mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-14 10:37:23 -07:00
Merge pull request #596 from temskiy/lf_emul
EM4100 read/clone/simulate standalone mode
This commit is contained in:
Iceman
GitHub
commit
4b4a941c17
4 changed files with 315 additions and 1 deletions
|
|
@ -41,9 +41,15 @@ define KNOWN_STANDALONE_DEFINITIONS
|
|||
| LF_ICEHID | LF HID collector to flashmem |
|
||||
| (RDV4 only) | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_EM4100EMUL | Simulate predefined em4100 tags only |
|
||||
| | |
|
||||
+----------------------------------------------------------+
|
||||
| LF_EM4100RWC | Read/simulate em4100 tags & clone it |
|
||||
| | to T555x tags |
|
||||
+----------------------------------------------------------+
|
||||
endef
|
||||
|
||||
STANDALONE_MODES := LF_SAMYRUN LF_ICERUN LF_PROXBRUTE LF_HIDBRUTE LF_ICEHID
|
||||
STANDALONE_MODES := LF_SAMYRUN LF_ICERUN LF_PROXBRUTE LF_HIDBRUTE LF_ICEHID LF_EM4100EMUL LF_EM4100RWC
|
||||
STANDALONE_MODES += HF_YOUNG HF_MATTYRUN HF_COLIN HF_BOG HF_14ASNIFF
|
||||
STANDALONE_MODES_REQ_SMARTCARD :=
|
||||
STANDALONE_MODES_REQ_FLASH := HF_COLIN HF_BOG HF_14ASNIFF LF_ICEHID
|
||||
|
|
|
|||
|
|
@ -40,4 +40,12 @@ endif
|
|||
# WITH_STANDALONE_LF_ICEHID
|
||||
ifneq (,$(findstring WITH_STANDALONE_LF_ICEHID,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = lf_icehid.c
|
||||
endif
|
||||
# WITH_STANDALONE_LF_EM4100EMUL
|
||||
ifneq (,$(findstring WITH_STANDALONE_LF_EM4100EMUL,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = lf_em4100emul.c
|
||||
endif
|
||||
# WITH_STANDALONE_LF_EM4100RWC
|
||||
ifneq (,$(findstring WITH_STANDALONE_LF_EM4100RWC,$(APP_CFLAGS)))
|
||||
SRC_STANDALONE = lf_em4100rwc.c
|
||||
endif
|
||||
98
armsrc/Standalone/lf_em4100emul.c
Normal file
98
armsrc/Standalone/lf_em4100emul.c
Normal file
|
|
@ -0,0 +1,98 @@
|
|||
//-----------------------------------------------------------------------------
|
||||
// Artyom Gnatyuk, 2020
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// LF emul - Very simple mode. Simulate only predefined in low[] IDs
|
||||
// Short click - select next slot and start simulation
|
||||
//-----------------------------------------------------------------------------
|
||||
#include "standalone.h"
|
||||
#include "proxmark3_arm.h"
|
||||
#include "appmain.h"
|
||||
#include "fpgaloader.h"
|
||||
#include "lfops.h"
|
||||
#include "util.h"
|
||||
#include "dbprint.h"
|
||||
#include "ticks.h"
|
||||
#include "string.h"
|
||||
#include "BigBuf.h"
|
||||
|
||||
#define MAX_IND 16 // 4 LEDs - 2^4 combinations
|
||||
#define CLOCK 64 //for 125kHz
|
||||
|
||||
// low & high - array for storage IDs. Its length must be equal.
|
||||
// Predefined IDs must be stored in low[].
|
||||
// In high[] must be nulls
|
||||
uint64_t low[] = {0x565A1140BE, 0x365A398149, 0x5555555555, 0xFFFFFFFFFF};
|
||||
uint32_t high[] = {0, 0, 0, 0};
|
||||
uint8_t *bba, slots_count;
|
||||
int buflen;
|
||||
|
||||
void ModInfo(void) {
|
||||
DbpString(" LF EM4100 simulator standalone mode");
|
||||
}
|
||||
|
||||
uint64_t ReversQuads(uint64_t bits) {
|
||||
uint64_t result = 0;
|
||||
for (int i = 0; i < 16; i++) {
|
||||
result += ((bits >> (60 - 4 * i)) & 0xf) << (4 * i);
|
||||
}
|
||||
return result >> 24;
|
||||
}
|
||||
|
||||
void FillBuff(uint8_t bit) {
|
||||
memset(bba + buflen, bit, CLOCK / 2);
|
||||
buflen += (CLOCK / 2);
|
||||
memset(bba + buflen, bit ^ 1, CLOCK / 2);
|
||||
buflen += (CLOCK / 2);
|
||||
}
|
||||
|
||||
void ConstructEM410xEmulBuf(uint64_t id) {
|
||||
|
||||
int i, j, binary[4], parity[4];
|
||||
buflen = 0;
|
||||
for (i = 0; i < 9; i++)
|
||||
FillBuff(1);
|
||||
parity[0] = parity[1] = parity[2] = parity[3] = 0;
|
||||
for (i = 0; i < 10; i++) {
|
||||
for (j = 3; j >= 0; j--, id /= 2)
|
||||
binary[j] = id % 2;
|
||||
for (j = 0; j < 4; j++)
|
||||
FillBuff(binary[j]);
|
||||
FillBuff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
|
||||
for (j = 0; j < 4; j++)
|
||||
parity[j] ^= binary[j];
|
||||
}
|
||||
for (j = 0; j < 4; j++)
|
||||
FillBuff(parity[j]);
|
||||
FillBuff(0);
|
||||
}
|
||||
|
||||
void LED_Slot(int i) {
|
||||
LEDsoff();
|
||||
if (slots_count > 4) {
|
||||
LED(i % MAX_IND, 0); //binary indication for slots_count > 4
|
||||
} else {
|
||||
LED(1 << i, 0); //simple indication for slots_count <=4
|
||||
}
|
||||
}
|
||||
|
||||
void RunMod() {
|
||||
StandAloneMode();
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
int selected = 0; //selected slot after start
|
||||
slots_count = sizeof(low) / sizeof(low[0]);
|
||||
bba = BigBuf_get_addr();
|
||||
for (;;) {
|
||||
WDT_HIT();
|
||||
if (data_available()) break;
|
||||
SpinDelay(100);
|
||||
SpinUp(100);
|
||||
LED_Slot(selected);
|
||||
ConstructEM410xEmulBuf(ReversQuads(low[selected]));
|
||||
SimulateTagLowFrequency(buflen, 0, true);
|
||||
selected = (selected + 1) % slots_count;
|
||||
}
|
||||
}
|
||||
202
armsrc/Standalone/lf_em4100rwc.c
Normal file
202
armsrc/Standalone/lf_em4100rwc.c
Normal file
|
|
@ -0,0 +1,202 @@
|
|||
//-----------------------------------------------------------------------------
|
||||
// Artyom Gnatyuk, 2020
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// LF rwc - This mode can simulate ID from selected slot, read ID to
|
||||
// selected slot, write from selected slot to T5555 tag and store
|
||||
// readed ID to flash (only RDV4). Also you can set predefined IDs
|
||||
// in any slot.
|
||||
// To recall stored ID from flash execute:
|
||||
// mem spifss dump o emdump p
|
||||
// or:
|
||||
// mem spifss dump o emdump f emdump
|
||||
// then from shell:
|
||||
// hexdump emdump -e '5/1 "%02X" /0 "\n"'
|
||||
//-----------------------------------------------------------------------------
|
||||
#include "standalone.h"
|
||||
#include "proxmark3_arm.h"
|
||||
#include "appmain.h"
|
||||
#include "fpgaloader.h"
|
||||
#include "lfops.h"
|
||||
#include "util.h"
|
||||
#include "dbprint.h"
|
||||
#include "ticks.h"
|
||||
#include "string.h"
|
||||
#include "BigBuf.h"
|
||||
#include "spiffs.h"
|
||||
|
||||
#ifdef WITH_FLASH
|
||||
#include "flashmem.h"
|
||||
#endif
|
||||
|
||||
#define MAX_IND 16 // 4 LEDs - 2^4 combinations
|
||||
#define CLOCK 64 //for 125kHz
|
||||
|
||||
// low & high - array for storage IDs. Its length must be equal.
|
||||
// Predefined IDs must be stored in low[].
|
||||
// In high[] must be nulls
|
||||
uint64_t low[] = {0x565AF781C7, 0x540053E4E2, 0x1234567890, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t high[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint8_t *bba, slots_count;
|
||||
int buflen;
|
||||
|
||||
void ModInfo(void) {
|
||||
DbpString(" LF EM4100 read/write/clone mode");
|
||||
}
|
||||
|
||||
uint64_t ReversQuads(uint64_t bits) {
|
||||
uint64_t result = 0;
|
||||
for (int i = 0; i < 16; i++) {
|
||||
result += ((bits >> (60 - 4 * i)) & 0xf) << (4 * i);
|
||||
}
|
||||
return result >> 24;
|
||||
}
|
||||
|
||||
void FillBuff(uint8_t bit) {
|
||||
memset(bba + buflen, bit, CLOCK / 2);
|
||||
buflen += (CLOCK / 2);
|
||||
memset(bba + buflen, bit ^ 1, CLOCK / 2);
|
||||
buflen += (CLOCK / 2);
|
||||
}
|
||||
|
||||
void ConstructEM410xEmulBuf(uint64_t id) {
|
||||
|
||||
int i, j, binary[4], parity[4];
|
||||
buflen = 0;
|
||||
for (i = 0; i < 9; i++)
|
||||
FillBuff(1);
|
||||
parity[0] = parity[1] = parity[2] = parity[3] = 0;
|
||||
for (i = 0; i < 10; i++) {
|
||||
for (j = 3; j >= 0; j--, id /= 2)
|
||||
binary[j] = id % 2;
|
||||
for (j = 0; j < 4; j++)
|
||||
FillBuff(binary[j]);
|
||||
FillBuff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
|
||||
for (j = 0; j < 4; j++)
|
||||
parity[j] ^= binary[j];
|
||||
}
|
||||
for (j = 0; j < 4; j++)
|
||||
FillBuff(parity[j]);
|
||||
FillBuff(0);
|
||||
}
|
||||
|
||||
void LED_Slot(int i) {
|
||||
LEDsoff();
|
||||
if (slots_count > 4) {
|
||||
LED(i % MAX_IND, 0); //binary indication, usefully for slots_count > 4
|
||||
} else {
|
||||
LED(1 << i, 0); //simple indication for slots_count <=4
|
||||
}
|
||||
}
|
||||
|
||||
void FlashLEDs(uint32_t speed, uint8_t times) {
|
||||
for (int i = 0; i < times * 2; i++) {
|
||||
LED_A_INV();
|
||||
LED_B_INV();
|
||||
LED_C_INV();
|
||||
LED_D_INV();
|
||||
SpinDelay(speed);
|
||||
}
|
||||
}
|
||||
|
||||
#ifdef WITH_FLASH
|
||||
void SaveIDtoFlash(int addr, uint64_t id) {
|
||||
uint8_t bt[5];
|
||||
char *filename = "emdump";
|
||||
rdv40_spiffs_mount();
|
||||
for (int i = 0; i < 5; i++) {
|
||||
bt[4 - i] = (uint8_t)(id >> 8 * i & 0xff);
|
||||
}
|
||||
if (exists_in_spiffs(filename) == false) {
|
||||
rdv40_spiffs_write(filename, &bt[0], 5, RDV40_SPIFFS_SAFETY_NORMAL);
|
||||
} else {
|
||||
rdv40_spiffs_append(filename, &bt[0], 5, RDV40_SPIFFS_SAFETY_NORMAL);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
void RunMod() {
|
||||
StandAloneMode();
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
int selected = 0;
|
||||
//state 0 - select slot
|
||||
// 1 - read tag to selected slot,
|
||||
// 2 - simulate tag from selected slot
|
||||
// 3 - write to T5555 tag
|
||||
uint8_t state = 0;
|
||||
slots_count = sizeof(low) / sizeof(low[0]);
|
||||
bba = BigBuf_get_addr();
|
||||
LED_Slot(selected);
|
||||
for (;;) {
|
||||
WDT_HIT();
|
||||
if (data_available()) break;
|
||||
int button_pressed = BUTTON_HELD(1000);
|
||||
SpinDelay(300);
|
||||
switch (state) {
|
||||
case 0:
|
||||
// Select mode
|
||||
if (button_pressed == 1) {
|
||||
// Long press - switch to simulate mode
|
||||
SpinUp(100);
|
||||
LED_Slot(selected);
|
||||
state = 2;
|
||||
} else if (button_pressed < 0) {
|
||||
// Click - switch to next slot
|
||||
selected = (selected + 1) % slots_count;
|
||||
LED_Slot(selected);
|
||||
}
|
||||
break;
|
||||
case 1:
|
||||
// Read mode.
|
||||
if (button_pressed > 0) {
|
||||
// Long press - switch to read mode
|
||||
SpinUp(100);
|
||||
LED_Slot(selected);
|
||||
state = 3;
|
||||
} else if (button_pressed < 0) {
|
||||
// Click - exit to select mode
|
||||
CmdEM410xdemod(1, &high[selected], &low[selected], 0);
|
||||
FlashLEDs(100, 5);
|
||||
#ifdef WITH_FLASH
|
||||
SaveIDtoFlash(selected, low[selected]);
|
||||
#endif
|
||||
state = 0;
|
||||
}
|
||||
break;
|
||||
case 2:
|
||||
// Simulate mode
|
||||
if (button_pressed > 0) {
|
||||
// Long press - switch to read mode
|
||||
SpinDown(100);
|
||||
LED_Slot(selected);
|
||||
state = 1;
|
||||
} else if (button_pressed < 0) {
|
||||
// Click - start simulating. Click again to exit from simulate mode
|
||||
LED_Slot(selected);
|
||||
ConstructEM410xEmulBuf(ReversQuads(low[selected]));
|
||||
FlashLEDs(100, 5);
|
||||
SimulateTagLowFrequency(buflen, 0, 1);
|
||||
LED_Slot(selected);
|
||||
state = 0; // Switch to select mode
|
||||
}
|
||||
break;
|
||||
case 3:
|
||||
// Write tag mode
|
||||
if (button_pressed > 0) {
|
||||
// Long press - switch to select mode
|
||||
SpinDown(100);
|
||||
LED_Slot(selected);
|
||||
state = 0;
|
||||
} else if (button_pressed < 0) {
|
||||
// Click - write ID to tag
|
||||
WriteEM410x(0, (uint32_t)(low[selected] >> 32), (uint32_t)(low[selected] & 0xffffffff));
|
||||
LED_Slot(selected);
|
||||
state = 0; // Switch to select mode
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue