]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c
projects / proxmark3-svn / blob
? search:


9206fd2ad946e635ef70d82efee8ef83a0b1d902
[proxmark3-svn] / client / cmdlft55xx.c
1 //-----------------------------------------------------------------------------
2 //
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
5 // the license.
6 //-----------------------------------------------------------------------------
7 // Low frequency T55xx commands
8 //-----------------------------------------------------------------------------
9
10 #include <stdio.h>
11 #include <string.h>
12 #include <inttypes.h>
13 #include "proxmark3.h"
14 #include "ui.h"
15 #include "graph.h"
16 #include "cmdmain.h"
17 #include "cmdparser.h"
18 #include "cmddata.h"
19 #include "cmdlf.h"
20 #include "cmdlft55xx.h"
21 #include "util.h"
22 #include "data.h"
23
24
25 #define LF_TRACE_BUFF_SIZE 12000 // 32 x 32 x 10 (32 bit times numofblock (7), times clock skip..)
26 static int CmdHelp(const char *Cmd);
27
28
29 int CmdReadBlk(const char *Cmd)
30 {
31 //default to invalid block
32 int Block = -1;
33 UsbCommand c;
34
35 sscanf(Cmd, "%d", &Block);
36
37 if ((Block > 7) | (Block < 0)) {
38 PrintAndLog("Block must be between 0 and 7");
39 return 1;
40 }
41
42 //PrintAndLog(" Reading page 0 block : %d", Block);
43
44 // this command fills up BigBuff
45 //
46 c.cmd = CMD_T55XX_READ_BLOCK;
47 c.d.asBytes[0] = 0x00;
48 c.arg[0] = 0;
49 c.arg[1] = Block;
50 c.arg[2] = 0;
51 SendCommand(&c);
52 WaitForResponse(CMD_ACK, NULL);
53
54 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
55
56 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
57 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
58
59 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
60 GraphBuffer[j] = ((int)data[j]) ;
61 }
62 GraphTraceLen = LF_TRACE_BUFF_SIZE;
63 CmdIceManchester(Cmd);
64 RepaintGraphWindow();
65 return 0;
66 }
67
68 int CmdReadBlkPWD(const char *Cmd)
69 {
70 int Block = -1; //default to invalid block
71 int Password = 0xFFFFFFFF; //default to blank Block 7
72 UsbCommand c;
73
74 sscanf(Cmd, "%d %x", &Block, &Password);
75
76 if ((Block > 7) | (Block < 0)) {
77 PrintAndLog("Block must be between 0 and 7");
78 return 1;
79 }
80
81 PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
82
83 c.cmd = CMD_T55XX_READ_BLOCK;
84 c.d.asBytes[0] = 0x1; //Password mode
85 c.arg[0] = 0;
86 c.arg[1] = Block;
87 c.arg[2] = Password;
88 SendCommand(&c);
89 WaitForResponse(CMD_ACK, NULL);
90
91 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
92
93 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
94 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
95
96 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
97 GraphBuffer[j] = ((int)data[j]) - 128;
98 }
99 GraphTraceLen = LF_TRACE_BUFF_SIZE;
100
101 CmdIceManchester(Cmd);
102
103 RepaintGraphWindow();
104 return 0;
105 }
106
107 int CmdWriteBlk(const char *Cmd)
108 {
109 int Block = 8; //default to invalid block
110 int Data = 0xFFFFFFFF; //default to blank Block
111 UsbCommand c;
112
113 sscanf(Cmd, "%x %d", &Data, &Block);
114
115 if (Block > 7) {
116 PrintAndLog("Block must be between 0 and 7");
117 return 1;
118 }
119
120 PrintAndLog("Writting block %d with data %08X", Block, Data);
121
122 c.cmd = CMD_T55XX_WRITE_BLOCK;
123 c.d.asBytes[0] = 0x0; //Normal mode
124 c.arg[0] = Data;
125 c.arg[1] = Block;
126 c.arg[2] = 0;
127 SendCommand(&c);
128 return 0;
129 }
130
131 int CmdWriteBlkPWD(const char *Cmd)
132 {
133 int Block = 8; //default to invalid block
134 int Data = 0xFFFFFFFF; //default to blank Block
135 int Password = 0xFFFFFFFF; //default to blank Block 7
136 UsbCommand c;
137
138 sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
139
140 if (Block > 7) {
141 PrintAndLog("Block must be between 0 and 7");
142 return 1;
143 }
144
145 PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
146
147 c.cmd = CMD_T55XX_WRITE_BLOCK;
148 c.d.asBytes[0] = 0x1; //Password mode
149 c.arg[0] = Data;
150 c.arg[1] = Block;
151 c.arg[2] = Password;
152 SendCommand(&c);
153 return 0;
154 }
155
156 int CmdReadTrace(const char *Cmd)
157 {
158 char cmdp = param_getchar(Cmd, 0);
159
160 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
161 PrintAndLog("Usage: lf t55xx trace [use data from Graphbuffer]");
162 PrintAndLog(" [use data from Graphbuffer], if not set, try reading data from tag.");
163 PrintAndLog("");
164 PrintAndLog(" sample: lf t55xx trace");
165 PrintAndLog(" sample: lf t55xx trace 1");
166 return 0;
167 }
168
169 if ( strlen(Cmd)==0){
170 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
171 SendCommand(&c);
172 WaitForResponse(CMD_ACK, NULL);
173
174 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
175
176 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
177 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
178
179 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
180 GraphBuffer[j] = ((int)data[j]);
181 }
182 GraphTraceLen = LF_TRACE_BUFF_SIZE;
183 }
184
185 uint8_t bits[1000] = {0x00};
186 uint8_t * bitstream = bits;
187
188 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
189 RepaintGraphWindow();
190
191 uint8_t si = 5;
192 uint32_t bl0 = PackBits(si, 32, bitstream);
193 uint32_t bl1 = PackBits(si+32, 32, bitstream);
194
195 uint32_t acl = PackBits(si, 8, bitstream); si += 8;
196 uint32_t mfc = PackBits(si, 8, bitstream); si += 8;
197 uint32_t cid = PackBits(si, 5, bitstream); si += 5;
198 uint32_t icr = PackBits(si, 3, bitstream); si += 3;
199 uint32_t year = PackBits(si, 4, bitstream); si += 4;
200 uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
201 uint32_t lotid = PackBits(si, 12, bitstream); si += 12;
202 uint32_t wafer = PackBits(si, 5, bitstream); si += 5;
203 uint32_t dw = PackBits(si, 15, bitstream);
204
205 PrintAndLog("");
206 PrintAndLog("-- T55xx Trace Information ----------------------------------");
207 PrintAndLog("-------------------------------------------------------------");
208 PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", acl, acl);
209 PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d)", mfc, mfc);
210 PrintAndLog(" CID : 0x%02X (%d)", cid, cid);
211 PrintAndLog(" ICR IC Revision : %d",icr );
212 PrintAndLog(" Manufactured");
213 PrintAndLog(" Year/Quarter : %d/%d",2000+year, quarter );
214 PrintAndLog(" Lot ID : %d", lotid );
215 PrintAndLog(" Wafer number : %d", wafer);
216 PrintAndLog(" Die Number : %d", dw);
217 PrintAndLog("-------------------------------------------------------------");
218 PrintAndLog(" Raw Data - Page 1");
219 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bitstream+5,32) );
220 PrintAndLog(" Block 0 : 0x%08X %s", bl1, sprint_bin(bitstream+37,32) );
221 PrintAndLog("-------------------------------------------------------------");
222 /*
223 TRACE - BLOCK O
224 Bits Definition HEX
225 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0
226 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation
227 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2
228 22-24 ICR IC revision
229 25-28 YEAR (BCD encoded) 9 (= 2009)
230 29-30 QUARTER 1,2,3,4
231 31-32 LOT ID
232
233 TRACE - BLOCK 1
234 1-12 LOT ID
235 13-17 Wafer number
236 18-32 DW, die number sequential
237 */
238
239 return 0;
240 }
241
242 int CmdInfo(const char *Cmd){
243 /*
244 Page 0 Block 0 Configuration data.
245 Normal mode
246 Extended mode
247 */
248 char cmdp = param_getchar(Cmd, 0);
249
250 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
251 PrintAndLog("Usage: lf t55xx info [use data from Graphbuffer]");
252 PrintAndLog(" [use data from Graphbuffer], if not set, try reading data from tag.");
253 PrintAndLog("");
254 PrintAndLog(" sample: lf t55xx info");
255 PrintAndLog(" sample: lf t55xx info 1");
256 return 0;
257 }
258
259 if ( strlen(Cmd)==0){
260 CmdReadBlk("0");
261 }
262
263
264 uint8_t bits[1000] = {0x00};
265 uint8_t * bitstream = bits;
266
267 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
268
269 uint8_t si = 5;
270 uint32_t bl0 = PackBits(si, 32, bitstream);
271
272 uint32_t safer = PackBits(si, 4, bitstream); si += 4;
273 uint32_t resv = PackBits(si, 7, bitstream); si += 7;
274 uint32_t dbr = PackBits(si, 3, bitstream); si += 3;
275 uint32_t extend = PackBits(si, 1, bitstream); si += 1;
276 uint32_t datamodulation = PackBits(si, 5, bitstream); si += 5;
277 uint32_t pskcf = PackBits(si, 2, bitstream); si += 2;
278 uint32_t aor = PackBits(si, 1, bitstream); si += 1;
279 uint32_t otp = PackBits(si, 1, bitstream); si += 1;
280 uint32_t maxblk = PackBits(si, 3, bitstream); si += 3;
281 uint32_t pwd = PackBits(si, 1, bitstream); si += 1;
282 uint32_t sst = PackBits(si, 1, bitstream); si += 1;
283 uint32_t fw = PackBits(si, 1, bitstream); si += 1;
284 uint32_t inv = PackBits(si, 1, bitstream); si += 1;
285 uint32_t por = PackBits(si, 1, bitstream); si += 1;
286
287 PrintAndLog("");
288 PrintAndLog("-- T55xx Configuration --------------------------------------");
289 PrintAndLog("-------------------------------------------------------------");
290 PrintAndLog(" Safer key : %s", GetSaferStr(safer));
291 PrintAndLog(" reserved : %d", resv);
292 PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr));
293 PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");
294 PrintAndLog(" Modulation : %s", GetModulationStr(datamodulation) );
295 PrintAndLog(" PSK clock freq : %d", pskcf);
296 PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");
297 PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );
298 PrintAndLog(" Max block : %d", maxblk);
299 PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");
300 PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
301 PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");
302 PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");
303 PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");
304 PrintAndLog("-------------------------------------------------------------");
305 PrintAndLog(" Raw Data - Page 0");
306 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bitstream+5,32) );
307 PrintAndLog("-------------------------------------------------------------");
308
309 return 0;
310 }
311
312 int CmdDump(const char *Cmd){
313
314 char cmdp = param_getchar(Cmd, 0);
315 char s[20];
316 uint8_t pwd[4] = {0x00};
317
318 if (strlen(Cmd)>1 || cmdp == 'h' || cmdp == 'H') {
319 PrintAndLog("Usage: lf t55xx dump <password>");
320 PrintAndLog(" sample: lf t55xx dump FFFFFFFF");
321 return 0;
322 }
323
324 bool hasPwd = ( strlen(Cmd) > 0);
325
326 if ( hasPwd ){
327 if (param_gethex(Cmd, 0, pwd, 4)) {
328 PrintAndLog("password must include 4 HEX symbols");
329 return 0;
330 }
331 }
332
333 for ( int i = 0; i <8; ++i){
334 *s = 0;
335 if ( hasPwd ) {
336 sprintf(s,"%d %d", i, pwd);
337 CmdReadBlkPWD(s);
338 } else {
339 sprintf(s,"%d", i);
340 CmdReadBlk(s);
341 }
342 }
343 return 0;
344 }
345
346 int CmdIceFsk(const char *Cmd){
347 iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
348 RepaintGraphWindow();
349 return 0;
350 }
351 int CmdIceManchester(const char *Cmd){
352
353 int blockNum = -1;
354 uint32_t blockData;
355 uint8_t bits[1000] = {0x00};
356 uint8_t * bitstream = bits;
357
358 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
359 blockData = PackBits(5, 32, bitstream);
360 sscanf(Cmd, "%d", &blockNum);
361 if ( blockNum > -1){
362 PrintAndLog(" Block %d : 0x%08X %s", blockNum, blockData, sprint_bin(bitstream+5,32) );
363 }else{
364 PrintAndLog(" Decoded : 0x%08X %s", blockData, sprint_bin(bitstream+5,32) );
365 }
366 return 0;
367 }
368
369 char * GetBitRateStr(uint32_t id){
370 static char buf[40];
371 char *retStr = buf;
372 switch (id){
373 case 0:
374 sprintf(retStr,"%d - RF/8",id);
375 break;
376 case 1:
377 sprintf(retStr,"%d - RF/16",id);
378 break;
379 case 2:
380 sprintf(retStr,"%d - RF/32",id);
381 break;
382 case 3:
383 sprintf(retStr,"%d - RF/40",id);
384 break;
385 case 4:
386 sprintf(retStr,"%d - RF/50",id);
387 break;
388 case 5:
389 sprintf(retStr,"%d - RF/64",id);
390 break;
391 case 6:
392 sprintf(retStr,"%d - RF/100",id);
393 break;
394 case 7:
395 sprintf(retStr,"%d - RF/128",id);
396 break;
397 default:
398 sprintf(retStr,"%d - (Unknown)",id);
399 break;
400 }
401
402 return buf;
403 }
404
405 char * GetSaferStr(uint32_t id){
406 static char buf[40];
407 char *retStr = buf;
408
409 sprintf(retStr,"%d",id);
410 if (id == 6) {
411 sprintf(retStr,"%d - pasdwd",id);
412 }
413 if (id == 9 ){
414 sprintf(retStr,"%d - testmode ",id);
415 }
416
417 return buf;
418 }
419 char * GetModulationStr( uint32_t id){
420 static char buf[40];
421 char *retStr = buf;
422
423 switch (id){
424 case 0:
425 sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
426 break;
427 case 1:
428 sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
429 break;
430 case 2:
431 sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
432 break;
433 case 3:
434 sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
435 break;
436 case 4:
437 sprintf(retStr,"%d - FSK 1 RF/8 RF/5",id);
438 break;
439 case 5:
440 sprintf(retStr,"%d - FSK 2 RF/8 RF/10",id);
441 break;
442 case 6:
443 sprintf(retStr,"%d - FSK 1a RF/5 RF/8",id);
444 break;
445 case 7:
446 sprintf(retStr,"%d - FSK 2a RF/10 RF/8",id);
447 break;
448 case 8:
449 sprintf(retStr,"%d - Manschester",id);
450 break;
451 case 16:
452 sprintf(retStr,"%d - Biphase",id);
453 break;
454 case 17:
455 sprintf(retStr,"%d - Reserved",id);
456 break;
457 default:
458 sprintf(retStr,"0x%02X (Unknown)",id);
459 break;
460 }
461 return buf;
462 }
463
464
465 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
466
467 int i = start;
468 int j = len-1;
469 uint32_t tmp = 0;
470 for (; j >= 0; --j, ++i){
471 tmp |= bits[i] << j;
472 }
473 return tmp;
474 }
475
476 static command_t CommandTable[] =
477 {
478 {"help", CmdHelp, 1, "This help"},
479 {"rd", CmdReadBlk, 0, "<block> -- Read T55xx block data (page 0)"},
480 {"rdPWD", CmdReadBlkPWD, 0, "<block> <password> -- Read T55xx block data with password mode"},
481 {"wr", CmdWriteBlk, 0, "<data> <block> -- Write T55xx block data (page 0)"},
482 {"wrPWD", CmdWriteBlkPWD, 0, "<data> <block> <password> -- Write T55xx block data with password"},
483 {"trace", CmdReadTrace, 0, "[1] Read T55xx traceability data (page 1 / blk 0-1) "},
484 {"info", CmdInfo, 0, "[1] Read T55xx configuration data (page0 /blk 0)"},
485 {"dump", CmdDump, 0, "[password] Dump T55xx card block 0-7. optional with password"},
486 {"fsk", CmdIceFsk, 0, "FSK demod"},
487 {"man", CmdIceManchester, 0, "Manchester demod"},
488 {NULL, NULL, 0, NULL}
489 };
490
491 int CmdLFT55XX(const char *Cmd)
492 {
493 CmdsParse(CommandTable, Cmd);
494 return 0;
495 }
496
497 int CmdHelp(const char *Cmd)
498 {
499 CmdsHelp(CommandTable);
500 return 0;
501 }
Proxmark3 GIT tracking
Impressum, Datenschutz