Merge pull request #1116 from tharexde/4x50_eview

4x50 eview

CHANGELOG.md

@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added  `lf em 4x50 eview` - show uploaded EM4x50 data in emul memory (@tharexde) 
  - Fix `data rawdemod` parsing for psk2 and user defined clock (@cyberpunk-re)
  - Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001)
  - Changed `recoverpk.py` - now tests more ECDSA curves (@doegox)

armsrc/Standalone/lf_tharexde.c

@@ -1,359 +0,0 @@
-//-----------------------------------------------------------------------------
-// Tharexde, 2020
-//
-// This code is licensed to you under the terms of the GNU GPL, version 2 or,
-// at your option, any later version. See the LICENSE.txt file for the text of
-// the license.
-//-----------------------------------------------------------------------------
-// main code for EM4x50 simulator and collector aka THAREXDE
-//-----------------------------------------------------------------------------
-#include <inttypes.h>
-#include "standalone.h"
-#include "proxmark3_arm.h"
-#include "appmain.h"
-#include "BigBuf.h"
-#include "fpgaloader.h"
-#include "util.h"
-#include "dbprint.h"
-#include "spiffs.h"
-#include "../em4x50.h"
-
-/*
- * `lf_tharexde` simulates hardcoded words/blocks, reads words of standard read
- * mode of EM4x50 tags and stores them in internal flash.
- * It requires RDV4 hardware (for flash and battery).
- *
- * On entering stand-alone mode, this module will start reading/record EM4x50 data.
- * Every found / collected data will be written/appended to the logfile in flash
- * as a text string.
- *
- * LEDs:
- * - LED A: simulating
- * - LED B: reading / record
- * - LED C: writing to flash
- * - LED D: unmounting/sync'ing flash (normally < 100ms)
- *
- * To retrieve log file from flash:
- *
- * 1. mem spiffs dump o lf_em4x50collect.log f lf_em4x50collect.log
- *    Copies log file from flash to your client.
- *
- * 2. exit the Proxmark3 client
- *
- * 3. more lf_tharexdecollect.log
- *
- * This module emits debug strings during normal operation -- so try it out in
- * the lab connected to PM3 client before taking it into the field.
- *
- * To delete the log file from flash:
- *
- * 1. mem spiffs remove lf_tharexdecollect.log
- */
-
-#define STATE_SIM                   0
-#define STATE_READ                  1
-#define STATE_BRUTE                 2
-#define EM4X50_TAG_WORD             45
-#define EM4X50_PWD_SPEED            27
-#define LF_EM4X50SIMULATE_INPUTFILE "lf_em4x50simulate.eml"
-#define LF_EM4X50COLLECT_LOGFILE    "lf_em4x50collect.log"
-#define LF_EM4X50BRUTE_INPUTFILE    "lf_em4x50brute.eml"
-#define LF_EM4X50BRUTE_LOGFILE      "lf_em4x50brute.log"
-
-bool input_exists;
-bool log_exists;
-
-static void LoadDataInstructions(const char *inputfile) {
-    Dbprintf("");
-    Dbprintf("To load datafile into flash and display it:");
-    Dbprintf(_YELLOW_("1.") " edit inputfile %s", inputfile);
-    Dbprintf(_YELLOW_("2.") " start proxmark3 client");
-    Dbprintf(_YELLOW_("3.") " mem spiffs load f %s o %s", inputfile, inputfile);
-    Dbprintf(_YELLOW_("4.") " start standalone mode");
-}
-
-static void DownloadLogInstructions(const char *logfile) {
-    Dbprintf("");
-    Dbprintf("To get the logfile from flash and display it:");
-    Dbprintf(_YELLOW_("1.") " mem spiffs dump o %s f %s", logfile, logfile);
-    Dbprintf(_YELLOW_("2.") " exit proxmark3 client");
-    Dbprintf(_YELLOW_("3.") " cat %s", logfile);
-}
-
-static int get_input_data_from_file(uint32_t *words, char *inputfile) {
-
-    size_t now = 0;
-
-    if (exists_in_spiffs(inputfile)) {
-
-        uint32_t size = size_in_spiffs(inputfile);
-        uint8_t *mem = BigBuf_malloc(size);
-
-        Dbprintf(_YELLOW_("found input file %s"), inputfile);
-
-        rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
-
-        now = size / 9;
-        for (int i = 0; i < now; i++)
-            for (int j = 0; j < 4; j++)
-                words[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
-
-        Dbprintf(_YELLOW_("read data from input file"));
-    }
-
-    BigBuf_free();
-
-    return (now > 0) ? now : 0;
-}
-
-static void append(const char *filename, uint8_t *entry, size_t entry_len) {
-
-    LED_D_ON();
-    if (log_exists == false) {
-        rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
-        log_exists = true;
-    } else {
-        rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
-    }
-    LED_D_OFF();
-}
-
-void ModInfo(void) {
-    DbpString(_YELLOW_("  LF EM4x50 sim/collector/bruteforce mode") " - a.k.a tharexde");
-}
-
-void RunMod(void) {
-
-    bool state_change = true;//, password_found = false;
-    int pwd_found = false;
-    uint8_t state = STATE_SIM;
-    // declarations for simulating
-    uint32_t words[33] = {0x0};
-    uint32_t pwd = 0x0;
-    uint32_t passwords[2] = {0x0};
-    size_t now = 0;
-    // declarations for reading
-    int no_words = 0;
-    //uint32_t words[EM4X50_TAG_WORD];
-    uint8_t entry[81];
-
-    rdv40_spiffs_lazy_mount();
-
-    StandAloneMode();
-    Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
-
-    for (;;) {
-
-        WDT_HIT();
-        if (data_available()) break;
-
-        // press button - toggle between SIM, READ and BRUTE
-        // hold button - exit
-        int button_pressed = BUTTON_CLICKED(1000);
-        if (button_pressed == BUTTON_SINGLE_CLICK) {
-
-            SpinUp(100);
-
-            switch (state) {
-
-                case STATE_SIM:
-                    state = STATE_READ;
-                    break;
-                case STATE_READ:
-                    state = STATE_BRUTE;
-                    break;
-                case STATE_BRUTE:
-                    state = STATE_SIM;
-                    break;
-                default:
-                    break;
-            }
-
-            state_change = true;
-
-        } else if (button_pressed == BUTTON_HOLD) {
-
-            SpinDown(100);
-            break;
-        }
-
-        if (state == STATE_SIM) {
-
-            if (state_change) {
-
-                FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-                FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
-                FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
-
-                AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
-                AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
-                AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
-
-                LEDsoff();
-                LED_A_ON();
-                Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
-
-                now = get_input_data_from_file(words, LF_EM4X50SIMULATE_INPUTFILE);
-                if (now > 0) {
-                    Dbprintf(_YELLOW_("simulating %i blocks"), now);
-                    for (int i = 0; i < now; i++)
-                        Dbprintf("%2i -> %lx", i + 1, words[i]);
-
-                } else {
-                    Dbprintf(_RED_("error in input data"));
-                }
-
-                state_change = false;
-            }
-
-            em4x50_sim_send_listen_window();
-            for (int i = 0; i < now; i++) {
-                em4x50_sim_send_listen_window();
-                em4x50_sim_send_word(words[i]);
-            }
-
-        } else if (state == STATE_READ) {
-
-            if (state_change) {
-
-                LEDsoff();
-                LED_B_ON();
-                Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 reading mode"));
-
-                memset(entry, 0, sizeof(entry));
-                memset(words, 0, sizeof(words));
-
-                log_exists = exists_in_spiffs(LF_EM4X50COLLECT_LOGFILE);
-
-                state_change = false;
-            }
-
-            no_words = em4x50_standalone_read(words);
-
-            if (no_words > 0) {
-
-                memset(entry, 0, sizeof(entry));
-
-                sprintf((char *)entry, "found new EM4x50 tag:");
-                Dbprintf("%s", entry);
-                strcat((char *)entry, "\n");
-                append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
-
-                for (int i = 0; i < no_words; i++) {
-
-                    sprintf((char *)entry, "  %2i -> 0x%08"PRIx32"", i + 1, words[i]);
-                    Dbprintf("%s", entry);
-                    strcat((char *)entry, "\n");
-                    append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
-                }
-            }
-
-        } else if (state == STATE_BRUTE) {
-
-            if (state_change) {
-
-                LEDsoff();
-                LED_C_ON();
-                Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 brute force mode"));
-
-                log_exists = exists_in_spiffs(LF_EM4X50BRUTE_LOGFILE);
-                now = get_input_data_from_file(passwords, LF_EM4X50BRUTE_INPUTFILE);
-
-                if (now == 2) {
-
-                    // print some information
-                    int no_iter = passwords[1] - passwords[0] + 1;
-                    int dur_s = no_iter / EM4X50_PWD_SPEED;
-                    int dur_h = dur_s / 3600;
-                    int dur_m = (dur_s - dur_h * 3600) / 60;
-                    dur_s -= dur_h * 3600 + dur_m * 60;
-
-                    //iterprint = no_iter/10;
-
-                    Dbprintf(_YELLOW_("trying %i passwords in range [0x%08x, 0x%08x]"),
-                             no_iter, passwords[0], passwords[1]);
-                    Dbprintf(_YELLOW_("estimated duration: %ih%im%is"),
-                             dur_h, dur_m, dur_s);
-
-                } else {
-                    Dbprintf(_RED_("error in input data"));
-                    break;
-                }
-
-                state_change = false;
-            }
-
-            pwd_found = em4x50_standalone_brute(passwords[0], passwords[1], &pwd);
-
-            if (pwd_found == PM3_ETIMEOUT) {
-
-                // timeout -> no EM4x50 tag on reader?
-                Dbprintf(_YELLOW_("timeout - no EM4x50 tag detected"));
-
-            } else if (pwd_found == true) {
-
-                // password found -> write to logfile
-                sprintf((char *)entry, "password found: 0x%08"PRIx32, pwd);
-                Dbprintf(_YELLOW_("%s"), entry);
-                strcat((char *)entry, "\n");
-                append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
-
-                break;
-
-            } else {
-
-                if (pwd == passwords[1] + 1) {
-
-                    // finished without success -> write to logfile
-                    sprintf((char *)entry, "no password found");
-                    Dbprintf(_YELLOW_("%s"), entry);
-                    strcat((char *)entry, "\n");
-                    append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
-
-
-                } else {
-
-                    // stopped -> write to logfile
-                    sprintf((char *)entry, "stopped search - last password: 0x%08"PRIx32, pwd);
-                    Dbprintf(_YELLOW_("%s"), entry);
-                    strcat((char *)entry, "\n");
-                    append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
-
-                    // replace start password by last tested password in
-                    // inputfile (spiffs) so that brute forcing process will
-                    // be continued when envoking brute force mode again
-                    sprintf((char *)entry, "%08"PRIx32"\n%08"PRIx32"\n", pwd, passwords[1]);
-                    rdv40_spiffs_write(LF_EM4X50BRUTE_INPUTFILE,
-                                       entry,
-                                       strlen((char *)entry),
-                                       RDV40_SPIFFS_SAFETY_SAFE);
-
-                }
-
-                break;
-            }
-        }
-    }
-
-    if (state == STATE_READ) {
-        DownloadLogInstructions(LF_EM4X50COLLECT_LOGFILE);
-    } else if (state == STATE_BRUTE) {
-        LoadDataInstructions(LF_EM4X50BRUTE_INPUTFILE);
-        DownloadLogInstructions(LF_EM4X50BRUTE_LOGFILE);
-    } else {
-        LoadDataInstructions(LF_EM4X50SIMULATE_INPUTFILE);
-    }
-
-    LED_D_ON();
-    rdv40_spiffs_lazy_unmount();
-    LED_D_OFF();
-
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    LEDsoff();
-    Dbprintf("");
-    Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
-
-}

armsrc/em4x50.c

@@ -45,6 +45,7 @@
 
 #define EM4X50_TAG_TOLERANCE                8
 #define EM4X50_TAG_WORD                     45
+#define EM4X50_TAG_MAX_NO_BYTES             136
 
 #define EM4X50_COMMAND_LOGIN                0x01
 #define EM4X50_COMMAND_RESET                0x80
@@ -690,7 +691,7 @@ static bool em4x50_sim_send_byte_with_parity(uint8_t byte) {
     return true;
 }
 
-bool em4x50_sim_send_word(uint32_t word) {
+static bool em4x50_sim_send_word(uint32_t word) {
 
     uint8_t cparity = 0x00;
 
@@ -721,7 +722,7 @@ bool em4x50_sim_send_word(uint32_t word) {
     return true;
 }
 
-bool em4x50_sim_send_listen_window(void) {
+static bool em4x50_sim_send_listen_window(void) {
 
     uint16_t check = 0;
 
@@ -1015,8 +1016,7 @@ void em4x50_read(em4x50_data_t *etd) {
     LOW(GPIO_SSC_DOUT);
     lf_finalize();
 
-    // iceman:  this hardcoded 136 value....
+    reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
-    reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, 136);
 }
 
 // collects as much information as possible via selective read mode
@@ -1041,8 +1041,7 @@ void em4x50_info(em4x50_data_t *etd) {
 
     lf_finalize();
 
-    // iceman:  this hardcoded 136 value....
+    reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
-    reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, 136);
 }
 
 // reads data that tag transmits "voluntarily" -> standard read mode
@@ -1193,7 +1192,7 @@ void em4x50_write(em4x50_data_t *etd) {
     }
 
     lf_finalize();
-    reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, 136);
+    reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
 
 // simple change of password

armsrc/em4x50.h

@@ -13,11 +13,6 @@
 
 #include "../include/em4x50.h"
 
-int em4x50_standalone_read(uint32_t *words);
-int em4x50_standalone_brute(uint32_t start, uint32_t stop, uint32_t *pwd);
-bool em4x50_sim_send_listen_window(void);
-bool em4x50_sim_send_word(uint32_t word);
-
 void em4x50_info(em4x50_data_t *etd);
 void em4x50_write(em4x50_data_t *etd);
 void em4x50_writepwd(em4x50_data_t *etd);

client/src/cmdlfem4x50.c

@@ -259,6 +259,48 @@ int CmdEM4x50ESave(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+int CmdEM4x50EView(const char *Cmd) {
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf em 4x50 eview",
+                  "Displays em4x50 content of emulator memory.",
+                  "lf em 4x50 eview\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
+    // download emulator memory
+    PrintAndLogEx(SUCCESS, "Reading emulator memory...");
+    uint8_t data[DUMP_FILESIZE] = {0x0};
+    if (GetFromDevice(BIG_BUF_EML, data, DUMP_FILESIZE, 0, NULL, 0, NULL, 2500, false) == false) {
+        PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
+        return PM3_ETIMEOUT;
+    }
+    
+    // valid em4x50 data?
+    uint32_t serial = bytes_to_num(data + 4 * EM4X50_DEVICE_SERIAL, 4);
+    uint32_t device_id = bytes_to_num(data + 4 * EM4X50_DEVICE_ID, 4);
+    if (serial == device_id) {
+        PrintAndLogEx(WARNING, "No valid em4x50 data in emulator memory.");
+        return PM3_ENODATA;
+    }
+
+    em4x50_word_t words[EM4X50_NO_WORDS];
+    for (int i = 0; i < EM4X50_NO_WORDS; i++) {
+        memcpy(words[i].byte, data + i * 4, 4);
+    }
+    print_result(words, 0, EM4X50_NO_WORDS - 1);
+    PrintAndLogEx(NORMAL, "");
+
+    return PM3_SUCCESS;
+}
+
 int CmdEM4x50Login(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 4x50 login",
@@ -1123,8 +1165,9 @@ static command_t CommandTable[] = {
     {"reader", CmdEM4x50Reader,      IfPm3EM4x50,     "show standard read mode data of EM4x50"},
     {"restore", CmdEM4x50Restore,     IfPm3EM4x50,     "restore EM4x50 dump to tag"},
     {"sim",    CmdEM4x50Sim,         IfPm3EM4x50,     "simulate EM4x50 tag"},
-    {"eload",  CmdEM4x50ELoad,       IfPm3EM4x50,     "upload dump of EM4x50 to flash memory"},
+    {"eload",  CmdEM4x50ELoad,       IfPm3EM4x50,     "upload dump of EM4x50 to emulator memory"},
-    {"esave",  CmdEM4x50ESave,       IfPm3EM4x50,     "save flash memory to file"},
+    {"esave",  CmdEM4x50ESave,       IfPm3EM4x50,     "save emulator memory to file"},
+    {"eview",  CmdEM4x50EView,       IfPm3EM4x50,     "view EM4x50 content in emulator memory"},
     {NULL, NULL, NULL, NULL}
 };
 

client/src/cmdlfem4x50.h

@@ -33,5 +33,6 @@ int CmdEM4x50Reader(const char *Cmd);
 int CmdEM4x50ELoad(const char *Cmd);
 int CmdEM4x50ESave(const char *Cmd);
 int CmdEM4x50Chk(const char *Cmd);
+int CmdEM4x50EView(const char *Cmd);
 
 #endif