\r
#define CONFIGURATION_BLOCK 0x00\r
#define TRACE_BLOCK 0x01\r
+#define T55x7_PWD 0x00000010\r
\r
// Default configuration\r
t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = FALSE, .offset = 0x00, .block0 = 0x00};\r
\r
int usage_t55xx_config(){\r
PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>]");\r
- PrintAndLog("Options: ");\r
+ PrintAndLog("Options:");\r
PrintAndLog(" h This help");\r
PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");\r
PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");\r
return 0;\r
}\r
int usage_t55xx_read(){\r
- PrintAndLog("Usage: lf t55xx read <block> <password>");\r
- PrintAndLog(" <block>, block number to read. Between 0-7");\r
- PrintAndLog(" <password>, OPTIONAL password (8 hex characters)");\r
+ PrintAndLog("Usage: lf t55xx read b <block> p <password> <override_safety> <wakeup>");\r
+ PrintAndLog("Options:");\r
+ PrintAndLog(" b <block>, block number to read. Between 0-7");\r
+ PrintAndLog(" p <password>, OPTIONAL password 4bytes (8 hex symbols)");\r
+ PrintAndLog(" o, OPTIONAL override safety check");\r
+ PrintAndLog(" w, OPTIONAL wakeup");\r
+ PrintAndLog(" ****WARNING****");\r
+ PrintAndLog(" Use of read with password on a tag not configured for a pwd");\r
+ PrintAndLog(" can damage the tag");\r
PrintAndLog("");\r
PrintAndLog("Examples:");\r
- PrintAndLog(" lf t55xx read 0 - read data from block 0");\r
- PrintAndLog(" lf t55xx read 0 feedbeef - read data from block 0 password feedbeef");\r
+ PrintAndLog(" lf t55xx read b 0 - read data from block 0");\r
+ PrintAndLog(" lf t55xx read b 0 p feedbeef - read data from block 0 password feedbeef");\r
+ PrintAndLog(" lf t55xx read b 0 p feedbeef o - read data from block 0 password feedbeef safety check");\r
PrintAndLog("");\r
return 0;\r
}\r
int usage_t55xx_write(){\r
- PrintAndLog("Usage: lf t55xx wr <block> <data> [password]");\r
+ PrintAndLog("Usage: lf t55xx write <block> <data> [password]");\r
+ PrintAndLog("Options:");\r
PrintAndLog(" <block>, block number to write. Between 0-7");\r
- PrintAndLog(" <data>, 4 bytes of data to write (8 hex characters)");\r
- PrintAndLog(" [password], OPTIONAL password 4bytes (8 hex characters)");\r
+ PrintAndLog(" <data>, 4 bytes of data to write (8 hex symbols)");\r
+ PrintAndLog(" [password], OPTIONAL password 4bytes (8 hex symbols)");\r
PrintAndLog("");\r
PrintAndLog("Examples:");\r
- PrintAndLog(" lf t55xx wr 3 11223344 - write 11223344 to block 3");\r
- PrintAndLog(" lf t55xx wr 3 11223344 feedbeef - write 11223344 to block 3 password feedbeef");\r
+ PrintAndLog(" lf t55xx write 3 11223344 - write 11223344 to block 3");\r
+ PrintAndLog(" lf t55xx write 3 11223344 feedbeef - write 11223344 to block 3 password feedbeef");\r
PrintAndLog("");\r
return 0;\r
}\r
int usage_t55xx_trace() {\r
PrintAndLog("Usage: lf t55xx trace [1]");\r
+ PrintAndLog("Options:");\r
PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");\r
PrintAndLog("");\r
PrintAndLog("Examples:");\r
}\r
int usage_t55xx_info() {\r
PrintAndLog("Usage: lf t55xx info [1]");\r
+ PrintAndLog("Options:");\r
PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");\r
PrintAndLog("");\r
PrintAndLog("Examples:");\r
}\r
int usage_t55xx_dump(){\r
PrintAndLog("Usage: lf t55xx dump <password>");\r
+ PrintAndLog("Options:");\r
PrintAndLog(" <password>, OPTIONAL password 4bytes (8 hex symbols)");\r
PrintAndLog("");\r
PrintAndLog("Examples:");\r
return 0;\r
}\r
int usage_t55xx_detect(){\r
- PrintAndLog("Usage: lf t55xx detect");\r
+ PrintAndLog("Usage: lf t55xx detect [1]");\r
+ PrintAndLog("Options:");\r
+ PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");\r
PrintAndLog("");\r
PrintAndLog("Examples:");\r
PrintAndLog(" lf t55xx detect");\r
PrintAndLog("");\r
return 0;\r
}\r
+int usage_t55xx_wakup(){\r
+ PrintAndLog("Usage: lf t55xx wakeup [h] p <password>");\r
+ PrintAndLog("This commands send the Answer-On-Request command and leaves the readerfield ON afterwards.");\r
+ PrintAndLog("Options:");\r
+ PrintAndLog(" h - this help");\r
+ PrintAndLog(" p <password> - password 4bytes (8 hex symbols)");\r
+ PrintAndLog("");\r
+ PrintAndLog("Examples:");\r
+ PrintAndLog(" lf t55xx wakeup p 11223344 - send wakeup password");\r
+ return 0;\r
+}\r
\r
static int CmdHelp(const char *Cmd);\r
\r
}\r
\r
int CmdT55xxReadBlock(const char *Cmd) {\r
- int block = -1;\r
- int password = 0xFFFFFFFF; //default to blank Block 7\r
-\r
- char cmdp = param_getchar(Cmd, 0);\r
- if (cmdp == 'h' || cmdp == 'H')\r
- return usage_t55xx_read();\r
-\r
- int res = sscanf(Cmd, "%d %x", &block, &password);\r
-\r
- if ( res < 1 || res > 2 )\r
+ uint8_t block = 255;\r
+ uint8_t wake = 0;\r
+ uint8_t usepwd = 0;\r
+ uint32_t password = 0xFFFFFFFF; //default to blank Block 7\r
+ uint8_t override = 0;\r
+ uint8_t cmdp = 0;\r
+ bool errors = false;\r
+ while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
+ switch(param_getchar(Cmd, cmdp)) {\r
+ case 'h':\r
+ case 'H':\r
return usage_t55xx_read();\r
-\r
- \r
- if ((block < 0) | (block > 7)) {\r
+ case 'b':\r
+ case 'B':\r
+ errors |= param_getdec(Cmd, cmdp+1, &block);\r
+ cmdp+=2;\r
+ break;\r
+ case 'o':\r
+ case 'O':\r
+ override = 1;\r
+ cmdp++;\r
+ break;\r
+ case 'p':\r
+ case 'P':\r
+ password = param_get32ex(Cmd, cmdp+1, 0, 10);\r
+ usepwd = 1;\r
+ cmdp+=2;\r
+ break;\r
+ case 'w':\r
+ case 'W':\r
+ wake = 1;\r
+ cmdp++;\r
+ break;\r
+ default:\r
+ PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
+ errors = true;\r
+ break;\r
+ }\r
+ }\r
+ if (errors) return usage_t55xx_read();\r
+ if (wake && !usepwd) {\r
+ PrintAndLog("Wake command must use a pwd");\r
+ return 1;\r
+ }\r
+ if ((block > 7) && !wake) {\r
PrintAndLog("Block must be between 0 and 7");\r
return 1;\r
} \r
\r
- UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, block, 0}};\r
- c.d.asBytes[0] = 0x0; \r
+ UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, block, password}};\r
\r
//Password mode\r
- if ( res == 2 ) {\r
- c.arg[2] = password;\r
- c.d.asBytes[0] = 0x1; \r
+ if ( usepwd || wake ) {\r
+ // try reading the config block and verify that PWD bit is set before doing this!\r
+ if ( wake || override ) {\r
+ c.arg[0] = (wake<<8) & usepwd;\r
+ if ( !wake && override )\r
+ PrintAndLog("Safety Check Overriden - proceeding despite risk");\r
+ } else {\r
+ AquireData( CONFIGURATION_BLOCK );\r
+ if ( !tryDetectModulation() ) {\r
+ PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");\r
+ return 1;\r
+ } else { \r
+ PrintAndLog("Safety Check: PWD bit is NOT set in config block. Reading without password..."); \r
+ }\r
+ }\r
}\r
\r
clearCommandBuffer();\r
uint8_t got[12000];\r
GetFromBigBuf(got,sizeof(got),0);\r
WaitForResponse(CMD_ACK,NULL);\r
- setGraphBuf(got, 12000);\r
- DemodBufferLen=0;\r
+ setGraphBuf(got, sizeof(got));\r
+ //DemodBufferLen=0;\r
if (!DecodeT55xxBlock()) return 3;\r
char blk[10]={0};\r
+ if ( wake ) {\r
+ sprintf(blk,"wake");\r
+ } else {\r
sprintf(blk,"%d", block);\r
+ }\r
printT55xxBlock(blk);\r
return 0;\r
}\r
DemodBufferLen = 0x00;\r
\r
//trim 1/2 a clock from beginning\r
- snprintf(cmdStr, sizeof(buf),"%d", bitRate[config.bitrate]/2 );\r
- CmdLtrim(cmdStr);\r
+ //snprintf(cmdStr, sizeof(buf),"%d", bitRate[config.bitrate]/2 );\r
+ //CmdLtrim(cmdStr);\r
switch( config.modulation ){\r
case DEMOD_FSK:\r
snprintf(cmdStr, sizeof(buf),"%d %d", bitRate[config.bitrate], config.inverted );\r
\r
// detect configuration?\r
bool tryDetectModulation(){\r
- char cmdStr[8] = {0};\r
+ //char cmdStr[8] = {0};\r
uint8_t hits = 0;\r
t55xx_conf_block_t tests[15];\r
int bitRate=0;\r
save_restoreGB(1);\r
if (GetFskClock("", FALSE, FALSE)){ \r
fskClocks(&fc1, &fc2, &clk, FALSE);\r
- sprintf(cmdStr,"%d", clk/2);\r
- CmdLtrim(cmdStr);\r
+ //sprintf(cmdStr,"%d", clk/2);\r
+ //CmdLtrim(cmdStr);\r
if ( FSKrawDemod("0 0", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate)){\r
tests[hits].modulation = DEMOD_FSK;\r
if (fc1==8 && fc2 == 5)\r
}\r
} else {\r
clk = GetAskClock("", FALSE, FALSE);\r
- \r
if (clk>0) {\r
- sprintf(cmdStr,"%d", clk/2);\r
- CmdLtrim(cmdStr);\r
+ //sprintf(cmdStr,"%d", clk/2);\r
+ //CmdLtrim(cmdStr);\r
if ( ASKDemod("0 0 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate)) {\r
tests[hits].modulation = DEMOD_ASK;\r
tests[hits].bitrate = bitRate;\r
save_restoreGB(0);\r
clk = GetNrzClock("", FALSE, FALSE);\r
if (clk>0) {\r
- sprintf(cmdStr,"%d", clk/2);\r
- CmdLtrim(cmdStr);\r
+ //sprintf(cmdStr,"%d", clk/2);\r
+ //CmdLtrim(cmdStr);\r
if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate)) {\r
tests[hits].modulation = DEMOD_NRZ;\r
tests[hits].bitrate = bitRate;\r
save_restoreGB(0);\r
clk = GetPskClock("", FALSE, FALSE);\r
if (clk>0) {\r
- PrintAndLog("clk %d",clk);\r
- sprintf(cmdStr,"%d", clk/2);\r
- CmdLtrim(cmdStr); \r
+ //PrintAndLog("clk %d",clk);\r
+ //sprintf(cmdStr,"%d", clk/2);\r
+ //CmdLtrim(cmdStr); \r
if ( PSKDemod("0 0 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate)) {\r
tests[hits].modulation = DEMOD_PSK1;\r
tests[hits].bitrate = bitRate;\r
\r
if (block > 7) {\r
PrintAndLog("Block number must be between 0 and 7");\r
- return 2;\r
+ return 1;\r
}\r
\r
- UsbCommand resp;\r
UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};\r
+ UsbCommand resp;\r
c.d.asBytes[0] = 0x0; \r
\r
PrintAndLog("Writing to block: %d data : 0x%08X", block, data);\r
\r
}\r
\r
+int CmdT55xxWakeUp(const char *Cmd) {\r
+ uint32_t password = 0xFFFFFFFF; //default to blank Block 7\r
+ uint8_t cmdp = 0;\r
+ bool errors = false;\r
+ while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
+ switch(param_getchar(Cmd, cmdp)) {\r
+ case 'h':\r
+ case 'H':\r
+ return usage_t55xx_wakup();\r
+ case 'p':\r
+ case 'P':\r
+ password = param_get32ex(Cmd, cmdp+1, 0, 10);\r
+ cmdp+=2;\r
+ break;\r
+ default:\r
+ PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
+ errors = true;\r
+ break;\r
+ }\r
+ }\r
+ if (errors) return usage_t55xx_wakup();\r
+ \r
+ UsbCommand c = {CMD_T55XX_WAKEUP, {password, 0, 0}};\r
+\r
+ clearCommandBuffer();\r
+ SendCommand(&c);\r
+ PrintAndLog("Wake up command sent. Try read now");\r
+ return 0;\r
+}\r
+\r
/*\r
uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){\r
\r
{"info", CmdT55xxInfo, 0, "[1] Show T55xx configuration data (page 0/ blk 0)"},\r
{"dump", CmdT55xxDump, 0, "[password] Dump T55xx card block 0-7. [optional password]"},\r
{"special", special, 0, "Show block changes with 64 different offsets"},\r
+ {"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},\r
+ \r
{NULL, NULL, 0, NULL}\r
};\r
\r
projects / proxmark3-svn / blobdiff