]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
FIX: LF TI WRITE inparameters didn't get copied by sscanf. This removes the "PRIu64...
[proxmark3-svn] / client / cmdlft55xx.c
1 //-----------------------------------------------------------------------------
2 //
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
5 // the license.
6 //-----------------------------------------------------------------------------
7 // Low frequency T55xx commands
8 //-----------------------------------------------------------------------------
9
10 #include <stdio.h>
11 #include <string.h>
12 #include <inttypes.h>
13 #include "proxmark3.h"
14 #include "ui.h"
15 #include "graph.h"
16 #include "cmdmain.h"
17 #include "cmdparser.h"
18 #include "cmddata.h"
19 #include "cmdlf.h"
20 #include "cmdlft55xx.h"
21 #include "util.h"
22 #include "data.h"
23 #include "lfdemod.h"
24
25
26 #define LF_TRACE_BUFF_SIZE 20000 // 32 x 32 x 10 (32 bit times numofblock (7), times clock skip..)
27 #define LF_BITSSTREAM_LEN 1000 // more then 1000 bits shouldn't happend.. 8block * 4 bytes * 8bits =
28 static int CmdHelp(const char *Cmd);
29
30 // int CmdReadBlk(const char *Cmd)
31 // {
32 // int block = -1;
33 // sscanf(Cmd, "%d", &block);
34
35 // if ((block > 7) | (block < 0)) {
36 // PrintAndLog("Block must be between 0 and 7");
37 // return 1;
38 // }
39
40 // UsbCommand c;
41 // c.cmd = CMD_T55XX_READ_BLOCK;
42 // c.d.asBytes[0] = 0x00;
43 // c.arg[0] = 0;
44 // c.arg[1] = block;
45 // c.arg[2] = 0;
46 // SendCommand(&c);
47 // WaitForResponse(CMD_ACK, NULL);
48
49 // uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
50
51 // GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0); //3560 -- should be offset..
52 // WaitForResponseTimeout(CMD_ACK,NULL, 1500);
53
54 // for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
55 // GraphBuffer[j] = (int)data[j];
56 // }
57 // GraphTraceLen = LF_TRACE_BUFF_SIZE;
58 // ManchesterDemod(block);
59 // RepaintGraphWindow();
60 // return 0;
61 // }
62
63 int CmdReadBlk(const char *Cmd)
64 {
65 int invert = 0;
66 int clk = 0;
67 int block = -1;
68 int errCnt;
69 size_t bitlen;
70 //int decodedBitlen;
71 uint32_t blockData;
72 uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};
73
74 sscanf(Cmd, "%d", &block);
75
76 if ((block > 7) | (block < 0)) {
77 PrintAndLog("Block must be between 0 and 7");
78 return 1;
79 }
80
81 UsbCommand c = { CMD_T55XX_READ_BLOCK, { 0, block, 0 } };
82 SendCommand(&c);
83 if ( !WaitForResponseTimeout(CMD_ACK,NULL,1500) ) {
84 PrintAndLog("command execution time out");
85 return 2;
86 }
87
88 CmdSamples("12000");
89
90 bitlen = getFromGraphBuf(bits);
91
92 errCnt = askrawdemod(bits, &bitlen, &clk, &invert);
93
94 //throw away static - allow 1 and -1 (in case of threshold command first)
95 if ( errCnt == -1 || bitlen < 16 ){
96 PrintAndLog("no data found");
97 if (g_debugMode)
98 PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
99 return 3;
100 }
101 if (g_debugMode)
102 PrintAndLog("Using Clock: %d - invert: %d - Bits Found: %d", clk, invert, bitlen);
103
104 //move bits back to DemodBuffer
105 setDemodBuf(bits, bitlen, 0);
106 printBitStream(bits,bitlen);
107
108 // bits has the manchester encoded data.
109 errCnt = manrawdecode(bits, &bitlen);
110 if ( errCnt == -1 || bitlen < 16 ){
111 PrintAndLog("no data found");
112 if (g_debugMode)
113 PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
114 return 4;
115 }
116
117 blockData = PackBits(0, 32, bits);
118
119 if ( block < 0)
120 PrintAndLog(" Decoded : 0x%08X %s", blockData, sprint_bin(bits,32) );
121 else
122 PrintAndLog(" Block %d : 0x%08X %s", block, blockData, sprint_bin(bits,32) );
123
124 return 0;
125 }
126
127 int CmdReadBlkPWD(const char *Cmd)
128 {
129 int Block = -1; //default to invalid block
130 int Password = 0xFFFFFFFF; //default to blank Block 7
131
132
133 sscanf(Cmd, "%d %x", &Block, &Password);
134
135 if ((Block > 7) | (Block < 0)) {
136 PrintAndLog("Block must be between 0 and 7");
137 return 1;
138 }
139
140 PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
141
142 UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, Block, Password} };
143 c.d.asBytes[0] = 0x1; //Password mode
144 SendCommand(&c);
145 WaitForResponse(CMD_ACK, NULL);
146
147 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
148
149 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);
150 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
151
152 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
153 GraphBuffer[j] = ((int)data[j]);
154 }
155 GraphTraceLen = LF_TRACE_BUFF_SIZE;
156 ManchesterDemod(Block);
157
158 RepaintGraphWindow();
159 return 0;
160 }
161
162 int CmdWriteBlk(const char *Cmd)
163 {
164 int Block = 8; //default to invalid block
165 int Data = 0xFFFFFFFF; //default to blank Block
166
167 sscanf(Cmd, "%d %x", &Block, &Data);
168
169 if (Block > 7) {
170 PrintAndLog("Block must be between 0 and 7");
171 return 1;
172 }
173
174 PrintAndLog("Writing block %d data %08X", Block, Data);
175
176 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {Data, Block, 0}};
177 c.d.asBytes[0] = 0x0; //Normal mode
178 SendCommand(&c);
179 return 0;
180 }
181
182 int CmdWriteBlkPWD(const char *Cmd)
183 {
184 int Block = 8; //default to invalid block
185 int Data = 0xFFFFFFFF; //default to blank Block
186 int Password = 0xFFFFFFFF; //default to blank Block 7
187
188
189 sscanf(Cmd, "%d %x %x",&Block, &Data, &Password);
190
191 if (Block > 7) {
192 PrintAndLog("Block must be between 0 and 7");
193 return 1;
194 }
195
196 PrintAndLog("Writing block %d data %08X password %08X", Block, Data, Password);
197
198 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {Data, Block, Password}};
199 c.d.asBytes[0] = 0x1; //Password mode
200 SendCommand(&c);
201 return 0;
202 }
203
204 int CmdReadTrace(const char *Cmd)
205 {
206 char cmdp = param_getchar(Cmd, 0);
207
208 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
209 PrintAndLog("Usage: lf t55xx trace [use data from Graphbuffer]");
210 PrintAndLog(" [use data from Graphbuffer], if not set, try reading data from tag.");
211 PrintAndLog("");
212 PrintAndLog(" sample: lf t55xx trace");
213 PrintAndLog(" : lf t55xx trace 1");
214 return 0;
215 }
216
217 if ( strlen(Cmd)==0){
218
219 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
220 SendCommand(&c);
221 WaitForResponse(CMD_ACK, NULL);
222
223 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
224
225 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0); //3560 -- should be offset..
226 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
227
228 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
229 GraphBuffer[j] = ((int)data[j]);
230 }
231 GraphTraceLen = LF_TRACE_BUFF_SIZE;
232 }
233
234 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
235 uint8_t * bitstream = bits;
236
237 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
238 RepaintGraphWindow();
239
240 uint8_t si = 5;
241 uint32_t bl0 = PackBits(si, 32, bitstream);
242 uint32_t bl1 = PackBits(si+32, 32, bitstream);
243
244 uint32_t acl = PackBits(si, 8, bitstream); si += 8;
245 uint32_t mfc = PackBits(si, 8, bitstream); si += 8;
246 uint32_t cid = PackBits(si, 5, bitstream); si += 5;
247 uint32_t icr = PackBits(si, 3, bitstream); si += 3;
248 uint32_t year = PackBits(si, 4, bitstream); si += 4;
249 uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
250 uint32_t lotid = PackBits(si, 12, bitstream); si += 12;
251 uint32_t wafer = PackBits(si, 5, bitstream); si += 5;
252 uint32_t dw = PackBits(si, 15, bitstream);
253
254 PrintAndLog("");
255 PrintAndLog("-- T55xx Trace Information ----------------------------------");
256 PrintAndLog("-------------------------------------------------------------");
257 PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", acl, acl);
258 PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d)", mfc, mfc);
259 PrintAndLog(" CID : 0x%02X (%d)", cid, cid);
260 PrintAndLog(" ICR IC Revision : %d",icr );
261 PrintAndLog(" Manufactured");
262 PrintAndLog(" Year/Quarter : %d/%d",2000+year, quarter );
263 PrintAndLog(" Lot ID : %d", lotid );
264 PrintAndLog(" Wafer number : %d", wafer);
265 PrintAndLog(" Die Number : %d", dw);
266 PrintAndLog("-------------------------------------------------------------");
267 PrintAndLog(" Raw Data - Page 1");
268 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bitstream+5,32) );
269 PrintAndLog(" Block 0 : 0x%08X %s", bl1, sprint_bin(bitstream+37,32) );
270 PrintAndLog("-------------------------------------------------------------");
271 /*
272 TRACE - BLOCK O
273 Bits Definition HEX
274 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0
275 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation
276 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2
277 22-24 ICR IC revision
278 25-28 YEAR (BCD encoded) 9 (= 2009)
279 29-30 QUARTER 1,2,3,4
280 31-32 LOT ID
281
282 TRACE - BLOCK 1
283 1-12 LOT ID
284 13-17 Wafer number
285 18-32 DW, die number sequential
286 */
287
288 return 0;
289 }
290
291 int CmdInfo(const char *Cmd){
292 /*
293 Page 0 Block 0 Configuration data.
294 Normal mode
295 Extended mode
296 */
297 char cmdp = param_getchar(Cmd, 0);
298
299 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
300 PrintAndLog("Usage: lf t55xx info [use data from Graphbuffer]");
301 PrintAndLog(" [use data from Graphbuffer], if not set, try reading data from tag.");
302 PrintAndLog("");
303 PrintAndLog(" sample: lf t55xx info");
304 PrintAndLog(" sample: lf t55xx info 1");
305 return 0;
306 }
307
308 if ( strlen(Cmd) == 0 ){
309 CmdReadBlk("0");
310 }
311
312 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
313
314 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
315
316 uint8_t si = 5;
317 uint32_t bl0 = PackBits(si, 32, bits);
318
319 uint32_t safer = PackBits(si, 4, bits); si += 4;
320 uint32_t resv = PackBits(si, 7, bits); si += 7;
321 uint32_t dbr = PackBits(si, 3, bits); si += 3;
322 uint32_t extend = PackBits(si, 1, bits); si += 1;
323 uint32_t datamodulation = PackBits(si, 5, bits); si += 5;
324 uint32_t pskcf = PackBits(si, 2, bits); si += 2;
325 uint32_t aor = PackBits(si, 1, bits); si += 1;
326 uint32_t otp = PackBits(si, 1, bits); si += 1;
327 uint32_t maxblk = PackBits(si, 3, bits); si += 3;
328 uint32_t pwd = PackBits(si, 1, bits); si += 1;
329 uint32_t sst = PackBits(si, 1, bits); si += 1;
330 uint32_t fw = PackBits(si, 1, bits); si += 1;
331 uint32_t inv = PackBits(si, 1, bits); si += 1;
332 uint32_t por = PackBits(si, 1, bits); si += 1;
333
334 PrintAndLog("");
335 PrintAndLog("-- T55xx Configuration & Tag Information --------------------");
336 PrintAndLog("-------------------------------------------------------------");
337 PrintAndLog(" Safer key : %s", GetSaferStr(safer));
338 PrintAndLog(" reserved : %d", resv);
339 PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr));
340 PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");
341 PrintAndLog(" Modulation : %s", GetModulationStr(datamodulation) );
342 PrintAndLog(" PSK clock freq : %d", pskcf);
343 PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");
344 PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );
345 PrintAndLog(" Max block : %d", maxblk);
346 PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");
347 PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
348 PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");
349 PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");
350 PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");
351 PrintAndLog("-------------------------------------------------------------");
352 PrintAndLog(" Raw Data - Page 0");
353 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bits+5,32) );
354 PrintAndLog("-------------------------------------------------------------");
355
356 return 0;
357 }
358
359 int CmdDump(const char *Cmd){
360
361 char cmdp = param_getchar(Cmd, 0);
362 char s[20];
363 uint8_t pwd[4] = {0x00};
364 bool hasPwd = ( strlen(Cmd) > 0);
365
366 if ( cmdp == 'h' || cmdp == 'H') {
367 PrintAndLog("Usage: lf t55xx dump <password>");
368 PrintAndLog(" sample: lf t55xx dump FFFFFFFF");
369 return 0;
370 }
371
372 if ( hasPwd ){
373 if (param_gethex(Cmd, 0, pwd, 8)) {
374 PrintAndLog("password must include 8 HEX symbols");
375 return 1;
376 }
377 }
378
379 for ( int i = 0; i <8; ++i){
380 memset(s,0,sizeof(s));
381 if ( hasPwd ) {
382 sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
383 CmdReadBlkPWD(s);
384 } else {
385 sprintf(s,"%d", i);
386 CmdReadBlk(s);
387 }
388 }
389 return 0;
390 }
391
392 int CmdIceFsk(const char *Cmd){
393
394 if (!HasGraphData()) return 0;
395
396 iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
397 RepaintGraphWindow();
398 return 0;
399 }
400 int CmdIceManchester(const char *Cmd){
401 ManchesterDemod( -1);
402 return 0;
403 }
404 int ManchesterDemod(int blockNum){
405
406 if (!HasGraphData()) return 0;
407
408 uint8_t sizebyte = 32;
409 // the value 5 was selected during empirical studies of the decoded data. Some signal noise to skip.
410 uint8_t offset = 5;
411 uint32_t blockData;
412 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
413 uint8_t * bitstream = bits;
414
415 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
416 blockData = PackBits(offset, sizebyte, bits);
417
418 if ( blockNum < 0)
419 PrintAndLog(" Decoded : 0x%08X %s", blockData, sprint_bin(bitstream+offset,sizebyte) );
420 else
421 PrintAndLog(" Block %d : 0x%08X %s", blockNum, blockData, sprint_bin(bitstream+offset,sizebyte) );
422
423 return 0;
424 }
425
426 char * GetBitRateStr(uint32_t id){
427 static char buf[40];
428 char *retStr = buf;
429 switch (id){
430 case 0:
431 sprintf(retStr,"%d - RF/8",id);
432 break;
433 case 1:
434 sprintf(retStr,"%d - RF/16",id);
435 break;
436 case 2:
437 sprintf(retStr,"%d - RF/32",id);
438 break;
439 case 3:
440 sprintf(retStr,"%d - RF/40",id);
441 break;
442 case 4:
443 sprintf(retStr,"%d - RF/50",id);
444 break;
445 case 5:
446 sprintf(retStr,"%d - RF/64",id);
447 break;
448 case 6:
449 sprintf(retStr,"%d - RF/100",id);
450 break;
451 case 7:
452 sprintf(retStr,"%d - RF/128",id);
453 break;
454 default:
455 sprintf(retStr,"%d - (Unknown)",id);
456 break;
457 }
458
459 return buf;
460 }
461
462 char * GetSaferStr(uint32_t id){
463 static char buf[40];
464 char *retStr = buf;
465
466 sprintf(retStr,"%d",id);
467 if (id == 6) {
468 sprintf(retStr,"%d - pasdwd",id);
469 }
470 if (id == 9 ){
471 sprintf(retStr,"%d - testmode ",id);
472 }
473
474 return buf;
475 }
476 char * GetModulationStr( uint32_t id){
477 static char buf[40];
478 char *retStr = buf;
479
480 switch (id){
481 case 0:
482 sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
483 break;
484 case 1:
485 sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
486 break;
487 case 2:
488 sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
489 break;
490 case 3:
491 sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
492 break;
493 case 4:
494 sprintf(retStr,"%d - FSK 1 RF/8 RF/5",id);
495 break;
496 case 5:
497 sprintf(retStr,"%d - FSK 2 RF/8 RF/10",id);
498 break;
499 case 6:
500 sprintf(retStr,"%d - FSK 1a RF/5 RF/8",id);
501 break;
502 case 7:
503 sprintf(retStr,"%d - FSK 2a RF/10 RF/8",id);
504 break;
505 case 8:
506 sprintf(retStr,"%d - Manschester",id);
507 break;
508 case 16:
509 sprintf(retStr,"%d - Biphase",id);
510 break;
511 case 17:
512 sprintf(retStr,"%d - Reserved",id);
513 break;
514 default:
515 sprintf(retStr,"0x%02X (Unknown)",id);
516 break;
517 }
518 return buf;
519 }
520
521
522 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
523
524 int i = start;
525 int j = len-1;
526 if (len > 32) {
527 return 0;
528 }
529 uint32_t tmp = 0;
530 for (; j >= 0; --j, ++i){
531 tmp |= bits[i] << j;
532 }
533 return tmp;
534 }
535
536 static command_t CommandTable[] =
537 {
538 {"help", CmdHelp, 1, "This help"},
539 {"rd", CmdReadBlk, 0, "<block> -- Read T55xx block data (page 0)"},
540 {"rdpwd", CmdReadBlkPWD, 0, "<block> <password> -- Read T55xx block data with password mode"},
541 {"wr", CmdWriteBlk, 0, "<block> <data> -- Write T55xx block data (page 0)"},
542 {"wrpwd", CmdWriteBlkPWD, 0, "<block> <password> <data> -- Write T55xx block data with password"},
543 {"trace", CmdReadTrace, 0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},
544 {"info", CmdInfo, 0, "[1] Read T55xx configuration data (page 0/ blk 0)"},
545 {"dump", CmdDump, 0, "[password] Dump T55xx card block 0-7. optional with password"},
546 //{"fsk", CmdIceFsk, 0, "FSK demod"},
547 {"man", CmdIceManchester, 0, "Manchester demod (with SST)"},
548 {NULL, NULL, 0, NULL}
549 };
550
551 int CmdLFT55XX(const char *Cmd)
552 {
553 CmdsParse(CommandTable, Cmd);
554 return 0;
555 }
556
557 int CmdHelp(const char *Cmd)
558 {
559 CmdsHelp(CommandTable);
560 return 0;
561 }
Proxmark3 GIT tracking
Impressum, Datenschutz