1 //----------------------------------------------------------------------------- 
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> 
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or, 
   5 // at your option, any later version. See the LICENSE.txt file for the text of 
   7 //----------------------------------------------------------------------------- 
   8 // Data and Graph commands 
   9 //----------------------------------------------------------------------------- 
  15 #include "proxmark3.h" 
  19 #include "cmdparser.h" 
  26 uint8_t DemodBuffer
[MAX_DEMOD_BUF_LEN
]; 
  29 static int CmdHelp(const char *Cmd
); 
  31 //set the demod buffer with given array of binary (one bit per byte) 
  33 void setDemodBuf(uint8_t *buff
, size_t size
, size_t startIdx
) 
  36         for (; i 
< size
; i
++){ 
  37                 DemodBuffer
[i
]=buff
[startIdx
++]; 
  43 int CmdSetDebugMode(const char *Cmd
) 
  46   sscanf(Cmd
, "%i", &demod
); 
  47   g_debugMode
=(uint8_t)demod
; 
  55         int bitLen 
= DemodBufferLen
; 
  57                 PrintAndLog("no bits found in demod buffer"); 
  60         if (bitLen
>512) bitLen
=512; //max output to 512 bits if we have more - should be plenty 
  62         // ensure equally divided by 16 
  65         for (i 
= 0; i 
<= (bitLen
-16); i
+=16) { 
  66                 PrintAndLog("%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i", 
  88 int CmdAmp(const char *Cmd
) 
  90   int i
, rising
, falling
; 
  91   int max 
= INT_MIN
, min 
= INT_MAX
; 
  93   for (i 
= 10; i 
< GraphTraceLen
; ++i
) { 
  94     if (GraphBuffer
[i
] > max
) 
  96     if (GraphBuffer
[i
] < min
) 
 102     for (i 
= 0; i 
< GraphTraceLen
; ++i
) { 
 103       if (GraphBuffer
[i 
+ 1] < GraphBuffer
[i
]) { 
 105           GraphBuffer
[i
] = max
; 
 110       if (GraphBuffer
[i 
+ 1] > GraphBuffer
[i
]) { 
 112           GraphBuffer
[i
] = min
; 
 119   RepaintGraphWindow(); 
 124  * Generic command to demodulate ASK. 
 126  * Argument is convention: positive or negative (High mod means zero 
 127  * or high mod means one) 
 129  * Updates the Graph trace with 0/1 values 
 134  //this method is dependant on all highs and lows to be the same(or clipped)  this creates issues[marshmellow] it also ignores the clock 
 135 int Cmdaskdemod(const char *Cmd
) 
 138   int c
, high 
= 0, low 
= 0; 
 140   // TODO: complain if we do not give 2 arguments here ! 
 141   // (AL - this doesn't make sense! we're only using one argument!!!) 
 142   sscanf(Cmd
, "%i", &c
); 
 144   /* Detect high and lows and clock */ 
 146   for (i 
= 0; i 
< GraphTraceLen
; ++i
) 
 148     if (GraphBuffer
[i
] > high
) 
 149       high 
= GraphBuffer
[i
]; 
 150     else if (GraphBuffer
[i
] < low
) 
 151       low 
= GraphBuffer
[i
]; 
 155   if (c 
!= 0 && c 
!= 1) { 
 156     PrintAndLog("Invalid argument: %s", Cmd
); 
 160   if (GraphBuffer
[0] > 0) { 
 161     GraphBuffer
[0] = 1-c
; 
 165   for (i 
= 1; i 
< GraphTraceLen
; ++i
) { 
 166     /* Transitions are detected at each peak 
 167      * Transitions are either: 
 168      * - we're low: transition if we hit a high 
 169      * - we're high: transition if we hit a low 
 170      * (we need to do it this way because some tags keep high or 
 171      * low for long periods, others just reach the peak and go 
 174     //[marhsmellow] change == to >= for high and <= for low for fuzz 
 175     if ((GraphBuffer
[i
] == high
) && (GraphBuffer
[i 
- 1] == c
)) { 
 176       GraphBuffer
[i
] = 1 - c
; 
 177     } else if ((GraphBuffer
[i
] == low
) && (GraphBuffer
[i 
- 1] == (1 - c
))){ 
 181       GraphBuffer
[i
] = GraphBuffer
[i 
- 1]; 
 184   RepaintGraphWindow(); 
 189 void printBitStream(uint8_t BitStream
[], uint32_t bitLen
) 
 193                 PrintAndLog("Too few bits found: %d",bitLen
); 
 196         if (bitLen
>512) bitLen
=512; 
 198           // ensure equally divided by 16 
 202         for (i 
= 0; i 
<= (bitLen
-16); i
+=16) { 
 203                 PrintAndLog("%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i", 
 224 //print EM410x ID in multiple formats 
 225 void printEM410x(uint64_t id
) 
 232     for (ii
=5; ii
>0;ii
--){ 
 234         id2lo
=(id2lo
<<1LL) | ((id 
& (iii 
<< (i
+((ii
-1)*8)))) >> (i
+((ii
-1)*8))); 
 238     PrintAndLog("EM TAG ID    : %010llx", id
); 
 239     PrintAndLog("Unique TAG ID: %010llx",  id2lo
); 
 240     PrintAndLog("DEZ 8        : %08lld",id 
& 0xFFFFFF); 
 241     PrintAndLog("DEZ 10       : %010lld",id 
& 0xFFFFFF); 
 242     PrintAndLog("DEZ 5.5      : %05lld.%05lld",(id
>>16LL) & 0xFFFF,(id 
& 0xFFFF)); 
 243     PrintAndLog("DEZ 3.5A     : %03lld.%05lld",(id
>>32ll),(id 
& 0xFFFF)); 
 244     PrintAndLog("DEZ 14/IK2   : %014lld",id
); 
 245     PrintAndLog("DEZ 15/IK3   : %015lld",id2lo
); 
 246     PrintAndLog("Other        : %05lld_%03lld_%08lld",(id
&0xFFFF),((id
>>16LL) & 0xFF),(id 
& 0xFFFFFF)); 
 252 //takes 3 arguments - clock, invert and maxErr as integers 
 253 //attempts to demodulate ask while decoding manchester 
 254 //prints binary found and saves in graphbuffer for further commands 
 255 int CmdAskEM410xDemod(const char *Cmd
) 
 260   char cmdp 
= param_getchar(Cmd
, 0); 
 261   if (strlen(Cmd
) > 10 || cmdp 
== 'h' || cmdp 
== 'H') { 
 262     PrintAndLog("Usage:  data askem410xdemod [clock] <0|1> [maxError]"); 
 263     PrintAndLog("     [set clock as integer] optional, if not set, autodetect."); 
 264     PrintAndLog("     <invert>, 1 for invert output"); 
 265     PrintAndLog("     [set maximum allowed errors], default = 100."); 
 267     PrintAndLog("    sample: data askem410xdemod        = demod an EM410x Tag ID from GraphBuffer"); 
 268     PrintAndLog("          : data askem410xdemod 32     = demod an EM410x Tag ID from GraphBuffer using a clock of RF/32"); 
 269     PrintAndLog("          : data askem410xdemod 32 1   = demod an EM410x Tag ID from GraphBuffer using a clock of RF/32 and inverting data"); 
 270     PrintAndLog("          : data askem410xdemod 1      = demod an EM410x Tag ID from GraphBuffer while inverting data"); 
 271     PrintAndLog("          : data askem410xdemod 64 1 0 = demod an EM410x Tag ID from GraphBuffer using a clock of RF/64 and inverting data and allowing 0 demod errors"); 
 277   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
 278   sscanf(Cmd
, "%i %i %i", &clk
, &invert
, &maxErr
); 
 279   if (invert 
!= 0 && invert 
!= 1) { 
 280     PrintAndLog("Invalid argument: %s", Cmd
); 
 283   size_t BitLen 
= getFromGraphBuf(BitStream
); 
 285   if (g_debugMode
==1) PrintAndLog("DEBUG: Bitlen from grphbuff: %d",BitLen
); 
 286   if (BitLen
==0) return 0; 
 288   errCnt 
= askmandemod(BitStream
, &BitLen
, &clk
, &invert
, maxErr
); 
 289   if (errCnt
<0||BitLen
<16){  //if fatal error (or -1) 
 290     if (g_debugMode
==1) PrintAndLog("no data found %d, errors:%d, bitlen:%d, clock:%d",errCnt
,invert
,BitLen
,clk
); 
 293   PrintAndLog("\nUsing Clock: %d - Invert: %d - Bits Found: %d",clk
,invert
,BitLen
); 
 297     PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt
); 
 299   //PrintAndLog("ASK/Manchester decoded bitstream:"); 
 300   // Now output the bitstream to the scrollback by line of 16 bits 
 301   setDemodBuf(BitStream
,BitLen
,0); 
 305   lo 
= Em410xDecode(BitStream
, &BitLen
, &idx
); 
 307     //set GraphBuffer for clone or sim command 
 308     setDemodBuf(BitStream
, BitLen
, idx
); 
 310       PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx
, BitLen
); 
 313     PrintAndLog("EM410x pattern found: "); 
 321 //takes 3 arguments - clock, invert, maxErr as integers 
 322 //attempts to demodulate ask while decoding manchester 
 323 //prints binary found and saves in graphbuffer for further commands 
 324 int Cmdaskmandemod(const char *Cmd
) 
 329   char cmdp 
= param_getchar(Cmd
, 0); 
 330   if (strlen(Cmd
) > 10 || cmdp 
== 'h' || cmdp 
== 'H') { 
 331     PrintAndLog("Usage:  data askmandemod [clock] <0|1> [maxError]"); 
 332     PrintAndLog("     [set clock as integer] optional, if not set, autodetect."); 
 333     PrintAndLog("     <invert>, 1 for invert output"); 
 334     PrintAndLog("     [set maximum allowed errors], default = 100."); 
 336     PrintAndLog("    sample: data askmandemod        = demod an ask/manchester tag from GraphBuffer"); 
 337     PrintAndLog("          : data askmandemod 32     = demod an ask/manchester tag from GraphBuffer using a clock of RF/32"); 
 338     PrintAndLog("          : data askmandemod 32 1   = demod an ask/manchester tag from GraphBuffer using a clock of RF/32 and inverting data"); 
 339     PrintAndLog("          : data askmandemod 1      = demod an ask/manchester tag from GraphBuffer while inverting data"); 
 340     PrintAndLog("          : data askmandemod 64 1 0 = demod an ask/manchester tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors"); 
 344   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
 345   sscanf(Cmd
, "%i %i %i", &clk
, &invert
, &maxErr
); 
 346   if (invert 
!= 0 && invert 
!= 1) { 
 347     PrintAndLog("Invalid argument: %s", Cmd
); 
 354   size_t BitLen 
= getFromGraphBuf(BitStream
); 
 355   if (g_debugMode
==1) PrintAndLog("DEBUG: Bitlen from grphbuff: %d",BitLen
); 
 356   if (BitLen
==0) return 0; 
 358   errCnt 
= askmandemod(BitStream
, &BitLen
, &clk
, &invert
, maxErr
); 
 359   if (errCnt
<0||BitLen
<16){  //if fatal error (or -1) 
 360     if (g_debugMode
==1) PrintAndLog("no data found %d, errors:%d, bitlen:%d, clock:%d",errCnt
,invert
,BitLen
,clk
); 
 363   PrintAndLog("\nUsing Clock: %d - Invert: %d - Bits Found: %d",clk
,invert
,BitLen
); 
 367     PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt
); 
 369   PrintAndLog("ASK/Manchester decoded bitstream:"); 
 370   // Now output the bitstream to the scrollback by line of 16 bits 
 371   setDemodBuf(BitStream
,BitLen
,0); 
 375   lo 
= Em410xDecode(BitStream
, &BitLen
, &idx
); 
 377     //set GraphBuffer for clone or sim command 
 378     setDemodBuf(BitStream
, BitLen
, idx
); 
 380       PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx
, BitLen
); 
 383     PrintAndLog("EM410x pattern found: "); 
 392 //stricktly take 10 and 01 and convert to 0 and 1 
 393 int Cmdmandecoderaw(const char *Cmd
) 
 399   char cmdp 
= param_getchar(Cmd
, 0); 
 400   if (strlen(Cmd
) > 1 || cmdp 
== 'h' || cmdp 
== 'H') { 
 401     PrintAndLog("Usage:  data manrawdecode"); 
 402     PrintAndLog("     Takes 10 and 01 and converts to 0 and 1 respectively"); 
 403     PrintAndLog("     --must have binary sequence in demodbuffer (run data askrawdemod first)"); 
 405     PrintAndLog("    sample: data manrawdecode   = decode manchester bitstream from the demodbuffer"); 
 408   if (DemodBufferLen
==0) return 0; 
 409   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
 411   for (;i
<DemodBufferLen
;++i
){ 
 412     if (DemodBuffer
[i
]>high
) high
=DemodBuffer
[i
]; 
 413     else if(DemodBuffer
[i
]<low
) low
=DemodBuffer
[i
]; 
 414     BitStream
[i
]=DemodBuffer
[i
]; 
 416   if (high
>1 || low 
<0 ){ 
 417     PrintAndLog("Error: please raw demod the wave first then mancheseter raw decode"); 
 421   errCnt
=manrawdecode(BitStream
, &size
); 
 423     PrintAndLog("Too many errors: %d",errCnt
); 
 426   PrintAndLog("Manchester Decoded - # errors:%d - data:",errCnt
); 
 427   printBitStream(BitStream
, size
); 
 431     id 
= Em410xDecode(BitStream
, &size
, &idx
); 
 433       //need to adjust to set bitstream back to manchester encoded data 
 434       //setDemodBuf(BitStream, size, idx); 
 444 //take 01 or 10 = 0 and 11 or 00 = 1 
 445 //takes 2 arguments "offset" default = 0 if 1 it will shift the decode by one bit 
 446 // and "invert" default = 0 if 1 it will invert output 
 447 //  since it is not like manchester and doesn't have an incorrect bit pattern we 
 448 //  cannot determine if our decode is correct or if it should be shifted by one bit 
 449 //  the argument offset allows us to manually shift if the output is incorrect 
 450 //  (better would be to demod and decode at the same time so we can distinguish large 
 451 //    width waves vs small width waves to help the decode positioning) or askbiphdemod 
 452 int CmdBiphaseDecodeRaw(const char *Cmd
) 
 460         char cmdp 
= param_getchar(Cmd
, 0); 
 461         if (strlen(Cmd
) > 3 || cmdp 
== 'h' || cmdp 
== 'H') { 
 462                 PrintAndLog("Usage:  data biphaserawdecode [offset] <invert>"); 
 463                 PrintAndLog("     Converts 10 or 01 to 0 and 11 or 00 to 1"); 
 464                 PrintAndLog("     --must have binary sequence in demodbuffer (run data askrawdemod first)"); 
 466                 PrintAndLog("     [offset <0|1>], set to 0 not to adjust start position or to 1 to adjust decode start position"); 
 467                 PrintAndLog("     [invert <0|1>], set to 1 to invert output"); 
 469                 PrintAndLog("    sample: data biphaserawdecode     = decode biphase bitstream from the demodbuffer"); 
 470                 PrintAndLog("    sample: data biphaserawdecode 1 1 = decode biphase bitstream from the demodbuffer, set offset, and invert output"); 
 473         sscanf(Cmd
, "%i %i", &offset
, &invert
); 
 474         if (DemodBufferLen
==0) return 0; 
 475         uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
 476         //get graphbuffer & high and low 
 477         for (;i
<DemodBufferLen
;++i
){ 
 478                 if(DemodBuffer
[i
]>high
)high
=DemodBuffer
[i
]; 
 479                 else if(DemodBuffer
[i
]<low
)low
=DemodBuffer
[i
]; 
 480                 BitStream
[i
]=DemodBuffer
[i
]; 
 482         if (high
>1 || low 
<0){ 
 483                 PrintAndLog("Error: please raw demod the wave first then decode"); 
 487         errCnt
=BiphaseRawDecode(BitStream
, &size
, offset
, invert
); 
 489                 PrintAndLog("Too many errors attempting to decode: %d",errCnt
); 
 492         PrintAndLog("Biphase Decoded using offset: %d - # errors:%d - data:",offset
,errCnt
); 
 493         printBitStream(BitStream
, size
); 
 494         PrintAndLog("\nif bitstream does not look right try offset=1"); 
 499 //takes 4 arguments - clock, invert, maxErr as integers and amplify as char 
 500 //attempts to demodulate ask only 
 501 //prints binary found and saves in graphbuffer for further commands 
 502 int Cmdaskrawdemod(const char *Cmd
) 
 508   char amp 
= param_getchar(Cmd
, 0); 
 509   char cmdp 
= param_getchar(Cmd
, 0); 
 510   if (strlen(Cmd
) > 12 || cmdp 
== 'h' || cmdp 
== 'H') { 
 511     PrintAndLog("Usage:  data askrawdemod [clock] <invert> [maxError] [amplify]"); 
 512     PrintAndLog("     [set clock as integer] optional, if not set, autodetect"); 
 513     PrintAndLog("     <invert>, 1 to invert output"); 
 514     PrintAndLog("     [set maximum allowed errors], default = 100"); 
 515     PrintAndLog("     <amplify>, 'a' to attempt demod with ask amplification, default = no amp"); 
 517     PrintAndLog("    sample: data askrawdemod          = demod an ask tag from GraphBuffer"); 
 518     PrintAndLog("          : data askrawdemod a        = demod an ask tag from GraphBuffer, amplified"); 
 519     PrintAndLog("          : data askrawdemod 32       = demod an ask tag from GraphBuffer using a clock of RF/32"); 
 520     PrintAndLog("          : data askrawdemod 32 1     = demod an ask tag from GraphBuffer using a clock of RF/32 and inverting data"); 
 521     PrintAndLog("          : data askrawdemod 1        = demod an ask tag from GraphBuffer while inverting data"); 
 522     PrintAndLog("          : data askrawdemod 64 1 0   = demod an ask tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors"); 
 523     PrintAndLog("          : data askrawdemod 64 1 0 a = demod an ask tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors, and amp"); 
 526   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
 527   sscanf(Cmd
, "%i %i %i %c", &clk
, &invert
, &maxErr
, &
); 
 528   if (invert 
!= 0 && invert 
!= 1) { 
 529     PrintAndLog("Invalid argument: %s", Cmd
); 
 536   if (amp 
== 'a' || amp 
== 'A') askAmp
=1;  
 537   size_t BitLen 
= getFromGraphBuf(BitStream
); 
 538   if (BitLen
==0) return 0; 
 540   errCnt 
= askrawdemod(BitStream
, &BitLen
, &clk
, &invert
, maxErr
, askAmp
); 
 541   if (errCnt
==-1||BitLen
<16){  //throw away static - allow 1 and -1 (in case of threshold command first) 
 542     PrintAndLog("no data found"); 
 543     if (g_debugMode
==1) PrintAndLog("errCnt: %d, BitLen: %d, clk: %d, invert: %d", errCnt
, BitLen
, clk
, invert
); 
 546   PrintAndLog("Using Clock: %d - invert: %d - Bits Found: %d", clk
, invert
, BitLen
); 
 548   //move BitStream back to DemodBuffer 
 549   setDemodBuf(BitStream
,BitLen
,0); 
 553     PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d", errCnt
); 
 555   PrintAndLog("ASK demoded bitstream:"); 
 556   // Now output the bitstream to the scrollback by line of 16 bits 
 557   printBitStream(BitStream
,BitLen
); 
 562 int CmdAutoCorr(const char *Cmd
) 
 564   static int CorrelBuffer
[MAX_GRAPH_TRACE_LEN
]; 
 566   int window 
= atoi(Cmd
); 
 569     PrintAndLog("needs a window"); 
 572   if (window 
>= GraphTraceLen
) { 
 573     PrintAndLog("window must be smaller than trace (%d samples)", 
 578   PrintAndLog("performing %d correlations", GraphTraceLen 
- window
); 
 580   for (int i 
= 0; i 
< GraphTraceLen 
- window
; ++i
) { 
 582     for (int j 
= 0; j 
< window
; ++j
) { 
 583       sum 
+= (GraphBuffer
[j
]*GraphBuffer
[i 
+ j
]) / 256; 
 585     CorrelBuffer
[i
] = sum
; 
 587   GraphTraceLen 
= GraphTraceLen 
- window
; 
 588   memcpy(GraphBuffer
, CorrelBuffer
, GraphTraceLen 
* sizeof (int)); 
 590   RepaintGraphWindow(); 
 594 int CmdBitsamples(const char *Cmd
) 
 599   GetFromBigBuf(got
,sizeof(got
),0); 
 600   WaitForResponse(CMD_ACK
,NULL
); 
 602     for (int j 
= 0; j 
< sizeof(got
); j
++) { 
 603       for (int k 
= 0; k 
< 8; k
++) { 
 604         if(got
[j
] & (1 << (7 - k
))) { 
 605           GraphBuffer
[cnt
++] = 1; 
 607           GraphBuffer
[cnt
++] = 0; 
 612   RepaintGraphWindow(); 
 617  * Convert to a bitstream 
 619 int CmdBitstream(const char *Cmd
) 
 627   int hithigh
, hitlow
, first
; 
 629   /* Detect high and lows and clock */ 
 630   for (i 
= 0; i 
< GraphTraceLen
; ++i
) 
 632     if (GraphBuffer
[i
] > high
) 
 633       high 
= GraphBuffer
[i
]; 
 634     else if (GraphBuffer
[i
] < low
) 
 635       low 
= GraphBuffer
[i
]; 
 639   clock 
= GetClock(Cmd
, high
, 1); 
 643   for (i 
= 0; i 
< (int)(gtl 
/ clock
); ++i
) 
 648     /* Find out if we hit both high and low peaks */ 
 649     for (j 
= 0; j 
< clock
; ++j
) 
 651       if (GraphBuffer
[(i 
* clock
) + j
] == high
) 
 653       else if (GraphBuffer
[(i 
* clock
) + j
] == low
) 
 655       /* it doesn't count if it's the first part of our read 
 656          because it's really just trailing from the last sequence */ 
 657       if (first 
&& (hithigh 
|| hitlow
)) 
 658         hithigh 
= hitlow 
= 0; 
 662       if (hithigh 
&& hitlow
) 
 666     /* If we didn't hit both high and low peaks, we had a bit transition */ 
 667     if (!hithigh 
|| !hitlow
) 
 670     AppendGraph(0, clock
, bit
); 
 673   RepaintGraphWindow(); 
 677 int CmdBuffClear(const char *Cmd
) 
 679   UsbCommand c 
= {CMD_BUFF_CLEAR
}; 
 685 int CmdDec(const char *Cmd
) 
 687   for (int i 
= 0; i 
< (GraphTraceLen 
/ 2); ++i
) 
 688     GraphBuffer
[i
] = GraphBuffer
[i 
* 2]; 
 690   PrintAndLog("decimated by 2"); 
 691   RepaintGraphWindow(); 
 695  * Undecimate - I'd call it 'interpolate', but we'll save that 
 696  * name until someone does an actual interpolation command, not just 
 697  * blindly repeating samples 
 701 int CmdUndec(const char *Cmd
) 
 703         if(param_getchar(Cmd
, 0) == 'h') 
 705                 PrintAndLog("Usage: data undec [factor]"); 
 706                 PrintAndLog("This function performs un-decimation, by repeating each sample N times"); 
 707                 PrintAndLog("Options:        "); 
 708                 PrintAndLog("       h            This help"); 
 709                 PrintAndLog("       factor       The number of times to repeat each sample.[default:2]"); 
 710                 PrintAndLog("Example: 'data undec 3'"); 
 714         uint8_t factor 
= param_get8ex(Cmd
, 0,2, 10); 
 715         //We have memory, don't we? 
 716         int swap
[MAX_GRAPH_TRACE_LEN
] = { 0 }; 
 717         uint32_t g_index 
= 0 ,s_index 
= 0; 
 718         while(g_index 
< GraphTraceLen 
&& s_index 
< MAX_GRAPH_TRACE_LEN
) 
 721                 for(count 
= 0; count 
< factor 
&& s_index
+count 
< MAX_GRAPH_TRACE_LEN
; count 
++) 
 722                         swap
[s_index
+count
] = GraphBuffer
[g_index
]; 
 726         memcpy(GraphBuffer
,swap
, s_index 
* sizeof(int)); 
 727         GraphTraceLen 
= s_index
; 
 728         RepaintGraphWindow(); 
 733 //shift graph zero up or down based on input + or - 
 734 int CmdGraphShiftZero(const char *Cmd
) 
 738   //set options from parameters entered with the command 
 739   sscanf(Cmd
, "%i", &shift
); 
 741   for(int i 
= 0; i
<GraphTraceLen
; i
++){ 
 742     shiftedVal
=GraphBuffer
[i
]+shift
; 
 745     else if (shiftedVal
<-127)  
 747     GraphBuffer
[i
]= shiftedVal
; 
 754 //use large jumps in read samples to identify edges of waves and then amplify that wave to max 
 755 //similar to dirtheshold, threshold, and askdemod commands  
 756 //takes a threshold length which is the measured length between two samples then determines an edge 
 757 int CmdAskEdgeDetect(const char *Cmd
) 
 760   sscanf(Cmd
, "%i", &thresLen
);  
 763   for(int i 
= 1; i
<GraphTraceLen
; i
++){ 
 764     if (GraphBuffer
[i
]-GraphBuffer
[i
-1]>=thresLen
) //large jump up 
 766     else if(GraphBuffer
[i
]-GraphBuffer
[i
-1]<=-1*thresLen
) //large jump down 
 769     shiftedVal
=GraphBuffer
[i
]+shift
; 
 773     else if (shiftedVal
<-127)  
 775     GraphBuffer
[i
-1] = shiftedVal
; 
 777   RepaintGraphWindow(); 
 782 /* Print our clock rate */ 
 783 // uses data from graphbuffer 
 784 int CmdDetectClockRate(const char *Cmd
) 
 786   int ans 
= GetClock("",0,0); 
 791 //fsk raw demod and print binary 
 792 //takes 4 arguments - Clock, invert, fchigh, fclow 
 793 //defaults: clock = 50, invert=1, fchigh=10, fclow=8 (RF/10 RF/8 (fsk2a)) 
 794 int CmdFSKrawdemod(const char *Cmd
) 
 796   //raw fsk demod  no manchester decoding no start bit finding just get binary from wave 
 802   char cmdp 
= param_getchar(Cmd
, 0); 
 803   if (strlen(Cmd
) > 10 || cmdp 
== 'h' || cmdp 
== 'H') { 
 804     PrintAndLog("Usage:  data fskrawdemod [clock] <invert> [fchigh] [fclow]"); 
 805     PrintAndLog("     [set clock as integer] optional, omit for autodetect."); 
 806     PrintAndLog("     <invert>, 1 for invert output, can be used even if the clock is omitted"); 
 807     PrintAndLog("     [fchigh], larger field clock length, omit for autodetect"); 
 808     PrintAndLog("     [fclow], small field clock length, omit for autodetect"); 
 810     PrintAndLog("    sample: data fskrawdemod           = demod an fsk tag from GraphBuffer using autodetect"); 
 811     PrintAndLog("          : data fskrawdemod 32        = demod an fsk tag from GraphBuffer using a clock of RF/32, autodetect fc"); 
 812     PrintAndLog("          : data fskrawdemod 1         = demod an fsk tag from GraphBuffer using autodetect, invert output");    
 813     PrintAndLog("          : data fskrawdemod 32 1      = demod an fsk tag from GraphBuffer using a clock of RF/32, invert output, autodetect fc"); 
 814     PrintAndLog("          : data fskrawdemod 64 0 8 5  = demod an fsk1 RF/64 tag from GraphBuffer"); 
 815     PrintAndLog("          : data fskrawdemod 50 0 10 8 = demod an fsk2 RF/50 tag from GraphBuffer"); 
 816     PrintAndLog("          : data fskrawdemod 50 1 10 8 = demod an fsk2a RF/50 tag from GraphBuffer"); 
 819   //set options from parameters entered with the command 
 820   sscanf(Cmd
, "%i %i %i %i", &rfLen
, &invert
, &fchigh
, &fclow
); 
 822   if (strlen(Cmd
)>0 && strlen(Cmd
)<=2) { 
 824       invert
=1;   //if invert option only is used 
 829   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
 830   size_t BitLen 
= getFromGraphBuf(BitStream
); 
 831   if (BitLen
==0) return 0; 
 832   //get field clock lengths 
 835   if (fchigh
==0 || fclow 
== 0){ 
 836     fcs
=countFC(BitStream
, BitLen
, &dummy
); 
 841       fchigh 
= (fcs 
>> 8) & 0xFF; 
 845   //get bit clock length 
 847     rfLen 
= detectFSKClk(BitStream
, BitLen
, fchigh
, fclow
); 
 848     if (rfLen 
== 0) rfLen 
= 50; 
 850   PrintAndLog("Args invert: %d - Clock:%d - fchigh:%d - fclow: %d",invert
,rfLen
,fchigh
, fclow
); 
 851   int size 
= fskdemod(BitStream
,BitLen
,(uint8_t)rfLen
,(uint8_t)invert
,(uint8_t)fchigh
,(uint8_t)fclow
); 
 853     PrintAndLog("FSK decoded bitstream:"); 
 854     setDemodBuf(BitStream
,size
,0); 
 856     // Now output the bitstream to the scrollback by line of 16 bits 
 857     if(size 
> (8*32)+2) size 
= (8*32)+2; //only output a max of 8 blocks of 32 bits  most tags will have full bit stream inside that sample size 
 858     printBitStream(BitStream
,size
); 
 861     PrintAndLog("no FSK data found"); 
 866 //by marshmellow (based on existing demod + holiman's refactor) 
 867 //HID Prox demod - FSK RF/50 with preamble of 00011101 (then manchester encoded) 
 868 //print full HID Prox ID and some bit format details if found 
 869 int CmdFSKdemodHID(const char *Cmd
) 
 871   //raw fsk demod no manchester decoding no start bit finding just get binary from wave 
 872   uint32_t hi2
=0, hi
=0, lo
=0; 
 874   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
 875   size_t BitLen 
= getFromGraphBuf(BitStream
); 
 876   if (BitLen
==0) return 0; 
 877   //get binary from fsk wave 
 878   int idx 
= HIDdemodFSK(BitStream
,&BitLen
,&hi2
,&hi
,&lo
); 
 882         PrintAndLog("DEBUG: Just Noise Detected"); 
 883       } else if (idx 
== -2) { 
 884         PrintAndLog("DEBUG: Error demoding fsk"); 
 885       } else if (idx 
== -3) { 
 886         PrintAndLog("DEBUG: Preamble not found"); 
 887       } else if (idx 
== -4) { 
 888         PrintAndLog("DEBUG: Error in Manchester data, SIZE: %d", BitLen
); 
 890         PrintAndLog("DEBUG: Error demoding fsk %d", idx
); 
 895   if (hi2
==0 && hi
==0 && lo
==0) { 
 896     if (g_debugMode
) PrintAndLog("DEBUG: Error - no values found"); 
 899   if (hi2 
!= 0){ //extra large HID tags 
 900     PrintAndLog("HID Prox TAG ID: %x%08x%08x (%d)", 
 901        (unsigned int) hi2
, (unsigned int) hi
, (unsigned int) lo
, (unsigned int) (lo
>>1) & 0xFFFF); 
 903   else {  //standard HID tags <38 bits 
 906     uint32_t cardnum 
= 0; 
 907     if (((hi
>>5)&1)==1){//if bit 38 is set then < 37 bit format is used 
 909       lo2
=(((hi 
& 31) << 12) | (lo
>>20)); //get bits 21-37 to check for format len bit 
 911       while(lo2
>1){ //find last bit set to 1 (format len bit) 
 919         cardnum 
= (lo
>>1)&0xFFFF; 
 923         cardnum 
= (lo
>>1)&0xFFFF; 
 924         fc
= ((hi
&1)<<15)|(lo
>>17); 
 927         cardnum 
= (lo
>>1)&0xFFFFF; 
 928         fc 
= ((hi
&1)<<11)|(lo
>>21); 
 931     else { //if bit 38 is not set then 37 bit format is used 
 936         cardnum 
= (lo
>>1)&0x7FFFF; 
 937         fc 
= ((hi
&0xF)<<12)|(lo
>>20); 
 940     PrintAndLog("HID Prox TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d", 
 941       (unsigned int) hi
, (unsigned int) lo
, (unsigned int) (lo
>>1) & 0xFFFF, 
 942       (unsigned int) fmtLen
, (unsigned int) fc
, (unsigned int) cardnum
); 
 944   setDemodBuf(BitStream
,BitLen
,idx
); 
 946     PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx
, BitLen
); 
 953 //Paradox Prox demod - FSK RF/50 with preamble of 00001111 (then manchester encoded) 
 954 //print full Paradox Prox ID and some bit format details if found 
 955 int CmdFSKdemodParadox(const char *Cmd
) 
 957   //raw fsk demod no manchester decoding no start bit finding just get binary from wave 
 958   uint32_t hi2
=0, hi
=0, lo
=0; 
 960   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
 961   size_t BitLen 
= getFromGraphBuf(BitStream
); 
 962   if (BitLen
==0) return 0; 
 963   //get binary from fsk wave 
 964   int idx 
= ParadoxdemodFSK(BitStream
,&BitLen
,&hi2
,&hi
,&lo
); 
 968         PrintAndLog("DEBUG: Just Noise Detected");      
 969       } else if (idx 
== -2) { 
 970         PrintAndLog("DEBUG: Error demoding fsk"); 
 971       } else if (idx 
== -3) { 
 972         PrintAndLog("DEBUG: Preamble not found"); 
 973       } else if (idx 
== -4) { 
 974         PrintAndLog("DEBUG: Error in Manchester data"); 
 976         PrintAndLog("DEBUG: Error demoding fsk %d", idx
); 
 981   if (hi2
==0 && hi
==0 && lo
==0){ 
 982     if (g_debugMode
) PrintAndLog("DEBUG: Error - no value found"); 
 985   uint32_t fc 
= ((hi 
& 0x3)<<6) | (lo
>>26); 
 986   uint32_t cardnum 
= (lo
>>10)&0xFFFF; 
 988   PrintAndLog("Paradox TAG ID: %x%08x - FC: %d - Card: %d - Checksum: %02x", 
 989     hi
>>10, (hi 
& 0x3)<<26 | (lo
>>10), fc
, cardnum
, (lo
>>2) & 0xFF ); 
 990   setDemodBuf(BitStream
,BitLen
,idx
); 
 992     PrintAndLog("DEBUG: idx: %d, len: %d, Printing Demod Buffer:", idx
, BitLen
); 
1000 //IO-Prox demod - FSK RF/64 with preamble of 000000001 
1001 //print ioprox ID and some format details 
1002 int CmdFSKdemodIO(const char *Cmd
) 
1004   //raw fsk demod no manchester decoding no start bit finding just get binary from wave 
1007   //something in graphbuffer? 
1008   if (GraphTraceLen 
< 65) { 
1009     if (g_debugMode
)PrintAndLog("DEBUG: not enough samples in GraphBuffer"); 
1012   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
1013   size_t BitLen 
= getFromGraphBuf(BitStream
); 
1014   if (BitLen
==0) return 0; 
1016   //get binary from fsk wave 
1017   idx 
= IOdemodFSK(BitStream
,BitLen
); 
1021         PrintAndLog("DEBUG: Just Noise Detected");      
1022       } else if (idx 
== -2) { 
1023         PrintAndLog("DEBUG: not enough samples"); 
1024       } else if (idx 
== -3) { 
1025         PrintAndLog("DEBUG: error during fskdemod");         
1026       } else if (idx 
== -4) { 
1027         PrintAndLog("DEBUG: Preamble not found"); 
1028       } else if (idx 
== -5) { 
1029         PrintAndLog("DEBUG: Separator bits not found"); 
1031         PrintAndLog("DEBUG: Error demoding fsk %d", idx
); 
1037     if (g_debugMode
==1){ 
1038       PrintAndLog("DEBUG: IO Prox Data not found - FSK Bits: %d",BitLen
); 
1039       if (BitLen 
> 92) printBitStream(BitStream
,92); 
1044     //0           10          20          30          40          50          60 
1046     //01234567 8 90123456 7 89012345 6 78901234 5 67890123 4 56789012 3 45678901 23 
1047     //----------------------------------------------------------------------------- 
1048     //00000000 0 11110000 1 facility 1 version* 1 code*one 1 code*two 1 ???????? 11 
1050     //XSF(version)facility:codeone+codetwo (raw) 
1052   if (idx
+64>BitLen
) { 
1053     if (g_debugMode
==1) PrintAndLog("not enough bits found - bitlen: %d",BitLen
); 
1056   PrintAndLog("%d%d%d%d%d%d%d%d %d",BitStream
[idx
],    BitStream
[idx
+1],  BitStream
[idx
+2], BitStream
[idx
+3], BitStream
[idx
+4], BitStream
[idx
+5], BitStream
[idx
+6], BitStream
[idx
+7], BitStream
[idx
+8]); 
1057   PrintAndLog("%d%d%d%d%d%d%d%d %d",BitStream
[idx
+9],  BitStream
[idx
+10], BitStream
[idx
+11],BitStream
[idx
+12],BitStream
[idx
+13],BitStream
[idx
+14],BitStream
[idx
+15],BitStream
[idx
+16],BitStream
[idx
+17]); 
1058   PrintAndLog("%d%d%d%d%d%d%d%d %d facility",BitStream
[idx
+18], BitStream
[idx
+19], BitStream
[idx
+20],BitStream
[idx
+21],BitStream
[idx
+22],BitStream
[idx
+23],BitStream
[idx
+24],BitStream
[idx
+25],BitStream
[idx
+26]); 
1059   PrintAndLog("%d%d%d%d%d%d%d%d %d version",BitStream
[idx
+27], BitStream
[idx
+28], BitStream
[idx
+29],BitStream
[idx
+30],BitStream
[idx
+31],BitStream
[idx
+32],BitStream
[idx
+33],BitStream
[idx
+34],BitStream
[idx
+35]); 
1060   PrintAndLog("%d%d%d%d%d%d%d%d %d code1",BitStream
[idx
+36], BitStream
[idx
+37], BitStream
[idx
+38],BitStream
[idx
+39],BitStream
[idx
+40],BitStream
[idx
+41],BitStream
[idx
+42],BitStream
[idx
+43],BitStream
[idx
+44]); 
1061   PrintAndLog("%d%d%d%d%d%d%d%d %d code2",BitStream
[idx
+45], BitStream
[idx
+46], BitStream
[idx
+47],BitStream
[idx
+48],BitStream
[idx
+49],BitStream
[idx
+50],BitStream
[idx
+51],BitStream
[idx
+52],BitStream
[idx
+53]); 
1062   PrintAndLog("%d%d%d%d%d%d%d%d %d%d checksum",BitStream
[idx
+54],BitStream
[idx
+55],BitStream
[idx
+56],BitStream
[idx
+57],BitStream
[idx
+58],BitStream
[idx
+59],BitStream
[idx
+60],BitStream
[idx
+61],BitStream
[idx
+62],BitStream
[idx
+63]); 
1064   uint32_t code 
= bytebits_to_byte(BitStream
+idx
,32); 
1065   uint32_t code2 
= bytebits_to_byte(BitStream
+idx
+32,32); 
1066   uint8_t version 
= bytebits_to_byte(BitStream
+idx
+27,8); //14,4 
1067   uint8_t facilitycode 
= bytebits_to_byte(BitStream
+idx
+18,8) ; 
1068   uint16_t number 
= (bytebits_to_byte(BitStream
+idx
+36,8)<<8)|(bytebits_to_byte(BitStream
+idx
+45,8)); //36,9 
1069   PrintAndLog("IO Prox XSF(%02d)%02x:%05d (%08x%08x)",version
,facilitycode
,number
,code
,code2
); 
1070   setDemodBuf(BitStream
,64,idx
); 
1072     PrintAndLog("DEBUG: idx: %d, Len: %d, Printing demod buffer:",idx
,64); 
1080 //AWID Prox demod - FSK RF/50 with preamble of 00000001  (always a 96 bit data stream) 
1081 //print full AWID Prox ID and some bit format details if found 
1082 int CmdFSKdemodAWID(const char *Cmd
) 
1086   //sscanf(Cmd, "%i", &verbose); 
1088   //raw fsk demod no manchester decoding no start bit finding just get binary from wave 
1089   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
1090   size_t size 
= getFromGraphBuf(BitStream
); 
1091   if (size
==0) return 0; 
1093   //get binary from fsk wave 
1094   int idx 
= AWIDdemodFSK(BitStream
, &size
); 
1096     if (g_debugMode
==1){ 
1098         PrintAndLog("DEBUG: Error - not enough samples"); 
1100         PrintAndLog("DEBUG: Error - only noise found"); 
1102         PrintAndLog("DEBUG: Error - problem during FSK demod"); 
1104         PrintAndLog("DEBUG: Error - AWID preamble not found"); 
1106         PrintAndLog("DEBUG: Error - Size not correct: %d", size
); 
1108         PrintAndLog("DEBUG: Error %d",idx
); 
1114   // 0            10            20            30              40            50              60 
1116   // 01234567 890 1 234 5 678 9 012 3 456 7 890 1 234 5 678 9 012 3 456 7 890 1 234 5 678 9 012 3 - to 96 
1117   // ----------------------------------------------------------------------------- 
1118   // 00000001 000 1 110 1 101 1 011 1 101 1 010 0 000 1 000 1 010 0 001 0 110 1 100 0 000 1 000 1 
1119   // premable bbb o bbb o bbw o fff o fff o ffc o ccc o ccc o ccc o ccc o ccc o wxx o xxx o xxx o - to 96 
1120   //          |---26 bit---|    |-----117----||-------------142-------------| 
1121   // b = format bit len, o = odd parity of last 3 bits 
1122   // f = facility code, c = card number 
1123   // w = wiegand parity 
1124   // (26 bit format shown) 
1126   //get raw ID before removing parities 
1127   uint32_t rawLo 
= bytebits_to_byte(BitStream
+idx
+64,32); 
1128   uint32_t rawHi 
= bytebits_to_byte(BitStream
+idx
+32,32); 
1129   uint32_t rawHi2 
= bytebits_to_byte(BitStream
+idx
,32); 
1130   setDemodBuf(BitStream
,96,idx
); 
1132   size 
= removeParity(BitStream
, idx
+8, 4, 1, 88); 
1134     if (g_debugMode
==1) PrintAndLog("DEBUG: Error - at parity check-tag size does not match AWID format"); 
1137   // ok valid card found! 
1140   // 0           10         20        30          40        50        60 
1142   // 01234567 8 90123456 7890123456789012 3 456789012345678901234567890123456 
1143   // ----------------------------------------------------------------------------- 
1144   // 00011010 1 01110101 0000000010001110 1 000000000000000000000000000000000 
1145   // bbbbbbbb w ffffffff cccccccccccccccc w xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 
1146   // |26 bit|   |-117--| |-----142------| 
1147   // b = format bit len, o = odd parity of last 3 bits 
1148   // f = facility code, c = card number 
1149   // w = wiegand parity 
1150   // (26 bit format shown) 
1153   uint32_t cardnum 
= 0; 
1156   uint8_t fmtLen 
= bytebits_to_byte(BitStream
,8); 
1158     fc 
= bytebits_to_byte(BitStream
+9, 8); 
1159     cardnum 
= bytebits_to_byte(BitStream
+17, 16); 
1160     code1 
= bytebits_to_byte(BitStream
+8,fmtLen
); 
1161     PrintAndLog("AWID Found - BitLength: %d, FC: %d, Card: %d - Wiegand: %x, Raw: %x%08x%08x", fmtLen
, fc
, cardnum
, code1
, rawHi2
, rawHi
, rawLo
); 
1163     cardnum 
= bytebits_to_byte(BitStream
+8+(fmtLen
-17), 16); 
1165       code1 
= bytebits_to_byte(BitStream
+8,fmtLen
-32); 
1166       code2 
= bytebits_to_byte(BitStream
+8+(fmtLen
-32),32); 
1167       PrintAndLog("AWID Found - BitLength: %d -unknown BitLength- (%d) - Wiegand: %x%08x, Raw: %x%08x%08x", fmtLen
, cardnum
, code1
, code2
, rawHi2
, rawHi
, rawLo
); 
1169       code1 
= bytebits_to_byte(BitStream
+8,fmtLen
); 
1170       PrintAndLog("AWID Found - BitLength: %d -unknown BitLength- (%d) - Wiegand: %x, Raw: %x%08x%08x", fmtLen
, cardnum
, code1
, rawHi2
, rawHi
, rawLo
); 
1174     PrintAndLog("DEBUG: idx: %d, Len: %d Printing Demod Buffer:", idx
, 96); 
1177   //todo - convert hi2, hi, lo to demodbuffer for future sim/clone commands 
1182 //Pyramid Prox demod - FSK RF/50 with preamble of 0000000000000001  (always a 128 bit data stream) 
1183 //print full Farpointe Data/Pyramid Prox ID and some bit format details if found 
1184 int CmdFSKdemodPyramid(const char *Cmd
) 
1186   //raw fsk demod no manchester decoding no start bit finding just get binary from wave 
1187   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
1188   size_t size 
= getFromGraphBuf(BitStream
); 
1189   if (size
==0) return 0; 
1191   //get binary from fsk wave 
1192   int idx 
= PyramiddemodFSK(BitStream
, &size
); 
1194     if (g_debugMode
==1){ 
1196         PrintAndLog("DEBUG: Error - not enough samples"); 
1198         PrintAndLog("DEBUG: Error - only noise found"); 
1200         PrintAndLog("DEBUG: Error - problem during FSK demod"); 
1202         PrintAndLog("DEBUG: Error - Size not correct: %d", size
); 
1204         PrintAndLog("DEBUG: Error - Pyramid preamble not found"); 
1206         PrintAndLog("DEBUG: Error - idx: %d",idx
); 
1211   // 0           10          20          30            40          50          60 
1213   // 0123456 7 8901234 5 6789012 3 4567890 1 2345678 9 0123456 7 8901234 5 6789012 3 
1214   // ----------------------------------------------------------------------------- 
1215   // 0000000 0 0000000 1 0000000 1 0000000 1 0000000 1 0000000 1 0000000 1 0000000 1 
1216   // premable  xxxxxxx o xxxxxxx o xxxxxxx o xxxxxxx o xxxxxxx o xxxxxxx o xxxxxxx o 
1218   // 64    70            80          90          100         110           120 
1220   // 4567890 1 2345678 9 0123456 7 8901234 5 6789012 3 4567890 1 2345678 9 0123456 7 
1221   // ----------------------------------------------------------------------------- 
1222   // 0000000 1 0000000 1 0000000 1 0110111 0 0011000 1 0000001 0 0001100 1 1001010 0 
1223   // xxxxxxx o xxxxxxx o xxxxxxx o xswffff o ffffccc o ccccccc o ccccccw o ppppppp o 
1224   //                                  |---115---||---------71---------| 
1225   // s = format start bit, o = odd parity of last 7 bits 
1226   // f = facility code, c = card number 
1227   // w = wiegand parity, x = extra space for other formats 
1228   // p = unknown checksum 
1229   // (26 bit format shown) 
1231   //get raw ID before removing parities 
1232   uint32_t rawLo 
= bytebits_to_byte(BitStream
+idx
+96,32); 
1233   uint32_t rawHi 
= bytebits_to_byte(BitStream
+idx
+64,32); 
1234   uint32_t rawHi2 
= bytebits_to_byte(BitStream
+idx
+32,32); 
1235   uint32_t rawHi3 
= bytebits_to_byte(BitStream
+idx
,32); 
1236   setDemodBuf(BitStream
,128,idx
); 
1238   size 
= removeParity(BitStream
, idx
+8, 8, 1, 120); 
1240     if (g_debugMode
==1) PrintAndLog("DEBUG: Error at parity check-tag size does not match Pyramid format, SIZE: %d, IDX: %d, hi3: %x",size
, idx
, rawHi3
); 
1244   // ok valid card found! 
1247   // 0         10        20        30        40        50        60        70 
1249   // 01234567890123456789012345678901234567890123456789012345678901234567890 
1250   // ----------------------------------------------------------------------- 
1251   // 00000000000000000000000000000000000000000000000000000000000000000000000 
1252   // xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 
1256   // 1 2 34567890 1234567890123456 7 8901234 
1257   // --------------------------------------- 
1258   // 1 1 01110011 0000000001000110 0 1001010 
1259   // s w ffffffff cccccccccccccccc w ppppppp 
1260   //     |--115-| |------71------| 
1261   // s = format start bit, o = odd parity of last 7 bits 
1262   // f = facility code, c = card number 
1263   // w = wiegand parity, x = extra space for other formats 
1264   // p = unknown checksum 
1265   // (26 bit format shown) 
1267   //find start bit to get fmtLen 
1269   for (j
=0; j
<size
; j
++){ 
1270     if(BitStream
[j
]) break; 
1272   uint8_t fmtLen 
= size
-j
-8; 
1274   uint32_t cardnum 
= 0; 
1276   //uint32_t code2 = 0; 
1278     fc 
= bytebits_to_byte(BitStream
+73, 8); 
1279     cardnum 
= bytebits_to_byte(BitStream
+81, 16); 
1280     code1 
= bytebits_to_byte(BitStream
+72,fmtLen
); 
1281     PrintAndLog("Pyramid ID Found - BitLength: %d, FC: %d, Card: %d - Wiegand: %x, Raw: %x%08x%08x%08x", fmtLen
, fc
, cardnum
, code1
, rawHi3
, rawHi2
, rawHi
, rawLo
); 
1282   } else if (fmtLen
==45){ 
1283     fmtLen
=42; //end = 10 bits not 7 like 26 bit fmt 
1284     fc 
= bytebits_to_byte(BitStream
+53, 10); 
1285     cardnum 
= bytebits_to_byte(BitStream
+63, 32); 
1286     PrintAndLog("Pyramid ID Found - BitLength: %d, FC: %d, Card: %d - Raw: %x%08x%08x%08x", fmtLen
, fc
, cardnum
, rawHi3
, rawHi2
, rawHi
, rawLo
); 
1288     cardnum 
= bytebits_to_byte(BitStream
+81, 16); 
1290       //code1 = bytebits_to_byte(BitStream+(size-fmtLen),fmtLen-32); 
1291       //code2 = bytebits_to_byte(BitStream+(size-32),32); 
1292       PrintAndLog("Pyramid ID Found - BitLength: %d -unknown BitLength- (%d), Raw: %x%08x%08x%08x", fmtLen
, cardnum
, rawHi3
, rawHi2
, rawHi
, rawLo
); 
1294       //code1 = bytebits_to_byte(BitStream+(size-fmtLen),fmtLen); 
1295       PrintAndLog("Pyramid ID Found - BitLength: %d -unknown BitLength- (%d), Raw: %x%08x%08x%08x", fmtLen
, cardnum
, rawHi3
, rawHi2
, rawHi
, rawLo
); 
1299     PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx
, 128); 
1305 int CmdFSKdemod(const char *Cmd
) //old CmdFSKdemod needs updating 
1307   static const int LowTone
[]  = { 
1308     1,  1,  1,  1,  1, -1, -1, -1, -1, -1, 
1309     1,  1,  1,  1,  1, -1, -1, -1, -1, -1, 
1310     1,  1,  1,  1,  1, -1, -1, -1, -1, -1, 
1311     1,  1,  1,  1,  1, -1, -1, -1, -1, -1, 
1312     1,  1,  1,  1,  1, -1, -1, -1, -1, -1 
1314   static const int HighTone
[] = { 
1315     1,  1,  1,  1,  1,     -1, -1, -1, -1, 
1316     1,  1,  1,  1,         -1, -1, -1, -1, 
1317     1,  1,  1,  1,         -1, -1, -1, -1, 
1318     1,  1,  1,  1,         -1, -1, -1, -1, 
1319     1,  1,  1,  1,         -1, -1, -1, -1, 
1320     1,  1,  1,  1,     -1, -1, -1, -1, -1, 
1323   int lowLen 
= sizeof (LowTone
) / sizeof (int); 
1324   int highLen 
= sizeof (HighTone
) / sizeof (int); 
1325   int convLen 
= (highLen 
> lowLen
) ? highLen 
: lowLen
; 
1326   uint32_t hi 
= 0, lo 
= 0; 
1329   int minMark 
= 0, maxMark 
= 0; 
1331   for (i 
= 0; i 
< GraphTraceLen 
- convLen
; ++i
) { 
1332     int lowSum 
= 0, highSum 
= 0; 
1334     for (j 
= 0; j 
< lowLen
; ++j
) { 
1335       lowSum 
+= LowTone
[j
]*GraphBuffer
[i
+j
]; 
1337     for (j 
= 0; j 
< highLen
; ++j
) { 
1338       highSum 
+= HighTone
[j
] * GraphBuffer
[i 
+ j
]; 
1340     lowSum 
= abs(100 * lowSum 
/ lowLen
); 
1341     highSum 
= abs(100 * highSum 
/ highLen
); 
1342     GraphBuffer
[i
] = (highSum 
<< 16) | lowSum
; 
1345   for(i 
= 0; i 
< GraphTraceLen 
- convLen 
- 16; ++i
) { 
1346     int lowTot 
= 0, highTot 
= 0; 
1347     // 10 and 8 are f_s divided by f_l and f_h, rounded 
1348     for (j 
= 0; j 
< 10; ++j
) { 
1349       lowTot 
+= (GraphBuffer
[i
+j
] & 0xffff); 
1351     for (j 
= 0; j 
< 8; j
++) { 
1352       highTot 
+= (GraphBuffer
[i 
+ j
] >> 16); 
1354     GraphBuffer
[i
] = lowTot 
- highTot
; 
1355     if (GraphBuffer
[i
] > maxMark
) maxMark 
= GraphBuffer
[i
]; 
1356     if (GraphBuffer
[i
] < minMark
) minMark 
= GraphBuffer
[i
]; 
1359   GraphTraceLen 
-= (convLen 
+ 16); 
1360   RepaintGraphWindow(); 
1362   // Find bit-sync (3 lo followed by 3 high) (HID ONLY) 
1363   int max 
= 0, maxPos 
= 0; 
1364   for (i 
= 0; i 
< 6000; ++i
) { 
1366     for (j 
= 0; j 
< 3 * lowLen
; ++j
) { 
1367       dec 
-= GraphBuffer
[i 
+ j
]; 
1369     for (; j 
< 3 * (lowLen 
+ highLen 
); ++j
) { 
1370       dec 
+= GraphBuffer
[i 
+ j
]; 
1378   // place start of bit sync marker in graph 
1379   GraphBuffer
[maxPos
] = maxMark
; 
1380   GraphBuffer
[maxPos 
+ 1] = minMark
; 
1384   // place end of bit sync marker in graph 
1385   GraphBuffer
[maxPos
] = maxMark
; 
1386   GraphBuffer
[maxPos
+1] = minMark
; 
1388   PrintAndLog("actual data bits start at sample %d", maxPos
); 
1389   PrintAndLog("length %d/%d", highLen
, lowLen
); 
1391   uint8_t bits
[46] = {0x00}; 
1393   // find bit pairs and manchester decode them 
1394   for (i 
= 0; i 
< arraylen(bits
) - 1; ++i
) { 
1396     for (j 
= 0; j 
< lowLen
; ++j
) { 
1397       dec 
-= GraphBuffer
[maxPos 
+ j
]; 
1399     for (; j 
< lowLen 
+ highLen
; ++j
) { 
1400       dec 
+= GraphBuffer
[maxPos 
+ j
]; 
1403     // place inter bit marker in graph 
1404     GraphBuffer
[maxPos
] = maxMark
; 
1405     GraphBuffer
[maxPos 
+ 1] = minMark
; 
1407     // hi and lo form a 64 bit pair 
1408     hi 
= (hi 
<< 1) | (lo 
>> 31); 
1410     // store decoded bit as binary (in hi/lo) and text (in bits[]) 
1418   PrintAndLog("bits: '%s'", bits
); 
1419   PrintAndLog("hex: %08x %08x", hi
, lo
); 
1424 //attempt to detect the field clock and bit clock for FSK 
1425 int CmdFSKfcDetect(const char *Cmd
) 
1427   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
1428   size_t size 
= getFromGraphBuf(BitStream
); 
1429   if (size
==0) return 0; 
1431   uint16_t ans 
= countFC(BitStream
, size
, &dummy
);  
1433     if (g_debugMode
) PrintAndLog("DEBUG: No data found"); 
1437   fc1 
= (ans 
>> 8) & 0xFF; 
1440   uint8_t rf1 
= detectFSKClk(BitStream
, size
, fc1
, fc2
); 
1442     if (g_debugMode
) PrintAndLog("DEBUG: Clock detect error"); 
1445   if ((fc1
==10 && fc2
==8) || (fc1
==8 && fc2
==5)){ 
1446     PrintAndLog("Detected Field Clocks: FC/%d, FC/%d - Bit Clock: RF/%d", fc1
, fc2
, rf1
); 
1450     PrintAndLog("DEBUG: unknown fsk field clock detected"); 
1451     PrintAndLog("Detected Field Clocks: FC/%d, FC/%d - Bit Clock: RF/%d", fc1
, fc2
, rf1
); 
1457 //attempt to detect the bit clock for PSK modulations 
1458 int CmdDetectPSKClockRate(const char *Cmd
) 
1460         GetPskClock("",0,0); 
1465 //attempt to detect the bit clock for NRZ modulations 
1466 int CmdDetectNRZClockRate(const char *Cmd
) 
1468   GetNrzClock("",0,0); 
1473 //attempt to psk1 demod graph buffer 
1474 int PSKDemod(const char *Cmd
, uint8_t verbose
) 
1479   sscanf(Cmd
, "%i %i %i", &clk
, &invert
, &maxErr
); 
1484   if (invert 
!= 0 && invert 
!= 1) { 
1485     PrintAndLog("Invalid argument: %s", Cmd
); 
1488   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
1489   size_t BitLen 
= getFromGraphBuf(BitStream
); 
1490   if (BitLen
==0) return 0; 
1492   errCnt 
= pskRawDemod(BitStream
, &BitLen
,&clk
,&invert
); 
1493   if (errCnt 
> maxErr
){ 
1494     if (g_debugMode
==1) PrintAndLog("Too many errors found, clk: %d, invert: %d, numbits: %d, errCnt: %d",clk
,invert
,BitLen
,errCnt
); 
1497   if (errCnt
<0|| BitLen
<16){  //throw away static - allow 1 and -1 (in case of threshold command first) 
1498     if (g_debugMode
==1) PrintAndLog("no data found, clk: %d, invert: %d, numbits: %d, errCnt: %d",clk
,invert
,BitLen
,errCnt
); 
1501   if (verbose
) PrintAndLog("Tried PSK Demod using Clock: %d - invert: %d - Bits Found: %d",clk
,invert
,BitLen
); 
1502   //prime demod buffer for output 
1503   setDemodBuf(BitStream
,BitLen
,0); 
1508 // Indala 26 bit decode 
1510 // optional arguments - same as CmdpskNRZrawDemod (clock & invert) 
1511 int CmdIndalaDecode(const char *Cmd
) 
1515                 ans 
= PSKDemod(Cmd
, 0); 
1516         } else{ //default to RF/32 
1517                 ans 
= PSKDemod("32", 0); 
1522                         PrintAndLog("Error1: %d",ans
); 
1526         ans 
= indala26decode(DemodBuffer
,(size_t *) &DemodBufferLen
, &invert
); 
1529                         PrintAndLog("Error2: %d",ans
); 
1532         char showbits
[251]={0x00}; 
1535                         PrintAndLog("Had to invert bits"); 
1537         //convert UID to HEX 
1538         uint32_t uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
; 
1542         PrintAndLog("BitLen: %d",DemodBufferLen
); 
1543         if (DemodBufferLen
==64){ 
1544                 for( idx
=0; idx
<64; idx
++) { 
1545                         uid1
=(uid1
<<1)|(uid2
>>31); 
1546                         if (DemodBuffer
[idx
] == 0) { 
1555                 PrintAndLog("Indala UID=%s (%x%08x)", showbits
, uid1
, uid2
); 
1563                 for( idx
=0; idx
<DemodBufferLen
; idx
++) { 
1564                         uid1
=(uid1
<<1)|(uid2
>>31); 
1565                         uid2
=(uid2
<<1)|(uid3
>>31); 
1566                         uid3
=(uid3
<<1)|(uid4
>>31); 
1567                         uid4
=(uid4
<<1)|(uid5
>>31); 
1568                         uid5
=(uid5
<<1)|(uid6
>>31); 
1569                         uid6
=(uid6
<<1)|(uid7
>>31); 
1570                         if (DemodBuffer
[idx
] == 0) { 
1580                 PrintAndLog("Indala UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits
, uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
); 
1583                 PrintAndLog("DEBUG: printing demodbuffer:"); 
1591 //attempt to clean psk wave noise after a peak  
1592 //NOTE RELIES ON PEAKS :( 
1593 int CmdPskClean(const char *Cmd) 
1595         uint8_t bitStream[MAX_GRAPH_TRACE_LEN]={0}; 
1596         size_t bitLen = getFromGraphBuf(bitStream); 
1597         pskCleanWave(bitStream, bitLen); 
1598         setGraphBuf(bitStream, bitLen); 
1604 // takes 3 arguments - clock, invert, maxErr as integers 
1605 // attempts to demodulate nrz only 
1606 // prints binary found and saves in demodbuffer for further commands 
1607 int CmdNRZrawDemod(const char *Cmd
) 
1612   char cmdp 
= param_getchar(Cmd
, 0); 
1613   if (strlen(Cmd
) > 10 || cmdp 
== 'h' || cmdp 
== 'H') { 
1614     PrintAndLog("Usage:  data nrzrawdemod [clock] <0|1> [maxError]"); 
1615     PrintAndLog("     [set clock as integer] optional, if not set, autodetect."); 
1616     PrintAndLog("     <invert>, 1 for invert output"); 
1617     PrintAndLog("     [set maximum allowed errors], default = 100."); 
1619     PrintAndLog("    sample: data nrzrawdemod        = demod a nrz/direct tag from GraphBuffer"); 
1620     PrintAndLog("          : data nrzrawdemod 32     = demod a nrz/direct tag from GraphBuffer using a clock of RF/32"); 
1621     PrintAndLog("          : data nrzrawdemod 32 1   = demod a nrz/direct tag from GraphBuffer using a clock of RF/32 and inverting data"); 
1622     PrintAndLog("          : data nrzrawdemod 1      = demod a nrz/direct tag from GraphBuffer while inverting data"); 
1623     PrintAndLog("          : data nrzrawdemod 64 1 0 = demod a nrz/direct tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors"); 
1628   sscanf(Cmd
, "%i %i %i", &clk
, &invert
, &maxErr
); 
1633   if (invert 
!= 0 && invert 
!= 1) { 
1634     PrintAndLog("Invalid argument: %s", Cmd
); 
1637   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
]={0}; 
1638   size_t BitLen 
= getFromGraphBuf(BitStream
); 
1639   if (BitLen
==0) return 0; 
1641   errCnt 
= nrzRawDemod(BitStream
, &BitLen
, &clk
, &invert
, maxErr
); 
1642   if (errCnt 
> maxErr
){ 
1643     if (g_debugMode
==1) PrintAndLog("Too many errors found, clk: %d, invert: %d, numbits: %d, errCnt: %d",clk
,invert
,BitLen
,errCnt
); 
1646   if (errCnt
<0|| BitLen
<16){  //throw away static - allow 1 and -1 (in case of threshold command first) 
1647     if (g_debugMode
==1) PrintAndLog("no data found, clk: %d, invert: %d, numbits: %d, errCnt: %d",clk
,invert
,BitLen
,errCnt
); 
1650   PrintAndLog("Tried NRZ Demod using Clock: %d - invert: %d - Bits Found: %d",clk
,invert
,BitLen
); 
1651   //prime demod buffer for output 
1652   setDemodBuf(BitStream
,BitLen
,0); 
1655     PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt
); 
1658   PrintAndLog("NRZ demoded bitstream:"); 
1659   // Now output the bitstream to the scrollback by line of 16 bits 
1665 // takes 3 arguments - clock, invert, maxErr as integers 
1666 // attempts to demodulate psk only 
1667 // prints binary found and saves in demodbuffer for further commands 
1668 int CmdPSK1rawDemod(const char *Cmd
) 
1671   char cmdp 
= param_getchar(Cmd
, 0); 
1672   if (strlen(Cmd
) > 10 || cmdp 
== 'h' || cmdp 
== 'H') { 
1673     PrintAndLog("Usage:  data psk1rawdemod [clock] <0|1> [maxError]"); 
1674     PrintAndLog("     [set clock as integer] optional, if not set, autodetect."); 
1675     PrintAndLog("     <invert>, 1 for invert output"); 
1676     PrintAndLog("     [set maximum allowed errors], default = 100."); 
1678     PrintAndLog("    sample: data psk1rawdemod        = demod a psk1 tag from GraphBuffer"); 
1679     PrintAndLog("          : data psk1rawdemod 32     = demod a psk1 tag from GraphBuffer using a clock of RF/32"); 
1680     PrintAndLog("          : data psk1rawdemod 32 1   = demod a psk1 tag from GraphBuffer using a clock of RF/32 and inverting data"); 
1681     PrintAndLog("          : data psk1rawdemod 1      = demod a psk1 tag from GraphBuffer while inverting data"); 
1682     PrintAndLog("          : data psk1rawdemod 64 1 0 = demod a psk1 tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors"); 
1685   errCnt 
= PSKDemod(Cmd
, 1); 
1688     if (g_debugMode
) PrintAndLog("Error demoding: %d",errCnt
);  
1692     PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt
); 
1695   PrintAndLog("PSK demoded bitstream:"); 
1696   // Now output the bitstream to the scrollback by line of 16 bits 
1702 // takes same args as cmdpsknrzrawdemod 
1703 int CmdPSK2rawDemod(const char *Cmd
) 
1706   char cmdp 
= param_getchar(Cmd
, 0); 
1707   if (strlen(Cmd
) > 10 || cmdp 
== 'h' || cmdp 
== 'H') { 
1708     PrintAndLog("Usage:  data psk2rawdemod [clock] <0|1> [maxError]"); 
1709     PrintAndLog("     [set clock as integer] optional, if not set, autodetect."); 
1710     PrintAndLog("     <invert>, 1 for invert output"); 
1711     PrintAndLog("     [set maximum allowed errors], default = 100."); 
1713     PrintAndLog("    sample: data psk2rawdemod        = demod a psk2 tag from GraphBuffer, autodetect clock"); 
1714     PrintAndLog("          : data psk2rawdemod 32     = demod a psk2 tag from GraphBuffer using a clock of RF/32"); 
1715     PrintAndLog("          : data psk2rawdemod 32 1   = demod a psk2 tag from GraphBuffer using a clock of RF/32 and inverting output"); 
1716     PrintAndLog("          : data psk2rawdemod 1      = demod a psk2 tag from GraphBuffer, autodetect clock and invert output"); 
1717     PrintAndLog("          : data psk2rawdemod 64 1 0 = demod a psk2 tag from GraphBuffer using a clock of RF/64, inverting output and allowing 0 demod errors"); 
1720   errCnt
=PSKDemod(Cmd
, 1); 
1722     if (g_debugMode
) PrintAndLog("Error demoding: %d",errCnt
);   
1725   psk1TOpsk2(DemodBuffer
, DemodBufferLen
); 
1728       PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt
); 
1729       PrintAndLog("PSK2 demoded bitstream:"); 
1730       // Now output the bitstream to the scrollback by line of 16 bits 
1734     PrintAndLog("PSK2 demoded bitstream:"); 
1735     // Now output the bitstream to the scrollback by line of 16 bits 
1741 int CmdGrid(const char *Cmd
) 
1743   sscanf(Cmd
, "%i %i", &PlotGridX
, &PlotGridY
); 
1744   PlotGridXdefault
= PlotGridX
; 
1745   PlotGridYdefault
= PlotGridY
; 
1746   RepaintGraphWindow(); 
1750 int CmdHexsamples(const char *Cmd
) 
1755   char string_buf
[25]; 
1756   char* string_ptr 
= string_buf
; 
1757   uint8_t got
[BIGBUF_SIZE
]; 
1759   sscanf(Cmd
, "%i %i", &requested
, &offset
); 
1761   /* if no args send something */ 
1762   if (requested 
== 0) { 
1765   if (offset 
+ requested 
> sizeof(got
)) { 
1766     PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > %d", BIGBUF_SIZE
); 
1770   GetFromBigBuf(got
,requested
,offset
); 
1771   WaitForResponse(CMD_ACK
,NULL
); 
1774   for (j 
= 0; j 
< requested
; j
++) { 
1776     string_ptr 
+= sprintf(string_ptr
, "%02x ", got
[j
]); 
1778       *(string_ptr 
- 1) = '\0';    // remove the trailing space 
1779       PrintAndLog("%s", string_buf
); 
1780       string_buf
[0] = '\0'; 
1781       string_ptr 
= string_buf
; 
1784     if (j 
== requested 
- 1 && string_buf
[0] != '\0') { // print any remaining bytes 
1785       *(string_ptr 
- 1) = '\0'; 
1786       PrintAndLog("%s", string_buf
); 
1787       string_buf
[0] = '\0'; 
1793 int CmdHide(const char *Cmd
) 
1799 int CmdHpf(const char *Cmd
) 
1804   for (i 
= 10; i 
< GraphTraceLen
; ++i
) 
1805     accum 
+= GraphBuffer
[i
]; 
1806   accum 
/= (GraphTraceLen 
- 10); 
1807   for (i 
= 0; i 
< GraphTraceLen
; ++i
) 
1808     GraphBuffer
[i
] -= accum
; 
1810   RepaintGraphWindow(); 
1819 bool _headBit( BitstreamOut 
*stream
) 
1821         int bytepos 
= stream
->position 
>> 3; // divide by 8 
1822         int bitpos 
= (stream
->position
++) & 7; // mask out 00000111 
1823         return (*(stream
->buffer 
+ bytepos
) >> (7-bitpos
)) & 1; 
1826 uint8_t getByte(uint8_t bits_per_sample
, BitstreamOut
* b
) 
1830         for(i 
=0 ; i 
< bits_per_sample
; i
++) 
1832                 val 
|= (_headBit(b
) << (7-i
)); 
1837 int CmdSamples(const char *Cmd
) 
1839         //If we get all but the last byte in bigbuf, 
1840         // we don't have to worry about remaining trash 
1841         // in the last byte in case the bits-per-sample 
1842         // does not line up on byte boundaries 
1843         uint8_t got
[BIGBUF_SIZE
-1] = { 0 }; 
1845         int n 
= strtol(Cmd
, NULL
, 0); 
1849         if (n 
> sizeof(got
)) 
1852         PrintAndLog("Reading %d bytes from device memory\n", n
); 
1853         GetFromBigBuf(got
,n
,0); 
1854         PrintAndLog("Data fetched"); 
1855         UsbCommand response
; 
1856         WaitForResponse(CMD_ACK
, &response
); 
1857         uint8_t bits_per_sample 
= 8; 
1859         //Old devices without this feature would send 0 at arg[0] 
1860         if(response
.arg
[0] > 0) 
1862                 sample_config 
*sc 
= (sample_config 
*) response
.d
.asBytes
; 
1863                 PrintAndLog("Samples @ %d bits/smpl, decimation 1:%d ", sc
->bits_per_sample
 
1865                 bits_per_sample 
= sc
->bits_per_sample
; 
1867         if(bits_per_sample 
< 8) 
1869                 PrintAndLog("Unpacking..."); 
1870                 BitstreamOut bout 
= { got
, bits_per_sample 
* n
,  0}; 
1872                 for (j 
= 0; j 
* bits_per_sample 
< n 
* 8 && j 
< sizeof(GraphBuffer
); j
++) { 
1873                         uint8_t sample 
= getByte(bits_per_sample
, &bout
); 
1874                         GraphBuffer
[j
] = ((int) sample 
)- 128; 
1877                 PrintAndLog("Unpacked %d samples" , j 
); 
1880                 for (int j 
= 0; j 
< n
; j
++) { 
1881                         GraphBuffer
[j
] = ((int)got
[j
]) - 128; 
1886         RepaintGraphWindow(); 
1890 int CmdTuneSamples(const char *Cmd
) 
1893         printf("\nMeasuring antenna characteristics, please wait..."); 
1895         UsbCommand c 
= {CMD_MEASURE_ANTENNA_TUNING
}; 
1899         while(!WaitForResponseTimeout(CMD_MEASURED_ANTENNA_TUNING
,&resp
,1000)) { 
1903                         PrintAndLog("\nNo response from Proxmark. Aborting..."); 
1909         int vLf125
, vLf134
, vHf
; 
1910         vLf125 
= resp
.arg
[0] & 0xffff; 
1911         vLf134 
= resp
.arg
[0] >> 16; 
1912         vHf 
= resp
.arg
[1] & 0xffff;; 
1913         peakf 
= resp
.arg
[2] & 0xffff; 
1914         peakv 
= resp
.arg
[2] >> 16; 
1916         PrintAndLog("# LF antenna: %5.2f V @   125.00 kHz", vLf125
/1000.0); 
1917         PrintAndLog("# LF antenna: %5.2f V @   134.00 kHz", vLf134
/1000.0); 
1918         PrintAndLog("# LF optimal: %5.2f V @%9.2f kHz", peakv
/1000.0, 12000.0/(peakf
+1)); 
1919         PrintAndLog("# HF antenna: %5.2f V @    13.56 MHz", vHf
/1000.0); 
1921                 PrintAndLog("# Your LF antenna is unusable."); 
1922         else if (peakv
<10000) 
1923                 PrintAndLog("# Your LF antenna is marginal."); 
1925                 PrintAndLog("# Your HF antenna is unusable."); 
1927                 PrintAndLog("# Your HF antenna is marginal."); 
1929         for (int i 
= 0; i 
< 256; i
++) { 
1930                 GraphBuffer
[i
] = resp
.d
.asBytes
[i
] - 128; 
1933         PrintAndLog("Done! Divisor 89 is 134khz, 95 is 125khz.\n"); 
1935         GraphTraceLen 
= 256; 
1942 int CmdLoad(const char *Cmd
) 
1944   char filename
[FILE_PATH_SIZE
] = {0x00}; 
1948   if (len 
> FILE_PATH_SIZE
) len 
= FILE_PATH_SIZE
; 
1949   memcpy(filename
, Cmd
, len
); 
1951   FILE *f 
= fopen(filename
, "r"); 
1953      PrintAndLog("couldn't open '%s'", filename
); 
1959   while (fgets(line
, sizeof (line
), f
)) { 
1960     GraphBuffer
[GraphTraceLen
] = atoi(line
); 
1964   PrintAndLog("loaded %d samples", GraphTraceLen
); 
1965   RepaintGraphWindow(); 
1969 int CmdLtrim(const char *Cmd
) 
1973   for (int i 
= ds
; i 
< GraphTraceLen
; ++i
) 
1974     GraphBuffer
[i
-ds
] = GraphBuffer
[i
]; 
1975   GraphTraceLen 
-= ds
; 
1977   RepaintGraphWindow(); 
1981 // trim graph to input argument length 
1982 int CmdRtrim(const char *Cmd
) 
1988   RepaintGraphWindow(); 
1993  * Manchester demodulate a bitstream. The bitstream needs to be already in 
1994  * the GraphBuffer as 0 and 1 values 
1996  * Give the clock rate as argument in order to help the sync - the algorithm 
1997  * resyncs at each pulse anyway. 
1999  * Not optimized by any means, this is the 1st time I'm writing this type of 
2000  * routine, feel free to improve... 
2002  * 1st argument: clock rate (as number of samples per clock rate) 
2003  *               Typical values can be 64, 32, 128... 
2005 int CmdManchesterDemod(const char *Cmd
) 
2007   int i
, j
, invert
= 0; 
2013   int hithigh
, hitlow
, first
; 
2019   /* check if we're inverting output */ 
2022     PrintAndLog("Inverting output"); 
2027     while(*Cmd 
== ' '); // in case a 2nd argument was given 
2030   /* Holds the decoded bitstream: each clock period contains 2 bits       */ 
2031   /* later simplified to 1 bit after manchester decoding.                 */ 
2032   /* Add 10 bits to allow for noisy / uncertain traces without aborting   */ 
2033   /* int BitStream[GraphTraceLen*2/clock+10]; */ 
2035   /* But it does not work if compiling on WIndows: therefore we just allocate a */ 
2037   uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
] = {0}; 
2039   /* Detect high and lows */ 
2040   for (i 
= 0; i 
< GraphTraceLen
; i
++) 
2042     if (GraphBuffer
[i
] > high
) 
2043       high 
= GraphBuffer
[i
]; 
2044     else if (GraphBuffer
[i
] < low
) 
2045       low 
= GraphBuffer
[i
]; 
2049   clock 
= GetClock(Cmd
, high
, 1); 
2051   int tolerance 
= clock
/4; 
2053   /* Detect first transition */ 
2054   /* Lo-Hi (arbitrary)       */ 
2055   /* skip to the first high */ 
2056   for (i
= 0; i 
< GraphTraceLen
; i
++) 
2057     if (GraphBuffer
[i
] == high
) 
2059   /* now look for the first low */ 
2060   for (; i 
< GraphTraceLen
; i
++) 
2062     if (GraphBuffer
[i
] == low
) 
2069   /* If we're not working with 1/0s, demod based off clock */ 
2072     bit 
= 0; /* We assume the 1st bit is zero, it may not be 
2073               * the case: this routine (I think) has an init problem. 
2076     for (; i 
< (int)(GraphTraceLen 
/ clock
); i
++) 
2082       /* Find out if we hit both high and low peaks */ 
2083       for (j 
= 0; j 
< clock
; j
++) 
2085         if (GraphBuffer
[(i 
* clock
) + j
] == high
) 
2087         else if (GraphBuffer
[(i 
* clock
) + j
] == low
) 
2090         /* it doesn't count if it's the first part of our read 
2091            because it's really just trailing from the last sequence */ 
2092         if (first 
&& (hithigh 
|| hitlow
)) 
2093           hithigh 
= hitlow 
= 0; 
2097         if (hithigh 
&& hitlow
) 
2101       /* If we didn't hit both high and low peaks, we had a bit transition */ 
2102       if (!hithigh 
|| !hitlow
) 
2105       BitStream
[bit2idx
++] = bit 
^ invert
; 
2109   /* standard 1/0 bitstream */ 
2113     /* Then detect duration between 2 successive transitions */ 
2114     for (bitidx 
= 1; i 
< GraphTraceLen
; i
++) 
2116       if (GraphBuffer
[i
-1] != GraphBuffer
[i
]) 
2121         // Error check: if bitidx becomes too large, we do not 
2122         // have a Manchester encoded bitstream or the clock is really 
2124         if (bitidx 
> (GraphTraceLen
*2/clock
+8) ) { 
2125           PrintAndLog("Error: the clock you gave is probably wrong, aborting."); 
2128         // Then switch depending on lc length: 
2129         // Tolerance is 1/4 of clock rate (arbitrary) 
2130         if (abs(lc
-clock
/2) < tolerance
) { 
2131           // Short pulse : either "1" or "0" 
2132           BitStream
[bitidx
++]=GraphBuffer
[i
-1]; 
2133         } else if (abs(lc
-clock
) < tolerance
) { 
2134           // Long pulse: either "11" or "00" 
2135           BitStream
[bitidx
++]=GraphBuffer
[i
-1]; 
2136           BitStream
[bitidx
++]=GraphBuffer
[i
-1]; 
2140           PrintAndLog("Warning: Manchester decode error for pulse width detection."); 
2141           PrintAndLog("(too many of those messages mean either the stream is not Manchester encoded, or clock is wrong)"); 
2145             PrintAndLog("Error: too many detection errors, aborting."); 
2152     // At this stage, we now have a bitstream of "01" ("1") or "10" ("0"), parse it into final decoded bitstream 
2153     // Actually, we overwrite BitStream with the new decoded bitstream, we just need to be careful 
2154     // to stop output at the final bitidx2 value, not bitidx 
2155     for (i 
= 0; i 
< bitidx
; i 
+= 2) { 
2156       if ((BitStream
[i
] == 0) && (BitStream
[i
+1] == 1)) { 
2157         BitStream
[bit2idx
++] = 1 ^ invert
; 
2158       } else if ((BitStream
[i
] == 1) && (BitStream
[i
+1] == 0)) { 
2159         BitStream
[bit2idx
++] = 0 ^ invert
; 
2161         // We cannot end up in this state, this means we are unsynchronized, 
2165         PrintAndLog("Unsynchronized, resync..."); 
2166         PrintAndLog("(too many of those messages mean the stream is not Manchester encoded)"); 
2170           PrintAndLog("Error: too many decode errors, aborting."); 
2177   PrintAndLog("Manchester decoded bitstream"); 
2178   // Now output the bitstream to the scrollback by line of 16 bits 
2179   for (i 
= 0; i 
< (bit2idx
-16); i
+=16) { 
2180     PrintAndLog("%i %i %i %i %i %i %i %i %i %i %i %i %i %i %i %i", 
2201 /* Modulate our data into manchester */ 
2202 int CmdManchesterMod(const char *Cmd
) 
2206   int bit
, lastbit
, wave
; 
2209   clock 
= GetClock(Cmd
, 0, 1); 
2213   for (i 
= 0; i 
< (int)(GraphTraceLen 
/ clock
); i
++) 
2215     bit 
= GraphBuffer
[i 
* clock
] ^ 1; 
2217     for (j 
= 0; j 
< (int)(clock
/2); j
++) 
2218       GraphBuffer
[(i 
* clock
) + j
] = bit 
^ lastbit 
^ wave
; 
2219     for (j 
= (int)(clock
/2); j 
< clock
; j
++) 
2220       GraphBuffer
[(i 
* clock
) + j
] = bit 
^ lastbit 
^ wave 
^ 1; 
2222     /* Keep track of how we start our wave and if we changed or not this time */ 
2223     wave 
^= bit 
^ lastbit
; 
2227   RepaintGraphWindow(); 
2231 int CmdNorm(const char *Cmd
) 
2234   int max 
= INT_MIN
, min 
= INT_MAX
; 
2236   for (i 
= 10; i 
< GraphTraceLen
; ++i
) { 
2237     if (GraphBuffer
[i
] > max
) 
2238       max 
= GraphBuffer
[i
]; 
2239     if (GraphBuffer
[i
] < min
) 
2240       min 
= GraphBuffer
[i
]; 
2244     for (i 
= 0; i 
< GraphTraceLen
; ++i
) { 
2245                         GraphBuffer
[i
] = (GraphBuffer
[i
] - ((max 
+ min
) / 2)) * 256 / 
2247                                 //marshmelow: adjusted *1000 to *256 to make +/- 128 so demod commands still work 
2250   RepaintGraphWindow(); 
2254 int CmdPlot(const char *Cmd
) 
2260 int CmdSave(const char *Cmd
) 
2262   char filename
[FILE_PATH_SIZE
] = {0x00}; 
2266   if (len 
> FILE_PATH_SIZE
) len 
= FILE_PATH_SIZE
; 
2267   memcpy(filename
, Cmd
, len
); 
2270   FILE *f 
= fopen(filename
, "w"); 
2272     PrintAndLog("couldn't open '%s'", filename
); 
2276   for (i 
= 0; i 
< GraphTraceLen
; i
++) { 
2277     fprintf(f
, "%d\n", GraphBuffer
[i
]); 
2280   PrintAndLog("saved to '%s'", Cmd
); 
2284 int CmdScale(const char *Cmd
) 
2286   CursorScaleFactor 
= atoi(Cmd
); 
2287   if (CursorScaleFactor 
== 0) { 
2288     PrintAndLog("bad, can't have zero scale"); 
2289     CursorScaleFactor 
= 1; 
2291   RepaintGraphWindow(); 
2295 int CmdThreshold(const char *Cmd
) 
2297   int threshold 
= atoi(Cmd
); 
2299   for (int i 
= 0; i 
< GraphTraceLen
; ++i
) { 
2300     if (GraphBuffer
[i
] >= threshold
) 
2303       GraphBuffer
[i
] = -1; 
2305   RepaintGraphWindow(); 
2309 int CmdDirectionalThreshold(const char *Cmd
) 
2311   int8_t upThres 
= param_get8(Cmd
, 0); 
2312   int8_t downThres 
= param_get8(Cmd
, 1); 
2314   printf("Applying Up Threshold: %d, Down Threshold: %d\n", upThres
, downThres
); 
2316   int lastValue 
= GraphBuffer
[0]; 
2317   GraphBuffer
[0] = 0; // Will be changed at the end, but init 0 as we adjust to last samples value if no threshold kicks in. 
2319   for (int i 
= 1; i 
< GraphTraceLen
; ++i
) { 
2320     // Apply first threshold to samples heading up 
2321     if (GraphBuffer
[i
] >= upThres 
&& GraphBuffer
[i
] > lastValue
) 
2323       lastValue 
= GraphBuffer
[i
]; // Buffer last value as we overwrite it. 
2326     // Apply second threshold to samples heading down 
2327     else if (GraphBuffer
[i
] <= downThres 
&& GraphBuffer
[i
] < lastValue
) 
2329       lastValue 
= GraphBuffer
[i
]; // Buffer last value as we overwrite it. 
2330       GraphBuffer
[i
] = -1; 
2334       lastValue 
= GraphBuffer
[i
]; // Buffer last value as we overwrite it. 
2335       GraphBuffer
[i
] = GraphBuffer
[i
-1]; 
2339   GraphBuffer
[0] = GraphBuffer
[1]; // Aline with first edited sample. 
2340   RepaintGraphWindow(); 
2344 int CmdZerocrossings(const char *Cmd
) 
2346   // Zero-crossings aren't meaningful unless the signal is zero-mean. 
2353   for (int i 
= 0; i 
< GraphTraceLen
; ++i
) { 
2354     if (GraphBuffer
[i
] * sign 
>= 0) { 
2355       // No change in sign, reproduce the previous sample count. 
2357       GraphBuffer
[i
] = lastZc
; 
2359       // Change in sign, reset the sample count. 
2361       GraphBuffer
[i
] = lastZc
; 
2369   RepaintGraphWindow(); 
2373 static command_t CommandTable
[] = 
2375   {"help",          CmdHelp
,            1, "This help"}, 
2376   {"amp",           CmdAmp
,             1, "Amplify peaks"}, 
2377   {"askdemod",      Cmdaskdemod
,        1, "<0 or 1> -- Attempt to demodulate simple ASK tags"}, 
2378   {"askedgedetect", CmdAskEdgeDetect
,   1, "[threshold] Adjust Graph for manual ask demod using length of sample differences to detect the edge of a wave - default = 25"}, 
2379   {"askem410xdemod",CmdAskEM410xDemod
,  1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate ASK/Manchester tags and output binary (args optional)"}, 
2380   {"askmandemod",   Cmdaskmandemod
,     1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate ASK/Manchester tags and output binary (args optional)"}, 
2381   {"askrawdemod",   Cmdaskrawdemod
,     1, "[clock] [invert<0|1>] -- Attempt to demodulate ASK tags and output bin (args optional)"}, 
2382   {"autocorr",      CmdAutoCorr
,        1, "<window length> -- Autocorrelation over window"}, 
2383   {"biphaserawdecode",CmdBiphaseDecodeRaw
,1,"[offset] [invert<0|1>] Biphase decode bin stream in demod buffer (offset = 0|1 bits to shift the decode start)"}, 
2384   {"bitsamples",    CmdBitsamples
,      0, "Get raw samples as bitstring"}, 
2385   {"bitstream",     CmdBitstream
,       1, "[clock rate] -- Convert waveform into a bitstream"}, 
2386   {"buffclear",     CmdBuffClear
,       1, "Clear sample buffer and graph window"}, 
2387   {"dec",           CmdDec
,             1, "Decimate samples"}, 
2388   {"detectclock",   CmdDetectClockRate
, 1, "Detect ASK clock rate"}, 
2389   {"fskdemod",      CmdFSKdemod
,        1, "Demodulate graph window as a HID FSK"}, 
2390   {"fskawiddemod",  CmdFSKdemodAWID
,    1, "Demodulate graph window as an AWID FSK tag using raw"}, 
2391   {"fskfcdetect",   CmdFSKfcDetect
,     1, "Try to detect the Field Clock of an FSK wave"}, 
2392   {"fskhiddemod",   CmdFSKdemodHID
,     1, "Demodulate graph window as a HID FSK tag using raw"}, 
2393   {"fskiodemod",    CmdFSKdemodIO
,      1, "Demodulate graph window as an IO Prox tag FSK using raw"}, 
2394   {"fskpyramiddemod",CmdFSKdemodPyramid
,1, "Demodulate graph window as a Pyramid FSK tag using raw"}, 
2395   {"fskparadoxdemod",CmdFSKdemodParadox
,1, "Demodulate graph window as a Paradox FSK tag using raw"}, 
2396   {"fskrawdemod",   CmdFSKrawdemod
,     1, "[clock rate] [invert] [rchigh] [rclow] Demodulate graph window from FSK to bin (clock = 50)(invert = 1|0)(rchigh = 10)(rclow=8)"}, 
2397   {"grid",          CmdGrid
,            1, "<x> <y> -- overlay grid on graph window, use zero value to turn off either"}, 
2398   {"hexsamples",    CmdHexsamples
,      0, "<bytes> [<offset>] -- Dump big buffer as hex bytes"}, 
2399   {"hide",          CmdHide
,            1, "Hide graph window"}, 
2400   {"hpf",           CmdHpf
,             1, "Remove DC offset from trace"}, 
2401   {"load",          CmdLoad
,            1, "<filename> -- Load trace (to graph window"}, 
2402   {"ltrim",         CmdLtrim
,           1, "<samples> -- Trim samples from left of trace"}, 
2403   {"rtrim",         CmdRtrim
,           1, "<location to end trace> -- Trim samples from right of trace"}, 
2404   {"mandemod",      CmdManchesterDemod
, 1, "[i] [clock rate] -- Manchester demodulate binary stream (option 'i' to invert output)"}, 
2405   {"manrawdecode",  Cmdmandecoderaw
,    1, "Manchester decode binary stream already in graph buffer"}, 
2406   {"manmod",        CmdManchesterMod
,   1, "[clock rate] -- Manchester modulate a binary stream"}, 
2407   {"norm",          CmdNorm
,            1, "Normalize max/min to +/-128"}, 
2408   {"nrzdetectclock",CmdDetectNRZClockRate
, 1, "Detect ASK, PSK, or NRZ clock rate"}, 
2409   {"nrzrawdemod",   CmdNRZrawDemod
,     1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate nrz tags and output binary (args optional)"}, 
2410   {"plot",          CmdPlot
,            1, "Show graph window (hit 'h' in window for keystroke help)"}, 
2411   {"pskdetectclock",CmdDetectPSKClockRate
, 1, "Detect ASK, PSK, or NRZ clock rate"}, 
2412   {"pskindalademod",CmdIndalaDecode
,    1, "[clock] [invert<0|1>] -- Attempt to demodulate psk1 indala tags and output ID binary & hex (args optional)"}, 
2413   {"psk1rawdemod",  CmdPSK1rawDemod
,    1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate psk1 tags and output binary (args optional)"}, 
2414   {"psk2rawdemod",  CmdPSK2rawDemod
,    1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate psk2 tags and output binary (args optional)"}, 
2415   {"samples",       CmdSamples
,         0, "[512 - 40000] -- Get raw samples for graph window"}, 
2416   {"save",          CmdSave
,            1, "<filename> -- Save trace (from graph window)"}, 
2417   {"scale",         CmdScale
,           1, "<int> -- Set cursor display scale"}, 
2418   {"setdebugmode",  CmdSetDebugMode
,    1, "<0|1> -- Turn on or off Debugging Mode for demods"}, 
2419   {"shiftgraphzero",CmdGraphShiftZero
,  1, "<shift> -- Shift 0 for Graphed wave + or - shift value"}, 
2420   {"threshold",     CmdThreshold
,       1, "<threshold> -- Maximize/minimize every value in the graph window depending on threshold"}, 
2421   {"dirthreshold",  CmdDirectionalThreshold
,   1, "<thres up> <thres down> -- Max rising higher up-thres/ Min falling lower down-thres, keep rest as prev."}, 
2422   {"tune",          CmdTuneSamples
,     0, "Get hw tune samples for graph window"}, 
2423   {"undec",         CmdUndec
,         1, "Un-decimate samples by 2"}, 
2424   {"zerocrossings", CmdZerocrossings
,   1, "Count time between zero-crossings"}, 
2425   {NULL
, NULL
, 0, NULL
} 
2428 int CmdData(const char *Cmd
) 
2430   CmdsParse(CommandTable
, Cmd
); 
2434 int CmdHelp(const char *Cmd
) 
2436   CmdsHelp(CommandTable
);