Merge pull request #1081 from tharexde/update_4x50

Update 4x50

CHANGELOG.md

@@ -3,6 +3,24 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - EM4x50: changed cli parameter from w (word) to d (data) (@tharexde)
+ - EM4x50: new function 4x50 login: authenticate against tag (@tharexde)
+ - EM4x50: new function 4x50 brute: guess password within a given password range (@tharexde)
+ - EM4x50: new function 4x50 chk: try passwords from dictionary (without option -> T55xx default dictionary or -f user dictionary) (@tharexde)
+ - EM4x50: new function 4x50 reader: read data from tag (configured data -> standard read mode), incl. option -@  (@tharexde)
+ - EM4x50: new function 4x50 sim: simulate dump from file or emulator/flash (@tharexde)
+ - EM4x50: new function 4x50 restore: restore dump file (bin, eml, json) onto tag  (@tharexde)
+ - EM4x50: new function 4x50 esave: dump em4x50 content in emulator memory to file (bin + eml + json) (@tharexde)
+ - EM4x50: new function 4x50 eload: upload em4x50 file content (bin, eml, json) to emulator memory  (@tharexde)
+ - EM4x50: added LED signals (@tharexde)
+ - EM4x50: added json format for 4x50 dump (@tharexde)
+ - EM4x50: relocated write requests in function 4x50 wipe from device to client (@tharexde)
+ - EM4x50: renamed 4x50_write_password to 4x50 writepwd (@tharexde)
+ - EM4x50: all hex input parameters now have to be given in lsb format (output is still msb + lsb) (@tharexde)
+ - EM4x50: changed cli parameter from a (address) to b (block) (@tharexde)
+ - EM4x50: switched to cliparser for all functions (@tharexde)
+ - EM4x50: stabilized and accelerated tag detection (@tharexde)
+ - EM4x50: removed global tag structure on device side (@tharexde)
  - Fix `hf 15 sim` - Added basic response to GET_SYSTEM_INFO and READBLOCK requests in order to fix iso15693 tag sim
  - Added `mf mfu sim t 7 n <numreads>` - MFU emulation now supports automatic exit after <num> blocks read. (@cyberpunk-re)
  - Added T55xx Guide to assist in learning how to use the T55xx chip (@mwalker33)

armsrc/Standalone/lf_tharexde.c

@@ -0,0 +1,359 @@
+//-----------------------------------------------------------------------------
+// Tharexde, 2020
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// main code for EM4x50 simulator and collector aka THAREXDE
+//-----------------------------------------------------------------------------
+#include <inttypes.h>
+#include "standalone.h"
+#include "proxmark3_arm.h"
+#include "appmain.h"
+#include "BigBuf.h"
+#include "fpgaloader.h"
+#include "util.h"
+#include "dbprint.h"
+#include "spiffs.h"
+#include "../em4x50.h"
+
+/*
+ * `lf_tharexde` simulates hardcoded words/blocks, reads words of standard read
+ * mode of EM4x50 tags and stores them in internal flash.
+ * It requires RDV4 hardware (for flash and battery).
+ *
+ * On entering stand-alone mode, this module will start reading/record EM4x50 data.
+ * Every found / collected data will be written/appended to the logfile in flash
+ * as a text string.
+ *
+ * LEDs:
+ * - LED A: simulating
+ * - LED B: reading / record
+ * - LED C: writing to flash
+ * - LED D: unmounting/sync'ing flash (normally < 100ms)
+ *
+ * To retrieve log file from flash:
+ *
+ * 1. mem spiffs dump o lf_em4x50collect.log f lf_em4x50collect.log
+ *    Copies log file from flash to your client.
+ *
+ * 2. exit the Proxmark3 client
+ *
+ * 3. more lf_tharexdecollect.log
+ *
+ * This module emits debug strings during normal operation -- so try it out in
+ * the lab connected to PM3 client before taking it into the field.
+ *
+ * To delete the log file from flash:
+ *
+ * 1. mem spiffs remove lf_tharexdecollect.log
+ */
+
+#define STATE_SIM                   0
+#define STATE_READ                  1
+#define STATE_BRUTE                 2
+#define EM4X50_TAG_WORD             45
+#define EM4X50_PWD_SPEED            27
+#define LF_EM4X50SIMULATE_INPUTFILE "lf_em4x50simulate.eml"
+#define LF_EM4X50COLLECT_LOGFILE    "lf_em4x50collect.log"
+#define LF_EM4X50BRUTE_INPUTFILE    "lf_em4x50brute.eml"
+#define LF_EM4X50BRUTE_LOGFILE      "lf_em4x50brute.log"
+
+bool input_exists;
+bool log_exists;
+
+static void LoadDataInstructions(const char *inputfile) {
+    Dbprintf("");
+    Dbprintf("To load datafile into flash and display it:");
+    Dbprintf(_YELLOW_("1.") " edit inputfile %s", inputfile);
+    Dbprintf(_YELLOW_("2.") " start proxmark3 client");
+    Dbprintf(_YELLOW_("3.") " mem spiffs load f %s o %s", inputfile, inputfile);
+    Dbprintf(_YELLOW_("4.") " start standalone mode");
+}
+
+static void DownloadLogInstructions(const char *logfile) {
+    Dbprintf("");
+    Dbprintf("To get the logfile from flash and display it:");
+    Dbprintf(_YELLOW_("1.") " mem spiffs dump o %s f %s", logfile, logfile);
+    Dbprintf(_YELLOW_("2.") " exit proxmark3 client");
+    Dbprintf(_YELLOW_("3.") " cat %s", logfile);
+}
+
+static int get_input_data_from_file(uint32_t *words, char *inputfile) {
+
+    size_t now = 0;
+
+    if (exists_in_spiffs(inputfile)) {
+
+        uint32_t size = size_in_spiffs(inputfile);
+        uint8_t *mem = BigBuf_malloc(size);
+        
+        Dbprintf(_YELLOW_("found input file %s"), inputfile);
+
+        rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
+
+        now = size / 9;
+        for (int i = 0; i < now; i++)
+            for (int j = 0; j < 4; j++)
+                words[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
+
+        Dbprintf(_YELLOW_("read data from input file"));
+    }
+
+    BigBuf_free();
+
+    return (now > 0) ? now : 0;
+}
+
+static void append(const char *filename, uint8_t *entry, size_t entry_len) {
+
+    LED_D_ON();
+    if (log_exists == false) {
+        rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
+        log_exists = true;
+    } else {
+        rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
+    }
+    LED_D_OFF();
+}
+
+void ModInfo(void) {
+    DbpString(_YELLOW_("  LF EM4x50 sim/collector/bruteforce mode") " - a.k.a tharexde");
+}
+
+void RunMod(void) {
+
+    bool state_change = true;//, password_found = false;
+    int pwd_found = false;
+    uint8_t state = STATE_SIM;
+    // declarations for simulating
+    uint32_t words[33] = {0x0};
+    uint32_t pwd = 0x0;
+    uint32_t passwords[2] = {0x0};
+    size_t now = 0;
+    // declarations for reading
+    int no_words = 0;
+    //uint32_t words[EM4X50_TAG_WORD];
+    uint8_t entry[81];
+
+    rdv40_spiffs_lazy_mount();
+
+    StandAloneMode();
+    Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
+
+    for (;;) {
+
+        WDT_HIT();
+        if (data_available()) break;
+
+        // press button - toggle between SIM, READ and BRUTE
+        // hold button - exit
+        int button_pressed = BUTTON_CLICKED(1000);
+        if (button_pressed == BUTTON_SINGLE_CLICK) {
+
+            SpinUp(100);
+            
+            switch (state) {
+
+                case STATE_SIM:
+                    state = STATE_READ;
+                    break;
+                case STATE_READ:
+                    state = STATE_BRUTE;
+                    break;
+                case STATE_BRUTE:
+                    state = STATE_SIM;
+                    break;
+                default:
+                    break;
+            }
+            
+            state_change = true;
+
+        } else if (button_pressed == BUTTON_HOLD) {
+
+            SpinDown(100);
+            break;
+        }
+
+        if (state == STATE_SIM) {
+
+            if (state_change) {
+
+                FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
+                FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
+                FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
+
+                AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
+                AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
+                AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
+
+                LEDsoff();
+                LED_A_ON();
+                Dbprintf("");
+                Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
+
+                now = get_input_data_from_file(words, LF_EM4X50SIMULATE_INPUTFILE);
+                if (now > 0) {
+                    Dbprintf(_YELLOW_("simulating %i blocks"), now);
+                    for (int i = 0; i < now; i++)
+                        Dbprintf("%2i -> %lx", i + 1, words[i]);
+
+                } else {
+                    Dbprintf(_RED_("error in input data"));
+                }
+
+                state_change = false;
+            }
+
+            em4x50_sim_send_listen_window();
+            for (int i = 0; i < now; i++) {
+                em4x50_sim_send_listen_window();
+                em4x50_sim_send_word(words[i]);
+            }
+
+        } else if (state == STATE_READ) {
+
+            if (state_change) {
+
+                LEDsoff();
+                LED_B_ON();
+                Dbprintf("");
+                Dbprintf(_YELLOW_("switched to EM4x50 reading mode"));
+
+                memset(entry, 0, sizeof(entry));
+                memset(words, 0, sizeof(words));
+
+                log_exists = exists_in_spiffs(LF_EM4X50COLLECT_LOGFILE);
+
+                state_change = false;
+            }
+
+            no_words = em4x50_standalone_read(words);
+
+            if (no_words > 0) {
+
+                memset(entry, 0, sizeof(entry));
+
+                sprintf((char *)entry, "found new EM4x50 tag:");
+                Dbprintf("%s", entry);
+                strcat((char *)entry, "\n");
+                append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
+
+                for (int i = 0; i < no_words; i++) {
+
+                    sprintf((char *)entry, "  %2i -> 0x%08"PRIx32"", i + 1, words[i]);
+                    Dbprintf("%s", entry);
+                    strcat((char *)entry, "\n");
+                    append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
+                }
+            }
+
+        } else if (state == STATE_BRUTE) {
+
+            if (state_change) {
+
+                LEDsoff();
+                LED_C_ON();
+                Dbprintf("");
+                Dbprintf(_YELLOW_("switched to EM4x50 brute force mode"));
+
+                log_exists = exists_in_spiffs(LF_EM4X50BRUTE_LOGFILE);
+                now = get_input_data_from_file(passwords, LF_EM4X50BRUTE_INPUTFILE);
+                
+                if (now == 2) {
+                    
+                    // print some information
+                    int no_iter = passwords[1] - passwords[0] + 1;
+                    int dur_s = no_iter / EM4X50_PWD_SPEED;
+                    int dur_h = dur_s / 3600;
+                    int dur_m = (dur_s - dur_h * 3600) / 60;
+                    dur_s -= dur_h * 3600 + dur_m * 60;
+
+                    //iterprint = no_iter/10;
+
+                    Dbprintf(_YELLOW_("trying %i passwords in range [0x%08x, 0x%08x]"),
+                             no_iter, passwords[0], passwords[1]);
+                    Dbprintf(_YELLOW_("estimated duration: %ih%im%is"),
+                             dur_h, dur_m, dur_s);
+                   
+                } else {
+                    Dbprintf(_RED_("error in input data"));
+                    break;
+                }
+
+                state_change = false;
+            }
+
+            pwd_found = em4x50_standalone_brute(passwords[0], passwords[1], &pwd);
+            
+            if (pwd_found == PM3_ETIMEOUT) {
+
+                // timeout -> no EM4x50 tag on reader?
+                Dbprintf(_YELLOW_("timeout - no EM4x50 tag detected"));
+
+            } else if (pwd_found == true) {
+
+                // password found -> write to logfile
+                sprintf((char *)entry, "password found: 0x%08"PRIx32, pwd);
+                Dbprintf(_YELLOW_("%s"), entry);
+                strcat((char *)entry, "\n");
+                append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
+
+                break;
+
+            } else {
+
+                if (pwd == passwords[1] + 1) {
+
+                    // finished without success -> write to logfile
+                    sprintf((char *)entry, "no password found");
+                    Dbprintf(_YELLOW_("%s"), entry);
+                    strcat((char *)entry, "\n");
+                    append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
+
+                    
+                } else {
+                    
+                    // stopped -> write to logfile
+                    sprintf((char *)entry, "stopped search - last password: 0x%08"PRIx32, pwd);
+                    Dbprintf(_YELLOW_("%s"), entry);
+                    strcat((char *)entry, "\n");
+                    append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
+                    
+                    // replace start password by last tested password in
+                    // inputfile (spiffs) so that brute forcing process will
+                    // be continued when envoking brute force mode again
+                    sprintf((char *)entry, "%08"PRIx32"\n%08"PRIx32"\n", pwd, passwords[1]);
+                    rdv40_spiffs_write(LF_EM4X50BRUTE_INPUTFILE,
+                                       entry,
+                                       strlen((char *)entry),
+                                       RDV40_SPIFFS_SAFETY_SAFE);
+
+                }
+
+                break;
+            }
+        }
+    }
+
+    if (state == STATE_READ) {
+        DownloadLogInstructions(LF_EM4X50COLLECT_LOGFILE);
+    } else if (state == STATE_BRUTE) {
+        LoadDataInstructions(LF_EM4X50BRUTE_INPUTFILE);
+        DownloadLogInstructions(LF_EM4X50BRUTE_LOGFILE);
+    } else {
+        LoadDataInstructions(LF_EM4X50SIMULATE_INPUTFILE);
+    }
+
+    LED_D_ON();
+    rdv40_spiffs_lazy_unmount();
+    LED_D_OFF();
+
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    LEDsoff();
+    Dbprintf("");
+    Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
+
+}

armsrc/appmain.c

@@ -1106,16 +1106,54 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x50_write((em4x50_data_t *)packet->data.asBytes);
             break;
         }
-        case CMD_LF_EM4X50_WRITE_PASSWORD: {
+        case CMD_LF_EM4X50_WRITEPWD: {
-            em4x50_write_password((em4x50_data_t *)packet->data.asBytes);
+            em4x50_writepwd((em4x50_data_t *)packet->data.asBytes);
             break;
         }
         case CMD_LF_EM4X50_READ: {
             em4x50_read((em4x50_data_t *)packet->data.asBytes);
             break;
         }
-        case CMD_LF_EM4X50_WIPE: {
+        case CMD_LF_EM4X50_BRUTE: {
-            em4x50_wipe((em4x50_data_t *)packet->data.asBytes);
+            em4x50_brute((em4x50_data_t *)packet->data.asBytes);
+            break;
+        }
+        case CMD_LF_EM4X50_LOGIN: {
+            em4x50_login((uint32_t *)packet->data.asBytes);
+            break;
+        }
+        case CMD_LF_EM4X50_SIM: {
+            //-----------------------------------------------------------------------------
+            // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_LF) here although FPGA is not
+            // involved in dealing with emulator memory. But if it is called later, it might
+            // destroy the Emulator Memory.
+            //-----------------------------------------------------------------------------
+            FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
+            em4x50_sim((uint8_t *)packet->data.asBytes);
+            break;
+        }
+        case CMD_LF_EM4X50_READER: {
+            em4x50_reader();
+            break;
+        }
+        case CMD_LF_EM4X50_ESET: {
+            //-----------------------------------------------------------------------------
+            // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_LF) here although FPGA is not
+            // involved in dealing with emulator memory. But if it is called later, it might
+            // destroy the Emulator Memory.
+            //-----------------------------------------------------------------------------
+            FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
+            emlSet(packet->data.asBytes, packet->oldarg[0], packet->oldarg[1]);
+            break;
+        }
+        case CMD_LF_EM4X50_CHK: {
+            //-----------------------------------------------------------------------------
+            // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_LF) here although FPGA is not
+            // involved in dealing with emulator memory. But if it is called later, it might
+            // destroy the Emulator Memory.
+            //-----------------------------------------------------------------------------
+            FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
+            em4x50_chk((uint8_t *)packet->data.asBytes);
             break;
         }
 #endif

armsrc/em4x50.h

@@ -13,14 +13,19 @@
 
 #include "../include/em4x50.h"
 
-typedef struct {
+int em4x50_standalone_read(uint32_t *words);
-    uint8_t sectors[34][7];
+int em4x50_standalone_brute(uint32_t start, uint32_t stop, uint32_t *pwd);
-} em4x50_tag_t;
+bool em4x50_sim_send_listen_window(void);
+bool em4x50_sim_send_word(uint32_t word);
 
 void em4x50_info(em4x50_data_t *etd);
 void em4x50_write(em4x50_data_t *etd);
-void em4x50_write_password(em4x50_data_t *etd);
+void em4x50_writepwd(em4x50_data_t *etd);
 void em4x50_read(em4x50_data_t *etd);
-void em4x50_wipe(em4x50_data_t *etd);
+void em4x50_brute(em4x50_data_t *etd);
+void em4x50_login(uint32_t *password);
+void em4x50_sim(uint8_t *filename);
+void em4x50_reader(void);
+void em4x50_chk(uint8_t *filename);
 
 #endif /* EM4X50_H */

armsrc/lfadc.h

@@ -31,6 +31,7 @@ void lf_wait_periods(size_t periods);
 void lf_init(bool reader, bool simulate);
 void lf_finalize(void);
 size_t lf_detect_field_drop(size_t max);
+
 bool lf_manchester_send_bytes(const uint8_t *frame, size_t frame_len);
 void lf_modulation(bool modulation);
 

client/src/cmdlfem4x50.h

@@ -11,20 +11,27 @@
 #ifndef CMDLFEM4X50_H__
 #define CMDLFEM4X50_H__
 
-#include"common.h"
 #include "em4x50.h"
 
 int CmdLFEM4X50(const char *Cmd);
 
 int read_em4x50_uid(void);
 bool detect_4x50_block(void);
-int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose);
+int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out);
 
 int CmdEM4x50Info(const char *Cmd);
 int CmdEM4x50Write(const char *Cmd);
-int CmdEM4x50WritePassword(const char *Cmd);
+int CmdEM4x50WritePwd(const char *Cmd);
 int CmdEM4x50Read(const char *Cmd);
 int CmdEM4x50Dump(const char *Cmd);
 int CmdEM4x50Wipe(const char *Cmd);
+int CmdEM4x50Brute(const char *Cmd);
+int CmdEM4x50Login(const char *Cmd);
+int CmdEM4x50Restore(const char *Cmd);
+int CmdEM4x50Sim(const char *Cmd);
+int CmdEM4x50Reader(const char *Cmd);
+int CmdEM4x50ELoad(const char *Cmd);
+int CmdEM4x50ESave(const char *Cmd);
+int CmdEM4x50Chk(const char *Cmd);
 
 #endif

client/src/fileutils.c

@@ -521,6 +521,20 @@ int saveFileJSONex(const char *preferredName, JSONFileType ftype, uint8_t *data,
             }
             break;
         }
+        case jsfEM4x50: {
+            JsonSaveStr(root, "FileType", "EM4X50");
+            JsonSaveBufAsHexCompact(root, "$.Card.Protection", data + (1 * 4), 4);
+            JsonSaveBufAsHexCompact(root, "$.Card.Config", data + (2 * 4), 4);
+            JsonSaveBufAsHexCompact(root, "$.Card.Serial", data + (32 * 4), 4);
+            JsonSaveBufAsHexCompact(root, "$.Card.UID", data + (33 * 4), 4);
+
+            for (size_t i = 0; i < (datalen / 4); i++) {
+                char path[PATH_MAX_LENGTH] = {0};
+                sprintf(path, "$.blocks.%zu", i);
+                JsonSaveBufAsHexCompact(root, path, data + (i * 4), 4);
+            }
+            break;
+        }
         case jsfMfPlusKeys: {
             JsonSaveStr(root, "FileType", "mfp");
             JsonSaveBufAsHexCompact(root, "$.Card.UID", &data[0], 7);
@@ -1139,6 +1153,27 @@ int loadFileJSONex(const char *preferredName, void *data, size_t maxdatalen, siz
         *datalen = sptr;
     }
 
+    if (!strcmp(ctype, "EM4X50")) {
+        size_t sptr = 0;
+        for (size_t i = 0; i < (maxdatalen / 4); i++) {
+            if (sptr + 4 > maxdatalen) {
+                retval = PM3_EMALLOC;
+                goto out;
+            }
+
+            char blocks[30] = {0};
+            sprintf(blocks, "$.blocks.%zu", i);
+
+            size_t len = 0;
+            JsonLoadBufAsHex(root, blocks, &udata[sptr], 4, &len);
+            if (!len)
+                break;
+
+            sptr += len;
+        }
+        *datalen = sptr;
+    }
+
 out:
 
     if (callback != NULL) {

client/src/fileutils.h

@@ -66,6 +66,7 @@ typedef enum {
     jsfMfDesfireKeys,
     jsfEM4x05,
     jsfEM4x69,
+    jsfEM4x50,
 } JSONFileType;
 
 typedef enum {

client/src/scripting.c

@@ -1146,8 +1146,7 @@ static int l_em4x50_read(lua_State *L) {
     em4x50_data_t etd;
     memset(&etd, 0x00, sizeof(em4x50_data_t));
     etd.addr_given = true;
-    etd.address = addr & 0xFF;
+    etd.addresses = addr & 0xFF;
-    etd.newpwd_given = false;
 
     // get password
     const char *p_pwd = luaL_checkstring(L, 2);
@@ -1162,31 +1161,29 @@ static int l_em4x50_read(lua_State *L) {
 
         PrintAndLogEx(DEBUG, " Pwd %08X", pwd);
 
-        etd.password[0] = pwd & 0xFF;
+        etd.password1 = pwd;
-        etd.password[1] = (pwd >> 8) & 0xFF;
-        etd.password[2] = (pwd >> 16) & 0xFF;
-        etd.password[3] = (pwd >> 24) & 0xFF;
         etd.pwd_given = true;
     }
 
-    PrintAndLogEx(DEBUG, "Addr %u", etd.address);
+    PrintAndLogEx(DEBUG, "Addr %u", etd.addresses & 0xFF);
     if (etd.pwd_given)
-        PrintAndLogEx(DEBUG, " Pwd %s", sprint_hex(etd.password, sizeof(etd.password)));
+        PrintAndLogEx(DEBUG, " Pwd %08x", etd.password1);
 
     em4x50_word_t words[EM4X50_NO_WORDS];
 
-    int res = em4x50_read(&etd, words, false);
+    int res = em4x50_read(&etd, words);
     if (res != PM3_SUCCESS) {
         return returnToLuaWithError(L, "Failed to read EM4x50 data");
     }
 
     uint32_t word = (
-                        words[etd.address].byte[0] << 24 |
+                        words[etd.addresses & 0xFF].byte[0] << 24 |
-                        words[etd.address].byte[1] << 16 |
+                        words[etd.addresses & 0xFF].byte[1] << 16 |
-                        words[etd.address].byte[2] << 8 |
+                        words[etd.addresses & 0xFF].byte[2] << 8 |
-                        words[etd.address].byte[3]
+                        words[etd.addresses & 0xFF].byte[3]
                     );
     lua_pushinteger(L, word);
+
     return 1;
 }
 

common/commonutil.c

@@ -97,6 +97,22 @@ uint16_t reflect16(uint16_t b) {
     return v;
 }
 
+uint32_t reflect32(uint32_t b) {
+    // https://graphics.stanford.edu/~seander/bithacks.html#BitReverseTable
+    uint32_t v = b; // 32-bit word to reverse bit order
+    // swap odd and even bits
+    v = ((v >> 1) & 0x55555555) | ((v & 0x55555555) << 1);
+    // swap consecutive pairs
+    v = ((v >> 2) & 0x33333333) | ((v & 0x33333333) << 2);
+    // swap nibbles ...
+    v = ((v >> 4) & 0x0F0F0F0F) | ((v & 0x0F0F0F0F) << 4);
+    // swap bytes
+    v = ((v >> 8) & 0x00FF00FF) | ((v & 0x00FF00FF) << 8);
+    // swap 2-byte long pairs
+    v = ( v >> 16             ) | ( v               << 16);
+    return v;
+}
+
 void num_to_bytes(uint64_t n, size_t len, uint8_t *dest) {
     while (len--) {
         dest[len] = (uint8_t) n;

common/commonutil.h

@@ -47,6 +47,7 @@ void FormatVersionInformation(char *dst, int len, const char *prefix, void *vers
 uint32_t reflect(uint32_t v, int b); // used in crc.c ...
 uint8_t reflect8(uint8_t b);         // dedicated 8bit reversal
 uint16_t reflect16(uint16_t b);      // dedicated 16bit reversal
+uint32_t reflect32(uint32_t b);      // dedicated 32bit reversal
 
 void num_to_bytes(uint64_t n, size_t len, uint8_t *dest);
 uint64_t bytes_to_num(uint8_t *src, size_t len);

include/em4x50.h

@@ -34,32 +34,20 @@
 #define LAST_WORD_WRITE_INHIBITED   3       // fourth byte
 
 // misc
-#define STATUS_NO_WORDS             0xfc
-#define STATUS_SUCCESS              0x2
-#define STATUS_LOGIN                0x1
-#define NO_CHARS_MAX                400
 #define TIMEOUT                     2000
+#define DUMP_FILESIZE               136
 
 typedef struct {
     bool addr_given;
     bool pwd_given;
-    bool newpwd_given;
+    uint32_t password1;
-    uint8_t password[4];
+    uint32_t password2;
-    uint8_t new_password[4];
+    uint32_t word;
-    uint8_t addresses[4];
+    uint32_t addresses;
-    uint8_t address;
-    uint8_t word[4];
 } PACKED em4x50_data_t;
 
 typedef struct {
     uint8_t byte[4];
-    uint8_t row_parity[4];
-    uint8_t col_parity;
-    uint8_t stopbit;
-    bool rparity[4];
-    bool cparity[8];
-    bool stopparity;
-    bool parity;
 } PACKED em4x50_word_t;
 
 #endif /* EM4X50_H__ */

include/pm3_cmd.h

@@ -507,9 +507,14 @@ typedef struct {
 #define CMD_LF_EM410X_WATCH                                               0x021C
 #define CMD_LF_EM4X50_INFO                                                0x0240
 #define CMD_LF_EM4X50_WRITE                                               0x0241
-#define CMD_LF_EM4X50_WRITE_PASSWORD                                      0x0242
+#define CMD_LF_EM4X50_WRITEPWD                                            0x0242
 #define CMD_LF_EM4X50_READ                                                0x0243
-#define CMD_LF_EM4X50_WIPE                                                0x0244
+#define CMD_LF_EM4X50_BRUTE                                               0x0245
+#define CMD_LF_EM4X50_LOGIN                                               0x0246
+#define CMD_LF_EM4X50_SIM                                                 0x0250
+#define CMD_LF_EM4X50_READER                                              0x0251
+#define CMD_LF_EM4X50_ESET                                                0x0252
+#define CMD_LF_EM4X50_CHK                                                 0x0253
 // Sampling configuration for LF reader/sniffer
 #define CMD_LF_SAMPLING_SET_CONFIG                                        0x021D
 #define CMD_LF_FSK_SIMULATE                                               0x021E