Add EM410x bruteforcing error checks

[proxmark3-svn] / armsrc / lfops.c

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 35cf90cad25abd63f8bc60015beb6ef058733e75..566ba1d40982ce2a2cb2e368383b5dc533787d80 100644 (file)
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -72,7 +72,7 @@ void ModThenAcquireRawAdcSamples125k(uint32_t delay_off, uint32_t period_0, uint
        FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
 
        // now do the read
        FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
 
        // now do the read

-       DoAcquisition_config(false);
+       DoAcquisition_config(false, 0);

 }
 
 /* blank r/w tag data stream
 }
 
 /* blank r/w tag data stream


@@ -769,6 +769,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
        size_t size; 
        uint32_t hi2=0, hi=0, lo=0;
        int idx=0;
        size_t size; 
        uint32_t hi2=0, hi=0, lo=0;
        int idx=0;

+       int dummyIdx = 0;

        // Configure to go in 125Khz listen mode
        LFSetupFPGAForADC(95, true);
 
        // Configure to go in 125Khz listen mode
        LFSetupFPGAForADC(95, true);
 


@@ -784,7 +785,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
                // FSK demodulator
                //size = sizeOfBigBuff;  //variable size will change after demod so re initialize it before use
                size = 50*128*2; //big enough to catch 2 sequences of largest format
                // FSK demodulator
                //size = sizeOfBigBuff;  //variable size will change after demod so re initialize it before use
                size = 50*128*2; //big enough to catch 2 sequences of largest format

-               idx = HIDdemodFSK(dest, &size, &hi2, &hi, &lo);
+               idx = HIDdemodFSK(dest, &size, &hi2, &hi, &lo, &dummyIdx);

                
                if (idx>0 && lo>0 && (size==96 || size==192)){
                        // go over previously decoded manchester data and decode into usable tag ID
                
                if (idx>0 && lo>0 && (size==96 || size==192)){
                        // go over previously decoded manchester data and decode into usable tag ID


@@ -861,7 +862,7 @@ void CmdAWIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
 {
        uint8_t *dest = BigBuf_get_addr();
        size_t size; 
 {
        uint8_t *dest = BigBuf_get_addr();
        size_t size; 

-       int idx=0;
+       int idx=0, dummyIdx=0;

        //clear read buffer
        BigBuf_Clear_keep_EM();
        // Configure to go in 125Khz listen mode
        //clear read buffer
        BigBuf_Clear_keep_EM();
        // Configure to go in 125Khz listen mode


@@ -875,7 +876,7 @@ void CmdAWIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
                DoAcquisition_default(-1,true);
                // FSK demodulator
                size = 50*128*2; //big enough to catch 2 sequences of largest format
                DoAcquisition_default(-1,true);
                // FSK demodulator
                size = 50*128*2; //big enough to catch 2 sequences of largest format

-               idx = AWIDdemodFSK(dest, &size);
+               idx = AWIDdemodFSK(dest, &size, &dummyIdx);

                
                if (idx<=0 || size!=96) continue;
                // Index map
                
                if (idx<=0 || size!=96) continue;
                // Index map


@@ -1017,6 +1018,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
        uint8_t version=0;
        uint8_t facilitycode=0;
        uint16_t number=0;
        uint8_t version=0;
        uint8_t facilitycode=0;
        uint16_t number=0;

+       int dummyIdx=0;

        //clear read buffer
        BigBuf_Clear_keep_EM();
        // Configure to go in 125Khz listen mode
        //clear read buffer
        BigBuf_Clear_keep_EM();
        // Configure to go in 125Khz listen mode


@@ -1028,7 +1030,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
                DoAcquisition_default(-1,true);
                //fskdemod and get start index
                WDT_HIT();
                DoAcquisition_default(-1,true);
                //fskdemod and get start index
                WDT_HIT();

-               idx = IOdemodFSK(dest, BigBuf_max_traceLen());
+               idx = IOdemodFSK(dest, BigBuf_max_traceLen(), &dummyIdx);

                if (idx<0) continue;
                //valid tag found
 
                if (idx<0) continue;
                //valid tag found
 


@@ -1132,7 +1134,7 @@ void T55xxResetRead(void) {
        TurnReadLFOn(READ_GAP);
 
        // Acquisition
        TurnReadLFOn(READ_GAP);
 
        // Acquisition

-       doT55x7Acquisition(BigBuf_max_traceLen());
+       DoPartialAcquisition(0, true, BigBuf_max_traceLen());

 
        // Turn the field off
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
 
        // Turn the field off
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off


@@ -1161,7 +1163,8 @@ void T55xxWriteBlockExt(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg
        // Std Opcode 10
        T55xxWriteBit(testMode ? 0 : 1);
        T55xxWriteBit(testMode ? 1 : Page); //Page 0
        // Std Opcode 10
        T55xxWriteBit(testMode ? 0 : 1);
        T55xxWriteBit(testMode ? 1 : Page); //Page 0

-       if (PwdMode){
+
+       if (PwdMode) {

                // Send Pwd
                for (i = 0x80000000; i != 0; i >>= 1)
                        T55xxWriteBit(Pwd & i);
                // Send Pwd
                for (i = 0x80000000; i != 0; i >>= 1)
                        T55xxWriteBit(Pwd & i);


@@ -1181,22 +1184,19 @@ void T55xxWriteBlockExt(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg
        // so wait a little more)
 
        // "there is a clock delay before programming" 
        // so wait a little more)
 
        // "there is a clock delay before programming" 

-       //  - programming takes ~5.6ms for t5577 ~18ms for E5550
+       //  - programming takes ~5.6ms for t5577 ~18ms for E5550 or t5567

        //  so we should wait 1 clock + 5.6ms then read response? 
        //  so we should wait 1 clock + 5.6ms then read response? 

-       //  but we need to know we are dealing with t55x7 vs e5550 (or q5) marshmellow...
+       //  but we need to know we are dealing with t5577 vs t5567 vs e5550 (or q5) marshmellow...

        if (testMode) {
        if (testMode) {

-               // Turn field on to read the response
-               TurnReadLFOn(READ_GAP);
-
-               // Acquisition
-               // Now do the acquisition
-               // Now do the acquisition
-               DoPartialAcquisition(20, true, 12000);
+               //TESTMODE TIMING TESTS: 
+               // <566us does nothing 
+               // 566-568 switches between wiping to 0s and doing nothing
+               // 5184 wipes and allows 1 block to be programmed.
+               // indefinite power on wipes and then programs all blocks with bitshifted data sent.
+               TurnReadLFOn(5184); 

 
 

-               //doT55x7Acquisition(12000);

        } else {
                TurnReadLFOn(20 * 1000);
        } else {
                TurnReadLFOn(20 * 1000);

-       }

                //could attempt to do a read to confirm write took
                // as the tag should repeat back the new block 
                // until it is reset, but to confirm it we would 
                //could attempt to do a read to confirm write took
                // as the tag should repeat back the new block 
                // until it is reset, but to confirm it we would 


@@ -1205,6 +1205,9 @@ void T55xxWriteBlockExt(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg
                // response should be (for t55x7) a 0 bit then (ST if on) 
                // block data written in on repeat until reset. 
 
                // response should be (for t55x7) a 0 bit then (ST if on) 
                // block data written in on repeat until reset. 
 

+               //DoPartialAcquisition(20, true, 12000);
+       }
+

        // turn field off
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_A_OFF();
        // turn field off
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_A_OFF();


@@ -1222,7 +1225,7 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
        bool PwdMode = arg0 & 0x1;
        uint8_t Page = (arg0 & 0x2) >> 1;
        uint32_t i = 0;
        bool PwdMode = arg0 & 0x1;
        uint8_t Page = (arg0 & 0x2) >> 1;
        uint32_t i = 0;

-       bool RegReadMode = (Block == 0xFF);
+       bool RegReadMode = (Block == 0xFF);//regular read mode

 
        //clear buffer now so it does not interfere with timing later
        BigBuf_Clear_ext(false);
 
        //clear buffer now so it does not interfere with timing later
        BigBuf_Clear_ext(false);


@@ -1257,14 +1260,14 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
                        T55xxWriteBit(Block & i);               
 
        // Turn field on to read the response
                        T55xxWriteBit(Block & i);               
 
        // Turn field on to read the response

-       TurnReadLFOn(135*8);
+       // 137*8 seems to get to the start of data pretty well... 
+       //  but we want to go past the start and let the repeating data settle in...
+       TurnReadLFOn(210*8); 

 
        // Acquisition
        // Now do the acquisition
        DoPartialAcquisition(0, true, 12000);
 
 
        // Acquisition
        // Now do the acquisition
        DoPartialAcquisition(0, true, 12000);
 

-       //      doT55x7Acquisition(12000);
-

        // Turn the field off
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
        cmd_send(CMD_ACK,0,0,0,0,0);    
        // Turn the field off
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
        cmd_send(CMD_ACK,0,0,0,0,0);    


@@ -1752,7 +1755,7 @@ void Cotag(uint32_t arg0) {
        switch(rawsignal) {
                case 0: doCotagAcquisition(50000); break;
                case 1: doCotagAcquisitionManchester(); break;
        switch(rawsignal) {
                case 0: doCotagAcquisition(50000); break;
                case 1: doCotagAcquisitionManchester(); break;

-               case 2: DoAcquisition_config(TRUE); break;
+               case 2: DoAcquisition_config(true, 0); break;

        }
 
        // Turn the field off
        }
 
        // Turn the field off