RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2024-12-28 19:31:19 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'master' of https://github.com/Proxmark/proxmark3

Browse source 
Conflicts:
	client/cmddata.c
	client/cmddata.h
This commit is contained in:
iceman1001 2015-03-10 09:18:35 +01:00
commit 12d708fec1
16 changed files with 911 additions and 103 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
armsrc/appmain.c
View file

@ -661,6 +661,15 @@ void UsbPacketReceived(uint8_t *packet, int len)
case CMD_HID_SIM_TAG:
CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
break;
case CMD_FSK_SIM_TAG:
CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
break;
case CMD_ASK_SIM_TAG:
CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
break;
case CMD_PSK_SIM_TAG:
CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
break;
case CMD_HID_CLONE_TAG:
CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
break;

3
armsrc/apps.h
View file

@ -122,6 +122,9 @@ void SimulateTagLowFrequency( uint16_t period, uint32_t gap, uint8_t ledcontrol)
//void SimulateTagLowFrequencyA(int period, int gap);
void CmdHIDsimTAG(int hi, int lo, int ledcontrol);
void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream);
void CmdASKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream);
void CmdPSKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream);
void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol);
void CmdEM410xdemod(int findone, int *high, int *low, int ledcontrol);
void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol);

19
armsrc/iso14443a.c
View file

@ -2301,8 +2301,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
}
if(cardSTATE == MFEMUL_NOFIELD) continue;
//Now, get data
res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
if (res == 2) { //Field is off!
cardSTATE = MFEMUL_NOFIELD;
@ -2373,7 +2371,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
//Collect AR/NR
if(ar_nr_collected < 2){
if(ar_nr_collected < 2 && cardAUTHSC == 2){
if(ar_nr_responses[2] != ar)
{// Avoid duplicates... probably not necessary, ar should vary.
ar_nr_responses[ar_nr_collected*4] = cuid;
@ -2381,6 +2379,11 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
ar_nr_responses[ar_nr_collected*4+2] = ar;
ar_nr_responses[ar_nr_collected*4+3] = nr;
ar_nr_collected++;
}
// Interactive mode flag, means we need to send ACK
if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
{
finished = true;
}
}
@ -2528,7 +2531,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
mf_crypto1_encrypt(pcs, response, 18, response_par);
EmSendCmdPar(response, 18, response_par);
numReads++;
if(exitAfterNReads > 0 && numReads == exitAfterNReads) {
if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
Dbprintf("%d reads done, exiting", numReads);
finished = true;
}
@ -2648,12 +2651,12 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
{
//May just aswell send the collected ar_nr in the response aswell
cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,0,0,&ar_nr_responses,ar_nr_collected*4*4);
cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,1,0,&ar_nr_responses,ar_nr_collected*4*4);
}
if(flags & FLAG_NR_AR_ATTACK)
if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
{
if(ar_nr_collected > 1) {
if(ar_nr_collected > 1 ) {
Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
ar_nr_responses[0], // UID
@ -2665,7 +2668,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
);
} else {
Dbprintf("Failed to obtain two AR/NR pairs!");
if(ar_nr_collected >0) {
if(ar_nr_collected > 0 ) {
Dbprintf("Only got these: UID=%08x, nonce=%08x, AR1=%08x, NR1=%08x",
ar_nr_responses[0], // UID
ar_nr_responses[1], //NT

213
armsrc/lfops.c
View file

@ -392,11 +392,12 @@ void SimulateTagLowFrequency(uint16_t period, uint32_t gap, uint8_t ledcontrol)
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
#define SHORT_COIL() LOW(GPIO_SSC_DOUT)
#define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
#define SHORT_COIL() LOW(GPIO_SSC_DOUT)
#define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
i = 0;
for(;;) {
//wait until SSC_CLK goes HIGH
while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
if(BUTTON_PRESS()) {
DbpString("Stopped");
@ -404,7 +405,6 @@ void SimulateTagLowFrequency(uint16_t period, uint32_t gap, uint8_t ledcontrol)
}
WDT_HIT();
}
if (ledcontrol)
LED_D_ON();
@ -415,17 +415,18 @@ void SimulateTagLowFrequency(uint16_t period, uint32_t gap, uint8_t ledcontrol)
if (ledcontrol)
LED_D_OFF();
//wait until SSC_CLK goes LOW
while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
if(BUTTON_PRESS()) {
DbpString("Stopped");
return;
}
WDT_HIT();
}
}
i++;
if(i == period) {
i = 0;
if (gap) {
SHORT_COIL();
@ -440,8 +441,9 @@ void SimulateTagLowFrequencyBidir(int divisor, int t0)
{
}
// compose fc/8 fc/10 waveform
static void fc(int c, int *n) {
// compose fc/8 fc/10 waveform (FSK2)
static void fc(int c, int *n)
{
uint8_t *dest = BigBuf_get_addr();
int idx;
@ -449,20 +451,21 @@ static void fc(int c, int *n) {
if(c==0) {
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
}
// an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
// an fc/8 encoded bit is a bit pattern of 11110000 x6 = 48 samples
if(c==8) {
for (idx=0; idx<6; idx++) {
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
@ -470,14 +473,14 @@ static void fc(int c, int *n) {
}
}
// an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
// an fc/10 encoded bit is a bit pattern of 1111100000 x5 = 50 samples
if(c==10) {
for (idx=0; idx<5; idx++) {
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
@ -486,6 +489,36 @@ static void fc(int c, int *n) {
}
}
}
// compose fc/X fc/Y waveform (FSKx)
static void fcAll(uint8_t fc, int *n, uint8_t clock, uint16_t *modCnt)
{
uint8_t *dest = BigBuf_get_addr();
uint8_t halfFC = fc/2;
uint8_t wavesPerClock = clock/fc;
uint8_t mod = clock % fc; //modifier
uint8_t modAdj = fc/mod; //how often to apply modifier
bool modAdjOk = !(fc % mod); //if (fc % mod==0) modAdjOk=TRUE;
// loop through clock - step field clock
for (uint8_t idx=0; idx < wavesPerClock; idx++){
// put 1/2 FC length 1's and 1/2 0's per field clock wave (to create the wave)
memset(dest+(*n), 0, fc-halfFC); //in case of odd number use extra here
memset(dest+(*n)+(fc-halfFC), 1, halfFC);
*n += fc;
}
if (mod>0) (*modCnt)++;
if ((mod>0) && modAdjOk){ //fsk2
if ((*modCnt % modAdj) == 0){ //if 4th 8 length wave in a rf/50 add extra 8 length wave
memset(dest+(*n), 0, fc-halfFC);
memset(dest+(*n)+(fc-halfFC), 1, halfFC);
*n += fc;
}
}
if (mod>0 && !modAdjOk){ //fsk1
memset(dest+(*n), 0, mod-(mod/2));
memset(dest+(*n)+(mod-(mod/2)), 1, mod/2);
*n += mod;
}
}
// prepare a waveform pattern in the buffer based on the ID given then
// simulate a HID tag until the button is pressed
@ -503,7 +536,7 @@ void CmdHIDsimTAG(int hi, int lo, int ledcontrol)
*/
if (hi>0xFFF) {
DbpString("Tags can only have 44 bits.");
DbpString("Tags can only have 44 bits. - USE lf simfsk for larger tags");
return;
}
fc(0,&n);
@ -543,6 +576,150 @@ void CmdHIDsimTAG(int hi, int lo, int ledcontrol)
LED_A_OFF();
}
// prepare a waveform pattern in the buffer based on the ID given then
// simulate a FSK tag until the button is pressed
// arg1 contains fcHigh and fcLow, arg2 contains invert and clock
void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
{
int ledcontrol=1;
int n=0, i=0;
uint8_t fcHigh = arg1 >> 8;
uint8_t fcLow = arg1 & 0xFF;
uint16_t modCnt = 0;
uint8_t clk = arg2 & 0xFF;
uint8_t invert = (arg2 >> 8) & 1;
for (i=0; i<size; i++){
if (BitStream[i] == invert){
fcAll(fcLow, &n, clk, &modCnt);
} else {
fcAll(fcHigh, &n, clk, &modCnt);
}
}
Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, invert: %d, n: %d",fcHigh, fcLow, clk, invert, n);
/*Dbprintf("DEBUG: First 32:");
uint8_t *dest = BigBuf_get_addr();
i=0;
Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
i+=16;
Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
*/
if (ledcontrol)
LED_A_ON();
SimulateTagLowFrequency(n, 0, ledcontrol);
if (ledcontrol)
LED_A_OFF();
}
// compose ask waveform for one bit(ASK)
static void askSimBit(uint8_t c, int *n, uint8_t clock, uint8_t manchester)
{
uint8_t *dest = BigBuf_get_addr();
uint8_t halfClk = clock/2;
// c = current bit 1 or 0
if (manchester){
memset(dest+(*n), c, halfClk);
memset(dest+(*n) + halfClk, c^1, halfClk);
} else {
memset(dest+(*n), c, clock);
}
*n += clock;
}
// args clock, ask/man or askraw, invert, transmission separator
void CmdASKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
{
int ledcontrol = 1;
int n=0, i=0;
uint8_t clk = (arg1 >> 8) & 0xFF;
uint8_t manchester = arg1 & 1;
uint8_t separator = arg2 & 1;
uint8_t invert = (arg2 >> 8) & 1;
for (i=0; i<size; i++){
askSimBit(BitStream[i]^invert, &n, clk, manchester);
}
if (manchester==0 && BitStream[0]==BitStream[size-1]){ //run a second set inverted (for biphase phase)
for (i=0; i<size; i++){
askSimBit(BitStream[i]^invert^1, &n, clk, manchester);
}
}
if (separator==1) Dbprintf("sorry but separator option not yet available");
Dbprintf("Simulating with clk: %d, invert: %d, manchester: %d, separator: %d, n: %d",clk, invert, manchester, separator, n);
//DEBUG
//Dbprintf("First 32:");
//uint8_t *dest = BigBuf_get_addr();
//i=0;
//Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
//i+=16;
//Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
if (ledcontrol)
LED_A_ON();
SimulateTagLowFrequency(n, 0, ledcontrol);
if (ledcontrol)
LED_A_OFF();
}
//carrier can be 2,4 or 8
static void pskSimBit(uint8_t waveLen, int *n, uint8_t clk, uint8_t *curPhase, bool phaseChg)
{
uint8_t *dest = BigBuf_get_addr();
uint8_t halfWave = waveLen/2;
//uint8_t idx;
int i = 0;
if (phaseChg){
// write phase change
memset(dest+(*n), *curPhase^1, halfWave);
memset(dest+(*n) + halfWave, *curPhase, halfWave);
*n += waveLen;
*curPhase ^= 1;
i += waveLen;
}
//write each normal clock wave for the clock duration
for (; i < clk; i+=waveLen){
memset(dest+(*n), *curPhase, halfWave);
memset(dest+(*n) + halfWave, *curPhase^1, halfWave);
*n += waveLen;
}
}
// args clock, carrier, invert,
void CmdPSKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
{
int ledcontrol=1;
int n=0, i=0;
uint8_t clk = arg1 >> 8;
uint8_t carrier = arg1 & 0xFF;
uint8_t invert = arg2 & 0xFF;
uint8_t curPhase = 0;
for (i=0; i<size; i++){
if (BitStream[i] == curPhase){
pskSimBit(carrier, &n, clk, &curPhase, FALSE);
} else {
pskSimBit(carrier, &n, clk, &curPhase, TRUE);
}
}
Dbprintf("Simulating with Carrier: %d, clk: %d, invert: %d, n: %d",carrier, clk, invert, n);
//Dbprintf("DEBUG: First 32:");
//uint8_t *dest = BigBuf_get_addr();
//i=0;
//Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
//i+=16;
//Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
if (ledcontrol)
LED_A_ON();
SimulateTagLowFrequency(n, 0, ledcontrol);
if (ledcontrol)
LED_A_OFF();
}
// loop to get raw HID waveform then FSK demodulate the TAG ID from it
void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
{
@ -1528,7 +1705,7 @@ void ReadPCF7931() {
tries++;
if (BUTTON_PRESS()) return;
} while (num_blocks != max_blocks);
end:
end:
Dbprintf("-----------------------------------------");
Dbprintf("Memory content:");
Dbprintf("-----------------------------------------");

233
client/cmddata.c
View file

@ -55,7 +55,7 @@ int CmdSetDebugMode(const char *Cmd)
}
//by marshmellow
void printDemodBuff()
void printDemodBuff(void)
{
uint32_t i = 0;
int bitLen = DemodBufferLen;
@ -90,7 +90,28 @@ void printDemodBuff()
return;
}
int CmdPrintDemodBuff(const char *Cmd)
{
char hex;
char printBuff[512]={0x00};
uint8_t numBits = DemodBufferLen & 0xFFF0;
sscanf(Cmd, "%c", &hex);
if (hex == 'h'){
PrintAndLog("Usage: data printdemodbuffer [x]");
PrintAndLog("Options: ");
PrintAndLog(" h This help");
PrintAndLog(" x output in hex (omit for binary output)");
return 0;
}
if (hex == 'x'){
numBits = binarraytohex(printBuff, (char *)DemodBuffer, numBits);
if (numBits==0) return 0;
PrintAndLog("DemodBuffer: %s",printBuff);
} else {
printDemodBuff();
}
return 1;
}
int CmdAmp(const char *Cmd)
{
int i, rising, falling;
@ -135,20 +156,19 @@ int CmdAmp(const char *Cmd)
* Updates the Graph trace with 0/1 values
*
* Arguments:
* c : 0 or 1
* c : 0 or 1 (or invert)
*/
//this method is dependant on all highs and lows to be the same(or clipped) this creates issues[marshmellow] it also ignores the clock
//this method ignores the clock
//this function strictly converts highs and lows to 1s and 0s for each sample in the graphbuffer
int Cmdaskdemod(const char *Cmd)
{
int i;
int c, high = 0, low = 0;
// TODO: complain if we do not give 2 arguments here !
// (AL - this doesn't make sense! we're only using one argument!!!)
sscanf(Cmd, "%i", &c);
/* Detect high and lows and clock */
// (AL - clock???)
/* Detect high and lows */
for (i = 0; i < GraphTraceLen; ++i)
{
if (GraphBuffer[i] > high)
@ -178,9 +198,9 @@ int Cmdaskdemod(const char *Cmd)
* down)
*/
//[marhsmellow] change == to >= for high and <= for low for fuzz
if ((GraphBuffer[i] == high) && (GraphBuffer[i - 1] == c)) {
if ((GraphBuffer[i] >= high) && (GraphBuffer[i - 1] == c)) {
GraphBuffer[i] = 1 - c;
} else if ((GraphBuffer[i] == low) && (GraphBuffer[i - 1] == (1 - c))){
} else if ((GraphBuffer[i] <= low) && (GraphBuffer[i - 1] == (1 - c))){
GraphBuffer[i] = c;
} else {
/* No transition */
@ -191,6 +211,23 @@ int Cmdaskdemod(const char *Cmd)
return 0;
}
//this function strictly converts >1 to 1 and <1 to 0 for each sample in the graphbuffer
int CmdGetBitStream(const char *Cmd)
{
int i;
CmdHpf(Cmd);
for (i = 0; i < GraphTraceLen; i++) {
if (GraphBuffer[i] >= 1) {
GraphBuffer[i] = 1;
} else {
GraphBuffer[i] = 0;
}
}
RepaintGraphWindow();
return 0;
}
//by marshmellow
void printBitStream(uint8_t BitStream[], uint32_t bitLen)
{
@ -506,9 +543,33 @@ int CmdBiphaseDecodeRaw(const char *Cmd)
PrintAndLog("Biphase Decoded using offset: %d - # errors:%d - data:",offset,errCnt);
printBitStream(BitStream, size);
PrintAndLog("\nif bitstream does not look right try offset=1");
if (offset == 1) setDemodBuf(DemodBuffer,DemodBufferLen-1,1); //remove first bit from raw demod
return 1;
}
// set demod buffer back to raw after biphase demod
void setBiphaseDemodBuf(uint8_t *BitStream, size_t size)
{
uint8_t rawStream[512]={0x00};
size_t i=0;
uint8_t curPhase=0;
if (size > 256) {
PrintAndLog("ERROR - Biphase Demod Buffer overrun");
return;
}
for (size_t idx=0; idx<size; idx++){
if(!BitStream[idx]){
rawStream[i++] = curPhase;
rawStream[i++] = curPhase;
curPhase ^= 1;
} else {
rawStream[i++] = curPhase;
rawStream[i++] = curPhase ^ 1;
}
}
setDemodBuf(rawStream,i,0);
return;
}
//by marshmellow
//takes 4 arguments - clock, invert, maxErr as integers and amplify as char
//attempts to demodulate ask only
@ -557,6 +618,100 @@ int ASKrawDemod(const char *Cmd, bool verbose)
return 1;
}
//by marshmellow
//attempts to demodulate and identify a G_Prox_II verex/chubb card
//WARNING: if it fails during some points it will destroy the DemodBuffer data
// but will leave the GraphBuffer intact.
//if successful it will push askraw data back to demod buffer ready for emulation
int CmdG_Prox_II_Demod(const char *Cmd)
{
int ans = ASKrawDemod(Cmd, FALSE);
if (ans <= 0) {
if (g_debugMode) PrintAndLog("Error AskrawDemod: %d",ans);
return ans;
}
size_t size = DemodBufferLen;
ans = BiphaseRawDecode(DemodBuffer, &size, 0, 0);
if (ans !=0) {
if (g_debugMode) PrintAndLog("Error BiphaseRawDecode: %d",ans);
return ans;
}
//call lfdemod.c demod for gProxII
ans = gProxII_Demod(DemodBuffer, &size);
if (ans < 0){
if (g_debugMode) PrintAndLog("Error gProxII_Demod 1st Try: %d",ans);
//try biphase again
ans = BiphaseRawDecode(DemodBuffer, &size, 1, 0);
if (ans != 0) {
if (g_debugMode) PrintAndLog("Error BiphaseRawDecode: %d",ans);
return ans;
}
ans = gProxII_Demod(DemodBuffer, &size);
if (ans < 0) {
if (g_debugMode) PrintAndLog("Error gProxII_Demod 1st Try: %d",ans);
return ans;
}
}
//got a good demod
uint32_t ByteStream[65] = {0x00};
uint8_t xorKey=0;
uint8_t keyCnt=0;
uint8_t bitCnt=0;
uint8_t ByteCnt=0;
size_t startIdx = ans + 6; //start after preamble
for (size_t idx = 0; idx<size-6; idx++){
if ((idx+1) % 5 == 0){
//spacer bit - should be 0
if (DemodBuffer[startIdx+idx] != 0) {
if (g_debugMode) PrintAndLog("Error spacer not 0: %d, pos: %d",DemodBuffer[startIdx+idx],startIdx+idx);
return -1;
}
continue;
}
if (keyCnt<8){ //lsb first
xorKey = xorKey | (DemodBuffer[startIdx+idx]<<keyCnt);
keyCnt++;
if (keyCnt==8 && g_debugMode) PrintAndLog("xorKey Found: %02x", xorKey);
continue;
}
//lsb first
ByteStream[ByteCnt] = ByteStream[ByteCnt] | (DemodBuffer[startIdx+idx]<<bitCnt);
bitCnt++;
if (bitCnt % 8 == 0){
if (g_debugMode) PrintAndLog("byte %d: %02x",ByteCnt,ByteStream[ByteCnt]);
bitCnt=0;
ByteCnt++;
}
}
for (uint8_t i = 0; i < ByteCnt; i++){
ByteStream[i] ^= xorKey; //xor
if (g_debugMode) PrintAndLog("byte %d after xor: %02x", i, ByteStream[i]);
}
//now ByteStream contains 64 bytes of decrypted raw tag data
//
uint8_t fmtLen = ByteStream[0]>>2;
uint32_t FC = 0;
uint32_t Card = 0;
uint32_t raw1 = bytebits_to_byte(DemodBuffer+ans,32);
uint32_t raw2 = bytebits_to_byte(DemodBuffer+ans+32, 32);
uint32_t raw3 = bytebits_to_byte(DemodBuffer+ans+64, 32);
if (fmtLen==36){
FC = ((ByteStream[3] & 0x7F)<<7) | (ByteStream[4]>>1);
Card = ((ByteStream[4]&1)<<19) | (ByteStream[5]<<11) | (ByteStream[6]<<3) | (ByteStream[7]>>5);
PrintAndLog("G-Prox-II Found: FmtLen %d, FC %d, Card %d",fmtLen,FC,Card);
} else if(fmtLen==26){
FC = ((ByteStream[3] & 0x7F)<<1) | (ByteStream[4]>>7);
Card = ((ByteStream[4]&0x7F)<<9) | (ByteStream[5]<<1) | (ByteStream[6]>>7);
PrintAndLog("G-Prox-II Found: FmtLen %d, FC %d, Card %d",fmtLen,FC,Card);
} else {
PrintAndLog("Unknown G-Prox-II Fmt Found: FmtLen %d",fmtLen);
}
PrintAndLog("Raw: %08x%08x%08x", raw1,raw2,raw3);
setBiphaseDemodBuf(DemodBuffer+ans, 96);
return 1;
}
//by marshmellow - see ASKrawDemod
int Cmdaskrawdemod(const char *Cmd)
{
@ -840,9 +995,9 @@ int FSKrawDemod(const char *Cmd, bool verbose)
//raw fsk demod no manchester decoding no start bit finding just get binary from wave
//set defaults
int rfLen = 0;
int invert=0;
int fchigh=0;
int fclow=0;
int invert = 0;
int fchigh = 0;
int fclow = 0;
//set options from parameters entered with the command
sscanf(Cmd, "%i %i %i %i", &rfLen, &invert, &fchigh, &fclow);
@ -861,7 +1016,7 @@ int FSKrawDemod(const char *Cmd, bool verbose)
uint16_t fcs=0;
uint8_t dummy=0;
if (fchigh==0 || fclow == 0){
fcs=countFC(BitStream, BitLen, &dummy);
fcs = countFC(BitStream, BitLen, &dummy);
if (fcs==0){
fchigh=10;
fclow=8;
@ -886,6 +1041,7 @@ int FSKrawDemod(const char *Cmd, bool verbose)
PrintAndLog("FSK decoded bitstream:");
printBitStream(BitStream,size);
}
return 1;
} else{
if (verbose) PrintAndLog("no FSK data found");
@ -1043,7 +1199,7 @@ int CmdFSKdemodParadox(const char *Cmd)
uint32_t rawLo = bytebits_to_byte(BitStream+idx+64,32);
uint32_t rawHi = bytebits_to_byte(BitStream+idx+32,32);
uint32_t rawHi2 = bytebits_to_byte(BitStream+idx,32);
PrintAndLog("Paradox TAG ID: %x%08x - FC: %d - Card: %d - Checksum: %02x - RAW: %08x%08x%08x",
hi>>10, (hi & 0x3)<<26 | (lo>>10), fc, cardnum, (lo>>2) & 0xFF, rawHi2, rawHi, rawLo);
setDemodBuf(BitStream,BitLen,idx);
@ -1495,9 +1651,14 @@ int PSKDemod(const char *Cmd, bool verbose)
}
uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
size_t BitLen = getFromGraphBuf(BitStream);
if (BitLen==0) return 0;
if (BitLen==0) return -1;
uint8_t carrier=countPSK_FC(BitStream, BitLen);
if (carrier!=2 && carrier!=4 && carrier!=8){
//invalid carrier
return -1;
}
int errCnt=0;
errCnt = pskRawDemod(BitStream, &BitLen,&clk,&invert);
errCnt = pskRawDemod(BitStream, &BitLen, &clk, &invert);
if (errCnt > maxErr){
if (g_debugMode==1 && verbose) PrintAndLog("Too many errors found, clk: %d, invert: %d, numbits: %d, errCnt: %d",clk,invert,BitLen,errCnt);
return -1;
@ -1638,7 +1799,7 @@ int NRZrawDemod(const char *Cmd, bool verbose)
// Now output the bitstream to the scrollback by line of 16 bits
printDemodBuff();
}
return 1;
return 1;
}
int CmdNRZrawDemod(const char *Cmd)
@ -1650,11 +1811,11 @@ int CmdNRZrawDemod(const char *Cmd)
PrintAndLog(" <invert>, 1 for invert output");
PrintAndLog(" [set maximum allowed errors], default = 100.");
PrintAndLog("");
PrintAndLog(" sample: data nrzrawdemod = demod a nrz/direct tag from GraphBuffer");
PrintAndLog(" : data nrzrawdemod 32 = demod a nrz/direct tag from GraphBuffer using a clock of RF/32");
PrintAndLog(" : data nrzrawdemod 32 1 = demod a nrz/direct tag from GraphBuffer using a clock of RF/32 and inverting data");
PrintAndLog(" : data nrzrawdemod 1 = demod a nrz/direct tag from GraphBuffer while inverting data");
PrintAndLog(" : data nrzrawdemod 64 1 0 = demod a nrz/direct tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors");
PrintAndLog(" sample: data rawdemod nr = demod a nrz/direct tag from GraphBuffer");
PrintAndLog(" : data rawdemod nr 32 = demod a nrz/direct tag from GraphBuffer using a clock of RF/32");
PrintAndLog(" : data rawdemod nr 32 1 = demod a nrz/direct tag from GraphBuffer using a clock of RF/32 and inverting data");
PrintAndLog(" : data rawdemod nr 1 = demod a nrz/direct tag from GraphBuffer while inverting data");
PrintAndLog(" : data rawdemod nr 64 1 0 = demod a nrz/direct tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors");
return 0;
}
return NRZrawDemod(Cmd, TRUE);
@ -1674,11 +1835,11 @@ int CmdPSK1rawDemod(const char *Cmd)
PrintAndLog(" <invert>, 1 for invert output");
PrintAndLog(" [set maximum allowed errors], default = 100.");
PrintAndLog("");
PrintAndLog(" sample: data psk1rawdemod = demod a psk1 tag from GraphBuffer");
PrintAndLog(" : data psk1rawdemod 32 = demod a psk1 tag from GraphBuffer using a clock of RF/32");
PrintAndLog(" : data psk1rawdemod 32 1 = demod a psk1 tag from GraphBuffer using a clock of RF/32 and inverting data");
PrintAndLog(" : data psk1rawdemod 1 = demod a psk1 tag from GraphBuffer while inverting data");
PrintAndLog(" : data psk1rawdemod 64 1 0 = demod a psk1 tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors");
PrintAndLog(" sample: data rawdemod p1 = demod a psk1 tag from GraphBuffer");
PrintAndLog(" : data rawdemod p1 32 = demod a psk1 tag from GraphBuffer using a clock of RF/32");
PrintAndLog(" : data rawdemod p1 32 1 = demod a psk1 tag from GraphBuffer using a clock of RF/32 and inverting data");
PrintAndLog(" : data rawdemod p1 1 = demod a psk1 tag from GraphBuffer while inverting data");
PrintAndLog(" : data rawdemod p1 64 1 0 = demod a psk1 tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors");
return 0;
}
errCnt = PSKDemod(Cmd, TRUE);
@ -1708,14 +1869,14 @@ int CmdPSK2rawDemod(const char *Cmd)
PrintAndLog(" <invert>, 1 for invert output");
PrintAndLog(" [set maximum allowed errors], default = 100.");
PrintAndLog("");
PrintAndLog(" sample: data psk2rawdemod = demod a psk2 tag from GraphBuffer, autodetect clock");
PrintAndLog(" : data psk2rawdemod 32 = demod a psk2 tag from GraphBuffer using a clock of RF/32");
PrintAndLog(" : data psk2rawdemod 32 1 = demod a psk2 tag from GraphBuffer using a clock of RF/32 and inverting output");
PrintAndLog(" : data psk2rawdemod 1 = demod a psk2 tag from GraphBuffer, autodetect clock and invert output");
PrintAndLog(" : data psk2rawdemod 64 1 0 = demod a psk2 tag from GraphBuffer using a clock of RF/64, inverting output and allowing 0 demod errors");
PrintAndLog(" sample: data rawdemod p2 = demod a psk2 tag from GraphBuffer, autodetect clock");
PrintAndLog(" : data rawdemod p2 32 = demod a psk2 tag from GraphBuffer using a clock of RF/32");
PrintAndLog(" : data rawdemod p2 32 1 = demod a psk2 tag from GraphBuffer using a clock of RF/32 and inverting output");
PrintAndLog(" : data rawdemod p2 1 = demod a psk2 tag from GraphBuffer, autodetect clock and invert output");
PrintAndLog(" : data rawdemod p2 64 1 0 = demod a psk2 tag from GraphBuffer using a clock of RF/64, inverting output and allowing 0 demod errors");
return 0;
}
errCnt=PSKDemod(Cmd, 1);
errCnt=PSKDemod(Cmd, TRUE);
if (errCnt<0){
if (g_debugMode) PrintAndLog("Error demoding: %d",errCnt);
return 0;
@ -1834,6 +1995,7 @@ int CmdHide(const char *Cmd)
return 0;
}
//zero mean GraphBuffer
int CmdHpf(const char *Cmd)
{
int i;
@ -2423,6 +2585,7 @@ static command_t CommandTable[] =
//{"askdemod", Cmdaskdemod, 1, "<0 or 1> -- Attempt to demodulate simple ASK tags"},
{"askedgedetect", CmdAskEdgeDetect, 1, "[threshold] Adjust Graph for manual ask demod using length of sample differences to detect the edge of a wave (default = 25)"},
{"askem410xdemod",CmdAskEM410xDemod, 1, "[clock] [invert<0|1>] [maxErr] -- Demodulate an EM410x tag from GraphBuffer (args optional)"},
{"askgproxiidemod",CmdG_Prox_II_Demod,1, "Demodulate a G Prox II tag from GraphBuffer"},
//{"askmandemod", Cmdaskmandemod, 1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate ASK/Manchester tags and output binary (args optional)"},
//{"askrawdemod", Cmdaskrawdemod, 1, "[clock] [invert<0|1>] -- Attempt to demodulate ASK tags and output bin (args optional)"},
{"autocorr", CmdAutoCorr, 1, "<window length> -- Autocorrelation over window"},
@ -2440,6 +2603,7 @@ static command_t CommandTable[] =
{"fskpyramiddemod",CmdFSKdemodPyramid,1, "Demodulate a Pyramid FSK tag from GraphBuffer"},
{"fskparadoxdemod",CmdFSKdemodParadox,1, "Demodulate a Paradox FSK tag from GraphBuffer"},
//{"fskrawdemod", CmdFSKrawdemod, 1, "[clock rate] [invert] [rchigh] [rclow] Demodulate graph window from FSK to bin (clock = 50)(invert = 1|0)(rchigh = 10)(rclow=8)"},
{"getbitstream", CmdGetBitStream, 1, "Convert GraphBuffer's >=1 values to 1 and <1 to 0"},
{"grid", CmdGrid, 1, "<x> <y> -- overlay grid on graph window, use zero value to turn off either"},
{"hexsamples", CmdHexsamples, 0, "<bytes> [<offset>] -- Dump big buffer as hex bytes"},
{"hide", CmdHide, 1, "Hide graph window"},
@ -2455,6 +2619,7 @@ static command_t CommandTable[] =
//{"nrzrawdemod", CmdNRZrawDemod, 1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate nrz tags and output binary (args optional)"},
{"plot", CmdPlot, 1, "Show graph window (hit 'h' in window for keystroke help)"},
//{"pskdetectclock",CmdDetectPSKClockRate, 1, "Detect ASK, PSK, or NRZ clock rate"},
{"printdemodbuffer",CmdPrintDemodBuff,1, "[x] -- print the data in the DemodBuffer - 'x' for hex output"},
{"pskindalademod",CmdIndalaDecode, 1, "[clock] [invert<0|1>] -- Demodulate an indala tag (PSK1) from GraphBuffer (args optional)"},
//{"psk1rawdemod", CmdPSK1rawDemod, 1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate psk1 tags and output binary (args optional)"},
//{"psk2rawdemod", CmdPSK2rawDemod, 1, "[clock] [invert<0|1>] [maxErr] -- Attempt to demodulate psk2 tags and output binary (args optional)"},

5
client/cmddata.h
View file

@ -14,12 +14,14 @@
command_t * CmdDataCommands();
int CmdData(const char *Cmd);
void printDemodBuff(void);
void printBitStream(uint8_t BitStream[], uint32_t bitLen);
void setDemodBuf(uint8_t *buff, size_t size, size_t startIdx);
void printDemodBuff();
int CmdAmp(const char *Cmd);
int Cmdaskdemod(const char *Cmd);
int CmdAskEM410xDemod(const char *Cmd);
int CmdG_Prox_II_Demod(const char *Cmd);
int Cmdaskrawdemod(const char *Cmd);
int Cmdaskmandemod(const char *Cmd);
int CmdAutoCorr(const char *Cmd);
@ -39,6 +41,7 @@ int CmdFSKrawdemod(const char *Cmd);
int CmdPSK1rawDemod(const char *Cmd);
int CmdPSK2rawDemod(const char *Cmd);
int CmdGrid(const char *Cmd);
int CmdGetBitStream(const char *Cmd);
int CmdHexsamples(const char *Cmd);
int CmdHide(const char *Cmd);
int CmdHpf(const char *Cmd);

378
client/cmdlf.c
View file

@ -28,6 +28,7 @@
#include "cmdlft55xx.h"
#include "cmdlfpcf7931.h"
#include "cmdlfio.h"
#include "lfdemod.h"
static int CmdHelp(const char *Cmd);
@ -514,11 +515,11 @@ int CmdLFSnoop(const char *Cmd)
static void ChkBitstream(const char *str)
{
int i;
/* convert to bitstream if necessary */
for (i = 0; i < (int)(GraphTraceLen / 2); i++){
if (GraphBuffer[i] > 1 || GraphBuffer[i] < 0) {
CmdBitstream(str);
CmdGetBitStream("");
break;
}
}
@ -526,33 +527,379 @@ static void ChkBitstream(const char *str)
//appears to attempt to simulate manchester
int CmdLFSim(const char *Cmd)
{
int i,j;
int i,j;
static int gap;
sscanf(Cmd, "%i", &gap);
/* convert to bitstream if necessary */
ChkBitstream(Cmd);
printf("Sending [%d bytes]", GraphTraceLen);
for (i = 0; i < GraphTraceLen; i += USB_CMD_DATA_SIZE) {
//can send 512 bits at a time (1 byte sent per bit...)
printf("Sending [%d bytes]", GraphTraceLen);
for (i = 0; i < GraphTraceLen; i += USB_CMD_DATA_SIZE) {
UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {i, 0, 0}};
for (j = 0; j < USB_CMD_DATA_SIZE; j++) {
for (j = 0; j < USB_CMD_DATA_SIZE; j++) {
c.d.asBytes[j] = GraphBuffer[i+j];
}
SendCommand(&c);
WaitForResponse(CMD_ACK,NULL);
printf(".");
printf(".");
}
printf("\n");
PrintAndLog("Starting to simulate");
printf("\n");
PrintAndLog("Starting to simulate");
UsbCommand c = {CMD_SIMULATE_TAG_125K, {GraphTraceLen, gap, 0}};
SendCommand(&c);
return 0;
}
int usage_lf_simfsk(void)
{
//print help
PrintAndLog("Usage: lf simfsk [c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>]");
PrintAndLog("Options: ");
PrintAndLog(" h This help");
PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
PrintAndLog(" i invert data");
PrintAndLog(" H <fcHigh> Manually set the larger Field Clock");
PrintAndLog(" L <fcLow> Manually set the smaller Field Clock");
//PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
PrintAndLog("\n NOTE: if you set one clock manually set them all manually");
return 0;
}
int usage_lf_simask(void)
{
//print help
PrintAndLog("Usage: lf simask [c <clock>] [i] [m|r] [s] [d <raw hex to sim>]");
PrintAndLog("Options: ");
PrintAndLog(" h This help");
PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
PrintAndLog(" i invert data");
PrintAndLog(" m sim ask/manchester");
PrintAndLog(" r sim ask/raw");
PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
return 0;
}
int usage_lf_simpsk(void)
{
//print help
PrintAndLog("Usage: lf simpsk [1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>]");
PrintAndLog("Options: ");
PrintAndLog(" h This help");
PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
PrintAndLog(" i invert data");
PrintAndLog(" 1 set PSK1 (default)");
PrintAndLog(" 2 set PSK2");
PrintAndLog(" 3 set PSK3");
PrintAndLog(" r <carrier> 2|4|8 are valid carriers: default = 2");
PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
return 0;
}
// by marshmellow - sim ask data given clock, fcHigh, fcLow, invert
// - allow pull data from DemodBuffer
int CmdLFfskSim(const char *Cmd)
{
//might be able to autodetect FC and clock from Graphbuffer if using demod buffer
//will need FChigh, FClow, Clock, and bitstream
uint8_t fcHigh=0, fcLow=0, clk=0;
uint8_t invert=0;
bool errors = FALSE;
char hexData[32] = {0x00}; // store entered hex data
uint8_t data[255] = {0x00};
int dataLen = 0;
uint8_t cmdp = 0;
while(param_getchar(Cmd, cmdp) != 0x00)
{
switch(param_getchar(Cmd, cmdp))
{
case 'h':
return usage_lf_simfsk();
case 'i':
invert = 1;
cmdp++;
break;
case 'c':
errors |= param_getdec(Cmd,cmdp+1,&clk);
cmdp+=2;
break;
case 'H':
errors |= param_getdec(Cmd,cmdp+1,&fcHigh);
cmdp+=2;
break;
case 'L':
errors |= param_getdec(Cmd,cmdp+1,&fcLow);
cmdp+=2;
break;
//case 's':
// separator=1;
// cmdp++;
// break;
case 'd':
dataLen = param_getstr(Cmd, cmdp+1, hexData);
if (dataLen==0) {
errors=TRUE;
} else {
dataLen = hextobinarray((char *)data, hexData);
}
if (dataLen==0) errors=TRUE;
if (errors) PrintAndLog ("Error getting hex data");
cmdp+=2;
break;
default:
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
errors = TRUE;
break;
}
if(errors) break;
}
if(cmdp == 0 && DemodBufferLen == 0)
{
errors = TRUE;// No args
}
//Validations
if(errors)
{
return usage_lf_simfsk();
}
if (dataLen == 0){ //using DemodBuffer
if (clk==0 || fcHigh==0 || fcLow==0){ //manual settings must set them all
uint8_t ans = fskClocks(&fcHigh, &fcLow, &clk, 0);
if (ans==0){
if (!fcHigh) fcHigh=10;
if (!fcLow) fcLow=8;
if (!clk) clk=50;
}
}
} else {
setDemodBuf(data, dataLen, 0);
}
if (clk == 0) clk = 50;
if (fcHigh == 0) fcHigh = 10;
if (fcLow == 0) fcLow = 8;
uint16_t arg1, arg2;
arg1 = fcHigh << 8 | fcLow;
arg2 = invert << 8 | clk;
size_t size = DemodBufferLen;
if (size > USB_CMD_DATA_SIZE) {
PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size, USB_CMD_DATA_SIZE);
size = USB_CMD_DATA_SIZE;
}
UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};
memcpy(c.d.asBytes, DemodBuffer, size);
SendCommand(&c);
return 0;
}
// by marshmellow - sim ask data given clock, invert, manchester or raw, separator
// - allow pull data from DemodBuffer
int CmdLFaskSim(const char *Cmd)
{
//autodetect clock from Graphbuffer if using demod buffer
//will need clock, invert, manchester/raw as m or r, separator as s, and bitstream
uint8_t manchester = 1, separator = 0;
//char cmdp = Cmd[0], par3='m', par4=0;
uint8_t clk=0, invert=0;
bool errors = FALSE;
char hexData[32] = {0x00};
uint8_t data[255]= {0x00}; // store entered hex data
int dataLen = 0;
uint8_t cmdp = 0;
while(param_getchar(Cmd, cmdp) != 0x00)
{
switch(param_getchar(Cmd, cmdp))
{
case 'h':
return usage_lf_simask();
case 'i':
invert = 1;
cmdp++;
break;
case 'c':
errors |= param_getdec(Cmd,cmdp+1,&clk);
cmdp+=2;
break;
case 'm':
manchester=1;
cmdp++;
break;
case 'r':
manchester=0;
cmdp++;
break;
case 's':
separator=1;
cmdp++;
break;
case 'd':
dataLen = param_getstr(Cmd, cmdp+1, hexData);
if (dataLen==0) {
errors=TRUE;
} else {
dataLen = hextobinarray((char *)data, hexData);
}
if (dataLen==0) errors=TRUE;
if (errors) PrintAndLog ("Error getting hex data, datalen: %d",dataLen);
cmdp+=2;
break;
default:
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
errors = TRUE;
break;
}
if(errors) break;
}
if(cmdp == 0 && DemodBufferLen == 0)
{
errors = TRUE;// No args
}
//Validations
if(errors)
{
return usage_lf_simask();
}
if (dataLen == 0){ //using DemodBuffer
if (clk == 0) clk = GetAskClock("0", false, false);
} else {
setDemodBuf(data, dataLen, 0);
}
if (clk == 0) clk = 64;
if (manchester == 0) clk = clk/2; //askraw needs to double the clock speed
uint16_t arg1, arg2;
size_t size=DemodBufferLen;
arg1 = clk << 8 | manchester;
arg2 = invert << 8 | separator;
if (size > USB_CMD_DATA_SIZE) {
PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size, USB_CMD_DATA_SIZE);
size = USB_CMD_DATA_SIZE;
}
UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
PrintAndLog("preparing to sim ask data: %d bits", size);
memcpy(c.d.asBytes, DemodBuffer, size);
SendCommand(&c);
return 0;
}
// by marshmellow - sim psk data given carrier, clock, invert
// - allow pull data from DemodBuffer or parameters
int CmdLFpskSim(const char *Cmd)
{
//might be able to autodetect FC and clock from Graphbuffer if using demod buffer
//will need carrier, Clock, and bitstream
uint8_t carrier=0, clk=0;
uint8_t invert=0;
bool errors = FALSE;
char hexData[32] = {0x00}; // store entered hex data
uint8_t data[255] = {0x00};
int dataLen = 0;
uint8_t cmdp = 0;
uint8_t pskType = 1;
while(param_getchar(Cmd, cmdp) != 0x00)
{
switch(param_getchar(Cmd, cmdp))
{
case 'h':
return usage_lf_simpsk();
case 'i':
invert = 1;
cmdp++;
break;
case 'c':
errors |= param_getdec(Cmd,cmdp+1,&clk);
cmdp+=2;
break;
case 'r':
errors |= param_getdec(Cmd,cmdp+1,&carrier);
cmdp+=2;
break;
case '1':
pskType=1;
cmdp++;
break;
case '2':
pskType=2;
cmdp++;
break;
case '3':
pskType=3;
cmdp++;
break;
case 'd':
dataLen = param_getstr(Cmd, cmdp+1, hexData);
if (dataLen==0) {
errors=TRUE;
} else {
dataLen = hextobinarray((char *)data, hexData);
}
if (dataLen==0) errors=TRUE;
if (errors) PrintAndLog ("Error getting hex data");
cmdp+=2;
break;
default:
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
errors = TRUE;
break;
}
if (errors) break;
}
if (cmdp == 0 && DemodBufferLen == 0)
{
errors = TRUE;// No args
}
//Validations
if (errors)
{
return usage_lf_simpsk();
}
if (dataLen == 0){ //using DemodBuffer
PrintAndLog("Getting Clocks");
if (clk==0) clk = GetPskClock("", FALSE, FALSE);
PrintAndLog("clk: %d",clk);
if (!carrier) carrier = GetPskCarrier("", FALSE, FALSE);
PrintAndLog("carrier: %d", carrier);
} else {
setDemodBuf(data, dataLen, 0);
}
if (clk <= 0) clk = 32;
if (carrier == 0) carrier = 2;
if (pskType != 1){
if (pskType == 2){
//need to convert psk2 to psk1 data before sim
psk2TOpsk1(DemodBuffer, DemodBufferLen);
} else {
PrintAndLog("Sorry, PSK3 not yet available");
}
}
uint16_t arg1, arg2;
arg1 = clk << 8 | carrier;
arg2 = invert;
size_t size=DemodBufferLen;
if (size > USB_CMD_DATA_SIZE) {
PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size, USB_CMD_DATA_SIZE);
size=USB_CMD_DATA_SIZE;
}
UsbCommand c = {CMD_PSK_SIM_TAG, {arg1, arg2, size}};
PrintAndLog("DEBUG: Sending DemodBuffer Length: %d", size);
memcpy(c.d.asBytes, DemodBuffer, size);
SendCommand(&c);
return 0;
}
int CmdLFSimBidir(const char *Cmd)
{
// Set ADC to twice the carrier for a slight supersampling
@ -564,6 +911,7 @@ int CmdLFSimBidir(const char *Cmd)
}
/* simulate an LF Manchester encoded tag with specified bitstream, clock rate and inter-id gap */
/*
int CmdLFSimManchester(const char *Cmd)
{
static int clock, gap;
@ -584,7 +932,7 @@ int CmdLFSimManchester(const char *Cmd)
CmdLFSim(gapstring);
return 0;
}
*/
int CmdVchDemod(const char *Cmd)
{
@ -728,6 +1076,11 @@ int CmdLFfind(const char *Cmd)
PrintAndLog("\nValid EM410x ID Found!");
return 1;
}
ans=CmdG_Prox_II_Demod("");
if (ans>0) {
PrintAndLog("\nValid G Prox II ID Found!");
return 1;
}
PrintAndLog("\nNo Known Tags Found!\n");
if (testRaw=='u' || testRaw=='U'){
//test unknown tag formats (raw mode)
@ -777,8 +1130,11 @@ static command_t CommandTable[] =
{"read", CmdLFRead, 0, "Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"},
{"search", CmdLFfind, 1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) - 'u' to search for unknown tags"},
{"sim", CmdLFSim, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
{"simask", CmdLFaskSim, 0, "[clock] [invert <1|0>] [manchester/raw <'m'|'r'>] [msg separator 's'] [d <hexdata>] -- Simulate LF ASK tag from demodbuffer or input"},
{"simfsk", CmdLFfskSim, 0, "[c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>] -- Simulate LF FSK tag from demodbuffer or input"},
{"simpsk", CmdLFpskSim, 0, "[1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>] -- Simulate LF PSK tag from demodbuffer or input"},
{"simbidir", CmdLFSimBidir, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
{"simman", CmdLFSimManchester, 0, "<Clock> <Bitstream> [GAP] Simulate arbitrary Manchester LF tag"},
//{"simman", CmdLFSimManchester, 0, "<Clock> <Bitstream> [GAP] Simulate arbitrary Manchester LF tag"},
{"snoop", CmdLFSnoop, 0, "['l'|'h'|<divisor>] [trigger threshold]-- Snoop LF (l:125khz, h:134khz)"},
{"vchdemod", CmdVchDemod, 1, "['clone'] -- Demodulate samples for VeriChip"},
{NULL, NULL, 0, NULL}

5
client/cmdlf.h
View file

@ -19,8 +19,11 @@ int CmdIndalaDemod(const char *Cmd);
int CmdIndalaClone(const char *Cmd);
int CmdLFRead(const char *Cmd);
int CmdLFSim(const char *Cmd);
int CmdLFaskSim(const char *Cmd);
int CmdLFfskSim(const char *Cmd);
int CmdLFpskSim(const char *Cmd);
int CmdLFSimBidir(const char *Cmd);
int CmdLFSimManchester(const char *Cmd);
//int CmdLFSimManchester(const char *Cmd);
int CmdLFSnoop(const char *Cmd);
int CmdVchDemod(const char *Cmd);
int CmdLFfind(const char *Cmd);

2
client/cmdlfem4x.c
View file

@ -266,7 +266,7 @@ int CmdEM410xSim(const char *Cmd)
/* stop bit */
AppendGraph(1, clock, 0);
CmdLFSim("240"); //240 start_gap.
CmdLFSim("0"); //240 start_gap.
return 0;
}

71
client/graph.c
View file

@ -18,16 +18,16 @@
int GraphBuffer[MAX_GRAPH_TRACE_LEN];
int GraphTraceLen;
/* write a bit to the graph */
/* write a manchester bit to the graph */
void AppendGraph(int redraw, int clock, int bit)
{
int i;
//set first half the clock bit (all 1's or 0's for a 0 or 1 bit)
for (i = 0; i < (int)(clock / 2); ++i)
GraphBuffer[GraphTraceLen++] = bit ^ 1;
GraphBuffer[GraphTraceLen++] = bit ;
//set second half of the clock bit (all 0's or 1's for a 0 or 1 bit)
for (i = (int)(clock / 2); i < clock; ++i)
GraphBuffer[GraphTraceLen++] = bit;
GraphBuffer[GraphTraceLen++] = bit ^ 1;
if (redraw)
RepaintGraphWindow();
@ -134,6 +134,26 @@ int GetAskClock(const char str[], bool printAns, bool verbose)
return clock;
}
uint8_t GetPskCarrier(const char str[], bool printAns, bool verbose)
{
uint8_t carrier=0;
uint8_t grph[MAX_GRAPH_TRACE_LEN]={0};
size_t size = getFromGraphBuf(grph);
if ( size == 0 ) {
if (verbose)
PrintAndLog("Failed to copy from graphbuffer");
return 0;
}
//uint8_t countPSK_FC(uint8_t *BitStream, size_t size)
carrier = countPSK_FC(grph,size);
// Only print this message if we're not looping something
if (printAns){
PrintAndLog("Auto-detected PSK carrier rate: %d", carrier);
}
return carrier;
}
int GetPskClock(const char str[], bool printAns, bool verbose)
{
int clock;
@ -193,24 +213,10 @@ uint8_t GetFskClock(const char str[], bool printAns, bool verbose)
clock = 0;
if (clock != 0) return (uint8_t)clock;
uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
size_t size = getFromGraphBuf(BitStream);
if (size==0) return 0;
uint8_t dummy = 0;
uint16_t ans = countFC(BitStream, size, &dummy);
if (ans==0) {
if (verbose) PrintAndLog("DEBUG: No data found");
return 0;
}
uint8_t fc1, fc2;
fc1 = (ans >> 8) & 0xFF;
fc2 = ans & 0xFF;
uint8_t rf1 = detectFSKClk(BitStream, size, fc1, fc2);
if (rf1==0) {
if (verbose) PrintAndLog("DEBUG: Clock detect error");
return 0;
}
uint8_t fc1=0, fc2=0, rf1=0;
uint8_t ans = fskClocks(&fc1, &fc2, &rf1, verbose);
if (ans == 0) return 0;
if ((fc1==10 && fc2==8) || (fc1==8 && fc2==5)){
if (printAns) PrintAndLog("Detected Field Clocks: FC/%d, FC/%d - Bit Clock: RF/%d", fc1, fc2, rf1);
return rf1;
@ -221,3 +227,24 @@ uint8_t GetFskClock(const char str[], bool printAns, bool verbose)
}
return 0;
}
uint8_t fskClocks(uint8_t *fc1, uint8_t *fc2, uint8_t *rf1, bool verbose)
{
uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
size_t size = getFromGraphBuf(BitStream);
if (size==0) return 0;
uint8_t dummy = 0;
uint16_t ans = countFC(BitStream, size, &dummy);
if (ans==0) {
if (verbose) PrintAndLog("DEBUG: No data found");
return 0;
}
*fc1 = (ans >> 8) & 0xFF;
*fc2 = ans & 0xFF;
*rf1 = detectFSKClk(BitStream, size, *fc1, *fc2);
if (*rf1==0) {
if (verbose) PrintAndLog("DEBUG: Clock detect error");
return 0;
}
return 1;
}

2
client/graph.h
View file

@ -18,8 +18,10 @@ int ClearGraph(int redraw);
size_t getFromGraphBuf(uint8_t *buff);
int GetAskClock(const char str[], bool printAns, bool verbose);
int GetPskClock(const char str[], bool printAns, bool verbose);
uint8_t GetPskCarrier(const char str[], bool printAns, bool verbose);
uint8_t GetNrzClock(const char str[], bool printAns, bool verbose);
uint8_t GetFskClock(const char str[], bool printAns, bool verbose);
uint8_t fskClocks(uint8_t *fc1, uint8_t *fc2, uint8_t *rf1, bool verbose);
void setGraphBuf(uint8_t *buff, size_t size);
bool HasGraphData();

13
client/hid-flasher/usb_cmd.h
View file

@ -71,6 +71,19 @@ typedef struct {
#define CMD_INDALA_CLONE_TAG 0x0212
// for 224 bits UID
#define CMD_INDALA_CLONE_TAG_L 0x0213
#define CMD_T55XX_READ_BLOCK 0x0214
#define CMD_T55XX_WRITE_BLOCK 0x0215
#define CMD_T55XX_READ_TRACE 0x0216
#define CMD_PCF7931_READ 0x0217
#define CMD_EM4X_READ_WORD 0x0218
#define CMD_EM4X_WRITE_WORD 0x0219
#define CMD_IO_DEMOD_FSK 0x021A
#define CMD_IO_CLONE_TAG 0x021B
#define CMD_EM410X_DEMOD 0x021c
#define CMD_SET_LF_SAMPLING_CONFIG 0x021d
#define CMD_FSK_SIM_TAG 0x021E
#define CMD_ASK_SIM_TAG 0x021F
#define CMD_PSK_SIM_TAG 0x0220
/* CMD_SET_ADC_MUX: ext1 is 0 for lopkd, 1 for loraw, 2 for hipkd, 3 for hiraw */

11
client/lualibs/commands.lua
View file

@ -48,8 +48,13 @@ local _commands = {
CMD_EM4X_READ_WORD = 0x0218,
CMD_EM4X_WRITE_WORD = 0x0219,
CMD_IO_DEMOD_FSK = 0x021A,
CMD_IO_CLONE_TAG = 0x021B,
CMD_EM410X_DEMOD = 0x021c,
CMD_IO_CLONE_TAG = 0x021B,
CMD_EM410X_DEMOD = 0x021c,
CMD_SET_LF_SAMPLING_CONFIG = 0x021d,
CMD_FSK_SIM_TAG = 0x021E,
CMD_ASK_SIM_TAG = 0x021F,
CMD_PSK_SIM_TAG = 0x0220,
--/* CMD_SET_ADC_MUX: ext1 is 0 for lopkd, 1 for loraw, 2 for hipkd, 3 for hiraw */
--// For the 13.56 MHz tags
@ -214,4 +219,4 @@ function Command:getBytes()
local arg1, arg2, arg3 = self.arg1, self.arg2, self.arg3
return bin.pack("LLLLH",cmd, arg1, arg2, arg3,data);
end
return _commands
return _commands

43
common/lfdemod.c
View file

@ -25,7 +25,7 @@ uint8_t justNoise(uint8_t *BitStream, size_t size)
}
//by marshmellow
//get high and low with passed in fuzz factor. also return noise test = 1 for passed or 0 for only noise
//get high and low values of a wave with passed in fuzz factor. also return noise test = 1 for passed or 0 for only noise
int getHiLo(uint8_t *BitStream, size_t size, int *high, int *low, uint8_t fuzzHi, uint8_t fuzzLo)
{
*high=0;
@ -108,6 +108,7 @@ uint64_t Em410xDecode(uint8_t *BitStream, size_t *size, size_t *startIdx)
errChk = 0;
break;
}
//set uint64 with ID from BitStream
for (uint8_t ii=0; ii<4; ii++){
lo = (lo << 1LL) | (BitStream[(i*5)+ii+idx]);
}
@ -353,7 +354,6 @@ void askAmp(uint8_t *BitStream, size_t size)
//by marshmellow
//takes 3 arguments - clock, invert and maxErr as integers
//attempts to demodulate ask only
//prints binary found and saves in graphbuffer for further commands
int askrawdemod(uint8_t *BinStream, size_t *size, int *clk, int *invert, int maxErr, uint8_t amp)
{
uint32_t i;
@ -500,6 +500,28 @@ int askrawdemod(uint8_t *BinStream, size_t *size, int *clk, int *invert, int max
}
return bestErrCnt;
}
// demod gProxIIDemod
// error returns as -x
// success returns start position in BitStream
// BitStream must contain previously askrawdemod and biphasedemoded data
int gProxII_Demod(uint8_t BitStream[], size_t *size)
{
size_t startIdx=0;
uint8_t preamble[] = {1,1,1,1,1,0};
uint8_t errChk = preambleSearch(BitStream, preamble, sizeof(preamble), size, &startIdx);
if (errChk == 0) return -3; //preamble not found
if (*size != 96) return -2; //should have found 96 bits
//check first 6 spacer bits to verify format
if (!BitStream[startIdx+5] && !BitStream[startIdx+10] && !BitStream[startIdx+15] && !BitStream[startIdx+20] && !BitStream[startIdx+25] && !BitStream[startIdx+30]){
//confirmed proper separator bits found
//return start position
return (int) startIdx;
}
return -5;
}
//translate wave to 11111100000 (1 for each short wave 0 for each long wave)
size_t fsk_wave_demod(uint8_t * dest, size_t size, uint8_t fchigh, uint8_t fclow)
{
@ -1067,6 +1089,21 @@ void psk1TOpsk2(uint8_t *BitStream, size_t size)
return;
}
// by marshmellow
// convert psk2 demod to psk1 demod
// from only transition waves are 1s to phase shifts change bit
void psk2TOpsk1(uint8_t *BitStream, size_t size)
{
uint8_t phase=0;
for (size_t i=0; i<size; i++){
if (BitStream[i]==1){
phase ^=1;
}
BitStream[i]=phase;
}
return;
}
// redesigned by marshmellow adjusted from existing decode functions
// indala id decoding - only tested on 26 bit tags, but attempted to make it work for more
int indala26decode(uint8_t *bitStream, size_t *size, uint8_t *invert)
@ -1561,7 +1598,7 @@ int pskRawDemod(uint8_t dest[], size_t *size, int *clock, int *invert)
*clock = DetectPSKClock(dest, *size, *clock);
if (*clock==0) return -1;
int avgWaveVal=0, lastAvgWaveVal=0;
//find first full wave
//find first phase shift
for (i=0; i<loopCnt; i++){
if (dest[i]+fc < dest[i+1] && dest[i+1] >= dest[i+2]){
if (waveStart == 0) {

2
common/lfdemod.h
View file

@ -22,12 +22,14 @@ int ManchesterEncode(uint8_t *BitStream, size_t size);
int manrawdecode(uint8_t *BitStream, size_t *size);
int BiphaseRawDecode(uint8_t * BitStream, size_t *size, int offset, int invert);
int askrawdemod(uint8_t *BinStream, size_t *size, int *clk, int *invert, int maxErr, uint8_t amp);
int gProxII_Demod(uint8_t BitStream[], size_t *size);
int HIDdemodFSK(uint8_t *dest, size_t *size, uint32_t *hi2, uint32_t *hi, uint32_t *lo);
int IOdemodFSK(uint8_t *dest, size_t size);
int fskdemod(uint8_t *dest, size_t size, uint8_t rfLen, uint8_t invert, uint8_t fchigh, uint8_t fclow);
uint32_t bytebits_to_byte(uint8_t* src, size_t numbits);
int nrzRawDemod(uint8_t *dest, size_t *size, int *clk, int *invert, int maxErr);
void psk1TOpsk2(uint8_t *BitStream, size_t size);
void psk2TOpsk1(uint8_t *BitStream, size_t size);
int DetectNRZClock(uint8_t dest[], size_t size, int clock);
int indala26decode(uint8_t *bitStream, size_t *size, uint8_t *invert);
void pskCleanWave(uint8_t *bitStream, size_t size);

5
include/usb_cmd.h
View file

@ -89,9 +89,12 @@ typedef struct{
#define CMD_EM4X_WRITE_WORD 0x0219
#define CMD_IO_DEMOD_FSK 0x021A
#define CMD_IO_CLONE_TAG 0x021B
#define CMD_EM410X_DEMOD 0x021c
#define CMD_EM410X_DEMOD 0x021c
// Sampling configuration for LF reader/snooper
#define CMD_SET_LF_SAMPLING_CONFIG 0x021d
#define CMD_FSK_SIM_TAG 0x021E
#define CMD_ASK_SIM_TAG 0x021F
#define CMD_PSK_SIM_TAG 0x0220
/* CMD_SET_ADC_MUX: ext1 is 0 for lopkd, 1 for loraw, 2 for hipkd, 3 for hiraw */