git.zerfleddert.de Git - proxmark3-svn/blame_incremental

... / ...

Commit	Line	Data
	1	//-----------------------------------------------------------------------------\r
	2	//\r
	3	// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
	4	// at your option, any later version. See the LICENSE.txt file for the text of\r
	5	// the license.\r
	6	//-----------------------------------------------------------------------------\r
	7	// Low frequency T55xx commands\r
	8	//-----------------------------------------------------------------------------\r
	9	\r
	10	#include "cmdlft55xx.h"\r
	11	\r
	12	#include <stdio.h>\r
	13	#include <string.h>\r
	14	#include <inttypes.h>\r
	15	#include <ctype.h>\r
	16	#include <time.h>\r
	17	#include "comms.h"\r
	18	#include "ui.h"\r
	19	#include "graph.h"\r
	20	#include "cmdmain.h"\r
	21	#include "cmdparser.h"\r
	22	#include "cmddata.h"\r
	23	#include "cmdlf.h"\r
	24	#include "util.h"\r
	25	#include "lfdemod.h"\r
	26	#include "protocols.h"\r
	27	#include "taginfo.h"\r
	28	\r
	29	#define T55x7_CONFIGURATION_BLOCK 0x00\r
	30	#define T55x7_PAGE0 0x00\r
	31	#define T55x7_PAGE1 0x01\r
	32	//#define T55x7_PWD 0x00000010\r
	33	#define REGULAR_READ_MODE_BLOCK 0xFF\r
	34	\r
	35	// Default configuration\r
	36	t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = false, .offset = 0x00, .block0 = 0x00, .Q5 = false };\r
	37	\r
	38	t55xx_conf_block_t Get_t55xx_Config(){\r
	39	return config;\r
	40	}\r
	41	void Set_t55xx_Config(t55xx_conf_block_t conf){\r
	42	config = conf;\r
	43	}\r
	44	\r
	45	int usage_t55xx_config(){\r
	46	PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");\r
	47	PrintAndLog("Options:");\r
	48	PrintAndLog(" h This help");\r
	49	PrintAndLog(" b <8\|16\|32\|40\|50\|64\|100\|128> Set bitrate");\r
	50	PrintAndLog(" d <FSK\|FSK1\|FSK1a\|FSK2\|FSK2a\|ASK\|PSK1\|PSK2\|NRZ\|BI\|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");\r
	51	PrintAndLog(" i [1] Invert data signal, defaults to normal");\r
	52	PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");\r
	53	PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");\r
	54	PrintAndLog(" ST Set Sequence Terminator on");\r
	55	PrintAndLog("");\r
	56	PrintAndLog("Examples:");\r
	57	PrintAndLog(" lf t55xx config d FSK - FSK demodulation");\r
	58	PrintAndLog(" lf t55xx config d FSK i 1 - FSK demodulation, inverse data");\r
	59	PrintAndLog(" lf t55xx config d FSK i 1 o 3 - FSK demodulation, inverse data, offset=3,start from position 3 to decode data");\r
	60	PrintAndLog("");\r
	61	return 0;\r
	62	}\r
	63	int usage_t55xx_read(){\r
	64	PrintAndLog("Usage: lf t55xx read [b <block>] [p <password>] <override_safety> <page1>");\r
	65	PrintAndLog("Options:");\r
	66	PrintAndLog(" b <block> - block number to read. Between 0-7");\r
	67	PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r
	68	PrintAndLog(" o - OPTIONAL override safety check");\r
	69	PrintAndLog(" 1 - OPTIONAL read Page 1 instead of Page 0");\r
	70	PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference"); \r
	71	PrintAndLog(" '2' Leading Zero, '3' 1 of 4 "); \r
	72	PrintAndLog(" **WARNING**");\r
	73	PrintAndLog(" Use of read with password on a tag not configured for a pwd");\r
	74	PrintAndLog(" can damage the tag");\r
	75	PrintAndLog("");\r
	76	PrintAndLog("Examples:");\r
	77	PrintAndLog(" lf t55xx read b 0 - read data from block 0");\r
	78	PrintAndLog(" lf t55xx read b 0 p feedbeef - read data from block 0 password feedbeef");\r
	79	PrintAndLog(" lf t55xx read b 0 p feedbeef o - read data from block 0 password feedbeef safety check");\r
	80	PrintAndLog("");\r
	81	return 0;\r
	82	}\r
	83	int usage_t55xx_write(){\r
	84	PrintAndLog("Usage: lf t55xx write [b <block>] [d <data>] [p <password>] [1] [t]");\r
	85	PrintAndLog("Options:");\r
	86	PrintAndLog(" b <block> - block number to write. Between 0-7");\r
	87	PrintAndLog(" d <data> - 4 bytes of data to write (8 hex characters)");\r
	88	PrintAndLog(" p <password> - OPTIONAL password 4bytes (8 hex characters)");\r
	89	PrintAndLog(" 1 - OPTIONAL write Page 1 instead of Page 0");\r
	90	PrintAndLog(" t - OPTIONAL test mode write - **DANGER**"); \r
	91	PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference"); \r
	92	PrintAndLog(" '2' Leading Zero, '3' 1 of 4 "); \r
	93	PrintAndLog("");\r
	94	PrintAndLog("Examples:");\r
	95	PrintAndLog(" lf t55xx write b 3 d 11223344 - write 11223344 to block 3");\r
	96	PrintAndLog(" lf t55xx write b 3 d 11223344 p feedbeef - write 11223344 to block 3 password feedbeef");\r
	97	PrintAndLog("");\r
	98	return 0;\r
	99	}\r
	100	int usage_t55xx_trace() {\r
	101	PrintAndLog("Usage: lf t55xx trace [1]");\r
	102	PrintAndLog("Options:");\r
	103	PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");\r
	104	PrintAndLog("");\r
	105	PrintAndLog("Examples:");\r
	106	PrintAndLog(" lf t55xx trace");\r
	107	PrintAndLog(" lf t55xx trace 1");\r
	108	PrintAndLog("");\r
	109	return 0;\r
	110	}\r
	111	int usage_t55xx_info() {\r
	112	PrintAndLog("Usage: lf t55xx info [1]");\r
	113	PrintAndLog("Options:");\r
	114	PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");\r
	115	PrintAndLog("");\r
	116	PrintAndLog("Examples:");\r
	117	PrintAndLog(" lf t55xx info");\r
	118	PrintAndLog(" lf t55xx info 1");\r
	119	PrintAndLog("");\r
	120	return 0;\r
	121	}\r
	122	int usage_t55xx_dump(){\r
	123	PrintAndLog("Usage: lf t55xx dump <password> [o]");\r
	124	PrintAndLog("Options:");\r
	125	PrintAndLog(" <password> - OPTIONAL password 4bytes (8 hex symbols)");\r
	126	PrintAndLog(" o - OPTIONAL override, force pwd read despite danger to card");\r
	127	PrintAndLog("");\r
	128	PrintAndLog("Examples:");\r
	129	PrintAndLog(" lf t55xx dump");\r
	130	PrintAndLog(" lf t55xx dump feedbeef o");\r
	131	PrintAndLog("");\r
	132	return 0;\r
	133	}\r
	134	int usage_t55xx_detect(){\r
	135	PrintAndLog("Usage: lf t55xx detect [1] [p <password>]");\r
	136	PrintAndLog("Options:");\r
	137	PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");\r
	138	PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r
	139	PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference");\r
	140	PrintAndLog(" '2' Leading Zero, '3' 1 of 4 "); \r
	141	PrintAndLog("");\r
	142	PrintAndLog("Examples:");\r
	143	PrintAndLog(" lf t55xx detect");\r
	144	PrintAndLog(" lf t55xx detect 1");\r
	145	PrintAndLog(" lf t55xx detect p 11223344");\r
	146	PrintAndLog("");\r
	147	return 0;\r
	148	}\r
	149	int usage_t55xx_detectP1(){\r
	150	PrintAndLog("Command: Detect Page 1 of a t55xx chip");\r
	151	PrintAndLog("Usage: lf t55xx p1detect [1] [p <password>]");\r
	152	PrintAndLog("Options:");\r
	153	PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");\r
	154	PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");\r
	155	PrintAndLog("");\r
	156	PrintAndLog("Examples:");\r
	157	PrintAndLog(" lf t55xx p1detect");\r
	158	PrintAndLog(" lf t55xx p1detect 1");\r
	159	PrintAndLog(" lf t55xx p1detect p 11223344");\r
	160	PrintAndLog("");\r
	161	return 0;\r
	162	}\r
	163	int usage_t55xx_wakup(){\r
	164	PrintAndLog("Usage: lf t55xx wakeup [h] <password>");\r
	165	PrintAndLog("This commands send the Answer-On-Request command and leaves the readerfield ON afterwards.");\r
	166	PrintAndLog("Options:");\r
	167	PrintAndLog(" h - this help");\r
	168	PrintAndLog(" <password> - [required] password 4bytes (8 hex symbols)");\r
	169	PrintAndLog("");\r
	170	PrintAndLog("Examples:");\r
	171	PrintAndLog(" lf t55xx wakeup 11223344 - send wakeup password");\r
	172	return 0;\r
	173	}\r
	174	int usage_t55xx_bruteforce(){\r
	175	PrintAndLog("This command uses A) bruteforce to scan a number range");\r
	176	PrintAndLog(" B) a dictionary attack");\r
	177	PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r
	178	PrintAndLog(" password must be 4 bytes (8 hex symbols)");\r
	179	PrintAndLog("Options:");\r
	180	PrintAndLog(" h - this help");\r
	181	PrintAndLog(" <start_pwd> - 4 byte hex value to start pwd search at");\r
	182	PrintAndLog(" <end_pwd> - 4 byte hex value to end pwd search at");\r
	183	PrintAndLog(" i <.dic> - loads a default keys dictionary file <.dic>");\r
	184	PrintAndLog("");\r
	185	PrintAndLog("Examples:");\r
	186	PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r
	187	PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");\r
	188	PrintAndLog("");\r
	189	return 0;\r
	190	}\r
	191	int usage_t55xx_bruteforce_downlink(){\r
	192	PrintAndLog("This command uses A) bruteforce to scan a number range");\r
	193	PrintAndLog(" B) a dictionary attack");\r
	194	PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r
	195	PrintAndLog(" password must be 4 bytes (8 hex symbols)");\r
	196	PrintAndLog("Options:");\r
	197	PrintAndLog(" h - this help");\r
	198	PrintAndLog(" r <start_pwd> <end_pwd> - 4 byte hex value to start and end pwd search at");\r
	199	PrintAndLog(" i <.dic> - loads a default keys dictionary file <.dic>");\r
	200	PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference"); \r
	201	PrintAndLog(" '2' Leading Zero, '3' 1 of 4 "); \r
	202	PrintAndLog("");\r
	203	PrintAndLog("Examples:");\r
	204	PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r
	205	PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");\r
	206	PrintAndLog("");\r
	207	return 0;\r
	208	}\r
	209	int usage_t55xx_wipe(){\r
	210	PrintAndLog("Usage: lf t55xx wipe [h] [Q5]");\r
	211	PrintAndLog("This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block");\r
	212	PrintAndLog("Options:");\r
	213	PrintAndLog(" h - this help");\r
	214	PrintAndLog(" Q5 - indicates to use the T5555 (Q5) default configuration block");\r
	215	PrintAndLog("");\r
	216	PrintAndLog("Examples:");\r
	217	PrintAndLog(" lf t55xx wipe - wipes a t55x7 tag, config block 0x000880E0");\r
	218	PrintAndLog(" lf t55xx wipe Q5 - wipes a t5555 Q5 tag, config block 0x6001F004");\r
	219	return 0;\r
	220	}\r
	221	\r
	222	\r
	223	static int CmdHelp(const char *Cmd);\r
	224	\r
	225	void printT5xxHeader(uint8_t page){\r
	226	PrintAndLog("Reading Page %d:", page);\r
	227	PrintAndLog("blk \| hex data \| binary");\r
	228	PrintAndLog("----+----------+---------------------------------"); \r
	229	}\r
	230	\r
	231	int CmdT55xxSetConfig(const char *Cmd) {\r
	232	\r
	233	uint8_t offset = 0;\r
	234	char modulation[6] = {0x00};\r
	235	char tmp = 0x00;\r
	236	uint8_t bitRate = 0;\r
	237	uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};\r
	238	uint8_t cmdp = 0;\r
	239	bool errors = false;\r
	240	while(param_getchar(Cmd, cmdp) != 0x00 && !errors)\r
	241	{\r
	242	tmp = param_getchar(Cmd, cmdp);\r
	243	switch(tmp)\r
	244	{\r
	245	case 'h':\r
	246	case 'H':\r
	247	return usage_t55xx_config();\r
	248	case 'b':\r
	249	errors \|= param_getdec(Cmd, cmdp+1, &bitRate);\r
	250	if ( !errors){\r
	251	uint8_t i = 0;\r
	252	for (; i < 9; i++){\r
	253	if (rates[i]==bitRate) {\r
	254	config.bitrate = i;\r
	255	break;\r
	256	}\r
	257	}\r
	258	if (i==9) errors = true;\r
	259	}\r
	260	cmdp+=2;\r
	261	break;\r
	262	case 'd':\r
	263	param_getstr(Cmd, cmdp+1, modulation, sizeof(modulation));\r
	264	cmdp += 2;\r
	265	\r
	266	if ( strcmp(modulation, "FSK" ) == 0) {\r
	267	config.modulation = DEMOD_FSK;\r
	268	} else if ( strcmp(modulation, "FSK1" ) == 0) {\r
	269	config.modulation = DEMOD_FSK1;\r
	270	config.inverted=1;\r
	271	} else if ( strcmp(modulation, "FSK1a" ) == 0) {\r
	272	config.modulation = DEMOD_FSK1a;\r
	273	config.inverted=0;\r
	274	} else if ( strcmp(modulation, "FSK2" ) == 0) {\r
	275	config.modulation = DEMOD_FSK2;\r
	276	config.inverted=0;\r
	277	} else if ( strcmp(modulation, "FSK2a" ) == 0) {\r
	278	config.modulation = DEMOD_FSK2a;\r
	279	config.inverted=1;\r
	280	} else if ( strcmp(modulation, "ASK" ) == 0) {\r
	281	config.modulation = DEMOD_ASK;\r
	282	} else if ( strcmp(modulation, "NRZ" ) == 0) {\r
	283	config.modulation = DEMOD_NRZ;\r
	284	} else if ( strcmp(modulation, "PSK1" ) == 0) {\r
	285	config.modulation = DEMOD_PSK1;\r
	286	} else if ( strcmp(modulation, "PSK2" ) == 0) {\r
	287	config.modulation = DEMOD_PSK2;\r
	288	} else if ( strcmp(modulation, "PSK3" ) == 0) {\r
	289	config.modulation = DEMOD_PSK3;\r
	290	} else if ( strcmp(modulation, "BIa" ) == 0) {\r
	291	config.modulation = DEMOD_BIa;\r
	292	config.inverted=1;\r
	293	} else if ( strcmp(modulation, "BI" ) == 0) {\r
	294	config.modulation = DEMOD_BI;\r
	295	config.inverted=0;\r
	296	} else {\r
	297	PrintAndLog("Unknown modulation '%s'", modulation);\r
	298	errors = true;\r
	299	}\r
	300	break;\r
	301	case 'i':\r
	302	config.inverted = param_getchar(Cmd,cmdp+1) == '1';\r
	303	cmdp+=2;\r
	304	break;\r
	305	case 'o':\r
	306	errors \|= param_getdec(Cmd, cmdp+1, &offset);\r
	307	if ( !errors )\r
	308	config.offset = offset;\r
	309	cmdp+=2;\r
	310	break;\r
	311	case 'Q':\r
	312	case 'q': \r
	313	config.Q5 = true;\r
	314	cmdp++;\r
	315	break;\r
	316	case 'S':\r
	317	case 's': \r
	318	config.ST = true;\r
	319	cmdp++;\r
	320	break;\r
	321	default:\r
	322	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	323	errors = true;\r
	324	break;\r
	325	}\r
	326	}\r
	327	\r
	328	// No args\r
	329	if (cmdp == 0) return printConfiguration( config );\r
	330	\r
	331	//Validations\r
	332	if (errors) return usage_t55xx_config();\r
	333	\r
	334	config.block0 = 0;\r
	335	return printConfiguration ( config );\r
	336	}\r
	337	\r
	338	int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32_t password, uint8_t downlink_mode){\r
	339	//Password mode\r
	340	if ( usepwd ) {\r
	341	// try reading the config block and verify that PWD bit is set before doing this!\r
	342	if ( !override ) {\r
	343	if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0,downlink_mode ) ) return 0;\r
	344	if ( !tryDetectModulation() ) {\r
	345	PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");\r
	346	return 0;\r
	347	} else {\r
	348	PrintAndLog("Safety Check: PWD bit is NOT set in config block. Reading without password..."); \r
	349	usepwd = false;\r
	350	page1 = false;\r
	351	}\r
	352	} else {\r
	353	PrintAndLog("Safety Check Overriden - proceeding despite risk");\r
	354	}\r
	355	}\r
	356	\r
	357	if (!AquireData(page1, block, usepwd, password,downlink_mode) ) return 0;\r
	358	if (!DecodeT55xxBlock()) return 0;\r
	359	\r
	360	char blk[10]={0};\r
	361	sprintf(blk,"%d", block);\r
	362	printT55xxBlock(blk); \r
	363	return 1;\r
	364	}\r
	365	\r
	366	int CmdT55xxReadBlock(const char *Cmd) {\r
	367	uint8_t block = REGULAR_READ_MODE_BLOCK;\r
	368	uint32_t password = 0; //default to blank Block 7\r
	369	uint8_t downlink_mode = 0;\r
	370	\r
	371	bool usepwd = false;\r
	372	bool override = false;\r
	373	bool page1 = false;\r
	374	bool errors = false;\r
	375	uint8_t cmdp = 0;\r
	376	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	377	switch(param_getchar(Cmd, cmdp)) {\r
	378	case 'h':\r
	379	case 'H':\r
	380	return usage_t55xx_read();\r
	381	case 'b':\r
	382	case 'B':\r
	383	errors \|= param_getdec(Cmd, cmdp+1, &block);\r
	384	cmdp += 2;\r
	385	break;\r
	386	case 'o':\r
	387	case 'O':\r
	388	override = true;\r
	389	cmdp++;\r
	390	break;\r
	391	case 'p':\r
	392	case 'P':\r
	393	password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	394	usepwd = true;\r
	395	cmdp += 2;\r
	396	break;\r
	397	case '1':\r
	398	page1 = true;\r
	399	cmdp++;\r
	400	break;\r
	401	case 'e':\r
	402	case 'E':\r
	403	downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
	404	if (downlink_mode > 3) downlink_mode = 0;\r
	405	cmdp +=2;\r
	406	break;\r
	407	default:\r
	408	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	409	errors = true;\r
	410	break;\r
	411	}\r
	412	}\r
	413	if (errors) return usage_t55xx_read();\r
	414	\r
	415	if (block > 7 && block != REGULAR_READ_MODE_BLOCK ) {\r
	416	PrintAndLog("Block must be between 0 and 7");\r
	417	return 0;\r
	418	}\r
	419	\r
	420	printT5xxHeader(page1);\r
	421	return T55xxReadBlock(block, page1, usepwd, override, password, downlink_mode);\r
	422	}\r
	423	\r
	424	bool DecodeT55xxBlock(){\r
	425	\r
	426	char buf[30] = {0x00};\r
	427	char *cmdStr = buf;\r
	428	int ans = 0;\r
	429	bool ST = config.ST;\r
	430	uint8_t bitRate[8] = {8,16,32,40,50,64,100,128};\r
	431	DemodBufferLen = 0x00;\r
	432	\r
	433	switch( config.modulation ){\r
	434	case DEMOD_FSK:\r
	435	snprintf(cmdStr, sizeof(buf),"%d %d", bitRate[config.bitrate], config.inverted );\r
	436	ans = FSKrawDemod(cmdStr, false);\r
	437	break;\r
	438	case DEMOD_FSK1:\r
	439	case DEMOD_FSK1a:\r
	440	snprintf(cmdStr, sizeof(buf),"%d %d 8 5", bitRate[config.bitrate], config.inverted );\r
	441	ans = FSKrawDemod(cmdStr, false);\r
	442	break;\r
	443	case DEMOD_FSK2:\r
	444	case DEMOD_FSK2a:\r
	445	snprintf(cmdStr, sizeof(buf),"%d %d 10 8", bitRate[config.bitrate], config.inverted );\r
	446	ans = FSKrawDemod(cmdStr, false);\r
	447	break;\r
	448	case DEMOD_ASK:\r
	449	snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );\r
	450	ans = ASKDemod_ext(cmdStr, false, false, 1, &ST);\r
	451	break;\r
	452	case DEMOD_PSK1:\r
	453	// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
	454	save_restoreGB(GRAPH_SAVE);\r
	455	CmdLtrim("160");\r
	456	snprintf(cmdStr, sizeof(buf),"%d %d 6", bitRate[config.bitrate], config.inverted );\r
	457	ans = PSKDemod(cmdStr, false);\r
	458	//undo trim samples\r
	459	save_restoreGB(GRAPH_RESTORE);\r
	460	break;\r
	461	case DEMOD_PSK2: //inverted won't affect this\r
	462	case DEMOD_PSK3: //not fully implemented\r
	463	// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
	464	save_restoreGB(GRAPH_SAVE);\r
	465	CmdLtrim("160");\r
	466	snprintf(cmdStr, sizeof(buf),"%d 0 6", bitRate[config.bitrate] );\r
	467	ans = PSKDemod(cmdStr, false);\r
	468	psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
	469	//undo trim samples\r
	470	save_restoreGB(GRAPH_RESTORE);\r
	471	break;\r
	472	case DEMOD_NRZ:\r
	473	snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );\r
	474	ans = NRZrawDemod(cmdStr, false);\r
	475	break;\r
	476	case DEMOD_BI:\r
	477	case DEMOD_BIa:\r
	478	snprintf(cmdStr, sizeof(buf),"0 %d %d 1", bitRate[config.bitrate], config.inverted );\r
	479	ans = ASKbiphaseDemod(cmdStr, false);\r
	480	break;\r
	481	default:\r
	482	return false;\r
	483	}\r
	484	return (bool) ans;\r
	485	}\r
	486	\r
	487	bool DecodeT5555TraceBlock() {\r
	488	DemodBufferLen = 0x00;\r
	489	\r
	490	// According to datasheet. Always: RF/64, not inverted, Manchester\r
	491	return (bool) ASKDemod("64 0 1", false, false, 1);\r
	492	}\r
	493	\r
	494	int CmdT55xxDetect(const char *Cmd){\r
	495	bool errors = false;\r
	496	bool useGB = false;\r
	497	bool usepwd = false;\r
	498	uint32_t password = 0;\r
	499	uint8_t cmdp = 0;\r
	500	uint8_t downlink_mode = 0;\r
	501	\r
	502	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	503	switch(param_getchar(Cmd, cmdp)) {\r
	504	case 'h':\r
	505	case 'H':\r
	506	return usage_t55xx_detect();\r
	507	case 'p':\r
	508	case 'P':\r
	509	password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	510	usepwd = true;\r
	511	cmdp += 2;\r
	512	break;\r
	513	case '1':\r
	514	// use Graphbuffer data\r
	515	useGB = true;\r
	516	cmdp++;\r
	517	break;\r
	518	case 'e':\r
	519	case 'E':\r
	520	downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
	521	if (downlink_mode > 3) downlink_mode = 0;\r
	522	cmdp +=2;\r
	523	break; \r
	524	default:\r
	525	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	526	errors = true;\r
	527	break;\r
	528	}\r
	529	}\r
	530	if (errors) return usage_t55xx_detect();\r
	531	\r
	532	if ( !useGB) {\r
	533	if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password,downlink_mode) )\r
	534	return 0;\r
	535	}\r
	536	\r
	537	if ( !tryDetectModulation() )\r
	538	PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");\r
	539	else {\r
	540	// Add downlink mode to reference.\r
	541	switch (downlink_mode) {\r
	542	case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r
	543	case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r
	544	case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r
	545	case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r
	546	// default:\r
	547	\r
	548	// No default action\r
	549	}\r
	550	}\r
	551	return 1;\r
	552	}\r
	553	\r
	554	// detect configuration?\r
	555	bool tryDetectModulation(){\r
	556	uint8_t hits = 0;\r
	557	t55xx_conf_block_t tests[15];\r
	558	int bitRate=0;\r
	559	uint8_t fc1 = 0, fc2 = 0, ans = 0;\r
	560	int clk = 0, firstClockEdge = 0;\r
	561	ans = fskClocks(&fc1, &fc2, (uint8_t *)&clk, false, &firstClockEdge);\r
	562	if (ans && ((fc1==10 && fc2==8) \|\| (fc1==8 && fc2==5))) {\r
	563	if ( FSKrawDemod("0 0", false) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	564	tests[hits].modulation = DEMOD_FSK;\r
	565	if (fc1==8 && fc2 == 5)\r
	566	tests[hits].modulation = DEMOD_FSK1a;\r
	567	else if (fc1==10 && fc2 == 8)\r
	568	tests[hits].modulation = DEMOD_FSK2;\r
	569	tests[hits].bitrate = bitRate;\r
	570	tests[hits].inverted = false;\r
	571	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	572	tests[hits].ST = false;\r
	573	++hits;\r
	574	}\r
	575	if ( FSKrawDemod("0 1", false) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	576	tests[hits].modulation = DEMOD_FSK;\r
	577	if (fc1 == 8 && fc2 == 5)\r
	578	tests[hits].modulation = DEMOD_FSK1;\r
	579	else if (fc1 == 10 && fc2 == 8)\r
	580	tests[hits].modulation = DEMOD_FSK2a;\r
	581	tests[hits].bitrate = bitRate;\r
	582	tests[hits].inverted = true;\r
	583	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	584	tests[hits].ST = false;\r
	585	++hits;\r
	586	}\r
	587	} else {\r
	588	clk = GetAskClock("", false, false);\r
	589	if (clk>0) {\r
	590	tests[hits].ST = true;\r
	591	if ( ASKDemod_ext("0 0 1", false, false, 1, &tests[hits].ST) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	592	tests[hits].modulation = DEMOD_ASK;\r
	593	tests[hits].bitrate = bitRate;\r
	594	tests[hits].inverted = false;\r
	595	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	596	++hits;\r
	597	}\r
	598	tests[hits].ST = true;\r
	599	if ( ASKDemod_ext("0 1 1", false, false, 1, &tests[hits].ST) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	600	tests[hits].modulation = DEMOD_ASK;\r
	601	tests[hits].bitrate = bitRate;\r
	602	tests[hits].inverted = true;\r
	603	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	604	++hits;\r
	605	}\r
	606	if ( ASKbiphaseDemod("0 0 0 2", false) && test(DEMOD_BI, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r
	607	tests[hits].modulation = DEMOD_BI;\r
	608	tests[hits].bitrate = bitRate;\r
	609	tests[hits].inverted = false;\r
	610	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	611	tests[hits].ST = false;\r
	612	++hits;\r
	613	}\r
	614	if ( ASKbiphaseDemod("0 0 1 2", false) && test(DEMOD_BIa, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {\r
	615	tests[hits].modulation = DEMOD_BIa;\r
	616	tests[hits].bitrate = bitRate;\r
	617	tests[hits].inverted = true;\r
	618	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	619	tests[hits].ST = false;\r
	620	++hits;\r
	621	}\r
	622	}\r
	623	clk = GetNrzClock("", false, false);\r
	624	if (clk>8) { //clock of rf/8 is likely a false positive, so don't use it.\r
	625	if ( NRZrawDemod("0 0 1", false) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	626	tests[hits].modulation = DEMOD_NRZ;\r
	627	tests[hits].bitrate = bitRate;\r
	628	tests[hits].inverted = false;\r
	629	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	630	tests[hits].ST = false;\r
	631	++hits;\r
	632	}\r
	633	\r
	634	if ( NRZrawDemod("0 1 1", false) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	635	tests[hits].modulation = DEMOD_NRZ;\r
	636	tests[hits].bitrate = bitRate;\r
	637	tests[hits].inverted = true;\r
	638	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	639	tests[hits].ST = false;\r
	640	++hits;\r
	641	}\r
	642	}\r
	643	\r
	644	clk = GetPskClock("", false, false);\r
	645	if (clk>0) {\r
	646	// allow undo\r
	647	save_restoreGB(GRAPH_SAVE);\r
	648	// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
	649	CmdLtrim("160");\r
	650	if ( PSKDemod("0 0 6", false) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	651	tests[hits].modulation = DEMOD_PSK1;\r
	652	tests[hits].bitrate = bitRate;\r
	653	tests[hits].inverted = false;\r
	654	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	655	tests[hits].ST = false;\r
	656	++hits;\r
	657	}\r
	658	if ( PSKDemod("0 1 6", false) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
	659	tests[hits].modulation = DEMOD_PSK1;\r
	660	tests[hits].bitrate = bitRate;\r
	661	tests[hits].inverted = true;\r
	662	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	663	tests[hits].ST = false;\r
	664	++hits;\r
	665	}\r
	666	// PSK2 - needs a call to psk1TOpsk2.\r
	667	if ( PSKDemod("0 0 6", false)) {\r
	668	psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
	669	if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
	670	tests[hits].modulation = DEMOD_PSK2;\r
	671	tests[hits].bitrate = bitRate;\r
	672	tests[hits].inverted = false;\r
	673	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	674	tests[hits].ST = false;\r
	675	++hits;\r
	676	}\r
	677	} // inverse waves does not affect this demod\r
	678	// PSK3 - needs a call to psk1TOpsk2.\r
	679	if ( PSKDemod("0 0 6", false)) {\r
	680	psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
	681	if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
	682	tests[hits].modulation = DEMOD_PSK3;\r
	683	tests[hits].bitrate = bitRate;\r
	684	tests[hits].inverted = false;\r
	685	tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
	686	tests[hits].ST = false;\r
	687	++hits;\r
	688	}\r
	689	} // inverse waves does not affect this demod\r
	690	//undo trim samples\r
	691	save_restoreGB(GRAPH_RESTORE);\r
	692	}\r
	693	} \r
	694	if ( hits == 1) {\r
	695	config.modulation = tests[0].modulation;\r
	696	config.bitrate = tests[0].bitrate;\r
	697	config.inverted = tests[0].inverted;\r
	698	config.offset = tests[0].offset;\r
	699	config.block0 = tests[0].block0;\r
	700	config.Q5 = tests[0].Q5;\r
	701	config.ST = tests[0].ST;\r
	702	printConfiguration( config );\r
	703	return true;\r
	704	}\r
	705	\r
	706	if ( hits > 1) {\r
	707	PrintAndLog("Found [%d] possible matches for modulation.",hits);\r
	708	for(int i=0; i<hits; ++i){\r
	709	PrintAndLog("--[%d]---------------", i+1);\r
	710	printConfiguration( tests[i] );\r
	711	}\r
	712	}\r
	713	return false;\r
	714	}\r
	715	\r
	716	bool testModulation(uint8_t mode, uint8_t modread){\r
	717	switch( mode ){\r
	718	case DEMOD_FSK:\r
	719	if (modread >= DEMOD_FSK1 && modread <= DEMOD_FSK2a) return true;\r
	720	break;\r
	721	case DEMOD_ASK:\r
	722	if (modread == DEMOD_ASK) return true;\r
	723	break;\r
	724	case DEMOD_PSK1:\r
	725	if (modread == DEMOD_PSK1) return true;\r
	726	break;\r
	727	case DEMOD_PSK2:\r
	728	if (modread == DEMOD_PSK2) return true;\r
	729	break;\r
	730	case DEMOD_PSK3:\r
	731	if (modread == DEMOD_PSK3) return true;\r
	732	break;\r
	733	case DEMOD_NRZ:\r
	734	if (modread == DEMOD_NRZ) return true;\r
	735	break;\r
	736	case DEMOD_BI:\r
	737	if (modread == DEMOD_BI) return true;\r
	738	break;\r
	739	case DEMOD_BIa:\r
	740	if (modread == DEMOD_BIa) return true;\r
	741	break; \r
	742	default:\r
	743	return false;\r
	744	}\r
	745	return false;\r
	746	}\r
	747	\r
	748	bool testQ5Modulation(uint8_t mode, uint8_t modread){\r
	749	switch( mode ){\r
	750	case DEMOD_FSK:\r
	751	if (modread >= 4 && modread <= 5) return true;\r
	752	break;\r
	753	case DEMOD_ASK:\r
	754	if (modread == 0) return true;\r
	755	break;\r
	756	case DEMOD_PSK1:\r
	757	if (modread == 1) return true;\r
	758	break;\r
	759	case DEMOD_PSK2:\r
	760	if (modread == 2) return true;\r
	761	break;\r
	762	case DEMOD_PSK3:\r
	763	if (modread == 3) return true;\r
	764	break;\r
	765	case DEMOD_NRZ:\r
	766	if (modread == 7) return true;\r
	767	break;\r
	768	case DEMOD_BI:\r
	769	if (modread == 6) return true;\r
	770	break;\r
	771	default:\r
	772	return false;\r
	773	}\r
	774	return false;\r
	775	}\r
	776	\r
	777	int convertQ5bitRate(uint8_t bitRateRead) {\r
	778	uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r
	779	for (int i=0; i<8; i++)\r
	780	if (expected[i] == bitRateRead)\r
	781	return i;\r
	782	\r
	783	return -1;\r
	784	}\r
	785	\r
	786	bool testQ5(uint8_t mode, uint8_t offset, int fndBitRate, uint8_t clk){\r
	787	\r
	788	if ( DemodBufferLen < 64 ) return false;\r
	789	uint8_t si = 0;\r
	790	for (uint8_t idx = 28; idx < 64; idx++){\r
	791	si = idx;\r
	792	if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r
	793	\r
	794	uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
	795	uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;\r
	796	// 2nibble must be zeroed.\r
	797	if (safer != 0x6 && safer != 0x9) continue;\r
	798	if ( resv > 0x00) continue;\r
	799	//uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;\r
	800	//uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;\r
	801	si += 1+1;\r
	802	int bitRate = PackBits(si, 6, DemodBuffer)*2 + 2; si += 6; //bit rate\r
	803	if (bitRate > 128 \|\| bitRate < 8) continue;\r
	804	\r
	805	//uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1; \r
	806	//uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1; \r
	807	//uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr\r
	808	//uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;\r
	809	si += 1+1+2+1;\r
	810	uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;\r
	811	uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;\r
	812	//uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;\r
	813	if (maxBlk == 0) continue;\r
	814	//test modulation\r
	815	if (!testQ5Modulation(mode, modread)) continue;\r
	816	if (bitRate != clk) continue;\r
	817	*fndBitRate = convertQ5bitRate(bitRate);\r
	818	if (*fndBitRate < 0) continue;\r
	819	*offset = idx;\r
	820	\r
	821	return true;\r
	822	}\r
	823	return false;\r
	824	}\r
	825	\r
	826	bool testBitRate(uint8_t readRate, uint8_t clk){\r
	827	uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r
	828	if (expected[readRate] == clk)\r
	829	return true;\r
	830	\r
	831	return false;\r
	832	}\r
	833	\r
	834	bool test(uint8_t mode, uint8_t offset, int fndBitRate, uint8_t clk, bool *Q5){\r
	835	\r
	836	if ( DemodBufferLen < 64 ) return false;\r
	837	uint8_t si = 0;\r
	838	for (uint8_t idx = 28; idx < 64; idx++){\r
	839	si = idx;\r
	840	if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r
	841	\r
	842	uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
	843	uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode\r
	844	// 2nibble must be zeroed.\r
	845	// moved test to here, since this gets most faults first.\r
	846	if ( resv > 0x00) continue;\r
	847	\r
	848	int bitRate = PackBits(si, 6, DemodBuffer); si += 6; //bit rate (includes extended mode part of rate)\r
	849	uint8_t extend = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode\r
	850	uint8_t modread = PackBits(si, 5, DemodBuffer); si += 5+2+1; \r
	851	//uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //could check psk cr\r
	852	//uint8_t nml01 = PackBits(si, 1, DemodBuffer); si += 1+5; //bit 24, 30, 31 could be tested for 0 if not extended mode\r
	853	//uint8_t nml02 = PackBits(si, 2, DemodBuffer); si += 2;\r
	854	\r
	855	//if extended mode\r
	856	bool extMode =( (safer == 0x6 \|\| safer == 0x9) && extend) ? true : false;\r
	857	\r
	858	if (!extMode) {\r
	859	if (bitRate > 7) continue;\r
	860	if (!testBitRate(bitRate, clk)) continue;\r
	861	} else { //extended mode bitrate = same function to calc bitrate as em4x05\r
	862	if (EM4x05_GET_BITRATE(bitRate) != clk) continue;\r
	863	\r
	864	}\r
	865	//test modulation\r
	866	if (!testModulation(mode, modread)) continue;\r
	867	*fndBitRate = bitRate;\r
	868	*offset = idx;\r
	869	*Q5 = false;\r
	870	return true;\r
	871	}\r
	872	if (testQ5(mode, offset, fndBitRate, clk)) {\r
	873	*Q5 = true;\r
	874	return true;\r
	875	}\r
	876	return false;\r
	877	}\r
	878	\r
	879	void printT55xxBlock(const char *blockNum){\r
	880	\r
	881	uint8_t i = config.offset;\r
	882	uint8_t endpos = 32 + i;\r
	883	uint32_t blockData = 0;\r
	884	uint8_t bits[64] = {0x00};\r
	885	\r
	886	if ( !DemodBufferLen) return;\r
	887	\r
	888	if ( endpos > DemodBufferLen){\r
	889	PrintAndLog("The configured offset %d is too big. Possible offset: %d)", i, DemodBufferLen-32);\r
	890	return;\r
	891	}\r
	892	\r
	893	for (; i < endpos; ++i)\r
	894	bits[i - config.offset]=DemodBuffer[i];\r
	895	\r
	896	blockData = PackBits(0, 32, bits);\r
	897	\r
	898	PrintAndLog(" %s \| %08X \| %s", blockNum, blockData, sprint_bin(bits,32));\r
	899	}\r
	900	\r
	901	int special(const char *Cmd) {\r
	902	uint32_t blockData = 0;\r
	903	uint8_t bits[32] = {0x00};\r
	904	\r
	905	PrintAndLog("OFFSET \| DATA \| BINARY");\r
	906	PrintAndLog("----------------------------------------------------");\r
	907	int i,j = 0;\r
	908	for (; j < 64; ++j){\r
	909	\r
	910	for (i = 0; i < 32; ++i)\r
	911	bits[i]=DemodBuffer[j+i];\r
	912	\r
	913	blockData = PackBits(0, 32, bits);\r
	914	\r
	915	PrintAndLog(" %02d \| 0x%08X \| %s",j , blockData, sprint_bin(bits,32)); \r
	916	}\r
	917	return 0;\r
	918	}\r
	919	\r
	920	int printConfiguration( t55xx_conf_block_t b){\r
	921	PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");\r
	922	PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );\r
	923	PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate, (b.block0 & T55x7_X_MODE && (b.block0>>28==6 \|\| b.block0>>28==9))) );\r
	924	PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );\r
	925	PrintAndLog("Offset : %d", b.offset);\r
	926	PrintAndLog("Seq. Term. : %s", (b.ST) ? "Yes" : "No" );\r
	927	PrintAndLog("Block0 : 0x%08X", b.block0);\r
	928	PrintAndLog("");\r
	929	return 0;\r
	930	}\r
	931	\r
	932	int CmdT55xxWakeUp(const char *Cmd) {\r
	933	uint32_t password = 0;\r
	934	if ( strlen(Cmd) <= 0 ) return usage_t55xx_wakup();\r
	935	char cmdp = param_getchar(Cmd, 0);\r
	936	if ( cmdp == 'h' \|\| cmdp == 'H') return usage_t55xx_wakup();\r
	937	\r
	938	password = param_get32ex(Cmd, 0, 0, 16);\r
	939	\r
	940	UsbCommand c = {CMD_T55XX_WAKEUP, {password, 0, 0}};\r
	941	clearCommandBuffer();\r
	942	SendCommand(&c);\r
	943	PrintAndLog("Wake up command sent. Try read now");\r
	944	return 0;\r
	945	}\r
	946	\r
	947	int CmdT55xxWriteBlock(const char *Cmd) {\r
	948	uint8_t block = 0xFF; //default to invalid block\r
	949	uint32_t data = 0; //default to blank Block \r
	950	uint32_t password = 0; //default to blank Block 7\r
	951	uint32_t downlink_mode = 0;\r
	952	\r
	953	bool usepwd = false;\r
	954	bool page1 = false; \r
	955	bool gotdata = false;\r
	956	bool testMode = false;\r
	957	bool errors = false;\r
	958	uint8_t cmdp = 0;\r
	959	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	960	switch(param_getchar(Cmd, cmdp)) {\r
	961	case 'h':\r
	962	case 'H':\r
	963	return usage_t55xx_write();\r
	964	case 'b':\r
	965	case 'B':\r
	966	errors \|= param_getdec(Cmd, cmdp+1, &block);\r
	967	cmdp += 2;\r
	968	break;\r
	969	case 'd':\r
	970	case 'D':\r
	971	data = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	972	gotdata = true;\r
	973	cmdp += 2;\r
	974	break;\r
	975	case 'p':\r
	976	case 'P':\r
	977	password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	978	usepwd = true;\r
	979	cmdp += 2;\r
	980	break;\r
	981	case 't':\r
	982	case 'T':\r
	983	testMode = true;\r
	984	cmdp++;\r
	985	break;\r
	986	case '1':\r
	987	page1 = true;\r
	988	cmdp++;\r
	989	break;\r
	990	case 'e':\r
	991	case 'E':\r
	992	downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
	993	if (downlink_mode > 3) downlink_mode = 0;\r
	994	cmdp +=2;\r
	995	break;\r
	996	default:\r
	997	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	998	errors = true;\r
	999	break;\r
	1000	}\r
	1001	}\r
	1002	if (errors \|\| !gotdata) return usage_t55xx_write();\r
	1003	\r
	1004	if (block > 7) {\r
	1005	PrintAndLog("Block number must be between 0 and 7");\r
	1006	return 0;\r
	1007	}\r
	1008	\r
	1009	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};\r
	1010	UsbCommand resp;\r
	1011	c.d.asBytes[0] = (page1) ? 0x2 : 0; \r
	1012	c.d.asBytes[0] \|= (testMode) ? 0x4 : 0; \r
	1013	c.d.asBytes[0] \|= (downlink_mode << 3);\r
	1014	\r
	1015	char pwdStr[16] = {0};\r
	1016	snprintf(pwdStr, sizeof(pwdStr), "pwd: 0x%08X", password);\r
	1017	\r
	1018	PrintAndLog("Writing page %d block: %02d data: 0x%08X %s", page1, block, data, (usepwd) ? pwdStr : "" );\r
	1019	\r
	1020	//Password mode\r
	1021	if (usepwd) {\r
	1022	c.arg[2] = password;\r
	1023	c.d.asBytes[0] \|= 0x1; \r
	1024	}\r
	1025	\r
	1026	clearCommandBuffer();\r
	1027	SendCommand(&c);\r
	1028	if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){\r
	1029	PrintAndLog("Error occurred, device did not ACK write operation. (May be due to old firmware)");\r
	1030	return 0;\r
	1031	}\r
	1032	return 1;\r
	1033	}\r
	1034	\r
	1035	int CmdT55xxReadTrace(const char *Cmd) {\r
	1036	char cmdp = param_getchar(Cmd, 0);\r
	1037	bool pwdmode = false;\r
	1038	uint32_t password = 0;\r
	1039	if (strlen(Cmd) > 1 \|\| cmdp == 'h' \|\| cmdp == 'H') \r
	1040	return usage_t55xx_trace();\r
	1041	\r
	1042	if (strlen(Cmd)==0)\r
	1043	if ( !AquireData( T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password,0 ) )\r
	1044	return 0;\r
	1045	\r
	1046	if ( config.Q5 ) {\r
	1047	if (!DecodeT5555TraceBlock()) return 0;\r
	1048	} else {\r
	1049	if (!DecodeT55xxBlock()) return 0;\r
	1050	}\r
	1051	\r
	1052	if ( !DemodBufferLen ) return 0;\r
	1053	\r
	1054	RepaintGraphWindow();\r
	1055	uint8_t repeat = (config.offset > 5) ? 32 : 0;\r
	1056	\r
	1057	uint8_t si = config.offset+repeat;\r
	1058	uint32_t bl1 = PackBits(si, 32, DemodBuffer);\r
	1059	uint32_t bl2 = PackBits(si+32, 32, DemodBuffer);\r
	1060	\r
	1061	if (config.Q5) {\r
	1062	uint32_t hdr = PackBits(si, 9, DemodBuffer); si += 9;\r
	1063	\r
	1064	if (hdr != 0x1FF) {\r
	1065	PrintAndLog("Invalid Q5 Trace data header (expected 0x1FF, found %X)", hdr);\r
	1066	return 0;\r
	1067	}\r
	1068	\r
	1069	t5555_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .icr = 0, .lotidc = '?', .lotid = 0, .wafer = 0, .dw =0};\r
	1070	\r
	1071	data.icr = PackBits(si, 2, DemodBuffer); si += 2;\r
	1072	data.lotidc = 'Z' - PackBits(si, 2, DemodBuffer); si += 3;\r
	1073	\r
	1074	data.lotid = PackBits(si, 4, DemodBuffer); si += 5;\r
	1075	data.lotid <<= 4;\r
	1076	data.lotid \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1077	data.lotid <<= 4;\r
	1078	data.lotid \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1079	data.lotid <<= 4;\r
	1080	data.lotid \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1081	data.lotid <<= 1;\r
	1082	data.lotid \|= PackBits(si, 1, DemodBuffer); si += 1;\r
	1083	\r
	1084	data.wafer = PackBits(si, 3, DemodBuffer); si += 4;\r
	1085	data.wafer <<= 2;\r
	1086	data.wafer \|= PackBits(si, 2, DemodBuffer); si += 2;\r
	1087	\r
	1088	data.dw = PackBits(si, 2, DemodBuffer); si += 3;\r
	1089	data.dw <<= 4;\r
	1090	data.dw \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1091	data.dw <<= 4;\r
	1092	data.dw \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1093	data.dw <<= 4;\r
	1094	data.dw \|= PackBits(si, 4, DemodBuffer); si += 5;\r
	1095	\r
	1096	printT5555Trace(data, repeat);\r
	1097	\r
	1098	} else {\r
	1099	\r
	1100	t55x7_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .acl = 0, .mfc = 0, .cid = 0, .year = 0, .quarter = 0, .icr = 0, .lotid = 0, .wafer = 0, .dw = 0};\r
	1101	\r
	1102	data.acl = PackBits(si, 8, DemodBuffer); si += 8;\r
	1103	if ( data.acl != 0xE0 ) {\r
	1104	PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");\r
	1105	return 0;\r
	1106	}\r
	1107	\r
	1108	data.mfc = PackBits(si, 8, DemodBuffer); si += 8;\r
	1109	data.cid = PackBits(si, 5, DemodBuffer); si += 5;\r
	1110	data.icr = PackBits(si, 3, DemodBuffer); si += 3;\r
	1111	data.year = PackBits(si, 4, DemodBuffer); si += 4;\r
	1112	data.quarter = PackBits(si, 2, DemodBuffer); si += 2;\r
	1113	data.lotid = PackBits(si, 14, DemodBuffer); si += 14;\r
	1114	data.wafer = PackBits(si, 5, DemodBuffer); si += 5;\r
	1115	data.dw = PackBits(si, 15, DemodBuffer); \r
	1116	\r
	1117	time_t t = time(NULL);\r
	1118	struct tm tm = *localtime(&t);\r
	1119	if ( data.year > tm.tm_year-110)\r
	1120	data.year += 2000;\r
	1121	else\r
	1122	data.year += 2010;\r
	1123	\r
	1124	printT55x7Trace(data, repeat);\r
	1125	}\r
	1126	return 0;\r
	1127	}\r
	1128	\r
	1129	void printT55x7Trace( t55x7_tracedata_t data, uint8_t repeat ){\r
	1130	PrintAndLog("-- T55x7 Trace Information ----------------------------------");\r
	1131	PrintAndLog("-------------------------------------------------------------");\r
	1132	PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", data.acl, data.acl);\r
	1133	PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d) - %s", data.mfc, data.mfc, getManufacturerName(data.mfc));\r
	1134	PrintAndLog(" CID : 0x%02X (%d) - %s", data.cid, data.cid, GetModelStrFromCID(data.cid));\r
	1135	PrintAndLog(" ICR IC Revision : %d", data.icr );\r
	1136	PrintAndLog(" Manufactured");\r
	1137	PrintAndLog(" Year/Quarter : %d/%d", data.year, data.quarter);\r
	1138	PrintAndLog(" Lot ID : %d", data.lotid );\r
	1139	PrintAndLog(" Wafer number : %d", data.wafer);\r
	1140	PrintAndLog(" Die Number : %d", data.dw);\r
	1141	PrintAndLog("-------------------------------------------------------------");\r
	1142	PrintAndLog(" Raw Data - Page 1");\r
	1143	PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );\r
	1144	PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );\r
	1145	PrintAndLog("-------------------------------------------------------------"); \r
	1146	\r
	1147	/*\r
	1148	TRACE - BLOCK O\r
	1149	Bits Definition HEX\r
	1150	1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0 \r
	1151	9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation\r
	1152	17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2 \r
	1153	22-24 ICR IC revision\r
	1154	25-28 YEAR (BCD encoded) 9 (= 2009)\r
	1155	29-30 QUARTER 1,2,3,4 \r
	1156	31-32 LOT ID\r
	1157	\r
	1158	TRACE - BLOCK 1\r
	1159	1-12 LOT ID \r
	1160	13-17 Wafer number\r
	1161	18-32 DW, die number sequential\r
	1162	*/\r
	1163	}\r
	1164	\r
	1165	void printT5555Trace( t5555_tracedata_t data, uint8_t repeat ){\r
	1166	PrintAndLog("-- T5555 (Q5) Trace Information -----------------------------");\r
	1167	PrintAndLog("-------------------------------------------------------------");\r
	1168	PrintAndLog(" ICR IC Revision : %d", data.icr ); \r
	1169	PrintAndLog(" Lot : %c%d", data.lotidc, data.lotid);\r
	1170	PrintAndLog(" Wafer number : %d", data.wafer);\r
	1171	PrintAndLog(" Die Number : %d", data.dw);\r
	1172	PrintAndLog("-------------------------------------------------------------");\r
	1173	PrintAndLog(" Raw Data - Page 1");\r
	1174	PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );\r
	1175	PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );\r
	1176	\r
	1177	/*\r
	1178	Q5 \r
	1179	TRACE - BLOCK O and BLOCK1\r
	1180	Bits Definition HEX\r
	1181	1-9 Header 0x1FF\r
	1182	10-11 IC Revision\r
	1183	12-13 Lot ID char\r
	1184	15-35 Lot ID (NB parity)\r
	1185	36-41 Wafer number (NB parity)\r
	1186	42-58 DW, die number sequential (NB parity)\r
	1187	60-63 Parity bits\r
	1188	64 Always zero\r
	1189	*/\r
	1190	}\r
	1191	\r
	1192	//need to add Q5 info...\r
	1193	int CmdT55xxInfo(const char *Cmd){\r
	1194	/*\r
	1195	Page 0 Block 0 Configuration data.\r
	1196	Normal mode\r
	1197	Extended mode\r
	1198	*/\r
	1199	bool pwdmode = false;\r
	1200	uint32_t password = 0;\r
	1201	char cmdp = param_getchar(Cmd, 0);\r
	1202	\r
	1203	if (strlen(Cmd) > 1 \|\| cmdp == 'h' \|\| cmdp == 'H')\r
	1204	return usage_t55xx_info();\r
	1205	\r
	1206	if (strlen(Cmd)==0)\r
	1207	if ( !AquireData( T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password,0 ) )\r
	1208	return 1;\r
	1209	\r
	1210	if (!DecodeT55xxBlock()) return 1;\r
	1211	\r
	1212	// too little space to start with\r
	1213	if ( DemodBufferLen < 32) return 1;\r
	1214	\r
	1215	uint8_t si = config.offset;\r
	1216	uint32_t bl0 = PackBits(si, 32, DemodBuffer);\r
	1217	\r
	1218	uint32_t safer = PackBits(si, 4, DemodBuffer); si += 4; \r
	1219	uint32_t resv = PackBits(si, 7, DemodBuffer); si += 7;\r
	1220	uint32_t dbr = PackBits(si, 3, DemodBuffer); si += 3;\r
	1221	uint32_t extend = PackBits(si, 1, DemodBuffer); si += 1;\r
	1222	uint32_t datamod = PackBits(si, 5, DemodBuffer); si += 5;\r
	1223	uint32_t pskcf = PackBits(si, 2, DemodBuffer); si += 2;\r
	1224	uint32_t aor = PackBits(si, 1, DemodBuffer); si += 1; \r
	1225	uint32_t otp = PackBits(si, 1, DemodBuffer); si += 1; \r
	1226	uint32_t maxblk = PackBits(si, 3, DemodBuffer); si += 3;\r
	1227	uint32_t pwd = PackBits(si, 1, DemodBuffer); si += 1; \r
	1228	uint32_t sst = PackBits(si, 1, DemodBuffer); si += 1; \r
	1229	uint32_t fw = PackBits(si, 1, DemodBuffer); si += 1;\r
	1230	uint32_t inv = PackBits(si, 1, DemodBuffer); si += 1; \r
	1231	uint32_t por = PackBits(si, 1, DemodBuffer); si += 1;\r
	1232	\r
	1233	if (config.Q5) PrintAndLog("* Warning * Config Info read off a Q5 will not display as expected");\r
	1234	PrintAndLog("");\r
	1235	PrintAndLog("-- T55x7 Configuration & Tag Information --------------------");\r
	1236	PrintAndLog("-------------------------------------------------------------");\r
	1237	PrintAndLog(" Safer key : %s", GetSaferStr(safer));\r
	1238	PrintAndLog(" reserved : %d", resv);\r
	1239	PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr, extend));\r
	1240	PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");\r
	1241	PrintAndLog(" Modulation : %s", GetModulationStr(datamod));\r
	1242	PrintAndLog(" PSK clock frequency : %d", pskcf);\r
	1243	PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");\r
	1244	PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );\r
	1245	PrintAndLog(" Max block : %d", maxblk);\r
	1246	PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");\r
	1247	PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");\r
	1248	PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");\r
	1249	PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");\r
	1250	PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");\r
	1251	PrintAndLog("-------------------------------------------------------------");\r
	1252	PrintAndLog(" Raw Data - Page 0");\r
	1253	PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(DemodBuffer+config.offset,32) );\r
	1254	PrintAndLog("-------------------------------------------------------------");\r
	1255	\r
	1256	return 0;\r
	1257	}\r
	1258	\r
	1259	int CmdT55xxDump(const char *Cmd){\r
	1260	\r
	1261	uint32_t password = 0;\r
	1262	char cmdp = param_getchar(Cmd, 0);\r
	1263	bool override = false;\r
	1264	if ( cmdp == 'h' \|\| cmdp == 'H') return usage_t55xx_dump();\r
	1265	\r
	1266	bool usepwd = ( strlen(Cmd) > 0);\r
	1267	if ( usepwd ){\r
	1268	password = param_get32ex(Cmd, 0, 0, 16);\r
	1269	if (param_getchar(Cmd, 1) =='o' )\r
	1270	override = true;\r
	1271	}\r
	1272	\r
	1273	printT5xxHeader(0);\r
	1274	for ( uint8_t i = 0; i <8; ++i)\r
	1275	T55xxReadBlock(i, 0, usepwd, override, password,0);\r
	1276	\r
	1277	printT5xxHeader(1);\r
	1278	for ( uint8_t i = 0; i<4; i++)\r
	1279	T55xxReadBlock(i, 1, usepwd, override, password,0); \r
	1280	\r
	1281	return 1;\r
	1282	}\r
	1283	\r
	1284	int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password, uint8_t downlink_mode ){\r
	1285	// arg0 bitmodes:\r
	1286	// bit0 = pwdmode\r
	1287	// bit1 = page to read from\r
	1288	uint8_t arg0 = (page<<1) \| pwdmode;\r
	1289	arg0 \|= (downlink_mode << 3);\r
	1290	UsbCommand c = {CMD_T55XX_READ_BLOCK, {arg0, block, password}};\r
	1291	\r
	1292	clearCommandBuffer();\r
	1293	SendCommand(&c);\r
	1294	if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r
	1295	PrintAndLog("command execution time out");\r
	1296	return 0;\r
	1297	}\r
	1298	getSamples(12000,true);\r
	1299	return 1;\r
	1300	}\r
	1301	\r
	1302	char * GetBitRateStr(uint32_t id, bool xmode) {\r
	1303	static char buf[25];\r
	1304	\r
	1305	char *retStr = buf;\r
	1306	if (xmode) { //xmode bitrate calc is same as em4x05 calc\r
	1307	snprintf(retStr,sizeof(buf),"%d - RF/%d", id, EM4x05_GET_BITRATE(id));\r
	1308	} else {\r
	1309	switch (id) {\r
	1310	case 0: snprintf(retStr,sizeof(buf),"%d - RF/8",id); break;\r
	1311	case 1: snprintf(retStr,sizeof(buf),"%d - RF/16",id); break;\r
	1312	case 2: snprintf(retStr,sizeof(buf),"%d - RF/32",id); break;\r
	1313	case 3: snprintf(retStr,sizeof(buf),"%d - RF/40",id); break;\r
	1314	case 4: snprintf(retStr,sizeof(buf),"%d - RF/50",id); break;\r
	1315	case 5: snprintf(retStr,sizeof(buf),"%d - RF/64",id); break;\r
	1316	case 6: snprintf(retStr,sizeof(buf),"%d - RF/100",id); break;\r
	1317	case 7: snprintf(retStr,sizeof(buf),"%d - RF/128",id); break;\r
	1318	default: snprintf(retStr,sizeof(buf),"%d - (Unknown)",id); break;\r
	1319	} \r
	1320	}\r
	1321	return buf;\r
	1322	}\r
	1323	\r
	1324	char * GetSaferStr(uint32_t id) {\r
	1325	static char buf[40];\r
	1326	char *retStr = buf;\r
	1327	\r
	1328	snprintf(retStr,sizeof(buf),"%d",id);\r
	1329	if (id == 6) {\r
	1330	snprintf(retStr,sizeof(buf),"%d - passwd",id);\r
	1331	}\r
	1332	if (id == 9 ){\r
	1333	snprintf(retStr,sizeof(buf),"%d - testmode",id);\r
	1334	}\r
	1335	\r
	1336	return buf;\r
	1337	}\r
	1338	\r
	1339	char * GetModulationStr( uint32_t id){\r
	1340	static char buf[60];\r
	1341	char *retStr = buf;\r
	1342	\r
	1343	switch (id){\r
	1344	case 0: snprintf(retStr,sizeof(buf),"%d - DIRECT (ASK/NRZ)",id); break;\r
	1345	case 1: snprintf(retStr,sizeof(buf),"%d - PSK 1 phase change when input changes",id); break;\r
	1346	case 2: snprintf(retStr,sizeof(buf),"%d - PSK 2 phase change on bitclk if input high",id); break;\r
	1347	case 3: snprintf(retStr,sizeof(buf),"%d - PSK 3 phase change on rising edge of input",id); break;\r
	1348	case 4: snprintf(retStr,sizeof(buf),"%d - FSK 1 RF/8 RF/5",id); break;\r
	1349	case 5: snprintf(retStr,sizeof(buf),"%d - FSK 2 RF/8 RF/10",id); break;\r
	1350	case 6: snprintf(retStr,sizeof(buf),"%d - FSK 1a RF/5 RF/8",id); break;\r
	1351	case 7: snprintf(retStr,sizeof(buf),"%d - FSK 2a RF/10 RF/8",id); break;\r
	1352	case 8: snprintf(retStr,sizeof(buf),"%d - Manchester",id); break;\r
	1353	case 16: snprintf(retStr,sizeof(buf),"%d - Biphase",id); break;\r
	1354	case 0x18: snprintf(retStr,sizeof(buf),"%d - Biphase a - AKA Conditional Dephase Encoding(CDP)",id); break;\r
	1355	case 17: snprintf(retStr,sizeof(buf),"%d - Reserved",id); break;\r
	1356	default: snprintf(retStr,sizeof(buf),"0x%02X (Unknown)",id); break;\r
	1357	}\r
	1358	return buf;\r
	1359	}\r
	1360	\r
	1361	char * GetModelStrFromCID(uint32_t cid){\r
	1362	\r
	1363	static char buf[10];\r
	1364	char *retStr = buf;\r
	1365	\r
	1366	if (cid == 1) snprintf(retStr, sizeof(buf),"ATA5577M1");\r
	1367	if (cid == 2) snprintf(retStr, sizeof(buf),"ATA5577M2"); \r
	1368	return buf;\r
	1369	}\r
	1370	\r
	1371	char * GetSelectedModulationStr( uint8_t id){\r
	1372	\r
	1373	static char buf[20];\r
	1374	char *retStr = buf;\r
	1375	\r
	1376	switch (id) {\r
	1377	case DEMOD_FSK: snprintf(retStr,sizeof(buf),"FSK"); break;\r
	1378	case DEMOD_FSK1: snprintf(retStr,sizeof(buf),"FSK1"); break;\r
	1379	case DEMOD_FSK1a: snprintf(retStr,sizeof(buf),"FSK1a"); break;\r
	1380	case DEMOD_FSK2: snprintf(retStr,sizeof(buf),"FSK2"); break;\r
	1381	case DEMOD_FSK2a: snprintf(retStr,sizeof(buf),"FSK2a"); break;\r
	1382	case DEMOD_ASK: snprintf(retStr,sizeof(buf),"ASK"); break;\r
	1383	case DEMOD_NRZ: snprintf(retStr,sizeof(buf),"DIRECT/NRZ"); break;\r
	1384	case DEMOD_PSK1: snprintf(retStr,sizeof(buf),"PSK1"); break;\r
	1385	case DEMOD_PSK2: snprintf(retStr,sizeof(buf),"PSK2"); break;\r
	1386	case DEMOD_PSK3: snprintf(retStr,sizeof(buf),"PSK3"); break;\r
	1387	case DEMOD_BI: snprintf(retStr,sizeof(buf),"BIPHASE"); break;\r
	1388	case DEMOD_BIa: snprintf(retStr,sizeof(buf),"BIPHASEa - (CDP)"); break;\r
	1389	default: snprintf(retStr,sizeof(buf),"(Unknown)"); break;\r
	1390	}\r
	1391	return buf;\r
	1392	}\r
	1393	\r
	1394	uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){\r
	1395	\r
	1396	int i = start;\r
	1397	int j = len-1;\r
	1398	\r
	1399	if (len > 32) return 0;\r
	1400	\r
	1401	uint32_t tmp = 0;\r
	1402	for (; j >= 0; --j, ++i)\r
	1403	tmp \|= bits[i] << j;\r
	1404	\r
	1405	return tmp;\r
	1406	}\r
	1407	\r
	1408	int CmdResetRead(const char *Cmd) {\r
	1409	UsbCommand c = {CMD_T55XX_RESET_READ, {0,0,0}};\r
	1410	\r
	1411	clearCommandBuffer();\r
	1412	SendCommand(&c);\r
	1413	if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r
	1414	PrintAndLog("command execution time out");\r
	1415	return 0;\r
	1416	}\r
	1417	\r
	1418	uint8_t got[BIGBUF_SIZE-1];\r
	1419	GetFromBigBuf(got, sizeof(got), 0, NULL, -1 , 0);\r
	1420	setGraphBuf(got, sizeof(got));\r
	1421	return 1;\r
	1422	}\r
	1423	\r
	1424	int CmdT55xxWipe(const char *Cmd) {\r
	1425	char writeData[20] = {0};\r
	1426	char *ptrData = writeData;\r
	1427	\r
	1428	char cmdp = param_getchar(Cmd, 0); \r
	1429	if ( cmdp == 'h' \|\| cmdp == 'H') return usage_t55xx_wipe();\r
	1430	\r
	1431	bool Q5 = (cmdp == 'q' \|\| cmdp == 'Q');\r
	1432	\r
	1433	// Try with the default password to reset block 0\r
	1434	// With a pwd should work even if pwd bit not set\r
	1435	PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");\r
	1436	\r
	1437	if ( Q5 ){\r
	1438	snprintf(ptrData,sizeof(writeData),"b 0 d 6001F004 p 0");\r
	1439	} else {\r
	1440	snprintf(ptrData,sizeof(writeData),"b 0 d 00088040 p 0");\r
	1441	}\r
	1442	\r
	1443	if (!CmdT55xxWriteBlock(ptrData)) PrintAndLog("Error writing blk 0");\r
	1444	\r
	1445	for (uint8_t blk = 1; blk<8; blk++) {\r
	1446	snprintf(ptrData,sizeof(writeData),"b %d d 0", blk);\r
	1447	if (!CmdT55xxWriteBlock(ptrData))\r
	1448	PrintAndLog("Error writing blk %d", blk);\r
	1449	\r
	1450	memset(writeData, 0x00, sizeof(writeData));\r
	1451	}\r
	1452	return 0;\r
	1453	}\r
	1454	\r
	1455	int CmdT55xxBruteForce(const char *Cmd) {\r
	1456	\r
	1457	// load a default pwd file.\r
	1458	char buf[9];\r
	1459	char filename[FILE_PATH_SIZE]={0};\r
	1460	int keycnt = 0;\r
	1461	uint8_t downlink_mode = 0;\r
	1462	int ch;\r
	1463	uint8_t stKeyBlock = 20;\r
	1464	uint8_t keyBlock = NULL, p = NULL;\r
	1465	uint32_t start_password = 0x00000000; //start password\r
	1466	uint32_t end_password = 0xFFFFFFFF; //end password\r
	1467	bool found = false;\r
	1468	\r
	1469	char cmdp = param_getchar(Cmd, 0);\r
	1470	if (cmdp == 'h' \|\| cmdp == 'H') return usage_t55xx_bruteforce();\r
	1471	\r
	1472	keyBlock = calloc(stKeyBlock, 6);\r
	1473	if (keyBlock == NULL) return 1;\r
	1474	\r
	1475	if (cmdp == 'i' \|\| cmdp == 'I') {\r
	1476	\r
	1477	int len = strlen(Cmd+2);\r
	1478	if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r
	1479	memcpy(filename, Cmd+2, len);\r
	1480	\r
	1481	FILE * f = fopen( filename , "r");\r
	1482	\r
	1483	if ( !f ) {\r
	1484	PrintAndLog("File: %s: not found or locked.", filename);\r
	1485	free(keyBlock);\r
	1486	return 1;\r
	1487	}\r
	1488	\r
	1489	while( fgets(buf, sizeof(buf), f) ) {\r
	1490	if (strlen(buf) < 8 \|\| buf[7] == '\n') continue;\r
	1491	\r
	1492	while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r
	1493	\r
	1494	//The line start with # is comment, skip\r
	1495	if( buf[0]=='#' ) continue;\r
	1496	\r
	1497	if (!isxdigit((unsigned char)buf[0])) {\r
	1498	PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r
	1499	continue;\r
	1500	}\r
	1501	\r
	1502	buf[8] = 0;\r
	1503	\r
	1504	if ( stKeyBlock - keycnt < 2) {\r
	1505	p = realloc(keyBlock, 6*(stKeyBlock+=10));\r
	1506	if (!p) {\r
	1507	PrintAndLog("Cannot allocate memory for defaultKeys");\r
	1508	free(keyBlock);\r
	1509	fclose(f);\r
	1510	return 2;\r
	1511	}\r
	1512	keyBlock = p;\r
	1513	}\r
	1514	memset(keyBlock + 4 * keycnt, 0, 4);\r
	1515	num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r
	1516	PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r
	1517	keycnt++;\r
	1518	memset(buf, 0, sizeof(buf));\r
	1519	}\r
	1520	fclose(f);\r
	1521	\r
	1522	if (keycnt == 0) {\r
	1523	PrintAndLog("No keys found in file");\r
	1524	free(keyBlock);\r
	1525	return 1;\r
	1526	}\r
	1527	PrintAndLog("Loaded %d keys", keycnt);\r
	1528	\r
	1529	// loop\r
	1530	uint64_t testpwd = 0x00;\r
	1531	for (uint16_t c = 0; c < keycnt; ++c ) {\r
	1532	\r
	1533	if (ukbhit()) {\r
	1534	ch = getchar();\r
	1535	(void)ch;\r
	1536	printf("\naborted via keyboard!\n");\r
	1537	free(keyBlock);\r
	1538	return 0;\r
	1539	}\r
	1540	\r
	1541	testpwd = bytes_to_num(keyBlock + 4*c, 4);\r
	1542	\r
	1543	PrintAndLog("Testing %08X", testpwd);\r
	1544	\r
	1545	if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,downlink_mode)) {\r
	1546	PrintAndLog("Aquireing data from device failed. Quitting");\r
	1547	free(keyBlock);\r
	1548	return 0;\r
	1549	}\r
	1550	\r
	1551	found = tryDetectModulation();\r
	1552	\r
	1553	if ( found ) {\r
	1554	PrintAndLog("Found valid password: [%08X]", testpwd);\r
	1555	free(keyBlock);\r
	1556	return 0;\r
	1557	}\r
	1558	}\r
	1559	PrintAndLog("Password NOT found.");\r
	1560	free(keyBlock);\r
	1561	return 0;\r
	1562	}\r
	1563	\r
	1564	// Try to read Block 7, first :)\r
	1565	\r
	1566	// incremental pwd range search\r
	1567	start_password = param_get32ex(Cmd, 0, 0, 16);\r
	1568	end_password = param_get32ex(Cmd, 1, 0, 16);\r
	1569	\r
	1570	if ( start_password >= end_password ) {\r
	1571	free(keyBlock);\r
	1572	return usage_t55xx_bruteforce();\r
	1573	}\r
	1574	PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r
	1575	\r
	1576	uint32_t i = start_password;\r
	1577	\r
	1578	while ((!found) && (i <= end_password)) {\r
	1579	\r
	1580	printf(".");\r
	1581	fflush(stdout);\r
	1582	if (ukbhit()) {\r
	1583	ch = getchar();\r
	1584	(void)ch;\r
	1585	printf("\naborted via keyboard!\n");\r
	1586	free(keyBlock);\r
	1587	return 0;\r
	1588	}\r
	1589	\r
	1590	if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r
	1591	PrintAndLog("Aquireing data from device failed. Quitting");\r
	1592	free(keyBlock);\r
	1593	return 0;\r
	1594	}\r
	1595	found = tryDetectModulation();\r
	1596	\r
	1597	if (found) break;\r
	1598	i++;\r
	1599	}\r
	1600	\r
	1601	PrintAndLog("");\r
	1602	\r
	1603	if (found)\r
	1604	PrintAndLog("Found valid password: [%08x]", i);\r
	1605	else\r
	1606	PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r
	1607	\r
	1608	free(keyBlock);\r
	1609	return 0;\r
	1610	}\r
	1611	\r
	1612	int CmdT55xxBruteForce_downlink(const char *Cmd) {\r
	1613	\r
	1614	// load a default pwd file.\r
	1615	char buf[9];\r
	1616	char filename[FILE_PATH_SIZE]={0};\r
	1617	int keycnt = 0;\r
	1618	uint8_t downlink_mode = 0;\r
	1619	int ch;\r
	1620	uint8_t stKeyBlock = 20;\r
	1621	uint8_t keyBlock = NULL, p = NULL;\r
	1622	uint32_t start_password = 0x00000000; //start password\r
	1623	uint32_t end_password = 0xFFFFFFFF; //end password\r
	1624	bool found = false;\r
	1625	uint8_t cmdp = 0;\r
	1626	int cmd_offset = 0;\r
	1627	int errors = 0;\r
	1628	int len;\r
	1629	bool use_file = false;\r
	1630	bool use_range = false;\r
	1631	bool try_all_dl_modes = false;\r
	1632	uint8_t dl_mode = 0;\r
	1633	\r
	1634	keyBlock = calloc(stKeyBlock, 6);\r
	1635	if (keyBlock == NULL) return 1;\r
	1636	\r
	1637	PrintAndLog("New Downlink Supprt");\r
	1638	\r
	1639	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	1640	switch(param_getchar(Cmd, cmdp)) {\r
	1641	case 'h':\r
	1642	case 'H':\r
	1643	return usage_t55xx_bruteforce_downlink();\r
	1644	case 'e':\r
	1645	case 'E':\r
	1646	downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
	1647	if (downlink_mode == 4) try_all_dl_modes = true;\r
	1648	if (downlink_mode > 3) downlink_mode = 0;\r
	1649	cmdp +=2;\r
	1650	cmd_offset += 4;\r
	1651	PrintAndLog ("DL Mode : %d",downlink_mode);\r
	1652	break;\r
	1653	case 'i':\r
	1654	case 'I':\r
	1655	if (use_range) {\r
	1656	PrintAndLog ("use Range or File");\r
	1657	return 0;\r
	1658	}\r
	1659	use_file = true;\r
	1660	len = strlen(Cmd+2);\r
	1661	if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r
	1662	memcpy(filename, Cmd+cmd_offset+2, len);\r
	1663	cmdp += 2;\r
	1664	// PrintAndLog (" File : [%s]",filename);\r
	1665	break;\r
	1666	case 'r':\r
	1667	case 'R':\r
	1668	if (use_file) {\r
	1669	PrintAndLog ("use Range or File");\r
	1670	return 0;\r
	1671	}\r
	1672	use_range = true; // = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	1673	start_password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	1674	end_password = param_get32ex(Cmd, cmdp+2, 0, 16);\r
	1675	cmdp += 3;\r
	1676	cmd_offset += 20; // 8 + 8 + 1 + 1 + 1\r
	1677	// PrintAndLog (" Range : [%0X] - [%0X]",start_password,end_password);\r
	1678	break;\r
	1679	default:\r
	1680	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	1681	errors = true;\r
	1682	break;\r
	1683	}\r
	1684	}\r
	1685	\r
	1686	\r
	1687	// if (cmdp == 'i' \|\| cmdp == 'I') {\r
	1688	\r
	1689	if (use_file)\r
	1690	{\r
	1691	FILE * f = fopen( filename , "r");\r
	1692	\r
	1693	if ( !f ) {\r
	1694	PrintAndLog("File: %s: not found or locked.", filename);\r
	1695	free(keyBlock);\r
	1696	return 1;\r
	1697	}\r
	1698	\r
	1699	while( fgets(buf, sizeof(buf), f) ) {\r
	1700	if (strlen(buf) < 8 \|\| buf[7] == '\n') continue;\r
	1701	\r
	1702	while (fgetc(f) != '\n' && !feof(f)) ; //goto next line\r
	1703	\r
	1704	//The line start with # is comment, skip\r
	1705	if( buf[0]=='#' ) continue;\r
	1706	\r
	1707	if (!isxdigit((unsigned char)buf[0])) {\r
	1708	PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r
	1709	continue;\r
	1710	}\r
	1711	\r
	1712	buf[8] = 0;\r
	1713	\r
	1714	if ( stKeyBlock - keycnt < 2) {\r
	1715	p = realloc(keyBlock, 6*(stKeyBlock+=10));\r
	1716	if (!p) {\r
	1717	PrintAndLog("Cannot allocate memory for defaultKeys");\r
	1718	free(keyBlock);\r
	1719	fclose(f);\r
	1720	return 2;\r
	1721	}\r
	1722	keyBlock = p;\r
	1723	}\r
	1724	memset(keyBlock + 4 * keycnt, 0, 4);\r
	1725	num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r
	1726	PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r
	1727	keycnt++;\r
	1728	memset(buf, 0, sizeof(buf));\r
	1729	}\r
	1730	fclose(f);\r
	1731	\r
	1732	if (keycnt == 0) {\r
	1733	PrintAndLog("No keys found in file");\r
	1734	free(keyBlock);\r
	1735	return 1;\r
	1736	}\r
	1737	PrintAndLog("Loaded %d keys", keycnt);\r
	1738	\r
	1739	// loop\r
	1740	uint64_t testpwd = 0x00;\r
	1741	for (uint16_t c = 0; c < keycnt; ++c ) {\r
	1742	\r
	1743	if (ukbhit()) {\r
	1744	ch = getchar();\r
	1745	(void)ch;\r
	1746	printf("\naborted via keyboard!\n");\r
	1747	free(keyBlock);\r
	1748	return 0;\r
	1749	}\r
	1750	\r
	1751	testpwd = bytes_to_num(keyBlock + 4*c, 4);\r
	1752	\r
	1753	PrintAndLog("Testing %08X", testpwd);\r
	1754	\r
	1755	// Try each downlink_mode of asked to \r
	1756	// donwlink_mode will = 0 if > 3 or set to 0, so loop from 0 - 3\r
	1757	for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++)\r
	1758	{\r
	1759	if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,dl_mode)) {\r
	1760	PrintAndLog("Aquireing data from device failed. Quitting");\r
	1761	free(keyBlock);\r
	1762	return 0;\r
	1763	}\r
	1764	\r
	1765	found = tryDetectModulation();\r
	1766	\r
	1767	if ( found ) {\r
	1768	PrintAndLog("Found valid password: [%08X]", testpwd);\r
	1769	free(keyBlock);\r
	1770	// Add downlink mode to reference.\r
	1771	switch (dl_mode) {\r
	1772	case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r
	1773	case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r
	1774	case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r
	1775	case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r
	1776	}\r
	1777	return 0;\r
	1778	}\r
	1779	if (!try_all_dl_modes) // Exit loop\r
	1780	dl_mode = 4;\r
	1781	}\r
	1782	}\r
	1783	PrintAndLog("Password NOT found.");\r
	1784	free(keyBlock);\r
	1785	return 0;\r
	1786	}\r
	1787	\r
	1788	if (use_range)\r
	1789	{\r
	1790	// incremental pwd range search\r
	1791	// start_password = param_get32ex(Cmd, 0, 0, 16);\r
	1792	// end_password = param_get32ex(Cmd, 1, 0, 16);\r
	1793	\r
	1794	if ( start_password >= end_password ) {\r
	1795	free(keyBlock);\r
	1796	return usage_t55xx_bruteforce_downlink();\r
	1797	}\r
	1798	PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r
	1799	\r
	1800	uint32_t i = start_password;\r
	1801	\r
	1802	while ((!found) && (i <= end_password)) {\r
	1803	\r
	1804	printf(".");\r
	1805	fflush(stdout);\r
	1806	if (ukbhit()) {\r
	1807	ch = getchar();\r
	1808	(void)ch;\r
	1809	printf("\naborted via keyboard!\n");\r
	1810	free(keyBlock);\r
	1811	return 0;\r
	1812	}\r
	1813	\r
	1814	if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r
	1815	PrintAndLog("Aquireing data from device failed. Quitting");\r
	1816	free(keyBlock);\r
	1817	return 0;\r
	1818	}\r
	1819	found = tryDetectModulation();\r
	1820	\r
	1821	if (found) break;\r
	1822	i++;\r
	1823	}\r
	1824	\r
	1825	PrintAndLog("");\r
	1826	\r
	1827	if (found) {\r
	1828	PrintAndLog("Found valid password: [%08x]", i);\r
	1829	// Add downlink mode to reference.\r
	1830	switch (downlink_mode) {\r
	1831	case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;\r
	1832	case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;\r
	1833	case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;\r
	1834	case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;\r
	1835	}\r
	1836	}\r
	1837	else\r
	1838	PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r
	1839	\r
	1840	free(keyBlock);\r
	1841	}\r
	1842	return 0;\r
	1843	}\r
	1844	\r
	1845	// note length of data returned is different for different chips. \r
	1846	// some return all page 1 (64 bits) and others return just that block (32 bits) \r
	1847	// unfortunately the 64 bits makes this more likely to get a false positive...\r
	1848	bool tryDetectP1(bool getData) {\r
	1849	uint8_t preamble[] = {1,1,1,0,0,0,0,0,0,0,0,1,0,1,0,1};\r
	1850	size_t startIdx = 0;\r
	1851	uint8_t fc1 = 0, fc2 = 0, ans = 0;\r
	1852	int clk = 0, firstClockEdge = 0;\r
	1853	bool st = true;\r
	1854	\r
	1855	if ( getData ) {\r
	1856	if ( !AquireData(T55x7_PAGE1, 1, false, 0,0) )\r
	1857	return false;\r
	1858	}\r
	1859	\r
	1860	// try fsk clock detect. if successful it cannot be any other type of modulation... (in theory...)\r
	1861	ans = fskClocks(&fc1, &fc2, (uint8_t *)&clk, false, &firstClockEdge);\r
	1862	if (ans && ((fc1==10 && fc2==8) \|\| (fc1==8 && fc2==5))) {\r
	1863	if ( FSKrawDemod("0 0", false) && \r
	1864	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1865	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1866	return true;\r
	1867	}\r
	1868	if ( FSKrawDemod("0 1", false) && \r
	1869	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1870	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1871	return true;\r
	1872	}\r
	1873	return false;\r
	1874	}\r
	1875	\r
	1876	// try psk clock detect. if successful it cannot be any other type of modulation... (in theory...)\r
	1877	clk = GetPskClock("", false, false);\r
	1878	if (clk>0) {\r
	1879	// allow undo\r
	1880	// save_restoreGB(1);\r
	1881	// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
	1882	//CmdLtrim("160");\r
	1883	if ( PSKDemod("0 0 6", false) &&\r
	1884	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1885	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1886	//save_restoreGB(0);\r
	1887	return true;\r
	1888	}\r
	1889	if ( PSKDemod("0 1 6", false) &&\r
	1890	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1891	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1892	//save_restoreGB(0);\r
	1893	return true;\r
	1894	}\r
	1895	// PSK2 - needs a call to psk1TOpsk2.\r
	1896	if ( PSKDemod("0 0 6", false)) {\r
	1897	psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
	1898	if (preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1899	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1900	//save_restoreGB(0);\r
	1901	return true;\r
	1902	}\r
	1903	} // inverse waves does not affect PSK2 demod\r
	1904	//undo trim samples\r
	1905	//save_restoreGB(0); \r
	1906	// no other modulation clocks = 2 or 4 so quit searching\r
	1907	if (fc1 != 8) return false;\r
	1908	}\r
	1909	\r
	1910	// try ask clock detect. it could be another type even if successful.\r
	1911	clk = GetAskClock("", false, false);\r
	1912	if (clk>0) {\r
	1913	if ( ASKDemod_ext("0 0 1", false, false, 1, &st) &&\r
	1914	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1915	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1916	return true;\r
	1917	}\r
	1918	st = true;\r
	1919	if ( ASKDemod_ext("0 1 1", false, false, 1, &st) &&\r
	1920	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1921	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1922	return true;\r
	1923	}\r
	1924	if ( ASKbiphaseDemod("0 0 0 2", false) &&\r
	1925	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1926	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1927	return true;\r
	1928	}\r
	1929	if ( ASKbiphaseDemod("0 0 1 2", false) &&\r
	1930	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1931	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1932	return true;\r
	1933	}\r
	1934	}\r
	1935	\r
	1936	// try NRZ clock detect. it could be another type even if successful.\r
	1937	clk = GetNrzClock("", false, false); //has the most false positives :(\r
	1938	if (clk>0) {\r
	1939	if ( NRZrawDemod("0 0 1", false) &&\r
	1940	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1941	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1942	return true;\r
	1943	}\r
	1944	if ( NRZrawDemod("0 1 1", false) &&\r
	1945	preambleSearchEx(DemodBuffer,preamble,sizeof(preamble),&DemodBufferLen,&startIdx,false) && \r
	1946	(DemodBufferLen == 32 \|\| DemodBufferLen == 64) ) {\r
	1947	return true;\r
	1948	}\r
	1949	}\r
	1950	return false;\r
	1951	}\r
	1952	// does this need to be a callable command?\r
	1953	int CmdT55xxDetectPage1(const char *Cmd){\r
	1954	bool errors = false;\r
	1955	bool useGB = false;\r
	1956	bool usepwd = false;\r
	1957	uint32_t password = 0;\r
	1958	uint8_t cmdp = 0;\r
	1959	\r
	1960	while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
	1961	switch(param_getchar(Cmd, cmdp)) {\r
	1962	case 'h':\r
	1963	case 'H':\r
	1964	return usage_t55xx_detectP1();\r
	1965	case 'p':\r
	1966	case 'P':\r
	1967	password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
	1968	usepwd = true;\r
	1969	cmdp += 2;\r
	1970	break;\r
	1971	case '1':\r
	1972	// use Graphbuffer data\r
	1973	useGB = true;\r
	1974	cmdp++;\r
	1975	break;\r
	1976	default:\r
	1977	PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
	1978	errors = true;\r
	1979	break;\r
	1980	}\r
	1981	}\r
	1982	if (errors) return usage_t55xx_detectP1();\r
	1983	\r
	1984	if ( !useGB ) {\r
	1985	if ( !AquireData(T55x7_PAGE1, 1, usepwd, password,0) )\r
	1986	return false;\r
	1987	}\r
	1988	bool success = tryDetectP1(false);\r
	1989	if (success) PrintAndLog("T55xx chip found!");\r
	1990	return success;\r
	1991	}\r
	1992	\r
	1993	static command_t CommandTable[] = {\r
	1994	{"help", CmdHelp, 1, "This help"},\r
	1995	{"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},\r
	1996	{"bruteforcedl",CmdT55xxBruteForce_downlink,0, "r <start password> <end password> [i <*.dic>] [e <downlink>] Simple bruteforce attack to find password"},\r
	1997	{"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},\r
	1998	{"detect", CmdT55xxDetect, 1, "[1] Try detecting the tag modulation from reading the configuration block."},\r
	1999	{"p1detect", CmdT55xxDetectPage1,1, "[1] Try detecting if this is a t55xx tag by reading page 1"},\r
	2000	{"read", CmdT55xxReadBlock, 0, "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},\r
	2001	{"resetread", CmdResetRead, 0, "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},\r
	2002	{"write", CmdT55xxWriteBlock,0, "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},\r
	2003	{"trace", CmdT55xxReadTrace, 1, "[1] Show T55x7 traceability data (page 1/ blk 0-1)"},\r
	2004	{"info", CmdT55xxInfo, 1, "[1] Show T55x7 configuration data (page 0/ blk 0)"},\r
	2005	{"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},\r
	2006	{"special", special, 0, "Show block changes with 64 different offsets"},\r
	2007	{"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},\r
	2008	{"wipe", CmdT55xxWipe, 0, "[q] Wipe a T55xx tag and set defaults (will destroy any data on tag)"},\r
	2009	{NULL, NULL, 0, NULL}\r
	2010	};\r
	2011	\r
	2012	int CmdLFT55XX(const char *Cmd) {\r
	2013	CmdsParse(CommandTable, Cmd);\r
	2014	return 0;\r
	2015	}\r
	2016	\r
	2017	int CmdHelp(const char *Cmd) {\r
	2018	CmdsHelp(CommandTable);\r
	2019	return 0;\r
	2020	}\r