Correction to Samyrun offline mode
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
b8e461ff 13#include <stdarg.h>
14
902cb3c0 15#include "usb_cdc.h"
16#include "cmd.h"
e30c654b 17#include "proxmark3.h"
15c4dc5a 18#include "apps.h"
472345da 19#include "fpga.h"
f7e3ed82 20#include "util.h"
9ab7a6c7 21#include "printf.h"
22#include "string.h"
15c4dc5a 23#include "legicrf.h"
b8e461ff 24#include "hitag2.h"
25#include "hitagS.h"
31abe49f 26#include "lfsampling.h"
3000dc4e 27#include "BigBuf.h"
c89274cc 28#include "mifareutil.h"
d10e08ae 29#include "pcf7931.h"
15c4dc5a 30#ifdef WITH_LCD
902cb3c0 31 #include "LCD.h"
15c4dc5a 32#endif
43591e64 33#ifdef WITH_SMARTCARD
34 #include "i2c.h"
35#endif
36
15c4dc5a 37
e46fe044 38// Craig Young - 14a stand-alone code
854fdf15 39#ifdef WITH_ISO14443a
e46fe044
CY
40 #include "iso14443a.h"
41#endif
42
15c4dc5a 43//=============================================================================
44// A buffer where we can queue things up to be sent through the FPGA, for
45// any purpose (fake tag, as reader, whatever). We go MSB first, since that
46// is the order in which they go out on the wire.
47//=============================================================================
48
6a1f2d82 49#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
50uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 51int ToSendMax;
52static int ToSendBit;
53struct common_area common_area __attribute__((section(".commonarea")));
54
15c4dc5a 55void ToSendReset(void)
56{
57 ToSendMax = -1;
58 ToSendBit = 8;
59}
60
61void ToSendStuffBit(int b)
62{
63 if(ToSendBit >= 8) {
64 ToSendMax++;
65 ToSend[ToSendMax] = 0;
66 ToSendBit = 0;
67 }
68
69 if(b) {
70 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
71 }
72
73 ToSendBit++;
74
6a1f2d82 75 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 76 ToSendBit = 0;
77 DbpString("ToSendStuffBit overflowed!");
78 }
79}
80
81//=============================================================================
82// Debug print functions, to go out over USB, to the usual PC-side client.
83//=============================================================================
84
85void DbpString(char *str)
86{
9440213d 87 byte_t len = strlen(str);
88 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 89}
90
91#if 0
92void DbpIntegers(int x1, int x2, int x3)
93{
902cb3c0 94 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 95}
96#endif
97
98void Dbprintf(const char *fmt, ...) {
99// should probably limit size here; oh well, let's just use a big buffer
100 char output_string[128];
101 va_list ap;
102
103 va_start(ap, fmt);
104 kvsprintf(fmt, output_string, 10, ap);
105 va_end(ap);
e30c654b 106
15c4dc5a 107 DbpString(output_string);
108}
109
9455b51c 110// prints HEX & ASCII
d19929cb 111void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 112 int l=0,i;
113 char ascii[9];
d19929cb 114
9455b51c 115 while (len>0) {
116 if (len>8) l=8;
117 else l=len;
118
119 memcpy(ascii,d,l);
d19929cb 120 ascii[l]=0;
9455b51c 121
122 // filter safe ascii
d19929cb 123 for (i=0;i<l;i++)
9455b51c 124 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 125
126 if (bAsci) {
127 Dbprintf("%-8s %*D",ascii,l,d," ");
128 } else {
129 Dbprintf("%*D",l,d," ");
130 }
131
9455b51c 132 len-=8;
133 d+=8;
134 }
135}
136
15c4dc5a 137//-----------------------------------------------------------------------------
138// Read an ADC channel and block till it completes, then return the result
139// in ADC units (0 to 1023). Also a routine to average 32 samples and
140// return that.
141//-----------------------------------------------------------------------------
142static int ReadAdc(int ch)
2d51da38 143{
3b692427 144 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
9b32625c 145 // AMPL_HI is are high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
146 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
3b692427 147 //
148 // The maths are:
149 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
150 //
9b32625c 151 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
15c4dc5a 152
2d51da38
I
153 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
154 AT91C_BASE_ADC->ADC_MR =
9b32625c 155 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
156 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
157 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
3b692427 158
2d51da38
I
159 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
160 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
15c4dc5a 161
2d51da38
I
162 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
163
164 return AT91C_BASE_ADC->ADC_CDR[ch];
15c4dc5a 165}
166
9ca155ba 167int AvgAdc(int ch) // was static - merlok
15c4dc5a 168{
169 int i;
170 int a = 0;
171
172 for(i = 0; i < 32; i++) {
173 a += ReadAdc(ch);
174 }
175
176 return (a + 15) >> 5;
177}
178
fdcfbdcc 179void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
15c4dc5a 180{
9b32625c 181 int i, adcval = 0, peak = 0;
15c4dc5a 182
183/*
184 * Sweeps the useful LF range of the proxmark from
185 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
186 * read the voltage in the antenna, the result left
187 * in the buffer is a graph which should clearly show
188 * the resonating frequency of your LF antenna
189 * ( hopefully around 95 if it is tuned to 125kHz!)
190 */
fdcfbdcc
RAB
191
192 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 193 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2d51da38
I
194 SpinDelay(50);
195
2bdd68c3 196 for (i=255; i>=19; i--) {
fdcfbdcc 197 WDT_HIT();
15c4dc5a 198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
3b692427 200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
fdcfbdcc
RAB
201 if (i==95) *vLf125 = adcval; // voltage at 125Khz
202 if (i==89) *vLf134 = adcval; // voltage at 134Khz
15c4dc5a 203
2d51da38 204 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
2bdd68c3 205 if(LF_Results[i] > peak) {
fdcfbdcc 206 *peakv = adcval;
2bdd68c3 207 peak = LF_Results[i];
fdcfbdcc 208 *peakf = i;
9f693930 209 //ptr = i;
15c4dc5a 210 }
211 }
212
2bdd68c3 213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
fdcfbdcc
RAB
214
215 return;
216}
217
218void MeasureAntennaTuningHfOnly(int *vHf)
219{
15c4dc5a 220 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
fdcfbdcc
RAB
221 LED_A_ON();
222 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 223 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
224 SpinDelay(20);
fdcfbdcc
RAB
225 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
226 LED_A_OFF();
227
228 return;
229}
230
231void MeasureAntennaTuning(int mode)
232{
233 uint8_t LF_Results[256] = {0};
234 int peakv = 0, peakf = 0;
235 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
236
237 LED_B_ON();
238
239 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
240 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
241 MeasureAntennaTuningHfOnly(&vHf);
242 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
243 } else {
244 if (mode & FLAG_TUNE_LF) {
245 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
246 }
247 if (mode & FLAG_TUNE_HF) {
248 MeasureAntennaTuningHfOnly(&vHf);
249 }
250 }
15c4dc5a 251
d040cb90 252 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
d19929cb 253 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 254 LED_B_OFF();
255 return;
15c4dc5a 256}
257
258void MeasureAntennaTuningHf(void)
259{
260 int vHf = 0; // in mV
261
262 DbpString("Measuring HF antenna, press button to exit");
263
3b692427 264 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
265 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
266 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
267
15c4dc5a 268 for (;;) {
15c4dc5a 269 SpinDelay(20);
3b692427 270 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 271
15c4dc5a 272 Dbprintf("%d mV",vHf);
273 if (BUTTON_PRESS()) break;
274 }
275 DbpString("cancelled");
3b692427 276
277 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
278
15c4dc5a 279}
280
281
15c4dc5a 282void ReadMem(int addr)
283{
f7e3ed82 284 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 285
286 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
287 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
288}
289
290/* osimage version information is linked in */
291extern struct version_information version_information;
292/* bootrom version information is pointed to from _bootphase1_version_pointer */
0fa01ec7 293extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
472345da 294
15c4dc5a 295void SendVersion(void)
296{
8e074056 297 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
298 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 299
300 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 301 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
302 * pointer, then use it.
303 */
304 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
305 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
8e074056 306 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 307 } else {
308 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
8e074056 309 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 310 }
e30c654b 311
15c4dc5a 312 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
8e074056 313 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 314
472345da 315 for (int i = 0; i < fpga_bitstream_num; i++) {
316 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
317 if (i < fpga_bitstream_num - 1) {
318 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
319 }
320 }
0fa01ec7 321
e6153040 322 // Send Chip ID and used flash memory
0fa01ec7 323 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
324 uint32_t compressed_data_section_size = common_area.arg1;
8e074056 325 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 326}
327
bfb01844 328// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
329// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
67b7d6fa 330void printUSBSpeed(void)
bfb01844 331{
332 Dbprintf("USB Speed:");
67b7d6fa 333 Dbprintf(" Sending USB packets to client...");
bfb01844 334
67b7d6fa 335 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
bfb01844 336 uint8_t *test_data = BigBuf_get_addr();
67b7d6fa 337 uint32_t end_time;
bfb01844 338
67b7d6fa 339 uint32_t start_time = end_time = GetTickCount();
340 uint32_t bytes_transferred = 0;
341
bfb01844 342 LED_B_ON();
67b7d6fa 343 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
344 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
345 end_time = GetTickCount();
346 bytes_transferred += USB_CMD_DATA_SIZE;
bfb01844 347 }
348 LED_B_OFF();
349
67b7d6fa 350 Dbprintf(" Time elapsed: %dms", end_time - start_time);
351 Dbprintf(" Bytes transferred: %d", bytes_transferred);
352 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
353 1000 * bytes_transferred / (end_time - start_time));
bfb01844 354
355}
356
c89274cc
CY
357/**
358 * Prints runtime information about the PM3.
359**/
67b7d6fa 360void SendStatus(void)
c89274cc
CY
361{
362 BigBuf_print_status();
363 Fpga_print_status();
43591e64 364#ifdef WITH_SMARTCARD
365 I2C_print_status();
366#endif
c89274cc 367 printConfig(); //LF Sampling config
67b7d6fa 368 printUSBSpeed();
c89274cc 369 Dbprintf("Various");
43591e64 370 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
371 Dbprintf(" ToSendMax..........%d", ToSendMax);
372 Dbprintf(" ToSendBit..........%d", ToSendBit);
bfb01844 373
374 cmd_send(CMD_ACK,1,0,0,0,0);
c89274cc 375}
15c4dc5a 376
a2937cea 377#if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
15c4dc5a 378
15c4dc5a 379#define OPTS 2
380
86a83668
MHS
381void StandAloneMode()
382{
383 DbpString("Stand-alone mode! No PC necessary.");
15c4dc5a 384 // Oooh pretty -- notify user we're in elite samy mode now
385 LED(LED_RED, 200);
386 LED(LED_ORANGE, 200);
387 LED(LED_GREEN, 200);
388 LED(LED_ORANGE, 200);
389 LED(LED_RED, 200);
390 LED(LED_ORANGE, 200);
391 LED(LED_GREEN, 200);
392 LED(LED_ORANGE, 200);
393 LED(LED_RED, 200);
394
86a83668
MHS
395}
396
397#endif
398
399
400
401#ifdef WITH_ISO14443a_StandAlone
402void StandAloneMode14a()
403{
404 StandAloneMode();
405 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
406
15c4dc5a 407 int selected = 0;
44964fd1 408 bool playing = false, GotoRecord = false, GotoClone = false;
409 bool cardRead[OPTS] = {false};
86a83668
MHS
410 uint8_t readUID[10] = {0};
411 uint32_t uid_1st[OPTS]={0};
412 uint32_t uid_2nd[OPTS]={0};
c89274cc
CY
413 uint32_t uid_tmp1 = 0;
414 uint32_t uid_tmp2 = 0;
415 iso14a_card_select_t hi14a_card[OPTS];
15c4dc5a 416
15c4dc5a 417 LED(selected + 1, 0);
418
419 for (;;)
420 {
6e82300d 421 usb_poll();
86a83668 422 WDT_HIT();
15c4dc5a 423 SpinDelay(300);
424
44964fd1 425 if (GotoRecord || !cardRead[selected])
15c4dc5a 426 {
44964fd1 427 GotoRecord = false;
15c4dc5a 428 LEDsoff();
429 LED(selected + 1, 0);
430 LED(LED_RED2, 0);
431
432 // record
86a83668 433 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
15c4dc5a 434 /* need this delay to prevent catching some weird data */
435 SpinDelay(500);
86a83668
MHS
436 /* Code for reading from 14a tag */
437 uint8_t uid[10] ={0};
438 uint32_t cuid;
439 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
15c4dc5a 440
86a83668
MHS
441 for ( ; ; )
442 {
443 WDT_HIT();
c89274cc
CY
444 if (BUTTON_PRESS()) {
445 if (cardRead[selected]) {
446 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
447 break;
448 }
449 else if (cardRead[(selected+1)%OPTS]) {
450 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
451 selected = (selected+1)%OPTS;
44964fd1 452 break;
c89274cc
CY
453 }
454 else {
455 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
456 SpinDelay(300);
457 }
458 }
c04a4b60 459 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
86a83668
MHS
460 continue;
461 else
462 {
463 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
464 memcpy(readUID,uid,10*sizeof(uint8_t));
c89274cc 465 uint8_t *dst = (uint8_t *)&uid_tmp1;
86a83668
MHS
466 // Set UID byte order
467 for (int i=0; i<4; i++)
468 dst[i] = uid[3-i];
c89274cc 469 dst = (uint8_t *)&uid_tmp2;
86a83668
MHS
470 for (int i=0; i<4; i++)
471 dst[i] = uid[7-i];
c89274cc
CY
472 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
473 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
474 }
475 else {
476 if (uid_tmp2) {
477 Dbprintf("Bank[%d] received a 7-byte UID",selected);
478 uid_1st[selected] = (uid_tmp1)>>8;
479 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
480 }
481 else {
482 Dbprintf("Bank[%d] received a 4-byte UID",selected);
483 uid_1st[selected] = uid_tmp1;
484 uid_2nd[selected] = uid_tmp2;
485 }
486 break;
487 }
86a83668
MHS
488 }
489 }
c89274cc
CY
490 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
491 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
86a83668
MHS
492 LEDsoff();
493 LED(LED_GREEN, 200);
494 LED(LED_ORANGE, 200);
495 LED(LED_GREEN, 200);
496 LED(LED_ORANGE, 200);
15c4dc5a 497
498 LEDsoff();
499 LED(selected + 1, 0);
15c4dc5a 500
c89274cc 501 // Next state is replay:
44964fd1 502 playing = true;
3fe4ff4f 503
44964fd1 504 cardRead[selected] = true;
86a83668 505 }
c89274cc 506 /* MF Classic UID clone */
44964fd1 507 else if (GotoClone)
3fe4ff4f 508 {
44964fd1 509 GotoClone=false;
c89274cc
CY
510 LEDsoff();
511 LED(selected + 1, 0);
512 LED(LED_ORANGE, 250);
3fe4ff4f 513
3fe4ff4f 514
c89274cc
CY
515 // record
516 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
3fe4ff4f 517
c89274cc
CY
518 // wait for button to be released
519 while(BUTTON_PRESS())
520 {
521 // Delay cloning until card is in place
522 WDT_HIT();
523 }
524 Dbprintf("Starting clone. [Bank: %u]", selected);
525 // need this delay to prevent catching some weird data
526 SpinDelay(500);
527 // Begin clone function here:
528 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
529 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
530 memcpy(c.d.asBytes, data, 16);
531 SendCommand(&c);
532
533 Block read is similar:
534 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
535 We need to imitate that call with blockNo 0 to set a uid.
536
537 The get and set commands are handled in this file:
538 // Work with "magic Chinese" card
539 case CMD_MIFARE_CSETBLOCK:
540 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
541 break;
542 case CMD_MIFARE_CGETBLOCK:
543 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
544 break;
545
546 mfCSetUID provides example logic for UID set workflow:
547 -Read block0 from card in field with MifareCGetBlock()
548 -Configure new values without replacing reserved bytes
549 memcpy(block0, uid, 4); // Copy UID bytes from byte array
550 // Mifare UID BCC
551 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
552 Bytes 5-7 are reserved SAK and ATQA for mifare classic
553 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
554 */
555 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
556 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
557 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
558 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
559 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
44964fd1 560 playing = true;
c89274cc
CY
561 }
562 else {
563 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
564 memcpy(newBlock0,oldBlock0,16);
565 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
566
567 newBlock0[0] = uid_1st[selected]>>24;
568 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
569 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
570 newBlock0[3] = 0xFF & (uid_1st[selected]);
571 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
572 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
573 MifareCSetBlock(0, 0xFF,0, newBlock0);
574 MifareCGetBlock(0x3F, 1, 0, testBlock0);
575 if (memcmp(testBlock0,newBlock0,16)==0)
576 {
577 DbpString("Cloned successfull!");
44964fd1 578 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
579 playing = false;
580 GotoRecord = true;
c89274cc
CY
581 selected = (selected+1) % OPTS;
582 }
583 else {
584 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
44964fd1 585 playing = true;
c89274cc
CY
586 }
587 }
588 LEDsoff();
589 LED(selected + 1, 0);
15c4dc5a 590
86a83668 591 }
15c4dc5a 592 // Change where to record (or begin playing)
44964fd1 593 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
15c4dc5a 594 {
15c4dc5a 595 LEDsoff();
596 LED(selected + 1, 0);
597
598 // Begin transmitting
44964fd1 599 LED(LED_GREEN, 0);
600 DbpString("Playing");
601 for ( ; ; ) {
602 WDT_HIT();
603 int button_action = BUTTON_HELD(1000);
604 if (button_action == 0) { // No button action, proceed with sim
605 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
606 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
607 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
608 DbpString("Mifare Classic");
609 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
c89274cc 610 }
44964fd1 611 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
612 DbpString("Mifare Ultralight");
613 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
15c4dc5a 614 }
44964fd1 615 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
616 DbpString("Mifare DESFire");
617 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
618 }
619 else {
620 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
621 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
c89274cc 622 }
c89274cc 623 }
44964fd1 624 else if (button_action == BUTTON_SINGLE_CLICK) {
625 selected = (selected + 1) % OPTS;
626 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
627 GotoRecord = true;
628 break;
629 }
630 else if (button_action == BUTTON_HOLD) {
631 Dbprintf("Playtime over. Begin cloning...");
632 GotoClone = true;
633 break;
634 }
635 WDT_HIT();
15c4dc5a 636 }
44964fd1 637
638 /* We pressed a button so ignore it here with a delay */
639 SpinDelay(300);
640 LEDsoff();
641 LED(selected + 1, 0);
15c4dc5a 642 }
643 }
644}
a2937cea 645#elif WITH_LF_StandAlone
86a83668
MHS
646// samy's sniff and repeat routine
647void SamyRun()
e46fe044 648{
86a83668
MHS
649 StandAloneMode();
650 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
e46fe044 651
53e2f2fa 652 int tops[OPTS], high[OPTS], low[OPTS];
15c4dc5a 653 int selected = 0;
654 int playing = 0;
3fe4ff4f 655 int cardRead = 0;
15c4dc5a 656
657 // Turn on selected LED
658 LED(selected + 1, 0);
659
660 for (;;)
661 {
6e82300d 662 usb_poll();
86a83668 663 WDT_HIT();
15c4dc5a 664
665 // Was our button held down or pressed?
666 int button_pressed = BUTTON_HELD(1000);
667 SpinDelay(300);
668
669 // Button was held for a second, begin recording
3fe4ff4f 670 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 671 {
672 LEDsoff();
673 LED(selected + 1, 0);
674 LED(LED_RED2, 0);
675
676 // record
677 DbpString("Starting recording");
678
679 // wait for button to be released
680 while(BUTTON_PRESS())
681 WDT_HIT();
682
683 /* need this delay to prevent catching some weird data */
684 SpinDelay(500);
685
53e2f2fa 686 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
687 if (tops[selected] > 0)
688 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
689 else
690 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
15c4dc5a 691
692 LEDsoff();
693 LED(selected + 1, 0);
694 // Finished recording
695
696 // If we were previously playing, set playing off
697 // so next button push begins playing what we recorded
698 playing = 0;
3fe4ff4f 699
700 cardRead = 1;
701
702 }
703
704 else if (button_pressed > 0 && cardRead == 1)
705 {
706 LEDsoff();
707 LED(selected + 1, 0);
708 LED(LED_ORANGE, 0);
709
710 // record
53e2f2fa 711 if (tops[selected] > 0)
712 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
713 else
714 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
3fe4ff4f 715
716 // wait for button to be released
717 while(BUTTON_PRESS())
718 WDT_HIT();
719
720 /* need this delay to prevent catching some weird data */
721 SpinDelay(500);
722
53e2f2fa 723 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)));
724 if (tops[selected] > 0)
725 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
726 else
727 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
3fe4ff4f 728
729 LEDsoff();
730 LED(selected + 1, 0);
731 // Finished recording
732
733 // If we were previously playing, set playing off
734 // so next button push begins playing what we recorded
735 playing = 0;
736
737 cardRead = 0;
738
15c4dc5a 739 }
740
741 // Change where to record (or begin playing)
742 else if (button_pressed)
743 {
744 // Next option if we were previously playing
745 if (playing)
746 selected = (selected + 1) % OPTS;
747 playing = !playing;
748
749 LEDsoff();
750 LED(selected + 1, 0);
751
752 // Begin transmitting
753 if (playing)
754 {
755 LED(LED_GREEN, 0);
756 DbpString("Playing");
757 // wait for button to be released
758 while(BUTTON_PRESS())
759 WDT_HIT();
53e2f2fa 760 if (tops[selected] > 0)
761 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
762 else
763 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
764
765 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
15c4dc5a 766 DbpString("Done playing");
767 if (BUTTON_HELD(1000) > 0)
768 {
769 DbpString("Exiting");
770 LEDsoff();
771 return;
772 }
773
774 /* We pressed a button so ignore it here with a delay */
775 SpinDelay(300);
776
777 // when done, we're done playing, move to next option
778 selected = (selected + 1) % OPTS;
779 playing = !playing;
780 LEDsoff();
781 LED(selected + 1, 0);
782 }
783 else
784 while(BUTTON_PRESS())
785 WDT_HIT();
786 }
787 }
788}
15c4dc5a 789
e46fe044 790#endif
15c4dc5a 791/*
792OBJECTIVE
793Listen and detect an external reader. Determine the best location
794for the antenna.
795
796INSTRUCTIONS:
797Inside the ListenReaderField() function, there is two mode.
798By default, when you call the function, you will enter mode 1.
799If you press the PM3 button one time, you will enter mode 2.
800If you press the PM3 button a second time, you will exit the function.
801
802DESCRIPTION OF MODE 1:
803This mode just listens for an external reader field and lights up green
804for HF and/or red for LF. This is the original mode of the detectreader
805function.
806
807DESCRIPTION OF MODE 2:
808This mode will visually represent, using the LEDs, the actual strength of the
809current compared to the maximum current detected. Basically, once you know
810what kind of external reader is present, it will help you spot the best location to place
811your antenna. You will probably not get some good results if there is a LF and a HF reader
812at the same place! :-)
813
814LIGHT SCHEME USED:
815*/
816static const char LIGHT_SCHEME[] = {
817 0x0, /* ---- | No field detected */
818 0x1, /* X--- | 14% of maximum current detected */
819 0x2, /* -X-- | 29% of maximum current detected */
820 0x4, /* --X- | 43% of maximum current detected */
821 0x8, /* ---X | 57% of maximum current detected */
822 0xC, /* --XX | 71% of maximum current detected */
823 0xE, /* -XXX | 86% of maximum current detected */
824 0xF, /* XXXX | 100% of maximum current detected */
825};
826static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
827
828void ListenReaderField(int limit)
829{
3b692427 830 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
831 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
15c4dc5a 832 int mode=1, display_val, display_max, i;
833
3b692427 834#define LF_ONLY 1
835#define HF_ONLY 2
836#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
837
838
839 // switch off FPGA - we don't want to measure our own signal
840 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
841 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 842
843 LEDsoff();
844
3b692427 845 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 846
847 if(limit != HF_ONLY) {
3b692427 848 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 849 lf_baseline = lf_av;
850 }
851
3b692427 852 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 853
854 if (limit != LF_ONLY) {
3b692427 855 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 856 hf_baseline = hf_av;
857 }
858
859 for(;;) {
860 if (BUTTON_PRESS()) {
861 SpinDelay(500);
862 switch (mode) {
863 case 1:
864 mode=2;
865 DbpString("Signal Strength Mode");
866 break;
867 case 2:
868 default:
869 DbpString("Stopped");
870 LEDsoff();
871 return;
872 break;
873 }
874 }
875 WDT_HIT();
876
877 if (limit != HF_ONLY) {
3b692427 878 if(mode == 1) {
cf194819 879 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
3b692427 880 LED_D_ON();
881 else
882 LED_D_OFF();
15c4dc5a 883 }
e30c654b 884
3b692427 885 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 886 // see if there's a significant change
cf194819 887 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
3b692427 888 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 889 lf_av = lf_av_new;
890 if (lf_av > lf_max)
891 lf_max = lf_av;
15c4dc5a 892 }
893 }
894
895 if (limit != LF_ONLY) {
896 if (mode == 1){
cf194819 897 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
3b692427 898 LED_B_ON();
899 else
900 LED_B_OFF();
15c4dc5a 901 }
e30c654b 902
3b692427 903 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 904 // see if there's a significant change
cf194819 905 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
3b692427 906 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 907 hf_av = hf_av_new;
908 if (hf_av > hf_max)
909 hf_max = hf_av;
15c4dc5a 910 }
911 }
e30c654b 912
15c4dc5a 913 if(mode == 2) {
914 if (limit == LF_ONLY) {
915 display_val = lf_av;
916 display_max = lf_max;
917 } else if (limit == HF_ONLY) {
918 display_val = hf_av;
919 display_max = hf_max;
920 } else { /* Pick one at random */
921 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
922 display_val = hf_av;
923 display_max = hf_max;
924 } else {
925 display_val = lf_av;
926 display_max = lf_max;
927 }
928 }
929 for (i=0; i<LIGHT_LEN; i++) {
930 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
931 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
932 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
933 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
934 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
935 break;
936 }
937 }
938 }
939 }
940}
941
f7e3ed82 942void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 943{
944 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 945
902cb3c0 946// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
947
15c4dc5a 948 switch(c->cmd) {
949#ifdef WITH_LF
31abe49f
MHS
950 case CMD_SET_LF_SAMPLING_CONFIG:
951 setSamplingConfig((sample_config *) c->d.asBytes);
952 break;
15c4dc5a 953 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
b9957414 954 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
15c4dc5a 955 break;
15c4dc5a 956 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
957 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
958 break;
b014c96d 959 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 960 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 961 break;
7e67e42f 962 case CMD_HID_DEMOD_FSK:
be59094d 963 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
7e67e42f 964 break;
965 case CMD_HID_SIM_TAG:
be59094d 966 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
7e67e42f 967 break;
abd6112f 968 case CMD_FSK_SIM_TAG:
969 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
970 break;
971 case CMD_ASK_SIM_TAG:
972 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
973 break;
872e3d4d 974 case CMD_PSK_SIM_TAG:
975 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
976 break;
977 case CMD_HID_CLONE_TAG:
1c611bbd 978 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 979 break;
a1f3bb12 980 case CMD_IO_DEMOD_FSK:
3fe4ff4f 981 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 982 break;
3fe4ff4f 983 case CMD_IO_CLONE_TAG:
9f669cb2 984 CopyIOtoT55x7(c->arg[0], c->arg[1]);
a1f3bb12 985 break;
66707a3b 986 case CMD_EM410X_DEMOD:
987 CmdEM410xdemod(c->arg[0], 0, 0, 1);
988 break;
2d4eae76 989 case CMD_EM410X_WRITE_TAG:
990 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
991 break;
7e67e42f 992 case CMD_READ_TI_TYPE:
993 ReadTItag();
994 break;
995 case CMD_WRITE_TI_TYPE:
996 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
997 break;
998 case CMD_SIMULATE_TAG_125K:
31d1caa5 999 LED_A_ON();
7e67e42f 1000 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
31d1caa5 1001 LED_A_OFF();
7e67e42f 1002 break;
1003 case CMD_LF_SIMULATE_BIDIR:
1004 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1005 break;
3fe4ff4f 1006 case CMD_INDALA_CLONE_TAG:
2414f978 1007 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1008 break;
3fe4ff4f 1009 case CMD_INDALA_CLONE_TAG_L:
2414f978 1010 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1011 break;
1c611bbd 1012 case CMD_T55XX_READ_BLOCK:
8e99ec25 1013 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1014 break;
1015 case CMD_T55XX_WRITE_BLOCK:
1016 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1017 break;
be2d41b7 1018 case CMD_T55XX_WAKEUP:
1019 T55xxWakeUp(c->arg[0]);
1c611bbd 1020 break;
66837a03 1021 case CMD_T55XX_RESET_READ:
1022 T55xxResetRead();
1023 break;
3fe4ff4f 1024 case CMD_PCF7931_READ:
1c611bbd 1025 ReadPCF7931();
1c611bbd 1026 break;
dc4300ba 1027 case CMD_PCF7931_WRITE:
d10e08ae 1028 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
dc4300ba 1029 break;
1c611bbd 1030 case CMD_EM4X_READ_WORD:
7666f460 1031 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1c611bbd 1032 break;
1033 case CMD_EM4X_WRITE_WORD:
7666f460 1034 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1035 break;
dbf6e824
CY
1036 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1037 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
7cfc777b 1038 break;
709665b5 1039 case CMD_VIKING_CLONE_TAG:
1040 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1041 break;
e04475c4 1042 case CMD_COTAG:
1043 Cotag(c->arg[0]);
1044 break;
15c4dc5a 1045#endif
1046
d19929cb 1047#ifdef WITH_HITAG
1048 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1049 SnoopHitag(c->arg[0]);
1050 break;
1051 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1052 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1053 break;
1054 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1055 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1056 break;
4e12287d
RS
1057 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1058 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1059 break;
1060 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1061 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1062 break;
1063 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1064 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1065 break;
1066 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
52244230
HJ
1067 if ((hitag_function)c->arg[0] < 10) {
1068 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1069 }
1070 else if ((hitag_function)c->arg[0] >= 10) {
1071 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1072 }
4e12287d 1073 break;
d19929cb 1074#endif
f168b263 1075
15c4dc5a 1076#ifdef WITH_ISO15693
1077 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1078 AcquireRawAdcSamplesIso15693();
1079 break;
9455b51c 1080 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1081 RecordRawAdcSamplesIso15693();
1082 break;
1083
1084 case CMD_ISO_15693_COMMAND:
1085 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1086 break;
1087
1088 case CMD_ISO_15693_FIND_AFI:
1089 BruteforceIso15693Afi(c->arg[0]);
1090 break;
1091
1092 case CMD_ISO_15693_DEBUG:
1093 SetDebugIso15693(c->arg[0]);
1094 break;
15c4dc5a 1095
15c4dc5a 1096 case CMD_READER_ISO_15693:
1097 ReaderIso15693(c->arg[0]);
1098 break;
7e67e42f 1099 case CMD_SIMTAG_ISO_15693:
3fe4ff4f 1100 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 1101 break;
15c4dc5a 1102#endif
1103
7e67e42f 1104#ifdef WITH_LEGICRF
1105 case CMD_SIMULATE_TAG_LEGIC_RF:
1106 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1107 break;
3612a8a8 1108
7e67e42f 1109 case CMD_WRITER_LEGIC_RF:
1110 LegicRfWriter(c->arg[1], c->arg[0]);
1111 break;
3612a8a8 1112
15c4dc5a 1113 case CMD_READER_LEGIC_RF:
1114 LegicRfReader(c->arg[0], c->arg[1]);
1115 break;
15c4dc5a 1116#endif
1117
1118#ifdef WITH_ISO14443b
15c4dc5a 1119 case CMD_READ_SRI512_TAG:
51d4f6f1 1120 ReadSTMemoryIso14443b(0x0F);
15c4dc5a 1121 break;
7e67e42f 1122 case CMD_READ_SRIX4K_TAG:
51d4f6f1 1123 ReadSTMemoryIso14443b(0x7F);
7e67e42f 1124 break;
132a0217 1125 case CMD_SNOOP_ISO_14443B:
51d4f6f1 1126 SnoopIso14443b();
7e67e42f 1127 break;
132a0217 1128 case CMD_SIMULATE_TAG_ISO_14443B:
51d4f6f1 1129 SimulateIso14443bTag();
7e67e42f 1130 break;
7cf3ef20 1131 case CMD_ISO_14443B_COMMAND:
1132 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1133 break;
15c4dc5a 1134#endif
1135
1136#ifdef WITH_ISO14443a
7e67e42f 1137 case CMD_SNOOP_ISO_14443a:
5cd9ec01 1138 SnoopIso14443a(c->arg[0]);
7e67e42f 1139 break;
15c4dc5a 1140 case CMD_READER_ISO_14443a:
902cb3c0 1141 ReaderIso14443a(c);
15c4dc5a 1142 break;
7e67e42f 1143 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 1144 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 1145 break;
3fe4ff4f 1146
5acd09bd 1147 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 1148 EPA_PACE_Collect_Nonce(c);
5acd09bd 1149 break;
3bb07d96
FM
1150 case CMD_EPA_PACE_REPLAY:
1151 EPA_PACE_Replay(c);
1152 break;
7e67e42f 1153
15c4dc5a 1154 case CMD_READER_MIFARE:
f168b263 1155 ReaderMifare(c->arg[0]);
15c4dc5a 1156 break;
20f9a2a1
M
1157 case CMD_MIFARE_READBL:
1158 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1159 break;
981bd429 1160 case CMD_MIFAREU_READBL:
f168b263 1161 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 1162 break;
8258f409 1163 case CMD_MIFAREUC_AUTH:
1164 MifareUC_Auth(c->arg[0],c->d.asBytes);
a631936e 1165 break;
981bd429 1166 case CMD_MIFAREU_READCARD:
75377d29 1167 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 1168 break;
f168b263 1169 case CMD_MIFAREUC_SETPWD:
1170 MifareUSetPwd(c->arg[0], c->d.asBytes);
1171 break;
20f9a2a1
M
1172 case CMD_MIFARE_READSC:
1173 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1174 break;
1175 case CMD_MIFARE_WRITEBL:
1176 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1177 break;
4973f23d 1178 //case CMD_MIFAREU_WRITEBL_COMPAT:
1179 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1180 //break;
981bd429 1181 case CMD_MIFAREU_WRITEBL:
4973f23d 1182 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
f168b263 1183 break;
c48c4d78 1184 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1185 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1186 break;
20f9a2a1
M
1187 case CMD_MIFARE_NESTED:
1188 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
1189 break;
1190 case CMD_MIFARE_CHKKEYS:
1191 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
1192 break;
1193 case CMD_SIMULATE_MIFARE_CARD:
1194 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1195 break;
8556b852
M
1196
1197 // emulator
1198 case CMD_MIFARE_SET_DBGMODE:
1199 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1200 break;
1201 case CMD_MIFARE_EML_MEMCLR:
1202 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1203 break;
1204 case CMD_MIFARE_EML_MEMSET:
1205 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1206 break;
1207 case CMD_MIFARE_EML_MEMGET:
1208 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1209 break;
1210 case CMD_MIFARE_EML_CARDLOAD:
1211 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
1212 break;
1213
1214 // Work with "magic Chinese" card
3a05a1e7
OM
1215 case CMD_MIFARE_CWIPE:
1216 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1217 break;
3fe4ff4f 1218 case CMD_MIFARE_CSETBLOCK:
0675f200 1219 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 1220 break;
3fe4ff4f 1221 case CMD_MIFARE_CGETBLOCK:
545a1f38 1222 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 1223 break;
3fe4ff4f 1224 case CMD_MIFARE_CIDENT:
1225 MifareCIdent();
1226 break;
b62a5a84
M
1227
1228 // mifare sniffer
1229 case CMD_MIFARE_SNIFFER:
5cd9ec01 1230 SniffMifare(c->arg[0]);
b62a5a84 1231 break;
a631936e 1232
20f9a2a1
M
1233#endif
1234
7e67e42f 1235#ifdef WITH_ICLASS
cee5a30d 1236 // Makes use of ISO14443a FPGA Firmware
1237 case CMD_SNOOP_ICLASS:
1238 SnoopIClass();
1239 break;
1e262141 1240 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 1241 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 1242 break;
1243 case CMD_READER_ICLASS:
1244 ReaderIClass(c->arg[0]);
1245 break;
c3963755 1246 case CMD_READER_ICLASS_REPLAY:
aa53efc3 1247 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 1248 break;
aa53efc3 1249 case CMD_ICLASS_EML_MEMSET:
e80aeb96
MHS
1250 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1251 break;
aa53efc3 1252 case CMD_ICLASS_WRITEBLOCK:
3ac22ee1 1253 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1254 break;
1255 case CMD_ICLASS_READCHECK: // auth step 1
1256 iClass_ReadCheck(c->arg[0], c->arg[1]);
aa53efc3 1257 break;
1258 case CMD_ICLASS_READBLOCK:
3ac22ee1 1259 iClass_ReadBlk(c->arg[0]);
aa53efc3 1260 break;
3ac22ee1 1261 case CMD_ICLASS_AUTHENTICATION: //check
aa53efc3 1262 iClass_Authentication(c->d.asBytes);
1263 break;
1264 case CMD_ICLASS_DUMP:
3ac22ee1 1265 iClass_Dump(c->arg[0], c->arg[1]);
aa53efc3 1266 break;
1267 case CMD_ICLASS_CLONE:
3ac22ee1 1268 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
aa53efc3 1269 break;
cee5a30d 1270#endif
0472d76d 1271#ifdef WITH_HFSNOOP
1272 case CMD_HF_SNIFFER:
1273 HfSnoop(c->arg[0], c->arg[1]);
1274 break;
1275#endif
43591e64 1276#ifdef WITH_SMARTCARD
1277 case CMD_SMART_ATR: {
1278 SmartCardAtr();
1279 break;
1280 }
1281 case CMD_SMART_SETCLOCK:{
1282 SmartCardSetClock(c->arg[0]);
1283 break;
1284 }
1285 case CMD_SMART_RAW: {
1286 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1287 break;
1288 }
1289 case CMD_SMART_UPLOAD: {
1290 // upload file from client
1291 uint8_t *mem = BigBuf_get_addr();
1292 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1293 cmd_send(CMD_ACK,1,0,0,0,0);
1294 break;
1295 }
1296 case CMD_SMART_UPGRADE: {
1297 SmartCardUpgrade(c->arg[0]);
1298 break;
1299 }
1300#endif
cee5a30d 1301
7e67e42f 1302 case CMD_BUFF_CLEAR:
117d9ec2 1303 BigBuf_Clear();
15c4dc5a 1304 break;
15c4dc5a 1305
1306 case CMD_MEASURE_ANTENNA_TUNING:
fdcfbdcc 1307 MeasureAntennaTuning(c->arg[0]);
15c4dc5a 1308 break;
1309
1310 case CMD_MEASURE_ANTENNA_TUNING_HF:
1311 MeasureAntennaTuningHf();
1312 break;
1313
1314 case CMD_LISTEN_READER_FIELD:
1315 ListenReaderField(c->arg[0]);
1316 break;
1317
15c4dc5a 1318 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1319 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1320 SpinDelay(200);
1321 LED_D_OFF(); // LED D indicates field ON or OFF
1322 break;
1323
1c611bbd 1324 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 1325
1c611bbd 1326 LED_B_ON();
117d9ec2 1327 uint8_t *BigBuf = BigBuf_get_addr();
1c611bbd 1328 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1329 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 1330 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 1331 }
1332 // Trigger a finish downloading signal with an ACK frame
3000dc4e 1333 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 1334 LED_B_OFF();
1c611bbd 1335 break;
15c4dc5a 1336
1337 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
8c8317a5 1338 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1339 // to be able to use this one for uploading data to device
1340 // arg1 = 0 upload for LF usage
1341 // 1 upload for HF usage
1342 if (c->arg[1] == 0)
1343 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1344 else
1345 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1346
117d9ec2 1347 uint8_t *b = BigBuf_get_addr();
3fe4ff4f 1348 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 1349 cmd_send(CMD_ACK,0,0,0,0,0);
1350 break;
1351 }
15c4dc5a 1352 case CMD_READ_MEM:
1353 ReadMem(c->arg[0]);
1354 break;
1355
1356 case CMD_SET_LF_DIVISOR:
8c8317a5 1357 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 1358 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1359 break;
1360
1361 case CMD_SET_ADC_MUX:
1362 switch(c->arg[0]) {
1363 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1364 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1365 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1366 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1367 }
1368 break;
1369
1370 case CMD_VERSION:
1371 SendVersion();
1372 break;
c89274cc 1373 case CMD_STATUS:
67b7d6fa 1374 SendStatus();
c89274cc
CY
1375 break;
1376 case CMD_PING:
1377 cmd_send(CMD_ACK,0,0,0,0,0);
1378 break;
15c4dc5a 1379#ifdef WITH_LCD
1380 case CMD_LCD_RESET:
1381 LCDReset();
1382 break;
1383 case CMD_LCD:
1384 LCDSend(c->arg[0]);
1385 break;
1386#endif
1387 case CMD_SETUP_WRITE:
1388 case CMD_FINISH_WRITE:
1c611bbd 1389 case CMD_HARDWARE_RESET:
1390 usb_disable();
15c4dc5a 1391 SpinDelay(1000);
1392 SpinDelay(1000);
1393 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1394 for(;;) {
1395 // We're going to reset, and the bootrom will take control.
1396 }
1c611bbd 1397 break;
15c4dc5a 1398
1c611bbd 1399 case CMD_START_FLASH:
15c4dc5a 1400 if(common_area.flags.bootrom_present) {
1401 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1402 }
1c611bbd 1403 usb_disable();
15c4dc5a 1404 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1405 for(;;);
1c611bbd 1406 break;
e30c654b 1407
15c4dc5a 1408 case CMD_DEVICE_INFO: {
902cb3c0 1409 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1410 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1411 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1412 break;
1413 }
1414 default:
15c4dc5a 1415 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1416 break;
15c4dc5a 1417 }
1418}
1419
1420void __attribute__((noreturn)) AppMain(void)
1421{
1422 SpinDelay(100);
9e8255d4 1423 clear_trace();
15c4dc5a 1424 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1425 /* Initialize common area */
1426 memset(&common_area, 0, sizeof(common_area));
1427 common_area.magic = COMMON_AREA_MAGIC;
1428 common_area.version = 1;
1429 }
1430 common_area.flags.osimage_present = 1;
1431
1432 LED_D_OFF();
1433 LED_C_OFF();
1434 LED_B_OFF();
1435 LED_A_OFF();
1436
3fe4ff4f 1437 // Init USB device
902cb3c0 1438 usb_enable();
15c4dc5a 1439
1440 // The FPGA gets its clock from us from PCK0 output, so set that up.
1441 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1442 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1443 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1444 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1445 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
0472d76d 1446 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
15c4dc5a 1447 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1448
1449 // Reset SPI
1450 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1451 // Reset SSC
1452 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1453
1454 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1455 // (the HF version by default)
1456 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1457
9ca155ba 1458 StartTickCount();
902cb3c0 1459
15c4dc5a 1460#ifdef WITH_LCD
15c4dc5a 1461 LCDInit();
15c4dc5a 1462#endif
1463
902cb3c0 1464 byte_t rx[sizeof(UsbCommand)];
1465 size_t rx_len;
1466
15c4dc5a 1467 for(;;) {
902cb3c0 1468 if (usb_poll()) {
1469 rx_len = usb_read(rx,sizeof(UsbCommand));
1470 if (rx_len) {
1471 UsbPacketReceived(rx,rx_len);
1472 }
1473 }
15c4dc5a 1474 WDT_HIT();
1475
a2937cea 1476#ifdef WITH_LF_StandAlone
e46fe044 1477#ifndef WITH_ISO14443a_StandAlone
15c4dc5a 1478 if (BUTTON_HELD(1000) > 0)
1479 SamyRun();
e46fe044
CY
1480#endif
1481#endif
1482#ifdef WITH_ISO14443a
1483#ifdef WITH_ISO14443a_StandAlone
1484 if (BUTTON_HELD(1000) > 0)
1485 StandAloneMode14a();
1486#endif
15c4dc5a 1487#endif
1488 }
1489}
Impressum, Datenschutz