From: apresence@gmail.com <apresence@gmail.com@ef4ab9da-24cd-11de-8aaa-f3a34680c41f>
Date: Sun, 12 May 2013 08:11:00 +0000 (+0000)
Subject: Support for cloning to T55x7 at different clock rates & 134KHz
X-Git-Tag: v1.0.0~95
X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/e67b06b7067c55f12bbdf72c5f9f00dec11e99fd?ds=sidebyside;hp=5b59cfb7b1067f95d4a1eb403404d1c15c23cac2
Support for cloning to T55x7 at different clock rates & 134KHz
* Modified commands (lf em4x):
em410xwatch ['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)
em410xwrite <UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate
* Better option checking for em410xwrite & fix for uninitialized vars
* Increased samples from 2000 to 4000 in em410xwatch (2000 is OK for clock=64, but too few for clock=32)
---
diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 8d4e2dc9..17d293ed 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -1175,6 +1175,7 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
uint64_t rev_id = 0; // reversed ID
int c_parity[4]; // column parity
int r_parity = 0; // row parity
+ uint32_t clock = 0;
// Reverse ID bits given as parameter (for simpler operations)
for (i = 0; i < EM410X_ID_LENGTH; ++i) {
@@ -1232,12 +1233,35 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
T55xxWriteBlock((uint32_t)id, 2, 0, 0);
// Config for EM410x (RF/64, Manchester, Maxblock=2)
- if (card)
+ if (card) {
+ // Clock rate is stored in bits 8-15 of the card value
+ clock = (card & 0xFF00) >> 8;
+ Dbprintf("Clock rate: %d", clock);
+ switch (clock)
+ {
+ case 32:
+ clock = T55x7_BITRATE_RF_32;
+ break;
+ case 16:
+ clock = T55x7_BITRATE_RF_16;
+ break;
+ case 0:
+ // A value of 0 is assumed to be 64 for backwards-compatibility
+ // Fall through...
+ case 64:
+ clock = T55x7_BITRATE_RF_64;
+ break;
+ default:
+ Dbprintf("Invalid clock rate: %d", clock);
+ return;
+ }
+
// Writing configuration for T55x7 tag
- T55xxWriteBlock(T55x7_BITRATE_RF_64 |
+ T55xxWriteBlock(clock |
T55x7_MODULATION_MANCHESTER |
2 << T55x7_MAXBLOCK_SHIFT,
0, 0, 0);
+ }
else
// Writing configuration for T5555(Q5) tag
T55xxWriteBlock(0x1F << T5555_BITRATE_SHIFT |
diff --git a/client/cmdlfem4x.c b/client/cmdlfem4x.c
index f823750b..862f20bd 100644
--- a/client/cmdlfem4x.c
+++ b/client/cmdlfem4x.c
@@ -248,10 +248,16 @@ int CmdEM410xSim(const char *Cmd)
* looped until an EM410x tag is detected */
int CmdEM410xWatch(const char *Cmd)
{
+ int read_h = (*Cmd == 'h');
do
{
- CmdLFRead("");
- CmdSamples("2000");
+ CmdLFRead(read_h ? "h" : "");
+ // 2000 samples is OK for clock=64, but not clock=32. Probably want
+ // 8000 for clock=16. Don't want to go too high since old HID driver
+ // is very slow
+ // TBD: Auto-grow sample size based on detected sample rate. IE: If the
+ // rate gets lower, then grow the number of samples
+ CmdSamples("4000");
} while ( ! CmdEM410xRead(""));
return 0;
}
@@ -402,22 +408,66 @@ int CmdEM4x50Read(const char *Cmd)
int CmdEM410xWrite(const char *Cmd)
{
- uint64_t id = 0;
- unsigned int card;
+ uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
+ unsigned int card = 0xFF; // invalid card value
+ unsigned int clock = 0; // invalid clock value
+
+ sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
+
+ // Check ID
+ if (id == 0xFFFFFFFFFFFFFFFF) {
+ PrintAndLog("Error! ID is required.\n");
+ return 0;
+ }
+ if (id >= 0x10000000000) {
+ PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
+ return 0;
+ }
+
+ // Check Card
+ if (card == 0xFF) {
+ PrintAndLog("Error! Card type required.\n");
+ return 0;
+ }
+ if (card < 0) {
+ PrintAndLog("Error! Bad card type selected.\n");
+ return 0;
+ }
+
+ // Check Clock
+ if (card == 1)
+ {
+ // Default: 64
+ if (clock == 0)
+ clock = 64;
+
+ // Allowed clock rates: 16, 32 and 64
+ if ((clock != 16) && (clock != 32) && (clock != 64)) {
+ PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
+ return 0;
+ }
+ }
+ else if (clock != 0)
+ {
+ PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
+ return 0;
+ }
+
+ if (card == 1) {
+ PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
+ // NOTE: We really should pass the clock in as a separate argument, but to
+ // provide for backwards-compatibility for older firmware, and to avoid
+ // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
+ // the clock rate in bits 8-15 of the card value
+ card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
+ }
+ else if (card == 0)
+ PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
+ else {
+ PrintAndLog("Error! Bad card type selected.\n");
+ return 0;
+ }
- sscanf(Cmd, "%" PRIx64 " %d", &id, &card);
-
- if (id >= 0x10000000000) {
- PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
- return 0;
- }
-
- if (card > 1) {
- PrintAndLog("Error! Bad card type selected.\n");
- return 0;
- }
-
- PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, card ? "T55x7":"T5555", id);
UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
SendCommand(&c);
@@ -527,8 +577,8 @@ static command_t CommandTable[] =
{"help", CmdHelp, 1, "This help"},
{"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
{"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
- {"em410xwatch", CmdEM410xWatch, 0, "Watches for EM410x tags"},
- {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> -- Write EM410x UID to T5555(Q5) or T55x7 tag"},
+ {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
+ {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
{"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
{"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
{"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},