client/cmdlfem4x.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Low frequency EM4x commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include <inttypes.h>
  14 #include "proxmark3.h"
  15 #include "ui.h"
  16 #include "util.h"
  17 #include "graph.h"
  18 #include "cmdparser.h"
  19 #include "cmddata.h"
  20 #include "cmdlf.h"
  21 #include "cmdlfem4x.h"
  22 char *global_em410xId;
  23
  24 static int CmdHelp(const char *Cmd);
  25
  26 int CmdEMdemodASK(const char *Cmd)
  27 {
  28         char cmdp = param_getchar(Cmd, 0);
  29         int findone = (cmdp == '1') ? 1 : 0;
  30   UsbCommand c={CMD_EM410X_DEMOD};
  31   c.arg[0]=findone;
  32   SendCommand(&c);
  33   return 0;
  34 }
  35
  36 /* Read the ID of an EM410x tag.
  37  * Format:
  38  *   1111 1111 1           <-- standard non-repeatable header
  39  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
  40  *   ....
  41  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
  42  *   0                     <-- stop bit, end of tag
  43  */
  44 int CmdEM410xRead(const char *Cmd)
  45 {
  46   int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
  47   int parity[4];
  48   char id[11] = {0x00};
  49   char id2[11] = {0x00};
  50   int retested = 0;
  51   uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
  52   high = low = 0;
  53
  54   /* Detect high and lows and clock */
  55   for (i = 0; i < GraphTraceLen; i++)
  56   {
  57     if (GraphBuffer[i] > high)
  58       high = GraphBuffer[i];
  59     else if (GraphBuffer[i] < low)
  60       low = GraphBuffer[i];
  61   }
  62
  63   /* get clock */
  64   clock = GetAskClock(Cmd, false, false);
  65
  66   /* parity for our 4 columns */
  67   parity[0] = parity[1] = parity[2] = parity[3] = 0;
  68   header = rows = 0;
  69
  70   // manchester demodulate
  71   bit = bit2idx = 0;
  72   for (i = 0; i < (int)(GraphTraceLen / clock); i++)
  73   {
  74     hithigh = 0;
  75     hitlow = 0;
  76     first = 1;
  77
  78     /* Find out if we hit both high and low peaks */
  79     for (j = 0; j < clock; j++)
  80     {
  81       if (GraphBuffer[(i * clock) + j] >= high)
  82         hithigh = 1;
  83       else if (GraphBuffer[(i * clock) + j] <= low)
  84         hitlow = 1;
  85
  86       /* it doesn't count if it's the first part of our read
  87        because it's really just trailing from the last sequence */
  88       if (first && (hithigh || hitlow))
  89         hithigh = hitlow = 0;
  90       else
  91         first = 0;
  92
  93       if (hithigh && hitlow)
  94         break;
  95     }
  96
  97     /* If we didn't hit both high and low peaks, we had a bit transition */
  98     if (!hithigh || !hitlow)
  99       bit ^= 1;
 100
 101     BitStream[bit2idx++] = bit;
 102   }
 103
 104 retest:
 105   /* We go till 5 before the graph ends because we'll get that far below */
 106   for (i = 1; i < bit2idx - 5; i++)
 107   {
 108     /* Step 2: We have our header but need our tag ID */
 109     if (header == 9 && rows < 10)
 110     {
 111       /* Confirm parity is correct */
 112       if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
 113       {
 114         /* Read another byte! */
 115         sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
 116         sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i]));
 117         rows++;
 118
 119         /* Keep parity info */
 120         parity[0] ^= BitStream[i];
 121         parity[1] ^= BitStream[i+1];
 122         parity[2] ^= BitStream[i+2];
 123         parity[3] ^= BitStream[i+3];
 124
 125         /* Move 4 bits ahead */
 126         i += 4;
 127       }
 128
 129       /* Damn, something wrong! reset */
 130       else
 131       {
 132         PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
 133
 134         /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
 135         i -= 9 + (5 * rows) - 5;
 136
 137         rows = header = 0;
 138       }
 139     }
 140
 141     /* Step 3: Got our 40 bits! confirm column parity */
 142     else if (rows == 10)
 143     {
 144       /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
 145       if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
 146         BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
 147         BitStream[i+4] == 0)
 148       {
 149         /* Sweet! */
 150         PrintAndLog("EM410x Tag ID: %s", id);
 151         PrintAndLog("Unique Tag ID: %s", id2);
 152
 153                 global_em410xId = id;
 154
 155         /* Stop any loops */
 156         return 1;
 157       }
 158
 159       /* Crap! Incorrect parity or no stop bit, start all over */
 160       else
 161       {
 162         rows = header = 0;
 163
 164         /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
 165         i -= 59;
 166       }
 167     }
 168
 169     /* Step 1: get our header */
 170     else if (header < 9)
 171     {
 172       /* Need 9 consecutive 1's */
 173       if (BitStream[i] == 1)
 174         header++;
 175
 176       /* We don't have a header, not enough consecutive 1 bits */
 177       else
 178         header = 0;
 179     }
 180   }
 181
 182   /* if we've already retested after flipping bits, return */
 183         if (retested++){
 184                 PrintAndLog("Failed to decode");
 185     return 0;
 186         }
 187
 188   /* if this didn't work, try flipping bits */
 189   for (i = 0; i < bit2idx; i++)
 190     BitStream[i] ^= 1;
 191
 192   goto retest;
 193 }
 194
 195 /* emulate an EM410X tag
 196  * Format:
 197  *   1111 1111 1           <-- standard non-repeatable header
 198  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
 199  *   ....
 200  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
 201  *   0                     <-- stop bit, end of tag
 202  */
 203 int CmdEM410xSim(const char *Cmd)
 204 {
 205         int i, n, j, binary[4], parity[4];
 206
 207         char cmdp = param_getchar(Cmd, 0);
 208         uint8_t uid[5] = {0x00};
 209
 210         if (cmdp == 'h' || cmdp == 'H') {
 211                 PrintAndLog("Usage:  lf em4x 410xsim <UID>");
 212                 PrintAndLog("");
 213                 PrintAndLog("     sample: lf em4x 410xsim 0F0368568B");
 214                 return 0;
 215         }
 216
 217         if (param_gethex(Cmd, 0, uid, 10)) {
 218                 PrintAndLog("UID must include 10 HEX symbols");
 219                 return 0;
 220         }
 221
 222         PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
 223         PrintAndLog("Press pm3-button to about simulation");
 224
 225   /* clock is 64 in EM410x tags */
 226   int clock = 64;
 227
 228   /* clear our graph */
 229   ClearGraph(0);
 230
 231     /* write 9 start bits */
 232     for (i = 0; i < 9; i++)
 233       AppendGraph(0, clock, 1);
 234
 235     /* for each hex char */
 236     parity[0] = parity[1] = parity[2] = parity[3] = 0;
 237     for (i = 0; i < 10; i++)
 238     {
 239       /* read each hex char */
 240       sscanf(&Cmd[i], "%1x", &n);
 241       for (j = 3; j >= 0; j--, n/= 2)
 242         binary[j] = n % 2;
 243
 244       /* append each bit */
 245       AppendGraph(0, clock, binary[0]);
 246       AppendGraph(0, clock, binary[1]);
 247       AppendGraph(0, clock, binary[2]);
 248       AppendGraph(0, clock, binary[3]);
 249
 250       /* append parity bit */
 251       AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
 252
 253       /* keep track of column parity */
 254       parity[0] ^= binary[0];
 255       parity[1] ^= binary[1];
 256       parity[2] ^= binary[2];
 257       parity[3] ^= binary[3];
 258     }
 259
 260     /* parity columns */
 261     AppendGraph(0, clock, parity[0]);
 262     AppendGraph(0, clock, parity[1]);
 263     AppendGraph(0, clock, parity[2]);
 264     AppendGraph(0, clock, parity[3]);
 265
 266     /* stop bit */
 267   AppendGraph(1, clock, 0);
 268
 269   CmdLFSim("0"); //240 start_gap.
 270   return 0;
 271 }
 272
 273 /* Function is equivalent of lf read + data samples + em410xread
 274  * looped until an EM410x tag is detected
 275  *
 276  * Why is CmdSamples("16000")?
 277  *  TBD: Auto-grow sample size based on detected sample rate.  IE: If the
 278  *       rate gets lower, then grow the number of samples
 279  *  Changed by martin, 4000 x 4 = 16000,
 280  *  see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
 281
 282 */
 283 int CmdEM410xWatch(const char *Cmd)
 284 {
 285         char cmdp = param_getchar(Cmd, 0);
 286         int read_h = (cmdp == 'h');
 287         do {
 288                 if (ukbhit()) {
 289                         printf("\naborted via keyboard!\n");
 290                         break;
 291                 }
 292
 293                 CmdLFRead(read_h ? "h" : "");
 294                 CmdSamples("6000");
 295         } while (
 296                 !CmdEM410xRead("")
 297         );
 298         return 0;
 299 }
 300
 301 int CmdEM410xWatchnSpoof(const char *Cmd)
 302 {
 303         CmdEM410xWatch(Cmd);
 304     PrintAndLog("# Replaying : %s",global_em410xId);
 305     CmdEM410xSim(global_em410xId);
 306   return 0;
 307 }
 308
 309 /* Read the transmitted data of an EM4x50 tag
 310  * Format:
 311  *
 312  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 313  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 314  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 315  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 316  *  CCCCCCCC                         <- column parity bits
 317  *  0                                <- stop bit
 318  *  LW                               <- Listen Window
 319  *
 320  * This pattern repeats for every block of data being transmitted.
 321  * Transmission starts with two Listen Windows (LW - a modulated
 322  * pattern of 320 cycles each (32/32/128/64/64)).
 323  *
 324  * Note that this data may or may not be the UID. It is whatever data
 325  * is stored in the blocks defined in the control word First and Last
 326  * Word Read values. UID is stored in block 32.
 327  */
 328 int CmdEM4x50Read(const char *Cmd)
 329 {
 330   int i, j, startblock, skip, block, start, end, low, high;
 331   bool complete= false;
 332   int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
 333   char tmp[6];
 334
 335   high= low= 0;
 336   memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
 337
 338   /* first get high and low values */
 339   for (i = 0; i < GraphTraceLen; i++)
 340   {
 341     if (GraphBuffer[i] > high)
 342       high = GraphBuffer[i];
 343     else if (GraphBuffer[i] < low)
 344       low = GraphBuffer[i];
 345   }
 346
 347   /* populate a buffer with pulse lengths */
 348   i= 0;
 349   j= 0;
 350   while (i < GraphTraceLen)
 351   {
 352     // measure from low to low
 353     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 354       ++i;
 355     start= i;
 356     while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
 357       ++i;
 358     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 359       ++i;
 360     if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
 361       break;
 362     }
 363     tmpbuff[j++]= i - start;
 364   }
 365
 366   /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
 367   start= -1;
 368   skip= 0;
 369   for (i= 0; i < j - 4 ; ++i)
 370   {
 371     skip += tmpbuff[i];
 372     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 373       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 374         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 375           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 376           {
 377             start= i + 3;
 378             break;
 379           }
 380   }
 381   startblock= i + 3;
 382
 383   /* skip over the remainder of the LW */
 384   skip += tmpbuff[i+1]+tmpbuff[i+2];
 385   while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
 386     ++skip;
 387   skip += 8;
 388
 389   /* now do it again to find the end */
 390   end= start;
 391   for (i += 3; i < j - 4 ; ++i)
 392   {
 393     end += tmpbuff[i];
 394     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 395       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 396         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 397           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 398           {
 399             complete= true;
 400             break;
 401           }
 402   }
 403
 404   if (start >= 0)
 405     PrintAndLog("Found data at sample: %i",skip);
 406   else
 407   {
 408     PrintAndLog("No data found!");
 409     PrintAndLog("Try again with more samples.");
 410     return 0;
 411   }
 412
 413   if (!complete)
 414   {
 415     PrintAndLog("*** Warning!");
 416     PrintAndLog("Partial data - no end found!");
 417     PrintAndLog("Try again with more samples.");
 418   }
 419
 420   /* get rid of leading crap */
 421   sprintf(tmp,"%i",skip);
 422   CmdLtrim(tmp);
 423
 424   /* now work through remaining buffer printing out data blocks */
 425   block= 0;
 426   i= startblock;
 427   while (block < 6)
 428   {
 429     PrintAndLog("Block %i:", block);
 430     // mandemod routine needs to be split so we can call it for data
 431     // just print for now for debugging
 432     CmdManchesterDemod("i 64");
 433     skip= 0;
 434     /* look for LW before start of next block */
 435     for ( ; i < j - 4 ; ++i)
 436     {
 437       skip += tmpbuff[i];
 438       if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 439         if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 440           break;
 441     }
 442     while (GraphBuffer[skip] > low)
 443       ++skip;
 444     skip += 8;
 445     sprintf(tmp,"%i",skip);
 446     CmdLtrim(tmp);
 447     start += skip;
 448     block++;
 449   }
 450   return 0;
 451 }
 452
 453 int CmdEM410xWrite(const char *Cmd)
 454 {
 455   uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
 456   int card = 0xFF; // invalid card value
 457         unsigned int clock = 0; // invalid clock value
 458
 459         sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
 460
 461         // Check ID
 462         if (id == 0xFFFFFFFFFFFFFFFF) {
 463                 PrintAndLog("Error! ID is required.\n");
 464                 return 0;
 465         }
 466         if (id >= 0x10000000000) {
 467                 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
 468                 return 0;
 469         }
 470
 471         // Check Card
 472         if (card == 0xFF) {
 473                 PrintAndLog("Error! Card type required.\n");
 474                 return 0;
 475         }
 476         if (card < 0) {
 477                 PrintAndLog("Error! Bad card type selected.\n");
 478                 return 0;
 479         }
 480
 481         // Check Clock
 482         if (card == 1)
 483         {
 484                 // Default: 64
 485                 if (clock == 0)
 486                         clock = 64;
 487
 488                 // Allowed clock rates: 16, 32 and 64
 489                 if ((clock != 16) && (clock != 32) && (clock != 64)) {
 490                         PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
 491                         return 0;
 492                 }
 493         }
 494         else if (clock != 0)
 495         {
 496                 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
 497                 return 0;
 498         }
 499
 500         if (card == 1) {
 501                 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
 502                 // NOTE: We really should pass the clock in as a separate argument, but to
 503                 //   provide for backwards-compatibility for older firmware, and to avoid
 504                 //   having to add another argument to CMD_EM410X_WRITE_TAG, we just store
 505                 //   the clock rate in bits 8-15 of the card value
 506                 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
 507         }
 508         else if (card == 0)
 509                 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
 510         else {
 511                 PrintAndLog("Error! Bad card type selected.\n");
 512                 return 0;
 513         }
 514
 515   UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
 516   SendCommand(&c);
 517
 518   return 0;
 519 }
 520
 521 int CmdReadWord(const char *Cmd)
 522 {
 523         int Word = -1; //default to invalid word
 524   UsbCommand c;
 525
 526   sscanf(Cmd, "%d", &Word);
 527
 528         if ( (Word > 15) | (Word < 0) ) {
 529     PrintAndLog("Word must be between 0 and 15");
 530     return 1;
 531   }
 532
 533   PrintAndLog("Reading word %d", Word);
 534
 535   c.cmd = CMD_EM4X_READ_WORD;
 536   c.d.asBytes[0] = 0x0; //Normal mode
 537   c.arg[0] = 0;
 538   c.arg[1] = Word;
 539   c.arg[2] = 0;
 540   SendCommand(&c);
 541   return 0;
 542 }
 543
 544 int CmdReadWordPWD(const char *Cmd)
 545 {
 546         int Word = -1; //default to invalid word
 547   int Password = 0xFFFFFFFF; //default to blank password
 548   UsbCommand c;
 549
 550   sscanf(Cmd, "%d %x", &Word, &Password);
 551
 552         if ( (Word > 15) | (Word < 0) ) {
 553     PrintAndLog("Word must be between 0 and 15");
 554     return 1;
 555   }
 556
 557   PrintAndLog("Reading word %d with password %08X", Word, Password);
 558
 559   c.cmd = CMD_EM4X_READ_WORD;
 560   c.d.asBytes[0] = 0x1; //Password mode
 561   c.arg[0] = 0;
 562   c.arg[1] = Word;
 563   c.arg[2] = Password;
 564   SendCommand(&c);
 565   return 0;
 566 }
 567
 568 int CmdWriteWord(const char *Cmd)
 569 {
 570   int Word = 16; //default to invalid block
 571   int Data = 0xFFFFFFFF; //default to blank data
 572   UsbCommand c;
 573
 574   sscanf(Cmd, "%x %d", &Data, &Word);
 575
 576   if (Word > 15) {
 577     PrintAndLog("Word must be between 0 and 15");
 578     return 1;
 579   }
 580
 581   PrintAndLog("Writing word %d with data %08X", Word, Data);
 582
 583   c.cmd = CMD_EM4X_WRITE_WORD;
 584   c.d.asBytes[0] = 0x0; //Normal mode
 585   c.arg[0] = Data;
 586   c.arg[1] = Word;
 587   c.arg[2] = 0;
 588   SendCommand(&c);
 589   return 0;
 590 }
 591
 592 int CmdWriteWordPWD(const char *Cmd)
 593 {
 594   int Word = 16; //default to invalid word
 595   int Data = 0xFFFFFFFF; //default to blank data
 596   int Password = 0xFFFFFFFF; //default to blank password
 597   UsbCommand c;
 598
 599   sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
 600
 601   if (Word > 15) {
 602     PrintAndLog("Word must be between 0 and 15");
 603     return 1;
 604   }
 605
 606   PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
 607
 608   c.cmd = CMD_EM4X_WRITE_WORD;
 609   c.d.asBytes[0] = 0x1; //Password mode
 610   c.arg[0] = Data;
 611   c.arg[1] = Word;
 612   c.arg[2] = Password;
 613   SendCommand(&c);
 614   return 0;
 615 }
 616
 617 static command_t CommandTable[] =
 618 {
 619   {"help", CmdHelp, 1, "This help"},
 620   {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
 621   {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
 622   {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
 623   {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
 624   {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
 625   {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
 626   {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
 627   {"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
 628   {"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
 629   {"writeword", CmdWriteWord, 1, "<Data> <Word> -- Write EM4xxx word data"},
 630   {"writewordPWD", CmdWriteWordPWD, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
 631   {NULL, NULL, 0, NULL}
 632 };
 633
 634 int CmdLFEM4X(const char *Cmd)
 635 {
 636   CmdsParse(CommandTable, Cmd);
 637   return 0;
 638 }
 639
 640 int CmdHelp(const char *Cmd)
 641 {
 642   CmdsHelp(CommandTable);
 643   return 0;
 644 }