]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
First check in.
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <inttypes.h>
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "graph.h"
17 #include "cmdmain.h"
18 #include "cmdparser.h"
19 #include "cmddata.h"
20 #include "cmdlf.h"
21 #include "cmdlfem4x.h"
22 #include "util.h"
23 #include "data.h"
24
25 char *global_em410xId;
26
27 static int CmdHelp(const char *Cmd);
28
29 /* Read the ID of an EM410x tag.
30 * Format:
31 * 1111 1111 1 <-- standard non-repeatable header
32 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
33 * ....
34 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
35 * 0 <-- stop bit, end of tag
36 */
37 int CmdEM410xRead(const char *Cmd)
38 {
39 int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
40 int parity[4];
41 char id[11];
42 char id2[11];
43 int retested = 0;
44 uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
45 high = low = 0;
46
47 /* Detect high and lows and clock */
48 for (i = 0; i < GraphTraceLen; i++)
49 {
50 if (GraphBuffer[i] > high)
51 high = GraphBuffer[i];
52 else if (GraphBuffer[i] < low)
53 low = GraphBuffer[i];
54 }
55
56 /* get clock */
57 clock = GetClock(Cmd, high, 0);
58
59 /* parity for our 4 columns */
60 parity[0] = parity[1] = parity[2] = parity[3] = 0;
61 header = rows = 0;
62
63 /* manchester demodulate */
64 bit = bit2idx = 0;
65 for (i = 0; i < (int)(GraphTraceLen / clock); i++)
66 {
67 hithigh = 0;
68 hitlow = 0;
69 first = 1;
70
71 /* Find out if we hit both high and low peaks */
72 for (j = 0; j < clock; j++)
73 {
74 if (GraphBuffer[(i * clock) + j] == high)
75 hithigh = 1;
76 else if (GraphBuffer[(i * clock) + j] == low)
77 hitlow = 1;
78
79 /* it doesn't count if it's the first part of our read
80 because it's really just trailing from the last sequence */
81 if (first && (hithigh || hitlow))
82 hithigh = hitlow = 0;
83 else
84 first = 0;
85
86 if (hithigh && hitlow)
87 break;
88 }
89
90 /* If we didn't hit both high and low peaks, we had a bit transition */
91 if (!hithigh || !hitlow)
92 bit ^= 1;
93
94 BitStream[bit2idx++] = bit;
95 }
96
97 retest:
98 /* We go till 5 before the graph ends because we'll get that far below */
99 for (i = 1; i < bit2idx - 5; i++)
100 {
101 /* Step 2: We have our header but need our tag ID */
102 if (header == 9 && rows < 10)
103 {
104 /* Confirm parity is correct */
105 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
106 {
107 /* Read another byte! */
108 sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
109 sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i]));
110 rows++;
111
112 /* Keep parity info */
113 parity[0] ^= BitStream[i];
114 parity[1] ^= BitStream[i+1];
115 parity[2] ^= BitStream[i+2];
116 parity[3] ^= BitStream[i+3];
117
118 /* Move 4 bits ahead */
119 i += 4;
120 }
121
122 /* Damn, something wrong! reset */
123 else
124 {
125 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
126
127 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
128 i -= 9 + (5 * rows) - 5;
129
130 rows = header = 0;
131 }
132 }
133
134 /* Step 3: Got our 40 bits! confirm column parity */
135 else if (rows == 10)
136 {
137 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
138 if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
139 BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
140 BitStream[i+4] == 0)
141 {
142 /* Sweet! */
143 PrintAndLog("EM410x Tag ID: %s", id);
144 PrintAndLog("Unique Tag ID: %s", id2);
145
146 global_em410xId = id;
147
148 /* Stop any loops */
149 return 1;
150 }
151
152 /* Crap! Incorrect parity or no stop bit, start all over */
153 else
154 {
155 rows = header = 0;
156
157 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
158 i -= 59;
159 }
160 }
161
162 /* Step 1: get our header */
163 else if (header < 9)
164 {
165 /* Need 9 consecutive 1's */
166 if (BitStream[i] == 1)
167 header++;
168
169 /* We don't have a header, not enough consecutive 1 bits */
170 else
171 header = 0;
172 }
173 }
174
175 /* if we've already retested after flipping bits, return */
176 if (retested++){
177 return 0;
178 }
179
180 /* if this didn't work, try flipping bits */
181 for (i = 0; i < bit2idx; i++)
182 BitStream[i] ^= 1;
183
184 goto retest;
185 }
186
187 /* emulate an EM410X tag
188 * Format:
189 * 1111 1111 1 <-- standard non-repeatable header
190 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
191 * ....
192 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
193 * 0 <-- stop bit, end of tag
194 */
195 int CmdEM410xSim(const char *Cmd)
196 {
197 int i, n, j, h, binary[4], parity[4];
198
199 /* clock is 64 in EM410x tags */
200 int clock = 64;
201
202 /* clear our graph */
203 ClearGraph(0);
204
205 /* write it out a few times */
206 for (h = 0; h < 4; h++)
207 {
208 /* write 9 start bits */
209 for (i = 0; i < 9; i++)
210 AppendGraph(0, clock, 1);
211
212 /* for each hex char */
213 parity[0] = parity[1] = parity[2] = parity[3] = 0;
214 for (i = 0; i < 10; i++)
215 {
216 /* read each hex char */
217 sscanf(&Cmd[i], "%1x", &n);
218 for (j = 3; j >= 0; j--, n/= 2)
219 binary[j] = n % 2;
220
221 /* append each bit */
222 AppendGraph(0, clock, binary[0]);
223 AppendGraph(0, clock, binary[1]);
224 AppendGraph(0, clock, binary[2]);
225 AppendGraph(0, clock, binary[3]);
226
227 /* append parity bit */
228 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
229
230 /* keep track of column parity */
231 parity[0] ^= binary[0];
232 parity[1] ^= binary[1];
233 parity[2] ^= binary[2];
234 parity[3] ^= binary[3];
235 }
236
237 /* parity columns */
238 AppendGraph(0, clock, parity[0]);
239 AppendGraph(0, clock, parity[1]);
240 AppendGraph(0, clock, parity[2]);
241 AppendGraph(0, clock, parity[3]);
242
243 /* stop bit */
244 AppendGraph(0, clock, 0);
245 }
246
247 /* modulate that biatch */
248 CmdManchesterMod("");
249
250 /* booyah! */
251 RepaintGraphWindow();
252
253 CmdLFSim("");
254 return 0;
255 }
256
257 /* Function is equivalent of loread + losamples + em410xread
258 * looped until an EM410x tag is detected */
259 int CmdEM410xWatch(const char *Cmd)
260 {
261 int read_h = (*Cmd == 'h');
262 //char k;
263 do
264 {
265 CmdLFRead(read_h ? "h" : "");
266 // 2000 samples is OK for clock=64, but not clock=32. Probably want
267 // 8000 for clock=16. Don't want to go too high since old HID driver
268 // is very slow
269 // TBD: Auto-grow sample size based on detected sample rate. IE: If the
270 // rate gets lower, then grow the number of samples
271
272 // Changed by martin, 4000 x 4 = 16000,
273 // see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
274 CmdSamples("16000");
275 } while (
276 !CmdEM410xRead("")
277 );
278 return 0;
279 }
280
281 int CmdEM410xWatchnSpoof(const char *Cmd)
282 {
283 int read_h = (*Cmd == 'h');
284 do
285 {
286 CmdLFRead(read_h ? "h" : "");
287 CmdSamples("16000");
288 } while ( ! CmdEM410xRead(""));
289 PrintAndLog("# Replaying : %s",global_em410xId);
290 CmdEM410xSim(global_em410xId);
291 return 0;
292 }
293
294 /* Read the transmitted data of an EM4x50 tag
295 * Format:
296 *
297 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
298 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
299 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
300 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
301 * CCCCCCCC <- column parity bits
302 * 0 <- stop bit
303 * LW <- Listen Window
304 *
305 * This pattern repeats for every block of data being transmitted.
306 * Transmission starts with two Listen Windows (LW - a modulated
307 * pattern of 320 cycles each (32/32/128/64/64)).
308 *
309 * Note that this data may or may not be the UID. It is whatever data
310 * is stored in the blocks defined in the control word First and Last
311 * Word Read values. UID is stored in block 32.
312 */
313 int CmdEM4x50Read(const char *Cmd)
314 {
315 int i, j, startblock, skip, block, start, end, low, high;
316 bool complete= false;
317 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
318 char tmp[6];
319
320 high= low= 0;
321 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
322
323 /* first get high and low values */
324 for (i = 0; i < GraphTraceLen; i++)
325 {
326 if (GraphBuffer[i] > high)
327 high = GraphBuffer[i];
328 else if (GraphBuffer[i] < low)
329 low = GraphBuffer[i];
330 }
331
332 /* populate a buffer with pulse lengths */
333 i= 0;
334 j= 0;
335 while (i < GraphTraceLen)
336 {
337 // measure from low to low
338 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
339 ++i;
340 start= i;
341 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
342 ++i;
343 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
344 ++i;
345 if (j>(MAX_GRAPH_TRACE_LEN/64)) {
346 break;
347 }
348 tmpbuff[j++]= i - start;
349 }
350
351 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
352 start= -1;
353 skip= 0;
354 for (i= 0; i < j - 4 ; ++i)
355 {
356 skip += tmpbuff[i];
357 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
358 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
359 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
360 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
361 {
362 start= i + 3;
363 break;
364 }
365 }
366 startblock= i + 3;
367
368 /* skip over the remainder of the LW */
369 skip += tmpbuff[i+1]+tmpbuff[i+2];
370 while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
371 ++skip;
372 skip += 8;
373
374 /* now do it again to find the end */
375 end= start;
376 for (i += 3; i < j - 4 ; ++i)
377 {
378 end += tmpbuff[i];
379 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
380 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
381 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
382 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
383 {
384 complete= true;
385 break;
386 }
387 }
388
389 if (start >= 0)
390 PrintAndLog("Found data at sample: %i",skip);
391 else
392 {
393 PrintAndLog("No data found!");
394 PrintAndLog("Try again with more samples.");
395 return 0;
396 }
397
398 if (!complete)
399 {
400 PrintAndLog("*** Warning!");
401 PrintAndLog("Partial data - no end found!");
402 PrintAndLog("Try again with more samples.");
403 }
404
405 /* get rid of leading crap */
406 sprintf(tmp,"%i",skip);
407 CmdLtrim(tmp);
408
409 /* now work through remaining buffer printing out data blocks */
410 block= 0;
411 i= startblock;
412 while (block < 6)
413 {
414 PrintAndLog("Block %i:", block);
415 // mandemod routine needs to be split so we can call it for data
416 // just print for now for debugging
417 CmdManchesterDemod("i 64");
418 skip= 0;
419 /* look for LW before start of next block */
420 for ( ; i < j - 4 ; ++i)
421 {
422 skip += tmpbuff[i];
423 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
424 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
425 break;
426 }
427 while (GraphBuffer[skip] > low)
428 ++skip;
429 skip += 8;
430 sprintf(tmp,"%i",skip);
431 CmdLtrim(tmp);
432 start += skip;
433 block++;
434 }
435 return 0;
436 }
437
438 int CmdEM410xWrite(const char *Cmd)
439 {
440 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
441 int card = 0xFF; // invalid card value
442 unsigned int clock = 0; // invalid clock value
443
444 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
445
446 // Check ID
447 if (id == 0xFFFFFFFFFFFFFFFF) {
448 PrintAndLog("Error! ID is required.\n");
449 return 0;
450 }
451 if (id >= 0x10000000000) {
452 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
453 return 0;
454 }
455
456 // Check Card
457 if (card == 0xFF) {
458 PrintAndLog("Error! Card type required.\n");
459 return 0;
460 }
461 if (card < 0) {
462 PrintAndLog("Error! Bad card type selected.\n");
463 return 0;
464 }
465
466 // Check Clock
467 if (card == 1)
468 {
469 // Default: 64
470 if (clock == 0)
471 clock = 64;
472
473 // Allowed clock rates: 16, 32 and 64
474 if ((clock != 16) && (clock != 32) && (clock != 64)) {
475 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
476 return 0;
477 }
478 }
479 else if (clock != 0)
480 {
481 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
482 return 0;
483 }
484
485 if (card == 1) {
486 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
487 // NOTE: We really should pass the clock in as a separate argument, but to
488 // provide for backwards-compatibility for older firmware, and to avoid
489 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
490 // the clock rate in bits 8-15 of the card value
491 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
492 }
493 else if (card == 0)
494 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
495 else {
496 PrintAndLog("Error! Bad card type selected.\n");
497 return 0;
498 }
499
500 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
501 SendCommand(&c);
502
503 return 0;
504 }
505
506 int CmdReadWord(const char *Cmd)
507 {
508 int Word = -1; //default to invalid word
509 UsbCommand c;
510
511 sscanf(Cmd, "%d", &Word);
512
513 if ( (Word > 15) | (Word < 0) ) {
514 PrintAndLog("Word must be between 0 and 15");
515 return 1;
516 }
517
518 PrintAndLog("Reading word %d", Word);
519
520 c.cmd = CMD_EM4X_READ_WORD;
521 c.d.asBytes[0] = 0x0; //Normal mode
522 c.arg[0] = 0;
523 c.arg[1] = Word;
524 c.arg[2] = 0;
525 SendCommand(&c);
526 WaitForResponse(CMD_ACK, NULL);
527
528 size_t bytelength = 4096;
529 uint8_t data[bytelength];
530 memset(data, 0x00, bytelength);
531
532 GetFromBigBuf(data,bytelength,3560); //3560 -- should be offset..
533 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
534
535 for (int j = 0; j < bytelength; j++) {
536 GraphBuffer[j] = ((int)data[j]) - 128;
537 }
538 GraphTraceLen = bytelength;
539 RepaintGraphWindow();
540
541 manchester_decode(data, bytelength);
542
543 free(data);
544
545 return 0;
546 }
547
548 int CmdReadWordPWD(const char *Cmd)
549 {
550 int Word = -1; //default to invalid word
551 int Password = 0xFFFFFFFF; //default to blank password
552 UsbCommand c;
553
554 sscanf(Cmd, "%d %x", &Word, &Password);
555
556 if ( (Word > 15) | (Word < 0) ) {
557 PrintAndLog("Word must be between 0 and 15");
558 return 1;
559 }
560
561 PrintAndLog("Reading word %d with password %08X", Word, Password);
562
563 c.cmd = CMD_EM4X_READ_WORD;
564 c.d.asBytes[0] = 0x1; //Password mode
565 c.arg[0] = 0;
566 c.arg[1] = Word;
567 c.arg[2] = Password;
568 SendCommand(&c);
569 WaitForResponse(CMD_ACK, NULL);
570
571 size_t bytelength = 4096;
572 uint8_t data[bytelength];
573 memset(data, 0x00, bytelength);
574
575 GetFromBigBuf(data,bytelength,3560); //3560 -- should be offset..
576 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
577
578 for (int j = 0; j < bytelength; j++) {
579 GraphBuffer[j] = ((int)data[j]) - 128;
580 }
581 GraphTraceLen = bytelength;
582 RepaintGraphWindow();
583
584 manchester_decode(data, bytelength);
585
586 free(data);
587 return 0;
588 }
589
590 int CmdWriteWord(const char *Cmd)
591 {
592 int Word = 16; //default to invalid block
593 int Data = 0xFFFFFFFF; //default to blank data
594 UsbCommand c;
595
596 sscanf(Cmd, "%x %d", &Data, &Word);
597
598 if (Word > 15) {
599 PrintAndLog("Word must be between 0 and 15");
600 return 1;
601 }
602
603 PrintAndLog("Writting word %d with data %08X", Word, Data);
604
605 c.cmd = CMD_EM4X_WRITE_WORD;
606 c.d.asBytes[0] = 0x0; //Normal mode
607 c.arg[0] = Data;
608 c.arg[1] = Word;
609 c.arg[2] = 0;
610 SendCommand(&c);
611 return 0;
612 }
613
614 int CmdWriteWordPWD(const char *Cmd)
615 {
616 int Word = 8; //default to invalid word
617 int Data = 0xFFFFFFFF; //default to blank data
618 int Password = 0xFFFFFFFF; //default to blank password
619 UsbCommand c;
620
621 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
622
623 if (Word > 15) {
624 PrintAndLog("Word must be between 0 and 15");
625 return 1;
626 }
627
628 PrintAndLog("Writting word %d with data %08X and password %08X", Word, Data, Password);
629
630 c.cmd = CMD_EM4X_WRITE_WORD;
631 c.d.asBytes[0] = 0x1; //Password mode
632 c.arg[0] = Data;
633 c.arg[1] = Word;
634 c.arg[2] = Password;
635 SendCommand(&c);
636 return 0;
637 }
638
639
640
641 static command_t CommandTable[] =
642 {
643 {"help", CmdHelp, 1, "This help"},
644 {"410read", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
645 {"410sim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
646 {"410watch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
647 {"410spoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
648 {"410write", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
649 {"4xread", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
650 {"rd", CmdReadWord, 1, "<Word 1-15> -- Read EM4xxx word data"},
651 {"rdpwd", CmdReadWordPWD, 1, "<Word 1-15> <Password> -- Read EM4xxx word data in password mode "},
652 {"wr", CmdWriteWord, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
653 {"wrpwd", CmdWriteWordPWD, 1, "<Data> <Word 1-15> <Password> -- Write EM4xxx word data in password mode"},
654 {NULL, NULL, 0, NULL}
655 };
656
657 int CmdLFEM4X(const char *Cmd)
658 {
659 CmdsParse(CommandTable, Cmd);
660 return 0;
661 }
662
663 int CmdHelp(const char *Cmd)
664 {
665 CmdsHelp(CommandTable);
666 return 0;
667 }
Impressum, Datenschutz