mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-05-12 11:18:11 -07:00
A lot of changes...
.. ntag simulation stuff from @marshmellows branch "ntag/sim" .. hf mf mifare fixes from @pwpivi. .. hw status command .. speedtest function from @pwpivi .. Viking Functionalities, (not a proper DEMOD, but a start) .. GetCountUS better precision from @pwpivi .. bin2hex, hex2bin from @holiman ... starting with getting the T55x7 CONFIGURATION_BLOCK for different clone situations. Ripped from Adam Lauries RFidler, nothing working or finished.. ... Started working with the T55x7 read command with password actually performs a write block... See Issue #136 https://github.com/Proxmark/proxmark3/issues/136 Not solved yet. ... Started add SHA256.. not working yet..
This commit is contained in:
iceman1001
@@ -9,6 +9,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
||||
- AWID26 command context added as 'lf awid' containing realtime demodulation as well as cloning/simulation based on tag numbers (Craig Young)
|
||||
- Added 'hw status'. This command makes the ARM print out some runtime information. (holiman)
|
||||
- Added 'hw ping'. This command just sends a usb packets and checks if the pm3 is responsive. Can be used to abort certain operations which supports abort over usb. (holiman)
|
||||
- Added `data hex2bin` and `data bin2hex` for command line conversion between binary and hexadecimal (holiman)
|
||||
|
||||
### Changed
|
||||
- Revised workflow for StandAloneMode14a (Craig Young)
|
||||
|
||||
+24
-15
@@ -301,39 +301,42 @@ void SendVersion(void)
|
||||
|
||||
// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
|
||||
// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
|
||||
void printUSBSpeed(uint32_t SpeedTestBufferSize)
|
||||
void printUSBSpeed(void)
|
||||
{
|
||||
Dbprintf("USB Speed:");
|
||||
Dbprintf(" Sending %d bytes payload...", SpeedTestBufferSize);
|
||||
Dbprintf(" Sending USB packets to client...");
|
||||
|
||||
#define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
|
||||
uint8_t *test_data = BigBuf_get_addr();
|
||||
uint32_t end_time;
|
||||
|
||||
uint32_t start_time = GetTickCount();
|
||||
uint32_t start_time = end_time = GetTickCount();
|
||||
uint32_t bytes_transferred = 0;
|
||||
|
||||
LED_B_ON();
|
||||
for(size_t i=0; i < SpeedTestBufferSize; i += USB_CMD_DATA_SIZE) {
|
||||
size_t len = MIN((SpeedTestBufferSize - i), USB_CMD_DATA_SIZE);
|
||||
cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,0,len,0,test_data,len);
|
||||
while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
|
||||
cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
|
||||
end_time = GetTickCount();
|
||||
bytes_transferred += USB_CMD_DATA_SIZE;
|
||||
}
|
||||
LED_B_OFF();
|
||||
|
||||
uint32_t end_time = GetTickCount();
|
||||
|
||||
Dbprintf(" Time elapsed: %dms, USB Transfer Speed PM3 -> Client = %d Bytes/s",
|
||||
end_time - start_time,
|
||||
1000* SpeedTestBufferSize / (end_time - start_time));
|
||||
Dbprintf(" Time elapsed: %dms", end_time - start_time);
|
||||
Dbprintf(" Bytes transferred: %d", bytes_transferred);
|
||||
Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
|
||||
1000 * bytes_transferred / (end_time - start_time));
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Prints runtime information about the PM3.
|
||||
**/
|
||||
void SendStatus(uint32_t SpeedTestBufferSize)
|
||||
void SendStatus(void)
|
||||
{
|
||||
BigBuf_print_status();
|
||||
Fpga_print_status();
|
||||
printConfig(); //LF Sampling config
|
||||
printUSBSpeed(SpeedTestBufferSize);
|
||||
printUSBSpeed();
|
||||
Dbprintf("Various");
|
||||
Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
|
||||
Dbprintf(" ToSendMax..........%d", ToSendMax);
|
||||
@@ -998,6 +1001,11 @@ void UsbPacketReceived(uint8_t *packet, int len)
|
||||
case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
|
||||
CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
|
||||
break;
|
||||
case CMD_VIKING_CLONE_TAG:
|
||||
CopyViKingtoT55x7(c->arg[0],c->arg[1]);
|
||||
break;
|
||||
|
||||
|
||||
#endif
|
||||
|
||||
#ifdef WITH_HITAG
|
||||
@@ -1232,8 +1240,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
|
||||
|
||||
LED_B_ON();
|
||||
uint8_t *BigBuf = BigBuf_get_addr();
|
||||
size_t len = 0;
|
||||
for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
|
||||
size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
|
||||
len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
|
||||
cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
|
||||
}
|
||||
// Trigger a finish downloading signal with an ACK frame
|
||||
@@ -1269,7 +1278,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
|
||||
SendVersion();
|
||||
break;
|
||||
case CMD_STATUS:
|
||||
SendStatus(c->arg[0]);
|
||||
SendStatus();
|
||||
break;
|
||||
case CMD_PING:
|
||||
cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
|
||||
@@ -191,6 +191,7 @@ void ReaderIClass(uint8_t arg0);
|
||||
void ReaderIClass_Replay(uint8_t arg0,uint8_t *MAC);
|
||||
void IClass_iso14443A_GetPublic(uint8_t arg0);
|
||||
|
||||
void CopyViKingtoT55x7(uint32_t block1,uint32_t block2);
|
||||
// hitag2.h
|
||||
void SnoopHitag(uint32_t type);
|
||||
void SimulateHitagTag(bool tag_mem_supplied, byte_t* data);
|
||||
|
||||
+77
-25
@@ -1047,7 +1047,7 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
|
||||
response3a[0] = sak & 0xFB;
|
||||
ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
|
||||
|
||||
uint8_t response5[] = { 0x01, 0x01, 0x01, 0x01 }; // Very random tag nonce
|
||||
uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
|
||||
uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
|
||||
// Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
|
||||
// TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
|
||||
@@ -1151,9 +1151,9 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
|
||||
} else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
|
||||
uint8_t block = receivedCmd[1];
|
||||
if ( tagType == 7 ) {
|
||||
uint8_t start = 4 * block;
|
||||
uint16_t start = 4 * block;
|
||||
|
||||
if ( block < 4 ) {
|
||||
/*if ( block < 4 ) {
|
||||
//NTAG 215
|
||||
uint8_t blockdata[50] = {
|
||||
data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
|
||||
@@ -1167,12 +1167,12 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
|
||||
0x00,0x00};
|
||||
AppendCrc14443a(blockdata+start, 16);
|
||||
EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
|
||||
} else {
|
||||
} else {*/
|
||||
uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
|
||||
emlGetMemBt( emdata, start, 16);
|
||||
AppendCrc14443a(emdata, 16);
|
||||
EmSendCmdEx(emdata, sizeof(emdata), false);
|
||||
}
|
||||
//}
|
||||
p_response = NULL;
|
||||
|
||||
} else {
|
||||
@@ -1417,9 +1417,11 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
|
||||
BigBuf_free_keep_EM();
|
||||
LED_A_OFF();
|
||||
|
||||
if (MF_DBGLEVEL >= 4){
|
||||
Dbprintf("-[ Wake ups after halt [%d]", happened);
|
||||
Dbprintf("-[ Messages after halt [%d]", happened2);
|
||||
Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -2194,7 +2196,7 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
|
||||
nttmp1 = nt1;
|
||||
nttmp2 = nt2;
|
||||
|
||||
for (i = 1; i < 32768; i++) {
|
||||
for (i = 1; i < 0xFFFF; i++) {
|
||||
nttmp1 = prng_successor(nttmp1, 1);
|
||||
if (nttmp1 == nt2) return i;
|
||||
nttmp2 = prng_successor(nttmp2, 1);
|
||||
@@ -2204,6 +2206,28 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
|
||||
return(-99999); // either nt1 or nt2 are invalid nonces
|
||||
}
|
||||
|
||||
int32_t dist_nt_ex32(uint32_t nt1, uint32_t nt2, bool *result) {
|
||||
|
||||
uint16_t i;
|
||||
uint32_t nttmp1, nttmp2;
|
||||
|
||||
if (nt1 == nt2) return 0;
|
||||
|
||||
nttmp1 = nt1;
|
||||
nttmp2 = nt2;
|
||||
|
||||
*result = true;
|
||||
for (i = 1; i < 0xFFFFFFFF; i++) {
|
||||
nttmp1 = prng_successor(nttmp1, 1);
|
||||
if (nttmp1 == nt2) return i;
|
||||
|
||||
nttmp2 = prng_successor(nttmp2, 1);
|
||||
if (nttmp2 == nt1) return -i;
|
||||
}
|
||||
|
||||
*result = false;
|
||||
return(-99999); // either nt1 or nt2 are invalid nonces
|
||||
}
|
||||
|
||||
//-----------------------------------------------------------------------------
|
||||
// Recover several bits of the cypher stream. This implements (first stages of)
|
||||
@@ -2244,6 +2268,7 @@ void ReaderMifare(bool first_try)
|
||||
byte_t par_list[8] = {0x00};
|
||||
byte_t ks_list[8] = {0x00};
|
||||
|
||||
#define PRNG_SEQUENCE_LENGTH (1 << 16);
|
||||
static uint32_t sync_time = 0;
|
||||
static uint32_t sync_cycles = 0;
|
||||
int catch_up_cycles = 0;
|
||||
@@ -2254,7 +2279,7 @@ void ReaderMifare(bool first_try)
|
||||
if (first_try) {
|
||||
mf_nr_ar3 = 0;
|
||||
sync_time = GetCountSspClk() & 0xfffffff8;
|
||||
sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
|
||||
sync_cycles = PRNG_SEQUENCE_LENGTH; //65536; //0x10000 // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
|
||||
nt_attacked = 0;
|
||||
nt = 0;
|
||||
par[0] = 0;
|
||||
@@ -2271,8 +2296,12 @@ void ReaderMifare(bool first_try)
|
||||
LED_C_OFF();
|
||||
|
||||
|
||||
#define DARKSIDE_MAX_TRIES 32 // number of tries to sync on PRNG cycle. Then give up.
|
||||
uint16_t unsuccessfull_tries = 0;
|
||||
#define MAX_UNEXPECTED_RANDOM 5 // maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
|
||||
#define MAX_SYNC_TRIES 16
|
||||
uint16_t unexpected_random = 0;
|
||||
uint16_t sync_tries = 0;
|
||||
int16_t debug_info_nr = -1;
|
||||
uint32_t debug_info[MAX_SYNC_TRIES];
|
||||
|
||||
for(uint16_t i = 0; TRUE; i++) {
|
||||
|
||||
@@ -2290,16 +2319,20 @@ void ReaderMifare(bool first_try)
|
||||
continue;
|
||||
}
|
||||
|
||||
sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
|
||||
catch_up_cycles = 0;
|
||||
if (debug_info_nr == -1) {
|
||||
sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
|
||||
catch_up_cycles = 0;
|
||||
|
||||
// if we missed the sync time already, advance to the next nonce repeat
|
||||
while(GetCountSspClk() > sync_time) {
|
||||
sync_time = (sync_time & 0xfffffff8) + sync_cycles;
|
||||
}
|
||||
// if we missed the sync time already, advance to the next nonce repeat
|
||||
while(GetCountSspClk() > sync_time) {
|
||||
sync_time = (sync_time & 0xfffffff8) + sync_cycles;
|
||||
}
|
||||
|
||||
// Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
|
||||
ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
|
||||
// Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
|
||||
ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
|
||||
} else {
|
||||
ReaderTransmit(mf_auth, sizeof(mf_auth), NULL);
|
||||
}
|
||||
|
||||
// Receive the (4 Byte) "random" nonce
|
||||
if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
|
||||
@@ -2317,19 +2350,32 @@ void ReaderMifare(bool first_try)
|
||||
int nt_distance = dist_nt(previous_nt, nt);
|
||||
if (nt_distance == 0) {
|
||||
nt_attacked = nt;
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
if (nt_distance == -99999) { // invalid nonce received
|
||||
unsuccessfull_tries++;
|
||||
if (!nt_attacked && unsuccessfull_tries > DARKSIDE_MAX_TRIES) {
|
||||
unexpected_random++;
|
||||
if (!nt_attacked && unexpected_random > MAX_UNEXPECTED_RANDOM) {
|
||||
isOK = -3; // Card has an unpredictable PRNG. Give up
|
||||
break;
|
||||
} else {
|
||||
continue; // continue trying...
|
||||
}
|
||||
}
|
||||
if (++sync_tries > MAX_SYNC_TRIES) {
|
||||
if (sync_tries > 2 * MAX_SYNC_TRIES) {
|
||||
isOK = -4; // Card's PRNG runs at an unexpected frequency or resets unexpectedly
|
||||
break;
|
||||
} else { // continue for a while, just to collect some debug info
|
||||
debug_info[++debug_info_nr] = nt_distance;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
sync_cycles = (sync_cycles - nt_distance);
|
||||
if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
|
||||
if (sync_cycles <= 0) {
|
||||
sync_cycles += PRNG_SEQUENCE_LENGTH;
|
||||
}
|
||||
if (MF_DBGLEVEL >= 3) {
|
||||
Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
}
|
||||
@@ -2401,8 +2447,15 @@ void ReaderMifare(bool first_try)
|
||||
|
||||
mf_nr_ar[3] &= 0x1F;
|
||||
|
||||
byte_t buf[28] = {0x00};
|
||||
if (isOK == -4) {
|
||||
if (MF_DBGLEVEL >= 3) {
|
||||
for(uint16_t i = 0; i < MAX_SYNC_TRIES; i++) {
|
||||
Dbprintf("collected debug info[%d] = %d\n", i, debug_info[i]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
byte_t buf[28];
|
||||
memcpy(buf + 0, uid, 4);
|
||||
num_to_bytes(nt, 4, buf + 4);
|
||||
memcpy(buf + 8, par_list, 8);
|
||||
@@ -2418,8 +2471,7 @@ void ReaderMifare(bool first_try)
|
||||
set_tracing(FALSE);
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
/**
|
||||
*MIFARE 1K simulate.
|
||||
*
|
||||
*@param flags :
|
||||
|
||||
+58
-31
@@ -90,9 +90,9 @@ void ReadTItag(void)
|
||||
// when we read a TI tag we sample the zerocross line at 2Mhz
|
||||
// TI tags modulate a 1 as 16 cycles of 123.2Khz
|
||||
// TI tags modulate a 0 as 16 cycles of 134.2Khz
|
||||
#define FSAMPLE 2000000
|
||||
#define FREQLO 123200
|
||||
#define FREQHI 134200
|
||||
#define FSAMPLE 2000000
|
||||
#define FREQLO 123200
|
||||
#define FREQHI 134200
|
||||
|
||||
signed char *dest = (signed char *)BigBuf_get_addr();
|
||||
uint16_t n = BigBuf_max_traceLen();
|
||||
@@ -1080,14 +1080,14 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
|
||||
*/
|
||||
|
||||
/* T55x7 configuration register definitions */
|
||||
#define T55x7_POR_DELAY 0x00000001
|
||||
#define T55x7_ST_TERMINATOR 0x00000008
|
||||
#define T55x7_PWD 0x00000010
|
||||
#define T55x7_POR_DELAY 0x00000001
|
||||
#define T55x7_ST_TERMINATOR 0x00000008
|
||||
#define T55x7_PWD 0x00000010
|
||||
#define T55x7_MAXBLOCK_SHIFT 5
|
||||
#define T55x7_AOR 0x00000200
|
||||
#define T55x7_PSKCF_RF_2 0
|
||||
#define T55x7_PSKCF_RF_4 0x00000400
|
||||
#define T55x7_PSKCF_RF_8 0x00000800
|
||||
#define T55x7_AOR 0x00000200
|
||||
#define T55x7_PSKCF_RF_2 0
|
||||
#define T55x7_PSKCF_RF_4 0x00000400
|
||||
#define T55x7_PSKCF_RF_8 0x00000800
|
||||
#define T55x7_MODULATION_DIRECT 0
|
||||
#define T55x7_MODULATION_PSK1 0x00001000
|
||||
#define T55x7_MODULATION_PSK2 0x00002000
|
||||
@@ -1098,17 +1098,18 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
|
||||
#define T55x7_MODULATION_FSK2a 0x00007000
|
||||
#define T55x7_MODULATION_MANCHESTER 0x00008000
|
||||
#define T55x7_MODULATION_BIPHASE 0x00010000
|
||||
#define T55x7_BITRATE_RF_8 0
|
||||
#define T55x7_BITRATE_RF_16 0x00040000
|
||||
#define T55x7_BITRATE_RF_32 0x00080000
|
||||
#define T55x7_BITRATE_RF_40 0x000C0000
|
||||
#define T55x7_BITRATE_RF_50 0x00100000
|
||||
#define T55x7_BITRATE_RF_64 0x00140000
|
||||
//#define T55x7_MODULATION_BIPHASE57 0x00011000
|
||||
#define T55x7_BITRATE_RF_8 0
|
||||
#define T55x7_BITRATE_RF_16 0x00040000
|
||||
#define T55x7_BITRATE_RF_32 0x00080000
|
||||
#define T55x7_BITRATE_RF_40 0x000C0000
|
||||
#define T55x7_BITRATE_RF_50 0x00100000
|
||||
#define T55x7_BITRATE_RF_64 0x00140000
|
||||
#define T55x7_BITRATE_RF_100 0x00180000
|
||||
#define T55x7_BITRATE_RF_128 0x001C0000
|
||||
|
||||
/* T5555 (Q5) configuration register definitions */
|
||||
#define T5555_ST_TERMINATOR 0x00000001
|
||||
#define T5555_ST_TERMINATOR 0x00000001
|
||||
#define T5555_MAXBLOCK_SHIFT 0x00000001
|
||||
#define T5555_MODULATION_MANCHESTER 0
|
||||
#define T5555_MODULATION_PSK1 0x00000010
|
||||
@@ -1118,22 +1119,23 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
|
||||
#define T5555_MODULATION_FSK2 0x00000050
|
||||
#define T5555_MODULATION_BIPHASE 0x00000060
|
||||
#define T5555_MODULATION_DIRECT 0x00000070
|
||||
#define T5555_INVERT_OUTPUT 0x00000080
|
||||
#define T5555_PSK_RF_2 0
|
||||
#define T5555_PSK_RF_4 0x00000100
|
||||
#define T5555_PSK_RF_8 0x00000200
|
||||
#define T5555_USE_PWD 0x00000400
|
||||
#define T5555_USE_AOR 0x00000800
|
||||
#define T5555_BITRATE_SHIFT 12
|
||||
#define T5555_FAST_WRITE 0x00004000
|
||||
#define T5555_PAGE_SELECT 0x00008000
|
||||
#define T5555_INVERT_OUTPUT 0x00000080
|
||||
#define T5555_PSK_RF_2 0
|
||||
#define T5555_PSK_RF_4 0x00000100
|
||||
#define T5555_PSK_RF_8 0x00000200
|
||||
#define T5555_USE_PWD 0x00000400
|
||||
#define T5555_USE_AOR 0x00000800
|
||||
#define T5555_BITRATE_SHIFT 12
|
||||
#define T5555_FAST_WRITE 0x00004000
|
||||
#define T5555_PAGE_SELECT 0x00008000
|
||||
|
||||
/*
|
||||
* Relevant times in microsecond
|
||||
* To compensate antenna falling times shorten the write times
|
||||
* and enlarge the gap ones.
|
||||
*/
|
||||
#define START_GAP 31*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc)
|
||||
|
||||
#define START_GAP 50*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc)
|
||||
#define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc)
|
||||
#define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
|
||||
#define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550
|
||||
@@ -1157,7 +1159,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
|
||||
// Write one bit to card
|
||||
void T55xxWriteBit(int bit)
|
||||
{
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
//FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
|
||||
if (!bit)
|
||||
@@ -1176,7 +1178,7 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMod
|
||||
// Set up FPGA, 125kHz
|
||||
// Wait for config.. (192+8190xPOW)x8 == 67ms
|
||||
LFSetupFPGAForADC(0, true);
|
||||
|
||||
|
||||
// Now start writting
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
SpinDelayUs(START_GAP);
|
||||
@@ -1211,7 +1213,7 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMod
|
||||
void TurnReadLFOn(){
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
|
||||
// Give it a bit of time for the resonant antenna to settle.
|
||||
SpinDelayUs(8*150);
|
||||
SpinDelayUs(300);
|
||||
}
|
||||
|
||||
|
||||
@@ -1229,7 +1231,21 @@ void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
|
||||
|
||||
// Set up FPGA, 125kHz
|
||||
// Wait for config.. (192+8190xPOW)x8 == 67ms
|
||||
LFSetupFPGAForADC(0, true);
|
||||
//LFSetupFPGAForADC(0, true);
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
|
||||
|
||||
// Connect the A/D to the peak-detected low-frequency path.
|
||||
SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
|
||||
|
||||
// Now set up the SSC to get the ADC samples that are now streaming at us.
|
||||
FpgaSetupSsc();
|
||||
|
||||
// Give it a bit of time for the resonant antenna to settle.
|
||||
//SpinDelayUs(8*200); //192FC
|
||||
SpinDelay(50);
|
||||
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
SpinDelayUs(START_GAP);
|
||||
|
||||
@@ -2098,3 +2114,14 @@ void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
|
||||
LED_D_OFF();
|
||||
}
|
||||
void CopyViKingtoT55x7(uint32_t block1,uint32_t block2)
|
||||
{
|
||||
LED_D_ON();
|
||||
T55xxWriteBlock(block1,1,0,0);
|
||||
T55xxWriteBlock(block2,2,0,0);
|
||||
|
||||
T55xxWriteBlock(T55x7_MODULATION_MANCHESTER | T55x7_BITRATE_RF_32 | 2 << T5555_MAXBLOCK_SHIFT,0,0,1);
|
||||
LED_D_OFF();
|
||||
DbpString("DONE!");
|
||||
}
|
||||
|
||||
|
||||
+2
-1
@@ -908,7 +908,8 @@ void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
|
||||
|
||||
void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
|
||||
emlSetMem(datain, arg0, arg1); // data, block num, blocks count
|
||||
//emlSetMem(datain, arg0, arg1); // data, block num, blocks count
|
||||
emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width
|
||||
}
|
||||
|
||||
void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
|
||||
|
||||
+6
-2
@@ -272,7 +272,7 @@ int mifare_ul_ev1_auth(uint8_t *keybytes, uint8_t *pack){
|
||||
if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
|
||||
Dbprintf("EV1 Auth : %02x%02x%02x%02x", key[0], key[1], key[2], key[3]);
|
||||
len = mifare_sendcmd(0x1B, key, sizeof(key), resp, respPar, NULL);
|
||||
//len = mifare_sendcmd_short_mfuev1auth(NULL, 0, 0x1B, key, resp, respPar, NULL);
|
||||
|
||||
if (len != 4) {
|
||||
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", resp[0], len);
|
||||
return 0;
|
||||
@@ -556,8 +556,12 @@ uint8_t FirstBlockOfSector(uint8_t sectorNo)
|
||||
|
||||
// work with emulator memory
|
||||
void emlSetMem(uint8_t *data, int blockNum, int blocksCount) {
|
||||
emlSetMem_xt(data, blockNum, blocksCount, 16);
|
||||
}
|
||||
|
||||
void emlSetMem_xt(uint8_t *data, int blockNum, int blocksCount, int blockBtWidth) {
|
||||
uint8_t* emCARD = BigBuf_get_EM_addr();
|
||||
memcpy(emCARD + blockNum * 16, data, blocksCount * 16);
|
||||
memcpy(emCARD + blockNum * blockBtWidth, data, blocksCount * blockBtWidth);
|
||||
}
|
||||
|
||||
void emlGetMem(uint8_t *data, int blockNum, int blocksCount) {
|
||||
|
||||
@@ -90,6 +90,7 @@ uint8_t FirstBlockOfSector(uint8_t sectorNo);
|
||||
// emulator functions
|
||||
void emlClearMem(void);
|
||||
void emlSetMem(uint8_t *data, int blockNum, int blocksCount);
|
||||
void emlSetMem_xt(uint8_t *data, int blockNum, int blocksCount, int blockBtWidth);
|
||||
void emlGetMem(uint8_t *data, int blockNum, int blocksCount);
|
||||
void emlGetMemBt(uint8_t *data, int bytePtr, int byteCount);
|
||||
uint64_t emlGetKey(int sectorNum, int keyType);
|
||||
|
||||
+3
-1
@@ -345,7 +345,9 @@ void StartCountUS()
|
||||
}
|
||||
|
||||
uint32_t RAMFUNC GetCountUS(){
|
||||
return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV / 15) * 10);
|
||||
//return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV / 15) * 10);
|
||||
// By suggestion from PwPiwi, http://www.proxmark.org/forum/viewtopic.php?pid=17548#p17548
|
||||
return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV * 2) / 3);
|
||||
}
|
||||
|
||||
static uint32_t GlobalUsCounter = 0;
|
||||
|
||||
+3
-1
@@ -8,7 +8,9 @@
|
||||
|
||||
# DO NOT use thumb mode in the phase 1 bootloader since that generates a section with glue code
|
||||
ARMSRC =
|
||||
THUMBSRC = cmd.c usb_cdc.c bootrom.c
|
||||
THUMBSRC = cmd.c \
|
||||
usb_cdc.c \
|
||||
bootrom.c
|
||||
ASMSRC = ram-reset.s flash-reset.s
|
||||
|
||||
## There is a strange bug with the linker: Sometimes it will not emit the glue to call
|
||||
|
||||
@@ -119,6 +119,7 @@ CMDSRCS = nonce2key/crapto1.c\
|
||||
cmdlfem4x.c \
|
||||
cmdlfhitag.c \
|
||||
cmdlfti.c \
|
||||
cmdlfviking.c\
|
||||
cmdparser.c \
|
||||
cmdmain.c \
|
||||
cmdlft55xx.c \
|
||||
@@ -130,6 +131,7 @@ CMDSRCS = nonce2key/crapto1.c\
|
||||
aes.c\
|
||||
protocols.c\
|
||||
sha1.c\
|
||||
sha256.c\
|
||||
cmdcrc.c\
|
||||
reveng/reveng.c\
|
||||
reveng/cli.c\
|
||||
|
||||
+145
-5
@@ -24,6 +24,7 @@
|
||||
#include "usb_cmd.h"
|
||||
#include "crc.h"
|
||||
#include "crc16.h"
|
||||
#include "loclass/cipherutils.h"
|
||||
|
||||
uint8_t DemodBuffer[MAX_DEMOD_BUF_LEN];
|
||||
uint8_t g_debugMode=0;
|
||||
@@ -1881,6 +1882,54 @@ int CmdRawDemod(const char *Cmd)
|
||||
return ans;
|
||||
}
|
||||
|
||||
int AmVikingDecode(const uint8_t *id){
|
||||
// searching the buffer for the id
|
||||
//uint8_t id_bits[32];
|
||||
// convert 4 bytes of id to 32 bits present in 32 bytes data;
|
||||
//bytes_to_bits(id,4,id_bits,sizeof(id_bits));
|
||||
|
||||
//print_arraybinary(id_bits,sizeof(id_bits));
|
||||
PrintAndLog(" binary: %s", printBits(4, id) );
|
||||
|
||||
//size_t idx = 0;
|
||||
size_t BitLen = DemodBufferLen;
|
||||
uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
|
||||
memcpy(BitStream, DemodBuffer, BitLen);
|
||||
|
||||
// if (VikingDecode(BitStream,BitLen,&idx,id_bits,sizeof(id_bits)) == 1)
|
||||
// {
|
||||
// setDemodBuf(BitStream,64, idx);
|
||||
// PrintAndLog("Found Viking tag\n");
|
||||
// CmdPrintDemodBuff("x");
|
||||
// }
|
||||
// else
|
||||
// {
|
||||
// PrintAndLog("Not found Viking tag\n");
|
||||
// }
|
||||
return 0;
|
||||
}
|
||||
int AMVikingDemod(const uint8_t *id){
|
||||
// demod am clock 32 fail
|
||||
if (!ASKDemod("32",g_debugMode,false,1))
|
||||
return 0;
|
||||
// search for the card id from bitstream.
|
||||
return AmVikingDecode(id);
|
||||
}
|
||||
//by Gusto
|
||||
// takes 1 argument <8 bytes of Hex number on the card
|
||||
// print binary found and saves in grapbuffer for further commands
|
||||
int CmdAMVikingDemod(const char *Cmd){
|
||||
uint8_t id[4];
|
||||
if (param_gethex(Cmd,0,id,8) == 1)
|
||||
{
|
||||
PrintAndLog("Usage: data vikingdemod CardID 8 bytes of hex number");
|
||||
return 0;
|
||||
}
|
||||
PrintAndLog("Card ID : %02X%02X%02X%02X\n",id[0],id[1],id[2],id[3]);
|
||||
// try to demod AMViking
|
||||
return AMVikingDemod(id);
|
||||
}
|
||||
|
||||
int CmdGrid(const char *Cmd)
|
||||
{
|
||||
sscanf(Cmd, "%i %i", &PlotGridX, &PlotGridY);
|
||||
@@ -1954,11 +2003,6 @@ int CmdHpf(const char *Cmd)
|
||||
RepaintGraphWindow();
|
||||
return 0;
|
||||
}
|
||||
typedef struct {
|
||||
uint8_t * buffer;
|
||||
uint32_t numbits;
|
||||
uint32_t position;
|
||||
} BitstreamOut;
|
||||
|
||||
bool _headBit( BitstreamOut *stream)
|
||||
{
|
||||
@@ -2276,6 +2320,99 @@ int CmdZerocrossings(const char *Cmd)
|
||||
return 0;
|
||||
}
|
||||
|
||||
int usage_data_bin2hex(){
|
||||
PrintAndLog("Usage: data bin2hex <binary_digits>");
|
||||
PrintAndLog(" This function will ignore all characters not 1 or 0 (but stop reading on whitespace)");
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Utility for conversion via cmdline.
|
||||
* @param Cmd
|
||||
* @return
|
||||
*/
|
||||
int Cmdbin2hex(const char *Cmd)
|
||||
{
|
||||
int bg =0, en =0;
|
||||
if(param_getptr(Cmd, &bg, &en, 0))
|
||||
{
|
||||
return usage_data_bin2hex();
|
||||
}
|
||||
//Number of digits supplied as argument
|
||||
size_t length = en - bg +1;
|
||||
size_t bytelen = (length+7) / 8;
|
||||
uint8_t* arr = (uint8_t *) malloc(bytelen);
|
||||
memset(arr, 0, bytelen);
|
||||
BitstreamOut bout = { arr, 0, 0 };
|
||||
|
||||
for(; bg <= en ;bg++)
|
||||
{
|
||||
char c = Cmd[bg];
|
||||
if( c == '1') pushBit(&bout, 1);
|
||||
else if( c == '0') pushBit(&bout, 0);
|
||||
else PrintAndLog("Ignoring '%c'", c);
|
||||
}
|
||||
|
||||
if(bout.numbits % 8 != 0)
|
||||
{
|
||||
printf("[padded with %d zeroes]\n", 8-(bout.numbits % 8));
|
||||
}
|
||||
|
||||
//Uses printf instead of PrintAndLog since the latter
|
||||
// adds linebreaks to each printout - this way was more convenient since we don't have to
|
||||
// allocate a string and write to that first...
|
||||
for(size_t x = 0; x < bytelen ; x++)
|
||||
{
|
||||
printf("%02X", arr[x]);
|
||||
}
|
||||
printf("\n");
|
||||
free(arr);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int usage_data_hex2bin(){
|
||||
|
||||
PrintAndLog("Usage: data bin2hex <binary_digits>");
|
||||
PrintAndLog(" This function will ignore all non-hexadecimal characters (but stop reading on whitespace)");
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
int Cmdhex2bin(const char *Cmd)
|
||||
{
|
||||
int bg =0, en =0;
|
||||
if(param_getptr(Cmd, &bg, &en, 0))
|
||||
{
|
||||
return usage_data_hex2bin();
|
||||
}
|
||||
|
||||
|
||||
while(bg <= en )
|
||||
{
|
||||
char x = Cmd[bg++];
|
||||
// capitalize
|
||||
if (x >= 'a' && x <= 'f')
|
||||
x -= 32;
|
||||
// convert to numeric value
|
||||
if (x >= '0' && x <= '9')
|
||||
x -= '0';
|
||||
else if (x >= 'A' && x <= 'F')
|
||||
x -= 'A' - 10;
|
||||
else
|
||||
continue;
|
||||
|
||||
//Uses printf instead of PrintAndLog since the latter
|
||||
// adds linebreaks to each printout - this way was more convenient since we don't have to
|
||||
// allocate a string and write to that first...
|
||||
|
||||
for(int i= 0 ; i < 4 ; ++i)
|
||||
printf("%d",(x >> (3 - i)) & 1);
|
||||
}
|
||||
printf("\n");
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static command_t CommandTable[] =
|
||||
{
|
||||
{"help", CmdHelp, 1, "This help"},
|
||||
@@ -2284,12 +2421,14 @@ static command_t CommandTable[] =
|
||||
{"askgproxiidemod", CmdG_Prox_II_Demod, 1, "Demodulate a G Prox II tag from GraphBuffer"},
|
||||
{"autocorr", CmdAutoCorr, 1, "[window length] [g] -- Autocorrelation over window - g to save back to GraphBuffer (overwrite)"},
|
||||
{"biphaserawdecode",CmdBiphaseDecodeRaw,1, "[offset] [invert<0|1>] [maxErr] -- Biphase decode bin stream in DemodBuffer (offset = 0|1 bits to shift the decode start)"},
|
||||
{"bin2hex", Cmdbin2hex, 1, "bin2hex <digits> -- Converts binary to hexadecimal"},
|
||||
{"bitsamples", CmdBitsamples, 0, "Get raw samples as bitstring"},
|
||||
{"buffclear", CmdBuffClear, 1, "Clear sample buffer and graph window"},
|
||||
{"dec", CmdDec, 1, "Decimate samples"},
|
||||
{"detectclock", CmdDetectClockRate, 1, "[modulation] Detect clock rate of wave in GraphBuffer (options: 'a','f','n','p' for ask, fsk, nrz, psk respectively)"},
|
||||
{"fdxbdemod", CmdFDXBdemodBI , 1, "Demodulate a FDX-B ISO11784/85 Biphase tag from GraphBuffer"},
|
||||
{"fskawiddemod", CmdFSKdemodAWID, 1, "Demodulate an AWID FSK tag from GraphBuffer"},
|
||||
{"vikingdemod", CmdAMVikingDemod, 1, "Demodulate a Viking AM tag from GraphBuffer"},
|
||||
//{"fskfcdetect", CmdFSKfcDetect, 1, "Try to detect the Field Clock of an FSK wave"},
|
||||
{"fskhiddemod", CmdFSKdemodHID, 1, "Demodulate a HID FSK tag from GraphBuffer"},
|
||||
{"fskiodemod", CmdFSKdemodIO, 1, "Demodulate an IO Prox FSK tag from GraphBuffer"},
|
||||
@@ -2298,6 +2437,7 @@ static command_t CommandTable[] =
|
||||
{"getbitstream", CmdGetBitStream, 1, "Convert GraphBuffer's >=1 values to 1 and <1 to 0"},
|
||||
{"grid", CmdGrid, 1, "<x> <y> -- overlay grid on graph window, use zero value to turn off either"},
|
||||
{"hexsamples", CmdHexsamples, 0, "<bytes> [<offset>] -- Dump big buffer as hex bytes"},
|
||||
{"hex2bin", Cmdhex2bin, 1, "hex2bin <hexadecimal> -- Converts hexadecimal to binary"},
|
||||
{"hide", CmdHide, 1, "Hide graph window"},
|
||||
{"hpf", CmdHpf, 1, "Remove DC offset from trace"},
|
||||
{"load", CmdLoad, 1, "<filename> -- Load trace (to graph window"},
|
||||
|
||||
+2
-1
@@ -67,7 +67,8 @@ int PSKDemod(const char *Cmd, bool verbose);
|
||||
int NRZrawDemod(const char *Cmd, bool verbose);
|
||||
void printEM410x(uint32_t hi, uint64_t id);
|
||||
int getSamples(const char *Cmd, bool silent);
|
||||
|
||||
int AMVikingDemod(const uint8_t *cardid);
|
||||
int CmdAMVikingDemod(const char *cmd);
|
||||
|
||||
#define MAX_DEMOD_BUF_LEN (1024*128)
|
||||
extern uint8_t DemodBuffer[MAX_DEMOD_BUF_LEN];
|
||||
|
||||
+1
-1
@@ -531,7 +531,7 @@ uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, ui
|
||||
oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
|
||||
}
|
||||
uint8_t parityBits = parityBytes[j>>3];
|
||||
if (protocol != ISO_14443B && isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
|
||||
if (protocol != ISO_14443B && (isResponse || protocol == ISO_14443A) && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
|
||||
snprintf(line[j/16]+(( j % 16) * 4),110, "%02x! ", frame[j]);
|
||||
|
||||
} else {
|
||||
|
||||
+11
-9
@@ -34,7 +34,7 @@ start:
|
||||
SendCommand(&c);
|
||||
|
||||
//flush queue
|
||||
while (ukbhit()) getchar();
|
||||
while (ukbhit()) getchar();
|
||||
|
||||
// wait cycle
|
||||
while (true) {
|
||||
@@ -59,6 +59,7 @@ start:
|
||||
case -1 : PrintAndLog("Button pressed. Aborted.\n"); break;
|
||||
case -2 : PrintAndLog("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break;
|
||||
case -3 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator is not predictable).\n"); break;
|
||||
case -4 : PrintAndLog("The card's random number generator is vulnerable but behaves somewhat weird (Mifare clone?). This needs to be fixed.\n"); break;
|
||||
default: ;
|
||||
}
|
||||
break;
|
||||
@@ -80,7 +81,7 @@ start:
|
||||
} else {
|
||||
isOK = 0;
|
||||
printf("------------------------------------------------------------------\n");
|
||||
PrintAndLog("Found valid key:%012"llx" \n", r_key);
|
||||
PrintAndLog("Found valid key: %012"llx" \n", r_key);
|
||||
}
|
||||
|
||||
PrintAndLog("");
|
||||
@@ -1210,13 +1211,13 @@ int CmdHF14AMfELoad(const char *Cmd)
|
||||
uint8_t buf8[64] = {0x00};
|
||||
int i, len, blockNum, numBlocks;
|
||||
int nameParamNo = 1;
|
||||
|
||||
uint8_t blockWidth = 32;
|
||||
char ctmp = param_getchar(Cmd, 0);
|
||||
|
||||
if ( ctmp == 'h' || ctmp == 0x00) {
|
||||
PrintAndLog("It loads emul dump from the file `filename.eml`");
|
||||
PrintAndLog("Usage: hf mf eload [card memory] <file name w/o `.eml`>");
|
||||
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
|
||||
PrintAndLog(" [card memory]: 0 = 320 bytes (Mifare Mini), 1 = 1K (default), 2 = 2K, 4 = 4K, u = UL");
|
||||
PrintAndLog("");
|
||||
PrintAndLog(" sample: hf mf eload filename");
|
||||
PrintAndLog(" hf mf eload 4 filename");
|
||||
@@ -1229,6 +1230,8 @@ int CmdHF14AMfELoad(const char *Cmd)
|
||||
case '\0': numBlocks = 16*4; break;
|
||||
case '2' : numBlocks = 32*4; break;
|
||||
case '4' : numBlocks = 256; break;
|
||||
case 'U' : // fall through
|
||||
case 'u' : numBlocks = 255; blockWidth = 8; break;
|
||||
default: {
|
||||
numBlocks = 16*4;
|
||||
nameParamNo = 0;
|
||||
@@ -1263,19 +1266,18 @@ int CmdHF14AMfELoad(const char *Cmd)
|
||||
return 2;
|
||||
}
|
||||
|
||||
if (strlen(buf) < 32){
|
||||
if (strlen(buf) < blockWidth){
|
||||
if(strlen(buf) && feof(f))
|
||||
break;
|
||||
PrintAndLog("File content error. Block data must include 32 HEX symbols");
|
||||
PrintAndLog("File content error. Block data must include %d HEX symbols", blockWidth);
|
||||
fclose(f);
|
||||
return 2;
|
||||
}
|
||||
|
||||
for (i = 0; i < 32; i += 2) {
|
||||
for (i = 0; i < blockWidth; i += 2) {
|
||||
sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
|
||||
}
|
||||
|
||||
if (mfEmlSetMem(buf8, blockNum, 1)) {
|
||||
if (mfEmlSetMem_xt(buf8, blockNum, 1, blockWidth/2)) {
|
||||
PrintAndLog("Cant set emul block: %3d", blockNum);
|
||||
fclose(f);
|
||||
return 3;
|
||||
|
||||
+16
-5
@@ -58,12 +58,21 @@ uint8_t default_pwd_pack[KEYS_PWD_COUNT][4] = {
|
||||
};
|
||||
|
||||
#define MAX_UL_TYPES 18
|
||||
uint32_t UL_TYPES_ARRAY[MAX_UL_TYPES] = {UNKNOWN, UL, UL_C, UL_EV1_48, UL_EV1_128, NTAG, NTAG_203,
|
||||
NTAG_210, NTAG_212, NTAG_213, NTAG_215, NTAG_216, MY_D, MY_D_NFC, MY_D_MOVE, MY_D_MOVE_NFC, MY_D_MOVE_LEAN, FUDAN_UL};
|
||||
uint32_t UL_TYPES_ARRAY[MAX_UL_TYPES] = {
|
||||
UNKNOWN, UL, UL_C,
|
||||
UL_EV1_48, UL_EV1_128, NTAG,
|
||||
NTAG_203, NTAG_210, NTAG_212,
|
||||
NTAG_213, NTAG_215, NTAG_216,
|
||||
MY_D, MY_D_NFC, MY_D_MOVE,
|
||||
MY_D_MOVE_NFC, MY_D_MOVE_LEAN, FUDAN_UL};
|
||||
|
||||
uint8_t UL_MEMORY_ARRAY[MAX_UL_TYPES] = {MAX_UL_BLOCKS, MAX_UL_BLOCKS, MAX_ULC_BLOCKS, MAX_ULEV1a_BLOCKS,
|
||||
MAX_ULEV1b_BLOCKS, MAX_NTAG_203, MAX_NTAG_203, MAX_NTAG_210, MAX_NTAG_212, MAX_NTAG_213,
|
||||
MAX_NTAG_215, MAX_NTAG_216, MAX_UL_BLOCKS, MAX_MY_D_NFC, MAX_MY_D_MOVE, MAX_MY_D_MOVE, MAX_MY_D_MOVE_LEAN, MAX_UL_BLOCKS};
|
||||
uint8_t UL_MEMORY_ARRAY[MAX_UL_TYPES] = {
|
||||
MAX_UL_BLOCKS, MAX_UL_BLOCKS, MAX_ULC_BLOCKS,
|
||||
MAX_ULEV1a_BLOCKS, MAX_ULEV1b_BLOCKS, MAX_NTAG_203,
|
||||
MAX_NTAG_203, MAX_NTAG_210, MAX_NTAG_212,
|
||||
MAX_NTAG_213, MAX_NTAG_215, MAX_NTAG_216,
|
||||
MAX_UL_BLOCKS, MAX_MY_D_NFC, MAX_MY_D_MOVE,
|
||||
MAX_MY_D_MOVE, MAX_MY_D_MOVE_LEAN, MAX_UL_BLOCKS};
|
||||
|
||||
|
||||
static int CmdHelp(const char *Cmd);
|
||||
@@ -799,6 +808,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
|
||||
}
|
||||
}
|
||||
|
||||
// Read signature
|
||||
if ((tagtype & (UL_EV1_48 | UL_EV1_128 | NTAG_213 | NTAG_215 | NTAG_216 | NTAG_I2C_1K | NTAG_I2C_2K ))) {
|
||||
uint8_t ulev1_signature[32] = {0x00};
|
||||
status = ulev1_readSignature( ulev1_signature, sizeof(ulev1_signature));
|
||||
@@ -814,6 +824,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
|
||||
}
|
||||
}
|
||||
|
||||
// Get Version
|
||||
if ((tagtype & (UL_EV1_48 | UL_EV1_128 | NTAG_210 | NTAG_212 | NTAG_213 | NTAG_215 | NTAG_216 | NTAG_I2C_1K | NTAG_I2C_2K))) {
|
||||
uint8_t version[10] = {0x00};
|
||||
status = ulev1_getVersion(version, sizeof(version));
|
||||
|
||||
+23
-25
@@ -405,6 +405,7 @@ int CmdTune(const char *Cmd)
|
||||
|
||||
int CmdVersion(const char *Cmd)
|
||||
{
|
||||
|
||||
clearCommandBuffer();
|
||||
UsbCommand c = {CMD_VERSION};
|
||||
static UsbCommand resp = {0, {0, 0, 0}};
|
||||
@@ -430,13 +431,11 @@ int CmdStatus(const char *Cmd)
|
||||
{
|
||||
uint8_t speed_test_buffer[USB_CMD_DATA_SIZE];
|
||||
sample_buf = speed_test_buffer;
|
||||
#define USB_SPEED_TEST_SIZE (100*USB_CMD_DATA_SIZE)
|
||||
|
||||
clearCommandBuffer();
|
||||
UsbCommand c = {CMD_STATUS, {USB_SPEED_TEST_SIZE}};
|
||||
UsbCommand c = {CMD_STATUS};
|
||||
SendCommand(&c);
|
||||
UsbCommand resp;
|
||||
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
|
||||
if (!WaitForResponseTimeout(CMD_ACK,&c,1900)) {
|
||||
PrintAndLog("Status command failed. USB Speed Test timed out");
|
||||
}
|
||||
return 0;
|
||||
@@ -449,40 +448,39 @@ int CmdPing(const char *Cmd)
|
||||
UsbCommand resp;
|
||||
UsbCommand c = {CMD_PING};
|
||||
SendCommand(&c);
|
||||
if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
|
||||
if (WaitForResponseTimeout(CMD_ACK,&resp,1000))
|
||||
PrintAndLog("Ping successfull");
|
||||
}else{
|
||||
PrintAndLog("Ping failed");
|
||||
}
|
||||
return 0;
|
||||
else
|
||||
PrintAndLog("Ping failed");
|
||||
return 0;
|
||||
}
|
||||
|
||||
static command_t CommandTable[] =
|
||||
{
|
||||
{"help", CmdHelp, 1, "This help"},
|
||||
{"detectreader", CmdDetectReader,0, "['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)"},
|
||||
{"fpgaoff", CmdFPGAOff, 0, "Set FPGA off"},
|
||||
{"lcd", CmdLCD, 0, "<HEX command> <count> -- Send command/data to LCD"},
|
||||
{"lcdreset", CmdLCDReset, 0, "Hardware reset LCD"},
|
||||
{"readmem", CmdReadmem, 0, "[address] -- Read memory at decimal address from flash"},
|
||||
{"reset", CmdReset, 0, "Reset the Proxmark3"},
|
||||
{"setlfdivisor", CmdSetDivisor, 0, "<19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)"},
|
||||
{"setmux", CmdSetMux, 0, "<loraw|hiraw|lopkd|hipkd> -- Set the ADC mux to a specific value"},
|
||||
{"tune", CmdTune, 0, "Measure antenna tuning"},
|
||||
{"version", CmdVersion, 0, "Show version information about the connected Proxmark"},
|
||||
{"help", CmdHelp, 1, "This help"},
|
||||
{"detectreader", CmdDetectReader,0, "['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)"},
|
||||
{"fpgaoff", CmdFPGAOff, 0, "Set FPGA off"},
|
||||
{"lcd", CmdLCD, 0, "<HEX command> <count> -- Send command/data to LCD"},
|
||||
{"lcdreset", CmdLCDReset, 0, "Hardware reset LCD"},
|
||||
{"readmem", CmdReadmem, 0, "[address] -- Read memory at decimal address from flash"},
|
||||
{"reset", CmdReset, 0, "Reset the Proxmark3"},
|
||||
{"setlfdivisor", CmdSetDivisor, 0, "<19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)"},
|
||||
{"setmux", CmdSetMux, 0, "<loraw|hiraw|lopkd|hipkd> -- Set the ADC mux to a specific value"},
|
||||
{"tune", CmdTune, 0, "Measure antenna tuning"},
|
||||
{"version", CmdVersion, 0, "Show version information about the connected Proxmark"},
|
||||
{"status", CmdStatus, 0, "Show runtime status information about the connected Proxmark"},
|
||||
{"ping", CmdPing, 0, "Test if the pm3 is responsive"},
|
||||
{NULL, NULL, 0, NULL}
|
||||
{NULL, NULL, 0, NULL}
|
||||
};
|
||||
|
||||
int CmdHW(const char *Cmd)
|
||||
{
|
||||
CmdsParse(CommandTable, Cmd);
|
||||
return 0;
|
||||
CmdsParse(CommandTable, Cmd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int CmdHelp(const char *Cmd)
|
||||
{
|
||||
CmdsHelp(CommandTable);
|
||||
return 0;
|
||||
CmdsHelp(CommandTable);
|
||||
return 0;
|
||||
}
|
||||
|
||||
+58
-11
@@ -30,22 +30,69 @@
|
||||
#include "cmdlfpcf7931.h"
|
||||
#include "cmdlfio.h"
|
||||
#include "lfdemod.h"
|
||||
|
||||
#include "cmdlfviking.h"
|
||||
static int CmdHelp(const char *Cmd);
|
||||
|
||||
|
||||
int usage_lf_cmdread()
|
||||
{
|
||||
PrintAndLog("Usage: lf cmdread <delay off> <zero> <one> <cmdbytes> [H] ");
|
||||
PrintAndLog("Options: ");
|
||||
PrintAndLog(" h This help");
|
||||
PrintAndLog(" L Low frequency (125 KHz)");
|
||||
PrintAndLog(" H High frequency (134 KHz)");
|
||||
PrintAndLog(" H delay OFF");
|
||||
PrintAndLog(" H time period ZERO");
|
||||
PrintAndLog(" H time period ONE");
|
||||
PrintAndLog("Examples:");
|
||||
PrintAndLog(" lf cmdread 80 100 200 11000");
|
||||
PrintAndLog(" lf cmdread 80 100 100 11000 H");
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* send a command before reading */
|
||||
int CmdLFCommandRead(const char *Cmd)
|
||||
{
|
||||
static char dummy[3];
|
||||
static char dummy[3] = {0x20,0x00,0x00};
|
||||
bool errors = FALSE;
|
||||
uint8_t divisor = 0; //125khz
|
||||
uint8_t cmdp =0;
|
||||
while(param_getchar(Cmd, cmdp) != 0x00)
|
||||
{
|
||||
switch(param_getchar(Cmd, cmdp))
|
||||
{
|
||||
case 'h':
|
||||
return usage_lf_cmdread();
|
||||
case 'H':
|
||||
divisor = 88;
|
||||
cmdp++;
|
||||
break;
|
||||
case 'a':
|
||||
//param_getchar(Cmd, cmdp+1) == '1';
|
||||
cmdp+=2;
|
||||
break;
|
||||
default:
|
||||
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = 1;
|
||||
break;
|
||||
}
|
||||
if(errors) break;
|
||||
}
|
||||
// No args
|
||||
if(cmdp == 0) errors = 1;
|
||||
|
||||
dummy[0]= ' ';
|
||||
//Validations
|
||||
if(errors) return usage_lf_cmdread();
|
||||
|
||||
UsbCommand c = {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K};
|
||||
sscanf(Cmd, "%"lli" %"lli" %"lli" %s %s", &c.arg[0], &c.arg[1], &c.arg[2],(char*)(&c.d.asBytes),(char*)(&dummy+1));
|
||||
// in case they specified 'h'
|
||||
strcpy((char *)&c.d.asBytes + strlen((char *)c.d.asBytes), dummy);
|
||||
|
||||
UsbCommand c = {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K};
|
||||
sscanf(Cmd, "%"lli" %"lli" %"lli" %s %s", &c.arg[0], &c.arg[1], &c.arg[2],(char*)(&c.d.asBytes),(char*)(&dummy+1));
|
||||
// in case they specified 'h'
|
||||
strcpy((char *)&c.d.asBytes + strlen((char *)c.d.asBytes), dummy);
|
||||
SendCommand(&c);
|
||||
return 0;
|
||||
PrintAndLog("ICE: %d %s -- %s", strlen((char *)c.d.asBytes) ,dummy, c.d.asBytes);
|
||||
clearCommandBuffer();
|
||||
SendCommand(&c);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int CmdFlexdemod(const char *Cmd)
|
||||
@@ -1074,7 +1121,7 @@ int CmdLFfind(const char *Cmd)
|
||||
|
||||
ans=CmdG_Prox_II_Demod("");
|
||||
if (ans>0) {
|
||||
PrintAndLog("\nValid G Prox II ID Found!");
|
||||
PrintAndLog("\nValid Guardall G-Prox II ID Found!");
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -1165,7 +1212,7 @@ static command_t CommandTable[] =
|
||||
{"pcf7931", CmdLFPCF7931, 1, "{ PCF7931 RFIDs... }"},
|
||||
{"ti", CmdLFTI, 1, "{ TI RFIDs... }"},
|
||||
{"t55xx", CmdLFT55XX, 1, "{ T55X7 RFIDs... }"},
|
||||
|
||||
{"viking", CmdLFViking, 1, "{ Viking RFIDs... }"},
|
||||
{"config", CmdLFSetConfig, 0, "Set config for LF sampling, bit/sample, decimation, frequency"},
|
||||
|
||||
{"cmdread", CmdLFCommandRead, 0, "<off period> <'0' period> <'1' period> <command> ['h' 134] \n\t\t-- Modulate LF reader field to send command before read (all periods in microseconds)"},
|
||||
|
||||
@@ -368,6 +368,7 @@ bool tryDetectModulation(){
|
||||
}
|
||||
} else {
|
||||
clk = GetAskClock("", FALSE, FALSE);
|
||||
|
||||
if (clk>0) {
|
||||
sprintf(cmdStr,"%d", clk/2);
|
||||
CmdLtrim(cmdStr);
|
||||
|
||||
@@ -10,6 +10,26 @@
|
||||
#ifndef CMDLFT55XX_H__
|
||||
#define CMDLFT55XX_H__
|
||||
|
||||
// config blocks
|
||||
#define T55X7_DEFAULT_CONFIG_BLOCK 0x000880E8 // compat mode, data rate 32, manchester, ST, 7 data blocks
|
||||
#define T55X7_RAW_CONFIG_BLOCK 0x000880E0 // compat mode, data rate 32, manchester, 7 data blocks
|
||||
|
||||
#define T55X7_EM_UNIQUE_CONFIG_BLOCK 0x00148040 // emulate em4x02/unique - compat mode, manchester, data rate 64, 2 data blocks
|
||||
|
||||
|
||||
// FDXB requires data inversion and BiPhase 57 is simply BipHase 50 inverted, so we can either do it using the modulation scheme or the inversion flag
|
||||
// we've done both below to prove that it works either way, and the modulation value for BiPhase 50 in the Atmel data sheet of binary "10001" (17) is a typo,
|
||||
// and it should actually be "10000" (16)
|
||||
// #define T55X7_FDXB_CONFIG_BLOCK 903F8080 // emulate fdx-b - xtended mode, BiPhase ('57), data rate 32, 4 data blocks
|
||||
#define T55X7_FDXB_CONFIG_BLOCK 0x903F0082 // emulate fdx-b - xtended mode, BiPhase ('50), invert data, data rate 32, 4 data blocks
|
||||
#define T55X7_HID_26_CONFIG_BLOCK 0x00107060 // hid 26 bit - compat mode, FSK2a, data rate 50, 3 data blocks
|
||||
#define T55X7_INDALA_64_CONFIG_BLOCK 0x00081040 // emulate indala 64 bit - compat mode, PSK1, psk carrier FC * 2, data rate 32, maxblock 2
|
||||
#define T55X7_INDALA_224_CONFIG_BLOCK 0x000810E0 // emulate indala 224 bit - compat mode, PSK1, psk carrier FC * 2, data rate 32, maxblock 7
|
||||
#define T55X7_GUARDPROXII_CONFIG_BLOCK 0x00150060 // bitrate 64pcb, Direct modulation, Biphase, 3 data blocks
|
||||
#define T55X7_VIKING_CONFIG_BLOCK 0x00088040 // compat mode, data rate 32, Manchester, 2 data blocks
|
||||
#define T55X7_bin 0b0010
|
||||
|
||||
|
||||
typedef struct {
|
||||
enum {
|
||||
DEMOD_NRZ = 0x00,
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user