git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency T55xx commands
   8 //-----------------------------------------------------------------------------
   9
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <inttypes.h>
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdmain.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"
  19 #include "cmdlf.h"
  20 #include "cmdlft55xx.h"
  21 #include "util.h"
  22 #include "data.h"
  23
  24
  25 #define LF_TRACE_BUFF_SIZE 20000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)
  26 #define LF_BITSSTREAM_LEN 1000 // more then 1000 bits shouldn't happend..  8block * 4 bytes * 8bits =
  27 static int CmdHelp(const char *Cmd);
  28
  29
  30 int CmdReadBlk(const char *Cmd)
  31 {
  32         int block = -1;
  33         sscanf(Cmd, "%d", &block);
  34
  35         if ((block > 7) | (block < 0)) {
  36                 PrintAndLog("Block must be between 0 and 7");
  37                 return 1;
  38         }
  39
  40         UsbCommand c;
  41         c.cmd = CMD_T55XX_READ_BLOCK;
  42         c.d.asBytes[0] = 0x00;
  43         c.arg[0] = 0;
  44         c.arg[1] = block;
  45         c.arg[2] = 0;
  46         SendCommand(&c);
  47         WaitForResponse(CMD_ACK, NULL);
  48
  49         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  50
  51         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
  52         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  53
  54         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  55                 GraphBuffer[j] = (int)data[j];
  56         }
  57         GraphTraceLen = LF_TRACE_BUFF_SIZE;
  58         ManchesterDemod(block);
  59         RepaintGraphWindow();
  60   return 0;
  61 }
  62
  63 int CmdReadBlkPWD(const char *Cmd)
  64 {
  65         int Block = -1; //default to invalid block
  66         int Password = 0xFFFFFFFF; //default to blank Block 7
  67         UsbCommand c;
  68
  69         sscanf(Cmd, "%d %x", &Block, &Password);
  70
  71         if ((Block > 7) | (Block < 0)) {
  72                 PrintAndLog("Block must be between 0 and 7");
  73                 return 1;
  74         }
  75
  76         PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
  77
  78         c.cmd = CMD_T55XX_READ_BLOCK;
  79         c.d.asBytes[0] = 0x1; //Password mode
  80         c.arg[0] = 0;
  81         c.arg[1] = Block;
  82         c.arg[2] = Password;
  83         SendCommand(&c);
  84         WaitForResponse(CMD_ACK, NULL);
  85
  86         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  87
  88         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
  89         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  90
  91         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  92                 GraphBuffer[j] = ((int)data[j]);
  93         }
  94         GraphTraceLen = LF_TRACE_BUFF_SIZE;
  95         ManchesterDemod(Block);
  96         RepaintGraphWindow();
  97   return 0;
  98 }
  99
 100 int CmdWriteBlk(const char *Cmd)
 101 {
 102   int Block = 8; //default to invalid block
 103   int Data = 0xFFFFFFFF; //default to blank Block
 104   UsbCommand c;
 105
 106   sscanf(Cmd, "%x %d", &Data, &Block);
 107
 108   if (Block > 7) {
 109         PrintAndLog("Block must be between 0 and 7");
 110         return 1;
 111   }
 112
 113   PrintAndLog("Writting block %d with data %08X", Block, Data);
 114
 115   c.cmd = CMD_T55XX_WRITE_BLOCK;
 116   c.d.asBytes[0] = 0x0; //Normal mode
 117   c.arg[0] = Data;
 118   c.arg[1] = Block;
 119   c.arg[2] = 0;
 120   SendCommand(&c);
 121   return 0;
 122 }
 123
 124 int CmdWriteBlkPWD(const char *Cmd)
 125 {
 126   int Block = 8; //default to invalid block
 127   int Data = 0xFFFFFFFF; //default to blank Block
 128   int Password = 0xFFFFFFFF; //default to blank Block 7
 129   UsbCommand c;
 130
 131   sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
 132
 133   if (Block > 7) {
 134         PrintAndLog("Block must be between 0 and 7");
 135         return 1;
 136   }
 137
 138   PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
 139
 140   c.cmd = CMD_T55XX_WRITE_BLOCK;
 141   c.d.asBytes[0] = 0x1; //Password mode
 142   c.arg[0] = Data;
 143   c.arg[1] = Block;
 144   c.arg[2] = Password;
 145   SendCommand(&c);
 146   return 0;
 147 }
 148
 149 int CmdReadTrace(const char *Cmd)
 150 {
 151         char cmdp = param_getchar(Cmd, 0);
 152
 153         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 154                 PrintAndLog("Usage:  lf t55xx trace  [use data from Graphbuffer]");
 155                 PrintAndLog("     [use data from Graphbuffer], if not set, try reading data from tag.");
 156                 PrintAndLog("");
 157                 PrintAndLog("     sample: lf t55xx trace");
 158                 PrintAndLog("     sample: lf t55xx trace 1");
 159                 return 0;
 160         }
 161
 162         if ( strlen(Cmd)==0){
 163                 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
 164                 SendCommand(&c);
 165                 WaitForResponse(CMD_ACK, NULL);
 166
 167                 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 168
 169                 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
 170                 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 171
 172                 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 173                         GraphBuffer[j] = ((int)data[j]);
 174                 }
 175                 GraphTraceLen = LF_TRACE_BUFF_SIZE;
 176         }
 177
 178         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 179         uint8_t * bitstream = bits;
 180
 181         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
 182         RepaintGraphWindow();
 183
 184         uint8_t si = 5;
 185         uint32_t bl0     = PackBits(si, 32, bitstream);
 186         uint32_t bl1     = PackBits(si+32, 32, bitstream);
 187
 188         uint32_t acl     = PackBits(si,  8, bitstream); si += 8;
 189         uint32_t mfc     = PackBits(si, 8, bitstream); si += 8;
 190         uint32_t cid     = PackBits(si, 5, bitstream); si += 5;
 191         uint32_t icr     = PackBits(si, 3, bitstream); si += 3;
 192         uint32_t year    = PackBits(si, 4, bitstream); si += 4;
 193         uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
 194         uint32_t lotid    = PackBits(si, 12, bitstream); si += 12;
 195         uint32_t wafer   = PackBits(si, 5, bitstream); si += 5;
 196         uint32_t dw      = PackBits(si, 15, bitstream);
 197
 198         PrintAndLog("");
 199         PrintAndLog("-- T55xx Trace Information ----------------------------------");
 200         PrintAndLog("-------------------------------------------------------------");
 201         PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1)  : 0x%02X (%d)", acl, acl);
 202         PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x%02X (%d)", mfc, mfc);
 203         PrintAndLog(" CID                                     : 0x%02X (%d)", cid, cid);
 204         PrintAndLog(" ICR IC Revision                         : %d",icr );
 205         PrintAndLog(" Manufactured");
 206         PrintAndLog("     Year/Quarter : %d/%d",2000+year, quarter );
 207         PrintAndLog("     Lot ID       : %d", lotid );
 208         PrintAndLog("     Wafer number : %d", wafer);
 209         PrintAndLog("     Die Number   : %d", dw);
 210         PrintAndLog("-------------------------------------------------------------");
 211         PrintAndLog(" Raw Data - Page 1");
 212         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bitstream+5,32) );
 213         PrintAndLog("     Block 0  : 0x%08X  %s", bl1, sprint_bin(bitstream+37,32) );
 214         PrintAndLog("-------------------------------------------------------------");
 215         /*
 216         TRACE - BLOCK O
 217                 Bits    Definition                                                              HEX
 218                 1-8             ACL Allocation class (ISO/IEC 15963-1)  0xE0
 219                 9-16    MFC Manufacturer ID (ISO/IEC 7816-6)    0x15 Atmel Corporation
 220                 17-21   CID                                                                             0x1 = Atmel ATA5577M1  0x2 = Atmel ATA5577M2
 221                 22-24   ICR IC revision
 222                 25-28   YEAR (BCD encoded)                                              9 (= 2009)
 223                 29-30   QUARTER                                                                 1,2,3,4
 224                 31-32   LOT ID
 225
 226         TRACE - BLOCK 1
 227                 1-12    LOT ID
 228                 13-17   Wafer number
 229                 18-32   DW,  die number sequential
 230         */
 231
 232   return 0;
 233 }
 234
 235 int CmdInfo(const char *Cmd){
 236         /*
 237                 Page 0 Block 0 Configuration data.
 238                 Normal mode
 239                 Extended mode
 240         */
 241         char cmdp = param_getchar(Cmd, 0);
 242
 243         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 244                 PrintAndLog("Usage:  lf t55xx info  [use data from Graphbuffer]");
 245                 PrintAndLog("     [use data from Graphbuffer], if not set, try reading data from tag.");
 246                 PrintAndLog("");
 247                 PrintAndLog("    sample: lf t55xx info");
 248                 PrintAndLog("    sample: lf t55xx info 1");
 249                 return 0;
 250         }
 251
 252         if ( strlen(Cmd) == 0 ){
 253                 CmdReadBlk("0");
 254         }
 255
 256         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 257
 258         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
 259
 260         uint8_t si = 5;
 261         uint32_t bl0      = PackBits(si, 32, bits);
 262
 263         uint32_t safer    = PackBits(si, 4, bits); si += 4;
 264         uint32_t resv     = PackBits(si, 7, bits); si += 7;
 265         uint32_t dbr      = PackBits(si, 3, bits); si += 3;
 266         uint32_t extend   = PackBits(si, 1, bits); si += 1;
 267         uint32_t datamodulation   = PackBits(si, 5, bits); si += 5;
 268         uint32_t pskcf    = PackBits(si, 2, bits); si += 2;
 269         uint32_t aor      = PackBits(si, 1, bits); si += 1;
 270         uint32_t otp      = PackBits(si, 1, bits); si += 1;
 271         uint32_t maxblk   = PackBits(si, 3, bits); si += 3;
 272         uint32_t pwd      = PackBits(si, 1, bits); si += 1;
 273         uint32_t sst      = PackBits(si, 1, bits); si += 1;
 274         uint32_t fw       = PackBits(si, 1, bits); si += 1;
 275         uint32_t inv      = PackBits(si, 1, bits); si += 1;
 276         uint32_t por      = PackBits(si, 1, bits); si += 1;
 277
 278         PrintAndLog("");
 279         PrintAndLog("-- T55xx Configuration --------------------------------------");
 280         PrintAndLog("-------------------------------------------------------------");
 281         PrintAndLog(" Safer key                 : %s", GetSaferStr(safer));
 282         PrintAndLog(" reserved                  : %d", resv);
 283         PrintAndLog(" Data bit rate             : %s", GetBitRateStr(dbr));
 284         PrintAndLog(" eXtended mode             : %s", (extend) ? "Yes - Warning":"No");
 285         PrintAndLog(" Modulation                : %s", GetModulationStr(datamodulation) );
 286         PrintAndLog(" PSK clock freq            : %d", pskcf);
 287         PrintAndLog(" AOR - Answer on Request   : %s", (aor) ? "Yes":"No");
 288         PrintAndLog(" OTP - One Time Pad        : %s", (otp) ? "Yes - Warning":"No" );
 289         PrintAndLog(" Max block                 : %d", maxblk);
 290         PrintAndLog(" Password mode             : %s", (pwd) ? "Yes":"No");
 291         PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
 292         PrintAndLog(" Fast Write                : %s", (fw) ? "Yes":"No");
 293         PrintAndLog(" Inverse data              : %s", (inv) ? "Yes":"No");
 294         PrintAndLog(" POR-Delay                 : %s", (por) ? "Yes":"No");
 295         PrintAndLog("-------------------------------------------------------------");
 296         PrintAndLog(" Raw Data - Page 0");
 297         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bits+5,32) );
 298         PrintAndLog("-------------------------------------------------------------");
 299
 300         return 0;
 301 }
 302
 303 int CmdDump(const char *Cmd){
 304
 305         char cmdp = param_getchar(Cmd, 0);
 306         char s[20];
 307         uint8_t pwd[4] = {0x00};
 308         bool hasPwd = ( strlen(Cmd) > 0);
 309
 310         if ( cmdp == 'h' || cmdp == 'H') {
 311                 PrintAndLog("Usage:  lf t55xx dump <password>");
 312                 PrintAndLog("        sample: lf t55xx dump FFFFFFFF");
 313                 return 0;
 314         }
 315
 316         if ( hasPwd ){
 317                 if (param_gethex(Cmd, 0, pwd, 8)) {
 318                         PrintAndLog("password must include 8 HEX symbols");
 319                         return 0;
 320                 }
 321         }
 322
 323         for ( int i = 0; i <8; ++i){
 324                 memset(s,0,sizeof(s));
 325                 if ( hasPwd ) {
 326                         sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
 327                         CmdReadBlkPWD(s);
 328                 } else {
 329                         sprintf(s,"%d", i);
 330                         CmdReadBlk(s);
 331                 }
 332         }
 333         return 0;
 334 }
 335
 336 int CmdIceFsk(const char *Cmd){
 337
 338         if (!HasGraphData()) return 0;
 339
 340         iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
 341         RepaintGraphWindow();
 342         return 0;
 343 }
 344 int CmdIceManchester(const char *Cmd){
 345         ManchesterDemod( -1);
 346         return 0;
 347 }
 348 int ManchesterDemod(int blockNum){
 349
 350         if (!HasGraphData()) return 0;
 351
 352         uint8_t sizebyte = 32;
 353         // the value 5 was selected during empirical studies of the decoded data. Some signal noise to skip.
 354         uint8_t offset = 5;
 355         uint32_t blockData;
 356         uint8_t  bits[LF_BITSSTREAM_LEN] = {0x00};
 357         uint8_t * bitstream = bits;
 358
 359         //manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
 360         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
 361     //blockData = PackBits(offset, sizebyte, bitstream);
 362         blockData = PackBits(offset, sizebyte, bits);
 363
 364         if ( blockNum < 0)
 365                 PrintAndLog(" Decoded     : 0x%08X  %s", blockData, sprint_bin(bitstream+offset,sizebyte) );
 366                 else
 367                 PrintAndLog(" Block %d    : 0x%08X  %s", blockNum, blockData, sprint_bin(bitstream+offset,sizebyte) );
 368
 369         return 0;
 370 }
 371
 372 char * GetBitRateStr(uint32_t id){
 373         static char buf[40];
 374         char *retStr = buf;
 375                 switch (id){
 376                 case 0:
 377                         sprintf(retStr,"%d - RF/8",id);
 378                         break;
 379                 case 1:
 380                         sprintf(retStr,"%d - RF/16",id);
 381                         break;
 382                 case 2:
 383                         sprintf(retStr,"%d - RF/32",id);
 384                         break;
 385                 case 3:
 386                         sprintf(retStr,"%d - RF/40",id);
 387                         break;
 388                 case 4:
 389                         sprintf(retStr,"%d - RF/50",id);
 390                         break;
 391                 case 5:
 392                         sprintf(retStr,"%d - RF/64",id);
 393                         break;
 394                 case 6:
 395                         sprintf(retStr,"%d - RF/100",id);
 396                         break;
 397                 case 7:
 398                         sprintf(retStr,"%d - RF/128",id);
 399                         break;
 400                 default:
 401                         sprintf(retStr,"%d - (Unknown)",id);
 402                         break;
 403                 }
 404
 405         return buf;
 406 }
 407
 408 char * GetSaferStr(uint32_t id){
 409         static char buf[40];
 410         char *retStr = buf;
 411
 412         sprintf(retStr,"%d",id);
 413         if (id == 6) {
 414                 sprintf(retStr,"%d - pasdwd",id);
 415         }
 416         if (id == 9 ){
 417                 sprintf(retStr,"%d - testmode ",id);
 418         }
 419
 420         return buf;
 421 }
 422 char * GetModulationStr( uint32_t id){
 423         static char buf[40];
 424         char *retStr = buf;
 425
 426         switch (id){
 427                 case 0:
 428                         sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
 429                         break;
 430                 case 1:
 431                         sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
 432                         break;
 433                 case 2:
 434                         sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
 435                         break;
 436                 case 3:
 437                         sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
 438                         break;
 439                 case 4:
 440                         sprintf(retStr,"%d - FSK 1 RF/8  RF/5",id);
 441                         break;
 442                 case 5:
 443                         sprintf(retStr,"%d - FSK 2 RF/8  RF/10",id);
 444                         break;
 445                 case 6:
 446                         sprintf(retStr,"%d - FSK 1a RF/5  RF/8",id);
 447                         break;
 448                 case 7:
 449                         sprintf(retStr,"%d - FSK 2a RF/10  RF/8",id);
 450                         break;
 451                 case 8:
 452                         sprintf(retStr,"%d - Manschester",id);
 453                         break;
 454                 case 16:
 455                         sprintf(retStr,"%d - Biphase",id);
 456                         break;
 457                 case 17:
 458                         sprintf(retStr,"%d - Reserved",id);
 459                         break;
 460                 default:
 461                         sprintf(retStr,"0x%02X (Unknown)",id);
 462                         break;
 463                 }
 464         return buf;
 465 }
 466
 467
 468 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
 469
 470         int i = start;
 471         int j = len-1;
 472         if (len > 32) {
 473                 return 0;
 474         }
 475         uint32_t tmp = 0;
 476         for (; j >= 0; --j, ++i){
 477                 tmp     |= bits[i] << j;
 478         }
 479         return tmp;
 480 }
 481
 482 static command_t CommandTable[] =
 483 {
 484   {"help",   CmdHelp,        1, "This help"},
 485   {"rd",     CmdReadBlk,     0, "<block> -- Read T55xx block data (page 0)"},
 486   {"rdpwd",  CmdReadBlkPWD,  0, "<block> <password> -- Read T55xx block data with password mode"},
 487   {"wr",     CmdWriteBlk,    0, "<data> <block> -- Write T55xx block data (page 0)"},
 488   {"wrpwd",  CmdWriteBlkPWD, 0, "<data> <block> <password> -- Write T55xx block data with password"},
 489   {"trace",  CmdReadTrace,   0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},
 490   {"info",   CmdInfo,        0, "[1] Read T55xx configuration data (page 0/ blk 0)"},
 491   {"dump",   CmdDump,        0, "[password] Dump T55xx card block 0-7. optional with password"},
 492   {"fsk",    CmdIceFsk,      0, "FSK demod"},
 493   {"man",    CmdIceManchester,      0, "Manchester demod (with SST)"},
 494   {NULL, NULL, 0, NULL}
 495 };
 496
 497 int CmdLFT55XX(const char *Cmd)
 498 {
 499   CmdsParse(CommandTable, Cmd);
 500   return 0;
 501 }
 502
 503 int CmdHelp(const char *Cmd)
 504 {
 505   CmdsHelp(CommandTable);
 506   return 0;
 507 }