1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
15 #include "proxmark3.h"
19 #include "cmdparser.h"
23 #include "cmdlfawid26.h"
26 #include "cmdlfem4x.h"
27 #include "cmdlfhitag.h"
28 #include "cmdlft55xx.h"
29 #include "cmdlfpcf7931.h"
32 static int CmdHelp(const char *Cmd
);
34 /* send a command before reading */
35 int CmdLFCommandRead(const char *Cmd
)
41 UsbCommand c
= {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
};
42 sscanf(Cmd
, "%"lli
" %"lli
" %"lli
" %s %s", &c
.arg
[0], &c
.arg
[1], &c
.arg
[2],(char*)(&c
.d
.asBytes
),(char*)(&dummy
+1));
43 // in case they specified 'h'
44 strcpy((char *)&c
.d
.asBytes
+ strlen((char *)c
.d
.asBytes
), dummy
);
49 int CmdFlexdemod(const char *Cmd
)
52 for (i
= 0; i
< GraphTraceLen
; ++i
) {
53 if (GraphBuffer
[i
] < 0) {
62 for (start
= 0; start
< GraphTraceLen
- LONG_WAIT
; start
++) {
63 int first
= GraphBuffer
[start
];
64 for (i
= start
; i
< start
+ LONG_WAIT
; i
++) {
65 if (GraphBuffer
[i
] != first
) {
69 if (i
== (start
+ LONG_WAIT
)) {
73 if (start
== GraphTraceLen
- LONG_WAIT
) {
74 //PrintAndLog("nothing to wait for");
78 GraphBuffer
[start
] = 2;
79 GraphBuffer
[start
+1] = -2;
80 uint8_t bits
[64] = {0x00};
84 for (bit
= 0; bit
< 64; bit
++) {
86 for (int j
= 0; j
< 16; j
++) {
87 sum
+= GraphBuffer
[i
++];
90 bits
[bit
] = (sum
> 0) ? 1 : 0;
92 PrintAndLog("bit %d sum %d", bit
, sum
);
95 for (bit
= 0; bit
< 64; bit
++) {
98 for (j
= 0; j
< 16; j
++) {
99 sum
+= GraphBuffer
[i
++];
101 if (sum
> 0 && bits
[bit
] != 1) {
102 PrintAndLog("oops1 at %d", bit
);
104 if (sum
< 0 && bits
[bit
] != 0) {
105 PrintAndLog("oops2 at %d", bit
);
109 // HACK writing back to graphbuffer.
110 GraphTraceLen
= 32*64;
113 for (bit
= 0; bit
< 64; bit
++) {
115 phase
= (bits
[bit
] == 0) ? 0 : 1;
118 for (j
= 0; j
< 32; j
++) {
119 GraphBuffer
[i
++] = phase
;
124 RepaintGraphWindow();
128 int CmdIndalaDemod(const char *Cmd
)
130 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
136 // worst case with GraphTraceLen=64000 is < 4096
137 // under normal conditions it's < 2048
139 uint8_t rawbits
[4096];
141 int worst
= 0, worstPos
= 0;
143 PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen
/ 32);
145 for (i
= 0; i
< GraphTraceLen
-1; i
+= 2) {
147 if ((GraphBuffer
[i
] > GraphBuffer
[i
+ 1]) && (state
!= 1)) {
149 for (j
= 0; j
< count
- 8; j
+= 16) {
150 rawbits
[rawbit
++] = 0;
152 if ((abs(count
- j
)) > worst
) {
153 worst
= abs(count
- j
);
159 } else if ((GraphBuffer
[i
] < GraphBuffer
[i
+ 1]) && (state
!= 0)) {
161 for (j
= 0; j
< count
- 8; j
+= 16) {
162 rawbits
[rawbit
++] = 1;
164 if ((abs(count
- j
)) > worst
) {
165 worst
= abs(count
- j
);
175 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit
, GraphTraceLen
/32);
176 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst
, worstPos
);
181 // Finding the start of a UID
182 int uidlen
, long_wait
;
183 if (strcmp(Cmd
, "224") == 0) {
193 for (start
= 0; start
<= rawbit
- uidlen
; start
++) {
194 first
= rawbits
[start
];
195 for (i
= start
; i
< start
+ long_wait
; i
++) {
196 if (rawbits
[i
] != first
) {
200 if (i
== (start
+ long_wait
)) {
205 if (start
== rawbit
- uidlen
+ 1) {
206 //PrintAndLog("nothing to wait for");
210 // Inverting signal if needed
212 for (i
= start
; i
< rawbit
; i
++) {
213 rawbits
[i
] = !rawbits
[i
];
218 uint8_t bits
[224] = {0x00};
219 char showbits
[225] = {0x00};
224 if (uidlen
> rawbit
) {
225 PrintAndLog("Warning: not enough raw bits to get a full UID");
226 for (bit
= 0; bit
< rawbit
; bit
++) {
227 bits
[bit
] = rawbits
[i
++];
228 // As we cannot know the parity, let's use "." and "/"
229 showbits
[bit
] = '.' + bits
[bit
];
231 showbits
[bit
+1]='\0';
232 PrintAndLog("Partial UID=%s", showbits
);
235 for (bit
= 0; bit
< uidlen
; bit
++) {
236 bits
[bit
] = rawbits
[i
++];
237 showbits
[bit
] = '0' + bits
[bit
];
243 uint32_t uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
248 for( idx
=0; idx
<64; idx
++) {
249 if (showbits
[idx
] == '0') {
250 uid1
= (uid1
<<1) | (uid2
>>31);
251 uid2
= (uid2
<<1) | 0;
253 uid1
= (uid1
<<1) | (uid2
>>31);
254 uid2
= (uid2
<<1) | 1;
257 PrintAndLog("UID=%s (%x%08x)", showbits
, uid1
, uid2
);
260 uid3
= uid4
= uid5
= uid6
= uid7
= 0;
262 for( idx
=0; idx
<224; idx
++) {
263 uid1
= (uid1
<<1) | (uid2
>>31);
264 uid2
= (uid2
<<1) | (uid3
>>31);
265 uid3
= (uid3
<<1) | (uid4
>>31);
266 uid4
= (uid4
<<1) | (uid5
>>31);
267 uid5
= (uid5
<<1) | (uid6
>>31);
268 uid6
= (uid6
<<1) | (uid7
>>31);
270 if (showbits
[idx
] == '0')
271 uid7
= (uid7
<<1) | 0;
273 uid7
= (uid7
<<1) | 1;
275 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits
, uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
278 // Checking UID against next occurrences
280 for (; i
+ uidlen
<= rawbit
;) {
282 for (bit
= 0; bit
< uidlen
; bit
++) {
283 if (bits
[bit
] != rawbits
[i
++]) {
294 PrintAndLog("Occurrences: %d (expected %d)", times
, (rawbit
- start
) / uidlen
);
296 // Remodulating for tag cloning
297 // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
298 // since this changes graphbuffer data.
299 GraphTraceLen
= 32 * uidlen
;
302 for (bit
= 0; bit
< uidlen
; bit
++) {
303 if (bits
[bit
] == 0) {
309 for (j
= 0; j
< 32; j
++) {
310 GraphBuffer
[i
++] = phase
;
315 RepaintGraphWindow();
319 int CmdIndalaClone(const char *Cmd
)
322 unsigned int uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
324 uid1
= uid2
= uid3
= uid4
= uid5
= uid6
= uid7
= 0;
327 if (strchr(Cmd
,'l') != 0) {
328 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
329 uid1
= (uid1
<< 4) | (uid2
>> 28);
330 uid2
= (uid2
<< 4) | (uid3
>> 28);
331 uid3
= (uid3
<< 4) | (uid4
>> 28);
332 uid4
= (uid4
<< 4) | (uid5
>> 28);
333 uid5
= (uid5
<< 4) | (uid6
>> 28);
334 uid6
= (uid6
<< 4) | (uid7
>> 28);
335 uid7
= (uid7
<< 4) | (n
& 0xf);
337 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
338 c
.cmd
= CMD_INDALA_CLONE_TAG_L
;
339 c
.d
.asDwords
[0] = uid1
;
340 c
.d
.asDwords
[1] = uid2
;
341 c
.d
.asDwords
[2] = uid3
;
342 c
.d
.asDwords
[3] = uid4
;
343 c
.d
.asDwords
[4] = uid5
;
344 c
.d
.asDwords
[5] = uid6
;
345 c
.d
.asDwords
[6] = uid7
;
347 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
348 uid1
= (uid1
<< 4) | (uid2
>> 28);
349 uid2
= (uid2
<< 4) | (n
& 0xf);
351 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1
, uid2
);
352 c
.cmd
= CMD_INDALA_CLONE_TAG
;
361 int CmdLFRead(const char *Cmd
)
363 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
};
365 // 'h' means higher-low-frequency, 134 kHz
368 } else if (*Cmd
== '\0') {
370 } else if (sscanf(Cmd
, "%"lli
, &c
.arg
[0]) != 1) {
371 PrintAndLog("Samples 1: 'lf read'");
372 PrintAndLog(" 2: 'lf read h'");
373 PrintAndLog(" 3: 'lf read <divisor>'");
377 WaitForResponse(CMD_ACK
,NULL
);
384 static void ChkBitstream(const char *str
)
388 /* convert to bitstream if necessary */
389 for (i
= 0; i
< (int)(GraphTraceLen
/ 2); i
++){
390 if (GraphBuffer
[i
] > 1 || GraphBuffer
[i
] < 0) {
397 int CmdLFSim(const char *Cmd
)
402 sscanf(Cmd
, "%i", &gap
);
404 /* convert to bitstream if necessary */
407 printf("Sending [%d bytes]", GraphTraceLen
);
408 for (i
= 0; i
< GraphTraceLen
; i
+= USB_CMD_DATA_SIZE
) {
409 UsbCommand c
={CMD_DOWNLOADED_SIM_SAMPLES_125K
, {i
, 0, 0}};
411 for (j
= 0; j
< USB_CMD_DATA_SIZE
; j
++) {
412 c
.d
.asBytes
[j
] = GraphBuffer
[i
+j
];
415 WaitForResponse(CMD_ACK
,NULL
);
420 PrintAndLog("Starting to simulate");
421 UsbCommand c
= {CMD_SIMULATE_TAG_125K
, {GraphTraceLen
, gap
, 0}};
426 int CmdLFSimBidir(const char *Cmd
)
428 // Set ADC to twice the carrier for a slight supersampling
429 // HACK: not implemented in ARMSRC.
430 PrintAndLog("Not implemented yet.");
431 UsbCommand c
= {CMD_LF_SIMULATE_BIDIR
, {47, 384, 0}};
436 /* simulate an LF Manchester encoded tag with specified bitstream, clock rate and inter-id gap */
437 int CmdLFSimManchester(const char *Cmd
)
439 static int clock
, gap
;
440 static char data
[1024], gapstring
[8];
442 sscanf(Cmd
, "%i %s %i", &clock
, &data
[0], &gap
);
446 for (int i
= 0; i
< strlen(data
) ; ++i
)
447 AppendGraph(0, clock
, data
[i
]- '0');
449 CmdManchesterMod("");
451 RepaintGraphWindow();
453 sprintf(&gapstring
[0], "%i", gap
);
458 int CmdLFSnoop(const char *Cmd
)
460 UsbCommand c
= {CMD_LF_SNOOP_RAW_ADC_SAMPLES
};
462 // 'h' means higher-low-frequency, 134 kHz
467 sscanf(Cmd
, "l %"lli
, &c
.arg
[1]);
468 } else if (*Cmd
== 'h') {
470 sscanf(Cmd
, "h %"lli
, &c
.arg
[1]);
471 } else if (sscanf(Cmd
, "%"lli
" %"lli
, &c
.arg
[0], &c
.arg
[1]) < 1) {
472 PrintAndLog("usage 1: snoop");
473 PrintAndLog(" 2: snoop {l,h} [trigger threshold]");
474 PrintAndLog(" 3: snoop <divisor> [trigger threshold]");
479 WaitForResponse(CMD_ACK
,NULL
);
481 #define BUFF_SIZE 8000
482 uint8_t data
[BUFF_SIZE
] = {0x00};
484 GetFromBigBuf(data
,BUFF_SIZE
,0);
485 WaitForResponseTimeout(CMD_ACK
,NULL
, 1500);
487 SetGraphBuf(data
, BUFF_SIZE
);
492 int CmdVchDemod(const char *Cmd
)
494 // Is this the entire sync pattern, or does this also include some
495 // data bits that happen to be the same everywhere? That would be
497 static const int SyncPattern
[] = {
498 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
499 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
500 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
501 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
502 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
503 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
504 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
505 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
506 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
507 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
510 // So first, we correlate for the sync pattern, and mark that.
511 int bestCorrel
= 0, bestPos
= 0;
513 // It does us no good to find the sync pattern, with fewer than
514 // 2048 samples after it...
515 for (i
= 0; i
< (GraphTraceLen
-2048); i
++) {
518 for (j
= 0; j
< arraylen(SyncPattern
); j
++) {
519 sum
+= GraphBuffer
[i
+j
]*SyncPattern
[j
];
521 if (sum
> bestCorrel
) {
526 PrintAndLog("best sync at %d [metric %d]", bestPos
, bestCorrel
);
534 for (i
= 0; i
< 2048; i
+= 8) {
537 for (j
= 0; j
< 8; j
++) {
538 sum
+= GraphBuffer
[bestPos
+i
+j
];
545 if(abs(sum
) < worst
) {
550 PrintAndLog("bits:");
551 PrintAndLog("%s", bits
);
552 PrintAndLog("worst metric: %d at pos %d", worst
, worstPos
);
554 if (strcmp(Cmd
, "clone")==0) {
557 for(s
= bits
; *s
; s
++) {
559 for(j
= 0; j
< 16; j
++) {
560 GraphBuffer
[GraphTraceLen
++] = (*s
== '1') ? 1 : 0;
563 RepaintGraphWindow();
569 int CmdLFfind(const char *Cmd
)
572 char cmdp
= param_getchar(Cmd
, 0);
574 if (strlen(Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H') {
575 PrintAndLog("Usage: lf search <0|1>");
576 PrintAndLog(" <use data from Graphbuffer>, if not set, try reading data from tag.");
578 PrintAndLog(" sample: lf search");
579 PrintAndLog(" : lf search 1");
583 if (!offline
|| (cmdp
!= '1') ){
585 } else if (GraphTraceLen
< 1000) {
586 PrintAndLog("Data in Graphbuffer was too small.");
590 PrintAndLog("Checking for known tags:");
592 ans
= Cmdaskmandemod("");
593 PrintAndLog("ASK_MAN: %s", (ans
) ? "YES":"NO" );
595 ans
= CmdFSKdemodHID("");
596 PrintAndLog("HID: %s", (ans
) ? "YES":"NO" );
598 ans
= CmdFSKdemodIO("");
599 PrintAndLog("IO prox: %s", (ans
) ? "YES":"NO" );
601 ans
= CmdIndalaDemod("");
602 PrintAndLog("Indala (64): %s", (ans
) ? "YES":"NO" );
604 ans
= CmdIndalaDemod("224");
605 PrintAndLog("Indala (224): %s", (ans
) ? "YES":"NO" );
607 // ans = CmdVchDemod("");
608 // PrintAndLog("VeriChip: %s", (ans) ? "YES":"NO" );
610 // ans = CmdFlexdemod("");
611 // PrintAndLog("FlexPass: %s", (ans) ? "YES":"NO" );
614 PrintAndLog("No Known Tags Found!\n");
619 static command_t CommandTable
[] =
621 {"help", CmdHelp
, 1, "This help"},
622 {"cmdread", CmdLFCommandRead
, 0, "<off period> <'0' period> <'1' period> <command> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)"},
624 {"flexdemod", CmdFlexdemod
, 1, "Demodulate samples for FlexPass"},
625 {"indalademod", CmdIndalaDemod
, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
626 {"indalaclone", CmdIndalaClone
, 0, "<UID> ['l']-- Clone Indala to T55x7 (UID in HEX)(option 'l' for 224 UID"},
627 {"vchdemod", CmdVchDemod
, 1, "['clone'] -- Demodulate samples for VeriChip"},
630 {"read", CmdLFRead
, 0, "['h' or <divisor>] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134, alternatively: f=12MHz/(divisor+1))"},
631 {"search", CmdLFfind
, 1, "Read and Search for valid known tag (in offline mode it you can load first then search)"},
632 {"sim", CmdLFSim
, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
633 {"simbidir", CmdLFSimBidir
, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
634 {"simman", CmdLFSimManchester
, 0, "<Clock> <Bitstream> [GAP] Simulate arbitrary Manchester LF tag"},
635 {"snoop", CmdLFSnoop
, 0, "['l'|'h'|<divisor>] [trigger threshold]-- Snoop LF (l:125khz, h:134khz)"},
637 {"awid26", CmdLFAWID26
, 1, "{ AWID26 tags }"},
638 {"em4x", CmdLFEM4X
, 1, "{ EM4X tags }"},
639 {"hid", CmdLFHID
, 1, "{ HID tags }"},
640 {"hitag", CmdLFHitag
, 1, "{ Hitag tags and transponders }"},
641 {"io", CmdLFIO
, 1, "{ ioProx tags }"},
642 {"pcf7931", CmdLFPCF7931
, 1, "{ PCF7931 tags }"},
643 {"ti", CmdLFTI
, 1, "{ TI tags }"},
644 {"t55xx", CmdLFT55XX
, 1, "{ T55xx tags }"},
646 {NULL
, NULL
, 0, NULL
}
649 int CmdLF(const char *Cmd
)
651 CmdsParse(CommandTable
, Cmd
);
655 int CmdHelp(const char *Cmd
)
657 CmdsHelp(CommandTable
);