proxmark3/armsrc/Standalone/lf_em4100emulV3.c

//-----------------------------------------------------------------------------
// Artyom Gnatyuk, 2020
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// LF emul V3 - This mode can simulate ID from selected slot, read ID to 
//              selected slot, write from selected slot to T5555 tag and store 
//              readed ID to flash (only RDV4). Also you can set predefined IDs
//              in any slot. 
//              To recall stored ID from flash execute:
//                  mem dump o offset l 5 p
//              where offset = 5 * selected slot
//-----------------------------------------------------------------------------
#include "standalone.h"
#include "proxmark3_arm.h"
#include "appmain.h"
#include "fpgaloader.h"
#include "lfops.h"
#include "util.h"
#include "dbprint.h"
#include "ticks.h"
#include "string.h"
#include "BigBuf.h"

#ifdef WITH_FLASH
#include "flashmem.h"
#endif

#define MAX_IND 16 // 4 LEDs - 2^4 combinations
#define CLOCK 64 //for 125kHz

// low & high - array for storage IDs. Its length must be equal.
// Predefined IDs must be stored in low[]. 
// In high[] must be nulls
uint64_t low[] = {0x565AF781C7,0x540053E4E2,0x1234567890,0,0,0,0,0,0,0,0,0,0,0,0,0};
uint32_t high[] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
uint8_t *bba,slots_count;
int buflen;

void ModInfo(void) {
    DbpString("  LF EM4100 simulate standalone V3");
}

uint64_t ReversQuads(uint64_t bits){
  uint64_t result = 0;
  for (int i = 0; i < 16; i++){
    result += ((bits >> (60 - 4 *i)) & 0xf) << (4 * i);
      }
  return result >> 24;
}

void FillBuff(uint8_t bit) {
    memset (bba + buflen, bit, CLOCK / 2);
	buflen += (CLOCK / 2);
	memset (bba + buflen, bit^1,CLOCK / 2);
	buflen += (CLOCK / 2);
}

void ConstructEM410xEmulBuf(uint64_t id) {
	
    int i, j, binary[4], parity[4];
 	buflen = 0;
    for (i = 0; i < 9; i++)
        FillBuff(1);
    parity[0] = parity[1] = parity[2] = parity[3] = 0;
    for (i = 0; i < 10; i++) {
        for (j = 3; j >= 0; j--, id /= 2)
            binary[j] = id % 2;
        for (j = 0; j < 4; j++)
			FillBuff(binary[j]);
        FillBuff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
        for (j = 0; j < 4; j++)
			parity[j] ^= binary[j];
    }
	for (j = 0; j < 4; j++)
    	FillBuff(parity[j]);
    FillBuff(0);
}

void LED_Slot(int i) {
	if (slots_count > 4) {
		LED(i % MAX_IND, 0); //binary indication, usefully for slots_count > 4
	} else {
		LED(1 << i,0); //simple indication for slots_count <=4
	}
}

void FlashLEDs(uint32_t speed, uint8_t times) {
    for (int i = 0; i < times * 2; i++) {
        LED_A_INV();
        LED_B_INV();
        LED_C_INV();
        LED_D_INV();
        SpinDelay(speed);
    }
}

#ifdef WITH_FLASH
void SaveIDtoFlash (int addr, uint64_t id) {
	uint8_t b, *ptr;
	for (int i = 0; i < 5; i++) {
		b = (uint8_t) (id >>  8 * i & 0xff);
		ptr = &b;
		Flash_WriteData(addr * 5 + 4 - i,ptr,1);
	}
}
#endif

void RunMod() {
    StandAloneMode();
    FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
	int selected = 0;
	//state 0 - select slot
	//      1 - read tag to selected slot, 
	//      2 - simulate tag from selected slot
	//      3 - write to T5555 tag
	uint8_t state = 0; 
	slots_count = sizeof(low)/sizeof(low[0]);
	bba = BigBuf_get_addr();
	LED_Slot(selected);
	for (;;) {		
		WDT_HIT();
        if (data_available()) break;
		int button_pressed = BUTTON_HELD(1000);
		SpinDelay(300);
		switch (state){
			case 0:
				// Select mode
				if (button_pressed == 1) {
					// Long press - switch to simulate mode
					SpinUp(100);
					SpinOff(100);
					LED_Slot(selected);
					state = 2;
				} else if (button_pressed < 0) {
					// Click - switch to next slot
					selected = (selected + 1) % slots_count;
					LEDsoff();
					LED_Slot(selected);
				} 
			break;
			case 1:
				// Read mode.
				if (button_pressed > 0) {
					// Long press - switch to read mode
					SpinUp(100);
					SpinOff(10);
					LED_Slot(selected);
					state = 3;
				} else if (button_pressed < 0) {
					// Click - exit to select mode
					CmdEM410xdemod(1, &high[selected], &low[selected], 0);
					FlashLEDs(100,5);
					#ifdef WITH_FLASH
					SaveIDtoFlash(selected, low[selected]);
					#endif
					state = 0;
				}
			break;
			case 2:
				// Simulate mode
				if (button_pressed > 0) {
					// Long press - switch to read mode
					SpinDown(100);
					SpinOff(10);
					LED_Slot(selected);
					state = 1;
				} else if (button_pressed < 0) {
					// Click - start simulating. Click again to exit from simelate mode
					LED_Slot(selected);
					ConstructEM410xEmulBuf(ReversQuads(low[selected]));
					FlashLEDs(100,5);
					SimulateTagLowFrequency(buflen, 0, 1);
					LED_Slot(selected);
					state = 0; // Switch to select mode
				}
			break;
			case 3:
				// Write tag mode
				if (button_pressed > 0) {
					// Long press - switch to select mode
					SpinDown(100);
					SpinOff(10);
					LED_Slot(selected);
					state = 0;
				} else if (button_pressed < 0) {
					// Click - write ID to tag
					WriteEM410x(0, (uint32_t) (low[selected] >> 32), (uint32_t) (low[selected] & 0xffffffff));
					LED_Slot(selected);
					state = 0; // Switch to select mode
				}
			break;
		}
	}
}