]>
Commit | Line | Data |
---|---|---|
a553f267 | 1 | //----------------------------------------------------------------------------- |
2 | // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // Low frequency EM4x commands | |
9 | //----------------------------------------------------------------------------- | |
10 | ||
7fe9b0b7 | 11 | #include <stdio.h> |
9e13f875 | 12 | #include <string.h> |
ec564290 | 13 | #include <inttypes.h> |
2b4898ec | 14 | #include "cmdlfem4x.h" |
902cb3c0 | 15 | #include "proxmark3.h" |
7fe9b0b7 | 16 | #include "ui.h" |
3fe4ff4f | 17 | #include "util.h" |
acf0582d | 18 | #include "data.h" |
7fe9b0b7 | 19 | #include "graph.h" |
20 | #include "cmdparser.h" | |
21 | #include "cmddata.h" | |
22 | #include "cmdlf.h" | |
7666f460 | 23 | #include "cmdmain.h" |
23f0a7d8 | 24 | #include "lfdemod.h" |
4ab135c0 | 25 | #include "protocols.h" |
50acfd37 | 26 | #include "util_posix.h" |
6ac4cb27 | 27 | |
35aa230e | 28 | uint64_t g_em410xId=0; |
7fe9b0b7 | 29 | |
30 | static int CmdHelp(const char *Cmd); | |
31 | ||
66707a3b | 32 | int CmdEMdemodASK(const char *Cmd) |
33 | { | |
3fe4ff4f | 34 | char cmdp = param_getchar(Cmd, 0); |
cc15a118 | 35 | int findone = (cmdp == '1') ? 1 : 0; |
23f0a7d8 | 36 | UsbCommand c={CMD_EM410X_DEMOD}; |
37 | c.arg[0]=findone; | |
38 | SendCommand(&c); | |
39 | return 0; | |
66707a3b | 40 | } |
41 | ||
35aa230e | 42 | //by marshmellow |
43 | //print 64 bit EM410x ID in multiple formats | |
44 | void printEM410x(uint32_t hi, uint64_t id) | |
45 | { | |
46 | if (id || hi){ | |
47 | uint64_t iii=1; | |
48 | uint64_t id2lo=0; | |
49 | uint32_t ii=0; | |
50 | uint32_t i=0; | |
51 | for (ii=5; ii>0;ii--){ | |
52 | for (i=0;i<8;i++){ | |
53 | id2lo=(id2lo<<1LL) | ((id & (iii << (i+((ii-1)*8)))) >> (i+((ii-1)*8))); | |
54 | } | |
55 | } | |
56 | if (hi){ | |
57 | //output 88 bit em id | |
58 | PrintAndLog("\nEM TAG ID : %06X%016" PRIX64, hi, id); | |
59 | } else{ | |
60 | //output 40 bit em id | |
61 | PrintAndLog("\nEM TAG ID : %010" PRIX64, id); | |
62 | PrintAndLog("\nPossible de-scramble patterns"); | |
63 | PrintAndLog("Unique TAG ID : %010" PRIX64, id2lo); | |
64 | PrintAndLog("HoneyWell IdentKey {"); | |
65 | PrintAndLog("DEZ 8 : %08" PRIu64,id & 0xFFFFFF); | |
66 | PrintAndLog("DEZ 10 : %010" PRIu64,id & 0xFFFFFFFF); | |
67 | PrintAndLog("DEZ 5.5 : %05lld.%05" PRIu64,(id>>16LL) & 0xFFFF,(id & 0xFFFF)); | |
68 | PrintAndLog("DEZ 3.5A : %03lld.%05" PRIu64,(id>>32ll),(id & 0xFFFF)); | |
69 | PrintAndLog("DEZ 3.5B : %03lld.%05" PRIu64,(id & 0xFF000000) >> 24,(id & 0xFFFF)); | |
70 | PrintAndLog("DEZ 3.5C : %03lld.%05" PRIu64,(id & 0xFF0000) >> 16,(id & 0xFFFF)); | |
71 | PrintAndLog("DEZ 14/IK2 : %014" PRIu64,id); | |
72 | PrintAndLog("DEZ 15/IK3 : %015" PRIu64,id2lo); | |
73 | PrintAndLog("DEZ 20/ZK : %02" PRIu64 "%02" PRIu64 "%02" PRIu64 "%02" PRIu64 "%02" PRIu64 "%02" PRIu64 "%02" PRIu64 "%02" PRIu64 "%02" PRIu64 "%02" PRIu64, | |
74 | (id2lo & 0xf000000000) >> 36, | |
75 | (id2lo & 0x0f00000000) >> 32, | |
76 | (id2lo & 0x00f0000000) >> 28, | |
77 | (id2lo & 0x000f000000) >> 24, | |
78 | (id2lo & 0x0000f00000) >> 20, | |
79 | (id2lo & 0x00000f0000) >> 16, | |
80 | (id2lo & 0x000000f000) >> 12, | |
81 | (id2lo & 0x0000000f00) >> 8, | |
82 | (id2lo & 0x00000000f0) >> 4, | |
83 | (id2lo & 0x000000000f) | |
84 | ); | |
85 | uint64_t paxton = (((id>>32) << 24) | (id & 0xffffff)) + 0x143e00; | |
47af8c5f | 86 | PrintAndLog("}\nOther : %05" PRIu64 "_%03" PRIu64 "_%08" PRIu64 "",(id&0xFFFF),((id>>16LL) & 0xFF),(id & 0xFFFFFF)); |
35aa230e | 87 | PrintAndLog("Pattern Paxton : %" PRIu64 " [0x%" PRIX64 "]", paxton, paxton); |
88 | ||
89 | uint32_t p1id = (id & 0xFFFFFF); | |
90 | uint8_t arr[32] = {0x00}; | |
47af8c5f | 91 | int i =0; |
35aa230e | 92 | int j = 23; |
93 | for (; i < 24; ++i, --j ){ | |
94 | arr[i] = (p1id >> i) & 1; | |
95 | } | |
96 | ||
97 | uint32_t p1 = 0; | |
98 | ||
99 | p1 |= arr[23] << 21; | |
100 | p1 |= arr[22] << 23; | |
101 | p1 |= arr[21] << 20; | |
102 | p1 |= arr[20] << 22; | |
47af8c5f | 103 | |
35aa230e | 104 | p1 |= arr[19] << 18; |
105 | p1 |= arr[18] << 16; | |
106 | p1 |= arr[17] << 19; | |
107 | p1 |= arr[16] << 17; | |
47af8c5f | 108 | |
35aa230e | 109 | p1 |= arr[15] << 13; |
110 | p1 |= arr[14] << 15; | |
111 | p1 |= arr[13] << 12; | |
112 | p1 |= arr[12] << 14; | |
113 | ||
114 | p1 |= arr[11] << 6; | |
115 | p1 |= arr[10] << 2; | |
116 | p1 |= arr[9] << 7; | |
117 | p1 |= arr[8] << 1; | |
118 | ||
119 | p1 |= arr[7] << 0; | |
120 | p1 |= arr[6] << 8; | |
121 | p1 |= arr[5] << 11; | |
122 | p1 |= arr[4] << 3; | |
123 | ||
124 | p1 |= arr[3] << 10; | |
125 | p1 |= arr[2] << 4; | |
126 | p1 |= arr[1] << 5; | |
127 | p1 |= arr[0] << 9; | |
128 | PrintAndLog("Pattern 1 : %d [0x%X]", p1, p1); | |
129 | ||
130 | uint16_t sebury1 = id & 0xFFFF; | |
131 | uint8_t sebury2 = (id >> 16) & 0x7F; | |
132 | uint32_t sebury3 = id & 0x7FFFFF; | |
133 | PrintAndLog("Pattern Sebury : %d %d %d [0x%X 0x%X 0x%X]", sebury1, sebury2, sebury3, sebury1, sebury2, sebury3); | |
134 | } | |
135 | } | |
136 | return; | |
137 | } | |
138 | ||
7fe9b0b7 | 139 | /* Read the ID of an EM410x tag. |
140 | * Format: | |
141 | * 1111 1111 1 <-- standard non-repeatable header | |
142 | * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID | |
143 | * .... | |
144 | * CCCC <-- each bit here is parity for the 10 bits above in corresponding column | |
145 | * 0 <-- stop bit, end of tag | |
146 | */ | |
35aa230e | 147 | int AskEm410xDecode(bool verbose, uint32_t *hi, uint64_t *lo ) |
7fe9b0b7 | 148 | { |
35aa230e | 149 | size_t idx = 0; |
b9957414 | 150 | uint8_t BitStream[512]={0}; |
151 | size_t BitLen = sizeof(BitStream); | |
152 | if ( !getDemodBuf(BitStream, &BitLen) ) return 0; | |
153 | ||
154 | if (Em410xDecode(BitStream, &BitLen, &idx, hi, lo)) { | |
35aa230e | 155 | //set GraphBuffer for clone or sim command |
b8fdac9e | 156 | setDemodBuf(DemodBuffer, (BitLen==40) ? 64 : 128, idx+1); |
9fe4507c | 157 | setClockGrid(g_DemodClock, g_DemodStartIdx + ((idx+1)*g_DemodClock)); |
158 | ||
b9957414 | 159 | if (g_debugMode) { |
35aa230e | 160 | PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, BitLen); |
161 | printDemodBuff(); | |
162 | } | |
b9957414 | 163 | if (verbose) { |
35aa230e | 164 | PrintAndLog("EM410x pattern found: "); |
165 | printEM410x(*hi, *lo); | |
166 | g_em410xId = *lo; | |
167 | } | |
168 | return 1; | |
169 | } | |
170 | return 0; | |
171 | } | |
172 | ||
173 | //askdemod then call Em410xdecode | |
174 | int AskEm410xDemod(const char *Cmd, uint32_t *hi, uint64_t *lo, bool verbose) | |
175 | { | |
176 | bool st = true; | |
177 | if (!ASKDemod_ext(Cmd, false, false, 1, &st)) return 0; | |
178 | return AskEm410xDecode(verbose, hi, lo); | |
179 | } | |
180 | ||
181 | //by marshmellow | |
182 | //takes 3 arguments - clock, invert and maxErr as integers | |
183 | //attempts to demodulate ask while decoding manchester | |
184 | //prints binary found and saves in graphbuffer for further commands | |
185 | int CmdAskEM410xDemod(const char *Cmd) | |
186 | { | |
187 | char cmdp = param_getchar(Cmd, 0); | |
188 | if (strlen(Cmd) > 10 || cmdp == 'h' || cmdp == 'H') { | |
189 | PrintAndLog("Usage: lf em 410xdemod [clock] <0|1> [maxError]"); | |
190 | PrintAndLog(" [set clock as integer] optional, if not set, autodetect."); | |
191 | PrintAndLog(" <invert>, 1 for invert output"); | |
192 | PrintAndLog(" [set maximum allowed errors], default = 100."); | |
193 | PrintAndLog(""); | |
194 | PrintAndLog(" sample: lf em 410xdemod = demod an EM410x Tag ID from GraphBuffer"); | |
195 | PrintAndLog(" : lf em 410xdemod 32 = demod an EM410x Tag ID from GraphBuffer using a clock of RF/32"); | |
196 | PrintAndLog(" : lf em 410xdemod 32 1 = demod an EM410x Tag ID from GraphBuffer using a clock of RF/32 and inverting data"); | |
197 | PrintAndLog(" : lf em 410xdemod 1 = demod an EM410x Tag ID from GraphBuffer while inverting data"); | |
198 | PrintAndLog(" : lf em 410xdemod 64 1 0 = demod an EM410x Tag ID from GraphBuffer using a clock of RF/64 and inverting data and allowing 0 demod errors"); | |
23f0a7d8 | 199 | return 0; |
200 | } | |
35aa230e | 201 | uint64_t lo = 0; |
202 | uint32_t hi = 0; | |
203 | return AskEm410xDemod(Cmd, &hi, &lo, true); | |
7fe9b0b7 | 204 | } |
205 | ||
c8518913 | 206 | int usage_lf_em410x_sim(void) { |
207 | PrintAndLog("Simulating EM410x tag"); | |
208 | PrintAndLog(""); | |
209 | PrintAndLog("Usage: lf em 410xsim [h] <uid> <clock>"); | |
210 | PrintAndLog("Options:"); | |
211 | PrintAndLog(" h - this help"); | |
212 | PrintAndLog(" uid - uid (10 HEX symbols)"); | |
213 | PrintAndLog(" clock - clock (32|64) (optional)"); | |
214 | PrintAndLog("samples:"); | |
215 | PrintAndLog(" lf em 410xsim 0F0368568B"); | |
216 | PrintAndLog(" lf em 410xsim 0F0368568B 32"); | |
217 | return 0; | |
218 | } | |
219 | ||
13d77ef9 | 220 | // emulate an EM410X tag |
7fe9b0b7 | 221 | int CmdEM410xSim(const char *Cmd) |
222 | { | |
3fe4ff4f | 223 | int i, n, j, binary[4], parity[4]; |
224 | ||
225 | char cmdp = param_getchar(Cmd, 0); | |
226 | uint8_t uid[5] = {0x00}; | |
227 | ||
c8518913 | 228 | if (cmdp == 'h' || cmdp == 'H') return usage_lf_em410x_sim(); |
daa4fbae | 229 | /* clock is 64 in EM410x tags */ |
415274a7 | 230 | uint8_t clock = 64; |
3fe4ff4f | 231 | |
232 | if (param_gethex(Cmd, 0, uid, 10)) { | |
233 | PrintAndLog("UID must include 10 HEX symbols"); | |
234 | return 0; | |
235 | } | |
415274a7 | 236 | param_getdec(Cmd,1, &clock); |
daa4fbae | 237 | |
238 | PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X clock: %d", uid[0],uid[1],uid[2],uid[3],uid[4],clock); | |
50acfd37 | 239 | PrintAndLog("Press pm3-button to abort simulation"); |
7fe9b0b7 | 240 | |
23f0a7d8 | 241 | |
242 | /* clear our graph */ | |
243 | ClearGraph(0); | |
244 | ||
245 | /* write 9 start bits */ | |
246 | for (i = 0; i < 9; i++) | |
247 | AppendGraph(0, clock, 1); | |
248 | ||
249 | /* for each hex char */ | |
250 | parity[0] = parity[1] = parity[2] = parity[3] = 0; | |
251 | for (i = 0; i < 10; i++) | |
252 | { | |
253 | /* read each hex char */ | |
254 | sscanf(&Cmd[i], "%1x", &n); | |
255 | for (j = 3; j >= 0; j--, n/= 2) | |
256 | binary[j] = n % 2; | |
257 | ||
258 | /* append each bit */ | |
259 | AppendGraph(0, clock, binary[0]); | |
260 | AppendGraph(0, clock, binary[1]); | |
261 | AppendGraph(0, clock, binary[2]); | |
262 | AppendGraph(0, clock, binary[3]); | |
263 | ||
264 | /* append parity bit */ | |
265 | AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]); | |
266 | ||
267 | /* keep track of column parity */ | |
268 | parity[0] ^= binary[0]; | |
269 | parity[1] ^= binary[1]; | |
270 | parity[2] ^= binary[2]; | |
271 | parity[3] ^= binary[3]; | |
272 | } | |
273 | ||
274 | /* parity columns */ | |
275 | AppendGraph(0, clock, parity[0]); | |
276 | AppendGraph(0, clock, parity[1]); | |
277 | AppendGraph(0, clock, parity[2]); | |
278 | AppendGraph(0, clock, parity[3]); | |
279 | ||
280 | /* stop bit */ | |
281 | AppendGraph(1, clock, 0); | |
47af8c5f | 282 | |
23f0a7d8 | 283 | CmdLFSim("0"); //240 start_gap. |
284 | return 0; | |
7fe9b0b7 | 285 | } |
286 | ||
50acfd37 F |
287 | int usage_lf_em410x_brute(void) { |
288 | PrintAndLog("Bruteforcing by emulating EM410x tag"); | |
289 | PrintAndLog(""); | |
290 | PrintAndLog("Usage: lf em 410xbrute [h] ids.txt"); | |
291 | PrintAndLog("Options:"); | |
292 | PrintAndLog(" h - this help"); | |
293 | PrintAndLog(" ids.txt - file with id in HEX format one per line"); | |
294 | PrintAndLog(" clock - clock (32|64) (optional)"); | |
295 | PrintAndLog("samples:"); | |
296 | PrintAndLog(" lf em 410xbrute ids.txt"); | |
297 | PrintAndLog(" lf em 410xbrute ids.txt 32"); | |
298 | return 0; | |
299 | } | |
300 | ||
301 | int CmdEM410xBrute(const char *Cmd) | |
302 | { | |
303 | char filename[FILE_PATH_SIZE]={0}; | |
47af8c5f F |
304 | FILE *f = NULL; |
305 | char buf[11]; | |
50acfd37 F |
306 | int i, n, j, binary[4], parity[4]; |
307 | ||
47af8c5f F |
308 | char cmdp = param_getchar(Cmd, 0); |
309 | uint8_t uid[5] = {0x00}; | |
50acfd37 | 310 | |
47af8c5f F |
311 | if (cmdp == 'h' || cmdp == 'H') return usage_lf_em410x_sim(); |
312 | /* clock is 64 in EM410x tags */ | |
313 | uint8_t clock = 64; | |
50acfd37 | 314 | |
47af8c5f | 315 | param_getdec(Cmd,1, &clock); |
50acfd37 F |
316 | |
317 | param_getstr(Cmd, 0, filename); | |
50acfd37 | 318 | |
47af8c5f F |
319 | if (strlen(filename) > 0) { |
320 | if ((f = fopen(filename, "r")) == NULL) { | |
321 | PrintAndLog("Error: Could not open IDs file [%s]",filename); | |
322 | return 1; | |
323 | } | |
324 | } else { | |
325 | PrintAndLog("Error: Please specify a filename"); | |
326 | return 1; | |
327 | } | |
50acfd37 | 328 | |
50acfd37 F |
329 | |
330 | while( fgets(buf, sizeof(buf), f) ) { | |
331 | msleep(1000); | |
332 | if (strlen(buf) < 10 || buf[9] == '\n') continue; | |
333 | while (fgetc(f) != '\n' && !feof(f)); //goto next line | |
334 | ||
335 | //The line start with # is comment, skip | |
47af8c5f F |
336 | if( buf[0]=='#' ) continue; |
337 | ||
50acfd37 F |
338 | buf[10] = 0; |
339 | //PrintAndLog("ID: %s", buf); | |
47af8c5f F |
340 | |
341 | if (param_gethex(buf, 0, uid, 10)) { | |
342 | PrintAndLog("UID must include 10 HEX symbols"); | |
343 | return 0; | |
344 | } | |
345 | ||
346 | PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X clock: %d", uid[0],uid[1],uid[2],uid[3],uid[4],clock); | |
347 | ||
348 | /* clear our graph */ | |
349 | ClearGraph(0); | |
350 | ||
351 | /* write 9 start bits */ | |
352 | for (i = 0; i < 9; i++) | |
353 | AppendGraph(0, clock, 1); | |
354 | ||
355 | /* for each hex char */ | |
356 | parity[0] = parity[1] = parity[2] = parity[3] = 0; | |
357 | for (i = 0; i < 10; i++) | |
358 | { | |
359 | /* read each hex char */ | |
360 | sscanf(&buf[i], "%1x", &n); | |
361 | for (j = 3; j >= 0; j--, n/= 2) | |
362 | binary[j] = n % 2; | |
363 | ||
364 | /* append each bit */ | |
365 | AppendGraph(0, clock, binary[0]); | |
50acfd37 | 366 | AppendGraph(0, clock, binary[1]); |
47af8c5f F |
367 | AppendGraph(0, clock, binary[2]); |
368 | AppendGraph(0, clock, binary[3]); | |
50acfd37 | 369 | |
47af8c5f F |
370 | /* append parity bit */ |
371 | AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]); | |
372 | ||
373 | /* keep track of column parity */ | |
374 | parity[0] ^= binary[0]; | |
375 | parity[1] ^= binary[1]; | |
376 | parity[2] ^= binary[2]; | |
377 | parity[3] ^= binary[3]; | |
378 | } | |
379 | ||
380 | /* parity columns */ | |
381 | AppendGraph(0, clock, parity[0]); | |
382 | AppendGraph(0, clock, parity[1]); | |
383 | AppendGraph(0, clock, parity[2]); | |
384 | AppendGraph(0, clock, parity[3]); | |
385 | ||
386 | /* stop bit */ | |
387 | AppendGraph(1, clock, 0); | |
50acfd37 | 388 | |
47af8c5f | 389 | CmdLFSim("0"); //240 start_gap. |
50acfd37 | 390 | |
47af8c5f | 391 | memset(buf, 0, sizeof(buf)); |
50acfd37 | 392 | |
47af8c5f F |
393 | } |
394 | ||
395 | fclose(f); | |
396 | ||
397 | return 0; | |
50acfd37 F |
398 | } |
399 | ||
400 | ||
3fe4ff4f | 401 | /* Function is equivalent of lf read + data samples + em410xread |
47af8c5f F |
402 | * looped until an EM410x tag is detected |
403 | * | |
3fe4ff4f | 404 | * Why is CmdSamples("16000")? |
405 | * TBD: Auto-grow sample size based on detected sample rate. IE: If the | |
406 | * rate gets lower, then grow the number of samples | |
47af8c5f | 407 | * Changed by martin, 4000 x 4 = 16000, |
3fe4ff4f | 408 | * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235 |
35aa230e | 409 | * |
410 | * EDIT -- capture enough to get 2 complete preambles at the slowest data rate known to be used (rf/64) (64*64*2+9 = 8201) marshmellow | |
3fe4ff4f | 411 | */ |
7fe9b0b7 | 412 | int CmdEM410xWatch(const char *Cmd) |
413 | { | |
3fe4ff4f | 414 | do { |
415 | if (ukbhit()) { | |
416 | printf("\naborted via keyboard!\n"); | |
417 | break; | |
418 | } | |
b9957414 | 419 | lf_read(true, 8201); |
35aa230e | 420 | } while (!CmdAskEM410xDemod("")); |
13d77ef9 | 421 | |
3fe4ff4f | 422 | return 0; |
7fe9b0b7 | 423 | } |
424 | ||
23f0a7d8 | 425 | //currently only supports manchester modulations |
c3bfb9c7 | 426 | int CmdEM410xWatchnSpoof(const char *Cmd) |
427 | { | |
428 | CmdEM410xWatch(Cmd); | |
35aa230e | 429 | PrintAndLog("# Replaying captured ID: %010"PRIx64, g_em410xId); |
1fbf8956 | 430 | CmdLFaskSim(""); |
431 | return 0; | |
c3bfb9c7 | 432 | } |
433 | ||
6e984446 | 434 | int CmdEM410xWrite(const char *Cmd) |
435 | { | |
436 | uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value | |
437 | int card = 0xFF; // invalid card value | |
438 | unsigned int clock = 0; // invalid clock value | |
439 | ||
2b11c7c7 | 440 | sscanf(Cmd, "%" SCNx64 " %d %d", &id, &card, &clock); |
6e984446 | 441 | |
442 | // Check ID | |
443 | if (id == 0xFFFFFFFFFFFFFFFF) { | |
444 | PrintAndLog("Error! ID is required.\n"); | |
445 | return 0; | |
446 | } | |
447 | if (id >= 0x10000000000) { | |
448 | PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n"); | |
449 | return 0; | |
450 | } | |
451 | ||
452 | // Check Card | |
453 | if (card == 0xFF) { | |
454 | PrintAndLog("Error! Card type required.\n"); | |
455 | return 0; | |
456 | } | |
457 | if (card < 0) { | |
458 | PrintAndLog("Error! Bad card type selected.\n"); | |
459 | return 0; | |
460 | } | |
461 | ||
462 | // Check Clock | |
76346455 | 463 | // Default: 64 |
464 | if (clock == 0) | |
465 | clock = 64; | |
466 | ||
467 | // Allowed clock rates: 16, 32, 40 and 64 | |
468 | if ((clock != 16) && (clock != 32) && (clock != 64) && (clock != 40)) { | |
469 | PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32, 40 and 64.\n", clock); | |
6e984446 | 470 | return 0; |
471 | } | |
472 | ||
473 | if (card == 1) { | |
474 | PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock); | |
475 | // NOTE: We really should pass the clock in as a separate argument, but to | |
476 | // provide for backwards-compatibility for older firmware, and to avoid | |
477 | // having to add another argument to CMD_EM410X_WRITE_TAG, we just store | |
478 | // the clock rate in bits 8-15 of the card value | |
76346455 | 479 | card = (card & 0xFF) | ((clock << 8) & 0xFF00); |
480 | } else if (card == 0) { | |
6e984446 | 481 | PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock); |
76346455 | 482 | card = (card & 0xFF) | ((clock << 8) & 0xFF00); |
483 | } else { | |
6e984446 | 484 | PrintAndLog("Error! Bad card type selected.\n"); |
485 | return 0; | |
486 | } | |
487 | ||
488 | UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}}; | |
489 | SendCommand(&c); | |
490 | ||
491 | return 0; | |
492 | } | |
493 | ||
4c6ccc2b | 494 | //**************** Start of EM4x50 Code ************************ |
23f0a7d8 | 495 | bool EM_EndParityTest(uint8_t *BitStream, size_t size, uint8_t rows, uint8_t cols, uint8_t pType) |
496 | { | |
497 | if (rows*cols>size) return false; | |
498 | uint8_t colP=0; | |
cc15a118 | 499 | //assume last col is a parity and do not test |
23f0a7d8 | 500 | for (uint8_t colNum = 0; colNum < cols-1; colNum++) { |
501 | for (uint8_t rowNum = 0; rowNum < rows; rowNum++) { | |
502 | colP ^= BitStream[(rowNum*cols)+colNum]; | |
503 | } | |
504 | if (colP != pType) return false; | |
505 | } | |
506 | return true; | |
507 | } | |
508 | ||
509 | bool EM_ByteParityTest(uint8_t *BitStream, size_t size, uint8_t rows, uint8_t cols, uint8_t pType) | |
510 | { | |
511 | if (rows*cols>size) return false; | |
512 | uint8_t rowP=0; | |
513 | //assume last row is a parity row and do not test | |
514 | for (uint8_t rowNum = 0; rowNum < rows-1; rowNum++) { | |
515 | for (uint8_t colNum = 0; colNum < cols; colNum++) { | |
516 | rowP ^= BitStream[(rowNum*cols)+colNum]; | |
517 | } | |
518 | if (rowP != pType) return false; | |
519 | } | |
520 | return true; | |
521 | } | |
522 | ||
523 | uint32_t OutputEM4x50_Block(uint8_t *BitStream, size_t size, bool verbose, bool pTest) | |
524 | { | |
525 | if (size<45) return 0; | |
526 | uint32_t code = bytebits_to_byte(BitStream,8); | |
527 | code = code<<8 | bytebits_to_byte(BitStream+9,8); | |
528 | code = code<<8 | bytebits_to_byte(BitStream+18,8); | |
529 | code = code<<8 | bytebits_to_byte(BitStream+27,8); | |
530 | if (verbose || g_debugMode){ | |
531 | for (uint8_t i = 0; i<5; i++){ | |
cc15a118 | 532 | if (i == 4) PrintAndLog(""); //parity byte spacer |
23f0a7d8 | 533 | PrintAndLog("%d%d%d%d%d%d%d%d %d -> 0x%02x", |
534 | BitStream[i*9], | |
535 | BitStream[i*9+1], | |
536 | BitStream[i*9+2], | |
537 | BitStream[i*9+3], | |
538 | BitStream[i*9+4], | |
539 | BitStream[i*9+5], | |
540 | BitStream[i*9+6], | |
541 | BitStream[i*9+7], | |
542 | BitStream[i*9+8], | |
543 | bytebits_to_byte(BitStream+i*9,8) | |
544 | ); | |
545 | } | |
546 | if (pTest) | |
547 | PrintAndLog("Parity Passed"); | |
548 | else | |
549 | PrintAndLog("Parity Failed"); | |
550 | } | |
23f0a7d8 | 551 | return code; |
552 | } | |
7666f460 | 553 | /* Read the transmitted data of an EM4x50 tag from the graphbuffer |
7fe9b0b7 | 554 | * Format: |
555 | * | |
556 | * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity | |
557 | * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity | |
558 | * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity | |
559 | * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity | |
560 | * CCCCCCCC <- column parity bits | |
561 | * 0 <- stop bit | |
562 | * LW <- Listen Window | |
563 | * | |
564 | * This pattern repeats for every block of data being transmitted. | |
565 | * Transmission starts with two Listen Windows (LW - a modulated | |
566 | * pattern of 320 cycles each (32/32/128/64/64)). | |
567 | * | |
568 | * Note that this data may or may not be the UID. It is whatever data | |
569 | * is stored in the blocks defined in the control word First and Last | |
570 | * Word Read values. UID is stored in block 32. | |
571 | */ | |
cc15a118 | 572 | //completed by Marshmellow |
23f0a7d8 | 573 | int EM4x50Read(const char *Cmd, bool verbose) |
574 | { | |
cc15a118 | 575 | uint8_t fndClk[] = {8,16,32,40,50,64,128}; |
47af8c5f | 576 | int clk = 0; |
23f0a7d8 | 577 | int invert = 0; |
23f0a7d8 | 578 | int tol = 0; |
579 | int i, j, startblock, skip, block, start, end, low, high, minClk; | |
cc15a118 | 580 | bool complete = false; |
23f0a7d8 | 581 | int tmpbuff[MAX_GRAPH_TRACE_LEN / 64]; |
23f0a7d8 | 582 | uint32_t Code[6]; |
583 | char tmp[6]; | |
23f0a7d8 | 584 | char tmp2[20]; |
49bbc60a | 585 | int phaseoff; |
cc15a118 | 586 | high = low = 0; |
23f0a7d8 | 587 | memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64); |
cc15a118 | 588 | |
589 | // get user entry if any | |
590 | sscanf(Cmd, "%i %i", &clk, &invert); | |
47af8c5f | 591 | |
23f0a7d8 | 592 | // first get high and low values |
cc15a118 | 593 | for (i = 0; i < GraphTraceLen; i++) { |
23f0a7d8 | 594 | if (GraphBuffer[i] > high) |
595 | high = GraphBuffer[i]; | |
596 | else if (GraphBuffer[i] < low) | |
597 | low = GraphBuffer[i]; | |
598 | } | |
599 | ||
cc15a118 | 600 | i = 0; |
601 | j = 0; | |
602 | minClk = 255; | |
603 | // get to first full low to prime loop and skip incomplete first pulse | |
604 | while ((GraphBuffer[i] < high) && (i < GraphTraceLen)) | |
605 | ++i; | |
606 | while ((GraphBuffer[i] > low) && (i < GraphTraceLen)) | |
607 | ++i; | |
608 | skip = i; | |
609 | ||
610 | // populate tmpbuff buffer with pulse lengths | |
611 | while (i < GraphTraceLen) { | |
23f0a7d8 | 612 | // measure from low to low |
cc15a118 | 613 | while ((GraphBuffer[i] > low) && (i < GraphTraceLen)) |
23f0a7d8 | 614 | ++i; |
615 | start= i; | |
cc15a118 | 616 | while ((GraphBuffer[i] < high) && (i < GraphTraceLen)) |
23f0a7d8 | 617 | ++i; |
cc15a118 | 618 | while ((GraphBuffer[i] > low) && (i < GraphTraceLen)) |
23f0a7d8 | 619 | ++i; |
620 | if (j>=(MAX_GRAPH_TRACE_LEN/64)) { | |
621 | break; | |
622 | } | |
623 | tmpbuff[j++]= i - start; | |
cc15a118 | 624 | if (i-start < minClk && i < GraphTraceLen) { |
625 | minClk = i - start; | |
626 | } | |
23f0a7d8 | 627 | } |
628 | // set clock | |
cc15a118 | 629 | if (!clk) { |
23f0a7d8 | 630 | for (uint8_t clkCnt = 0; clkCnt<7; clkCnt++) { |
631 | tol = fndClk[clkCnt]/8; | |
47af8c5f | 632 | if (minClk >= fndClk[clkCnt]-tol && minClk <= fndClk[clkCnt]+1) { |
23f0a7d8 | 633 | clk=fndClk[clkCnt]; |
634 | break; | |
635 | } | |
636 | } | |
cc15a118 | 637 | if (!clk) return 0; |
6e984446 | 638 | } else tol = clk/8; |
23f0a7d8 | 639 | |
640 | // look for data start - should be 2 pairs of LW (pulses of clk*3,clk*2) | |
cc15a118 | 641 | start = -1; |
642 | for (i= 0; i < j - 4 ; ++i) { | |
23f0a7d8 | 643 | skip += tmpbuff[i]; |
cc15a118 | 644 | if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol) //3 clocks |
645 | if (tmpbuff[i+1] >= clk*2-tol && tmpbuff[i+1] <= clk*2+tol) //2 clocks | |
646 | if (tmpbuff[i+2] >= clk*3-tol && tmpbuff[i+2] <= clk*3+tol) //3 clocks | |
647 | if (tmpbuff[i+3] >= clk-tol) //1.5 to 2 clocks - depends on bit following | |
23f0a7d8 | 648 | { |
649 | start= i + 4; | |
650 | break; | |
651 | } | |
652 | } | |
cc15a118 | 653 | startblock = i + 4; |
23f0a7d8 | 654 | |
655 | // skip over the remainder of LW | |
49bbc60a | 656 | skip += tmpbuff[i+1] + tmpbuff[i+2] + clk; |
47af8c5f | 657 | if (tmpbuff[i+3]>clk) |
49bbc60a | 658 | phaseoff = tmpbuff[i+3]-clk; |
659 | else | |
660 | phaseoff = 0; | |
23f0a7d8 | 661 | // now do it again to find the end |
662 | end = skip; | |
cc15a118 | 663 | for (i += 3; i < j - 4 ; ++i) { |
23f0a7d8 | 664 | end += tmpbuff[i]; |
cc15a118 | 665 | if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol) //3 clocks |
666 | if (tmpbuff[i+1] >= clk*2-tol && tmpbuff[i+1] <= clk*2+tol) //2 clocks | |
667 | if (tmpbuff[i+2] >= clk*3-tol && tmpbuff[i+2] <= clk*3+tol) //3 clocks | |
668 | if (tmpbuff[i+3] >= clk-tol) //1.5 to 2 clocks - depends on bit following | |
23f0a7d8 | 669 | { |
670 | complete= true; | |
671 | break; | |
672 | } | |
673 | } | |
674 | end = i; | |
675 | // report back | |
676 | if (verbose || g_debugMode) { | |
677 | if (start >= 0) { | |
cc15a118 | 678 | PrintAndLog("\nNote: one block = 50 bits (32 data, 12 parity, 6 marker)"); |
23f0a7d8 | 679 | } else { |
cc15a118 | 680 | PrintAndLog("No data found!, clock tried:%d",clk); |
23f0a7d8 | 681 | PrintAndLog("Try again with more samples."); |
cc15a118 | 682 | PrintAndLog(" or after a 'data askedge' command to clean up the read"); |
23f0a7d8 | 683 | return 0; |
684 | } | |
23f0a7d8 | 685 | } else if (start < 0) return 0; |
cc15a118 | 686 | start = skip; |
23f0a7d8 | 687 | snprintf(tmp2, sizeof(tmp2),"%d %d 1000 %d", clk, invert, clk*47); |
47af8c5f | 688 | // save GraphBuffer - to restore it later |
3fd7fce4 | 689 | save_restoreGB(GRAPH_SAVE); |
47af8c5f | 690 | // get rid of leading crap |
cc15a118 | 691 | snprintf(tmp, sizeof(tmp), "%i", skip); |
23f0a7d8 | 692 | CmdLtrim(tmp); |
693 | bool pTest; | |
cc15a118 | 694 | bool AllPTest = true; |
23f0a7d8 | 695 | // now work through remaining buffer printing out data blocks |
696 | block = 0; | |
697 | i = startblock; | |
cc15a118 | 698 | while (block < 6) { |
23f0a7d8 | 699 | if (verbose || g_debugMode) PrintAndLog("\nBlock %i:", block); |
700 | skip = phaseoff; | |
47af8c5f | 701 | |
23f0a7d8 | 702 | // look for LW before start of next block |
cc15a118 | 703 | for ( ; i < j - 4 ; ++i) { |
23f0a7d8 | 704 | skip += tmpbuff[i]; |
705 | if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol) | |
706 | if (tmpbuff[i+1] >= clk-tol) | |
707 | break; | |
708 | } | |
49bbc60a | 709 | if (i >= j-4) break; //next LW not found |
23f0a7d8 | 710 | skip += clk; |
49bbc60a | 711 | if (tmpbuff[i+1]>clk) |
712 | phaseoff = tmpbuff[i+1]-clk; | |
713 | else | |
714 | phaseoff = 0; | |
23f0a7d8 | 715 | i += 2; |
fef74fdc | 716 | if (ASKDemod(tmp2, false, false, 1) < 1) { |
3fd7fce4 | 717 | save_restoreGB(GRAPH_RESTORE); |
cc15a118 | 718 | return 0; |
719 | } | |
23f0a7d8 | 720 | //set DemodBufferLen to just one block |
721 | DemodBufferLen = skip/clk; | |
722 | //test parities | |
47af8c5f | 723 | pTest = EM_ByteParityTest(DemodBuffer,DemodBufferLen,5,9,0); |
23f0a7d8 | 724 | pTest &= EM_EndParityTest(DemodBuffer,DemodBufferLen,5,9,0); |
725 | AllPTest &= pTest; | |
726 | //get output | |
cc15a118 | 727 | Code[block] = OutputEM4x50_Block(DemodBuffer,DemodBufferLen,verbose, pTest); |
728 | if (g_debugMode) PrintAndLog("\nskipping %d samples, bits:%d", skip, skip/clk); | |
23f0a7d8 | 729 | //skip to start of next block |
730 | snprintf(tmp,sizeof(tmp),"%i",skip); | |
731 | CmdLtrim(tmp); | |
732 | block++; | |
cc15a118 | 733 | if (i >= end) break; //in case chip doesn't output 6 blocks |
23f0a7d8 | 734 | } |
735 | //print full code: | |
736 | if (verbose || g_debugMode || AllPTest){ | |
49bbc60a | 737 | if (!complete) { |
738 | PrintAndLog("*** Warning!"); | |
739 | PrintAndLog("Partial data - no end found!"); | |
740 | PrintAndLog("Try again with more samples."); | |
741 | } | |
47af8c5f | 742 | PrintAndLog("Found data at sample: %i - using clock: %i", start, clk); |
cc15a118 | 743 | end = block; |
744 | for (block=0; block < end; block++){ | |
23f0a7d8 | 745 | PrintAndLog("Block %d: %08x",block,Code[block]); |
746 | } | |
49bbc60a | 747 | if (AllPTest) { |
23f0a7d8 | 748 | PrintAndLog("Parities Passed"); |
49bbc60a | 749 | } else { |
23f0a7d8 | 750 | PrintAndLog("Parities Failed"); |
cc15a118 | 751 | PrintAndLog("Try cleaning the read samples with 'data askedge'"); |
49bbc60a | 752 | } |
23f0a7d8 | 753 | } |
754 | ||
755 | //restore GraphBuffer | |
3fd7fce4 | 756 | save_restoreGB(GRAPH_RESTORE); |
23f0a7d8 | 757 | return (int)AllPTest; |
758 | } | |
759 | ||
7fe9b0b7 | 760 | int CmdEM4x50Read(const char *Cmd) |
761 | { | |
23f0a7d8 | 762 | return EM4x50Read(Cmd, true); |
7fe9b0b7 | 763 | } |
764 | ||
4c6ccc2b | 765 | //**************** Start of EM4x05/EM4x69 Code ************************ |
7666f460 | 766 | int usage_lf_em_read(void) { |
767 | PrintAndLog("Read EM4x05/EM4x69. Tag must be on antenna. "); | |
768 | PrintAndLog(""); | |
e39a92bb | 769 | PrintAndLog("Usage: lf em 4x05readword [h] <address> <pwd>"); |
7666f460 | 770 | PrintAndLog("Options:"); |
771 | PrintAndLog(" h - this help"); | |
772 | PrintAndLog(" address - memory address to read. (0-15)"); | |
773 | PrintAndLog(" pwd - password (hex) (optional)"); | |
774 | PrintAndLog("samples:"); | |
e39a92bb | 775 | PrintAndLog(" lf em 4x05readword 1"); |
776 | PrintAndLog(" lf em 4x05readword 1 11223344"); | |
7666f460 | 777 | return 0; |
778 | } | |
6f1a5978 | 779 | |
4c6ccc2b | 780 | // for command responses from em4x05 or em4x69 |
781 | // download samples from device and copy them to the Graphbuffer | |
782 | bool downloadSamplesEM() { | |
783 | // 8 bit preamble + 32 bit word response (max clock (128) * 40bits = 5120 samples) | |
47af8c5f | 784 | uint8_t got[6000]; |
4c6ccc2b | 785 | GetFromBigBuf(got, sizeof(got), 0); |
786 | if ( !WaitForResponseTimeout(CMD_ACK, NULL, 4000) ) { | |
787 | PrintAndLog("command execution time out"); | |
788 | return false; | |
6f1a5978 | 789 | } |
4c6ccc2b | 790 | setGraphBuf(got, sizeof(got)); |
791 | return true; | |
e39a92bb | 792 | } |
793 | ||
794 | bool EM4x05testDemodReadData(uint32_t *word, bool readCmd) { | |
34ff8985 | 795 | // em4x05/em4x69 command response preamble is 00001010 |
4c6ccc2b | 796 | // skip first two 0 bits as they might have been missed in the demod |
797 | uint8_t preamble[] = {0,0,1,0,1,0}; | |
e39a92bb | 798 | size_t startIdx = 0; |
e39a92bb | 799 | |
34ff8985 | 800 | // set size to 20 to only test first 14 positions for the preamble or less if not a read command |
801 | size_t size = (readCmd) ? 20 : 11; | |
802 | // sanity check | |
803 | size = (size > DemodBufferLen) ? DemodBufferLen : size; | |
804 | // test preamble | |
e88096ba | 805 | if ( !preambleSearchEx(DemodBuffer, preamble, sizeof(preamble), &size, &startIdx, true) ) { |
e39a92bb | 806 | if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305 preamble not found :: %d", startIdx); |
807 | return false; | |
808 | } | |
4c6ccc2b | 809 | // if this is a readword command, get the read bytes and test the parities |
e39a92bb | 810 | if (readCmd) { |
4c6ccc2b | 811 | if (!EM_EndParityTest(DemodBuffer + startIdx + sizeof(preamble), 45, 5, 9, 0)) { |
812 | if (g_debugMode) PrintAndLog("DEBUG: Error - End Parity check failed"); | |
813 | return false; | |
814 | } | |
e88096ba | 815 | // test for even parity bits and remove them. (leave out the end row of parities so 36 bits) |
47af8c5f | 816 | if ( removeParity(DemodBuffer, startIdx + sizeof(preamble),9,0,36) == 0 ) { |
e39a92bb | 817 | if (g_debugMode) PrintAndLog("DEBUG: Error - Parity not detected"); |
818 | return false; | |
819 | } | |
820 | ||
e88096ba | 821 | setDemodBuf(DemodBuffer, 32, 0); |
f516ff08 | 822 | //setClockGrid(0,0); |
9fe4507c | 823 | |
4c6ccc2b | 824 | *word = bytebits_to_byteLSBF(DemodBuffer, 32); |
e39a92bb | 825 | } |
826 | return true; | |
6f1a5978 | 827 | } |
828 | ||
47af8c5f | 829 | // FSK, PSK, ASK/MANCHESTER, ASK/BIPHASE, ASK/DIPHASE |
59f726c9 | 830 | // should cover 90% of known used configs |
831 | // the rest will need to be manually demoded for now... | |
e39a92bb | 832 | int demodEM4x05resp(uint32_t *word, bool readCmd) { |
6f1a5978 | 833 | int ans = 0; |
6f1a5978 | 834 | |
835 | // test for FSK wave (easiest to 99% ID) | |
34212c66 | 836 | if (GetFskClock("", false, false)) { |
6f1a5978 | 837 | //valid fsk clocks found |
838 | ans = FSKrawDemod("0 0", false); | |
839 | if (!ans) { | |
4c6ccc2b | 840 | if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: FSK Demod failed, ans: %d", ans); |
6f1a5978 | 841 | } else { |
e39a92bb | 842 | if (EM4x05testDemodReadData(word, readCmd)) { |
843 | return 1; | |
6f1a5978 | 844 | } |
845 | } | |
846 | } | |
59f726c9 | 847 | // PSK clocks should be easy to detect ( but difficult to demod a non-repeating pattern... ) |
34212c66 | 848 | ans = GetPskClock("", false, false); |
6980d66b | 849 | if (ans>0) { |
850 | //try psk1 | |
34212c66 | 851 | ans = PSKDemod("0 0 6", false); |
59f726c9 | 852 | if (!ans) { |
4c6ccc2b | 853 | if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: PSK1 Demod failed, ans: %d", ans); |
59f726c9 | 854 | } else { |
e39a92bb | 855 | if (EM4x05testDemodReadData(word, readCmd)) { |
856 | return 1; | |
6980d66b | 857 | } else { |
858 | //try psk2 | |
859 | psk1TOpsk2(DemodBuffer, DemodBufferLen); | |
860 | if (EM4x05testDemodReadData(word, readCmd)) { | |
861 | return 1; | |
862 | } | |
863 | } | |
864 | //try psk1 inverted | |
34212c66 | 865 | ans = PSKDemod("0 1 6", false); |
6980d66b | 866 | if (!ans) { |
4c6ccc2b | 867 | if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: PSK1 Demod failed, ans: %d", ans); |
6980d66b | 868 | } else { |
869 | if (EM4x05testDemodReadData(word, readCmd)) { | |
870 | return 1; | |
871 | } else { | |
872 | //try psk2 | |
873 | psk1TOpsk2(DemodBuffer, DemodBufferLen); | |
874 | if (EM4x05testDemodReadData(word, readCmd)) { | |
875 | return 1; | |
876 | } | |
877 | } | |
59f726c9 | 878 | } |
879 | } | |
6f1a5978 | 880 | } |
881 | ||
4c6ccc2b | 882 | // manchester is more common than biphase... try first |
6980d66b | 883 | bool stcheck = false; |
884 | // try manchester - NOTE: ST only applies to T55x7 tags. | |
885 | ans = ASKDemod_ext("0,0,1", false, false, 1, &stcheck); | |
886 | if (!ans) { | |
4c6ccc2b | 887 | if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/Manchester Demod failed, ans: %d", ans); |
6980d66b | 888 | } else { |
889 | if (EM4x05testDemodReadData(word, readCmd)) { | |
890 | return 1; | |
6f1a5978 | 891 | } |
892 | } | |
893 | ||
6980d66b | 894 | //try biphase |
34212c66 | 895 | ans = ASKbiphaseDemod("0 0 1", false); |
47af8c5f | 896 | if (!ans) { |
4c6ccc2b | 897 | if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/biphase Demod failed, ans: %d", ans); |
6980d66b | 898 | } else { |
899 | if (EM4x05testDemodReadData(word, readCmd)) { | |
900 | return 1; | |
6f1a5978 | 901 | } |
902 | } | |
903 | ||
6980d66b | 904 | //try diphase (differential biphase or inverted) |
34212c66 | 905 | ans = ASKbiphaseDemod("0 1 1", false); |
47af8c5f | 906 | if (!ans) { |
4c6ccc2b | 907 | if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/biphase Demod failed, ans: %d", ans); |
6980d66b | 908 | } else { |
909 | if (EM4x05testDemodReadData(word, readCmd)) { | |
910 | return 1; | |
59f726c9 | 911 | } |
6980d66b | 912 | } |
913 | ||
6f1a5978 | 914 | return -1; |
915 | } | |
916 | ||
fa1e00cf | 917 | int EM4x05ReadWord_ext(uint8_t addr, uint32_t pwd, bool usePwd, uint32_t *wordData) { |
7666f460 | 918 | UsbCommand c = {CMD_EM4X_READ_WORD, {addr, pwd, usePwd}}; |
919 | clearCommandBuffer(); | |
23f0a7d8 | 920 | SendCommand(&c); |
47af8c5f | 921 | UsbCommand resp; |
7666f460 | 922 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)){ |
923 | PrintAndLog("Command timed out"); | |
924 | return -1; | |
925 | } | |
4c6ccc2b | 926 | if ( !downloadSamplesEM() ) { |
6f1a5978 | 927 | return -1; |
7666f460 | 928 | } |
6f1a5978 | 929 | int testLen = (GraphTraceLen < 1000) ? GraphTraceLen : 1000; |
930 | if (graphJustNoise(GraphBuffer, testLen)) { | |
931 | PrintAndLog("no tag not found"); | |
932 | return -1; | |
933 | } | |
59f726c9 | 934 | //attempt demod: |
fa1e00cf | 935 | return demodEM4x05resp(wordData, true); |
936 | } | |
937 | ||
938 | int EM4x05ReadWord(uint8_t addr, uint32_t pwd, bool usePwd) { | |
e39a92bb | 939 | uint32_t wordData = 0; |
fa1e00cf | 940 | int success = EM4x05ReadWord_ext(addr, pwd, usePwd, &wordData); |
4c6ccc2b | 941 | if (success == 1) |
33a1fe96 | 942 | PrintAndLog("%s Address %02d | %08X", (addr>13) ? "Lock":" Got",addr,wordData); |
4c6ccc2b | 943 | else |
fa1e00cf | 944 | PrintAndLog("Read Address %02d | failed",addr); |
4c6ccc2b | 945 | |
e39a92bb | 946 | return success; |
947 | } | |
948 | ||
949 | int CmdEM4x05ReadWord(const char *Cmd) { | |
950 | uint8_t addr; | |
951 | uint32_t pwd; | |
952 | bool usePwd = false; | |
953 | uint8_t ctmp = param_getchar(Cmd, 0); | |
954 | if ( strlen(Cmd) == 0 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_em_read(); | |
955 | ||
956 | addr = param_get8ex(Cmd, 0, 50, 10); | |
957 | // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) | |
958 | pwd = param_get32ex(Cmd, 1, 1, 16); | |
47af8c5f | 959 | |
e39a92bb | 960 | if ( (addr > 15) ) { |
961 | PrintAndLog("Address must be between 0 and 15"); | |
962 | return 1; | |
963 | } | |
4c6ccc2b | 964 | if ( pwd == 1 ) { |
e39a92bb | 965 | PrintAndLog("Reading address %02u", addr); |
4c6ccc2b | 966 | } else { |
e39a92bb | 967 | usePwd = true; |
968 | PrintAndLog("Reading address %02u | password %08X", addr, pwd); | |
969 | } | |
61500621 | 970 | |
4c6ccc2b | 971 | return EM4x05ReadWord(addr, pwd, usePwd); |
54a942b0 | 972 | } |
973 | ||
e39a92bb | 974 | int usage_lf_em_dump(void) { |
975 | PrintAndLog("Dump EM4x05/EM4x69. Tag must be on antenna. "); | |
976 | PrintAndLog(""); | |
977 | PrintAndLog("Usage: lf em 4x05dump [h] <pwd>"); | |
978 | PrintAndLog("Options:"); | |
979 | PrintAndLog(" h - this help"); | |
980 | PrintAndLog(" pwd - password (hex) (optional)"); | |
981 | PrintAndLog("samples:"); | |
982 | PrintAndLog(" lf em 4x05dump"); | |
983 | PrintAndLog(" lf em 4x05dump 11223344"); | |
984 | return 0; | |
985 | } | |
986 | ||
987 | int CmdEM4x05dump(const char *Cmd) { | |
988 | uint8_t addr = 0; | |
989 | uint32_t pwd; | |
990 | bool usePwd = false; | |
991 | uint8_t ctmp = param_getchar(Cmd, 0); | |
992 | if ( ctmp == 'H' || ctmp == 'h' ) return usage_lf_em_dump(); | |
993 | ||
994 | // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) | |
995 | pwd = param_get32ex(Cmd, 0, 1, 16); | |
47af8c5f | 996 | |
e39a92bb | 997 | if ( pwd != 1 ) { |
998 | usePwd = true; | |
999 | } | |
1000 | int success = 1; | |
1001 | for (; addr < 16; addr++) { | |
1002 | if (addr == 2) { | |
1003 | if (usePwd) { | |
34212c66 | 1004 | PrintAndLog(" PWD Address %02u | %08X",addr,pwd); |
e39a92bb | 1005 | } else { |
34212c66 | 1006 | PrintAndLog(" PWD Address 02 | cannot read"); |
e39a92bb | 1007 | } |
1008 | } else { | |
1009 | success &= EM4x05ReadWord(addr, pwd, usePwd); | |
1010 | } | |
1011 | } | |
1012 | ||
1013 | return success; | |
1014 | } | |
1015 | ||
1016 | ||
7666f460 | 1017 | int usage_lf_em_write(void) { |
1018 | PrintAndLog("Write EM4x05/EM4x69. Tag must be on antenna. "); | |
1019 | PrintAndLog(""); | |
4ab135c0 | 1020 | PrintAndLog("Usage: lf em 4x05writeword [h] a <address> d <data> p <pwd> [s] [i]"); |
7666f460 | 1021 | PrintAndLog("Options:"); |
4ab135c0 | 1022 | PrintAndLog(" h - this help"); |
1023 | PrintAndLog(" a <address> - memory address to write to. (0-15)"); | |
47af8c5f | 1024 | PrintAndLog(" d <data> - data to write (hex)"); |
4ab135c0 | 1025 | PrintAndLog(" p <pwd> - password (hex) (optional)"); |
1026 | PrintAndLog(" s - swap the data bit order before write"); | |
1027 | PrintAndLog(" i - invert the data bits before write"); | |
7666f460 | 1028 | PrintAndLog("samples:"); |
4ab135c0 | 1029 | PrintAndLog(" lf em 4x05writeword a 5 d 11223344"); |
1030 | PrintAndLog(" lf em 4x05writeword a 5 p deadc0de d 11223344 s i"); | |
7666f460 | 1031 | return 0; |
1032 | } | |
59f726c9 | 1033 | |
6a772a12 | 1034 | // note: em4x05 doesn't have a way to invert data output so we must invert the data prior to writing |
1035 | // it if invertion is needed. (example FSK2a vs FSK) | |
1036 | // also em4x05 requires swapping word data when compared to the data used for t55xx chips. | |
4ab135c0 | 1037 | int EM4x05WriteWord(uint8_t addr, uint32_t data, uint32_t pwd, bool usePwd, bool swap, bool invert) { |
1038 | if (swap) data = SwapBits(data, 32); | |
713045f8 | 1039 | |
4ab135c0 | 1040 | if (invert) data ^= 0xFFFFFFFF; |
713045f8 | 1041 | |
e39a92bb | 1042 | if ( (addr > 15) ) { |
7666f460 | 1043 | PrintAndLog("Address must be between 0 and 15"); |
51b614aa | 1044 | return -1; |
23f0a7d8 | 1045 | } |
4ab135c0 | 1046 | if ( !usePwd ) { |
1047 | PrintAndLog("Writing address %d data %08X", addr, data); | |
1048 | } else { | |
713045f8 | 1049 | PrintAndLog("Writing address %d data %08X using password %08X", addr, data, pwd); |
7666f460 | 1050 | } |
713045f8 | 1051 | |
7666f460 | 1052 | uint16_t flag = (addr << 8 ) | usePwd; |
713045f8 | 1053 | |
7666f460 | 1054 | UsbCommand c = {CMD_EM4X_WRITE_WORD, {flag, data, pwd}}; |
1055 | clearCommandBuffer(); | |
23f0a7d8 | 1056 | SendCommand(&c); |
713045f8 | 1057 | UsbCommand resp; |
e39a92bb | 1058 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)){ |
7666f460 | 1059 | PrintAndLog("Error occurred, device did not respond during write operation."); |
1060 | return -1; | |
1061 | } | |
4c6ccc2b | 1062 | if ( !downloadSamplesEM() ) { |
1063 | return -1; | |
7666f460 | 1064 | } |
713045f8 | 1065 | //check response for 00001010 for write confirmation! |
59f726c9 | 1066 | //attempt demod: |
e39a92bb | 1067 | uint32_t dummy = 0; |
1068 | int result = demodEM4x05resp(&dummy,false); | |
59f726c9 | 1069 | if (result == 1) { |
1070 | PrintAndLog("Write Verified"); | |
34ff8985 | 1071 | } else { |
1072 | PrintAndLog("Write could not be verified"); | |
59f726c9 | 1073 | } |
1074 | return result; | |
54a942b0 | 1075 | } |
1076 | ||
4ab135c0 | 1077 | int CmdEM4x05WriteWord(const char *Cmd) { |
1078 | bool errors = false; | |
1079 | bool usePwd = false; | |
1080 | uint32_t data = 0xFFFFFFFF; | |
1081 | uint32_t pwd = 0xFFFFFFFF; | |
1082 | bool swap = false; | |
1083 | bool invert = false; | |
1084 | uint8_t addr = 16; // default to invalid address | |
6a772a12 | 1085 | bool gotData = false; |
4ab135c0 | 1086 | char cmdp = 0; |
1087 | while(param_getchar(Cmd, cmdp) != 0x00) | |
1088 | { | |
1089 | switch(param_getchar(Cmd, cmdp)) | |
1090 | { | |
1091 | case 'h': | |
1092 | case 'H': | |
1093 | return usage_lf_em_write(); | |
1094 | case 'a': | |
1095 | case 'A': | |
1096 | addr = param_get8ex(Cmd, cmdp+1, 16, 10); | |
1097 | cmdp += 2; | |
1098 | break; | |
1099 | case 'd': | |
1100 | case 'D': | |
1101 | data = param_get32ex(Cmd, cmdp+1, 0, 16); | |
6a772a12 | 1102 | gotData = true; |
4ab135c0 | 1103 | cmdp += 2; |
1104 | break; | |
1105 | case 'i': | |
1106 | case 'I': | |
1107 | invert = true; | |
1108 | cmdp++; | |
1109 | break; | |
1110 | case 'p': | |
1111 | case 'P': | |
1112 | pwd = param_get32ex(Cmd, cmdp+1, 1, 16); | |
1113 | if (pwd == 1) { | |
1114 | PrintAndLog("invalid pwd"); | |
1115 | errors = true; | |
1116 | } | |
1117 | usePwd = true; | |
1118 | cmdp += 2; | |
1119 | break; | |
1120 | case 's': | |
1121 | case 'S': | |
1122 | swap = true; | |
1123 | cmdp++; | |
1124 | break; | |
1125 | default: | |
1126 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp)); | |
1127 | errors = true; | |
1128 | break; | |
1129 | } | |
1130 | if(errors) break; | |
1131 | } | |
1132 | //Validations | |
1133 | if(errors) return usage_lf_em_write(); | |
1134 | ||
1135 | if ( strlen(Cmd) == 0 ) return usage_lf_em_write(); | |
1136 | ||
6a772a12 | 1137 | if (!gotData) { |
1138 | PrintAndLog("You must enter the data you want to write"); | |
1139 | return usage_lf_em_write(); | |
1140 | } | |
4ab135c0 | 1141 | return EM4x05WriteWord(addr, data, pwd, usePwd, swap, invert); |
1142 | } | |
1143 | ||
0a85edf4 | 1144 | void printEM4x05config(uint32_t wordData) { |
4ab135c0 | 1145 | uint16_t datarate = EM4x05_GET_BITRATE(wordData); |
0a85edf4 | 1146 | uint8_t encoder = ((wordData >> 6) & 0xF); |
1147 | char enc[14]; | |
1148 | memset(enc,0,sizeof(enc)); | |
1149 | ||
1150 | uint8_t PSKcf = (wordData >> 10) & 0x3; | |
1151 | char cf[10]; | |
1152 | memset(cf,0,sizeof(cf)); | |
1153 | uint8_t delay = (wordData >> 12) & 0x3; | |
1154 | char cdelay[33]; | |
1155 | memset(cdelay,0,sizeof(cdelay)); | |
4ab135c0 | 1156 | uint8_t numblks = EM4x05_GET_NUM_BLOCKS(wordData); |
1157 | uint8_t LWR = numblks+5-1; //last word read | |
0a85edf4 | 1158 | switch (encoder) { |
1159 | case 0: snprintf(enc,sizeof(enc),"NRZ"); break; | |
1160 | case 1: snprintf(enc,sizeof(enc),"Manchester"); break; | |
1161 | case 2: snprintf(enc,sizeof(enc),"Biphase"); break; | |
1162 | case 3: snprintf(enc,sizeof(enc),"Miller"); break; | |
1163 | case 4: snprintf(enc,sizeof(enc),"PSK1"); break; | |
1164 | case 5: snprintf(enc,sizeof(enc),"PSK2"); break; | |
1165 | case 6: snprintf(enc,sizeof(enc),"PSK3"); break; | |
1166 | case 7: snprintf(enc,sizeof(enc),"Unknown"); break; | |
1167 | case 8: snprintf(enc,sizeof(enc),"FSK1"); break; | |
1168 | case 9: snprintf(enc,sizeof(enc),"FSK2"); break; | |
1169 | default: snprintf(enc,sizeof(enc),"Unknown"); break; | |
1170 | } | |
1171 | ||
1172 | switch (PSKcf) { | |
1173 | case 0: snprintf(cf,sizeof(cf),"RF/2"); break; | |
1174 | case 1: snprintf(cf,sizeof(cf),"RF/8"); break; | |
1175 | case 2: snprintf(cf,sizeof(cf),"RF/4"); break; | |
1176 | case 3: snprintf(cf,sizeof(cf),"unknown"); break; | |
1177 | } | |
1178 | ||
1179 | switch (delay) { | |
1180 | case 0: snprintf(cdelay, sizeof(cdelay),"no delay"); break; | |
1181 | case 1: snprintf(cdelay, sizeof(cdelay),"BP/8 or 1/8th bit period delay"); break; | |
1182 | case 2: snprintf(cdelay, sizeof(cdelay),"BP/4 or 1/4th bit period delay"); break; | |
1183 | case 3: snprintf(cdelay, sizeof(cdelay),"no delay"); break; | |
1184 | } | |
4ab135c0 | 1185 | uint8_t readLogin = (wordData & EM4x05_READ_LOGIN_REQ)>>18; |
1186 | uint8_t readHKL = (wordData & EM4x05_READ_HK_LOGIN_REQ)>>19; | |
1187 | uint8_t writeLogin = (wordData & EM4x05_WRITE_LOGIN_REQ)>>20; | |
1188 | uint8_t writeHKL = (wordData & EM4x05_WRITE_HK_LOGIN_REQ)>>21; | |
1189 | uint8_t raw = (wordData & EM4x05_READ_AFTER_WRITE)>>22; | |
1190 | uint8_t disable = (wordData & EM4x05_DISABLE_ALLOWED)>>23; | |
1191 | uint8_t rtf = (wordData & EM4x05_READER_TALK_FIRST)>>24; | |
1192 | uint8_t pigeon = (wordData & (1<<26))>>26; | |
0a85edf4 | 1193 | PrintAndLog("ConfigWord: %08X (Word 4)\n", wordData); |
4ab135c0 | 1194 | PrintAndLog("Config Breakdown:"); |
33a1fe96 | 1195 | PrintAndLog(" Data Rate: %02u | RF/%u", wordData & 0x3F, datarate); |
0a85edf4 | 1196 | PrintAndLog(" Encoder: %u | %s", encoder, enc); |
1197 | PrintAndLog(" PSK CF: %u | %s", PSKcf, cf); | |
1198 | PrintAndLog(" Delay: %u | %s", delay, cdelay); | |
4ab135c0 | 1199 | PrintAndLog(" LastWordR: %02u | Address of last word for default read - meaning %u blocks are output", LWR, numblks); |
47af8c5f F |
1200 | PrintAndLog(" ReadLogin: %u | Read Login is %s", readLogin, readLogin ? "Required" : "Not Required"); |
1201 | PrintAndLog(" ReadHKL: %u | Read Housekeeping Words Login is %s", readHKL, readHKL ? "Required" : "Not Required"); | |
1202 | PrintAndLog("WriteLogin: %u | Write Login is %s", writeLogin, writeLogin ? "Required" : "Not Required"); | |
1203 | PrintAndLog(" WriteHKL: %u | Write Housekeeping Words Login is %s", writeHKL, writeHKL ? "Required" : "Not Required"); | |
4ab135c0 | 1204 | PrintAndLog(" R.A.W.: %u | Read After Write is %s", raw, raw ? "On" : "Off"); |
1205 | PrintAndLog(" Disable: %u | Disable Command is %s", disable, disable ? "Accepted" : "Not Accepted"); | |
1206 | PrintAndLog(" R.T.F.: %u | Reader Talk First is %s", rtf, rtf ? "Enabled" : "Disabled"); | |
1207 | PrintAndLog(" Pigeon: %u | Pigeon Mode is %s\n", pigeon, pigeon ? "Enabled" : "Disabled"); | |
0a85edf4 | 1208 | } |
1209 | ||
fa1e00cf | 1210 | void printEM4x05info(uint8_t chipType, uint8_t cap, uint16_t custCode, uint32_t serial) { |
1211 | switch (chipType) { | |
0a85edf4 | 1212 | case 9: PrintAndLog("\n Chip Type: %u | EM4305", chipType); break; |
1213 | case 4: PrintAndLog(" Chip Type: %u | Unknown", chipType); break; | |
1214 | case 2: PrintAndLog(" Chip Type: %u | EM4469", chipType); break; | |
fa1e00cf | 1215 | //add more here when known |
0a85edf4 | 1216 | default: PrintAndLog(" Chip Type: %u Unknown", chipType); break; |
fa1e00cf | 1217 | } |
1218 | ||
1219 | switch (cap) { | |
0a85edf4 | 1220 | case 3: PrintAndLog(" Cap Type: %u | 330pF",cap); break; |
1221 | case 2: PrintAndLog(" Cap Type: %u | %spF",cap, (chipType==2)? "75":"210"); break; | |
1222 | case 1: PrintAndLog(" Cap Type: %u | 250pF",cap); break; | |
1223 | case 0: PrintAndLog(" Cap Type: %u | no resonant capacitor",cap); break; | |
1224 | default: PrintAndLog(" Cap Type: %u | unknown",cap); break; | |
fa1e00cf | 1225 | } |
1226 | ||
0a85edf4 | 1227 | PrintAndLog(" Cust Code: %03u | %s", custCode, (custCode == 0x200) ? "Default": "Unknown"); |
fa1e00cf | 1228 | if (serial != 0) { |
0a85edf4 | 1229 | PrintAndLog("\n Serial #: %08X\n", serial); |
fa1e00cf | 1230 | } |
1231 | } | |
1232 | ||
34ff8985 | 1233 | void printEM4x05ProtectionBits(uint32_t wordData) { |
33a1fe96 | 1234 | for (uint8_t i = 0; i < 15; i++) { |
1235 | PrintAndLog(" Word: %02u | %s", i, (((1 << i) & wordData ) || i < 2) ? "Is Write Locked" : "Is Not Write Locked"); | |
1236 | if (i==14) { | |
1237 | PrintAndLog(" Word: %02u | %s", i+1, (((1 << i) & wordData ) || i < 2) ? "Is Write Locked" : "Is Not Write Locked"); | |
1238 | } | |
34ff8985 | 1239 | } |
1240 | } | |
1241 | ||
fa1e00cf | 1242 | //quick test for EM4x05/EM4x69 tag |
1243 | bool EM4x05Block0Test(uint32_t *wordData) { | |
1244 | if (EM4x05ReadWord_ext(0,0,false,wordData) == 1) { | |
1245 | return true; | |
1246 | } | |
1247 | return false; | |
1248 | } | |
1249 | ||
1250 | int CmdEM4x05info(const char *Cmd) { | |
1251 | //uint8_t addr = 0; | |
0a85edf4 | 1252 | uint32_t pwd; |
fa1e00cf | 1253 | uint32_t wordData = 0; |
0a85edf4 | 1254 | bool usePwd = false; |
fa1e00cf | 1255 | uint8_t ctmp = param_getchar(Cmd, 0); |
1256 | if ( ctmp == 'H' || ctmp == 'h' ) return usage_lf_em_dump(); | |
1257 | ||
1258 | // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) | |
0a85edf4 | 1259 | pwd = param_get32ex(Cmd, 0, 1, 16); |
47af8c5f | 1260 | |
0a85edf4 | 1261 | if ( pwd != 1 ) { |
1262 | usePwd = true; | |
1263 | } | |
fa1e00cf | 1264 | |
0a85edf4 | 1265 | // read word 0 (chip info) |
1266 | // block 0 can be read even without a password. | |
47af8c5f | 1267 | if ( !EM4x05Block0Test(&wordData) ) |
fa1e00cf | 1268 | return -1; |
47af8c5f | 1269 | |
fa1e00cf | 1270 | uint8_t chipType = (wordData >> 1) & 0xF; |
1271 | uint8_t cap = (wordData >> 5) & 3; | |
1272 | uint16_t custCode = (wordData >> 9) & 0x3FF; | |
47af8c5f | 1273 | |
0a85edf4 | 1274 | // read word 1 (serial #) doesn't need pwd |
fa1e00cf | 1275 | wordData = 0; |
1276 | if (EM4x05ReadWord_ext(1, 0, false, &wordData) != 1) { | |
1277 | //failed, but continue anyway... | |
1278 | } | |
1279 | printEM4x05info(chipType, cap, custCode, wordData); | |
1280 | ||
47af8c5f | 1281 | // read word 4 (config block) |
fa1e00cf | 1282 | // needs password if one is set |
0a85edf4 | 1283 | wordData = 0; |
1284 | if ( EM4x05ReadWord_ext(4, pwd, usePwd, &wordData) != 1 ) { | |
1285 | //failed | |
4ab135c0 | 1286 | PrintAndLog("Config block read failed - might be password protected."); |
0a85edf4 | 1287 | return 0; |
1288 | } | |
1289 | printEM4x05config(wordData); | |
34ff8985 | 1290 | |
1291 | // read word 14 and 15 to see which is being used for the protection bits | |
1292 | wordData = 0; | |
1293 | if ( EM4x05ReadWord_ext(14, pwd, usePwd, &wordData) != 1 ) { | |
1294 | //failed | |
1295 | return 0; | |
1296 | } | |
1297 | // if status bit says this is not the used protection word | |
1298 | if (!(wordData & 0x8000)) { | |
1299 | if ( EM4x05ReadWord_ext(15, pwd, usePwd, &wordData) != 1 ) { | |
1300 | //failed | |
1301 | return 0; | |
1302 | } | |
1303 | } | |
1304 | if (!(wordData & 0x8000)) { | |
1305 | //something went wrong | |
1306 | return 0; | |
1307 | } | |
1308 | printEM4x05ProtectionBits(wordData); | |
1309 | ||
0a85edf4 | 1310 | return 1; |
fa1e00cf | 1311 | } |
1312 | ||
1313 | ||
2d4eae76 | 1314 | static command_t CommandTable[] = |
7fe9b0b7 | 1315 | { |
35aa230e | 1316 | {"help", CmdHelp, 1, "This help"}, |
47af8c5f | 1317 | {"410xread", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"}, |
35aa230e | 1318 | {"410xdemod", CmdAskEM410xDemod, 1, "[clock] [invert<0|1>] [maxErr] -- Demodulate an EM410x tag from GraphBuffer (args optional)"}, |
1319 | {"410xsim", CmdEM410xSim, 0, "<UID> [clock rate] -- Simulate EM410x tag"}, | |
50acfd37 | 1320 | {"410xbrute", CmdEM410xBrute, 0, "ids.txt [clock rate] -- Bruteforcing by simulating EM410x tags (1 UID/s)"}, |
e39a92bb | 1321 | {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"}, |
1322 | {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" }, | |
1323 | {"410xwrite", CmdEM410xWrite, 0, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"}, | |
35aa230e | 1324 | {"4x05dump", CmdEM4x05dump, 0, "(pwd) -- Read EM4x05/EM4x69 all word data"}, |
1325 | {"4x05info", CmdEM4x05info, 0, "(pwd) -- Get info from EM4x05/EM4x69 tag"}, | |
1326 | {"4x05readword", CmdEM4x05ReadWord, 0, "<Word> (pwd) -- Read EM4x05/EM4x69 word data"}, | |
fa1e00cf | 1327 | {"4x05writeword", CmdEM4x05WriteWord, 0, "<Word> <data> (pwd) -- Write EM4x05/EM4x69 word data"}, |
35aa230e | 1328 | {"4x50read", CmdEM4x50Read, 1, "demod data from EM4x50 tag from the graph buffer"}, |
23f0a7d8 | 1329 | {NULL, NULL, 0, NULL} |
7fe9b0b7 | 1330 | }; |
1331 | ||
1332 | int CmdLFEM4X(const char *Cmd) | |
1333 | { | |
23f0a7d8 | 1334 | CmdsParse(CommandTable, Cmd); |
1335 | return 0; | |
7fe9b0b7 | 1336 | } |
1337 | ||
1338 | int CmdHelp(const char *Cmd) | |
1339 | { | |
23f0a7d8 | 1340 | CmdsHelp(CommandTable); |
1341 | return 0; | |
7fe9b0b7 | 1342 | } |