]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfindala.c
Merge pull request #405 from ZenSecurity/master
[proxmark3-svn] / client / cmdlfindala.c
1 //-----------------------------------------------------------------------------
2 //
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
5 // the license.
6 //-----------------------------------------------------------------------------
7 // Low frequency Indala commands
8 // PSK1, rf/32, 64 or 224 bits (known)
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include "cmdlfindala.h"
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "graph.h"
17 #include "cmdparser.h"
18 #include "cmddata.h" //for g_debugMode, demodbuff cmds
19 #include "lfdemod.h" //for indala26decode
20 #include "util.h" //for sprint_bin_break
21 #include "cmdlf.h" //for CmdLFRead
22 #include "cmdmain.h" //for clearCommandBuffer
23
24 static int CmdHelp(const char *Cmd);
25
26 // Indala 26 bit decode
27 // by marshmellow
28 // optional arguments - same as PSKDemod (clock & invert & maxerr)
29 int CmdIndalaDecode(const char *Cmd) {
30 int ans;
31 if (strlen(Cmd)>0) {
32 ans = PSKDemod(Cmd, 0);
33 } else { //default to RF/32
34 ans = PSKDemod("32", 0);
35 }
36
37 if (!ans) {
38 if (g_debugMode) PrintAndLog("Error1: %i",ans);
39 return 0;
40 }
41 uint8_t invert=0;
42 size_t size = DemodBufferLen;
43 int startIdx = indala64decode(DemodBuffer, &size, &invert);
44 if (startIdx < 0 || size != 64) {
45 // try 224 indala
46 invert = 0;
47 size = DemodBufferLen;
48 startIdx = indala224decode(DemodBuffer, &size, &invert);
49 if (startIdx < 0 || size != 224) {
50 if (g_debugMode) PrintAndLog("Error2: %i",startIdx);
51 return -1;
52 }
53 }
54 setDemodBuf(DemodBuffer, size, (size_t)startIdx);
55 setClockGrid(g_DemodClock, g_DemodStartIdx + (startIdx*g_DemodClock));
56 if (invert)
57 if (g_debugMode)
58 PrintAndLog("Had to invert bits");
59
60 PrintAndLog("BitLen: %d",DemodBufferLen);
61 //convert UID to HEX
62 uint32_t uid1, uid2, uid3, uid4, uid5, uid6, uid7;
63 uid1=bytebits_to_byte(DemodBuffer,32);
64 uid2=bytebits_to_byte(DemodBuffer+32,32);
65 if (DemodBufferLen==64) {
66 PrintAndLog("Indala UID=%s (%x%08x)", sprint_bin_break(DemodBuffer,DemodBufferLen,16), uid1, uid2);
67 } else if (DemodBufferLen==224) {
68 uid3=bytebits_to_byte(DemodBuffer+64,32);
69 uid4=bytebits_to_byte(DemodBuffer+96,32);
70 uid5=bytebits_to_byte(DemodBuffer+128,32);
71 uid6=bytebits_to_byte(DemodBuffer+160,32);
72 uid7=bytebits_to_byte(DemodBuffer+192,32);
73 PrintAndLog("Indala UID=%s (%x%08x%08x%08x%08x%08x%08x)",
74 sprint_bin_break(DemodBuffer,DemodBufferLen,16), uid1, uid2, uid3, uid4, uid5, uid6, uid7);
75 }
76 if (g_debugMode) {
77 PrintAndLog("DEBUG: printing demodbuffer:");
78 printDemodBuff();
79 }
80 return 1;
81 }
82
83 int CmdIndalaRead(const char *Cmd) {
84 lf_read(true, 30000);
85 return CmdIndalaDecode("");
86 }
87
88 // older alternative indala demodulate (has some positives and negatives)
89 // returns false positives more often - but runs against more sets of samples
90 // poor psk signal can be difficult to demod this approach might succeed when the other fails
91 // but the other appears to currently be more accurate than this approach most of the time.
92 int CmdIndalaDemod(const char *Cmd) {
93 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
94
95 int state = -1;
96 int count = 0;
97 int i, j;
98
99 // worst case with GraphTraceLen=64000 is < 4096
100 // under normal conditions it's < 2048
101
102 uint8_t rawbits[4096];
103 int rawbit = 0;
104 int worst = 0, worstPos = 0;
105
106 //clear clock grid and demod plot
107 setClockGrid(0, 0);
108 DemodBufferLen = 0;
109
110 // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
111 // loop through raw signal - since we know it is psk1 rf/32 fc/2 skip every other value (+=2)
112 for (i = 0; i < GraphTraceLen-1; i += 2) {
113 count += 1;
114 if ((GraphBuffer[i] > GraphBuffer[i + 1]) && (state != 1)) {
115 // appears redundant - marshmellow
116 if (state == 0) {
117 for (j = 0; j < count - 8; j += 16) {
118 rawbits[rawbit++] = 0;
119 }
120 if ((abs(count - j)) > worst) {
121 worst = abs(count - j);
122 worstPos = i;
123 }
124 }
125 state = 1;
126 count = 0;
127 } else if ((GraphBuffer[i] < GraphBuffer[i + 1]) && (state != 0)) {
128 //appears redundant
129 if (state == 1) {
130 for (j = 0; j < count - 8; j += 16) {
131 rawbits[rawbit++] = 1;
132 }
133 if ((abs(count - j)) > worst) {
134 worst = abs(count - j);
135 worstPos = i;
136 }
137 }
138 state = 0;
139 count = 0;
140 }
141 }
142
143 if (rawbit>0){
144 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit, GraphTraceLen/32);
145 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst, worstPos);
146 } else {
147 return 0;
148 }
149
150 // Finding the start of a UID
151 int uidlen, long_wait;
152 if (strcmp(Cmd, "224") == 0) {
153 uidlen = 224;
154 long_wait = 30;
155 } else {
156 uidlen = 64;
157 long_wait = 29;
158 }
159
160 int start;
161 int first = 0;
162 for (start = 0; start <= rawbit - uidlen; start++) {
163 first = rawbits[start];
164 for (i = start; i < start + long_wait; i++) {
165 if (rawbits[i] != first) {
166 break;
167 }
168 }
169 if (i == (start + long_wait)) {
170 break;
171 }
172 }
173
174 if (start == rawbit - uidlen + 1) {
175 PrintAndLog("nothing to wait for");
176 return 0;
177 }
178
179 // Inverting signal if needed
180 if (first == 1) {
181 for (i = start; i < rawbit; i++) {
182 rawbits[i] = !rawbits[i];
183 }
184 }
185
186 // Dumping UID
187 uint8_t bits[224] = {0x00};
188 char showbits[225] = {0x00};
189 int bit;
190 i = start;
191 int times = 0;
192
193 if (uidlen > rawbit) {
194 PrintAndLog("Warning: not enough raw bits to get a full UID");
195 for (bit = 0; bit < rawbit; bit++) {
196 bits[bit] = rawbits[i++];
197 // As we cannot know the parity, let's use "." and "/"
198 showbits[bit] = '.' + bits[bit];
199 }
200 showbits[bit+1]='\0';
201 PrintAndLog("Partial UID=%s", showbits);
202 return 0;
203 } else {
204 for (bit = 0; bit < uidlen; bit++) {
205 bits[bit] = rawbits[i++];
206 showbits[bit] = '0' + bits[bit];
207 }
208 times = 1;
209 }
210
211 //convert UID to HEX
212 uint32_t uid1, uid2, uid3, uid4, uid5, uid6, uid7;
213 int idx;
214 uid1 = uid2 = 0;
215
216 if (uidlen==64){
217 for( idx=0; idx<64; idx++) {
218 if (showbits[idx] == '0') {
219 uid1=(uid1<<1)|(uid2>>31);
220 uid2=(uid2<<1)|0;
221 } else {
222 uid1=(uid1<<1)|(uid2>>31);
223 uid2=(uid2<<1)|1;
224 }
225 }
226 PrintAndLog("UID=%s (%x%08x)", showbits, uid1, uid2);
227 }
228 else {
229 uid3 = uid4 = uid5 = uid6 = uid7 = 0;
230
231 for( idx=0; idx<224; idx++) {
232 uid1=(uid1<<1)|(uid2>>31);
233 uid2=(uid2<<1)|(uid3>>31);
234 uid3=(uid3<<1)|(uid4>>31);
235 uid4=(uid4<<1)|(uid5>>31);
236 uid5=(uid5<<1)|(uid6>>31);
237 uid6=(uid6<<1)|(uid7>>31);
238
239 if (showbits[idx] == '0')
240 uid7 = (uid7<<1) | 0;
241 else
242 uid7 = (uid7<<1) | 1;
243 }
244 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits, uid1, uid2, uid3, uid4, uid5, uid6, uid7);
245 }
246
247 // Checking UID against next occurrences
248 int failed = 0;
249 for (; i + uidlen <= rawbit;) {
250 failed = 0;
251 for (bit = 0; bit < uidlen; bit++) {
252 if (bits[bit] != rawbits[i++]) {
253 failed = 1;
254 break;
255 }
256 }
257 if (failed == 1) {
258 break;
259 }
260 times += 1;
261 }
262
263 PrintAndLog("Occurrences: %d (expected %d)", times, (rawbit - start) / uidlen);
264
265 // Remodulating for tag cloning
266 // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
267 // since this changes graphbuffer data.
268 GraphTraceLen = 32*uidlen;
269 i = 0;
270 int phase = 0;
271 for (bit = 0; bit < uidlen; bit++) {
272 if (bits[bit] == 0) {
273 phase = 0;
274 } else {
275 phase = 1;
276 }
277 int j;
278 for (j = 0; j < 32; j++) {
279 GraphBuffer[i++] = phase;
280 phase = !phase;
281 }
282 }
283
284 RepaintGraphWindow();
285 return 1;
286 }
287
288 int CmdIndalaClone(const char *Cmd) {
289 UsbCommand c;
290 unsigned int uid1, uid2, uid3, uid4, uid5, uid6, uid7;
291
292 uid1 = uid2 = uid3 = uid4 = uid5 = uid6 = uid7 = 0;
293 int n = 0, i = 0;
294
295 if (strchr(Cmd,'l') != 0) {
296 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
297 uid1 = (uid1 << 4) | (uid2 >> 28);
298 uid2 = (uid2 << 4) | (uid3 >> 28);
299 uid3 = (uid3 << 4) | (uid4 >> 28);
300 uid4 = (uid4 << 4) | (uid5 >> 28);
301 uid5 = (uid5 << 4) | (uid6 >> 28);
302 uid6 = (uid6 << 4) | (uid7 >> 28);
303 uid7 = (uid7 << 4) | (n & 0xf);
304 }
305 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1, uid2, uid3, uid4, uid5, uid6, uid7);
306 c.cmd = CMD_INDALA_CLONE_TAG_L;
307 c.d.asDwords[0] = uid1;
308 c.d.asDwords[1] = uid2;
309 c.d.asDwords[2] = uid3;
310 c.d.asDwords[3] = uid4;
311 c.d.asDwords[4] = uid5;
312 c.d.asDwords[5] = uid6;
313 c.d.asDwords[6] = uid7;
314 } else {
315 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
316 uid1 = (uid1 << 4) | (uid2 >> 28);
317 uid2 = (uid2 << 4) | (n & 0xf);
318 }
319 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1, uid2);
320 c.cmd = CMD_INDALA_CLONE_TAG;
321 c.arg[0] = uid1;
322 c.arg[1] = uid2;
323 }
324
325 clearCommandBuffer();
326 SendCommand(&c);
327 return 0;
328 }
329
330 static command_t CommandTable[] = {
331 {"help", CmdHelp, 1, "This help"},
332 {"demod", CmdIndalaDecode, 1, "[clock] [invert<0|1>] -- Demodulate an indala tag (PSK1) from GraphBuffer (args optional)"},
333 {"read", CmdIndalaRead, 0, "Read an Indala Prox tag from the antenna"},
334 {"clone", CmdIndalaClone, 0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be on antenna)(UID in HEX)(option 'l' for 224 UID"},
335 {"altdemod", CmdIndalaDemod, 1, "['224'] -- Alternative method to Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
336 //{"sim", CmdIndalaSim, 0, "<ID> -- indala tag simulator"},
337 {NULL, NULL, 0, NULL}
338 };
339
340 int CmdLFINDALA(const char *Cmd) {
341 CmdsParse(CommandTable, Cmd);
342 return 0;
343 }
344
345 int CmdHelp(const char *Cmd) {
346 CmdsHelp(CommandTable);
347 return 0;
348 }
Impressum, Datenschutz