+ // allow undo\r
+ // skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)\r
+ save_restoreGB(1);\r
+ CmdLtrim("160");\r
+ clk = GetPskClock("", FALSE, FALSE);\r
+ if (clk>0) {\r
+ if ( PSKDemod("0 0 6", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
+ tests[hits].modulation = DEMOD_PSK1;\r
+ tests[hits].bitrate = bitRate;\r
+ tests[hits].inverted = FALSE;\r
+ tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
+ tests[hits].ST = FALSE;\r
+ ++hits;\r
+ }\r
+ if ( PSKDemod("0 1 6", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {\r
+ tests[hits].modulation = DEMOD_PSK1;\r
+ tests[hits].bitrate = bitRate;\r
+ tests[hits].inverted = TRUE;\r
+ tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
+ tests[hits].ST = FALSE;\r
+ ++hits;\r
+ }\r
+ // PSK2 - needs a call to psk1TOpsk2.\r
+ if ( PSKDemod("0 0 6", FALSE)) {\r
+ psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
+ if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
+ tests[hits].modulation = DEMOD_PSK2;\r
+ tests[hits].bitrate = bitRate;\r
+ tests[hits].inverted = FALSE;\r
+ tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
+ tests[hits].ST = FALSE;\r
+ ++hits;\r
+ }\r
+ } // inverse waves does not affect this demod\r
+ // PSK3 - needs a call to psk1TOpsk2.\r
+ if ( PSKDemod("0 0 6", FALSE)) {\r
+ psk1TOpsk2(DemodBuffer, DemodBufferLen);\r
+ if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){\r
+ tests[hits].modulation = DEMOD_PSK3;\r
+ tests[hits].bitrate = bitRate;\r
+ tests[hits].inverted = FALSE;\r
+ tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);\r
+ tests[hits].ST = FALSE;\r
+ ++hits;\r
+ }\r
+ } // inverse waves does not affect this demod\r
+ }\r
+ //undo trim samples\r
+ save_restoreGB(0);\r
+ } \r
+ if ( hits == 1) {\r
+ config.modulation = tests[0].modulation;\r
+ config.bitrate = tests[0].bitrate;\r
+ config.inverted = tests[0].inverted;\r
+ config.offset = tests[0].offset;\r
+ config.block0 = tests[0].block0;\r
+ config.Q5 = tests[0].Q5;\r
+ config.ST = tests[0].ST;\r
+ printConfiguration( config );\r
+ return TRUE;\r
+ }\r
+ \r
+ if ( hits > 1) {\r
+ PrintAndLog("Found [%d] possible matches for modulation.",hits);\r
+ for(int i=0; i<hits; ++i){\r
+ PrintAndLog("--[%d]---------------", i+1);\r
+ printConfiguration( tests[i] );\r
+ }\r
+ }\r
+ return FALSE;\r
+}\r
+\r
+bool testModulation(uint8_t mode, uint8_t modread){\r
+ switch( mode ){\r
+ case DEMOD_FSK:\r
+ if (modread >= DEMOD_FSK1 && modread <= DEMOD_FSK2a) return TRUE;\r
+ break;\r
+ case DEMOD_ASK:\r
+ if (modread == DEMOD_ASK) return TRUE;\r
+ break;\r
+ case DEMOD_PSK1:\r
+ if (modread == DEMOD_PSK1) return TRUE;\r
+ break;\r
+ case DEMOD_PSK2:\r
+ if (modread == DEMOD_PSK2) return TRUE;\r
+ break;\r
+ case DEMOD_PSK3:\r
+ if (modread == DEMOD_PSK3) return TRUE;\r
+ break;\r
+ case DEMOD_NRZ:\r
+ if (modread == DEMOD_NRZ) return TRUE;\r
+ break;\r
+ case DEMOD_BI:\r
+ if (modread == DEMOD_BI) return TRUE;\r
+ break;\r
+ case DEMOD_BIa:\r
+ if (modread == DEMOD_BIa) return TRUE;\r
+ break; \r
+ default:\r
+ return FALSE;\r
+ }\r
+ return FALSE;\r
+}\r
+\r
+bool testQ5Modulation(uint8_t mode, uint8_t modread){\r
+ switch( mode ){\r
+ case DEMOD_FSK:\r
+ if (modread >= 4 && modread <= 5) return TRUE;\r
+ break;\r
+ case DEMOD_ASK:\r
+ if (modread == 0) return TRUE;\r
+ break;\r
+ case DEMOD_PSK1:\r
+ if (modread == 1) return TRUE;\r
+ break;\r
+ case DEMOD_PSK2:\r
+ if (modread == 2) return TRUE;\r
+ break;\r
+ case DEMOD_PSK3:\r
+ if (modread == 3) return TRUE;\r
+ break;\r
+ case DEMOD_NRZ:\r
+ if (modread == 7) return TRUE;\r
+ break;\r
+ case DEMOD_BI:\r
+ if (modread == 6) return TRUE;\r
+ break;\r
+ default:\r
+ return FALSE;\r
+ }\r
+ return FALSE;\r
+}\r
+\r
+int convertQ5bitRate(uint8_t bitRateRead) {\r
+ uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r
+ for (int i=0; i<8; i++)\r
+ if (expected[i] == bitRateRead)\r
+ return i;\r
+\r
+ return -1;\r
+}\r
+\r
+bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){\r
+\r
+ if ( DemodBufferLen < 64 ) return FALSE;\r
+ uint8_t si = 0;\r
+ for (uint8_t idx = 28; idx < 64; idx++){\r
+ si = idx;\r
+ if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r
+\r
+ uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
+ uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;\r
+ // 2nibble must be zeroed.\r
+ if (safer != 0x6 && safer != 0x9) continue;\r
+ if ( resv > 0x00) continue;\r
+ //uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;\r
+ //uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;\r
+ si += 1+1;\r
+ int bitRate = PackBits(si, 6, DemodBuffer)*2 + 2; si += 6; //bit rate\r
+ if (bitRate > 128 || bitRate < 8) continue;\r
+\r
+ //uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1; \r
+ //uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1; \r
+ //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr\r
+ //uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;\r
+ si += 1+1+2+1;\r
+ uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;\r
+ uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;\r
+ //uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;\r
+ if (maxBlk == 0) continue;\r
+ //test modulation\r
+ if (!testQ5Modulation(mode, modread)) continue;\r
+ if (bitRate != clk) continue;\r
+ *fndBitRate = convertQ5bitRate(bitRate);\r
+ if (*fndBitRate < 0) continue;\r
+ *offset = idx;\r
+\r
+ return TRUE;\r
+ }\r
+ return FALSE;\r
+}\r
+\r
+bool testBitRate(uint8_t readRate, uint8_t clk){\r
+ uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r
+ if (expected[readRate] == clk)\r
+ return true;\r
+\r
+ return false;\r
+}\r
+\r
+bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5){\r
+\r
+ if ( DemodBufferLen < 64 ) return FALSE;\r
+ uint8_t si = 0;\r
+ for (uint8_t idx = 28; idx < 64; idx++){\r
+ si = idx;\r
+ if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r
+\r
+ uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
+ uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode\r
+ // 2nibble must be zeroed.\r
+ // moved test to here, since this gets most faults first.\r
+ if ( resv > 0x00) continue;\r
+\r
+ uint8_t xtRate = PackBits(si, 3, DemodBuffer); si += 3; //extended mode part of rate\r
+ int bitRate = PackBits(si, 3, DemodBuffer); si += 3; //bit rate\r
+ if (bitRate > 7) continue;\r
+ uint8_t extend = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode\r
+ uint8_t modread = PackBits(si, 5, DemodBuffer); si += 5+2+1; \r
+ //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //could check psk cr\r
+ //uint8_t nml01 = PackBits(si, 1, DemodBuffer); si += 1+5; //bit 24, 30, 31 could be tested for 0 if not extended mode\r
+ //uint8_t nml02 = PackBits(si, 2, DemodBuffer); si += 2;\r
projects / proxmark3-svn / blobdiff