]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Applied Holiman's fixes for iclass.c and CSNs
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "../common/usb_cdc.h"
14 #include "../common/cmd.h"
15
16 #include "../include/proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21 #include <stdarg.h>
22
23
24 #include "legicrf.h"
25 #include "../include/hitag2.h"
26
27
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 #define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34 //=============================================================================
35 // A buffer where we can queue things up to be sent through the FPGA, for
36 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
37 // is the order in which they go out on the wire.
38 //=============================================================================
39
40 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41 uint8_t ToSend[TOSEND_BUFFER_SIZE];
42 int ToSendMax;
43 static int ToSendBit;
44 struct common_area common_area __attribute__((section(".commonarea")));
45
46 void BufferClear(void)
47 {
48 memset(BigBuf,0,sizeof(BigBuf));
49 Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
50 }
51
52 void ToSendReset(void)
53 {
54 ToSendMax = -1;
55 ToSendBit = 8;
56 }
57
58 void ToSendStuffBit(int b)
59 {
60 if(ToSendBit >= 8) {
61 ToSendMax++;
62 ToSend[ToSendMax] = 0;
63 ToSendBit = 0;
64 }
65
66 if(b) {
67 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
68 }
69
70 ToSendBit++;
71
72 if(ToSendMax >= sizeof(ToSend)) {
73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76 }
77
78 //=============================================================================
79 // Debug print functions, to go out over USB, to the usual PC-side client.
80 //=============================================================================
81
82 void DbpString(char *str)
83 {
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
86 }
87
88 #if 0
89 void DbpIntegers(int x1, int x2, int x3)
90 {
91 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
92 }
93 #endif
94
95 void Dbprintf(const char *fmt, ...) {
96 // should probably limit size here; oh well, let's just use a big buffer
97 char output_string[128];
98 va_list ap;
99
100 va_start(ap, fmt);
101 kvsprintf(fmt, output_string, 10, ap);
102 va_end(ap);
103
104 DbpString(output_string);
105 }
106
107 // prints HEX & ASCII
108 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
109 int l=0,i;
110 char ascii[9];
111
112 while (len>0) {
113 if (len>8) l=8;
114 else l=len;
115
116 memcpy(ascii,d,l);
117 ascii[l]=0;
118
119 // filter safe ascii
120 for (i=0;i<l;i++)
121 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
122
123 if (bAsci) {
124 Dbprintf("%-8s %*D",ascii,l,d," ");
125 } else {
126 Dbprintf("%*D",l,d," ");
127 }
128
129 len-=8;
130 d+=8;
131 }
132 }
133
134 //-----------------------------------------------------------------------------
135 // Read an ADC channel and block till it completes, then return the result
136 // in ADC units (0 to 1023). Also a routine to average 32 samples and
137 // return that.
138 //-----------------------------------------------------------------------------
139 static int ReadAdc(int ch)
140 {
141 uint32_t d;
142
143 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
144 AT91C_BASE_ADC->ADC_MR =
145 ADC_MODE_PRESCALE(32) |
146 ADC_MODE_STARTUP_TIME(16) |
147 ADC_MODE_SAMPLE_HOLD_TIME(8);
148 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
149
150 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
151 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
152 ;
153 d = AT91C_BASE_ADC->ADC_CDR[ch];
154
155 return d;
156 }
157
158 int AvgAdc(int ch) // was static - merlok
159 {
160 int i;
161 int a = 0;
162
163 for(i = 0; i < 32; i++) {
164 a += ReadAdc(ch);
165 }
166
167 return (a + 15) >> 5;
168 }
169
170 void MeasureAntennaTuning(void)
171 {
172 uint8_t *dest = (uint8_t *)BigBuf + FREE_BUFFER_OFFSET;
173 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
174 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
175
176 LED_B_ON();
177 DbpString("Measuring antenna characteristics, please wait...");
178 memset(dest,0,FREE_BUFFER_SIZE);
179
180 /*
181 * Sweeps the useful LF range of the proxmark from
182 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
183 * read the voltage in the antenna, the result left
184 * in the buffer is a graph which should clearly show
185 * the resonating frequency of your LF antenna
186 * ( hopefully around 95 if it is tuned to 125kHz!)
187 */
188
189 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
190 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
191 for (i=255; i>19; i--) {
192 WDT_HIT();
193 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
194 SpinDelay(20);
195 // Vref = 3.3V, and a 10000:240 voltage divider on the input
196 // can measure voltages up to 137500 mV
197 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
198 if (i==95) vLf125 = adcval; // voltage at 125Khz
199 if (i==89) vLf134 = adcval; // voltage at 134Khz
200
201 dest[i] = adcval>>8; // scale int to fit in byte for graphing purposes
202 if(dest[i] > peak) {
203 peakv = adcval;
204 peak = dest[i];
205 peakf = i;
206 //ptr = i;
207 }
208 }
209
210 LED_A_ON();
211 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
212 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
213 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
214 SpinDelay(20);
215 // Vref = 3300mV, and an 10:1 voltage divider on the input
216 // can measure voltages up to 33000 mV
217 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
218
219 // c.cmd = CMD_MEASURED_ANTENNA_TUNING;
220 // c.arg[0] = (vLf125 << 0) | (vLf134 << 16);
221 // c.arg[1] = vHf;
222 // c.arg[2] = peakf | (peakv << 16);
223
224 DbpString("Measuring complete, sending report back to host");
225 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),0,0);
226 // UsbSendPacket((uint8_t *)&c, sizeof(c));
227 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
228 LED_A_OFF();
229 LED_B_OFF();
230 return;
231 }
232
233 void MeasureAntennaTuningHf(void)
234 {
235 int vHf = 0; // in mV
236
237 DbpString("Measuring HF antenna, press button to exit");
238
239 for (;;) {
240 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
241 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
242 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
243 SpinDelay(20);
244 // Vref = 3300mV, and an 10:1 voltage divider on the input
245 // can measure voltages up to 33000 mV
246 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
247
248 Dbprintf("%d mV",vHf);
249 if (BUTTON_PRESS()) break;
250 }
251 DbpString("cancelled");
252 }
253
254
255 void SimulateTagHfListen(void)
256 {
257 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
258 uint8_t v = 0;
259 int i;
260 int p = 0;
261
262 // We're using this mode just so that I can test it out; the simulated
263 // tag mode would work just as well and be simpler.
264 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
265 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
266
267 // We need to listen to the high-frequency, peak-detected path.
268 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
269
270 FpgaSetupSsc();
271
272 i = 0;
273 for(;;) {
274 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
275 AT91C_BASE_SSC->SSC_THR = 0xff;
276 }
277 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
278 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
279
280 v <<= 1;
281 if(r & 1) {
282 v |= 1;
283 }
284 p++;
285
286 if(p >= 8) {
287 dest[i] = v;
288 v = 0;
289 p = 0;
290 i++;
291
292 if(i >= FREE_BUFFER_SIZE) {
293 break;
294 }
295 }
296 }
297 }
298 DbpString("simulate tag (now type bitsamples)");
299 }
300
301 void ReadMem(int addr)
302 {
303 const uint8_t *data = ((uint8_t *)addr);
304
305 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
306 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
307 }
308
309 /* osimage version information is linked in */
310 extern struct version_information version_information;
311 /* bootrom version information is pointed to from _bootphase1_version_pointer */
312 extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
313 void SendVersion(void)
314 {
315 char temp[512]; /* Limited data payload in USB packets */
316 DbpString("Prox/RFID mark3 RFID instrument");
317
318 /* Try to find the bootrom version information. Expect to find a pointer at
319 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
320 * pointer, then use it.
321 */
322 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
323 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
324 DbpString("bootrom version information appears invalid");
325 } else {
326 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
327 DbpString(temp);
328 }
329
330 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
331 DbpString(temp);
332
333 FpgaGatherVersion(temp, sizeof(temp));
334 DbpString(temp);
335 // Send Chip ID
336 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
337 }
338
339 #ifdef WITH_LF
340 // samy's sniff and repeat routine
341 void SamyRun()
342 {
343 DbpString("Stand-alone mode! No PC necessary.");
344 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
345
346 // 3 possible options? no just 2 for now
347 #define OPTS 2
348
349 int high[OPTS], low[OPTS];
350
351 // Oooh pretty -- notify user we're in elite samy mode now
352 LED(LED_RED, 200);
353 LED(LED_ORANGE, 200);
354 LED(LED_GREEN, 200);
355 LED(LED_ORANGE, 200);
356 LED(LED_RED, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_GREEN, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_RED, 200);
361
362 int selected = 0;
363 int playing = 0;
364 int cardRead = 0;
365
366 // Turn on selected LED
367 LED(selected + 1, 0);
368
369 for (;;)
370 {
371 usb_poll();
372 WDT_HIT();
373
374 // Was our button held down or pressed?
375 int button_pressed = BUTTON_HELD(1000);
376 SpinDelay(300);
377
378 // Button was held for a second, begin recording
379 if (button_pressed > 0 && cardRead == 0)
380 {
381 LEDsoff();
382 LED(selected + 1, 0);
383 LED(LED_RED2, 0);
384
385 // record
386 DbpString("Starting recording");
387
388 // wait for button to be released
389 while(BUTTON_PRESS())
390 WDT_HIT();
391
392 /* need this delay to prevent catching some weird data */
393 SpinDelay(500);
394
395 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
396 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
397
398 LEDsoff();
399 LED(selected + 1, 0);
400 // Finished recording
401
402 // If we were previously playing, set playing off
403 // so next button push begins playing what we recorded
404 playing = 0;
405
406 cardRead = 1;
407
408 }
409
410 else if (button_pressed > 0 && cardRead == 1)
411 {
412 LEDsoff();
413 LED(selected + 1, 0);
414 LED(LED_ORANGE, 0);
415
416 // record
417 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
418
419 // wait for button to be released
420 while(BUTTON_PRESS())
421 WDT_HIT();
422
423 /* need this delay to prevent catching some weird data */
424 SpinDelay(500);
425
426 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
427 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
428
429 LEDsoff();
430 LED(selected + 1, 0);
431 // Finished recording
432
433 // If we were previously playing, set playing off
434 // so next button push begins playing what we recorded
435 playing = 0;
436
437 cardRead = 0;
438
439 }
440
441 // Change where to record (or begin playing)
442 else if (button_pressed)
443 {
444 // Next option if we were previously playing
445 if (playing)
446 selected = (selected + 1) % OPTS;
447 playing = !playing;
448
449 LEDsoff();
450 LED(selected + 1, 0);
451
452 // Begin transmitting
453 if (playing)
454 {
455 LED(LED_GREEN, 0);
456 DbpString("Playing");
457 // wait for button to be released
458 while(BUTTON_PRESS())
459 WDT_HIT();
460 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
461 CmdHIDsimTAG(high[selected], low[selected], 0);
462 DbpString("Done playing");
463 if (BUTTON_HELD(1000) > 0)
464 {
465 DbpString("Exiting");
466 LEDsoff();
467 return;
468 }
469
470 /* We pressed a button so ignore it here with a delay */
471 SpinDelay(300);
472
473 // when done, we're done playing, move to next option
474 selected = (selected + 1) % OPTS;
475 playing = !playing;
476 LEDsoff();
477 LED(selected + 1, 0);
478 }
479 else
480 while(BUTTON_PRESS())
481 WDT_HIT();
482 }
483 }
484 }
485 #endif
486
487 /*
488 OBJECTIVE
489 Listen and detect an external reader. Determine the best location
490 for the antenna.
491
492 INSTRUCTIONS:
493 Inside the ListenReaderField() function, there is two mode.
494 By default, when you call the function, you will enter mode 1.
495 If you press the PM3 button one time, you will enter mode 2.
496 If you press the PM3 button a second time, you will exit the function.
497
498 DESCRIPTION OF MODE 1:
499 This mode just listens for an external reader field and lights up green
500 for HF and/or red for LF. This is the original mode of the detectreader
501 function.
502
503 DESCRIPTION OF MODE 2:
504 This mode will visually represent, using the LEDs, the actual strength of the
505 current compared to the maximum current detected. Basically, once you know
506 what kind of external reader is present, it will help you spot the best location to place
507 your antenna. You will probably not get some good results if there is a LF and a HF reader
508 at the same place! :-)
509
510 LIGHT SCHEME USED:
511 */
512 static const char LIGHT_SCHEME[] = {
513 0x0, /* ---- | No field detected */
514 0x1, /* X--- | 14% of maximum current detected */
515 0x2, /* -X-- | 29% of maximum current detected */
516 0x4, /* --X- | 43% of maximum current detected */
517 0x8, /* ---X | 57% of maximum current detected */
518 0xC, /* --XX | 71% of maximum current detected */
519 0xE, /* -XXX | 86% of maximum current detected */
520 0xF, /* XXXX | 100% of maximum current detected */
521 };
522 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
523
524 void ListenReaderField(int limit)
525 {
526 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
527 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
528 int mode=1, display_val, display_max, i;
529
530 #define LF_ONLY 1
531 #define HF_ONLY 2
532
533 LEDsoff();
534
535 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
536
537 if(limit != HF_ONLY) {
538 Dbprintf("LF 125/134 Baseline: %d", lf_av);
539 lf_baseline = lf_av;
540 }
541
542 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
543
544 if (limit != LF_ONLY) {
545 Dbprintf("HF 13.56 Baseline: %d", hf_av);
546 hf_baseline = hf_av;
547 }
548
549 for(;;) {
550 if (BUTTON_PRESS()) {
551 SpinDelay(500);
552 switch (mode) {
553 case 1:
554 mode=2;
555 DbpString("Signal Strength Mode");
556 break;
557 case 2:
558 default:
559 DbpString("Stopped");
560 LEDsoff();
561 return;
562 break;
563 }
564 }
565 WDT_HIT();
566
567 if (limit != HF_ONLY) {
568 if(mode==1) {
569 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
570 else LED_D_OFF();
571 }
572
573 ++lf_count;
574 lf_av_new= ReadAdc(ADC_CHAN_LF);
575 // see if there's a significant change
576 if(abs(lf_av - lf_av_new) > 10) {
577 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
578 lf_av = lf_av_new;
579 if (lf_av > lf_max)
580 lf_max = lf_av;
581 lf_count= 0;
582 }
583 }
584
585 if (limit != LF_ONLY) {
586 if (mode == 1){
587 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
588 else LED_B_OFF();
589 }
590
591 ++hf_count;
592 hf_av_new= ReadAdc(ADC_CHAN_HF);
593 // see if there's a significant change
594 if(abs(hf_av - hf_av_new) > 10) {
595 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
596 hf_av = hf_av_new;
597 if (hf_av > hf_max)
598 hf_max = hf_av;
599 hf_count= 0;
600 }
601 }
602
603 if(mode == 2) {
604 if (limit == LF_ONLY) {
605 display_val = lf_av;
606 display_max = lf_max;
607 } else if (limit == HF_ONLY) {
608 display_val = hf_av;
609 display_max = hf_max;
610 } else { /* Pick one at random */
611 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
612 display_val = hf_av;
613 display_max = hf_max;
614 } else {
615 display_val = lf_av;
616 display_max = lf_max;
617 }
618 }
619 for (i=0; i<LIGHT_LEN; i++) {
620 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
621 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
622 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
623 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
624 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
625 break;
626 }
627 }
628 }
629 }
630 }
631
632 void UsbPacketReceived(uint8_t *packet, int len)
633 {
634 UsbCommand *c = (UsbCommand *)packet;
635
636 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
637
638 switch(c->cmd) {
639 #ifdef WITH_LF
640 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
641 AcquireRawAdcSamples125k(c->arg[0]);
642 cmd_send(CMD_ACK,0,0,0,0,0);
643 break;
644 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
645 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
646 break;
647 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
648 SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
649 cmd_send(CMD_ACK,0,0,0,0,0);
650 break;
651 case CMD_HID_DEMOD_FSK:
652 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
653 break;
654 case CMD_HID_SIM_TAG:
655 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
656 break;
657 case CMD_HID_CLONE_TAG:
658 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
659 break;
660 case CMD_IO_DEMOD_FSK:
661 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
662 break;
663 case CMD_IO_CLONE_TAG:
664 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
665 break;
666 case CMD_EM410X_WRITE_TAG:
667 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
668 break;
669 case CMD_READ_TI_TYPE:
670 ReadTItag();
671 break;
672 case CMD_WRITE_TI_TYPE:
673 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
674 break;
675 case CMD_SIMULATE_TAG_125K:
676 SimulateTagLowFrequency(c->arg[0], c->arg[1], 0);
677 //SimulateTagLowFrequencyA(c->arg[0], c->arg[1]);
678 break;
679 case CMD_LF_SIMULATE_BIDIR:
680 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
681 break;
682 case CMD_INDALA_CLONE_TAG:
683 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
684 break;
685 case CMD_INDALA_CLONE_TAG_L:
686 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
687 break;
688 case CMD_T55XX_READ_BLOCK:
689 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
690 break;
691 case CMD_T55XX_WRITE_BLOCK:
692 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
693 break;
694 case CMD_T55XX_READ_TRACE:
695 T55xxReadTrace();
696 break;
697 case CMD_PCF7931_READ:
698 ReadPCF7931();
699 cmd_send(CMD_ACK,0,0,0,0,0);
700 break;
701 case CMD_EM4X_READ_WORD:
702 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
703 break;
704 case CMD_EM4X_WRITE_WORD:
705 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
706 break;
707 #endif
708
709 #ifdef WITH_HITAG
710 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
711 SnoopHitag(c->arg[0]);
712 break;
713 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
714 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
715 break;
716 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
717 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
718 break;
719 #endif
720
721 #ifdef WITH_ISO15693
722 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
723 AcquireRawAdcSamplesIso15693();
724 break;
725 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
726 RecordRawAdcSamplesIso15693();
727 break;
728
729 case CMD_ISO_15693_COMMAND:
730 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
731 break;
732
733 case CMD_ISO_15693_FIND_AFI:
734 BruteforceIso15693Afi(c->arg[0]);
735 break;
736
737 case CMD_ISO_15693_DEBUG:
738 SetDebugIso15693(c->arg[0]);
739 break;
740
741 case CMD_READER_ISO_15693:
742 ReaderIso15693(c->arg[0]);
743 break;
744 case CMD_SIMTAG_ISO_15693:
745 SimTagIso15693(c->arg[0], c->d.asBytes);
746 break;
747 #endif
748
749 #ifdef WITH_LEGICRF
750 case CMD_SIMULATE_TAG_LEGIC_RF:
751 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
752 break;
753
754 case CMD_WRITER_LEGIC_RF:
755 LegicRfWriter(c->arg[1], c->arg[0]);
756 break;
757
758 case CMD_READER_LEGIC_RF:
759 LegicRfReader(c->arg[0], c->arg[1]);
760 break;
761 #endif
762
763 #ifdef WITH_ISO14443b
764 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
765 AcquireRawAdcSamplesIso14443(c->arg[0]);
766 break;
767 case CMD_READ_SRI512_TAG:
768 ReadSTMemoryIso14443(0x0F);
769 break;
770 case CMD_READ_SRIX4K_TAG:
771 ReadSTMemoryIso14443(0x7F);
772 break;
773 case CMD_SNOOP_ISO_14443:
774 SnoopIso14443();
775 break;
776 case CMD_SIMULATE_TAG_ISO_14443:
777 SimulateIso14443Tag();
778 break;
779 case CMD_ISO_14443B_COMMAND:
780 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
781 break;
782 #endif
783
784 #ifdef WITH_ISO14443a
785 case CMD_SNOOP_ISO_14443a:
786 SnoopIso14443a(c->arg[0]);
787 break;
788 case CMD_READER_ISO_14443a:
789 ReaderIso14443a(c);
790 break;
791 case CMD_SIMULATE_TAG_ISO_14443a:
792 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
793 break;
794
795 case CMD_EPA_PACE_COLLECT_NONCE:
796 EPA_PACE_Collect_Nonce(c);
797 break;
798
799 // case CMD_EPA_:
800 // EpaFoo(c);
801 // break;
802
803 case CMD_READER_MIFARE:
804 ReaderMifare(c->arg[0]);
805 break;
806 case CMD_MIFARE_READBL:
807 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
808 break;
809 case CMD_MIFAREU_READBL:
810 MifareUReadBlock(c->arg[0],c->d.asBytes);
811 break;
812 case CMD_MIFAREUC_AUTH1:
813 MifareUC_Auth1(c->arg[0],c->d.asBytes);
814 break;
815 case CMD_MIFAREUC_AUTH2:
816 MifareUC_Auth2(c->arg[0],c->d.asBytes);
817 break;
818 case CMD_MIFAREU_READCARD:
819 MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
820 break;
821 case CMD_MIFAREUC_READCARD:
822 MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
823 break;
824 case CMD_MIFARE_READSC:
825 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
826 break;
827 case CMD_MIFARE_WRITEBL:
828 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
829 break;
830 case CMD_MIFAREU_WRITEBL_COMPAT:
831 MifareUWriteBlock(c->arg[0], c->d.asBytes);
832 break;
833 case CMD_MIFAREU_WRITEBL:
834 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
835 break;
836 case CMD_MIFARE_NESTED:
837 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
838 break;
839 case CMD_MIFARE_CHKKEYS:
840 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
841 break;
842 case CMD_SIMULATE_MIFARE_CARD:
843 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
844 break;
845
846 // emulator
847 case CMD_MIFARE_SET_DBGMODE:
848 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
849 break;
850 case CMD_MIFARE_EML_MEMCLR:
851 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
852 break;
853 case CMD_MIFARE_EML_MEMSET:
854 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
855 break;
856 case CMD_MIFARE_EML_MEMGET:
857 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
858 break;
859 case CMD_MIFARE_EML_CARDLOAD:
860 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
861 break;
862
863 // Work with "magic Chinese" card
864 case CMD_MIFARE_EML_CSETBLOCK:
865 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
866 break;
867 case CMD_MIFARE_EML_CGETBLOCK:
868 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
869 break;
870
871 // mifare sniffer
872 case CMD_MIFARE_SNIFFER:
873 SniffMifare(c->arg[0]);
874 break;
875
876 // mifare desfire
877 case CMD_MIFARE_DESFIRE_READBL:
878 break;
879 case CMD_MIFARE_DESFIRE_WRITEBL:
880 break;
881 case CMD_MIFARE_DESFIRE_AUTH1:
882 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
883 break;
884 case CMD_MIFARE_DESFIRE_AUTH2:
885 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
886 break;
887 // case CMD_MIFARE_DES_READER:
888 // ReaderMifareDES(c->arg[0], c->arg[1], c->d.asBytes);
889 //break;
890 case CMD_MIFARE_DESFIRE_INFO:
891 MifareDesfireGetInformation();
892 break;
893 case CMD_MIFARE_DESFIRE:
894 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
895 break;
896
897 #endif
898
899 #ifdef WITH_ICLASS
900 // Makes use of ISO14443a FPGA Firmware
901 case CMD_SNOOP_ICLASS:
902 SnoopIClass();
903 break;
904 case CMD_SIMULATE_TAG_ICLASS:
905 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
906 break;
907 case CMD_READER_ICLASS:
908 ReaderIClass(c->arg[0]);
909 break;
910 case CMD_READER_ICLASS_REPLAY:
911 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
912 break;
913 #endif
914
915 case CMD_SIMULATE_TAG_HF_LISTEN:
916 SimulateTagHfListen();
917 break;
918
919 case CMD_BUFF_CLEAR:
920 BufferClear();
921 break;
922
923 case CMD_MEASURE_ANTENNA_TUNING:
924 MeasureAntennaTuning();
925 break;
926
927 case CMD_MEASURE_ANTENNA_TUNING_HF:
928 MeasureAntennaTuningHf();
929 break;
930
931 case CMD_LISTEN_READER_FIELD:
932 ListenReaderField(c->arg[0]);
933 break;
934
935 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
936 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
937 SpinDelay(200);
938 LED_D_OFF(); // LED D indicates field ON or OFF
939 break;
940
941 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
942
943 LED_B_ON();
944 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
945 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
946 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
947 }
948 // Trigger a finish downloading signal with an ACK frame
949 cmd_send(CMD_ACK,0,0,0,0,0);
950 LED_B_OFF();
951 break;
952
953 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
954 uint8_t *b = (uint8_t *)BigBuf;
955 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
956 cmd_send(CMD_ACK,0,0,0,0,0);
957 break;
958 }
959 case CMD_READ_MEM:
960 ReadMem(c->arg[0]);
961 break;
962
963 case CMD_SET_LF_DIVISOR:
964 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
965 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
966 break;
967
968 case CMD_SET_ADC_MUX:
969 switch(c->arg[0]) {
970 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
971 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
972 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
973 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
974 }
975 break;
976
977 case CMD_VERSION:
978 SendVersion();
979 break;
980
981 #ifdef WITH_LCD
982 case CMD_LCD_RESET:
983 LCDReset();
984 break;
985 case CMD_LCD:
986 LCDSend(c->arg[0]);
987 break;
988 #endif
989 case CMD_SETUP_WRITE:
990 case CMD_FINISH_WRITE:
991 case CMD_HARDWARE_RESET:
992 usb_disable();
993 SpinDelay(1000);
994 SpinDelay(1000);
995 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
996 for(;;) {
997 // We're going to reset, and the bootrom will take control.
998 }
999 break;
1000
1001 case CMD_START_FLASH:
1002 if(common_area.flags.bootrom_present) {
1003 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1004 }
1005 usb_disable();
1006 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1007 for(;;);
1008 break;
1009
1010 case CMD_DEVICE_INFO: {
1011 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1012 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1013 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1014 break;
1015 }
1016 default:
1017 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1018 break;
1019 }
1020 }
1021
1022 void __attribute__((noreturn)) AppMain(void)
1023 {
1024 SpinDelay(100);
1025
1026 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1027 /* Initialize common area */
1028 memset(&common_area, 0, sizeof(common_area));
1029 common_area.magic = COMMON_AREA_MAGIC;
1030 common_area.version = 1;
1031 }
1032 common_area.flags.osimage_present = 1;
1033
1034 LED_D_OFF();
1035 LED_C_OFF();
1036 LED_B_OFF();
1037 LED_A_OFF();
1038
1039 // Init USB device
1040 usb_enable();
1041
1042 // The FPGA gets its clock from us from PCK0 output, so set that up.
1043 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1044 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1045 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1046 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1047 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1048 AT91C_PMC_PRES_CLK_4;
1049 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1050
1051 // Reset SPI
1052 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1053 // Reset SSC
1054 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1055
1056 // Load the FPGA image, which we have stored in our flash.
1057 // (the HF version by default)
1058 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1059
1060 StartTickCount();
1061
1062 #ifdef WITH_LCD
1063 LCDInit();
1064 #endif
1065
1066 byte_t rx[sizeof(UsbCommand)];
1067 size_t rx_len;
1068
1069 for(;;) {
1070 if (usb_poll()) {
1071 rx_len = usb_read(rx,sizeof(UsbCommand));
1072 if (rx_len) {
1073 UsbPacketReceived(rx,rx_len);
1074 }
1075 }
1076 WDT_HIT();
1077
1078 #ifdef WITH_LF
1079 if (BUTTON_HELD(1000) > 0)
1080 SamyRun();
1081 #endif
1082 }
1083 }
Proxmark3 GIT tracking
Impressum, Datenschutz