[proxmark3-svn] / armsrc / appmain.c

//-----------------------------------------------------------------------------\r
// The main application code. This is the first thing called after start.c\r
// executes.\r
// Jonathan Westhues, Mar 2006\r
// Edits by Gerhard de Koning Gans, Sep 2007 (##)\r
//-----------------------------------------------------------------------------\r
#include <proxmark3.h>\r
#include "apps.h"\r
#include "fonts.h"\r
#include "LCD.h"\r
\r
// The large multi-purpose buffer, typically used to hold A/D samples,\r
// maybe pre-processed in some way.\r
DWORD BigBuf[16000];\r
\r
//=============================================================================\r
// A buffer where we can queue things up to be sent through the FPGA, for\r
// any purpose (fake tag, as reader, whatever). We go MSB first, since that\r
// is the order in which they go out on the wire.\r
//=============================================================================\r
\r
BYTE ToSend[256];\r
int ToSendMax;\r
static int ToSendBit;\r
\r
void ToSendReset(void)\r
{\r
	ToSendMax = -1;\r
	ToSendBit = 8;\r
}\r
\r
void ToSendStuffBit(int b)\r
{\r
	if(ToSendBit >= 8) {\r
		ToSendMax++;\r
		ToSend[ToSendMax] = 0;\r
		ToSendBit = 0;\r
	}\r
\r
	if(b) {\r
		ToSend[ToSendMax] |= (1 << (7 - ToSendBit));\r
	}\r
\r
	ToSendBit++;\r
\r
	if(ToSendBit >= sizeof(ToSend)) {\r
		ToSendBit = 0;\r
		DbpString("ToSendStuffBit overflowed!");\r
	}\r
}\r
\r
//=============================================================================\r
// Debug print functions, to go out over USB, to the usual PC-side client.\r
//=============================================================================\r
\r
void DbpString(char *str)\r
{\r
	UsbCommand c;\r
	c.cmd = CMD_DEBUG_PRINT_STRING;\r
	c.ext1 = strlen(str);\r
	memcpy(c.d.asBytes, str, c.ext1);\r
\r
	UsbSendPacket((BYTE *)&c, sizeof(c));\r
	// TODO fix USB so stupid things like this aren't req'd\r
	SpinDelay(50);\r
}\r
\r
void DbpIntegers(int x1, int x2, int x3)\r
{\r
	UsbCommand c;\r
	c.cmd = CMD_DEBUG_PRINT_INTEGERS;\r
	c.ext1 = x1;\r
	c.ext2 = x2;\r
	c.ext3 = x3;\r
\r
	UsbSendPacket((BYTE *)&c, sizeof(c));\r
	// XXX\r
	SpinDelay(50);\r
}\r
\r
void AcquireRawAdcSamples125k(BOOL at134khz)\r
{\r
	BYTE *dest = (BYTE *)BigBuf;\r
	int n = sizeof(BigBuf);\r
	int i;\r
\r
	memset(dest,0,n);\r
\r
	if(at134khz) {\r
		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
		FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ);\r
	} else {\r
		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz\r
		FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);\r
	}\r
\r
	// Connect the A/D to the peak-detected low-frequency path.\r
	SetAdcMuxFor(GPIO_MUXSEL_LOPKD);\r
\r
	// Give it a bit of time for the resonant antenna to settle.\r
	SpinDelay(50);\r
\r
	// Now set up the SSC to get the ADC samples that are now streaming at us.\r
	FpgaSetupSsc();\r
\r
	i = 0;\r
	for(;;) {\r
		if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
			SSC_TRANSMIT_HOLDING = 0x43;\r
			LED_D_ON();\r
		}\r
		if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
			dest[i] = (BYTE)SSC_RECEIVE_HOLDING;\r
			i++;\r
			LED_D_OFF();\r
			if(i >= n) {\r
				break;\r
			}\r
		}\r
	}\r
	DbpIntegers(dest[0], dest[1], at134khz);\r
}\r
\r
//-----------------------------------------------------------------------------\r
// Read an ADC channel and block till it completes, then return the result\r
// in ADC units (0 to 1023). Also a routine to average 32 samples and\r
// return that.\r
//-----------------------------------------------------------------------------\r
static int ReadAdc(int ch)\r
{\r
	DWORD d;\r
\r
	ADC_CONTROL = ADC_CONTROL_RESET;\r
	ADC_MODE = ADC_MODE_PRESCALE(32) | ADC_MODE_STARTUP_TIME(16) |\r
		ADC_MODE_SAMPLE_HOLD_TIME(8);\r
	ADC_CHANNEL_ENABLE = ADC_CHANNEL(ch);\r
\r
	ADC_CONTROL = ADC_CONTROL_START;\r
	while(!(ADC_STATUS & ADC_END_OF_CONVERSION(ch)))\r
		;\r
	d = ADC_CHANNEL_DATA(ch);\r
\r
	return d;\r
}\r
\r
static int AvgAdc(int ch)\r
{\r
	int i;\r
	int a = 0;\r
\r
	for(i = 0; i < 32; i++) {\r
		a += ReadAdc(ch);\r
	}\r
\r
	return (a + 15) >> 5;\r
}\r

/*
 * Sweeps the useful LF range of the proxmark from
 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
 * reads the voltage in the antenna: the result is a graph
 * which should clearly show the resonating frequency of your
 * LF antenna ( hopefully around 90 if it is tuned to 125kHz!)
 */\r
void SweepLFrange()\r
{\r
	BYTE *dest = (BYTE *)BigBuf;\r
	int i;\r
\r
	// clear buffer\r
	memset(BigBuf,0,sizeof(BigBuf));\r
\r
	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
	for (i=255; i>19; i--) {\r
		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);\r
		SpinDelay(20);\r
		dest[i] = (137500 * AvgAdc(4)) >> 18;\r
	}\r
}\r
\r
void MeasureAntennaTuning(void)\r
{\r
// Impedances are Zc = 1/(j*omega*C), in ohms\r
#define LF_TUNING_CAP_Z	1273	//  1 nF @ 125   kHz\r
#define HF_TUNING_CAP_Z	235		// 50 pF @ 13.56 MHz\r
\r
	int vLf125, vLf134, vHf;	// in mV\r
\r
	UsbCommand c;\r
\r
	// Let the FPGA drive the low-frequency antenna around 125 kHz.\r
	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz\r
	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);\r
	SpinDelay(20);\r
	vLf125 = AvgAdc(4);\r
	// Vref = 3.3V, and a 10000:240 voltage divider on the input\r
	// can measure voltages up to 137500 mV\r
	vLf125 = (137500 * vLf125) >> 10;\r
\r
	// Let the FPGA drive the low-frequency antenna around 134 kHz.\r
	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ);\r
	SpinDelay(20);\r
	vLf134 = AvgAdc(4);\r
	// Vref = 3.3V, and a 10000:240 voltage divider on the input\r
	// can measure voltages up to 137500 mV\r
	vLf134 = (137500 * vLf134) >> 10;\r
\r
	// Let the FPGA drive the high-frequency antenna around 13.56 MHz.\r
	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);\r
	SpinDelay(20);\r
	vHf = AvgAdc(5);\r
	// Vref = 3300mV, and an 10:1 voltage divider on the input\r
	// can measure voltages up to 33000 mV\r
	vHf = (33000 * vHf) >> 10;\r
\r
	c.cmd = CMD_MEASURED_ANTENNA_TUNING;\r
	c.ext1 = (vLf125 << 0) | (vLf134 << 16);\r
	c.ext2 = vHf;\r
	c.ext3 = (LF_TUNING_CAP_Z << 0) | (HF_TUNING_CAP_Z << 16);\r
	UsbSendPacket((BYTE *)&c, sizeof(c));\r
}\r
\r
void SimulateTagLowFrequency(int period)\r
{\r
	int i;\r
	BYTE *tab = (BYTE *)BigBuf;\r
\r
	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR);\r
\r
	PIO_ENABLE = (1 << GPIO_SSC_DOUT) | (1 << GPIO_SSC_CLK);\r
\r
	PIO_OUTPUT_ENABLE = (1 << GPIO_SSC_DOUT);\r
	PIO_OUTPUT_DISABLE = (1 << GPIO_SSC_CLK);\r
\r
#define SHORT_COIL()	LOW(GPIO_SSC_DOUT)\r
#define OPEN_COIL()	HIGH(GPIO_SSC_DOUT)\r
\r
	i = 0;\r
	for(;;) {\r
		while(!(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK))) {\r
			if(BUTTON_PRESS()) {\r
				return;\r
			}\r
			WDT_HIT();\r
		}\r
\r
		LED_D_ON();\r
		if(tab[i]) {\r
			OPEN_COIL();\r
		} else {\r
			SHORT_COIL();\r
		}\r
		LED_D_OFF();\r
\r
		while(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK)) {\r
			if(BUTTON_PRESS()) {\r
				return;\r
			}\r
			WDT_HIT();\r
		}\r
\r
		i++;\r
		if(i == period) i = 0;\r
	}\r
}\r
\r
// compose fc/8 fc/10 waveform\r
static void fc(int c, int *n) {\r
	BYTE *dest = (BYTE *)BigBuf;\r
	int idx;\r
\r
	// for when we want an fc8 pattern every 4 logical bits\r
	if(c==0) {\r
		dest[((*n)++)]=1;\r
		dest[((*n)++)]=1;\r
		dest[((*n)++)]=0;\r
		dest[((*n)++)]=0;\r
		dest[((*n)++)]=0;\r
		dest[((*n)++)]=0;\r
		dest[((*n)++)]=0;\r
		dest[((*n)++)]=0;\r
	}\r
	//	an fc/8  encoded bit is a bit pattern of  11000000  x6 = 48 samples\r
	if(c==8) {\r
		for (idx=0; idx<6; idx++) {\r
			dest[((*n)++)]=1;\r
			dest[((*n)++)]=1;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
		}\r
	}\r
\r
	//	an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples\r
	if(c==10) {\r
		for (idx=0; idx<5; idx++) {\r
			dest[((*n)++)]=1;\r
			dest[((*n)++)]=1;\r
			dest[((*n)++)]=1;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
			dest[((*n)++)]=0;\r
		}\r
	}\r
}\r
\r
// prepare a waveform pattern in the buffer based on the ID given then\r
// simulate a HID tag until the button is pressed\r
static void CmdHIDsimTAG(int hi, int lo)\r
{\r
	int n=0, i=0;\r
	/*\r
	 HID tag bitstream format\r
	 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits\r
	 A 1 bit is represented as 6 fc8 and 5 fc10 patterns\r
	 A 0 bit is represented as 5 fc10 and 6 fc8 patterns\r
	 A fc8 is inserted before every 4 bits\r
	 A special start of frame pattern is used consisting a0b0 where a and b are neither 0\r
	 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)\r
	*/\r
\r
	if (hi>0xFFF) {\r
		DbpString("Tags can only have 44 bits.");\r
		return;\r
	}\r
	fc(0,&n);\r
	// special start of frame marker containing invalid bit sequences\r
	fc(8,  &n);	fc(8,  &n);	// invalid\r
	fc(8,  &n);	fc(10, &n); // logical 0\r
	fc(10, &n);	fc(10, &n); // invalid\r
	fc(8,  &n);	fc(10, &n); // logical 0\r
\r
	WDT_HIT();\r
	// manchester encode bits 43 to 32\r
	for (i=11; i>=0; i--) {\r
		if ((i%4)==3) fc(0,&n);\r
		if ((hi>>i)&1) {\r
			fc(10, &n);	fc(8,  &n);		// low-high transition\r
		} else {\r
			fc(8,  &n);	fc(10, &n);		// high-low transition\r
		}\r
	}\r
\r
	WDT_HIT();\r
	// manchester encode bits 31 to 0\r
	for (i=31; i>=0; i--) {\r
		if ((i%4)==3) fc(0,&n);\r
		if ((lo>>i)&1) {\r
			fc(10, &n);	fc(8,  &n);		// low-high transition\r
		} else {\r
			fc(8,  &n);	fc(10, &n);		// high-low transition\r
		}\r
	}\r
\r
	LED_A_ON();\r
	SimulateTagLowFrequency(n);\r
	LED_A_OFF();\r
}\r
\r
// loop to capture raw HID waveform then FSK demodulate the TAG ID from it\r
static void CmdHIDdemodFSK(void)\r
{\r
	BYTE *dest = (BYTE *)BigBuf;\r
	int m=0, n=0, i=0, idx=0, found=0, lastval=0;\r
	DWORD hi=0, lo=0;\r
\r
	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz\r
	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);\r
\r
	// Connect the A/D to the peak-detected low-frequency path.\r
	SetAdcMuxFor(GPIO_MUXSEL_LOPKD);\r
\r
	// Give it a bit of time for the resonant antenna to settle.\r
	SpinDelay(50);\r
\r
	// Now set up the SSC to get the ADC samples that are now streaming at us.\r
	FpgaSetupSsc();\r
\r
	for(;;) {\r
		WDT_HIT();\r
		LED_A_ON();\r
		if(BUTTON_PRESS()) {\r
			LED_A_OFF();\r
			return;\r
		}\r
\r
		i = 0;\r
		m = sizeof(BigBuf);\r
		memset(dest,128,m);\r
		for(;;) {\r
			if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
				SSC_TRANSMIT_HOLDING = 0x43;\r
				LED_D_ON();\r
			}\r
			if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
				dest[i] = (BYTE)SSC_RECEIVE_HOLDING;\r
				// we don't care about actual value, only if it's more or less than a\r
				// threshold essentially we capture zero crossings for later analysis\r
				if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;\r
				i++;\r
				LED_D_OFF();\r
				if(i >= m) {\r
					break;\r
				}\r
			}\r
		}\r
\r
		// FSK demodulator\r
\r
		// sync to first lo-hi transition\r
		for( idx=1; idx<m; idx++) {\r
			if (dest[idx-1]<dest[idx])\r
				lastval=idx;\r
				break;\r
		}\r
		WDT_HIT();\r
\r
		// count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)\r
		// or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere\r
		// between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10\r
		for( i=0; idx<m; idx++) {\r
			if (dest[idx-1]<dest[idx]) {\r
				dest[i]=idx-lastval;\r
				if (dest[i] <= 8) {\r
						dest[i]=1;\r
				} else {\r
						dest[i]=0;\r
				}\r
\r
				lastval=idx;\r
				i++;\r
			}\r
		}\r
		m=i;\r
		WDT_HIT();\r
\r
		// we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns\r
		lastval=dest[0];\r
		idx=0;\r
		i=0;\r
		n=0;\r
		for( idx=0; idx<m; idx++) {\r
			if (dest[idx]==lastval) {\r
				n++;\r
			} else {\r
				// a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,\r
				// an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets\r
				// swallowed up by rounding\r
				// expected results are 1 or 2 bits, any more and it's an invalid manchester encoding\r
				// special start of frame markers use invalid manchester states (no transitions) by using sequences\r
				// like 111000\r
				if (dest[idx-1]) {\r
					n=(n+1)/6;			// fc/8 in sets of 6\r
				} else {\r
					n=(n+1)/5;			// fc/10 in sets of 5\r
				}\r
				switch (n) {			// stuff appropriate bits in buffer\r
					case 0:\r
					case 1:	// one bit\r
						dest[i++]=dest[idx-1];\r
						break;\r
					case 2: // two bits\r
						dest[i++]=dest[idx-1];\r
						dest[i++]=dest[idx-1];\r
						break;\r
					case 3: // 3 bit start of frame markers\r
						dest[i++]=dest[idx-1];\r
						dest[i++]=dest[idx-1];\r
						dest[i++]=dest[idx-1];\r
						break;\r
					// When a logic 0 is immediately followed by the start of the next transmisson\r
					// (special pattern) a pattern of 4 bit duration lengths is created.\r
					case 4:\r
						dest[i++]=dest[idx-1];\r
						dest[i++]=dest[idx-1];\r
						dest[i++]=dest[idx-1];\r
						dest[i++]=dest[idx-1];\r
						break;\r
					default:	// this shouldn't happen, don't stuff any bits\r
						break;\r
				}\r
				n=0;\r
				lastval=dest[idx];\r
			}\r
		}\r
		m=i;\r
		WDT_HIT();\r
\r
		// final loop, go over previously decoded manchester data and decode into usable tag ID\r
		// 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0\r
		for( idx=0; idx<m-6; idx++) {\r
			// search for a start of frame marker\r
			if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )\r
			{\r
				found=1;\r
				idx+=6;\r
				if (found && (hi|lo)) {\r
					DbpString("TAG ID");\r
					DbpIntegers(hi, lo, (lo>>1)&0xffff);\r
					hi=0;\r
					lo=0;\r
					found=0;\r
				}\r
			}\r
			if (found) {\r
				if (dest[idx] && (!dest[idx+1]) ) {\r
					hi=(hi<<1)|(lo>>31);\r
					lo=(lo<<1)|0;\r
				} else if ( (!dest[idx]) && dest[idx+1]) {\r
					hi=(hi<<1)|(lo>>31);\r
					lo=(lo<<1)|1;\r
				} else {\r
					found=0;\r
					hi=0;\r
					lo=0;\r
				}\r
				idx++;\r
			}\r
			if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )\r
			{\r
				found=1;\r
				idx+=6;\r
				if (found && (hi|lo)) {\r
					DbpString("TAG ID");\r
					DbpIntegers(hi, lo, (lo>>1)&0xffff);\r
					hi=0;\r
					lo=0;\r
					found=0;\r
				}\r
			}\r
		}\r
		WDT_HIT();\r
	}\r
}\r
\r
void SimulateTagHfListen(void)\r
{\r
	BYTE *dest = (BYTE *)BigBuf;\r
	int n = sizeof(BigBuf);\r
	BYTE v = 0;\r
	int i;\r
	int p = 0;\r
\r
	// We're using this mode just so that I can test it out; the simulated\r
	// tag mode would work just as well and be simpler.\r
	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);\r
\r
	// We need to listen to the high-frequency, peak-detected path.\r
	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r
\r
	FpgaSetupSsc();\r
\r
	i = 0;\r
	for(;;) {\r
		if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
			SSC_TRANSMIT_HOLDING = 0xff;\r
		}\r
		if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
			BYTE r = (BYTE)SSC_RECEIVE_HOLDING;\r
\r
			v <<= 1;\r
			if(r & 1) {\r
				v |= 1;\r
			}\r
			p++;\r
\r
			if(p >= 8) {\r
				dest[i] = v;\r
				v = 0;\r
				p = 0;\r
				i++;\r
\r
				if(i >= n) {\r
					break;\r
				}\r
			}\r
		}\r
	}\r
	DbpString("simulate tag (now type bitsamples)");\r
}\r
\r
void UsbPacketReceived(BYTE *packet, int len)\r
{\r
	UsbCommand *c = (UsbCommand *)packet;\r
\r
	switch(c->cmd) {\r
		case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:\r
			AcquireRawAdcSamples125k(c->ext1);\r
			break;\r
\r
		case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:\r
			AcquireRawAdcSamplesIso15693();\r
			break;\r
\r
		case CMD_READER_ISO_15693:\r
			ReaderIso15693(c->ext1);\r
			break;\r
\r
		case CMD_SIMTAG_ISO_15693:\r
			SimTagIso15693(c->ext1);\r
			break;\r
\r
		case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:\r
			AcquireRawAdcSamplesIso14443(c->ext1);\r
			break;\r
\r
		case CMD_READER_ISO_14443a:\r
			ReaderIso14443a(c->ext1);\r
			break;\r
\r
		case CMD_SNOOP_ISO_14443:\r
			SnoopIso14443();\r
			break;\r
\r
		case CMD_SNOOP_ISO_14443a:\r
			SnoopIso14443a();\r
			break;\r
\r
		case CMD_SIMULATE_TAG_HF_LISTEN:\r
			SimulateTagHfListen();\r
			break;\r
\r
		case CMD_SIMULATE_TAG_ISO_14443:\r
			SimulateIso14443Tag();\r
			break;\r
\r
		case CMD_SIMULATE_TAG_ISO_14443a:\r
			SimulateIso14443aTag(c->ext1, c->ext2);  // ## Simulate iso14443a tag - pass tag type & UID\r
			break;\r
\r
		case CMD_MEASURE_ANTENNA_TUNING:\r
			MeasureAntennaTuning();\r
			break;\r
\r
		case CMD_HID_DEMOD_FSK:\r
			CmdHIDdemodFSK();				// Demodulate HID tag\r
			break;\r
\r
		case CMD_HID_SIM_TAG:\r
			CmdHIDsimTAG(c->ext1, c->ext2);					// Simulate HID tag by ID\r
			break;\r
\r
		case CMD_FPGA_MAJOR_MODE_OFF:		// ## FPGA Control\r
			LED_C_ON();\r
			FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
			SpinDelay(200);\r
			LED_C_OFF();\r
			break;\r
\r
		case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:\r
		case CMD_DOWNLOAD_RAW_BITS_TI_TYPE: {\r
			UsbCommand n;\r
			if(c->cmd == CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K) {\r
				n.cmd = CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K;\r
			} else {\r
				n.cmd = CMD_DOWNLOADED_RAW_BITS_TI_TYPE;\r
			}\r
			n.ext1 = c->ext1;\r
			memcpy(n.d.asDwords, BigBuf+c->ext1, 12*sizeof(DWORD));\r
			UsbSendPacket((BYTE *)&n, sizeof(n));\r
			break;\r
		}\r
		case CMD_DOWNLOADED_SIM_SAMPLES_125K: {\r
			BYTE *b = (BYTE *)BigBuf;\r
			memcpy(b+c->ext1, c->d.asBytes, 48);\r
			break;\r
		}\r
		case CMD_SIMULATE_TAG_125K:\r
			LED_A_ON();\r
			SimulateTagLowFrequency(c->ext1);\r
			LED_A_OFF();\r
			break;\r
\r
		case CMD_LCD_RESET:\r
			LCDReset();\r
			break;\r
\r
		case CMD_SWEEP_LF:\r
			SweepLFrange();\r
			break;\r
\r
		case CMD_SET_LF_DIVISOR:\r
			FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->ext1);\r
			break;\r
\r
		case CMD_LCD:\r
			LCDSend(c->ext1);\r
			break;\r
\r
        case CMD_SETUP_WRITE:\r
		case CMD_FINISH_WRITE:\r
			USB_D_PLUS_PULLUP_OFF();\r
			SpinDelay(1000);\r
			SpinDelay(1000);\r
			RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET;\r
			for(;;) {\r
				// We're going to reset, and the bootrom will take control.\r
			}\r
			break;\r
\r
		default:\r
			DbpString("unknown command");\r
			break;\r
	}\r
}\r
\r
void AppMain(void)\r
{\r
	memset(BigBuf,0,sizeof(BigBuf));\r
	SpinDelay(100);\r
\r
    LED_D_OFF();\r
    LED_C_OFF();\r
    LED_B_OFF();\r
    LED_A_OFF();\r
\r
	UsbStart();\r
\r
	// The FPGA gets its clock from us from PCK0 output, so set that up.\r
	PIO_PERIPHERAL_B_SEL = (1 << GPIO_PCK0);\r
	PIO_DISABLE = (1 << GPIO_PCK0);\r
	PMC_SYS_CLK_ENABLE = PMC_SYS_CLK_PROGRAMMABLE_CLK_0;\r
	// PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz\r
	PMC_PROGRAMMABLE_CLK_0 = PMC_CLK_SELECTION_PLL_CLOCK |\r
		PMC_CLK_PRESCALE_DIV_4;\r
	PIO_OUTPUT_ENABLE = (1 << GPIO_PCK0);\r
\r
	// Reset SPI\r
	SPI_CONTROL = SPI_CONTROL_RESET;\r
	// Reset SSC\r
	SSC_CONTROL = SSC_CONTROL_RESET;\r
\r
	// Load the FPGA image, which we have stored in our flash.\r
	FpgaDownloadAndGo();\r
\r
	LCDInit();\r
\r
	// test text on different colored backgrounds\r
    LCDString(" The quick brown fox  ",	&FONT6x8,1,1+8*0,WHITE  ,BLACK );\r
    LCDString("  jumped over the     ",	&FONT6x8,1,1+8*1,BLACK  ,WHITE );\r
    LCDString("     lazy dog.        ",	&FONT6x8,1,1+8*2,YELLOW ,RED   );\r
    LCDString(" AaBbCcDdEeFfGgHhIiJj ",	&FONT6x8,1,1+8*3,RED    ,GREEN );\r
    LCDString(" KkLlMmNnOoPpQqRrSsTt ",	&FONT6x8,1,1+8*4,MAGENTA,BLUE  );\r
    LCDString("UuVvWwXxYyZz0123456789",	&FONT6x8,1,1+8*5,BLUE   ,YELLOW);\r
    LCDString("`-=[]_;',./~!@#$%^&*()",	&FONT6x8,1,1+8*6,BLACK  ,CYAN  );\r
    LCDString("     _+{}|:\\\"<>?     ",&FONT6x8,1,1+8*7,BLUE  ,MAGENTA);\r
\r
	// color bands\r
	LCDFill(0, 1+8* 8, 132, 8, BLACK);\r
	LCDFill(0, 1+8* 9, 132, 8, WHITE);\r
	LCDFill(0, 1+8*10, 132, 8, RED);\r
	LCDFill(0, 1+8*11, 132, 8, GREEN);\r
	LCDFill(0, 1+8*12, 132, 8, BLUE);\r
	LCDFill(0, 1+8*13, 132, 8, YELLOW);\r
	LCDFill(0, 1+8*14, 132, 8, CYAN);\r
	LCDFill(0, 1+8*15, 132, 8, MAGENTA);\r
\r
	for(;;) {\r
		UsbPoll(FALSE);\r
		WDT_HIT();\r
	}\r
}\r
\r
void SpinDelay(int ms)\r
{\r
	int ticks = (48000*ms) >> 10;\r
\r
	// Borrow a PWM unit for my real-time clock\r
	PWM_ENABLE = PWM_CHANNEL(0);\r
	// 48 MHz / 1024 gives 46.875 kHz\r
	PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10);\r
	PWM_CH_DUTY_CYCLE(0) = 0;\r
	PWM_CH_PERIOD(0) = 0xffff;\r
\r
	WORD start = (WORD)PWM_CH_COUNTER(0);\r
\r
	for(;;) {\r
		WORD now = (WORD)PWM_CH_COUNTER(0);\r
		if(now == (WORD)(start + ticks)) {\r
			return;\r
		}\r
		WDT_HIT();\r
	}\r
}\r