a553f267 |
1 | //----------------------------------------------------------------------------- |
2 | // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> |
3 | // |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
5 | // at your option, any later version. See the LICENSE.txt file for the text of |
6 | // the license. |
7 | //----------------------------------------------------------------------------- |
8 | // Low frequency TI commands |
9 | //----------------------------------------------------------------------------- |
10 | |
7fe9b0b7 |
11 | #include <stdio.h> |
590f8ff9 |
12 | #include <stdlib.h> |
43534cba |
13 | #include <inttypes.h> |
7fe9b0b7 |
14 | #include "crc16.h" |
902cb3c0 |
15 | #include "proxmark3.h" |
7fe9b0b7 |
16 | #include "data.h" |
17 | #include "ui.h" |
18 | #include "graph.h" |
19 | #include "cmdparser.h" |
20 | #include "cmdlfti.h" |
21 | |
22 | static int CmdHelp(const char *Cmd); |
23 | |
24 | int CmdTIDemod(const char *Cmd) |
25 | { |
26 | /* MATLAB as follows: |
27 | f_s = 2000000; % sampling frequency |
28 | f_l = 123200; % low FSK tone |
29 | f_h = 134200; % high FSK tone |
30 | |
31 | T_l = 119e-6; % low bit duration |
32 | T_h = 130e-6; % high bit duration |
33 | |
34 | l = 2*pi*ones(1, floor(f_s*T_l))*(f_l/f_s); |
35 | h = 2*pi*ones(1, floor(f_s*T_h))*(f_h/f_s); |
36 | |
37 | l = sign(sin(cumsum(l))); |
38 | h = sign(sin(cumsum(h))); |
39 | */ |
40 | |
41 | // 2M*16/134.2k = 238 |
42 | static const int LowTone[] = { |
43 | 1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
44 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
45 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
46 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
47 | 1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
48 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
49 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
50 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
51 | 1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
52 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
53 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
54 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
55 | 1, 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
56 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
57 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1 |
58 | }; |
59 | // 2M*16/123.2k = 260 |
60 | static const int HighTone[] = { |
61 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
62 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
63 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
64 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
65 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
66 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
67 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
68 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
69 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
70 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
71 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
72 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
73 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
74 | 1, 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
75 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
76 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, -1, |
77 | 1, 1, 1, 1, 1, 1, 1, -1, -1, -1, -1, -1, -1, -1, |
78 | 1, 1, 1, 1, 1, 1, 1, 1 |
79 | }; |
80 | int lowLen = sizeof(LowTone)/sizeof(int); |
81 | int highLen = sizeof(HighTone)/sizeof(int); |
82 | int convLen = (highLen>lowLen)?highLen:lowLen; |
83 | uint16_t crc; |
84 | int i, j, TagType; |
85 | int lowSum = 0, highSum = 0;; |
86 | int lowTot = 0, highTot = 0; |
87 | |
88 | for (i = 0; i < GraphTraceLen - convLen; i++) { |
89 | lowSum = 0; |
90 | highSum = 0;; |
91 | |
92 | for (j = 0; j < lowLen; j++) { |
93 | lowSum += LowTone[j]*GraphBuffer[i+j]; |
94 | } |
95 | for (j = 0; j < highLen; j++) { |
96 | highSum += HighTone[j]*GraphBuffer[i+j]; |
97 | } |
98 | lowSum = abs((100*lowSum) / lowLen); |
99 | highSum = abs((100*highSum) / highLen); |
100 | lowSum = (lowSum<0)?-lowSum:lowSum; |
101 | highSum = (highSum<0)?-highSum:highSum; |
102 | |
103 | GraphBuffer[i] = (highSum << 16) | lowSum; |
104 | } |
105 | |
106 | for (i = 0; i < GraphTraceLen - convLen - 16; i++) { |
107 | lowTot = 0; |
108 | highTot = 0; |
109 | // 16 and 15 are f_s divided by f_l and f_h, rounded |
110 | for (j = 0; j < 16; j++) { |
111 | lowTot += (GraphBuffer[i+j] & 0xffff); |
112 | } |
113 | for (j = 0; j < 15; j++) { |
114 | highTot += (GraphBuffer[i+j] >> 16); |
115 | } |
116 | GraphBuffer[i] = lowTot - highTot; |
117 | } |
118 | |
119 | GraphTraceLen -= (convLen + 16); |
120 | |
121 | RepaintGraphWindow(); |
122 | |
123 | // TI tag data format is 16 prebits, 8 start bits, 64 data bits, |
124 | // 16 crc CCITT bits, 8 stop bits, 15 end bits |
125 | |
126 | // the 16 prebits are always low |
127 | // the 8 start and stop bits of a tag must match |
128 | // the start/stop prebits of a ro tag are 01111110 |
129 | // the start/stop prebits of a rw tag are 11111110 |
130 | // the 15 end bits of a ro tag are all low |
131 | // the 15 end bits of a rw tag match bits 15-1 of the data bits |
132 | |
133 | // Okay, so now we have unsliced soft decisions; |
134 | // find bit-sync, and then get some bits. |
135 | // look for 17 low bits followed by 6 highs (common pattern for ro and rw tags) |
136 | int max = 0, maxPos = 0; |
137 | for (i = 0; i < 6000; i++) { |
138 | int j; |
139 | int dec = 0; |
140 | // searching 17 consecutive lows |
141 | for (j = 0; j < 17*lowLen; j++) { |
142 | dec -= GraphBuffer[i+j]; |
143 | } |
144 | // searching 7 consecutive highs |
145 | for (; j < 17*lowLen + 6*highLen; j++) { |
146 | dec += GraphBuffer[i+j]; |
147 | } |
148 | if (dec > max) { |
149 | max = dec; |
150 | maxPos = i; |
151 | } |
152 | } |
153 | |
154 | // place a marker in the buffer to visually aid location |
155 | // of the start of sync |
156 | GraphBuffer[maxPos] = 800; |
157 | GraphBuffer[maxPos+1] = -800; |
158 | |
159 | // advance pointer to start of actual data stream (after 16 pre and 8 start bits) |
160 | maxPos += 17*lowLen; |
161 | maxPos += 6*highLen; |
162 | |
163 | // place a marker in the buffer to visually aid location |
164 | // of the end of sync |
165 | GraphBuffer[maxPos] = 800; |
166 | GraphBuffer[maxPos+1] = -800; |
167 | |
168 | PrintAndLog("actual data bits start at sample %d", maxPos); |
169 | |
170 | PrintAndLog("length %d/%d", highLen, lowLen); |
171 | |
172 | uint8_t bits[1+64+16+8+16]; |
173 | bits[sizeof(bits)-1] = '\0'; |
174 | |
175 | uint32_t shift3 = 0x7e000000, shift2 = 0, shift1 = 0, shift0 = 0; |
176 | |
177 | for (i = 0; i < arraylen(bits)-1; i++) { |
178 | int high = 0; |
179 | int low = 0; |
180 | int j; |
181 | for (j = 0; j < lowLen; j++) { |
182 | low -= GraphBuffer[maxPos+j]; |
183 | } |
184 | for (j = 0; j < highLen; j++) { |
185 | high += GraphBuffer[maxPos+j]; |
186 | } |
187 | |
188 | if (high > low) { |
189 | bits[i] = '1'; |
190 | maxPos += highLen; |
191 | // bitstream arrives lsb first so shift right |
192 | shift3 |= (1<<31); |
193 | } else { |
194 | bits[i] = '.'; |
195 | maxPos += lowLen; |
196 | } |
197 | |
198 | // 128 bit right shift register |
199 | shift0 = (shift0>>1) | (shift1 << 31); |
200 | shift1 = (shift1>>1) | (shift2 << 31); |
201 | shift2 = (shift2>>1) | (shift3 << 31); |
202 | shift3 >>= 1; |
203 | |
204 | // place a marker in the buffer between bits to visually aid location |
205 | GraphBuffer[maxPos] = 800; |
206 | GraphBuffer[maxPos+1] = -800; |
207 | } |
208 | PrintAndLog("Info: raw tag bits = %s", bits); |
209 | |
210 | TagType = (shift3>>8)&0xff; |
211 | if ( TagType != ((shift0>>16)&0xff) ) { |
212 | PrintAndLog("Error: start and stop bits do not match!"); |
213 | return 0; |
214 | } |
215 | else if (TagType == 0x7e) { |
216 | PrintAndLog("Info: Readonly TI tag detected."); |
217 | return 0; |
218 | } |
219 | else if (TagType == 0xfe) { |
220 | PrintAndLog("Info: Rewriteable TI tag detected."); |
221 | |
222 | // put 64 bit data into shift1 and shift0 |
223 | shift0 = (shift0>>24) | (shift1 << 8); |
224 | shift1 = (shift1>>24) | (shift2 << 8); |
225 | |
226 | // align 16 bit crc into lower half of shift2 |
227 | shift2 = ((shift2>>24) | (shift3 << 8)) & 0x0ffff; |
228 | |
229 | // align 16 bit "end bits" or "ident" into lower half of shift3 |
230 | shift3 >>= 16; |
231 | |
232 | // only 15 bits compare, last bit of ident is not valid |
233 | if ( (shift3^shift0)&0x7fff ) { |
234 | PrintAndLog("Error: Ident mismatch!"); |
235 | } |
236 | // WARNING the order of the bytes in which we calc crc below needs checking |
237 | // i'm 99% sure the crc algorithm is correct, but it may need to eat the |
238 | // bytes in reverse or something |
239 | // calculate CRC |
240 | crc=0; |
241 | crc = update_crc16(crc, (shift0)&0xff); |
242 | crc = update_crc16(crc, (shift0>>8)&0xff); |
243 | crc = update_crc16(crc, (shift0>>16)&0xff); |
244 | crc = update_crc16(crc, (shift0>>24)&0xff); |
245 | crc = update_crc16(crc, (shift1)&0xff); |
246 | crc = update_crc16(crc, (shift1>>8)&0xff); |
247 | crc = update_crc16(crc, (shift1>>16)&0xff); |
248 | crc = update_crc16(crc, (shift1>>24)&0xff); |
249 | PrintAndLog("Info: Tag data = %08X%08X", shift1, shift0); |
250 | if (crc != (shift2&0xffff)) { |
251 | PrintAndLog("Error: CRC mismatch, calculated %04X, got ^04X", crc, shift2&0xffff); |
252 | } else { |
253 | PrintAndLog("Info: CRC %04X is good", crc); |
254 | } |
255 | } |
256 | else { |
257 | PrintAndLog("Unknown tag type."); |
258 | return 0; |
259 | } |
260 | return 0; |
261 | } |
262 | |
263 | // read a TI tag and return its ID |
264 | int CmdTIRead(const char *Cmd) |
265 | { |
266 | UsbCommand c = {CMD_READ_TI_TYPE}; |
267 | SendCommand(&c); |
268 | return 0; |
269 | } |
270 | |
271 | // write new data to a r/w TI tag |
272 | int CmdTIWrite(const char *Cmd) |
273 | { |
274 | UsbCommand c = {CMD_WRITE_TI_TYPE}; |
275 | int res = 0; |
276 | |
4c16ae80 |
277 | res = sscanf(Cmd, "%012" SCNx64 " %012" SCNx64 " %012" SCNx64 "", &c.arg[0], &c.arg[1], &c.arg[2]); |
5c2b11eb |
278 | |
7fe9b0b7 |
279 | if (res == 2) c.arg[2]=0; |
280 | if (res < 2) |
281 | PrintAndLog("Please specify the data as two hex strings, optionally the CRC as a third"); |
282 | else |
283 | SendCommand(&c); |
284 | return 0; |
285 | } |
286 | |
287 | static command_t CommandTable[] = |
288 | { |
289 | {"help", CmdHelp, 1, "This help"}, |
290 | {"demod", CmdTIDemod, 1, "Demodulate raw bits for TI-type LF tag"}, |
291 | {"read", CmdTIRead, 0, "Read and decode a TI 134 kHz tag"}, |
292 | {"write", CmdTIWrite, 0, "Write new data to a r/w TI 134 kHz tag"}, |
293 | {NULL, NULL, 0, NULL} |
294 | }; |
295 | |
296 | int CmdLFTI(const char *Cmd) |
297 | { |
298 | CmdsParse(CommandTable, Cmd); |
299 | return 0; |
300 | } |
301 | |
302 | int CmdHelp(const char *Cmd) |
303 | { |
304 | CmdsHelp(CommandTable); |
305 | return 0; |
306 | } |