]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge remote-tracking branch 'upstream/master' into pm3+reveng
[proxmark3-svn] / client / cmdlft55xx.c
1 //-----------------------------------------------------------------------------
2 //
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
5 // the license.
6 //-----------------------------------------------------------------------------
7 // Low frequency T55xx commands
8 //-----------------------------------------------------------------------------
9
10 #include <stdio.h>
11 #include <string.h>
12 #include <inttypes.h>
13 #include "proxmark3.h"
14 #include "ui.h"
15 #include "graph.h"
16 #include "cmdmain.h"
17 #include "cmdparser.h"
18 #include "cmddata.h"
19 #include "cmdlf.h"
20 #include "cmdlft55xx.h"
21 #include "util.h"
22 #include "data.h"
23 #include "lfdemod.h"
24 #include "cmdhf14a.h" //for getTagInfo
25
26 #define T55x7_CONFIGURATION_BLOCK 0x00
27 #define T55x7_PAGE0 0x00
28 #define T55x7_PAGE1 0x01
29 //#define T55x7_PWD 0x00000010
30 #define REGULAR_READ_MODE_BLOCK 0xFF
31
32 // Default configuration
33 t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = FALSE, .offset = 0x00, .block0 = 0x00, .Q5 = FALSE };
34
35 t55xx_conf_block_t Get_t55xx_Config(){
36 return config;
37 }
38 void Set_t55xx_Config(t55xx_conf_block_t conf){
39 config = conf;
40 }
41
42 int usage_t55xx_config(){
43 PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");
44 PrintAndLog("Options:");
45 PrintAndLog(" h This help");
46 PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");
47 PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");
48 PrintAndLog(" i [1] Invert data signal, defaults to normal");
49 PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");
50 PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");
51 PrintAndLog("");
52 PrintAndLog("Examples:");
53 PrintAndLog(" lf t55xx config d FSK - FSK demodulation");
54 PrintAndLog(" lf t55xx config d FSK i 1 - FSK demodulation, inverse data");
55 PrintAndLog(" lf t55xx config d FSK i 1 o 3 - FSK demodulation, inverse data, offset=3,start from position 3 to decode data");
56 PrintAndLog("");
57 return 0;
58 }
59 int usage_t55xx_read(){
60 PrintAndLog("Usage: lf t55xx read [b <block>] [p <password>] <override_safety> <page1>");
61 PrintAndLog("Options:");
62 PrintAndLog(" b <block> - block number to read. Between 0-7");
63 PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");
64 PrintAndLog(" o - OPTIONAL override safety check");
65 PrintAndLog(" 1 - OPTIONAL read Page 1 instead of Page 0");
66 PrintAndLog(" ****WARNING****");
67 PrintAndLog(" Use of read with password on a tag not configured for a pwd");
68 PrintAndLog(" can damage the tag");
69 PrintAndLog("");
70 PrintAndLog("Examples:");
71 PrintAndLog(" lf t55xx read b 0 - read data from block 0");
72 PrintAndLog(" lf t55xx read b 0 p feedbeef - read data from block 0 password feedbeef");
73 PrintAndLog(" lf t55xx read b 0 p feedbeef o - read data from block 0 password feedbeef safety check");
74 PrintAndLog("");
75 return 0;
76 }
77 int usage_t55xx_write(){
78 PrintAndLog("Usage: lf t55xx wr [b <block>] [d <data>] [p <password>] [1]");
79 PrintAndLog("Options:");
80 PrintAndLog(" b <block> - block number to write. Between 0-7");
81 PrintAndLog(" d <data> - 4 bytes of data to write (8 hex characters)");
82 PrintAndLog(" p <password> - OPTIONAL password 4bytes (8 hex characters)");
83 PrintAndLog(" 1 - OPTIONAL write Page 1 instead of Page 0");
84 PrintAndLog("");
85 PrintAndLog("Examples:");
86 PrintAndLog(" lf t55xx wr b 3 d 11223344 - write 11223344 to block 3");
87 PrintAndLog(" lf t55xx wr b 3 d 11223344 p feedbeef - write 11223344 to block 3 password feedbeef");
88 PrintAndLog("");
89 return 0;
90 }
91 int usage_t55xx_trace() {
92 PrintAndLog("Usage: lf t55xx trace [1]");
93 PrintAndLog("Options:");
94 PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");
95 PrintAndLog("");
96 PrintAndLog("Examples:");
97 PrintAndLog(" lf t55xx trace");
98 PrintAndLog(" lf t55xx trace 1");
99 PrintAndLog("");
100 return 0;
101 }
102 int usage_t55xx_info() {
103 PrintAndLog("Usage: lf t55xx info [1]");
104 PrintAndLog("Options:");
105 PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");
106 PrintAndLog("");
107 PrintAndLog("Examples:");
108 PrintAndLog(" lf t55xx info");
109 PrintAndLog(" lf t55xx info 1");
110 PrintAndLog("");
111 return 0;
112 }
113 int usage_t55xx_dump(){
114 PrintAndLog("Usage: lf t55xx dump <password> [o]");
115 PrintAndLog("Options:");
116 PrintAndLog(" <password> - OPTIONAL password 4bytes (8 hex symbols)");
117 PrintAndLog(" o - OPTIONAL override, force pwd read despite danger to card");
118 PrintAndLog("");
119 PrintAndLog("Examples:");
120 PrintAndLog(" lf t55xx dump");
121 PrintAndLog(" lf t55xx dump feedbeef o");
122 PrintAndLog("");
123 return 0;
124 }
125 int usage_t55xx_detect(){
126 PrintAndLog("Usage: lf t55xx detect [1] [p <password>]");
127 PrintAndLog("Options:");
128 PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");
129 PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");
130 PrintAndLog("");
131 PrintAndLog("Examples:");
132 PrintAndLog(" lf t55xx detect");
133 PrintAndLog(" lf t55xx detect 1");
134 PrintAndLog(" lf t55xx detect p 11223344");
135 PrintAndLog("");
136 return 0;
137 }
138 int usage_t55xx_wakup(){
139 PrintAndLog("Usage: lf t55xx wakeup [h] p <password>");
140 PrintAndLog("This commands send the Answer-On-Request command and leaves the readerfield ON afterwards.");
141 PrintAndLog("Options:");
142 PrintAndLog(" h - this help");
143 PrintAndLog(" p <password> - password 4bytes (8 hex symbols)");
144 PrintAndLog("");
145 PrintAndLog("Examples:");
146 PrintAndLog(" lf t55xx wakeup p 11223344 - send wakeup password");
147 return 0;
148 }
149 int usage_t55xx_bruteforce(){
150 PrintAndLog("This command uses A) bruteforce to scan a number range");
151 PrintAndLog(" B) a dictionary attack");
152 PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");
153 PrintAndLog(" password must be 4 bytes (8 hex symbols)");
154 PrintAndLog("Options:");
155 PrintAndLog(" h - this help");
156 PrintAndLog(" <start_pwd> - 4 byte hex value to start pwd search at");
157 PrintAndLog(" <end_pwd> - 4 byte hex value to end pwd search at");
158 PrintAndLog(" i <*.dic> - loads a default keys dictionary file <*.dic>");
159 PrintAndLog("");
160 PrintAndLog("Examples:");
161 PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");
162 PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");
163 PrintAndLog("");
164 return 0;
165 }
166 int usage_t55xx_wipe(){
167 PrintAndLog("Usage: lf t55xx wipe [h] [Q5]");
168 PrintAndLog("This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block");
169 PrintAndLog("Options:");
170 PrintAndLog(" h - this help");
171 PrintAndLog(" Q5 - indicates to use the T5555 (Q5) default configuration block");
172 PrintAndLog("");
173 PrintAndLog("Examples:");
174 PrintAndLog(" lf t55xx wipe - wipes a t55x7 tag, config block 0x000880E0");
175 PrintAndLog(" lf t55xx wipe Q5 - wipes a t5555 Q5 tag, config block 0x6001F004");
176 return 0;
177 }
178
179
180 static int CmdHelp(const char *Cmd);
181
182 void printT5xxHeader(uint8_t page){
183 PrintAndLog("Reading Page %d:", page);
184 PrintAndLog("blk | hex data | binary");
185 PrintAndLog("----+----------+---------------------------------");
186 }
187
188 int CmdT55xxSetConfig(const char *Cmd) {
189
190 uint8_t offset = 0;
191 char modulation[5] = {0x00};
192 char tmp = 0x00;
193 uint8_t bitRate = 0;
194 uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};
195 uint8_t cmdp = 0;
196 bool errors = FALSE;
197 while(param_getchar(Cmd, cmdp) != 0x00 && !errors)
198 {
199 tmp = param_getchar(Cmd, cmdp);
200 switch(tmp)
201 {
202 case 'h':
203 case 'H':
204 return usage_t55xx_config();
205 case 'b':
206 errors |= param_getdec(Cmd, cmdp+1, &bitRate);
207 if ( !errors){
208 uint8_t i = 0;
209 for (; i < 9; i++){
210 if (rates[i]==bitRate) {
211 config.bitrate = i;
212 break;
213 }
214 }
215 if (i==9) errors = TRUE;
216 }
217 cmdp+=2;
218 break;
219 case 'd':
220 param_getstr(Cmd, cmdp+1, modulation);
221 cmdp += 2;
222
223 if ( strcmp(modulation, "FSK" ) == 0) {
224 config.modulation = DEMOD_FSK;
225 } else if ( strcmp(modulation, "FSK1" ) == 0) {
226 config.modulation = DEMOD_FSK1;
227 config.inverted=1;
228 } else if ( strcmp(modulation, "FSK1a" ) == 0) {
229 config.modulation = DEMOD_FSK1a;
230 config.inverted=0;
231 } else if ( strcmp(modulation, "FSK2" ) == 0) {
232 config.modulation = DEMOD_FSK2;
233 config.inverted=0;
234 } else if ( strcmp(modulation, "FSK2a" ) == 0) {
235 config.modulation = DEMOD_FSK2a;
236 config.inverted=1;
237 } else if ( strcmp(modulation, "ASK" ) == 0) {
238 config.modulation = DEMOD_ASK;
239 } else if ( strcmp(modulation, "NRZ" ) == 0) {
240 config.modulation = DEMOD_NRZ;
241 } else if ( strcmp(modulation, "PSK1" ) == 0) {
242 config.modulation = DEMOD_PSK1;
243 } else if ( strcmp(modulation, "PSK2" ) == 0) {
244 config.modulation = DEMOD_PSK2;
245 } else if ( strcmp(modulation, "PSK3" ) == 0) {
246 config.modulation = DEMOD_PSK3;
247 } else if ( strcmp(modulation, "BIa" ) == 0) {
248 config.modulation = DEMOD_BIa;
249 config.inverted=1;
250 } else if ( strcmp(modulation, "BI" ) == 0) {
251 config.modulation = DEMOD_BI;
252 config.inverted=0;
253 } else {
254 PrintAndLog("Unknown modulation '%s'", modulation);
255 errors = TRUE;
256 }
257 break;
258 case 'i':
259 config.inverted = param_getchar(Cmd,cmdp+1) == '1';
260 cmdp+=2;
261 break;
262 case 'o':
263 errors |= param_getdec(Cmd, cmdp+1, &offset);
264 if ( !errors )
265 config.offset = offset;
266 cmdp+=2;
267 break;
268 case 'Q':
269 case 'q':
270 config.Q5 = TRUE;
271 cmdp++;
272 break;
273 default:
274 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
275 errors = TRUE;
276 break;
277 }
278 }
279
280 // No args
281 if (cmdp == 0) return printConfiguration( config );
282
283 //Validations
284 if (errors) return usage_t55xx_config();
285
286 config.block0 = 0;
287 return printConfiguration ( config );
288 }
289
290 int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32_t password){
291 //Password mode
292 if ( usepwd ) {
293 // try reading the config block and verify that PWD bit is set before doing this!
294 if ( !override ) {
295 if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0 ) ) return 0;
296 if ( !tryDetectModulation() ) {
297 PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");
298 return 0;
299 } else {
300 PrintAndLog("Safety Check: PWD bit is NOT set in config block. Reading without password...");
301 usepwd = false;
302 page1 = false;
303 }
304 } else {
305 PrintAndLog("Safety Check Overriden - proceeding despite risk");
306 }
307 }
308
309 if (!AquireData(page1, block, usepwd, password) ) return 0;
310 if (!DecodeT55xxBlock()) return 0;
311
312 char blk[10]={0};
313 sprintf(blk,"%d", block);
314 printT55xxBlock(blk);
315 return 1;
316 }
317
318 int CmdT55xxReadBlock(const char *Cmd) {
319 uint8_t block = REGULAR_READ_MODE_BLOCK;
320 uint32_t password = 0; //default to blank Block 7
321 bool usepwd = false;
322 bool override = false;
323 bool page1 = false;
324 bool errors = false;
325 uint8_t cmdp = 0;
326 while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
327 switch(param_getchar(Cmd, cmdp)) {
328 case 'h':
329 case 'H':
330 return usage_t55xx_read();
331 case 'b':
332 case 'B':
333 errors |= param_getdec(Cmd, cmdp+1, &block);
334 cmdp += 2;
335 break;
336 case 'o':
337 case 'O':
338 override = true;
339 cmdp++;
340 break;
341 case 'p':
342 case 'P':
343 password = param_get32ex(Cmd, cmdp+1, 0, 16);
344 usepwd = true;
345 cmdp += 2;
346 break;
347 case '1':
348 page1 = true;
349 cmdp++;
350 break;
351 default:
352 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
353 errors = true;
354 break;
355 }
356 }
357 if (errors) return usage_t55xx_read();
358
359 if (block > 7 && block != REGULAR_READ_MODE_BLOCK ) {
360 PrintAndLog("Block must be between 0 and 7");
361 return 0;
362 }
363
364 printT5xxHeader(page1);
365 return T55xxReadBlock(block, page1, usepwd, override, password);
366 }
367
368 bool DecodeT55xxBlock(){
369
370 char buf[30] = {0x00};
371 char *cmdStr = buf;
372 int ans = 0;
373 uint8_t bitRate[8] = {8,16,32,40,50,64,100,128};
374 DemodBufferLen = 0x00;
375
376 switch( config.modulation ){
377 case DEMOD_FSK:
378 snprintf(cmdStr, sizeof(buf),"%d %d", bitRate[config.bitrate], config.inverted );
379 ans = FSKrawDemod(cmdStr, FALSE);
380 break;
381 case DEMOD_FSK1:
382 case DEMOD_FSK1a:
383 snprintf(cmdStr, sizeof(buf),"%d %d 8 5", bitRate[config.bitrate], config.inverted );
384 ans = FSKrawDemod(cmdStr, FALSE);
385 break;
386 case DEMOD_FSK2:
387 case DEMOD_FSK2a:
388 snprintf(cmdStr, sizeof(buf),"%d %d 10 8", bitRate[config.bitrate], config.inverted );
389 ans = FSKrawDemod(cmdStr, FALSE);
390 break;
391 case DEMOD_ASK:
392 snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );
393 ans = ASKDemod(cmdStr, FALSE, FALSE, 1);
394 break;
395 case DEMOD_PSK1:
396 // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
397 save_restoreGB(1);
398 CmdLtrim("160");
399 snprintf(cmdStr, sizeof(buf),"%d %d 6", bitRate[config.bitrate], config.inverted );
400 ans = PSKDemod(cmdStr, FALSE);
401 //undo trim samples
402 save_restoreGB(0);
403 break;
404 case DEMOD_PSK2: //inverted won't affect this
405 case DEMOD_PSK3: //not fully implemented
406 // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
407 save_restoreGB(1);
408 CmdLtrim("160");
409 snprintf(cmdStr, sizeof(buf),"%d 0 6", bitRate[config.bitrate] );
410 ans = PSKDemod(cmdStr, FALSE);
411 psk1TOpsk2(DemodBuffer, DemodBufferLen);
412 //undo trim samples
413 save_restoreGB(0);
414 break;
415 case DEMOD_NRZ:
416 snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );
417 ans = NRZrawDemod(cmdStr, FALSE);
418 break;
419 case DEMOD_BI:
420 case DEMOD_BIa:
421 snprintf(cmdStr, sizeof(buf),"0 %d %d 1", bitRate[config.bitrate], config.inverted );
422 ans = ASKbiphaseDemod(cmdStr, FALSE);
423 break;
424 default:
425 return FALSE;
426 }
427 return (bool) ans;
428 }
429
430 bool DecodeT5555TraceBlock() {
431 DemodBufferLen = 0x00;
432
433 // According to datasheet. Always: RF/64, not inverted, Manchester
434 return (bool) ASKDemod("64 0 1", FALSE, FALSE, 1);
435 }
436
437 int CmdT55xxDetect(const char *Cmd){
438 bool errors = FALSE;
439 bool useGB = FALSE;
440 bool usepwd = FALSE;
441 uint32_t password = 0;
442 uint8_t cmdp = 0;
443
444 while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
445 switch(param_getchar(Cmd, cmdp)) {
446 case 'h':
447 case 'H':
448 return usage_t55xx_detect();
449 case 'p':
450 case 'P':
451 password = param_get32ex(Cmd, cmdp+1, 0, 16);
452 usepwd = TRUE;
453 cmdp += 2;
454 break;
455 case '1':
456 // use Graphbuffer data
457 useGB = TRUE;
458 cmdp++;
459 break;
460 default:
461 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
462 errors = true;
463 break;
464 }
465 }
466 if (errors) return usage_t55xx_detect();
467
468 if ( !useGB) {
469 if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password) )
470 return 0;
471 }
472
473 if ( !tryDetectModulation() )
474 PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");
475
476 return 1;
477 }
478
479 // detect configuration?
480 bool tryDetectModulation(){
481 uint8_t hits = 0;
482 t55xx_conf_block_t tests[15];
483 int bitRate=0;
484 uint8_t fc1 = 0, fc2 = 0, clk=0;
485
486 if (GetFskClock("", FALSE, FALSE)){
487 fskClocks(&fc1, &fc2, &clk, FALSE);
488 if ( FSKrawDemod("0 0", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
489 tests[hits].modulation = DEMOD_FSK;
490 if (fc1==8 && fc2 == 5)
491 tests[hits].modulation = DEMOD_FSK1a;
492 else if (fc1==10 && fc2 == 8)
493 tests[hits].modulation = DEMOD_FSK2;
494 tests[hits].bitrate = bitRate;
495 tests[hits].inverted = FALSE;
496 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
497 ++hits;
498 }
499 if ( FSKrawDemod("0 1", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
500 tests[hits].modulation = DEMOD_FSK;
501 if (fc1 == 8 && fc2 == 5)
502 tests[hits].modulation = DEMOD_FSK1;
503 else if (fc1 == 10 && fc2 == 8)
504 tests[hits].modulation = DEMOD_FSK2a;
505 tests[hits].bitrate = bitRate;
506 tests[hits].inverted = TRUE;
507 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
508 ++hits;
509 }
510 } else {
511 clk = GetAskClock("", FALSE, FALSE);
512 if (clk>0) {
513 if ( ASKDemod("0 0 1", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
514 tests[hits].modulation = DEMOD_ASK;
515 tests[hits].bitrate = bitRate;
516 tests[hits].inverted = FALSE;
517 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
518 ++hits;
519 }
520 if ( ASKDemod("0 1 1", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
521 tests[hits].modulation = DEMOD_ASK;
522 tests[hits].bitrate = bitRate;
523 tests[hits].inverted = TRUE;
524 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
525 ++hits;
526 }
527 if ( ASKbiphaseDemod("0 0 0 2", FALSE) && test(DEMOD_BI, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {
528 tests[hits].modulation = DEMOD_BI;
529 tests[hits].bitrate = bitRate;
530 tests[hits].inverted = FALSE;
531 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
532 ++hits;
533 }
534 if ( ASKbiphaseDemod("0 0 1 2", FALSE) && test(DEMOD_BIa, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {
535 tests[hits].modulation = DEMOD_BIa;
536 tests[hits].bitrate = bitRate;
537 tests[hits].inverted = TRUE;
538 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
539 ++hits;
540 }
541 }
542 //undo trim from ask
543 //save_restoreGB(0);
544 clk = GetNrzClock("", FALSE, FALSE);
545 if (clk>0) {
546 if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
547 tests[hits].modulation = DEMOD_NRZ;
548 tests[hits].bitrate = bitRate;
549 tests[hits].inverted = FALSE;
550 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
551 ++hits;
552 }
553
554 if ( NRZrawDemod("0 1 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
555 tests[hits].modulation = DEMOD_NRZ;
556 tests[hits].bitrate = bitRate;
557 tests[hits].inverted = TRUE;
558 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
559 ++hits;
560 }
561 }
562
563 // allow undo
564 // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
565 save_restoreGB(1);
566 CmdLtrim("160");
567 clk = GetPskClock("", FALSE, FALSE);
568 if (clk>0) {
569 if ( PSKDemod("0 0 6", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
570 tests[hits].modulation = DEMOD_PSK1;
571 tests[hits].bitrate = bitRate;
572 tests[hits].inverted = FALSE;
573 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
574 ++hits;
575 }
576 if ( PSKDemod("0 1 6", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
577 tests[hits].modulation = DEMOD_PSK1;
578 tests[hits].bitrate = bitRate;
579 tests[hits].inverted = TRUE;
580 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
581 ++hits;
582 }
583 // PSK2 - needs a call to psk1TOpsk2.
584 if ( PSKDemod("0 0 6", FALSE)) {
585 psk1TOpsk2(DemodBuffer, DemodBufferLen);
586 if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){
587 tests[hits].modulation = DEMOD_PSK2;
588 tests[hits].bitrate = bitRate;
589 tests[hits].inverted = FALSE;
590 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
591 ++hits;
592 }
593 } // inverse waves does not affect this demod
594 // PSK3 - needs a call to psk1TOpsk2.
595 if ( PSKDemod("0 0 6", FALSE)) {
596 psk1TOpsk2(DemodBuffer, DemodBufferLen);
597 if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){
598 tests[hits].modulation = DEMOD_PSK3;
599 tests[hits].bitrate = bitRate;
600 tests[hits].inverted = FALSE;
601 tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
602 ++hits;
603 }
604 } // inverse waves does not affect this demod
605 }
606 //undo trim samples
607 save_restoreGB(0);
608 }
609 if ( hits == 1) {
610 config.modulation = tests[0].modulation;
611 config.bitrate = tests[0].bitrate;
612 config.inverted = tests[0].inverted;
613 config.offset = tests[0].offset;
614 config.block0 = tests[0].block0;
615 config.Q5 = tests[0].Q5;
616 printConfiguration( config );
617 return TRUE;
618 }
619
620 if ( hits > 1) {
621 PrintAndLog("Found [%d] possible matches for modulation.",hits);
622 for(int i=0; i<hits; ++i){
623 PrintAndLog("--[%d]---------------", i+1);
624 printConfiguration( tests[i] );
625 }
626 }
627 return FALSE;
628 }
629
630 bool testModulation(uint8_t mode, uint8_t modread){
631 switch( mode ){
632 case DEMOD_FSK:
633 if (modread >= DEMOD_FSK1 && modread <= DEMOD_FSK2a) return TRUE;
634 break;
635 case DEMOD_ASK:
636 if (modread == DEMOD_ASK) return TRUE;
637 break;
638 case DEMOD_PSK1:
639 if (modread == DEMOD_PSK1) return TRUE;
640 break;
641 case DEMOD_PSK2:
642 if (modread == DEMOD_PSK2) return TRUE;
643 break;
644 case DEMOD_PSK3:
645 if (modread == DEMOD_PSK3) return TRUE;
646 break;
647 case DEMOD_NRZ:
648 if (modread == DEMOD_NRZ) return TRUE;
649 break;
650 case DEMOD_BI:
651 if (modread == DEMOD_BI) return TRUE;
652 break;
653 case DEMOD_BIa:
654 if (modread == DEMOD_BIa) return TRUE;
655 break;
656 default:
657 return FALSE;
658 }
659 return FALSE;
660 }
661
662 bool testQ5Modulation(uint8_t mode, uint8_t modread){
663 switch( mode ){
664 case DEMOD_FSK:
665 if (modread >= 4 && modread <= 5) return TRUE;
666 break;
667 case DEMOD_ASK:
668 if (modread == 0) return TRUE;
669 break;
670 case DEMOD_PSK1:
671 if (modread == 1) return TRUE;
672 break;
673 case DEMOD_PSK2:
674 if (modread == 2) return TRUE;
675 break;
676 case DEMOD_PSK3:
677 if (modread == 3) return TRUE;
678 break;
679 case DEMOD_NRZ:
680 if (modread == 7) return TRUE;
681 break;
682 case DEMOD_BI:
683 if (modread == 6) return TRUE;
684 break;
685 default:
686 return FALSE;
687 }
688 return FALSE;
689 }
690
691 int convertQ5bitRate(uint8_t bitRateRead) {
692 uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};
693 for (int i=0; i<8; i++)
694 if (expected[i] == bitRateRead)
695 return i;
696
697 return -1;
698 }
699
700 bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){
701
702 if ( DemodBufferLen < 64 ) return FALSE;
703 uint8_t si = 0;
704 for (uint8_t idx = 28; idx < 64; idx++){
705 si = idx;
706 if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;
707
708 uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key
709 uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;
710 // 2nibble must be zeroed.
711 if (safer != 0x6 && safer != 0x9) continue;
712 if ( resv > 0x00) continue;
713 //uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;
714 //uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;
715 si += 1+1;
716 int bitRate = PackBits(si, 6, DemodBuffer)*2 + 2; si += 6; //bit rate
717 if (bitRate > 128 || bitRate < 8) continue;
718
719 //uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1;
720 //uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1;
721 //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr
722 //uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;
723 si += 1+1+2+1;
724 uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;
725 uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;
726 //uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;
727 if (maxBlk == 0) continue;
728 //test modulation
729 if (!testQ5Modulation(mode, modread)) continue;
730 if (bitRate != clk) continue;
731 *fndBitRate = convertQ5bitRate(bitRate);
732 if (*fndBitRate < 0) continue;
733 *offset = idx;
734
735 return TRUE;
736 }
737 return FALSE;
738 }
739
740 bool testBitRate(uint8_t readRate, uint8_t clk){
741 uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};
742 if (expected[readRate] == clk)
743 return true;
744
745 return false;
746 }
747
748 bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5){
749
750 if ( DemodBufferLen < 64 ) return FALSE;
751 uint8_t si = 0;
752 for (uint8_t idx = 28; idx < 64; idx++){
753 si = idx;
754 if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;
755
756 uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key
757 uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode
758 // 2nibble must be zeroed.
759 // moved test to here, since this gets most faults first.
760 if ( resv > 0x00) continue;
761
762 uint8_t xtRate = PackBits(si, 3, DemodBuffer); si += 3; //extended mode part of rate
763 int bitRate = PackBits(si, 3, DemodBuffer); si += 3; //bit rate
764 if (bitRate > 7) continue;
765 uint8_t extend = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode
766 uint8_t modread = PackBits(si, 5, DemodBuffer); si += 5+2+1;
767 //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //could check psk cr
768 uint8_t nml01 = PackBits(si, 1, DemodBuffer); si += 1+5; //bit 24, 30, 31 could be tested for 0 if not extended mode
769 uint8_t nml02 = PackBits(si, 2, DemodBuffer); si += 2;
770
771 //if extended mode
772 bool extMode =( (safer == 0x6 || safer == 0x9) && extend) ? TRUE : FALSE;
773
774 if (!extMode){
775 if (nml01 || nml02 || xtRate) continue;
776 }
777 //test modulation
778 if (!testModulation(mode, modread)) continue;
779 if (!testBitRate(bitRate, clk)) continue;
780 *fndBitRate = bitRate;
781 *offset = idx;
782 *Q5 = FALSE;
783 return TRUE;
784 }
785 if (testQ5(mode, offset, fndBitRate, clk)) {
786 *Q5 = TRUE;
787 return TRUE;
788 }
789 return FALSE;
790 }
791
792 void printT55xxBlock(const char *blockNum){
793
794 uint8_t i = config.offset;
795 uint8_t endpos = 32 + i;
796 uint32_t blockData = 0;
797 uint8_t bits[64] = {0x00};
798
799 if ( !DemodBufferLen) return;
800
801 if ( endpos > DemodBufferLen){
802 PrintAndLog("The configured offset %d is too big. Possible offset: %d)", i, DemodBufferLen-32);
803 return;
804 }
805
806 for (; i < endpos; ++i)
807 bits[i - config.offset]=DemodBuffer[i];
808
809 blockData = PackBits(0, 32, bits);
810
811 PrintAndLog(" %s | %08X | %s", blockNum, blockData, sprint_bin(bits,32));
812 }
813
814 int special(const char *Cmd) {
815 uint32_t blockData = 0;
816 uint8_t bits[32] = {0x00};
817
818 PrintAndLog("OFFSET | DATA | BINARY");
819 PrintAndLog("----------------------------------------------------");
820 int i,j = 0;
821 for (; j < 64; ++j){
822
823 for (i = 0; i < 32; ++i)
824 bits[i]=DemodBuffer[j+i];
825
826 blockData = PackBits(0, 32, bits);
827
828 PrintAndLog(" %02d | 0x%08X | %s",j , blockData, sprint_bin(bits,32));
829 }
830 return 0;
831 }
832
833 int printConfiguration( t55xx_conf_block_t b){
834 PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");
835 PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );
836 PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate) );
837 PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );
838 PrintAndLog("Offset : %d", b.offset);
839 PrintAndLog("Block0 : 0x%08X", b.block0);
840 PrintAndLog("");
841 return 0;
842 }
843
844 int CmdT55xxWakeUp(const char *Cmd) {
845 uint32_t password = 0;
846 uint8_t cmdp = 0;
847 bool errors = true;
848 while(param_getchar(Cmd, cmdp) != 0x00) {
849 switch(param_getchar(Cmd, cmdp)) {
850 case 'h':
851 case 'H':
852 return usage_t55xx_wakup();
853 case 'p':
854 case 'P':
855 password = param_get32ex(Cmd, cmdp+1, 0xFFFFFFFF, 16);
856 cmdp += 2;
857 errors = false;
858 break;
859 default:
860 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
861 errors = true;
862 break;
863 }
864 }
865 if (errors) return usage_t55xx_wakup();
866
867 UsbCommand c = {CMD_T55XX_WAKEUP, {password, 0, 0}};
868 clearCommandBuffer();
869 SendCommand(&c);
870 PrintAndLog("Wake up command sent. Try read now");
871 return 0;
872 }
873
874 int CmdT55xxWriteBlock(const char *Cmd) {
875 uint8_t block = 0xFF; //default to invalid block
876 uint32_t data = 0; //default to blank Block
877 uint32_t password = 0; //default to blank Block 7
878 bool usepwd = false;
879 bool page1 = false;
880 bool gotdata = false;
881 bool errors = false;
882 uint8_t cmdp = 0;
883 while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
884 switch(param_getchar(Cmd, cmdp)) {
885 case 'h':
886 case 'H':
887 return usage_t55xx_write();
888 case 'b':
889 case 'B':
890 errors |= param_getdec(Cmd, cmdp+1, &block);
891 cmdp += 2;
892 break;
893 case 'd':
894 case 'D':
895 data = param_get32ex(Cmd, cmdp+1, 0, 16);
896 gotdata = true;
897 cmdp += 2;
898 break;
899 case 'p':
900 case 'P':
901 password = param_get32ex(Cmd, cmdp+1, 0, 16);
902 usepwd = true;
903 cmdp += 2;
904 break;
905 case '1':
906 page1 = true;
907 cmdp++;
908 break;
909 default:
910 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
911 errors = true;
912 break;
913 }
914 }
915 if (errors || !gotdata) return usage_t55xx_write();
916
917 if (block > 7) {
918 PrintAndLog("Block number must be between 0 and 7");
919 return 0;
920 }
921
922 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};
923 UsbCommand resp;
924 c.d.asBytes[0] = (page1) ? 0x2 : 0;
925
926 char pwdStr[16] = {0};
927 snprintf(pwdStr, sizeof(pwdStr), "pwd: 0x%08X", password);
928
929 PrintAndLog("Writing page %d block: %02d data: 0x%08X %s", page1, block, data, (usepwd) ? pwdStr : "" );
930
931 //Password mode
932 if (usepwd) {
933 c.arg[2] = password;
934 c.d.asBytes[0] |= 0x1;
935 }
936 clearCommandBuffer();
937 SendCommand(&c);
938 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
939 PrintAndLog("Error occurred, device did not ACK write operation. (May be due to old firmware)");
940 return 0;
941 }
942 return 1;
943 }
944
945 int CmdT55xxReadTrace(const char *Cmd) {
946 char cmdp = param_getchar(Cmd, 0);
947 bool pwdmode = false;
948 uint32_t password = 0;
949 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H')
950 return usage_t55xx_trace();
951
952 if (strlen(Cmd)==0)
953 if ( !AquireData( T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password ) )
954 return 0;
955
956 if ( config.Q5 ) {
957 if (!DecodeT5555TraceBlock()) return 0;
958 } else {
959 if (!DecodeT55xxBlock()) return 0;
960 }
961
962 if ( !DemodBufferLen ) return 0;
963
964 RepaintGraphWindow();
965 uint8_t repeat = (config.offset > 5) ? 32 : 0;
966
967 uint8_t si = config.offset+repeat;
968 uint32_t bl1 = PackBits(si, 32, DemodBuffer);
969 uint32_t bl2 = PackBits(si+32, 32, DemodBuffer);
970
971 if (config.Q5) {
972 uint32_t hdr = PackBits(si, 9, DemodBuffer); si += 9;
973
974 if (hdr != 0x1FF) {
975 PrintAndLog("Invalid Q5 Trace data header (expected 0x1FF, found %X)", hdr);
976 return 0;
977 }
978
979 t5555_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .icr = 0, .lotidc = '?', .lotid = 0, .wafer = 0, .dw =0};
980
981 data.icr = PackBits(si, 2, DemodBuffer); si += 2;
982 data.lotidc = 'Z' - PackBits(si, 2, DemodBuffer); si += 3;
983
984 data.lotid = PackBits(si, 4, DemodBuffer); si += 5;
985 data.lotid <<= 4;
986 data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;
987 data.lotid <<= 4;
988 data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;
989 data.lotid <<= 4;
990 data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;
991 data.lotid <<= 1;
992 data.lotid |= PackBits(si, 1, DemodBuffer); si += 1;
993
994 data.wafer = PackBits(si, 3, DemodBuffer); si += 4;
995 data.wafer <<= 2;
996 data.wafer |= PackBits(si, 2, DemodBuffer); si += 2;
997
998 data.dw = PackBits(si, 2, DemodBuffer); si += 3;
999 data.dw <<= 4;
1000 data.dw |= PackBits(si, 4, DemodBuffer); si += 5;
1001 data.dw <<= 4;
1002 data.dw |= PackBits(si, 4, DemodBuffer); si += 5;
1003 data.dw <<= 4;
1004 data.dw |= PackBits(si, 4, DemodBuffer); si += 5;
1005
1006 printT5555Trace(data, repeat);
1007
1008 } else {
1009
1010 t55x7_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .acl = 0, .mfc = 0, .cid = 0, .year = 0, .quarter = 0, .icr = 0, .lotid = 0, .wafer = 0, .dw = 0};
1011
1012 data.acl = PackBits(si, 8, DemodBuffer); si += 8;
1013 if ( data.acl != 0xE0 ) {
1014 PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");
1015 return 0;
1016 }
1017
1018 data.mfc = PackBits(si, 8, DemodBuffer); si += 8;
1019 data.cid = PackBits(si, 5, DemodBuffer); si += 5;
1020 data.icr = PackBits(si, 3, DemodBuffer); si += 3;
1021 data.year = PackBits(si, 4, DemodBuffer); si += 4;
1022 data.quarter = PackBits(si, 2, DemodBuffer); si += 2;
1023 data.lotid = PackBits(si, 14, DemodBuffer); si += 14;
1024 data.wafer = PackBits(si, 5, DemodBuffer); si += 5;
1025 data.dw = PackBits(si, 15, DemodBuffer);
1026
1027 time_t t = time(NULL);
1028 struct tm tm = *localtime(&t);
1029 if ( data.year > tm.tm_year-110)
1030 data.year += 2000;
1031 else
1032 data.year += 2010;
1033
1034 printT55x7Trace(data, repeat);
1035 }
1036 return 0;
1037 }
1038
1039 void printT55x7Trace( t55x7_tracedata_t data, uint8_t repeat ){
1040 PrintAndLog("-- T55x7 Trace Information ----------------------------------");
1041 PrintAndLog("-------------------------------------------------------------");
1042 PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", data.acl, data.acl);
1043 PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d) - %s", data.mfc, data.mfc, getTagInfo(data.mfc));
1044 PrintAndLog(" CID : 0x%02X (%d) - %s", data.cid, data.cid, GetModelStrFromCID(data.cid));
1045 PrintAndLog(" ICR IC Revision : %d", data.icr );
1046 PrintAndLog(" Manufactured");
1047 PrintAndLog(" Year/Quarter : %d/%d", data.year, data.quarter);
1048 PrintAndLog(" Lot ID : %d", data.lotid );
1049 PrintAndLog(" Wafer number : %d", data.wafer);
1050 PrintAndLog(" Die Number : %d", data.dw);
1051 PrintAndLog("-------------------------------------------------------------");
1052 PrintAndLog(" Raw Data - Page 1");
1053 PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );
1054 PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );
1055 PrintAndLog("-------------------------------------------------------------");
1056
1057 /*
1058 TRACE - BLOCK O
1059 Bits Definition HEX
1060 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0
1061 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation
1062 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2
1063 22-24 ICR IC revision
1064 25-28 YEAR (BCD encoded) 9 (= 2009)
1065 29-30 QUARTER 1,2,3,4
1066 31-32 LOT ID
1067
1068 TRACE - BLOCK 1
1069 1-12 LOT ID
1070 13-17 Wafer number
1071 18-32 DW, die number sequential
1072 */
1073 }
1074
1075 void printT5555Trace( t5555_tracedata_t data, uint8_t repeat ){
1076 PrintAndLog("-- T5555 (Q5) Trace Information -----------------------------");
1077 PrintAndLog("-------------------------------------------------------------");
1078 PrintAndLog(" ICR IC Revision : %d", data.icr );
1079 PrintAndLog(" Lot : %c%d", data.lotidc, data.lotid);
1080 PrintAndLog(" Wafer number : %d", data.wafer);
1081 PrintAndLog(" Die Number : %d", data.dw);
1082 PrintAndLog("-------------------------------------------------------------");
1083 PrintAndLog(" Raw Data - Page 1");
1084 PrintAndLog(" Block 1 : 0x%08X %s", data.bl1, sprint_bin(DemodBuffer+config.offset+repeat,32) );
1085 PrintAndLog(" Block 2 : 0x%08X %s", data.bl2, sprint_bin(DemodBuffer+config.offset+repeat+32,32) );
1086
1087 /*
1088 ** Q5 **
1089 TRACE - BLOCK O and BLOCK1
1090 Bits Definition HEX
1091 1-9 Header 0x1FF
1092 10-11 IC Revision
1093 12-13 Lot ID char
1094 15-35 Lot ID (NB parity)
1095 36-41 Wafer number (NB parity)
1096 42-58 DW, die number sequential (NB parity)
1097 60-63 Parity bits
1098 64 Always zero
1099 */
1100 }
1101
1102 //need to add Q5 info...
1103 int CmdT55xxInfo(const char *Cmd){
1104 /*
1105 Page 0 Block 0 Configuration data.
1106 Normal mode
1107 Extended mode
1108 */
1109 bool pwdmode = false;
1110 uint32_t password = 0;
1111 char cmdp = param_getchar(Cmd, 0);
1112
1113 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H')
1114 return usage_t55xx_info();
1115
1116 if (strlen(Cmd)==0)
1117 if ( !AquireData( T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password ) )
1118 return 1;
1119
1120 if (!DecodeT55xxBlock()) return 1;
1121
1122 // too little space to start with
1123 if ( DemodBufferLen < 32) return 1;
1124
1125 uint8_t si = config.offset;
1126 uint32_t bl0 = PackBits(si, 32, DemodBuffer);
1127
1128 uint32_t safer = PackBits(si, 4, DemodBuffer); si += 4;
1129 uint32_t resv = PackBits(si, 7, DemodBuffer); si += 7;
1130 uint32_t dbr = PackBits(si, 3, DemodBuffer); si += 3;
1131 uint32_t extend = PackBits(si, 1, DemodBuffer); si += 1;
1132 uint32_t datamod = PackBits(si, 5, DemodBuffer); si += 5;
1133 uint32_t pskcf = PackBits(si, 2, DemodBuffer); si += 2;
1134 uint32_t aor = PackBits(si, 1, DemodBuffer); si += 1;
1135 uint32_t otp = PackBits(si, 1, DemodBuffer); si += 1;
1136 uint32_t maxblk = PackBits(si, 3, DemodBuffer); si += 3;
1137 uint32_t pwd = PackBits(si, 1, DemodBuffer); si += 1;
1138 uint32_t sst = PackBits(si, 1, DemodBuffer); si += 1;
1139 uint32_t fw = PackBits(si, 1, DemodBuffer); si += 1;
1140 uint32_t inv = PackBits(si, 1, DemodBuffer); si += 1;
1141 uint32_t por = PackBits(si, 1, DemodBuffer); si += 1;
1142
1143 if (config.Q5) PrintAndLog("*** Warning *** Config Info read off a Q5 will not display as expected");
1144 PrintAndLog("");
1145 PrintAndLog("-- T55x7 Configuration & Tag Information --------------------");
1146 PrintAndLog("-------------------------------------------------------------");
1147 PrintAndLog(" Safer key : %s", GetSaferStr(safer));
1148 PrintAndLog(" reserved : %d", resv);
1149 PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr));
1150 PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");
1151 PrintAndLog(" Modulation : %s", GetModulationStr(datamod));
1152 PrintAndLog(" PSK clock frequency : %d", pskcf);
1153 PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");
1154 PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );
1155 PrintAndLog(" Max block : %d", maxblk);
1156 PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");
1157 PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
1158 PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");
1159 PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");
1160 PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");
1161 PrintAndLog("-------------------------------------------------------------");
1162 PrintAndLog(" Raw Data - Page 0");
1163 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(DemodBuffer+config.offset,32) );
1164 PrintAndLog("-------------------------------------------------------------");
1165
1166 return 0;
1167 }
1168
1169 int CmdT55xxDump(const char *Cmd){
1170
1171 uint32_t password = 0;
1172 char cmdp = param_getchar(Cmd, 0);
1173 bool override = false;
1174 if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_dump();
1175
1176 bool usepwd = ( strlen(Cmd) > 0);
1177 if ( usepwd ){
1178 password = param_get32ex(Cmd, 0, 0, 16);
1179 if (param_getchar(Cmd, 1) =='o' )
1180 override = true;
1181 }
1182
1183 printT5xxHeader(0);
1184 for ( uint8_t i = 0; i <8; ++i)
1185 T55xxReadBlock(i, 0, usepwd, override, password);
1186
1187 printT5xxHeader(1);
1188 for ( uint8_t i = 0; i<4; i++)
1189 T55xxReadBlock(i, 1, usepwd, override, password);
1190
1191 return 1;
1192 }
1193
1194 int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password ){
1195 // arg0 bitmodes:
1196 // bit0 = pwdmode
1197 // bit1 = page to read from
1198 uint8_t arg0 = (page<<1) | pwdmode;
1199 UsbCommand c = {CMD_T55XX_READ_BLOCK, {arg0, block, password}};
1200
1201 clearCommandBuffer();
1202 SendCommand(&c);
1203 if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {
1204 PrintAndLog("command execution time out");
1205 return 0;
1206 }
1207
1208 uint8_t got[12000];
1209 GetFromBigBuf(got,sizeof(got),0);
1210 WaitForResponse(CMD_ACK,NULL);
1211 setGraphBuf(got, sizeof(got));
1212 return 1;
1213 }
1214
1215 char * GetBitRateStr(uint32_t id) {
1216 static char buf[25];
1217
1218 char *retStr = buf;
1219 switch (id) {
1220 case 0: snprintf(retStr,sizeof(buf),"%d - RF/8",id); break;
1221 case 1: snprintf(retStr,sizeof(buf),"%d - RF/16",id); break;
1222 case 2: snprintf(retStr,sizeof(buf),"%d - RF/32",id); break;
1223 case 3: snprintf(retStr,sizeof(buf),"%d - RF/40",id); break;
1224 case 4: snprintf(retStr,sizeof(buf),"%d - RF/50",id); break;
1225 case 5: snprintf(retStr,sizeof(buf),"%d - RF/64",id); break;
1226 case 6: snprintf(retStr,sizeof(buf),"%d - RF/100",id); break;
1227 case 7: snprintf(retStr,sizeof(buf),"%d - RF/128",id); break;
1228 default: snprintf(retStr,sizeof(buf),"%d - (Unknown)",id); break;
1229 }
1230 return buf;
1231 }
1232
1233 char * GetSaferStr(uint32_t id) {
1234 static char buf[40];
1235 char *retStr = buf;
1236
1237 snprintf(retStr,sizeof(buf),"%d",id);
1238 if (id == 6) {
1239 snprintf(retStr,sizeof(buf),"%d - passwd",id);
1240 }
1241 if (id == 9 ){
1242 snprintf(retStr,sizeof(buf),"%d - testmode",id);
1243 }
1244
1245 return buf;
1246 }
1247
1248 char * GetModulationStr( uint32_t id){
1249 static char buf[60];
1250 char *retStr = buf;
1251
1252 switch (id){
1253 case 0: snprintf(retStr,sizeof(buf),"%d - DIRECT (ASK/NRZ)",id); break;
1254 case 1: snprintf(retStr,sizeof(buf),"%d - PSK 1 phase change when input changes",id); break;
1255 case 2: snprintf(retStr,sizeof(buf),"%d - PSK 2 phase change on bitclk if input high",id); break;
1256 case 3: snprintf(retStr,sizeof(buf),"%d - PSK 3 phase change on rising edge of input",id); break;
1257 case 4: snprintf(retStr,sizeof(buf),"%d - FSK 1 RF/8 RF/5",id); break;
1258 case 5: snprintf(retStr,sizeof(buf),"%d - FSK 2 RF/8 RF/10",id); break;
1259 case 6: snprintf(retStr,sizeof(buf),"%d - FSK 1a RF/5 RF/8",id); break;
1260 case 7: snprintf(retStr,sizeof(buf),"%d - FSK 2a RF/10 RF/8",id); break;
1261 case 8: snprintf(retStr,sizeof(buf),"%d - Manchester",id); break;
1262 case 16: snprintf(retStr,sizeof(buf),"%d - Biphase",id); break;
1263 case 0x18: snprintf(retStr,sizeof(buf),"%d - Biphase a - AKA Conditional Dephase Encoding(CDP)",id); break;
1264 case 17: snprintf(retStr,sizeof(buf),"%d - Reserved",id); break;
1265 default: snprintf(retStr,sizeof(buf),"0x%02X (Unknown)",id); break;
1266 }
1267 return buf;
1268 }
1269
1270 char * GetModelStrFromCID(uint32_t cid){
1271
1272 static char buf[10];
1273 char *retStr = buf;
1274
1275 if (cid == 1) snprintf(retStr, sizeof(buf),"ATA5577M1");
1276 if (cid == 2) snprintf(retStr, sizeof(buf),"ATA5577M2");
1277 return buf;
1278 }
1279
1280 char * GetSelectedModulationStr( uint8_t id){
1281
1282 static char buf[20];
1283 char *retStr = buf;
1284
1285 switch (id) {
1286 case DEMOD_FSK: snprintf(retStr,sizeof(buf),"FSK"); break;
1287 case DEMOD_FSK1: snprintf(retStr,sizeof(buf),"FSK1"); break;
1288 case DEMOD_FSK1a: snprintf(retStr,sizeof(buf),"FSK1a"); break;
1289 case DEMOD_FSK2: snprintf(retStr,sizeof(buf),"FSK2"); break;
1290 case DEMOD_FSK2a: snprintf(retStr,sizeof(buf),"FSK2a"); break;
1291 case DEMOD_ASK: snprintf(retStr,sizeof(buf),"ASK"); break;
1292 case DEMOD_NRZ: snprintf(retStr,sizeof(buf),"DIRECT/NRZ"); break;
1293 case DEMOD_PSK1: snprintf(retStr,sizeof(buf),"PSK1"); break;
1294 case DEMOD_PSK2: snprintf(retStr,sizeof(buf),"PSK2"); break;
1295 case DEMOD_PSK3: snprintf(retStr,sizeof(buf),"PSK3"); break;
1296 case DEMOD_BI: snprintf(retStr,sizeof(buf),"BIPHASE"); break;
1297 case DEMOD_BIa: snprintf(retStr,sizeof(buf),"BIPHASEa - (CDP)"); break;
1298 default: snprintf(retStr,sizeof(buf),"(Unknown)"); break;
1299 }
1300 return buf;
1301 }
1302
1303 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
1304
1305 int i = start;
1306 int j = len-1;
1307
1308 if (len > 32) return 0;
1309
1310 uint32_t tmp = 0;
1311 for (; j >= 0; --j, ++i)
1312 tmp |= bits[i] << j;
1313
1314 return tmp;
1315 }
1316
1317 int CmdResetRead(const char *Cmd) {
1318 UsbCommand c = {CMD_T55XX_RESET_READ, {0,0,0}};
1319
1320 clearCommandBuffer();
1321 SendCommand(&c);
1322 if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {
1323 PrintAndLog("command execution time out");
1324 return 0;
1325 }
1326
1327 uint8_t got[BIGBUF_SIZE-1];
1328 GetFromBigBuf(got,sizeof(got),0);
1329 WaitForResponse(CMD_ACK,NULL);
1330 setGraphBuf(got, sizeof(got));
1331 return 1;
1332 }
1333
1334 int CmdT55xxWipe(const char *Cmd) {
1335 char writeData[20] = {0};
1336 char *ptrData = writeData;
1337
1338 char cmdp = param_getchar(Cmd, 0);
1339 if ( cmdp == 'h' || cmdp == 'H') return usage_t55xx_wipe();
1340
1341 bool Q5 = (cmdp == 'q' || cmdp == 'Q');
1342
1343 // Try with the default password to reset block 0
1344 // With a pwd should work even if pwd bit not set
1345 PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");
1346
1347 if ( Q5 ){
1348 snprintf(ptrData,sizeof(writeData),"b 0 d 6001F004 p 0");
1349 } else {
1350 snprintf(ptrData,sizeof(writeData),"b 0 d 00088040 p 0");
1351 }
1352
1353 if (!CmdT55xxWriteBlock(ptrData)) PrintAndLog("Error writing blk 0");
1354
1355 for (uint8_t blk = 1; blk<8; blk++) {
1356 snprintf(ptrData,sizeof(writeData),"b %d d 0", blk);
1357 if (!CmdT55xxWriteBlock(ptrData))
1358 PrintAndLog("Error writing blk %d", blk);
1359
1360 memset(writeData, 0x00, sizeof(writeData));
1361 }
1362 return 0;
1363 }
1364
1365 int CmdT55xxBruteForce(const char *Cmd) {
1366
1367 // load a default pwd file.
1368 char buf[9];
1369 char filename[FILE_PATH_SIZE]={0};
1370 int keycnt = 0;
1371 int ch;
1372 uint8_t stKeyBlock = 20;
1373 uint8_t *keyBlock = NULL, *p = NULL;
1374 uint32_t start_password = 0x00000000; //start password
1375 uint32_t end_password = 0xFFFFFFFF; //end password
1376 bool found = false;
1377
1378 char cmdp = param_getchar(Cmd, 0);
1379 if (cmdp == 'h' || cmdp == 'H') return usage_t55xx_bruteforce();
1380
1381 keyBlock = calloc(stKeyBlock, 6);
1382 if (keyBlock == NULL) return 1;
1383
1384 if (cmdp == 'i' || cmdp == 'I') {
1385
1386 int len = strlen(Cmd+2);
1387 if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
1388 memcpy(filename, Cmd+2, len);
1389
1390 FILE * f = fopen( filename , "r");
1391
1392 if ( !f ) {
1393 PrintAndLog("File: %s: not found or locked.", filename);
1394 free(keyBlock);
1395 return 1;
1396 }
1397
1398 while( fgets(buf, sizeof(buf), f) ) {
1399 if (strlen(buf) < 8 || buf[7] == '\n') continue;
1400
1401 while (fgetc(f) != '\n' && !feof(f)) ; //goto next line
1402
1403 //The line start with # is comment, skip
1404 if( buf[0]=='#' ) continue;
1405
1406 if (!isxdigit(buf[0])) {
1407 PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);
1408 continue;
1409 }
1410
1411 buf[8] = 0;
1412
1413 if ( stKeyBlock - keycnt < 2) {
1414 p = realloc(keyBlock, 6*(stKeyBlock+=10));
1415 if (!p) {
1416 PrintAndLog("Cannot allocate memory for defaultKeys");
1417 free(keyBlock);
1418 fclose(f);
1419 return 2;
1420 }
1421 keyBlock = p;
1422 }
1423 memset(keyBlock + 4 * keycnt, 0, 4);
1424 num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);
1425 PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));
1426 keycnt++;
1427 memset(buf, 0, sizeof(buf));
1428 }
1429 fclose(f);
1430
1431 if (keycnt == 0) {
1432 PrintAndLog("No keys found in file");
1433 free(keyBlock);
1434 return 1;
1435 }
1436 PrintAndLog("Loaded %d keys", keycnt);
1437
1438 // loop
1439 uint64_t testpwd = 0x00;
1440 for (uint16_t c = 0; c < keycnt; ++c ) {
1441
1442 if (ukbhit()) {
1443 ch = getchar();
1444 (void)ch;
1445 printf("\naborted via keyboard!\n");
1446 free(keyBlock);
1447 return 0;
1448 }
1449
1450 testpwd = bytes_to_num(keyBlock + 4*c, 4);
1451
1452 PrintAndLog("Testing %08X", testpwd);
1453
1454 if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, TRUE, testpwd)) {
1455 PrintAndLog("Aquireing data from device failed. Quitting");
1456 free(keyBlock);
1457 return 0;
1458 }
1459
1460 found = tryDetectModulation();
1461
1462 if ( found ) {
1463 PrintAndLog("Found valid password: [%08X]", testpwd);
1464 free(keyBlock);
1465 return 0;
1466 }
1467 }
1468 PrintAndLog("Password NOT found.");
1469 free(keyBlock);
1470 return 0;
1471 }
1472
1473 // Try to read Block 7, first :)
1474
1475 // incremental pwd range search
1476 start_password = param_get32ex(Cmd, 0, 0, 16);
1477 end_password = param_get32ex(Cmd, 1, 0, 16);
1478
1479 if ( start_password >= end_password ) {
1480 free(keyBlock);
1481 return usage_t55xx_bruteforce();
1482 }
1483 PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);
1484
1485 uint32_t i = start_password;
1486
1487 while ((!found) && (i <= end_password)) {
1488
1489 printf(".");
1490 fflush(stdout);
1491 if (ukbhit()) {
1492 ch = getchar();
1493 (void)ch;
1494 printf("\naborted via keyboard!\n");
1495 free(keyBlock);
1496 return 0;
1497 }
1498
1499 if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, TRUE, i)) {
1500 PrintAndLog("Aquireing data from device failed. Quitting");
1501 free(keyBlock);
1502 return 0;
1503 }
1504 found = tryDetectModulation();
1505
1506 if (found) break;
1507 i++;
1508 }
1509
1510 PrintAndLog("");
1511
1512 if (found)
1513 PrintAndLog("Found valid password: [%08x]", i);
1514 else
1515 PrintAndLog("Password NOT found. Last tried: [%08x]", --i);
1516
1517 free(keyBlock);
1518 return 0;
1519 }
1520
1521 static command_t CommandTable[] = {
1522 {"help", CmdHelp, 1, "This help"},
1523 {"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},
1524 {"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
1525 {"detect", CmdT55xxDetect, 1, "[1] Try detecting the tag modulation from reading the configuration block."},
1526 {"read", CmdT55xxReadBlock, 0, "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},
1527 {"resetread", CmdResetRead, 0, "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},
1528 {"write", CmdT55xxWriteBlock,0, "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},
1529 {"trace", CmdT55xxReadTrace, 1, "[1] Show T55x7 traceability data (page 1/ blk 0-1)"},
1530 {"info", CmdT55xxInfo, 1, "[1] Show T55x7 configuration data (page 0/ blk 0)"},
1531 {"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},
1532 {"special", special, 0, "Show block changes with 64 different offsets"},
1533 {"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},
1534 {"wipe", CmdT55xxWipe, 0, "[q] Wipe a T55xx tag and set defaults (will destroy any data on tag)"},
1535 {NULL, NULL, 0, NULL}
1536 };
1537
1538 int CmdLFT55XX(const char *Cmd) {
1539 CmdsParse(CommandTable, Cmd);
1540 return 0;
1541 }
1542
1543 int CmdHelp(const char *Cmd) {
1544 CmdsHelp(CommandTable);
1545 return 0;
1546 }
Proxmark3 GIT tracking
Impressum, Datenschutz