Merge pull request #19 from RfidResearchGroup/master

Update from rrg

Makefile

@@ -197,12 +197,12 @@ style:
 	# Make sure astyle is installed
 	@which astyle >/dev/null || ( echo "Please install 'astyle' package first" ; exit 1 )
 	# Remove spaces & tabs at EOL, add LF at EOF if needed on *.c, *.h, *.cpp. *.lua, *.py, *.pl, Makefile
-	find . \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "Makefile" -or -name "*.v" \) \
+	find . \( -not -path "./cov-int/*" -and \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) -or -name "*.lua" -or -name "*.py" -or -name "*.pl" -or -name "Makefile" -or -name "*.v" \) \) \
 	    -exec perl -pi -e 's/[ \t]+$$//' {} \; \
 	    -exec sh -c "tail -c1 {} | xxd -p | tail -1 | grep -q -v 0a$$" \; \
 	    -exec sh -c "echo >> {}" \;
 	# Apply astyle on *.c, *.h, *.cpp
-	find . \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) \) -exec astyle --formatted --mode=c --suffix=none \
+	find . \( -not -path "./cov-int/*" -and \( -name "*.[ch]" -or \( -name "*.cpp" -and -not -name "*.moc.cpp" \) \) \) -exec astyle --formatted --mode=c --suffix=none \
 	    --indent=spaces=4 --indent-switches \
 	    --keep-one-line-blocks --max-instatement-indent=60 \
 	    --style=google --pad-oper --unpad-paren --pad-header \

armsrc/lfsampling.c

@@ -23,8 +23,10 @@ Default LF config is set to:
     averaging = YES
     divisor = 95 (125kHz)
     trigger_threshold = 0
+    samples_to_skip = 0
+    verbose = YES
     */
-sample_config config = { 1, 8, 1, LF_DIVISOR_125, 0, 0 } ;
+sample_config config = { 1, 8, 1, LF_DIVISOR_125, 0, 0, 1} ;
 
 void printConfig() {
     uint32_t d = config.divisor;
@@ -59,6 +61,7 @@ void setSamplingConfig(sample_config *sc) {
     config.averaging = sc->averaging;
     if (config.bits_per_sample > 8) config.bits_per_sample = 8;
 
+    if (sc->verbose)
         printConfig();
 }
 

client/Makefile

@@ -227,7 +227,7 @@ CMDSRCS =   crapto1/crapto1.c \
             cmdlfti.c \
             cmdlfviking.c \
             cmdlfvisa2000.c \
-            cmdlfverichip.c \
+            cmdlfmotorola.c \
             cmdtrace.c \
             cmdflashmem.c \
             cmdflashmemspiffs.c \

client/cmdlf.c

@@ -1,5 +1,9 @@
 //-----------------------------------------------------------------------------
 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
+// Modified by
+//    Marshellow
+//    Iceman
+//    Doegox
 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
@@ -47,7 +51,7 @@
 #include "cmdlfsecurakey.h" // for securakey menu
 #include "cmdlfpac.h"       // for pac menu
 #include "cmdlfkeri.h"      // for keri menu
-#include "cmdlfverichip.h"  // for VeriChip menu
+#include "cmdlfmotorola.h"  // for Motorola menu
 #include "cmdlfgallagher.h" // for GALLAGHER menu
 
 bool g_lf_threshold_set = false;
@@ -449,6 +453,14 @@ int CmdFlexdemod(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+int lf_config(sample_config *config) {
+    if (!session.pm3_present) return PM3_ENOTTY;
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_SAMPLING_SET_CONFIG, (uint8_t *)config, sizeof(sample_config));
+    return PM3_SUCCESS;
+}
+
 int CmdLFConfig(const char *Cmd) {
 
     if (!session.pm3_present) return PM3_ENOTTY;
@@ -525,22 +537,19 @@ int CmdLFConfig(const char *Cmd) {
         }
     }
 
-    //Validations
+    // validations
     if (errors) return usage_lf_config();
-    if (cmdp == 0) {
-        clearCommandBuffer();
-        SendCommandNG(CMD_LF_SAMPLING_GET_CONFIG, NULL, 0);
-        return PM3_SUCCESS;
-    }
 
-    //Bps is limited to 8
+    // print current settings.
+    if (cmdp == 0)
+        return lf_config(NULL);
+
+    // bps is limited to 8
     if (bps >> 4) bps = 8;
 
-    sample_config config = { decimation, bps, averaging, divisor, trigger_threshold, samples_to_skip };
+    sample_config config = { decimation, bps, averaging, divisor, trigger_threshold, samples_to_skip, true };
 
-    clearCommandBuffer();
+    return lf_config(&config);
-    SendCommandNG(CMD_LF_SAMPLING_SET_CONFIG, (uint8_t *)&config, sizeof(sample_config));
-    return PM3_SUCCESS;
 }
 
 int lf_read(bool silent, uint32_t samples) {
@@ -632,6 +641,7 @@ static void ChkBitstream() {
         }
     }
 }
+
 //Attempt to simulate any wave in buffer (one bit per output sample)
 // converts GraphBuffer to bitstream (based on zero crossings) if needed.
 int CmdLFSim(const char *Cmd) {
@@ -711,7 +721,7 @@ int CmdLFSim(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-// by marshmellow - sim fsk data given clock, fcHigh, fcLow, invert
+// sim fsk data given clock, fcHigh, fcLow, invert
 // - allow pull data from DemodBuffer
 int CmdLFfskSim(const char *Cmd) {
     //might be able to autodetect FCs and clock from Graphbuffer if using demod buffer
@@ -815,7 +825,7 @@ int CmdLFfskSim(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-// by marshmellow - sim ask data given clock, invert, manchester or raw, separator
+// sim ask data given clock, invert, manchester or raw, separator
 // - allow pull data from DemodBuffer
 int CmdLFaskSim(const char *Cmd) {
     // autodetect clock from Graphbuffer if using demod buffer
@@ -916,7 +926,7 @@ int CmdLFaskSim(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-// by marshmellow - sim psk data given carrier, clock, invert
+// sim psk data given carrier, clock, invert
 // - allow pull data from DemodBuffer or parameters
 int CmdLFpskSim(const char *Cmd) {
     //might be able to autodetect FC and clock from Graphbuffer if using demod buffer
@@ -1126,7 +1136,6 @@ int CmdVchDemod(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-//by marshmellow
 static bool CheckChipType(bool getDeviceData) {
 
     bool retval = false;
@@ -1158,7 +1167,6 @@ out:
     return retval;
 }
 
-//by marshmellow
 int CmdLFfind(const char *Cmd) {
     int ans = 0;
     size_t minLength = 2000;
@@ -1193,9 +1201,21 @@ int CmdLFfind(const char *Cmd) {
         if (getSignalProperties()->isnoise) {
 
             if (IfPm3Hitag()) {
-                if (readHitagUid()) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Hitag") "found!"); return PM3_SUCCESS;}
+                if (readHitagUid()) {
+                    PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Hitag") "found!");
+                    return PM3_SUCCESS;
+                }
+            }
+
+            if (readMotorolaUid()) {
+                PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Motorola ID") "found!");
+                return PM3_SUCCESS;
+            }
+
+            if (readCOTAGUid()) {
+                PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("COTAG ID") "found!");
+                return PM3_SUCCESS;
             }
-            if (readCOTAGUid()) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("COTAG ID") "found!"); return PM3_SUCCESS;}
 
             PrintAndLogEx(FAILED, _RED_("No data found!"));
             PrintAndLogEx(INFO, "Signal looks like noise. Maybe not an LF tag?");
@@ -1229,7 +1249,6 @@ int CmdLFfind(const char *Cmd) {
     if (demodVisa2k() == PM3_SUCCESS)          { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Visa2000 ID") "found!"); goto out;}
     if (demodGallagher() == PM3_SUCCESS)       { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("GALLAGHER ID") "found!"); goto out;}
 //    if (demodTI() == PM3_SUCCESS)              { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Texas Instrument ID") "found!"); goto out;}
-//    if (demodVerichip() == PM3_SUCCESS)        { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("VeriChip ID") "found!"); goto out;}
     //if (demodFermax() == PM3_SUCCESS)          { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Fermax ID") "found!"); goto out;}
     //if (demodFlex() == PM3_SUCCESS)            { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Motorola FlexPass ID") "found!"); goto out;}
 
@@ -1297,6 +1316,7 @@ static command_t CommandTable[] = {
     {"nedap",       CmdLFNedap,         AlwaysAvailable, "{ Nedap RFIDs...             }"},
     {"nexwatch",    CmdLFNEXWATCH,      AlwaysAvailable, "{ NexWatch RFIDs...          }"},
     {"noralsy",     CmdLFNoralsy,       AlwaysAvailable, "{ Noralsy RFIDs...           }"},
+    {"motorola",    CmdLFMotorola,      AlwaysAvailable, "{ Motorola RFIDs...          }"},
     {"pac",         CmdLFPac,           AlwaysAvailable, "{ PAC/Stanley RFIDs...       }"},
     {"paradox",     CmdLFParadox,       AlwaysAvailable, "{ Paradox RFIDs...           }"},
     {"pcf7931",     CmdLFPCF7931,       AlwaysAvailable, "{ PCF7931 CHIPs...           }"},
@@ -1305,7 +1325,6 @@ static command_t CommandTable[] = {
     {"securakey",   CmdLFSecurakey,     AlwaysAvailable, "{ Securakey RFIDs...         }"},
     {"ti",          CmdLFTI,            AlwaysAvailable, "{ TI CHIPs...                }"},
     {"t55xx",       CmdLFT55XX,         AlwaysAvailable, "{ T55xx CHIPs...             }"},
-//    {"verichip",    CmdLFVerichip,      AlwaysAvailable, "{ VeriChip RFIDs...          }"},
     {"viking",      CmdLFViking,        AlwaysAvailable, "{ Viking RFIDs...            }"},
     {"visa2000",    CmdLFVisa2k,        AlwaysAvailable, "{ Visa2000 RFIDs...          }"},
     {"",            CmdHelp,            AlwaysAvailable, ""},

client/cmdlf.h

@@ -12,12 +12,13 @@
 #define CMDLF_H__
 
 #include "common.h"
+#include "pm3_cmd.h" // sample_config_t
 
 #define T55XX_WRITE_TIMEOUT 1500
 
 int CmdLF(const char *Cmd);
 
-int CmdLFSetConfig(const char *Cmd);
+int CmdLFConfig(const char *Cmd);
 
 int CmdLFCommandRead(const char *Cmd);
 int CmdFlexdemod(const char *Cmd);
@@ -32,5 +33,6 @@ int CmdVchDemod(const char *Cmd);
 int CmdLFfind(const char *Cmd);
 
 int lf_read(bool silent, uint32_t samples);
+int lf_config(sample_config *config);
 
 #endif

client/cmdlfem4x.c

@@ -1263,7 +1263,8 @@ static int CmdEM4x05Dump(const char *Cmd) {
 
     while (param_getchar(Cmd, cmdp) != 0x00) {
         switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':   return usage_lf_em4x05_dump();
+            case 'h':
+                return usage_lf_em4x05_dump();
                 break;
             case 'f':   // since f could match in password, lets confirm it is 1 character only for an option
                 param_getstr(Cmd, cmdp, optchk, sizeof(optchk));
@@ -1327,8 +1328,7 @@ static int CmdEM4x05Dump(const char *Cmd) {
             if (status == PM3_SUCCESS) {
                 num_to_bytes(word, 4, bytes);
                 PrintAndLogEx(NORMAL, "  %02d | %08X | %s  | %c |", addr, word, sprint_ascii(bytes, 4), ((lock_bits >> addr) & 1) ? 'x' : ' ');
-            }
+            } else
-            else
                 PrintAndLogEx(NORMAL, "  %02d |          |       |   | " _RED_("Fail"), addr);
         }
     }

client/cmdlfindala.c

@@ -647,8 +647,6 @@ out:
 
     *size = found_size;
 
-    //PrintAndLogEx(INFO, "DEBUG: detectindala RES = %d | %d | %d", res, found_size, idx);
-
     if (found_size != 224 && found_size != 64) {
         PrintAndLogEx(INFO, "DEBUG: detectindala | %zu", found_size);
         return -5;

client/cmdlfmotorola.c

@@ -0,0 +1,258 @@
+//-----------------------------------------------------------------------------
+// Iceman, 2019
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// Low frequency Motorola tag commands
+// PSK1, RF/32, 64 bits long,  at 74 kHz
+//-----------------------------------------------------------------------------
+#include "cmdlfmotorola.h"
+
+#include <ctype.h>          //tolower
+
+#include "commonutil.h"     // ARRAYLEN
+#include "common.h"
+#include "cmdparser.h"    // command_t
+#include "comms.h"
+#include "ui.h"
+#include "cmddata.h"
+#include "cmdlf.h"
+#include "lfdemod.h"    // preamble test
+#include "protocols.h"  // t55xx defines
+#include "cmdlft55xx.h" // clone..
+#include "cmdlf.h"      // cmdlfconfig
+#include "cliparser/cliparser.h" // cli parse input
+
+
+static int CmdHelp(const char *Cmd);
+
+//see PSKDemod for what args are accepted
+static int CmdMotorolaDemod(const char *Cmd) {
+
+    //PSK1
+    if (PSKDemod("32 1", true) != PM3_SUCCESS) {
+        PrintAndLogEx(DEBUG, "DEBUG: Error - Motorola: PSK Demod failed");
+        return PM3_ESOFT;
+    }
+    size_t size = DemodBufferLen;
+    int ans = detectMotorola(DemodBuffer, &size);
+    if (ans < 0) {
+        if (ans == -1)
+            PrintAndLogEx(DEBUG, "DEBUG: Error - Motorola: too few bits found");
+        else if (ans == -2)
+            PrintAndLogEx(DEBUG, "DEBUG: Error - Motorola: preamble not found");
+        else if (ans == -3)
+            PrintAndLogEx(DEBUG, "DEBUG: Error - Motorola: Size not correct: %zu", size);
+        else
+            PrintAndLogEx(DEBUG, "DEBUG: Error - Motorola: ans: %d", ans);
+
+        return PM3_ESOFT;
+    }
+    setDemodBuff(DemodBuffer, 64, ans);
+    setClockGrid(g_DemodClock, g_DemodStartIdx + (ans * g_DemodClock));
+
+    //got a good demod
+    uint32_t raw1 = bytebits_to_byte(DemodBuffer, 32);
+    uint32_t raw2 = bytebits_to_byte(DemodBuffer + 32, 32);
+
+// A0000000E308C0C1
+// 10100000000000000000000000000000 1110 0011 0000 1000 1100 0000 1100 0001
+
+
+//                1    1    2    2    2    3    3    4    4    4    5    5    6
+// 0    4    8    2    6    0    4    8    2    6    0    4    8    2    6    0
+// 1010 0000 0000 0000 0000 0000 0000 0000 1110 0011 0000 1000 1100 0000 0101 0010
+//                                           9    .0      5  4 26    3 .  71
+//                                           .    .0      5  4 26    3 .  71
+//                                          6 9 A5   C0FD  E7    18 B 4  3  2
+
+// hex(234)  0xEA    bin(234)    1110 1010
+// hex(437)  0x1B5   bin(437)  1 1011 0101
+// hex(229)  0xE5    bin(229)    1110 0101
+
+    uint16_t fc = 0;
+
+// FC seems to be guess work.  Need more samples
+// guessing  printed FC is 4 digits.  1024? 10bit?
+//    fc |= DemodBuffer[38] << 9; // b10
+    fc |= DemodBuffer[34] << 8; // b9
+
+    fc |= DemodBuffer[44] << 7; // b8
+    fc |= DemodBuffer[47] << 6; // b7
+    fc |= DemodBuffer[57] << 5; // b6
+    fc |= DemodBuffer[49] << 4; // b5
+
+// seems to match
+    fc |= DemodBuffer[53] << 3; // b4
+    fc |= DemodBuffer[48] << 2; // b3
+    fc |= DemodBuffer[58] << 1; // b2
+    fc |= DemodBuffer[39] << 0; // b1
+
+// CSN was same as Indala CSN descramble.
+    uint16_t csn = 0;
+    csn |= DemodBuffer[42] << 15; // b16
+    csn |= DemodBuffer[45] << 14; // b15
+    csn |= DemodBuffer[43] << 13; // b14
+    csn |= DemodBuffer[40] << 12; // b13
+    csn |= DemodBuffer[52] << 11; // b12
+    csn |= DemodBuffer[36] << 10; // b11
+    csn |= DemodBuffer[35] << 9; // b10
+    csn |= DemodBuffer[51] << 8; // b9
+    csn |= DemodBuffer[46] << 7; // b8
+    csn |= DemodBuffer[33] << 6; // b7
+    csn |= DemodBuffer[37] << 5; // b6
+    csn |= DemodBuffer[54] << 4; // b5
+    csn |= DemodBuffer[56] << 3; // b4
+    csn |= DemodBuffer[59] << 2; // b3
+    csn |= DemodBuffer[50] << 1; // b2
+    csn |= DemodBuffer[41] << 0; // b1
+
+    uint8_t checksum = 0;
+    checksum |= DemodBuffer[62] << 1; // b2
+    checksum |= DemodBuffer[63] << 0; // b1
+
+    PrintAndLogEx(SUCCESS, "Motorola Tag Found -- Raw: %08X%08X", raw1, raw2);
+    PrintAndLogEx(SUCCESS, "Fmt 26 bit  FC %u , CSN %u , checksum %1d%1d", fc, csn, checksum >> 1 & 0x01, checksum & 0x01);
+    PrintAndLogEx(NORMAL, "");
+
+    return PM3_SUCCESS;
+}
+
+static int CmdMotorolaRead(const char *Cmd) {
+    // Motorola Flexpass seem to work at 74 kHz
+    // and take about 4400 samples to befor modulating
+    sample_config sc = {
+        .decimation = 0,
+        .bits_per_sample = 0,
+        .averaging = false,
+        .divisor = LF_DIVISOR(74),
+        .trigger_threshold = -1,
+        .samples_to_skip = 4500,
+        .verbose = false
+    };
+    lf_config(&sc);
+
+    // 64 * 32 * 2 * n-ish
+    lf_read(true, 5000);
+
+    // reset back to 125 kHz
+    sc.divisor = LF_DIVISOR_125;
+    sc.samples_to_skip = 0;
+    lf_config(&sc);
+    return CmdMotorolaDemod(Cmd);
+}
+
+static int CmdMotorolaClone(const char *Cmd) {
+
+    uint32_t blocks[3] = {0};
+    uint8_t data[8];
+    int datalen = 0;
+
+    CLIParserInit("lf indala clone",
+                  "Enables cloning of Motorola card with specified uid onto T55x7\n"
+                  "defaults to 64.\n",
+                  "\n"
+                  "Samples:\n"
+                  "\tlf motorola clone a0000000a0002021\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_strx1(NULL, NULL, "<uid (hex)>", NULL),
+        arg_param_end
+    };
+    CLIExecWithReturn(Cmd, argtable, false);
+    CLIGetHexWithReturn(1, data, &datalen);
+    CLIParserFree();
+
+    //TODO add selection of chip for Q5 or T55x7
+    // data[0] = T5555_SET_BITRATE(32 | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT;
+
+    // config for Motorola 64 format (RF/32;PSK1 with RF/2; Maxblock=2)
+    PrintAndLogEx(INFO, "Preparing to clone Motorola 64bit tag with RawID %s", sprint_hex(data, datalen));
+    blocks[0] =  T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (2 << T55x7_MAXBLOCK_SHIFT);
+    blocks[1] = bytes_to_num(data, 4);
+    blocks[2] = bytes_to_num(data + 4, 4);
+
+    print_blocks(blocks, ARRAYLEN(blocks));
+    return clone_t55xx_tag(blocks, ARRAYLEN(blocks));
+}
+
+static int CmdMotorolaSim(const char *Cmd) {
+
+    // PSK sim.
+    PrintAndLogEx(INFO, " PSK1 at 66 kHz... Interesting.");
+    PrintAndLogEx(INFO, " To be implemented, feel free to contribute!");
+    return PM3_SUCCESS;
+}
+
+static command_t CommandTable[] = {
+    {"help",  CmdHelp,           AlwaysAvailable, "This help"},
+    {"demod", CmdMotorolaDemod,  AlwaysAvailable, "Demodulate an MOTOROLA tag from the GraphBuffer"},
+    {"read",  CmdMotorolaRead,   IfPm3Lf,         "Attempt to read and extract tag data from the antenna"},
+    {"clone", CmdMotorolaClone,  IfPm3Lf,         "clone MOTOROLA to T55x7"},
+    {"sim",   CmdMotorolaSim,    IfPm3Lf,         "simulate MOTOROLA tag"},
+    {NULL, NULL, NULL, NULL}
+};
+
+static int CmdHelp(const char *Cmd) {
+    (void)Cmd; // Cmd is not used so far
+    CmdsHelp(CommandTable);
+    return PM3_SUCCESS;
+}
+
+int CmdLFMotorola(const char *Cmd) {
+    clearCommandBuffer();
+    return CmdsParse(CommandTable, Cmd);
+}
+
+// find MOTOROLA preamble in already demoded data
+int detectMotorola(uint8_t *dest, size_t *size) {
+
+    //make sure buffer has data
+    if (*size < 64)
+        return -1;
+
+    bool inverted = false;
+    size_t found_size = *size;
+    size_t start_idx = 0;
+
+    // Seems Motorola is based on the following indala format.
+    // standard 64 bit Motorola formats including 26 bit 40134 format
+    uint8_t preamble[] =  {1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1};
+    uint8_t preamble_i[]  = {0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0};
+
+    // preamble not found
+    if (!preambleSearch(dest, preamble, sizeof(preamble), &found_size, &start_idx)) {
+        found_size = *size;
+        if (!preambleSearch(dest, preamble_i, sizeof(preamble_i), &found_size, &start_idx)) {
+            return -2;
+        }
+        PrintAndLogEx(DEBUG, "DEBUG: detectMotorola PSK1 found inverted preamble");
+        inverted = true;
+    }
+
+    *size = found_size;
+
+    // wrong demoded size
+    if (*size != 64)
+        return -3;
+
+    if (inverted && start_idx > 0) {
+        for (size_t i = start_idx - 1 ; i < *size + start_idx + 2; i++) {
+            dest[i] ^= 1;
+        }
+    }
+
+    return (int)start_idx;
+}
+
+int demodMotorola(void) {
+    return CmdMotorolaDemod("");
+}
+
+int readMotorolaUid(void) {
+    return (CmdMotorolaRead("") == PM3_SUCCESS);
+}

client/cmdlfmotorola.h

@@ -0,0 +1,21 @@
+//-----------------------------------------------------------------------------
+// Iceman, 2019
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// Low frequency MOTOROLA tag commands
+//-----------------------------------------------------------------------------
+#ifndef CMDLFMOTOROLA_H__
+#define CMDLFMOTOROLA_H__
+
+#include "common.h"
+
+int CmdLFMotorola(const char *Cmd);
+
+int demodMotorola(void);
+int detectMotorola(uint8_t *dest, size_t *size);
+int readMotorolaUid(void);
+#endif
+

client/cmdlfnoralsy.c

@@ -169,7 +169,8 @@ static int CmdNoralsyClone(const char *Cmd) {
     PrintAndLogEx(INFO, "Preparing to clone Noralsy to T55x7 with CardId: %u", id);
     print_blocks(blocks,  ARRAYLEN(blocks));
 
-    return clone_t55xx_tag(blocks, ARRAYLEN(blocks));}
+    return clone_t55xx_tag(blocks, ARRAYLEN(blocks));
+}
 
 static int CmdNoralsySim(const char *Cmd) {
 

client/cmdlft55xx.c

@@ -355,6 +355,21 @@ static int usage_t55xx_protect() {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
+static int usage_t55xx_dangerraw() {
+    PrintAndLogEx(NORMAL, "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.");
+    PrintAndLogEx(NORMAL, _RED_("WARNING:") " this may lock definitively the tag in an unusable state!");
+    PrintAndLogEx(NORMAL, "Uncontrolled usage can easily write an invalid configuration, activate lock bits,");
+    PrintAndLogEx(NORMAL, "OTP bit, password protection bit, deactivate test-mode, lock your card forever.");
+    PrintAndLogEx(NORMAL, "Uncontrolled usage is known to the State of California to cause cancer.");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "Usage:  lf t55xx dangerraw [h] [b <bitstream> t <timing>]");
+    PrintAndLogEx(NORMAL, "Options:");
+    PrintAndLogEx(NORMAL, "     h                 - This help");
+    PrintAndLogEx(NORMAL, "     b <bitstream>     - raw bitstream");
+    PrintAndLogEx(NORMAL, "     t <timing>        - time in microseconds before dropping the field");
+    PrintAndLogEx(NORMAL, "");
+    return PM3_SUCCESS;
+}
 
 static int CmdHelp(const char *Cmd);
 
@@ -1706,6 +1721,8 @@ static int CmdT55xxDangerousRaw(const char *Cmd) {
 
     while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
         switch (tolower(param_getchar(Cmd, cmdp))) {
+            case 'h':
+                return usage_t55xx_dangerraw();
             case 't':
                 ng.time = param_get32ex(Cmd, cmdp + 1, 0, 10);
                 if (ng.time == 0 || ng.time > 200000) {
@@ -1745,8 +1762,7 @@ static int CmdT55xxDangerousRaw(const char *Cmd) {
         }
     }
     if (errors || ng.bitlen == 0 || ng.time == 0) {
-        PrintAndLogEx(ERR, "Error occurred, abort. " _RED_("DANGEROUS COMMAND, DO NOT USE!"));
+        return usage_t55xx_dangerraw();
-        return PM3_EINVARG;
     }
     PacketResponseNG resp;
     clearCommandBuffer();
@@ -2262,11 +2278,11 @@ static int CmdT55xxDump(const char *Cmd) {
             strcpy(preferredName, "lf-t55xx");
             for (uint8_t i = 1; i <= 7; i++) {
                 if ((cardmem[i].blockdata != 0x00) && (cardmem[i].blockdata != 0xFFFFFFFF))
-                    sprintf (preferredName,"%s-%08X",preferredName,cardmem[i].blockdata);
+                    sprintf(preferredName + strlen(preferredName), "-%08X", cardmem[i].blockdata);
                 else
                     break;
             }
-            sprintf (preferredName,"%s-data",preferredName);
+            strcat(preferredName, "-data");
         }
 
         // Swap endian so the files match the txt display

covbuild.sh

@@ -32,7 +32,7 @@ cov-build --dir "$COVDIR" --c-coverage=gcov --no-network-coverage --no-generate-
 #########################################
 # Run tests                             #
 #########################################
-cov-build --dir "$COVDIR" --c-coverage=gcov --no-network-coverage --test-capture ./pm3test.sh
+cov-build --dir "$COVDIR" --c-coverage=gcov --no-network-coverage --test-capture ./pm3test.sh long
 #cov-manage-emit --dir "$COVDIR" list-coverage-known
 
 #########################################

include/pm3_cmd.h

@@ -119,6 +119,7 @@ typedef struct {
     int divisor;
     int trigger_threshold;
     uint32_t samples_to_skip;
+    bool verbose;
 } PACKED sample_config;
 /*
 typedef struct {
@@ -488,6 +489,7 @@ typedef struct {
 #define CMD_HF_MIFARE_CHKKEYS_FAST                                        0x0625
 
 #define CMD_HF_MIFARE_SNIFF                                               0x0630
+#define CMD_HF_MIFARE_MFKEY                                               0x0631
 //ultralightC
 #define CMD_HF_MIFAREUC_AUTH                                              0x0724
 //0x0725 and 0x0726 no longer used

traces/README.txt

@@ -26,3 +26,5 @@ AWID-15-259.pm3: AWID FSK RF/50 FC: 15 Card: 259
 HID-weak-fob-11647.pm3: HID 32bit Prox Card#: 11647.  very weak tag/read but just readable.
 visa2000.pm3:  VISA2000 ASK/MAN RF/64, Card: 480518
 securakey-64169.pm3  Securakey Tag BitLen: 26, Card ID: 64169, FC: 0x35
+
+motorola_0437_00072.pm3 - Motorola  Grey clamshell card, old.  (RAW: A0000000E308C0C1)