1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
15 #include "proxmark3.h"
17 #include "lfdemod.h" // for psk2TOpsk1
18 #include "util.h" // for parsing cli command utils
19 #include "ui.h" // for show graph controls
20 #include "graph.h" // for graph data
21 #include "cmdparser.h" // for getting cli commands included in cmdmain.h
22 #include "cmdmain.h" // for sending cmds to device
23 #include "data.h" // for GetFromBigBuf
24 #include "cmddata.h" // for `lf search`
25 #include "cmdlfawid.h" // for awid menu
26 #include "cmdlfem4x.h" // for em4x menu
27 #include "cmdlfhid.h" // for hid menu
28 #include "cmdlfhitag.h" // for hitag menu
29 #include "cmdlfio.h" // for ioprox menu
30 #include "cmdlft55xx.h" // for t55xx menu
31 #include "cmdlfti.h" // for ti menu
32 #include "cmdlfpresco.h" // for presco menu
33 #include "cmdlfpcf7931.h"// for pcf7931 menu
34 #include "cmdlfpyramid.h"// for pyramid menu
35 #include "cmdlfviking.h" // for viking menu
36 #include "cmdlfcotag.h" // for COTAG menu
37 #include "cmdlfvisa2000.h" // for VISA2000 menu
39 bool g_lf_threshold_set
= false;
40 static int CmdHelp(const char *Cmd
);
44 int usage_lf_cmdread(void)
46 PrintAndLog("Usage: lf cmdread d <delay period> z <zero period> o <one period> c <cmdbytes> [H] ");
47 PrintAndLog("Options: ");
48 PrintAndLog(" h This help");
49 PrintAndLog(" L Low frequency (125 KHz)");
50 PrintAndLog(" H High frequency (134 KHz)");
51 PrintAndLog(" d <delay> delay OFF period");
52 PrintAndLog(" z <zero> time period ZERO");
53 PrintAndLog(" o <one> time period ONE");
54 PrintAndLog(" c <cmd> Command bytes");
55 PrintAndLog(" ************* All periods in microseconds");
56 PrintAndLog("Examples:");
57 PrintAndLog(" lf cmdread d 80 z 100 o 200 c 11000");
58 PrintAndLog(" lf cmdread d 80 z 100 o 100 c 11000 H");
62 /* send a command before reading */
63 int CmdLFCommandRead(const char *Cmd
)
65 static char dummy
[3] = {0x20,0x00,0x00};
66 UsbCommand c
= {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
};
68 //uint8_t divisor = 95; //125khz
70 while(param_getchar(Cmd
, cmdp
) != 0x00)
72 switch(param_getchar(Cmd
, cmdp
))
75 return usage_lf_cmdread();
85 param_getstr(Cmd
, cmdp
+1, (char *)&c
.d
.asBytes
);
89 c
.arg
[0] = param_get32ex(Cmd
, cmdp
+1, 0, 10);
93 c
.arg
[1] = param_get32ex(Cmd
, cmdp
+1, 0, 10);
97 c
.arg
[2] = param_get32ex(Cmd
, cmdp
+1, 0, 10);
101 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
108 if(cmdp
== 0) errors
= 1;
111 if(errors
) return usage_lf_cmdread();
113 // in case they specified 'H'
114 strcpy((char *)&c
.d
.asBytes
+ strlen((char *)c
.d
.asBytes
), dummy
);
116 clearCommandBuffer();
121 int CmdFlexdemod(const char *Cmd
)
124 for (i
= 0; i
< GraphTraceLen
; ++i
) {
125 if (GraphBuffer
[i
] < 0) {
132 #define LONG_WAIT 100
134 for (start
= 0; start
< GraphTraceLen
- LONG_WAIT
; start
++) {
135 int first
= GraphBuffer
[start
];
136 for (i
= start
; i
< start
+ LONG_WAIT
; i
++) {
137 if (GraphBuffer
[i
] != first
) {
141 if (i
== (start
+ LONG_WAIT
)) {
145 if (start
== GraphTraceLen
- LONG_WAIT
) {
146 PrintAndLog("nothing to wait for");
150 GraphBuffer
[start
] = 2;
151 GraphBuffer
[start
+1] = -2;
152 uint8_t bits
[64] = {0x00};
156 for (bit
= 0; bit
< 64; bit
++) {
158 for (int j
= 0; j
< 16; j
++) {
159 sum
+= GraphBuffer
[i
++];
162 bits
[bit
] = (sum
> 0) ? 1 : 0;
164 PrintAndLog("bit %d sum %d", bit
, sum
);
167 for (bit
= 0; bit
< 64; bit
++) {
170 for (j
= 0; j
< 16; j
++) {
171 sum
+= GraphBuffer
[i
++];
173 if (sum
> 0 && bits
[bit
] != 1) {
174 PrintAndLog("oops1 at %d", bit
);
176 if (sum
< 0 && bits
[bit
] != 0) {
177 PrintAndLog("oops2 at %d", bit
);
181 // HACK writing back to graphbuffer.
182 GraphTraceLen
= 32*64;
185 for (bit
= 0; bit
< 64; bit
++) {
187 phase
= (bits
[bit
] == 0) ? 0 : 1;
190 for (j
= 0; j
< 32; j
++) {
191 GraphBuffer
[i
++] = phase
;
196 RepaintGraphWindow();
200 int CmdIndalaDemod(const char *Cmd
)
202 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
208 // worst case with GraphTraceLen=64000 is < 4096
209 // under normal conditions it's < 2048
211 uint8_t rawbits
[4096];
213 int worst
= 0, worstPos
= 0;
214 // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
216 // loop through raw signal - since we know it is psk1 rf/32 fc/2 skip every other value (+=2)
217 for (i
= 0; i
< GraphTraceLen
-1; i
+= 2) {
219 if ((GraphBuffer
[i
] > GraphBuffer
[i
+ 1]) && (state
!= 1)) {
220 // appears redundant - marshmellow
222 for (j
= 0; j
< count
- 8; j
+= 16) {
223 rawbits
[rawbit
++] = 0;
225 if ((abs(count
- j
)) > worst
) {
226 worst
= abs(count
- j
);
232 } else if ((GraphBuffer
[i
] < GraphBuffer
[i
+ 1]) && (state
!= 0)) {
235 for (j
= 0; j
< count
- 8; j
+= 16) {
236 rawbits
[rawbit
++] = 1;
238 if ((abs(count
- j
)) > worst
) {
239 worst
= abs(count
- j
);
249 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit
, GraphTraceLen
/32);
250 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst
, worstPos
);
255 // Finding the start of a UID
256 int uidlen
, long_wait
;
257 if (strcmp(Cmd
, "224") == 0) {
267 for (start
= 0; start
<= rawbit
- uidlen
; start
++) {
268 first
= rawbits
[start
];
269 for (i
= start
; i
< start
+ long_wait
; i
++) {
270 if (rawbits
[i
] != first
) {
274 if (i
== (start
+ long_wait
)) {
279 if (start
== rawbit
- uidlen
+ 1) {
280 PrintAndLog("nothing to wait for");
284 // Inverting signal if needed
286 for (i
= start
; i
< rawbit
; i
++) {
287 rawbits
[i
] = !rawbits
[i
];
292 uint8_t bits
[224] = {0x00};
293 char showbits
[225] = {0x00};
298 if (uidlen
> rawbit
) {
299 PrintAndLog("Warning: not enough raw bits to get a full UID");
300 for (bit
= 0; bit
< rawbit
; bit
++) {
301 bits
[bit
] = rawbits
[i
++];
302 // As we cannot know the parity, let's use "." and "/"
303 showbits
[bit
] = '.' + bits
[bit
];
305 showbits
[bit
+1]='\0';
306 PrintAndLog("Partial UID=%s", showbits
);
309 for (bit
= 0; bit
< uidlen
; bit
++) {
310 bits
[bit
] = rawbits
[i
++];
311 showbits
[bit
] = '0' + bits
[bit
];
317 uint32_t uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
322 for( idx
=0; idx
<64; idx
++) {
323 if (showbits
[idx
] == '0') {
324 uid1
=(uid1
<<1)|(uid2
>>31);
327 uid1
=(uid1
<<1)|(uid2
>>31);
331 PrintAndLog("UID=%s (%x%08x)", showbits
, uid1
, uid2
);
334 uid3
= uid4
= uid5
= uid6
= uid7
= 0;
336 for( idx
=0; idx
<224; idx
++) {
337 uid1
=(uid1
<<1)|(uid2
>>31);
338 uid2
=(uid2
<<1)|(uid3
>>31);
339 uid3
=(uid3
<<1)|(uid4
>>31);
340 uid4
=(uid4
<<1)|(uid5
>>31);
341 uid5
=(uid5
<<1)|(uid6
>>31);
342 uid6
=(uid6
<<1)|(uid7
>>31);
344 if (showbits
[idx
] == '0')
345 uid7
= (uid7
<<1) | 0;
347 uid7
= (uid7
<<1) | 1;
349 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits
, uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
352 // Checking UID against next occurrences
354 for (; i
+ uidlen
<= rawbit
;) {
356 for (bit
= 0; bit
< uidlen
; bit
++) {
357 if (bits
[bit
] != rawbits
[i
++]) {
368 PrintAndLog("Occurrences: %d (expected %d)", times
, (rawbit
- start
) / uidlen
);
370 // Remodulating for tag cloning
371 // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
372 // since this changes graphbuffer data.
373 GraphTraceLen
= 32*uidlen
;
376 for (bit
= 0; bit
< uidlen
; bit
++) {
377 if (bits
[bit
] == 0) {
383 for (j
= 0; j
< 32; j
++) {
384 GraphBuffer
[i
++] = phase
;
389 RepaintGraphWindow();
393 int CmdIndalaClone(const char *Cmd
)
396 unsigned int uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
398 uid1
= uid2
= uid3
= uid4
= uid5
= uid6
= uid7
= 0;
401 if (strchr(Cmd
,'l') != 0) {
402 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
403 uid1
= (uid1
<< 4) | (uid2
>> 28);
404 uid2
= (uid2
<< 4) | (uid3
>> 28);
405 uid3
= (uid3
<< 4) | (uid4
>> 28);
406 uid4
= (uid4
<< 4) | (uid5
>> 28);
407 uid5
= (uid5
<< 4) | (uid6
>> 28);
408 uid6
= (uid6
<< 4) | (uid7
>> 28);
409 uid7
= (uid7
<< 4) | (n
& 0xf);
411 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
412 c
.cmd
= CMD_INDALA_CLONE_TAG_L
;
413 c
.d
.asDwords
[0] = uid1
;
414 c
.d
.asDwords
[1] = uid2
;
415 c
.d
.asDwords
[2] = uid3
;
416 c
.d
.asDwords
[3] = uid4
;
417 c
.d
.asDwords
[4] = uid5
;
418 c
.d
.asDwords
[5] = uid6
;
419 c
.d
.asDwords
[6] = uid7
;
421 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
422 uid1
= (uid1
<< 4) | (uid2
>> 28);
423 uid2
= (uid2
<< 4) | (n
& 0xf);
425 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1
, uid2
);
426 c
.cmd
= CMD_INDALA_CLONE_TAG
;
431 clearCommandBuffer();
436 int usage_lf_read(void)
438 PrintAndLog("Usage: lf read");
439 PrintAndLog("Options: ");
440 PrintAndLog(" h This help");
441 PrintAndLog(" s silent run no printout");
442 PrintAndLog("This function takes no arguments. ");
443 PrintAndLog("Use 'lf config' to set parameters.");
446 int usage_lf_snoop(void)
448 PrintAndLog("Usage: lf snoop");
449 PrintAndLog("Options: ");
450 PrintAndLog(" h This help");
451 PrintAndLog("This function takes no arguments. ");
452 PrintAndLog("Use 'lf config' to set parameters.");
456 int usage_lf_config(void)
458 PrintAndLog("Usage: lf config [H|<divisor>] [b <bps>] [d <decim>] [a 0|1]");
459 PrintAndLog("Options: ");
460 PrintAndLog(" h This help");
461 PrintAndLog(" L Low frequency (125 KHz)");
462 PrintAndLog(" H High frequency (134 KHz)");
463 PrintAndLog(" q <divisor> Manually set divisor. 88-> 134KHz, 95-> 125 Hz");
464 PrintAndLog(" b <bps> Sets resolution of bits per sample. Default (max): 8");
465 PrintAndLog(" d <decim> Sets decimation. A value of N saves only 1 in N samples. Default: 1");
466 PrintAndLog(" a [0|1] Averaging - if set, will average the stored sample value when decimating. Default: 1");
467 PrintAndLog(" t <threshold> Sets trigger threshold. 0 means no threshold (range: 0-128)");
468 PrintAndLog("Examples:");
469 PrintAndLog(" lf config b 8 L");
470 PrintAndLog(" Samples at 125KHz, 8bps.");
471 PrintAndLog(" lf config H b 4 d 3");
472 PrintAndLog(" Samples at 134KHz, averages three samples into one, stored with ");
473 PrintAndLog(" a resolution of 4 bits per sample.");
474 PrintAndLog(" lf read");
475 PrintAndLog(" Performs a read (active field)");
476 PrintAndLog(" lf snoop");
477 PrintAndLog(" Performs a snoop (no active field)");
481 int CmdLFSetConfig(const char *Cmd
)
484 uint8_t divisor
= 0;//Frequency divisor
485 uint8_t bps
= 0; // Bits per sample
486 uint8_t decimation
= 0; //How many to keep
487 bool averaging
= 1; // Defaults to true
489 int trigger_threshold
=-1;//Means no change
490 uint8_t unsigned_trigg
= 0;
493 while(param_getchar(Cmd
, cmdp
) != 0x00)
495 switch(param_getchar(Cmd
, cmdp
))
498 return usage_lf_config();
508 errors
|= param_getdec(Cmd
,cmdp
+1,&divisor
);
512 errors
|= param_getdec(Cmd
,cmdp
+1,&unsigned_trigg
);
515 trigger_threshold
= unsigned_trigg
;
516 if (trigger_threshold
> 0) g_lf_threshold_set
= true;
520 errors
|= param_getdec(Cmd
,cmdp
+1,&bps
);
524 errors
|= param_getdec(Cmd
,cmdp
+1,&decimation
);
528 averaging
= param_getchar(Cmd
,cmdp
+1) == '1';
532 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
540 errors
= 1;// No args
546 return usage_lf_config();
548 //Bps is limited to 8, so fits in lower half of arg1
549 if(bps
>> 4) bps
= 8;
551 sample_config config
= {
552 decimation
,bps
,averaging
,divisor
,trigger_threshold
554 //Averaging is a flag on high-bit of arg[1]
555 UsbCommand c
= {CMD_SET_LF_SAMPLING_CONFIG
};
556 memcpy(c
.d
.asBytes
,&config
,sizeof(sample_config
));
557 clearCommandBuffer();
562 int CmdLFRead(const char *Cmd
)
564 if (offline
) return 0;
567 if (param_getchar(Cmd
, cmdp
) == 'h')
569 return usage_lf_read();
571 if (param_getchar(Cmd
, cmdp
) == 's') arg1
= true; //suppress print
572 //And ship it to device
573 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
, {arg1
,0,0}};
574 clearCommandBuffer();
576 if (g_lf_threshold_set
) {
577 WaitForResponse(CMD_ACK
,NULL
);
579 if ( !WaitForResponseTimeout(CMD_ACK
,NULL
,2500) ) {
580 PrintAndLog("command execution time out");
587 int CmdLFSnoop(const char *Cmd
)
590 if(param_getchar(Cmd
, cmdp
) == 'h')
592 return usage_lf_snoop();
595 UsbCommand c
= {CMD_LF_SNOOP_RAW_ADC_SAMPLES
};
596 clearCommandBuffer();
598 WaitForResponse(CMD_ACK
,NULL
);
602 static void ChkBitstream(const char *str
)
606 /* convert to bitstream if necessary */
607 for (i
= 0; i
< (int)(GraphTraceLen
/ 2); i
++){
608 if (GraphBuffer
[i
] > 1 || GraphBuffer
[i
] < 0) {
614 //Attempt to simulate any wave in buffer (one bit per output sample)
615 // converts GraphBuffer to bitstream (based on zero crossings) if needed.
616 int CmdLFSim(const char *Cmd
)
621 sscanf(Cmd
, "%i", &gap
);
623 // convert to bitstream if necessary
627 //can send only 512 bits at a time (1 byte sent per bit...)
628 printf("Sending [%d bytes]", GraphTraceLen
);
629 for (i
= 0; i
< GraphTraceLen
; i
+= USB_CMD_DATA_SIZE
) {
630 UsbCommand c
={CMD_DOWNLOADED_SIM_SAMPLES_125K
, {i
, 0, 0}};
632 for (j
= 0; j
< USB_CMD_DATA_SIZE
; j
++) {
633 c
.d
.asBytes
[j
] = GraphBuffer
[i
+j
];
636 WaitForResponse(CMD_ACK
,NULL
);
641 PrintAndLog("Starting to simulate");
642 UsbCommand c
= {CMD_SIMULATE_TAG_125K
, {GraphTraceLen
, gap
, 0}};
643 clearCommandBuffer();
648 int usage_lf_simfsk(void)
651 PrintAndLog("Usage: lf simfsk [c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>]");
652 PrintAndLog("Options: ");
653 PrintAndLog(" h This help");
654 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
655 PrintAndLog(" i invert data");
656 PrintAndLog(" H <fcHigh> Manually set the larger Field Clock");
657 PrintAndLog(" L <fcLow> Manually set the smaller Field Clock");
658 //PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
659 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
660 PrintAndLog("\n NOTE: if you set one clock manually set them all manually");
664 int usage_lf_simask(void)
667 PrintAndLog("Usage: lf simask [c <clock>] [i] [b|m|r] [s] [d <raw hex to sim>]");
668 PrintAndLog("Options: ");
669 PrintAndLog(" h This help");
670 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
671 PrintAndLog(" i invert data");
672 PrintAndLog(" b sim ask/biphase");
673 PrintAndLog(" m sim ask/manchester - Default");
674 PrintAndLog(" r sim ask/raw");
675 PrintAndLog(" s add t55xx Sequence Terminator gap - default: no gaps (only manchester)");
676 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
680 int usage_lf_simpsk(void)
683 PrintAndLog("Usage: lf simpsk [1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>]");
684 PrintAndLog("Options: ");
685 PrintAndLog(" h This help");
686 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
687 PrintAndLog(" i invert data");
688 PrintAndLog(" 1 set PSK1 (default)");
689 PrintAndLog(" 2 set PSK2");
690 PrintAndLog(" 3 set PSK3");
691 PrintAndLog(" r <carrier> 2|4|8 are valid carriers: default = 2");
692 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
696 // by marshmellow - sim fsk data given clock, fcHigh, fcLow, invert
697 // - allow pull data from DemodBuffer
698 int CmdLFfskSim(const char *Cmd
)
700 //might be able to autodetect FCs and clock from Graphbuffer if using demod buffer
701 // otherwise will need FChigh, FClow, Clock, and bitstream
702 uint8_t fcHigh
=0, fcLow
=0, clk
=0;
705 char hexData
[32] = {0x00}; // store entered hex data
706 uint8_t data
[255] = {0x00};
709 while(param_getchar(Cmd
, cmdp
) != 0x00)
711 switch(param_getchar(Cmd
, cmdp
))
714 return usage_lf_simfsk();
720 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
724 errors
|= param_getdec(Cmd
,cmdp
+1,&fcHigh
);
728 errors
|= param_getdec(Cmd
,cmdp
+1,&fcLow
);
736 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
740 dataLen
= hextobinarray((char *)data
, hexData
);
742 if (dataLen
==0) errors
=true;
743 if (errors
) PrintAndLog ("Error getting hex data");
747 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
753 if(cmdp
== 0 && DemodBufferLen
== 0)
755 errors
= true;// No args
761 return usage_lf_simfsk();
764 if (dataLen
== 0){ //using DemodBuffer
765 if (clk
==0 || fcHigh
==0 || fcLow
==0){ //manual settings must set them all
766 uint8_t ans
= fskClocks(&fcHigh
, &fcLow
, &clk
, 0);
768 if (!fcHigh
) fcHigh
=10;
774 setDemodBuf(data
, dataLen
, 0);
777 //default if not found
778 if (clk
== 0) clk
= 50;
779 if (fcHigh
== 0) fcHigh
= 10;
780 if (fcLow
== 0) fcLow
= 8;
783 arg1
= fcHigh
<< 8 | fcLow
;
784 arg2
= invert
<< 8 | clk
;
785 size_t size
= DemodBufferLen
;
786 if (size
> USB_CMD_DATA_SIZE
) {
787 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
788 size
= USB_CMD_DATA_SIZE
;
790 UsbCommand c
= {CMD_FSK_SIM_TAG
, {arg1
, arg2
, size
}};
792 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
793 clearCommandBuffer();
798 // by marshmellow - sim ask data given clock, invert, manchester or raw, separator
799 // - allow pull data from DemodBuffer
800 int CmdLFaskSim(const char *Cmd
)
802 //autodetect clock from Graphbuffer if using demod buffer
803 // needs clock, invert, manchester/raw as m or r, separator as s, and bitstream
804 uint8_t encoding
= 1, separator
= 0;
805 uint8_t clk
=0, invert
=0;
807 char hexData
[32] = {0x00};
808 uint8_t data
[255]= {0x00}; // store entered hex data
811 while(param_getchar(Cmd
, cmdp
) != 0x00)
813 switch(param_getchar(Cmd
, cmdp
))
816 return usage_lf_simask();
822 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
826 encoding
=2; //biphase
842 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
846 dataLen
= hextobinarray((char *)data
, hexData
);
848 if (dataLen
==0) errors
=true;
849 if (errors
) PrintAndLog ("Error getting hex data, datalen: %d",dataLen
);
853 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
859 if(cmdp
== 0 && DemodBufferLen
== 0)
861 errors
= true;// No args
867 return usage_lf_simask();
869 if (dataLen
== 0){ //using DemodBuffer
870 if (clk
== 0) clk
= GetAskClock("0", false, false);
872 setDemodBuf(data
, dataLen
, 0);
874 if (clk
== 0) clk
= 64;
875 if (encoding
== 0) clk
= clk
/2; //askraw needs to double the clock speed
877 size_t size
=DemodBufferLen
;
878 arg1
= clk
<< 8 | encoding
;
879 arg2
= invert
<< 8 | separator
;
880 if (size
> USB_CMD_DATA_SIZE
) {
881 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
882 size
= USB_CMD_DATA_SIZE
;
884 UsbCommand c
= {CMD_ASK_SIM_TAG
, {arg1
, arg2
, size
}};
885 PrintAndLog("preparing to sim ask data: %d bits", size
);
886 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
887 clearCommandBuffer();
892 // by marshmellow - sim psk data given carrier, clock, invert
893 // - allow pull data from DemodBuffer or parameters
894 int CmdLFpskSim(const char *Cmd
)
896 //might be able to autodetect FC and clock from Graphbuffer if using demod buffer
897 //will need carrier, Clock, and bitstream
898 uint8_t carrier
=0, clk
=0;
901 char hexData
[32] = {0x00}; // store entered hex data
902 uint8_t data
[255] = {0x00};
906 while(param_getchar(Cmd
, cmdp
) != 0x00)
908 switch(param_getchar(Cmd
, cmdp
))
911 return usage_lf_simpsk();
917 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
921 errors
|= param_getdec(Cmd
,cmdp
+1,&carrier
);
937 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
941 dataLen
= hextobinarray((char *)data
, hexData
);
943 if (dataLen
==0) errors
=true;
944 if (errors
) PrintAndLog ("Error getting hex data");
948 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
954 if (cmdp
== 0 && DemodBufferLen
== 0)
956 errors
= true;// No args
962 return usage_lf_simpsk();
964 if (dataLen
== 0){ //using DemodBuffer
965 PrintAndLog("Getting Clocks");
966 if (clk
==0) clk
= GetPskClock("", false, false);
967 PrintAndLog("clk: %d",clk
);
968 if (!carrier
) carrier
= GetPskCarrier("", false, false);
969 PrintAndLog("carrier: %d", carrier
);
971 setDemodBuf(data
, dataLen
, 0);
974 if (clk
<= 0) clk
= 32;
975 if (carrier
== 0) carrier
= 2;
978 //need to convert psk2 to psk1 data before sim
979 psk2TOpsk1(DemodBuffer
, DemodBufferLen
);
981 PrintAndLog("Sorry, PSK3 not yet available");
985 arg1
= clk
<< 8 | carrier
;
987 size_t size
=DemodBufferLen
;
988 if (size
> USB_CMD_DATA_SIZE
) {
989 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
990 size
=USB_CMD_DATA_SIZE
;
992 UsbCommand c
= {CMD_PSK_SIM_TAG
, {arg1
, arg2
, size
}};
993 PrintAndLog("DEBUG: Sending DemodBuffer Length: %d", size
);
994 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
995 clearCommandBuffer();
1001 int CmdLFSimBidir(const char *Cmd
)
1003 // Set ADC to twice the carrier for a slight supersampling
1004 // HACK: not implemented in ARMSRC.
1005 PrintAndLog("Not implemented yet.");
1006 UsbCommand c
= {CMD_LF_SIMULATE_BIDIR
, {47, 384, 0}};
1011 int CmdVchDemod(const char *Cmd
)
1013 // Is this the entire sync pattern, or does this also include some
1014 // data bits that happen to be the same everywhere? That would be
1016 static const int SyncPattern
[] = {
1017 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1018 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1019 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1020 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1021 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1022 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1023 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1024 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1025 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1026 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1029 // So first, we correlate for the sync pattern, and mark that.
1030 int bestCorrel
= 0, bestPos
= 0;
1032 // It does us no good to find the sync pattern, with fewer than
1033 // 2048 samples after it...
1034 for (i
= 0; i
< (GraphTraceLen
-2048); i
++) {
1037 for (j
= 0; j
< arraylen(SyncPattern
); j
++) {
1038 sum
+= GraphBuffer
[i
+j
]*SyncPattern
[j
];
1040 if (sum
> bestCorrel
) {
1045 PrintAndLog("best sync at %d [metric %d]", bestPos
, bestCorrel
);
1050 int worst
= INT_MAX
;
1053 for (i
= 0; i
< 2048; i
+= 8) {
1056 for (j
= 0; j
< 8; j
++) {
1057 sum
+= GraphBuffer
[bestPos
+i
+j
];
1064 if(abs(sum
) < worst
) {
1069 PrintAndLog("bits:");
1070 PrintAndLog("%s", bits
);
1071 PrintAndLog("worst metric: %d at pos %d", worst
, worstPos
);
1073 if (strcmp(Cmd
, "clone")==0) {
1076 for(s
= bits
; *s
; s
++) {
1078 for(j
= 0; j
< 16; j
++) {
1079 GraphBuffer
[GraphTraceLen
++] = (*s
== '1') ? 1 : 0;
1082 RepaintGraphWindow();
1089 int CheckChipType(char cmdp
) {
1090 uint32_t wordData
= 0;
1092 //check for em4x05/em4x69 chips first
1094 if ((!offline
&& (cmdp
!= '1')) && EM4x05Block0Test(&wordData
)) {
1095 PrintAndLog("\nValid EM4x05/EM4x69 Chip Found\nTry lf em 4x05... commands\n");
1100 //TODO check for t55xx chip...
1107 int CmdLFfind(const char *Cmd
)
1109 uint32_t wordData
= 0;
1111 size_t minLength
= 1000;
1112 char cmdp
= param_getchar(Cmd
, 0);
1113 char testRaw
= param_getchar(Cmd
, 1);
1114 if (strlen(Cmd
) > 3 || cmdp
== 'h' || cmdp
== 'H') {
1115 PrintAndLog("Usage: lf search <0|1> [u]");
1116 PrintAndLog(" <use data from Graphbuffer> , if not set, try reading data from tag.");
1117 PrintAndLog(" [Search for Unknown tags] , if not set, reads only known tags.");
1119 PrintAndLog(" sample: lf search = try reading data from tag & search for known tags");
1120 PrintAndLog(" : lf search 1 = use data from GraphBuffer & search for known tags");
1121 PrintAndLog(" : lf search u = try reading data from tag & search for known and unknown tags");
1122 PrintAndLog(" : lf search 1 u = use data from GraphBuffer & search for known and unknown tags");
1127 if (!offline
&& (cmdp
!= '1')){
1129 getSamples("30000",false);
1130 } else if (GraphTraceLen
< minLength
) {
1131 PrintAndLog("Data in Graphbuffer was too small.");
1134 if (cmdp
== 'u' || cmdp
== 'U') testRaw
= 'u';
1136 PrintAndLog("NOTE: some demods output possible binary\n if it finds something that looks like a tag");
1137 PrintAndLog("False Positives ARE possible\n");
1138 PrintAndLog("\nChecking for known tags:\n");
1140 size_t testLen
= minLength
;
1141 // only run if graphbuffer is just noise as it should be for hitag/cotag
1142 if (graphJustNoise(GraphBuffer
, testLen
)) {
1143 // only run these tests if we are in online mode
1144 if (!offline
&& (cmdp
!= '1')) {
1145 // test for em4x05 in reader talk first mode.
1146 if (EM4x05Block0Test(&wordData
)) {
1147 PrintAndLog("\nValid EM4x05/EM4x69 Chip Found\nUse lf em 4x05readword/dump commands to read\n");
1150 ans
=CmdLFHitagReader("26");
1154 ans
=CmdCOTAGRead("");
1156 PrintAndLog("\nValid COTAG ID Found!");
1163 ans
=CmdFSKdemodIO("");
1165 PrintAndLog("\nValid IO Prox ID Found!");
1166 return CheckChipType(cmdp
);
1169 ans
=CmdFSKdemodPyramid("");
1171 PrintAndLog("\nValid Pyramid ID Found!");
1172 return CheckChipType(cmdp
);
1175 ans
=CmdFSKdemodParadox("");
1177 PrintAndLog("\nValid Paradox ID Found!");
1178 return CheckChipType(cmdp
);
1181 ans
=CmdFSKdemodAWID("");
1183 PrintAndLog("\nValid AWID ID Found!");
1184 return CheckChipType(cmdp
);
1187 ans
=CmdFSKdemodHID("");
1189 PrintAndLog("\nValid HID Prox ID Found!");
1190 return CheckChipType(cmdp
);
1193 ans
=CmdAskEM410xDemod("");
1195 PrintAndLog("\nValid EM410x ID Found!");
1196 return CheckChipType(cmdp
);
1199 ans
=CmdVisa2kDemod("");
1201 PrintAndLog("\nValid Visa2000 ID Found!");
1202 return CheckChipType(cmdp
);
1205 ans
=CmdG_Prox_II_Demod("");
1207 PrintAndLog("\nValid G Prox II ID Found!");
1208 return CheckChipType(cmdp
);
1211 ans
=CmdFDXBdemodBI("");
1213 PrintAndLog("\nValid FDX-B ID Found!");
1214 return CheckChipType(cmdp
);
1217 ans
=EM4x50Read("", false);
1219 PrintAndLog("\nValid EM4x50 ID Found!");
1223 ans
=CmdVikingDemod("");
1225 PrintAndLog("\nValid Viking ID Found!");
1226 return CheckChipType(cmdp
);
1229 ans
=CmdIndalaDecode("");
1231 PrintAndLog("\nValid Indala ID Found!");
1232 return CheckChipType(cmdp
);
1235 ans
=CmdPSKNexWatch("");
1237 PrintAndLog("\nValid NexWatch ID Found!");
1238 return CheckChipType(cmdp
);
1241 PrintAndLog("\nNo Known Tags Found!\n");
1242 if (testRaw
=='u' || testRaw
=='U'){
1243 ans
=CheckChipType(cmdp
);
1244 //test unknown tag formats (raw mode)0
1245 PrintAndLog("\nChecking for Unknown tags:\n");
1246 ans
=AutoCorrelate(4000, false, false);
1247 if (ans
> 0) PrintAndLog("Possible Auto Correlation of %d repeating samples",ans
);
1248 ans
=GetFskClock("",false,false);
1249 if (ans
!= 0){ //fsk
1250 ans
=FSKrawDemod("",true);
1252 PrintAndLog("\nUnknown FSK Modulated Tag Found!");
1257 ans
=ASKDemod_ext("0 0 0",true,false,1,&st
);
1259 PrintAndLog("\nUnknown ASK Modulated and Manchester encoded Tag Found!");
1260 PrintAndLog("\nif it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'");
1263 ans
=CmdPSK1rawDemod("");
1265 PrintAndLog("Possible unknown PSK1 Modulated Tag Found above!\n\nCould also be PSK2 - try 'data rawdemod p2'");
1266 PrintAndLog("\nCould also be PSK3 - [currently not supported]");
1267 PrintAndLog("\nCould also be NRZ - try 'data nrzrawdemod");
1270 PrintAndLog("\nNo Data Found!\n");
1275 static command_t CommandTable
[] =
1277 {"help", CmdHelp
, 1, "This help"},
1278 {"awid", CmdLFAWID
, 1, "{ AWID RFIDs... }"},
1279 {"cotag", CmdLFCOTAG
, 1, "{ COTAG RFIDs... }"},
1280 {"em", CmdLFEM4X
, 1, "{ EM4X RFIDs... }"},
1281 {"hid", CmdLFHID
, 1, "{ HID RFIDs... }"},
1282 {"hitag", CmdLFHitag
, 1, "{ Hitag tags and transponders... }"},
1283 {"io", CmdLFIO
, 1, "{ ioProx tags... }"},
1284 {"presco", CmdLFPresco
, 1, "{ Presco RFIDs... }"},
1285 {"pcf7931", CmdLFPCF7931
, 1, "{ PCF7931 RFIDs... }"},
1286 {"pyramid", CmdLFPyramid
, 1, "{ Farpointe/Pyramid RFIDs... }"},
1287 {"t55xx", CmdLFT55XX
, 1, "{ T55xx RFIDs... }"},
1288 {"ti", CmdLFTI
, 1, "{ TI RFIDs... }"},
1289 {"viking", CmdLFViking
, 1, "{ Viking tags... }"},
1290 {"visa2000", CmdLFVisa2k
, 1, "{ Visa2000 RFIDs...}"},
1291 {"cmdread", CmdLFCommandRead
, 0, "<d period> <z period> <o period> <c command> ['H'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'H' for 134)"},
1292 {"config", CmdLFSetConfig
, 0, "Set config for LF sampling, bit/sample, decimation, frequency"},
1293 {"flexdemod", CmdFlexdemod
, 1, "Demodulate samples for FlexPass"},
1294 {"indalademod", CmdIndalaDemod
, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
1295 {"indalaclone", CmdIndalaClone
, 0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
1296 {"read", CmdLFRead
, 0, "['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"},
1297 {"search", CmdLFfind
, 1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) - 'u' to search for unknown tags"},
1298 {"sim", CmdLFSim
, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
1299 {"simask", CmdLFaskSim
, 0, "[clock] [invert <1|0>] [biphase/manchester/raw <'b'|'m'|'r'>] [msg separator 's'] [d <hexdata>] -- Simulate LF ASK tag from demodbuffer or input"},
1300 {"simfsk", CmdLFfskSim
, 0, "[c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>] -- Simulate LF FSK tag from demodbuffer or input"},
1301 {"simpsk", CmdLFpskSim
, 0, "[1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>] -- Simulate LF PSK tag from demodbuffer or input"},
1302 {"simbidir", CmdLFSimBidir
, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
1303 {"snoop", CmdLFSnoop
, 0, "['l'|'h'|<divisor>] [trigger threshold]-- Snoop LF (l:125khz, h:134khz)"},
1304 {"vchdemod", CmdVchDemod
, 1, "['clone'] -- Demodulate samples for VeriChip"},
1305 {NULL
, NULL
, 0, NULL
}
1308 int CmdLF(const char *Cmd
)
1310 CmdsParse(CommandTable
, Cmd
);
1314 int CmdHelp(const char *Cmd
)
1316 CmdsHelp(CommandTable
);