From e88096ba259b88d0dc2edfd0e77cde5b297e1bd8 Mon Sep 17 00:00:00 2001 From: marshmellow42 Date: Thu, 23 Feb 2017 13:53:40 -0500 Subject: [PATCH 1/4] cleanup combine preamble searches (thanks @iceman1001) simplify Em410xDecode fix bug in removeParity (I made recently) move Unique TAG ID printout to avoid confusion --- client/cmddata.c | 2 +- client/cmdlfem4x.c | 8 ++--- common/lfdemod.c | 87 +++++++++++++++++++--------------------------- common/lfdemod.h | 2 +- 4 files changed, 41 insertions(+), 58 deletions(-) diff --git a/client/cmddata.c b/client/cmddata.c index 2db1f8eb..f7addc53 100644 --- a/client/cmddata.c +++ b/client/cmddata.c @@ -175,8 +175,8 @@ void printEM410x(uint32_t hi, uint64_t id) } else{ //output 40 bit em id PrintAndLog("\nEM TAG ID : %010llX", id); - PrintAndLog("Unique TAG ID : %010llX", id2lo); PrintAndLog("\nPossible de-scramble patterns"); + PrintAndLog("Unique TAG ID : %010llX", id2lo); PrintAndLog("HoneyWell IdentKey {"); PrintAndLog("DEZ 8 : %08lld",id & 0xFFFFFF); PrintAndLog("DEZ 10 : %010lld",id & 0xFFFFFFFF); diff --git a/client/cmdlfem4x.c b/client/cmdlfem4x.c index 0788b138..c26b4f39 100644 --- a/client/cmdlfem4x.c +++ b/client/cmdlfem4x.c @@ -540,7 +540,7 @@ bool EM4x05testDemodReadData(uint32_t *word, bool readCmd) { // sanity check size = (size > DemodBufferLen) ? DemodBufferLen : size; // test preamble - if ( !onePreambleSearch(DemodBuffer, preamble, sizeof(preamble), size, &startIdx) ) { + if ( !preambleSearchEx(DemodBuffer, preamble, sizeof(preamble), &size, &startIdx, true) ) { if (g_debugMode) PrintAndLog("DEBUG: Error - EM4305 preamble not found :: %d", startIdx); return false; } @@ -550,13 +550,13 @@ bool EM4x05testDemodReadData(uint32_t *word, bool readCmd) { if (g_debugMode) PrintAndLog("DEBUG: Error - End Parity check failed"); return false; } - // test for even parity bits. - if ( removeParity(DemodBuffer, startIdx + sizeof(preamble),9,0,44) == 0 ) { + // test for even parity bits and remove them. (leave out the end row of parities so 36 bits) + if ( removeParity(DemodBuffer, startIdx + sizeof(preamble),9,0,36) == 0 ) { if (g_debugMode) PrintAndLog("DEBUG: Error - Parity not detected"); return false; } - setDemodBuf(DemodBuffer, 40, 0); + setDemodBuf(DemodBuffer, 32, 0); *word = bytebits_to_byteLSBF(DemodBuffer, 32); } return true; diff --git a/common/lfdemod.c b/common/lfdemod.c index e9f19311..e1fcbf73 100644 --- a/common/lfdemod.c +++ b/common/lfdemod.c @@ -78,7 +78,7 @@ size_t removeParity(uint8_t *BitStream, size_t startIdx, uint8_t pLen, uint8_t p parityWd = (parityWd << 1) | BitStream[startIdx+word+bit]; BitStream[j++] = (BitStream[startIdx+word+bit]); } - if (word+pLen >= bLen) break; + if (word+pLen > bLen) break; j--; // overwrite parity with next data // if parity fails then return 0 @@ -150,38 +150,28 @@ uint32_t bytebits_to_byteLSBF(uint8_t *src, size_t numbits) //search for given preamble in given BitStream and return success=1 or fail=0 and startIndex and length uint8_t preambleSearch(uint8_t *BitStream, uint8_t *preamble, size_t pLen, size_t *size, size_t *startIdx) { - // Sanity check. If preamble length is bigger than bitstream length. - if ( *size <= pLen ) return 0; - - uint8_t foundCnt=0; - for (int idx=0; idx < *size - pLen; idx++){ - if (memcmp(BitStream+idx, preamble, pLen) == 0){ - //first index found - foundCnt++; - if (foundCnt == 1){ - *startIdx = idx; - } - if (foundCnt == 2){ - *size = idx - *startIdx; - return 1; - } - } - } - return 0; + return (preambleSearchEx(BitStream, preamble, pLen, size, startIdx, false)) ? 1 : 0; } -// search for given preamble in given BitStream and return success=1 or fail=0 and startIndex (where it was found) -// does not look for a repeating preamble -// em4x05/4x69 only sends preamble once, so look for it once in the first pLen bits -// leave it generic so it could be reused later... -bool onePreambleSearch(uint8_t *BitStream, uint8_t *preamble, size_t pLen, size_t size, size_t *startIdx) { +// search for given preamble in given BitStream and return success=1 or fail=0 and startIndex (where it was found) and length if not fineone +// fineone does not look for a repeating preamble for em4x05/4x69 sends preamble once, so look for it once in the first pLen bits +bool preambleSearchEx(uint8_t *BitStream, uint8_t *preamble, size_t pLen, size_t *size, size_t *startIdx, bool findone) { // Sanity check. If preamble length is bigger than bitstream length. - if ( size <= pLen ) return false; - for (size_t idx = 0; idx < size - pLen; idx++) { + if ( *size <= pLen ) return false; + + uint8_t foundCnt = 0; + for (size_t idx = 0; idx < *size - pLen; idx++) { if (memcmp(BitStream+idx, preamble, pLen) == 0) { - if (g_debugMode) prnt("DEBUG: preamble found at %u", idx); - *startIdx = idx; - return true; + //first index found + foundCnt++; + if (foundCnt == 1) { + if (g_debugMode) prnt("DEBUG: preamble found at %u", idx); + *startIdx = idx; + if (findone) return true; + } else if (foundCnt == 2) { + *size = idx - *startIdx; + return true; + } } } return false; @@ -217,39 +207,32 @@ size_t findModStart(uint8_t dest[], size_t size, uint8_t threshold_value, uint8_ //takes 1s and 0s and searches for EM410x format - output EM ID uint8_t Em410xDecode(uint8_t *BitStream, size_t *size, size_t *startIdx, uint32_t *hi, uint64_t *lo) { - //no arguments needed - built this way in case we want this to be a direct call from "data " cmds in the future - // otherwise could be a void with no arguments - //set defaults - uint32_t i = 0; + //sanity checks + if (*size < 64) return 0; if (BitStream[1]>1) return 0; //allow only 1s and 0s // 111111111 bit pattern represent start of frame // include 0 in front to help get start pos uint8_t preamble[] = {0,1,1,1,1,1,1,1,1,1}; - uint32_t idx = 0; - uint32_t parityBits = 0; uint8_t errChk = 0; - uint8_t FmtLen = 10; + uint8_t FmtLen = 10; // sets of 4 bits = end data *startIdx = 0; errChk = preambleSearch(BitStream, preamble, sizeof(preamble), size, startIdx); if (errChk == 0 || *size < 64) return 0; - if (*size > 64) FmtLen = 22; - *startIdx += 1; //get rid of 0 from preamble - idx = *startIdx + 9; - for (i=0; i> 63); - *lo = (*lo << 1) | (BitStream[(i*5)+ii+idx]); - } + if (*size == 110) FmtLen = 22; // 22 sets of 4 bits + + //skip last 4bit parity row for simplicity + *size = removeParity(BitStream, *startIdx + sizeof(preamble), 5, 0, FmtLen * 5); + if (*size == 40) { // std em410x format + *hi = 0; + *lo = ((uint64_t)(bytebits_to_byte(BitStream, 8)) << 32) | (bytebits_to_byte(BitStream + 8, 32)); + } else if (*size == 88) { // long em format + *hi = (bytebits_to_byte(BitStream, 24)); + *lo = ((uint64_t)(bytebits_to_byte(BitStream + 24, 32)) << 32) | (bytebits_to_byte(BitStream + 24 + 32, 32)); + } else { + return 0; } - if (errChk != 0) return 1; - //skip last 5 bit parity test for simplicity. - // *size = 64 | 128; - return 0; + return 1; } //by marshmellow diff --git a/common/lfdemod.h b/common/lfdemod.h index 9c5c83fb..a77eb604 100644 --- a/common/lfdemod.h +++ b/common/lfdemod.h @@ -39,7 +39,7 @@ int manrawdecode(uint8_t *BitStream, size_t *size, uint8_t invert); int nrzRawDemod(uint8_t *dest, size_t *size, int *clk, int *invert); uint8_t parityTest(uint32_t bits, uint8_t bitLen, uint8_t pType); uint8_t preambleSearch(uint8_t *BitStream, uint8_t *preamble, size_t pLen, size_t *size, size_t *startIdx); -bool onePreambleSearch(uint8_t *BitStream, uint8_t *preamble, size_t pLen, size_t size, size_t *startIdx); +bool preambleSearchEx(uint8_t *BitStream, uint8_t *preamble, size_t pLen, size_t *size, size_t *startIdx, bool findone); int pskRawDemod(uint8_t dest[], size_t *size, int *clock, int *invert); void psk2TOpsk1(uint8_t *BitStream, size_t size); void psk1TOpsk2(uint8_t *BitStream, size_t size); From c85189135eac76e96a38d22062f422c8ccfb18aa Mon Sep 17 00:00:00 2001 From: marshmellow42 Date: Fri, 24 Feb 2017 01:02:25 -0500 Subject: [PATCH 2/4] the timeout on lf read makes the threshold ... option not work as expected.. need to find a more robust option... + added iceman's lf_em410x_sim help text.. --- client/cmdlf.c | 10 +++++----- client/cmdlfem4x.c | 21 +++++++++++++++------ 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/client/cmdlf.c b/client/cmdlf.c index 206d5355..5683a589 100644 --- a/client/cmdlf.c +++ b/client/cmdlf.c @@ -569,11 +569,11 @@ int CmdLFRead(const char *Cmd) UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K, {arg1,0,0}}; clearCommandBuffer(); SendCommand(&c); - //WaitForResponse(CMD_ACK,NULL); - if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) { - PrintAndLog("command execution time out"); - return 1; - } + WaitForResponse(CMD_ACK,NULL); + //if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) { + // PrintAndLog("command execution time out"); + // return 1; + //} return 0; } diff --git a/client/cmdlfem4x.c b/client/cmdlfem4x.c index c26b4f39..38bb5c5d 100644 --- a/client/cmdlfem4x.c +++ b/client/cmdlfem4x.c @@ -63,6 +63,20 @@ int CmdEM410xRead(const char *Cmd) return 1; } +int usage_lf_em410x_sim(void) { + PrintAndLog("Simulating EM410x tag"); + PrintAndLog(""); + PrintAndLog("Usage: lf em 410xsim [h] "); + PrintAndLog("Options:"); + PrintAndLog(" h - this help"); + PrintAndLog(" uid - uid (10 HEX symbols)"); + PrintAndLog(" clock - clock (32|64) (optional)"); + PrintAndLog("samples:"); + PrintAndLog(" lf em 410xsim 0F0368568B"); + PrintAndLog(" lf em 410xsim 0F0368568B 32"); + return 0; +} + // emulate an EM410X tag int CmdEM410xSim(const char *Cmd) { @@ -71,12 +85,7 @@ int CmdEM410xSim(const char *Cmd) char cmdp = param_getchar(Cmd, 0); uint8_t uid[5] = {0x00}; - if (cmdp == 'h' || cmdp == 'H') { - PrintAndLog("Usage: lf em 410xsim "); - PrintAndLog(""); - PrintAndLog(" sample: lf em 410xsim 0F0368568B"); - return 0; - } + if (cmdp == 'h' || cmdp == 'H') return usage_lf_em410x_sim(); /* clock is 64 in EM410x tags */ uint8_t clock = 64; From 2b11c7c75068f6e25da5cc4ed463ff78b2cc8900 Mon Sep 17 00:00:00 2001 From: marshmellow42 Date: Sun, 26 Feb 2017 21:44:40 -0500 Subject: [PATCH 3/4] adjust timeouts on lf read/lf search to no timeout if threshold was set. NOTE: lf snoop already doesn't have a timeout... also adjusted PRIx64 to SCNx64 in em410xwrite --- client/cmdlf.c | 23 ++++++++++++++--------- client/cmdlfem4x.c | 2 +- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/client/cmdlf.c b/client/cmdlf.c index 5683a589..dc7185cc 100644 --- a/client/cmdlf.c +++ b/client/cmdlf.c @@ -35,7 +35,7 @@ #include "cmdlfviking.h" // for viking menu #include "cmdlfcotag.h" // for COTAG menu - +bool threshold_set = false; static int CmdHelp(const char *Cmd); @@ -510,7 +510,10 @@ int CmdLFSetConfig(const char *Cmd) case 't': errors |= param_getdec(Cmd,cmdp+1,&unsigned_trigg); cmdp+=2; - if(!errors) trigger_threshold = unsigned_trigg; + if(!errors) { + trigger_threshold = unsigned_trigg; + if (trigger_threshold > 0) threshold_set = true; + } break; case 'b': errors |= param_getdec(Cmd,cmdp+1,&bps); @@ -557,7 +560,7 @@ int CmdLFSetConfig(const char *Cmd) int CmdLFRead(const char *Cmd) { - + if (offline) return 0; uint8_t cmdp = 0; bool arg1 = false; if (param_getchar(Cmd, cmdp) == 'h') @@ -569,12 +572,14 @@ int CmdLFRead(const char *Cmd) UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K, {arg1,0,0}}; clearCommandBuffer(); SendCommand(&c); - WaitForResponse(CMD_ACK,NULL); - //if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) { - // PrintAndLog("command execution time out"); - // return 1; - //} - + if (threshold_set) { + WaitForResponse(CMD_ACK,NULL); + } else { + if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) { + PrintAndLog("command execution time out"); + return 1; + } + } return 0; } diff --git a/client/cmdlfem4x.c b/client/cmdlfem4x.c index 38bb5c5d..f9103126 100644 --- a/client/cmdlfem4x.c +++ b/client/cmdlfem4x.c @@ -183,7 +183,7 @@ int CmdEM410xWrite(const char *Cmd) int card = 0xFF; // invalid card value unsigned int clock = 0; // invalid clock value - sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock); + sscanf(Cmd, "%" SCNx64 " %d %d", &id, &card, &clock); // Check ID if (id == 0xFFFFFFFFFFFFFFFF) { From fac69c3d76b04088c337365ee124f8db4c13a2f0 Mon Sep 17 00:00:00 2001 From: marshmellow42 Date: Mon, 27 Feb 2017 23:03:55 -0500 Subject: [PATCH 4/4] Adjust global variable name --- client/cmdlf.c | 6 +++--- common/lfdemod.c | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/client/cmdlf.c b/client/cmdlf.c index dc7185cc..2e786943 100644 --- a/client/cmdlf.c +++ b/client/cmdlf.c @@ -35,7 +35,7 @@ #include "cmdlfviking.h" // for viking menu #include "cmdlfcotag.h" // for COTAG menu -bool threshold_set = false; +bool g_lf_threshold_set = false; static int CmdHelp(const char *Cmd); @@ -512,7 +512,7 @@ int CmdLFSetConfig(const char *Cmd) cmdp+=2; if(!errors) { trigger_threshold = unsigned_trigg; - if (trigger_threshold > 0) threshold_set = true; + if (trigger_threshold > 0) g_lf_threshold_set = true; } break; case 'b': @@ -572,7 +572,7 @@ int CmdLFRead(const char *Cmd) UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K, {arg1,0,0}}; clearCommandBuffer(); SendCommand(&c); - if (threshold_set) { + if (g_lf_threshold_set) { WaitForResponse(CMD_ACK,NULL); } else { if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) { diff --git a/common/lfdemod.c b/common/lfdemod.c index e1fcbf73..f5fee22a 100644 --- a/common/lfdemod.c +++ b/common/lfdemod.c @@ -288,6 +288,7 @@ int cleanAskRawDemod(uint8_t *BinStream, size_t *size, int clk, int invert, int } //by marshmellow +//amplify based on ask edge detection void askAmp(uint8_t *BitStream, size_t size) { uint8_t Last = 128;