//-----------------------------------
// EM4469 / EM4305 routines
//-----------------------------------
-#define FWD_CMD_LOGIN 0xC //including the even parity, binary mirrored
+// Below given command set.
+// Commands are including the even parity, binary mirrored
+#define FWD_CMD_LOGIN 0xC
#define FWD_CMD_WRITE 0xA
#define FWD_CMD_READ 0x9
#define FWD_CMD_DISABLE 0x5
uint8_t i;
line_parity = 0;
- for(i=0;i<6;i++) {
+ for( i=0; i<6; i++ ) {
*forward_ptr++ = addr;
line_parity ^= addr;
addr >>= 1;
//====================================================================
void SendForward(uint8_t fwd_bit_count) {
+// iceman, 21.3us increments for the USclock verification.
+// 55FC * 8us == 440us / 21.3 === 20.65 steps. could be too short. Go for 56FC instead
+// 32FC * 8us == 256us / 21.3 == 12.018 steps. ok
+// 16FC * 8us == 128us / 21.3 == 6.009 steps. ok
+
+#ifndef EM_START_GAP
+#define EM_START_GAP 56*8
+#endif
+#ifndef EM_ONE_GAP
+#define EM_ONE_GAP 32*8
+#endif
+#ifndef EM_ZERO_GAP
+# define EM_ZERO_GAP 16*8
+#endif
+
fwd_write_ptr = forwardLink_data;
fwd_bit_sz = fwd_bit_count;
- LED_D_ON();
-
// Set up FPGA, 125kHz
LFSetupFPGAForADC(95, true);
// force 1st mod pulse (start gap must be longer for 4305)
fwd_bit_sz--; //prepare next bit modulation
fwd_write_ptr++;
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
- WaitUS(55*8); //55 cycles off (8us each)for 4305 // ICEMAN: problem with (us) clock is 21.3us increments
- FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on
- WaitUS(16*8); //16 cycles on (8us each) // ICEMAN: problem with (us) clock is 21.3us increments
+
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ WaitUS(EM_START_GAP);
+
+ TurnReadLFOn(EM_ZERO_GAP);
- // now start writting
+ // now start writting with bitbanging the antenna.
while(fwd_bit_sz-- > 0) { //prepare next bit modulation
if(((*fwd_write_ptr++) & 1) == 1)
- WaitUS(32*8); //32 cycles at 125Khz (8us each) // ICEMAN: problem with (us) clock is 21.3us increments
+ WaitUS(EM_ONE_GAP);
else {
- //These timings work for 4469/4269/4305 (with the 55*8 above)
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
- WaitUS(16*8); //16-4 cycles off (8us each) // ICEMAN: problem with (us) clock is 21.3us increments
- FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on
- WaitUS(16*8); //16 cycles on (8us each) // ICEMAN: problem with (us) clock is 21.3us increments
+ //These timings work for 4469/4269/4305
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ WaitUS(EM_ZERO_GAP);
+ TurnReadLFOn(EM_ZERO_GAP);
}
}
}
-void EM4xLogin(uint32_t Password) {
-
- uint8_t fwd_bit_count;
+void EM4xLogin(uint32_t pwd) {
+ uint8_t len;
forward_ptr = forwardLink_data;
- fwd_bit_count = Prepare_Cmd( FWD_CMD_LOGIN );
- fwd_bit_count += Prepare_Data( Password&0xFFFF, Password>>16 );
- SendForward(fwd_bit_count);
-
- //Wait for command to complete
+ len = Prepare_Cmd( FWD_CMD_LOGIN );
+ len += Prepare_Data( pwd & 0xFFFF, pwd >> 16 );
+ SendForward(len);
WaitMS(20);
}
-void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
+void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd) {
- uint8_t fwd_bit_count;
- uint8_t *dest = BigBuf_get_addr();
- uint16_t bufsize = BigBuf_max_traceLen(); // ICEMAN: this tries to fill up all tracelog space
- uint32_t i = 0;
+ LED_A_ON();
- // Clear destination buffer before sending the command
+ uint8_t len;
+
+ //clear buffer now so it does not interfere with timing later
BigBuf_Clear_ext(false);
- //If password mode do login
- if (PwdMode == 1) EM4xLogin(Pwd);
+ if (usepwd) EM4xLogin(pwd);
forward_ptr = forwardLink_data;
- fwd_bit_count = Prepare_Cmd( FWD_CMD_READ );
- fwd_bit_count += Prepare_Addr( Address );
+ len = Prepare_Cmd( FWD_CMD_READ );
+ len += Prepare_Addr( addr );
- SendForward(fwd_bit_count);
+ SendForward(len);
- // Now do the acquisition
- // ICEMAN, change to the one in lfsampling.c
- i = 0;
- for(;;) {
- if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
- AT91C_BASE_SSC->SSC_THR = 0x43;
- }
- if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
- dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
- ++i;
- if (i >= bufsize) break;
- }
- }
+ DoAcquisition_config(TRUE);
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
cmd_send(CMD_ACK,0,0,0,0,0);
- LED_D_OFF();
+ LED_A_OFF();
}
-void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
+void EM4xWriteWord(uint32_t flag, uint32_t data, uint32_t pwd) {
- uint8_t fwd_bit_count;
-
- //If password mode do login
- if (PwdMode == 1) EM4xLogin(Pwd);
+ LED_A_ON();
+
+ bool usePwd = (flag & 0xF);
+ uint8_t addr = (flag >> 8) & 0xFF;
+ uint8_t len;
+
+ //clear buffer now so it does not interfere with timing later
+ BigBuf_Clear_ext(false);
+
+ if (usePwd) EM4xLogin(pwd);
forward_ptr = forwardLink_data;
- fwd_bit_count = Prepare_Cmd( FWD_CMD_WRITE );
- fwd_bit_count += Prepare_Addr( Address );
- fwd_bit_count += Prepare_Data( Data&0xFFFF, Data>>16 );
+ len = Prepare_Cmd( FWD_CMD_WRITE );
+ len += Prepare_Addr( addr );
+ len += Prepare_Data( data & 0xFFFF, data >> 16 );
- SendForward(fwd_bit_count);
+ SendForward(len);
- //Wait for write to complete
+ //Wait 20ms for write to complete
WaitMS(20);
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
- LED_D_OFF();
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ cmd_send(CMD_ACK,0,0,0,0,0);
+ LED_A_OFF();
}
/*
This triggers a COTAG tag to response
*/
void Cotag(uint32_t arg0) {
-
-#define OFF { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); WaitUS(2035); }
-#define ON(x) { FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD); WaitUS((x)); }
-
+#ifndef OFF
+# define OFF { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); WaitUS(2035); }
+#endif
+#ifndef ON
+# define ON(x) { FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD); WaitUS((x)); }
+#endif
uint8_t rawsignal = arg0 & 0xF;
LED_A_ON();
cmd_send(CMD_ACK,0,0,0,0,0);
LED_A_OFF();
}
+
+/*
+* EM4305 support
+*/
// Low frequency EM4x commands
//-----------------------------------------------------------------------------
-#include <stdio.h>
-#include <string.h>
-#include <inttypes.h>
#include "cmdlfem4x.h"
uint64_t g_em410xid = 0;
int CmdEMdemodASK(const char *Cmd)
{
char cmdp = param_getchar(Cmd, 0);
- int findone = (cmdp == '1') ? 1 : 0;
- UsbCommand c={CMD_EM410X_DEMOD};
- c.arg[0]=findone;
+ uint8_t findone = (cmdp == '1') ? 1 : 0;
+ UsbCommand c = {CMD_EM410X_DEMOD, {findone, 0, 0}};
SendCommand(&c);
return 0;
}
return 1;
}
+
+int usage_lf_em410x_sim(void) {
+ PrintAndLog("Simulating EM410x tag");
+ PrintAndLog("");
+ PrintAndLog("Usage: lf em4x em410xsim [h] <uid> <clock>");
+ PrintAndLog("Options:");
+ PrintAndLog(" h - this help");
+ PrintAndLog(" uid - uid (10 HEX symbols)");
+ PrintAndLog(" clock - clock (32|64) (optional)");
+ PrintAndLog("samples:");
+ PrintAndLog(" lf em4x em410xsim 0F0368568B");
+ PrintAndLog(" lf em4x em410xsim 0F0368568B 32");
+ return 0;
+}
+
// emulate an EM410X tag
int CmdEM410xSim(const char *Cmd)
{
uint8_t uid[5] = {0x00};
char cmdp = param_getchar(Cmd, 0);
- if (cmdp == 'h' || cmdp == 'H') {
- PrintAndLog("Usage: lf em4x em410xsim <UID> <clock>");
- PrintAndLog("");
- PrintAndLog(" sample: lf em4x em410xsim 0F0368568B");
- return 0;
- }
+ if (cmdp == 'h' || cmdp == 'H') return usage_lf_em410x_sim();
+
/* clock is 64 in EM410x tags */
uint8_t clock = 64;
PrintAndLog("UID must include 10 HEX symbols");
return 0;
}
+
param_getdec(Cmd, 1, &clock);
PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X clock: %d", uid[0],uid[1],uid[2],uid[3],uid[4],clock);
uint32_t OutputEM4x50_Block(uint8_t *BitStream, size_t size, bool verbose, bool pTest)
{
if (size<45) return 0;
+
uint32_t code = bytebits_to_byte(BitStream,8);
code = code<<8 | bytebits_to_byte(BitStream+9,8);
code = code<<8 | bytebits_to_byte(BitStream+18,8);
code = code<<8 | bytebits_to_byte(BitStream+27,8);
+
if (verbose || g_debugMode){
for (uint8_t i = 0; i<5; i++){
if (i == 4) PrintAndLog(""); //parity byte spacer
//completed by Marshmellow
int EM4x50Read(const char *Cmd, bool verbose)
{
+ /*
+ char buf[30] = {0x00};
+ char *cmdStr = buf;
+ int ans = 0;
+ bool ST = config.ST;
+ uint8_t bitRate[8] = {8,16,32,40,50,64,100,128};
+ DemodBufferLen = 0x00;
+ snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );
+ ans = ASKDemod_ext(cmdStr, FALSE, FALSE, 1, &ST);
+ snprintf(cmdStr, sizeof(buf),"0 %d %d 1", bitRate[config.bitrate], config.inverted );
+ ans = ASKbiphaseDemod(cmdStr, FALSE);
+ */
+
uint8_t fndClk[] = {8,16,32,40,50,64,128};
int clk = 0;
int invert = 0;
break;
}
}
- if (!clk) return 0;
+ if (!clk) {
+ PrintAndLog("ERROR: EM4x50 - didn't find a clock");
+ return 0;
+ }
} else tol = clk/8;
// look for data start - should be 2 pairs of LW (pulses of clk*3,clk*2)
return (int)AllPTest;
}
-int CmdEM4x50Read(const char *Cmd)
-{
+int CmdEM4x50Read(const char *Cmd) {
return EM4x50Read(Cmd, true);
}
-int CmdReadWord(const char *Cmd)
-{
- int Word = -1; //default to invalid word
- UsbCommand c;
-
- sscanf(Cmd, "%d", &Word);
-
- if ( (Word > 15) | (Word < 0) ) {
- PrintAndLog("Word must be between 0 and 15");
- return 1;
- }
-
- PrintAndLog("Reading word %d", Word);
-
- c.cmd = CMD_EM4X_READ_WORD;
- c.d.asBytes[0] = 0x0; //Normal mode
- c.arg[0] = 0;
- c.arg[1] = Word;
- c.arg[2] = 0;
- SendCommand(&c);
+int usage_lf_em_read(void) {
+ PrintAndLog("Read EM4x50. Tag must be on antenna. ");
+ PrintAndLog("");
+ PrintAndLog("Usage: lf em readword [h] <address> <pwd>");
+ PrintAndLog("Options:");
+ PrintAndLog(" h - this help");
+ PrintAndLog(" address - memory address to read. (0-15)");
+ PrintAndLog(" pwd - password (hex) (optional)");
+ PrintAndLog("samples:");
+ PrintAndLog(" lf em readword 1");
+ PrintAndLog(" lf em readword 1 11223344");
return 0;
}
-
-int CmdReadWordPWD(const char *Cmd)
-{
- int Word = -1; //default to invalid word
- int Password = 0xFFFFFFFF; //default to blank password
- UsbCommand c;
-
- sscanf(Cmd, "%d %x", &Word, &Password);
+int CmdReadWord(const char *Cmd) {
+ int addr, pwd;
+ bool usePwd = false;
+ uint8_t ctmp = param_getchar(Cmd, 0);
+ if ( strlen(Cmd) == 0 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_em_read();
+
+ addr = param_get8ex(Cmd, 0, -1, 10);
+ pwd = param_get32ex(Cmd, 1, -1, 16);
- if ( (Word > 15) | (Word < 0) ) {
- PrintAndLog("Word must be between 0 and 15");
+ if ( (addr > 15) || (addr < 0 ) || ( addr == -1) ) {
+ PrintAndLog("Address must be between 0 and 15");
return 1;
}
+ if ( pwd == -1 )
+ PrintAndLog("Reading address %d", addr);
+ else {
+ usePwd = true;
+ PrintAndLog("Reading address %d | password %08X", addr, pwd);
+ }
- PrintAndLog("Reading word %d with password %08X", Word, Password);
-
- c.cmd = CMD_EM4X_READ_WORD;
- c.d.asBytes[0] = 0x1; //Password mode
- c.arg[0] = 0;
- c.arg[1] = Word;
- c.arg[2] = Password;
+ UsbCommand c = {CMD_EM4X_READ_WORD, {addr, pwd, usePwd}};
+ clearCommandBuffer();
SendCommand(&c);
- return 0;
-}
-
-int CmdWriteWord(const char *Cmd)
-{
- int Word = 16; //default to invalid block
- int Data = 0xFFFFFFFF; //default to blank data
- UsbCommand c;
-
- sscanf(Cmd, "%x %d", &Data, &Word);
-
- if (Word > 15) {
- PrintAndLog("Word must be between 0 and 15");
- return 1;
+ UsbCommand resp;
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)){
+ PrintAndLog("Command timed out");
+ return -1;
}
- PrintAndLog("Writing word %d with data %08X", Word, Data);
-
- c.cmd = CMD_EM4X_WRITE_WORD;
- c.d.asBytes[0] = 0x0; //Normal mode
- c.arg[0] = Data;
- c.arg[1] = Word;
- c.arg[2] = 0;
- SendCommand(&c);
- return 0;
+ //uint8_t got[12288];
+ uint8_t got[30000];
+ GetFromBigBuf(got, sizeof(got), 0);
+ if ( !WaitForResponseTimeout(CMD_ACK, NULL, 8000) ) {
+ PrintAndLog("command execution time out");
+ return 0;
+ }
+ setGraphBuf(got, sizeof(got));
+ return 1;
}
-int CmdWriteWordPWD(const char *Cmd)
-{
- int Word = 16; //default to invalid word
- int Data = 0xFFFFFFFF; //default to blank data
- int Password = 0xFFFFFFFF; //default to blank password
- UsbCommand c;
+int usage_lf_em_write(void) {
+ PrintAndLog("Write EM4x50. Tag must be on antenna. ");
+ PrintAndLog("");
+ PrintAndLog("Usage: lf em writeword [h] <address> <data> <pwd>");
+ PrintAndLog("Options:");
+ PrintAndLog(" h - this help");
+ PrintAndLog(" address - memory address to write to. (0-15)");
+ PrintAndLog(" data - data to write (hex)");
+ PrintAndLog(" pwd - password (hex) (optional)");
+ PrintAndLog("samples:");
+ PrintAndLog(" lf em writeword 1");
+ PrintAndLog(" lf em writeword 1 deadc0de 11223344");
+ return 0;
+}
+int CmdWriteWord(const char *Cmd) {
+ uint8_t ctmp = param_getchar(Cmd, 0);
+ if ( strlen(Cmd) == 0 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_em_write();
+
+ bool usePwd = false;
+
+ int addr = 16; // default to invalid address
+ int data = 0xFFFFFFFF; // default to blank data
+ int pwd = 0xFFFFFFFF; // default to blank password
+
+ addr = param_get8ex(Cmd, 0, -1, 10);
+ data = param_get32ex(Cmd, 1, -1, 16);
+ pwd = param_get32ex(Cmd, 2, -1, 16);
- sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
- if (Word > 15) {
- PrintAndLog("Word must be between 0 and 15");
+ if ( (addr > 15) || (addr < 0 ) || ( addr == -1) ) {
+ PrintAndLog("Address must be between 0 and 15");
return 1;
}
+ if ( pwd == -1 )
+ PrintAndLog("Writing address %d data %08X", addr, data);
+ else {
+ usePwd = true;
+ PrintAndLog("Writing address %d data %08X using password %08X", addr, data, pwd);
+ }
- PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
+ uint16_t flag = (addr << 8 ) | usePwd;
- c.cmd = CMD_EM4X_WRITE_WORD;
- c.d.asBytes[0] = 0x1; //Password mode
- c.arg[0] = Data;
- c.arg[1] = Word;
- c.arg[2] = Password;
+ UsbCommand c = {CMD_EM4X_WRITE_WORD, {flag, data, pwd}};
+ clearCommandBuffer();
SendCommand(&c);
+ UsbCommand resp;
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
+ PrintAndLog("Error occurred, device did not respond during write operation.");
+ return -1;
+ }
return 0;
}
-static command_t CommandTable[] =
-{
- {"help", CmdHelp, 1, "This help"},
- {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
- {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag in GraphBuffer"},
- {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
- {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
- {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
- {"em410xwrite", CmdEM410xWrite, 0, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
- {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
- {"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
- {"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
- {"writeword", CmdWriteWord, 1, "<Data> <Word> -- Write EM4xxx word data"},
- {"writewordPWD", CmdWriteWordPWD, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
+static command_t CommandTable[] = {
+ {"help", CmdHelp, 1, "This help"},
+ {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
+ {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag in GraphBuffer"},
+ {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
+ {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
+ {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
+ {"em410xwrite", CmdEM410xWrite, 0, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
+ {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
+ {"readword", CmdReadWord, 1, "<word> <pwd> -- Read EM4xxx word data"},
+ {"writeword", CmdWriteWord, 1, "<sata> <word> <pwd> -- Write EM4xxx word data"},
{NULL, NULL, 0, NULL}
};
projects / proxmark3-svn / commitdiff