git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency T55xx commands
   8 //-----------------------------------------------------------------------------
   9
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <inttypes.h>
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdmain.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"
  19 #include "cmdlf.h"
  20 #include "cmdlft55xx.h"
  21 #include "util.h"
  22 #include "data.h"
  23 #include "lfdemod.h"
  24
  25 #define LF_TRACE_BUFF_SIZE 20000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)
  26 #define LF_BITSSTREAM_LEN 1000 // more then 1000 bits shouldn't happend..  8block * 4 bytes * 8bits =
  27
  28 int usage_t55xx_rd(){
  29         PrintAndLog("Usage:  lf t55xx rd <block> <password>");
  30     PrintAndLog("     <block>, block number to read. Between 0-7");
  31     PrintAndLog("     <password>, OPTIONAL password (8 hex characters)");
  32     PrintAndLog("");
  33     PrintAndLog("    sample: lf t55xx rd 0           = try reading data from block 0");
  34         PrintAndLog("          : lf t55xx rd 0 feedbeef  = try reading data from block 0 using password");
  35         PrintAndLog("");
  36         return 0;
  37 }
  38 int usage_t55xx_wr(){
  39         PrintAndLog("Usage:  lf t55xx wr <block> <data> [password]");
  40     PrintAndLog("     <block>, block number to read. Between 0-7");
  41         PrintAndLog("     <data>,  4 bytes of data to write (8 hex characters)");
  42     PrintAndLog("     [password], OPTIONAL password 4bytes (8 hex characters)");
  43     PrintAndLog("");
  44     PrintAndLog("    sample: lf t55xx wd 3 11223344  = try writing data 11223344 to block 3");
  45         PrintAndLog("          : lf t55xx wd 3 11223344 feedbeef  = try writing data 11223344 to block 3 using password feedbeef");
  46         PrintAndLog("");
  47         return 0;
  48 }
  49 int usage_t55xx_trace() {
  50         PrintAndLog("Usage:  lf t55xx trace  [graph buffer data]");
  51         PrintAndLog("     [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");
  52         PrintAndLog("");
  53         PrintAndLog("     sample: lf t55xx trace");
  54         PrintAndLog("           : lf t55xx trace 1");
  55         PrintAndLog("");
  56         return 0;
  57 }
  58 int usage_t55xx_info() {
  59         PrintAndLog("Usage:  lf t55xx info [graph buffer data]");
  60         PrintAndLog("     [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");
  61         PrintAndLog("");
  62         PrintAndLog("    sample: lf t55xx info");
  63         PrintAndLog("          : lf t55xx info 1");
  64         PrintAndLog("");
  65         return 0;
  66 }
  67 int usage_t55xx_dump(){
  68         PrintAndLog("Usage:  lf t55xx dump <password>");
  69     PrintAndLog("     <password>, OPTIONAL password 4bytes (8 hex characters)");
  70         PrintAndLog("");
  71         PrintAndLog("        sample: lf t55xx dump");
  72         PrintAndLog("              : lf t55xx dump feedbeef");
  73         PrintAndLog("");
  74         return 0;
  75 }
  76
  77 static int CmdHelp(const char *Cmd);
  78
  79 int CmdReadBlk(const char *Cmd)
  80 {
  81         int invert = 0;
  82         int clk = 0;
  83         int block = -1;
  84         int password = 0xFFFFFFFF; //default to blank Block 7
  85         int errCnt;
  86         size_t bitlen;
  87         int maxErr = 100;
  88     //uint8_t askAmp = 0;
  89         uint32_t blockData;
  90         uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};
  91
  92
  93         char cmdp = param_getchar(Cmd, 0);
  94         if (cmdp == 'h' || cmdp == 'H') {
  95                 usage_t55xx_rd();
  96                 return 0;
  97         }
  98
  99         int res = sscanf(Cmd, "%d %x", &block, &password);
 100
 101         if ( res < 1 || res > 2 ){
 102                 usage_t55xx_rd();
 103                 return 1;
 104         }
 105
 106         if ((block < 0) | (block > 7)) {
 107                 PrintAndLog("Block must be between 0 and 7");
 108                 return 1;
 109         }
 110
 111         UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, block, 0}};
 112         c.d.asBytes[0] = 0x0;
 113
 114         //Password mode
 115         if ( res == 2 ) {
 116                 c.arg[2] = password;
 117                 c.d.asBytes[0] = 0x1;
 118         }
 119
 120         SendCommand(&c);
 121         if ( !WaitForResponseTimeout(CMD_ACK,NULL,1500) ) {
 122                 PrintAndLog("command execution time out");
 123                 return 2;
 124         }
 125
 126         CmdSamples("12000");
 127
 128         bitlen = getFromGraphBuf(bits);
 129
 130         //errCnt = askrawdemod(bits, &bitlen, &clk, &invert, maxErr, askAmp);
 131         errCnt = askmandemod(bits, &bitlen, &clk, &invert, maxErr);
 132
 133         //throw away static - allow 1 and -1 (in case of threshold command first)
 134         if ( errCnt == -1 || bitlen < 16 ){
 135                 PrintAndLog("no data found");
 136                 if (g_debugMode)
 137                         PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
 138                 return 3;
 139         }
 140         if (g_debugMode)
 141                 PrintAndLog("Using Clock: %d - invert: %d - Bits Found: %d", clk, invert, bitlen);
 142
 143         //move bits back to DemodBuffer
 144         setDemodBuf(bits, bitlen, 0);
 145         printBitStream(bits,bitlen);
 146
 147         // bits has the manchester encoded data.
 148         errCnt = manrawdecode(bits, &bitlen);
 149         if ( errCnt == -1 || bitlen < 16 ){
 150                 PrintAndLog("no data found");
 151                 if (g_debugMode)
 152                         PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
 153                 return 4;
 154         }
 155
 156         blockData = PackBits(1, 32, bits);
 157
 158         if ( block < 0)
 159                 PrintAndLog(" Decoded     : 0x%08X  %s", blockData, sprint_bin(bits+1,32) );
 160         else
 161                 PrintAndLog(" Block %d    : 0x%08X  %s", block, blockData, sprint_bin(bits+1,32) );
 162
 163         return 0;
 164 }
 165
 166 int CmdWriteBlk(const char *Cmd)
 167 {
 168         int block = 8; //default to invalid block
 169         int data = 0xFFFFFFFF; //default to blank Block
 170         int password = 0xFFFFFFFF; //default to blank Block 7
 171
 172         char cmdp = param_getchar(Cmd, 0);
 173         if (cmdp == 'h' || cmdp == 'H') {
 174                 usage_t55xx_wr();
 175                 return 0;
 176         }
 177
 178         int res = sscanf(Cmd, "%d %x %x",&block, &data, &password);
 179
 180         if ( res < 2 || res > 3) {
 181                 usage_t55xx_wr();
 182                 return 1;
 183         }
 184
 185         if (block > 7) {
 186                 PrintAndLog("Block must be between 0 and 7");
 187                 return 1;
 188         }
 189
 190         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};
 191         c.d.asBytes[0] = 0x0;
 192
 193         if (res == 2) {
 194                 PrintAndLog("Writing block %d  data %08X", block, data);
 195         } else {
 196                 //Password mode
 197                 c.arg[2] = password;
 198                 c.d.asBytes[0] = 0x1;
 199                 PrintAndLog("Writing block %d  data %08X  password %08X", block, data, password);
 200         }
 201
 202         SendCommand(&c);
 203         return 0;
 204 }
 205
 206 int CmdReadTrace(const char *Cmd)
 207 {
 208         int invert = 0;
 209         int clk = 0;
 210         int errCnt;
 211         size_t bitlen;
 212         int maxErr = 100;
 213         uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};
 214
 215         char cmdp = param_getchar(Cmd, 0);
 216
 217         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 218                 usage_t55xx_trace();
 219                 return 0;
 220         }
 221
 222         if ( strlen(Cmd)==0){
 223
 224                 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
 225                 SendCommand(&c);
 226                 WaitForResponse(CMD_ACK, NULL);
 227
 228                 CmdSamples("12000");
 229         }
 230
 231         bitlen = getFromGraphBuf(bits);
 232
 233         //errCnt = askrawdemod(bits, &bitlen, &clk, &invert, maxErr, askAmp);
 234         errCnt = askmandemod(bits, &bitlen, &clk, &invert, maxErr);
 235
 236         //throw away static - allow 1 and -1 (in case of threshold command first)
 237         if ( errCnt == -1 || bitlen < 16 ){
 238                 PrintAndLog("no data found");
 239                 if (g_debugMode)
 240                         PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
 241                 return 3;
 242         }
 243         if (g_debugMode)
 244                 PrintAndLog("Using Clock: %d - invert: %d - Bits Found: %d", clk, invert, bitlen);
 245
 246         //move bits back to DemodBuffer
 247         setDemodBuf(bits, bitlen, 0);
 248
 249         // bits has the manchester encoded data.
 250         errCnt = manrawdecode(bits, &bitlen);
 251         if ( errCnt == -1 || bitlen < 16 ){
 252                 PrintAndLog("no data found");
 253                 if (g_debugMode)
 254                         PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
 255                 return 4;
 256         }
 257
 258         RepaintGraphWindow();
 259
 260         uint8_t si = 5;
 261         uint32_t bl0     = PackBits(si, 32, bits);
 262         uint32_t bl1     = PackBits(si+32, 32, bits);
 263
 264         uint32_t acl     = PackBits(si,  8, bits); si += 8;
 265         uint32_t mfc     = PackBits(si, 8, bits); si += 8;
 266         uint32_t cid     = PackBits(si, 5, bits); si += 5;
 267         uint32_t icr     = PackBits(si, 3, bits); si += 3;
 268         uint32_t year    = PackBits(si, 4, bits); si += 4;
 269         uint32_t quarter = PackBits(si, 2, bits); si += 2;
 270         uint32_t lotid    = PackBits(si, 12, bits); si += 12;
 271         uint32_t wafer   = PackBits(si, 5, bits); si += 5;
 272         uint32_t dw      = PackBits(si, 15, bits);
 273
 274         PrintAndLog("");
 275         PrintAndLog("-- T55xx Trace Information ----------------------------------");
 276         PrintAndLog("-------------------------------------------------------------");
 277         PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1)  : 0x%02X (%d)", acl, acl);
 278         PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x%02X (%d)", mfc, mfc);
 279         PrintAndLog(" CID                                     : 0x%02X (%d)", cid, cid);
 280         PrintAndLog(" ICR IC Revision                         : %d",icr );
 281         PrintAndLog(" Manufactured");
 282         PrintAndLog("     Year/Quarter : %d/%d",2000+year, quarter );
 283         PrintAndLog("     Lot ID       : %d", lotid );
 284         PrintAndLog("     Wafer number : %d", wafer);
 285         PrintAndLog("     Die Number   : %d", dw);
 286         PrintAndLog("-------------------------------------------------------------");
 287         PrintAndLog(" Raw Data - Page 1");
 288         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bits+5,32) );
 289         PrintAndLog("     Block 0  : 0x%08X  %s", bl1, sprint_bin(bits+37,32) );
 290         PrintAndLog("-------------------------------------------------------------");
 291         /*
 292         TRACE - BLOCK O
 293                 Bits    Definition                                                              HEX
 294                 1-8             ACL Allocation class (ISO/IEC 15963-1)  0xE0
 295                 9-16    MFC Manufacturer ID (ISO/IEC 7816-6)    0x15 Atmel Corporation
 296                 17-21   CID                                                                             0x1 = Atmel ATA5577M1  0x2 = Atmel ATA5577M2
 297                 22-24   ICR IC revision
 298                 25-28   YEAR (BCD encoded)                                              9 (= 2009)
 299                 29-30   QUARTER                                                                 1,2,3,4
 300                 31-32   LOT ID
 301
 302         TRACE - BLOCK 1
 303                 1-12    LOT ID
 304                 13-17   Wafer number
 305                 18-32   DW,  die number sequential
 306         */
 307
 308   return 0;
 309 }
 310
 311 int CmdInfo(const char *Cmd){
 312         /*
 313                 Page 0 Block 0 Configuration data.
 314                 Normal mode
 315                 Extended mode
 316         */
 317         char cmdp = param_getchar(Cmd, 0);
 318
 319         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 320                 usage_t55xx_info();
 321                 return 0;
 322         } else {
 323                 CmdReadBlk("0");
 324         }
 325
 326         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 327
 328         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
 329
 330         uint8_t si = 5;
 331         uint32_t bl0      = PackBits(si, 32, bits);
 332
 333         uint32_t safer    = PackBits(si, 4, bits); si += 4;
 334         uint32_t resv     = PackBits(si, 7, bits); si += 7;
 335         uint32_t dbr      = PackBits(si, 3, bits); si += 3;
 336         uint32_t extend   = PackBits(si, 1, bits); si += 1;
 337         uint32_t datamodulation   = PackBits(si, 5, bits); si += 5;
 338         uint32_t pskcf    = PackBits(si, 2, bits); si += 2;
 339         uint32_t aor      = PackBits(si, 1, bits); si += 1;
 340         uint32_t otp      = PackBits(si, 1, bits); si += 1;
 341         uint32_t maxblk   = PackBits(si, 3, bits); si += 3;
 342         uint32_t pwd      = PackBits(si, 1, bits); si += 1;
 343         uint32_t sst      = PackBits(si, 1, bits); si += 1;
 344         uint32_t fw       = PackBits(si, 1, bits); si += 1;
 345         uint32_t inv      = PackBits(si, 1, bits); si += 1;
 346         uint32_t por      = PackBits(si, 1, bits); si += 1;
 347
 348         PrintAndLog("");
 349         PrintAndLog("-- T55xx Configuration & Tag Information --------------------");
 350         PrintAndLog("-------------------------------------------------------------");
 351         PrintAndLog(" Safer key                 : %s", GetSaferStr(safer));
 352         PrintAndLog(" reserved                  : %d", resv);
 353         PrintAndLog(" Data bit rate             : %s", GetBitRateStr(dbr));
 354         PrintAndLog(" eXtended mode             : %s", (extend) ? "Yes - Warning":"No");
 355         PrintAndLog(" Modulation                : %s", GetModulationStr(datamodulation) );
 356         PrintAndLog(" PSK clock freq            : %d", pskcf);
 357         PrintAndLog(" AOR - Answer on Request   : %s", (aor) ? "Yes":"No");
 358         PrintAndLog(" OTP - One Time Pad        : %s", (otp) ? "Yes - Warning":"No" );
 359         PrintAndLog(" Max block                 : %d", maxblk);
 360         PrintAndLog(" Password mode             : %s", (pwd) ? "Yes":"No");
 361         PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
 362         PrintAndLog(" Fast Write                : %s", (fw) ? "Yes":"No");
 363         PrintAndLog(" Inverse data              : %s", (inv) ? "Yes":"No");
 364         PrintAndLog(" POR-Delay                 : %s", (por) ? "Yes":"No");
 365         PrintAndLog("-------------------------------------------------------------");
 366         PrintAndLog(" Raw Data - Page 0");
 367         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bits+5,32) );
 368         PrintAndLog("-------------------------------------------------------------");
 369
 370         return 0;
 371 }
 372
 373 int CmdDump(const char *Cmd){
 374
 375         char s[20] = {0x00};
 376         uint8_t pwd[4] = {0x00};
 377
 378         char cmdp = param_getchar(Cmd, 0);
 379         if ( cmdp == 'h' || cmdp == 'H') {
 380                 usage_t55xx_dump();
 381                 return 0;
 382         }
 383
 384         bool hasPwd = ( strlen(Cmd) > 0);
 385         if ( hasPwd ){
 386                 if (param_gethex(Cmd, 0, pwd, 8)) {
 387                         PrintAndLog("password must include 8 HEX symbols");
 388                         return 1;
 389                 }
 390         }
 391
 392         for ( int i = 0; i <8; ++i){
 393                 memset(s,0,sizeof(s));
 394                 if ( hasPwd ) {
 395                         sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
 396                 } else {
 397                         sprintf(s,"%d", i);
 398                 }
 399                 CmdReadBlk(s);
 400         }
 401         return 0;
 402 }
 403
 404 int CmdIceFsk(const char *Cmd){
 405
 406         if (!HasGraphData()) return 0;
 407
 408         iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
 409         RepaintGraphWindow();
 410         return 0;
 411 }
 412 int CmdIceManchester(const char *Cmd){
 413         ManchesterDemod( -1);
 414         return 0;
 415 }
 416 int ManchesterDemod(int blockNum){
 417
 418         if (!HasGraphData()) return 0;
 419
 420         uint8_t sizebyte = 32;
 421         // the value 5 was selected during empirical studies of the decoded data. Some signal noise to skip.
 422         uint8_t offset = 5;
 423         uint32_t blockData;
 424         uint8_t  bits[LF_BITSSTREAM_LEN] = {0x00};
 425         uint8_t * bitstream = bits;
 426
 427         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
 428         blockData = PackBits(offset, sizebyte, bits);
 429
 430         if ( blockNum < 0)
 431                 PrintAndLog(" Decoded     : 0x%08X  %s", blockData, sprint_bin(bitstream+offset,sizebyte) );
 432                 else
 433                 PrintAndLog(" Block %d    : 0x%08X  %s", blockNum, blockData, sprint_bin(bitstream+offset,sizebyte) );
 434
 435         return 0;
 436 }
 437
 438 char * GetBitRateStr(uint32_t id){
 439         static char buf[40];
 440         char *retStr = buf;
 441                 switch (id){
 442                 case 0:
 443                         sprintf(retStr,"%d - RF/8",id);
 444                         break;
 445                 case 1:
 446                         sprintf(retStr,"%d - RF/16",id);
 447                         break;
 448                 case 2:
 449                         sprintf(retStr,"%d - RF/32",id);
 450                         break;
 451                 case 3:
 452                         sprintf(retStr,"%d - RF/40",id);
 453                         break;
 454                 case 4:
 455                         sprintf(retStr,"%d - RF/50",id);
 456                         break;
 457                 case 5:
 458                         sprintf(retStr,"%d - RF/64",id);
 459                         break;
 460                 case 6:
 461                         sprintf(retStr,"%d - RF/100",id);
 462                         break;
 463                 case 7:
 464                         sprintf(retStr,"%d - RF/128",id);
 465                         break;
 466                 default:
 467                         sprintf(retStr,"%d - (Unknown)",id);
 468                         break;
 469                 }
 470
 471         return buf;
 472 }
 473
 474 char * GetSaferStr(uint32_t id){
 475         static char buf[40];
 476         char *retStr = buf;
 477
 478         sprintf(retStr,"%d",id);
 479         if (id == 6) {
 480                 sprintf(retStr,"%d - pasdwd",id);
 481         }
 482         if (id == 9 ){
 483                 sprintf(retStr,"%d - testmode ",id);
 484         }
 485
 486         return buf;
 487 }
 488 char * GetModulationStr( uint32_t id){
 489         static char buf[40];
 490         char *retStr = buf;
 491
 492         switch (id){
 493                 case 0:
 494                         sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
 495                         break;
 496                 case 1:
 497                         sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
 498                         break;
 499                 case 2:
 500                         sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
 501                         break;
 502                 case 3:
 503                         sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
 504                         break;
 505                 case 4:
 506                         sprintf(retStr,"%d - FSK 1 RF/8  RF/5",id);
 507                         break;
 508                 case 5:
 509                         sprintf(retStr,"%d - FSK 2 RF/8  RF/10",id);
 510                         break;
 511                 case 6:
 512                         sprintf(retStr,"%d - FSK 1a RF/5  RF/8",id);
 513                         break;
 514                 case 7:
 515                         sprintf(retStr,"%d - FSK 2a RF/10  RF/8",id);
 516                         break;
 517                 case 8:
 518                         sprintf(retStr,"%d - Manschester",id);
 519                         break;
 520                 case 16:
 521                         sprintf(retStr,"%d - Biphase",id);
 522                         break;
 523                 case 17:
 524                         sprintf(retStr,"%d - Reserved",id);
 525                         break;
 526                 default:
 527                         sprintf(retStr,"0x%02X (Unknown)",id);
 528                         break;
 529                 }
 530         return buf;
 531 }
 532
 533
 534 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
 535
 536         int i = start;
 537         int j = len-1;
 538         if (len > 32) {
 539                 return 0;
 540         }
 541         uint32_t tmp = 0;
 542         for (; j >= 0; --j, ++i){
 543                 tmp     |= bits[i] << j;
 544         }
 545         return tmp;
 546 }
 547
 548 static command_t CommandTable[] =
 549 {
 550   {"help",   CmdHelp,        1, "This help"},
 551   {"rd",     CmdReadBlk,     0, "<block> [password] -- Read T55xx block data (page 0) [optional password]"},
 552   {"wr",     CmdWriteBlk,    0, "<block> <data> [password] -- Write T55xx block data (page 0) [optional password]"},
 553   {"trace",  CmdReadTrace,   0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},
 554   {"info",   CmdInfo,        0, "[1] Read T55xx configuration data (page 0/ blk 0)"},
 555   {"dump",   CmdDump,        0, "[password] Dump T55xx card block 0-7. [optional password]"},
 556   {"man",    CmdIceManchester,      0, "Manchester demod (with SST)"},
 557   {NULL, NULL, 0, NULL}
 558 };
 559
 560 int CmdLFT55XX(const char *Cmd)
 561 {
 562   CmdsParse(CommandTable, Cmd);
 563   return 0;
 564 }
 565
 566 int CmdHelp(const char *Cmd)
 567 {
 568   CmdsHelp(CommandTable);
 569   return 0;
 570 }