From: marshmellow42 Date: Mon, 20 Feb 2017 14:50:00 +0000 (-0500) Subject: add em4x05 info command X-Git-Tag: v3.0.0~69^2~8 X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/fa1e00cfbbabec0580adc94f799a44068d05296f add em4x05 info command plus some minor adjustments and added a quick em4x05 test: bool EM4x05Block0Test(uint32_t *wordData) if successful very likely the tag is an em4x05 or compatible... --- diff --git a/armsrc/lfops.c b/armsrc/lfops.c index 2ddd2a06..87b21efc 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -1573,14 +1573,14 @@ void SendForward(uint8_t fwd_bit_count) { // Set up FPGA, 125kHz LFSetupFPGAForADC(95, true); - + // force 1st mod pulse (start gap must be longer for 4305) fwd_bit_sz--; //prepare next bit modulation fwd_write_ptr++; FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off - SpinDelayUs(55*8); //55 cycles off (8us each)for 4305 + SpinDelayUs(56*8); //55 cycles off (8us each)for 4305 /another reader has 37 here... FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on - SpinDelayUs(16*8); //16 cycles on (8us each) + SpinDelayUs(18*8); //16 cycles on (8us each) // another reader has 18 here // now start writting while(fwd_bit_sz-- > 0) { //prepare next bit modulation @@ -1589,9 +1589,9 @@ void SendForward(uint8_t fwd_bit_count) { else { //These timings work for 4469/4269/4305 (with the 55*8 above) FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off - SpinDelayUs(20*8); //16-4 cycles off (8us each) //23 + SpinDelayUs(23*8); //16-4 cycles off (8us each) //23 //one reader goes as high as 25 here FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on - SpinDelayUs(12*8); //16 cycles on (8us each) //9 + SpinDelayUs(16*8); //16 cycles on (8us each) //9 // another reader goes to 17 here } } } diff --git a/client/cmdlfem4x.c b/client/cmdlfem4x.c index 8e535b9a..6781b03d 100644 --- a/client/cmdlfem4x.c +++ b/client/cmdlfem4x.c @@ -648,7 +648,7 @@ int demodEM4x05resp(uint32_t *word, bool readCmd) { return -1; } -int EM4x05ReadWord(uint8_t addr, uint32_t pwd, bool usePwd) { +int EM4x05ReadWord_ext(uint8_t addr, uint32_t pwd, bool usePwd, uint32_t *wordData) { UsbCommand c = {CMD_EM4X_READ_WORD, {addr, pwd, usePwd}}; clearCommandBuffer(); SendCommand(&c); @@ -666,12 +666,16 @@ int EM4x05ReadWord(uint8_t addr, uint32_t pwd, bool usePwd) { return -1; } //attempt demod: + return demodEM4x05resp(wordData, true); +} + +int EM4x05ReadWord(uint8_t addr, uint32_t pwd, bool usePwd) { uint32_t wordData = 0; - int success = demodEM4x05resp(&wordData, true); + int success = EM4x05ReadWord_ext(addr, pwd, usePwd, &wordData); if (success == 1) PrintAndLog(" Got Address %02d | %08X",addr,wordData); else - PrintAndLog("RSead Address %02d | failed",addr); + PrintAndLog("Read Address %02d | failed",addr); return success; } @@ -808,6 +812,74 @@ int CmdEM4x05WriteWord(const char *Cmd) { return result; } +void printEM4x05info(uint8_t chipType, uint8_t cap, uint16_t custCode, uint32_t serial) { + switch (chipType) { + case 9: PrintAndLog("\nChip Type: %u | EM4305", chipType); break; + case 4: PrintAndLog("Chip Type: %u | Unknown", chipType); break; + case 2: PrintAndLog("Chip Type: %u | EM4469", chipType); break; + //add more here when known + default: PrintAndLog("Chip Type: %u Unknown", chipType); break; + } + + switch (cap) { + case 3: PrintAndLog(" Cap Type: %u | 330pF",cap); break; + case 2: PrintAndLog(" Cap Type: %u | 210pF",cap); break; + case 1: PrintAndLog(" Cap Type: %u | 250pF",cap); break; + default: PrintAndLog(" Cap Type: %u | unknown",cap); break; + } + + PrintAndLog("Cust Code: %03u | %s", custCode, (custCode == 0x200) ? "Default": "Unknown"); + if (serial != 0) { + PrintAndLog("\n Serial #: %08X\n", serial); + } +} + +//quick test for EM4x05/EM4x69 tag +bool EM4x05Block0Test(uint32_t *wordData) { + if (EM4x05ReadWord_ext(0,0,false,wordData) == 1) { + return true; + } + return false; +} + +int CmdEM4x05info(const char *Cmd) { + //uint8_t addr = 0; + //uint32_t pwd; + uint32_t wordData = 0; + // bool usePwd = false; + uint8_t ctmp = param_getchar(Cmd, 0); + if ( ctmp == 'H' || ctmp == 'h' ) return usage_lf_em_dump(); + + // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) + //pwd = param_get32ex(Cmd, 0, 1, 16); + + //if ( pwd != 1 ) { + // usePwd = true; + //} + int success = 1; + // read blk 0 + + //block 0 can be read even without a password. + if ( !EM4x05Block0Test(&wordData) ) + return -1; + + uint8_t chipType = (wordData >> 1) & 0xF; + uint8_t cap = (wordData >> 5) & 3; + uint16_t custCode = (wordData >> 9) & 0x3FF; + + wordData = 0; + if (EM4x05ReadWord_ext(1, 0, false, &wordData) != 1) { + //failed, but continue anyway... + } + printEM4x05info(chipType, cap, custCode, wordData); + + // add read block 4 and read out config if successful + // needs password if one is set + + return success; +} + + static command_t CommandTable[] = { {"help", CmdHelp, 1, "This help"}, @@ -817,9 +889,10 @@ static command_t CommandTable[] = {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"}, {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" }, {"410xwrite", CmdEM410xWrite, 0, " <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"}, - {"4x05dump", CmdEM4x05dump, 1, "(pwd) -- Read EM4x05/EM4x69 all word data"}, - {"4x05readword", CmdEM4x05ReadWord, 1, " (pwd) -- Read EM4x05/EM4x69 word data"}, - {"4x05writeword", CmdEM4x05WriteWord, 1, " (pwd) -- Write EM4x05/EM4x69 word data"}, + {"4x05dump", CmdEM4x05dump, 0, "(pwd) -- Read EM4x05/EM4x69 all word data"}, + {"4x05info", CmdEM4x05info, 0, "(pwd) -- Get info from EM4x05/EM4x69 tag"}, + {"4x05readword", CmdEM4x05ReadWord, 0, " (pwd) -- Read EM4x05/EM4x69 word data"}, + {"4x05writeword", CmdEM4x05WriteWord, 0, " (pwd) -- Write EM4x05/EM4x69 word data"}, {"4x50read", CmdEM4x50Read, 1, "demod data from EM4x50 tag from the graph buffer"}, {NULL, NULL, 0, NULL} };