1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
15 #include "proxmark3.h"
19 #include "cmdparser.h"
25 #include "cmdlfawid.h"
27 #include "cmdlfem4x.h"
28 #include "cmdlfhitag.h"
29 #include "cmdlft55xx.h"
30 #include "cmdlfpcf7931.h"
33 #include "cmdlfviking.h"
34 static int CmdHelp(const char *Cmd
);
36 int usage_lf_cmdread(void) {
37 PrintAndLog("Usage: lf cmdread d <delay period> z <zero period> o <one period> c <cmdbytes> [H]");
38 PrintAndLog("Options: ");
39 PrintAndLog(" h This help");
40 PrintAndLog(" H Freqency High (134 KHz), default is 'Low (125KHz)'");
41 PrintAndLog(" d <delay> delay OFF period, (dec)");
42 PrintAndLog(" z <zero> time period ZERO, (dec)");
43 PrintAndLog(" o <one> time period ONE, (dec)");
44 PrintAndLog(" c <cmd> Command bytes");
45 PrintAndLog(" ************* All periods in microseconds (ms)");
46 PrintAndLog("Examples:");
47 PrintAndLog(" lf cmdread d 80 z 100 o 200 c 11000");
48 PrintAndLog(" lf cmdread d 80 z 100 o 100 c 11000 H");
51 int usage_lf_read(void){
52 PrintAndLog("Usage: lf read [h] [s]");
53 PrintAndLog("Options: ");
54 PrintAndLog(" h This help");
55 PrintAndLog(" s silent run no printout");
56 PrintAndLog("This function takes no arguments. ");
57 PrintAndLog("Use 'lf config' to set parameters.");
60 int usage_lf_snoop(void) {
61 PrintAndLog("Usage: lf snoop");
62 PrintAndLog("Options: ");
63 PrintAndLog(" h This help");
64 PrintAndLog("This function takes no arguments. ");
65 PrintAndLog("Use 'lf config' to set parameters.");
68 int usage_lf_config(void) {
69 PrintAndLog("Usage: lf config [H|<divisor>] [b <bps>] [d <decim>] [a 0|1]");
70 PrintAndLog("Options: ");
71 PrintAndLog(" h This help");
72 PrintAndLog(" L Low frequency (125 KHz)");
73 PrintAndLog(" H High frequency (134 KHz)");
74 PrintAndLog(" q <divisor> Manually set divisor. 88-> 134KHz, 95-> 125 Hz");
75 PrintAndLog(" b <bps> Sets resolution of bits per sample. Default (max): 8");
76 PrintAndLog(" d <decim> Sets decimation. A value of N saves only 1 in N samples. Default: 1");
77 PrintAndLog(" a [0|1] Averaging - if set, will average the stored sample value when decimating. Default: 1");
78 PrintAndLog(" t <threshold> Sets trigger threshold. 0 means no threshold (range: 0-128)");
79 PrintAndLog("Examples:");
80 PrintAndLog(" lf config b 8 L");
81 PrintAndLog(" Samples at 125KHz, 8bps.");
82 PrintAndLog(" lf config H b 4 d 3");
83 PrintAndLog(" Samples at 134KHz, averages three samples into one, stored with ");
84 PrintAndLog(" a resolution of 4 bits per sample.");
85 PrintAndLog(" lf read");
86 PrintAndLog(" Performs a read (active field)");
87 PrintAndLog(" lf snoop");
88 PrintAndLog(" Performs a snoop (no active field)");
91 int usage_lf_simfsk(void) {
92 PrintAndLog("Usage: lf simfsk [c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>]");
93 PrintAndLog("Options: ");
94 PrintAndLog(" h This help");
95 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
96 PrintAndLog(" i invert data");
97 PrintAndLog(" H <fcHigh> Manually set the larger Field Clock");
98 PrintAndLog(" L <fcLow> Manually set the smaller Field Clock");
99 //PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
100 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
101 PrintAndLog("\n NOTE: if you set one clock manually set them all manually");
104 int usage_lf_simask(void) {
105 PrintAndLog("Usage: lf simask [c <clock>] [i] [b|m|r] [s] [d <raw hex to sim>]");
106 PrintAndLog("Options: ");
107 PrintAndLog(" h This help");
108 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
109 PrintAndLog(" i invert data");
110 PrintAndLog(" b sim ask/biphase");
111 PrintAndLog(" m sim ask/manchester - Default");
112 PrintAndLog(" r sim ask/raw");
113 PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
114 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
117 int usage_lf_simpsk(void) {
118 PrintAndLog("Usage: lf simpsk [1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>]");
119 PrintAndLog("Options: ");
120 PrintAndLog(" h This help");
121 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
122 PrintAndLog(" i invert data");
123 PrintAndLog(" 1 set PSK1 (default)");
124 PrintAndLog(" 2 set PSK2");
125 PrintAndLog(" 3 set PSK3");
126 PrintAndLog(" r <carrier> 2|4|8 are valid carriers: default = 2");
127 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
130 int usage_lf_find(void){
131 PrintAndLog("Usage: lf search <0|1> [u]");
132 PrintAndLog(" <use data from Graphbuffer> , if not set, try reading data from tag.");
133 PrintAndLog(" [Search for Unknown tags] , if not set, reads only known tags.");
135 PrintAndLog(" sample: lf search = try reading data from tag & search for known tags");
136 PrintAndLog(" : lf search 1 = use data from GraphBuffer & search for known tags");
137 PrintAndLog(" : lf search u = try reading data from tag & search for known and unknown tags");
138 PrintAndLog(" : lf search 1 u = use data from GraphBuffer & search for known and unknown tags");
143 /* send a LF command before reading */
144 int CmdLFCommandRead(const char *Cmd
)
146 static char dummy
[3] = {0x20,0x00,0x00};
147 UsbCommand c
= {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
};
153 while(param_getchar(Cmd
, cmdp
) != 0x00) {
154 switch(param_getchar(Cmd
, cmdp
))
157 return usage_lf_cmdread();
166 strLength
= param_getstr(Cmd
, cmdp
+1, (char *)&c
.d
.asBytes
);
170 c
.arg
[0] = param_get32ex(Cmd
, cmdp
+1, 0, 10);
174 c
.arg
[1] = param_get32ex(Cmd
, cmdp
+1, 0, 10);
178 c
.arg
[2] = param_get32ex(Cmd
, cmdp
+1, 0, 10);
182 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
189 if (cmdp
== 0) errors
= 1;
192 if (errors
) return usage_lf_cmdread();
194 // in case they specified 'H'
195 strcpy((char *)&c
.d
.asBytes
+ strLength
, dummy
);
197 clearCommandBuffer();
202 int CmdFlexdemod(const char *Cmd
)
205 for (i
= 0; i
< GraphTraceLen
; ++i
) {
206 if (GraphBuffer
[i
] < 0) {
213 #define LONG_WAIT 100
215 for (start
= 0; start
< GraphTraceLen
- LONG_WAIT
; start
++) {
216 int first
= GraphBuffer
[start
];
217 for (i
= start
; i
< start
+ LONG_WAIT
; i
++) {
218 if (GraphBuffer
[i
] != first
) {
222 if (i
== (start
+ LONG_WAIT
)) {
226 if (start
== GraphTraceLen
- LONG_WAIT
) {
227 PrintAndLog("nothing to wait for");
231 GraphBuffer
[start
] = 2;
232 GraphBuffer
[start
+1] = -2;
233 uint8_t bits
[64] = {0x00};
237 for (bit
= 0; bit
< 64; bit
++) {
239 for (int j
= 0; j
< 16; j
++) {
240 sum
+= GraphBuffer
[i
++];
243 bits
[bit
] = (sum
> 0) ? 1 : 0;
245 PrintAndLog("bit %d sum %d", bit
, sum
);
248 for (bit
= 0; bit
< 64; bit
++) {
251 for (j
= 0; j
< 16; j
++) {
252 sum
+= GraphBuffer
[i
++];
254 if (sum
> 0 && bits
[bit
] != 1) {
255 PrintAndLog("oops1 at %d", bit
);
257 if (sum
< 0 && bits
[bit
] != 0) {
258 PrintAndLog("oops2 at %d", bit
);
262 // HACK writing back to graphbuffer.
263 GraphTraceLen
= 32*64;
266 for (bit
= 0; bit
< 64; bit
++) {
268 phase
= (bits
[bit
] == 0) ? 0 : 1;
271 for (j
= 0; j
< 32; j
++) {
272 GraphBuffer
[i
++] = phase
;
277 RepaintGraphWindow();
281 int CmdIndalaDemod(const char *Cmd
)
283 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
289 // worst case with GraphTraceLen=64000 is < 4096
290 // under normal conditions it's < 2048
292 uint8_t rawbits
[4096];
294 int worst
= 0, worstPos
= 0;
295 // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
297 // loop through raw signal - since we know it is psk1 rf/32 fc/2 skip every other value (+=2)
298 for (i
= 0; i
< GraphTraceLen
-1; i
+= 2) {
300 if ((GraphBuffer
[i
] > GraphBuffer
[i
+ 1]) && (state
!= 1)) {
301 // appears redundant - marshmellow
303 for (j
= 0; j
< count
- 8; j
+= 16) {
304 rawbits
[rawbit
++] = 0;
306 if ((abs(count
- j
)) > worst
) {
307 worst
= abs(count
- j
);
313 } else if ((GraphBuffer
[i
] < GraphBuffer
[i
+ 1]) && (state
!= 0)) {
316 for (j
= 0; j
< count
- 8; j
+= 16) {
317 rawbits
[rawbit
++] = 1;
319 if ((abs(count
- j
)) > worst
) {
320 worst
= abs(count
- j
);
330 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit
, GraphTraceLen
/32);
331 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst
, worstPos
);
336 // Finding the start of a UID
337 int uidlen
, long_wait
;
338 if (strcmp(Cmd
, "224") == 0) {
348 for (start
= 0; start
<= rawbit
- uidlen
; start
++) {
349 first
= rawbits
[start
];
350 for (i
= start
; i
< start
+ long_wait
; i
++) {
351 if (rawbits
[i
] != first
) {
355 if (i
== (start
+ long_wait
)) {
360 if (start
== rawbit
- uidlen
+ 1) {
361 PrintAndLog("nothing to wait for");
365 // Inverting signal if needed
367 for (i
= start
; i
< rawbit
; i
++) {
368 rawbits
[i
] = !rawbits
[i
];
373 uint8_t bits
[224] = {0x00};
374 char showbits
[225] = {0x00};
379 if (uidlen
> rawbit
) {
380 PrintAndLog("Warning: not enough raw bits to get a full UID");
381 for (bit
= 0; bit
< rawbit
; bit
++) {
382 bits
[bit
] = rawbits
[i
++];
383 // As we cannot know the parity, let's use "." and "/"
384 showbits
[bit
] = '.' + bits
[bit
];
386 showbits
[bit
+1]='\0';
387 PrintAndLog("Partial UID=%s", showbits
);
390 for (bit
= 0; bit
< uidlen
; bit
++) {
391 bits
[bit
] = rawbits
[i
++];
392 showbits
[bit
] = '0' + bits
[bit
];
398 uint32_t uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
403 for( idx
=0; idx
<64; idx
++) {
404 if (showbits
[idx
] == '0') {
405 uid1
= (uid1
<<1) | (uid2
>>31);
406 uid2
= (uid2
<<1) | 0;
408 uid1
= (uid1
<<1) | (uid2
>>31);
409 uid2
= (uid2
<<1) | 1;
412 PrintAndLog("UID=%s (%x%08x)", showbits
, uid1
, uid2
);
414 uid3
= uid4
= uid5
= uid6
= uid7
= 0;
416 for( idx
=0; idx
<224; idx
++) {
417 uid1
= (uid1
<<1) | (uid2
>>31);
418 uid2
= (uid2
<<1) | (uid3
>>31);
419 uid3
= (uid3
<<1) | (uid4
>>31);
420 uid4
= (uid4
<<1) | (uid5
>>31);
421 uid5
= (uid5
<<1) | (uid6
>>31);
422 uid6
= (uid6
<<1) | (uid7
>>31);
424 if (showbits
[idx
] == '0')
425 uid7
= (uid7
<<1) | 0;
427 uid7
= (uid7
<<1) | 1;
429 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits
, uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
432 // Checking UID against next occurrences
434 for (; i
+ uidlen
<= rawbit
;) {
436 for (bit
= 0; bit
< uidlen
; bit
++) {
437 if (bits
[bit
] != rawbits
[i
++]) {
448 PrintAndLog("Occurrences: %d (expected %d)", times
, (rawbit
- start
) / uidlen
);
450 // Remodulating for tag cloning
451 // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
452 // since this changes graphbuffer data.
453 GraphTraceLen
= 32 * uidlen
;
456 for (bit
= 0; bit
< uidlen
; bit
++) {
457 phase
= (bits
[bit
] == 0) ? 0 : 1;
459 for (j
= 0; j
< 32; j
++) {
460 GraphBuffer
[i
++] = phase
;
465 RepaintGraphWindow();
469 int CmdIndalaClone(const char *Cmd
)
472 unsigned int uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
474 uid1
= uid2
= uid3
= uid4
= uid5
= uid6
= uid7
= 0;
477 if (strchr(Cmd
,'l') != 0) {
478 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
479 uid1
= (uid1
<< 4) | (uid2
>> 28);
480 uid2
= (uid2
<< 4) | (uid3
>> 28);
481 uid3
= (uid3
<< 4) | (uid4
>> 28);
482 uid4
= (uid4
<< 4) | (uid5
>> 28);
483 uid5
= (uid5
<< 4) | (uid6
>> 28);
484 uid6
= (uid6
<< 4) | (uid7
>> 28);
485 uid7
= (uid7
<< 4) | (n
& 0xf);
487 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
488 c
.cmd
= CMD_INDALA_CLONE_TAG_L
;
489 c
.d
.asDwords
[0] = uid1
;
490 c
.d
.asDwords
[1] = uid2
;
491 c
.d
.asDwords
[2] = uid3
;
492 c
.d
.asDwords
[3] = uid4
;
493 c
.d
.asDwords
[4] = uid5
;
494 c
.d
.asDwords
[5] = uid6
;
495 c
.d
.asDwords
[6] = uid7
;
497 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
498 uid1
= (uid1
<< 4) | (uid2
>> 28);
499 uid2
= (uid2
<< 4) | (n
& 0xf);
501 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1
, uid2
);
502 c
.cmd
= CMD_INDALA_CLONE_TAG
;
507 clearCommandBuffer();
512 int CmdLFSetConfig(const char *Cmd
)
515 uint8_t divisor
= 0;//Frequency divisor
516 uint8_t bps
= 0; // Bits per sample
517 uint8_t decimation
= 0; //How many to keep
518 bool averaging
= 1; // Defaults to true
520 int trigger_threshold
=-1;//Means no change
521 uint8_t unsigned_trigg
= 0;
524 while(param_getchar(Cmd
, cmdp
) != 0x00)
526 switch(param_getchar(Cmd
, cmdp
))
529 return usage_lf_config();
539 errors
|= param_getdec(Cmd
,cmdp
+1,&divisor
);
543 errors
|= param_getdec(Cmd
,cmdp
+1,&unsigned_trigg
);
545 if(!errors
) trigger_threshold
= unsigned_trigg
;
548 errors
|= param_getdec(Cmd
,cmdp
+1,&bps
);
552 errors
|= param_getdec(Cmd
,cmdp
+1,&decimation
);
556 averaging
= param_getchar(Cmd
,cmdp
+1) == '1';
560 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
568 errors
= 1;// No args
574 return usage_lf_config();
576 //Bps is limited to 8, so fits in lower half of arg1
577 if(bps
>> 8) bps
= 8;
579 sample_config config
= {
580 decimation
,bps
,averaging
,divisor
,trigger_threshold
582 //Averaging is a flag on high-bit of arg[1]
583 UsbCommand c
= {CMD_SET_LF_SAMPLING_CONFIG
};
584 memcpy(c
.d
.asBytes
,&config
,sizeof(sample_config
));
585 clearCommandBuffer();
590 int CmdLFRead(const char *Cmd
)
593 uint8_t cmdp
= param_getchar(Cmd
, 0);
595 if ( cmdp
== 'h' || cmdp
== 'H') return usage_lf_read();
598 if ( cmdp
== 's' || cmdp
== 'S') arg1
= true;
600 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
, {arg1
,0,0}};
601 clearCommandBuffer();
603 if ( !WaitForResponseTimeout(CMD_ACK
,NULL
,2500) ) {
604 PrintAndLog("command execution time out");
610 int CmdLFSnoop(const char *Cmd
)
612 uint8_t cmdp
= param_getchar(Cmd
, 0);
613 if(cmdp
== 'h' || cmdp
== 'H') return usage_lf_snoop();
615 UsbCommand c
= {CMD_LF_SNOOP_RAW_ADC_SAMPLES
};
616 clearCommandBuffer();
618 WaitForResponse(CMD_ACK
,NULL
);
622 static void ChkBitstream(const char *str
)
626 /* convert to bitstream if necessary */
627 for (i
= 0; i
< (int)(GraphTraceLen
/ 2); i
++){
628 if (GraphBuffer
[i
] > 1 || GraphBuffer
[i
] < 0) {
634 //Attempt to simulate any wave in buffer (one bit per output sample)
635 // converts GraphBuffer to bitstream (based on zero crossings) if needed.
636 int CmdLFSim(const char *Cmd
)
641 sscanf(Cmd
, "%i", &gap
);
643 // convert to bitstream if necessary
646 //can send only 512 bits at a time (1 byte sent per bit...)
647 printf("Sending [%d bytes]", GraphTraceLen
);
648 for (i
= 0; i
< GraphTraceLen
; i
+= USB_CMD_DATA_SIZE
) {
649 UsbCommand c
= {CMD_DOWNLOADED_SIM_SAMPLES_125K
, {i
, 0, 0}};
651 for (j
= 0; j
< USB_CMD_DATA_SIZE
; j
++) {
652 c
.d
.asBytes
[j
] = GraphBuffer
[i
+j
];
654 clearCommandBuffer();
656 WaitForResponse(CMD_ACK
,NULL
);
660 PrintAndLog("\nStarting to simulate");
661 UsbCommand c
= {CMD_SIMULATE_TAG_125K
, {GraphTraceLen
, gap
, 0}};
662 clearCommandBuffer();
667 // by marshmellow - sim ask data given clock, fcHigh, fcLow, invert
668 // - allow pull data from DemodBuffer
669 int CmdLFfskSim(const char *Cmd
)
671 //might be able to autodetect FCs and clock from Graphbuffer if using demod buffer
672 // otherwise will need FChigh, FClow, Clock, and bitstream
673 uint8_t fcHigh
=0, fcLow
=0, clk
=0;
676 char hexData
[32] = {0x00}; // store entered hex data
677 uint8_t data
[255] = {0x00};
680 while(param_getchar(Cmd
, cmdp
) != 0x00)
682 switch(param_getchar(Cmd
, cmdp
))
685 return usage_lf_simfsk();
691 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
695 errors
|= param_getdec(Cmd
,cmdp
+1,&fcHigh
);
699 errors
|= param_getdec(Cmd
,cmdp
+1,&fcLow
);
707 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
711 dataLen
= hextobinarray((char *)data
, hexData
);
713 if (dataLen
==0) errors
=TRUE
;
714 if (errors
) PrintAndLog ("Error getting hex data");
718 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
724 if(cmdp
== 0 && DemodBufferLen
== 0)
726 errors
= TRUE
;// No args
732 return usage_lf_simfsk();
735 if (dataLen
== 0){ //using DemodBuffer
736 if (clk
==0 || fcHigh
==0 || fcLow
==0){ //manual settings must set them all
737 uint8_t ans
= fskClocks(&fcHigh
, &fcLow
, &clk
, 0);
739 if (!fcHigh
) fcHigh
=10;
745 setDemodBuf(data
, dataLen
, 0);
748 //default if not found
749 if (clk
== 0) clk
= 50;
750 if (fcHigh
== 0) fcHigh
= 10;
751 if (fcLow
== 0) fcLow
= 8;
754 arg1
= fcHigh
<< 8 | fcLow
;
755 arg2
= invert
<< 8 | clk
;
756 size_t size
= DemodBufferLen
;
757 if (size
> USB_CMD_DATA_SIZE
) {
758 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
759 size
= USB_CMD_DATA_SIZE
;
761 UsbCommand c
= {CMD_FSK_SIM_TAG
, {arg1
, arg2
, size
}};
763 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
764 clearCommandBuffer();
769 // by marshmellow - sim ask data given clock, invert, manchester or raw, separator
770 // - allow pull data from DemodBuffer
771 int CmdLFaskSim(const char *Cmd
)
773 //autodetect clock from Graphbuffer if using demod buffer
774 // needs clock, invert, manchester/raw as m or r, separator as s, and bitstream
775 uint8_t encoding
= 1, separator
= 0;
776 uint8_t clk
=0, invert
=0;
778 char hexData
[32] = {0x00};
779 uint8_t data
[255]= {0x00}; // store entered hex data
782 while(param_getchar(Cmd
, cmdp
) != 0x00)
784 switch(param_getchar(Cmd
, cmdp
))
787 return usage_lf_simask();
793 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
797 encoding
=2; //biphase
813 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
817 dataLen
= hextobinarray((char *)data
, hexData
);
819 if (dataLen
==0) errors
=TRUE
;
820 if (errors
) PrintAndLog ("Error getting hex data, datalen: %d",dataLen
);
824 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
830 if(cmdp
== 0 && DemodBufferLen
== 0)
832 errors
= TRUE
;// No args
838 return usage_lf_simask();
840 if (dataLen
== 0){ //using DemodBuffer
841 if (clk
== 0) clk
= GetAskClock("0", false, false);
843 setDemodBuf(data
, dataLen
, 0);
845 if (clk
== 0) clk
= 64;
846 if (encoding
== 0) clk
= clk
/2; //askraw needs to double the clock speed
848 size_t size
=DemodBufferLen
;
849 arg1
= clk
<< 8 | encoding
;
850 arg2
= invert
<< 8 | separator
;
851 if (size
> USB_CMD_DATA_SIZE
) {
852 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
853 size
= USB_CMD_DATA_SIZE
;
855 UsbCommand c
= {CMD_ASK_SIM_TAG
, {arg1
, arg2
, size
}};
856 PrintAndLog("preparing to sim ask data: %d bits", size
);
857 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
858 clearCommandBuffer();
863 // by marshmellow - sim psk data given carrier, clock, invert
864 // - allow pull data from DemodBuffer or parameters
865 int CmdLFpskSim(const char *Cmd
)
867 //might be able to autodetect FC and clock from Graphbuffer if using demod buffer
868 //will need carrier, Clock, and bitstream
869 uint8_t carrier
=0, clk
=0;
872 char hexData
[32] = {0x00}; // store entered hex data
873 uint8_t data
[255] = {0x00};
877 while(param_getchar(Cmd
, cmdp
) != 0x00)
879 switch(param_getchar(Cmd
, cmdp
))
882 return usage_lf_simpsk();
888 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
892 errors
|= param_getdec(Cmd
,cmdp
+1,&carrier
);
908 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
912 dataLen
= hextobinarray((char *)data
, hexData
);
914 if (dataLen
==0) errors
=TRUE
;
915 if (errors
) PrintAndLog ("Error getting hex data");
919 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
925 if (cmdp
== 0 && DemodBufferLen
== 0)
927 errors
= TRUE
;// No args
933 return usage_lf_simpsk();
935 if (dataLen
== 0){ //using DemodBuffer
936 PrintAndLog("Getting Clocks");
937 if (clk
==0) clk
= GetPskClock("", FALSE
, FALSE
);
938 PrintAndLog("clk: %d",clk
);
939 if (!carrier
) carrier
= GetPskCarrier("", FALSE
, FALSE
);
940 PrintAndLog("carrier: %d", carrier
);
942 setDemodBuf(data
, dataLen
, 0);
945 if (clk
<= 0) clk
= 32;
946 if (carrier
== 0) carrier
= 2;
949 //need to convert psk2 to psk1 data before sim
950 psk2TOpsk1(DemodBuffer
, DemodBufferLen
);
952 PrintAndLog("Sorry, PSK3 not yet available");
956 arg1
= clk
<< 8 | carrier
;
958 size_t size
=DemodBufferLen
;
959 if (size
> USB_CMD_DATA_SIZE
) {
960 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
961 size
=USB_CMD_DATA_SIZE
;
963 UsbCommand c
= {CMD_PSK_SIM_TAG
, {arg1
, arg2
, size
}};
964 PrintAndLog("DEBUG: Sending DemodBuffer Length: %d", size
);
965 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
966 clearCommandBuffer();
972 int CmdLFSimBidir(const char *Cmd
)
974 // Set ADC to twice the carrier for a slight supersampling
975 // HACK: not implemented in ARMSRC.
976 PrintAndLog("Not implemented yet.");
977 UsbCommand c
= {CMD_LF_SIMULATE_BIDIR
, {47, 384, 0}};
982 int CmdVchDemod(const char *Cmd
)
984 // Is this the entire sync pattern, or does this also include some
985 // data bits that happen to be the same everywhere? That would be
987 static const int SyncPattern
[] = {
988 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
989 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
990 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
991 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
992 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
993 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
994 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
995 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
996 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
997 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1000 // So first, we correlate for the sync pattern, and mark that.
1001 int bestCorrel
= 0, bestPos
= 0;
1003 // It does us no good to find the sync pattern, with fewer than
1004 // 2048 samples after it...
1005 for (i
= 0; i
< (GraphTraceLen
-2048); i
++) {
1008 for (j
= 0; j
< arraylen(SyncPattern
); j
++) {
1009 sum
+= GraphBuffer
[i
+j
]*SyncPattern
[j
];
1011 if (sum
> bestCorrel
) {
1016 PrintAndLog("best sync at %d [metric %d]", bestPos
, bestCorrel
);
1021 int worst
= INT_MAX
;
1024 for (i
= 0; i
< 2048; i
+= 8) {
1027 for (j
= 0; j
< 8; j
++) {
1028 sum
+= GraphBuffer
[bestPos
+i
+j
];
1035 if(abs(sum
) < worst
) {
1040 PrintAndLog("bits:");
1041 PrintAndLog("%s", bits
);
1042 PrintAndLog("worst metric: %d at pos %d", worst
, worstPos
);
1044 if (strcmp(Cmd
, "clone")==0) {
1047 for(s
= bits
; *s
; s
++) {
1049 for(j
= 0; j
< 16; j
++) {
1050 GraphBuffer
[GraphTraceLen
++] = (*s
== '1') ? 1 : 0;
1053 RepaintGraphWindow();
1059 int CmdLFfind(const char *Cmd
) {
1061 char cmdp
= param_getchar(Cmd
, 0);
1062 char testRaw
= param_getchar(Cmd
, 1);
1063 if (strlen(Cmd
) > 3 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_find();
1065 if (!offline
&& (cmdp
!= '1')){
1067 getSamples("30000",false);
1068 } else if (GraphTraceLen
< 1000) {
1069 PrintAndLog("Data in Graphbuffer was too small.");
1072 if (cmdp
== 'u' || cmdp
== 'U') testRaw
= 'u';
1074 PrintAndLog("NOTE: some demods output possible binary\n if it finds something that looks like a tag");
1075 PrintAndLog("False Positives ARE possible\n");
1076 PrintAndLog("\nChecking for known tags:\n");
1078 ans
=CmdFSKdemodIO("");
1080 PrintAndLog("\nValid IO Prox ID Found!");
1084 ans
=CmdFSKdemodPyramid("");
1086 PrintAndLog("\nValid Pyramid ID Found!");
1090 ans
=CmdFSKdemodParadox("");
1092 PrintAndLog("\nValid Paradox ID Found!");
1096 ans
=CmdFSKdemodAWID("");
1098 PrintAndLog("\nValid AWID ID Found!");
1102 ans
=CmdFSKdemodHID("");
1104 PrintAndLog("\nValid HID Prox ID Found!");
1108 ans
=CmdAskEM410xDemod("");
1110 PrintAndLog("\nValid EM410x ID Found!");
1114 ans
=CmdG_Prox_II_Demod("");
1116 PrintAndLog("\nValid Guardall G-Prox II ID Found!");
1120 ans
=CmdFDXBdemodBI("");
1122 PrintAndLog("\nValid FDX-B ID Found!");
1126 ans
=EM4x50Read("", false);
1128 PrintAndLog("\nValid EM4x50 ID Found!");
1132 ans
=CmdVikingDemod("");
1134 PrintAndLog("\nValid Viking ID Found!");
1138 ans
=CmdIndalaDecode("");
1140 PrintAndLog("\nValid Indala ID Found!");
1144 ans
=CmdPSKNexWatch("");
1146 PrintAndLog("\nValid NexWatch ID Found!");
1152 PrintAndLog("\nNo Known Tags Found!\n");
1153 if (testRaw
=='u' || testRaw
=='U'){
1154 //test unknown tag formats (raw mode)
1155 PrintAndLog("\nChecking for Unknown tags:\n");
1156 ans
=AutoCorrelate(4000, FALSE
, FALSE
);
1160 PrintAndLog("Possible Auto Correlation of %d repeating samples",ans
);
1162 if ( ans
% 8 == 0) {
1163 int bytes
= (ans
/ 8);
1164 PrintAndLog("Possible %d bytes", bytes
);
1166 if ( bytes
% 2 == 0) {
1167 blocks
= (bytes
/ 2);
1168 PrintAndLog("Possible 2 blocks, width %d", blocks
);
1170 if ( bytes
% 4 == 0) {
1171 blocks
= (bytes
/ 4);
1172 PrintAndLog("Possible 4 blocks, width %d", blocks
);
1174 if ( bytes
% 8 == 0) {
1175 blocks
= (bytes
/ 8);
1176 PrintAndLog("Possible 8 blocks, width %d", blocks
);
1178 if ( bytes
% 16 == 0) {
1179 blocks
= (bytes
/ 16);
1180 PrintAndLog("Possible 16 blocks, width %d", blocks
);
1185 ans
=GetFskClock("",FALSE
,FALSE
);
1186 if (ans
!= 0){ //fsk
1187 ans
=FSKrawDemod("",TRUE
);
1189 PrintAndLog("\nUnknown FSK Modulated Tag Found!");
1194 ans
=ASKDemod("0 0 0",TRUE
,FALSE
,1);
1196 PrintAndLog("\nUnknown ASK Modulated and Manchester encoded Tag Found!");
1197 PrintAndLog("\nif it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'");
1201 ans
=CmdPSK1rawDemod("");
1203 PrintAndLog("Possible unknown PSK1 Modulated Tag Found above!\n\nCould also be PSK2 - try 'data rawdemod p2'");
1204 PrintAndLog("\nCould also be PSK3 - [currently not supported]");
1205 PrintAndLog("\nCould also be NRZ - try 'data nrzrawdemod");
1208 PrintAndLog("\nNo Data Found!\n");
1213 static command_t CommandTable
[] =
1215 {"help", CmdHelp
, 1, "This help"},
1216 {"awid", CmdLFAWID
, 1, "{ AWID RFIDs... }"},
1217 {"em4x", CmdLFEM4X
, 1, "{ EM4X RFIDs... }"},
1218 {"hid", CmdLFHID
, 1, "{ HID RFIDs... }"},
1219 {"hitag", CmdLFHitag
, 1, "{ HITAG RFIDs... }"},
1220 {"io", CmdLFIO
, 1, "{ IOPROX RFIDs... }"},
1221 {"pcf7931", CmdLFPCF7931
, 1, "{ PCF7931 RFIDs... }"},
1222 {"ti", CmdLFTI
, 1, "{ TI RFIDs... }"},
1223 {"t55xx", CmdLFT55XX
, 1, "{ T55X7 RFIDs... }"},
1224 {"viking", CmdLFViking
, 1, "{ Viking RFIDs... }"},
1225 {"config", CmdLFSetConfig
, 0, "Set config for LF sampling, bit/sample, decimation, frequency"},
1227 {"cmdread", CmdLFCommandRead
, 0, "<off period> <'0' period> <'1' period> <command> ['h' 134] \n\t\t-- Modulate LF reader field to send command before read (all periods in microseconds)"},
1228 {"flexdemod", CmdFlexdemod
, 1, "Demodulate samples for FlexPass"},
1229 {"indalademod", CmdIndalaDemod
, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
1230 {"indalaclone", CmdIndalaClone
, 0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
1231 {"read", CmdLFRead
, 0, "['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"},
1232 {"search", CmdLFfind
, 1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) \n\t\t-- 'u' to search for unknown tags"},
1233 {"sim", CmdLFSim
, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
1234 {"simask", CmdLFaskSim
, 0, "[clock] [invert <1|0>] [biphase/manchester/raw <'b'|'m'|'r'>] [msg separator 's'] [d <hexdata>] \n\t\t-- Simulate LF ASK tag from demodbuffer or input"},
1235 {"simfsk", CmdLFfskSim
, 0, "[c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>] \n\t\t-- Simulate LF FSK tag from demodbuffer or input"},
1236 {"simpsk", CmdLFpskSim
, 0, "[1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>] \n\t\t-- Simulate LF PSK tag from demodbuffer or input"},
1237 {"simbidir", CmdLFSimBidir
, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
1238 {"snoop", CmdLFSnoop
, 0, "Snoop LF"},
1239 {"vchdemod", CmdVchDemod
, 1, "['clone'] -- Demodulate samples for VeriChip"},
1240 {NULL
, NULL
, 0, NULL
}
1243 int CmdLF(const char *Cmd
)
1245 CmdsParse(CommandTable
, Cmd
);
1249 int CmdHelp(const char *Cmd
)
1251 CmdsHelp(CommandTable
);