-//-----------------------------------------------------------------------------
+ //-----------------------------------------------------------------------------
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
#include "cmdlfem4x.h"
#include "util.h"
#include "data.h"
-#define LF_TRACE_BUFF_SIZE 16000
+#define LF_TRACE_BUFF_SIZE 12000
+#define LF_BITSSTREAM_LEN 1000
char *global_em410xId;
/* get clock */
clock = GetClock(Cmd, high, 0);
-
+
/* parity for our 4 columns */
parity[0] = parity[1] = parity[2] = parity[3] = 0;
header = rows = 0;
retest:
/* We go till 5 before the graph ends because we'll get that far below */
- for (i = 1; i < bit2idx - 5; i++)
+ for (i = 0; i < bit2idx - 5; i++)
{
/* Step 2: We have our header but need our tag ID */
if (header == 9 && rows < 10)
PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
/* Start back rows * 5 + 9 header bits, -1 to not start at same place */
- i -= 9 + (5 * rows) - 5;
+ i -= 9 + (5 * rows) -2;
rows = header = 0;
}
* 0 <-- stop bit, end of tag
*/
int CmdEM410xSim(const char *Cmd)
-{
- int i, n, j, h, binary[4], parity[4];
+{
+ int i, n, j, h, binary[4], parity[4];
+
+ char cmdp = param_getchar(Cmd, 0);
+ uint8_t uid[5] = {0x00};
+
+ if (cmdp == 'h' || cmdp == 'H') {
+ PrintAndLog("Usage: lf em4x sim <UID>");
+ PrintAndLog("");
+ PrintAndLog(" sample: lf em4x sim 0F0368568B");
+ return 0;
+ }
+ if (param_gethex(Cmd, 0, uid, 10)) {
+ PrintAndLog("UID must include 10 HEX symbols");
+ return 0;
+ }
+
+ PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
+ PrintAndLog("Press pm3-button to about simulation");
+
/* clock is 64 in EM410x tags */
int clock = 64;
/* clear our graph */
- ClearGraph(0);
-
+ ClearGraph(1);
+
/* write it out a few times */
for (h = 0; h < 4; h++)
{
}
/* modulate that biatch */
- CmdManchesterMod("");
+ CmdManchesterMod("64");
/* booyah! */
RepaintGraphWindow();
return 0;
}
-/* Function is equivalent of loread + losamples + em410xread
- * looped until an EM410x tag is detected */
+/* Function is equivalent of lf read + data samples + em410xread
+ * looped until an EM410x tag is detected
+ *
+ * Why is CmdSamples("16000")?
+ * TBD: Auto-grow sample size based on detected sample rate. IE: If the
+ * rate gets lower, then grow the number of samples
+ * Changed by martin, 4000 x 4 = 16000,
+ * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
+
+*/
int CmdEM410xWatch(const char *Cmd)
{
- int read_h = (*Cmd == 'h');
- //char k;
- do
- {
- CmdLFRead(read_h ? "h" : "");
- // 2000 samples is OK for clock=64, but not clock=32. Probably want
- // 8000 for clock=16. Don't want to go too high since old HID driver
- // is very slow
- // TBD: Auto-grow sample size based on detected sample rate. IE: If the
- // rate gets lower, then grow the number of samples
-
- // Changed by martin, 4000 x 4 = 16000,
- // see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
+ int read_h = (*Cmd == 'h');
+ do
+ {
+ if (ukbhit()) {
+ printf("\naborted via keyboard!\n");
+ break;
+ }
+
+ CmdLFRead(read_h ? "h" : "");
CmdSamples("16000");
- } while (
+
+ } while (
!CmdEM410xRead("")
);
- return 0;
+ return 0;
}
int CmdEM410xWatchnSpoof(const char *Cmd)
{
- int read_h = (*Cmd == 'h');
- do
- {
- CmdLFRead(read_h ? "h" : "");
- CmdSamples("16000");
- } while ( ! CmdEM410xRead(""));
+ CmdEM410xWatch(Cmd);
PrintAndLog("# Replaying : %s",global_em410xId);
CmdEM410xSim(global_em410xId);
return 0;
++i;
while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
++i;
- if (j>(MAX_GRAPH_TRACE_LEN/64)) {
+ if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
break;
}
tmpbuff[j++]= i - start;
SendCommand(&c);
WaitForResponse(CMD_ACK, NULL);
- uint8_t data[LF_TRACE_BUFF_SIZE];
- memset(data, 0x00, LF_TRACE_BUFF_SIZE);
+ uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
WaitForResponseTimeout(CMD_ACK,NULL, 1500);
for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
- GraphBuffer[j] = ((int)data[j]) - 128;
+ GraphBuffer[j] = ((int)data[j]);
}
GraphTraceLen = LF_TRACE_BUFF_SIZE;
-
- // BiDirectional
- //CmdDirectionalThreshold("70 -60");
- // Askdemod
- //Cmdaskdemod("1");
-
- uint8_t bits[1000];
+ uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
uint8_t * bitstream = bits;
- memset(bitstream, 0x00, sizeof(bits));
-
- manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
-
+ manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream,LF_BITSSTREAM_LEN);
+ RepaintGraphWindow();
return 0;
}
SendCommand(&c);
WaitForResponse(CMD_ACK, NULL);
- uint8_t data[LF_TRACE_BUFF_SIZE];
- memset(data, 0x00, LF_TRACE_BUFF_SIZE);
+ uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
WaitForResponseTimeout(CMD_ACK,NULL, 1500);
for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
- GraphBuffer[j] = ((int)data[j]) - 128;
+ GraphBuffer[j] = ((int)data[j]);
}
GraphTraceLen = LF_TRACE_BUFF_SIZE;
-
- // BiDirectional
- //CmdDirectionalThreshold("70 -60");
-
- // Askdemod
- //Cmdaskdemod("1");
-
- uint8_t bits[1000];
- uint8_t * bitstream = bits;
- memset(bitstream, 0x00, sizeof(bits));
- manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
+ uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
+ uint8_t * bitstream = bits;
+ manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
+ RepaintGraphWindow();
return 0;
}
return 1;
}
- PrintAndLog("Writting word %d with data %08X", Word, Data);
+ PrintAndLog("Writing word %d with data %08X", Word, Data);
c.cmd = CMD_EM4X_WRITE_WORD;
c.d.asBytes[0] = 0x0; //Normal mode
int CmdWriteWordPWD(const char *Cmd)
{
- int Word = 8; //default to invalid word
+ int Word = 16; //default to invalid word
int Data = 0xFFFFFFFF; //default to blank data
int Password = 0xFFFFFFFF; //default to blank password
UsbCommand c;
return 1;
}
- PrintAndLog("Writting word %d with data %08X and password %08X", Word, Data, Password);
+ PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
c.cmd = CMD_EM4X_WRITE_WORD;
c.d.asBytes[0] = 0x1; //Password mode
static command_t CommandTable[] =
{
{"help", CmdHelp, 1, "This help"},
- {"410read", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
- {"410sim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
- {"410watch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
- {"410spoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
- {"410write", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
- {"4xread", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
+ {"410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
+ {"410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
+ {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
+ {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
+ {"410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
+ {"4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
{"rd", CmdReadWord, 1, "<Word 1-15> -- Read EM4xxx word data"},
{"rdpwd", CmdReadWordPWD, 1, "<Word 1-15> <Password> -- Read EM4xxx word data in password mode "},
{"wr", CmdWriteWord, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
projects / proxmark3-svn / blobdiff