X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/865279ba89d3cab9941eee19d585e0d926fb0f14..refs/pull/148/head:/client/cmdlft55xx.c?ds=sidebyside
diff --git a/client/cmdlft55xx.c b/client/cmdlft55xx.c
index 2291735c..a12cffa2 100644
--- a/client/cmdlft55xx.c
+++ b/client/cmdlft55xx.c
@@ -28,18 +28,27 @@
#define CONFIGURATION_BLOCK 0x00
#define TRACE_BLOCK 0x01
+#define REGULAR_READ_MODE_BLOCK 0xFF
// Default configuration
-t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = FALSE, .offset = 0x00, .block0 = 0x00};
+t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = FALSE, .offset = 0x00, .block0 = 0x00, .Q5 = FALSE };
+
+t55xx_conf_block_t Get_t55xx_Config(){
+ return config;
+}
+void Set_t55xx_Config(t55xx_conf_block_t conf){
+ config = conf;
+}
int usage_t55xx_config(){
- PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>]");
- PrintAndLog("Options: ");
+ PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");
+ PrintAndLog("Options:");
PrintAndLog(" h This help");
- PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");
- PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NZ|BI|BIa> Set demodulation FSK / ASK / PSK / NZ / Biphase / Biphase A");
- PrintAndLog(" i [1] Invert data signal, defaults to normal");
- PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");
+ PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");
+ PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");
+ PrintAndLog(" i [1] Invert data signal, defaults to normal");
+ PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");
+ PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");
PrintAndLog("");
PrintAndLog("Examples:");
PrintAndLog(" lf t55xx config d FSK - FSK demodulation");
@@ -49,31 +58,41 @@ int usage_t55xx_config(){
return 0;
}
int usage_t55xx_read(){
- PrintAndLog("Usage: lf t55xx read <block> <password>");
- PrintAndLog(" <block>, block number to read. Between 0-7");
- PrintAndLog(" <password>, OPTIONAL password (8 hex characters)");
+ PrintAndLog("Usage: lf t55xx read [b <block>] [p <password>] <override_safety> <page1>");
+ PrintAndLog("Options:");
+ PrintAndLog(" b <block> - block number to read. Between 0-7");
+ PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");
+ PrintAndLog(" o - OPTIONAL override safety check");
+ PrintAndLog(" 1 - OPTIONAL read Page 1 instead of Page 0");
+ PrintAndLog(" ****WARNING****");
+ PrintAndLog(" Use of read with password on a tag not configured for a pwd");
+ PrintAndLog(" can damage the tag");
PrintAndLog("");
PrintAndLog("Examples:");
- PrintAndLog(" lf t55xx read 0 - read data from block 0");
- PrintAndLog(" lf t55xx read 0 feedbeef - read data from block 0 password feedbeef");
+ PrintAndLog(" lf t55xx read b 0 - read data from block 0");
+ PrintAndLog(" lf t55xx read b 0 p feedbeef - read data from block 0 password feedbeef");
+ PrintAndLog(" lf t55xx read b 0 p feedbeef o - read data from block 0 password feedbeef safety check");
PrintAndLog("");
return 0;
}
int usage_t55xx_write(){
- PrintAndLog("Usage: lf t55xx wr <block> <data> [password]");
- PrintAndLog(" <block>, block number to write. Between 0-7");
- PrintAndLog(" <data>, 4 bytes of data to write (8 hex characters)");
- PrintAndLog(" [password], OPTIONAL password 4bytes (8 hex characters)");
+ PrintAndLog("Usage: lf t55xx wr [b <block>] [d <data>] [p <password>] [1]");
+ PrintAndLog("Options:");
+ PrintAndLog(" b <block> - block number to write. Between 0-7");
+ PrintAndLog(" d <data> - 4 bytes of data to write (8 hex characters)");
+ PrintAndLog(" p <password> - OPTIONAL password 4bytes (8 hex characters)");
+ PrintAndLog(" 1 - OPTIONAL write Page 1 instead of Page 0");
PrintAndLog("");
PrintAndLog("Examples:");
- PrintAndLog(" lf t55xx wr 3 11223344 - write 11223344 to block 3");
- PrintAndLog(" lf t55xx wr 3 11223344 feedbeef - write 11223344 to block 3 password feedbeef");
+ PrintAndLog(" lf t55xx wr b 3 d 11223344 - write 11223344 to block 3");
+ PrintAndLog(" lf t55xx wr b 3 d 11223344 p feedbeef - write 11223344 to block 3 password feedbeef");
PrintAndLog("");
return 0;
}
int usage_t55xx_trace() {
PrintAndLog("Usage: lf t55xx trace [1]");
- PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");
+ PrintAndLog("Options:");
+ PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");
PrintAndLog("");
PrintAndLog("Examples:");
PrintAndLog(" lf t55xx trace");
@@ -83,7 +102,8 @@ int usage_t55xx_trace() {
}
int usage_t55xx_info() {
PrintAndLog("Usage: lf t55xx info [1]");
- PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");
+ PrintAndLog("Options:");
+ PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");
PrintAndLog("");
PrintAndLog("Examples:");
PrintAndLog(" lf t55xx info");
@@ -92,17 +112,21 @@ int usage_t55xx_info() {
return 0;
}
int usage_t55xx_dump(){
- PrintAndLog("Usage: lf t55xx dump <password>");
- PrintAndLog(" <password>, OPTIONAL password 4bytes (8 hex symbols)");
+ PrintAndLog("Usage: lf t55xx dump <password> [o]");
+ PrintAndLog("Options:");
+ PrintAndLog(" <password> - OPTIONAL password 4bytes (8 hex symbols)");
+ PrintAndLog(" o - OPTIONAL override, force pwd read despite danger to card");
PrintAndLog("");
PrintAndLog("Examples:");
PrintAndLog(" lf t55xx dump");
- PrintAndLog(" lf t55xx dump feedbeef");
+ PrintAndLog(" lf t55xx dump feedbeef o");
PrintAndLog("");
return 0;
}
int usage_t55xx_detect(){
- PrintAndLog("Usage: lf t55xx detect");
+ PrintAndLog("Usage: lf t55xx detect [1]");
+ PrintAndLog("Options:");
+ PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");
PrintAndLog("");
PrintAndLog("Examples:");
PrintAndLog(" lf t55xx detect");
@@ -110,18 +134,30 @@ int usage_t55xx_detect(){
PrintAndLog("");
return 0;
}
+int usage_t55xx_wakup(){
+ PrintAndLog("Usage: lf t55xx wakeup [h] p <password>");
+ PrintAndLog("This commands send the Answer-On-Request command and leaves the readerfield ON afterwards.");
+ PrintAndLog("Options:");
+ PrintAndLog(" h - this help");
+ PrintAndLog(" p <password> - password 4bytes (8 hex symbols)");
+ PrintAndLog("");
+ PrintAndLog("Examples:");
+ PrintAndLog(" lf t55xx wakeup p 11223344 - send wakeup password");
+ return 0;
+}
static int CmdHelp(const char *Cmd);
int CmdT55xxSetConfig(const char *Cmd) {
uint8_t offset = 0;
- bool errors = FALSE;
- uint8_t cmdp = 0;
char modulation[5] = {0x00};
char tmp = 0x00;
uint8_t bitRate = 0;
uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};
+ uint8_t cmdp = 0;
+ config.Q5 = FALSE;
+ bool errors = FALSE;
while(param_getchar(Cmd, cmdp) != 0x00 && !errors)
{
tmp = param_getchar(Cmd, cmdp);
@@ -193,6 +229,11 @@ int CmdT55xxSetConfig(const char *Cmd) {
config.offset = offset;
cmdp+=2;
break;
+ case 'Q':
+ case 'q':
+ config.Q5 = TRUE;
+ cmdp++;
+ break;
default:
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
errors = TRUE;
@@ -201,64 +242,91 @@ int CmdT55xxSetConfig(const char *Cmd) {
}
// No args
- if (cmdp == 0) {
- printConfiguration( config );
- return 0;
- }
+ if (cmdp == 0) return printConfiguration( config );
+
//Validations
- if (errors)
- return usage_t55xx_config();
+ if (errors) return usage_t55xx_config();
- config.block0 = 0;
- printConfiguration ( config );
- return 0;
+ config.block0 = 0;
+ return printConfiguration ( config );
}
-int CmdT55xxReadBlock(const char *Cmd) {
- int block = -1;
- int password = 0xFFFFFFFF; //default to blank Block 7
-
- char cmdp = param_getchar(Cmd, 0);
- if (cmdp == 'h' || cmdp == 'H')
- return usage_t55xx_read();
-
- int res = sscanf(Cmd, "%d %x", &block, &password);
-
- if ( res < 1 || res > 2 )
- return usage_t55xx_read();
+int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32_t password){
+ //Password mode
+ if ( usepwd ) {
+ // try reading the config block and verify that PWD bit is set before doing this!
+ if ( !override ) {
+ if ( !AquireData(0, CONFIGURATION_BLOCK, false, 0 ) ) return 0;
+ if ( !tryDetectModulation() ) {
+ PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");
+ return 0;
+ } else {
+ PrintAndLog("Safety Check: PWD bit is NOT set in config block. Reading without password...");
+ usepwd = false;
+ page1 = false;
+ }
+ } else {
+ PrintAndLog("Safety Check Overriden - proceeding despite risk");
+ }
+ }
-
- if ((block < 0) | (block > 7)) {
- PrintAndLog("Block must be between 0 and 7");
- return 1;
- }
+ if (!AquireData(page1, block, usepwd, password) ) return 0;
+ if (!DecodeT55xxBlock()) return 0;
- UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, block, 0}};
- c.d.asBytes[0] = 0x0;
+ char blk[10]={0};
+ sprintf(blk,"%d", block);
+ printT55xxBlock(blk);
+ return 1;
+}
- //Password mode
- if ( res == 2 ) {
- c.arg[2] = password;
- c.d.asBytes[0] = 0x1;
+int CmdT55xxReadBlock(const char *Cmd) {
+ uint8_t block = REGULAR_READ_MODE_BLOCK;
+ uint32_t password = 0; //default to blank Block 7
+ bool usepwd = false;
+ bool override = false;
+ bool page1 = false;
+ bool errors = false;
+ uint8_t cmdp = 0;
+ while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+ switch(param_getchar(Cmd, cmdp)) {
+ case 'h':
+ case 'H':
+ return usage_t55xx_read();
+ case 'b':
+ case 'B':
+ errors |= param_getdec(Cmd, cmdp+1, &block);
+ cmdp += 2;
+ break;
+ case 'o':
+ case 'O':
+ override = true;
+ cmdp++;
+ break;
+ case 'p':
+ case 'P':
+ password = param_get32ex(Cmd, cmdp+1, 0, 16);
+ usepwd = true;
+ cmdp += 2;
+ break;
+ case '1':
+ page1 = true;
+ cmdp++;
+ break;
+ default:
+ PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+ errors = true;
+ break;
+ }
}
+ if (errors) return usage_t55xx_read();
- clearCommandBuffer();
- SendCommand(&c);
- if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {
- PrintAndLog("command execution time out");
- return 2;
+ if (block > 7 && block != REGULAR_READ_MODE_BLOCK ) {
+ PrintAndLog("Block must be between 0 and 7");
+ return 0;
}
-
- uint8_t got[12000];
- GetFromBigBuf(got,sizeof(got),0);
- WaitForResponse(CMD_ACK,NULL);
- setGraphBuf(got, 12000);
- DemodBufferLen=0;
- if (!DecodeT55xxBlock()) return 3;
- char blk[10]={0};
- sprintf(blk,"%d", block);
- printT55xxBlock(blk);
- return 0;
+ PrintAndLog("Reading Page %d:", page1);
+ PrintAndLog("blk | hex data | binary");
+ return T55xxReadBlock(block, page1, usepwd, override, password);
}
bool DecodeT55xxBlock(){
@@ -269,9 +337,6 @@ bool DecodeT55xxBlock(){
uint8_t bitRate[8] = {8,16,32,40,50,64,100,128};
DemodBufferLen = 0x00;
- //trim 1/2 a clock from beginning
- snprintf(cmdStr, sizeof(buf),"%d", bitRate[config.bitrate]/2 );
- CmdLtrim(cmdStr);
switch( config.modulation ){
case DEMOD_FSK:
snprintf(cmdStr, sizeof(buf),"%d %d", bitRate[config.bitrate], config.inverted );
@@ -288,16 +353,20 @@ bool DecodeT55xxBlock(){
ans = FSKrawDemod(cmdStr, FALSE);
break;
case DEMOD_ASK:
- snprintf(cmdStr, sizeof(buf),"%d %d 0", bitRate[config.bitrate], config.inverted );
+ snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );
ans = ASKDemod(cmdStr, FALSE, FALSE, 1);
break;
case DEMOD_PSK1:
- snprintf(cmdStr, sizeof(buf),"%d %d 0", bitRate[config.bitrate], config.inverted );
+ // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
+ CmdLtrim("160");
+ snprintf(cmdStr, sizeof(buf),"%d %d 6", bitRate[config.bitrate], config.inverted );
ans = PSKDemod(cmdStr, FALSE);
break;
case DEMOD_PSK2: //inverted won't affect this
case DEMOD_PSK3: //not fully implemented
- snprintf(cmdStr, sizeof(buf),"%d 0 1", bitRate[config.bitrate] );
+ // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
+ CmdLtrim("160");
+ snprintf(cmdStr, sizeof(buf),"%d 0 6", bitRate[config.bitrate] );
ans = PSKDemod(cmdStr, FALSE);
psk1TOpsk2(DemodBuffer, DemodBufferLen);
break;
@@ -307,7 +376,7 @@ bool DecodeT55xxBlock(){
break;
case DEMOD_BI:
case DEMOD_BIa:
- snprintf(cmdStr, sizeof(buf),"0 %d %d 0", bitRate[config.bitrate], config.inverted );
+ snprintf(cmdStr, sizeof(buf),"0 %d %d 1", bitRate[config.bitrate], config.inverted );
ans = ASKbiphaseDemod(cmdStr, FALSE);
break;
default:
@@ -323,17 +392,17 @@ int CmdT55xxDetect(const char *Cmd){
return usage_t55xx_detect();
if (strlen(Cmd)==0)
- AquireData( CONFIGURATION_BLOCK );
+ if ( !AquireData(0, CONFIGURATION_BLOCK, false, 0) )
+ return 0;
if ( !tryDetectModulation() )
PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");
- return 0;
+ return 1;
}
// detect configuration?
bool tryDetectModulation(){
- char cmdStr[8] = {0};
uint8_t hits = 0;
t55xx_conf_block_t tests[15];
int bitRate=0;
@@ -341,20 +410,18 @@ bool tryDetectModulation(){
save_restoreGB(1);
if (GetFskClock("", FALSE, FALSE)){
fskClocks(&fc1, &fc2, &clk, FALSE);
- sprintf(cmdStr,"%d", clk/2);
- CmdLtrim(cmdStr);
- if ( FSKrawDemod("0 0", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate)){
+ if ( FSKrawDemod("0 0", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){
tests[hits].modulation = DEMOD_FSK;
if (fc1==8 && fc2 == 5)
tests[hits].modulation = DEMOD_FSK1a;
- else if (fc1==10 && fc2 == 8)
+ else if (fc1==10 && fc2 == 8)
tests[hits].modulation = DEMOD_FSK2;
tests[hits].bitrate = bitRate;
tests[hits].inverted = FALSE;
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
++hits;
}
- if ( FSKrawDemod("0 1", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate)) {
+ if ( FSKrawDemod("0 1", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
tests[hits].modulation = DEMOD_FSK;
if (fc1 == 8 && fc2 == 5)
tests[hits].modulation = DEMOD_FSK1;
@@ -369,30 +436,28 @@ bool tryDetectModulation(){
} else {
clk = GetAskClock("", FALSE, FALSE);
if (clk>0) {
- sprintf(cmdStr,"%d", clk/2);
- CmdLtrim(cmdStr);
- if ( ASKDemod("0 0 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate)) {
+ if ( ASKDemod("0 0 1", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
tests[hits].modulation = DEMOD_ASK;
tests[hits].bitrate = bitRate;
tests[hits].inverted = FALSE;
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
++hits;
}
- if ( ASKDemod("0 1 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate)) {
+ if ( ASKDemod("0 1 1", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
tests[hits].modulation = DEMOD_ASK;
tests[hits].bitrate = bitRate;
tests[hits].inverted = TRUE;
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
++hits;
}
- if ( ASKbiphaseDemod("0 0 0 0", FALSE) && test(DEMOD_BI, &tests[hits].offset, &bitRate) ) {
+ if ( ASKbiphaseDemod("0 0 0 2", FALSE) && test(DEMOD_BI, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {
tests[hits].modulation = DEMOD_BI;
tests[hits].bitrate = bitRate;
tests[hits].inverted = FALSE;
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
++hits;
}
- if ( ASKbiphaseDemod("0 0 1 0", FALSE) && test(DEMOD_BIa, &tests[hits].offset, &bitRate) ) {
+ if ( ASKbiphaseDemod("0 0 1 2", FALSE) && test(DEMOD_BIa, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {
tests[hits].modulation = DEMOD_BIa;
tests[hits].bitrate = bitRate;
tests[hits].inverted = TRUE;
@@ -404,9 +469,7 @@ bool tryDetectModulation(){
save_restoreGB(0);
clk = GetNrzClock("", FALSE, FALSE);
if (clk>0) {
- sprintf(cmdStr,"%d", clk/2);
- CmdLtrim(cmdStr);
- if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate)) {
+ if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
tests[hits].modulation = DEMOD_NRZ;
tests[hits].bitrate = bitRate;
tests[hits].inverted = FALSE;
@@ -414,7 +477,7 @@ bool tryDetectModulation(){
++hits;
}
- if ( NRZrawDemod("0 1 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate)) {
+ if ( NRZrawDemod("0 1 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
tests[hits].modulation = DEMOD_NRZ;
tests[hits].bitrate = bitRate;
tests[hits].inverted = TRUE;
@@ -425,19 +488,18 @@ bool tryDetectModulation(){
//undo trim from nrz
save_restoreGB(0);
+ // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
+ CmdLtrim("160");
clk = GetPskClock("", FALSE, FALSE);
if (clk>0) {
- PrintAndLog("clk %d",clk);
- sprintf(cmdStr,"%d", clk/2);
- CmdLtrim(cmdStr);
- if ( PSKDemod("0 0 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate)) {
+ if ( PSKDemod("0 0 6", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
tests[hits].modulation = DEMOD_PSK1;
tests[hits].bitrate = bitRate;
tests[hits].inverted = FALSE;
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
++hits;
}
- if ( PSKDemod("0 1 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate)) {
+ if ( PSKDemod("0 1 6", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
tests[hits].modulation = DEMOD_PSK1;
tests[hits].bitrate = bitRate;
tests[hits].inverted = TRUE;
@@ -445,9 +507,9 @@ bool tryDetectModulation(){
++hits;
}
// PSK2 - needs a call to psk1TOpsk2.
- if ( PSKDemod("0 0 1", FALSE)) {
+ if ( PSKDemod("0 0 6", FALSE)) {
psk1TOpsk2(DemodBuffer, DemodBufferLen);
- if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate)){
+ if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){
tests[hits].modulation = DEMOD_PSK2;
tests[hits].bitrate = bitRate;
tests[hits].inverted = FALSE;
@@ -456,9 +518,9 @@ bool tryDetectModulation(){
}
} // inverse waves does not affect this demod
// PSK3 - needs a call to psk1TOpsk2.
- if ( PSKDemod("0 0 1", FALSE)) {
+ if ( PSKDemod("0 0 6", FALSE)) {
psk1TOpsk2(DemodBuffer, DemodBufferLen);
- if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate)){
+ if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){
tests[hits].modulation = DEMOD_PSK3;
tests[hits].bitrate = bitRate;
tests[hits].inverted = FALSE;
@@ -491,7 +553,7 @@ bool tryDetectModulation(){
bool testModulation(uint8_t mode, uint8_t modread){
switch( mode ){
case DEMOD_FSK:
- if (modread > 3 && modread < 8) return TRUE;
+ if (modread >= DEMOD_FSK1 && modread <= DEMOD_FSK2a) return TRUE;
break;
case DEMOD_ASK:
if (modread == DEMOD_ASK) return TRUE;
@@ -520,37 +582,28 @@ bool testModulation(uint8_t mode, uint8_t modread){
return FALSE;
}
-bool testBitRate(uint8_t readRate, uint8_t mod){
- uint8_t expected[8] = {8, 16, 32, 40, 50, 64, 100, 128};
- uint8_t detRate = 0;
- switch( mod ){
+bool testQ5Modulation(uint8_t mode, uint8_t modread){
+ switch( mode ){
case DEMOD_FSK:
- case DEMOD_FSK1:
- case DEMOD_FSK1a:
- case DEMOD_FSK2:
- case DEMOD_FSK2a:
- detRate = GetFskClock("",FALSE, FALSE);
- if (expected[readRate] == detRate)
- return TRUE;
+ if (modread >= 4 && modread <= 5) return TRUE;
break;
case DEMOD_ASK:
- case DEMOD_BI:
- case DEMOD_BIa:
- detRate = GetAskClock("",FALSE, FALSE);
- if (expected[readRate] == detRate)
- return TRUE;
+ if (modread == 0) return TRUE;
break;
case DEMOD_PSK1:
+ if (modread == 1) return TRUE;
+ break;
case DEMOD_PSK2:
+ if (modread == 2) return TRUE;
+ break;
case DEMOD_PSK3:
- detRate = GetPskClock("",FALSE, FALSE);
- if (expected[readRate] == detRate)
- return TRUE;
+ if (modread == 3) return TRUE;
break;
case DEMOD_NRZ:
- detRate = GetNrzClock("",FALSE, FALSE);
- if (expected[readRate] == detRate)
- return TRUE;
+ if (modread == 7) return TRUE;
+ break;
+ case DEMOD_BI:
+ if (modread == 6) return TRUE;
break;
default:
return FALSE;
@@ -558,13 +611,60 @@ bool testBitRate(uint8_t readRate, uint8_t mod){
return FALSE;
}
-bool test(uint8_t mode, uint8_t *offset, int *fndBitRate){
+bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){
+
+ if ( DemodBufferLen < 64 ) return FALSE;
+ uint8_t si = 0;
+ for (uint8_t idx = 28; idx < 64; idx++){
+ si = idx;
+ if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;
+
+ uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key
+ uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;
+ // 2nibble must be zeroed.
+ if (safer != 0x6) continue;
+ if ( resv > 0x00) continue;
+ //uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;
+ //uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;
+ si += 1+1;
+ int bitRate = PackBits(si, 5, DemodBuffer)*2 + 2; si += 5; //bit rate
+ if (bitRate > 128 || bitRate < 8) continue;
+
+ //uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1;
+ //uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1;
+ //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr
+ //uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;
+ si += 1+1+2+1;
+ uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;
+ uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;
+ //uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;
+ if (maxBlk == 0) continue;
+ //test modulation
+ if (!testQ5Modulation(mode, modread)) continue;
+ if (bitRate != clk) continue;
+ *fndBitRate = bitRate;
+ *offset = idx;
+
+ return TRUE;
+ }
+ return FALSE;
+}
+
+bool testBitRate(uint8_t readRate, uint8_t clk){
+ uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};
+ if (expected[readRate] == clk)
+ return true;
+
+ return false;
+}
+
+bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5){
if ( DemodBufferLen < 64 ) return FALSE;
uint8_t si = 0;
- for (uint8_t idx = 0; idx < 64; idx++){
+ for (uint8_t idx = 28; idx < 64; idx++){
si = idx;
- if ( PackBits(si, 32, DemodBuffer) == 0x00 ) continue;
+ if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;
uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key
uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode
@@ -573,7 +673,7 @@ bool test(uint8_t mode, uint8_t *offset, int *fndBitRate){
if ( resv > 0x00) continue;
uint8_t xtRate = PackBits(si, 3, DemodBuffer); si += 3; //extended mode part of rate
- int bitRate = PackBits(si, 3, DemodBuffer); si += 3; //bit rate
+ int bitRate = PackBits(si, 3, DemodBuffer); si += 3; //bit rate
if (bitRate > 7) continue;
uint8_t extend = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode
uint8_t modread = PackBits(si, 5, DemodBuffer); si += 5+2+1;
@@ -589,9 +689,14 @@ bool test(uint8_t mode, uint8_t *offset, int *fndBitRate){
}
//test modulation
if (!testModulation(mode, modread)) continue;
- if (!testBitRate(bitRate, mode)) continue;
+ if (!testBitRate(bitRate, clk)) continue;
*fndBitRate = bitRate;
*offset = idx;
+ *Q5 = FALSE;
+ return TRUE;
+ }
+ if (testQ5(mode, offset, fndBitRate, clk)) {
+ *Q5 = TRUE;
return TRUE;
}
return FALSE;
@@ -615,14 +720,15 @@ void printT55xxBlock(const char *blockNum){
bits[i - config.offset]=DemodBuffer[i];
blockData = PackBits(0, 32, bits);
- PrintAndLog("[%s] 0x%08X %s", blockNum, blockData, sprint_bin(bits,32));
+
+ PrintAndLog(" %s | %08X | %s", blockNum, blockData, sprint_bin(bits,32));
}
int special(const char *Cmd) {
uint32_t blockData = 0;
uint8_t bits[32] = {0x00};
- PrintAndLog("[OFFSET] [DATA] [BINARY]");
+ PrintAndLog("OFFSET | DATA | BINARY");
PrintAndLog("----------------------------------------------------");
int i,j = 0;
for (; j < 64; ++j){
@@ -632,86 +738,143 @@ int special(const char *Cmd) {
blockData = PackBits(0, 32, bits);
- PrintAndLog("[%02d] 0x%08X %s",j , blockData, sprint_bin(bits,32));
+ PrintAndLog(" %02d | 0x%08X | %s",j , blockData, sprint_bin(bits,32));
}
return 0;
}
-void printConfiguration( t55xx_conf_block_t b){
+int printConfiguration( t55xx_conf_block_t b){
+ PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");
PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );
PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate) );
PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );
PrintAndLog("Offset : %d", b.offset);
PrintAndLog("Block0 : 0x%08X", b.block0);
PrintAndLog("");
+ return 0;
}
-int CmdT55xxWriteBlock(const char *Cmd)
-{
- int block = 8; //default to invalid block
- int data = 0xFFFFFFFF; //default to blank Block
- int password = 0xFFFFFFFF; //default to blank Block 7
-
- char cmdp = param_getchar(Cmd, 0);
- if (cmdp == 'h' || cmdp == 'H') {
- usage_t55xx_write();
- return 0;
+int CmdT55xxWakeUp(const char *Cmd) {
+ uint32_t password = 0;
+ uint8_t cmdp = 0;
+ bool errors = true;
+ while(param_getchar(Cmd, cmdp) != 0x00) {
+ switch(param_getchar(Cmd, cmdp)) {
+ case 'h':
+ case 'H':
+ return usage_t55xx_wakup();
+ case 'p':
+ case 'P':
+ password = param_get32ex(Cmd, cmdp+1, 0xFFFFFFFF, 16);
+ cmdp += 2;
+ errors = false;
+ break;
+ default:
+ PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+ errors = true;
+ break;
+ }
}
-
- int res = sscanf(Cmd, "%d %x %x",&block, &data, &password);
-
- if ( res < 2 || res > 3) {
- usage_t55xx_write();
- return 1;
+ if (errors) return usage_t55xx_wakup();
+
+ UsbCommand c = {CMD_T55XX_WAKEUP, {password, 0, 0}};
+ clearCommandBuffer();
+ SendCommand(&c);
+ PrintAndLog("Wake up command sent. Try read now");
+ return 0;
+}
+
+int CmdT55xxWriteBlock(const char *Cmd) {
+ uint8_t block = 0xFF; //default to invalid block
+ uint32_t data = 0xFFFFFFFF; //default to blank Block
+ uint32_t password = 0xFFFFFFFF; //default to blank Block 7
+ bool usepwd = false;
+ bool page1 = false;
+ bool gotdata = false;
+ bool errors = false;
+ uint8_t cmdp = 0;
+ while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+ switch(param_getchar(Cmd, cmdp)) {
+ case 'h':
+ case 'H':
+ return usage_t55xx_write();
+ case 'b':
+ case 'B':
+ errors |= param_getdec(Cmd, cmdp+1, &block);
+ cmdp += 2;
+ break;
+ case 'd':
+ case 'D':
+ data = param_get32ex(Cmd, cmdp+1, 0, 16);
+ gotdata = true;
+ cmdp += 2;
+ break;
+ case 'p':
+ case 'P':
+ password = param_get32ex(Cmd, cmdp+1, 0, 16);
+ usepwd = true;
+ cmdp += 2;
+ break;
+ case '1':
+ page1 = true;
+ cmdp++;
+ break;
+ default:
+ PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+ errors = true;
+ break;
+ }
}
+ if (errors || !gotdata) return usage_t55xx_write();
if (block > 7) {
PrintAndLog("Block number must be between 0 and 7");
- return 1;
+ return 0;
}
UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};
UsbCommand resp;
- c.d.asBytes[0] = 0x0;
+ c.d.asBytes[0] = (page1) ? 0x2 : 0;
- PrintAndLog("Writing to block: %d data : 0x%08X", block, data);
+ PrintAndLog("Writing to page: %d block: %d data : 0x%08X", page1, block, data);
//Password mode
- if (res == 3) {
+ if (usepwd) {
c.arg[2] = password;
- c.d.asBytes[0] = 0x1;
+ c.d.asBytes[0] |= 0x1;
PrintAndLog("pwd : 0x%08X", password);
}
clearCommandBuffer();
SendCommand(&c);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
PrintAndLog("Error occurred, device did not ACK write operation. (May be due to old firmware)");
- return -1;
+ return 0;
}
- return 0;
+ return 1;
}
-int CmdT55xxReadTrace(const char *Cmd)
-{
+int CmdT55xxReadTrace(const char *Cmd) {
char cmdp = param_getchar(Cmd, 0);
-
+ bool pwdmode = false;
+ uint32_t password = 0;
if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H')
return usage_t55xx_trace();
if (strlen(Cmd)==0)
- AquireData( TRACE_BLOCK );
+ if ( !AquireData( TRACE_BLOCK, REGULAR_READ_MODE_BLOCK, pwdmode, password ) )
+ return 0;
- if (!DecodeT55xxBlock()) return 1;
+ if (!DecodeT55xxBlock()) return 0;
+
+ if ( !DemodBufferLen) return 0;
- if ( !DemodBufferLen) return 1;
-
RepaintGraphWindow();
uint8_t repeat = 0;
if (config.offset > 5)
repeat = 32;
uint8_t si = config.offset+repeat;
- uint32_t bl0 = PackBits(si, 32, DemodBuffer);
- uint32_t bl1 = PackBits(si+32, 32, DemodBuffer);
+ uint32_t bl1 = PackBits(si, 32, DemodBuffer);
+ uint32_t bl2 = PackBits(si+32, 32, DemodBuffer);
uint32_t acl = PackBits(si, 8, DemodBuffer); si += 8;
uint32_t mfc = PackBits(si, 8, DemodBuffer); si += 8;
@@ -730,11 +893,11 @@ int CmdT55xxReadTrace(const char *Cmd)
else
year += 2010;
+ if (config.Q5) PrintAndLog("*** Warning *** Info read off a Q5 will not work as expected");
if ( acl != 0xE0 ) {
PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");
- return 1;
+ return 0;
}
-
PrintAndLog("");
PrintAndLog("-- T55xx Trace Information ----------------------------------");
PrintAndLog("-------------------------------------------------------------");
@@ -749,8 +912,8 @@ int CmdT55xxReadTrace(const char *Cmd)
PrintAndLog(" Die Number : %d", dw);
PrintAndLog("-------------------------------------------------------------");
PrintAndLog(" Raw Data - Page 1");
- PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(DemodBuffer+config.offset+repeat,32) );
- PrintAndLog(" Block 1 : 0x%08X %s", bl1, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );
+ PrintAndLog(" Block 1 : 0x%08X %s", bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );
+ PrintAndLog(" Block 2 : 0x%08X %s", bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );
PrintAndLog("-------------------------------------------------------------");
/*
@@ -779,13 +942,16 @@ int CmdT55xxInfo(const char *Cmd){
Normal mode
Extended mode
*/
+ bool pwdmode = false;
+ uint32_t password = 0;
char cmdp = param_getchar(Cmd, 0);
if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H')
return usage_t55xx_info();
if (strlen(Cmd)==0)
- AquireData( CONFIGURATION_BLOCK );
+ if ( !AquireData( 0, CONFIGURATION_BLOCK, pwdmode, password ) )
+ return 1;
if (!DecodeT55xxBlock()) return 1;
@@ -808,7 +974,7 @@ int CmdT55xxInfo(const char *Cmd){
uint32_t fw = PackBits(si, 1, DemodBuffer); si += 1;
uint32_t inv = PackBits(si, 1, DemodBuffer); si += 1;
uint32_t por = PackBits(si, 1, DemodBuffer); si += 1;
-
+ if (config.Q5) PrintAndLog("*** Warning *** Config Info read off a Q5 will not display as expected");
PrintAndLog("");
PrintAndLog("-- T55xx Configuration & Tag Information --------------------");
PrintAndLog("-------------------------------------------------------------");
@@ -836,67 +1002,59 @@ int CmdT55xxInfo(const char *Cmd){
int CmdT55xxDump(const char *Cmd){
- char s[20] = {0x00};
- uint8_t pwd[4] = {0x00};
-
+ uint32_t password = 0;
char cmdp = param_getchar(Cmd, 0);
- if ( cmdp == 'h' || cmdp == 'H') {
- usage_t55xx_dump();
- return 0;
- }
-
- bool hasPwd = ( strlen(Cmd) > 0);
- if ( hasPwd ){
- if (param_gethex(Cmd, 0, pwd, 8)) {
- PrintAndLog("password must include 8 HEX symbols");
- return 1;
- }
+ bool override = false;
+ if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_dump();
+
+ bool usepwd = ( strlen(Cmd) > 0);
+ if ( usepwd ){
+ password = param_get32ex(Cmd, 0, 0, 16);
+ if (param_getchar(Cmd, 1) =='o' )
+ override = true;
}
- for ( int i = 0; i <8; ++i){
- memset(s,0,sizeof(s));
+ PrintAndLog("Reading Page 0:");
+ PrintAndLog("blk | hex data | binary");
+ for ( uint8_t i = 0; i <8; ++i){
+ T55xxReadBlock(i, 0, usepwd, override, password);
+ /*memset(s,0,sizeof(s));
if ( hasPwd ) {
- sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
+ if ( override ) {
+ sprintf(s,"b %d p %02x%02x%02x%02x o", i, pwd[0],pwd[1],pwd[2],pwd[3]);
+ } else {
+ sprintf(s,"b %d p %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
+ }
} else {
- sprintf(s,"%d", i);
+ sprintf(s,"b %d", i);
}
- CmdT55xxReadBlock(s);
+ CmdT55xxReadBlock(s);*/
}
- return 0;
+ PrintAndLog("Reading Page 1:");
+ PrintAndLog("blk | hex data | binary");
+ for ( uint8_t i = 0; i<4; i++){
+ T55xxReadBlock(i, 1, usepwd, override, password);
+ }
+ return 1;
}
-int AquireData( uint8_t block ){
+int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password ){
- UsbCommand c;
-
- if ( block == CONFIGURATION_BLOCK )
- c.cmd = CMD_T55XX_READ_BLOCK;
- else if (block == TRACE_BLOCK )
- c.cmd = CMD_T55XX_READ_TRACE;
-
- c.arg[0] = 0x00;
- c.arg[1] = 0x00;
- c.arg[2] = 0x00;
- c.d.asBytes[0] = 0x0;
-
- //Password mode
- // if ( res == 2 ) {
- // c.arg[2] = password;
- // c.d.asBytes[0] = 0x1;
- // }
+ uint8_t arg0 = (page<<1) | pwdmode;
+ UsbCommand c = {CMD_T55XX_READ_BLOCK, {arg0, block, password}};
clearCommandBuffer();
SendCommand(&c);
if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {
PrintAndLog("command execution time out");
- return 1;
+ return 0;
}
uint8_t got[12000];
GetFromBigBuf(got,sizeof(got),0);
WaitForResponse(CMD_ACK,NULL);
- setGraphBuf(got, 12000);
- return 0;
+ setGraphBuf(got, sizeof(got));
+ return 1;
}
char * GetBitRateStr(uint32_t id){
@@ -1072,17 +1230,57 @@ uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
return tmp;
}
+int CmdResetRead(const char *Cmd) {
+ UsbCommand c = {CMD_T55XX_RESET_READ, {0,0,0}};
+
+ clearCommandBuffer();
+ SendCommand(&c);
+ if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {
+ PrintAndLog("command execution time out");
+ return 0;
+ }
+
+ uint8_t got[BIGBUF_SIZE-1];
+ GetFromBigBuf(got,sizeof(got),0);
+ WaitForResponse(CMD_ACK,NULL);
+ setGraphBuf(got, sizeof(got));
+ return 1;
+}
+
+int CmdT55xxWipe(const char *Cmd) {
+ char writeData[20] = {0};
+ char *ptrData = writeData;
+ uint8_t blk = 0;
+ PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");
+ //try with the default password to reset block 0 (with a pwd should work even if pwd bit not set)
+ snprintf(ptrData,sizeof(writeData),"b %d d 00088040 p 0", blk);
+ if (!CmdT55xxWriteBlock(ptrData)){
+ PrintAndLog("Error writing blk %d", blk);
+ }
+ blk = 1;
+ for (; blk<8; blk++) {
+ snprintf(ptrData,sizeof(writeData),"b %d d 0", blk);
+ if (!CmdT55xxWriteBlock(ptrData)){
+ PrintAndLog("Error writing blk %d", blk);
+ }
+ }
+ return 0;
+}
+
static command_t CommandTable[] =
{
- {"help", CmdHelp, 1, "This help"},
- {"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
- {"detect", CmdT55xxDetect, 0, "[1] Try detecting the tag modulation from reading the configuration block."},
- {"read", CmdT55xxReadBlock, 0, "<block> [password] -- Read T55xx block data (page 0) [optional password]"},
- {"write", CmdT55xxWriteBlock,0, "<block> <data> [password] -- Write T55xx block data (page 0) [optional password]"},
- {"trace", CmdT55xxReadTrace, 0, "[1] Show T55xx traceability data (page 1/ blk 0-1)"},
- {"info", CmdT55xxInfo, 0, "[1] Show T55xx configuration data (page 0/ blk 0)"},
- {"dump", CmdT55xxDump, 0, "[password] Dump T55xx card block 0-7. [optional password]"},
- {"special", special, 0, "Show block changes with 64 different offsets"},
+ {"help", CmdHelp, 1, "This help"},
+ {"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
+ {"detect", CmdT55xxDetect, 0, "[1] Try detecting the tag modulation from reading the configuration block."},
+ {"read", CmdT55xxReadBlock, 0, "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},
+ {"resetread",CmdResetRead, 0, "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},
+ {"write", CmdT55xxWriteBlock,0, "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},
+ {"trace", CmdT55xxReadTrace, 0, "[1] Show T55x7 traceability data (page 1/ blk 0-1)"},
+ {"info", CmdT55xxInfo, 0, "[1] Show T55x7 configuration data (page 0/ blk 0)"},
+ {"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},
+ {"special", special, 0, "Show block changes with 64 different offsets"},
+ {"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},
+ {"wipe", CmdT55xxWipe, 0, "Wipe a T55xx tag and set defaults (will destroy any data on tag)"},
{NULL, NULL, 0, NULL}
};