git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency T55xx commands
   8 //-----------------------------------------------------------------------------
   9
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <inttypes.h>
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdmain.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"
  19 #include "cmdlf.h"
  20 #include "cmdlft55xx.h"
  21 #include "util.h"
  22 #include "data.h"
  23 #include "lfdemod.h"
  24
  25
  26 #define LF_TRACE_BUFF_SIZE 20000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)
  27 #define LF_BITSSTREAM_LEN 1000 // more then 1000 bits shouldn't happend..  8block * 4 bytes * 8bits =
  28 static int CmdHelp(const char *Cmd);
  29
  30 // int CmdReadBlk(const char *Cmd)
  31 // {
  32         // int block = -1;
  33         // sscanf(Cmd, "%d", &block);
  34
  35         // if ((block > 7) | (block < 0)) {
  36                 // PrintAndLog("Block must be between 0 and 7");
  37                 // return 1;
  38         // }
  39
  40         // UsbCommand c;
  41         // c.cmd = CMD_T55XX_READ_BLOCK;
  42         // c.d.asBytes[0] = 0x00;
  43         // c.arg[0] = 0;
  44         // c.arg[1] = block;
  45         // c.arg[2] = 0;
  46         // SendCommand(&c);
  47         // WaitForResponse(CMD_ACK, NULL);
  48
  49         // uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  50
  51         // GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
  52         // WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  53
  54         // for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  55                 // GraphBuffer[j] = (int)data[j];
  56         // }
  57         // GraphTraceLen = LF_TRACE_BUFF_SIZE;
  58         // ManchesterDemod(block);
  59         // RepaintGraphWindow();
  60   // return 0;
  61 // }
  62
  63 int CmdReadBlk(const char *Cmd)
  64 {
  65         int invert = 0;
  66         int clk = 0;
  67         int block = -1;
  68         uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};
  69
  70         sscanf(Cmd, "%d", &block);
  71
  72         if ((block > 7) | (block < 0)) {
  73                 PrintAndLog("Block must be between 0 and 7");
  74                 return 1;
  75         }
  76
  77         UsbCommand c = { CMD_T55XX_READ_BLOCK, { 0, block, 0 } };
  78         SendCommand(&c);
  79         if ( !WaitForResponseTimeout(CMD_ACK,NULL,1500) ) {
  80                 PrintAndLog("command execution time out");
  81                 return 1;
  82         }
  83
  84         CmdSamples("");
  85
  86         size_t bitlen = getFromGraphBuf(bits);
  87
  88         int errCnt = askrawdemod(bits, &bitlen, &clk, &invert);
  89
  90         //throw away static - allow 1 and -1 (in case of threshold command first)
  91         if ( errCnt == -1 || bitlen < 16 ){
  92                 PrintAndLog("no data found");
  93                 if (g_debugMode)
  94                         PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
  95                 return 0;
  96         }
  97         if (g_debugMode)
  98                 PrintAndLog("Using Clock: %d - invert: %d - Bits Found: %d", clk, invert, bitlen);
  99
 100         //move bits back to DemodBuffer
 101         setDemodBuf(bits, bitlen, 0);
 102         printBitStream(bits,bitlen);
 103         return 0;
 104 }
 105
 106 int CmdReadBlkPWD(const char *Cmd)
 107 {
 108         int Block = -1; //default to invalid block
 109         int Password = 0xFFFFFFFF; //default to blank Block 7
 110
 111
 112         sscanf(Cmd, "%d %x", &Block, &Password);
 113
 114         if ((Block > 7) | (Block < 0)) {
 115                 PrintAndLog("Block must be between 0 and 7");
 116                 return 1;
 117         }
 118
 119         PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
 120
 121         UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, Block, Password} };
 122         c.d.asBytes[0] = 0x1; //Password mode
 123         SendCommand(&c);
 124         WaitForResponse(CMD_ACK, NULL);
 125
 126         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 127
 128         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);
 129         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 130
 131         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 132                 GraphBuffer[j] = ((int)data[j]);
 133         }
 134         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 135         ManchesterDemod(Block);
 136
 137         RepaintGraphWindow();
 138   return 0;
 139 }
 140
 141 int CmdWriteBlk(const char *Cmd)
 142 {
 143   int Block = 8; //default to invalid block
 144   int Data = 0xFFFFFFFF; //default to blank Block
 145
 146         sscanf(Cmd, "%d %x", &Block, &Data);
 147
 148   if (Block > 7) {
 149         PrintAndLog("Block must be between 0 and 7");
 150         return 1;
 151   }
 152
 153         PrintAndLog("Writing block %d  data %08X", Block, Data);
 154
 155         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {Data, Block, 0}};
 156   c.d.asBytes[0] = 0x0; //Normal mode
 157   SendCommand(&c);
 158   return 0;
 159 }
 160
 161 int CmdWriteBlkPWD(const char *Cmd)
 162 {
 163   int Block = 8; //default to invalid block
 164   int Data = 0xFFFFFFFF; //default to blank Block
 165   int Password = 0xFFFFFFFF; //default to blank Block 7
 166
 167
 168         sscanf(Cmd, "%d %x %x",&Block, &Data, &Password);
 169
 170   if (Block > 7) {
 171         PrintAndLog("Block must be between 0 and 7");
 172         return 1;
 173   }
 174
 175         PrintAndLog("Writing block %d  data %08X  password %08X", Block, Data, Password);
 176
 177         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {Data, Block, Password}};
 178   c.d.asBytes[0] = 0x1; //Password mode
 179   SendCommand(&c);
 180   return 0;
 181 }
 182
 183 int CmdReadTrace(const char *Cmd)
 184 {
 185         char cmdp = param_getchar(Cmd, 0);
 186
 187         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 188                 PrintAndLog("Usage:  lf t55xx trace  [use data from Graphbuffer]");
 189                 PrintAndLog("     [use data from Graphbuffer], if not set, try reading data from tag.");
 190                 PrintAndLog("");
 191                 PrintAndLog("     sample: lf t55xx trace");
 192                 PrintAndLog("           : lf t55xx trace 1");
 193                 return 0;
 194         }
 195
 196         if ( strlen(Cmd)==0){
 197
 198                 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
 199                 SendCommand(&c);
 200                 WaitForResponse(CMD_ACK, NULL);
 201
 202                 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 203
 204                 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
 205                 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 206
 207                 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 208                         GraphBuffer[j] = ((int)data[j]);
 209                 }
 210                 GraphTraceLen = LF_TRACE_BUFF_SIZE;
 211         }
 212
 213         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 214         uint8_t * bitstream = bits;
 215
 216         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
 217         RepaintGraphWindow();
 218
 219         uint8_t si = 5;
 220         uint32_t bl0     = PackBits(si, 32, bitstream);
 221         uint32_t bl1     = PackBits(si+32, 32, bitstream);
 222
 223         uint32_t acl     = PackBits(si,  8, bitstream); si += 8;
 224         uint32_t mfc     = PackBits(si, 8, bitstream); si += 8;
 225         uint32_t cid     = PackBits(si, 5, bitstream); si += 5;
 226         uint32_t icr     = PackBits(si, 3, bitstream); si += 3;
 227         uint32_t year    = PackBits(si, 4, bitstream); si += 4;
 228         uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
 229         uint32_t lotid    = PackBits(si, 12, bitstream); si += 12;
 230         uint32_t wafer   = PackBits(si, 5, bitstream); si += 5;
 231         uint32_t dw      = PackBits(si, 15, bitstream);
 232
 233         PrintAndLog("");
 234         PrintAndLog("-- T55xx Trace Information ----------------------------------");
 235         PrintAndLog("-------------------------------------------------------------");
 236         PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1)  : 0x%02X (%d)", acl, acl);
 237         PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x%02X (%d)", mfc, mfc);
 238         PrintAndLog(" CID                                     : 0x%02X (%d)", cid, cid);
 239         PrintAndLog(" ICR IC Revision                         : %d",icr );
 240         PrintAndLog(" Manufactured");
 241         PrintAndLog("     Year/Quarter : %d/%d",2000+year, quarter );
 242         PrintAndLog("     Lot ID       : %d", lotid );
 243         PrintAndLog("     Wafer number : %d", wafer);
 244         PrintAndLog("     Die Number   : %d", dw);
 245         PrintAndLog("-------------------------------------------------------------");
 246         PrintAndLog(" Raw Data - Page 1");
 247         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bitstream+5,32) );
 248         PrintAndLog("     Block 0  : 0x%08X  %s", bl1, sprint_bin(bitstream+37,32) );
 249         PrintAndLog("-------------------------------------------------------------");
 250         /*
 251         TRACE - BLOCK O
 252                 Bits    Definition                                                              HEX
 253                 1-8             ACL Allocation class (ISO/IEC 15963-1)  0xE0
 254                 9-16    MFC Manufacturer ID (ISO/IEC 7816-6)    0x15 Atmel Corporation
 255                 17-21   CID                                                                             0x1 = Atmel ATA5577M1  0x2 = Atmel ATA5577M2
 256                 22-24   ICR IC revision
 257                 25-28   YEAR (BCD encoded)                                              9 (= 2009)
 258                 29-30   QUARTER                                                                 1,2,3,4
 259                 31-32   LOT ID
 260
 261         TRACE - BLOCK 1
 262                 1-12    LOT ID
 263                 13-17   Wafer number
 264                 18-32   DW,  die number sequential
 265         */
 266
 267   return 0;
 268 }
 269
 270 int CmdInfo(const char *Cmd){
 271         /*
 272                 Page 0 Block 0 Configuration data.
 273                 Normal mode
 274                 Extended mode
 275         */
 276         char cmdp = param_getchar(Cmd, 0);
 277
 278         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 279                 PrintAndLog("Usage:  lf t55xx info  [use data from Graphbuffer]");
 280                 PrintAndLog("     [use data from Graphbuffer], if not set, try reading data from tag.");
 281                 PrintAndLog("");
 282                 PrintAndLog("    sample: lf t55xx info");
 283                 PrintAndLog("    sample: lf t55xx info 1");
 284                 return 0;
 285         }
 286
 287         if ( strlen(Cmd) == 0 ){
 288                 CmdReadBlk("0");
 289         }
 290
 291         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 292
 293         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
 294
 295         uint8_t si = 5;
 296         uint32_t bl0      = PackBits(si, 32, bits);
 297
 298         uint32_t safer    = PackBits(si, 4, bits); si += 4;
 299         uint32_t resv     = PackBits(si, 7, bits); si += 7;
 300         uint32_t dbr      = PackBits(si, 3, bits); si += 3;
 301         uint32_t extend   = PackBits(si, 1, bits); si += 1;
 302         uint32_t datamodulation   = PackBits(si, 5, bits); si += 5;
 303         uint32_t pskcf    = PackBits(si, 2, bits); si += 2;
 304         uint32_t aor      = PackBits(si, 1, bits); si += 1;
 305         uint32_t otp      = PackBits(si, 1, bits); si += 1;
 306         uint32_t maxblk   = PackBits(si, 3, bits); si += 3;
 307         uint32_t pwd      = PackBits(si, 1, bits); si += 1;
 308         uint32_t sst      = PackBits(si, 1, bits); si += 1;
 309         uint32_t fw       = PackBits(si, 1, bits); si += 1;
 310         uint32_t inv      = PackBits(si, 1, bits); si += 1;
 311         uint32_t por      = PackBits(si, 1, bits); si += 1;
 312
 313         PrintAndLog("");
 314         PrintAndLog("-- T55xx Configuration & Tag Information --------------------");
 315         PrintAndLog("-------------------------------------------------------------");
 316         PrintAndLog(" Safer key                 : %s", GetSaferStr(safer));
 317         PrintAndLog(" reserved                  : %d", resv);
 318         PrintAndLog(" Data bit rate             : %s", GetBitRateStr(dbr));
 319         PrintAndLog(" eXtended mode             : %s", (extend) ? "Yes - Warning":"No");
 320         PrintAndLog(" Modulation                : %s", GetModulationStr(datamodulation) );
 321         PrintAndLog(" PSK clock freq            : %d", pskcf);
 322         PrintAndLog(" AOR - Answer on Request   : %s", (aor) ? "Yes":"No");
 323         PrintAndLog(" OTP - One Time Pad        : %s", (otp) ? "Yes - Warning":"No" );
 324         PrintAndLog(" Max block                 : %d", maxblk);
 325         PrintAndLog(" Password mode             : %s", (pwd) ? "Yes":"No");
 326         PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
 327         PrintAndLog(" Fast Write                : %s", (fw) ? "Yes":"No");
 328         PrintAndLog(" Inverse data              : %s", (inv) ? "Yes":"No");
 329         PrintAndLog(" POR-Delay                 : %s", (por) ? "Yes":"No");
 330         PrintAndLog("-------------------------------------------------------------");
 331         PrintAndLog(" Raw Data - Page 0");
 332         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bits+5,32) );
 333         PrintAndLog("-------------------------------------------------------------");
 334
 335         return 0;
 336 }
 337
 338 int CmdDump(const char *Cmd){
 339
 340         char cmdp = param_getchar(Cmd, 0);
 341         char s[20];
 342         uint8_t pwd[4] = {0x00};
 343         bool hasPwd = ( strlen(Cmd) > 0);
 344
 345         if ( cmdp == 'h' || cmdp == 'H') {
 346                 PrintAndLog("Usage:  lf t55xx dump <password>");
 347                 PrintAndLog("        sample: lf t55xx dump FFFFFFFF");
 348                 return 0;
 349         }
 350
 351         if ( hasPwd ){
 352                 if (param_gethex(Cmd, 0, pwd, 8)) {
 353                         PrintAndLog("password must include 8 HEX symbols");
 354                         return 1;
 355                 }
 356         }
 357
 358         for ( int i = 0; i <8; ++i){
 359                 memset(s,0,sizeof(s));
 360                 if ( hasPwd ) {
 361                         sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
 362                         CmdReadBlkPWD(s);
 363                 } else {
 364                         sprintf(s,"%d", i);
 365                         CmdReadBlk(s);
 366                 }
 367         }
 368         return 0;
 369 }
 370
 371 int CmdIceFsk(const char *Cmd){
 372
 373         if (!HasGraphData()) return 0;
 374
 375         iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
 376         RepaintGraphWindow();
 377         return 0;
 378 }
 379 int CmdIceManchester(const char *Cmd){
 380         ManchesterDemod( -1);
 381         return 0;
 382 }
 383 int ManchesterDemod(int blockNum){
 384
 385         if (!HasGraphData()) return 0;
 386
 387         uint8_t sizebyte = 32;
 388         // the value 5 was selected during empirical studies of the decoded data. Some signal noise to skip.
 389         uint8_t offset = 5;
 390         uint32_t blockData;
 391         uint8_t  bits[LF_BITSSTREAM_LEN] = {0x00};
 392         uint8_t * bitstream = bits;
 393
 394         //manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
 395         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
 396     //blockData = PackBits(offset, sizebyte, bitstream);
 397         blockData = PackBits(offset, sizebyte, bits);
 398
 399         if ( blockNum < 0)
 400                 PrintAndLog(" Decoded     : 0x%08X  %s", blockData, sprint_bin(bitstream+offset,sizebyte) );
 401                 else
 402                 PrintAndLog(" Block %d    : 0x%08X  %s", blockNum, blockData, sprint_bin(bitstream+offset,sizebyte) );
 403
 404         return 0;
 405 }
 406
 407 char * GetBitRateStr(uint32_t id){
 408         static char buf[40];
 409         char *retStr = buf;
 410                 switch (id){
 411                 case 0:
 412                         sprintf(retStr,"%d - RF/8",id);
 413                         break;
 414                 case 1:
 415                         sprintf(retStr,"%d - RF/16",id);
 416                         break;
 417                 case 2:
 418                         sprintf(retStr,"%d - RF/32",id);
 419                         break;
 420                 case 3:
 421                         sprintf(retStr,"%d - RF/40",id);
 422                         break;
 423                 case 4:
 424                         sprintf(retStr,"%d - RF/50",id);
 425                         break;
 426                 case 5:
 427                         sprintf(retStr,"%d - RF/64",id);
 428                         break;
 429                 case 6:
 430                         sprintf(retStr,"%d - RF/100",id);
 431                         break;
 432                 case 7:
 433                         sprintf(retStr,"%d - RF/128",id);
 434                         break;
 435                 default:
 436                         sprintf(retStr,"%d - (Unknown)",id);
 437                         break;
 438                 }
 439
 440         return buf;
 441 }
 442
 443 char * GetSaferStr(uint32_t id){
 444         static char buf[40];
 445         char *retStr = buf;
 446
 447         sprintf(retStr,"%d",id);
 448         if (id == 6) {
 449                 sprintf(retStr,"%d - pasdwd",id);
 450         }
 451         if (id == 9 ){
 452                 sprintf(retStr,"%d - testmode ",id);
 453         }
 454
 455         return buf;
 456 }
 457 char * GetModulationStr( uint32_t id){
 458         static char buf[40];
 459         char *retStr = buf;
 460
 461         switch (id){
 462                 case 0:
 463                         sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
 464                         break;
 465                 case 1:
 466                         sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
 467                         break;
 468                 case 2:
 469                         sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
 470                         break;
 471                 case 3:
 472                         sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
 473                         break;
 474                 case 4:
 475                         sprintf(retStr,"%d - FSK 1 RF/8  RF/5",id);
 476                         break;
 477                 case 5:
 478                         sprintf(retStr,"%d - FSK 2 RF/8  RF/10",id);
 479                         break;
 480                 case 6:
 481                         sprintf(retStr,"%d - FSK 1a RF/5  RF/8",id);
 482                         break;
 483                 case 7:
 484                         sprintf(retStr,"%d - FSK 2a RF/10  RF/8",id);
 485                         break;
 486                 case 8:
 487                         sprintf(retStr,"%d - Manschester",id);
 488                         break;
 489                 case 16:
 490                         sprintf(retStr,"%d - Biphase",id);
 491                         break;
 492                 case 17:
 493                         sprintf(retStr,"%d - Reserved",id);
 494                         break;
 495                 default:
 496                         sprintf(retStr,"0x%02X (Unknown)",id);
 497                         break;
 498                 }
 499         return buf;
 500 }
 501
 502
 503 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
 504
 505         int i = start;
 506         int j = len-1;
 507         if (len > 32) {
 508                 return 0;
 509         }
 510         uint32_t tmp = 0;
 511         for (; j >= 0; --j, ++i){
 512                 tmp     |= bits[i] << j;
 513         }
 514         return tmp;
 515 }
 516
 517 static command_t CommandTable[] =
 518 {
 519   {"help",   CmdHelp,        1, "This help"},
 520   {"rd",     CmdReadBlk,     0, "<block> -- Read T55xx block data (page 0)"},
 521   {"rdpwd",  CmdReadBlkPWD,  0, "<block> <password> -- Read T55xx block data with password mode"},
 522   {"wr",     CmdWriteBlk,    0, "<block> <data> -- Write T55xx block data (page 0)"},
 523   {"wrpwd",  CmdWriteBlkPWD, 0, "<block> <password> <data> -- Write T55xx block data with password"},
 524   {"trace",  CmdReadTrace,   0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},
 525   {"info",   CmdInfo,        0, "[1] Read T55xx configuration data (page 0/ blk 0)"},
 526   {"dump",   CmdDump,        0, "[password] Dump T55xx card block 0-7. optional with password"},
 527   {"fsk",    CmdIceFsk,      0, "FSK demod"},
 528   {"man",    CmdIceManchester,      0, "Manchester demod (with SST)"},
 529   {NULL, NULL, 0, NULL}
 530 };
 531
 532 int CmdLFT55XX(const char *Cmd)
 533 {
 534   CmdsParse(CommandTable, Cmd);
 535   return 0;
 536 }
 537
 538 int CmdHelp(const char *Cmd)
 539 {
 540   CmdsHelp(CommandTable);
 541   return 0;
 542 }