]>
git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
14 #include "proxmark3.h"
18 #include "cmdparser.h"
21 #include "cmdlfem4x.h"
22 char *global_em410xId
;
24 static int CmdHelp(const char *Cmd
);
26 int CmdEMdemodASK(const char *Cmd
)
28 char cmdp
= param_getchar(Cmd
, 0);
29 int findone
= (cmdp
== '1') ? 1 : 0;
30 UsbCommand c
={CMD_EM410X_DEMOD
};
36 /* Read the ID of an EM410x tag.
38 * 1111 1111 1 <-- standard non-repeatable header
39 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
41 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
42 * 0 <-- stop bit, end of tag
44 int CmdEM410xRead(const char *Cmd
)
46 int i
, j
, clock
, header
, rows
, bit
, hithigh
, hitlow
, first
, bit2idx
, high
, low
;
49 char id2
[11] = {0x00};
51 uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
];
54 /* Detect high and lows and clock */
55 for (i
= 0; i
< GraphTraceLen
; i
++)
57 if (GraphBuffer
[i
] > high
)
58 high
= GraphBuffer
[i
];
59 else if (GraphBuffer
[i
] < low
)
64 clock
= GetClock(Cmd
, high
, 0);
66 /* parity for our 4 columns */
67 parity
[0] = parity
[1] = parity
[2] = parity
[3] = 0;
70 // manchester demodulate
72 for (i
= 0; i
< (int)(GraphTraceLen
/ clock
); i
++)
78 /* Find out if we hit both high and low peaks */
79 for (j
= 0; j
< clock
; j
++)
81 if (GraphBuffer
[(i
* clock
) + j
] >= high
)
83 else if (GraphBuffer
[(i
* clock
) + j
] <= low
)
86 /* it doesn't count if it's the first part of our read
87 because it's really just trailing from the last sequence */
88 if (first
&& (hithigh
|| hitlow
))
93 if (hithigh
&& hitlow
)
97 /* If we didn't hit both high and low peaks, we had a bit transition */
98 if (!hithigh
|| !hitlow
)
101 BitStream
[bit2idx
++] = bit
;
105 /* We go till 5 before the graph ends because we'll get that far below */
106 for (i
= 1; i
< bit2idx
- 5; i
++)
108 /* Step 2: We have our header but need our tag ID */
109 if (header
== 9 && rows
< 10)
111 /* Confirm parity is correct */
112 if ((BitStream
[i
] ^ BitStream
[i
+1] ^ BitStream
[i
+2] ^ BitStream
[i
+3]) == BitStream
[i
+4])
114 /* Read another byte! */
115 sprintf(id
+rows
, "%x", (8 * BitStream
[i
]) + (4 * BitStream
[i
+1]) + (2 * BitStream
[i
+2]) + (1 * BitStream
[i
+3]));
116 sprintf(id2
+rows
, "%x", (8 * BitStream
[i
+3]) + (4 * BitStream
[i
+2]) + (2 * BitStream
[i
+1]) + (1 * BitStream
[i
]));
119 /* Keep parity info */
120 parity
[0] ^= BitStream
[i
];
121 parity
[1] ^= BitStream
[i
+1];
122 parity
[2] ^= BitStream
[i
+2];
123 parity
[3] ^= BitStream
[i
+3];
125 /* Move 4 bits ahead */
129 /* Damn, something wrong! reset */
132 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows
+ 1, i
);
134 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
135 i
-= 9 + (5 * rows
) - 5;
141 /* Step 3: Got our 40 bits! confirm column parity */
144 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
145 if (BitStream
[i
] == parity
[0] && BitStream
[i
+1] == parity
[1] &&
146 BitStream
[i
+2] == parity
[2] && BitStream
[i
+3] == parity
[3] &&
150 PrintAndLog("EM410x Tag ID: %s", id
);
151 PrintAndLog("Unique Tag ID: %s", id2
);
153 global_em410xId
= id
;
159 /* Crap! Incorrect parity or no stop bit, start all over */
164 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
169 /* Step 1: get our header */
172 /* Need 9 consecutive 1's */
173 if (BitStream
[i
] == 1)
176 /* We don't have a header, not enough consecutive 1 bits */
182 /* if we've already retested after flipping bits, return */
184 PrintAndLog("Failed to decode");
188 /* if this didn't work, try flipping bits */
189 for (i
= 0; i
< bit2idx
; i
++)
195 /* emulate an EM410X tag
197 * 1111 1111 1 <-- standard non-repeatable header
198 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
200 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
201 * 0 <-- stop bit, end of tag
203 int CmdEM410xSim(const char *Cmd
)
205 int i
, n
, j
, binary
[4], parity
[4];
207 char cmdp
= param_getchar(Cmd
, 0);
208 uint8_t uid
[5] = {0x00};
210 if (cmdp
== 'h' || cmdp
== 'H') {
211 PrintAndLog("Usage: lf em4x 410xsim <UID>");
213 PrintAndLog(" sample: lf em4x 410xsim 0F0368568B");
217 if (param_gethex(Cmd
, 0, uid
, 10)) {
218 PrintAndLog("UID must include 10 HEX symbols");
222 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid
[0],uid
[1],uid
[2],uid
[3],uid
[4]);
223 PrintAndLog("Press pm3-button to about simulation");
225 /* clock is 64 in EM410x tags */
228 /* clear our graph */
231 /* write 9 start bits */
232 for (i
= 0; i
< 9; i
++)
233 AppendGraph(0, clock
, 1);
235 /* for each hex char */
236 parity
[0] = parity
[1] = parity
[2] = parity
[3] = 0;
237 for (i
= 0; i
< 10; i
++)
239 /* read each hex char */
240 sscanf(&Cmd
[i
], "%1x", &n
);
241 for (j
= 3; j
>= 0; j
--, n
/= 2)
244 /* append each bit */
245 AppendGraph(0, clock
, binary
[0]);
246 AppendGraph(0, clock
, binary
[1]);
247 AppendGraph(0, clock
, binary
[2]);
248 AppendGraph(0, clock
, binary
[3]);
250 /* append parity bit */
251 AppendGraph(0, clock
, binary
[0] ^ binary
[1] ^ binary
[2] ^ binary
[3]);
253 /* keep track of column parity */
254 parity
[0] ^= binary
[0];
255 parity
[1] ^= binary
[1];
256 parity
[2] ^= binary
[2];
257 parity
[3] ^= binary
[3];
261 AppendGraph(0, clock
, parity
[0]);
262 AppendGraph(0, clock
, parity
[1]);
263 AppendGraph(0, clock
, parity
[2]);
264 AppendGraph(0, clock
, parity
[3]);
267 AppendGraph(1, clock
, 0);
269 CmdLFSim("240"); //240 start_gap.
273 /* Function is equivalent of lf read + data samples + em410xread
274 * looped until an EM410x tag is detected
276 * Why is CmdSamples("16000")?
277 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
278 * rate gets lower, then grow the number of samples
279 * Changed by martin, 4000 x 4 = 16000,
280 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
283 int CmdEM410xWatch(const char *Cmd
)
285 char cmdp
= param_getchar(Cmd
, 0);
286 int read_h
= (cmdp
== 'h');
289 printf("\naborted via keyboard!\n");
293 CmdLFRead(read_h
? "h" : "");
301 int CmdEM410xWatchnSpoof(const char *Cmd
)
304 PrintAndLog("# Replaying : %s",global_em410xId
);
305 CmdEM410xSim(global_em410xId
);
309 /* Read the transmitted data of an EM4x50 tag
312 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
313 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
314 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
315 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
316 * CCCCCCCC <- column parity bits
318 * LW <- Listen Window
320 * This pattern repeats for every block of data being transmitted.
321 * Transmission starts with two Listen Windows (LW - a modulated
322 * pattern of 320 cycles each (32/32/128/64/64)).
324 * Note that this data may or may not be the UID. It is whatever data
325 * is stored in the blocks defined in the control word First and Last
326 * Word Read values. UID is stored in block 32.
328 int CmdEM4x50Read(const char *Cmd
)
330 int i
, j
, startblock
, skip
, block
, start
, end
, low
, high
;
331 bool complete
= false;
332 int tmpbuff
[MAX_GRAPH_TRACE_LEN
/ 64];
336 memset(tmpbuff
, 0, MAX_GRAPH_TRACE_LEN
/ 64);
338 /* first get high and low values */
339 for (i
= 0; i
< GraphTraceLen
; i
++)
341 if (GraphBuffer
[i
] > high
)
342 high
= GraphBuffer
[i
];
343 else if (GraphBuffer
[i
] < low
)
344 low
= GraphBuffer
[i
];
347 /* populate a buffer with pulse lengths */
350 while (i
< GraphTraceLen
)
352 // measure from low to low
353 while ((GraphBuffer
[i
] > low
) && (i
<GraphTraceLen
))
356 while ((GraphBuffer
[i
] < high
) && (i
<GraphTraceLen
))
358 while ((GraphBuffer
[i
] > low
) && (i
<GraphTraceLen
))
360 if (j
>=(MAX_GRAPH_TRACE_LEN
/64)) {
363 tmpbuff
[j
++]= i
- start
;
366 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
369 for (i
= 0; i
< j
- 4 ; ++i
)
372 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
373 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
374 if (tmpbuff
[i
+2] >= 190 && tmpbuff
[i
+2] <= 194)
375 if (tmpbuff
[i
+3] >= 126 && tmpbuff
[i
+3] <= 130)
383 /* skip over the remainder of the LW */
384 skip
+= tmpbuff
[i
+1]+tmpbuff
[i
+2];
385 while (skip
< MAX_GRAPH_TRACE_LEN
&& GraphBuffer
[skip
] > low
)
389 /* now do it again to find the end */
391 for (i
+= 3; i
< j
- 4 ; ++i
)
394 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
395 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
396 if (tmpbuff
[i
+2] >= 190 && tmpbuff
[i
+2] <= 194)
397 if (tmpbuff
[i
+3] >= 126 && tmpbuff
[i
+3] <= 130)
405 PrintAndLog("Found data at sample: %i",skip
);
408 PrintAndLog("No data found!");
409 PrintAndLog("Try again with more samples.");
415 PrintAndLog("*** Warning!");
416 PrintAndLog("Partial data - no end found!");
417 PrintAndLog("Try again with more samples.");
420 /* get rid of leading crap */
421 sprintf(tmp
,"%i",skip
);
424 /* now work through remaining buffer printing out data blocks */
429 PrintAndLog("Block %i:", block
);
430 // mandemod routine needs to be split so we can call it for data
431 // just print for now for debugging
432 CmdManchesterDemod("i 64");
434 /* look for LW before start of next block */
435 for ( ; i
< j
- 4 ; ++i
)
438 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
439 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
442 while (GraphBuffer
[skip
] > low
)
445 sprintf(tmp
,"%i",skip
);
453 int CmdEM410xWrite(const char *Cmd
)
455 uint64_t id
= 0xFFFFFFFFFFFFFFFF; // invalid id value
456 int card
= 0xFF; // invalid card value
457 unsigned int clock
= 0; // invalid clock value
459 sscanf(Cmd
, "%" PRIx64
" %d %d", &id
, &card
, &clock
);
462 if (id
== 0xFFFFFFFFFFFFFFFF) {
463 PrintAndLog("Error! ID is required.\n");
466 if (id
>= 0x10000000000) {
467 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
473 PrintAndLog("Error! Card type required.\n");
477 PrintAndLog("Error! Bad card type selected.\n");
488 // Allowed clock rates: 16, 32 and 64
489 if ((clock
!= 16) && (clock
!= 32) && (clock
!= 64)) {
490 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock
);
496 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
501 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64
" (clock rate: %d)", "T55x7", id
, clock
);
502 // NOTE: We really should pass the clock in as a separate argument, but to
503 // provide for backwards-compatibility for older firmware, and to avoid
504 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
505 // the clock rate in bits 8-15 of the card value
506 card
= (card
& 0xFF) | (((uint64_t)clock
<< 8) & 0xFF00);
509 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64
, "T5555", id
, clock
);
511 PrintAndLog("Error! Bad card type selected.\n");
515 UsbCommand c
= {CMD_EM410X_WRITE_TAG
, {card
, (uint32_t)(id
>> 32), (uint32_t)id
}};
521 int CmdReadWord(const char *Cmd
)
523 int Word
= -1; //default to invalid word
526 sscanf(Cmd
, "%d", &Word
);
528 if ( (Word
> 15) | (Word
< 0) ) {
529 PrintAndLog("Word must be between 0 and 15");
533 PrintAndLog("Reading word %d", Word
);
535 c
.cmd
= CMD_EM4X_READ_WORD
;
536 c
.d
.asBytes
[0] = 0x0; //Normal mode
544 int CmdReadWordPWD(const char *Cmd
)
546 int Word
= -1; //default to invalid word
547 int Password
= 0xFFFFFFFF; //default to blank password
550 sscanf(Cmd
, "%d %x", &Word
, &Password
);
552 if ( (Word
> 15) | (Word
< 0) ) {
553 PrintAndLog("Word must be between 0 and 15");
557 PrintAndLog("Reading word %d with password %08X", Word
, Password
);
559 c
.cmd
= CMD_EM4X_READ_WORD
;
560 c
.d
.asBytes
[0] = 0x1; //Password mode
568 int CmdWriteWord(const char *Cmd
)
570 int Word
= 16; //default to invalid block
571 int Data
= 0xFFFFFFFF; //default to blank data
574 sscanf(Cmd
, "%x %d", &Data
, &Word
);
577 PrintAndLog("Word must be between 0 and 15");
581 PrintAndLog("Writing word %d with data %08X", Word
, Data
);
583 c
.cmd
= CMD_EM4X_WRITE_WORD
;
584 c
.d
.asBytes
[0] = 0x0; //Normal mode
592 int CmdWriteWordPWD(const char *Cmd
)
594 int Word
= 16; //default to invalid word
595 int Data
= 0xFFFFFFFF; //default to blank data
596 int Password
= 0xFFFFFFFF; //default to blank password
599 sscanf(Cmd
, "%x %d %x", &Data
, &Word
, &Password
);
602 PrintAndLog("Word must be between 0 and 15");
606 PrintAndLog("Writing word %d with data %08X and password %08X", Word
, Data
, Password
);
608 c
.cmd
= CMD_EM4X_WRITE_WORD
;
609 c
.d
.asBytes
[0] = 0x1; //Password mode
617 static command_t CommandTable
[] =
619 {"help", CmdHelp
, 1, "This help"},
620 {"em410xdemod", CmdEMdemodASK
, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
621 {"em410xread", CmdEM410xRead
, 1, "[clock rate] -- Extract ID from EM410x tag"},
622 {"em410xsim", CmdEM410xSim
, 0, "<UID> -- Simulate EM410x tag"},
623 {"em410xwatch", CmdEM410xWatch
, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
624 {"em410xspoof", CmdEM410xWatchnSpoof
, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
625 {"em410xwrite", CmdEM410xWrite
, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
626 {"em4x50read", CmdEM4x50Read
, 1, "Extract data from EM4x50 tag"},
627 {"readword", CmdReadWord
, 1, "<Word> -- Read EM4xxx word data"},
628 {"readwordPWD", CmdReadWordPWD
, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
629 {"writeword", CmdWriteWord
, 1, "<Data> <Word> -- Write EM4xxx word data"},
630 {"writewordPWD", CmdWriteWordPWD
, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
631 {NULL
, NULL
, 0, NULL
}
634 int CmdLFEM4X(const char *Cmd
)
636 CmdsParse(CommandTable
, Cmd
);
640 int CmdHelp(const char *Cmd
)
642 CmdsHelp(CommandTable
);