mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-09-20 15:26:13 +08:00
Merge branch 'master' into t55xx_config_recompute_block0
This commit is contained in:
(⌐■_■) Cyberpunk
GitHub
commit
888efe2c13
18
CHANGELOG.md
18
CHANGELOG.md
|
|
@ -4,6 +4,24 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
|||
|
||||
## [unreleased][unreleased]
|
||||
- Fix issue #844 - `lf t55xx config` => recompute block0 (@cyberpunk-re)
|
||||
- EM4x50: changed cli parameter from w (word) to d (data) (@tharexde)
|
||||
- EM4x50: new function 4x50 login: authenticate against tag (@tharexde)
|
||||
- EM4x50: new function 4x50 brute: guess password within a given password range (@tharexde)
|
||||
- EM4x50: new function 4x50 chk: try passwords from dictionary (without option -> T55xx default dictionary or -f user dictionary) (@tharexde)
|
||||
- EM4x50: new function 4x50 reader: read data from tag (configured data -> standard read mode), incl. option -@ (@tharexde)
|
||||
- EM4x50: new function 4x50 sim: simulate dump from file or emulator/flash (@tharexde)
|
||||
- EM4x50: new function 4x50 restore: restore dump file (bin, eml, json) onto tag (@tharexde)
|
||||
- EM4x50: new function 4x50 esave: dump em4x50 content in emulator memory to file (bin + eml + json) (@tharexde)
|
||||
- EM4x50: new function 4x50 eload: upload em4x50 file content (bin, eml, json) to emulator memory (@tharexde)
|
||||
- EM4x50: added LED signals (@tharexde)
|
||||
- EM4x50: added json format for 4x50 dump (@tharexde)
|
||||
- EM4x50: relocated write requests in function 4x50 wipe from device to client (@tharexde)
|
||||
- EM4x50: renamed 4x50_write_password to 4x50 writepwd (@tharexde)
|
||||
- EM4x50: all hex input parameters now have to be given in lsb format (output is still msb + lsb) (@tharexde)
|
||||
- EM4x50: changed cli parameter from a (address) to b (block) (@tharexde)
|
||||
- EM4x50: switched to cliparser for all functions (@tharexde)
|
||||
- EM4x50: stabilized and accelerated tag detection (@tharexde)
|
||||
- EM4x50: removed global tag structure on device side (@tharexde)
|
||||
- Fix `hf 15 sim` - Added basic response to GET_SYSTEM_INFO and READBLOCK requests in order to fix iso15693 tag sim (@cyberpunk-re)
|
||||
- Added `mf mfu sim t 7 n <numreads>` - MFU emulation now supports automatic exit after <num> blocks read. (@cyberpunk-re)
|
||||
- Added T55xx Guide to assist in learning how to use the T55xx chip (@mwalker33)
|
||||
|
|
|
|||
359
armsrc/Standalone/lf_tharexde.c
Normal file
359
armsrc/Standalone/lf_tharexde.c
Normal file
|
|
@ -0,0 +1,359 @@
|
|||
//-----------------------------------------------------------------------------
|
||||
// Tharexde, 2020
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// main code for EM4x50 simulator and collector aka THAREXDE
|
||||
//-----------------------------------------------------------------------------
|
||||
#include <inttypes.h>
|
||||
#include "standalone.h"
|
||||
#include "proxmark3_arm.h"
|
||||
#include "appmain.h"
|
||||
#include "BigBuf.h"
|
||||
#include "fpgaloader.h"
|
||||
#include "util.h"
|
||||
#include "dbprint.h"
|
||||
#include "spiffs.h"
|
||||
#include "../em4x50.h"
|
||||
|
||||
/*
|
||||
* `lf_tharexde` simulates hardcoded words/blocks, reads words of standard read
|
||||
* mode of EM4x50 tags and stores them in internal flash.
|
||||
* It requires RDV4 hardware (for flash and battery).
|
||||
*
|
||||
* On entering stand-alone mode, this module will start reading/record EM4x50 data.
|
||||
* Every found / collected data will be written/appended to the logfile in flash
|
||||
* as a text string.
|
||||
*
|
||||
* LEDs:
|
||||
* - LED A: simulating
|
||||
* - LED B: reading / record
|
||||
* - LED C: writing to flash
|
||||
* - LED D: unmounting/sync'ing flash (normally < 100ms)
|
||||
*
|
||||
* To retrieve log file from flash:
|
||||
*
|
||||
* 1. mem spiffs dump o lf_em4x50collect.log f lf_em4x50collect.log
|
||||
* Copies log file from flash to your client.
|
||||
*
|
||||
* 2. exit the Proxmark3 client
|
||||
*
|
||||
* 3. more lf_tharexdecollect.log
|
||||
*
|
||||
* This module emits debug strings during normal operation -- so try it out in
|
||||
* the lab connected to PM3 client before taking it into the field.
|
||||
*
|
||||
* To delete the log file from flash:
|
||||
*
|
||||
* 1. mem spiffs remove lf_tharexdecollect.log
|
||||
*/
|
||||
|
||||
#define STATE_SIM 0
|
||||
#define STATE_READ 1
|
||||
#define STATE_BRUTE 2
|
||||
#define EM4X50_TAG_WORD 45
|
||||
#define EM4X50_PWD_SPEED 27
|
||||
#define LF_EM4X50SIMULATE_INPUTFILE "lf_em4x50simulate.eml"
|
||||
#define LF_EM4X50COLLECT_LOGFILE "lf_em4x50collect.log"
|
||||
#define LF_EM4X50BRUTE_INPUTFILE "lf_em4x50brute.eml"
|
||||
#define LF_EM4X50BRUTE_LOGFILE "lf_em4x50brute.log"
|
||||
|
||||
bool input_exists;
|
||||
bool log_exists;
|
||||
|
||||
static void LoadDataInstructions(const char *inputfile) {
|
||||
Dbprintf("");
|
||||
Dbprintf("To load datafile into flash and display it:");
|
||||
Dbprintf(_YELLOW_("1.") " edit inputfile %s", inputfile);
|
||||
Dbprintf(_YELLOW_("2.") " start proxmark3 client");
|
||||
Dbprintf(_YELLOW_("3.") " mem spiffs load f %s o %s", inputfile, inputfile);
|
||||
Dbprintf(_YELLOW_("4.") " start standalone mode");
|
||||
}
|
||||
|
||||
static void DownloadLogInstructions(const char *logfile) {
|
||||
Dbprintf("");
|
||||
Dbprintf("To get the logfile from flash and display it:");
|
||||
Dbprintf(_YELLOW_("1.") " mem spiffs dump o %s f %s", logfile, logfile);
|
||||
Dbprintf(_YELLOW_("2.") " exit proxmark3 client");
|
||||
Dbprintf(_YELLOW_("3.") " cat %s", logfile);
|
||||
}
|
||||
|
||||
static int get_input_data_from_file(uint32_t *words, char *inputfile) {
|
||||
|
||||
size_t now = 0;
|
||||
|
||||
if (exists_in_spiffs(inputfile)) {
|
||||
|
||||
uint32_t size = size_in_spiffs(inputfile);
|
||||
uint8_t *mem = BigBuf_malloc(size);
|
||||
|
||||
Dbprintf(_YELLOW_("found input file %s"), inputfile);
|
||||
|
||||
rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
|
||||
now = size / 9;
|
||||
for (int i = 0; i < now; i++)
|
||||
for (int j = 0; j < 4; j++)
|
||||
words[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
|
||||
|
||||
Dbprintf(_YELLOW_("read data from input file"));
|
||||
}
|
||||
|
||||
BigBuf_free();
|
||||
|
||||
return (now > 0) ? now : 0;
|
||||
}
|
||||
|
||||
static void append(const char *filename, uint8_t *entry, size_t entry_len) {
|
||||
|
||||
LED_D_ON();
|
||||
if (log_exists == false) {
|
||||
rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
log_exists = true;
|
||||
} else {
|
||||
rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
}
|
||||
LED_D_OFF();
|
||||
}
|
||||
|
||||
void ModInfo(void) {
|
||||
DbpString(_YELLOW_(" LF EM4x50 sim/collector/bruteforce mode") " - a.k.a tharexde");
|
||||
}
|
||||
|
||||
void RunMod(void) {
|
||||
|
||||
bool state_change = true;//, password_found = false;
|
||||
int pwd_found = false;
|
||||
uint8_t state = STATE_SIM;
|
||||
// declarations for simulating
|
||||
uint32_t words[33] = {0x0};
|
||||
uint32_t pwd = 0x0;
|
||||
uint32_t passwords[2] = {0x0};
|
||||
size_t now = 0;
|
||||
// declarations for reading
|
||||
int no_words = 0;
|
||||
//uint32_t words[EM4X50_TAG_WORD];
|
||||
uint8_t entry[81];
|
||||
|
||||
rdv40_spiffs_lazy_mount();
|
||||
|
||||
StandAloneMode();
|
||||
Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
|
||||
|
||||
for (;;) {
|
||||
|
||||
WDT_HIT();
|
||||
if (data_available()) break;
|
||||
|
||||
// press button - toggle between SIM, READ and BRUTE
|
||||
// hold button - exit
|
||||
int button_pressed = BUTTON_CLICKED(1000);
|
||||
if (button_pressed == BUTTON_SINGLE_CLICK) {
|
||||
|
||||
SpinUp(100);
|
||||
|
||||
switch (state) {
|
||||
|
||||
case STATE_SIM:
|
||||
state = STATE_READ;
|
||||
break;
|
||||
case STATE_READ:
|
||||
state = STATE_BRUTE;
|
||||
break;
|
||||
case STATE_BRUTE:
|
||||
state = STATE_SIM;
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
state_change = true;
|
||||
|
||||
} else if (button_pressed == BUTTON_HOLD) {
|
||||
|
||||
SpinDown(100);
|
||||
break;
|
||||
}
|
||||
|
||||
if (state == STATE_SIM) {
|
||||
|
||||
if (state_change) {
|
||||
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
|
||||
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
|
||||
|
||||
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
|
||||
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
|
||||
AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
|
||||
|
||||
LEDsoff();
|
||||
LED_A_ON();
|
||||
Dbprintf("");
|
||||
Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
|
||||
|
||||
now = get_input_data_from_file(words, LF_EM4X50SIMULATE_INPUTFILE);
|
||||
if (now > 0) {
|
||||
Dbprintf(_YELLOW_("simulating %i blocks"), now);
|
||||
for (int i = 0; i < now; i++)
|
||||
Dbprintf("%2i -> %lx", i + 1, words[i]);
|
||||
|
||||
} else {
|
||||
Dbprintf(_RED_("error in input data"));
|
||||
}
|
||||
|
||||
state_change = false;
|
||||
}
|
||||
|
||||
em4x50_sim_send_listen_window();
|
||||
for (int i = 0; i < now; i++) {
|
||||
em4x50_sim_send_listen_window();
|
||||
em4x50_sim_send_word(words[i]);
|
||||
}
|
||||
|
||||
} else if (state == STATE_READ) {
|
||||
|
||||
if (state_change) {
|
||||
|
||||
LEDsoff();
|
||||
LED_B_ON();
|
||||
Dbprintf("");
|
||||
Dbprintf(_YELLOW_("switched to EM4x50 reading mode"));
|
||||
|
||||
memset(entry, 0, sizeof(entry));
|
||||
memset(words, 0, sizeof(words));
|
||||
|
||||
log_exists = exists_in_spiffs(LF_EM4X50COLLECT_LOGFILE);
|
||||
|
||||
state_change = false;
|
||||
}
|
||||
|
||||
no_words = em4x50_standalone_read(words);
|
||||
|
||||
if (no_words > 0) {
|
||||
|
||||
memset(entry, 0, sizeof(entry));
|
||||
|
||||
sprintf((char *)entry, "found new EM4x50 tag:");
|
||||
Dbprintf("%s", entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
|
||||
|
||||
for (int i = 0; i < no_words; i++) {
|
||||
|
||||
sprintf((char *)entry, " %2i -> 0x%08"PRIx32"", i + 1, words[i]);
|
||||
Dbprintf("%s", entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
|
||||
}
|
||||
}
|
||||
|
||||
} else if (state == STATE_BRUTE) {
|
||||
|
||||
if (state_change) {
|
||||
|
||||
LEDsoff();
|
||||
LED_C_ON();
|
||||
Dbprintf("");
|
||||
Dbprintf(_YELLOW_("switched to EM4x50 brute force mode"));
|
||||
|
||||
log_exists = exists_in_spiffs(LF_EM4X50BRUTE_LOGFILE);
|
||||
now = get_input_data_from_file(passwords, LF_EM4X50BRUTE_INPUTFILE);
|
||||
|
||||
if (now == 2) {
|
||||
|
||||
// print some information
|
||||
int no_iter = passwords[1] - passwords[0] + 1;
|
||||
int dur_s = no_iter / EM4X50_PWD_SPEED;
|
||||
int dur_h = dur_s / 3600;
|
||||
int dur_m = (dur_s - dur_h * 3600) / 60;
|
||||
dur_s -= dur_h * 3600 + dur_m * 60;
|
||||
|
||||
//iterprint = no_iter/10;
|
||||
|
||||
Dbprintf(_YELLOW_("trying %i passwords in range [0x%08x, 0x%08x]"),
|
||||
no_iter, passwords[0], passwords[1]);
|
||||
Dbprintf(_YELLOW_("estimated duration: %ih%im%is"),
|
||||
dur_h, dur_m, dur_s);
|
||||
|
||||
} else {
|
||||
Dbprintf(_RED_("error in input data"));
|
||||
break;
|
||||
}
|
||||
|
||||
state_change = false;
|
||||
}
|
||||
|
||||
pwd_found = em4x50_standalone_brute(passwords[0], passwords[1], &pwd);
|
||||
|
||||
if (pwd_found == PM3_ETIMEOUT) {
|
||||
|
||||
// timeout -> no EM4x50 tag on reader?
|
||||
Dbprintf(_YELLOW_("timeout - no EM4x50 tag detected"));
|
||||
|
||||
} else if (pwd_found == true) {
|
||||
|
||||
// password found -> write to logfile
|
||||
sprintf((char *)entry, "password found: 0x%08"PRIx32, pwd);
|
||||
Dbprintf(_YELLOW_("%s"), entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
|
||||
|
||||
break;
|
||||
|
||||
} else {
|
||||
|
||||
if (pwd == passwords[1] + 1) {
|
||||
|
||||
// finished without success -> write to logfile
|
||||
sprintf((char *)entry, "no password found");
|
||||
Dbprintf(_YELLOW_("%s"), entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
|
||||
|
||||
|
||||
} else {
|
||||
|
||||
// stopped -> write to logfile
|
||||
sprintf((char *)entry, "stopped search - last password: 0x%08"PRIx32, pwd);
|
||||
Dbprintf(_YELLOW_("%s"), entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
|
||||
|
||||
// replace start password by last tested password in
|
||||
// inputfile (spiffs) so that brute forcing process will
|
||||
// be continued when envoking brute force mode again
|
||||
sprintf((char *)entry, "%08"PRIx32"\n%08"PRIx32"\n", pwd, passwords[1]);
|
||||
rdv40_spiffs_write(LF_EM4X50BRUTE_INPUTFILE,
|
||||
entry,
|
||||
strlen((char *)entry),
|
||||
RDV40_SPIFFS_SAFETY_SAFE);
|
||||
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (state == STATE_READ) {
|
||||
DownloadLogInstructions(LF_EM4X50COLLECT_LOGFILE);
|
||||
} else if (state == STATE_BRUTE) {
|
||||
LoadDataInstructions(LF_EM4X50BRUTE_INPUTFILE);
|
||||
DownloadLogInstructions(LF_EM4X50BRUTE_LOGFILE);
|
||||
} else {
|
||||
LoadDataInstructions(LF_EM4X50SIMULATE_INPUTFILE);
|
||||
}
|
||||
|
||||
LED_D_ON();
|
||||
rdv40_spiffs_lazy_unmount();
|
||||
LED_D_OFF();
|
||||
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LEDsoff();
|
||||
Dbprintf("");
|
||||
Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
|
||||
|
||||
}
|
||||
|
|
@ -1106,16 +1106,54 @@ static void PacketReceived(PacketCommandNG *packet) {
|
|||
em4x50_write((em4x50_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X50_WRITE_PASSWORD: {
|
||||
em4x50_write_password((em4x50_data_t *)packet->data.asBytes);
|
||||
case CMD_LF_EM4X50_WRITEPWD: {
|
||||
em4x50_writepwd((em4x50_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X50_READ: {
|
||||
em4x50_read((em4x50_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X50_WIPE: {
|
||||
em4x50_wipe((em4x50_data_t *)packet->data.asBytes);
|
||||
case CMD_LF_EM4X50_BRUTE: {
|
||||
em4x50_brute((em4x50_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X50_LOGIN: {
|
||||
em4x50_login((uint32_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X50_SIM: {
|
||||
//-----------------------------------------------------------------------------
|
||||
// Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_LF) here although FPGA is not
|
||||
// involved in dealing with emulator memory. But if it is called later, it might
|
||||
// destroy the Emulator Memory.
|
||||
//-----------------------------------------------------------------------------
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
em4x50_sim((uint8_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X50_READER: {
|
||||
em4x50_reader();
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X50_ESET: {
|
||||
//-----------------------------------------------------------------------------
|
||||
// Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_LF) here although FPGA is not
|
||||
// involved in dealing with emulator memory. But if it is called later, it might
|
||||
// destroy the Emulator Memory.
|
||||
//-----------------------------------------------------------------------------
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
emlSet(packet->data.asBytes, packet->oldarg[0], packet->oldarg[1]);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X50_CHK: {
|
||||
//-----------------------------------------------------------------------------
|
||||
// Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_LF) here although FPGA is not
|
||||
// involved in dealing with emulator memory. But if it is called later, it might
|
||||
// destroy the Emulator Memory.
|
||||
//-----------------------------------------------------------------------------
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
em4x50_chk((uint8_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
#endif
|
||||
|
|
|
|||
1093
armsrc/em4x50.c
1093
armsrc/em4x50.c
File diff suppressed because it is too large
Load diff
|
|
@ -13,14 +13,19 @@
|
|||
|
||||
#include "../include/em4x50.h"
|
||||
|
||||
typedef struct {
|
||||
uint8_t sectors[34][7];
|
||||
} em4x50_tag_t;
|
||||
int em4x50_standalone_read(uint32_t *words);
|
||||
int em4x50_standalone_brute(uint32_t start, uint32_t stop, uint32_t *pwd);
|
||||
bool em4x50_sim_send_listen_window(void);
|
||||
bool em4x50_sim_send_word(uint32_t word);
|
||||
|
||||
void em4x50_info(em4x50_data_t *etd);
|
||||
void em4x50_write(em4x50_data_t *etd);
|
||||
void em4x50_write_password(em4x50_data_t *etd);
|
||||
void em4x50_writepwd(em4x50_data_t *etd);
|
||||
void em4x50_read(em4x50_data_t *etd);
|
||||
void em4x50_wipe(em4x50_data_t *etd);
|
||||
void em4x50_brute(em4x50_data_t *etd);
|
||||
void em4x50_login(uint32_t *password);
|
||||
void em4x50_sim(uint8_t *filename);
|
||||
void em4x50_reader(void);
|
||||
void em4x50_chk(uint8_t *filename);
|
||||
|
||||
#endif /* EM4X50_H */
|
||||
|
|
|
|||
|
|
@ -31,6 +31,7 @@ void lf_wait_periods(size_t periods);
|
|||
void lf_init(bool reader, bool simulate);
|
||||
void lf_finalize(void);
|
||||
size_t lf_detect_field_drop(size_t max);
|
||||
|
||||
bool lf_manchester_send_bytes(const uint8_t *frame, size_t frame_len);
|
||||
void lf_modulation(bool modulation);
|
||||
|
||||
|
|
|
|||
|
|
@ -4066,6 +4066,13 @@
|
|||
"service_provider": "PAYCULT",
|
||||
"system_integrator": "PAYCULT"
|
||||
},
|
||||
{
|
||||
"application": "Access Control (SIO)",
|
||||
"company": "HID Global",
|
||||
"mad": "0x3D01",
|
||||
"service_provider": "HID Corporation",
|
||||
"system_integrator": "HID Corporation"
|
||||
},
|
||||
{
|
||||
"application": "City transport bus, ferry, administration",
|
||||
"company": "VFJ Technology Pty Ltd",
|
||||
|
|
|
|||
|
|
@ -1696,7 +1696,7 @@ static int CmdHFiClassRestore(const char *Cmd) {
|
|||
CLIParserInit(&ctx, "hf iclass restore",
|
||||
"Restore data from dumpfile onto a iCLASS tag",
|
||||
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0\n"
|
||||
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0 --elite"
|
||||
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0 --elite\n"
|
||||
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 -k 1122334455667788 --elite\n"
|
||||
);
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <ctype.h>
|
||||
|
||||
#include "cliparser.h"
|
||||
#include "cmdparser.h" // command_t
|
||||
#include "comms.h"
|
||||
#include "cmdtrace.h"
|
||||
|
|
@ -22,28 +22,6 @@
|
|||
|
||||
static int CmdHelp(const char *Cmd);
|
||||
|
||||
static int usage_thinfilm_info(void) {
|
||||
PrintAndLogEx(NORMAL, "Usage: hf thinfilm info [h]");
|
||||
PrintAndLogEx(NORMAL, "Options:");
|
||||
PrintAndLogEx(NORMAL, " h this help");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Examples:");
|
||||
PrintAndLogEx(NORMAL, " hf thinfilm info");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int usage_thinfilm_sim(void) {
|
||||
PrintAndLogEx(NORMAL, "Usage: hf thinfilm sim [h] [d <data>]");
|
||||
PrintAndLogEx(NORMAL, "Options:");
|
||||
PrintAndLogEx(NORMAL, " h this help");
|
||||
PrintAndLogEx(NORMAL, " d <bytes> bytes to send, in hex");
|
||||
PrintAndLogEx(NORMAL, " r raw, provided bytes should include CRC");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Examples:");
|
||||
PrintAndLogEx(NORMAL, " hf thinfilm sim d B70470726f786d61726b2e636f6d");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
// Printing function based upon the code in libnfc
|
||||
// ref
|
||||
// https://github.com/nfc-tools/libnfc/blob/master/utils/nfc-barcode.c
|
||||
|
|
@ -119,25 +97,16 @@ static int print_barcode(uint8_t *barcode, const size_t barcode_len, bool verbos
|
|||
}
|
||||
|
||||
static int CmdHfThinFilmInfo(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf thinfilm info",
|
||||
"Get info from Thinfilm tags",
|
||||
"hf thinfilm info");
|
||||
|
||||
uint8_t cmdp = 0;
|
||||
bool errors = false;
|
||||
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
|
||||
switch (tolower(param_getchar(Cmd, cmdp))) {
|
||||
case 'h':
|
||||
return usage_thinfilm_info();
|
||||
default:
|
||||
PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
//Validations
|
||||
if (errors) {
|
||||
usage_thinfilm_info();
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
return infoThinFilm(true);
|
||||
}
|
||||
|
|
@ -168,45 +137,40 @@ int infoThinFilm(bool verbose) {
|
|||
}
|
||||
|
||||
static int CmdHfThinFilmSim(const char *Cmd) {
|
||||
uint8_t cmdp = 0;
|
||||
uint8_t data[512];
|
||||
int datalen = 0;
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf thinfilm sim",
|
||||
"Simulate Thinfilm tag",
|
||||
"hf thinfilm sim -d B70470726f786d61726b2e636f6d");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_str1("d", "data", "<hex>", "bytes to send"),
|
||||
arg_lit0(NULL, "raw", "raw, provided bytes should include CRC"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
|
||||
int data_len = 0;
|
||||
uint8_t data[512] = {0};
|
||||
CLIGetHexWithReturn(ctx, 1, data, &data_len);
|
||||
|
||||
bool addcrc = true;
|
||||
bool errors = false;
|
||||
|
||||
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
|
||||
switch (tolower(param_getchar(Cmd, cmdp))) {
|
||||
case 'h':
|
||||
return usage_thinfilm_sim();
|
||||
case 'd':
|
||||
// Retrieve the data
|
||||
param_gethex_ex(Cmd, cmdp + 1, data, &datalen);
|
||||
datalen >>= 1;
|
||||
cmdp += 2;
|
||||
break;
|
||||
case 'r':
|
||||
if (arg_get_lit(ctx, 2)) {
|
||||
addcrc = false;
|
||||
cmdp++;
|
||||
break;
|
||||
default:
|
||||
PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
//Validations
|
||||
if (errors || cmdp == 0 || datalen == 0 || datalen > 512) return usage_thinfilm_sim();
|
||||
if (addcrc && datalen <= 510) {
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (addcrc && data_len <= 510) {
|
||||
uint8_t b1, b2;
|
||||
compute_crc(CRC_14443_A, data, datalen, &b1, &b2);
|
||||
data[datalen++] = b2;
|
||||
data[datalen++] = b1;
|
||||
compute_crc(CRC_14443_A, data, data_len, &b1, &b2);
|
||||
data[data_len++] = b2;
|
||||
data[data_len++] = b1;
|
||||
}
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_HF_THINFILM_SIMULATE, (uint8_t *)&data, datalen);
|
||||
SendCommandNG(CMD_HF_THINFILM_SIMULATE, (uint8_t *)&data, data_len);
|
||||
PacketResponseNG resp;
|
||||
PrintAndLogEx(SUCCESS, "press pm3-button to abort simulation");
|
||||
|
||||
|
|
|
|||
|
|
@ -14,6 +14,7 @@
|
|||
#include <string.h>
|
||||
#include <ctype.h>
|
||||
#include <inttypes.h>
|
||||
#include "cliparser.h"
|
||||
#include "cmdparser.h" // command_t
|
||||
#include "comms.h"
|
||||
#include "cmdtrace.h"
|
||||
|
|
@ -393,21 +394,42 @@ static int topaz_print_NDEF(uint8_t *data, size_t maxsize) {
|
|||
}
|
||||
|
||||
static int CmdHFTopazReader(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf topaz reader",
|
||||
"Read UID from Topaz tags",
|
||||
"hf topaz reader");
|
||||
|
||||
bool verbose = true;
|
||||
char ctmp = tolower(param_getchar(Cmd, 0));
|
||||
if (ctmp == 's') verbose = false;
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0("v", "verbose", "verbose output"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
bool verbose = arg_get_lit(ctx, 1);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
return readTopazUid(verbose);
|
||||
}
|
||||
|
||||
// read a Topaz tag and print some useful information
|
||||
static int CmdHFTopazInfo(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf topaz info",
|
||||
"Get info from Topaz tags",
|
||||
"hf topaz info");
|
||||
|
||||
bool verbose = true;
|
||||
char ctmp = tolower(param_getchar(Cmd, 0));
|
||||
if (ctmp == 's') verbose = false;
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0("v", "verbose", "verbose output"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
bool verbose = arg_get_lit(ctx, 1);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
int status = readTopazUid(verbose);
|
||||
if (status != PM3_SUCCESS)
|
||||
|
|
@ -469,13 +491,34 @@ static int CmdHFTopazInfo(const char *Cmd) {
|
|||
}
|
||||
|
||||
static int CmdHFTopazSim(const char *Cmd) {
|
||||
(void)Cmd; // Cmd is not used so far
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf topaz sim",
|
||||
"Simulate a Topaz tag",
|
||||
"hf topaz sim <- Not yet implemented");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIParserFree(ctx);
|
||||
PrintAndLogEx(INFO, "not yet implemented");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int CmdHFTopazCmdRaw(const char *Cmd) {
|
||||
(void)Cmd; // Cmd is not used so far
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf topaz raw",
|
||||
"Send raw hex data to Topaz tags",
|
||||
"hf topaz raw <- Not yet implemented");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
PrintAndLogEx(INFO, "not yet implemented. Use hf 14 raw with option -T.");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
|
@ -490,6 +533,25 @@ static int CmdHFTopazList(const char *Cmd) {
|
|||
return CmdTraceList(args);
|
||||
}
|
||||
|
||||
static int CmdHFTopazSniff(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf topaz sniff",
|
||||
"Sniff Topaz reader-tag communication",
|
||||
"hf topaz sniff");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
uint8_t param = 0;
|
||||
SendCommandNG(CMD_HF_ISO14443A_SNIFF, (uint8_t *)¶m, sizeof(uint8_t));
|
||||
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int CmdHelp(const char *Cmd);
|
||||
|
||||
static command_t CommandTable[] = {
|
||||
|
|
@ -498,7 +560,7 @@ static command_t CommandTable[] = {
|
|||
{"info", CmdHFTopazInfo, IfPm3Iso14443a, "Tag information"},
|
||||
{"reader", CmdHFTopazReader, IfPm3Iso14443a, "Act like a Topaz reader"},
|
||||
{"sim", CmdHFTopazSim, IfPm3Iso14443a, "<UID> -- Simulate Topaz tag"},
|
||||
{"sniff", CmdHF14ASniff, IfPm3Iso14443a, "Sniff Topaz reader-tag communication"},
|
||||
{"sniff", CmdHFTopazSniff, IfPm3Iso14443a, "Sniff Topaz reader-tag communication"},
|
||||
{"raw", CmdHFTopazCmdRaw, IfPm3Iso14443a, "Send raw hex data to tag"},
|
||||
{NULL, NULL, 0, NULL}
|
||||
};
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -11,20 +11,27 @@
|
|||
#ifndef CMDLFEM4X50_H__
|
||||
#define CMDLFEM4X50_H__
|
||||
|
||||
#include"common.h"
|
||||
#include "em4x50.h"
|
||||
|
||||
int CmdLFEM4X50(const char *Cmd);
|
||||
|
||||
int read_em4x50_uid(void);
|
||||
bool detect_4x50_block(void);
|
||||
int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose);
|
||||
int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out);
|
||||
|
||||
int CmdEM4x50Info(const char *Cmd);
|
||||
int CmdEM4x50Write(const char *Cmd);
|
||||
int CmdEM4x50WritePassword(const char *Cmd);
|
||||
int CmdEM4x50WritePwd(const char *Cmd);
|
||||
int CmdEM4x50Read(const char *Cmd);
|
||||
int CmdEM4x50Dump(const char *Cmd);
|
||||
int CmdEM4x50Wipe(const char *Cmd);
|
||||
int CmdEM4x50Brute(const char *Cmd);
|
||||
int CmdEM4x50Login(const char *Cmd);
|
||||
int CmdEM4x50Restore(const char *Cmd);
|
||||
int CmdEM4x50Sim(const char *Cmd);
|
||||
int CmdEM4x50Reader(const char *Cmd);
|
||||
int CmdEM4x50ELoad(const char *Cmd);
|
||||
int CmdEM4x50ESave(const char *Cmd);
|
||||
int CmdEM4x50Chk(const char *Cmd);
|
||||
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -521,6 +521,20 @@ int saveFileJSONex(const char *preferredName, JSONFileType ftype, uint8_t *data,
|
|||
}
|
||||
break;
|
||||
}
|
||||
case jsfEM4x50: {
|
||||
JsonSaveStr(root, "FileType", "EM4X50");
|
||||
JsonSaveBufAsHexCompact(root, "$.Card.Protection", data + (1 * 4), 4);
|
||||
JsonSaveBufAsHexCompact(root, "$.Card.Config", data + (2 * 4), 4);
|
||||
JsonSaveBufAsHexCompact(root, "$.Card.Serial", data + (32 * 4), 4);
|
||||
JsonSaveBufAsHexCompact(root, "$.Card.UID", data + (33 * 4), 4);
|
||||
|
||||
for (size_t i = 0; i < (datalen / 4); i++) {
|
||||
char path[PATH_MAX_LENGTH] = {0};
|
||||
sprintf(path, "$.blocks.%zu", i);
|
||||
JsonSaveBufAsHexCompact(root, path, data + (i * 4), 4);
|
||||
}
|
||||
break;
|
||||
}
|
||||
case jsfMfPlusKeys: {
|
||||
JsonSaveStr(root, "FileType", "mfp");
|
||||
JsonSaveBufAsHexCompact(root, "$.Card.UID", &data[0], 7);
|
||||
|
|
@ -1139,6 +1153,27 @@ int loadFileJSONex(const char *preferredName, void *data, size_t maxdatalen, siz
|
|||
*datalen = sptr;
|
||||
}
|
||||
|
||||
if (!strcmp(ctype, "EM4X50")) {
|
||||
size_t sptr = 0;
|
||||
for (size_t i = 0; i < (maxdatalen / 4); i++) {
|
||||
if (sptr + 4 > maxdatalen) {
|
||||
retval = PM3_EMALLOC;
|
||||
goto out;
|
||||
}
|
||||
|
||||
char blocks[30] = {0};
|
||||
sprintf(blocks, "$.blocks.%zu", i);
|
||||
|
||||
size_t len = 0;
|
||||
JsonLoadBufAsHex(root, blocks, &udata[sptr], 4, &len);
|
||||
if (!len)
|
||||
break;
|
||||
|
||||
sptr += len;
|
||||
}
|
||||
*datalen = sptr;
|
||||
}
|
||||
|
||||
out:
|
||||
|
||||
if (callback != NULL) {
|
||||
|
|
|
|||
|
|
@ -66,6 +66,7 @@ typedef enum {
|
|||
jsfMfDesfireKeys,
|
||||
jsfEM4x05,
|
||||
jsfEM4x69,
|
||||
jsfEM4x50,
|
||||
} JSONFileType;
|
||||
|
||||
typedef enum {
|
||||
|
|
|
|||
|
|
@ -1146,8 +1146,7 @@ static int l_em4x50_read(lua_State *L) {
|
|||
em4x50_data_t etd;
|
||||
memset(&etd, 0x00, sizeof(em4x50_data_t));
|
||||
etd.addr_given = true;
|
||||
etd.address = addr & 0xFF;
|
||||
etd.newpwd_given = false;
|
||||
etd.addresses = addr & 0xFF;
|
||||
|
||||
// get password
|
||||
const char *p_pwd = luaL_checkstring(L, 2);
|
||||
|
|
@ -1162,31 +1161,29 @@ static int l_em4x50_read(lua_State *L) {
|
|||
|
||||
PrintAndLogEx(DEBUG, " Pwd %08X", pwd);
|
||||
|
||||
etd.password[0] = pwd & 0xFF;
|
||||
etd.password[1] = (pwd >> 8) & 0xFF;
|
||||
etd.password[2] = (pwd >> 16) & 0xFF;
|
||||
etd.password[3] = (pwd >> 24) & 0xFF;
|
||||
etd.password1 = pwd;
|
||||
etd.pwd_given = true;
|
||||
}
|
||||
|
||||
PrintAndLogEx(DEBUG, "Addr %u", etd.address);
|
||||
PrintAndLogEx(DEBUG, "Addr %u", etd.addresses & 0xFF);
|
||||
if (etd.pwd_given)
|
||||
PrintAndLogEx(DEBUG, " Pwd %s", sprint_hex(etd.password, sizeof(etd.password)));
|
||||
PrintAndLogEx(DEBUG, " Pwd %08x", etd.password1);
|
||||
|
||||
em4x50_word_t words[EM4X50_NO_WORDS];
|
||||
|
||||
int res = em4x50_read(&etd, words, false);
|
||||
int res = em4x50_read(&etd, words);
|
||||
if (res != PM3_SUCCESS) {
|
||||
return returnToLuaWithError(L, "Failed to read EM4x50 data");
|
||||
}
|
||||
|
||||
uint32_t word = (
|
||||
words[etd.address].byte[0] << 24 |
|
||||
words[etd.address].byte[1] << 16 |
|
||||
words[etd.address].byte[2] << 8 |
|
||||
words[etd.address].byte[3]
|
||||
words[etd.addresses & 0xFF].byte[0] << 24 |
|
||||
words[etd.addresses & 0xFF].byte[1] << 16 |
|
||||
words[etd.addresses & 0xFF].byte[2] << 8 |
|
||||
words[etd.addresses & 0xFF].byte[3]
|
||||
);
|
||||
lua_pushinteger(L, word);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -97,6 +97,22 @@ uint16_t reflect16(uint16_t b) {
|
|||
return v;
|
||||
}
|
||||
|
||||
uint32_t reflect32(uint32_t b) {
|
||||
// https://graphics.stanford.edu/~seander/bithacks.html#BitReverseTable
|
||||
uint32_t v = b; // 32-bit word to reverse bit order
|
||||
// swap odd and even bits
|
||||
v = ((v >> 1) & 0x55555555) | ((v & 0x55555555) << 1);
|
||||
// swap consecutive pairs
|
||||
v = ((v >> 2) & 0x33333333) | ((v & 0x33333333) << 2);
|
||||
// swap nibbles ...
|
||||
v = ((v >> 4) & 0x0F0F0F0F) | ((v & 0x0F0F0F0F) << 4);
|
||||
// swap bytes
|
||||
v = ((v >> 8) & 0x00FF00FF) | ((v & 0x00FF00FF) << 8);
|
||||
// swap 2-byte long pairs
|
||||
v = ( v >> 16 ) | ( v << 16);
|
||||
return v;
|
||||
}
|
||||
|
||||
void num_to_bytes(uint64_t n, size_t len, uint8_t *dest) {
|
||||
while (len--) {
|
||||
dest[len] = (uint8_t) n;
|
||||
|
|
|
|||
|
|
@ -47,6 +47,7 @@ void FormatVersionInformation(char *dst, int len, const char *prefix, void *vers
|
|||
uint32_t reflect(uint32_t v, int b); // used in crc.c ...
|
||||
uint8_t reflect8(uint8_t b); // dedicated 8bit reversal
|
||||
uint16_t reflect16(uint16_t b); // dedicated 16bit reversal
|
||||
uint32_t reflect32(uint32_t b); // dedicated 32bit reversal
|
||||
|
||||
void num_to_bytes(uint64_t n, size_t len, uint8_t *dest);
|
||||
uint64_t bytes_to_num(uint8_t *src, size_t len);
|
||||
|
|
|
|||
|
|
@ -141,13 +141,6 @@ hf mfu otptear
|
|||
hf mfdes enum
|
||||
hf mfdes getuid
|
||||
hf mfdes info
|
||||
hf thinfilm info
|
||||
hf thinfilm sim
|
||||
hf topaz info
|
||||
hf topaz reader
|
||||
hf topaz sim
|
||||
hf topaz sniff
|
||||
hf topaz raw
|
||||
hw connect
|
||||
hw dbg
|
||||
hw detectreader
|
||||
|
|
@ -174,11 +167,14 @@ lf simfsk
|
|||
lf simpsk
|
||||
lf simbidir
|
||||
lf sniff
|
||||
lf tune
|
||||
lf em 410x
|
||||
lf em 4x05
|
||||
lf em 4x50
|
||||
lf hitag info
|
||||
lf hitag reader
|
||||
lf hitag sim
|
||||
lf hitag sniff
|
||||
lf hitag writer
|
||||
lf hitag dump
|
||||
lf hitag cc
|
||||
|
|
|
|||
|
|
@ -34,32 +34,20 @@
|
|||
#define LAST_WORD_WRITE_INHIBITED 3 // fourth byte
|
||||
|
||||
// misc
|
||||
#define STATUS_NO_WORDS 0xfc
|
||||
#define STATUS_SUCCESS 0x2
|
||||
#define STATUS_LOGIN 0x1
|
||||
#define NO_CHARS_MAX 400
|
||||
#define TIMEOUT 2000
|
||||
#define DUMP_FILESIZE 136
|
||||
|
||||
typedef struct {
|
||||
bool addr_given;
|
||||
bool pwd_given;
|
||||
bool newpwd_given;
|
||||
uint8_t password[4];
|
||||
uint8_t new_password[4];
|
||||
uint8_t addresses[4];
|
||||
uint8_t address;
|
||||
uint8_t word[4];
|
||||
uint32_t password1;
|
||||
uint32_t password2;
|
||||
uint32_t word;
|
||||
uint32_t addresses;
|
||||
} PACKED em4x50_data_t;
|
||||
|
||||
typedef struct {
|
||||
uint8_t byte[4];
|
||||
uint8_t row_parity[4];
|
||||
uint8_t col_parity;
|
||||
uint8_t stopbit;
|
||||
bool rparity[4];
|
||||
bool cparity[8];
|
||||
bool stopparity;
|
||||
bool parity;
|
||||
} PACKED em4x50_word_t;
|
||||
|
||||
#endif /* EM4X50_H__ */
|
||||
|
|
|
|||
|
|
@ -507,9 +507,14 @@ typedef struct {
|
|||
#define CMD_LF_EM410X_WATCH 0x021C
|
||||
#define CMD_LF_EM4X50_INFO 0x0240
|
||||
#define CMD_LF_EM4X50_WRITE 0x0241
|
||||
#define CMD_LF_EM4X50_WRITE_PASSWORD 0x0242
|
||||
#define CMD_LF_EM4X50_WRITEPWD 0x0242
|
||||
#define CMD_LF_EM4X50_READ 0x0243
|
||||
#define CMD_LF_EM4X50_WIPE 0x0244
|
||||
#define CMD_LF_EM4X50_BRUTE 0x0245
|
||||
#define CMD_LF_EM4X50_LOGIN 0x0246
|
||||
#define CMD_LF_EM4X50_SIM 0x0250
|
||||
#define CMD_LF_EM4X50_READER 0x0251
|
||||
#define CMD_LF_EM4X50_ESET 0x0252
|
||||
#define CMD_LF_EM4X50_CHK 0x0253
|
||||
// Sampling configuration for LF reader/sniffer
|
||||
#define CMD_LF_SAMPLING_SET_CONFIG 0x021D
|
||||
#define CMD_LF_FSK_SIMULATE 0x021E
|
||||
|
|
|
|||
|
|
@ -391,7 +391,7 @@ while true; do
|
|||
"Fmt 26 FC: 123 Card: 1337 checksum: 10"; then break; fi
|
||||
if ! CheckExecute slow "lf T55 indala_224 test" "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala_224.pm3; lf search 1'" "Indala ID found"; then break; fi
|
||||
if ! CheckExecute slow "lf T55 indala_224 test2" "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala_224.pm3; lf indala demod'" \
|
||||
"Indala - len 224 Raw: 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5"; then break; fi
|
||||
"Indala (len 224) Raw: 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5"; then break; fi
|
||||
if ! CheckExecute slow "lf T55 io test" "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_io.pm3; lf search 1'" "IO Prox ID found"; then break; fi
|
||||
if ! CheckExecute slow "lf T55 io test2" "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_io.pm3; lf io demod'" \
|
||||
"IO Prox - XSF(01)01:01337, Raw: 007840603059cf3f (ok)"; then break; fi
|
||||
|
|
|
|||
Loading…
Reference in a new issue