]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
Fix FMCN setting so it actually matches datasheet
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include "proxusb.h"
14 #include "ui.h"
15 #include "graph.h"
16 #include "cmdparser.h"
17 #include "cmddata.h"
18 #include "cmdlf.h"
19 #include "cmdlfem4x.h"
20
21 static int CmdHelp(const char *Cmd);
22
23 /* Read the ID of an EM410x tag.
24 * Format:
25 * 1111 1111 1 <-- standard non-repeatable header
26 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
27 * ....
28 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
29 * 0 <-- stop bit, end of tag
30 */
31 int CmdEM410xRead(const char *Cmd)
32 {
33 int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
34 int parity[4];
35 char id[11];
36 int retested = 0;
37 int BitStream[MAX_GRAPH_TRACE_LEN];
38 high = low = 0;
39
40 /* Detect high and lows and clock */
41 for (i = 0; i < GraphTraceLen; i++)
42 {
43 if (GraphBuffer[i] > high)
44 high = GraphBuffer[i];
45 else if (GraphBuffer[i] < low)
46 low = GraphBuffer[i];
47 }
48
49 /* get clock */
50 clock = GetClock(Cmd, high, 0);
51
52 /* parity for our 4 columns */
53 parity[0] = parity[1] = parity[2] = parity[3] = 0;
54 header = rows = 0;
55
56 /* manchester demodulate */
57 bit = bit2idx = 0;
58 for (i = 0; i < (int)(GraphTraceLen / clock); i++)
59 {
60 hithigh = 0;
61 hitlow = 0;
62 first = 1;
63
64 /* Find out if we hit both high and low peaks */
65 for (j = 0; j < clock; j++)
66 {
67 if (GraphBuffer[(i * clock) + j] == high)
68 hithigh = 1;
69 else if (GraphBuffer[(i * clock) + j] == low)
70 hitlow = 1;
71
72 /* it doesn't count if it's the first part of our read
73 because it's really just trailing from the last sequence */
74 if (first && (hithigh || hitlow))
75 hithigh = hitlow = 0;
76 else
77 first = 0;
78
79 if (hithigh && hitlow)
80 break;
81 }
82
83 /* If we didn't hit both high and low peaks, we had a bit transition */
84 if (!hithigh || !hitlow)
85 bit ^= 1;
86
87 BitStream[bit2idx++] = bit;
88 }
89
90 retest:
91 /* We go till 5 before the graph ends because we'll get that far below */
92 for (i = 1; i < bit2idx - 5; i++)
93 {
94 /* Step 2: We have our header but need our tag ID */
95 if (header == 9 && rows < 10)
96 {
97 /* Confirm parity is correct */
98 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
99 {
100 /* Read another byte! */
101 sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
102 rows++;
103
104 /* Keep parity info */
105 parity[0] ^= BitStream[i];
106 parity[1] ^= BitStream[i+1];
107 parity[2] ^= BitStream[i+2];
108 parity[3] ^= BitStream[i+3];
109
110 /* Move 4 bits ahead */
111 i += 4;
112 }
113
114 /* Damn, something wrong! reset */
115 else
116 {
117 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
118
119 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
120 i -= 9 + (5 * rows) - 5;
121
122 rows = header = 0;
123 }
124 }
125
126 /* Step 3: Got our 40 bits! confirm column parity */
127 else if (rows == 10)
128 {
129 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
130 if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
131 BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
132 BitStream[i+4] == 0)
133 {
134 /* Sweet! */
135 PrintAndLog("EM410x Tag ID: %s", id);
136
137 /* Stop any loops */
138 return 1;
139 }
140
141 /* Crap! Incorrect parity or no stop bit, start all over */
142 else
143 {
144 rows = header = 0;
145
146 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
147 i -= 59;
148 }
149 }
150
151 /* Step 1: get our header */
152 else if (header < 9)
153 {
154 /* Need 9 consecutive 1's */
155 if (BitStream[i] == 1)
156 header++;
157
158 /* We don't have a header, not enough consecutive 1 bits */
159 else
160 header = 0;
161 }
162 }
163
164 /* if we've already retested after flipping bits, return */
165 if (retested++)
166 return 0;
167
168 /* if this didn't work, try flipping bits */
169 for (i = 0; i < bit2idx; i++)
170 BitStream[i] ^= 1;
171
172 goto retest;
173 }
174
175 /* emulate an EM410X tag
176 * Format:
177 * 1111 1111 1 <-- standard non-repeatable header
178 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
179 * ....
180 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
181 * 0 <-- stop bit, end of tag
182 */
183 int CmdEM410xSim(const char *Cmd)
184 {
185 int i, n, j, h, binary[4], parity[4];
186
187 /* clock is 64 in EM410x tags */
188 int clock = 64;
189
190 /* clear our graph */
191 ClearGraph(0);
192
193 /* write it out a few times */
194 for (h = 0; h < 4; h++)
195 {
196 /* write 9 start bits */
197 for (i = 0; i < 9; i++)
198 AppendGraph(0, clock, 1);
199
200 /* for each hex char */
201 parity[0] = parity[1] = parity[2] = parity[3] = 0;
202 for (i = 0; i < 10; i++)
203 {
204 /* read each hex char */
205 sscanf(&Cmd[i], "%1x", &n);
206 for (j = 3; j >= 0; j--, n/= 2)
207 binary[j] = n % 2;
208
209 /* append each bit */
210 AppendGraph(0, clock, binary[0]);
211 AppendGraph(0, clock, binary[1]);
212 AppendGraph(0, clock, binary[2]);
213 AppendGraph(0, clock, binary[3]);
214
215 /* append parity bit */
216 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
217
218 /* keep track of column parity */
219 parity[0] ^= binary[0];
220 parity[1] ^= binary[1];
221 parity[2] ^= binary[2];
222 parity[3] ^= binary[3];
223 }
224
225 /* parity columns */
226 AppendGraph(0, clock, parity[0]);
227 AppendGraph(0, clock, parity[1]);
228 AppendGraph(0, clock, parity[2]);
229 AppendGraph(0, clock, parity[3]);
230
231 /* stop bit */
232 AppendGraph(0, clock, 0);
233 }
234
235 /* modulate that biatch */
236 CmdManchesterMod("");
237
238 /* booyah! */
239 RepaintGraphWindow();
240
241 CmdLFSim("");
242 return 0;
243 }
244
245 /* Function is equivalent of loread + losamples + em410xread
246 * looped until an EM410x tag is detected */
247 int CmdEM410xWatch(const char *Cmd)
248 {
249 do
250 {
251 CmdLFRead("");
252 CmdSamples("2000");
253 } while ( ! CmdEM410xRead(""));
254 return 0;
255 }
256
257 /* Read the transmitted data of an EM4x50 tag
258 * Format:
259 *
260 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
261 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
262 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
263 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
264 * CCCCCCCC <- column parity bits
265 * 0 <- stop bit
266 * LW <- Listen Window
267 *
268 * This pattern repeats for every block of data being transmitted.
269 * Transmission starts with two Listen Windows (LW - a modulated
270 * pattern of 320 cycles each (32/32/128/64/64)).
271 *
272 * Note that this data may or may not be the UID. It is whatever data
273 * is stored in the blocks defined in the control word First and Last
274 * Word Read values. UID is stored in block 32.
275 */
276 int CmdEM4x50Read(const char *Cmd)
277 {
278 int i, j, startblock, clock, skip, block, start, end, low, high;
279 bool complete= false;
280 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
281 char tmp[6];
282
283 high= low= 0;
284 clock= 64;
285 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
286
287 /* first get high and low values */
288 for (i = 0; i < GraphTraceLen; i++)
289 {
290 if (GraphBuffer[i] > high)
291 high = GraphBuffer[i];
292 else if (GraphBuffer[i] < low)
293 low = GraphBuffer[i];
294 }
295
296 /* populate a buffer with pulse lengths */
297 i= 0;
298 j= 0;
299 while (i < GraphTraceLen)
300 {
301 // measure from low to low
302 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
303 ++i;
304 start= i;
305 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
306 ++i;
307 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
308 ++i;
309 if (j>(MAX_GRAPH_TRACE_LEN/64)) {
310 break;
311 }
312 tmpbuff[j++]= i - start;
313 }
314
315 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
316 start= -1;
317 skip= 0;
318 for (i= 0; i < j - 4 ; ++i)
319 {
320 skip += tmpbuff[i];
321 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
322 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
323 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
324 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
325 {
326 start= i + 3;
327 break;
328 }
329 }
330 startblock= i + 3;
331
332 /* skip over the remainder of the LW */
333 skip += tmpbuff[i+1]+tmpbuff[i+2];
334 while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
335 ++skip;
336 skip += 8;
337
338 /* now do it again to find the end */
339 end= start;
340 for (i += 3; i < j - 4 ; ++i)
341 {
342 end += tmpbuff[i];
343 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
344 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
345 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
346 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
347 {
348 complete= true;
349 break;
350 }
351 }
352
353 if (start >= 0)
354 PrintAndLog("Found data at sample: %i",skip);
355 else
356 {
357 PrintAndLog("No data found!");
358 PrintAndLog("Try again with more samples.");
359 return 0;
360 }
361
362 if (!complete)
363 {
364 PrintAndLog("*** Warning!");
365 PrintAndLog("Partial data - no end found!");
366 PrintAndLog("Try again with more samples.");
367 }
368
369 /* get rid of leading crap */
370 sprintf(tmp,"%i",skip);
371 CmdLtrim(tmp);
372
373 /* now work through remaining buffer printing out data blocks */
374 block= 0;
375 i= startblock;
376 while (block < 6)
377 {
378 PrintAndLog("Block %i:", block);
379 // mandemod routine needs to be split so we can call it for data
380 // just print for now for debugging
381 CmdManchesterDemod("i 64");
382 skip= 0;
383 /* look for LW before start of next block */
384 for ( ; i < j - 4 ; ++i)
385 {
386 skip += tmpbuff[i];
387 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
388 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
389 break;
390 }
391 while (GraphBuffer[skip] > low)
392 ++skip;
393 skip += 8;
394 sprintf(tmp,"%i",skip);
395 CmdLtrim(tmp);
396 start += skip;
397 block++;
398 }
399 return 0;
400 }
401
402 static command_t CommandTable[] =
403 {
404 {"help", CmdHelp, 1, "This help"},
405 {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
406 {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
407 {"em410xwatch", CmdEM410xWatch, 0, "Watches for EM410x tags"},
408 {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
409 {NULL, NULL, 0, NULL}
410 };
411
412 int CmdLFEM4X(const char *Cmd)
413 {
414 CmdsParse(CommandTable, Cmd);
415 return 0;
416 }
417
418 int CmdHelp(const char *Cmd)
419 {
420 CmdsHelp(CommandTable);
421 return 0;
422 }
Impressum, Datenschutz