mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-08-14 10:36:58 -07:00
updates to lf t55xx commands
fix wakeup cmd per @iceman1001 fix dump and read cmds clean up write command allow page 1 read/write (block 3 is writable)(ata5577 only) remove duplicate code
This commit is contained in:
parent
8e99ec25ed
commit
be2d41b73a
10 changed files with 321 additions and 217 deletions
|
@ -980,9 +980,12 @@ void UsbPacketReceived(uint8_t *packet, int len)
|
|||
case CMD_T55XX_WRITE_BLOCK:
|
||||
T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
|
||||
break;
|
||||
case CMD_T55XX_READ_TRACE:
|
||||
T55xxReadTrace();
|
||||
case CMD_T55XX_WAKEUP:
|
||||
T55xxWakeUp(c->arg[0]);
|
||||
break;
|
||||
//case CMD_T55XX_READ_TRACE:
|
||||
// T55xxReadTrace();
|
||||
// break;
|
||||
case CMD_PCF7931_READ:
|
||||
ReadPCF7931();
|
||||
break;
|
||||
|
|
|
@ -81,7 +81,9 @@ void CopyIndala64toT55x7(int hi, int lo); // Clone Indala 64-bit tag by UID to T
|
|||
void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int uid6, int uid7); // Clone Indala 224-bit tag by UID to T55x7
|
||||
void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode);
|
||||
void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd);
|
||||
void T55xxReadTrace(void);
|
||||
void T55xxWakeUp(uint32_t Pwd);
|
||||
void TurnReadLFOn();
|
||||
//void T55xxReadTrace(void);
|
||||
void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode);
|
||||
void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode);
|
||||
|
||||
|
|
|
@ -1160,9 +1160,10 @@ void T55xxWriteBit(int bit) {
|
|||
}
|
||||
|
||||
// Write one card block in page 0, no lock
|
||||
void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode) {
|
||||
void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
|
||||
LED_A_ON();
|
||||
|
||||
bool PwdMode = arg & 0x1;
|
||||
uint8_t Page = (arg & 0x2)>>1;
|
||||
uint32_t i = 0;
|
||||
|
||||
// Set up FPGA, 125kHz
|
||||
|
@ -1174,8 +1175,8 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMod
|
|||
|
||||
// Opcode 10
|
||||
T55xxWriteBit(1);
|
||||
T55xxWriteBit(0); //Page 0
|
||||
if (PwdMode == 1){
|
||||
T55xxWriteBit(Page); //Page 0
|
||||
if (PwdMode){
|
||||
// Send Pwd
|
||||
for (i = 0x80000000; i != 0; i >>= 1)
|
||||
T55xxWriteBit(Pwd & i);
|
||||
|
@ -1194,6 +1195,10 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMod
|
|||
// Perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
|
||||
// so wait a little more)
|
||||
TurnReadLFOn(20 * 1000);
|
||||
//could attempt to do a read to confirm write took
|
||||
// as the tag should repeat back the new block
|
||||
// until it is reset, but to confirm it we would
|
||||
// need to know the current block 0 config mode
|
||||
|
||||
// turn field off
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
|
@ -1204,9 +1209,10 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMod
|
|||
// Read one card block in page 0
|
||||
void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
||||
LED_A_ON();
|
||||
uint8_t PwdMode = arg0 & 0xFF;
|
||||
uint8_t wake = arg0 >> 8;
|
||||
bool PwdMode = arg0 & 0x1;
|
||||
uint8_t Page = (arg0 & 0x2) >> 1;
|
||||
uint32_t i = 0;
|
||||
bool RegReadMode = (Block == 0xFF);
|
||||
|
||||
//clear buffer now so it does not interfere with timing later
|
||||
BigBuf_Clear_ext(false);
|
||||
|
@ -1223,7 +1229,7 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
|||
SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
|
||||
|
||||
// Now set up the SSC to get the ADC samples that are now streaming at us.
|
||||
FpgaSetupSsc();
|
||||
FpgaSetpSsc();
|
||||
|
||||
// Give it a bit of time for the resonant antenna to settle.
|
||||
//SpinDelayUs(8*200); //192FC
|
||||
|
@ -1236,23 +1242,20 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
|||
|
||||
// Opcode 10
|
||||
T55xxWriteBit(1);
|
||||
T55xxWriteBit(0); //Page 0
|
||||
T55xxWriteBit(Page); //Page 0
|
||||
|
||||
if (PwdMode || wake){
|
||||
if (PwdMode){
|
||||
// Send Pwd
|
||||
for (i = 0x80000000; i != 0; i >>= 1)
|
||||
T55xxWriteBit(Pwd & i);
|
||||
}
|
||||
// Send a zero bit separation
|
||||
T55xxWriteBit(0);
|
||||
|
||||
// reading a block - send rest of read block cmd else skip for wake command
|
||||
if (!wake) {
|
||||
// Send a zero bit separation
|
||||
T55xxWriteBit(0);
|
||||
|
||||
// Send Block number
|
||||
// Send Block number (if direct access mode)
|
||||
if (!RegReadMode)
|
||||
for (i = 0x04; i != 0; i >>= 1)
|
||||
T55xxWriteBit(Block & i);
|
||||
}
|
||||
|
||||
// Turn field on to read the response
|
||||
TurnReadLFOn(READ_GAP);
|
||||
|
@ -1266,6 +1269,7 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
|||
LED_A_OFF();
|
||||
}
|
||||
|
||||
/*
|
||||
// Read card traceability data (page 1)
|
||||
void T55xxReadTrace(void){
|
||||
LED_A_ON();
|
||||
|
@ -1295,6 +1299,29 @@ void T55xxReadTrace(void){
|
|||
cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
LED_A_OFF();
|
||||
}
|
||||
*/
|
||||
void T55xxWakeUp(uint32_t Pwd){
|
||||
LED_B_ON();
|
||||
uint32_t i = 0;
|
||||
|
||||
// Set up FPGA, 125kHz
|
||||
LFSetupFPGAForADC(95, true);
|
||||
|
||||
// Trigger T55x7 Direct Access Mode
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
SpinDelayUs(START_GAP);
|
||||
|
||||
// Opcode 10
|
||||
T55xxWriteBit(1);
|
||||
T55xxWriteBit(0); //Page 0
|
||||
|
||||
// Send Pwd
|
||||
for (i = 0x80000000; i != 0; i >>= 1)
|
||||
T55xxWriteBit(Pwd & i);
|
||||
|
||||
// Turn and leave field on to let the begin repeating transmission
|
||||
TurnReadLFOn(20*1000);
|
||||
}
|
||||
|
||||
/*-------------- Cloning routines -----------*/
|
||||
// Copy HID id to card and setup block 0 config
|
||||
|
|
|
@ -272,20 +272,24 @@ void doT55x7Acquisition(void){
|
|||
bool highFound = false;
|
||||
uint8_t curSample = 0;
|
||||
uint8_t firstSample = 0;
|
||||
for(;;) {
|
||||
uint16_t skipCnt = 0;
|
||||
while(!BUTTON_PRESS() && skipCnt<1000) {
|
||||
WDT_HIT();
|
||||
if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
|
||||
AT91C_BASE_SSC->SSC_THR = 0x43;
|
||||
LED_D_ON();
|
||||
}
|
||||
if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
|
||||
curSample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
|
||||
LED_D_OFF();
|
||||
|
||||
// find first high sample
|
||||
if (!startFound && curSample > T55xx_READ_UPPER_THRESHOLD) {
|
||||
if (curSample > firstSample)
|
||||
firstSample = curSample;
|
||||
highFound = true;
|
||||
} else if (!highFound) {
|
||||
skipCnt++;
|
||||
continue;
|
||||
}
|
||||
|
||||
|
@ -295,9 +299,9 @@ void doT55x7Acquisition(void){
|
|||
dest[i++] = firstSample;
|
||||
startFound = true;
|
||||
dest[i++] = curSample;
|
||||
LED_D_OFF();
|
||||
if (i >= bufsize) break;
|
||||
if (i >= bufsize-1) break;
|
||||
}
|
||||
}
|
||||
//skipCnt++;
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue