diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 897b5718d..cfbf3f219 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -1126,6 +1126,10 @@ static void PacketReceived(PacketCommandNG *packet) { em4x50_sim((em4x50_data_t *)packet->data.asBytes); break; } + case CMD_LF_EM4X50_STD_READ: { + em4x50_std_read(); + break; + } #endif #ifdef WITH_ISO15693 diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c index 9868ce6c2..14029803e 100644 --- a/armsrc/em4x50.c +++ b/armsrc/em4x50.c @@ -885,7 +885,7 @@ void em4x50_info(em4x50_data_t *etd) { bool bsuccess = false, blogin = false; uint8_t status = 0; uint32_t addresses = 0x00002100; // read from fwr = 0 to lwr = 33 (0x21) - uint32_t words[32] = {0x0}; + uint32_t words[EM4X50_NO_WORDS] = {0x0}; em4x50_setup_read(); @@ -915,7 +915,7 @@ void em4x50_read(em4x50_data_t *etd) { bool bsuccess = false, blogin = false; int now = 0; uint8_t status = 0; - uint32_t words[32] = {0x0}; + uint32_t words[EM4X50_NO_WORDS] = {0x0}; em4x50_setup_read(); @@ -1044,7 +1044,7 @@ void em4x50_write(em4x50_data_t *etd) { bool bsuccess = false, blogin = false; uint8_t status = 0; - uint32_t words[34] = {0x0}; + uint32_t words[EM4X50_NO_WORDS] = {0x0}; em4x50_setup_read(); @@ -1119,7 +1119,7 @@ void em4x50_wipe(uint32_t *password) { bool bsuccess = false; uint32_t addresses = 0x00001E01; // from fwr = 1 to lwr = 31 (0x1E) - uint32_t words[34] = {0x0}; + uint32_t words[EM4X50_NO_WORDS] = {0x0}; uint32_t zero = 0x0; em4x50_setup_read(); @@ -1268,7 +1268,7 @@ void em4x50_watch() { // read continuously and display standard reads of tag int now = 0; - uint32_t words[34] = {0x0}; + uint32_t words[EM4X50_NO_WORDS] = {0x0}; em4x50_setup_read(); @@ -1447,3 +1447,21 @@ void em4x50_sim(em4x50_data_t *etd) { lf_finalize(); reply_ng(CMD_LF_EM4X50_SIM, 1, 0, 0); } + +void em4x50_std_read(void) { + + // reads data that tag transmits "voluntarily" -> standard read mode + + int now = 0; + uint32_t words[EM4X50_NO_WORDS] = {0x0}; + + em4x50_setup_read(); + + // set gHigh and gLow + if (get_signalproperties() && find_em4x50_tag()) + standard_read(&now, words); + + LOW(GPIO_SSC_DOUT); + lf_finalize(); + reply_ng(CMD_LF_EM4X50_STD_READ, now, (uint8_t *)words, 4 * now); +} diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h index e286e91f7..75f663db2 100644 --- a/armsrc/em4x50.h +++ b/armsrc/em4x50.h @@ -30,5 +30,6 @@ void em4x50_reset(void); void em4x50_watch(void); void em4x50_restore(em4x50_data_t *etd); void em4x50_sim(em4x50_data_t *etd); +void em4x50_std_read(void); #endif /* EM4X50_H */ diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index fdf593fc5..3ae292848 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -663,6 +663,7 @@ static command_t CommandTable[] = { {"4x50_watch", CmdEM4x50Watch, IfPm3EM4x50, "read EM4x50 continously"}, {"4x50_restore",CmdEM4x50Restore, IfPm3EM4x50, "restore EM4x50 dump to tag"}, {"4x50_sim", CmdEM4x50Sim, IfPm3EM4x50, "simulate single EM4x50 word (uid)"}, + {"4x50_std_read",CmdEM4x50StdRead, IfPm3EM4x50, "show standard read mode data of EM4x50 tag"}, {NULL, NULL, NULL, NULL} }; diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c index a86650c2b..f1d51efd5 100644 --- a/client/src/cmdlfem4x50.c +++ b/client/src/cmdlfem4x50.c @@ -175,6 +175,17 @@ static int usage_lf_em4x50_sim(void) { PrintAndLogEx(NORMAL, ""); return PM3_SUCCESS; } +static int usage_lf_em4x50_std_read(void) { + PrintAndLogEx(NORMAL, "Show standard read mode data of EM4x50 tag. Tag must be on antenna."); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf em 4x50_std_read [h]"); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h - this help"); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, _YELLOW_(" lf em 4x50_std_read")); + PrintAndLogEx(NORMAL, ""); + return PM3_SUCCESS; +} static int loadFileEM4x50(const char *filename, uint8_t *data, size_t data_len) { @@ -426,7 +437,6 @@ int CmdEM4x50Write(const char *Cmd) { PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); errors = true; break; - } } @@ -1100,3 +1110,71 @@ int CmdEM4x50Sim(const char *Cmd) { return PM3_SUCCESS; } + +int CmdEM4x50StdRead(const char *Cmd) { + + bool errors = false; + uint8_t cmdp = 0; + int now = 0; + PacketResponseNG resp; + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + + switch (tolower(param_getchar(Cmd, cmdp))) { + + case 'h': + return usage_lf_em4x50_std_read(); + + default: + PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); + errors = true; + break; + } + } + + if (errors) + return usage_lf_em4x50_std_read(); + + // start + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X50_STD_READ, 0, 0); + if (!WaitForResponseTimeout(CMD_LF_EM4X50_STD_READ, &resp, TIMEOUT)) { + PrintAndLogEx(WARNING, "Timeout while waiting for reply."); + return PM3_ETIMEOUT; + } + + now = resp.status; + + // print response + if (now > 0) { + + em4x50_word_t words[EM4X50_NO_WORDS]; + + prepare_result(resp.data.asBytes, 0, now - 1, words); + + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, " # | word (msb) | word (lsb) "); + PrintAndLogEx(INFO, "----+-------------+-------------"); + + for (int i = 0; i < now; i++) { + + char r[30] = {0}; + for (int j = 3; j >= 0; j--) + sprintf(r + strlen(r), "%02x ", reflect8(words[i].byte[j])); + + PrintAndLogEx(INFO, " %2i | " _GREEN_("%s") "| %s", + i, + sprint_hex(words[i].byte, 4), + r + ); + } + + PrintAndLogEx(INFO, "----+-------------+-------------"); + PrintAndLogEx(SUCCESS, "Standard read " _GREEN_("ok")); + + } else { + PrintAndLogEx(FAILED, "Standard read " _RED_("failed")); + } + + return PM3_SUCCESS; +} diff --git a/client/src/cmdlfem4x50.h b/client/src/cmdlfem4x50.h index acadd2084..2eaeb8b86 100644 --- a/client/src/cmdlfem4x50.h +++ b/client/src/cmdlfem4x50.h @@ -30,5 +30,6 @@ int CmdEM4x50Reset(const char *Cmd); int CmdEM4x50Watch(const char *Cmd); int CmdEM4x50Restore(const char *Cmd); int CmdEM4x50Sim(const char *Cmd); +int CmdEM4x50StdRead(const char *Cmd); #endif diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index 8124cd82b..5f4abb85e 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -514,6 +514,7 @@ typedef struct { #define CMD_LF_EM4X50_WATCH 0x0248 #define CMD_LF_EM4X50_RESTORE 0x0249 #define CMD_LF_EM4X50_SIM 0x0250 +#define CMD_LF_EM4X50_STD_READ 0x0251 // Sampling configuration for LF reader/sniffer #define CMD_LF_SAMPLING_SET_CONFIG 0x021D #define CMD_LF_FSK_SIMULATE 0x021E