]>
Commit | Line | Data |
---|---|---|
54a942b0 | 1 | //-----------------------------------------------------------------------------\r |
2 | //\r | |
3 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
4 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
5 | // the license.\r | |
6 | //-----------------------------------------------------------------------------\r | |
7 | // Low frequency T55xx commands\r | |
8 | //-----------------------------------------------------------------------------\r | |
9 | \r | |
ad939de5 | 10 | #include "cmdlft55xx.h"\r |
11 | \r | |
54a942b0 | 12 | #include <stdio.h>\r |
13 | #include <string.h>\r | |
14 | #include <inttypes.h>\r | |
acf0582d | 15 | #include <ctype.h>\r |
16 | #include <time.h>\r | |
ad939de5 | 17 | #include "comms.h"\r |
54a942b0 | 18 | #include "ui.h"\r |
19 | #include "graph.h"\r | |
13d77ef9 | 20 | #include "cmdmain.h"\r |
54a942b0 | 21 | #include "cmdparser.h"\r |
22 | #include "cmddata.h"\r | |
23 | #include "cmdlf.h"\r | |
13d77ef9 | 24 | #include "util.h"\r |
13d77ef9 | 25 | #include "lfdemod.h"\r |
b97311b1 | 26 | #include "protocols.h"\r |
1338d245 | 27 | #include "taginfo.h"\r |
13d77ef9 | 28 | \r |
709665b5 | 29 | #define T55x7_CONFIGURATION_BLOCK 0x00\r |
30 | #define T55x7_PAGE0 0x00\r | |
31 | #define T55x7_PAGE1 0x01\r | |
3975d477 | 32 | //#define T55x7_PWD 0x00000010\r |
be2d41b7 | 33 | #define REGULAR_READ_MODE_BLOCK 0xFF\r |
13d77ef9 | 34 | \r |
35 | // Default configuration\r | |
7cb8516c | 36 | t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = false, .offset = 0x00, .block0 = 0x00, .Q5 = false };\r |
13d77ef9 | 37 | \r |
9f669cb2 | 38 | t55xx_conf_block_t Get_t55xx_Config(){\r |
39 | return config;\r | |
40 | }\r | |
41 | void Set_t55xx_Config(t55xx_conf_block_t conf){\r | |
42 | config = conf;\r | |
43 | }\r | |
44 | \r | |
13d77ef9 | 45 | int usage_t55xx_config(){\r |
f6650679 | 46 | PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");\r |
be2d41b7 | 47 | PrintAndLog("Options:");\r |
13d77ef9 | 48 | PrintAndLog(" h This help");\r |
f6650679 | 49 | PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");\r |
4ff341ef | 50 | PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");\r |
f6650679 | 51 | PrintAndLog(" i [1] Invert data signal, defaults to normal");\r |
52 | PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");\r | |
53 | PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");\r | |
d1869c33 | 54 | PrintAndLog(" ST Set Sequence Terminator on");\r |
13d77ef9 | 55 | PrintAndLog("");\r |
56 | PrintAndLog("Examples:");\r | |
57 | PrintAndLog(" lf t55xx config d FSK - FSK demodulation");\r | |
58 | PrintAndLog(" lf t55xx config d FSK i 1 - FSK demodulation, inverse data");\r | |
59 | PrintAndLog(" lf t55xx config d FSK i 1 o 3 - FSK demodulation, inverse data, offset=3,start from position 3 to decode data");\r | |
60 | PrintAndLog("");\r | |
61 | return 0;\r | |
62 | }\r | |
63 | int usage_t55xx_read(){\r | |
0c8200f1 | 64 | PrintAndLog("Usage: lf t55xx read [b <block>] [p <password>] <override_safety> <page1>");\r |
be2d41b7 | 65 | PrintAndLog("Options:");\r |
0c8200f1 | 66 | PrintAndLog(" b <block> - block number to read. Between 0-7");\r |
67 | PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r | |
68 | PrintAndLog(" o - OPTIONAL override safety check");\r | |
69 | PrintAndLog(" 1 - OPTIONAL read Page 1 instead of Page 0");\r | |
dd8e4513 | 70 | PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference"); \r |
71 | PrintAndLog(" '2' Leading Zero, '3' 1 of 4 "); \r | |
f1b74c30 | 72 | PrintAndLog(" ****WARNING****");\r |
73 | PrintAndLog(" Use of read with password on a tag not configured for a pwd");\r | |
74 | PrintAndLog(" can damage the tag");\r | |
185e038c | 75 | PrintAndLog("");\r |
13d77ef9 | 76 | PrintAndLog("Examples:");\r |
0c8200f1 | 77 | PrintAndLog(" lf t55xx read b 0 - read data from block 0");\r |
be2d41b7 | 78 | PrintAndLog(" lf t55xx read b 0 p feedbeef - read data from block 0 password feedbeef");\r |
79 | PrintAndLog(" lf t55xx read b 0 p feedbeef o - read data from block 0 password feedbeef safety check");\r | |
13d77ef9 | 80 | PrintAndLog("");\r |
81 | return 0;\r | |
82 | }\r | |
83 | int usage_t55xx_write(){\r | |
b97311b1 | 84 | PrintAndLog("Usage: lf t55xx write [b <block>] [d <data>] [p <password>] [1] [t]");\r |
be2d41b7 | 85 | PrintAndLog("Options:");\r |
0c8200f1 | 86 | PrintAndLog(" b <block> - block number to write. Between 0-7");\r |
87 | PrintAndLog(" d <data> - 4 bytes of data to write (8 hex characters)");\r | |
88 | PrintAndLog(" p <password> - OPTIONAL password 4bytes (8 hex characters)");\r | |
89 | PrintAndLog(" 1 - OPTIONAL write Page 1 instead of Page 0");\r | |
b97311b1 | 90 | PrintAndLog(" t - OPTIONAL test mode write - ****DANGER****"); \r |
dd8e4513 | 91 | PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference"); \r |
92 | PrintAndLog(" '2' Leading Zero, '3' 1 of 4 "); \r | |
185e038c | 93 | PrintAndLog("");\r |
13d77ef9 | 94 | PrintAndLog("Examples:");\r |
72c5877a | 95 | PrintAndLog(" lf t55xx write b 3 d 11223344 - write 11223344 to block 3");\r |
96 | PrintAndLog(" lf t55xx write b 3 d 11223344 p feedbeef - write 11223344 to block 3 password feedbeef");\r | |
13d77ef9 | 97 | PrintAndLog("");\r |
98 | return 0;\r | |
99 | }\r | |
100 | int usage_t55xx_trace() {\r | |
101 | PrintAndLog("Usage: lf t55xx trace [1]");\r | |
be2d41b7 | 102 | PrintAndLog("Options:");\r |
0c8200f1 | 103 | PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");\r |
13d77ef9 | 104 | PrintAndLog("");\r |
105 | PrintAndLog("Examples:");\r | |
106 | PrintAndLog(" lf t55xx trace");\r | |
107 | PrintAndLog(" lf t55xx trace 1");\r | |
108 | PrintAndLog("");\r | |
109 | return 0;\r | |
110 | }\r | |
111 | int usage_t55xx_info() {\r | |
112 | PrintAndLog("Usage: lf t55xx info [1]");\r | |
be2d41b7 | 113 | PrintAndLog("Options:");\r |
0c8200f1 | 114 | PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");\r |
13d77ef9 | 115 | PrintAndLog("");\r |
116 | PrintAndLog("Examples:");\r | |
117 | PrintAndLog(" lf t55xx info");\r | |
118 | PrintAndLog(" lf t55xx info 1");\r | |
119 | PrintAndLog("");\r | |
120 | return 0;\r | |
121 | }\r | |
122 | int usage_t55xx_dump(){\r | |
be2d41b7 | 123 | PrintAndLog("Usage: lf t55xx dump <password> [o]");\r |
124 | PrintAndLog("Options:");\r | |
0c8200f1 | 125 | PrintAndLog(" <password> - OPTIONAL password 4bytes (8 hex symbols)");\r |
126 | PrintAndLog(" o - OPTIONAL override, force pwd read despite danger to card");\r | |
13d77ef9 | 127 | PrintAndLog("");\r |
128 | PrintAndLog("Examples:");\r | |
129 | PrintAndLog(" lf t55xx dump");\r | |
be2d41b7 | 130 | PrintAndLog(" lf t55xx dump feedbeef o");\r |
13d77ef9 | 131 | PrintAndLog("");\r |
132 | return 0;\r | |
133 | }\r | |
134 | int usage_t55xx_detect(){\r | |
ab5ffe3b | 135 | PrintAndLog("Usage: lf t55xx detect [1] [p <password>]");\r |
be2d41b7 | 136 | PrintAndLog("Options:");\r |
ab5ffe3b | 137 | PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");\r |
138 | PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r | |
dd8e4513 | 139 | PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference");\r |
140 | PrintAndLog(" '2' Leading Zero, '3' 1 of 4 "); \r | |
13d77ef9 | 141 | PrintAndLog("");\r |
142 | PrintAndLog("Examples:");\r | |
143 | PrintAndLog(" lf t55xx detect");\r | |
144 | PrintAndLog(" lf t55xx detect 1");\r | |
ab5ffe3b | 145 | PrintAndLog(" lf t55xx detect p 11223344");\r |
13d77ef9 | 146 | PrintAndLog("");\r |
147 | return 0;\r | |
148 | }\r | |
b97311b1 | 149 | int usage_t55xx_detectP1(){\r |
605524b1 | 150 | PrintAndLog("Command: Detect Page 1 of a t55xx chip");\r |
151 | PrintAndLog("Usage: lf t55xx p1detect [1] [p <password>]");\r | |
b97311b1 | 152 | PrintAndLog("Options:");\r |
153 | PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");\r | |
154 | PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r | |
155 | PrintAndLog("");\r | |
156 | PrintAndLog("Examples:");\r | |
605524b1 | 157 | PrintAndLog(" lf t55xx p1detect");\r |
158 | PrintAndLog(" lf t55xx p1detect 1");\r | |
159 | PrintAndLog(" lf t55xx p1detect p 11223344");\r | |
b97311b1 | 160 | PrintAndLog("");\r |
161 | return 0;\r | |
162 | }\r | |
be2d41b7 | 163 | int usage_t55xx_wakup(){\r |
b97311b1 | 164 | PrintAndLog("Usage: lf t55xx wakeup [h] <password>");\r |
be2d41b7 | 165 | PrintAndLog("This commands send the Answer-On-Request command and leaves the readerfield ON afterwards.");\r |
166 | PrintAndLog("Options:");\r | |
167 | PrintAndLog(" h - this help");\r | |
b97311b1 | 168 | PrintAndLog(" <password> - [required] password 4bytes (8 hex symbols)");\r |
be2d41b7 | 169 | PrintAndLog("");\r |
170 | PrintAndLog("Examples:");\r | |
b97311b1 | 171 | PrintAndLog(" lf t55xx wakeup 11223344 - send wakeup password");\r |
be2d41b7 | 172 | return 0;\r |
173 | }\r | |
506672c4 | 174 | int usage_t55xx_bruteforce(){\r |
51923aca | 175 | PrintAndLog("This command uses A) bruteforce to scan a number range");\r |
176 | PrintAndLog(" B) a dictionary attack");\r | |
506672c4 | 177 | PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r |
178 | PrintAndLog(" password must be 4 bytes (8 hex symbols)");\r | |
179 | PrintAndLog("Options:");\r | |
51923aca | 180 | PrintAndLog(" h - this help");\r |
181 | PrintAndLog(" <start_pwd> - 4 byte hex value to start pwd search at");\r | |
182 | PrintAndLog(" <end_pwd> - 4 byte hex value to end pwd search at");\r | |
183 | PrintAndLog(" i <*.dic> - loads a default keys dictionary file <*.dic>");\r | |
506672c4 | 184 | PrintAndLog("");\r |
185 | PrintAndLog("Examples:");\r | |
186 | PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r | |
51923aca | 187 | PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");\r |
506672c4 | 188 | PrintAndLog("");\r |
189 | return 0;\r | |
190 | }\r | |
dd8e4513 | 191 | int usage_t55xx_bruteforce_downlink(){\r |
192 | PrintAndLog("This command uses A) bruteforce to scan a number range");\r | |
193 | PrintAndLog(" B) a dictionary attack");\r | |
194 | PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r | |
195 | PrintAndLog(" password must be 4 bytes (8 hex symbols)");\r | |
196 | PrintAndLog("Options:");\r | |
197 | PrintAndLog(" h - this help");\r | |
198 | PrintAndLog(" r <start_pwd> <end_pwd> - 4 byte hex value to start and end pwd search at");\r | |
199 | PrintAndLog(" i <*.dic> - loads a default keys dictionary file <*.dic>");\r | |
200 | PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference"); \r | |
201 | PrintAndLog(" '2' Leading Zero, '3' 1 of 4 "); \r | |
202 | PrintAndLog("");\r | |
203 | PrintAndLog("Examples:");\r | |
204 | PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r | |
205 | PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");\r | |
206 | PrintAndLog("");\r | |
207 | return 0;\r | |
208 | }\r | |
5490c2d6 | 209 | int usage_t55xx_wipe(){\r |
210 | PrintAndLog("Usage: lf t55xx wipe [h] [Q5]");\r | |
211 | PrintAndLog("This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block");\r | |
212 | PrintAndLog("Options:");\r | |
213 | PrintAndLog(" h - this help");\r | |
214 | PrintAndLog(" Q5 - indicates to use the T5555 (Q5) default configuration block");\r | |
215 | PrintAndLog("");\r | |
216 | PrintAndLog("Examples:");\r | |
217 | PrintAndLog(" lf t55xx wipe - wipes a t55x7 tag, config block 0x000880E0");\r | |
218 | PrintAndLog(" lf t55xx wipe Q5 - wipes a t5555 Q5 tag, config block 0x6001F004");\r | |
219 | return 0;\r | |
220 | }\r | |
221 | \r | |
54a942b0 | 222 | \r |
223 | static int CmdHelp(const char *Cmd);\r | |
224 | \r | |
709665b5 | 225 | void printT5xxHeader(uint8_t page){\r |
506672c4 | 226 | PrintAndLog("Reading Page %d:", page);\r |
709665b5 | 227 | PrintAndLog("blk | hex data | binary");\r |
228 | PrintAndLog("----+----------+---------------------------------"); \r | |
229 | }\r | |
230 | \r | |
13d77ef9 | 231 | int CmdT55xxSetConfig(const char *Cmd) {\r |
54a942b0 | 232 | \r |
13d77ef9 | 233 | uint8_t offset = 0;\r |
b6a04aff | 234 | char modulation[6] = {0x00};\r |
13d77ef9 | 235 | char tmp = 0x00;\r |
236 | uint8_t bitRate = 0;\r | |
237 | uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};\r | |
8e99ec25 | 238 | uint8_t cmdp = 0;\r |
7cb8516c | 239 | bool errors = false;\r |
13d77ef9 | 240 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors)\r |
241 | {\r | |
242 | tmp = param_getchar(Cmd, cmdp);\r | |
243 | switch(tmp)\r | |
244 | {\r | |
245 | case 'h':\r | |
246 | case 'H':\r | |
247 | return usage_t55xx_config();\r | |
248 | case 'b':\r | |
249 | errors |= param_getdec(Cmd, cmdp+1, &bitRate);\r | |
250 | if ( !errors){\r | |
251 | uint8_t i = 0;\r | |
252 | for (; i < 9; i++){\r | |
253 | if (rates[i]==bitRate) {\r | |
254 | config.bitrate = i;\r | |
255 | break;\r | |
256 | }\r | |
257 | }\r | |
7cb8516c | 258 | if (i==9) errors = true;\r |
13d77ef9 | 259 | }\r |
260 | cmdp+=2;\r | |
261 | break;\r | |
262 | case 'd':\r | |
874572d4 | 263 | param_getstr(Cmd, cmdp+1, modulation, sizeof(modulation));\r |
13d77ef9 | 264 | cmdp += 2;\r |
54a942b0 | 265 | \r |
2767fc02 | 266 | if ( strcmp(modulation, "FSK" ) == 0) {\r |
13d77ef9 | 267 | config.modulation = DEMOD_FSK;\r |
2767fc02 | 268 | } else if ( strcmp(modulation, "FSK1" ) == 0) {\r |
13d77ef9 | 269 | config.modulation = DEMOD_FSK1;\r |
2767fc02 | 270 | config.inverted=1;\r |
271 | } else if ( strcmp(modulation, "FSK1a" ) == 0) {\r | |
13d77ef9 | 272 | config.modulation = DEMOD_FSK1a;\r |
2767fc02 | 273 | config.inverted=0;\r |
274 | } else if ( strcmp(modulation, "FSK2" ) == 0) {\r | |
13d77ef9 | 275 | config.modulation = DEMOD_FSK2;\r |
2767fc02 | 276 | config.inverted=0;\r |
277 | } else if ( strcmp(modulation, "FSK2a" ) == 0) {\r | |
13d77ef9 | 278 | config.modulation = DEMOD_FSK2a;\r |
2767fc02 | 279 | config.inverted=1;\r |
280 | } else if ( strcmp(modulation, "ASK" ) == 0) {\r | |
13d77ef9 | 281 | config.modulation = DEMOD_ASK;\r |
2767fc02 | 282 | } else if ( strcmp(modulation, "NRZ" ) == 0) {\r |
13d77ef9 | 283 | config.modulation = DEMOD_NRZ;\r |
2767fc02 | 284 | } else if ( strcmp(modulation, "PSK1" ) == 0) {\r |
13d77ef9 | 285 | config.modulation = DEMOD_PSK1;\r |
2767fc02 | 286 | } else if ( strcmp(modulation, "PSK2" ) == 0) {\r |
13d77ef9 | 287 | config.modulation = DEMOD_PSK2;\r |
2767fc02 | 288 | } else if ( strcmp(modulation, "PSK3" ) == 0) {\r |
13d77ef9 | 289 | config.modulation = DEMOD_PSK3;\r |
2767fc02 | 290 | } else if ( strcmp(modulation, "BIa" ) == 0) {\r |
13d77ef9 | 291 | config.modulation = DEMOD_BIa;\r |
2767fc02 | 292 | config.inverted=1;\r |
293 | } else if ( strcmp(modulation, "BI" ) == 0) {\r | |
13d77ef9 | 294 | config.modulation = DEMOD_BI;\r |
2767fc02 | 295 | config.inverted=0;\r |
296 | } else {\r | |
13d77ef9 | 297 | PrintAndLog("Unknown modulation '%s'", modulation);\r |
7cb8516c | 298 | errors = true;\r |
13d77ef9 | 299 | }\r |
300 | break;\r | |
301 | case 'i':\r | |
302 | config.inverted = param_getchar(Cmd,cmdp+1) == '1';\r | |
303 | cmdp+=2;\r | |
304 | break;\r | |
305 | case 'o':\r | |
306 | errors |= param_getdec(Cmd, cmdp+1, &offset);\r | |
307 | if ( !errors )\r | |
308 | config.offset = offset;\r | |
309 | cmdp+=2;\r | |
310 | break;\r | |
f6650679 | 311 | case 'Q':\r |
312 | case 'q': \r | |
7cb8516c | 313 | config.Q5 = true;\r |
f6650679 | 314 | cmdp++;\r |
315 | break;\r | |
d1869c33 | 316 | case 'S':\r |
317 | case 's': \r | |
7cb8516c | 318 | config.ST = true;\r |
d1869c33 | 319 | cmdp++;\r |
320 | break;\r | |
13d77ef9 | 321 | default:\r |
322 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
7cb8516c | 323 | errors = true;\r |
13d77ef9 | 324 | break;\r |
325 | }\r | |
326 | }\r | |
54a942b0 | 327 | \r |
13d77ef9 | 328 | // No args\r |
be2d41b7 | 329 | if (cmdp == 0) return printConfiguration( config );\r |
330 | \r | |
13d77ef9 | 331 | //Validations\r |
be2d41b7 | 332 | if (errors) return usage_t55xx_config();\r |
54a942b0 | 333 | \r |
be2d41b7 | 334 | config.block0 = 0;\r |
335 | return printConfiguration ( config );\r | |
336 | }\r | |
337 | \r | |
dd8e4513 | 338 | int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32_t password, uint8_t downlink_mode){\r |
be2d41b7 | 339 | //Password mode\r |
340 | if ( usepwd ) {\r | |
341 | // try reading the config block and verify that PWD bit is set before doing this!\r | |
342 | if ( !override ) {\r | |
dd8e4513 | 343 | if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0,downlink_mode ) ) return 0;\r |
be2d41b7 | 344 | if ( !tryDetectModulation() ) {\r |
345 | PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");\r | |
346 | return 0;\r | |
347 | } else {\r | |
348 | PrintAndLog("Safety Check: PWD bit is NOT set in config block. Reading without password..."); \r | |
349 | usepwd = false;\r | |
350 | page1 = false;\r | |
351 | }\r | |
352 | } else {\r | |
353 | PrintAndLog("Safety Check Overriden - proceeding despite risk");\r | |
354 | }\r | |
355 | }\r | |
356 | \r | |
dd8e4513 | 357 | if (!AquireData(page1, block, usepwd, password,downlink_mode) ) return 0;\r |
be2d41b7 | 358 | if (!DecodeT55xxBlock()) return 0;\r |
359 | \r | |
360 | char blk[10]={0};\r | |
361 | sprintf(blk,"%d", block);\r | |
362 | printT55xxBlock(blk); \r | |
363 | return 1;\r | |
13d77ef9 | 364 | }\r |
54a942b0 | 365 | \r |
13d77ef9 | 366 | int CmdT55xxReadBlock(const char *Cmd) {\r |
be2d41b7 | 367 | uint8_t block = REGULAR_READ_MODE_BLOCK;\r |
368 | uint32_t password = 0; //default to blank Block 7\r | |
dd8e4513 | 369 | uint8_t downlink_mode = 0;\r |
370 | \r | |
be2d41b7 | 371 | bool usepwd = false;\r |
372 | bool override = false;\r | |
373 | bool page1 = false;\r | |
8e99ec25 | 374 | bool errors = false;\r |
be2d41b7 | 375 | uint8_t cmdp = 0;\r |
8e99ec25 | 376 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r |
377 | switch(param_getchar(Cmd, cmdp)) {\r | |
378 | case 'h':\r | |
379 | case 'H':\r | |
380 | return usage_t55xx_read();\r | |
381 | case 'b':\r | |
382 | case 'B':\r | |
383 | errors |= param_getdec(Cmd, cmdp+1, &block);\r | |
be2d41b7 | 384 | cmdp += 2;\r |
8e99ec25 | 385 | break;\r |
386 | case 'o':\r | |
387 | case 'O':\r | |
be2d41b7 | 388 | override = true;\r |
8e99ec25 | 389 | cmdp++;\r |
390 | break;\r | |
391 | case 'p':\r | |
392 | case 'P':\r | |
be2d41b7 | 393 | password = param_get32ex(Cmd, cmdp+1, 0, 16);\r |
394 | usepwd = true;\r | |
395 | cmdp += 2;\r | |
8e99ec25 | 396 | break;\r |
be2d41b7 | 397 | case '1':\r |
398 | page1 = true;\r | |
8e99ec25 | 399 | cmdp++;\r |
400 | break;\r | |
dd8e4513 | 401 | case 'e':\r |
402 | case 'E':\r | |
403 | downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r | |
404 | if (downlink_mode > 3) downlink_mode = 0;\r | |
405 | cmdp +=2;\r | |
406 | break;\r | |
8e99ec25 | 407 | default:\r |
408 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
409 | errors = true;\r | |
410 | break;\r | |
411 | }\r | |
412 | }\r | |
413 | if (errors) return usage_t55xx_read();\r | |
13d77ef9 | 414 | \r |
be2d41b7 | 415 | if (block > 7 && block != REGULAR_READ_MODE_BLOCK ) {\r |
416 | PrintAndLog("Block must be between 0 and 7");\r | |
417 | return 0;\r | |
8e99ec25 | 418 | }\r |
709665b5 | 419 | \r |
420 | printT5xxHeader(page1);\r | |
dd8e4513 | 421 | return T55xxReadBlock(block, page1, usepwd, override, password, downlink_mode);\r |
54a942b0 | 422 | }\r |
423 | \r | |
13d77ef9 | 424 | bool DecodeT55xxBlock(){\r |
425 | \r | |
fef74fdc | 426 | char buf[30] = {0x00};\r |
13d77ef9 | 427 | char *cmdStr = buf;\r |
428 | int ans = 0;\r | |
d1869c33 | 429 | bool ST = config.ST;\r |
13d77ef9 | 430 | uint8_t bitRate[8] = {8,16,32,40,50,64,100,128};\r |
13d77ef9 | 431 | DemodBufferLen = 0x00;\r |
54a942b0 | 432 | \r |
13d77ef9 | 433 | switch( config.modulation ){\r |
434 | case DEMOD_FSK:\r | |
224ce36e | 435 | snprintf(cmdStr, sizeof(buf),"%d %d", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 436 | ans = FSKrawDemod(cmdStr, false);\r |
13d77ef9 | 437 | break;\r |
438 | case DEMOD_FSK1:\r | |
13d77ef9 | 439 | case DEMOD_FSK1a:\r |
224ce36e | 440 | snprintf(cmdStr, sizeof(buf),"%d %d 8 5", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 441 | ans = FSKrawDemod(cmdStr, false);\r |
13d77ef9 | 442 | break;\r |
443 | case DEMOD_FSK2:\r | |
13d77ef9 | 444 | case DEMOD_FSK2a:\r |
224ce36e | 445 | snprintf(cmdStr, sizeof(buf),"%d %d 10 8", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 446 | ans = FSKrawDemod(cmdStr, false);\r |
13d77ef9 | 447 | break;\r |
448 | case DEMOD_ASK:\r | |
db829602 | 449 | snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 450 | ans = ASKDemod_ext(cmdStr, false, false, 1, &ST);\r |
13d77ef9 | 451 | break;\r |
452 | case DEMOD_PSK1:\r | |
db829602 | 453 | // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r |
3fd7fce4 | 454 | save_restoreGB(GRAPH_SAVE);\r |
db829602 | 455 | CmdLtrim("160");\r |
456 | snprintf(cmdStr, sizeof(buf),"%d %d 6", bitRate[config.bitrate], config.inverted );\r | |
7cb8516c | 457 | ans = PSKDemod(cmdStr, false);\r |
534678c3 | 458 | //undo trim samples\r |
3fd7fce4 | 459 | save_restoreGB(GRAPH_RESTORE);\r |
13d77ef9 | 460 | break;\r |
2767fc02 | 461 | case DEMOD_PSK2: //inverted won't affect this\r |
462 | case DEMOD_PSK3: //not fully implemented\r | |
db829602 | 463 | // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r |
3fd7fce4 | 464 | save_restoreGB(GRAPH_SAVE);\r |
db829602 | 465 | CmdLtrim("160");\r |
466 | snprintf(cmdStr, sizeof(buf),"%d 0 6", bitRate[config.bitrate] );\r | |
7cb8516c | 467 | ans = PSKDemod(cmdStr, false);\r |
13d77ef9 | 468 | psk1TOpsk2(DemodBuffer, DemodBufferLen);\r |
534678c3 | 469 | //undo trim samples\r |
3fd7fce4 | 470 | save_restoreGB(GRAPH_RESTORE);\r |
13d77ef9 | 471 | break;\r |
472 | case DEMOD_NRZ:\r | |
224ce36e | 473 | snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 474 | ans = NRZrawDemod(cmdStr, false);\r |
13d77ef9 | 475 | break;\r |
476 | case DEMOD_BI:\r | |
13d77ef9 | 477 | case DEMOD_BIa:\r |
db829602 | 478 | snprintf(cmdStr, sizeof(buf),"0 %d %d 1", bitRate[config.bitrate], config.inverted );\r |
7cb8516c | 479 | ans = ASKbiphaseDemod(cmdStr, false);\r |
13d77ef9 | 480 | break;\r |
481 | default:\r | |
7cb8516c | 482 | return false;\r |
13d77ef9 | 483 | }\r |
484 | return (bool) ans;\r | |
485 | }\r | |
54a942b0 | 486 | \r |
5490c2d6 | 487 | bool DecodeT5555TraceBlock() {\r |
488 | DemodBufferLen = 0x00;\r | |
489 | \r | |
490 | // According to datasheet. Always: RF/64, not inverted, Manchester\r | |
7cb8516c | 491 | return (bool) ASKDemod("64 0 1", false, false, 1);\r |
5490c2d6 | 492 | }\r |
493 | \r | |
13d77ef9 | 494 | int CmdT55xxDetect(const char *Cmd){\r |
7cb8516c | 495 | bool errors = false;\r |
496 | bool useGB = false;\r | |
497 | bool usepwd = false;\r | |
ab5ffe3b | 498 | uint32_t password = 0;\r |
499 | uint8_t cmdp = 0;\r | |
dd8e4513 | 500 | uint8_t downlink_mode = 0;\r |
54a942b0 | 501 | \r |
ab5ffe3b | 502 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r |
503 | switch(param_getchar(Cmd, cmdp)) {\r | |
504 | case 'h':\r | |
505 | case 'H':\r | |
506 | return usage_t55xx_detect();\r | |
507 | case 'p':\r | |
508 | case 'P':\r | |
509 | password = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
7cb8516c | 510 | usepwd = true;\r |
ab5ffe3b | 511 | cmdp += 2;\r |
512 | break;\r | |
513 | case '1':\r | |
514 | // use Graphbuffer data\r | |
7cb8516c | 515 | useGB = true;\r |
ab5ffe3b | 516 | cmdp++;\r |
517 | break;\r | |
dd8e4513 | 518 | case 'e':\r |
519 | case 'E':\r | |
520 | downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r | |
521 | if (downlink_mode > 3) downlink_mode = 0;\r | |
522 | cmdp +=2;\r | |
523 | break; \r | |
ab5ffe3b | 524 | default:\r |
525 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
526 | errors = true;\r | |
527 | break;\r | |
528 | }\r | |
709665b5 | 529 | }\r |
ab5ffe3b | 530 | if (errors) return usage_t55xx_detect();\r |
13d77ef9 | 531 | \r |
ab5ffe3b | 532 | if ( !useGB) {\r |
dd8e4513 | 533 | if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password,downlink_mode) )\r |
ab5ffe3b | 534 | return 0;\r |
709665b5 | 535 | }\r |
ab5ffe3b | 536 | \r |
13d77ef9 | 537 | if ( !tryDetectModulation() )\r |
538 | PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");\r | |
dd8e4513 | 539 | else {\r |
540 | // Add downlink mode to reference.\r | |
541 | switch (downlink_mode) {\r | |
542 | case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r | |
543 | case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r | |
544 | case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r | |
545 | case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r | |
546 | // default:\r | |
547 | \r | |
548 | // No default action\r | |
549 | }\r | |
550 | }\r | |
be2d41b7 | 551 | return 1;\r |
54a942b0 | 552 | }\r |
553 | \r | |
13d77ef9 | 554 | // detect configuration?\r |
555 | bool tryDetectModulation(){\r | |
13d77ef9 | 556 | uint8_t hits = 0;\r |
557 | t55xx_conf_block_t tests[15];\r | |
fef74fdc | 558 | int bitRate=0;\r |
b97311b1 | 559 | uint8_t fc1 = 0, fc2 = 0, ans = 0;\r |
bb4e6dbd | 560 | int clk = 0, firstClockEdge = 0;\r |
561 | ans = fskClocks(&fc1, &fc2, (uint8_t *)&clk, false, &firstClockEdge);\r | |
b97311b1 | 562 | if (ans && ((fc1==10 && fc2==8) || (fc1==8 && fc2==5))) {\r |
7cb8516c | 563 | if ( FSKrawDemod("0 0", false) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
13d77ef9 | 564 | tests[hits].modulation = DEMOD_FSK;\r |
565 | if (fc1==8 && fc2 == 5)\r | |
566 | tests[hits].modulation = DEMOD_FSK1a;\r | |
f6650679 | 567 | else if (fc1==10 && fc2 == 8)\r |
13d77ef9 | 568 | tests[hits].modulation = DEMOD_FSK2;\r |
fef74fdc | 569 | tests[hits].bitrate = bitRate;\r |
7cb8516c | 570 | tests[hits].inverted = false;\r |
13d77ef9 | 571 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 572 | tests[hits].ST = false;\r |
13d77ef9 | 573 | ++hits;\r |
574 | }\r | |
7cb8516c | 575 | if ( FSKrawDemod("0 1", false) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
13d77ef9 | 576 | tests[hits].modulation = DEMOD_FSK;\r |
fef74fdc | 577 | if (fc1 == 8 && fc2 == 5)\r |
13d77ef9 | 578 | tests[hits].modulation = DEMOD_FSK1;\r |
fef74fdc | 579 | else if (fc1 == 10 && fc2 == 8)\r |
13d77ef9 | 580 | tests[hits].modulation = DEMOD_FSK2a;\r |
fef74fdc | 581 | tests[hits].bitrate = bitRate;\r |
7cb8516c | 582 | tests[hits].inverted = true;\r |
13d77ef9 | 583 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 584 | tests[hits].ST = false;\r |
13d77ef9 | 585 | ++hits;\r |
586 | }\r | |
587 | } else {\r | |
7cb8516c | 588 | clk = GetAskClock("", false, false);\r |
322f7eb1 | 589 | if (clk>0) {\r |
7cb8516c | 590 | tests[hits].ST = true;\r |
591 | if ( ASKDemod_ext("0 0 1", false, false, 1, &tests[hits].ST) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r | |
322f7eb1 | 592 | tests[hits].modulation = DEMOD_ASK;\r |
593 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 594 | tests[hits].inverted = false;\r |
322f7eb1 | 595 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
596 | ++hits;\r | |
597 | }\r | |
7cb8516c | 598 | tests[hits].ST = true;\r |
599 | if ( ASKDemod_ext("0 1 1", false, false, 1, &tests[hits].ST) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r | |
322f7eb1 | 600 | tests[hits].modulation = DEMOD_ASK;\r |
601 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 602 | tests[hits].inverted = true;\r |
322f7eb1 | 603 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
604 | ++hits;\r | |
605 | }\r | |
7cb8516c | 606 | if ( ASKbiphaseDemod("0 0 0 2", false) && test(DEMOD_BI, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r |
322f7eb1 | 607 | tests[hits].modulation = DEMOD_BI;\r |
608 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 609 | tests[hits].inverted = false;\r |
322f7eb1 | 610 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 611 | tests[hits].ST = false;\r |
322f7eb1 | 612 | ++hits;\r |
613 | }\r | |
7cb8516c | 614 | if ( ASKbiphaseDemod("0 0 1 2", false) && test(DEMOD_BIa, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r |
322f7eb1 | 615 | tests[hits].modulation = DEMOD_BIa;\r |
616 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 617 | tests[hits].inverted = true;\r |
322f7eb1 | 618 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 619 | tests[hits].ST = false;\r |
322f7eb1 | 620 | ++hits;\r |
621 | }\r | |
13d77ef9 | 622 | }\r |
7cb8516c | 623 | clk = GetNrzClock("", false, false);\r |
bf85d22f | 624 | if (clk>8) { //clock of rf/8 is likely a false positive, so don't use it.\r |
7cb8516c | 625 | if ( NRZrawDemod("0 0 1", false) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
322f7eb1 | 626 | tests[hits].modulation = DEMOD_NRZ;\r |
627 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 628 | tests[hits].inverted = false;\r |
322f7eb1 | 629 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 630 | tests[hits].ST = false;\r |
322f7eb1 | 631 | ++hits;\r |
632 | }\r | |
54a942b0 | 633 | \r |
7cb8516c | 634 | if ( NRZrawDemod("0 1 1", false) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
322f7eb1 | 635 | tests[hits].modulation = DEMOD_NRZ;\r |
636 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 637 | tests[hits].inverted = true;\r |
322f7eb1 | 638 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 639 | tests[hits].ST = false;\r |
322f7eb1 | 640 | ++hits;\r |
641 | }\r | |
13d77ef9 | 642 | }\r |
643 | \r | |
7cb8516c | 644 | clk = GetPskClock("", false, false);\r |
322f7eb1 | 645 | if (clk>0) {\r |
b97311b1 | 646 | // allow undo\r |
3fd7fce4 | 647 | save_restoreGB(GRAPH_SAVE);\r |
b97311b1 | 648 | // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r |
649 | CmdLtrim("160");\r | |
7cb8516c | 650 | if ( PSKDemod("0 0 6", false) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
322f7eb1 | 651 | tests[hits].modulation = DEMOD_PSK1;\r |
fef74fdc | 652 | tests[hits].bitrate = bitRate;\r |
7cb8516c | 653 | tests[hits].inverted = false;\r |
13d77ef9 | 654 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 655 | tests[hits].ST = false;\r |
13d77ef9 | 656 | ++hits;\r |
657 | }\r | |
7cb8516c | 658 | if ( PSKDemod("0 1 6", false) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r |
322f7eb1 | 659 | tests[hits].modulation = DEMOD_PSK1;\r |
fef74fdc | 660 | tests[hits].bitrate = bitRate;\r |
7cb8516c | 661 | tests[hits].inverted = true;\r |
13d77ef9 | 662 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 663 | tests[hits].ST = false;\r |
13d77ef9 | 664 | ++hits;\r |
665 | }\r | |
322f7eb1 | 666 | // PSK2 - needs a call to psk1TOpsk2.\r |
7cb8516c | 667 | if ( PSKDemod("0 0 6", false)) {\r |
322f7eb1 | 668 | psk1TOpsk2(DemodBuffer, DemodBufferLen);\r |
f6650679 | 669 | if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r |
322f7eb1 | 670 | tests[hits].modulation = DEMOD_PSK2;\r |
671 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 672 | tests[hits].inverted = false;\r |
322f7eb1 | 673 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 674 | tests[hits].ST = false;\r |
322f7eb1 | 675 | ++hits;\r |
676 | }\r | |
677 | } // inverse waves does not affect this demod\r | |
678 | // PSK3 - needs a call to psk1TOpsk2.\r | |
7cb8516c | 679 | if ( PSKDemod("0 0 6", false)) {\r |
322f7eb1 | 680 | psk1TOpsk2(DemodBuffer, DemodBufferLen);\r |
f6650679 | 681 | if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r |
322f7eb1 | 682 | tests[hits].modulation = DEMOD_PSK3;\r |
683 | tests[hits].bitrate = bitRate;\r | |
7cb8516c | 684 | tests[hits].inverted = false;\r |
322f7eb1 | 685 | tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r |
7cb8516c | 686 | tests[hits].ST = false;\r |
322f7eb1 | 687 | ++hits;\r |
688 | }\r | |
689 | } // inverse waves does not affect this demod\r | |
b97311b1 | 690 | //undo trim samples\r |
3fd7fce4 | 691 | save_restoreGB(GRAPH_RESTORE);\r |
13d77ef9 | 692 | }\r |
6fe5c94b | 693 | } \r |
13d77ef9 | 694 | if ( hits == 1) {\r |
695 | config.modulation = tests[0].modulation;\r | |
fef74fdc | 696 | config.bitrate = tests[0].bitrate;\r |
13d77ef9 | 697 | config.inverted = tests[0].inverted;\r |
698 | config.offset = tests[0].offset;\r | |
699 | config.block0 = tests[0].block0;\r | |
6ca1477c | 700 | config.Q5 = tests[0].Q5;\r |
d1869c33 | 701 | config.ST = tests[0].ST;\r |
13d77ef9 | 702 | printConfiguration( config );\r |
7cb8516c | 703 | return true;\r |
13d77ef9 | 704 | }\r |
705 | \r | |
706 | if ( hits > 1) {\r | |
707 | PrintAndLog("Found [%d] possible matches for modulation.",hits);\r | |
708 | for(int i=0; i<hits; ++i){\r | |
709 | PrintAndLog("--[%d]---------------", i+1);\r | |
710 | printConfiguration( tests[i] );\r | |
711 | }\r | |
712 | }\r | |
7cb8516c | 713 | return false;\r |
13d77ef9 | 714 | }\r |
715 | \r | |
716 | bool testModulation(uint8_t mode, uint8_t modread){\r | |
717 | switch( mode ){\r | |
718 | case DEMOD_FSK:\r | |
7cb8516c | 719 | if (modread >= DEMOD_FSK1 && modread <= DEMOD_FSK2a) return true;\r |
13d77ef9 | 720 | break;\r |
721 | case DEMOD_ASK:\r | |
7cb8516c | 722 | if (modread == DEMOD_ASK) return true;\r |
13d77ef9 | 723 | break;\r |
724 | case DEMOD_PSK1:\r | |
7cb8516c | 725 | if (modread == DEMOD_PSK1) return true;\r |
13d77ef9 | 726 | break;\r |
727 | case DEMOD_PSK2:\r | |
7cb8516c | 728 | if (modread == DEMOD_PSK2) return true;\r |
13d77ef9 | 729 | break;\r |
730 | case DEMOD_PSK3:\r | |
7cb8516c | 731 | if (modread == DEMOD_PSK3) return true;\r |
13d77ef9 | 732 | break;\r |
733 | case DEMOD_NRZ:\r | |
7cb8516c | 734 | if (modread == DEMOD_NRZ) return true;\r |
13d77ef9 | 735 | break;\r |
736 | case DEMOD_BI:\r | |
7cb8516c | 737 | if (modread == DEMOD_BI) return true;\r |
13d77ef9 | 738 | break;\r |
739 | case DEMOD_BIa:\r | |
7cb8516c | 740 | if (modread == DEMOD_BIa) return true;\r |
13d77ef9 | 741 | break; \r |
742 | default:\r | |
7cb8516c | 743 | return false;\r |
13d77ef9 | 744 | }\r |
7cb8516c | 745 | return false;\r |
13d77ef9 | 746 | }\r |
747 | \r | |
f6650679 | 748 | bool testQ5Modulation(uint8_t mode, uint8_t modread){\r |
749 | switch( mode ){\r | |
13d77ef9 | 750 | case DEMOD_FSK:\r |
7cb8516c | 751 | if (modread >= 4 && modread <= 5) return true;\r |
13d77ef9 | 752 | break;\r |
753 | case DEMOD_ASK:\r | |
7cb8516c | 754 | if (modread == 0) return true;\r |
13d77ef9 | 755 | break;\r |
756 | case DEMOD_PSK1:\r | |
7cb8516c | 757 | if (modread == 1) return true;\r |
f6650679 | 758 | break;\r |
13d77ef9 | 759 | case DEMOD_PSK2:\r |
7cb8516c | 760 | if (modread == 2) return true;\r |
f6650679 | 761 | break;\r |
13d77ef9 | 762 | case DEMOD_PSK3:\r |
7cb8516c | 763 | if (modread == 3) return true;\r |
13d77ef9 | 764 | break;\r |
765 | case DEMOD_NRZ:\r | |
7cb8516c | 766 | if (modread == 7) return true;\r |
f6650679 | 767 | break;\r |
768 | case DEMOD_BI:\r | |
7cb8516c | 769 | if (modread == 6) return true;\r |
13d77ef9 | 770 | break;\r |
13d77ef9 | 771 | default:\r |
7cb8516c | 772 | return false;\r |
13d77ef9 | 773 | }\r |
7cb8516c | 774 | return false;\r |
13d77ef9 | 775 | }\r |
776 | \r | |
af5384bc | 777 | int convertQ5bitRate(uint8_t bitRateRead) {\r |
778 | uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r | |
779 | for (int i=0; i<8; i++)\r | |
780 | if (expected[i] == bitRateRead)\r | |
781 | return i;\r | |
782 | \r | |
783 | return -1;\r | |
784 | }\r | |
785 | \r | |
f6650679 | 786 | bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){\r |
787 | \r | |
7cb8516c | 788 | if ( DemodBufferLen < 64 ) return false;\r |
f6650679 | 789 | uint8_t si = 0;\r |
db829602 | 790 | for (uint8_t idx = 28; idx < 64; idx++){\r |
f6650679 | 791 | si = idx;\r |
db829602 | 792 | if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r |
f6650679 | 793 | \r |
794 | uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r | |
795 | uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;\r | |
796 | // 2nibble must be zeroed.\r | |
6ca1477c | 797 | if (safer != 0x6 && safer != 0x9) continue;\r |
f6650679 | 798 | if ( resv > 0x00) continue;\r |
799 | //uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;\r | |
800 | //uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;\r | |
801 | si += 1+1;\r | |
6ca1477c | 802 | int bitRate = PackBits(si, 6, DemodBuffer)*2 + 2; si += 6; //bit rate\r |
db829602 | 803 | if (bitRate > 128 || bitRate < 8) continue;\r |
f6650679 | 804 | \r |
db829602 | 805 | //uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1; \r |
f6650679 | 806 | //uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1; \r |
807 | //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr\r | |
808 | //uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;\r | |
db829602 | 809 | si += 1+1+2+1;\r |
810 | uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;\r | |
811 | uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;\r | |
f6650679 | 812 | //uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;\r |
db829602 | 813 | if (maxBlk == 0) continue;\r |
f6650679 | 814 | //test modulation\r |
815 | if (!testQ5Modulation(mode, modread)) continue;\r | |
816 | if (bitRate != clk) continue;\r | |
af5384bc | 817 | *fndBitRate = convertQ5bitRate(bitRate);\r |
818 | if (*fndBitRate < 0) continue;\r | |
f6650679 | 819 | *offset = idx;\r |
820 | \r | |
7cb8516c | 821 | return true;\r |
f6650679 | 822 | }\r |
7cb8516c | 823 | return false;\r |
f6650679 | 824 | }\r |
825 | \r | |
826 | bool testBitRate(uint8_t readRate, uint8_t clk){\r | |
db829602 | 827 | uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r |
f6650679 | 828 | if (expected[readRate] == clk)\r |
829 | return true;\r | |
830 | \r | |
831 | return false;\r | |
832 | }\r | |
833 | \r | |
834 | bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5){\r | |
13d77ef9 | 835 | \r |
7cb8516c | 836 | if ( DemodBufferLen < 64 ) return false;\r |
13d77ef9 | 837 | uint8_t si = 0;\r |
db829602 | 838 | for (uint8_t idx = 28; idx < 64; idx++){\r |
13d77ef9 | 839 | si = idx;\r |
db829602 | 840 | if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r |
13d77ef9 | 841 | \r |
2767fc02 | 842 | uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r |
13d77ef9 | 843 | uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode\r |
844 | // 2nibble must be zeroed.\r | |
845 | // moved test to here, since this gets most faults first.\r | |
846 | if ( resv > 0x00) continue;\r | |
847 | \r | |
b97311b1 | 848 | int bitRate = PackBits(si, 6, DemodBuffer); si += 6; //bit rate (includes extended mode part of rate)\r |
13d77ef9 | 849 | uint8_t extend = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode\r |
2767fc02 | 850 | uint8_t modread = PackBits(si, 5, DemodBuffer); si += 5+2+1; \r |
851 | //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //could check psk cr\r | |
35cfcfc7 | 852 | //uint8_t nml01 = PackBits(si, 1, DemodBuffer); si += 1+5; //bit 24, 30, 31 could be tested for 0 if not extended mode\r |
853 | //uint8_t nml02 = PackBits(si, 2, DemodBuffer); si += 2;\r | |
13d77ef9 | 854 | \r |
855 | //if extended mode\r | |
7cb8516c | 856 | bool extMode =( (safer == 0x6 || safer == 0x9) && extend) ? true : false;\r |
13d77ef9 | 857 | \r |
b97311b1 | 858 | if (!extMode) {\r |
859 | if (bitRate > 7) continue;\r | |
860 | if (!testBitRate(bitRate, clk)) continue;\r | |
861 | } else { //extended mode bitrate = same function to calc bitrate as em4x05\r | |
862 | if (EM4x05_GET_BITRATE(bitRate) != clk) continue;\r | |
b9957414 | 863 | \r |
13d77ef9 | 864 | }\r |
865 | //test modulation\r | |
866 | if (!testModulation(mode, modread)) continue;\r | |
fef74fdc | 867 | *fndBitRate = bitRate;\r |
2767fc02 | 868 | *offset = idx;\r |
7cb8516c | 869 | *Q5 = false;\r |
870 | return true;\r | |
f6650679 | 871 | }\r |
872 | if (testQ5(mode, offset, fndBitRate, clk)) {\r | |
7cb8516c | 873 | *Q5 = true;\r |
874 | return true;\r | |
13d77ef9 | 875 | }\r |
7cb8516c | 876 | return false;\r |
54a942b0 | 877 | }\r |
878 | \r | |
224ce36e | 879 | void printT55xxBlock(const char *blockNum){\r |
13d77ef9 | 880 | \r |
881 | uint8_t i = config.offset;\r | |
882 | uint8_t endpos = 32 + i;\r | |
883 | uint32_t blockData = 0;\r | |
884 | uint8_t bits[64] = {0x00};\r | |
885 | \r | |
886 | if ( !DemodBufferLen) return;\r | |
887 | \r | |
888 | if ( endpos > DemodBufferLen){\r | |
889 | PrintAndLog("The configured offset %d is too big. Possible offset: %d)", i, DemodBufferLen-32);\r | |
890 | return;\r | |
891 | }\r | |
892 | \r | |
893 | for (; i < endpos; ++i)\r | |
894 | bits[i - config.offset]=DemodBuffer[i];\r | |
93507a33 | 895 | \r |
13d77ef9 | 896 | blockData = PackBits(0, 32, bits);\r |
db829602 | 897 | \r |
be2d41b7 | 898 | PrintAndLog(" %s | %08X | %s", blockNum, blockData, sprint_bin(bits,32));\r |
13d77ef9 | 899 | }\r |
900 | \r | |
901 | int special(const char *Cmd) {\r | |
902 | uint32_t blockData = 0;\r | |
903 | uint8_t bits[32] = {0x00};\r | |
904 | \r | |
be2d41b7 | 905 | PrintAndLog("OFFSET | DATA | BINARY");\r |
13d77ef9 | 906 | PrintAndLog("----------------------------------------------------");\r |
907 | int i,j = 0;\r | |
908 | for (; j < 64; ++j){\r | |
909 | \r | |
910 | for (i = 0; i < 32; ++i)\r | |
911 | bits[i]=DemodBuffer[j+i];\r | |
912 | \r | |
913 | blockData = PackBits(0, 32, bits);\r | |
914 | \r | |
be2d41b7 | 915 | PrintAndLog(" %02d | 0x%08X | %s",j , blockData, sprint_bin(bits,32)); \r |
13d77ef9 | 916 | }\r |
917 | return 0;\r | |
918 | }\r | |
919 | \r | |
be2d41b7 | 920 | int printConfiguration( t55xx_conf_block_t b){\r |
f6650679 | 921 | PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");\r |
13d77ef9 | 922 | PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );\r |
b9957414 | 923 | PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate, (b.block0 & T55x7_X_MODE && (b.block0>>28==6 || b.block0>>28==9))) );\r |
13d77ef9 | 924 | PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );\r |
925 | PrintAndLog("Offset : %d", b.offset);\r | |
8e90cd41 | 926 | PrintAndLog("Seq. Term. : %s", (b.ST) ? "Yes" : "No" );\r |
13d77ef9 | 927 | PrintAndLog("Block0 : 0x%08X", b.block0);\r |
928 | PrintAndLog("");\r | |
be2d41b7 | 929 | return 0;\r |
13d77ef9 | 930 | }\r |
931 | \r | |
be2d41b7 | 932 | int CmdT55xxWakeUp(const char *Cmd) {\r |
933 | uint32_t password = 0;\r | |
b97311b1 | 934 | if ( strlen(Cmd) <= 0 ) return usage_t55xx_wakup();\r |
935 | char cmdp = param_getchar(Cmd, 0);\r | |
936 | if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_wakup();\r | |
937 | \r | |
938 | password = param_get32ex(Cmd, 0, 0, 16);\r | |
be2d41b7 | 939 | \r |
940 | UsbCommand c = {CMD_T55XX_WAKEUP, {password, 0, 0}};\r | |
941 | clearCommandBuffer();\r | |
942 | SendCommand(&c);\r | |
943 | PrintAndLog("Wake up command sent. Try read now");\r | |
944 | return 0;\r | |
945 | }\r | |
946 | \r | |
947 | int CmdT55xxWriteBlock(const char *Cmd) {\r | |
948 | uint8_t block = 0xFF; //default to invalid block\r | |
709665b5 | 949 | uint32_t data = 0; //default to blank Block \r |
950 | uint32_t password = 0; //default to blank Block 7\r | |
dd8e4513 | 951 | uint32_t downlink_mode = 0;\r |
952 | \r | |
be2d41b7 | 953 | bool usepwd = false;\r |
954 | bool page1 = false; \r | |
955 | bool gotdata = false;\r | |
b97311b1 | 956 | bool testMode = false;\r |
be2d41b7 | 957 | bool errors = false;\r |
958 | uint8_t cmdp = 0;\r | |
959 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r | |
960 | switch(param_getchar(Cmd, cmdp)) {\r | |
961 | case 'h':\r | |
962 | case 'H':\r | |
963 | return usage_t55xx_write();\r | |
964 | case 'b':\r | |
965 | case 'B':\r | |
966 | errors |= param_getdec(Cmd, cmdp+1, &block);\r | |
967 | cmdp += 2;\r | |
968 | break;\r | |
969 | case 'd':\r | |
970 | case 'D':\r | |
971 | data = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
972 | gotdata = true;\r | |
973 | cmdp += 2;\r | |
974 | break;\r | |
975 | case 'p':\r | |
976 | case 'P':\r | |
977 | password = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
978 | usepwd = true;\r | |
979 | cmdp += 2;\r | |
980 | break;\r | |
b97311b1 | 981 | case 't':\r |
982 | case 'T':\r | |
983 | testMode = true;\r | |
984 | cmdp++;\r | |
985 | break;\r | |
be2d41b7 | 986 | case '1':\r |
987 | page1 = true;\r | |
988 | cmdp++;\r | |
989 | break;\r | |
dd8e4513 | 990 | case 'e':\r |
991 | case 'E':\r | |
992 | downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r | |
993 | if (downlink_mode > 3) downlink_mode = 0;\r | |
994 | cmdp +=2;\r | |
995 | break;\r | |
be2d41b7 | 996 | default:\r |
997 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
998 | errors = true;\r | |
999 | break;\r | |
1000 | }\r | |
13d77ef9 | 1001 | }\r |
be2d41b7 | 1002 | if (errors || !gotdata) return usage_t55xx_write();\r |
13d77ef9 | 1003 | \r |
1004 | if (block > 7) {\r | |
1005 | PrintAndLog("Block number must be between 0 and 7");\r | |
be2d41b7 | 1006 | return 0;\r |
13d77ef9 | 1007 | }\r |
1008 | \r | |
1009 | UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};\r | |
976627d5 | 1010 | UsbCommand resp;\r |
be2d41b7 | 1011 | c.d.asBytes[0] = (page1) ? 0x2 : 0; \r |
b97311b1 | 1012 | c.d.asBytes[0] |= (testMode) ? 0x4 : 0; \r |
dd8e4513 | 1013 | c.d.asBytes[0] |= (downlink_mode << 3);\r |
1014 | \r | |
709665b5 | 1015 | char pwdStr[16] = {0};\r |
1016 | snprintf(pwdStr, sizeof(pwdStr), "pwd: 0x%08X", password);\r | |
1017 | \r | |
1018 | PrintAndLog("Writing page %d block: %02d data: 0x%08X %s", page1, block, data, (usepwd) ? pwdStr : "" );\r | |
dd8e4513 | 1019 | \r |
13d77ef9 | 1020 | //Password mode\r |
be2d41b7 | 1021 | if (usepwd) {\r |
13d77ef9 | 1022 | c.arg[2] = password;\r |
be2d41b7 | 1023 | c.d.asBytes[0] |= 0x1; \r |
13d77ef9 | 1024 | }\r |
dd8e4513 | 1025 | \r |
40c5f342 | 1026 | clearCommandBuffer();\r |
13d77ef9 | 1027 | SendCommand(&c);\r |
976627d5 MHS |
1028 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){\r |
1029 | PrintAndLog("Error occurred, device did not ACK write operation. (May be due to old firmware)");\r | |
be2d41b7 | 1030 | return 0;\r |
976627d5 | 1031 | }\r |
be2d41b7 | 1032 | return 1;\r |
54a942b0 | 1033 | }\r |
1034 | \r | |
be2d41b7 | 1035 | int CmdT55xxReadTrace(const char *Cmd) {\r |
13d77ef9 | 1036 | char cmdp = param_getchar(Cmd, 0);\r |
be2d41b7 | 1037 | bool pwdmode = false;\r |
1038 | uint32_t password = 0;\r | |
13d77ef9 | 1039 | if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') \r |
1040 | return usage_t55xx_trace();\r | |
1041 | \r | |
1042 | if (strlen(Cmd)==0)\r | |
dd8e4513 | 1043 | if ( !AquireData( T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password,0 ) )\r |
be2d41b7 | 1044 | return 0;\r |
be2d41b7 | 1045 | \r |
5490c2d6 | 1046 | if ( config.Q5 ) {\r |
1047 | if (!DecodeT5555TraceBlock()) return 0;\r | |
1048 | } else {\r | |
1049 | if (!DecodeT55xxBlock()) return 0;\r | |
1050 | }\r | |
1051 | \r | |
1052 | if ( !DemodBufferLen ) return 0;\r | |
54a942b0 | 1053 | \r |
13d77ef9 | 1054 | RepaintGraphWindow();\r |
5490c2d6 | 1055 | uint8_t repeat = (config.offset > 5) ? 32 : 0;\r |
1056 | \r | |
13d77ef9 | 1057 | uint8_t si = config.offset+repeat;\r |
be2d41b7 | 1058 | uint32_t bl1 = PackBits(si, 32, DemodBuffer);\r |
1059 | uint32_t bl2 = PackBits(si+32, 32, DemodBuffer);\r | |
224ce36e | 1060 | \r |
5490c2d6 | 1061 | if (config.Q5) {\r |
1062 | uint32_t hdr = PackBits(si, 9, DemodBuffer); si += 9;\r | |
1063 | \r | |
1064 | if (hdr != 0x1FF) {\r | |
1065 | PrintAndLog("Invalid Q5 Trace data header (expected 0x1FF, found %X)", hdr);\r | |
1066 | return 0;\r | |
1067 | }\r | |
1068 | \r | |
1069 | t5555_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .icr = 0, .lotidc = '?', .lotid = 0, .wafer = 0, .dw =0};\r | |
1070 | \r | |
1071 | data.icr = PackBits(si, 2, DemodBuffer); si += 2;\r | |
1072 | data.lotidc = 'Z' - PackBits(si, 2, DemodBuffer); si += 3;\r | |
1073 | \r | |
1074 | data.lotid = PackBits(si, 4, DemodBuffer); si += 5;\r | |
1075 | data.lotid <<= 4;\r | |
1076 | data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1077 | data.lotid <<= 4;\r | |
1078 | data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1079 | data.lotid <<= 4;\r | |
1080 | data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1081 | data.lotid <<= 1;\r | |
1082 | data.lotid |= PackBits(si, 1, DemodBuffer); si += 1;\r | |
1083 | \r | |
1084 | data.wafer = PackBits(si, 3, DemodBuffer); si += 4;\r | |
1085 | data.wafer <<= 2;\r | |
1086 | data.wafer |= PackBits(si, 2, DemodBuffer); si += 2;\r | |
1087 | \r | |
1088 | data.dw = PackBits(si, 2, DemodBuffer); si += 3;\r | |
1089 | data.dw <<= 4;\r | |
1090 | data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1091 | data.dw <<= 4;\r | |
1092 | data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1093 | data.dw <<= 4;\r | |
1094 | data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r | |
1095 | \r | |
1096 | printT5555Trace(data, repeat);\r | |
1097 | \r | |
1098 | } else {\r | |
1099 | \r | |
1100 | t55x7_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .acl = 0, .mfc = 0, .cid = 0, .year = 0, .quarter = 0, .icr = 0, .lotid = 0, .wafer = 0, .dw = 0};\r | |
1101 | \r | |
1102 | data.acl = PackBits(si, 8, DemodBuffer); si += 8;\r | |
1103 | if ( data.acl != 0xE0 ) {\r | |
1104 | PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");\r | |
1105 | return 0;\r | |
1106 | }\r | |
1107 | \r | |
1108 | data.mfc = PackBits(si, 8, DemodBuffer); si += 8;\r | |
1109 | data.cid = PackBits(si, 5, DemodBuffer); si += 5;\r | |
1110 | data.icr = PackBits(si, 3, DemodBuffer); si += 3;\r | |
1111 | data.year = PackBits(si, 4, DemodBuffer); si += 4;\r | |
1112 | data.quarter = PackBits(si, 2, DemodBuffer); si += 2;\r | |
1113 | data.lotid = PackBits(si, 14, DemodBuffer); si += 14;\r | |
1114 | data.wafer = PackBits(si, 5, DemodBuffer); si += 5;\r | |
1115 | data.dw = PackBits(si, 15, DemodBuffer); \r | |
1116 | \r | |
1117 | time_t t = time(NULL);\r | |
1118 | struct tm tm = *localtime(&t);\r | |
1119 | if ( data.year > tm.tm_year-110)\r | |
1120 | data.year += 2000;\r | |
1121 | else\r | |
1122 | data.year += 2010;\r | |
1123 | \r | |
1124 | printT55x7Trace(data, repeat);\r | |
224ce36e | 1125 | }\r |
5490c2d6 | 1126 | return 0;\r |
1127 | }\r | |
1128 | \r | |
1129 | void printT55x7Trace( t55x7_tracedata_t data, uint8_t repeat ){\r | |
1130 | PrintAndLog("-- T55x7 Trace Information ----------------------------------");\r | |
13d77ef9 | 1131 | PrintAndLog("-------------------------------------------------------------");\r |
5490c2d6 | 1132 | PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", data.acl, data.acl);\r |
1338d245 | 1133 | PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d) - %s", data.mfc, data.mfc, getManufacturerName(data.mfc));\r |
5490c2d6 | 1134 | PrintAndLog(" CID : 0x%02X (%d) - %s", data.cid, data.cid, GetModelStrFromCID(data.cid));\r |
1135 | PrintAndLog(" ICR IC Revision : %d", data.icr );\r | |
13d77ef9 | 1136 | PrintAndLog(" Manufactured");\r |
5490c2d6 | 1137 | PrintAndLog(" Year/Quarter : %d/%d", data.year, data.quarter);\r |
1138 | PrintAndLog(" Lot ID : %d", data.lotid );\r | |
1139 | PrintAndLog(" Wafer number : %d", data.wafer);\r | |
1140 | PrintAndLog(" Die Number : %d", data.dw);\r | |
13d77ef9 | 1141 | PrintAndLog("-------------------------------------------------------------");\r |
1142 | PrintAndLog(" Raw Data - Page 1");\r | |
5490c2d6 | 1143 | PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );\r |
1144 | PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );\r | |
1145 | PrintAndLog("-------------------------------------------------------------"); \r | |
54a942b0 | 1146 | \r |
13d77ef9 | 1147 | /*\r |
1148 | TRACE - BLOCK O\r | |
1149 | Bits Definition HEX\r | |
1150 | 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0 \r | |
1151 | 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation\r | |
1152 | 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2 \r | |
1153 | 22-24 ICR IC revision\r | |
1154 | 25-28 YEAR (BCD encoded) 9 (= 2009)\r | |
1155 | 29-30 QUARTER 1,2,3,4 \r | |
1156 | 31-32 LOT ID\r | |
1157 | \r | |
1158 | TRACE - BLOCK 1\r | |
1159 | 1-12 LOT ID \r | |
1160 | 13-17 Wafer number\r | |
1161 | 18-32 DW, die number sequential\r | |
1162 | */\r | |
5490c2d6 | 1163 | }\r |
1164 | \r | |
1165 | void printT5555Trace( t5555_tracedata_t data, uint8_t repeat ){\r | |
1166 | PrintAndLog("-- T5555 (Q5) Trace Information -----------------------------");\r | |
1167 | PrintAndLog("-------------------------------------------------------------");\r | |
1168 | PrintAndLog(" ICR IC Revision : %d", data.icr ); \r | |
1169 | PrintAndLog(" Lot : %c%d", data.lotidc, data.lotid);\r | |
1170 | PrintAndLog(" Wafer number : %d", data.wafer);\r | |
1171 | PrintAndLog(" Die Number : %d", data.dw);\r | |
1172 | PrintAndLog("-------------------------------------------------------------");\r | |
1173 | PrintAndLog(" Raw Data - Page 1");\r | |
1174 | PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );\r | |
1175 | PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );\r | |
13d77ef9 | 1176 | \r |
5490c2d6 | 1177 | /*\r |
1178 | ** Q5 **\r | |
1179 | TRACE - BLOCK O and BLOCK1\r | |
1180 | Bits Definition HEX\r | |
1181 | 1-9 Header 0x1FF\r | |
1182 | 10-11 IC Revision\r | |
1183 | 12-13 Lot ID char\r | |
1184 | 15-35 Lot ID (NB parity)\r | |
1185 | 36-41 Wafer number (NB parity)\r | |
1186 | 42-58 DW, die number sequential (NB parity)\r | |
1187 | 60-63 Parity bits\r | |
1188 | 64 Always zero\r | |
1189 | */\r | |
54a942b0 | 1190 | }\r |
1191 | \r | |
5490c2d6 | 1192 | //need to add Q5 info...\r |
13d77ef9 | 1193 | int CmdT55xxInfo(const char *Cmd){\r |
1194 | /*\r | |
1195 | Page 0 Block 0 Configuration data.\r | |
1196 | Normal mode\r | |
1197 | Extended mode\r | |
1198 | */\r | |
be2d41b7 | 1199 | bool pwdmode = false;\r |
1200 | uint32_t password = 0;\r | |
13d77ef9 | 1201 | char cmdp = param_getchar(Cmd, 0);\r |
1202 | \r | |
1203 | if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H')\r | |
1204 | return usage_t55xx_info();\r | |
1205 | \r | |
1206 | if (strlen(Cmd)==0)\r | |
dd8e4513 | 1207 | if ( !AquireData( T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password,0 ) )\r |
be2d41b7 | 1208 | return 1;\r |
fef74fdc | 1209 | \r |
13d77ef9 | 1210 | if (!DecodeT55xxBlock()) return 1;\r |
1211 | \r | |
5490c2d6 | 1212 | // too little space to start with\r |
fef74fdc | 1213 | if ( DemodBufferLen < 32) return 1;\r |
13d77ef9 | 1214 | \r |
1215 | uint8_t si = config.offset;\r | |
1216 | uint32_t bl0 = PackBits(si, 32, DemodBuffer);\r | |
1217 | \r | |
1218 | uint32_t safer = PackBits(si, 4, DemodBuffer); si += 4; \r | |
1219 | uint32_t resv = PackBits(si, 7, DemodBuffer); si += 7;\r | |
1220 | uint32_t dbr = PackBits(si, 3, DemodBuffer); si += 3;\r | |
1221 | uint32_t extend = PackBits(si, 1, DemodBuffer); si += 1;\r | |
1222 | uint32_t datamod = PackBits(si, 5, DemodBuffer); si += 5;\r | |
1223 | uint32_t pskcf = PackBits(si, 2, DemodBuffer); si += 2;\r | |
1224 | uint32_t aor = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1225 | uint32_t otp = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1226 | uint32_t maxblk = PackBits(si, 3, DemodBuffer); si += 3;\r | |
1227 | uint32_t pwd = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1228 | uint32_t sst = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1229 | uint32_t fw = PackBits(si, 1, DemodBuffer); si += 1;\r | |
1230 | uint32_t inv = PackBits(si, 1, DemodBuffer); si += 1; \r | |
1231 | uint32_t por = PackBits(si, 1, DemodBuffer); si += 1;\r | |
5490c2d6 | 1232 | \r |
db829602 | 1233 | if (config.Q5) PrintAndLog("*** Warning *** Config Info read off a Q5 will not display as expected");\r |
13d77ef9 | 1234 | PrintAndLog("");\r |
5490c2d6 | 1235 | PrintAndLog("-- T55x7 Configuration & Tag Information --------------------");\r |
13d77ef9 | 1236 | PrintAndLog("-------------------------------------------------------------");\r |
1237 | PrintAndLog(" Safer key : %s", GetSaferStr(safer));\r | |
1238 | PrintAndLog(" reserved : %d", resv);\r | |
b97311b1 | 1239 | PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr, extend));\r |
13d77ef9 | 1240 | PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");\r |
1241 | PrintAndLog(" Modulation : %s", GetModulationStr(datamod));\r | |
1242 | PrintAndLog(" PSK clock frequency : %d", pskcf);\r | |
1243 | PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");\r | |
1244 | PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );\r | |
1245 | PrintAndLog(" Max block : %d", maxblk);\r | |
1246 | PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");\r | |
1247 | PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");\r | |
1248 | PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");\r | |
1249 | PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");\r | |
1250 | PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");\r | |
1251 | PrintAndLog("-------------------------------------------------------------");\r | |
1252 | PrintAndLog(" Raw Data - Page 0");\r | |
1253 | PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(DemodBuffer+config.offset,32) );\r | |
1254 | PrintAndLog("-------------------------------------------------------------");\r | |
1255 | \r | |
1256 | return 0;\r | |
1257 | }\r | |
1258 | \r | |
1259 | int CmdT55xxDump(const char *Cmd){\r | |
1260 | \r | |
be2d41b7 | 1261 | uint32_t password = 0;\r |
13d77ef9 | 1262 | char cmdp = param_getchar(Cmd, 0);\r |
be2d41b7 | 1263 | bool override = false;\r |
1264 | if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_dump();\r | |
1265 | \r | |
b97311b1 | 1266 | bool usepwd = ( strlen(Cmd) > 0);\r |
be2d41b7 | 1267 | if ( usepwd ){\r |
1268 | password = param_get32ex(Cmd, 0, 0, 16);\r | |
1269 | if (param_getchar(Cmd, 1) =='o' )\r | |
1270 | override = true;\r | |
13d77ef9 | 1271 | }\r |
1272 | \r | |
709665b5 | 1273 | printT5xxHeader(0);\r |
1274 | for ( uint8_t i = 0; i <8; ++i)\r | |
dd8e4513 | 1275 | T55xxReadBlock(i, 0, usepwd, override, password,0);\r |
709665b5 | 1276 | \r |
1277 | printT5xxHeader(1);\r | |
1278 | for ( uint8_t i = 0; i<4; i++)\r | |
dd8e4513 | 1279 | T55xxReadBlock(i, 1, usepwd, override, password,0); \r |
709665b5 | 1280 | \r |
be2d41b7 | 1281 | return 1;\r |
13d77ef9 | 1282 | }\r |
1283 | \r | |
dd8e4513 | 1284 | int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password, uint8_t downlink_mode ){\r |
709665b5 | 1285 | // arg0 bitmodes:\r |
1286 | // bit0 = pwdmode\r | |
1287 | // bit1 = page to read from\r | |
be2d41b7 | 1288 | uint8_t arg0 = (page<<1) | pwdmode;\r |
dd8e4513 | 1289 | arg0 |= (downlink_mode << 3);\r |
be2d41b7 | 1290 | UsbCommand c = {CMD_T55XX_READ_BLOCK, {arg0, block, password}};\r |
13d77ef9 | 1291 | \r |
40c5f342 | 1292 | clearCommandBuffer();\r |
13d77ef9 | 1293 | SendCommand(&c);\r |
1294 | if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r | |
1295 | PrintAndLog("command execution time out");\r | |
be2d41b7 | 1296 | return 0;\r |
13d77ef9 | 1297 | }\r |
b9957414 | 1298 | getSamples(12000,true);\r |
be2d41b7 | 1299 | return 1;\r |
13d77ef9 | 1300 | }\r |
1301 | \r | |
b97311b1 | 1302 | char * GetBitRateStr(uint32_t id, bool xmode) {\r |
af5384bc | 1303 | static char buf[25];\r |
fef74fdc | 1304 | \r |
13d77ef9 | 1305 | char *retStr = buf;\r |
b97311b1 | 1306 | if (xmode) { //xmode bitrate calc is same as em4x05 calc\r |
1307 | snprintf(retStr,sizeof(buf),"%d - RF/%d", id, EM4x05_GET_BITRATE(id));\r | |
1308 | } else {\r | |
1309 | switch (id) {\r | |
1310 | case 0: snprintf(retStr,sizeof(buf),"%d - RF/8",id); break;\r | |
1311 | case 1: snprintf(retStr,sizeof(buf),"%d - RF/16",id); break;\r | |
1312 | case 2: snprintf(retStr,sizeof(buf),"%d - RF/32",id); break;\r | |
1313 | case 3: snprintf(retStr,sizeof(buf),"%d - RF/40",id); break;\r | |
1314 | case 4: snprintf(retStr,sizeof(buf),"%d - RF/50",id); break;\r | |
1315 | case 5: snprintf(retStr,sizeof(buf),"%d - RF/64",id); break;\r | |
1316 | case 6: snprintf(retStr,sizeof(buf),"%d - RF/100",id); break;\r | |
1317 | case 7: snprintf(retStr,sizeof(buf),"%d - RF/128",id); break;\r | |
1318 | default: snprintf(retStr,sizeof(buf),"%d - (Unknown)",id); break;\r | |
1319 | } \r | |
af5384bc | 1320 | }\r |
13d77ef9 | 1321 | return buf;\r |
1322 | }\r | |
1323 | \r | |
af5384bc | 1324 | char * GetSaferStr(uint32_t id) {\r |
13d77ef9 | 1325 | static char buf[40];\r |
1326 | char *retStr = buf;\r | |
1327 | \r | |
9795e535 | 1328 | snprintf(retStr,sizeof(buf),"%d",id);\r |
13d77ef9 | 1329 | if (id == 6) {\r |
9795e535 | 1330 | snprintf(retStr,sizeof(buf),"%d - passwd",id);\r |
13d77ef9 | 1331 | }\r |
1332 | if (id == 9 ){\r | |
9795e535 | 1333 | snprintf(retStr,sizeof(buf),"%d - testmode",id);\r |
13d77ef9 | 1334 | }\r |
1335 | \r | |
1336 | return buf;\r | |
1337 | }\r | |
9795e535 | 1338 | \r |
13d77ef9 | 1339 | char * GetModulationStr( uint32_t id){\r |
2767fc02 | 1340 | static char buf[60];\r |
13d77ef9 | 1341 | char *retStr = buf;\r |
1342 | \r | |
1343 | switch (id){\r | |
5490c2d6 | 1344 | case 0: snprintf(retStr,sizeof(buf),"%d - DIRECT (ASK/NRZ)",id); break;\r |
1345 | case 1: snprintf(retStr,sizeof(buf),"%d - PSK 1 phase change when input changes",id); break;\r | |
1346 | case 2: snprintf(retStr,sizeof(buf),"%d - PSK 2 phase change on bitclk if input high",id); break;\r | |
1347 | case 3: snprintf(retStr,sizeof(buf),"%d - PSK 3 phase change on rising edge of input",id); break;\r | |
1348 | case 4: snprintf(retStr,sizeof(buf),"%d - FSK 1 RF/8 RF/5",id); break;\r | |
1349 | case 5: snprintf(retStr,sizeof(buf),"%d - FSK 2 RF/8 RF/10",id); break;\r | |
1350 | case 6: snprintf(retStr,sizeof(buf),"%d - FSK 1a RF/5 RF/8",id); break;\r | |
1351 | case 7: snprintf(retStr,sizeof(buf),"%d - FSK 2a RF/10 RF/8",id); break;\r | |
1352 | case 8: snprintf(retStr,sizeof(buf),"%d - Manchester",id); break;\r | |
1353 | case 16: snprintf(retStr,sizeof(buf),"%d - Biphase",id); break;\r | |
1354 | case 0x18: snprintf(retStr,sizeof(buf),"%d - Biphase a - AKA Conditional Dephase Encoding(CDP)",id); break;\r | |
1355 | case 17: snprintf(retStr,sizeof(buf),"%d - Reserved",id); break;\r | |
1356 | default: snprintf(retStr,sizeof(buf),"0x%02X (Unknown)",id); break;\r | |
13d77ef9 | 1357 | }\r |
1358 | return buf;\r | |
1359 | }\r | |
1360 | \r | |
1361 | char * GetModelStrFromCID(uint32_t cid){\r | |
1362 | \r | |
1363 | static char buf[10];\r | |
1364 | char *retStr = buf;\r | |
1365 | \r | |
224ce36e | 1366 | if (cid == 1) snprintf(retStr, sizeof(buf),"ATA5577M1");\r |
1367 | if (cid == 2) snprintf(retStr, sizeof(buf),"ATA5577M2"); \r | |
13d77ef9 | 1368 | return buf;\r |
1369 | }\r | |
1370 | \r | |
1371 | char * GetSelectedModulationStr( uint8_t id){\r | |
1372 | \r | |
9795e535 | 1373 | static char buf[20];\r |
13d77ef9 | 1374 | char *retStr = buf;\r |
1375 | \r | |
5490c2d6 | 1376 | switch (id) {\r |
1377 | case DEMOD_FSK: snprintf(retStr,sizeof(buf),"FSK"); break;\r | |
1378 | case DEMOD_FSK1: snprintf(retStr,sizeof(buf),"FSK1"); break;\r | |
1379 | case DEMOD_FSK1a: snprintf(retStr,sizeof(buf),"FSK1a"); break;\r | |
1380 | case DEMOD_FSK2: snprintf(retStr,sizeof(buf),"FSK2"); break;\r | |
1381 | case DEMOD_FSK2a: snprintf(retStr,sizeof(buf),"FSK2a"); break;\r | |
1382 | case DEMOD_ASK: snprintf(retStr,sizeof(buf),"ASK"); break;\r | |
1383 | case DEMOD_NRZ: snprintf(retStr,sizeof(buf),"DIRECT/NRZ"); break;\r | |
1384 | case DEMOD_PSK1: snprintf(retStr,sizeof(buf),"PSK1"); break;\r | |
1385 | case DEMOD_PSK2: snprintf(retStr,sizeof(buf),"PSK2"); break;\r | |
1386 | case DEMOD_PSK3: snprintf(retStr,sizeof(buf),"PSK3"); break;\r | |
1387 | case DEMOD_BI: snprintf(retStr,sizeof(buf),"BIPHASE"); break;\r | |
1388 | case DEMOD_BIa: snprintf(retStr,sizeof(buf),"BIPHASEa - (CDP)"); break;\r | |
1389 | default: snprintf(retStr,sizeof(buf),"(Unknown)"); break;\r | |
1390 | }\r | |
13d77ef9 | 1391 | return buf;\r |
1392 | }\r | |
1393 | \r | |
1394 | uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){\r | |
1395 | \r | |
1396 | int i = start;\r | |
1397 | int j = len-1;\r | |
1398 | \r | |
1399 | if (len > 32) return 0;\r | |
1400 | \r | |
1401 | uint32_t tmp = 0;\r | |
1402 | for (; j >= 0; --j, ++i)\r | |
1403 | tmp |= bits[i] << j;\r | |
1404 | \r | |
1405 | return tmp;\r | |
1406 | }\r | |
1407 | \r | |
66837a03 | 1408 | int CmdResetRead(const char *Cmd) {\r |
1409 | UsbCommand c = {CMD_T55XX_RESET_READ, {0,0,0}};\r | |
1410 | \r | |
1411 | clearCommandBuffer();\r | |
1412 | SendCommand(&c);\r | |
1413 | if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r | |
1414 | PrintAndLog("command execution time out");\r | |
1415 | return 0;\r | |
1416 | }\r | |
1417 | \r | |
9f669cb2 | 1418 | uint8_t got[BIGBUF_SIZE-1];\r |
babca445 | 1419 | GetFromBigBuf(got, sizeof(got), 0, NULL, -1 , 0);\r |
66837a03 | 1420 | setGraphBuf(got, sizeof(got));\r |
1421 | return 1;\r | |
1422 | }\r | |
1423 | \r | |
f6650679 | 1424 | int CmdT55xxWipe(const char *Cmd) {\r |
1425 | char writeData[20] = {0};\r | |
1426 | char *ptrData = writeData;\r | |
709665b5 | 1427 | \r |
5490c2d6 | 1428 | char cmdp = param_getchar(Cmd, 0); \r |
1429 | if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_wipe();\r | |
1430 | \r | |
1431 | bool Q5 = (cmdp == 'q' || cmdp == 'Q');\r | |
1432 | \r | |
1433 | // Try with the default password to reset block 0\r | |
1434 | // With a pwd should work even if pwd bit not set\r | |
f6650679 | 1435 | PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");\r |
709665b5 | 1436 | \r |
5490c2d6 | 1437 | if ( Q5 ){\r |
1438 | snprintf(ptrData,sizeof(writeData),"b 0 d 6001F004 p 0");\r | |
1439 | } else {\r | |
1440 | snprintf(ptrData,sizeof(writeData),"b 0 d 00088040 p 0");\r | |
1441 | }\r | |
709665b5 | 1442 | \r |
5490c2d6 | 1443 | if (!CmdT55xxWriteBlock(ptrData)) PrintAndLog("Error writing blk 0");\r |
709665b5 | 1444 | \r |
1445 | for (uint8_t blk = 1; blk<8; blk++) {\r | |
f6650679 | 1446 | snprintf(ptrData,sizeof(writeData),"b %d d 0", blk);\r |
709665b5 | 1447 | if (!CmdT55xxWriteBlock(ptrData))\r |
f6650679 | 1448 | PrintAndLog("Error writing blk %d", blk);\r |
709665b5 | 1449 | \r |
534678c3 | 1450 | memset(writeData, 0x00, sizeof(writeData));\r |
f6650679 | 1451 | }\r |
1452 | return 0;\r | |
1453 | }\r | |
1454 | \r | |
506672c4 | 1455 | int CmdT55xxBruteForce(const char *Cmd) {\r |
1456 | \r | |
1457 | // load a default pwd file.\r | |
1458 | char buf[9];\r | |
1459 | char filename[FILE_PATH_SIZE]={0};\r | |
1460 | int keycnt = 0;\r | |
dd8e4513 | 1461 | uint8_t downlink_mode = 0;\r |
735136e6 | 1462 | int ch;\r |
506672c4 | 1463 | uint8_t stKeyBlock = 20;\r |
735136e6 | 1464 | uint8_t *keyBlock = NULL, *p = NULL;\r |
506672c4 | 1465 | uint32_t start_password = 0x00000000; //start password\r |
1466 | uint32_t end_password = 0xFFFFFFFF; //end password\r | |
1467 | bool found = false;\r | |
1468 | \r | |
1469 | char cmdp = param_getchar(Cmd, 0);\r | |
1470 | if (cmdp == 'h' || cmdp == 'H') return usage_t55xx_bruteforce();\r | |
1471 | \r | |
735136e6 | 1472 | keyBlock = calloc(stKeyBlock, 6);\r |
1473 | if (keyBlock == NULL) return 1;\r | |
1474 | \r | |
506672c4 | 1475 | if (cmdp == 'i' || cmdp == 'I') {\r |
1476 | \r | |
1477 | int len = strlen(Cmd+2);\r | |
1478 | if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r | |
1479 | memcpy(filename, Cmd+2, len);\r | |
1480 | \r | |
1481 | FILE * f = fopen( filename , "r");\r | |
1482 | \r | |
1483 | if ( !f ) {\r | |
1484 | PrintAndLog("File: %s: not found or locked.", filename);\r | |
1485 | free(keyBlock);\r | |
1486 | return 1;\r | |
1487 | }\r | |
1488 | \r | |
5490c2d6 | 1489 | while( fgets(buf, sizeof(buf), f) ) {\r |
506672c4 | 1490 | if (strlen(buf) < 8 || buf[7] == '\n') continue;\r |
1491 | \r | |
1492 | while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r | |
1493 | \r | |
1494 | //The line start with # is comment, skip\r | |
1495 | if( buf[0]=='#' ) continue;\r | |
1496 | \r | |
3ded0f97 | 1497 | if (!isxdigit((unsigned char)buf[0])) {\r |
506672c4 | 1498 | PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r |
1499 | continue;\r | |
1500 | }\r | |
1501 | \r | |
1502 | buf[8] = 0;\r | |
1503 | \r | |
1504 | if ( stKeyBlock - keycnt < 2) {\r | |
1505 | p = realloc(keyBlock, 6*(stKeyBlock+=10));\r | |
1506 | if (!p) {\r | |
1507 | PrintAndLog("Cannot allocate memory for defaultKeys");\r | |
1508 | free(keyBlock);\r | |
735136e6 | 1509 | fclose(f);\r |
506672c4 | 1510 | return 2;\r |
1511 | }\r | |
1512 | keyBlock = p;\r | |
1513 | }\r | |
1514 | memset(keyBlock + 4 * keycnt, 0, 4);\r | |
1515 | num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r | |
1516 | PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r | |
1517 | keycnt++;\r | |
1518 | memset(buf, 0, sizeof(buf));\r | |
1519 | }\r | |
1520 | fclose(f);\r | |
1521 | \r | |
1522 | if (keycnt == 0) {\r | |
1523 | PrintAndLog("No keys found in file");\r | |
735136e6 | 1524 | free(keyBlock);\r |
506672c4 | 1525 | return 1;\r |
1526 | }\r | |
1527 | PrintAndLog("Loaded %d keys", keycnt);\r | |
1528 | \r | |
1529 | // loop\r | |
1530 | uint64_t testpwd = 0x00;\r | |
1531 | for (uint16_t c = 0; c < keycnt; ++c ) {\r | |
1532 | \r | |
1533 | if (ukbhit()) {\r | |
735136e6 | 1534 | ch = getchar();\r |
1535 | (void)ch;\r | |
506672c4 | 1536 | printf("\naborted via keyboard!\n");\r |
735136e6 | 1537 | free(keyBlock);\r |
506672c4 | 1538 | return 0;\r |
1539 | }\r | |
1540 | \r | |
1541 | testpwd = bytes_to_num(keyBlock + 4*c, 4);\r | |
1542 | \r | |
1543 | PrintAndLog("Testing %08X", testpwd);\r | |
1544 | \r | |
dd8e4513 | 1545 | if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,downlink_mode)) {\r |
506672c4 | 1546 | PrintAndLog("Aquireing data from device failed. Quitting");\r |
735136e6 | 1547 | free(keyBlock);\r |
506672c4 | 1548 | return 0;\r |
1549 | }\r | |
1550 | \r | |
1551 | found = tryDetectModulation();\r | |
1552 | \r | |
1553 | if ( found ) {\r | |
1554 | PrintAndLog("Found valid password: [%08X]", testpwd);\r | |
735136e6 | 1555 | free(keyBlock);\r |
506672c4 | 1556 | return 0;\r |
1557 | }\r | |
1558 | }\r | |
1559 | PrintAndLog("Password NOT found.");\r | |
735136e6 | 1560 | free(keyBlock);\r |
506672c4 | 1561 | return 0;\r |
1562 | }\r | |
1563 | \r | |
1564 | // Try to read Block 7, first :)\r | |
1565 | \r | |
1566 | // incremental pwd range search\r | |
1567 | start_password = param_get32ex(Cmd, 0, 0, 16);\r | |
1568 | end_password = param_get32ex(Cmd, 1, 0, 16);\r | |
5490c2d6 | 1569 | \r |
735136e6 | 1570 | if ( start_password >= end_password ) {\r |
1571 | free(keyBlock);\r | |
1572 | return usage_t55xx_bruteforce();\r | |
1573 | }\r | |
506672c4 | 1574 | PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r |
1575 | \r | |
1576 | uint32_t i = start_password;\r | |
1577 | \r | |
5490c2d6 | 1578 | while ((!found) && (i <= end_password)) {\r |
506672c4 | 1579 | \r |
5490c2d6 | 1580 | printf(".");\r |
1581 | fflush(stdout);\r | |
1582 | if (ukbhit()) {\r | |
735136e6 | 1583 | ch = getchar();\r |
1584 | (void)ch;\r | |
5490c2d6 | 1585 | printf("\naborted via keyboard!\n");\r |
735136e6 | 1586 | free(keyBlock);\r |
5490c2d6 | 1587 | return 0;\r |
1588 | }\r | |
506672c4 | 1589 | \r |
dd8e4513 | 1590 | if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r |
5490c2d6 | 1591 | PrintAndLog("Aquireing data from device failed. Quitting");\r |
735136e6 | 1592 | free(keyBlock);\r |
5490c2d6 | 1593 | return 0;\r |
1594 | }\r | |
1595 | found = tryDetectModulation();\r | |
1596 | \r | |
1597 | if (found) break;\r | |
1598 | i++;\r | |
506672c4 | 1599 | }\r |
1600 | \r | |
1601 | PrintAndLog("");\r | |
1602 | \r | |
1603 | if (found)\r | |
5490c2d6 | 1604 | PrintAndLog("Found valid password: [%08x]", i);\r |
506672c4 | 1605 | else\r |
5490c2d6 | 1606 | PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r |
735136e6 | 1607 | \r |
1608 | free(keyBlock);\r | |
506672c4 | 1609 | return 0;\r |
1610 | }\r | |
1611 | \r | |
dd8e4513 | 1612 | int CmdT55xxBruteForce_downlink(const char *Cmd) {\r |
1613 | \r | |
1614 | // load a default pwd file.\r | |
1615 | char buf[9];\r | |
1616 | char filename[FILE_PATH_SIZE]={0};\r | |
1617 | int keycnt = 0;\r | |
1618 | uint8_t downlink_mode = 0;\r | |
1619 | int ch;\r | |
1620 | uint8_t stKeyBlock = 20;\r | |
1621 | uint8_t *keyBlock = NULL, *p = NULL;\r | |
1622 | uint32_t start_password = 0x00000000; //start password\r | |
1623 | uint32_t end_password = 0xFFFFFFFF; //end password\r | |
1624 | bool found = false;\r | |
1625 | uint8_t cmdp = 0;\r | |
1626 | int cmd_offset = 0;\r | |
1627 | int errors = 0;\r | |
1628 | int len;\r | |
1629 | bool use_file = false;\r | |
1630 | bool use_range = false;\r | |
1631 | bool try_all_dl_modes = false;\r | |
1632 | uint8_t dl_mode = 0;\r | |
1633 | \r | |
1634 | keyBlock = calloc(stKeyBlock, 6);\r | |
1635 | if (keyBlock == NULL) return 1;\r | |
1636 | \r | |
1637 | PrintAndLog("New Downlink Supprt");\r | |
1638 | \r | |
1639 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r | |
1640 | switch(param_getchar(Cmd, cmdp)) {\r | |
1641 | case 'h':\r | |
1642 | case 'H':\r | |
1643 | return usage_t55xx_bruteforce_downlink();\r | |
1644 | case 'e':\r | |
1645 | case 'E':\r | |
1646 | downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r | |
1647 | if (downlink_mode == 4) try_all_dl_modes = true;\r | |
1648 | if (downlink_mode > 3) downlink_mode = 0;\r | |
1649 | cmdp +=2;\r | |
1650 | cmd_offset += 4;\r | |
1651 | PrintAndLog ("DL Mode : %d",downlink_mode);\r | |
1652 | break;\r | |
1653 | case 'i':\r | |
1654 | case 'I':\r | |
1655 | if (use_range) {\r | |
1656 | PrintAndLog ("use Range or File");\r | |
1657 | return 0;\r | |
1658 | }\r | |
1659 | use_file = true;\r | |
1660 | len = strlen(Cmd+2);\r | |
1661 | if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r | |
1662 | memcpy(filename, Cmd+cmd_offset+2, len);\r | |
1663 | cmdp += 2;\r | |
1664 | // PrintAndLog (" File : [%s]",filename);\r | |
1665 | break;\r | |
1666 | case 'r':\r | |
1667 | case 'R':\r | |
1668 | if (use_file) {\r | |
1669 | PrintAndLog ("use Range or File");\r | |
1670 | return 0;\r | |
1671 | }\r | |
1672 | use_range = true; // = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
1673 | start_password = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
1674 | end_password = param_get32ex(Cmd, cmdp+2, 0, 16);\r | |
1675 | cmdp += 3;\r | |
1676 | cmd_offset += 20; // 8 + 8 + 1 + 1 + 1\r | |
1677 | // PrintAndLog (" Range : [%0X] - [%0X]",start_password,end_password);\r | |
1678 | break;\r | |
1679 | default:\r | |
1680 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
1681 | errors = true;\r | |
1682 | break;\r | |
1683 | }\r | |
1684 | }\r | |
1685 | \r | |
1686 | \r | |
1687 | // if (cmdp == 'i' || cmdp == 'I') {\r | |
1688 | \r | |
1689 | if (use_file)\r | |
1690 | {\r | |
1691 | FILE * f = fopen( filename , "r");\r | |
1692 | \r | |
1693 | if ( !f ) {\r | |
1694 | PrintAndLog("File: %s: not found or locked.", filename);\r | |
1695 | free(keyBlock);\r | |
1696 | return 1;\r | |
1697 | }\r | |
1698 | \r | |
1699 | while( fgets(buf, sizeof(buf), f) ) {\r | |
1700 | if (strlen(buf) < 8 || buf[7] == '\n') continue;\r | |
1701 | \r | |
1702 | while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r | |
1703 | \r | |
1704 | //The line start with # is comment, skip\r | |
1705 | if( buf[0]=='#' ) continue;\r | |
1706 | \r | |
1707 | if (!isxdigit((unsigned char)buf[0])) {\r | |
1708 | PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r | |
1709 | continue;\r | |
1710 | }\r | |
1711 | \r | |
1712 | buf[8] = 0;\r | |
1713 | \r | |
1714 | if ( stKeyBlock - keycnt < 2) {\r | |
1715 | p = realloc(keyBlock, 6*(stKeyBlock+=10));\r | |
1716 | if (!p) {\r | |
1717 | PrintAndLog("Cannot allocate memory for defaultKeys");\r | |
1718 | free(keyBlock);\r | |
1719 | fclose(f);\r | |
1720 | return 2;\r | |
1721 | }\r | |
1722 | keyBlock = p;\r | |
1723 | }\r | |
1724 | memset(keyBlock + 4 * keycnt, 0, 4);\r | |
1725 | num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r | |
1726 | PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r | |
1727 | keycnt++;\r | |
1728 | memset(buf, 0, sizeof(buf));\r | |
1729 | }\r | |
1730 | fclose(f);\r | |
1731 | \r | |
1732 | if (keycnt == 0) {\r | |
1733 | PrintAndLog("No keys found in file");\r | |
1734 | free(keyBlock);\r | |
1735 | return 1;\r | |
1736 | }\r | |
1737 | PrintAndLog("Loaded %d keys", keycnt);\r | |
1738 | \r | |
1739 | // loop\r | |
1740 | uint64_t testpwd = 0x00;\r | |
1741 | for (uint16_t c = 0; c < keycnt; ++c ) {\r | |
1742 | \r | |
1743 | if (ukbhit()) {\r | |
1744 | ch = getchar();\r | |
1745 | (void)ch;\r | |
1746 | printf("\naborted via keyboard!\n");\r | |
1747 | free(keyBlock);\r | |
1748 | return 0;\r | |
1749 | }\r | |
1750 | \r | |
1751 | testpwd = bytes_to_num(keyBlock + 4*c, 4);\r | |
1752 | \r | |
1753 | PrintAndLog("Testing %08X", testpwd);\r | |
1754 | \r | |
1755 | // Try each downlink_mode of asked to \r | |
1756 | // donwlink_mode will = 0 if > 3 or set to 0, so loop from 0 - 3\r | |
1757 | for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++)\r | |
1758 | {\r | |
1759 | if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,dl_mode)) {\r | |
1760 | PrintAndLog("Aquireing data from device failed. Quitting");\r | |
1761 | free(keyBlock);\r | |
1762 | return 0;\r | |
1763 | }\r | |
1764 | \r | |
1765 | found = tryDetectModulation();\r | |
1766 | \r | |
1767 | if ( found ) {\r | |
1768 | PrintAndLog("Found valid password: [%08X]", testpwd);\r | |
1769 | free(keyBlock);\r | |
1770 | // Add downlink mode to reference.\r | |
1771 | switch (dl_mode) {\r | |
1772 | case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r | |
1773 | case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r | |
1774 | case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r | |
1775 | case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r | |
1776 | }\r | |
1777 | return 0;\r | |
1778 | }\r | |
1779 | if (!try_all_dl_modes) // Exit loop\r | |
1780 | dl_mode = 4;\r | |
1781 | }\r | |
1782 | }\r | |
1783 | PrintAndLog("Password NOT found.");\r | |
1784 | free(keyBlock);\r | |
1785 | return 0;\r | |
1786 | }\r | |
1787 | \r | |
1788 | if (use_range)\r | |
1789 | {\r | |
1790 | // incremental pwd range search\r | |
1791 | // start_password = param_get32ex(Cmd, 0, 0, 16);\r | |
1792 | // end_password = param_get32ex(Cmd, 1, 0, 16);\r | |
1793 | \r | |
1794 | if ( start_password >= end_password ) {\r | |
1795 | free(keyBlock);\r | |
1796 | return usage_t55xx_bruteforce_downlink();\r | |
1797 | }\r | |
1798 | PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r | |
1799 | \r | |
1800 | uint32_t i = start_password;\r | |
1801 | \r | |
1802 | while ((!found) && (i <= end_password)) {\r | |
1803 | \r | |
1804 | printf(".");\r | |
1805 | fflush(stdout);\r | |
1806 | if (ukbhit()) {\r | |
1807 | ch = getchar();\r | |
1808 | (void)ch;\r | |
1809 | printf("\naborted via keyboard!\n");\r | |
1810 | free(keyBlock);\r | |
1811 | return 0;\r | |
1812 | }\r | |
1813 | \r | |
1814 | if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r | |
1815 | PrintAndLog("Aquireing data from device failed. Quitting");\r | |
1816 | free(keyBlock);\r | |
1817 | return 0;\r | |
1818 | }\r | |
1819 | found = tryDetectModulation();\r | |
1820 | \r | |
1821 | if (found) break;\r | |
1822 | i++;\r | |
1823 | }\r | |
1824 | \r | |
1825 | PrintAndLog("");\r | |
1826 | \r | |
1827 | if (found) {\r | |
1828 | PrintAndLog("Found valid password: [%08x]", i);\r | |
1829 | // Add downlink mode to reference.\r | |
1830 | switch (downlink_mode) {\r | |
1831 | case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r | |
1832 | case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r | |
1833 | case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r | |
1834 | case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r | |
1835 | }\r | |
1836 | }\r | |
1837 | else\r | |
1838 | PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r | |
1839 | \r | |
1840 | free(keyBlock);\r | |
1841 | }\r | |
1842 | return 0;\r | |
1843 | }\r | |
1844 | \r | |
b97311b1 | 1845 | // note length of data returned is different for different chips. \r |
1846 | // some return all page 1 (64 bits) and others return just that block (32 bits) \r | |
1847 | // unfortunately the 64 bits makes this more likely to get a false positive...\r | |
1848 | bool tryDetectP1(bool getData) {\r | |
1849 | uint8_t preamble[] = {1,1,1,0,0,0,0,0,0,0,0,1,0,1,0,1};\r | |
1850 | size_t startIdx = 0;\r | |
1851 | uint8_t fc1 = 0, fc2 = 0, ans = 0;\r | |
bb4e6dbd | 1852 | int clk = 0, firstClockEdge = 0;\r |
b97311b1 | 1853 | bool st = true;\r |
1854 | \r | |
1855 | if ( getData ) {\r | |
dd8e4513 | 1856 | if ( !AquireData(T55x7_PAGE1, 1, false, 0,0) )\r |
b97311b1 | 1857 | return false;\r |
1858 | }\r | |
1859 | \r | |
1860 | // try fsk clock detect. if successful it cannot be any other type of modulation... (in theory...)\r | |
bb4e6dbd | 1861 | ans = fskClocks(&fc1, &fc2, (uint8_t *)&clk, false, &firstClockEdge);\r |
b97311b1 | 1862 | if (ans && ((fc1==10 && fc2==8) || (fc1==8 && fc2==5))) {\r |
1863 | if ( FSKrawDemod("0 0", false) && \r | |
1864 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1865 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1866 | return true;\r | |
1867 | }\r | |
1868 | if ( FSKrawDemod("0 1", false) && \r | |
1869 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1870 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1871 | return true;\r | |
1872 | }\r | |
1873 | return false;\r | |
1874 | }\r | |
1875 | \r | |
1876 | // try psk clock detect. if successful it cannot be any other type of modulation... (in theory...)\r | |
1877 | clk = GetPskClock("", false, false);\r | |
1878 | if (clk>0) {\r | |
1879 | // allow undo\r | |
1880 | // save_restoreGB(1);\r | |
1881 | // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r | |
1882 | //CmdLtrim("160");\r | |
1883 | if ( PSKDemod("0 0 6", false) &&\r | |
1884 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1885 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1886 | //save_restoreGB(0);\r | |
1887 | return true;\r | |
1888 | }\r | |
1889 | if ( PSKDemod("0 1 6", false) &&\r | |
1890 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1891 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1892 | //save_restoreGB(0);\r | |
1893 | return true;\r | |
1894 | }\r | |
1895 | // PSK2 - needs a call to psk1TOpsk2.\r | |
1896 | if ( PSKDemod("0 0 6", false)) {\r | |
1897 | psk1TOpsk2(DemodBuffer, DemodBufferLen);\r | |
1898 | if (preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1899 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1900 | //save_restoreGB(0);\r | |
1901 | return true;\r | |
1902 | }\r | |
1903 | } // inverse waves does not affect PSK2 demod\r | |
1904 | //undo trim samples\r | |
1905 | //save_restoreGB(0); \r | |
1906 | // no other modulation clocks = 2 or 4 so quit searching\r | |
1907 | if (fc1 != 8) return false;\r | |
1908 | }\r | |
1909 | \r | |
1910 | // try ask clock detect. it could be another type even if successful.\r | |
1911 | clk = GetAskClock("", false, false);\r | |
1912 | if (clk>0) {\r | |
1913 | if ( ASKDemod_ext("0 0 1", false, false, 1, &st) &&\r | |
1914 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1915 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1916 | return true;\r | |
1917 | }\r | |
1918 | st = true;\r | |
1919 | if ( ASKDemod_ext("0 1 1", false, false, 1, &st) &&\r | |
1920 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1921 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1922 | return true;\r | |
1923 | }\r | |
1924 | if ( ASKbiphaseDemod("0 0 0 2", false) &&\r | |
1925 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1926 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1927 | return true;\r | |
1928 | }\r | |
1929 | if ( ASKbiphaseDemod("0 0 1 2", false) &&\r | |
1930 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1931 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1932 | return true;\r | |
1933 | }\r | |
1934 | }\r | |
1935 | \r | |
1936 | // try NRZ clock detect. it could be another type even if successful.\r | |
1937 | clk = GetNrzClock("", false, false); //has the most false positives :(\r | |
1938 | if (clk>0) {\r | |
1939 | if ( NRZrawDemod("0 0 1", false) &&\r | |
1940 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1941 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1942 | return true;\r | |
1943 | }\r | |
1944 | if ( NRZrawDemod("0 1 1", false) &&\r | |
1945 | preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r | |
1946 | (DemodBufferLen == 32 || DemodBufferLen == 64) ) {\r | |
1947 | return true;\r | |
1948 | }\r | |
1949 | }\r | |
1950 | return false;\r | |
1951 | }\r | |
1952 | // does this need to be a callable command?\r | |
1953 | int CmdT55xxDetectPage1(const char *Cmd){\r | |
1954 | bool errors = false;\r | |
1955 | bool useGB = false;\r | |
1956 | bool usepwd = false;\r | |
1957 | uint32_t password = 0;\r | |
1958 | uint8_t cmdp = 0;\r | |
1959 | \r | |
1960 | while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r | |
1961 | switch(param_getchar(Cmd, cmdp)) {\r | |
1962 | case 'h':\r | |
1963 | case 'H':\r | |
1964 | return usage_t55xx_detectP1();\r | |
1965 | case 'p':\r | |
1966 | case 'P':\r | |
1967 | password = param_get32ex(Cmd, cmdp+1, 0, 16);\r | |
1968 | usepwd = true;\r | |
1969 | cmdp += 2;\r | |
1970 | break;\r | |
1971 | case '1':\r | |
1972 | // use Graphbuffer data\r | |
1973 | useGB = true;\r | |
1974 | cmdp++;\r | |
1975 | break;\r | |
1976 | default:\r | |
1977 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r | |
1978 | errors = true;\r | |
1979 | break;\r | |
1980 | }\r | |
1981 | }\r | |
1982 | if (errors) return usage_t55xx_detectP1();\r | |
1983 | \r | |
1984 | if ( !useGB ) {\r | |
dd8e4513 | 1985 | if ( !AquireData(T55x7_PAGE1, 1, usepwd, password,0) )\r |
b97311b1 | 1986 | return false;\r |
1987 | }\r | |
1988 | bool success = tryDetectP1(false);\r | |
1989 | if (success) PrintAndLog("T55xx chip found!");\r | |
1990 | return success;\r | |
1991 | }\r | |
1992 | \r | |
709665b5 | 1993 | static command_t CommandTable[] = {\r |
506672c4 | 1994 | {"help", CmdHelp, 1, "This help"},\r |
dd8e4513 | 1995 | {"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},\r |
1996 | {"bruteforcedl",CmdT55xxBruteForce_downlink,0, "r <start password> <end password> [i <*.dic>] [e <downlink>] Simple bruteforce attack to find password"},\r | |
506672c4 | 1997 | {"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},\r |
1998 | {"detect", CmdT55xxDetect, 1, "[1] Try detecting the tag modulation from reading the configuration block."},\r | |
b97311b1 | 1999 | {"p1detect", CmdT55xxDetectPage1,1, "[1] Try detecting if this is a t55xx tag by reading page 1"},\r |
506672c4 | 2000 | {"read", CmdT55xxReadBlock, 0, "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},\r |
2001 | {"resetread", CmdResetRead, 0, "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},\r | |
2002 | {"write", CmdT55xxWriteBlock,0, "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},\r | |
2003 | {"trace", CmdT55xxReadTrace, 1, "[1] Show T55x7 traceability data (page 1/ blk 0-1)"},\r | |
2004 | {"info", CmdT55xxInfo, 1, "[1] Show T55x7 configuration data (page 0/ blk 0)"},\r | |
2005 | {"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},\r | |
2006 | {"special", special, 0, "Show block changes with 64 different offsets"},\r | |
2007 | {"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},\r | |
5490c2d6 | 2008 | {"wipe", CmdT55xxWipe, 0, "[q] Wipe a T55xx tag and set defaults (will destroy any data on tag)"},\r |
54a942b0 | 2009 | {NULL, NULL, 0, NULL}\r |
2010 | };\r | |
2011 | \r | |
709665b5 | 2012 | int CmdLFT55XX(const char *Cmd) {\r |
54a942b0 | 2013 | CmdsParse(CommandTable, Cmd);\r |
2014 | return 0;\r | |
2015 | }\r | |
2016 | \r | |
709665b5 | 2017 | int CmdHelp(const char *Cmd) {\r |
54a942b0 | 2018 | CmdsHelp(CommandTable);\r |
2019 | return 0;\r | |
2020 | }\r |