]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
fpgaloader: fix function accordingly to #669 (#673)
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "legicrfsim.h"
25 #include "hitag2.h"
26 #include "hitagS.h"
27 #include "lfsampling.h"
28 #include "BigBuf.h"
29 #include "mifareutil.h"
30 #include "pcf7931.h"
31 #ifdef WITH_LCD
32 #include "LCD.h"
33 #endif
34 #ifdef WITH_SMARTCARD
35 #include "i2c.h"
36 #endif
37
38
39 // Craig Young - 14a stand-alone code
40 #ifdef WITH_ISO14443a
41 #include "iso14443a.h"
42 #endif
43
44 //=============================================================================
45 // A buffer where we can queue things up to be sent through the FPGA, for
46 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
47 // is the order in which they go out on the wire.
48 //=============================================================================
49
50 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
51 uint8_t ToSend[TOSEND_BUFFER_SIZE];
52 int ToSendMax;
53 static int ToSendBit;
54 struct common_area common_area __attribute__((section(".commonarea")));
55
56 void ToSendReset(void)
57 {
58 ToSendMax = -1;
59 ToSendBit = 8;
60 }
61
62 void ToSendStuffBit(int b)
63 {
64 if(ToSendBit >= 8) {
65 ToSendMax++;
66 ToSend[ToSendMax] = 0;
67 ToSendBit = 0;
68 }
69
70 if(b) {
71 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
72 }
73
74 ToSendBit++;
75
76 if(ToSendMax >= sizeof(ToSend)) {
77 ToSendBit = 0;
78 DbpString("ToSendStuffBit overflowed!");
79 }
80 }
81
82 //=============================================================================
83 // Debug print functions, to go out over USB, to the usual PC-side client.
84 //=============================================================================
85
86 void DbpString(char *str)
87 {
88 byte_t len = strlen(str);
89 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
90 }
91
92 #if 0
93 void DbpIntegers(int x1, int x2, int x3)
94 {
95 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
96 }
97 #endif
98
99 void Dbprintf(const char *fmt, ...) {
100 // should probably limit size here; oh well, let's just use a big buffer
101 char output_string[128];
102 va_list ap;
103
104 va_start(ap, fmt);
105 kvsprintf(fmt, output_string, 10, ap);
106 va_end(ap);
107
108 DbpString(output_string);
109 }
110
111 // prints HEX & ASCII
112 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
113 int l=0,i;
114 char ascii[9];
115
116 while (len>0) {
117 if (len>8) l=8;
118 else l=len;
119
120 memcpy(ascii,d,l);
121 ascii[l]=0;
122
123 // filter safe ascii
124 for (i=0;i<l;i++)
125 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
126
127 if (bAsci) {
128 Dbprintf("%-8s %*D",ascii,l,d," ");
129 } else {
130 Dbprintf("%*D",l,d," ");
131 }
132
133 len-=8;
134 d+=8;
135 }
136 }
137
138 //-----------------------------------------------------------------------------
139 // Read an ADC channel and block till it completes, then return the result
140 // in ADC units (0 to 1023). Also a routine to average 32 samples and
141 // return that.
142 //-----------------------------------------------------------------------------
143 static int ReadAdc(int ch)
144 {
145 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
146 // AMPL_HI is are high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
147 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
148 //
149 // The maths are:
150 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
151 //
152 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
153
154 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
155 AT91C_BASE_ADC->ADC_MR =
156 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
157 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
158 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
159
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
162
163 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
164
165 return AT91C_BASE_ADC->ADC_CDR[ch];
166 }
167
168 int AvgAdc(int ch) // was static - merlok
169 {
170 int i;
171 int a = 0;
172
173 for(i = 0; i < 32; i++) {
174 a += ReadAdc(ch);
175 }
176
177 return (a + 15) >> 5;
178 }
179
180 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
181 {
182 int i, adcval = 0, peak = 0;
183
184 /*
185 * Sweeps the useful LF range of the proxmark from
186 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
187 * read the voltage in the antenna, the result left
188 * in the buffer is a graph which should clearly show
189 * the resonating frequency of your LF antenna
190 * ( hopefully around 95 if it is tuned to 125kHz!)
191 */
192
193 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
194 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
195 SpinDelay(50);
196
197 for (i=255; i>=19; i--) {
198 WDT_HIT();
199 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
200 SpinDelay(20);
201 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
202 if (i==95) *vLf125 = adcval; // voltage at 125Khz
203 if (i==89) *vLf134 = adcval; // voltage at 134Khz
204
205 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
206 if(LF_Results[i] > peak) {
207 *peakv = adcval;
208 peak = LF_Results[i];
209 *peakf = i;
210 //ptr = i;
211 }
212 }
213
214 for (i=18; i >= 0; i--) LF_Results[i] = 0;
215
216 return;
217 }
218
219 void MeasureAntennaTuningHfOnly(int *vHf)
220 {
221 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
222 LED_A_ON();
223 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
224 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
225 SpinDelay(20);
226 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
227 LED_A_OFF();
228
229 return;
230 }
231
232 void MeasureAntennaTuning(int mode)
233 {
234 uint8_t LF_Results[256] = {0};
235 int peakv = 0, peakf = 0;
236 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
237
238 LED_B_ON();
239
240 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
241 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
242 MeasureAntennaTuningHfOnly(&vHf);
243 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
244 } else {
245 if (mode & FLAG_TUNE_LF) {
246 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
247 }
248 if (mode & FLAG_TUNE_HF) {
249 MeasureAntennaTuningHfOnly(&vHf);
250 }
251 }
252
253 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
255 LED_B_OFF();
256 return;
257 }
258
259 void MeasureAntennaTuningHf(void)
260 {
261 int vHf = 0; // in mV
262
263 DbpString("Measuring HF antenna, press button to exit");
264
265 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
266 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
268
269 for (;;) {
270 SpinDelay(20);
271 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
272
273 Dbprintf("%d mV",vHf);
274 if (BUTTON_PRESS()) break;
275 }
276 DbpString("cancelled");
277
278 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
279
280 }
281
282
283 void ReadMem(int addr)
284 {
285 const uint8_t *data = ((uint8_t *)addr);
286
287 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
288 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
289 }
290
291 /* osimage version information is linked in */
292 extern struct version_information version_information;
293 /* bootrom version information is pointed to from _bootphase1_version_pointer */
294 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
295
296 void SendVersion(void)
297 {
298 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
299 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
300
301 /* Try to find the bootrom version information. Expect to find a pointer at
302 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
303 * pointer, then use it.
304 */
305 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
306 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
307 strcat(VersionString, "bootrom version information appears invalid\n");
308 } else {
309 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
311 }
312
313 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
314 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
315
316 for (int i = 0; i < fpga_bitstream_num; i++) {
317 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
318 if (i < fpga_bitstream_num - 1) {
319 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
320 }
321 }
322
323 // Send Chip ID and used flash memory
324 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
325 uint32_t compressed_data_section_size = common_area.arg1;
326 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
327 }
328
329 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
330 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
331 void printUSBSpeed(void)
332 {
333 Dbprintf("USB Speed:");
334 Dbprintf(" Sending USB packets to client...");
335
336 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
337 uint8_t *test_data = BigBuf_get_addr();
338 uint32_t end_time;
339
340 uint32_t start_time = end_time = GetTickCount();
341 uint32_t bytes_transferred = 0;
342
343 LED_B_ON();
344 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
345 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
346 end_time = GetTickCount();
347 bytes_transferred += USB_CMD_DATA_SIZE;
348 }
349 LED_B_OFF();
350
351 Dbprintf(" Time elapsed: %dms", end_time - start_time);
352 Dbprintf(" Bytes transferred: %d", bytes_transferred);
353 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
354 1000 * bytes_transferred / (end_time - start_time));
355
356 }
357
358 /**
359 * Prints runtime information about the PM3.
360 **/
361 void SendStatus(void)
362 {
363 BigBuf_print_status();
364 Fpga_print_status();
365 #ifdef WITH_SMARTCARD
366 I2C_print_status();
367 #endif
368 printConfig(); //LF Sampling config
369 printUSBSpeed();
370 Dbprintf("Various");
371 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
372 Dbprintf(" ToSendMax..........%d", ToSendMax);
373 Dbprintf(" ToSendBit..........%d", ToSendBit);
374
375 cmd_send(CMD_ACK,1,0,0,0,0);
376 }
377
378 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
379
380 #define OPTS 2
381
382 void StandAloneMode()
383 {
384 DbpString("Stand-alone mode! No PC necessary.");
385 // Oooh pretty -- notify user we're in elite samy mode now
386 LED(LED_RED, 200);
387 LED(LED_ORANGE, 200);
388 LED(LED_GREEN, 200);
389 LED(LED_ORANGE, 200);
390 LED(LED_RED, 200);
391 LED(LED_ORANGE, 200);
392 LED(LED_GREEN, 200);
393 LED(LED_ORANGE, 200);
394 LED(LED_RED, 200);
395
396 }
397
398 #endif
399
400
401
402 #ifdef WITH_ISO14443a_StandAlone
403 void StandAloneMode14a()
404 {
405 StandAloneMode();
406 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
407
408 int selected = 0;
409 bool playing = false, GotoRecord = false, GotoClone = false;
410 bool cardRead[OPTS] = {false};
411 uint8_t readUID[10] = {0};
412 uint32_t uid_1st[OPTS]={0};
413 uint32_t uid_2nd[OPTS]={0};
414 uint32_t uid_tmp1 = 0;
415 uint32_t uid_tmp2 = 0;
416 iso14a_card_select_t hi14a_card[OPTS];
417
418 LED(selected + 1, 0);
419
420 for (;;)
421 {
422 usb_poll();
423 WDT_HIT();
424 SpinDelay(300);
425
426 if (GotoRecord || !cardRead[selected])
427 {
428 GotoRecord = false;
429 LEDsoff();
430 LED(selected + 1, 0);
431 LED(LED_RED2, 0);
432
433 // record
434 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
435 /* need this delay to prevent catching some weird data */
436 SpinDelay(500);
437 /* Code for reading from 14a tag */
438 uint8_t uid[10] ={0};
439 uint32_t cuid;
440 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
441
442 for ( ; ; )
443 {
444 WDT_HIT();
445 if (BUTTON_PRESS()) {
446 if (cardRead[selected]) {
447 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
448 break;
449 }
450 else if (cardRead[(selected+1)%OPTS]) {
451 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
452 selected = (selected+1)%OPTS;
453 break;
454 }
455 else {
456 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
457 SpinDelay(300);
458 }
459 }
460 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
461 continue;
462 else
463 {
464 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
465 memcpy(readUID,uid,10*sizeof(uint8_t));
466 uint8_t *dst = (uint8_t *)&uid_tmp1;
467 // Set UID byte order
468 for (int i=0; i<4; i++)
469 dst[i] = uid[3-i];
470 dst = (uint8_t *)&uid_tmp2;
471 for (int i=0; i<4; i++)
472 dst[i] = uid[7-i];
473 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
474 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
475 }
476 else {
477 if (uid_tmp2) {
478 Dbprintf("Bank[%d] received a 7-byte UID",selected);
479 uid_1st[selected] = (uid_tmp1)>>8;
480 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
481 }
482 else {
483 Dbprintf("Bank[%d] received a 4-byte UID",selected);
484 uid_1st[selected] = uid_tmp1;
485 uid_2nd[selected] = uid_tmp2;
486 }
487 break;
488 }
489 }
490 }
491 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
492 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
493 LEDsoff();
494 LED(LED_GREEN, 200);
495 LED(LED_ORANGE, 200);
496 LED(LED_GREEN, 200);
497 LED(LED_ORANGE, 200);
498
499 LEDsoff();
500 LED(selected + 1, 0);
501
502 // Next state is replay:
503 playing = true;
504
505 cardRead[selected] = true;
506 }
507 /* MF Classic UID clone */
508 else if (GotoClone)
509 {
510 GotoClone=false;
511 LEDsoff();
512 LED(selected + 1, 0);
513 LED(LED_ORANGE, 250);
514
515
516 // record
517 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
518
519 // wait for button to be released
520 while(BUTTON_PRESS())
521 {
522 // Delay cloning until card is in place
523 WDT_HIT();
524 }
525 Dbprintf("Starting clone. [Bank: %u]", selected);
526 // need this delay to prevent catching some weird data
527 SpinDelay(500);
528 // Begin clone function here:
529 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
530 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
531 memcpy(c.d.asBytes, data, 16);
532 SendCommand(&c);
533
534 Block read is similar:
535 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
536 We need to imitate that call with blockNo 0 to set a uid.
537
538 The get and set commands are handled in this file:
539 // Work with "magic Chinese" card
540 case CMD_MIFARE_CSETBLOCK:
541 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
542 break;
543 case CMD_MIFARE_CGETBLOCK:
544 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545 break;
546
547 mfCSetUID provides example logic for UID set workflow:
548 -Read block0 from card in field with MifareCGetBlock()
549 -Configure new values without replacing reserved bytes
550 memcpy(block0, uid, 4); // Copy UID bytes from byte array
551 // Mifare UID BCC
552 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
553 Bytes 5-7 are reserved SAK and ATQA for mifare classic
554 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
555 */
556 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
557 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
558 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
559 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
560 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
561 playing = true;
562 }
563 else {
564 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
565 memcpy(newBlock0,oldBlock0,16);
566 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
567
568 newBlock0[0] = uid_1st[selected]>>24;
569 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
570 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
571 newBlock0[3] = 0xFF & (uid_1st[selected]);
572 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
573 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
574 MifareCSetBlock(0, 0xFF,0, newBlock0);
575 MifareCGetBlock(0x3F, 1, 0, testBlock0);
576 if (memcmp(testBlock0,newBlock0,16)==0)
577 {
578 DbpString("Cloned successfull!");
579 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
580 playing = false;
581 GotoRecord = true;
582 selected = (selected+1) % OPTS;
583 }
584 else {
585 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
586 playing = true;
587 }
588 }
589 LEDsoff();
590 LED(selected + 1, 0);
591
592 }
593 // Change where to record (or begin playing)
594 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
595 {
596 LEDsoff();
597 LED(selected + 1, 0);
598
599 // Begin transmitting
600 LED(LED_GREEN, 0);
601 DbpString("Playing");
602 for ( ; ; ) {
603 WDT_HIT();
604 int button_action = BUTTON_HELD(1000);
605 if (button_action == 0) { // No button action, proceed with sim
606 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
607 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
608 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
609 DbpString("Mifare Classic");
610 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
611 }
612 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
613 DbpString("Mifare Ultralight");
614 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
615 }
616 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
617 DbpString("Mifare DESFire");
618 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
619 }
620 else {
621 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
622 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
623 }
624 }
625 else if (button_action == BUTTON_SINGLE_CLICK) {
626 selected = (selected + 1) % OPTS;
627 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
628 GotoRecord = true;
629 break;
630 }
631 else if (button_action == BUTTON_HOLD) {
632 Dbprintf("Playtime over. Begin cloning...");
633 GotoClone = true;
634 break;
635 }
636 WDT_HIT();
637 }
638
639 /* We pressed a button so ignore it here with a delay */
640 SpinDelay(300);
641 LEDsoff();
642 LED(selected + 1, 0);
643 }
644 }
645 }
646 #elif WITH_LF_StandAlone
647 // samy's sniff and repeat routine
648 void SamyRun()
649 {
650 StandAloneMode();
651 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
652
653 int high[OPTS], low[OPTS];
654 int selected = 0;
655 int playing = 0;
656 int cardRead = 0;
657
658 // Turn on selected LED
659 LED(selected + 1, 0);
660
661 for (;;)
662 {
663 usb_poll();
664 WDT_HIT();
665
666 // Was our button held down or pressed?
667 int button_pressed = BUTTON_HELD(1000);
668 SpinDelay(300);
669
670 // Button was held for a second, begin recording
671 if (button_pressed > 0 && cardRead == 0)
672 {
673 LEDsoff();
674 LED(selected + 1, 0);
675 LED(LED_RED2, 0);
676
677 // record
678 DbpString("Starting recording");
679
680 // wait for button to be released
681 while(BUTTON_PRESS())
682 WDT_HIT();
683
684 /* need this delay to prevent catching some weird data */
685 SpinDelay(500);
686
687 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
688 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
689
690 LEDsoff();
691 LED(selected + 1, 0);
692 // Finished recording
693
694 // If we were previously playing, set playing off
695 // so next button push begins playing what we recorded
696 playing = 0;
697
698 cardRead = 1;
699
700 }
701
702 else if (button_pressed > 0 && cardRead == 1)
703 {
704 LEDsoff();
705 LED(selected + 1, 0);
706 LED(LED_ORANGE, 0);
707
708 // record
709 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
710
711 // wait for button to be released
712 while(BUTTON_PRESS())
713 WDT_HIT();
714
715 /* need this delay to prevent catching some weird data */
716 SpinDelay(500);
717
718 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
719 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
720
721 LEDsoff();
722 LED(selected + 1, 0);
723 // Finished recording
724
725 // If we were previously playing, set playing off
726 // so next button push begins playing what we recorded
727 playing = 0;
728
729 cardRead = 0;
730
731 }
732
733 // Change where to record (or begin playing)
734 else if (button_pressed)
735 {
736 // Next option if we were previously playing
737 if (playing)
738 selected = (selected + 1) % OPTS;
739 playing = !playing;
740
741 LEDsoff();
742 LED(selected + 1, 0);
743
744 // Begin transmitting
745 if (playing)
746 {
747 LED(LED_GREEN, 0);
748 DbpString("Playing");
749 // wait for button to be released
750 while(BUTTON_PRESS())
751 WDT_HIT();
752 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
753 CmdHIDsimTAG(high[selected], low[selected], 0);
754 DbpString("Done playing");
755 if (BUTTON_HELD(1000) > 0)
756 {
757 DbpString("Exiting");
758 LEDsoff();
759 return;
760 }
761
762 /* We pressed a button so ignore it here with a delay */
763 SpinDelay(300);
764
765 // when done, we're done playing, move to next option
766 selected = (selected + 1) % OPTS;
767 playing = !playing;
768 LEDsoff();
769 LED(selected + 1, 0);
770 }
771 else
772 while(BUTTON_PRESS())
773 WDT_HIT();
774 }
775 }
776 }
777
778 #endif
779 /*
780 OBJECTIVE
781 Listen and detect an external reader. Determine the best location
782 for the antenna.
783
784 INSTRUCTIONS:
785 Inside the ListenReaderField() function, there is two mode.
786 By default, when you call the function, you will enter mode 1.
787 If you press the PM3 button one time, you will enter mode 2.
788 If you press the PM3 button a second time, you will exit the function.
789
790 DESCRIPTION OF MODE 1:
791 This mode just listens for an external reader field and lights up green
792 for HF and/or red for LF. This is the original mode of the detectreader
793 function.
794
795 DESCRIPTION OF MODE 2:
796 This mode will visually represent, using the LEDs, the actual strength of the
797 current compared to the maximum current detected. Basically, once you know
798 what kind of external reader is present, it will help you spot the best location to place
799 your antenna. You will probably not get some good results if there is a LF and a HF reader
800 at the same place! :-)
801
802 LIGHT SCHEME USED:
803 */
804 static const char LIGHT_SCHEME[] = {
805 0x0, /* ---- | No field detected */
806 0x1, /* X--- | 14% of maximum current detected */
807 0x2, /* -X-- | 29% of maximum current detected */
808 0x4, /* --X- | 43% of maximum current detected */
809 0x8, /* ---X | 57% of maximum current detected */
810 0xC, /* --XX | 71% of maximum current detected */
811 0xE, /* -XXX | 86% of maximum current detected */
812 0xF, /* XXXX | 100% of maximum current detected */
813 };
814 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
815
816 void ListenReaderField(int limit)
817 {
818 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
819 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
820 int mode=1, display_val, display_max, i;
821
822 #define LF_ONLY 1
823 #define HF_ONLY 2
824 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
825
826
827 // switch off FPGA - we don't want to measure our own signal
828 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
829 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
830
831 LEDsoff();
832
833 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
834
835 if(limit != HF_ONLY) {
836 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
837 lf_baseline = lf_av;
838 }
839
840 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
841
842 if (limit != LF_ONLY) {
843 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
844 hf_baseline = hf_av;
845 }
846
847 for(;;) {
848 if (BUTTON_PRESS()) {
849 SpinDelay(500);
850 switch (mode) {
851 case 1:
852 mode=2;
853 DbpString("Signal Strength Mode");
854 break;
855 case 2:
856 default:
857 DbpString("Stopped");
858 LEDsoff();
859 return;
860 break;
861 }
862 }
863 WDT_HIT();
864
865 if (limit != HF_ONLY) {
866 if(mode == 1) {
867 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
868 LED_D_ON();
869 else
870 LED_D_OFF();
871 }
872
873 lf_av_new = AvgAdc(ADC_CHAN_LF);
874 // see if there's a significant change
875 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
876 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
877 lf_av = lf_av_new;
878 if (lf_av > lf_max)
879 lf_max = lf_av;
880 }
881 }
882
883 if (limit != LF_ONLY) {
884 if (mode == 1){
885 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
886 LED_B_ON();
887 else
888 LED_B_OFF();
889 }
890
891 hf_av_new = AvgAdc(ADC_CHAN_HF);
892 // see if there's a significant change
893 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
894 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
895 hf_av = hf_av_new;
896 if (hf_av > hf_max)
897 hf_max = hf_av;
898 }
899 }
900
901 if(mode == 2) {
902 if (limit == LF_ONLY) {
903 display_val = lf_av;
904 display_max = lf_max;
905 } else if (limit == HF_ONLY) {
906 display_val = hf_av;
907 display_max = hf_max;
908 } else { /* Pick one at random */
909 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
910 display_val = hf_av;
911 display_max = hf_max;
912 } else {
913 display_val = lf_av;
914 display_max = lf_max;
915 }
916 }
917 for (i=0; i<LIGHT_LEN; i++) {
918 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
919 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
920 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
921 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
922 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
923 break;
924 }
925 }
926 }
927 }
928 }
929
930 void UsbPacketReceived(uint8_t *packet, int len)
931 {
932 UsbCommand *c = (UsbCommand *)packet;
933
934 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
935
936 switch(c->cmd) {
937 #ifdef WITH_LF
938 case CMD_SET_LF_SAMPLING_CONFIG:
939 setSamplingConfig((sample_config *) c->d.asBytes);
940 break;
941 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
942 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
943 break;
944 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
945 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
946 break;
947 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
948 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
949 break;
950 case CMD_HID_DEMOD_FSK:
951 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
952 break;
953 case CMD_HID_SIM_TAG:
954 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
955 break;
956 case CMD_FSK_SIM_TAG:
957 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
958 break;
959 case CMD_ASK_SIM_TAG:
960 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
961 break;
962 case CMD_PSK_SIM_TAG:
963 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
964 break;
965 case CMD_HID_CLONE_TAG:
966 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
967 break;
968 case CMD_IO_DEMOD_FSK:
969 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
970 break;
971 case CMD_IO_CLONE_TAG:
972 CopyIOtoT55x7(c->arg[0], c->arg[1]);
973 break;
974 case CMD_EM410X_DEMOD:
975 CmdEM410xdemod(c->arg[0], 0, 0, 1);
976 break;
977 case CMD_EM410X_WRITE_TAG:
978 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
979 break;
980 case CMD_READ_TI_TYPE:
981 ReadTItag();
982 break;
983 case CMD_WRITE_TI_TYPE:
984 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
985 break;
986 case CMD_SIMULATE_TAG_125K:
987 LED_A_ON();
988 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
989 LED_A_OFF();
990 break;
991 case CMD_LF_SIMULATE_BIDIR:
992 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
993 break;
994 case CMD_INDALA_CLONE_TAG:
995 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
996 break;
997 case CMD_INDALA_CLONE_TAG_L:
998 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
999 break;
1000 case CMD_T55XX_READ_BLOCK:
1001 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1002 break;
1003 case CMD_T55XX_WRITE_BLOCK:
1004 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1005 break;
1006 case CMD_T55XX_WAKEUP:
1007 T55xxWakeUp(c->arg[0]);
1008 break;
1009 case CMD_T55XX_RESET_READ:
1010 T55xxResetRead();
1011 break;
1012 case CMD_PCF7931_READ:
1013 ReadPCF7931();
1014 break;
1015 case CMD_PCF7931_WRITE:
1016 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1017 break;
1018 case CMD_EM4X_READ_WORD:
1019 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1020 break;
1021 case CMD_EM4X_WRITE_WORD:
1022 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1023 break;
1024 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1025 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1026 break;
1027 case CMD_VIKING_CLONE_TAG:
1028 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1029 break;
1030 case CMD_COTAG:
1031 Cotag(c->arg[0]);
1032 break;
1033 #endif
1034
1035 #ifdef WITH_HITAG
1036 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1037 SnoopHitag(c->arg[0]);
1038 break;
1039 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1040 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1041 break;
1042 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1043 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1044 break;
1045 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1046 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1047 break;
1048 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1049 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1050 break;
1051 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1052 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1053 break;
1054 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1055 if ((hitag_function)c->arg[0] < 10) {
1056 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1057 }
1058 else if ((hitag_function)c->arg[0] >= 10) {
1059 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1060 }
1061 break;
1062 #endif
1063
1064 #ifdef WITH_ISO15693
1065 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1066 AcquireRawAdcSamplesIso15693();
1067 break;
1068 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1069 RecordRawAdcSamplesIso15693();
1070 break;
1071
1072 case CMD_ISO_15693_COMMAND:
1073 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1074 break;
1075
1076 case CMD_ISO_15693_FIND_AFI:
1077 BruteforceIso15693Afi(c->arg[0]);
1078 break;
1079
1080 case CMD_ISO_15693_DEBUG:
1081 SetDebugIso15693(c->arg[0]);
1082 break;
1083
1084 case CMD_READER_ISO_15693:
1085 ReaderIso15693(c->arg[0]);
1086 break;
1087 case CMD_SIMTAG_ISO_15693:
1088 SimTagIso15693(c->arg[0], c->d.asBytes);
1089 break;
1090 #endif
1091
1092 #ifdef WITH_LEGICRF
1093 case CMD_SIMULATE_TAG_LEGIC_RF:
1094 LegicRfSimulate(c->arg[0]);
1095 break;
1096
1097 case CMD_WRITER_LEGIC_RF:
1098 LegicRfWriter(c->arg[1], c->arg[0]);
1099 break;
1100
1101 case CMD_READER_LEGIC_RF:
1102 LegicRfReader(c->arg[0], c->arg[1]);
1103 break;
1104 #endif
1105
1106 #ifdef WITH_ISO14443b
1107 case CMD_READ_SRI512_TAG:
1108 ReadSTMemoryIso14443b(0x0F);
1109 break;
1110 case CMD_READ_SRIX4K_TAG:
1111 ReadSTMemoryIso14443b(0x7F);
1112 break;
1113 case CMD_SNOOP_ISO_14443B:
1114 SnoopIso14443b();
1115 break;
1116 case CMD_SIMULATE_TAG_ISO_14443B:
1117 SimulateIso14443bTag();
1118 break;
1119 case CMD_ISO_14443B_COMMAND:
1120 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1121 break;
1122 #endif
1123
1124 #ifdef WITH_ISO14443a
1125 case CMD_SNOOP_ISO_14443a:
1126 SnoopIso14443a(c->arg[0]);
1127 break;
1128 case CMD_READER_ISO_14443a:
1129 ReaderIso14443a(c);
1130 break;
1131 case CMD_SIMULATE_TAG_ISO_14443a:
1132 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1133 break;
1134
1135 case CMD_EPA_PACE_COLLECT_NONCE:
1136 EPA_PACE_Collect_Nonce(c);
1137 break;
1138 case CMD_EPA_PACE_REPLAY:
1139 EPA_PACE_Replay(c);
1140 break;
1141
1142 case CMD_READER_MIFARE:
1143 ReaderMifare(c->arg[0]);
1144 break;
1145 case CMD_MIFARE_READBL:
1146 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1147 break;
1148 case CMD_MIFAREU_READBL:
1149 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1150 break;
1151 case CMD_MIFAREUC_AUTH:
1152 MifareUC_Auth(c->arg[0],c->d.asBytes);
1153 break;
1154 case CMD_MIFAREU_READCARD:
1155 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1156 break;
1157 case CMD_MIFAREUC_SETPWD:
1158 MifareUSetPwd(c->arg[0], c->d.asBytes);
1159 break;
1160 case CMD_MIFARE_READSC:
1161 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1162 break;
1163 case CMD_MIFARE_WRITEBL:
1164 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1165 break;
1166 //case CMD_MIFAREU_WRITEBL_COMPAT:
1167 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1168 //break;
1169 case CMD_MIFAREU_WRITEBL:
1170 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1171 break;
1172 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1173 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1174 break;
1175 case CMD_MIFARE_NESTED:
1176 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1177 break;
1178 case CMD_MIFARE_CHKKEYS:
1179 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1180 break;
1181 case CMD_SIMULATE_MIFARE_CARD:
1182 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1183 break;
1184
1185 // emulator
1186 case CMD_MIFARE_SET_DBGMODE:
1187 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1188 break;
1189 case CMD_MIFARE_EML_MEMCLR:
1190 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1191 break;
1192 case CMD_MIFARE_EML_MEMSET:
1193 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1194 break;
1195 case CMD_MIFARE_EML_MEMGET:
1196 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1197 break;
1198 case CMD_MIFARE_EML_CARDLOAD:
1199 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1200 break;
1201
1202 // Work with "magic Chinese" card
1203 case CMD_MIFARE_CWIPE:
1204 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1205 break;
1206 case CMD_MIFARE_CSETBLOCK:
1207 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1208 break;
1209 case CMD_MIFARE_CGETBLOCK:
1210 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1211 break;
1212 case CMD_MIFARE_CIDENT:
1213 MifareCIdent();
1214 break;
1215
1216 // mifare sniffer
1217 case CMD_MIFARE_SNIFFER:
1218 SniffMifare(c->arg[0]);
1219 break;
1220
1221 #endif
1222
1223 #ifdef WITH_ICLASS
1224 // Makes use of ISO14443a FPGA Firmware
1225 case CMD_SNOOP_ICLASS:
1226 SnoopIClass();
1227 break;
1228 case CMD_SIMULATE_TAG_ICLASS:
1229 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1230 break;
1231 case CMD_READER_ICLASS:
1232 ReaderIClass(c->arg[0]);
1233 break;
1234 case CMD_READER_ICLASS_REPLAY:
1235 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1236 break;
1237 case CMD_ICLASS_EML_MEMSET:
1238 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1239 break;
1240 case CMD_ICLASS_WRITEBLOCK:
1241 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1242 break;
1243 case CMD_ICLASS_READCHECK: // auth step 1
1244 iClass_ReadCheck(c->arg[0], c->arg[1]);
1245 break;
1246 case CMD_ICLASS_READBLOCK:
1247 iClass_ReadBlk(c->arg[0]);
1248 break;
1249 case CMD_ICLASS_AUTHENTICATION: //check
1250 iClass_Authentication(c->d.asBytes);
1251 break;
1252 case CMD_ICLASS_DUMP:
1253 iClass_Dump(c->arg[0], c->arg[1]);
1254 break;
1255 case CMD_ICLASS_CLONE:
1256 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1257 break;
1258 #endif
1259 #ifdef WITH_HFSNOOP
1260 case CMD_HF_SNIFFER:
1261 HfSnoop(c->arg[0], c->arg[1]);
1262 break;
1263 #endif
1264 #ifdef WITH_SMARTCARD
1265 case CMD_SMART_ATR: {
1266 SmartCardAtr();
1267 break;
1268 }
1269 case CMD_SMART_SETCLOCK:{
1270 SmartCardSetClock(c->arg[0]);
1271 break;
1272 }
1273 case CMD_SMART_RAW: {
1274 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1275 break;
1276 }
1277 case CMD_SMART_UPLOAD: {
1278 // upload file from client
1279 uint8_t *mem = BigBuf_get_addr();
1280 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1281 cmd_send(CMD_ACK,1,0,0,0,0);
1282 break;
1283 }
1284 case CMD_SMART_UPGRADE: {
1285 SmartCardUpgrade(c->arg[0]);
1286 break;
1287 }
1288 #endif
1289
1290 case CMD_BUFF_CLEAR:
1291 BigBuf_Clear();
1292 break;
1293
1294 case CMD_MEASURE_ANTENNA_TUNING:
1295 MeasureAntennaTuning(c->arg[0]);
1296 break;
1297
1298 case CMD_MEASURE_ANTENNA_TUNING_HF:
1299 MeasureAntennaTuningHf();
1300 break;
1301
1302 case CMD_LISTEN_READER_FIELD:
1303 ListenReaderField(c->arg[0]);
1304 break;
1305
1306 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1307 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1308 SpinDelay(200);
1309 LED_D_OFF(); // LED D indicates field ON or OFF
1310 break;
1311
1312 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1313
1314 LED_B_ON();
1315 uint8_t *BigBuf = BigBuf_get_addr();
1316 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1317 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1318 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1319 }
1320 // Trigger a finish downloading signal with an ACK frame
1321 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1322 LED_B_OFF();
1323 break;
1324
1325 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1326 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1327 // to be able to use this one for uploading data to device
1328 // arg1 = 0 upload for LF usage
1329 // 1 upload for HF usage
1330 if (c->arg[1] == 0)
1331 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1332 else
1333 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1334
1335 uint8_t *b = BigBuf_get_addr();
1336 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1337 cmd_send(CMD_ACK,0,0,0,0,0);
1338 break;
1339 }
1340 case CMD_READ_MEM:
1341 ReadMem(c->arg[0]);
1342 break;
1343
1344 case CMD_SET_LF_DIVISOR:
1345 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1346 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1347 break;
1348
1349 case CMD_SET_ADC_MUX:
1350 switch(c->arg[0]) {
1351 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1352 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1353 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1354 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1355 }
1356 break;
1357
1358 case CMD_VERSION:
1359 SendVersion();
1360 break;
1361 case CMD_STATUS:
1362 SendStatus();
1363 break;
1364 case CMD_PING:
1365 cmd_send(CMD_ACK,0,0,0,0,0);
1366 break;
1367 #ifdef WITH_LCD
1368 case CMD_LCD_RESET:
1369 LCDReset();
1370 break;
1371 case CMD_LCD:
1372 LCDSend(c->arg[0]);
1373 break;
1374 #endif
1375 case CMD_SETUP_WRITE:
1376 case CMD_FINISH_WRITE:
1377 case CMD_HARDWARE_RESET:
1378 usb_disable();
1379 SpinDelay(1000);
1380 SpinDelay(1000);
1381 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1382 for(;;) {
1383 // We're going to reset, and the bootrom will take control.
1384 }
1385 break;
1386
1387 case CMD_START_FLASH:
1388 if(common_area.flags.bootrom_present) {
1389 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1390 }
1391 usb_disable();
1392 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1393 for(;;);
1394 break;
1395
1396 case CMD_DEVICE_INFO: {
1397 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1398 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1399 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1400 break;
1401 }
1402 default:
1403 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1404 break;
1405 }
1406 }
1407
1408 void __attribute__((noreturn)) AppMain(void)
1409 {
1410 SpinDelay(100);
1411 clear_trace();
1412 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1413 /* Initialize common area */
1414 memset(&common_area, 0, sizeof(common_area));
1415 common_area.magic = COMMON_AREA_MAGIC;
1416 common_area.version = 1;
1417 }
1418 common_area.flags.osimage_present = 1;
1419
1420 LED_D_OFF();
1421 LED_C_OFF();
1422 LED_B_OFF();
1423 LED_A_OFF();
1424
1425 // Init USB device
1426 usb_enable();
1427
1428 // The FPGA gets its clock from us from PCK0 output, so set that up.
1429 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1430 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1431 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1432 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1433 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1434 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1435 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1436
1437 // Reset SPI
1438 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1439 // Reset SSC
1440 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1441
1442 // Load the FPGA image, which we have stored in our flash.
1443 // (the HF version by default)
1444 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1445
1446 StartTickCount();
1447
1448 #ifdef WITH_LCD
1449 LCDInit();
1450 #endif
1451
1452 byte_t rx[sizeof(UsbCommand)];
1453 size_t rx_len;
1454
1455 for(;;) {
1456 if (usb_poll()) {
1457 rx_len = usb_read(rx,sizeof(UsbCommand));
1458 if (rx_len) {
1459 UsbPacketReceived(rx,rx_len);
1460 }
1461 }
1462 WDT_HIT();
1463
1464 #ifdef WITH_LF_StandAlone
1465 #ifndef WITH_ISO14443a_StandAlone
1466 if (BUTTON_HELD(1000) > 0)
1467 SamyRun();
1468 #endif
1469 #endif
1470 #ifdef WITH_ISO14443a
1471 #ifdef WITH_ISO14443a_StandAlone
1472 if (BUTTON_HELD(1000) > 0)
1473 StandAloneMode14a();
1474 #endif
1475 #endif
1476 }
1477 }
Proxmark3 GIT tracking
Impressum, Datenschutz