Here you can download the software for the OPEN RFID Tag Lite. Documentation is still needed!!!!
The actual version is the 0.4 and includes:
Multimap emulator
Stores up to 12 different RFID memory maps (Manchester/Biphase encoding and different data rate are supported). Pressing the button 1, you can choose which one to emulate.
A RS232 bootloader is implemented to change the memory maps. Commands:
p: prints the stored memory maps.
wABCCDDXXXXXXXX : writes a memory map. If the command is well constructed, it returns "OK"
A is the number of the memory map. 1 Byte in hex. Values from 0 to B
B is the encoding scheme. 1 byte in ASCII. 'b' form Biphase , 'm' for Manchester
CC is the data rate. 2 bytes in hex.
DD is the map size. 2 bytes in hex. Maximal value: 0x0F (firmware limited)
XXXXXXXXX are the memory map bytes. DD bytes in hex.
Frequency counter
Detects a low frequency RFID reader and shows you the frequency of the carrier (from 115KHz to 145KHz). LED1 represents 125 KHz and LED2 represents 135Khz. The LEDs blink proportionally to the received carrier. Examples:
115 KHz carrier: LED1 blinks very slowly. LED2 is off
120 KHz carrier: LED1 and LED2 blink slowly. LED2 is blinking slower than LED1
125 KHz carrier: LED1 is on but do not blink. LED2 is blinking slowly.
130 KHz carrier: LED1 and LED2 blink slowly and at the same rate.
135 KHz carrier: LED2 is on but do not blink. LED1 is blinking slowly.
....
Timing Attack
It performs a timing attack. The tag will transmit a memory map and will measure the time between the end of the transmission and denial event occurs. The event can be a rise edge of a signal measured inside the reader circuit (intrusive attack) or can be an acoustic or light signal (non intrusive attack). In this last case, you have to attach to the Open RFID Tag a circuit like an microphone or a light detector.
The RS232 connection is used to program the transmitted memory map and read the measured times. A PC-side software (not provided) is needed to perform the calculations and to decide which memory map try next.
Brute-Force & Multimap ALL-in-1 This is the old 0.2 version of the firmware. I have not yet ported the "Brute Force Attack" to the 0.4 version of the firmware, so you have to use this old one. It is commented in spanish and the code is a mess...
