+void printEM4x05info(uint32_t block0, uint32_t serial) {
+
+ uint8_t chipType = (block0 >> 1) & 0xF;
+ uint8_t cap = (block0 >> 5) & 3;
+ uint16_t custCode = (block0 >> 9) & 0x3FF;
+
+ switch (chipType) {
+ case 9: PrintAndLog("\n Chip Type: %u | EM4305", chipType); break;
+ case 8: PrintAndLog("\n Chip Type: %u | EM4205", chipType); break;
+ case 4: PrintAndLog(" Chip Type: %u | Unknown", chipType); break;
+ case 2: PrintAndLog(" Chip Type: %u | EM4469", chipType); break;
+ //add more here when known
+ default: PrintAndLog(" Chip Type: %u Unknown", chipType); break;
+ }
+
+ switch (cap) {
+ case 3: PrintAndLog(" Cap Type: %u | 330pF",cap); break;
+ case 2: PrintAndLog(" Cap Type: %u | %spF",cap, (chipType==2)? "75":"210"); break;
+ case 1: PrintAndLog(" Cap Type: %u | 250pF",cap); break;
+ case 0: PrintAndLog(" Cap Type: %u | no resonant capacitor",cap); break;
+ default: PrintAndLog(" Cap Type: %u | unknown",cap); break;
+ }
+
+ PrintAndLog(" Cust Code: %03u | %s", custCode, (custCode == 0x200) ? "Default": "Unknown");
+ if (serial != 0)
+ PrintAndLog("\n Serial #: %08X\n", serial);
+}
+
+void printEM4x05ProtectionBits(uint32_t word) {
+ for (uint8_t i = 0; i < 15; i++) {
+ PrintAndLog(" Word: %02u | %s", i, (((1 << i) & word ) || i < 2) ? "Is Write Locked" : "Is Not Write Locked");
+ if (i==14)
+ PrintAndLog(" Word: %02u | %s", i+1, (((1 << i) & word ) || i < 2) ? "Is Write Locked" : "Is Not Write Locked");
+ }
+}
+
+//quick test for EM4x05/EM4x69 tag
+bool EM4x05IsBlock0(uint32_t *word) {
+ return EM4x05ReadWord_ext(0, 0, FALSE, word);
+}
+
+int CmdEM4x05Info(const char *Cmd) {
+#define EM_SERIAL_BLOCK 1
+#define EM_CONFIG_BLOCK 4
+#define EM_PROT1_BLOCK 14
+#define EM_PROT2_BLOCK 15
+ uint32_t pwd;
+ uint32_t word = 0, block0 = 0, serial = 0;
+ bool usePwd = false;
+ uint8_t ctmp = param_getchar(Cmd, 0);
+ if ( ctmp == 'H' || ctmp == 'h' ) return usage_lf_em4x05_info();
+
+ // for now use default input of 1 as invalid (unlikely 1 will be a valid password...)
+ pwd = param_get32ex(Cmd, 0, 1, 16);
+
+ if ( pwd != 1 )
+ usePwd = true;
+
+ // read word 0 (chip info)
+ // block 0 can be read even without a password.
+ if ( !EM4x05IsBlock0(&block0) )
+ return -1;
+
+ // read word 1 (serial #) doesn't need pwd
+ // continue if failed, .. non blocking fail.
+ EM4x05ReadWord_ext(EM_SERIAL_BLOCK, 0, false, &serial);
+ printEM4x05info(block0, serial);
+
+ // read word 4 (config block)
+ // needs password if one is set
+ if ( EM4x05ReadWord_ext(EM_CONFIG_BLOCK, pwd, usePwd, &word) != 1 )
+ return 0;
+
+ printEM4x05config(word);
+
+ // read word 14 and 15 to see which is being used for the protection bits
+ if ( EM4x05ReadWord_ext(EM_PROT1_BLOCK, pwd, usePwd, &word) != 1 ) {
+ return 0;
+ }
+ // if status bit says this is not the used protection word
+ if (!(word & 0x8000)) {
+ if ( EM4x05ReadWord_ext(EM_PROT2_BLOCK, pwd, usePwd, &word) != 1 )
+ return 0;
+ }
+ //something went wrong
+ if (!(word & 0x8000)) return 0;
+ printEM4x05ProtectionBits(word);
+ return 1;
+}
+
+static command_t CommandTable[] = {
+ {"help", CmdHelp, 1, "This help"},
+ {"410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
+ {"410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag in GraphBuffer"},
+ {"410xsim", CmdEM410xSim, 0, "simulate EM410x tag"},
+ {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
+ {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
+ {"410xwrite", CmdEM410xWrite, 0, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
+ {"4x05dump", CmdEM4x05Dump, 0, "dump EM4205/4305 tag"},
+ {"4x05info", CmdEM4x05Info, 0, "tag information EM4x05/EM4x69"},
+ {"4x05read", CmdEM4x05Read, 0, "read word data from EM4205/4305"},
+ {"4x05write", CmdEM4x05Write, 0, "write word data to EM4205/4305"},
+ {"4x50read", CmdEM4x50Read, 0, "read word data from EM4x50"},
+ {"4x50write", CmdEM4x50Write, 0, "write word data to EM4x50"},
+ {"4x50dump", CmdEM4x50Dump, 0, "dump EM4x50 tag"},
+ {NULL, NULL, 0, NULL}
+};
+
+int CmdLFEM4X(const char *Cmd) {
+ clearCommandBuffer();
+ CmdsParse(CommandTable, Cmd);
+ return 0;
+}
+
+int CmdHelp(const char *Cmd) {
+ CmdsHelp(CommandTable);
+ return 0;
projects / proxmark3-svn / blobdiff