git.zerfleddert.de Git - proxmark3-svn/blame_incremental

... / ...

Commit	Line	Data
	1	//-----------------------------------------------------------------------------\r
	2	//\r
	3	// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
	4	// at your option, any later version. See the LICENSE.txt file for the text of\r
	5	// the license.\r
	6	//-----------------------------------------------------------------------------\r
	7	// Low frequency T55xx commands\r
	8	//-----------------------------------------------------------------------------\r
	9	\r
	10	#include "cmdlft55xx.h"\r
	11	\r
	12	#include <stdio.h>\r
	13	#include <string.h>\r
	14	#include <inttypes.h>\r
	15	#include <ctype.h>\r
	16	#include <time.h>\r
	17	#include "comms.h"\r
	18	#include "ui.h"\r
	19	#include "graph.h"\r
	20	#include "cmdmain.h"\r
	21	#include "cmdparser.h"\r
	22	#include "cmddata.h"\r
	23	#include "cmdlf.h"\r
	24	#include "util.h"\r
	25	#include "lfdemod.h"\r
	26	#include "protocols.h"\r
	27	#include "taginfo.h"\r
	28	\r
	29	#define T55x7_CONFIGURATION_BLOCK 0x00\r
	30	#define T55x7_PAGE0 0x00\r
	31	#define T55x7_PAGE1 0x01\r
	32	//#define T55x7_PWD 0x00000010\r
	33	#define REGULAR_READ_MODE_BLOCK 0xFF\r
	34	\r
	35	// Default configuration\r
	36	t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = false, .offset = 0x00, .block0 = 0x00, .Q5 = false };\r
	37	\r
	38	t55xx_conf_block_t Get_t55xx_Config(){\r
	39	return config;\r
	40	}\r
	41	void Set_t55xx_Config(t55xx_conf_block_t conf){\r
	42	config = conf;\r
	43	}\r
	44	\r
	45	int usage_t55xx_config(){\r
	46	PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");\r
	47	PrintAndLog("Options:");\r
	48	PrintAndLog(" h This help");\r
	49	PrintAndLog(" b <8\|16\|32\|40\|50\|64\|100\|128> Set bitrate");\r
	50	PrintAndLog(" d <FSK\|FSK1\|FSK1a\|FSK2\|FSK2a\|ASK\|PSK1\|PSK2\|NRZ\|BI\|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");\r
	51	PrintAndLog(" i [1] Invert data signal, defaults to normal");\r
	52	PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");\r
	53	PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");\r
	54	PrintAndLog(" ST Set Sequence Terminator on");\r
	55	PrintAndLog("");\r
	56	PrintAndLog("Examples:");\r
	57	PrintAndLog(" lf t55xx config d FSK - FSK demodulation");\r
	58	PrintAndLog(" lf t55xx config d FSK i 1 - FSK demodulation, inverse data");\r
	59	PrintAndLog(" lf t55xx config d FSK i 1 o 3 - FSK demodulation, inverse data, offset=3,start from position 3 to decode data");\r
	60	PrintAndLog("");\r
	61	return 0;\r
	62	}\r
	63	int usage_t55xx_read(){\r
	64	PrintAndLog("Usage: lf t55xx read [b <block>] [p <password>] <override_safety> <page1>");\r
	65	PrintAndLog("Options:");\r
	66	PrintAndLog(" b <block> - block number to read. Between 0-7");\r
	67	PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r
	68	PrintAndLog(" o - OPTIONAL override safety check");\r
	69	PrintAndLog(" 1 - OPTIONAL read Page 1 instead of Page 0");\r
	70	PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
	71	PrintAndLog(" '2' leading zero, '3' 1 of 4 coding reference"); \r
	72	PrintAndLog(" **WARNING**");\r
	73	PrintAndLog(" Use of read with password on a tag not configured for a pwd");\r
	74	PrintAndLog(" can damage the tag");\r
	75	PrintAndLog("");\r
	76	PrintAndLog("Examples:");\r
	77	PrintAndLog(" lf t55xx read b 0 - read data from block 0");\r
	78	PrintAndLog(" lf t55xx read b 0 p feedbeef - read data from block 0 password feedbeef");\r
	79	PrintAndLog(" lf t55xx read b 0 p feedbeef o - read data from block 0 password feedbeef safety check");\r
	80	PrintAndLog("");\r
	81	return 0;\r
	82	}\r
	83	int usage_t55xx_write(){\r
	84	PrintAndLog("Usage: lf t55xx write [b <block>] [d <data>] [p <password>] [1] [t]");\r
	85	PrintAndLog("Options:");\r
	86	PrintAndLog(" b <block> - block number to write. Between 0-7");\r
	87	PrintAndLog(" d <data> - 4 bytes of data to write (8 hex characters)");\r
	88	PrintAndLog(" p <password> - OPTIONAL password 4bytes (8 hex characters)");\r
	89	PrintAndLog(" 1 - OPTIONAL write Page 1 instead of Page 0");\r
	90	PrintAndLog(" t - OPTIONAL test mode write - **DANGER**"); \r
	91	PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
	92	PrintAndLog(" '2' leading zero, '3' 1 of 4 coding reference"); \r
	93	PrintAndLog("");\r
	94	PrintAndLog("Examples:");\r
	95	PrintAndLog(" lf t55xx write b 3 d 11223344 - write 11223344 to block 3");\r
	96	PrintAndLog(" lf t55xx write b 3 d 11223344 p feedbeef - write 11223344 to block 3 password feedbeef");\r
	97	PrintAndLog("");\r
	98	return 0;\r
	99	}\r
	100	int usage_t55xx_trace() {\r
	101	PrintAndLog("Usage: lf t55xx trace [1]");\r
	102	PrintAndLog("Options:");\r
	103	PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");\r
	104	PrintAndLog("");\r
	105	PrintAndLog("Examples:");\r
	106	PrintAndLog(" lf t55xx trace");\r
	107	PrintAndLog(" lf t55xx trace 1");\r
	108	PrintAndLog("");\r
	109	return 0;\r
	110	}\r
	111	int usage_t55xx_info() {\r
	112	PrintAndLog("Usage: lf t55xx info [1]");\r
	113	PrintAndLog("Options:");\r
	114	PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");\r
	115	PrintAndLog("");\r
	116	PrintAndLog("Examples:");\r
	117	PrintAndLog(" lf t55xx info");\r
	118	PrintAndLog(" lf t55xx info 1");\r
	119	PrintAndLog("");\r
	120	return 0;\r
	121	}\r
	122	int usage_t55xx_dump(){\r
	123	PrintAndLog("Usage: lf t55xx dump <password> [o]");\r
	124	PrintAndLog("Options:");\r
	125	PrintAndLog(" <password> - OPTIONAL password 4bytes (8 hex symbols)");\r
	126	PrintAndLog(" o - OPTIONAL override, force pwd read despite danger to card");\r
	127	PrintAndLog("");\r
	128	PrintAndLog("Examples:");\r
	129	PrintAndLog(" lf t55xx dump");\r
	130	PrintAndLog(" lf t55xx dump feedbeef o");\r
	131	PrintAndLog("");\r
	132	return 0;\r
	133	}\r
	134	int usage_t55xx_detect(){\r
	135	PrintAndLog("Usage: lf t55xx detect [1] [p <password>]");\r
	136	PrintAndLog("Options:");\r
	137	PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");\r
	138	PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r
	139	PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
	140	PrintAndLog(" '2' leading zero, '3' 1 of 4 coding reference"); \r
	141	PrintAndLog("");\r
	142	PrintAndLog("Examples:");\r
	143	PrintAndLog(" lf t55xx detect");\r
	144	PrintAndLog(" lf t55xx detect 1");\r
	145	PrintAndLog(" lf t55xx detect p 11223344");\r
	146	PrintAndLog("");\r
	147	return 0;\r
	148	}\r
	149	int usage_t55xx_detectP1(){\r
	150	PrintAndLog("Command: Detect Page 1 of a t55xx chip");\r
	151	PrintAndLog("Usage: lf t55xx p1detect [1] [p <password>]");\r
	152	PrintAndLog("Options:");\r
	153	PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");\r
	154	PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r
	155	PrintAndLog("");\r
	156	PrintAndLog("Examples:");\r
	157	PrintAndLog(" lf t55xx p1detect");\r
	158	PrintAndLog(" lf t55xx p1detect 1");\r
	159	PrintAndLog(" lf t55xx p1detect p 11223344");\r
	160	PrintAndLog("");\r
	161	return 0;\r
	162	}\r
	163	int usage_t55xx_wakup(){\r
	164	PrintAndLog("Usage: lf t55xx wakeup [h] <password>");\r
	165	PrintAndLog("This commands send the Answer-On-Request command and leaves the readerfield ON afterwards.");\r
	166	PrintAndLog("Options:");\r
	167	PrintAndLog(" h - this help");\r
	168	PrintAndLog(" <password> - [required] password 4bytes (8 hex symbols)");\r
	169	PrintAndLog("");\r
	170	PrintAndLog("Examples:");\r
	171	PrintAndLog(" lf t55xx wakeup 11223344 - send wakeup password");\r
	172	return 0;\r
	173	}\r
	174	int usage_t55xx_bruteforce(){\r
	175	PrintAndLog("This command uses A) bruteforce to scan a number range");\r
	176	PrintAndLog(" B) a dictionary attack");\r
	177	PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r
	178	PrintAndLog(" password must be 4 bytes (8 hex symbols)");\r
	179	PrintAndLog("Options:");\r
	180	PrintAndLog(" h - this help");\r
	181	PrintAndLog(" <start_pwd> - 4 byte hex value to start pwd search at");\r
	182	PrintAndLog(" <end_pwd> - 4 byte hex value to end pwd search at");\r
	183	PrintAndLog(" i <.dic> - loads a default keys dictionary file <.dic>");\r
	184	PrintAndLog("");\r
	185	PrintAndLog("Examples:");\r
	186	PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r
	187	PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");\r
	188	PrintAndLog("");\r
	189	return 0;\r
	190	}\r
	191	int usage_t55xx_bruteforce_downlink(){\r
	192	PrintAndLog("This command uses A) bruteforce to scan a number range");\r
	193	PrintAndLog(" B) a dictionary attack");\r
	194	PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r
	195	PrintAndLog(" password must be 4 bytes (8 hex symbols)");\r
	196	PrintAndLog("Options:");\r
	197	PrintAndLog(" h - this help");\r
	198	PrintAndLog(" r <start_pwd> <end_pwd> - 4 byte hex value to start and end pwd search at");\r
	199	PrintAndLog(" i <.dic> - loads a default keys dictionary file <.dic>");\r
	200	PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed bit length (default)"); \r
	201	PrintAndLog(" '1' long leading reference, '2' leading zero ");\r
	202	PrintAndLog(" '3' 1 of 4 coding reference, '4' special - try all downlink modes");\r
	203	PrintAndLog("");\r
	204	PrintAndLog("Examples:");\r
	205	PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r
	206	PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");\r
	207	PrintAndLog("");\r
	208	return 0;\r
	209	}\r
	210	int usage_t55xx_wipe(){\r
	211	PrintAndLog("Usage: lf t55xx wipe [h] [Q5]");\r
	212	PrintAndLog("This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block");\r
	213	PrintAndLog("Options:");\r
	214	PrintAndLog(" h - this help");\r
	215	PrintAndLog(" Q5 - indicates to use the T5555 (Q5) default configuration block");\r
	216	PrintAndLog("");\r
	217	PrintAndLog("Examples:");\r
	218	PrintAndLog(" lf t55xx wipe - wipes a t55x7 tag, config block 0x000880E0");\r
	219	PrintAndLog(" lf t55xx wipe Q5 - wipes a t5555 Q5 tag, config block 0x6001F004");\r
	220	return 0;\r
	221	}\r
	222	\r
	223	\r
	224	static int CmdHelp(const char *Cmd);\r
	225	\r
	226	void printT5xxHeader(uint8_t page){\r
	227	PrintAndLog("Reading Page %d:", page);\r
	228	PrintAndLog("blk \| hex data \| binary");\r
	229	PrintAndLog("----+----------+---------------------------------"); \r
	230	}\r
	231	\r
	232	int CmdT55xxSetConfig(const char *Cmd) {\r
	233	\r
	234	uint8_t offset = 0;\r
	235	char modulation[6] = {0x00};\r
	236	char tmp = 0x00;\r
	237	uint8_t bitRate = 0;\r
	238	uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};\r
	239	uint8_t cmdp = 0;\r
	240	bool errors = false;\r
	241	while(param_getchar(Cmd, cmdp) != 0x00 && !errors)\r
	242	{\r
	243	tmp = param_getchar(Cmd, cmdp);\r
	244	switch(tmp)\r
	245	{\r
	246	case 'h':\r
	247	case 'H':\r
	248	return usage_t55xx_config();\r
	249	case 'b':\r
	250	errors \|= param_getdec(Cmd, cmdp+1, &bitRate);\r
	251	if ( !errors){\r
	252	uint8_t i = 0;\r
	253	for (; i < 9; i++){\r
	254	if (rates[i]==bitRate) {\r
	255	config.bitrate = i;\r
	256	break;\r
	257	}\r
	258	}\r
	259	if (i==9) errors = true;\r
	260	}\r
	261	cmdp+=2;\r
	262	break;\r
	263	case 'd':\r
	264	param_getstr(Cmd, cmdp+1, modulation, sizeof(modulation));\r
	265	cmdp += 2;\r
	266	\r
	267	if ( strcmp(modulation, "FSK" ) == 0) {\r
	268	config.modulation = DEMOD_FSK;\r
	269	} else if ( strcmp(modulation, "FSK1" ) == 0) {\r
	270	config.modulation = DEMOD_FSK1;\r
	271	config.inverted=1;\r
	272	} else if ( strcmp(modulation, "FSK1a" ) == 0) {\r
	273	config.modulation = DEMOD_FSK1a;\r
	274	config.inverted=0;\r
	275	} else if ( strcmp(modulation, "FSK2" ) == 0) {\r
	276	config.modulation = DEMOD_FSK2;\r
	277	config.inverted=0;\r
	278	} else if ( strcmp(modulation, "FSK2a" ) == 0) {\r
	279	config.modulation = DEMOD_FSK2a;\r
	280	config.inverted=1;\r
	281	} else if ( strcmp(modulation, "ASK" ) == 0) {\r
	282	config.modulation = DEMOD_ASK;\r
	283	} else if ( strcmp(modulation, "NRZ" ) == 0) {\r
	284	config.modulation = DEMOD_NRZ;\r
	285	} else if ( strcmp(modulation, "PSK1" ) == 0) {\r
	286	config.modulation = DEMOD_PSK1;\r
	287	} else if ( strcmp(modulation, "PSK2" ) == 0) {\r
	288	config.modulation = DEMOD_PSK2;\r
	289	} else if ( strcmp(modulation, "PSK3" ) == 0) {\r
	290	config.modulation = DEMOD_PSK3;\r
	291	} else if ( strcmp(modulation, "BIa" ) == 0) {\r
	292	config.modulation = DEMOD_BIa;\r
	293	config.inverted=1;\r
	294	} else if ( strcmp(modulation, "BI" ) == 0) {\r
	295	config.modulation = DEMOD_BI;\r
	296	config.inverted=0;\r
	297	} else {\r
	298	PrintAndLog("Unknown modulation '%s'", modulation);\r
	299	errors = true;\r
	300	}\r
	301	break;\r
	302	case 'i':\r
	303	config.inverted = param_getchar(Cmd,cmdp+1) == '1';\r
	304	cmdp+=2;\r
	305	break;\r
	306	case 'o':\r
	307	errors \|= param_getdec(Cmd, cmdp+1, &offset);\r
	308	if ( !errors )\r
	309	config.offset = offset;\r
	310	cmdp+=2;\r
	311	break;\r
	312	case 'Q':\r
	313	case 'q': \r
	314	config.Q5 = true;\r
	315	cmdp++;\r
	316	break;\r
	317	case 'S':\r
	318	case 's': \r
	319	config.ST = true;\r
	320	cmdp++;\r
	321	break;\r
	322	default:\r
	323	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	324	errors = true;\r
	325	break;\r
	326	}\r
	327	}\r
	328	\r
	329	// No args\r
	330	if (cmdp == 0) return printConfiguration( config );\r
	331	\r
	332	//Validations\r
	333	if (errors) return usage_t55xx_config();\r
	334	\r
	335	config.block0 = 0;\r
	336	return printConfiguration ( config );\r
	337	}\r
	338	\r
	339	int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32_t password, uint8_t downlink_mode){\r
	340	//Password mode\r
	341	if ( usepwd ) {\r
	342	// try reading the config block and verify that PWD bit is set before doing this!\r
	343	if ( !override ) {\r
	344	if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0,downlink_mode ) ) return 0;\r
	345	if ( !tryDetectModulation() ) {\r
	346	PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");\r
	347	return 0;\r
	348	} else {\r
	349	PrintAndLog("Safety Check: PWD bit is NOT set in config block. Reading without password..."); \r
	350	usepwd = false;\r
	351	page1 = false;\r
	352	}\r
	353	} else {\r
	354	PrintAndLog("Safety Check Overriden - proceeding despite risk");\r
	355	}\r
	356	}\r
	357	\r
	358	if (!AquireData(page1, block, usepwd, password,downlink_mode) ) return 0;\r
	359	if (!DecodeT55xxBlock()) return 0;\r
	360	\r
	361	char blk[10]={0};\r
	362	sprintf(blk,"%d", block);\r
	363	printT55xxBlock(blk); \r
	364	return 1;\r
	365	}\r
	366	\r
	367	int CmdT55xxReadBlock(const char *Cmd) {\r
	368	uint8_t block = REGULAR_READ_MODE_BLOCK;\r
	369	uint32_t password = 0; //default to blank Block 7\r
	370	uint8_t downlink_mode = 0;\r
	371	\r
	372	bool usepwd = false;\r
	373	bool override = false;\r
	374	bool page1 = false;\r
	375	bool errors = false;\r
	376	uint8_t cmdp = 0;\r
	377	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	378	switch(param_getchar(Cmd, cmdp)) {\r
	379	case 'h':\r
	380	case 'H':\r
	381	return usage_t55xx_read();\r
	382	case 'b':\r
	383	case 'B':\r
	384	errors \|= param_getdec(Cmd, cmdp+1, &block);\r
	385	cmdp += 2;\r
	386	break;\r
	387	case 'o':\r
	388	case 'O':\r
	389	override = true;\r
	390	cmdp++;\r
	391	break;\r
	392	case 'p':\r
	393	case 'P':\r
	394	password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	395	usepwd = true;\r
	396	cmdp += 2;\r
	397	break;\r
	398	case '1':\r
	399	page1 = true;\r
	400	cmdp++;\r
	401	break;\r
	402	case 'e':\r
	403	case 'E':\r
	404	downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
	405	if (downlink_mode > 3) downlink_mode = 0;\r
	406	cmdp +=2;\r
	407	break;\r
	408	default:\r
	409	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	410	errors = true;\r
	411	break;\r
	412	}\r
	413	}\r
	414	if (errors) return usage_t55xx_read();\r
	415	\r
	416	if (block > 7 && block != REGULAR_READ_MODE_BLOCK ) {\r
	417	PrintAndLog("Block must be between 0 and 7");\r
	418	return 0;\r
	419	}\r
	420	\r
	421	printT5xxHeader(page1);\r
	422	return T55xxReadBlock(block, page1, usepwd, override, password, downlink_mode);\r
	423	}\r
	424	\r
	425	bool DecodeT55xxBlock(){\r
	426	\r
	427	char buf[30] = {0x00};\r
	428	char *cmdStr = buf;\r
	429	int ans = 0;\r
	430	bool ST = config.ST;\r
	431	uint8_t bitRate[8] = {8,16,32,40,50,64,100,128};\r
	432	DemodBufferLen = 0x00;\r
	433	\r
	434	switch( config.modulation ){\r
	435	case DEMOD_FSK:\r
	436	snprintf(cmdStr, sizeof(buf),"%d %d", bitRate[config.bitrate], config.inverted );\r
	437	ans = FSKrawDemod(cmdStr, false);\r
	438	break;\r
	439	case DEMOD_FSK1:\r
	440	case DEMOD_FSK1a:\r
	441	snprintf(cmdStr, sizeof(buf),"%d %d 8 5", bitRate[config.bitrate], config.inverted );\r
	442	ans = FSKrawDemod(cmdStr, false);\r
	443	break;\r
	444	case DEMOD_FSK2:\r
	445	case DEMOD_FSK2a:\r
	446	snprintf(cmdStr, sizeof(buf),"%d %d 10 8", bitRate[config.bitrate], config.inverted );\r
	447	ans = FSKrawDemod(cmdStr, false);\r
	448	break;\r
	449	case DEMOD_ASK:\r
	450	snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );\r
	451	ans = ASKDemod_ext(cmdStr, false, false, 1, &ST);\r
	452	break;\r
	453	case DEMOD_PSK1:\r
	454	// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
	455	save_restoreGB(GRAPH_SAVE);\r
	456	CmdLtrim("160");\r
	457	snprintf(cmdStr, sizeof(buf),"%d %d 6", bitRate[config.bitrate], config.inverted );\r
	458	ans = PSKDemod(cmdStr, false);\r
	459	//undo trim samples\r
	460	save_restoreGB(GRAPH_RESTORE);\r
	461	break;\r
	462	case DEMOD_PSK2: //inverted won't affect this\r
	463	case DEMOD_PSK3: //not fully implemented\r
	464	// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
	465	save_restoreGB(GRAPH_SAVE);\r
	466	CmdLtrim("160");\r
	467	snprintf(cmdStr, sizeof(buf),"%d 0 6", bitRate[config.bitrate] );\r
	468	ans = PSKDemod(cmdStr, false);\r
	469	psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
	470	//undo trim samples\r
	471	save_restoreGB(GRAPH_RESTORE);\r
	472	break;\r
	473	case DEMOD_NRZ:\r
	474	snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );\r
	475	ans = NRZrawDemod(cmdStr, false);\r
	476	break;\r
	477	case DEMOD_BI:\r
	478	case DEMOD_BIa:\r
	479	snprintf(cmdStr, sizeof(buf),"0 %d %d 1", bitRate[config.bitrate], config.inverted );\r
	480	ans = ASKbiphaseDemod(cmdStr, false);\r
	481	break;\r
	482	default:\r
	483	return false;\r
	484	}\r
	485	return (bool) ans;\r
	486	}\r
	487	\r
	488	bool DecodeT5555TraceBlock() {\r
	489	DemodBufferLen = 0x00;\r
	490	\r
	491	// According to datasheet. Always: RF/64, not inverted, Manchester\r
	492	return (bool) ASKDemod("64 0 1", false, false, 1);\r
	493	}\r
	494	\r
	495	int CmdT55xxDetect(const char *Cmd){\r
	496	bool errors = false;\r
	497	bool useGB = false;\r
	498	bool usepwd = false;\r
	499	uint32_t password = 0;\r
	500	uint8_t cmdp = 0;\r
	501	uint8_t downlink_mode = 0;\r
	502	\r
	503	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	504	switch(param_getchar(Cmd, cmdp)) {\r
	505	case 'h':\r
	506	case 'H':\r
	507	return usage_t55xx_detect();\r
	508	case 'p':\r
	509	case 'P':\r
	510	password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	511	usepwd = true;\r
	512	cmdp += 2;\r
	513	break;\r
	514	case '1':\r
	515	// use Graphbuffer data\r
	516	useGB = true;\r
	517	cmdp++;\r
	518	break;\r
	519	case 'e':\r
	520	case 'E':\r
	521	downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
	522	if (downlink_mode > 3) downlink_mode = 0;\r
	523	cmdp +=2;\r
	524	break; \r
	525	default:\r
	526	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	527	errors = true;\r
	528	break;\r
	529	}\r
	530	}\r
	531	if (errors) return usage_t55xx_detect();\r
	532	\r
	533	if ( !useGB) {\r
	534	if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password,downlink_mode) )\r
	535	return 0;\r
	536	}\r
	537	\r
	538	if ( !tryDetectModulation() )\r
	539	PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");\r
	540	else {\r
	541	// Add downlink mode to reference.\r
	542	switch (downlink_mode) {\r
	543	case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r
	544	case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r
	545	case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r
	546	case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r
	547	// default:\r
	548	\r
	549	// No default action\r
	550	}\r
	551	}\r
	552	return 1;\r
	553	}\r
	554	\r
	555	// detect configuration?\r
	556	bool tryDetectModulation(){\r
	557	uint8_t hits = 0;\r
	558	t55xx_conf_block_t tests[15];\r
	559	int bitRate=0;\r
	560	uint8_t fc1 = 0, fc2 = 0, ans = 0;\r
	561	int clk = 0, firstClockEdge = 0;\r
	562	ans = fskClocks(&fc1, &fc2, (uint8_t *)&clk, false, &firstClockEdge);\r
	563	if (ans && ((fc1==10 && fc2==8) \|\| (fc1==8 && fc2==5))) {\r
	564	if ( FSKrawDemod("0 0", false) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	565	tests[hits].modulation = DEMOD_FSK;\r
	566	if (fc1==8 && fc2 == 5)\r
	567	tests[hits].modulation = DEMOD_FSK1a;\r
	568	else if (fc1==10 && fc2 == 8)\r
	569	tests[hits].modulation = DEMOD_FSK2;\r
	570	tests[hits].bitrate = bitRate;\r
	571	tests[hits].inverted = false;\r
	572	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	573	tests[hits].ST = false;\r
	574	++hits;\r
	575	}\r
	576	if ( FSKrawDemod("0 1", false) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	577	tests[hits].modulation = DEMOD_FSK;\r
	578	if (fc1 == 8 && fc2 == 5)\r
	579	tests[hits].modulation = DEMOD_FSK1;\r
	580	else if (fc1 == 10 && fc2 == 8)\r
	581	tests[hits].modulation = DEMOD_FSK2a;\r
	582	tests[hits].bitrate = bitRate;\r
	583	tests[hits].inverted = true;\r
	584	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	585	tests[hits].ST = false;\r
	586	++hits;\r
	587	}\r
	588	} else {\r
	589	clk = GetAskClock("", false, false);\r
	590	if (clk>0) {\r
	591	tests[hits].ST = true;\r
	592	if ( ASKDemod_ext("0 0 1", false, false, 1, &tests[hits].ST) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	593	tests[hits].modulation = DEMOD_ASK;\r
	594	tests[hits].bitrate = bitRate;\r
	595	tests[hits].inverted = false;\r
	596	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	597	++hits;\r
	598	}\r
	599	tests[hits].ST = true;\r
	600	if ( ASKDemod_ext("0 1 1", false, false, 1, &tests[hits].ST) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	601	tests[hits].modulation = DEMOD_ASK;\r
	602	tests[hits].bitrate = bitRate;\r
	603	tests[hits].inverted = true;\r
	604	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	605	++hits;\r
	606	}\r
	607	if ( ASKbiphaseDemod("0 0 0 2", false) && test(DEMOD_BI, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r
	608	tests[hits].modulation = DEMOD_BI;\r
	609	tests[hits].bitrate = bitRate;\r
	610	tests[hits].inverted = false;\r
	611	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	612	tests[hits].ST = false;\r
	613	++hits;\r
	614	}\r
	615	if ( ASKbiphaseDemod("0 0 1 2", false) && test(DEMOD_BIa, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r
	616	tests[hits].modulation = DEMOD_BIa;\r
	617	tests[hits].bitrate = bitRate;\r
	618	tests[hits].inverted = true;\r
	619	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	620	tests[hits].ST = false;\r
	621	++hits;\r
	622	}\r
	623	}\r
	624	clk = GetNrzClock("", false, false);\r
	625	if (clk>8) { //clock of rf/8 is likely a false positive, so don't use it.\r
	626	if ( NRZrawDemod("0 0 1", false) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	627	tests[hits].modulation = DEMOD_NRZ;\r
	628	tests[hits].bitrate = bitRate;\r
	629	tests[hits].inverted = false;\r
	630	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	631	tests[hits].ST = false;\r
	632	++hits;\r
	633	}\r
	634	\r
	635	if ( NRZrawDemod("0 1 1", false) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	636	tests[hits].modulation = DEMOD_NRZ;\r
	637	tests[hits].bitrate = bitRate;\r
	638	tests[hits].inverted = true;\r
	639	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	640	tests[hits].ST = false;\r
	641	++hits;\r
	642	}\r
	643	}\r
	644	\r
	645	clk = GetPskClock("", false, false);\r
	646	if (clk>0) {\r
	647	// allow undo\r
	648	save_restoreGB(GRAPH_SAVE);\r
	649	// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
	650	CmdLtrim("160");\r
	651	if ( PSKDemod("0 0 6", false) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	652	tests[hits].modulation = DEMOD_PSK1;\r
	653	tests[hits].bitrate = bitRate;\r
	654	tests[hits].inverted = false;\r
	655	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	656	tests[hits].ST = false;\r
	657	++hits;\r
	658	}\r
	659	if ( PSKDemod("0 1 6", false) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	660	tests[hits].modulation = DEMOD_PSK1;\r
	661	tests[hits].bitrate = bitRate;\r
	662	tests[hits].inverted = true;\r
	663	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	664	tests[hits].ST = false;\r
	665	++hits;\r
	666	}\r
	667	// PSK2 - needs a call to psk1TOpsk2.\r
	668	if ( PSKDemod("0 0 6", false)) {\r
	669	psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
	670	if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
	671	tests[hits].modulation = DEMOD_PSK2;\r
	672	tests[hits].bitrate = bitRate;\r
	673	tests[hits].inverted = false;\r
	674	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	675	tests[hits].ST = false;\r
	676	++hits;\r
	677	}\r
	678	} // inverse waves does not affect this demod\r
	679	// PSK3 - needs a call to psk1TOpsk2.\r
	680	if ( PSKDemod("0 0 6", false)) {\r
	681	psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
	682	if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
	683	tests[hits].modulation = DEMOD_PSK3;\r
	684	tests[hits].bitrate = bitRate;\r
	685	tests[hits].inverted = false;\r
	686	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	687	tests[hits].ST = false;\r
	688	++hits;\r
	689	}\r
	690	} // inverse waves does not affect this demod\r
	691	//undo trim samples\r
	692	save_restoreGB(GRAPH_RESTORE);\r
	693	}\r
	694	} \r
	695	if ( hits == 1) {\r
	696	config.modulation = tests[0].modulation;\r
	697	config.bitrate = tests[0].bitrate;\r
	698	config.inverted = tests[0].inverted;\r
	699	config.offset = tests[0].offset;\r
	700	config.block0 = tests[0].block0;\r
	701	config.Q5 = tests[0].Q5;\r
	702	config.ST = tests[0].ST;\r
	703	printConfiguration( config );\r
	704	return true;\r
	705	}\r
	706	\r
	707	if ( hits > 1) {\r
	708	PrintAndLog("Found [%d] possible matches for modulation.",hits);\r
	709	for(int i=0; i<hits; ++i){\r
	710	PrintAndLog("--[%d]---------------", i+1);\r
	711	printConfiguration( tests[i] );\r
	712	}\r
	713	}\r
	714	return false;\r
	715	}\r
	716	\r
	717	bool testModulation(uint8_t mode, uint8_t modread){\r
	718	switch( mode ){\r
	719	case DEMOD_FSK:\r
	720	if (modread >= DEMOD_FSK1 && modread <= DEMOD_FSK2a) return true;\r
	721	break;\r
	722	case DEMOD_ASK:\r
	723	if (modread == DEMOD_ASK) return true;\r
	724	break;\r
	725	case DEMOD_PSK1:\r
	726	if (modread == DEMOD_PSK1) return true;\r
	727	break;\r
	728	case DEMOD_PSK2:\r
	729	if (modread == DEMOD_PSK2) return true;\r
	730	break;\r
	731	case DEMOD_PSK3:\r
	732	if (modread == DEMOD_PSK3) return true;\r
	733	break;\r
	734	case DEMOD_NRZ:\r
	735	if (modread == DEMOD_NRZ) return true;\r
	736	break;\r
	737	case DEMOD_BI:\r
	738	if (modread == DEMOD_BI) return true;\r
	739	break;\r
	740	case DEMOD_BIa:\r
	741	if (modread == DEMOD_BIa) return true;\r
	742	break; \r
	743	default:\r
	744	return false;\r
	745	}\r
	746	return false;\r
	747	}\r
	748	\r
	749	bool testQ5Modulation(uint8_t mode, uint8_t modread){\r
	750	switch( mode ){\r
	751	case DEMOD_FSK:\r
	752	if (modread >= 4 && modread <= 5) return true;\r
	753	break;\r
	754	case DEMOD_ASK:\r
	755	if (modread == 0) return true;\r
	756	break;\r
	757	case DEMOD_PSK1:\r
	758	if (modread == 1) return true;\r
	759	break;\r
	760	case DEMOD_PSK2:\r
	761	if (modread == 2) return true;\r
	762	break;\r
	763	case DEMOD_PSK3:\r
	764	if (modread == 3) return true;\r
	765	break;\r
	766	case DEMOD_NRZ:\r
	767	if (modread == 7) return true;\r
	768	break;\r
	769	case DEMOD_BI:\r
	770	if (modread == 6) return true;\r
	771	break;\r
	772	default:\r
	773	return false;\r
	774	}\r
	775	return false;\r
	776	}\r
	777	\r
	778	int convertQ5bitRate(uint8_t bitRateRead) {\r
	779	uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r
	780	for (int i=0; i<8; i++)\r
	781	if (expected[i] == bitRateRead)\r
	782	return i;\r
	783	\r
	784	return -1;\r
	785	}\r
	786	\r
	787	bool testQ5(uint8_t mode, uint8_t offset, int fndBitRate, uint8_t clk){\r
	788	\r
	789	if ( DemodBufferLen < 64 ) return false;\r
	790	uint8_t si = 0;\r
	791	for (uint8_t idx = 28; idx < 64; idx++){\r
	792	si = idx;\r
	793	if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r
	794	\r
	795	uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
	796	uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;\r
	797	// 2nibble must be zeroed.\r
	798	if (safer != 0x6 && safer != 0x9) continue;\r
	799	if ( resv > 0x00) continue;\r
	800	//uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;\r
	801	//uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;\r
	802	si += 1+1;\r
	803	int bitRate = PackBits(si, 6, DemodBuffer)*2 + 2; si += 6; //bit rate\r
	804	if (bitRate > 128 \|\| bitRate < 8) continue;\r
	805	\r
	806	//uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1; \r
	807	//uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1; \r
	808	//uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr\r
	809	//uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;\r
	810	si += 1+1+2+1;\r
	811	uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;\r
	812	uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;\r
	813	//uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;\r
	814	if (maxBlk == 0) continue;\r
	815	//test modulation\r
	816	if (!testQ5Modulation(mode, modread)) continue;\r
	817	if (bitRate != clk) continue;\r
	818	*fndBitRate = convertQ5bitRate(bitRate);\r
	819	if (*fndBitRate < 0) continue;\r
	820	*offset = idx;\r
	821	\r
	822	return true;\r
	823	}\r
	824	return false;\r
	825	}\r
	826	\r
	827	bool testBitRate(uint8_t readRate, uint8_t clk){\r
	828	uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r
	829	if (expected[readRate] == clk)\r
	830	return true;\r
	831	\r
	832	return false;\r
	833	}\r
	834	\r
	835	bool test(uint8_t mode, uint8_t offset, int fndBitRate, uint8_t clk, bool *Q5){\r
	836	\r
	837	if ( DemodBufferLen < 64 ) return false;\r
	838	uint8_t si = 0;\r
	839	for (uint8_t idx = 28; idx < 64; idx++){\r
	840	si = idx;\r
	841	if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r
	842	\r
	843	uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
	844	uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode\r
	845	// 2nibble must be zeroed.\r
	846	// moved test to here, since this gets most faults first.\r
	847	if ( resv > 0x00) continue;\r
	848	\r
	849	int bitRate = PackBits(si, 6, DemodBuffer); si += 6; //bit rate (includes extended mode part of rate)\r
	850	uint8_t extend = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode\r
	851	uint8_t modread = PackBits(si, 5, DemodBuffer); si += 5+2+1; \r
	852	//uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //could check psk cr\r
	853	//uint8_t nml01 = PackBits(si, 1, DemodBuffer); si += 1+5; //bit 24, 30, 31 could be tested for 0 if not extended mode\r
	854	//uint8_t nml02 = PackBits(si, 2, DemodBuffer); si += 2;\r
	855	\r
	856	//if extended mode\r
	857	bool extMode =( (safer == 0x6 \|\| safer == 0x9) && extend) ? true : false;\r
	858	\r
	859	if (!extMode) {\r
	860	if (bitRate > 7) continue;\r
	861	if (!testBitRate(bitRate, clk)) continue;\r
	862	} else { //extended mode bitrate = same function to calc bitrate as em4x05\r
	863	if (EM4x05_GET_BITRATE(bitRate) != clk) continue;\r
	864	\r
	865	}\r
	866	//test modulation\r
	867	if (!testModulation(mode, modread)) continue;\r
	868	*fndBitRate = bitRate;\r
	869	*offset = idx;\r
	870	*Q5 = false;\r
	871	return true;\r
	872	}\r
	873	if (testQ5(mode, offset, fndBitRate, clk)) {\r
	874	*Q5 = true;\r
	875	return true;\r
	876	}\r
	877	return false;\r
	878	}\r
	879	\r
	880	void printT55xxBlock(const char *blockNum){\r
	881	\r
	882	uint8_t i = config.offset;\r
	883	uint8_t endpos = 32 + i;\r
	884	uint32_t blockData = 0;\r
	885	uint8_t bits[64] = {0x00};\r
	886	\r
	887	if ( !DemodBufferLen) return;\r
	888	\r
	889	if ( endpos > DemodBufferLen){\r
	890	PrintAndLog("The configured offset %d is too big. Possible offset: %d)", i, DemodBufferLen-32);\r
	891	return;\r
	892	}\r
	893	\r
	894	for (; i < endpos; ++i)\r
	895	bits[i - config.offset]=DemodBuffer[i];\r
	896	\r
	897	blockData = PackBits(0, 32, bits);\r
	898	\r
	899	PrintAndLog(" %s \| %08X \| %s", blockNum, blockData, sprint_bin(bits,32));\r
	900	}\r
	901	\r
	902	int special(const char *Cmd) {\r
	903	uint32_t blockData = 0;\r
	904	uint8_t bits[32] = {0x00};\r
	905	\r
	906	PrintAndLog("OFFSET \| DATA \| BINARY");\r
	907	PrintAndLog("----------------------------------------------------");\r
	908	int i,j = 0;\r
	909	for (; j < 64; ++j){\r
	910	\r
	911	for (i = 0; i < 32; ++i)\r
	912	bits[i]=DemodBuffer[j+i];\r
	913	\r
	914	blockData = PackBits(0, 32, bits);\r
	915	\r
	916	PrintAndLog(" %02d \| 0x%08X \| %s",j , blockData, sprint_bin(bits,32)); \r
	917	}\r
	918	return 0;\r
	919	}\r
	920	\r
	921	int printConfiguration( t55xx_conf_block_t b){\r
	922	PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");\r
	923	PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );\r
	924	PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate, (b.block0 & T55x7_X_MODE && (b.block0>>28==6 \|\| b.block0>>28==9))) );\r
	925	PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );\r
	926	PrintAndLog("Offset : %d", b.offset);\r
	927	PrintAndLog("Seq. Term. : %s", (b.ST) ? "Yes" : "No" );\r
	928	PrintAndLog("Block0 : 0x%08X", b.block0);\r
	929	PrintAndLog("");\r
	930	return 0;\r
	931	}\r
	932	\r
	933	int CmdT55xxWakeUp(const char *Cmd) {\r
	934	uint32_t password = 0;\r
	935	if ( strlen(Cmd) <= 0 ) return usage_t55xx_wakup();\r
	936	char cmdp = param_getchar(Cmd, 0);\r
	937	if ( cmdp == 'h' \|\| cmdp == 'H') return usage_t55xx_wakup();\r
	938	\r
	939	password = param_get32ex(Cmd, 0, 0, 16);\r
	940	\r
	941	UsbCommand c = {CMD_T55XX_WAKEUP, {password, 0, 0}};\r
	942	clearCommandBuffer();\r
	943	SendCommand(&c);\r
	944	PrintAndLog("Wake up command sent. Try read now");\r
	945	return 0;\r
	946	}\r
	947	\r
	948	int CmdT55xxWriteBlock(const char *Cmd) {\r
	949	uint8_t block = 0xFF; //default to invalid block\r
	950	uint32_t data = 0; //default to blank Block \r
	951	uint32_t password = 0; //default to blank Block 7\r
	952	uint32_t downlink_mode = 0;\r
	953	\r
	954	bool usepwd = false;\r
	955	bool page1 = false; \r
	956	bool gotdata = false;\r
	957	bool testMode = false;\r
	958	bool errors = false;\r
	959	uint8_t cmdp = 0;\r
	960	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	961	switch(param_getchar(Cmd, cmdp)) {\r
	962	case 'h':\r
	963	case 'H':\r
	964	return usage_t55xx_write();\r
	965	case 'b':\r
	966	case 'B':\r
	967	errors \|= param_getdec(Cmd, cmdp+1, &block);\r
	968	cmdp += 2;\r
	969	break;\r
	970	case 'd':\r
	971	case 'D':\r
	972	data = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	973	gotdata = true;\r
	974	cmdp += 2;\r
	975	break;\r
	976	case 'p':\r
	977	case 'P':\r
	978	password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	979	usepwd = true;\r
	980	cmdp += 2;\r
	981	break;\r
	982	case 't':\r
	983	case 'T':\r
	984	testMode = true;\r
	985	cmdp++;\r
	986	break;\r
	987	case '1':\r
	988	page1 = true;\r
	989	cmdp++;\r
	990	break;\r
	991	case 'e':\r
	992	case 'E':\r
	993	downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
	994	if (downlink_mode > 3) downlink_mode = 0;\r
	995	cmdp +=2;\r
	996	break;\r
	997	default:\r
	998	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	999	errors = true;\r
	1000	break;\r
	1001	}\r
	1002	}\r
	1003	if (errors \|\| !gotdata) return usage_t55xx_write();\r
	1004	\r
	1005	if (block > 7) {\r
	1006	PrintAndLog("Block number must be between 0 and 7");\r
	1007	return 0;\r
	1008	}\r
	1009	\r
	1010	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};\r
	1011	UsbCommand resp;\r
	1012	c.d.asBytes[0] = (page1) ? 0x2 : 0; \r
	1013	c.d.asBytes[0] \|= (testMode) ? 0x4 : 0; \r
	1014	c.d.asBytes[0] \|= (downlink_mode << 3);\r
	1015	\r
	1016	char pwdStr[16] = {0};\r
	1017	snprintf(pwdStr, sizeof(pwdStr), "pwd: 0x%08X", password);\r
	1018	\r
	1019	PrintAndLog("Writing page %d block: %02d data: 0x%08X %s", page1, block, data, (usepwd) ? pwdStr : "" );\r
	1020	\r
	1021	//Password mode\r
	1022	if (usepwd) {\r
	1023	c.arg[2] = password;\r
	1024	c.d.asBytes[0] \|= 0x1; \r
	1025	}\r
	1026	\r
	1027	clearCommandBuffer();\r
	1028	SendCommand(&c);\r
	1029	if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){\r
	1030	PrintAndLog("Error occurred, device did not ACK write operation. (May be due to old firmware)");\r
	1031	return 0;\r
	1032	}\r
	1033	return 1;\r
	1034	}\r
	1035	\r
	1036	int CmdT55xxReadTrace(const char *Cmd) {\r
	1037	char cmdp = param_getchar(Cmd, 0);\r
	1038	bool pwdmode = false;\r
	1039	uint32_t password = 0;\r
	1040	if (strlen(Cmd) > 1 \|\| cmdp == 'h' \|\| cmdp == 'H') \r
	1041	return usage_t55xx_trace();\r
	1042	\r
	1043	if (strlen(Cmd)==0)\r
	1044	if ( !AquireData( T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password,0 ) )\r
	1045	return 0;\r
	1046	\r
	1047	if ( config.Q5 ) {\r
	1048	if (!DecodeT5555TraceBlock()) return 0;\r
	1049	} else {\r
	1050	if (!DecodeT55xxBlock()) return 0;\r
	1051	}\r
	1052	\r
	1053	if ( !DemodBufferLen ) return 0;\r
	1054	\r
	1055	RepaintGraphWindow();\r
	1056	uint8_t repeat = (config.offset > 5) ? 32 : 0;\r
	1057	\r
	1058	uint8_t si = config.offset+repeat;\r
	1059	uint32_t bl1 = PackBits(si, 32, DemodBuffer);\r
	1060	uint32_t bl2 = PackBits(si+32, 32, DemodBuffer);\r
	1061	\r
	1062	if (config.Q5) {\r
	1063	uint32_t hdr = PackBits(si, 9, DemodBuffer); si += 9;\r
	1064	\r
	1065	if (hdr != 0x1FF) {\r
	1066	PrintAndLog("Invalid Q5 Trace data header (expected 0x1FF, found %X)", hdr);\r
	1067	return 0;\r
	1068	}\r
	1069	\r
	1070	t5555_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .icr = 0, .lotidc = '?', .lotid = 0, .wafer = 0, .dw =0};\r
	1071	\r
	1072	data.icr = PackBits(si, 2, DemodBuffer); si += 2;\r
	1073	data.lotidc = 'Z' - PackBits(si, 2, DemodBuffer); si += 3;\r
	1074	\r
	1075	data.lotid = PackBits(si, 4, DemodBuffer); si += 5;\r
	1076	data.lotid <<= 4;\r
	1077	data.lotid \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1078	data.lotid <<= 4;\r
	1079	data.lotid \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1080	data.lotid <<= 4;\r
	1081	data.lotid \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1082	data.lotid <<= 1;\r
	1083	data.lotid \|= PackBits(si, 1, DemodBuffer); si += 1;\r
	1084	\r
	1085	data.wafer = PackBits(si, 3, DemodBuffer); si += 4;\r
	1086	data.wafer <<= 2;\r
	1087	data.wafer \|= PackBits(si, 2, DemodBuffer); si += 2;\r
	1088	\r
	1089	data.dw = PackBits(si, 2, DemodBuffer); si += 3;\r
	1090	data.dw <<= 4;\r
	1091	data.dw \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1092	data.dw <<= 4;\r
	1093	data.dw \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1094	data.dw <<= 4;\r
	1095	data.dw \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1096	\r
	1097	printT5555Trace(data, repeat);\r
	1098	\r
	1099	} else {\r
	1100	\r
	1101	t55x7_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .acl = 0, .mfc = 0, .cid = 0, .year = 0, .quarter = 0, .icr = 0, .lotid = 0, .wafer = 0, .dw = 0};\r
	1102	\r
	1103	data.acl = PackBits(si, 8, DemodBuffer); si += 8;\r
	1104	if ( data.acl != 0xE0 ) {\r
	1105	PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");\r
	1106	return 0;\r
	1107	}\r
	1108	\r
	1109	data.mfc = PackBits(si, 8, DemodBuffer); si += 8;\r
	1110	data.cid = PackBits(si, 5, DemodBuffer); si += 5;\r
	1111	data.icr = PackBits(si, 3, DemodBuffer); si += 3;\r
	1112	data.year = PackBits(si, 4, DemodBuffer); si += 4;\r
	1113	data.quarter = PackBits(si, 2, DemodBuffer); si += 2;\r
	1114	data.lotid = PackBits(si, 14, DemodBuffer); si += 14;\r
	1115	data.wafer = PackBits(si, 5, DemodBuffer); si += 5;\r
	1116	data.dw = PackBits(si, 15, DemodBuffer); \r
	1117	\r
	1118	time_t t = time(NULL);\r
	1119	struct tm tm = *localtime(&t);\r
	1120	if ( data.year > tm.tm_year-110)\r
	1121	data.year += 2000;\r
	1122	else\r
	1123	data.year += 2010;\r
	1124	\r
	1125	printT55x7Trace(data, repeat);\r
	1126	}\r
	1127	return 0;\r
	1128	}\r
	1129	\r
	1130	void printT55x7Trace( t55x7_tracedata_t data, uint8_t repeat ){\r
	1131	PrintAndLog("-- T55x7 Trace Information ----------------------------------");\r
	1132	PrintAndLog("-------------------------------------------------------------");\r
	1133	PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", data.acl, data.acl);\r
	1134	PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d) - %s", data.mfc, data.mfc, getManufacturerName(data.mfc));\r
	1135	PrintAndLog(" CID : 0x%02X (%d) - %s", data.cid, data.cid, GetModelStrFromCID(data.cid));\r
	1136	PrintAndLog(" ICR IC Revision : %d", data.icr );\r
	1137	PrintAndLog(" Manufactured");\r
	1138	PrintAndLog(" Year/Quarter : %d/%d", data.year, data.quarter);\r
	1139	PrintAndLog(" Lot ID : %d", data.lotid );\r
	1140	PrintAndLog(" Wafer number : %d", data.wafer);\r
	1141	PrintAndLog(" Die Number : %d", data.dw);\r
	1142	PrintAndLog("-------------------------------------------------------------");\r
	1143	PrintAndLog(" Raw Data - Page 1");\r
	1144	PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );\r
	1145	PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );\r
	1146	PrintAndLog("-------------------------------------------------------------"); \r
	1147	\r
	1148	/*\r
	1149	TRACE - BLOCK O\r
	1150	Bits Definition HEX\r
	1151	1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0 \r
	1152	9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation\r
	1153	17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2 \r
	1154	22-24 ICR IC revision\r
	1155	25-28 YEAR (BCD encoded) 9 (= 2009)\r
	1156	29-30 QUARTER 1,2,3,4 \r
	1157	31-32 LOT ID\r
	1158	\r
	1159	TRACE - BLOCK 1\r
	1160	1-12 LOT ID \r
	1161	13-17 Wafer number\r
	1162	18-32 DW, die number sequential\r
	1163	*/\r
	1164	}\r
	1165	\r
	1166	void printT5555Trace( t5555_tracedata_t data, uint8_t repeat ){\r
	1167	PrintAndLog("-- T5555 (Q5) Trace Information -----------------------------");\r
	1168	PrintAndLog("-------------------------------------------------------------");\r
	1169	PrintAndLog(" ICR IC Revision : %d", data.icr ); \r
	1170	PrintAndLog(" Lot : %c%d", data.lotidc, data.lotid);\r
	1171	PrintAndLog(" Wafer number : %d", data.wafer);\r
	1172	PrintAndLog(" Die Number : %d", data.dw);\r
	1173	PrintAndLog("-------------------------------------------------------------");\r
	1174	PrintAndLog(" Raw Data - Page 1");\r
	1175	PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );\r
	1176	PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );\r
	1177	\r
	1178	/*\r
	1179	Q5 \r
	1180	TRACE - BLOCK O and BLOCK1\r
	1181	Bits Definition HEX\r
	1182	1-9 Header 0x1FF\r
	1183	10-11 IC Revision\r
	1184	12-13 Lot ID char\r
	1185	15-35 Lot ID (NB parity)\r
	1186	36-41 Wafer number (NB parity)\r
	1187	42-58 DW, die number sequential (NB parity)\r
	1188	60-63 Parity bits\r
	1189	64 Always zero\r
	1190	*/\r
	1191	}\r
	1192	\r
	1193	//need to add Q5 info...\r
	1194	int CmdT55xxInfo(const char *Cmd){\r
	1195	/*\r
	1196	Page 0 Block 0 Configuration data.\r
	1197	Normal mode\r
	1198	Extended mode\r
	1199	*/\r
	1200	bool pwdmode = false;\r
	1201	uint32_t password = 0;\r
	1202	char cmdp = param_getchar(Cmd, 0);\r
	1203	\r
	1204	if (strlen(Cmd) > 1 \|\| cmdp == 'h' \|\| cmdp == 'H')\r
	1205	return usage_t55xx_info();\r
	1206	\r
	1207	if (strlen(Cmd)==0)\r
	1208	if ( !AquireData( T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password,0 ) )\r
	1209	return 1;\r
	1210	\r
	1211	if (!DecodeT55xxBlock()) return 1;\r
	1212	\r
	1213	// too little space to start with\r
	1214	if ( DemodBufferLen < 32) return 1;\r
	1215	\r
	1216	uint8_t si = config.offset;\r
	1217	uint32_t bl0 = PackBits(si, 32, DemodBuffer);\r
	1218	\r
	1219	uint32_t safer = PackBits(si, 4, DemodBuffer); si += 4; \r
	1220	uint32_t resv = PackBits(si, 7, DemodBuffer); si += 7;\r
	1221	uint32_t dbr = PackBits(si, 3, DemodBuffer); si += 3;\r
	1222	uint32_t extend = PackBits(si, 1, DemodBuffer); si += 1;\r
	1223	uint32_t datamod = PackBits(si, 5, DemodBuffer); si += 5;\r
	1224	uint32_t pskcf = PackBits(si, 2, DemodBuffer); si += 2;\r
	1225	uint32_t aor = PackBits(si, 1, DemodBuffer); si += 1; \r
	1226	uint32_t otp = PackBits(si, 1, DemodBuffer); si += 1; \r
	1227	uint32_t maxblk = PackBits(si, 3, DemodBuffer); si += 3;\r
	1228	uint32_t pwd = PackBits(si, 1, DemodBuffer); si += 1; \r
	1229	uint32_t sst = PackBits(si, 1, DemodBuffer); si += 1; \r
	1230	uint32_t fw = PackBits(si, 1, DemodBuffer); si += 1;\r
	1231	uint32_t inv = PackBits(si, 1, DemodBuffer); si += 1; \r
	1232	uint32_t por = PackBits(si, 1, DemodBuffer); si += 1;\r
	1233	\r
	1234	if (config.Q5) PrintAndLog("* Warning * Config Info read off a Q5 will not display as expected");\r
	1235	PrintAndLog("");\r
	1236	PrintAndLog("-- T55x7 Configuration & Tag Information --------------------");\r
	1237	PrintAndLog("-------------------------------------------------------------");\r
	1238	PrintAndLog(" Safer key : %s", GetSaferStr(safer));\r
	1239	PrintAndLog(" reserved : %d", resv);\r
	1240	PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr, extend));\r
	1241	PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");\r
	1242	PrintAndLog(" Modulation : %s", GetModulationStr(datamod));\r
	1243	PrintAndLog(" PSK clock frequency : %d", pskcf);\r
	1244	PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");\r
	1245	PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );\r
	1246	PrintAndLog(" Max block : %d", maxblk);\r
	1247	PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");\r
	1248	PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");\r
	1249	PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");\r
	1250	PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");\r
	1251	PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");\r
	1252	PrintAndLog("-------------------------------------------------------------");\r
	1253	PrintAndLog(" Raw Data - Page 0");\r
	1254	PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(DemodBuffer+config.offset,32) );\r
	1255	PrintAndLog("-------------------------------------------------------------");\r
	1256	\r
	1257	return 0;\r
	1258	}\r
	1259	\r
	1260	int CmdT55xxDump(const char *Cmd){\r
	1261	\r
	1262	uint32_t password = 0;\r
	1263	char cmdp = param_getchar(Cmd, 0);\r
	1264	bool override = false;\r
	1265	if ( cmdp == 'h' \|\| cmdp == 'H') return usage_t55xx_dump();\r
	1266	\r
	1267	bool usepwd = ( strlen(Cmd) > 0);\r
	1268	if ( usepwd ){\r
	1269	password = param_get32ex(Cmd, 0, 0, 16);\r
	1270	if (param_getchar(Cmd, 1) =='o' )\r
	1271	override = true;\r
	1272	}\r
	1273	\r
	1274	printT5xxHeader(0);\r
	1275	for ( uint8_t i = 0; i <8; ++i)\r
	1276	T55xxReadBlock(i, 0, usepwd, override, password,0);\r
	1277	\r
	1278	printT5xxHeader(1);\r
	1279	for ( uint8_t i = 0; i<4; i++)\r
	1280	T55xxReadBlock(i, 1, usepwd, override, password,0); \r
	1281	\r
	1282	return 1;\r
	1283	}\r
	1284	\r
	1285	int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password, uint8_t downlink_mode ){\r
	1286	// arg0 bitmodes:\r
	1287	// bit0 = pwdmode\r
	1288	// bit1 = page to read from\r
	1289	uint8_t arg0 = (page<<1) \| pwdmode;\r
	1290	arg0 \|= (downlink_mode << 3);\r
	1291	UsbCommand c = {CMD_T55XX_READ_BLOCK, {arg0, block, password}};\r
	1292	\r
	1293	clearCommandBuffer();\r
	1294	SendCommand(&c);\r
	1295	if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r
	1296	PrintAndLog("command execution time out");\r
	1297	return 0;\r
	1298	}\r
	1299	getSamples(12000,true);\r
	1300	return 1;\r
	1301	}\r
	1302	\r
	1303	char * GetBitRateStr(uint32_t id, bool xmode) {\r
	1304	static char buf[25];\r
	1305	\r
	1306	char *retStr = buf;\r
	1307	if (xmode) { //xmode bitrate calc is same as em4x05 calc\r
	1308	snprintf(retStr,sizeof(buf),"%d - RF/%d", id, EM4x05_GET_BITRATE(id));\r
	1309	} else {\r
	1310	switch (id) {\r
	1311	case 0: snprintf(retStr,sizeof(buf),"%d - RF/8",id); break;\r
	1312	case 1: snprintf(retStr,sizeof(buf),"%d - RF/16",id); break;\r
	1313	case 2: snprintf(retStr,sizeof(buf),"%d - RF/32",id); break;\r
	1314	case 3: snprintf(retStr,sizeof(buf),"%d - RF/40",id); break;\r
	1315	case 4: snprintf(retStr,sizeof(buf),"%d - RF/50",id); break;\r
	1316	case 5: snprintf(retStr,sizeof(buf),"%d - RF/64",id); break;\r
	1317	case 6: snprintf(retStr,sizeof(buf),"%d - RF/100",id); break;\r
	1318	case 7: snprintf(retStr,sizeof(buf),"%d - RF/128",id); break;\r
	1319	default: snprintf(retStr,sizeof(buf),"%d - (Unknown)",id); break;\r
	1320	} \r
	1321	}\r
	1322	return buf;\r
	1323	}\r
	1324	\r
	1325	char * GetSaferStr(uint32_t id) {\r
	1326	static char buf[40];\r
	1327	char *retStr = buf;\r
	1328	\r
	1329	snprintf(retStr,sizeof(buf),"%d",id);\r
	1330	if (id == 6) {\r
	1331	snprintf(retStr,sizeof(buf),"%d - passwd",id);\r
	1332	}\r
	1333	if (id == 9 ){\r
	1334	snprintf(retStr,sizeof(buf),"%d - testmode",id);\r
	1335	}\r
	1336	\r
	1337	return buf;\r
	1338	}\r
	1339	\r
	1340	char * GetModulationStr( uint32_t id){\r
	1341	static char buf[60];\r
	1342	char *retStr = buf;\r
	1343	\r
	1344	switch (id){\r
	1345	case 0: snprintf(retStr,sizeof(buf),"%d - DIRECT (ASK/NRZ)",id); break;\r
	1346	case 1: snprintf(retStr,sizeof(buf),"%d - PSK 1 phase change when input changes",id); break;\r
	1347	case 2: snprintf(retStr,sizeof(buf),"%d - PSK 2 phase change on bitclk if input high",id); break;\r
	1348	case 3: snprintf(retStr,sizeof(buf),"%d - PSK 3 phase change on rising edge of input",id); break;\r
	1349	case 4: snprintf(retStr,sizeof(buf),"%d - FSK 1 RF/8 RF/5",id); break;\r
	1350	case 5: snprintf(retStr,sizeof(buf),"%d - FSK 2 RF/8 RF/10",id); break;\r
	1351	case 6: snprintf(retStr,sizeof(buf),"%d - FSK 1a RF/5 RF/8",id); break;\r
	1352	case 7: snprintf(retStr,sizeof(buf),"%d - FSK 2a RF/10 RF/8",id); break;\r
	1353	case 8: snprintf(retStr,sizeof(buf),"%d - Manchester",id); break;\r
	1354	case 16: snprintf(retStr,sizeof(buf),"%d - Biphase",id); break;\r
	1355	case 0x18: snprintf(retStr,sizeof(buf),"%d - Biphase a - AKA Conditional Dephase Encoding(CDP)",id); break;\r
	1356	case 17: snprintf(retStr,sizeof(buf),"%d - Reserved",id); break;\r
	1357	default: snprintf(retStr,sizeof(buf),"0x%02X (Unknown)",id); break;\r
	1358	}\r
	1359	return buf;\r
	1360	}\r
	1361	\r
	1362	char * GetModelStrFromCID(uint32_t cid){\r
	1363	\r
	1364	static char buf[10];\r
	1365	char *retStr = buf;\r
	1366	\r
	1367	if (cid == 1) snprintf(retStr, sizeof(buf),"ATA5577M1");\r
	1368	if (cid == 2) snprintf(retStr, sizeof(buf),"ATA5577M2"); \r
	1369	return buf;\r
	1370	}\r
	1371	\r
	1372	char * GetSelectedModulationStr( uint8_t id){\r
	1373	\r
	1374	static char buf[20];\r
	1375	char *retStr = buf;\r
	1376	\r
	1377	switch (id) {\r
	1378	case DEMOD_FSK: snprintf(retStr,sizeof(buf),"FSK"); break;\r
	1379	case DEMOD_FSK1: snprintf(retStr,sizeof(buf),"FSK1"); break;\r
	1380	case DEMOD_FSK1a: snprintf(retStr,sizeof(buf),"FSK1a"); break;\r
	1381	case DEMOD_FSK2: snprintf(retStr,sizeof(buf),"FSK2"); break;\r
	1382	case DEMOD_FSK2a: snprintf(retStr,sizeof(buf),"FSK2a"); break;\r
	1383	case DEMOD_ASK: snprintf(retStr,sizeof(buf),"ASK"); break;\r
	1384	case DEMOD_NRZ: snprintf(retStr,sizeof(buf),"DIRECT/NRZ"); break;\r
	1385	case DEMOD_PSK1: snprintf(retStr,sizeof(buf),"PSK1"); break;\r
	1386	case DEMOD_PSK2: snprintf(retStr,sizeof(buf),"PSK2"); break;\r
	1387	case DEMOD_PSK3: snprintf(retStr,sizeof(buf),"PSK3"); break;\r
	1388	case DEMOD_BI: snprintf(retStr,sizeof(buf),"BIPHASE"); break;\r
	1389	case DEMOD_BIa: snprintf(retStr,sizeof(buf),"BIPHASEa - (CDP)"); break;\r
	1390	default: snprintf(retStr,sizeof(buf),"(Unknown)"); break;\r
	1391	}\r
	1392	return buf;\r
	1393	}\r
	1394	\r
	1395	uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){\r
	1396	\r
	1397	int i = start;\r
	1398	int j = len-1;\r
	1399	\r
	1400	if (len > 32) return 0;\r
	1401	\r
	1402	uint32_t tmp = 0;\r
	1403	for (; j >= 0; --j, ++i)\r
	1404	tmp \|= bits[i] << j;\r
	1405	\r
	1406	return tmp;\r
	1407	}\r
	1408	\r
	1409	int CmdResetRead(const char *Cmd) {\r
	1410	UsbCommand c = {CMD_T55XX_RESET_READ, {0,0,0}};\r
	1411	\r
	1412	clearCommandBuffer();\r
	1413	SendCommand(&c);\r
	1414	if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r
	1415	PrintAndLog("command execution time out");\r
	1416	return 0;\r
	1417	}\r
	1418	\r
	1419	uint8_t got[BIGBUF_SIZE-1];\r
	1420	GetFromBigBuf(got, sizeof(got), 0, NULL, -1 , 0);\r
	1421	setGraphBuf(got, sizeof(got));\r
	1422	return 1;\r
	1423	}\r
	1424	\r
	1425	int CmdT55xxWipe(const char *Cmd) {\r
	1426	char writeData[20] = {0};\r
	1427	char *ptrData = writeData;\r
	1428	\r
	1429	char cmdp = param_getchar(Cmd, 0); \r
	1430	if ( cmdp == 'h' \|\| cmdp == 'H') return usage_t55xx_wipe();\r
	1431	\r
	1432	bool Q5 = (cmdp == 'q' \|\| cmdp == 'Q');\r
	1433	\r
	1434	// Try with the default password to reset block 0\r
	1435	// With a pwd should work even if pwd bit not set\r
	1436	PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");\r
	1437	\r
	1438	if ( Q5 ){\r
	1439	snprintf(ptrData,sizeof(writeData),"b 0 d 6001F004 p 0");\r
	1440	} else {\r
	1441	snprintf(ptrData,sizeof(writeData),"b 0 d 00088040 p 0");\r
	1442	}\r
	1443	\r
	1444	if (!CmdT55xxWriteBlock(ptrData)) PrintAndLog("Error writing blk 0");\r
	1445	\r
	1446	for (uint8_t blk = 1; blk<8; blk++) {\r
	1447	snprintf(ptrData,sizeof(writeData),"b %d d 0", blk);\r
	1448	if (!CmdT55xxWriteBlock(ptrData))\r
	1449	PrintAndLog("Error writing blk %d", blk);\r
	1450	\r
	1451	memset(writeData, 0x00, sizeof(writeData));\r
	1452	}\r
	1453	return 0;\r
	1454	}\r
	1455	\r
	1456	int CmdT55xxBruteForce(const char *Cmd) {\r
	1457	\r
	1458	// load a default pwd file.\r
	1459	char buf[9];\r
	1460	char filename[FILE_PATH_SIZE]={0};\r
	1461	int keycnt = 0;\r
	1462	uint8_t downlink_mode = 0;\r
	1463	int ch;\r
	1464	uint8_t stKeyBlock = 20;\r
	1465	uint8_t keyBlock = NULL, p = NULL;\r
	1466	uint32_t start_password = 0x00000000; //start password\r
	1467	uint32_t end_password = 0xFFFFFFFF; //end password\r
	1468	bool found = false;\r
	1469	\r
	1470	char cmdp = param_getchar(Cmd, 0);\r
	1471	if (cmdp == 'h' \|\| cmdp == 'H') return usage_t55xx_bruteforce();\r
	1472	\r
	1473	keyBlock = calloc(stKeyBlock, 6);\r
	1474	if (keyBlock == NULL) return 1;\r
	1475	\r
	1476	if (cmdp == 'i' \|\| cmdp == 'I') {\r
	1477	\r
	1478	int len = strlen(Cmd+2);\r
	1479	if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r
	1480	memcpy(filename, Cmd+2, len);\r
	1481	\r
	1482	FILE * f = fopen( filename , "r");\r
	1483	\r
	1484	if ( !f ) {\r
	1485	PrintAndLog("File: %s: not found or locked.", filename);\r
	1486	free(keyBlock);\r
	1487	return 1;\r
	1488	}\r
	1489	\r
	1490	while( fgets(buf, sizeof(buf), f) ) {\r
	1491	if (strlen(buf) < 8 \|\| buf[7] == '\n') continue;\r
	1492	\r
	1493	while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r
	1494	\r
	1495	//The line start with # is comment, skip\r
	1496	if( buf[0]=='#' ) continue;\r
	1497	\r
	1498	if (!isxdigit((unsigned char)buf[0])) {\r
	1499	PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r
	1500	continue;\r
	1501	}\r
	1502	\r
	1503	buf[8] = 0;\r
	1504	\r
	1505	if ( stKeyBlock - keycnt < 2) {\r
	1506	p = realloc(keyBlock, 6*(stKeyBlock+=10));\r
	1507	if (!p) {\r
	1508	PrintAndLog("Cannot allocate memory for defaultKeys");\r
	1509	free(keyBlock);\r
	1510	fclose(f);\r
	1511	return 2;\r
	1512	}\r
	1513	keyBlock = p;\r
	1514	}\r
	1515	memset(keyBlock + 4 * keycnt, 0, 4);\r
	1516	num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r
	1517	PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r
	1518	keycnt++;\r
	1519	memset(buf, 0, sizeof(buf));\r
	1520	}\r
	1521	fclose(f);\r
	1522	\r
	1523	if (keycnt == 0) {\r
	1524	PrintAndLog("No keys found in file");\r
	1525	free(keyBlock);\r
	1526	return 1;\r
	1527	}\r
	1528	PrintAndLog("Loaded %d keys", keycnt);\r
	1529	\r
	1530	// loop\r
	1531	uint64_t testpwd = 0x00;\r
	1532	for (uint16_t c = 0; c < keycnt; ++c ) {\r
	1533	\r
	1534	if (ukbhit()) {\r
	1535	ch = getchar();\r
	1536	(void)ch;\r
	1537	printf("\naborted via keyboard!\n");\r
	1538	free(keyBlock);\r
	1539	return 0;\r
	1540	}\r
	1541	\r
	1542	testpwd = bytes_to_num(keyBlock + 4*c, 4);\r
	1543	\r
	1544	PrintAndLog("Testing %08X", testpwd);\r
	1545	\r
	1546	if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,downlink_mode)) {\r
	1547	PrintAndLog("Aquireing data from device failed. Quitting");\r
	1548	free(keyBlock);\r
	1549	return 0;\r
	1550	}\r
	1551	\r
	1552	found = tryDetectModulation();\r
	1553	\r
	1554	if ( found ) {\r
	1555	PrintAndLog("Found valid password: [%08X]", testpwd);\r
	1556	free(keyBlock);\r
	1557	return 0;\r
	1558	}\r
	1559	}\r
	1560	PrintAndLog("Password NOT found.");\r
	1561	free(keyBlock);\r
	1562	return 0;\r
	1563	}\r
	1564	\r
	1565	// Try to read Block 7, first :)\r
	1566	\r
	1567	// incremental pwd range search\r
	1568	start_password = param_get32ex(Cmd, 0, 0, 16);\r
	1569	end_password = param_get32ex(Cmd, 1, 0, 16);\r
	1570	\r
	1571	if ( start_password >= end_password ) {\r
	1572	free(keyBlock);\r
	1573	return usage_t55xx_bruteforce();\r
	1574	}\r
	1575	PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r
	1576	\r
	1577	uint32_t i = start_password;\r
	1578	\r
	1579	while ((!found) && (i <= end_password)) {\r
	1580	\r
	1581	printf(".");\r
	1582	fflush(stdout);\r
	1583	if (ukbhit()) {\r
	1584	ch = getchar();\r
	1585	(void)ch;\r
	1586	printf("\naborted via keyboard!\n");\r
	1587	free(keyBlock);\r
	1588	return 0;\r
	1589	}\r
	1590	\r
	1591	if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r
	1592	PrintAndLog("Aquireing data from device failed. Quitting");\r
	1593	free(keyBlock);\r
	1594	return 0;\r
	1595	}\r
	1596	found = tryDetectModulation();\r
	1597	\r
	1598	if (found) break;\r
	1599	i++;\r
	1600	}\r
	1601	\r
	1602	PrintAndLog("");\r
	1603	\r
	1604	if (found)\r
	1605	PrintAndLog("Found valid password: [%08x]", i);\r
	1606	else\r
	1607	PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r
	1608	\r
	1609	free(keyBlock);\r
	1610	return 0;\r
	1611	}\r
	1612	\r
	1613	int CmdT55xxBruteForce_downlink(const char *Cmd) {\r
	1614	\r
	1615	// load a default pwd file.\r
	1616	char buf[9];\r
	1617	char filename[FILE_PATH_SIZE]={0};\r
	1618	int keycnt = 0;\r
	1619	uint8_t downlink_mode = 0;\r
	1620	int ch;\r
	1621	uint8_t stKeyBlock = 20;\r
	1622	uint8_t keyBlock = NULL, p = NULL;\r
	1623	uint32_t start_password = 0x00000000; //start password\r
	1624	uint32_t end_password = 0xFFFFFFFF; //end password\r
	1625	bool found = false;\r
	1626	uint8_t cmdp = 0;\r
	1627	int cmd_offset = 0;\r
	1628	int errors = 0;\r
	1629	int len;\r
	1630	bool use_file = false;\r
	1631	bool use_range = false;\r
	1632	bool try_all_dl_modes = false;\r
	1633	uint8_t dl_mode = 0;\r
	1634	\r
	1635	keyBlock = calloc(stKeyBlock, 6);\r
	1636	if (keyBlock == NULL) return 1;\r
	1637	\r
	1638	PrintAndLog("New Downlink Supprt");\r
	1639	\r
	1640	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	1641	switch(param_getchar(Cmd, cmdp)) {\r
	1642	case 'h':\r
	1643	case 'H':\r
	1644	return usage_t55xx_bruteforce_downlink();\r
	1645	case 'e':\r
	1646	case 'E':\r
	1647	downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
	1648	if (downlink_mode == 4) try_all_dl_modes = true;\r
	1649	if (downlink_mode > 3) downlink_mode = 0;\r
	1650	cmdp +=2;\r
	1651	cmd_offset += 4;\r
	1652	PrintAndLog ("DL Mode : %d",downlink_mode);\r
	1653	break;\r
	1654	case 'i':\r
	1655	case 'I':\r
	1656	if (use_range) {\r
	1657	PrintAndLog ("use Range or File");\r
	1658	return 0;\r
	1659	}\r
	1660	use_file = true;\r
	1661	len = strlen(Cmd+2);\r
	1662	if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r
	1663	memcpy(filename, Cmd+cmd_offset+2, len);\r
	1664	cmdp += 2;\r
	1665	// PrintAndLog (" File : [%s]",filename);\r
	1666	break;\r
	1667	case 'r':\r
	1668	case 'R':\r
	1669	if (use_file) {\r
	1670	PrintAndLog ("use Range or File");\r
	1671	return 0;\r
	1672	}\r
	1673	use_range = true; // = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	1674	start_password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	1675	end_password = param_get32ex(Cmd, cmdp+2, 0, 16);\r
	1676	cmdp += 3;\r
	1677	cmd_offset += 20; // 8 + 8 + 1 + 1 + 1\r
	1678	// PrintAndLog (" Range : [%0X] - [%0X]",start_password,end_password);\r
	1679	break;\r
	1680	default:\r
	1681	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	1682	errors = true;\r
	1683	break;\r
	1684	}\r
	1685	}\r
	1686	\r
	1687	\r
	1688	// if (cmdp == 'i' \|\| cmdp == 'I') {\r
	1689	\r
	1690	if (use_file)\r
	1691	{\r
	1692	FILE * f = fopen( filename , "r");\r
	1693	\r
	1694	if ( !f ) {\r
	1695	PrintAndLog("File: %s: not found or locked.", filename);\r
	1696	free(keyBlock);\r
	1697	return 1;\r
	1698	}\r
	1699	\r
	1700	while( fgets(buf, sizeof(buf), f) ) {\r
	1701	if (strlen(buf) < 8 \|\| buf[7] == '\n') continue;\r
	1702	\r
	1703	while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r
	1704	\r
	1705	//The line start with # is comment, skip\r
	1706	if( buf[0]=='#' ) continue;\r
	1707	\r
	1708	if (!isxdigit((unsigned char)buf[0])) {\r
	1709	PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r
	1710	continue;\r
	1711	}\r
	1712	\r
	1713	buf[8] = 0;\r
	1714	\r
	1715	if ( stKeyBlock - keycnt < 2) {\r
	1716	p = realloc(keyBlock, 6*(stKeyBlock+=10));\r
	1717	if (!p) {\r
	1718	PrintAndLog("Cannot allocate memory for defaultKeys");\r
	1719	free(keyBlock);\r
	1720	fclose(f);\r
	1721	return 2;\r
	1722	}\r
	1723	keyBlock = p;\r
	1724	}\r
	1725	memset(keyBlock + 4 * keycnt, 0, 4);\r
	1726	num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r
	1727	PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r
	1728	keycnt++;\r
	1729	memset(buf, 0, sizeof(buf));\r
	1730	}\r
	1731	fclose(f);\r
	1732	\r
	1733	if (keycnt == 0) {\r
	1734	PrintAndLog("No keys found in file");\r
	1735	free(keyBlock);\r
	1736	return 1;\r
	1737	}\r
	1738	PrintAndLog("Loaded %d keys", keycnt);\r
	1739	\r
	1740	// loop\r
	1741	uint64_t testpwd = 0x00;\r
	1742	for (uint16_t c = 0; c < keycnt; ++c ) {\r
	1743	\r
	1744	if (ukbhit()) {\r
	1745	ch = getchar();\r
	1746	(void)ch;\r
	1747	printf("\naborted via keyboard!\n");\r
	1748	free(keyBlock);\r
	1749	return 0;\r
	1750	}\r
	1751	\r
	1752	testpwd = bytes_to_num(keyBlock + 4*c, 4);\r
	1753	\r
	1754	PrintAndLog("Testing %08X", testpwd);\r
	1755	\r
	1756	// Try each downlink_mode of asked to \r
	1757	// donwlink_mode will = 0 if > 3 or set to 0, so loop from 0 - 3\r
	1758	for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++)\r
	1759	{\r
	1760	if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,dl_mode)) {\r
	1761	PrintAndLog("Aquireing data from device failed. Quitting");\r
	1762	free(keyBlock);\r
	1763	return 0;\r
	1764	}\r
	1765	\r
	1766	found = tryDetectModulation();\r
	1767	\r
	1768	if ( found ) {\r
	1769	PrintAndLog("Found valid password: [%08X]", testpwd);\r
	1770	free(keyBlock);\r
	1771	// Add downlink mode to reference.\r
	1772	switch (dl_mode) {\r
	1773	case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r
	1774	case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r
	1775	case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r
	1776	case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r
	1777	}\r
	1778	return 0;\r
	1779	}\r
	1780	if (!try_all_dl_modes) // Exit loop\r
	1781	dl_mode = 4;\r
	1782	}\r
	1783	}\r
	1784	PrintAndLog("Password NOT found.");\r
	1785	free(keyBlock);\r
	1786	return 0;\r
	1787	}\r
	1788	\r
	1789	if (use_range)\r
	1790	{\r
	1791	// incremental pwd range search\r
	1792	// start_password = param_get32ex(Cmd, 0, 0, 16);\r
	1793	// end_password = param_get32ex(Cmd, 1, 0, 16);\r
	1794	\r
	1795	if ( start_password >= end_password ) {\r
	1796	free(keyBlock);\r
	1797	return usage_t55xx_bruteforce_downlink();\r
	1798	}\r
	1799	PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r
	1800	\r
	1801	uint32_t i = start_password;\r
	1802	\r
	1803	while ((!found) && (i <= end_password)) {\r
	1804	\r
	1805	printf(".");\r
	1806	fflush(stdout);\r
	1807	if (ukbhit()) {\r
	1808	ch = getchar();\r
	1809	(void)ch;\r
	1810	printf("\naborted via keyboard!\n");\r
	1811	free(keyBlock);\r
	1812	return 0;\r
	1813	}\r
	1814	\r
	1815	if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r
	1816	PrintAndLog("Aquireing data from device failed. Quitting");\r
	1817	free(keyBlock);\r
	1818	return 0;\r
	1819	}\r
	1820	found = tryDetectModulation();\r
	1821	\r
	1822	if (found) break;\r
	1823	i++;\r
	1824	}\r
	1825	\r
	1826	PrintAndLog("");\r
	1827	\r
	1828	if (found) {\r
	1829	PrintAndLog("Found valid password: [%08x]", i);\r
	1830	// Add downlink mode to reference.\r
	1831	switch (downlink_mode) {\r
	1832	case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r
	1833	case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r
	1834	case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r
	1835	case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r
	1836	}\r
	1837	}\r
	1838	else\r
	1839	PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r
	1840	\r
	1841	free(keyBlock);\r
	1842	}\r
	1843	return 0;\r
	1844	}\r
	1845	\r
	1846	// note length of data returned is different for different chips. \r
	1847	// some return all page 1 (64 bits) and others return just that block (32 bits) \r
	1848	// unfortunately the 64 bits makes this more likely to get a false positive...\r
	1849	bool tryDetectP1(bool getData) {\r
	1850	uint8_t preamble[] = {1,1,1,0,0,0,0,0,0,0,0,1,0,1,0,1};\r
	1851	size_t startIdx = 0;\r
	1852	uint8_t fc1 = 0, fc2 = 0, ans = 0;\r
	1853	int clk = 0, firstClockEdge = 0;\r
	1854	bool st = true;\r
	1855	\r
	1856	if ( getData ) {\r
	1857	if ( !AquireData(T55x7_PAGE1, 1, false, 0,0) )\r
	1858	return false;\r
	1859	}\r
	1860	\r
	1861	// try fsk clock detect. if successful it cannot be any other type of modulation... (in theory...)\r
	1862	ans = fskClocks(&fc1, &fc2, (uint8_t *)&clk, false, &firstClockEdge);\r
	1863	if (ans && ((fc1==10 && fc2==8) \|\| (fc1==8 && fc2==5))) {\r
	1864	if ( FSKrawDemod("0 0", false) && \r
	1865	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1866	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1867	return true;\r
	1868	}\r
	1869	if ( FSKrawDemod("0 1", false) && \r
	1870	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1871	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1872	return true;\r
	1873	}\r
	1874	return false;\r
	1875	}\r
	1876	\r
	1877	// try psk clock detect. if successful it cannot be any other type of modulation... (in theory...)\r
	1878	clk = GetPskClock("", false, false);\r
	1879	if (clk>0) {\r
	1880	// allow undo\r
	1881	// save_restoreGB(1);\r
	1882	// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
	1883	//CmdLtrim("160");\r
	1884	if ( PSKDemod("0 0 6", false) &&\r
	1885	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1886	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1887	//save_restoreGB(0);\r
	1888	return true;\r
	1889	}\r
	1890	if ( PSKDemod("0 1 6", false) &&\r
	1891	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1892	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1893	//save_restoreGB(0);\r
	1894	return true;\r
	1895	}\r
	1896	// PSK2 - needs a call to psk1TOpsk2.\r
	1897	if ( PSKDemod("0 0 6", false)) {\r
	1898	psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
	1899	if (preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1900	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1901	//save_restoreGB(0);\r
	1902	return true;\r
	1903	}\r
	1904	} // inverse waves does not affect PSK2 demod\r
	1905	//undo trim samples\r
	1906	//save_restoreGB(0); \r
	1907	// no other modulation clocks = 2 or 4 so quit searching\r
	1908	if (fc1 != 8) return false;\r
	1909	}\r
	1910	\r
	1911	// try ask clock detect. it could be another type even if successful.\r
	1912	clk = GetAskClock("", false, false);\r
	1913	if (clk>0) {\r
	1914	if ( ASKDemod_ext("0 0 1", false, false, 1, &st) &&\r
	1915	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1916	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1917	return true;\r
	1918	}\r
	1919	st = true;\r
	1920	if ( ASKDemod_ext("0 1 1", false, false, 1, &st) &&\r
	1921	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1922	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1923	return true;\r
	1924	}\r
	1925	if ( ASKbiphaseDemod("0 0 0 2", false) &&\r
	1926	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1927	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1928	return true;\r
	1929	}\r
	1930	if ( ASKbiphaseDemod("0 0 1 2", false) &&\r
	1931	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1932	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1933	return true;\r
	1934	}\r
	1935	}\r
	1936	\r
	1937	// try NRZ clock detect. it could be another type even if successful.\r
	1938	clk = GetNrzClock("", false, false); //has the most false positives :(\r
	1939	if (clk>0) {\r
	1940	if ( NRZrawDemod("0 0 1", false) &&\r
	1941	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1942	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1943	return true;\r
	1944	}\r
	1945	if ( NRZrawDemod("0 1 1", false) &&\r
	1946	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1947	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1948	return true;\r
	1949	}\r
	1950	}\r
	1951	return false;\r
	1952	}\r
	1953	// does this need to be a callable command?\r
	1954	int CmdT55xxDetectPage1(const char *Cmd){\r
	1955	bool errors = false;\r
	1956	bool useGB = false;\r
	1957	bool usepwd = false;\r
	1958	uint32_t password = 0;\r
	1959	uint8_t cmdp = 0;\r
	1960	\r
	1961	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	1962	switch(param_getchar(Cmd, cmdp)) {\r
	1963	case 'h':\r
	1964	case 'H':\r
	1965	return usage_t55xx_detectP1();\r
	1966	case 'p':\r
	1967	case 'P':\r
	1968	password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	1969	usepwd = true;\r
	1970	cmdp += 2;\r
	1971	break;\r
	1972	case '1':\r
	1973	// use Graphbuffer data\r
	1974	useGB = true;\r
	1975	cmdp++;\r
	1976	break;\r
	1977	default:\r
	1978	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	1979	errors = true;\r
	1980	break;\r
	1981	}\r
	1982	}\r
	1983	if (errors) return usage_t55xx_detectP1();\r
	1984	\r
	1985	if ( !useGB ) {\r
	1986	if ( !AquireData(T55x7_PAGE1, 1, usepwd, password,0) )\r
	1987	return false;\r
	1988	}\r
	1989	bool success = tryDetectP1(false);\r
	1990	if (success) PrintAndLog("T55xx chip found!");\r
	1991	return success;\r
	1992	}\r
	1993	\r
	1994	static command_t CommandTable[] = {\r
	1995	{"help", CmdHelp, 1, "This help"},\r
	1996	{"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},\r
	1997	{"bruteforcedl",CmdT55xxBruteForce_downlink,0, "r <start password> <end password> [i <*.dic>] [e <downlink>] Simple bruteforce attack to find password"},\r
	1998	{"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},\r
	1999	{"detect", CmdT55xxDetect, 1, "[1] Try detecting the tag modulation from reading the configuration block."},\r
	2000	{"p1detect", CmdT55xxDetectPage1,1, "[1] Try detecting if this is a t55xx tag by reading page 1"},\r
	2001	{"read", CmdT55xxReadBlock, 0, "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},\r
	2002	{"resetread", CmdResetRead, 0, "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},\r
	2003	{"write", CmdT55xxWriteBlock,0, "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},\r
	2004	{"trace", CmdT55xxReadTrace, 1, "[1] Show T55x7 traceability data (page 1/ blk 0-1)"},\r
	2005	{"info", CmdT55xxInfo, 1, "[1] Show T55x7 configuration data (page 0/ blk 0)"},\r
	2006	{"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},\r
	2007	{"special", special, 0, "Show block changes with 64 different offsets"},\r
	2008	{"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},\r
	2009	{"wipe", CmdT55xxWipe, 0, "[q] Wipe a T55xx tag and set defaults (will destroy any data on tag)"},\r
	2010	{NULL, NULL, 0, NULL}\r
	2011	};\r
	2012	\r
	2013	int CmdLFT55XX(const char *Cmd) {\r
	2014	CmdsParse(CommandTable, Cmd);\r
	2015	return 0;\r
	2016	}\r
	2017	\r
	2018	int CmdHelp(const char *Cmd) {\r
	2019	CmdsHelp(CommandTable);\r
	2020	return 0;\r
	2021	}\r