+bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){\r
+\r
+ if ( DemodBufferLen < 64 ) return FALSE;\r
+ uint8_t si = 0;\r
+ for (uint8_t idx = 28; idx < 64; idx++){\r
+ si = idx;\r
+ if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r
+\r
+ uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
+ uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;\r
+ // 2nibble must be zeroed.\r
+ if (safer != 0x6 && safer != 0x9) continue;\r
+ if ( resv > 0x00) continue;\r
+ //uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;\r
+ //uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;\r
+ si += 1+1;\r
+ int bitRate = PackBits(si, 6, DemodBuffer)*2 + 2; si += 6; //bit rate\r
+ if (bitRate > 128 || bitRate < 8) continue;\r
+\r
+ //uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1; \r
+ //uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1; \r
+ //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr\r
+ //uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;\r
+ si += 1+1+2+1;\r
+ uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;\r
+ uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;\r
+ //uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;\r
+ if (maxBlk == 0) continue;\r
+ //test modulation\r
+ if (!testQ5Modulation(mode, modread)) continue;\r
+ if (bitRate != clk) continue;\r
+ *fndBitRate = convertQ5bitRate(bitRate);\r
+ if (*fndBitRate < 0) continue;\r
+ *offset = idx;\r
+\r
+ return TRUE;\r
+ }\r
+ return FALSE;\r
+}\r
+\r
+bool testBitRate(uint8_t readRate, uint8_t clk){\r
+ uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};\r
+ if (expected[readRate] == clk)\r
+ return true;\r
+\r
+ return false;\r
+}\r
+\r
+bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5){\r
+\r
+ if ( DemodBufferLen < 64 ) return FALSE;\r
+ uint8_t si = 0;\r
+ for (uint8_t idx = 28; idx < 64; idx++){\r
+ si = idx;\r
+ if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;\r
+\r
+ uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key\r
+ uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode\r
+ // 2nibble must be zeroed.\r
+ // moved test to here, since this gets most faults first.\r
+ if ( resv > 0x00) continue;\r
+\r
+ uint8_t xtRate = PackBits(si, 3, DemodBuffer); si += 3; //extended mode part of rate\r
+ int bitRate = PackBits(si, 3, DemodBuffer); si += 3; //bit rate\r
+ if (bitRate > 7) continue;\r
+ uint8_t extend = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode\r
+ uint8_t modread = PackBits(si, 5, DemodBuffer); si += 5+2+1; \r
+ //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //could check psk cr\r
+ //uint8_t nml01 = PackBits(si, 1, DemodBuffer); si += 1+5; //bit 24, 30, 31 could be tested for 0 if not extended mode\r
+ //uint8_t nml02 = PackBits(si, 2, DemodBuffer); si += 2;\r
+ \r
+ //if extended mode\r
+ bool extMode =( (safer == 0x6 || safer == 0x9) && extend) ? TRUE : FALSE;\r
+\r
+ if (!extMode){\r
+ if (xtRate) continue; //nml01 || nml02 || caused issues on noralys tags\r
+ }\r
+ //test modulation\r
+ if (!testModulation(mode, modread)) continue;\r
+ if (!testBitRate(bitRate, clk)) continue;\r
+ *fndBitRate = bitRate;\r
+ *offset = idx;\r
+ *Q5 = FALSE;\r
+ return TRUE;\r
+ }\r
+ if (testQ5(mode, offset, fndBitRate, clk)) {\r
+ *Q5 = TRUE;\r
+ return TRUE;\r
+ }\r
+ return FALSE;\r
+}\r
+\r
+void printT55xxBlock(const char *blockNum){\r
+ \r
+ uint8_t i = config.offset;\r
+ uint8_t endpos = 32 + i;\r
+ uint32_t blockData = 0;\r
+ uint8_t bits[64] = {0x00};\r
+\r
+ if ( !DemodBufferLen) return;\r
+\r
+ if ( endpos > DemodBufferLen){\r
+ PrintAndLog("The configured offset %d is too big. Possible offset: %d)", i, DemodBufferLen-32);\r
+ return;\r
+ }\r
+\r
+ for (; i < endpos; ++i)\r
+ bits[i - config.offset] = DemodBuffer[i];\r
+\r
+ blockData = PackBits(0, 32, bits);\r
+\r
+ PrintAndLog(" %s | %08X | %s", blockNum, blockData, sprint_bin(bits,32));\r
+}\r
+\r
+int special(const char *Cmd) {\r
+ uint32_t blockData = 0;\r
+ uint8_t bits[32] = {0x00};\r
+\r
+ PrintAndLog("OFFSET | DATA | BINARY");\r
+ PrintAndLog("----------------------------------------------------");\r
+ int i,j = 0;\r
+ for (; j < 64; ++j){\r
+ \r
+ for (i = 0; i < 32; ++i)\r
+ bits[i]=DemodBuffer[j+i];\r
+ \r
+ blockData = PackBits(0, 32, bits);\r
+ \r
+ PrintAndLog("%02d | 0x%08X | %s",j , blockData, sprint_bin(bits,32)); \r
+ }\r
+ return 0;\r
+}\r
+\r
+int printConfiguration( t55xx_conf_block_t b){\r
+ PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");\r
+ PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );\r
+ PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate) );\r
+ PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );\r
+ PrintAndLog("Offset : %d", b.offset);\r
+ PrintAndLog("Seq. Term. : %s", (b.ST) ? "Yes" : "No" );\r
+ PrintAndLog("Block0 : 0x%08X", b.block0);\r
+ PrintAndLog("");\r
+ return 0;\r
+}\r
+\r
+int CmdT55xxWakeUp(const char *Cmd) {\r
+ uint32_t password = 0;\r
+ uint8_t cmdp = 0;\r
+ bool errors = false;\r
+ while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
+ switch(param_getchar(Cmd, cmdp)) {\r
+ case 'h':\r
+ case 'H':\r
+ return usage_t55xx_wakup();\r
+ case 'p':\r
+ case 'P':\r
+ password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
+ cmdp += 2;\r
+ errors = false;\r
+ break;\r
+ default:\r
+ PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
+ errors = true;\r
+ break;\r
+ }\r
+ }\r
+ if (errors) return usage_t55xx_wakup();\r
+\r
+ UsbCommand c = {CMD_T55XX_WAKEUP, {password, 0, 0}};\r
+ clearCommandBuffer();\r
+ SendCommand(&c);\r
+ PrintAndLog("Wake up command sent. Try read now");\r
+ return 0;\r
+}\r
+\r
+int CmdT55xxWriteBlock(const char *Cmd) {\r
+ uint8_t block = 0xFF; //default to invalid block\r
+ uint32_t data = 0; //default to blank Block \r
+ uint32_t password = 0; //default to blank Block 7\r
+ bool usepwd = false;\r
+ bool page1 = false; \r
+ bool gotdata = false;\r
+ bool errors = false;\r
+ uint8_t cmdp = 0;\r
+ while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
+ switch(param_getchar(Cmd, cmdp)) {\r
+ case 'h':\r
+ case 'H':\r
+ return usage_t55xx_write();\r
+ case 'b':\r
+ case 'B':\r
+ errors |= param_getdec(Cmd, cmdp+1, &block);\r
+ cmdp += 2;\r
+ break;\r
+ case 'd':\r
+ case 'D':\r
+ data = param_get32ex(Cmd, cmdp+1, 0, 16);\r
+ gotdata = true;\r
+ cmdp += 2;\r
+ break;\r
+ case 'p':\r
+ case 'P':\r
+ password = param_get32ex(Cmd, cmdp+1, 0, 16);\r
+ usepwd = true;\r
+ cmdp += 2;\r
+ break;\r
+ case '1':\r
+ page1 = true;\r
+ cmdp++;\r
+ break;\r
+ default:\r
+ PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
+ errors = true;\r
+ break;\r
+ }\r
+ }\r
+ if (errors || !gotdata) return usage_t55xx_write();\r
+\r
+ if (block > 7) {\r
+ PrintAndLog("Block number must be between 0 and 7");\r
+ return 0;\r
+ }\r
+ \r
+ UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};\r
+ UsbCommand resp;\r
+ c.d.asBytes[0] = (page1) ? 0x2 : 0; \r
+\r
+ char pwdStr[16] = {0};\r
+ snprintf(pwdStr, sizeof(pwdStr), "pwd: 0x%08X", password);\r
+ \r
+ PrintAndLog("Writing page %d block: %02d data: 0x%08X %s", page1, block, data, (usepwd) ? pwdStr : "" );\r
+\r
+ //Password mode\r
+ if (usepwd) {\r
+ c.arg[2] = password;\r
+ c.d.asBytes[0] |= 0x1; \r
+ }\r
+ clearCommandBuffer();\r
+ SendCommand(&c);\r
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){\r
+ PrintAndLog("Error occurred, device did not ACK write operation. (May be due to old firmware)");\r
+ return 0;\r
+ }\r
+ return 1;\r
+}\r
+\r
+int CmdT55xxReadTrace(const char *Cmd) {\r
+ char cmdp = param_getchar(Cmd, 0);\r
+ bool pwdmode = false;\r
+ uint32_t password = 0; \r
+ if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') return usage_t55xx_trace();\r
+\r
+ if (strlen(Cmd)==0) {\r
+ // sanity check.\r
+ if (!SanityOfflineCheck(FALSE)) return 1;\r
+\r
+ if ( !AquireData( T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password ) )\r
+ return 1;\r
+ }\r
+\r
+ if ( config.Q5 ){\r
+ if (!DecodeT5555TraceBlock()) return 1;\r
+ } else {\r
+ if (!DecodeT55xxBlock()) return 1;\r
+ }\r
+ \r
+ if ( !DemodBufferLen ) return 1;\r
+ \r
+ RepaintGraphWindow();\r
+ uint8_t repeat = (config.offset > 5) ? 32 : 0;\r
+ \r
+ uint8_t si = config.offset + repeat;\r
+ uint32_t bl1 = PackBits(si, 32, DemodBuffer);\r
+ uint32_t bl2 = PackBits(si+32, 32, DemodBuffer); \r
+ \r
+ if (config.Q5) {\r
+ uint32_t hdr = PackBits(si, 9, DemodBuffer); si += 9;\r
+ \r
+ if (hdr != 0x1FF) {\r
+ PrintAndLog("Invalid Q5 Trace data header (expected 0x1FF, found %X)", hdr);\r
+ return 1;\r
+ }\r
+ \r
+ t5555_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .icr = 0, .lotidc = '?', .lotid = 0, .wafer = 0, .dw =0};\r
+ \r
+ data.icr = PackBits(si, 2, DemodBuffer); si += 2;\r
+ data.lotidc = 'Z' - PackBits(si, 2, DemodBuffer); si += 3;\r
+ \r
+ data.lotid = PackBits(si, 4, DemodBuffer); si += 5;\r
+ data.lotid <<= 4;\r
+ data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r
+ data.lotid <<= 4;\r
+ data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r
+ data.lotid <<= 4;\r
+ data.lotid |= PackBits(si, 4, DemodBuffer); si += 5;\r
+ data.lotid <<= 1;\r
+ data.lotid |= PackBits(si, 1, DemodBuffer); si += 1;\r
+ \r
+ data.wafer = PackBits(si, 3, DemodBuffer); si += 4;\r
+ data.wafer <<= 2;\r
+ data.wafer |= PackBits(si, 2, DemodBuffer); si += 2;\r
+ \r
+ data.dw = PackBits(si, 2, DemodBuffer); si += 3;\r
+ data.dw <<= 4;\r
+ data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r
+ data.dw <<= 4;\r
+ data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r
+ data.dw <<= 4;\r
+ data.dw |= PackBits(si, 4, DemodBuffer); si += 5;\r
+ \r
+ printT5555Trace(data, repeat);\r
+ \r
+ } else {\r
+ \r
+ t55x7_tracedata_t data = {.bl1 = bl1, .bl2 = bl2, .acl = 0, .mfc = 0, .cid = 0, .year = 0, .quarter = 0, .icr = 0, .lotid = 0, .wafer = 0, .dw = 0};\r
+ \r
+ data.acl = PackBits(si, 8, DemodBuffer); si += 8;\r
+ if ( data.acl != 0xE0 ) {\r
+ PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");\r
+ return 1;\r
+ }\r
projects / proxmark3-svn / blobdiff