]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
Merge branch 'master' of https://github.com/Proxmark/proxmark3
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <inttypes.h>
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "util.h"
17 #include "graph.h"
18 #include "cmdparser.h"
19 #include "cmddata.h"
20 #include "cmdlf.h"
21 #include "cmdlfem4x.h"
22 char *global_em410xId;
23
24 static int CmdHelp(const char *Cmd);
25
26 int CmdEMdemodASK(const char *Cmd)
27 {
28 char cmdp = param_getchar(Cmd, 0);
29 int findone = (cmdp == '1') ? 1 : 0;
30 UsbCommand c={CMD_EM410X_DEMOD};
31 c.arg[0]=findone;
32 SendCommand(&c);
33 return 0;
34 }
35
36 /* Read the ID of an EM410x tag.
37 * Format:
38 * 1111 1111 1 <-- standard non-repeatable header
39 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
40 * ....
41 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
42 * 0 <-- stop bit, end of tag
43 */
44 int CmdEM410xRead(const char *Cmd)
45 {
46 uint32_t hi=0;
47 uint64_t lo=0;
48
49 if(!AskEm410xDemod("", &hi, &lo)) return 0;
50 PrintAndLog("EM410x pattern found: ");
51 printEM410x(hi, lo);
52 if (hi){
53 PrintAndLog ("EM410x XL pattern found");
54 return 0;
55 }
56 char id[12] = {0x00};
57 sprintf(id, "%010llx",lo);
58
59 global_em410xId = id;
60 return 1;
61 }
62
63 // emulate an EM410X tag
64 int CmdEM410xSim(const char *Cmd)
65 {
66 int i, n, j, binary[4], parity[4];
67
68 char cmdp = param_getchar(Cmd, 0);
69 uint8_t uid[5] = {0x00};
70
71 if (cmdp == 'h' || cmdp == 'H') {
72 PrintAndLog("Usage: lf em4x em410xsim <UID>");
73 PrintAndLog("");
74 PrintAndLog(" sample: lf em4x em410xsim 0F0368568B");
75 return 0;
76 }
77
78 if (param_gethex(Cmd, 0, uid, 10)) {
79 PrintAndLog("UID must include 10 HEX symbols");
80 return 0;
81 }
82
83 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
84 PrintAndLog("Press pm3-button to about simulation");
85
86 /* clock is 64 in EM410x tags */
87 int clock = 64;
88
89 /* clear our graph */
90 ClearGraph(0);
91
92 /* write 9 start bits */
93 for (i = 0; i < 9; i++)
94 AppendGraph(0, clock, 1);
95
96 /* for each hex char */
97 parity[0] = parity[1] = parity[2] = parity[3] = 0;
98 for (i = 0; i < 10; i++)
99 {
100 /* read each hex char */
101 sscanf(&Cmd[i], "%1x", &n);
102 for (j = 3; j >= 0; j--, n/= 2)
103 binary[j] = n % 2;
104
105 /* append each bit */
106 AppendGraph(0, clock, binary[0]);
107 AppendGraph(0, clock, binary[1]);
108 AppendGraph(0, clock, binary[2]);
109 AppendGraph(0, clock, binary[3]);
110
111 /* append parity bit */
112 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
113
114 /* keep track of column parity */
115 parity[0] ^= binary[0];
116 parity[1] ^= binary[1];
117 parity[2] ^= binary[2];
118 parity[3] ^= binary[3];
119 }
120
121 /* parity columns */
122 AppendGraph(0, clock, parity[0]);
123 AppendGraph(0, clock, parity[1]);
124 AppendGraph(0, clock, parity[2]);
125 AppendGraph(0, clock, parity[3]);
126
127 /* stop bit */
128 AppendGraph(1, clock, 0);
129
130 CmdLFSim("0"); //240 start_gap.
131 return 0;
132 }
133
134 /* Function is equivalent of lf read + data samples + em410xread
135 * looped until an EM410x tag is detected
136 *
137 * Why is CmdSamples("16000")?
138 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
139 * rate gets lower, then grow the number of samples
140 * Changed by martin, 4000 x 4 = 16000,
141 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
142
143 */
144 int CmdEM410xWatch(const char *Cmd)
145 {
146 do {
147 if (ukbhit()) {
148 printf("\naborted via keyboard!\n");
149 break;
150 }
151
152 CmdLFRead("s");
153 getSamples("8192",true); //capture enough to get 2 full messages
154 } while (!CmdEM410xRead(""));
155
156 return 0;
157 }
158
159 int CmdEM410xWatchnSpoof(const char *Cmd)
160 {
161 CmdEM410xWatch(Cmd);
162 PrintAndLog("# Replaying captured ID: %s",global_em410xId);
163 CmdLFaskSim("");
164 return 0;
165 }
166
167 /* Read the transmitted data of an EM4x50 tag
168 * Format:
169 *
170 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
171 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
172 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
173 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
174 * CCCCCCCC <- column parity bits
175 * 0 <- stop bit
176 * LW <- Listen Window
177 *
178 * This pattern repeats for every block of data being transmitted.
179 * Transmission starts with two Listen Windows (LW - a modulated
180 * pattern of 320 cycles each (32/32/128/64/64)).
181 *
182 * Note that this data may or may not be the UID. It is whatever data
183 * is stored in the blocks defined in the control word First and Last
184 * Word Read values. UID is stored in block 32.
185 */
186 int CmdEM4x50Read(const char *Cmd)
187 {
188 int i, j, startblock, skip, block, start, end, low, high;
189 bool complete= false;
190 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
191 char tmp[6];
192
193 high= low= 0;
194 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
195
196 /* first get high and low values */
197 for (i = 0; i < GraphTraceLen; i++)
198 {
199 if (GraphBuffer[i] > high)
200 high = GraphBuffer[i];
201 else if (GraphBuffer[i] < low)
202 low = GraphBuffer[i];
203 }
204
205 /* populate a buffer with pulse lengths */
206 i= 0;
207 j= 0;
208 while (i < GraphTraceLen)
209 {
210 // measure from low to low
211 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
212 ++i;
213 start= i;
214 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
215 ++i;
216 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
217 ++i;
218 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
219 break;
220 }
221 tmpbuff[j++]= i - start;
222 }
223
224 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
225 start= -1;
226 skip= 0;
227 for (i= 0; i < j - 4 ; ++i)
228 {
229 skip += tmpbuff[i];
230 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
231 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
232 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
233 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
234 {
235 start= i + 3;
236 break;
237 }
238 }
239 startblock= i + 3;
240
241 /* skip over the remainder of the LW */
242 skip += tmpbuff[i+1]+tmpbuff[i+2];
243 while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
244 ++skip;
245 skip += 8;
246
247 /* now do it again to find the end */
248 end= start;
249 for (i += 3; i < j - 4 ; ++i)
250 {
251 end += tmpbuff[i];
252 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
253 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
254 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
255 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
256 {
257 complete= true;
258 break;
259 }
260 }
261
262 if (start >= 0)
263 PrintAndLog("Found data at sample: %i",skip);
264 else
265 {
266 PrintAndLog("No data found!");
267 PrintAndLog("Try again with more samples.");
268 return 0;
269 }
270
271 if (!complete)
272 {
273 PrintAndLog("*** Warning!");
274 PrintAndLog("Partial data - no end found!");
275 PrintAndLog("Try again with more samples.");
276 }
277
278 /* get rid of leading crap */
279 sprintf(tmp,"%i",skip);
280 CmdLtrim(tmp);
281
282 /* now work through remaining buffer printing out data blocks */
283 block= 0;
284 i= startblock;
285 while (block < 6)
286 {
287 PrintAndLog("Block %i:", block);
288 // mandemod routine needs to be split so we can call it for data
289 // just print for now for debugging
290 CmdManchesterDemod("i 64");
291 skip= 0;
292 /* look for LW before start of next block */
293 for ( ; i < j - 4 ; ++i)
294 {
295 skip += tmpbuff[i];
296 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
297 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
298 break;
299 }
300 while (GraphBuffer[skip] > low)
301 ++skip;
302 skip += 8;
303 sprintf(tmp,"%i",skip);
304 CmdLtrim(tmp);
305 start += skip;
306 block++;
307 }
308 return 0;
309 }
310
311 int CmdEM410xWrite(const char *Cmd)
312 {
313 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
314 int card = 0xFF; // invalid card value
315 unsigned int clock = 0; // invalid clock value
316
317 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
318
319 // Check ID
320 if (id == 0xFFFFFFFFFFFFFFFF) {
321 PrintAndLog("Error! ID is required.\n");
322 return 0;
323 }
324 if (id >= 0x10000000000) {
325 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
326 return 0;
327 }
328
329 // Check Card
330 if (card == 0xFF) {
331 PrintAndLog("Error! Card type required.\n");
332 return 0;
333 }
334 if (card < 0) {
335 PrintAndLog("Error! Bad card type selected.\n");
336 return 0;
337 }
338
339 // Check Clock
340 if (card == 1)
341 {
342 // Default: 64
343 if (clock == 0)
344 clock = 64;
345
346 // Allowed clock rates: 16, 32 and 64
347 if ((clock != 16) && (clock != 32) && (clock != 64)) {
348 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
349 return 0;
350 }
351 }
352 else if (clock != 0)
353 {
354 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
355 return 0;
356 }
357
358 if (card == 1) {
359 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
360 // NOTE: We really should pass the clock in as a separate argument, but to
361 // provide for backwards-compatibility for older firmware, and to avoid
362 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
363 // the clock rate in bits 8-15 of the card value
364 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
365 }
366 else if (card == 0)
367 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
368 else {
369 PrintAndLog("Error! Bad card type selected.\n");
370 return 0;
371 }
372
373 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
374 SendCommand(&c);
375
376 return 0;
377 }
378
379 int CmdReadWord(const char *Cmd)
380 {
381 int Word = -1; //default to invalid word
382 UsbCommand c;
383
384 sscanf(Cmd, "%d", &Word);
385
386 if ( (Word > 15) | (Word < 0) ) {
387 PrintAndLog("Word must be between 0 and 15");
388 return 1;
389 }
390
391 PrintAndLog("Reading word %d", Word);
392
393 c.cmd = CMD_EM4X_READ_WORD;
394 c.d.asBytes[0] = 0x0; //Normal mode
395 c.arg[0] = 0;
396 c.arg[1] = Word;
397 c.arg[2] = 0;
398 SendCommand(&c);
399 return 0;
400 }
401
402 int CmdReadWordPWD(const char *Cmd)
403 {
404 int Word = -1; //default to invalid word
405 int Password = 0xFFFFFFFF; //default to blank password
406 UsbCommand c;
407
408 sscanf(Cmd, "%d %x", &Word, &Password);
409
410 if ( (Word > 15) | (Word < 0) ) {
411 PrintAndLog("Word must be between 0 and 15");
412 return 1;
413 }
414
415 PrintAndLog("Reading word %d with password %08X", Word, Password);
416
417 c.cmd = CMD_EM4X_READ_WORD;
418 c.d.asBytes[0] = 0x1; //Password mode
419 c.arg[0] = 0;
420 c.arg[1] = Word;
421 c.arg[2] = Password;
422 SendCommand(&c);
423 return 0;
424 }
425
426 int CmdWriteWord(const char *Cmd)
427 {
428 int Word = 16; //default to invalid block
429 int Data = 0xFFFFFFFF; //default to blank data
430 UsbCommand c;
431
432 sscanf(Cmd, "%x %d", &Data, &Word);
433
434 if (Word > 15) {
435 PrintAndLog("Word must be between 0 and 15");
436 return 1;
437 }
438
439 PrintAndLog("Writing word %d with data %08X", Word, Data);
440
441 c.cmd = CMD_EM4X_WRITE_WORD;
442 c.d.asBytes[0] = 0x0; //Normal mode
443 c.arg[0] = Data;
444 c.arg[1] = Word;
445 c.arg[2] = 0;
446 SendCommand(&c);
447 return 0;
448 }
449
450 int CmdWriteWordPWD(const char *Cmd)
451 {
452 int Word = 16; //default to invalid word
453 int Data = 0xFFFFFFFF; //default to blank data
454 int Password = 0xFFFFFFFF; //default to blank password
455 UsbCommand c;
456
457 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
458
459 if (Word > 15) {
460 PrintAndLog("Word must be between 0 and 15");
461 return 1;
462 }
463
464 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
465
466 c.cmd = CMD_EM4X_WRITE_WORD;
467 c.d.asBytes[0] = 0x1; //Password mode
468 c.arg[0] = Data;
469 c.arg[1] = Word;
470 c.arg[2] = Password;
471 SendCommand(&c);
472 return 0;
473 }
474
475 static command_t CommandTable[] =
476 {
477 {"help", CmdHelp, 1, "This help"},
478 {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
479 {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
480 {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
481 {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
482 {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
483 {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
484 {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
485 {"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
486 {"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
487 {"writeword", CmdWriteWord, 1, "<Data> <Word> -- Write EM4xxx word data"},
488 {"writewordPWD", CmdWriteWordPWD, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
489 {NULL, NULL, 0, NULL}
490 };
491
492 int CmdLFEM4X(const char *Cmd)
493 {
494 CmdsParse(CommandTable, Cmd);
495 return 0;
496 }
497
498 int CmdHelp(const char *Cmd)
499 {
500 CmdsHelp(CommandTable);
501 return 0;
502 }
Impressum, Datenschutz