]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c
projects / proxmark3-svn / blob
? search:


3820e590b02e6b21e74090f6fc47fe5337923214
[proxmark3-svn] / client / cmdlft55xx.c
1 //-----------------------------------------------------------------------------
2 //
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
5 // the license.
6 //-----------------------------------------------------------------------------
7 // Low frequency T55xx commands
8 //-----------------------------------------------------------------------------
9
10 #include <stdio.h>
11 #include <string.h>
12 #include <inttypes.h>
13 #include "proxmark3.h"
14 #include "ui.h"
15 #include "graph.h"
16 #include "cmdmain.h"
17 #include "cmdparser.h"
18 #include "cmddata.h"
19 #include "cmdlf.h"
20 #include "cmdlft55xx.h"
21 #include "util.h"
22 #include "data.h"
23
24
25 #define LF_TRACE_BUFF_SIZE 12000 // 32 x 32 x 10 (32 bit times numofblock (7), times clock skip..)
26 static int CmdHelp(const char *Cmd);
27
28
29 int CmdReadBlk(const char *Cmd)
30 {
31 //default to invalid block
32 int Block = -1;
33 UsbCommand c;
34
35 sscanf(Cmd, "%d", &Block);
36
37 if ((Block > 7) | (Block < 0)) {
38 PrintAndLog("Block must be between 0 and 7");
39 return 1;
40 }
41
42 //PrintAndLog(" Reading page 0 block : %d", Block);
43
44 // this command fills up BigBuff
45 //
46 c.cmd = CMD_T55XX_READ_BLOCK;
47 c.d.asBytes[0] = 0x00;
48 c.arg[0] = 0;
49 c.arg[1] = Block;
50 c.arg[2] = 0;
51 SendCommand(&c);
52 WaitForResponse(CMD_ACK, NULL);
53
54 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
55
56 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
57 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
58
59 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
60 GraphBuffer[j] = ((int)data[j]) ;
61 }
62 GraphTraceLen = LF_TRACE_BUFF_SIZE;
63
64 uint8_t bits[1000] = {0x00};
65 uint8_t * bitstream = bits;
66
67 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
68
69 uint32_t bl0 = PackBits(5, 32, bitstream);
70 PrintAndLog(" Block %d : 0x%08X %s", Block, bl0, sprint_bin(bitstream+5,32) );
71
72 RepaintGraphWindow();
73 return 0;
74 }
75
76 int CmdReadBlkPWD(const char *Cmd)
77 {
78 int Block = -1; //default to invalid block
79 int Password = 0xFFFFFFFF; //default to blank Block 7
80 UsbCommand c;
81
82 sscanf(Cmd, "%d %x", &Block, &Password);
83
84 if ((Block > 7) | (Block < 0)) {
85 PrintAndLog("Block must be between 0 and 7");
86 return 1;
87 }
88
89 PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
90
91 c.cmd = CMD_T55XX_READ_BLOCK;
92 c.d.asBytes[0] = 0x1; //Password mode
93 c.arg[0] = 0;
94 c.arg[1] = Block;
95 c.arg[2] = Password;
96 SendCommand(&c);
97 WaitForResponse(CMD_ACK, NULL);
98
99 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
100
101 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
102 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
103
104 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
105 GraphBuffer[j] = ((int)data[j]) - 128;
106 }
107 GraphTraceLen = LF_TRACE_BUFF_SIZE;
108
109 uint8_t bits[1000] = {0x00};
110 uint8_t * bitstream = bits;
111
112 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
113
114 uint32_t bl0 = PackBits(5, 32, bitstream);
115 PrintAndLog(" Block %d : 0x%08X %s", Block, bl0, sprint_bin(bitstream+5,32) );
116
117 RepaintGraphWindow();
118 return 0;
119 }
120
121 int CmdWriteBlk(const char *Cmd)
122 {
123 int Block = 8; //default to invalid block
124 int Data = 0xFFFFFFFF; //default to blank Block
125 UsbCommand c;
126
127 sscanf(Cmd, "%x %d", &Data, &Block);
128
129 if (Block > 7) {
130 PrintAndLog("Block must be between 0 and 7");
131 return 1;
132 }
133
134 PrintAndLog("Writting block %d with data %08X", Block, Data);
135
136 c.cmd = CMD_T55XX_WRITE_BLOCK;
137 c.d.asBytes[0] = 0x0; //Normal mode
138 c.arg[0] = Data;
139 c.arg[1] = Block;
140 c.arg[2] = 0;
141 SendCommand(&c);
142 return 0;
143 }
144
145 int CmdWriteBlkPWD(const char *Cmd)
146 {
147 int Block = 8; //default to invalid block
148 int Data = 0xFFFFFFFF; //default to blank Block
149 int Password = 0xFFFFFFFF; //default to blank Block 7
150 UsbCommand c;
151
152 sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
153
154 if (Block > 7) {
155 PrintAndLog("Block must be between 0 and 7");
156 return 1;
157 }
158
159 PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
160
161 c.cmd = CMD_T55XX_WRITE_BLOCK;
162 c.d.asBytes[0] = 0x1; //Password mode
163 c.arg[0] = Data;
164 c.arg[1] = Block;
165 c.arg[2] = Password;
166 SendCommand(&c);
167 return 0;
168 }
169
170 int CmdReadTrace(const char *Cmd)
171 {
172 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
173 SendCommand(&c);
174 WaitForResponse(CMD_ACK, NULL);
175
176 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
177
178 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
179 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
180
181 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
182 GraphBuffer[j] = ((int)data[j]);
183 //GraphBuffer[j] = ((int)data[j]) - 128;
184 }
185 GraphTraceLen = LF_TRACE_BUFF_SIZE;
186
187 uint8_t bits[1000] = {0x00};
188 uint8_t * bitstream = bits;
189
190 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
191 RepaintGraphWindow();
192
193 uint8_t si = 5;
194 uint32_t bl0 = PackBits(si, 32, bitstream);
195 uint32_t bl1 = PackBits(si+32, 32, bitstream);
196
197 uint32_t acl = PackBits(si, 8, bitstream); si += 8;
198 uint32_t mfc = PackBits(si, 8, bitstream); si += 8;
199 uint32_t cid = PackBits(si, 5, bitstream); si += 5;
200 uint32_t icr = PackBits(si, 3, bitstream); si += 3;
201 uint32_t year = PackBits(si, 4, bitstream); si += 4;
202 uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
203 uint32_t lotid = PackBits(si, 12, bitstream); si += 12;
204 uint32_t wafer = PackBits(si, 5, bitstream); si += 5;
205 uint32_t dw = PackBits(si, 15, bitstream);
206
207 PrintAndLog("");
208 PrintAndLog("-- T55xx Trace Information ----------------------------------");
209 PrintAndLog("-------------------------------------------------------------");
210 PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", acl, acl);
211 PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d)", mfc, mfc);
212 PrintAndLog(" CID : 0x%02X (%d)", cid, cid);
213 PrintAndLog(" ICR IC Revision : %d",icr );
214 PrintAndLog(" Manufactured");
215 PrintAndLog(" Year/Quarter : %d/%d",2000+year, quarter );
216 PrintAndLog(" Lot ID : %d", lotid );
217 PrintAndLog(" Wafer number : %d", wafer);
218 PrintAndLog(" Die Number : %d", dw);
219 PrintAndLog("-------------------------------------------------------------");
220 PrintAndLog(" Raw Data - Page 1");
221 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bitstream+5,32) );
222 PrintAndLog(" Block 0 : 0x%08X %s", bl1, sprint_bin(bitstream+37,32) );
223 PrintAndLog("-------------------------------------------------------------");
224 /*
225 TRACE - BLOCK O
226 Bits Definition HEX
227 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0
228 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation
229 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2
230 22-24 ICR IC revision
231 25-28 YEAR (BCD encoded) 9 (= 2009)
232 29-30 QUARTER 1,2,3,4
233 31-32 LOT ID
234
235 TRACE - BLOCK 1
236 1-12 LOT ID
237 13-17 Wafer number
238 18-32 DW, die number sequential
239 */
240
241 return 0;
242 }
243
244 int CmdInfo(const char *Cmd){
245 /*
246 Page 0 Block 0 Configuration data.
247 Normal mode
248 Extended mode
249 */
250 // läs block 0 - data finns i graphbuff
251 CmdReadBlk("0");
252
253 uint8_t bits[1000] = {0x00};
254 uint8_t * bitstream = bits;
255
256 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
257
258 uint8_t si = 5;
259 uint32_t bl0 = PackBits(si, 32, bitstream);
260
261 uint32_t safer = PackBits(si, 4, bitstream); si += 4;
262 uint32_t resv = PackBits(si, 7, bitstream); si += 7;
263 uint32_t dbr = PackBits(si, 3, bitstream); si += 3;
264 uint32_t extend = PackBits(si, 1, bitstream); si += 1;
265 uint32_t datamodulation = PackBits(si, 5, bitstream); si += 5;
266 uint32_t pskcf = PackBits(si, 2, bitstream); si += 2;
267 uint32_t aor = PackBits(si, 1, bitstream); si += 1;
268 uint32_t otp = PackBits(si, 1, bitstream); si += 1;
269 uint32_t maxblk = PackBits(si, 3, bitstream); si += 3;
270 uint32_t pwd = PackBits(si, 1, bitstream); si += 1;
271 uint32_t sst = PackBits(si, 1, bitstream); si += 1;
272 uint32_t fw = PackBits(si, 1, bitstream); si += 1;
273 uint32_t inv = PackBits(si, 1, bitstream); si += 1;
274 uint32_t por = PackBits(si, 1, bitstream); si += 1;
275
276 PrintAndLog("");
277 PrintAndLog("-- T55xx Configuration --------------------------------------");
278 PrintAndLog("-------------------------------------------------------------");
279 PrintAndLog(" Safer key : %s", GetSaferStr(safer));
280 PrintAndLog(" reserved : %d", resv);
281 PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr));
282 PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");
283 PrintAndLog(" Modulation : %s", GetModulationStr(datamodulation) );
284 PrintAndLog(" PSK clock freq : %d", pskcf);
285 PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");
286 PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );
287 PrintAndLog(" Max block : %d", maxblk);
288 PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");
289 PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
290 PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");
291 PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");
292 PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");
293 PrintAndLog("-------------------------------------------------------------");
294 PrintAndLog(" Raw Data - Page 0");
295 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bitstream+5,32) );
296 PrintAndLog("-------------------------------------------------------------");
297
298 return 0;
299 }
300
301 int CmdDump(const char *Cmd){
302
303 char cmdp = param_getchar(Cmd, 0);
304 char s[20];
305 uint8_t pwd[4] = {0x00};
306
307 if (strlen(Cmd)>1 || cmdp == 'h' || cmdp == 'H') {
308 PrintAndLog("Usage: lf t55xx dump <password>");
309 PrintAndLog(" sample: lf t55xx dump FFFFFFFF");
310 return 0;
311 }
312
313 bool hasPwd = ( strlen(Cmd) > 0);
314
315 if ( hasPwd ){
316 if (param_gethex(Cmd, 0, pwd, 4)) {
317 PrintAndLog("password must include 4 HEX symbols");
318 return 0;
319 }
320 }
321
322 for ( int i = 0; i <8; ++i){
323 *s = 0;
324 if ( hasPwd ) {
325 sprintf(s,"%d %d", i, pwd);
326 CmdReadBlkPWD(s);
327 } else {
328 sprintf(s,"%d", i);
329 CmdReadBlk(s);
330 }
331 }
332 return 0;
333 }
334
335 int CmdIceFsk(const char *Cmd){
336 //uint8_t bits[1000] = {0x00};
337 //uint8_t * bitstream = bits;
338 iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
339
340 RepaintGraphWindow();
341 return 0;
342 }
343
344 char * GetBitRateStr(uint32_t id){
345 static char buf[40];
346 char *retStr = buf;
347 switch (id){
348 case 0:
349 sprintf(retStr,"%d - RF/8",id);
350 break;
351 case 1:
352 sprintf(retStr,"%d - RF/16",id);
353 break;
354 case 2:
355 sprintf(retStr,"%d - RF/32",id);
356 break;
357 case 3:
358 sprintf(retStr,"%d - RF/40",id);
359 break;
360 case 4:
361 sprintf(retStr,"%d - RF/50",id);
362 break;
363 case 5:
364 sprintf(retStr,"%d - RF/64",id);
365 break;
366 case 6:
367 sprintf(retStr,"%d - RF/100",id);
368 break;
369 case 7:
370 sprintf(retStr,"%d - RF/128",id);
371 break;
372 default:
373 sprintf(retStr,"%d - (Unknown)",id);
374 break;
375 }
376
377 return buf;
378 }
379
380 char * GetSaferStr(uint32_t id){
381 static char buf[40];
382 char *retStr = buf;
383
384 sprintf(retStr,"%d",id);
385 if (id == 6) {
386 sprintf(retStr,"%d - pasdwd",id);
387 }
388 if (id == 9 ){
389 sprintf(retStr,"%d - testmode ",id);
390 }
391
392 return buf;
393 }
394 char * GetModulationStr( uint32_t id){
395 static char buf[40];
396 char *retStr = buf;
397
398 switch (id){
399 case 0:
400 sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
401 break;
402 case 1:
403 sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
404 break;
405 case 2:
406 sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
407 break;
408 case 3:
409 sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
410 break;
411 case 4:
412 sprintf(retStr,"%d - FSK 1 RF/8 RF/5",id);
413 break;
414 case 5:
415 sprintf(retStr,"%d - FSK 2 RF/8 RF/10",id);
416 break;
417 case 6:
418 sprintf(retStr,"%d - FSK 1a RF/5 RF/8",id);
419 break;
420 case 7:
421 sprintf(retStr,"%d - FSK 2a RF/10 RF/8",id);
422 break;
423 case 8:
424 sprintf(retStr,"%d - Manschester",id);
425 break;
426 case 16:
427 sprintf(retStr,"%d - Biphase",id);
428 break;
429 case 17:
430 sprintf(retStr,"%d - Reserved",id);
431 break;
432 default:
433 sprintf(retStr,"0x%02X (Unknown)",id);
434 break;
435 }
436 return buf;
437 }
438
439
440 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
441
442 int i = start;
443 int j = len-1;
444 uint32_t tmp = 0;
445 for (; j >= 0; --j, ++i){
446 tmp |= bits[i] << j;
447 }
448 return tmp;
449 }
450
451 static command_t CommandTable[] =
452 {
453 {"help", CmdHelp, 1, "This help"},
454 {"rd", CmdReadBlk, 0, "<block> -- Read T55xx block data (page 0)"},
455 {"rdPWD", CmdReadBlkPWD, 0, "<block> <password> -- Read T55xx block data with password mode"},
456 {"wr", CmdWriteBlk, 0, "<data> <block> -- Write T55xx block data (page 0)"},
457 {"wrPWD", CmdWriteBlkPWD, 0, "<data> <block> <password> -- Write T55xx block data with password"},
458 {"trace", CmdReadTrace, 0, "Read T55xx traceability data (page 1 / blk 0-1)"},
459 {"info", CmdInfo, 0, "Read T55xx configuration data (page0 /blk 0)"},
460 {"dump", CmdDump, 0, "[password] Dump T55xx card block 0-7. optional with password"},
461 {"fsk", CmdIceFsk, 0, "FSK demod"},
462 {NULL, NULL, 0, NULL}
463 };
464
465 int CmdLFT55XX(const char *Cmd)
466 {
467 CmdsParse(CommandTable, Cmd);
468 return 0;
469 }
470
471 int CmdHelp(const char *Cmd)
472 {
473 CmdsHelp(CommandTable);
474 return 0;
475 }
Proxmark3 GIT tracking
Impressum, Datenschutz