]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c
projects / proxmark3-svn / blob
? search:


513eb0ef668683334191f388243951ba5567cfc3
[proxmark3-svn] / client / cmdlft55xx.c
1 //-----------------------------------------------------------------------------
2 //
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
5 // the license.
6 //-----------------------------------------------------------------------------
7 // Low frequency T55xx commands
8 //-----------------------------------------------------------------------------
9
10 #include <stdio.h>
11 #include <string.h>
12 #include <inttypes.h>
13 #include "proxmark3.h"
14 #include "ui.h"
15 #include "graph.h"
16 #include "cmdmain.h"
17 #include "cmdparser.h"
18 #include "cmddata.h"
19 #include "cmdlf.h"
20 #include "cmdlft55xx.h"
21 #include "util.h"
22 #include "data.h"
23
24
25 #define LF_TRACE_BUFF_SIZE 12000 // 32 x 32 x 10 (32 bit times numofblock (7), times clock skip..)
26 #define LF_BITSSTREAM_LEN 1000 // more then 1000 bits shouldn't happend.. 8block * 4 bytes * 8bits =
27 static int CmdHelp(const char *Cmd);
28
29
30 int CmdReadBlk(const char *Cmd)
31 {
32 int block = -1;
33 sscanf(Cmd, "%d", &block);
34
35 if ((block > 7) | (block < 0)) {
36 PrintAndLog("Block must be between 0 and 7");
37 return 1;
38 }
39
40 UsbCommand c;
41 c.cmd = CMD_T55XX_READ_BLOCK;
42 c.d.asBytes[0] = 0x00;
43 c.arg[0] = 0;
44 c.arg[1] = block;
45 c.arg[2] = 0;
46 SendCommand(&c);
47 WaitForResponse(CMD_ACK, NULL);
48
49 // uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
50
51 // GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
52 // WaitForResponseTimeout(CMD_ACK,NULL, 1500);
53
54 // for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
55 // GraphBuffer[j] = (int)data[j];
56 // }
57 // GraphTraceLen = LF_TRACE_BUFF_SIZE;
58 CmdSamples("12000");
59 ManchesterDemod(block);
60 // RepaintGraphWindow();
61 return 0;
62 }
63
64 int CmdReadBlkPWD(const char *Cmd)
65 {
66 int Block = -1; //default to invalid block
67 int Password = 0xFFFFFFFF; //default to blank Block 7
68 UsbCommand c;
69
70 sscanf(Cmd, "%d %x", &Block, &Password);
71
72 if ((Block > 7) | (Block < 0)) {
73 PrintAndLog("Block must be between 0 and 7");
74 return 1;
75 }
76
77 PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
78
79 c.cmd = CMD_T55XX_READ_BLOCK;
80 c.d.asBytes[0] = 0x1; //Password mode
81 c.arg[0] = 0;
82 c.arg[1] = Block;
83 c.arg[2] = Password;
84 SendCommand(&c);
85 WaitForResponse(CMD_ACK, NULL);
86
87 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
88
89 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
90 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
91
92 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
93 GraphBuffer[j] = ((int)data[j]);
94 }
95 GraphTraceLen = LF_TRACE_BUFF_SIZE;
96 ManchesterDemod(Block);
97 RepaintGraphWindow();
98 return 0;
99 }
100
101 int CmdWriteBlk(const char *Cmd)
102 {
103 int Block = 8; //default to invalid block
104 int Data = 0xFFFFFFFF; //default to blank Block
105 UsbCommand c;
106
107 sscanf(Cmd, "%x %d", &Data, &Block);
108
109 if (Block > 7) {
110 PrintAndLog("Block must be between 0 and 7");
111 return 1;
112 }
113
114 PrintAndLog("Writting block %d with data %08X", Block, Data);
115
116 c.cmd = CMD_T55XX_WRITE_BLOCK;
117 c.d.asBytes[0] = 0x0; //Normal mode
118 c.arg[0] = Data;
119 c.arg[1] = Block;
120 c.arg[2] = 0;
121 SendCommand(&c);
122 return 0;
123 }
124
125 int CmdWriteBlkPWD(const char *Cmd)
126 {
127 int Block = 8; //default to invalid block
128 int Data = 0xFFFFFFFF; //default to blank Block
129 int Password = 0xFFFFFFFF; //default to blank Block 7
130 UsbCommand c;
131
132 sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
133
134 if (Block > 7) {
135 PrintAndLog("Block must be between 0 and 7");
136 return 1;
137 }
138
139 PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
140
141 c.cmd = CMD_T55XX_WRITE_BLOCK;
142 c.d.asBytes[0] = 0x1; //Password mode
143 c.arg[0] = Data;
144 c.arg[1] = Block;
145 c.arg[2] = Password;
146 SendCommand(&c);
147 return 0;
148 }
149
150 int CmdReadTrace(const char *Cmd)
151 {
152 char cmdp = param_getchar(Cmd, 0);
153
154 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
155 PrintAndLog("Usage: lf t55xx trace [use data from Graphbuffer]");
156 PrintAndLog(" [use data from Graphbuffer], if not set, try reading data from tag.");
157 PrintAndLog("");
158 PrintAndLog(" sample: lf t55xx trace");
159 PrintAndLog(" sample: lf t55xx trace 1");
160 return 0;
161 }
162
163 if ( strlen(Cmd)==0){
164 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
165 SendCommand(&c);
166 WaitForResponse(CMD_ACK, NULL);
167
168 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
169
170 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
171 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
172
173 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
174 GraphBuffer[j] = ((int)data[j]);
175 }
176 GraphTraceLen = LF_TRACE_BUFF_SIZE;
177 }
178
179 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
180 uint8_t * bitstream = bits;
181
182 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
183 RepaintGraphWindow();
184
185 uint8_t si = 5;
186 uint32_t bl0 = PackBits(si, 32, bitstream);
187 uint32_t bl1 = PackBits(si+32, 32, bitstream);
188
189 uint32_t acl = PackBits(si, 8, bitstream); si += 8;
190 uint32_t mfc = PackBits(si, 8, bitstream); si += 8;
191 uint32_t cid = PackBits(si, 5, bitstream); si += 5;
192 uint32_t icr = PackBits(si, 3, bitstream); si += 3;
193 uint32_t year = PackBits(si, 4, bitstream); si += 4;
194 uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
195 uint32_t lotid = PackBits(si, 12, bitstream); si += 12;
196 uint32_t wafer = PackBits(si, 5, bitstream); si += 5;
197 uint32_t dw = PackBits(si, 15, bitstream);
198
199 PrintAndLog("");
200 PrintAndLog("-- T55xx Trace Information ----------------------------------");
201 PrintAndLog("-------------------------------------------------------------");
202 PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", acl, acl);
203 PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d)", mfc, mfc);
204 PrintAndLog(" CID : 0x%02X (%d)", cid, cid);
205 PrintAndLog(" ICR IC Revision : %d",icr );
206 PrintAndLog(" Manufactured");
207 PrintAndLog(" Year/Quarter : %d/%d",2000+year, quarter );
208 PrintAndLog(" Lot ID : %d", lotid );
209 PrintAndLog(" Wafer number : %d", wafer);
210 PrintAndLog(" Die Number : %d", dw);
211 PrintAndLog("-------------------------------------------------------------");
212 PrintAndLog(" Raw Data - Page 1");
213 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bitstream+5,32) );
214 PrintAndLog(" Block 0 : 0x%08X %s", bl1, sprint_bin(bitstream+37,32) );
215 PrintAndLog("-------------------------------------------------------------");
216 /*
217 TRACE - BLOCK O
218 Bits Definition HEX
219 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0
220 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation
221 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2
222 22-24 ICR IC revision
223 25-28 YEAR (BCD encoded) 9 (= 2009)
224 29-30 QUARTER 1,2,3,4
225 31-32 LOT ID
226
227 TRACE - BLOCK 1
228 1-12 LOT ID
229 13-17 Wafer number
230 18-32 DW, die number sequential
231 */
232
233 return 0;
234 }
235
236 int CmdInfo(const char *Cmd){
237 /*
238 Page 0 Block 0 Configuration data.
239 Normal mode
240 Extended mode
241 */
242 char cmdp = param_getchar(Cmd, 0);
243
244 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
245 PrintAndLog("Usage: lf t55xx info [use data from Graphbuffer]");
246 PrintAndLog(" [use data from Graphbuffer], if not set, try reading data from tag.");
247 PrintAndLog("");
248 PrintAndLog(" sample: lf t55xx info");
249 PrintAndLog(" sample: lf t55xx info 1");
250 return 0;
251 }
252
253 if ( strlen(Cmd)==0){
254 CmdReadBlk("0");
255 }
256
257 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
258 uint8_t * bitstream = bits;
259
260 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
261
262 uint8_t si = 5;
263 uint32_t bl0 = PackBits(si, 32, bitstream);
264
265 uint32_t safer = PackBits(si, 4, bitstream); si += 4;
266 uint32_t resv = PackBits(si, 7, bitstream); si += 7;
267 uint32_t dbr = PackBits(si, 3, bitstream); si += 3;
268 uint32_t extend = PackBits(si, 1, bitstream); si += 1;
269 uint32_t datamodulation = PackBits(si, 5, bitstream); si += 5;
270 uint32_t pskcf = PackBits(si, 2, bitstream); si += 2;
271 uint32_t aor = PackBits(si, 1, bitstream); si += 1;
272 uint32_t otp = PackBits(si, 1, bitstream); si += 1;
273 uint32_t maxblk = PackBits(si, 3, bitstream); si += 3;
274 uint32_t pwd = PackBits(si, 1, bitstream); si += 1;
275 uint32_t sst = PackBits(si, 1, bitstream); si += 1;
276 uint32_t fw = PackBits(si, 1, bitstream); si += 1;
277 uint32_t inv = PackBits(si, 1, bitstream); si += 1;
278 uint32_t por = PackBits(si, 1, bitstream); si += 1;
279
280 PrintAndLog("");
281 PrintAndLog("-- T55xx Configuration --------------------------------------");
282 PrintAndLog("-------------------------------------------------------------");
283 PrintAndLog(" Safer key : %s", GetSaferStr(safer));
284 PrintAndLog(" reserved : %d", resv);
285 PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr));
286 PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");
287 PrintAndLog(" Modulation : %s", GetModulationStr(datamodulation) );
288 PrintAndLog(" PSK clock freq : %d", pskcf);
289 PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");
290 PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );
291 PrintAndLog(" Max block : %d", maxblk);
292 PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");
293 PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
294 PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");
295 PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");
296 PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");
297 PrintAndLog("-------------------------------------------------------------");
298 PrintAndLog(" Raw Data - Page 0");
299 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bitstream+5,32) );
300 PrintAndLog("-------------------------------------------------------------");
301
302 return 0;
303 }
304
305 int CmdDump(const char *Cmd){
306
307 char cmdp = param_getchar(Cmd, 0);
308 char s[20];
309 uint8_t pwd[4] = {0x00};
310 bool hasPwd = ( strlen(Cmd) > 0);
311
312 if ( cmdp == 'h' || cmdp == 'H') {
313 PrintAndLog("Usage: lf t55xx dump <password>");
314 PrintAndLog(" sample: lf t55xx dump FFFFFFFF");
315 return 0;
316 }
317
318 if ( hasPwd ){
319 if (param_gethex(Cmd, 0, pwd, 8)) {
320 PrintAndLog("password must include 8 HEX symbols");
321 return 0;
322 }
323 }
324
325 for ( int i = 0; i <8; ++i){
326 memset(s,0,sizeof(s));
327 if ( hasPwd ) {
328 sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
329 CmdReadBlkPWD(s);
330 } else {
331 sprintf(s,"%d", i);
332 CmdReadBlk(s);
333 }
334 }
335 return 0;
336 }
337
338 int CmdIceFsk(const char *Cmd){
339
340 if (!HasGraphData()) return 0;
341
342 iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
343 RepaintGraphWindow();
344 return 0;
345 }
346 int CmdIceManchester(const char *Cmd){
347 ManchesterDemod( -1);
348 return 0;
349 }
350 int ManchesterDemod(int blockNum){
351
352 if (!HasGraphData()) return 0;
353
354 uint8_t sizebyte = 32;
355 uint8_t offset = 5;
356 uint32_t blockData;
357 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
358 uint8_t * bitstream = bits;
359
360 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
361 blockData = PackBits(offset, sizebyte, bitstream);
362
363 if ( blockNum < 0)
364 PrintAndLog(" Decoded : 0x%08X %s", blockData, sprint_bin(bitstream+offset,sizebyte) );
365 else
366 PrintAndLog(" Block %d : 0x%08X %s", blockNum, blockData, sprint_bin(bitstream+offset,sizebyte) );
367
368 return 0;
369 }
370
371 char * GetBitRateStr(uint32_t id){
372 static char buf[40];
373 char *retStr = buf;
374 switch (id){
375 case 0:
376 sprintf(retStr,"%d - RF/8",id);
377 break;
378 case 1:
379 sprintf(retStr,"%d - RF/16",id);
380 break;
381 case 2:
382 sprintf(retStr,"%d - RF/32",id);
383 break;
384 case 3:
385 sprintf(retStr,"%d - RF/40",id);
386 break;
387 case 4:
388 sprintf(retStr,"%d - RF/50",id);
389 break;
390 case 5:
391 sprintf(retStr,"%d - RF/64",id);
392 break;
393 case 6:
394 sprintf(retStr,"%d - RF/100",id);
395 break;
396 case 7:
397 sprintf(retStr,"%d - RF/128",id);
398 break;
399 default:
400 sprintf(retStr,"%d - (Unknown)",id);
401 break;
402 }
403
404 return buf;
405 }
406
407 char * GetSaferStr(uint32_t id){
408 static char buf[40];
409 char *retStr = buf;
410
411 sprintf(retStr,"%d",id);
412 if (id == 6) {
413 sprintf(retStr,"%d - pasdwd",id);
414 }
415 if (id == 9 ){
416 sprintf(retStr,"%d - testmode ",id);
417 }
418
419 return buf;
420 }
421 char * GetModulationStr( uint32_t id){
422 static char buf[40];
423 char *retStr = buf;
424
425 switch (id){
426 case 0:
427 sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
428 break;
429 case 1:
430 sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
431 break;
432 case 2:
433 sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
434 break;
435 case 3:
436 sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
437 break;
438 case 4:
439 sprintf(retStr,"%d - FSK 1 RF/8 RF/5",id);
440 break;
441 case 5:
442 sprintf(retStr,"%d - FSK 2 RF/8 RF/10",id);
443 break;
444 case 6:
445 sprintf(retStr,"%d - FSK 1a RF/5 RF/8",id);
446 break;
447 case 7:
448 sprintf(retStr,"%d - FSK 2a RF/10 RF/8",id);
449 break;
450 case 8:
451 sprintf(retStr,"%d - Manschester",id);
452 break;
453 case 16:
454 sprintf(retStr,"%d - Biphase",id);
455 break;
456 case 17:
457 sprintf(retStr,"%d - Reserved",id);
458 break;
459 default:
460 sprintf(retStr,"0x%02X (Unknown)",id);
461 break;
462 }
463 return buf;
464 }
465
466
467 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
468
469 int i = start;
470 int j = len-1;
471 uint32_t tmp = 0;
472 for (; j >= 0; --j, ++i){
473 tmp |= bits[i] << j;
474 }
475 return tmp;
476 }
477
478 static command_t CommandTable[] =
479 {
480 {"help", CmdHelp, 1, "This help"},
481 {"rd", CmdReadBlk, 0, "<block> -- Read T55xx block data (page 0)"},
482 {"rdpwd", CmdReadBlkPWD, 0, "<block> <password> -- Read T55xx block data with password mode"},
483 {"wr", CmdWriteBlk, 0, "<data> <block> -- Write T55xx block data (page 0)"},
484 {"wrpwd", CmdWriteBlkPWD, 0, "<data> <block> <password> -- Write T55xx block data with password"},
485 {"trace", CmdReadTrace, 0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},
486 {"info", CmdInfo, 0, "[1] Read T55xx configuration data (page 0/ blk 0)"},
487 {"dump", CmdDump, 0, "[password] Dump T55xx card block 0-7. optional with password"},
488 {"fsk", CmdIceFsk, 0, "FSK demod"},
489 {"man", CmdIceManchester, 0, "Manchester demod (with SST)"},
490 {NULL, NULL, 0, NULL}
491 };
492
493 int CmdLFT55XX(const char *Cmd)
494 {
495 CmdsParse(CommandTable, Cmd);
496 return 0;
497 }
498
499 int CmdHelp(const char *Cmd)
500 {
501 CmdsHelp(CommandTable);
502 return 0;
503 }
Proxmark3 GIT tracking
Impressum, Datenschutz