Legic Tag Simulator (#666)
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
b8e461ff 13#include <stdarg.h>
14
902cb3c0 15#include "usb_cdc.h"
16#include "cmd.h"
e30c654b 17#include "proxmark3.h"
15c4dc5a 18#include "apps.h"
472345da 19#include "fpga.h"
f7e3ed82 20#include "util.h"
9ab7a6c7 21#include "printf.h"
22#include "string.h"
15c4dc5a 23#include "legicrf.h"
1b902aa0 24#include "legicrfsim.h"
b8e461ff 25#include "hitag2.h"
26#include "hitagS.h"
31abe49f 27#include "lfsampling.h"
3000dc4e 28#include "BigBuf.h"
c89274cc 29#include "mifareutil.h"
d10e08ae 30#include "pcf7931.h"
15c4dc5a 31#ifdef WITH_LCD
902cb3c0 32 #include "LCD.h"
15c4dc5a 33#endif
43591e64 34#ifdef WITH_SMARTCARD
35 #include "i2c.h"
36#endif
37
15c4dc5a 38
e46fe044 39// Craig Young - 14a stand-alone code
854fdf15 40#ifdef WITH_ISO14443a
e46fe044
CY
41 #include "iso14443a.h"
42#endif
43
15c4dc5a 44//=============================================================================
45// A buffer where we can queue things up to be sent through the FPGA, for
46// any purpose (fake tag, as reader, whatever). We go MSB first, since that
47// is the order in which they go out on the wire.
48//=============================================================================
49
6a1f2d82 50#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
51uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 52int ToSendMax;
53static int ToSendBit;
54struct common_area common_area __attribute__((section(".commonarea")));
55
15c4dc5a 56void ToSendReset(void)
57{
58 ToSendMax = -1;
59 ToSendBit = 8;
60}
61
62void ToSendStuffBit(int b)
63{
64 if(ToSendBit >= 8) {
65 ToSendMax++;
66 ToSend[ToSendMax] = 0;
67 ToSendBit = 0;
68 }
69
70 if(b) {
71 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
72 }
73
74 ToSendBit++;
75
6a1f2d82 76 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 77 ToSendBit = 0;
78 DbpString("ToSendStuffBit overflowed!");
79 }
80}
81
82//=============================================================================
83// Debug print functions, to go out over USB, to the usual PC-side client.
84//=============================================================================
85
86void DbpString(char *str)
87{
9440213d 88 byte_t len = strlen(str);
89 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 90}
91
92#if 0
93void DbpIntegers(int x1, int x2, int x3)
94{
902cb3c0 95 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 96}
97#endif
98
99void Dbprintf(const char *fmt, ...) {
100// should probably limit size here; oh well, let's just use a big buffer
101 char output_string[128];
102 va_list ap;
103
104 va_start(ap, fmt);
105 kvsprintf(fmt, output_string, 10, ap);
106 va_end(ap);
e30c654b 107
15c4dc5a 108 DbpString(output_string);
109}
110
9455b51c 111// prints HEX & ASCII
d19929cb 112void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 113 int l=0,i;
114 char ascii[9];
d19929cb 115
9455b51c 116 while (len>0) {
117 if (len>8) l=8;
118 else l=len;
119
120 memcpy(ascii,d,l);
d19929cb 121 ascii[l]=0;
9455b51c 122
123 // filter safe ascii
d19929cb 124 for (i=0;i<l;i++)
9455b51c 125 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 126
127 if (bAsci) {
128 Dbprintf("%-8s %*D",ascii,l,d," ");
129 } else {
130 Dbprintf("%*D",l,d," ");
131 }
132
9455b51c 133 len-=8;
134 d+=8;
135 }
136}
137
15c4dc5a 138//-----------------------------------------------------------------------------
139// Read an ADC channel and block till it completes, then return the result
140// in ADC units (0 to 1023). Also a routine to average 32 samples and
141// return that.
142//-----------------------------------------------------------------------------
143static int ReadAdc(int ch)
2d51da38 144{
3b692427 145 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
9b32625c 146 // AMPL_HI is are high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
147 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
3b692427 148 //
149 // The maths are:
150 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
151 //
9b32625c 152 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
15c4dc5a 153
2d51da38
I
154 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
155 AT91C_BASE_ADC->ADC_MR =
9b32625c 156 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
157 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
158 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
3b692427 159
2d51da38
I
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
15c4dc5a 162
2d51da38
I
163 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
164
165 return AT91C_BASE_ADC->ADC_CDR[ch];
15c4dc5a 166}
167
9ca155ba 168int AvgAdc(int ch) // was static - merlok
15c4dc5a 169{
170 int i;
171 int a = 0;
172
173 for(i = 0; i < 32; i++) {
174 a += ReadAdc(ch);
175 }
176
177 return (a + 15) >> 5;
178}
179
fdcfbdcc 180void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
15c4dc5a 181{
9b32625c 182 int i, adcval = 0, peak = 0;
15c4dc5a 183
184/*
185 * Sweeps the useful LF range of the proxmark from
186 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
187 * read the voltage in the antenna, the result left
188 * in the buffer is a graph which should clearly show
189 * the resonating frequency of your LF antenna
190 * ( hopefully around 95 if it is tuned to 125kHz!)
191 */
fdcfbdcc
RAB
192
193 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 194 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2d51da38
I
195 SpinDelay(50);
196
2bdd68c3 197 for (i=255; i>=19; i--) {
fdcfbdcc 198 WDT_HIT();
15c4dc5a 199 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
200 SpinDelay(20);
3b692427 201 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
fdcfbdcc
RAB
202 if (i==95) *vLf125 = adcval; // voltage at 125Khz
203 if (i==89) *vLf134 = adcval; // voltage at 134Khz
15c4dc5a 204
2d51da38 205 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
2bdd68c3 206 if(LF_Results[i] > peak) {
fdcfbdcc 207 *peakv = adcval;
2bdd68c3 208 peak = LF_Results[i];
fdcfbdcc 209 *peakf = i;
9f693930 210 //ptr = i;
15c4dc5a 211 }
212 }
213
2bdd68c3 214 for (i=18; i >= 0; i--) LF_Results[i] = 0;
fdcfbdcc
RAB
215
216 return;
217}
218
219void MeasureAntennaTuningHfOnly(int *vHf)
220{
15c4dc5a 221 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
fdcfbdcc
RAB
222 LED_A_ON();
223 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 224 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
225 SpinDelay(20);
fdcfbdcc
RAB
226 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
227 LED_A_OFF();
228
229 return;
230}
231
232void MeasureAntennaTuning(int mode)
233{
234 uint8_t LF_Results[256] = {0};
235 int peakv = 0, peakf = 0;
236 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
237
238 LED_B_ON();
239
240 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
241 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
242 MeasureAntennaTuningHfOnly(&vHf);
243 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
244 } else {
245 if (mode & FLAG_TUNE_LF) {
246 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
247 }
248 if (mode & FLAG_TUNE_HF) {
249 MeasureAntennaTuningHfOnly(&vHf);
250 }
251 }
15c4dc5a 252
d040cb90 253 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
d19929cb 254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 255 LED_B_OFF();
256 return;
15c4dc5a 257}
258
259void MeasureAntennaTuningHf(void)
260{
261 int vHf = 0; // in mV
262
263 DbpString("Measuring HF antenna, press button to exit");
264
3b692427 265 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
266 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
268
15c4dc5a 269 for (;;) {
15c4dc5a 270 SpinDelay(20);
3b692427 271 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 272
15c4dc5a 273 Dbprintf("%d mV",vHf);
274 if (BUTTON_PRESS()) break;
275 }
276 DbpString("cancelled");
3b692427 277
278 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
279
15c4dc5a 280}
281
282
15c4dc5a 283void ReadMem(int addr)
284{
f7e3ed82 285 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 286
287 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
288 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
289}
290
291/* osimage version information is linked in */
292extern struct version_information version_information;
293/* bootrom version information is pointed to from _bootphase1_version_pointer */
0fa01ec7 294extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
472345da 295
15c4dc5a 296void SendVersion(void)
297{
8e074056 298 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
299 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 300
301 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 302 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
303 * pointer, then use it.
304 */
305 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
306 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
8e074056 307 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 308 } else {
309 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
8e074056 310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 311 }
e30c654b 312
15c4dc5a 313 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
8e074056 314 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 315
472345da 316 for (int i = 0; i < fpga_bitstream_num; i++) {
317 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
318 if (i < fpga_bitstream_num - 1) {
319 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
320 }
321 }
0fa01ec7 322
e6153040 323 // Send Chip ID and used flash memory
0fa01ec7 324 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
325 uint32_t compressed_data_section_size = common_area.arg1;
8e074056 326 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 327}
328
bfb01844 329// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
330// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
67b7d6fa 331void printUSBSpeed(void)
bfb01844 332{
333 Dbprintf("USB Speed:");
67b7d6fa 334 Dbprintf(" Sending USB packets to client...");
bfb01844 335
67b7d6fa 336 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
bfb01844 337 uint8_t *test_data = BigBuf_get_addr();
67b7d6fa 338 uint32_t end_time;
bfb01844 339
67b7d6fa 340 uint32_t start_time = end_time = GetTickCount();
341 uint32_t bytes_transferred = 0;
342
bfb01844 343 LED_B_ON();
67b7d6fa 344 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
345 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
346 end_time = GetTickCount();
347 bytes_transferred += USB_CMD_DATA_SIZE;
bfb01844 348 }
349 LED_B_OFF();
350
67b7d6fa 351 Dbprintf(" Time elapsed: %dms", end_time - start_time);
352 Dbprintf(" Bytes transferred: %d", bytes_transferred);
353 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
354 1000 * bytes_transferred / (end_time - start_time));
bfb01844 355
356}
357
c89274cc
CY
358/**
359 * Prints runtime information about the PM3.
360**/
67b7d6fa 361void SendStatus(void)
c89274cc
CY
362{
363 BigBuf_print_status();
364 Fpga_print_status();
43591e64 365#ifdef WITH_SMARTCARD
366 I2C_print_status();
367#endif
c89274cc 368 printConfig(); //LF Sampling config
67b7d6fa 369 printUSBSpeed();
c89274cc 370 Dbprintf("Various");
43591e64 371 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
372 Dbprintf(" ToSendMax..........%d", ToSendMax);
373 Dbprintf(" ToSendBit..........%d", ToSendBit);
bfb01844 374
375 cmd_send(CMD_ACK,1,0,0,0,0);
c89274cc 376}
15c4dc5a 377
a2937cea 378#if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
15c4dc5a 379
15c4dc5a 380#define OPTS 2
381
86a83668
MHS
382void StandAloneMode()
383{
384 DbpString("Stand-alone mode! No PC necessary.");
15c4dc5a 385 // Oooh pretty -- notify user we're in elite samy mode now
386 LED(LED_RED, 200);
387 LED(LED_ORANGE, 200);
388 LED(LED_GREEN, 200);
389 LED(LED_ORANGE, 200);
390 LED(LED_RED, 200);
391 LED(LED_ORANGE, 200);
392 LED(LED_GREEN, 200);
393 LED(LED_ORANGE, 200);
394 LED(LED_RED, 200);
395
86a83668
MHS
396}
397
398#endif
399
400
401
402#ifdef WITH_ISO14443a_StandAlone
403void StandAloneMode14a()
404{
405 StandAloneMode();
406 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
407
15c4dc5a 408 int selected = 0;
44964fd1 409 bool playing = false, GotoRecord = false, GotoClone = false;
410 bool cardRead[OPTS] = {false};
86a83668
MHS
411 uint8_t readUID[10] = {0};
412 uint32_t uid_1st[OPTS]={0};
413 uint32_t uid_2nd[OPTS]={0};
c89274cc
CY
414 uint32_t uid_tmp1 = 0;
415 uint32_t uid_tmp2 = 0;
416 iso14a_card_select_t hi14a_card[OPTS];
15c4dc5a 417
15c4dc5a 418 LED(selected + 1, 0);
419
420 for (;;)
421 {
6e82300d 422 usb_poll();
86a83668 423 WDT_HIT();
15c4dc5a 424 SpinDelay(300);
425
44964fd1 426 if (GotoRecord || !cardRead[selected])
15c4dc5a 427 {
44964fd1 428 GotoRecord = false;
15c4dc5a 429 LEDsoff();
430 LED(selected + 1, 0);
431 LED(LED_RED2, 0);
432
433 // record
86a83668 434 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
15c4dc5a 435 /* need this delay to prevent catching some weird data */
436 SpinDelay(500);
86a83668
MHS
437 /* Code for reading from 14a tag */
438 uint8_t uid[10] ={0};
439 uint32_t cuid;
440 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
15c4dc5a 441
86a83668
MHS
442 for ( ; ; )
443 {
444 WDT_HIT();
c89274cc
CY
445 if (BUTTON_PRESS()) {
446 if (cardRead[selected]) {
447 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
448 break;
449 }
450 else if (cardRead[(selected+1)%OPTS]) {
451 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
452 selected = (selected+1)%OPTS;
44964fd1 453 break;
c89274cc
CY
454 }
455 else {
456 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
457 SpinDelay(300);
458 }
459 }
c04a4b60 460 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
86a83668
MHS
461 continue;
462 else
463 {
464 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
465 memcpy(readUID,uid,10*sizeof(uint8_t));
c89274cc 466 uint8_t *dst = (uint8_t *)&uid_tmp1;
86a83668
MHS
467 // Set UID byte order
468 for (int i=0; i<4; i++)
469 dst[i] = uid[3-i];
c89274cc 470 dst = (uint8_t *)&uid_tmp2;
86a83668
MHS
471 for (int i=0; i<4; i++)
472 dst[i] = uid[7-i];
c89274cc
CY
473 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
474 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
475 }
476 else {
477 if (uid_tmp2) {
478 Dbprintf("Bank[%d] received a 7-byte UID",selected);
479 uid_1st[selected] = (uid_tmp1)>>8;
480 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
481 }
482 else {
483 Dbprintf("Bank[%d] received a 4-byte UID",selected);
484 uid_1st[selected] = uid_tmp1;
485 uid_2nd[selected] = uid_tmp2;
486 }
487 break;
488 }
86a83668
MHS
489 }
490 }
c89274cc
CY
491 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
492 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
86a83668
MHS
493 LEDsoff();
494 LED(LED_GREEN, 200);
495 LED(LED_ORANGE, 200);
496 LED(LED_GREEN, 200);
497 LED(LED_ORANGE, 200);
15c4dc5a 498
499 LEDsoff();
500 LED(selected + 1, 0);
15c4dc5a 501
c89274cc 502 // Next state is replay:
44964fd1 503 playing = true;
3fe4ff4f 504
44964fd1 505 cardRead[selected] = true;
86a83668 506 }
c89274cc 507 /* MF Classic UID clone */
44964fd1 508 else if (GotoClone)
3fe4ff4f 509 {
44964fd1 510 GotoClone=false;
c89274cc
CY
511 LEDsoff();
512 LED(selected + 1, 0);
513 LED(LED_ORANGE, 250);
3fe4ff4f 514
3fe4ff4f 515
c89274cc
CY
516 // record
517 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
3fe4ff4f 518
c89274cc
CY
519 // wait for button to be released
520 while(BUTTON_PRESS())
521 {
522 // Delay cloning until card is in place
523 WDT_HIT();
524 }
525 Dbprintf("Starting clone. [Bank: %u]", selected);
526 // need this delay to prevent catching some weird data
527 SpinDelay(500);
528 // Begin clone function here:
529 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
530 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
531 memcpy(c.d.asBytes, data, 16);
532 SendCommand(&c);
533
534 Block read is similar:
535 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
536 We need to imitate that call with blockNo 0 to set a uid.
537
538 The get and set commands are handled in this file:
539 // Work with "magic Chinese" card
540 case CMD_MIFARE_CSETBLOCK:
541 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
542 break;
543 case CMD_MIFARE_CGETBLOCK:
544 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545 break;
546
547 mfCSetUID provides example logic for UID set workflow:
548 -Read block0 from card in field with MifareCGetBlock()
549 -Configure new values without replacing reserved bytes
550 memcpy(block0, uid, 4); // Copy UID bytes from byte array
551 // Mifare UID BCC
552 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
553 Bytes 5-7 are reserved SAK and ATQA for mifare classic
554 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
555 */
556 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
557 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
558 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
559 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
560 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
44964fd1 561 playing = true;
c89274cc
CY
562 }
563 else {
564 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
565 memcpy(newBlock0,oldBlock0,16);
566 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
567
568 newBlock0[0] = uid_1st[selected]>>24;
569 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
570 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
571 newBlock0[3] = 0xFF & (uid_1st[selected]);
572 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
573 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
574 MifareCSetBlock(0, 0xFF,0, newBlock0);
575 MifareCGetBlock(0x3F, 1, 0, testBlock0);
576 if (memcmp(testBlock0,newBlock0,16)==0)
577 {
578 DbpString("Cloned successfull!");
44964fd1 579 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
580 playing = false;
581 GotoRecord = true;
c89274cc
CY
582 selected = (selected+1) % OPTS;
583 }
584 else {
585 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
44964fd1 586 playing = true;
c89274cc
CY
587 }
588 }
589 LEDsoff();
590 LED(selected + 1, 0);
15c4dc5a 591
86a83668 592 }
15c4dc5a 593 // Change where to record (or begin playing)
44964fd1 594 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
15c4dc5a 595 {
15c4dc5a 596 LEDsoff();
597 LED(selected + 1, 0);
598
599 // Begin transmitting
44964fd1 600 LED(LED_GREEN, 0);
601 DbpString("Playing");
602 for ( ; ; ) {
603 WDT_HIT();
604 int button_action = BUTTON_HELD(1000);
605 if (button_action == 0) { // No button action, proceed with sim
606 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
607 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
608 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
609 DbpString("Mifare Classic");
610 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
c89274cc 611 }
44964fd1 612 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
613 DbpString("Mifare Ultralight");
614 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
15c4dc5a 615 }
44964fd1 616 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
617 DbpString("Mifare DESFire");
618 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
619 }
620 else {
621 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
622 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
c89274cc 623 }
c89274cc 624 }
44964fd1 625 else if (button_action == BUTTON_SINGLE_CLICK) {
626 selected = (selected + 1) % OPTS;
627 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
628 GotoRecord = true;
629 break;
630 }
631 else if (button_action == BUTTON_HOLD) {
632 Dbprintf("Playtime over. Begin cloning...");
633 GotoClone = true;
634 break;
635 }
636 WDT_HIT();
15c4dc5a 637 }
44964fd1 638
639 /* We pressed a button so ignore it here with a delay */
640 SpinDelay(300);
641 LEDsoff();
642 LED(selected + 1, 0);
15c4dc5a 643 }
644 }
645}
a2937cea 646#elif WITH_LF_StandAlone
86a83668
MHS
647// samy's sniff and repeat routine
648void SamyRun()
e46fe044 649{
86a83668
MHS
650 StandAloneMode();
651 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
e46fe044 652
86a83668 653 int high[OPTS], low[OPTS];
15c4dc5a 654 int selected = 0;
655 int playing = 0;
3fe4ff4f 656 int cardRead = 0;
15c4dc5a 657
658 // Turn on selected LED
659 LED(selected + 1, 0);
660
661 for (;;)
662 {
6e82300d 663 usb_poll();
86a83668 664 WDT_HIT();
15c4dc5a 665
666 // Was our button held down or pressed?
667 int button_pressed = BUTTON_HELD(1000);
668 SpinDelay(300);
669
670 // Button was held for a second, begin recording
3fe4ff4f 671 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 672 {
673 LEDsoff();
674 LED(selected + 1, 0);
675 LED(LED_RED2, 0);
676
677 // record
678 DbpString("Starting recording");
679
680 // wait for button to be released
681 while(BUTTON_PRESS())
682 WDT_HIT();
683
684 /* need this delay to prevent catching some weird data */
685 SpinDelay(500);
686
687 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
098015eb 688 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
15c4dc5a 689
690 LEDsoff();
691 LED(selected + 1, 0);
692 // Finished recording
693
694 // If we were previously playing, set playing off
695 // so next button push begins playing what we recorded
696 playing = 0;
3fe4ff4f 697
698 cardRead = 1;
699
700 }
701
702 else if (button_pressed > 0 && cardRead == 1)
703 {
704 LEDsoff();
705 LED(selected + 1, 0);
706 LED(LED_ORANGE, 0);
707
708 // record
098015eb 709 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
3fe4ff4f 710
711 // wait for button to be released
712 while(BUTTON_PRESS())
713 WDT_HIT();
714
715 /* need this delay to prevent catching some weird data */
716 SpinDelay(500);
717
098015eb 718 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
719 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
3fe4ff4f 720
721 LEDsoff();
722 LED(selected + 1, 0);
723 // Finished recording
724
725 // If we were previously playing, set playing off
726 // so next button push begins playing what we recorded
727 playing = 0;
728
729 cardRead = 0;
730
15c4dc5a 731 }
732
733 // Change where to record (or begin playing)
734 else if (button_pressed)
735 {
736 // Next option if we were previously playing
737 if (playing)
738 selected = (selected + 1) % OPTS;
739 playing = !playing;
740
741 LEDsoff();
742 LED(selected + 1, 0);
743
744 // Begin transmitting
745 if (playing)
746 {
747 LED(LED_GREEN, 0);
748 DbpString("Playing");
749 // wait for button to be released
750 while(BUTTON_PRESS())
751 WDT_HIT();
098015eb 752 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
15c4dc5a 753 CmdHIDsimTAG(high[selected], low[selected], 0);
754 DbpString("Done playing");
755 if (BUTTON_HELD(1000) > 0)
756 {
757 DbpString("Exiting");
758 LEDsoff();
759 return;
760 }
761
762 /* We pressed a button so ignore it here with a delay */
763 SpinDelay(300);
764
765 // when done, we're done playing, move to next option
766 selected = (selected + 1) % OPTS;
767 playing = !playing;
768 LEDsoff();
769 LED(selected + 1, 0);
770 }
771 else
772 while(BUTTON_PRESS())
773 WDT_HIT();
774 }
775 }
776}
15c4dc5a 777
e46fe044 778#endif
15c4dc5a 779/*
780OBJECTIVE
781Listen and detect an external reader. Determine the best location
782for the antenna.
783
784INSTRUCTIONS:
785Inside the ListenReaderField() function, there is two mode.
786By default, when you call the function, you will enter mode 1.
787If you press the PM3 button one time, you will enter mode 2.
788If you press the PM3 button a second time, you will exit the function.
789
790DESCRIPTION OF MODE 1:
791This mode just listens for an external reader field and lights up green
792for HF and/or red for LF. This is the original mode of the detectreader
793function.
794
795DESCRIPTION OF MODE 2:
796This mode will visually represent, using the LEDs, the actual strength of the
797current compared to the maximum current detected. Basically, once you know
798what kind of external reader is present, it will help you spot the best location to place
799your antenna. You will probably not get some good results if there is a LF and a HF reader
800at the same place! :-)
801
802LIGHT SCHEME USED:
803*/
804static const char LIGHT_SCHEME[] = {
805 0x0, /* ---- | No field detected */
806 0x1, /* X--- | 14% of maximum current detected */
807 0x2, /* -X-- | 29% of maximum current detected */
808 0x4, /* --X- | 43% of maximum current detected */
809 0x8, /* ---X | 57% of maximum current detected */
810 0xC, /* --XX | 71% of maximum current detected */
811 0xE, /* -XXX | 86% of maximum current detected */
812 0xF, /* XXXX | 100% of maximum current detected */
813};
814static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
815
816void ListenReaderField(int limit)
817{
3b692427 818 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
819 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
15c4dc5a 820 int mode=1, display_val, display_max, i;
821
3b692427 822#define LF_ONLY 1
823#define HF_ONLY 2
824#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
825
826
827 // switch off FPGA - we don't want to measure our own signal
828 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
829 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 830
831 LEDsoff();
832
3b692427 833 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 834
835 if(limit != HF_ONLY) {
3b692427 836 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 837 lf_baseline = lf_av;
838 }
839
3b692427 840 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 841
842 if (limit != LF_ONLY) {
3b692427 843 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 844 hf_baseline = hf_av;
845 }
846
847 for(;;) {
848 if (BUTTON_PRESS()) {
849 SpinDelay(500);
850 switch (mode) {
851 case 1:
852 mode=2;
853 DbpString("Signal Strength Mode");
854 break;
855 case 2:
856 default:
857 DbpString("Stopped");
858 LEDsoff();
859 return;
860 break;
861 }
862 }
863 WDT_HIT();
864
865 if (limit != HF_ONLY) {
3b692427 866 if(mode == 1) {
cf194819 867 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
3b692427 868 LED_D_ON();
869 else
870 LED_D_OFF();
15c4dc5a 871 }
e30c654b 872
3b692427 873 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 874 // see if there's a significant change
cf194819 875 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
3b692427 876 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 877 lf_av = lf_av_new;
878 if (lf_av > lf_max)
879 lf_max = lf_av;
15c4dc5a 880 }
881 }
882
883 if (limit != LF_ONLY) {
884 if (mode == 1){
cf194819 885 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
3b692427 886 LED_B_ON();
887 else
888 LED_B_OFF();
15c4dc5a 889 }
e30c654b 890
3b692427 891 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 892 // see if there's a significant change
cf194819 893 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
3b692427 894 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 895 hf_av = hf_av_new;
896 if (hf_av > hf_max)
897 hf_max = hf_av;
15c4dc5a 898 }
899 }
e30c654b 900
15c4dc5a 901 if(mode == 2) {
902 if (limit == LF_ONLY) {
903 display_val = lf_av;
904 display_max = lf_max;
905 } else if (limit == HF_ONLY) {
906 display_val = hf_av;
907 display_max = hf_max;
908 } else { /* Pick one at random */
909 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
910 display_val = hf_av;
911 display_max = hf_max;
912 } else {
913 display_val = lf_av;
914 display_max = lf_max;
915 }
916 }
917 for (i=0; i<LIGHT_LEN; i++) {
918 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
919 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
920 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
921 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
922 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
923 break;
924 }
925 }
926 }
927 }
928}
929
f7e3ed82 930void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 931{
932 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 933
902cb3c0 934// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
935
15c4dc5a 936 switch(c->cmd) {
937#ifdef WITH_LF
31abe49f
MHS
938 case CMD_SET_LF_SAMPLING_CONFIG:
939 setSamplingConfig((sample_config *) c->d.asBytes);
940 break;
15c4dc5a 941 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
b9957414 942 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
15c4dc5a 943 break;
15c4dc5a 944 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
945 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
946 break;
b014c96d 947 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 948 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 949 break;
7e67e42f 950 case CMD_HID_DEMOD_FSK:
3fe4ff4f 951 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 952 break;
953 case CMD_HID_SIM_TAG:
3fe4ff4f 954 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 955 break;
abd6112f 956 case CMD_FSK_SIM_TAG:
957 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
958 break;
959 case CMD_ASK_SIM_TAG:
960 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
961 break;
872e3d4d 962 case CMD_PSK_SIM_TAG:
963 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
964 break;
965 case CMD_HID_CLONE_TAG:
1c611bbd 966 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 967 break;
a1f3bb12 968 case CMD_IO_DEMOD_FSK:
3fe4ff4f 969 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 970 break;
3fe4ff4f 971 case CMD_IO_CLONE_TAG:
9f669cb2 972 CopyIOtoT55x7(c->arg[0], c->arg[1]);
a1f3bb12 973 break;
66707a3b 974 case CMD_EM410X_DEMOD:
975 CmdEM410xdemod(c->arg[0], 0, 0, 1);
976 break;
2d4eae76 977 case CMD_EM410X_WRITE_TAG:
978 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
979 break;
7e67e42f 980 case CMD_READ_TI_TYPE:
981 ReadTItag();
982 break;
983 case CMD_WRITE_TI_TYPE:
984 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
985 break;
986 case CMD_SIMULATE_TAG_125K:
31d1caa5 987 LED_A_ON();
7e67e42f 988 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
31d1caa5 989 LED_A_OFF();
7e67e42f 990 break;
991 case CMD_LF_SIMULATE_BIDIR:
992 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
993 break;
3fe4ff4f 994 case CMD_INDALA_CLONE_TAG:
2414f978 995 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
996 break;
3fe4ff4f 997 case CMD_INDALA_CLONE_TAG_L:
2414f978 998 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
999 break;
1c611bbd 1000 case CMD_T55XX_READ_BLOCK:
8e99ec25 1001 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1002 break;
1003 case CMD_T55XX_WRITE_BLOCK:
1004 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1005 break;
be2d41b7 1006 case CMD_T55XX_WAKEUP:
1007 T55xxWakeUp(c->arg[0]);
1c611bbd 1008 break;
66837a03 1009 case CMD_T55XX_RESET_READ:
1010 T55xxResetRead();
1011 break;
3fe4ff4f 1012 case CMD_PCF7931_READ:
1c611bbd 1013 ReadPCF7931();
1c611bbd 1014 break;
dc4300ba 1015 case CMD_PCF7931_WRITE:
d10e08ae 1016 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
dc4300ba 1017 break;
1c611bbd 1018 case CMD_EM4X_READ_WORD:
7666f460 1019 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1c611bbd 1020 break;
1021 case CMD_EM4X_WRITE_WORD:
7666f460 1022 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1023 break;
dbf6e824
CY
1024 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1025 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
7cfc777b 1026 break;
709665b5 1027 case CMD_VIKING_CLONE_TAG:
1028 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1029 break;
e04475c4 1030 case CMD_COTAG:
1031 Cotag(c->arg[0]);
1032 break;
15c4dc5a 1033#endif
1034
d19929cb 1035#ifdef WITH_HITAG
1036 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1037 SnoopHitag(c->arg[0]);
1038 break;
1039 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1040 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1041 break;
1042 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1043 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1044 break;
4e12287d
RS
1045 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1046 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1047 break;
1048 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1049 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1050 break;
1051 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1052 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1053 break;
1054 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
52244230
HJ
1055 if ((hitag_function)c->arg[0] < 10) {
1056 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1057 }
1058 else if ((hitag_function)c->arg[0] >= 10) {
1059 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1060 }
4e12287d 1061 break;
d19929cb 1062#endif
f168b263 1063
15c4dc5a 1064#ifdef WITH_ISO15693
1065 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1066 AcquireRawAdcSamplesIso15693();
1067 break;
9455b51c 1068 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1069 RecordRawAdcSamplesIso15693();
1070 break;
1071
1072 case CMD_ISO_15693_COMMAND:
1073 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1074 break;
1075
1076 case CMD_ISO_15693_FIND_AFI:
1077 BruteforceIso15693Afi(c->arg[0]);
1078 break;
1079
1080 case CMD_ISO_15693_DEBUG:
1081 SetDebugIso15693(c->arg[0]);
1082 break;
15c4dc5a 1083
15c4dc5a 1084 case CMD_READER_ISO_15693:
1085 ReaderIso15693(c->arg[0]);
1086 break;
7e67e42f 1087 case CMD_SIMTAG_ISO_15693:
3fe4ff4f 1088 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 1089 break;
15c4dc5a 1090#endif
1091
7e67e42f 1092#ifdef WITH_LEGICRF
1093 case CMD_SIMULATE_TAG_LEGIC_RF:
1b902aa0 1094 LegicRfSimulate(c->arg[0]);
7e67e42f 1095 break;
3612a8a8 1096
7e67e42f 1097 case CMD_WRITER_LEGIC_RF:
1098 LegicRfWriter(c->arg[1], c->arg[0]);
1099 break;
3612a8a8 1100
15c4dc5a 1101 case CMD_READER_LEGIC_RF:
1102 LegicRfReader(c->arg[0], c->arg[1]);
1103 break;
15c4dc5a 1104#endif
1105
1106#ifdef WITH_ISO14443b
15c4dc5a 1107 case CMD_READ_SRI512_TAG:
51d4f6f1 1108 ReadSTMemoryIso14443b(0x0F);
15c4dc5a 1109 break;
7e67e42f 1110 case CMD_READ_SRIX4K_TAG:
51d4f6f1 1111 ReadSTMemoryIso14443b(0x7F);
7e67e42f 1112 break;
132a0217 1113 case CMD_SNOOP_ISO_14443B:
51d4f6f1 1114 SnoopIso14443b();
7e67e42f 1115 break;
132a0217 1116 case CMD_SIMULATE_TAG_ISO_14443B:
51d4f6f1 1117 SimulateIso14443bTag();
7e67e42f 1118 break;
7cf3ef20 1119 case CMD_ISO_14443B_COMMAND:
1120 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1121 break;
15c4dc5a 1122#endif
1123
1124#ifdef WITH_ISO14443a
7e67e42f 1125 case CMD_SNOOP_ISO_14443a:
5cd9ec01 1126 SnoopIso14443a(c->arg[0]);
7e67e42f 1127 break;
15c4dc5a 1128 case CMD_READER_ISO_14443a:
902cb3c0 1129 ReaderIso14443a(c);
15c4dc5a 1130 break;
7e67e42f 1131 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 1132 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 1133 break;
3fe4ff4f 1134
5acd09bd 1135 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 1136 EPA_PACE_Collect_Nonce(c);
5acd09bd 1137 break;
3bb07d96
FM
1138 case CMD_EPA_PACE_REPLAY:
1139 EPA_PACE_Replay(c);
1140 break;
7e67e42f 1141
15c4dc5a 1142 case CMD_READER_MIFARE:
f168b263 1143 ReaderMifare(c->arg[0]);
15c4dc5a 1144 break;
20f9a2a1
M
1145 case CMD_MIFARE_READBL:
1146 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1147 break;
981bd429 1148 case CMD_MIFAREU_READBL:
f168b263 1149 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 1150 break;
8258f409 1151 case CMD_MIFAREUC_AUTH:
1152 MifareUC_Auth(c->arg[0],c->d.asBytes);
a631936e 1153 break;
981bd429 1154 case CMD_MIFAREU_READCARD:
75377d29 1155 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 1156 break;
f168b263 1157 case CMD_MIFAREUC_SETPWD:
1158 MifareUSetPwd(c->arg[0], c->d.asBytes);
1159 break;
20f9a2a1
M
1160 case CMD_MIFARE_READSC:
1161 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1162 break;
1163 case CMD_MIFARE_WRITEBL:
1164 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1165 break;
4973f23d 1166 //case CMD_MIFAREU_WRITEBL_COMPAT:
1167 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1168 //break;
981bd429 1169 case CMD_MIFAREU_WRITEBL:
4973f23d 1170 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
f168b263 1171 break;
c48c4d78 1172 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1173 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1174 break;
20f9a2a1
M
1175 case CMD_MIFARE_NESTED:
1176 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
1177 break;
1178 case CMD_MIFARE_CHKKEYS:
1179 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
1180 break;
1181 case CMD_SIMULATE_MIFARE_CARD:
1182 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1183 break;
8556b852
M
1184
1185 // emulator
1186 case CMD_MIFARE_SET_DBGMODE:
1187 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1188 break;
1189 case CMD_MIFARE_EML_MEMCLR:
1190 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1191 break;
1192 case CMD_MIFARE_EML_MEMSET:
1193 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1194 break;
1195 case CMD_MIFARE_EML_MEMGET:
1196 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1197 break;
1198 case CMD_MIFARE_EML_CARDLOAD:
1199 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
1200 break;
1201
1202 // Work with "magic Chinese" card
3a05a1e7
OM
1203 case CMD_MIFARE_CWIPE:
1204 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1205 break;
3fe4ff4f 1206 case CMD_MIFARE_CSETBLOCK:
0675f200 1207 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 1208 break;
3fe4ff4f 1209 case CMD_MIFARE_CGETBLOCK:
545a1f38 1210 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 1211 break;
3fe4ff4f 1212 case CMD_MIFARE_CIDENT:
1213 MifareCIdent();
1214 break;
b62a5a84
M
1215
1216 // mifare sniffer
1217 case CMD_MIFARE_SNIFFER:
5cd9ec01 1218 SniffMifare(c->arg[0]);
b62a5a84 1219 break;
a631936e 1220
20f9a2a1
M
1221#endif
1222
7e67e42f 1223#ifdef WITH_ICLASS
cee5a30d 1224 // Makes use of ISO14443a FPGA Firmware
1225 case CMD_SNOOP_ICLASS:
1226 SnoopIClass();
1227 break;
1e262141 1228 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 1229 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 1230 break;
1231 case CMD_READER_ICLASS:
1232 ReaderIClass(c->arg[0]);
1233 break;
c3963755 1234 case CMD_READER_ICLASS_REPLAY:
aa53efc3 1235 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 1236 break;
aa53efc3 1237 case CMD_ICLASS_EML_MEMSET:
e80aeb96
MHS
1238 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1239 break;
aa53efc3 1240 case CMD_ICLASS_WRITEBLOCK:
3ac22ee1 1241 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1242 break;
1243 case CMD_ICLASS_READCHECK: // auth step 1
1244 iClass_ReadCheck(c->arg[0], c->arg[1]);
aa53efc3 1245 break;
1246 case CMD_ICLASS_READBLOCK:
3ac22ee1 1247 iClass_ReadBlk(c->arg[0]);
aa53efc3 1248 break;
3ac22ee1 1249 case CMD_ICLASS_AUTHENTICATION: //check
aa53efc3 1250 iClass_Authentication(c->d.asBytes);
1251 break;
1252 case CMD_ICLASS_DUMP:
3ac22ee1 1253 iClass_Dump(c->arg[0], c->arg[1]);
aa53efc3 1254 break;
1255 case CMD_ICLASS_CLONE:
3ac22ee1 1256 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
aa53efc3 1257 break;
cee5a30d 1258#endif
0472d76d 1259#ifdef WITH_HFSNOOP
1260 case CMD_HF_SNIFFER:
1261 HfSnoop(c->arg[0], c->arg[1]);
1262 break;
1263#endif
43591e64 1264#ifdef WITH_SMARTCARD
1265 case CMD_SMART_ATR: {
1266 SmartCardAtr();
1267 break;
1268 }
1269 case CMD_SMART_SETCLOCK:{
1270 SmartCardSetClock(c->arg[0]);
1271 break;
1272 }
1273 case CMD_SMART_RAW: {
1274 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1275 break;
1276 }
1277 case CMD_SMART_UPLOAD: {
1278 // upload file from client
1279 uint8_t *mem = BigBuf_get_addr();
1280 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1281 cmd_send(CMD_ACK,1,0,0,0,0);
1282 break;
1283 }
1284 case CMD_SMART_UPGRADE: {
1285 SmartCardUpgrade(c->arg[0]);
1286 break;
1287 }
1288#endif
cee5a30d 1289
7e67e42f 1290 case CMD_BUFF_CLEAR:
117d9ec2 1291 BigBuf_Clear();
15c4dc5a 1292 break;
15c4dc5a 1293
1294 case CMD_MEASURE_ANTENNA_TUNING:
fdcfbdcc 1295 MeasureAntennaTuning(c->arg[0]);
15c4dc5a 1296 break;
1297
1298 case CMD_MEASURE_ANTENNA_TUNING_HF:
1299 MeasureAntennaTuningHf();
1300 break;
1301
1302 case CMD_LISTEN_READER_FIELD:
1303 ListenReaderField(c->arg[0]);
1304 break;
1305
15c4dc5a 1306 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1307 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1308 SpinDelay(200);
1309 LED_D_OFF(); // LED D indicates field ON or OFF
1310 break;
1311
1c611bbd 1312 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 1313
1c611bbd 1314 LED_B_ON();
117d9ec2 1315 uint8_t *BigBuf = BigBuf_get_addr();
1c611bbd 1316 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1317 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 1318 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 1319 }
1320 // Trigger a finish downloading signal with an ACK frame
3000dc4e 1321 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 1322 LED_B_OFF();
1c611bbd 1323 break;
15c4dc5a 1324
1325 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
8c8317a5 1326 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1327 // to be able to use this one for uploading data to device
1328 // arg1 = 0 upload for LF usage
1329 // 1 upload for HF usage
1330 if (c->arg[1] == 0)
1331 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1332 else
1333 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1334
117d9ec2 1335 uint8_t *b = BigBuf_get_addr();
3fe4ff4f 1336 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 1337 cmd_send(CMD_ACK,0,0,0,0,0);
1338 break;
1339 }
15c4dc5a 1340 case CMD_READ_MEM:
1341 ReadMem(c->arg[0]);
1342 break;
1343
1344 case CMD_SET_LF_DIVISOR:
8c8317a5 1345 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 1346 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1347 break;
1348
1349 case CMD_SET_ADC_MUX:
1350 switch(c->arg[0]) {
1351 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1352 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1353 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1354 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1355 }
1356 break;
1357
1358 case CMD_VERSION:
1359 SendVersion();
1360 break;
c89274cc 1361 case CMD_STATUS:
67b7d6fa 1362 SendStatus();
c89274cc
CY
1363 break;
1364 case CMD_PING:
1365 cmd_send(CMD_ACK,0,0,0,0,0);
1366 break;
15c4dc5a 1367#ifdef WITH_LCD
1368 case CMD_LCD_RESET:
1369 LCDReset();
1370 break;
1371 case CMD_LCD:
1372 LCDSend(c->arg[0]);
1373 break;
1374#endif
1375 case CMD_SETUP_WRITE:
1376 case CMD_FINISH_WRITE:
1c611bbd 1377 case CMD_HARDWARE_RESET:
1378 usb_disable();
15c4dc5a 1379 SpinDelay(1000);
1380 SpinDelay(1000);
1381 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1382 for(;;) {
1383 // We're going to reset, and the bootrom will take control.
1384 }
1c611bbd 1385 break;
15c4dc5a 1386
1c611bbd 1387 case CMD_START_FLASH:
15c4dc5a 1388 if(common_area.flags.bootrom_present) {
1389 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1390 }
1c611bbd 1391 usb_disable();
15c4dc5a 1392 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1393 for(;;);
1c611bbd 1394 break;
e30c654b 1395
15c4dc5a 1396 case CMD_DEVICE_INFO: {
902cb3c0 1397 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1398 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1399 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1400 break;
1401 }
1402 default:
15c4dc5a 1403 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1404 break;
15c4dc5a 1405 }
1406}
1407
1408void __attribute__((noreturn)) AppMain(void)
1409{
1410 SpinDelay(100);
9e8255d4 1411 clear_trace();
15c4dc5a 1412 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1413 /* Initialize common area */
1414 memset(&common_area, 0, sizeof(common_area));
1415 common_area.magic = COMMON_AREA_MAGIC;
1416 common_area.version = 1;
1417 }
1418 common_area.flags.osimage_present = 1;
1419
1420 LED_D_OFF();
1421 LED_C_OFF();
1422 LED_B_OFF();
1423 LED_A_OFF();
1424
3fe4ff4f 1425 // Init USB device
902cb3c0 1426 usb_enable();
15c4dc5a 1427
1428 // The FPGA gets its clock from us from PCK0 output, so set that up.
1429 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1430 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1431 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1432 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1433 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
0472d76d 1434 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
15c4dc5a 1435 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1436
1437 // Reset SPI
1438 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1439 // Reset SSC
1440 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1441
1442 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1443 // (the HF version by default)
1444 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1445
9ca155ba 1446 StartTickCount();
902cb3c0 1447
15c4dc5a 1448#ifdef WITH_LCD
15c4dc5a 1449 LCDInit();
15c4dc5a 1450#endif
1451
902cb3c0 1452 byte_t rx[sizeof(UsbCommand)];
1453 size_t rx_len;
1454
15c4dc5a 1455 for(;;) {
902cb3c0 1456 if (usb_poll()) {
1457 rx_len = usb_read(rx,sizeof(UsbCommand));
1458 if (rx_len) {
1459 UsbPacketReceived(rx,rx_len);
1460 }
1461 }
15c4dc5a 1462 WDT_HIT();
1463
a2937cea 1464#ifdef WITH_LF_StandAlone
e46fe044 1465#ifndef WITH_ISO14443a_StandAlone
15c4dc5a 1466 if (BUTTON_HELD(1000) > 0)
1467 SamyRun();
e46fe044
CY
1468#endif
1469#endif
1470#ifdef WITH_ISO14443a
1471#ifdef WITH_ISO14443a_StandAlone
1472 if (BUTTON_HELD(1000) > 0)
1473 StandAloneMode14a();
1474#endif
15c4dc5a 1475#endif
1476 }
1477}
Impressum, Datenschutz