]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #167 from spenneb/master
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include <hitagS.h>
27 #include "lfsampling.h"
28 #include "BigBuf.h"
29 #include "mifareutil.h"
30 #include "pcf7931.h"
31 #ifdef WITH_LCD
32 #include "LCD.h"
33 #endif
34
35 // Craig Young - 14a stand-alone code
36 #ifdef WITH_ISO14443a_StandAlone
37 #include "iso14443a.h"
38 #endif
39
40 #define abs(x) ( ((x)<0) ? -(x) : (x) )
41
42 //=============================================================================
43 // A buffer where we can queue things up to be sent through the FPGA, for
44 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
45 // is the order in which they go out on the wire.
46 //=============================================================================
47
48 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
49 uint8_t ToSend[TOSEND_BUFFER_SIZE];
50 int ToSendMax;
51 static int ToSendBit;
52 struct common_area common_area __attribute__((section(".commonarea")));
53
54 void ToSendReset(void)
55 {
56 ToSendMax = -1;
57 ToSendBit = 8;
58 }
59
60 void ToSendStuffBit(int b)
61 {
62 if(ToSendBit >= 8) {
63 ToSendMax++;
64 ToSend[ToSendMax] = 0;
65 ToSendBit = 0;
66 }
67
68 if(b) {
69 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
70 }
71
72 ToSendBit++;
73
74 if(ToSendMax >= sizeof(ToSend)) {
75 ToSendBit = 0;
76 DbpString("ToSendStuffBit overflowed!");
77 }
78 }
79
80 //=============================================================================
81 // Debug print functions, to go out over USB, to the usual PC-side client.
82 //=============================================================================
83
84 void DbpString(char *str)
85 {
86 byte_t len = strlen(str);
87 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
88 }
89
90 #if 0
91 void DbpIntegers(int x1, int x2, int x3)
92 {
93 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
94 }
95 #endif
96
97 void Dbprintf(const char *fmt, ...) {
98 // should probably limit size here; oh well, let's just use a big buffer
99 char output_string[128];
100 va_list ap;
101
102 va_start(ap, fmt);
103 kvsprintf(fmt, output_string, 10, ap);
104 va_end(ap);
105
106 DbpString(output_string);
107 }
108
109 // prints HEX & ASCII
110 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
111 int l=0,i;
112 char ascii[9];
113
114 while (len>0) {
115 if (len>8) l=8;
116 else l=len;
117
118 memcpy(ascii,d,l);
119 ascii[l]=0;
120
121 // filter safe ascii
122 for (i=0;i<l;i++)
123 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
124
125 if (bAsci) {
126 Dbprintf("%-8s %*D",ascii,l,d," ");
127 } else {
128 Dbprintf("%*D",l,d," ");
129 }
130
131 len-=8;
132 d+=8;
133 }
134 }
135
136 //-----------------------------------------------------------------------------
137 // Read an ADC channel and block till it completes, then return the result
138 // in ADC units (0 to 1023). Also a routine to average 32 samples and
139 // return that.
140 //-----------------------------------------------------------------------------
141 static int ReadAdc(int ch)
142 {
143 uint32_t d;
144
145 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
146 AT91C_BASE_ADC->ADC_MR =
147 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
148 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
149 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
150
151 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
152 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
153 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
154 //
155 // The maths are:
156 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
157 //
158 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
159 //
160 // Note: with the "historic" values in the comments above, the error was 34% !!!
161
162 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
163
164 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
165
166 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
167 ;
168 d = AT91C_BASE_ADC->ADC_CDR[ch];
169
170 return d;
171 }
172
173 int AvgAdc(int ch) // was static - merlok
174 {
175 int i;
176 int a = 0;
177
178 for(i = 0; i < 32; i++) {
179 a += ReadAdc(ch);
180 }
181
182 return (a + 15) >> 5;
183 }
184
185 void MeasureAntennaTuning(void)
186 {
187 uint8_t LF_Results[256];
188 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
189 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
190
191 LED_B_ON();
192
193 /*
194 * Sweeps the useful LF range of the proxmark from
195 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
196 * read the voltage in the antenna, the result left
197 * in the buffer is a graph which should clearly show
198 * the resonating frequency of your LF antenna
199 * ( hopefully around 95 if it is tuned to 125kHz!)
200 */
201
202 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
203 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
204 for (i=255; i>=19; i--) {
205 WDT_HIT();
206 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
207 SpinDelay(20);
208 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
209 if (i==95) vLf125 = adcval; // voltage at 125Khz
210 if (i==89) vLf134 = adcval; // voltage at 134Khz
211
212 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
213 if(LF_Results[i] > peak) {
214 peakv = adcval;
215 peak = LF_Results[i];
216 peakf = i;
217 //ptr = i;
218 }
219 }
220
221 for (i=18; i >= 0; i--) LF_Results[i] = 0;
222
223 LED_A_ON();
224 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
225 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
226 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
227 SpinDelay(20);
228 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
229
230 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
231 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
232 LED_A_OFF();
233 LED_B_OFF();
234 return;
235 }
236
237 void MeasureAntennaTuningHf(void)
238 {
239 int vHf = 0; // in mV
240
241 DbpString("Measuring HF antenna, press button to exit");
242
243 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
244 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
245 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
246
247 for (;;) {
248 SpinDelay(20);
249 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
250
251 Dbprintf("%d mV",vHf);
252 if (BUTTON_PRESS()) break;
253 }
254 DbpString("cancelled");
255
256 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
257
258 }
259
260
261 void ReadMem(int addr)
262 {
263 const uint8_t *data = ((uint8_t *)addr);
264
265 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
266 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
267 }
268
269 /* osimage version information is linked in */
270 extern struct version_information version_information;
271 /* bootrom version information is pointed to from _bootphase1_version_pointer */
272 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
273 void SendVersion(void)
274 {
275 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
276 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
277
278 /* Try to find the bootrom version information. Expect to find a pointer at
279 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
280 * pointer, then use it.
281 */
282 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
283 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
284 strcat(VersionString, "bootrom version information appears invalid\n");
285 } else {
286 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
287 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
288 }
289
290 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
291 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
292
293 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
294 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
295 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
296 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
297
298 // Send Chip ID and used flash memory
299 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
300 uint32_t compressed_data_section_size = common_area.arg1;
301 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
302 }
303
304 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
305 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
306 void printUSBSpeed(void)
307 {
308 Dbprintf("USB Speed:");
309 Dbprintf(" Sending USB packets to client...");
310
311 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
312 uint8_t *test_data = BigBuf_get_addr();
313 uint32_t end_time;
314
315 uint32_t start_time = end_time = GetTickCount();
316 uint32_t bytes_transferred = 0;
317
318 LED_B_ON();
319 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
320 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
321 end_time = GetTickCount();
322 bytes_transferred += USB_CMD_DATA_SIZE;
323 }
324 LED_B_OFF();
325
326 Dbprintf(" Time elapsed: %dms", end_time - start_time);
327 Dbprintf(" Bytes transferred: %d", bytes_transferred);
328 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
329 1000 * bytes_transferred / (end_time - start_time));
330
331 }
332
333 /**
334 * Prints runtime information about the PM3.
335 **/
336 void SendStatus(void)
337 {
338 BigBuf_print_status();
339 Fpga_print_status();
340 printConfig(); //LF Sampling config
341 printUSBSpeed();
342 Dbprintf("Various");
343 Dbprintf(" MF_DBGLEVEL......%d", MF_DBGLEVEL);
344 Dbprintf(" ToSendMax........%d",ToSendMax);
345 Dbprintf(" ToSendBit........%d",ToSendBit);
346
347 cmd_send(CMD_ACK,1,0,0,0,0);
348 }
349
350 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
351
352 #define OPTS 2
353
354 void StandAloneMode()
355 {
356 DbpString("Stand-alone mode! No PC necessary.");
357 // Oooh pretty -- notify user we're in elite samy mode now
358 LED(LED_RED, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_GREEN, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_RED, 200);
363 LED(LED_ORANGE, 200);
364 LED(LED_GREEN, 200);
365 LED(LED_ORANGE, 200);
366 LED(LED_RED, 200);
367
368 }
369
370 #endif
371
372
373
374 #ifdef WITH_ISO14443a_StandAlone
375 void StandAloneMode14a()
376 {
377 StandAloneMode();
378 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
379
380 int selected = 0;
381 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
382 int cardRead[OPTS] = {0};
383 uint8_t readUID[10] = {0};
384 uint32_t uid_1st[OPTS]={0};
385 uint32_t uid_2nd[OPTS]={0};
386 uint32_t uid_tmp1 = 0;
387 uint32_t uid_tmp2 = 0;
388 iso14a_card_select_t hi14a_card[OPTS];
389
390 LED(selected + 1, 0);
391
392 for (;;)
393 {
394 usb_poll();
395 WDT_HIT();
396 SpinDelay(300);
397
398 if (iGotoRecord == 1 || cardRead[selected] == 0)
399 {
400 iGotoRecord = 0;
401 LEDsoff();
402 LED(selected + 1, 0);
403 LED(LED_RED2, 0);
404
405 // record
406 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
407 /* need this delay to prevent catching some weird data */
408 SpinDelay(500);
409 /* Code for reading from 14a tag */
410 uint8_t uid[10] ={0};
411 uint32_t cuid;
412 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
413
414 for ( ; ; )
415 {
416 WDT_HIT();
417 if (BUTTON_PRESS()) {
418 if (cardRead[selected]) {
419 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
420 break;
421 }
422 else if (cardRead[(selected+1)%OPTS]) {
423 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
424 selected = (selected+1)%OPTS;
425 break; // playing = 1;
426 }
427 else {
428 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
429 SpinDelay(300);
430 }
431 }
432 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
433 continue;
434 else
435 {
436 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
437 memcpy(readUID,uid,10*sizeof(uint8_t));
438 uint8_t *dst = (uint8_t *)&uid_tmp1;
439 // Set UID byte order
440 for (int i=0; i<4; i++)
441 dst[i] = uid[3-i];
442 dst = (uint8_t *)&uid_tmp2;
443 for (int i=0; i<4; i++)
444 dst[i] = uid[7-i];
445 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
446 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
447 }
448 else {
449 if (uid_tmp2) {
450 Dbprintf("Bank[%d] received a 7-byte UID",selected);
451 uid_1st[selected] = (uid_tmp1)>>8;
452 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
453 }
454 else {
455 Dbprintf("Bank[%d] received a 4-byte UID",selected);
456 uid_1st[selected] = uid_tmp1;
457 uid_2nd[selected] = uid_tmp2;
458 }
459 break;
460 }
461 }
462 }
463 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
464 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
465 LEDsoff();
466 LED(LED_GREEN, 200);
467 LED(LED_ORANGE, 200);
468 LED(LED_GREEN, 200);
469 LED(LED_ORANGE, 200);
470
471 LEDsoff();
472 LED(selected + 1, 0);
473
474 // Next state is replay:
475 playing = 1;
476
477 cardRead[selected] = 1;
478 }
479 /* MF Classic UID clone */
480 else if (iGotoClone==1)
481 {
482 iGotoClone=0;
483 LEDsoff();
484 LED(selected + 1, 0);
485 LED(LED_ORANGE, 250);
486
487
488 // record
489 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
490
491 // wait for button to be released
492 while(BUTTON_PRESS())
493 {
494 // Delay cloning until card is in place
495 WDT_HIT();
496 }
497 Dbprintf("Starting clone. [Bank: %u]", selected);
498 // need this delay to prevent catching some weird data
499 SpinDelay(500);
500 // Begin clone function here:
501 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
502 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
503 memcpy(c.d.asBytes, data, 16);
504 SendCommand(&c);
505
506 Block read is similar:
507 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
508 We need to imitate that call with blockNo 0 to set a uid.
509
510 The get and set commands are handled in this file:
511 // Work with "magic Chinese" card
512 case CMD_MIFARE_CSETBLOCK:
513 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
514 break;
515 case CMD_MIFARE_CGETBLOCK:
516 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
517 break;
518
519 mfCSetUID provides example logic for UID set workflow:
520 -Read block0 from card in field with MifareCGetBlock()
521 -Configure new values without replacing reserved bytes
522 memcpy(block0, uid, 4); // Copy UID bytes from byte array
523 // Mifare UID BCC
524 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
525 Bytes 5-7 are reserved SAK and ATQA for mifare classic
526 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
527 */
528 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
529 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
530 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
531 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
532 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
533 playing = 1;
534 }
535 else {
536 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
537 memcpy(newBlock0,oldBlock0,16);
538 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
539
540 newBlock0[0] = uid_1st[selected]>>24;
541 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
542 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
543 newBlock0[3] = 0xFF & (uid_1st[selected]);
544 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
545 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
546 MifareCSetBlock(0, 0xFF,0, newBlock0);
547 MifareCGetBlock(0x3F, 1, 0, testBlock0);
548 if (memcmp(testBlock0,newBlock0,16)==0)
549 {
550 DbpString("Cloned successfull!");
551 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
552 playing = 0;
553 iGotoRecord = 1;
554 selected = (selected+1) % OPTS;
555 }
556 else {
557 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
558 playing = 1;
559 }
560 }
561 LEDsoff();
562 LED(selected + 1, 0);
563
564 }
565 // Change where to record (or begin playing)
566 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
567 {
568 LEDsoff();
569 LED(selected + 1, 0);
570
571 // Begin transmitting
572 if (playing)
573 {
574 LED(LED_GREEN, 0);
575 DbpString("Playing");
576 for ( ; ; ) {
577 WDT_HIT();
578 int button_action = BUTTON_HELD(1000);
579 if (button_action == 0) { // No button action, proceed with sim
580 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
581 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
582 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
583 DbpString("Mifare Classic");
584 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
585 }
586 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
587 DbpString("Mifare Ultralight");
588 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
589 }
590 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
591 DbpString("Mifare DESFire");
592 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
593 }
594 else {
595 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
596 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
597 }
598 }
599 else if (button_action == BUTTON_SINGLE_CLICK) {
600 selected = (selected + 1) % OPTS;
601 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
602 iGotoRecord = 1;
603 break;
604 }
605 else if (button_action == BUTTON_HOLD) {
606 Dbprintf("Playtime over. Begin cloning...");
607 iGotoClone = 1;
608 break;
609 }
610 WDT_HIT();
611 }
612
613 /* We pressed a button so ignore it here with a delay */
614 SpinDelay(300);
615 LEDsoff();
616 LED(selected + 1, 0);
617 }
618 else
619 while(BUTTON_PRESS())
620 WDT_HIT();
621 }
622 }
623 }
624 #elif WITH_LF
625 // samy's sniff and repeat routine
626 void SamyRun()
627 {
628 StandAloneMode();
629 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
630
631 int high[OPTS], low[OPTS];
632 int selected = 0;
633 int playing = 0;
634 int cardRead = 0;
635
636 // Turn on selected LED
637 LED(selected + 1, 0);
638
639 for (;;)
640 {
641 usb_poll();
642 WDT_HIT();
643
644 // Was our button held down or pressed?
645 int button_pressed = BUTTON_HELD(1000);
646 SpinDelay(300);
647
648 // Button was held for a second, begin recording
649 if (button_pressed > 0 && cardRead == 0)
650 {
651 LEDsoff();
652 LED(selected + 1, 0);
653 LED(LED_RED2, 0);
654
655 // record
656 DbpString("Starting recording");
657
658 // wait for button to be released
659 while(BUTTON_PRESS())
660 WDT_HIT();
661
662 /* need this delay to prevent catching some weird data */
663 SpinDelay(500);
664
665 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
666 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
667
668 LEDsoff();
669 LED(selected + 1, 0);
670 // Finished recording
671
672 // If we were previously playing, set playing off
673 // so next button push begins playing what we recorded
674 playing = 0;
675
676 cardRead = 1;
677
678 }
679
680 else if (button_pressed > 0 && cardRead == 1)
681 {
682 LEDsoff();
683 LED(selected + 1, 0);
684 LED(LED_ORANGE, 0);
685
686 // record
687 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
688
689 // wait for button to be released
690 while(BUTTON_PRESS())
691 WDT_HIT();
692
693 /* need this delay to prevent catching some weird data */
694 SpinDelay(500);
695
696 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
697 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
698
699 LEDsoff();
700 LED(selected + 1, 0);
701 // Finished recording
702
703 // If we were previously playing, set playing off
704 // so next button push begins playing what we recorded
705 playing = 0;
706
707 cardRead = 0;
708
709 }
710
711 // Change where to record (or begin playing)
712 else if (button_pressed)
713 {
714 // Next option if we were previously playing
715 if (playing)
716 selected = (selected + 1) % OPTS;
717 playing = !playing;
718
719 LEDsoff();
720 LED(selected + 1, 0);
721
722 // Begin transmitting
723 if (playing)
724 {
725 LED(LED_GREEN, 0);
726 DbpString("Playing");
727 // wait for button to be released
728 while(BUTTON_PRESS())
729 WDT_HIT();
730 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
731 CmdHIDsimTAG(high[selected], low[selected], 0);
732 DbpString("Done playing");
733 if (BUTTON_HELD(1000) > 0)
734 {
735 DbpString("Exiting");
736 LEDsoff();
737 return;
738 }
739
740 /* We pressed a button so ignore it here with a delay */
741 SpinDelay(300);
742
743 // when done, we're done playing, move to next option
744 selected = (selected + 1) % OPTS;
745 playing = !playing;
746 LEDsoff();
747 LED(selected + 1, 0);
748 }
749 else
750 while(BUTTON_PRESS())
751 WDT_HIT();
752 }
753 }
754 }
755
756 #endif
757 /*
758 OBJECTIVE
759 Listen and detect an external reader. Determine the best location
760 for the antenna.
761
762 INSTRUCTIONS:
763 Inside the ListenReaderField() function, there is two mode.
764 By default, when you call the function, you will enter mode 1.
765 If you press the PM3 button one time, you will enter mode 2.
766 If you press the PM3 button a second time, you will exit the function.
767
768 DESCRIPTION OF MODE 1:
769 This mode just listens for an external reader field and lights up green
770 for HF and/or red for LF. This is the original mode of the detectreader
771 function.
772
773 DESCRIPTION OF MODE 2:
774 This mode will visually represent, using the LEDs, the actual strength of the
775 current compared to the maximum current detected. Basically, once you know
776 what kind of external reader is present, it will help you spot the best location to place
777 your antenna. You will probably not get some good results if there is a LF and a HF reader
778 at the same place! :-)
779
780 LIGHT SCHEME USED:
781 */
782 static const char LIGHT_SCHEME[] = {
783 0x0, /* ---- | No field detected */
784 0x1, /* X--- | 14% of maximum current detected */
785 0x2, /* -X-- | 29% of maximum current detected */
786 0x4, /* --X- | 43% of maximum current detected */
787 0x8, /* ---X | 57% of maximum current detected */
788 0xC, /* --XX | 71% of maximum current detected */
789 0xE, /* -XXX | 86% of maximum current detected */
790 0xF, /* XXXX | 100% of maximum current detected */
791 };
792 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
793
794 void ListenReaderField(int limit)
795 {
796 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
797 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
798 int mode=1, display_val, display_max, i;
799
800 #define LF_ONLY 1
801 #define HF_ONLY 2
802 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
803
804
805 // switch off FPGA - we don't want to measure our own signal
806 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
807 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
808
809 LEDsoff();
810
811 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
812
813 if(limit != HF_ONLY) {
814 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
815 lf_baseline = lf_av;
816 }
817
818 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
819
820 if (limit != LF_ONLY) {
821 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
822 hf_baseline = hf_av;
823 }
824
825 for(;;) {
826 if (BUTTON_PRESS()) {
827 SpinDelay(500);
828 switch (mode) {
829 case 1:
830 mode=2;
831 DbpString("Signal Strength Mode");
832 break;
833 case 2:
834 default:
835 DbpString("Stopped");
836 LEDsoff();
837 return;
838 break;
839 }
840 }
841 WDT_HIT();
842
843 if (limit != HF_ONLY) {
844 if(mode == 1) {
845 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
846 LED_D_ON();
847 else
848 LED_D_OFF();
849 }
850
851 lf_av_new = AvgAdc(ADC_CHAN_LF);
852 // see if there's a significant change
853 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
854 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
855 lf_av = lf_av_new;
856 if (lf_av > lf_max)
857 lf_max = lf_av;
858 }
859 }
860
861 if (limit != LF_ONLY) {
862 if (mode == 1){
863 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
864 LED_B_ON();
865 else
866 LED_B_OFF();
867 }
868
869 hf_av_new = AvgAdc(ADC_CHAN_HF);
870 // see if there's a significant change
871 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
872 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
873 hf_av = hf_av_new;
874 if (hf_av > hf_max)
875 hf_max = hf_av;
876 }
877 }
878
879 if(mode == 2) {
880 if (limit == LF_ONLY) {
881 display_val = lf_av;
882 display_max = lf_max;
883 } else if (limit == HF_ONLY) {
884 display_val = hf_av;
885 display_max = hf_max;
886 } else { /* Pick one at random */
887 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
888 display_val = hf_av;
889 display_max = hf_max;
890 } else {
891 display_val = lf_av;
892 display_max = lf_max;
893 }
894 }
895 for (i=0; i<LIGHT_LEN; i++) {
896 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
897 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
898 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
899 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
900 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
901 break;
902 }
903 }
904 }
905 }
906 }
907
908 void UsbPacketReceived(uint8_t *packet, int len)
909 {
910 UsbCommand *c = (UsbCommand *)packet;
911
912 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
913
914 switch(c->cmd) {
915 #ifdef WITH_LF
916 case CMD_SET_LF_SAMPLING_CONFIG:
917 setSamplingConfig((sample_config *) c->d.asBytes);
918 break;
919 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
920 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
921 break;
922 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
923 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
924 break;
925 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
926 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
927 break;
928 case CMD_HID_DEMOD_FSK:
929 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
930 break;
931 case CMD_HID_SIM_TAG:
932 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
933 break;
934 case CMD_FSK_SIM_TAG:
935 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
936 break;
937 case CMD_ASK_SIM_TAG:
938 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
939 break;
940 case CMD_PSK_SIM_TAG:
941 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
942 break;
943 case CMD_HID_CLONE_TAG:
944 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
945 break;
946 case CMD_IO_DEMOD_FSK:
947 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
948 break;
949 case CMD_IO_CLONE_TAG:
950 CopyIOtoT55x7(c->arg[0], c->arg[1]);
951 break;
952 case CMD_EM410X_DEMOD:
953 CmdEM410xdemod(c->arg[0], 0, 0, 1);
954 break;
955 case CMD_EM410X_WRITE_TAG:
956 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
957 break;
958 case CMD_READ_TI_TYPE:
959 ReadTItag();
960 break;
961 case CMD_WRITE_TI_TYPE:
962 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
963 break;
964 case CMD_SIMULATE_TAG_125K:
965 LED_A_ON();
966 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
967 LED_A_OFF();
968 break;
969 case CMD_LF_SIMULATE_BIDIR:
970 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
971 break;
972 case CMD_INDALA_CLONE_TAG:
973 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
974 break;
975 case CMD_INDALA_CLONE_TAG_L:
976 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
977 break;
978 case CMD_T55XX_READ_BLOCK:
979 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
980 break;
981 case CMD_T55XX_WRITE_BLOCK:
982 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
983 break;
984 case CMD_T55XX_WAKEUP:
985 T55xxWakeUp(c->arg[0]);
986 break;
987 case CMD_T55XX_RESET_READ:
988 T55xxResetRead();
989 break;
990 case CMD_PCF7931_READ:
991 ReadPCF7931();
992 break;
993 case CMD_PCF7931_WRITE:
994 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
995 break;
996 case CMD_EM4X_READ_WORD:
997 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
998 break;
999 case CMD_EM4X_WRITE_WORD:
1000 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1001 break;
1002 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1003 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1004 break;
1005 case CMD_VIKING_CLONE_TAG:
1006 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1007 break;
1008 #endif
1009
1010 #ifdef WITH_HITAG
1011 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1012 SnoopHitag(c->arg[0]);
1013 break;
1014 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1015 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1016 break;
1017 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1018 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1019 break;
1020 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1021 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1022 break;
1023 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1024 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1025 break;
1026 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1027 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1028 break;
1029 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1030 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1031 break;
1032 #endif
1033
1034 #ifdef WITH_ISO15693
1035 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1036 AcquireRawAdcSamplesIso15693();
1037 break;
1038 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1039 RecordRawAdcSamplesIso15693();
1040 break;
1041
1042 case CMD_ISO_15693_COMMAND:
1043 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1044 break;
1045
1046 case CMD_ISO_15693_FIND_AFI:
1047 BruteforceIso15693Afi(c->arg[0]);
1048 break;
1049
1050 case CMD_ISO_15693_DEBUG:
1051 SetDebugIso15693(c->arg[0]);
1052 break;
1053
1054 case CMD_READER_ISO_15693:
1055 ReaderIso15693(c->arg[0]);
1056 break;
1057 case CMD_SIMTAG_ISO_15693:
1058 SimTagIso15693(c->arg[0], c->d.asBytes);
1059 break;
1060 #endif
1061
1062 #ifdef WITH_LEGICRF
1063 case CMD_SIMULATE_TAG_LEGIC_RF:
1064 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1065 break;
1066
1067 case CMD_WRITER_LEGIC_RF:
1068 LegicRfWriter(c->arg[1], c->arg[0]);
1069 break;
1070
1071 case CMD_READER_LEGIC_RF:
1072 LegicRfReader(c->arg[0], c->arg[1]);
1073 break;
1074 #endif
1075
1076 #ifdef WITH_ISO14443b
1077 case CMD_READ_SRI512_TAG:
1078 ReadSTMemoryIso14443b(0x0F);
1079 break;
1080 case CMD_READ_SRIX4K_TAG:
1081 ReadSTMemoryIso14443b(0x7F);
1082 break;
1083 case CMD_SNOOP_ISO_14443B:
1084 SnoopIso14443b();
1085 break;
1086 case CMD_SIMULATE_TAG_ISO_14443B:
1087 SimulateIso14443bTag();
1088 break;
1089 case CMD_ISO_14443B_COMMAND:
1090 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1091 break;
1092 #endif
1093
1094 #ifdef WITH_ISO14443a
1095 case CMD_SNOOP_ISO_14443a:
1096 SnoopIso14443a(c->arg[0]);
1097 break;
1098 case CMD_READER_ISO_14443a:
1099 ReaderIso14443a(c);
1100 break;
1101 case CMD_SIMULATE_TAG_ISO_14443a:
1102 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1103 break;
1104
1105 case CMD_EPA_PACE_COLLECT_NONCE:
1106 EPA_PACE_Collect_Nonce(c);
1107 break;
1108 case CMD_EPA_PACE_REPLAY:
1109 EPA_PACE_Replay(c);
1110 break;
1111
1112 case CMD_READER_MIFARE:
1113 ReaderMifare(c->arg[0]);
1114 break;
1115 case CMD_MIFARE_READBL:
1116 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1117 break;
1118 case CMD_MIFAREU_READBL:
1119 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1120 break;
1121 case CMD_MIFAREUC_AUTH:
1122 MifareUC_Auth(c->arg[0],c->d.asBytes);
1123 break;
1124 case CMD_MIFAREU_READCARD:
1125 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1126 break;
1127 case CMD_MIFAREUC_SETPWD:
1128 MifareUSetPwd(c->arg[0], c->d.asBytes);
1129 break;
1130 case CMD_MIFARE_READSC:
1131 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1132 break;
1133 case CMD_MIFARE_WRITEBL:
1134 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1135 break;
1136 //case CMD_MIFAREU_WRITEBL_COMPAT:
1137 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1138 //break;
1139 case CMD_MIFAREU_WRITEBL:
1140 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1141 break;
1142 case CMD_MIFARE_NESTED:
1143 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1144 break;
1145 case CMD_MIFARE_CHKKEYS:
1146 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1147 break;
1148 case CMD_SIMULATE_MIFARE_CARD:
1149 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1150 break;
1151
1152 // emulator
1153 case CMD_MIFARE_SET_DBGMODE:
1154 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_EML_MEMCLR:
1157 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1158 break;
1159 case CMD_MIFARE_EML_MEMSET:
1160 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1161 break;
1162 case CMD_MIFARE_EML_MEMGET:
1163 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1164 break;
1165 case CMD_MIFARE_EML_CARDLOAD:
1166 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1167 break;
1168
1169 // Work with "magic Chinese" card
1170 case CMD_MIFARE_CSETBLOCK:
1171 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1172 break;
1173 case CMD_MIFARE_CGETBLOCK:
1174 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1175 break;
1176 case CMD_MIFARE_CIDENT:
1177 MifareCIdent();
1178 break;
1179
1180 // mifare sniffer
1181 case CMD_MIFARE_SNIFFER:
1182 SniffMifare(c->arg[0]);
1183 break;
1184
1185 #endif
1186
1187 #ifdef WITH_ICLASS
1188 // Makes use of ISO14443a FPGA Firmware
1189 case CMD_SNOOP_ICLASS:
1190 SnoopIClass();
1191 break;
1192 case CMD_SIMULATE_TAG_ICLASS:
1193 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1194 break;
1195 case CMD_READER_ICLASS:
1196 ReaderIClass(c->arg[0]);
1197 break;
1198 case CMD_READER_ICLASS_REPLAY:
1199 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1200 break;
1201 case CMD_ICLASS_EML_MEMSET:
1202 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1203 break;
1204 case CMD_ICLASS_WRITEBLOCK:
1205 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1206 break;
1207 case CMD_ICLASS_READCHECK: // auth step 1
1208 iClass_ReadCheck(c->arg[0], c->arg[1]);
1209 break;
1210 case CMD_ICLASS_READBLOCK:
1211 iClass_ReadBlk(c->arg[0]);
1212 break;
1213 case CMD_ICLASS_AUTHENTICATION: //check
1214 iClass_Authentication(c->d.asBytes);
1215 break;
1216 case CMD_ICLASS_DUMP:
1217 iClass_Dump(c->arg[0], c->arg[1]);
1218 break;
1219 case CMD_ICLASS_CLONE:
1220 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1221 break;
1222 #endif
1223 #ifdef WITH_HFSNOOP
1224 case CMD_HF_SNIFFER:
1225 HfSnoop(c->arg[0], c->arg[1]);
1226 break;
1227 #endif
1228
1229 case CMD_BUFF_CLEAR:
1230 BigBuf_Clear();
1231 break;
1232
1233 case CMD_MEASURE_ANTENNA_TUNING:
1234 MeasureAntennaTuning();
1235 break;
1236
1237 case CMD_MEASURE_ANTENNA_TUNING_HF:
1238 MeasureAntennaTuningHf();
1239 break;
1240
1241 case CMD_LISTEN_READER_FIELD:
1242 ListenReaderField(c->arg[0]);
1243 break;
1244
1245 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1246 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1247 SpinDelay(200);
1248 LED_D_OFF(); // LED D indicates field ON or OFF
1249 break;
1250
1251 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1252
1253 LED_B_ON();
1254 uint8_t *BigBuf = BigBuf_get_addr();
1255 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1256 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1257 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1258 }
1259 // Trigger a finish downloading signal with an ACK frame
1260 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1261 LED_B_OFF();
1262 break;
1263
1264 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1265 uint8_t *b = BigBuf_get_addr();
1266 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1267 cmd_send(CMD_ACK,0,0,0,0,0);
1268 break;
1269 }
1270 case CMD_READ_MEM:
1271 ReadMem(c->arg[0]);
1272 break;
1273
1274 case CMD_SET_LF_DIVISOR:
1275 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1276 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1277 break;
1278
1279 case CMD_SET_ADC_MUX:
1280 switch(c->arg[0]) {
1281 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1282 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1283 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1284 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1285 }
1286 break;
1287
1288 case CMD_VERSION:
1289 SendVersion();
1290 break;
1291 case CMD_STATUS:
1292 SendStatus();
1293 break;
1294 case CMD_PING:
1295 cmd_send(CMD_ACK,0,0,0,0,0);
1296 break;
1297 #ifdef WITH_LCD
1298 case CMD_LCD_RESET:
1299 LCDReset();
1300 break;
1301 case CMD_LCD:
1302 LCDSend(c->arg[0]);
1303 break;
1304 #endif
1305 case CMD_SETUP_WRITE:
1306 case CMD_FINISH_WRITE:
1307 case CMD_HARDWARE_RESET:
1308 usb_disable();
1309 SpinDelay(1000);
1310 SpinDelay(1000);
1311 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1312 for(;;) {
1313 // We're going to reset, and the bootrom will take control.
1314 }
1315 break;
1316
1317 case CMD_START_FLASH:
1318 if(common_area.flags.bootrom_present) {
1319 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1320 }
1321 usb_disable();
1322 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1323 for(;;);
1324 break;
1325
1326 case CMD_DEVICE_INFO: {
1327 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1328 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1329 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1330 break;
1331 }
1332 default:
1333 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1334 break;
1335 }
1336 }
1337
1338 void __attribute__((noreturn)) AppMain(void)
1339 {
1340 SpinDelay(100);
1341 clear_trace();
1342 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1343 /* Initialize common area */
1344 memset(&common_area, 0, sizeof(common_area));
1345 common_area.magic = COMMON_AREA_MAGIC;
1346 common_area.version = 1;
1347 }
1348 common_area.flags.osimage_present = 1;
1349
1350 LED_D_OFF();
1351 LED_C_OFF();
1352 LED_B_OFF();
1353 LED_A_OFF();
1354
1355 // Init USB device
1356 usb_enable();
1357
1358 // The FPGA gets its clock from us from PCK0 output, so set that up.
1359 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1360 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1361 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1362 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1363 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1364 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1365 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1366
1367 // Reset SPI
1368 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1369 // Reset SSC
1370 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1371
1372 // Load the FPGA image, which we have stored in our flash.
1373 // (the HF version by default)
1374 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1375
1376 StartTickCount();
1377
1378 #ifdef WITH_LCD
1379 LCDInit();
1380 #endif
1381
1382 byte_t rx[sizeof(UsbCommand)];
1383 size_t rx_len;
1384
1385 for(;;) {
1386 if (usb_poll()) {
1387 rx_len = usb_read(rx,sizeof(UsbCommand));
1388 if (rx_len) {
1389 UsbPacketReceived(rx,rx_len);
1390 }
1391 }
1392 WDT_HIT();
1393
1394 #ifdef WITH_LF
1395 #ifndef WITH_ISO14443a_StandAlone
1396 if (BUTTON_HELD(1000) > 0)
1397 SamyRun();
1398 #endif
1399 #endif
1400 #ifdef WITH_ISO14443a
1401 #ifdef WITH_ISO14443a_StandAlone
1402 if (BUTTON_HELD(1000) > 0)
1403 StandAloneMode14a();
1404 #endif
1405 #endif
1406 }
1407 }
Proxmark3 GIT tracking
Impressum, Datenschutz