github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-19 21:03:48 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'dev_standalone' into malsehn_standalone

Browse source
This commit is contained in:
tharexde 2020-09-23 00:07:34 +02:00
commit 51651a1e0a
12 changed files with 992 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

9
armsrc/Standalone/Makefile.hal
View file

@ -35,6 +35,9 @@ define KNOWN_STANDALONE_DEFINITIONS
| LF_SAMYRUN | HID26 read/clone/sim |
| | - Samy Kamkar |
+----------------------------------------------------------+
| LF_THAREXDE | read and sim em4x50 tags |
| (RDV4 only) | |
+----------------------------------------------------------+
| HF_14ASNIFF | 14a sniff to flashmem |
| (RDV4 only) | |
+----------------------------------------------------------+
@ -64,10 +67,10 @@ define KNOWN_STANDALONE_DEFINITIONS
+----------------------------------------------------------+
endef
STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN
STANDALONE_MODES += HF_14ASNIFF HF_AVEFUL HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG
STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE
STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG
STANDALONE_MODES_REQ_SMARTCARD :=
STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
STANDALONE_MODES_REQ_FLASH := LF_THAREXDE LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN
ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)
STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE)
ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),)

4
armsrc/Standalone/Makefile.inc
View file

@ -69,3 +69,7 @@ endif
ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
SRC_STANDALONE = hf_iceclass.c
endif
# WITH_STANDALONE_LF_THAREXDE
ifneq (,$(findstring WITH_STANDALONE_LF_THAREXDE,$(APP_CFLAGS)))
SRC_STANDALONE = lf_tharexde.c
endif

297
armsrc/Standalone/lf_tharexde.c Normal file
View file

@ -0,0 +1,297 @@
//-----------------------------------------------------------------------------
// Tharexde, 2020
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// main code for EM4x50 simulator and collector aka THAREXDE
//-----------------------------------------------------------------------------
#include <inttypes.h>
#include "standalone.h"
#include "proxmark3_arm.h"
#include "appmain.h"
#include "BigBuf.h"
#include "fpgaloader.h"
#include "util.h"
#include "dbprint.h"
#include "spiffs.h"
#include "../em4x50.h"
/*
* `lf_tharexde` simulates hardcoded words/blocks, reads words of standard read
* mode of EM4x50 tags and stores them in internal flash.
* It requires RDV4 hardware (for flash and battery).
*
* On entering stand-alone mode, this module will start reading/record EM4x50 data.
* Every found / collected data will be written/appended to the logfile in flash
* as a text string.
*
* LEDs:
* - LED A: simulating
* - LED B: reading / record
* - LED C: writing to flash
* - LED D: unmounting/sync'ing flash (normally < 100ms)
*
* To retrieve log file from flash:
*
* 1. mem spiffs dump o lf_em4x50collect.log f lf_em4x50collect.log
* Copies log file from flash to your client.
*
* 2. exit the Proxmark3 client
*
* 3. more lf_tharexdecollect.log
*
* This module emits debug strings during normal operation -- so try it out in
* the lab connected to PM3 client before taking it into the field.
*
* To delete the log file from flash:
*
* 1. mem spiffs remove lf_tharexdecollect.log
*/
#define STATE_SIM 0
#define STATE_READ 1
#define LF_EM4X50SIMULATE_INPUTFILE "lf_em4x50simulate.eml"
#define LF_EM4X50COLLECT_LOGFILE "lf_em4x50collect.log"
#define EM4X50_TAG_WORD 45
bool input_exists;
bool log_exists;
static void LoadDataInstructions(void) {
Dbprintf("");
Dbprintf("[=] To load datafile into flash and display it:");
Dbprintf("[=] " _YELLOW_("1.") " edit inputfile "LF_EM4X50SIMULATE_INPUTFILE);
Dbprintf("[=] " _YELLOW_("2.") " start proxmark3 client");
Dbprintf("[=] " _YELLOW_("3.") " mem spiffs load f "LF_EM4X50SIMULATE_INPUTFILE" o "LF_EM4X50SIMULATE_INPUTFILE);
Dbprintf("[=] " _YELLOW_("4.") " start standalone mode");
}
static void DownloadLogInstructions(void) {
Dbprintf("");
Dbprintf("[=] To get the logfile from flash and display it:");
Dbprintf("[=] " _YELLOW_("1.") " mem spiffs dump o "LF_EM4X50COLLECT_LOGFILE" f "LF_EM4X50COLLECT_LOGFILE);
Dbprintf("[=] " _YELLOW_("2.") " exit proxmark3 client");
Dbprintf("[=] " _YELLOW_("3.") " cat "LF_EM4X50COLLECT_LOGFILE);
}
static bool strip_check_parities(uint64_t data, uint32_t *word) {
uint8_t rparity = 0, cparity = 0;
uint8_t rparity_m = 0, cparity_m = 0, stop_bit_m = 0;
// strip parities
for (int i = 0; i < 4; i++) {
for (int j = 0; j < 8; j++) {
*word <<= 1;
*word += (data >> (EM4X50_TAG_WORD - 1 - 9 * i - j)) & 1;
}
}
// calculate row parities
for (int i = 0; i < 4; i++) {
rparity <<= 1;
for (int j = 0; j < 8; j++) {
rparity ^= (*word >> (31 - 8 * i - j)) & 1;
}
}
// calculate column parities
for (int i = 0; i < 8; i++) {
cparity <<= 1;
for (int j = 0; j < 4; j++) {
cparity ^= (*word >> (31 - 8 * j - i)) & 1;
}
}
// measured row parities
for (int i = 0; i < 4; i++) {
rparity_m <<= 1;
rparity_m += (data >> (EM4X50_TAG_WORD - 9 * (i + 1))) & 1;
}
// measured column parities
cparity_m = (data >> 1) & 0xFF;
// measured stop bit
stop_bit_m = data & 1;
if ((cparity_m == cparity) && (rparity_m == rparity) && (stop_bit_m == 0))
return true;
return false;
}
static int get_input_data_from_file(uint32_t *words) {
size_t now = 0;
if (exists_in_spiffs(LF_EM4X50SIMULATE_INPUTFILE)) {
uint32_t size = size_in_spiffs((char *)LF_EM4X50SIMULATE_INPUTFILE);
uint8_t *mem = BigBuf_malloc(size);
Dbprintf(_YELLOW_("[=] found input file %s"), LF_EM4X50SIMULATE_INPUTFILE);
rdv40_spiffs_read_as_filetype((char *)LF_EM4X50SIMULATE_INPUTFILE, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
now = size / 9;
for (int i = 0; i < now; i++)
for (int j = 0; j < 4; j++)
words[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
Dbprintf(_YELLOW_("[=] read data from input file"));
}
BigBuf_free();
return (now > 0) ? now : 0;
}
static void append(uint8_t *entry, size_t entry_len) {
LED_C_ON();
if (log_exists == false) {
rdv40_spiffs_write(LF_EM4X50COLLECT_LOGFILE, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
log_exists = true;
} else {
rdv40_spiffs_append(LF_EM4X50COLLECT_LOGFILE, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
}
LED_C_OFF();
}
void ModInfo(void) {
DbpString(_YELLOW_(" LF EM4x50 collector mode") " - a.k.a tharexde");
}
void RunMod(void) {
bool state_change = true;
uint8_t state = STATE_SIM;
// declarations for simulating
uint32_t words[33] = {0x0};
size_t now = 0;
// declarations for reading
int no_words = 0;
uint64_t data[EM4X50_TAG_WORD];
uint32_t word = 0;
uint8_t entry[81];
rdv40_spiffs_lazy_mount();
StandAloneMode();
Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE started"));
for (;;) {
WDT_HIT();
if (data_available()) break;
// press button - toggle between SIM and READ
// hold button - exit
int button_pressed = BUTTON_CLICKED(1000);
if (button_pressed == BUTTON_SINGLE_CLICK) {
SpinUp(100);
state = (state == STATE_SIM) ? STATE_READ : STATE_SIM;
state_change = true;
} else if (button_pressed == BUTTON_HOLD) {
SpinDown(100);
break;
}
if (state == STATE_SIM) {
if (state_change) {
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
LED_A_ON();
LED_B_OFF();
Dbprintf(_YELLOW_("[=] switched to EM4x50 simulating mode"));
now = get_input_data_from_file(words);
if (now > 0) {
Dbprintf(_YELLOW_("[=] simulating %i blocks"), now);
for (int i = 0; i < now; i++)
Dbprintf(_YELLOW_("[=] %2i -> %lx"), i + 1, words[i]);
} else {
Dbprintf(_RED_("[!] error in input data"));
}
state_change = false;
}
em4x50_sim_send_listen_window2();
for (int i = 0; i < now; i++) {
em4x50_sim_send_listen_window2();
em4x50_sim_send_word3(words[i]);
}
} else if (state == STATE_READ) {
if (state_change) {
LED_B_ON();
LED_A_OFF();
Dbprintf(_YELLOW_("[=] switched to EM4x50 reading mode"));
memset(entry, 0, sizeof(entry));
memset(data, 0, sizeof(data));
log_exists = exists_in_spiffs(LF_EM4X50COLLECT_LOGFILE);
state_change = false;
}
no_words = em4x50_standalone_read(data);
if (no_words > 0) {
memset(entry, 0, sizeof(entry));
sprintf((char *)entry, "found new EM4x50 tag:");
Dbprintf("%s", entry);
strcat((char *)entry, "\n");
append(entry, strlen((char *)entry));
for (int i = 0; i < no_words; i++) {
if (strip_check_parities(data[i], &word))
sprintf((char *)entry, " %2i -> 0x%08"PRIx32" (parity check ok)", i + 1, word);
else
sprintf((char *)entry, " %2i -> 0x%08"PRIx32" (parity check failed)", i + 1, word);
Dbprintf("%s", entry);
strcat((char *)entry, "\n");
append(entry, strlen((char *)entry));
}
}
}
}
if (state == STATE_READ)
DownloadLogInstructions();
else
LoadDataInstructions();
LED_D_ON();
rdv40_spiffs_lazy_unmount();
LED_D_OFF();
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
}

8
armsrc/appmain.c
View file

@ -1037,6 +1037,14 @@ static void PacketReceived(PacketCommandNG *packet) {
em4x50_wipe((em4x50_data_t *)packet->data.asBytes);
break;
}
case CMD_LF_EM4X50_SIM: {
em4x50_sim((em4x50_data_t *)packet->data.asBytes);
break;
}
case CMD_LF_EM4X50_TEST: {
em4x50_test((em4x50_data_t *)packet->data.asBytes);
break;
}
#endif
#ifdef WITH_ISO15693

544
armsrc/em4x50.c
View file

@ -8,10 +8,12 @@
// Low frequency EM4x50 commands
//-----------------------------------------------------------------------------
#include "BigBuf.h"
#include "fpgaloader.h"
#include "ticks.h"
#include "dbprint.h"
#include "lfadc.h"
#include "lfsampling.h"
#include "commonutil.h"
#include "em4x50.h"
@ -72,18 +74,21 @@ static em4x50_tag_t tag = {
#define EM4X50_T_TAG_HALF_PERIOD 32
#define EM4X50_T_TAG_THREE_QUARTER_PERIOD 48
#define EM4X50_T_TAG_FULL_PERIOD 64
#define EM4X50_T_TAG_THREE_HALF_PERIOD 96
#define EM4X50_T_TAG_TPP 64
#define EM4X50_T_TAG_TWA 64
#define EM4X50_T_WAITING_FOR_SNGLLIW 50
#define EM4X50_T_WAITING_FOR_SNGLLIW 100
#define EM4X50_T_WAITING_FOR_DBLLIW 1550
#define EM4X50_TAG_TOLERANCE 8
#define EM4X50_TAG_WORD 45
#define EM4X50_SAMPLE_CNT_MAX 3000
#define EM4X50_BIT_0 0
#define EM4X50_BIT_1 1
#define EM4X50_BIT_OTHER 2
#define EM4X50_COMMAND_REQUEST 2
#define EM4X50_COMMAND_LOGIN 0x01
#define EM4X50_COMMAND_RESET 0x80
#define EM4X50_COMMAND_WRITE 0x12
@ -172,7 +177,7 @@ static void wait_timer(int timer, uint32_t period) {
AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
while (AT91C_BASE_TC0->TC_CV < period);
} else {
AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
@ -241,6 +246,7 @@ static bool get_signalproperties(void) {
bool signal_found = false;
int no_periods = 32, pct = 75, noise = 140;
uint8_t sample = 0;
uint8_t sample_ref = 127;
uint8_t sample_max_mean = 0;
uint8_t sample_max[no_periods];
@ -250,6 +256,8 @@ static bool get_signalproperties(void) {
// wait until signal/noise > 1 (max. 32 periods)
for (int i = 0; i < T0 * no_periods; i++) {
if (BUTTON_PRESS()) return false;
// about 2 samples per bit period
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
@ -269,8 +277,9 @@ static bool get_signalproperties(void) {
AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
while (AT91C_BASE_TC0->TC_CV < T0 * 3 * EM4X50_T_TAG_FULL_PERIOD) {
volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if (BUTTON_PRESS()) return false;
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if (sample > sample_max[i])
sample_max[i] = sample;
@ -318,21 +327,28 @@ static uint32_t get_pulse_length(void) {
int32_t timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
// iterates pulse length (low -> high -> low)
// to avoid endless loops - quit after EM4X50_SAMPLE_CNT_MAX samples
int sample_cnt = 0;
uint8_t sample = 0;
volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
while (sample > gLow && (timeout--)) {
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if (++sample_cnt > EM4X50_SAMPLE_CNT_MAX)
return 0;
}
if (timeout == 0)
return 0;
AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
while (sample < gHigh && (timeout--)) {
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if (++sample_cnt > EM4X50_SAMPLE_CNT_MAX)
return 0;
}
if (timeout == 0)
@ -341,11 +357,10 @@ static uint32_t get_pulse_length(void) {
timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
while (sample > gLow && (timeout--)) {
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if (++sample_cnt > EM4X50_SAMPLE_CNT_MAX)
return 0;
}
if (timeout == 0)
return 0;
return (uint32_t)AT91C_BASE_TC1->TC_CV;
}
@ -355,8 +370,8 @@ static bool check_pulse_length(uint32_t pl, int length) {
return ((pl >= T0 * (length - EM4X50_TAG_TOLERANCE)) & (pl <= T0 * (length + EM4X50_TAG_TOLERANCE)));
}
static void em4x50_send_bit(int bit) {
static void em4x50_reader_send_bit(int bit) {
// send single bit according to EM4x50 application note and datasheet
// reset clock for the next bit
@ -385,45 +400,200 @@ static void em4x50_send_bit(int bit) {
while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
}
}
/*
static void em4x50_sim_send_bit(int bit) {
// send single bit according to EM4x50 application note and datasheet
// reset clock for the next bit
AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
static void em4x50_send_byte(uint8_t byte) {
if (bit == 0) {
// disable modulation (activates the field) for first half of bit period
LOW(GPIO_SSC_DOUT);
while (AT91C_BASE_TC1->TC_CV < T0 * EM4X50_T_TAG_HALF_PERIOD);
// enable modulation for second half of bit period
HIGH(GPIO_SSC_DOUT);
while (AT91C_BASE_TC1->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
} else {
// enable modulation (drop the field) for first half of bit period
HIGH(GPIO_SSC_DOUT);
while (AT91C_BASE_TC1->TC_CV < T0 * EM4X50_T_TAG_HALF_PERIOD);
// disable modulation for second half of bit period
LOW(GPIO_SSC_DOUT);
while (AT91C_BASE_TC1->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
}
}
*/
static void em4x50_reader_send_byte(uint8_t byte) {
// send byte (without parity)
for (int i = 0; i < 8; i++)
em4x50_reader_send_bit((byte >> (7-i)) & 1);
}
/*
static void em4x50_sim_send_byte(uint8_t byte) {
// send byte (without parity)
for (int i = 0; i < 8; i++)
em4x50_send_bit((byte >> (7 - i)) & 1);
em4x50_sim_send_bit((byte >> (7-i)) & 1);
}
*/
static void em4x50_reader_send_byte_with_parity(uint8_t byte) {
static void em4x50_send_byte_with_parity(uint8_t byte) {
// send byte followed by its (equal) parity bit
int parity = 0, bit = 0;
for (int i = 0; i < 8; i++) {
bit = (byte >> (7-i)) & 1;
em4x50_reader_send_bit(bit);
parity ^= bit;
}
em4x50_reader_send_bit(parity);
}
/*
static void em4x50_sim_send_byte_with_parity(uint8_t byte) {
// send byte followed by its (equal) parity bit
int parity = 0, bit = 0;
for (int i = 0; i < 8; i++) {
bit = (byte >> (7 - i)) & 1;
em4x50_send_bit(bit);
bit = (byte >> (7-i)) & 1;
em4x50_sim_send_bit(bit);
parity ^= bit;
}
em4x50_send_bit(parity);
em4x50_sim_send_bit(parity);
}
*/
static void em4x50_reader_send_word(const uint8_t bytes[4]) {
// send 32 bit word with parity bits according to EM4x50 datasheet
for (int i = 0; i < 4; i++)
em4x50_reader_send_byte_with_parity(bytes[i]);
// send column parities
em4x50_reader_send_byte(bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3]);
static void em4x50_send_word(const uint8_t bytes[4]) {
// send final stop bit (always "0")
em4x50_reader_send_bit(0);
}
/*
static void em4x50_sim_send_word(const uint8_t bytes[4]) {
// send 32 bit word with parity bits according to EM4x50 datasheet
for (int i = 0; i < 4; i++)
em4x50_send_byte_with_parity(bytes[i]);
em4x50_sim_send_byte_with_parity(bytes[i]);
// send column parities
em4x50_send_byte(bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3]);
em4x50_sim_send_byte(bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3]);
// send final stop bit (always "0")
em4x50_send_bit(0);
em4x50_sim_send_bit(0);
}
static void em4x50_sim_send_ack(void) {
// send "acknowledge" according to EM4x50 application note and datasheet
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
HIGH(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_THREE_HALF_PERIOD);
HIGH(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_THREE_HALF_PERIOD);
HIGH(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
}
static void em4x50_sim_send_nak(void) {
// send "not" acknowledge" according to EM4x50 application note and datasheet
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
HIGH(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_THREE_HALF_PERIOD);
HIGH(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_FULL_PERIOD);
HIGH(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
}
static void em4x50_sim_handle_command(void) {
em4x50_sim_send_ack();
em4x50_sim_send_nak();
Dbprintf("");
}
*/
/*
static bool em4x50_sim_detect_rm(void) {
if (get_next_bit() == EM4X50_BIT_0)
if (get_next_bit() == EM4X50_BIT_0)
return true;
//int periods = 0;
//AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
//while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD)
// adc_val[periods++] = AT91C_BASE_SSC->SSC_RHR;
return false;
}
*/
/*
static void em4x50_sim_send_listen_window(void) {
// send single listen window according to EM4x50 application note and datasheet
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
HIGH(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD);
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * 2 * EM4X50_T_TAG_FULL_PERIOD);
HIGH(GPIO_SSC_DOUT);
if (em4x50_sim_detect_rm())
em4x50_sim_handle_command();
LOW(GPIO_SSC_DOUT);
wait_timer(0, T0 * EM4X50_T_TAG_FULL_PERIOD);
}
*/
static bool find_single_listen_window(void) {
// find single listen window
@ -486,8 +656,8 @@ static bool find_double_listen_window(bool bcommand) {
if (get_next_bit() == EM4X50_BIT_OTHER) {
// send RM for request mode
em4x50_send_bit(0);
em4x50_send_bit(0);
em4x50_reader_send_bit(0);
em4x50_reader_send_bit(0);
return true;
}
@ -561,8 +731,8 @@ static bool check_ack(bool bliw) {
if (get_next_bit() == EM4X50_BIT_OTHER) {
// send RM for request mode
em4x50_send_bit(0);
em4x50_send_bit(0);
em4x50_reader_send_bit(0);
em4x50_reader_send_bit(0);
return true;
}
@ -611,8 +781,8 @@ static int get_word_from_bitstream(uint8_t bits[EM4X50_TAG_WORD]) {
// identify remaining bits based on pulse lengths
// between two listen windows only pulse lengths of 1, 1.5 and 2 are possible
while (true) {
while (BUTTON_PRESS() == false) {
i++;
pl = get_pulse_length();
@ -660,6 +830,8 @@ static int get_word_from_bitstream(uint8_t bits[EM4X50_TAG_WORD]) {
}
}
return 0;
}
//==============================================================================
@ -674,10 +846,10 @@ static bool login(uint8_t password[4]) {
if (request_receive_mode()) {
// send login command
em4x50_send_byte_with_parity(EM4X50_COMMAND_LOGIN);
em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_LOGIN);
// send password
em4x50_send_word(password);
em4x50_reader_send_word(password);
// check if ACK is returned
if (check_ack(false))
@ -696,14 +868,14 @@ static bool login(uint8_t password[4]) {
//==============================================================================
static bool reset(void) {
// resets EM4x50 tag (used by write function)
if (request_receive_mode()) {
// send login command
em4x50_send_byte_with_parity(EM4X50_COMMAND_RESET);
em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_RESET);
if (check_ack(false))
return true;
@ -760,15 +932,14 @@ static bool selective_read(uint8_t addresses[4]) {
if (request_receive_mode()) {
// send selective read command
em4x50_send_byte_with_parity(EM4X50_COMMAND_SELECTIVE_READ);
em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_SELECTIVE_READ);
// send address data
em4x50_send_word(addresses);
em4x50_reader_send_word(addresses);
// look for ACK sequence
// look for ACK sequence -> save and verify via standard read mode
// (compare number of words)
if (check_ack(false))
// save and verify via standard read mode (compare number of words)
if (standard_read(&now))
if (now == (lwr - fwr + 1))
return true;
@ -797,7 +968,7 @@ void em4x50_info(em4x50_data_t *etd) {
// set gHigh and gLow
if (get_signalproperties() && find_em4x50_tag()) {
if (etd->pwd_given) {
// try to login with given password
@ -835,8 +1006,7 @@ void em4x50_read(em4x50_data_t *etd) {
em4x50_setup_read();
// set gHigh and gLow
if (get_signalproperties() && find_em4x50_tag()) {
if (get_signalproperties()) {//} && find_em4x50_tag()) {
if (etd->addr_given) {
// selective read mode
@ -853,12 +1023,12 @@ void em4x50_read(em4x50_data_t *etd) {
// standard read mode
bsuccess = standard_read(&now);
}
}
status = (now << 2) + (bsuccess << 1) + blogin;
LOW(GPIO_SSC_DOUT);
lf_finalize();
reply_ng(CMD_ACK, status, (uint8_t *)tag.sectors, 238);
}
@ -874,13 +1044,13 @@ static bool write(uint8_t word[4], uint8_t address) {
if (request_receive_mode()) {
// send write command
em4x50_send_byte_with_parity(EM4X50_COMMAND_WRITE);
em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_WRITE);
// send address data
em4x50_send_byte_with_parity(address);
em4x50_reader_send_byte_with_parity(address);
// send data
em4x50_send_word(word);
em4x50_reader_send_word(word);
// wait for T0 * EM4X50_T_TAG_TWA (write access time)
wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA);
@ -910,10 +1080,10 @@ static bool write_password(uint8_t password[4], uint8_t new_password[4]) {
if (request_receive_mode()) {
// send write password command
em4x50_send_byte_with_parity(EM4X50_COMMAND_WRITE_PASSWORD);
em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_WRITE_PASSWORD);
// send address data
em4x50_send_word(password);
em4x50_reader_send_word(password);
// wait for T0 * EM4x50_T_TAG_TPP (processing pause time)
wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TPP);
@ -923,7 +1093,7 @@ static bool write_password(uint8_t password[4], uint8_t new_password[4]) {
if (check_ack(true)) {
// send new password
em4x50_send_word(new_password);
em4x50_reader_send_word(new_password);
// wait for T0 * EM4X50_T_TAG_TWA (write access time)
wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA);
@ -1080,3 +1250,285 @@ void em4x50_wipe(em4x50_data_t *etd) {
lf_finalize();
reply_ng(CMD_ACK, bsuccess, (uint8_t *)tag.sectors, 238);
}
static bool em4x50_sim_send_bit2(uint8_t bit) {
uint16_t check = 0;
for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) {
// wait until SSC_CLK goes HIGH
// used as a simple detection of a reader field?
while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
WDT_HIT();
if (check == 1000) {
if (BUTTON_PRESS())
return false;
check = 0;
}
++check;
}
if (bit)
OPEN_COIL();
else
SHORT_COIL();
check = 0;
//wait until SSC_CLK goes LOW
while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
WDT_HIT();
if (check == 1000) {
if (BUTTON_PRESS())
return false;
check = 0;
}
++check;
}
if (t == EM4X50_T_TAG_HALF_PERIOD)
bit ^= 1;
}
return true;
}
static bool em4x50_sim_send_byte2(uint8_t byte) {
// send byte
for (int i = 0; i < 8; i++)
if (!em4x50_sim_send_bit2((byte >> (7 - i)) & 1))
return false;
return true;
}
static bool em4x50_sim_send_byte_with_parity2(uint8_t byte) {
uint8_t parity = 0x0;
// send byte with parity (even)
for (int i = 0; i < 8; i++)
parity ^= (byte >> i) & 1;
if (!em4x50_sim_send_byte2(byte))
return false;;
if (!em4x50_sim_send_bit2(parity))
return false;
return true;
}
bool em4x50_sim_send_word3(uint32_t word) {
uint8_t cparity = 0x00;
// 4 bytes each with even row parity bit
for (int i = 0; i < 4; i++)
if (!em4x50_sim_send_byte_with_parity2( (word >> ((3 - i) * 8)) & 0xFF))
return false;
// column parity
for (int i = 0; i < 8; i++) {
cparity <<= 1;
for (int j = 0; j < 4; j++) {
cparity ^= (((word >> ((3 - j) * 8)) & 0xFF) >> (7 - i)) & 1;
}
}
if (!em4x50_sim_send_byte2(cparity))
return false;
// stop bit
if (!em4x50_sim_send_bit2(0))
return false;
return true;
}
bool em4x50_sim_send_listen_window2(void) {
//int i = 0;
uint16_t check = 0;
//uint8_t test[100] = {0};
for (int t = 0; t < 5 * EM4X50_T_TAG_FULL_PERIOD; t++) {
// wait until SSC_CLK goes HIGH
while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
WDT_HIT();
if (check == 1000) {
if (BUTTON_PRESS())
return false;
check = 0;
}
++check;
}
if (t >= 4 * EM4X50_T_TAG_FULL_PERIOD) {
SHORT_COIL();
} else if (t >= 3 * EM4X50_T_TAG_FULL_PERIOD) {
OPEN_COIL();
} else if (t >= EM4X50_T_TAG_FULL_PERIOD) {
SHORT_COIL();
} else if (t >= EM4X50_T_TAG_HALF_PERIOD) {
OPEN_COIL();
} else {
SHORT_COIL();
}
check = 0;
//wait until SSC_CLK goes LOW
while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
WDT_HIT();
if (check == 1000) {
if (BUTTON_PRESS())
return false;
check = 0;
}
++check;
}
}
return true;
}
/*
static void em4x50_sim_send_word3(uint8_t *word) {
uint8_t rparity = 0x00, cparity = 0x00;
uint64_t word_with_parities = { 0x00 };
// bytes + row parities
for (int i = 0; i < 4; i++) {
for (int j = 0; j < 8; j++) {
word_with_parities += (word[i] >> j) & 1;
word_with_parities <<= 1;
rparity ^= (word[i] >> j) & 1;
}
word_with_parities += rparity & 1;
word_with_parities <<= 1;
}
// column parities
for (int i = 0; i < 8; i++) {
for (int j = 0; j < 4; j++) {
cparity ^= (word[j] >> i) & 1;
}
word_with_parities += cparity;
word_with_parities <<= 1;
cparity = 0;
}
// stop bit
word_with_parities += 0;
// send total word
for (int i = 0; i < EM4X50_TAG_WORD; i++)
em4x50_sim_send_bit2((word_with_parities >> (EM4X50_TAG_WORD-1 - i)) & 1);
}
*/
/*
static void simlf(uint8_t *buf, int period) {
int i = 0, count = 0;
int clock1 = 32, clock2 = 64;
uint16_t check = 0;
for (;;) {
// wait until SSC_CLK goes HIGH
// used as a simple detection of a reader field?
while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
WDT_HIT();
if (check == 1000) {
if (BUTTON_PRESS())
return;
check = 0;
}
++check;
}
if (buf[i])
OPEN_COIL();
else
SHORT_COIL();
check = 0;
//wait until SSC_CLK goes LOW
while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
WDT_HIT();
if (check == 1000) {
if (BUTTON_PRESS())
return;
check = 0;
}
++check;
}
if (count == EM4X50_T_TAG_HALF_PERIOD) {
buf[i] ^= 1;
} else if (count == EM4X50_T_TAG_FULL_PERIOD) {
buf[i] ^= 1;
count = 0;
i++;
if (i == period) {
i = 0;
}
}
count++;
}
}
*/
void em4x50_sim(em4x50_data_t *etd) {
bool bsuccess = false;
lf_finalize();
reply_ng(CMD_ACK, bsuccess, (uint8_t *)tag.sectors, 238);
}
void em4x50_test(em4x50_data_t *etd) {
bool bsuccess = true;
reply_ng(CMD_ACK, bsuccess, (uint8_t *)tag.sectors, 238);
}
int em4x50_standalone_read(uint64_t *words) {
int now = 0;
uint8_t bits[EM4X50_TAG_WORD];
em4x50_setup_read();
if (get_signalproperties() && find_em4x50_tag()) {
if (find_double_listen_window(false)) {
memset(bits, 0, sizeof(bits));
while (get_word_from_bitstream(bits) == EM4X50_TAG_WORD) {
words[now] = 0;
for (int i = 0; i < EM4X50_TAG_WORD; i++) {
words[now] <<= 1;
words[now] += bits[i] & 1;
}
now++;
}
}
}
return now;
}

6
armsrc/em4x50.h
View file

@ -17,10 +17,16 @@ typedef struct {
uint8_t sectors[34][7];
} em4x50_tag_t;
int em4x50_standalone_read(uint64_t *words);
bool em4x50_sim_send_listen_window2(void);
bool em4x50_sim_send_word3(uint32_t word);
void em4x50_info(em4x50_data_t *etd);
void em4x50_write(em4x50_data_t *etd);
void em4x50_write_password(em4x50_data_t *etd);
void em4x50_read(em4x50_data_t *etd);
void em4x50_wipe(em4x50_data_t *etd);
void em4x50_sim(em4x50_data_t *etd);
void em4x50_test(em4x50_data_t *etd);
#endif /* EM4X50_H */

1
armsrc/lfadc.h
View file

@ -31,6 +31,7 @@ void lf_wait_periods(size_t periods);
void lf_init(bool reader, bool simulate);
void lf_finalize(void);
size_t lf_detect_field_drop(size_t max);
bool lf_manchester_send_bytes(const uint8_t *frame, size_t frame_len);
void lf_modulation(bool modulation);

2
client/src/cmdlfem4x.c
View file

@ -1398,6 +1398,8 @@ static command_t CommandTable[] = {
{"4x50_write_password", CmdEM4x50WritePassword, IfPm3EM4x50, "change passwword of EM4x50 tag"},
{"4x50_read", CmdEM4x50Read, IfPm3EM4x50, "read word data from EM4x50"},
{"4x50_wipe", CmdEM4x50Wipe, IfPm3EM4x50, "wipe data from EM4x50"},
{"4x50_sim", CmdEM4x50Sim, IfPm3EM4x50, "simulate EM4x50 tag"},
{"4x50_test", CmdEM4x50Test, IfPm3EM4x50, "test functionality for EM4x50"},
{NULL, NULL, NULL, NULL}
};

169
client/src/cmdlfem4x50.c
View file

@ -93,7 +93,32 @@ static int usage_lf_em4x50_wipe(void) {
PrintAndLogEx(NORMAL, " h - this help");
PrintAndLogEx(NORMAL, " p <pwd> - password (hex)");
PrintAndLogEx(NORMAL, "Examples:");
PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_wwipe p 11223344"));
PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_wipe p 11223344"));
PrintAndLogEx(NORMAL, "");
return PM3_SUCCESS;
}
static int usage_lf_em4x50_sim(void) {
PrintAndLogEx(NORMAL, "Simulate EM4x50 tag. ");
PrintAndLogEx(NORMAL, "");
PrintAndLogEx(NORMAL, "Usage: lf em 4x50_sim [h] w <word>");
PrintAndLogEx(NORMAL, "Options:");
PrintAndLogEx(NORMAL, " h - this help");
PrintAndLogEx(NORMAL, " w <word> - word (hex)");
PrintAndLogEx(NORMAL, "Examples:");
PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_sim w 12345678"));
PrintAndLogEx(NORMAL, "");
return PM3_SUCCESS;
}
static int usage_lf_em4x50_test(void) {
PrintAndLogEx(NORMAL, "Test functionality for EM4x50 tag. ");
PrintAndLogEx(NORMAL, "");
PrintAndLogEx(NORMAL, "Usage: lf em 4x50_test [h] ...");
PrintAndLogEx(NORMAL, "Options:");
PrintAndLogEx(NORMAL, " h - this help");
PrintAndLogEx(NORMAL, " c <0|1> - carrier on|off (optional)");
PrintAndLogEx(NORMAL, " b <byte> - byte (hex) (optional)");
PrintAndLogEx(NORMAL, "Examples:");
PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_test ..."));
PrintAndLogEx(NORMAL, "");
return PM3_SUCCESS;
}
@ -539,10 +564,10 @@ int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose) {
uint8_t *data = resp.data.asBytes;
em4x50_word_t words[EM4X50_NO_WORDS];
int now = (resp.status & STATUS_NO_WORDS) >> 2;
if (edata.addr_given) {
prepare_result(data, etd->address, etd->address, words);
} else {
int now = (resp.status & STATUS_NO_WORDS) >> 2;
prepare_result(data, 0, now - 1, words);
}
@ -550,7 +575,11 @@ int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose) {
memcpy(out, &words, sizeof(em4x50_word_t) * EM4X50_NO_WORDS);
}
print_result(words, etd->address, etd->address);
if (edata.addr_given)
print_result(words, etd->address, etd->address);
else
print_result(words, 0, now - 1);
return PM3_SUCCESS;
}
@ -598,8 +627,9 @@ int CmdEM4x50Read(const char *Cmd) {
}
}
if (errors || strlen(Cmd) == 0 || etd.addr_given == false)
return usage_lf_em4x50_read();
//if (errors || strlen(Cmd) == 0 || etd.addr_given == false)
if (errors)
return usage_lf_em4x50_read();
return em4x50_read(&etd, NULL, true);
}
@ -740,3 +770,132 @@ int CmdEM4x50Wipe(const char *Cmd) {
return PM3_SUCCESS;
}
int CmdEM4x50Sim(const char *Cmd) {
// fills EM4x50 tag with zeros including password
bool errors = false, bword = false;
uint8_t cmdp = 0;
em4x50_data_t etd;
PacketResponseNG resp;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch (tolower(param_getchar(Cmd, cmdp))) {
case 'h':
return usage_lf_em4x50_sim();
case 'w': {
if (param_gethex(Cmd, cmdp + 1, etd.word, 8)) {
PrintAndLogEx(FAILED, "\n word has to be 8 hex symbols\n");
return PM3_EINVARG;
}
bword = true;
cmdp += 2;
break;
}
case 'f': {
if (param_gethex(Cmd, cmdp + 1, etd.word, 8)) {
PrintAndLogEx(FAILED, "\n word has to be 8 hex symbols\n");
return PM3_EINVARG;
}
bword = true;
cmdp += 2;
break;
}
default:
PrintAndLogEx(WARNING, "\nUnknown parameter '%c'\n", param_getchar(Cmd, cmdp));
errors = true;
break;
}
}
if (errors || !bword)
return usage_lf_em4x50_sim();
clearCommandBuffer();
SendCommandNG(CMD_LF_EM4X50_SIM, (uint8_t *)&etd, sizeof(etd));
if (!WaitForResponse(CMD_ACK, &resp)) {
PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.\n");
return PM3_ETIMEOUT;
}
// print response
bool isOK = resp.status;
if (isOK) {
PrintAndLogEx(SUCCESS,"\nsimulation data " _GREEN_("ok") "\n");
} else {
PrintAndLogEx(FAILED,"\nsimulating data " _RED_("failed") "\n");
return PM3_ESOFT;
}
return PM3_SUCCESS;
}
int CmdEM4x50Test(const char *Cmd) {
// fills EM4x50 tag with zeros including password
bool errors = false;
uint8_t cmdp = 0;
em4x50_data_t etd;
PacketResponseNG resp;
etd.carrier = 2;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch (tolower(param_getchar(Cmd, cmdp))) {
case 'h':
return usage_lf_em4x50_test();
case 'c':
param_getdec(Cmd, cmdp + 1, &etd.carrier);
if (etd.carrier != 0 && etd.carrier != 1) {
PrintAndLogEx(FAILED, "\ncarrier has to be either 0 or 1\n");
return PM3_EINVARG;
}
cmdp += 2;
break;
case 'b':
if (param_gethex(Cmd, cmdp + 1, &etd.byte, 2)) {
PrintAndLogEx(FAILED, "\nbyte has to be 2 hex symbols\n");
return PM3_EINVARG;
}
cmdp += 2;
break;
default:
PrintAndLogEx(WARNING, "\nUnknown parameter '%c'\n", param_getchar(Cmd, cmdp));
errors = true;
break;
}
}
if (errors)
return usage_lf_em4x50_test();
clearCommandBuffer();
SendCommandNG(CMD_LF_EM4X50_TEST, (uint8_t *)&etd, sizeof(etd));
if (!WaitForResponse(CMD_ACK, &resp)) {
PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.\n");
return PM3_ETIMEOUT;
}
// print response
bool isOK = resp.status;
if (isOK) {
PrintAndLogEx(SUCCESS,"\ntest " _GREEN_("ok") "\n");
} else {
PrintAndLogEx(FAILED,"\ntest " _RED_("failed") "\n");
return PM3_ESOFT;
}
return PM3_SUCCESS;
}

2
client/src/cmdlfem4x50.h
View file

@ -24,5 +24,7 @@ int CmdEM4x50WritePassword(const char *Cmd);
int CmdEM4x50Read(const char *Cmd);
int CmdEM4x50Dump(const char *Cmd);
int CmdEM4x50Wipe(const char *Cmd);
int CmdEM4x50Sim(const char *Cmd);
int CmdEM4x50Test(const char *Cmd);
#endif

2
include/em4x50.h
View file

@ -44,6 +44,8 @@ typedef struct {
bool addr_given;
bool pwd_given;
bool newpwd_given;
uint8_t carrier;
uint8_t byte;
uint8_t password[4];
uint8_t new_password[4];
uint8_t addresses[4];

2
include/pm3_cmd.h
View file

@ -493,6 +493,8 @@ typedef struct {
#define CMD_LF_EM4X50_WRITE_PASSWORD 0x0242
#define CMD_LF_EM4X50_READ 0x0243
#define CMD_LF_EM4X50_WIPE 0x0244
#define CMD_LF_EM4X50_SIM 0x0245
#define CMD_LF_EM4X50_TEST 0x0246
// Sampling configuration for LF reader/sniffer
#define CMD_LF_SAMPLING_SET_CONFIG 0x021D
#define CMD_LF_FSK_SIMULATE 0x021E