mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-07-14 01:03:01 -07:00
T55xx downlink Modes
Changes : - Added t55xx downlink protocols (long leading reference, leading 0 and 1 of 4) - Added function to all read to call differnet downlink functions (to match write) - Update functions to support using differnet downlink modes. - Added support for calling downlink modes for lf t55 read, write and detect - Added new function lf t55 bruteforcedl to support downlink modes as well as try each mode for each password in password file. for functions with downlink mode extenstion. e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference, '2' Leading Zero, '3' 1 of 4
This commit is contained in:
mwalker33
parent
b8dd1ef649
commit
dd8e451330
3 changed files with 755 additions and 22 deletions
442
armsrc/lfops.c
442
armsrc/lfops.c
|
|
@ -1203,6 +1203,8 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
|
|||
#define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
|
||||
#define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550
|
||||
#define READ_GAP 15*8
|
||||
// Long Leading Reference
|
||||
#define Reference_llr (136+18)*8 // Needs to be WRITR_0 + 136 clocks.
|
||||
|
||||
void TurnReadLFOn(int delay) {
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
|
||||
|
|
@ -1220,6 +1222,265 @@ void T55xxWriteBit(int bit) {
|
|||
WaitUS(WRITE_GAP);
|
||||
}
|
||||
|
||||
void T55xxWrite_LLR (void)
|
||||
{
|
||||
TurnReadLFOn (Reference_llr);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
WaitUS(WRITE_GAP);
|
||||
}
|
||||
|
||||
#define START_GAPlz 31*8
|
||||
#define WRITE_GAPlz 20*8
|
||||
#define WRITElz_0 18*8
|
||||
#define WRITElz_1 40*8
|
||||
#define READ_GAP 15*8
|
||||
|
||||
void T55xxWriteBit_Leading0(int bit) {
|
||||
if (!bit)
|
||||
TurnReadLFOn(WRITElz_0);
|
||||
else
|
||||
TurnReadLFOn(WRITElz_1);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
WaitUS(WRITE_GAPlz);
|
||||
// WaitUS(160);
|
||||
}
|
||||
|
||||
#define START_GAP1of4 31*8 // SPEC: 1*8 to 50*8 - typ 10*8 (or 15fc)
|
||||
#define WRITE_GAP1of4 20*8 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc)
|
||||
// 00 = reference // 8 * 8 - - 68 * 8
|
||||
#define WRITE1of4_00 18*8 // SPEC: 8*8 to 68*8 - typ 24*8 (or 24fc)
|
||||
#define WRITE1of4_01 34*8 // SPEC: dref+9 - dref+16 - dref+24
|
||||
#define WRITE1of4_10 50*8 // SPEC: dref+25 - dref+32 - dref+40
|
||||
#define WRITE1of4_11 66*8 // SPEC: dref+41 - dref+48 - dref+56
|
||||
#define READ1of4_GAP 15*8
|
||||
|
||||
void T55xxWriteBit_1of4(int bits) {
|
||||
|
||||
switch (bits)
|
||||
{
|
||||
case 0 : TurnReadLFOn(WRITE1of4_00); break;
|
||||
case 1 : TurnReadLFOn(WRITE1of4_01); break;
|
||||
case 2 : TurnReadLFOn(WRITE1of4_10); break;
|
||||
case 3 : TurnReadLFOn(WRITE1of4_11); break;
|
||||
default:
|
||||
TurnReadLFOn(WRITE1of4_00);
|
||||
}
|
||||
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
WaitUS(WRITE_GAP1of4);
|
||||
// WaitUS(160);
|
||||
}
|
||||
|
||||
void T55xxWriteBlockExt_Leading0 (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
|
||||
|
||||
LED_A_ON();
|
||||
bool PwdMode = arg & 0x1;
|
||||
uint8_t Page = (arg & 0x2)>>1;
|
||||
bool testMode = arg & 0x4;
|
||||
uint32_t i = 0;
|
||||
|
||||
// Set up FPGA, 125kHz
|
||||
LFSetupFPGAForADC(95, true);
|
||||
StartTicks();
|
||||
// make sure tag is fully powered up...
|
||||
WaitMS(5);
|
||||
// Trigger T55x7 in mode.
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
|
||||
WaitUS(START_GAPlz);
|
||||
|
||||
|
||||
/*
|
||||
0 : Leading Zero
|
||||
11 : Opcode
|
||||
00 : Fixed 00 if protected write (i.e. have password)
|
||||
<32 bit Password>
|
||||
0 : Lock Bit
|
||||
<32 bit data>
|
||||
<3 bit addr>
|
||||
|
||||
Standard Write : 0 1p L <32 data bits> <3 bit addr>
|
||||
0 10 0 00000000000000000000000000000000 001
|
||||
Protected Write: 0 1p 00 <32 pwd bits> L <32 data bits> <3 bit addr>
|
||||
0 10 00 00000000000000000000000000000000 0 00000000000000000000000000000000 001
|
||||
Wake Up 0 10 00 <32 pwd bits>
|
||||
Protected Read 0 1p 00 <32 pwd bits> 0 <3 bit addr>
|
||||
Standard Read 0 1p 0 <3 bit addr>
|
||||
Page 0/1 read 0 1p
|
||||
Reset 0 00
|
||||
|
||||
*/
|
||||
T55xxWriteBit_Leading0 (0); //T55xxWriteBit(0);
|
||||
|
||||
|
||||
if (testMode) Dbprintf("TestMODE");
|
||||
// Std Opcode 10
|
||||
T55xxWriteBit_Leading0 (testMode ? 0 : 1);
|
||||
T55xxWriteBit_Leading0 (testMode ? 1 : Page); //Page 0
|
||||
|
||||
|
||||
if (PwdMode) {
|
||||
// Leading zero - insert two fixed 00 between opcode and password
|
||||
T55xxWriteBit_Leading0 (0);
|
||||
T55xxWriteBit_Leading0 (0);
|
||||
// Send Pwd
|
||||
for (i = 0x80000000; i != 0; i >>= 1)
|
||||
T55xxWriteBit_Leading0 (Pwd & i);
|
||||
}
|
||||
|
||||
// Send Lock bit
|
||||
T55xxWriteBit_Leading0 (0);
|
||||
|
||||
// Send Data
|
||||
for (i = 0x80000000; i != 0; i >>= 1)
|
||||
T55xxWriteBit_Leading0(Data & i);
|
||||
|
||||
// Send Block number
|
||||
for (i = 0x04; i != 0; i >>= 1)
|
||||
T55xxWriteBit_Leading0 (Block & i);
|
||||
|
||||
// Perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
|
||||
// so wait a little more)
|
||||
// "there is a clock delay before programming"
|
||||
// - programming takes ~5.6ms for t5577 ~18ms for E5550 or t5567
|
||||
// so we should wait 1 clock + 5.6ms then read response?
|
||||
// but we need to know we are dealing with t5577 vs t5567 vs e5550 (or q5) marshmellow...
|
||||
if (testMode) {
|
||||
//TESTMODE TIMING TESTS:
|
||||
// <566us does nothing
|
||||
// 566-568 switches between wiping to 0s and doing nothing
|
||||
// 5184 wipes and allows 1 block to be programmed.
|
||||
// indefinite power on wipes and then programs all blocks with bitshifted data sent.
|
||||
TurnReadLFOn(5184);
|
||||
|
||||
} else {
|
||||
TurnReadLFOn(20 * 1000);
|
||||
//could attempt to do a read to confirm write took
|
||||
// as the tag should repeat back the new block
|
||||
// until it is reset, but to confirm it we would
|
||||
// need to know the current block 0 config mode for
|
||||
// modulation clock an other details to demod the response...
|
||||
// response should be (for t55x7) a 0 bit then (ST if on)
|
||||
// block data written in on repeat until reset.
|
||||
|
||||
//DoPartialAcquisition(20, true, 12000);
|
||||
}
|
||||
|
||||
// turn field off
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LED_A_OFF();
|
||||
|
||||
}
|
||||
void T55xxWriteBlockExt_1of4 (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
|
||||
|
||||
LED_A_ON();
|
||||
bool PwdMode = arg & 0x1;
|
||||
uint8_t Page = (arg & 0x2)>>1;
|
||||
bool testMode = arg & 0x4;
|
||||
int bitpos;
|
||||
uint8_t bits;
|
||||
|
||||
// Set up FPGA, 125kHz
|
||||
LFSetupFPGAForADC(95, true);
|
||||
StartTicks();
|
||||
// make sure tag is fully powered up...
|
||||
WaitMS(5);
|
||||
// Trigger T55x7 in mode.
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
|
||||
|
||||
WaitUS(START_GAP1of4);
|
||||
|
||||
|
||||
/*
|
||||
00 : 1 if 4
|
||||
11 : Opcode
|
||||
00 : Fixed 00 if protected write (i.e. have password)
|
||||
<32 bit Password>
|
||||
0 : Lock Bit
|
||||
<32 bit data>
|
||||
<3 bit addr>
|
||||
|
||||
Standard Write : 00 1p L <32 data bits> <3 bit addr>
|
||||
00 10 0 00000000000000000000000000000000 001
|
||||
Protected Write: 00 1p 00 <32 pwd bits> L <32 data bits> <3 bit addr>
|
||||
00 10 00 00000000000000000000000000000000 0 00000000000000000000000000000000 001
|
||||
Wake Up 00 10 00 <32 pwd bits>
|
||||
Protected Read 00 1p 00 <32 pwd bits> 0 <3 bit addr>
|
||||
Standard Read 00 1p 0 <3 bit addr>
|
||||
Page 0/1 read 00 1p
|
||||
Reset 00 00
|
||||
|
||||
*/
|
||||
T55xxWriteBit_1of4 (0); //Send Reference 00
|
||||
|
||||
if (testMode) Dbprintf("TestMODE");
|
||||
// Std Opcode 10
|
||||
if (testMode) bits = 0; else bits = 2; // 0x or 1x
|
||||
if (testMode) bits |= 1; else bits += (Page); // x0 or x1
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
|
||||
if (PwdMode) {
|
||||
// 1 of 4 00 - insert two fixed 00 between opcode and password
|
||||
T55xxWriteBit_1of4 (0); // 00
|
||||
|
||||
// Send Pwd
|
||||
for (bitpos = 31; bitpos >= 1; bitpos -= 2) { // 2 bits at a time
|
||||
bits = (((Pwd >> bitpos) & 1) << 1) + ((Pwd >> (bitpos-1)) & 1);
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
}
|
||||
}
|
||||
|
||||
// Send Lock bit
|
||||
bits = 0; // Add lock bit (Not Set) to the next 2 bits
|
||||
|
||||
// Send Data - offset by 1 bit due to lock bit
|
||||
// 2 bits at a time - Initilised with lock bit above
|
||||
for (bitpos = 31; bitpos >= 1; bitpos -= 2) {
|
||||
bits |= ((Data >> bitpos) & 1); // Add Low bit
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
bits = ((Data >> (bitpos-1)) & 1) << 1; // Set next high bit
|
||||
}
|
||||
|
||||
// Send Block number
|
||||
bits |= ((Block >> 2) & 1);
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
bits = (Block & 3);// 1) & 2) + (Block & 1);
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
|
||||
// Perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
|
||||
// so wait a little more)
|
||||
// "there is a clock delay before programming"
|
||||
// - programming takes ~5.6ms for t5577 ~18ms for E5550 or t5567
|
||||
// so we should wait 1 clock + 5.6ms then read response?
|
||||
// but we need to know we are dealing with t5577 vs t5567 vs e5550 (or q5) marshmellow...
|
||||
if (testMode) {
|
||||
//TESTMODE TIMING TESTS:
|
||||
// <566us does nothing
|
||||
// 566-568 switches between wiping to 0s and doing nothing
|
||||
// 5184 wipes and allows 1 block to be programmed.
|
||||
// indefinite power on wipes and then programs all blocks with bitshifted data sent.
|
||||
TurnReadLFOn(5184);
|
||||
|
||||
} else {
|
||||
TurnReadLFOn(20 * 1000);
|
||||
//could attempt to do a read to confirm write took
|
||||
// as the tag should repeat back the new block
|
||||
// until it is reset, but to confirm it we would
|
||||
// need to know the current block 0 config mode for
|
||||
// modulation clock an other details to demod the response...
|
||||
// response should be (for t55x7) a 0 bit then (ST if on)
|
||||
// block data written in on repeat until reset.
|
||||
|
||||
//DoPartialAcquisition(20, true, 12000);
|
||||
}
|
||||
|
||||
// turn field off
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LED_A_OFF();
|
||||
|
||||
}
|
||||
|
||||
// Send T5577 reset command then read stream (see if we can identify the start of the stream)
|
||||
void T55xxResetRead(void) {
|
||||
LED_A_ON();
|
||||
|
|
@ -1324,12 +1585,34 @@ void T55xxWriteBlockExt(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg
|
|||
|
||||
// Write one card block in page 0, no lock
|
||||
void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
|
||||
T55xxWriteBlockExt(Data, Block, Pwd, arg);
|
||||
// arg 8 bit 00000000
|
||||
// 0000000x Password
|
||||
// 000000x0 Page
|
||||
// 00000x00 Test Mode
|
||||
// 000xx000 (0x18) where xx : 00 - Normal Write, 01 - Long Leading Reference
|
||||
// 10 - Leading 0, 11 - 1 of 4
|
||||
uint8_t downlink_mode;
|
||||
|
||||
downlink_mode = (arg >> 3) & 0x03;
|
||||
|
||||
switch (downlink_mode)
|
||||
{
|
||||
case 0 : T55xxWriteBlockExt (Data, Block, Pwd, arg); break;
|
||||
case 1 : T55xxWrite_LLR ();
|
||||
T55xxWriteBlockExt (Data, Block, Pwd, arg);
|
||||
break;
|
||||
case 2 : T55xxWriteBlockExt_Leading0 (Data, Block, Pwd, arg); break;
|
||||
case 3 : T55xxWriteBlockExt_1of4 (Data, Block, Pwd, arg); break;
|
||||
|
||||
default:
|
||||
T55xxWriteBlockExt (Data, Block, Pwd, arg);
|
||||
}
|
||||
|
||||
cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
}
|
||||
|
||||
// Read one card block in page [page]
|
||||
void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
||||
void T55xxReadBlockExt (uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
||||
LED_A_ON();
|
||||
bool PwdMode = arg0 & 0x1;
|
||||
uint8_t Page = (arg0 & 0x2) >> 1;
|
||||
|
|
@ -1379,10 +1662,163 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
|||
|
||||
// Turn the field off
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
|
||||
cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
// cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
LED_A_OFF();
|
||||
}
|
||||
|
||||
void T55xxReadBlockExt_Leading0 (uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
||||
LED_A_ON();
|
||||
bool PwdMode = arg0 & 0x1;
|
||||
uint8_t Page = (arg0 & 0x2) >> 1;
|
||||
uint32_t i = 0;
|
||||
bool RegReadMode = (Block == 0xFF);//regular read mode
|
||||
|
||||
//clear buffer now so it does not interfere with timing later
|
||||
BigBuf_Clear_ext(false);
|
||||
|
||||
//make sure block is at max 7
|
||||
Block &= 0x7;
|
||||
|
||||
// Set up FPGA, 125kHz to power up the tag
|
||||
LFSetupFPGAForADC(95, true);
|
||||
StartTicks();
|
||||
// make sure tag is fully powered up...
|
||||
WaitMS(5);
|
||||
// Trigger T55x7 Direct Access Mode with start gap
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
WaitUS(START_GAPlz);
|
||||
|
||||
T55xxWriteBit_Leading0 (0);
|
||||
|
||||
// Opcode 1[page]
|
||||
T55xxWriteBit_Leading0 (1);
|
||||
T55xxWriteBit_Leading0 (Page); //Page 0
|
||||
|
||||
if (PwdMode){
|
||||
// Send Pwd
|
||||
T55xxWriteBit_Leading0 (0);
|
||||
T55xxWriteBit_Leading0 (0);
|
||||
|
||||
for (i = 0x80000000; i != 0; i >>= 1)
|
||||
T55xxWriteBit_Leading0 (Pwd & i);
|
||||
}
|
||||
// Send a zero bit separation
|
||||
T55xxWriteBit_Leading0(0);
|
||||
|
||||
// Send Block number (if direct access mode)
|
||||
if (!RegReadMode)
|
||||
for (i = 0x04; i != 0; i >>= 1)
|
||||
T55xxWriteBit_Leading0(Block & i);
|
||||
|
||||
// Turn field on to read the response
|
||||
// 137*8 seems to get to the start of data pretty well...
|
||||
// but we want to go past the start and let the repeating data settle in...
|
||||
TurnReadLFOn(210*8);
|
||||
|
||||
// Acquisition
|
||||
// Now do the acquisition
|
||||
DoPartialAcquisition(0, true, 12000, 0);
|
||||
|
||||
// Turn the field off
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
|
||||
// cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
LED_A_OFF();
|
||||
}
|
||||
|
||||
void T55xxReadBlockExt_1of4 (uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
||||
LED_A_ON();
|
||||
bool PwdMode = arg0 & 0x1;
|
||||
uint8_t Page = (arg0 & 0x2) >> 1;
|
||||
//uint32_t i = 0;
|
||||
bool RegReadMode = (Block == 0xFF);//regular read mode
|
||||
uint8_t bits;
|
||||
int bitpos;
|
||||
|
||||
//clear buffer now so it does not interfere with timing later
|
||||
BigBuf_Clear_ext(false);
|
||||
|
||||
//make sure block is at max 7
|
||||
Block &= 0x7;
|
||||
|
||||
// Set up FPGA, 125kHz to power up the tag
|
||||
LFSetupFPGAForADC(95, true);
|
||||
StartTicks();
|
||||
// make sure tag is fully powered up...
|
||||
WaitMS(5);
|
||||
// Trigger T55x7 Direct Access Mode with start gap
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
WaitUS(START_GAP1of4);
|
||||
|
||||
T55xxWriteBit_1of4 (0); // 2 Bit 00 leading reference
|
||||
|
||||
// Opcode 1[page]
|
||||
bits = 2 + Page;
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
|
||||
if (PwdMode) {
|
||||
// 1 of 4 00 - insert two fixed 00 between opcode and password
|
||||
T55xxWriteBit_1of4 (0); // 00
|
||||
|
||||
// Send Pwd
|
||||
for (bitpos = 31; bitpos >= 1; bitpos -= 2) { // 2 bits at a time
|
||||
bits = (((Pwd >> bitpos) & 1) << 1) + ((Pwd >> (bitpos-1)) & 1);
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
}
|
||||
}
|
||||
|
||||
// Send Lock bit
|
||||
bits = 0; // Add lock bit (Not Set) to the next 2 bits
|
||||
|
||||
// Send Block number (if direct access mode)
|
||||
if (!RegReadMode){
|
||||
// Send Block number
|
||||
bits += ((Block >> 2) & 1);
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
bits = (Block & 3); // + (Block & 1);
|
||||
T55xxWriteBit_1of4 (bits);
|
||||
}
|
||||
|
||||
// Turn field on to read the response
|
||||
// 137*8 seems to get to the start of data pretty well...
|
||||
// but we want to go past the start and let the repeating data settle in...
|
||||
TurnReadLFOn(210*8);
|
||||
|
||||
// Acquisition
|
||||
// Now do the acquisition
|
||||
DoPartialAcquisition(0, true, 12000, 0);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
|
||||
// cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
LED_A_OFF();
|
||||
}
|
||||
|
||||
void T55xxReadBlock (uint16_t arg0, uint8_t Block, uint32_t Pwd) {
|
||||
// arg0 16 bit 00000000
|
||||
// 0000000x Password
|
||||
// 000000x0 Page
|
||||
// 00000x00
|
||||
// 000xx000 (0x18) where xx : 00 - Normal Write, 01 - Long Leading Reference
|
||||
// 10 - Leading 0, 11 - 1 of 4
|
||||
uint8_t downlink_mode;
|
||||
|
||||
downlink_mode = (arg0 >> 3) & 0x03;
|
||||
|
||||
// downlink mode id set to match the 2 bit as per Tech Sheet
|
||||
switch (downlink_mode)
|
||||
{
|
||||
case 0 : T55xxReadBlockExt (arg0, Block, Pwd); break;
|
||||
case 1 : T55xxWrite_LLR ();
|
||||
T55xxReadBlockExt (arg0, Block, Pwd);
|
||||
break;
|
||||
case 2 : T55xxReadBlockExt_Leading0 (arg0, Block, Pwd); break;
|
||||
case 3 : T55xxReadBlockExt_1of4 (arg0, Block, Pwd); break;
|
||||
default:
|
||||
T55xxReadBlockExt (arg0, Block, Pwd) ;
|
||||
}
|
||||
|
||||
// T55xxReadBlockExt (arg0, Block, Pwd) ;
|
||||
cmd_send(CMD_ACK,0,0,0,0,0);
|
||||
}
|
||||
|
||||
void T55xxWakeUp(uint32_t Pwd){
|
||||
LED_B_ON();
|
||||
uint32_t i = 0;
|
||||
|
|
|
|||
|
|
@ -67,6 +67,8 @@ int usage_t55xx_read(){
|
|||
PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");
|
||||
PrintAndLog(" o - OPTIONAL override safety check");
|
||||
PrintAndLog(" 1 - OPTIONAL read Page 1 instead of Page 0");
|
||||
PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference");
|
||||
PrintAndLog(" '2' Leading Zero, '3' 1 of 4 ");
|
||||
PrintAndLog(" ****WARNING****");
|
||||
PrintAndLog(" Use of read with password on a tag not configured for a pwd");
|
||||
PrintAndLog(" can damage the tag");
|
||||
|
|
@ -86,6 +88,8 @@ int usage_t55xx_write(){
|
|||
PrintAndLog(" p <password> - OPTIONAL password 4bytes (8 hex characters)");
|
||||
PrintAndLog(" 1 - OPTIONAL write Page 1 instead of Page 0");
|
||||
PrintAndLog(" t - OPTIONAL test mode write - ****DANGER****");
|
||||
PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference");
|
||||
PrintAndLog(" '2' Leading Zero, '3' 1 of 4 ");
|
||||
PrintAndLog("");
|
||||
PrintAndLog("Examples:");
|
||||
PrintAndLog(" lf t55xx write b 3 d 11223344 - write 11223344 to block 3");
|
||||
|
|
@ -132,6 +136,8 @@ int usage_t55xx_detect(){
|
|||
PrintAndLog("Options:");
|
||||
PrintAndLog(" 1 - if set, use Graphbuffer otherwise read data from tag.");
|
||||
PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");
|
||||
PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference");
|
||||
PrintAndLog(" '2' Leading Zero, '3' 1 of 4 ");
|
||||
PrintAndLog("");
|
||||
PrintAndLog("Examples:");
|
||||
PrintAndLog(" lf t55xx detect");
|
||||
|
|
@ -182,6 +188,24 @@ int usage_t55xx_bruteforce(){
|
|||
PrintAndLog("");
|
||||
return 0;
|
||||
}
|
||||
int usage_t55xx_bruteforce_downlink(){
|
||||
PrintAndLog("This command uses A) bruteforce to scan a number range");
|
||||
PrintAndLog(" B) a dictionary attack");
|
||||
PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");
|
||||
PrintAndLog(" password must be 4 bytes (8 hex symbols)");
|
||||
PrintAndLog("Options:");
|
||||
PrintAndLog(" h - this help");
|
||||
PrintAndLog(" r <start_pwd> <end_pwd> - 4 byte hex value to start and end pwd search at");
|
||||
PrintAndLog(" i <*.dic> - loads a default keys dictionary file <*.dic>");
|
||||
PrintAndLog(" e <mode> - OPTIONAL downlink encoding '0' fixed-bit-length (default), '1' Long Zero Reference");
|
||||
PrintAndLog(" '2' Leading Zero, '3' 1 of 4 ");
|
||||
PrintAndLog("");
|
||||
PrintAndLog("Examples:");
|
||||
PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");
|
||||
PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");
|
||||
PrintAndLog("");
|
||||
return 0;
|
||||
}
|
||||
int usage_t55xx_wipe(){
|
||||
PrintAndLog("Usage: lf t55xx wipe [h] [Q5]");
|
||||
PrintAndLog("This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block");
|
||||
|
|
@ -311,12 +335,12 @@ int CmdT55xxSetConfig(const char *Cmd) {
|
|||
return printConfiguration ( config );
|
||||
}
|
||||
|
||||
int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32_t password){
|
||||
int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32_t password, uint8_t downlink_mode){
|
||||
//Password mode
|
||||
if ( usepwd ) {
|
||||
// try reading the config block and verify that PWD bit is set before doing this!
|
||||
if ( !override ) {
|
||||
if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0 ) ) return 0;
|
||||
if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, false, 0,downlink_mode ) ) return 0;
|
||||
if ( !tryDetectModulation() ) {
|
||||
PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");
|
||||
return 0;
|
||||
|
|
@ -330,7 +354,7 @@ int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32
|
|||
}
|
||||
}
|
||||
|
||||
if (!AquireData(page1, block, usepwd, password) ) return 0;
|
||||
if (!AquireData(page1, block, usepwd, password,downlink_mode) ) return 0;
|
||||
if (!DecodeT55xxBlock()) return 0;
|
||||
|
||||
char blk[10]={0};
|
||||
|
|
@ -342,6 +366,8 @@ int T55xxReadBlock(uint8_t block, bool page1, bool usepwd, bool override, uint32
|
|||
int CmdT55xxReadBlock(const char *Cmd) {
|
||||
uint8_t block = REGULAR_READ_MODE_BLOCK;
|
||||
uint32_t password = 0; //default to blank Block 7
|
||||
uint8_t downlink_mode = 0;
|
||||
|
||||
bool usepwd = false;
|
||||
bool override = false;
|
||||
bool page1 = false;
|
||||
|
|
@ -372,6 +398,12 @@ int CmdT55xxReadBlock(const char *Cmd) {
|
|||
page1 = true;
|
||||
cmdp++;
|
||||
break;
|
||||
case 'e':
|
||||
case 'E':
|
||||
downlink_mode = param_getchar(Cmd, cmdp+1) - '0';
|
||||
if (downlink_mode > 3) downlink_mode = 0;
|
||||
cmdp +=2;
|
||||
break;
|
||||
default:
|
||||
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = true;
|
||||
|
|
@ -386,7 +418,7 @@ int CmdT55xxReadBlock(const char *Cmd) {
|
|||
}
|
||||
|
||||
printT5xxHeader(page1);
|
||||
return T55xxReadBlock(block, page1, usepwd, override, password);
|
||||
return T55xxReadBlock(block, page1, usepwd, override, password, downlink_mode);
|
||||
}
|
||||
|
||||
bool DecodeT55xxBlock(){
|
||||
|
|
@ -465,6 +497,7 @@ int CmdT55xxDetect(const char *Cmd){
|
|||
bool usepwd = false;
|
||||
uint32_t password = 0;
|
||||
uint8_t cmdp = 0;
|
||||
uint8_t downlink_mode = 0;
|
||||
|
||||
while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
|
||||
switch(param_getchar(Cmd, cmdp)) {
|
||||
|
|
@ -482,6 +515,12 @@ int CmdT55xxDetect(const char *Cmd){
|
|||
useGB = true;
|
||||
cmdp++;
|
||||
break;
|
||||
case 'e':
|
||||
case 'E':
|
||||
downlink_mode = param_getchar(Cmd, cmdp+1) - '0';
|
||||
if (downlink_mode > 3) downlink_mode = 0;
|
||||
cmdp +=2;
|
||||
break;
|
||||
default:
|
||||
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = true;
|
||||
|
|
@ -491,13 +530,24 @@ int CmdT55xxDetect(const char *Cmd){
|
|||
if (errors) return usage_t55xx_detect();
|
||||
|
||||
if ( !useGB) {
|
||||
if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password) )
|
||||
if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, usepwd, password,downlink_mode) )
|
||||
return 0;
|
||||
}
|
||||
|
||||
if ( !tryDetectModulation() )
|
||||
PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");
|
||||
|
||||
else {
|
||||
// Add downlink mode to reference.
|
||||
switch (downlink_mode) {
|
||||
case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;
|
||||
case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;
|
||||
case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;
|
||||
case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;
|
||||
// default:
|
||||
|
||||
// No default action
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
|
@ -898,6 +948,8 @@ int CmdT55xxWriteBlock(const char *Cmd) {
|
|||
uint8_t block = 0xFF; //default to invalid block
|
||||
uint32_t data = 0; //default to blank Block
|
||||
uint32_t password = 0; //default to blank Block 7
|
||||
uint32_t downlink_mode = 0;
|
||||
|
||||
bool usepwd = false;
|
||||
bool page1 = false;
|
||||
bool gotdata = false;
|
||||
|
|
@ -935,6 +987,12 @@ int CmdT55xxWriteBlock(const char *Cmd) {
|
|||
page1 = true;
|
||||
cmdp++;
|
||||
break;
|
||||
case 'e':
|
||||
case 'E':
|
||||
downlink_mode = param_getchar(Cmd, cmdp+1) - '0';
|
||||
if (downlink_mode > 3) downlink_mode = 0;
|
||||
cmdp +=2;
|
||||
break;
|
||||
default:
|
||||
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = true;
|
||||
|
|
@ -952,17 +1010,19 @@ int CmdT55xxWriteBlock(const char *Cmd) {
|
|||
UsbCommand resp;
|
||||
c.d.asBytes[0] = (page1) ? 0x2 : 0;
|
||||
c.d.asBytes[0] |= (testMode) ? 0x4 : 0;
|
||||
|
||||
c.d.asBytes[0] |= (downlink_mode << 3);
|
||||
|
||||
char pwdStr[16] = {0};
|
||||
snprintf(pwdStr, sizeof(pwdStr), "pwd: 0x%08X", password);
|
||||
|
||||
PrintAndLog("Writing page %d block: %02d data: 0x%08X %s", page1, block, data, (usepwd) ? pwdStr : "" );
|
||||
|
||||
|
||||
//Password mode
|
||||
if (usepwd) {
|
||||
c.arg[2] = password;
|
||||
c.d.asBytes[0] |= 0x1;
|
||||
}
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommand(&c);
|
||||
if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
|
||||
|
|
@ -980,7 +1040,7 @@ int CmdT55xxReadTrace(const char *Cmd) {
|
|||
return usage_t55xx_trace();
|
||||
|
||||
if (strlen(Cmd)==0)
|
||||
if ( !AquireData( T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password ) )
|
||||
if ( !AquireData( T55x7_PAGE1, REGULAR_READ_MODE_BLOCK, pwdmode, password,0 ) )
|
||||
return 0;
|
||||
|
||||
if ( config.Q5 ) {
|
||||
|
|
@ -1144,7 +1204,7 @@ int CmdT55xxInfo(const char *Cmd){
|
|||
return usage_t55xx_info();
|
||||
|
||||
if (strlen(Cmd)==0)
|
||||
if ( !AquireData( T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password ) )
|
||||
if ( !AquireData( T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, pwdmode, password,0 ) )
|
||||
return 1;
|
||||
|
||||
if (!DecodeT55xxBlock()) return 1;
|
||||
|
|
@ -1212,20 +1272,21 @@ int CmdT55xxDump(const char *Cmd){
|
|||
|
||||
printT5xxHeader(0);
|
||||
for ( uint8_t i = 0; i <8; ++i)
|
||||
T55xxReadBlock(i, 0, usepwd, override, password);
|
||||
T55xxReadBlock(i, 0, usepwd, override, password,0);
|
||||
|
||||
printT5xxHeader(1);
|
||||
for ( uint8_t i = 0; i<4; i++)
|
||||
T55xxReadBlock(i, 1, usepwd, override, password);
|
||||
T55xxReadBlock(i, 1, usepwd, override, password,0);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password ){
|
||||
int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password, uint8_t downlink_mode ){
|
||||
// arg0 bitmodes:
|
||||
// bit0 = pwdmode
|
||||
// bit1 = page to read from
|
||||
uint8_t arg0 = (page<<1) | pwdmode;
|
||||
arg0 |= (downlink_mode << 3);
|
||||
UsbCommand c = {CMD_T55XX_READ_BLOCK, {arg0, block, password}};
|
||||
|
||||
clearCommandBuffer();
|
||||
|
|
@ -1397,6 +1458,7 @@ int CmdT55xxBruteForce(const char *Cmd) {
|
|||
char buf[9];
|
||||
char filename[FILE_PATH_SIZE]={0};
|
||||
int keycnt = 0;
|
||||
uint8_t downlink_mode = 0;
|
||||
int ch;
|
||||
uint8_t stKeyBlock = 20;
|
||||
uint8_t *keyBlock = NULL, *p = NULL;
|
||||
|
|
@ -1480,7 +1542,7 @@ int CmdT55xxBruteForce(const char *Cmd) {
|
|||
|
||||
PrintAndLog("Testing %08X", testpwd);
|
||||
|
||||
if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd)) {
|
||||
if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,downlink_mode)) {
|
||||
PrintAndLog("Aquireing data from device failed. Quitting");
|
||||
free(keyBlock);
|
||||
return 0;
|
||||
|
|
@ -1525,7 +1587,7 @@ int CmdT55xxBruteForce(const char *Cmd) {
|
|||
return 0;
|
||||
}
|
||||
|
||||
if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i)) {
|
||||
if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {
|
||||
PrintAndLog("Aquireing data from device failed. Quitting");
|
||||
free(keyBlock);
|
||||
return 0;
|
||||
|
|
@ -1547,6 +1609,239 @@ int CmdT55xxBruteForce(const char *Cmd) {
|
|||
return 0;
|
||||
}
|
||||
|
||||
int CmdT55xxBruteForce_downlink(const char *Cmd) {
|
||||
|
||||
// load a default pwd file.
|
||||
char buf[9];
|
||||
char filename[FILE_PATH_SIZE]={0};
|
||||
int keycnt = 0;
|
||||
uint8_t downlink_mode = 0;
|
||||
int ch;
|
||||
uint8_t stKeyBlock = 20;
|
||||
uint8_t *keyBlock = NULL, *p = NULL;
|
||||
uint32_t start_password = 0x00000000; //start password
|
||||
uint32_t end_password = 0xFFFFFFFF; //end password
|
||||
bool found = false;
|
||||
uint8_t cmdp = 0;
|
||||
int cmd_offset = 0;
|
||||
int errors = 0;
|
||||
int len;
|
||||
bool use_file = false;
|
||||
bool use_range = false;
|
||||
bool try_all_dl_modes = false;
|
||||
uint8_t dl_mode = 0;
|
||||
|
||||
keyBlock = calloc(stKeyBlock, 6);
|
||||
if (keyBlock == NULL) return 1;
|
||||
|
||||
PrintAndLog("New Downlink Supprt");
|
||||
|
||||
while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
|
||||
switch(param_getchar(Cmd, cmdp)) {
|
||||
case 'h':
|
||||
case 'H':
|
||||
return usage_t55xx_bruteforce_downlink();
|
||||
case 'e':
|
||||
case 'E':
|
||||
downlink_mode = param_getchar(Cmd, cmdp+1) - '0';
|
||||
if (downlink_mode == 4) try_all_dl_modes = true;
|
||||
if (downlink_mode > 3) downlink_mode = 0;
|
||||
cmdp +=2;
|
||||
cmd_offset += 4;
|
||||
PrintAndLog ("DL Mode : %d",downlink_mode);
|
||||
break;
|
||||
case 'i':
|
||||
case 'I':
|
||||
if (use_range) {
|
||||
PrintAndLog ("use Range or File");
|
||||
return 0;
|
||||
}
|
||||
use_file = true;
|
||||
len = strlen(Cmd+2);
|
||||
if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
|
||||
memcpy(filename, Cmd+cmd_offset+2, len);
|
||||
cmdp += 2;
|
||||
// PrintAndLog (" File : [%s]",filename);
|
||||
break;
|
||||
case 'r':
|
||||
case 'R':
|
||||
if (use_file) {
|
||||
PrintAndLog ("use Range or File");
|
||||
return 0;
|
||||
}
|
||||
use_range = true; // = param_get32ex(Cmd, cmdp+1, 0, 16);
|
||||
start_password = param_get32ex(Cmd, cmdp+1, 0, 16);
|
||||
end_password = param_get32ex(Cmd, cmdp+2, 0, 16);
|
||||
cmdp += 3;
|
||||
cmd_offset += 20; // 8 + 8 + 1 + 1 + 1
|
||||
// PrintAndLog (" Range : [%0X] - [%0X]",start_password,end_password);
|
||||
break;
|
||||
default:
|
||||
PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// if (cmdp == 'i' || cmdp == 'I') {
|
||||
|
||||
if (use_file)
|
||||
{
|
||||
FILE * f = fopen( filename , "r");
|
||||
|
||||
if ( !f ) {
|
||||
PrintAndLog("File: %s: not found or locked.", filename);
|
||||
free(keyBlock);
|
||||
return 1;
|
||||
}
|
||||
|
||||
while( fgets(buf, sizeof(buf), f) ) {
|
||||
if (strlen(buf) < 8 || buf[7] == '\n') continue;
|
||||
|
||||
while (fgetc(f) != '\n' && !feof(f)) ; //goto next line
|
||||
|
||||
//The line start with # is comment, skip
|
||||
if( buf[0]=='#' ) continue;
|
||||
|
||||
if (!isxdigit((unsigned char)buf[0])) {
|
||||
PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);
|
||||
continue;
|
||||
}
|
||||
|
||||
buf[8] = 0;
|
||||
|
||||
if ( stKeyBlock - keycnt < 2) {
|
||||
p = realloc(keyBlock, 6*(stKeyBlock+=10));
|
||||
if (!p) {
|
||||
PrintAndLog("Cannot allocate memory for defaultKeys");
|
||||
free(keyBlock);
|
||||
fclose(f);
|
||||
return 2;
|
||||
}
|
||||
keyBlock = p;
|
||||
}
|
||||
memset(keyBlock + 4 * keycnt, 0, 4);
|
||||
num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);
|
||||
PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));
|
||||
keycnt++;
|
||||
memset(buf, 0, sizeof(buf));
|
||||
}
|
||||
fclose(f);
|
||||
|
||||
if (keycnt == 0) {
|
||||
PrintAndLog("No keys found in file");
|
||||
free(keyBlock);
|
||||
return 1;
|
||||
}
|
||||
PrintAndLog("Loaded %d keys", keycnt);
|
||||
|
||||
// loop
|
||||
uint64_t testpwd = 0x00;
|
||||
for (uint16_t c = 0; c < keycnt; ++c ) {
|
||||
|
||||
if (ukbhit()) {
|
||||
ch = getchar();
|
||||
(void)ch;
|
||||
printf("\naborted via keyboard!\n");
|
||||
free(keyBlock);
|
||||
return 0;
|
||||
}
|
||||
|
||||
testpwd = bytes_to_num(keyBlock + 4*c, 4);
|
||||
|
||||
PrintAndLog("Testing %08X", testpwd);
|
||||
|
||||
// Try each downlink_mode of asked to
|
||||
// donwlink_mode will = 0 if > 3 or set to 0, so loop from 0 - 3
|
||||
for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++)
|
||||
{
|
||||
if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,dl_mode)) {
|
||||
PrintAndLog("Aquireing data from device failed. Quitting");
|
||||
free(keyBlock);
|
||||
return 0;
|
||||
}
|
||||
|
||||
found = tryDetectModulation();
|
||||
|
||||
if ( found ) {
|
||||
PrintAndLog("Found valid password: [%08X]", testpwd);
|
||||
free(keyBlock);
|
||||
// Add downlink mode to reference.
|
||||
switch (dl_mode) {
|
||||
case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;
|
||||
case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;
|
||||
case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;
|
||||
case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
if (!try_all_dl_modes) // Exit loop
|
||||
dl_mode = 4;
|
||||
}
|
||||
}
|
||||
PrintAndLog("Password NOT found.");
|
||||
free(keyBlock);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (use_range)
|
||||
{
|
||||
// incremental pwd range search
|
||||
// start_password = param_get32ex(Cmd, 0, 0, 16);
|
||||
// end_password = param_get32ex(Cmd, 1, 0, 16);
|
||||
|
||||
if ( start_password >= end_password ) {
|
||||
free(keyBlock);
|
||||
return usage_t55xx_bruteforce_downlink();
|
||||
}
|
||||
PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);
|
||||
|
||||
uint32_t i = start_password;
|
||||
|
||||
while ((!found) && (i <= end_password)) {
|
||||
|
||||
printf(".");
|
||||
fflush(stdout);
|
||||
if (ukbhit()) {
|
||||
ch = getchar();
|
||||
(void)ch;
|
||||
printf("\naborted via keyboard!\n");
|
||||
free(keyBlock);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {
|
||||
PrintAndLog("Aquireing data from device failed. Quitting");
|
||||
free(keyBlock);
|
||||
return 0;
|
||||
}
|
||||
found = tryDetectModulation();
|
||||
|
||||
if (found) break;
|
||||
i++;
|
||||
}
|
||||
|
||||
PrintAndLog("");
|
||||
|
||||
if (found) {
|
||||
PrintAndLog("Found valid password: [%08x]", i);
|
||||
// Add downlink mode to reference.
|
||||
switch (downlink_mode) {
|
||||
case 0 : PrintAndLog ("Downlink : e 0 - Default/Fixed Bit Length"); break;
|
||||
case 1 : PrintAndLog ("Downlink : e 1 - Long Leading Reference"); break;
|
||||
case 2 : PrintAndLog ("Downlink : e 2 - Leading Zero Reference"); break;
|
||||
case 3 : PrintAndLog ("Downlink : e 3 - 1 of 4 Coding"); break;
|
||||
}
|
||||
}
|
||||
else
|
||||
PrintAndLog("Password NOT found. Last tried: [%08x]", --i);
|
||||
|
||||
free(keyBlock);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
// note length of data returned is different for different chips.
|
||||
// some return all page 1 (64 bits) and others return just that block (32 bits)
|
||||
// unfortunately the 64 bits makes this more likely to get a false positive...
|
||||
|
|
@ -1558,7 +1853,7 @@ bool tryDetectP1(bool getData) {
|
|||
bool st = true;
|
||||
|
||||
if ( getData ) {
|
||||
if ( !AquireData(T55x7_PAGE1, 1, false, 0) )
|
||||
if ( !AquireData(T55x7_PAGE1, 1, false, 0,0) )
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
@ -1687,7 +1982,7 @@ int CmdT55xxDetectPage1(const char *Cmd){
|
|||
if (errors) return usage_t55xx_detectP1();
|
||||
|
||||
if ( !useGB ) {
|
||||
if ( !AquireData(T55x7_PAGE1, 1, usepwd, password) )
|
||||
if ( !AquireData(T55x7_PAGE1, 1, usepwd, password,0) )
|
||||
return false;
|
||||
}
|
||||
bool success = tryDetectP1(false);
|
||||
|
|
@ -1697,7 +1992,8 @@ int CmdT55xxDetectPage1(const char *Cmd){
|
|||
|
||||
static command_t CommandTable[] = {
|
||||
{"help", CmdHelp, 1, "This help"},
|
||||
{"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},
|
||||
{"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},
|
||||
{"bruteforcedl",CmdT55xxBruteForce_downlink,0, "r <start password> <end password> [i <*.dic>] [e <downlink>] Simple bruteforce attack to find password"},
|
||||
{"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
|
||||
{"detect", CmdT55xxDetect, 1, "[1] Try detecting the tag modulation from reading the configuration block."},
|
||||
{"p1detect", CmdT55xxDetectPage1,1, "[1] Try detecting if this is a t55xx tag by reading page 1"},
|
||||
|
|
|
|||
|
|
@ -74,6 +74,7 @@ void Set_t55xx_Config(t55xx_conf_block_t conf);
|
|||
|
||||
extern int CmdLFT55XX(const char *Cmd);
|
||||
extern int CmdT55xxBruteForce(const char *Cmd);
|
||||
extern int CmdT55xxBruteForce_downlink(const char *Cmd);
|
||||
extern int CmdT55xxSetConfig(const char *Cmd);
|
||||
extern int CmdT55xxReadBlock(const char *Cmd);
|
||||
extern int CmdT55xxWriteBlock(const char *Cmd);
|
||||
|
|
@ -98,7 +99,7 @@ bool tryDetectModulation(void);
|
|||
extern bool tryDetectP1(bool getData);
|
||||
bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5);
|
||||
int special(const char *Cmd);
|
||||
int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password );
|
||||
int AquireData( uint8_t page, uint8_t block, bool pwdmode, uint32_t password,uint8_t downlink_mode );
|
||||
|
||||
void printT55x7Trace( t55x7_tracedata_t data, uint8_t repeat );
|
||||
void printT5555Trace( t5555_tracedata_t data, uint8_t repeat );
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue