]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
small fixes to 14b info, added 14b sim cmds
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
902cb3c0 13#include "usb_cdc.h"
14#include "cmd.h"
15
e30c654b 16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
31d1caa5 21
9ab7a6c7 22#include <stdarg.h>
f7e3ed82 23
15c4dc5a 24#include "legicrf.h"
d19929cb 25#include <hitag2.h>
31abe49f 26#include "lfsampling.h"
3000dc4e 27#include "BigBuf.h"
15c4dc5a 28#ifdef WITH_LCD
902cb3c0 29 #include "LCD.h"
15c4dc5a 30#endif
31
15c4dc5a 32#define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34//=============================================================================
35// A buffer where we can queue things up to be sent through the FPGA, for
36// any purpose (fake tag, as reader, whatever). We go MSB first, since that
37// is the order in which they go out on the wire.
38//=============================================================================
39
6a1f2d82 40#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 42int ToSendMax;
43static int ToSendBit;
44struct common_area common_area __attribute__((section(".commonarea")));
45
15c4dc5a 46void ToSendReset(void)
47{
48 ToSendMax = -1;
49 ToSendBit = 8;
50}
51
52void ToSendStuffBit(int b)
53{
54 if(ToSendBit >= 8) {
55 ToSendMax++;
56 ToSend[ToSendMax] = 0;
57 ToSendBit = 0;
58 }
59
60 if(b) {
61 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
62 }
63
64 ToSendBit++;
65
6a1f2d82 66 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 67 ToSendBit = 0;
68 DbpString("ToSendStuffBit overflowed!");
69 }
70}
71
72//=============================================================================
73// Debug print functions, to go out over USB, to the usual PC-side client.
74//=============================================================================
75
76void DbpString(char *str)
77{
9440213d 78 byte_t len = strlen(str);
79 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 80}
81
82#if 0
83void DbpIntegers(int x1, int x2, int x3)
84{
902cb3c0 85 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 86}
87#endif
88
89void Dbprintf(const char *fmt, ...) {
90// should probably limit size here; oh well, let's just use a big buffer
91 char output_string[128];
92 va_list ap;
93
94 va_start(ap, fmt);
95 kvsprintf(fmt, output_string, 10, ap);
96 va_end(ap);
e30c654b 97
15c4dc5a 98 DbpString(output_string);
99}
100
9455b51c 101// prints HEX & ASCII
d19929cb 102void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 103 int l=0,i;
104 char ascii[9];
d19929cb 105
9455b51c 106 while (len>0) {
107 if (len>8) l=8;
108 else l=len;
109
110 memcpy(ascii,d,l);
d19929cb 111 ascii[l]=0;
9455b51c 112
113 // filter safe ascii
d19929cb 114 for (i=0;i<l;i++)
9455b51c 115 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 116
117 if (bAsci) {
118 Dbprintf("%-8s %*D",ascii,l,d," ");
119 } else {
120 Dbprintf("%*D",l,d," ");
121 }
122
9455b51c 123 len-=8;
124 d+=8;
125 }
126}
127
15c4dc5a 128//-----------------------------------------------------------------------------
129// Read an ADC channel and block till it completes, then return the result
130// in ADC units (0 to 1023). Also a routine to average 32 samples and
131// return that.
132//-----------------------------------------------------------------------------
133static int ReadAdc(int ch)
134{
f7e3ed82 135 uint32_t d;
15c4dc5a 136
137 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
138 AT91C_BASE_ADC->ADC_MR =
3b692427 139 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
140 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
141 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
142
143 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
144 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
145 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
146 //
147 // The maths are:
148 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
149 //
150 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
151 //
152 // Note: with the "historic" values in the comments above, the error was 34% !!!
153
15c4dc5a 154 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
155
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
3b692427 157
15c4dc5a 158 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
159 ;
160 d = AT91C_BASE_ADC->ADC_CDR[ch];
161
162 return d;
163}
164
9ca155ba 165int AvgAdc(int ch) // was static - merlok
15c4dc5a 166{
167 int i;
168 int a = 0;
169
170 for(i = 0; i < 32; i++) {
171 a += ReadAdc(ch);
172 }
173
174 return (a + 15) >> 5;
175}
176
177void MeasureAntennaTuning(void)
178{
2bdd68c3 179 uint8_t LF_Results[256];
9f693930 180 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 181 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
182
2bdd68c3 183 LED_B_ON();
15c4dc5a 184
185/*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
d19929cb 193
7cc204bf 194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2bdd68c3 196 for (i=255; i>=19; i--) {
d19929cb 197 WDT_HIT();
15c4dc5a 198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
3b692427 200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
15c4dc5a 201 if (i==95) vLf125 = adcval; // voltage at 125Khz
202 if (i==89) vLf134 = adcval; // voltage at 134Khz
203
2bdd68c3 204 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
205 if(LF_Results[i] > peak) {
15c4dc5a 206 peakv = adcval;
2bdd68c3 207 peak = LF_Results[i];
15c4dc5a 208 peakf = i;
9f693930 209 //ptr = i;
15c4dc5a 210 }
211 }
212
2bdd68c3 213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
214
215 LED_A_ON();
15c4dc5a 216 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 217 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 218 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
219 SpinDelay(20);
3b692427 220 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
15c4dc5a 221
3b692427 222 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
d19929cb 223 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 224 LED_A_OFF();
225 LED_B_OFF();
226 return;
15c4dc5a 227}
228
229void MeasureAntennaTuningHf(void)
230{
231 int vHf = 0; // in mV
232
233 DbpString("Measuring HF antenna, press button to exit");
234
3b692427 235 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
236 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
237 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
238
15c4dc5a 239 for (;;) {
15c4dc5a 240 SpinDelay(20);
3b692427 241 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 242
15c4dc5a 243 Dbprintf("%d mV",vHf);
244 if (BUTTON_PRESS()) break;
245 }
246 DbpString("cancelled");
3b692427 247
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
249
15c4dc5a 250}
251
252
15c4dc5a 253void ReadMem(int addr)
254{
f7e3ed82 255 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 256
257 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
258 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
259}
260
261/* osimage version information is linked in */
262extern struct version_information version_information;
263/* bootrom version information is pointed to from _bootphase1_version_pointer */
0fa01ec7 264extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
15c4dc5a 265void SendVersion(void)
266{
8e074056 267 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
268 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 269
270 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 271 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
272 * pointer, then use it.
273 */
274 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
275 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
8e074056 276 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 277 } else {
278 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
8e074056 279 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 280 }
e30c654b 281
15c4dc5a 282 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
8e074056 283 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 284
e6153040 285 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
8e074056 286 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e6153040 287 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
8e074056 288 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
0fa01ec7 289
e6153040 290 // Send Chip ID and used flash memory
0fa01ec7 291 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
292 uint32_t compressed_data_section_size = common_area.arg1;
8e074056 293 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 294}
295
296#ifdef WITH_LF
297// samy's sniff and repeat routine
298void SamyRun()
299{
300 DbpString("Stand-alone mode! No PC necessary.");
7cc204bf 301 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 302
303 // 3 possible options? no just 2 for now
304#define OPTS 2
305
306 int high[OPTS], low[OPTS];
307
308 // Oooh pretty -- notify user we're in elite samy mode now
309 LED(LED_RED, 200);
310 LED(LED_ORANGE, 200);
311 LED(LED_GREEN, 200);
312 LED(LED_ORANGE, 200);
313 LED(LED_RED, 200);
314 LED(LED_ORANGE, 200);
315 LED(LED_GREEN, 200);
316 LED(LED_ORANGE, 200);
317 LED(LED_RED, 200);
318
319 int selected = 0;
320 int playing = 0;
3fe4ff4f 321 int cardRead = 0;
15c4dc5a 322
323 // Turn on selected LED
324 LED(selected + 1, 0);
325
326 for (;;)
327 {
6e82300d 328 usb_poll();
329 WDT_HIT();
15c4dc5a 330
331 // Was our button held down or pressed?
332 int button_pressed = BUTTON_HELD(1000);
333 SpinDelay(300);
334
335 // Button was held for a second, begin recording
3fe4ff4f 336 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 337 {
338 LEDsoff();
339 LED(selected + 1, 0);
340 LED(LED_RED2, 0);
341
342 // record
343 DbpString("Starting recording");
344
345 // wait for button to be released
346 while(BUTTON_PRESS())
347 WDT_HIT();
348
349 /* need this delay to prevent catching some weird data */
350 SpinDelay(500);
351
352 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
353 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
354
355 LEDsoff();
356 LED(selected + 1, 0);
357 // Finished recording
358
359 // If we were previously playing, set playing off
360 // so next button push begins playing what we recorded
361 playing = 0;
3fe4ff4f 362
363 cardRead = 1;
364
365 }
366
367 else if (button_pressed > 0 && cardRead == 1)
368 {
369 LEDsoff();
370 LED(selected + 1, 0);
371 LED(LED_ORANGE, 0);
372
373 // record
374 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
375
376 // wait for button to be released
377 while(BUTTON_PRESS())
378 WDT_HIT();
379
380 /* need this delay to prevent catching some weird data */
381 SpinDelay(500);
382
383 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
384 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
385
386 LEDsoff();
387 LED(selected + 1, 0);
388 // Finished recording
389
390 // If we were previously playing, set playing off
391 // so next button push begins playing what we recorded
392 playing = 0;
393
394 cardRead = 0;
395
15c4dc5a 396 }
397
398 // Change where to record (or begin playing)
399 else if (button_pressed)
400 {
401 // Next option if we were previously playing
402 if (playing)
403 selected = (selected + 1) % OPTS;
404 playing = !playing;
405
406 LEDsoff();
407 LED(selected + 1, 0);
408
409 // Begin transmitting
410 if (playing)
411 {
412 LED(LED_GREEN, 0);
413 DbpString("Playing");
414 // wait for button to be released
415 while(BUTTON_PRESS())
416 WDT_HIT();
417 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
418 CmdHIDsimTAG(high[selected], low[selected], 0);
419 DbpString("Done playing");
420 if (BUTTON_HELD(1000) > 0)
421 {
422 DbpString("Exiting");
423 LEDsoff();
424 return;
425 }
426
427 /* We pressed a button so ignore it here with a delay */
428 SpinDelay(300);
429
430 // when done, we're done playing, move to next option
431 selected = (selected + 1) % OPTS;
432 playing = !playing;
433 LEDsoff();
434 LED(selected + 1, 0);
435 }
436 else
437 while(BUTTON_PRESS())
438 WDT_HIT();
439 }
440 }
441}
442#endif
443
444/*
445OBJECTIVE
446Listen and detect an external reader. Determine the best location
447for the antenna.
448
449INSTRUCTIONS:
450Inside the ListenReaderField() function, there is two mode.
451By default, when you call the function, you will enter mode 1.
452If you press the PM3 button one time, you will enter mode 2.
453If you press the PM3 button a second time, you will exit the function.
454
455DESCRIPTION OF MODE 1:
456This mode just listens for an external reader field and lights up green
457for HF and/or red for LF. This is the original mode of the detectreader
458function.
459
460DESCRIPTION OF MODE 2:
461This mode will visually represent, using the LEDs, the actual strength of the
462current compared to the maximum current detected. Basically, once you know
463what kind of external reader is present, it will help you spot the best location to place
464your antenna. You will probably not get some good results if there is a LF and a HF reader
465at the same place! :-)
466
467LIGHT SCHEME USED:
468*/
469static const char LIGHT_SCHEME[] = {
470 0x0, /* ---- | No field detected */
471 0x1, /* X--- | 14% of maximum current detected */
472 0x2, /* -X-- | 29% of maximum current detected */
473 0x4, /* --X- | 43% of maximum current detected */
474 0x8, /* ---X | 57% of maximum current detected */
475 0xC, /* --XX | 71% of maximum current detected */
476 0xE, /* -XXX | 86% of maximum current detected */
477 0xF, /* XXXX | 100% of maximum current detected */
478};
479static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
480
481void ListenReaderField(int limit)
482{
3b692427 483 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
484 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
15c4dc5a 485 int mode=1, display_val, display_max, i;
486
3b692427 487#define LF_ONLY 1
488#define HF_ONLY 2
489#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
490
491
492 // switch off FPGA - we don't want to measure our own signal
493 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
494 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 495
496 LEDsoff();
497
3b692427 498 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 499
500 if(limit != HF_ONLY) {
3b692427 501 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 502 lf_baseline = lf_av;
503 }
504
3b692427 505 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 506
507 if (limit != LF_ONLY) {
3b692427 508 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 509 hf_baseline = hf_av;
510 }
511
512 for(;;) {
513 if (BUTTON_PRESS()) {
514 SpinDelay(500);
515 switch (mode) {
516 case 1:
517 mode=2;
518 DbpString("Signal Strength Mode");
519 break;
520 case 2:
521 default:
522 DbpString("Stopped");
523 LEDsoff();
524 return;
525 break;
526 }
527 }
528 WDT_HIT();
529
530 if (limit != HF_ONLY) {
3b692427 531 if(mode == 1) {
532 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
533 LED_D_ON();
534 else
535 LED_D_OFF();
15c4dc5a 536 }
e30c654b 537
3b692427 538 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 539 // see if there's a significant change
3b692427 540 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
541 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 542 lf_av = lf_av_new;
543 if (lf_av > lf_max)
544 lf_max = lf_av;
15c4dc5a 545 }
546 }
547
548 if (limit != LF_ONLY) {
549 if (mode == 1){
3b692427 550 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
551 LED_B_ON();
552 else
553 LED_B_OFF();
15c4dc5a 554 }
e30c654b 555
3b692427 556 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 557 // see if there's a significant change
3b692427 558 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
559 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 560 hf_av = hf_av_new;
561 if (hf_av > hf_max)
562 hf_max = hf_av;
15c4dc5a 563 }
564 }
e30c654b 565
15c4dc5a 566 if(mode == 2) {
567 if (limit == LF_ONLY) {
568 display_val = lf_av;
569 display_max = lf_max;
570 } else if (limit == HF_ONLY) {
571 display_val = hf_av;
572 display_max = hf_max;
573 } else { /* Pick one at random */
574 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
575 display_val = hf_av;
576 display_max = hf_max;
577 } else {
578 display_val = lf_av;
579 display_max = lf_max;
580 }
581 }
582 for (i=0; i<LIGHT_LEN; i++) {
583 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
584 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
585 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
586 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
587 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
588 break;
589 }
590 }
591 }
592 }
593}
594
f7e3ed82 595void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 596{
597 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 598
902cb3c0 599// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
600
15c4dc5a 601 switch(c->cmd) {
602#ifdef WITH_LF
31abe49f
MHS
603 case CMD_SET_LF_SAMPLING_CONFIG:
604 setSamplingConfig((sample_config *) c->d.asBytes);
605 break;
15c4dc5a 606 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1fbf8956 607 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
15c4dc5a 608 break;
15c4dc5a 609 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
610 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
611 break;
b014c96d 612 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 613 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 614 break;
7e67e42f 615 case CMD_HID_DEMOD_FSK:
3fe4ff4f 616 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 617 break;
618 case CMD_HID_SIM_TAG:
3fe4ff4f 619 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 620 break;
abd6112f 621 case CMD_FSK_SIM_TAG:
622 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
623 break;
624 case CMD_ASK_SIM_TAG:
625 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
626 break;
872e3d4d 627 case CMD_PSK_SIM_TAG:
628 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
629 break;
630 case CMD_HID_CLONE_TAG:
1c611bbd 631 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 632 break;
a1f3bb12 633 case CMD_IO_DEMOD_FSK:
3fe4ff4f 634 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 635 break;
3fe4ff4f 636 case CMD_IO_CLONE_TAG:
a1f3bb12 637 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
638 break;
66707a3b 639 case CMD_EM410X_DEMOD:
640 CmdEM410xdemod(c->arg[0], 0, 0, 1);
641 break;
2d4eae76 642 case CMD_EM410X_WRITE_TAG:
643 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
644 break;
7e67e42f 645 case CMD_READ_TI_TYPE:
646 ReadTItag();
647 break;
648 case CMD_WRITE_TI_TYPE:
649 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
650 break;
651 case CMD_SIMULATE_TAG_125K:
31d1caa5 652 LED_A_ON();
7e67e42f 653 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
31d1caa5 654 LED_A_OFF();
7e67e42f 655 break;
656 case CMD_LF_SIMULATE_BIDIR:
657 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
658 break;
3fe4ff4f 659 case CMD_INDALA_CLONE_TAG:
2414f978 660 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
661 break;
3fe4ff4f 662 case CMD_INDALA_CLONE_TAG_L:
2414f978 663 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
664 break;
1c611bbd 665 case CMD_T55XX_READ_BLOCK:
666 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
667 break;
668 case CMD_T55XX_WRITE_BLOCK:
669 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
670 break;
3fe4ff4f 671 case CMD_T55XX_READ_TRACE:
1c611bbd 672 T55xxReadTrace();
673 break;
3fe4ff4f 674 case CMD_PCF7931_READ:
1c611bbd 675 ReadPCF7931();
676 cmd_send(CMD_ACK,0,0,0,0,0);
1c611bbd 677 break;
678 case CMD_EM4X_READ_WORD:
679 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
680 break;
681 case CMD_EM4X_WRITE_WORD:
682 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
683 break;
15c4dc5a 684#endif
685
d19929cb 686#ifdef WITH_HITAG
687 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
688 SnoopHitag(c->arg[0]);
689 break;
690 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
691 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
692 break;
693 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
694 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
695 break;
696#endif
f168b263 697
15c4dc5a 698#ifdef WITH_ISO15693
699 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
700 AcquireRawAdcSamplesIso15693();
701 break;
9455b51c 702 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
703 RecordRawAdcSamplesIso15693();
704 break;
705
706 case CMD_ISO_15693_COMMAND:
707 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
708 break;
709
710 case CMD_ISO_15693_FIND_AFI:
711 BruteforceIso15693Afi(c->arg[0]);
712 break;
713
714 case CMD_ISO_15693_DEBUG:
715 SetDebugIso15693(c->arg[0]);
716 break;
15c4dc5a 717
15c4dc5a 718 case CMD_READER_ISO_15693:
719 ReaderIso15693(c->arg[0]);
720 break;
7e67e42f 721 case CMD_SIMTAG_ISO_15693:
3fe4ff4f 722 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 723 break;
15c4dc5a 724#endif
725
7e67e42f 726#ifdef WITH_LEGICRF
727 case CMD_SIMULATE_TAG_LEGIC_RF:
728 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
729 break;
3612a8a8 730
7e67e42f 731 case CMD_WRITER_LEGIC_RF:
732 LegicRfWriter(c->arg[1], c->arg[0]);
733 break;
3612a8a8 734
15c4dc5a 735 case CMD_READER_LEGIC_RF:
736 LegicRfReader(c->arg[0], c->arg[1]);
737 break;
15c4dc5a 738#endif
739
740#ifdef WITH_ISO14443b
15c4dc5a 741 case CMD_READ_SRI512_TAG:
51d4f6f1 742 ReadSTMemoryIso14443b(0x0F);
15c4dc5a 743 break;
7e67e42f 744 case CMD_READ_SRIX4K_TAG:
51d4f6f1 745 ReadSTMemoryIso14443b(0x7F);
7e67e42f 746 break;
132a0217 747 case CMD_SNOOP_ISO_14443B:
51d4f6f1 748 SnoopIso14443b();
7e67e42f 749 break;
132a0217 750 case CMD_SIMULATE_TAG_ISO_14443B:
51d4f6f1 751 SimulateIso14443bTag();
7e67e42f 752 break;
7cf3ef20 753 case CMD_ISO_14443B_COMMAND:
754 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
755 break;
15c4dc5a 756#endif
757
758#ifdef WITH_ISO14443a
7e67e42f 759 case CMD_SNOOP_ISO_14443a:
5cd9ec01 760 SnoopIso14443a(c->arg[0]);
7e67e42f 761 break;
15c4dc5a 762 case CMD_READER_ISO_14443a:
902cb3c0 763 ReaderIso14443a(c);
15c4dc5a 764 break;
7e67e42f 765 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 766 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 767 break;
3fe4ff4f 768
5acd09bd 769 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 770 EPA_PACE_Collect_Nonce(c);
5acd09bd 771 break;
3bb07d96
FM
772 case CMD_EPA_PACE_REPLAY:
773 EPA_PACE_Replay(c);
774 break;
7e67e42f 775
15c4dc5a 776 case CMD_READER_MIFARE:
f168b263 777 ReaderMifare(c->arg[0]);
15c4dc5a 778 break;
20f9a2a1
M
779 case CMD_MIFARE_READBL:
780 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
781 break;
981bd429 782 case CMD_MIFAREU_READBL:
f168b263 783 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 784 break;
8258f409 785 case CMD_MIFAREUC_AUTH:
786 MifareUC_Auth(c->arg[0],c->d.asBytes);
a631936e 787 break;
981bd429 788 case CMD_MIFAREU_READCARD:
75377d29 789 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 790 break;
f168b263 791 case CMD_MIFAREUC_SETPWD:
792 MifareUSetPwd(c->arg[0], c->d.asBytes);
793 break;
20f9a2a1
M
794 case CMD_MIFARE_READSC:
795 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
796 break;
797 case CMD_MIFARE_WRITEBL:
798 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
799 break;
4973f23d 800 //case CMD_MIFAREU_WRITEBL_COMPAT:
801 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
802 //break;
981bd429 803 case CMD_MIFAREU_WRITEBL:
4973f23d 804 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
f168b263 805 break;
20f9a2a1
M
806 case CMD_MIFARE_NESTED:
807 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
808 break;
809 case CMD_MIFARE_CHKKEYS:
810 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
811 break;
812 case CMD_SIMULATE_MIFARE_CARD:
813 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
814 break;
8556b852
M
815
816 // emulator
817 case CMD_MIFARE_SET_DBGMODE:
818 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
819 break;
820 case CMD_MIFARE_EML_MEMCLR:
821 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
822 break;
823 case CMD_MIFARE_EML_MEMSET:
824 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
825 break;
826 case CMD_MIFARE_EML_MEMGET:
827 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
828 break;
829 case CMD_MIFARE_EML_CARDLOAD:
830 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
831 break;
832
833 // Work with "magic Chinese" card
3fe4ff4f 834 case CMD_MIFARE_CSETBLOCK:
0675f200 835 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 836 break;
3fe4ff4f 837 case CMD_MIFARE_CGETBLOCK:
545a1f38 838 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 839 break;
3fe4ff4f 840 case CMD_MIFARE_CIDENT:
841 MifareCIdent();
842 break;
b62a5a84
M
843
844 // mifare sniffer
845 case CMD_MIFARE_SNIFFER:
5cd9ec01 846 SniffMifare(c->arg[0]);
b62a5a84 847 break;
a631936e 848
20f9a2a1
M
849#endif
850
7e67e42f 851#ifdef WITH_ICLASS
cee5a30d 852 // Makes use of ISO14443a FPGA Firmware
853 case CMD_SNOOP_ICLASS:
854 SnoopIClass();
855 break;
1e262141 856 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 857 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 858 break;
859 case CMD_READER_ICLASS:
860 ReaderIClass(c->arg[0]);
861 break;
c3963755 862 case CMD_READER_ICLASS_REPLAY:
fecd8202 863 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 864 break;
e80aeb96
MHS
865 case CMD_ICLASS_EML_MEMSET:
866 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
867 break;
cee5a30d 868#endif
869
7e67e42f 870 case CMD_BUFF_CLEAR:
117d9ec2 871 BigBuf_Clear();
15c4dc5a 872 break;
15c4dc5a 873
874 case CMD_MEASURE_ANTENNA_TUNING:
875 MeasureAntennaTuning();
876 break;
877
878 case CMD_MEASURE_ANTENNA_TUNING_HF:
879 MeasureAntennaTuningHf();
880 break;
881
882 case CMD_LISTEN_READER_FIELD:
883 ListenReaderField(c->arg[0]);
884 break;
885
15c4dc5a 886 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
887 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
888 SpinDelay(200);
889 LED_D_OFF(); // LED D indicates field ON or OFF
890 break;
891
1c611bbd 892 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 893
1c611bbd 894 LED_B_ON();
117d9ec2 895 uint8_t *BigBuf = BigBuf_get_addr();
1c611bbd 896 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
897 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 898 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 899 }
900 // Trigger a finish downloading signal with an ACK frame
3000dc4e 901 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 902 LED_B_OFF();
1c611bbd 903 break;
15c4dc5a 904
905 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
117d9ec2 906 uint8_t *b = BigBuf_get_addr();
3fe4ff4f 907 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 908 cmd_send(CMD_ACK,0,0,0,0,0);
909 break;
910 }
15c4dc5a 911 case CMD_READ_MEM:
912 ReadMem(c->arg[0]);
913 break;
914
915 case CMD_SET_LF_DIVISOR:
7cc204bf 916 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 917 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
918 break;
919
920 case CMD_SET_ADC_MUX:
921 switch(c->arg[0]) {
922 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
923 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
924 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
925 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
926 }
927 break;
928
929 case CMD_VERSION:
930 SendVersion();
931 break;
932
15c4dc5a 933#ifdef WITH_LCD
934 case CMD_LCD_RESET:
935 LCDReset();
936 break;
937 case CMD_LCD:
938 LCDSend(c->arg[0]);
939 break;
940#endif
941 case CMD_SETUP_WRITE:
942 case CMD_FINISH_WRITE:
1c611bbd 943 case CMD_HARDWARE_RESET:
944 usb_disable();
15c4dc5a 945 SpinDelay(1000);
946 SpinDelay(1000);
947 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
948 for(;;) {
949 // We're going to reset, and the bootrom will take control.
950 }
1c611bbd 951 break;
15c4dc5a 952
1c611bbd 953 case CMD_START_FLASH:
15c4dc5a 954 if(common_area.flags.bootrom_present) {
955 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
956 }
1c611bbd 957 usb_disable();
15c4dc5a 958 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
959 for(;;);
1c611bbd 960 break;
e30c654b 961
15c4dc5a 962 case CMD_DEVICE_INFO: {
902cb3c0 963 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
964 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 965 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
966 break;
967 }
968 default:
15c4dc5a 969 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 970 break;
15c4dc5a 971 }
972}
973
974void __attribute__((noreturn)) AppMain(void)
975{
976 SpinDelay(100);
9e8255d4 977 clear_trace();
15c4dc5a 978 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
979 /* Initialize common area */
980 memset(&common_area, 0, sizeof(common_area));
981 common_area.magic = COMMON_AREA_MAGIC;
982 common_area.version = 1;
983 }
984 common_area.flags.osimage_present = 1;
985
986 LED_D_OFF();
987 LED_C_OFF();
988 LED_B_OFF();
989 LED_A_OFF();
990
3fe4ff4f 991 // Init USB device
902cb3c0 992 usb_enable();
15c4dc5a 993
994 // The FPGA gets its clock from us from PCK0 output, so set that up.
995 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
996 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
997 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
998 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
999 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1000 AT91C_PMC_PRES_CLK_4;
1001 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1002
1003 // Reset SPI
1004 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1005 // Reset SSC
1006 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1007
1008 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1009 // (the HF version by default)
1010 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1011
9ca155ba 1012 StartTickCount();
902cb3c0 1013
15c4dc5a 1014#ifdef WITH_LCD
15c4dc5a 1015 LCDInit();
15c4dc5a 1016#endif
1017
902cb3c0 1018 byte_t rx[sizeof(UsbCommand)];
1019 size_t rx_len;
1020
15c4dc5a 1021 for(;;) {
902cb3c0 1022 if (usb_poll()) {
1023 rx_len = usb_read(rx,sizeof(UsbCommand));
1024 if (rx_len) {
1025 UsbPacketReceived(rx,rx_len);
1026 }
1027 }
15c4dc5a 1028 WDT_HIT();
1029
1030#ifdef WITH_LF
1031 if (BUTTON_HELD(1000) > 0)
1032 SamyRun();
1033#endif
1034 }
1035}
Impressum, Datenschutz