]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
send LF commands to TAG (locomread)
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // The main application code. This is the first thing called after start.c
3 // executes.
4 // Jonathan Westhues, Mar 2006
5 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
6 //-----------------------------------------------------------------------------
7
8
9 #include <proxmark3.h>
10 #include "apps.h"
11 #ifdef WITH_LCD
12 #include "fonts.h"
13 #include "LCD.h"
14 #endif
15
16 // The large multi-purpose buffer, typically used to hold A/D samples,
17 // maybe pre-processed in some way.
18 DWORD BigBuf[16000];
19
20 //=============================================================================
21 // A buffer where we can queue things up to be sent through the FPGA, for
22 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
23 // is the order in which they go out on the wire.
24 //=============================================================================
25
26 BYTE ToSend[256];
27 int ToSendMax;
28 static int ToSendBit;
29
30
31 void BufferClear(void)
32 {
33 memset(BigBuf,0,sizeof(BigBuf));
34 DbpString("Buffer cleared");
35 }
36
37 void ToSendReset(void)
38 {
39 ToSendMax = -1;
40 ToSendBit = 8;
41 }
42
43 void ToSendStuffBit(int b)
44 {
45 if(ToSendBit >= 8) {
46 ToSendMax++;
47 ToSend[ToSendMax] = 0;
48 ToSendBit = 0;
49 }
50
51 if(b) {
52 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
53 }
54
55 ToSendBit++;
56
57 if(ToSendBit >= sizeof(ToSend)) {
58 ToSendBit = 0;
59 DbpString("ToSendStuffBit overflowed!");
60 }
61 }
62
63 //=============================================================================
64 // Debug print functions, to go out over USB, to the usual PC-side client.
65 //=============================================================================
66
67 void DbpString(char *str)
68 {
69 UsbCommand c;
70 c.cmd = CMD_DEBUG_PRINT_STRING;
71 c.ext1 = strlen(str);
72 memcpy(c.d.asBytes, str, c.ext1);
73
74 UsbSendPacket((BYTE *)&c, sizeof(c));
75 // TODO fix USB so stupid things like this aren't req'd
76 SpinDelay(50);
77 }
78
79 void DbpIntegers(int x1, int x2, int x3)
80 {
81 UsbCommand c;
82 c.cmd = CMD_DEBUG_PRINT_INTEGERS;
83 c.ext1 = x1;
84 c.ext2 = x2;
85 c.ext3 = x3;
86
87 UsbSendPacket((BYTE *)&c, sizeof(c));
88 // XXX
89 SpinDelay(50);
90 }
91
92 void AcquireRawAdcSamples125k(BOOL at134khz)
93 {
94 if(at134khz) {
95 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
96 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ);
97 } else {
98 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
99 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);
100 }
101
102 // Connect the A/D to the peak-detected low-frequency path.
103 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
104
105 // Give it a bit of time for the resonant antenna to settle.
106 SpinDelay(50);
107
108 // Now set up the SSC to get the ADC samples that are now streaming at us.
109 FpgaSetupSsc();
110
111 // Now call the acquisition routine
112 DoAcquisition125k(at134khz);
113 }
114
115 // split into two routines so we can avoid timing issues after sending commands //
116 void DoAcquisition125k(BOOL at134khz)
117 {
118 BYTE *dest = (BYTE *)BigBuf;
119 int n = sizeof(BigBuf);
120 int i;
121
122 memset(dest,0,n);
123 i = 0;
124 for(;;) {
125 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
126 SSC_TRANSMIT_HOLDING = 0x43;
127 LED_D_ON();
128 }
129 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
130 dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
131 i++;
132 LED_D_OFF();
133 if(i >= n) {
134 break;
135 }
136 }
137 }
138 DbpIntegers(dest[0], dest[1], at134khz);
139 }
140
141 void ModThenAcquireRawAdcSamples125k(int delay_off,int period_0,int period_1,BYTE *command)
142 {
143 BOOL at134khz;
144
145 // see if 'h' was specified
146 if(command[strlen(command) - 1] == 'h')
147 at134khz= TRUE;
148 else
149 at134khz= FALSE;
150
151 if(at134khz) {
152 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
153 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ);
154 } else {
155 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
156 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);
157 }
158
159 // Give it a bit of time for the resonant antenna to settle.
160 SpinDelay(50);
161
162 // Now set up the SSC to get the ADC samples that are now streaming at us.
163 FpgaSetupSsc();
164
165 // now modulate the reader field
166 while(*command != '\0' && *command != ' ')
167 {
168 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
169 LED_D_OFF();
170 SpinDelayUs(delay_off);
171 if(at134khz) {
172 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
173 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ);
174 } else {
175 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
176 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);
177 }
178 LED_D_ON();
179 if(*(command++) == '0')
180 SpinDelayUs(period_0);
181 else
182 SpinDelayUs(period_1);
183 }
184 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
185 LED_D_OFF();
186 SpinDelayUs(delay_off);
187 if(at134khz) {
188 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
189 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ);
190 } else {
191 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
192 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);
193 }
194
195 // now do the read
196 DoAcquisition125k(at134khz);
197 }
198
199 //-----------------------------------------------------------------------------
200 // Read an ADC channel and block till it completes, then return the result
201 // in ADC units (0 to 1023). Also a routine to average 32 samples and
202 // return that.
203 //-----------------------------------------------------------------------------
204 static int ReadAdc(int ch)
205 {
206 DWORD d;
207
208 ADC_CONTROL = ADC_CONTROL_RESET;
209 ADC_MODE = ADC_MODE_PRESCALE(32) | ADC_MODE_STARTUP_TIME(16) |
210 ADC_MODE_SAMPLE_HOLD_TIME(8);
211 ADC_CHANNEL_ENABLE = ADC_CHANNEL(ch);
212
213 ADC_CONTROL = ADC_CONTROL_START;
214 while(!(ADC_STATUS & ADC_END_OF_CONVERSION(ch)))
215 ;
216 d = ADC_CHANNEL_DATA(ch);
217
218 return d;
219 }
220
221 static int AvgAdc(int ch)
222 {
223 int i;
224 int a = 0;
225
226 for(i = 0; i < 32; i++) {
227 a += ReadAdc(ch);
228 }
229
230 return (a + 15) >> 5;
231 }
232
233 /*
234 * Sweeps the useful LF range of the proxmark from
235 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
236 * reads the voltage in the antenna: the result is a graph
237 * which should clearly show the resonating frequency of your
238 * LF antenna ( hopefully around 90 if it is tuned to 125kHz!)
239 */
240 void SweepLFrange()
241 {
242 BYTE *dest = (BYTE *)BigBuf;
243 int i;
244
245 // clear buffer
246 memset(BigBuf,0,sizeof(BigBuf));
247
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
249 for (i=255; i>19; i--) {
250 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
251 SpinDelay(20);
252 dest[i] = (137500 * AvgAdc(4)) >> 18;
253 }
254 }
255
256 void MeasureAntennaTuning(void)
257 {
258 // Impedances are Zc = 1/(j*omega*C), in ohms
259 #define LF_TUNING_CAP_Z 1273 // 1 nF @ 125 kHz
260 #define HF_TUNING_CAP_Z 235 // 50 pF @ 13.56 MHz
261
262 int vLf125, vLf134, vHf; // in mV
263
264 UsbCommand c;
265
266 // Let the FPGA drive the low-frequency antenna around 125 kHz.
267 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
268 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);
269 SpinDelay(20);
270 vLf125 = AvgAdc(4);
271 // Vref = 3.3V, and a 10000:240 voltage divider on the input
272 // can measure voltages up to 137500 mV
273 vLf125 = (137500 * vLf125) >> 10;
274
275 // Let the FPGA drive the low-frequency antenna around 134 kHz.
276 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
277 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ);
278 SpinDelay(20);
279 vLf134 = AvgAdc(4);
280 // Vref = 3.3V, and a 10000:240 voltage divider on the input
281 // can measure voltages up to 137500 mV
282 vLf134 = (137500 * vLf134) >> 10;
283
284 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
285 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
286 SpinDelay(20);
287 vHf = AvgAdc(5);
288 // Vref = 3300mV, and an 10:1 voltage divider on the input
289 // can measure voltages up to 33000 mV
290 vHf = (33000 * vHf) >> 10;
291
292 c.cmd = CMD_MEASURED_ANTENNA_TUNING;
293 c.ext1 = (vLf125 << 0) | (vLf134 << 16);
294 c.ext2 = vHf;
295 c.ext3 = (LF_TUNING_CAP_Z << 0) | (HF_TUNING_CAP_Z << 16);
296 UsbSendPacket((BYTE *)&c, sizeof(c));
297 }
298
299 void SimulateTagLowFrequency(int period)
300 {
301 int i;
302 BYTE *tab = (BYTE *)BigBuf;
303
304 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR);
305
306 PIO_ENABLE = (1 << GPIO_SSC_DOUT) | (1 << GPIO_SSC_CLK);
307
308 PIO_OUTPUT_ENABLE = (1 << GPIO_SSC_DOUT);
309 PIO_OUTPUT_DISABLE = (1 << GPIO_SSC_CLK);
310
311 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
312 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
313
314 i = 0;
315 for(;;) {
316 while(!(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK))) {
317 if(BUTTON_PRESS()) {
318 return;
319 }
320 WDT_HIT();
321 }
322
323 LED_D_ON();
324 if(tab[i]) {
325 OPEN_COIL();
326 } else {
327 SHORT_COIL();
328 }
329 LED_D_OFF();
330
331 while(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK)) {
332 if(BUTTON_PRESS()) {
333 return;
334 }
335 WDT_HIT();
336 }
337
338 i++;
339 if(i == period) i = 0;
340 }
341 }
342
343 // compose fc/8 fc/10 waveform
344 static void fc(int c, int *n) {
345 BYTE *dest = (BYTE *)BigBuf;
346 int idx;
347
348 // for when we want an fc8 pattern every 4 logical bits
349 if(c==0) {
350 dest[((*n)++)]=1;
351 dest[((*n)++)]=1;
352 dest[((*n)++)]=0;
353 dest[((*n)++)]=0;
354 dest[((*n)++)]=0;
355 dest[((*n)++)]=0;
356 dest[((*n)++)]=0;
357 dest[((*n)++)]=0;
358 }
359 // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
360 if(c==8) {
361 for (idx=0; idx<6; idx++) {
362 dest[((*n)++)]=1;
363 dest[((*n)++)]=1;
364 dest[((*n)++)]=0;
365 dest[((*n)++)]=0;
366 dest[((*n)++)]=0;
367 dest[((*n)++)]=0;
368 dest[((*n)++)]=0;
369 dest[((*n)++)]=0;
370 }
371 }
372
373 // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
374 if(c==10) {
375 for (idx=0; idx<5; idx++) {
376 dest[((*n)++)]=1;
377 dest[((*n)++)]=1;
378 dest[((*n)++)]=1;
379 dest[((*n)++)]=0;
380 dest[((*n)++)]=0;
381 dest[((*n)++)]=0;
382 dest[((*n)++)]=0;
383 dest[((*n)++)]=0;
384 dest[((*n)++)]=0;
385 dest[((*n)++)]=0;
386 }
387 }
388 }
389
390 // prepare a waveform pattern in the buffer based on the ID given then
391 // simulate a HID tag until the button is pressed
392 static void CmdHIDsimTAG(int hi, int lo)
393 {
394 int n=0, i=0;
395 /*
396 HID tag bitstream format
397 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
398 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
399 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
400 A fc8 is inserted before every 4 bits
401 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
402 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
403 */
404
405 if (hi>0xFFF) {
406 DbpString("Tags can only have 44 bits.");
407 return;
408 }
409 fc(0,&n);
410 // special start of frame marker containing invalid bit sequences
411 fc(8, &n); fc(8, &n); // invalid
412 fc(8, &n); fc(10, &n); // logical 0
413 fc(10, &n); fc(10, &n); // invalid
414 fc(8, &n); fc(10, &n); // logical 0
415
416 WDT_HIT();
417 // manchester encode bits 43 to 32
418 for (i=11; i>=0; i--) {
419 if ((i%4)==3) fc(0,&n);
420 if ((hi>>i)&1) {
421 fc(10, &n); fc(8, &n); // low-high transition
422 } else {
423 fc(8, &n); fc(10, &n); // high-low transition
424 }
425 }
426
427 WDT_HIT();
428 // manchester encode bits 31 to 0
429 for (i=31; i>=0; i--) {
430 if ((i%4)==3) fc(0,&n);
431 if ((lo>>i)&1) {
432 fc(10, &n); fc(8, &n); // low-high transition
433 } else {
434 fc(8, &n); fc(10, &n); // high-low transition
435 }
436 }
437
438 LED_A_ON();
439 SimulateTagLowFrequency(n);
440 LED_A_OFF();
441 }
442
443 // loop to capture raw HID waveform then FSK demodulate the TAG ID from it
444 static void CmdHIDdemodFSK(void)
445 {
446 BYTE *dest = (BYTE *)BigBuf;
447 int m=0, n=0, i=0, idx=0, found=0, lastval=0;
448 DWORD hi=0, lo=0;
449
450 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
451 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ);
452
453 // Connect the A/D to the peak-detected low-frequency path.
454 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
455
456 // Give it a bit of time for the resonant antenna to settle.
457 SpinDelay(50);
458
459 // Now set up the SSC to get the ADC samples that are now streaming at us.
460 FpgaSetupSsc();
461
462 for(;;) {
463 WDT_HIT();
464 LED_A_ON();
465 if(BUTTON_PRESS()) {
466 LED_A_OFF();
467 return;
468 }
469
470 i = 0;
471 m = sizeof(BigBuf);
472 memset(dest,128,m);
473 for(;;) {
474 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
475 SSC_TRANSMIT_HOLDING = 0x43;
476 LED_D_ON();
477 }
478 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
479 dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
480 // we don't care about actual value, only if it's more or less than a
481 // threshold essentially we capture zero crossings for later analysis
482 if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
483 i++;
484 LED_D_OFF();
485 if(i >= m) {
486 break;
487 }
488 }
489 }
490
491 // FSK demodulator
492
493 // sync to first lo-hi transition
494 for( idx=1; idx<m; idx++) {
495 if (dest[idx-1]<dest[idx])
496 lastval=idx;
497 break;
498 }
499 WDT_HIT();
500
501 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
502 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
503 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
504 for( i=0; idx<m; idx++) {
505 if (dest[idx-1]<dest[idx]) {
506 dest[i]=idx-lastval;
507 if (dest[i] <= 8) {
508 dest[i]=1;
509 } else {
510 dest[i]=0;
511 }
512
513 lastval=idx;
514 i++;
515 }
516 }
517 m=i;
518 WDT_HIT();
519
520 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
521 lastval=dest[0];
522 idx=0;
523 i=0;
524 n=0;
525 for( idx=0; idx<m; idx++) {
526 if (dest[idx]==lastval) {
527 n++;
528 } else {
529 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
530 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
531 // swallowed up by rounding
532 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
533 // special start of frame markers use invalid manchester states (no transitions) by using sequences
534 // like 111000
535 if (dest[idx-1]) {
536 n=(n+1)/6; // fc/8 in sets of 6
537 } else {
538 n=(n+1)/5; // fc/10 in sets of 5
539 }
540 switch (n) { // stuff appropriate bits in buffer
541 case 0:
542 case 1: // one bit
543 dest[i++]=dest[idx-1];
544 break;
545 case 2: // two bits
546 dest[i++]=dest[idx-1];
547 dest[i++]=dest[idx-1];
548 break;
549 case 3: // 3 bit start of frame markers
550 dest[i++]=dest[idx-1];
551 dest[i++]=dest[idx-1];
552 dest[i++]=dest[idx-1];
553 break;
554 // When a logic 0 is immediately followed by the start of the next transmisson
555 // (special pattern) a pattern of 4 bit duration lengths is created.
556 case 4:
557 dest[i++]=dest[idx-1];
558 dest[i++]=dest[idx-1];
559 dest[i++]=dest[idx-1];
560 dest[i++]=dest[idx-1];
561 break;
562 default: // this shouldn't happen, don't stuff any bits
563 break;
564 }
565 n=0;
566 lastval=dest[idx];
567 }
568 }
569 m=i;
570 WDT_HIT();
571
572 // final loop, go over previously decoded manchester data and decode into usable tag ID
573 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
574 for( idx=0; idx<m-6; idx++) {
575 // search for a start of frame marker
576 if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
577 {
578 found=1;
579 idx+=6;
580 if (found && (hi|lo)) {
581 DbpString("TAG ID");
582 DbpIntegers(hi, lo, (lo>>1)&0xffff);
583 hi=0;
584 lo=0;
585 found=0;
586 }
587 }
588 if (found) {
589 if (dest[idx] && (!dest[idx+1]) ) {
590 hi=(hi<<1)|(lo>>31);
591 lo=(lo<<1)|0;
592 } else if ( (!dest[idx]) && dest[idx+1]) {
593 hi=(hi<<1)|(lo>>31);
594 lo=(lo<<1)|1;
595 } else {
596 found=0;
597 hi=0;
598 lo=0;
599 }
600 idx++;
601 }
602 if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
603 {
604 found=1;
605 idx+=6;
606 if (found && (hi|lo)) {
607 DbpString("TAG ID");
608 DbpIntegers(hi, lo, (lo>>1)&0xffff);
609 hi=0;
610 lo=0;
611 found=0;
612 }
613 }
614 }
615 WDT_HIT();
616 }
617 }
618
619 void SimulateTagHfListen(void)
620 {
621 BYTE *dest = (BYTE *)BigBuf;
622 int n = sizeof(BigBuf);
623 BYTE v = 0;
624 int i;
625 int p = 0;
626
627 // We're using this mode just so that I can test it out; the simulated
628 // tag mode would work just as well and be simpler.
629 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
630
631 // We need to listen to the high-frequency, peak-detected path.
632 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
633
634 FpgaSetupSsc();
635
636 i = 0;
637 for(;;) {
638 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
639 SSC_TRANSMIT_HOLDING = 0xff;
640 }
641 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
642 BYTE r = (BYTE)SSC_RECEIVE_HOLDING;
643
644 v <<= 1;
645 if(r & 1) {
646 v |= 1;
647 }
648 p++;
649
650 if(p >= 8) {
651 dest[i] = v;
652 v = 0;
653 p = 0;
654 i++;
655
656 if(i >= n) {
657 break;
658 }
659 }
660 }
661 }
662 DbpString("simulate tag (now type bitsamples)");
663 }
664
665 void UsbPacketReceived(BYTE *packet, int len)
666 {
667 UsbCommand *c = (UsbCommand *)packet;
668
669 switch(c->cmd) {
670 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
671 AcquireRawAdcSamples125k(c->ext1);
672 break;
673
674 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
675 ModThenAcquireRawAdcSamples125k(c->ext1,c->ext2,c->ext3,c->d.asBytes);
676 break;
677
678 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
679 AcquireRawAdcSamplesIso15693();
680 break;
681
682 case CMD_BUFF_CLEAR:
683 BufferClear();
684 break;
685
686 case CMD_READER_ISO_15693:
687 ReaderIso15693(c->ext1);
688 break;
689
690 case CMD_SIMTAG_ISO_15693:
691 SimTagIso15693(c->ext1);
692 break;
693
694 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
695 AcquireRawAdcSamplesIso14443(c->ext1);
696 break;
697
698 case CMD_READ_SRI512_TAG:
699 ReadSRI512Iso14443(c->ext1);
700 break;
701
702 case CMD_READER_ISO_14443a:
703 ReaderIso14443a(c->ext1);
704 break;
705
706 case CMD_SNOOP_ISO_14443:
707 SnoopIso14443();
708 break;
709
710 case CMD_SNOOP_ISO_14443a:
711 SnoopIso14443a();
712 break;
713
714 case CMD_SIMULATE_TAG_HF_LISTEN:
715 SimulateTagHfListen();
716 break;
717
718 case CMD_SIMULATE_TAG_ISO_14443:
719 SimulateIso14443Tag();
720 break;
721
722 case CMD_SIMULATE_TAG_ISO_14443a:
723 SimulateIso14443aTag(c->ext1, c->ext2); // ## Simulate iso14443a tag - pass tag type & UID
724 break;
725
726 case CMD_MEASURE_ANTENNA_TUNING:
727 MeasureAntennaTuning();
728 break;
729
730 case CMD_HID_DEMOD_FSK:
731 CmdHIDdemodFSK(); // Demodulate HID tag
732 break;
733
734 case CMD_HID_SIM_TAG:
735 CmdHIDsimTAG(c->ext1, c->ext2); // Simulate HID tag by ID
736 break;
737
738 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
739 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
740 SpinDelay(200);
741 LED_D_OFF(); // LED D indicates field ON or OFF
742 break;
743
744 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
745 case CMD_DOWNLOAD_RAW_BITS_TI_TYPE: {
746 UsbCommand n;
747 if(c->cmd == CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K) {
748 n.cmd = CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K;
749 } else {
750 n.cmd = CMD_DOWNLOADED_RAW_BITS_TI_TYPE;
751 }
752 n.ext1 = c->ext1;
753 memcpy(n.d.asDwords, BigBuf+c->ext1, 12*sizeof(DWORD));
754 UsbSendPacket((BYTE *)&n, sizeof(n));
755 break;
756 }
757 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
758 BYTE *b = (BYTE *)BigBuf;
759 memcpy(b+c->ext1, c->d.asBytes, 48);
760 break;
761 }
762 case CMD_SIMULATE_TAG_125K:
763 LED_A_ON();
764 SimulateTagLowFrequency(c->ext1);
765 LED_A_OFF();
766 break;
767 #ifdef WITH_LCD
768 case CMD_LCD_RESET:
769 LCDReset();
770 break;
771 #endif
772 case CMD_SWEEP_LF:
773 SweepLFrange();
774 break;
775
776 case CMD_SET_LF_DIVISOR:
777 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->ext1);
778 break;
779 #ifdef WITH_LCD
780 case CMD_LCD:
781 LCDSend(c->ext1);
782 break;
783 #endif
784 case CMD_SETUP_WRITE:
785 case CMD_FINISH_WRITE:
786 case CMD_HARDWARE_RESET:
787 USB_D_PLUS_PULLUP_OFF();
788 SpinDelay(1000);
789 SpinDelay(1000);
790 RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET;
791 for(;;) {
792 // We're going to reset, and the bootrom will take control.
793 }
794 break;
795
796
797 default:
798 DbpString("unknown command");
799 break;
800 }
801 }
802
803 void AppMain(void)
804 {
805 memset(BigBuf,0,sizeof(BigBuf));
806 SpinDelay(100);
807
808 LED_D_OFF();
809 LED_C_OFF();
810 LED_B_OFF();
811 LED_A_OFF();
812
813 UsbStart();
814
815 // The FPGA gets its clock from us from PCK0 output, so set that up.
816 PIO_PERIPHERAL_B_SEL = (1 << GPIO_PCK0);
817 PIO_DISABLE = (1 << GPIO_PCK0);
818 PMC_SYS_CLK_ENABLE = PMC_SYS_CLK_PROGRAMMABLE_CLK_0;
819 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
820 PMC_PROGRAMMABLE_CLK_0 = PMC_CLK_SELECTION_PLL_CLOCK |
821 PMC_CLK_PRESCALE_DIV_4;
822 PIO_OUTPUT_ENABLE = (1 << GPIO_PCK0);
823
824 // Reset SPI
825 SPI_CONTROL = SPI_CONTROL_RESET;
826 // Reset SSC
827 SSC_CONTROL = SSC_CONTROL_RESET;
828
829 // Load the FPGA image, which we have stored in our flash.
830 FpgaDownloadAndGo();
831
832 #ifdef WITH_LCD
833
834 LCDInit();
835
836 // test text on different colored backgrounds
837 LCDString(" The quick brown fox ", &FONT6x8,1,1+8*0,WHITE ,BLACK );
838 LCDString(" jumped over the ", &FONT6x8,1,1+8*1,BLACK ,WHITE );
839 LCDString(" lazy dog. ", &FONT6x8,1,1+8*2,YELLOW ,RED );
840 LCDString(" AaBbCcDdEeFfGgHhIiJj ", &FONT6x8,1,1+8*3,RED ,GREEN );
841 LCDString(" KkLlMmNnOoPpQqRrSsTt ", &FONT6x8,1,1+8*4,MAGENTA,BLUE );
842 LCDString("UuVvWwXxYyZz0123456789", &FONT6x8,1,1+8*5,BLUE ,YELLOW);
843 LCDString("`-=[]_;',./~!@#$%^&*()", &FONT6x8,1,1+8*6,BLACK ,CYAN );
844 LCDString(" _+{}|:\\\"<>? ",&FONT6x8,1,1+8*7,BLUE ,MAGENTA);
845
846 // color bands
847 LCDFill(0, 1+8* 8, 132, 8, BLACK);
848 LCDFill(0, 1+8* 9, 132, 8, WHITE);
849 LCDFill(0, 1+8*10, 132, 8, RED);
850 LCDFill(0, 1+8*11, 132, 8, GREEN);
851 LCDFill(0, 1+8*12, 132, 8, BLUE);
852 LCDFill(0, 1+8*13, 132, 8, YELLOW);
853 LCDFill(0, 1+8*14, 132, 8, CYAN);
854 LCDFill(0, 1+8*15, 132, 8, MAGENTA);
855
856 #endif
857
858 for(;;) {
859 UsbPoll(FALSE);
860 WDT_HIT();
861 }
862 }
863
864 void SpinDelayUs(int us)
865 {
866 int ticks = (48*us) >> 10;
867
868 // Borrow a PWM unit for my real-time clock
869 PWM_ENABLE = PWM_CHANNEL(0);
870 // 48 MHz / 1024 gives 46.875 kHz
871 PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10);
872 PWM_CH_DUTY_CYCLE(0) = 0;
873 PWM_CH_PERIOD(0) = 0xffff;
874
875 WORD start = (WORD)PWM_CH_COUNTER(0);
876
877 for(;;) {
878 WORD now = (WORD)PWM_CH_COUNTER(0);
879 if(now == (WORD)(start + ticks)) {
880 return;
881 }
882 WDT_HIT();
883 }
884 }
885
886 void SpinDelay(int ms)
887 {
888 int ticks = (48000*ms) >> 10;
889
890 // Borrow a PWM unit for my real-time clock
891 PWM_ENABLE = PWM_CHANNEL(0);
892 // 48 MHz / 1024 gives 46.875 kHz
893 PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10);
894 PWM_CH_DUTY_CYCLE(0) = 0;
895 PWM_CH_PERIOD(0) = 0xffff;
896
897 WORD start = (WORD)PWM_CH_COUNTER(0);
898
899 for(;;) {
900 WORD now = (WORD)PWM_CH_COUNTER(0);
901 if(now == (WORD)(start + ticks)) {
902 return;
903 }
904 WDT_HIT();
905 }
906 }
Proxmark3 GIT tracking
Impressum, Datenschutz