mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-05-12 11:18:11 -07:00
@marshmellows last LF changes.
- wipe a t55x7 tag - stable demods -
This commit is contained in:
iceman1001
+11
-2
@@ -1065,7 +1065,7 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
|
||||
#define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc)
|
||||
#define WRITE_0 16*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
|
||||
#define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550
|
||||
#define READ_GAP 52*8
|
||||
#define READ_GAP 15*8
|
||||
|
||||
// VALUES TAKEN FROM EM4x function: SendForward
|
||||
// START_GAP = 440; (55*8) cycles at 125Khz (8us = 1cycle)
|
||||
@@ -1183,7 +1183,7 @@ void T55xxWriteBlock(uint32_t Data, uint8_t Block, uint32_t Pwd, uint8_t arg) {
|
||||
cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
}
|
||||
|
||||
// Read one card block in page 0
|
||||
// Read one card block in page [page]
|
||||
void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
||||
LED_A_ON();
|
||||
bool PwdMode = arg0 & 0x1;
|
||||
@@ -1463,6 +1463,15 @@ uint8_t * fwd_write_ptr; //forwardlink bit pointer
|
||||
// prepares command bits
|
||||
// see EM4469 spec
|
||||
//====================================================================
|
||||
//--------------------------------------------------------------------
|
||||
// VALUES TAKEN FROM EM4x function: SendForward
|
||||
// START_GAP = 440; (55*8) cycles at 125Khz (8us = 1cycle)
|
||||
// WRITE_GAP = 128; (16*8)
|
||||
// WRITE_1 = 256 32*8; (32*8)
|
||||
|
||||
// These timings work for 4469/4269/4305 (with the 55*8 above)
|
||||
// WRITE_0 = 23*8 , 9*8 SpinDelayUs(23*8);
|
||||
|
||||
uint8_t Prepare_Cmd( uint8_t cmd ) {
|
||||
|
||||
*forward_ptr++ = 0; //start bit
|
||||
|
||||
+18
-6
@@ -254,7 +254,8 @@ uint32_t SnoopLF() {
|
||||
**/
|
||||
void doT55x7Acquisition(size_t sample_size) {
|
||||
|
||||
#define T55xx_READ_UPPER_THRESHOLD 128+40 // 40 grph
|
||||
#define T55xx_READ_UPPER_THRESHOLD 128+60 // 60 grph
|
||||
#define T55xx_READ_LOWER_THRESHOLD 128-60 // -60 grph
|
||||
#define T55xx_READ_TOL 5
|
||||
|
||||
uint8_t *dest = BigBuf_get_addr();
|
||||
@@ -266,8 +267,9 @@ void doT55x7Acquisition(size_t sample_size) {
|
||||
uint16_t i = 0;
|
||||
bool startFound = false;
|
||||
bool highFound = false;
|
||||
bool lowFound = false;
|
||||
uint8_t curSample = 0;
|
||||
uint8_t firstSample = 0;
|
||||
uint8_t lastSample = 0;
|
||||
uint16_t skipCnt = 0;
|
||||
while(!BUTTON_PRESS() && !usb_poll_validate_length() && skipCnt<1000) {
|
||||
WDT_HIT();
|
||||
@@ -281,19 +283,29 @@ void doT55x7Acquisition(size_t sample_size) {
|
||||
|
||||
// skip until the first high sample above threshold
|
||||
if (!startFound && curSample > T55xx_READ_UPPER_THRESHOLD) {
|
||||
if (curSample > firstSample)
|
||||
firstSample = curSample;
|
||||
//if (curSample > lastSample)
|
||||
// lastSample = curSample;
|
||||
highFound = true;
|
||||
} else if (!highFound) {
|
||||
skipCnt++;
|
||||
continue;
|
||||
}
|
||||
// skip until the first Low sample below threshold
|
||||
if (!startFound && curSample < T55xx_READ_LOWER_THRESHOLD) {
|
||||
//if (curSample > lastSample)
|
||||
lastSample = curSample;
|
||||
lowFound = true;
|
||||
} else if (!lowFound) {
|
||||
skipCnt++;
|
||||
continue;
|
||||
}
|
||||
|
||||
|
||||
// skip until first high samples begin to change
|
||||
if (startFound || curSample < firstSample-T55xx_READ_TOL){
|
||||
if (startFound || curSample > T55xx_READ_LOWER_THRESHOLD+T55xx_READ_TOL){
|
||||
// if just found start - recover last sample
|
||||
if (!startFound) {
|
||||
dest[i++] = firstSample;
|
||||
dest[i++] = lastSample;
|
||||
startFound = true;
|
||||
}
|
||||
// collect samples
|
||||
|
||||
+10
-3
@@ -1495,6 +1495,10 @@ int CmdFDXBdemodBI(const char *Cmd){
|
||||
if (g_debugMode) PrintAndLog("Error FDXBDemod , no startmarker found :: %d",preambleIndex);
|
||||
return 0;
|
||||
}
|
||||
if (size != 128) {
|
||||
if (g_debugMode) PrintAndLog("Error incorrect data length found");
|
||||
return 0;
|
||||
}
|
||||
|
||||
setDemodBuf(BitStream, 128, preambleIndex);
|
||||
|
||||
@@ -1564,6 +1568,9 @@ int PSKDemod(const char *Cmd, bool verbose)
|
||||
//invalid carrier
|
||||
return 0;
|
||||
}
|
||||
if (g_debugMode){
|
||||
PrintAndLog("Carrier: rf/%d",carrier);
|
||||
}
|
||||
int errCnt=0;
|
||||
errCnt = pskRawDemod(BitStream, &BitLen, &clk, &invert);
|
||||
if (errCnt > maxErr){
|
||||
@@ -1605,7 +1612,7 @@ int CmdIndalaDecode(const char *Cmd)
|
||||
uint8_t invert=0;
|
||||
size_t size = DemodBufferLen;
|
||||
size_t startIdx = indala26decode(DemodBuffer, &size, &invert);
|
||||
if (startIdx < 1) {
|
||||
if (startIdx < 1 || size > 224) {
|
||||
if (g_debugMode==1)
|
||||
PrintAndLog("Error2: %d",ans);
|
||||
return -1;
|
||||
@@ -1622,7 +1629,7 @@ int CmdIndalaDecode(const char *Cmd)
|
||||
uid2=bytebits_to_byte(DemodBuffer+32,32);
|
||||
if (DemodBufferLen==64){
|
||||
PrintAndLog("Indala UID=%s (%x%08x)", sprint_bin(DemodBuffer,DemodBufferLen), uid1, uid2);
|
||||
} else {
|
||||
} else {
|
||||
uid3=bytebits_to_byte(DemodBuffer+64,32);
|
||||
uid4=bytebits_to_byte(DemodBuffer+96,32);
|
||||
uid5=bytebits_to_byte(DemodBuffer+128,32);
|
||||
@@ -1699,7 +1706,7 @@ int NRZrawDemod(const char *Cmd, bool verbose)
|
||||
size_t BitLen = getFromGraphBuf(BitStream);
|
||||
if (BitLen==0) return 0;
|
||||
int errCnt=0;
|
||||
errCnt = nrzRawDemod(BitStream, &BitLen, &clk, &invert, maxErr);
|
||||
errCnt = nrzRawDemod(BitStream, &BitLen, &clk, &invert);
|
||||
if (errCnt > maxErr){
|
||||
if (g_debugMode) PrintAndLog("Too many errors found, clk: %d, invert: %d, numbits: %d, errCnt: %d",clk,invert,BitLen,errCnt);
|
||||
return 0;
|
||||
|
||||
+10
-7
@@ -294,9 +294,12 @@ int CmdIndalaDemod(const char *Cmd)
|
||||
int rawbit = 0;
|
||||
int worst = 0, worstPos = 0;
|
||||
// PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
|
||||
|
||||
// loop through raw signal - since we know it is psk1 rf/32 fc/2 skip every other value (+=2)
|
||||
for (i = 0; i < GraphTraceLen-1; i += 2) {
|
||||
count += 1;
|
||||
if ((GraphBuffer[i] > GraphBuffer[i + 1]) && (state != 1)) {
|
||||
// appears redundant - marshmellow
|
||||
if (state == 0) {
|
||||
for (j = 0; j < count - 8; j += 16) {
|
||||
rawbits[rawbit++] = 0;
|
||||
@@ -309,6 +312,7 @@ int CmdIndalaDemod(const char *Cmd)
|
||||
state = 1;
|
||||
count = 0;
|
||||
} else if ((GraphBuffer[i] < GraphBuffer[i + 1]) && (state != 0)) {
|
||||
//appears redundant
|
||||
if (state == 1) {
|
||||
for (j = 0; j < count - 8; j += 16) {
|
||||
rawbits[rawbit++] = 1;
|
||||
@@ -1098,13 +1102,6 @@ int CmdLFfind(const char *Cmd)
|
||||
return 1;
|
||||
}
|
||||
|
||||
//add psk and indala
|
||||
ans=CmdIndalaDecode("");
|
||||
if (ans>0) {
|
||||
PrintAndLog("\nValid Indala ID Found!");
|
||||
return 1;
|
||||
}
|
||||
|
||||
ans=CmdAskEM410xDemod("");
|
||||
if (ans>0) {
|
||||
PrintAndLog("\nValid EM410x ID Found!");
|
||||
@@ -1135,6 +1132,12 @@ int CmdLFfind(const char *Cmd)
|
||||
return 1;
|
||||
}
|
||||
|
||||
ans=CmdIndalaDecode("");
|
||||
if (ans>0) {
|
||||
PrintAndLog("\nValid Indala ID Found!");
|
||||
return 1;
|
||||
}
|
||||
|
||||
ans=CmdPSKNexWatch("");
|
||||
if (ans>0) {
|
||||
PrintAndLog("\nValid NexWatch ID Found!");
|
||||
|
||||
+155
-69
@@ -33,7 +33,7 @@
|
||||
#define REGULAR_READ_MODE_BLOCK 0xFF
|
||||
|
||||
// Default configuration
|
||||
t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = FALSE, .offset = 0x00, .block0 = 0x00};
|
||||
t55xx_conf_block_t config = { .modulation = DEMOD_ASK, .inverted = FALSE, .offset = 0x00, .block0 = 0x00, .Q5 = FALSE };
|
||||
|
||||
t55xx_conf_block_t Get_t55xx_Config(){
|
||||
return config;
|
||||
@@ -43,13 +43,14 @@ void Set_t55xx_Config(t55xx_conf_block_t conf){
|
||||
}
|
||||
|
||||
int usage_t55xx_config(){
|
||||
PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>]");
|
||||
PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");
|
||||
PrintAndLog("Options:");
|
||||
PrintAndLog(" h This help");
|
||||
PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");
|
||||
PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");
|
||||
PrintAndLog(" i [1] Invert data signal, defaults to normal");
|
||||
PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");
|
||||
PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");
|
||||
PrintAndLog("");
|
||||
PrintAndLog("Examples:");
|
||||
PrintAndLog(" lf t55xx config d FSK - FSK demodulation");
|
||||
@@ -149,16 +150,24 @@ int usage_t55xx_wakup(){
|
||||
|
||||
static int CmdHelp(const char *Cmd);
|
||||
|
||||
void printT5xxHeader(uint8_t page){
|
||||
PrintAndLog("Reading Page %d:", page);
|
||||
PrintAndLog("blk | hex data | binary");
|
||||
PrintAndLog("----+----------+---------------------------------");
|
||||
}
|
||||
|
||||
int CmdT55xxSetConfig(const char *Cmd) {
|
||||
|
||||
uint8_t offset = 0;
|
||||
bool errors = FALSE;
|
||||
uint8_t cmdp = 0;
|
||||
char modulation[5] = {0x00};
|
||||
char tmp = 0x00;
|
||||
uint8_t bitRate = 0;
|
||||
uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};
|
||||
while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
|
||||
uint8_t cmdp = 0;
|
||||
config.Q5 = FALSE;
|
||||
bool errors = FALSE;
|
||||
while(param_getchar(Cmd, cmdp) != 0x00 && !errors)
|
||||
{
|
||||
tmp = param_getchar(Cmd, cmdp);
|
||||
switch(tmp)
|
||||
{
|
||||
@@ -228,6 +237,11 @@ int CmdT55xxSetConfig(const char *Cmd) {
|
||||
config.offset = offset;
|
||||
cmdp+=2;
|
||||
break;
|
||||
case 'Q':
|
||||
case 'q':
|
||||
config.Q5 = TRUE;
|
||||
cmdp++;
|
||||
break;
|
||||
default:
|
||||
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = TRUE;
|
||||
@@ -270,7 +284,7 @@ int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32
|
||||
if (!DecodeT55xxBlock()) return 0;
|
||||
|
||||
char blk[10]={0};
|
||||
sprintf(blk,"%d", block);
|
||||
sprintf(blk,"%02d", block);
|
||||
printT55xxBlock(blk);
|
||||
return 1;
|
||||
}
|
||||
@@ -320,8 +334,8 @@ int CmdT55xxReadBlock(const char *Cmd) {
|
||||
PrintAndLog("Block must be between 0 and 7");
|
||||
return 0;
|
||||
}
|
||||
PrintAndLog("Reading Page %d:", page1);
|
||||
PrintAndLog("blk | hex data | binary");
|
||||
|
||||
printT5xxHeader(page1);
|
||||
return T55xxReadBlock(block, page1, usepwd, override, password);
|
||||
}
|
||||
|
||||
@@ -349,16 +363,20 @@ bool DecodeT55xxBlock(){
|
||||
ans = FSKrawDemod(cmdStr, FALSE);
|
||||
break;
|
||||
case DEMOD_ASK:
|
||||
snprintf(cmdStr, sizeof(buf),"%d %d 0", bitRate[config.bitrate], config.inverted );
|
||||
snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );
|
||||
ans = ASKDemod(cmdStr, FALSE, FALSE, 1);
|
||||
break;
|
||||
case DEMOD_PSK1:
|
||||
snprintf(cmdStr, sizeof(buf),"%d %d 0", bitRate[config.bitrate], config.inverted );
|
||||
// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
|
||||
CmdLtrim("160");
|
||||
snprintf(cmdStr, sizeof(buf),"%d %d 6", bitRate[config.bitrate], config.inverted );
|
||||
ans = PSKDemod(cmdStr, FALSE);
|
||||
break;
|
||||
case DEMOD_PSK2: //inverted won't affect this
|
||||
case DEMOD_PSK3: //not fully implemented
|
||||
snprintf(cmdStr, sizeof(buf),"%d 0 1", bitRate[config.bitrate] );
|
||||
// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
|
||||
CmdLtrim("160");
|
||||
snprintf(cmdStr, sizeof(buf),"%d 0 6", bitRate[config.bitrate] );
|
||||
ans = PSKDemod(cmdStr, FALSE);
|
||||
psk1TOpsk2(DemodBuffer, DemodBufferLen);
|
||||
break;
|
||||
@@ -368,7 +386,7 @@ bool DecodeT55xxBlock(){
|
||||
break;
|
||||
case DEMOD_BI:
|
||||
case DEMOD_BIa:
|
||||
snprintf(cmdStr, sizeof(buf),"0 %d %d 0", bitRate[config.bitrate], config.inverted );
|
||||
snprintf(cmdStr, sizeof(buf),"0 %d %d 1", bitRate[config.bitrate], config.inverted );
|
||||
ans = ASKbiphaseDemod(cmdStr, FALSE);
|
||||
break;
|
||||
default:
|
||||
@@ -379,15 +397,15 @@ bool DecodeT55xxBlock(){
|
||||
|
||||
int CmdT55xxDetect(const char *Cmd){
|
||||
|
||||
bool override = false;
|
||||
//bool override = false;
|
||||
//bool pwdmode = false;
|
||||
|
||||
uint32_t password = 0; //default to blank Block 7
|
||||
bool usepwd = ( strlen(Cmd) > 0);
|
||||
if ( usepwd ){
|
||||
password = param_get32ex(Cmd, 0, 0, 16);
|
||||
if (param_getchar(Cmd, 1) =='o' )
|
||||
override = true;
|
||||
// if (param_getchar(Cmd, 1) =='o' )
|
||||
// override = true;
|
||||
}
|
||||
|
||||
char cmdp = param_getchar(Cmd, 0);
|
||||
@@ -395,7 +413,7 @@ int CmdT55xxDetect(const char *Cmd){
|
||||
|
||||
if (strlen(Cmd)==0) {
|
||||
password = param_get32ex(Cmd, 0, 0, 16);
|
||||
if (param_getchar(Cmd, 1) =='o' ) override = true;
|
||||
//if (param_getchar(Cmd, 1) =='o' ) override = true;
|
||||
}
|
||||
|
||||
if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password) )
|
||||
@@ -414,9 +432,10 @@ bool tryDetectModulation(){
|
||||
int bitRate=0;
|
||||
uint8_t fc1 = 0, fc2 = 0, clk=0;
|
||||
save_restoreGB(1);
|
||||
|
||||
if (GetFskClock("", FALSE, FALSE)){
|
||||
fskClocks(&fc1, &fc2, &clk, FALSE);
|
||||
if ( FSKrawDemod("0 0", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate)){
|
||||
if ( FSKrawDemod("0 0", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){
|
||||
tests[hits].modulation = DEMOD_FSK;
|
||||
if (fc1==8 && fc2 == 5)
|
||||
tests[hits].modulation = DEMOD_FSK1a;
|
||||
@@ -427,7 +446,7 @@ bool tryDetectModulation(){
|
||||
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
|
||||
++hits;
|
||||
}
|
||||
if ( FSKrawDemod("0 1", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate)) {
|
||||
if ( FSKrawDemod("0 1", FALSE) && test(DEMOD_FSK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
|
||||
tests[hits].modulation = DEMOD_FSK;
|
||||
if (fc1 == 8 && fc2 == 5)
|
||||
tests[hits].modulation = DEMOD_FSK1;
|
||||
@@ -442,28 +461,28 @@ bool tryDetectModulation(){
|
||||
} else {
|
||||
clk = GetAskClock("", FALSE, FALSE);
|
||||
if (clk>0) {
|
||||
if ( ASKDemod("0 0 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate)) {
|
||||
if ( ASKDemod("0 0 1", TRUE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
|
||||
tests[hits].modulation = DEMOD_ASK;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = FALSE;
|
||||
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
|
||||
++hits;
|
||||
}
|
||||
if ( ASKDemod("0 1 0", FALSE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate)) {
|
||||
if ( ASKDemod("0 1 1", TRUE, FALSE, 1) && test(DEMOD_ASK, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
|
||||
tests[hits].modulation = DEMOD_ASK;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = TRUE;
|
||||
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
|
||||
++hits;
|
||||
}
|
||||
if ( ASKbiphaseDemod("0 0 0 0", FALSE) && test(DEMOD_BI, &tests[hits].offset, &bitRate) ) {
|
||||
if ( ASKbiphaseDemod("0 0 0 2", FALSE) && test(DEMOD_BI, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {
|
||||
tests[hits].modulation = DEMOD_BI;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = FALSE;
|
||||
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
|
||||
++hits;
|
||||
}
|
||||
if ( ASKbiphaseDemod("0 0 1 0", FALSE) && test(DEMOD_BIa, &tests[hits].offset, &bitRate) ) {
|
||||
if ( ASKbiphaseDemod("0 0 1 2", FALSE) && test(DEMOD_BIa, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5) ) {
|
||||
tests[hits].modulation = DEMOD_BIa;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = TRUE;
|
||||
@@ -475,7 +494,7 @@ bool tryDetectModulation(){
|
||||
save_restoreGB(0);
|
||||
clk = GetNrzClock("", FALSE, FALSE);
|
||||
if (clk>0) {
|
||||
if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate)) {
|
||||
if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
|
||||
tests[hits].modulation = DEMOD_NRZ;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = FALSE;
|
||||
@@ -483,7 +502,7 @@ bool tryDetectModulation(){
|
||||
++hits;
|
||||
}
|
||||
|
||||
if ( NRZrawDemod("0 1 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate)) {
|
||||
if ( NRZrawDemod("0 1 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
|
||||
tests[hits].modulation = DEMOD_NRZ;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = TRUE;
|
||||
@@ -494,16 +513,18 @@ bool tryDetectModulation(){
|
||||
|
||||
//undo trim from nrz
|
||||
save_restoreGB(0);
|
||||
// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
|
||||
CmdLtrim("160");
|
||||
clk = GetPskClock("", FALSE, FALSE);
|
||||
if (clk>0) {
|
||||
if ( PSKDemod("0 0 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate)) {
|
||||
if ( PSKDemod("0 0 6", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
|
||||
tests[hits].modulation = DEMOD_PSK1;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = FALSE;
|
||||
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
|
||||
++hits;
|
||||
}
|
||||
if ( PSKDemod("0 1 1", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate)) {
|
||||
if ( PSKDemod("0 1 6", FALSE) && test(DEMOD_PSK1, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
|
||||
tests[hits].modulation = DEMOD_PSK1;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = TRUE;
|
||||
@@ -511,9 +532,9 @@ bool tryDetectModulation(){
|
||||
++hits;
|
||||
}
|
||||
// PSK2 - needs a call to psk1TOpsk2.
|
||||
if ( PSKDemod("0 0 1", FALSE)) {
|
||||
if ( PSKDemod("0 0 6", FALSE)) {
|
||||
psk1TOpsk2(DemodBuffer, DemodBufferLen);
|
||||
if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate)){
|
||||
if (test(DEMOD_PSK2, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){
|
||||
tests[hits].modulation = DEMOD_PSK2;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = FALSE;
|
||||
@@ -522,9 +543,9 @@ bool tryDetectModulation(){
|
||||
}
|
||||
} // inverse waves does not affect this demod
|
||||
// PSK3 - needs a call to psk1TOpsk2.
|
||||
if ( PSKDemod("0 0 1", FALSE)) {
|
||||
if ( PSKDemod("0 0 6", FALSE)) {
|
||||
psk1TOpsk2(DemodBuffer, DemodBufferLen);
|
||||
if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate)){
|
||||
if (test(DEMOD_PSK3, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)){
|
||||
tests[hits].modulation = DEMOD_PSK3;
|
||||
tests[hits].bitrate = bitRate;
|
||||
tests[hits].inverted = FALSE;
|
||||
@@ -534,6 +555,7 @@ bool tryDetectModulation(){
|
||||
} // inverse waves does not affect this demod
|
||||
}
|
||||
}
|
||||
save_restoreGB(0);
|
||||
if ( hits == 1) {
|
||||
config.modulation = tests[0].modulation;
|
||||
config.bitrate = tests[0].bitrate;
|
||||
@@ -586,37 +608,28 @@ bool testModulation(uint8_t mode, uint8_t modread){
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
bool testBitRate(uint8_t readRate, uint8_t mod){
|
||||
uint8_t expected[8] = {8, 16, 32, 40, 50, 64, 100, 128};
|
||||
uint8_t detRate = 0;
|
||||
switch( mod ){
|
||||
bool testQ5Modulation(uint8_t mode, uint8_t modread){
|
||||
switch( mode ){
|
||||
case DEMOD_FSK:
|
||||
case DEMOD_FSK1:
|
||||
case DEMOD_FSK1a:
|
||||
case DEMOD_FSK2:
|
||||
case DEMOD_FSK2a:
|
||||
detRate = GetFskClock("",FALSE, FALSE);
|
||||
if (expected[readRate] == detRate)
|
||||
return TRUE;
|
||||
if (modread >= 4 && modread <= 5) return TRUE;
|
||||
break;
|
||||
case DEMOD_ASK:
|
||||
case DEMOD_BI:
|
||||
case DEMOD_BIa:
|
||||
detRate = GetAskClock("",FALSE, FALSE);
|
||||
if (expected[readRate] == detRate)
|
||||
return TRUE;
|
||||
if (modread == 0) return TRUE;
|
||||
break;
|
||||
case DEMOD_PSK1:
|
||||
if (modread == 1) return TRUE;
|
||||
break;
|
||||
case DEMOD_PSK2:
|
||||
if (modread == 2) return TRUE;
|
||||
break;
|
||||
case DEMOD_PSK3:
|
||||
detRate = GetPskClock("",FALSE, FALSE);
|
||||
if (expected[readRate] == detRate)
|
||||
return TRUE;
|
||||
if (modread == 3) return TRUE;
|
||||
break;
|
||||
case DEMOD_NRZ:
|
||||
detRate = GetNrzClock("",FALSE, FALSE);
|
||||
if (expected[readRate] == detRate)
|
||||
return TRUE;
|
||||
if (modread == 7) return TRUE;
|
||||
break;
|
||||
case DEMOD_BI:
|
||||
if (modread == 6) return TRUE;
|
||||
break;
|
||||
default:
|
||||
return FALSE;
|
||||
@@ -624,13 +637,60 @@ bool testBitRate(uint8_t readRate, uint8_t mod){
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
bool test(uint8_t mode, uint8_t *offset, int *fndBitRate){
|
||||
bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){
|
||||
|
||||
if ( DemodBufferLen < 64 ) return FALSE;
|
||||
uint8_t si = 0;
|
||||
for (uint8_t idx = 0; idx < 64; idx++){
|
||||
for (uint8_t idx = 28; idx < 64; idx++){
|
||||
si = idx;
|
||||
if ( PackBits(si, 32, DemodBuffer) == 0x00 ) continue;
|
||||
if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;
|
||||
|
||||
uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key
|
||||
uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;
|
||||
// 2nibble must be zeroed.
|
||||
if (safer != 0x6) continue;
|
||||
if ( resv > 0x00) continue;
|
||||
//uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
//uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
si += 1+1;
|
||||
int bitRate = PackBits(si, 5, DemodBuffer)*2 + 2; si += 5; //bit rate
|
||||
if (bitRate > 128 || bitRate < 8) continue;
|
||||
|
||||
//uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
//uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
//uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr
|
||||
//uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
si += 1+1+2+1;
|
||||
uint8_t modread = PackBits(si, 3, DemodBuffer); si += 3;
|
||||
uint8_t maxBlk = PackBits(si, 3, DemodBuffer); si += 3;
|
||||
//uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
if (maxBlk == 0) continue;
|
||||
//test modulation
|
||||
if (!testQ5Modulation(mode, modread)) continue;
|
||||
if (bitRate != clk) continue;
|
||||
*fndBitRate = bitRate;
|
||||
*offset = idx;
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
bool testBitRate(uint8_t readRate, uint8_t clk){
|
||||
uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};
|
||||
if (expected[readRate] == clk)
|
||||
return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5){
|
||||
|
||||
if ( DemodBufferLen < 64 ) return FALSE;
|
||||
uint8_t si = 0;
|
||||
for (uint8_t idx = 28; idx < 64; idx++){
|
||||
si = idx;
|
||||
if ( PackBits(si, 28, DemodBuffer) == 0x00 ) continue;
|
||||
|
||||
uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key
|
||||
uint8_t resv = PackBits(si, 4, DemodBuffer); si += 4; //was 7 & +=7+3 //should be only 4 bits if extended mode
|
||||
@@ -655,9 +715,14 @@ bool test(uint8_t mode, uint8_t *offset, int *fndBitRate){
|
||||
}
|
||||
//test modulation
|
||||
if (!testModulation(mode, modread)) continue;
|
||||
if (!testBitRate(bitRate, mode)) continue;
|
||||
if (!testBitRate(bitRate, clk)) continue;
|
||||
*fndBitRate = bitRate;
|
||||
*offset = idx;
|
||||
*Q5 = FALSE;
|
||||
return TRUE;
|
||||
}
|
||||
if (testQ5(mode, offset, fndBitRate, clk)) {
|
||||
*Q5 = TRUE;
|
||||
return TRUE;
|
||||
}
|
||||
return FALSE;
|
||||
@@ -681,7 +746,8 @@ void printT55xxBlock(const char *blockNum){
|
||||
bits[i - config.offset] = DemodBuffer[i];
|
||||
|
||||
blockData = PackBits(0, 32, bits);
|
||||
PrintAndLog("%s | %08X | %s", blockNum, blockData, sprint_bin(bits,32));
|
||||
|
||||
PrintAndLog(" %s | %08X | %s", blockNum, blockData, sprint_bin(bits,32));
|
||||
}
|
||||
|
||||
int special(const char *Cmd) {
|
||||
@@ -704,6 +770,7 @@ int special(const char *Cmd) {
|
||||
}
|
||||
|
||||
int printConfiguration( t55xx_conf_block_t b){
|
||||
PrintAndLog("Chip Type : %s", (b.Q5) ? "T5555(Q5)" : "T55x7");
|
||||
PrintAndLog("Modulation : %s", GetSelectedModulationStr(b.modulation) );
|
||||
PrintAndLog("Bit Rate : %s", GetBitRateStr(b.bitrate) );
|
||||
PrintAndLog("Inverted : %s", (b.inverted) ? "Yes" : "No" );
|
||||
@@ -851,11 +918,11 @@ int CmdT55xxReadTrace(const char *Cmd) {
|
||||
else
|
||||
year += 2010;
|
||||
|
||||
if (config.Q5) PrintAndLog("*** Warning *** Info read off a Q5 will not work as expected");
|
||||
if ( acl != 0xE0 ) {
|
||||
PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");
|
||||
return 0;
|
||||
}
|
||||
|
||||
PrintAndLog("");
|
||||
PrintAndLog("-- T55xx Trace Information ----------------------------------");
|
||||
PrintAndLog("-------------------------------------------------------------");
|
||||
@@ -931,7 +998,7 @@ int CmdT55xxInfo(const char *Cmd){
|
||||
uint32_t fw = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
uint32_t inv = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
uint32_t por = PackBits(si, 1, DemodBuffer); si += 1;
|
||||
|
||||
if (config.Q5) PrintAndLog("*** Warning *** Config Info read off a Q5 will not display as expected");
|
||||
PrintAndLog("");
|
||||
PrintAndLog("-- T55xx Configuration & Tag Information --------------------");
|
||||
PrintAndLog("-------------------------------------------------------------");
|
||||
@@ -971,16 +1038,14 @@ int CmdT55xxDump(const char *Cmd){
|
||||
override = true;
|
||||
}
|
||||
|
||||
PrintAndLog("Reading Page 0:");
|
||||
PrintAndLog("blk | hex data | binary");
|
||||
for ( uint8_t i = 0; i < 8; ++i){
|
||||
printT5xxHeader(0);
|
||||
for ( uint8_t i = 0; i < 8; ++i)
|
||||
T55xxReadBlock(i, 0, usepwd, override, password);
|
||||
}
|
||||
PrintAndLog("Reading Page 1:");
|
||||
PrintAndLog("blk | hex data | binary");
|
||||
for ( uint8_t i = 0; i < 4; i++){
|
||||
|
||||
printT5xxHeader(1);
|
||||
for ( uint8_t i = 0; i < 4; i++)
|
||||
T55xxReadBlock(i, 1, usepwd, override, password);
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -1203,6 +1268,26 @@ int CmdResetRead(const char *Cmd) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
int CmdT55xxWipe(const char *Cmd) {
|
||||
char writeData[20] = {0};
|
||||
char *ptrData = writeData;
|
||||
uint8_t blk = 0;
|
||||
PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");
|
||||
//try with the default password to reset block 0 (with a pwd should work even if pwd bit not set)
|
||||
snprintf(ptrData,sizeof(writeData),"b %d d 00088040 p 0", blk);
|
||||
if (!CmdT55xxWriteBlock(ptrData)){
|
||||
PrintAndLog("Error writing blk %d", blk);
|
||||
}
|
||||
blk = 1;
|
||||
for (; blk<8; blk++) {
|
||||
snprintf(ptrData,sizeof(writeData),"b %d d 0", blk);
|
||||
if (!CmdT55xxWriteBlock(ptrData)){
|
||||
PrintAndLog("Error writing blk %d", blk);
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static command_t CommandTable[] =
|
||||
{
|
||||
{"help", CmdHelp, 1, "This help"},
|
||||
@@ -1211,11 +1296,12 @@ static command_t CommandTable[] =
|
||||
{"read", CmdT55xxReadBlock, 0, "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},
|
||||
{"resetread",CmdResetRead, 0, "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},
|
||||
{"write", CmdT55xxWriteBlock,0, "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},
|
||||
{"trace", CmdT55xxReadTrace, 0, "[1] Show T55xx traceability data (page 1/ blk 0-1)"},
|
||||
{"info", CmdT55xxInfo, 0, "[1] Show T55xx configuration data (page 0/ blk 0)"},
|
||||
{"trace", CmdT55xxReadTrace, 0, "[1] Show T55x7 traceability data (page 1/ blk 0-1)"},
|
||||
{"info", CmdT55xxInfo, 0, "[1] Show T55x7 configuration data (page 0/ blk 0)"},
|
||||
{"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},
|
||||
{"special", special, 0, "Show block changes with 64 different offsets"},
|
||||
{"wakeup", CmdT55xxWakeUp, 0, "Send AOR wakeup command"},
|
||||
{"wipe", CmdT55xxWipe, 0, "Wipe a T55xx tag and set defaults (will destroy any data on tag)"},
|
||||
{NULL, NULL, 0, NULL}
|
||||
};
|
||||
|
||||
|
||||
+4
-1
@@ -59,6 +59,7 @@ typedef struct {
|
||||
RF_100 = 0x06,
|
||||
RF_128 = 0x07,
|
||||
} bitrate;
|
||||
bool Q5;
|
||||
} t55xx_conf_block_t;
|
||||
t55xx_conf_block_t Get_t55xx_Config();
|
||||
void Set_t55xx_Config(t55xx_conf_block_t conf);
|
||||
@@ -72,6 +73,7 @@ int CmdT55xxReadTrace(const char *Cmd);
|
||||
int CmdT55xxInfo(const char *Cmd);
|
||||
int CmdT55xxDetect(const char *Cmd);
|
||||
int CmdResetRead(const char *Cmd);
|
||||
int CmdT55xxWipe(const char *Cmd);
|
||||
|
||||
char * GetBitRateStr(uint32_t id);
|
||||
char * GetSaferStr(uint32_t id);
|
||||
@@ -79,12 +81,13 @@ char * GetModulationStr( uint32_t id);
|
||||
char * GetModelStrFromCID(uint32_t cid);
|
||||
char * GetSelectedModulationStr( uint8_t id);
|
||||
uint32_t PackBits(uint8_t start, uint8_t len, uint8_t *bitstream);
|
||||
void printT5xxHeader(uint8_t page);
|
||||
void printT55xxBlock(const char *demodStr);
|
||||
int printConfiguration( t55xx_conf_block_t b);
|
||||
|
||||
bool DecodeT55xxBlock();
|
||||
bool tryDetectModulation();
|
||||
bool test(uint8_t mode, uint8_t *offset, int *fndBitRate);
|
||||
bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5);
|
||||
int special(const char *Cmd);
|
||||
int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password );
|
||||
|
||||
|
||||
@@ -23,8 +23,8 @@ int usage_lf_viking_clone(void){
|
||||
//see ASKDemod for what args are accepted
|
||||
int CmdVikingDemod(const char *Cmd)
|
||||
{
|
||||
CmdLFRead("s");
|
||||
getSamples("30000",false);
|
||||
//CmdLFRead("s");
|
||||
//getSamples("30000",false);
|
||||
|
||||
if (!ASKDemod(Cmd, false, false, 1)) {
|
||||
if (g_debugMode) PrintAndLog("ASKDemod failed");
|
||||
@@ -34,7 +34,7 @@ int CmdVikingDemod(const char *Cmd)
|
||||
|
||||
int ans = VikingDemod_AM(DemodBuffer, &size);
|
||||
if (ans < 0) {
|
||||
if (g_debugMode) PrintAndLog("Error Viking_Demod");
|
||||
if (g_debugMode) PrintAndLog("Error Viking_Demod %d", ans);
|
||||
return 0;
|
||||
}
|
||||
//got a good demod
|
||||
|
||||
+199
-192
File diff suppressed because it is too large
Load Diff
+1
-1
@@ -32,7 +32,7 @@ int getHiLo(uint8_t *BitStream, size_t size, int *high, int *low, uint8_t f
|
||||
uint32_t manchesterEncode2Bytes(uint16_t datain);
|
||||
int ManchesterEncode(uint8_t *BitStream, size_t size);
|
||||
int manrawdecode(uint8_t *BitStream, size_t *size, uint8_t invert);
|
||||
int nrzRawDemod(uint8_t *dest, size_t *size, int *clk, int *invert, int maxErr);
|
||||
int nrzRawDemod(uint8_t *dest, size_t *size, int *clk, int *invert);
|
||||
uint8_t parityTest(uint32_t bits, uint8_t bitLen, uint8_t pType);
|
||||
uint8_t preambleSearch(uint8_t *BitStream, uint8_t *preamble, size_t pLen, size_t *size, size_t *startIdx);
|
||||
int pskRawDemod(uint8_t dest[], size_t *size, int *clock, int *invert);
|
||||
|
||||
Reference in New Issue
Block a user