]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfem4x.c
Merge remote-tracking branch 'upstream/master'
[proxmark3-svn] / client / cmdlfem4x.c
CommitLineData
a553f267 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// Low frequency EM4x commands
9//-----------------------------------------------------------------------------
10
7fe9b0b7 11#include <stdio.h>
9e13f875 12#include <string.h>
ec564290 13#include <inttypes.h>
902cb3c0 14#include "proxmark3.h"
7fe9b0b7 15#include "ui.h"
3fe4ff4f 16#include "util.h"
7fe9b0b7 17#include "graph.h"
18#include "cmdparser.h"
19#include "cmddata.h"
20#include "cmdlf.h"
21#include "cmdlfem4x.h"
c3bfb9c7 22char *global_em410xId;
7fe9b0b7 23
24static int CmdHelp(const char *Cmd);
25
66707a3b 26int CmdEMdemodASK(const char *Cmd)
27{
3fe4ff4f 28 char cmdp = param_getchar(Cmd, 0);
29 int findone = (cmdp == '1') ? 1 : 0;
66707a3b 30 UsbCommand c={CMD_EM410X_DEMOD};
66707a3b 31 c.arg[0]=findone;
32 SendCommand(&c);
33 return 0;
34}
35
7fe9b0b7 36/* Read the ID of an EM410x tag.
37 * Format:
38 * 1111 1111 1 <-- standard non-repeatable header
39 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
40 * ....
41 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
42 * 0 <-- stop bit, end of tag
43 */
44int CmdEM410xRead(const char *Cmd)
45{
46 int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
47 int parity[4];
3fe4ff4f 48 char id[11] = {0x00};
49 char id2[11] = {0x00};
7fe9b0b7 50 int retested = 0;
15cdabd4 51 uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
7fe9b0b7 52 high = low = 0;
53
54 /* Detect high and lows and clock */
55 for (i = 0; i < GraphTraceLen; i++)
56 {
57 if (GraphBuffer[i] > high)
58 high = GraphBuffer[i];
59 else if (GraphBuffer[i] < low)
60 low = GraphBuffer[i];
61 }
62
63 /* get clock */
f3bf15e4 64 clock = GetAskClock(Cmd, false, false);
7fe9b0b7 65
66 /* parity for our 4 columns */
67 parity[0] = parity[1] = parity[2] = parity[3] = 0;
68 header = rows = 0;
69
c3bfb9c7 70 // manchester demodulate
7fe9b0b7 71 bit = bit2idx = 0;
72 for (i = 0; i < (int)(GraphTraceLen / clock); i++)
73 {
74 hithigh = 0;
75 hitlow = 0;
76 first = 1;
77
78 /* Find out if we hit both high and low peaks */
79 for (j = 0; j < clock; j++)
80 {
c3bfb9c7 81 if (GraphBuffer[(i * clock) + j] >= high)
7fe9b0b7 82 hithigh = 1;
c3bfb9c7 83 else if (GraphBuffer[(i * clock) + j] <= low)
7fe9b0b7 84 hitlow = 1;
85
86 /* it doesn't count if it's the first part of our read
87 because it's really just trailing from the last sequence */
88 if (first && (hithigh || hitlow))
89 hithigh = hitlow = 0;
90 else
91 first = 0;
92
93 if (hithigh && hitlow)
94 break;
95 }
96
97 /* If we didn't hit both high and low peaks, we had a bit transition */
98 if (!hithigh || !hitlow)
99 bit ^= 1;
100
101 BitStream[bit2idx++] = bit;
102 }
103
104retest:
105 /* We go till 5 before the graph ends because we'll get that far below */
106 for (i = 1; i < bit2idx - 5; i++)
107 {
108 /* Step 2: We have our header but need our tag ID */
109 if (header == 9 && rows < 10)
110 {
111 /* Confirm parity is correct */
112 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
113 {
114 /* Read another byte! */
115 sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
cb967ea9 116 sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i]));
7fe9b0b7 117 rows++;
118
119 /* Keep parity info */
120 parity[0] ^= BitStream[i];
121 parity[1] ^= BitStream[i+1];
122 parity[2] ^= BitStream[i+2];
123 parity[3] ^= BitStream[i+3];
124
125 /* Move 4 bits ahead */
126 i += 4;
127 }
128
129 /* Damn, something wrong! reset */
130 else
131 {
132 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
133
134 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
135 i -= 9 + (5 * rows) - 5;
136
137 rows = header = 0;
138 }
139 }
140
141 /* Step 3: Got our 40 bits! confirm column parity */
142 else if (rows == 10)
143 {
144 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
145 if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
146 BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
147 BitStream[i+4] == 0)
148 {
149 /* Sweet! */
150 PrintAndLog("EM410x Tag ID: %s", id);
cb967ea9 151 PrintAndLog("Unique Tag ID: %s", id2);
7fe9b0b7 152
c3bfb9c7 153 global_em410xId = id;
154
7fe9b0b7 155 /* Stop any loops */
156 return 1;
157 }
158
159 /* Crap! Incorrect parity or no stop bit, start all over */
160 else
161 {
162 rows = header = 0;
163
164 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
165 i -= 59;
166 }
167 }
168
169 /* Step 1: get our header */
170 else if (header < 9)
171 {
172 /* Need 9 consecutive 1's */
173 if (BitStream[i] == 1)
174 header++;
175
176 /* We don't have a header, not enough consecutive 1 bits */
177 else
178 header = 0;
179 }
180 }
181
182 /* if we've already retested after flipping bits, return */
c3bfb9c7 183 if (retested++){
184 PrintAndLog("Failed to decode");
7fe9b0b7 185 return 0;
c3bfb9c7 186 }
7fe9b0b7 187
188 /* if this didn't work, try flipping bits */
189 for (i = 0; i < bit2idx; i++)
190 BitStream[i] ^= 1;
191
192 goto retest;
193}
194
195/* emulate an EM410X tag
196 * Format:
197 * 1111 1111 1 <-- standard non-repeatable header
198 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
199 * ....
200 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
201 * 0 <-- stop bit, end of tag
202 */
203int CmdEM410xSim(const char *Cmd)
204{
3fe4ff4f 205 int i, n, j, binary[4], parity[4];
206
207 char cmdp = param_getchar(Cmd, 0);
208 uint8_t uid[5] = {0x00};
209
210 if (cmdp == 'h' || cmdp == 'H') {
211 PrintAndLog("Usage: lf em4x 410xsim <UID>");
212 PrintAndLog("");
213 PrintAndLog(" sample: lf em4x 410xsim 0F0368568B");
214 return 0;
215 }
216
217 if (param_gethex(Cmd, 0, uid, 10)) {
218 PrintAndLog("UID must include 10 HEX symbols");
219 return 0;
220 }
221
222 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
223 PrintAndLog("Press pm3-button to about simulation");
7fe9b0b7 224
225 /* clock is 64 in EM410x tags */
226 int clock = 64;
227
228 /* clear our graph */
229 ClearGraph(0);
230
7fe9b0b7 231 /* write 9 start bits */
232 for (i = 0; i < 9; i++)
233 AppendGraph(0, clock, 1);
234
235 /* for each hex char */
236 parity[0] = parity[1] = parity[2] = parity[3] = 0;
237 for (i = 0; i < 10; i++)
238 {
239 /* read each hex char */
240 sscanf(&Cmd[i], "%1x", &n);
241 for (j = 3; j >= 0; j--, n/= 2)
242 binary[j] = n % 2;
243
244 /* append each bit */
245 AppendGraph(0, clock, binary[0]);
246 AppendGraph(0, clock, binary[1]);
247 AppendGraph(0, clock, binary[2]);
248 AppendGraph(0, clock, binary[3]);
249
250 /* append parity bit */
251 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
252
253 /* keep track of column parity */
254 parity[0] ^= binary[0];
255 parity[1] ^= binary[1];
256 parity[2] ^= binary[2];
257 parity[3] ^= binary[3];
258 }
259
260 /* parity columns */
261 AppendGraph(0, clock, parity[0]);
262 AppendGraph(0, clock, parity[1]);
263 AppendGraph(0, clock, parity[2]);
264 AppendGraph(0, clock, parity[3]);
265
266 /* stop bit */
3fe4ff4f 267 AppendGraph(1, clock, 0);
268
269 CmdLFSim("240"); //240 start_gap.
7fe9b0b7 270 return 0;
271}
272
3fe4ff4f 273/* Function is equivalent of lf read + data samples + em410xread
274 * looped until an EM410x tag is detected
275 *
276 * Why is CmdSamples("16000")?
277 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
278 * rate gets lower, then grow the number of samples
279 * Changed by martin, 4000 x 4 = 16000,
280 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
281
282*/
7fe9b0b7 283int CmdEM410xWatch(const char *Cmd)
284{
3fe4ff4f 285 char cmdp = param_getchar(Cmd, 0);
286 int read_h = (cmdp == 'h');
287 do {
288 if (ukbhit()) {
289 printf("\naborted via keyboard!\n");
290 break;
291 }
292
293 CmdLFRead(read_h ? "h" : "");
294 CmdSamples("6000");
295 } while (
296 !CmdEM410xRead("")
297 );
298 return 0;
7fe9b0b7 299}
300
c3bfb9c7 301int CmdEM410xWatchnSpoof(const char *Cmd)
302{
303 CmdEM410xWatch(Cmd);
304 PrintAndLog("# Replaying : %s",global_em410xId);
305 CmdEM410xSim(global_em410xId);
306 return 0;
307}
308
7fe9b0b7 309/* Read the transmitted data of an EM4x50 tag
310 * Format:
311 *
312 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
313 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
314 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
315 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
316 * CCCCCCCC <- column parity bits
317 * 0 <- stop bit
318 * LW <- Listen Window
319 *
320 * This pattern repeats for every block of data being transmitted.
321 * Transmission starts with two Listen Windows (LW - a modulated
322 * pattern of 320 cycles each (32/32/128/64/64)).
323 *
324 * Note that this data may or may not be the UID. It is whatever data
325 * is stored in the blocks defined in the control word First and Last
326 * Word Read values. UID is stored in block 32.
327 */
328int CmdEM4x50Read(const char *Cmd)
329{
31b6e9af 330 int i, j, startblock, skip, block, start, end, low, high;
7fe9b0b7 331 bool complete= false;
332 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
333 char tmp[6];
334
335 high= low= 0;
913d23c6 336 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
7fe9b0b7 337
338 /* first get high and low values */
339 for (i = 0; i < GraphTraceLen; i++)
340 {
341 if (GraphBuffer[i] > high)
342 high = GraphBuffer[i];
343 else if (GraphBuffer[i] < low)
344 low = GraphBuffer[i];
345 }
346
347 /* populate a buffer with pulse lengths */
348 i= 0;
349 j= 0;
350 while (i < GraphTraceLen)
351 {
352 // measure from low to low
353 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
354 ++i;
355 start= i;
356 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
357 ++i;
358 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
359 ++i;
90e278d3 360 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
7fe9b0b7 361 break;
362 }
363 tmpbuff[j++]= i - start;
364 }
365
366 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
367 start= -1;
368 skip= 0;
369 for (i= 0; i < j - 4 ; ++i)
370 {
371 skip += tmpbuff[i];
372 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
373 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
374 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
375 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
376 {
377 start= i + 3;
378 break;
379 }
380 }
381 startblock= i + 3;
382
383 /* skip over the remainder of the LW */
384 skip += tmpbuff[i+1]+tmpbuff[i+2];
385 while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
386 ++skip;
387 skip += 8;
388
389 /* now do it again to find the end */
390 end= start;
391 for (i += 3; i < j - 4 ; ++i)
392 {
393 end += tmpbuff[i];
394 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
395 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
396 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
397 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
398 {
399 complete= true;
400 break;
401 }
402 }
403
404 if (start >= 0)
405 PrintAndLog("Found data at sample: %i",skip);
406 else
407 {
408 PrintAndLog("No data found!");
409 PrintAndLog("Try again with more samples.");
410 return 0;
411 }
412
413 if (!complete)
414 {
415 PrintAndLog("*** Warning!");
416 PrintAndLog("Partial data - no end found!");
417 PrintAndLog("Try again with more samples.");
418 }
419
420 /* get rid of leading crap */
421 sprintf(tmp,"%i",skip);
422 CmdLtrim(tmp);
423
424 /* now work through remaining buffer printing out data blocks */
425 block= 0;
426 i= startblock;
427 while (block < 6)
428 {
429 PrintAndLog("Block %i:", block);
430 // mandemod routine needs to be split so we can call it for data
431 // just print for now for debugging
432 CmdManchesterDemod("i 64");
433 skip= 0;
434 /* look for LW before start of next block */
435 for ( ; i < j - 4 ; ++i)
436 {
437 skip += tmpbuff[i];
438 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
439 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
440 break;
441 }
442 while (GraphBuffer[skip] > low)
443 ++skip;
444 skip += 8;
445 sprintf(tmp,"%i",skip);
446 CmdLtrim(tmp);
447 start += skip;
448 block++;
449 }
450 return 0;
451}
452
2d4eae76 453int CmdEM410xWrite(const char *Cmd)
454{
e67b06b7 455 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
7bb9d33e 456 int card = 0xFF; // invalid card value
e67b06b7 457 unsigned int clock = 0; // invalid clock value
458
459 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
460
461 // Check ID
462 if (id == 0xFFFFFFFFFFFFFFFF) {
463 PrintAndLog("Error! ID is required.\n");
464 return 0;
465 }
466 if (id >= 0x10000000000) {
467 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
468 return 0;
469 }
470
471 // Check Card
472 if (card == 0xFF) {
473 PrintAndLog("Error! Card type required.\n");
474 return 0;
475 }
476 if (card < 0) {
477 PrintAndLog("Error! Bad card type selected.\n");
478 return 0;
479 }
480
481 // Check Clock
482 if (card == 1)
483 {
484 // Default: 64
485 if (clock == 0)
486 clock = 64;
487
488 // Allowed clock rates: 16, 32 and 64
489 if ((clock != 16) && (clock != 32) && (clock != 64)) {
490 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
491 return 0;
492 }
493 }
494 else if (clock != 0)
495 {
496 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
497 return 0;
498 }
499
500 if (card == 1) {
501 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
502 // NOTE: We really should pass the clock in as a separate argument, but to
503 // provide for backwards-compatibility for older firmware, and to avoid
504 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
505 // the clock rate in bits 8-15 of the card value
506 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
507 }
508 else if (card == 0)
509 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
510 else {
511 PrintAndLog("Error! Bad card type selected.\n");
512 return 0;
513 }
2d4eae76 514
2d4eae76 515 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
516 SendCommand(&c);
517
518 return 0;
519}
520
54a942b0 521int CmdReadWord(const char *Cmd)
522{
b915fda3 523 int Word = -1; //default to invalid word
54a942b0 524 UsbCommand c;
525
526 sscanf(Cmd, "%d", &Word);
527
b915fda3 528 if ( (Word > 15) | (Word < 0) ) {
54a942b0 529 PrintAndLog("Word must be between 0 and 15");
530 return 1;
531 }
532
533 PrintAndLog("Reading word %d", Word);
534
535 c.cmd = CMD_EM4X_READ_WORD;
536 c.d.asBytes[0] = 0x0; //Normal mode
537 c.arg[0] = 0;
538 c.arg[1] = Word;
539 c.arg[2] = 0;
540 SendCommand(&c);
541 return 0;
542}
543
544int CmdReadWordPWD(const char *Cmd)
545{
b915fda3 546 int Word = -1; //default to invalid word
54a942b0 547 int Password = 0xFFFFFFFF; //default to blank password
548 UsbCommand c;
549
550 sscanf(Cmd, "%d %x", &Word, &Password);
551
b915fda3 552 if ( (Word > 15) | (Word < 0) ) {
54a942b0 553 PrintAndLog("Word must be between 0 and 15");
554 return 1;
555 }
556
557 PrintAndLog("Reading word %d with password %08X", Word, Password);
558
559 c.cmd = CMD_EM4X_READ_WORD;
560 c.d.asBytes[0] = 0x1; //Password mode
561 c.arg[0] = 0;
562 c.arg[1] = Word;
563 c.arg[2] = Password;
564 SendCommand(&c);
565 return 0;
566}
567
568int CmdWriteWord(const char *Cmd)
569{
570 int Word = 16; //default to invalid block
571 int Data = 0xFFFFFFFF; //default to blank data
572 UsbCommand c;
573
574 sscanf(Cmd, "%x %d", &Data, &Word);
575
576 if (Word > 15) {
577 PrintAndLog("Word must be between 0 and 15");
578 return 1;
579 }
580
b915fda3 581 PrintAndLog("Writing word %d with data %08X", Word, Data);
54a942b0 582
583 c.cmd = CMD_EM4X_WRITE_WORD;
584 c.d.asBytes[0] = 0x0; //Normal mode
585 c.arg[0] = Data;
586 c.arg[1] = Word;
587 c.arg[2] = 0;
588 SendCommand(&c);
589 return 0;
590}
591
592int CmdWriteWordPWD(const char *Cmd)
593{
b915fda3 594 int Word = 16; //default to invalid word
54a942b0 595 int Data = 0xFFFFFFFF; //default to blank data
596 int Password = 0xFFFFFFFF; //default to blank password
597 UsbCommand c;
598
599 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
600
601 if (Word > 15) {
602 PrintAndLog("Word must be between 0 and 15");
603 return 1;
604 }
605
b915fda3 606 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
54a942b0 607
608 c.cmd = CMD_EM4X_WRITE_WORD;
609 c.d.asBytes[0] = 0x1; //Password mode
610 c.arg[0] = Data;
611 c.arg[1] = Word;
612 c.arg[2] = Password;
613 SendCommand(&c);
614 return 0;
615}
616
2d4eae76 617static command_t CommandTable[] =
7fe9b0b7 618{
54a942b0 619 {"help", CmdHelp, 1, "This help"},
4118b74d 620 {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
54a942b0 621 {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
622 {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
e67b06b7 623 {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
c3bfb9c7 624 {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
e67b06b7 625 {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
54a942b0 626 {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
627 {"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
628 {"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
629 {"writeword", CmdWriteWord, 1, "<Data> <Word> -- Write EM4xxx word data"},
630 {"writewordPWD", CmdWriteWordPWD, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
7fe9b0b7 631 {NULL, NULL, 0, NULL}
632};
633
634int CmdLFEM4X(const char *Cmd)
635{
636 CmdsParse(CommandTable, Cmd);
637 return 0;
638}
639
640int CmdHelp(const char *Cmd)
641{
642 CmdsHelp(CommandTable);
643 return 0;
644}
Impressum, Datenschutz