cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency T55xx commands
   8 //-----------------------------------------------------------------------------
   9
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <inttypes.h>
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdmain.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"
  19 #include "cmdlf.h"
  20 #include "cmdlft55xx.h"
  21 #include "util.h"
  22 #include "data.h"
  23
  24
  25 #define LF_TRACE_BUFF_SIZE 12000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)
  26 static int CmdHelp(const char *Cmd);
  27
  28
  29 int CmdReadBlk(const char *Cmd)
  30 {
  31         //default to invalid block
  32         int Block = -1;
  33         UsbCommand c;
  34
  35         sscanf(Cmd, "%d", &Block);
  36
  37         if ((Block > 7) | (Block < 0)) {
  38                 PrintAndLog("Block must be between 0 and 7");
  39                 return 1;
  40         }
  41
  42         //PrintAndLog(" Reading page 0 block : %d", Block);
  43
  44         // this command fills up BigBuff
  45         //
  46         c.cmd = CMD_T55XX_READ_BLOCK;
  47         c.d.asBytes[0] = 0x00;
  48         c.arg[0] = 0;
  49         c.arg[1] = Block;
  50         c.arg[2] = 0;
  51         SendCommand(&c);
  52         WaitForResponse(CMD_ACK, NULL);
  53
  54         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  55
  56         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
  57         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  58
  59         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  60                 GraphBuffer[j] = ((int)data[j]) ;
  61         }
  62         GraphTraceLen = LF_TRACE_BUFF_SIZE;
  63         CmdIceManchester(Cmd);
  64         RepaintGraphWindow();
  65   return 0;
  66 }
  67
  68 int CmdReadBlkPWD(const char *Cmd)
  69 {
  70         int Block = -1; //default to invalid block
  71         int Password = 0xFFFFFFFF; //default to blank Block 7
  72         UsbCommand c;
  73
  74         sscanf(Cmd, "%d %x", &Block, &Password);
  75
  76         if ((Block > 7) | (Block < 0)) {
  77                 PrintAndLog("Block must be between 0 and 7");
  78                 return 1;
  79         }
  80
  81         PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
  82
  83         c.cmd = CMD_T55XX_READ_BLOCK;
  84         c.d.asBytes[0] = 0x1; //Password mode
  85         c.arg[0] = 0;
  86         c.arg[1] = Block;
  87         c.arg[2] = Password;
  88         SendCommand(&c);
  89         WaitForResponse(CMD_ACK, NULL);
  90
  91         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  92
  93         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
  94         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  95
  96         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  97                 GraphBuffer[j] = ((int)data[j]) - 128;
  98         }
  99         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 100
 101         CmdIceManchester(Cmd);
 102
 103         RepaintGraphWindow();
 104   return 0;
 105 }
 106
 107 int CmdWriteBlk(const char *Cmd)
 108 {
 109   int Block = 8; //default to invalid block
 110   int Data = 0xFFFFFFFF; //default to blank Block
 111   UsbCommand c;
 112
 113   sscanf(Cmd, "%x %d", &Data, &Block);
 114
 115   if (Block > 7) {
 116         PrintAndLog("Block must be between 0 and 7");
 117         return 1;
 118   }
 119
 120   PrintAndLog("Writting block %d with data %08X", Block, Data);
 121
 122   c.cmd = CMD_T55XX_WRITE_BLOCK;
 123   c.d.asBytes[0] = 0x0; //Normal mode
 124   c.arg[0] = Data;
 125   c.arg[1] = Block;
 126   c.arg[2] = 0;
 127   SendCommand(&c);
 128   return 0;
 129 }
 130
 131 int CmdWriteBlkPWD(const char *Cmd)
 132 {
 133   int Block = 8; //default to invalid block
 134   int Data = 0xFFFFFFFF; //default to blank Block
 135   int Password = 0xFFFFFFFF; //default to blank Block 7
 136   UsbCommand c;
 137
 138   sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
 139
 140   if (Block > 7) {
 141         PrintAndLog("Block must be between 0 and 7");
 142         return 1;
 143   }
 144
 145   PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
 146
 147   c.cmd = CMD_T55XX_WRITE_BLOCK;
 148   c.d.asBytes[0] = 0x1; //Password mode
 149   c.arg[0] = Data;
 150   c.arg[1] = Block;
 151   c.arg[2] = Password;
 152   SendCommand(&c);
 153   return 0;
 154 }
 155
 156 int CmdReadTrace(const char *Cmd)
 157 {
 158         char cmdp = param_getchar(Cmd, 0);
 159
 160         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 161                 PrintAndLog("Usage:  lf t55xx trace  [use data from Graphbuffer]");
 162                 PrintAndLog("     [use data from Graphbuffer], if not set, try reading data from tag.");
 163                 PrintAndLog("");
 164                 PrintAndLog("        sample: lf t55xx trace");
 165                 PrintAndLog("        sample: lf t55xx trace 1");
 166                 return 0;
 167         }
 168
 169         if ( strlen(Cmd)==0){
 170                 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
 171                 SendCommand(&c);
 172                 WaitForResponse(CMD_ACK, NULL);
 173
 174                 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 175
 176                 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
 177                 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 178
 179                 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 180                         GraphBuffer[j] = ((int)data[j]);
 181                 }
 182                 GraphTraceLen = LF_TRACE_BUFF_SIZE;
 183         }
 184
 185         uint8_t bits[1000] = {0x00};
 186         uint8_t * bitstream = bits;
 187
 188         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 189         RepaintGraphWindow();
 190
 191         uint8_t si = 5;
 192         uint32_t bl0     = PackBits(si, 32, bitstream);
 193         uint32_t bl1     = PackBits(si+32, 32, bitstream);
 194
 195         uint32_t acl     = PackBits(si,  8, bitstream); si += 8;
 196         uint32_t mfc     = PackBits(si, 8, bitstream); si += 8;
 197         uint32_t cid     = PackBits(si, 5, bitstream); si += 5;
 198         uint32_t icr     = PackBits(si, 3, bitstream); si += 3;
 199         uint32_t year    = PackBits(si, 4, bitstream); si += 4;
 200         uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
 201         uint32_t lotid    = PackBits(si, 12, bitstream); si += 12;
 202         uint32_t wafer   = PackBits(si, 5, bitstream); si += 5;
 203         uint32_t dw      = PackBits(si, 15, bitstream);
 204
 205         PrintAndLog("");
 206         PrintAndLog("-- T55xx Trace Information ----------------------------------");
 207         PrintAndLog("-------------------------------------------------------------");
 208         PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1)  : 0x%02X (%d)", acl, acl);
 209         PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x%02X (%d)", mfc, mfc);
 210         PrintAndLog(" CID                                     : 0x%02X (%d)", cid, cid);
 211         PrintAndLog(" ICR IC Revision                         : %d",icr );
 212         PrintAndLog(" Manufactured");
 213         PrintAndLog("     Year/Quarter : %d/%d",2000+year, quarter );
 214         PrintAndLog("     Lot ID       : %d", lotid );
 215         PrintAndLog("     Wafer number : %d", wafer);
 216         PrintAndLog("     Die Number   : %d", dw);
 217         PrintAndLog("-------------------------------------------------------------");
 218         PrintAndLog(" Raw Data - Page 1");
 219         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bitstream+5,32) );
 220         PrintAndLog("     Block 0  : 0x%08X  %s", bl1, sprint_bin(bitstream+37,32) );
 221         PrintAndLog("-------------------------------------------------------------");
 222         /*
 223         TRACE - BLOCK O
 224                 Bits    Definition                                                              HEX
 225                 1-8             ACL Allocation class (ISO/IEC 15963-1)  0xE0
 226                 9-16    MFC Manufacturer ID (ISO/IEC 7816-6)    0x15 Atmel Corporation
 227                 17-21   CID                                                                             0x1 = Atmel ATA5577M1  0x2 = Atmel ATA5577M2
 228                 22-24   ICR IC revision
 229                 25-28   YEAR (BCD encoded)                                              9 (= 2009)
 230                 29-30   QUARTER                                                                 1,2,3,4
 231                 31-32   LOT ID
 232
 233         TRACE - BLOCK 1
 234                 1-12    LOT ID
 235                 13-17   Wafer number
 236                 18-32   DW,  die number sequential
 237         */
 238
 239   return 0;
 240 }
 241
 242 int CmdInfo(const char *Cmd){
 243         /*
 244                 Page 0 Block 0 Configuration data.
 245                 Normal mode
 246                 Extended mode
 247         */
 248         char cmdp = param_getchar(Cmd, 0);
 249
 250         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 251                 PrintAndLog("Usage:  lf t55xx info  [use data from Graphbuffer]");
 252                 PrintAndLog("     [use data from Graphbuffer], if not set, try reading data from tag.");
 253                 PrintAndLog("");
 254                 PrintAndLog("        sample: lf t55xx info");
 255                 PrintAndLog("        sample: lf t55xx info 1");
 256                 return 0;
 257         }
 258
 259         if ( strlen(Cmd)==0){
 260                 CmdReadBlk("0");
 261         }
 262
 263
 264         uint8_t bits[1000] = {0x00};
 265         uint8_t * bitstream = bits;
 266
 267         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 268
 269         uint8_t si = 5;
 270         uint32_t bl0      = PackBits(si, 32, bitstream);
 271
 272         uint32_t safer    = PackBits(si, 4, bitstream); si += 4;
 273         uint32_t resv     = PackBits(si, 7, bitstream); si += 7;
 274         uint32_t dbr      = PackBits(si, 3, bitstream); si += 3;
 275         uint32_t extend   = PackBits(si, 1, bitstream); si += 1;
 276         uint32_t datamodulation   = PackBits(si, 5, bitstream); si += 5;
 277         uint32_t pskcf    = PackBits(si, 2, bitstream); si += 2;
 278         uint32_t aor      = PackBits(si, 1, bitstream); si += 1;
 279         uint32_t otp      = PackBits(si, 1, bitstream); si += 1;
 280         uint32_t maxblk   = PackBits(si, 3, bitstream); si += 3;
 281         uint32_t pwd      = PackBits(si, 1, bitstream); si += 1;
 282         uint32_t sst      = PackBits(si, 1, bitstream); si += 1;
 283         uint32_t fw       = PackBits(si, 1, bitstream); si += 1;
 284         uint32_t inv      = PackBits(si, 1, bitstream); si += 1;
 285         uint32_t por      = PackBits(si, 1, bitstream); si += 1;
 286
 287         PrintAndLog("");
 288         PrintAndLog("-- T55xx Configuration --------------------------------------");
 289         PrintAndLog("-------------------------------------------------------------");
 290         PrintAndLog(" Safer key                 : %s", GetSaferStr(safer));
 291         PrintAndLog(" reserved                  : %d", resv);
 292         PrintAndLog(" Data bit rate             : %s", GetBitRateStr(dbr));
 293         PrintAndLog(" eXtended mode             : %s", (extend) ? "Yes - Warning":"No");
 294         PrintAndLog(" Modulation                : %s", GetModulationStr(datamodulation) );
 295         PrintAndLog(" PSK clock freq            : %d", pskcf);
 296         PrintAndLog(" AOR - Answer on Request   : %s", (aor) ? "Yes":"No");
 297         PrintAndLog(" OTP - One Time Pad        : %s", (otp) ? "Yes - Warning":"No" );
 298         PrintAndLog(" Max block                 : %d", maxblk);
 299         PrintAndLog(" Password mode             : %s", (pwd) ? "Yes":"No");
 300         PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
 301         PrintAndLog(" Fast Write                : %s", (fw) ? "Yes":"No");
 302         PrintAndLog(" Inverse data              : %s", (inv) ? "Yes":"No");
 303         PrintAndLog(" POR-Delay                 : %s", (por) ? "Yes":"No");
 304         PrintAndLog("-------------------------------------------------------------");
 305         PrintAndLog(" Raw Data - Page 0");
 306         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bitstream+5,32) );
 307         PrintAndLog("-------------------------------------------------------------");
 308
 309         return 0;
 310 }
 311
 312 int CmdDump(const char *Cmd){
 313
 314         char cmdp = param_getchar(Cmd, 0);
 315         char s[20];
 316         uint8_t pwd[4] = {0x00};
 317
 318         if (strlen(Cmd)>1 || cmdp == 'h' || cmdp == 'H') {
 319                 PrintAndLog("Usage:  lf t55xx dump <password>");
 320                 PrintAndLog("        sample: lf t55xx dump FFFFFFFF");
 321                 return 0;
 322         }
 323
 324         bool hasPwd = ( strlen(Cmd) > 0);
 325
 326         if ( hasPwd ){
 327                 if (param_gethex(Cmd, 0, pwd, 4)) {
 328                         PrintAndLog("password must include 4 HEX symbols");
 329                         return 0;
 330                 }
 331         }
 332
 333         for ( int i = 0; i <8; ++i){
 334                 *s = 0;
 335                 if ( hasPwd ) {
 336                         sprintf(s,"%d %d", i, pwd);
 337                         CmdReadBlkPWD(s);
 338                 } else {
 339                         sprintf(s,"%d", i);
 340                         CmdReadBlk(s);
 341                 }
 342         }
 343         return 0;
 344 }
 345
 346 int CmdIceFsk(const char *Cmd){
 347         iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
 348         RepaintGraphWindow();
 349         return 0;
 350 }
 351 int CmdIceManchester(const char *Cmd){
 352
 353         int  blockNum = -1;
 354         uint32_t blockData;
 355         uint8_t  bits[1000] = {0x00};
 356         uint8_t * bitstream = bits;
 357
 358         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 359     blockData = PackBits(5, 32, bitstream);
 360         sscanf(Cmd, "%d", &blockNum);
 361         if ( blockNum > -1){
 362                 PrintAndLog("   Block %d  : 0x%08X  %s", blockNum, blockData, sprint_bin(bitstream+5,32) );
 363         }else{
 364                 PrintAndLog("   Decoded : 0x%08X  %s", blockData, sprint_bin(bitstream+5,32) );
 365         }
 366         return 0;
 367 }
 368
 369 char * GetBitRateStr(uint32_t id){
 370         static char buf[40];
 371         char *retStr = buf;
 372                 switch (id){
 373                 case 0:
 374                         sprintf(retStr,"%d - RF/8",id);
 375                         break;
 376                 case 1:
 377                         sprintf(retStr,"%d - RF/16",id);
 378                         break;
 379                 case 2:
 380                         sprintf(retStr,"%d - RF/32",id);
 381                         break;
 382                 case 3:
 383                         sprintf(retStr,"%d - RF/40",id);
 384                         break;
 385                 case 4:
 386                         sprintf(retStr,"%d - RF/50",id);
 387                         break;
 388                 case 5:
 389                         sprintf(retStr,"%d - RF/64",id);
 390                         break;
 391                 case 6:
 392                         sprintf(retStr,"%d - RF/100",id);
 393                         break;
 394                 case 7:
 395                         sprintf(retStr,"%d - RF/128",id);
 396                         break;
 397                 default:
 398                         sprintf(retStr,"%d - (Unknown)",id);
 399                         break;
 400                 }
 401
 402         return buf;
 403 }
 404
 405 char * GetSaferStr(uint32_t id){
 406         static char buf[40];
 407         char *retStr = buf;
 408
 409         sprintf(retStr,"%d",id);
 410         if (id == 6) {
 411                 sprintf(retStr,"%d - pasdwd",id);
 412         }
 413         if (id == 9 ){
 414                 sprintf(retStr,"%d - testmode ",id);
 415         }
 416
 417         return buf;
 418 }
 419 char * GetModulationStr( uint32_t id){
 420         static char buf[40];
 421         char *retStr = buf;
 422
 423         switch (id){
 424                 case 0:
 425                         sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
 426                         break;
 427                 case 1:
 428                         sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
 429                         break;
 430                 case 2:
 431                         sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
 432                         break;
 433                 case 3:
 434                         sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
 435                         break;
 436                 case 4:
 437                         sprintf(retStr,"%d - FSK 1 RF/8  RF/5",id);
 438                         break;
 439                 case 5:
 440                         sprintf(retStr,"%d - FSK 2 RF/8  RF/10",id);
 441                         break;
 442                 case 6:
 443                         sprintf(retStr,"%d - FSK 1a RF/5  RF/8",id);
 444                         break;
 445                 case 7:
 446                         sprintf(retStr,"%d - FSK 2a RF/10  RF/8",id);
 447                         break;
 448                 case 8:
 449                         sprintf(retStr,"%d - Manschester",id);
 450                         break;
 451                 case 16:
 452                         sprintf(retStr,"%d - Biphase",id);
 453                         break;
 454                 case 17:
 455                         sprintf(retStr,"%d - Reserved",id);
 456                         break;
 457                 default:
 458                         sprintf(retStr,"0x%02X (Unknown)",id);
 459                         break;
 460                 }
 461         return buf;
 462 }
 463
 464
 465 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
 466
 467         int i = start;
 468         int j = len-1;
 469         uint32_t tmp = 0;
 470         for (; j >= 0; --j, ++i){
 471                 tmp     |= bits[i] << j;
 472         }
 473         return tmp;
 474 }
 475
 476 static command_t CommandTable[] =
 477 {
 478   {"help",   CmdHelp,        1, "This help"},
 479   {"rd",     CmdReadBlk,     0, "<block> -- Read T55xx block data (page 0)"},
 480   {"rdPWD",  CmdReadBlkPWD,  0, "<block> <password> -- Read T55xx block data with password mode"},
 481   {"wr",     CmdWriteBlk,    0, "<data> <block> -- Write T55xx block data (page 0)"},
 482   {"wrPWD",  CmdWriteBlkPWD, 0, "<data> <block> <password> -- Write T55xx block data with password"},
 483   {"trace",  CmdReadTrace,   0, "[1] Read T55xx traceability data (page 1 / blk 0-1) "},
 484   {"info",   CmdInfo,        0, "[1] Read T55xx configuration data (page0 /blk 0)"},
 485   {"dump",   CmdDump,        0, "[password] Dump T55xx card block 0-7. optional with password"},
 486   {"fsk",    CmdIceFsk,      0, "FSK demod"},
 487   {"man",    CmdIceManchester,      0, "Manchester demod"},
 488   {NULL, NULL, 0, NULL}
 489 };
 490
 491 int CmdLFT55XX(const char *Cmd)
 492 {
 493   CmdsParse(CommandTable, Cmd);
 494   return 0;
 495 }
 496
 497 int CmdHelp(const char *Cmd)
 498 {
 499   CmdsHelp(CommandTable);
 500   return 0;
 501 }