X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/1b492a97af74c0cb6c9886bce8b777d6bb50798d..f0cf62cd734219c2f8b012a4e3ba42520344bce4:/armsrc/lfops.c diff --git a/armsrc/lfops.c b/armsrc/lfops.c index 5e01e9b0..cc9814be 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -11,11 +11,12 @@ #include "../include/proxmark3.h" #include "apps.h" #include "util.h" -#include "../include/hitag2.h" #include "../common/crc16.h" +#include "../common/lfdemod.h" #include "string.h" #include "crapto1.h" -#include "mifareutil.h" +#include "mifareutil.h" +#include "../include/hitag2.h" // Sam7s has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK) // TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz @@ -63,9 +64,9 @@ void SnoopLFRawAdcSamples(int divisor, int trigger_threshold) // split into two routines so we can avoid timing issues after sending commands // void DoAcquisition125k_internal(int trigger_threshold, bool silent) { - uint8_t *dest = get_bigbufptr_recvrespbuf(); + uint8_t *dest = (uint8_t *)BigBuf; uint16_t i = 0; - memset(dest, 0x00, FREE_BUFFER_SIZE); + memset(dest, 0x00, BIGBUF_SIZE); for(;;) { if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) { @@ -79,7 +80,7 @@ void DoAcquisition125k_internal(int trigger_threshold, bool silent) continue; else trigger_threshold = -1; - if (++i >= FREE_BUFFER_SIZE) break; + if (++i >= BIGBUF_SIZE) break; } } if (!silent){ @@ -160,8 +161,6 @@ void ReadTItag(void) signed char *dest = (signed char *)BigBuf; int n = sizeof(BigBuf); -// int *dest = GraphBuffer; -// int n = GraphTraceLen; // 128 bit shift register [shift3:shift2:shift1:shift0] uint32_t shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0; @@ -568,8 +567,6 @@ void SimulateTagLowFrequency( uint16_t period, uint32_t gap, uint8_t ledcontrol) void SimulateTagLowFrequencyA(int len, int gap) { - //Dbprintf("LEN %d || Gap %d",len, gap); - uint8_t *buf = (uint8_t *)BigBuf; FpgaDownloadAndGo(FPGA_BITSTREAM_LF); @@ -623,7 +620,7 @@ static void fc(int c, uint16_t *n) { int idx; // for when we want an fc8 pattern every 4 logical bits - if(c==0) { + if(c == 0) { dest[((*n)++)]=1; dest[((*n)++)]=1; dest[((*n)++)]=0; @@ -634,7 +631,7 @@ static void fc(int c, uint16_t *n) { dest[((*n)++)]=0; } // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples - if(c==8) { + if(c == 8) { for (idx=0; idx<6; idx++) { dest[((*n)++)]=1; dest[((*n)++)]=1; @@ -648,8 +645,8 @@ static void fc(int c, uint16_t *n) { } // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples - if(c==10) { - for (idx=0; idx<5; idx++) { + if(c == 10) { + for (idx = 0; idx < 5; idx++) { dest[((*n)++)]=1; dest[((*n)++)]=1; dest[((*n)++)]=1; @@ -668,7 +665,7 @@ static void fc(int c, uint16_t *n) { // simulate a HID tag until the button is pressed void CmdHIDsimTAG(int hi, int lo, uint8_t ledcontrol) { - uint16_t n=0, i=0; + uint16_t n = 0, i = 0; /* HID tag bitstream format The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits @@ -679,11 +676,11 @@ void CmdHIDsimTAG(int hi, int lo, uint8_t ledcontrol) nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10) */ - if (hi>0xFFF) { + if (hi > 0xFFF) { DbpString("Tags can only have 44 bits."); return; } - fc(0,&n); + fc(0, &n); // special start of frame marker containing invalid bit sequences fc(8, &n); fc(8, &n); // invalid fc(8, &n); fc(10, &n); // logical 0 @@ -692,9 +689,9 @@ void CmdHIDsimTAG(int hi, int lo, uint8_t ledcontrol) WDT_HIT(); // manchester encode bits 43 to 32 - for (i=11; i>=0; i--) { - if ((i%4)==3) fc(0,&n); - if ((hi>>i)&1) { + for (i = 11; i >= 0; i--) { + if ((i % 4) == 3) fc(0, &n); + if ((hi >> i) & 1) { fc(10, &n); fc(8, &n); // low-high transition } else { fc(8, &n); fc(10, &n); // high-low transition @@ -703,9 +700,9 @@ void CmdHIDsimTAG(int hi, int lo, uint8_t ledcontrol) WDT_HIT(); // manchester encode bits 31 to 0 - for (i=31; i>=0; i--) { - if ((i%4)==3) fc(0,&n); - if ((lo>>i)&1) { + for (i = 31; i >= 0; i--) { + if ((i % 4 ) == 3) fc(0, &n); + if ((lo >> i ) & 1) { fc(10, &n); fc(8, &n); // low-high transition } else { fc(8, &n); fc(10, &n); // high-low transition @@ -721,106 +718,11 @@ void CmdHIDsimTAG(int hi, int lo, uint8_t ledcontrol) LED_A_OFF(); } -//translate wave to 11111100000 (1 for each short wave 0 for each long wave) -size_t fsk_demod(uint8_t * dest, size_t size) -{ - uint32_t last_transition = 0; - uint32_t idx = 1; - uint32_t maxVal=0; - // // we don't care about actual value, only if it's more or less than a - // // threshold essentially we capture zero crossings for later analysis - - // we do care about the actual value as sometimes near the center of the - // wave we may get static that changes direction of wave for one value - // if our value is too low it might affect the read. and if our tag or - // antenna is weak a setting too high might not see anything. [marshmellow] - if (size<100) return size; - for(idx=1; idx<100; idx++){ - if(maxVal1 transition - if (dest[idx-1] < dest[idx]) { // 0 -> 1 transition - - dest[numBits] = (idx-last_transition < 9) ? 1 : 0; - last_transition = idx; - numBits++; - } - } - return numBits; //Actually, it returns the number of bytes, but each byte represents a bit: 1 or 0 -} - -uint32_t myround(float f) -{ - if (f >= 2000) return 2000;//something bad happened - return (uint32_t) (f + (float)0.5); -} - -//translate 11111100000 to 10 -size_t aggregate_bits(uint8_t *dest,size_t size, uint8_t rfLen, uint8_t maxConsequtiveBits, uint8_t invert )// uint8_t h2l_crossing_value,uint8_t l2h_crossing_value, -{ - uint8_t lastval=dest[0]; - uint32_t idx=0; - size_t numBits=0; - uint32_t n=1; - - for( idx=1; idx < size; idx++) { - - if (dest[idx]==lastval) { - n++; - continue; - } - //if lastval was 1, we have a 1->0 crossing - if ( dest[idx-1]==1 ) { - n=myround((float)(n+1)/((float)(rfLen)/(float)8)); - //n=(n+1) / h2l_crossing_value; - } else {// 0->1 crossing - n=myround((float)(n+1)/((float)(rfLen-2)/(float)10)); - //n=(n+1) / l2h_crossing_value; - } - if (n == 0) n = 1; - - if(n < maxConsequtiveBits) - { - if ( invert==0) - memset(dest+numBits, dest[idx-1] , n); - else - memset(dest+numBits, dest[idx-1]^1 , n); - - numBits += n; - } - n=0; - lastval=dest[idx]; - }//end for - - return numBits; - -} // loop to get raw HID waveform then FSK demodulate the TAG ID from it void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol) { - uint8_t *dest = get_bigbufptr_recvrespbuf(); - - size_t size=0,idx=0; //, found=0; - uint32_t hi2=0, hi=0, lo=0; + uint8_t *dest = (uint8_t *)BigBuf; + uint32_t hi2 = 0, hi = 0, lo = 0; // Configure to go in 125Khz listen mode LFSetupFPGAForADC(0, true); @@ -833,172 +735,160 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol) DoAcquisition125k_internal(-1,true); // FSK demodulator - size = fsk_demod(dest, FREE_BUFFER_SIZE); - - // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns - // 1->0 : fc/8 in sets of 6 (RF/50 / 8 = 6.25) - // 0->1 : fc/10 in sets of 5 (RF/50 / 10= 5) - // do not invert - size = aggregate_bits(dest,size, 50,5,0); //6,5,5,0 + int bitLen = HIDdemodFSK(dest,BIGBUF_SIZE,&hi2,&hi,&lo); WDT_HIT(); + if (bitLen > 0 && lo > 0){ + // final loop, go over previously decoded manchester data and decode into usable tag ID // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0 - uint8_t frame_marker_mask[] = {1,1,1,0,0,0}; - int numshifts = 0; - idx = 0; - //one scan - uint8_t sameCardCount =0; - while( idx + sizeof(frame_marker_mask) < size) { - // search for a start of frame marker - if (sameCardCount>2) break; //only up to 2 valid sets of data for the same read of looping card data - if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0) - { // frame marker found - idx+=sizeof(frame_marker_mask); - - while(dest[idx] != dest[idx+1] && idx < size-2) - { - // Keep going until next frame marker (or error) - // Shift in a bit. Start by shifting high registers - hi2=(hi2<<1)|(hi>>31); - hi=(hi<<1)|(lo>>31); - //Then, shift in a 0 or one into low - if (dest[idx] && !dest[idx+1]) // 1 0 - lo=(lo<<1)|0; - else // 0 1 - lo=(lo<<1)| - 1; - numshifts ++; - idx += 2; + + if (hi2 != 0){ + //extra large HID tags + Dbprintf("TAG ID: %x%08x%08x (%d)", + (unsigned int) hi2, + (unsigned int) hi, + (unsigned int) lo, + (unsigned int) (lo >> 1) & 0xFFFF); + + } else { + //standard HID tags <38 bits + uint8_t bitlen = 0; + uint32_t fc = 0; + uint32_t cardnum = 0; + + if ((( hi >> 5 ) & 1) ==1){//if bit 38 is set then < 37 bit format is used + uint32_t lo2 = 0; + lo2 = (((hi & 31) << 12) | (lo >> 20)); //get bits 21-37 to check for format len bit + uint8_t idx3 = 1; + while(lo2 > 1){ //find last bit set to 1 (format len bit) + lo2 = lo2 >> 1; + idx3++; + } + bitlen =idx3 + 19; + fc = 0; + cardnum = 0; + if(bitlen == 26){ + cardnum = (lo >> 1) & 0xFFFF; + fc = (lo >> 17) & 0xFF; + } + if(bitlen == 37){ + cardnum = (lo >> 1) & 0x7FFFF; + fc = ((hi & 0xF) << 12)|( lo >> 20); + } + if(bitlen == 34){ + cardnum = (lo >> 1) & 0xFFFF; + fc = ((hi & 1) << 15) | (lo >> 17); + } + if(bitlen == 35){ + cardnum = (lo >> 1 ) & 0xFFFFF; + fc = ((hi & 1) << 11 ) | ( lo >> 21); + } } - //Dbprintf("Num shifts: %d ", numshifts); - // Hopefully, we read a tag and hit upon the next frame marker - if(idx + sizeof(frame_marker_mask) < size) - { - if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0) - { - if (hi2 != 0){ //extra large HID tags - Dbprintf("TAG ID: %x%08x%08x (%d)", - (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); - } - else { //standard HID tags <38 bits - //Dbprintf("TAG ID: %x%08x (%d)",(unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); //old print cmd - uint8_t bitlen = 0; - uint32_t fc = 0; - uint32_t cardnum = 0; - if (((hi>>5)&1)==1){//if bit 38 is set then < 37 bit format is used - uint32_t lo2=0; - lo2=(((hi & 31) << 12) | (lo>>20)); //get bits 21-37 to check for format len bit - uint8_t idx3 = 1; - while(lo2>1){ //find last bit set to 1 (format len bit) - lo2=lo2>>1; - idx3++; - } - bitlen =idx3+19; - fc =0; - cardnum=0; - if(bitlen==26){ - cardnum = (lo>>1)&0xFFFF; - fc = (lo>>17)&0xFF; - } - if(bitlen==37){ - cardnum = (lo>>1)&0x7FFFF; - fc = ((hi&0xF)<<12)|(lo>>20); - } - if(bitlen==34){ - cardnum = (lo>>1)&0xFFFF; - fc= ((hi&1)<<15)|(lo>>17); - } - if(bitlen==35){ - cardnum = (lo>>1)&0xFFFFF; - fc = ((hi&1)<<11)|(lo>>21); - } - } - else { //if bit 38 is not set then 37 bit format is used - bitlen= 37; - fc =0; - cardnum=0; - if(bitlen==37){ - cardnum = (lo>>1)&0x7FFFF; - fc = ((hi&0xF)<<12)|(lo>>20); - } - } - //Dbprintf("TAG ID: %x%08x (%d)", - // (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); - Dbprintf("TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d", - (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF, - (unsigned int) bitlen, (unsigned int) fc, (unsigned int) cardnum); - } - sameCardCount++; - if (findone){ - if (ledcontrol) LED_A_OFF(); - return; - } + else { //if bit 38 is not set then 37 bit format is used + bitlen = 37; + fc = 0; + cardnum = 0; + if(bitlen == 37){ + cardnum = ( lo >> 1) & 0x7FFFF; + fc = ((hi & 0xF) << 12 ) |(lo >> 20); } } - // reset - hi2 = hi = lo = 0; - numshifts = 0; - } else { - idx++; + Dbprintf("TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d", + (unsigned int) hi, + (unsigned int) lo, + (unsigned int) (lo >> 1) & 0xFFFF, + (unsigned int) bitlen, + (unsigned int) fc, + (unsigned int) cardnum); + } + if (findone){ + if (ledcontrol) LED_A_OFF(); + return; } + // reset + hi2 = hi = lo = 0; } WDT_HIT(); - - } + } DbpString("Stopped"); if (ledcontrol) LED_A_OFF(); } -uint32_t bytebits_to_byte(uint8_t* src, int numbits) +void CmdEM410xdemod(int findone, int *high, int *low, int ledcontrol) { - uint32_t num = 0; - for(int i = 0 ; i < numbits ; i++) - { - num = (num << 1) | (*src); - src++; + uint8_t *dest = (uint8_t *)BigBuf; + uint32_t bitLen = 0; + int clk = 0, invert = 0, errCnt = 0; + uint64_t lo = 0; + + // Configure to go in 125Khz listen mode + LFSetupFPGAForADC(0, true); + + while(!BUTTON_PRESS()) { + + WDT_HIT(); + if (ledcontrol) LED_A_ON(); + + DoAcquisition125k_internal(-1,true); + + // FSK demodulator + bitLen = BIGBUF_SIZE; + errCnt = askmandemod(dest,&bitLen,&clk,&invert); + if ( errCnt < 0 ) continue; + + WDT_HIT(); + + lo = Em410xDecode(dest,bitLen); + + if ( lo <= 0) continue; + + Dbprintf("EM TAG ID: %02x%08x - (%05d_%03d_%08d)", + (uint32_t)(lo >> 32), + (uint32_t)lo, + (uint32_t)(lo & 0xFFFF), + (uint32_t)((lo >> 16LL) & 0xFF), + (uint32_t)(lo & 0xFFFFFF) + ); + + if (findone){ + if (ledcontrol) LED_A_OFF(); + return; + } + + WDT_HIT(); + lo = clk = invert = errCnt = 0; } - return num; + DbpString("Stopped"); + if (ledcontrol) LED_A_OFF(); } - void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) { uint8_t *dest = (uint8_t *)BigBuf; - size_t size=0, idx=0; - uint32_t code=0, code2=0; - uint8_t isFinish = 0; - - // Configure to go in 125Khz listen mode + int idx = 0; + uint32_t code = 0, code2 = 0; + uint8_t version = 0; + uint8_t facilitycode = 0; + uint16_t number = 0; + LFSetupFPGAForADC(0, true); - while(!BUTTON_PRESS() & !isFinish) { + while(!BUTTON_PRESS()) { WDT_HIT(); - if (ledcontrol) LED_A_ON(); - DoAcquisition125k_internal(-1,true); - size = sizeof(BigBuf); - //make sure buffer has data - if (size < 64) return; - //test samples are not just noise - uint8_t testMax=0; - for(idx=0;idx<64;idx++){ - if (testMax170){ - //Dbprintf("testMax: %d",testMax); - // FSK demodulator - size = fsk_demod(dest, size); - // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns - // 1->0 : fc/8 in sets of 7 (RF/64 / 8 = 8) - // 0->1 : fc/10 in sets of 6 (RF/64 / 10 = 6.4) - size = aggregate_bits(dest, size, 64, 13, 1); //13 max Consecutive should be ok as most 0s in row should be 10 for init seq - invert bits - WDT_HIT(); + DoAcquisition125k_internal(-1, true); + + idx = IOdemodFSK(dest, BIGBUF_SIZE); + + if ( idx < 0 ) + continue; + + WDT_HIT(); + //Index map //0 10 20 30 40 50 60 //| | | | | | | @@ -1008,44 +898,34 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) // //XSF(version)facility:codeone+codetwo //Handle the data - uint8_t sameCardCount=0; - uint8_t mask[] = {0,0,0,0,0,0,0,0,0,1}; - for( idx=0; idx < (size - 74); idx++) { - if (sameCardCount>2) break; - if ( memcmp(dest + idx, mask, sizeof(mask))==0) { - //frame marker found - if (!dest[idx+8] && dest[idx+17]==1 && dest[idx+26]==1 && dest[idx+35]==1 && dest[idx+44]==1 && dest[idx+53]==1){ - //confirmed proper separator bits found - if(findone){ //only print binary if we are doing one - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7],dest[idx+8]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15],dest[idx+16],dest[idx+17]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23],dest[idx+24],dest[idx+25],dest[idx+26]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+27],dest[idx+28],dest[idx+29],dest[idx+30],dest[idx+31],dest[idx+32],dest[idx+33],dest[idx+34],dest[idx+35]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+36],dest[idx+37],dest[idx+38],dest[idx+39],dest[idx+40],dest[idx+41],dest[idx+42],dest[idx+43],dest[idx+44]); - Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+45],dest[idx+46],dest[idx+47],dest[idx+48],dest[idx+49],dest[idx+50],dest[idx+51],dest[idx+52],dest[idx+53]); - Dbprintf("%d%d%d%d%d%d%d%d %d%d",dest[idx+54],dest[idx+55],dest[idx+56],dest[idx+57],dest[idx+58],dest[idx+59],dest[idx+60],dest[idx+61],dest[idx+62],dest[idx+63]); - } - code = bytebits_to_byte(dest+idx,32); - code2 = bytebits_to_byte(dest+idx+32,32); - short version = bytebits_to_byte(dest+idx+27,8); //14,4 - uint8_t facilitycode = bytebits_to_byte(dest+idx+19,8) ; - uint16_t number = (bytebits_to_byte(dest+idx+36,8)<<8)|(bytebits_to_byte(dest+idx+45,8)); //36,9 - Dbprintf("XSF(%02d)%02x:%d (%08x%08x)",version,facilitycode,number,code,code2); - - // if we're only looking for one tag - if (findone){ - if (ledcontrol) LED_A_OFF(); - isFinish = 1; - break; - } - sameCardCount++; - } - } - } + if(findone){ //only print binary if we are doing one + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7],dest[idx+8]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15],dest[idx+16],dest[idx+17]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23],dest[idx+24],dest[idx+25],dest[idx+26]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+27],dest[idx+28],dest[idx+29],dest[idx+30],dest[idx+31],dest[idx+32],dest[idx+33],dest[idx+34],dest[idx+35]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+36],dest[idx+37],dest[idx+38],dest[idx+39],dest[idx+40],dest[idx+41],dest[idx+42],dest[idx+43],dest[idx+44]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+45],dest[idx+46],dest[idx+47],dest[idx+48],dest[idx+49],dest[idx+50],dest[idx+51],dest[idx+52],dest[idx+53]); + Dbprintf("%d%d%d%d%d%d%d%d %d%d",dest[idx+54],dest[idx+55],dest[idx+56],dest[idx+57],dest[idx+58],dest[idx+59],dest[idx+60],dest[idx+61],dest[idx+62],dest[idx+63]); } - WDT_HIT(); + + code = bytebits_to_byte(dest+idx,32); + code2 = bytebits_to_byte(dest+idx+32,32); + version = bytebits_to_byte(dest+idx+27,8); //14,4 + facilitycode = bytebits_to_byte(dest+idx+18,8) ; + number = (bytebits_to_byte(dest+idx+36,8)<<8)|(bytebits_to_byte(dest+idx+45,8)); //36,9 + + Dbprintf("XSF(%02d)%02x:%05d (%08x%08x)", version, facilitycode, number, code, code2); + if (findone){ + if (ledcontrol) LED_A_OFF(); + return; + } + code = code2 = 0; + version = facilitycode = 0; + number = 0; + idx = 0; } + DbpString("Stopped"); if (ledcontrol) LED_A_OFF(); }