X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/e220fc63aaa4f61ca2f91216c4420c18612dd544..7db36608a266a1f0f46dd4032cede2930e221d51:/armsrc/lfops.c diff --git a/armsrc/lfops.c b/armsrc/lfops.c index c56d08f9..95fa9e7c 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -1198,6 +1198,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) * and enlarge the gap ones. * Q5 tags seems to have issues when these values changes. */ + /* // Original Timings for reference @@ -1205,6 +1206,47 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) #define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc) #define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc) #define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550 + +*/ +/* Q5 timing datasheet: + * Type | MIN | Typical | Max | + * Start_Gap | 10*8 | ? | 50*8 | + * Write_Gap Normal mode | 8*8 | 14*8 | 20*8 | + * Write_Gap Fast Mode | 8*8 | ? | 20*8 | + * Write_0 Normal mode | 16*8 | 24*8 | 32*8 | + * Write_1 Normal mode | 48*8 | 56*8 | 64*8 | + * Write_0 Fast Mode | 8*8 | 12*8 | 16*8 | + * Write_1 Fast Mode | 24*8 | 28*8 | 32*8 | +*/ + +/* T5557 timing datasheet: + * Type | MIN | Typical | Max | + * Start_Gap | 10*8 | ? | 50*8 | + * Write_Gap Normal mode | 8*8 |50-150us | 30*8 | + * Write_Gap Fast Mode | 8*8 | ? | 20*8 | + * Write_0 Normal mode | 16*8 | 24*8 | 31*8 | + * Write_1 Normal mode | 48*8 | 54*8 | 63*8 | + * Write_0 Fast Mode | 8*8 | 12*8 | 15*8 | + * Write_1 Fast Mode | 24*8 | 28*8 | 31*8 | +*/ + +/* T5577C timing datasheet for Fixed-Bit-Length protocol (defualt): + * Type | MIN | Typical | Max | + * Start_Gap | 8*8 | 15*8 | 50*8 | + * Write_Gap Normal mode | 8*8 | 10*8 | 20*8 | + * Write_Gap Fast Mode | 8*8 | 10*8 | 20*8 | + * Write_0 Normal mode | 16*8 | 24*8 | 32*8 | + * Write_1 Normal mode | 48*8 | 56*8 | 64*8 | + * Write_0 Fast Mode | 8*8 | 12*8 | 16*8 | + * Write_1 Fast Mode | 24*8 | 28*8 | 32*8 | +*/ +/* +//note startgap must be sent after tag has been powered up for more than 3ms (per T5557 ds) +#define START_GAP 31*8 //31*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc) - T5557: 10*8 to 50*8 +#define WRITE_GAP 20*8 //20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc) - T5557: 8*8 to 30*8 typ 50-150us +#define WRITE_0 18*8 //18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc) - T5557: 16*8 to 31*8 typ 24*8 +#define WRITE_1 50*8 //50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) - T5557: 48*8 to 63*8 typ 54*8 432 for T55x7; 448 for E5550 + #define READ_GAP 15*8 */ @@ -1219,21 +1261,22 @@ typedef struct { uint16_t READ_GAP; } T55xx_Timing; - - // Set Initial/Default Values. Note: *8 can occure when used. This should keep things simplier here. T55xx_Timing T55xx_Timing_FixedBit = { 31 * 8 , 20 * 8 , 18 * 8 , 50 * 8 , 0 , 0 , 15 * 8 }; T55xx_Timing T55xx_Timing_LLR = { 31 * 8 , 20 * 8 , 18 * 8 , 50 * 8 , 0 , 0 , 15 * 8 }; T55xx_Timing T55xx_Timing_Leading0 = { 31 * 8 , 20 * 8 , 18 * 8 , 40 * 8 , 0 , 0 , 15 * 8 }; T55xx_Timing T55xx_Timing_1of4 = { 31 * 8 , 20 * 8 , 18 * 8 , 34 * 8 , 50 * 8 , 66 * 8 , 15 * 8 }; - // Some defines for readability -#define T55xx_LongLeadingReference 4 // Value to tell Write Bit to send long reference #define T55xx_DLMode_Fixed 0 // Default Mode #define T55xx_DLMode_LLR 1 // Long Leading Reference #define T55xx_DLMode_Leading0 2 // Leading Zero #define T55xx_DLMode_1of4 3 // 1 of 4 +#define T55xx_LongLeadingReference 4 // Value to tell Write Bit to send long reference +// Macro for code readability +#define BitStream_Byte(X) ((X) / 8) +#define BitStream_Bit(X) ((X) - ((X) / 8) * 8) + void TurnReadLFOn(int delay) { FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD); @@ -1257,7 +1300,6 @@ void T55xxWriteBit(int bit, T55xx_Timing *Timings) { WaitUS(Timings->WRITE_GAP); } - // Function to abstract an Arbitrary length byte array to store bit pattern. // bit_array - Array to hold data/bit pattern // start_offset - bit location to start storing new bits. @@ -1265,69 +1307,29 @@ void T55xxWriteBit(int bit, T55xx_Timing *Timings) { // num_bits - how many bits (low x bits of data) Max 32 bits at a time // max_len - how many bytes can the bit_array hold (ensure no buffer overflow) // returns "Next" bit offset / bits stored (for next store) -int T55xx_SetBits (uint8_t *bit_array, int start_offset, uint32_t data , int num_bits, int max_len) +//int T55xx_SetBits (uint8_t *bit_array, int start_offset, uint32_t data , int num_bits, int max_len) +int T55xx_SetBits (uint8_t *BitStream, uint8_t start_offset, uint32_t data , uint8_t num_bits, uint8_t max_len) { - int bit,byte_idx, bit_idx; - int offset; - int NextOffset = start_offset; + int8_t offset; + int8_t NextOffset = start_offset; // Check if data will fit. - if ((start_offset + num_bits) <= (max_len*8)) { - + if ((start_offset + num_bits) <= (max_len*8)) { // Loop through the data and store for (offset = (num_bits-1); offset >= 0; offset--) { - - bit = (data >> offset) & 1; // Get data bit value (0/1) - byte_idx = (NextOffset / 8); // Get Array Byte Index to Store - bit_idx = NextOffset - (byte_idx * 8); // Get Bit Index to set/clr - - // If set (1) we OR, if clear (0) we AND with inverse - // Dbprintf ("Add Bit : %d at byte %d bit %d",bit,byte_idx,bit_idx); - if (bit == 1) - bit_array[byte_idx] |= (1 << bit_idx); // Set the bit to 1 - - else - bit_array[byte_idx] &= (0xff ^ (1 << bit_idx)); // Set the bit to 0 (clr) - - NextOffset++; - } + + if ((data >> offset) & 1) BitStream[BitStream_Byte(NextOffset)] |= (1 << BitStream_Bit(NextOffset)); // Set the bit to 1 + else BitStream[BitStream_Byte(NextOffset)] &= (0xff ^ (1 << BitStream_Bit(NextOffset))); // Set the bit to 0 + + NextOffset++; + } } else Dbprintf ("Too Many Bits to fit into bit buffer"); + return NextOffset; } -// Send T5577 reset command then read stream (see if we can identify the start of the stream) -void T55xxResetRead(void) { - LED_A_ON(); - //clear buffer now so it does not interfere with timing later - BigBuf_Clear_keep_EM(); - - // Set up FPGA, 125kHz - LFSetupFPGAForADC(95, true); - StartTicks(); - // make sure tag is fully powered up... - WaitMS(5); - - // Trigger T55x7 in mode. - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - WaitUS(T55xx_Timing_FixedBit.START_GAP); - - // reset tag - op code 00 - T55xxWriteBit(0,&T55xx_Timing_FixedBit); - T55xxWriteBit(0,&T55xx_Timing_FixedBit); - - TurnReadLFOn(T55xx_Timing_FixedBit.READ_GAP); - - // Acquisition - DoPartialAcquisition(0, true, BigBuf_max_traceLen(), 0); - - // Turn the field off - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off - cmd_send(CMD_ACK,0,0,0,0,0); - LED_A_OFF(); -} - // Send one downlink command to the card void T55xx_SendCMD (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) { //, bool read_cmd) {//, struct T55xx_Timing *Timing) { @@ -1344,17 +1346,15 @@ void T55xx_SendCMD (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) { bool PwdMode = ((arg & 0x01) == 0x01); uint8_t Page = (arg & 0x02) >> 1; bool testMode = ((arg & 0x04) == 0x04); - uint8_t downlink_mode = (arg >> 3) & 0x03;; + uint8_t downlink_mode = (arg >> 3) & 0x03; bool reg_readmode = ((arg & 0x20) == 0x20); bool read_cmd = ((arg & 0x40) == 0x40); - - int i = 0; - uint8_t BitStream[10]; // Max Downlink Command size ~75 bits, so 10 bytes (80 bits) + uint8_t i = 0; + uint8_t BitStream[10]; // Max Downlink Command size ~74 bits, so 10 bytes (80 bits) uint8_t BitStreamLen; - int byte_idx, bit_idx; T55xx_Timing *Timing; + uint8_t SendBits; - // Assigning Downlink Timeing for write switch (downlink_mode) { @@ -1385,16 +1385,15 @@ void T55xx_SendCMD (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) { BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,testMode ? 1 : Page , 1,sizeof(BitStream)); if (PwdMode) { - // Leading 0 and 1 of 4 00 fixed bits if passsword used if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4)) { BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream)); BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream)); } BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Pwd, 32,sizeof(BitStream)); - } - // Add Lock bit + + // Add Lock bit 0 BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream)); // Add Data if a write command @@ -1402,11 +1401,8 @@ void T55xx_SendCMD (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) { // Add Address if (!reg_readmode) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Block, 3,sizeof(BitStream)); - - // Send Bits to T55xx - // Set up FPGA, 125kHz LFSetupFPGAForADC(95, true); StartTicks(); @@ -1416,35 +1412,54 @@ void T55xx_SendCMD (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); WaitUS(Timing->START_GAP); - // If long leading 0 send long reference pulse if (downlink_mode == T55xx_DLMode_LLR) T55xxWriteBit (T55xx_LongLeadingReference,Timing); // Send Long Leading Start Reference - uint8_t SendBits; - if (downlink_mode == T55xx_DLMode_1of4) { // 1 of 4 need to send 2 bits at a time - for (i = 0; i < BitStreamLen; i+=2) { - byte_idx = i / 8; - bit_idx = i - (byte_idx * 8); - SendBits = ((BitStream[byte_idx] >> bit_idx) & 1) << 1; - - byte_idx = (i+1) / 8; - bit_idx = (i+1) - (byte_idx * 8); - SendBits += (BitStream[byte_idx] >> bit_idx) & 1; - - T55xxWriteBit (SendBits,Timing); + for ( i = 0; i < BitStreamLen; i+=2 ) { + SendBits = (BitStream[BitStream_Byte(i )] >> (BitStream_Bit(i )) & 1) << 1; // Bit i + SendBits += (BitStream[BitStream_Byte(i+1)] >> (BitStream_Bit(i+1)) & 1); // Bit i+1; + T55xxWriteBit (SendBits & 3,Timing); } } else { for (i = 0; i < BitStreamLen; i++) { - byte_idx = i / 8; - bit_idx = i - (byte_idx * 8); - SendBits = (BitStream[byte_idx] >> bit_idx) & 1; - T55xxWriteBit (SendBits,Timing); + SendBits = (BitStream[BitStream_Byte(i)] >> BitStream_Bit(i)); + T55xxWriteBit (SendBits & 1,Timing); } } +} + +// Send T5577 reset command then read stream (see if we can identify the start of the stream) +void T55xxResetRead(void) { + LED_A_ON(); + //clear buffer now so it does not interfere with timing later + BigBuf_Clear_keep_EM(); + + // Set up FPGA, 125kHz + LFSetupFPGAForADC(95, true); + StartTicks(); + // make sure tag is fully powered up... + WaitMS(5); + // Trigger T55x7 in mode. + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + WaitUS(T55xx_Timing_FixedBit.START_GAP); + + // reset tag - op code 00 + T55xxWriteBit(0,&T55xx_Timing_FixedBit); + T55xxWriteBit(0,&T55xx_Timing_FixedBit); + + TurnReadLFOn(T55xx_Timing_FixedBit.READ_GAP); + + // Acquisition + DoPartialAcquisition(0, true, BigBuf_max_traceLen(), 0); + + // Turn the field off + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off + cmd_send(CMD_ACK,0,0,0,0,0); + LED_A_OFF(); } // Write one card block in page 0, no lock @@ -1501,6 +1516,7 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) { } // Read one card block in page [page] +//void T55xxReadBlock (uint16_t arg0, uint8_t Block, uint32_t Pwd) {//, struct T55xx_Timing *Timing) { void T55xxReadBlock (uint16_t arg0, uint8_t Block, uint32_t Pwd) {//, struct T55xx_Timing *Timing) { LED_A_ON(); @@ -1523,12 +1539,44 @@ void T55xxReadBlock (uint16_t arg0, uint8_t Block, uint32_t Pwd) {//, struct T55 //make sure block is at max 7 Block &= 0x7; + //clear buffer now so it does not interfere with timing later BigBuf_Clear_ext(false); T55xx_SendCMD (0, Block, Pwd, arg0); //, true); - +/* +// the send has been moved to the above SendCMD Call +======= + + // Set up FPGA, 125kHz to power up the tag + LFSetupFPGAForADC(95, true); + StartTicks(); + // make sure tag is fully powered up... + WaitMS(5); + // Trigger T55x7 Direct Access Mode with start gap + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + WaitUS(START_GAP); + + // Opcode 1[page] + T55xxWriteBit(1); + T55xxWriteBit(Page); //Page 0 + + if (PwdMode) { + // Send Pwd + for (i = 0x80000000; i != 0; i >>= 1) + T55xxWriteBit(Pwd & i); + } + // Send a zero bit separation + T55xxWriteBit(0); + + // Send Block number (if direct access mode) + if (!RegReadMode) + for (i = 0x04; i != 0; i >>= 1) + T55xxWriteBit(Block & i); + + +*/ // Turn field on to read the response // 137*8 seems to get to the start of data pretty well... // but we want to go past the start and let the repeating data settle in... @@ -1564,7 +1612,6 @@ void T55xxWakeUp(uint32_t Pwd){ T55xxWriteBit(0,&T55xx_Timing_FixedBit); //Page 0 // Send Pwd - for (i = 0x80000000; i != 0; i >>= 1) T55xxWriteBit(Pwd & i,&T55xx_Timing_FixedBit); @@ -1778,6 +1825,7 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo) { #define FWD_CMD_WRITE 0xA #define FWD_CMD_READ 0x9 #define FWD_CMD_DISABLE 0x5 +#define FWD_CMD_PROTECT 0x3 uint8_t forwardLink_data[64]; //array of forwarded bits uint8_t * forward_ptr; //ptr for forward message preparation @@ -1947,7 +1995,7 @@ void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) { void EM4xWriteWord(uint32_t flag, uint32_t Data, uint32_t Pwd) { - bool PwdMode = (flag & 0xF); + bool PwdMode = (flag & 0x1); uint8_t Address = (flag >> 8) & 0xFF; uint8_t fwd_bit_count; @@ -1977,6 +2025,39 @@ void EM4xWriteWord(uint32_t flag, uint32_t Data, uint32_t Pwd) { LED_A_OFF(); cmd_send(CMD_ACK,0,0,0,0,0); } + +void EM4xProtect(uint32_t flag, uint32_t Data, uint32_t Pwd) { + + bool PwdMode = (flag & 0x1); + uint8_t fwd_bit_count; + + //clear buffer now so it does not interfere with timing later + BigBuf_Clear_ext(false); + + LED_A_ON(); + StartTicks(); + //If password mode do login + if (PwdMode) EM4xLogin(Pwd); + + forward_ptr = forwardLink_data; + fwd_bit_count = Prepare_Cmd( FWD_CMD_PROTECT ); + + //unsure if this needs the full packet config... + fwd_bit_count += Prepare_Data( Data&0xFFFF, Data>>16 ); + + SendForward(fwd_bit_count); + + //Wait for write to complete + //SpinDelay(10); + + WaitUS(6500); + //Capture response if one exists + DoPartialAcquisition(20, true, 6000, 1000); + + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off + LED_A_OFF(); + cmd_send(CMD_ACK,0,0,0,0,0); +} /* Reading a COTAG.