1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
19 #include "cmdparser.h"
25 #include "cmdlfem4x.h"
26 #include "cmdlfhitag.h"
27 #include "cmdlft55xx.h"
28 #include "cmdlfpcf7931.h"
30 static int CmdHelp(const char *Cmd
);
32 /* send a command before reading */
33 int CmdLFCommandRead(const char *Cmd
)
39 UsbCommand c
= {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
};
40 sscanf(Cmd
, "%i %i %i %s %s", &c
.arg
[0], &c
.arg
[1], &c
.arg
[2], (char *) &c
.d
.asBytes
,(char *) &dummy
+1);
41 // in case they specified 'h'
42 strcpy((char *)&c
.d
.asBytes
+ strlen((char *)c
.d
.asBytes
), dummy
);
47 int CmdFlexdemod(const char *Cmd
)
50 for (i
= 0; i
< GraphTraceLen
; ++i
) {
51 if (GraphBuffer
[i
] < 0) {
60 for (start
= 0; start
< GraphTraceLen
- LONG_WAIT
; start
++) {
61 int first
= GraphBuffer
[start
];
62 for (i
= start
; i
< start
+ LONG_WAIT
; i
++) {
63 if (GraphBuffer
[i
] != first
) {
67 if (i
== (start
+ LONG_WAIT
)) {
71 if (start
== GraphTraceLen
- LONG_WAIT
) {
72 PrintAndLog("nothing to wait for");
76 GraphBuffer
[start
] = 2;
77 GraphBuffer
[start
+1] = -2;
83 for (bit
= 0; bit
< 64; bit
++) {
86 for (j
= 0; j
< 16; j
++) {
87 sum
+= GraphBuffer
[i
++];
94 PrintAndLog("bit %d sum %d", bit
, sum
);
97 for (bit
= 0; bit
< 64; bit
++) {
100 for (j
= 0; j
< 16; j
++) {
101 sum
+= GraphBuffer
[i
++];
103 if (sum
> 0 && bits
[bit
] != 1) {
104 PrintAndLog("oops1 at %d", bit
);
106 if (sum
< 0 && bits
[bit
] != 0) {
107 PrintAndLog("oops2 at %d", bit
);
111 GraphTraceLen
= 32*64;
114 for (bit
= 0; bit
< 64; bit
++) {
115 if (bits
[bit
] == 0) {
121 for (j
= 0; j
< 32; j
++) {
122 GraphBuffer
[i
++] = phase
;
127 RepaintGraphWindow();
131 int CmdIndalaDemod(const char *Cmd
)
133 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
138 // worst case with GraphTraceLen=64000 is < 4096
139 // under normal conditions it's < 2048
140 uint8_t rawbits
[4096];
142 int worst
= 0, worstPos
= 0;
143 PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen
/ 32);
144 for (i
= 0; i
< GraphTraceLen
-1; i
+= 2) {
146 if ((GraphBuffer
[i
] > GraphBuffer
[i
+ 1]) && (state
!= 1)) {
148 for (j
= 0; j
< count
- 8; j
+= 16) {
149 rawbits
[rawbit
++] = 0;
151 if ((abs(count
- j
)) > worst
) {
152 worst
= abs(count
- j
);
158 } else if ((GraphBuffer
[i
] < GraphBuffer
[i
+ 1]) && (state
!= 0)) {
160 for (j
= 0; j
< count
- 8; j
+= 16) {
161 rawbits
[rawbit
++] = 1;
163 if ((abs(count
- j
)) > worst
) {
164 worst
= abs(count
- j
);
172 PrintAndLog("Recovered %d raw bits", rawbit
);
173 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst
, worstPos
);
175 // Finding the start of a UID
176 int uidlen
, long_wait
;
177 if (strcmp(Cmd
, "224") == 0) {
186 for (start
= 0; start
<= rawbit
- uidlen
; start
++) {
187 first
= rawbits
[start
];
188 for (i
= start
; i
< start
+ long_wait
; i
++) {
189 if (rawbits
[i
] != first
) {
193 if (i
== (start
+ long_wait
)) {
197 if (start
== rawbit
- uidlen
+ 1) {
198 PrintAndLog("nothing to wait for");
202 // Inverting signal if needed
204 for (i
= start
; i
< rawbit
; i
++) {
205 rawbits
[i
] = !rawbits
[i
];
212 showbits
[uidlen
]='\0';
216 if (uidlen
> rawbit
) {
217 PrintAndLog("Warning: not enough raw bits to get a full UID");
218 for (bit
= 0; bit
< rawbit
; bit
++) {
219 bits
[bit
] = rawbits
[i
++];
220 // As we cannot know the parity, let's use "." and "/"
221 showbits
[bit
] = '.' + bits
[bit
];
223 showbits
[bit
+1]='\0';
224 PrintAndLog("Partial UID=%s", showbits
);
227 for (bit
= 0; bit
< uidlen
; bit
++) {
228 bits
[bit
] = rawbits
[i
++];
229 showbits
[bit
] = '0' + bits
[bit
];
235 uint32_t uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
240 for( idx
=0; idx
<64; idx
++) {
241 if (showbits
[idx
] == '0') {
242 uid1
=(uid1
<<1)|(uid2
>>31);
245 uid1
=(uid1
<<1)|(uid2
>>31);
249 PrintAndLog("UID=%s (%x%08x)", showbits
, uid1
, uid2
);
257 for( idx
=0; idx
<224; idx
++) {
258 uid1
=(uid1
<<1)|(uid2
>>31);
259 uid2
=(uid2
<<1)|(uid3
>>31);
260 uid3
=(uid3
<<1)|(uid4
>>31);
261 uid4
=(uid4
<<1)|(uid5
>>31);
262 uid5
=(uid5
<<1)|(uid6
>>31);
263 uid6
=(uid6
<<1)|(uid7
>>31);
264 if (showbits
[idx
] == '0') uid7
=(uid7
<<1)|0;
265 else uid7
=(uid7
<<1)|1;
267 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits
, uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
270 // Checking UID against next occurences
271 for (; i
+ uidlen
<= rawbit
;) {
273 for (bit
= 0; bit
< uidlen
; bit
++) {
274 if (bits
[bit
] != rawbits
[i
++]) {
284 PrintAndLog("Occurences: %d (expected %d)", times
, (rawbit
- start
) / uidlen
);
286 // Remodulating for tag cloning
287 GraphTraceLen
= 32*uidlen
;
290 for (bit
= 0; bit
< uidlen
; bit
++) {
291 if (bits
[bit
] == 0) {
297 for (j
= 0; j
< 32; j
++) {
298 GraphBuffer
[i
++] = phase
;
303 RepaintGraphWindow();
307 int CmdIndalaClone(const char *Cmd
)
309 unsigned int uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
320 if (strchr(Cmd
,'l') != 0) {
321 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
322 uid1
= (uid1
<< 4) | (uid2
>> 28);
323 uid2
= (uid2
<< 4) | (uid3
>> 28);
324 uid3
= (uid3
<< 4) | (uid4
>> 28);
325 uid4
= (uid4
<< 4) | (uid5
>> 28);
326 uid5
= (uid5
<< 4) | (uid6
>> 28);
327 uid6
= (uid6
<< 4) | (uid7
>> 28);
328 uid7
= (uid7
<< 4) | (n
& 0xf);
330 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
331 c
.cmd
= CMD_INDALA_CLONE_TAG_L
;
332 c
.d
.asDwords
[0] = uid1
;
333 c
.d
.asDwords
[1] = uid2
;
334 c
.d
.asDwords
[2] = uid3
;
335 c
.d
.asDwords
[3] = uid4
;
336 c
.d
.asDwords
[4] = uid5
;
337 c
.d
.asDwords
[5] = uid6
;
338 c
.d
.asDwords
[6] = uid7
;
342 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
343 uid1
= (uid1
<< 4) | (uid2
>> 28);
344 uid2
= (uid2
<< 4) | (n
& 0xf);
346 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1
, uid2
);
347 c
.cmd
= CMD_INDALA_CLONE_TAG
;
356 int CmdLFRead(const char *Cmd
)
358 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
};
359 // 'h' means higher-low-frequency, 134 kHz
362 } else if (*Cmd
== '\0') {
365 PrintAndLog("use 'read' or 'read h'");
369 WaitForResponse(CMD_ACK
);
373 static void ChkBitstream(const char *str
)
377 /* convert to bitstream if necessary */
378 for (i
= 0; i
< (int)(GraphTraceLen
/ 2); i
++)
380 if (GraphBuffer
[i
] > 1 || GraphBuffer
[i
] < 0)
388 int CmdLFSim(const char *Cmd
)
393 sscanf(Cmd
, "%i", &gap
);
395 /* convert to bitstream if necessary */
398 PrintAndLog("Sending data, please wait...");
399 for (i
= 0; i
< GraphTraceLen
; i
+= 48) {
400 UsbCommand c
={CMD_DOWNLOADED_SIM_SAMPLES_125K
, {i
, 0, 0}};
402 for (j
= 0; j
< 48; j
++) {
403 c
.d
.asBytes
[j
] = GraphBuffer
[i
+j
];
406 WaitForResponse(CMD_ACK
);
409 PrintAndLog("Starting simulator...");
410 UsbCommand c
= {CMD_SIMULATE_TAG_125K
, {GraphTraceLen
, gap
, 0}};
415 int CmdLFSimBidir(const char *Cmd
)
417 /* Set ADC to twice the carrier for a slight supersampling */
418 UsbCommand c
= {CMD_LF_SIMULATE_BIDIR
, {47, 384, 0}};
423 /* simulate an LF Manchester encoded tag with specified bitstream, clock rate and inter-id gap */
424 int CmdLFSimManchester(const char *Cmd
)
426 static int clock
, gap
;
427 static char data
[1024], gapstring
[8];
429 /* get settings/bits */
430 sscanf(Cmd
, "%i %s %i", &clock
, &data
[0], &gap
);
432 /* clear our graph */
435 /* fill it with our bitstream */
436 for (int i
= 0; i
< strlen(data
) ; ++i
)
437 AppendGraph(0, clock
, data
[i
]- '0');
440 CmdManchesterMod("");
442 /* show what we've done */
443 RepaintGraphWindow();
446 sprintf(&gapstring
[0], "%i", gap
);
451 int CmdVchDemod(const char *Cmd
)
453 // Is this the entire sync pattern, or does this also include some
454 // data bits that happen to be the same everywhere? That would be
456 static const int SyncPattern
[] = {
457 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
458 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
459 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
460 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
461 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
462 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
463 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
464 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
465 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
466 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
469 // So first, we correlate for the sync pattern, and mark that.
470 int bestCorrel
= 0, bestPos
= 0;
472 // It does us no good to find the sync pattern, with fewer than
473 // 2048 samples after it...
474 for (i
= 0; i
< (GraphTraceLen
-2048); i
++) {
477 for (j
= 0; j
< arraylen(SyncPattern
); j
++) {
478 sum
+= GraphBuffer
[i
+j
]*SyncPattern
[j
];
480 if (sum
> bestCorrel
) {
485 PrintAndLog("best sync at %d [metric %d]", bestPos
, bestCorrel
);
493 for (i
= 0; i
< 2048; i
+= 8) {
496 for (j
= 0; j
< 8; j
++) {
497 sum
+= GraphBuffer
[bestPos
+i
+j
];
504 if(abs(sum
) < worst
) {
509 PrintAndLog("bits:");
510 PrintAndLog("%s", bits
);
511 PrintAndLog("worst metric: %d at pos %d", worst
, worstPos
);
513 if (strcmp(Cmd
, "clone")==0) {
516 for(s
= bits
; *s
; s
++) {
518 for(j
= 0; j
< 16; j
++) {
519 GraphBuffer
[GraphTraceLen
++] = (*s
== '1') ? 1 : 0;
522 RepaintGraphWindow();
527 static command_t CommandTable
[] =
529 {"help", CmdHelp
, 1, "This help"},
530 {"cmdread", CmdLFCommandRead
, 0, "<off period> <'0' period> <'1' period> <command> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)"},
531 {"em4x", CmdLFEM4X
, 1, "{ EM4X RFIDs... }"},
532 {"flexdemod", CmdFlexdemod
, 1, "Demodulate samples for FlexPass"},
533 {"hid", CmdLFHID
, 1, "{ HID RFIDs... }"},
534 {"indalademod", CmdIndalaDemod
, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
535 {"indalaclone", CmdIndalaClone
, 1, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
536 {"read", CmdLFRead
, 0, "['h'] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134)"},
537 {"sim", CmdLFSim
, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
538 {"simbidir", CmdLFSimBidir
, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
539 {"simman", CmdLFSimManchester
, 0, "<Clock> <Bitstream> [GAP] Simulate arbitrary Manchester LF tag"},
540 {"ti", CmdLFTI
, 1, "{ TI RFIDs... }"},
541 {"hitag", CmdLFHitag
, 1, "{ Hitag tags and transponders... }"},
542 {"vchdemod", CmdVchDemod
, 1, "['clone'] -- Demodulate samples for VeriChip"},
543 {"t55xx", CmdLFT55XX
, 1, "{ T55xx RFIDs... }"},
544 {"pcf7931", CmdLFPCF7931
, 1, "{PCF7931 RFIDs...}"},
545 {NULL
, NULL
, 0, NULL
}
548 int CmdLF(const char *Cmd
)
550 CmdsParse(CommandTable
, Cmd
);
554 int CmdHelp(const char *Cmd
)
556 CmdsHelp(CommandTable
);