]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Correction to Samyrun offline mode
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "hitag2.h"
25 #include "hitagS.h"
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #include "mifareutil.h"
29 #include "pcf7931.h"
30 #ifdef WITH_LCD
31 #include "LCD.h"
32 #endif
33 #ifdef WITH_SMARTCARD
34 #include "i2c.h"
35 #endif
36
37
38 // Craig Young - 14a stand-alone code
39 #ifdef WITH_ISO14443a
40 #include "iso14443a.h"
41 #endif
42
43 //=============================================================================
44 // A buffer where we can queue things up to be sent through the FPGA, for
45 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
46 // is the order in which they go out on the wire.
47 //=============================================================================
48
49 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
50 uint8_t ToSend[TOSEND_BUFFER_SIZE];
51 int ToSendMax;
52 static int ToSendBit;
53 struct common_area common_area __attribute__((section(".commonarea")));
54
55 void ToSendReset(void)
56 {
57 ToSendMax = -1;
58 ToSendBit = 8;
59 }
60
61 void ToSendStuffBit(int b)
62 {
63 if(ToSendBit >= 8) {
64 ToSendMax++;
65 ToSend[ToSendMax] = 0;
66 ToSendBit = 0;
67 }
68
69 if(b) {
70 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
71 }
72
73 ToSendBit++;
74
75 if(ToSendMax >= sizeof(ToSend)) {
76 ToSendBit = 0;
77 DbpString("ToSendStuffBit overflowed!");
78 }
79 }
80
81 //=============================================================================
82 // Debug print functions, to go out over USB, to the usual PC-side client.
83 //=============================================================================
84
85 void DbpString(char *str)
86 {
87 byte_t len = strlen(str);
88 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
89 }
90
91 #if 0
92 void DbpIntegers(int x1, int x2, int x3)
93 {
94 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
95 }
96 #endif
97
98 void Dbprintf(const char *fmt, ...) {
99 // should probably limit size here; oh well, let's just use a big buffer
100 char output_string[128];
101 va_list ap;
102
103 va_start(ap, fmt);
104 kvsprintf(fmt, output_string, 10, ap);
105 va_end(ap);
106
107 DbpString(output_string);
108 }
109
110 // prints HEX & ASCII
111 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
112 int l=0,i;
113 char ascii[9];
114
115 while (len>0) {
116 if (len>8) l=8;
117 else l=len;
118
119 memcpy(ascii,d,l);
120 ascii[l]=0;
121
122 // filter safe ascii
123 for (i=0;i<l;i++)
124 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
125
126 if (bAsci) {
127 Dbprintf("%-8s %*D",ascii,l,d," ");
128 } else {
129 Dbprintf("%*D",l,d," ");
130 }
131
132 len-=8;
133 d+=8;
134 }
135 }
136
137 //-----------------------------------------------------------------------------
138 // Read an ADC channel and block till it completes, then return the result
139 // in ADC units (0 to 1023). Also a routine to average 32 samples and
140 // return that.
141 //-----------------------------------------------------------------------------
142 static int ReadAdc(int ch)
143 {
144 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
145 // AMPL_HI is are high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
146 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
147 //
148 // The maths are:
149 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
150 //
151 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
152
153 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
154 AT91C_BASE_ADC->ADC_MR =
155 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
156 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
157 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
158
159 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
160 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
161
162 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
163
164 return AT91C_BASE_ADC->ADC_CDR[ch];
165 }
166
167 int AvgAdc(int ch) // was static - merlok
168 {
169 int i;
170 int a = 0;
171
172 for(i = 0; i < 32; i++) {
173 a += ReadAdc(ch);
174 }
175
176 return (a + 15) >> 5;
177 }
178
179 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
180 {
181 int i, adcval = 0, peak = 0;
182
183 /*
184 * Sweeps the useful LF range of the proxmark from
185 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
186 * read the voltage in the antenna, the result left
187 * in the buffer is a graph which should clearly show
188 * the resonating frequency of your LF antenna
189 * ( hopefully around 95 if it is tuned to 125kHz!)
190 */
191
192 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
193 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
194 SpinDelay(50);
195
196 for (i=255; i>=19; i--) {
197 WDT_HIT();
198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
201 if (i==95) *vLf125 = adcval; // voltage at 125Khz
202 if (i==89) *vLf134 = adcval; // voltage at 134Khz
203
204 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
205 if(LF_Results[i] > peak) {
206 *peakv = adcval;
207 peak = LF_Results[i];
208 *peakf = i;
209 //ptr = i;
210 }
211 }
212
213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
214
215 return;
216 }
217
218 void MeasureAntennaTuningHfOnly(int *vHf)
219 {
220 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
221 LED_A_ON();
222 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
223 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
224 SpinDelay(20);
225 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
226 LED_A_OFF();
227
228 return;
229 }
230
231 void MeasureAntennaTuning(int mode)
232 {
233 uint8_t LF_Results[256] = {0};
234 int peakv = 0, peakf = 0;
235 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
236
237 LED_B_ON();
238
239 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
240 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
241 MeasureAntennaTuningHfOnly(&vHf);
242 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
243 } else {
244 if (mode & FLAG_TUNE_LF) {
245 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
246 }
247 if (mode & FLAG_TUNE_HF) {
248 MeasureAntennaTuningHfOnly(&vHf);
249 }
250 }
251
252 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
253 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
254 LED_B_OFF();
255 return;
256 }
257
258 void MeasureAntennaTuningHf(void)
259 {
260 int vHf = 0; // in mV
261
262 DbpString("Measuring HF antenna, press button to exit");
263
264 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
265 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
266 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
267
268 for (;;) {
269 SpinDelay(20);
270 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
271
272 Dbprintf("%d mV",vHf);
273 if (BUTTON_PRESS()) break;
274 }
275 DbpString("cancelled");
276
277 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
278
279 }
280
281
282 void ReadMem(int addr)
283 {
284 const uint8_t *data = ((uint8_t *)addr);
285
286 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
287 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
288 }
289
290 /* osimage version information is linked in */
291 extern struct version_information version_information;
292 /* bootrom version information is pointed to from _bootphase1_version_pointer */
293 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
294
295 void SendVersion(void)
296 {
297 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
298 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
299
300 /* Try to find the bootrom version information. Expect to find a pointer at
301 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
302 * pointer, then use it.
303 */
304 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
305 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
306 strcat(VersionString, "bootrom version information appears invalid\n");
307 } else {
308 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
309 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
310 }
311
312 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
313 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
314
315 for (int i = 0; i < fpga_bitstream_num; i++) {
316 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
317 if (i < fpga_bitstream_num - 1) {
318 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
319 }
320 }
321
322 // Send Chip ID and used flash memory
323 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
324 uint32_t compressed_data_section_size = common_area.arg1;
325 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
326 }
327
328 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
329 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
330 void printUSBSpeed(void)
331 {
332 Dbprintf("USB Speed:");
333 Dbprintf(" Sending USB packets to client...");
334
335 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
336 uint8_t *test_data = BigBuf_get_addr();
337 uint32_t end_time;
338
339 uint32_t start_time = end_time = GetTickCount();
340 uint32_t bytes_transferred = 0;
341
342 LED_B_ON();
343 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
344 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
345 end_time = GetTickCount();
346 bytes_transferred += USB_CMD_DATA_SIZE;
347 }
348 LED_B_OFF();
349
350 Dbprintf(" Time elapsed: %dms", end_time - start_time);
351 Dbprintf(" Bytes transferred: %d", bytes_transferred);
352 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
353 1000 * bytes_transferred / (end_time - start_time));
354
355 }
356
357 /**
358 * Prints runtime information about the PM3.
359 **/
360 void SendStatus(void)
361 {
362 BigBuf_print_status();
363 Fpga_print_status();
364 #ifdef WITH_SMARTCARD
365 I2C_print_status();
366 #endif
367 printConfig(); //LF Sampling config
368 printUSBSpeed();
369 Dbprintf("Various");
370 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
371 Dbprintf(" ToSendMax..........%d", ToSendMax);
372 Dbprintf(" ToSendBit..........%d", ToSendBit);
373
374 cmd_send(CMD_ACK,1,0,0,0,0);
375 }
376
377 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
378
379 #define OPTS 2
380
381 void StandAloneMode()
382 {
383 DbpString("Stand-alone mode! No PC necessary.");
384 // Oooh pretty -- notify user we're in elite samy mode now
385 LED(LED_RED, 200);
386 LED(LED_ORANGE, 200);
387 LED(LED_GREEN, 200);
388 LED(LED_ORANGE, 200);
389 LED(LED_RED, 200);
390 LED(LED_ORANGE, 200);
391 LED(LED_GREEN, 200);
392 LED(LED_ORANGE, 200);
393 LED(LED_RED, 200);
394
395 }
396
397 #endif
398
399
400
401 #ifdef WITH_ISO14443a_StandAlone
402 void StandAloneMode14a()
403 {
404 StandAloneMode();
405 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
406
407 int selected = 0;
408 bool playing = false, GotoRecord = false, GotoClone = false;
409 bool cardRead[OPTS] = {false};
410 uint8_t readUID[10] = {0};
411 uint32_t uid_1st[OPTS]={0};
412 uint32_t uid_2nd[OPTS]={0};
413 uint32_t uid_tmp1 = 0;
414 uint32_t uid_tmp2 = 0;
415 iso14a_card_select_t hi14a_card[OPTS];
416
417 LED(selected + 1, 0);
418
419 for (;;)
420 {
421 usb_poll();
422 WDT_HIT();
423 SpinDelay(300);
424
425 if (GotoRecord || !cardRead[selected])
426 {
427 GotoRecord = false;
428 LEDsoff();
429 LED(selected + 1, 0);
430 LED(LED_RED2, 0);
431
432 // record
433 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
434 /* need this delay to prevent catching some weird data */
435 SpinDelay(500);
436 /* Code for reading from 14a tag */
437 uint8_t uid[10] ={0};
438 uint32_t cuid;
439 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
440
441 for ( ; ; )
442 {
443 WDT_HIT();
444 if (BUTTON_PRESS()) {
445 if (cardRead[selected]) {
446 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
447 break;
448 }
449 else if (cardRead[(selected+1)%OPTS]) {
450 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
451 selected = (selected+1)%OPTS;
452 break;
453 }
454 else {
455 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
456 SpinDelay(300);
457 }
458 }
459 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
460 continue;
461 else
462 {
463 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
464 memcpy(readUID,uid,10*sizeof(uint8_t));
465 uint8_t *dst = (uint8_t *)&uid_tmp1;
466 // Set UID byte order
467 for (int i=0; i<4; i++)
468 dst[i] = uid[3-i];
469 dst = (uint8_t *)&uid_tmp2;
470 for (int i=0; i<4; i++)
471 dst[i] = uid[7-i];
472 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
473 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
474 }
475 else {
476 if (uid_tmp2) {
477 Dbprintf("Bank[%d] received a 7-byte UID",selected);
478 uid_1st[selected] = (uid_tmp1)>>8;
479 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
480 }
481 else {
482 Dbprintf("Bank[%d] received a 4-byte UID",selected);
483 uid_1st[selected] = uid_tmp1;
484 uid_2nd[selected] = uid_tmp2;
485 }
486 break;
487 }
488 }
489 }
490 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
491 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
492 LEDsoff();
493 LED(LED_GREEN, 200);
494 LED(LED_ORANGE, 200);
495 LED(LED_GREEN, 200);
496 LED(LED_ORANGE, 200);
497
498 LEDsoff();
499 LED(selected + 1, 0);
500
501 // Next state is replay:
502 playing = true;
503
504 cardRead[selected] = true;
505 }
506 /* MF Classic UID clone */
507 else if (GotoClone)
508 {
509 GotoClone=false;
510 LEDsoff();
511 LED(selected + 1, 0);
512 LED(LED_ORANGE, 250);
513
514
515 // record
516 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
517
518 // wait for button to be released
519 while(BUTTON_PRESS())
520 {
521 // Delay cloning until card is in place
522 WDT_HIT();
523 }
524 Dbprintf("Starting clone. [Bank: %u]", selected);
525 // need this delay to prevent catching some weird data
526 SpinDelay(500);
527 // Begin clone function here:
528 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
529 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
530 memcpy(c.d.asBytes, data, 16);
531 SendCommand(&c);
532
533 Block read is similar:
534 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
535 We need to imitate that call with blockNo 0 to set a uid.
536
537 The get and set commands are handled in this file:
538 // Work with "magic Chinese" card
539 case CMD_MIFARE_CSETBLOCK:
540 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
541 break;
542 case CMD_MIFARE_CGETBLOCK:
543 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
544 break;
545
546 mfCSetUID provides example logic for UID set workflow:
547 -Read block0 from card in field with MifareCGetBlock()
548 -Configure new values without replacing reserved bytes
549 memcpy(block0, uid, 4); // Copy UID bytes from byte array
550 // Mifare UID BCC
551 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
552 Bytes 5-7 are reserved SAK and ATQA for mifare classic
553 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
554 */
555 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
556 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
557 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
558 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
559 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
560 playing = true;
561 }
562 else {
563 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
564 memcpy(newBlock0,oldBlock0,16);
565 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
566
567 newBlock0[0] = uid_1st[selected]>>24;
568 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
569 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
570 newBlock0[3] = 0xFF & (uid_1st[selected]);
571 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
572 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
573 MifareCSetBlock(0, 0xFF,0, newBlock0);
574 MifareCGetBlock(0x3F, 1, 0, testBlock0);
575 if (memcmp(testBlock0,newBlock0,16)==0)
576 {
577 DbpString("Cloned successfull!");
578 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
579 playing = false;
580 GotoRecord = true;
581 selected = (selected+1) % OPTS;
582 }
583 else {
584 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
585 playing = true;
586 }
587 }
588 LEDsoff();
589 LED(selected + 1, 0);
590
591 }
592 // Change where to record (or begin playing)
593 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
594 {
595 LEDsoff();
596 LED(selected + 1, 0);
597
598 // Begin transmitting
599 LED(LED_GREEN, 0);
600 DbpString("Playing");
601 for ( ; ; ) {
602 WDT_HIT();
603 int button_action = BUTTON_HELD(1000);
604 if (button_action == 0) { // No button action, proceed with sim
605 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
606 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
607 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
608 DbpString("Mifare Classic");
609 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
610 }
611 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
612 DbpString("Mifare Ultralight");
613 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
614 }
615 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
616 DbpString("Mifare DESFire");
617 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
618 }
619 else {
620 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
621 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
622 }
623 }
624 else if (button_action == BUTTON_SINGLE_CLICK) {
625 selected = (selected + 1) % OPTS;
626 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
627 GotoRecord = true;
628 break;
629 }
630 else if (button_action == BUTTON_HOLD) {
631 Dbprintf("Playtime over. Begin cloning...");
632 GotoClone = true;
633 break;
634 }
635 WDT_HIT();
636 }
637
638 /* We pressed a button so ignore it here with a delay */
639 SpinDelay(300);
640 LEDsoff();
641 LED(selected + 1, 0);
642 }
643 }
644 }
645 #elif WITH_LF_StandAlone
646 // samy's sniff and repeat routine
647 void SamyRun()
648 {
649 StandAloneMode();
650 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
651
652 int tops[OPTS], high[OPTS], low[OPTS];
653 int selected = 0;
654 int playing = 0;
655 int cardRead = 0;
656
657 // Turn on selected LED
658 LED(selected + 1, 0);
659
660 for (;;)
661 {
662 usb_poll();
663 WDT_HIT();
664
665 // Was our button held down or pressed?
666 int button_pressed = BUTTON_HELD(1000);
667 SpinDelay(300);
668
669 // Button was held for a second, begin recording
670 if (button_pressed > 0 && cardRead == 0)
671 {
672 LEDsoff();
673 LED(selected + 1, 0);
674 LED(LED_RED2, 0);
675
676 // record
677 DbpString("Starting recording");
678
679 // wait for button to be released
680 while(BUTTON_PRESS())
681 WDT_HIT();
682
683 /* need this delay to prevent catching some weird data */
684 SpinDelay(500);
685
686 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
687 if (tops[selected] > 0)
688 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
689 else
690 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
691
692 LEDsoff();
693 LED(selected + 1, 0);
694 // Finished recording
695
696 // If we were previously playing, set playing off
697 // so next button push begins playing what we recorded
698 playing = 0;
699
700 cardRead = 1;
701
702 }
703
704 else if (button_pressed > 0 && cardRead == 1)
705 {
706 LEDsoff();
707 LED(selected + 1, 0);
708 LED(LED_ORANGE, 0);
709
710 // record
711 if (tops[selected] > 0)
712 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
713 else
714 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
715
716 // wait for button to be released
717 while(BUTTON_PRESS())
718 WDT_HIT();
719
720 /* need this delay to prevent catching some weird data */
721 SpinDelay(500);
722
723 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)));
724 if (tops[selected] > 0)
725 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
726 else
727 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
728
729 LEDsoff();
730 LED(selected + 1, 0);
731 // Finished recording
732
733 // If we were previously playing, set playing off
734 // so next button push begins playing what we recorded
735 playing = 0;
736
737 cardRead = 0;
738
739 }
740
741 // Change where to record (or begin playing)
742 else if (button_pressed)
743 {
744 // Next option if we were previously playing
745 if (playing)
746 selected = (selected + 1) % OPTS;
747 playing = !playing;
748
749 LEDsoff();
750 LED(selected + 1, 0);
751
752 // Begin transmitting
753 if (playing)
754 {
755 LED(LED_GREEN, 0);
756 DbpString("Playing");
757 // wait for button to be released
758 while(BUTTON_PRESS())
759 WDT_HIT();
760 if (tops[selected] > 0)
761 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
762 else
763 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
764
765 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
766 DbpString("Done playing");
767 if (BUTTON_HELD(1000) > 0)
768 {
769 DbpString("Exiting");
770 LEDsoff();
771 return;
772 }
773
774 /* We pressed a button so ignore it here with a delay */
775 SpinDelay(300);
776
777 // when done, we're done playing, move to next option
778 selected = (selected + 1) % OPTS;
779 playing = !playing;
780 LEDsoff();
781 LED(selected + 1, 0);
782 }
783 else
784 while(BUTTON_PRESS())
785 WDT_HIT();
786 }
787 }
788 }
789
790 #endif
791 /*
792 OBJECTIVE
793 Listen and detect an external reader. Determine the best location
794 for the antenna.
795
796 INSTRUCTIONS:
797 Inside the ListenReaderField() function, there is two mode.
798 By default, when you call the function, you will enter mode 1.
799 If you press the PM3 button one time, you will enter mode 2.
800 If you press the PM3 button a second time, you will exit the function.
801
802 DESCRIPTION OF MODE 1:
803 This mode just listens for an external reader field and lights up green
804 for HF and/or red for LF. This is the original mode of the detectreader
805 function.
806
807 DESCRIPTION OF MODE 2:
808 This mode will visually represent, using the LEDs, the actual strength of the
809 current compared to the maximum current detected. Basically, once you know
810 what kind of external reader is present, it will help you spot the best location to place
811 your antenna. You will probably not get some good results if there is a LF and a HF reader
812 at the same place! :-)
813
814 LIGHT SCHEME USED:
815 */
816 static const char LIGHT_SCHEME[] = {
817 0x0, /* ---- | No field detected */
818 0x1, /* X--- | 14% of maximum current detected */
819 0x2, /* -X-- | 29% of maximum current detected */
820 0x4, /* --X- | 43% of maximum current detected */
821 0x8, /* ---X | 57% of maximum current detected */
822 0xC, /* --XX | 71% of maximum current detected */
823 0xE, /* -XXX | 86% of maximum current detected */
824 0xF, /* XXXX | 100% of maximum current detected */
825 };
826 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
827
828 void ListenReaderField(int limit)
829 {
830 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
831 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
832 int mode=1, display_val, display_max, i;
833
834 #define LF_ONLY 1
835 #define HF_ONLY 2
836 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
837
838
839 // switch off FPGA - we don't want to measure our own signal
840 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
841 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
842
843 LEDsoff();
844
845 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
846
847 if(limit != HF_ONLY) {
848 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
849 lf_baseline = lf_av;
850 }
851
852 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
853
854 if (limit != LF_ONLY) {
855 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
856 hf_baseline = hf_av;
857 }
858
859 for(;;) {
860 if (BUTTON_PRESS()) {
861 SpinDelay(500);
862 switch (mode) {
863 case 1:
864 mode=2;
865 DbpString("Signal Strength Mode");
866 break;
867 case 2:
868 default:
869 DbpString("Stopped");
870 LEDsoff();
871 return;
872 break;
873 }
874 }
875 WDT_HIT();
876
877 if (limit != HF_ONLY) {
878 if(mode == 1) {
879 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
880 LED_D_ON();
881 else
882 LED_D_OFF();
883 }
884
885 lf_av_new = AvgAdc(ADC_CHAN_LF);
886 // see if there's a significant change
887 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
888 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
889 lf_av = lf_av_new;
890 if (lf_av > lf_max)
891 lf_max = lf_av;
892 }
893 }
894
895 if (limit != LF_ONLY) {
896 if (mode == 1){
897 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
898 LED_B_ON();
899 else
900 LED_B_OFF();
901 }
902
903 hf_av_new = AvgAdc(ADC_CHAN_HF);
904 // see if there's a significant change
905 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
906 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
907 hf_av = hf_av_new;
908 if (hf_av > hf_max)
909 hf_max = hf_av;
910 }
911 }
912
913 if(mode == 2) {
914 if (limit == LF_ONLY) {
915 display_val = lf_av;
916 display_max = lf_max;
917 } else if (limit == HF_ONLY) {
918 display_val = hf_av;
919 display_max = hf_max;
920 } else { /* Pick one at random */
921 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
922 display_val = hf_av;
923 display_max = hf_max;
924 } else {
925 display_val = lf_av;
926 display_max = lf_max;
927 }
928 }
929 for (i=0; i<LIGHT_LEN; i++) {
930 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
931 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
932 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
933 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
934 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
935 break;
936 }
937 }
938 }
939 }
940 }
941
942 void UsbPacketReceived(uint8_t *packet, int len)
943 {
944 UsbCommand *c = (UsbCommand *)packet;
945
946 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
947
948 switch(c->cmd) {
949 #ifdef WITH_LF
950 case CMD_SET_LF_SAMPLING_CONFIG:
951 setSamplingConfig((sample_config *) c->d.asBytes);
952 break;
953 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
954 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
955 break;
956 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
957 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
958 break;
959 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
960 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
961 break;
962 case CMD_HID_DEMOD_FSK:
963 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
964 break;
965 case CMD_HID_SIM_TAG:
966 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
967 break;
968 case CMD_FSK_SIM_TAG:
969 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
970 break;
971 case CMD_ASK_SIM_TAG:
972 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
973 break;
974 case CMD_PSK_SIM_TAG:
975 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
976 break;
977 case CMD_HID_CLONE_TAG:
978 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
979 break;
980 case CMD_IO_DEMOD_FSK:
981 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
982 break;
983 case CMD_IO_CLONE_TAG:
984 CopyIOtoT55x7(c->arg[0], c->arg[1]);
985 break;
986 case CMD_EM410X_DEMOD:
987 CmdEM410xdemod(c->arg[0], 0, 0, 1);
988 break;
989 case CMD_EM410X_WRITE_TAG:
990 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
991 break;
992 case CMD_READ_TI_TYPE:
993 ReadTItag();
994 break;
995 case CMD_WRITE_TI_TYPE:
996 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
997 break;
998 case CMD_SIMULATE_TAG_125K:
999 LED_A_ON();
1000 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
1001 LED_A_OFF();
1002 break;
1003 case CMD_LF_SIMULATE_BIDIR:
1004 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1005 break;
1006 case CMD_INDALA_CLONE_TAG:
1007 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1008 break;
1009 case CMD_INDALA_CLONE_TAG_L:
1010 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1011 break;
1012 case CMD_T55XX_READ_BLOCK:
1013 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1014 break;
1015 case CMD_T55XX_WRITE_BLOCK:
1016 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1017 break;
1018 case CMD_T55XX_WAKEUP:
1019 T55xxWakeUp(c->arg[0]);
1020 break;
1021 case CMD_T55XX_RESET_READ:
1022 T55xxResetRead();
1023 break;
1024 case CMD_PCF7931_READ:
1025 ReadPCF7931();
1026 break;
1027 case CMD_PCF7931_WRITE:
1028 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1029 break;
1030 case CMD_EM4X_READ_WORD:
1031 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1032 break;
1033 case CMD_EM4X_WRITE_WORD:
1034 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1035 break;
1036 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1037 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1038 break;
1039 case CMD_VIKING_CLONE_TAG:
1040 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1041 break;
1042 case CMD_COTAG:
1043 Cotag(c->arg[0]);
1044 break;
1045 #endif
1046
1047 #ifdef WITH_HITAG
1048 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1049 SnoopHitag(c->arg[0]);
1050 break;
1051 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1052 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1053 break;
1054 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1055 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1056 break;
1057 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1058 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1059 break;
1060 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1061 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1062 break;
1063 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1064 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1065 break;
1066 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1067 if ((hitag_function)c->arg[0] < 10) {
1068 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1069 }
1070 else if ((hitag_function)c->arg[0] >= 10) {
1071 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1072 }
1073 break;
1074 #endif
1075
1076 #ifdef WITH_ISO15693
1077 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1078 AcquireRawAdcSamplesIso15693();
1079 break;
1080 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1081 RecordRawAdcSamplesIso15693();
1082 break;
1083
1084 case CMD_ISO_15693_COMMAND:
1085 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1086 break;
1087
1088 case CMD_ISO_15693_FIND_AFI:
1089 BruteforceIso15693Afi(c->arg[0]);
1090 break;
1091
1092 case CMD_ISO_15693_DEBUG:
1093 SetDebugIso15693(c->arg[0]);
1094 break;
1095
1096 case CMD_READER_ISO_15693:
1097 ReaderIso15693(c->arg[0]);
1098 break;
1099 case CMD_SIMTAG_ISO_15693:
1100 SimTagIso15693(c->arg[0], c->d.asBytes);
1101 break;
1102 #endif
1103
1104 #ifdef WITH_LEGICRF
1105 case CMD_SIMULATE_TAG_LEGIC_RF:
1106 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1107 break;
1108
1109 case CMD_WRITER_LEGIC_RF:
1110 LegicRfWriter(c->arg[1], c->arg[0]);
1111 break;
1112
1113 case CMD_READER_LEGIC_RF:
1114 LegicRfReader(c->arg[0], c->arg[1]);
1115 break;
1116 #endif
1117
1118 #ifdef WITH_ISO14443b
1119 case CMD_READ_SRI512_TAG:
1120 ReadSTMemoryIso14443b(0x0F);
1121 break;
1122 case CMD_READ_SRIX4K_TAG:
1123 ReadSTMemoryIso14443b(0x7F);
1124 break;
1125 case CMD_SNOOP_ISO_14443B:
1126 SnoopIso14443b();
1127 break;
1128 case CMD_SIMULATE_TAG_ISO_14443B:
1129 SimulateIso14443bTag();
1130 break;
1131 case CMD_ISO_14443B_COMMAND:
1132 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1133 break;
1134 #endif
1135
1136 #ifdef WITH_ISO14443a
1137 case CMD_SNOOP_ISO_14443a:
1138 SnoopIso14443a(c->arg[0]);
1139 break;
1140 case CMD_READER_ISO_14443a:
1141 ReaderIso14443a(c);
1142 break;
1143 case CMD_SIMULATE_TAG_ISO_14443a:
1144 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1145 break;
1146
1147 case CMD_EPA_PACE_COLLECT_NONCE:
1148 EPA_PACE_Collect_Nonce(c);
1149 break;
1150 case CMD_EPA_PACE_REPLAY:
1151 EPA_PACE_Replay(c);
1152 break;
1153
1154 case CMD_READER_MIFARE:
1155 ReaderMifare(c->arg[0]);
1156 break;
1157 case CMD_MIFARE_READBL:
1158 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1159 break;
1160 case CMD_MIFAREU_READBL:
1161 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1162 break;
1163 case CMD_MIFAREUC_AUTH:
1164 MifareUC_Auth(c->arg[0],c->d.asBytes);
1165 break;
1166 case CMD_MIFAREU_READCARD:
1167 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1168 break;
1169 case CMD_MIFAREUC_SETPWD:
1170 MifareUSetPwd(c->arg[0], c->d.asBytes);
1171 break;
1172 case CMD_MIFARE_READSC:
1173 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1174 break;
1175 case CMD_MIFARE_WRITEBL:
1176 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1177 break;
1178 //case CMD_MIFAREU_WRITEBL_COMPAT:
1179 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1180 //break;
1181 case CMD_MIFAREU_WRITEBL:
1182 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1183 break;
1184 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1185 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1186 break;
1187 case CMD_MIFARE_NESTED:
1188 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1189 break;
1190 case CMD_MIFARE_CHKKEYS:
1191 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1192 break;
1193 case CMD_SIMULATE_MIFARE_CARD:
1194 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1195 break;
1196
1197 // emulator
1198 case CMD_MIFARE_SET_DBGMODE:
1199 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1200 break;
1201 case CMD_MIFARE_EML_MEMCLR:
1202 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1203 break;
1204 case CMD_MIFARE_EML_MEMSET:
1205 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1206 break;
1207 case CMD_MIFARE_EML_MEMGET:
1208 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1209 break;
1210 case CMD_MIFARE_EML_CARDLOAD:
1211 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1212 break;
1213
1214 // Work with "magic Chinese" card
1215 case CMD_MIFARE_CWIPE:
1216 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1217 break;
1218 case CMD_MIFARE_CSETBLOCK:
1219 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1220 break;
1221 case CMD_MIFARE_CGETBLOCK:
1222 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1223 break;
1224 case CMD_MIFARE_CIDENT:
1225 MifareCIdent();
1226 break;
1227
1228 // mifare sniffer
1229 case CMD_MIFARE_SNIFFER:
1230 SniffMifare(c->arg[0]);
1231 break;
1232
1233 #endif
1234
1235 #ifdef WITH_ICLASS
1236 // Makes use of ISO14443a FPGA Firmware
1237 case CMD_SNOOP_ICLASS:
1238 SnoopIClass();
1239 break;
1240 case CMD_SIMULATE_TAG_ICLASS:
1241 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1242 break;
1243 case CMD_READER_ICLASS:
1244 ReaderIClass(c->arg[0]);
1245 break;
1246 case CMD_READER_ICLASS_REPLAY:
1247 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1248 break;
1249 case CMD_ICLASS_EML_MEMSET:
1250 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1251 break;
1252 case CMD_ICLASS_WRITEBLOCK:
1253 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1254 break;
1255 case CMD_ICLASS_READCHECK: // auth step 1
1256 iClass_ReadCheck(c->arg[0], c->arg[1]);
1257 break;
1258 case CMD_ICLASS_READBLOCK:
1259 iClass_ReadBlk(c->arg[0]);
1260 break;
1261 case CMD_ICLASS_AUTHENTICATION: //check
1262 iClass_Authentication(c->d.asBytes);
1263 break;
1264 case CMD_ICLASS_DUMP:
1265 iClass_Dump(c->arg[0], c->arg[1]);
1266 break;
1267 case CMD_ICLASS_CLONE:
1268 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1269 break;
1270 #endif
1271 #ifdef WITH_HFSNOOP
1272 case CMD_HF_SNIFFER:
1273 HfSnoop(c->arg[0], c->arg[1]);
1274 break;
1275 #endif
1276 #ifdef WITH_SMARTCARD
1277 case CMD_SMART_ATR: {
1278 SmartCardAtr();
1279 break;
1280 }
1281 case CMD_SMART_SETCLOCK:{
1282 SmartCardSetClock(c->arg[0]);
1283 break;
1284 }
1285 case CMD_SMART_RAW: {
1286 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1287 break;
1288 }
1289 case CMD_SMART_UPLOAD: {
1290 // upload file from client
1291 uint8_t *mem = BigBuf_get_addr();
1292 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1293 cmd_send(CMD_ACK,1,0,0,0,0);
1294 break;
1295 }
1296 case CMD_SMART_UPGRADE: {
1297 SmartCardUpgrade(c->arg[0]);
1298 break;
1299 }
1300 #endif
1301
1302 case CMD_BUFF_CLEAR:
1303 BigBuf_Clear();
1304 break;
1305
1306 case CMD_MEASURE_ANTENNA_TUNING:
1307 MeasureAntennaTuning(c->arg[0]);
1308 break;
1309
1310 case CMD_MEASURE_ANTENNA_TUNING_HF:
1311 MeasureAntennaTuningHf();
1312 break;
1313
1314 case CMD_LISTEN_READER_FIELD:
1315 ListenReaderField(c->arg[0]);
1316 break;
1317
1318 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1319 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1320 SpinDelay(200);
1321 LED_D_OFF(); // LED D indicates field ON or OFF
1322 break;
1323
1324 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1325
1326 LED_B_ON();
1327 uint8_t *BigBuf = BigBuf_get_addr();
1328 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1329 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1330 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1331 }
1332 // Trigger a finish downloading signal with an ACK frame
1333 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1334 LED_B_OFF();
1335 break;
1336
1337 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1338 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1339 // to be able to use this one for uploading data to device
1340 // arg1 = 0 upload for LF usage
1341 // 1 upload for HF usage
1342 if (c->arg[1] == 0)
1343 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1344 else
1345 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1346
1347 uint8_t *b = BigBuf_get_addr();
1348 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1349 cmd_send(CMD_ACK,0,0,0,0,0);
1350 break;
1351 }
1352 case CMD_READ_MEM:
1353 ReadMem(c->arg[0]);
1354 break;
1355
1356 case CMD_SET_LF_DIVISOR:
1357 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1358 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1359 break;
1360
1361 case CMD_SET_ADC_MUX:
1362 switch(c->arg[0]) {
1363 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1364 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1365 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1366 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1367 }
1368 break;
1369
1370 case CMD_VERSION:
1371 SendVersion();
1372 break;
1373 case CMD_STATUS:
1374 SendStatus();
1375 break;
1376 case CMD_PING:
1377 cmd_send(CMD_ACK,0,0,0,0,0);
1378 break;
1379 #ifdef WITH_LCD
1380 case CMD_LCD_RESET:
1381 LCDReset();
1382 break;
1383 case CMD_LCD:
1384 LCDSend(c->arg[0]);
1385 break;
1386 #endif
1387 case CMD_SETUP_WRITE:
1388 case CMD_FINISH_WRITE:
1389 case CMD_HARDWARE_RESET:
1390 usb_disable();
1391 SpinDelay(1000);
1392 SpinDelay(1000);
1393 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1394 for(;;) {
1395 // We're going to reset, and the bootrom will take control.
1396 }
1397 break;
1398
1399 case CMD_START_FLASH:
1400 if(common_area.flags.bootrom_present) {
1401 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1402 }
1403 usb_disable();
1404 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1405 for(;;);
1406 break;
1407
1408 case CMD_DEVICE_INFO: {
1409 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1410 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1411 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1412 break;
1413 }
1414 default:
1415 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1416 break;
1417 }
1418 }
1419
1420 void __attribute__((noreturn)) AppMain(void)
1421 {
1422 SpinDelay(100);
1423 clear_trace();
1424 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1425 /* Initialize common area */
1426 memset(&common_area, 0, sizeof(common_area));
1427 common_area.magic = COMMON_AREA_MAGIC;
1428 common_area.version = 1;
1429 }
1430 common_area.flags.osimage_present = 1;
1431
1432 LED_D_OFF();
1433 LED_C_OFF();
1434 LED_B_OFF();
1435 LED_A_OFF();
1436
1437 // Init USB device
1438 usb_enable();
1439
1440 // The FPGA gets its clock from us from PCK0 output, so set that up.
1441 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1442 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1443 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1444 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1445 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1446 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1447 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1448
1449 // Reset SPI
1450 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1451 // Reset SSC
1452 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1453
1454 // Load the FPGA image, which we have stored in our flash.
1455 // (the HF version by default)
1456 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1457
1458 StartTickCount();
1459
1460 #ifdef WITH_LCD
1461 LCDInit();
1462 #endif
1463
1464 byte_t rx[sizeof(UsbCommand)];
1465 size_t rx_len;
1466
1467 for(;;) {
1468 if (usb_poll()) {
1469 rx_len = usb_read(rx,sizeof(UsbCommand));
1470 if (rx_len) {
1471 UsbPacketReceived(rx,rx_len);
1472 }
1473 }
1474 WDT_HIT();
1475
1476 #ifdef WITH_LF_StandAlone
1477 #ifndef WITH_ISO14443a_StandAlone
1478 if (BUTTON_HELD(1000) > 0)
1479 SamyRun();
1480 #endif
1481 #endif
1482 #ifdef WITH_ISO14443a
1483 #ifdef WITH_ISO14443a_StandAlone
1484 if (BUTTON_HELD(1000) > 0)
1485 StandAloneMode14a();
1486 #endif
1487 #endif
1488 }
1489 }
Proxmark3 GIT tracking
Impressum, Datenschutz