]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
5faf48012b6f5ad35567ef91915c8c161181fded
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <inttypes.h>
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "util.h"
17 #include "graph.h"
18 #include "cmdparser.h"
19 #include "cmddata.h"
20 #include "cmdlf.h"
21 #include "cmdlfem4x.h"
22 char *global_em410xId;
23
24 static int CmdHelp(const char *Cmd);
25
26 int CmdEMdemodASK(const char *Cmd)
27 {
28 char cmdp = param_getchar(Cmd, 0);
29 int findone = (cmdp == '1') ? 1 : 0;
30 UsbCommand c={CMD_EM410X_DEMOD};
31 c.arg[0]=findone;
32 SendCommand(&c);
33 return 0;
34 }
35
36 /* Read the ID of an EM410x tag.
37 * Format:
38 * 1111 1111 1 <-- standard non-repeatable header
39 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
40 * ....
41 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
42 * 0 <-- stop bit, end of tag
43 */
44 int CmdEM410xRead(const char *Cmd)
45 {
46 uint32_t hi=0;
47 uint64_t lo=0;
48
49 if(!AskEm410xDemod("", &hi, &lo)) return 0;
50 PrintAndLog("EM410x pattern found: ");
51 printEM410x(hi, lo);
52 if (hi){
53 PrintAndLog ("EM410x XL pattern found");
54 return 0;
55 }
56 char id[11] = {0x00};
57 sprintf(id, "%010x", lo);
58 global_em410xId = id;
59 return 1;
60 }
61
62 // emulate an EM410X tag
63 int CmdEM410xSim(const char *Cmd)
64 {
65 int i, n, j, binary[4], parity[4];
66
67 char cmdp = param_getchar(Cmd, 0);
68 uint8_t uid[5] = {0x00};
69
70 if (cmdp == 'h' || cmdp == 'H') {
71 PrintAndLog("Usage: lf em4x 410xsim <UID>");
72 PrintAndLog("");
73 PrintAndLog(" sample: lf em4x 410xsim 0F0368568B");
74 return 0;
75 }
76
77 if (param_gethex(Cmd, 0, uid, 10)) {
78 PrintAndLog("UID must include 10 HEX symbols");
79 return 0;
80 }
81
82 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
83 PrintAndLog("Press pm3-button to about simulation");
84
85 /* clock is 64 in EM410x tags */
86 int clock = 64;
87
88 /* clear our graph */
89 ClearGraph(0);
90
91 /* write 9 start bits */
92 for (i = 0; i < 9; i++)
93 AppendGraph(0, clock, 1);
94
95 /* for each hex char */
96 parity[0] = parity[1] = parity[2] = parity[3] = 0;
97 for (i = 0; i < 10; i++)
98 {
99 /* read each hex char */
100 sscanf(&Cmd[i], "%1x", &n);
101 for (j = 3; j >= 0; j--, n/= 2)
102 binary[j] = n % 2;
103
104 /* append each bit */
105 AppendGraph(0, clock, binary[0]);
106 AppendGraph(0, clock, binary[1]);
107 AppendGraph(0, clock, binary[2]);
108 AppendGraph(0, clock, binary[3]);
109
110 /* append parity bit */
111 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
112
113 /* keep track of column parity */
114 parity[0] ^= binary[0];
115 parity[1] ^= binary[1];
116 parity[2] ^= binary[2];
117 parity[3] ^= binary[3];
118 }
119
120 /* parity columns */
121 AppendGraph(0, clock, parity[0]);
122 AppendGraph(0, clock, parity[1]);
123 AppendGraph(0, clock, parity[2]);
124 AppendGraph(0, clock, parity[3]);
125
126 /* stop bit */
127 AppendGraph(1, clock, 0);
128
129 CmdLFSim("0"); //240 start_gap.
130 return 0;
131 }
132
133 /* Function is equivalent of lf read + data samples + em410xread
134 * looped until an EM410x tag is detected
135 *
136 * Why is CmdSamples("16000")?
137 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
138 * rate gets lower, then grow the number of samples
139 * Changed by martin, 4000 x 4 = 16000,
140 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
141
142 */
143 int CmdEM410xWatch(const char *Cmd)
144 {
145 do {
146 if (ukbhit()) {
147 printf("\naborted via keyboard!\n");
148 break;
149 }
150
151 CmdLFRead("");
152 CmdSamples("6000");
153 } while (!CmdEM410xRead(""));
154
155 return 0;
156 }
157
158 int CmdEM410xWatchnSpoof(const char *Cmd)
159 {
160 CmdEM410xWatch(Cmd);
161 PrintAndLog("# Replaying captured ID: %s",global_em410xId);
162 CmdLFaskSim("");
163 return 0;
164 }
165
166 /* Read the transmitted data of an EM4x50 tag
167 * Format:
168 *
169 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
170 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
171 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
172 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
173 * CCCCCCCC <- column parity bits
174 * 0 <- stop bit
175 * LW <- Listen Window
176 *
177 * This pattern repeats for every block of data being transmitted.
178 * Transmission starts with two Listen Windows (LW - a modulated
179 * pattern of 320 cycles each (32/32/128/64/64)).
180 *
181 * Note that this data may or may not be the UID. It is whatever data
182 * is stored in the blocks defined in the control word First and Last
183 * Word Read values. UID is stored in block 32.
184 */
185 int CmdEM4x50Read(const char *Cmd)
186 {
187 int i, j, startblock, skip, block, start, end, low, high;
188 bool complete= false;
189 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
190 char tmp[6];
191
192 high= low= 0;
193 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
194
195 /* first get high and low values */
196 for (i = 0; i < GraphTraceLen; i++)
197 {
198 if (GraphBuffer[i] > high)
199 high = GraphBuffer[i];
200 else if (GraphBuffer[i] < low)
201 low = GraphBuffer[i];
202 }
203
204 /* populate a buffer with pulse lengths */
205 i= 0;
206 j= 0;
207 while (i < GraphTraceLen)
208 {
209 // measure from low to low
210 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
211 ++i;
212 start= i;
213 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
214 ++i;
215 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
216 ++i;
217 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
218 break;
219 }
220 tmpbuff[j++]= i - start;
221 }
222
223 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
224 start= -1;
225 skip= 0;
226 for (i= 0; i < j - 4 ; ++i)
227 {
228 skip += tmpbuff[i];
229 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
230 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
231 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
232 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
233 {
234 start= i + 3;
235 break;
236 }
237 }
238 startblock= i + 3;
239
240 /* skip over the remainder of the LW */
241 skip += tmpbuff[i+1]+tmpbuff[i+2];
242 while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
243 ++skip;
244 skip += 8;
245
246 /* now do it again to find the end */
247 end= start;
248 for (i += 3; i < j - 4 ; ++i)
249 {
250 end += tmpbuff[i];
251 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
252 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
253 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
254 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
255 {
256 complete= true;
257 break;
258 }
259 }
260
261 if (start >= 0)
262 PrintAndLog("Found data at sample: %i",skip);
263 else
264 {
265 PrintAndLog("No data found!");
266 PrintAndLog("Try again with more samples.");
267 return 0;
268 }
269
270 if (!complete)
271 {
272 PrintAndLog("*** Warning!");
273 PrintAndLog("Partial data - no end found!");
274 PrintAndLog("Try again with more samples.");
275 }
276
277 /* get rid of leading crap */
278 sprintf(tmp,"%i",skip);
279 CmdLtrim(tmp);
280
281 /* now work through remaining buffer printing out data blocks */
282 block= 0;
283 i= startblock;
284 while (block < 6)
285 {
286 PrintAndLog("Block %i:", block);
287 // mandemod routine needs to be split so we can call it for data
288 // just print for now for debugging
289 CmdManchesterDemod("i 64");
290 skip= 0;
291 /* look for LW before start of next block */
292 for ( ; i < j - 4 ; ++i)
293 {
294 skip += tmpbuff[i];
295 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
296 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
297 break;
298 }
299 while (GraphBuffer[skip] > low)
300 ++skip;
301 skip += 8;
302 sprintf(tmp,"%i",skip);
303 CmdLtrim(tmp);
304 start += skip;
305 block++;
306 }
307 return 0;
308 }
309
310 int CmdEM410xWrite(const char *Cmd)
311 {
312 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
313 int card = 0xFF; // invalid card value
314 unsigned int clock = 0; // invalid clock value
315
316 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
317
318 // Check ID
319 if (id == 0xFFFFFFFFFFFFFFFF) {
320 PrintAndLog("Error! ID is required.\n");
321 return 0;
322 }
323 if (id >= 0x10000000000) {
324 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
325 return 0;
326 }
327
328 // Check Card
329 if (card == 0xFF) {
330 PrintAndLog("Error! Card type required.\n");
331 return 0;
332 }
333 if (card < 0) {
334 PrintAndLog("Error! Bad card type selected.\n");
335 return 0;
336 }
337
338 // Check Clock
339 if (card == 1)
340 {
341 // Default: 64
342 if (clock == 0)
343 clock = 64;
344
345 // Allowed clock rates: 16, 32 and 64
346 if ((clock != 16) && (clock != 32) && (clock != 64)) {
347 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
348 return 0;
349 }
350 }
351 else if (clock != 0)
352 {
353 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
354 return 0;
355 }
356
357 if (card == 1) {
358 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
359 // NOTE: We really should pass the clock in as a separate argument, but to
360 // provide for backwards-compatibility for older firmware, and to avoid
361 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
362 // the clock rate in bits 8-15 of the card value
363 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
364 }
365 else if (card == 0)
366 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
367 else {
368 PrintAndLog("Error! Bad card type selected.\n");
369 return 0;
370 }
371
372 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
373 SendCommand(&c);
374
375 return 0;
376 }
377
378 int CmdReadWord(const char *Cmd)
379 {
380 int Word = -1; //default to invalid word
381 UsbCommand c;
382
383 sscanf(Cmd, "%d", &Word);
384
385 if ( (Word > 15) | (Word < 0) ) {
386 PrintAndLog("Word must be between 0 and 15");
387 return 1;
388 }
389
390 PrintAndLog("Reading word %d", Word);
391
392 c.cmd = CMD_EM4X_READ_WORD;
393 c.d.asBytes[0] = 0x0; //Normal mode
394 c.arg[0] = 0;
395 c.arg[1] = Word;
396 c.arg[2] = 0;
397 SendCommand(&c);
398 return 0;
399 }
400
401 int CmdReadWordPWD(const char *Cmd)
402 {
403 int Word = -1; //default to invalid word
404 int Password = 0xFFFFFFFF; //default to blank password
405 UsbCommand c;
406
407 sscanf(Cmd, "%d %x", &Word, &Password);
408
409 if ( (Word > 15) | (Word < 0) ) {
410 PrintAndLog("Word must be between 0 and 15");
411 return 1;
412 }
413
414 PrintAndLog("Reading word %d with password %08X", Word, Password);
415
416 c.cmd = CMD_EM4X_READ_WORD;
417 c.d.asBytes[0] = 0x1; //Password mode
418 c.arg[0] = 0;
419 c.arg[1] = Word;
420 c.arg[2] = Password;
421 SendCommand(&c);
422 return 0;
423 }
424
425 int CmdWriteWord(const char *Cmd)
426 {
427 int Word = 16; //default to invalid block
428 int Data = 0xFFFFFFFF; //default to blank data
429 UsbCommand c;
430
431 sscanf(Cmd, "%x %d", &Data, &Word);
432
433 if (Word > 15) {
434 PrintAndLog("Word must be between 0 and 15");
435 return 1;
436 }
437
438 PrintAndLog("Writing word %d with data %08X", Word, Data);
439
440 c.cmd = CMD_EM4X_WRITE_WORD;
441 c.d.asBytes[0] = 0x0; //Normal mode
442 c.arg[0] = Data;
443 c.arg[1] = Word;
444 c.arg[2] = 0;
445 SendCommand(&c);
446 return 0;
447 }
448
449 int CmdWriteWordPWD(const char *Cmd)
450 {
451 int Word = 16; //default to invalid word
452 int Data = 0xFFFFFFFF; //default to blank data
453 int Password = 0xFFFFFFFF; //default to blank password
454 UsbCommand c;
455
456 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
457
458 if (Word > 15) {
459 PrintAndLog("Word must be between 0 and 15");
460 return 1;
461 }
462
463 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
464
465 c.cmd = CMD_EM4X_WRITE_WORD;
466 c.d.asBytes[0] = 0x1; //Password mode
467 c.arg[0] = Data;
468 c.arg[1] = Word;
469 c.arg[2] = Password;
470 SendCommand(&c);
471 return 0;
472 }
473
474 static command_t CommandTable[] =
475 {
476 {"help", CmdHelp, 1, "This help"},
477 {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
478 {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
479 {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
480 {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
481 {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
482 {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
483 {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
484 {"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
485 {"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
486 {"writeword", CmdWriteWord, 1, "<Data> <Word> -- Write EM4xxx word data"},
487 {"writewordPWD", CmdWriteWordPWD, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
488 {NULL, NULL, 0, NULL}
489 };
490
491 int CmdLFEM4X(const char *Cmd)
492 {
493 CmdsParse(CommandTable, Cmd);
494 return 0;
495 }
496
497 int CmdHelp(const char *Cmd)
498 {
499 CmdsHelp(CommandTable);
500 return 0;
501 }
Impressum, Datenschutz