]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #34 from marshmellow42/master
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26
27 #ifdef WITH_LCD
28 #include "LCD.h"
29 #endif
30
31 #define abs(x) ( ((x)<0) ? -(x) : (x) )
32
33 //=============================================================================
34 // A buffer where we can queue things up to be sent through the FPGA, for
35 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
36 // is the order in which they go out on the wire.
37 //=============================================================================
38
39 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
40 uint8_t ToSend[TOSEND_BUFFER_SIZE];
41 int ToSendMax;
42 static int ToSendBit;
43 struct common_area common_area __attribute__((section(".commonarea")));
44
45 void BufferClear(void)
46 {
47 memset(BigBuf,0,sizeof(BigBuf));
48 Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
49 }
50
51 void ToSendReset(void)
52 {
53 ToSendMax = -1;
54 ToSendBit = 8;
55 }
56
57 void ToSendStuffBit(int b)
58 {
59 if(ToSendBit >= 8) {
60 ToSendMax++;
61 ToSend[ToSendMax] = 0;
62 ToSendBit = 0;
63 }
64
65 if(b) {
66 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
67 }
68
69 ToSendBit++;
70
71 if(ToSendMax >= sizeof(ToSend)) {
72 ToSendBit = 0;
73 DbpString("ToSendStuffBit overflowed!");
74 }
75 }
76
77 //=============================================================================
78 // Debug print functions, to go out over USB, to the usual PC-side client.
79 //=============================================================================
80
81 void DbpString(char *str)
82 {
83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
85 // /* this holds up stuff unless we're connected to usb */
86 // if (!UsbConnected())
87 // return;
88 //
89 // UsbCommand c;
90 // c.cmd = CMD_DEBUG_PRINT_STRING;
91 // c.arg[0] = strlen(str);
92 // if(c.arg[0] > sizeof(c.d.asBytes)) {
93 // c.arg[0] = sizeof(c.d.asBytes);
94 // }
95 // memcpy(c.d.asBytes, str, c.arg[0]);
96 //
97 // UsbSendPacket((uint8_t *)&c, sizeof(c));
98 // // TODO fix USB so stupid things like this aren't req'd
99 // SpinDelay(50);
100 }
101
102 #if 0
103 void DbpIntegers(int x1, int x2, int x3)
104 {
105 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
106 // /* this holds up stuff unless we're connected to usb */
107 // if (!UsbConnected())
108 // return;
109 //
110 // UsbCommand c;
111 // c.cmd = CMD_DEBUG_PRINT_INTEGERS;
112 // c.arg[0] = x1;
113 // c.arg[1] = x2;
114 // c.arg[2] = x3;
115 //
116 // UsbSendPacket((uint8_t *)&c, sizeof(c));
117 // // XXX
118 // SpinDelay(50);
119 }
120 #endif
121
122 void Dbprintf(const char *fmt, ...) {
123 // should probably limit size here; oh well, let's just use a big buffer
124 char output_string[128];
125 va_list ap;
126
127 va_start(ap, fmt);
128 kvsprintf(fmt, output_string, 10, ap);
129 va_end(ap);
130
131 DbpString(output_string);
132 }
133
134 // prints HEX & ASCII
135 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
136 int l=0,i;
137 char ascii[9];
138
139 while (len>0) {
140 if (len>8) l=8;
141 else l=len;
142
143 memcpy(ascii,d,l);
144 ascii[l]=0;
145
146 // filter safe ascii
147 for (i=0;i<l;i++)
148 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
149
150 if (bAsci) {
151 Dbprintf("%-8s %*D",ascii,l,d," ");
152 } else {
153 Dbprintf("%*D",l,d," ");
154 }
155
156 len-=8;
157 d+=8;
158 }
159 }
160
161 //-----------------------------------------------------------------------------
162 // Read an ADC channel and block till it completes, then return the result
163 // in ADC units (0 to 1023). Also a routine to average 32 samples and
164 // return that.
165 //-----------------------------------------------------------------------------
166 static int ReadAdc(int ch)
167 {
168 uint32_t d;
169
170 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
171 AT91C_BASE_ADC->ADC_MR =
172 ADC_MODE_PRESCALE(32) |
173 ADC_MODE_STARTUP_TIME(16) |
174 ADC_MODE_SAMPLE_HOLD_TIME(8);
175 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
176
177 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
178 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
179 ;
180 d = AT91C_BASE_ADC->ADC_CDR[ch];
181
182 return d;
183 }
184
185 int AvgAdc(int ch) // was static - merlok
186 {
187 int i;
188 int a = 0;
189
190 for(i = 0; i < 32; i++) {
191 a += ReadAdc(ch);
192 }
193
194 return (a + 15) >> 5;
195 }
196
197 void MeasureAntennaTuning(void)
198 {
199 uint8_t LF_Results[256];
200 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
201 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
202
203 LED_B_ON();
204
205 /*
206 * Sweeps the useful LF range of the proxmark from
207 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
208 * read the voltage in the antenna, the result left
209 * in the buffer is a graph which should clearly show
210 * the resonating frequency of your LF antenna
211 * ( hopefully around 95 if it is tuned to 125kHz!)
212 */
213
214 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
215 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
216 for (i=255; i>=19; i--) {
217 WDT_HIT();
218 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
219 SpinDelay(20);
220 // Vref = 3.3V, and a 10000:240 voltage divider on the input
221 // can measure voltages up to 137500 mV
222 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
223 if (i==95) vLf125 = adcval; // voltage at 125Khz
224 if (i==89) vLf134 = adcval; // voltage at 134Khz
225
226 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
227 if(LF_Results[i] > peak) {
228 peakv = adcval;
229 peak = LF_Results[i];
230 peakf = i;
231 //ptr = i;
232 }
233 }
234
235 for (i=18; i >= 0; i--) LF_Results[i] = 0;
236
237 LED_A_ON();
238 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
239 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
240 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
241 SpinDelay(20);
242 // Vref = 3300mV, and an 10:1 voltage divider on the input
243 // can measure voltages up to 33000 mV
244 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
245
246 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),LF_Results,256);
247 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
248 LED_A_OFF();
249 LED_B_OFF();
250 return;
251 }
252
253 void MeasureAntennaTuningHf(void)
254 {
255 int vHf = 0; // in mV
256
257 DbpString("Measuring HF antenna, press button to exit");
258
259 for (;;) {
260 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
261 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
262 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
263 SpinDelay(20);
264 // Vref = 3300mV, and an 10:1 voltage divider on the input
265 // can measure voltages up to 33000 mV
266 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
267
268 Dbprintf("%d mV",vHf);
269 if (BUTTON_PRESS()) break;
270 }
271 DbpString("cancelled");
272 }
273
274
275 void SimulateTagHfListen(void)
276 {
277 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
278 uint8_t v = 0;
279 int i;
280 int p = 0;
281
282 // We're using this mode just so that I can test it out; the simulated
283 // tag mode would work just as well and be simpler.
284 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
285 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
286
287 // We need to listen to the high-frequency, peak-detected path.
288 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
289
290 FpgaSetupSsc();
291
292 i = 0;
293 for(;;) {
294 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
295 AT91C_BASE_SSC->SSC_THR = 0xff;
296 }
297 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
298 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
299
300 v <<= 1;
301 if(r & 1) {
302 v |= 1;
303 }
304 p++;
305
306 if(p >= 8) {
307 dest[i] = v;
308 v = 0;
309 p = 0;
310 i++;
311
312 if(i >= FREE_BUFFER_SIZE) {
313 break;
314 }
315 }
316 }
317 }
318 DbpString("simulate tag (now type bitsamples)");
319 }
320
321 void ReadMem(int addr)
322 {
323 const uint8_t *data = ((uint8_t *)addr);
324
325 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
326 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
327 }
328
329 /* osimage version information is linked in */
330 extern struct version_information version_information;
331 /* bootrom version information is pointed to from _bootphase1_version_pointer */
332 extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
333 void SendVersion(void)
334 {
335 char temp[256]; /* Limited data payload in USB packets */
336 DbpString("Prox/RFID mark3 RFID instrument");
337
338 /* Try to find the bootrom version information. Expect to find a pointer at
339 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
340 * pointer, then use it.
341 */
342 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
343 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
344 DbpString("bootrom version information appears invalid");
345 } else {
346 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
347 DbpString(temp);
348 }
349
350 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
351 DbpString(temp);
352
353 FpgaGatherVersion(temp, sizeof(temp));
354 DbpString(temp);
355 // Send Chip ID
356 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
357 }
358
359 #ifdef WITH_LF
360 // samy's sniff and repeat routine
361 void SamyRun()
362 {
363 DbpString("Stand-alone mode! No PC necessary.");
364 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
365
366 // 3 possible options? no just 2 for now
367 #define OPTS 2
368
369 int high[OPTS], low[OPTS];
370
371 // Oooh pretty -- notify user we're in elite samy mode now
372 LED(LED_RED, 200);
373 LED(LED_ORANGE, 200);
374 LED(LED_GREEN, 200);
375 LED(LED_ORANGE, 200);
376 LED(LED_RED, 200);
377 LED(LED_ORANGE, 200);
378 LED(LED_GREEN, 200);
379 LED(LED_ORANGE, 200);
380 LED(LED_RED, 200);
381
382 int selected = 0;
383 int playing = 0;
384
385 // Turn on selected LED
386 LED(selected + 1, 0);
387
388 for (;;)
389 {
390 // UsbPoll(FALSE);
391 usb_poll();
392 WDT_HIT();
393
394 // Was our button held down or pressed?
395 int button_pressed = BUTTON_HELD(1000);
396 SpinDelay(300);
397
398 // Button was held for a second, begin recording
399 if (button_pressed > 0)
400 {
401 LEDsoff();
402 LED(selected + 1, 0);
403 LED(LED_RED2, 0);
404
405 // record
406 DbpString("Starting recording");
407
408 // wait for button to be released
409 while(BUTTON_PRESS())
410 WDT_HIT();
411
412 /* need this delay to prevent catching some weird data */
413 SpinDelay(500);
414
415 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
416 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
417
418 LEDsoff();
419 LED(selected + 1, 0);
420 // Finished recording
421
422 // If we were previously playing, set playing off
423 // so next button push begins playing what we recorded
424 playing = 0;
425 }
426
427 // Change where to record (or begin playing)
428 else if (button_pressed)
429 {
430 // Next option if we were previously playing
431 if (playing)
432 selected = (selected + 1) % OPTS;
433 playing = !playing;
434
435 LEDsoff();
436 LED(selected + 1, 0);
437
438 // Begin transmitting
439 if (playing)
440 {
441 LED(LED_GREEN, 0);
442 DbpString("Playing");
443 // wait for button to be released
444 while(BUTTON_PRESS())
445 WDT_HIT();
446 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
447 CmdHIDsimTAG(high[selected], low[selected], 0);
448 DbpString("Done playing");
449 if (BUTTON_HELD(1000) > 0)
450 {
451 DbpString("Exiting");
452 LEDsoff();
453 return;
454 }
455
456 /* We pressed a button so ignore it here with a delay */
457 SpinDelay(300);
458
459 // when done, we're done playing, move to next option
460 selected = (selected + 1) % OPTS;
461 playing = !playing;
462 LEDsoff();
463 LED(selected + 1, 0);
464 }
465 else
466 while(BUTTON_PRESS())
467 WDT_HIT();
468 }
469 }
470 }
471 #endif
472
473 /*
474 OBJECTIVE
475 Listen and detect an external reader. Determine the best location
476 for the antenna.
477
478 INSTRUCTIONS:
479 Inside the ListenReaderField() function, there is two mode.
480 By default, when you call the function, you will enter mode 1.
481 If you press the PM3 button one time, you will enter mode 2.
482 If you press the PM3 button a second time, you will exit the function.
483
484 DESCRIPTION OF MODE 1:
485 This mode just listens for an external reader field and lights up green
486 for HF and/or red for LF. This is the original mode of the detectreader
487 function.
488
489 DESCRIPTION OF MODE 2:
490 This mode will visually represent, using the LEDs, the actual strength of the
491 current compared to the maximum current detected. Basically, once you know
492 what kind of external reader is present, it will help you spot the best location to place
493 your antenna. You will probably not get some good results if there is a LF and a HF reader
494 at the same place! :-)
495
496 LIGHT SCHEME USED:
497 */
498 static const char LIGHT_SCHEME[] = {
499 0x0, /* ---- | No field detected */
500 0x1, /* X--- | 14% of maximum current detected */
501 0x2, /* -X-- | 29% of maximum current detected */
502 0x4, /* --X- | 43% of maximum current detected */
503 0x8, /* ---X | 57% of maximum current detected */
504 0xC, /* --XX | 71% of maximum current detected */
505 0xE, /* -XXX | 86% of maximum current detected */
506 0xF, /* XXXX | 100% of maximum current detected */
507 };
508 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
509
510 void ListenReaderField(int limit)
511 {
512 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
513 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
514 int mode=1, display_val, display_max, i;
515
516 #define LF_ONLY 1
517 #define HF_ONLY 2
518
519 LEDsoff();
520
521 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
522
523 if(limit != HF_ONLY) {
524 Dbprintf("LF 125/134 Baseline: %d", lf_av);
525 lf_baseline = lf_av;
526 }
527
528 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
529
530 if (limit != LF_ONLY) {
531 Dbprintf("HF 13.56 Baseline: %d", hf_av);
532 hf_baseline = hf_av;
533 }
534
535 for(;;) {
536 if (BUTTON_PRESS()) {
537 SpinDelay(500);
538 switch (mode) {
539 case 1:
540 mode=2;
541 DbpString("Signal Strength Mode");
542 break;
543 case 2:
544 default:
545 DbpString("Stopped");
546 LEDsoff();
547 return;
548 break;
549 }
550 }
551 WDT_HIT();
552
553 if (limit != HF_ONLY) {
554 if(mode==1) {
555 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
556 else LED_D_OFF();
557 }
558
559 ++lf_count;
560 lf_av_new= ReadAdc(ADC_CHAN_LF);
561 // see if there's a significant change
562 if(abs(lf_av - lf_av_new) > 10) {
563 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
564 lf_av = lf_av_new;
565 if (lf_av > lf_max)
566 lf_max = lf_av;
567 lf_count= 0;
568 }
569 }
570
571 if (limit != LF_ONLY) {
572 if (mode == 1){
573 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
574 else LED_B_OFF();
575 }
576
577 ++hf_count;
578 hf_av_new= ReadAdc(ADC_CHAN_HF);
579 // see if there's a significant change
580 if(abs(hf_av - hf_av_new) > 10) {
581 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
582 hf_av = hf_av_new;
583 if (hf_av > hf_max)
584 hf_max = hf_av;
585 hf_count= 0;
586 }
587 }
588
589 if(mode == 2) {
590 if (limit == LF_ONLY) {
591 display_val = lf_av;
592 display_max = lf_max;
593 } else if (limit == HF_ONLY) {
594 display_val = hf_av;
595 display_max = hf_max;
596 } else { /* Pick one at random */
597 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
598 display_val = hf_av;
599 display_max = hf_max;
600 } else {
601 display_val = lf_av;
602 display_max = lf_max;
603 }
604 }
605 for (i=0; i<LIGHT_LEN; i++) {
606 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
607 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
608 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
609 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
610 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
611 break;
612 }
613 }
614 }
615 }
616 }
617
618 void UsbPacketReceived(uint8_t *packet, int len)
619 {
620 UsbCommand *c = (UsbCommand *)packet;
621
622 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
623
624 switch(c->cmd) {
625 #ifdef WITH_LF
626 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
627 AcquireRawAdcSamples125k(c->arg[0]);
628 cmd_send(CMD_ACK,0,0,0,0,0);
629 break;
630 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
631 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
632 break;
633 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
634 SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
635 cmd_send(CMD_ACK,0,0,0,0,0);
636 break;
637 case CMD_HID_DEMOD_FSK:
638 CmdHIDdemodFSK(c->arg[0], 0, 0, 1); // Demodulate HID tag
639 break;
640 case CMD_HID_SIM_TAG:
641 CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID
642 break;
643 case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
644 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
645 break;
646 case CMD_IO_DEMOD_FSK:
647 CmdIOdemodFSK(c->arg[0], 0, 0, 1); // Demodulate IO tag
648 break;
649 case CMD_IO_CLONE_TAG: // Clone IO tag by ID to T55x7
650 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
651 break;
652 case CMD_EM410X_DEMOD:
653 CmdEM410xdemod(c->arg[0], 0, 0, 1);
654 break;
655 case CMD_EM410X_WRITE_TAG:
656 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
657 break;
658 case CMD_READ_TI_TYPE:
659 ReadTItag();
660 break;
661 case CMD_WRITE_TI_TYPE:
662 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
663 break;
664 case CMD_SIMULATE_TAG_125K:
665 LED_A_ON();
666 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
667 LED_A_OFF();
668 break;
669 case CMD_LF_SIMULATE_BIDIR:
670 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
671 break;
672 case CMD_INDALA_CLONE_TAG: // Clone Indala 64-bit tag by UID to T55x7
673 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
674 break;
675 case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7
676 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
677 break;
678 case CMD_T55XX_READ_BLOCK:
679 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
680 break;
681 case CMD_T55XX_WRITE_BLOCK:
682 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
683 break;
684 case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
685 T55xxReadTrace();
686 break;
687 case CMD_PCF7931_READ: // Read PCF7931 tag
688 ReadPCF7931();
689 cmd_send(CMD_ACK,0,0,0,0,0);
690 // UsbSendPacket((uint8_t*)&ack, sizeof(ack));
691 break;
692 case CMD_EM4X_READ_WORD:
693 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
694 break;
695 case CMD_EM4X_WRITE_WORD:
696 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
697 break;
698 #endif
699
700 #ifdef WITH_HITAG
701 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
702 SnoopHitag(c->arg[0]);
703 break;
704 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
705 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
706 break;
707 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
708 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
709 break;
710 #endif
711
712 #ifdef WITH_ISO15693
713 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
714 AcquireRawAdcSamplesIso15693();
715 break;
716 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
717 RecordRawAdcSamplesIso15693();
718 break;
719
720 case CMD_ISO_15693_COMMAND:
721 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
722 break;
723
724 case CMD_ISO_15693_FIND_AFI:
725 BruteforceIso15693Afi(c->arg[0]);
726 break;
727
728 case CMD_ISO_15693_DEBUG:
729 SetDebugIso15693(c->arg[0]);
730 break;
731
732 case CMD_READER_ISO_15693:
733 ReaderIso15693(c->arg[0]);
734 break;
735 case CMD_SIMTAG_ISO_15693:
736 SimTagIso15693(c->arg[0]);
737 break;
738 #endif
739
740 #ifdef WITH_LEGICRF
741 case CMD_SIMULATE_TAG_LEGIC_RF:
742 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
743 break;
744
745 case CMD_WRITER_LEGIC_RF:
746 LegicRfWriter(c->arg[1], c->arg[0]);
747 break;
748
749 case CMD_READER_LEGIC_RF:
750 LegicRfReader(c->arg[0], c->arg[1]);
751 break;
752 #endif
753
754 #ifdef WITH_ISO14443b
755 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
756 AcquireRawAdcSamplesIso14443(c->arg[0]);
757 break;
758 case CMD_READ_SRI512_TAG:
759 ReadSTMemoryIso14443(0x0F);
760 break;
761 case CMD_READ_SRIX4K_TAG:
762 ReadSTMemoryIso14443(0x7F);
763 break;
764 case CMD_SNOOP_ISO_14443:
765 SnoopIso14443();
766 break;
767 case CMD_SIMULATE_TAG_ISO_14443:
768 SimulateIso14443Tag();
769 break;
770 case CMD_ISO_14443B_COMMAND:
771 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
772 break;
773 #endif
774
775 #ifdef WITH_ISO14443a
776 case CMD_SNOOP_ISO_14443a:
777 SnoopIso14443a(c->arg[0]);
778 break;
779 case CMD_READER_ISO_14443a:
780 ReaderIso14443a(c);
781 break;
782 case CMD_SIMULATE_TAG_ISO_14443a:
783 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
784 break;
785 case CMD_EPA_PACE_COLLECT_NONCE:
786 EPA_PACE_Collect_Nonce(c);
787 break;
788
789 case CMD_READER_MIFARE:
790 ReaderMifare(c->arg[0]);
791 break;
792 case CMD_MIFARE_READBL:
793 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
794 break;
795 case CMD_MIFAREU_READBL:
796 MifareUReadBlock(c->arg[0],c->d.asBytes);
797 break;
798 case CMD_MIFAREU_READCARD:
799 MifareUReadCard(c->arg[0],c->d.asBytes);
800 break;
801 case CMD_MIFARE_READSC:
802 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
803 break;
804 case CMD_MIFARE_WRITEBL:
805 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
806 break;
807 case CMD_MIFAREU_WRITEBL_COMPAT:
808 MifareUWriteBlock(c->arg[0], c->d.asBytes);
809 break;
810 case CMD_MIFAREU_WRITEBL:
811 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
812 break;
813 case CMD_MIFARE_NESTED:
814 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
815 break;
816 case CMD_MIFARE_CHKKEYS:
817 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
818 break;
819 case CMD_SIMULATE_MIFARE_CARD:
820 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
821 break;
822
823 // emulator
824 case CMD_MIFARE_SET_DBGMODE:
825 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
826 break;
827 case CMD_MIFARE_EML_MEMCLR:
828 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
829 break;
830 case CMD_MIFARE_EML_MEMSET:
831 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
832 break;
833 case CMD_MIFARE_EML_MEMGET:
834 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
835 break;
836 case CMD_MIFARE_EML_CARDLOAD:
837 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
838 break;
839
840 // Work with "magic Chinese" card
841 case CMD_MIFARE_EML_CSETBLOCK:
842 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
843 break;
844 case CMD_MIFARE_EML_CGETBLOCK:
845 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
846 break;
847
848 // mifare sniffer
849 case CMD_MIFARE_SNIFFER:
850 SniffMifare(c->arg[0]);
851 break;
852 #endif
853
854 #ifdef WITH_ICLASS
855 // Makes use of ISO14443a FPGA Firmware
856 case CMD_SNOOP_ICLASS:
857 SnoopIClass();
858 break;
859 case CMD_SIMULATE_TAG_ICLASS:
860 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
861 break;
862 case CMD_READER_ICLASS:
863 ReaderIClass(c->arg[0]);
864 break;
865 case CMD_READER_ICLASS_REPLAY:
866 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
867 break;
868 #endif
869
870 case CMD_SIMULATE_TAG_HF_LISTEN:
871 SimulateTagHfListen();
872 break;
873
874 case CMD_BUFF_CLEAR:
875 BufferClear();
876 break;
877
878 case CMD_MEASURE_ANTENNA_TUNING:
879 MeasureAntennaTuning();
880 break;
881
882 case CMD_MEASURE_ANTENNA_TUNING_HF:
883 MeasureAntennaTuningHf();
884 break;
885
886 case CMD_LISTEN_READER_FIELD:
887 ListenReaderField(c->arg[0]);
888 break;
889
890 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
891 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
892 SpinDelay(200);
893 LED_D_OFF(); // LED D indicates field ON or OFF
894 break;
895
896 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
897 // UsbCommand n;
898 // if(c->cmd == CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K) {
899 // n.cmd = CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K;
900 // } else {
901 // n.cmd = CMD_DOWNLOADED_RAW_BITS_TI_TYPE;
902 // }
903 // n.arg[0] = c->arg[0];
904 // memcpy(n.d.asBytes, BigBuf+c->arg[0], 48); // 12*sizeof(uint32_t)
905 // LED_B_ON();
906 // usb_write((uint8_t *)&n, sizeof(n));
907 // UsbSendPacket((uint8_t *)&n, sizeof(n));
908 // LED_B_OFF();
909
910 LED_B_ON();
911 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
912 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
913 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
914 }
915 // Trigger a finish downloading signal with an ACK frame
916 cmd_send(CMD_ACK,0,0,0,0,0);
917 LED_B_OFF();
918 break;
919
920 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
921 uint8_t *b = (uint8_t *)BigBuf;
922 memcpy(b+c->arg[0], c->d.asBytes, 48);
923 //Dbprintf("copied 48 bytes to %i",b+c->arg[0]);
924 // UsbSendPacket((uint8_t*)&ack, sizeof(ack));
925 cmd_send(CMD_ACK,0,0,0,0,0);
926 break;
927 }
928 case CMD_READ_MEM:
929 ReadMem(c->arg[0]);
930 break;
931
932 case CMD_SET_LF_DIVISOR:
933 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
934 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
935 break;
936
937 case CMD_SET_ADC_MUX:
938 switch(c->arg[0]) {
939 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
940 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
941 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
942 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
943 }
944 break;
945
946 case CMD_VERSION:
947 SendVersion();
948 break;
949
950 #ifdef WITH_LCD
951 case CMD_LCD_RESET:
952 LCDReset();
953 break;
954 case CMD_LCD:
955 LCDSend(c->arg[0]);
956 break;
957 #endif
958 case CMD_SETUP_WRITE:
959 case CMD_FINISH_WRITE:
960 case CMD_HARDWARE_RESET:
961 usb_disable();
962 SpinDelay(1000);
963 SpinDelay(1000);
964 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
965 for(;;) {
966 // We're going to reset, and the bootrom will take control.
967 }
968 break;
969
970 case CMD_START_FLASH:
971 if(common_area.flags.bootrom_present) {
972 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
973 }
974 usb_disable();
975 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
976 for(;;);
977 break;
978
979 case CMD_DEVICE_INFO: {
980 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
981 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
982 // UsbSendPacket((uint8_t*)&c, sizeof(c));
983 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
984 break;
985 }
986 default:
987 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
988 break;
989 }
990 }
991
992 void __attribute__((noreturn)) AppMain(void)
993 {
994 SpinDelay(100);
995
996 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
997 /* Initialize common area */
998 memset(&common_area, 0, sizeof(common_area));
999 common_area.magic = COMMON_AREA_MAGIC;
1000 common_area.version = 1;
1001 }
1002 common_area.flags.osimage_present = 1;
1003
1004 LED_D_OFF();
1005 LED_C_OFF();
1006 LED_B_OFF();
1007 LED_A_OFF();
1008
1009 // Init USB device`
1010 usb_enable();
1011 // UsbStart();
1012
1013 // The FPGA gets its clock from us from PCK0 output, so set that up.
1014 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1015 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1016 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1017 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1018 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1019 AT91C_PMC_PRES_CLK_4;
1020 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1021
1022 // Reset SPI
1023 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1024 // Reset SSC
1025 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1026
1027 // Load the FPGA image, which we have stored in our flash.
1028 // (the HF version by default)
1029 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1030
1031 StartTickCount();
1032
1033 #ifdef WITH_LCD
1034 LCDInit();
1035 #endif
1036
1037 byte_t rx[sizeof(UsbCommand)];
1038 size_t rx_len;
1039
1040 for(;;) {
1041 if (usb_poll()) {
1042 rx_len = usb_read(rx,sizeof(UsbCommand));
1043 if (rx_len) {
1044 UsbPacketReceived(rx,rx_len);
1045 }
1046 }
1047 // UsbPoll(FALSE);
1048
1049 WDT_HIT();
1050
1051 #ifdef WITH_LF
1052 if (BUTTON_HELD(1000) > 0)
1053 SamyRun();
1054 #endif
1055 }
1056 }
Proxmark3 GIT tracking
Impressum, Datenschutz