X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/f9f5f4500024230410171226f036c596d73b1bbc..6f93185537e17bebe27f42c8558338e7f04b7d68:/client/cmdlfem4x.c

diff --git a/client/cmdlfem4x.c b/client/cmdlfem4x.c
index 2cc03430..1150595c 100644
--- a/client/cmdlfem4x.c
+++ b/client/cmdlfem4x.c
@@ -305,7 +305,6 @@ uint32_t OutputEM4x50_Block(uint8_t *BitStream, size_t size, bool verbose, bool
  //completed by Marshmellow
 int EM4x50Read(const char *Cmd, bool verbose)
 {
-
 	uint8_t fndClk[] = {8,16,32,40,50,64,128};
 	int clk = 0; 
 	int invert = 0;
@@ -500,7 +499,7 @@ int CmdEM4x50Read(const char *Cmd) {
 }
 
 int usage_lf_em_read(void) {
-	PrintAndLog("Read EM4x05/EM4x69.  Tag must be on antenna. ");
+	PrintAndLog("Read EM 4x05/4x50/EM4x69.  Tag must be on antenna. ");
 	PrintAndLog("");
 	PrintAndLog("Usage:  lf em readword [h] <address> <pwd>");
 	PrintAndLog("Options:");
@@ -513,124 +512,150 @@ int usage_lf_em_read(void) {
 	return 0;
 }
 
-//search for given preamble in given BitStream and return success=1 or fail=0 and startIndex
-uint8_t EMpreambleSearch(uint8_t *BitStream, uint8_t *preamble, size_t pLen, size_t size, size_t *startIdx)
-{
-	// Sanity check.  If preamble length is bigger than bitstream length.
-	if ( size <= pLen ) return 0;
-	// em only sends preamble once, so look for it once in the first x bits
-	uint8_t foundCnt = 0;
-	for (int idx = 0; idx < size - pLen; idx++){
-		if (memcmp(BitStream+idx, preamble, pLen) == 0){
-			//first index found
-			foundCnt++;
-			if (foundCnt == 1) {
-				*startIdx = idx;
-				return 1;
-			}
-		}
-	}
+int usage_lf_em_write(void) {
+	PrintAndLog("Write EM 4x05/4x50/4x69.  Tag must be on antenna. ");
+	PrintAndLog("");
+	PrintAndLog("Usage:  lf em writeword [h] <address> <data> <pwd>");
+	PrintAndLog("Options:");
+	PrintAndLog("       h         - this help");
+	PrintAndLog("       address   - memory address to write to. (0-15)");
+	PrintAndLog("       data      - data to write (hex)");	
+	PrintAndLog("       pwd       - password (hex) (optional)");
+	PrintAndLog("samples:");
+	PrintAndLog("      lf em writeword 1");
+	PrintAndLog("      lf em writeword 1 deadc0de 11223344");
 	return 0;
 }
 
-int demodEM4x05resp(uint8_t bitsNeeded) {
-	int ans = 0;
-	bool demodFound = false;
-	DemodBufferLen = 0x00;
+#define EM_PREAMBLE_LEN 6
+// download samples from device
+// and copy them to Graphbuffer
+bool downloadSamplesEM(){
+	
+	// 8 bit preamble + 32 bit word response (max clock (128) * 40bits = 5120 samples)
+	uint8_t got[6000];
+	GetFromBigBuf(got, sizeof(got), 0);
+	if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2500) ) {
+		PrintAndLog("command execution time out");
+		return FALSE;
+	}
+	setGraphBuf(got, sizeof(got));
+	return TRUE;
+}
+//search for given preamble in given BitStream and return success=1 or fail=0 and startIndex
+bool doPreambleSearch(size_t *startIdx){
+	
+	// sanity check
+	if ( DemodBufferLen < EM_PREAMBLE_LEN) {
+		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305 demodbuffer too small");
+		return FALSE;
+	}
+	
 	// skip first two 0 bits as they might have been missed in the demod 
-	uint8_t preamble[6] = {0,0,1,0,1,0};
-
-	// test for FSK wave (easiest to 99% ID)
-	if (GetFskClock("", FALSE, FALSE)) {
-		//valid fsk clocks found
-		ans = FSKrawDemod("0 0", false);
-		if (!ans) {
-			if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: FSK Demod failed");
-			//return -1;
-		} else {
-			// set size to 10 to only test first 4 positions for the preamble
-			size_t size = (10 > DemodBufferLen) ? DemodBufferLen : 10;
-			size_t startIdx = 0; 
-
-			if (g_debugMode) PrintAndLog("ANS: %d | %u | %u", ans, startIdx, size);
-
-			uint8_t errChk = !EMpreambleSearch(DemodBuffer, preamble, sizeof(preamble), size, &startIdx);
-			if ( errChk == 0) {
-				if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305 preamble not found :: %d", startIdx);
-				//return -1;
-			} else {
-				//can't test size because the preamble doesn't repeat :(
-				//meaning chances of false positives are high.
-				demodFound = true;
-			}
+	uint8_t preamble[EM_PREAMBLE_LEN] = {0,0,1,0,1,0};
+	
+	// set size to 10 to only test first 4 positions for the preamble
+	size_t size = (10 > DemodBufferLen) ? DemodBufferLen : 10;
+	*startIdx = 0; 
+	uint8_t found = 0;
+	
+	// em only sends preamble once, so look for it once in the first x bits
+	for (int idx = 0; idx < size - EM_PREAMBLE_LEN; idx++){
+		if (memcmp(DemodBuffer+idx, preamble, EM_PREAMBLE_LEN) == 0){
+			//first index found
+			*startIdx = idx;
+			found = 1;
+			break;
 		}
 	}
+	
+	if ( !found) {
+		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305 preamble not found :: %d", *startIdx);
+		return FALSE;
+	} 
+	return TRUE;
+}
 
-	ans = GetPskClock("", FALSE, FALSE);
-	if (ans>0) {
-		PrintAndLog("PSK response possibly found, run `data rawd p1` to attempt to demod");
+bool detectFSK(){
+	// detect fsk clock
+	if (!GetFskClock("", FALSE, FALSE)) {
+		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: FSK clock failed");
+		return FALSE;
 	}
-
-	if (!demodFound) {
-		DemodBufferLen = 0x00;
-		//try biphase
-		ans = ASKbiphaseDemod("0 0 1", FALSE);
-		if (!ans) { 
-			if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/biphase Demod failed");
-			//return -1;
-		} else {
-			// set size to 10 to only test first 4 positions for the preamble
-			size_t size = (10 > DemodBufferLen) ? DemodBufferLen : 10;
-			size_t startIdx = 0; 
-
-			if (g_debugMode) PrintAndLog("ANS: %d | %u | %u", ans, startIdx, size);
-
-			uint8_t errChk = !EMpreambleSearch(DemodBuffer, preamble, sizeof(preamble), size, &startIdx);
-			if ( errChk == 0) {
-				if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305 preamble not found :: %d", startIdx);
-				//return -1;
-			} else {
-				//can't test size because the preamble doesn't repeat :(
-				//meaning chances of false positives are high.
-				demodFound = true;
-			}
-		}
+	// demod
+	int ans = FSKrawDemod("0 0", FALSE);
+	if (!ans) {
+		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: FSK Demod failed");
+		return FALSE;
 	}
-
-	if (!demodFound) {
-		DemodBufferLen = 0x00;
-		// try manchester - NOTE: ST only applies to T55x7 tags.
-		ans = ASKDemod_ext("0,0,1", false, false, 1, false);
+	return TRUE;
+}
+// PSK clocks should be easy to detect ( but difficult to demod a non-repeating pattern... )
+bool detectPSK(){	
+	int	ans = GetPskClock("", FALSE, FALSE);
+	if (ans <= 0) {
+		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: PSK clock failed");
+		return FALSE;
+	}
+	PrintAndLog("PSK response possibly found, run `data rawd p1` to attempt to demod");
+	return TRUE;
+}
+// try manchester - NOTE: ST only applies to T55x7 tags.
+bool detectASK_MAN(){
+	bool stcheck = FALSE;
+	int ans = ASKDemod_ext("0 0 0", FALSE, FALSE, 1, &stcheck);
+	if (!ans) {
+		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/Manchester Demod failed");
+		return FALSE;
+	} 
+	return TRUE;
+}
+bool detectASK_BI(){
+	int ans = ASKbiphaseDemod("0 0 1", FALSE);
+	if (!ans) { 
+		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/biphase normal demod failed");
+		
+		ans = ASKbiphaseDemod("0 1 1", FALSE);
 		if (!ans) {
-			if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/Manchester Demod failed");
-			//return -1;
-		} else {
-			// set size to 10 to only test first 4 positions for the preamble
-			size_t size = (10 > DemodBufferLen) ? DemodBufferLen : 10;
-			size_t startIdx = 0; 
-
-			if (g_debugMode) PrintAndLog("ANS: %d | %u | %u", ans, startIdx, size);
-
-			uint8_t errChk = !EMpreambleSearch(DemodBuffer, preamble, sizeof(preamble), size, &startIdx);
-			if ( errChk == 0) {
-				if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305 preamble not found :: %d", startIdx);
-				//return -1;
-			} else {
-				//can't test size because the preamble doesn't repeat :(
-				//meaning chances of false positives are high.
-				demodFound = true;
-			}
+			if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/biphase inverted demod failed");
+			return FALSE;
 		}
 	}
+	return TRUE;
+}
 
-	if (demodFound && bitsNeeded < DemodBufferLen) {
-		setDemodBuf(DemodBuffer + ans + sizeof(preamble), bitsNeeded, 0);
+// param: idx - start index in demoded data.
+int setDemodBufferEM(uint8_t bitsNeeded, size_t idx){
+	if ( bitsNeeded < DemodBufferLen) {
+		setDemodBuf(DemodBuffer + idx + EM_PREAMBLE_LEN, bitsNeeded, 0);
 		CmdPrintDemodBuff("x");
 		return 1;
 	}
 	return -1;
 }
 
+// FSK, PSK, ASK/MANCHESTER, ASK/BIPHASE, ASK/DIPHASE 
+// should cover 90% of known used configs
+// the rest will need to be manually demoded for now...
+int demodEM4x05resp(uint8_t bitsNeeded) {
+
+	size_t startIdx = 0;	
+	
+	if (detectASK_MAN() && doPreambleSearch( &startIdx ))
+		return setDemodBufferEM(bitsNeeded, startIdx);
+	
+	if (detectASK_BI() && doPreambleSearch( &startIdx ))
+		return setDemodBufferEM(bitsNeeded, startIdx);
+	
+	if (detectFSK() && doPreambleSearch( &startIdx ))
+		return setDemodBufferEM(bitsNeeded, startIdx);
+	
+	if (detectPSK() && doPreambleSearch( &startIdx )) 
+		return setDemodBufferEM(bitsNeeded, startIdx);
+	
+	return -1;
+}
+
 int CmdReadWord(const char *Cmd) {
 	int addr, pwd;
 	bool usePwd = false;
@@ -659,46 +684,26 @@ int CmdReadWord(const char *Cmd) {
 		PrintAndLog("Command timed out");
 		return -1;
 	}
-	
-	uint8_t got[6000];
-	GetFromBigBuf(got, sizeof(got), 0);
-	if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2500) ) {
-		PrintAndLog("command execution time out");
+
+	if (!downloadSamplesEM())
 		return -1;
-	}
-	setGraphBuf(got, sizeof(got));
+	
 	int testLen = (GraphTraceLen < 1000) ? GraphTraceLen : 1000;
 	if (graphJustNoise(GraphBuffer, testLen)) {
-		PrintAndLog("no tag not found");
+		PrintAndLog("Tag not found");
 		return -1;
 	}
 
-	//need 32 bits for read word
-	demodEM4x05resp(32);
-	
-	return 1;
+	//attempt demod:
+	//need 32 bits from a read word
+	return demodEM4x05resp(44);
 }
 
-int usage_lf_em_write(void) {
-	PrintAndLog("Write EM4x05/EM4x69.  Tag must be on antenna. ");
-	PrintAndLog("");
-	PrintAndLog("Usage:  lf em writeword [h] <address> <data> <pwd>");
-	PrintAndLog("Options:");
-	PrintAndLog("       h         - this help");
-	PrintAndLog("       address   - memory address to write to. (0-15)");
-	PrintAndLog("       data      - data to write (hex)");	
-	PrintAndLog("       pwd       - password (hex) (optional)");
-	PrintAndLog("samples:");
-	PrintAndLog("      lf em writeword 1");
-	PrintAndLog("      lf em writeword 1 deadc0de 11223344");
-	return 0;
-}
 int CmdWriteWord(const char *Cmd) {
 	uint8_t ctmp = param_getchar(Cmd, 0);
 	if ( strlen(Cmd) == 0 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_em_write();
 	
-	bool usePwd = false;
-		
+	bool usePwd = false;		
 	int addr = 16; // default to invalid address
 	int data = 0xFFFFFFFF; // default to blank data
 	int pwd = 0xFFFFFFFF; // default to blank password
@@ -707,7 +712,6 @@ int CmdWriteWord(const char *Cmd) {
 	data = param_get32ex(Cmd, 1, -1, 16);
 	pwd =  param_get32ex(Cmd, 2, -1, 16);
 	
-	
 	if ( (addr > 15) || (addr < 0 ) || ( addr == -1) ) {
 		PrintAndLog("Address must be between 0 and 15");
 		return 1;
@@ -730,36 +734,18 @@ int CmdWriteWord(const char *Cmd) {
 		return -1;
 	}
 	
-	//get response if there is one
-	uint8_t got[6000]; // 8 bit preamble + 32 bit word response (max clock (128) * 40bits = 5120 samples)
-	GetFromBigBuf(got, sizeof(got), 0);
-	if ( !WaitForResponseTimeout(CMD_ACK, NULL, 8000) ) {
-		PrintAndLog("command execution time out");
-		return -2;
-	}
-	setGraphBuf(got, sizeof(got));
-	
-	int ans = 0;
-	//bool ST = true;
-	DemodBufferLen = 0x00;	
+	if (!downloadSamplesEM())
+		return -1;
 
-	//ans = ASKDemod_ext("0 0 1", FALSE, FALSE, 1, &ST);
-	ans = ASKbiphaseDemod("0 0 1", FALSE);
-	if (!ans) { 
-		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305: ASK/Manchester Demod failed");
-		return -3;
-	}
+	//todo: check response for 00001010 then write data for write confirmation!
 	
-	//todo: check response for 00001010 then write data for write confirmation!	
-	size_t startIdx = 0, size = DemodBufferLen; 
+	//attempt demod:
+	//need 0 bits demoded (after preamble) to verify write cmd
+	int result = demodEM4x05resp(0);
+	if (result == 1)
+		PrintAndLog("Write Verified");
 
-	uint8_t preamble[8] = {0,0,0,0,1,0,1,0};		
-	if (!preambleSearch(DemodBuffer, preamble, sizeof(preamble), &size, &startIdx)){
-		if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305 preamble not found :: %d", startIdx);
-		return -4;
-	}
-	PrintAndLog("Write OK");
-	return 0;
+	return result;
 }
 
 static command_t CommandTable[] = {