X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/2ae8a312e058f71d0f02be4f2f9cc6f284ebbf34..0452ec6c906c2389c761c1dd6b0a4b5f67defe32:/client/cmdlfem4x.c

diff --git a/client/cmdlfem4x.c b/client/cmdlfem4x.c
index aa87132e..a0cd87ca 100644
--- a/client/cmdlfem4x.c
+++ b/client/cmdlfem4x.c
@@ -28,6 +28,16 @@ char *global_em410xId;
 
 static int CmdHelp(const char *Cmd);
 
+int CmdEMdemodASK(const char *Cmd)
+{
+	char cmdp = param_getchar(Cmd, 0);
+	int findone = (cmdp == '1') ? 1 : 0;	
+	UsbCommand c = { CMD_EM410X_DEMOD };
+	c.arg[0] = findone;
+	SendCommand(&c);
+	return 0;
+}
+
 /* Read the ID of an EM410x tag.
  * Format:
  *   1111 1111 1           <-- standard non-repeatable header
@@ -40,29 +50,25 @@ int CmdEM410xRead(const char *Cmd)
 {
   int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
   int parity[4];
-  char id[11];
-  char id2[11];
+  char id[11] = {0x00};
+  char id2[11] = {0x00};
   int retested = 0;
   uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
   high = low = 0;
 
-  /* Detect high and lows and clock */
-  for (i = 0; i < GraphTraceLen; i++)
-  {
-    if (GraphBuffer[i] > high)
-      high = GraphBuffer[i];
-    else if (GraphBuffer[i] < low)
-      low = GraphBuffer[i];
-  }
-
-  /* get clock */
-  clock = GetClock(Cmd, high, 0);
+  // get clock 
+  clock = GetClock(Cmd, 0);
+  
+  // Detect high and lows and clock 
+  DetectHighLowInGraph( &high, &low, TRUE);
 
-  /* parity for our 4 columns */
+  PrintAndLog("NUMNUM");
+  
+  // parity for our 4 columns
   parity[0] = parity[1] = parity[2] = parity[3] = 0;
   header = rows = 0;
 
-  /* manchester demodulate */
+  // manchester demodulate
   bit = bit2idx = 0;
   for (i = 0; i < (int)(GraphTraceLen / clock); i++)
   {
@@ -73,9 +79,9 @@ int CmdEM410xRead(const char *Cmd)
     /* Find out if we hit both high and low peaks */
     for (j = 0; j < clock; j++)
     {
-      if (GraphBuffer[(i * clock) + j] == high)
+      if (GraphBuffer[(i * clock) + j] >= high)
         hithigh = 1;
-      else if (GraphBuffer[(i * clock) + j] == low)
+      else if (GraphBuffer[(i * clock) + j] <= low)
         hitlow = 1;
 
       /* it doesn't count if it's the first part of our read
@@ -95,10 +101,10 @@ int CmdEM410xRead(const char *Cmd)
 
     BitStream[bit2idx++] = bit;
   }
-
+  
 retest:
   /* We go till 5 before the graph ends because we'll get that far below */
-  for (i = 1; i < bit2idx - 5; i++)
+  for (i = 0; i < bit2idx - 5; i++)
   {
     /* Step 2: We have our header but need our tag ID */
     if (header == 9 && rows < 10)
@@ -127,7 +133,7 @@ retest:
         PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
 
         /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
-        i -= 9 + (5 * rows) - 5;
+        i -= 9 + (5 * rows) -5;
 
         rows = header = 0;
       }
@@ -175,13 +181,14 @@ retest:
   }
 
   /* if we've already retested after flipping bits, return */
-  if (retested++){
-    return 0;
+	if (retested++){
+		PrintAndLog("Failed to decode");
+		return 0;
 	}
 
   /* if this didn't work, try flipping bits */
-  for (i = 0; i < bit2idx; i++)
-    BitStream[i] ^= 1;
+	for (i = 0; i < bit2idx; i++)
+		BitStream[i] ^= 1;
 
   goto retest;
 }
@@ -196,15 +203,15 @@ retest:
  */
 int CmdEM410xSim(const char *Cmd)
 {	
-	int i, n, j, h, binary[4], parity[4];
+	int i, n, j, binary[4], parity[4];
 
 	char cmdp = param_getchar(Cmd, 0);
 	uint8_t uid[5] = {0x00};
 
 	if (cmdp == 'h' || cmdp == 'H') {
-		PrintAndLog("Usage:  lf em4x sim <UID>");
+		PrintAndLog("Usage:  lf em4x 410xsim <UID>");
 		PrintAndLog("");
-		PrintAndLog("     sample: lf em4x sim 0F0368568B");
+		PrintAndLog("     sample: lf em4x 410xsim 0F0368568B");
 		return 0;
 	}
 
@@ -213,18 +220,15 @@ int CmdEM410xSim(const char *Cmd)
 		return 0;
 	}
 	
-	PrintAndLog("Starting simulating with UID %02X %02X %02X %02X %02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
-	
+	PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
+	PrintAndLog("Press pm3-button to about simulation");
   
   /* clock is 64 in EM410x tags */
   int clock = 64;
 
   /* clear our graph */
   ClearGraph(0);
-
-  /* write it out a few times */
-  for (h = 0; h < 4; h++)
-  {
+  
     /* write 9 start bits */
     for (i = 0; i < 9; i++)
       AppendGraph(0, clock, 1);
@@ -260,17 +264,10 @@ int CmdEM410xSim(const char *Cmd)
     AppendGraph(0, clock, parity[2]);
     AppendGraph(0, clock, parity[3]);
 
-    /* stop bit */
-    AppendGraph(0, clock, 0);
-  }
-
-  /* modulate that biatch */
-  CmdManchesterMod("");
-
-  /* booyah! */
-  RepaintGraphWindow();
-  
-  CmdLFSim("");
+  /* stop bit */
+  AppendGraph(1, clock, 0);
+ 
+  CmdLFSim("240"); //240 start_gap.
   return 0;
 }
 
@@ -286,7 +283,8 @@ int CmdEM410xSim(const char *Cmd)
 */
 int CmdEM410xWatch(const char *Cmd)
 {
-	int read_h = (*Cmd == 'h');
+	char cmdp = param_getchar(Cmd, 0);
+	int read_h = (cmdp == 'h');
 	do
 	{
 		if (ukbhit()) {
@@ -295,10 +293,10 @@ int CmdEM410xWatch(const char *Cmd)
 		}
 		
 		CmdLFRead(read_h ? "h" : "");
-		CmdSamples("16000");
+		CmdSamples("6000");
 		
 	} while (
-		!CmdEM410xRead("64") 
+		!CmdEM410xRead("") 
 	);
 	return 0;
 }
@@ -362,7 +360,7 @@ int CmdEM4x50Read(const char *Cmd)
       ++i;
     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
       ++i;
-    if (j>(MAX_GRAPH_TRACE_LEN/64)) {
+    if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
       break;
     }
     tmpbuff[j++]= i - start;
@@ -547,7 +545,7 @@ int CmdReadWord(const char *Cmd)
 
 	uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 
-	GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
+	GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
 	WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 
 	for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
@@ -587,7 +585,7 @@ int CmdReadWordPWD(const char *Cmd)
 		
 	uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 
-	GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
+	GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
 	WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 
 	for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
@@ -615,7 +613,7 @@ int CmdWriteWord(const char *Cmd)
     return 1;
   }
   
-  PrintAndLog("Writting word %d with data %08X", Word, Data);
+  PrintAndLog("Writing word %d with data %08X", Word, Data);
   
   c.cmd = CMD_EM4X_WRITE_WORD;
   c.d.asBytes[0] = 0x0; //Normal mode
@@ -628,7 +626,7 @@ int CmdWriteWord(const char *Cmd)
 
 int CmdWriteWordPWD(const char *Cmd)
 {
-  int Word = 8; //default to invalid word
+  int Word = 16; //default to invalid word
   int Data = 0xFFFFFFFF; //default to blank data
   int Password = 0xFFFFFFFF; //default to blank password
   UsbCommand c;
@@ -640,7 +638,7 @@ int CmdWriteWordPWD(const char *Cmd)
     return 1;
   }
   
-  PrintAndLog("Writting word %d with data %08X and password %08X", Word, Data, Password);
+  PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
   
   c.cmd = CMD_EM4X_WRITE_WORD;
   c.d.asBytes[0] = 0x1; //Password mode
@@ -654,8 +652,10 @@ int CmdWriteWordPWD(const char *Cmd)
 static command_t CommandTable[] =
 {
   {"help", CmdHelp, 1, "This help"},
+  {"410xdemod", CmdEMdemodASK, 0, "[clock rate] -- Extract ID from EM410x tag"},    
   {"410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
   {"410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
+  {"replay",  MWRem4xReplay, 0, "Watches for tag and simulates manchester encoded em4x tag"},
   {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
   {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
   {"410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
@@ -667,6 +667,265 @@ static command_t CommandTable[] =
   {NULL, NULL, 0, NULL}
 };
 
+
+//Confirms the parity of a bitstream as well as obtaining the data (TagID) from within the appropriate memory space.
+//Arguments:
+// Pointer to a string containing the desired bitsream
+// Pointer to a string that will receive the decoded tag ID
+// Length of the bitsream pointed at in the first argument, char* _strBitStream
+//Retuns:
+//1 Parity confirmed
+//0 Parity not confirmed
+int ConfirmEm410xTagParity( char* _strBitStream, char* pID, int LengthOfBitstream )
+{
+	int i = 0;
+	int rows = 0;
+	int Parity[4] = {0x00};
+	char ID[11] = {0x00};
+	int k = 0;
+	int BitStream[70] = {0x00};
+	int counter = 0;
+	//prepare variables
+	for ( i = 0; i <= LengthOfBitstream; i++)
+	{
+		if (_strBitStream[i] == '1')
+		{
+			k =1;
+			memcpy(&BitStream[i], &k,4);
+		}
+		else if (_strBitStream[i] == '0')
+		{
+			k = 0;
+			memcpy(&BitStream[i], &k,4);
+		}
+	}
+	while ( counter < 2 )
+	{
+		//set/reset variables and counters
+		memset(ID,0x00,sizeof(ID));
+		memset(Parity,0x00,sizeof(Parity));
+		rows = 0;
+		for ( i = 9; i <= LengthOfBitstream; i++)
+		{
+			if ( rows < 10 )
+			{
+				if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
+				{
+					sprintf(ID+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
+					rows++;
+					/* Keep parity info and move four bits ahead*/
+					Parity[0] ^= BitStream[i];
+					Parity[1] ^= BitStream[i+1];
+					Parity[2] ^= BitStream[i+2];
+					Parity[3] ^= BitStream[i+3];
+					i += 4;
+				}
+			}
+			if ( rows == 10 )
+			{
+				if (	BitStream[i] == Parity[0] && BitStream[i+1] == Parity[1] &&
+					BitStream[i+2] == Parity[2] && BitStream[i+3] == Parity[3] &&
+					BitStream[i+4] == 0)
+				{
+					memcpy(pID,ID,strlen(ID));
+					return 1;
+				}
+			}
+		}
+		printf("[PARITY ->]Failed. Flipping Bits, and rechecking parity for bitstream:\n[PARITY ->]");  
+		for (k = 0; k < LengthOfBitstream; k++)
+		{
+			BitStream[k] ^= 1;
+			printf("%i", BitStream[k]);
+		}
+		puts(" ");
+		counter++;
+	}
+	return 0;
+}
+//Reads and demodulates an em410x RFID tag. It further allows slight modification to the decoded bitstream
+//Once a suitable bitstream has been identified, and if needed, modified, it is replayed. Allowing emulation of the
+//"stolen" rfid tag.
+//No meaningful returns or arguments.
+int MWRem4xReplay(const char* Cmd)
+{
+	// //header traces
+	// static char ArrayTraceZero[] = { '0','0','0','0','0','0','0','0','0' };
+	// static char ArrayTraceOne[] =  { '1','1','1','1','1','1','1','1','1' };
+	// //local string variables
+	// char strClockRate[10] = {0x00};
+	// char strAnswer[4] = {0x00};
+	// char strTempBufferMini[2] = {0x00}; 
+	// //our outbound bit-stream
+	// char strSimulateBitStream[65] = {0x00};
+	// //integers
+	// int iClockRate = 0;
+	// int needle = 0;
+	// int j = 0;
+	// int iFirstHeaderOffset = 0x00000000;
+	// int numManchesterDemodBits=0;
+	// //boolean values
+	// bool bInverted = false;
+	// //pointers to strings. memory will be allocated.
+	// char* pstrInvertBitStream = 0x00000000;
+	// char* pTempBuffer = 0x00000000;
+	// char* pID = 0x00000000;
+	// char* strBitStreamBuffer = 0x00000000;
+		
+
+	// puts("###################################");
+	// puts("#### Em4x Replay                 ##");
+	// puts("#### R.A.M.           June 2013  ##");
+	// puts("###################################");
+	// //initialize
+	// CmdLFRead("");
+	// //Collect ourselves 10,000 samples
+	// CmdSamples("10000");
+	// puts("[->]preforming ASK demodulation\n");
+	// //demodulate ask
+	// Cmdaskdemod("0");
+	// iClockRate = DetectClock(0);
+	// sprintf(strClockRate, "%i\n",iClockRate);
+	// printf("[->]Detected ClockRate: %s\n", strClockRate);
+	
+	// //If detected clock rate is something completely unreasonable, dont go ahead
+	// if ( iClockRate < 0xFFFE )
+	// {  
+	    // pTempBuffer = (char*)malloc(MAX_GRAPH_TRACE_LEN);
+	    // if (pTempBuffer == 0x00000000)
+	      // return 0;
+	    // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
+	    // //Preform manchester de-modulation and display in a single line.
+	    // numManchesterDemodBits = CmdManchesterDemod( strClockRate ); 
+	    // //note: numManchesterDemodBits is set above in CmdManchesterDemod()
+	    // if ( numManchesterDemodBits == 0 )
+	      // return 0;
+	    // strBitStreamBuffer = malloc(numManchesterDemodBits+1);
+	    // if ( strBitStreamBuffer == 0x00000000 )
+		// return 0;
+	    // memset(strBitStreamBuffer, 0x00, (numManchesterDemodBits+1));
+	    // //fill strBitStreamBuffer with demodulated, string formatted bits.
+	    // for ( j = 0; j <= numManchesterDemodBits; j++ )
+	    // {
+		// sprintf(strTempBufferMini, "%i",BitStream[j]);
+		// strcat(strBitStreamBuffer,strTempBufferMini);
+	    // }
+	    // printf("[->]Demodulated Bitstream: \n%s\n", strBitStreamBuffer);
+	    // //Reset counter and select most probable bit stream
+	    // j = 0;
+		// while ( j < numManchesterDemodBits )
+		// {
+		    // memset(strSimulateBitStream,0x00,64);
+		    // //search for header of nine (9) 0's : 000000000 or nine (9) 1's : 1111 1111 1
+			// if ( ( strncmp(strBitStreamBuffer+j, ArrayTraceZero, sizeof(ArrayTraceZero)) == 0 ) ||
+			    // ( strncmp(strBitStreamBuffer+j, ArrayTraceOne, sizeof(ArrayTraceOne)) == 0  ) )
+			// {
+				// iFirstHeaderOffset = j;
+			    // memcpy(strSimulateBitStream, strBitStreamBuffer+j,64);
+			    // printf("[->]Offset of Header");
+				// if ( strncmp(strBitStreamBuffer+iFirstHeaderOffset, "0", 1) == 0 )
+					// printf("'%s'", ArrayTraceZero );
+				// else
+					// printf("'%s'", ArrayTraceOne );
+				// printf(": %i\nHighlighted string : %s\n",iFirstHeaderOffset,strSimulateBitStream);
+			    // //allow us to escape loop or choose another frame
+			    // puts("[<-]Are we happy with this sample? [Y]es/[N]o");
+			    // gets(strAnswer);
+			    // if ( ( strncmp(strAnswer,"y",1) == 0 )  || ( strncmp(strAnswer,"Y",1) == 0 ) )
+			    // {
+				    // j = numManchesterDemodBits+1;
+				    // break;
+			    // }
+			// }
+			// j++;
+		// }
+	// }
+	// else return 0;
+	
+	// //Do we want the buffer inverted?
+	// memset(strAnswer, 0x00, sizeof(strAnswer));
+	// printf("[<-]Do you wish to invert the highlighted bitstream? [Y]es/[N]o\n");
+	// gets(strAnswer);
+	// if ( ( strncmp("y", strAnswer,1) == 0 )  || ( strncmp("Y", strAnswer, 1 ) == 0 ) )
+	// {
+		// //allocate heap memory
+		// pstrInvertBitStream = (char*)malloc(numManchesterDemodBits);
+		// if ( pstrInvertBitStream != 0x00000000 )
+		// {
+			// memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
+			// bInverted = true;
+			// //Invert Bitstream
+			// for ( needle = 0; needle <= numManchesterDemodBits; needle++ )
+			// {
+				// if (strSimulateBitStream[needle] == '0')
+					// strcat(pstrInvertBitStream,"1");
+				// else if (strSimulateBitStream[needle] == '1')
+					// strcat(pstrInvertBitStream,"0");
+			// }
+			// printf("[->]Inverted bitstream: %s\n", pstrInvertBitStream);
+		// }
+	// }    
+    // //Confirm parity of selected string
+	// pID = (char*)malloc(11);
+	// if (pID != 0x00000000)
+	// {
+		// memset(pID, 0x00, 11);
+		// if (ConfirmEm410xTagParity(strSimulateBitStream,pID, 64) == 1)
+		// {
+			// printf("[->]Parity confirmed for selected bitstream!\n");
+			// printf("[->]Tag ID was detected as: [hex]:%s\n",pID );
+		// }
+		// else
+			// printf("[->]Parity check failed for the selected bitstream!\n");	
+	// }
+	
+	// //Spoof
+	// memset(strAnswer, 0x00, sizeof(strAnswer));  
+	// printf("[<-]Do you wish to continue with the EM4x simulation? [Y]es/[N]o\n");
+	// gets(strAnswer);
+	// if ( ( strncmp(strAnswer,"y",1) == 0 )  || ( strncmp(strAnswer,"Y",1) == 0 ) )
+	// {
+		// strcat(pTempBuffer, strClockRate);
+		// strcat(pTempBuffer, " ");
+		// if (bInverted == true)
+			// strcat(pTempBuffer,pstrInvertBitStream);
+		// if (bInverted == false)
+			// strcat(pTempBuffer,strSimulateBitStream);
+		// //inform the user
+		// puts("[->]Starting simulation now: \n");
+		// //Simulate tag with prepared buffer.
+		// CmdLFSimManchester(pTempBuffer);
+	// }
+	// else if ( ( strcmp("n", strAnswer) == 0 )  || ( strcmp("N", strAnswer ) == 0 ) )
+		// printf("[->]Exiting procedure now...\n");
+	// else
+		// printf("[->]Erroneous selection\nExiting procedure now....\n");
+	
+	// //Clean up -- Exit function
+	// //clear memory, then release pointer.
+	// if ( pstrInvertBitStream != 0x00000000 )
+	// {
+	    // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
+	    // free(pstrInvertBitStream);
+	// }
+	// if ( pTempBuffer != 0x00000000 )
+	// {
+	    // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
+	    // free(pTempBuffer);
+	// }
+	// if ( pID != 0x00000000 )
+	// {
+	    // memset(pID,0x00,11);
+	    // free(pID);
+	// }
+	// if ( strBitStreamBuffer != 0x00000000 )
+	// {
+	    // memset(strBitStreamBuffer,0x00,numManchesterDemodBits);
+	    // free(strBitStreamBuffer);
+	// }
+	return 0;
+}
+
 int CmdLFEM4X(const char *Cmd)
 {
   CmdsParse(CommandTable, Cmd);