]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
ADD: tnp3.lua can now validate the checkums in the dump
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <inttypes.h>
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "graph.h"
17 #include "cmdmain.h"
18 #include "cmdparser.h"
19 #include "cmddata.h"
20 #include "cmdlf.h"
21 #include "cmdlfem4x.h"
22 #include "util.h"
23 #include "data.h"
24 #define LF_TRACE_BUFF_SIZE 12000
25 #define LF_BITSSTREAM_LEN 1000
26
27 char *global_em410xId;
28
29 static int CmdHelp(const char *Cmd);
30
31 /* Read the ID of an EM410x tag.
32 * Format:
33 * 1111 1111 1 <-- standard non-repeatable header
34 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
35 * ....
36 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
37 * 0 <-- stop bit, end of tag
38 */
39 int CmdEM410xRead(const char *Cmd)
40 {
41 int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
42 int parity[4];
43 char id[11];
44 char id2[11];
45 int retested = 0;
46 uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
47 high = low = 0;
48
49 /* Detect high and lows and clock */
50 for (i = 0; i < GraphTraceLen; i++)
51 {
52 if (GraphBuffer[i] > high)
53 high = GraphBuffer[i];
54 else if (GraphBuffer[i] < low)
55 low = GraphBuffer[i];
56 }
57
58 /* get clock */
59 clock = GetClock(Cmd, high, 0);
60
61 /* parity for our 4 columns */
62 parity[0] = parity[1] = parity[2] = parity[3] = 0;
63 header = rows = 0;
64
65 /* manchester demodulate */
66 bit = bit2idx = 0;
67 for (i = 0; i < (int)(GraphTraceLen / clock); i++)
68 {
69 hithigh = 0;
70 hitlow = 0;
71 first = 1;
72
73 /* Find out if we hit both high and low peaks */
74 for (j = 0; j < clock; j++)
75 {
76 if (GraphBuffer[(i * clock) + j] == high)
77 hithigh = 1;
78 else if (GraphBuffer[(i * clock) + j] == low)
79 hitlow = 1;
80
81 /* it doesn't count if it's the first part of our read
82 because it's really just trailing from the last sequence */
83 if (first && (hithigh || hitlow))
84 hithigh = hitlow = 0;
85 else
86 first = 0;
87
88 if (hithigh && hitlow)
89 break;
90 }
91
92 /* If we didn't hit both high and low peaks, we had a bit transition */
93 if (!hithigh || !hitlow)
94 bit ^= 1;
95
96 BitStream[bit2idx++] = bit;
97 }
98
99 retest:
100 /* We go till 5 before the graph ends because we'll get that far below */
101 for (i = 0; i < bit2idx - 5; i++)
102 {
103 /* Step 2: We have our header but need our tag ID */
104 if (header == 9 && rows < 10)
105 {
106 /* Confirm parity is correct */
107 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
108 {
109 /* Read another byte! */
110 sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
111 sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i]));
112 rows++;
113
114 /* Keep parity info */
115 parity[0] ^= BitStream[i];
116 parity[1] ^= BitStream[i+1];
117 parity[2] ^= BitStream[i+2];
118 parity[3] ^= BitStream[i+3];
119
120 /* Move 4 bits ahead */
121 i += 4;
122 }
123
124 /* Damn, something wrong! reset */
125 else
126 {
127 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
128
129 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
130 i -= 9 + (5 * rows) -5;
131
132 rows = header = 0;
133 }
134 }
135
136 /* Step 3: Got our 40 bits! confirm column parity */
137 else if (rows == 10)
138 {
139 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
140 if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
141 BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
142 BitStream[i+4] == 0)
143 {
144 /* Sweet! */
145 PrintAndLog("EM410x Tag ID: %s", id);
146 PrintAndLog("Unique Tag ID: %s", id2);
147
148 global_em410xId = id;
149
150 /* Stop any loops */
151 return 1;
152 }
153
154 /* Crap! Incorrect parity or no stop bit, start all over */
155 else
156 {
157 rows = header = 0;
158
159 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
160 i -= 59;
161 }
162 }
163
164 /* Step 1: get our header */
165 else if (header < 9)
166 {
167 /* Need 9 consecutive 1's */
168 if (BitStream[i] == 1)
169 header++;
170
171 /* We don't have a header, not enough consecutive 1 bits */
172 else
173 header = 0;
174 }
175 }
176
177 /* if we've already retested after flipping bits, return */
178 if (retested++){
179 return 0;
180 }
181
182 /* if this didn't work, try flipping bits */
183 for (i = 0; i < bit2idx; i++)
184 BitStream[i] ^= 1;
185
186 goto retest;
187 }
188
189 /* emulate an EM410X tag
190 * Format:
191 * 1111 1111 1 <-- standard non-repeatable header
192 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
193 * ....
194 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
195 * 0 <-- stop bit, end of tag
196 */
197 int CmdEM410xSim(const char *Cmd)
198 {
199 int i, n, j, h, binary[4], parity[4];
200
201 char cmdp = param_getchar(Cmd, 0);
202 uint8_t uid[5] = {0x00};
203
204 if (cmdp == 'h' || cmdp == 'H') {
205 PrintAndLog("Usage: lf em4x sim <UID>");
206 PrintAndLog("");
207 PrintAndLog(" sample: lf em4x sim 0F0368568B");
208 return 0;
209 }
210
211 if (param_gethex(Cmd, 0, uid, 10)) {
212 PrintAndLog("UID must include 10 HEX symbols");
213 return 0;
214 }
215
216 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
217 PrintAndLog("Press pm3-button to about simulation");
218
219 /* clock is 64 in EM410x tags */
220 int clock = 64;
221
222 /* clear our graph */
223 ClearGraph(0);
224
225 /* write it out a few times */
226 //for (h = 0; h < 4; h++)
227 //{
228 /* write 9 start bits */
229 for (i = 0; i < 9; i++)
230 AppendGraph(0, clock, 1);
231
232 /* for each hex char */
233 parity[0] = parity[1] = parity[2] = parity[3] = 0;
234 for (i = 0; i < 10; i++)
235 {
236 /* read each hex char */
237 sscanf(&Cmd[i], "%1x", &n);
238 for (j = 3; j >= 0; j--, n/= 2)
239 binary[j] = n % 2;
240
241 /* append each bit */
242 AppendGraph(0, clock, binary[0]);
243 AppendGraph(0, clock, binary[1]);
244 AppendGraph(0, clock, binary[2]);
245 AppendGraph(0, clock, binary[3]);
246
247 /* append parity bit */
248 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
249
250 /* keep track of column parity */
251 parity[0] ^= binary[0];
252 parity[1] ^= binary[1];
253 parity[2] ^= binary[2];
254 parity[3] ^= binary[3];
255 }
256
257 /* parity columns */
258 AppendGraph(0, clock, parity[0]);
259 AppendGraph(0, clock, parity[1]);
260 AppendGraph(0, clock, parity[2]);
261 AppendGraph(0, clock, parity[3]);
262
263 /* stop bit */
264 AppendGraph(0, clock, 0);
265 //}
266
267 /* modulate that biatch */
268 //CmdManchesterMod("64");
269
270 /* booyah! */
271 RepaintGraphWindow();
272
273 CmdLFSim("");
274 return 0;
275 }
276
277 /* Function is equivalent of lf read + data samples + em410xread
278 * looped until an EM410x tag is detected
279 *
280 * Why is CmdSamples("16000")?
281 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
282 * rate gets lower, then grow the number of samples
283 * Changed by martin, 4000 x 4 = 16000,
284 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
285
286 */
287 int CmdEM410xWatch(const char *Cmd)
288 {
289 int read_h = (*Cmd == 'h');
290 do
291 {
292 if (ukbhit()) {
293 printf("\naborted via keyboard!\n");
294 break;
295 }
296
297 CmdLFRead(read_h ? "h" : "");
298 CmdSamples("6000");
299
300 } while (
301 !CmdEM410xRead("")
302 );
303 return 0;
304 }
305
306 int CmdEM410xWatchnSpoof(const char *Cmd)
307 {
308 CmdEM410xWatch(Cmd);
309 PrintAndLog("# Replaying : %s",global_em410xId);
310 CmdEM410xSim(global_em410xId);
311 return 0;
312 }
313
314 /* Read the transmitted data of an EM4x50 tag
315 * Format:
316 *
317 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
318 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
319 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
320 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
321 * CCCCCCCC <- column parity bits
322 * 0 <- stop bit
323 * LW <- Listen Window
324 *
325 * This pattern repeats for every block of data being transmitted.
326 * Transmission starts with two Listen Windows (LW - a modulated
327 * pattern of 320 cycles each (32/32/128/64/64)).
328 *
329 * Note that this data may or may not be the UID. It is whatever data
330 * is stored in the blocks defined in the control word First and Last
331 * Word Read values. UID is stored in block 32.
332 */
333 int CmdEM4x50Read(const char *Cmd)
334 {
335 int i, j, startblock, skip, block, start, end, low, high;
336 bool complete= false;
337 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
338 char tmp[6];
339
340 high= low= 0;
341 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
342
343 /* first get high and low values */
344 for (i = 0; i < GraphTraceLen; i++)
345 {
346 if (GraphBuffer[i] > high)
347 high = GraphBuffer[i];
348 else if (GraphBuffer[i] < low)
349 low = GraphBuffer[i];
350 }
351
352 /* populate a buffer with pulse lengths */
353 i= 0;
354 j= 0;
355 while (i < GraphTraceLen)
356 {
357 // measure from low to low
358 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
359 ++i;
360 start= i;
361 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
362 ++i;
363 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
364 ++i;
365 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
366 break;
367 }
368 tmpbuff[j++]= i - start;
369 }
370
371 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
372 start= -1;
373 skip= 0;
374 for (i= 0; i < j - 4 ; ++i)
375 {
376 skip += tmpbuff[i];
377 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
378 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
379 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
380 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
381 {
382 start= i + 3;
383 break;
384 }
385 }
386 startblock= i + 3;
387
388 /* skip over the remainder of the LW */
389 skip += tmpbuff[i+1]+tmpbuff[i+2];
390 while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
391 ++skip;
392 skip += 8;
393
394 /* now do it again to find the end */
395 end= start;
396 for (i += 3; i < j - 4 ; ++i)
397 {
398 end += tmpbuff[i];
399 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
400 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
401 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
402 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
403 {
404 complete= true;
405 break;
406 }
407 }
408
409 if (start >= 0)
410 PrintAndLog("Found data at sample: %i",skip);
411 else
412 {
413 PrintAndLog("No data found!");
414 PrintAndLog("Try again with more samples.");
415 return 0;
416 }
417
418 if (!complete)
419 {
420 PrintAndLog("*** Warning!");
421 PrintAndLog("Partial data - no end found!");
422 PrintAndLog("Try again with more samples.");
423 }
424
425 /* get rid of leading crap */
426 sprintf(tmp,"%i",skip);
427 CmdLtrim(tmp);
428
429 /* now work through remaining buffer printing out data blocks */
430 block= 0;
431 i= startblock;
432 while (block < 6)
433 {
434 PrintAndLog("Block %i:", block);
435 // mandemod routine needs to be split so we can call it for data
436 // just print for now for debugging
437 CmdManchesterDemod("i 64");
438 skip= 0;
439 /* look for LW before start of next block */
440 for ( ; i < j - 4 ; ++i)
441 {
442 skip += tmpbuff[i];
443 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
444 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
445 break;
446 }
447 while (GraphBuffer[skip] > low)
448 ++skip;
449 skip += 8;
450 sprintf(tmp,"%i",skip);
451 CmdLtrim(tmp);
452 start += skip;
453 block++;
454 }
455 return 0;
456 }
457
458 int CmdEM410xWrite(const char *Cmd)
459 {
460 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
461 int card = 0xFF; // invalid card value
462 unsigned int clock = 0; // invalid clock value
463
464 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
465
466 // Check ID
467 if (id == 0xFFFFFFFFFFFFFFFF) {
468 PrintAndLog("Error! ID is required.\n");
469 return 0;
470 }
471 if (id >= 0x10000000000) {
472 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
473 return 0;
474 }
475
476 // Check Card
477 if (card == 0xFF) {
478 PrintAndLog("Error! Card type required.\n");
479 return 0;
480 }
481 if (card < 0) {
482 PrintAndLog("Error! Bad card type selected.\n");
483 return 0;
484 }
485
486 // Check Clock
487 if (card == 1)
488 {
489 // Default: 64
490 if (clock == 0)
491 clock = 64;
492
493 // Allowed clock rates: 16, 32 and 64
494 if ((clock != 16) && (clock != 32) && (clock != 64)) {
495 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
496 return 0;
497 }
498 }
499 else if (clock != 0)
500 {
501 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
502 return 0;
503 }
504
505 if (card == 1) {
506 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
507 // NOTE: We really should pass the clock in as a separate argument, but to
508 // provide for backwards-compatibility for older firmware, and to avoid
509 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
510 // the clock rate in bits 8-15 of the card value
511 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
512 }
513 else if (card == 0)
514 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
515 else {
516 PrintAndLog("Error! Bad card type selected.\n");
517 return 0;
518 }
519
520 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
521 SendCommand(&c);
522
523 return 0;
524 }
525
526 int CmdReadWord(const char *Cmd)
527 {
528 int Word = -1; //default to invalid word
529 UsbCommand c;
530
531 sscanf(Cmd, "%d", &Word);
532
533 if ( (Word > 15) | (Word < 0) ) {
534 PrintAndLog("Word must be between 0 and 15");
535 return 1;
536 }
537
538 PrintAndLog("Reading word %d", Word);
539
540 c.cmd = CMD_EM4X_READ_WORD;
541 c.d.asBytes[0] = 0x0; //Normal mode
542 c.arg[0] = 0;
543 c.arg[1] = Word;
544 c.arg[2] = 0;
545 SendCommand(&c);
546 WaitForResponse(CMD_ACK, NULL);
547
548 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
549
550 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
551 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
552
553 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
554 GraphBuffer[j] = ((int)data[j]);
555 }
556 GraphTraceLen = LF_TRACE_BUFF_SIZE;
557
558 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
559 uint8_t * bitstream = bits;
560 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream,LF_BITSSTREAM_LEN);
561 RepaintGraphWindow();
562 return 0;
563 }
564
565 int CmdReadWordPWD(const char *Cmd)
566 {
567 int Word = -1; //default to invalid word
568 int Password = 0xFFFFFFFF; //default to blank password
569 UsbCommand c;
570
571 sscanf(Cmd, "%d %x", &Word, &Password);
572
573 if ( (Word > 15) | (Word < 0) ) {
574 PrintAndLog("Word must be between 0 and 15");
575 return 1;
576 }
577
578 PrintAndLog("Reading word %d with password %08X", Word, Password);
579
580 c.cmd = CMD_EM4X_READ_WORD;
581 c.d.asBytes[0] = 0x1; //Password mode
582 c.arg[0] = 0;
583 c.arg[1] = Word;
584 c.arg[2] = Password;
585 SendCommand(&c);
586 WaitForResponse(CMD_ACK, NULL);
587
588 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
589
590 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
591 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
592
593 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
594 GraphBuffer[j] = ((int)data[j]);
595 }
596 GraphTraceLen = LF_TRACE_BUFF_SIZE;
597
598 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
599 uint8_t * bitstream = bits;
600 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
601 RepaintGraphWindow();
602 return 0;
603 }
604
605 int CmdWriteWord(const char *Cmd)
606 {
607 int Word = 16; //default to invalid block
608 int Data = 0xFFFFFFFF; //default to blank data
609 UsbCommand c;
610
611 sscanf(Cmd, "%x %d", &Data, &Word);
612
613 if (Word > 15) {
614 PrintAndLog("Word must be between 0 and 15");
615 return 1;
616 }
617
618 PrintAndLog("Writing word %d with data %08X", Word, Data);
619
620 c.cmd = CMD_EM4X_WRITE_WORD;
621 c.d.asBytes[0] = 0x0; //Normal mode
622 c.arg[0] = Data;
623 c.arg[1] = Word;
624 c.arg[2] = 0;
625 SendCommand(&c);
626 return 0;
627 }
628
629 int CmdWriteWordPWD(const char *Cmd)
630 {
631 int Word = 16; //default to invalid word
632 int Data = 0xFFFFFFFF; //default to blank data
633 int Password = 0xFFFFFFFF; //default to blank password
634 UsbCommand c;
635
636 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
637
638 if (Word > 15) {
639 PrintAndLog("Word must be between 0 and 15");
640 return 1;
641 }
642
643 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
644
645 c.cmd = CMD_EM4X_WRITE_WORD;
646 c.d.asBytes[0] = 0x1; //Password mode
647 c.arg[0] = Data;
648 c.arg[1] = Word;
649 c.arg[2] = Password;
650 SendCommand(&c);
651 return 0;
652 }
653
654 static command_t CommandTable[] =
655 {
656 {"help", CmdHelp, 1, "This help"},
657
658 {"410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
659 {"410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
660 {"replay", MWRem4xReplay, 0, "Watches for tag and simulates manchester encoded em4x tag"},
661 {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
662 {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
663 {"410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
664 {"4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
665 {"rd", CmdReadWord, 1, "<Word 1-15> -- Read EM4xxx word data"},
666 {"rdpwd", CmdReadWordPWD, 1, "<Word 1-15> <Password> -- Read EM4xxx word data in password mode "},
667 {"wr", CmdWriteWord, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
668 {"wrpwd", CmdWriteWordPWD, 1, "<Data> <Word 1-15> <Password> -- Write EM4xxx word data in password mode"},
669 {NULL, NULL, 0, NULL}
670 };
671
672
673 //Confirms the parity of a bitstream as well as obtaining the data (TagID) from within the appropriate memory space.
674 //Arguments:
675 // Pointer to a string containing the desired bitsream
676 // Pointer to a string that will receive the decoded tag ID
677 // Length of the bitsream pointed at in the first argument, char* _strBitStream
678 //Retuns:
679 //1 Parity confirmed
680 //0 Parity not confirmed
681 int ConfirmEm410xTagParity( char* _strBitStream, char* pID, int LengthOfBitstream )
682 {
683 int i = 0;
684 int rows = 0;
685 int Parity[4] = {0x00};
686 char ID[11] = {0x00};
687 int k = 0;
688 int BitStream[70] = {0x00};
689 int counter = 0;
690 //prepare variables
691 for ( i = 0; i <= LengthOfBitstream; i++)
692 {
693 if (_strBitStream[i] == '1')
694 {
695 k =1;
696 memcpy(&BitStream[i], &k,4);
697 }
698 else if (_strBitStream[i] == '0')
699 {
700 k = 0;
701 memcpy(&BitStream[i], &k,4);
702 }
703 }
704 while ( counter < 2 )
705 {
706 //set/reset variables and counters
707 memset(ID,0x00,sizeof(ID));
708 memset(Parity,0x00,sizeof(Parity));
709 rows = 0;
710 for ( i = 9; i <= LengthOfBitstream; i++)
711 {
712 if ( rows < 10 )
713 {
714 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
715 {
716 sprintf(ID+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
717 rows++;
718 /* Keep parity info and move four bits ahead*/
719 Parity[0] ^= BitStream[i];
720 Parity[1] ^= BitStream[i+1];
721 Parity[2] ^= BitStream[i+2];
722 Parity[3] ^= BitStream[i+3];
723 i += 4;
724 }
725 }
726 if ( rows == 10 )
727 {
728 if ( BitStream[i] == Parity[0] && BitStream[i+1] == Parity[1] &&
729 BitStream[i+2] == Parity[2] && BitStream[i+3] == Parity[3] &&
730 BitStream[i+4] == 0)
731 {
732 memcpy(pID,ID,strlen(ID));
733 return 1;
734 }
735 }
736 }
737 printf("[PARITY ->]Failed. Flipping Bits, and rechecking parity for bitstream:\n[PARITY ->]");
738 for (k = 0; k < LengthOfBitstream; k++)
739 {
740 BitStream[k] ^= 1;
741 printf("%i", BitStream[k]);
742 }
743 puts(" ");
744 counter++;
745 }
746 return 0;
747 }
748 //Reads and demodulates an em410x RFID tag. It further allows slight modification to the decoded bitstream
749 //Once a suitable bitstream has been identified, and if needed, modified, it is replayed. Allowing emulation of the
750 //"stolen" rfid tag.
751 //No meaningful returns or arguments.
752 int MWRem4xReplay(const char* Cmd)
753 {
754 // //header traces
755 // static char ArrayTraceZero[] = { '0','0','0','0','0','0','0','0','0' };
756 // static char ArrayTraceOne[] = { '1','1','1','1','1','1','1','1','1' };
757 // //local string variables
758 // char strClockRate[10] = {0x00};
759 // char strAnswer[4] = {0x00};
760 // char strTempBufferMini[2] = {0x00};
761 // //our outbound bit-stream
762 // char strSimulateBitStream[65] = {0x00};
763 // //integers
764 // int iClockRate = 0;
765 // int needle = 0;
766 // int j = 0;
767 // int iFirstHeaderOffset = 0x00000000;
768 // int numManchesterDemodBits=0;
769 // //boolean values
770 // bool bInverted = false;
771 // //pointers to strings. memory will be allocated.
772 // char* pstrInvertBitStream = 0x00000000;
773 // char* pTempBuffer = 0x00000000;
774 // char* pID = 0x00000000;
775 // char* strBitStreamBuffer = 0x00000000;
776
777
778 // puts("###################################");
779 // puts("#### Em4x Replay ##");
780 // puts("#### R.A.M. June 2013 ##");
781 // puts("###################################");
782 // //initialize
783 // CmdLFRead("");
784 // //Collect ourselves 10,000 samples
785 // CmdSamples("10000");
786 // puts("[->]preforming ASK demodulation\n");
787 // //demodulate ask
788 // Cmdaskdemod("0");
789 // iClockRate = DetectClock(0);
790 // sprintf(strClockRate, "%i\n",iClockRate);
791 // printf("[->]Detected ClockRate: %s\n", strClockRate);
792
793 // //If detected clock rate is something completely unreasonable, dont go ahead
794 // if ( iClockRate < 0xFFFE )
795 // {
796 // pTempBuffer = (char*)malloc(MAX_GRAPH_TRACE_LEN);
797 // if (pTempBuffer == 0x00000000)
798 // return 0;
799 // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
800 // //Preform manchester de-modulation and display in a single line.
801 // numManchesterDemodBits = CmdManchesterDemod( strClockRate );
802 // //note: numManchesterDemodBits is set above in CmdManchesterDemod()
803 // if ( numManchesterDemodBits == 0 )
804 // return 0;
805 // strBitStreamBuffer = malloc(numManchesterDemodBits+1);
806 // if ( strBitStreamBuffer == 0x00000000 )
807 // return 0;
808 // memset(strBitStreamBuffer, 0x00, (numManchesterDemodBits+1));
809 // //fill strBitStreamBuffer with demodulated, string formatted bits.
810 // for ( j = 0; j <= numManchesterDemodBits; j++ )
811 // {
812 // sprintf(strTempBufferMini, "%i",BitStream[j]);
813 // strcat(strBitStreamBuffer,strTempBufferMini);
814 // }
815 // printf("[->]Demodulated Bitstream: \n%s\n", strBitStreamBuffer);
816 // //Reset counter and select most probable bit stream
817 // j = 0;
818 // while ( j < numManchesterDemodBits )
819 // {
820 // memset(strSimulateBitStream,0x00,64);
821 // //search for header of nine (9) 0's : 000000000 or nine (9) 1's : 1111 1111 1
822 // if ( ( strncmp(strBitStreamBuffer+j, ArrayTraceZero, sizeof(ArrayTraceZero)) == 0 ) ||
823 // ( strncmp(strBitStreamBuffer+j, ArrayTraceOne, sizeof(ArrayTraceOne)) == 0 ) )
824 // {
825 // iFirstHeaderOffset = j;
826 // memcpy(strSimulateBitStream, strBitStreamBuffer+j,64);
827 // printf("[->]Offset of Header");
828 // if ( strncmp(strBitStreamBuffer+iFirstHeaderOffset, "0", 1) == 0 )
829 // printf("'%s'", ArrayTraceZero );
830 // else
831 // printf("'%s'", ArrayTraceOne );
832 // printf(": %i\nHighlighted string : %s\n",iFirstHeaderOffset,strSimulateBitStream);
833 // //allow us to escape loop or choose another frame
834 // puts("[<-]Are we happy with this sample? [Y]es/[N]o");
835 // gets(strAnswer);
836 // if ( ( strncmp(strAnswer,"y",1) == 0 ) || ( strncmp(strAnswer,"Y",1) == 0 ) )
837 // {
838 // j = numManchesterDemodBits+1;
839 // break;
840 // }
841 // }
842 // j++;
843 // }
844 // }
845 // else return 0;
846
847 // //Do we want the buffer inverted?
848 // memset(strAnswer, 0x00, sizeof(strAnswer));
849 // printf("[<-]Do you wish to invert the highlighted bitstream? [Y]es/[N]o\n");
850 // gets(strAnswer);
851 // if ( ( strncmp("y", strAnswer,1) == 0 ) || ( strncmp("Y", strAnswer, 1 ) == 0 ) )
852 // {
853 // //allocate heap memory
854 // pstrInvertBitStream = (char*)malloc(numManchesterDemodBits);
855 // if ( pstrInvertBitStream != 0x00000000 )
856 // {
857 // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
858 // bInverted = true;
859 // //Invert Bitstream
860 // for ( needle = 0; needle <= numManchesterDemodBits; needle++ )
861 // {
862 // if (strSimulateBitStream[needle] == '0')
863 // strcat(pstrInvertBitStream,"1");
864 // else if (strSimulateBitStream[needle] == '1')
865 // strcat(pstrInvertBitStream,"0");
866 // }
867 // printf("[->]Inverted bitstream: %s\n", pstrInvertBitStream);
868 // }
869 // }
870 // //Confirm parity of selected string
871 // pID = (char*)malloc(11);
872 // if (pID != 0x00000000)
873 // {
874 // memset(pID, 0x00, 11);
875 // if (ConfirmEm410xTagParity(strSimulateBitStream,pID, 64) == 1)
876 // {
877 // printf("[->]Parity confirmed for selected bitstream!\n");
878 // printf("[->]Tag ID was detected as: [hex]:%s\n",pID );
879 // }
880 // else
881 // printf("[->]Parity check failed for the selected bitstream!\n");
882 // }
883
884 // //Spoof
885 // memset(strAnswer, 0x00, sizeof(strAnswer));
886 // printf("[<-]Do you wish to continue with the EM4x simulation? [Y]es/[N]o\n");
887 // gets(strAnswer);
888 // if ( ( strncmp(strAnswer,"y",1) == 0 ) || ( strncmp(strAnswer,"Y",1) == 0 ) )
889 // {
890 // strcat(pTempBuffer, strClockRate);
891 // strcat(pTempBuffer, " ");
892 // if (bInverted == true)
893 // strcat(pTempBuffer,pstrInvertBitStream);
894 // if (bInverted == false)
895 // strcat(pTempBuffer,strSimulateBitStream);
896 // //inform the user
897 // puts("[->]Starting simulation now: \n");
898 // //Simulate tag with prepared buffer.
899 // CmdLFSimManchester(pTempBuffer);
900 // }
901 // else if ( ( strcmp("n", strAnswer) == 0 ) || ( strcmp("N", strAnswer ) == 0 ) )
902 // printf("[->]Exiting procedure now...\n");
903 // else
904 // printf("[->]Erroneous selection\nExiting procedure now....\n");
905
906 // //Clean up -- Exit function
907 // //clear memory, then release pointer.
908 // if ( pstrInvertBitStream != 0x00000000 )
909 // {
910 // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
911 // free(pstrInvertBitStream);
912 // }
913 // if ( pTempBuffer != 0x00000000 )
914 // {
915 // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
916 // free(pTempBuffer);
917 // }
918 // if ( pID != 0x00000000 )
919 // {
920 // memset(pID,0x00,11);
921 // free(pID);
922 // }
923 // if ( strBitStreamBuffer != 0x00000000 )
924 // {
925 // memset(strBitStreamBuffer,0x00,numManchesterDemodBits);
926 // free(strBitStreamBuffer);
927 // }
928 return 0;
929 }
930
931 int CmdLFEM4X(const char *Cmd)
932 {
933 CmdsParse(CommandTable, Cmd);
934 return 0;
935 }
936
937 int CmdHelp(const char *Cmd)
938 {
939 CmdsHelp(CommandTable);
940 return 0;
941 }
Impressum, Datenschutz