From ac233a346a70a55832dfbe3365769b66eac6f486 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Tue, 23 Jul 2019 23:43:30 +0200 Subject: [PATCH] make style --- armsrc/appmain.c | 10 +- armsrc/apps.h | 2 +- armsrc/lfops.c | 676 +++++++++++++++++++++++--------------------- client/cmdlft55xx.c | 647 +++++++++++++++++++++--------------------- client/scripting.c | 6 +- include/pm3_cmd.h | 18 +- 6 files changed, 689 insertions(+), 670 deletions(-) diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 80d0f9316..02829c20c 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -880,7 +880,7 @@ static void PacketReceived(PacketCommandNG *packet) { uint8_t downlink_mode; } PACKED; struct p *payload = (struct p *) packet->data.asBytes; - T55xxReadBlock(payload->page, payload->pwdmode, false, payload->blockno, payload->password,payload->downlink_mode); + T55xxReadBlock(payload->page, payload->pwdmode, false, payload->blockno, payload->password, payload->downlink_mode); break; } case CMD_T55XX_WRITE_BLOCK: { @@ -889,15 +889,15 @@ static void PacketReceived(PacketCommandNG *packet) { break; } case CMD_T55XX_WAKEUP: { - T55xxWakeUp(packet->oldarg[0],packet->oldarg[1]); - break; + T55xxWakeUp(packet->oldarg[0], packet->oldarg[1]); + break; } case CMD_T55XX_RESET_READ: { - T55xxResetRead(packet->data.asBytes[0]&0xff); + T55xxResetRead(packet->data.asBytes[0] & 0xff); break; } case CMD_T55XX_CHKPWDS: { - T55xx_ChkPwds(packet->data.asBytes[0]&0xff); + T55xx_ChkPwds(packet->data.asBytes[0] & 0xff); break; } case CMD_PCF7931_READ: { diff --git a/armsrc/apps.h b/armsrc/apps.h index a508b74b0..e3ea8048c 100644 --- a/armsrc/apps.h +++ b/armsrc/apps.h @@ -106,7 +106,7 @@ void T55xxResetRead(uint8_t flags); //id T55xxWriteBlock(uint32_t data, uint8_t blockno, uint32_t pwd, uint8_t flags); void T55xxWriteBlock(uint8_t *data); // void T55xxWriteBlockExt(uint32_t data, uint8_t blockno, uint32_t pwd, uint8_t flags); -void T55xxReadBlock(uint8_t page, bool pwd_mode, bool brute_mem, uint8_t block, uint32_t pwd,uint8_t downlink_mode); +void T55xxReadBlock(uint8_t page, bool pwd_mode, bool brute_mem, uint8_t block, uint32_t pwd, uint8_t downlink_mode); void T55xxWakeUp(uint32_t Pwd, uint8_t flags); void T55xx_ChkPwds(uint8_t flags); diff --git a/armsrc/lfops.c b/armsrc/lfops.c index 17ac49dd2..26a494cf2 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -47,13 +47,13 @@ // 1fc = 8us = 12ticks /* ========================================================================================================== - T55x7 Timing + T55x7 Timing ========================================================================================================== // t55xx_config t_config = { 29 * 8, 17 * 8, 15 * 8, 47 * 8, 15 * 8 } ; - ATA5577 Downlink Protocol Timings. - Note: All absolute times assume TC = 1 / fC = 8 μs (fC = 125 kHz) + ATA5577 Downlink Protocol Timings. + Note: All absolute times assume TC = 1 / fC = 8 μs (fC = 125 kHz) ----------------------------------------------------------------------- Fixed-bit-length Protocol | Normal Downlink | Fast Downlink | ------------------------------+-----------------------------------+-----------------------------------+------ @@ -67,7 +67,7 @@ ------------------------------------------------------------------------------------------------------------- ----------------------------------------------------------------------- - Long Leading Reference | Normal Downlink | Fast Downlink | + Long Leading Reference | Normal Downlink | Fast Downlink | ------------------------------+-----------------------------------+-----------------------------------+------ | Parameter | Remark | Symbol | Min. | Typ. | Max. | Min. | Typ. | Max. | Unit | |-----------+--------+---------+-----------+-----------+-----------+-----------+-----------+-----------+------| @@ -76,7 +76,7 @@ |-----------+--------+---------+-----------+-----------+-----------+-----------+-----------+-----------+------| | Write | Ref | | 152 | 160 | 168 | 140 | 144 | 148 | Tc | | data | Pulse | dref | 136 clocks + 0 data bit | 132 clocks + 0 data bit | Tc | -| coding |--------+---------+-----------------------------------+-----------------------------------+------| +| coding |--------+---------+-----------------------------------+-----------------------------------+------| | | 0 data | d0 |dref – 143 |dref – 136 |dref – 128 |dref – 135 |dref – 132 |dref – 124 | Tc | | | 1 data | d1 |dref – 111 |dref – 104 |dref – 96 |dref – 119 |dref – 116 |dref – 112 | Tc | ------------------------------------------------------------------------------------------------------------- @@ -113,16 +113,22 @@ /* // Note: Moved * 8 to apply when used. Saving 28 bytes here (- the *8) and 28 bytes flash. // StartGap WriteGap Bit 0/00 Bit 1/01 Bit 10 Bit 11 ReadGap -t55xx_config T55xx_Timing = {{{ 29 , 17 , 15 , 50 , 0 , 0 , 15 }, // Default Fixed - { 31 , 20 , 18 , 50 , 0 , 0 , 15 }, // Long Leading Ref. - { 31 , 20 , 18 , 40 , 0 , 0 , 15 }, // Leading 0 - { 29 , 17 , 15 , 31 , 47 , 63 , 15 } }}; // 1 of 4 +t55xx_config T55xx_Timing = {{ + { 29 , 17 , 15 , 50 , 0 , 0 , 15 }, // Default Fixed + { 31 , 20 , 18 , 50 , 0 , 0 , 15 }, // Long Leading Ref. + { 31 , 20 , 18 , 40 , 0 , 0 , 15 }, // Leading 0 + { 29 , 17 , 15 , 31 , 47 , 63 , 15 } // 1 of 4 + } +}; */ // StartGap WriteGap Bit 0/00 Bit 1/01 Bit 10 Bit 11 ReadGap -t55xx_config T55xx_Timing = {{{ 29 * 8 , 17 * 8 , 15 * 8 , 50 * 8 , 0 , 0 , 15 * 8 }, // Default Fixed - { 31 * 8 , 20 * 8 , 18 * 8 , 50 * 8 , 0 , 0 , 15 * 8 }, // Long Leading Ref. - { 31 * 8 , 20 * 8 , 18 * 8 , 40 * 8 , 0 , 0 , 15 * 8 }, // Leading 0 - { 29 * 8 , 17 * 8 , 15 * 8 , 31 * 8 , 47 * 8, 63 * 8, 15 * 8 } }}; // 1 of 4 +t55xx_config T55xx_Timing = {{ + { 29 * 8, 17 * 8, 15 * 8, 50 * 8, 0, 0, 15 * 8 }, // Default Fixed + { 31 * 8, 20 * 8, 18 * 8, 50 * 8, 0, 0, 15 * 8 }, // Long Leading Ref. + { 31 * 8, 20 * 8, 18 * 8, 40 * 8, 0, 0, 15 * 8 }, // Leading 0 + { 29 * 8, 17 * 8, 15 * 8, 31 * 8, 47 * 8, 63 * 8, 15 * 8 } // 1 of 4 + } +}; // Some defines for readability @@ -133,48 +139,55 @@ t55xx_config T55xx_Timing = {{{ 29 * 8 , 17 * 8 , 15 * 8 , 50 * 8 , 0 , 0 #define T55xx_LongLeadingReference 4 // Value to tell Write Bit to send long reference void printT55xxConfig(void) { - int DLMode; - + int DLMode; + DbpString(_BLUE_("LF T55XX config")); - for (DLMode = 0; DLMode < 4; DLMode++) { - switch (DLMode){ - case T55xx_DLMode_Fixed : Dbprintf("r 0 fixed bit length (default)"); break; - case T55xx_DLMode_LLR : Dbprintf("r 1 long leading reference"); break; - case T55xx_DLMode_Leading0 : Dbprintf("r 2 leading zero"); break; - case T55xx_DLMode_1of4 : Dbprintf("r 3 1 of 4 coding reference"); break; - } - Dbprintf(" [a] startgap............%d*8 (%d)", T55xx_Timing.m[DLMode].start_gap / 8, T55xx_Timing.m[DLMode].start_gap); - Dbprintf(" [b] writegap............%d*8 (%d)", T55xx_Timing.m[DLMode].write_gap / 8, T55xx_Timing.m[DLMode].write_gap); - Dbprintf(" [c] write_0.............%d*8 (%d)", T55xx_Timing.m[DLMode].write_0 / 8, T55xx_Timing.m[DLMode].write_0 ); - Dbprintf(" [d] write_1.............%d*8 (%d)", T55xx_Timing.m[DLMode].write_1 / 8, T55xx_Timing.m[DLMode].write_1 ); - if (DLMode == T55xx_DLMode_1of4) { - Dbprintf(" [e] write_2.............%d*8 (%d)", T55xx_Timing.m[DLMode].write_2 / 8, T55xx_Timing.m[DLMode].write_2); - Dbprintf(" [f] write_3.............%d*8 (%d)", T55xx_Timing.m[DLMode].write_3 / 8, T55xx_Timing.m[DLMode].write_3); - } - Dbprintf(" [g] readgap.............%d*8 (%d)", T55xx_Timing.m[DLMode].read_gap / 8, T55xx_Timing.m[DLMode].read_gap); - } + for (DLMode = 0; DLMode < 4; DLMode++) { + switch (DLMode) { + case T55xx_DLMode_Fixed : + Dbprintf("r 0 fixed bit length (default)"); + break; + case T55xx_DLMode_LLR : + Dbprintf("r 1 long leading reference"); + break; + case T55xx_DLMode_Leading0 : + Dbprintf("r 2 leading zero"); + break; + case T55xx_DLMode_1of4 : + Dbprintf("r 3 1 of 4 coding reference"); + break; + } + Dbprintf(" [a] startgap............%d*8 (%d)", T55xx_Timing.m[DLMode].start_gap / 8, T55xx_Timing.m[DLMode].start_gap); + Dbprintf(" [b] writegap............%d*8 (%d)", T55xx_Timing.m[DLMode].write_gap / 8, T55xx_Timing.m[DLMode].write_gap); + Dbprintf(" [c] write_0.............%d*8 (%d)", T55xx_Timing.m[DLMode].write_0 / 8, T55xx_Timing.m[DLMode].write_0); + Dbprintf(" [d] write_1.............%d*8 (%d)", T55xx_Timing.m[DLMode].write_1 / 8, T55xx_Timing.m[DLMode].write_1); + if (DLMode == T55xx_DLMode_1of4) { + Dbprintf(" [e] write_2.............%d*8 (%d)", T55xx_Timing.m[DLMode].write_2 / 8, T55xx_Timing.m[DLMode].write_2); + Dbprintf(" [f] write_3.............%d*8 (%d)", T55xx_Timing.m[DLMode].write_3 / 8, T55xx_Timing.m[DLMode].write_3); + } + Dbprintf(" [g] readgap.............%d*8 (%d)", T55xx_Timing.m[DLMode].read_gap / 8, T55xx_Timing.m[DLMode].read_gap); + } } void setT55xxConfig(uint8_t arg0, t55xx_config *c) { - uint8_t DLMode; -// uint8_t ClearT55Settings = c->m[0].start_gap & 0xffff; // all values will be ffff if clear requested - - - for (DLMode = 0; DLMode < 4; DLMode++) { - if (c->m[DLMode].start_gap != 0) T55xx_Timing.m[DLMode].start_gap = c->m[DLMode].start_gap;// * 8; - if (c->m[DLMode].write_gap != 0) T55xx_Timing.m[DLMode].write_gap = c->m[DLMode].write_gap;// * 8; - if (c->m[DLMode].write_0 != 0) T55xx_Timing.m[DLMode].write_0 = c->m[DLMode].write_0 ;// * 8; - if (c->m[DLMode].write_1 != 0) T55xx_Timing.m[DLMode].write_1 = c->m[DLMode].write_1 ;// * 8; - if (DLMode == T55xx_DLMode_1of4) { - if (c->m[DLMode].write_2 != 0) T55xx_Timing.m[DLMode].write_2 = c->m[DLMode].write_2;// * 8; - if (c->m[DLMode].write_3 != 0) T55xx_Timing.m[DLMode].write_3 = c->m[DLMode].write_3;// * 8 ; - } - else{ - T55xx_Timing.m[DLMode].write_2 = 0x00; - T55xx_Timing.m[DLMode].write_3 = 0x00; - } - if (c->m[DLMode].read_gap != 0) T55xx_Timing.m[DLMode].read_gap = c->m[DLMode].read_gap;//* 8; - } + uint8_t DLMode; +// uint8_t ClearT55Settings = c->m[0].start_gap & 0xffff; // all values will be ffff if clear requested + + + for (DLMode = 0; DLMode < 4; DLMode++) { + if (c->m[DLMode].start_gap != 0) T55xx_Timing.m[DLMode].start_gap = c->m[DLMode].start_gap;// * 8; + if (c->m[DLMode].write_gap != 0) T55xx_Timing.m[DLMode].write_gap = c->m[DLMode].write_gap;// * 8; + if (c->m[DLMode].write_0 != 0) T55xx_Timing.m[DLMode].write_0 = c->m[DLMode].write_0 ;// * 8; + if (c->m[DLMode].write_1 != 0) T55xx_Timing.m[DLMode].write_1 = c->m[DLMode].write_1 ;// * 8; + if (DLMode == T55xx_DLMode_1of4) { + if (c->m[DLMode].write_2 != 0) T55xx_Timing.m[DLMode].write_2 = c->m[DLMode].write_2;// * 8; + if (c->m[DLMode].write_3 != 0) T55xx_Timing.m[DLMode].write_3 = c->m[DLMode].write_3;// * 8 ; + } else { + T55xx_Timing.m[DLMode].write_2 = 0x00; + T55xx_Timing.m[DLMode].write_3 = 0x00; + } + if (c->m[DLMode].read_gap != 0) T55xx_Timing.m[DLMode].read_gap = c->m[DLMode].read_gap;//* 8; + } printT55xxConfig(); @@ -188,7 +201,7 @@ void setT55xxConfig(uint8_t arg0, t55xx_config *c) { return; } - + uint8_t *buf = BigBuf_malloc(T55XX_CONFIG_LEN); Flash_CheckBusy(BUSY_TIMEOUT); uint16_t res = Flash_ReadDataCont(T55XX_CONFIG_OFFSET, buf, T55XX_CONFIG_LEN); @@ -198,21 +211,21 @@ void setT55xxConfig(uint8_t arg0, t55xx_config *c) { return; } - // if ( ClearT55Settings) // dont copy over new timings + // if ( ClearT55Settings) // dont copy over new timings memcpy(buf, &T55xx_Timing, T55XX_CONFIG_LEN); - - Flash_CheckBusy(BUSY_TIMEOUT); + + Flash_CheckBusy(BUSY_TIMEOUT); Flash_WriteEnable(); Flash_Erase4k(3, 0xD); - // if not a settings erase, write data - // if ( ClearT55Settings) { - res = Flash_Write(T55XX_CONFIG_OFFSET, buf, T55XX_CONFIG_LEN); + // if not a settings erase, write data + // if ( ClearT55Settings) { + res = Flash_Write(T55XX_CONFIG_OFFSET, buf, T55XX_CONFIG_LEN); - if (res == T55XX_CONFIG_LEN && DBGLEVEL > 1) { + if (res == T55XX_CONFIG_LEN && DBGLEVEL > 1) { DbpString("T55XX Config save success"); - } -// } + } + // } BigBuf_free(); #endif @@ -246,8 +259,8 @@ void loadT55xxConfig(void) { return; } - if (buf[0] != 0xFF) // if not set for clear - memcpy((uint8_t *)&T55xx_Timing, buf, T55XX_CONFIG_LEN); + if (buf[0] != 0xFF) // if not set for clear + memcpy((uint8_t *)&T55xx_Timing, buf, T55XX_CONFIG_LEN); if (isok == T55XX_CONFIG_LEN) { if (DBGLEVEL > 1) DbpString("T55XX Config load success"); @@ -1470,7 +1483,7 @@ void TurnReadLF_off(uint32_t delay) { #define BitStream_Byte(X) ((X) >> 3) #define BitStream_Bit(X) ((X) & 7) #define t55_send_PwdMode (arg & 0x01) -#define t55_send_Page ((arg & 0x02) >> 1) +#define t55_send_Page ((arg & 0x02) >> 1) #define t55_send_TestMode ((arg & 0x04) >> 2) #define t55_send_RegReadMode ((arg & 0x20) >> 5) #define t55_send_ReadCmd ((arg & 0x40) >> 6) @@ -1479,18 +1492,28 @@ void TurnReadLF_off(uint32_t delay) { // Write one bit to chip void T55xxWriteBit(uint8_t bit, uint8_t downlink_idx) { - // Dbprintf ("%d",bit); - // If bit = 4 Send Long Leading Reference which is (138*8) + WRITE_0 - switch (bit){ - case 0 : TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_0 ); break; // Send bit 0/00 - case 1 : TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_1 ); break; // Send bit 1/01 - case 2 : TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_2 ); break; // Send bits 10 (1 of 4) - case 3 : TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_3 ); break; // Send bits 11 (1 of 4) - case 4 : TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_0 + (136 * 8)); break; // Send Long Leading Reference - } + // Dbprintf ("%d",bit); + // If bit = 4 Send Long Leading Reference which is (138*8) + WRITE_0 + switch (bit) { + case 0 : + TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_0); + break; // Send bit 0/00 + case 1 : + TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_1); + break; // Send bit 1/01 + case 2 : + TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_2); + break; // Send bits 10 (1 of 4) + case 3 : + TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_3); + break; // Send bits 11 (1 of 4) + case 4 : + TurnReadLFOn(T55xx_Timing.m[downlink_idx].write_0 + (136 * 8)); + break; // Send Long Leading Reference + } - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - WaitUS(T55xx_Timing.m[downlink_idx].write_gap ); + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + WaitUS(T55xx_Timing.m[downlink_idx].write_gap); } // Function to abstract an Arbitrary length byte array to store bit pattern. @@ -1500,152 +1523,147 @@ void T55xxWriteBit(uint8_t bit, uint8_t downlink_idx) { // num_bits - how many bits (low x bits of data) Max 32 bits at a time // max_len - how many bytes can the bit_array hold (ensure no buffer overflow) // returns "Next" bit offset / bits stored (for next store) -uint8_t T55xx_SetBits (uint8_t *BitStream, uint8_t start_offset, uint32_t data , uint8_t num_bits, uint8_t max_len) -{ - int8_t offset; - int8_t NextOffset = start_offset; +uint8_t T55xx_SetBits(uint8_t *BitStream, uint8_t start_offset, uint32_t data, uint8_t num_bits, uint8_t max_len) { + int8_t offset; + int8_t NextOffset = start_offset; - // Check if data will fit. - if ((start_offset + num_bits) <= (max_len*8)) { - // Loop through the data and store - for (offset = (num_bits-1); offset >= 0; offset--) { + // Check if data will fit. + if ((start_offset + num_bits) <= (max_len * 8)) { + // Loop through the data and store + for (offset = (num_bits - 1); offset >= 0; offset--) { - if ((data >> offset) & 1) BitStream[BitStream_Byte(NextOffset)] |= (1 << BitStream_Bit(NextOffset)); // Set the bit to 1 - else BitStream[BitStream_Byte(NextOffset)] &= (0xff ^ (1 << BitStream_Bit(NextOffset))); // Set the bit to 0 + if ((data >> offset) & 1) BitStream[BitStream_Byte(NextOffset)] |= (1 << BitStream_Bit(NextOffset)); // Set the bit to 1 + else BitStream[BitStream_Byte(NextOffset)] &= (0xff ^ (1 << BitStream_Bit(NextOffset))); // Set the bit to 0 - NextOffset++; - } - } - else { - // Note: This should never happen unless some code changes cause it. - // So short message for coders when testing. - Dbprintf ("T55 too many bits"); - } - return NextOffset; + NextOffset++; + } + } else { + // Note: This should never happen unless some code changes cause it. + // So short message for coders when testing. + Dbprintf("T55 too many bits"); + } + return NextOffset; } -// Send one downlink command to the card -// void T55xx_SendCMD (uint32_t Data, uint8_t Block, uint32_t Pwd, uint8_t arg) { -void T55xx_SendCMD (uint32_t Data, uint32_t Pwd, uint16_t arg) { +// Send one downlink command to the card +// void T55xx_SendCMD (uint32_t Data, uint8_t Block, uint32_t Pwd, uint8_t arg) { +void T55xx_SendCMD(uint32_t Data, uint32_t Pwd, uint16_t arg) { - /* - arg bits - xxxx xxxxxxx1 0x001 PwdMode - xxxx xxxxxx1x 0x002 Page - xxxx xxxxx1xx 0x004 testMode - xxxx xxx11xxx 0x018 downlink mode - xxxx xx1xxxxx 0x020 !reg_readmode - xxxx x1xxxxxx 0x040 called for a read, so no data packet - xxxx 1xxxxxxx 0x080 reset - xxx1 xxxxxxxx 0x100 brute force - 111x xxxxxxxx 0xE00 Block - - */ + /* + arg bits + xxxx xxxxxxx1 0x001 PwdMode + xxxx xxxxxx1x 0x002 Page + xxxx xxxxx1xx 0x004 testMode + xxxx xxx11xxx 0x018 downlink mode + xxxx xx1xxxxx 0x020 !reg_readmode + xxxx x1xxxxxx 0x040 called for a read, so no data packet + xxxx 1xxxxxxx 0x080 reset + xxx1 xxxxxxxx 0x100 brute force + 111x xxxxxxxx 0xE00 Block + */ - uint8_t downlink_mode = (arg >> 3) & 0x03; - uint8_t i = 0; - uint8_t BitStream[10]; // Max Downlink Command size ~74 bits, so 10 bytes (80 bits) - uint8_t BitStreamLen = 0; - uint8_t SendBits; - uint8_t start_wait = 4; - bool brute_mem = (arg & 0x100); - uint8_t Block = (arg >> 9) & 0x07; - - if (brute_mem) start_wait = 0; - - // Build Bit Stream to send. - memset (BitStream,0x00,sizeof(BitStream)); - - BitStreamLen = 0; // Ensure 0 bit index to start. - - // Add Leading 0 and 1 of 4 reference bit - if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4)) - BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream)); + uint8_t downlink_mode = (arg >> 3) & 0x03; + uint8_t i = 0; + uint8_t BitStream[10]; // Max Downlink Command size ~74 bits, so 10 bytes (80 bits) + uint8_t BitStreamLen = 0; + uint8_t SendBits; + uint8_t start_wait = 4; + bool brute_mem = (arg & 0x100); + uint8_t Block = (arg >> 9) & 0x07; - // Add extra reference 0 for 1 of 4 - if (downlink_mode == T55xx_DLMode_1of4) - BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream)); + if (brute_mem) start_wait = 0; - // Add Opcode - if (t55_send_Reset) { - // Reset : r*) 00 - BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 2,sizeof(BitStream)); - } - else { - if (t55_send_TestMode) Dbprintf("TestMODE"); - BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,t55_send_TestMode ? 0 : 1 , 1,sizeof(BitStream)); - BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,t55_send_TestMode ? 1 : t55_send_Page , 1,sizeof(BitStream)); - //if (PwdMode) { - if (t55_send_PwdMode) { - // Leading 0 and 1 of 4 00 fixed bits if passsword used - if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4)) { - BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 2,sizeof(BitStream)); - } - BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Pwd, 32,sizeof(BitStream)); - } + // Build Bit Stream to send. + memset(BitStream, 0x00, sizeof(BitStream)); - // Add Lock bit 0 - if (!t55_send_RegReadMode) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream)); + BitStreamLen = 0; // Ensure 0 bit index to start. - // Add Data if a write command - if (!t55_send_ReadCmd) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Data, 32,sizeof(BitStream)); + // Add Leading 0 and 1 of 4 reference bit + if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4)) + BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, 0, 1, sizeof(BitStream)); - // Add Address - if (!t55_send_RegReadMode) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Block, 3,sizeof(BitStream)); - } + // Add extra reference 0 for 1 of 4 + if (downlink_mode == T55xx_DLMode_1of4) + BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, 0, 1, sizeof(BitStream)); - // Send Bits to T55xx - // Set up FPGA, 125kHz - LFSetupFPGAForADC(95, true); + // Add Opcode + if (t55_send_Reset) { + // Reset : r*) 00 + BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, 0, 2, sizeof(BitStream)); + } else { + if (t55_send_TestMode) Dbprintf("TestMODE"); + BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, t55_send_TestMode ? 0 : 1, 1, sizeof(BitStream)); + BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, t55_send_TestMode ? 1 : t55_send_Page, 1, sizeof(BitStream)); + //if (PwdMode) { + if (t55_send_PwdMode) { + // Leading 0 and 1 of 4 00 fixed bits if passsword used + if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4)) { + BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, 0, 2, sizeof(BitStream)); + } + BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, Pwd, 32, sizeof(BitStream)); + } - // make sure tag is fully powered up... - WaitMS(start_wait); + // Add Lock bit 0 + if (!t55_send_RegReadMode) BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, 0, 1, sizeof(BitStream)); - // Trigger T55x7 in mode. - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - WaitUS(T55xx_Timing.m[downlink_mode].start_gap * 8); + // Add Data if a write command + if (!t55_send_ReadCmd) BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, Data, 32, sizeof(BitStream)); - // If long leading 0 send long reference pulse - if (downlink_mode == T55xx_DLMode_LLR) - T55xxWriteBit (T55xx_LongLeadingReference,downlink_mode);//Timing); // Send Long Leading Start Reference + // Add Address + if (!t55_send_RegReadMode) BitStreamLen = T55xx_SetBits(BitStream, BitStreamLen, Block, 3, sizeof(BitStream)); + } - if ((downlink_mode == T55xx_DLMode_1of4) && (BitStreamLen > 0)) { // 1 of 4 need to send 2 bits at a time - for ( i = 0; i < BitStreamLen-1; i+=2 ) { - SendBits = (BitStream[BitStream_Byte(i )] >> (BitStream_Bit(i )) & 1) << 1; // Bit i - SendBits += (BitStream[BitStream_Byte(i+1)] >> (BitStream_Bit(i+1)) & 1); // Bit i+1; - T55xxWriteBit (SendBits & 3,downlink_mode);//Timing); - } - } - else { - for (i = 0; i < BitStreamLen; i++) { - SendBits = (BitStream[BitStream_Byte(i)] >> BitStream_Bit(i)); - T55xxWriteBit (SendBits & 1,downlink_mode);//Timing); - } - } + // Send Bits to T55xx + // Set up FPGA, 125kHz + LFSetupFPGAForADC(95, true); + + // make sure tag is fully powered up... + WaitMS(start_wait); + + // Trigger T55x7 in mode. + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + WaitUS(T55xx_Timing.m[downlink_mode].start_gap * 8); + + // If long leading 0 send long reference pulse + if (downlink_mode == T55xx_DLMode_LLR) + T55xxWriteBit(T55xx_LongLeadingReference, downlink_mode);//Timing); // Send Long Leading Start Reference + + if ((downlink_mode == T55xx_DLMode_1of4) && (BitStreamLen > 0)) { // 1 of 4 need to send 2 bits at a time + for (i = 0; i < BitStreamLen - 1; i += 2) { + SendBits = (BitStream[BitStream_Byte(i)] >> (BitStream_Bit(i)) & 1) << 1; // Bit i + SendBits += (BitStream[BitStream_Byte(i + 1)] >> (BitStream_Bit(i + 1)) & 1); // Bit i+1; + T55xxWriteBit(SendBits & 3, downlink_mode);//Timing); + } + } else { + for (i = 0; i < BitStreamLen; i++) { + SendBits = (BitStream[BitStream_Byte(i)] >> BitStream_Bit(i)); + T55xxWriteBit(SendBits & 1, downlink_mode);//Timing); + } + } } // Send T5577 reset command then read stream (see if we can identify the start of the stream) void T55xxResetRead(uint8_t flags) { - uint8_t downlink_mode = ((flags >> 3) & 3); - uint8_t arg = 0x80 | downlink_mode; - + uint8_t downlink_mode = ((flags >> 3) & 3); + uint8_t arg = 0x80 | downlink_mode; + LED_A_ON(); - + //clear buffer now so it does not interfere with timing later BigBuf_Clear_keep_EM(); - T55xx_SendCMD (0, 0, arg); + T55xx_SendCMD(0, 0, arg); TurnReadLFOn(T55xx_Timing.m[downlink_mode].read_gap); - + // Acquisition DoPartialAcquisition(0, true, BigBuf_max_traceLen(), 0); // Turn the field off FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off reply_mix(CMD_ACK, 0, 0, 0, 0, 0); - + LED_A_OFF(); } @@ -1653,60 +1671,60 @@ void T55xxResetRead(uint8_t flags) { //void T55xxWriteBlockExt(uint32_t data, uint8_t blockno, uint32_t pwd, uint8_t flags) { void T55xxWriteBlock(uint8_t *data) { - /* - flag bits - xxxxxxx1 0x01 PwdMode - xxxxxx1x 0x02 Page - xxxxx1xx 0x04 testMode - xxx11xxx 0x18 downlink mode - xx1xxxxx 0x20 !reg_readmode - x1xxxxxx 0x40 called for a read, so no data packet - 1xxxxxxx 0x80 reset - */ - - t55xx_write_block_t *c = (t55xx_write_block_t *)data; - // c->data, c->blockno, c->pwd, c->flags + /* + flag bits + xxxxxxx1 0x01 PwdMode + xxxxxx1x 0x02 Page + xxxxx1xx 0x04 testMode + xxx11xxx 0x18 downlink mode + xx1xxxxx 0x20 !reg_readmode + x1xxxxxx 0x40 called for a read, so no data packet + 1xxxxxxx 0x80 reset + */ - bool testMode = ((c->flags & 0x04) == 0x04); + t55xx_write_block_t *c = (t55xx_write_block_t *)data; + // c->data, c->blockno, c->pwd, c->flags - c->flags &= (0xff ^ 0x40); // Called for a write, so ensure it is clear/0 - - LED_A_ON (); - T55xx_SendCMD (c->data, c->pwd, c->flags | (c->blockno << 9)) ;//, false); + bool testMode = ((c->flags & 0x04) == 0x04); - // Perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550, - // so wait a little more) + c->flags &= (0xff ^ 0x40); // Called for a write, so ensure it is clear/0 - // "there is a clock delay before programming" - // - programming takes ~5.6ms for t5577 ~18ms for E5550 or t5567 - // so we should wait 1 clock + 5.6ms then read response? - // but we need to know we are dealing with t5577 vs t5567 vs e5550 (or q5) marshmellow... - if (testMode) { - //TESTMODE TIMING TESTS: - // <566us does nothing - // 566-568 switches between wiping to 0s and doing nothing - // 5184 wipes and allows 1 block to be programmed. - // indefinite power on wipes and then programs all blocks with bitshifted data sent. - TurnReadLFOn(5184); + LED_A_ON(); + T55xx_SendCMD(c->data, c->pwd, c->flags | (c->blockno << 9)) ; //, false); - } else { - TurnReadLFOn(20 * 1000); - //could attempt to do a read to confirm write took - // as the tag should repeat back the new block - // until it is reset, but to confirm it we would - // need to know the current block 0 config mode for - // modulation clock an other details to demod the response... - // response should be (for t55x7) a 0 bit then (ST if on) - // block data written in on repeat until reset. + // Perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550, + // so wait a little more) - //DoPartialAcquisition(20, true, 12000); - } - // turn field off - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + // "there is a clock delay before programming" + // - programming takes ~5.6ms for t5577 ~18ms for E5550 or t5567 + // so we should wait 1 clock + 5.6ms then read response? + // but we need to know we are dealing with t5577 vs t5567 vs e5550 (or q5) marshmellow... + if (testMode) { + //TESTMODE TIMING TESTS: + // <566us does nothing + // 566-568 switches between wiping to 0s and doing nothing + // 5184 wipes and allows 1 block to be programmed. + // indefinite power on wipes and then programs all blocks with bitshifted data sent. + TurnReadLFOn(5184); - // cmd_send(CMD_ACK,0,0,0,0,0); - reply_ng(CMD_T55XX_WRITE_BLOCK, PM3_SUCCESS, NULL, 0); - LED_A_OFF (); + } else { + TurnReadLFOn(20 * 1000); + //could attempt to do a read to confirm write took + // as the tag should repeat back the new block + // until it is reset, but to confirm it we would + // need to know the current block 0 config mode for + // modulation clock an other details to demod the response... + // response should be (for t55x7) a 0 bit then (ST if on) + // block data written in on repeat until reset. + + //DoPartialAcquisition(20, true, 12000); + } + // turn field off + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + + // cmd_send(CMD_ACK,0,0,0,0,0); + reply_ng(CMD_T55XX_WRITE_BLOCK, PM3_SUCCESS, NULL, 0); + LED_A_OFF(); } /* @@ -1719,49 +1737,49 @@ void T55xxWriteBlock(uint8_t *data) { */ /* // Read one card block in page [page] -void T55xxReadBlockExt (uint16_t flags, uint8_t block, uint32_t pwd) { - / * - flag bits - xxxx xxxxxxx1 0x0001 PwdMode - xxxx xxxxxx1x 0x0002 Page - xxxx xxxxx1xx 0x0004 testMode - xxxx xxx11xxx 0x0018 downlink mode - xxxx xx1xxxxx 0x0020 !reg_readmode - xxxx x1xxxxxx 0x0040 called for a read, so no data packet - xxxx 1xxxxxxx 0x0080 reset - xxx1 xxxxxxxx 0x0100 brute/leave field on - * / - size_t samples = 12000; - bool brute_mem = (flags & 0x0100) >> 8; - - LED_A_ON(); +void T55xxReadBlockExt(uint16_t flags, uint8_t block, uint32_t pwd) { + / * + flag bits + xxxx xxxxxxx1 0x0001 PwdMode + xxxx xxxxxx1x 0x0002 Page + xxxx xxxxx1xx 0x0004 testMode + xxxx xxx11xxx 0x0018 downlink mode + xxxx xx1xxxxx 0x0020 !reg_readmode + xxxx x1xxxxxx 0x0040 called for a read, so no data packet + xxxx 1xxxxxxx 0x0080 reset + xxx1 xxxxxxxx 0x0100 brute / leave field on + * / + size_t samples = 12000; +bool brute_mem = (flags & 0x0100) >> 8; - if (brute_mem) samples = 1024; - - // Set Read Flag to ensure SendCMD does not add "data" to the packet - flags |= 0x40; + LED_A_ON(); - // RegRead Mode true block = 0xff, so read without an address - if (block == 0xff) flags |= 0x20; - - //make sure block is at max 7 - block &= 0x7; + if (brute_mem) samples = 1024; - //clear buffer now so it does not interfere with timing later - BigBuf_Clear_keep_EM(); + // Set Read Flag to ensure SendCMD does not add "data" to the packet + flags |= 0x40; - T55xx_SendCMD (0, pwd, flags | (block << 9)); //, true); + // RegRead Mode true block = 0xff, so read without an address + if (block == 0xff) flags |= 0x20; - // Turn field on to read the response - // 137*8 seems to get to the start of data pretty well... - // but we want to go past the start and let the repeating data settle in... + //make sure block is at max 7 + block &= 0x7; - // TurnReadLFOn(210*8); // issues with block 1 reads so dropping down seemed to help - TurnReadLFOn(137*8); + //clear buffer now so it does not interfere with timing later + BigBuf_Clear_keep_EM(); - // Acquisition - // Now do the acquisition - DoPartialAcquisition(0, true, samples, 0); + T55xx_SendCMD(0, pwd, flags | (block << 9)); //, true); + + // Turn field on to read the response + // 137*8 seems to get to the start of data pretty well... + // but we want to go past the start and let the repeating data settle in... + + // TurnReadLFOn(210*8); // issues with block 1 reads so dropping down seemed to help + TurnReadLFOn(137 * 8); + + // Acquisition + // Now do the acquisition + DoPartialAcquisition(0, true, samples, 0); // Turn the field off if (!brute_mem) { @@ -1773,55 +1791,55 @@ void T55xxReadBlockExt (uint16_t flags, uint8_t block, uint32_t pwd) { */ // Read one card block in page [page] void T55xxReadBlock(uint8_t page, bool pwd_mode, bool brute_mem, uint8_t block, uint32_t pwd, uint8_t downlink_mode) { - /* - flag bits - xxxxxxx1 0x0001 PwdMode - xxxxxx1x 0x0002 Page - xxxxx1xx 0x0004 testMode - xxx11xxx 0x0018 downlink mode - xx1xxxxx 0x0020 !reg_readmode - x1xxxxxx 0x0040 called for a read, so no data packet - 1xxxxxxx 0x0080 reset - 1xxxxxxxx 0x0100 brute/leave field on - */ - uint16_t flags = 0x0040; // read packet - if (pwd_mode) flags |= 0x0001; - if (page) flags |= 0x0002; - flags |= (downlink_mode & 3) << 3; - if (brute_mem) flags |= 0x0100; - -// T55xxReadBlockExt (flags,block,pwd); - size_t samples = 12000; - // bool brute_mem = (flags & 0x0100) >> 8; - - LED_A_ON(); + /* + flag bits + xxxx xxxxxxx1 0x0001 PwdMode + xxxx xxxxxx1x 0x0002 Page + xxxx xxxxx1xx 0x0004 testMode + xxxx xxx11xxx 0x0018 downlink mode + xxxx xx1xxxxx 0x0020 !reg_readmode + xxxx x1xxxxxx 0x0040 called for a read, so no data packet + xxxx 1xxxxxxx 0x0080 reset + xxx1 xxxxxxxx 0x0100 brute / leave field on + */ + uint16_t flags = 0x0040; // read packet + if (pwd_mode) flags |= 0x0001; + if (page) flags |= 0x0002; + flags |= (downlink_mode & 3) << 3; + if (brute_mem) flags |= 0x0100; - if (brute_mem) samples = 1024; - - //-- Set Read Flag to ensure SendCMD does not add "data" to the packet - //-- flags |= 0x40; +// T55xxReadBlockExt (flags,block,pwd); + size_t samples = 12000; + // bool brute_mem = (flags & 0x0100) >> 8; - // RegRead Mode true block = 0xff, so read without an address - if (block == 0xff) flags |= 0x20; - - //make sure block is at max 7 - block &= 0x7; + LED_A_ON(); - //clear buffer now so it does not interfere with timing later - BigBuf_Clear_keep_EM(); + if (brute_mem) samples = 1024; - T55xx_SendCMD (0, pwd, flags | (block << 9)); //, true); + //-- Set Read Flag to ensure SendCMD does not add "data" to the packet + //-- flags |= 0x40; - // Turn field on to read the response - // 137*8 seems to get to the start of data pretty well... - // but we want to go past the start and let the repeating data settle in... + // RegRead Mode true block = 0xff, so read without an address + if (block == 0xff) flags |= 0x20; - // TurnReadLFOn(210*8); // issues with block 1 reads so dropping down seemed to help - TurnReadLFOn(137*8); + //make sure block is at max 7 + block &= 0x7; - // Acquisition - // Now do the acquisition - DoPartialAcquisition(0, true, samples, 0); + //clear buffer now so it does not interfere with timing later + BigBuf_Clear_keep_EM(); + + T55xx_SendCMD(0, pwd, flags | (block << 9)); //, true); + + // Turn field on to read the response + // 137*8 seems to get to the start of data pretty well... + // but we want to go past the start and let the repeating data settle in... + + // TurnReadLFOn(210*8); // issues with block 1 reads so dropping down seemed to help + TurnReadLFOn(137 * 8); + + // Acquisition + // Now do the acquisition + DoPartialAcquisition(0, true, samples, 0); // Turn the field off if (!brute_mem) { @@ -1841,13 +1859,13 @@ void T55xx_ChkPwds(uint8_t flags) { // tends to mess up BigBuf uint8_t *buf = BigBuf_get_addr(); uint32_t b1, baseline = 0; - uint8_t downlink_mode = (flags >> 3) & 0x03; - + uint8_t downlink_mode = (flags >> 3) & 0x03; + // collect baseline for failed attempt uint8_t x = 32; while (x--) { b1 = 0; - T55xxReadBlock(0, 0, true, 1, 0,downlink_mode); + T55xxReadBlock(0, 0, true, 1, 0, downlink_mode); for (uint16_t j = 0; j < 1024; ++j) b1 += buf[j]; @@ -1892,7 +1910,7 @@ void T55xx_ChkPwds(uint8_t flags) { pwd = bytes_to_num(pwds + i * 4, 4); - T55xxReadBlock(0, true, true, 0, pwd,downlink_mode); + T55xxReadBlock(0, true, true, 0, pwd, downlink_mode); // calc mean of BigBuf 1024 samples. uint32_t sum = 0; @@ -1909,7 +1927,7 @@ void T55xx_ChkPwds(uint8_t flags) { Dbprintf("[=] Pwd %08X | ABS %u", pwd, curr); if (curr > prev) { - Dbprintf("[=] --> ABS %u Candidate %08X <--", curr, pwd); + Dbprintf("[=] --> ABS %u Candidate %08X <--", curr, pwd); candidate = pwd; prev = curr; } @@ -1925,12 +1943,12 @@ OUT: } void T55xxWakeUp(uint32_t Pwd, uint8_t flags) { - - flags |= 0x01 | 0x40 | 0x20; //Password | Read Call (no data) | reg_read no block + + flags |= 0x01 | 0x40 | 0x20; //Password | Read Call (no data) | reg_read no block LED_B_ON(); - T55xx_SendCMD (0, Pwd, flags); - + T55xx_SendCMD(0, Pwd, flags); + //-- Turn and leave field on to let the begin repeating transmission TurnReadLFOn(20 * 1000); } @@ -1939,16 +1957,16 @@ void T55xxWakeUp(uint32_t Pwd, uint8_t flags) { /*-------------- Cloning routines -----------*/ void WriteT55xx(uint32_t *blockdata, uint8_t startblock, uint8_t numblocks) { - t55xx_write_block_t cmd; - cmd.pwd = 0; + t55xx_write_block_t cmd; + cmd.pwd = 0; cmd.flags = 0; - for (uint8_t i = numblocks + startblock; i > startblock; i--) { - cmd.data = blockdata[i - 1]; - cmd.blockno = i - 1; - T55xxWriteBlock ((uint8_t *)&cmd); - } - + for (uint8_t i = numblocks + startblock; i > startblock; i--) { + cmd.data = blockdata[i - 1]; + cmd.blockno = i - 1; + T55xxWriteBlock((uint8_t *)&cmd); + } + } // Copy HID id to card and setup block 0 config diff --git a/client/cmdlft55xx.c b/client/cmdlft55xx.c index 618ab8c7c..69cd8251b 100644 --- a/client/cmdlft55xx.c +++ b/client/cmdlft55xx.c @@ -49,8 +49,8 @@ static int usage_t55xx_read() { PrintAndLogEx(NORMAL, " p - OPTIONAL password (8 hex characters)"); PrintAndLogEx(NORMAL, " o - OPTIONAL override safety check"); PrintAndLogEx(NORMAL, " 1 - OPTIONAL read Page 1 instead of Page 0"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); - PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); + PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); PrintAndLogEx(NORMAL, " ****WARNING****"); PrintAndLogEx(NORMAL, " Use of read with password on a tag not configured for a pwd"); PrintAndLogEx(NORMAL, " can damage the tag"); @@ -70,8 +70,8 @@ static int usage_t55xx_write() { PrintAndLogEx(NORMAL, " p - OPTIONAL password 4bytes (8 hex characters)"); PrintAndLogEx(NORMAL, " 1 - OPTIONAL write Page 1 instead of Page 0"); PrintAndLogEx(NORMAL, " t - OPTIONAL test mode write - ****DANGER****"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); - PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); + PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, " lf t55xx write b 3 d 11223344 - write 11223344 to block 3"); @@ -82,10 +82,10 @@ static int usage_t55xx_write() { static int usage_t55xx_trace() { PrintAndLogEx(NORMAL, "Usage: lf t55xx trace [r mode]"); PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); - PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); + PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); // Command did not seem to support the 1 option (yet) so have removed the help lines - // PrintAndLogEx(NORMAL, " 1 - if set, use Graphbuffer otherwise read data from tag."); + // PrintAndLogEx(NORMAL, " 1 - if set, use Graphbuffer otherwise read data from tag."); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, " lf t55xx trace"); @@ -101,8 +101,8 @@ static int usage_t55xx_info() { PrintAndLogEx(NORMAL, " d - 4 bytes of data (8 hex characters)"); PrintAndLogEx(NORMAL, " if set, use these data instead of reading tag."); PrintAndLogEx(NORMAL, " q - if set, provided data are interpreted as Q5 config."); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); - PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); + PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, " lf t55xx info"); @@ -117,8 +117,8 @@ static int usage_t55xx_dump() { PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " - OPTIONAL password 4bytes (8 hex symbols)"); PrintAndLogEx(NORMAL, " o - OPTIONAL override, force pwd read despite danger to card"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); - PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); + PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, " lf t55xx dump"); @@ -131,9 +131,9 @@ static int usage_t55xx_detect() { PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " 1 - if set, use Graphbuffer otherwise read data from tag."); PrintAndLogEx(NORMAL, " p - downlink encoding '0' fixed bit length (default)"); - PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); - PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); + PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); + PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, " lf t55xx detect"); @@ -148,9 +148,9 @@ static int usage_t55xx_detectP1() { PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " 1 - if set, use Graphbuffer otherwise read data from tag."); PrintAndLogEx(NORMAL, " p - OPTIONAL password (8 hex characters)"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); - PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); - PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); + PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); + PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, " lf t55xx p1detect"); @@ -165,8 +165,8 @@ static int usage_t55xx_wakup() { PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " h - this help"); PrintAndLogEx(NORMAL, " p - password 4bytes (8 hex symbols)"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); - PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); + PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, " lf t55xx wakeup p 11223344 - send wakeup password"); @@ -181,9 +181,9 @@ static int usage_t55xx_chk() { PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " h - this help"); PrintAndLogEx(NORMAL, " m - use dictionary from flashmemory\n"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); - PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); - PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); + PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); + PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); PrintAndLogEx(NORMAL, " i <*.dic> - loads a default keys dictionary file <*.dic>"); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); @@ -201,9 +201,9 @@ static int usage_t55xx_bruteforce() { PrintAndLogEx(NORMAL, " password must be 4 bytes (8 hex symbols)"); PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " h - this help"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); - PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); - PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); + PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); + PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); PrintAndLogEx(NORMAL, " - 4 byte hex value to start pwd search at"); PrintAndLogEx(NORMAL, " - 4 byte hex value to end pwd search at"); PrintAndLogEx(NORMAL, ""); @@ -222,9 +222,9 @@ static int usage_t55xx_recoverpw() { PrintAndLogEx(NORMAL, " default password is 51243648, used by many cloners"); PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " h - this help"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); - PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); - PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default)"); + PrintAndLogEx(NORMAL, " '1' long leading ref., '2' leading zero "); + PrintAndLogEx(NORMAL, " '3' 1 of 4 coding ref., '4' try all modes"); PrintAndLogEx(NORMAL, " [password] - 4 byte hex value of password written by cloner"); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); @@ -258,10 +258,10 @@ static int usage_lf_deviceconfig() { PrintAndLogEx(NORMAL, " f <8..255> - Set write THREE gap (1 of 4 only)"); PrintAndLogEx(NORMAL, " g <8..255> - Set read gap"); PrintAndLogEx(NORMAL, " p - persist to flashmemory"); - PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); - PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); - PrintAndLogEx(NORMAL, " z - erase t55x7 timings (needs p and reboot to load defaults)"); - PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, " r - downlink encoding '0' fixed bit length (default), '1' long leading ref."); + PrintAndLogEx(NORMAL, " '2' leading zero, '3' 1 of 4 coding ref."); + PrintAndLogEx(NORMAL, " z - erase t55x7 timings (needs p and reboot to load defaults)"); + PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, " lf t55xx deviceconfig a 29 b 17 c 15 d 47 e 15 - default T55XX"); PrintAndLogEx(NORMAL, " lf t55xx deviceconfig a 55 b 14 c 21 d 30 - default EM4305"); @@ -397,7 +397,7 @@ int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, uint8_t override, uin if (usepwd) { // try reading the config block and verify that PWD bit is set before doing this! if (!override) { - if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0,downlink_mode)) return PM3_ESOFT; + if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0, downlink_mode)) return PM3_ESOFT; if (!tryDetectModulation()) { PrintAndLogEx(NORMAL, "Safety Check: Could not detect if PWD bit is set in config block. Exits."); @@ -408,9 +408,9 @@ int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, uint8_t override, uin page1 = false; } } else { - // Show only if first for command i.e. override = 1 (override and display) override = 2 (override and dont display) - if ((override & 2) != 2) - PrintAndLogEx(NORMAL, "Safety Check Overriden - proceeding despite risk"); + // Show only if first for command i.e. override = 1 (override and display) override = 2 (override and dont display) + if ((override & 2) != 2) + PrintAndLogEx(NORMAL, "Safety Check Overriden - proceeding despite risk"); } } @@ -430,8 +430,8 @@ static int CmdT55xxReadBlock(const char *Cmd) { bool page1 = false; bool errors = false; uint8_t cmdp = 0; - uint8_t downlink_mode = 0; - + uint8_t downlink_mode = 0; + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { switch (tolower(param_getchar(Cmd, cmdp))) { case 'h': @@ -453,13 +453,13 @@ static int CmdT55xxReadBlock(const char *Cmd) { page1 = true; cmdp++; break; - case 'r': - case 'R': - downlink_mode = param_getchar(Cmd, cmdp+1) - '0'; - if (downlink_mode > 3) downlink_mode = 0; - cmdp +=2; - break; - + case 'r': + case 'R': + downlink_mode = param_getchar(Cmd, cmdp + 1) - '0'; + if (downlink_mode > 3) downlink_mode = 0; + cmdp += 2; + break; + default: PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); errors = true; @@ -556,34 +556,42 @@ static int SanityOfflineCheck(bool useGraphBuffer) { return PM3_SUCCESS; } -void T55xx_Print_DownlinkMode (uint8_t downlink_mode) -{ - char Msg[80]; - sprintf (Msg,"Downlink Mode used : "); - - switch (downlink_mode) { - case 0 : strcat (Msg,"default/fixed bit length"); break; - case 1 : strcat (Msg,"long leading reference (r 1)"); break; - case 2 : strcat (Msg,"leading zero reference (r 2)"); break; - case 3 : strcat (Msg,"1 of 4 coding reference (r 3)"); break; - default : - strcat (Msg,"default/fixed bit length"); break; - } - - PrintAndLogEx (NORMAL,Msg); +void T55xx_Print_DownlinkMode(uint8_t downlink_mode) { + char Msg[80]; + sprintf(Msg, "Downlink Mode used : "); + + switch (downlink_mode) { + case 0 : + strcat(Msg, "default/fixed bit length"); + break; + case 1 : + strcat(Msg, "long leading reference (r 1)"); + break; + case 2 : + strcat(Msg, "leading zero reference (r 2)"); + break; + case 3 : + strcat(Msg, "1 of 4 coding reference (r 3)"); + break; + default : + strcat(Msg, "default/fixed bit length"); + break; + } + + PrintAndLogEx(NORMAL, Msg); } -// +// static int CmdT55xxDetect(const char *Cmd) { bool errors = false; bool useGB = false; - bool usepwd = false; - bool try_all_dl_modes = false; - bool found = false; + bool usepwd = false; + bool try_all_dl_modes = false; + bool found = false; uint32_t password = 0; uint8_t cmdp = 0; - uint8_t downlink_mode = 0; - uint8_t dl_mode = 0; + uint8_t downlink_mode = 0; + uint8_t dl_mode = 0; while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { switch (tolower(param_getchar(Cmd, cmdp))) { @@ -599,12 +607,12 @@ static int CmdT55xxDetect(const char *Cmd) { useGB = true; cmdp++; break; - case 'r': - downlink_mode = param_getchar(Cmd, cmdp+1) - '0'; - if (downlink_mode == 4) try_all_dl_modes = true; - if (downlink_mode > 3) downlink_mode = 0; - cmdp +=2; - break; + case 'r': + downlink_mode = param_getchar(Cmd, cmdp + 1) - '0'; + if (downlink_mode == 4) try_all_dl_modes = true; + if (downlink_mode > 3) downlink_mode = 0; + cmdp += 2; + break; default: PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); errors = true; @@ -617,44 +625,44 @@ static int CmdT55xxDetect(const char *Cmd) { if (SanityOfflineCheck(useGB) != PM3_SUCCESS) return PM3_ENODATA; if (!useGB) { - for (dl_mode = downlink_mode; dl_mode < 4; dl_mode++) { - found = AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password,dl_mode); + for (dl_mode = downlink_mode; dl_mode < 4; dl_mode++) { + found = AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password, dl_mode); - // found = false if password is supplied but wrong d/l mode - // so keep trying other modes (if requested) - /* if (!found) { - printf ("Aquire not found"); - return PM3_ENODATA; - } - */ - if (tryDetectModulation()) - { - T55xx_Print_DownlinkMode (dl_mode); - dl_mode = 4; - found = true; - } - else found = false; + // found = false if password is supplied but wrong d/l mode + // so keep trying other modes (if requested) + /* + if (!found) { + printf ("Aquire not found"); + return PM3_ENODATA; + } + */ + if (tryDetectModulation()) { + T55xx_Print_DownlinkMode(dl_mode); + dl_mode = 4; + found = true; + } else found = false; - if (!try_all_dl_modes) dl_mode = 4; - } + if (!try_all_dl_modes) dl_mode = 4; + } } - - if (useGB) found = tryDetectModulation(); - - if (!found) - PrintAndLogEx(WARNING, "Could not detect modulation automatically. Try setting it manually with " _YELLOW_("\'lf t55xx config\'")); + + if (useGB) found = tryDetectModulation(); + + if (!found) + PrintAndLogEx(WARNING, "Could not detect modulation automatically. Try setting it manually with " _YELLOW_("\'lf t55xx config\'")); - /* if (!useGB) { + /* + if (!useGB) { if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password,downlink_mode)) return PM3_ENODATA; } if (!tryDetectModulation()) PrintAndLogEx(WARNING, "Could not detect modulation automatically. Try setting it manually with " _YELLOW_("\'lf t55xx config\'")); - else - T55xx_Print_DownlinkMode (downlink_mode); -*/ + else + T55xx_Print_DownlinkMode (downlink_mode); + */ return PM3_SUCCESS; } @@ -1101,14 +1109,14 @@ int printConfiguration(t55xx_conf_block_t b) { } static int CmdT55xxWakeUp(const char *Cmd) { - + uint32_t password = 0; uint8_t cmdp = 0; bool errors = false; uint8_t downlink_mode = 0; - uint8_t flags = 0; + uint8_t flags = 0; - while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { switch (tolower(param_getchar(Cmd, cmdp))) { case 'h': return usage_t55xx_wakup(); @@ -1117,11 +1125,11 @@ static int CmdT55xxWakeUp(const char *Cmd) { cmdp += 2; errors = false; break; - case 'r': - downlink_mode = param_getchar(Cmd, cmdp+1) - '0'; - if (downlink_mode > 3) downlink_mode = 0; - cmdp +=2; - break; + case 'r': + downlink_mode = param_getchar(Cmd, cmdp + 1) - '0'; + if (downlink_mode > 3) downlink_mode = 0; + cmdp += 2; + break; default: PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); errors = true; @@ -1131,7 +1139,7 @@ static int CmdT55xxWakeUp(const char *Cmd) { if (errors) return usage_t55xx_wakup(); - flags = (downlink_mode & 3) << 3; + flags = (downlink_mode & 3) << 3; clearCommandBuffer(); SendCommandMIX(CMD_T55XX_WAKEUP, password, flags, 0, NULL, 0); PrintAndLogEx(SUCCESS, "Wake up command sent. Try read now"); @@ -1149,8 +1157,8 @@ static int CmdT55xxWriteBlock(const char *Cmd) { bool testMode = false; bool errors = false; uint8_t cmdp = 0; - uint32_t downlink_mode = 0; - + uint32_t downlink_mode = 0; + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { switch (tolower(param_getchar(Cmd, cmdp))) { case 'h': @@ -1182,11 +1190,11 @@ static int CmdT55xxWriteBlock(const char *Cmd) { page1 = true; cmdp++; break; - case 'r': - downlink_mode = param_getchar(Cmd, cmdp+1) - '0'; - if (downlink_mode > 3) downlink_mode = 0; - cmdp +=2; - break; + case 'r': + downlink_mode = param_getchar(Cmd, cmdp + 1) - '0'; + if (downlink_mode > 3) downlink_mode = 0; + cmdp += 2; + break; default: PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); errors = true; @@ -1200,8 +1208,8 @@ static int CmdT55xxWriteBlock(const char *Cmd) { flags = (usepwd) ? 0x1 : 0; flags |= (page1) ? 0x2 : 0; flags |= (testMode) ? 0x4 : 0; - flags |= (downlink_mode << 3); - + flags |= (downlink_mode << 3); + char pwdStr[16] = {0}; snprintf(pwdStr, sizeof(pwdStr), "pwd: 0x%08X", password); @@ -1234,26 +1242,26 @@ static int CmdT55xxWriteBlock(const char *Cmd) { } static int CmdT55xxReadTrace(const char *Cmd) { - uint8_t cmd_len = 0; - uint8_t downlink_mode = 0; - + uint8_t cmd_len = 0; + uint8_t downlink_mode = 0; + char cmdp = tolower(param_getchar(Cmd, 0)); - if (cmdp == 'r') { - downlink_mode = param_getchar(Cmd, 1) - '0'; - if (downlink_mode > 3) downlink_mode = 0; - cmd_len = 3; - } + if (cmdp == 'r') { + downlink_mode = param_getchar(Cmd, 1) - '0'; + if (downlink_mode > 3) downlink_mode = 0; + cmd_len = 3; + } if ((strlen(Cmd) != cmd_len) || (cmdp == 'h')) return usage_t55xx_trace(); - + if (strlen(Cmd) == cmd_len) { // sanity check. if (SanityOfflineCheck(false) != PM3_SUCCESS) return PM3_ENODATA; bool pwdmode = false; uint32_t password = 0; -// REGULAR_READ_MODE_BLOCK - yeilds correct Page 1 Block 2 data i.e. + 32 bit offset. +// REGULAR_READ_MODE_BLOCK - yeilds correct Page 1 Block 2 data i.e. + 32 bit offset. // if (!AquireData(T55x7_PAGE1, T55x7_TRACE_BLOCK1, pwdmode, password,downlink_mode)) - if (!AquireData(T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password,downlink_mode)) + if (!AquireData(T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password, downlink_mode)) return PM3_ENODATA; } @@ -1497,9 +1505,9 @@ static int CmdT55xxInfo(const char *Cmd) { */ bool frombuff = false, gotdata = false, dataasq5 = false; uint8_t cmdp = 0; - uint8_t downlink_mode = 0; + uint8_t downlink_mode = 0; uint32_t block0 = 0; - + while (param_getchar(Cmd, cmdp) != 0x00) { switch (tolower(param_getchar(Cmd, cmdp))) { case 'h': @@ -1517,11 +1525,11 @@ static int CmdT55xxInfo(const char *Cmd) { dataasq5 = true; cmdp += 2; break; - case 'r': - downlink_mode = param_getchar(Cmd, cmdp+1)- '0'; - if (downlink_mode > 3) downlink_mode = 0; - cmdp += 2; - break; + case 'r': + downlink_mode = param_getchar(Cmd, cmdp + 1) - '0'; + if (downlink_mode > 3) downlink_mode = 0; + cmdp += 2; + break; default: PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); return usage_t55xx_info(); @@ -1540,7 +1548,7 @@ static int CmdT55xxInfo(const char *Cmd) { bool pwdmode = false; uint32_t password = 0; - if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password,downlink_mode)) + if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password, downlink_mode)) return PM3_ENODATA; } if (!gotdata) { @@ -1637,19 +1645,19 @@ static int CmdT55xxDump(const char *Cmd) { uint32_t password = 0; uint8_t override = false; - uint8_t cmd_opt_idx = 0; - uint8_t downlink_mode = 0; - uint8_t pwd_offset = 0; + uint8_t cmd_opt_idx = 0; + uint8_t downlink_mode = 0; + uint8_t pwd_offset = 0; char cmdp = tolower(param_getchar(Cmd, 0)); - + if (cmdp == 'h') return usage_t55xx_dump(); - if (cmdp == 'r') { - cmd_opt_idx++; - downlink_mode = param_getchar(Cmd, cmd_opt_idx++) - '0'; - if (downlink_mode > 3) downlink_mode = 0; - pwd_offset = 3; - } + if (cmdp == 'r') { + cmd_opt_idx++; + downlink_mode = param_getchar(Cmd, cmd_opt_idx++) - '0'; + if (downlink_mode > 3) downlink_mode = 0; + pwd_offset = 3; + } bool usepwd = (strlen(Cmd) > pwd_offset); if (usepwd) { password = param_get32ex(Cmd, cmd_opt_idx++, 0, 16); @@ -1659,14 +1667,14 @@ static int CmdT55xxDump(const char *Cmd) { printT5xxHeader(0); for (uint8_t i = 0; i < 8; ++i) { - T55xxReadBlock(i, 0, usepwd, override, password,downlink_mode); - // idea for better user experience and display. - // only show override warning on the first block read - if (override) override |= 2; // flag not to show safty for 2nd and on. - } + T55xxReadBlock(i, 0, usepwd, override, password, downlink_mode); + // idea for better user experience and display. + // only show override warning on the first block read + if (override) override |= 2; // flag not to show safty for 2nd and on. + } printT5xxHeader(1); for (uint8_t i = 0; i < 4; i++) - T55xxReadBlock(i, 1, usepwd, override, password,downlink_mode); + T55xxReadBlock(i, 1, usepwd, override, password, downlink_mode); return PM3_SUCCESS; } @@ -1683,14 +1691,14 @@ bool AquireData(uint8_t page, uint8_t block, bool pwdmode, uint32_t password, ui uint8_t blockno; uint8_t page; bool pwdmode; - uint8_t downlink_mode; + uint8_t downlink_mode; } PACKED; struct p payload; payload.password = password; payload.blockno = block; payload.page = page & 0x1; payload.pwdmode = pwdmode; - payload.downlink_mode = downlink_mode; + payload.downlink_mode = downlink_mode; clearCommandBuffer(); SendCommandNG(CMD_T55XX_READ_BLOCK, (uint8_t *)&payload, sizeof(payload)); @@ -1951,17 +1959,17 @@ static void t55x7_create_config_block(int tagtype) { static int CmdResetRead(const char *Cmd) { - uint8_t downlink_mode = 0; - uint8_t flags = 0; - - - if (strlen (Cmd) == 3) - downlink_mode = param_getchar(Cmd, 1) - '0'; - - if (downlink_mode > 3) downlink_mode = 0; - - printf ("DL : %d\n",downlink_mode); - flags = downlink_mode << 3; + uint8_t downlink_mode = 0; + uint8_t flags = 0; + + + if (strlen(Cmd) == 3) + downlink_mode = param_getchar(Cmd, 1) - '0'; + + if (downlink_mode > 3) downlink_mode = 0; + + printf("DL : %d\n", downlink_mode); + flags = downlink_mode << 3; clearCommandBuffer(); SendCommandNG(CMD_T55XX_RESET_READ, &flags, sizeof(flags)); if (!WaitForResponseTimeout(CMD_ACK, NULL, 2500)) { @@ -2019,44 +2027,44 @@ static bool IsCancelled(void) { // load a default pwd file. static int CmdT55xxChkPwds(const char *Cmd) { - char filename[FILE_PATH_SIZE] = {0}; - bool found = false; - uint8_t timeout = 0; - uint8_t *keyBlock = NULL; - bool from_flash = false; - bool try_all_dl_modes = false; - uint8_t downlink_mode = 0; - int len; - char cmdp; - bool use_pwd_file = false; - int dl_mode; // to try each downlink mode for each password - - - cmdp = tolower(param_getchar(Cmd,0)); - - if (cmdp == 'h') return usage_t55xx_chk(); - if (cmdp == 'm') { - from_flash = true; - Cmd +=2; - cmdp = tolower(param_getchar(Cmd,0)); - } - if (cmdp == 'r') { - Cmd += 2; - downlink_mode = param_getchar(Cmd,0 ) - '0'; // get 2nd option, as this is fixed order. - if (downlink_mode == 4) try_all_dl_modes = true; - if (downlink_mode > 3) downlink_mode = 0; - Cmd += 2; - cmdp = param_getchar(Cmd,0); - } - if (cmdp == 'i') { - Cmd+=2; - len = strlen(Cmd); - if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE; - memcpy(filename, Cmd, len); - use_pwd_file = true; - } - - + char filename[FILE_PATH_SIZE] = {0}; + bool found = false; + uint8_t timeout = 0; + uint8_t *keyBlock = NULL; + bool from_flash = false; + bool try_all_dl_modes = false; + uint8_t downlink_mode = 0; + int len; + char cmdp; + bool use_pwd_file = false; + int dl_mode; // to try each downlink mode for each password + + + cmdp = tolower(param_getchar(Cmd, 0)); + + if (cmdp == 'h') return usage_t55xx_chk(); + if (cmdp == 'm') { + from_flash = true; + Cmd += 2; + cmdp = tolower(param_getchar(Cmd, 0)); + } + if (cmdp == 'r') { + Cmd += 2; + downlink_mode = param_getchar(Cmd, 0) - '0'; // get 2nd option, as this is fixed order. + if (downlink_mode == 4) try_all_dl_modes = true; + if (downlink_mode > 3) downlink_mode = 0; + Cmd += 2; + cmdp = param_getchar(Cmd, 0); + } + if (cmdp == 'i') { + Cmd += 2; + len = strlen(Cmd); + if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE; + memcpy(filename, Cmd, len); + use_pwd_file = true; + } + + /* // block 7, page1 = false, usepwd = false, override = false, pwd = 00000000 @@ -2069,8 +2077,8 @@ static int CmdT55xxChkPwds(const char *Cmd) { */ uint64_t t1 = msclock(); - uint8_t flags = downlink_mode << 3; - + uint8_t flags = downlink_mode << 3; + if (from_flash) { clearCommandBuffer(); SendCommandNG(CMD_T55XX_CHKPWDS, &flags, sizeof(flags)); @@ -2089,11 +2097,11 @@ static int CmdT55xxChkPwds(const char *Cmd) { if (resp.oldarg[0]) { PrintAndLogEx(SUCCESS, "\nFound a candidate [ " _YELLOW_("%08X") " ]. Trying to validate", resp.oldarg[1]); - if (AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, resp.oldarg[1],downlink_mode)) { + if (AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, resp.oldarg[1], downlink_mode)) { found = tryDetectModulation(); if (found) { PrintAndLogEx(SUCCESS, "Found valid password: [ " _GREEN_("%08X") " ]", resp.oldarg[1]); - T55xx_Print_DownlinkMode (downlink_mode); + T55xx_Print_DownlinkMode(downlink_mode); } else { PrintAndLogEx(WARNING, "Check pwd failed"); @@ -2143,25 +2151,25 @@ static int CmdT55xxChkPwds(const char *Cmd) { curr_password = bytes_to_num(keyBlock + 4 * c, 4); PrintAndLogEx(INFO, "Testing %08X", curr_password); - for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++){ - - if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, curr_password,dl_mode)) { - continue; - } + for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++) { - found = tryDetectModulation(); - if (found) { - PrintAndLogEx(SUCCESS, "Found valid password: [ " _GREEN_("%08X") " ]", curr_password); - T55xx_Print_DownlinkMode (dl_mode); - dl_mode = 4; // Exit other downlink mode checks - c = keycount; // Exit loop - } - - if (!try_all_dl_modes) // Exit loop if not trying all downlink modes - dl_mode = 4; - } - } - if (!found) PrintAndLogEx(WARNING, "Check pwd failed"); + if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, curr_password, dl_mode)) { + continue; + } + + found = tryDetectModulation(); + if (found) { + PrintAndLogEx(SUCCESS, "Found valid password: [ " _GREEN_("%08X") " ]", curr_password); + T55xx_Print_DownlinkMode(dl_mode); + dl_mode = 4; // Exit other downlink mode checks + c = keycount; // Exit loop + } + + if (!try_all_dl_modes) // Exit loop if not trying all downlink modes + dl_mode = 4; + } + } + if (!found) PrintAndLogEx(WARNING, "Check pwd failed"); } free(keyBlock); @@ -2178,19 +2186,19 @@ static int CmdT55xxBruteForce(const char *Cmd) { uint32_t start_password = 0x00000000; //start password uint32_t end_password = 0xFFFFFFFF; //end password uint32_t curr = 0; - uint8_t downlink_mode = 0; - uint8_t cmd_opt_idx = 0; + uint8_t downlink_mode = 0; + uint8_t cmd_opt_idx = 0; uint8_t found = 0; // > 0 if found xx1 xx downlink needed, 1 found char cmdp = tolower(param_getchar(Cmd, cmd_opt_idx)); if (cmdp == 'h') return usage_t55xx_bruteforce(); - if (cmdp == 'r') { // downlink mode supplied - cmd_opt_idx++; // skip over 'r' - downlink_mode = param_getchar (Cmd,cmd_opt_idx++) - '0'; - if (downlink_mode > 4) downlink_mode = 0; - } - + if (cmdp == 'r') { // downlink mode supplied + cmd_opt_idx++; // skip over 'r' + downlink_mode = param_getchar(Cmd, cmd_opt_idx++) - '0'; + if (downlink_mode > 4) downlink_mode = 0; + } + uint64_t t1 = msclock(); @@ -2214,7 +2222,7 @@ static int CmdT55xxBruteForce(const char *Cmd) { return PM3_EOPABORTED; } - found = tryOnePassword(curr,downlink_mode); + found = tryOnePassword(curr, downlink_mode); if (curr == end_password) break; @@ -2225,10 +2233,9 @@ static int CmdT55xxBruteForce(const char *Cmd) { PrintAndLogEx(NORMAL, ""); if (found) { - PrintAndLogEx(SUCCESS, "Found valid password: [ " _GREEN_("%08X") "]", curr-1); - T55xx_Print_DownlinkMode ((found >> 1) & 3); - } - else + PrintAndLogEx(SUCCESS, "Found valid password: [ " _GREEN_("%08X") "]", curr - 1); + T55xx_Print_DownlinkMode((found >> 1) & 3); + } else PrintAndLogEx(WARNING, "Bruteforce failed, last tried: [ " _YELLOW_("%08X") " ]", curr); t1 = msclock() - t1; @@ -2237,31 +2244,30 @@ static int CmdT55xxBruteForce(const char *Cmd) { } uint8_t tryOnePassword(uint32_t password, uint8_t downlink_mode) { - - bool try_all_dl_modes = false; - uint8_t dl_mode = 0; - - PrintAndLogEx(INFO, "Trying password %08X", password); - if (downlink_mode == 4) try_all_dl_modes = true; - - downlink_mode = (downlink_mode & 3); // ensure 0-3 - - // check if dl mode 4 and loop if needed - for (dl_mode = downlink_mode; dl_mode < 4; dl_mode++){ + bool try_all_dl_modes = false; + uint8_t dl_mode = 0; - AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, password,dl_mode); + PrintAndLogEx(INFO, "Trying password %08X", password); - // if (getSignalProperties()->isnoise == false) { - // } else { - if (tryDetectModulation()) - { - return 1 + (dl_mode << 1); - } - // } - if (!try_all_dl_modes) dl_mode = 4; - } - return 0; + if (downlink_mode == 4) try_all_dl_modes = true; + + downlink_mode = (downlink_mode & 3); // ensure 0-3 + + // check if dl mode 4 and loop if needed + for (dl_mode = downlink_mode; dl_mode < 4; dl_mode++) { + + AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, password, dl_mode); + + // if (getSignalProperties()->isnoise == false) { + // } else { + if (tryDetectModulation()) { + return 1 + (dl_mode << 1); + } + // } + if (!try_all_dl_modes) dl_mode = 4; + } + return 0; } static int CmdT55xxRecoverPW(const char *Cmd) { @@ -2270,25 +2276,25 @@ static int CmdT55xxRecoverPW(const char *Cmd) { uint32_t curr_password = 0x0; uint32_t prev_password = 0xffffffff; uint32_t mask = 0x0; - uint8_t downlink_mode = 0; + uint8_t downlink_mode = 0; uint8_t found = 0; - uint8_t cmd_opt_idx = 0; - + uint8_t cmd_opt_idx = 0; + char cmdp = tolower(param_getchar(Cmd, cmd_opt_idx)); if (cmdp == 'h') return usage_t55xx_recoverpw(); - if (cmdp == 'r') { // downlink mode supplied - cmd_opt_idx++; // skip over 'r' - downlink_mode = param_getchar (Cmd,cmd_opt_idx++) - '0'; - if (downlink_mode > 4) downlink_mode = 0; - } + if (cmdp == 'r') { // downlink mode supplied + cmd_opt_idx++; // skip over 'r' + downlink_mode = param_getchar(Cmd, cmd_opt_idx++) - '0'; + if (downlink_mode > 4) downlink_mode = 0; + } orig_password = param_get32ex(Cmd, cmd_opt_idx++, 0x51243648, 16); //password used by handheld cloners // first try fliping each bit in the expected password while (bit < 32) { curr_password = orig_password ^ (1u << bit); - found = tryOnePassword(curr_password,downlink_mode); + found = tryOnePassword(curr_password, downlink_mode); if (found > 0) // xx1 for found xx = dl mode used goto out; @@ -2313,7 +2319,7 @@ static int CmdT55xxRecoverPW(const char *Cmd) { continue; } - found = tryOnePassword(curr_password,downlink_mode); + found = tryOnePassword(curr_password, downlink_mode); if (found > 0) goto out; @@ -2335,7 +2341,7 @@ static int CmdT55xxRecoverPW(const char *Cmd) { bit++; continue; } - found = tryOnePassword(curr_password,downlink_mode); + found = tryOnePassword(curr_password, downlink_mode); if (found > 0) goto out; @@ -2352,9 +2358,8 @@ out: if (found > 0) { PrintAndLogEx(SUCCESS, "Found valid password: [ " _GREEN_("%08X") "]", curr_password); - T55xx_Print_DownlinkMode ((found >> 1) & 3); - } - else + T55xx_Print_DownlinkMode((found >> 1) & 3); + } else PrintAndLogEx(WARNING, "Recover pwd failed"); return PM3_SUCCESS; @@ -2371,7 +2376,7 @@ bool tryDetectP1(bool getData) { bool st = true; if (getData) { - if (!AquireData(T55x7_PAGE1, T55x7_TRACE_BLOCK1, false, 0,0)) + if (!AquireData(T55x7_PAGE1, T55x7_TRACE_BLOCK1, false, 0, 0)) return false; } @@ -2477,12 +2482,12 @@ static int CmdT55xxDetectPage1(const char *Cmd) { bool errors = false; bool useGB = false; bool usepwd = false; - bool try_all_dl_modes = false; - uint8_t found = 0; + bool try_all_dl_modes = false; + uint8_t found = 0; uint32_t password = 0; uint8_t cmdp = 0; - uint8_t downlink_mode = 0; - uint8_t dl_mode = 0; + uint8_t downlink_mode = 0; + uint8_t dl_mode = 0; while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { switch (tolower(param_getchar(Cmd, cmdp))) { @@ -2498,12 +2503,12 @@ static int CmdT55xxDetectPage1(const char *Cmd) { useGB = true; cmdp++; break; - case 'r': - downlink_mode = param_getchar(Cmd, cmdp+1) - '0'; - if (downlink_mode == 4) try_all_dl_modes = true; - if (downlink_mode > 3) downlink_mode = 0; - cmdp +=2; - break; + case 'r': + downlink_mode = param_getchar(Cmd, cmdp + 1) - '0'; + if (downlink_mode == 4) try_all_dl_modes = true; + if (downlink_mode > 3) downlink_mode = 0; + cmdp += 2; + break; default: PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); errors = true; @@ -2513,29 +2518,26 @@ static int CmdT55xxDetectPage1(const char *Cmd) { if (errors) return usage_t55xx_detectP1(); if (!useGB) { - for (dl_mode = downlink_mode; dl_mode < 4; dl_mode++) { - found = AquireData(T55x7_PAGE1, T55x7_TRACE_BLOCK1, usepwd, password,dl_mode); + for (dl_mode = downlink_mode; dl_mode < 4; dl_mode++) { + found = AquireData(T55x7_PAGE1, T55x7_TRACE_BLOCK1, usepwd, password, dl_mode); //return PM3_ENODATA; - if (tryDetectP1(false)) //tryDetectModulation()) - { - found = dl_mode; - dl_mode = 4; - } - else found = false; + if (tryDetectP1(false)) { //tryDetectModulation()) + found = dl_mode; + dl_mode = 4; + } else found = false; - if (!try_all_dl_modes) dl_mode = 4; - } - - } + if (!try_all_dl_modes) dl_mode = 4; + } + + } if (useGB) found = tryDetectP1(false); - if (found) { - PrintAndLogEx(SUCCESS, "T55xx chip found!"); - T55xx_Print_DownlinkMode (found); - } - else - PrintAndLogEx(WARNING, "Could not detect modulation automatically. Try setting it manually with " _YELLOW_("\'lf t55xx config\'")); + if (found) { + PrintAndLogEx(SUCCESS, "T55xx chip found!"); + T55xx_Print_DownlinkMode(found); + } else + PrintAndLogEx(WARNING, "Could not detect modulation automatically. Try setting it manually with " _YELLOW_("\'lf t55xx config\'")); return PM3_SUCCESS; @@ -2546,9 +2548,9 @@ static int CmdT55xxSetDeviceConfig(const char *Cmd) { uint8_t write0 = 0, write1 = 0, write2 = 0, write3 = 0; bool errors = false, shall_persist = false; uint8_t cmdp = 0; - uint8_t downlink_mode = 0; - bool erase = false; - + uint8_t downlink_mode = 0; + bool erase = false; + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { switch (tolower(param_getchar(Cmd, cmdp))) { case 'h': @@ -2583,7 +2585,7 @@ static int CmdT55xxSetDeviceConfig(const char *Cmd) { break; case 'r': downlink_mode = param_getchar(Cmd, cmdp + 1) - '0'; - if (downlink_mode > 3) downlink_mode = 0; + if (downlink_mode > 3) downlink_mode = 0; cmdp += 2; break; case 'p': @@ -2604,23 +2606,22 @@ static int CmdT55xxSetDeviceConfig(const char *Cmd) { //Validations if (errors || cmdp == 0) return usage_lf_deviceconfig(); -// printf ("DLmode %d\n",downlink_mode); +// printf ("DLmode %d\n",downlink_mode); t55xx_config conf = {0}; - printf ("Size conf %zu\n",sizeof(conf)); - if (erase) { - memset (&conf,0xff, sizeof(conf)); - printf ("Conf.m[0] %x\n",conf.m[0].start_gap); - } - else { - - conf.m[downlink_mode].start_gap = startgap * 8; - conf.m[downlink_mode].write_gap = writegap * 8; - conf.m[downlink_mode].write_0 = write0 * 8; - conf.m[downlink_mode].write_1 = write1 * 8; - conf.m[downlink_mode].write_2 = write2 * 8; - conf.m[downlink_mode].write_3 = write3 * 8; - conf.m[downlink_mode].read_gap = readgap * 8; - } + printf("Size conf %zu\n", sizeof(conf)); + if (erase) { + memset(&conf, 0xff, sizeof(conf)); + printf("Conf.m[0] %x\n", conf.m[0].start_gap); + } else { + + conf.m[downlink_mode].start_gap = startgap * 8; + conf.m[downlink_mode].write_gap = writegap * 8; + conf.m[downlink_mode].write_0 = write0 * 8; + conf.m[downlink_mode].write_1 = write1 * 8; + conf.m[downlink_mode].write_2 = write2 * 8; + conf.m[downlink_mode].write_3 = write3 * 8; + conf.m[downlink_mode].read_gap = readgap * 8; + } clearCommandBuffer(); SendCommandOLD(CMD_SET_LF_T55XX_CONFIG, shall_persist, 0, 0, &conf, sizeof(t55xx_config)); return PM3_SUCCESS; diff --git a/client/scripting.c b/client/scripting.c index 703feffa4..4a2ff28d6 100644 --- a/client/scripting.c +++ b/client/scripting.c @@ -903,7 +903,7 @@ static int l_T55xx_readblock(lua_State *L) { // try reading the config block and verify that PWD bit is set before doing this! if (!override) { - if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0,0)) { + if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0, 0)) { return returnToLuaWithError(L, "Failed to read config block"); } @@ -920,7 +920,7 @@ static int l_T55xx_readblock(lua_State *L) { } } - if (!AquireData(usepage1, block, usepwd, password,0)) { + if (!AquireData(usepage1, block, usepwd, password, 0)) { return returnToLuaWithError(L, "Failed to aquire data from card"); } @@ -977,7 +977,7 @@ static int l_T55xx_detect(lua_State *L) { if (!useGB) { - isok = AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password,0); + isok = AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password, 0); if (isok == false) { return returnToLuaWithError(L, "Failed to aquire LF signal data"); } diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index ded330e1e..63054d3a1 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -129,20 +129,20 @@ typedef struct { } t55xx_config; */ -// Extended to support 1 of 4 timing +// Extended to support 1 of 4 timing typedef struct { - uint16_t start_gap ; - uint16_t write_gap ; - uint16_t write_0 ; - uint16_t write_1 ; - uint16_t write_2 ; - uint16_t write_3 ; - uint16_t read_gap ; + uint16_t start_gap ; + uint16_t write_gap ; + uint16_t write_0 ; + uint16_t write_1 ; + uint16_t write_2 ; + uint16_t write_3 ; + uint16_t read_gap ; } t55xx_config_t; // This setup will allow for the 4 downlink modes "m" as well as other items if needed. // Given the one struct we can then read/write to flash/client in one go. typedef struct { - t55xx_config_t m[4]; // mode + t55xx_config_t m[4]; // mode } t55xx_config; /*typedef struct {