#define REGULAR_READ_MODE_BLOCK 0xFF\r
\r
// Default configuration\r
-t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = FALSE, .offset = 0x00, .block0 = 0x00};\r
+t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = FALSE, .offset = 0x00, .block0 = 0x00, .Q5 = FALSE };\r
\r
t55xx_conf_block_t Get_t55xx_Config(){\r
return config;\r
}\r
\r
int usage_t55xx_config(){\r
- PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>]");\r
+ PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");\r
PrintAndLog("Options:");\r
PrintAndLog(" h This help");\r
- PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");\r
+ PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");\r
PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");\r
- PrintAndLog(" i [1] Invert data signal, defaults to normal");\r
- PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");\r
+ PrintAndLog(" i [1] Invert data signal, defaults to normal");\r
+ PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");\r
+ PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");\r
PrintAndLog("");\r
PrintAndLog("Examples:");\r
PrintAndLog(" lf t55xx config d FSK - FSK demodulation");\r
uint8_t bitRate = 0;\r
uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};\r
uint8_t cmdp = 0;\r
+ config.Q5 = FALSE;\r
bool errors = FALSE;\r
while(param_getchar(Cmd, cmdp) != 0x00 && !errors)\r
{\r
config.offset = offset;\r
cmdp+=2;\r
break;\r
+ case 'Q':\r
+ case 'q': \r
+ config.Q5 = TRUE;\r
+ cmdp++;\r
+ break;\r
default:\r
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
errors = TRUE;\r
save_restoreGB(1);\r
if (GetFskClock("", FALSE, FALSE)){ \r
fskClocks(&fc1, &fc2, &clk, FALSE);\r
- if ( FSKrawDemod("0 0", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate)){\r
+ if ( FSKrawDemod("0 0", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
tests[hits].modulation = DEMOD_FSK;\r
if (fc1==8 && fc2 == 5)\r
tests[hits].modulation = DEMOD_FSK1a;\r
- else if (fc1==10 && fc2 == 8)\r
+ else if (fc1==10 && fc2 == 8)\r
tests[hits].modulation = DEMOD_FSK2;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = FALSE;\r
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
++hits;\r
}\r
- if ( FSKrawDemod("0 1", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate)) {\r
+ if ( FSKrawDemod("0 1", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
tests[hits].modulation = DEMOD_FSK;\r
if (fc1 == 8 && fc2 == 5)\r
tests[hits].modulation = DEMOD_FSK1;\r
} else {\r
clk = GetAskClock("", FALSE, FALSE);\r
if (clk>0) {\r
- if ( ASKDemod("0 0 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate)) {\r
+ if ( ASKDemod("0 0 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
tests[hits].modulation = DEMOD_ASK;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = FALSE;\r
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
++hits;\r
}\r
- if ( ASKDemod("0 1 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate)) {\r
+ if ( ASKDemod("0 1 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
tests[hits].modulation = DEMOD_ASK;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = TRUE;\r
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
++hits;\r
}\r
- if ( ASKbiphaseDemod("0 0 0 0", FALSE) && test(DEMOD_BI, &tests[hits].offset, &bitRate) ) {\r
+ if ( ASKbiphaseDemod("0 0 0 0", FALSE) && test(DEMOD_BI, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r
tests[hits].modulation = DEMOD_BI;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = FALSE;\r
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
++hits;\r
}\r
- if ( ASKbiphaseDemod("0 0 1 0", FALSE) && test(DEMOD_BIa, &tests[hits].offset, &bitRate) ) {\r
+ if ( ASKbiphaseDemod("0 0 1 0", FALSE) && test(DEMOD_BIa, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r
tests[hits].modulation = DEMOD_BIa;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = TRUE;\r
save_restoreGB(0);\r
clk = GetNrzClock("", FALSE, FALSE);\r
if (clk>0) {\r
- if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate)) {\r
+ if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
tests[hits].modulation = DEMOD_NRZ;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = FALSE;\r
++hits;\r
}\r
\r
- if ( NRZrawDemod("0 1 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate)) {\r
+ if ( NRZrawDemod("0 1 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
tests[hits].modulation = DEMOD_NRZ;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = TRUE;\r
save_restoreGB(0);\r
clk = GetPskClock("", FALSE, FALSE);\r
if (clk>0) {\r
- if ( PSKDemod("0 0 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate)) {\r
+ if ( PSKDemod("0 0 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
tests[hits].modulation = DEMOD_PSK1;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = FALSE;\r
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
++hits;\r
}\r
- if ( PSKDemod("0 1 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate)) {\r
+ if ( PSKDemod("0 1 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
tests[hits].modulation = DEMOD_PSK1;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = TRUE;\r
// PSK2 - needs a call to psk1TOpsk2.\r
if ( PSKDemod("0 0 1", FALSE)) {\r
psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
- if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate)){\r
+ if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
tests[hits].modulation = DEMOD_PSK2;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = FALSE;\r
// PSK3 - needs a call to psk1TOpsk2.\r
if ( PSKDemod("0 0 1", FALSE)) {\r
psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
- if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate)){\r
+ if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
tests[hits].modulation = DEMOD_PSK3;\r
tests[hits].bitrate = bitRate;\r
tests[hits].inverted = FALSE;\r
return FALSE;\r
}\r
\r
-bool testBitRate(uint8_t readRate, uint8_t mod){\r
- uint8_t expected[8] = {8, 16, 32, 40, 50, 64, 100, 128};\r
- uint8_t detRate = 0;\r
- switch( mod ){\r
+bool testQ5Modulation(uint8_t mode, uint8_t modread){\r
+ switch( mode ){\r
case DEMOD_FSK:\r
- case DEMOD_FSK1:\r
- case DEMOD_FSK1a:\r
- case DEMOD_FSK2:\r
- case DEMOD_FSK2a:\r
- detRate = GetFskClock("",FALSE, FALSE); \r
- if (expected[readRate] == detRate) \r
- return TRUE;\r
+ if (modread >= 4 && modread <= 5) return TRUE;\r
break;\r
case DEMOD_ASK:\r
- case DEMOD_BI:\r
- case DEMOD_BIa:\r
- detRate = GetAskClock("",FALSE, FALSE); \r
- if (expected[readRate] == detRate) \r
- return TRUE;\r
+ if (modread == 0) return TRUE;\r
break;\r
case DEMOD_PSK1:\r
+ if (modread == 1) return TRUE;\r
+ break;\r
case DEMOD_PSK2:\r
+ if (modread == 2) return TRUE;\r
+ break;\r
case DEMOD_PSK3:\r
- detRate = GetPskClock("",FALSE, FALSE); \r
- if (expected[readRate] == detRate)\r
- return TRUE;\r
+ if (modread == 3) return TRUE;\r
break;\r
case DEMOD_NRZ:\r
- detRate = GetNrzClock("",FALSE, FALSE); \r
- if (expected[readRate] == detRate)\r
- return TRUE;\r
+ if (modread == 7) return TRUE;\r
+ break;\r
+ case DEMOD_BI:\r
+ if (modread == 6) return TRUE;\r
break;\r
default:\r
return FALSE;\r
return FALSE;\r
}\r
\r
-bool test(uint8_t mode, uint8_t *offset, int *fndBitRate){\r
+bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){\r
+\r
+ if ( DemodBufferLen < 64 ) return FALSE;\r
+ uint8_t si = 0;\r
+ for (uint8_t idx = 0; idx < 64; idx++){\r
+ si = idx;\r
+ if ( PackBits(si, 32, DemodBuffer) == 0x00 ) continue;\r
+\r
+ uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
+ uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;\r
+ // 2nibble must be zeroed.\r
+ // moved test to here, since this gets most faults first.\r
+ if (safer != 0x6) continue;\r
+ if ( resv > 0x00) continue;\r
+ //uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;\r
+ //uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;\r
+ si += 1+1;\r
+ int bitRate = PackBits(si, 5, DemodBuffer)*2 + 2; si += 5; //bit rate\r
+ if (bitRate > 128) continue;\r
+\r
+ si += 1+1+2+1;\r
+ //uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode\r
+ //uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1; \r
+ //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr\r
+ //uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;\r
+ uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3; //bit 24, 30, 31 could be tested for 0 if not extended mode\r
+ //uint8_t maxBlk = PackBits(si, 2, DemodBuffer); si += 2;\r
+ //uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;\r
+\r
+ //test modulation\r
+ if (!testQ5Modulation(mode, modread)) continue;\r
+ if (bitRate != clk) continue;\r
+ *fndBitRate = bitRate;\r
+ *offset = idx;\r
+\r
+ return TRUE;\r
+ }\r
+ return FALSE;\r
+}\r
+\r
+bool testBitRate(uint8_t readRate, uint8_t clk){\r
+ uint8_t expected[8] = {8, 16, 32, 40, 50, 64, 100, 128};\r
+ if (expected[readRate] == clk)\r
+ return true;\r
+\r
+ return false;\r
+}\r
+\r
+bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5){\r
\r
if ( DemodBufferLen < 64 ) return FALSE;\r
uint8_t si = 0;\r
}\r
//test modulation\r
if (!testModulation(mode, modread)) continue;\r
- if (!testBitRate(bitRate, mode)) continue;\r
+ if (!testBitRate(bitRate, clk)) continue;\r
*fndBitRate = bitRate;\r
*offset = idx;\r
+ *Q5 = FALSE;\r
+ return TRUE;\r
+ }\r
+ if (testQ5(mode, offset, fndBitRate, clk)) {\r
+ *Q5 = TRUE;\r
return TRUE;\r
}\r
return FALSE;\r
}\r
\r
int printConfiguration( t55xx_conf_block_t b){\r
+ PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");\r
PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );\r
PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate) );\r
PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );\r
else\r
year += 2010;\r
\r
+ if (config.Q5) PrintAndLog("*** Warning *** Info read off a Q5 will not work as expected");\r
if ( acl != 0xE0 ) {\r
PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");\r
return 0;\r
}\r
-\r
PrintAndLog("");\r
PrintAndLog("-- T55xx Trace Information ----------------------------------");\r
PrintAndLog("-------------------------------------------------------------");\r
uint32_t fw = PackBits(si, 1, DemodBuffer); si += 1;\r
uint32_t inv = PackBits(si, 1, DemodBuffer); si += 1; \r
uint32_t por = PackBits(si, 1, DemodBuffer); si += 1;\r
- \r
+ if (config.Q5) PrintAndLog("*** Warning *** Info read off a Q5 will not work as expected");\r
PrintAndLog("");\r
PrintAndLog("-- T55xx Configuration & Tag Information --------------------");\r
PrintAndLog("-------------------------------------------------------------");\r
return 1;\r
}\r
\r
+int CmdT55xxWipe(const char *Cmd) {\r
+ char writeData[20] = {0};\r
+ char *ptrData = writeData;\r
+ uint8_t blk = 0;\r
+ PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");\r
+ //try with the default password to reset block 0 (with a pwd should work even if pwd bit not set)\r
+ snprintf(ptrData,sizeof(writeData),"b %d d 00088040 p 0", blk);\r
+ if (!CmdT55xxWriteBlock(ptrData)){\r
+ PrintAndLog("Error writing blk %d", blk);\r
+ }\r
+ blk = 1;\r
+ for (; blk<8; blk++) {\r
+ snprintf(ptrData,sizeof(writeData),"b %d d 0", blk);\r
+ if (!CmdT55xxWriteBlock(ptrData)){\r
+ PrintAndLog("Error writing blk %d", blk);\r
+ }\r
+ }\r
+ return 0;\r
+}\r
+\r
static command_t CommandTable[] =\r
{\r
{"help", CmdHelp, 1, "This help"},\r
{"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},\r
{"special", special, 0, "Show block changes with 64 different offsets"},\r
{"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},\r
+ {"wipe", CmdT55xxWipe, 0, "Wipe a T55xx tag and set defaults (will destroy any data on tag)"},\r
{NULL, NULL, 0, NULL}\r
};\r
\r