1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
12 bool g_lf_threshold_set
= FALSE
;
14 static int CmdHelp(const char *Cmd
);
16 int usage_lf_cmdread(void) {
17 PrintAndLog("Usage: lf cmdread d <delay period> z <zero period> o <one period> c <cmdbytes> [H]");
18 PrintAndLog("Options:");
19 PrintAndLog(" h This help");
20 PrintAndLog(" L Low frequency (125 KHz)");
21 PrintAndLog(" H High frequency (134 KHz)");
22 PrintAndLog(" d <delay> delay OFF period, (decimal)");
23 PrintAndLog(" z <zero> time period ZERO, (decimal)");
24 PrintAndLog(" o <one> time period ONE, (decimal)");
25 PrintAndLog(" c <cmd> Command bytes (in ones and zeros)");
26 PrintAndLog(" ************* All periods in microseconds (ms)");
27 PrintAndLog("Examples:");
28 PrintAndLog(" lf cmdread d 80 z 100 o 200 c 11000");
29 PrintAndLog(" lf cmdread d 80 z 100 o 100 c 11000 H");
32 int usage_lf_read(void){
33 PrintAndLog("Usage: lf read [h] [s]");
34 PrintAndLog("Options:");
35 PrintAndLog(" h This help");
36 PrintAndLog(" s silent run no printout");
37 PrintAndLog("Use 'lf config' to set parameters.");
40 int usage_lf_snoop(void) {
41 PrintAndLog("Snoop low frequence signal. Use 'lf config' to set parameters.");
42 PrintAndLog("Usage: lf snoop [h]");
43 PrintAndLog("Options:");
44 PrintAndLog(" h This help");
47 int usage_lf_config(void) {
48 PrintAndLog("Usage: lf config [h] [H|<divisor>] [b <bps>] [d <decim>] [a 0|1]");
49 PrintAndLog("Options:");
50 PrintAndLog(" h This help");
51 PrintAndLog(" L Low frequency (125 KHz)");
52 PrintAndLog(" H High frequency (134 KHz)");
53 PrintAndLog(" q <divisor> Manually set divisor. 88-> 134KHz, 95-> 125 Hz");
54 PrintAndLog(" b <bps> Sets resolution of bits per sample. Default (max): 8");
55 PrintAndLog(" d <decim> Sets decimation. A value of N saves only 1 in N samples. Default: 1");
56 PrintAndLog(" a [0|1] Averaging - if set, will average the stored sample value when decimating. Default: 1");
57 PrintAndLog(" t <threshold> Sets trigger threshold. 0 means no threshold (range: 0-128)");
58 PrintAndLog("Examples:");
59 PrintAndLog(" lf config b 8 L");
60 PrintAndLog(" Samples at 125KHz, 8bps.");
61 PrintAndLog(" lf config H b 4 d 3");
62 PrintAndLog(" Samples at 134KHz, averages three samples into one, stored with ");
63 PrintAndLog(" a resolution of 4 bits per sample.");
64 PrintAndLog(" lf read");
65 PrintAndLog(" Performs a read (active field)");
66 PrintAndLog(" lf snoop");
67 PrintAndLog(" Performs a snoop (no active field)");
70 int usage_lf_simfsk(void) {
71 PrintAndLog("Usage: lf simfsk [c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>]");
72 PrintAndLog("Options:");
73 PrintAndLog(" h This help");
74 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
75 PrintAndLog(" i invert data");
76 PrintAndLog(" H <fcHigh> Manually set the larger Field Clock");
77 PrintAndLog(" L <fcLow> Manually set the smaller Field Clock");
78 //PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
79 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
80 PrintAndLog("\n NOTE: if you set one clock manually set them all manually");
83 int usage_lf_simask(void) {
84 PrintAndLog("Usage: lf simask [c <clock>] [i] [b|m|r] [s] [d <raw hex to sim>]");
85 PrintAndLog("Options:");
86 PrintAndLog(" h This help");
87 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
88 PrintAndLog(" i invert data");
89 PrintAndLog(" b sim ask/biphase");
90 PrintAndLog(" m sim ask/manchester - Default");
91 PrintAndLog(" r sim ask/raw");
92 PrintAndLog(" s add t55xx Sequence Terminator gap - default: no gaps (only manchester)");
93 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
96 int usage_lf_simpsk(void) {
97 PrintAndLog("Usage: lf simpsk [1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>]");
98 PrintAndLog("Options:");
99 PrintAndLog(" h This help");
100 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
101 PrintAndLog(" i invert data");
102 PrintAndLog(" 1 set PSK1 (default)");
103 PrintAndLog(" 2 set PSK2");
104 PrintAndLog(" 3 set PSK3");
105 PrintAndLog(" r <carrier> 2|4|8 are valid carriers: default = 2");
106 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
109 int usage_lf_find(void){
110 PrintAndLog("Usage: lf search [h] <0|1> [u]");
112 PrintAndLog("Options:");
113 PrintAndLog(" h This help");
114 PrintAndLog(" <0|1> Use data from Graphbuffer, if not set, try reading data from tag.");
115 PrintAndLog(" u Search for Unknown tags, if not set, reads only known tags.");
116 PrintAndLog("Examples:");
117 PrintAndLog(" lf search = try reading data from tag & search for known tags");
118 PrintAndLog(" lf search 1 = use data from GraphBuffer & search for known tags");
119 PrintAndLog(" lf search u = try reading data from tag & search for known and unknown tags");
120 PrintAndLog(" lf search 1 u = use data from GraphBuffer & search for known and unknown tags");
125 /* send a LF command before reading */
126 int CmdLFCommandRead(const char *Cmd
) {
129 bool useHighFreq
= FALSE
;
130 uint16_t one
= 0, zero
= 0;
132 UsbCommand c
= {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
, {0,0,0}};
134 while(param_getchar(Cmd
, cmdp
) != 0x00) {
135 switch(param_getchar(Cmd
, cmdp
)) {
137 return usage_lf_cmdread();
146 param_getstr(Cmd
, cmdp
+1, (char *)&c
.d
.asBytes
);
150 c
.arg
[0] = param_get32ex(Cmd
, cmdp
+1, 0, 10);
154 zero
= param_get32ex(Cmd
, cmdp
+1, 0, 10) & 0xFFFF;
158 one
= param_get32ex(Cmd
, cmdp
+1, 0, 10) & 0xFFFF;
162 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
169 if (cmdp
== 0) errors
= TRUE
;
172 if (errors
) return usage_lf_cmdread();
174 // zero and one lengths
175 c
.arg
[1] = (uint32_t)(zero
<< 16 | one
);
177 // add frequency 125 or 134
178 c
.arg
[2] = useHighFreq
;
180 clearCommandBuffer();
185 int CmdFlexdemod(const char *Cmd
)
187 #define LONG_WAIT 100
188 int i
, j
, start
, bit
, sum
;
191 for (i
= 0; i
< GraphTraceLen
; ++i
)
192 GraphBuffer
[i
] = (GraphBuffer
[i
] < 0) ? -1 : 1;
194 for (start
= 0; start
< GraphTraceLen
- LONG_WAIT
; start
++) {
195 int first
= GraphBuffer
[start
];
196 for (i
= start
; i
< start
+ LONG_WAIT
; i
++) {
197 if (GraphBuffer
[i
] != first
) {
201 if (i
== (start
+ LONG_WAIT
))
205 if (start
== GraphTraceLen
- LONG_WAIT
) {
206 PrintAndLog("nothing to wait for");
210 GraphBuffer
[start
] = 2;
211 GraphBuffer
[start
+1] = -2;
212 uint8_t bits
[64] = {0x00};
215 for (bit
= 0; bit
< 64; bit
++) {
217 for (int j
= 0; j
< 16; j
++) {
218 sum
+= GraphBuffer
[i
++];
220 bits
[bit
] = (sum
> 0) ? 1 : 0;
221 PrintAndLog("bit %d sum %d", bit
, sum
);
224 for (bit
= 0; bit
< 64; bit
++) {
226 for (j
= 0; j
< 16; j
++)
227 sum
+= GraphBuffer
[i
++];
229 if (sum
> 0 && bits
[bit
] != 1) PrintAndLog("oops1 at %d", bit
);
231 if (sum
< 0 && bits
[bit
] != 0) PrintAndLog("oops2 at %d", bit
);
235 // HACK writing back to graphbuffer.
236 GraphTraceLen
= 32*64;
238 for (bit
= 0; bit
< 64; bit
++) {
240 phase
= (bits
[bit
] == 0) ? 0 : 1;
242 for (j
= 0; j
< 32; j
++) {
243 GraphBuffer
[i
++] = phase
;
247 RepaintGraphWindow();
251 int CmdIndalaDemod(const char *Cmd
)
255 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
260 // worst case with GraphTraceLen=64000 is < 4096
261 // under normal conditions it's < 2048
262 uint8_t rawbits
[4096];
264 int rawbit
= 0, worst
= 0, worstPos
= 0;
265 // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
267 // loop through raw signal - since we know it is psk1 rf/32 fc/2 skip every other value (+=2)
268 for (i
= 0; i
< GraphTraceLen
-1; i
+= 2) {
270 if ((GraphBuffer
[i
] > GraphBuffer
[i
+ 1]) && (state
!= 1)) {
271 // appears redundant - marshmellow
273 for (j
= 0; j
< count
- 8; j
+= 16) {
274 rawbits
[rawbit
++] = 0;
276 if ((abs(count
- j
)) > worst
) {
277 worst
= abs(count
- j
);
283 } else if ((GraphBuffer
[i
] < GraphBuffer
[i
+ 1]) && (state
!= 0)) {
286 for (j
= 0; j
< count
- 8; j
+= 16) {
287 rawbits
[rawbit
++] = 1;
289 if ((abs(count
- j
)) > worst
) {
290 worst
= abs(count
- j
);
298 if ( rawbit
<1 ) return 0;
301 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit
, GraphTraceLen
/32);
302 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst
, worstPos
);
305 // Finding the start of a UID
306 int uidlen
, long_wait
;
307 if (strcmp(Cmd
, "224") == 0) {
317 for (start
= 0; start
<= rawbit
- uidlen
; start
++) {
318 first
= rawbits
[start
];
319 for (i
= start
; i
< start
+ long_wait
; i
++) {
320 if (rawbits
[i
] != first
) {
324 if (i
== (start
+ long_wait
)) {
329 if (start
== rawbit
- uidlen
+ 1) {
330 if (g_debugMode
) PrintAndLog("nothing to wait for");
334 // Inverting signal if needed
336 for (i
= start
; i
< rawbit
; i
++)
337 rawbits
[i
] = !rawbits
[i
];
341 uint8_t bits
[224] = {0x00};
342 char showbits
[225] = {0x00};
347 if (uidlen
> rawbit
) {
348 PrintAndLog("Warning: not enough raw bits to get a full UID");
349 for (bit
= 0; bit
< rawbit
; bit
++) {
350 bits
[bit
] = rawbits
[i
++];
351 // As we cannot know the parity, let's use "." and "/"
352 showbits
[bit
] = '.' + bits
[bit
];
354 showbits
[bit
+1]='\0';
355 PrintAndLog("Partial UID=%s", showbits
);
358 for (bit
= 0; bit
< uidlen
; bit
++) {
359 bits
[bit
] = rawbits
[i
++];
360 showbits
[bit
] = '0' + bits
[bit
];
366 uint32_t uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
371 for( idx
=0; idx
<64; idx
++) {
372 if (showbits
[idx
] == '0') {
373 uid1
= (uid1
<<1) | (uid2
>>31);
374 uid2
= (uid2
<<1) | 0;
376 uid1
= (uid1
<<1) | (uid2
>>31);
377 uid2
= (uid2
<<1) | 1;
380 PrintAndLog("UID=%s (%x%08x)", showbits
, uid1
, uid2
);
382 uid3
= uid4
= uid5
= uid6
= uid7
= 0;
384 for( idx
=0; idx
<224; idx
++) {
385 uid1
= (uid1
<<1) | (uid2
>>31);
386 uid2
= (uid2
<<1) | (uid3
>>31);
387 uid3
= (uid3
<<1) | (uid4
>>31);
388 uid4
= (uid4
<<1) | (uid5
>>31);
389 uid5
= (uid5
<<1) | (uid6
>>31);
390 uid6
= (uid6
<<1) | (uid7
>>31);
392 if (showbits
[idx
] == '0')
393 uid7
= (uid7
<<1) | 0;
395 uid7
= (uid7
<<1) | 1;
397 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits
, uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
400 // Checking UID against next occurrences
402 for (; i
+ uidlen
<= rawbit
;) {
404 for (bit
= 0; bit
< uidlen
; bit
++) {
405 if (bits
[bit
] != rawbits
[i
++]) {
416 if (g_debugMode
) PrintAndLog("Occurrences: %d (expected %d)", times
, (rawbit
- start
) / uidlen
);
418 // Remodulating for tag cloning
419 // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
420 // since this changes graphbuffer data.
421 GraphTraceLen
= 32 * uidlen
;
424 for (bit
= 0; bit
< uidlen
; bit
++) {
425 phase
= (bits
[bit
] == 0) ? 0 : 1;
427 for (j
= 0; j
< 32; j
++) {
428 GraphBuffer
[i
++] = phase
;
433 RepaintGraphWindow();
437 int CmdIndalaClone(const char *Cmd
){
439 unsigned int uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
441 uid1
= uid2
= uid3
= uid4
= uid5
= uid6
= uid7
= 0;
444 if (strchr(Cmd
,'l') != 0) {
445 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
446 uid1
= (uid1
<< 4) | (uid2
>> 28);
447 uid2
= (uid2
<< 4) | (uid3
>> 28);
448 uid3
= (uid3
<< 4) | (uid4
>> 28);
449 uid4
= (uid4
<< 4) | (uid5
>> 28);
450 uid5
= (uid5
<< 4) | (uid6
>> 28);
451 uid6
= (uid6
<< 4) | (uid7
>> 28);
452 uid7
= (uid7
<< 4) | (n
& 0xf);
454 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
455 c
.cmd
= CMD_INDALA_CLONE_TAG_L
;
456 c
.d
.asDwords
[0] = uid1
;
457 c
.d
.asDwords
[1] = uid2
;
458 c
.d
.asDwords
[2] = uid3
;
459 c
.d
.asDwords
[3] = uid4
;
460 c
.d
.asDwords
[4] = uid5
;
461 c
.d
.asDwords
[5] = uid6
;
462 c
.d
.asDwords
[6] = uid7
;
464 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
465 uid1
= (uid1
<< 4) | (uid2
>> 28);
466 uid2
= (uid2
<< 4) | (n
& 0xf);
468 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1
, uid2
);
469 c
.cmd
= CMD_INDALA_CLONE_TAG
;
474 clearCommandBuffer();
479 int CmdLFSetConfig(const char *Cmd
) {
480 uint8_t divisor
= 0;//Frequency divisor
481 uint8_t bps
= 0; // Bits per sample
482 uint8_t decimation
= 0; //How many to keep
483 bool averaging
= 1; // Defaults to true
485 int trigger_threshold
= -1;//Means no change
486 uint8_t unsigned_trigg
= 0;
489 while(param_getchar(Cmd
, cmdp
) != 0x00) {
490 switch(param_getchar(Cmd
, cmdp
)) {
492 return usage_lf_config();
502 errors
|= param_getdec(Cmd
, cmdp
+1, &divisor
);
506 errors
|= param_getdec(Cmd
, cmdp
+1, &unsigned_trigg
);
509 trigger_threshold
= unsigned_trigg
;
510 g_lf_threshold_set
= (trigger_threshold
> 0);
514 errors
|= param_getdec(Cmd
, cmdp
+1, &bps
);
518 errors
|= param_getdec(Cmd
, cmdp
+1, &decimation
);
522 averaging
= param_getchar(Cmd
, cmdp
+1) == '1';
526 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
534 if (cmdp
== 0) errors
= 1;
537 if (errors
) return usage_lf_config();
539 //Bps is limited to 8
540 if (bps
>> 4) bps
= 8;
542 sample_config config
= { decimation
, bps
, averaging
, divisor
, trigger_threshold
};
544 UsbCommand c
= {CMD_SET_LF_SAMPLING_CONFIG
, {0,0,0} };
545 memcpy(c
.d
.asBytes
, &config
, sizeof(sample_config
));
546 clearCommandBuffer();
551 int CmdLFRead(const char *Cmd
) {
553 if (offline
) return 0;
558 while(param_getchar(Cmd
, cmdp
) != 0x00) {
559 switch(param_getchar(Cmd
, cmdp
)) {
562 return usage_lf_read();
569 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
577 if (cmdp
== 0) errors
= 1;
580 if (errors
) return usage_lf_read();
582 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
, {arg1
,0,0}};
583 clearCommandBuffer();
585 if ( g_lf_threshold_set
) {
586 WaitForResponse(CMD_ACK
,NULL
);
588 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
,2500) ) {
589 PrintAndLog("command execution time out");
596 int CmdLFSnoop(const char *Cmd
) {
597 uint8_t cmdp
= param_getchar(Cmd
, 0);
598 if(cmdp
== 'h' || cmdp
== 'H') return usage_lf_snoop();
600 UsbCommand c
= {CMD_LF_SNOOP_RAW_ADC_SAMPLES
,{0,0,0}};
601 clearCommandBuffer();
603 WaitForResponse(CMD_ACK
,NULL
);
604 getSamples("", false);
608 static void ChkBitstream(const char *str
) {
609 // convert to bitstream if necessary
610 for (int i
= 0; i
< (int)(GraphTraceLen
/ 2); i
++){
611 if (GraphBuffer
[i
] > 1 || GraphBuffer
[i
] < 0) {
617 //Attempt to simulate any wave in buffer (one bit per output sample)
618 // converts GraphBuffer to bitstream (based on zero crossings) if needed.
619 int CmdLFSim(const char *Cmd
) {
623 sscanf(Cmd
, "%i", &gap
);
625 // convert to bitstream if necessary
629 printf("DEBUG: Sending [%d bytes]\n", GraphTraceLen
);
631 //can send only 512 bits at a time (1 byte sent per bit...)
632 for (i
= 0; i
< GraphTraceLen
; i
+= USB_CMD_DATA_SIZE
) {
633 UsbCommand c
= {CMD_DOWNLOADED_SIM_SAMPLES_125K
, {i
, 0, 0}};
635 for (j
= 0; j
< USB_CMD_DATA_SIZE
; j
++)
636 c
.d
.asBytes
[j
] = GraphBuffer
[i
+j
];
638 clearCommandBuffer();
640 WaitForResponse(CMD_ACK
, NULL
);
644 PrintAndLog("Simulating");
646 UsbCommand c
= {CMD_SIMULATE_TAG_125K
, {GraphTraceLen
, gap
, 0}};
647 clearCommandBuffer();
652 // by marshmellow - sim fsk data given clock, fcHigh, fcLow, invert
653 // - allow pull data from DemodBuffer
654 int CmdLFfskSim(const char *Cmd
)
656 //might be able to autodetect FCs and clock from Graphbuffer if using demod buffer
657 // otherwise will need FChigh, FClow, Clock, and bitstream
658 uint8_t fcHigh
= 0, fcLow
= 0, clk
= 0;
661 char hexData
[32] = {0x00}; // store entered hex data
662 uint8_t data
[255] = {0x00};
666 while(param_getchar(Cmd
, cmdp
) != 0x00) {
667 switch(param_getchar(Cmd
, cmdp
)){
669 return usage_lf_simfsk();
675 errors
|= param_getdec(Cmd
, cmdp
+1, &clk
);
679 errors
|= param_getdec(Cmd
, cmdp
+1, &fcHigh
);
683 errors
|= param_getdec(Cmd
, cmdp
+1, &fcLow
);
691 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
695 dataLen
= hextobinarray((char *)data
, hexData
);
697 if (dataLen
== 0) errors
= TRUE
;
698 if (errors
) PrintAndLog ("Error getting hex data");
702 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
710 if(cmdp
== 0 && DemodBufferLen
== 0)
714 if(errors
) return usage_lf_simfsk();
716 if (dataLen
== 0){ //using DemodBuffer
717 if (clk
== 0 || fcHigh
== 0 || fcLow
== 0){ //manual settings must set them all
718 uint8_t ans
= fskClocks(&fcHigh
, &fcLow
, &clk
, 0);
720 if (!fcHigh
) fcHigh
= 10;
721 if (!fcLow
) fcLow
= 8;
726 setDemodBuf(data
, dataLen
, 0);
729 //default if not found
730 if (clk
== 0) clk
= 50;
731 if (fcHigh
== 0) fcHigh
= 10;
732 if (fcLow
== 0) fcLow
= 8;
735 arg1
= fcHigh
<< 8 | fcLow
;
736 arg2
= invert
<< 8 | clk
;
737 size_t size
= DemodBufferLen
;
738 if (size
> USB_CMD_DATA_SIZE
) {
739 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
740 size
= USB_CMD_DATA_SIZE
;
742 UsbCommand c
= {CMD_FSK_SIM_TAG
, {arg1
, arg2
, size
}};
744 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
745 clearCommandBuffer();
750 // by marshmellow - sim ask data given clock, invert, manchester or raw, separator
751 // - allow pull data from DemodBuffer
752 int CmdLFaskSim(const char *Cmd
)
754 // autodetect clock from Graphbuffer if using demod buffer
755 // needs clock, invert, manchester/raw as m or r, separator as s, and bitstream
756 uint8_t encoding
= 1, separator
= 0, clk
= 0, invert
= 0;
758 char hexData
[32] = {0x00};
759 uint8_t data
[255]= {0x00}; // store entered hex data
763 while(param_getchar(Cmd
, cmdp
) != 0x00) {
764 switch(param_getchar(Cmd
, cmdp
)) {
766 case 'h': return usage_lf_simask();
772 errors
|= param_getdec(Cmd
, cmdp
+1, &clk
);
776 encoding
= 2; //biphase
780 encoding
= 1; //manchester
792 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
796 dataLen
= hextobinarray((char *)data
, hexData
);
798 if (dataLen
== 0) errors
= TRUE
;
799 if (errors
) PrintAndLog ("Error getting hex data, datalen: %d", dataLen
);
803 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
811 if(cmdp
== 0 && DemodBufferLen
== 0)
815 if(errors
) return usage_lf_simask();
817 if (dataLen
== 0){ //using DemodBuffer
819 clk
= GetAskClock("0", false, false);
821 setDemodBuf(data
, dataLen
, 0);
823 if (clk
== 0) clk
= 64;
824 if (encoding
== 0) clk
>>= 2; //askraw needs to double the clock speed
826 size_t size
= DemodBufferLen
;
828 if (size
> USB_CMD_DATA_SIZE
) {
829 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
830 size
= USB_CMD_DATA_SIZE
;
833 PrintAndLog("preparing to sim ask data: %d bits", size
);
836 arg1
= clk
<< 8 | encoding
;
837 arg2
= invert
<< 8 | separator
;
839 UsbCommand c
= {CMD_ASK_SIM_TAG
, {arg1
, arg2
, size
}};
840 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
841 clearCommandBuffer();
846 // by marshmellow - sim psk data given carrier, clock, invert
847 // - allow pull data from DemodBuffer or parameters
848 int CmdLFpskSim(const char *Cmd
) {
849 //might be able to autodetect FC and clock from Graphbuffer if using demod buffer
850 //will need carrier, Clock, and bitstream
851 uint8_t carrier
=0, clk
=0;
854 char hexData
[32] = {0x00}; // store entered hex data
855 uint8_t data
[255] = {0x00};
860 while(param_getchar(Cmd
, cmdp
) != 0x00) {
861 switch(param_getchar(Cmd
, cmdp
)) {
863 return usage_lf_simpsk();
869 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
873 errors
|= param_getdec(Cmd
,cmdp
+1,&carrier
);
889 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
893 dataLen
= hextobinarray((char *)data
, hexData
);
895 if (dataLen
== 0) errors
= TRUE
;
896 if (errors
) PrintAndLog ("Error getting hex data");
900 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
907 if (cmdp
== 0 && DemodBufferLen
== 0)
911 if (errors
) return usage_lf_simpsk();
913 if (dataLen
== 0){ //using DemodBuffer
914 PrintAndLog("Getting Clocks");
916 if (clk
==0) clk
= GetPskClock("", FALSE
, FALSE
);
917 PrintAndLog("clk: %d",clk
);
919 if (!carrier
) carrier
= GetPskCarrier("", FALSE
, FALSE
);
920 PrintAndLog("carrier: %d", carrier
);
923 setDemodBuf(data
, dataLen
, 0);
926 if (clk
<= 0) clk
= 32;
928 if (carrier
== 0) carrier
= 2;
932 //need to convert psk2 to psk1 data before sim
933 psk2TOpsk1(DemodBuffer
, DemodBufferLen
);
935 PrintAndLog("Sorry, PSK3 not yet available");
939 arg1
= clk
<< 8 | carrier
;
941 size_t size
= DemodBufferLen
;
942 if (size
> USB_CMD_DATA_SIZE
) {
943 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size
, USB_CMD_DATA_SIZE
);
944 size
= USB_CMD_DATA_SIZE
;
946 UsbCommand c
= {CMD_PSK_SIM_TAG
, {arg1
, arg2
, size
}};
947 PrintAndLog("DEBUG: Sending DemodBuffer Length: %d", size
);
948 memcpy(c
.d
.asBytes
, DemodBuffer
, size
);
949 clearCommandBuffer();
954 int CmdLFSimBidir(const char *Cmd
) {
955 // Set ADC to twice the carrier for a slight supersampling
956 // HACK: not implemented in ARMSRC.
957 PrintAndLog("Not implemented yet.");
958 UsbCommand c
= {CMD_LF_SIMULATE_BIDIR
, {47, 384, 0}};
963 int CmdVchDemod(const char *Cmd
) {
964 // Is this the entire sync pattern, or does this also include some
965 // data bits that happen to be the same everywhere? That would be
967 static const int SyncPattern
[] = {
968 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
969 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
970 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
971 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
972 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
973 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
974 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
975 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
976 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
977 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
980 // So first, we correlate for the sync pattern, and mark that.
981 int bestCorrel
= 0, bestPos
= 0;
984 // It does us no good to find the sync pattern, with fewer than 2048 samples after it.
986 for (i
= 0; i
< (GraphTraceLen
- 2048); i
++) {
987 for (j
= 0; j
< ARRAYLEN(SyncPattern
); j
++) {
988 sum
+= GraphBuffer
[i
+j
] * SyncPattern
[j
];
990 if (sum
> bestCorrel
) {
995 PrintAndLog("best sync at %d [metric %d]", bestPos
, bestCorrel
);
1000 int worst
= INT_MAX
, worstPos
= 0;
1002 for (i
= 0; i
< 2048; i
+= 8) {
1004 for (j
= 0; j
< 8; j
++)
1005 sum
+= GraphBuffer
[bestPos
+i
+j
];
1012 if(abs(sum
) < worst
) {
1017 PrintAndLog("bits:");
1018 PrintAndLog("%s", bits
);
1019 PrintAndLog("worst metric: %d at pos %d", worst
, worstPos
);
1022 if (strcmp(Cmd
, "clone")==0) {
1025 for(s
= bits
; *s
; s
++) {
1026 for(j
= 0; j
< 16; j
++) {
1027 GraphBuffer
[GraphTraceLen
++] = (*s
== '1') ? 1 : 0;
1030 RepaintGraphWindow();
1037 int CheckChipset(bool getDeviceData
) {
1039 if (!getDeviceData
) return 0;
1044 //check for em4x05/em4x69 chips first
1045 if (EM4x05IsBlock0(&word
)) {
1047 PrintAndLog("\nValid EM4x05/EM4x69 Chipset found\nTry `lf em 4x05` commands\n");
1051 //TODO check for t55xx chip...
1052 // if ( t55xxIsBlock0(() {
1053 // save_restoreGB(0);
1054 // PrintAndLog("\nValid T55xx Chipset found\nTry `lf t55xx` commands\n");
1063 int CmdLFfind(const char *Cmd
) {
1065 size_t minLength
= 1000;
1066 char cmdp
= param_getchar(Cmd
, 0);
1067 char testRaw
= param_getchar(Cmd
, 1);
1068 if (strlen(Cmd
) > 3 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_find();
1070 bool getDeviceData
= (!offline
&& (cmdp
!= '1') );
1072 if (getDeviceData
) {
1074 getSamples("30000", false);
1075 } else if (GraphTraceLen
< minLength
) {
1076 PrintAndLog("Data in Graphbuffer was too small.");
1079 if (cmdp
== 'u' || cmdp
== 'U') testRaw
= 'u';
1081 PrintAndLog("NOTE: some demods output possible binary\n if it finds something that looks like a tag");
1082 PrintAndLog("False Positives ARE possible\n");
1083 PrintAndLog("\nChecking for known tags:\n");
1085 size_t testLen
= minLength
;
1087 // only run these tests if device is online
1088 if (getDeviceData
) {
1090 // only run if graphbuffer is just noise as it should be for hitag/cotag
1091 if (graphJustNoise(GraphBuffer
, testLen
)) {
1093 if (CheckChipset(getDeviceData
) )
1096 ans
=CmdLFHitagReader("26");
1100 ans
=CmdCOTAGRead("");
1102 PrintAndLog("\nValid COTAG ID Found!");
1105 PrintAndLog("Signal looks just like noise. Quitting.");
1111 CheckChipset(getDeviceData
);
1113 ans
=CmdFSKdemodIO("");
1115 PrintAndLog("\nValid IO Prox ID Found!");
1118 ans
=CmdFSKdemodPyramid("");
1120 PrintAndLog("\nValid Pyramid ID Found!");
1123 ans
=CmdFSKdemodParadox("");
1125 PrintAndLog("\nValid Paradox ID Found!");
1128 ans
=CmdFSKdemodAWID("");
1130 PrintAndLog("\nValid AWID ID Found!");
1133 ans
=CmdFSKdemodHID("");
1135 PrintAndLog("\nValid HID Prox ID Found!");
1138 ans
=CmdAskEM410xDemod("");
1140 PrintAndLog("\nValid EM410x ID Found!");
1143 ans
=CmdG_Prox_II_Demod("");
1145 PrintAndLog("\nValid Guardall G-Prox II ID Found!");
1148 ans
=CmdFDXBdemodBI("");
1150 PrintAndLog("\nValid FDX-B ID Found!");
1153 ans
=EM4x50Read("", false);
1155 PrintAndLog("\nValid EM4x50 ID Found!");
1158 ans
=CmdVikingDemod("");
1160 PrintAndLog("\nValid Viking ID Found!");
1163 ans
=CmdIndalaDecode("");
1165 PrintAndLog("\nValid Indala ID Found!");
1168 ans
=CmdPSKNexWatch("");
1170 PrintAndLog("\nValid NexWatch ID Found!");
1173 ans
=CmdPSKIdteck("");
1175 PrintAndLog("\nValid Idteck ID Found!");
1178 ans
=CmdJablotronDemod("");
1180 PrintAndLog("\nValid Jablotron ID Found!");
1183 ans
=CmdLFNedapDemod("");
1185 PrintAndLog("\nValid NEDAP ID Found!");
1188 ans
=CmdVisa2kDemod("");
1190 PrintAndLog("\nValid Visa2000 ID Found!");
1193 ans
=CmdNoralsyDemod("");
1195 PrintAndLog("\nValid Noralsy ID Found!");
1198 ans
=CmdPrescoDemod("");
1200 PrintAndLog("\nValid Presco ID Found!");
1205 PrintAndLog("\nNo Known Tags Found!\n");
1206 if (testRaw
=='u' || testRaw
=='U'){
1207 //test unknown tag formats (raw mode)
1208 PrintAndLog("\nChecking for Unknown tags:\n");
1209 ans
=AutoCorrelate(4000, FALSE
, FALSE
);
1213 PrintAndLog("Possible Auto Correlation of %d repeating samples",ans
);
1215 if ( ans
% 8 == 0) {
1216 int bytes
= (ans
/ 8);
1217 PrintAndLog("Possible %d bytes", bytes
);
1219 if ( bytes
% 2 == 0) {
1220 blocks
= (bytes
/ 2);
1221 PrintAndLog("Possible 2 blocks, width %d", blocks
);
1223 if ( bytes
% 4 == 0) {
1224 blocks
= (bytes
/ 4);
1225 PrintAndLog("Possible 4 blocks, width %d", blocks
);
1227 if ( bytes
% 8 == 0) {
1228 blocks
= (bytes
/ 8);
1229 PrintAndLog("Possible 8 blocks, width %d", blocks
);
1231 if ( bytes
% 16 == 0) {
1232 blocks
= (bytes
/ 16);
1233 PrintAndLog("Possible 16 blocks, width %d", blocks
);
1238 ans
=GetFskClock("",FALSE
,FALSE
);
1239 if (ans
!= 0){ //fsk
1240 ans
=FSKrawDemod("",TRUE
);
1242 PrintAndLog("\nUnknown FSK Modulated Tag Found!");
1247 ans
=ASKDemod_ext("0 0 0",TRUE
,FALSE
,1,&st
);
1249 PrintAndLog("\nUnknown ASK Modulated and Manchester encoded Tag Found!");
1250 PrintAndLog("\nif it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'");
1254 ans
=CmdPSK1rawDemod("");
1256 PrintAndLog("Possible unknown PSK1 Modulated Tag Found above!\n\nCould also be PSK2 - try 'data rawdemod p2'");
1257 PrintAndLog("\nCould also be PSK3 - [currently not supported]");
1258 PrintAndLog("\nCould also be NRZ - try 'data nrzrawdemod");
1261 PrintAndLog("\nNo Data Found!\n");
1266 static command_t CommandTable
[] = {
1267 {"help", CmdHelp
, 1, "This help"},
1268 {"animal", CmdLFFdx
, 1, "{ Animal RFIDs... }"},
1269 {"awid", CmdLFAWID
, 1, "{ AWID RFIDs... }"},
1270 {"cotag", CmdLFCOTAG
, 1, "{ COTAG RFIDs... }"},
1271 {"em", CmdLFEM4X
, 1, "{ EM4X RFIDs... }"},
1272 {"guard", CmdLFGuard
, 1, "{ Guardall RFIDs... }"},
1273 {"hid", CmdLFHID
, 1, "{ HID RFIDs... }"},
1274 {"hitag", CmdLFHitag
, 1, "{ HITAG RFIDs... }"},
1275 // {"indala", CmdLFIndala, 1, "{ Indala RFIDs... }"},
1276 {"io", CmdLFIO
, 1, "{ IOPROX RFIDs... }"},
1277 {"jablotron", CmdLFJablotron
, 1, "{ Jablotron RFIDs... }"},
1278 {"nedap", CmdLFNedap
, 1, "{ Nedap RFIDs... }"},
1279 {"noralsy", CmdLFNoralsy
, 1, "{ Noralsy RFIDs... }"},
1280 {"pcf7931", CmdLFPCF7931
, 1, "{ PCF7931 RFIDs... }"},
1281 {"presco", CmdLFPresco
, 1, "{ Presco RFIDs... }"},
1282 {"pyramid", CmdLFPyramid
, 1, "{ Farpointe/Pyramid RFIDs... }"},
1283 {"ti", CmdLFTI
, 1, "{ TI RFIDs... }"},
1284 {"t55xx", CmdLFT55XX
, 1, "{ T55xx RFIDs... }"},
1285 {"viking", CmdLFViking
, 1, "{ Viking RFIDs... }"},
1286 {"visa2000", CmdLFVisa2k
, 1, "{ Visa2000 RFIDs... }"},
1287 {"config", CmdLFSetConfig
, 0, "Set config for LF sampling, bit/sample, decimation, frequency"},
1288 {"cmdread", CmdLFCommandRead
, 0, "<off period> <'0' period> <'1' period> <command> ['h' 134] \n\t\t-- Modulate LF reader field to send command before read (all periods in microseconds)"},
1289 {"flexdemod", CmdFlexdemod
, 1, "Demodulate samples for FlexPass"},
1290 {"indalademod", CmdIndalaDemod
, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
1291 {"indalaclone", CmdIndalaClone
, 0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
1292 {"read", CmdLFRead
, 0, "['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"},
1293 {"search", CmdLFfind
, 1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) \n\t\t-- 'u' to search for unknown tags"},
1294 {"sim", CmdLFSim
, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
1295 {"simask", CmdLFaskSim
, 0, "[clock] [invert <1|0>] [biphase/manchester/raw <'b'|'m'|'r'>] [msg separator 's'] [d <hexdata>] \n\t\t-- Simulate LF ASK tag from demodbuffer or input"},
1296 {"simfsk", CmdLFfskSim
, 0, "[c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>] \n\t\t-- Simulate LF FSK tag from demodbuffer or input"},
1297 {"simpsk", CmdLFpskSim
, 0, "[1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>] \n\t\t-- Simulate LF PSK tag from demodbuffer or input"},
1298 {"simbidir", CmdLFSimBidir
, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
1299 {"snoop", CmdLFSnoop
, 0, "Snoop LF"},
1300 {"vchdemod", CmdVchDemod
, 1, "['clone'] -- Demodulate samples for VeriChip"},
1301 {NULL
, NULL
, 0, NULL
}
1304 int CmdLF(const char *Cmd
) {
1305 clearCommandBuffer();
1306 CmdsParse(CommandTable
, Cmd
);
1310 int CmdHelp(const char *Cmd
) {
1311 CmdsHelp(CommandTable
);