From: marshmellow42 Date: Mon, 29 Dec 2014 01:33:32 +0000 (-0500) Subject: LF Demod streamlining X-Git-Tag: v2.0.0-rc1~75^2~10 X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/eb191de615e499035904263bcbdbff21539dd103?ds=sidebyside LF Demod streamlining one shared location for demoding lf for arm and client. also added a few raw demod commands. --- diff --git a/armsrc/Makefile b/armsrc/Makefile index e10c1001..6f0a2aef 100644 --- a/armsrc/Makefile +++ b/armsrc/Makefile @@ -35,6 +35,7 @@ ARMSRC = fpgaloader.c \ legicrf.c \ iso14443crc.c \ crc16.c \ + lfdemod.c \ $(SRC_ISO14443a) \ $(SRC_ISO14443b) \ $(SRC_CRAPTO1) \ diff --git a/armsrc/lfops.c b/armsrc/lfops.c index 94d9d1fb..0ed1c0c3 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -14,6 +14,7 @@ #include "hitag2.h" #include "crc16.h" #include "string.h" +#include "../common/lfdemod.h" /** @@ -629,7 +630,7 @@ void CmdHIDsimTAG(int hi, int lo, int ledcontrol) if (ledcontrol) LED_A_OFF(); } - +/* //translate wave to 11111100000 (1 for each short wave 0 for each long wave) size_t fsk_demod(uint8_t * dest, size_t size) { @@ -728,11 +729,106 @@ size_t aggregate_bits(uint8_t *dest,size_t size, uint8_t rfLen, uint8_t maxCons }//end for return numBits; } +*/ + // loop to get raw HID waveform then FSK demodulate the TAG ID from it void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol) { uint8_t *dest = (uint8_t *)BigBuf; + size_t size=0; //, found=0; + uint32_t hi2=0, hi=0, lo=0; + + // Configure to go in 125Khz listen mode + LFSetupFPGAForADC(95, true); + + while(!BUTTON_PRESS()) { + + WDT_HIT(); + if (ledcontrol) LED_A_ON(); + + DoAcquisition125k_internal(-1,true); + size = sizeof(BigBuf); + if (size < 2000) continue; + // FSK demodulator + + int bitLen = HIDdemodFSK(dest,size,&hi2,&hi,&lo); + + WDT_HIT(); + + if (bitLen>0 && lo>0){ + // final loop, go over previously decoded manchester data and decode into usable tag ID + // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0 + if (hi2 != 0){ //extra large HID tags + Dbprintf("TAG ID: %x%08x%08x (%d)", + (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); + }else { //standard HID tags <38 bits + //Dbprintf("TAG ID: %x%08x (%d)",(unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); //old print cmd + uint8_t bitlen = 0; + uint32_t fc = 0; + uint32_t cardnum = 0; + if (((hi>>5)&1)==1){//if bit 38 is set then < 37 bit format is used + uint32_t lo2=0; + lo2=(((hi & 31) << 12) | (lo>>20)); //get bits 21-37 to check for format len bit + uint8_t idx3 = 1; + while(lo2>1){ //find last bit set to 1 (format len bit) + lo2=lo2>>1; + idx3++; + } + bitlen =idx3+19; + fc =0; + cardnum=0; + if(bitlen==26){ + cardnum = (lo>>1)&0xFFFF; + fc = (lo>>17)&0xFF; + } + if(bitlen==37){ + cardnum = (lo>>1)&0x7FFFF; + fc = ((hi&0xF)<<12)|(lo>>20); + } + if(bitlen==34){ + cardnum = (lo>>1)&0xFFFF; + fc= ((hi&1)<<15)|(lo>>17); + } + if(bitlen==35){ + cardnum = (lo>>1)&0xFFFFF; + fc = ((hi&1)<<11)|(lo>>21); + } + } + else { //if bit 38 is not set then 37 bit format is used + bitlen= 37; + fc =0; + cardnum=0; + if(bitlen==37){ + cardnum = (lo>>1)&0x7FFFF; + fc = ((hi&0xF)<<12)|(lo>>20); + } + } + //Dbprintf("TAG ID: %x%08x (%d)", + // (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); + Dbprintf("TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d", + (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF, + (unsigned int) bitlen, (unsigned int) fc, (unsigned int) cardnum); + } + if (findone){ + if (ledcontrol) LED_A_OFF(); + return; + } + // reset + hi2 = hi = lo = 0; + } + WDT_HIT(); + } + DbpString("Stopped"); + if (ledcontrol) LED_A_OFF(); +} + +/* +// loop to get raw HID waveform then FSK demodulate the TAG ID from it +void CmdHIDdemodFSK2(int findone, int *high, int *low, int ledcontrol) +{ + uint8_t *dest = (uint8_t *)BigBuf; + size_t size=0,idx=0; //, found=0; uint32_t hi2=0, hi=0, lo=0; @@ -865,7 +961,9 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol) DbpString("Stopped"); if (ledcontrol) LED_A_OFF(); } +*/ +/* uint32_t bytebits_to_byte(uint8_t* src, int numbits) { uint32_t num = 0; @@ -876,8 +974,69 @@ uint32_t bytebits_to_byte(uint8_t* src, int numbits) } return num; } +*/ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) +{ + uint8_t *dest = (uint8_t *)BigBuf; + size_t size=0; + int idx=0; + uint32_t code=0, code2=0; + + // Configure to go in 125Khz listen mode + LFSetupFPGAForADC(95, true); + + while(!BUTTON_PRESS()) { + WDT_HIT(); + if (ledcontrol) LED_A_ON(); + DoAcquisition125k_internal(-1,true); + size = sizeof(BigBuf); + //make sure buffer has data + if (size < 2000) continue; + //fskdemod and get start index + idx = IOdemodFSK(dest,size); + if (idx>0){ + //valid tag found + + //Index map + //0 10 20 30 40 50 60 + //| | | | | | | + //01234567 8 90123456 7 89012345 6 78901234 5 67890123 4 56789012 3 45678901 23 + //----------------------------------------------------------------------------- + //00000000 0 11110000 1 facility 1 version* 1 code*one 1 code*two 1 ???????? 11 + // + //XSF(version)facility:codeone+codetwo + //Handle the data + if(findone){ //only print binary if we are doing one + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7],dest[idx+8]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15],dest[idx+16],dest[idx+17]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23],dest[idx+24],dest[idx+25],dest[idx+26]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+27],dest[idx+28],dest[idx+29],dest[idx+30],dest[idx+31],dest[idx+32],dest[idx+33],dest[idx+34],dest[idx+35]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+36],dest[idx+37],dest[idx+38],dest[idx+39],dest[idx+40],dest[idx+41],dest[idx+42],dest[idx+43],dest[idx+44]); + Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+45],dest[idx+46],dest[idx+47],dest[idx+48],dest[idx+49],dest[idx+50],dest[idx+51],dest[idx+52],dest[idx+53]); + Dbprintf("%d%d%d%d%d%d%d%d %d%d",dest[idx+54],dest[idx+55],dest[idx+56],dest[idx+57],dest[idx+58],dest[idx+59],dest[idx+60],dest[idx+61],dest[idx+62],dest[idx+63]); + } + code = bytebits_to_byte(dest+idx,32); + code2 = bytebits_to_byte(dest+idx+32,32); + short version = bytebits_to_byte(dest+idx+27,8); //14,4 + uint8_t facilitycode = bytebits_to_byte(dest+idx+19,8) ; + uint16_t number = (bytebits_to_byte(dest+idx+36,8)<<8)|(bytebits_to_byte(dest+idx+45,8)); //36,9 + + Dbprintf("XSF(%02d)%02x:%d (%08x%08x)",version,facilitycode,number,code,code2); + // if we're only looking for one tag + if (findone){ + if (ledcontrol) LED_A_OFF(); + //LED_A_OFF(); + return; + } + } + WDT_HIT(); + } + DbpString("Stopped"); + if (ledcontrol) LED_A_OFF(); +} +/* +void CmdIOdemodFSK2(int findone, int *high, int *low, int ledcontrol) { uint8_t *dest = (uint8_t *)BigBuf; size_t size=0, idx=0; @@ -958,6 +1117,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol) DbpString("Stopped"); if (ledcontrol) LED_A_OFF(); } +*/ /*------------------------------ * T5555/T5557/T5567 routines diff --git a/client/Makefile b/client/Makefile index 05ffc667..b2b215e1 100644 --- a/client/Makefile +++ b/client/Makefile @@ -70,6 +70,7 @@ CMDSRCS = nonce2key/crapto1.c\ graph.c \ ui.c \ cmddata.c \ + lfdemod.c \ cmdhf.c \ cmdhf14a.c \ cmdhf14b.c \ diff --git a/client/cmddata.c b/client/cmddata.c index be6e35d5..607121f0 100644 --- a/client/cmddata.c +++ b/client/cmddata.c @@ -11,8 +11,7 @@ #include #include #include -#include - +//#include #include #include "proxmark3.h" #include "data.h" @@ -22,6 +21,7 @@ #include "util.h" #include "cmdmain.h" #include "cmddata.h" +#include "../common/lfdemod.h" static int CmdHelp(const char *Cmd); @@ -90,6 +90,8 @@ int Cmdaskdemod(const char *Cmd) else if (GraphBuffer[i] < low) low = GraphBuffer[i]; } + high=abs(high*.75); + low=abs(low*.75); if (c != 0 && c != 1) { PrintAndLog("Invalid argument: %s", Cmd); return 0; @@ -123,32 +125,7 @@ int Cmdaskdemod(const char *Cmd) return 0; } -void printBitStream(int BitStream[], uint32_t bitLen){ - uint32_t i = 0; - if (bitLen<16) return; - if (bitLen>512) bitLen=512; - for (i = 0; i < (bitLen-16); i+=16) { - PrintAndLog("%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i", - BitStream[i], - BitStream[i+1], - BitStream[i+2], - BitStream[i+3], - BitStream[i+4], - BitStream[i+5], - BitStream[i+6], - BitStream[i+7], - BitStream[i+8], - BitStream[i+9], - BitStream[i+10], - BitStream[i+11], - BitStream[i+12], - BitStream[i+13], - BitStream[i+14], - BitStream[i+15]); - } - return; -} -void printBitStream2(uint8_t BitStream[], uint32_t bitLen){ +void printBitStream(uint8_t BitStream[], uint32_t bitLen){ uint32_t i = 0; if (bitLen<16) { PrintAndLog("Too few bits found: %d",bitLen); @@ -176,219 +153,183 @@ void printBitStream2(uint8_t BitStream[], uint32_t bitLen){ } return; } - -//by marshmellow -//takes 1s and 0s and searches for EM410x format - output EM ID -int Em410xDecode(const char *Cmd) +void printEM410x(uint64_t id) { - //no arguments needed - built this way in case we want this to be a direct call from "data " cmds in the future - // otherwise could be a void with no arguments - //set defaults - int high=0, low=0; - uint64_t lo=0; //hi=0, - - uint32_t i = 0; - uint32_t initLoopMax = 1000; - if (initLoopMax>GraphTraceLen) initLoopMax=GraphTraceLen; - - for (;i < initLoopMax; ++i) //1000 samples should be plenty to find high and low values - { - if (GraphBuffer[i] > high) - high = GraphBuffer[i]; - else if (GraphBuffer[i] < low) - low = GraphBuffer[i]; - } - if (((high !=1)||(low !=0))){ //allow only 1s and 0s - PrintAndLog("no data found"); - return 0; - } - uint8_t parityTest=0; - // 111111111 bit pattern represent start of frame - int frame_marker_mask[] = {1,1,1,1,1,1,1,1,1}; - uint32_t idx = 0; - uint32_t ii=0; - uint8_t resetCnt = 0; - while( (idx + 64) < GraphTraceLen) { -restart: - // search for a start of frame marker - if ( memcmp(GraphBuffer+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0) - { // frame marker found - idx+=9;//sizeof(frame_marker_mask); - for (i=0; i<10;i++){ - for(ii=0; ii<5; ++ii){ - parityTest += GraphBuffer[(i*5)+ii+idx]; - } - if (parityTest== ((parityTest>>1)<<1)){ - parityTest=0; - for (ii=0; ii<4;++ii){ - //hi = (hi<<1)|(lo>>31); - lo=(lo<<1LL)|(GraphBuffer[(i*5)+ii+idx]); - } - //PrintAndLog("DEBUG: EM parity passed parity val: %d, i:%d, ii:%d,idx:%d, Buffer: %d%d%d%d%d,lo: %d",parityTest,i,ii,idx,GraphBuffer[idx+ii+(i*5)-5],GraphBuffer[idx+ii+(i*5)-4],GraphBuffer[idx+ii+(i*5)-3],GraphBuffer[idx+ii+(i*5)-2],GraphBuffer[idx+ii+(i*5)-1],lo); - }else {//parity failed - //PrintAndLog("DEBUG: EM parity failed parity val: %d, i:%d, ii:%d,idx:%d, Buffer: %d%d%d%d%d",parityTest,i,ii,idx,GraphBuffer[idx+ii+(i*5)-5],GraphBuffer[idx+ii+(i*5)-4],GraphBuffer[idx+ii+(i*5)-3],GraphBuffer[idx+ii+(i*5)-2],GraphBuffer[idx+ii+(i*5)-1]); - parityTest=0; - idx-=8; - if (resetCnt>5)return 0; - resetCnt++; - goto restart;//continue; - } - } - //skip last 5 bit parity test for simplicity. - - //get Unique ID + if (id !=0){ uint64_t iii=1; uint64_t id2lo=0; //id2hi=0, - //for (i=0;i<8;i++){ //for uint32 instead of uint64 - // id2hi=(id2hi<<1)|((hi & (iii<<(i)))>>i); - //} + uint32_t ii=0; + uint32_t i=0; for (ii=5; ii>0;ii--){ for (i=0;i<8;i++){ - id2lo=(id2lo<<1LL)|((lo & (iii<<(i+((ii-1)*8))))>>(i+((ii-1)*8))); + id2lo=(id2lo<<1LL)|((id & (iii<<(i+((ii-1)*8))))>>(i+((ii-1)*8))); } } //output em id - PrintAndLog("EM TAG ID : %010llx", lo); + PrintAndLog("EM TAG ID : %010llx", id); PrintAndLog("Unique TAG ID: %010llx", id2lo); //id2hi, - PrintAndLog("DEZ 8 : %08lld",lo & 0xFFFFFF); - PrintAndLog("DEZ 10 : %010lld",lo & 0xFFFFFF); - PrintAndLog("DEZ 5.5 : %05lld.%05lld",(lo>>16LL) & 0xFFFF,(lo & 0xFFFF)); - PrintAndLog("DEZ 3.5A : %03lld.%05lld",(lo>>32ll),(lo & 0xFFFF)); - PrintAndLog("DEZ 14/IK2 : %014lld",lo); + PrintAndLog("DEZ 8 : %08lld",id & 0xFFFFFF); + PrintAndLog("DEZ 10 : %010lld",id & 0xFFFFFF); + PrintAndLog("DEZ 5.5 : %05lld.%05lld",(id>>16LL) & 0xFFFF,(id & 0xFFFF)); + PrintAndLog("DEZ 3.5A : %03lld.%05lld",(id>>32ll),(id & 0xFFFF)); + PrintAndLog("DEZ 14/IK2 : %014lld",id); PrintAndLog("DEZ 15/IK3 : %015lld",id2lo); - PrintAndLog("Other : %05lld_%03lld_%08lld",(lo&0xFFFF),((lo>>16LL) & 0xFF),(lo & 0xFFFFFF)); - return 0; - }else{ - idx++; - } + PrintAndLog("Other : %05lld_%03lld_%08lld",(id&0xFFFF),((id>>16LL) & 0xFF),(id & 0xFFFFFF)); + } + return; +} + +int CmdEm410xDecode(const char *Cmd) +{ + uint64_t id=0; + uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0}; + uint32_t i=0; + for (i=0;iGraphTraceLen) initLoopMax=GraphTraceLen; - // Detect high and lows - PrintAndLog("Using Clock: %d and invert=%d",clk,invert); - for (i = 0; i < initLoopMax; ++i) //1000 samples should be plenty to find high and low values - { - if (GraphBuffer[i] > high) - high = GraphBuffer[i]; - else if (GraphBuffer[i] < low) - low = GraphBuffer[i]; - } - if ((high < 30) && ((high !=1)||(low !=-1))){ //throw away static - allow 1 and -1 (in case of threshold command first) + uint32_t BitLen = getFromGraphBuf(BitStream); + + int errCnt=0; + errCnt = askmandemod(BitStream, &BitLen,&clk,&invert); + if (errCnt==-1){ //if fatal error (or -1) PrintAndLog("no data found"); return 0; - } - //13% fuzz in case highs and lows aren't clipped [marshmellow] - high=(int)(0.75*high); - low=(int)(0.75*low); - - //PrintAndLog("DEBUG - valid high: %d - valid low: %d",high,low); - int lastBit = 0; //set first clock check - uint32_t bitnum = 0; //output counter - uint8_t tol = 0; //clock tolerance adjust - waves will be accepted as within the clock if they fall + or - this value + clock from last valid wave - if (clk==32)tol=1; //clock tolerance may not be needed anymore currently set to + or - 1 but could be increased for poor waves or removed entirely - uint32_t iii = 0; - uint32_t gLen = GraphTraceLen; - if (gLen > 500) gLen=500; - uint8_t errCnt =0; - uint32_t bestStart = GraphTraceLen; - uint32_t bestErrCnt = (GraphTraceLen/1000); - //PrintAndLog("DEBUG - lastbit - %d",lastBit); - //loop to find first wave that works - for (iii=0; iii < gLen; ++iii){ - if ((GraphBuffer[iii]>=high)||(GraphBuffer[iii]<=low)){ - lastBit=iii-clk; - //loop through to see if this start location works - for (i = iii; i < GraphTraceLen; ++i) { - if ((GraphBuffer[i] >= high) && ((i-lastBit)>(clk-tol))){ - lastBit+=clk; - BitStream[bitnum] = invert; - bitnum++; - } else if ((GraphBuffer[i] <= low) && ((i-lastBit)>(clk-tol))){ - //low found and we are expecting a bar - lastBit+=clk; - BitStream[bitnum] = 1-invert; - bitnum++; - } else { - //mid value found or no bar supposed to be here - if ((i-lastBit)>(clk+tol)){ - //should have hit a high or low based on clock!! - - - //debug - //PrintAndLog("DEBUG - no wave in expected area - location: %d, expected: %d-%d, lastBit: %d - resetting search",i,(lastBit+(clk-((int)(tol)))),(lastBit+(clk+((int)(tol)))),lastBit); - if (bitnum > 0){ - BitStream[bitnum]=77; - bitnum++; - } - - - errCnt++; - lastBit+=clk;//skip over until hit too many errors - if (errCnt>((GraphTraceLen/1000))){ //allow 1 error for every 1000 samples else start over - errCnt=0; - bitnum=0;//start over - break; - } - } - } - } - //we got more than 64 good bits and not all errors - if ((bitnum > (64+errCnt)) && (errCnt<(GraphTraceLen/1000))) { - //possible good read - if (errCnt==0) break; //great read - finish - if (bestStart == iii) break; //if current run == bestErrCnt run (after exhausted testing) then finish - if (errCnt=gLen){ //exhausted test - //if there was a ok test go back to that one and re-run the best run (then dump after that run) - if (bestErrCnt < (GraphTraceLen/1000)) iii=bestStart; - } + GraphTraceLen=bitnum; + RepaintGraphWindow(); + */ + //output + if (errCnt>0){ + PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt); } - if (bitnum>16){ - - PrintAndLog("Data start pos:%d, lastBit:%d, stop pos:%d, numBits:%d",iii,lastBit,i,bitnum); - //move BitStream back to GraphBuffer + PrintAndLog("ASK/Manchester decoded bitstream:"); + // Now output the bitstream to the scrollback by line of 16 bits + printBitStream(BitStream,BitLen); + uint64_t lo =0; + lo = Em410xDecode(BitStream,BitLen); + printEM410x(lo); + + return 0; +} + +//by marshmellow +//biphase demod = 10 (or 01)=1 / 00 (or 11)=0 + + +//by marshmellow +//manchester demod +//stricktly take 10 and 01 and convert to 0 and 1 +int Cmdmandecoderaw(const char *Cmd) +{ + int i =0; + int errCnt=0; + int bitnum=0; + uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0}; + int high=0,low=0; + for (;ihigh) high=GraphBuffer[i]; + else if(GraphBuffer[i]1 || low <0 ){ + PrintAndLog("Error: please raw demod the wave first then mancheseter raw decode"); + return 0; + } + bitnum=i; + errCnt=manrawdemod(BitStream,&bitnum); + PrintAndLog("Manchester Decoded - # errors:%d - data:",errCnt); + printBitStream(BitStream,bitnum); + if (errCnt==0){ + //put back in graphbuffer ClearGraph(0); - for (i=0; i < bitnum; ++i){ + for (i=0; i0){ - PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt); - } - PrintAndLog("ASK decoded bitstream:"); - // Now output the bitstream to the scrollback by line of 16 bits - printBitStream2(BitStream,bitnum); - Em410xDecode(Cmd); - } + if (errCnt>0){ + PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt); + } + PrintAndLog("ASK demoded bitstream:"); + // Now output the bitstream to the scrollback by line of 16 bits + printBitStream(BitStream,BitLen); + return 0; } @@ -536,139 +477,8 @@ int CmdDetectClockRate(const char *Cmd) PrintAndLog("Auto-detected clock rate: %d", clock); return 0; } - -//by marshmellow -//demod GraphBuffer wave to 0s and 1s for each wave - 0s for short waves 1s for long waves -size_t fsk_wave_demod(int size) -{ - uint32_t last_transition = 0; - uint32_t idx = 1; - uint32_t maxVal = 0; - // we don't care about actual value, only if it's more or less than a - // threshold essentially we capture zero crossings for later analysis - for(idx=1; idx1 transition - if (GraphBuffer[idx-1] < GraphBuffer[idx]) { // 0 -> 1 transition - if (idx-last_transition<6){ - // do nothing with extra garbage (shouldn't be any) noise tolerance? - } else if(idx-last_transition < 9) { - GraphBuffer[numBits]=1; - // Other fsk demods reverse this making the short waves 1 and long waves 0 - // this is really backwards... smaller waves will typically be 0 and larger 1 [marshmellow] - // but will leave as is and invert when needed later - } else{ - GraphBuffer[numBits]=0; - } - last_transition = idx; - numBits++; - // PrintAndLog("numbits %d",numBits); - } - } - return numBits; //Actually, it returns the number of bytes, but each byte represents a bit: 1 or 0 -} -uint32_t myround(float f) -{ - if (f >= UINT_MAX) return UINT_MAX; - return (uint32_t) (f + (float)0.5); -} - -//by marshmellow (from holiman's base) -//translate 11111100000 to 10 -size_t aggregate_bits(int size, uint8_t rfLen, uint8_t maxConsequtiveBits, uint8_t invert) //,uint8_t l2h_crossing_value -{ - int lastval=GraphBuffer[0]; - uint32_t idx=0; - size_t numBits=0; - uint32_t n=1; - uint32_t n2=0; - for( idx=1; idx < size; idx++) { - - if (GraphBuffer[idx]==lastval) { - n++; - continue; - } - // if lastval was 1, we have a 1->0 crossing - if ( GraphBuffer[idx-1]==1 ) { - n=myround((float)(n+1)/((float)(rfLen)/(float)8)); //-2 noise tolerance - - // n=(n+1) / h2l_crossing_value; - //truncating could get us into trouble - //now we will try with actual clock (RF/64 or RF/50) variable instead - //then devide with float casting then truncate after more acurate division - //and round to nearest int - //like n = (((float)n)/(float)rfLen/(float)10); - } else {// 0->1 crossing - n=myround((float)(n+1)/((float)(rfLen-2)/(float)10)); // as int 120/6 = 20 as float 120/(64/10) = 18 (18.75) - //n=(n+1) / l2h_crossing_value; - } - if (n == 0) n = 1; //this should never happen... should we error if it does? - - if (n < maxConsequtiveBits) // Consecutive //when the consecutive bits are low - the noise tolerance can be high - //if it is high then we must be careful how much noise tolerance we allow - { - if (invert==0){ // do not invert bits - for (n2=0; n2 (7*32)+2) size = (7*32)+2; //only output a max of 7 blocks of 32 bits most tags will have full bit stream inside that sample size - printBitStream(GraphBuffer,size); - - ClearGraph(1); + printBitStream(BitStream,size); return 0; } -//by marshmellow +//by marshmellow (based on existing demod + holiman's refactor) +//HID Prox demod - FSK RF/50 with preamble of 00011101 (then manchester encoded) +//print full HID Prox ID and some bit format details if found int CmdFSKdemodHID(const char *Cmd) { //raw fsk demod no manchester decoding no start bit finding just get binary from wave - //set defaults - uint8_t rfLen = 50; - uint8_t invert=0;//param_get8(Cmd, 0); - size_t idx=0; uint32_t hi2=0, hi=0, lo=0; + uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0}; + uint32_t BitLen = getFromGraphBuf(BitStream); //get binary from fsk wave - size_t size = fskdemod(rfLen,invert); - - // final loop, go over previously decoded fsk data and now manchester decode into usable tag ID - // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0 - int frame_marker_mask[] = {1,1,1,0,0,0}; - int numshifts = 0; - idx = 0; - while( idx + 6 < size) { - // search for a start of frame marker - - if ( memcmp(GraphBuffer+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0) - { // frame marker found - idx+=6;//sizeof(frame_marker_mask); //size of int is >6 - while(GraphBuffer[idx] != GraphBuffer[idx+1] && idx < size-2) - { - // Keep going until next frame marker (or error) - // Shift in a bit. Start by shifting high registers - hi2 = (hi2<<1)|(hi>>31); - hi = (hi<<1)|(lo>>31); - //Then, shift in a 0 or one into low - if (GraphBuffer[idx] && !GraphBuffer[idx+1]) // 1 0 - lo=(lo<<1)|0; - else // 0 1 - lo=(lo<<1)|1; - numshifts++; - idx += 2; + size_t size = HIDdemodFSK(BitStream,BitLen,&hi2,&hi,&lo); + if (size<0){ + PrintAndLog("Error demoding fsk"); + return 0; + } + if (hi2 != 0){ //extra large HID tags + PrintAndLog("TAG ID: %x%08x%08x (%d)", + (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); + } + else { //standard HID tags <38 bits + //Dbprintf("TAG ID: %x%08x (%d)",(unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); //old print cmd + uint8_t bitlen = 0; + uint32_t fc = 0; + uint32_t cardnum = 0; + if (((hi>>5)&1)==1){//if bit 38 is set then < 37 bit format is used + uint32_t lo2=0; + lo2=(((hi & 15) << 12) | (lo>>20)); //get bits 21-37 to check for format len bit + uint8_t idx3 = 1; + while(lo2>1){ //find last bit set to 1 (format len bit) + lo2=lo2>>1; + idx3++; } - - //PrintAndLog("Num shifts: %d ", numshifts); - // Hopefully, we read a tag and hit upon the next frame marker - if(idx + 6 < size) - { - if ( memcmp(GraphBuffer+(idx), frame_marker_mask, sizeof(frame_marker_mask)) == 0) - { - if (hi2 != 0){ //extra large HID tags - PrintAndLog("TAG ID: %x%08x%08x (%d)", - (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); - } - else { //standard HID tags <38 bits - //Dbprintf("TAG ID: %x%08x (%d)",(unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); //old print cmd - uint8_t bitlen = 0; - uint32_t fc = 0; - uint32_t cardnum = 0; - if (((hi>>5)&1)==1){//if bit 38 is set then < 37 bit format is used - uint32_t lo2=0; - lo2=(((hi & 15) << 12) | (lo>>20)); //get bits 21-37 to check for format len bit - uint8_t idx3 = 1; - while(lo2>1){ //find last bit set to 1 (format len bit) - lo2=lo2>>1; - idx3++; - } - bitlen =idx3+19; - fc =0; - cardnum=0; - if(bitlen==26){ - cardnum = (lo>>1)&0xFFFF; - fc = (lo>>17)&0xFF; - } - if(bitlen==37){ - cardnum = (lo>>1)&0x7FFFF; - fc = ((hi&0xF)<<12)|(lo>>20); - } - if(bitlen==34){ - cardnum = (lo>>1)&0xFFFF; - fc= ((hi&1)<<15)|(lo>>17); - } - if(bitlen==35){ - cardnum = (lo>>1)&0xFFFFF; - fc = ((hi&1)<<11)|(lo>>21); - } - } - else { //if bit 38 is not set then 37 bit format is used - bitlen= 37; - fc =0; - cardnum=0; - if(bitlen==37){ - cardnum = (lo>>1)&0x7FFFF; - fc = ((hi&0xF)<<12)|(lo>>20); - } - } - - PrintAndLog("TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d", - (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF, - (unsigned int) bitlen, (unsigned int) fc, (unsigned int) cardnum); - ClearGraph(1); - return 0; - } - } + bitlen =idx3+19; + fc =0; + cardnum=0; + if(bitlen==26){ + cardnum = (lo>>1)&0xFFFF; + fc = (lo>>17)&0xFF; + } + if(bitlen==37){ + cardnum = (lo>>1)&0x7FFFF; + fc = ((hi&0xF)<<12)|(lo>>20); + } + if(bitlen==34){ + cardnum = (lo>>1)&0xFFFF; + fc= ((hi&1)<<15)|(lo>>17); + } + if(bitlen==35){ + cardnum = (lo>>1)&0xFFFFF; + fc = ((hi&1)<<11)|(lo>>21); } - // reset - hi2 = hi = lo = 0; - numshifts = 0; - }else - { - idx++; } + else { //if bit 38 is not set then 37 bit format is used + bitlen= 37; + fc =0; + cardnum=0; + if(bitlen==37){ + cardnum = (lo>>1)&0x7FFFF; + fc = ((hi&0xF)<<12)|(lo>>20); + } + } + PrintAndLog("TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d", + (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF, + (unsigned int) bitlen, (unsigned int) fc, (unsigned int) cardnum); + return 0; } - if (idx + sizeof(frame_marker_mask) >= size){ - PrintAndLog("start bits for hid not found"); - PrintAndLog("FSK decoded bitstream:"); - // Now output the bitstream to the scrollback by line of 16 bits - printBitStream(GraphBuffer,size); - - } - ClearGraph(1); return 0; } //by marshmellow +//IO-Prox demod - FSK RF/64 with preamble of 000000001 +//print ioprox ID and some format details int CmdFSKdemodIO(const char *Cmd) { //raw fsk demod no manchester decoding no start bit finding just get binary from wave //set defaults - uint8_t rfLen = 64; - uint8_t invert=1; - size_t idx=0; - uint8_t testMax=0; + int idx=0; //test samples are not just noise if (GraphTraceLen < 64) return 0; - for(idx=0;idx<64;idx++){ - if (testMax40){ //Index map //0 10 20 30 40 50 60 //| | | | | | | @@ -861,43 +632,22 @@ int CmdFSKdemodIO(const char *Cmd) // //XSF(version)facility:codeone+codetwo (raw) //Handle the data - int mask[] = {0,0,0,0,0,0,0,0,0,1}; - for( idx=0; idx < (size - 74); idx++) { - if ( memcmp(GraphBuffer + idx, mask, sizeof(mask))==0) { - //frame marker found - if (GraphBuffer[idx+17]==1 && GraphBuffer[idx+26]==1 && GraphBuffer[idx+35]==1 && GraphBuffer[idx+44]==1 && GraphBuffer[idx+53]==1){ - //confirmed proper separator bits found - - PrintAndLog("%d%d%d%d%d%d%d%d %d",GraphBuffer[idx], GraphBuffer[idx+1], GraphBuffer[idx+2], GraphBuffer[idx+3], GraphBuffer[idx+4], GraphBuffer[idx+5], GraphBuffer[idx+6], GraphBuffer[idx+7], GraphBuffer[idx+8]); - PrintAndLog("%d%d%d%d%d%d%d%d %d",GraphBuffer[idx+9], GraphBuffer[idx+10], GraphBuffer[idx+11],GraphBuffer[idx+12],GraphBuffer[idx+13],GraphBuffer[idx+14],GraphBuffer[idx+15],GraphBuffer[idx+16],GraphBuffer[idx+17]); - PrintAndLog("%d%d%d%d%d%d%d%d %d",GraphBuffer[idx+18], GraphBuffer[idx+19], GraphBuffer[idx+20],GraphBuffer[idx+21],GraphBuffer[idx+22],GraphBuffer[idx+23],GraphBuffer[idx+24],GraphBuffer[idx+25],GraphBuffer[idx+26]); - PrintAndLog("%d%d%d%d%d%d%d%d %d",GraphBuffer[idx+27], GraphBuffer[idx+28], GraphBuffer[idx+29],GraphBuffer[idx+30],GraphBuffer[idx+31],GraphBuffer[idx+32],GraphBuffer[idx+33],GraphBuffer[idx+34],GraphBuffer[idx+35]); - PrintAndLog("%d%d%d%d%d%d%d%d %d",GraphBuffer[idx+36], GraphBuffer[idx+37], GraphBuffer[idx+38],GraphBuffer[idx+39],GraphBuffer[idx+40],GraphBuffer[idx+41],GraphBuffer[idx+42],GraphBuffer[idx+43],GraphBuffer[idx+44]); - PrintAndLog("%d%d%d%d%d%d%d%d %d",GraphBuffer[idx+45], GraphBuffer[idx+46], GraphBuffer[idx+47],GraphBuffer[idx+48],GraphBuffer[idx+49],GraphBuffer[idx+50],GraphBuffer[idx+51],GraphBuffer[idx+52],GraphBuffer[idx+53]); - PrintAndLog("%d%d%d%d%d%d%d%d %d%d",GraphBuffer[idx+54],GraphBuffer[idx+55],GraphBuffer[idx+56],GraphBuffer[idx+57],GraphBuffer[idx+58],GraphBuffer[idx+59],GraphBuffer[idx+60],GraphBuffer[idx+61],GraphBuffer[idx+62],GraphBuffer[idx+63]); - - uint32_t code = bytebits_to_byte(GraphBuffer+idx,32); - uint32_t code2 = bytebits_to_byte(GraphBuffer+idx+32,32); - short version = bytebits_to_byte(GraphBuffer+idx+27,8); //14,4 - uint8_t facilitycode = bytebits_to_byte(GraphBuffer+idx+19,8) ; - uint16_t number = (bytebits_to_byte(GraphBuffer+idx+36,8)<<8)|(bytebits_to_byte(GraphBuffer+idx+45,8)); //36,9 - - PrintAndLog("XSF(%02d)%02x:%d (%08x%08x)",version,facilitycode,number,code,code2); - ClearGraph(1); - return 0; - } else { - PrintAndLog("thought we had a valid tag but did not match format"); - } - } - } - if (idx >= (size-74)){ - PrintAndLog("start bits for io prox not found"); - PrintAndLog("FSK decoded bitstream:"); - // Now output the bitstream to the scrollback by line of 16 bits - printBitStream(GraphBuffer,size); - } - } - ClearGraph(1); + + PrintAndLog("%d%d%d%d%d%d%d%d %d",BitStream[idx], BitStream[idx+1], BitStream[idx+2], BitStream[idx+3], BitStream[idx+4], BitStream[idx+5], BitStream[idx+6], BitStream[idx+7], BitStream[idx+8]); + PrintAndLog("%d%d%d%d%d%d%d%d %d",BitStream[idx+9], BitStream[idx+10], BitStream[idx+11],BitStream[idx+12],BitStream[idx+13],BitStream[idx+14],BitStream[idx+15],BitStream[idx+16],BitStream[idx+17]); + PrintAndLog("%d%d%d%d%d%d%d%d %d",BitStream[idx+18], BitStream[idx+19], BitStream[idx+20],BitStream[idx+21],BitStream[idx+22],BitStream[idx+23],BitStream[idx+24],BitStream[idx+25],BitStream[idx+26]); + PrintAndLog("%d%d%d%d%d%d%d%d %d",BitStream[idx+27], BitStream[idx+28], BitStream[idx+29],BitStream[idx+30],BitStream[idx+31],BitStream[idx+32],BitStream[idx+33],BitStream[idx+34],BitStream[idx+35]); + PrintAndLog("%d%d%d%d%d%d%d%d %d",BitStream[idx+36], BitStream[idx+37], BitStream[idx+38],BitStream[idx+39],BitStream[idx+40],BitStream[idx+41],BitStream[idx+42],BitStream[idx+43],BitStream[idx+44]); + PrintAndLog("%d%d%d%d%d%d%d%d %d",BitStream[idx+45], BitStream[idx+46], BitStream[idx+47],BitStream[idx+48],BitStream[idx+49],BitStream[idx+50],BitStream[idx+51],BitStream[idx+52],BitStream[idx+53]); + PrintAndLog("%d%d%d%d%d%d%d%d %d%d",BitStream[idx+54],BitStream[idx+55],BitStream[idx+56],BitStream[idx+57],BitStream[idx+58],BitStream[idx+59],BitStream[idx+60],BitStream[idx+61],BitStream[idx+62],BitStream[idx+63]); + + uint32_t code = bytebits_to_byte(BitStream+idx,32); + uint32_t code2 = bytebits_to_byte(BitStream+idx+32,32); + short version = bytebits_to_byte(BitStream+idx+27,8); //14,4 + uint8_t facilitycode = bytebits_to_byte(BitStream+idx+19,8) ; + uint16_t number = (bytebits_to_byte(BitStream+idx+36,8)<<8)|(bytebits_to_byte(BitStream+idx+45,8)); //36,9 + + PrintAndLog("XSF(%02d)%02x:%d (%08x%08x)",version,facilitycode,number,code,code2); return 0; } int CmdFSKdemod(const char *Cmd) //old CmdFSKdemod needs updating @@ -1545,6 +1295,7 @@ static command_t CommandTable[] = {"amp", CmdAmp, 1, "Amplify peaks"}, {"askdemod", Cmdaskdemod, 1, "<0 or 1> -- Attempt to demodulate simple ASK tags"}, {"askmandemod", Cmdaskmandemod, 1, "[clock] [invert<0 or 1>] -- Attempt to demodulate ASK/Manchester tags and output binary (args optional[clock will try Auto-detect])"}, + {"askrawdemod", Cmdaskrawdemod, 1, "[clock] [invert<0 or 1>] -- Attempt to demodulate ASK tags and output binary (args optional[clock will try Auto-detect])"}, {"autocorr", CmdAutoCorr, 1, " -- Autocorrelation over window"}, {"bitsamples", CmdBitsamples, 0, "Get raw samples as bitstring"}, {"bitstream", CmdBitstream, 1, "[clock rate] -- Convert waveform into a bitstream"}, @@ -1562,6 +1313,7 @@ static command_t CommandTable[] = {"load", CmdLoad, 1, " -- Load trace (to graph window"}, {"ltrim", CmdLtrim, 1, " -- Trim samples from left of trace"}, {"mandemod", CmdManchesterDemod, 1, "[i] [clock rate] -- Manchester demodulate binary stream (option 'i' to invert output)"}, + {"manrawdecode", Cmdmandecoderaw, 1, "Manchester decode binary stream already in graph buffer"}, {"manmod", CmdManchesterMod, 1, "[clock rate] -- Manchester modulate a binary stream"}, {"norm", CmdNorm, 1, "Normalize max/min to +/-500"}, {"plot", CmdPlot, 1, "Show graph window (hit 'h' in window for keystroke help)"}, diff --git a/client/cmddata.h b/client/cmddata.h index 8a202828..8bbbf195 100644 --- a/client/cmddata.h +++ b/client/cmddata.h @@ -18,6 +18,7 @@ int CmdData(const char *Cmd); int CmdAmp(const char *Cmd); int Cmdaskdemod(const char *Cmd); int Cmdaskrawdemod(const char *Cmd); +int Cmdaskmandemod(const char *Cmd); int CmdAutoCorr(const char *Cmd); int CmdBitsamples(const char *Cmd); int CmdBitstream(const char *Cmd); diff --git a/common/lfdemod.c b/common/lfdemod.c new file mode 100644 index 00000000..1d668a14 --- /dev/null +++ b/common/lfdemod.c @@ -0,0 +1,692 @@ +//----------------------------------------------------------------------------- +// Copyright (C) 2014 +// +// This code is licensed to you under the terms of the GNU GPL, version 2 or, +// at your option, any later version. See the LICENSE.txt file for the text of +// the license. +//----------------------------------------------------------------------------- +// Low frequency commands +//----------------------------------------------------------------------------- + +//#include +#include +#include +//#include +//#include +#include "lfdemod.h" +//#include "proxmark3.h" +//#include "data.h" +//#include "ui.h" +//#include "graph.h" +//#include "cmdparser.h" +//#include "util.h" +//#include "cmdmain.h" +//#include "cmddata.h" +//uint8_t BinStream[MAX_GRAPH_TRACE_LEN]; +//uint8_t BinStreamLen; + +//by marshmellow +//takes 1s and 0s and searches for EM410x format - output EM ID +uint64_t Em410xDecode(uint8_t BitStream[],uint32_t BitLen) +{ + //no arguments needed - built this way in case we want this to be a direct call from "data " cmds in the future + // otherwise could be a void with no arguments + //set defaults + int high=0, low=0; + uint64_t lo=0; //hi=0, + + uint32_t i = 0; + uint32_t initLoopMax = 1000; + if (initLoopMax>BitLen) initLoopMax=BitLen; + + for (;i < initLoopMax; ++i) //1000 samples should be plenty to find high and low values + { + if (BitStream[i] > high) + high = BitStream[i]; + else if (BitStream[i] < low) + low = BitStream[i]; + } + if (((high !=1)||(low !=0))){ //allow only 1s and 0s + // PrintAndLog("no data found"); + return 0; + } + uint8_t parityTest=0; + // 111111111 bit pattern represent start of frame + uint8_t frame_marker_mask[] = {1,1,1,1,1,1,1,1,1}; + uint32_t idx = 0; + uint32_t ii=0; + uint8_t resetCnt = 0; + while( (idx + 64) < BitLen) { +restart: + // search for a start of frame marker + if ( memcmp(BitStream+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0) + { // frame marker found + idx+=9;//sizeof(frame_marker_mask); + for (i=0; i<10;i++){ + for(ii=0; ii<5; ++ii){ + parityTest += BitStream[(i*5)+ii+idx]; + } + if (parityTest== ((parityTest>>1)<<1)){ + parityTest=0; + for (ii=0; ii<4;++ii){ + //hi = (hi<<1)|(lo>>31); + lo=(lo<<1LL)|(BitStream[(i*5)+ii+idx]); + } + //PrintAndLog("DEBUG: EM parity passed parity val: %d, i:%d, ii:%d,idx:%d, Buffer: %d%d%d%d%d,lo: %d",parityTest,i,ii,idx,BitStream[idx+ii+(i*5)-5],BitStream[idx+ii+(i*5)-4],BitStream[idx+ii+(i*5)-3],BitStream[idx+ii+(i*5)-2],BitStream[idx+ii+(i*5)-1],lo); + }else {//parity failed + //PrintAndLog("DEBUG: EM parity failed parity val: %d, i:%d, ii:%d,idx:%d, Buffer: %d%d%d%d%d",parityTest,i,ii,idx,BitStream[idx+ii+(i*5)-5],BitStream[idx+ii+(i*5)-4],BitStream[idx+ii+(i*5)-3],BitStream[idx+ii+(i*5)-2],BitStream[idx+ii+(i*5)-1]); + parityTest=0; + idx-=8; + if (resetCnt>5)return 0; + resetCnt++; + goto restart;//continue; + } + } + //skip last 5 bit parity test for simplicity. + return lo; + }else{ + idx++; + } + } + return 0; +} + +//by marshmellow +//takes 2 arguments - clock and invert both as integers +//attempts to demodulate ask while decoding manchester +//prints binary found and saves in graphbuffer for further commands +int askmandemod(uint8_t * BinStream,uint32_t *BitLen,int *clk, int *invert) +{ + uint32_t i; + //int invert=0; //invert default + int high = 0, low = 0; + *clk=DetectClock2(BinStream,(size_t)*BitLen,*clk); //clock default + uint8_t BitStream[MAX_BitStream_LEN] = {0}; + + //sscanf(Cmd, "%i %i", &clk, &invert); + if (*clk<8) *clk =64; + if (*clk<32) *clk=32; + if (*invert != 0 && *invert != 1) *invert=0; + uint32_t initLoopMax = 1000; + if (initLoopMax>*BitLen) initLoopMax=*BitLen; + // Detect high and lows + //PrintAndLog("Using Clock: %d and invert=%d",clk,invert); + for (i = 0; i < initLoopMax; ++i) //1000 samples should be plenty to find high and low values + { + if (BinStream[i] > high) + high = BinStream[i]; + else if (BinStream[i] < low) + low = BinStream[i]; + } + if ((high < 30) && ((high !=1)||(low !=-1))){ //throw away static - allow 1 and -1 (in case of threshold command first) + //PrintAndLog("no data found"); + return -1; + } + //13% fuzz in case highs and lows aren't clipped [marshmellow] + high=(int)(0.75*high); + low=(int)(0.75*low); + + //PrintAndLog("DEBUG - valid high: %d - valid low: %d",high,low); + int lastBit = 0; //set first clock check + uint32_t bitnum = 0; //output counter + uint8_t tol = 0; //clock tolerance adjust - waves will be accepted as within the clock if they fall + or - this value + clock from last valid wave + if (*clk==32)tol=1; //clock tolerance may not be needed anymore currently set to + or - 1 but could be increased for poor waves or removed entirely + uint32_t iii = 0; + uint32_t gLen = *BitLen; + if (gLen > 500) gLen=500; + uint8_t errCnt =0; + uint32_t bestStart = *BitLen; + uint32_t bestErrCnt = (*BitLen/1000); + //PrintAndLog("DEBUG - lastbit - %d",lastBit); + //loop to find first wave that works + for (iii=0; iii < gLen; ++iii){ + if ((BinStream[iii]>=high)||(BinStream[iii]<=low)){ + lastBit=iii-*clk; + //loop through to see if this start location works + for (i = iii; i < *BitLen; ++i) { + if ((BinStream[i] >= high) && ((i-lastBit)>(*clk-tol))){ + lastBit+=*clk; + BitStream[bitnum] = *invert; + bitnum++; + } else if ((BinStream[i] <= low) && ((i-lastBit)>(*clk-tol))){ + //low found and we are expecting a bar + lastBit+=*clk; + BitStream[bitnum] = 1-*invert; + bitnum++; + } else { + //mid value found or no bar supposed to be here + if ((i-lastBit)>(*clk+tol)){ + //should have hit a high or low based on clock!! + + + //debug + //PrintAndLog("DEBUG - no wave in expected area - location: %d, expected: %d-%d, lastBit: %d - resetting search",i,(lastBit+(clk-((int)(tol)))),(lastBit+(clk+((int)(tol)))),lastBit); + if (bitnum > 0){ + BitStream[bitnum]=77; + bitnum++; + } + + + errCnt++; + lastBit+=*clk;//skip over until hit too many errors + if (errCnt>((*BitLen/1000))){ //allow 1 error for every 1000 samples else start over + errCnt=0; + bitnum=0;//start over + break; + } + } + } + } + //we got more than 64 good bits and not all errors + if ((bitnum > (64+errCnt)) && (errCnt<(*BitLen/1000))) { + //possible good read + if (errCnt==0) break; //great read - finish + if (bestStart == iii) break; //if current run == bestErrCnt run (after exhausted testing) then finish + if (errCnt=gLen){ //exhausted test + //if there was a ok test go back to that one and re-run the best run (then dump after that run) + if (bestErrCnt < (*BitLen/1000)) iii=bestStart; + } + } + if (bitnum>16){ + + // PrintAndLog("Data start pos:%d, lastBit:%d, stop pos:%d, numBits:%d",iii,lastBit,i,bitnum); + //move BitStream back to GraphBuffer + //ClearGraph(0); + for (i=0; i < bitnum; ++i){ + BinStream[i]=BitStream[i]; + } + *BitLen=bitnum; + //RepaintGraphWindow(); + //output + //if (errCnt>0){ + // PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt); + //} + // PrintAndLog("ASK decoded bitstream:"); + // Now output the bitstream to the scrollback by line of 16 bits + // printBitStream2(BitStream,bitnum); + // Em410xDecode(Cmd); + } + return errCnt; +} + +//by marshmellow +//take 10 and 01 and manchester decode +//run through 2 times and take least errCnt +int manrawdemod(uint8_t * BitStream, int *bitLen) +{ + uint8_t BitStream2[MAX_BitStream_LEN]={0}; + int bitnum=0; + int errCnt =0; + int i=1; + int bestErr = 1000; + int bestRun = 0; + int finish = 0; + int ii=1; + for (ii=1;ii<3;++ii){ + i=1; + for (i=i+ii;i<*bitLen-2;i+=2){ + if(BitStream[i]==1 && (BitStream[i+1]==0)){ + BitStream2[bitnum++]=0; + } else if((BitStream[i]==0)&& BitStream[i+1]==1){ + BitStream2[bitnum++]=1; + } else { + BitStream2[bitnum++]=77; + errCnt++; + } + } + if (bestErr>errCnt){ + bestErr=errCnt; + bestRun=ii; + } + if (ii>1 || finish==1) { + if (bestRun==ii) { + break; + } else{ + ii=bestRun-1; + finish=1; + } + } + errCnt=0; + bitnum=0; + } + errCnt=bestErr; + if (errCnt<10){ + for (i=0; i*bitLen) initLoopMax=*bitLen; + // Detect high and lows + for (i = 0; i < initLoopMax; ++i) //1000 samples should be plenty to find high and low values + { + if (BinStream[i] > high) + high = BinStream[i]; + else if (BinStream[i] < low) + low = BinStream[i]; + } + if ((high < 30) && ((high !=1)||(low !=-1))){ //throw away static - allow 1 and -1 (in case of threshold command first) + // PrintAndLog("no data found"); + return -1; + } + //13% fuzz in case highs and lows aren't clipped [marshmellow] + high=(int)(0.75*high); + low=(int)(0.75*low); + + //PrintAndLog("DEBUG - valid high: %d - valid low: %d",high,low); + int lastBit = 0; //set first clock check + uint32_t bitnum = 0; //output counter + uint8_t tol = 0; //clock tolerance adjust - waves will be accepted as within the clock if they fall + or - this value + clock from last valid wave + if (*clk==32)tol=1; //clock tolerance may not be needed anymore currently set to + or - 1 but could be increased for poor waves or removed entirely + uint32_t iii = 0; + uint32_t gLen = *bitLen; + if (gLen > 500) gLen=500; + uint8_t errCnt =0; + uint32_t bestStart = *bitLen; + uint32_t bestErrCnt = (*bitLen/1000); + uint8_t midBit=0; + //PrintAndLog("DEBUG - lastbit - %d",lastBit); + //loop to find first wave that works + for (iii=0; iii < gLen; ++iii){ + if ((BinStream[iii]>=high)||(BinStream[iii]<=low)){ + lastBit=iii-*clk; + //loop through to see if this start location works + for (i = iii; i < *bitLen; ++i) { + if ((BinStream[i] >= high) && ((i-lastBit)>(*clk-tol))){ + lastBit+=*clk; + BitStream[bitnum] = *invert; + bitnum++; + midBit=0; + } else if ((BinStream[i] <= low) && ((i-lastBit)>(*clk-tol))){ + //low found and we are expecting a bar + lastBit+=*clk; + BitStream[bitnum] = 1-*invert; + bitnum++; + midBit=0; + } else if ((BinStream[i]<=low) && (midBit==0) && ((i-lastBit)>((*clk/2)-tol))){ + //mid bar? + midBit=1; + BitStream[bitnum]= 1-*invert; + bitnum++; + } else if ((BinStream[i]>=high)&&(midBit==0) && ((i-lastBit)>((*clk/2)-tol))){ + //mid bar? + midBit=1; + BitStream[bitnum]= *invert; + bitnum++; + } else if ((i-lastBit)>((*clk/2)+tol)&&(midBit==0)){ + //no mid bar found + midBit=1; + BitStream[bitnum]= BitStream[bitnum-1]; + bitnum++; + } else { + //mid value found or no bar supposed to be here + + if ((i-lastBit)>(*clk+tol)){ + //should have hit a high or low based on clock!! + //debug + //PrintAndLog("DEBUG - no wave in expected area - location: %d, expected: %d-%d, lastBit: %d - resetting search",i,(lastBit+(clk-((int)(tol)))),(lastBit+(clk+((int)(tol)))),lastBit); + if (bitnum > 0){ + BitStream[bitnum]=77; + bitnum++; + } + + + errCnt++; + lastBit+=*clk;//skip over until hit too many errors + if (errCnt>((*bitLen/1000))){ //allow 1 error for every 1000 samples else start over + errCnt=0; + bitnum=0;//start over + break; + } + } + } + } + //we got more than 64 good bits and not all errors + if ((bitnum > (64+errCnt)) && (errCnt<(*bitLen/1000))) { + //possible good read + if (errCnt==0) break; //great read - finish + if (bestStart == iii) break; //if current run == bestErrCnt run (after exhausted testing) then finish + if (errCnt=gLen){ //exhausted test + //if there was a ok test go back to that one and re-run the best run (then dump after that run) + if (bestErrCnt < (*bitLen/1000)) iii=bestStart; + } + } + if (bitnum>16){ + + // PrintAndLog("Data start pos:%d, lastBit:%d, stop pos:%d, numBits:%d",iii,lastBit,i,bitnum); + //move BitStream back to BinStream + // ClearGraph(0); + for (i=0; i < bitnum; ++i){ + BinStream[i]=BitStream[i]; + } + *bitLen=bitnum; + // RepaintGraphWindow(); + //output + // if (errCnt>0){ + // PrintAndLog("# Errors during Demoding (shown as 77 in bit stream): %d",errCnt); + // } + // PrintAndLog("ASK decoded bitstream:"); + // Now output the bitstream to the scrollback by line of 16 bits + // printBitStream2(BitStream,bitnum); + //int errCnt=0; + //errCnt=manrawdemod(BitStream,bitnum); + + // Em410xDecode(Cmd); + } else return -1; + return errCnt; +} +//translate wave to 11111100000 (1 for each short wave 0 for each long wave) +size_t fsk_wave_demod2(uint8_t * dest, size_t size) +{ + uint32_t last_transition = 0; + uint32_t idx = 1; + uint32_t maxVal=0; + // // we don't care about actual value, only if it's more or less than a + // // threshold essentially we capture zero crossings for later analysis + + // we do care about the actual value as sometimes near the center of the + // wave we may get static that changes direction of wave for one value + // if our value is too low it might affect the read. and if our tag or + // antenna is weak a setting too high might not see anything. [marshmellow] + if (size<100) return 0; + for(idx=1; idx<100; idx++){ + if(maxVal1 transition + if (dest[idx-1] < dest[idx]) { // 0 -> 1 transition + if (idx-last_transition<6){ + //do nothing with extra garbage + } else if (idx-last_transition < 9) { + dest[numBits]=1; + } else { + dest[numBits]=0; + } + last_transition = idx; + numBits++; + } + } + return numBits; //Actually, it returns the number of bytes, but each byte represents a bit: 1 or 0 +} + +uint32_t myround2(float f) +{ + if (f >= 2000) return 2000;//something bad happened + return (uint32_t) (f + (float)0.5); +} + +//translate 11111100000 to 10 +size_t aggregate_bits2(uint8_t *dest,size_t size, uint8_t rfLen, uint8_t maxConsequtiveBits, uint8_t invert )// uint8_t h2l_crossing_value,uint8_t l2h_crossing_value, +{ + uint8_t lastval=dest[0]; + uint32_t idx=0; + size_t numBits=0; + uint32_t n=1; + + for( idx=1; idx < size; idx++) { + + if (dest[idx]==lastval) { + n++; + continue; + } + //if lastval was 1, we have a 1->0 crossing + if ( dest[idx-1]==1 ) { + n=myround2((float)(n+1)/((float)(rfLen)/(float)8)); + //n=(n+1) / h2l_crossing_value; + } else {// 0->1 crossing + n=myround2((float)(n+1)/((float)(rfLen-2)/(float)10)); + //n=(n+1) / l2h_crossing_value; + } + if (n == 0) n = 1; + + if(n < maxConsequtiveBits) //Consecutive + { + if(invert==0){ //invert bits + memset(dest+numBits, dest[idx-1] , n); + }else{ + memset(dest+numBits, dest[idx-1]^1 , n); + } + numBits += n; + } + n=0; + lastval=dest[idx]; + }//end for + return numBits; +} +//by marshmellow (from holiman's base) +// full fsk demod from GraphBuffer wave to decoded 1s and 0s (no mandemod) +int fskdemod(uint8_t *dest, size_t size, uint8_t rfLen, uint8_t invert) +{ + //uint8_t h2l_crossing_value = 6; + //uint8_t l2h_crossing_value = 5; + + // if (rfLen==64) //currently only know settings for RF/64 change from default if option entered + // { + // h2l_crossing_value=8; //or 8 as 64/8 = 8 + // l2h_crossing_value=6; //or 6.4 as 64/10 = 6.4 + // } + // size_t size = GraphTraceLen; + // FSK demodulator + size = fsk_wave_demod2(dest, size); + size = aggregate_bits2(dest, size,rfLen,192,invert); + // size = aggregate_bits(size, h2l_crossing_value, l2h_crossing_value,192, invert); //192=no limit to same values + //done messing with GraphBuffer - repaint + //RepaintGraphWindow(); + return size; +} +// loop to get raw HID waveform then FSK demodulate the TAG ID from it +int HIDdemodFSK(uint8_t *dest, size_t size, uint32_t *hi2, uint32_t *hi, uint32_t *lo) +{ + + size_t idx=0; //, found=0; //size=0, + // FSK demodulator + size = fskdemod(dest, size,50,0); + + // final loop, go over previously decoded manchester data and decode into usable tag ID + // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0 + uint8_t frame_marker_mask[] = {1,1,1,0,0,0}; + int numshifts = 0; + idx = 0; + //one scan + while( idx + sizeof(frame_marker_mask) < size) { + // search for a start of frame marker + if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0) + { // frame marker found + idx+=sizeof(frame_marker_mask); + while(dest[idx] != dest[idx+1] && idx < size-2) + { + // Keep going until next frame marker (or error) + // Shift in a bit. Start by shifting high registers + *hi2 = (*hi2<<1)|(*hi>>31); + *hi = (*hi<<1)|(*lo>>31); + //Then, shift in a 0 or one into low + if (dest[idx] && !dest[idx+1]) // 1 0 + *lo=(*lo<<1)|0; + else // 0 1 + *lo=(*lo<<1)|1; + numshifts++; + idx += 2; + } + // Hopefully, we read a tag and hit upon the next frame marker + if(idx + sizeof(frame_marker_mask) < size) + { + if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0) + { + //good return + return idx; + } + } + // reset + *hi2 = *hi = *lo = 0; + numshifts = 0; + }else { + idx++; + } + } + return -1; +} + +uint32_t bytebits_to_byte(uint8_t* src, int numbits) +{ + uint32_t num = 0; + for(int i = 0 ; i < numbits ; i++) + { + num = (num << 1) | (*src); + src++; + } + return num; +} + +int IOdemodFSK(uint8_t *dest, size_t size) +{ + size_t idx=0; + //make sure buffer has data + if (size < 64) return -1; + //test samples are not just noise + uint8_t testMax=0; + for(idx=0;idx<64;idx++){ + if (testMax170){ + // FSK demodulator + size = fskdemod(dest, size,64,1); + //Index map + //0 10 20 30 40 50 60 + //| | | | | | | + //01234567 8 90123456 7 89012345 6 78901234 5 67890123 4 56789012 3 45678901 23 + //----------------------------------------------------------------------------- + //00000000 0 11110000 1 facility 1 version* 1 code*one 1 code*two 1 ???????? 11 + // + //XSF(version)facility:codeone+codetwo + //Handle the data + uint8_t mask[] = {0,0,0,0,0,0,0,0,0,1}; + for( idx=0; idx < (size - 74); idx++) { + if ( memcmp(dest + idx, mask, sizeof(mask))==0) { + //frame marker found + if (!dest[idx+8] && dest[idx+17]==1 && dest[idx+26]==1 && dest[idx+35]==1 && dest[idx+44]==1 && dest[idx+53]==1){ + //confirmed proper separator bits found + //return start position + return idx; + } + } + } + } + return 0; +} + +// by marshmellow +// not perfect especially with lower clocks or VERY good antennas (heavy wave clipping) +// maybe somehow adjust peak trimming value based on samples to fix? +int DetectClock2(uint8_t dest[], size_t size, int clock) +{ + int i=0; + int peak=0; + int low=0; + int clk[]={16,32,40,50,64,100,128,256}; + for (;i<8;++i) + if (clk[i]==clock) return clock; + if (!peak){ + for (i=0;ipeak){ + peak = dest[i]; + } + if(dest[i]=peak) || (dest[ii]<=low)){ + errCnt[clkCnt]=0; + for (i=0; i<((int)(size/clk[clkCnt])-1); ++i){ + if (dest[ii+(i*clk[clkCnt])]>=peak || dest[ii+(i*clk[clkCnt])]<=low){ + }else if(dest[ii+(i*clk[clkCnt])-tol]>=peak || dest[ii+(i*clk[clkCnt])-tol]<=low){ + }else if(dest[ii+(i*clk[clkCnt])+tol]>=peak || dest[ii+(i*clk[clkCnt])+tol]<=low){ + }else{ //error no peak detected + errCnt[clkCnt]++; + } + } + if(errCnt[clkCnt]==0) return clk[clkCnt]; + if(errCnt[clkCnt] + +int DetectClock2(uint8_t dest[], size_t size, int clock); +int askmandemod(uint8_t *BinStream,uint32_t *BitLen,int *clk, int *invert); +uint64_t Em410xDecode(uint8_t BitStream[],uint32_t BitLen); +int manrawdemod(uint8_t *BitStream, int *bitLen); +int askrawdemod(uint8_t *BinStream, int *bitLen,int *clk, int *invert); +int HIDdemodFSK(uint8_t *dest, size_t size, uint32_t *hi2, uint32_t *hi, uint32_t *lo); +int IOdemodFSK(uint8_t *dest, size_t size); +int fskdemod(uint8_t *dest, size_t size, uint8_t rfLen, uint8_t invert); +uint32_t bytebits_to_byte(uint8_t* src, int numbits); + +// +#define MAX_BitStream_LEN (1024*128) +//extern int BitStreamLen; + +#endif