git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c

   1  //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Low frequency EM4x commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include <inttypes.h>
  14 #include "proxmark3.h"
  15 #include "ui.h"
  16 #include "graph.h"
  17 #include "cmdmain.h"
  18 #include "cmdparser.h"
  19 #include "cmddata.h"
  20 #include "cmdlf.h"
  21 #include "cmdlfem4x.h"
  22 #include "util.h"
  23 #include "data.h"
  24 #define LF_TRACE_BUFF_SIZE 12000
  25 #define LF_BITSSTREAM_LEN 1000
  26
  27 char *global_em410xId;
  28
  29 static int CmdHelp(const char *Cmd);
  30
  31 int CmdEMdemodASK(const char *Cmd)
  32 {
  33         char cmdp = param_getchar(Cmd, 0);
  34         int findone = (cmdp == '1') ? 1 : 0;
  35         UsbCommand c = { CMD_EM410X_DEMOD };
  36         c.arg[0] = findone;
  37         SendCommand(&c);
  38         return 0;
  39 }
  40
  41 /* Read the ID of an EM410x tag.
  42  * Format:
  43  *   1111 1111 1           <-- standard non-repeatable header
  44  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
  45  *   ....
  46  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
  47  *   0                     <-- stop bit, end of tag
  48  */
  49 int CmdEM410xRead(const char *Cmd)
  50 {
  51   int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
  52   int parity[4];
  53   char id[11] = {0x00};
  54   char id2[11] = {0x00};
  55   int retested = 0;
  56   uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
  57   high = low = 0;
  58
  59   // get clock
  60   clock = GetClock(Cmd, 0);
  61
  62   // Detect high and lows and clock
  63   DetectHighLowInGraph( &high, &low, TRUE);
  64
  65   PrintAndLog("NUMNUM");
  66
  67   // parity for our 4 columns
  68   parity[0] = parity[1] = parity[2] = parity[3] = 0;
  69   header = rows = 0;
  70
  71   // manchester demodulate
  72   bit = bit2idx = 0;
  73   for (i = 0; i < (int)(GraphTraceLen / clock); i++)
  74   {
  75     hithigh = 0;
  76     hitlow = 0;
  77     first = 1;
  78
  79     /* Find out if we hit both high and low peaks */
  80     for (j = 0; j < clock; j++)
  81     {
  82       if (GraphBuffer[(i * clock) + j] >= high)
  83         hithigh = 1;
  84       else if (GraphBuffer[(i * clock) + j] <= low)
  85         hitlow = 1;
  86
  87       /* it doesn't count if it's the first part of our read
  88        because it's really just trailing from the last sequence */
  89       if (first && (hithigh || hitlow))
  90         hithigh = hitlow = 0;
  91       else
  92         first = 0;
  93
  94       if (hithigh && hitlow)
  95         break;
  96     }
  97
  98     /* If we didn't hit both high and low peaks, we had a bit transition */
  99     if (!hithigh || !hitlow)
 100       bit ^= 1;
 101
 102     BitStream[bit2idx++] = bit;
 103   }
 104
 105 retest:
 106   /* We go till 5 before the graph ends because we'll get that far below */
 107   for (i = 0; i < bit2idx - 5; i++)
 108   {
 109     /* Step 2: We have our header but need our tag ID */
 110     if (header == 9 && rows < 10)
 111     {
 112       /* Confirm parity is correct */
 113       if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
 114       {
 115         /* Read another byte! */
 116         sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
 117         sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i]));
 118         rows++;
 119
 120         /* Keep parity info */
 121         parity[0] ^= BitStream[i];
 122         parity[1] ^= BitStream[i+1];
 123         parity[2] ^= BitStream[i+2];
 124         parity[3] ^= BitStream[i+3];
 125
 126         /* Move 4 bits ahead */
 127         i += 4;
 128       }
 129
 130       /* Damn, something wrong! reset */
 131       else
 132       {
 133         PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
 134
 135         /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
 136         i -= 9 + (5 * rows) -5;
 137
 138         rows = header = 0;
 139       }
 140     }
 141
 142     /* Step 3: Got our 40 bits! confirm column parity */
 143     else if (rows == 10)
 144     {
 145       /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
 146       if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
 147         BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
 148         BitStream[i+4] == 0)
 149       {
 150         /* Sweet! */
 151         PrintAndLog("EM410x Tag ID: %s", id);
 152         PrintAndLog("Unique Tag ID: %s", id2);
 153
 154                 global_em410xId = id;
 155
 156         /* Stop any loops */
 157         return 1;
 158       }
 159
 160       /* Crap! Incorrect parity or no stop bit, start all over */
 161       else
 162       {
 163         rows = header = 0;
 164
 165         /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
 166         i -= 59;
 167       }
 168     }
 169
 170     /* Step 1: get our header */
 171     else if (header < 9)
 172     {
 173       /* Need 9 consecutive 1's */
 174       if (BitStream[i] == 1)
 175         header++;
 176
 177       /* We don't have a header, not enough consecutive 1 bits */
 178       else
 179         header = 0;
 180     }
 181   }
 182
 183   /* if we've already retested after flipping bits, return */
 184         if (retested++){
 185                 PrintAndLog("Failed to decode");
 186                 return 0;
 187         }
 188
 189   /* if this didn't work, try flipping bits */
 190         for (i = 0; i < bit2idx; i++)
 191                 BitStream[i] ^= 1;
 192
 193   goto retest;
 194 }
 195
 196 /* emulate an EM410X tag
 197  * Format:
 198  *   1111 1111 1           <-- standard non-repeatable header
 199  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
 200  *   ....
 201  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
 202  *   0                     <-- stop bit, end of tag
 203  */
 204 int CmdEM410xSim(const char *Cmd)
 205 {
 206         int i, n, j, binary[4], parity[4];
 207
 208         char cmdp = param_getchar(Cmd, 0);
 209         uint8_t uid[5] = {0x00};
 210
 211         if (cmdp == 'h' || cmdp == 'H') {
 212                 PrintAndLog("Usage:  lf em4x 410xsim <UID>");
 213                 PrintAndLog("");
 214                 PrintAndLog("     sample: lf em4x 410xsim 0F0368568B");
 215                 return 0;
 216         }
 217
 218         if (param_gethex(Cmd, 0, uid, 10)) {
 219                 PrintAndLog("UID must include 10 HEX symbols");
 220                 return 0;
 221         }
 222
 223         PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
 224         PrintAndLog("Press pm3-button to about simulation");
 225
 226   /* clock is 64 in EM410x tags */
 227   int clock = 64;
 228
 229   /* clear our graph */
 230   ClearGraph(0);
 231
 232     /* write 9 start bits */
 233     for (i = 0; i < 9; i++)
 234       AppendGraph(0, clock, 1);
 235
 236     /* for each hex char */
 237     parity[0] = parity[1] = parity[2] = parity[3] = 0;
 238     for (i = 0; i < 10; i++)
 239     {
 240       /* read each hex char */
 241       sscanf(&Cmd[i], "%1x", &n);
 242       for (j = 3; j >= 0; j--, n/= 2)
 243         binary[j] = n % 2;
 244
 245       /* append each bit */
 246       AppendGraph(0, clock, binary[0]);
 247       AppendGraph(0, clock, binary[1]);
 248       AppendGraph(0, clock, binary[2]);
 249       AppendGraph(0, clock, binary[3]);
 250
 251       /* append parity bit */
 252       AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
 253
 254       /* keep track of column parity */
 255       parity[0] ^= binary[0];
 256       parity[1] ^= binary[1];
 257       parity[2] ^= binary[2];
 258       parity[3] ^= binary[3];
 259     }
 260
 261     /* parity columns */
 262     AppendGraph(0, clock, parity[0]);
 263     AppendGraph(0, clock, parity[1]);
 264     AppendGraph(0, clock, parity[2]);
 265     AppendGraph(0, clock, parity[3]);
 266
 267   /* stop bit */
 268   AppendGraph(1, clock, 0);
 269
 270   CmdLFSim("240"); //240 start_gap.
 271   return 0;
 272 }
 273
 274 /* Function is equivalent of lf read + data samples + em410xread
 275  * looped until an EM410x tag is detected
 276  *
 277  * Why is CmdSamples("16000")?
 278  *  TBD: Auto-grow sample size based on detected sample rate.  IE: If the
 279  *       rate gets lower, then grow the number of samples
 280  *  Changed by martin, 4000 x 4 = 16000,
 281  *  see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
 282
 283 */
 284 int CmdEM410xWatch(const char *Cmd)
 285 {
 286         char cmdp = param_getchar(Cmd, 0);
 287         int read_h = (cmdp == 'h');
 288         do
 289         {
 290                 if (ukbhit()) {
 291                         printf("\naborted via keyboard!\n");
 292                         break;
 293                 }
 294
 295                 CmdLFRead(read_h ? "h" : "");
 296                 CmdSamples("6000");
 297
 298         } while (
 299                 !CmdEM410xRead("")
 300         );
 301         return 0;
 302 }
 303
 304 int CmdEM410xWatchnSpoof(const char *Cmd)
 305 {
 306         CmdEM410xWatch(Cmd);
 307     PrintAndLog("# Replaying : %s",global_em410xId);
 308     CmdEM410xSim(global_em410xId);
 309   return 0;
 310 }
 311
 312 /* Read the transmitted data of an EM4x50 tag
 313  * Format:
 314  *
 315  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 316  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 317  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 318  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 319  *  CCCCCCCC                         <- column parity bits
 320  *  0                                <- stop bit
 321  *  LW                               <- Listen Window
 322  *
 323  * This pattern repeats for every block of data being transmitted.
 324  * Transmission starts with two Listen Windows (LW - a modulated
 325  * pattern of 320 cycles each (32/32/128/64/64)).
 326  *
 327  * Note that this data may or may not be the UID. It is whatever data
 328  * is stored in the blocks defined in the control word First and Last
 329  * Word Read values. UID is stored in block 32.
 330  */
 331 int CmdEM4x50Read(const char *Cmd)
 332 {
 333   int i, j, startblock, skip, block, start, end, low, high;
 334   bool complete= false;
 335   int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
 336   char tmp[6];
 337
 338   high= low= 0;
 339   memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
 340
 341   /* first get high and low values */
 342   for (i = 0; i < GraphTraceLen; i++)
 343   {
 344     if (GraphBuffer[i] > high)
 345       high = GraphBuffer[i];
 346     else if (GraphBuffer[i] < low)
 347       low = GraphBuffer[i];
 348   }
 349
 350   /* populate a buffer with pulse lengths */
 351   i= 0;
 352   j= 0;
 353   while (i < GraphTraceLen)
 354   {
 355     // measure from low to low
 356     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 357       ++i;
 358     start= i;
 359     while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
 360       ++i;
 361     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 362       ++i;
 363     if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
 364       break;
 365     }
 366     tmpbuff[j++]= i - start;
 367   }
 368
 369   /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
 370   start= -1;
 371   skip= 0;
 372   for (i= 0; i < j - 4 ; ++i)
 373   {
 374     skip += tmpbuff[i];
 375     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 376       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 377         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 378           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 379           {
 380             start= i + 3;
 381             break;
 382           }
 383   }
 384   startblock= i + 3;
 385
 386   /* skip over the remainder of the LW */
 387   skip += tmpbuff[i+1]+tmpbuff[i+2];
 388   while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
 389     ++skip;
 390   skip += 8;
 391
 392   /* now do it again to find the end */
 393   end= start;
 394   for (i += 3; i < j - 4 ; ++i)
 395   {
 396     end += tmpbuff[i];
 397     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 398       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 399         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 400           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 401           {
 402             complete= true;
 403             break;
 404           }
 405   }
 406
 407   if (start >= 0)
 408     PrintAndLog("Found data at sample: %i",skip);
 409   else
 410   {
 411     PrintAndLog("No data found!");
 412     PrintAndLog("Try again with more samples.");
 413     return 0;
 414   }
 415
 416   if (!complete)
 417   {
 418     PrintAndLog("*** Warning!");
 419     PrintAndLog("Partial data - no end found!");
 420     PrintAndLog("Try again with more samples.");
 421   }
 422
 423   /* get rid of leading crap */
 424   sprintf(tmp,"%i",skip);
 425   CmdLtrim(tmp);
 426
 427   /* now work through remaining buffer printing out data blocks */
 428   block= 0;
 429   i= startblock;
 430   while (block < 6)
 431   {
 432     PrintAndLog("Block %i:", block);
 433     // mandemod routine needs to be split so we can call it for data
 434     // just print for now for debugging
 435     CmdManchesterDemod("i 64");
 436     skip= 0;
 437     /* look for LW before start of next block */
 438     for ( ; i < j - 4 ; ++i)
 439     {
 440       skip += tmpbuff[i];
 441       if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 442         if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 443           break;
 444     }
 445     while (GraphBuffer[skip] > low)
 446       ++skip;
 447     skip += 8;
 448     sprintf(tmp,"%i",skip);
 449     CmdLtrim(tmp);
 450     start += skip;
 451     block++;
 452   }
 453   return 0;
 454 }
 455
 456 int CmdEM410xWrite(const char *Cmd)
 457 {
 458   uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
 459   int card = 0xFF; // invalid card value
 460         unsigned int clock = 0; // invalid clock value
 461
 462         sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
 463
 464         // Check ID
 465         if (id == 0xFFFFFFFFFFFFFFFF) {
 466                 PrintAndLog("Error! ID is required.\n");
 467                 return 0;
 468         }
 469         if (id >= 0x10000000000) {
 470                 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
 471                 return 0;
 472         }
 473
 474         // Check Card
 475         if (card == 0xFF) {
 476                 PrintAndLog("Error! Card type required.\n");
 477                 return 0;
 478         }
 479         if (card < 0) {
 480                 PrintAndLog("Error! Bad card type selected.\n");
 481                 return 0;
 482         }
 483
 484         // Check Clock
 485         if (card == 1)
 486         {
 487                 // Default: 64
 488                 if (clock == 0)
 489                         clock = 64;
 490
 491                 // Allowed clock rates: 16, 32 and 64
 492                 if ((clock != 16) && (clock != 32) && (clock != 64)) {
 493                         PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
 494                         return 0;
 495                 }
 496         }
 497         else if (clock != 0)
 498         {
 499                 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
 500                 return 0;
 501         }
 502
 503         if (card == 1) {
 504                 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
 505                 // NOTE: We really should pass the clock in as a separate argument, but to
 506                 //   provide for backwards-compatibility for older firmware, and to avoid
 507                 //   having to add another argument to CMD_EM410X_WRITE_TAG, we just store
 508                 //   the clock rate in bits 8-15 of the card value
 509                 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
 510         }
 511         else if (card == 0)
 512                 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
 513         else {
 514                 PrintAndLog("Error! Bad card type selected.\n");
 515                 return 0;
 516         }
 517
 518   UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
 519   SendCommand(&c);
 520
 521   return 0;
 522 }
 523
 524 int CmdReadWord(const char *Cmd)
 525 {
 526         int Word = -1; //default to invalid word
 527         UsbCommand c;
 528
 529         sscanf(Cmd, "%d", &Word);
 530
 531         if ( (Word > 15) | (Word < 0) ) {
 532                 PrintAndLog("Word must be between 0 and 15");
 533                 return 1;
 534         }
 535
 536         PrintAndLog("Reading word %d", Word);
 537
 538         c.cmd = CMD_EM4X_READ_WORD;
 539         c.d.asBytes[0] = 0x0; //Normal mode
 540         c.arg[0] = 0;
 541         c.arg[1] = Word;
 542         c.arg[2] = 0;
 543         SendCommand(&c);
 544         WaitForResponse(CMD_ACK, NULL);
 545
 546         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 547
 548         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
 549         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 550
 551         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 552                 GraphBuffer[j] = ((int)data[j]);
 553         }
 554         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 555
 556         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 557         uint8_t * bitstream = bits;
 558         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream,LF_BITSSTREAM_LEN);
 559         RepaintGraphWindow();
 560   return 0;
 561 }
 562
 563 int CmdReadWordPWD(const char *Cmd)
 564 {
 565         int Word = -1; //default to invalid word
 566         int Password = 0xFFFFFFFF; //default to blank password
 567         UsbCommand c;
 568
 569         sscanf(Cmd, "%d %x", &Word, &Password);
 570
 571         if ( (Word > 15) | (Word < 0) ) {
 572                 PrintAndLog("Word must be between 0 and 15");
 573                 return 1;
 574         }
 575
 576         PrintAndLog("Reading word %d with password %08X", Word, Password);
 577
 578         c.cmd = CMD_EM4X_READ_WORD;
 579         c.d.asBytes[0] = 0x1; //Password mode
 580         c.arg[0] = 0;
 581         c.arg[1] = Word;
 582         c.arg[2] = Password;
 583         SendCommand(&c);
 584         WaitForResponse(CMD_ACK, NULL);
 585
 586         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 587
 588         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
 589         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 590
 591         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 592                 GraphBuffer[j] = ((int)data[j]);
 593         }
 594         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 595
 596         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 597         uint8_t * bitstream = bits;
 598         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
 599         RepaintGraphWindow();
 600   return 0;
 601 }
 602
 603 int CmdWriteWord(const char *Cmd)
 604 {
 605   int Word = 16; //default to invalid block
 606   int Data = 0xFFFFFFFF; //default to blank data
 607   UsbCommand c;
 608
 609   sscanf(Cmd, "%x %d", &Data, &Word);
 610
 611   if (Word > 15) {
 612     PrintAndLog("Word must be between 0 and 15");
 613     return 1;
 614   }
 615
 616   PrintAndLog("Writing word %d with data %08X", Word, Data);
 617
 618   c.cmd = CMD_EM4X_WRITE_WORD;
 619   c.d.asBytes[0] = 0x0; //Normal mode
 620   c.arg[0] = Data;
 621   c.arg[1] = Word;
 622   c.arg[2] = 0;
 623   SendCommand(&c);
 624   return 0;
 625 }
 626
 627 int CmdWriteWordPWD(const char *Cmd)
 628 {
 629   int Word = 16; //default to invalid word
 630   int Data = 0xFFFFFFFF; //default to blank data
 631   int Password = 0xFFFFFFFF; //default to blank password
 632   UsbCommand c;
 633
 634   sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
 635
 636   if (Word > 15) {
 637     PrintAndLog("Word must be between 0 and 15");
 638     return 1;
 639   }
 640
 641   PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
 642
 643   c.cmd = CMD_EM4X_WRITE_WORD;
 644   c.d.asBytes[0] = 0x1; //Password mode
 645   c.arg[0] = Data;
 646   c.arg[1] = Word;
 647   c.arg[2] = Password;
 648   SendCommand(&c);
 649   return 0;
 650 }
 651
 652 static command_t CommandTable[] =
 653 {
 654   {"help", CmdHelp, 1, "This help"},
 655   {"410xdemod", CmdEMdemodASK, 0, "[clock rate] -- Extract ID from EM410x tag"},
 656   {"410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
 657   {"410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
 658   {"replay",  MWRem4xReplay, 0, "Watches for tag and simulates manchester encoded em4x tag"},
 659   {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
 660   {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
 661   {"410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
 662   {"4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
 663   {"rd", CmdReadWord, 1, "<Word 1-15> -- Read EM4xxx word data"},
 664   {"rdpwd", CmdReadWordPWD, 1, "<Word 1-15> <Password> -- Read EM4xxx word data  in password mode "},
 665   {"wr", CmdWriteWord, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
 666   {"wrpwd", CmdWriteWordPWD, 1, "<Data> <Word 1-15> <Password> -- Write EM4xxx word data in password mode"},
 667   {NULL, NULL, 0, NULL}
 668 };
 669
 670
 671 //Confirms the parity of a bitstream as well as obtaining the data (TagID) from within the appropriate memory space.
 672 //Arguments:
 673 // Pointer to a string containing the desired bitsream
 674 // Pointer to a string that will receive the decoded tag ID
 675 // Length of the bitsream pointed at in the first argument, char* _strBitStream
 676 //Retuns:
 677 //1 Parity confirmed
 678 //0 Parity not confirmed
 679 int ConfirmEm410xTagParity( char* _strBitStream, char* pID, int LengthOfBitstream )
 680 {
 681         int i = 0;
 682         int rows = 0;
 683         int Parity[4] = {0x00};
 684         char ID[11] = {0x00};
 685         int k = 0;
 686         int BitStream[70] = {0x00};
 687         int counter = 0;
 688         //prepare variables
 689         for ( i = 0; i <= LengthOfBitstream; i++)
 690         {
 691                 if (_strBitStream[i] == '1')
 692                 {
 693                         k =1;
 694                         memcpy(&BitStream[i], &k,4);
 695                 }
 696                 else if (_strBitStream[i] == '0')
 697                 {
 698                         k = 0;
 699                         memcpy(&BitStream[i], &k,4);
 700                 }
 701         }
 702         while ( counter < 2 )
 703         {
 704                 //set/reset variables and counters
 705                 memset(ID,0x00,sizeof(ID));
 706                 memset(Parity,0x00,sizeof(Parity));
 707                 rows = 0;
 708                 for ( i = 9; i <= LengthOfBitstream; i++)
 709                 {
 710                         if ( rows < 10 )
 711                         {
 712                                 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
 713                                 {
 714                                         sprintf(ID+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
 715                                         rows++;
 716                                         /* Keep parity info and move four bits ahead*/
 717                                         Parity[0] ^= BitStream[i];
 718                                         Parity[1] ^= BitStream[i+1];
 719                                         Parity[2] ^= BitStream[i+2];
 720                                         Parity[3] ^= BitStream[i+3];
 721                                         i += 4;
 722                                 }
 723                         }
 724                         if ( rows == 10 )
 725                         {
 726                                 if (    BitStream[i] == Parity[0] && BitStream[i+1] == Parity[1] &&
 727                                         BitStream[i+2] == Parity[2] && BitStream[i+3] == Parity[3] &&
 728                                         BitStream[i+4] == 0)
 729                                 {
 730                                         memcpy(pID,ID,strlen(ID));
 731                                         return 1;
 732                                 }
 733                         }
 734                 }
 735                 printf("[PARITY ->]Failed. Flipping Bits, and rechecking parity for bitstream:\n[PARITY ->]");
 736                 for (k = 0; k < LengthOfBitstream; k++)
 737                 {
 738                         BitStream[k] ^= 1;
 739                         printf("%i", BitStream[k]);
 740                 }
 741                 puts(" ");
 742                 counter++;
 743         }
 744         return 0;
 745 }
 746 //Reads and demodulates an em410x RFID tag. It further allows slight modification to the decoded bitstream
 747 //Once a suitable bitstream has been identified, and if needed, modified, it is replayed. Allowing emulation of the
 748 //"stolen" rfid tag.
 749 //No meaningful returns or arguments.
 750 int MWRem4xReplay(const char* Cmd)
 751 {
 752         // //header traces
 753         // static char ArrayTraceZero[] = { '0','0','0','0','0','0','0','0','0' };
 754         // static char ArrayTraceOne[] =  { '1','1','1','1','1','1','1','1','1' };
 755         // //local string variables
 756         // char strClockRate[10] = {0x00};
 757         // char strAnswer[4] = {0x00};
 758         // char strTempBufferMini[2] = {0x00};
 759         // //our outbound bit-stream
 760         // char strSimulateBitStream[65] = {0x00};
 761         // //integers
 762         // int iClockRate = 0;
 763         // int needle = 0;
 764         // int j = 0;
 765         // int iFirstHeaderOffset = 0x00000000;
 766         // int numManchesterDemodBits=0;
 767         // //boolean values
 768         // bool bInverted = false;
 769         // //pointers to strings. memory will be allocated.
 770         // char* pstrInvertBitStream = 0x00000000;
 771         // char* pTempBuffer = 0x00000000;
 772         // char* pID = 0x00000000;
 773         // char* strBitStreamBuffer = 0x00000000;
 774
 775
 776         // puts("###################################");
 777         // puts("#### Em4x Replay                 ##");
 778         // puts("#### R.A.M.           June 2013  ##");
 779         // puts("###################################");
 780         // //initialize
 781         // CmdLFRead("");
 782         // //Collect ourselves 10,000 samples
 783         // CmdSamples("10000");
 784         // puts("[->]preforming ASK demodulation\n");
 785         // //demodulate ask
 786         // Cmdaskdemod("0");
 787         // iClockRate = DetectClock(0);
 788         // sprintf(strClockRate, "%i\n",iClockRate);
 789         // printf("[->]Detected ClockRate: %s\n", strClockRate);
 790
 791         // //If detected clock rate is something completely unreasonable, dont go ahead
 792         // if ( iClockRate < 0xFFFE )
 793         // {
 794             // pTempBuffer = (char*)malloc(MAX_GRAPH_TRACE_LEN);
 795             // if (pTempBuffer == 0x00000000)
 796               // return 0;
 797             // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
 798             // //Preform manchester de-modulation and display in a single line.
 799             // numManchesterDemodBits = CmdManchesterDemod( strClockRate );
 800             // //note: numManchesterDemodBits is set above in CmdManchesterDemod()
 801             // if ( numManchesterDemodBits == 0 )
 802               // return 0;
 803             // strBitStreamBuffer = malloc(numManchesterDemodBits+1);
 804             // if ( strBitStreamBuffer == 0x00000000 )
 805                 // return 0;
 806             // memset(strBitStreamBuffer, 0x00, (numManchesterDemodBits+1));
 807             // //fill strBitStreamBuffer with demodulated, string formatted bits.
 808             // for ( j = 0; j <= numManchesterDemodBits; j++ )
 809             // {
 810                 // sprintf(strTempBufferMini, "%i",BitStream[j]);
 811                 // strcat(strBitStreamBuffer,strTempBufferMini);
 812             // }
 813             // printf("[->]Demodulated Bitstream: \n%s\n", strBitStreamBuffer);
 814             // //Reset counter and select most probable bit stream
 815             // j = 0;
 816                 // while ( j < numManchesterDemodBits )
 817                 // {
 818                     // memset(strSimulateBitStream,0x00,64);
 819                     // //search for header of nine (9) 0's : 000000000 or nine (9) 1's : 1111 1111 1
 820                         // if ( ( strncmp(strBitStreamBuffer+j, ArrayTraceZero, sizeof(ArrayTraceZero)) == 0 ) ||
 821                             // ( strncmp(strBitStreamBuffer+j, ArrayTraceOne, sizeof(ArrayTraceOne)) == 0  ) )
 822                         // {
 823                                 // iFirstHeaderOffset = j;
 824                             // memcpy(strSimulateBitStream, strBitStreamBuffer+j,64);
 825                             // printf("[->]Offset of Header");
 826                                 // if ( strncmp(strBitStreamBuffer+iFirstHeaderOffset, "0", 1) == 0 )
 827                                         // printf("'%s'", ArrayTraceZero );
 828                                 // else
 829                                         // printf("'%s'", ArrayTraceOne );
 830                                 // printf(": %i\nHighlighted string : %s\n",iFirstHeaderOffset,strSimulateBitStream);
 831                             // //allow us to escape loop or choose another frame
 832                             // puts("[<-]Are we happy with this sample? [Y]es/[N]o");
 833                             // gets(strAnswer);
 834                             // if ( ( strncmp(strAnswer,"y",1) == 0 )  || ( strncmp(strAnswer,"Y",1) == 0 ) )
 835                             // {
 836                                     // j = numManchesterDemodBits+1;
 837                                     // break;
 838                             // }
 839                         // }
 840                         // j++;
 841                 // }
 842         // }
 843         // else return 0;
 844
 845         // //Do we want the buffer inverted?
 846         // memset(strAnswer, 0x00, sizeof(strAnswer));
 847         // printf("[<-]Do you wish to invert the highlighted bitstream? [Y]es/[N]o\n");
 848         // gets(strAnswer);
 849         // if ( ( strncmp("y", strAnswer,1) == 0 )  || ( strncmp("Y", strAnswer, 1 ) == 0 ) )
 850         // {
 851                 // //allocate heap memory
 852                 // pstrInvertBitStream = (char*)malloc(numManchesterDemodBits);
 853                 // if ( pstrInvertBitStream != 0x00000000 )
 854                 // {
 855                         // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
 856                         // bInverted = true;
 857                         // //Invert Bitstream
 858                         // for ( needle = 0; needle <= numManchesterDemodBits; needle++ )
 859                         // {
 860                                 // if (strSimulateBitStream[needle] == '0')
 861                                         // strcat(pstrInvertBitStream,"1");
 862                                 // else if (strSimulateBitStream[needle] == '1')
 863                                         // strcat(pstrInvertBitStream,"0");
 864                         // }
 865                         // printf("[->]Inverted bitstream: %s\n", pstrInvertBitStream);
 866                 // }
 867         // }
 868     // //Confirm parity of selected string
 869         // pID = (char*)malloc(11);
 870         // if (pID != 0x00000000)
 871         // {
 872                 // memset(pID, 0x00, 11);
 873                 // if (ConfirmEm410xTagParity(strSimulateBitStream,pID, 64) == 1)
 874                 // {
 875                         // printf("[->]Parity confirmed for selected bitstream!\n");
 876                         // printf("[->]Tag ID was detected as: [hex]:%s\n",pID );
 877                 // }
 878                 // else
 879                         // printf("[->]Parity check failed for the selected bitstream!\n");
 880         // }
 881
 882         // //Spoof
 883         // memset(strAnswer, 0x00, sizeof(strAnswer));
 884         // printf("[<-]Do you wish to continue with the EM4x simulation? [Y]es/[N]o\n");
 885         // gets(strAnswer);
 886         // if ( ( strncmp(strAnswer,"y",1) == 0 )  || ( strncmp(strAnswer,"Y",1) == 0 ) )
 887         // {
 888                 // strcat(pTempBuffer, strClockRate);
 889                 // strcat(pTempBuffer, " ");
 890                 // if (bInverted == true)
 891                         // strcat(pTempBuffer,pstrInvertBitStream);
 892                 // if (bInverted == false)
 893                         // strcat(pTempBuffer,strSimulateBitStream);
 894                 // //inform the user
 895                 // puts("[->]Starting simulation now: \n");
 896                 // //Simulate tag with prepared buffer.
 897                 // CmdLFSimManchester(pTempBuffer);
 898         // }
 899         // else if ( ( strcmp("n", strAnswer) == 0 )  || ( strcmp("N", strAnswer ) == 0 ) )
 900                 // printf("[->]Exiting procedure now...\n");
 901         // else
 902                 // printf("[->]Erroneous selection\nExiting procedure now....\n");
 903
 904         // //Clean up -- Exit function
 905         // //clear memory, then release pointer.
 906         // if ( pstrInvertBitStream != 0x00000000 )
 907         // {
 908             // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
 909             // free(pstrInvertBitStream);
 910         // }
 911         // if ( pTempBuffer != 0x00000000 )
 912         // {
 913             // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
 914             // free(pTempBuffer);
 915         // }
 916         // if ( pID != 0x00000000 )
 917         // {
 918             // memset(pID,0x00,11);
 919             // free(pID);
 920         // }
 921         // if ( strBitStreamBuffer != 0x00000000 )
 922         // {
 923             // memset(strBitStreamBuffer,0x00,numManchesterDemodBits);
 924             // free(strBitStreamBuffer);
 925         // }
 926         return 0;
 927 }
 928
 929 int CmdLFEM4X(const char *Cmd)
 930 {
 931   CmdsParse(CommandTable, Cmd);
 932   return 0;
 933 }
 934
 935 int CmdHelp(const char *Cmd)
 936 {
 937   CmdsHelp(CommandTable);
 938   return 0;
 939 }