Merge pull request #23 from RfidResearchGroup/master

Update
2026-05-12 11:18:11 -07:00 · 2019-10-26 12:59:08 +11:00
parent 6e6b46c87a 07cf3fd32b
commit 5a3a1fcc0f
25 changed files with 699 additions and 222 deletions
@@ -3,6 +3,10 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...

 ## [unreleased][unreleased]
+ - Added hf felica rdunencrypted (@7homasSutter)
+ - Added hf felica rqresponse (@7homasSutter)
+ - Added hf felica rqservice (@7homasSutter)
+ - Added polling for felica standard (@7homasSutter)
 - Added lf t55xx dump save and lf t55xx restore for .bin and .eml files (@mwalker33)
 - Added lf t55xx detected to try without password first (@mwalker33)
 - Chg `lf indala read` - added indala 26bit decoding (@martinbeier)
@@ -1589,9 +1589,14 @@ static void PacketReceived(PacketCommandNG *packet) {
                BigBuf_free();
            }
            uint16_t offset = MIN(BIGBUF_SIZE - PM3_CMD_DATA_SIZE - 3, payload->offset);
+            
+            // need to copy len bytes of data, not PM3_CMD_DATA_SIZE - 3 - offset
+            // ensure len bytes copied wont go past end of bigbuf
+            uint16_t len = MIN(BIGBUF_SIZE - offset,PM3_CMD_DATA_SIZE - 3);

            uint8_t *mem = BigBuf_get_addr();
-            memcpy(mem + offset, &payload->data, PM3_CMD_DATA_SIZE - 3 - offset);
+            memcpy(mem + offset, &payload->data, len);
+            // memcpy(mem + offset, &payload->data, PM3_CMD_DATA_SIZE - 3 - offset);
            reply_ng(CMD_LF_UPLOAD_SIM_SAMPLES, PM3_SUCCESS, NULL, 0);
            break;
        }
@@ -3,7 +3,7 @@
 #include "BigBuf.h"
 #include "util.h"
 #include "protocols.h"
-#include "crc16.h"   // crc16 ccitt
+#include "crc16.h"
 #include "fpgaloader.h"
 #include "string.h"
 #include "commonutil.h"
@@ -14,17 +14,17 @@
 // FeliCa timings
 // minimum time between the start bits of consecutive transfers from reader to tag: 6800 carrier (13.56MHz) cycles
 #ifndef FELICA_REQUEST_GUARD_TIME
-# define FELICA_REQUEST_GUARD_TIME (6800/16 + 1)
+# define FELICA_REQUEST_GUARD_TIME (6800/16 + 1) // 426
 #endif
 // FRAME DELAY TIME 2672 carrier cycles
 #ifndef FELICA_FRAME_DELAY_TIME
-# define FELICA_FRAME_DELAY_TIME  (2672/16 + 1)
+# define FELICA_FRAME_DELAY_TIME (2672/16 + 1) // 168
 #endif
 #ifndef DELAY_AIR2ARM_AS_READER
-#define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
+#define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16) // 91
 #endif
 #ifndef DELAY_ARM2AIR_AS_READER
-#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
+#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1) // 209
 #endif

 // CRC skips two first sync bits in data buffer
@@ -229,21 +229,21 @@ static uint8_t felica_select_card(felica_card_select_t *card) {

    // timed-out
    if (len == 0) {
-        if (DBGLEVEL > 3)
+        if (DBGLEVEL >= DBG_DEBUG)
            Dbprintf("Error: Time out card selection!");
        return 1;
    }

    // wrong answer
    if (FelicaFrame.framebytes[3] != FELICA_POLL_ACK) {
-        if (DBGLEVEL > 3)
+        if (DBGLEVEL >= DBG_DEBUG)
            Dbprintf("Error: Wrong answer selecting card!");
        return 2;
    }

    // VALIDATE CRC   residue is 0, hence if crc is a value it failed.
    if (!check_crc(CRC_FELICA, FelicaFrame.framebytes + 2, FelicaFrame.len - 2)) {
-        if (DBGLEVEL > 3) {
+        if (DBGLEVEL >= DBG_DEBUG) {
            Dbprintf("Error: CRC check failed!");
            Dbprintf("CRC check was done on Frame: ");
            Dbhexdump(FelicaFrame.len - 2, FelicaFrame.framebytes + 2, 0);
@@ -251,7 +251,7 @@ static uint8_t felica_select_card(felica_card_select_t *card) {
        return 3;
    }

-    if (DBGLEVEL > 3)
+    if (DBGLEVEL >= DBG_DEBUG)
        Dbprintf("Card selection successful!");
    // copy UID
    // idm 8
@@ -263,7 +263,7 @@ static uint8_t felica_select_card(felica_card_select_t *card) {
        memcpy(card->uid, card->IDm + 2, 6);
        memcpy(card->iccode, card->PMm, 2);
        memcpy(card->mrt, card->PMm + 2, 6);
-        if (DBGLEVEL > 3) {
+        if (DBGLEVEL >= DBG_DEBUG) {
            Dbprintf("Received Frame: ");
            Dbhexdump(FelicaFrame.len, FelicaFrame.framebytes, 0);
        }
@@ -337,9 +337,7 @@ static void BuildFliteRdblk(uint8_t *idm, int blocknum, uint16_t *blocks) {
 }

 static void TransmitFor18092_AsReader(uint8_t *frame, int len, uint32_t *timing, uint8_t power, uint8_t highspeed) {
-
    uint8_t flags = FPGA_MAJOR_MODE_ISO18092;
-
    if (power)
        flags |= FPGA_HF_ISO18092_FLAG_READER;
    if (highspeed)
@@ -357,7 +355,6 @@ static void TransmitFor18092_AsReader(uint8_t *frame, int len, uint32_t *timing,
    // sending 0x00 0x00 0x00 0x00 0x00 0x00
    uint16_t c = 0;
    while (c < 6) {
-
        // keep tx buffer in a defined state anyway.
        if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
            AT91C_BASE_SSC->SSC_THR = 0x00;
@@ -366,13 +363,12 @@ static void TransmitFor18092_AsReader(uint8_t *frame, int len, uint32_t *timing,
    }
    // sending data with sync bytes
    c = 0;
-    if (DBGLEVEL > 3) {
+    if (DBGLEVEL >= DBG_DEBUG) {
        Dbprintf("Sending frame:");
        Dbhexdump(len, frame, 0);
    }

    while (c < len) {
-
        // Put byte into tx holding register as soon as it is ready
        if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
            AT91C_BASE_SSC->SSC_THR = frame[c++];
@@ -404,7 +400,7 @@ static void TransmitFor18092_AsReader(uint8_t *frame, int len, uint32_t *timing,
 // stop when button is pressed
 // or return TRUE when command is captured
 bool WaitForFelicaReply(uint16_t maxbytes) {
-    if (DBGLEVEL > 3)
+    if (DBGLEVEL >= DBG_DEBUG)
        Dbprintf("WaitForFelicaReply Start");
    uint32_t c = 0;
    // power, no modulation
@@ -414,22 +410,18 @@ bool WaitForFelicaReply(uint16_t maxbytes) {
    // clear RXRDY:
    uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
    uint32_t timeout = iso18092_get_timeout();
-    if (DBGLEVEL > 3)
+    if (DBGLEVEL >= DBG_DEBUG)
        Dbprintf("timeout set: %i", timeout);
-    //TODO FIX THIS METHOD - Race Condition or something: TIMING/MEMORY ISSUES
-    // If you add content here (dbprintf), timing problems appear?! Last Bytes (CRC) of frame will be cutoff.
+
    for (;;) {
        WDT_HIT();
        if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
            b = (uint8_t)(AT91C_BASE_SSC->SSC_RHR);
            Process18092Byte(b);
            if (FelicaFrame.state == STATE_FULL) {
-                felica_nexttransfertime =
-                    MAX(
-                        felica_nexttransfertime,
-                        (GetCountSspClk() & 0xfffffff8) - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER) / 16 + FELICA_FRAME_DELAY_TIME
-                    );
-
+                felica_nexttransfertime = MAX(felica_nexttransfertime,
+                                              (GetCountSspClk() & 0xfffffff8) - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER) / 16 + FELICA_FRAME_DELAY_TIME
+                                             );
                LogTrace(
                    FelicaFrame.framebytes,
                    FelicaFrame.len,
@@ -438,10 +430,10 @@ bool WaitForFelicaReply(uint16_t maxbytes) {
                    NULL,
                    false
                );
-                if (DBGLEVEL > 3) Dbprintf("All bytes received! STATE_FULL");
+                if (DBGLEVEL >= DBG_DEBUG) Dbprintf("All bytes received! STATE_FULL");
                return true;
            } else if (c++ > timeout && FelicaFrame.state == STATE_UNSYNCD) {
-                if (DBGLEVEL > 3) Dbprintf("Error: Timeout! STATE_UNSYNCD");
+                if (DBGLEVEL >= DBG_DEBUG) Dbprintf("Error: Timeout! STATE_UNSYNCD");
                return false;
            }
        }
@@ -451,7 +443,7 @@ bool WaitForFelicaReply(uint16_t maxbytes) {
 // Set up FeliCa communication (similar to iso14443a_setup)
 // field is setup for "Sending as Reader"
 static void iso18092_setup(uint8_t fpga_minor_mode) {
-    if (DBGLEVEL > 3) Dbprintf("Start iso18092_setup");
+    if (DBGLEVEL >= DBG_DEBUG) Dbprintf("Start iso18092_setup");

    LEDsoff();
    FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
@@ -504,7 +496,7 @@ void felica_reset_frame_mode() {
 // arg1 len of commandbytes
 // d.asBytes command bytes to send
 void felica_sendraw(PacketCommandNG *c) {
-    if (DBGLEVEL > 3) Dbprintf("FeliCa_sendraw Enter");
+    if (DBGLEVEL >= DBG_DEBUG) Dbprintf("FeliCa_sendraw Enter");

    felica_command_t param = c->oldarg[0];
    size_t len = c->oldarg[1] & 0xffff;
@@ -514,7 +506,7 @@ void felica_sendraw(PacketCommandNG *c) {
    felica_card_select_t card;

    if ((param & FELICA_CONNECT))
-        if (DBGLEVEL > 3) Dbprintf("Clear trace");
+        if (DBGLEVEL >= DBG_DEBUG) Dbprintf("Clear trace");
    clear_trace();

    set_tracing(true);
@@ -527,13 +519,13 @@ void felica_sendraw(PacketCommandNG *c) {
            arg0 = felica_select_card(&card);
            reply_mix(CMD_ACK, arg0, sizeof(card.uid), 0, &card, sizeof(felica_card_select_t));
            if (arg0 > 0) {
-                if (DBGLEVEL >=  DBG_DEBUG) Dbprintf("Error: Failed selecting card! ");
+                if (DBGLEVEL >= DBG_DEBUG) Dbprintf("Error: Failed selecting card! ");
                felica_reset_frame_mode();
                return;
            }
        }
    } else {
-        if (DBGLEVEL > 3) Dbprintf("No card selection");
+        if (DBGLEVEL >= DBG_DEBUG) Dbprintf("No card selection");
    }

    if ((param & FELICA_RAW)) {
@@ -554,17 +546,18 @@ void felica_sendraw(PacketCommandNG *c) {
                AddCrc(buf, len);
            }
        }
-        if (DBGLEVEL > 3) {
+        if (DBGLEVEL >= DBG_DEBUG) {
            Dbprintf("Transmit Frame (no CRC shown):");
            Dbhexdump(len, buf, 0);
            Dbprintf("Buffer Length: %i", buf[2] + 4);
        };
        TransmitFor18092_AsReader(buf, buf[2] + 4, NULL, 1, 0);
        arg0 = WaitForFelicaReply(1024);
-        if (DBGLEVEL > 3) {
+        if (DBGLEVEL >= DBG_DEBUG) {
            Dbprintf("Received Frame Code: %d", arg0);
            Dbhexdump(FelicaFrame.len, FelicaFrame.framebytes, 0);
        };
+
        uint32_t result = reply_mix(CMD_ACK, FelicaFrame.len, arg0, 0, FelicaFrame.framebytes, FelicaFrame.len);
        if (result) {
            Dbprintf("Reply to Client Error Code: %i", result);
@@ -573,7 +566,7 @@ void felica_sendraw(PacketCommandNG *c) {
    if ((param & FELICA_NO_DISCONNECT)) {
        Dbprintf("Disconnect");
    }
-    if (DBGLEVEL > 3)
+    if (DBGLEVEL >= DBG_DEBUG)
        Dbprintf("FeliCa_sendraw Exit");
    felica_reset_frame_mode();
    return;
@@ -758,99 +751,6 @@ void felica_sim_lite(uint64_t uid) {

 #define RES_SVC_LEN 11 + 3

-void felica_dump() {
-    uint8_t ndef[8];
-    uint8_t poll[10] = { 0xb2, 0x4d, 0x06, FELICA_POLL_REQ, 0xff, 0xff, 0x00, 0x00, 0x09, 0x21}; // B24D0600FFFF00000921
-    iso18092_setup(FPGA_HF_ISO18092_FLAG_READER | FPGA_HF_ISO18092_FLAG_NOMOD);
-
-    TransmitFor18092_AsReader(poll, 10, NULL, 1, 0);
-
-    // iceman, no exit path in this loop
-    while (!BUTTON_PRESS() && !data_available()) {
-        WDT_HIT();
-        TransmitFor18092_AsReader(poll, 10, NULL, 1, 0);
-        if (WaitForFelicaReply(512) && FelicaFrame.framebytes[3] == FELICA_POLL_ACK) {
-            memcpy(ndef, FelicaFrame.framebytes + 4, 8);
-            uint8_t *request_service = felica_create_request_service_frame(0x01, ndef);
-            felica_send_request_service(request_service);
-        }
-    }
-
-}
-
-void felica_send_request_service(uint8_t *request_service) {
-    Dbprintf("Send Service Request - len: d%", RES_SVC_LEN);
-    TransmitFor18092_AsReader(request_service, RES_SVC_LEN, NULL, 1, 0);
-    if (WaitForFelicaReply(512) && FelicaFrame.framebytes[3] == FELICA_REQSRV_ACK) {
-        Dbprintf("Got Service Response!");
-    }
-}
-
-/* Create Request Service Frame
-// Use this command to verify the existence of Area and Service, and to acquire Key Version.
-// When the specified Area or Service exists, the card returns Key Version.
-// When the specified Area or Service does not exist, the card returns FFFFh as Key Version.
-*/
-uint8_t *felica_create_request_service_frame(uint8_t nodeNumber, uint8_t *idm) {
-    if (nodeNumber < 1 && nodeNumber > 32) {
-        Dbprintf("Node number out of range: 1 <= %d <= 32 - set node number to 1");
-        nodeNumber = 1;
-    }
-    // Sync 2-Byte, Length 1-Byte, CMD 1-Byte, IDm 8-Byte, nodeNumber 1 <= n <= 32 1-Byte, Node Code List <Little Endian>
-    uint8_t *request_service = BigBuf_malloc(sizeof(uint8_t) * RES_SVC_LEN);
-    //{ 0xb2, 0x4d, 0x06, FELICA_REQSRV_REQ, 0xff, 0xff, 0x00, 0x00, 0x09, 0x21};
-    request_service[0] = 0xb2; //Sync
-    request_service[1] = 0x4d; //Sync
-    request_service[2] = 0x0B; // Length
-    request_service[3] = FELICA_REQSRV_REQ; // CMD
-    request_service[4] = idm[0];
-    request_service[5] = idm[1];
-    request_service[6] = idm[2];
-    request_service[7] = idm[3];
-    request_service[8] = idm[4];
-    request_service[9] = idm[5];
-    request_service[10] = idm[6];
-    request_service[11] = idm[7];
-    request_service[12] = nodeNumber; // Node we like to ask for services
-    request_service[13] = 0x00; // Node Code List // TODO FIND OUT WHAT NEEDS TO BE IN HERE
-    return request_service;
-}
-
-// Create Frame for authentication1 CMD
-void felica_create_authentication1_frame() {
-
-}
-
-// Create Frame for authentication2 CMD
-void felica_create_authentication2_frame() {
-
-}
-
-// Create a Frame for Read without encryption CMD as Payload
-void felica_create_read_block_frame(uint16_t blockNr) {
-    if (blockNr < 1 || blockNr > 567) {
-        Dbprintf("Block number out of range!");
-        return;
-    }
-    uint8_t c = 0;
-    // First Byte of SYNC
-    frameSpace[c++] = 0xb2;
-    frameSpace[c++] = 0x4d;
-    // skip Length of Frame
-    c++;
-    // Payload
-    frameSpace[c++] = FELICA_RDBLK_REQ; //command number
-
-    // Set frame length
-
-    // CRC
-}
-
-void felica_read_block(uint8_t *idm, uint16_t blockNr) {
-
-
-}
-
 void felica_dump_lite_s() {
    uint8_t ndef[8];
    uint8_t poll[10] = { 0xb2, 0x4d, 0x06, FELICA_POLL_REQ, 0xff, 0xff, 0x00, 0x00, 0x09, 0x21};
@@ -18,12 +18,7 @@ void felica_sendraw(PacketCommandNG *c);
 void felica_sniff(uint32_t samplesToSkip, uint32_t triggersToSkip);
 void felica_sim_lite(uint64_t uid);
 void felica_dump_lite_s();
-void felica_dump();
 void felica_create_read_block_frame(uint16_t blockNr);
-void felica_create_authentication1_frame();
-void felica_create_authentication2_frame();
 void felica_send_request_service(uint8_t *request_service);
-void felica_reset_frame_mode();
-uint8_t *felica_create_request_service_frame(uint8_t nodeNumber, uint8_t *idm);

 #endif
@@ -2418,7 +2418,7 @@ because of this, we can "sample" the data signal but we interpreate it to Manche
 This behavior looks very similar to old ancient Motorola Flexpass

 -----------------------------------------------------------------------
-According to patent:
+According to patent EP0040544B1:
 Operating freq
  reader 132 kHz
  tag     66 kHz
@@ -2453,7 +2453,7 @@ void Cotag(uint32_t arg0) {

    LED_A_ON();

-    LFSetupFPGAForADC(LF_DIVISOR(132), true);
+    LFSetupFPGAForADC(LF_FREQ2DIV(132), true);

    //clear buffer now so it does not interfere with timing later
    BigBuf_Clear_ext(false);
@@ -508,7 +508,7 @@ int CmdGetBitStream(const char *Cmd) {
    RepaintGraphWindow();
    return PM3_SUCCESS;
 }
-int CmdConvertBitStream(const char *Cmd) {
+static int CmdConvertBitStream(const char *Cmd) {

    if (isGraphBitstream()) {
        convertGraphFromBitstream();
@@ -1676,16 +1676,16 @@ int CmdTuneSamples(const char *Cmd) {
    struct p *package = (struct p *)resp.data.asBytes;

    if (package->v_lf125 > NON_VOLTAGE)
-        PrintAndLogEx(SUCCESS, "LF antenna: %5.2f V - %.2f kHz", (package->v_lf125 * ANTENNA_ERROR) / 1000.0, 12000.0 / (LF_DIVISOR_125 + 1));
+        PrintAndLogEx(SUCCESS, "LF antenna: %5.2f V - %.2f kHz", (package->v_lf125 * ANTENNA_ERROR) / 1000.0, LF_DIV2FREQ(LF_DIVISOR_125));

    if (package->v_lf134 > NON_VOLTAGE)
-        PrintAndLogEx(SUCCESS, "LF antenna: %5.2f V - %.2f kHz", (package->v_lf134 * ANTENNA_ERROR) / 1000.0, 12000.0 / (LF_DIVISOR_134 + 1));
+        PrintAndLogEx(SUCCESS, "LF antenna: %5.2f V - %.2f kHz", (package->v_lf134 * ANTENNA_ERROR) / 1000.0, LF_DIV2FREQ(LF_DIVISOR_134));

    if (package->v_lfconf > NON_VOLTAGE && package->divisor > 0 && package->divisor != LF_DIVISOR_125 && package->divisor != LF_DIVISOR_134)
-        PrintAndLogEx(SUCCESS, "LF antenna: %5.2f V - %.2f kHz", (package->v_lfconf * ANTENNA_ERROR) / 1000.0, 12000.0 / (package->divisor + 1));
+        PrintAndLogEx(SUCCESS, "LF antenna: %5.2f V - %.2f kHz", (package->v_lfconf * ANTENNA_ERROR) / 1000.0, LF_DIV2FREQ(package->divisor));

    if (package->peak_v > NON_VOLTAGE && package->peak_f > 0)
-        PrintAndLogEx(SUCCESS, "LF optimal: %5.2f V - %6.2f kHz", (package->peak_v * ANTENNA_ERROR) / 1000.0, 12000.0 / (package->peak_f + 1));
+        PrintAndLogEx(SUCCESS, "LF optimal: %5.2f V - %6.2f kHz", (package->peak_v * ANTENNA_ERROR) / 1000.0, LF_DIV2FREQ(package->peak_f));

    char judgement[20];
    memset(judgement, 0, sizeof(judgement));
@@ -1730,7 +1730,7 @@ int CmdTuneSamples(const char *Cmd) {

    if (test1 > 0) {
        PrintAndLogEx(SUCCESS, "\nDisplaying LF tuning graph. Divisor %d is %.2f kHz, %d is %.2f kHz.\n\n",
-                      LF_DIVISOR_134, 12000.0 / (LF_DIVISOR_134 + 1), LF_DIVISOR_125, 12000.0 / (LF_DIVISOR_125 + 1));
+                      LF_DIVISOR_134, LF_DIV2FREQ(LF_DIVISOR_134), LF_DIVISOR_125, LF_DIV2FREQ(LF_DIVISOR_125));
        GraphTraceLen = 256;
        ShowGraphWindow();
        RepaintGraphWindow();
@@ -8,7 +8,7 @@
 //-----------------------------------------------------------------------------
 // High frequency commands
 //-----------------------------------------------------------------------------
-//#include "cmdhf.h"
+#include "cmdhf.h"

 #include <ctype.h>        // tolower

@@ -12,10 +12,10 @@
 #define CMDHFFELICA_H__

 #include "common.h"
+#include "mifare.h"

 int CmdHFFelica(const char *Cmd);
-
 int readFelicaUid(bool verbose);
-
-int dump();
+int send_request_service(uint8_t flags, uint16_t datalen, uint8_t *data, bool verbose);
+int send_rd_unencrypted(uint8_t flags, uint16_t datalen, uint8_t *data, bool verbose, felica_read_without_encryption_response_t *rd_noCry_resp);
 #endif
@@ -366,7 +366,7 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
    PrintAndLogEx(NORMAL, "  --= Nonvolatile Program Memory Type: %s", asBuff);
 }

-int CmdDbg(const char *Cmd) {
+static int CmdDbg(const char *Cmd) {

    char ctmp = tolower(param_getchar(Cmd, 0));
    if (strlen(Cmd) < 1 || ctmp == 'h') return usage_dbg();
@@ -213,7 +213,7 @@ static int usage_lf_tune(void) {
    return PM3_SUCCESS;
 }

-int CmdLFTune(const char *Cmd) {
+static int CmdLFTune(const char *Cmd) {
    int iter = 0;
    uint8_t divisor =  LF_DIVISOR_125;//Frequency divisor
    bool errors = false;
@@ -231,12 +231,12 @@ int CmdLFTune(const char *Cmd) {
                }
                break;
            case 'f': {
-                int freq = param_get32ex(Cmd, cmdp + 1, 125, 10);
-                divisor = LF_DIVISOR(freq);
-                if (divisor < 19) {
+                float freq = param_getfloat(Cmd, cmdp + 1, 125);
+                if ((freq < 47) || (freq > 600)) {
                    PrintAndLogEx(ERR, "freq must be between 47 and 600");
                    return PM3_EINVARG;
                }
+                divisor = LF_FREQ2DIV(freq);
                cmdp += 2;
                break;
            }
@@ -254,7 +254,7 @@ int CmdLFTune(const char *Cmd) {
    //Validations
    if (errors) return usage_lf_tune();

-    PrintAndLogEx(SUCCESS, "Measuring LF antenna at %.2f kHz, click button or press Enter to exit", 12000.0 / (divisor + 1));
+    PrintAndLogEx(SUCCESS, "Measuring LF antenna at %.2f kHz, click button or press Enter to exit", LF_DIV2FREQ(divisor));

    uint8_t params[] = {1, 0};
    params[1] = divisor;
@@ -498,7 +498,7 @@ int CmdLFConfig(const char *Cmd) {
                break;
            case 'f': {
                int freq = param_get32ex(Cmd, cmdp + 1, 125, 10);
-                divisor = LF_DIVISOR(freq);
+                divisor = LF_FREQ2DIV(freq);
                if (divisor < 19) {
                    PrintAndLogEx(ERR, "freq must be between 47 and 600");
                    return PM3_EINVARG;
@@ -8,6 +8,8 @@
 // Low frequency Hitag support
 //-----------------------------------------------------------------------------

+#include "cmdlfhitag.h"
+
 #include <ctype.h>

 #include "cmdparser.h"    // command_t
@@ -127,7 +127,7 @@ static int CmdMotorolaRead(const char *Cmd) {
        .decimation = 0,
        .bits_per_sample = 0,
        .averaging = false,
-        .divisor = LF_DIVISOR(74),
+        .divisor = LF_FREQ2DIV(74),
        .trigger_threshold = -1,
        .samples_to_skip = 4500,
        .verbose = false
@@ -426,7 +426,7 @@ static int CmdLfNedapGen(const char *Cmd) {
    return PM3_SUCCESS;
 }

-int CmdLFNedapClone(const char *Cmd) {
+static int CmdLFNedapClone(const char *Cmd) {
    uint8_t max;
    uint32_t blocks[5] = {0};

@@ -74,7 +74,8 @@ int fileExists(const char *filename) {
 * @param filename
 * @return
 */
-bool is_regular_file(const char *filename) {
+/*
+static bool is_regular_file(const char *filename) {
 #ifdef _WIN32
    struct _stat st;
    if (_stat(filename, &st) == -1)
@@ -87,12 +88,14 @@ bool is_regular_file(const char *filename) {
 #endif
    return S_ISREG(st.st_mode) != 0;
 }
+*/
+
 /**
 * @brief checks if path is directory.
 * @param filename
 * @return
 */
-bool is_directory(const char *filename) {
+static bool is_directory(const char *filename) {
 #ifdef _WIN32
    struct _stat st;
    if (_stat(filename, &st) == -1)
@@ -58,6 +58,8 @@ From "Dismantling iclass":
    output of hash0 is the diversified card key k = k [0] , . . . , k [7] ∈ (F 82 ) 8 .

 **/
+#include "ikeys.h"
+
 #include <stdint.h>
 #include <stdbool.h>
 #include <string.h>
@@ -38,6 +38,7 @@
 #ifndef IKEYS_H
 #define IKEYS_H

+#include <inttypes.h>

 /**
 * @brief
@@ -56,7 +56,7 @@ static void showBanner(void) {
    g_printAndLog = PRINTANDLOG_PRINT | PRINTANDLOG_LOG;
 }

-int check_comm(void) {
+static int check_comm(void) {
    // If communications thread goes down. Device disconnected then this should hook up PM3 again.
    if (IsCommunicationThreadDead() && session.pm3_present) {
        rl_set_prompt(PROXPROMPT_OFFLINE);
@@ -86,7 +86,7 @@ int push_cmdscriptfile(char *path, bool stayafter) {
    return PM3_SUCCESS;
 }

-FILE *current_cmdscriptfile() {
+static FILE *current_cmdscriptfile() {
    return cmdscriptfile[cmdscriptfile_idx];
 }

@@ -551,6 +551,14 @@ uint64_t param_get64ex(const char *line, int paramnum, int deflt, int base) {
        return deflt;
 }

+float param_getfloat(const char *line, int paramnum, float deflt) {
+    int bg, en;
+    if (!param_getptr(line, &bg, &en, paramnum))
+        return strtof(&line[bg], NULL);
+    else
+        return deflt;
+}
+
 int param_gethex(const char *line, int paramnum, uint8_t *data, int hexcnt) {
    int bg, en, i;
    uint32_t temp;
@@ -68,6 +68,7 @@ uint8_t param_get8(const char *line, int paramnum);
 uint8_t param_get8ex(const char *line, int paramnum, int deflt, int base);
 uint32_t param_get32ex(const char *line, int paramnum, int deflt, int base);
 uint64_t param_get64ex(const char *line, int paramnum, int deflt, int base);
+float param_getfloat(const char *line, int paramnum, float deflt);
 uint8_t param_getdec(const char *line, int paramnum, uint8_t *destination);
 uint8_t param_isdec(const char *line, int paramnum);
 int param_gethex(const char *line, int paramnum, uint8_t *data, int hexcnt);
--- a/Show More
+++ b/Show More