]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
cleaning up iclass.c and optimized_cipher.c
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "legicrfsim.h"
25 #include "hitag2.h"
26 #include "hitagS.h"
27 #include "iclass.h"
28 #include "iso14443b.h"
29 #include "iso15693.h"
30 #include "lfsampling.h"
31 #include "BigBuf.h"
32 #include "mifareutil.h"
33 #include "mifaresim.h"
34 #include "pcf7931.h"
35 #include "i2c.h"
36 #include "hfsnoop.h"
37 #include "fpgaloader.h"
38 #ifdef WITH_LCD
39 #include "LCD.h"
40 #endif
41
42 static uint32_t hw_capabilities;
43
44 // Craig Young - 14a stand-alone code
45 #ifdef WITH_ISO14443a
46 #include "iso14443a.h"
47 #endif
48
49 //=============================================================================
50 // A buffer where we can queue things up to be sent through the FPGA, for
51 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
52 // is the order in which they go out on the wire.
53 //=============================================================================
54
55 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
56 uint8_t ToSend[TOSEND_BUFFER_SIZE];
57 int ToSendMax;
58 static int ToSendBit;
59 struct common_area common_area __attribute__((section(".commonarea")));
60
61 void ToSendReset(void)
62 {
63 ToSendMax = -1;
64 ToSendBit = 8;
65 }
66
67 void ToSendStuffBit(int b)
68 {
69 if(ToSendBit >= 8) {
70 ToSendMax++;
71 ToSend[ToSendMax] = 0;
72 ToSendBit = 0;
73 }
74
75 if(b) {
76 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
77 }
78
79 ToSendBit++;
80
81 if(ToSendMax >= sizeof(ToSend)) {
82 ToSendBit = 0;
83 DbpString("ToSendStuffBit overflowed!");
84 }
85 }
86
87 //=============================================================================
88 // Debug print functions, to go out over USB, to the usual PC-side client.
89 //=============================================================================
90
91 void DbpString(char *str)
92 {
93 byte_t len = strlen(str);
94 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
95 }
96
97 #if 0
98 void DbpIntegers(int x1, int x2, int x3)
99 {
100 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
101 }
102 #endif
103
104 void Dbprintf(const char *fmt, ...) {
105 // should probably limit size here; oh well, let's just use a big buffer
106 char output_string[128];
107 va_list ap;
108
109 va_start(ap, fmt);
110 kvsprintf(fmt, output_string, 10, ap);
111 va_end(ap);
112
113 DbpString(output_string);
114 }
115
116 // prints HEX & ASCII
117 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
118 int l=0,i;
119 char ascii[9];
120
121 while (len>0) {
122 if (len>8) l=8;
123 else l=len;
124
125 memcpy(ascii,d,l);
126 ascii[l]=0;
127
128 // filter safe ascii
129 for (i=0;i<l;i++)
130 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
131
132 if (bAsci) {
133 Dbprintf("%-8s %*D",ascii,l,d," ");
134 } else {
135 Dbprintf("%*D",l,d," ");
136 }
137
138 len-=8;
139 d+=8;
140 }
141 }
142
143 //-----------------------------------------------------------------------------
144 // Read an ADC channel and block till it completes, then return the result
145 // in ADC units (0 to 1023). Also a routine to average 32 samples and
146 // return that.
147 //-----------------------------------------------------------------------------
148 static int ReadAdc(int ch)
149 {
150 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
151 // AMPL_HI is a high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
152 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
153 //
154 // The maths are:
155 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
156 //
157 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
158
159 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
160 AT91C_BASE_ADC->ADC_MR =
161 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
162 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
163 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
164
165 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
166 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
167
168 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
169
170 return AT91C_BASE_ADC->ADC_CDR[ch] & 0x3ff;
171 }
172
173 int AvgAdc(int ch) // was static - merlok
174 {
175 int i;
176 int a = 0;
177
178 for(i = 0; i < 32; i++) {
179 a += ReadAdc(ch);
180 }
181
182 return (a + 15) >> 5;
183 }
184
185 static int AvgAdc_Voltage_HF(void)
186 {
187 int AvgAdc_Voltage_Low, AvgAdc_Voltage_High;
188
189 AvgAdc_Voltage_Low= (MAX_ADC_HF_VOLTAGE_LOW * AvgAdc(ADC_CHAN_HF_LOW)) >> 10;
190 // if voltage range is about to be exceeded, use high voltage ADC channel if available (RDV40 only)
191 if (AvgAdc_Voltage_Low > MAX_ADC_HF_VOLTAGE_LOW - 300) {
192 AvgAdc_Voltage_High = (MAX_ADC_HF_VOLTAGE_HIGH * AvgAdc(ADC_CHAN_HF_HIGH)) >> 10;
193 if (AvgAdc_Voltage_High >= AvgAdc_Voltage_Low) {
194 return AvgAdc_Voltage_High;
195 }
196 }
197 return AvgAdc_Voltage_Low;
198 }
199
200 static int AvgAdc_Voltage_LF(void)
201 {
202 return (MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10;
203 }
204
205 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
206 {
207 int i, adcval = 0, peak = 0;
208
209 /*
210 * Sweeps the useful LF range of the proxmark from
211 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
212 * read the voltage in the antenna, the result left
213 * in the buffer is a graph which should clearly show
214 * the resonating frequency of your LF antenna
215 * ( hopefully around 95 if it is tuned to 125kHz!)
216 */
217
218 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
219 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
220 SpinDelay(50);
221
222 for (i=255; i>=19; i--) {
223 WDT_HIT();
224 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
225 SpinDelay(20);
226 adcval = AvgAdc_Voltage_LF();
227 if (i==95) *vLf125 = adcval; // voltage at 125Khz
228 if (i==89) *vLf134 = adcval; // voltage at 134Khz
229
230 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
231 if(LF_Results[i] > peak) {
232 *peakv = adcval;
233 peak = LF_Results[i];
234 *peakf = i;
235 //ptr = i;
236 }
237 }
238
239 for (i=18; i >= 0; i--) LF_Results[i] = 0;
240
241 return;
242 }
243
244 void MeasureAntennaTuningHfOnly(int *vHf)
245 {
246 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
247 LED_A_ON();
248 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
249 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
250 SpinDelay(20);
251 *vHf = AvgAdc_Voltage_HF();
252 LED_A_OFF();
253 return;
254 }
255
256 void MeasureAntennaTuning(int mode)
257 {
258 uint8_t LF_Results[256] = {0};
259 int peakv = 0, peakf = 0;
260 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
261
262 LED_B_ON();
263
264 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
265 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
266 MeasureAntennaTuningHfOnly(&vHf);
267 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
268 } else {
269 if (mode & FLAG_TUNE_LF) {
270 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
271 }
272 if (mode & FLAG_TUNE_HF) {
273 MeasureAntennaTuningHfOnly(&vHf);
274 }
275 }
276
277 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
278 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
279 LED_B_OFF();
280 return;
281 }
282
283 void MeasureAntennaTuningHf(void)
284 {
285 int vHf = 0; // in mV
286
287 DbpString("Measuring HF antenna, press button to exit");
288
289 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
290 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
291 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
292
293 for (;;) {
294 SpinDelay(500);
295 vHf = AvgAdc_Voltage_HF();
296
297 Dbprintf("%d mV",vHf);
298 if (BUTTON_PRESS()) break;
299 }
300 DbpString("cancelled");
301
302 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
303
304 }
305
306
307 void ReadMem(int addr)
308 {
309 const uint8_t *data = ((uint8_t *)addr);
310
311 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
312 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
313 }
314
315 /* osimage version information is linked in */
316 extern struct version_information version_information;
317 /* bootrom version information is pointed to from _bootphase1_version_pointer */
318 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
319
320
321 void set_hw_capabilities(void)
322 {
323 if (I2C_is_available()) {
324 hw_capabilities |= HAS_SMARTCARD_SLOT;
325 }
326
327 if (false) { // TODO: implement a test
328 hw_capabilities |= HAS_EXTRA_FLASH_MEM;
329 }
330 }
331
332
333 void SendVersion(void)
334 {
335 set_hw_capabilities();
336
337 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
338 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
339
340 /* Try to find the bootrom version information. Expect to find a pointer at
341 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
342 * pointer, then use it.
343 */
344 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
345 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
346 strcat(VersionString, "bootrom version information appears invalid\n");
347 } else {
348 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
349 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
350 }
351
352 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
353 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
354
355 for (int i = 0; i < fpga_bitstream_num; i++) {
356 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
357 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
358 }
359
360 // test availability of SmartCard slot
361 if (I2C_is_available()) {
362 strncat(VersionString, "SmartCard Slot: available\n", sizeof(VersionString) - strlen(VersionString) - 1);
363 } else {
364 strncat(VersionString, "SmartCard Slot: not available\n", sizeof(VersionString) - strlen(VersionString) - 1);
365 }
366
367 // Send Chip ID and used flash memory
368 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
369 uint32_t compressed_data_section_size = common_area.arg1;
370 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, hw_capabilities, VersionString, strlen(VersionString));
371 }
372
373 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
374 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
375 void printUSBSpeed(void)
376 {
377 Dbprintf("USB Speed:");
378 Dbprintf(" Sending USB packets to client...");
379
380 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
381 uint8_t *test_data = BigBuf_get_addr();
382 uint32_t end_time;
383
384 uint32_t start_time = end_time = GetTickCount();
385 uint32_t bytes_transferred = 0;
386
387 LED_B_ON();
388 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
389 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
390 end_time = GetTickCount();
391 bytes_transferred += USB_CMD_DATA_SIZE;
392 }
393 LED_B_OFF();
394
395 Dbprintf(" Time elapsed: %dms", end_time - start_time);
396 Dbprintf(" Bytes transferred: %d", bytes_transferred);
397 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
398 1000 * bytes_transferred / (end_time - start_time));
399
400 }
401
402 /**
403 * Prints runtime information about the PM3.
404 **/
405 void SendStatus(void)
406 {
407 BigBuf_print_status();
408 Fpga_print_status();
409 #ifdef WITH_SMARTCARD
410 I2C_print_status();
411 #endif
412 printConfig(); //LF Sampling config
413 printUSBSpeed();
414 Dbprintf("Various");
415 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
416 Dbprintf(" ToSendMax..........%d", ToSendMax);
417 Dbprintf(" ToSendBit..........%d", ToSendBit);
418
419 cmd_send(CMD_ACK,1,0,0,0,0);
420 }
421
422 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
423
424 #define OPTS 2
425
426 void StandAloneMode()
427 {
428 DbpString("Stand-alone mode! No PC necessary.");
429 // Oooh pretty -- notify user we're in elite samy mode now
430 LED(LED_RED, 200);
431 LED(LED_ORANGE, 200);
432 LED(LED_GREEN, 200);
433 LED(LED_ORANGE, 200);
434 LED(LED_RED, 200);
435 LED(LED_ORANGE, 200);
436 LED(LED_GREEN, 200);
437 LED(LED_ORANGE, 200);
438 LED(LED_RED, 200);
439
440 }
441
442 #endif
443
444
445
446 #ifdef WITH_ISO14443a_StandAlone
447 void StandAloneMode14a()
448 {
449 StandAloneMode();
450 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
451
452 int selected = 0;
453 bool playing = false, GotoRecord = false, GotoClone = false;
454 bool cardRead[OPTS] = {false};
455 uint8_t readUID[10] = {0};
456 uint32_t uid_1st[OPTS]={0};
457 uint32_t uid_2nd[OPTS]={0};
458 uint32_t uid_tmp1 = 0;
459 uint32_t uid_tmp2 = 0;
460 iso14a_card_select_t hi14a_card[OPTS];
461
462 LED(selected + 1, 0);
463
464 for (;;)
465 {
466 usb_poll();
467 WDT_HIT();
468 SpinDelay(300);
469
470 if (GotoRecord || !cardRead[selected])
471 {
472 GotoRecord = false;
473 LEDsoff();
474 LED(selected + 1, 0);
475 LED(LED_RED2, 0);
476
477 // record
478 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
479 /* need this delay to prevent catching some weird data */
480 SpinDelay(500);
481 /* Code for reading from 14a tag */
482 uint8_t uid[10] ={0};
483 uint32_t cuid;
484 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
485
486 for ( ; ; )
487 {
488 WDT_HIT();
489 if (BUTTON_PRESS()) {
490 if (cardRead[selected]) {
491 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
492 break;
493 }
494 else if (cardRead[(selected+1)%OPTS]) {
495 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
496 selected = (selected+1)%OPTS;
497 break;
498 }
499 else {
500 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
501 SpinDelay(300);
502 }
503 }
504 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
505 continue;
506 else
507 {
508 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
509 memcpy(readUID,uid,10*sizeof(uint8_t));
510 uint8_t *dst = (uint8_t *)&uid_tmp1;
511 // Set UID byte order
512 for (int i=0; i<4; i++)
513 dst[i] = uid[3-i];
514 dst = (uint8_t *)&uid_tmp2;
515 for (int i=0; i<4; i++)
516 dst[i] = uid[7-i];
517 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
518 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
519 }
520 else {
521 if (uid_tmp2) {
522 Dbprintf("Bank[%d] received a 7-byte UID",selected);
523 uid_1st[selected] = (uid_tmp1)>>8;
524 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
525 }
526 else {
527 Dbprintf("Bank[%d] received a 4-byte UID",selected);
528 uid_1st[selected] = uid_tmp1;
529 uid_2nd[selected] = uid_tmp2;
530 }
531 break;
532 }
533 }
534 }
535 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
536 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
537 LEDsoff();
538 LED(LED_GREEN, 200);
539 LED(LED_ORANGE, 200);
540 LED(LED_GREEN, 200);
541 LED(LED_ORANGE, 200);
542
543 LEDsoff();
544 LED(selected + 1, 0);
545
546 // Next state is replay:
547 playing = true;
548
549 cardRead[selected] = true;
550 }
551 /* MF Classic UID clone */
552 else if (GotoClone)
553 {
554 GotoClone=false;
555 LEDsoff();
556 LED(selected + 1, 0);
557 LED(LED_ORANGE, 250);
558
559
560 // record
561 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
562
563 // wait for button to be released
564 while(BUTTON_PRESS())
565 {
566 // Delay cloning until card is in place
567 WDT_HIT();
568 }
569 Dbprintf("Starting clone. [Bank: %u]", selected);
570 // need this delay to prevent catching some weird data
571 SpinDelay(500);
572 // Begin clone function here:
573 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
574 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
575 memcpy(c.d.asBytes, data, 16);
576 SendCommand(&c);
577
578 Block read is similar:
579 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
580 We need to imitate that call with blockNo 0 to set a uid.
581
582 The get and set commands are handled in this file:
583 // Work with "magic Chinese" card
584 case CMD_MIFARE_CSETBLOCK:
585 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
586 break;
587 case CMD_MIFARE_CGETBLOCK:
588 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
589 break;
590
591 mfCSetUID provides example logic for UID set workflow:
592 -Read block0 from card in field with MifareCGetBlock()
593 -Configure new values without replacing reserved bytes
594 memcpy(block0, uid, 4); // Copy UID bytes from byte array
595 // Mifare UID BCC
596 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
597 Bytes 5-7 are reserved SAK and ATQA for mifare classic
598 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
599 */
600 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
601 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
602 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
603 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
604 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
605 playing = true;
606 }
607 else {
608 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
609 memcpy(newBlock0,oldBlock0,16);
610 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
611
612 newBlock0[0] = uid_1st[selected]>>24;
613 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
614 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
615 newBlock0[3] = 0xFF & (uid_1st[selected]);
616 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
617 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
618 MifareCSetBlock(0, 0xFF,0, newBlock0);
619 MifareCGetBlock(0x3F, 1, 0, testBlock0);
620 if (memcmp(testBlock0,newBlock0,16)==0)
621 {
622 DbpString("Cloned successfull!");
623 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
624 playing = false;
625 GotoRecord = true;
626 selected = (selected+1) % OPTS;
627 }
628 else {
629 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
630 playing = true;
631 }
632 }
633 LEDsoff();
634 LED(selected + 1, 0);
635
636 }
637 // Change where to record (or begin playing)
638 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
639 {
640 LEDsoff();
641 LED(selected + 1, 0);
642
643 // Begin transmitting
644 LED(LED_GREEN, 0);
645 DbpString("Playing");
646 for ( ; ; ) {
647 WDT_HIT();
648 int button_action = BUTTON_HELD(1000);
649 if (button_action == 0) { // No button action, proceed with sim
650 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
651 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
652 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
653 DbpString("Mifare Classic");
654 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
655 }
656 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
657 DbpString("Mifare Ultralight");
658 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
659 }
660 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
661 DbpString("Mifare DESFire");
662 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
663 }
664 else {
665 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
666 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
667 }
668 }
669 else if (button_action == BUTTON_SINGLE_CLICK) {
670 selected = (selected + 1) % OPTS;
671 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
672 GotoRecord = true;
673 break;
674 }
675 else if (button_action == BUTTON_HOLD) {
676 Dbprintf("Playtime over. Begin cloning...");
677 GotoClone = true;
678 break;
679 }
680 WDT_HIT();
681 }
682
683 /* We pressed a button so ignore it here with a delay */
684 SpinDelay(300);
685 LEDsoff();
686 LED(selected + 1, 0);
687 }
688 }
689 }
690 #elif WITH_LF_StandAlone
691 // samy's sniff and repeat routine
692 void SamyRun()
693 {
694 StandAloneMode();
695 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
696
697 int tops[OPTS], high[OPTS], low[OPTS];
698 int selected = 0;
699 int playing = 0;
700 int cardRead = 0;
701
702 // Turn on selected LED
703 LED(selected + 1, 0);
704
705 for (;;)
706 {
707 usb_poll();
708 WDT_HIT();
709
710 // Was our button held down or pressed?
711 int button_pressed = BUTTON_HELD(1000);
712 SpinDelay(300);
713
714 // Button was held for a second, begin recording
715 if (button_pressed > 0 && cardRead == 0)
716 {
717 LEDsoff();
718 LED(selected + 1, 0);
719 LED(LED_RED2, 0);
720
721 // record
722 DbpString("Starting recording");
723
724 // wait for button to be released
725 while(BUTTON_PRESS())
726 WDT_HIT();
727
728 /* need this delay to prevent catching some weird data */
729 SpinDelay(500);
730
731 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
732 if (tops[selected] > 0)
733 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
734 else
735 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
736
737 LEDsoff();
738 LED(selected + 1, 0);
739 // Finished recording
740
741 // If we were previously playing, set playing off
742 // so next button push begins playing what we recorded
743 playing = 0;
744
745 cardRead = 1;
746
747 }
748
749 else if (button_pressed > 0 && cardRead == 1)
750 {
751 LEDsoff();
752 LED(selected + 1, 0);
753 LED(LED_ORANGE, 0);
754
755 // record
756 if (tops[selected] > 0)
757 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
758 else
759 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
760
761 // wait for button to be released
762 while(BUTTON_PRESS())
763 WDT_HIT();
764
765 /* need this delay to prevent catching some weird data */
766 SpinDelay(500);
767
768 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)), 0x1D);
769 if (tops[selected] > 0)
770 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
771 else
772 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
773
774 LEDsoff();
775 LED(selected + 1, 0);
776 // Finished recording
777
778 // If we were previously playing, set playing off
779 // so next button push begins playing what we recorded
780 playing = 0;
781
782 cardRead = 0;
783
784 }
785
786 // Change where to record (or begin playing)
787 else if (button_pressed)
788 {
789 // Next option if we were previously playing
790 if (playing)
791 selected = (selected + 1) % OPTS;
792 playing = !playing;
793
794 LEDsoff();
795 LED(selected + 1, 0);
796
797 // Begin transmitting
798 if (playing)
799 {
800 LED(LED_GREEN, 0);
801 DbpString("Playing");
802 // wait for button to be released
803 while(BUTTON_PRESS())
804 WDT_HIT();
805 if (tops[selected] > 0)
806 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
807 else
808 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
809
810 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
811 DbpString("Done playing");
812 if (BUTTON_HELD(1000) > 0)
813 {
814 DbpString("Exiting");
815 LEDsoff();
816 return;
817 }
818
819 /* We pressed a button so ignore it here with a delay */
820 SpinDelay(300);
821
822 // when done, we're done playing, move to next option
823 selected = (selected + 1) % OPTS;
824 playing = !playing;
825 LEDsoff();
826 LED(selected + 1, 0);
827 }
828 else
829 while(BUTTON_PRESS())
830 WDT_HIT();
831 }
832 }
833 }
834
835 #endif
836 /*
837 OBJECTIVE
838 Listen and detect an external reader. Determine the best location
839 for the antenna.
840
841 INSTRUCTIONS:
842 Inside the ListenReaderField() function, there is two mode.
843 By default, when you call the function, you will enter mode 1.
844 If you press the PM3 button one time, you will enter mode 2.
845 If you press the PM3 button a second time, you will exit the function.
846
847 DESCRIPTION OF MODE 1:
848 This mode just listens for an external reader field and lights up green
849 for HF and/or red for LF. This is the original mode of the detectreader
850 function.
851
852 DESCRIPTION OF MODE 2:
853 This mode will visually represent, using the LEDs, the actual strength of the
854 current compared to the maximum current detected. Basically, once you know
855 what kind of external reader is present, it will help you spot the best location to place
856 your antenna. You will probably not get some good results if there is a LF and a HF reader
857 at the same place! :-)
858
859 LIGHT SCHEME USED:
860 */
861 static const char LIGHT_SCHEME[] = {
862 0x0, /* ---- | No field detected */
863 0x1, /* X--- | 14% of maximum current detected */
864 0x2, /* -X-- | 29% of maximum current detected */
865 0x4, /* --X- | 43% of maximum current detected */
866 0x8, /* ---X | 57% of maximum current detected */
867 0xC, /* --XX | 71% of maximum current detected */
868 0xE, /* -XXX | 86% of maximum current detected */
869 0xF, /* XXXX | 100% of maximum current detected */
870 };
871 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
872
873 void ListenReaderField(int limit)
874 {
875 int lf_av, lf_av_new=0, lf_baseline= 0, lf_max;
876 int hf_av, hf_av_new=0, hf_baseline= 0, hf_max;
877 int mode=1, display_val, display_max, i;
878
879 #define LF_ONLY 1
880 #define HF_ONLY 2
881 #define REPORT_CHANGE_PERCENT 5 // report new values only if they have changed at least by REPORT_CHANGE_PERCENT
882 #define MIN_HF_FIELD 300 // in mode 1 signal HF field greater than MIN_HF_FIELD above baseline
883 #define MIN_LF_FIELD 1200 // in mode 1 signal LF field greater than MIN_LF_FIELD above baseline
884
885
886 // switch off FPGA - we don't want to measure our own signal
887 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
888 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
889
890 LEDsoff();
891
892 lf_av = lf_max = AvgAdc_Voltage_LF();
893
894 if(limit != HF_ONLY) {
895 Dbprintf("LF 125/134kHz Baseline: %dmV", lf_av);
896 lf_baseline = lf_av;
897 }
898
899 hf_av = hf_max = AvgAdc_Voltage_HF();
900
901 if (limit != LF_ONLY) {
902 Dbprintf("HF 13.56MHz Baseline: %dmV", hf_av);
903 hf_baseline = hf_av;
904 }
905
906 for(;;) {
907 SpinDelay(500);
908 if (BUTTON_PRESS()) {
909 switch (mode) {
910 case 1:
911 mode=2;
912 DbpString("Signal Strength Mode");
913 break;
914 case 2:
915 default:
916 DbpString("Stopped");
917 LEDsoff();
918 return;
919 break;
920 }
921 while (BUTTON_PRESS());
922 }
923 WDT_HIT();
924
925 if (limit != HF_ONLY) {
926 if(mode == 1) {
927 if (lf_av - lf_baseline > MIN_LF_FIELD)
928 LED_D_ON();
929 else
930 LED_D_OFF();
931 }
932
933 lf_av_new = AvgAdc_Voltage_LF();
934 // see if there's a significant change
935 if (ABS((lf_av - lf_av_new)*100/(lf_av?lf_av:1)) > REPORT_CHANGE_PERCENT) {
936 Dbprintf("LF 125/134kHz Field Change: %5dmV", lf_av_new);
937 lf_av = lf_av_new;
938 if (lf_av > lf_max)
939 lf_max = lf_av;
940 }
941 }
942
943 if (limit != LF_ONLY) {
944 if (mode == 1){
945 if (hf_av - hf_baseline > MIN_HF_FIELD)
946 LED_B_ON();
947 else
948 LED_B_OFF();
949 }
950
951 hf_av_new = AvgAdc_Voltage_HF();
952
953 // see if there's a significant change
954 if (ABS((hf_av - hf_av_new)*100/(hf_av?hf_av:1)) > REPORT_CHANGE_PERCENT) {
955 Dbprintf("HF 13.56MHz Field Change: %5dmV", hf_av_new);
956 hf_av = hf_av_new;
957 if (hf_av > hf_max)
958 hf_max = hf_av;
959 }
960 }
961
962 if(mode == 2) {
963 if (limit == LF_ONLY) {
964 display_val = lf_av;
965 display_max = lf_max;
966 } else if (limit == HF_ONLY) {
967 display_val = hf_av;
968 display_max = hf_max;
969 } else { /* Pick one at random */
970 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
971 display_val = hf_av;
972 display_max = hf_max;
973 } else {
974 display_val = lf_av;
975 display_max = lf_max;
976 }
977 }
978 for (i=0; i<LIGHT_LEN; i++) {
979 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
980 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
981 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
982 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
983 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
984 break;
985 }
986 }
987 }
988 }
989 }
990
991 void UsbPacketReceived(uint8_t *packet, int len)
992 {
993 UsbCommand *c = (UsbCommand *)packet;
994
995 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
996
997 switch(c->cmd) {
998 #ifdef WITH_LF
999 case CMD_SET_LF_SAMPLING_CONFIG:
1000 setSamplingConfig((sample_config *) c->d.asBytes);
1001 break;
1002 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1003 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
1004 break;
1005 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
1006 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1007 break;
1008 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
1009 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
1010 break;
1011 case CMD_HID_DEMOD_FSK:
1012 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
1013 break;
1014 case CMD_HID_SIM_TAG:
1015 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
1016 break;
1017 case CMD_FSK_SIM_TAG:
1018 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1019 break;
1020 case CMD_ASK_SIM_TAG:
1021 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1022 break;
1023 case CMD_PSK_SIM_TAG:
1024 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1025 break;
1026 case CMD_HID_CLONE_TAG:
1027 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x1D);
1028 break;
1029 case CMD_PARADOX_CLONE_TAG:
1030 // Paradox cards are the same as HID, with a different preamble, so we can reuse the same function
1031 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x0F);
1032 break;
1033 case CMD_IO_DEMOD_FSK:
1034 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
1035 break;
1036 case CMD_IO_CLONE_TAG:
1037 CopyIOtoT55x7(c->arg[0], c->arg[1]);
1038 break;
1039 case CMD_EM410X_DEMOD:
1040 CmdEM410xdemod(c->arg[0], 0, 0, 1);
1041 break;
1042 case CMD_EM410X_WRITE_TAG:
1043 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
1044 break;
1045 case CMD_READ_TI_TYPE:
1046 ReadTItag();
1047 break;
1048 case CMD_WRITE_TI_TYPE:
1049 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
1050 break;
1051 case CMD_SIMULATE_TAG_125K:
1052 LED_A_ON();
1053 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
1054 LED_A_OFF();
1055 break;
1056 case CMD_LF_SIMULATE_BIDIR:
1057 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1058 break;
1059 case CMD_INDALA_CLONE_TAG:
1060 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1061 break;
1062 case CMD_INDALA_CLONE_TAG_L:
1063 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1064 break;
1065 case CMD_T55XX_READ_BLOCK:
1066 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1067 break;
1068 case CMD_T55XX_WRITE_BLOCK:
1069 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1070 break;
1071 case CMD_T55XX_WAKEUP:
1072 T55xxWakeUp(c->arg[0]);
1073 break;
1074 case CMD_T55XX_RESET_READ:
1075 T55xxResetRead();
1076 break;
1077 case CMD_PCF7931_READ:
1078 ReadPCF7931();
1079 break;
1080 case CMD_PCF7931_WRITE:
1081 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1082 break;
1083 case CMD_PCF7931_BRUTEFORCE:
1084 BruteForcePCF7931(c->arg[0], (c->arg[1] & 0xFF), c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128);
1085 break;
1086 case CMD_EM4X_READ_WORD:
1087 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1088 break;
1089 case CMD_EM4X_WRITE_WORD:
1090 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1091 break;
1092 case CMD_EM4X_PROTECT:
1093 EM4xProtect(c->arg[0], c->arg[1], c->arg[2]);
1094 break;
1095 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1096 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1097 break;
1098 case CMD_VIKING_CLONE_TAG:
1099 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1100 break;
1101 case CMD_COTAG:
1102 Cotag(c->arg[0]);
1103 break;
1104 #endif
1105
1106 #ifdef WITH_HITAG
1107 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1108 SnoopHitag(c->arg[0]);
1109 break;
1110 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1111 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1112 break;
1113 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1114 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1115 break;
1116 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1117 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1118 break;
1119 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1120 check_challenges_cmd((bool)c->arg[0], (byte_t*)c->d.asBytes, (uint8_t)c->arg[1]);
1121 break;
1122 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1123 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], false);
1124 break;
1125 case CMD_READ_HITAG_S_BLK:
1126 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], true);
1127 break;
1128 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1129 if ((hitag_function)c->arg[0] < 10) {
1130 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1131 }
1132 else if ((hitag_function)c->arg[0] >= 10) {
1133 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1134 }
1135 break;
1136 #endif
1137
1138 #ifdef WITH_ISO15693
1139 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1140 AcquireRawAdcSamplesIso15693();
1141 break;
1142
1143 case CMD_SNOOP_ISO_15693:
1144 SnoopIso15693();
1145 break;
1146
1147 case CMD_ISO_15693_COMMAND:
1148 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1149 break;
1150
1151 case CMD_ISO_15693_FIND_AFI:
1152 BruteforceIso15693Afi(c->arg[0]);
1153 break;
1154
1155 case CMD_ISO_15693_DEBUG:
1156 SetDebugIso15693(c->arg[0]);
1157 break;
1158
1159 case CMD_READER_ISO_15693:
1160 ReaderIso15693(c->arg[0]);
1161 break;
1162
1163 case CMD_SIMTAG_ISO_15693:
1164 SimTagIso15693(c->arg[0], c->d.asBytes);
1165 break;
1166
1167 case CMD_CSETUID_ISO_15693:
1168 SetTag15693Uid(c->d.asBytes);
1169 break;
1170 #endif
1171
1172 #ifdef WITH_LEGICRF
1173 case CMD_SIMULATE_TAG_LEGIC_RF:
1174 LegicRfSimulate(c->arg[0]);
1175 break;
1176
1177 case CMD_WRITER_LEGIC_RF:
1178 LegicRfWriter(c->arg[1], c->arg[0]);
1179 break;
1180
1181 case CMD_READER_LEGIC_RF:
1182 LegicRfReader(c->arg[0], c->arg[1]);
1183 break;
1184 #endif
1185
1186 #ifdef WITH_ISO14443b
1187 case CMD_READ_SRI512_TAG:
1188 ReadSTMemoryIso14443b(0x0F);
1189 break;
1190 case CMD_READ_SRIX4K_TAG:
1191 ReadSTMemoryIso14443b(0x7F);
1192 break;
1193 case CMD_SNOOP_ISO_14443B:
1194 SnoopIso14443b();
1195 break;
1196 case CMD_SIMULATE_TAG_ISO_14443B:
1197 SimulateIso14443bTag();
1198 break;
1199 case CMD_ISO_14443B_COMMAND:
1200 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1201 break;
1202 #endif
1203
1204 #ifdef WITH_ISO14443a
1205 case CMD_SNOOP_ISO_14443a:
1206 SnoopIso14443a(c->arg[0]);
1207 break;
1208 case CMD_READER_ISO_14443a:
1209 ReaderIso14443a(c);
1210 break;
1211 case CMD_SIMULATE_TAG_ISO_14443a:
1212 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1213 break;
1214
1215 case CMD_EPA_PACE_COLLECT_NONCE:
1216 EPA_PACE_Collect_Nonce(c);
1217 break;
1218 case CMD_EPA_PACE_REPLAY:
1219 EPA_PACE_Replay(c);
1220 break;
1221
1222 case CMD_READER_MIFARE:
1223 ReaderMifare(c->arg[0]);
1224 break;
1225 case CMD_MIFARE_READBL:
1226 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1227 break;
1228 case CMD_MIFAREU_READBL:
1229 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1230 break;
1231 case CMD_MIFAREUC_AUTH:
1232 MifareUC_Auth(c->arg[0],c->d.asBytes);
1233 break;
1234 case CMD_MIFAREU_READCARD:
1235 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1236 break;
1237 case CMD_MIFAREUC_SETPWD:
1238 MifareUSetPwd(c->arg[0], c->d.asBytes);
1239 break;
1240 case CMD_MIFARE_READSC:
1241 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1242 break;
1243 case CMD_MIFARE_WRITEBL:
1244 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1245 break;
1246 //case CMD_MIFAREU_WRITEBL_COMPAT:
1247 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1248 //break;
1249 case CMD_MIFAREU_WRITEBL:
1250 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1251 break;
1252 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1253 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1254 break;
1255 case CMD_MIFARE_NESTED:
1256 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1257 break;
1258 case CMD_MIFARE_CHKKEYS:
1259 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1260 break;
1261 case CMD_SIMULATE_MIFARE_CARD:
1262 MifareSim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1263 break;
1264
1265 // emulator
1266 case CMD_MIFARE_SET_DBGMODE:
1267 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1268 break;
1269 case CMD_MIFARE_EML_MEMCLR:
1270 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1271 break;
1272 case CMD_MIFARE_EML_MEMSET:
1273 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1274 break;
1275 case CMD_MIFARE_EML_MEMGET:
1276 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1277 break;
1278 case CMD_MIFARE_EML_CARDLOAD:
1279 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1280 break;
1281
1282 // Work with "magic Chinese" card
1283 case CMD_MIFARE_CWIPE:
1284 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1285 break;
1286 case CMD_MIFARE_CSETBLOCK:
1287 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1288 break;
1289 case CMD_MIFARE_CGETBLOCK:
1290 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1291 break;
1292 case CMD_MIFARE_CIDENT:
1293 MifareCIdent();
1294 break;
1295
1296 // mifare sniffer
1297 case CMD_MIFARE_SNIFFER:
1298 SniffMifare(c->arg[0]);
1299 break;
1300
1301 #endif
1302
1303 #ifdef WITH_ICLASS
1304 // Makes use of ISO14443a FPGA Firmware
1305 case CMD_SNOOP_ICLASS:
1306 SnoopIClass();
1307 break;
1308 case CMD_SIMULATE_TAG_ICLASS:
1309 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1310 break;
1311 case CMD_READER_ICLASS:
1312 ReaderIClass(c->arg[0]);
1313 break;
1314 case CMD_READER_ICLASS_REPLAY:
1315 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1316 break;
1317 case CMD_ICLASS_EML_MEMSET:
1318 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1319 break;
1320 case CMD_ICLASS_WRITEBLOCK:
1321 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1322 break;
1323 case CMD_ICLASS_READCHECK: // auth step 1
1324 iClass_ReadCheck(c->arg[0], c->arg[1]);
1325 break;
1326 case CMD_ICLASS_READBLOCK:
1327 iClass_ReadBlk(c->arg[0]);
1328 break;
1329 case CMD_ICLASS_AUTHENTICATION: //check
1330 iClass_Authentication(c->d.asBytes);
1331 break;
1332 case CMD_ICLASS_DUMP:
1333 iClass_Dump(c->arg[0], c->arg[1]);
1334 break;
1335 case CMD_ICLASS_CLONE:
1336 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1337 break;
1338 #endif
1339
1340 #ifdef WITH_HFSNOOP
1341 case CMD_HF_SNIFFER:
1342 HfSnoop(c->arg[0], c->arg[1]);
1343 break;
1344 case CMD_HF_PLOT:
1345 HfPlot();
1346 break;
1347 #endif
1348
1349 #ifdef WITH_SMARTCARD
1350 case CMD_SMART_ATR: {
1351 SmartCardAtr();
1352 break;
1353 }
1354 case CMD_SMART_SETCLOCK:{
1355 SmartCardSetClock(c->arg[0]);
1356 break;
1357 }
1358 case CMD_SMART_RAW: {
1359 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1360 break;
1361 }
1362 case CMD_SMART_UPLOAD: {
1363 // upload file from client
1364 uint8_t *mem = BigBuf_get_addr();
1365 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1366 cmd_send(CMD_ACK,1,0,0,0,0);
1367 break;
1368 }
1369 case CMD_SMART_UPGRADE: {
1370 SmartCardUpgrade(c->arg[0]);
1371 break;
1372 }
1373 #endif
1374
1375 case CMD_BUFF_CLEAR:
1376 BigBuf_Clear();
1377 break;
1378
1379 case CMD_MEASURE_ANTENNA_TUNING:
1380 MeasureAntennaTuning(c->arg[0]);
1381 break;
1382
1383 case CMD_MEASURE_ANTENNA_TUNING_HF:
1384 MeasureAntennaTuningHf();
1385 break;
1386
1387 case CMD_LISTEN_READER_FIELD:
1388 ListenReaderField(c->arg[0]);
1389 break;
1390
1391 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1392 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1393 SpinDelay(200);
1394 LED_D_OFF(); // LED D indicates field ON or OFF
1395 break;
1396
1397 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1398 LED_B_ON();
1399 uint8_t *BigBuf = BigBuf_get_addr();
1400 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1401 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1402 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1403 }
1404 // Trigger a finish downloading signal with an ACK frame
1405 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1406 LED_B_OFF();
1407 break;
1408
1409 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1410 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1411 // to be able to use this one for uploading data to device
1412 // arg1 = 0 upload for LF usage
1413 // 1 upload for HF usage
1414 if (c->arg[1] == 0)
1415 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1416 else
1417 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1418
1419 uint8_t *b = BigBuf_get_addr();
1420 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1421 cmd_send(CMD_ACK,0,0,0,0,0);
1422 break;
1423 }
1424 case CMD_READ_MEM:
1425 ReadMem(c->arg[0]);
1426 break;
1427
1428 case CMD_SET_LF_DIVISOR:
1429 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1430 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1431 break;
1432
1433 case CMD_SET_ADC_MUX:
1434 switch(c->arg[0]) {
1435 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1436 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1437 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1438 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1439 }
1440 break;
1441
1442 case CMD_VERSION:
1443 SendVersion();
1444 break;
1445 case CMD_STATUS:
1446 SendStatus();
1447 break;
1448 case CMD_PING:
1449 cmd_send(CMD_ACK,0,0,0,0,0);
1450 break;
1451 #ifdef WITH_LCD
1452 case CMD_LCD_RESET:
1453 LCDReset();
1454 break;
1455 case CMD_LCD:
1456 LCDSend(c->arg[0]);
1457 break;
1458 #endif
1459 case CMD_SETUP_WRITE:
1460 case CMD_FINISH_WRITE:
1461 case CMD_HARDWARE_RESET:
1462 usb_disable();
1463 SpinDelay(1000);
1464 SpinDelay(1000);
1465 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1466 for(;;) {
1467 // We're going to reset, and the bootrom will take control.
1468 }
1469 break;
1470
1471 case CMD_START_FLASH:
1472 if(common_area.flags.bootrom_present) {
1473 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1474 }
1475 usb_disable();
1476 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1477 for(;;);
1478 break;
1479
1480 case CMD_DEVICE_INFO: {
1481 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1482 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1483 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1484 break;
1485 }
1486 default:
1487 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1488 break;
1489 }
1490 }
1491
1492 void __attribute__((noreturn)) AppMain(void)
1493 {
1494 SpinDelay(100);
1495 clear_trace();
1496 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1497 /* Initialize common area */
1498 memset(&common_area, 0, sizeof(common_area));
1499 common_area.magic = COMMON_AREA_MAGIC;
1500 common_area.version = 1;
1501 }
1502 common_area.flags.osimage_present = 1;
1503
1504 LEDsoff();
1505
1506 // Init USB device
1507 usb_enable();
1508
1509 // The FPGA gets its clock from us from PCK0 output, so set that up.
1510 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1511 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1512 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1513 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1514 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1515 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1516 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1517
1518 // Reset SPI
1519 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1520 // Reset SSC
1521 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1522
1523 // Load the FPGA image, which we have stored in our flash.
1524 // (the HF version by default)
1525 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1526
1527 StartTickCount();
1528
1529 #ifdef WITH_LCD
1530 LCDInit();
1531 #endif
1532
1533 byte_t rx[sizeof(UsbCommand)];
1534 size_t rx_len;
1535
1536 for(;;) {
1537 if (usb_poll()) {
1538 rx_len = usb_read(rx,sizeof(UsbCommand));
1539 if (rx_len) {
1540 UsbPacketReceived(rx,rx_len);
1541 }
1542 }
1543 WDT_HIT();
1544
1545 #ifdef WITH_LF_StandAlone
1546 #ifndef WITH_ISO14443a_StandAlone
1547 if (BUTTON_HELD(1000) > 0)
1548 SamyRun();
1549 #endif
1550 #endif
1551 #ifdef WITH_ISO14443a
1552 #ifdef WITH_ISO14443a_StandAlone
1553 if (BUTTON_HELD(1000) > 0)
1554 StandAloneMode14a();
1555 #endif
1556 #endif
1557 }
1558 }
Proxmark3 GIT tracking
Impressum, Datenschutz