git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfindala.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency Indala commands
   8 // PSK1, rf/32, 64 or 224 bits (known)
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include "cmdlfindala.h"
  14 #include "proxmark3.h"
  15 #include "ui.h"
  16 #include "graph.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"  //for g_debugMode, demodbuff cmds
  19 #include "lfdemod.h"  //for indala26decode
  20 #include "util.h"     //for sprint_bin_break
  21 #include "cmdlf.h"    //for CmdLFRead
  22 #include "cmdmain.h"  //for clearCommandBuffer
  23
  24 static int CmdHelp(const char *Cmd);
  25
  26 // Indala 26 bit decode
  27 // by marshmellow
  28 // optional arguments - same as PSKDemod (clock & invert & maxerr)
  29 int CmdIndalaDecode(const char *Cmd) {
  30         int ans;
  31         if (strlen(Cmd)>0) {
  32                 ans = PSKDemod(Cmd, 0);
  33         } else { //default to RF/32
  34                 ans = PSKDemod("32", 0);
  35         }
  36
  37         if (!ans) {
  38                 if (g_debugMode) PrintAndLog("Error1: %i",ans);
  39                 return 0;
  40         }
  41         uint8_t invert=0;
  42         size_t size = DemodBufferLen;
  43         int startIdx = indala64decode(DemodBuffer, &size, &invert);
  44         if (startIdx < 0 || size != 64) {
  45                 // try 224 indala
  46                 invert = 0;
  47                 size = DemodBufferLen;
  48                 startIdx = indala224decode(DemodBuffer, &size, &invert);
  49                 if (startIdx < 0 || size != 224) {
  50                         if (g_debugMode) PrintAndLog("Error2: %i",startIdx);
  51                         return -1;
  52                 }
  53         }
  54         setDemodBuf(DemodBuffer, size, (size_t)startIdx);
  55         setClockGrid(g_DemodClock, g_DemodStartIdx + (startIdx*g_DemodClock));
  56         if (invert)
  57                 if (g_debugMode)
  58                         PrintAndLog("Had to invert bits");
  59
  60         PrintAndLog("BitLen: %d",DemodBufferLen);
  61         //convert UID to HEX
  62         uint32_t uid1, uid2, uid3, uid4, uid5, uid6, uid7;
  63         uid1=bytebits_to_byte(DemodBuffer,32);
  64         uid2=bytebits_to_byte(DemodBuffer+32,32);
  65         if (DemodBufferLen==64) {
  66                 PrintAndLog("Indala UID=%s (%x%08x)", sprint_bin_break(DemodBuffer,DemodBufferLen,16), uid1, uid2);
  67         } else if (DemodBufferLen==224) {
  68                 uid3=bytebits_to_byte(DemodBuffer+64,32);
  69                 uid4=bytebits_to_byte(DemodBuffer+96,32);
  70                 uid5=bytebits_to_byte(DemodBuffer+128,32);
  71                 uid6=bytebits_to_byte(DemodBuffer+160,32);
  72                 uid7=bytebits_to_byte(DemodBuffer+192,32);
  73                 PrintAndLog("Indala UID=%s (%x%08x%08x%08x%08x%08x%08x)",
  74                     sprint_bin_break(DemodBuffer,DemodBufferLen,16), uid1, uid2, uid3, uid4, uid5, uid6, uid7);
  75         }
  76         if (g_debugMode) {
  77                 PrintAndLog("DEBUG: printing demodbuffer:");
  78                 printDemodBuff();
  79         }
  80         return 1;
  81 }
  82
  83 int CmdIndalaRead(const char *Cmd) {
  84         lf_read(true, 30000);
  85         return CmdIndalaDecode("");
  86 }
  87
  88 // older alternative indala demodulate (has some positives and negatives)
  89 // returns false positives more often - but runs against more sets of samples
  90 // poor psk signal can be difficult to demod this approach might succeed when the other fails
  91 // but the other appears to currently be more accurate than this approach most of the time.
  92 int CmdIndalaDemod(const char *Cmd) {
  93         // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
  94
  95         int state = -1;
  96         int count = 0;
  97         int i, j;
  98
  99         // worst case with GraphTraceLen=64000 is < 4096
 100         // under normal conditions it's < 2048
 101
 102         uint8_t rawbits[4096];
 103         int rawbit = 0;
 104         int worst = 0, worstPos = 0;
 105
 106         //clear clock grid and demod plot
 107         setClockGrid(0, 0);
 108         DemodBufferLen = 0;
 109
 110         // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
 111         // loop through raw signal - since we know it is psk1 rf/32 fc/2 skip every other value (+=2)
 112         for (i = 0; i < GraphTraceLen-1; i += 2) {
 113                 count += 1;
 114                 if ((GraphBuffer[i] > GraphBuffer[i + 1]) && (state != 1)) {
 115                         // appears redundant - marshmellow
 116                         if (state == 0) {
 117                                 for (j = 0; j <  count - 8; j += 16) {
 118                                         rawbits[rawbit++] = 0;
 119                                 }
 120                                 if ((abs(count - j)) > worst) {
 121                                         worst = abs(count - j);
 122                                         worstPos = i;
 123                                 }
 124                         }
 125                         state = 1;
 126                         count = 0;
 127                 } else if ((GraphBuffer[i] < GraphBuffer[i + 1]) && (state != 0)) {
 128                         //appears redundant
 129                         if (state == 1) {
 130                                 for (j = 0; j <  count - 8; j += 16) {
 131                                         rawbits[rawbit++] = 1;
 132                                 }
 133                                 if ((abs(count - j)) > worst) {
 134                                         worst = abs(count - j);
 135                                         worstPos = i;
 136                                 }
 137                         }
 138                         state = 0;
 139                         count = 0;
 140                 }
 141         }
 142
 143         if (rawbit>0){
 144                 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit, GraphTraceLen/32);
 145                 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst, worstPos);
 146         } else {
 147                 return 0;
 148         }
 149
 150         // Finding the start of a UID
 151         int uidlen, long_wait;
 152         if (strcmp(Cmd, "224") == 0) {
 153                 uidlen = 224;
 154                 long_wait = 30;
 155         } else {
 156                 uidlen = 64;
 157                 long_wait = 29;
 158         }
 159
 160         int start;
 161         int first = 0;
 162         for (start = 0; start <= rawbit - uidlen; start++) {
 163                 first = rawbits[start];
 164                 for (i = start; i < start + long_wait; i++) {
 165                         if (rawbits[i] != first) {
 166                                 break;
 167                         }
 168                 }
 169                 if (i == (start + long_wait)) {
 170                         break;
 171                 }
 172         }
 173
 174         if (start == rawbit - uidlen + 1) {
 175                 PrintAndLog("nothing to wait for");
 176                 return 0;
 177         }
 178
 179         // Inverting signal if needed
 180         if (first == 1) {
 181                 for (i = start; i < rawbit; i++) {
 182                         rawbits[i] = !rawbits[i];
 183                 }
 184         }
 185
 186         // Dumping UID
 187         uint8_t bits[224] = {0x00};
 188         char showbits[225] = {0x00};
 189         int bit;
 190         i = start;
 191         int times = 0;
 192
 193         if (uidlen > rawbit) {
 194                 PrintAndLog("Warning: not enough raw bits to get a full UID");
 195                 for (bit = 0; bit < rawbit; bit++) {
 196                         bits[bit] = rawbits[i++];
 197                         // As we cannot know the parity, let's use "." and "/"
 198                         showbits[bit] = '.' + bits[bit];
 199                 }
 200                 showbits[bit+1]='\0';
 201                 PrintAndLog("Partial UID=%s", showbits);
 202                 return 0;
 203         } else {
 204                 for (bit = 0; bit < uidlen; bit++) {
 205                         bits[bit] = rawbits[i++];
 206                         showbits[bit] = '0' + bits[bit];
 207                 }
 208                 times = 1;
 209         }
 210
 211         //convert UID to HEX
 212         uint32_t uid1, uid2, uid3, uid4, uid5, uid6, uid7;
 213         int idx;
 214         uid1 = uid2 = 0;
 215
 216         if (uidlen==64){
 217                 for( idx=0; idx<64; idx++) {
 218                                 if (showbits[idx] == '0') {
 219                                 uid1=(uid1<<1)|(uid2>>31);
 220                                 uid2=(uid2<<1)|0;
 221                                 } else {
 222                                 uid1=(uid1<<1)|(uid2>>31);
 223                                 uid2=(uid2<<1)|1;
 224                                 }
 225                         }
 226                 PrintAndLog("UID=%s (%x%08x)", showbits, uid1, uid2);
 227         }
 228         else {
 229                 uid3 = uid4 = uid5 = uid6 = uid7 = 0;
 230
 231                 for( idx=0; idx<224; idx++) {
 232                                 uid1=(uid1<<1)|(uid2>>31);
 233                                 uid2=(uid2<<1)|(uid3>>31);
 234                                 uid3=(uid3<<1)|(uid4>>31);
 235                                 uid4=(uid4<<1)|(uid5>>31);
 236                                 uid5=(uid5<<1)|(uid6>>31);
 237                                 uid6=(uid6<<1)|(uid7>>31);
 238
 239                         if (showbits[idx] == '0')
 240                                 uid7 = (uid7<<1) | 0;
 241                         else
 242                                 uid7 = (uid7<<1) | 1;
 243                         }
 244                 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits, uid1, uid2, uid3, uid4, uid5, uid6, uid7);
 245         }
 246
 247         // Checking UID against next occurrences
 248                 int failed = 0;
 249         for (; i + uidlen <= rawbit;) {
 250                 failed = 0;
 251                 for (bit = 0; bit < uidlen; bit++) {
 252                         if (bits[bit] != rawbits[i++]) {
 253                                 failed = 1;
 254                                 break;
 255                         }
 256                 }
 257                 if (failed == 1) {
 258                         break;
 259                 }
 260                 times += 1;
 261         }
 262
 263         PrintAndLog("Occurrences: %d (expected %d)", times, (rawbit - start) / uidlen);
 264
 265         // Remodulating for tag cloning
 266         // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
 267         // since this changes graphbuffer data.
 268         GraphTraceLen = 32*uidlen;
 269         i = 0;
 270         int phase = 0;
 271         for (bit = 0; bit < uidlen; bit++) {
 272                 if (bits[bit] == 0) {
 273                         phase = 0;
 274                 } else {
 275                         phase = 1;
 276                 }
 277                 int j;
 278                 for (j = 0; j < 32; j++) {
 279                         GraphBuffer[i++] = phase;
 280                         phase = !phase;
 281                 }
 282         }
 283
 284         RepaintGraphWindow();
 285         return 1;
 286 }
 287
 288 int CmdIndalaClone(const char *Cmd) {
 289         UsbCommand c;
 290         unsigned int uid1, uid2, uid3, uid4, uid5, uid6, uid7;
 291
 292         uid1 =  uid2 = uid3 = uid4 = uid5 = uid6 = uid7 = 0;
 293         int n = 0, i = 0;
 294
 295         if (strchr(Cmd,'l') != 0) {
 296                 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 297                         uid1 = (uid1 << 4) | (uid2 >> 28);
 298                         uid2 = (uid2 << 4) | (uid3 >> 28);
 299                         uid3 = (uid3 << 4) | (uid4 >> 28);
 300                         uid4 = (uid4 << 4) | (uid5 >> 28);
 301                         uid5 = (uid5 << 4) | (uid6 >> 28);
 302                         uid6 = (uid6 << 4) | (uid7 >> 28);
 303                         uid7 = (uid7 << 4) | (n & 0xf);
 304                 }
 305                 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1, uid2, uid3, uid4, uid5, uid6, uid7);
 306                 c.cmd = CMD_INDALA_CLONE_TAG_L;
 307                 c.d.asDwords[0] = uid1;
 308                 c.d.asDwords[1] = uid2;
 309                 c.d.asDwords[2] = uid3;
 310                 c.d.asDwords[3] = uid4;
 311                 c.d.asDwords[4] = uid5;
 312                 c.d.asDwords[5] = uid6;
 313                 c.d.asDwords[6] = uid7;
 314         } else {
 315                 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 316                         uid1 = (uid1 << 4) | (uid2 >> 28);
 317                         uid2 = (uid2 << 4) | (n & 0xf);
 318                 }
 319                 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1, uid2);
 320                 c.cmd = CMD_INDALA_CLONE_TAG;
 321                 c.arg[0] = uid1;
 322                 c.arg[1] = uid2;
 323         }
 324
 325         clearCommandBuffer();
 326         SendCommand(&c);
 327         return 0;
 328 }
 329
 330 static command_t CommandTable[] = {
 331         {"help",     CmdHelp,         1, "This help"},
 332         {"demod",    CmdIndalaDecode, 1, "[clock] [invert<0|1>] -- Demodulate an indala tag (PSK1) from GraphBuffer (args optional)"},
 333         {"read",     CmdIndalaRead,   0, "Read an Indala Prox tag from the antenna"},
 334         {"clone",    CmdIndalaClone,  0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be on antenna)(UID in HEX)(option 'l' for 224 UID"},
 335         {"altdemod", CmdIndalaDemod,  1, "['224'] -- Alternative method to Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
 336         //{"sim",      CmdIndalaSim,    0, "<ID> -- indala tag simulator"},
 337         {NULL, NULL, 0, NULL}
 338 };
 339
 340 int CmdLFINDALA(const char *Cmd) {
 341         CmdsParse(CommandTable, Cmd);
 342         return 0;
 343 }
 344
 345 int CmdHelp(const char *Cmd) {
 346         CmdsHelp(CommandTable);
 347         return 0;
 348 }