github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-14 18:48:13 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Relocated write requests in function 4x50_restore from device to client

Browse source
This commit is contained in:
tharexde 2020-12-03 22:00:52 +01:00
commit 6876ff2f04
5 changed files with 26 additions and 98 deletions
Download patch file Download diff file Expand all files Collapse all files

74
armsrc/em4x50.c
View file

@ -1310,80 +1310,6 @@ void em4x50_writepwd(em4x50_data_t *etd) {
reply_ng(CMD_LF_EM4X50_WRITEPWD, status, 0, 0);
}
void em4x50_restore(em4x50_data_t *etd) {
// restore em4x50 dump file to tag
bool bsuccess = false;
int status = PM3_SUCCESS;
int start_word = 3; // first block/address with user data
uint8_t em4x50_mem[DUMP_FILESIZE] = {0x0};
uint32_t addresses = 0x00001F01; // from fwr = 1 to lwr = 31 (0x1F)
uint32_t words_client[EM4X50_NO_WORDS] = {0x0};
uint32_t words_read[EM4X50_NO_WORDS] = {0x0};
//-----------------------------------------------------------------------------
// Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_LF) here although FPGA is not
// involved in dealing with emulator memory. But if it is called later, it will
// destroy the Emulator Memory.
//-----------------------------------------------------------------------------
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
// read data from flash memory
Flash_ReadData(0, em4x50_mem, 4 * EM4X50_NO_WORDS);
for (int i = 0; i < EM4X50_NO_WORDS; i++)
words_client[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
em4x50_setup_read();
// set gHigh and gLow
if (get_signalproperties() && find_em4x50_tag()) {
// login first if password is available
if (etd->pwd_given) {
if ((status = login(etd->password1)) == PM3_SUCCESS) {
// successful login allows words 1 and 2 to be written
start_word = 1;
}
}
if (status == PM3_SUCCESS) {
// write data to each address but ignore addresses
// 0 -> password, 32 -> serial, 33 -> uid
for (int i = start_word; i < EM4X50_NO_WORDS - 2; i++) {
status = write(words_client[i], i);
if (status == PM3_ETEAROFF) {
lf_finalize();
return;
}
}
// to verify result -> reset EM4x50
if (reset() == PM3_SUCCESS) {
// login not necessary because protected word has been set to 0
// -> no read protected words
// -> selective read can be called immediately
if (selective_read(addresses, words_read) == PM3_SUCCESS) {
// check if everything is zero
bsuccess = true;
for (int i = start_word; i < EM4X50_NO_WORDS - 2; i++)
bsuccess &= (reflect32(words_read[i]) == words_client[i]);
}
}
}
}
if (bsuccess)
status = PM3_SUCCESS;
lf_finalize();
reply_ng(CMD_LF_EM4X50_RESTORE, status, 0, 0);
}
//==============================================================================
// simulate functions
//==============================================================================