git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Low frequency EM4x commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include "proxusb.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdparser.h"
  17 #include "cmddata.h"
  18 #include "cmdlf.h"
  19 #include "cmdlfem4x.h"
  20
  21 static int CmdHelp(const char *Cmd);
  22
  23 /* Read the ID of an EM410x tag.
  24  * Format:
  25  *   1111 1111 1           <-- standard non-repeatable header
  26  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
  27  *   ....
  28  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
  29  *   0                     <-- stop bit, end of tag
  30  */
  31 int CmdEM410xRead(const char *Cmd)
  32 {
  33   int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
  34   int parity[4];
  35   char id[11];
  36   int retested = 0;
  37   uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
  38   high = low = 0;
  39
  40   /* Detect high and lows and clock */
  41   for (i = 0; i < GraphTraceLen; i++)
  42   {
  43     if (GraphBuffer[i] > high)
  44       high = GraphBuffer[i];
  45     else if (GraphBuffer[i] < low)
  46       low = GraphBuffer[i];
  47   }
  48
  49   /* get clock */
  50   clock = GetClock(Cmd, high, 0);
  51
  52   /* parity for our 4 columns */
  53   parity[0] = parity[1] = parity[2] = parity[3] = 0;
  54   header = rows = 0;
  55
  56   /* manchester demodulate */
  57   bit = bit2idx = 0;
  58   for (i = 0; i < (int)(GraphTraceLen / clock); i++)
  59   {
  60     hithigh = 0;
  61     hitlow = 0;
  62     first = 1;
  63
  64     /* Find out if we hit both high and low peaks */
  65     for (j = 0; j < clock; j++)
  66     {
  67       if (GraphBuffer[(i * clock) + j] == high)
  68         hithigh = 1;
  69       else if (GraphBuffer[(i * clock) + j] == low)
  70         hitlow = 1;
  71
  72       /* it doesn't count if it's the first part of our read
  73        because it's really just trailing from the last sequence */
  74       if (first && (hithigh || hitlow))
  75         hithigh = hitlow = 0;
  76       else
  77         first = 0;
  78
  79       if (hithigh && hitlow)
  80         break;
  81     }
  82
  83     /* If we didn't hit both high and low peaks, we had a bit transition */
  84     if (!hithigh || !hitlow)
  85       bit ^= 1;
  86
  87     BitStream[bit2idx++] = bit;
  88   }
  89
  90 retest:
  91   /* We go till 5 before the graph ends because we'll get that far below */
  92   for (i = 1; i < bit2idx - 5; i++)
  93   {
  94     /* Step 2: We have our header but need our tag ID */
  95     if (header == 9 && rows < 10)
  96     {
  97       /* Confirm parity is correct */
  98       if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
  99       {
 100         /* Read another byte! */
 101         sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
 102         rows++;
 103
 104         /* Keep parity info */
 105         parity[0] ^= BitStream[i];
 106         parity[1] ^= BitStream[i+1];
 107         parity[2] ^= BitStream[i+2];
 108         parity[3] ^= BitStream[i+3];
 109
 110         /* Move 4 bits ahead */
 111         i += 4;
 112       }
 113
 114       /* Damn, something wrong! reset */
 115       else
 116       {
 117         PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
 118
 119         /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
 120         i -= 9 + (5 * rows) - 5;
 121
 122         rows = header = 0;
 123       }
 124     }
 125
 126     /* Step 3: Got our 40 bits! confirm column parity */
 127     else if (rows == 10)
 128     {
 129       /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
 130       if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
 131         BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
 132         BitStream[i+4] == 0)
 133       {
 134         /* Sweet! */
 135         PrintAndLog("EM410x Tag ID: %s", id);
 136
 137         /* Stop any loops */
 138         return 1;
 139       }
 140
 141       /* Crap! Incorrect parity or no stop bit, start all over */
 142       else
 143       {
 144         rows = header = 0;
 145
 146         /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
 147         i -= 59;
 148       }
 149     }
 150
 151     /* Step 1: get our header */
 152     else if (header < 9)
 153     {
 154       /* Need 9 consecutive 1's */
 155       if (BitStream[i] == 1)
 156         header++;
 157
 158       /* We don't have a header, not enough consecutive 1 bits */
 159       else
 160         header = 0;
 161     }
 162   }
 163
 164   /* if we've already retested after flipping bits, return */
 165   if (retested++)
 166     return 0;
 167
 168   /* if this didn't work, try flipping bits */
 169   for (i = 0; i < bit2idx; i++)
 170     BitStream[i] ^= 1;
 171
 172   goto retest;
 173 }
 174
 175 /* emulate an EM410X tag
 176  * Format:
 177  *   1111 1111 1           <-- standard non-repeatable header
 178  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
 179  *   ....
 180  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
 181  *   0                     <-- stop bit, end of tag
 182  */
 183 int CmdEM410xSim(const char *Cmd)
 184 {
 185   int i, n, j, h, binary[4], parity[4];
 186
 187   /* clock is 64 in EM410x tags */
 188   int clock = 64;
 189
 190   /* clear our graph */
 191   ClearGraph(0);
 192
 193   /* write it out a few times */
 194   for (h = 0; h < 4; h++)
 195   {
 196     /* write 9 start bits */
 197     for (i = 0; i < 9; i++)
 198       AppendGraph(0, clock, 1);
 199
 200     /* for each hex char */
 201     parity[0] = parity[1] = parity[2] = parity[3] = 0;
 202     for (i = 0; i < 10; i++)
 203     {
 204       /* read each hex char */
 205       sscanf(&Cmd[i], "%1x", &n);
 206       for (j = 3; j >= 0; j--, n/= 2)
 207         binary[j] = n % 2;
 208
 209       /* append each bit */
 210       AppendGraph(0, clock, binary[0]);
 211       AppendGraph(0, clock, binary[1]);
 212       AppendGraph(0, clock, binary[2]);
 213       AppendGraph(0, clock, binary[3]);
 214
 215       /* append parity bit */
 216       AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
 217
 218       /* keep track of column parity */
 219       parity[0] ^= binary[0];
 220       parity[1] ^= binary[1];
 221       parity[2] ^= binary[2];
 222       parity[3] ^= binary[3];
 223     }
 224
 225     /* parity columns */
 226     AppendGraph(0, clock, parity[0]);
 227     AppendGraph(0, clock, parity[1]);
 228     AppendGraph(0, clock, parity[2]);
 229     AppendGraph(0, clock, parity[3]);
 230
 231     /* stop bit */
 232     AppendGraph(0, clock, 0);
 233   }
 234
 235   /* modulate that biatch */
 236   CmdManchesterMod("");
 237
 238   /* booyah! */
 239   RepaintGraphWindow();
 240
 241   CmdLFSim("");
 242   return 0;
 243 }
 244
 245 /* Function is equivalent of loread + losamples + em410xread
 246  * looped until an EM410x tag is detected */
 247 int CmdEM410xWatch(const char *Cmd)
 248 {
 249   do
 250   {
 251     CmdLFRead("");
 252     CmdSamples("2000");
 253   } while ( ! CmdEM410xRead(""));
 254   return 0;
 255 }
 256
 257 /* Read the transmitted data of an EM4x50 tag
 258  * Format:
 259  *
 260  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 261  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 262  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 263  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 264  *  CCCCCCCC                         <- column parity bits
 265  *  0                                <- stop bit
 266  *  LW                               <- Listen Window
 267  *
 268  * This pattern repeats for every block of data being transmitted.
 269  * Transmission starts with two Listen Windows (LW - a modulated
 270  * pattern of 320 cycles each (32/32/128/64/64)).
 271  *
 272  * Note that this data may or may not be the UID. It is whatever data
 273  * is stored in the blocks defined in the control word First and Last
 274  * Word Read values. UID is stored in block 32.
 275  */
 276 int CmdEM4x50Read(const char *Cmd)
 277 {
 278   int i, j, startblock, skip, block, start, end, low, high;
 279   bool complete= false;
 280   int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
 281   char tmp[6];
 282
 283   high= low= 0;
 284   memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
 285
 286   /* first get high and low values */
 287   for (i = 0; i < GraphTraceLen; i++)
 288   {
 289     if (GraphBuffer[i] > high)
 290       high = GraphBuffer[i];
 291     else if (GraphBuffer[i] < low)
 292       low = GraphBuffer[i];
 293   }
 294
 295   /* populate a buffer with pulse lengths */
 296   i= 0;
 297   j= 0;
 298   while (i < GraphTraceLen)
 299   {
 300     // measure from low to low
 301     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 302       ++i;
 303     start= i;
 304     while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
 305       ++i;
 306     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 307       ++i;
 308     if (j>(MAX_GRAPH_TRACE_LEN/64)) {
 309       break;
 310     }
 311     tmpbuff[j++]= i - start;
 312   }
 313
 314   /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
 315   start= -1;
 316   skip= 0;
 317   for (i= 0; i < j - 4 ; ++i)
 318   {
 319     skip += tmpbuff[i];
 320     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 321       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 322         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 323           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 324           {
 325             start= i + 3;
 326             break;
 327           }
 328   }
 329   startblock= i + 3;
 330
 331   /* skip over the remainder of the LW */
 332   skip += tmpbuff[i+1]+tmpbuff[i+2];
 333   while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
 334     ++skip;
 335   skip += 8;
 336
 337   /* now do it again to find the end */
 338   end= start;
 339   for (i += 3; i < j - 4 ; ++i)
 340   {
 341     end += tmpbuff[i];
 342     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 343       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 344         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 345           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 346           {
 347             complete= true;
 348             break;
 349           }
 350   }
 351
 352   if (start >= 0)
 353     PrintAndLog("Found data at sample: %i",skip);
 354   else
 355   {
 356     PrintAndLog("No data found!");
 357     PrintAndLog("Try again with more samples.");
 358     return 0;
 359   }
 360
 361   if (!complete)
 362   {
 363     PrintAndLog("*** Warning!");
 364     PrintAndLog("Partial data - no end found!");
 365     PrintAndLog("Try again with more samples.");
 366   }
 367
 368   /* get rid of leading crap */
 369   sprintf(tmp,"%i",skip);
 370   CmdLtrim(tmp);
 371
 372   /* now work through remaining buffer printing out data blocks */
 373   block= 0;
 374   i= startblock;
 375   while (block < 6)
 376   {
 377     PrintAndLog("Block %i:", block);
 378     // mandemod routine needs to be split so we can call it for data
 379     // just print for now for debugging
 380     CmdManchesterDemod("i 64");
 381     skip= 0;
 382     /* look for LW before start of next block */
 383     for ( ; i < j - 4 ; ++i)
 384     {
 385       skip += tmpbuff[i];
 386       if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 387         if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 388           break;
 389     }
 390     while (GraphBuffer[skip] > low)
 391       ++skip;
 392     skip += 8;
 393     sprintf(tmp,"%i",skip);
 394     CmdLtrim(tmp);
 395     start += skip;
 396     block++;
 397   }
 398   return 0;
 399 }
 400
 401 int CmdEM410xWrite(const char *Cmd)
 402 {
 403   uint64_t id = 0;
 404   unsigned int card;
 405
 406   sscanf(Cmd, "%lx %d", &id, &card);
 407
 408   if (id >= 0x10000000000) {
 409     PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
 410     return 0;
 411   }
 412
 413   if (card > 1) {
 414     PrintAndLog("Error! Bad card type selected.\n");
 415     return 0;
 416   }
 417
 418   PrintAndLog("Writing %s tag with UID 0x%010lx", card ? "T55x7":"T5555", id);
 419   UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
 420   SendCommand(&c);
 421
 422   return 0;
 423 }
 424
 425 static command_t CommandTable[] =
 426 {
 427   {"help",        CmdHelp,        1, "This help"},
 428   {"em410xread",  CmdEM410xRead,  1, "[clock rate] -- Extract ID from EM410x tag"},
 429   {"em410xsim",   CmdEM410xSim,   0, "<UID> -- Simulate EM410x tag"},
 430   {"em410xwatch", CmdEM410xWatch, 0, "Watches for EM410x tags"},
 431   {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> -- Write EM410x UID to T5555(Q5) or T55x7 tag"},
 432   {"em4x50read",  CmdEM4x50Read,  1, "Extract data from EM4x50 tag"},
 433   {NULL, NULL, 0, NULL}
 434 };
 435
 436 int CmdLFEM4X(const char *Cmd)
 437 {
 438   CmdsParse(CommandTable, Cmd);
 439   return 0;
 440 }
 441
 442 int CmdHelp(const char *Cmd)
 443 {
 444   CmdsHelp(CommandTable);
 445   return 0;
 446 }