]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
47a5ac3e7b8b4647967270c69b0a7110c06842e5
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <inttypes.h>
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "util.h"
17 #include "graph.h"
18 #include "cmdparser.h"
19 #include "cmddata.h"
20 #include "cmdlf.h"
21 #include "cmdlfem4x.h"
22 #include "lfdemod.h"
23 char *global_em410xId;
24
25 static int CmdHelp(const char *Cmd);
26
27 int CmdEMdemodASK(const char *Cmd)
28 {
29 char cmdp = param_getchar(Cmd, 0);
30 int findone = (cmdp == '1') ? 1 : 0;
31 UsbCommand c={CMD_EM410X_DEMOD};
32 c.arg[0]=findone;
33 SendCommand(&c);
34 return 0;
35 }
36
37 /* Read the ID of an EM410x tag.
38 * Format:
39 * 1111 1111 1 <-- standard non-repeatable header
40 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
41 * ....
42 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
43 * 0 <-- stop bit, end of tag
44 */
45 int CmdEM410xRead(const char *Cmd)
46 {
47 uint32_t hi=0;
48 uint64_t lo=0;
49
50 if(!AskEm410xDemod("", &hi, &lo)) return 0;
51 PrintAndLog("EM410x pattern found: ");
52 printEM410x(hi, lo);
53 if (hi){
54 PrintAndLog ("EM410x XL pattern found");
55 return 0;
56 }
57 char id[12] = {0x00};
58 sprintf(id, "%010llx",lo);
59
60 global_em410xId = id;
61 return 1;
62 }
63
64 // emulate an EM410X tag
65 int CmdEM410xSim(const char *Cmd)
66 {
67 int i, n, j, binary[4], parity[4];
68
69 char cmdp = param_getchar(Cmd, 0);
70 uint8_t uid[5] = {0x00};
71
72 if (cmdp == 'h' || cmdp == 'H') {
73 PrintAndLog("Usage: lf em4x 410xsim <UID>");
74 PrintAndLog("");
75 PrintAndLog(" sample: lf em4x 410xsim 0F0368568B");
76 return 0;
77 }
78
79 if (param_gethex(Cmd, 0, uid, 10)) {
80 PrintAndLog("UID must include 10 HEX symbols");
81 return 0;
82 }
83
84 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
85 PrintAndLog("Press pm3-button to about simulation");
86
87 /* clock is 64 in EM410x tags */
88 int clock = 64;
89
90 /* clear our graph */
91 ClearGraph(0);
92
93 /* write 9 start bits */
94 for (i = 0; i < 9; i++)
95 AppendGraph(0, clock, 1);
96
97 /* for each hex char */
98 parity[0] = parity[1] = parity[2] = parity[3] = 0;
99 for (i = 0; i < 10; i++)
100 {
101 /* read each hex char */
102 sscanf(&Cmd[i], "%1x", &n);
103 for (j = 3; j >= 0; j--, n/= 2)
104 binary[j] = n % 2;
105
106 /* append each bit */
107 AppendGraph(0, clock, binary[0]);
108 AppendGraph(0, clock, binary[1]);
109 AppendGraph(0, clock, binary[2]);
110 AppendGraph(0, clock, binary[3]);
111
112 /* append parity bit */
113 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
114
115 /* keep track of column parity */
116 parity[0] ^= binary[0];
117 parity[1] ^= binary[1];
118 parity[2] ^= binary[2];
119 parity[3] ^= binary[3];
120 }
121
122 /* parity columns */
123 AppendGraph(0, clock, parity[0]);
124 AppendGraph(0, clock, parity[1]);
125 AppendGraph(0, clock, parity[2]);
126 AppendGraph(0, clock, parity[3]);
127
128 /* stop bit */
129 AppendGraph(1, clock, 0);
130
131 CmdLFSim("0"); //240 start_gap.
132 return 0;
133 }
134
135 /* Function is equivalent of lf read + data samples + em410xread
136 * looped until an EM410x tag is detected
137 *
138 * Why is CmdSamples("16000")?
139 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
140 * rate gets lower, then grow the number of samples
141 * Changed by martin, 4000 x 4 = 16000,
142 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
143
144 */
145 int CmdEM410xWatch(const char *Cmd)
146 {
147 do {
148 if (ukbhit()) {
149 printf("\naborted via keyboard!\n");
150 break;
151 }
152
153 CmdLFRead("s");
154 getSamples("8192",true); //capture enough to get 2 full messages
155 } while (!CmdEM410xRead(""));
156
157 return 0;
158 }
159
160 //currently only supports manchester modulations
161 int CmdEM410xWatchnSpoof(const char *Cmd)
162 {
163 CmdEM410xWatch(Cmd);
164 PrintAndLog("# Replaying captured ID: %s",global_em410xId);
165 CmdLFaskSim("");
166 return 0;
167 }
168
169 int CmdEM410xWrite(const char *Cmd)
170 {
171 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
172 int card = 0xFF; // invalid card value
173 unsigned int clock = 0; // invalid clock value
174
175 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
176
177 // Check ID
178 if (id == 0xFFFFFFFFFFFFFFFF) {
179 PrintAndLog("Error! ID is required.\n");
180 return 0;
181 }
182 if (id >= 0x10000000000) {
183 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
184 return 0;
185 }
186
187 // Check Card
188 if (card == 0xFF) {
189 PrintAndLog("Error! Card type required.\n");
190 return 0;
191 }
192 if (card < 0) {
193 PrintAndLog("Error! Bad card type selected.\n");
194 return 0;
195 }
196
197 // Check Clock
198 if (card == 1)
199 {
200 // Default: 64
201 if (clock == 0)
202 clock = 64;
203
204 // Allowed clock rates: 16, 32 and 64
205 if ((clock != 16) && (clock != 32) && (clock != 64)) {
206 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
207 return 0;
208 }
209 }
210 else if (clock != 0)
211 {
212 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
213 return 0;
214 }
215
216 if (card == 1) {
217 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
218 // NOTE: We really should pass the clock in as a separate argument, but to
219 // provide for backwards-compatibility for older firmware, and to avoid
220 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
221 // the clock rate in bits 8-15 of the card value
222 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
223 }
224 else if (card == 0)
225 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
226 else {
227 PrintAndLog("Error! Bad card type selected.\n");
228 return 0;
229 }
230
231 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
232 SendCommand(&c);
233
234 return 0;
235 }
236
237 bool EM_EndParityTest(uint8_t *BitStream, size_t size, uint8_t rows, uint8_t cols, uint8_t pType)
238 {
239 if (rows*cols>size) return false;
240 uint8_t colP=0;
241 //assume last row is a parity row and do not test
242 for (uint8_t colNum = 0; colNum < cols-1; colNum++) {
243 for (uint8_t rowNum = 0; rowNum < rows; rowNum++) {
244 colP ^= BitStream[(rowNum*cols)+colNum];
245 }
246 if (colP != pType) return false;
247 }
248 return true;
249 }
250
251 bool EM_ByteParityTest(uint8_t *BitStream, size_t size, uint8_t rows, uint8_t cols, uint8_t pType)
252 {
253 if (rows*cols>size) return false;
254 uint8_t rowP=0;
255 //assume last row is a parity row and do not test
256 for (uint8_t rowNum = 0; rowNum < rows-1; rowNum++) {
257 for (uint8_t colNum = 0; colNum < cols; colNum++) {
258 rowP ^= BitStream[(rowNum*cols)+colNum];
259 }
260 if (rowP != pType) return false;
261 }
262 return true;
263 }
264
265 uint32_t OutputEM4x50_Block(uint8_t *BitStream, size_t size, bool verbose, bool pTest)
266 {
267 if (size<45) return 0;
268 uint32_t code = bytebits_to_byte(BitStream,8);
269 code = code<<8 | bytebits_to_byte(BitStream+9,8);
270 code = code<<8 | bytebits_to_byte(BitStream+18,8);
271 code = code<<8 | bytebits_to_byte(BitStream+27,8);
272 if (verbose || g_debugMode){
273 for (uint8_t i = 0; i<5; i++){
274 if (i == 4) PrintAndLog("");
275 PrintAndLog("%d%d%d%d%d%d%d%d %d -> 0x%02x",
276 BitStream[i*9],
277 BitStream[i*9+1],
278 BitStream[i*9+2],
279 BitStream[i*9+3],
280 BitStream[i*9+4],
281 BitStream[i*9+5],
282 BitStream[i*9+6],
283 BitStream[i*9+7],
284 BitStream[i*9+8],
285 bytebits_to_byte(BitStream+i*9,8)
286 );
287 }
288 if (pTest)
289 PrintAndLog("Parity Passed");
290 else
291 PrintAndLog("Parity Failed");
292 }
293 //PrintAndLog("Code: %08x",code);
294 return code;
295 }
296 /* Read the transmitted data of an EM4x50 tag
297 * Format:
298 *
299 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
300 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
301 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
302 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
303 * CCCCCCCC <- column parity bits
304 * 0 <- stop bit
305 * LW <- Listen Window
306 *
307 * This pattern repeats for every block of data being transmitted.
308 * Transmission starts with two Listen Windows (LW - a modulated
309 * pattern of 320 cycles each (32/32/128/64/64)).
310 *
311 * Note that this data may or may not be the UID. It is whatever data
312 * is stored in the blocks defined in the control word First and Last
313 * Word Read values. UID is stored in block 32.
314 */
315 int EM4x50Read(const char *Cmd, bool verbose)
316 {
317 uint8_t fndClk[]={0,8,16,32,40,50,64};
318 int clk = 0;
319 int invert = 0;
320 sscanf(Cmd, "%i %i", &clk, &invert);
321 int tol = 0;
322 int i, j, startblock, skip, block, start, end, low, high, minClk;
323 bool complete= false;
324 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
325 save_restoreGB(1);
326 uint32_t Code[6];
327 char tmp[6];
328
329 char tmp2[20];
330 high= low= 0;
331 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
332
333 // first get high and low values
334 for (i = 0; i < GraphTraceLen; i++)
335 {
336 if (GraphBuffer[i] > high)
337 high = GraphBuffer[i];
338 else if (GraphBuffer[i] < low)
339 low = GraphBuffer[i];
340 }
341
342 // populate a buffer with pulse lengths
343 i= 0;
344 j= 0;
345 minClk= 255;
346 while (i < GraphTraceLen)
347 {
348 // measure from low to low
349 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
350 ++i;
351 start= i;
352 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
353 ++i;
354 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
355 ++i;
356 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
357 break;
358 }
359 tmpbuff[j++]= i - start;
360 if (i-start < minClk) minClk = i-start;
361 }
362 // set clock
363 if (!clk){
364 for (uint8_t clkCnt = 0; clkCnt<7; clkCnt++) {
365 tol = fndClk[clkCnt]/8;
366 if (fndClk[clkCnt]-tol >= minClk) {
367 clk=fndClk[clkCnt];
368 break;
369 }
370 }
371 } else tol = clk/8;
372
373 // look for data start - should be 2 pairs of LW (pulses of clk*3,clk*2)
374 start= -1;
375 skip= 0;
376 for (i= 0; i < j - 4 ; ++i)
377 {
378 skip += tmpbuff[i];
379 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol)
380 if (tmpbuff[i+1] >= clk*2-tol && tmpbuff[i+1] <= clk*2+tol)
381 if (tmpbuff[i+2] >= clk*3-tol && tmpbuff[i+2] <= clk*3+tol)
382 if (tmpbuff[i+3] >= clk-tol)
383 {
384 start= i + 4;
385 break;
386 }
387 }
388 startblock= i + 4;
389
390 // skip over the remainder of LW
391 skip += tmpbuff[i+1] + tmpbuff[i+2] + clk + clk/8;
392
393 int phaseoff = tmpbuff[i+3]-clk;
394
395 // now do it again to find the end
396 end = skip;
397 for (i += 3; i < j - 4 ; ++i)
398 {
399 end += tmpbuff[i];
400 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3 + tol)
401 if (tmpbuff[i+1] >= clk*2-tol && tmpbuff[i+1] <= clk*2 + tol)
402 if (tmpbuff[i+2] >= clk*3-tol && tmpbuff[i+2] <= clk*3 + tol)
403 if (tmpbuff[i+3] >= clk-tol)
404 {
405 complete= true;
406 break;
407 }
408 }
409 end = i;
410 // report back
411 if (verbose || g_debugMode) {
412 if (start >= 0) {
413 PrintAndLog("\nNote: should print 45 bits then 0177 (end of block)");
414 PrintAndLog(" for each block");
415 PrintAndLog(" Also, sometimes the demod gets out of sync and ");
416 PrintAndLog(" inverts the output - when this happens the 0177");
417 PrintAndLog(" will be 3 extra 1's at the end");
418 PrintAndLog(" 'data askedge' command may fix that");
419 } else {
420 PrintAndLog("No data found!");
421 PrintAndLog("Try again with more samples.");
422 return 0;
423 }
424 if (!complete)
425 {
426 PrintAndLog("*** Warning!");
427 PrintAndLog("Partial data - no end found!");
428 PrintAndLog("Try again with more samples.");
429 }
430 } else if (start < 0) return 0;
431 start=skip;
432 snprintf(tmp2, sizeof(tmp2),"%d %d 1000 %d", clk, invert, clk*47);
433 // get rid of leading crap
434 snprintf(tmp, sizeof(tmp),"%i",skip);
435 CmdLtrim(tmp);
436 bool pTest;
437 bool AllPTest=true;
438 // now work through remaining buffer printing out data blocks
439 block = 0;
440 i = startblock;
441 while (block < 6)
442 {
443 if (verbose || g_debugMode) PrintAndLog("\nBlock %i:", block);
444 skip = phaseoff;
445
446 // look for LW before start of next block
447 for ( ; i < j - 4 ; ++i)
448 {
449 skip += tmpbuff[i];
450 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol)
451 if (tmpbuff[i+1] >= clk-tol)
452 break;
453 }
454 skip += clk;
455 phaseoff = tmpbuff[i+1]-clk;
456 i += 2;
457 if (ASKmanDemod(tmp2, false, false)<1) return 0;
458 //set DemodBufferLen to just one block
459 DemodBufferLen = skip/clk;
460 //test parities
461 pTest = EM_ByteParityTest(DemodBuffer,DemodBufferLen,5,9,0);
462 pTest &= EM_EndParityTest(DemodBuffer,DemodBufferLen,5,9,0);
463 AllPTest &= pTest;
464 //get output
465 Code[block]=OutputEM4x50_Block(DemodBuffer,DemodBufferLen,verbose, pTest);
466 if (g_debugMode) PrintAndLog("\nskipping %d samples, bits:%d",start, skip/clk);
467 //skip to start of next block
468 snprintf(tmp,sizeof(tmp),"%i",skip);
469 CmdLtrim(tmp);
470 block++;
471 if (i>=end) break; //in case chip doesn't output 6 blocks
472 }
473 //print full code:
474 if (verbose || g_debugMode || AllPTest){
475 PrintAndLog("Found data at sample: %i - using clock: %i",skip,clk);
476 //PrintAndLog("\nSummary:");
477 end=block;
478 for (block=0; block<end; block++){
479 PrintAndLog("Block %d: %08x",block,Code[block]);
480 }
481 if (AllPTest)
482 PrintAndLog("Parities Passed");
483 else
484 PrintAndLog("Parities Failed");
485 }
486
487 //restore GraphBuffer
488 save_restoreGB(0);
489 return (int)AllPTest;
490 }
491
492 int CmdEM4x50Read(const char *Cmd)
493 {
494 return EM4x50Read(Cmd, true);
495 }
496
497 int CmdReadWord(const char *Cmd)
498 {
499 int Word = -1; //default to invalid word
500 UsbCommand c;
501
502 sscanf(Cmd, "%d", &Word);
503
504 if ( (Word > 15) | (Word < 0) ) {
505 PrintAndLog("Word must be between 0 and 15");
506 return 1;
507 }
508
509 PrintAndLog("Reading word %d", Word);
510
511 c.cmd = CMD_EM4X_READ_WORD;
512 c.d.asBytes[0] = 0x0; //Normal mode
513 c.arg[0] = 0;
514 c.arg[1] = Word;
515 c.arg[2] = 0;
516 SendCommand(&c);
517 return 0;
518 }
519
520 int CmdReadWordPWD(const char *Cmd)
521 {
522 int Word = -1; //default to invalid word
523 int Password = 0xFFFFFFFF; //default to blank password
524 UsbCommand c;
525
526 sscanf(Cmd, "%d %x", &Word, &Password);
527
528 if ( (Word > 15) | (Word < 0) ) {
529 PrintAndLog("Word must be between 0 and 15");
530 return 1;
531 }
532
533 PrintAndLog("Reading word %d with password %08X", Word, Password);
534
535 c.cmd = CMD_EM4X_READ_WORD;
536 c.d.asBytes[0] = 0x1; //Password mode
537 c.arg[0] = 0;
538 c.arg[1] = Word;
539 c.arg[2] = Password;
540 SendCommand(&c);
541 return 0;
542 }
543
544 int CmdWriteWord(const char *Cmd)
545 {
546 int Word = 16; //default to invalid block
547 int Data = 0xFFFFFFFF; //default to blank data
548 UsbCommand c;
549
550 sscanf(Cmd, "%x %d", &Data, &Word);
551
552 if (Word > 15) {
553 PrintAndLog("Word must be between 0 and 15");
554 return 1;
555 }
556
557 PrintAndLog("Writing word %d with data %08X", Word, Data);
558
559 c.cmd = CMD_EM4X_WRITE_WORD;
560 c.d.asBytes[0] = 0x0; //Normal mode
561 c.arg[0] = Data;
562 c.arg[1] = Word;
563 c.arg[2] = 0;
564 SendCommand(&c);
565 return 0;
566 }
567
568 int CmdWriteWordPWD(const char *Cmd)
569 {
570 int Word = 16; //default to invalid word
571 int Data = 0xFFFFFFFF; //default to blank data
572 int Password = 0xFFFFFFFF; //default to blank password
573 UsbCommand c;
574
575 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
576
577 if (Word > 15) {
578 PrintAndLog("Word must be between 0 and 15");
579 return 1;
580 }
581
582 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
583
584 c.cmd = CMD_EM4X_WRITE_WORD;
585 c.d.asBytes[0] = 0x1; //Password mode
586 c.arg[0] = Data;
587 c.arg[1] = Word;
588 c.arg[2] = Password;
589 SendCommand(&c);
590 return 0;
591 }
592
593 static command_t CommandTable[] =
594 {
595 {"help", CmdHelp, 1, "This help"},
596 {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
597 {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
598 {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
599 {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
600 {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
601 {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
602 {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
603 {"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
604 {"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
605 {"writeword", CmdWriteWord, 1, "<Data> <Word> -- Write EM4xxx word data"},
606 {"writewordPWD", CmdWriteWordPWD, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
607 {NULL, NULL, 0, NULL}
608 };
609
610 int CmdLFEM4X(const char *Cmd)
611 {
612 CmdsParse(CommandTable, Cmd);
613 return 0;
614 }
615
616 int CmdHelp(const char *Cmd)
617 {
618 CmdsHelp(CommandTable);
619 return 0;
620 }
Impressum, Datenschutz