dash/proxmark3
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ADD: 'LF T55X7 WAKEUP' command. For tags with AOR bit set, send this command with password to wake tag up and be able to do a "LF SEARCH" etc on it.

Browse Source 
CHG:  Minor code changes on T55X7 code.   Default password is back to 'FF FF FF FF',
REM:  removed @marshmellow42 's wakeup option in "lf t55x7 read",

---  BASICALLY:
if a  T55X7 tag has following bits set:
AOR -  send wakeup command with pwd, to enable LF interacting with it.
PWD -  send read/write/trace/info command with pwd.  No need to send wakeup.
This commit is contained in:
iceman1001
2015-10-21 09:12:33 +02:00
parent f82894ba69
commit 1c8fbeb93e
5 changed files with 111 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
armsrc/appmain.c
View File

@@ -921,7 +921,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
setSamplingConfig((sample_config *) c->d.asBytes);
break;
case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
break;
case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);

59
armsrc/lfops.c
View File

@@ -1197,7 +1197,8 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMod
// Read one card block in page 0
void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
LED_A_ON();
uint8_t PwdMode = arg0 & 0xFF;
uint8_t PwdMode = arg0 & 0x01;
uint8_t Page = arg0 & 0x02;
uint32_t i = 0;
//clear buffer now so it does not interfere with timing later
@@ -1215,7 +1216,7 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
// Opcode 10
T55xxWriteBit(1);
T55xxWriteBit(0); //Page 0
T55xxWriteBit(Page); //Page 0
if (PwdMode){
// Send Pwd
@@ -1245,33 +1246,45 @@ void T55xxReadBlock(uint16_t arg0, uint8_t Block, uint32_t Pwd) {
// Read card traceability data (page 1)
void T55xxReadTrace(void){
LED_A_ON();
// LED_A_ON();
//clear buffer now so it does not interfere with timing later
BigBuf_Clear_ext(false);
// uint8_t PwdMode = arg0 & 0xFF;
// uint32_t i = 0;
// //clear buffer now so it does not interfere with timing later
// BigBuf_Clear_ext(false);
// Set up FPGA, 125kHz
LFSetupFPGAForADC(95, true);
// // Set up FPGA, 125kHz
// LFSetupFPGAForADC(95, true);
// Trigger T55x7 Direct Access Mode
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
SpinDelayUs(START_GAP);
// // Trigger T55x7 Direct Access Mode
// FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
// SpinDelayUs(START_GAP);
// Opcode 11
T55xxWriteBit(1);
T55xxWriteBit(1); //Page 1
// // Opcode 11
// T55xxWriteBit(1);
// T55xxWriteBit(1); //Page 1
// Turn field on to read the response
TurnReadLFOn(READ_GAP);
// if (PwdMode){
// // Send Pwd
// for (i = 0x80000000; i != 0; i >>= 1)
// T55xxWriteBit(Pwd & i);
// }
// Acquisition
doT55x7Acquisition();
// // Send a zero bit separation
// T55xxWriteBit(0);
// // Turn field on to read the response
// TurnReadLFOn(READ_GAP);
// turn field off
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
cmd_send(CMD_ACK,0,0,0,0,0);
LED_A_OFF();
LED_B_OFF();
// // Acquisition
// doT55x7Acquisition();
// // turn field off
// FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
// cmd_send(CMD_ACK,0,0,0,0,0);
// LED_A_OFF();
// LED_B_OFF();
}
void T55xxWakeUp(uint32_t Pwd){
@@ -1294,7 +1307,7 @@ void T55xxWakeUp(uint32_t Pwd){
T55xxWriteBit(Pwd & i);
// Turn field on to read the response
TurnReadLFOn(READ_GAP);
TurnReadLFOn(20*1000);
}
/*-------------- Cloning routines -----------*/

43
armsrc/lfsampling.c
View File

@@ -121,11 +121,11 @@ void LFSetupFPGAForADC(int divisor, bool lf_field)
*/
uint32_t DoAcquisition(uint8_t decimation, uint32_t bits_per_sample, bool averaging, int trigger_threshold,bool silent)
{
//.
//bigbuf, to hold the aquired raw data signal
uint8_t *dest = BigBuf_get_addr();
int bufsize = BigBuf_max_traceLen();
uint16_t bufsize = BigBuf_max_traceLen();
memset(dest, 0, bufsize);
BigBuf_Clear_ext(false);
if(bits_per_sample < 1) bits_per_sample = 1;
if(bits_per_sample > 8) bits_per_sample = 8;
@@ -244,7 +244,6 @@ uint32_t SampleLF(bool printCfg)
* Initializes the FPGA for snoop-mode (field off), and acquires the samples.
* @return number of bits sampled
**/
uint32_t SnoopLF() {
return ReadLF(false, true);
}
@@ -256,9 +255,9 @@ uint32_t SnoopLF() {
void doT55x7Acquisition(void){
#define T55xx_SAMPLES_SIZE 12000 // 32 x 32 x 10 (32 bit times numofblock (7), times clock skip..)
#define T55xx_READ_UPPER_THRESHOLD 128+40 // 50
#define T55xx_UPPER_THRESHOLD 128+40 // 50
#define T55xx_READ_TOL 5
//#define T55xx_READ_LOWER_THRESHOLD 128-40 //-50
#define T55xx_LOWER_THRESHOLD 128-40 //-50
uint8_t *dest = BigBuf_get_addr();
uint16_t bufsize = BigBuf_max_traceLen();
@@ -267,39 +266,37 @@ void doT55x7Acquisition(void){
bufsize = T55xx_SAMPLES_SIZE;
uint16_t i = 0;
uint16_t nosignal = 0;
bool startFound = false;
bool highFound = false;
uint8_t curSample = 0;
uint8_t sample = 0;
uint8_t firstSample = 0;
while(!BUTTON_PRESS()) {
WDT_HIT();
if ( nosignal == 0xFFFF ) break;
WDT_HIT();
if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
AT91C_BASE_SSC->SSC_THR = 0x43;
AT91C_BASE_SSC->SSC_THR = 0x00;
LED_D_ON();
}
if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
curSample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
LED_D_OFF();
// find first high sample
if (!startFound && curSample > T55xx_READ_UPPER_THRESHOLD) {
if (curSample > firstSample)
firstSample = curSample;
highFound = true;
if (!startFound && sample > T55xx_UPPER_THRESHOLD) {
if (sample > firstSample)
firstSample = sample;
highFound = TRUE;
} else if (!highFound) {
nosignal++;
continue;
}
// skip until samples begin to change
if (startFound || curSample < firstSample-T55xx_READ_TOL){
if (startFound || sample < firstSample - T55xx_READ_TOL){
if (!startFound)
dest[i++] = firstSample;
startFound = true;
dest[i++] = curSample;
LED_D_OFF();
startFound = TRUE;
dest[i++] = sample;
// exit condition.
if (i >= bufsize) break;
}
}