[proxmark3-svn] / client / cmdlf.c

//-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// Low frequency commands
//-----------------------------------------------------------------------------

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>
#include "proxmark3.h"
#include "data.h"
#include "graph.h"
#include "ui.h"
#include "cmdparser.h"
#include "cmdmain.h"
#include "cmddata.h"
#include "cmdlf.h"
#include "cmdlfhid.h"
#include "cmdlfti.h"
#include "cmdlfem4x.h"
#include "cmdlfhitag.h"
#include "cmdlft55xx.h"
#include "cmdlfpcf7931.h"
#include "cmdlfio.h"

static int CmdHelp(const char *Cmd);

/* send a command before reading */
int CmdLFCommandRead(const char *Cmd)
{
  static char dummy[3];

  dummy[0]= ' ';

  UsbCommand c = {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K};
  sscanf(Cmd, "%"lli" %"lli" %"lli" %s %s", &c.arg[0], &c.arg[1], &c.arg[2],(char*)(&c.d.asBytes),(char*)(&dummy+1));
  // in case they specified 'h'
  strcpy((char *)&c.d.asBytes + strlen((char *)c.d.asBytes), dummy);
  SendCommand(&c);
  return 0;
}

int CmdFlexdemod(const char *Cmd)
{
  int i;
  for (i = 0; i < GraphTraceLen; ++i) {
    if (GraphBuffer[i] < 0) {
      GraphBuffer[i] = -1;
    } else {
      GraphBuffer[i] = 1;
    }
  }

  #define LONG_WAIT 100
  int start;
  for (start = 0; start < GraphTraceLen - LONG_WAIT; start++) {
    int first = GraphBuffer[start];
    for (i = start; i < start + LONG_WAIT; i++) {
      if (GraphBuffer[i] != first) {
        break;
      }
    }
    if (i == (start + LONG_WAIT)) {
      break;
    }
  }
  if (start == GraphTraceLen - LONG_WAIT) {
    PrintAndLog("nothing to wait for");
    return 0;
  }

  GraphBuffer[start] = 2;
  GraphBuffer[start+1] = -2;
	uint8_t bits[64] = {0x00};

	int bit, sum;
  i = start;
  for (bit = 0; bit < 64; bit++) {
		sum = 0;
		for (int j = 0; j < 16; j++) {
      sum += GraphBuffer[i++];
    }

		bits[bit] = (sum > 0) ? 1 : 0;

    PrintAndLog("bit %d sum %d", bit, sum);
  }

  for (bit = 0; bit < 64; bit++) {
    int j;
    int sum = 0;
    for (j = 0; j < 16; j++) {
      sum += GraphBuffer[i++];
    }
    if (sum > 0 && bits[bit] != 1) {
      PrintAndLog("oops1 at %d", bit);
    }
    if (sum < 0 && bits[bit] != 0) {
      PrintAndLog("oops2 at %d", bit);
    }
  }

	// HACK writing back to graphbuffer.
  GraphTraceLen = 32*64;
  i = 0;
  int phase = 0;
  for (bit = 0; bit < 64; bit++) {
	
		phase = (bits[bit] == 0) ? 0 : 1;
		
    int j;
    for (j = 0; j < 32; j++) {
      GraphBuffer[i++] = phase;
      phase = !phase;
    }
  }

  RepaintGraphWindow();
  return 0;
}
  
int CmdIndalaDemod(const char *Cmd)
{
  // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID

  int state = -1;
  int count = 0;
  int i, j;

  // worst case with GraphTraceLen=64000 is < 4096
  // under normal conditions it's < 2048

  uint8_t rawbits[4096];
  int rawbit = 0;
  int worst = 0, worstPos = 0;
 // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
  for (i = 0; i < GraphTraceLen-1; i += 2) {
    count += 1;
    if ((GraphBuffer[i] > GraphBuffer[i + 1]) && (state != 1)) {
      if (state == 0) {
        for (j = 0; j <  count - 8; j += 16) {
          rawbits[rawbit++] = 0;
        }
        if ((abs(count - j)) > worst) {
          worst = abs(count - j);
          worstPos = i;
        }
      }
      state = 1;
      count = 0;
    } else if ((GraphBuffer[i] < GraphBuffer[i + 1]) && (state != 0)) {
      if (state == 1) {
        for (j = 0; j <  count - 8; j += 16) {
          rawbits[rawbit++] = 1;
        }
        if ((abs(count - j)) > worst) {
          worst = abs(count - j);
          worstPos = i;
        }
      }
      state = 0;
      count = 0;
    }
  }
  
  if (rawbit>0){
    PrintAndLog("Recovered %d raw bits, expected: %d", rawbit, GraphTraceLen/32);
    PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst, worstPos);
	} else {
		return 0;
	}

  // Finding the start of a UID
  int uidlen, long_wait;
  if (strcmp(Cmd, "224") == 0) {
    uidlen = 224;
    long_wait = 30;
  } else {
    uidlen = 64;
    long_wait = 29;
  }

  int start;
  int first = 0;
  for (start = 0; start <= rawbit - uidlen; start++) {
    first = rawbits[start];
    for (i = start; i < start + long_wait; i++) {
      if (rawbits[i] != first) {
        break;
      }
    }
    if (i == (start + long_wait)) {
      break;
    }
  }
  
  if (start == rawbit - uidlen + 1) {
    PrintAndLog("nothing to wait for");
    return 0;
  }

  // Inverting signal if needed
  if (first == 1) {
    for (i = start; i < rawbit; i++) {
      rawbits[i] = !rawbits[i];
    }
  }

  // Dumping UID
	uint8_t bits[224] = {0x00};
	char showbits[225] = {0x00};
  int bit;
  i = start;
  int times = 0;
	
  if (uidlen > rawbit) {
    PrintAndLog("Warning: not enough raw bits to get a full UID");
    for (bit = 0; bit < rawbit; bit++) {
      bits[bit] = rawbits[i++];
      // As we cannot know the parity, let's use "." and "/"
      showbits[bit] = '.' + bits[bit];
    }
    showbits[bit+1]='\0';
    PrintAndLog("Partial UID=%s", showbits);
    return 0;
  } else {
    for (bit = 0; bit < uidlen; bit++) {
      bits[bit] = rawbits[i++];
      showbits[bit] = '0' + bits[bit];
    }
    times = 1;
  }
  
  //convert UID to HEX
  uint32_t uid1, uid2, uid3, uid4, uid5, uid6, uid7;
  int idx;
	uid1 = uid2 = 0;
	
  if (uidlen==64){
    for( idx=0; idx<64; idx++) {
        if (showbits[idx] == '0') {
        uid1=(uid1<<1)|(uid2>>31);
        uid2=(uid2<<1)|0;
        } else {
        uid1=(uid1<<1)|(uid2>>31);
        uid2=(uid2<<1)|1;
        } 
      }
    PrintAndLog("UID=%s (%x%08x)", showbits, uid1, uid2);
  }
  else {
		uid3 = uid4 = uid5 = uid6 = uid7 = 0;

    for( idx=0; idx<224; idx++) {
        uid1=(uid1<<1)|(uid2>>31);
        uid2=(uid2<<1)|(uid3>>31);
        uid3=(uid3<<1)|(uid4>>31);
        uid4=(uid4<<1)|(uid5>>31);
        uid5=(uid5<<1)|(uid6>>31);
        uid6=(uid6<<1)|(uid7>>31);
			
			if (showbits[idx] == '0') 
				uid7 = (uid7<<1) | 0;
			else 
				uid7 = (uid7<<1) | 1;
      }
    PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits, uid1, uid2, uid3, uid4, uid5, uid6, uid7);
  }

  // Checking UID against next occurrences
    int failed = 0;
	for (; i + uidlen <= rawbit;) {
		failed = 0;
    for (bit = 0; bit < uidlen; bit++) {
      if (bits[bit] != rawbits[i++]) {
        failed = 1;
        break;
      }
    }
    if (failed == 1) {
      break;
    }
    times += 1;
  }

  PrintAndLog("Occurrences: %d (expected %d)", times, (rawbit - start) / uidlen);

  // Remodulating for tag cloning
	// HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod) 
	// since this changes graphbuffer data.
  GraphTraceLen = 32*uidlen;
  i = 0;
  int phase = 0;
  for (bit = 0; bit < uidlen; bit++) {
    if (bits[bit] == 0) {
      phase = 0;
    } else {
      phase = 1;
    }
    int j;
    for (j = 0; j < 32; j++) {
      GraphBuffer[i++] = phase;
      phase = !phase;
    }
  }

  RepaintGraphWindow();
  return 1;
}

int CmdIndalaClone(const char *Cmd)
{
  UsbCommand c;
	unsigned int uid1, uid2, uid3, uid4, uid5, uid6, uid7;

	uid1 =  uid2 = uid3 = uid4 = uid5 = uid6 = uid7 = 0;
  int n = 0, i = 0;

  if (strchr(Cmd,'l') != 0) {
    while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
      uid1 = (uid1 << 4) | (uid2 >> 28);
      uid2 = (uid2 << 4) | (uid3 >> 28);
      uid3 = (uid3 << 4) | (uid4 >> 28);
      uid4 = (uid4 << 4) | (uid5 >> 28);
      uid5 = (uid5 << 4) | (uid6 >> 28);
      uid6 = (uid6 << 4) | (uid7 >> 28);
    	uid7 = (uid7 << 4) | (n & 0xf);
    }
    PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1, uid2, uid3, uid4, uid5, uid6, uid7);
    c.cmd = CMD_INDALA_CLONE_TAG_L;
    c.d.asDwords[0] = uid1;
    c.d.asDwords[1] = uid2;
    c.d.asDwords[2] = uid3;
    c.d.asDwords[3] = uid4;
    c.d.asDwords[4] = uid5;
    c.d.asDwords[5] = uid6;
    c.d.asDwords[6] = uid7;
	} else {
    while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
      uid1 = (uid1 << 4) | (uid2 >> 28);
      uid2 = (uid2 << 4) | (n & 0xf);
    }
    PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1, uid2);
    c.cmd = CMD_INDALA_CLONE_TAG;
    c.arg[0] = uid1;
    c.arg[1] = uid2;
  }

  SendCommand(&c);
  return 0;
}

int CmdLFRead(const char *Cmd)
{
  UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K};

  // 'h' means higher-low-frequency, 134 kHz
  if(*Cmd == 'h') {
    c.arg[0] = 1;
  } else if (*Cmd == '\0') {
    c.arg[0] = 0;
  } else if (sscanf(Cmd, "%"lli, &c.arg[0]) != 1) {
		PrintAndLog("Samples 1: 'lf read'");
		PrintAndLog("        2: 'lf read h'");
		PrintAndLog("        3: 'lf read <divisor>'");
    return 0;
  }
  SendCommand(&c);
  WaitForResponse(CMD_ACK,NULL);
  return 0;
}

static void ChkBitstream(const char *str)
{
  int i;

  /* convert to bitstream if necessary */
  for (i = 0; i < (int)(GraphTraceLen / 2); i++)
  {
    if (GraphBuffer[i] > 1 || GraphBuffer[i] < 0)
    {
      CmdBitstream(str);
      break;
    }
  }
}

int CmdLFSim(const char *Cmd)
{
  int i;
  static int gap;

  sscanf(Cmd, "%i", &gap);

  /* convert to bitstream if necessary */
  ChkBitstream(Cmd);

  PrintAndLog("Sending data, please wait...");
  for (i = 0; i < GraphTraceLen; i += 48) {
    UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {i, 0, 0}};
    int j;
    for (j = 0; j < 48; j++) {
      c.d.asBytes[j] = GraphBuffer[i+j];
    }
    SendCommand(&c);
    WaitForResponse(CMD_ACK,NULL);
  }

  PrintAndLog("Starting simulator...");
  UsbCommand c = {CMD_SIMULATE_TAG_125K, {GraphTraceLen, gap, 0}};
  SendCommand(&c);
  return 0;
}

int CmdLFSimBidir(const char *Cmd)
{
  // Set ADC to twice the carrier for a slight supersampling
  // HACK: not implemented in ARMSRC.
  PrintAndLog("Not implemented yet.");
  UsbCommand c = {CMD_LF_SIMULATE_BIDIR, {47, 384, 0}};
  SendCommand(&c);
  return 0;
}

/* simulate an LF Manchester encoded tag with specified bitstream, clock rate and inter-id gap */
int CmdLFSimManchester(const char *Cmd)
{
  static int clock, gap;
  static char data[1024], gapstring[8];

  sscanf(Cmd, "%i %s %i", &clock, &data[0], &gap);

  ClearGraph(0);

  for (int i = 0; i < strlen(data) ; ++i)
    AppendGraph(0, clock, data[i]- '0');

  CmdManchesterMod("");

  RepaintGraphWindow();

  sprintf(&gapstring[0], "%i", gap);
  CmdLFSim(gapstring);
  return 0;
}

int CmdLFSnoop(const char *Cmd)
{
  UsbCommand c = {CMD_LF_SNOOP_RAW_ADC_SAMPLES};

  // 'h' means higher-low-frequency, 134 kHz
  c.arg[0] = 0;
  c.arg[1] = -1;

	if (*Cmd == 'l') {
    sscanf(Cmd, "l %"lli, &c.arg[1]);
  } else if(*Cmd == 'h') {
    c.arg[0] = 1;
    sscanf(Cmd, "h %"lli, &c.arg[1]);
  } else if (sscanf(Cmd, "%"lli" %"lli, &c.arg[0], &c.arg[1]) < 1) {
		PrintAndLog("usage 1:  snoop");
		PrintAndLog("      2:  snoop {l,h} [trigger threshold]");
		PrintAndLog("      3:  snoop <divisor> [trigger threshold]");
    return 0;
  }

  SendCommand(&c);
  WaitForResponse(CMD_ACK,NULL);
  return 0;
}

int CmdVchDemod(const char *Cmd)
{
  // Is this the entire sync pattern, or does this also include some
  // data bits that happen to be the same everywhere? That would be
  // lovely to know.
  static const int SyncPattern[] = {
    1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
    1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
    1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
    1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
    1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
    1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
    1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
    1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
    1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
    1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
  };

  // So first, we correlate for the sync pattern, and mark that.
  int bestCorrel = 0, bestPos = 0;
  int i;
  // It does us no good to find the sync pattern, with fewer than
  // 2048 samples after it...
  for (i = 0; i < (GraphTraceLen-2048); i++) {
    int sum = 0;
    int j;
    for (j = 0; j < arraylen(SyncPattern); j++) {
      sum += GraphBuffer[i+j]*SyncPattern[j];
    }
    if (sum > bestCorrel) {
      bestCorrel = sum;
      bestPos = i;
    }
  }
  PrintAndLog("best sync at %d [metric %d]", bestPos, bestCorrel);

  char bits[257];
  bits[256] = '\0';

  int worst = INT_MAX;
  int worstPos = 0;

  for (i = 0; i < 2048; i += 8) {
    int sum = 0;
    int j;
    for (j = 0; j < 8; j++) {
      sum += GraphBuffer[bestPos+i+j];
    }
    if (sum < 0) {
      bits[i/8] = '.';
    } else {
      bits[i/8] = '1';
    }
    if(abs(sum) < worst) {
      worst = abs(sum);
      worstPos = i;
    }
  }
  PrintAndLog("bits:");
  PrintAndLog("%s", bits);
  PrintAndLog("worst metric: %d at pos %d", worst, worstPos);

  if (strcmp(Cmd, "clone")==0) {
    GraphTraceLen = 0;
    char *s;
    for(s = bits; *s; s++) {
      int j;
      for(j = 0; j < 16; j++) {
        GraphBuffer[GraphTraceLen++] = (*s == '1') ? 1 : 0;
      }
    }
    RepaintGraphWindow();
  }
  return 0;
}

//by marshmellow
int CmdLFfind(const char *Cmd)
{
  int ans=0;
  if (!offline){
    ans=CmdLFRead("");
    ans=CmdSamples("20000");
  }
  if (GraphTraceLen<1000) return 0;
  PrintAndLog("NOTE: some demods output possible binary\n  if it finds something that looks like a tag");
  PrintAndLog("Checking for known tags:");

  ans=Cmdaskmandemod("");
  if (ans>0) {
    PrintAndLog("Valid EM410x ID Found!");
    return 1;
  }
  ans=CmdFSKdemodHID("");
  if (ans>0) {
    PrintAndLog("Valid HID Prox ID Found!");
    return 1;
  }
  ans=CmdFSKdemodIO("");
  if (ans>0) {
    PrintAndLog("Valid IO Prox ID Found!");
    return 1;
  }
  //add psk and indala
  ans=CmdIndalaDecode("");
  if (ans>0) {
    PrintAndLog("Valid Indala ID Found!");
    return 1;
  }
 // ans=CmdIndalaDemod("224");
 // if (ans>0) return 1;
  PrintAndLog("No Known Tags Found!\n");
  return 0;
}

static command_t CommandTable[] = 
{
  {"help",        CmdHelp,            1, "This help"},
  {"cmdread",     CmdLFCommandRead,   0, "<off period> <'0' period> <'1' period> <command> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)"},
  {"em4x",        CmdLFEM4X,          1, "{ EM4X RFIDs... }"},
  {"flexdemod",   CmdFlexdemod,       1, "Demodulate samples for FlexPass"},
  {"hid",         CmdLFHID,           1, "{ HID RFIDs... }"},
  {"io",       	  CmdLFIO,	          1, "{ ioProx tags... }"},
  {"indalademod", CmdIndalaDemod,     1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
  {"indalaclone", CmdIndalaClone,     0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
  {"read",        CmdLFRead,          0, "['h' or <divisor>] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134, alternatively: f=12MHz/(divisor+1))"},
  {"search",      CmdLFfind,          1, "Read and Search for valid known tag (in offline mode it you can load first then search)"},
  {"sim",         CmdLFSim,           0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
  {"simbidir",    CmdLFSimBidir,      0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
  {"simman",      CmdLFSimManchester, 0, "<Clock> <Bitstream> [GAP] Simulate arbitrary Manchester LF tag"},
  {"snoop",       CmdLFSnoop,         0, "['l'|'h'|<divisor>] [trigger threshold]-- Snoop LF (l:125khz, h:134khz)"},
  {"ti",          CmdLFTI,            1, "{ TI RFIDs... }"},
  {"hitag",       CmdLFHitag,         1, "{ Hitag tags and transponders... }"},
  {"vchdemod",    CmdVchDemod,        1, "['clone'] -- Demodulate samples for VeriChip"},
  {"t55xx",       CmdLFT55XX,         1, "{ T55xx RFIDs... }"},
  {"pcf7931",     CmdLFPCF7931,       1, "{PCF7931 RFIDs...}"},
  {NULL, NULL, 0, NULL}
};

int CmdLF(const char *Cmd)
{
  CmdsParse(CommandTable, Cmd);
  return 0; 
}

int CmdHelp(const char *Cmd)
{
  CmdsHelp(CommandTable);
  return 0;
}
Commit	Line	Data
a553f267	1	//-----------------------------------------------------------------------------
	2	// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
	3	//
	4	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	5	// at your option, any later version. See the LICENSE.txt file for the text of
	6	// the license.
	7	//-----------------------------------------------------------------------------
	8	// Low frequency commands
	9	//-----------------------------------------------------------------------------
	10
7fe9b0b7	11	#include <stdio.h>
590f8ff9	12	#include <stdlib.h>
7fe9b0b7	13	#include <string.h>
393c3ef9	14	#include <limits.h>
902cb3c0	15	#include "proxmark3.h"
7fe9b0b7	16	#include "data.h"
	17	#include "graph.h"
	18	#include "ui.h"
	19	#include "cmdparser.h"
040a7baa	20	#include "cmdmain.h"
7fe9b0b7	21	#include "cmddata.h"
	22	#include "cmdlf.h"
	23	#include "cmdlfhid.h"
	24	#include "cmdlfti.h"
	25	#include "cmdlfem4x.h"
db09cb3a	26	#include "cmdlfhitag.h"
54a942b0	27	#include "cmdlft55xx.h"
54a942b0	28	#include "cmdlfpcf7931.h"
a1f3bb12	29	#include "cmdlfio.h"
7fe9b0b7	30
	31	static int CmdHelp(const char *Cmd);
	32
	33	/* send a command before reading */
	34	int CmdLFCommandRead(const char *Cmd)
	35	{
	36	static char dummy[3];
	37
	38	dummy[0]= ' ';
	39
	40	UsbCommand c = {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K};
1a07fd51	41	sscanf(Cmd, "%"lli" %"lli" %"lli" %s %s", &c.arg[0], &c.arg[1], &c.arg[2],(char)(&c.d.asBytes),(char)(&dummy+1));
7fe9b0b7	42	// in case they specified 'h'
	43	strcpy((char )&c.d.asBytes + strlen((char )c.d.asBytes), dummy);
	44	SendCommand(&c);
	45	return 0;
	46	}
	47
	48	int CmdFlexdemod(const char *Cmd)
	49	{
	50	int i;
	51	for (i = 0; i < GraphTraceLen; ++i) {
	52	if (GraphBuffer[i] < 0) {
	53	GraphBuffer[i] = -1;
	54	} else {
	55	GraphBuffer[i] = 1;
	56	}
	57	}
	58
4118b74d	59	#define LONG_WAIT 100
7fe9b0b7	60	int start;
	61	for (start = 0; start < GraphTraceLen - LONG_WAIT; start++) {
	62	int first = GraphBuffer[start];
	63	for (i = start; i < start + LONG_WAIT; i++) {
	64	if (GraphBuffer[i] != first) {
	65	break;
	66	}
	67	}
	68	if (i == (start + LONG_WAIT)) {
	69	break;
	70	}
	71	}
	72	if (start == GraphTraceLen - LONG_WAIT) {
	73	PrintAndLog("nothing to wait for");
	74	return 0;
	75	}
	76
	77	GraphBuffer[start] = 2;
	78	GraphBuffer[start+1] = -2;
3fe4ff4f	79	uint8_t bits[64] = {0x00};
7fe9b0b7	80
3fe4ff4f	81	int bit, sum;
7fe9b0b7	82	i = start;
7fe9b0b7	83	for (bit = 0; bit < 64; bit++) {
3fe4ff4f	84	sum = 0;
3fe4ff4f	85	for (int j = 0; j < 16; j++) {
7fe9b0b7	86	sum += GraphBuffer[i++];
7fe9b0b7	87	}
3fe4ff4f	88
	89	bits[bit] = (sum > 0) ? 1 : 0;
	90
7fe9b0b7	91	PrintAndLog("bit %d sum %d", bit, sum);
	92	}
	93
	94	for (bit = 0; bit < 64; bit++) {
	95	int j;
	96	int sum = 0;
	97	for (j = 0; j < 16; j++) {
	98	sum += GraphBuffer[i++];
	99	}
	100	if (sum > 0 && bits[bit] != 1) {
	101	PrintAndLog("oops1 at %d", bit);
	102	}
	103	if (sum < 0 && bits[bit] != 0) {
	104	PrintAndLog("oops2 at %d", bit);
	105	}
	106	}
	107
3fe4ff4f	108	// HACK writing back to graphbuffer.
7fe9b0b7	109	GraphTraceLen = 32*64;
	110	i = 0;
	111	int phase = 0;
	112	for (bit = 0; bit < 64; bit++) {
3fe4ff4f	113
	114	phase = (bits[bit] == 0) ? 0 : 1;
	115
7fe9b0b7	116	int j;
	117	for (j = 0; j < 32; j++) {
	118	GraphBuffer[i++] = phase;
	119	phase = !phase;
	120	}
	121	}
	122
	123	RepaintGraphWindow();
	124	return 0;
	125	}
a1f3bb12	126
7fe9b0b7	127	int CmdIndalaDemod(const char *Cmd)
	128	{
	129	// Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
	130
	131	int state = -1;
	132	int count = 0;
	133	int i, j;
3fe4ff4f	134
7fe9b0b7	135	// worst case with GraphTraceLen=64000 is < 4096
7fe9b0b7	136	// under normal conditions it's < 2048
3fe4ff4f	137
7fe9b0b7	138	uint8_t rawbits[4096];
	139	int rawbit = 0;
	140	int worst = 0, worstPos = 0;
d5a72d2f	141	// PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
7fe9b0b7	142	for (i = 0; i < GraphTraceLen-1; i += 2) {
	143	count += 1;
	144	if ((GraphBuffer[i] > GraphBuffer[i + 1]) && (state != 1)) {
	145	if (state == 0) {
	146	for (j = 0; j < count - 8; j += 16) {
	147	rawbits[rawbit++] = 0;
	148	}
	149	if ((abs(count - j)) > worst) {
	150	worst = abs(count - j);
	151	worstPos = i;
	152	}
	153	}
	154	state = 1;
	155	count = 0;
	156	} else if ((GraphBuffer[i] < GraphBuffer[i + 1]) && (state != 0)) {
	157	if (state == 1) {
	158	for (j = 0; j < count - 8; j += 16) {
	159	rawbits[rawbit++] = 1;
	160	}
	161	if ((abs(count - j)) > worst) {
	162	worst = abs(count - j);
	163	worstPos = i;
	164	}
	165	}
	166	state = 0;
	167	count = 0;
	168	}
	169	}
3fe4ff4f	170
d5a72d2f	171	if (rawbit>0){
	172	PrintAndLog("Recovered %d raw bits, expected: %d", rawbit, GraphTraceLen/32);
	173	PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst, worstPos);
3fe4ff4f	174	} else {
	175	return 0;
	176	}
	177
7fe9b0b7	178	// Finding the start of a UID
	179	int uidlen, long_wait;
	180	if (strcmp(Cmd, "224") == 0) {
	181	uidlen = 224;
	182	long_wait = 30;
	183	} else {
	184	uidlen = 64;
	185	long_wait = 29;
	186	}
3fe4ff4f	187
7fe9b0b7	188	int start;
	189	int first = 0;
	190	for (start = 0; start <= rawbit - uidlen; start++) {
	191	first = rawbits[start];
	192	for (i = start; i < start + long_wait; i++) {
	193	if (rawbits[i] != first) {
	194	break;
	195	}
	196	}
	197	if (i == (start + long_wait)) {
	198	break;
	199	}
	200	}
3fe4ff4f	201
7fe9b0b7	202	if (start == rawbit - uidlen + 1) {
	203	PrintAndLog("nothing to wait for");
	204	return 0;
	205	}
	206
	207	// Inverting signal if needed
	208	if (first == 1) {
	209	for (i = start; i < rawbit; i++) {
	210	rawbits[i] = !rawbits[i];
	211	}
	212	}
	213
	214	// Dumping UID
3fe4ff4f	215	uint8_t bits[224] = {0x00};
3fe4ff4f	216	char showbits[225] = {0x00};
7fe9b0b7	217	int bit;
	218	i = start;
	219	int times = 0;
3fe4ff4f	220
7fe9b0b7	221	if (uidlen > rawbit) {
	222	PrintAndLog("Warning: not enough raw bits to get a full UID");
	223	for (bit = 0; bit < rawbit; bit++) {
	224	bits[bit] = rawbits[i++];
	225	// As we cannot know the parity, let's use "." and "/"
	226	showbits[bit] = '.' + bits[bit];
	227	}
	228	showbits[bit+1]='\0';
	229	PrintAndLog("Partial UID=%s", showbits);
	230	return 0;
	231	} else {
	232	for (bit = 0; bit < uidlen; bit++) {
	233	bits[bit] = rawbits[i++];
	234	showbits[bit] = '0' + bits[bit];
	235	}
	236	times = 1;
	237	}
2414f978	238
	239	//convert UID to HEX
	240	uint32_t uid1, uid2, uid3, uid4, uid5, uid6, uid7;
	241	int idx;
3fe4ff4f	242	uid1 = uid2 = 0;
3fe4ff4f	243
2414f978	244	if (uidlen==64){
	245	for( idx=0; idx<64; idx++) {
	246	if (showbits[idx] == '0') {
	247	uid1=(uid1<<1)\|(uid2>>31);
	248	uid2=(uid2<<1)\|0;
	249	} else {
	250	uid1=(uid1<<1)\|(uid2>>31);
	251	uid2=(uid2<<1)\|1;
	252	}
	253	}
	254	PrintAndLog("UID=%s (%x%08x)", showbits, uid1, uid2);
	255	}
	256	else {
3fe4ff4f	257	uid3 = uid4 = uid5 = uid6 = uid7 = 0;
3fe4ff4f	258
2414f978	259	for( idx=0; idx<224; idx++) {
	260	uid1=(uid1<<1)\|(uid2>>31);
	261	uid2=(uid2<<1)\|(uid3>>31);
	262	uid3=(uid3<<1)\|(uid4>>31);
	263	uid4=(uid4<<1)\|(uid5>>31);
	264	uid5=(uid5<<1)\|(uid6>>31);
	265	uid6=(uid6<<1)\|(uid7>>31);
3fe4ff4f	266
	267	if (showbits[idx] == '0')
	268	uid7 = (uid7<<1) \| 0;
	269	else
	270	uid7 = (uid7<<1) \| 1;
2414f978	271	}
	272	PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits, uid1, uid2, uid3, uid4, uid5, uid6, uid7);
	273	}
7fe9b0b7	274
0ff9a939	275	// Checking UID against next occurrences
7fe9b0b7	276	int failed = 0;
3fe4ff4f	277	for (; i + uidlen <= rawbit;) {
3fe4ff4f	278	failed = 0;
7fe9b0b7	279	for (bit = 0; bit < uidlen; bit++) {
	280	if (bits[bit] != rawbits[i++]) {
	281	failed = 1;
	282	break;
	283	}
	284	}
	285	if (failed == 1) {
	286	break;
	287	}
	288	times += 1;
	289	}
3fe4ff4f	290
0ff9a939	291	PrintAndLog("Occurrences: %d (expected %d)", times, (rawbit - start) / uidlen);
7fe9b0b7	292
7fe9b0b7	293	// Remodulating for tag cloning
3fe4ff4f	294	// HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
3fe4ff4f	295	// since this changes graphbuffer data.
7fe9b0b7	296	GraphTraceLen = 32*uidlen;
	297	i = 0;
	298	int phase = 0;
	299	for (bit = 0; bit < uidlen; bit++) {
	300	if (bits[bit] == 0) {
	301	phase = 0;
	302	} else {
	303	phase = 1;
	304	}
	305	int j;
	306	for (j = 0; j < 32; j++) {
	307	GraphBuffer[i++] = phase;
	308	phase = !phase;
	309	}
	310	}
	311
	312	RepaintGraphWindow();
d5a72d2f	313	return 1;
7fe9b0b7	314	}
7fe9b0b7	315
2414f978	316	int CmdIndalaClone(const char *Cmd)
2414f978	317	{
2414f978	318	UsbCommand c;
3fe4ff4f	319	unsigned int uid1, uid2, uid3, uid4, uid5, uid6, uid7;
	320
	321	uid1 = uid2 = uid3 = uid4 = uid5 = uid6 = uid7 = 0;
2414f978	322	int n = 0, i = 0;
	323
	324	if (strchr(Cmd,'l') != 0) {
	325	while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
	326	uid1 = (uid1 << 4) \| (uid2 >> 28);
	327	uid2 = (uid2 << 4) \| (uid3 >> 28);
	328	uid3 = (uid3 << 4) \| (uid4 >> 28);
	329	uid4 = (uid4 << 4) \| (uid5 >> 28);
	330	uid5 = (uid5 << 4) \| (uid6 >> 28);
	331	uid6 = (uid6 << 4) \| (uid7 >> 28);
	332	uid7 = (uid7 << 4) \| (n & 0xf);
	333	}
	334	PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1, uid2, uid3, uid4, uid5, uid6, uid7);
	335	c.cmd = CMD_INDALA_CLONE_TAG_L;
	336	c.d.asDwords[0] = uid1;
	337	c.d.asDwords[1] = uid2;
	338	c.d.asDwords[2] = uid3;
	339	c.d.asDwords[3] = uid4;
	340	c.d.asDwords[4] = uid5;
	341	c.d.asDwords[5] = uid6;
	342	c.d.asDwords[6] = uid7;
3fe4ff4f	343	} else {
2414f978	344	while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
	345	uid1 = (uid1 << 4) \| (uid2 >> 28);
	346	uid2 = (uid2 << 4) \| (n & 0xf);
	347	}
	348	PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1, uid2);
	349	c.cmd = CMD_INDALA_CLONE_TAG;
	350	c.arg[0] = uid1;
	351	c.arg[1] = uid2;
	352	}
	353
	354	SendCommand(&c);
	355	return 0;
	356	}
	357
7fe9b0b7	358	int CmdLFRead(const char *Cmd)
	359	{
	360	UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K};
3fe4ff4f	361
7fe9b0b7	362	// 'h' means higher-low-frequency, 134 kHz
	363	if(*Cmd == 'h') {
	364	c.arg[0] = 1;
	365	} else if (*Cmd == '\0') {
	366	c.arg[0] = 0;
f66021cf	367	} else if (sscanf(Cmd, "%"lli, &c.arg[0]) != 1) {
3fe4ff4f	368	PrintAndLog("Samples 1: 'lf read'");
	369	PrintAndLog(" 2: 'lf read h'");
	370	PrintAndLog(" 3: 'lf read <divisor>'");
7fe9b0b7	371	return 0;
	372	}
	373	SendCommand(&c);
902cb3c0	374	WaitForResponse(CMD_ACK,NULL);
7fe9b0b7	375	return 0;
	376	}
	377
	378	static void ChkBitstream(const char *str)
	379	{
	380	int i;
	381
	382	/* convert to bitstream if necessary */
	383	for (i = 0; i < (int)(GraphTraceLen / 2); i++)
	384	{
	385	if (GraphBuffer[i] > 1 \|\| GraphBuffer[i] < 0)
	386	{
	387	CmdBitstream(str);
	388	break;
	389	}
	390	}
	391	}
	392
	393	int CmdLFSim(const char *Cmd)
	394	{
	395	int i;
	396	static int gap;
	397
	398	sscanf(Cmd, "%i", &gap);
	399
	400	/* convert to bitstream if necessary */
	401	ChkBitstream(Cmd);
	402
	403	PrintAndLog("Sending data, please wait...");
	404	for (i = 0; i < GraphTraceLen; i += 48) {
	405	UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {i, 0, 0}};
	406	int j;
	407	for (j = 0; j < 48; j++) {
	408	c.d.asBytes[j] = GraphBuffer[i+j];
	409	}
	410	SendCommand(&c);
902cb3c0	411	WaitForResponse(CMD_ACK,NULL);
7fe9b0b7	412	}
	413
	414	PrintAndLog("Starting simulator...");
	415	UsbCommand c = {CMD_SIMULATE_TAG_125K, {GraphTraceLen, gap, 0}};
	416	SendCommand(&c);
	417	return 0;
	418	}
	419
	420	int CmdLFSimBidir(const char *Cmd)
	421	{
3fe4ff4f	422	// Set ADC to twice the carrier for a slight supersampling
	423	// HACK: not implemented in ARMSRC.
	424	PrintAndLog("Not implemented yet.");
7fe9b0b7	425	UsbCommand c = {CMD_LF_SIMULATE_BIDIR, {47, 384, 0}};
	426	SendCommand(&c);
	427	return 0;
	428	}
	429
	430	/* simulate an LF Manchester encoded tag with specified bitstream, clock rate and inter-id gap */
	431	int CmdLFSimManchester(const char *Cmd)
	432	{
	433	static int clock, gap;
	434	static char data[1024], gapstring[8];
	435
7fe9b0b7	436	sscanf(Cmd, "%i %s %i", &clock, &data[0], &gap);
7fe9b0b7	437
7fe9b0b7	438	ClearGraph(0);
7fe9b0b7	439
7fe9b0b7	440	for (int i = 0; i < strlen(data) ; ++i)
	441	AppendGraph(0, clock, data[i]- '0');
	442
7fe9b0b7	443	CmdManchesterMod("");
7fe9b0b7	444
7fe9b0b7	445	RepaintGraphWindow();
7fe9b0b7	446
7fe9b0b7	447	sprintf(&gapstring[0], "%i", gap);
	448	CmdLFSim(gapstring);
	449	return 0;
	450	}
	451
b014c96d	452	int CmdLFSnoop(const char *Cmd)
	453	{
	454	UsbCommand c = {CMD_LF_SNOOP_RAW_ADC_SAMPLES};
3fe4ff4f	455
b014c96d	456	// 'h' means higher-low-frequency, 134 kHz
	457	c.arg[0] = 0;
	458	c.arg[1] = -1;
3fe4ff4f	459
3fe4ff4f	460	if (*Cmd == 'l') {
b014c96d	461	sscanf(Cmd, "l %"lli, &c.arg[1]);
	462	} else if(*Cmd == 'h') {
	463	c.arg[0] = 1;
	464	sscanf(Cmd, "h %"lli, &c.arg[1]);
	465	} else if (sscanf(Cmd, "%"lli" %"lli, &c.arg[0], &c.arg[1]) < 1) {
3fe4ff4f	466	PrintAndLog("usage 1: snoop");
	467	PrintAndLog(" 2: snoop {l,h} [trigger threshold]");
	468	PrintAndLog(" 3: snoop <divisor> [trigger threshold]");
b014c96d	469	return 0;
b014c96d	470	}
3fe4ff4f	471
b014c96d	472	SendCommand(&c);
	473	WaitForResponse(CMD_ACK,NULL);
	474	return 0;
	475	}
	476
7fe9b0b7	477	int CmdVchDemod(const char *Cmd)
	478	{
	479	// Is this the entire sync pattern, or does this also include some
	480	// data bits that happen to be the same everywhere? That would be
	481	// lovely to know.
	482	static const int SyncPattern[] = {
	483	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
	484	1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
	485	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
	486	1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
	487	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
	488	1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
	489	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
	490	1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
	491	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
	492	1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
	493	};
	494
	495	// So first, we correlate for the sync pattern, and mark that.
	496	int bestCorrel = 0, bestPos = 0;
	497	int i;
	498	// It does us no good to find the sync pattern, with fewer than
	499	// 2048 samples after it...
	500	for (i = 0; i < (GraphTraceLen-2048); i++) {
	501	int sum = 0;
	502	int j;
	503	for (j = 0; j < arraylen(SyncPattern); j++) {
	504	sum += GraphBuffer[i+j]*SyncPattern[j];
	505	}
	506	if (sum > bestCorrel) {
	507	bestCorrel = sum;
	508	bestPos = i;
	509	}
	510	}
	511	PrintAndLog("best sync at %d [metric %d]", bestPos, bestCorrel);
	512
	513	char bits[257];
	514	bits[256] = '\0';
	515
	516	int worst = INT_MAX;
fddf220a	517	int worstPos = 0;
7fe9b0b7	518
	519	for (i = 0; i < 2048; i += 8) {
	520	int sum = 0;
	521	int j;
	522	for (j = 0; j < 8; j++) {
	523	sum += GraphBuffer[bestPos+i+j];
	524	}
	525	if (sum < 0) {
	526	bits[i/8] = '.';
	527	} else {
	528	bits[i/8] = '1';
	529	}
	530	if(abs(sum) < worst) {
	531	worst = abs(sum);
	532	worstPos = i;
	533	}
	534	}
	535	PrintAndLog("bits:");
	536	PrintAndLog("%s", bits);
	537	PrintAndLog("worst metric: %d at pos %d", worst, worstPos);
	538
	539	if (strcmp(Cmd, "clone")==0) {
	540	GraphTraceLen = 0;
	541	char *s;
	542	for(s = bits; *s; s++) {
	543	int j;
	544	for(j = 0; j < 16; j++) {
	545	GraphBuffer[GraphTraceLen++] = (*s == '1') ? 1 : 0;
	546	}
	547	}
	548	RepaintGraphWindow();
	549	}
	550	return 0;
	551	}
	552
d5a72d2f	553	//by marshmellow
	554	int CmdLFfind(const char *Cmd)
	555	{
	556	int ans=0;
	557	if (!offline){
	558	ans=CmdLFRead("");
	559	ans=CmdSamples("20000");
	560	}
	561	if (GraphTraceLen<1000) return 0;
4118b74d	562	PrintAndLog("NOTE: some demods output possible binary\n if it finds something that looks like a tag");
d5a72d2f	563	PrintAndLog("Checking for known tags:");
4118b74d	564
d5a72d2f	565	ans=Cmdaskmandemod("");
4118b74d	566	if (ans>0) {
	567	PrintAndLog("Valid EM410x ID Found!");
	568	return 1;
	569	}
d5a72d2f	570	ans=CmdFSKdemodHID("");
4118b74d	571	if (ans>0) {
	572	PrintAndLog("Valid HID Prox ID Found!");
	573	return 1;
	574	}
d5a72d2f	575	ans=CmdFSKdemodIO("");
4118b74d	576	if (ans>0) {
	577	PrintAndLog("Valid IO Prox ID Found!");
	578	return 1;
	579	}
d5a72d2f	580	//add psk and indala
4118b74d	581	ans=CmdIndalaDecode("");
	582	if (ans>0) {
	583	PrintAndLog("Valid Indala ID Found!");
	584	return 1;
	585	}
	586	// ans=CmdIndalaDemod("224");
	587	// if (ans>0) return 1;
d5a72d2f	588	PrintAndLog("No Known Tags Found!\n");
	589	return 0;
	590	}
	591
7fe9b0b7	592	static command_t CommandTable[] =
	593	{
	594	{"help", CmdHelp, 1, "This help"},
	595	{"cmdread", CmdLFCommandRead, 0, "<off period> <'0' period> <'1' period> <command> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)"},
37239a7c	596	{"em4x", CmdLFEM4X, 1, "{ EM4X RFIDs... }"},
7fe9b0b7	597	{"flexdemod", CmdFlexdemod, 1, "Demodulate samples for FlexPass"},
37239a7c	598	{"hid", CmdLFHID, 1, "{ HID RFIDs... }"},
083ca3de	599	{"io", CmdLFIO, 1, "{ ioProx tags... }"},
7fe9b0b7	600	{"indalademod", CmdIndalaDemod, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
083ca3de	601	{"indalaclone", CmdIndalaClone, 0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
57c69556	602	{"read", CmdLFRead, 0, "['h' or <divisor>] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134, alternatively: f=12MHz/(divisor+1))"},
d5a72d2f	603	{"search", CmdLFfind, 1, "Read and Search for valid known tag (in offline mode it you can load first then search)"},
7fe9b0b7	604	{"sim", CmdLFSim, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
	605	{"simbidir", CmdLFSimBidir, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
	606	{"simman", CmdLFSimManchester, 0, "<Clock> <Bitstream> [GAP] Simulate arbitrary Manchester LF tag"},
b014c96d	607	{"snoop", CmdLFSnoop, 0, "['l'\|'h'\|<divisor>] [trigger threshold]-- Snoop LF (l:125khz, h:134khz)"},
37239a7c	608	{"ti", CmdLFTI, 1, "{ TI RFIDs... }"},
db09cb3a	609	{"hitag", CmdLFHitag, 1, "{ Hitag tags and transponders... }"},
7fe9b0b7	610	{"vchdemod", CmdVchDemod, 1, "['clone'] -- Demodulate samples for VeriChip"},
54a942b0	611	{"t55xx", CmdLFT55XX, 1, "{ T55xx RFIDs... }"},
54a942b0	612	{"pcf7931", CmdLFPCF7931, 1, "{PCF7931 RFIDs...}"},
7fe9b0b7	613	{NULL, NULL, 0, NULL}
	614	};
	615
	616	int CmdLF(const char *Cmd)
	617	{
	618	CmdsParse(CommandTable, Cmd);
	619	return 0;
	620	}
	621
	622	int CmdHelp(const char *Cmd)
	623	{
	624	CmdsHelp(CommandTable);
	625	return 0;
	626	}