solved

armsrc/Standalone/Makefile.hal

@@ -35,6 +35,9 @@ define KNOWN_STANDALONE_DEFINITIONS
 | LF_SAMYRUN      | HID26 read/clone/sim                   |
 |                 | - Samy Kamkar                          |
 +----------------------------------------------------------+
+| LF_THAREXDE     | read and sim em4x50 tags               |
+| (RDV4 only)     |                                        |
++----------------------------------------------------------+
 | HF_14ASNIFF     | 14a sniff to flashmem                  |
 | (RDV4 only)     |                                        |
 +----------------------------------------------------------+
@@ -64,10 +67,10 @@ define KNOWN_STANDALONE_DEFINITIONS
 +----------------------------------------------------------+
 endef
 
-STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN
+STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE
-STANDALONE_MODES += HF_14ASNIFF HF_AVEFUL HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG
+STANDALONE_MODES += HF_14ASNIFF HF_BOG HF_COLIN HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_YOUNG
 STANDALONE_MODES_REQ_SMARTCARD :=
-STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
+STANDALONE_MODES_REQ_FLASH := LF_THAREXDE LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN
 ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)
     STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE)
     ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),)

armsrc/Standalone/Makefile.inc

@@ -68,4 +68,7 @@ endif
 # WITH_STANDALONE_HF_ICECLASS
 ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
     SRC_STANDALONE = hf_iceclass.c
+# WITH_STANDALONE_LF_THAREXDE
+ifneq (,$(findstring WITH_STANDALONE_LF_THAREXDE,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_tharexde.c
 endif

armsrc/appmain.c

@@ -1021,6 +1021,14 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x50_wipe((em4x50_data_t *)packet->data.asBytes);
             break;
         }
+        case CMD_LF_EM4X50_SIM: {
+            em4x50_sim((em4x50_data_t *)packet->data.asBytes);
+            break;
+        }
+        case CMD_LF_EM4X50_TEST: {
+            em4x50_test((em4x50_data_t *)packet->data.asBytes);
+            break;
+        }
 #endif
 
 #ifdef WITH_ISO15693

armsrc/em4x50.h

@@ -17,10 +17,16 @@ typedef struct {
     uint8_t sectors[34][7];
 } em4x50_tag_t;
 
+int em4x50_standalone_read(uint64_t *words);
+bool em4x50_sim_send_listen_window2(void);
+bool em4x50_sim_send_word3(uint32_t word);
+
 void em4x50_info(em4x50_data_t *etd);
 void em4x50_write(em4x50_data_t *etd);
 void em4x50_write_password(em4x50_data_t *etd);
 void em4x50_read(em4x50_data_t *etd);
 void em4x50_wipe(em4x50_data_t *etd);
+void em4x50_sim(em4x50_data_t *etd);
+void em4x50_test(em4x50_data_t *etd);
 
 #endif /* EM4X50_H */

armsrc/lfadc.h

@@ -31,6 +31,7 @@ void lf_wait_periods(size_t periods);
 void lf_init(bool reader, bool simulate);
 void lf_finalize(void);
 size_t lf_detect_field_drop(size_t max);
+
 bool lf_manchester_send_bytes(const uint8_t *frame, size_t frame_len);
 void lf_modulation(bool modulation);
 

client/src/cmdlfem4x.c

@@ -1397,6 +1397,8 @@ static command_t CommandTable[] = {
     {"4x50_write_password", CmdEM4x50WritePassword, IfPm3EM4x50, "change passwword of EM4x50 tag"},
     {"4x50_read",   CmdEM4x50Read,        IfPm3EM4x50,     "read word data from EM4x50"},
     {"4x50_wipe",   CmdEM4x50Wipe,        IfPm3EM4x50,     "wipe data from EM4x50"},
+    {"4x50_sim",    CmdEM4x50Sim,         IfPm3EM4x50,     "simulate EM4x50 tag"},
+    {"4x50_test",   CmdEM4x50Test,        IfPm3EM4x50,     "test functionality for EM4x50"},
     {NULL, NULL, NULL, NULL}
 };
 

client/src/cmdlfem4x50.c

@@ -93,7 +93,32 @@ static int usage_lf_em4x50_wipe(void) {
     PrintAndLogEx(NORMAL, "       h         - this help");
     PrintAndLogEx(NORMAL, "       p <pwd>   - password (hex)");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 4x50_wwipe p 11223344"));
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 4x50_wipe p 11223344"));
+    PrintAndLogEx(NORMAL, "");
+    return PM3_SUCCESS;
+}
+static int usage_lf_em4x50_sim(void) {
+    PrintAndLogEx(NORMAL, "Simulate EM4x50 tag. ");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "Usage:  lf em 4x50_sim [h] w <word>");
+    PrintAndLogEx(NORMAL, "Options:");
+    PrintAndLogEx(NORMAL, "       h         - this help");
+    PrintAndLogEx(NORMAL, "       w <word>  - word (hex)");
+    PrintAndLogEx(NORMAL, "Examples:");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 4x50_sim w 12345678"));
+    PrintAndLogEx(NORMAL, "");
+    return PM3_SUCCESS;
+}
+static int usage_lf_em4x50_test(void) {
+    PrintAndLogEx(NORMAL, "Test functionality for EM4x50 tag. ");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "Usage:  lf em 4x50_test [h] ...");
+    PrintAndLogEx(NORMAL, "Options:");
+    PrintAndLogEx(NORMAL, "       h         - this help");
+    PrintAndLogEx(NORMAL, "       c <0|1>   - carrier on|off (optional)");
+    PrintAndLogEx(NORMAL, "       b <byte>  - byte (hex) (optional)");
+    PrintAndLogEx(NORMAL, "Examples:");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 4x50_test ..."));
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
@@ -539,10 +564,10 @@ int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose) {
 
     uint8_t *data = resp.data.asBytes;
     em4x50_word_t words[EM4X50_NO_WORDS];
+    int now = (resp.status & STATUS_NO_WORDS) >> 2;
     if (edata.addr_given) {
         prepare_result(data, etd->address, etd->address, words);
     } else {
-        int now = (resp.status & STATUS_NO_WORDS) >> 2;
         prepare_result(data, 0, now - 1, words);
     }
 
@@ -550,7 +575,11 @@ int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose) {
         memcpy(out, &words, sizeof(em4x50_word_t) * EM4X50_NO_WORDS);
     }
 
-    print_result(words, etd->address, etd->address);
+    if (edata.addr_given)
+        print_result(words, etd->address, etd->address);
+    else
+        print_result(words, 0, now - 1);
+
     return PM3_SUCCESS;
 }
 
@@ -598,8 +627,9 @@ int CmdEM4x50Read(const char *Cmd) {
         }
     }
 
-    if (errors || strlen(Cmd) == 0 || etd.addr_given == false)
+    //if (errors || strlen(Cmd) == 0 || etd.addr_given == false)
-        return usage_lf_em4x50_read();
+    if (errors)
+         return usage_lf_em4x50_read();
 
     return em4x50_read(&etd, NULL, true);
 }
@@ -740,3 +770,132 @@ int CmdEM4x50Wipe(const char *Cmd) {
 
     return PM3_SUCCESS;
 }
+
+int CmdEM4x50Sim(const char *Cmd) {
+
+    // fills EM4x50 tag with zeros including password
+
+    bool errors = false, bword = false;
+    uint8_t cmdp = 0;
+    em4x50_data_t etd;
+    PacketResponseNG resp;
+
+    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+
+        switch (tolower(param_getchar(Cmd, cmdp))) {
+            case 'h':
+                return usage_lf_em4x50_sim();
+
+            case 'w': {
+                if (param_gethex(Cmd, cmdp + 1, etd.word, 8)) {
+                     PrintAndLogEx(FAILED, "\n  word has to be 8 hex symbols\n");
+                     return PM3_EINVARG;
+                }
+                bword = true;
+                cmdp += 2;
+                break;
+            }
+
+            case 'f': {
+                if (param_gethex(Cmd, cmdp + 1, etd.word, 8)) {
+                     PrintAndLogEx(FAILED, "\n  word has to be 8 hex symbols\n");
+                     return PM3_EINVARG;
+                }
+                bword = true;
+                cmdp += 2;
+                break;
+            }
+
+            default:
+                PrintAndLogEx(WARNING, "\nUnknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+                errors = true;
+                break;
+        }
+    }
+
+    if (errors || !bword)
+         return usage_lf_em4x50_sim();
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM4X50_SIM, (uint8_t *)&etd, sizeof(etd));
+
+    if (!WaitForResponse(CMD_ACK, &resp)) {
+        PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.\n");
+        return PM3_ETIMEOUT;
+    }
+
+    // print response
+    bool isOK = resp.status;
+    if (isOK) {
+        PrintAndLogEx(SUCCESS,"\nsimulation data " _GREEN_("ok") "\n");
+    } else {
+        PrintAndLogEx(FAILED,"\nsimulating data " _RED_("failed") "\n");
+        return PM3_ESOFT;
+    }
+
+    return PM3_SUCCESS;
+}
+
+int CmdEM4x50Test(const char *Cmd) {
+
+    // fills EM4x50 tag with zeros including password
+
+    bool errors = false;
+    uint8_t cmdp = 0;
+    em4x50_data_t etd;
+    PacketResponseNG resp;
+    
+    etd.carrier = 2;
+
+    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
+
+        switch (tolower(param_getchar(Cmd, cmdp))) {
+            case 'h':
+                return usage_lf_em4x50_test();
+
+            case 'c':
+                param_getdec(Cmd, cmdp + 1, &etd.carrier);
+                if (etd.carrier != 0 && etd.carrier != 1) {
+                    PrintAndLogEx(FAILED, "\ncarrier has to be either 0 or 1\n");
+                    return PM3_EINVARG;
+                }
+                cmdp += 2;
+                break;
+
+            case 'b':
+                if (param_gethex(Cmd, cmdp + 1, &etd.byte, 2)) {
+                    PrintAndLogEx(FAILED, "\nbyte has to be 2 hex symbols\n");
+                    return PM3_EINVARG;
+                }
+                cmdp += 2;
+                break;
+
+            default:
+                PrintAndLogEx(WARNING, "\nUnknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+                errors = true;
+                break;
+        }
+    }
+
+    if (errors)
+         return usage_lf_em4x50_test();
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM4X50_TEST, (uint8_t *)&etd, sizeof(etd));
+
+    if (!WaitForResponse(CMD_ACK, &resp)) {
+        PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.\n");
+        return PM3_ETIMEOUT;
+    }
+
+    // print response
+    bool isOK = resp.status;
+    if (isOK) {
+        PrintAndLogEx(SUCCESS,"\ntest " _GREEN_("ok") "\n");
+    } else {
+        PrintAndLogEx(FAILED,"\ntest " _RED_("failed") "\n");
+        return PM3_ESOFT;
+    }
+
+    return PM3_SUCCESS;
+}

client/src/cmdlfem4x50.h

@@ -24,5 +24,7 @@ int CmdEM4x50WritePassword(const char *Cmd);
 int CmdEM4x50Read(const char *Cmd);
 int CmdEM4x50Dump(const char *Cmd);
 int CmdEM4x50Wipe(const char *Cmd);
+int CmdEM4x50Sim(const char *Cmd);
+int CmdEM4x50Test(const char *Cmd);
 
 #endif

include/em4x50.h

@@ -44,6 +44,8 @@ typedef struct {
     bool addr_given;
     bool pwd_given;
     bool newpwd_given;
+    uint8_t carrier;
+    uint8_t byte;
     uint8_t password[4];
     uint8_t new_password[4];
     uint8_t addresses[4];

include/pm3_cmd.h

@@ -484,6 +484,8 @@ typedef struct {
 #define CMD_LF_EM4X50_WRITE_PASSWORD                                      0x0242
 #define CMD_LF_EM4X50_READ                                                0x0243
 #define CMD_LF_EM4X50_WIPE                                                0x0244
+#define CMD_LF_EM4X50_SIM                                                 0x0245
+#define CMD_LF_EM4X50_TEST                                                0x0246
 // Sampling configuration for LF reader/sniffer
 #define CMD_LF_SAMPLING_SET_CONFIG                                        0x021D
 #define CMD_LF_FSK_SIMULATE                                               0x021E