1 //----------------------------------------------------------------------------- 
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> 
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or, 
   5 // at your option, any later version. See the LICENSE.txt file for the text of 
   7 //----------------------------------------------------------------------------- 
   8 // Low frequency commands 
   9 //----------------------------------------------------------------------------- 
  11 static int CmdHelp(const char *Cmd
); 
  13 int usage_lf_cmdread(void) { 
  14         PrintAndLog("Usage: lf cmdread d <delay period> z <zero period> o <one period> c <cmdbytes> [H]"); 
  15         PrintAndLog("Options:"); 
  16         PrintAndLog("       h             This help"); 
  17         PrintAndLog("       L             Low frequency (125 KHz)"); 
  18         PrintAndLog("       H             High frequency (134 KHz)"); 
  19         PrintAndLog("       d <delay>     delay OFF period, (decimal)"); 
  20         PrintAndLog("       z <zero>      time period ZERO, (decimal)"); 
  21         PrintAndLog("       o <one>       time period ONE, (decimal)"); 
  22         PrintAndLog("       c <cmd>       Command bytes  (in ones and zeros)"); 
  23         PrintAndLog("       ************* All periods in microseconds (ms)"); 
  24         PrintAndLog("Examples:"); 
  25         PrintAndLog("      lf cmdread d 80 z 100 o 200 c 11000"); 
  26         PrintAndLog("      lf cmdread d 80 z 100 o 100 c 11000 H"); 
  29 int usage_lf_read(void){ 
  30         PrintAndLog("Usage: lf read [h] [s]"); 
  31         PrintAndLog("Options:"); 
  32         PrintAndLog("       h            This help"); 
  33         PrintAndLog("       s            silent run no printout"); 
  34         PrintAndLog("This function takes no arguments. "); 
  35         PrintAndLog("Use 'lf config' to set parameters."); 
  38 int usage_lf_snoop(void) { 
  39         PrintAndLog("Snoop low frequence signal. Use 'lf config' to set parameters."); 
  40         PrintAndLog("Usage: lf snoop [h]"); 
  41         PrintAndLog("Options:"); 
  42         PrintAndLog("      h         This help"); 
  45 int usage_lf_config(void) { 
  46         PrintAndLog("Usage: lf config [h] [H|<divisor>] [b <bps>] [d <decim>] [a 0|1]"); 
  47         PrintAndLog("Options:"); 
  48         PrintAndLog("       h             This help"); 
  49         PrintAndLog("       L             Low frequency (125 KHz)"); 
  50         PrintAndLog("       H             High frequency (134 KHz)"); 
  51         PrintAndLog("       q <divisor>   Manually set divisor. 88-> 134KHz, 95-> 125 Hz"); 
  52         PrintAndLog("       b <bps>       Sets resolution of bits per sample. Default (max): 8"); 
  53         PrintAndLog("       d <decim>     Sets decimation. A value of N saves only 1 in N samples. Default: 1"); 
  54         PrintAndLog("       a [0|1]       Averaging - if set, will average the stored sample value when decimating. Default: 1"); 
  55         PrintAndLog("       t <threshold> Sets trigger threshold. 0 means no threshold (range: 0-128)"); 
  56         PrintAndLog("Examples:"); 
  57         PrintAndLog("      lf config b 8 L"); 
  58         PrintAndLog("                    Samples at 125KHz, 8bps."); 
  59         PrintAndLog("      lf config H b 4 d 3"); 
  60         PrintAndLog("                    Samples at 134KHz, averages three samples into one, stored with "); 
  61         PrintAndLog("                    a resolution of 4 bits per sample."); 
  62         PrintAndLog("      lf read"); 
  63         PrintAndLog("                    Performs a read (active field)"); 
  64         PrintAndLog("      lf snoop"); 
  65         PrintAndLog("                    Performs a snoop (no active field)"); 
  68 int usage_lf_simfsk(void) { 
  69         PrintAndLog("Usage: lf simfsk [c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>]"); 
  70         PrintAndLog("Options:"); 
  71         PrintAndLog("       h              This help"); 
  72         PrintAndLog("       c <clock>      Manually set clock - can autodetect if using DemodBuffer"); 
  73         PrintAndLog("       i              invert data"); 
  74         PrintAndLog("       H <fcHigh>     Manually set the larger Field Clock"); 
  75         PrintAndLog("       L <fcLow>      Manually set the smaller Field Clock"); 
  76         //PrintAndLog("       s              TBD- -to enable a gap between playback repetitions - default: no gap"); 
  77         PrintAndLog("       d <hexdata>    Data to sim as hex - omit to sim from DemodBuffer"); 
  78         PrintAndLog("\n  NOTE: if you set one clock manually set them all manually"); 
  81 int usage_lf_simask(void) { 
  82         PrintAndLog("Usage: lf simask [c <clock>] [i] [b|m|r] [s] [d <raw hex to sim>]"); 
  83         PrintAndLog("Options:"); 
  84         PrintAndLog("       h              This help"); 
  85         PrintAndLog("       c <clock>      Manually set clock - can autodetect if using DemodBuffer"); 
  86         PrintAndLog("       i              invert data"); 
  87         PrintAndLog("       b              sim ask/biphase"); 
  88         PrintAndLog("       m              sim ask/manchester - Default"); 
  89         PrintAndLog("       r              sim ask/raw"); 
  90         PrintAndLog("       s              add t55xx Sequence Terminator gap - default: no gaps (only manchester)"); 
  91         PrintAndLog("       d <hexdata>    Data to sim as hex - omit to sim from DemodBuffer"); 
  94 int usage_lf_simpsk(void) { 
  95         PrintAndLog("Usage: lf simpsk [1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>]"); 
  96         PrintAndLog("Options:"); 
  97         PrintAndLog("       h              This help"); 
  98         PrintAndLog("       c <clock>      Manually set clock - can autodetect if using DemodBuffer"); 
  99         PrintAndLog("       i              invert data"); 
 100         PrintAndLog("       1              set PSK1 (default)"); 
 101         PrintAndLog("       2              set PSK2"); 
 102         PrintAndLog("       3              set PSK3"); 
 103         PrintAndLog("       r <carrier>    2|4|8 are valid carriers: default = 2"); 
 104         PrintAndLog("       d <hexdata>    Data to sim as hex - omit to sim from DemodBuffer"); 
 107 int usage_lf_find(void){ 
 108     PrintAndLog("Usage:  lf search [h] <0|1> [u]"); 
 110         PrintAndLog("Options:"); 
 111         PrintAndLog("       h             This help"); 
 112         PrintAndLog("       <0|1>         Use data from Graphbuffer, if not set, try reading data from tag."); 
 113     PrintAndLog("       u             Search for Unknown tags, if not set, reads only known tags."); 
 114         PrintAndLog("Examples:"); 
 115     PrintAndLog("      lf search     = try reading data from tag & search for known tags"); 
 116     PrintAndLog("      lf search 1   = use data from GraphBuffer & search for known tags"); 
 117     PrintAndLog("      lf search u   = try reading data from tag & search for known and unknown tags"); 
 118     PrintAndLog("      lf search 1 u = use data from GraphBuffer & search for known and unknown tags"); 
 123 /* send a LF command before reading */ 
 124 int CmdLFCommandRead(const char *Cmd
) { 
 127         bool useHighFreq 
= FALSE
; 
 128         uint16_t one 
= 0, zero 
= 0; 
 130         UsbCommand c 
= {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
, {0,0,0}}; 
 132         while(param_getchar(Cmd
, cmdp
) != 0x00) { 
 133                 switch(param_getchar(Cmd
, cmdp
)) { 
 135                         return usage_lf_cmdread(); 
 144                         param_getstr(Cmd
, cmdp
+1, (char *)&c
.d
.asBytes
); 
 148                         c
.arg
[0] = param_get32ex(Cmd
, cmdp
+1, 0, 10); 
 152                         zero 
= param_get32ex(Cmd
, cmdp
+1, 0, 10) & 0xFFFF; 
 156                         one 
= param_get32ex(Cmd
, cmdp
+1, 0, 10) & 0xFFFF; 
 160                         PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
)); 
 167         if (cmdp 
== 0) errors 
= TRUE
; 
 170         if (errors
) return usage_lf_cmdread(); 
 172         // zero and one lengths 
 173         c
.arg
[1] = (uint32_t)(zero 
<< 16 | one
); 
 175         // add frequency 125 or 134 
 176         c
.arg
[2] = useHighFreq
; 
 178         clearCommandBuffer(); 
 183 int CmdFlexdemod(const char *Cmd
) 
 185 #define LONG_WAIT 100    
 186         int i
, j
, start
, bit
, sum
; 
 189         for (i 
= 0; i 
< GraphTraceLen
; ++i
) 
 190                 GraphBuffer
[i
] = (GraphBuffer
[i
] < 0) ? -1 : 1; 
 192         for (start 
= 0; start 
< GraphTraceLen 
- LONG_WAIT
; start
++) { 
 193                 int first 
= GraphBuffer
[start
]; 
 194                 for (i 
= start
; i 
< start 
+ LONG_WAIT
; i
++) { 
 195                         if (GraphBuffer
[i
] != first
) { 
 199                 if (i 
== (start 
+ LONG_WAIT
)) 
 203         if (start 
== GraphTraceLen 
- LONG_WAIT
) { 
 204                 PrintAndLog("nothing to wait for"); 
 208         GraphBuffer
[start
] = 2; 
 209         GraphBuffer
[start
+1] = -2; 
 210         uint8_t bits
[64] = {0x00}; 
 213         for (bit 
= 0; bit 
< 64; bit
++) { 
 215                 for (int j 
= 0; j 
< 16; j
++) { 
 216                         sum 
+= GraphBuffer
[i
++]; 
 218                 bits
[bit
] = (sum 
> 0) ? 1 : 0; 
 219                 PrintAndLog("bit %d sum %d", bit
, sum
); 
 222         for (bit 
= 0; bit 
< 64; bit
++) { 
 224                 for (j 
= 0; j 
< 16; j
++) 
 225                         sum 
+= GraphBuffer
[i
++]; 
 227                 if (sum 
> 0 && bits
[bit
] != 1) PrintAndLog("oops1 at %d", bit
); 
 229                 if (sum 
< 0 && bits
[bit
] != 0) PrintAndLog("oops2 at %d", bit
); 
 233         // HACK writing back to graphbuffer. 
 234         GraphTraceLen 
= 32*64; 
 236         for (bit 
= 0; bit 
< 64; bit
++) { 
 238                 phase 
= (bits
[bit
] == 0) ? 0 : 1; 
 240                 for (j 
= 0; j 
< 32; j
++) { 
 241                         GraphBuffer
[i
++] = phase
; 
 245         RepaintGraphWindow(); 
 249 int CmdIndalaDemod(const char *Cmd
) 
 253         // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID 
 258         // worst case with GraphTraceLen=64000 is < 4096 
 259         // under normal conditions it's < 2048 
 260         uint8_t rawbits
[4096]; 
 262         int rawbit 
= 0, worst 
= 0, worstPos 
= 0; 
 263         // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32); 
 265         // loop through raw signal - since we know it is psk1 rf/32 fc/2 skip every other value (+=2) 
 266         for (i 
= 0; i 
< GraphTraceLen
-1; i 
+= 2) { 
 268                 if ((GraphBuffer
[i
] > GraphBuffer
[i 
+ 1]) && (state 
!= 1)) { 
 269                         // appears redundant - marshmellow 
 271                                 for (j 
= 0; j 
<  count 
- 8; j 
+= 16) { 
 272                                         rawbits
[rawbit
++] = 0; 
 274                                 if ((abs(count 
- j
)) > worst
) { 
 275                                         worst 
= abs(count 
- j
); 
 281                 } else if ((GraphBuffer
[i
] < GraphBuffer
[i 
+ 1]) && (state 
!= 0)) { 
 284                                 for (j 
= 0; j 
<  count 
- 8; j 
+= 16) { 
 285                                         rawbits
[rawbit
++] = 1; 
 287                                 if ((abs(count 
- j
)) > worst
) { 
 288                                         worst 
= abs(count 
- j
); 
 296         if ( rawbit
<1 ) return 0; 
 299                 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit
, GraphTraceLen
/32); 
 300                 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst
, worstPos
); 
 303         // Finding the start of a UID 
 304         int uidlen
, long_wait
; 
 305         if (strcmp(Cmd
, "224") == 0) { 
 315         for (start 
= 0; start 
<= rawbit 
- uidlen
; start
++) { 
 316                 first 
= rawbits
[start
]; 
 317                 for (i 
= start
; i 
< start 
+ long_wait
; i
++) { 
 318                         if (rawbits
[i
] != first
) { 
 322                 if (i 
== (start 
+ long_wait
)) { 
 327         if (start 
== rawbit 
- uidlen 
+ 1) { 
 328                 if (g_debugMode
) PrintAndLog("nothing to wait for"); 
 332         // Inverting signal if needed 
 334                 for (i 
= start
; i 
< rawbit
; i
++) 
 335                         rawbits
[i
] = !rawbits
[i
]; 
 339         uint8_t bits
[224] = {0x00}; 
 340         char showbits
[225] = {0x00}; 
 345         if (uidlen 
> rawbit
) { 
 346                 PrintAndLog("Warning: not enough raw bits to get a full UID"); 
 347                 for (bit 
= 0; bit 
< rawbit
; bit
++) { 
 348                         bits
[bit
] = rawbits
[i
++]; 
 349                         // As we cannot know the parity, let's use "." and "/" 
 350                         showbits
[bit
] = '.' + bits
[bit
]; 
 352                 showbits
[bit
+1]='\0'; 
 353                 PrintAndLog("Partial UID=%s", showbits
); 
 356                 for (bit 
= 0; bit 
< uidlen
; bit
++) { 
 357                         bits
[bit
] = rawbits
[i
++]; 
 358                         showbits
[bit
] = '0' + bits
[bit
]; 
 364         uint32_t uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
; 
 369                 for( idx
=0; idx
<64; idx
++) { 
 370                         if (showbits
[idx
] == '0') { 
 371                                 uid1 
= (uid1
<<1) | (uid2
>>31); 
 372                                 uid2 
= (uid2
<<1) | 0; 
 374                                 uid1 
= (uid1
<<1) | (uid2
>>31); 
 375                                 uid2 
= (uid2
<<1) | 1; 
 378                 PrintAndLog("UID=%s (%x%08x)", showbits
, uid1
, uid2
); 
 380                 uid3 
= uid4 
= uid5 
= uid6 
= uid7 
= 0; 
 382                 for( idx
=0; idx
<224; idx
++) { 
 383                         uid1 
= (uid1
<<1) | (uid2
>>31); 
 384                         uid2 
= (uid2
<<1) | (uid3
>>31); 
 385                         uid3 
= (uid3
<<1) | (uid4
>>31); 
 386                         uid4 
= (uid4
<<1) | (uid5
>>31); 
 387                         uid5 
= (uid5
<<1) | (uid6
>>31); 
 388                         uid6 
= (uid6
<<1) | (uid7
>>31); 
 390                         if (showbits
[idx
] == '0')  
 391                                 uid7 
= (uid7
<<1) | 0; 
 393                                 uid7 
= (uid7
<<1) | 1; 
 395                 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits
, uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
); 
 398         // Checking UID against next occurrences 
 400         for (; i 
+ uidlen 
<= rawbit
;) { 
 402                 for (bit 
= 0; bit 
< uidlen
; bit
++) { 
 403                         if (bits
[bit
] != rawbits
[i
++]) { 
 414         if (g_debugMode
) PrintAndLog("Occurrences: %d (expected %d)", times
, (rawbit 
- start
) / uidlen
); 
 416         // Remodulating for tag cloning 
 417         // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)  
 418         // since this changes graphbuffer data. 
 419         GraphTraceLen 
= 32 * uidlen
; 
 422         for (bit 
= 0; bit 
< uidlen
; bit
++) { 
 423                 phase 
= (bits
[bit
] == 0) ? 0 : 1; 
 425                 for (j 
= 0; j 
< 32; j
++) { 
 426                         GraphBuffer
[i
++] = phase
; 
 431         RepaintGraphWindow(); 
 435 int CmdIndalaClone(const char *Cmd
){ 
 437         unsigned int uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
; 
 439         uid1 
=  uid2 
= uid3 
= uid4 
= uid5 
= uid6 
= uid7 
= 0; 
 442         if (strchr(Cmd
,'l') != 0) { 
 443                 while (sscanf(&Cmd
[i
++], "%1x", &n 
) == 1) { 
 444                         uid1 
= (uid1 
<< 4) | (uid2 
>> 28); 
 445                         uid2 
= (uid2 
<< 4) | (uid3 
>> 28); 
 446                         uid3 
= (uid3 
<< 4) | (uid4 
>> 28); 
 447                         uid4 
= (uid4 
<< 4) | (uid5 
>> 28); 
 448                         uid5 
= (uid5 
<< 4) | (uid6 
>> 28); 
 449                         uid6 
= (uid6 
<< 4) | (uid7 
>> 28); 
 450                         uid7 
= (uid7 
<< 4) | (n 
& 0xf); 
 452                 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
); 
 453                 c
.cmd 
= CMD_INDALA_CLONE_TAG_L
; 
 454                 c
.d
.asDwords
[0] = uid1
; 
 455                 c
.d
.asDwords
[1] = uid2
; 
 456                 c
.d
.asDwords
[2] = uid3
; 
 457                 c
.d
.asDwords
[3] = uid4
; 
 458                 c
.d
.asDwords
[4] = uid5
; 
 459                 c
.d
.asDwords
[5] = uid6
; 
 460                 c
.d
.asDwords
[6] = uid7
; 
 462                 while (sscanf(&Cmd
[i
++], "%1x", &n 
) == 1) { 
 463                         uid1 
= (uid1 
<< 4) | (uid2 
>> 28); 
 464                         uid2 
= (uid2 
<< 4) | (n 
& 0xf); 
 466                 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1
, uid2
); 
 467                 c
.cmd 
= CMD_INDALA_CLONE_TAG
; 
 472         clearCommandBuffer(); 
 477 int CmdLFSetConfig(const char *Cmd
) { 
 478         uint8_t divisor 
=  0;//Frequency divisor 
 479         uint8_t bps 
= 0; // Bits per sample 
 480         uint8_t decimation 
= 0; //How many to keep 
 481         bool averaging 
= 1; // Defaults to true 
 483         int trigger_threshold 
= -1;//Means no change 
 484         uint8_t unsigned_trigg 
= 0; 
 487         while(param_getchar(Cmd
, cmdp
) != 0x00) { 
 488                 switch(param_getchar(Cmd
, cmdp
)) { 
 490                         return usage_lf_config(); 
 500                         errors 
|= param_getdec(Cmd
,cmdp
+1,&divisor
); 
 504                         errors 
|= param_getdec(Cmd
,cmdp
+1,&unsigned_trigg
); 
 506                         if(!errors
) trigger_threshold 
= unsigned_trigg
; 
 509                         errors 
|= param_getdec(Cmd
,cmdp
+1,&bps
); 
 513                         errors 
|= param_getdec(Cmd
,cmdp
+1,&decimation
); 
 517                         averaging 
= param_getchar(Cmd
,cmdp
+1) == '1'; 
 521                         PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
)); 
 529         if (cmdp 
== 0) errors 
= 1; 
 532         if (errors
) return usage_lf_config(); 
 534         //Bps is limited to 8, so fits in lower half of arg1 
 535         if (bps 
>> 4) bps 
= 8; 
 537         sample_config config 
= { decimation
, bps
, averaging
, divisor
, trigger_threshold 
}; 
 539         //Averaging is a flag on high-bit of arg[1] 
 540         UsbCommand c 
= {CMD_SET_LF_SAMPLING_CONFIG
}; 
 541         memcpy(c
.d
.asBytes
,&config
,sizeof(sample_config
)); 
 542         clearCommandBuffer(); 
 547 int CmdLFRead(const char *Cmd
) { 
 549         uint8_t cmdp 
=  param_getchar(Cmd
, 0); 
 551         if ( cmdp 
== 'h' || cmdp 
== 'H') return usage_lf_read(); 
 554         if ( cmdp 
== 's' || cmdp 
== 'S') arg1 
= true; 
 556         UsbCommand c 
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
, {arg1
,0,0}}; 
 557         clearCommandBuffer(); 
 559         if ( !WaitForResponseTimeout(CMD_ACK
,NULL
,2500) ) { 
 560                 PrintAndLog("command execution time out"); 
 566 int CmdLFSnoop(const char *Cmd
) { 
 567         uint8_t cmdp 
= param_getchar(Cmd
, 0); 
 568         if(cmdp 
== 'h' || cmdp 
== 'H') return usage_lf_snoop(); 
 570         UsbCommand c 
= {CMD_LF_SNOOP_RAW_ADC_SAMPLES
,{0,0,0}}; 
 571         clearCommandBuffer();    
 573         WaitForResponse(CMD_ACK
,NULL
); 
 574         getSamples("", false); 
 578 static void ChkBitstream(const char *str
) { 
 579         // convert to bitstream if necessary 
 580         for (int i 
= 0; i 
< (int)(GraphTraceLen 
/ 2); i
++){ 
 581                 if (GraphBuffer
[i
] > 1 || GraphBuffer
[i
] < 0) { 
 587 //Attempt to simulate any wave in buffer (one bit per output sample) 
 588 // converts GraphBuffer to bitstream (based on zero crossings) if needed. 
 589 int CmdLFSim(const char *Cmd
) { 
 593         sscanf(Cmd
, "%i", &gap
); 
 595         // convert to bitstream if necessary  
 599                 printf("DEBUG: Sending [%d bytes]\n", GraphTraceLen
); 
 601         //can send only 512 bits at a time (1 byte sent per bit...) 
 602         for (i 
= 0; i 
< GraphTraceLen
; i 
+= USB_CMD_DATA_SIZE
) { 
 603                 UsbCommand c 
= {CMD_DOWNLOADED_SIM_SAMPLES_125K
, {i
, 0, 0}}; 
 605                 for (j 
= 0; j 
< USB_CMD_DATA_SIZE
; j
++) 
 606                         c
.d
.asBytes
[j
] = GraphBuffer
[i
+j
]; 
 608                 clearCommandBuffer(); 
 610                 WaitForResponse(CMD_ACK
, NULL
); 
 614         PrintAndLog("Simulating"); 
 616         UsbCommand c 
= {CMD_SIMULATE_TAG_125K
, {GraphTraceLen
, gap
, 0}}; 
 617         clearCommandBuffer(); 
 622 // by marshmellow - sim fsk data given clock, fcHigh, fcLow, invert  
 623 // - allow pull data from DemodBuffer 
 624 int CmdLFfskSim(const char *Cmd
) 
 626         //might be able to autodetect FCs and clock from Graphbuffer if using demod buffer 
 627         // otherwise will need FChigh, FClow, Clock, and bitstream 
 628         uint8_t fcHigh 
= 0, fcLow 
= 0, clk 
= 0; 
 631         char hexData
[32] = {0x00}; // store entered hex data 
 632         uint8_t data
[255] = {0x00};  
 636         while(param_getchar(Cmd
, cmdp
) != 0x00) { 
 637                 switch(param_getchar(Cmd
, cmdp
)){ 
 639                                 return usage_lf_simfsk(); 
 645                                 errors 
|= param_getdec(Cmd
, cmdp
+1, &clk
); 
 649                                 errors 
|= param_getdec(Cmd
, cmdp
+1, &fcHigh
); 
 653                                 errors 
|= param_getdec(Cmd
, cmdp
+1, &fcLow
); 
 661                                 dataLen 
= param_getstr(Cmd
, cmdp
+1, hexData
); 
 665                                         dataLen 
= hextobinarray((char *)data
, hexData
); 
 667                                 if (dataLen 
== 0) errors 
= TRUE
;  
 668                                 if (errors
) PrintAndLog ("Error getting hex data"); 
 672                                 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
)); 
 680         if(cmdp 
== 0 && DemodBufferLen 
== 0) 
 684         if(errors
) return usage_lf_simfsk(); 
 686         if (dataLen 
== 0){ //using DemodBuffer  
 687                 if (clk 
== 0 || fcHigh 
== 0 || fcLow 
== 0){ //manual settings must set them all 
 688                         uint8_t ans 
= fskClocks(&fcHigh
, &fcLow
, &clk
, 0); 
 690                                 if (!fcHigh
) fcHigh 
= 10; 
 691                                 if (!fcLow
) fcLow 
= 8; 
 696                 setDemodBuf(data
, dataLen
, 0); 
 699         //default if not found 
 700         if (clk 
== 0) clk 
= 50; 
 701         if (fcHigh 
== 0) fcHigh 
= 10; 
 702         if (fcLow 
== 0) fcLow 
= 8; 
 705         arg1 
= fcHigh 
<< 8 | fcLow
; 
 706         arg2 
= invert 
<< 8 | clk
; 
 707         size_t size 
= DemodBufferLen
; 
 708         if (size 
> USB_CMD_DATA_SIZE
) { 
 709                 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
); 
 710                 size 
= USB_CMD_DATA_SIZE
; 
 712         UsbCommand c 
= {CMD_FSK_SIM_TAG
, {arg1
, arg2
, size
}}; 
 714         memcpy(c
.d
.asBytes
, DemodBuffer
, size
); 
 715         clearCommandBuffer(); 
 720 // by marshmellow - sim ask data given clock, invert, manchester or raw, separator  
 721 // - allow pull data from DemodBuffer 
 722 int CmdLFaskSim(const char *Cmd
) 
 724         // autodetect clock from Graphbuffer if using demod buffer 
 725         // needs clock, invert, manchester/raw as m or r, separator as s, and bitstream 
 726         uint8_t encoding 
= 1, separator 
= 0, clk 
= 0, invert 
= 0; 
 728         char hexData
[32] = {0x00};  
 729         uint8_t data
[255]= {0x00}; // store entered hex data 
 733         while(param_getchar(Cmd
, cmdp
) != 0x00) { 
 734                 switch(param_getchar(Cmd
, cmdp
)) { 
 736                         case 'h': return usage_lf_simask(); 
 742                                 errors 
|= param_getdec(Cmd
, cmdp
+1, &clk
); 
 746                                 encoding 
= 2; //biphase 
 750                                 encoding 
= 1; //manchester 
 762                                 dataLen 
= param_getstr(Cmd
, cmdp
+1, hexData
); 
 766                                         dataLen 
= hextobinarray((char *)data
, hexData
); 
 768                                 if (dataLen 
== 0) errors 
= TRUE
;  
 769                                 if (errors
) PrintAndLog ("Error getting hex data, datalen: %d", dataLen
); 
 773                                 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
)); 
 781         if(cmdp 
== 0 && DemodBufferLen 
== 0) 
 785         if(errors
) return usage_lf_simask(); 
 787         if (dataLen 
== 0){ //using DemodBuffer 
 789                         clk 
= GetAskClock("0", false, false); 
 791                 setDemodBuf(data
, dataLen
, 0); 
 793         if (clk 
== 0) clk 
= 64; 
 794         if (encoding 
== 0) clk 
>>= 2; //askraw needs to double the clock speed 
 796         size_t size 
= DemodBufferLen
; 
 798         if (size 
> USB_CMD_DATA_SIZE
) { 
 799                 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
); 
 800                 size 
= USB_CMD_DATA_SIZE
; 
 803         PrintAndLog("preparing to sim ask data: %d bits", size
);         
 806         arg1 
= clk 
<< 8 | encoding
; 
 807         arg2 
= invert 
<< 8 | separator
; 
 809         UsbCommand c 
= {CMD_ASK_SIM_TAG
, {arg1
, arg2
, size
}}; 
 810         memcpy(c
.d
.asBytes
, DemodBuffer
, size
); 
 811         clearCommandBuffer(); 
 816 // by marshmellow - sim psk data given carrier, clock, invert  
 817 // - allow pull data from DemodBuffer or parameters 
 818 int CmdLFpskSim(const char *Cmd
) { 
 819         //might be able to autodetect FC and clock from Graphbuffer if using demod buffer 
 820         //will need carrier, Clock, and bitstream 
 821         uint8_t carrier
=0, clk
=0; 
 824         char hexData
[32] = {0x00}; // store entered hex data 
 825         uint8_t data
[255] = {0x00};  
 830         while(param_getchar(Cmd
, cmdp
) != 0x00) { 
 831                 switch(param_getchar(Cmd
, cmdp
)) { 
 833                                 return usage_lf_simpsk(); 
 839                                 errors 
|= param_getdec(Cmd
,cmdp
+1,&clk
); 
 843                                 errors 
|= param_getdec(Cmd
,cmdp
+1,&carrier
); 
 859                                 dataLen 
= param_getstr(Cmd
, cmdp
+1, hexData
); 
 863                                         dataLen 
= hextobinarray((char *)data
, hexData
); 
 865                                 if (dataLen 
== 0) errors 
= TRUE
;  
 866                                 if (errors
) PrintAndLog ("Error getting hex data"); 
 870                                 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
)); 
 877         if (cmdp 
== 0 && DemodBufferLen 
== 0) 
 881         if (errors
) return usage_lf_simpsk(); 
 883         if (dataLen 
== 0){ //using DemodBuffer 
 884                 PrintAndLog("Getting Clocks"); 
 886                 if (clk
==0) clk 
= GetPskClock("", FALSE
, FALSE
); 
 887                 PrintAndLog("clk: %d",clk
); 
 889                 if (!carrier
) carrier 
= GetPskCarrier("", FALSE
, FALSE
);  
 890                 PrintAndLog("carrier: %d", carrier
); 
 893                 setDemodBuf(data
, dataLen
, 0); 
 896         if (clk 
<= 0) clk 
= 32; 
 898         if (carrier 
== 0) carrier 
= 2; 
 902                         //need to convert psk2 to psk1 data before sim 
 903                         psk2TOpsk1(DemodBuffer
, DemodBufferLen
); 
 905                         PrintAndLog("Sorry, PSK3 not yet available"); 
 909         arg1 
= clk 
<< 8 | carrier
; 
 911         size_t size 
= DemodBufferLen
; 
 912         if (size 
> USB_CMD_DATA_SIZE
) { 
 913                 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
); 
 914                 size 
= USB_CMD_DATA_SIZE
; 
 916         UsbCommand c 
= {CMD_PSK_SIM_TAG
, {arg1
, arg2
, size
}}; 
 917         PrintAndLog("DEBUG: Sending DemodBuffer Length: %d", size
); 
 918         memcpy(c
.d
.asBytes
, DemodBuffer
, size
); 
 919         clearCommandBuffer(); 
 924 int CmdLFSimBidir(const char *Cmd
) { 
 925         // Set ADC to twice the carrier for a slight supersampling 
 926         // HACK: not implemented in ARMSRC. 
 927         PrintAndLog("Not implemented yet."); 
 928         UsbCommand c 
= {CMD_LF_SIMULATE_BIDIR
, {47, 384, 0}}; 
 933 int CmdVchDemod(const char *Cmd
) { 
 934         // Is this the entire sync pattern, or does this also include some 
 935         // data bits that happen to be the same everywhere? That would be 
 937         static const int SyncPattern
[] = { 
 938                 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, 
 939                 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 
 940                 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, 
 941                 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 
 942                 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, 
 943                 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 
 944                 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, 
 945                 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 
 946                 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, 
 947                 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 
 950         // So first, we correlate for the sync pattern, and mark that. 
 951         int bestCorrel 
= 0, bestPos 
= 0; 
 954         // It does us no good to find the sync pattern, with fewer than 2048 samples after it. 
 956         for (i 
= 0; i 
< (GraphTraceLen 
- 2048); i
++) { 
 957                 for (j 
= 0; j 
< ARRAYLEN(SyncPattern
); j
++) { 
 958                         sum 
+= GraphBuffer
[i
+j
] * SyncPattern
[j
]; 
 960                 if (sum 
> bestCorrel
) { 
 965         PrintAndLog("best sync at %d [metric %d]", bestPos
, bestCorrel
); 
 970         int worst 
= INT_MAX
, worstPos 
= 0; 
 972         for (i 
= 0; i 
< 2048; i 
+= 8) { 
 974                 for (j 
= 0; j 
< 8; j
++)  
 975                         sum 
+= GraphBuffer
[bestPos
+i
+j
]; 
 982                 if(abs(sum
) < worst
) { 
 987         PrintAndLog("bits:"); 
 988         PrintAndLog("%s", bits
); 
 989         PrintAndLog("worst metric: %d at pos %d", worst
, worstPos
); 
 992         if (strcmp(Cmd
, "clone")==0) { 
 995                         for(s 
= bits
; *s
; s
++) { 
 996                                 for(j 
= 0; j 
< 16; j
++) { 
 997                                         GraphBuffer
[GraphTraceLen
++] = (*s 
== '1') ? 1 : 0; 
1000                 RepaintGraphWindow(); 
1006 int CmdLFfind(const char *Cmd
) { 
1008         char cmdp 
= param_getchar(Cmd
, 0); 
1009         char testRaw 
= param_getchar(Cmd
, 1); 
1010         if (strlen(Cmd
) > 3 || cmdp 
== 'h' || cmdp 
== 'H') return usage_lf_find(); 
1012         if (!offline 
&& (cmdp 
!= '1')){ 
1014                 getSamples("30000", TRUE
); 
1015         } else if (GraphTraceLen 
< 1000) { 
1016                 PrintAndLog("Data in Graphbuffer was too small."); 
1019         if (cmdp 
== 'u' || cmdp 
== 'U') testRaw 
= 'u'; 
1021         // if ( justNoise(GraphBuffer, GraphTraceLen) ) { 
1022                 // PrintAndLog("Signal looks just like noise. Quitting."); 
1026         PrintAndLog("NOTE: some demods output possible binary\n  if it finds something that looks like a tag"); 
1027         PrintAndLog("False Positives ARE possible\n");   
1028         PrintAndLog("\nChecking for known tags:\n"); 
1030         ans
=CmdFSKdemodIO(""); 
1032                 PrintAndLog("\nValid IO Prox ID Found!"); 
1035         ans
=CmdFSKdemodPyramid(""); 
1037                 PrintAndLog("\nValid Pyramid ID Found!"); 
1040         ans
=CmdFSKdemodParadox(""); 
1042                 PrintAndLog("\nValid Paradox ID Found!"); 
1045         ans
=CmdFSKdemodAWID(""); 
1047                 PrintAndLog("\nValid AWID ID Found!"); 
1050         ans
=CmdFSKdemodHID(""); 
1052                 PrintAndLog("\nValid HID Prox ID Found!"); 
1055         ans
=CmdAskEM410xDemod(""); 
1057                 PrintAndLog("\nValid EM410x ID Found!"); 
1060         ans
=CmdG_Prox_II_Demod(""); 
1062                 PrintAndLog("\nValid Guardall G-Prox II ID Found!"); 
1065         ans
=CmdFDXBdemodBI(""); 
1067                 PrintAndLog("\nValid FDX-B ID Found!"); 
1070         ans
=EM4x50Read("", false); 
1072                 PrintAndLog("\nValid EM4x50 ID Found!"); 
1075         ans
=CmdVikingDemod(""); 
1077                 PrintAndLog("\nValid Viking ID Found!"); 
1080         ans
=CmdIndalaDecode(""); 
1082                 PrintAndLog("\nValid Indala ID Found!"); 
1085         ans
=CmdPSKNexWatch(""); 
1087                 PrintAndLog("\nValid NexWatch ID Found!"); 
1090         ans
=CmdPSKIdteck(""); 
1092                 PrintAndLog("\nValid Idteck ID Found!"); 
1095         ans
=CmdJablotronDemod(""); 
1097                 PrintAndLog("\nValid Jablotron ID Found!"); 
1100         ans
=CmdLFNedapDemod(""); 
1102                 PrintAndLog("\nValid NEDAP ID Found!"); 
1105         ans
=CmdVisa2kDemod(""); 
1107                 PrintAndLog("\nValid Visa2000 ID Found!"); 
1110         ans
=CmdNoralsyDemod(""); 
1112                 PrintAndLog("\nValid Noralsy ID Found!"); 
1115         ans
=CmdPrescoDemod(""); 
1117                 PrintAndLog("\nValid Presco ID Found!"); 
1122         if (!offline 
&& (cmdp 
!= '1')){ 
1123                 ans
=CmdLFHitagReader("26"); 
1129         PrintAndLog("\nNo Known Tags Found!\n"); 
1130         if (testRaw
=='u' || testRaw
=='U'){ 
1131                 //test unknown tag formats (raw mode) 
1132                 PrintAndLog("\nChecking for Unknown tags:\n"); 
1133                 ans
=AutoCorrelate(4000, FALSE
, FALSE
); 
1137                         PrintAndLog("Possible Auto Correlation of %d repeating samples",ans
); 
1139                         if ( ans 
% 8 == 0)  { 
1140                                 int bytes 
= (ans 
/ 8); 
1141                                 PrintAndLog("Possible %d bytes", bytes
); 
1143                                 if ( bytes 
% 2 == 0) { 
1144                                         blocks 
= (bytes 
/ 2);    
1145                                         PrintAndLog("Possible  2 blocks, width %d", blocks
); 
1147                                 if ( bytes 
% 4 == 0) { 
1148                                         blocks 
= (bytes 
/ 4);    
1149                                         PrintAndLog("Possible  4 blocks, width %d", blocks
); 
1151                                 if ( bytes 
% 8 == 0) { 
1152                                         blocks 
= (bytes 
/ 8);    
1153                                         PrintAndLog("Possible  8 blocks, width %d", blocks
); 
1155                                 if ( bytes 
% 16 == 0) { 
1156                                         blocks 
= (bytes 
/ 16);   
1157                                         PrintAndLog("Possible 16 blocks, width %d", blocks
); 
1162                 ans
=GetFskClock("",FALSE
,FALSE
);  
1163                 if (ans 
!= 0){ //fsk 
1164                         ans
=FSKrawDemod("",TRUE
); 
1166                                 PrintAndLog("\nUnknown FSK Modulated Tag Found!"); 
1171                 ans
=ASKDemod_ext("0 0 0",TRUE
,FALSE
,1,&st
); 
1173                   PrintAndLog("\nUnknown ASK Modulated and Manchester encoded Tag Found!"); 
1174                   PrintAndLog("\nif it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'"); 
1178                 ans
=CmdPSK1rawDemod(""); 
1180                         PrintAndLog("Possible unknown PSK1 Modulated Tag Found above!\n\nCould also be PSK2 - try 'data rawdemod p2'"); 
1181                         PrintAndLog("\nCould also be PSK3 - [currently not supported]"); 
1182                         PrintAndLog("\nCould also be NRZ - try 'data nrzrawdemod"); 
1185                 PrintAndLog("\nNo Data Found!\n"); 
1190 static command_t CommandTable
[] =  
1192         {"help",        CmdHelp
,            1, "This help"}, 
1193         {"animal",      CmdLFFdx
,           1, "{ Animal RFIDs... }"}, 
1194         {"awid",        CmdLFAWID
,          1, "{ AWID RFIDs... }"}, 
1195         {"cotag",       CmdLFCOTAG
,         1, "{ COTAG RFIDs... }"}, 
1196         {"em4x",        CmdLFEM4X
,          1, "{ EM4X RFIDs... }"}, 
1197         {"guard",       CmdLFGuard
,         1, "{ Guardall RFIDs... }"}, 
1198         {"hid",         CmdLFHID
,           1, "{ HID RFIDs... }"}, 
1199         {"hitag",       CmdLFHitag
,         1, "{ HITAG RFIDs... }"}, 
1200 //      {"indala",              CmdLFIndala,            1, "{ Indala RFIDs... }"}, 
1201         {"io",                  CmdLFIO
,                        1, "{ IOPROX RFIDs... }"}, 
1202         {"jablotron",   CmdLFJablotron
,         1, "{ Jablotron RFIDs... }"}, 
1203         {"nedap",               CmdLFNedap
,                     1, "{ Nedap RFIDs... }"}, 
1204         {"noralsy",             CmdLFNoralsy
,           1, "{ Noralsy RFIDs... }"},      
1205         {"pcf7931",     CmdLFPCF7931
,       1, "{ PCF7931 RFIDs... }"}, 
1206         {"presco",      CmdLFPresco
,        1, "{ Presco RFIDs... }"}, 
1207         {"pyramid",             CmdLFPyramid
,       1, "{ Farpointe/Pyramid RFIDs... }"},        
1208         {"ti",          CmdLFTI
,            1, "{ TI RFIDs... }"}, 
1209         {"t55xx",       CmdLFT55XX
,         1, "{ T55xx RFIDs... }"}, 
1210         {"viking",      CmdLFViking
,        1, "{ Viking RFIDs... }"}, 
1211         {"visa2000",    CmdLFVisa2k
,        1, "{ Visa2000 RFIDs... }"}, 
1212         {"config",      CmdLFSetConfig
,     0, "Set config for LF sampling, bit/sample, decimation, frequency"}, 
1213         {"cmdread",     CmdLFCommandRead
,   0, "<off period> <'0' period> <'1' period> <command> ['h' 134] \n\t\t-- Modulate LF reader field to send command before read (all periods in microseconds)"}, 
1214         {"flexdemod",   CmdFlexdemod
,       1, "Demodulate samples for FlexPass"}, 
1215         {"indalademod", CmdIndalaDemod
,     1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"}, 
1216         {"indalaclone", CmdIndalaClone
,     0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"}, 
1217         {"read",        CmdLFRead
,          0, "['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"}, 
1218         {"search",      CmdLFfind
,          1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) \n\t\t-- 'u' to search for unknown tags"}, 
1219         {"sim",         CmdLFSim
,           0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"}, 
1220         {"simask",      CmdLFaskSim
,        0, "[clock] [invert <1|0>] [biphase/manchester/raw <'b'|'m'|'r'>] [msg separator 's'] [d <hexdata>] \n\t\t-- Simulate LF ASK tag from demodbuffer or input"}, 
1221         {"simfsk",      CmdLFfskSim
,        0, "[c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>] \n\t\t-- Simulate LF FSK tag from demodbuffer or input"}, 
1222         {"simpsk",      CmdLFpskSim
,        0, "[1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>] \n\t\t-- Simulate LF PSK tag from demodbuffer or input"}, 
1223         {"simbidir",    CmdLFSimBidir
,      0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"}, 
1224         {"snoop",       CmdLFSnoop
,         0, "Snoop LF"}, 
1225         {"vchdemod",    CmdVchDemod
,        1, "['clone'] -- Demodulate samples for VeriChip"}, 
1226         {NULL
, NULL
, 0, NULL
} 
1229 int CmdLF(const char *Cmd
) { 
1230         clearCommandBuffer(); 
1231         CmdsParse(CommandTable
, Cmd
); 
1235 int CmdHelp(const char *Cmd
) { 
1236         CmdsHelp(CommandTable
);