]>
Commit | Line | Data |
---|---|---|
54a942b0 | 1 | //-----------------------------------------------------------------------------\r |
2 | //\r | |
3 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
4 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
5 | // the license.\r | |
6 | //-----------------------------------------------------------------------------\r | |
7 | // Low frequency T55xx commands\r | |
8 | //-----------------------------------------------------------------------------\r | |
9 | \r | |
ad939de5 | 10 | #include "cmdlft55xx.h"\r |
11 | \r | |
54a942b0 | 12 | #include <stdio.h>\r |
13 | #include <string.h>\r | |
14 | #include <inttypes.h>\r | |
acf0582d | 15 | #include <ctype.h>\r |
16 | #include <time.h>\r | |
ad939de5 | 17 | #include "comms.h"\r |
54a942b0 | 18 | #include "ui.h"\r |
19 | #include "graph.h"\r | |
13d77ef9 | 20 | #include "cmdmain.h"\r |
54a942b0 | 21 | #include "cmdparser.h"\r |
22 | #include "cmddata.h"\r | |
23 | #include "cmdlf.h"\r | |
13d77ef9 | 24 | #include "util.h"\r |
13d77ef9 | 25 | #include "lfdemod.h"\r |
b97311b1 | 26 | #include "protocols.h"\r |
1338d245 | 27 | #include "taginfo.h"\r |
13d77ef9 | 28 | \r |
709665b5 | 29 | #define T55x7_CONFIGURATION_BLOCK 0x00\r |
30 | #define T55x7_PAGE0 0x00\r | |
31 | #define T55x7_PAGE1 0x01\r | |
3975d477 | 32 | //#define T55x7_PWD 0x00000010\r |
be2d41b7 | 33 | #define REGULAR_READ_MODE_BLOCK 0xFF\r |
13d77ef9 | 34 | \r |
35 | // Default configuration\r | |
7cb8516c | 36 | t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = false, .offset = 0x00, .block0 = 0x00, .Q5 = false };\r |
13d77ef9 | 37 | \r |
9f669cb2 | 38 | t55xx_conf_block_t Get_t55xx_Config(){\r |
39 | return config;\r | |
40 | }\r | |
41 | void Set_t55xx_Config(t55xx_conf_block_t conf){\r | |
42 | config = conf;\r | |
43 | }\r | |
44 | \r | |
13d77ef9 | 45 | int usage_t55xx_config(){\r |
f6650679 | 46 | PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");\r |
be2d41b7 | 47 | PrintAndLog("Options:");\r |
13d77ef9 | 48 | PrintAndLog(" h This help");\r |
f6650679 | 49 | PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");\r |
4ff341ef | 50 | PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");\r |
f6650679 | 51 | PrintAndLog(" i [1] Invert data signal, defaults to normal");\r |
52 | PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");\r | |
53 | PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");\r | |
d1869c33 | 54 | PrintAndLog(" ST Set Sequence Terminator on");\r |
13d77ef9 | 55 | PrintAndLog("");\r |
56 | PrintAndLog("Examples:");\r | |
57 | PrintAndLog(" lf t55xx config d FSK - FSK demodulation");\r | |
58 | PrintAndLog(" lf t55xx config d FSK i 1 - FSK demodulation, inverse data");\r | |
59 | PrintAndLog(" lf t55xx config d FSK i 1 o 3 - FSK demodulation, inverse data, offset=3,start from position 3 to decode data");\r | |
60 | PrintAndLog("");\r | |
61 | return 0;\r | |
62 | }\r | |
63 | int usage_t55xx_read(){\r | |
0c8200f1 | 64 | PrintAndLog("Usage: lf t55xx read [b <block>] [p <password>] <override_safety> <page1>");\r |
be2d41b7 | 65 | PrintAndLog("Options:");\r |
0c8200f1 | 66 | PrintAndLog(" b <block> - block number to read. Between 0-7");\r |
67 | PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r | |
68 | PrintAndLog(" o - OPTIONAL override safety check");\r | |
69 | PrintAndLog(" 1 - OPTIONAL read Page 1 instead of Page 0");\r | |
6dd0ff30 | 70 | PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r |
71 | PrintAndLog(" '2' leading zero, '3' 1 of 4 coding reference"); \r | |
f1b74c30 | 72 | PrintAndLog(" ****WARNING****");\r |
73 | PrintAndLog(" Use of read with password on a tag not configured for a pwd");\r | |
74 | PrintAndLog(" can damage the tag");\r | |
185e038c | 75 | PrintAndLog("");\r |
13d77ef9 | 76 | PrintAndLog("Examples:");\r |
0c8200f1 | 77 | PrintAndLog(" lf t55xx read b 0 - read data from block 0");\r |
be2d41b7 | 78 | PrintAndLog(" lf t55xx read b 0 p feedbeef - read data from block 0 password feedbeef");\r |
79 | PrintAndLog(" lf t55xx read b 0 p feedbeef o - read data from block 0 password feedbeef safety check");\r | |
13d77ef9 | 80 | PrintAndLog("");\r |
81 | return 0;\r | |
82 | }\r | |
83 | int usage_t55xx_write(){\r | |
b97311b1 | 84 | PrintAndLog("Usage: lf t55xx write [b <block>] [d <data>] [p <password>] [1] [t]");\r |
be2d41b7 | 85 | PrintAndLog("Options:");\r |
0c8200f1 | 86 | PrintAndLog(" b <block> - block number to write. Between 0-7");\r |
87 | PrintAndLog(" d <data> - 4 bytes of data to write (8 hex characters)");\r | |
88 | PrintAndLog(" p <password> - OPTIONAL password 4bytes (8 hex characters)");\r | |
89 | PrintAndLog(" 1 - OPTIONAL write Page 1 instead of Page 0");\r | |
b97311b1 | 90 | PrintAndLog(" t - OPTIONAL test mode write - ****DANGER****"); \r |
6dd0ff30 | 91 | PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r |
92 | PrintAndLog(" '2' leading zero, '3' 1 of 4 coding reference"); \r | |
185e038c | 93 | PrintAndLog("");\r |
13d77ef9 | 94 | PrintAndLog("Examples:");\r |
72c5877a | 95 | PrintAndLog(" lf t55xx write b 3 d 11223344 - write 11223344 to block 3");\r |
96 | PrintAndLog(" lf t55xx write b 3 d 11223344 p feedbeef - write 11223344 to block 3 password feedbeef");\r | |
13d77ef9 | 97 | PrintAndLog("");\r |
98 | return 0;\r | |
99 | }\r | |
100 | int usage_t55xx_trace() {\r | |
101 | PrintAndLog("Usage: lf t55xx trace [1]");\r | |
be2d41b7 | 102 | PrintAndLog("Options:");\r |
0c8200f1 | 103 | PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");\r |
13d77ef9 | 104 | PrintAndLog("");\r |
105 | PrintAndLog("Examples:");\r | |
106 | PrintAndLog(" lf t55xx trace");\r | |
107 | PrintAndLog(" lf t55xx trace 1");\r | |
108 | PrintAndLog("");\r | |
109 | return 0;\r | |
110 | }\r | |
111 | int usage_t55xx_info() {\r | |
112 | PrintAndLog("Usage: lf t55xx info [1]");\r | |
be2d41b7 | 113 | PrintAndLog("Options:");\r |
0c8200f1 | 114 | PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");\r |
13d77ef9 | 115 | PrintAndLog("");\r |
116 | PrintAndLog("Examples:");\r | |
117 | PrintAndLog(" lf t55xx info");\r | |
118 | PrintAndLog(" lf t55xx info 1");\r | |
119 | PrintAndLog("");\r | |
120 | return 0;\r | |
121 | }\r | |
122 | int usage_t55xx_dump(){\r | |
be2d41b7 | 123 | PrintAndLog("Usage: lf t55xx dump <password> [o]");\r |
124 | PrintAndLog("Options:");\r | |
0c8200f1 | 125 | PrintAndLog(" <password> - OPTIONAL password 4bytes (8 hex symbols)");\r |
126 | PrintAndLog(" o - OPTIONAL override, force pwd read despite danger to card");\r | |
13d77ef9 | 127 | PrintAndLog("");\r |
128 | PrintAndLog("Examples:");\r | |
129 | PrintAndLog(" lf t55xx dump");\r | |
be2d41b7 | 130 | PrintAndLog(" lf t55xx dump feedbeef o");\r |
13d77ef9 | 131 | PrintAndLog("");\r |
132 | return 0;\r | |
133 | }\r | |
134 | int usage_t55xx_detect(){\r | |
ab5ffe3b | 135 | PrintAndLog("Usage: lf t55xx detect [1] [p <password>]");\r |
be2d41b7 | 136 | PrintAndLog("Options:");\r |
ab5ffe3b | 137 | PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");\r |
138 | PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r | |
6dd0ff30 | 139 | PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r |
140 | PrintAndLog(" '2' leading zero, '3' 1 of 4 coding reference"); \r | |
13d77ef9 | 141 | PrintAndLog("");\r |
142 | PrintAndLog("Examples:");\r | |
143 | PrintAndLog(" lf t55xx detect");\r | |
144 | PrintAndLog(" lf t55xx detect 1");\r | |
ab5ffe3b | 145 | PrintAndLog(" lf t55xx detect p 11223344");\r |
13d77ef9 | 146 | PrintAndLog("");\r |
147 | return 0;\r | |
148 | }\r | |
b97311b1 | 149 | int usage_t55xx_detectP1(){\r |
605524b1 | 150 | PrintAndLog("Command: Detect Page 1 of a t55xx chip");\r |
151 | PrintAndLog("Usage: lf t55xx p1detect [1] [p <password>]");\r | |
b97311b1 | 152 | PrintAndLog("Options:");\r |
153 | PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");\r | |
154 | PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r | |
155 | PrintAndLog("");\r | |
156 | PrintAndLog("Examples:");\r | |
605524b1 | 157 | PrintAndLog(" lf t55xx p1detect");\r |
158 | PrintAndLog(" lf t55xx p1detect 1");\r | |
159 | PrintAndLog(" lf t55xx p1detect p 11223344");\r | |
b97311b1 | 160 | PrintAndLog("");\r |
161 | return 0;\r | |
162 | }\r | |
be2d41b7 | 163 | int usage_t55xx_wakup(){\r |
b97311b1 | 164 | PrintAndLog("Usage: lf t55xx wakeup [h] <password>");\r |
be2d41b7 | 165 | PrintAndLog("This commands send the Answer-On-Request command and leaves the readerfield ON afterwards.");\r |
166 | PrintAndLog("Options:");\r | |
167 | PrintAndLog(" h - this help");\r | |
b97311b1 | 168 | PrintAndLog(" <password> - [required] password 4bytes (8 hex symbols)");\r |
be2d41b7 | 169 | PrintAndLog("");\r |
170 | PrintAndLog("Examples:");\r | |
b97311b1 | 171 | PrintAndLog(" lf t55xx wakeup 11223344 - send wakeup password");\r |
be2d41b7 | 172 | return 0;\r |
173 | }\r | |
506672c4 | 174 | int usage_t55xx_bruteforce(){\r |
51923aca | 175 | PrintAndLog("This command uses A) bruteforce to scan a number range");\r |
176 | PrintAndLog(" B) a dictionary attack");\r | |
506672c4 | 177 | PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r |
178 | PrintAndLog(" password must be 4 bytes (8 hex symbols)");\r | |
179 | PrintAndLog("Options:");\r | |
51923aca | 180 | PrintAndLog(" h - this help");\r |
181 | PrintAndLog(" <start_pwd> - 4 byte hex value to start pwd search at");\r | |
182 | PrintAndLog(" <end_pwd> - 4 byte hex value to end pwd search at");\r | |
183 | PrintAndLog(" i <*.dic> - loads a default keys dictionary file <*.dic>");\r | |
506672c4 | 184 | PrintAndLog("");\r |
185 | PrintAndLog("Examples:");\r | |
186 | PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r | |
51923aca | 187 | PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");\r |
506672c4 | 188 | PrintAndLog("");\r |
189 | return 0;\r | |
190 | }\r | |
dd8e4513 | 191 | int usage_t55xx_bruteforce_downlink(){\r |
192 | PrintAndLog("This command uses A) bruteforce to scan a number range");\r | |
193 | PrintAndLog(" B) a dictionary attack");\r | |
194 | PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r | |
195 | PrintAndLog(" password must be 4 bytes (8 hex symbols)");\r | |
196 | PrintAndLog("Options:");\r | |
197 | PrintAndLog(" h - this help");\r | |
198 | PrintAndLog(" r <start_pwd> <end_pwd> - 4 byte hex value to start and end pwd search at");\r | |
6dd0ff30 | 199 | PrintAndLog(" i <*.dic> - loads a default keys dictionary file <*.dic>");\r |
200 | PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed bit length (default)"); \r | |
201 | PrintAndLog(" '1' long leading reference, '2' leading zero ");\r | |
202 | PrintAndLog(" '3' 1 of 4 coding reference, '4' special - try all downlink modes");\r | |
dd8e4513 | 203 | PrintAndLog("");\r |
204 | PrintAndLog("Examples:");\r | |
205 | PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r | |
206 | PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");\r | |
207 | PrintAndLog("");\r | |
208 | return 0;\r | |
209 | }\r | |
5490c2d6 | 210 | int usage_t55xx_wipe(){\r |
211 | PrintAndLog("Usage: lf t55xx wipe [h] [Q5]");\r | |
212 | PrintAndLog("This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block");\r | |
213 | PrintAndLog("Options:");\r | |
214 | PrintAndLog(" h - this help");\r | |
215 | PrintAndLog(" Q5 - indicates to use the T5555 (Q5) default configuration block");\r | |
216 | PrintAndLog("");\r | |
217 | PrintAndLog("Examples:");\r | |
218 | PrintAndLog(" lf t55xx wipe - wipes a t55x7 tag, config block 0x000880E0");\r | |
219 | PrintAndLog(" lf t55xx wipe Q5 - wipes a t5555 Q5 tag, config block 0x6001F004");\r | |
220 | return 0;\r | |
221 | }\r | |
222 | \r | |
54a942b0 | 223 | \r |
224 | static int CmdHelp(const char *Cmd);\r | |
225 | \r | |
709665b5 | 226 | void printT5xxHeader(uint8_t page){\r |
506672c4 | 227 | PrintAndLog("Reading Page %d:", page);\r |
709665b5 | 228 | PrintAndLog("blk | hex data | binary");\r |
229 | PrintAndLog("----+----------+---------------------------------"); \r | |
230 | }\r | |
231 | \r | |
13d77ef9 | 232 | int CmdT55xxSetConfig(const char *Cmd) {\r |
54a942b0 | 233 | \r |
13d77ef9 | 234 | uint8_t offset = 0;\r |
b6a04aff | 235 | char modulation[6] = {0x00};\r |
13d77ef9 | 236 | char tmp = 0x00;\r |
237 | uint8_t bitRate = 0;\r | |
238 | uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};\r | |
8e99ec25 | 239 | uint8_t cmdp = 0;\r |
7cb8516c | 240 | bool errors = false;\r |
13d77ef9 | 241 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors)\r |
242 | {\r | |
243 | tmp = param_getchar(Cmd, cmdp);\r | |
244 | switch(tmp)\r | |
245 | {\r | |
246 | case 'h':\r | |
247 | case 'H':\r | |
248 | return usage_t55xx_config();\r | |
249 | case 'b':\r | |
250 | errors |= param_getdec(Cmd, cmdp+1, &bitRate);\r | |
251 | if ( !errors){\r | |
252 | uint8_t i = 0;\r | |
253 | for (; i < 9; i++){\r | |
254 | if (rates[i]==bitRate) {\r | |
255 | config.bitrate = i;\r | |
256 | break;\r | |
257 | }\r | |
258 | }\r | |
7cb8516c | 259 | if (i==9) errors = true;\r |
13d77ef9 | 260 | }\r |
261 | cmdp+=2;\r | |
262 | break;\r | |
263 | case 'd':\r | |
874572d4 | 264 | param_getstr(Cmd, cmdp+1, modulation, sizeof(modulation));\r |
13d77ef9 | 265 | cmdp += 2;\r |
54a942b0 | 266 | \r |
2767fc02 | 267 | if ( strcmp(modulation, "FSK" ) == 0) {\r |
13d77ef9 | 268 | config.modulation = DEMOD_FSK;\r |
2767fc02 | 269 | } else if ( strcmp(modulation, "FSK1" ) == 0) {\r |
13d77ef9 | 270 | config.modulation = DEMOD_FSK1;\r |
2767fc02 | 271 | config.inverted=1;\r |
272 | } else if ( strcmp(modulation, "FSK1a" ) == 0) {\r | |
13d77ef9 | 273 | config.modulation = DEMOD_FSK1a;\r |
2767fc02 | 274 | config.inverted=0;\r |
275 | } else if ( strcmp(modulation, "FSK2" ) == 0) {\r | |
13d77ef9 | 276 | config.modulation = DEMOD_FSK2;\r |
2767fc02 | 277 | config.inverted=0;\r |
278 | } else if ( strcmp(modulation, "FSK2a" ) == 0) {\r | |
13d77ef9 | 279 | config.modulation = DEMOD_FSK2a;\r |
2767fc02 | 280 | config.inverted=1;\r |
281 | } else if ( strcmp(modulation, "ASK" ) == 0) {\r | |
13d77ef9 | 282 | config.modulation = DEMOD_ASK;\r |
2767fc02 | 283 | } else if ( strcmp(modulation, "NRZ" ) == 0) {\r |
13d77ef9 | 284 | config.modulation = DEMOD_NRZ;\r |
2767fc02 | 285 | } else if ( strcmp(modulation, "PSK1" ) == 0) {\r |
13d77ef9 | 286 | config.modulation = DEMOD_PSK1;\r |
2767fc02 | 287 | } else if ( strcmp(modulation, "PSK2" ) == 0) {\r |
13d77ef9 | 288 | config.modulation = DEMOD_PSK2;\r |
2767fc02 | 289 | } else if ( strcmp(modulation, "PSK3" ) == 0) {\r |
13d77ef9 | 290 | config.modulation = DEMOD_PSK3;\r |
2767fc02 | 291 | } else if ( strcmp(modulation, "BIa" ) == 0) {\r |
13d77ef9 | 292 | config.modulation = DEMOD_BIa;\r |
2767fc02 | 293 | config.inverted=1;\r |
294 | } else if ( strcmp(modulation, "BI" ) == 0) {\r | |
13d77ef9 | 295 | config.modulation = DEMOD_BI;\r |
2767fc02 | 296 | config.inverted=0;\r |
297 | } else {\r | |
13d77ef9 | 298 | PrintAndLog("Unknown modulation '%s'", modulation);\r |
7cb8516c | 299 | errors = true;\r |
13d77ef9 | 300 | }\r |
301 | break;\r | |
302 | case 'i':\r | |
303 | config.inverted = param_getchar(Cmd,cmdp+1) == '1';\r | |
304 | cmdp+=2;\r | |
305 | break;\r | |
306 | case 'o':\r | |
307 | errors |= param_getdec(Cmd, cmdp+1, &offset);\r | |
308 | if ( !errors )\r | |
309 | config.offset = offset;\r | |
310 | cmdp+=2;\r | |
311 | break;\r | |
f6650679 | 312 | case 'Q':\r |
313 | case 'q': \r | |
7cb8516c | 314 | config.Q5 = true;\r |
f6650679 | 315 | cmdp++;\r |
316 | break;\r | |
d1869c33 | 317 | case 'S':\r |
318 | case 's': \r | |
7cb8516c | 319 | config.ST = true;\r |
d1869c33 | 320 | cmdp++;\r |
321 | break;\r | |
13d77ef9 | 322 | default:\r |
323 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
7cb8516c | 324 | errors = true;\r |
13d77ef9 | 325 | break;\r |
326 | }\r | |
327 | }\r | |
54a942b0 | 328 | \r |
13d77ef9 | 329 | // No args\r |
be2d41b7 | 330 | if (cmdp == 0) return printConfiguration( config );\r |
331 | \r | |
13d77ef9 | 332 | //Validations\r |
be2d41b7 | 333 | if (errors) return usage_t55xx_config();\r |
54a942b0 | 334 | \r |
be2d41b7 | 335 | config.block0 = 0;\r |
336 | return printConfiguration ( config );\r | |
337 | }\r | |
338 | \r | |
dd8e4513 | 339 | int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32_t password, uint8_t downlink_mode){\r |
be2d41b7 | 340 | //Password mode\r |
341 | if ( usepwd ) {\r | |
342 | // try reading the config block and verify that PWD bit is set before doing this!\r | |
343 | if ( !override ) {\r | |
dd8e4513 | 344 | if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0,downlink_mode ) ) return 0;\r |
be2d41b7 | 345 | if ( !tryDetectModulation() ) {\r |
346 | PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");\r | |
347 | return 0;\r | |
348 | } else {\r | |
349 | PrintAndLog("Safety Check: PWD bit is NOT set in config block. Reading without password..."); \r | |
350 | usepwd = false;\r | |
351 | page1 = false;\r | |
352 | }\r | |
353 | } else {\r | |
354 | PrintAndLog("Safety Check Overriden - proceeding despite risk");\r | |
355 | }\r | |
356 | }\r | |
357 | \r | |
dd8e4513 | 358 | if (!AquireData(page1, block, usepwd, password,downlink_mode) ) return 0;\r |
be2d41b7 | 359 | if (!DecodeT55xxBlock()) return 0;\r |
360 | \r | |
361 | char blk[10]={0};\r | |
362 | sprintf(blk,"%d", block);\r | |
363 | printT55xxBlock(blk); \r | |
364 | return 1;\r | |
13d77ef9 | 365 | }\r |
54a942b0 | 366 | \r |
13d77ef9 | 367 | int CmdT55xxReadBlock(const char *Cmd) {\r |
be2d41b7 | 368 | uint8_t block = REGULAR_READ_MODE_BLOCK;\r |
369 | uint32_t password = 0; //default to blank Block 7\r | |
dd8e4513 | 370 | uint8_t downlink_mode = 0;\r |
371 | \r | |
be2d41b7 | 372 | bool usepwd = false;\r |
373 | bool override = false;\r | |
374 | bool page1 = false;\r | |
8e99ec25 | 375 | bool errors = false;\r |
be2d41b7 | 376 | uint8_t cmdp = 0;\r |
8e99ec25 | 377 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r |
378 | switch(param_getchar(Cmd, cmdp)) {\r | |
379 | case 'h':\r | |
380 | case 'H':\r | |
381 | return usage_t55xx_read();\r | |
382 | case 'b':\r | |
383 | case 'B':\r | |
384 | errors |= param_getdec(Cmd, cmdp+1, &block);\r | |
be2d41b7 | 385 | cmdp += 2;\r |
8e99ec25 | 386 | break;\r |
387 | case 'o':\r | |
388 | case 'O':\r | |
be2d41b7 | 389 | override = true;\r |
8e99ec25 | 390 | cmdp++;\r |
391 | break;\r | |
392 | case 'p':\r | |
393 | case 'P':\r | |
be2d41b7 | 394 | password = param_get32ex(Cmd, cmdp+1, 0, 16);\r |
395 | usepwd = true;\r | |
396 | cmdp += 2;\r | |
8e99ec25 | 397 | break;\r |
be2d41b7 | 398 | case '1':\r |
399 | page1 = true;\r | |
8e99ec25 | 400 | cmdp++;\r |
401 | break;\r | |
dd8e4513 | 402 | case 'e':\r |
403 | case 'E':\r | |
404 | downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r | |
405 | if (downlink_mode > 3) downlink_mode = 0;\r | |
406 | cmdp +=2;\r | |
407 | break;\r | |
8e99ec25 | 408 | default:\r |
409 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
410 | errors = true;\r | |
411 | break;\r | |
412 | }\r | |
413 | }\r | |
414 | if (errors) return usage_t55xx_read();\r | |
13d77ef9 | 415 | \r |
be2d41b7 | 416 | if (block > 7 && block != REGULAR_READ_MODE_BLOCK ) {\r |
417 | PrintAndLog("Block must be between 0 and 7");\r | |
418 | return 0;\r | |
8e99ec25 | 419 | }\r |
709665b5 | 420 | \r |
421 | printT5xxHeader(page1);\r | |
dd8e4513 | 422 | return T55xxReadBlock(block, page1, usepwd, override, password, downlink_mode);\r |
54a942b0 | 423 | }\r |
424 | \r | |
13d77ef9 | 425 | bool DecodeT55xxBlock(){\r |
426 | \r | |
fef74fdc | 427 | char buf[30] = {0x00};\r |
13d77ef9 | 428 | char *cmdStr = buf;\r |
429 | int ans = 0;\r | |
d1869c33 | 430 | bool ST = config.ST;\r |
13d77ef9 | 431 | uint8_t bitRate[8] = {8,16,32,40,50,64,100,128};\r |
13d77ef9 | 432 | DemodBufferLen = 0x00;\r |
54a942b0 | 433 | \r |
13d77ef9 | 434 | switch( config.modulation ){\r |
435 | case DEMOD_FSK:\r | |
224ce36e | 436 | snprintf(cmdStr, sizeof(buf),"%d %d", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 437 | ans = FSKrawDemod(cmdStr, false);\r |
13d77ef9 | 438 | break;\r |
439 | case DEMOD_FSK1:\r | |
13d77ef9 | 440 | case DEMOD_FSK1a:\r |
224ce36e | 441 | snprintf(cmdStr, sizeof(buf),"%d %d 8 5", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 442 | ans = FSKrawDemod(cmdStr, false);\r |
13d77ef9 | 443 | break;\r |
444 | case DEMOD_FSK2:\r | |
13d77ef9 | 445 | case DEMOD_FSK2a:\r |
224ce36e | 446 | snprintf(cmdStr, sizeof(buf),"%d %d 10 8", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 447 | ans = FSKrawDemod(cmdStr, false);\r |
13d77ef9 | 448 | break;\r |
449 | case DEMOD_ASK:\r | |
db829602 | 450 | snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 451 | ans = ASKDemod_ext(cmdStr, false, false, 1, &ST);\r |
13d77ef9 | 452 | break;\r |
453 | case DEMOD_PSK1:\r | |
db829602 | 454 | // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r |
3fd7fce4 | 455 | save_restoreGB(GRAPH_SAVE);\r |
db829602 | 456 | CmdLtrim("160");\r |
457 | snprintf(cmdStr, sizeof(buf),"%d %d 6", bitRate[config.bitrate], config.inverted );\r | |
7cb8516c | 458 | ans = PSKDemod(cmdStr, false);\r |
534678c3 | 459 | //undo trim samples\r |
3fd7fce4 | 460 | save_restoreGB(GRAPH_RESTORE);\r |
13d77ef9 | 461 | break;\r |
2767fc02 | 462 | case DEMOD_PSK2: //inverted won't affect this\r |
463 | case DEMOD_PSK3: //not fully implemented\r | |
db829602 | 464 | // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r |
3fd7fce4 | 465 | save_restoreGB(GRAPH_SAVE);\r |
db829602 | 466 | CmdLtrim("160");\r |
467 | snprintf(cmdStr, sizeof(buf),"%d 0 6", bitRate[config.bitrate] );\r | |
7cb8516c | 468 | ans = PSKDemod(cmdStr, false);\r |
13d77ef9 | 469 | psk1TOpsk2(DemodBuffer, DemodBufferLen);\r |
534678c3 | 470 | //undo trim samples\r |
3fd7fce4 | 471 | save_restoreGB(GRAPH_RESTORE);\r |
13d77ef9 | 472 | break;\r |
473 | case DEMOD_NRZ:\r | |
224ce36e | 474 | snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 475 | ans = NRZrawDemod(cmdStr, false);\r |
13d77ef9 | 476 | break;\r |
477 | case DEMOD_BI:\r | |
13d77ef9 | 478 | case DEMOD_BIa:\r |
db829602 | 479 | snprintf(cmdStr, sizeof(buf),"0 %d %d 1", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 480 | ans = ASKbiphaseDemod(cmdStr, false);\r |
13d77ef9 | 481 | break;\r |
482 | default:\r | |
7cb8516c | 483 | return false;\r |
13d77ef9 | 484 | }\r |
485 | return (bool) ans;\r | |
486 | }\r | |
54a942b0 | 487 | \r |
5490c2d6 | 488 | bool DecodeT5555TraceBlock() {\r |
489 | DemodBufferLen = 0x00;\r | |
490 | \r | |
491 | // According to datasheet. Always: RF/64, not inverted, Manchester\r | |
7cb8516c | 492 | return (bool) ASKDemod("64 0 1", false, false, 1);\r |
5490c2d6 | 493 | }\r |
494 | \r | |
13d77ef9 | 495 | int CmdT55xxDetect(const char *Cmd){\r |
7cb8516c | 496 | bool errors = false;\r |
497 | bool useGB = false;\r | |
498 | bool usepwd = false;\r | |
ab5ffe3b | 499 | uint32_t password = 0;\r |
500 | uint8_t cmdp = 0;\r | |
dd8e4513 | 501 | uint8_t downlink_mode = 0;\r |
54a942b0 | 502 | \r |
ab5ffe3b | 503 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r |
504 | switch(param_getchar(Cmd, cmdp)) {\r | |
505 | case 'h':\r | |
506 | case 'H':\r | |
507 | return usage_t55xx_detect();\r | |
508 | case 'p':\r | |
509 | case 'P':\r | |
510 | password = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
7cb8516c | 511 | usepwd = true;\r |
ab5ffe3b | 512 | cmdp += 2;\r |
513 | break;\r | |
514 | case '1':\r | |
515 | // use Graphbuffer data\r | |
7cb8516c | 516 | useGB = true;\r |
ab5ffe3b | 517 | cmdp++;\r |
518 | break;\r | |
dd8e4513 | 519 | case 'e':\r |
520 | case 'E':\r | |
521 | downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r | |
522 | if (downlink_mode > 3) downlink_mode = 0;\r | |
523 | cmdp +=2;\r | |
524 | break; \r | |
ab5ffe3b | 525 | default:\r |
526 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
527 | errors = true;\r | |
528 | break;\r | |
529 | }\r | |
709665b5 | 530 | }\r |
ab5ffe3b | 531 | if (errors) return usage_t55xx_detect();\r |
13d77ef9 | 532 | \r |
ab5ffe3b | 533 | if ( !useGB) {\r |
dd8e4513 | 534 | if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password,downlink_mode) )\r |
ab5ffe3b | 535 | return 0;\r |
709665b5 | 536 | }\r |
ab5ffe3b | 537 | \r |
13d77ef9 | 538 | if ( !tryDetectModulation() )\r |
539 | PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");\r | |
dd8e4513 | 540 | else {\r |
541 | // Add downlink mode to reference.\r | |
542 | switch (downlink_mode) {\r | |
543 | case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r | |
544 | case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r | |
545 | case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r | |
546 | case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r | |
547 | // default:\r | |
548 | \r | |
549 | // No default action\r | |
550 | }\r | |
551 | }\r | |
be2d41b7 | 552 | return 1;\r |
54a942b0 | 553 | }\r |
554 | \r | |
13d77ef9 | 555 | // detect configuration?\r |
556 | bool tryDetectModulation(){\r | |
13d77ef9 | 557 | uint8_t hits = 0;\r |
558 | t55xx_conf_block_t tests[15];\r | |
fef74fdc | 559 | int bitRate=0;\r |
b97311b1 | 560 | uint8_t fc1 = 0, fc2 = 0, ans = 0;\r |
bb4e6dbd | 561 | int clk = 0, firstClockEdge = 0;\r |
562 | ans = fskClocks(&fc1, &fc2, (uint8_t *)&clk, false, &firstClockEdge);\r | |
b97311b1 | 563 | if (ans && ((fc1==10 && fc2==8) || (fc1==8 && fc2==5))) {\r |
7cb8516c | 564 | if ( FSKrawDemod("0 0", false) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
13d77ef9 | 565 | tests[hits].modulation = DEMOD_FSK;\r |
566 | if (fc1==8 && fc2 == 5)\r | |
567 | tests[hits].modulation = DEMOD_FSK1a;\r | |
f6650679 | 568 | else if (fc1==10 && fc2 == 8)\r |
13d77ef9 | 569 | tests[hits].modulation = DEMOD_FSK2;\r |
fef74fdc | 570 | tests[hits].bitrate = bitRate;\r |
7cb8516c | 571 | tests[hits].inverted = false;\r |
13d77ef9 | 572 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 573 | tests[hits].ST = false;\r |
13d77ef9 | 574 | ++hits;\r |
575 | }\r | |
7cb8516c | 576 | if ( FSKrawDemod("0 1", false) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
13d77ef9 | 577 | tests[hits].modulation = DEMOD_FSK;\r |
fef74fdc | 578 | if (fc1 == 8 && fc2 == 5)\r |
13d77ef9 | 579 | tests[hits].modulation = DEMOD_FSK1;\r |
fef74fdc | 580 | else if (fc1 == 10 && fc2 == 8)\r |
13d77ef9 | 581 | tests[hits].modulation = DEMOD_FSK2a;\r |
fef74fdc | 582 | tests[hits].bitrate = bitRate;\r |
7cb8516c | 583 | tests[hits].inverted = true;\r |
13d77ef9 | 584 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 585 | tests[hits].ST = false;\r |
13d77ef9 | 586 | ++hits;\r |
587 | }\r | |
588 | } else {\r | |
7cb8516c | 589 | clk = GetAskClock("", false, false);\r |
322f7eb1 | 590 | if (clk>0) {\r |
7cb8516c | 591 | tests[hits].ST = true;\r |
592 | if ( ASKDemod_ext("0 0 1", false, false, 1, &tests[hits].ST) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r | |
322f7eb1 | 593 | tests[hits].modulation = DEMOD_ASK;\r |
594 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 595 | tests[hits].inverted = false;\r |
322f7eb1 | 596 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
597 | ++hits;\r | |
598 | }\r | |
7cb8516c | 599 | tests[hits].ST = true;\r |
600 | if ( ASKDemod_ext("0 1 1", false, false, 1, &tests[hits].ST) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r | |
322f7eb1 | 601 | tests[hits].modulation = DEMOD_ASK;\r |
602 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 603 | tests[hits].inverted = true;\r |
322f7eb1 | 604 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
605 | ++hits;\r | |
606 | }\r | |
7cb8516c | 607 | if ( ASKbiphaseDemod("0 0 0 2", false) && test(DEMOD_BI, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r |
322f7eb1 | 608 | tests[hits].modulation = DEMOD_BI;\r |
609 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 610 | tests[hits].inverted = false;\r |
322f7eb1 | 611 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 612 | tests[hits].ST = false;\r |
322f7eb1 | 613 | ++hits;\r |
614 | }\r | |
7cb8516c | 615 | if ( ASKbiphaseDemod("0 0 1 2", false) && test(DEMOD_BIa, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r |
322f7eb1 | 616 | tests[hits].modulation = DEMOD_BIa;\r |
617 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 618 | tests[hits].inverted = true;\r |
322f7eb1 | 619 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 620 | tests[hits].ST = false;\r |
322f7eb1 | 621 | ++hits;\r |
622 | }\r | |
13d77ef9 | 623 | }\r |
7cb8516c | 624 | clk = GetNrzClock("", false, false);\r |
bf85d22f | 625 | if (clk>8) { //clock of rf/8 is likely a false positive, so don't use it.\r |
7cb8516c | 626 | if ( NRZrawDemod("0 0 1", false) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
322f7eb1 | 627 | tests[hits].modulation = DEMOD_NRZ;\r |
628 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 629 | tests[hits].inverted = false;\r |
322f7eb1 | 630 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 631 | tests[hits].ST = false;\r |
322f7eb1 | 632 | ++hits;\r |
633 | }\r | |
54a942b0 | 634 | \r |
7cb8516c | 635 | if ( NRZrawDemod("0 1 1", false) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
322f7eb1 | 636 | tests[hits].modulation = DEMOD_NRZ;\r |
637 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 638 | tests[hits].inverted = true;\r |
322f7eb1 | 639 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 640 | tests[hits].ST = false;\r |
322f7eb1 | 641 | ++hits;\r |
642 | }\r | |
13d77ef9 | 643 | }\r |
644 | \r | |
7cb8516c | 645 | clk = GetPskClock("", false, false);\r |
322f7eb1 | 646 | if (clk>0) {\r |
b97311b1 | 647 | // allow undo\r |
3fd7fce4 | 648 | save_restoreGB(GRAPH_SAVE);\r |
b97311b1 | 649 | // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r |
650 | CmdLtrim("160");\r | |
7cb8516c | 651 | if ( PSKDemod("0 0 6", false) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
322f7eb1 | 652 | tests[hits].modulation = DEMOD_PSK1;\r |
fef74fdc | 653 | tests[hits].bitrate = bitRate;\r |
7cb8516c | 654 | tests[hits].inverted = false;\r |
13d77ef9 | 655 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 656 | tests[hits].ST = false;\r |
13d77ef9 | 657 | ++hits;\r |
658 | }\r | |
7cb8516c | 659 | if ( PSKDemod("0 1 6", false) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
322f7eb1 | 660 | tests[hits].modulation = DEMOD_PSK1;\r |
fef74fdc | 661 | tests[hits].bitrate = bitRate;\r |
7cb8516c | 662 | tests[hits].inverted = true;\r |
13d77ef9 | 663 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 664 | tests[hits].ST = false;\r |
13d77ef9 | 665 | ++hits;\r |
666 | }\r | |
322f7eb1 | 667 | // PSK2 - needs a call to psk1TOpsk2.\r |
7cb8516c | 668 | if ( PSKDemod("0 0 6", false)) {\r |
322f7eb1 | 669 | psk1TOpsk2(DemodBuffer, DemodBufferLen);\r |
f6650679 | 670 | if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r |
322f7eb1 | 671 | tests[hits].modulation = DEMOD_PSK2;\r |
672 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 673 | tests[hits].inverted = false;\r |
322f7eb1 | 674 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 675 | tests[hits].ST = false;\r |
322f7eb1 | 676 | ++hits;\r |
677 | }\r | |
678 | } // inverse waves does not affect this demod\r | |
679 | // PSK3 - needs a call to psk1TOpsk2.\r | |
7cb8516c | 680 | if ( PSKDemod("0 0 6", false)) {\r |
322f7eb1 | 681 | psk1TOpsk2(DemodBuffer, DemodBufferLen);\r |
f6650679 | 682 | if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r |
322f7eb1 | 683 | tests[hits].modulation = DEMOD_PSK3;\r |
684 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 685 | tests[hits].inverted = false;\r |
322f7eb1 | 686 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 687 | tests[hits].ST = false;\r |
322f7eb1 | 688 | ++hits;\r |
689 | }\r | |
690 | } // inverse waves does not affect this demod\r | |
b97311b1 | 691 | //undo trim samples\r |
3fd7fce4 | 692 | save_restoreGB(GRAPH_RESTORE);\r |
13d77ef9 | 693 | }\r |
6fe5c94b | 694 | } \r |
13d77ef9 | 695 | if ( hits == 1) {\r |
696 | config.modulation = tests[0].modulation;\r | |
fef74fdc | 697 | config.bitrate = tests[0].bitrate;\r |
13d77ef9 | 698 | config.inverted = tests[0].inverted;\r |
699 | config.offset = tests[0].offset;\r | |
700 | config.block0 = tests[0].block0;\r | |
6ca1477c | 701 | config.Q5 = tests[0].Q5;\r |
d1869c33 | 702 | config.ST = tests[0].ST;\r |
13d77ef9 | 703 | printConfiguration( config );\r |
7cb8516c | 704 | return true;\r |
13d77ef9 | 705 | }\r |
706 | \r | |
707 | if ( hits > 1) {\r | |
708 | PrintAndLog("Found [%d] possible matches for modulation.",hits);\r | |
709 | for(int i=0; i<hits; ++i){\r | |
710 | PrintAndLog("--[%d]---------------", i+1);\r | |
711 | printConfiguration( tests[i] );\r | |
712 | }\r | |
713 | }\r | |
7cb8516c | 714 | return false;\r |
13d77ef9 | 715 | }\r |
716 | \r | |
717 | bool testModulation(uint8_t mode, uint8_t modread){\r | |
718 | switch( mode ){\r | |
719 | case DEMOD_FSK:\r | |
7cb8516c | 720 | if (modread >= DEMOD_FSK1 && modread <= DEMOD_FSK2a) return true;\r |
13d77ef9 | 721 | break;\r |
722 | case DEMOD_ASK:\r | |
7cb8516c | 723 | if (modread == DEMOD_ASK) return true;\r |
13d77ef9 | 724 | break;\r |
725 | case DEMOD_PSK1:\r | |
7cb8516c | 726 | if (modread == DEMOD_PSK1) return true;\r |
13d77ef9 | 727 | break;\r |
728 | case DEMOD_PSK2:\r | |
7cb8516c | 729 | if (modread == DEMOD_PSK2) return true;\r |
13d77ef9 | 730 | break;\r |
731 | case DEMOD_PSK3:\r | |
7cb8516c | 732 | if (modread == DEMOD_PSK3) return true;\r |
13d77ef9 | 733 | break;\r |
734 | case DEMOD_NRZ:\r | |
7cb8516c | 735 | if (modread == DEMOD_NRZ) return true;\r |
13d77ef9 | 736 | break;\r |
737 | case DEMOD_BI:\r | |
7cb8516c | 738 | if (modread == DEMOD_BI) return true;\r |
13d77ef9 | 739 | break;\r |
740 | case DEMOD_BIa:\r | |
7cb8516c | 741 | if (modread == DEMOD_BIa) return true;\r |
13d77ef9 | 742 | break; \r |
743 | default:\r | |
7cb8516c | 744 | return false;\r |
13d77ef9 | 745 | }\r |
7cb8516c | 746 | return false;\r |
13d77ef9 | 747 | }\r |
748 | \r | |
f6650679 | 749 | bool testQ5Modulation(uint8_t mode, uint8_t modread){\r |
750 | switch( mode ){\r | |
13d77ef9 | 751 | case DEMOD_FSK:\r |
7cb8516c | 752 | if (modread >= 4 && modread <= 5) return true;\r |
13d77ef9 | 753 | break;\r |
754 | case DEMOD_ASK:\r | |
7cb8516c | 755 | if (modread == 0) return true;\r |
13d77ef9 | 756 | break;\r |
757 | case DEMOD_PSK1:\r | |
7cb8516c | 758 | if (modread == 1) return true;\r |
f6650679 | 759 | break;\r |
13d77ef9 | 760 | case DEMOD_PSK2:\r |
7cb8516c | 761 | if (modread == 2) return true;\r |
f6650679 | 762 | break;\r |
13d77ef9 | 763 | case DEMOD_PSK3:\r |
7cb8516c | 764 | if (modread == 3) return true;\r |
13d77ef9 | 765 | break;\r |
766 | case DEMOD_NRZ:\r | |
7cb8516c | 767 | if (modread == 7) return true;\r |
f6650679 | 768 | break;\r |
769 | case DEMOD_BI:\r | |
7cb8516c | 770 | if (modread == 6) return true;\r |
13d77ef9 | 771 | break;\r |
13d77ef9 | 772 | default:\r |
7cb8516c | 773 | return false;\r |
13d77ef9 | 774 | }\r |
7cb8516c | 775 | return false;\r |
13d77ef9 | 776 | }\r |
777 | \r | |
af5384bc | 778 | int convertQ5bitRate(uint8_t bitRateRead) {\r |
779 | uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r | |
780 | for (int i=0; i<8; i++)\r | |
781 | if (expected[i] == bitRateRead)\r | |
782 | return i;\r | |
783 | \r | |
784 | return -1;\r | |
785 | }\r | |
786 | \r | |
f6650679 | 787 | bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){\r |
788 | \r | |
7cb8516c | 789 | if ( DemodBufferLen < 64 ) return false;\r |
f6650679 | 790 | uint8_t si = 0;\r |
db829602 | 791 | for (uint8_t idx = 28; idx < 64; idx++){\r |
f6650679 | 792 | si = idx;\r |
db829602 | 793 | if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r |
f6650679 | 794 | \r |
795 | uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r | |
796 | uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;\r | |
797 | // 2nibble must be zeroed.\r | |
6ca1477c | 798 | if (safer != 0x6 && safer != 0x9) continue;\r |
f6650679 | 799 | if ( resv > 0x00) continue;\r |
800 | //uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;\r | |
801 | //uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;\r | |
802 | si += 1+1;\r | |
6ca1477c | 803 | int bitRate = PackBits(si, 6, DemodBuffer)*2 + 2; si += 6; //bit rate\r |
db829602 | 804 | if (bitRate > 128 || bitRate < 8) continue;\r |
f6650679 | 805 | \r |
db829602 | 806 | //uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1; \r |
f6650679 | 807 | //uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1; \r |
808 | //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr\r | |
809 | //uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;\r | |
db829602 | 810 | si += 1+1+2+1;\r |
811 | uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;\r | |
812 | uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;\r | |
f6650679 | 813 | //uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;\r |
db829602 | 814 | if (maxBlk == 0) continue;\r |
f6650679 | 815 | //test modulation\r |
816 | if (!testQ5Modulation(mode, modread)) continue;\r | |
817 | if (bitRate != clk) continue;\r | |
af5384bc | 818 | *fndBitRate = convertQ5bitRate(bitRate);\r |
819 | if (*fndBitRate < 0) continue;\r | |
f6650679 | 820 | *offset = idx;\r |
821 | \r | |
7cb8516c | 822 | return true;\r |
f6650679 | 823 | }\r |
7cb8516c | 824 | return false;\r |
f6650679 | 825 | }\r |
826 | \r | |
827 | bool testBitRate(uint8_t readRate, uint8_t clk){\r | |
db829602 | 828 | uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r |
f6650679 | 829 | if (expected[readRate] == clk)\r |
830 | return true;\r | |
831 | \r | |
832 | return false;\r | |
833 | }\r | |
834 | \r | |
835 | bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5){\r | |
13d77ef9 | 836 | \r |
7cb8516c | 837 | if ( DemodBufferLen < 64 ) return false;\r |
13d77ef9 | 838 | uint8_t si = 0;\r |
db829602 | 839 | for (uint8_t idx = 28; idx < 64; idx++){\r |
13d77ef9 | 840 | si = idx;\r |
db829602 | 841 | if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r |
13d77ef9 | 842 | \r |
2767fc02 | 843 | uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r |
13d77ef9 | 844 | uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode\r |
845 | // 2nibble must be zeroed.\r | |
846 | // moved test to here, since this gets most faults first.\r | |
847 | if ( resv > 0x00) continue;\r | |
848 | \r | |
b97311b1 | 849 | int bitRate = PackBits(si, 6, DemodBuffer); si += 6; //bit rate (includes extended mode part of rate)\r |
13d77ef9 | 850 | uint8_t extend = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode\r |
2767fc02 | 851 | uint8_t modread = PackBits(si, 5, DemodBuffer); si += 5+2+1; \r |
852 | //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //could check psk cr\r | |
35cfcfc7 | 853 | //uint8_t nml01 = PackBits(si, 1, DemodBuffer); si += 1+5; //bit 24, 30, 31 could be tested for 0 if not extended mode\r |
854 | //uint8_t nml02 = PackBits(si, 2, DemodBuffer); si += 2;\r | |
13d77ef9 | 855 | \r |
856 | //if extended mode\r | |
7cb8516c | 857 | bool extMode =( (safer == 0x6 || safer == 0x9) && extend) ? true : false;\r |
13d77ef9 | 858 | \r |
b97311b1 | 859 | if (!extMode) {\r |
860 | if (bitRate > 7) continue;\r | |
861 | if (!testBitRate(bitRate, clk)) continue;\r | |
862 | } else { //extended mode bitrate = same function to calc bitrate as em4x05\r | |
863 | if (EM4x05_GET_BITRATE(bitRate) != clk) continue;\r | |
b9957414 | 864 | \r |
13d77ef9 | 865 | }\r |
866 | //test modulation\r | |
867 | if (!testModulation(mode, modread)) continue;\r | |
fef74fdc | 868 | *fndBitRate = bitRate;\r |
2767fc02 | 869 | *offset = idx;\r |
7cb8516c | 870 | *Q5 = false;\r |
871 | return true;\r | |
f6650679 | 872 | }\r |
873 | if (testQ5(mode, offset, fndBitRate, clk)) {\r | |
7cb8516c | 874 | *Q5 = true;\r |
875 | return true;\r | |
13d77ef9 | 876 | }\r |
7cb8516c | 877 | return false;\r |
54a942b0 | 878 | }\r |
879 | \r | |
224ce36e | 880 | void printT55xxBlock(const char *blockNum){\r |
13d77ef9 | 881 | \r |
882 | uint8_t i = config.offset;\r | |
883 | uint8_t endpos = 32 + i;\r | |
884 | uint32_t blockData = 0;\r | |
885 | uint8_t bits[64] = {0x00};\r | |
886 | \r | |
887 | if ( !DemodBufferLen) return;\r | |
888 | \r | |
889 | if ( endpos > DemodBufferLen){\r | |
890 | PrintAndLog("The configured offset %d is too big. Possible offset: %d)", i, DemodBufferLen-32);\r | |
891 | return;\r | |
892 | }\r | |
893 | \r | |
894 | for (; i < endpos; ++i)\r | |
895 | bits[i - config.offset]=DemodBuffer[i];\r | |
93507a33 | 896 | \r |
13d77ef9 | 897 | blockData = PackBits(0, 32, bits);\r |
db829602 | 898 | \r |
be2d41b7 | 899 | PrintAndLog(" %s | %08X | %s", blockNum, blockData, sprint_bin(bits,32));\r |
13d77ef9 | 900 | }\r |
901 | \r | |
902 | int special(const char *Cmd) {\r | |
903 | uint32_t blockData = 0;\r | |
904 | uint8_t bits[32] = {0x00};\r | |
905 | \r | |
be2d41b7 | 906 | PrintAndLog("OFFSET | DATA | BINARY");\r |
13d77ef9 | 907 | PrintAndLog("----------------------------------------------------");\r |
908 | int i,j = 0;\r | |
909 | for (; j < 64; ++j){\r | |
910 | \r | |
911 | for (i = 0; i < 32; ++i)\r | |
912 | bits[i]=DemodBuffer[j+i];\r | |
913 | \r | |
914 | blockData = PackBits(0, 32, bits);\r | |
915 | \r | |
be2d41b7 | 916 | PrintAndLog(" %02d | 0x%08X | %s",j , blockData, sprint_bin(bits,32)); \r |
13d77ef9 | 917 | }\r |
918 | return 0;\r | |
919 | }\r | |
920 | \r | |
be2d41b7 | 921 | int printConfiguration( t55xx_conf_block_t b){\r |
f6650679 | 922 | PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");\r |
13d77ef9 | 923 | PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );\r |
b9957414 | 924 | PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate, (b.block0 & T55x7_X_MODE && (b.block0>>28==6 || b.block0>>28==9))) );\r |
13d77ef9 | 925 | PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );\r |
926 | PrintAndLog("Offset : %d", b.offset);\r | |
8e90cd41 | 927 | PrintAndLog("Seq. Term. : %s", (b.ST) ? "Yes" : "No" );\r |
13d77ef9 | 928 | PrintAndLog("Block0 : 0x%08X", b.block0);\r |
929 | PrintAndLog("");\r | |
be2d41b7 | 930 | return 0;\r |
13d77ef9 | 931 | }\r |
932 | \r | |
be2d41b7 | 933 | int CmdT55xxWakeUp(const char *Cmd) {\r |
934 | uint32_t password = 0;\r | |
b97311b1 | 935 | if ( strlen(Cmd) <= 0 ) return usage_t55xx_wakup();\r |
936 | char cmdp = param_getchar(Cmd, 0);\r | |
937 | if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_wakup();\r | |
938 | \r | |
939 | password = param_get32ex(Cmd, 0, 0, 16);\r | |
be2d41b7 | 940 | \r |
941 | UsbCommand c = {CMD_T55XX_WAKEUP, {password, 0, 0}};\r | |
942 | clearCommandBuffer();\r | |
943 | SendCommand(&c);\r | |
944 | PrintAndLog("Wake up command sent. Try read now");\r | |
945 | return 0;\r | |
946 | }\r | |
947 | \r | |
948 | int CmdT55xxWriteBlock(const char *Cmd) {\r | |
949 | uint8_t block = 0xFF; //default to invalid block\r | |
709665b5 | 950 | uint32_t data = 0; //default to blank Block \r |
951 | uint32_t password = 0; //default to blank Block 7\r | |
dd8e4513 | 952 | uint32_t downlink_mode = 0;\r |
953 | \r | |
be2d41b7 | 954 | bool usepwd = false;\r |
955 | bool page1 = false; \r | |
956 | bool gotdata = false;\r | |
b97311b1 | 957 | bool testMode = false;\r |
be2d41b7 | 958 | bool errors = false;\r |
959 | uint8_t cmdp = 0;\r | |
960 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r | |
961 | switch(param_getchar(Cmd, cmdp)) {\r | |
962 | case 'h':\r | |
963 | case 'H':\r | |
964 | return usage_t55xx_write();\r | |
965 | case 'b':\r | |
966 | case 'B':\r | |
967 | errors |= param_getdec(Cmd, cmdp+1, &block);\r | |
968 | cmdp += 2;\r | |
969 | break;\r | |
970 | case 'd':\r | |
971 | case 'D':\r | |
972 | data = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
973 | gotdata = true;\r | |
974 | cmdp += 2;\r | |
975 | break;\r | |
976 | case 'p':\r | |
977 | case 'P':\r | |
978 | password = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
979 | usepwd = true;\r | |
980 | cmdp += 2;\r | |
981 | break;\r | |
b97311b1 | 982 | case 't':\r |
983 | case 'T':\r | |
984 | testMode = true;\r | |
985 | cmdp++;\r | |
986 | break;\r | |
be2d41b7 | 987 | case '1':\r |
988 | page1 = true;\r | |
989 | cmdp++;\r | |
990 | break;\r | |
dd8e4513 | 991 | case 'e':\r |
992 | case 'E':\r | |
993 | downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r | |
994 | if (downlink_mode > 3) downlink_mode = 0;\r | |
995 | cmdp +=2;\r | |
996 | break;\r | |
be2d41b7 | 997 | default:\r |
998 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
999 | errors = true;\r | |
1000 | break;\r | |
1001 | }\r | |
13d77ef9 | 1002 | }\r |
be2d41b7 | 1003 | if (errors || !gotdata) return usage_t55xx_write();\r |
13d77ef9 | 1004 | \r |
1005 | if (block > 7) {\r | |
1006 | PrintAndLog("Block number must be between 0 and 7");\r | |
be2d41b7 | 1007 | return 0;\r |
13d77ef9 | 1008 | }\r |
1009 | \r | |
1010 | UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};\r | |
976627d5 | 1011 | UsbCommand resp;\r |
be2d41b7 | 1012 | c.d.asBytes[0] = (page1) ? 0x2 : 0; \r |
b97311b1 | 1013 | c.d.asBytes[0] |= (testMode) ? 0x4 : 0; \r |
dd8e4513 | 1014 | c.d.asBytes[0] |= (downlink_mode << 3);\r |
1015 | \r | |
709665b5 | 1016 | char pwdStr[16] = {0};\r |
1017 | snprintf(pwdStr, sizeof(pwdStr), "pwd: 0x%08X", password);\r | |
1018 | \r | |
1019 | PrintAndLog("Writing page %d block: %02d data: 0x%08X %s", page1, block, data, (usepwd) ? pwdStr : "" );\r | |
dd8e4513 | 1020 | \r |
13d77ef9 | 1021 | //Password mode\r |
be2d41b7 | 1022 | if (usepwd) {\r |
13d77ef9 | 1023 | c.arg[2] = password;\r |
be2d41b7 | 1024 | c.d.asBytes[0] |= 0x1; \r |
13d77ef9 | 1025 | }\r |
dd8e4513 | 1026 | \r |
40c5f342 | 1027 | clearCommandBuffer();\r |
13d77ef9 | 1028 | SendCommand(&c);\r |
976627d5 MHS |
1029 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){\r |
1030 | PrintAndLog("Error occurred, device did not ACK write operation. (May be due to old firmware)");\r | |
be2d41b7 | 1031 | return 0;\r |
976627d5 | 1032 | }\r |
be2d41b7 | 1033 | return 1;\r |
54a942b0 | 1034 | }\r |
1035 | \r | |
be2d41b7 | 1036 | int CmdT55xxReadTrace(const char *Cmd) {\r |
13d77ef9 | 1037 | char cmdp = param_getchar(Cmd, 0);\r |
be2d41b7 | 1038 | bool pwdmode = false;\r |
1039 | uint32_t password = 0;\r | |
13d77ef9 | 1040 | if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') \r |
1041 | return usage_t55xx_trace();\r | |
1042 | \r | |
1043 | if (strlen(Cmd)==0)\r | |
dd8e4513 | 1044 | if ( !AquireData( T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password,0 ) )\r |
be2d41b7 | 1045 | return 0;\r |
be2d41b7 | 1046 | \r |
5490c2d6 | 1047 | if ( config.Q5 ) {\r |
1048 | if (!DecodeT5555TraceBlock()) return 0;\r | |
1049 | } else {\r | |
1050 | if (!DecodeT55xxBlock()) return 0;\r | |
1051 | }\r | |
1052 | \r | |
1053 | if ( !DemodBufferLen ) return 0;\r | |
54a942b0 | 1054 | \r |
13d77ef9 | 1055 | RepaintGraphWindow();\r |
5490c2d6 | 1056 | uint8_t repeat = (config.offset > 5) ? 32 : 0;\r |
1057 | \r | |
13d77ef9 | 1058 | uint8_t si = config.offset+repeat;\r |
be2d41b7 | 1059 | uint32_t bl1 = PackBits(si, 32, DemodBuffer);\r |
1060 | uint32_t bl2 = PackBits(si+32, 32, DemodBuffer);\r | |
224ce36e | 1061 | \r |
5490c2d6 | 1062 | if (config.Q5) {\r |
1063 | uint32_t hdr = PackBits(si, 9, DemodBuffer); si += 9;\r | |
1064 | \r | |
1065 | if (hdr != 0x1FF) {\r | |
1066 | PrintAndLog("Invalid Q5 Trace data header (expected 0x1FF, found %X)", hdr);\r | |
1067 | return 0;\r | |
1068 | }\r | |
1069 | \r | |
1070 | t5555_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .icr = 0, .lotidc = '?', .lotid = 0, .wafer = 0, .dw =0};\r | |
1071 | \r | |
1072 | data.icr = PackBits(si, 2, DemodBuffer); si += 2;\r | |
1073 | data.lotidc = 'Z' - PackBits(si, 2, DemodBuffer); si += 3;\r | |
1074 | \r | |
1075 | data.lotid = PackBits(si, 4, DemodBuffer); si += 5;\r | |
1076 | data.lotid <<= 4;\r | |
1077 | data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1078 | data.lotid <<= 4;\r | |
1079 | data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1080 | data.lotid <<= 4;\r | |
1081 | data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1082 | data.lotid <<= 1;\r | |
1083 | data.lotid |= PackBits(si, 1, DemodBuffer); si += 1;\r | |
1084 | \r | |
1085 | data.wafer = PackBits(si, 3, DemodBuffer); si += 4;\r | |
1086 | data.wafer <<= 2;\r | |
1087 | data.wafer |= PackBits(si, 2, DemodBuffer); si += 2;\r | |
1088 | \r | |
1089 | data.dw = PackBits(si, 2, DemodBuffer); si += 3;\r | |
1090 | data.dw <<= 4;\r | |
1091 | data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1092 | data.dw <<= 4;\r | |
1093 | data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1094 | data.dw <<= 4;\r | |
1095 | data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1096 | \r | |
1097 | printT5555Trace(data, repeat);\r | |
1098 | \r | |
1099 | } else {\r | |
1100 | \r | |
1101 | t55x7_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .acl = 0, .mfc = 0, .cid = 0, .year = 0, .quarter = 0, .icr = 0, .lotid = 0, .wafer = 0, .dw = 0};\r | |
1102 | \r | |
1103 | data.acl = PackBits(si, 8, DemodBuffer); si += 8;\r | |
1104 | if ( data.acl != 0xE0 ) {\r | |
1105 | PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");\r | |
1106 | return 0;\r | |
1107 | }\r | |
1108 | \r | |
1109 | data.mfc = PackBits(si, 8, DemodBuffer); si += 8;\r | |
1110 | data.cid = PackBits(si, 5, DemodBuffer); si += 5;\r | |
1111 | data.icr = PackBits(si, 3, DemodBuffer); si += 3;\r | |
1112 | data.year = PackBits(si, 4, DemodBuffer); si += 4;\r | |
1113 | data.quarter = PackBits(si, 2, DemodBuffer); si += 2;\r | |
1114 | data.lotid = PackBits(si, 14, DemodBuffer); si += 14;\r | |
1115 | data.wafer = PackBits(si, 5, DemodBuffer); si += 5;\r | |
1116 | data.dw = PackBits(si, 15, DemodBuffer); \r | |
1117 | \r | |
1118 | time_t t = time(NULL);\r | |
1119 | struct tm tm = *localtime(&t);\r | |
1120 | if ( data.year > tm.tm_year-110)\r | |
1121 | data.year += 2000;\r | |
1122 | else\r | |
1123 | data.year += 2010;\r | |
1124 | \r | |
1125 | printT55x7Trace(data, repeat);\r | |
224ce36e | 1126 | }\r |
5490c2d6 | 1127 | return 0;\r |
1128 | }\r | |
1129 | \r | |
1130 | void printT55x7Trace( t55x7_tracedata_t data, uint8_t repeat ){\r | |
1131 | PrintAndLog("-- T55x7 Trace Information ----------------------------------");\r | |
13d77ef9 | 1132 | PrintAndLog("-------------------------------------------------------------");\r |
5490c2d6 | 1133 | PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", data.acl, data.acl);\r |
1338d245 | 1134 | PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d) - %s", data.mfc, data.mfc, getManufacturerName(data.mfc));\r |
5490c2d6 | 1135 | PrintAndLog(" CID : 0x%02X (%d) - %s", data.cid, data.cid, GetModelStrFromCID(data.cid));\r |
1136 | PrintAndLog(" ICR IC Revision : %d", data.icr );\r | |
13d77ef9 | 1137 | PrintAndLog(" Manufactured");\r |
5490c2d6 | 1138 | PrintAndLog(" Year/Quarter : %d/%d", data.year, data.quarter);\r |
1139 | PrintAndLog(" Lot ID : %d", data.lotid );\r | |
1140 | PrintAndLog(" Wafer number : %d", data.wafer);\r | |
1141 | PrintAndLog(" Die Number : %d", data.dw);\r | |
13d77ef9 | 1142 | PrintAndLog("-------------------------------------------------------------");\r |
1143 | PrintAndLog(" Raw Data - Page 1");\r | |
5490c2d6 | 1144 | PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );\r |
1145 | PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );\r | |
1146 | PrintAndLog("-------------------------------------------------------------"); \r | |
54a942b0 | 1147 | \r |
13d77ef9 | 1148 | /*\r |
1149 | TRACE - BLOCK O\r | |
1150 | Bits Definition HEX\r | |
1151 | 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0 \r | |
1152 | 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation\r | |
1153 | 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2 \r | |
1154 | 22-24 ICR IC revision\r | |
1155 | 25-28 YEAR (BCD encoded) 9 (= 2009)\r | |
1156 | 29-30 QUARTER 1,2,3,4 \r | |
1157 | 31-32 LOT ID\r | |
1158 | \r | |
1159 | TRACE - BLOCK 1\r | |
1160 | 1-12 LOT ID \r | |
1161 | 13-17 Wafer number\r | |
1162 | 18-32 DW, die number sequential\r | |
1163 | */\r | |
5490c2d6 | 1164 | }\r |
1165 | \r | |
1166 | void printT5555Trace( t5555_tracedata_t data, uint8_t repeat ){\r | |
1167 | PrintAndLog("-- T5555 (Q5) Trace Information -----------------------------");\r | |
1168 | PrintAndLog("-------------------------------------------------------------");\r | |
1169 | PrintAndLog(" ICR IC Revision : %d", data.icr ); \r | |
1170 | PrintAndLog(" Lot : %c%d", data.lotidc, data.lotid);\r | |
1171 | PrintAndLog(" Wafer number : %d", data.wafer);\r | |
1172 | PrintAndLog(" Die Number : %d", data.dw);\r | |
1173 | PrintAndLog("-------------------------------------------------------------");\r | |
1174 | PrintAndLog(" Raw Data - Page 1");\r | |
1175 | PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );\r | |
1176 | PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );\r | |
13d77ef9 | 1177 | \r |
5490c2d6 | 1178 | /*\r |
1179 | ** Q5 **\r | |
1180 | TRACE - BLOCK O and BLOCK1\r | |
1181 | Bits Definition HEX\r | |
1182 | 1-9 Header 0x1FF\r | |
1183 | 10-11 IC Revision\r | |
1184 | 12-13 Lot ID char\r | |
1185 | 15-35 Lot ID (NB parity)\r | |
1186 | 36-41 Wafer number (NB parity)\r | |
1187 | 42-58 DW, die number sequential (NB parity)\r | |
1188 | 60-63 Parity bits\r | |
1189 | 64 Always zero\r | |
1190 | */\r | |
54a942b0 | 1191 | }\r |
1192 | \r | |
5490c2d6 | 1193 | //need to add Q5 info...\r |
13d77ef9 | 1194 | int CmdT55xxInfo(const char *Cmd){\r |
1195 | /*\r | |
1196 | Page 0 Block 0 Configuration data.\r | |
1197 | Normal mode\r | |
1198 | Extended mode\r | |
1199 | */\r | |
be2d41b7 | 1200 | bool pwdmode = false;\r |
1201 | uint32_t password = 0;\r | |
13d77ef9 | 1202 | char cmdp = param_getchar(Cmd, 0);\r |
1203 | \r | |
1204 | if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H')\r | |
1205 | return usage_t55xx_info();\r | |
1206 | \r | |
1207 | if (strlen(Cmd)==0)\r | |
dd8e4513 | 1208 | if ( !AquireData( T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password,0 ) )\r |
be2d41b7 | 1209 | return 1;\r |
fef74fdc | 1210 | \r |
13d77ef9 | 1211 | if (!DecodeT55xxBlock()) return 1;\r |
1212 | \r | |
5490c2d6 | 1213 | // too little space to start with\r |
fef74fdc | 1214 | if ( DemodBufferLen < 32) return 1;\r |
13d77ef9 | 1215 | \r |
1216 | uint8_t si = config.offset;\r | |
1217 | uint32_t bl0 = PackBits(si, 32, DemodBuffer);\r | |
1218 | \r | |
1219 | uint32_t safer = PackBits(si, 4, DemodBuffer); si += 4; \r | |
1220 | uint32_t resv = PackBits(si, 7, DemodBuffer); si += 7;\r | |
1221 | uint32_t dbr = PackBits(si, 3, DemodBuffer); si += 3;\r | |
1222 | uint32_t extend = PackBits(si, 1, DemodBuffer); si += 1;\r | |
1223 | uint32_t datamod = PackBits(si, 5, DemodBuffer); si += 5;\r | |
1224 | uint32_t pskcf = PackBits(si, 2, DemodBuffer); si += 2;\r | |
1225 | uint32_t aor = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1226 | uint32_t otp = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1227 | uint32_t maxblk = PackBits(si, 3, DemodBuffer); si += 3;\r | |
1228 | uint32_t pwd = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1229 | uint32_t sst = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1230 | uint32_t fw = PackBits(si, 1, DemodBuffer); si += 1;\r | |
1231 | uint32_t inv = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1232 | uint32_t por = PackBits(si, 1, DemodBuffer); si += 1;\r | |
5490c2d6 | 1233 | \r |
db829602 | 1234 | if (config.Q5) PrintAndLog("*** Warning *** Config Info read off a Q5 will not display as expected");\r |
13d77ef9 | 1235 | PrintAndLog("");\r |
5490c2d6 | 1236 | PrintAndLog("-- T55x7 Configuration & Tag Information --------------------");\r |
13d77ef9 | 1237 | PrintAndLog("-------------------------------------------------------------");\r |
1238 | PrintAndLog(" Safer key : %s", GetSaferStr(safer));\r | |
1239 | PrintAndLog(" reserved : %d", resv);\r | |
b97311b1 | 1240 | PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr, extend));\r |
13d77ef9 | 1241 | PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");\r |
1242 | PrintAndLog(" Modulation : %s", GetModulationStr(datamod));\r | |
1243 | PrintAndLog(" PSK clock frequency : %d", pskcf);\r | |
1244 | PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");\r | |
1245 | PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );\r | |
1246 | PrintAndLog(" Max block : %d", maxblk);\r | |
1247 | PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");\r | |
1248 | PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");\r | |
1249 | PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");\r | |
1250 | PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");\r | |
1251 | PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");\r | |
1252 | PrintAndLog("-------------------------------------------------------------");\r | |
1253 | PrintAndLog(" Raw Data - Page 0");\r | |
1254 | PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(DemodBuffer+config.offset,32) );\r | |
1255 | PrintAndLog("-------------------------------------------------------------");\r | |
1256 | \r | |
1257 | return 0;\r | |
1258 | }\r | |
1259 | \r | |
1260 | int CmdT55xxDump(const char *Cmd){\r | |
1261 | \r | |
be2d41b7 | 1262 | uint32_t password = 0;\r |
13d77ef9 | 1263 | char cmdp = param_getchar(Cmd, 0);\r |
be2d41b7 | 1264 | bool override = false;\r |
1265 | if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_dump();\r | |
1266 | \r | |
b97311b1 | 1267 | bool usepwd = ( strlen(Cmd) > 0);\r |
be2d41b7 | 1268 | if ( usepwd ){\r |
1269 | password = param_get32ex(Cmd, 0, 0, 16);\r | |
1270 | if (param_getchar(Cmd, 1) =='o' )\r | |
1271 | override = true;\r | |
13d77ef9 | 1272 | }\r |
1273 | \r | |
709665b5 | 1274 | printT5xxHeader(0);\r |
1275 | for ( uint8_t i = 0; i <8; ++i)\r | |
dd8e4513 | 1276 | T55xxReadBlock(i, 0, usepwd, override, password,0);\r |
709665b5 | 1277 | \r |
1278 | printT5xxHeader(1);\r | |
1279 | for ( uint8_t i = 0; i<4; i++)\r | |
dd8e4513 | 1280 | T55xxReadBlock(i, 1, usepwd, override, password,0); \r |
709665b5 | 1281 | \r |
be2d41b7 | 1282 | return 1;\r |
13d77ef9 | 1283 | }\r |
1284 | \r | |
dd8e4513 | 1285 | int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password, uint8_t downlink_mode ){\r |
709665b5 | 1286 | // arg0 bitmodes:\r |
1287 | // bit0 = pwdmode\r | |
1288 | // bit1 = page to read from\r | |
be2d41b7 | 1289 | uint8_t arg0 = (page<<1) | pwdmode;\r |
dd8e4513 | 1290 | arg0 |= (downlink_mode << 3);\r |
be2d41b7 | 1291 | UsbCommand c = {CMD_T55XX_READ_BLOCK, {arg0, block, password}};\r |
13d77ef9 | 1292 | \r |
40c5f342 | 1293 | clearCommandBuffer();\r |
13d77ef9 | 1294 | SendCommand(&c);\r |
1295 | if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r | |
1296 | PrintAndLog("command execution time out");\r | |
be2d41b7 | 1297 | return 0;\r |
13d77ef9 | 1298 | }\r |
b9957414 | 1299 | getSamples(12000,true);\r |
be2d41b7 | 1300 | return 1;\r |
13d77ef9 | 1301 | }\r |
1302 | \r | |
b97311b1 | 1303 | char * GetBitRateStr(uint32_t id, bool xmode) {\r |
af5384bc | 1304 | static char buf[25];\r |
fef74fdc | 1305 | \r |
13d77ef9 | 1306 | char *retStr = buf;\r |
b97311b1 | 1307 | if (xmode) { //xmode bitrate calc is same as em4x05 calc\r |
1308 | snprintf(retStr,sizeof(buf),"%d - RF/%d", id, EM4x05_GET_BITRATE(id));\r | |
1309 | } else {\r | |
1310 | switch (id) {\r | |
1311 | case 0: snprintf(retStr,sizeof(buf),"%d - RF/8",id); break;\r | |
1312 | case 1: snprintf(retStr,sizeof(buf),"%d - RF/16",id); break;\r | |
1313 | case 2: snprintf(retStr,sizeof(buf),"%d - RF/32",id); break;\r | |
1314 | case 3: snprintf(retStr,sizeof(buf),"%d - RF/40",id); break;\r | |
1315 | case 4: snprintf(retStr,sizeof(buf),"%d - RF/50",id); break;\r | |
1316 | case 5: snprintf(retStr,sizeof(buf),"%d - RF/64",id); break;\r | |
1317 | case 6: snprintf(retStr,sizeof(buf),"%d - RF/100",id); break;\r | |
1318 | case 7: snprintf(retStr,sizeof(buf),"%d - RF/128",id); break;\r | |
1319 | default: snprintf(retStr,sizeof(buf),"%d - (Unknown)",id); break;\r | |
1320 | } \r | |
af5384bc | 1321 | }\r |
13d77ef9 | 1322 | return buf;\r |
1323 | }\r | |
1324 | \r | |
af5384bc | 1325 | char * GetSaferStr(uint32_t id) {\r |
13d77ef9 | 1326 | static char buf[40];\r |
1327 | char *retStr = buf;\r | |
1328 | \r | |
9795e535 | 1329 | snprintf(retStr,sizeof(buf),"%d",id);\r |
13d77ef9 | 1330 | if (id == 6) {\r |
9795e535 | 1331 | snprintf(retStr,sizeof(buf),"%d - passwd",id);\r |
13d77ef9 | 1332 | }\r |
1333 | if (id == 9 ){\r | |
9795e535 | 1334 | snprintf(retStr,sizeof(buf),"%d - testmode",id);\r |
13d77ef9 | 1335 | }\r |
1336 | \r | |
1337 | return buf;\r | |
1338 | }\r | |
9795e535 | 1339 | \r |
13d77ef9 | 1340 | char * GetModulationStr( uint32_t id){\r |
2767fc02 | 1341 | static char buf[60];\r |
13d77ef9 | 1342 | char *retStr = buf;\r |
1343 | \r | |
1344 | switch (id){\r | |
5490c2d6 | 1345 | case 0: snprintf(retStr,sizeof(buf),"%d - DIRECT (ASK/NRZ)",id); break;\r |
1346 | case 1: snprintf(retStr,sizeof(buf),"%d - PSK 1 phase change when input changes",id); break;\r | |
1347 | case 2: snprintf(retStr,sizeof(buf),"%d - PSK 2 phase change on bitclk if input high",id); break;\r | |
1348 | case 3: snprintf(retStr,sizeof(buf),"%d - PSK 3 phase change on rising edge of input",id); break;\r | |
1349 | case 4: snprintf(retStr,sizeof(buf),"%d - FSK 1 RF/8 RF/5",id); break;\r | |
1350 | case 5: snprintf(retStr,sizeof(buf),"%d - FSK 2 RF/8 RF/10",id); break;\r | |
1351 | case 6: snprintf(retStr,sizeof(buf),"%d - FSK 1a RF/5 RF/8",id); break;\r | |
1352 | case 7: snprintf(retStr,sizeof(buf),"%d - FSK 2a RF/10 RF/8",id); break;\r | |
1353 | case 8: snprintf(retStr,sizeof(buf),"%d - Manchester",id); break;\r | |
1354 | case 16: snprintf(retStr,sizeof(buf),"%d - Biphase",id); break;\r | |
1355 | case 0x18: snprintf(retStr,sizeof(buf),"%d - Biphase a - AKA Conditional Dephase Encoding(CDP)",id); break;\r | |
1356 | case 17: snprintf(retStr,sizeof(buf),"%d - Reserved",id); break;\r | |
1357 | default: snprintf(retStr,sizeof(buf),"0x%02X (Unknown)",id); break;\r | |
13d77ef9 | 1358 | }\r |
1359 | return buf;\r | |
1360 | }\r | |
1361 | \r | |
1362 | char * GetModelStrFromCID(uint32_t cid){\r | |
1363 | \r | |
1364 | static char buf[10];\r | |
1365 | char *retStr = buf;\r | |
1366 | \r | |
224ce36e | 1367 | if (cid == 1) snprintf(retStr, sizeof(buf),"ATA5577M1");\r |
1368 | if (cid == 2) snprintf(retStr, sizeof(buf),"ATA5577M2"); \r | |
13d77ef9 | 1369 | return buf;\r |
1370 | }\r | |
1371 | \r | |
1372 | char * GetSelectedModulationStr( uint8_t id){\r | |
1373 | \r | |
9795e535 | 1374 | static char buf[20];\r |
13d77ef9 | 1375 | char *retStr = buf;\r |
1376 | \r | |
5490c2d6 | 1377 | switch (id) {\r |
1378 | case DEMOD_FSK: snprintf(retStr,sizeof(buf),"FSK"); break;\r | |
1379 | case DEMOD_FSK1: snprintf(retStr,sizeof(buf),"FSK1"); break;\r | |
1380 | case DEMOD_FSK1a: snprintf(retStr,sizeof(buf),"FSK1a"); break;\r | |
1381 | case DEMOD_FSK2: snprintf(retStr,sizeof(buf),"FSK2"); break;\r | |
1382 | case DEMOD_FSK2a: snprintf(retStr,sizeof(buf),"FSK2a"); break;\r | |
1383 | case DEMOD_ASK: snprintf(retStr,sizeof(buf),"ASK"); break;\r | |
1384 | case DEMOD_NRZ: snprintf(retStr,sizeof(buf),"DIRECT/NRZ"); break;\r | |
1385 | case DEMOD_PSK1: snprintf(retStr,sizeof(buf),"PSK1"); break;\r | |
1386 | case DEMOD_PSK2: snprintf(retStr,sizeof(buf),"PSK2"); break;\r | |
1387 | case DEMOD_PSK3: snprintf(retStr,sizeof(buf),"PSK3"); break;\r | |
1388 | case DEMOD_BI: snprintf(retStr,sizeof(buf),"BIPHASE"); break;\r | |
1389 | case DEMOD_BIa: snprintf(retStr,sizeof(buf),"BIPHASEa - (CDP)"); break;\r | |
1390 | default: snprintf(retStr,sizeof(buf),"(Unknown)"); break;\r | |
1391 | }\r | |
13d77ef9 | 1392 | return buf;\r |
1393 | }\r | |
1394 | \r | |
1395 | uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){\r | |
1396 | \r | |
1397 | int i = start;\r | |
1398 | int j = len-1;\r | |
1399 | \r | |
1400 | if (len > 32) return 0;\r | |
1401 | \r | |
1402 | uint32_t tmp = 0;\r | |
1403 | for (; j >= 0; --j, ++i)\r | |
1404 | tmp |= bits[i] << j;\r | |
1405 | \r | |
1406 | return tmp;\r | |
1407 | }\r | |
1408 | \r | |
66837a03 | 1409 | int CmdResetRead(const char *Cmd) {\r |
1410 | UsbCommand c = {CMD_T55XX_RESET_READ, {0,0,0}};\r | |
1411 | \r | |
1412 | clearCommandBuffer();\r | |
1413 | SendCommand(&c);\r | |
1414 | if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r | |
1415 | PrintAndLog("command execution time out");\r | |
1416 | return 0;\r | |
1417 | }\r | |
1418 | \r | |
9f669cb2 | 1419 | uint8_t got[BIGBUF_SIZE-1];\r |
babca445 | 1420 | GetFromBigBuf(got, sizeof(got), 0, NULL, -1 , 0);\r |
66837a03 | 1421 | setGraphBuf(got, sizeof(got));\r |
1422 | return 1;\r | |
1423 | }\r | |
1424 | \r | |
f6650679 | 1425 | int CmdT55xxWipe(const char *Cmd) {\r |
1426 | char writeData[20] = {0};\r | |
1427 | char *ptrData = writeData;\r | |
709665b5 | 1428 | \r |
5490c2d6 | 1429 | char cmdp = param_getchar(Cmd, 0); \r |
1430 | if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_wipe();\r | |
1431 | \r | |
1432 | bool Q5 = (cmdp == 'q' || cmdp == 'Q');\r | |
1433 | \r | |
1434 | // Try with the default password to reset block 0\r | |
1435 | // With a pwd should work even if pwd bit not set\r | |
f6650679 | 1436 | PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");\r |
709665b5 | 1437 | \r |
5490c2d6 | 1438 | if ( Q5 ){\r |
1439 | snprintf(ptrData,sizeof(writeData),"b 0 d 6001F004 p 0");\r | |
1440 | } else {\r | |
1441 | snprintf(ptrData,sizeof(writeData),"b 0 d 00088040 p 0");\r | |
1442 | }\r | |
709665b5 | 1443 | \r |
5490c2d6 | 1444 | if (!CmdT55xxWriteBlock(ptrData)) PrintAndLog("Error writing blk 0");\r |
709665b5 | 1445 | \r |
1446 | for (uint8_t blk = 1; blk<8; blk++) {\r | |
f6650679 | 1447 | snprintf(ptrData,sizeof(writeData),"b %d d 0", blk);\r |
709665b5 | 1448 | if (!CmdT55xxWriteBlock(ptrData))\r |
f6650679 | 1449 | PrintAndLog("Error writing blk %d", blk);\r |
709665b5 | 1450 | \r |
534678c3 | 1451 | memset(writeData, 0x00, sizeof(writeData));\r |
f6650679 | 1452 | }\r |
1453 | return 0;\r | |
1454 | }\r | |
1455 | \r | |
506672c4 | 1456 | int CmdT55xxBruteForce(const char *Cmd) {\r |
1457 | \r | |
1458 | // load a default pwd file.\r | |
1459 | char buf[9];\r | |
1460 | char filename[FILE_PATH_SIZE]={0};\r | |
1461 | int keycnt = 0;\r | |
dd8e4513 | 1462 | uint8_t downlink_mode = 0;\r |
735136e6 | 1463 | int ch;\r |
506672c4 | 1464 | uint8_t stKeyBlock = 20;\r |
735136e6 | 1465 | uint8_t *keyBlock = NULL, *p = NULL;\r |
506672c4 | 1466 | uint32_t start_password = 0x00000000; //start password\r |
1467 | uint32_t end_password = 0xFFFFFFFF; //end password\r | |
1468 | bool found = false;\r | |
1469 | \r | |
1470 | char cmdp = param_getchar(Cmd, 0);\r | |
1471 | if (cmdp == 'h' || cmdp == 'H') return usage_t55xx_bruteforce();\r | |
1472 | \r | |
735136e6 | 1473 | keyBlock = calloc(stKeyBlock, 6);\r |
1474 | if (keyBlock == NULL) return 1;\r | |
1475 | \r | |
506672c4 | 1476 | if (cmdp == 'i' || cmdp == 'I') {\r |
1477 | \r | |
1478 | int len = strlen(Cmd+2);\r | |
1479 | if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r | |
1480 | memcpy(filename, Cmd+2, len);\r | |
1481 | \r | |
1482 | FILE * f = fopen( filename , "r");\r | |
1483 | \r | |
1484 | if ( !f ) {\r | |
1485 | PrintAndLog("File: %s: not found or locked.", filename);\r | |
1486 | free(keyBlock);\r | |
1487 | return 1;\r | |
1488 | }\r | |
1489 | \r | |
5490c2d6 | 1490 | while( fgets(buf, sizeof(buf), f) ) {\r |
506672c4 | 1491 | if (strlen(buf) < 8 || buf[7] == '\n') continue;\r |
1492 | \r | |
1493 | while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r | |
1494 | \r | |
1495 | //The line start with # is comment, skip\r | |
1496 | if( buf[0]=='#' ) continue;\r | |
1497 | \r | |
3ded0f97 | 1498 | if (!isxdigit((unsigned char)buf[0])) {\r |
506672c4 | 1499 | PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r |
1500 | continue;\r | |
1501 | }\r | |
1502 | \r | |
1503 | buf[8] = 0;\r | |
1504 | \r | |
1505 | if ( stKeyBlock - keycnt < 2) {\r | |
1506 | p = realloc(keyBlock, 6*(stKeyBlock+=10));\r | |
1507 | if (!p) {\r | |
1508 | PrintAndLog("Cannot allocate memory for defaultKeys");\r | |
1509 | free(keyBlock);\r | |
735136e6 | 1510 | fclose(f);\r |
506672c4 | 1511 | return 2;\r |
1512 | }\r | |
1513 | keyBlock = p;\r | |
1514 | }\r | |
1515 | memset(keyBlock + 4 * keycnt, 0, 4);\r | |
1516 | num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r | |
1517 | PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r | |
1518 | keycnt++;\r | |
1519 | memset(buf, 0, sizeof(buf));\r | |
1520 | }\r | |
1521 | fclose(f);\r | |
1522 | \r | |
1523 | if (keycnt == 0) {\r | |
1524 | PrintAndLog("No keys found in file");\r | |
735136e6 | 1525 | free(keyBlock);\r |
506672c4 | 1526 | return 1;\r |
1527 | }\r | |
1528 | PrintAndLog("Loaded %d keys", keycnt);\r | |
1529 | \r | |
1530 | // loop\r | |
1531 | uint64_t testpwd = 0x00;\r | |
1532 | for (uint16_t c = 0; c < keycnt; ++c ) {\r | |
1533 | \r | |
1534 | if (ukbhit()) {\r | |
735136e6 | 1535 | ch = getchar();\r |
1536 | (void)ch;\r | |
506672c4 | 1537 | printf("\naborted via keyboard!\n");\r |
735136e6 | 1538 | free(keyBlock);\r |
506672c4 | 1539 | return 0;\r |
1540 | }\r | |
1541 | \r | |
1542 | testpwd = bytes_to_num(keyBlock + 4*c, 4);\r | |
1543 | \r | |
1544 | PrintAndLog("Testing %08X", testpwd);\r | |
1545 | \r | |
dd8e4513 | 1546 | if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,downlink_mode)) {\r |
506672c4 | 1547 | PrintAndLog("Aquireing data from device failed. Quitting");\r |
735136e6 | 1548 | free(keyBlock);\r |
506672c4 | 1549 | return 0;\r |
1550 | }\r | |
1551 | \r | |
1552 | found = tryDetectModulation();\r | |
1553 | \r | |
1554 | if ( found ) {\r | |
1555 | PrintAndLog("Found valid password: [%08X]", testpwd);\r | |
735136e6 | 1556 | free(keyBlock);\r |
506672c4 | 1557 | return 0;\r |
1558 | }\r | |
1559 | }\r | |
1560 | PrintAndLog("Password NOT found.");\r | |
735136e6 | 1561 | free(keyBlock);\r |
506672c4 | 1562 | return 0;\r |
1563 | }\r | |
1564 | \r | |
1565 | // Try to read Block 7, first :)\r | |
1566 | \r | |
1567 | // incremental pwd range search\r | |
1568 | start_password = param_get32ex(Cmd, 0, 0, 16);\r | |
1569 | end_password = param_get32ex(Cmd, 1, 0, 16);\r | |
5490c2d6 | 1570 | \r |
735136e6 | 1571 | if ( start_password >= end_password ) {\r |
1572 | free(keyBlock);\r | |
1573 | return usage_t55xx_bruteforce();\r | |
1574 | }\r | |
506672c4 | 1575 | PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r |
1576 | \r | |
1577 | uint32_t i = start_password;\r | |
1578 | \r | |
5490c2d6 | 1579 | while ((!found) && (i <= end_password)) {\r |
506672c4 | 1580 | \r |
5490c2d6 | 1581 | printf(".");\r |
1582 | fflush(stdout);\r | |
1583 | if (ukbhit()) {\r | |
735136e6 | 1584 | ch = getchar();\r |
1585 | (void)ch;\r | |
5490c2d6 | 1586 | printf("\naborted via keyboard!\n");\r |
735136e6 | 1587 | free(keyBlock);\r |
5490c2d6 | 1588 | return 0;\r |
1589 | }\r | |
506672c4 | 1590 | \r |
dd8e4513 | 1591 | if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r |
5490c2d6 | 1592 | PrintAndLog("Aquireing data from device failed. Quitting");\r |
735136e6 | 1593 | free(keyBlock);\r |
5490c2d6 | 1594 | return 0;\r |
1595 | }\r | |
1596 | found = tryDetectModulation();\r | |
1597 | \r | |
1598 | if (found) break;\r | |
1599 | i++;\r | |
506672c4 | 1600 | }\r |
1601 | \r | |
1602 | PrintAndLog("");\r | |
1603 | \r | |
1604 | if (found)\r | |
5490c2d6 | 1605 | PrintAndLog("Found valid password: [%08x]", i);\r |
506672c4 | 1606 | else\r |
5490c2d6 | 1607 | PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r |
735136e6 | 1608 | \r |
1609 | free(keyBlock);\r | |
506672c4 | 1610 | return 0;\r |
1611 | }\r | |
1612 | \r | |
dd8e4513 | 1613 | int CmdT55xxBruteForce_downlink(const char *Cmd) {\r |
1614 | \r | |
1615 | // load a default pwd file.\r | |
1616 | char buf[9];\r | |
1617 | char filename[FILE_PATH_SIZE]={0};\r | |
1618 | int keycnt = 0;\r | |
1619 | uint8_t downlink_mode = 0;\r | |
1620 | int ch;\r | |
1621 | uint8_t stKeyBlock = 20;\r | |
1622 | uint8_t *keyBlock = NULL, *p = NULL;\r | |
1623 | uint32_t start_password = 0x00000000; //start password\r | |
1624 | uint32_t end_password = 0xFFFFFFFF; //end password\r | |
1625 | bool found = false;\r | |
1626 | uint8_t cmdp = 0;\r | |
1627 | int cmd_offset = 0;\r | |
1628 | int errors = 0;\r | |
1629 | int len;\r | |
1630 | bool use_file = false;\r | |
1631 | bool use_range = false;\r | |
1632 | bool try_all_dl_modes = false;\r | |
1633 | uint8_t dl_mode = 0;\r | |
1634 | \r | |
1635 | keyBlock = calloc(stKeyBlock, 6);\r | |
1636 | if (keyBlock == NULL) return 1;\r | |
1637 | \r | |
1638 | PrintAndLog("New Downlink Supprt");\r | |
1639 | \r | |
1640 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r | |
1641 | switch(param_getchar(Cmd, cmdp)) {\r | |
1642 | case 'h':\r | |
1643 | case 'H':\r | |
1644 | return usage_t55xx_bruteforce_downlink();\r | |
1645 | case 'e':\r | |
1646 | case 'E':\r | |
1647 | downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r | |
1648 | if (downlink_mode == 4) try_all_dl_modes = true;\r | |
1649 | if (downlink_mode > 3) downlink_mode = 0;\r | |
1650 | cmdp +=2;\r | |
1651 | cmd_offset += 4;\r | |
1652 | PrintAndLog ("DL Mode : %d",downlink_mode);\r | |
1653 | break;\r | |
1654 | case 'i':\r | |
1655 | case 'I':\r | |
1656 | if (use_range) {\r | |
1657 | PrintAndLog ("use Range or File");\r | |
1658 | return 0;\r | |
1659 | }\r | |
1660 | use_file = true;\r | |
1661 | len = strlen(Cmd+2);\r | |
1662 | if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r | |
1663 | memcpy(filename, Cmd+cmd_offset+2, len);\r | |
1664 | cmdp += 2;\r | |
1665 | // PrintAndLog (" File : [%s]",filename);\r | |
1666 | break;\r | |
1667 | case 'r':\r | |
1668 | case 'R':\r | |
1669 | if (use_file) {\r | |
1670 | PrintAndLog ("use Range or File");\r | |
1671 | return 0;\r | |
1672 | }\r | |
1673 | use_range = true; // = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
1674 | start_password = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
1675 | end_password = param_get32ex(Cmd, cmdp+2, 0, 16);\r | |
1676 | cmdp += 3;\r | |
1677 | cmd_offset += 20; // 8 + 8 + 1 + 1 + 1\r | |
1678 | // PrintAndLog (" Range : [%0X] - [%0X]",start_password,end_password);\r | |
1679 | break;\r | |
1680 | default:\r | |
1681 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
1682 | errors = true;\r | |
1683 | break;\r | |
1684 | }\r | |
1685 | }\r | |
1686 | \r | |
1687 | \r | |
1688 | // if (cmdp == 'i' || cmdp == 'I') {\r | |
1689 | \r | |
1690 | if (use_file)\r | |
1691 | {\r | |
1692 | FILE * f = fopen( filename , "r");\r | |
1693 | \r | |
1694 | if ( !f ) {\r | |
1695 | PrintAndLog("File: %s: not found or locked.", filename);\r | |
1696 | free(keyBlock);\r | |
1697 | return 1;\r | |
1698 | }\r | |
1699 | \r | |
1700 | while( fgets(buf, sizeof(buf), f) ) {\r | |
1701 | if (strlen(buf) < 8 || buf[7] == '\n') continue;\r | |
1702 | \r | |
1703 | while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r | |
1704 | \r | |
1705 | //The line start with # is comment, skip\r | |
1706 | if( buf[0]=='#' ) continue;\r | |
1707 | \r | |
1708 | if (!isxdigit((unsigned char)buf[0])) {\r | |
1709 | PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r | |
1710 | continue;\r | |
1711 | }\r | |
1712 | \r | |
1713 | buf[8] = 0;\r | |
1714 | \r | |
1715 | if ( stKeyBlock - keycnt < 2) {\r | |
1716 | p = realloc(keyBlock, 6*(stKeyBlock+=10));\r | |
1717 | if (!p) {\r | |
1718 | PrintAndLog("Cannot allocate memory for defaultKeys");\r | |
1719 | free(keyBlock);\r | |
1720 | fclose(f);\r | |
1721 | return 2;\r | |
1722 | }\r | |
1723 | keyBlock = p;\r | |
1724 | }\r | |
1725 | memset(keyBlock + 4 * keycnt, 0, 4);\r | |
1726 | num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r | |
1727 | PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r | |
1728 | keycnt++;\r | |
1729 | memset(buf, 0, sizeof(buf));\r | |
1730 | }\r | |
1731 | fclose(f);\r | |
1732 | \r | |
1733 | if (keycnt == 0) {\r | |
1734 | PrintAndLog("No keys found in file");\r | |
1735 | free(keyBlock);\r | |
1736 | return 1;\r | |
1737 | }\r | |
1738 | PrintAndLog("Loaded %d keys", keycnt);\r | |
1739 | \r | |
1740 | // loop\r | |
1741 | uint64_t testpwd = 0x00;\r | |
1742 | for (uint16_t c = 0; c < keycnt; ++c ) {\r | |
1743 | \r | |
1744 | if (ukbhit()) {\r | |
1745 | ch = getchar();\r | |
1746 | (void)ch;\r | |
1747 | printf("\naborted via keyboard!\n");\r | |
1748 | free(keyBlock);\r | |
1749 | return 0;\r | |
1750 | }\r | |
1751 | \r | |
1752 | testpwd = bytes_to_num(keyBlock + 4*c, 4);\r | |
1753 | \r | |
1754 | PrintAndLog("Testing %08X", testpwd);\r | |
1755 | \r | |
1756 | // Try each downlink_mode of asked to \r | |
1757 | // donwlink_mode will = 0 if > 3 or set to 0, so loop from 0 - 3\r | |
1758 | for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++)\r | |
1759 | {\r | |
1760 | if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,dl_mode)) {\r | |
1761 | PrintAndLog("Aquireing data from device failed. Quitting");\r | |
1762 | free(keyBlock);\r | |
1763 | return 0;\r | |
1764 | }\r | |
1765 | \r | |
1766 | found = tryDetectModulation();\r | |
1767 | \r | |
1768 | if ( found ) {\r | |
1769 | PrintAndLog("Found valid password: [%08X]", testpwd);\r | |
1770 | free(keyBlock);\r | |
1771 | // Add downlink mode to reference.\r | |
1772 | switch (dl_mode) {\r | |
1773 | case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r | |
1774 | case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r | |
1775 | case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r | |
1776 | case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r | |
1777 | }\r | |
1778 | return 0;\r | |
1779 | }\r | |
1780 | if (!try_all_dl_modes) // Exit loop\r | |
1781 | dl_mode = 4;\r | |
1782 | }\r | |
1783 | }\r | |
1784 | PrintAndLog("Password NOT found.");\r | |
1785 | free(keyBlock);\r | |
1786 | return 0;\r | |
1787 | }\r | |
1788 | \r | |
1789 | if (use_range)\r | |
1790 | {\r | |
1791 | // incremental pwd range search\r | |
1792 | // start_password = param_get32ex(Cmd, 0, 0, 16);\r | |
1793 | // end_password = param_get32ex(Cmd, 1, 0, 16);\r | |
1794 | \r | |
1795 | if ( start_password >= end_password ) {\r | |
1796 | free(keyBlock);\r | |
1797 | return usage_t55xx_bruteforce_downlink();\r | |
1798 | }\r | |
1799 | PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r | |
1800 | \r | |
1801 | uint32_t i = start_password;\r | |
1802 | \r | |
1803 | while ((!found) && (i <= end_password)) {\r | |
1804 | \r | |
1805 | printf(".");\r | |
1806 | fflush(stdout);\r | |
1807 | if (ukbhit()) {\r | |
1808 | ch = getchar();\r | |
1809 | (void)ch;\r | |
1810 | printf("\naborted via keyboard!\n");\r | |
1811 | free(keyBlock);\r | |
1812 | return 0;\r | |
1813 | }\r | |
1814 | \r | |
1815 | if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r | |
1816 | PrintAndLog("Aquireing data from device failed. Quitting");\r | |
1817 | free(keyBlock);\r | |
1818 | return 0;\r | |
1819 | }\r | |
1820 | found = tryDetectModulation();\r | |
1821 | \r | |
1822 | if (found) break;\r | |
1823 | i++;\r | |
1824 | }\r | |
1825 | \r | |
1826 | PrintAndLog("");\r | |
1827 | \r | |
1828 | if (found) {\r | |
1829 | PrintAndLog("Found valid password: [%08x]", i);\r | |
1830 | // Add downlink mode to reference.\r | |
1831 | switch (downlink_mode) {\r | |
1832 | case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r | |
1833 | case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r | |
1834 | case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r | |
1835 | case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r | |
1836 | }\r | |
1837 | }\r | |
1838 | else\r | |
1839 | PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r | |
1840 | \r | |
1841 | free(keyBlock);\r | |
1842 | }\r | |
1843 | return 0;\r | |
1844 | }\r | |
1845 | \r | |
b97311b1 | 1846 | // note length of data returned is different for different chips. \r |
1847 | // some return all page 1 (64 bits) and others return just that block (32 bits) \r | |
1848 | // unfortunately the 64 bits makes this more likely to get a false positive...\r | |
1849 | bool tryDetectP1(bool getData) {\r | |
1850 | uint8_t preamble[] = {1,1,1,0,0,0,0,0,0,0,0,1,0,1,0,1};\r | |
1851 | size_t startIdx = 0;\r | |
1852 | uint8_t fc1 = 0, fc2 = 0, ans = 0;\r | |
bb4e6dbd | 1853 | int clk = 0, firstClockEdge = 0;\r |
b97311b1 | 1854 | bool st = true;\r |
1855 | \r | |
1856 | if ( getData ) {\r | |
dd8e4513 | 1857 | if ( !AquireData(T55x7_PAGE1, 1, false, 0,0) )\r |
b97311b1 | 1858 | return false;\r |
1859 | }\r | |
1860 | \r | |
1861 | // try fsk clock detect. if successful it cannot be any other type of modulation... (in theory...)\r | |
bb4e6dbd | 1862 | ans = fskClocks(&fc1, &fc2, (uint8_t *)&clk, false, &firstClockEdge);\r |
b97311b1 | 1863 | if (ans && ((fc1==10 && fc2==8) || (fc1==8 && fc2==5))) {\r |
1864 | if ( FSKrawDemod("0 0", false) && \r | |
1865 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1866 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1867 | return true;\r | |
1868 | }\r | |
1869 | if ( FSKrawDemod("0 1", false) && \r | |
1870 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1871 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1872 | return true;\r | |
1873 | }\r | |
1874 | return false;\r | |
1875 | }\r | |
1876 | \r | |
1877 | // try psk clock detect. if successful it cannot be any other type of modulation... (in theory...)\r | |
1878 | clk = GetPskClock("", false, false);\r | |
1879 | if (clk>0) {\r | |
1880 | // allow undo\r | |
1881 | // save_restoreGB(1);\r | |
1882 | // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r | |
1883 | //CmdLtrim("160");\r | |
1884 | if ( PSKDemod("0 0 6", false) &&\r | |
1885 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1886 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1887 | //save_restoreGB(0);\r | |
1888 | return true;\r | |
1889 | }\r | |
1890 | if ( PSKDemod("0 1 6", false) &&\r | |
1891 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1892 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1893 | //save_restoreGB(0);\r | |
1894 | return true;\r | |
1895 | }\r | |
1896 | // PSK2 - needs a call to psk1TOpsk2.\r | |
1897 | if ( PSKDemod("0 0 6", false)) {\r | |
1898 | psk1TOpsk2(DemodBuffer, DemodBufferLen);\r | |
1899 | if (preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1900 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1901 | //save_restoreGB(0);\r | |
1902 | return true;\r | |
1903 | }\r | |
1904 | } // inverse waves does not affect PSK2 demod\r | |
1905 | //undo trim samples\r | |
1906 | //save_restoreGB(0); \r | |
1907 | // no other modulation clocks = 2 or 4 so quit searching\r | |
1908 | if (fc1 != 8) return false;\r | |
1909 | }\r | |
1910 | \r | |
1911 | // try ask clock detect. it could be another type even if successful.\r | |
1912 | clk = GetAskClock("", false, false);\r | |
1913 | if (clk>0) {\r | |
1914 | if ( ASKDemod_ext("0 0 1", false, false, 1, &st) &&\r | |
1915 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1916 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1917 | return true;\r | |
1918 | }\r | |
1919 | st = true;\r | |
1920 | if ( ASKDemod_ext("0 1 1", false, false, 1, &st) &&\r | |
1921 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1922 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1923 | return true;\r | |
1924 | }\r | |
1925 | if ( ASKbiphaseDemod("0 0 0 2", false) &&\r | |
1926 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1927 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1928 | return true;\r | |
1929 | }\r | |
1930 | if ( ASKbiphaseDemod("0 0 1 2", false) &&\r | |
1931 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1932 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1933 | return true;\r | |
1934 | }\r | |
1935 | }\r | |
1936 | \r | |
1937 | // try NRZ clock detect. it could be another type even if successful.\r | |
1938 | clk = GetNrzClock("", false, false); //has the most false positives :(\r | |
1939 | if (clk>0) {\r | |
1940 | if ( NRZrawDemod("0 0 1", false) &&\r | |
1941 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1942 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1943 | return true;\r | |
1944 | }\r | |
1945 | if ( NRZrawDemod("0 1 1", false) &&\r | |
1946 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1947 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1948 | return true;\r | |
1949 | }\r | |
1950 | }\r | |
1951 | return false;\r | |
1952 | }\r | |
1953 | // does this need to be a callable command?\r | |
1954 | int CmdT55xxDetectPage1(const char *Cmd){\r | |
1955 | bool errors = false;\r | |
1956 | bool useGB = false;\r | |
1957 | bool usepwd = false;\r | |
1958 | uint32_t password = 0;\r | |
1959 | uint8_t cmdp = 0;\r | |
1960 | \r | |
1961 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r | |
1962 | switch(param_getchar(Cmd, cmdp)) {\r | |
1963 | case 'h':\r | |
1964 | case 'H':\r | |
1965 | return usage_t55xx_detectP1();\r | |
1966 | case 'p':\r | |
1967 | case 'P':\r | |
1968 | password = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
1969 | usepwd = true;\r | |
1970 | cmdp += 2;\r | |
1971 | break;\r | |
1972 | case '1':\r | |
1973 | // use Graphbuffer data\r | |
1974 | useGB = true;\r | |
1975 | cmdp++;\r | |
1976 | break;\r | |
1977 | default:\r | |
1978 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
1979 | errors = true;\r | |
1980 | break;\r | |
1981 | }\r | |
1982 | }\r | |
1983 | if (errors) return usage_t55xx_detectP1();\r | |
1984 | \r | |
1985 | if ( !useGB ) {\r | |
dd8e4513 | 1986 | if ( !AquireData(T55x7_PAGE1, 1, usepwd, password,0) )\r |
b97311b1 | 1987 | return false;\r |
1988 | }\r | |
1989 | bool success = tryDetectP1(false);\r | |
1990 | if (success) PrintAndLog("T55xx chip found!");\r | |
1991 | return success;\r | |
1992 | }\r | |
1993 | \r | |
709665b5 | 1994 | static command_t CommandTable[] = {\r |
506672c4 | 1995 | {"help", CmdHelp, 1, "This help"},\r |
dd8e4513 | 1996 | {"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},\r |
1997 | {"bruteforcedl",CmdT55xxBruteForce_downlink,0, "r <start password> <end password> [i <*.dic>] [e <downlink>] Simple bruteforce attack to find password"},\r | |
506672c4 | 1998 | {"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},\r |
1999 | {"detect", CmdT55xxDetect, 1, "[1] Try detecting the tag modulation from reading the configuration block."},\r | |
b97311b1 | 2000 | {"p1detect", CmdT55xxDetectPage1,1, "[1] Try detecting if this is a t55xx tag by reading page 1"},\r |
506672c4 | 2001 | {"read", CmdT55xxReadBlock, 0, "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},\r |
2002 | {"resetread", CmdResetRead, 0, "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},\r | |
2003 | {"write", CmdT55xxWriteBlock,0, "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},\r | |
2004 | {"trace", CmdT55xxReadTrace, 1, "[1] Show T55x7 traceability data (page 1/ blk 0-1)"},\r | |
2005 | {"info", CmdT55xxInfo, 1, "[1] Show T55x7 configuration data (page 0/ blk 0)"},\r | |
2006 | {"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},\r | |
2007 | {"special", special, 0, "Show block changes with 64 different offsets"},\r | |
2008 | {"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},\r | |
5490c2d6 | 2009 | {"wipe", CmdT55xxWipe, 0, "[q] Wipe a T55xx tag and set defaults (will destroy any data on tag)"},\r |
54a942b0 | 2010 | {NULL, NULL, 0, NULL}\r |
2011 | };\r | |
2012 | \r | |
709665b5 | 2013 | int CmdLFT55XX(const char *Cmd) {\r |
54a942b0 | 2014 | CmdsParse(CommandTable, Cmd);\r |
2015 | return 0;\r | |
2016 | }\r | |
2017 | \r | |
709665b5 | 2018 | int CmdHelp(const char *Cmd) {\r |
54a942b0 | 2019 | CmdsHelp(CommandTable);\r |
2020 | return 0;\r | |
2021 | }\r |