From e98300f2455f72b64df737b3a81c072b6b3761e3 Mon Sep 17 00:00:00 2001
From: "cex123@gmail.com"
<cex123@gmail.com@ef4ab9da-24cd-11de-8aaa-f3a34680c41f>
Date: Wed, 16 Jan 2013 10:42:29 +0000
Subject: [PATCH] Added block command for T55xx and support for cloning HID
long format
---
armsrc/appmain.c | 13 +-
armsrc/apps.h | 5 +-
armsrc/lfops.c | 331 ++++++++++++++++++++++++++++++++++++--------
client/Makefile | 3 +-
client/cmdhfmf.c | 16 +--
client/cmdlf.c | 2 +
client/cmdlf.h | 1 +
client/cmdlfhid.c | 39 ++++--
client/cmdlft55xx.c | 151 ++++++++++++++++++++
client/cmdlft55xx.h | 21 +++
include/usb_cmd.h | 3 +
11 files changed, 504 insertions(+), 81 deletions(-)
create mode 100644 client/cmdlft55xx.c
create mode 100644 client/cmdlft55xx.h
diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index dac87677..1f005716 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -631,8 +631,8 @@ void UsbPacketReceived(uint8_t *packet, int len)
case CMD_HID_SIM_TAG:
CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID
break;
- case CMD_HID_CLONE_TAG:
- CopyHIDtoT55x7(c->arg[0], c->arg[1]); // Clone HID tag by ID to T55x7
+ case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
+ CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
break;
case CMD_EM410X_WRITE_TAG:
WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
@@ -657,6 +657,15 @@ void UsbPacketReceived(uint8_t *packet, int len)
case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7
CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
break;
+ case CMD_T55XX_READ_BLOCK:
+ T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
+ break;
+ case CMD_T55XX_WRITE_BLOCK:
+ T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
+ break;
+ case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
+ T55xxReadTrace();
+ break;
#endif
#ifdef WITH_HITAG
diff --git a/armsrc/apps.h b/armsrc/apps.h
index f3f90237..93b59306 100644
--- a/armsrc/apps.h
+++ b/armsrc/apps.h
@@ -117,10 +117,13 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol);
void CmdHIDsimTAG(int hi, int lo, int ledcontrol);
void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol);
void SimulateTagLowFrequencyBidir(int divisor, int max_bitlen);
-void CopyHIDtoT55x7(int hi, int lo); // Clone an HID card to T5557/T5567
+void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT); // Clone an HID card to T5557/T5567
void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo);
void CopyIndala64toT55x7(int hi, int lo); // Clone Indala 64-bit tag by UID to T55x7
void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int uid6, int uid7); // Clone Indala 224-bit tag by UID to T55x7
+void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode);
+void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode );
+void T55xxReadTrace(void);
/// iso14443.h
void SimulateIso14443Tag(void);
diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 1b5f220e..0eb3503d 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -598,7 +598,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
{
uint8_t *dest = (uint8_t *)BigBuf;
int m=0, n=0, i=0, idx=0, found=0, lastval=0;
- uint32_t hi=0, lo=0;
+ uint32_t hi2=0, hi=0, lo=0;
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
@@ -735,9 +735,15 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
{
found=1;
idx+=6;
- if (found && (hi|lo)) {
- Dbprintf("TAG ID: %x%08x (%d)",
- (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ if (found && (hi2|hi|lo)) {
+ if (hi2 != 0){
+ Dbprintf("TAG ID: %x%08x%08x (%d)",
+ (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ }
+ else {
+ Dbprintf("TAG ID: %x%08x (%d)",
+ (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ }
/* if we're only looking for one tag */
if (findone)
{
@@ -745,6 +751,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
*low = lo;
return;
}
+ hi2=0;
hi=0;
lo=0;
found=0;
@@ -752,13 +759,16 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
}
if (found) {
if (dest[idx] && (!dest[idx+1]) ) {
+ hi2=(hi2<<1)|(hi>>31);
hi=(hi<<1)|(lo>>31);
lo=(lo<<1)|0;
} else if ( (!dest[idx]) && dest[idx+1]) {
+ hi2=(hi2<<1)|(hi>>31);
hi=(hi<<1)|(lo>>31);
lo=(lo<<1)|1;
} else {
found=0;
+ hi2=0;
hi=0;
lo=0;
}
@@ -769,8 +779,14 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
found=1;
idx+=6;
if (found && (hi|lo)) {
- Dbprintf("TAG ID: %x%08x (%d)",
- (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ if (hi2 != 0){
+ Dbprintf("TAG ID: %x%08x%08x (%d)",
+ (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ }
+ else {
+ Dbprintf("TAG ID: %x%08x (%d)",
+ (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ }
/* if we're only looking for one tag */
if (findone)
{
@@ -778,6 +794,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
*low = lo;
return;
}
+ hi2=0;
hi=0;
lo=0;
found=0;
@@ -788,6 +805,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
}
}
+
/*------------------------------
* T5555/T5557/T5567 routines
*------------------------------
@@ -866,7 +884,7 @@ void T55xxWriteBit(int bit)
}
// Write one card block in page 0, no lock
-void T55xxWriteBlock(int Data, int Block)
+void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
{
unsigned int i;
@@ -884,6 +902,11 @@ void T55xxWriteBlock(int Data, int Block)
// Opcode
T55xxWriteBit(1);
T55xxWriteBit(0); //Page 0
+ if (PwdMode == 1){
+ // Pwd
+ for (i = 0x80000000; i != 0; i >>= 1)
+ T55xxWriteBit(Pwd & i);
+ }
// Lock bit
T55xxWriteBit(0);
@@ -891,7 +914,7 @@ void T55xxWriteBlock(int Data, int Block)
for (i = 0x80000000; i != 0; i >>= 1)
T55xxWriteBit(Data & i);
- // Page
+ // Block
for (i = 0x04; i != 0; i >>= 1)
T55xxWriteBit(Block & i);
@@ -903,55 +926,243 @@ void T55xxWriteBlock(int Data, int Block)
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
}
-// Copy HID id to card and setup block 0 config
-void CopyHIDtoT55x7(int hi, int lo)
+
+// Read one card block in page 0
+void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
{
- int data1, data2, data3;
+ uint8_t *dest = (uint8_t *)BigBuf;
+ int m=0, i=0;
+
+ m = sizeof(BigBuf);
+ // Clear destination buffer before sending the command
+ memset(dest, 128, m);
+ // Connect the A/D to the peak-detected low-frequency path.
+ SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
+ // Now set up the SSC to get the ADC samples that are now streaming at us.
+ FpgaSetupSsc();
- // Ensure no more than 44 bits supplied
- if (hi>0xFFF) {
- DbpString("Tags can only have 44 bits.");
- return;
- }
+ LED_D_ON();
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
- // Build the 3 data blocks for supplied 44bit ID
- data1 = 0x1D000000; // load preamble
+ // Give it a bit of time for the resonant antenna to settle.
+ // And for the tag to fully power up
+ SpinDelay(150);
- for (int i=0;i<12;i++) {
- if (hi & (1<<(11-i)))
- data1 |= (1<<(((11-i)*2)+1)); // 1 -> 10
- else
- data1 |= (1<<((11-i)*2)); // 0 -> 01
- }
+ // Now start writting
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelayUs(START_GAP);
- data2 = 0;
- for (int i=0;i<16;i++) {
- if (lo & (1<<(31-i)))
- data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
- else
- data2 |= (1<<((15-i)*2)); // 0 -> 01
+ // Opcode
+ T55xxWriteBit(1);
+ T55xxWriteBit(0); //Page 0
+ if (PwdMode == 1){
+ // Pwd
+ for (i = 0x80000000; i != 0; i >>= 1)
+ T55xxWriteBit(Pwd & i);
+ }
+ // Lock bit
+ T55xxWriteBit(0);
+ // Block
+ for (i = 0x04; i != 0; i >>= 1)
+ T55xxWriteBit(Block & i);
+
+ // Turn field on to read the response
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+
+ // Now do the acquisition
+ i = 0;
+ for(;;) {
+ if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
+ AT91C_BASE_SSC->SSC_THR = 0x43;
+ }
+ if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
+ dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+ // we don't care about actual value, only if it's more or less than a
+ // threshold essentially we capture zero crossings for later analysis
+// if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
+ i++;
+ if (i >= m) break;
+ }
}
- data3 = 0;
- for (int i=0;i<16;i++) {
- if (lo & (1<<(15-i)))
- data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
- else
- data3 |= (1<<((15-i)*2)); // 0 -> 01
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
+ LED_D_OFF();
+ DbpString("DONE!");
+}
+
+// Read card traceability data (page 1)
+void T55xxReadTrace(void){
+ uint8_t *dest = (uint8_t *)BigBuf;
+ int m=0, i=0;
+
+ m = sizeof(BigBuf);
+ // Clear destination buffer before sending the command
+ memset(dest, 128, m);
+ // Connect the A/D to the peak-detected low-frequency path.
+ SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
+ // Now set up the SSC to get the ADC samples that are now streaming at us.
+ FpgaSetupSsc();
+
+ LED_D_ON();
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+
+ // Give it a bit of time for the resonant antenna to settle.
+ // And for the tag to fully power up
+ SpinDelay(150);
+
+ // Now start writting
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelayUs(START_GAP);
+
+ // Opcode
+ T55xxWriteBit(1);
+ T55xxWriteBit(1); //Page 1
+
+ // Turn field on to read the response
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+
+ // Now do the acquisition
+ i = 0;
+ for(;;) {
+ if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
+ AT91C_BASE_SSC->SSC_THR = 0x43;
+ }
+ if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
+ dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+ i++;
+ if (i >= m) break;
+ }
}
- // Program the 3 data blocks for supplied 44bit ID
- // and the block 0 for HID format
- T55xxWriteBlock(data1,1);
- T55xxWriteBlock(data2,2);
- T55xxWriteBlock(data3,3);
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
+ LED_D_OFF();
+ DbpString("DONE!");
+}
- // Config for HID (RF/50, FSK2a, Maxblock=3)
+/*-------------- Cloning routines -----------*/
+// Copy HID id to card and setup block 0 config
+void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT)
+{
+ int data1, data2, data3, data4, data5, data6; //up to six blocks for long format
+ int last_block = 0;
+
+ if (longFMT){
+ // Ensure no more than 84 bits supplied
+ if (hi2>0xFFFFF) {
+ DbpString("Tags can only have 84 bits.");
+ return;
+ }
+ // Build the 6 data blocks for supplied 84bit ID
+ last_block = 6;
+ data1 = 0x1D96A900; // load preamble (1D) & long format identifier (9E manchester encoded)
+ for (int i=0;i<4;i++) {
+ if (hi2 & (1<<(19-i)))
+ data1 |= (1<<(((3-i)*2)+1)); // 1 -> 10
+ else
+ data1 |= (1<<((3-i)*2)); // 0 -> 01
+ }
+
+ data2 = 0;
+ for (int i=0;i<16;i++) {
+ if (hi2 & (1<<(15-i)))
+ data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else
+ data2 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+
+ data3 = 0;
+ for (int i=0;i<16;i++) {
+ if (hi & (1<<(31-i)))
+ data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else
+ data3 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+
+ data4 = 0;
+ for (int i=0;i<16;i++) {
+ if (hi & (1<<(15-i)))
+ data4 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else
+ data4 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+
+ data5 = 0;
+ for (int i=0;i<16;i++) {
+ if (lo & (1<<(31-i)))
+ data5 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else
+ data5 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+
+ data6 = 0;
+ for (int i=0;i<16;i++) {
+ if (lo & (1<<(15-i)))
+ data6 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else
+ data6 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+ }
+ else {
+ // Ensure no more than 44 bits supplied
+ if (hi>0xFFF) {
+ DbpString("Tags can only have 44 bits.");
+ return;
+ }
+
+ // Build the 3 data blocks for supplied 44bit ID
+ last_block = 3;
+
+ data1 = 0x1D000000; // load preamble
+
+ for (int i=0;i<12;i++) {
+ if (hi & (1<<(12-i)))
+ data1 |= (1<<(((12-i)*2)+1)); // 1 -> 10
+ else
+ data1 |= (1<<((12-i)*2)); // 0 -> 01
+ }
+
+ data2 = 0;
+ for (int i=0;i<16;i++) {
+ if (lo & (1<<(31-i)))
+ data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else
+ data2 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+
+ data3 = 0;
+ for (int i=0;i<16;i++) {
+ if (lo & (1<<(15-i)))
+ data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+ else
+ data3 |= (1<<((15-i)*2)); // 0 -> 01
+ }
+ }
+
+ LED_D_ON();
+ // Program the data blocks for supplied ID
+ // and the block 0 for HID format
+ T55xxWriteBlock(data1,1,0,0);
+ T55xxWriteBlock(data2,2,0,0);
+ T55xxWriteBlock(data3,3,0,0);
+
+ if (longFMT) { // if long format there are 6 blocks
+ T55xxWriteBlock(data4,4,0,0);
+ T55xxWriteBlock(data5,5,0,0);
+ T55xxWriteBlock(data6,6,0,0);
+ }
+
+ // Config for HID (RF/50, FSK2a, Maxblock=3 for short/6 for long)
T55xxWriteBlock(T55x7_BITRATE_RF_50 |
T55x7_MODULATION_FSK2a |
- 3 << T55x7_MAXBLOCK_SHIFT,
- 0);
-
+ last_block << T55x7_MAXBLOCK_SHIFT,
+ 0,0,0);
+
+ LED_D_OFF();
+
DbpString("DONE!");
}
@@ -1019,8 +1230,8 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
LED_D_ON();
// Write EM410x ID
- T55xxWriteBlock((uint32_t)(id >> 32), 1);
- T55xxWriteBlock((uint32_t)id, 2);
+ T55xxWriteBlock((uint32_t)(id >> 32), 1, 0, 0);
+ T55xxWriteBlock((uint32_t)id, 2, 0, 0);
// Config for EM410x (RF/64, Manchester, Maxblock=2)
if (card)
@@ -1028,13 +1239,13 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
T55xxWriteBlock(T55x7_BITRATE_RF_64 |
T55x7_MODULATION_MANCHESTER |
2 << T55x7_MAXBLOCK_SHIFT,
- 0);
+ 0, 0, 0);
else
// Writing configuration for T5555(Q5) tag
T55xxWriteBlock(0x1F << T5555_BITRATE_SHIFT |
T5555_MODULATION_MANCHESTER |
2 << T5555_MAXBLOCK_SHIFT,
- 0);
+ 0, 0, 0);
LED_D_OFF();
Dbprintf("Tag %s written with 0x%08x%08x\n", card ? "T55x7":"T5555",
@@ -1047,13 +1258,13 @@ void CopyIndala64toT55x7(int hi, int lo)
//Program the 2 data blocks for supplied 64bit UID
// and the block 0 for Indala64 format
- T55xxWriteBlock(hi,1);
- T55xxWriteBlock(lo,2);
+ T55xxWriteBlock(hi,1,0,0);
+ T55xxWriteBlock(lo,2,0,0);
//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=2)
T55xxWriteBlock(T55x7_BITRATE_RF_32 |
T55x7_MODULATION_PSK1 |
2 << T55x7_MAXBLOCK_SHIFT,
- 0);
+ 0,0,0);
//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
// T5567WriteBlock(0x603E1042,0);
@@ -1066,18 +1277,18 @@ void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int
//Program the 7 data blocks for supplied 224bit UID
// and the block 0 for Indala224 format
- T55xxWriteBlock(uid1,1);
- T55xxWriteBlock(uid2,2);
- T55xxWriteBlock(uid3,3);
- T55xxWriteBlock(uid4,4);
- T55xxWriteBlock(uid5,5);
- T55xxWriteBlock(uid6,6);
- T55xxWriteBlock(uid7,7);
+ T55xxWriteBlock(uid1,1,0,0);
+ T55xxWriteBlock(uid2,2,0,0);
+ T55xxWriteBlock(uid3,3,0,0);
+ T55xxWriteBlock(uid4,4,0,0);
+ T55xxWriteBlock(uid5,5,0,0);
+ T55xxWriteBlock(uid6,6,0,0);
+ T55xxWriteBlock(uid7,7,0,0);
//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
T55xxWriteBlock(T55x7_BITRATE_RF_32 |
T55x7_MODULATION_PSK1 |
7 << T55x7_MAXBLOCK_SHIFT,
- 0);
+ 0,0,0);
//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
// T5567WriteBlock(0x603E10E2,0);
diff --git a/client/Makefile b/client/Makefile
index 9a9d3228..597f562e 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -67,7 +67,8 @@ CMDSRCS = \
cmdlfhitag.c \
cmdlfti.c \
cmdparser.c \
- cmdmain.c
+ cmdmain.c \
+ cmdlft55xx.c
CMDOBJS = $(CMDSRCS:%.c=$(OBJDIR)/%.o)
diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index dff5db37..abb6f59f 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -77,13 +77,13 @@ start:
PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt);
} else {
printf("------------------------------------------------------------------\n");
- PrintAndLog("Key found:%012llx \n", r_key);
+ PrintAndLog("Key found:%012I64x \n", r_key);
num_to_bytes(r_key, 6, keyBlock);
isOK = mfCheckKeys(0, 0, 1, keyBlock, &r_key);
}
if (!isOK)
- PrintAndLog("Found valid key:%012llx", r_key);
+ PrintAndLog("Found valid key:%012I64x", r_key);
else
{
if (isOK != 2) PrintAndLog("Found invalid key. ( Nt=%08x ,Trying use it to run again...", nt);
@@ -575,7 +575,7 @@ int CmdHF14AMfNested(const char *Cmd)
if (res)
res = mfCheckKeys(trgBlockNo, trgKeyType, 8, &keyBlock[6 * 8], &key64);
if (!res) {
- PrintAndLog("Found valid key:%012llx", key64);
+ PrintAndLog("Found valid key:%012I64x", key64);
// transfer key to the emulator
if (transferToEml) {
@@ -635,7 +635,7 @@ int CmdHF14AMfNested(const char *Cmd)
if (res)
res = mfCheckKeys(trgBlockNo, trgKeyType, 8, &keyBlock[6 * 8], &key64);
if (!res) {
- PrintAndLog("Found valid key:%012llx", key64);
+ PrintAndLog("Found valid key:%012I64x", key64);
e_sector[trgBlockNo / 4].foundKey[trgKeyType] = 1;
e_sector[trgBlockNo / 4].Key[trgKeyType] = key64;
}
@@ -648,7 +648,7 @@ int CmdHF14AMfNested(const char *Cmd)
PrintAndLog("|sec|key A |res|key B |res|");
PrintAndLog("|---|----------------|---|----------------|---|");
for (i = 0; i < SectorsCnt; i++) {
- PrintAndLog("|%03d| %012llx | %d | %012llx | %d |", i,
+ PrintAndLog("|%03d| %012I64x | %d | %012I64x | %d |", i,
e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]);
}
PrintAndLog("|---|----------------|---|----------------|---|");
@@ -845,7 +845,7 @@ int CmdHF14AMfChk(const char *Cmd)
}
memset(keyBlock + 6 * keycnt, 0, 6);
num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6*keycnt);
- PrintAndLog("chk custom key[%d] %012llx", keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
+ PrintAndLog("chk custom key[%d] %012I64x", keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
keycnt++;
}
} else {
@@ -875,7 +875,7 @@ int CmdHF14AMfChk(const char *Cmd)
res = mfCheckKeys(b, t, size, keyBlock +6*c, &key64);
if (res !=1) {
if (!res) {
- PrintAndLog("Found valid key:[%012llx]",key64);
+ PrintAndLog("Found valid key:[%012I64x]",key64);
if (transferToEml) {
uint8_t block[16];
mfEmlGetMem(block, get_trailer_block(b), 1);
@@ -1207,7 +1207,7 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
}
keyA = bytes_to_num(data, 6);
keyB = bytes_to_num(data + 10, 6);
- PrintAndLog("|%03d| %012llx | %012llx |", i, keyA, keyB);
+ PrintAndLog("|%03d| %012I64x | %012I64x |", i, keyA, keyB);
}
PrintAndLog("|---|----------------|----------------|");
diff --git a/client/cmdlf.c b/client/cmdlf.c
index 78e1f988..f3a3f52a 100644
--- a/client/cmdlf.c
+++ b/client/cmdlf.c
@@ -24,6 +24,7 @@
#include "cmdlfti.h"
#include "cmdlfem4x.h"
#include "cmdlfhitag.h"
+#include "cmdlft55xx.h"
static int CmdHelp(const char *Cmd);
@@ -538,6 +539,7 @@ static command_t CommandTable[] =
{"ti", CmdLFTI, 1, "{ TI RFIDs... }"},
{"hitag", CmdLFHitag, 1, "{ Hitag tags and transponders... }"},
{"vchdemod", CmdVchDemod, 1, "['clone'] -- Demodulate samples for VeriChip"},
+ {"t55xx", CmdLFT55XX, 1, "{ T55xx RFIDs... }"},
{NULL, NULL, 0, NULL}
};
diff --git a/client/cmdlf.h b/client/cmdlf.h
index e1f15d2c..471e4e0c 100644
--- a/client/cmdlf.h
+++ b/client/cmdlf.h
@@ -16,6 +16,7 @@ int CmdLF(const char *Cmd);
int CmdLFCommandRead(const char *Cmd);
int CmdFlexdemod(const char *Cmd);
int CmdIndalaDemod(const char *Cmd);
+int CmdIndalaClone(const char *Cmd);
int CmdLFRead(const char *Cmd);
int CmdLFSim(const char *Cmd);
int CmdLFSimBidir(const char *Cmd);
diff --git a/client/cmdlfhid.c b/client/cmdlfhid.c
index 767ea3cc..e7fc88e1 100644
--- a/client/cmdlfhid.c
+++ b/client/cmdlfhid.c
@@ -62,17 +62,38 @@ int CmdHIDSim(const char *Cmd)
int CmdHIDClone(const char *Cmd)
{
- unsigned int hi = 0, lo = 0;
+ unsigned int hi2 = 0, hi = 0, lo = 0;
int n = 0, i = 0;
+ UsbCommand c;
- while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
- hi = (hi << 4) | (lo >> 28);
- lo = (lo << 4) | (n & 0xf);
+ if (strchr(Cmd,'l') != 0) {
+ while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
+ hi2 = (hi2 << 4) | (hi >> 28);
+ hi = (hi << 4) | (lo >> 28);
+ lo = (lo << 4) | (n & 0xf);
+ }
+
+ PrintAndLog("Cloning tag with long ID %x%08x%08x", hi2, hi, lo);
+
+ c.d.asBytes[0] = 1;
+ }
+ else {
+ while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
+ hi = (hi << 4) | (lo >> 28);
+ lo = (lo << 4) | (n & 0xf);
+ }
+
+ PrintAndLog("Cloning tag with ID %x%08x", hi, lo);
+
+ hi2 = 0;
+ c.d.asBytes[0] = 0;
}
- PrintAndLog("Cloning tag with ID %x%08x", hi, lo);
+ c.cmd = CMD_HID_CLONE_TAG;
+ c.arg[0] = hi2;
+ c.arg[1] = hi;
+ c.arg[2] = lo;
- UsbCommand c = {CMD_HID_CLONE_TAG, {hi, lo}};
SendCommand(&c);
return 0;
}
@@ -81,9 +102,9 @@ static command_t CommandTable[] =
{
{"help", CmdHelp, 1, "This help"},
{"demod", CmdHIDDemod, 1, "Demodulate HID Prox Card II (not optimal)"},
- {"fskdemod", CmdHIDDemodFSK, 0, "Realtime HID FSK demodulator"},
- {"sim", CmdHIDSim, 0, "<ID> -- HID tag simulator"},
- {"clone", CmdHIDClone, 0, "<ID> -- Clone HID to T55x7 (tag must be in antenna)"},
+ {"fskdemod", CmdHIDDemodFSK, 1, "Realtime HID FSK demodulator"},
+ {"sim", CmdHIDSim, 1, "<ID> -- HID tag simulator"},
+ {"clone", CmdHIDClone, 1, "<ID> ['l'] -- Clone HID to T55x7 (tag must be in antenna)(option 'l' for 84bit ID)"},
{NULL, NULL, 0, NULL}
};
diff --git a/client/cmdlft55xx.c b/client/cmdlft55xx.c
new file mode 100644
index 00000000..1fac5014
--- /dev/null
+++ b/client/cmdlft55xx.c
@@ -0,0 +1,151 @@
+//-----------------------------------------------------------------------------
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// Low frequency T55xx commands
+//-----------------------------------------------------------------------------
+
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#include "proxusb.h"
+#include "ui.h"
+#include "graph.h"
+#include "cmdparser.h"
+#include "cmddata.h"
+#include "cmdlf.h"
+#include "cmdlft55xx.h"
+
+static int CmdHelp(const char *Cmd);
+
+
+int CmdReadBlk(const char *Cmd)
+{
+ int Block = 8; //default to invalid block
+ UsbCommand c;
+
+ sscanf(Cmd, "%d", &Block);
+
+ if (Block > 7) {
+ PrintAndLog("Block must be between 0 and 7");
+ return 1;
+ }
+
+ PrintAndLog("Reading block %d", Block);
+
+ c.cmd = CMD_T55XX_READ_BLOCK;
+ c.d.asBytes[0] = 0x0; //Normal mode
+ c.arg[0] = 0;
+ c.arg[1] = Block;
+ c.arg[2] = 0;
+ SendCommand(&c);
+ return 0;
+}
+
+int CmdReadBlkPWD(const char *Cmd)
+{
+ int Block = 8; //default to invalid block
+ int Password = 0xFFFFFFFF; //default to blank Block 7
+ UsbCommand c;
+
+ sscanf(Cmd, "%d %x", &Block, &Password);
+
+ if (Block > 7) {
+ PrintAndLog("Block must be between 0 and 7");
+ return 1;
+ }
+
+ PrintAndLog("Reading block %d with password %08X", Block, Password);
+
+ c.cmd = CMD_T55XX_READ_BLOCK;
+ c.d.asBytes[0] = 0x1; //Password mode
+ c.arg[0] = 0;
+ c.arg[1] = Block;
+ c.arg[2] = Password;
+ SendCommand(&c);
+ return 0;
+}
+
+int CmdWriteBlk(const char *Cmd)
+{
+ int Block = 8; //default to invalid block
+ int Data = 0xFFFFFFFF; //default to blank Block
+ UsbCommand c;
+
+ sscanf(Cmd, "%x %d", &Data, &Block);
+
+ if (Block > 7) {
+ PrintAndLog("Block must be between 0 and 7");
+ return 1;
+ }
+
+ PrintAndLog("Writting block %d with data %08X", Block, Data);
+
+ c.cmd = CMD_T55XX_WRITE_BLOCK;
+ c.d.asBytes[0] = 0x0; //Normal mode
+ c.arg[0] = Data;
+ c.arg[1] = Block;
+ c.arg[2] = 0;
+ SendCommand(&c);
+ return 0;
+}
+
+int CmdWriteBlkPWD(const char *Cmd)
+{
+ int Block = 8; //default to invalid block
+ int Data = 0xFFFFFFFF; //default to blank Block
+ int Password = 0xFFFFFFFF; //default to blank Block 7
+ UsbCommand c;
+
+ sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
+
+ if (Block > 7) {
+ PrintAndLog("Block must be between 0 and 7");
+ return 1;
+ }
+
+ PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
+
+ c.cmd = CMD_T55XX_WRITE_BLOCK;
+ c.d.asBytes[0] = 0x1; //Password mode
+ c.arg[0] = Data;
+ c.arg[1] = Block;
+ c.arg[2] = Password;
+ SendCommand(&c);
+ return 0;
+}
+
+int CmdReadTrace(const char *Cmd)
+{
+
+ PrintAndLog("Reading traceability data");
+
+ UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
+ SendCommand(&c);
+ return 0;
+}
+
+static command_t CommandTable[] =
+{
+ {"help", CmdHelp, 1, "This help"},
+ {"readblock", CmdReadBlk, 1, "<Block> -- Read T55xx block data (page 0)"},
+ {"readblockPWD", CmdReadBlkPWD, 1, "<Block> <Password> -- Read T55xx block data in password mode(page 0)"},
+ {"writeblock", CmdWriteBlk, 1, "<Data> <Block> -- Write T55xx block data (page 0)"},
+ {"writeblockPWD", CmdWriteBlkPWD, 1, "<Data> <Block> <Password> -- Write T55xx block data in password mode(page 0)"},
+ {"readtrace", CmdReadTrace, 1, "Read T55xx traceability data (page 1)"},
+ {NULL, NULL, 0, NULL}
+};
+
+int CmdLFT55XX(const char *Cmd)
+{
+ CmdsParse(CommandTable, Cmd);
+ return 0;
+}
+
+int CmdHelp(const char *Cmd)
+{
+ CmdsHelp(CommandTable);
+ return 0;
+}
diff --git a/client/cmdlft55xx.h b/client/cmdlft55xx.h
new file mode 100644
index 00000000..25503e87
--- /dev/null
+++ b/client/cmdlft55xx.h
@@ -0,0 +1,21 @@
+//-----------------------------------------------------------------------------
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// Low frequency T55xx commands
+//-----------------------------------------------------------------------------
+
+#ifndef CMDLFT55XX_H__
+#define CMDLFT55XX_H__
+
+int CmdLFT55XX(const char *Cmd);
+
+int CmdReadBlk(const char *Cmd);
+int CmdReadBlkPWD(const char *Cmd);
+int CmdWriteBlk(const char *Cmd);
+int CmdWriteBLkPWD(const char *Cmd);
+int CmdReadTrace(const char *Cmd);
+
+#endif
diff --git a/include/usb_cmd.h b/include/usb_cmd.h
index a7552b3e..507519ec 100644
--- a/include/usb_cmd.h
+++ b/include/usb_cmd.h
@@ -71,6 +71,9 @@ typedef struct {
#define CMD_INDALA_CLONE_TAG 0x0212
// for 224 bits UID
#define CMD_INDALA_CLONE_TAG_L 0x0213
+#define CMD_T55XX_READ_BLOCK 0x0214
+#define CMD_T55XX_WRITE_BLOCK 0x0215
+#define CMD_T55XX_READ_TRACE 0x0216
/* CMD_SET_ADC_MUX: ext1 is 0 for lopkd, 1 for loraw, 2 for hipkd, 3 for hiraw */
--
2.39.5