]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #862 from pwpiwi/fix_iclass_sim
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "legicrfsim.h"
25 #include "hitag2.h"
26 #include "hitagS.h"
27 #include "iclass.h"
28 #include "iso14443b.h"
29 #include "iso15693.h"
30 #include "lfsampling.h"
31 #include "BigBuf.h"
32 #include "mifarecmd.h"
33 #include "mifareutil.h"
34 #include "mifaresim.h"
35 #include "pcf7931.h"
36 #include "i2c.h"
37 #include "hfsnoop.h"
38 #include "fpgaloader.h"
39 #ifdef WITH_LCD
40 #include "LCD.h"
41 #endif
42
43 static uint32_t hw_capabilities;
44
45 // Craig Young - 14a stand-alone code
46 #ifdef WITH_ISO14443a
47 #include "iso14443a.h"
48 #endif
49
50 //=============================================================================
51 // A buffer where we can queue things up to be sent through the FPGA, for
52 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
53 // is the order in which they go out on the wire.
54 //=============================================================================
55
56 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
57 uint8_t ToSend[TOSEND_BUFFER_SIZE];
58 int ToSendMax;
59 static int ToSendBit;
60 struct common_area common_area __attribute__((section(".commonarea")));
61
62 void ToSendReset(void)
63 {
64 ToSendMax = -1;
65 ToSendBit = 8;
66 }
67
68 void ToSendStuffBit(int b)
69 {
70 if(ToSendBit >= 8) {
71 ToSendMax++;
72 ToSend[ToSendMax] = 0;
73 ToSendBit = 0;
74 }
75
76 if(b) {
77 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
78 }
79
80 ToSendBit++;
81
82 if(ToSendMax >= sizeof(ToSend)) {
83 ToSendBit = 0;
84 DbpString("ToSendStuffBit overflowed!");
85 }
86 }
87
88 //=============================================================================
89 // Debug print functions, to go out over USB, to the usual PC-side client.
90 //=============================================================================
91
92 void DbpString(char *str)
93 {
94 byte_t len = strlen(str);
95 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
96 }
97
98 #if 0
99 void DbpIntegers(int x1, int x2, int x3)
100 {
101 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
102 }
103 #endif
104
105 void Dbprintf(const char *fmt, ...) {
106 // should probably limit size here; oh well, let's just use a big buffer
107 char output_string[128];
108 va_list ap;
109
110 va_start(ap, fmt);
111 kvsprintf(fmt, output_string, 10, ap);
112 va_end(ap);
113
114 DbpString(output_string);
115 }
116
117 // prints HEX & ASCII
118 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
119 int l=0,i;
120 char ascii[9];
121
122 while (len>0) {
123 if (len>8) l=8;
124 else l=len;
125
126 memcpy(ascii,d,l);
127 ascii[l]=0;
128
129 // filter safe ascii
130 for (i=0;i<l;i++)
131 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
132
133 if (bAsci) {
134 Dbprintf("%-8s %*D",ascii,l,d," ");
135 } else {
136 Dbprintf("%*D",l,d," ");
137 }
138
139 len-=8;
140 d+=8;
141 }
142 }
143
144 //-----------------------------------------------------------------------------
145 // Read an ADC channel and block till it completes, then return the result
146 // in ADC units (0 to 1023). Also a routine to average 32 samples and
147 // return that.
148 //-----------------------------------------------------------------------------
149 static int ReadAdc(int ch)
150 {
151 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
152 // AMPL_HI is a high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
153 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
154 //
155 // The maths are:
156 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
157 //
158 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
159
160 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
161 AT91C_BASE_ADC->ADC_MR =
162 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
163 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
164 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
165
166 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
167 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
168
169 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
170
171 return AT91C_BASE_ADC->ADC_CDR[ch] & 0x3ff;
172 }
173
174 int AvgAdc(int ch) // was static - merlok
175 {
176 int i;
177 int a = 0;
178
179 for(i = 0; i < 32; i++) {
180 a += ReadAdc(ch);
181 }
182
183 return (a + 15) >> 5;
184 }
185
186 static int AvgAdc_Voltage_HF(void)
187 {
188 int AvgAdc_Voltage_Low, AvgAdc_Voltage_High;
189
190 AvgAdc_Voltage_Low= (MAX_ADC_HF_VOLTAGE_LOW * AvgAdc(ADC_CHAN_HF_LOW)) >> 10;
191 // if voltage range is about to be exceeded, use high voltage ADC channel if available (RDV40 only)
192 if (AvgAdc_Voltage_Low > MAX_ADC_HF_VOLTAGE_LOW - 300) {
193 AvgAdc_Voltage_High = (MAX_ADC_HF_VOLTAGE_HIGH * AvgAdc(ADC_CHAN_HF_HIGH)) >> 10;
194 if (AvgAdc_Voltage_High >= AvgAdc_Voltage_Low) {
195 return AvgAdc_Voltage_High;
196 }
197 }
198 return AvgAdc_Voltage_Low;
199 }
200
201 static int AvgAdc_Voltage_LF(void)
202 {
203 return (MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10;
204 }
205
206 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
207 {
208 int i, adcval = 0, peak = 0;
209
210 /*
211 * Sweeps the useful LF range of the proxmark from
212 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
213 * read the voltage in the antenna, the result left
214 * in the buffer is a graph which should clearly show
215 * the resonating frequency of your LF antenna
216 * ( hopefully around 95 if it is tuned to 125kHz!)
217 */
218
219 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
220 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
221 SpinDelay(50);
222
223 for (i=255; i>=19; i--) {
224 WDT_HIT();
225 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
226 SpinDelay(20);
227 adcval = AvgAdc_Voltage_LF();
228 if (i==95) *vLf125 = adcval; // voltage at 125Khz
229 if (i==89) *vLf134 = adcval; // voltage at 134Khz
230
231 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
232 if(LF_Results[i] > peak) {
233 *peakv = adcval;
234 peak = LF_Results[i];
235 *peakf = i;
236 //ptr = i;
237 }
238 }
239
240 for (i=18; i >= 0; i--) LF_Results[i] = 0;
241
242 return;
243 }
244
245 void MeasureAntennaTuningHfOnly(int *vHf)
246 {
247 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
248 LED_A_ON();
249 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
250 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
251 SpinDelay(20);
252 *vHf = AvgAdc_Voltage_HF();
253 LED_A_OFF();
254 return;
255 }
256
257 void MeasureAntennaTuning(int mode)
258 {
259 uint8_t LF_Results[256] = {0};
260 int peakv = 0, peakf = 0;
261 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
262
263 LED_B_ON();
264
265 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
266 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
267 MeasureAntennaTuningHfOnly(&vHf);
268 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
269 } else {
270 if (mode & FLAG_TUNE_LF) {
271 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
272 }
273 if (mode & FLAG_TUNE_HF) {
274 MeasureAntennaTuningHfOnly(&vHf);
275 }
276 }
277
278 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
279 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
280 LED_B_OFF();
281 return;
282 }
283
284 void MeasureAntennaTuningHf(void)
285 {
286 int vHf = 0; // in mV
287
288 DbpString("Measuring HF antenna, press button to exit");
289
290 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
291 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
292 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
293
294 for (;;) {
295 SpinDelay(500);
296 vHf = AvgAdc_Voltage_HF();
297
298 Dbprintf("%d mV",vHf);
299 if (BUTTON_PRESS()) break;
300 }
301 DbpString("cancelled");
302
303 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
304
305 }
306
307
308 void ReadMem(int addr)
309 {
310 const uint8_t *data = ((uint8_t *)addr);
311
312 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
313 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
314 }
315
316 /* osimage version information is linked in */
317 extern struct version_information version_information;
318 /* bootrom version information is pointed to from _bootphase1_version_pointer */
319 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
320
321
322 void set_hw_capabilities(void)
323 {
324 if (I2C_is_available()) {
325 hw_capabilities |= HAS_SMARTCARD_SLOT;
326 }
327
328 if (false) { // TODO: implement a test
329 hw_capabilities |= HAS_EXTRA_FLASH_MEM;
330 }
331 }
332
333
334 void SendVersion(void)
335 {
336 set_hw_capabilities();
337
338 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
339 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
340
341 /* Try to find the bootrom version information. Expect to find a pointer at
342 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
343 * pointer, then use it.
344 */
345 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
346 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
347 strcat(VersionString, "bootrom version information appears invalid\n");
348 } else {
349 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
350 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
351 }
352
353 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
354 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
355
356 for (int i = 0; i < fpga_bitstream_num; i++) {
357 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
358 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
359 }
360
361 // test availability of SmartCard slot
362 if (I2C_is_available()) {
363 strncat(VersionString, "SmartCard Slot: available\n", sizeof(VersionString) - strlen(VersionString) - 1);
364 } else {
365 strncat(VersionString, "SmartCard Slot: not available\n", sizeof(VersionString) - strlen(VersionString) - 1);
366 }
367
368 // Send Chip ID and used flash memory
369 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
370 uint32_t compressed_data_section_size = common_area.arg1;
371 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, hw_capabilities, VersionString, strlen(VersionString));
372 }
373
374 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
375 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
376 void printUSBSpeed(void)
377 {
378 Dbprintf("USB Speed:");
379 Dbprintf(" Sending USB packets to client...");
380
381 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
382 uint8_t *test_data = BigBuf_get_addr();
383 uint32_t end_time;
384
385 uint32_t start_time = end_time = GetTickCount();
386 uint32_t bytes_transferred = 0;
387
388 LED_B_ON();
389 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
390 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
391 end_time = GetTickCount();
392 bytes_transferred += USB_CMD_DATA_SIZE;
393 }
394 LED_B_OFF();
395
396 Dbprintf(" Time elapsed: %dms", end_time - start_time);
397 Dbprintf(" Bytes transferred: %d", bytes_transferred);
398 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
399 1000 * bytes_transferred / (end_time - start_time));
400
401 }
402
403 /**
404 * Prints runtime information about the PM3.
405 **/
406 void SendStatus(void)
407 {
408 BigBuf_print_status();
409 Fpga_print_status();
410 #ifdef WITH_SMARTCARD
411 I2C_print_status();
412 #endif
413 printConfig(); //LF Sampling config
414 printUSBSpeed();
415 Dbprintf("Various");
416 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
417 Dbprintf(" ToSendMax..........%d", ToSendMax);
418 Dbprintf(" ToSendBit..........%d", ToSendBit);
419
420 cmd_send(CMD_ACK,1,0,0,0,0);
421 }
422
423 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
424
425 #define OPTS 2
426
427 void StandAloneMode()
428 {
429 DbpString("Stand-alone mode! No PC necessary.");
430 // Oooh pretty -- notify user we're in elite samy mode now
431 LED(LED_RED, 200);
432 LED(LED_ORANGE, 200);
433 LED(LED_GREEN, 200);
434 LED(LED_ORANGE, 200);
435 LED(LED_RED, 200);
436 LED(LED_ORANGE, 200);
437 LED(LED_GREEN, 200);
438 LED(LED_ORANGE, 200);
439 LED(LED_RED, 200);
440
441 }
442
443 #endif
444
445
446
447 #ifdef WITH_ISO14443a_StandAlone
448 void StandAloneMode14a()
449 {
450 StandAloneMode();
451 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
452
453 int selected = 0;
454 bool playing = false, GotoRecord = false, GotoClone = false;
455 bool cardRead[OPTS] = {false};
456 uint8_t readUID[10] = {0};
457 uint32_t uid_1st[OPTS]={0};
458 uint32_t uid_2nd[OPTS]={0};
459 uint32_t uid_tmp1 = 0;
460 uint32_t uid_tmp2 = 0;
461 iso14a_card_select_t hi14a_card[OPTS];
462
463 LED(selected + 1, 0);
464
465 for (;;)
466 {
467 usb_poll();
468 WDT_HIT();
469 SpinDelay(300);
470
471 if (GotoRecord || !cardRead[selected])
472 {
473 GotoRecord = false;
474 LEDsoff();
475 LED(selected + 1, 0);
476 LED(LED_RED2, 0);
477
478 // record
479 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
480 /* need this delay to prevent catching some weird data */
481 SpinDelay(500);
482 /* Code for reading from 14a tag */
483 uint8_t uid[10] ={0};
484 uint32_t cuid;
485 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
486
487 for ( ; ; )
488 {
489 WDT_HIT();
490 if (BUTTON_PRESS()) {
491 if (cardRead[selected]) {
492 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
493 break;
494 }
495 else if (cardRead[(selected+1)%OPTS]) {
496 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
497 selected = (selected+1)%OPTS;
498 break;
499 }
500 else {
501 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
502 SpinDelay(300);
503 }
504 }
505 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
506 continue;
507 else
508 {
509 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
510 memcpy(readUID,uid,10*sizeof(uint8_t));
511 uint8_t *dst = (uint8_t *)&uid_tmp1;
512 // Set UID byte order
513 for (int i=0; i<4; i++)
514 dst[i] = uid[3-i];
515 dst = (uint8_t *)&uid_tmp2;
516 for (int i=0; i<4; i++)
517 dst[i] = uid[7-i];
518 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
519 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
520 }
521 else {
522 if (uid_tmp2) {
523 Dbprintf("Bank[%d] received a 7-byte UID",selected);
524 uid_1st[selected] = (uid_tmp1)>>8;
525 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
526 }
527 else {
528 Dbprintf("Bank[%d] received a 4-byte UID",selected);
529 uid_1st[selected] = uid_tmp1;
530 uid_2nd[selected] = uid_tmp2;
531 }
532 break;
533 }
534 }
535 }
536 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
537 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
538 LEDsoff();
539 LED(LED_GREEN, 200);
540 LED(LED_ORANGE, 200);
541 LED(LED_GREEN, 200);
542 LED(LED_ORANGE, 200);
543
544 LEDsoff();
545 LED(selected + 1, 0);
546
547 // Next state is replay:
548 playing = true;
549
550 cardRead[selected] = true;
551 }
552 /* MF Classic UID clone */
553 else if (GotoClone)
554 {
555 GotoClone=false;
556 LEDsoff();
557 LED(selected + 1, 0);
558 LED(LED_ORANGE, 250);
559
560
561 // record
562 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
563
564 // wait for button to be released
565 while(BUTTON_PRESS())
566 {
567 // Delay cloning until card is in place
568 WDT_HIT();
569 }
570 Dbprintf("Starting clone. [Bank: %u]", selected);
571 // need this delay to prevent catching some weird data
572 SpinDelay(500);
573 // Begin clone function here:
574 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
575 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
576 memcpy(c.d.asBytes, data, 16);
577 SendCommand(&c);
578
579 Block read is similar:
580 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
581 We need to imitate that call with blockNo 0 to set a uid.
582
583 The get and set commands are handled in this file:
584 // Work with "magic Chinese" card
585 case CMD_MIFARE_CSETBLOCK:
586 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
587 break;
588 case CMD_MIFARE_CGETBLOCK:
589 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
590 break;
591
592 mfCSetUID provides example logic for UID set workflow:
593 -Read block0 from card in field with MifareCGetBlock()
594 -Configure new values without replacing reserved bytes
595 memcpy(block0, uid, 4); // Copy UID bytes from byte array
596 // Mifare UID BCC
597 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
598 Bytes 5-7 are reserved SAK and ATQA for mifare classic
599 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
600 */
601 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
602 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
603 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
604 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
605 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
606 playing = true;
607 }
608 else {
609 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
610 memcpy(newBlock0,oldBlock0,16);
611 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
612
613 newBlock0[0] = uid_1st[selected]>>24;
614 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
615 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
616 newBlock0[3] = 0xFF & (uid_1st[selected]);
617 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
618 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
619 MifareCSetBlock(0, 0xFF,0, newBlock0);
620 MifareCGetBlock(0x3F, 1, 0, testBlock0);
621 if (memcmp(testBlock0,newBlock0,16)==0)
622 {
623 DbpString("Cloned successfull!");
624 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
625 playing = false;
626 GotoRecord = true;
627 selected = (selected+1) % OPTS;
628 }
629 else {
630 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
631 playing = true;
632 }
633 }
634 LEDsoff();
635 LED(selected + 1, 0);
636
637 }
638 // Change where to record (or begin playing)
639 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
640 {
641 LEDsoff();
642 LED(selected + 1, 0);
643
644 // Begin transmitting
645 LED(LED_GREEN, 0);
646 DbpString("Playing");
647 for ( ; ; ) {
648 WDT_HIT();
649 int button_action = BUTTON_HELD(1000);
650 if (button_action == 0) { // No button action, proceed with sim
651 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
652 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
653 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
654 DbpString("Mifare Classic");
655 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
656 }
657 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
658 DbpString("Mifare Ultralight");
659 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
660 }
661 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
662 DbpString("Mifare DESFire");
663 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
664 }
665 else {
666 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
667 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
668 }
669 }
670 else if (button_action == BUTTON_SINGLE_CLICK) {
671 selected = (selected + 1) % OPTS;
672 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
673 GotoRecord = true;
674 break;
675 }
676 else if (button_action == BUTTON_HOLD) {
677 Dbprintf("Playtime over. Begin cloning...");
678 GotoClone = true;
679 break;
680 }
681 WDT_HIT();
682 }
683
684 /* We pressed a button so ignore it here with a delay */
685 SpinDelay(300);
686 LEDsoff();
687 LED(selected + 1, 0);
688 }
689 }
690 }
691 #elif WITH_LF_StandAlone
692 // samy's sniff and repeat routine
693 void SamyRun()
694 {
695 StandAloneMode();
696 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
697
698 int tops[OPTS], high[OPTS], low[OPTS];
699 int selected = 0;
700 int playing = 0;
701 int cardRead = 0;
702
703 // Turn on selected LED
704 LED(selected + 1, 0);
705
706 for (;;)
707 {
708 usb_poll();
709 WDT_HIT();
710
711 // Was our button held down or pressed?
712 int button_pressed = BUTTON_HELD(1000);
713 SpinDelay(300);
714
715 // Button was held for a second, begin recording
716 if (button_pressed > 0 && cardRead == 0)
717 {
718 LEDsoff();
719 LED(selected + 1, 0);
720 LED(LED_RED2, 0);
721
722 // record
723 DbpString("Starting recording");
724
725 // wait for button to be released
726 while(BUTTON_PRESS())
727 WDT_HIT();
728
729 /* need this delay to prevent catching some weird data */
730 SpinDelay(500);
731
732 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
733 if (tops[selected] > 0)
734 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
735 else
736 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
737
738 LEDsoff();
739 LED(selected + 1, 0);
740 // Finished recording
741
742 // If we were previously playing, set playing off
743 // so next button push begins playing what we recorded
744 playing = 0;
745
746 cardRead = 1;
747
748 }
749
750 else if (button_pressed > 0 && cardRead == 1)
751 {
752 LEDsoff();
753 LED(selected + 1, 0);
754 LED(LED_ORANGE, 0);
755
756 // record
757 if (tops[selected] > 0)
758 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
759 else
760 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
761
762 // wait for button to be released
763 while(BUTTON_PRESS())
764 WDT_HIT();
765
766 /* need this delay to prevent catching some weird data */
767 SpinDelay(500);
768
769 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)), 0x1D);
770 if (tops[selected] > 0)
771 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
772 else
773 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
774
775 LEDsoff();
776 LED(selected + 1, 0);
777 // Finished recording
778
779 // If we were previously playing, set playing off
780 // so next button push begins playing what we recorded
781 playing = 0;
782
783 cardRead = 0;
784
785 }
786
787 // Change where to record (or begin playing)
788 else if (button_pressed)
789 {
790 // Next option if we were previously playing
791 if (playing)
792 selected = (selected + 1) % OPTS;
793 playing = !playing;
794
795 LEDsoff();
796 LED(selected + 1, 0);
797
798 // Begin transmitting
799 if (playing)
800 {
801 LED(LED_GREEN, 0);
802 DbpString("Playing");
803 // wait for button to be released
804 while(BUTTON_PRESS())
805 WDT_HIT();
806 if (tops[selected] > 0)
807 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
808 else
809 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
810
811 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
812 DbpString("Done playing");
813 if (BUTTON_HELD(1000) > 0)
814 {
815 DbpString("Exiting");
816 LEDsoff();
817 return;
818 }
819
820 /* We pressed a button so ignore it here with a delay */
821 SpinDelay(300);
822
823 // when done, we're done playing, move to next option
824 selected = (selected + 1) % OPTS;
825 playing = !playing;
826 LEDsoff();
827 LED(selected + 1, 0);
828 }
829 else
830 while(BUTTON_PRESS())
831 WDT_HIT();
832 }
833 }
834 }
835
836 #endif
837 /*
838 OBJECTIVE
839 Listen and detect an external reader. Determine the best location
840 for the antenna.
841
842 INSTRUCTIONS:
843 Inside the ListenReaderField() function, there is two mode.
844 By default, when you call the function, you will enter mode 1.
845 If you press the PM3 button one time, you will enter mode 2.
846 If you press the PM3 button a second time, you will exit the function.
847
848 DESCRIPTION OF MODE 1:
849 This mode just listens for an external reader field and lights up green
850 for HF and/or red for LF. This is the original mode of the detectreader
851 function.
852
853 DESCRIPTION OF MODE 2:
854 This mode will visually represent, using the LEDs, the actual strength of the
855 current compared to the maximum current detected. Basically, once you know
856 what kind of external reader is present, it will help you spot the best location to place
857 your antenna. You will probably not get some good results if there is a LF and a HF reader
858 at the same place! :-)
859
860 LIGHT SCHEME USED:
861 */
862 static const char LIGHT_SCHEME[] = {
863 0x0, /* ---- | No field detected */
864 0x1, /* X--- | 14% of maximum current detected */
865 0x2, /* -X-- | 29% of maximum current detected */
866 0x4, /* --X- | 43% of maximum current detected */
867 0x8, /* ---X | 57% of maximum current detected */
868 0xC, /* --XX | 71% of maximum current detected */
869 0xE, /* -XXX | 86% of maximum current detected */
870 0xF, /* XXXX | 100% of maximum current detected */
871 };
872 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
873
874 void ListenReaderField(int limit)
875 {
876 int lf_av, lf_av_new=0, lf_baseline= 0, lf_max;
877 int hf_av, hf_av_new=0, hf_baseline= 0, hf_max;
878 int mode=1, display_val, display_max, i;
879
880 #define LF_ONLY 1
881 #define HF_ONLY 2
882 #define REPORT_CHANGE_PERCENT 5 // report new values only if they have changed at least by REPORT_CHANGE_PERCENT
883 #define MIN_HF_FIELD 300 // in mode 1 signal HF field greater than MIN_HF_FIELD above baseline
884 #define MIN_LF_FIELD 1200 // in mode 1 signal LF field greater than MIN_LF_FIELD above baseline
885
886
887 // switch off FPGA - we don't want to measure our own signal
888 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
889 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
890
891 LEDsoff();
892
893 lf_av = lf_max = AvgAdc_Voltage_LF();
894
895 if(limit != HF_ONLY) {
896 Dbprintf("LF 125/134kHz Baseline: %dmV", lf_av);
897 lf_baseline = lf_av;
898 }
899
900 hf_av = hf_max = AvgAdc_Voltage_HF();
901
902 if (limit != LF_ONLY) {
903 Dbprintf("HF 13.56MHz Baseline: %dmV", hf_av);
904 hf_baseline = hf_av;
905 }
906
907 for(;;) {
908 SpinDelay(500);
909 if (BUTTON_PRESS()) {
910 switch (mode) {
911 case 1:
912 mode=2;
913 DbpString("Signal Strength Mode");
914 break;
915 case 2:
916 default:
917 DbpString("Stopped");
918 LEDsoff();
919 return;
920 break;
921 }
922 while (BUTTON_PRESS());
923 }
924 WDT_HIT();
925
926 if (limit != HF_ONLY) {
927 if(mode == 1) {
928 if (lf_av - lf_baseline > MIN_LF_FIELD)
929 LED_D_ON();
930 else
931 LED_D_OFF();
932 }
933
934 lf_av_new = AvgAdc_Voltage_LF();
935 // see if there's a significant change
936 if (ABS((lf_av - lf_av_new)*100/(lf_av?lf_av:1)) > REPORT_CHANGE_PERCENT) {
937 Dbprintf("LF 125/134kHz Field Change: %5dmV", lf_av_new);
938 lf_av = lf_av_new;
939 if (lf_av > lf_max)
940 lf_max = lf_av;
941 }
942 }
943
944 if (limit != LF_ONLY) {
945 if (mode == 1){
946 if (hf_av - hf_baseline > MIN_HF_FIELD)
947 LED_B_ON();
948 else
949 LED_B_OFF();
950 }
951
952 hf_av_new = AvgAdc_Voltage_HF();
953
954 // see if there's a significant change
955 if (ABS((hf_av - hf_av_new)*100/(hf_av?hf_av:1)) > REPORT_CHANGE_PERCENT) {
956 Dbprintf("HF 13.56MHz Field Change: %5dmV", hf_av_new);
957 hf_av = hf_av_new;
958 if (hf_av > hf_max)
959 hf_max = hf_av;
960 }
961 }
962
963 if(mode == 2) {
964 if (limit == LF_ONLY) {
965 display_val = lf_av;
966 display_max = lf_max;
967 } else if (limit == HF_ONLY) {
968 display_val = hf_av;
969 display_max = hf_max;
970 } else { /* Pick one at random */
971 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
972 display_val = hf_av;
973 display_max = hf_max;
974 } else {
975 display_val = lf_av;
976 display_max = lf_max;
977 }
978 }
979 for (i=0; i<LIGHT_LEN; i++) {
980 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
981 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
982 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
983 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
984 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
985 break;
986 }
987 }
988 }
989 }
990 }
991
992 void UsbPacketReceived(uint8_t *packet, int len)
993 {
994 UsbCommand *c = (UsbCommand *)packet;
995
996 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
997
998 switch(c->cmd) {
999 #ifdef WITH_LF
1000 case CMD_SET_LF_SAMPLING_CONFIG:
1001 setSamplingConfig(c->d.asBytes);
1002 break;
1003 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1004 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
1005 break;
1006 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
1007 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1008 break;
1009 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
1010 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
1011 break;
1012 case CMD_HID_DEMOD_FSK:
1013 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
1014 break;
1015 case CMD_HID_SIM_TAG:
1016 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
1017 break;
1018 case CMD_FSK_SIM_TAG:
1019 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1020 break;
1021 case CMD_ASK_SIM_TAG:
1022 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1023 break;
1024 case CMD_PSK_SIM_TAG:
1025 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1026 break;
1027 case CMD_HID_CLONE_TAG:
1028 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x1D);
1029 break;
1030 case CMD_PARADOX_CLONE_TAG:
1031 // Paradox cards are the same as HID, with a different preamble, so we can reuse the same function
1032 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x0F);
1033 break;
1034 case CMD_IO_DEMOD_FSK:
1035 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
1036 break;
1037 case CMD_IO_CLONE_TAG:
1038 CopyIOtoT55x7(c->arg[0], c->arg[1]);
1039 break;
1040 case CMD_EM410X_DEMOD:
1041 CmdEM410xdemod(c->arg[0], 0, 0, 1);
1042 break;
1043 case CMD_EM410X_WRITE_TAG:
1044 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
1045 break;
1046 case CMD_READ_TI_TYPE:
1047 ReadTItag();
1048 break;
1049 case CMD_WRITE_TI_TYPE:
1050 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
1051 break;
1052 case CMD_SIMULATE_TAG_125K:
1053 LED_A_ON();
1054 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
1055 LED_A_OFF();
1056 break;
1057 case CMD_LF_SIMULATE_BIDIR:
1058 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1059 break;
1060 case CMD_INDALA_CLONE_TAG:
1061 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1062 break;
1063 case CMD_INDALA_CLONE_TAG_L:
1064 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1065 break;
1066 case CMD_T55XX_READ_BLOCK:
1067 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1068 break;
1069 case CMD_T55XX_WRITE_BLOCK:
1070 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1071 break;
1072 case CMD_T55XX_WAKEUP:
1073 T55xxWakeUp(c->arg[0]);
1074 break;
1075 case CMD_T55XX_RESET_READ:
1076 T55xxResetRead();
1077 break;
1078 case CMD_PCF7931_READ:
1079 ReadPCF7931();
1080 break;
1081 case CMD_PCF7931_WRITE:
1082 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1083 break;
1084 case CMD_PCF7931_BRUTEFORCE:
1085 BruteForcePCF7931(c->arg[0], (c->arg[1] & 0xFF), c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128);
1086 break;
1087 case CMD_EM4X_READ_WORD:
1088 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1089 break;
1090 case CMD_EM4X_WRITE_WORD:
1091 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1092 break;
1093 case CMD_EM4X_PROTECT:
1094 EM4xProtect(c->arg[0], c->arg[1], c->arg[2]);
1095 break;
1096 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1097 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1098 break;
1099 case CMD_VIKING_CLONE_TAG:
1100 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1101 break;
1102 case CMD_COTAG:
1103 Cotag(c->arg[0]);
1104 break;
1105 #endif
1106
1107 #ifdef WITH_HITAG
1108 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1109 SnoopHitag(c->arg[0]);
1110 break;
1111 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1112 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1113 break;
1114 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1115 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1116 break;
1117 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1118 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1119 break;
1120 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1121 check_challenges_cmd((bool)c->arg[0], (byte_t*)c->d.asBytes, (uint8_t)c->arg[1]);
1122 break;
1123 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1124 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], false);
1125 break;
1126 case CMD_READ_HITAG_S_BLK:
1127 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], true);
1128 break;
1129 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1130 if ((hitag_function)c->arg[0] < 10) {
1131 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1132 }
1133 else if ((hitag_function)c->arg[0] >= 10) {
1134 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1135 }
1136 break;
1137 #endif
1138
1139 #ifdef WITH_ISO15693
1140 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1141 AcquireRawAdcSamplesIso15693();
1142 break;
1143
1144 case CMD_SNOOP_ISO_15693:
1145 SnoopIso15693();
1146 break;
1147
1148 case CMD_ISO_15693_COMMAND:
1149 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1150 break;
1151
1152 case CMD_ISO_15693_FIND_AFI:
1153 BruteforceIso15693Afi(c->arg[0]);
1154 break;
1155
1156 case CMD_ISO_15693_DEBUG:
1157 SetDebugIso15693(c->arg[0]);
1158 break;
1159
1160 case CMD_READER_ISO_15693:
1161 ReaderIso15693(c->arg[0]);
1162 break;
1163
1164 case CMD_SIMTAG_ISO_15693:
1165 SimTagIso15693(c->arg[0], c->d.asBytes);
1166 break;
1167
1168 case CMD_CSETUID_ISO_15693:
1169 SetTag15693Uid(c->d.asBytes);
1170 break;
1171 #endif
1172
1173 #ifdef WITH_LEGICRF
1174 case CMD_SIMULATE_TAG_LEGIC_RF:
1175 LegicRfSimulate(c->arg[0]);
1176 break;
1177
1178 case CMD_WRITER_LEGIC_RF:
1179 LegicRfWriter(c->arg[1], c->arg[0]);
1180 break;
1181
1182 case CMD_READER_LEGIC_RF:
1183 LegicRfReader(c->arg[0], c->arg[1]);
1184 break;
1185 #endif
1186
1187 #ifdef WITH_ISO14443b
1188 case CMD_READ_SRI512_TAG:
1189 ReadSTMemoryIso14443b(0x0F);
1190 break;
1191 case CMD_READ_SRIX4K_TAG:
1192 ReadSTMemoryIso14443b(0x7F);
1193 break;
1194 case CMD_SNOOP_ISO_14443B:
1195 SnoopIso14443b();
1196 break;
1197 case CMD_SIMULATE_TAG_ISO_14443B:
1198 SimulateIso14443bTag();
1199 break;
1200 case CMD_ISO_14443B_COMMAND:
1201 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1202 break;
1203 #endif
1204
1205 #ifdef WITH_ISO14443a
1206 case CMD_SNOOP_ISO_14443a:
1207 SnoopIso14443a(c->arg[0]);
1208 break;
1209 case CMD_READER_ISO_14443a:
1210 ReaderIso14443a(c);
1211 break;
1212 case CMD_SIMULATE_TAG_ISO_14443a:
1213 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1214 break;
1215
1216 case CMD_EPA_PACE_COLLECT_NONCE:
1217 EPA_PACE_Collect_Nonce(c);
1218 break;
1219 case CMD_EPA_PACE_REPLAY:
1220 EPA_PACE_Replay(c);
1221 break;
1222
1223 case CMD_READER_MIFARE:
1224 ReaderMifare(c->arg[0]);
1225 break;
1226 case CMD_MIFARE_READBL:
1227 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1228 break;
1229 case CMD_MIFAREU_READBL:
1230 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1231 break;
1232 case CMD_MIFAREUC_AUTH:
1233 MifareUC_Auth(c->arg[0],c->d.asBytes);
1234 break;
1235 case CMD_MIFAREU_READCARD:
1236 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1237 break;
1238 case CMD_MIFAREUC_SETPWD:
1239 MifareUSetPwd(c->arg[0], c->d.asBytes);
1240 break;
1241 case CMD_MIFARE_READSC:
1242 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1243 break;
1244 case CMD_MIFARE_WRITEBL:
1245 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1246 break;
1247 case CMD_MIFARE_PERSONALIZE_UID:
1248 MifarePersonalizeUID(c->arg[0], c->arg[1], c->d.asBytes);
1249 break;
1250 //case CMD_MIFAREU_WRITEBL_COMPAT:
1251 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1252 //break;
1253 case CMD_MIFAREU_WRITEBL:
1254 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1255 break;
1256 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1257 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1258 break;
1259 case CMD_MIFARE_NESTED:
1260 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1261 break;
1262 case CMD_MIFARE_CHKKEYS:
1263 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1264 break;
1265 case CMD_SIMULATE_MIFARE_CARD:
1266 MifareSim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1267 break;
1268
1269 // emulator
1270 case CMD_MIFARE_SET_DBGMODE:
1271 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1272 break;
1273 case CMD_MIFARE_EML_MEMCLR:
1274 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1275 break;
1276 case CMD_MIFARE_EML_MEMSET:
1277 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1278 break;
1279 case CMD_MIFARE_EML_MEMGET:
1280 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1281 break;
1282 case CMD_MIFARE_EML_CARDLOAD:
1283 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1284 break;
1285
1286 // Work with "magic Chinese" card
1287 case CMD_MIFARE_CWIPE:
1288 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1289 break;
1290 case CMD_MIFARE_CSETBLOCK:
1291 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1292 break;
1293 case CMD_MIFARE_CGETBLOCK:
1294 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1295 break;
1296 case CMD_MIFARE_CIDENT:
1297 MifareCIdent();
1298 break;
1299
1300 // mifare sniffer
1301 case CMD_MIFARE_SNIFFER:
1302 SniffMifare(c->arg[0]);
1303 break;
1304
1305 #endif
1306
1307 #ifdef WITH_ICLASS
1308 // Makes use of ISO14443a FPGA Firmware
1309 case CMD_SNOOP_ICLASS:
1310 SnoopIClass();
1311 break;
1312 case CMD_SIMULATE_TAG_ICLASS:
1313 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1314 break;
1315 case CMD_READER_ICLASS:
1316 ReaderIClass(c->arg[0]);
1317 break;
1318 case CMD_READER_ICLASS_REPLAY:
1319 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1320 break;
1321 case CMD_ICLASS_EML_MEMSET:
1322 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1323 break;
1324 case CMD_ICLASS_WRITEBLOCK:
1325 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1326 break;
1327 case CMD_ICLASS_READBLOCK:
1328 iClass_ReadBlk(c->arg[0]);
1329 break;
1330 case CMD_ICLASS_AUTHENTICATION: //check
1331 iClass_Authentication(c->d.asBytes);
1332 break;
1333 case CMD_ICLASS_DUMP:
1334 iClass_Dump(c->arg[0], c->arg[1]);
1335 break;
1336 case CMD_ICLASS_CLONE:
1337 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1338 break;
1339 #endif
1340
1341 #ifdef WITH_HFSNOOP
1342 case CMD_HF_SNIFFER:
1343 HfSnoop(c->arg[0], c->arg[1]);
1344 break;
1345 case CMD_HF_PLOT:
1346 HfPlot();
1347 break;
1348 #endif
1349
1350 #ifdef WITH_SMARTCARD
1351 case CMD_SMART_ATR: {
1352 SmartCardAtr();
1353 break;
1354 }
1355 case CMD_SMART_SETCLOCK:{
1356 SmartCardSetClock(c->arg[0]);
1357 break;
1358 }
1359 case CMD_SMART_RAW: {
1360 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1361 break;
1362 }
1363 case CMD_SMART_UPLOAD: {
1364 // upload file from client
1365 uint8_t *mem = BigBuf_get_addr();
1366 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1367 cmd_send(CMD_ACK,1,0,0,0,0);
1368 break;
1369 }
1370 case CMD_SMART_UPGRADE: {
1371 SmartCardUpgrade(c->arg[0]);
1372 break;
1373 }
1374 #endif
1375
1376 case CMD_BUFF_CLEAR:
1377 BigBuf_Clear();
1378 break;
1379
1380 case CMD_MEASURE_ANTENNA_TUNING:
1381 MeasureAntennaTuning(c->arg[0]);
1382 break;
1383
1384 case CMD_MEASURE_ANTENNA_TUNING_HF:
1385 MeasureAntennaTuningHf();
1386 break;
1387
1388 case CMD_LISTEN_READER_FIELD:
1389 ListenReaderField(c->arg[0]);
1390 break;
1391
1392 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1393 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1394 SpinDelay(200);
1395 LED_D_OFF(); // LED D indicates field ON or OFF
1396 break;
1397
1398 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1399 LED_B_ON();
1400 uint8_t *BigBuf = BigBuf_get_addr();
1401 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1402 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1403 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1404 }
1405 // Trigger a finish downloading signal with an ACK frame
1406 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1407 LED_B_OFF();
1408 break;
1409
1410 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1411 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1412 // to be able to use this one for uploading data to device
1413 // arg1 = 0 upload for LF usage
1414 // 1 upload for HF usage
1415 if (c->arg[1] == 0)
1416 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1417 else
1418 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1419
1420 uint8_t *b = BigBuf_get_addr();
1421 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1422 cmd_send(CMD_ACK,0,0,0,0,0);
1423 break;
1424 }
1425 case CMD_READ_MEM:
1426 ReadMem(c->arg[0]);
1427 break;
1428
1429 case CMD_SET_LF_DIVISOR:
1430 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1431 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1432 break;
1433
1434 case CMD_SET_ADC_MUX:
1435 switch(c->arg[0]) {
1436 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1437 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1438 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1439 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1440 }
1441 break;
1442
1443 case CMD_VERSION:
1444 SendVersion();
1445 break;
1446 case CMD_STATUS:
1447 SendStatus();
1448 break;
1449 case CMD_PING:
1450 cmd_send(CMD_ACK,0,0,0,0,0);
1451 break;
1452 #ifdef WITH_LCD
1453 case CMD_LCD_RESET:
1454 LCDReset();
1455 break;
1456 case CMD_LCD:
1457 LCDSend(c->arg[0]);
1458 break;
1459 #endif
1460 case CMD_SETUP_WRITE:
1461 case CMD_FINISH_WRITE:
1462 case CMD_HARDWARE_RESET:
1463 usb_disable();
1464 SpinDelay(1000);
1465 SpinDelay(1000);
1466 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1467 for(;;) {
1468 // We're going to reset, and the bootrom will take control.
1469 }
1470 break;
1471
1472 case CMD_START_FLASH:
1473 if(common_area.flags.bootrom_present) {
1474 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1475 }
1476 usb_disable();
1477 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1478 for(;;);
1479 break;
1480
1481 case CMD_DEVICE_INFO: {
1482 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1483 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1484 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1485 break;
1486 }
1487 default:
1488 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1489 break;
1490 }
1491 }
1492
1493 void __attribute__((noreturn)) AppMain(void)
1494 {
1495 SpinDelay(100);
1496 clear_trace();
1497 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1498 /* Initialize common area */
1499 memset(&common_area, 0, sizeof(common_area));
1500 common_area.magic = COMMON_AREA_MAGIC;
1501 common_area.version = 1;
1502 }
1503 common_area.flags.osimage_present = 1;
1504
1505 LEDsoff();
1506
1507 // Init USB device
1508 usb_enable();
1509
1510 // The FPGA gets its clock from us from PCK0 output, so set that up.
1511 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1512 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1513 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1514 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1515 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1516 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1517 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1518
1519 // Reset SPI
1520 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1521 // Reset SSC
1522 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1523
1524 // Load the FPGA image, which we have stored in our flash.
1525 // (the HF version by default)
1526 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1527
1528 StartTickCount();
1529
1530 #ifdef WITH_LCD
1531 LCDInit();
1532 #endif
1533
1534 byte_t rx[sizeof(UsbCommand)];
1535 size_t rx_len;
1536
1537 for(;;) {
1538 if (usb_poll()) {
1539 rx_len = usb_read(rx,sizeof(UsbCommand));
1540 if (rx_len) {
1541 UsbPacketReceived(rx,rx_len);
1542 }
1543 }
1544 WDT_HIT();
1545
1546 #ifdef WITH_LF_StandAlone
1547 #ifndef WITH_ISO14443a_StandAlone
1548 if (BUTTON_HELD(1000) > 0)
1549 SamyRun();
1550 #endif
1551 #endif
1552 #ifdef WITH_ISO14443a
1553 #ifdef WITH_ISO14443a_StandAlone
1554 if (BUTTON_HELD(1000) > 0)
1555 StandAloneMode14a();
1556 #endif
1557 #endif
1558 }
1559 }
Proxmark3 GIT tracking
Impressum, Datenschutz