X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/736aea60368061c5f9d3de92465d0a4f5672217f..a5d5146c4892355b04201fcd17674b5f20d6adae:/winsrc/command.cpp?ds=inline

diff --git a/winsrc/command.cpp b/winsrc/command.cpp
index 405405de..08feb3dd 100644
--- a/winsrc/command.cpp
+++ b/winsrc/command.cpp
@@ -12,6 +12,7 @@
 
 #include "prox.h"
 #include "../common/iso14443_crc.c"
+#include "../common/crc16.c"
 
 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
 #define BIT(x) GraphBuffer[x * clock]
@@ -256,6 +257,150 @@ static void CmdEM410xwatch(char *str)
 	} while (go);
 }
 
+/* Read the transmitted data of an EM4x50 tag
+ * Format:
+ *
+ *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
+ *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
+ *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
+ *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
+ *  CCCCCCCC                         <- column parity bits
+ *  0                                <- stop bit
+ *  LW                               <- Listen Window
+ *
+ * This pattern repeats for every block of data being transmitted.
+ * Transmission starts with two Listen Windows (LW - a modulated
+ * pattern of 320 cycles each (32/32/128/64/64)).
+ *
+ * Note that this data may or may not be the UID. It is whatever data
+ * is stored in the blocks defined in the control word First and Last
+ * Word Read values. UID is stored in block 32.
+ */
+static void CmdEM4x50read(char *str)
+{
+	int i, j, startblock, clock, skip, block, start, end, low, high;
+	BOOL complete= FALSE;
+	int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
+	char tmp[6];
+
+	high= low= 0;
+	clock= 64;
+
+	/* first get high and low values */
+	for (i = 0; i < GraphTraceLen; i++)
+	{
+		if (GraphBuffer[i] > high)
+			high = GraphBuffer[i];
+		else if (GraphBuffer[i] < low)
+			low = GraphBuffer[i];
+	}
+
+	/* populate a buffer with pulse lengths */
+	i= 0;
+	j= 0;
+	while(i < GraphTraceLen)
+		{
+		// measure from low to low
+		while((GraphBuffer[i] > low) && (i<GraphTraceLen))
+			++i;
+		start= i;
+		while((GraphBuffer[i] < high) && (i<GraphTraceLen))
+			++i;
+		while((GraphBuffer[i] > low) && (i<GraphTraceLen))
+			++i;
+		if (j>(MAX_GRAPH_TRACE_LEN/64)) {
+			break;
+		}
+		tmpbuff[j++]= i - start;
+		}
+
+	/* look for data start - should be 2 pairs of LW (pulses of 192,128) */
+	start= -1;
+	skip= 0;
+	for (i= 0; i < j - 4 ; ++i)
+		{
+		skip += tmpbuff[i];
+		if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
+			if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
+				if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
+					if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
+						{
+						start= i + 3;
+						break;
+						}
+		}
+	startblock= i + 3;
+
+	/* skip over the remainder of the LW */
+	skip += tmpbuff[i+1]+tmpbuff[i+2];
+	while(skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
+		++skip;
+	skip += 8;
+
+	/* now do it again to find the end */
+	end= start;
+	for (i += 3; i < j - 4 ; ++i)
+		{
+		end += tmpbuff[i];
+		if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
+			if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
+				if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
+					if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
+						{
+						complete= TRUE;
+						break;
+						}
+		}
+
+	if (start >= 0)
+		PrintToScrollback("Found data at sample: %i",skip);
+	else
+		{
+		PrintToScrollback("No data found!");
+		PrintToScrollback("Try again with more samples.");
+		return;
+		}
+
+	if (!complete)
+		{
+		PrintToScrollback("*** Warning!");
+		PrintToScrollback("Partial data - no end found!");
+		PrintToScrollback("Try again with more samples.");
+		}
+
+	/* get rid of leading crap */
+	sprintf(tmp,"%i",skip);
+	CmdLtrim(tmp);
+
+	/* now work through remaining buffer printing out data blocks */
+	block= 0;
+	i= startblock;
+	while(block < 6)
+		{
+		PrintToScrollback("Block %i:", block);
+		// mandemod routine needs to be split so we can call it for data
+		// just print for now for debugging
+		Cmdmanchesterdemod("i 64");
+		skip= 0;
+		/* look for LW before start of next block */
+		for ( ; i < j - 4 ; ++i)
+			{
+			skip += tmpbuff[i];
+			if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
+				if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
+					break;
+			}
+		while(GraphBuffer[skip] > low)
+			++skip;
+		skip += 8;
+		sprintf(tmp,"%i",skip);
+		CmdLtrim(tmp);
+		start += skip;
+		block++;
+		}
+}
+
+
 /* Read the ID of an EM410x tag.
  * Format:
  *   1111 1111 1           <-- standard non-repeatable header
@@ -315,14 +460,14 @@ static void CmdEM410xread(char *str)
 			if (hithigh && hitlow)
 				break;
 		}
-		
+
 		/* If we didn't hit both high and low peaks, we had a bit transition */
 		if (!hithigh || !hitlow)
 			bit ^= 1;
-		
+
 		BitStream[bit2idx++] = bit;
 	}
-	
+
 retest:
 	/* We go till 5 before the graph ends because we'll get that far below */
 	for (i = 1; i < bit2idx - 5; i++)
@@ -397,7 +542,7 @@ retest:
 				header = 0;
 		}
 	}
-	
+
 	/* if we've already retested after flipping bits, return */
 	if (retested++)
 		return;
@@ -497,7 +642,6 @@ static void ChkBitstream(char *str)
 static void CmdLosim(char *str)
 {
 	int i;
-	char *zero = "0";
 
 	/* convert to bitstream if necessary */
 	ChkBitstream(str);
@@ -535,18 +679,34 @@ static void CmdLoread(char *str)
 	SendCommand(&c, FALSE);
 }
 
+static void CmdDetectReader(char *str)
+{
+	UsbCommand c;
+	// 'l' means LF - 125/134 kHz
+	if(*str == 'l') {
+		c.ext1 = 1;
+	} else if (*str == 'h') {
+		c.ext1 = 2;
+	} else if (*str != '\0') {
+		PrintToScrollback("use 'detectreader' or 'detectreader l' or 'detectreader h'");
+		return;
+	}
+	c.cmd = CMD_LISTEN_READER_FIELD;
+	 SendCommand(&c, FALSE);
+}
+
 /* send a command before reading */
 static void CmdLoCommandRead(char *str)
 {
 	static char dummy[3];
 
 	dummy[0]= ' ';
-	
+
 	UsbCommand c;
 	c.cmd = CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K;
-	sscanf(str, "%i %i %i %s %s", &c.ext1, &c.ext2, &c.ext3, &c.d.asBytes,&dummy+1);
+	sscanf(str, "%i %i %i %s %s", &c.ext1, &c.ext2, &c.ext3, (char *) &c.d.asBytes,(char *) &dummy+1);
 	// in case they specified 'h'
-	strcpy(&c.d.asBytes + strlen(c.d.asBytes),dummy);
+	strcpy((char *)&c.d.asBytes + strlen((char *)c.d.asBytes), dummy);
 	SendCommand(&c, FALSE);
 }
 
@@ -638,7 +798,6 @@ static void CmdHisamples(char *str)
 	RepaintGraphWindow();
 }
 
-
 static int CmdHisamplest(char *str, int nrlow)
 {
 	int cnt = 0;
@@ -1238,44 +1397,150 @@ static void CmdHi15demod(char *str)
 	PrintToScrollback("CRC=%04x", Iso15693Crc(outBuf, k-2));
 }
 
-static void CmdTiread(char *str)
+static void CmdFSKdemod(char *cmdline)
 {
-	UsbCommand c;
-	c.cmd = CMD_ACQUIRE_RAW_BITS_TI_TYPE;
-	SendCommand(&c, FALSE);
-}
+	static const int LowTone[]  = {
+		1,  1,  1,  1,  1, -1, -1, -1, -1, -1,
+		1,  1,  1,  1,  1, -1, -1, -1, -1, -1,
+		1,  1,  1,  1,  1, -1, -1, -1, -1, -1,
+		1,  1,  1,  1,  1, -1, -1, -1, -1, -1,
+		1,  1,  1,  1,  1, -1, -1, -1, -1, -1
+	};
+	static const int HighTone[] = {
+		1,  1,  1,  1,  1,     -1, -1, -1, -1,
+		1,  1,  1,  1,         -1, -1, -1, -1,
+		1,  1,  1,  1,         -1, -1, -1, -1,
+		1,  1,  1,  1,         -1, -1, -1, -1,
+		1,  1,  1,  1,         -1, -1, -1, -1,
+		1,  1,  1,  1,     -1, -1, -1, -1, -1,
+	};
 
-static void CmdTibits(char *str)
-{
-	int cnt = 0;
-	int i;
-	for(i = 0; i < 1536; i += 12) {
-		UsbCommand c;
-		c.cmd = CMD_DOWNLOAD_RAW_BITS_TI_TYPE;
-		c.ext1 = i;
-		SendCommand(&c, FALSE);
-		ReceiveCommand(&c);
-		if(c.cmd != CMD_DOWNLOADED_RAW_BITS_TI_TYPE) {
-			PrintToScrollback("bad resp");
-			return;
+	int lowLen = sizeof(LowTone)/sizeof(int);
+	int highLen = sizeof(HighTone)/sizeof(int);
+	int convLen = (highLen>lowLen)?highLen:lowLen;
+	DWORD hi = 0, lo = 0;
+
+	int i, j;
+	int minMark=0, maxMark=0;
+
+	for(i = 0; i < GraphTraceLen - convLen; i++) {
+		int lowSum = 0, highSum = 0;
+
+		for(j = 0; j < lowLen; j++) {
+			lowSum += LowTone[j]*GraphBuffer[i+j];
 		}
+		for(j = 0; j < highLen; j++) {
+			highSum += HighTone[j]*GraphBuffer[i+j];
+		}
+		lowSum = abs((100*lowSum) / lowLen);
+		highSum = abs((100*highSum) / highLen);
+		GraphBuffer[i] = (highSum << 16) | lowSum;
+	}
+
+	for(i = 0; i < GraphTraceLen - convLen - 16; i++) {
 		int j;
-		for(j = 0; j < 12; j++) {
-			int k;
-			for(k = 31; k >= 0; k--) {
-				if(c.d.asDwords[j] & (1 << k)) {
-					GraphBuffer[cnt++] = 1;
-				} else {
-					GraphBuffer[cnt++] = -1;
-				}
-			}
+		int lowTot = 0, highTot = 0;
+		// 10 and 8 are f_s divided by f_l and f_h, rounded
+		for(j = 0; j < 10; j++) {
+			lowTot += (GraphBuffer[i+j] & 0xffff);
 		}
+		for(j = 0; j < 8; j++) {
+			highTot += (GraphBuffer[i+j] >> 16);
+		}
+		GraphBuffer[i] = lowTot - highTot;
+		if (GraphBuffer[i]>maxMark) maxMark=GraphBuffer[i];
+		if (GraphBuffer[i]<minMark) minMark=GraphBuffer[i];
 	}
-	GraphTraceLen = 1536*32;
+
+	GraphTraceLen -= (convLen + 16);
+
 	RepaintGraphWindow();
+
+	// Find bit-sync (3 lo followed by 3 high)
+	int max = 0, maxPos = 0;
+	for(i = 0; i < 6000; i++) {
+		int dec = 0;
+		for(j = 0; j < 3*lowLen; j++) {
+			dec -= GraphBuffer[i+j];
+		}
+		for(; j < 3*(lowLen + highLen ); j++) {
+			dec += GraphBuffer[i+j];
+		}
+		if(dec > max) {
+			max = dec;
+			maxPos = i;
+		}
+	}
+
+	// place start of bit sync marker in graph
+	GraphBuffer[maxPos] = maxMark;
+	GraphBuffer[maxPos+1] = minMark;
+
+	maxPos += j;
+
+	// place end of bit sync marker in graph
+	GraphBuffer[maxPos] = maxMark;
+	GraphBuffer[maxPos+1] = minMark;
+
+	PrintToScrollback("actual data bits start at sample %d", maxPos);
+	PrintToScrollback("length %d/%d", highLen, lowLen);
+
+	BYTE bits[46];
+	bits[sizeof(bits)-1] = '\0';
+
+	// find bit pairs and manchester decode them
+	for(i = 0; i < arraylen(bits)-1; i++) {
+		int dec = 0;
+		for(j = 0; j < lowLen; j++) {
+			dec -= GraphBuffer[maxPos+j];
+		}
+		for(; j < lowLen + highLen; j++) {
+			dec += GraphBuffer[maxPos+j];
+		}
+		maxPos += j;
+		// place inter bit marker in graph
+		GraphBuffer[maxPos] = maxMark;
+		GraphBuffer[maxPos+1] = minMark;
+
+		// hi and lo form a 64 bit pair
+		hi = (hi<<1)|(lo>>31);
+		lo = (lo<<1);
+		// store decoded bit as binary (in hi/lo) and text (in bits[])
+		if(dec<0) {
+			bits[i] = '1';
+			lo|=1;
+		} else {
+			bits[i] = '0';
+		}
+	}
+	PrintToScrollback("bits: '%s'", bits);
+	PrintToScrollback("hex: %08x %08x", hi, lo);
+}
+
+// read a TI tag and return its ID
+static void CmdTIRead(char *str)
+{
+	UsbCommand c;
+	c.cmd = CMD_READ_TI_TYPE;
+	SendCommand(&c, FALSE);
+}
+
+// write new data to a r/w TI tag
+static void CmdTIWrite(char *str)
+{
+	UsbCommand c;
+	int res=0;
+
+	c.cmd = CMD_WRITE_TI_TYPE;
+	res = sscanf(str, "0x%x 0x%x 0x%x ", &c.ext1, &c.ext2, &c.ext3);
+	if (res == 2) c.ext3=0;
+	if (res<2)
+		PrintToScrollback("Please specify the data as two hex strings, optionally the CRC as a third");
+	else
+		SendCommand(&c, FALSE);
 }
 
-static void CmdTidemod(char *cmdline)
+static void CmdTIDemod(char *cmdline)
 {
 	/* MATLAB as follows:
 f_s = 2000000;  % sampling frequency
@@ -1291,46 +1556,57 @@ h = 2*pi*ones(1, floor(f_s*T_h))*(f_h/f_s);
 l = sign(sin(cumsum(l)));
 h = sign(sin(cumsum(h)));
 	*/
-	static const int LowTone[] = {
-		1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1,
-		1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1,
-		1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1,
-		-1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1,
-		-1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1,
-		-1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1,
-		1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1,
-		1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1,
-		1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1,
-		-1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1,
-		-1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1,
-		-1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1,
-		1, 1, 1, 1, 1, 1, 1, -1, -1, -1,
-	};
-	static const int HighTone[] = {
-		1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1,
-		1, 1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1,
-		-1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1,
-		-1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, 1, 1,
-		1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1,
-		1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, -1, -1,
-		-1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1,
-		-1, -1, -1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1,
-		1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1,
-		1, 1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1,
-		-1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1,
-		-1, -1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, 1, 1,
-		1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1,
-		1, -1, -1, -1, -1, -1, -1, -1, -1, 1, 1, 1, 1, 1, 1, 1,
-	};
 
-	int convLen = max(arraylen(HighTone), arraylen(LowTone));
+// 2M*16/134.2k = 238
+ static const int LowTone[] = {
+	1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		 -1, -1
+ };
+// 2M*16/123.2k = 260
+ static const int HighTone[] = {
+	1, 1, 1, 1, 1, 1, 1, 1,		-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1,		-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1,			-1, -1, -1, -1, -1, -1, -1,
+	1, 1, 1, 1, 1, 1, 1, 1
+ };
+	int lowLen = sizeof(LowTone)/sizeof(int);
+	int highLen = sizeof(HighTone)/sizeof(int);
+	int convLen = (highLen>lowLen)?highLen:lowLen;
+	WORD crc;
+	int i, j, TagType;
+	int lowSum = 0, highSum = 0;;
+	int lowTot = 0, highTot = 0;
 
-	int i;
 	for(i = 0; i < GraphTraceLen - convLen; i++) {
-		int j;
-		int lowSum = 0, highSum = 0;;
-		int lowLen = arraylen(LowTone);
-		int highLen = arraylen(HighTone);
+		lowSum = 0;
+		highSum = 0;;
 
 		for(j = 0; j < lowLen; j++) {
 			lowSum += LowTone[j]*GraphBuffer[i+j];
@@ -1340,12 +1616,15 @@ h = sign(sin(cumsum(h)));
 		}
 		lowSum = abs((100*lowSum) / lowLen);
 		highSum = abs((100*highSum) / highLen);
+		lowSum = (lowSum<0)?-lowSum:lowSum;
+		highSum = (highSum<0)?-highSum:highSum;
+
 		GraphBuffer[i] = (highSum << 16) | lowSum;
 	}
 
 	for(i = 0; i < GraphTraceLen - convLen - 16; i++) {
-		int j;
-		int lowTot = 0, highTot = 0;
+		lowTot = 0;
+		highTot = 0;
 		// 16 and 15 are f_s divided by f_l and f_h, rounded
 		for(j = 0; j < 16; j++) {
 			lowTot += (GraphBuffer[i+j] & 0xffff);
@@ -1360,17 +1639,29 @@ h = sign(sin(cumsum(h)));
 
 	RepaintGraphWindow();
 
-	// Okay, so now we have unsliced soft decisions; find bit-sync, and then
-	// get some bits.
+	// TI tag data format is 16 prebits, 8 start bits, 64 data bits,
+	// 16 crc CCITT bits, 8 stop bits, 15 end bits
 
+	// the 16 prebits are always low
+	// the 8 start and stop bits of a tag must match
+	// the start/stop prebits of a ro tag are 01111110
+	// the start/stop prebits of a rw tag are 11111110
+  // the 15 end bits of a ro tag are all low
+  // the 15 end bits of a rw tag match bits 15-1 of the data bits
+
+	// Okay, so now we have unsliced soft decisions;
+	// find bit-sync, and then get some bits.
+	// look for 17 low bits followed by 6 highs (common pattern for ro and rw tags)
 	int max = 0, maxPos = 0;
 	for(i = 0; i < 6000; i++) {
 		int j;
 		int dec = 0;
-		for(j = 0; j < 8*arraylen(LowTone); j++) {
+		// searching 17 consecutive lows
+		for(j = 0; j < 17*lowLen; j++) {
 			dec -= GraphBuffer[i+j];
 		}
-		for(; j < 8*arraylen(LowTone) + 8*arraylen(HighTone); j++) {
+		// searching 7 consecutive highs
+		for(; j < 17*lowLen + 6*highLen; j++) {
 			dec += GraphBuffer[i+j];
 		}
 		if(dec > max) {
@@ -1378,61 +1669,113 @@ h = sign(sin(cumsum(h)));
 			maxPos = i;
 		}
 	}
-	GraphBuffer[maxPos] = 800;
-	GraphBuffer[maxPos+1] = -800;
 
-	maxPos += 8*arraylen(LowTone);
+	// place a marker in the buffer to visually aid location
+	// of the start of sync
 	GraphBuffer[maxPos] = 800;
 	GraphBuffer[maxPos+1] = -800;
-	maxPos += 8*arraylen(HighTone);
 
+	// advance pointer to start of actual data stream (after 16 pre and 8 start bits)
+	maxPos += 17*lowLen;
+	maxPos += 6*highLen;
+
+	// place a marker in the buffer to visually aid location
+	// of the end of sync
 	GraphBuffer[maxPos] = 800;
 	GraphBuffer[maxPos+1] = -800;
 
 	PrintToScrollback("actual data bits start at sample %d", maxPos);
 
-	PrintToScrollback("length %d/%d", arraylen(HighTone), arraylen(LowTone));
-
-	GraphBuffer[maxPos] = 800;
-	GraphBuffer[maxPos+1] = -800;
+	PrintToScrollback("length %d/%d", highLen, lowLen);
 
-	BYTE bits[64+16+8+1];
+	BYTE bits[1+64+16+8+16];
 	bits[sizeof(bits)-1] = '\0';
 
-	for(i = 0; i < arraylen(bits); i++) {
+	DWORD shift3 = 0x7e000000, shift2 = 0, shift1 = 0, shift0 = 0;
+
+	for(i = 0; i < arraylen(bits)-1; i++) {
 		int high = 0;
 		int low = 0;
 		int j;
-		for(j = 0; j < arraylen(LowTone); j++) {
+		for(j = 0; j < lowLen; j++) {
 			low -= GraphBuffer[maxPos+j];
 		}
-		for(j = 0; j < arraylen(HighTone); j++) {
+		for(j = 0; j < highLen; j++) {
 			high += GraphBuffer[maxPos+j];
 		}
+
 		if(high > low) {
 			bits[i] = '1';
-			maxPos += arraylen(HighTone);
+			maxPos += highLen;
+			// bitstream arrives lsb first so shift right
+			shift3 |= (1<<31);
 		} else {
 			bits[i] = '.';
-			maxPos += arraylen(LowTone);
+			maxPos += lowLen;
 		}
+
+		// 128 bit right shift register
+	  shift0 = (shift0>>1) | (shift1 << 31);
+	  shift1 = (shift1>>1) | (shift2 << 31);
+	  shift2 = (shift2>>1) | (shift3 << 31);
+	  shift3 >>= 1;
+
+		// place a marker in the buffer between bits to visually aid location
 		GraphBuffer[maxPos] = 800;
 		GraphBuffer[maxPos+1] = -800;
 	}
-	PrintToScrollback("bits: '%s'", bits);
+	PrintToScrollback("Info: raw tag bits = %s", bits);
 
-	DWORD h = 0, l = 0;
-	for(i = 0; i < 32; i++) {
-		if(bits[i] == '1') {
-			l |= (1<<i);
-		}
+	TagType = (shift3>>8)&0xff;
+	if ( TagType != ((shift0>>16)&0xff) ) {
+		PrintToScrollback("Error: start and stop bits do not match!");
+		return;
 	}
-	for(i = 32; i < 64; i++) {
-		if(bits[i] == '1') {
-			h |= (1<<(i-32));
+	else if (TagType == 0x7e) {
+		PrintToScrollback("Info: Readonly TI tag detected.");
+		return;
+	}
+	else if (TagType == 0xfe) {
+		PrintToScrollback("Info: Rewriteable TI tag detected.");
+
+	  // put 64 bit data into shift1 and shift0
+	  shift0 = (shift0>>24) | (shift1 << 8);
+	  shift1 = (shift1>>24) | (shift2 << 8);
+
+		// align 16 bit crc into lower half of shift2
+	  shift2 = ((shift2>>24) | (shift3 << 8)) & 0x0ffff;
+
+		// align 16 bit "end bits" or "ident" into lower half of shift3
+	  shift3 >>= 16;
+
+		// only 15 bits compare, last bit of ident is not valid
+		if ( (shift3^shift0)&0x7fff ) {
+			PrintToScrollback("Error: Ident mismatch!");
+		}
+		// WARNING the order of the bytes in which we calc crc below needs checking
+		// i'm 99% sure the crc algorithm is correct, but it may need to eat the
+		// bytes in reverse or something
+		// calculate CRC
+		crc=0;
+	 	crc = update_crc16(crc, (shift0)&0xff);
+		crc = update_crc16(crc, (shift0>>8)&0xff);
+		crc = update_crc16(crc, (shift0>>16)&0xff);
+		crc = update_crc16(crc, (shift0>>24)&0xff);
+		crc = update_crc16(crc, (shift1)&0xff);
+		crc = update_crc16(crc, (shift1>>8)&0xff);
+		crc = update_crc16(crc, (shift1>>16)&0xff);
+		crc = update_crc16(crc, (shift1>>24)&0xff);
+		PrintToScrollback("Info: Tag data = %08X%08X", shift1, shift0);
+		if (crc != (shift2&0xffff)) {
+			PrintToScrollback("Error: CRC mismatch, calculated %04X, got ^04X", crc, shift2&0xffff);
+		} else {
+			PrintToScrollback("Info: CRC %04X is good", crc);
 		}
 	}
-	PrintToScrollback("hex: %08x %08x", h, l);
+	else {
+		PrintToScrollback("Unknown tag type.");
+		return;
+	}
 }
 
 static void CmdNorm(char *str)
@@ -1510,6 +1853,20 @@ static void CmdZerocrossings(char *str)
 	RepaintGraphWindow();
 }
 
+static void CmdThreshold(char *str)
+{
+	int i;
+	int threshold = atoi(str);
+
+	for(i = 0; i < GraphTraceLen; i++) {
+		if(GraphBuffer[i]>= threshold)
+			GraphBuffer[i]=1;
+		else
+			GraphBuffer[i]=-1;
+	}
+	RepaintGraphWindow();
+}
+
 static void CmdLtrim(char *str)
 {
 	int i;
@@ -1869,8 +2226,7 @@ static void CmdFlexdemod(char *str)
 
 static void Cmdaskdemod(char *str) {
 	int i;
-	int n = 0;
-	int c,high,low = 0;
+	int c, high = 0, low = 0;
 
 	// TODO: complain if we do not give 2 arguments here !
 	sscanf(str, "%i", &c);
@@ -2241,7 +2597,7 @@ static void Cmdmanchesterdemod(char *str) {
 					return;
 				}
 			}
-		}	
+		}
 	}
 
 	PrintToScrollback("Manchester decoded bitstream");
@@ -2267,8 +2623,6 @@ static void Cmdmanchesterdemod(char *str) {
 	}
 }
 
-
-
 /*
  * Usage ???
  */
@@ -2296,6 +2650,12 @@ static void CmdPlot(char *str)
 	ShowGraphWindow();
 }
 
+static void CmdGrid(char *str)
+{
+  	sscanf(str, "%i %i", &PlotGridX, &PlotGridY);
+	RepaintGraphWindow();
+}
+
 static void CmdHide(char *str)
 {
 	HideGraphWindow();
@@ -2364,6 +2724,14 @@ static void CmdHIDsimTAG(char *str)
 	SendCommand(&c, FALSE);
 }
 
+static void CmdReadmem(char *str)
+{
+	UsbCommand c;
+	c.cmd = CMD_READ_MEM;
+	c.ext1 = atoi(str);
+	SendCommand(&c, FALSE);
+}
+
 static void CmdLcdReset(char *str)
 {
 	UsbCommand c;
@@ -2384,12 +2752,6 @@ static void CmdLcd(char *str)
 	}
 }
 
-
-
-static void CmdTest(char *str)
-{
-}
-
 /*
  * Sets the divisor for LF frequency clock: lets the user choose any LF frequency below
  * 600kHz.
@@ -2407,14 +2769,6 @@ static void CmdSetDivisor(char *str)
 	}
 }
 
-static void CmdSweepLF(char *str)
-{
-	UsbCommand c;
-	c.cmd = CMD_SWEEP_LF;
-	SendCommand(&c, FALSE);
-}
-
-
 typedef void HandlerFunction(char *cmdline);
 
 /* in alphabetic order */
@@ -2424,70 +2778,85 @@ static struct {
 	int		offline;  // 1 if the command can be used when in offline mode
 	char		*docString;
 } CommandTable[] = {
-	"askdemod",			Cmdaskdemod,1,		"<samples per bit> <0|1> -- Attempt to demodulate simple ASK tags",
-	"autocorr",			CmdAutoCorr,1,		"<window length> -- Autocorrelation over window",
-	"bitsamples",		CmdBitsamples,0,	"    Get raw samples as bitstring",
-	"bitstream",		Cmdbitstream,1,		"[clock rate] -- Convert waveform into a bitstream",
-	"buffclear",		CmdBuffClear,0,		"    Clear sample buffer and graph window",
-	"dec",				CmdDec,1,		"    Decimate samples",
-	"detectclock",		Cmddetectclockrate,1, "    Detect clock rate",
-	"em410xsim",		CmdEM410xsim,1,		"<UID> -- Simulate EM410x tag",
-	"em410xread",		CmdEM410xread,1,	"[clock rate] -- Extract ID from EM410x tag",
-	"em410xwatch",		CmdEM410xwatch,0,	"    Watches for EM410x tags",
-	"exit",				CmdQuit,1,			"    Exit program",
-	"flexdemod",		CmdFlexdemod,1,		"    Demodulate samples for FlexPass",
-	"fpgaoff",			CmdFPGAOff,0,		"    Set FPGA off",							// ## FPGA Control
-	"hexsamples",		CmdHexsamples,0,	"<blocks> -- Dump big buffer as hex bytes",
-	"hi14alist",		CmdHi14alist,0,		"    List ISO 14443a history",				// ## New list command
-	"hi14areader",		CmdHi14areader,0,	"    Act like an ISO14443 Type A reader",	// ## New reader command
-	"hi14asim",			CmdHi14asim,0,		"<UID> -- Fake ISO 14443a tag",					// ## Simulate 14443a tag
-	"hi14asnoop",		CmdHi14asnoop,0,	"    Eavesdrop ISO 14443 Type A",			// ## New snoop command
-	"hi14bdemod",		CmdHi14bdemod,1,	"    Demodulate ISO14443 Type B from tag",
-	"hi14list",			CmdHi14list,0,		"    List ISO 14443 history",
-	"hi14read",			CmdHi14read,0,		"    Read HF tag (ISO 14443)",
-	"hi14sim",			CmdHi14sim,0,		"    Fake ISO 14443 tag",
-	"hi14snoop",		CmdHi14snoop,0,		"    Eavesdrop ISO 14443",
-	"hi15demod",		CmdHi15demod,1,		"    Demodulate ISO15693 from tag",
-	"hi15read",			CmdHi15read,0,		"    Read HF tag (ISO 15693)",
-	"hi15reader",		CmdHi15reader,0,	"    Act like an ISO15693 reader", // new command greg
-	"hi15sim",			CmdHi15tag,0,		"    Fake an ISO15693 tag", // new command greg
-	"hiddemod",			CmdHiddemod,1,		"    Demodulate HID Prox Card II (not optimal)",
-	"hide",				CmdHide,1,		"    Hide graph window",
-	"hidfskdemod",		CmdHIDdemodFSK,0,	"    Realtime HID FSK demodulator",
-	"hidsimtag",		CmdHIDsimTAG,0,		"<ID> -- HID tag simulator",
-	"higet",			CmdHi14read_sim,0,	"<samples> -- Get samples HF, 'analog'",
-	"hisamples",		CmdHisamples,0,		"    Get raw samples for HF tag",
-	"hisampless",		CmdHisampless,0,	"<samples> -- Get signed raw samples, HF tag",
-	"hisamplest",		CmdHi14readt,0,		"    Get samples HF, for testing",
-	"hisimlisten",		CmdHisimlisten,0,	"    Get HF samples as fake tag",
-	"hpf",				CmdHpf,1,		"    Remove DC offset from trace",
-    	"indalademod",		CmdIndalademod,0,         "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)",
-	"lcd",				CmdLcd,0,			"<HEX command> <count> -- Send command/data to LCD",
-	"lcdreset",			CmdLcdReset,0,		"    Hardware reset LCD",
-	"load",				CmdLoad,1,		"<filename> -- Load trace (to graph window",
-	"loread",			CmdLoread,0,		"['h'] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134)",
-	"losamples",		CmdLosamples,0,		"[128 - 16000] -- Get raw samples for LF tag",
-	"losim",			CmdLosim,0,		"    Simulate LF tag",
-	"ltrim",			CmdLtrim,1,		"<samples> -- Trim samples from left of trace",
-	"mandemod",			Cmdmanchesterdemod,1,	"[i] [clock rate] -- Manchester demodulate binary stream (option 'i' to invert output)",
-	"manmod",			Cmdmanchestermod,1,	"[clock rate] -- Manchester modulate a binary stream",
-	"norm",				CmdNorm,1,		"    Normalize max/min to +/-500",
-	"plot",				CmdPlot,1,		"    Show graph window",
-	"quit",				CmdQuit,1,			"    Quit program",
-	"reset",			CmdReset,0,			"    Reset the Proxmark3",
-	"save",				CmdSave,1,		"<filename> -- Save trace (from graph window)",
-	"scale",			CmdScale,1,		"<int> -- Set cursor display scale",
-	"setlfdivisor",		CmdSetDivisor,0,	"<19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)",
-	"sri512read",		CmdSri512read,0,	"<int> -- Read contents of a SRI512 tag",
-	"sweeplf",			CmdSweepLF,0,		"    Sweep through LF freq range and store results in buffer",
-	"tibits",			CmdTibits,0,		"    Get raw bits for TI-type LF tag",
-	"tidemod",			CmdTidemod,0,		"    Demodulate raw bits for TI-type LF tag",
-	"tiread",			CmdTiread,0,		"    Read a TI-type 134 kHz tag",
-	"tune",				CmdTune,0,		"    Measure antenna tuning",
-	"vchdemod",			CmdVchdemod,0,		"['clone'] -- Demodulate samples for VeriChip",
-	"zerocrossings",	CmdZerocrossings,1,	"    Count time between zero-crossings",
+	{"askdemod",			Cmdaskdemod,				1, "<samples per bit> <0|1> -- Attempt to demodulate simple ASK tags"},
+	{"autocorr",			CmdAutoCorr,				1, "<window length> -- Autocorrelation over window"},
+	{"bitsamples",		CmdBitsamples,			0, "Get raw samples as bitstring"},
+	{"bitstream",			Cmdbitstream,				1, "[clock rate] -- Convert waveform into a bitstream"},
+	{"buffclear",			CmdBuffClear,				1, "Clear sample buffer and graph window"},
+	{"dec",						CmdDec,							1, "Decimate samples"},
+	{"detectclock",		Cmddetectclockrate,	1, "Detect clock rate"},
+	{"detectreader",	CmdDetectReader,		0, "['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)"},
+	{"em410xsim",			CmdEM410xsim,				1, "<UID> -- Simulate EM410x tag"},
+	{"em410xread",		CmdEM410xread,			1, "[clock rate] -- Extract ID from EM410x tag"},
+	{"em410xwatch",		CmdEM410xwatch,			0, "Watches for EM410x tags"},
+	{"em4x50read",		CmdEM4x50read,			1, "Extract data from EM4x50 tag"},
+	{"exit",					CmdQuit,						1, "Exit program"},
+	{"flexdemod",			CmdFlexdemod,				1, "Demodulate samples for FlexPass"},
+	{"fpgaoff",				CmdFPGAOff,					0, "Set FPGA off"},
+	{"fskdemod",			CmdFSKdemod,				1, "Demodulate graph window as a HID FSK"},
+	{"grid",					CmdGrid,						1, "<x> <y> -- overlay grid on graph window, use zero value to turn off either"},
+	{"hexsamples",		CmdHexsamples,			0, "<blocks> -- Dump big buffer as hex bytes"},
+	{"hi14alist",			CmdHi14alist,				0, "List ISO 14443a history"},
+	{"hi14areader",		CmdHi14areader,			0, "Act like an ISO14443 Type A reader"},
+	{"hi14asim",			CmdHi14asim,				0, "<UID> -- Fake ISO 14443a tag"},
+	{"hi14asnoop",		CmdHi14asnoop,			0, "Eavesdrop ISO 14443 Type A"},
+	{"hi14bdemod",		CmdHi14bdemod,			1, "Demodulate ISO14443 Type B from tag"},
+	{"hi14list",			CmdHi14list,				0, "List ISO 14443 history"},
+	{"hi14read",			CmdHi14read,				0, "Read HF tag (ISO 14443)"},
+	{"hi14sim",				CmdHi14sim,					0, "Fake ISO 14443 tag"},
+	{"hi14snoop",			CmdHi14snoop,				0, "Eavesdrop ISO 14443"},
+	{"hi15demod",			CmdHi15demod,				1, "Demodulate ISO15693 from tag"},
+	{"hi15read",			CmdHi15read,				0, "Read HF tag (ISO 15693)"},
+	{"hi15reader",		CmdHi15reader,			0, "Act like an ISO15693 reader"},
+	{"hi15sim",				CmdHi15tag,					0, "Fake an ISO15693 tag"},
+	{"hiddemod",			CmdHiddemod,				1, "Demodulate HID Prox Card II (not optimal)"},
+	{"hide",					CmdHide,						1, "Hide graph window"},
+	{"hidfskdemod",		CmdHIDdemodFSK,			0, "Realtime HID FSK demodulator"},
+	{"hidsimtag",			CmdHIDsimTAG,				0, "<ID> -- HID tag simulator"},
+	{"higet",					CmdHi14read_sim,		0, "<samples> -- Get samples HF, 'analog'"},
+	{"hisamples",			CmdHisamples,				0, "Get raw samples for HF tag"},
+	{"hisampless",		CmdHisampless,			0, "<samples> -- Get signed raw samples, HF tag"},
+	{"hisamplest",		CmdHi14readt,				0, "Get samples HF, for testing"},
+	{"hisimlisten",		CmdHisimlisten,			0, "Get HF samples as fake tag"},
+	{"hpf",						CmdHpf,							1, "Remove DC offset from trace"},
+	{"indalademod",		CmdIndalademod,			0, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
+	{"lcd",						CmdLcd,							0, "<HEX command> <count> -- Send command/data to LCD"},
+	{"lcdreset",			CmdLcdReset,				0, "Hardware reset LCD"},
+	{"load",					CmdLoad,						1, "<filename> -- Load trace (to graph window"},
+	{"locomread",			CmdLoCommandRead,		0, "<off period> <'0' period> <'1' period> <command> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)"},
+	{"loread",				CmdLoread,					0, "['h'] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134)"},
+	{"losamples",			CmdLosamples,				0, "[128 - 16000] -- Get raw samples for LF tag"},
+	{"losim",					CmdLosim,						0, "Simulate LF tag"},
+	{"ltrim",					CmdLtrim,						1, "<samples> -- Trim samples from left of trace"},
+	{"mandemod",			Cmdmanchesterdemod,	1, "[i] [clock rate] -- Manchester demodulate binary stream (option 'i' to invert output)"},
+	{"manmod",				Cmdmanchestermod,		1, "[clock rate] -- Manchester modulate a binary stream"},
+	{"norm",					CmdNorm,						1, "Normalize max/min to +/-500"},
+	{"plot",					CmdPlot,						1, "Show graph window"},
+	{"quit",					CmdQuit,						1, "Quit program"},
+	{"readmem",				CmdReadmem,					0, "[address] -- Read memory at decimal address from flash"},
+	{"reset",					CmdReset,						0, "Reset the Proxmark3"},
+	{"save",					CmdSave,						1, "<filename> -- Save trace (from graph window)"},
+	{"scale",					CmdScale,						1, "<int> -- Set cursor display scale"},
+	{"setlfdivisor",	CmdSetDivisor,			0, "<19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)"},
+	{"sri512read",		CmdSri512read,			0, "<int> -- Read contents of a SRI512 tag"},
+	{"tidemod",				CmdTIDemod,					1, "Demodulate raw bits for TI-type LF tag"},
+	{"tiread",				CmdTIRead,					0, "Read and decode a TI 134 kHz tag"},
+	{"tiwrite",				CmdTIWrite,					0, "Write new data to a r/w TI 134 kHz tag"},
+	{"threshold",			CmdThreshold,				1, "Maximize/minimize every value in the graph window depending on threshold"},
+	{"tune",					CmdTune,						0, "Measure antenna tuning"},
+	{"vchdemod",			CmdVchdemod,				0, "['clone'] -- Demodulate samples for VeriChip"},
+	{"zerocrossings",	CmdZerocrossings,		1, "Count time between zero-crossings"},
 };
 
+static struct {
+	char *name;
+	char *args;
+	char *argshelp;
+	char *description;
+	} 	CommandExtendedHelp[]= {
+		{"detectreader","'l'|'h'","'l' specifies LF antenna scan only, 'h' specifies HF antenna scan only.","Monitor antenna for changes in voltage. Output is in three fields: CHANGED, CURRENT, PERIOD,\nwhere CHANGED is the value just changed from, CURRENT is the current value and PERIOD is the\nnumber of program loops since the last change.\n\nThe RED LED indicates LF field detected, and the GREEN LED indicates HF field detected."},
+		{"tune","","","Drive LF antenna at all divisor range values (19 - 255) and store the results in the output\nbuffer. Issuing 'losamples' and then 'plot' commands will display the resulting peak. 12MHz\ndivided by the peak's position plus one gives the antenna's resonant frequency. For convenience,\nthis value is also printed out by the command."},
+		};
 
 //-----------------------------------------------------------------------------
 // Entry point into our code: called whenever the user types a command and
@@ -2496,15 +2865,30 @@ static struct {
 void CommandReceived(char *cmd)
 {
 	int i;
+	char line[256];
 
 	PrintToScrollback("> %s", cmd);
 
-	if(strcmp(cmd, "help")==0) {
+	if(strcmp(cmd, "help") == 0 || strncmp(cmd,"help ",strlen("help ")) == 0) {
+		// check if we're doing extended help
+		if(strlen(cmd) > strlen("help ")) {
+			cmd += strlen("help ");
+			for(i = 0; i < sizeof(CommandExtendedHelp) / sizeof(CommandExtendedHelp[0]); i++) {
+				if(strcmp(CommandExtendedHelp[i].name,cmd) == 0) {
+					PrintToScrollback("\nExtended help for '%s':\n", cmd);
+					PrintToScrollback("Args: %s\t- %s\n",CommandExtendedHelp[i].args,CommandExtendedHelp[i].argshelp);
+					PrintToScrollback(CommandExtendedHelp[i].description);
+					PrintToScrollback("");
+					return;
+				}
+			}
+		PrintToScrollback("No extended help available for '%s'", cmd);
+		return;
+		}
 		if (offline) PrintToScrollback("Operating in OFFLINE mode (no device connected)");
 		PrintToScrollback("\r\nAvailable commands:");
 		for(i = 0; i < sizeof(CommandTable) / sizeof(CommandTable[0]); i++) {
 			if (offline && (CommandTable[i].offline==0)) continue;
-			char line[256];
 			memset(line, ' ', sizeof(line));
 			strcpy(line+2, CommandTable[i].name);
 			line[strlen(line)] = ' ';
@@ -2512,7 +2896,7 @@ void CommandReceived(char *cmd)
 			PrintToScrollback("%s", line);
 		}
 		PrintToScrollback("");
-		PrintToScrollback("and also: help, cls");
+		PrintToScrollback("'help <command>' for extended help on that command\n");
 		return;
 	}
 
@@ -2559,19 +2943,27 @@ void UsbCommandReceived(UsbCommand *c)
 			break;
 
 		case CMD_MEASURED_ANTENNA_TUNING: {
-			int zLf, zHf;
+			int peakv, peakf;
 			int vLf125, vLf134, vHf;
 			vLf125 = c->ext1 & 0xffff;
 			vLf134 = c->ext1 >> 16;
-			vHf = c->ext2;
-			zLf = c->ext3 & 0xffff;
-			zHf = c->ext3 >> 16;
-			PrintToScrollback("# LF antenna @ %3d mA / %5d mV [%d ohms] 125Khz",
-				vLf125/zLf, vLf125, zLf);
-			PrintToScrollback("# LF antenna @ %3d mA / %5d mV [%d ohms] 134Khz",
-				vLf134/((zLf*125)/134), vLf134, (zLf*125)/134);
-			PrintToScrollback("# HF antenna @ %3d mA / %5d mV [%d ohms] 13.56Mhz",
-				vHf/zHf, vHf, zHf);
+			vHf = c->ext2 & 0xffff;;
+			peakf = c->ext3 & 0xffff;
+			peakv = c->ext3 >> 16;
+			PrintToScrollback("");
+			PrintToScrollback("");
+			PrintToScrollback("# LF antenna: %5.2f V @   125.00 kHz", vLf125/1000.0);
+			PrintToScrollback("# LF antenna: %5.2f V @   134.00 kHz", vLf134/1000.0);
+			PrintToScrollback("# LF optimal: %5.2f V @%9.2f kHz", peakv/1000.0, 12000.0/(peakf+1));
+			PrintToScrollback("# HF antenna: %5.2f V @    13.56 MHz", vHf/1000.0);
+			if (peakv<2000)
+				PrintToScrollback("# Your LF antenna is unusable.");
+			else if (peakv<10000)
+				PrintToScrollback("# Your LF antenna is marginal.");
+			if (vHf<2000)
+				PrintToScrollback("# Your HF antenna is unusable.");
+			else if (vHf<5000)
+				PrintToScrollback("# Your HF antenna is marginal.");
 			break;
 		}
 		default: