]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'master' of https://github.com/Proxmark/proxmark3
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26
27 #ifdef WITH_LCD
28 #include "LCD.h"
29 #endif
30
31 #define abs(x) ( ((x)<0) ? -(x) : (x) )
32
33 //=============================================================================
34 // A buffer where we can queue things up to be sent through the FPGA, for
35 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
36 // is the order in which they go out on the wire.
37 //=============================================================================
38
39 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
40 uint8_t ToSend[TOSEND_BUFFER_SIZE];
41 int ToSendMax;
42 static int ToSendBit;
43 struct common_area common_area __attribute__((section(".commonarea")));
44
45 void BufferClear(void)
46 {
47 memset(BigBuf,0,sizeof(BigBuf));
48 Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
49 }
50
51 void ToSendReset(void)
52 {
53 ToSendMax = -1;
54 ToSendBit = 8;
55 }
56
57 void ToSendStuffBit(int b)
58 {
59 if(ToSendBit >= 8) {
60 ToSendMax++;
61 ToSend[ToSendMax] = 0;
62 ToSendBit = 0;
63 }
64
65 if(b) {
66 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
67 }
68
69 ToSendBit++;
70
71 if(ToSendMax >= sizeof(ToSend)) {
72 ToSendBit = 0;
73 DbpString("ToSendStuffBit overflowed!");
74 }
75 }
76
77 //=============================================================================
78 // Debug print functions, to go out over USB, to the usual PC-side client.
79 //=============================================================================
80
81 void DbpString(char *str)
82 {
83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
85 // /* this holds up stuff unless we're connected to usb */
86 // if (!UsbConnected())
87 // return;
88 //
89 // UsbCommand c;
90 // c.cmd = CMD_DEBUG_PRINT_STRING;
91 // c.arg[0] = strlen(str);
92 // if(c.arg[0] > sizeof(c.d.asBytes)) {
93 // c.arg[0] = sizeof(c.d.asBytes);
94 // }
95 // memcpy(c.d.asBytes, str, c.arg[0]);
96 //
97 // UsbSendPacket((uint8_t *)&c, sizeof(c));
98 // // TODO fix USB so stupid things like this aren't req'd
99 // SpinDelay(50);
100 }
101
102 #if 0
103 void DbpIntegers(int x1, int x2, int x3)
104 {
105 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
106 // /* this holds up stuff unless we're connected to usb */
107 // if (!UsbConnected())
108 // return;
109 //
110 // UsbCommand c;
111 // c.cmd = CMD_DEBUG_PRINT_INTEGERS;
112 // c.arg[0] = x1;
113 // c.arg[1] = x2;
114 // c.arg[2] = x3;
115 //
116 // UsbSendPacket((uint8_t *)&c, sizeof(c));
117 // // XXX
118 // SpinDelay(50);
119 }
120 #endif
121
122 void Dbprintf(const char *fmt, ...) {
123 // should probably limit size here; oh well, let's just use a big buffer
124 char output_string[128];
125 va_list ap;
126
127 va_start(ap, fmt);
128 kvsprintf(fmt, output_string, 10, ap);
129 va_end(ap);
130
131 DbpString(output_string);
132 }
133
134 // prints HEX & ASCII
135 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
136 int l=0,i;
137 char ascii[9];
138
139 while (len>0) {
140 if (len>8) l=8;
141 else l=len;
142
143 memcpy(ascii,d,l);
144 ascii[l]=0;
145
146 // filter safe ascii
147 for (i=0;i<l;i++)
148 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
149
150 if (bAsci) {
151 Dbprintf("%-8s %*D",ascii,l,d," ");
152 } else {
153 Dbprintf("%*D",l,d," ");
154 }
155
156 len-=8;
157 d+=8;
158 }
159 }
160
161 //-----------------------------------------------------------------------------
162 // Read an ADC channel and block till it completes, then return the result
163 // in ADC units (0 to 1023). Also a routine to average 32 samples and
164 // return that.
165 //-----------------------------------------------------------------------------
166 static int ReadAdc(int ch)
167 {
168 uint32_t d;
169
170 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
171 AT91C_BASE_ADC->ADC_MR =
172 ADC_MODE_PRESCALE(32) |
173 ADC_MODE_STARTUP_TIME(16) |
174 ADC_MODE_SAMPLE_HOLD_TIME(8);
175 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
176
177 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
178 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
179 ;
180 d = AT91C_BASE_ADC->ADC_CDR[ch];
181
182 return d;
183 }
184
185 int AvgAdc(int ch) // was static - merlok
186 {
187 int i;
188 int a = 0;
189
190 for(i = 0; i < 32; i++) {
191 a += ReadAdc(ch);
192 }
193
194 return (a + 15) >> 5;
195 }
196
197 void MeasureAntennaTuning(void)
198 {
199 uint8_t LF_Results[256];
200 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
201 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
202
203 LED_B_ON();
204
205 /*
206 * Sweeps the useful LF range of the proxmark from
207 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
208 * read the voltage in the antenna, the result left
209 * in the buffer is a graph which should clearly show
210 * the resonating frequency of your LF antenna
211 * ( hopefully around 95 if it is tuned to 125kHz!)
212 */
213
214 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
215 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
216 for (i=255; i>=19; i--) {
217 WDT_HIT();
218 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
219 SpinDelay(20);
220 // Vref = 3.3V, and a 10000:240 voltage divider on the input
221 // can measure voltages up to 137500 mV
222 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
223 if (i==95) vLf125 = adcval; // voltage at 125Khz
224 if (i==89) vLf134 = adcval; // voltage at 134Khz
225
226 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
227 if(LF_Results[i] > peak) {
228 peakv = adcval;
229 peak = LF_Results[i];
230 peakf = i;
231 //ptr = i;
232 }
233 }
234
235 for (i=18; i >= 0; i--) LF_Results[i] = 0;
236
237 LED_A_ON();
238 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
239 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
240 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
241 SpinDelay(20);
242 // Vref = 3300mV, and an 10:1 voltage divider on the input
243 // can measure voltages up to 33000 mV
244 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
245
246 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),LF_Results,256);
247 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
248 LED_A_OFF();
249 LED_B_OFF();
250 return;
251 }
252
253 void MeasureAntennaTuningHf(void)
254 {
255 int vHf = 0; // in mV
256
257 DbpString("Measuring HF antenna, press button to exit");
258
259 for (;;) {
260 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
261 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
262 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
263 SpinDelay(20);
264 // Vref = 3300mV, and an 10:1 voltage divider on the input
265 // can measure voltages up to 33000 mV
266 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
267
268 Dbprintf("%d mV",vHf);
269 if (BUTTON_PRESS()) break;
270 }
271 DbpString("cancelled");
272 }
273
274
275 void SimulateTagHfListen(void)
276 {
277 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
278 uint8_t v = 0;
279 int i;
280 int p = 0;
281
282 // We're using this mode just so that I can test it out; the simulated
283 // tag mode would work just as well and be simpler.
284 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
285 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
286
287 // We need to listen to the high-frequency, peak-detected path.
288 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
289
290 FpgaSetupSsc();
291
292 i = 0;
293 for(;;) {
294 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
295 AT91C_BASE_SSC->SSC_THR = 0xff;
296 }
297 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
298 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
299
300 v <<= 1;
301 if(r & 1) {
302 v |= 1;
303 }
304 p++;
305
306 if(p >= 8) {
307 dest[i] = v;
308 v = 0;
309 p = 0;
310 i++;
311
312 if(i >= FREE_BUFFER_SIZE) {
313 break;
314 }
315 }
316 }
317 }
318 DbpString("simulate tag (now type bitsamples)");
319 }
320
321 void ReadMem(int addr)
322 {
323 const uint8_t *data = ((uint8_t *)addr);
324
325 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
326 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
327 }
328
329 /* osimage version information is linked in */
330 extern struct version_information version_information;
331 /* bootrom version information is pointed to from _bootphase1_version_pointer */
332 extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
333 void SendVersion(void)
334 {
335 char temp[256]; /* Limited data payload in USB packets */
336 DbpString("Prox/RFID mark3 RFID instrument");
337
338 /* Try to find the bootrom version information. Expect to find a pointer at
339 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
340 * pointer, then use it.
341 */
342 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
343 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
344 DbpString("bootrom version information appears invalid");
345 } else {
346 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
347 DbpString(temp);
348 }
349
350 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
351 DbpString(temp);
352
353 FpgaGatherVersion(temp, sizeof(temp));
354 DbpString(temp);
355 // Send Chip ID
356 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
357 }
358
359 #ifdef WITH_LF
360 // samy's sniff and repeat routine
361 void SamyRun()
362 {
363 DbpString("Stand-alone mode! No PC necessary.");
364 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
365
366 // 3 possible options? no just 2 for now
367 #define OPTS 2
368
369 int high[OPTS], low[OPTS];
370
371 // Oooh pretty -- notify user we're in elite samy mode now
372 LED(LED_RED, 200);
373 LED(LED_ORANGE, 200);
374 LED(LED_GREEN, 200);
375 LED(LED_ORANGE, 200);
376 LED(LED_RED, 200);
377 LED(LED_ORANGE, 200);
378 LED(LED_GREEN, 200);
379 LED(LED_ORANGE, 200);
380 LED(LED_RED, 200);
381
382 int selected = 0;
383 int playing = 0;
384
385 // Turn on selected LED
386 LED(selected + 1, 0);
387
388 for (;;)
389 {
390 // UsbPoll(FALSE);
391 usb_poll();
392 WDT_HIT();
393
394 // Was our button held down or pressed?
395 int button_pressed = BUTTON_HELD(1000);
396 SpinDelay(300);
397
398 // Button was held for a second, begin recording
399 if (button_pressed > 0)
400 {
401 LEDsoff();
402 LED(selected + 1, 0);
403 LED(LED_RED2, 0);
404
405 // record
406 DbpString("Starting recording");
407
408 // wait for button to be released
409 while(BUTTON_PRESS())
410 WDT_HIT();
411
412 /* need this delay to prevent catching some weird data */
413 SpinDelay(500);
414
415 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
416 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
417
418 LEDsoff();
419 LED(selected + 1, 0);
420 // Finished recording
421
422 // If we were previously playing, set playing off
423 // so next button push begins playing what we recorded
424 playing = 0;
425 }
426
427 // Change where to record (or begin playing)
428 else if (button_pressed)
429 {
430 // Next option if we were previously playing
431 if (playing)
432 selected = (selected + 1) % OPTS;
433 playing = !playing;
434
435 LEDsoff();
436 LED(selected + 1, 0);
437
438 // Begin transmitting
439 if (playing)
440 {
441 LED(LED_GREEN, 0);
442 DbpString("Playing");
443 // wait for button to be released
444 while(BUTTON_PRESS())
445 WDT_HIT();
446 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
447 CmdHIDsimTAG(high[selected], low[selected], 0);
448 DbpString("Done playing");
449 if (BUTTON_HELD(1000) > 0)
450 {
451 DbpString("Exiting");
452 LEDsoff();
453 return;
454 }
455
456 /* We pressed a button so ignore it here with a delay */
457 SpinDelay(300);
458
459 // when done, we're done playing, move to next option
460 selected = (selected + 1) % OPTS;
461 playing = !playing;
462 LEDsoff();
463 LED(selected + 1, 0);
464 }
465 else
466 while(BUTTON_PRESS())
467 WDT_HIT();
468 }
469 }
470 }
471 #endif
472
473 /*
474 OBJECTIVE
475 Listen and detect an external reader. Determine the best location
476 for the antenna.
477
478 INSTRUCTIONS:
479 Inside the ListenReaderField() function, there is two mode.
480 By default, when you call the function, you will enter mode 1.
481 If you press the PM3 button one time, you will enter mode 2.
482 If you press the PM3 button a second time, you will exit the function.
483
484 DESCRIPTION OF MODE 1:
485 This mode just listens for an external reader field and lights up green
486 for HF and/or red for LF. This is the original mode of the detectreader
487 function.
488
489 DESCRIPTION OF MODE 2:
490 This mode will visually represent, using the LEDs, the actual strength of the
491 current compared to the maximum current detected. Basically, once you know
492 what kind of external reader is present, it will help you spot the best location to place
493 your antenna. You will probably not get some good results if there is a LF and a HF reader
494 at the same place! :-)
495
496 LIGHT SCHEME USED:
497 */
498 static const char LIGHT_SCHEME[] = {
499 0x0, /* ---- | No field detected */
500 0x1, /* X--- | 14% of maximum current detected */
501 0x2, /* -X-- | 29% of maximum current detected */
502 0x4, /* --X- | 43% of maximum current detected */
503 0x8, /* ---X | 57% of maximum current detected */
504 0xC, /* --XX | 71% of maximum current detected */
505 0xE, /* -XXX | 86% of maximum current detected */
506 0xF, /* XXXX | 100% of maximum current detected */
507 };
508 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
509
510 void ListenReaderField(int limit)
511 {
512 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
513 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
514 int mode=1, display_val, display_max, i;
515
516 #define LF_ONLY 1
517 #define HF_ONLY 2
518
519 LEDsoff();
520
521 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
522
523 if(limit != HF_ONLY) {
524 Dbprintf("LF 125/134 Baseline: %d", lf_av);
525 lf_baseline = lf_av;
526 }
527
528 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
529
530 if (limit != LF_ONLY) {
531 Dbprintf("HF 13.56 Baseline: %d", hf_av);
532 hf_baseline = hf_av;
533 }
534
535 for(;;) {
536 if (BUTTON_PRESS()) {
537 SpinDelay(500);
538 switch (mode) {
539 case 1:
540 mode=2;
541 DbpString("Signal Strength Mode");
542 break;
543 case 2:
544 default:
545 DbpString("Stopped");
546 LEDsoff();
547 return;
548 break;
549 }
550 }
551 WDT_HIT();
552
553 if (limit != HF_ONLY) {
554 if(mode==1) {
555 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
556 else LED_D_OFF();
557 }
558
559 ++lf_count;
560 lf_av_new= ReadAdc(ADC_CHAN_LF);
561 // see if there's a significant change
562 if(abs(lf_av - lf_av_new) > 10) {
563 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
564 lf_av = lf_av_new;
565 if (lf_av > lf_max)
566 lf_max = lf_av;
567 lf_count= 0;
568 }
569 }
570
571 if (limit != LF_ONLY) {
572 if (mode == 1){
573 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
574 else LED_B_OFF();
575 }
576
577 ++hf_count;
578 hf_av_new= ReadAdc(ADC_CHAN_HF);
579 // see if there's a significant change
580 if(abs(hf_av - hf_av_new) > 10) {
581 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
582 hf_av = hf_av_new;
583 if (hf_av > hf_max)
584 hf_max = hf_av;
585 hf_count= 0;
586 }
587 }
588
589 if(mode == 2) {
590 if (limit == LF_ONLY) {
591 display_val = lf_av;
592 display_max = lf_max;
593 } else if (limit == HF_ONLY) {
594 display_val = hf_av;
595 display_max = hf_max;
596 } else { /* Pick one at random */
597 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
598 display_val = hf_av;
599 display_max = hf_max;
600 } else {
601 display_val = lf_av;
602 display_max = lf_max;
603 }
604 }
605 for (i=0; i<LIGHT_LEN; i++) {
606 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
607 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
608 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
609 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
610 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
611 break;
612 }
613 }
614 }
615 }
616 }
617
618 void UsbPacketReceived(uint8_t *packet, int len)
619 {
620 UsbCommand *c = (UsbCommand *)packet;
621
622 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
623
624 switch(c->cmd) {
625 #ifdef WITH_LF
626 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
627 AcquireRawAdcSamples125k(c->arg[0]);
628 cmd_send(CMD_ACK,0,0,0,0,0);
629 break;
630 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
631 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
632 break;
633 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
634 SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
635 cmd_send(CMD_ACK,0,0,0,0,0);
636 break;
637 case CMD_HID_DEMOD_FSK:
638 CmdHIDdemodFSK(c->arg[0], 0, 0, 1); // Demodulate HID tag
639 break;
640 case CMD_HID_SIM_TAG:
641 CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID
642 break;
643 case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
644 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
645 break;
646 case CMD_IO_DEMOD_FSK:
647 CmdIOdemodFSK(c->arg[0], 0, 0, 1); // Demodulate IO tag
648 break;
649 case CMD_IO_CLONE_TAG: // Clone IO tag by ID to T55x7
650 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
651 break;
652 case CMD_EM410X_WRITE_TAG:
653 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
654 break;
655 case CMD_READ_TI_TYPE:
656 ReadTItag();
657 break;
658 case CMD_WRITE_TI_TYPE:
659 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
660 break;
661 case CMD_SIMULATE_TAG_125K:
662 LED_A_ON();
663 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
664 LED_A_OFF();
665 break;
666 case CMD_LF_SIMULATE_BIDIR:
667 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
668 break;
669 case CMD_INDALA_CLONE_TAG: // Clone Indala 64-bit tag by UID to T55x7
670 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
671 break;
672 case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7
673 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
674 break;
675 case CMD_T55XX_READ_BLOCK:
676 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
677 break;
678 case CMD_T55XX_WRITE_BLOCK:
679 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
680 break;
681 case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
682 T55xxReadTrace();
683 break;
684 case CMD_PCF7931_READ: // Read PCF7931 tag
685 ReadPCF7931();
686 cmd_send(CMD_ACK,0,0,0,0,0);
687 // UsbSendPacket((uint8_t*)&ack, sizeof(ack));
688 break;
689 case CMD_EM4X_READ_WORD:
690 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
691 break;
692 case CMD_EM4X_WRITE_WORD:
693 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
694 break;
695 #endif
696
697 #ifdef WITH_HITAG
698 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
699 SnoopHitag(c->arg[0]);
700 break;
701 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
702 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
703 break;
704 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
705 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
706 break;
707 #endif
708
709 #ifdef WITH_ISO15693
710 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
711 AcquireRawAdcSamplesIso15693();
712 break;
713 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
714 RecordRawAdcSamplesIso15693();
715 break;
716
717 case CMD_ISO_15693_COMMAND:
718 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
719 break;
720
721 case CMD_ISO_15693_FIND_AFI:
722 BruteforceIso15693Afi(c->arg[0]);
723 break;
724
725 case CMD_ISO_15693_DEBUG:
726 SetDebugIso15693(c->arg[0]);
727 break;
728
729 case CMD_READER_ISO_15693:
730 ReaderIso15693(c->arg[0]);
731 break;
732 case CMD_SIMTAG_ISO_15693:
733 SimTagIso15693(c->arg[0]);
734 break;
735 #endif
736
737 #ifdef WITH_LEGICRF
738 case CMD_SIMULATE_TAG_LEGIC_RF:
739 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
740 break;
741
742 case CMD_WRITER_LEGIC_RF:
743 LegicRfWriter(c->arg[1], c->arg[0]);
744 break;
745
746 case CMD_READER_LEGIC_RF:
747 LegicRfReader(c->arg[0], c->arg[1]);
748 break;
749 #endif
750
751 #ifdef WITH_ISO14443b
752 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
753 AcquireRawAdcSamplesIso14443(c->arg[0]);
754 break;
755 case CMD_READ_SRI512_TAG:
756 ReadSTMemoryIso14443(0x0F);
757 break;
758 case CMD_READ_SRIX4K_TAG:
759 ReadSTMemoryIso14443(0x7F);
760 break;
761 case CMD_SNOOP_ISO_14443:
762 SnoopIso14443();
763 break;
764 case CMD_SIMULATE_TAG_ISO_14443:
765 SimulateIso14443Tag();
766 break;
767 case CMD_ISO_14443B_COMMAND:
768 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
769 break;
770 #endif
771
772 #ifdef WITH_ISO14443a
773 case CMD_SNOOP_ISO_14443a:
774 SnoopIso14443a(c->arg[0]);
775 break;
776 case CMD_READER_ISO_14443a:
777 ReaderIso14443a(c);
778 break;
779 case CMD_SIMULATE_TAG_ISO_14443a:
780 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
781 break;
782 case CMD_EPA_PACE_COLLECT_NONCE:
783 EPA_PACE_Collect_Nonce(c);
784 break;
785
786 case CMD_READER_MIFARE:
787 ReaderMifare(c->arg[0]);
788 break;
789 case CMD_MIFARE_READBL:
790 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
791 break;
792 case CMD_MIFAREU_READBL:
793 MifareUReadBlock(c->arg[0],c->d.asBytes);
794 break;
795 case CMD_MIFAREU_READCARD:
796 MifareUReadCard(c->arg[0],c->d.asBytes);
797 break;
798 case CMD_MIFARE_READSC:
799 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
800 break;
801 case CMD_MIFARE_WRITEBL:
802 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
803 break;
804 case CMD_MIFAREU_WRITEBL_COMPAT:
805 MifareUWriteBlock(c->arg[0], c->d.asBytes);
806 break;
807 case CMD_MIFAREU_WRITEBL:
808 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
809 break;
810 case CMD_MIFARE_NESTED:
811 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
812 break;
813 case CMD_MIFARE_CHKKEYS:
814 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
815 break;
816 case CMD_SIMULATE_MIFARE_CARD:
817 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
818 break;
819
820 // emulator
821 case CMD_MIFARE_SET_DBGMODE:
822 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
823 break;
824 case CMD_MIFARE_EML_MEMCLR:
825 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
826 break;
827 case CMD_MIFARE_EML_MEMSET:
828 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
829 break;
830 case CMD_MIFARE_EML_MEMGET:
831 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
832 break;
833 case CMD_MIFARE_EML_CARDLOAD:
834 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
835 break;
836
837 // Work with "magic Chinese" card
838 case CMD_MIFARE_EML_CSETBLOCK:
839 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
840 break;
841 case CMD_MIFARE_EML_CGETBLOCK:
842 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
843 break;
844
845 // mifare sniffer
846 case CMD_MIFARE_SNIFFER:
847 SniffMifare(c->arg[0]);
848 break;
849 #endif
850
851 #ifdef WITH_ICLASS
852 // Makes use of ISO14443a FPGA Firmware
853 case CMD_SNOOP_ICLASS:
854 SnoopIClass();
855 break;
856 case CMD_SIMULATE_TAG_ICLASS:
857 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
858 break;
859 case CMD_READER_ICLASS:
860 ReaderIClass(c->arg[0]);
861 break;
862 case CMD_READER_ICLASS_REPLAY:
863 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
864 break;
865 #endif
866
867 case CMD_SIMULATE_TAG_HF_LISTEN:
868 SimulateTagHfListen();
869 break;
870
871 case CMD_BUFF_CLEAR:
872 BufferClear();
873 break;
874
875 case CMD_MEASURE_ANTENNA_TUNING:
876 MeasureAntennaTuning();
877 break;
878
879 case CMD_MEASURE_ANTENNA_TUNING_HF:
880 MeasureAntennaTuningHf();
881 break;
882
883 case CMD_LISTEN_READER_FIELD:
884 ListenReaderField(c->arg[0]);
885 break;
886
887 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
888 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
889 SpinDelay(200);
890 LED_D_OFF(); // LED D indicates field ON or OFF
891 break;
892
893 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
894 // UsbCommand n;
895 // if(c->cmd == CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K) {
896 // n.cmd = CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K;
897 // } else {
898 // n.cmd = CMD_DOWNLOADED_RAW_BITS_TI_TYPE;
899 // }
900 // n.arg[0] = c->arg[0];
901 // memcpy(n.d.asBytes, BigBuf+c->arg[0], 48); // 12*sizeof(uint32_t)
902 // LED_B_ON();
903 // usb_write((uint8_t *)&n, sizeof(n));
904 // UsbSendPacket((uint8_t *)&n, sizeof(n));
905 // LED_B_OFF();
906
907 LED_B_ON();
908 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
909 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
910 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
911 }
912 // Trigger a finish downloading signal with an ACK frame
913 cmd_send(CMD_ACK,0,0,0,0,0);
914 LED_B_OFF();
915 break;
916
917 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
918 uint8_t *b = (uint8_t *)BigBuf;
919 memcpy(b+c->arg[0], c->d.asBytes, 48);
920 //Dbprintf("copied 48 bytes to %i",b+c->arg[0]);
921 // UsbSendPacket((uint8_t*)&ack, sizeof(ack));
922 cmd_send(CMD_ACK,0,0,0,0,0);
923 break;
924 }
925 case CMD_READ_MEM:
926 ReadMem(c->arg[0]);
927 break;
928
929 case CMD_SET_LF_DIVISOR:
930 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
931 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
932 break;
933
934 case CMD_SET_ADC_MUX:
935 switch(c->arg[0]) {
936 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
937 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
938 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
939 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
940 }
941 break;
942
943 case CMD_VERSION:
944 SendVersion();
945 break;
946
947 #ifdef WITH_LCD
948 case CMD_LCD_RESET:
949 LCDReset();
950 break;
951 case CMD_LCD:
952 LCDSend(c->arg[0]);
953 break;
954 #endif
955 case CMD_SETUP_WRITE:
956 case CMD_FINISH_WRITE:
957 case CMD_HARDWARE_RESET:
958 usb_disable();
959 SpinDelay(1000);
960 SpinDelay(1000);
961 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
962 for(;;) {
963 // We're going to reset, and the bootrom will take control.
964 }
965 break;
966
967 case CMD_START_FLASH:
968 if(common_area.flags.bootrom_present) {
969 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
970 }
971 usb_disable();
972 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
973 for(;;);
974 break;
975
976 case CMD_DEVICE_INFO: {
977 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
978 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
979 // UsbSendPacket((uint8_t*)&c, sizeof(c));
980 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
981 break;
982 }
983 default:
984 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
985 break;
986 }
987 }
988
989 void __attribute__((noreturn)) AppMain(void)
990 {
991 SpinDelay(100);
992
993 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
994 /* Initialize common area */
995 memset(&common_area, 0, sizeof(common_area));
996 common_area.magic = COMMON_AREA_MAGIC;
997 common_area.version = 1;
998 }
999 common_area.flags.osimage_present = 1;
1000
1001 LED_D_OFF();
1002 LED_C_OFF();
1003 LED_B_OFF();
1004 LED_A_OFF();
1005
1006 // Init USB device`
1007 usb_enable();
1008 // UsbStart();
1009
1010 // The FPGA gets its clock from us from PCK0 output, so set that up.
1011 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1012 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1013 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1014 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1015 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1016 AT91C_PMC_PRES_CLK_4;
1017 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1018
1019 // Reset SPI
1020 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1021 // Reset SSC
1022 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1023
1024 // Load the FPGA image, which we have stored in our flash.
1025 // (the HF version by default)
1026 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1027
1028 StartTickCount();
1029
1030 #ifdef WITH_LCD
1031 LCDInit();
1032 #endif
1033
1034 byte_t rx[sizeof(UsbCommand)];
1035 size_t rx_len;
1036
1037 for(;;) {
1038 if (usb_poll()) {
1039 rx_len = usb_read(rx,sizeof(UsbCommand));
1040 if (rx_len) {
1041 UsbPacketReceived(rx,rx_len);
1042 }
1043 }
1044 // UsbPoll(FALSE);
1045
1046 WDT_HIT();
1047
1048 #ifdef WITH_LF
1049 if (BUTTON_HELD(1000) > 0)
1050 SamyRun();
1051 #endif
1052 }
1053 }
Proxmark3 GIT tracking
Impressum, Datenschutz