rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-05-12 11:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream/master'

Browse Source
This commit is contained in:
Colin J. Brigato
2018-09-05 20:39:56 +02:00
parent 2263c826db 972d30474d
commit 76e2d7502a
17 changed files with 509 additions and 407 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+7 -1
View File
@@ -3,10 +3,16 @@ All notable changes to this project will be documented in this file.
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
## [unreleased][unreleased]
- Changed 'proxmark3 client threading' - remake from official repo (@micolous)
- Add 'rem' - new command that adds a line to the log file (@didierStevens)
- Fix 'EM410xdemod empty tag id in lfops.c' (@Defensor7)
- Fix 'usb device descriptor' - some android phones will enumerate better when iSerialnumber isn't a multiple of 8 (@micolous, @megabug)
- Fix 'StandaloneMode LF' - when collecting signal, justNoise detection is needed (@didierStevens, @Megabug)
- Fix 'StandAloneMode Colin' - mifare1ksim called with right params (@cjbrigato)
- Improved 'install.sh' to install dependencies for Ubuntu 18.04 and using max number of processors during compilation (@joanbono)
- Modified 'install.sh' script to work in macOS and Linux + added the 'update.sh' and 'proxmark3.sh' from joanbono (@TomHarkness)
- Fix 'hf emv' - some cards need to have Le=0x00, some need to not to have (@merlokk)
- Fix 'hf emv' - some cards need to have Le=0x00, some don't need to have (@merlokk)
- Fix 'hf legic' enhancement of rx / tx in legic commands (@drandreas)
- Fix 'data buffclear' - now frees bigbuff also (@iceman)
- Fix GET_TICKS and signess while shifting (@drandreas)
armsrc/BigBuf.c
+24 -42
View File
@@ -34,14 +34,12 @@ static uint16_t traceLen = 0;
int tracing = 1; //Last global one.. todo static?
// get the address of BigBuf
uint8_t *BigBuf_get_addr(void)
{
uint8_t *BigBuf_get_addr(void) {
return (uint8_t *)BigBuf;
}
// get the address of the emulator memory. Allocate part of Bigbuf for it, if not yet done
uint8_t *BigBuf_get_EM_addr(void)
{
uint8_t *BigBuf_get_EM_addr(void) {
// not yet allocated
if (emulator_memory == NULL)
emulator_memory = BigBuf_malloc(CARD_MEMORY_SIZE);
@@ -50,53 +48,45 @@ uint8_t *BigBuf_get_EM_addr(void)
}
// clear ALL of BigBuf
void BigBuf_Clear(void)
{
void BigBuf_Clear(void) {
BigBuf_Clear_ext(true);
}
// clear ALL of BigBuf
void BigBuf_Clear_ext(bool verbose)
{
void BigBuf_Clear_ext(bool verbose) {
memset(BigBuf, 0, BIGBUF_SIZE);
if (verbose)
Dbprintf("Buffer cleared (%i bytes)", BIGBUF_SIZE);
}
void BigBuf_Clear_EM(void){
void BigBuf_Clear_EM(void) {
memset(BigBuf_get_EM_addr(), 0, CARD_MEMORY_SIZE);
}
void BigBuf_Clear_keep_EM(void)
{
void BigBuf_Clear_keep_EM(void) {
memset(BigBuf, 0, BigBuf_hi);
}
// allocate a chunk of memory from BigBuf. We allocate high memory first. The unallocated memory
// at the beginning of BigBuf is always for traces/samples
uint8_t *BigBuf_malloc(uint16_t chunksize)
{
if (BigBuf_hi - chunksize < 0) {
uint8_t *BigBuf_malloc(uint16_t chunksize) {
if (BigBuf_hi - chunksize < 0)
return NULL; // no memory left
} else {
chunksize = (chunksize + 3) & 0xfffc; // round to next multiple of 4
BigBuf_hi -= chunksize; // aligned to 4 Byte boundary
return (uint8_t *)BigBuf + BigBuf_hi;
}
chunksize = (chunksize + 3) & 0xfffc; // round to next multiple of 4
BigBuf_hi -= chunksize; // aligned to 4 Byte boundary
return (uint8_t *)BigBuf + BigBuf_hi;
}
// free ALL allocated chunks. The whole BigBuf is available for traces or samples again.
void BigBuf_free(void)
{
void BigBuf_free(void){
BigBuf_hi = BIGBUF_SIZE;
emulator_memory = NULL;
// shouldn't this empty BigBuf also?
}
// free allocated chunks EXCEPT the emulator memory
void BigBuf_free_keep_EM(void)
{
void BigBuf_free_keep_EM(void) {
if (emulator_memory != NULL)
BigBuf_hi = emulator_memory - (uint8_t *)BigBuf;
else
@@ -105,8 +95,7 @@ void BigBuf_free_keep_EM(void)
// shouldn't this empty BigBuf also?
}
void BigBuf_print_status(void)
{
void BigBuf_print_status(void) {
Dbprintf("Memory");
Dbprintf(" BIGBUF_SIZE.............%d", BIGBUF_SIZE);
Dbprintf(" Available memory........%d", BigBuf_hi);
@@ -116,12 +105,11 @@ void BigBuf_print_status(void)
}
// return the maximum trace length (i.e. the unallocated size of BigBuf)
uint16_t BigBuf_max_traceLen(void)
{
uint16_t BigBuf_max_traceLen(void) {
return BigBuf_hi;
}
void clear_trace() {
void clear_trace(void) {
traceLen = 0;
}
void set_tracelen(uint16_t value) {
@@ -139,8 +127,7 @@ bool get_tracing(void) {
* Get the number of bytes traced
* @return
*/
uint16_t BigBuf_get_traceLen(void)
{
uint16_t BigBuf_get_traceLen(void) {
return traceLen;
}
@@ -150,8 +137,7 @@ uint16_t BigBuf_get_traceLen(void)
by 'hf list raw', alternatively 'hf list <proto>' for protocol-specific
annotation of commands/responses.
**/
bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag)
{
bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag) {
if (!tracing) return false;
uint8_t *trace = BigBuf_get_addr();
@@ -209,9 +195,7 @@ bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_
return true;
}
int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int readerToTag)
{
int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int readerToTag) {
/**
Todo, rewrite the logger to use the generic functionality instead. It should be noted, however,
that this logger takes number of bits as argument, not number of bytes.
@@ -252,15 +236,13 @@ int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwP
return true;
}
// Emulator memory
uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length){
uint8_t* mem = BigBuf_get_EM_addr();
if(offset+length < CARD_MEMORY_SIZE) {
if (offset + length < CARD_MEMORY_SIZE) {
memcpy(mem+offset, data, length);
return 0;
} else {
Dbprintf("Error, trying to set memory outside of bounds! %d > %d", (offset+length), CARD_MEMORY_SIZE);
return 1;
}
}
Dbprintf("Error, trying to set memory outside of bounds! %d > %d", (offset + length), CARD_MEMORY_SIZE);
return 1;
}
armsrc/Standalone/lf_hidbrute.c
+27 -30
View File
@@ -47,7 +47,7 @@ void RunMod() {
// Was our button held down or pressed?
int button_pressed = BUTTON_HELD(1000);
//SpinDelay(300);
SpinDelay(300);
// Button was held for a second, begin recording
if (button_pressed > 0 && cardRead == 0) {
@@ -56,7 +56,7 @@ void RunMod() {
LED(LED_RED2, 0);
// record
DbpString("[+] starting recording");
DbpString("[=] starting recording");
// wait for button to be released
while(BUTTON_PRESS())
@@ -66,7 +66,7 @@ void RunMod() {
SpinDelay(500);
CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
Dbprintf("[+] recorded %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] recorded %x %x %08x", selected, high[selected], low[selected]);
LEDsoff();
LED(selected + 1, 0);
@@ -82,7 +82,7 @@ void RunMod() {
LED(LED_ORANGE, 0);
// record
Dbprintf("[+] cloning %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] cloning %x %x %08x", selected, high[selected], low[selected]);
// wait for button to be released
while(BUTTON_PRESS())
@@ -92,7 +92,7 @@ void RunMod() {
SpinDelay(500);
CopyHIDtoT55x7(0, high[selected], low[selected], 0);
Dbprintf("[+] cloned %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] cloned %x %x %08x", selected, high[selected], low[selected]);
LEDsoff();
LED(selected + 1, 0);
@@ -109,6 +109,7 @@ void RunMod() {
// Next option if we were previously playing
if (playing)
selected = (selected + 1) % OPTS;
playing = !playing;
LEDsoff();
@@ -118,21 +119,18 @@ void RunMod() {
if (playing && selected != 2) {
LED(LED_GREEN, 0);
DbpString("[+] playing");
DbpString("[=] playing");
// wait for button to be released
while (BUTTON_PRESS())
WDT_HIT();
Dbprintf("[+] %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] %x %x %08x", selected, high[selected], low[selected]);
CmdHIDsimTAG(high[selected], low[selected], 0);
DbpString("[+] done playing");
DbpString("[=] done playing");
if (BUTTON_HELD(1000) > 0) {
DbpString("[+] exiting");
LEDsoff();
return;
}
if (BUTTON_HELD(1000) > 0)
goto out;
/* We pressed a button so ignore it here with a delay */
SpinDelay(300);
@@ -166,18 +164,18 @@ void RunMod() {
uint32_t fc = ((high[selected] & 1 ) << 11 ) | (low[selected] >> 21);
uint32_t original_cardnum = cardnum;
Dbprintf("[+] Proxbrute - starting decrementing card number");
Dbprintf("[=] Proxbrute - starting decrementing card number");
while (cardnum >= 0) {
// Needed for exiting from proxbrute when button is pressed
if (BUTTON_PRESS()) {
if (BUTTON_HELD(1000) > 0) {
DbpString("[+] exiting");
LEDsoff();
return;
goto out;
} else {
while (BUTTON_PRESS()) { WDT_HIT(); }
while (BUTTON_PRESS()) {
WDT_HIT();
}
break;
}
}
@@ -189,23 +187,21 @@ void RunMod() {
hid_corporate_1000_calculate_checksum_and_set(&high[selected], &low[selected], cardnum, fc);
// Print actual code to brute
Dbprintf("[+] TAG ID: %x%08x (%d) - FC: %u - Card: %u", high[selected], low[selected], (low[selected] >> 1) & 0xFFFF, fc, cardnum);
Dbprintf("[=] TAG ID: %x%08x (%d) - FC: %u - Card: %u", high[selected], low[selected], (low[selected] >> 1) & 0xFFFF, fc, cardnum);
CmdHIDsimTAGEx(high[selected], low[selected], 1, 50000);
}
cardnum = original_cardnum;
Dbprintf("[+] Proxbrute - starting incrementing card number");
Dbprintf("[=] Proxbrute - starting incrementing card number");
while (cardnum <= 0xFFFFF) {
// Needed for exiting from proxbrute when button is pressed
if (BUTTON_PRESS()) {
if (BUTTON_HELD(1000) > 0) {
DbpString("[+] exiting");
LEDsoff();
return;
goto out;
} else {
while (BUTTON_PRESS()) { WDT_HIT(); }
break;
@@ -219,17 +215,14 @@ void RunMod() {
hid_corporate_1000_calculate_checksum_and_set(&high[selected], &low[selected], cardnum, fc);
// Print actual code to brute
Dbprintf("[+] TAG ID: %x%08x (%d) - FC: %u - Card: %u", high[selected], low[selected], (low[selected] >> 1) & 0xFFFF, fc, cardnum);
Dbprintf("[=] TAG ID: %x%08x (%d) - FC: %u - Card: %u", high[selected], low[selected], (low[selected] >> 1) & 0xFFFF, fc, cardnum);
CmdHIDsimTAGEx(high[selected], low[selected], 1, 50000);
}
DbpString("[+] done bruteforcing");
if (BUTTON_HELD(1000) > 0) {
DbpString("Exiting");
LEDsoff();
return;
}
DbpString("[=] done bruteforcing");
if (BUTTON_HELD(1000) > 0)
goto out;
/* We pressed a button so ignore it here with a delay */
SpinDelay(300);
@@ -246,6 +239,10 @@ void RunMod() {
}
}
}
out:
DbpString("[=] exiting");
LEDsoff();
}
// Function that calculate next value for the brutforce of HID corporate 1000
armsrc/Standalone/lf_proxbrute.c
+15 -15
View File
@@ -32,7 +32,7 @@ void RunMod() {
// Was our button held down or pressed?
int button_pressed = BUTTON_HELD(1000);
//SpinDelay(300);
SpinDelay(300);
// Button was held for a second, begin recording
if (button_pressed > 0 && cardRead == 0) {
@@ -41,7 +41,7 @@ void RunMod() {
LED(LED_RED2, 0);
// record
DbpString("[+] starting recording");
DbpString("[=] starting recording");
// wait for button to be released
while (BUTTON_PRESS())
@@ -51,7 +51,7 @@ void RunMod() {
SpinDelay(500);
CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
Dbprintf("[+] recorded %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] recorded %x %x %08x", selected, high[selected], low[selected]);
LEDsoff();
LED(selected + 1, 0);
@@ -67,7 +67,7 @@ void RunMod() {
LED(LED_ORANGE, 0);
// record
Dbprintf("[+] cloning %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] cloning %x %x %08x", selected, high[selected], low[selected]);
// wait for button to be released
while (BUTTON_PRESS())
@@ -77,7 +77,7 @@ void RunMod() {
SpinDelay(500);
CopyHIDtoT55x7(0, high[selected], low[selected], 0);
Dbprintf("[+] cloned %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] cloned %x %x %08x", selected, high[selected], low[selected]);
LEDsoff();
LED(selected + 1, 0);
@@ -102,7 +102,7 @@ void RunMod() {
// Begin transmitting
if (playing) {
LED(LED_GREEN, 0);
DbpString("[+] playing");
DbpString("[=] playing");
// wait for button to be released
while (BUTTON_PRESS())
WDT_HIT();
@@ -120,7 +120,7 @@ void RunMod() {
*/
if ( selected == 1 ) {
DbpString("[=] entering ProxBrute Mode");
Dbprintf("[+] current Tag: Selected = %x Facility = %08x ID = %08x", selected, high[selected], low[selected]);
Dbprintf("[=] current Tag: Selected = %x Facility = %08x ID = %08x", selected, high[selected], low[selected]);
LED(LED_ORANGE, 0);
LED(LED_RED, 0);
for (uint16_t i = low[selected]-1; i > 0; i--) {
@@ -135,20 +135,17 @@ void RunMod() {
}
} else {
DbpString("[+] RED is lit, not entering ProxBrute Mode");
Dbprintf("[+] %x %x %x", selected, high[selected], low[selected]);
DbpString("[=] RED is lit, not entering ProxBrute Mode");
Dbprintf("[=] %x %x %x", selected, high[selected], low[selected]);
CmdHIDsimTAGEx(high[selected], low[selected], 0, 20000);
DbpString("[+] done playing");
DbpString("[=] done playing");
}
/* END PROXBRUTE */
if (BUTTON_HELD(1000) > 0) {
DbpString("[+] exiting");
LEDsoff();
return;
}
if (BUTTON_HELD(1000) > 0)
goto out;
/* We pressed a button so ignore it here with a delay */
SpinDelay(300);
@@ -165,4 +162,7 @@ void RunMod() {
}
}
}
out:
DbpString("[=] exiting");
LEDsoff();
}
armsrc/Standalone/lf_samyrun.c
+24 -16
View File
@@ -19,7 +19,7 @@ void RunMod() {
int selected = 0;
int playing = 0;
int cardRead = 0;
bool gotCard;
// Turn on selected LED
LED(selected + 1, 0);
@@ -31,7 +31,9 @@ void RunMod() {
// Was our button held down or pressed?
int button_pressed = BUTTON_HELD(1000);
//SpinDelay(300);
Dbprintf("button %d", button_pressed);
SpinDelay(300);
// Button was held for a second, begin recording
if (button_pressed > 0 && cardRead == 0) {
@@ -40,7 +42,7 @@ void RunMod() {
LED(LED_RED2, 0);
// record
DbpString("[+] starting recording");
DbpString("[=] starting recording");
// wait for button to be released
while (BUTTON_PRESS())
@@ -50,7 +52,7 @@ void RunMod() {
SpinDelay(500);
CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
Dbprintf("[+] recorded %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] recorded bank %x | %x %08x", selected, high[selected], low[selected]);
LEDsoff();
LED(selected + 1, 0);
@@ -58,7 +60,9 @@ void RunMod() {
// If we were previously playing, set playing off
// so next button push begins playing what we recorded
playing = 0;
cardRead = 1;
cardRead = 1;
gotCard = true;
}
else if (button_pressed > 0 && cardRead == 1) {
LEDsoff();
@@ -66,7 +70,7 @@ void RunMod() {
LED(LED_ORANGE, 0);
// record
Dbprintf("[+] cloning %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] cloning %x %x %08x", selected, high[selected], low[selected]);
// wait for button to be released
while (BUTTON_PRESS())
@@ -76,7 +80,7 @@ void RunMod() {
SpinDelay(500);
CopyHIDtoT55x7(0, high[selected], low[selected], 0);
Dbprintf("[+] cloned %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] cloned %x %x %08x", selected, high[selected], low[selected]);
LEDsoff();
LED(selected + 1, 0);
@@ -89,10 +93,11 @@ void RunMod() {
}
// Change where to record (or begin playing)
else if (button_pressed) {
else if (button_pressed && gotCard) {
// Next option if we were previously playing
if (playing)
selected = (selected + 1) % OPTS;
playing = !playing;
LEDsoff();
@@ -100,21 +105,20 @@ void RunMod() {
// Begin transmitting
if (playing) {
LED(LED_GREEN, 0);
DbpString("[+] playing");
DbpString("[=] playing");
// wait for button to be released
while (BUTTON_PRESS())
WDT_HIT();
Dbprintf("[+] %x %x %08x", selected, high[selected], low[selected]);
Dbprintf("[=] %x %x %08x", selected, high[selected], low[selected]);
CmdHIDsimTAG(high[selected], low[selected], false);
DbpString("[+] done playing");
DbpString("[=] done playing");
if (BUTTON_HELD(1000) > 0) {
DbpString("[+] exiting");
LEDsoff();
return;
}
if (BUTTON_HELD(1000) > 0)
goto out;
/* We pressed a button so ignore it here with a delay */
SpinDelay(300);
@@ -131,4 +135,8 @@ void RunMod() {
}
}
}
out:
DbpString("[=] exiting");
LEDsoff();
}
armsrc/Standalone/readme.md
+77 -3
View File
@@ -6,8 +6,25 @@ If you want to implement a new standalone mode, you need to implement the method
## Implementing a standalone mode
Each standalone mod needs to have its own compiler flag to be added in `armsrc\makefile` and inside the function `AppMain` inside AppMain.c. Inside Appmain a call to RunMod is needed. It looks strange because of what kinds of dependencies your mode will have.
The RunMod function is your "main" function when running. You need to check for Usb commands, in order to let the pm3 client break the standalone mode.
Each standalone mod needs to have its own compiler flag to be added in `armsrc\makefile` and inside the function `AppMain` inside AppMain.c. Inside Appmain a call to RunMod is needed. It looks strange because of what kinds of dependencies your mode will have.
The RunMod function is your "main" function when running. You need to check for Usb commands, in order to let the pm3 client break the standalone mode. See this basic skeleton of main function RunMod().
````
void RunMod() {
// led show
StandAloneMode();
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
// main loop
for (;;) {
WDT_HIT();
// exit from standalone mode, just send a usbcommand
if (usb_poll_validate_length()) break;
// do your standalone stuff..
}
````
As it is now, you can only have one standalone mode installed at the time.
@@ -15,14 +32,71 @@ As it is now, you can only have one standalone mode installed at the time.
Use HF/LF to denote which frequence your mod is targeting.
Use you own github name/similar for perpetual honour to denote your mod
Samples:
Samples of directive flag used in the `armsrc\makefile`:
```
### -DWITH_LF_ICERUN
### -DWITH_LF_SAMYRUN
### -DWITH_LF_PROXBRUTE
### -DWITH_LF_HIDBRUTE
### -DWITH_HF_COLIN
### -DWITH_HF_YOUNG
### -DWITH_HF_MATTYRUN
```
Add your source code file like the following sample in the `armsrc\makefile`
```
# WITH_HF_COLIN
ifneq (,$(findstring WITH_HF_COLIN,$(APP_CFLAGS)))
SRC_STANDALONE = hf_colin.c vtsend.c
else
SRC_STANDALONE =
endif
```
## Adding identification of your mode
Do please add a identification string in the function `printStandAloneModes` inside `armsrc\appmain.c`
This will enable an easy way to detect on client side which standalone mods has been installed on the device.
```
#if defined(WITH_HF_COLIN)
DbpString(" HF Mifare ultra fast sniff/sim/clone - aka VIGIKPWN (Colin Brigato)");
#endif
````
Once all this is done, you and others can now easily compile different standalone modes by just swapping the -D directive in `armsrc\makefile`
````
#remove one of the following defines and comment out the relevant line
#in the next section to remove that particular feature from compilation.
# NO space,TABs after the "\" sign.
APP_CFLAGS = -DWITH_CRC \
-DON_DEVICE \
-DWITH_LF \
-DWITH_HITAG \
-DWITH_ISO15693 \
-DWITH_LEGICRF \
-DWITH_ISO14443b \
-DWITH_ISO14443a \
-DWITH_ICLASS \
-DWITH_FELICA \
-DWITH_FLASH \
-DWITH_SMARTCARD \
-DWITH_HFSNOOP \
-DWITH_HF_COLIN\
-DWITH_FPC \
-fno-strict-aliasing -ffunction-sections -fdata-sections
### IMPORTANT - move the commented variable below this line
# -DWITH_LCD \
# -DWITH_EMV \
# -DWITH_FPC \
#
# Standalone Mods
#-------------------------------------------------------
# -DWITH_LF_ICERUN
# -DWITH_LF_SAMYRUN
# -DWITH_LF_PROXBRUTE
# -DWITH_LF_HIDBRUTE
# -DWITH_HF_YOUNG
# -DWITH_HF_MATTYRUN
# -DWITH_HF_COLIN
````
armsrc/lfops.c
+16 -14
View File
@@ -27,10 +27,10 @@
#endif
#define START_GAP 31*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (15fc)
#define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (10fc)
#define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (24fc)
#define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (56fc) 432 for T55x7; 448 for E5550
#define START_GAP 48*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (15fc)
#define WRITE_GAP 18*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (10fc)
#define WRITE_0 24*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (24fc)
#define WRITE_1 54*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (56fc) 432 for T55x7; 448 for E5550
#define READ_GAP 15*8
// VALUES TAKEN FROM EM4x function: SendForward
@@ -474,10 +474,10 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
StopTicks();
}
// note: a call to FpgaDownloadAndGo(FPGA_BITSTREAM_LF) must be done before, but
// this may destroy the bigbuf so be sure this is called before calling SimulateTagLowFrequencyEx
void SimulateTagLowFrequencyEx(int period, int gap, int ledcontrol, int numcycles) {
// note this may destroy the bigbuf so be sure this is called before now...
//FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
//FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE );
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
SpinDelay(20);
@@ -514,7 +514,7 @@ void SimulateTagLowFrequencyEx(int period, int gap, int ledcontrol, int numcycle
// wait until SSC_CLK goes HIGH
// used as a simple detection of a reader field?
while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
WDT_HIT();
if ( usb_poll_validate_length() || BUTTON_PRESS() )
goto OUT;
@@ -526,7 +526,7 @@ void SimulateTagLowFrequencyEx(int period, int gap, int ledcontrol, int numcycle
SHORT_COIL();
//wait until SSC_CLK goes LOW
while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
WDT_HIT();
//if ( usb_poll_validate_length() || BUTTON_PRESS() )
if ( BUTTON_PRESS() )
@@ -918,7 +918,7 @@ void CmdHIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol)
idx = HIDdemodFSK(dest, &size, &hi2, &hi, &lo, &dummyIdx);
if ( idx < 0 ) continue;
if (idx>0 && lo>0 && (size==96 || size==192)){
if (idx > 0 && lo > 0 && (size == 96 || size == 192)){
// go over previously decoded manchester data and decode into usable tag ID
if (hi2 != 0){ //extra large HID tags 88/192 bits
Dbprintf("TAG ID: %x%08x%08x (%d)",
@@ -979,7 +979,6 @@ void CmdHIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol)
);
}
if (findone){
if (ledcontrol) LED_A_OFF();
*high = hi;
*low = lo;
break;
@@ -1007,7 +1006,7 @@ void CmdAWIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol)
LFSetupFPGAForADC(95, true);
while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
while (!BUTTON_PRESS() && !usb_poll_validate_length()) {
WDT_HIT();
if (ledcontrol) LED_A_ON();
@@ -1107,6 +1106,7 @@ void CmdEM410xdemod(int findone, uint32_t *high, uint64_t *low, int ledcontrol)
if (ledcontrol) LED_A_ON();
DoAcquisition_default(-1, true);
size = BigBuf_max_traceLen();
//askdemod and manchester decode
if (size > 16385) size = 16385; //big enough to catch 2 sequences of largest format
@@ -1116,7 +1116,7 @@ void CmdEM410xdemod(int findone, uint32_t *high, uint64_t *low, int ledcontrol)
if (errCnt < 0) continue;
errCnt = Em410xDecode(dest, &size, &idx, &hi, &lo);
if (errCnt){
if (errCnt == 1){
if (size == 128){
Dbprintf("EM XL TAG ID: %06x%08x%08x - (%05d_%03d_%08d)",
hi,
@@ -1169,7 +1169,9 @@ void CmdIOdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol) {
while (!BUTTON_PRESS() && !usb_poll_validate_length()) {
WDT_HIT();
if (ledcontrol) LED_A_ON();
DoAcquisition_default(-1,true);
DoAcquisition_default(-1, true);
//fskdemod and get start index
WDT_HIT();
idx = detectIOProx(dest, &size, &dummyIdx);
armsrc/lfsampling.c
+4
View File
@@ -202,6 +202,10 @@ uint32_t DoAcquisition(uint8_t decimation, uint32_t bits_per_sample, bool averag
Dbprintf("buffer samples: %02x %02x %02x %02x %02x %02x %02x %02x ...",
dest[0], dest[1], dest[2], dest[3], dest[4], dest[5], dest[6], dest[7]);
}
// Ensure that noise check is performed for any device-side processing
justNoise(dest, bufsize);
return data.numbits;
}
/**
client/cmddata.c
+216 -231
View File
File diff suppressed because it is too large Load Diff
client/cmdlfem4x.c
+1 -1
View File
@@ -1148,7 +1148,7 @@ int EM4x05ReadWord_ext(uint8_t addr, uint32_t pwd, bool usePwd, uint32_t *word)
}
int testLen = (GraphTraceLen < 1000) ? GraphTraceLen : 1000;
if (justNoise_int(GraphBuffer, testLen)) {
if (justNoise(GraphBuffer, testLen)) {
PrintAndLogEx(DEBUG, "No tag found");
return -1;
}
client/cmdlft55xx.c
+1 -1
View File
@@ -1315,7 +1315,7 @@ bool AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password ){
}
setGraphBuf(got, sizeof(got));
return !justNoise_int(GraphBuffer, sizeof(got));
return !justNoise(GraphBuffer, sizeof(got));
}
char * GetBitRateStr(uint32_t id, bool xmode) {
client/cmdmain.c
+14
View File
@@ -13,6 +13,7 @@
static int CmdHelp(const char *Cmd);
static int CmdQuit(const char *Cmd);
static int CmdRev(const char *Cmd);
static int CmdRem(const char *Cmd);
//For storing command that are received from the device
static UsbCommand cmdBuffer[CMD_BUFFER_SIZE];
@@ -33,6 +34,7 @@ static command_t CommandTable[] = {
{"hf", CmdHF, 1, "{ High Frequency commands... }"},
{"hw", CmdHW, 1, "{ Hardware commands... }"},
{"lf", CmdLF, 1, "{ Low Frequency commands... }"},
{"rem", CmdRem, 1, "{ Add text to row in log file }"},
{"reveng", CmdRev, 1, "{ Crc calculations from the software reveng 1.53... }"},
{"script", CmdScript, 1, "{ Scripting commands }"},
{"trace", CmdTrace, 1, "{ Trace manipulation... }"},
@@ -51,6 +53,18 @@ command_t* getTopLevelCommandTable() {
return CommandTable;
}
int CmdRem(const char *Cmd) {
char buf[22];
memset(buf, 0x00, sizeof(buf));
struct tm *curTime;
time_t now = time(0);
curTime = gmtime(&now);
strftime (buf, sizeof(buf), "%Y-%m-%dT%H:%M:%SZ", curTime); // ISO8601
PrintAndLogEx(NORMAL, "%s remark: %s", buf, Cmd);
return 0;
}
int CmdHelp(const char *Cmd) {
CmdsHelp(CommandTable);
return 0;
client/util.c
+3
View File
@@ -817,6 +817,9 @@ extern void str_lower(char *s ){
for(int i=0; i < strlen(s); i++)
s[i] = tolower( s[i] );
}
extern bool str_startswith(const char *s, const char *pre) {
return strncmp(pre, s, strlen(pre)) == 0;
}
// Replace unprintable characters with a dot in char buffer
extern void clean_ascii(unsigned char *buf, size_t len) {
client/util.h
+1
View File
@@ -247,6 +247,7 @@ extern uint64_t HornerScheme(uint64_t num, uint64_t divider, uint64_t factor);
extern int num_CPUs(void); // number of logical CPUs
extern void str_lower(char* s); // converts string to lower case
extern bool str_startswith(const char *s, const char *pre); // check for prefix in string
extern void strcleanrn(char *buf, size_t len);
extern void strcreplace(char *buf, size_t len, char from, char to);
extern char *strmcopy(char *buf);
common/lfdemod.c
+66 -44
View File
@@ -51,7 +51,9 @@
#define NOICE_AMPLITUDE_THRESHOLD 10
//to allow debug print calls when used not on dev
void dummy(char *fmt, ...){}
//void dummy(char *fmt, ...){}
extern void Dbprintf(const char *fmt, ...);
#ifndef ON_DEVICE
#include "ui.h"
# include "cmdparser.h"
@@ -59,7 +61,7 @@ void dummy(char *fmt, ...){}
# define prnt PrintAndLog
#else
uint8_t g_debugMode = 0;
# define prnt dummy
# define prnt Dbprintf
#endif
signal_t signalprop = { 255, -255, 0, 0, true };
@@ -105,10 +107,9 @@ int32_t compute_mean_int(int *in, size_t N) {
//test samples are not just noise
// By measuring mean and look at amplitude of signal from HIGH / LOW, we can detect noise
bool justNoise_int(int *bits, uint32_t size) {
bool isNoise_int(int *bits, uint32_t size) {
resetSignal();
if ( bits == NULL ) return true;
if ( size < 100 ) return true;
if ( bits == NULL || size < 100 ) return true;
int32_t sum = 0;
for ( size_t i = 0; i < size; i++) {
@@ -130,10 +131,9 @@ bool justNoise_int(int *bits, uint32_t size) {
//test samples are not just noise
// By measuring mean and look at amplitude of signal from HIGH / LOW,
// we can detect noise
bool justNoise(uint8_t *bits, uint32_t size) {
bool isNoise(uint8_t *bits, uint32_t size) {
resetSignal();
if ( bits == NULL ) return true;
if ( size < 100 ) return true;
if ( bits == NULL || size < 100 ) return true;
uint32_t sum = 0;
for ( uint32_t i = 0; i < size; i++) {
@@ -1553,16 +1553,15 @@ size_t fsk_wave_demod(uint8_t *dest, size_t size, uint8_t fchigh, uint8_t fclow,
size_t currSample = 0;
size_t last_transition = 0;
size_t idx = 1;
size_t numBits = 0;
//find start of modulating data in trace
idx = findModStart(dest, size, fchigh);
// Need to threshold first sample
if(dest[idx] < FSK_PSK_THRESHOLD) dest[0] = 0;
else dest[0] = 1;
dest[0] = (dest[idx] < FSK_PSK_THRESHOLD) ? 0 : 1;
last_transition = idx;
idx++;
size_t numBits = 0;
// Definition: cycles between consecutive lo-hi transitions
// Lets define some expected lengths. FSK1 is easier since it has bigger differences between.
@@ -1595,9 +1594,9 @@ size_t fsk_wave_demod(uint8_t *dest, size_t size, uint8_t fchigh, uint8_t fclow,
// the 1-0 to 0-1 width should be divided with exp_zero. Ie: 3+5+6+7 = 21/6 = 3
for(; idx < size-20; idx++) {
// threshold current value
if (dest[idx] < FSK_PSK_THRESHOLD) dest[idx] = 0;
else dest[idx] = 1;
dest[idx] = (dest[idx] < FSK_PSK_THRESHOLD) ? 0 : 1;
// Check for 0->1 transition
if (dest[idx-1] < dest[idx]) {
@@ -1612,16 +1611,24 @@ size_t fsk_wave_demod(uint8_t *dest, size_t size, uint8_t fchigh, uint8_t fclow,
dest[numBits-1]=1;
}
dest[numBits++]=1;
if (numBits > 0 && *startIdx==0) *startIdx = idx - fclow;
if (numBits > 0 && *startIdx == 0)
*startIdx = idx - fclow;
} else if (currSample > (fchigh+1) && numBits < 3) { //12 + and first two bit = unusable garbage
//do nothing with beginning garbage and reset.. should be rare..
numBits = 0;
} else if (currSample == (fclow+1) && LastSample == (fclow-1)) { // had a 7 then a 9 should be two 8's (or 4 then a 6 should be two 5's)
dest[numBits++]=1;
if (numBits > 0 && *startIdx==0) *startIdx = idx - fclow;
if (numBits > 0 && *startIdx == 0) {
*startIdx = idx - fclow;
}
} else { //9+ = 10 sample waves (or 6+ = 7)
dest[numBits++]=0;
if (numBits > 0 && *startIdx==0) *startIdx = idx - fchigh;
if (numBits > 0 && *startIdx == 0) {
*startIdx = idx - fchigh;
}
}
last_transition = idx;
}
@@ -1632,6 +1639,7 @@ size_t fsk_wave_demod(uint8_t *dest, size_t size, uint8_t fchigh, uint8_t fclow,
//translate 11111100000 to 10
//rfLen = clock, fchigh = larger field clock, fclow = smaller field clock
size_t aggregate_bits(uint8_t *dest, size_t size, uint8_t clk, uint8_t invert, uint8_t fchigh, uint8_t fclow, int *startIdx) {
uint8_t lastval = dest[0];
size_t i = 0;
size_t numBits = 0;
@@ -1643,13 +1651,16 @@ size_t aggregate_bits(uint8_t *dest, size_t size, uint8_t clk, uint8_t invert, u
if (dest[i] == lastval) continue; //skip until we hit a transition
//find out how many bits (n) we collected (use 1/2 clk tolerance)
if (dest[i-1] == 1)
//if lastval was 1, we have a 1->0 crossing
if (dest[i-1] == 1) {
n = (n * fclow + hclk) / clk;
} else {// 0->1 crossing
else
// 0->1 crossing
n = (n * fchigh + hclk) / clk;
}
if (n == 0) n = 1;
if (n == 0)
n = 1;
//first transition - save startidx
if (numBits == 0) {
@@ -1664,12 +1675,13 @@ size_t aggregate_bits(uint8_t *dest, size_t size, uint8_t clk, uint8_t invert, u
//add to our destination the bits we collected
memset(dest+numBits, dest[i-1] ^ invert , n);
//if (g_debugMode == 2) prnt("ICCE:: n %u | numbits %u", n, numBits);
numBits += n;
n = 0;
lastval = dest[i];
}//end for
// if valid extra bits at the end were all the same frequency - add them in
if (n > clk/fchigh) {
if (dest[i-2] == 1) {
@@ -1696,14 +1708,15 @@ size_t fskdemod(uint8_t *dest, size_t size, uint8_t rfLen, uint8_t invert, uint8
// by marshmellow
// convert psk1 demod to psk2 demod
// only transition waves are 1s
//TODO: Iceman - hard coded value 7, should be #define
void psk1TOpsk2(uint8_t *bits, size_t size) {
uint8_t lastBit = bits[0];
uint8_t lastbit = bits[0];
for (size_t i = 1; i < size; i++){
//ignore errors
if (bits[i] == 7) continue;
if (lastBit != bits[i]){
lastBit = bits[i];
if (lastbit != bits[i]){
lastbit = bits[i];
bits[i] = 1;
} else {
bits[i] = 0;
@@ -1726,6 +1739,7 @@ void psk2TOpsk1(uint8_t *bits, size_t size) {
//by marshmellow - demodulate PSK1 wave
//uses wave lengths (# Samples)
//TODO: Iceman - hard coded value 7, should be #define
int pskRawDemod_ext(uint8_t *dest, size_t *size, int *clock, int *invert, int *startIdx) {
// sanity check
@@ -1763,7 +1777,7 @@ int pskRawDemod_ext(uint8_t *dest, size_t *size, int *clock, int *invert, int *s
//set start of wave as clock align
lastClkBit = firstFullWave;
if (g_debugMode==2) prnt("DEBUG PSK: firstFullWave: %u, waveLen: %u, startIdx %i",firstFullWave,fullWaveLen, *startIdx);
if (g_debugMode==2) prnt("DEBUG PSK: clk: %d, lastClkBit: %u, fc: %u", *clock, lastClkBit,(unsigned int) fc);
if (g_debugMode == 2) prnt("DEBUG PSK: clk: %d, lastClkBit: %u, fc: %u", *clock, lastClkBit, fc);
waveStart = 0;
dest[numBits++] = curPhase; //set first read bit
for (i = firstFullWave + fullWaveLen - 1; i < *size-3; i++){
@@ -1809,8 +1823,8 @@ int pskRawDemod_ext(uint8_t *dest, size_t *size, int *clock, int *invert, int *s
}
int pskRawDemod(uint8_t *dest, size_t *size, int *clock, int *invert) {
int startIdx = 0;
return pskRawDemod_ext(dest, size, clock, invert, &startIdx);
int start_idx = 0;
return pskRawDemod_ext(dest, size, clock, invert, &start_idx);
}
@@ -1833,38 +1847,38 @@ int detectAWID(uint8_t *dest, size_t *size, int *waveStartIdx) {
//did we get a good demod?
if (*size < 96) return -3;
size_t startIdx = 0;
size_t start_idx = 0;
uint8_t preamble[] = {0,0,0,0,0,0,0,1};
if (!preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx))
if (!preambleSearch(dest, preamble, sizeof(preamble), size, &start_idx))
return -4; //preamble not found
// wrong size? (between to preambles)
if (*size != 96) return -5;
return (int)startIdx;
return (int)start_idx;
}
//by marshmellow
//takes 1s and 0s and searches for EM410x format - output EM ID
int Em410xDecode(uint8_t *bits, size_t *size, size_t *startIdx, uint32_t *hi, uint64_t *lo) {
int Em410xDecode(uint8_t *bits, size_t *size, size_t *start_idx, uint32_t *hi, uint64_t *lo) {
// sanity check
if (bits[1] > 1) return -1;
if (*size < 64) return -2;
uint8_t fmtlen;
*startIdx = 0;
*start_idx = 0;
// preamble 0111111111
// include 0 in front to help get start pos
uint8_t preamble[] = {0,1,1,1,1,1,1,1,1,1};
if (!preambleSearch(bits, preamble, sizeof(preamble), size, startIdx))
if (!preambleSearch(bits, preamble, sizeof(preamble), size, start_idx))
return -4;
// (iceman) if the preamble doesn't find two occuriences, this identification fails.
fmtlen = (*size == 128) ? 22 : 10;
//skip last 4bit parity row for simplicity
*size = removeParity(bits, *startIdx + sizeof(preamble), 5, 0, fmtlen * 5);
*size = removeParity(bits, *start_idx + sizeof(preamble), 5, 0, fmtlen * 5);
switch (*size) {
case 40: {
@@ -1898,14 +1912,17 @@ int HIDdemodFSK(uint8_t *dest, size_t *size, uint32_t *hi2, uint32_t *hi, uint32
if (*size < 96*2) return -3;
// 00011101 bit pattern represent start of frame, 01 pattern represents a 0 and 10 represents a 1
size_t startIdx = 0;
size_t start_idx = 0;
uint8_t preamble[] = {0,0,0,1,1,1,0,1};
if (!preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx))
if (!preambleSearch(dest, preamble, sizeof(preamble), size, &start_idx))
return -4; //preamble not found
size_t numStart = startIdx + sizeof(preamble);
// wrong size? (between to preambles)
//if (*size != 96) return -5;
size_t num_start = start_idx + sizeof(preamble);
// final loop, go over previously decoded FSK data and manchester decode into usable tag ID
for (size_t idx = numStart; (idx-numStart) < *size - sizeof(preamble); idx+=2){
for (size_t idx = num_start; (idx - num_start) < *size - sizeof(preamble); idx += 2) {
if (dest[idx] == dest[idx+1]){
return -5; //not manchester data
}
@@ -1918,7 +1935,7 @@ int HIDdemodFSK(uint8_t *dest, size_t *size, uint32_t *hi2, uint32_t *hi, uint32
else // 0 1
*lo |= 0;
}
return (int)startIdx;
return (int)start_idx;
}
// Find IDTEC PSK1, RF Preamble == 0x4944544B, Demodsize 64bits
@@ -1943,7 +1960,7 @@ int detectIOProx(uint8_t *dest, size_t *size, int *waveStartIdx) {
// FSK demodulator RF/64, fsk2a so invert, and fc/10/8
*size = fskdemod(dest, *size, 64, 1, 10, 8, waveStartIdx); //io fsk2a
//did we get a good demod?
//did we get enough demod data?
if (*size < 64) return -3;
//Index map
@@ -1955,18 +1972,23 @@ int detectIOProx(uint8_t *dest, size_t *size, int *waveStartIdx) {
//
//XSF(version)facility:codeone+codetwo
size_t startIdx = 0;
size_t start_idx = 0;
uint8_t preamble[] = {0,0,0,0,0,0,0,0,0,1};
if (! preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx))
if (!preambleSearch(dest, preamble, sizeof(preamble), size, &start_idx))
return -4; //preamble not found
// wrong size? (between to preambles)
if (*size != 64) return -5;
if (!dest[startIdx+8] && dest[startIdx+17]==1 && dest[startIdx+26]==1 && dest[startIdx+35]==1 && dest[startIdx+44]==1 && dest[startIdx+53]==1){
if ( !dest[start_idx + 8]
&& dest[start_idx + 17] == 1
&& dest[start_idx + 26] == 1
&& dest[start_idx + 35] == 1
&& dest[start_idx + 44] == 1
&& dest[start_idx + 53] == 1) {
//confirmed proper separator bits found
//return start position
return (int) startIdx;
return (int) start_idx;
}
return -6;
}
common/lfdemod.h
+9 -3
View File
@@ -32,10 +32,16 @@ extern signal_t* getSignalProperties(void);
extern uint32_t compute_mean_uint(uint8_t *in, size_t N);
extern int32_t compute_mean_int(int *in, size_t N);
bool isNoise_int(int *bits, uint32_t size);
bool isNoise(uint8_t *bits, uint32_t size);
extern bool justNoise_int(int *bits, uint32_t size);
extern bool justNoise(uint8_t *bits, uint32_t size);
// buffer is unsigned on DEVIE
#ifdef ON_DEVICE
#define justNoise(a, b) isNoise((a), (b))
#else
#define justNoise(a, b) isNoise_int((a), (b))
#endif
void getNextLow(uint8_t *samples, size_t size, int low, size_t *i);
void getNextHigh(uint8_t *samples, size_t size, int high, size_t *i);
bool loadWaveCounters(uint8_t *samples, size_t size, int lowToLowWaveLen[], int highToLowWaveLen[], int *waveCnt, int *skip, int *minClk, int *high, int *low);
common/usb_cdc.c
+4 -6
View File
@@ -373,17 +373,15 @@ static const char StrManufacturer[] = {
};
static const char StrProduct[] = {
22, // Length
20, // Length
0x03, // Type is string
'P',0,'M',0,'3',0,' ',0,'D',0,'e',0,'v',0,'i',0,'c',0,'e',0
'p',0,'r',0,'o',0,'x',0,'m',0,'a',0,'r',0,'k',0,'3',0
};
static const char StrSerialNumber[] = {
8, // Length
14, // Length
0x03, // Type is string
'8',0,
'8',0,
'8',0
'i',0,'c',0,'e',0,'m',0,'a',0,'n',0
};
// size includes their own field.