1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
11 //-----------------------------------------------------------------------------
16 #include "proxmark3.h"
26 #include "lfsampling.h"
32 // Craig Young - 14a stand-alone code
33 #ifdef WITH_ISO14443a_StandAlone
34 #include "iso14443a.h"
37 #define abs(x) ( ((x)<0) ? -(x) : (x) )
39 //=============================================================================
40 // A buffer where we can queue things up to be sent through the FPGA, for
41 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
42 // is the order in which they go out on the wire.
43 //=============================================================================
45 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
46 uint8_t ToSend
[TOSEND_BUFFER_SIZE
];
49 struct common_area common_area
__attribute__((section(".commonarea")));
51 void ToSendReset(void)
57 void ToSendStuffBit(int b
)
61 ToSend
[ToSendMax
] = 0;
66 ToSend
[ToSendMax
] |= (1 << (7 - ToSendBit
));
71 if(ToSendMax
>= sizeof(ToSend
)) {
73 DbpString("ToSendStuffBit overflowed!");
77 //=============================================================================
78 // Debug print functions, to go out over USB, to the usual PC-side client.
79 //=============================================================================
81 void DbpString(char *str
)
83 byte_t len
= strlen(str
);
84 cmd_send(CMD_DEBUG_PRINT_STRING
,len
,0,0,(byte_t
*)str
,len
);
88 void DbpIntegers(int x1
, int x2
, int x3
)
90 cmd_send(CMD_DEBUG_PRINT_INTEGERS
,x1
,x2
,x3
,0,0);
94 void Dbprintf(const char *fmt
, ...) {
95 // should probably limit size here; oh well, let's just use a big buffer
96 char output_string
[128];
100 kvsprintf(fmt
, output_string
, 10, ap
);
103 DbpString(output_string
);
106 // prints HEX & ASCII
107 void Dbhexdump(int len
, uint8_t *d
, bool bAsci
) {
120 if (ascii
[i
]<32 || ascii
[i
]>126) ascii
[i
]='.';
123 Dbprintf("%-8s %*D",ascii
,l
,d
," ");
125 Dbprintf("%*D",l
,d
," ");
133 //-----------------------------------------------------------------------------
134 // Read an ADC channel and block till it completes, then return the result
135 // in ADC units (0 to 1023). Also a routine to average 32 samples and
137 //-----------------------------------------------------------------------------
138 static int ReadAdc(int ch
)
142 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_SWRST
;
143 AT91C_BASE_ADC
->ADC_MR
=
144 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
145 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
146 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
148 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
149 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
150 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
153 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
155 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
157 // Note: with the "historic" values in the comments above, the error was 34% !!!
159 AT91C_BASE_ADC
->ADC_CHER
= ADC_CHANNEL(ch
);
161 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
;
163 while(!(AT91C_BASE_ADC
->ADC_SR
& ADC_END_OF_CONVERSION(ch
)))
165 d
= AT91C_BASE_ADC
->ADC_CDR
[ch
];
170 int AvgAdc(int ch
) // was static - merlok
175 for(i
= 0; i
< 32; i
++) {
179 return (a
+ 15) >> 5;
182 void MeasureAntennaTuning(void)
184 uint8_t LF_Results
[256];
185 int i
, adcval
= 0, peak
= 0, peakv
= 0, peakf
= 0; //ptr = 0
186 int vLf125
= 0, vLf134
= 0, vHf
= 0; // in mV
191 * Sweeps the useful LF range of the proxmark from
192 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
193 * read the voltage in the antenna, the result left
194 * in the buffer is a graph which should clearly show
195 * the resonating frequency of your LF antenna
196 * ( hopefully around 95 if it is tuned to 125kHz!)
199 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
200 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC
| FPGA_LF_ADC_READER_FIELD
);
201 for (i
=255; i
>=19; i
--) {
203 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, i
);
205 adcval
= ((MAX_ADC_LF_VOLTAGE
* AvgAdc(ADC_CHAN_LF
)) >> 10);
206 if (i
==95) vLf125
= adcval
; // voltage at 125Khz
207 if (i
==89) vLf134
= adcval
; // voltage at 134Khz
209 LF_Results
[i
] = adcval
>>8; // scale int to fit in byte for graphing purposes
210 if(LF_Results
[i
] > peak
) {
212 peak
= LF_Results
[i
];
218 for (i
=18; i
>= 0; i
--) LF_Results
[i
] = 0;
221 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
222 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
223 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
225 vHf
= (MAX_ADC_HF_VOLTAGE
* AvgAdc(ADC_CHAN_HF
)) >> 10;
227 cmd_send(CMD_MEASURED_ANTENNA_TUNING
, vLf125
| (vLf134
<<16), vHf
, peakf
| (peakv
<<16), LF_Results
, 256);
228 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
234 void MeasureAntennaTuningHf(void)
236 int vHf
= 0; // in mV
238 DbpString("Measuring HF antenna, press button to exit");
240 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
241 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
242 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
246 vHf
= (MAX_ADC_HF_VOLTAGE
* AvgAdc(ADC_CHAN_HF
)) >> 10;
248 Dbprintf("%d mV",vHf
);
249 if (BUTTON_PRESS()) break;
251 DbpString("cancelled");
253 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
258 void ReadMem(int addr
)
260 const uint8_t *data
= ((uint8_t *)addr
);
262 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
263 addr
, data
[0], data
[1], data
[2], data
[3], data
[4], data
[5], data
[6], data
[7]);
266 /* osimage version information is linked in */
267 extern struct version_information version_information
;
268 /* bootrom version information is pointed to from _bootphase1_version_pointer */
269 extern char *_bootphase1_version_pointer
, _flash_start
, _flash_end
, _bootrom_start
, _bootrom_end
, __data_src_start__
;
270 void SendVersion(void)
272 char temp
[USB_CMD_DATA_SIZE
]; /* Limited data payload in USB packets */
273 char VersionString
[USB_CMD_DATA_SIZE
] = { '\0' };
275 /* Try to find the bootrom version information. Expect to find a pointer at
276 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
277 * pointer, then use it.
279 char *bootrom_version
= *(char**)&_bootphase1_version_pointer
;
280 if( bootrom_version
< &_flash_start
|| bootrom_version
>= &_flash_end
) {
281 strcat(VersionString
, "bootrom version information appears invalid\n");
283 FormatVersionInformation(temp
, sizeof(temp
), "bootrom: ", bootrom_version
);
284 strncat(VersionString
, temp
, sizeof(VersionString
) - strlen(VersionString
) - 1);
287 FormatVersionInformation(temp
, sizeof(temp
), "os: ", &version_information
);
288 strncat(VersionString
, temp
, sizeof(VersionString
) - strlen(VersionString
) - 1);
290 FpgaGatherVersion(FPGA_BITSTREAM_LF
, temp
, sizeof(temp
));
291 strncat(VersionString
, temp
, sizeof(VersionString
) - strlen(VersionString
) - 1);
292 FpgaGatherVersion(FPGA_BITSTREAM_HF
, temp
, sizeof(temp
));
293 strncat(VersionString
, temp
, sizeof(VersionString
) - strlen(VersionString
) - 1);
295 // Send Chip ID and used flash memory
296 uint32_t text_and_rodata_section_size
= (uint32_t)&__data_src_start__
- (uint32_t)&_flash_start
;
297 uint32_t compressed_data_section_size
= common_area
.arg1
;
298 cmd_send(CMD_ACK
, *(AT91C_DBGU_CIDR
), text_and_rodata_section_size
+ compressed_data_section_size
, 0, VersionString
, strlen(VersionString
));
302 #ifndef WITH_ISO14443a_StandAlone
303 // samy's sniff and repeat routine
306 DbpString("Stand-alone mode! No PC necessary.");
307 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
309 // 3 possible options? no just 2 for now
312 int high
[OPTS
], low
[OPTS
];
314 // Oooh pretty -- notify user we're in elite samy mode now
316 LED(LED_ORANGE
, 200);
318 LED(LED_ORANGE
, 200);
320 LED(LED_ORANGE
, 200);
322 LED(LED_ORANGE
, 200);
329 // Turn on selected LED
330 LED(selected
+ 1, 0);
337 // Was our button held down or pressed?
338 int button_pressed
= BUTTON_HELD(1000);
341 // Button was held for a second, begin recording
342 if (button_pressed
> 0 && cardRead
== 0)
345 LED(selected
+ 1, 0);
349 DbpString("Starting recording");
351 // wait for button to be released
352 while(BUTTON_PRESS())
355 /* need this delay to prevent catching some weird data */
358 CmdHIDdemodFSK(1, &high
[selected
], &low
[selected
], 0);
359 Dbprintf("Recorded %x %x %x", selected
, high
[selected
], low
[selected
]);
362 LED(selected
+ 1, 0);
363 // Finished recording
365 // If we were previously playing, set playing off
366 // so next button push begins playing what we recorded
373 else if (button_pressed
> 0 && cardRead
== 1)
376 LED(selected
+ 1, 0);
380 Dbprintf("Cloning %x %x %x", selected
, high
[selected
], low
[selected
]);
382 // wait for button to be released
383 while(BUTTON_PRESS())
386 /* need this delay to prevent catching some weird data */
389 CopyHIDtoT55x7(high
[selected
], low
[selected
], 0, 0);
390 Dbprintf("Cloned %x %x %x", selected
, high
[selected
], low
[selected
]);
393 LED(selected
+ 1, 0);
394 // Finished recording
396 // If we were previously playing, set playing off
397 // so next button push begins playing what we recorded
404 // Change where to record (or begin playing)
405 else if (button_pressed
)
407 // Next option if we were previously playing
409 selected
= (selected
+ 1) % OPTS
;
413 LED(selected
+ 1, 0);
415 // Begin transmitting
419 DbpString("Playing");
420 // wait for button to be released
421 while(BUTTON_PRESS())
423 Dbprintf("%x %x %x", selected
, high
[selected
], low
[selected
]);
424 CmdHIDsimTAG(high
[selected
], low
[selected
], 0);
425 DbpString("Done playing");
426 if (BUTTON_HELD(1000) > 0)
428 DbpString("Exiting");
433 /* We pressed a button so ignore it here with a delay */
436 // when done, we're done playing, move to next option
437 selected
= (selected
+ 1) % OPTS
;
440 LED(selected
+ 1, 0);
443 while(BUTTON_PRESS())
450 #ifdef WITH_ISO14443a
451 #ifdef WITH_ISO14443a_StandAlone
452 void StandAloneMode14a()
454 DbpString("Stand-alone mode! No PC necessary.");
455 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
457 // 3 possible options? no just 1 for now
460 // Oooh pretty -- notify user we're in elite samy mode now
462 LED(LED_ORANGE
, 200);
464 LED(LED_ORANGE
, 200);
466 LED(LED_ORANGE
, 200);
468 LED(LED_ORANGE
, 200);
473 int cardRead
[OPTS
] = {0};
474 uint8_t readUID
[10] = {0};
475 int uid_1st
[OPTS
]={0};
476 int uid_2nd
[OPTS
]={0};
478 LED(selected
+ 1, 0);
485 // Was our button held down or pressed?
486 int button_pressed
= BUTTON_HELD(1000);
490 // Button was held for a second, begin recording
491 if (button_pressed
> 0 && cardRead
[selected
] == 0)
494 LED(selected
+ 1, 0);
498 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected
);
500 // wait for button to be released
501 while(BUTTON_PRESS())
503 /* need this delay to prevent catching some weird data */
505 /* Code for reading from 14a tag */
506 uint8_t uid
[10] ={0};
508 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD
);
512 if (!iso14443a_select_card(uid
, NULL
, &cuid
))
516 Dbprintf("Read UID:"); Dbhexdump(10,uid
,0);
517 memcpy(readUID
,uid
,10*sizeof(uint8_t));
518 uint8_t *dst
= (uint8_t *)&uid_1st
[selected
];
519 // Set UID byte order
520 for (int i
=0; i
<4; i
++)
522 dst
= (uint8_t *)&uid_2nd
[selected
];
523 for (int i
=0; i
<4; i
++)
530 LED(LED_ORANGE
, 200);
532 LED(LED_ORANGE
, 200);
535 LED(selected
+ 1, 0);
536 // Finished recording
538 // If we were previously playing, set playing off
539 // so next button push begins playing what we recorded
542 cardRead
[selected
] = 1;
546 else if (button_pressed
> 0 && cardRead
[selected
] == 1)
549 LED(selected
+ 1, 0);
550 LED(LED_ORANGE
, 250);
554 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected
, uid_1st
[selected
]);
556 // wait for button to be released
557 while(BUTTON_PRESS())
559 // Delay cloning until card is in place
562 Dbprintf("Starting clone. [Bank: %u]", selected
);
563 // need this delay to prevent catching some weird data
565 // Begin clone function here:
566 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
567 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
568 memcpy(c.d.asBytes, data, 16);
571 Block read is similar:
572 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
573 We need to imitate that call with blockNo 0 to set a uid.
575 The get and set commands are handled in this file:
576 // Work with "magic Chinese" card
577 case CMD_MIFARE_CSETBLOCK:
578 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
580 case CMD_MIFARE_CGETBLOCK:
581 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
585 mfCSetUID provides example logic for UID set workflow:
586 -Read block0 from card in field with MifareCGetBlock()
587 -Configure new values without replacing reserved bytes
588 memcpy(block0, uid, 4); // Copy UID bytes from byte array
590 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
591 Bytes 5-7 are reserved SAK and ATQA for mifare classic
592 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
594 uint8_t oldBlock0
[16] = {0}, newBlock0
[16] = {0}, testBlock0
[16] = {0};
595 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
596 MifareCGetBlock(0x1F, 1, 0, oldBlock0
);
597 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0
[0],oldBlock0
[1],oldBlock0
[2],oldBlock0
[3]);
598 memcpy(newBlock0
,oldBlock0
,16);
599 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
600 newBlock0
[0] = uid_1st
[selected
]>>24;
601 newBlock0
[1] = 0xFF & (uid_1st
[selected
]>>16);
602 newBlock0
[2] = 0xFF & (uid_1st
[selected
]>>8);
603 newBlock0
[3] = 0xFF & (uid_1st
[selected
]);
604 newBlock0
[4] = newBlock0
[0]^newBlock0
[1]^newBlock0
[2]^newBlock0
[3];
605 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
606 MifareCSetBlock(0, 0xFF,0, newBlock0
);
607 MifareCGetBlock(0x1F, 1, 0, testBlock0
);
608 if (memcmp(testBlock0
,newBlock0
,16)==0)
610 DbpString("Cloned successfull!");
611 cardRead
[selected
] = 0; // Only if the card was cloned successfully should we clear it
614 LED(selected
+ 1, 0);
615 // Finished recording
617 // If we were previously playing, set playing off
618 // so next button push begins playing what we recorded
622 // Change where to record (or begin playing)
623 else if (button_pressed
&& cardRead
[selected
])
625 // Next option if we were previously playing
627 selected
= (selected
+ 1) % OPTS
;
631 LED(selected
+ 1, 0);
633 // Begin transmitting
637 DbpString("Playing");
638 while (!BUTTON_HELD(500)) { // Loop simulating tag until the button is held a half-sec
639 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st
[selected
],uid_2nd
[selected
],selected
);
640 SimulateIso14443aTag(1,uid_1st
[selected
],uid_2nd
[selected
],NULL
);
642 //cardRead[selected] = 1;
643 Dbprintf("Done playing [Bank: %u]",selected
);
645 /* We pressed a button so ignore it here with a delay */
648 // when done, we're done playing, move to next option
649 selected
= (selected
+ 1) % OPTS
;
652 LED(selected
+ 1, 0);
655 while(BUTTON_PRESS())
664 Listen and detect an external reader. Determine the best location
668 Inside the ListenReaderField() function, there is two mode.
669 By default, when you call the function, you will enter mode 1.
670 If you press the PM3 button one time, you will enter mode 2.
671 If you press the PM3 button a second time, you will exit the function.
673 DESCRIPTION OF MODE 1:
674 This mode just listens for an external reader field and lights up green
675 for HF and/or red for LF. This is the original mode of the detectreader
678 DESCRIPTION OF MODE 2:
679 This mode will visually represent, using the LEDs, the actual strength of the
680 current compared to the maximum current detected. Basically, once you know
681 what kind of external reader is present, it will help you spot the best location to place
682 your antenna. You will probably not get some good results if there is a LF and a HF reader
683 at the same place! :-)
687 static const char LIGHT_SCHEME
[] = {
688 0x0, /* ---- | No field detected */
689 0x1, /* X--- | 14% of maximum current detected */
690 0x2, /* -X-- | 29% of maximum current detected */
691 0x4, /* --X- | 43% of maximum current detected */
692 0x8, /* ---X | 57% of maximum current detected */
693 0xC, /* --XX | 71% of maximum current detected */
694 0xE, /* -XXX | 86% of maximum current detected */
695 0xF, /* XXXX | 100% of maximum current detected */
697 static const int LIGHT_LEN
= sizeof(LIGHT_SCHEME
)/sizeof(LIGHT_SCHEME
[0]);
699 void ListenReaderField(int limit
)
701 int lf_av
, lf_av_new
, lf_baseline
= 0, lf_max
;
702 int hf_av
, hf_av_new
, hf_baseline
= 0, hf_max
;
703 int mode
=1, display_val
, display_max
, i
;
707 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
710 // switch off FPGA - we don't want to measure our own signal
711 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
712 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
716 lf_av
= lf_max
= AvgAdc(ADC_CHAN_LF
);
718 if(limit
!= HF_ONLY
) {
719 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE
* lf_av
) >> 10);
723 hf_av
= hf_max
= AvgAdc(ADC_CHAN_HF
);
725 if (limit
!= LF_ONLY
) {
726 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE
* hf_av
) >> 10);
731 if (BUTTON_PRESS()) {
736 DbpString("Signal Strength Mode");
740 DbpString("Stopped");
748 if (limit
!= HF_ONLY
) {
750 if (abs(lf_av
- lf_baseline
) > REPORT_CHANGE
)
756 lf_av_new
= AvgAdc(ADC_CHAN_LF
);
757 // see if there's a significant change
758 if(abs(lf_av
- lf_av_new
) > REPORT_CHANGE
) {
759 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE
* lf_av_new
) >> 10);
766 if (limit
!= LF_ONLY
) {
768 if (abs(hf_av
- hf_baseline
) > REPORT_CHANGE
)
774 hf_av_new
= AvgAdc(ADC_CHAN_HF
);
775 // see if there's a significant change
776 if(abs(hf_av
- hf_av_new
) > REPORT_CHANGE
) {
777 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE
* hf_av_new
) >> 10);
785 if (limit
== LF_ONLY
) {
787 display_max
= lf_max
;
788 } else if (limit
== HF_ONLY
) {
790 display_max
= hf_max
;
791 } else { /* Pick one at random */
792 if( (hf_max
- hf_baseline
) > (lf_max
- lf_baseline
) ) {
794 display_max
= hf_max
;
797 display_max
= lf_max
;
800 for (i
=0; i
<LIGHT_LEN
; i
++) {
801 if (display_val
>= ((display_max
/LIGHT_LEN
)*i
) && display_val
<= ((display_max
/LIGHT_LEN
)*(i
+1))) {
802 if (LIGHT_SCHEME
[i
] & 0x1) LED_C_ON(); else LED_C_OFF();
803 if (LIGHT_SCHEME
[i
] & 0x2) LED_A_ON(); else LED_A_OFF();
804 if (LIGHT_SCHEME
[i
] & 0x4) LED_B_ON(); else LED_B_OFF();
805 if (LIGHT_SCHEME
[i
] & 0x8) LED_D_ON(); else LED_D_OFF();
813 void UsbPacketReceived(uint8_t *packet
, int len
)
815 UsbCommand
*c
= (UsbCommand
*)packet
;
817 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
821 case CMD_SET_LF_SAMPLING_CONFIG
:
822 setSamplingConfig((sample_config
*) c
->d
.asBytes
);
824 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
:
825 cmd_send(CMD_ACK
,SampleLF(c
->arg
[0]),0,0,0,0);
827 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
:
828 ModThenAcquireRawAdcSamples125k(c
->arg
[0],c
->arg
[1],c
->arg
[2],c
->d
.asBytes
);
830 case CMD_LF_SNOOP_RAW_ADC_SAMPLES
:
831 cmd_send(CMD_ACK
,SnoopLF(),0,0,0,0);
833 case CMD_HID_DEMOD_FSK
:
834 CmdHIDdemodFSK(c
->arg
[0], 0, 0, 1);
836 case CMD_HID_SIM_TAG
:
837 CmdHIDsimTAG(c
->arg
[0], c
->arg
[1], 1);
839 case CMD_FSK_SIM_TAG
:
840 CmdFSKsimTAG(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
842 case CMD_ASK_SIM_TAG
:
843 CmdASKsimTag(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
845 case CMD_PSK_SIM_TAG
:
846 CmdPSKsimTag(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
848 case CMD_HID_CLONE_TAG
:
849 CopyHIDtoT55x7(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
[0]);
851 case CMD_IO_DEMOD_FSK
:
852 CmdIOdemodFSK(c
->arg
[0], 0, 0, 1);
854 case CMD_IO_CLONE_TAG
:
855 CopyIOtoT55x7(c
->arg
[0], c
->arg
[1], c
->d
.asBytes
[0]);
857 case CMD_EM410X_DEMOD
:
858 CmdEM410xdemod(c
->arg
[0], 0, 0, 1);
860 case CMD_EM410X_WRITE_TAG
:
861 WriteEM410x(c
->arg
[0], c
->arg
[1], c
->arg
[2]);
863 case CMD_READ_TI_TYPE
:
866 case CMD_WRITE_TI_TYPE
:
867 WriteTItag(c
->arg
[0],c
->arg
[1],c
->arg
[2]);
869 case CMD_SIMULATE_TAG_125K
:
871 SimulateTagLowFrequency(c
->arg
[0], c
->arg
[1], 1);
874 case CMD_LF_SIMULATE_BIDIR
:
875 SimulateTagLowFrequencyBidir(c
->arg
[0], c
->arg
[1]);
877 case CMD_INDALA_CLONE_TAG
:
878 CopyIndala64toT55x7(c
->arg
[0], c
->arg
[1]);
880 case CMD_INDALA_CLONE_TAG_L
:
881 CopyIndala224toT55x7(c
->d
.asDwords
[0], c
->d
.asDwords
[1], c
->d
.asDwords
[2], c
->d
.asDwords
[3], c
->d
.asDwords
[4], c
->d
.asDwords
[5], c
->d
.asDwords
[6]);
883 case CMD_T55XX_READ_BLOCK
:
884 T55xxReadBlock(c
->arg
[1], c
->arg
[2],c
->d
.asBytes
[0]);
886 case CMD_T55XX_WRITE_BLOCK
:
887 T55xxWriteBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
[0]);
888 cmd_send(CMD_ACK
,0,0,0,0,0);
890 case CMD_T55XX_READ_TRACE
:
893 case CMD_PCF7931_READ
:
895 cmd_send(CMD_ACK
,0,0,0,0,0);
897 case CMD_EM4X_READ_WORD
:
898 EM4xReadWord(c
->arg
[1], c
->arg
[2],c
->d
.asBytes
[0]);
900 case CMD_EM4X_WRITE_WORD
:
901 EM4xWriteWord(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
[0]);
903 case CMD_AWID_DEMOD_FSK
: // Set realtime AWID demodulation
904 CmdAWIDdemodFSK(c
->arg
[0], 0, 0, 1);
909 case CMD_SNOOP_HITAG
: // Eavesdrop Hitag tag, args = type
910 SnoopHitag(c
->arg
[0]);
912 case CMD_SIMULATE_HITAG
: // Simulate Hitag tag, args = memory content
913 SimulateHitagTag((bool)c
->arg
[0],(byte_t
*)c
->d
.asBytes
);
915 case CMD_READER_HITAG
: // Reader for Hitag tags, args = type and function
916 ReaderHitag((hitag_function
)c
->arg
[0],(hitag_data
*)c
->d
.asBytes
);
921 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693
:
922 AcquireRawAdcSamplesIso15693();
924 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693
:
925 RecordRawAdcSamplesIso15693();
928 case CMD_ISO_15693_COMMAND
:
929 DirectTag15693Command(c
->arg
[0],c
->arg
[1],c
->arg
[2],c
->d
.asBytes
);
932 case CMD_ISO_15693_FIND_AFI
:
933 BruteforceIso15693Afi(c
->arg
[0]);
936 case CMD_ISO_15693_DEBUG
:
937 SetDebugIso15693(c
->arg
[0]);
940 case CMD_READER_ISO_15693
:
941 ReaderIso15693(c
->arg
[0]);
943 case CMD_SIMTAG_ISO_15693
:
944 SimTagIso15693(c
->arg
[0], c
->d
.asBytes
);
949 case CMD_SIMULATE_TAG_LEGIC_RF
:
950 LegicRfSimulate(c
->arg
[0], c
->arg
[1], c
->arg
[2]);
953 case CMD_WRITER_LEGIC_RF
:
954 LegicRfWriter(c
->arg
[1], c
->arg
[0]);
957 case CMD_READER_LEGIC_RF
:
958 LegicRfReader(c
->arg
[0], c
->arg
[1]);
962 #ifdef WITH_ISO14443b
963 case CMD_READ_SRI512_TAG
:
964 ReadSTMemoryIso14443b(0x0F);
966 case CMD_READ_SRIX4K_TAG
:
967 ReadSTMemoryIso14443b(0x7F);
969 case CMD_SNOOP_ISO_14443B
:
972 case CMD_SIMULATE_TAG_ISO_14443B
:
973 SimulateIso14443bTag();
975 case CMD_ISO_14443B_COMMAND
:
976 SendRawCommand14443B(c
->arg
[0],c
->arg
[1],c
->arg
[2],c
->d
.asBytes
);
980 #ifdef WITH_ISO14443a
981 case CMD_SNOOP_ISO_14443a
:
982 SnoopIso14443a(c
->arg
[0]);
984 case CMD_READER_ISO_14443a
:
987 case CMD_SIMULATE_TAG_ISO_14443a
:
988 SimulateIso14443aTag(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
); // ## Simulate iso14443a tag - pass tag type & UID
991 case CMD_EPA_PACE_COLLECT_NONCE
:
992 EPA_PACE_Collect_Nonce(c
);
994 case CMD_EPA_PACE_REPLAY
:
998 case CMD_READER_MIFARE
:
999 ReaderMifare(c
->arg
[0]);
1001 case CMD_MIFARE_READBL
:
1002 MifareReadBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1004 case CMD_MIFAREU_READBL
:
1005 MifareUReadBlock(c
->arg
[0],c
->arg
[1], c
->d
.asBytes
);
1007 case CMD_MIFAREUC_AUTH
:
1008 MifareUC_Auth(c
->arg
[0],c
->d
.asBytes
);
1010 case CMD_MIFAREU_READCARD
:
1011 MifareUReadCard(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1013 case CMD_MIFAREUC_SETPWD
:
1014 MifareUSetPwd(c
->arg
[0], c
->d
.asBytes
);
1016 case CMD_MIFARE_READSC
:
1017 MifareReadSector(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1019 case CMD_MIFARE_WRITEBL
:
1020 MifareWriteBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1022 //case CMD_MIFAREU_WRITEBL_COMPAT:
1023 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1025 case CMD_MIFAREU_WRITEBL
:
1026 MifareUWriteBlock(c
->arg
[0], c
->arg
[1], c
->d
.asBytes
);
1028 case CMD_MIFARE_NESTED
:
1029 MifareNested(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1031 case CMD_MIFARE_CHKKEYS
:
1032 MifareChkKeys(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1034 case CMD_SIMULATE_MIFARE_CARD
:
1035 Mifare1ksim(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1039 case CMD_MIFARE_SET_DBGMODE
:
1040 MifareSetDbgLvl(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1042 case CMD_MIFARE_EML_MEMCLR
:
1043 MifareEMemClr(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1045 case CMD_MIFARE_EML_MEMSET
:
1046 MifareEMemSet(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1048 case CMD_MIFARE_EML_MEMGET
:
1049 MifareEMemGet(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1051 case CMD_MIFARE_EML_CARDLOAD
:
1052 MifareECardLoad(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1055 // Work with "magic Chinese" card
1056 case CMD_MIFARE_CSETBLOCK
:
1057 MifareCSetBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1059 case CMD_MIFARE_CGETBLOCK
:
1060 MifareCGetBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1062 case CMD_MIFARE_CIDENT
:
1067 case CMD_MIFARE_SNIFFER
:
1068 SniffMifare(c
->arg
[0]);
1074 // Makes use of ISO14443a FPGA Firmware
1075 case CMD_SNOOP_ICLASS
:
1078 case CMD_SIMULATE_TAG_ICLASS
:
1079 SimulateIClass(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
1081 case CMD_READER_ICLASS
:
1082 ReaderIClass(c
->arg
[0]);
1084 case CMD_READER_ICLASS_REPLAY
:
1085 ReaderIClass_Replay(c
->arg
[0], c
->d
.asBytes
);
1087 case CMD_ICLASS_EML_MEMSET
:
1088 emlSet(c
->d
.asBytes
,c
->arg
[0], c
->arg
[1]);
1092 case CMD_BUFF_CLEAR
:
1096 case CMD_MEASURE_ANTENNA_TUNING
:
1097 MeasureAntennaTuning();
1100 case CMD_MEASURE_ANTENNA_TUNING_HF
:
1101 MeasureAntennaTuningHf();
1104 case CMD_LISTEN_READER_FIELD
:
1105 ListenReaderField(c
->arg
[0]);
1108 case CMD_FPGA_MAJOR_MODE_OFF
: // ## FPGA Control
1109 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1111 LED_D_OFF(); // LED D indicates field ON or OFF
1114 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
:
1117 uint8_t *BigBuf
= BigBuf_get_addr();
1118 for(size_t i
=0; i
<c
->arg
[1]; i
+= USB_CMD_DATA_SIZE
) {
1119 size_t len
= MIN((c
->arg
[1] - i
),USB_CMD_DATA_SIZE
);
1120 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K
,i
,len
,BigBuf_get_traceLen(),BigBuf
+c
->arg
[0]+i
,len
);
1122 // Trigger a finish downloading signal with an ACK frame
1123 cmd_send(CMD_ACK
,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config
));
1127 case CMD_DOWNLOADED_SIM_SAMPLES_125K
: {
1128 uint8_t *b
= BigBuf_get_addr();
1129 memcpy(b
+c
->arg
[0], c
->d
.asBytes
, USB_CMD_DATA_SIZE
);
1130 cmd_send(CMD_ACK
,0,0,0,0,0);
1137 case CMD_SET_LF_DIVISOR
:
1138 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
1139 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, c
->arg
[0]);
1142 case CMD_SET_ADC_MUX
:
1144 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD
); break;
1145 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW
); break;
1146 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD
); break;
1147 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW
); break;
1163 case CMD_SETUP_WRITE
:
1164 case CMD_FINISH_WRITE
:
1165 case CMD_HARDWARE_RESET
:
1169 AT91C_BASE_RSTC
->RSTC_RCR
= RST_CONTROL_KEY
| AT91C_RSTC_PROCRST
;
1171 // We're going to reset, and the bootrom will take control.
1175 case CMD_START_FLASH
:
1176 if(common_area
.flags
.bootrom_present
) {
1177 common_area
.command
= COMMON_AREA_COMMAND_ENTER_FLASH_MODE
;
1180 AT91C_BASE_RSTC
->RSTC_RCR
= RST_CONTROL_KEY
| AT91C_RSTC_PROCRST
;
1184 case CMD_DEVICE_INFO
: {
1185 uint32_t dev_info
= DEVICE_INFO_FLAG_OSIMAGE_PRESENT
| DEVICE_INFO_FLAG_CURRENT_MODE_OS
;
1186 if(common_area
.flags
.bootrom_present
) dev_info
|= DEVICE_INFO_FLAG_BOOTROM_PRESENT
;
1187 cmd_send(CMD_DEVICE_INFO
,dev_info
,0,0,0,0);
1191 Dbprintf("%s: 0x%04x","unknown command:",c
->cmd
);
1196 void __attribute__((noreturn
)) AppMain(void)
1200 if(common_area
.magic
!= COMMON_AREA_MAGIC
|| common_area
.version
!= 1) {
1201 /* Initialize common area */
1202 memset(&common_area
, 0, sizeof(common_area
));
1203 common_area
.magic
= COMMON_AREA_MAGIC
;
1204 common_area
.version
= 1;
1206 common_area
.flags
.osimage_present
= 1;
1216 // The FPGA gets its clock from us from PCK0 output, so set that up.
1217 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_PCK0
;
1218 AT91C_BASE_PIOA
->PIO_PDR
= GPIO_PCK0
;
1219 AT91C_BASE_PMC
->PMC_SCER
= AT91C_PMC_PCK0
;
1220 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1221 AT91C_BASE_PMC
->PMC_PCKR
[0] = AT91C_PMC_CSS_PLL_CLK
|
1222 AT91C_PMC_PRES_CLK_4
;
1223 AT91C_BASE_PIOA
->PIO_OER
= GPIO_PCK0
;
1226 AT91C_BASE_SPI
->SPI_CR
= AT91C_SPI_SWRST
;
1228 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_SWRST
;
1230 // Load the FPGA image, which we have stored in our flash.
1231 // (the HF version by default)
1232 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1240 byte_t rx
[sizeof(UsbCommand
)];
1245 rx_len
= usb_read(rx
,sizeof(UsbCommand
));
1247 UsbPacketReceived(rx
,rx_len
);
1253 #ifndef WITH_ISO14443a_StandAlone
1254 if (BUTTON_HELD(1000) > 0)
1258 #ifdef WITH_ISO14443a
1259 #ifdef WITH_ISO14443a_StandAlone
1260 if (BUTTON_HELD(1000) > 0)
1261 StandAloneMode14a();