]> git.zerfleddert.de Git - proxmark3-svn/blob - common/lfdemod.c
projects / proxmark3-svn / blob
? search:


11ad1403eced9b20b56384131b1368249d68039b
[proxmark3-svn] / common / lfdemod.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2014
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdlib.h>
12 #include <string.h>
13 #include "lfdemod.h"
14
15 //by marshmellow
16 //takes 1s and 0s and searches for EM410x format - output EM ID
17 uint64_t Em410xDecode(uint8_t *BitStream, size_t size)
18 {
19 //no arguments needed - built this way in case we want this to be a direct call from "data " cmds in the future
20 // otherwise could be a void with no arguments
21 //set defaults
22 int high=0, low=128;
23 uint64_t lo=0;
24
25 uint32_t i = 0;
26 uint32_t initLoopMax = 65;
27 if (initLoopMax>size) initLoopMax=size;
28
29 for (;i < initLoopMax; ++i) //65 samples should be plenty to find high and low values
30 {
31 if (BitStream[i] > high)
32 high = BitStream[i];
33 else if (BitStream[i] < low)
34 low = BitStream[i];
35 }
36 if (((high !=1)||(low !=0))){ //allow only 1s and 0s
37 // PrintAndLog("no data found");
38 return 0;
39 }
40 uint8_t parityTest=0;
41 // 111111111 bit pattern represent start of frame
42 uint8_t frame_marker_mask[] = {1,1,1,1,1,1,1,1,1};
43 uint32_t idx = 0;
44 uint32_t ii=0;
45 uint8_t resetCnt = 0;
46 while( (idx + 64) < size) {
47 restart:
48 // search for a start of frame marker
49 if ( memcmp(BitStream+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0)
50 { // frame marker found
51 idx+=9;
52 for (i=0; i<10;i++){
53 for(ii=0; ii<5; ++ii){
54 parityTest += BitStream[(i*5)+ii+idx];
55 }
56 if (parityTest== ((parityTest>>1)<<1)){
57 parityTest=0;
58 for (ii=0; ii<4;++ii){
59 lo=(lo<<1LL)|(BitStream[(i*5)+ii+idx]);
60 }
61 //PrintAndLog("DEBUG: EM parity passed parity val: %d, i:%d, ii:%d,idx:%d, Buffer: %d%d%d%d%d,lo: %d",parityTest,i,ii,idx,BitStream[idx+ii+(i*5)-5],BitStream[idx+ii+(i*5)-4],BitStream[idx+ii+(i*5)-3],BitStream[idx+ii+(i*5)-2],BitStream[idx+ii+(i*5)-1],lo);
62 }else {//parity failed
63 //PrintAndLog("DEBUG: EM parity failed parity val: %d, i:%d, ii:%d,idx:%d, Buffer: %d%d%d%d%d",parityTest,i,ii,idx,BitStream[idx+ii+(i*5)-5],BitStream[idx+ii+(i*5)-4],BitStream[idx+ii+(i*5)-3],BitStream[idx+ii+(i*5)-2],BitStream[idx+ii+(i*5)-1]);
64 parityTest=0;
65 idx-=8;
66 if (resetCnt>5)return 0;
67 resetCnt++;
68 goto restart;//continue;
69 }
70 }
71 //skip last 5 bit parity test for simplicity.
72 return lo;
73 }else{
74 idx++;
75 }
76 }
77 return 0;
78 }
79
80 //by marshmellow
81 //takes 2 arguments - clock and invert both as integers
82 //attempts to demodulate ask while decoding manchester
83 //prints binary found and saves in graphbuffer for further commands
84 int askmandemod(uint8_t *BinStream, size_t *size, int *clk, int *invert)
85 {
86 int i;
87 int high = 0, low = 128;
88 *clk=DetectASKClock(BinStream, *size, *clk); //clock default
89
90 if (*clk<8) *clk =64;
91 if (*clk<32) *clk=32;
92 if (*invert != 0 && *invert != 1) *invert=0;
93 uint32_t initLoopMax = 200;
94 if (initLoopMax > *size) initLoopMax=*size;
95 // Detect high and lows
96 for (i = 0; i < initLoopMax; ++i) //200 samples should be enough to find high and low values
97 {
98 if (BinStream[i] > high)
99 high = BinStream[i];
100 else if (BinStream[i] < low)
101 low = BinStream[i];
102 }
103 if ((high < 158) ){ //throw away static
104 //PrintAndLog("no data found");
105 return -2;
106 }
107 //25% fuzz in case highs and lows aren't clipped [marshmellow]
108 high=(int)(((high-128)*.75)+128);
109 low= (int)(((low-128)*.75)+128);
110
111 //PrintAndLog("DEBUG - valid high: %d - valid low: %d",high,low);
112 int lastBit = 0; //set first clock check
113 uint32_t bitnum = 0; //output counter
114 int tol = 0; //clock tolerance adjust - waves will be accepted as within the clock if they fall + or - this value + clock from last valid wave
115 if (*clk==32)tol=1; //clock tolerance may not be needed anymore currently set to + or - 1 but could be increased for poor waves or removed entirely
116 int iii = 0;
117 uint32_t gLen = *size;
118 if (gLen > 3000) gLen=3000;
119 uint8_t errCnt =0;
120 uint32_t bestStart = *size;
121 uint32_t bestErrCnt = (*size/1000);
122 uint32_t maxErr = (*size/1000);
123 //PrintAndLog("DEBUG - lastbit - %d",lastBit);
124 //loop to find first wave that works
125 for (iii=0; iii < gLen; ++iii){
126 if ((BinStream[iii] >= high) || (BinStream[iii] <= low)){
127 lastBit=iii-*clk;
128 errCnt=0;
129 //loop through to see if this start location works
130 for (i = iii; i < *size; ++i) {
131 if ((BinStream[i] >= high) && ((i-lastBit) > (*clk-tol))){
132 lastBit+=*clk;
133 } else if ((BinStream[i] <= low) && ((i-lastBit) > (*clk-tol))){
134 //low found and we are expecting a bar
135 lastBit+=*clk;
136 } else {
137 //mid value found or no bar supposed to be here
138 if ((i-lastBit)>(*clk+tol)){
139 //should have hit a high or low based on clock!!
140
141 //debug
142 //PrintAndLog("DEBUG - no wave in expected area - location: %d, expected: %d-%d, lastBit: %d - resetting search",i,(lastBit+(clk-((int)(tol)))),(lastBit+(clk+((int)(tol)))),lastBit);
143
144 errCnt++;
145 lastBit+=*clk;//skip over until hit too many errors
146 if (errCnt>(maxErr)) break; //allow 1 error for every 1000 samples else start over
147 }
148 }
149 if ((i-iii) >(400 * *clk)) break; //got plenty of bits
150 }
151 //we got more than 64 good bits and not all errors
152 if ((((i-iii)/ *clk) > (64+errCnt)) && (errCnt<maxErr)) {
153 //possible good read
154 if (errCnt==0){
155 bestStart=iii;
156 bestErrCnt=errCnt;
157 break; //great read - finish
158 }
159 if (errCnt<bestErrCnt){ //set this as new best run
160 bestErrCnt=errCnt;
161 bestStart = iii;
162 }
163 }
164 }
165 }
166 if (bestErrCnt<maxErr){
167 //best run is good enough set to best run and set overwrite BinStream
168 iii=bestStart;
169 lastBit = bestStart - *clk;
170 bitnum=0;
171 for (i = iii; i < *size; ++i) {
172 if ((BinStream[i] >= high) && ((i-lastBit) > (*clk-tol))){
173 lastBit += *clk;
174 BinStream[bitnum] = *invert;
175 bitnum++;
176 } else if ((BinStream[i] <= low) && ((i-lastBit) > (*clk-tol))){
177 //low found and we are expecting a bar
178 lastBit+=*clk;
179 BinStream[bitnum] = 1-*invert;
180 bitnum++;
181 } else {
182 //mid value found or no bar supposed to be here
183 if ((i-lastBit)>(*clk+tol)){
184 //should have hit a high or low based on clock!!
185
186 //debug
187 //PrintAndLog("DEBUG - no wave in expected area - location: %d, expected: %d-%d, lastBit: %d - resetting search",i,(lastBit+(clk-((int)(tol)))),(lastBit+(clk+((int)(tol)))),lastBit);
188 if (bitnum > 0){
189 BinStream[bitnum]=77;
190 bitnum++;
191 }
192
193 lastBit+=*clk;//skip over error
194 }
195 }
196 if (bitnum >=400) break;
197 }
198 *size=bitnum;
199 } else{
200 *invert=bestStart;
201 *clk=iii;
202 return -1;
203 }
204 return bestErrCnt;
205 }
206
207 //by marshmellow
208 //take 10 and 01 and manchester decode
209 //run through 2 times and take least errCnt
210 int manrawdecode(uint8_t * BitStream, size_t *size)
211 {
212 int bitnum=0;
213 int errCnt =0;
214 int i=1;
215 int bestErr = 1000;
216 int bestRun = 0;
217 int ii=1;
218 for (ii=1;ii<3;++ii){
219 i=1;
220 for (i=i+ii;i<*size-2;i+=2){
221 if(BitStream[i]==1 && (BitStream[i+1]==0)){
222 } else if((BitStream[i]==0)&& BitStream[i+1]==1){
223 } else {
224 errCnt++;
225 }
226 if(bitnum>300) break;
227 }
228 if (bestErr>errCnt){
229 bestErr=errCnt;
230 bestRun=ii;
231 }
232 errCnt=0;
233 }
234 errCnt=bestErr;
235 if (errCnt<20){
236 ii=bestRun;
237 i=1;
238 for (i=i+ii;i < *size-2;i+=2){
239 if(BitStream[i] == 1 && (BitStream[i+1] == 0)){
240 BitStream[bitnum++]=0;
241 } else if((BitStream[i] == 0) && BitStream[i+1] == 1){
242 BitStream[bitnum++]=1;
243 } else {
244 BitStream[bitnum++]=77;
245 //errCnt++;
246 }
247 if(bitnum>300) break;
248 }
249 *size=bitnum;
250 }
251 return errCnt;
252 }
253
254
255 //by marshmellow
256 //take 01 or 10 = 0 and 11 or 00 = 1
257 int BiphaseRawDecode(uint8_t *BitStream, size_t *size, int offset)
258 {
259 uint8_t bitnum=0;
260 uint32_t errCnt =0;
261 uint32_t i=1;
262 i=offset;
263 for (;i<*size-2;i+=2){
264 if((BitStream[i]==1 && BitStream[i+1]==0) || (BitStream[i]==0 && BitStream[i+1]==1)){
265 BitStream[bitnum++]=1;
266 } else if((BitStream[i]==0 && BitStream[i+1]==0) || (BitStream[i]==1 && BitStream[i+1]==1)){
267 BitStream[bitnum++]=0;
268 } else {
269 BitStream[bitnum++]=77;
270 errCnt++;
271 }
272 if(bitnum>250) break;
273 }
274 *size=bitnum;
275 return errCnt;
276 }
277
278 //by marshmellow
279 //takes 2 arguments - clock and invert both as integers
280 //attempts to demodulate ask only
281 //prints binary found and saves in graphbuffer for further commands
282 int askrawdemod(uint8_t *BinStream, size_t *size, int *clk, int *invert)
283 {
284 uint32_t i;
285 // int invert=0; //invert default
286 int high = 0, low = 128;
287 *clk=DetectASKClock(BinStream, *size, *clk); //clock default
288 uint8_t BitStream[502] = {0};
289
290 if (*clk<8) *clk =64;
291 if (*clk<32) *clk=32;
292 if (*invert != 0 && *invert != 1) *invert =0;
293 uint32_t initLoopMax = 200;
294 if (initLoopMax > *size) initLoopMax=*size;
295 // Detect high and lows
296 for (i = 0; i < initLoopMax; ++i) //200 samples should be plenty to find high and low values
297 {
298 if (BinStream[i] > high)
299 high = BinStream[i];
300 else if (BinStream[i] < low)
301 low = BinStream[i];
302 }
303 if ((high < 134)){ //throw away static high has to be more than 6 on graph. noise <= -10 here
304 // PrintAndLog("no data found");
305 return -2;
306 }
307 //25% fuzz in case highs and lows aren't clipped [marshmellow]
308 high=(int)(((high-128)*.75)+128);
309 low= (int)(((low-128)*.75)+128);
310
311 //PrintAndLog("DEBUG - valid high: %d - valid low: %d",high,low);
312 int lastBit = 0; //set first clock check
313 uint32_t bitnum = 0; //output counter
314 uint8_t tol = 0; //clock tolerance adjust - waves will be accepted as within the clock
315 // if they fall + or - this value + clock from last valid wave
316 if (*clk == 32) tol=1; //clock tolerance may not be needed anymore currently set to
317 // + or - 1 but could be increased for poor waves or removed entirely
318 uint32_t iii = 0;
319 uint32_t gLen = *size;
320 if (gLen > 500) gLen=500;
321 uint8_t errCnt =0;
322 uint32_t bestStart = *size;
323 uint32_t bestErrCnt = (*size/1000);
324 uint8_t midBit=0;
325 //PrintAndLog("DEBUG - lastbit - %d",lastBit);
326 //loop to find first wave that works
327 for (iii=0; iii < gLen; ++iii){
328 if ((BinStream[iii]>=high) || (BinStream[iii]<=low)){
329 lastBit=iii-*clk;
330 //loop through to see if this start location works
331 for (i = iii; i < *size; ++i) {
332 if ((BinStream[i] >= high) && ((i-lastBit)>(*clk-tol))){
333 lastBit+=*clk;
334 BitStream[bitnum] = *invert;
335 bitnum++;
336 midBit=0;
337 } else if ((BinStream[i] <= low) && ((i-lastBit)>(*clk-tol))){
338 //low found and we are expecting a bar
339 lastBit+=*clk;
340 BitStream[bitnum] = 1- *invert;
341 bitnum++;
342 midBit=0;
343 } else if ((BinStream[i]<=low) && (midBit==0) && ((i-lastBit)>((*clk/2)-tol))){
344 //mid bar?
345 midBit=1;
346 BitStream[bitnum]= 1- *invert;
347 bitnum++;
348 } else if ((BinStream[i]>=high) && (midBit==0) && ((i-lastBit)>((*clk/2)-tol))){
349 //mid bar?
350 midBit=1;
351 BitStream[bitnum]= *invert;
352 bitnum++;
353 } else if ((i-lastBit)>((*clk/2)+tol) && (midBit==0)){
354 //no mid bar found
355 midBit=1;
356 BitStream[bitnum]= BitStream[bitnum-1];
357 bitnum++;
358 } else {
359 //mid value found or no bar supposed to be here
360
361 if ((i-lastBit)>(*clk+tol)){
362 //should have hit a high or low based on clock!!
363 //debug
364 //PrintAndLog("DEBUG - no wave in expected area - location: %d, expected: %d-%d, lastBit: %d - resetting search",i,(lastBit+(clk-((int)(tol)))),(lastBit+(clk+((int)(tol)))),lastBit);
365 if (bitnum > 0){
366 BitStream[bitnum]=77;
367 bitnum++;
368 }
369
370 errCnt++;
371 lastBit+=*clk;//skip over until hit too many errors
372 if (errCnt > ((*size/1000))){ //allow 1 error for every 1000 samples else start over
373 errCnt=0;
374 bitnum=0;//start over
375 break;
376 }
377 }
378 }
379 if (bitnum>500) break;
380 }
381 //we got more than 64 good bits and not all errors
382 if ((bitnum > (64+errCnt)) && (errCnt<(*size/1000))) {
383 //possible good read
384 if (errCnt==0) break; //great read - finish
385 if (bestStart == iii) break; //if current run == bestErrCnt run (after exhausted testing) then finish
386 if (errCnt<bestErrCnt){ //set this as new best run
387 bestErrCnt=errCnt;
388 bestStart = iii;
389 }
390 }
391 }
392 if (iii>=gLen){ //exhausted test
393 //if there was a ok test go back to that one and re-run the best run (then dump after that run)
394 if (bestErrCnt < (*size/1000)) iii=bestStart;
395 }
396 }
397 if (bitnum>16){
398 for (i=0; i < bitnum; ++i){
399 BinStream[i]=BitStream[i];
400 }
401 *size=bitnum;
402 } else return -1;
403 return errCnt;
404 }
405 //translate wave to 11111100000 (1 for each short wave 0 for each long wave)
406 size_t fsk_wave_demod(uint8_t * dest, size_t size, uint8_t fchigh, uint8_t fclow)
407 {
408 uint32_t last_transition = 0;
409 uint32_t idx = 1;
410 //uint32_t maxVal=0;
411 if (fchigh==0) fchigh=10;
412 if (fclow==0) fclow=8;
413 //set the threshold close to 0 (graph) to avoid static
414 uint8_t threshold_value = 134; //(uint8_t)(((maxVal-128)*.75)+128);
415
416 // sync to first lo-hi transition, and threshold
417
418 // Need to threshold first sample
419
420 if(dest[0] < threshold_value) dest[0] = 0;
421 else dest[0] = 1;
422
423 size_t numBits = 0;
424 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
425 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
426 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
427 for(idx = 1; idx < size; idx++) {
428 // threshold current value
429
430 if (dest[idx] < threshold_value) dest[idx] = 0;
431 else dest[idx] = 1;
432
433 // Check for 0->1 transition
434 if (dest[idx-1] < dest[idx]) { // 0 -> 1 transition
435 if ((idx-last_transition)<(fclow-2)){ //0-5 = garbage noise
436 //do nothing with extra garbage
437 } else if ((idx-last_transition) < (fchigh-1)) { //6-8 = 8 waves
438 dest[numBits]=1;
439 } else { //9+ = 10 waves
440 dest[numBits]=0;
441 }
442 last_transition = idx;
443 numBits++;
444 }
445 }
446 return numBits; //Actually, it returns the number of bytes, but each byte represents a bit: 1 or 0
447 }
448
449 uint32_t myround2(float f)
450 {
451 if (f >= 2000) return 2000;//something bad happened
452 return (uint32_t) (f + (float)0.5);
453 }
454
455 //translate 11111100000 to 10
456 size_t aggregate_bits(uint8_t *dest, size_t size, uint8_t rfLen, uint8_t maxConsequtiveBits,
457 uint8_t invert, uint8_t fchigh, uint8_t fclow)
458 {
459 uint8_t lastval=dest[0];
460 uint32_t idx=0;
461 size_t numBits=0;
462 uint32_t n=1;
463
464 for( idx=1; idx < size; idx++) {
465
466 if (dest[idx]==lastval) {
467 n++;
468 continue;
469 }
470 //if lastval was 1, we have a 1->0 crossing
471 if ( dest[idx-1]==1 ) {
472 n=myround2((float)(n+1)/((float)(rfLen)/(float)fclow));
473 } else {// 0->1 crossing
474 n=myround2((float)(n+1)/((float)(rfLen-2)/(float)fchigh)); //-2 for fudge factor
475 }
476 if (n == 0) n = 1;
477
478 if(n < maxConsequtiveBits) //Consecutive
479 {
480 if(invert==0){ //invert bits
481 memset(dest+numBits, dest[idx-1] , n);
482 }else{
483 memset(dest+numBits, dest[idx-1]^1 , n);
484 }
485 numBits += n;
486 }
487 n=0;
488 lastval=dest[idx];
489 }//end for
490 return numBits;
491 }
492 //by marshmellow (from holiman's base)
493 // full fsk demod from GraphBuffer wave to decoded 1s and 0s (no mandemod)
494 int fskdemod(uint8_t *dest, size_t size, uint8_t rfLen, uint8_t invert, uint8_t fchigh, uint8_t fclow)
495 {
496 // FSK demodulator
497 size = fsk_wave_demod(dest, size, fchigh, fclow);
498 size = aggregate_bits(dest, size, rfLen, 192, invert, fchigh, fclow);
499 return size;
500 }
501 // loop to get raw HID waveform then FSK demodulate the TAG ID from it
502 int HIDdemodFSK(uint8_t *dest, size_t size, uint32_t *hi2, uint32_t *hi, uint32_t *lo)
503 {
504
505 size_t idx=0; //, found=0; //size=0,
506 // FSK demodulator
507 size = fskdemod(dest, size,50,0,10,8);
508
509 // final loop, go over previously decoded manchester data and decode into usable tag ID
510 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
511 uint8_t frame_marker_mask[] = {1,1,1,0,0,0};
512 int numshifts = 0;
513 idx = 0;
514 //one scan
515 while( idx + sizeof(frame_marker_mask) < size) {
516 // search for a start of frame marker
517 if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0)
518 { // frame marker found
519 idx+=sizeof(frame_marker_mask);
520 while(dest[idx] != dest[idx+1] && idx < size-2)
521 {
522 // Keep going until next frame marker (or error)
523 // Shift in a bit. Start by shifting high registers
524 *hi2 = (*hi2<<1)|(*hi>>31);
525 *hi = (*hi<<1)|(*lo>>31);
526 //Then, shift in a 0 or one into low
527 if (dest[idx] && !dest[idx+1]) // 1 0
528 *lo=(*lo<<1)|0;
529 else // 0 1
530 *lo=(*lo<<1)|1;
531 numshifts++;
532 idx += 2;
533 }
534 // Hopefully, we read a tag and hit upon the next frame marker
535 if(idx + sizeof(frame_marker_mask) < size)
536 {
537 if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0)
538 {
539 //good return
540 return idx;
541 }
542 }
543 // reset
544 *hi2 = *hi = *lo = 0;
545 numshifts = 0;
546 }else {
547 idx++;
548 }
549 }
550 return -1;
551 }
552
553 uint32_t bytebits_to_byte(uint8_t* src, size_t numbits)
554 {
555 uint32_t num = 0;
556 for(int i = 0 ; i < numbits ; i++)
557 {
558 num = (num << 1) | (*src);
559 src++;
560 }
561 return num;
562 }
563
564 int IOdemodFSK(uint8_t *dest, size_t size)
565 {
566 static const uint8_t THRESHOLD = 134;
567 uint32_t idx=0;
568 //make sure buffer has data
569 if (size < 66) return -1;
570 //test samples are not just noise
571 uint8_t justNoise = 1;
572 for(idx=0;idx< size && justNoise ;idx++){
573 justNoise = dest[idx] < THRESHOLD;
574 }
575 if(justNoise) return 0;
576
577 // FSK demodulator
578 size = fskdemod(dest, size, 64, 1, 10, 8); // RF/64 and invert
579 if (size < 65) return -1; //did we get a good demod?
580 //Index map
581 //0 10 20 30 40 50 60
582 //| | | | | | |
583 //01234567 8 90123456 7 89012345 6 78901234 5 67890123 4 56789012 3 45678901 23
584 //-----------------------------------------------------------------------------
585 //00000000 0 11110000 1 facility 1 version* 1 code*one 1 code*two 1 ???????? 11
586 //
587 //XSF(version)facility:codeone+codetwo
588 //Handle the data
589 uint8_t mask[] = {0,0,0,0,0,0,0,0,0,1};
590 for( idx=0; idx < (size - 65); idx++) {
591 if ( memcmp(dest + idx, mask, sizeof(mask))==0) {
592 //frame marker found
593 if (!dest[idx+8] && dest[idx+17]==1 && dest[idx+26]==1 && dest[idx+35]==1 && dest[idx+44]==1 && dest[idx+53]==1){
594 //confirmed proper separator bits found
595 //return start position
596 return (int) idx;
597 }
598 }
599 }
600 return 0;
601 }
602
603 // by marshmellow
604 // not perfect especially with lower clocks or VERY good antennas (heavy wave clipping)
605 // maybe somehow adjust peak trimming value based on samples to fix?
606 int DetectASKClock(uint8_t dest[], size_t size, int clock)
607 {
608 int i=0;
609 int peak=0;
610 int low=128;
611 int clk[]={16,32,40,50,64,100,128,256};
612 int loopCnt = 256; //don't need to loop through entire array...
613 if (size<loopCnt) loopCnt = size;
614
615 //if we already have a valid clock quit
616 for (;i<8;++i)
617 if (clk[i] == clock) return clock;
618
619 //get high and low peak
620 for (i=0; i < loopCnt; ++i){
621 if(dest[i] > peak){
622 peak = dest[i];
623 }
624 if(dest[i] < low){
625 low = dest[i];
626 }
627 }
628 peak=(int)(((peak-128)*.75)+128);
629 low= (int)(((low-128)*.75)+128);
630 int ii;
631 int clkCnt;
632 int tol = 0;
633 int bestErr[]={1000,1000,1000,1000,1000,1000,1000,1000};
634 int errCnt=0;
635 //test each valid clock from smallest to greatest to see which lines up
636 for(clkCnt=0; clkCnt < 6; ++clkCnt){
637 if (clk[clkCnt] == 32){
638 tol=1;
639 }else{
640 tol=0;
641 }
642 bestErr[clkCnt]=1000;
643 //try lining up the peaks by moving starting point (try first 256)
644 for (ii=0; ii< loopCnt; ++ii){
645 if ((dest[ii] >= peak) || (dest[ii] <= low)){
646 errCnt=0;
647 // now that we have the first one lined up test rest of wave array
648 for (i=0; i<((int)(size/clk[clkCnt])-1); ++i){
649 if (dest[ii+(i*clk[clkCnt])]>=peak || dest[ii+(i*clk[clkCnt])]<=low){
650 }else if(dest[ii+(i*clk[clkCnt])-tol]>=peak || dest[ii+(i*clk[clkCnt])-tol]<=low){
651 }else if(dest[ii+(i*clk[clkCnt])+tol]>=peak || dest[ii+(i*clk[clkCnt])+tol]<=low){
652 }else{ //error no peak detected
653 errCnt++;
654 }
655 }
656 //if we found no errors this is correct one - return this clock
657 if(errCnt==0) return clk[clkCnt];
658 //if we found errors see if it is lowest so far and save it as best run
659 if(errCnt<bestErr[clkCnt]) bestErr[clkCnt]=errCnt;
660 }
661 }
662 }
663 int iii=0;
664 int best=0;
665 for (iii=0; iii<7;++iii){
666 if (bestErr[iii]<bestErr[best]){
667 // current best bit to error ratio vs new bit to error ratio
668 if (((size/clk[best])/bestErr[best] < (size/clk[iii])/bestErr[iii]) ){
669 best = iii;
670 }
671 }
672 }
673 return clk[best];
674 }
675
676 //by marshmellow
677 //detect psk clock by reading #peaks vs no peaks(or errors)
678 int DetectpskNRZClock(uint8_t dest[], size_t size, int clock)
679 {
680 int i=0;
681 int peak=0;
682 int low=128;
683 int clk[]={16,32,40,50,64,100,128,256};
684 int loopCnt = 2048; //don't need to loop through entire array...
685 if (size<loopCnt) loopCnt = size;
686
687 //if we already have a valid clock quit
688 for (; i < 8; ++i)
689 if (clk[i] == clock) return clock;
690
691 //get high and low peak
692 for (i=0; i < loopCnt; ++i){
693 if(dest[i] > peak){
694 peak = dest[i];
695 }
696 if(dest[i] < low){
697 low = dest[i];
698 }
699 }
700 peak=(int)(((peak-128)*.75)+128);
701 low= (int)(((low-128)*.75)+128);
702 //PrintAndLog("DEBUG: peak: %d, low: %d",peak,low);
703 int ii;
704 uint8_t clkCnt;
705 uint8_t tol = 0;
706 int peakcnt=0;
707 int errCnt=0;
708 int bestErr[]={1000,1000,1000,1000,1000,1000,1000,1000,1000};
709 int peaksdet[]={0,0,0,0,0,0,0,0,0};
710 //test each valid clock from smallest to greatest to see which lines up
711 for(clkCnt=0; clkCnt < 6; ++clkCnt){
712 if (clk[clkCnt] == 32){
713 tol=1;
714 }else{
715 tol=0;
716 }
717 //try lining up the peaks by moving starting point (try first 256)
718 for (ii=0; ii< loopCnt; ++ii){
719 if ((dest[ii] >= peak) || (dest[ii] <= low)){
720 errCnt=0;
721 peakcnt=0;
722 // now that we have the first one lined up test rest of wave array
723 for (i=0; i < ((int)(size/clk[clkCnt])-1); ++i){
724 if (dest[ii+(i*clk[clkCnt])]>=peak || dest[ii+(i*clk[clkCnt])]<=low){
725 peakcnt++;
726 }else if(dest[ii+(i*clk[clkCnt])-tol]>=peak || dest[ii+(i*clk[clkCnt])-tol]<=low){
727 peakcnt++;
728 }else if(dest[ii+(i*clk[clkCnt])+tol]>=peak || dest[ii+(i*clk[clkCnt])+tol]<=low){
729 peakcnt++;
730 }else{ //error no peak detected
731 errCnt++;
732 }
733 }
734 if(peakcnt>peaksdet[clkCnt]) {
735 peaksdet[clkCnt]=peakcnt;
736 bestErr[clkCnt]=errCnt;
737 }
738 }
739 }
740 }
741 int iii=0;
742 int best=0;
743 //int ratio2; //debug
744 int ratio;
745 //int bits;
746 for (iii=0; iii < 7; ++iii){
747 ratio=1000;
748 //ratio2=1000; //debug
749 //bits=size/clk[iii]; //debug
750 if (peaksdet[iii] > 0){
751 ratio=bestErr[iii]/peaksdet[iii];
752 if (((bestErr[best]/peaksdet[best]) > (ratio)+1)){
753 best = iii;
754 }
755 //ratio2=bits/peaksdet[iii]; //debug
756 }
757 //PrintAndLog("DEBUG: Clk: %d, peaks: %d, errs: %d, bestClk: %d, ratio: %d, bits: %d, peakbitr: %d",clk[iii],peaksdet[iii],bestErr[iii],clk[best],ratio, bits,ratio2);
758 }
759 return clk[best];
760 }
761
762 //by marshmellow (attempt to get rid of high immediately after a low)
763 void pskCleanWave(uint8_t *bitStream, size_t size)
764 {
765 int i;
766 int low=128;
767 int high=0;
768 int gap = 4;
769 // int loopMax = 2048;
770 int newLow=0;
771 int newHigh=0;
772 for (i=0; i < size; ++i){
773 if (bitStream[i] < low) low=bitStream[i];
774 if (bitStream[i] > high) high=bitStream[i];
775 }
776 high = (int)(((high-128)*.80)+128);
777 low = (int)(((low-128)*.90)+128);
778 //low = (uint8_t)(((int)(low)-128)*.80)+128;
779 for (i=0; i < size; ++i){
780 if (newLow == 1){
781 bitStream[i]=low+8;
782 gap--;
783 if (gap == 0){
784 newLow=0;
785 gap=4;
786 }
787 }else if (newHigh == 1){
788 bitStream[i]=high-8;
789 gap--;
790 if (gap == 0){
791 newHigh=0;
792 gap=4;
793 }
794 }
795 if (bitStream[i] <= low) newLow=1;
796 if (bitStream[i] >= high) newHigh=1;
797 }
798 return;
799 }
800
801
802 //redesigned by marshmellow adjusted from existing decode functions
803 //indala id decoding - only tested on 26 bit tags, but attempted to make it work for more
804 int indala26decode(uint8_t *bitStream, size_t *size, uint8_t *invert)
805 {
806 //26 bit 40134 format (don't know other formats)
807 int i;
808 int long_wait;
809 long_wait = 29;//29 leading zeros in format
810 int start;
811 int first = 0;
812 int first2 = 0;
813 int bitCnt = 0;
814 int ii;
815 // Finding the start of a UID
816 for (start = 0; start <= *size - 250; start++) {
817 first = bitStream[start];
818 for (i = start; i < start + long_wait; i++) {
819 if (bitStream[i] != first) {
820 break;
821 }
822 }
823 if (i == (start + long_wait)) {
824 break;
825 }
826 }
827 if (start == *size - 250 + 1) {
828 // did not find start sequence
829 return -1;
830 }
831 //found start once now test length by finding next one
832 // Inverting signal if needed
833 if (first == 1) {
834 for (i = start; i < *size; i++) {
835 bitStream[i] = !bitStream[i];
836 }
837 *invert = 1;
838 }else *invert=0;
839
840 int iii;
841 for (ii=start+29; ii <= *size - 250; ii++) {
842 first2 = bitStream[ii];
843 for (iii = ii; iii < ii + long_wait; iii++) {
844 if (bitStream[iii] != first2) {
845 break;
846 }
847 }
848 if (iii == (ii + long_wait)) {
849 break;
850 }
851 }
852 if (ii== *size - 250 + 1){
853 // did not find second start sequence
854 return -2;
855 }
856 bitCnt=ii-start;
857
858 // Dumping UID
859 i = start;
860 for (ii = 0; ii < bitCnt; ii++) {
861 bitStream[ii] = bitStream[i++];
862 }
863 *size=bitCnt;
864 return 1;
865 }
866
867
868 //by marshmellow - demodulate PSK wave or NRZ wave (both similar enough)
869 //peaks switch bit (high=1 low=0) each clock cycle = 1 bit determined by last peak
870 int pskNRZrawDemod(uint8_t *dest, size_t *size, int *clk, int *invert)
871 {
872 pskCleanWave(dest,*size);
873 int clk2 = DetectpskNRZClock(dest, *size, *clk);
874 *clk=clk2;
875 uint32_t i;
876 uint8_t high=0, low=128;
877 uint32_t gLen = *size;
878 if (gLen > 1280) gLen=1280;
879 // get high
880 for (i=0; i < gLen; ++i){
881 if (dest[i] > high) high = dest[i];
882 if (dest[i] < low) low = dest[i];
883 }
884 //fudge high/low bars by 25%
885 high = (uint8_t)((((int)(high)-128)*.75)+128);
886 low = (uint8_t)((((int)(low)-128)*.80)+128);
887
888 //PrintAndLog("DEBUG - valid high: %d - valid low: %d",high,low);
889 int lastBit = 0; //set first clock check
890 uint32_t bitnum = 0; //output counter
891 uint8_t tol = 0; //clock tolerance adjust - waves will be accepted as within the clock if they fall + or - this value + clock from last valid wave
892 if (*clk==32)tol=2; //clock tolerance may not be needed anymore currently set to + or - 1 but could be increased for poor waves or removed entirely
893 uint32_t iii = 0;
894 uint8_t errCnt =0;
895 uint32_t bestStart = *size;
896 uint32_t maxErr = (*size/1000);
897 uint32_t bestErrCnt = maxErr;
898 //uint8_t midBit=0;
899 uint8_t curBit=0;
900 uint8_t bitHigh=0;
901 uint8_t ignorewin=*clk/8;
902 //PrintAndLog("DEBUG - lastbit - %d",lastBit);
903 //loop to find first wave that works - align to clock
904 for (iii=0; iii < gLen; ++iii){
905 if ((dest[iii]>=high) || (dest[iii]<=low)){
906 lastBit=iii-*clk;
907 //loop through to see if this start location works
908 for (i = iii; i < *size; ++i) {
909 //if we found a high bar and we are at a clock bit
910 if ((dest[i]>=high ) && (i>=lastBit+*clk-tol && i<=lastBit+*clk+tol)){
911 bitHigh=1;
912 lastBit+=*clk;
913 ignorewin=*clk/8;
914 bitnum++;
915 //else if low bar found and we are at a clock point
916 }else if ((dest[i]<=low ) && (i>=lastBit+*clk-tol && i<=lastBit+*clk+tol)){
917 bitHigh=1;
918 lastBit+=*clk;
919 ignorewin=*clk/8;
920 bitnum++;
921 //else if no bars found
922 }else if(dest[i] < high && dest[i] > low) {
923 if (ignorewin==0){
924 bitHigh=0;
925 }else ignorewin--;
926 //if we are past a clock point
927 if (i >= lastBit+*clk+tol){ //clock val
928 lastBit+=*clk;
929 bitnum++;
930 }
931 //else if bar found but we are not at a clock bit and we did not just have a clock bit
932 }else if ((dest[i]>=high || dest[i]<=low) && (i<lastBit+*clk-tol || i>lastBit+*clk+tol) && (bitHigh==0)){
933 //error bar found no clock...
934 errCnt++;
935 }
936 if (bitnum>=1000) break;
937 }
938 //we got more than 64 good bits and not all errors
939 if ((bitnum > (64+errCnt)) && (errCnt < (maxErr))) {
940 //possible good read
941 if (errCnt == 0){
942 bestStart = iii;
943 bestErrCnt = errCnt;
944 break; //great read - finish
945 }
946 if (bestStart == iii) break; //if current run == bestErrCnt run (after exhausted testing) then finish
947 if (errCnt < bestErrCnt){ //set this as new best run
948 bestErrCnt = errCnt;
949 bestStart = iii;
950 }
951 }
952 }
953 }
954 if (bestErrCnt < maxErr){
955 //best run is good enough set to best run and set overwrite BinStream
956 iii=bestStart;
957 lastBit=bestStart-*clk;
958 bitnum=0;
959 for (i = iii; i < *size; ++i) {
960 //if we found a high bar and we are at a clock bit
961 if ((dest[i] >= high ) && (i>=lastBit+*clk-tol && i<=lastBit+*clk+tol)){
962 bitHigh=1;
963 lastBit+=*clk;
964 curBit=1-*invert;
965 dest[bitnum]=curBit;
966 ignorewin=*clk/8;
967 bitnum++;
968 //else if low bar found and we are at a clock point
969 }else if ((dest[i]<=low ) && (i>=lastBit+*clk-tol && i<=lastBit+*clk+tol)){
970 bitHigh=1;
971 lastBit+=*clk;
972 curBit=*invert;
973 dest[bitnum]=curBit;
974 ignorewin=*clk/8;
975 bitnum++;
976 //else if no bars found
977 }else if(dest[i]<high && dest[i]>low) {
978 if (ignorewin==0){
979 bitHigh=0;
980 }else ignorewin--;
981 //if we are past a clock point
982 if (i>=lastBit+*clk+tol){ //clock val
983 lastBit+=*clk;
984 dest[bitnum]=curBit;
985 bitnum++;
986 }
987 //else if bar found but we are not at a clock bit and we did not just have a clock bit
988 }else if ((dest[i]>=high || dest[i]<=low) && ((i<lastBit+*clk-tol) || (i>lastBit+*clk+tol)) && (bitHigh==0)){
989 //error bar found no clock...
990 bitHigh=1;
991 dest[bitnum]=77;
992 bitnum++;
993 errCnt++;
994 }
995 if (bitnum >=1000) break;
996 }
997 *size=bitnum;
998 } else{
999 *size=bitnum;
1000 *clk=bestStart;
1001 return -1;
1002 }
1003
1004 if (bitnum>16){
1005 *size=bitnum;
1006 } else return -1;
1007 return errCnt;
1008 }
1009
Proxmark3 GIT tracking
Impressum, Datenschutz