Added block command for T55xx and support for cloning HID long format

armsrc/appmain.c

@@ -631,8 +631,8 @@ void UsbPacketReceived(uint8_t *packet, int len)
 		case CMD_HID_SIM_TAG:
 			CmdHIDsimTAG(c->arg[0], c->arg[1], 1);					// Simulate HID tag by ID
 			break;
-		case CMD_HID_CLONE_TAG:
+		case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
-			CopyHIDtoT55x7(c->arg[0], c->arg[1]);					// Clone HID tag by ID to T55x7
+			CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 			break;
 		case CMD_EM410X_WRITE_TAG:
 			WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
@@ -657,6 +657,15 @@ void UsbPacketReceived(uint8_t *packet, int len)
 		case CMD_INDALA_CLONE_TAG_L:					// Clone Indala 224-bit tag by UID to T55x7
 			CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
 			break;
+		case CMD_T55XX_READ_BLOCK: 
+			T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
+			break;
+		case CMD_T55XX_WRITE_BLOCK: 
+			T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]); 
+			break;
+		case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
+			T55xxReadTrace();
+			break;
 #endif
 
 #ifdef WITH_HITAG

armsrc/apps.h

@@ -117,10 +117,13 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol);
 void CmdHIDsimTAG(int hi, int lo, int ledcontrol);
 void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol);
 void SimulateTagLowFrequencyBidir(int divisor, int max_bitlen);
-void CopyHIDtoT55x7(int hi, int lo); // Clone an HID card to T5557/T5567
+void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT); // Clone an HID card to T5557/T5567
 void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo);
 void CopyIndala64toT55x7(int hi, int lo); // Clone Indala 64-bit tag by UID to T55x7
 void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int uid6, int uid7); // Clone Indala 224-bit tag by UID to T55x7
+void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode);
+void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode );
+void T55xxReadTrace(void);
 
 /// iso14443.h
 void SimulateIso14443Tag(void);

armsrc/lfops.c

@@ -598,7 +598,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
 {
 	uint8_t *dest = (uint8_t *)BigBuf;
 	int m=0, n=0, i=0, idx=0, found=0, lastval=0;
-	uint32_t hi=0, lo=0;
+	uint32_t hi2=0, hi=0, lo=0;
 
 	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
@@ -735,9 +735,15 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
 			{
 				found=1;
 				idx+=6;
-				if (found && (hi|lo)) {
+				if (found && (hi2|hi|lo)) {
-					Dbprintf("TAG ID: %x%08x (%d)",
+					if (hi2 != 0){
-						(unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+  					Dbprintf("TAG ID: %x%08x%08x (%d)",
+	  					(unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+	  			}		
+					else {
+					  Dbprintf("TAG ID: %x%08x (%d)",
+						  (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+					}	
 					/* if we're only looking for one tag */
 					if (findone)
 					{
@@ -745,6 +751,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
 						*low = lo;
 						return;
 					}
+					hi2=0;
 					hi=0;
 					lo=0;
 					found=0;
@@ -752,13 +759,16 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
 			}
 			if (found) {
 				if (dest[idx] && (!dest[idx+1]) ) {
+					hi2=(hi2<<1)|(hi>>31);
 					hi=(hi<<1)|(lo>>31);
 					lo=(lo<<1)|0;
 				} else if ( (!dest[idx]) && dest[idx+1]) {
+					hi2=(hi2<<1)|(hi>>31);
 					hi=(hi<<1)|(lo>>31);
 					lo=(lo<<1)|1;
 				} else {
 					found=0;
+					hi2=0;
 					hi=0;
 					lo=0;
 				}
@@ -769,8 +779,14 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
 				found=1;
 				idx+=6;
 				if (found && (hi|lo)) {
-					Dbprintf("TAG ID: %x%08x (%d)",
+					if (hi2 != 0){
-						(unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+  					Dbprintf("TAG ID: %x%08x%08x (%d)",
+	  					(unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+	  			}		
+					else {
+					  Dbprintf("TAG ID: %x%08x (%d)",
+						  (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+					}	
 					/* if we're only looking for one tag */
 					if (findone)
 					{
@@ -778,6 +794,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
 						*low = lo;
 						return;
 					}
+          hi2=0;
 					hi=0;
 					lo=0;
 					found=0;
@@ -788,6 +805,7 @@ void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
 	}
 }
 
+
 /*------------------------------
  * T5555/T5557/T5567 routines
  *------------------------------
@@ -866,7 +884,7 @@ void T55xxWriteBit(int bit)
 }
 
 // Write one card block in page 0, no lock
-void T55xxWriteBlock(int Data, int Block)
+void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
 {
 	unsigned int i;
 
@@ -884,6 +902,11 @@ void T55xxWriteBlock(int Data, int Block)
 	// Opcode
 	T55xxWriteBit(1);
 	T55xxWriteBit(0); //Page 0
+	if (PwdMode == 1){
+		// Pwd
+		for (i = 0x80000000; i != 0; i >>= 1)
+			T55xxWriteBit(Pwd & i);
+	}	
 	// Lock bit
 	T55xxWriteBit(0);
 
@@ -891,7 +914,7 @@ void T55xxWriteBlock(int Data, int Block)
 	for (i = 0x80000000; i != 0; i >>= 1)
 		T55xxWriteBit(Data & i);
 
-	// Page
+	// Block
 	for (i = 0x04; i != 0; i >>= 1)
 		T55xxWriteBit(Block & i);
 
@@ -903,55 +926,243 @@ void T55xxWriteBlock(int Data, int Block)
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 }
 
-// Copy HID id to card and setup block 0 config
+
-void CopyHIDtoT55x7(int hi, int lo)
+// Read one card block in page 0 
+void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
 {
-	int data1, data2, data3;
+	uint8_t *dest = (uint8_t *)BigBuf;
+	int m=0, i=0;
+ 
+	m = sizeof(BigBuf);
+  // Clear destination buffer before sending the command
+	memset(dest, 128, m);
+	// Connect the A/D to the peak-detected low-frequency path.
+	SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
+	// Now set up the SSC to get the ADC samples that are now streaming at us.
+	FpgaSetupSsc();
 
-	// Ensure no more than 44 bits supplied
+	LED_D_ON();
-	if (hi>0xFFF) {
+	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-		DbpString("Tags can only have 44 bits.");
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-		return;
+
+	// Give it a bit of time for the resonant antenna to settle.
+	// And for the tag to fully power up
+	SpinDelay(150);
+
+	// Now start writting
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	SpinDelayUs(START_GAP);
+
+	// Opcode
+	T55xxWriteBit(1);
+	T55xxWriteBit(0); //Page 0
+	if (PwdMode == 1){
+		// Pwd
+		for (i = 0x80000000; i != 0; i >>= 1)
+			T55xxWriteBit(Pwd & i);
+	}	
+	// Lock bit
+	T55xxWriteBit(0);
+	// Block
+	for (i = 0x04; i != 0; i >>= 1)
+		T55xxWriteBit(Block & i);
+  
+  // Turn field on to read the response
+	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+
+	// Now do the acquisition 
+	i = 0;
+	for(;;) {
+		if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
+			AT91C_BASE_SSC->SSC_THR = 0x43;
+		}
+		if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
+			dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+			// we don't care about actual value, only if it's more or less than a
+			// threshold essentially we capture zero crossings for later analysis
+//			if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
+			i++;
+			if (i >= m) break;
+		}
 	}
 
-	// Build the 3 data blocks for supplied 44bit ID
+  FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
-	data1 = 0x1D000000; // load preamble
+	LED_D_OFF();
+	DbpString("DONE!");
+}
 
-	for (int i=0;i<12;i++) {
+// Read card traceability data (page 1)
-		if (hi & (1<<(11-i)))
+void T55xxReadTrace(void){ 
-			data1 |= (1<<(((11-i)*2)+1)); // 1 -> 10
+	uint8_t *dest = (uint8_t *)BigBuf;
-		else
+	int m=0, i=0;
-			data1 |= (1<<((11-i)*2)); // 0 -> 01
+ 
+	m = sizeof(BigBuf);
+  // Clear destination buffer before sending the command
+	memset(dest, 128, m);
+	// Connect the A/D to the peak-detected low-frequency path.
+	SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
+	// Now set up the SSC to get the ADC samples that are now streaming at us.
+	FpgaSetupSsc();
+
+	LED_D_ON();
+	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+
+	// Give it a bit of time for the resonant antenna to settle.
+	// And for the tag to fully power up
+	SpinDelay(150);
+
+	// Now start writting
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	SpinDelayUs(START_GAP);
+
+	// Opcode
+	T55xxWriteBit(1);
+	T55xxWriteBit(1); //Page 1
+  
+  // Turn field on to read the response
+	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+
+	// Now do the acquisition 
+	i = 0;
+	for(;;) {
+		if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
+			AT91C_BASE_SSC->SSC_THR = 0x43;
+		}
+		if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
+			dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+			i++;
+			if (i >= m) break;
+		}
 	}
 
-	data2 = 0;
+  FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
-	for (int i=0;i<16;i++) {
+	LED_D_OFF();
-		if (lo & (1<<(31-i)))
+	DbpString("DONE!");
-			data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+}
-		else
-			data2 |= (1<<((15-i)*2)); // 0 -> 01
-	}
 
-	data3 = 0;
+/*-------------- Cloning routines -----------*/
-	for (int i=0;i<16;i++) {
+// Copy HID id to card and setup block 0 config
-		if (lo & (1<<(15-i)))
+void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT)
-			data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+{
-		else
+	int data1, data2, data3, data4, data5, data6; //up to six blocks for long format
-			data3 |= (1<<((15-i)*2)); // 0 -> 01
+	int last_block = 0;
-	}
 
-	// Program the 3 data blocks for supplied 44bit ID
+  if (longFMT){
+	  // Ensure no more than 84 bits supplied
+	  if (hi2>0xFFFFF) {
+		  DbpString("Tags can only have 84 bits.");
+		  return;
+	  }
+    // Build the 6 data blocks for supplied 84bit ID
+    last_block = 6;
+    data1 = 0x1D96A900; // load preamble (1D) & long format identifier (9E manchester encoded)
+	  for (int i=0;i<4;i++) {
+		  if (hi2 & (1<<(19-i)))
+			  data1 |= (1<<(((3-i)*2)+1)); // 1 -> 10
+		  else
+			  data1 |= (1<<((3-i)*2)); // 0 -> 01
+	  }
+
+  	data2 = 0;
+  	for (int i=0;i<16;i++) {
+  		if (hi2 & (1<<(15-i)))
+  			data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+  		else
+  			data2 |= (1<<((15-i)*2)); // 0 -> 01
+    }
+
+  	data3 = 0;
+  	for (int i=0;i<16;i++) {
+  		if (hi & (1<<(31-i)))
+  			data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+  		else
+  			data3 |= (1<<((15-i)*2)); // 0 -> 01
+  	}
+  
+  	data4 = 0;
+  	for (int i=0;i<16;i++) {
+  		if (hi & (1<<(15-i)))
+  			data4 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+  		else
+  			data4 |= (1<<((15-i)*2)); // 0 -> 01
+    }
+    
+  	data5 = 0;
+  	for (int i=0;i<16;i++) {
+  		if (lo & (1<<(31-i)))
+  			data5 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+  		else
+  			data5 |= (1<<((15-i)*2)); // 0 -> 01
+  	}
+  
+  	data6 = 0;
+  	for (int i=0;i<16;i++) {
+  		if (lo & (1<<(15-i)))
+  			data6 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+  		else
+  			data6 |= (1<<((15-i)*2)); // 0 -> 01
+    }
+  }
+  else {	
+	  // Ensure no more than 44 bits supplied
+	  if (hi>0xFFF) {
+		  DbpString("Tags can only have 44 bits.");
+		  return;
+	  }
+
+  	// Build the 3 data blocks for supplied 44bit ID
+  	last_block = 3;
+  	
+  	data1 = 0x1D000000; // load preamble
+  
+  	for (int i=0;i<12;i++) {
+  		if (hi & (1<<(12-i)))
+  			data1 |= (1<<(((12-i)*2)+1)); // 1 -> 10
+  		else
+  			data1 |= (1<<((12-i)*2)); // 0 -> 01
+  	}
+  
+  	data2 = 0;
+  	for (int i=0;i<16;i++) {
+  		if (lo & (1<<(31-i)))
+  			data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+  		else
+  			data2 |= (1<<((15-i)*2)); // 0 -> 01
+  	}
+  
+  	data3 = 0;
+  	for (int i=0;i<16;i++) {
+  		if (lo & (1<<(15-i)))
+  			data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
+  		else
+  			data3 |= (1<<((15-i)*2)); // 0 -> 01
+  	}		
+  }
+
+	LED_D_ON();
+	// Program the data blocks for supplied ID
 	// and the block 0 for HID format
-	T55xxWriteBlock(data1,1);
+	T55xxWriteBlock(data1,1,0,0);
-	T55xxWriteBlock(data2,2);
+	T55xxWriteBlock(data2,2,0,0);
-	T55xxWriteBlock(data3,3);
+	T55xxWriteBlock(data3,3,0,0);
+	
+	if (longFMT) { // if long format there are 6 blocks
+	  T55xxWriteBlock(data4,4,0,0);
+	  T55xxWriteBlock(data5,5,0,0);
+	  T55xxWriteBlock(data6,6,0,0);
+  }
 
-	// Config for HID (RF/50, FSK2a, Maxblock=3)
+	// Config for HID (RF/50, FSK2a, Maxblock=3 for short/6 for long)
 	T55xxWriteBlock(T55x7_BITRATE_RF_50    |
 			T55x7_MODULATION_FSK2a |
-			3 << T55x7_MAXBLOCK_SHIFT,
+			last_block << T55x7_MAXBLOCK_SHIFT,
-			0);
+			0,0,0);
-
+  
+	LED_D_OFF();
+	
 	DbpString("DONE!");
 }
 
@@ -1019,8 +1230,8 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
 	LED_D_ON();
 
 	// Write EM410x ID
-	T55xxWriteBlock((uint32_t)(id >> 32), 1);
+	T55xxWriteBlock((uint32_t)(id >> 32), 1, 0, 0);
-	T55xxWriteBlock((uint32_t)id, 2);
+	T55xxWriteBlock((uint32_t)id, 2, 0, 0);
 
 	// Config for EM410x (RF/64, Manchester, Maxblock=2)
 	if (card)
@@ -1028,13 +1239,13 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
 		T55xxWriteBlock(T55x7_BITRATE_RF_64	    |
 				T55x7_MODULATION_MANCHESTER |
 				2 << T55x7_MAXBLOCK_SHIFT,
-				0);
+				0, 0, 0);
 	else
 		// Writing configuration for T5555(Q5) tag
 		T55xxWriteBlock(0x1F << T5555_BITRATE_SHIFT |
 				T5555_MODULATION_MANCHESTER   |
 				2 << T5555_MAXBLOCK_SHIFT,
-				0);
+				0, 0, 0);
 
 	LED_D_OFF();
 	Dbprintf("Tag %s written with 0x%08x%08x\n", card ? "T55x7":"T5555",
@@ -1047,13 +1258,13 @@ void CopyIndala64toT55x7(int hi, int lo)
 
 	//Program the 2 data blocks for supplied 64bit UID
 	// and the block 0 for Indala64 format
-	T55xxWriteBlock(hi,1);
+	T55xxWriteBlock(hi,1,0,0);
-	T55xxWriteBlock(lo,2);
+	T55xxWriteBlock(lo,2,0,0);
 	//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=2)
 	T55xxWriteBlock(T55x7_BITRATE_RF_32    |
 			T55x7_MODULATION_PSK1 |
 			2 << T55x7_MAXBLOCK_SHIFT,
-			0);
+			0,0,0);
 	//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
 //	T5567WriteBlock(0x603E1042,0);
 
@@ -1066,18 +1277,18 @@ void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int
 
 	//Program the 7 data blocks for supplied 224bit UID
 	// and the block 0 for Indala224 format
-	T55xxWriteBlock(uid1,1);
+	T55xxWriteBlock(uid1,1,0,0);
-	T55xxWriteBlock(uid2,2);
+	T55xxWriteBlock(uid2,2,0,0);
-	T55xxWriteBlock(uid3,3);
+	T55xxWriteBlock(uid3,3,0,0);
-	T55xxWriteBlock(uid4,4);
+	T55xxWriteBlock(uid4,4,0,0);
-	T55xxWriteBlock(uid5,5);
+	T55xxWriteBlock(uid5,5,0,0);
-	T55xxWriteBlock(uid6,6);
+	T55xxWriteBlock(uid6,6,0,0);
-	T55xxWriteBlock(uid7,7);
+	T55xxWriteBlock(uid7,7,0,0);
 	//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
 	T55xxWriteBlock(T55x7_BITRATE_RF_32    |
 			T55x7_MODULATION_PSK1 |
 			7 << T55x7_MAXBLOCK_SHIFT,
-			0);
+			0,0,0);
 	//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
 //	T5567WriteBlock(0x603E10E2,0);
 

client/Makefile

@@ -67,7 +67,8 @@ CMDSRCS = \
 			cmdlfhitag.c \
 			cmdlfti.c \
 			cmdparser.c \
-			cmdmain.c
+			cmdmain.c \
+			cmdlft55xx.c
 
 CMDOBJS = $(CMDSRCS:%.c=$(OBJDIR)/%.o)
 

client/cmdhfmf.c

@@ -77,13 +77,13 @@ start:
 		PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt);	
 	} else {
 		printf("------------------------------------------------------------------\n");
-		PrintAndLog("Key found:%012llx \n", r_key);
+		PrintAndLog("Key found:%012I64x \n", r_key);
 
 		num_to_bytes(r_key, 6, keyBlock);
 		isOK = mfCheckKeys(0, 0, 1, keyBlock, &r_key);
 	}
 	if (!isOK) 
-		PrintAndLog("Found valid key:%012llx", r_key);
+		PrintAndLog("Found valid key:%012I64x", r_key);
 	else
 	{
 		if (isOK != 2) PrintAndLog("Found invalid key. ( Nt=%08x ,Trying use it to run again...", nt);	
@@ -575,7 +575,7 @@ int CmdHF14AMfNested(const char *Cmd)
 		if (res)
 			res = mfCheckKeys(trgBlockNo, trgKeyType, 8, &keyBlock[6 * 8], &key64);
 		if (!res) {
-			PrintAndLog("Found valid key:%012llx", key64);
+			PrintAndLog("Found valid key:%012I64x", key64);
 
 			// transfer key to the emulator
 			if (transferToEml) {
@@ -635,7 +635,7 @@ int CmdHF14AMfNested(const char *Cmd)
 					if (res)
 						res = mfCheckKeys(trgBlockNo, trgKeyType, 8, &keyBlock[6 * 8], &key64);
 					if (!res) {
-						PrintAndLog("Found valid key:%012llx", key64);	
+						PrintAndLog("Found valid key:%012I64x", key64);	
 						e_sector[trgBlockNo / 4].foundKey[trgKeyType] = 1;
 						e_sector[trgBlockNo / 4].Key[trgKeyType] = key64;
 					}
@@ -648,7 +648,7 @@ int CmdHF14AMfNested(const char *Cmd)
 		PrintAndLog("|sec|key A           |res|key B           |res|");
 		PrintAndLog("|---|----------------|---|----------------|---|");
 		for (i = 0; i < SectorsCnt; i++) {
-			PrintAndLog("|%03d|  %012llx  | %d |  %012llx  | %d |", i, 
+			PrintAndLog("|%03d|  %012I64x  | %d |  %012I64x  | %d |", i, 
 				e_sector[i].Key[0], e_sector[i].foundKey[0], e_sector[i].Key[1], e_sector[i].foundKey[1]);
 		}
 		PrintAndLog("|---|----------------|---|----------------|---|");
@@ -845,7 +845,7 @@ int CmdHF14AMfChk(const char *Cmd)
 					}
 					memset(keyBlock + 6 * keycnt, 0, 6);
 					num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6*keycnt);
-					PrintAndLog("chk custom key[%d] %012llx", keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
+					PrintAndLog("chk custom key[%d] %012I64x", keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
 					keycnt++;
 				}
 			} else {
@@ -875,7 +875,7 @@ int CmdHF14AMfChk(const char *Cmd)
 				res = mfCheckKeys(b, t, size, keyBlock +6*c, &key64);
 				if (res !=1) {
 					if (!res) {
-						PrintAndLog("Found valid key:[%012llx]",key64);
+						PrintAndLog("Found valid key:[%012I64x]",key64);
 						if (transferToEml) {
 							uint8_t block[16];
 							mfEmlGetMem(block, get_trailer_block(b), 1);
@@ -1207,7 +1207,7 @@ int CmdHF14AMfEKeyPrn(const char *Cmd)
 		}
 		keyA = bytes_to_num(data, 6);
 		keyB = bytes_to_num(data + 10, 6);
-		PrintAndLog("|%03d|  %012llx  |  %012llx  |", i, keyA, keyB);
+		PrintAndLog("|%03d|  %012I64x  |  %012I64x  |", i, keyA, keyB);
 	}
 	PrintAndLog("|---|----------------|----------------|");
 	

client/cmdlf.c

@@ -24,6 +24,7 @@
 #include "cmdlfti.h"
 #include "cmdlfem4x.h"
 #include "cmdlfhitag.h"
+#include "cmdlft55xx.h"
 
 static int CmdHelp(const char *Cmd);
 
@@ -538,6 +539,7 @@ static command_t CommandTable[] =
   {"ti",          CmdLFTI,            1, "{ TI RFIDs... }"},
   {"hitag",       CmdLFHitag,         1, "{ Hitag tags and transponders... }"},
   {"vchdemod",    CmdVchDemod,        1, "['clone'] -- Demodulate samples for VeriChip"},
+  {"t55xx",       CmdLFT55XX,         1, "{ T55xx RFIDs... }"},
   {NULL, NULL, 0, NULL}
 };
 

client/cmdlf.h

@@ -16,6 +16,7 @@ int CmdLF(const char *Cmd);
 int CmdLFCommandRead(const char *Cmd);
 int CmdFlexdemod(const char *Cmd);
 int CmdIndalaDemod(const char *Cmd);
+int CmdIndalaClone(const char *Cmd);
 int CmdLFRead(const char *Cmd);
 int CmdLFSim(const char *Cmd);
 int CmdLFSimBidir(const char *Cmd);

client/cmdlfhid.c

@@ -62,17 +62,38 @@ int CmdHIDSim(const char *Cmd)
 
 int CmdHIDClone(const char *Cmd)
 {
-  unsigned int hi = 0, lo = 0;
+  unsigned int hi2 = 0, hi = 0, lo = 0;
   int n = 0, i = 0;
+  UsbCommand c;
 
-  while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
+  if (strchr(Cmd,'l') != 0) {
-    hi = (hi << 4) | (lo >> 28);
+  	while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
-    lo = (lo << 4) | (n & 0xf);
+      hi2 = (hi2 << 4) | (hi >> 28);
+      hi = (hi << 4) | (lo >> 28);
+      lo = (lo << 4) | (n & 0xf);
+    }
+
+    PrintAndLog("Cloning tag with long ID %x%08x%08x", hi2, hi, lo);
+
+    c.d.asBytes[0] = 1;
+  }
+  else {
+  	while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
+      hi = (hi << 4) | (lo >> 28);
+      lo = (lo << 4) | (n & 0xf);
+    }
+
+    PrintAndLog("Cloning tag with ID %x%08x", hi, lo);
+
+    hi2 = 0;
+    c.d.asBytes[0] = 0;
   }
 
-  PrintAndLog("Cloning tag with ID %x%08x", hi, lo);
+  c.cmd = CMD_HID_CLONE_TAG;
+  c.arg[0] = hi2;
+  c.arg[1] = hi;
+  c.arg[2] = lo;
 
-  UsbCommand c = {CMD_HID_CLONE_TAG, {hi, lo}};
   SendCommand(&c);
   return 0;
 }
@@ -81,9 +102,9 @@ static command_t CommandTable[] =
 {
   {"help",      CmdHelp,        1, "This help"},
   {"demod",     CmdHIDDemod,    1, "Demodulate HID Prox Card II (not optimal)"},
-  {"fskdemod",  CmdHIDDemodFSK, 0, "Realtime HID FSK demodulator"},
+  {"fskdemod",  CmdHIDDemodFSK, 1, "Realtime HID FSK demodulator"},
-  {"sim",       CmdHIDSim,      0, "<ID> -- HID tag simulator"},
+  {"sim",       CmdHIDSim,      1, "<ID> -- HID tag simulator"},
-  {"clone",     CmdHIDClone,    0, "<ID> -- Clone HID to T55x7 (tag must be in antenna)"},
+  {"clone",     CmdHIDClone,    1, "<ID> ['l'] -- Clone HID to T55x7 (tag must be in antenna)(option 'l' for 84bit ID)"},
   {NULL, NULL, 0, NULL}
 };
 

client/cmdlft55xx.c

@@ -0,0 +1,151 @@
+//-----------------------------------------------------------------------------
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// Low frequency T55xx commands
+//-----------------------------------------------------------------------------
+
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#include "proxusb.h"
+#include "ui.h"
+#include "graph.h"
+#include "cmdparser.h"
+#include "cmddata.h"
+#include "cmdlf.h"
+#include "cmdlft55xx.h"
+
+static int CmdHelp(const char *Cmd);
+
+
+int CmdReadBlk(const char *Cmd)
+{
+  int Block = 8; //default to invalid block
+  UsbCommand c;
+
+  sscanf(Cmd, "%d", &Block);
+
+  if (Block > 7) {
+  	PrintAndLog("Block must be between 0 and 7");
+  	return 1;
+  }	
+
+  PrintAndLog("Reading block %d", Block);
+
+  c.cmd = CMD_T55XX_READ_BLOCK;
+  c.d.asBytes[0] = 0x0; //Normal mode
+  c.arg[0] = 0;
+  c.arg[1] = Block;
+  c.arg[2] = 0;
+  SendCommand(&c);
+  return 0;
+}
+
+int CmdReadBlkPWD(const char *Cmd)
+{
+  int Block = 8; //default to invalid block
+  int Password = 0xFFFFFFFF; //default to blank Block 7
+  UsbCommand c;
+
+  sscanf(Cmd, "%d %x", &Block, &Password);
+
+  if (Block > 7) {
+  	PrintAndLog("Block must be between 0 and 7");
+  	return 1;
+  }	
+
+  PrintAndLog("Reading block %d with password %08X", Block, Password);
+
+  c.cmd = CMD_T55XX_READ_BLOCK;
+  c.d.asBytes[0] = 0x1; //Password mode
+  c.arg[0] = 0;
+  c.arg[1] = Block;
+  c.arg[2] = Password;
+  SendCommand(&c);
+  return 0;
+}
+
+int CmdWriteBlk(const char *Cmd)
+{
+  int Block = 8; //default to invalid block
+  int Data = 0xFFFFFFFF; //default to blank Block 
+  UsbCommand c;
+
+  sscanf(Cmd, "%x %d", &Data, &Block);
+
+  if (Block > 7) {
+  	PrintAndLog("Block must be between 0 and 7");
+  	return 1;
+  }	
+
+  PrintAndLog("Writting block %d with data %08X", Block, Data);
+
+  c.cmd = CMD_T55XX_WRITE_BLOCK;
+  c.d.asBytes[0] = 0x0; //Normal mode
+  c.arg[0] = Data;
+  c.arg[1] = Block;
+  c.arg[2] = 0;
+  SendCommand(&c);
+  return 0;
+}
+
+int CmdWriteBlkPWD(const char *Cmd)
+{
+  int Block = 8; //default to invalid block
+  int Data = 0xFFFFFFFF; //default to blank Block 
+  int Password = 0xFFFFFFFF; //default to blank Block 7
+  UsbCommand c;
+
+  sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
+
+  if (Block > 7) {
+  	PrintAndLog("Block must be between 0 and 7");
+  	return 1;
+  }	
+
+  PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
+
+  c.cmd = CMD_T55XX_WRITE_BLOCK;
+  c.d.asBytes[0] = 0x1; //Password mode
+  c.arg[0] = Data;
+  c.arg[1] = Block;
+  c.arg[2] = Password;
+  SendCommand(&c);
+  return 0;
+}
+
+int CmdReadTrace(const char *Cmd)
+{
+
+  PrintAndLog("Reading traceability data");
+
+  UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
+  SendCommand(&c);
+  return 0;
+}
+
+static command_t CommandTable[] =
+{
+  {"help",          CmdHelp,        1, "This help"},
+  {"readblock",     CmdReadBlk,     1, "<Block> -- Read T55xx block data (page 0)"},
+  {"readblockPWD",  CmdReadBlkPWD,  1, "<Block> <Password> -- Read T55xx block data in password mode(page 0)"},
+  {"writeblock",    CmdWriteBlk,    1, "<Data> <Block> -- Write T55xx block data (page 0)"},
+  {"writeblockPWD", CmdWriteBlkPWD, 1, "<Data> <Block> <Password> -- Write T55xx block data in password mode(page 0)"},
+  {"readtrace",     CmdReadTrace,   1, "Read T55xx traceability data (page 1)"},
+  {NULL, NULL, 0, NULL}
+};
+
+int CmdLFT55XX(const char *Cmd)
+{
+  CmdsParse(CommandTable, Cmd);
+  return 0;
+}
+
+int CmdHelp(const char *Cmd)
+{
+  CmdsHelp(CommandTable);
+  return 0;
+}

client/cmdlft55xx.h

@@ -0,0 +1,21 @@
+//-----------------------------------------------------------------------------
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// Low frequency T55xx commands
+//-----------------------------------------------------------------------------
+
+#ifndef CMDLFT55XX_H__
+#define CMDLFT55XX_H__
+
+int CmdLFT55XX(const char *Cmd);
+
+int CmdReadBlk(const char *Cmd);
+int CmdReadBlkPWD(const char *Cmd);
+int CmdWriteBlk(const char *Cmd);
+int CmdWriteBLkPWD(const char *Cmd);
+int CmdReadTrace(const char *Cmd);
+
+#endif

include/usb_cmd.h

@@ -71,6 +71,9 @@ typedef struct {
 #define CMD_INDALA_CLONE_TAG                                              0x0212
 // for 224 bits UID
 #define CMD_INDALA_CLONE_TAG_L                                            0x0213
+#define CMD_T55XX_READ_BLOCK                                              0x0214
+#define CMD_T55XX_WRITE_BLOCK                                             0x0215
+#define CMD_T55XX_READ_TRACE                                              0x0216
 
 /* CMD_SET_ADC_MUX: ext1 is 0 for lopkd, 1 for loraw, 2 for hipkd, 3 for hiraw */