Skip to content

Commit 81ae28b

Browse files
committed
process bits before emulating them, implement them with bitwise operations + remove magic pattern
1 parent 727a009 commit 81ae28b

File tree

2 files changed

+7
-7
lines changed

2 files changed

+7
-7
lines changed

README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,11 @@ Attempting to exploit flipper hardware to some extent
4747

4848
- [X] Preprocess all MSR data into bitwise arrays, including manchester encoding.
4949
- [ ] Feed bits from timers
50-
- [ ] Sync to the lfrfid timer and experiment representing a field flip with a few cycles of a high frequency carrier. Perhaps mag readerfrontends will lowpass such signals, and keep only the low frequency component, in an attempt to drown out nearby noise
51-
- [ ] Can the CC1101 radio be used in any way? Driving it from GD0 can be done in 50us, or about 10khz. Probably more with sync/packet mode
50+
- [ ] Sync to the lfrfid timer and experiment representing a field flip with a few cycles of a high frequency carrier, like the 125khz lfrfid one. Perhaps mag readers' frontends will lowpass such signals, and keep only the low frequency component, in an attempt to drown out nearby noise?
51+
- [ ] Can the CC1101 radio be used in any way? Driving it from GD0 can achieve 50us, or about 10khz. Probably more with sync/packet mode
5252
- [ ] Can the 5V pin act as a coil driver? I've read reports it can drive 0.4A, other reports it can drive 2A. It boils down to bq25896 being fast enough. Ref: bq25896_enable_otg, which will probably need bypassing kernel libs and calling furi_hal_i2c_tx/furi_hal_i2c_tx whatever calls from Cube libs.
5353
- [ ] Investigate transparent mode on 3916
54-
- [ ] Can the piezo be used at its resonant frequency? I've seen LF signals being emulated with nothing but headphones at a subharmonic; and the wheel brake on some carts seems to also work with audiofreq signals (or the RF emission from driving a speaker)
54+
- [ ] Can the piezo be used at its resonant frequency? I've seen LF signals being emulated with [nothing but headphones](https://github.com/smre/DCF77/blob/master/DCF77.py#L124) running a subharmonic; the wheel brake on some carts seems to react to audiofreq signals (or the RF emission from driving a speaker)
5555

5656
----
5757
## Credits

helpers/mag_helpers.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -248,11 +248,11 @@ void mag_spoof_bitwise(Mag* mag) {
248248
}
249249

250250

251-
uint8_t bits_t1_raw[64] = {0x55}; // 68 chars max track 1 + 1 char crc * 7 approx =~ 483 bits
252-
uint8_t bits_t1_manchester[128] = {0x55}; // twice the above
251+
uint8_t bits_t1_raw[64] = {0x00}; // 68 chars max track 1 + 1 char crc * 7 approx =~ 483 bits
252+
uint8_t bits_t1_manchester[128] = {0x00}; // twice the above
253253
uint16_t bits_t1_count = msr_encode(data1, (uint8_t*) bits_t1_manchester, (uint8_t*) bits_t1_raw, BITS_TRACK1, OFFSET_TRACK1);
254-
uint8_t bits_t2_raw[64] = {0x55}; // 68 chars max track 1 + 1 char crc * 7 approx =~ 483 bits
255-
uint8_t bits_t2_manchester[128] = {0x55}; // twice the above
254+
uint8_t bits_t2_raw[64] = {0x00}; // 68 chars max track 1 + 1 char crc * 7 approx =~ 483 bits
255+
uint8_t bits_t2_manchester[128] = {0x00}; // twice the above
256256
uint16_t bits_t2_count = msr_encode(data2, (uint8_t*) bits_t2_manchester, (uint8_t*) bits_t2_raw, BITS_TRACK2, OFFSET_TRACK2);
257257

258258
if(furi_log_get_level() >= FuriLogLevelDebug) {

0 commit comments

Comments
 (0)