]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlf.c
e3361cb50b3b33e38aebd540dbe505405d543173
[proxmark3-svn] / client / cmdlf.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <limits.h>
15 #include "proxmark3.h"
16 #include "data.h"
17 #include "graph.h"
18 #include "ui.h"
19 #include "cmdparser.h"
20 #include "cmdmain.h"
21 #include "cmddata.h"
22 #include "util.h"
23 #include "cmdlf.h"
24 #include "cmdlfhid.h"
25 #include "cmdlfti.h"
26 #include "cmdlfem4x.h"
27 #include "cmdlfhitag.h"
28 #include "cmdlft55xx.h"
29 #include "cmdlfpcf7931.h"
30 #include "cmdlfio.h"
31
32 static int CmdHelp(const char *Cmd);
33
34 /* send a command before reading */
35 int CmdLFCommandRead(const char *Cmd)
36 {
37 static char dummy[3];
38
39 dummy[0]= ' ';
40
41 UsbCommand c = {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K};
42 sscanf(Cmd, "%"lli" %"lli" %"lli" %s %s", &c.arg[0], &c.arg[1], &c.arg[2],(char*)(&c.d.asBytes),(char*)(&dummy+1));
43 // in case they specified 'h'
44 strcpy((char *)&c.d.asBytes + strlen((char *)c.d.asBytes), dummy);
45 SendCommand(&c);
46 return 0;
47 }
48
49 int CmdFlexdemod(const char *Cmd)
50 {
51 int i;
52 for (i = 0; i < GraphTraceLen; ++i) {
53 if (GraphBuffer[i] < 0) {
54 GraphBuffer[i] = -1;
55 } else {
56 GraphBuffer[i] = 1;
57 }
58 }
59
60 #define LONG_WAIT 100
61 int start;
62 for (start = 0; start < GraphTraceLen - LONG_WAIT; start++) {
63 int first = GraphBuffer[start];
64 for (i = start; i < start + LONG_WAIT; i++) {
65 if (GraphBuffer[i] != first) {
66 break;
67 }
68 }
69 if (i == (start + LONG_WAIT)) {
70 break;
71 }
72 }
73 if (start == GraphTraceLen - LONG_WAIT) {
74 PrintAndLog("nothing to wait for");
75 return 0;
76 }
77
78 GraphBuffer[start] = 2;
79 GraphBuffer[start+1] = -2;
80 uint8_t bits[64] = {0x00};
81
82 int bit, sum;
83 i = start;
84 for (bit = 0; bit < 64; bit++) {
85 sum = 0;
86 for (int j = 0; j < 16; j++) {
87 sum += GraphBuffer[i++];
88 }
89
90 bits[bit] = (sum > 0) ? 1 : 0;
91
92 PrintAndLog("bit %d sum %d", bit, sum);
93 }
94
95 for (bit = 0; bit < 64; bit++) {
96 int j;
97 int sum = 0;
98 for (j = 0; j < 16; j++) {
99 sum += GraphBuffer[i++];
100 }
101 if (sum > 0 && bits[bit] != 1) {
102 PrintAndLog("oops1 at %d", bit);
103 }
104 if (sum < 0 && bits[bit] != 0) {
105 PrintAndLog("oops2 at %d", bit);
106 }
107 }
108
109 // HACK writing back to graphbuffer.
110 GraphTraceLen = 32*64;
111 i = 0;
112 int phase = 0;
113 for (bit = 0; bit < 64; bit++) {
114
115 phase = (bits[bit] == 0) ? 0 : 1;
116
117 int j;
118 for (j = 0; j < 32; j++) {
119 GraphBuffer[i++] = phase;
120 phase = !phase;
121 }
122 }
123
124 RepaintGraphWindow();
125 return 0;
126 }
127
128 int CmdIndalaDemod(const char *Cmd)
129 {
130 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
131
132 int state = -1;
133 int count = 0;
134 int i, j;
135
136 // worst case with GraphTraceLen=64000 is < 4096
137 // under normal conditions it's < 2048
138
139 uint8_t rawbits[4096];
140 int rawbit = 0;
141 int worst = 0, worstPos = 0;
142 // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
143 for (i = 0; i < GraphTraceLen-1; i += 2) {
144 count += 1;
145 if ((GraphBuffer[i] > GraphBuffer[i + 1]) && (state != 1)) {
146 if (state == 0) {
147 for (j = 0; j < count - 8; j += 16) {
148 rawbits[rawbit++] = 0;
149 }
150 if ((abs(count - j)) > worst) {
151 worst = abs(count - j);
152 worstPos = i;
153 }
154 }
155 state = 1;
156 count = 0;
157 } else if ((GraphBuffer[i] < GraphBuffer[i + 1]) && (state != 0)) {
158 if (state == 1) {
159 for (j = 0; j < count - 8; j += 16) {
160 rawbits[rawbit++] = 1;
161 }
162 if ((abs(count - j)) > worst) {
163 worst = abs(count - j);
164 worstPos = i;
165 }
166 }
167 state = 0;
168 count = 0;
169 }
170 }
171
172 if (rawbit>0){
173 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit, GraphTraceLen/32);
174 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst, worstPos);
175 } else {
176 return 0;
177 }
178
179 // Finding the start of a UID
180 int uidlen, long_wait;
181 if (strcmp(Cmd, "224") == 0) {
182 uidlen = 224;
183 long_wait = 30;
184 } else {
185 uidlen = 64;
186 long_wait = 29;
187 }
188
189 int start;
190 int first = 0;
191 for (start = 0; start <= rawbit - uidlen; start++) {
192 first = rawbits[start];
193 for (i = start; i < start + long_wait; i++) {
194 if (rawbits[i] != first) {
195 break;
196 }
197 }
198 if (i == (start + long_wait)) {
199 break;
200 }
201 }
202
203 if (start == rawbit - uidlen + 1) {
204 PrintAndLog("nothing to wait for");
205 return 0;
206 }
207
208 // Inverting signal if needed
209 if (first == 1) {
210 for (i = start; i < rawbit; i++) {
211 rawbits[i] = !rawbits[i];
212 }
213 }
214
215 // Dumping UID
216 uint8_t bits[224] = {0x00};
217 char showbits[225] = {0x00};
218 int bit;
219 i = start;
220 int times = 0;
221
222 if (uidlen > rawbit) {
223 PrintAndLog("Warning: not enough raw bits to get a full UID");
224 for (bit = 0; bit < rawbit; bit++) {
225 bits[bit] = rawbits[i++];
226 // As we cannot know the parity, let's use "." and "/"
227 showbits[bit] = '.' + bits[bit];
228 }
229 showbits[bit+1]='\0';
230 PrintAndLog("Partial UID=%s", showbits);
231 return 0;
232 } else {
233 for (bit = 0; bit < uidlen; bit++) {
234 bits[bit] = rawbits[i++];
235 showbits[bit] = '0' + bits[bit];
236 }
237 times = 1;
238 }
239
240 //convert UID to HEX
241 uint32_t uid1, uid2, uid3, uid4, uid5, uid6, uid7;
242 int idx;
243 uid1 = uid2 = 0;
244
245 if (uidlen==64){
246 for( idx=0; idx<64; idx++) {
247 if (showbits[idx] == '0') {
248 uid1=(uid1<<1)|(uid2>>31);
249 uid2=(uid2<<1)|0;
250 } else {
251 uid1=(uid1<<1)|(uid2>>31);
252 uid2=(uid2<<1)|1;
253 }
254 }
255 PrintAndLog("UID=%s (%x%08x)", showbits, uid1, uid2);
256 }
257 else {
258 uid3 = uid4 = uid5 = uid6 = uid7 = 0;
259
260 for( idx=0; idx<224; idx++) {
261 uid1=(uid1<<1)|(uid2>>31);
262 uid2=(uid2<<1)|(uid3>>31);
263 uid3=(uid3<<1)|(uid4>>31);
264 uid4=(uid4<<1)|(uid5>>31);
265 uid5=(uid5<<1)|(uid6>>31);
266 uid6=(uid6<<1)|(uid7>>31);
267
268 if (showbits[idx] == '0')
269 uid7 = (uid7<<1) | 0;
270 else
271 uid7 = (uid7<<1) | 1;
272 }
273 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits, uid1, uid2, uid3, uid4, uid5, uid6, uid7);
274 }
275
276 // Checking UID against next occurrences
277 int failed = 0;
278 for (; i + uidlen <= rawbit;) {
279 failed = 0;
280 for (bit = 0; bit < uidlen; bit++) {
281 if (bits[bit] != rawbits[i++]) {
282 failed = 1;
283 break;
284 }
285 }
286 if (failed == 1) {
287 break;
288 }
289 times += 1;
290 }
291
292 PrintAndLog("Occurrences: %d (expected %d)", times, (rawbit - start) / uidlen);
293
294 // Remodulating for tag cloning
295 // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
296 // since this changes graphbuffer data.
297 GraphTraceLen = 32*uidlen;
298 i = 0;
299 int phase = 0;
300 for (bit = 0; bit < uidlen; bit++) {
301 if (bits[bit] == 0) {
302 phase = 0;
303 } else {
304 phase = 1;
305 }
306 int j;
307 for (j = 0; j < 32; j++) {
308 GraphBuffer[i++] = phase;
309 phase = !phase;
310 }
311 }
312
313 RepaintGraphWindow();
314 return 1;
315 }
316
317 int CmdIndalaClone(const char *Cmd)
318 {
319 UsbCommand c;
320 unsigned int uid1, uid2, uid3, uid4, uid5, uid6, uid7;
321
322 uid1 = uid2 = uid3 = uid4 = uid5 = uid6 = uid7 = 0;
323 int n = 0, i = 0;
324
325 if (strchr(Cmd,'l') != 0) {
326 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
327 uid1 = (uid1 << 4) | (uid2 >> 28);
328 uid2 = (uid2 << 4) | (uid3 >> 28);
329 uid3 = (uid3 << 4) | (uid4 >> 28);
330 uid4 = (uid4 << 4) | (uid5 >> 28);
331 uid5 = (uid5 << 4) | (uid6 >> 28);
332 uid6 = (uid6 << 4) | (uid7 >> 28);
333 uid7 = (uid7 << 4) | (n & 0xf);
334 }
335 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1, uid2, uid3, uid4, uid5, uid6, uid7);
336 c.cmd = CMD_INDALA_CLONE_TAG_L;
337 c.d.asDwords[0] = uid1;
338 c.d.asDwords[1] = uid2;
339 c.d.asDwords[2] = uid3;
340 c.d.asDwords[3] = uid4;
341 c.d.asDwords[4] = uid5;
342 c.d.asDwords[5] = uid6;
343 c.d.asDwords[6] = uid7;
344 } else {
345 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
346 uid1 = (uid1 << 4) | (uid2 >> 28);
347 uid2 = (uid2 << 4) | (n & 0xf);
348 }
349 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1, uid2);
350 c.cmd = CMD_INDALA_CLONE_TAG;
351 c.arg[0] = uid1;
352 c.arg[1] = uid2;
353 }
354
355 SendCommand(&c);
356 return 0;
357 }
358
359 int CmdLFRead(const char *Cmd)
360 {
361 UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K};
362
363 // 'h' means higher-low-frequency, 134 kHz
364 if(*Cmd == 'h') {
365 c.arg[0] = 1;
366 } else if (*Cmd == '\0') {
367 c.arg[0] = 0;
368 } else if (sscanf(Cmd, "%"lli, &c.arg[0]) != 1) {
369 PrintAndLog("Samples 1: 'lf read'");
370 PrintAndLog(" 2: 'lf read h'");
371 PrintAndLog(" 3: 'lf read <divisor>'");
372 return 0;
373 }
374 SendCommand(&c);
375 WaitForResponse(CMD_ACK,NULL);
376 return 0;
377 }
378
379 static void ChkBitstream(const char *str)
380 {
381 int i;
382
383 /* convert to bitstream if necessary */
384 for (i = 0; i < (int)(GraphTraceLen / 2); i++){
385 if (GraphBuffer[i] > 1 || GraphBuffer[i] < 0) {
386 CmdBitstream(str);
387 break;
388 }
389 }
390 }
391
392 int CmdLFSim(const char *Cmd)
393 {
394 int i,j;
395 static int gap;
396
397 sscanf(Cmd, "%i", &gap);
398
399 /* convert to bitstream if necessary */
400 ChkBitstream(Cmd);
401
402 printf("Sending [%d bytes]", GraphTraceLen);
403 for (i = 0; i < GraphTraceLen; i += USB_CMD_DATA_SIZE) {
404 UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {i, 0, 0}};
405
406 for (j = 0; j < USB_CMD_DATA_SIZE; j++) {
407 c.d.asBytes[j] = GraphBuffer[i+j];
408 }
409 SendCommand(&c);
410 WaitForResponse(CMD_ACK,NULL);
411 printf(".");
412 }
413
414 printf("\n");
415 PrintAndLog("Starting to simulate");
416 UsbCommand c = {CMD_SIMULATE_TAG_125K, {GraphTraceLen, gap, 0}};
417 SendCommand(&c);
418 return 0;
419 }
420
421 int CmdLFSimBidir(const char *Cmd)
422 {
423 // Set ADC to twice the carrier for a slight supersampling
424 // HACK: not implemented in ARMSRC.
425 PrintAndLog("Not implemented yet.");
426 UsbCommand c = {CMD_LF_SIMULATE_BIDIR, {47, 384, 0}};
427 SendCommand(&c);
428 return 0;
429 }
430
431 /* simulate an LF Manchester encoded tag with specified bitstream, clock rate and inter-id gap */
432 int CmdLFSimManchester(const char *Cmd)
433 {
434 static int clock, gap;
435 static char data[1024], gapstring[8];
436
437 sscanf(Cmd, "%i %s %i", &clock, &data[0], &gap);
438
439 ClearGraph(0);
440
441 for (int i = 0; i < strlen(data) ; ++i)
442 AppendGraph(0, clock, data[i]- '0');
443
444 CmdManchesterMod("");
445
446 RepaintGraphWindow();
447
448 sprintf(&gapstring[0], "%i", gap);
449 CmdLFSim(gapstring);
450 return 0;
451 }
452
453 int CmdLFSnoop(const char *Cmd)
454 {
455 UsbCommand c = {CMD_LF_SNOOP_RAW_ADC_SAMPLES};
456
457 // 'h' means higher-low-frequency, 134 kHz
458 c.arg[0] = 0;
459 c.arg[1] = -1;
460
461 if (*Cmd == 'l') {
462 sscanf(Cmd, "l %"lli, &c.arg[1]);
463 } else if(*Cmd == 'h') {
464 c.arg[0] = 1;
465 sscanf(Cmd, "h %"lli, &c.arg[1]);
466 } else if (sscanf(Cmd, "%"lli" %"lli, &c.arg[0], &c.arg[1]) < 1) {
467 PrintAndLog("usage 1: snoop");
468 PrintAndLog(" 2: snoop {l,h} [trigger threshold]");
469 PrintAndLog(" 3: snoop <divisor> [trigger threshold]");
470 return 0;
471 }
472
473 SendCommand(&c);
474 WaitForResponse(CMD_ACK,NULL);
475 return 0;
476 }
477
478 int CmdVchDemod(const char *Cmd)
479 {
480 // Is this the entire sync pattern, or does this also include some
481 // data bits that happen to be the same everywhere? That would be
482 // lovely to know.
483 static const int SyncPattern[] = {
484 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
485 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
486 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
487 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
488 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
489 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
490 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
491 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
492 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
493 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
494 };
495
496 // So first, we correlate for the sync pattern, and mark that.
497 int bestCorrel = 0, bestPos = 0;
498 int i;
499 // It does us no good to find the sync pattern, with fewer than
500 // 2048 samples after it...
501 for (i = 0; i < (GraphTraceLen-2048); i++) {
502 int sum = 0;
503 int j;
504 for (j = 0; j < arraylen(SyncPattern); j++) {
505 sum += GraphBuffer[i+j]*SyncPattern[j];
506 }
507 if (sum > bestCorrel) {
508 bestCorrel = sum;
509 bestPos = i;
510 }
511 }
512 PrintAndLog("best sync at %d [metric %d]", bestPos, bestCorrel);
513
514 char bits[257];
515 bits[256] = '\0';
516
517 int worst = INT_MAX;
518 int worstPos = 0;
519
520 for (i = 0; i < 2048; i += 8) {
521 int sum = 0;
522 int j;
523 for (j = 0; j < 8; j++) {
524 sum += GraphBuffer[bestPos+i+j];
525 }
526 if (sum < 0) {
527 bits[i/8] = '.';
528 } else {
529 bits[i/8] = '1';
530 }
531 if(abs(sum) < worst) {
532 worst = abs(sum);
533 worstPos = i;
534 }
535 }
536 PrintAndLog("bits:");
537 PrintAndLog("%s", bits);
538 PrintAndLog("worst metric: %d at pos %d", worst, worstPos);
539
540 if (strcmp(Cmd, "clone")==0) {
541 GraphTraceLen = 0;
542 char *s;
543 for(s = bits; *s; s++) {
544 int j;
545 for(j = 0; j < 16; j++) {
546 GraphBuffer[GraphTraceLen++] = (*s == '1') ? 1 : 0;
547 }
548 }
549 RepaintGraphWindow();
550 }
551 return 0;
552 }
553
554 //by marshmellow
555 int CmdLFfind(const char *Cmd)
556 {
557 int ans=0;
558 char cmdp = param_getchar(Cmd, 0);
559
560 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
561 PrintAndLog("Usage: lf search <0|1>");
562 PrintAndLog(" <use data from Graphbuffer>, if not set, try reading data from tag.");
563 PrintAndLog("");
564 PrintAndLog(" sample: lf search");
565 PrintAndLog(" : lf search 1");
566 return 0;
567 }
568
569 if (!offline && (cmdp != '1')){
570 ans=CmdLFRead("");
571 ans=CmdSamples("20000");
572 } else if (GraphTraceLen < 1000) {
573 PrintAndLog("Data in Graphbuffer was too small.");
574 return 0;
575 }
576
577 PrintAndLog("NOTE: some demods output possible binary\n if it finds something that looks like a tag");
578 PrintAndLog("Checking for known tags:");
579 ans=CmdFSKdemodIO("");
580 if (ans>0) {
581 PrintAndLog("Valid IO Prox ID Found!");
582 return 1;
583 }
584 ans=CmdFSKdemodHID("");
585 if (ans>0) {
586 PrintAndLog("Valid HID Prox ID Found!");
587 return 1;
588 }
589 //add psk and indala
590 ans=CmdIndalaDecode("0");
591 if (ans>0) {
592 PrintAndLog("Valid Indala ID Found!");
593 return 1;
594 }
595 ans=Cmdaskmandemod("");
596 if (ans>0) {
597 PrintAndLog("Valid EM410x ID Found!");
598 return 1;
599 }
600 PrintAndLog("No Known Tags Found!\n");
601 return 0;
602 }
603
604 static command_t CommandTable[] =
605 {
606 {"help", CmdHelp, 1, "This help"},
607 {"cmdread", CmdLFCommandRead, 0, "<off period> <'0' period> <'1' period> <command> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)"},
608 {"em4x", CmdLFEM4X, 1, "{ EM4X RFIDs... }"},
609 {"flexdemod", CmdFlexdemod, 1, "Demodulate samples for FlexPass"},
610 {"hid", CmdLFHID, 1, "{ HID RFIDs... }"},
611 {"io", CmdLFIO, 1, "{ ioProx tags... }"},
612 {"indalademod", CmdIndalaDemod, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
613 {"indalaclone", CmdIndalaClone, 0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
614 {"read", CmdLFRead, 0, "['h' or <divisor>] -- Read 125/134 kHz LF ID-only tag (option 'h' for 134, alternatively: f=12MHz/(divisor+1))"},
615 {"search", CmdLFfind, 1, "Read and Search for valid known tag (in offline mode it you can load first then search)"},
616 {"sim", CmdLFSim, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
617 {"simbidir", CmdLFSimBidir, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
618 {"simman", CmdLFSimManchester, 0, "<Clock> <Bitstream> [GAP] Simulate arbitrary Manchester LF tag"},
619 {"snoop", CmdLFSnoop, 0, "['l'|'h'|<divisor>] [trigger threshold]-- Snoop LF (l:125khz, h:134khz)"},
620 {"ti", CmdLFTI, 1, "{ TI RFIDs... }"},
621 {"hitag", CmdLFHitag, 1, "{ Hitag tags and transponders... }"},
622 {"vchdemod", CmdVchDemod, 1, "['clone'] -- Demodulate samples for VeriChip"},
623 {"t55xx", CmdLFT55XX, 1, "{ T55xx RFIDs... }"},
624 {"pcf7931", CmdLFPCF7931, 1, "{PCF7931 RFIDs...}"},
625 {NULL, NULL, 0, NULL}
626 };
627
628 int CmdLF(const char *Cmd)
629 {
630 CmdsParse(CommandTable, Cmd);
631 return 0;
632 }
633
634 int CmdHelp(const char *Cmd)
635 {
636 CmdsHelp(CommandTable);
637 return 0;
638 }
Impressum, Datenschutz