git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency T55xx commands
   8 //-----------------------------------------------------------------------------
   9
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <inttypes.h>
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdmain.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"
  19 #include "cmdlf.h"
  20 #include "cmdlft55xx.h"
  21 #include "util.h"
  22 #include "data.h"
  23
  24
  25 #define LF_TRACE_BUFF_SIZE 12000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)
  26 static int CmdHelp(const char *Cmd);
  27
  28
  29 int CmdReadBlk(const char *Cmd)
  30 {
  31         //default to invalid block
  32         int Block = -1;
  33         UsbCommand c;
  34
  35         sscanf(Cmd, "%d", &Block);
  36
  37         if ((Block > 7) | (Block < 0)) {
  38                 PrintAndLog("Block must be between 0 and 7");
  39                 return 1;
  40         }
  41
  42         PrintAndLog(" Reading page 0 block : %d", Block);
  43
  44         // this command fills up BigBuff
  45         //
  46         c.cmd = CMD_T55XX_READ_BLOCK;
  47         c.d.asBytes[0] = 0x00;
  48         c.arg[0] = 0;
  49         c.arg[1] = Block;
  50         c.arg[2] = 0;
  51         SendCommand(&c);
  52         WaitForResponse(CMD_ACK, NULL);
  53
  54         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  55
  56         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
  57         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  58
  59         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  60                 GraphBuffer[j] = ((int)data[j]) ;
  61         }
  62         GraphTraceLen = LF_TRACE_BUFF_SIZE;
  63
  64         uint8_t bits[1000] = {0x00};
  65         uint8_t * bitstream = bits;
  66
  67         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
  68
  69         RepaintGraphWindow();
  70   return 0;
  71 }
  72
  73 int CmdReadBlkPWD(const char *Cmd)
  74 {
  75         int Block = -1; //default to invalid block
  76         int Password = 0xFFFFFFFF; //default to blank Block 7
  77         UsbCommand c;
  78
  79         sscanf(Cmd, "%d %x", &Block, &Password);
  80
  81         if ((Block > 7) | (Block < 0)) {
  82                 PrintAndLog("Block must be between 0 and 7");
  83                 return 1;
  84         }
  85
  86         PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
  87
  88         c.cmd = CMD_T55XX_READ_BLOCK;
  89         c.d.asBytes[0] = 0x1; //Password mode
  90         c.arg[0] = 0;
  91         c.arg[1] = Block;
  92         c.arg[2] = Password;
  93         SendCommand(&c);
  94         WaitForResponse(CMD_ACK, NULL);
  95
  96         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  97
  98         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
  99         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 100
 101         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 102                 GraphBuffer[j] = ((int)data[j]) - 128;
 103         }
 104         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 105
 106         uint8_t bits[1000] = {0x00};
 107         uint8_t * bitstream = bits;
 108
 109         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 110         RepaintGraphWindow();
 111   return 0;
 112 }
 113
 114 int CmdWriteBlk(const char *Cmd)
 115 {
 116   int Block = 8; //default to invalid block
 117   int Data = 0xFFFFFFFF; //default to blank Block
 118   UsbCommand c;
 119
 120   sscanf(Cmd, "%x %d", &Data, &Block);
 121
 122   if (Block > 7) {
 123         PrintAndLog("Block must be between 0 and 7");
 124         return 1;
 125   }
 126
 127   PrintAndLog("Writting block %d with data %08X", Block, Data);
 128
 129   c.cmd = CMD_T55XX_WRITE_BLOCK;
 130   c.d.asBytes[0] = 0x0; //Normal mode
 131   c.arg[0] = Data;
 132   c.arg[1] = Block;
 133   c.arg[2] = 0;
 134   SendCommand(&c);
 135   return 0;
 136 }
 137
 138 int CmdWriteBlkPWD(const char *Cmd)
 139 {
 140   int Block = 8; //default to invalid block
 141   int Data = 0xFFFFFFFF; //default to blank Block
 142   int Password = 0xFFFFFFFF; //default to blank Block 7
 143   UsbCommand c;
 144
 145   sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
 146
 147   if (Block > 7) {
 148         PrintAndLog("Block must be between 0 and 7");
 149         return 1;
 150   }
 151
 152   PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
 153
 154   c.cmd = CMD_T55XX_WRITE_BLOCK;
 155   c.d.asBytes[0] = 0x1; //Password mode
 156   c.arg[0] = Data;
 157   c.arg[1] = Block;
 158   c.arg[2] = Password;
 159   SendCommand(&c);
 160   return 0;
 161 }
 162
 163 int CmdReadTrace(const char *Cmd)
 164 {
 165         UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
 166         SendCommand(&c);
 167         WaitForResponse(CMD_ACK, NULL);
 168
 169         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 170
 171         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
 172         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 173
 174         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 175                 GraphBuffer[j] = ((int)data[j]);
 176                 //GraphBuffer[j] = ((int)data[j]) - 128;
 177         }
 178         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 179
 180         uint8_t bits[1000] = {0x00};
 181         uint8_t * bitstream = bits;
 182
 183         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 184         RepaintGraphWindow();
 185
 186         uint8_t si = 5;
 187         uint32_t bl0     = PackBits(si, 32, bitstream);
 188         uint32_t bl1     = PackBits(si+32, 32, bitstream);
 189
 190         uint32_t acl     = PackBits(si,  8, bitstream);
 191         si += 8;
 192         uint32_t mfc     = PackBits(si, 8, bitstream);
 193         si += 8;
 194         uint32_t cid     = PackBits(si, 5, bitstream);
 195         si += 5;
 196         uint32_t icr     = PackBits(si, 3, bitstream);
 197         si += 3;
 198         uint32_t year    = PackBits(si, 4, bitstream);
 199         si += 4;
 200         uint32_t quarter = PackBits(si, 2, bitstream);
 201         si += 2;
 202         uint32_t num     = PackBits(si, 12, bitstream);
 203         si += 12;
 204         uint32_t wafer   = PackBits(si, 5, bitstream);
 205         si += 5;
 206         uint32_t dw      = PackBits(si, 15, bitstream);
 207
 208         PrintAndLog("");
 209         PrintAndLog("-- T55xx Trace Information ----------------------------------");
 210         PrintAndLog("-------------------------------------------------------------");
 211         PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1)  : 0x%02X (%d)", acl, acl);
 212         PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x%02X (%d)", mfc, mfc);
 213         PrintAndLog(" CID                                     : 0x%02X (%d)", cid, cid);
 214         PrintAndLog(" ICR IC Revision                         : %d",icr );
 215         PrintAndLog(" Manufactured");
 216         PrintAndLog("     Year/Quarter : %d/%d",2000+year, quarter );
 217         PrintAndLog("     Number       : %d", num );
 218         PrintAndLog("     Wafer number : %d", wafer);
 219         PrintAndLog("     Die Number   : %d", dw);
 220         PrintAndLog("-------------------------------------------------------------");
 221         PrintAndLog(" Raw Data");
 222         PrintAndLog("     Block 0  : %08X", bl0);
 223         PrintAndLog("     Block 1  : %08X", bl1);
 224         PrintAndLog("-------------------------------------------------------------");
 225         /*
 226         TRACE - BLOCK O
 227                 Bits    Definition                                                              HEX
 228                 1-8             ACL Allocation class (ISO/IEC 15963-1)  0xE0
 229                 9-16    MFC Manufacturer ID (ISO/IEC 7816-6)    0x15 Atmel Corporation
 230                 17-21   CID                                                                             0x1 = Atmel ATA5577M1  0x2 = Atmel ATA5577M2
 231                 22-24   ICR IC revision
 232                 25-28   YEAR (BCD encoded)                                              9 (= 2009)
 233                 29-30   QUARTER                                                                 1,2,3,4
 234                 31-32   Number
 235
 236         TRACE - BLOCK 1
 237                 1-12    Number
 238                 13-17   Wafer number
 239                 18-32   DW,  die number sequential
 240         */
 241
 242   return 0;
 243 }
 244
 245 int CmdInfo(const char *Cmd){
 246         /*
 247                 Page 0 Block 0 Configuration data.
 248                 Normal mode
 249                 Extended mode
 250         */
 251         // läs block 0 -  data finns i graphbuff
 252         CmdReadBlk("0");
 253
 254         uint8_t bits[1000] = {0x00};
 255         uint8_t * bitstream = bits;
 256
 257         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 258
 259         uint8_t si = 5;
 260         uint32_t bl0     = PackBits(si, 32, bitstream);
 261
 262         uint32_t safer   = PackBits(si, 4, bitstream); si += 4;
 263         uint32_t resv   = PackBits(si, 7, bitstream); si += 7;
 264         uint32_t dbr   = PackBits(si, 3, bitstream); si += 3;
 265         uint32_t extend   = PackBits(si, 1, bitstream); si += 1;
 266         uint32_t datamodulation   = PackBits(si, 5, bitstream); si += 5;
 267         uint32_t pskcf   = PackBits(si, 2, bitstream); si += 2;
 268         uint32_t aor   = PackBits(si, 1, bitstream); si += 1;
 269         uint32_t otp   = PackBits(si, 1, bitstream); si += 1;
 270         uint32_t maxblk   = PackBits(si, 3, bitstream); si += 3;
 271         uint32_t pwd   = PackBits(si, 1, bitstream); si += 1;
 272         uint32_t sst   = PackBits(si, 1, bitstream); si += 1;
 273         uint32_t fw   = PackBits(si, 1, bitstream); si += 1;
 274         uint32_t inv   = PackBits(si, 1, bitstream); si += 1;
 275         uint32_t por   = PackBits(si, 1, bitstream); si += 1;
 276
 277         PrintAndLog("");
 278         PrintAndLog("-- T55xx Configuration --------------------------------------");
 279         PrintAndLog("-------------------------------------------------------------");
 280         PrintAndLog(" Safer key                 : %s", GetSaferStr(safer));
 281         PrintAndLog(" reserved                  : %d", resv);
 282         PrintAndLog(" Data bit rate             : %s", GetBitRateStr(dbr));
 283         PrintAndLog(" eXtended mode             : %s", (extend) ? "Yes - Warning":"No");
 284         PrintAndLog(" Modulation                : %s", GetModulationStr(datamodulation) );
 285         PrintAndLog(" PSK clock freq            : %d", pskcf);
 286         PrintAndLog(" AOR - Answer on Request   : %s", (aor) ? "Yes":"No");
 287         PrintAndLog(" OTP - One Time Pad        : %s", (otp) ? "Yes - Warning":"No" );
 288         PrintAndLog(" Max block                 : %d", maxblk);
 289         PrintAndLog(" Password mode             : %s", (pwd) ? "Yes":"No");
 290         PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
 291         PrintAndLog(" Fast Write                : %s", (fw) ? "Yes":"No");
 292         PrintAndLog(" Inverse data              : %s", (inv) ? "Yes":"No");
 293         PrintAndLog(" POR-Delay                 : %s", (por) ? "Yes":"No");
 294         PrintAndLog("-------------------------------------------------------------");
 295         PrintAndLog(" Raw Data");
 296         PrintAndLog("     Block 0  : 0x%08X", bl0);
 297         PrintAndLog("-------------------------------------------------------------");
 298
 299         return 0;
 300 }
 301
 302 char * GetBitRateStr(uint32_t id){
 303         static char buf[40];
 304         char *retStr = buf;
 305                 switch (id){
 306                 case 0:
 307                         sprintf(retStr,"%d - RF/8",id);
 308                         break;
 309                 case 1:
 310                         sprintf(retStr,"%d - RF/16",id);
 311                         break;
 312                 case 2:
 313                         sprintf(retStr,"%d - RF/32",id);
 314                         break;
 315                 case 3:
 316                         sprintf(retStr,"%d - RF/40",id);
 317                         break;
 318                 case 4:
 319                         sprintf(retStr,"%d - RF/50",id);
 320                         break;
 321                 case 5:
 322                         sprintf(retStr,"%d - RF/64",id);
 323                         break;
 324                 case 6:
 325                         sprintf(retStr,"%d - RF/100",id);
 326                         break;
 327                 case 7:
 328                         sprintf(retStr,"%d - RF/128",id);
 329                         break;
 330                 default:
 331                         sprintf(retStr,"%d - (Unknown)",id);
 332                         break;
 333                 }
 334
 335         return buf;
 336 }
 337
 338
 339 char * GetSaferStr(uint32_t id){
 340         static char buf[40];
 341         char *retStr = buf;
 342
 343         sprintf(retStr,"%d",id);
 344         if (id == 6) {
 345                 sprintf(retStr,"%d - pasdwd",id);
 346         }
 347         if (id == 9 ){
 348                 sprintf(retStr,"%d - testmode ",id);
 349         }
 350
 351         return buf;
 352 }
 353 char * GetModulationStr( uint32_t id){
 354         static char buf[40];
 355         char *retStr = buf;
 356
 357         switch (id){
 358                 case 0:
 359                         sprintf(retStr,"%d - direct",id);
 360                         break;
 361                 case 1:
 362                         sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
 363                         break;
 364                 case 2:
 365                         sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
 366                         break;
 367                 case 3:
 368                         sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
 369                         break;
 370                 case 4:
 371                         sprintf(retStr,"%d - FSK 1 RF/8  RF/5",id);
 372                         break;
 373                 case 5:
 374                         sprintf(retStr,"%d - FSK 2 RF/8  RF/10",id);
 375                         break;
 376                 case 6:
 377                         sprintf(retStr,"%d - FSK 1a RF/5  RF/8",id);
 378                         break;
 379                 case 7:
 380                         sprintf(retStr,"%d - FSK 2a RF/10  RF/8",id);
 381                         break;
 382                 case 8:
 383                         sprintf(retStr,"%d - Manschester",id);
 384                         break;
 385                 case 16:
 386                         sprintf(retStr,"%d - Biphase",id);
 387                         break;
 388                 case 17:
 389                         sprintf(retStr,"%d - Reserved",id);
 390                         break;
 391                 default:
 392                         sprintf(retStr,"0x%02X (Unknown)",id);
 393                         break;
 394                 }
 395         return buf;
 396 }
 397
 398
 399 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
 400
 401         int i = start;
 402         int j = len-1;
 403         uint32_t tmp = 0;
 404         for (; j >= 0; --j, ++i){
 405                 tmp     |= bits[i] << j;
 406         }
 407         return tmp;
 408 }
 409
 410 static command_t CommandTable[] =
 411 {
 412   {"help",   CmdHelp,        1, "This help"},
 413   {"rd",     CmdReadBlk,     0, "<Block> -- Read T55xx block data (page 0)"},
 414   {"rdPWD",  CmdReadBlkPWD,  0, "<Block> <Password> -- Read T55xx block data in password mode(page 0)"},
 415   {"wr",     CmdWriteBlk,    0, "<Data> <Block> -- Write T55xx block data (page 0)"},
 416   {"wrPWD",  CmdWriteBlkPWD, 0, "<Data> <Block> <Password> -- Write T55xx block data in password mode(page 0)"},
 417   {"trace",  CmdReadTrace,   0, "Read T55xx traceability data (page 1)"},
 418   {"info",   CmdInfo,        0, "Read T55xx configuration data (page 0 / block 0"},
 419   {NULL, NULL, 0, NULL}
 420 };
 421
 422 int CmdLFT55XX(const char *Cmd)
 423 {
 424   CmdsParse(CommandTable, Cmd);
 425   return 0;
 426 }
 427
 428 int CmdHelp(const char *Cmd)
 429 {
 430   CmdsHelp(CommandTable);
 431   return 0;
 432 }