diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal index eef4ecf6f..ff01e7c67 100644 --- a/armsrc/Standalone/Makefile.hal +++ b/armsrc/Standalone/Makefile.hal @@ -35,6 +35,9 @@ define KNOWN_STANDALONE_DEFINITIONS | LF_SAMYRUN | HID26 read/clone/sim | | | - Samy Kamkar | +----------------------------------------------------------+ +| LF_THAREXDE | read and sim em4x50 tags | +| (RDV4 only) | | ++----------------------------------------------------------+ | HF_14ASNIFF | 14a sniff to flashmem | | (RDV4 only) | | +----------------------------------------------------------+ @@ -64,10 +67,10 @@ define KNOWN_STANDALONE_DEFINITIONS +----------------------------------------------------------+ endef -STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN -STANDALONE_MODES += HF_14ASNIFF HF_AVEFUL HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG +STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE +STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG STANDALONE_MODES_REQ_SMARTCARD := -STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS +STANDALONE_MODES_REQ_FLASH := LF_THAREXDE LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),) STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE) ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),) diff --git a/armsrc/Standalone/Makefile.inc b/armsrc/Standalone/Makefile.inc index c5730965b..6fae43f96 100644 --- a/armsrc/Standalone/Makefile.inc +++ b/armsrc/Standalone/Makefile.inc @@ -69,3 +69,7 @@ endif ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS))) SRC_STANDALONE = hf_iceclass.c endif +# WITH_STANDALONE_LF_THAREXDE +ifneq (,$(findstring WITH_STANDALONE_LF_THAREXDE,$(APP_CFLAGS))) + SRC_STANDALONE = lf_tharexde.c +endif diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c new file mode 100644 index 000000000..11e056c8b --- /dev/null +++ b/armsrc/Standalone/lf_tharexde.c @@ -0,0 +1,297 @@ +//----------------------------------------------------------------------------- +// Tharexde, 2020 +// +// This code is licensed to you under the terms of the GNU GPL, version 2 or, +// at your option, any later version. See the LICENSE.txt file for the text of +// the license. +//----------------------------------------------------------------------------- +// main code for EM4x50 simulator and collector aka THAREXDE +//----------------------------------------------------------------------------- +#include +#include "standalone.h" +#include "proxmark3_arm.h" +#include "appmain.h" +#include "BigBuf.h" +#include "fpgaloader.h" +#include "util.h" +#include "dbprint.h" +#include "spiffs.h" +#include "../em4x50.h" + +/* + * `lf_tharexde` simulates hardcoded words/blocks, reads words of standard read + * mode of EM4x50 tags and stores them in internal flash. + * It requires RDV4 hardware (for flash and battery). + * + * On entering stand-alone mode, this module will start reading/record EM4x50 data. + * Every found / collected data will be written/appended to the logfile in flash + * as a text string. + * + * LEDs: + * - LED A: simulating + * - LED B: reading / record + * - LED C: writing to flash + * - LED D: unmounting/sync'ing flash (normally < 100ms) + * + * To retrieve log file from flash: + * + * 1. mem spiffs dump o lf_em4x50collect.log f lf_em4x50collect.log + * Copies log file from flash to your client. + * + * 2. exit the Proxmark3 client + * + * 3. more lf_tharexdecollect.log + * + * This module emits debug strings during normal operation -- so try it out in + * the lab connected to PM3 client before taking it into the field. + * + * To delete the log file from flash: + * + * 1. mem spiffs remove lf_tharexdecollect.log + */ + +#define STATE_SIM 0 +#define STATE_READ 1 +#define LF_EM4X50SIMULATE_INPUTFILE "lf_em4x50simulate.eml" +#define LF_EM4X50COLLECT_LOGFILE "lf_em4x50collect.log" +#define EM4X50_TAG_WORD 45 + +bool input_exists; +bool log_exists; + +static void LoadDataInstructions(void) { + Dbprintf(""); + Dbprintf("[=] To load datafile into flash and display it:"); + Dbprintf("[=] " _YELLOW_("1.") " edit inputfile "LF_EM4X50SIMULATE_INPUTFILE); + Dbprintf("[=] " _YELLOW_("2.") " start proxmark3 client"); + Dbprintf("[=] " _YELLOW_("3.") " mem spiffs load f "LF_EM4X50SIMULATE_INPUTFILE" o "LF_EM4X50SIMULATE_INPUTFILE); + Dbprintf("[=] " _YELLOW_("4.") " start standalone mode"); +} + +static void DownloadLogInstructions(void) { + Dbprintf(""); + Dbprintf("[=] To get the logfile from flash and display it:"); + Dbprintf("[=] " _YELLOW_("1.") " mem spiffs dump o "LF_EM4X50COLLECT_LOGFILE" f "LF_EM4X50COLLECT_LOGFILE); + Dbprintf("[=] " _YELLOW_("2.") " exit proxmark3 client"); + Dbprintf("[=] " _YELLOW_("3.") " cat "LF_EM4X50COLLECT_LOGFILE); +} + +static bool strip_check_parities(uint64_t data, uint32_t *word) { + + uint8_t rparity = 0, cparity = 0; + uint8_t rparity_m = 0, cparity_m = 0, stop_bit_m = 0; + + // strip parities + for (int i = 0; i < 4; i++) { + for (int j = 0; j < 8; j++) { + *word <<= 1; + *word += (data >> (EM4X50_TAG_WORD - 1 - 9 * i - j)) & 1; + } + } + + // calculate row parities + for (int i = 0; i < 4; i++) { + rparity <<= 1; + for (int j = 0; j < 8; j++) { + rparity ^= (*word >> (31 - 8 * i - j)) & 1; + } + } + + // calculate column parities + for (int i = 0; i < 8; i++) { + cparity <<= 1; + for (int j = 0; j < 4; j++) { + cparity ^= (*word >> (31 - 8 * j - i)) & 1; + } + } + + // measured row parities + for (int i = 0; i < 4; i++) { + rparity_m <<= 1; + rparity_m += (data >> (EM4X50_TAG_WORD - 9 * (i + 1))) & 1; + } + + // measured column parities + cparity_m = (data >> 1) & 0xFF; + + // measured stop bit + stop_bit_m = data & 1; + + if ((cparity_m == cparity) && (rparity_m == rparity) && (stop_bit_m == 0)) + return true; + + return false; +} + +static int get_input_data_from_file(uint32_t *words) { + + size_t now = 0; + + if (exists_in_spiffs(LF_EM4X50SIMULATE_INPUTFILE)) { + + uint32_t size = size_in_spiffs((char *)LF_EM4X50SIMULATE_INPUTFILE); + uint8_t *mem = BigBuf_malloc(size); + + Dbprintf(_YELLOW_("[=] found input file %s"), LF_EM4X50SIMULATE_INPUTFILE); + + rdv40_spiffs_read_as_filetype((char *)LF_EM4X50SIMULATE_INPUTFILE, mem, size, RDV40_SPIFFS_SAFETY_SAFE); + + now = size / 9; + for (int i = 0; i < now; i++) + for (int j = 0; j < 4; j++) + words[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8); + + Dbprintf(_YELLOW_("[=] read data from input file")); + } + + BigBuf_free(); + + return (now > 0) ? now : 0; +} + +static void append(uint8_t *entry, size_t entry_len) { + + LED_C_ON(); + if (log_exists == false) { + rdv40_spiffs_write(LF_EM4X50COLLECT_LOGFILE, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE); + log_exists = true; + } else { + rdv40_spiffs_append(LF_EM4X50COLLECT_LOGFILE, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE); + } + LED_C_OFF(); +} + +void ModInfo(void) { + DbpString(_YELLOW_(" LF EM4x50 collector mode") " - a.k.a tharexde"); +} + +void RunMod(void) { + + bool state_change = true; + uint8_t state = STATE_SIM; + // declarations for simulating + uint32_t words[33] = {0x0}; + size_t now = 0; + // declarations for reading + int no_words = 0; + uint64_t data[EM4X50_TAG_WORD]; + uint32_t word = 0; + uint8_t entry[81]; + + rdv40_spiffs_lazy_mount(); + + StandAloneMode(); + Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE started")); + + for (;;) { + + WDT_HIT(); + if (data_available()) break; + + // press button - toggle between SIM and READ + // hold button - exit + int button_pressed = BUTTON_CLICKED(1000); + if (button_pressed == BUTTON_SINGLE_CLICK) { + + SpinUp(100); + state = (state == STATE_SIM) ? STATE_READ : STATE_SIM; + state_change = true; + + } else if (button_pressed == BUTTON_HOLD) { + + SpinDown(100); + break; + } + + if (state == STATE_SIM) { + + if (state_change) { + + FpgaDownloadAndGo(FPGA_BITSTREAM_LF); + FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT); + FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125); + + AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK; + AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; + AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK; + + LED_A_ON(); + LED_B_OFF(); + Dbprintf(_YELLOW_("[=] switched to EM4x50 simulating mode")); + + now = get_input_data_from_file(words); + if (now > 0) { + Dbprintf(_YELLOW_("[=] simulating %i blocks"), now); + for (int i = 0; i < now; i++) + Dbprintf(_YELLOW_("[=] %2i -> %lx"), i + 1, words[i]); + + } else { + Dbprintf(_RED_("[!] error in input data")); + } + + state_change = false; + } + + em4x50_sim_send_listen_window2(); + for (int i = 0; i < now; i++) { + em4x50_sim_send_listen_window2(); + em4x50_sim_send_word3(words[i]); + } + + } else if (state == STATE_READ) { + + if (state_change) { + + LED_B_ON(); + LED_A_OFF(); + Dbprintf(_YELLOW_("[=] switched to EM4x50 reading mode")); + + memset(entry, 0, sizeof(entry)); + memset(data, 0, sizeof(data)); + + log_exists = exists_in_spiffs(LF_EM4X50COLLECT_LOGFILE); + + state_change = false; + } + + no_words = em4x50_standalone_read(data); + + if (no_words > 0) { + + memset(entry, 0, sizeof(entry)); + + sprintf((char *)entry, "found new EM4x50 tag:"); + Dbprintf("%s", entry); + strcat((char *)entry, "\n"); + append(entry, strlen((char *)entry)); + + for (int i = 0; i < no_words; i++) { + + if (strip_check_parities(data[i], &word)) + sprintf((char *)entry, " %2i -> 0x%08"PRIx32" (parity check ok)", i + 1, word); + else + sprintf((char *)entry, " %2i -> 0x%08"PRIx32" (parity check failed)", i + 1, word); + + Dbprintf("%s", entry); + strcat((char *)entry, "\n"); + append(entry, strlen((char *)entry)); + } + } + + } + } + + if (state == STATE_READ) + DownloadLogInstructions(); + else + LoadDataInstructions(); + + LED_D_ON(); + rdv40_spiffs_lazy_unmount(); + LED_D_OFF(); + + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + LEDsoff(); + Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped")); + +} diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 6a315999c..8378a281e 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -1037,6 +1037,14 @@ static void PacketReceived(PacketCommandNG *packet) { em4x50_wipe((em4x50_data_t *)packet->data.asBytes); break; } + case CMD_LF_EM4X50_SIM: { + em4x50_sim((em4x50_data_t *)packet->data.asBytes); + break; + } + case CMD_LF_EM4X50_TEST: { + em4x50_test((em4x50_data_t *)packet->data.asBytes); + break; + } #endif #ifdef WITH_ISO15693 diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c index 3f0ad9b6b..bb1eb5f10 100644 --- a/armsrc/em4x50.c +++ b/armsrc/em4x50.c @@ -8,10 +8,12 @@ // Low frequency EM4x50 commands //----------------------------------------------------------------------------- +#include "BigBuf.h" #include "fpgaloader.h" #include "ticks.h" #include "dbprint.h" #include "lfadc.h" +#include "lfsampling.h" #include "commonutil.h" #include "em4x50.h" @@ -72,18 +74,21 @@ static em4x50_tag_t tag = { #define EM4X50_T_TAG_HALF_PERIOD 32 #define EM4X50_T_TAG_THREE_QUARTER_PERIOD 48 #define EM4X50_T_TAG_FULL_PERIOD 64 +#define EM4X50_T_TAG_THREE_HALF_PERIOD 96 #define EM4X50_T_TAG_TPP 64 #define EM4X50_T_TAG_TWA 64 -#define EM4X50_T_WAITING_FOR_SNGLLIW 50 +#define EM4X50_T_WAITING_FOR_SNGLLIW 100 #define EM4X50_T_WAITING_FOR_DBLLIW 1550 #define EM4X50_TAG_TOLERANCE 8 #define EM4X50_TAG_WORD 45 +#define EM4X50_SAMPLE_CNT_MAX 3000 #define EM4X50_BIT_0 0 #define EM4X50_BIT_1 1 #define EM4X50_BIT_OTHER 2 +#define EM4X50_COMMAND_REQUEST 2 #define EM4X50_COMMAND_LOGIN 0x01 #define EM4X50_COMMAND_RESET 0x80 #define EM4X50_COMMAND_WRITE 0x12 @@ -172,7 +177,7 @@ static void wait_timer(int timer, uint32_t period) { AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; while (AT91C_BASE_TC0->TC_CV < period); - + } else { AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; @@ -241,6 +246,7 @@ static bool get_signalproperties(void) { bool signal_found = false; int no_periods = 32, pct = 75, noise = 140; + uint8_t sample = 0; uint8_t sample_ref = 127; uint8_t sample_max_mean = 0; uint8_t sample_max[no_periods]; @@ -250,6 +256,8 @@ static bool get_signalproperties(void) { // wait until signal/noise > 1 (max. 32 periods) for (int i = 0; i < T0 * no_periods; i++) { + if (BUTTON_PRESS()) return false; + // about 2 samples per bit period wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); @@ -269,8 +277,9 @@ static bool get_signalproperties(void) { AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; while (AT91C_BASE_TC0->TC_CV < T0 * 3 * EM4X50_T_TAG_FULL_PERIOD) { - volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR; + if (BUTTON_PRESS()) return false; + sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR; if (sample > sample_max[i]) sample_max[i] = sample; @@ -318,21 +327,28 @@ static uint32_t get_pulse_length(void) { int32_t timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD); // iterates pulse length (low -> high -> low) + // to avoid endless loops - quit after EM4X50_SAMPLE_CNT_MAX samples + + int sample_cnt = 0; + uint8_t sample = 0; volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR; while (sample > gLow && (timeout--)) { sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR; + if (++sample_cnt > EM4X50_SAMPLE_CNT_MAX) + return 0; } if (timeout == 0) return 0; AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; - timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD); while (sample < gHigh && (timeout--)) { sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR; + if (++sample_cnt > EM4X50_SAMPLE_CNT_MAX) + return 0; } if (timeout == 0) @@ -341,11 +357,10 @@ static uint32_t get_pulse_length(void) { timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD); while (sample > gLow && (timeout--)) { sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR; + if (++sample_cnt > EM4X50_SAMPLE_CNT_MAX) + return 0; } - if (timeout == 0) - return 0; - return (uint32_t)AT91C_BASE_TC1->TC_CV; } @@ -355,8 +370,8 @@ static bool check_pulse_length(uint32_t pl, int length) { return ((pl >= T0 * (length - EM4X50_TAG_TOLERANCE)) & (pl <= T0 * (length + EM4X50_TAG_TOLERANCE))); } -static void em4x50_send_bit(int bit) { - +static void em4x50_reader_send_bit(int bit) { + // send single bit according to EM4x50 application note and datasheet // reset clock for the next bit @@ -385,45 +400,200 @@ static void em4x50_send_bit(int bit) { while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD); } } +/* +static void em4x50_sim_send_bit(int bit) { + + // send single bit according to EM4x50 application note and datasheet + + // reset clock for the next bit + AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; -static void em4x50_send_byte(uint8_t byte) { + if (bit == 0) { + + // disable modulation (activates the field) for first half of bit period + LOW(GPIO_SSC_DOUT); + while (AT91C_BASE_TC1->TC_CV < T0 * EM4X50_T_TAG_HALF_PERIOD); + + // enable modulation for second half of bit period + HIGH(GPIO_SSC_DOUT); + while (AT91C_BASE_TC1->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD); + + } else { + + // enable modulation (drop the field) for first half of bit period + HIGH(GPIO_SSC_DOUT); + while (AT91C_BASE_TC1->TC_CV < T0 * EM4X50_T_TAG_HALF_PERIOD); + + // disable modulation for second half of bit period + LOW(GPIO_SSC_DOUT); + while (AT91C_BASE_TC1->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD); + } +} +*/ +static void em4x50_reader_send_byte(uint8_t byte) { + + // send byte (without parity) + + for (int i = 0; i < 8; i++) + em4x50_reader_send_bit((byte >> (7-i)) & 1); + +} +/* +static void em4x50_sim_send_byte(uint8_t byte) { // send byte (without parity) for (int i = 0; i < 8; i++) - em4x50_send_bit((byte >> (7 - i)) & 1); + em4x50_sim_send_bit((byte >> (7-i)) & 1); } +*/ +static void em4x50_reader_send_byte_with_parity(uint8_t byte) { -static void em4x50_send_byte_with_parity(uint8_t byte) { + // send byte followed by its (equal) parity bit + + int parity = 0, bit = 0; + + for (int i = 0; i < 8; i++) { + bit = (byte >> (7-i)) & 1; + em4x50_reader_send_bit(bit); + parity ^= bit; + } + + em4x50_reader_send_bit(parity); +} +/* +static void em4x50_sim_send_byte_with_parity(uint8_t byte) { // send byte followed by its (equal) parity bit int parity = 0, bit = 0; for (int i = 0; i < 8; i++) { - bit = (byte >> (7 - i)) & 1; - em4x50_send_bit(bit); + bit = (byte >> (7-i)) & 1; + em4x50_sim_send_bit(bit); parity ^= bit; } - em4x50_send_bit(parity); + em4x50_sim_send_bit(parity); } +*/ +static void em4x50_reader_send_word(const uint8_t bytes[4]) { + + // send 32 bit word with parity bits according to EM4x50 datasheet + + for (int i = 0; i < 4; i++) + em4x50_reader_send_byte_with_parity(bytes[i]); + + // send column parities + em4x50_reader_send_byte(bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3]); -static void em4x50_send_word(const uint8_t bytes[4]) { + // send final stop bit (always "0") + em4x50_reader_send_bit(0); +} +/* +static void em4x50_sim_send_word(const uint8_t bytes[4]) { + // send 32 bit word with parity bits according to EM4x50 datasheet for (int i = 0; i < 4; i++) - em4x50_send_byte_with_parity(bytes[i]); - + em4x50_sim_send_byte_with_parity(bytes[i]); + // send column parities - em4x50_send_byte(bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3]); + em4x50_sim_send_byte(bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3]); // send final stop bit (always "0") - em4x50_send_bit(0); + em4x50_sim_send_bit(0); } +static void em4x50_sim_send_ack(void) { + + // send "acknowledge" according to EM4x50 application note and datasheet + + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + HIGH(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_THREE_HALF_PERIOD); + HIGH(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_THREE_HALF_PERIOD); + HIGH(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + +} + +static void em4x50_sim_send_nak(void) { + + // send "not" acknowledge" according to EM4x50 application note and datasheet + + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + HIGH(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_THREE_HALF_PERIOD); + HIGH(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_FULL_PERIOD); + HIGH(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + +} + +static void em4x50_sim_handle_command(void) { + + em4x50_sim_send_ack(); + em4x50_sim_send_nak(); + Dbprintf(""); + +} +*/ +/* +static bool em4x50_sim_detect_rm(void) { + + if (get_next_bit() == EM4X50_BIT_0) + if (get_next_bit() == EM4X50_BIT_0) + return true; + + //int periods = 0; + //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG; + //while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD) + // adc_val[periods++] = AT91C_BASE_SSC->SSC_RHR; + + return false; +} +*/ +/* +static void em4x50_sim_send_listen_window(void) { + + // send single listen window according to EM4x50 application note and datasheet + + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + + HIGH(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_HALF_PERIOD); + + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * 2 * EM4X50_T_TAG_FULL_PERIOD); + + HIGH(GPIO_SSC_DOUT); + if (em4x50_sim_detect_rm()) + em4x50_sim_handle_command(); + + LOW(GPIO_SSC_DOUT); + wait_timer(0, T0 * EM4X50_T_TAG_FULL_PERIOD); + +} +*/ + static bool find_single_listen_window(void) { // find single listen window @@ -486,8 +656,8 @@ static bool find_double_listen_window(bool bcommand) { if (get_next_bit() == EM4X50_BIT_OTHER) { // send RM for request mode - em4x50_send_bit(0); - em4x50_send_bit(0); + em4x50_reader_send_bit(0); + em4x50_reader_send_bit(0); return true; } @@ -561,8 +731,8 @@ static bool check_ack(bool bliw) { if (get_next_bit() == EM4X50_BIT_OTHER) { // send RM for request mode - em4x50_send_bit(0); - em4x50_send_bit(0); + em4x50_reader_send_bit(0); + em4x50_reader_send_bit(0); return true; } @@ -611,8 +781,8 @@ static int get_word_from_bitstream(uint8_t bits[EM4X50_TAG_WORD]) { // identify remaining bits based on pulse lengths // between two listen windows only pulse lengths of 1, 1.5 and 2 are possible - while (true) { - + while (BUTTON_PRESS() == false) { + i++; pl = get_pulse_length(); @@ -660,6 +830,8 @@ static int get_word_from_bitstream(uint8_t bits[EM4X50_TAG_WORD]) { } } + + return 0; } //============================================================================== @@ -674,10 +846,10 @@ static bool login(uint8_t password[4]) { if (request_receive_mode()) { // send login command - em4x50_send_byte_with_parity(EM4X50_COMMAND_LOGIN); + em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_LOGIN); // send password - em4x50_send_word(password); + em4x50_reader_send_word(password); // check if ACK is returned if (check_ack(false)) @@ -696,14 +868,14 @@ static bool login(uint8_t password[4]) { //============================================================================== static bool reset(void) { - + // resets EM4x50 tag (used by write function) if (request_receive_mode()) { // send login command - em4x50_send_byte_with_parity(EM4X50_COMMAND_RESET); - + em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_RESET); + if (check_ack(false)) return true; @@ -760,15 +932,14 @@ static bool selective_read(uint8_t addresses[4]) { if (request_receive_mode()) { // send selective read command - em4x50_send_byte_with_parity(EM4X50_COMMAND_SELECTIVE_READ); + em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_SELECTIVE_READ); // send address data - em4x50_send_word(addresses); + em4x50_reader_send_word(addresses); - // look for ACK sequence + // look for ACK sequence -> save and verify via standard read mode + // (compare number of words) if (check_ack(false)) - - // save and verify via standard read mode (compare number of words) if (standard_read(&now)) if (now == (lwr - fwr + 1)) return true; @@ -797,7 +968,7 @@ void em4x50_info(em4x50_data_t *etd) { // set gHigh and gLow if (get_signalproperties() && find_em4x50_tag()) { - + if (etd->pwd_given) { // try to login with given password @@ -835,8 +1006,7 @@ void em4x50_read(em4x50_data_t *etd) { em4x50_setup_read(); // set gHigh and gLow - if (get_signalproperties() && find_em4x50_tag()) { - + if (get_signalproperties()) {//} && find_em4x50_tag()) { if (etd->addr_given) { // selective read mode @@ -853,12 +1023,12 @@ void em4x50_read(em4x50_data_t *etd) { // standard read mode bsuccess = standard_read(&now); - } } status = (now << 2) + (bsuccess << 1) + blogin; + LOW(GPIO_SSC_DOUT); lf_finalize(); reply_ng(CMD_ACK, status, (uint8_t *)tag.sectors, 238); } @@ -874,13 +1044,13 @@ static bool write(uint8_t word[4], uint8_t address) { if (request_receive_mode()) { // send write command - em4x50_send_byte_with_parity(EM4X50_COMMAND_WRITE); + em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_WRITE); // send address data - em4x50_send_byte_with_parity(address); + em4x50_reader_send_byte_with_parity(address); // send data - em4x50_send_word(word); + em4x50_reader_send_word(word); // wait for T0 * EM4X50_T_TAG_TWA (write access time) wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA); @@ -910,10 +1080,10 @@ static bool write_password(uint8_t password[4], uint8_t new_password[4]) { if (request_receive_mode()) { // send write password command - em4x50_send_byte_with_parity(EM4X50_COMMAND_WRITE_PASSWORD); + em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_WRITE_PASSWORD); // send address data - em4x50_send_word(password); + em4x50_reader_send_word(password); // wait for T0 * EM4x50_T_TAG_TPP (processing pause time) wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TPP); @@ -923,7 +1093,7 @@ static bool write_password(uint8_t password[4], uint8_t new_password[4]) { if (check_ack(true)) { // send new password - em4x50_send_word(new_password); + em4x50_reader_send_word(new_password); // wait for T0 * EM4X50_T_TAG_TWA (write access time) wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA); @@ -1080,3 +1250,285 @@ void em4x50_wipe(em4x50_data_t *etd) { lf_finalize(); reply_ng(CMD_ACK, bsuccess, (uint8_t *)tag.sectors, 238); } + +static bool em4x50_sim_send_bit2(uint8_t bit) { + + uint16_t check = 0; + + for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) { + + // wait until SSC_CLK goes HIGH + // used as a simple detection of a reader field? + while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) { + WDT_HIT(); + if (check == 1000) { + if (BUTTON_PRESS()) + return false; + check = 0; + } + ++check; + } + + if (bit) + OPEN_COIL(); + else + SHORT_COIL(); + + check = 0; + + //wait until SSC_CLK goes LOW + while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) { + WDT_HIT(); + if (check == 1000) { + if (BUTTON_PRESS()) + return false; + check = 0; + } + ++check; + } + + if (t == EM4X50_T_TAG_HALF_PERIOD) + bit ^= 1; + + } + + return true; +} + +static bool em4x50_sim_send_byte2(uint8_t byte) { + + // send byte + for (int i = 0; i < 8; i++) + if (!em4x50_sim_send_bit2((byte >> (7 - i)) & 1)) + return false; + + return true; + +} + +static bool em4x50_sim_send_byte_with_parity2(uint8_t byte) { + + uint8_t parity = 0x0; + + // send byte with parity (even) + for (int i = 0; i < 8; i++) + parity ^= (byte >> i) & 1; + + if (!em4x50_sim_send_byte2(byte)) + return false;; + + if (!em4x50_sim_send_bit2(parity)) + return false; + + return true; +} + +bool em4x50_sim_send_word3(uint32_t word) { + + uint8_t cparity = 0x00; + + // 4 bytes each with even row parity bit + for (int i = 0; i < 4; i++) + if (!em4x50_sim_send_byte_with_parity2( (word >> ((3 - i) * 8)) & 0xFF)) + return false; + + // column parity + for (int i = 0; i < 8; i++) { + cparity <<= 1; + for (int j = 0; j < 4; j++) { + cparity ^= (((word >> ((3 - j) * 8)) & 0xFF) >> (7 - i)) & 1; + } + } + if (!em4x50_sim_send_byte2(cparity)) + return false; + + // stop bit + if (!em4x50_sim_send_bit2(0)) + return false; + + return true; +} + +bool em4x50_sim_send_listen_window2(void) { + + //int i = 0; + uint16_t check = 0; + //uint8_t test[100] = {0}; + + for (int t = 0; t < 5 * EM4X50_T_TAG_FULL_PERIOD; t++) { + + // wait until SSC_CLK goes HIGH + while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) { + WDT_HIT(); + if (check == 1000) { + if (BUTTON_PRESS()) + return false; + check = 0; + } + ++check; + } + + if (t >= 4 * EM4X50_T_TAG_FULL_PERIOD) { + SHORT_COIL(); + } else if (t >= 3 * EM4X50_T_TAG_FULL_PERIOD) { + OPEN_COIL(); + } else if (t >= EM4X50_T_TAG_FULL_PERIOD) { + SHORT_COIL(); + } else if (t >= EM4X50_T_TAG_HALF_PERIOD) { + OPEN_COIL(); + } else { + SHORT_COIL(); + } + + check = 0; + + //wait until SSC_CLK goes LOW + while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) { + WDT_HIT(); + if (check == 1000) { + if (BUTTON_PRESS()) + return false; + check = 0; + } + ++check; + } + } + + return true; +} + +/* +static void em4x50_sim_send_word3(uint8_t *word) { + + uint8_t rparity = 0x00, cparity = 0x00; + uint64_t word_with_parities = { 0x00 }; + + // bytes + row parities + for (int i = 0; i < 4; i++) { + for (int j = 0; j < 8; j++) { + word_with_parities += (word[i] >> j) & 1; + word_with_parities <<= 1; + rparity ^= (word[i] >> j) & 1; + } + word_with_parities += rparity & 1; + word_with_parities <<= 1; + } + + // column parities + for (int i = 0; i < 8; i++) { + for (int j = 0; j < 4; j++) { + cparity ^= (word[j] >> i) & 1; + } + word_with_parities += cparity; + word_with_parities <<= 1; + cparity = 0; + } + + // stop bit + word_with_parities += 0; + + // send total word + for (int i = 0; i < EM4X50_TAG_WORD; i++) + em4x50_sim_send_bit2((word_with_parities >> (EM4X50_TAG_WORD-1 - i)) & 1); + +} +*/ + +/* +static void simlf(uint8_t *buf, int period) { + + int i = 0, count = 0; + int clock1 = 32, clock2 = 64; + uint16_t check = 0; + + for (;;) { + + // wait until SSC_CLK goes HIGH + // used as a simple detection of a reader field? + while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) { + WDT_HIT(); + if (check == 1000) { + if (BUTTON_PRESS()) + return; + check = 0; + } + ++check; + } + + if (buf[i]) + OPEN_COIL(); + else + SHORT_COIL(); + + check = 0; + + //wait until SSC_CLK goes LOW + while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) { + WDT_HIT(); + if (check == 1000) { + if (BUTTON_PRESS()) + return; + check = 0; + } + ++check; + } + + if (count == EM4X50_T_TAG_HALF_PERIOD) { + buf[i] ^= 1; + } else if (count == EM4X50_T_TAG_FULL_PERIOD) { + buf[i] ^= 1; + count = 0; + i++; + if (i == period) { + i = 0; + } + } + count++; + } +} +*/ + +void em4x50_sim(em4x50_data_t *etd) { + + bool bsuccess = false; + + lf_finalize(); + reply_ng(CMD_ACK, bsuccess, (uint8_t *)tag.sectors, 238); +} + +void em4x50_test(em4x50_data_t *etd) { + + bool bsuccess = true; + + reply_ng(CMD_ACK, bsuccess, (uint8_t *)tag.sectors, 238); +} + +int em4x50_standalone_read(uint64_t *words) { + + int now = 0; + uint8_t bits[EM4X50_TAG_WORD]; + + em4x50_setup_read(); + + if (get_signalproperties() && find_em4x50_tag()) { + + if (find_double_listen_window(false)) { + + memset(bits, 0, sizeof(bits)); + + while (get_word_from_bitstream(bits) == EM4X50_TAG_WORD) { + + words[now] = 0; + + for (int i = 0; i < EM4X50_TAG_WORD; i++) { + words[now] <<= 1; + words[now] += bits[i] & 1; + } + + now++; + } + } + } + + return now; +} diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h index f9f1375f2..c483bf27f 100644 --- a/armsrc/em4x50.h +++ b/armsrc/em4x50.h @@ -17,10 +17,16 @@ typedef struct { uint8_t sectors[34][7]; } em4x50_tag_t; +int em4x50_standalone_read(uint64_t *words); +bool em4x50_sim_send_listen_window2(void); +bool em4x50_sim_send_word3(uint32_t word); + void em4x50_info(em4x50_data_t *etd); void em4x50_write(em4x50_data_t *etd); void em4x50_write_password(em4x50_data_t *etd); void em4x50_read(em4x50_data_t *etd); void em4x50_wipe(em4x50_data_t *etd); +void em4x50_sim(em4x50_data_t *etd); +void em4x50_test(em4x50_data_t *etd); #endif /* EM4X50_H */ diff --git a/armsrc/lfadc.h b/armsrc/lfadc.h index 1c8a4211f..66c6da534 100644 --- a/armsrc/lfadc.h +++ b/armsrc/lfadc.h @@ -31,6 +31,7 @@ void lf_wait_periods(size_t periods); void lf_init(bool reader, bool simulate); void lf_finalize(void); size_t lf_detect_field_drop(size_t max); + bool lf_manchester_send_bytes(const uint8_t *frame, size_t frame_len); void lf_modulation(bool modulation); diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 3b00686b1..1d0fe2f6c 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1398,6 +1398,8 @@ static command_t CommandTable[] = { {"4x50_write_password", CmdEM4x50WritePassword, IfPm3EM4x50, "change passwword of EM4x50 tag"}, {"4x50_read", CmdEM4x50Read, IfPm3EM4x50, "read word data from EM4x50"}, {"4x50_wipe", CmdEM4x50Wipe, IfPm3EM4x50, "wipe data from EM4x50"}, + {"4x50_sim", CmdEM4x50Sim, IfPm3EM4x50, "simulate EM4x50 tag"}, + {"4x50_test", CmdEM4x50Test, IfPm3EM4x50, "test functionality for EM4x50"}, {NULL, NULL, NULL, NULL} }; diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c index 124ffe8c0..9103725dc 100644 --- a/client/src/cmdlfem4x50.c +++ b/client/src/cmdlfem4x50.c @@ -93,7 +93,32 @@ static int usage_lf_em4x50_wipe(void) { PrintAndLogEx(NORMAL, " h - this help"); PrintAndLogEx(NORMAL, " p - password (hex)"); PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_wwipe p 11223344")); + PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_wipe p 11223344")); + PrintAndLogEx(NORMAL, ""); + return PM3_SUCCESS; +} +static int usage_lf_em4x50_sim(void) { + PrintAndLogEx(NORMAL, "Simulate EM4x50 tag. "); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf em 4x50_sim [h] w "); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h - this help"); + PrintAndLogEx(NORMAL, " w - word (hex)"); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_sim w 12345678")); + PrintAndLogEx(NORMAL, ""); + return PM3_SUCCESS; +} +static int usage_lf_em4x50_test(void) { + PrintAndLogEx(NORMAL, "Test functionality for EM4x50 tag. "); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf em 4x50_test [h] ..."); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h - this help"); + PrintAndLogEx(NORMAL, " c <0|1> - carrier on|off (optional)"); + PrintAndLogEx(NORMAL, " b - byte (hex) (optional)"); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_test ...")); PrintAndLogEx(NORMAL, ""); return PM3_SUCCESS; } @@ -539,10 +564,10 @@ int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose) { uint8_t *data = resp.data.asBytes; em4x50_word_t words[EM4X50_NO_WORDS]; + int now = (resp.status & STATUS_NO_WORDS) >> 2; if (edata.addr_given) { prepare_result(data, etd->address, etd->address, words); } else { - int now = (resp.status & STATUS_NO_WORDS) >> 2; prepare_result(data, 0, now - 1, words); } @@ -550,7 +575,11 @@ int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose) { memcpy(out, &words, sizeof(em4x50_word_t) * EM4X50_NO_WORDS); } - print_result(words, etd->address, etd->address); + if (edata.addr_given) + print_result(words, etd->address, etd->address); + else + print_result(words, 0, now - 1); + return PM3_SUCCESS; } @@ -598,8 +627,9 @@ int CmdEM4x50Read(const char *Cmd) { } } - if (errors || strlen(Cmd) == 0 || etd.addr_given == false) - return usage_lf_em4x50_read(); + //if (errors || strlen(Cmd) == 0 || etd.addr_given == false) + if (errors) + return usage_lf_em4x50_read(); return em4x50_read(&etd, NULL, true); } @@ -740,3 +770,132 @@ int CmdEM4x50Wipe(const char *Cmd) { return PM3_SUCCESS; } + +int CmdEM4x50Sim(const char *Cmd) { + + // fills EM4x50 tag with zeros including password + + bool errors = false, bword = false; + uint8_t cmdp = 0; + em4x50_data_t etd; + PacketResponseNG resp; + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + + switch (tolower(param_getchar(Cmd, cmdp))) { + case 'h': + return usage_lf_em4x50_sim(); + + case 'w': { + if (param_gethex(Cmd, cmdp + 1, etd.word, 8)) { + PrintAndLogEx(FAILED, "\n word has to be 8 hex symbols\n"); + return PM3_EINVARG; + } + bword = true; + cmdp += 2; + break; + } + + case 'f': { + if (param_gethex(Cmd, cmdp + 1, etd.word, 8)) { + PrintAndLogEx(FAILED, "\n word has to be 8 hex symbols\n"); + return PM3_EINVARG; + } + bword = true; + cmdp += 2; + break; + } + + default: + PrintAndLogEx(WARNING, "\nUnknown parameter '%c'\n", param_getchar(Cmd, cmdp)); + errors = true; + break; + } + } + + if (errors || !bword) + return usage_lf_em4x50_sim(); + + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X50_SIM, (uint8_t *)&etd, sizeof(etd)); + + if (!WaitForResponse(CMD_ACK, &resp)) { + PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.\n"); + return PM3_ETIMEOUT; + } + + // print response + bool isOK = resp.status; + if (isOK) { + PrintAndLogEx(SUCCESS,"\nsimulation data " _GREEN_("ok") "\n"); + } else { + PrintAndLogEx(FAILED,"\nsimulating data " _RED_("failed") "\n"); + return PM3_ESOFT; + } + + return PM3_SUCCESS; +} + +int CmdEM4x50Test(const char *Cmd) { + + // fills EM4x50 tag with zeros including password + + bool errors = false; + uint8_t cmdp = 0; + em4x50_data_t etd; + PacketResponseNG resp; + + etd.carrier = 2; + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + + switch (tolower(param_getchar(Cmd, cmdp))) { + case 'h': + return usage_lf_em4x50_test(); + + case 'c': + param_getdec(Cmd, cmdp + 1, &etd.carrier); + if (etd.carrier != 0 && etd.carrier != 1) { + PrintAndLogEx(FAILED, "\ncarrier has to be either 0 or 1\n"); + return PM3_EINVARG; + } + cmdp += 2; + break; + + case 'b': + if (param_gethex(Cmd, cmdp + 1, &etd.byte, 2)) { + PrintAndLogEx(FAILED, "\nbyte has to be 2 hex symbols\n"); + return PM3_EINVARG; + } + cmdp += 2; + break; + + default: + PrintAndLogEx(WARNING, "\nUnknown parameter '%c'\n", param_getchar(Cmd, cmdp)); + errors = true; + break; + } + } + + if (errors) + return usage_lf_em4x50_test(); + + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X50_TEST, (uint8_t *)&etd, sizeof(etd)); + + if (!WaitForResponse(CMD_ACK, &resp)) { + PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.\n"); + return PM3_ETIMEOUT; + } + + // print response + bool isOK = resp.status; + if (isOK) { + PrintAndLogEx(SUCCESS,"\ntest " _GREEN_("ok") "\n"); + } else { + PrintAndLogEx(FAILED,"\ntest " _RED_("failed") "\n"); + return PM3_ESOFT; + } + + return PM3_SUCCESS; +} diff --git a/client/src/cmdlfem4x50.h b/client/src/cmdlfem4x50.h index 01417aa1e..8a66fd7b8 100644 --- a/client/src/cmdlfem4x50.h +++ b/client/src/cmdlfem4x50.h @@ -24,5 +24,7 @@ int CmdEM4x50WritePassword(const char *Cmd); int CmdEM4x50Read(const char *Cmd); int CmdEM4x50Dump(const char *Cmd); int CmdEM4x50Wipe(const char *Cmd); +int CmdEM4x50Sim(const char *Cmd); +int CmdEM4x50Test(const char *Cmd); #endif diff --git a/include/em4x50.h b/include/em4x50.h index b70072c32..ea759ca97 100644 --- a/include/em4x50.h +++ b/include/em4x50.h @@ -44,6 +44,8 @@ typedef struct { bool addr_given; bool pwd_given; bool newpwd_given; + uint8_t carrier; + uint8_t byte; uint8_t password[4]; uint8_t new_password[4]; uint8_t addresses[4]; diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index 6cacc5ef1..fa9150ef3 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -493,6 +493,8 @@ typedef struct { #define CMD_LF_EM4X50_WRITE_PASSWORD 0x0242 #define CMD_LF_EM4X50_READ 0x0243 #define CMD_LF_EM4X50_WIPE 0x0244 +#define CMD_LF_EM4X50_SIM 0x0245 +#define CMD_LF_EM4X50_TEST 0x0246 // Sampling configuration for LF reader/sniffer #define CMD_LF_SAMPLING_SET_CONFIG 0x021D #define CMD_LF_FSK_SIMULATE 0x021E