git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Low frequency EM4x commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include "proxusb.h"
  13 #include "ui.h"
  14 #include "graph.h"
  15 #include "cmdparser.h"
  16 #include "cmddata.h"
  17 #include "cmdlf.h"
  18 #include "cmdlfem4x.h"
  19
  20 static int CmdHelp(const char *Cmd);
  21
  22 /* Read the ID of an EM410x tag.
  23  * Format:
  24  *   1111 1111 1           <-- standard non-repeatable header
  25  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
  26  *   ....
  27  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
  28  *   0                     <-- stop bit, end of tag
  29  */
  30 int CmdEM410xRead(const char *Cmd)
  31 {
  32   int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
  33   int parity[4];
  34   char id[11];
  35   int retested = 0;
  36   int BitStream[MAX_GRAPH_TRACE_LEN];
  37   high = low = 0;
  38
  39   /* Detect high and lows and clock */
  40   for (i = 0; i < GraphTraceLen; i++)
  41   {
  42     if (GraphBuffer[i] > high)
  43       high = GraphBuffer[i];
  44     else if (GraphBuffer[i] < low)
  45       low = GraphBuffer[i];
  46   }
  47
  48   /* get clock */
  49   clock = GetClock(Cmd, high, 0);
  50
  51   /* parity for our 4 columns */
  52   parity[0] = parity[1] = parity[2] = parity[3] = 0;
  53   header = rows = 0;
  54
  55   /* manchester demodulate */
  56   bit = bit2idx = 0;
  57   for (i = 0; i < (int)(GraphTraceLen / clock); i++)
  58   {
  59     hithigh = 0;
  60     hitlow = 0;
  61     first = 1;
  62
  63     /* Find out if we hit both high and low peaks */
  64     for (j = 0; j < clock; j++)
  65     {
  66       if (GraphBuffer[(i * clock) + j] == high)
  67         hithigh = 1;
  68       else if (GraphBuffer[(i * clock) + j] == low)
  69         hitlow = 1;
  70
  71       /* it doesn't count if it's the first part of our read
  72        because it's really just trailing from the last sequence */
  73       if (first && (hithigh || hitlow))
  74         hithigh = hitlow = 0;
  75       else
  76         first = 0;
  77
  78       if (hithigh && hitlow)
  79         break;
  80     }
  81
  82     /* If we didn't hit both high and low peaks, we had a bit transition */
  83     if (!hithigh || !hitlow)
  84       bit ^= 1;
  85
  86     BitStream[bit2idx++] = bit;
  87   }
  88
  89 retest:
  90   /* We go till 5 before the graph ends because we'll get that far below */
  91   for (i = 1; i < bit2idx - 5; i++)
  92   {
  93     /* Step 2: We have our header but need our tag ID */
  94     if (header == 9 && rows < 10)
  95     {
  96       /* Confirm parity is correct */
  97       if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
  98       {
  99         /* Read another byte! */
 100         sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
 101         rows++;
 102
 103         /* Keep parity info */
 104         parity[0] ^= BitStream[i];
 105         parity[1] ^= BitStream[i+1];
 106         parity[2] ^= BitStream[i+2];
 107         parity[3] ^= BitStream[i+3];
 108
 109         /* Move 4 bits ahead */
 110         i += 4;
 111       }
 112
 113       /* Damn, something wrong! reset */
 114       else
 115       {
 116         PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
 117
 118         /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
 119         i -= 9 + (5 * rows) - 5;
 120
 121         rows = header = 0;
 122       }
 123     }
 124
 125     /* Step 3: Got our 40 bits! confirm column parity */
 126     else if (rows == 10)
 127     {
 128       /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
 129       if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
 130         BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
 131         BitStream[i+4] == 0)
 132       {
 133         /* Sweet! */
 134         PrintAndLog("EM410x Tag ID: %s", id);
 135
 136         /* Stop any loops */
 137         return 1;
 138       }
 139
 140       /* Crap! Incorrect parity or no stop bit, start all over */
 141       else
 142       {
 143         rows = header = 0;
 144
 145         /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
 146         i -= 59;
 147       }
 148     }
 149
 150     /* Step 1: get our header */
 151     else if (header < 9)
 152     {
 153       /* Need 9 consecutive 1's */
 154       if (BitStream[i] == 1)
 155         header++;
 156
 157       /* We don't have a header, not enough consecutive 1 bits */
 158       else
 159         header = 0;
 160     }
 161   }
 162
 163   /* if we've already retested after flipping bits, return */
 164   if (retested++)
 165     return 0;
 166
 167   /* if this didn't work, try flipping bits */
 168   for (i = 0; i < bit2idx; i++)
 169     BitStream[i] ^= 1;
 170
 171   goto retest;
 172 }
 173
 174 /* emulate an EM410X tag
 175  * Format:
 176  *   1111 1111 1           <-- standard non-repeatable header
 177  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
 178  *   ....
 179  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
 180  *   0                     <-- stop bit, end of tag
 181  */
 182 int CmdEM410xSim(const char *Cmd)
 183 {
 184   int i, n, j, h, binary[4], parity[4];
 185
 186   /* clock is 64 in EM410x tags */
 187   int clock = 64;
 188
 189   /* clear our graph */
 190   ClearGraph(0);
 191
 192   /* write it out a few times */
 193   for (h = 0; h < 4; h++)
 194   {
 195     /* write 9 start bits */
 196     for (i = 0; i < 9; i++)
 197       AppendGraph(0, clock, 1);
 198
 199     /* for each hex char */
 200     parity[0] = parity[1] = parity[2] = parity[3] = 0;
 201     for (i = 0; i < 10; i++)
 202     {
 203       /* read each hex char */
 204       sscanf(&Cmd[i], "%1x", &n);
 205       for (j = 3; j >= 0; j--, n/= 2)
 206         binary[j] = n % 2;
 207
 208       /* append each bit */
 209       AppendGraph(0, clock, binary[0]);
 210       AppendGraph(0, clock, binary[1]);
 211       AppendGraph(0, clock, binary[2]);
 212       AppendGraph(0, clock, binary[3]);
 213
 214       /* append parity bit */
 215       AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
 216
 217       /* keep track of column parity */
 218       parity[0] ^= binary[0];
 219       parity[1] ^= binary[1];
 220       parity[2] ^= binary[2];
 221       parity[3] ^= binary[3];
 222     }
 223
 224     /* parity columns */
 225     AppendGraph(0, clock, parity[0]);
 226     AppendGraph(0, clock, parity[1]);
 227     AppendGraph(0, clock, parity[2]);
 228     AppendGraph(0, clock, parity[3]);
 229
 230     /* stop bit */
 231     AppendGraph(0, clock, 0);
 232   }
 233
 234   /* modulate that biatch */
 235   CmdManchesterMod("");
 236
 237   /* booyah! */
 238   RepaintGraphWindow();
 239
 240   CmdLFSim("");
 241   return 0;
 242 }
 243
 244 /* Function is equivalent of loread + losamples + em410xread
 245  * looped until an EM410x tag is detected */
 246 int CmdEM410xWatch(const char *Cmd)
 247 {
 248   do
 249   {
 250     CmdLFRead("");
 251     CmdSamples("2000");
 252   } while ( ! CmdEM410xRead(""));
 253   return 0;
 254 }
 255
 256 /* Read the transmitted data of an EM4x50 tag
 257  * Format:
 258  *
 259  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 260  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 261  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 262  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 263  *  CCCCCCCC                         <- column parity bits
 264  *  0                                <- stop bit
 265  *  LW                               <- Listen Window
 266  *
 267  * This pattern repeats for every block of data being transmitted.
 268  * Transmission starts with two Listen Windows (LW - a modulated
 269  * pattern of 320 cycles each (32/32/128/64/64)).
 270  *
 271  * Note that this data may or may not be the UID. It is whatever data
 272  * is stored in the blocks defined in the control word First and Last
 273  * Word Read values. UID is stored in block 32.
 274  */
 275 int CmdEM4x50Read(const char *Cmd)
 276 {
 277   int i, j, startblock, clock, skip, block, start, end, low, high;
 278   bool complete= false;
 279   int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
 280   char tmp[6];
 281
 282   high= low= 0;
 283   clock= 64;
 284
 285   /* first get high and low values */
 286   for (i = 0; i < GraphTraceLen; i++)
 287   {
 288     if (GraphBuffer[i] > high)
 289       high = GraphBuffer[i];
 290     else if (GraphBuffer[i] < low)
 291       low = GraphBuffer[i];
 292   }
 293
 294   /* populate a buffer with pulse lengths */
 295   i= 0;
 296   j= 0;
 297   while (i < GraphTraceLen)
 298   {
 299     // measure from low to low
 300     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 301       ++i;
 302     start= i;
 303     while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
 304       ++i;
 305     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 306       ++i;
 307     if (j>(MAX_GRAPH_TRACE_LEN/64)) {
 308       break;
 309     }
 310     tmpbuff[j++]= i - start;
 311   }
 312
 313   /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
 314   start= -1;
 315   skip= 0;
 316   for (i= 0; i < j - 4 ; ++i)
 317   {
 318     skip += tmpbuff[i];
 319     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 320       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 321         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 322           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 323           {
 324             start= i + 3;
 325             break;
 326           }
 327   }
 328   startblock= i + 3;
 329
 330   /* skip over the remainder of the LW */
 331   skip += tmpbuff[i+1]+tmpbuff[i+2];
 332   while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
 333     ++skip;
 334   skip += 8;
 335
 336   /* now do it again to find the end */
 337   end= start;
 338   for (i += 3; i < j - 4 ; ++i)
 339   {
 340     end += tmpbuff[i];
 341     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 342       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 343         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 344           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 345           {
 346             complete= true;
 347             break;
 348           }
 349   }
 350
 351   if (start >= 0)
 352     PrintAndLog("Found data at sample: %i",skip);
 353   else
 354   {
 355     PrintAndLog("No data found!");
 356     PrintAndLog("Try again with more samples.");
 357     return 0;
 358   }
 359
 360   if (!complete)
 361   {
 362     PrintAndLog("*** Warning!");
 363     PrintAndLog("Partial data - no end found!");
 364     PrintAndLog("Try again with more samples.");
 365   }
 366
 367   /* get rid of leading crap */
 368   sprintf(tmp,"%i",skip);
 369   CmdLtrim(tmp);
 370
 371   /* now work through remaining buffer printing out data blocks */
 372   block= 0;
 373   i= startblock;
 374   while (block < 6)
 375   {
 376     PrintAndLog("Block %i:", block);
 377     // mandemod routine needs to be split so we can call it for data
 378     // just print for now for debugging
 379     CmdManchesterDemod("i 64");
 380     skip= 0;
 381     /* look for LW before start of next block */
 382     for ( ; i < j - 4 ; ++i)
 383     {
 384       skip += tmpbuff[i];
 385       if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 386         if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 387           break;
 388     }
 389     while (GraphBuffer[skip] > low)
 390       ++skip;
 391     skip += 8;
 392     sprintf(tmp,"%i",skip);
 393     CmdLtrim(tmp);
 394     start += skip;
 395     block++;
 396   }
 397   return 0;
 398 }
 399
 400 static command_t CommandTable[] =
 401 {
 402   {"help",        CmdHelp,        1, "This help"},
 403   {"em410xread",  CmdEM410xRead,  1, "[clock rate] -- Extract ID from EM410x tag"},
 404   {"em410xsim",   CmdEM410xSim,   0, "<UID> -- Simulate EM410x tag"},
 405   {"em410xwatch", CmdEM410xWatch, 0, "Watches for EM410x tags"},
 406   {"em4x50read",  CmdEM4x50Read,  1, "Extract data from EM4x50 tag"},
 407   {NULL, NULL, 0, NULL}
 408 };
 409
 410 int CmdLFEM4X(const char *Cmd)
 411 {
 412   CmdsParse(CommandTable, Cmd);
 413   return 0;
 414 }
 415
 416 int CmdHelp(const char *Cmd)
 417 {
 418   CmdsHelp(CommandTable);
 419   return 0;
 420 }