]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
CHG: syntax suger
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
c3c241f3 12#include "usb_cdc.h"
13#include "cmd.h"
c3c241f3 14#include "proxmark3.h"
15c4dc5a 15#include "apps.h"
f7e3ed82 16#include "util.h"
9ab7a6c7 17#include "printf.h"
18#include "string.h"
9ab7a6c7 19#include <stdarg.h>
15c4dc5a 20#include "legicrf.h"
0db11b71 21#include "hitag2.h"
22#include "hitagS.h"
31abe49f 23#include "lfsampling.h"
3000dc4e 24#include "BigBuf.h"
7838f4be 25#include "mifareutil.h"
36804420 26#include "pcf7931.h"
f2c2b174 27
15c4dc5a 28#ifdef WITH_LCD
902cb3c0 29 #include "LCD.h"
15c4dc5a 30#endif
31
7838f4be 32// Craig Young - 14a stand-alone code
33#ifdef WITH_ISO14443a_StandAlone
34 #include "iso14443a.h"
c2731f37 35 #include "protocols.h"
7838f4be 36#endif
37
15c4dc5a 38//=============================================================================
39// A buffer where we can queue things up to be sent through the FPGA, for
40// any purpose (fake tag, as reader, whatever). We go MSB first, since that
41// is the order in which they go out on the wire.
42//=============================================================================
43
6a1f2d82 44#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
a501c82b 45uint8_t ToSend[TOSEND_BUFFER_SIZE];
7838f4be 46int ToSendMax = 0;
15c4dc5a 47static int ToSendBit;
48struct common_area common_area __attribute__((section(".commonarea")));
49
15c4dc5a 50void ToSendReset(void)
51{
52 ToSendMax = -1;
53 ToSendBit = 8;
54}
55
da198be4 56void ToSendStuffBit(int b) {
15c4dc5a 57 if(ToSendBit >= 8) {
da198be4 58 ++ToSendMax;
15c4dc5a 59 ToSend[ToSendMax] = 0;
60 ToSendBit = 0;
61 }
62
da198be4 63 if(b)
15c4dc5a 64 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
15c4dc5a 65
da198be4 66 ++ToSendBit;
15c4dc5a 67
6a1f2d82 68 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 69 ToSendBit = 0;
70 DbpString("ToSendStuffBit overflowed!");
71 }
72}
73
74//=============================================================================
75// Debug print functions, to go out over USB, to the usual PC-side client.
76//=============================================================================
77
38e41917 78void DbpStringEx(char *str, uint32_t cmd){
79 byte_t len = strlen(str);
80 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
81}
82
da198be4 83void DbpString(char *str) {
38e41917 84 DbpStringEx(str, 0);
15c4dc5a 85}
86
87#if 0
da198be4 88void DbpIntegers(int x1, int x2, int x3) {
38e41917 89 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 90}
91#endif
38e41917 92void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
93 // should probably limit size here; oh well, let's just use a big buffer
94 char output_string[128] = {0x00};
95 va_list ap;
96
97 va_start(ap, fmt);
98 kvsprintf(fmt, output_string, 10, ap);
99 va_end(ap);
100
101 DbpStringEx(output_string, cmd);
102}
15c4dc5a 103
104void Dbprintf(const char *fmt, ...) {
da198be4 105 // should probably limit size here; oh well, let's just use a big buffer
106 char output_string[128] = {0x00};
15c4dc5a 107 va_list ap;
108
109 va_start(ap, fmt);
110 kvsprintf(fmt, output_string, 10, ap);
111 va_end(ap);
e30c654b 112
15c4dc5a 113 DbpString(output_string);
114}
115
9455b51c 116// prints HEX & ASCII
d19929cb 117void Dbhexdump(int len, uint8_t *d, bool bAsci) {
da198be4 118 int l=0, i;
9455b51c 119 char ascii[9];
d19929cb 120
9455b51c 121 while (len>0) {
da198be4 122
123 l = (len>8) ? 8 : len;
9455b51c 124
125 memcpy(ascii,d,l);
d19929cb 126 ascii[l]=0;
9455b51c 127
128 // filter safe ascii
da198be4 129 for (i=0; i<l; ++i)
9455b51c 130 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 131
da198be4 132 if (bAsci)
d19929cb 133 Dbprintf("%-8s %*D",ascii,l,d," ");
da198be4 134 else
d19929cb 135 Dbprintf("%*D",l,d," ");
d19929cb 136
da198be4 137 len -= 8;
138 d += 8;
9455b51c 139 }
140}
141
15c4dc5a 142//-----------------------------------------------------------------------------
143// Read an ADC channel and block till it completes, then return the result
144// in ADC units (0 to 1023). Also a routine to average 32 samples and
145// return that.
146//-----------------------------------------------------------------------------
147static int ReadAdc(int ch)
148{
f7e3ed82 149 uint32_t d;
15c4dc5a 150
151 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
152 AT91C_BASE_ADC->ADC_MR =
3b692427 153 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
154 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
155 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
156
157 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
158 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
159 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
160 //
161 // The maths are:
162 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
163 //
164 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
165 //
166 // Note: with the "historic" values in the comments above, the error was 34% !!!
167
15c4dc5a 168 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
169
170 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
3b692427 171
da198be4 172 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
173
15c4dc5a 174 d = AT91C_BASE_ADC->ADC_CDR[ch];
15c4dc5a 175 return d;
176}
177
9ca155ba 178int AvgAdc(int ch) // was static - merlok
15c4dc5a 179{
180 int i;
181 int a = 0;
182
da198be4 183 for(i = 0; i < 32; ++i)
15c4dc5a 184 a += ReadAdc(ch);
15c4dc5a 185
186 return (a + 15) >> 5;
187}
188
da198be4 189void MeasureAntennaTuning(void) {
d3499d36 190 uint8_t LF_Results[256];
9f693930 191 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 192 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
193
7838f4be 194 LED_B_ON();
15c4dc5a 195
196/*
197 * Sweeps the useful LF range of the proxmark from
198 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
199 * read the voltage in the antenna, the result left
200 * in the buffer is a graph which should clearly show
201 * the resonating frequency of your LF antenna
202 * ( hopefully around 95 if it is tuned to 125kHz!)
203 */
d19929cb 204
7cc204bf 205 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 206 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
da198be4 207
d3499d36 208 for (i=255; i>=19; i--) {
da198be4 209 WDT_HIT();
15c4dc5a 210 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
211 SpinDelay(20);
3b692427 212 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
15c4dc5a 213 if (i==95) vLf125 = adcval; // voltage at 125Khz
214 if (i==89) vLf134 = adcval; // voltage at 134Khz
215
d3499d36 216 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
217 if(LF_Results[i] > peak) {
15c4dc5a 218 peakv = adcval;
d3499d36 219 peak = LF_Results[i];
15c4dc5a 220 peakf = i;
9f693930 221 //ptr = i;
15c4dc5a 222 }
223 }
224
d3499d36 225 for (i=18; i >= 0; i--) LF_Results[i] = 0;
226
7838f4be 227 LED_A_ON();
15c4dc5a 228 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7838f4be 229 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 230 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
231 SpinDelay(20);
3b692427 232 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
15c4dc5a 233
3b692427 234 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
d19929cb 235 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
da198be4 236
237 LEDsoff();
15c4dc5a 238}
239
da198be4 240void MeasureAntennaTuningHf(void) {
15c4dc5a 241 int vHf = 0; // in mV
3b692427 242 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
243 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
244 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
245
38e41917 246 while ( !BUTTON_PRESS() ){
15c4dc5a 247 SpinDelay(20);
3b692427 248 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
38e41917 249 //Dbprintf("%d mV",vHf);
250 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
15c4dc5a 251 }
3b692427 252 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
38e41917 253 DbpString("cancelled");
15c4dc5a 254}
255
256
da198be4 257void ReadMem(int addr) {
f7e3ed82 258 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 259
260 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
261 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
262}
263
264/* osimage version information is linked in */
265extern struct version_information version_information;
266/* bootrom version information is pointed to from _bootphase1_version_pointer */
9783989b 267extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
15c4dc5a 268void SendVersion(void)
269{
9783989b 270 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
271 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 272
273 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 274 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
275 * pointer, then use it.
276 */
277 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
da198be4 278
15c4dc5a 279 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
9783989b 280 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 281 } else {
282 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
9783989b 283 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 284 }
e30c654b 285
15c4dc5a 286 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
9783989b 287 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 288
9783989b 289 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
290 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
da198be4 291
9783989b 292 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
293 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
294
295 // Send Chip ID and used flash memory
296 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
297 uint32_t compressed_data_section_size = common_area.arg1;
298 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 299}
f62b5e12 300
301// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
302// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
0de8e387 303void printUSBSpeed(void)
f62b5e12 304{
305 Dbprintf("USB Speed:");
0de8e387 306 Dbprintf(" Sending USB packets to client...");
f62b5e12 307
0de8e387 308 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
f62b5e12 309 uint8_t *test_data = BigBuf_get_addr();
0de8e387 310 uint32_t end_time;
f62b5e12 311
0de8e387 312 uint32_t start_time = end_time = GetTickCount();
313 uint32_t bytes_transferred = 0;
f62b5e12 314
315 LED_B_ON();
0de8e387 316 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
317 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
318 end_time = GetTickCount();
319 bytes_transferred += USB_CMD_DATA_SIZE;
f62b5e12 320 }
321 LED_B_OFF();
322
0de8e387 323 Dbprintf(" Time elapsed: %dms", end_time - start_time);
324 Dbprintf(" Bytes transferred: %d", bytes_transferred);
325 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
326 1000 * bytes_transferred / (end_time - start_time));
f62b5e12 327
328}
329
7838f4be 330/**
331 * Prints runtime information about the PM3.
332**/
da198be4 333void SendStatus(void) {
7838f4be 334 BigBuf_print_status();
335 Fpga_print_status();
336 printConfig(); //LF Sampling config
0de8e387 337 printUSBSpeed();
7838f4be 338 Dbprintf("Various");
f62b5e12 339 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
340 Dbprintf(" ToSendMax..........%d", ToSendMax);
341 Dbprintf(" ToSendBit..........%d", ToSendBit);
342 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
343
344 cmd_send(CMD_ACK,1,0,0,0,0);
7838f4be 345}
15c4dc5a 346
7838f4be 347#if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
15c4dc5a 348
7838f4be 349#define OPTS 2
7838f4be 350void StandAloneMode()
351{
352 DbpString("Stand-alone mode! No PC necessary.");
15c4dc5a 353 // Oooh pretty -- notify user we're in elite samy mode now
354 LED(LED_RED, 200);
355 LED(LED_ORANGE, 200);
356 LED(LED_GREEN, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_RED, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_GREEN, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_RED, 200);
7838f4be 363}
7838f4be 364#endif
365
7838f4be 366#ifdef WITH_ISO14443a_StandAlone
367void StandAloneMode14a()
368{
369 StandAloneMode();
370 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
371
372 int selected = 0;
0db6ed9a 373 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
7838f4be 374 int cardRead[OPTS] = {0};
375 uint8_t readUID[10] = {0};
376 uint32_t uid_1st[OPTS]={0};
377 uint32_t uid_2nd[OPTS]={0};
0db6ed9a 378 uint32_t uid_tmp1 = 0;
379 uint32_t uid_tmp2 = 0;
380 iso14a_card_select_t hi14a_card[OPTS];
7838f4be 381
c2731f37 382 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
383
7838f4be 384 LED(selected + 1, 0);
385
386 for (;;)
387 {
388 usb_poll();
389 WDT_HIT();
7838f4be 390 SpinDelay(300);
391
0db6ed9a 392 if (iGotoRecord == 1 || cardRead[selected] == 0)
7838f4be 393 {
0db6ed9a 394 iGotoRecord = 0;
7838f4be 395 LEDsoff();
396 LED(selected + 1, 0);
397 LED(LED_RED2, 0);
398
399 // record
400 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
7838f4be 401 /* need this delay to prevent catching some weird data */
402 SpinDelay(500);
403 /* Code for reading from 14a tag */
810f5379 404 uint8_t uid[10] = {0};
405 uint32_t cuid = 0;
7838f4be 406 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
407
408 for ( ; ; )
409 {
410 WDT_HIT();
0db6ed9a 411 if (BUTTON_PRESS()) {
412 if (cardRead[selected]) {
413 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
414 break;
415 }
416 else if (cardRead[(selected+1)%OPTS]) {
417 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
418 selected = (selected+1)%OPTS;
419 break; // playing = 1;
420 }
421 else {
422 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
423 SpinDelay(300);
424 }
425 }
c188b1b9 426 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
7838f4be 427 continue;
428 else
429 {
430 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
431 memcpy(readUID,uid,10*sizeof(uint8_t));
0db6ed9a 432 uint8_t *dst = (uint8_t *)&uid_tmp1;
7838f4be 433 // Set UID byte order
434 for (int i=0; i<4; i++)
435 dst[i] = uid[3-i];
0db6ed9a 436 dst = (uint8_t *)&uid_tmp2;
7838f4be 437 for (int i=0; i<4; i++)
438 dst[i] = uid[7-i];
0db6ed9a 439 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
440 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
441 }
442 else {
443 if (uid_tmp2) {
444 Dbprintf("Bank[%d] received a 7-byte UID",selected);
445 uid_1st[selected] = (uid_tmp1)>>8;
446 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
447 }
448 else {
449 Dbprintf("Bank[%d] received a 4-byte UID",selected);
450 uid_1st[selected] = uid_tmp1;
451 uid_2nd[selected] = uid_tmp2;
452 }
7838f4be 453 break;
454 }
455 }
0db6ed9a 456 }
457 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
458 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
7838f4be 459 LEDsoff();
460 LED(LED_GREEN, 200);
461 LED(LED_ORANGE, 200);
462 LED(LED_GREEN, 200);
463 LED(LED_ORANGE, 200);
464
465 LEDsoff();
466 LED(selected + 1, 0);
7838f4be 467
0db6ed9a 468 // Next state is replay:
469 playing = 1;
7838f4be 470
471 cardRead[selected] = 1;
7838f4be 472 }
0db6ed9a 473 /* MF Classic UID clone */
474 else if (iGotoClone==1)
7838f4be 475 {
0db6ed9a 476 iGotoClone=0;
c2731f37 477 LEDsoff();
478 LED(selected + 1, 0);
479 LED(LED_ORANGE, 250);
7838f4be 480
c2731f37 481 // record
482 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
7838f4be 483
c2731f37 484 // wait for button to be released
485 // Delay cloning until card is in place
486 while(BUTTON_PRESS())
487 WDT_HIT();
7838f4be 488
c2731f37 489 Dbprintf("Starting clone. [Bank: %u]", selected);
490 // need this delay to prevent catching some weird data
491 SpinDelay(500);
492 // Begin clone function here:
493 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
494 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
495 memcpy(c.d.asBytes, data, 16);
496 SendCommand(&c);
497
498 Block read is similar:
499 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
500 We need to imitate that call with blockNo 0 to set a uid.
501
502 The get and set commands are handled in this file:
503 // Work with "magic Chinese" card
504 case CMD_MIFARE_CSETBLOCK:
505 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
506 break;
507 case CMD_MIFARE_CGETBLOCK:
508 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
509 break;
510
511 mfCSetUID provides example logic for UID set workflow:
512 -Read block0 from card in field with MifareCGetBlock()
513 -Configure new values without replacing reserved bytes
514 memcpy(block0, uid, 4); // Copy UID bytes from byte array
515 // Mifare UID BCC
516 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
517 Bytes 5-7 are reserved SAK and ATQA for mifare classic
518 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
519 */
520 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
521 // arg0 = Flags, arg1=blockNo
522 MifareCGetBlock(params, 0, oldBlock0);
0db6ed9a 523 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
524 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
525 playing = 1;
526 }
527 else {
c2731f37 528 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
529 memcpy(newBlock0,oldBlock0,16);
530 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
531
532 newBlock0[0] = uid_1st[selected]>>24;
533 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
534 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
535 newBlock0[3] = 0xFF & (uid_1st[selected]);
536 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
537
538 // arg0 = workFlags, arg1 = blockNo, datain
539 MifareCSetBlock(params, 0, newBlock0);
540 MifareCGetBlock(params, 0, testBlock0);
541
542 if (memcmp(testBlock0, newBlock0, 16)==0) {
543 DbpString("Cloned successfull!");
544 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
7838f4be 545 playing = 0;
0db6ed9a 546 iGotoRecord = 1;
c2731f37 547 selected = (selected + 1) % OPTS;
548 } else {
0db6ed9a 549 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
550 playing = 1;
551 }
552 }
553 LEDsoff();
554 LED(selected + 1, 0);
7838f4be 555 }
556 // Change where to record (or begin playing)
0db6ed9a 557 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
7838f4be 558 {
7838f4be 559 LEDsoff();
560 LED(selected + 1, 0);
561
562 // Begin transmitting
563 if (playing)
564 {
565 LED(LED_GREEN, 0);
566 DbpString("Playing");
0db6ed9a 567 for ( ; ; ) {
568 WDT_HIT();
569 int button_action = BUTTON_HELD(1000);
570 if (button_action == 0) { // No button action, proceed with sim
571 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
572 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
573 num_to_bytes(uid_1st[selected], 3, data);
574 num_to_bytes(uid_2nd[selected], 4, data);
575
7838f4be 576 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
0db6ed9a 577 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
578 DbpString("Mifare Classic");
579 SimulateIso14443aTag(1, flags, data); // Mifare Classic
580 }
581 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
582 DbpString("Mifare Ultralight");
583 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
584 }
585 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
586 DbpString("Mifare DESFire");
587 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
588 }
589 else {
590 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
591 SimulateIso14443aTag(1, flags, data);
592 }
593 }
594 else if (button_action == BUTTON_SINGLE_CLICK) {
595 selected = (selected + 1) % OPTS;
596 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
597 iGotoRecord = 1;
598 break;
599 }
600 else if (button_action == BUTTON_HOLD) {
601 Dbprintf("Playtime over. Begin cloning...");
602 iGotoClone = 1;
603 break;
7838f4be 604 }
0db6ed9a 605 WDT_HIT();
606 }
7838f4be 607
608 /* We pressed a button so ignore it here with a delay */
609 SpinDelay(300);
7838f4be 610 LEDsoff();
611 LED(selected + 1, 0);
612 }
613 else
614 while(BUTTON_PRESS())
615 WDT_HIT();
616 }
617 }
618}
619#elif WITH_LF
620// samy's sniff and repeat routine
621void SamyRun()
622{
623 StandAloneMode();
624 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
625
626 int high[OPTS], low[OPTS];
15c4dc5a 627 int selected = 0;
628 int playing = 0;
72e930ef 629 int cardRead = 0;
15c4dc5a 630
631 // Turn on selected LED
632 LED(selected + 1, 0);
633
614da335 634 for (;;) {
6e82300d 635 usb_poll();
95e63594 636 WDT_HIT();
15c4dc5a 637
638 // Was our button held down or pressed?
639 int button_pressed = BUTTON_HELD(1000);
640 SpinDelay(300);
641
642 // Button was held for a second, begin recording
72e930ef 643 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 644 {
645 LEDsoff();
646 LED(selected + 1, 0);
647 LED(LED_RED2, 0);
648
649 // record
650 DbpString("Starting recording");
651
652 // wait for button to be released
653 while(BUTTON_PRESS())
654 WDT_HIT();
655
656 /* need this delay to prevent catching some weird data */
657 SpinDelay(500);
658
659 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
b7536e11 660 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
15c4dc5a 661
662 LEDsoff();
663 LED(selected + 1, 0);
664 // Finished recording
15c4dc5a 665 // If we were previously playing, set playing off
666 // so next button push begins playing what we recorded
614da335 667 playing = 0;
668 cardRead = 1;
72e930ef 669 }
614da335 670 else if (button_pressed > 0 && cardRead == 1) {
671 LEDsoff();
672 LED(selected + 1, 0);
673 LED(LED_ORANGE, 0);
72e930ef 674
614da335 675 // record
b7536e11 676 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
72e930ef 677
614da335 678 // wait for button to be released
679 while(BUTTON_PRESS())
680 WDT_HIT();
72e930ef 681
614da335 682 /* need this delay to prevent catching some weird data */
683 SpinDelay(500);
72e930ef 684
b7536e11 685 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
686 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
72e930ef 687
614da335 688 LEDsoff();
689 LED(selected + 1, 0);
690 // Finished recording
72e930ef 691
614da335 692 // If we were previously playing, set playing off
693 // so next button push begins playing what we recorded
694 playing = 0;
695 cardRead = 0;
15c4dc5a 696 }
697
698 // Change where to record (or begin playing)
614da335 699 else if (button_pressed) {
15c4dc5a 700 // Next option if we were previously playing
701 if (playing)
702 selected = (selected + 1) % OPTS;
703 playing = !playing;
704
705 LEDsoff();
706 LED(selected + 1, 0);
707
708 // Begin transmitting
709 if (playing)
710 {
711 LED(LED_GREEN, 0);
712 DbpString("Playing");
713 // wait for button to be released
714 while(BUTTON_PRESS())
715 WDT_HIT();
0d5ee8e2 716
b7536e11 717 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
0d5ee8e2 718 CmdHIDsimTAG(high[selected], low[selected], 0);
15c4dc5a 719 DbpString("Done playing");
0d5ee8e2 720
721 if (BUTTON_HELD(1000) > 0) {
15c4dc5a 722 DbpString("Exiting");
723 LEDsoff();
724 return;
0d5ee8e2 725 }
15c4dc5a 726
727 /* We pressed a button so ignore it here with a delay */
728 SpinDelay(300);
729
730 // when done, we're done playing, move to next option
731 selected = (selected + 1) % OPTS;
732 playing = !playing;
733 LEDsoff();
734 LED(selected + 1, 0);
735 }
736 else
737 while(BUTTON_PRESS())
738 WDT_HIT();
739 }
740 }
741}
15c4dc5a 742
7838f4be 743#endif
15c4dc5a 744/*
745OBJECTIVE
746Listen and detect an external reader. Determine the best location
747for the antenna.
748
749INSTRUCTIONS:
750Inside the ListenReaderField() function, there is two mode.
751By default, when you call the function, you will enter mode 1.
752If you press the PM3 button one time, you will enter mode 2.
753If you press the PM3 button a second time, you will exit the function.
754
755DESCRIPTION OF MODE 1:
756This mode just listens for an external reader field and lights up green
757for HF and/or red for LF. This is the original mode of the detectreader
758function.
759
760DESCRIPTION OF MODE 2:
761This mode will visually represent, using the LEDs, the actual strength of the
762current compared to the maximum current detected. Basically, once you know
763what kind of external reader is present, it will help you spot the best location to place
764your antenna. You will probably not get some good results if there is a LF and a HF reader
765at the same place! :-)
766
767LIGHT SCHEME USED:
768*/
769static const char LIGHT_SCHEME[] = {
770 0x0, /* ---- | No field detected */
771 0x1, /* X--- | 14% of maximum current detected */
772 0x2, /* -X-- | 29% of maximum current detected */
773 0x4, /* --X- | 43% of maximum current detected */
774 0x8, /* ---X | 57% of maximum current detected */
775 0xC, /* --XX | 71% of maximum current detected */
776 0xE, /* -XXX | 86% of maximum current detected */
777 0xF, /* XXXX | 100% of maximum current detected */
778};
779static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
780
da198be4 781void ListenReaderField(int limit) {
3b692427 782#define LF_ONLY 1
783#define HF_ONLY 2
784#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
785
da198be4 786 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
787 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
788 int mode=1, display_val, display_max, i;
3b692427 789
790 // switch off FPGA - we don't want to measure our own signal
791 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
792 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 793
794 LEDsoff();
795
3b692427 796 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 797
798 if(limit != HF_ONLY) {
3b692427 799 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 800 lf_baseline = lf_av;
801 }
802
3b692427 803 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 804
805 if (limit != LF_ONLY) {
3b692427 806 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 807 hf_baseline = hf_av;
808 }
809
810 for(;;) {
811 if (BUTTON_PRESS()) {
812 SpinDelay(500);
813 switch (mode) {
814 case 1:
815 mode=2;
816 DbpString("Signal Strength Mode");
817 break;
818 case 2:
819 default:
820 DbpString("Stopped");
821 LEDsoff();
822 return;
823 break;
824 }
825 }
826 WDT_HIT();
827
828 if (limit != HF_ONLY) {
3b692427 829 if(mode == 1) {
f2c2b174 830 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
3b692427 831 LED_D_ON();
832 else
833 LED_D_OFF();
15c4dc5a 834 }
e30c654b 835
3b692427 836 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 837 // see if there's a significant change
f2c2b174 838 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
3b692427 839 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 840 lf_av = lf_av_new;
841 if (lf_av > lf_max)
842 lf_max = lf_av;
15c4dc5a 843 }
844 }
845
846 if (limit != LF_ONLY) {
847 if (mode == 1){
f2c2b174 848 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
3b692427 849 LED_B_ON();
850 else
851 LED_B_OFF();
15c4dc5a 852 }
e30c654b 853
3b692427 854 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 855 // see if there's a significant change
f2c2b174 856 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
3b692427 857 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 858 hf_av = hf_av_new;
859 if (hf_av > hf_max)
860 hf_max = hf_av;
15c4dc5a 861 }
862 }
e30c654b 863
15c4dc5a 864 if(mode == 2) {
865 if (limit == LF_ONLY) {
866 display_val = lf_av;
867 display_max = lf_max;
868 } else if (limit == HF_ONLY) {
869 display_val = hf_av;
870 display_max = hf_max;
871 } else { /* Pick one at random */
872 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
873 display_val = hf_av;
874 display_max = hf_max;
875 } else {
876 display_val = lf_av;
877 display_max = lf_max;
878 }
879 }
880 for (i=0; i<LIGHT_LEN; i++) {
881 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
882 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
883 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
884 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
885 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
886 break;
887 }
888 }
889 }
890 }
891}
892
f7e3ed82 893void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 894{
895 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 896
313ee67e 897 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
902cb3c0 898
15c4dc5a 899 switch(c->cmd) {
900#ifdef WITH_LF
31abe49f
MHS
901 case CMD_SET_LF_SAMPLING_CONFIG:
902 setSamplingConfig((sample_config *) c->d.asBytes);
903 break;
15c4dc5a 904 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1c8fbeb9 905 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
15c4dc5a 906 break;
15c4dc5a 907 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
908 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
909 break;
b014c96d 910 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 911 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 912 break;
7e67e42f 913 case CMD_HID_DEMOD_FSK:
a501c82b 914 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 915 break;
916 case CMD_HID_SIM_TAG:
a501c82b 917 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 918 break;
abd6112f 919 case CMD_FSK_SIM_TAG:
920 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
921 break;
922 case CMD_ASK_SIM_TAG:
923 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
924 break;
872e3d4d 925 case CMD_PSK_SIM_TAG:
926 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
927 break;
a501c82b 928 case CMD_HID_CLONE_TAG:
1c611bbd 929 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 930 break;
a1f3bb12 931 case CMD_IO_DEMOD_FSK:
a501c82b 932 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 933 break;
a501c82b 934 case CMD_IO_CLONE_TAG:
94422fa2 935 CopyIOtoT55x7(c->arg[0], c->arg[1]);
a1f3bb12 936 break;
6ff6ade2 937 case CMD_EM410X_DEMOD:
938 CmdEM410xdemod(c->arg[0], 0, 0, 1);
939 break;
2d4eae76 940 case CMD_EM410X_WRITE_TAG:
941 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
942 break;
7e67e42f 943 case CMD_READ_TI_TYPE:
944 ReadTItag();
945 break;
946 case CMD_WRITE_TI_TYPE:
947 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
948 break;
949 case CMD_SIMULATE_TAG_125K:
74daee24 950 LED_A_ON();
951 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
952 LED_A_OFF();
7e67e42f 953 break;
954 case CMD_LF_SIMULATE_BIDIR:
955 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
956 break;
a501c82b 957 case CMD_INDALA_CLONE_TAG:
2414f978 958 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
959 break;
a501c82b 960 case CMD_INDALA_CLONE_TAG_L:
2414f978 961 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
962 break;
1c611bbd 963 case CMD_T55XX_READ_BLOCK:
9276e859 964 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 965 break;
966 case CMD_T55XX_WRITE_BLOCK:
967 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
968 break;
9276e859 969 case CMD_T55XX_WAKEUP:
970 T55xxWakeUp(c->arg[0]);
971 break;
94422fa2 972 case CMD_T55XX_RESET_READ:
973 T55xxResetRead();
974 break;
a501c82b 975 case CMD_PCF7931_READ:
1c611bbd 976 ReadPCF7931();
1c611bbd 977 break;
e98572a1 978 case CMD_PCF7931_WRITE:
ac2df346 979 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
e98572a1 980 break;
1c611bbd 981 case CMD_EM4X_READ_WORD:
982 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
983 break;
984 case CMD_EM4X_WRITE_WORD:
985 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
986 break;
db25599d 987 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
988 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
70459879 989 break;
0de8e387 990 case CMD_VIKING_CLONE_TAG:
a126332a 991 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
0de8e387 992 break;
15c4dc5a 993#endif
994
d19929cb 995#ifdef WITH_HITAG
996 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
997 SnoopHitag(c->arg[0]);
998 break;
999 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1000 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1001 break;
1002 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1003 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1004 break;
0db11b71 1005 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1006 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1007 break;
1008 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1009 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1010 break;
6fc68747 1011 case CMD_READ_HITAG_S: //Reader for only Hitag S tags, args = key or challenge
0db11b71 1012 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1013 break;
6fc68747 1014 case CMD_WR_HITAG_S: //writer for Hitag tags args=data to write,page and key or challenge
0db11b71 1015 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1016 break;
d19929cb 1017#endif
f168b263 1018
15c4dc5a 1019#ifdef WITH_ISO15693
1020 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1021 AcquireRawAdcSamplesIso15693();
1022 break;
9455b51c 1023 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1024 RecordRawAdcSamplesIso15693();
1025 break;
1026
1027 case CMD_ISO_15693_COMMAND:
1028 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1029 break;
1030
1031 case CMD_ISO_15693_FIND_AFI:
1032 BruteforceIso15693Afi(c->arg[0]);
1033 break;
1034
1035 case CMD_ISO_15693_DEBUG:
1036 SetDebugIso15693(c->arg[0]);
1037 break;
15c4dc5a 1038
15c4dc5a 1039 case CMD_READER_ISO_15693:
1040 ReaderIso15693(c->arg[0]);
1041 break;
7e67e42f 1042 case CMD_SIMTAG_ISO_15693:
3649b640 1043 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 1044 break;
15c4dc5a 1045#endif
1046
7e67e42f 1047#ifdef WITH_LEGICRF
1048 case CMD_SIMULATE_TAG_LEGIC_RF:
1049 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1050 break;
3612a8a8 1051
7e67e42f 1052 case CMD_WRITER_LEGIC_RF:
1053 LegicRfWriter(c->arg[1], c->arg[0]);
1054 break;
3612a8a8 1055
15c4dc5a 1056 case CMD_READER_LEGIC_RF:
1057 LegicRfReader(c->arg[0], c->arg[1]);
1058 break;
15c4dc5a 1059#endif
1060
1061#ifdef WITH_ISO14443b
6fc68747 1062 case CMD_READ_SRI_TAG:
1063 ReadSTMemoryIso14443b(c->arg[0]);
7e67e42f 1064 break;
22e24700 1065 case CMD_SNOOP_ISO_14443B:
abb21530 1066 SnoopIso14443b();
7e67e42f 1067 break;
22e24700 1068 case CMD_SIMULATE_TAG_ISO_14443B:
abb21530 1069 SimulateIso14443bTag();
7e67e42f 1070 break;
7cf3ef20 1071 case CMD_ISO_14443B_COMMAND:
6fc68747 1072 //SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1073 SendRawCommand14443B_Ex(c);
7cf3ef20 1074 break;
15c4dc5a 1075#endif
1076
1077#ifdef WITH_ISO14443a
7e67e42f 1078 case CMD_SNOOP_ISO_14443a:
4d2e4eea 1079 SniffIso14443a(c->arg[0]);
7e67e42f 1080 break;
15c4dc5a 1081 case CMD_READER_ISO_14443a:
902cb3c0 1082 ReaderIso14443a(c);
15c4dc5a 1083 break;
7e67e42f 1084 case CMD_SIMULATE_TAG_ISO_14443a:
0db6ed9a 1085 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 1086 break;
5acd09bd 1087 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 1088 EPA_PACE_Collect_Nonce(c);
5acd09bd 1089 break;
d0f3338e 1090 case CMD_EPA_PACE_REPLAY:
1091 EPA_PACE_Replay(c);
1092 break;
15c4dc5a 1093 case CMD_READER_MIFARE:
810f5379 1094 ReaderMifare(c->arg[0], c->arg[1]);
15c4dc5a 1095 break;
20f9a2a1
M
1096 case CMD_MIFARE_READBL:
1097 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1098 break;
981bd429 1099 case CMD_MIFAREU_READBL:
aa60d156 1100 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 1101 break;
4d2e4eea 1102 case CMD_MIFAREUC_AUTH:
1103 MifareUC_Auth(c->arg[0],c->d.asBytes);
f38a1528 1104 break;
981bd429 1105 case CMD_MIFAREU_READCARD:
74daee24 1106 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 1107 break;
aa60d156 1108 case CMD_MIFAREUC_SETPWD:
1109 MifareUSetPwd(c->arg[0], c->d.asBytes);
117d9ec2 1110 break;
20f9a2a1
M
1111 case CMD_MIFARE_READSC:
1112 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1113 break;
1114 case CMD_MIFARE_WRITEBL:
1115 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1116 break;
95aeb706 1117 //case CMD_MIFAREU_WRITEBL_COMPAT:
1118 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1119 //break;
981bd429 1120 case CMD_MIFAREU_WRITEBL:
95aeb706 1121 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
aa60d156 1122 break;
c188b1b9 1123 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1124 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1125 break;
20f9a2a1
M
1126 case CMD_MIFARE_NESTED:
1127 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
1128 break;
1129 case CMD_MIFARE_CHKKEYS:
1130 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
1131 break;
1132 case CMD_SIMULATE_MIFARE_CARD:
1133 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1134 break;
8556b852
M
1135
1136 // emulator
1137 case CMD_MIFARE_SET_DBGMODE:
1138 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1139 break;
1140 case CMD_MIFARE_EML_MEMCLR:
1141 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1142 break;
1143 case CMD_MIFARE_EML_MEMSET:
1144 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1145 break;
1146 case CMD_MIFARE_EML_MEMGET:
1147 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1148 break;
1149 case CMD_MIFARE_EML_CARDLOAD:
1150 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
1151 break;
1152
1153 // Work with "magic Chinese" card
d52e4e88 1154 case CMD_MIFARE_CSETBLOCK:
c2731f37 1155 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
545a1f38 1156 break;
d52e4e88 1157 case CMD_MIFARE_CGETBLOCK:
c2731f37 1158 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
8556b852 1159 break;
d52e4e88 1160 case CMD_MIFARE_CIDENT:
1161 MifareCIdent();
1162 break;
b62a5a84
M
1163
1164 // mifare sniffer
1165 case CMD_MIFARE_SNIFFER:
5cd9ec01 1166 SniffMifare(c->arg[0]);
b62a5a84 1167 break;
313ee67e 1168
aa60d156 1169 //mifare desfire
1170 case CMD_MIFARE_DESFIRE_READBL: break;
1171 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1172 case CMD_MIFARE_DESFIRE_AUTH1:
1173 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1174 break;
1175 case CMD_MIFARE_DESFIRE_AUTH2:
1176 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1177 break;
1178 case CMD_MIFARE_DES_READER:
1179 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1180 break;
1181 case CMD_MIFARE_DESFIRE_INFO:
1182 MifareDesfireGetInformation();
1183 break;
1184 case CMD_MIFARE_DESFIRE:
1185 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1186 break;
1187
add0504d 1188 case CMD_MIFARE_COLLECT_NONCES:
add0504d 1189 break;
20f9a2a1 1190#endif
810f5379 1191#ifdef WITH_EMV
1192 case CMD_EMV_TRANSACTION:
1193 EMVTransaction();
1194 break;
1195 case CMD_EMV_GET_RANDOM_NUM:
1196 //EMVgetUDOL();
1197 break;
1198 case CMD_EMV_LOAD_VALUE:
1199 EMVloadvalue(c->arg[0], c->d.asBytes);
1200 break;
1201 case CMD_EMV_DUMP_CARD:
1202 EMVdumpcard();
1203#endif
7e67e42f 1204#ifdef WITH_ICLASS
cee5a30d 1205 // Makes use of ISO14443a FPGA Firmware
1206 case CMD_SNOOP_ICLASS:
1207 SnoopIClass();
1208 break;
1e262141 1209 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 1210 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 1211 break;
1212 case CMD_READER_ICLASS:
1213 ReaderIClass(c->arg[0]);
1214 break;
f38a1528 1215 case CMD_READER_ICLASS_REPLAY:
f62b5e12 1216 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
f38a1528 1217 break;
e80aeb96
MHS
1218 case CMD_ICLASS_EML_MEMSET:
1219 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1220 break;
e98572a1 1221 case CMD_ICLASS_WRITEBLOCK:
1222 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1223 break;
1224 case CMD_ICLASS_READCHECK: // auth step 1
1225 iClass_ReadCheck(c->arg[0], c->arg[1]);
1226 break;
1227 case CMD_ICLASS_READBLOCK:
1228 iClass_ReadBlk(c->arg[0]);
1229 break;
1230 case CMD_ICLASS_AUTHENTICATION: //check
1231 iClass_Authentication(c->d.asBytes);
1232 break;
1233 case CMD_ICLASS_DUMP:
1234 iClass_Dump(c->arg[0], c->arg[1]);
1235 break;
1236 case CMD_ICLASS_CLONE:
1237 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1238 break;
cee5a30d 1239#endif
1d0ccbe0 1240#ifdef WITH_HFSNOOP
1241 case CMD_HF_SNIFFER:
1242 HfSnoop(c->arg[0], c->arg[1]);
1243 break;
1244#endif
cee5a30d 1245
7e67e42f 1246 case CMD_BUFF_CLEAR:
117d9ec2 1247 BigBuf_Clear();
15c4dc5a 1248 break;
15c4dc5a 1249
1250 case CMD_MEASURE_ANTENNA_TUNING:
1251 MeasureAntennaTuning();
1252 break;
1253
1254 case CMD_MEASURE_ANTENNA_TUNING_HF:
1255 MeasureAntennaTuningHf();
1256 break;
1257
1258 case CMD_LISTEN_READER_FIELD:
1259 ListenReaderField(c->arg[0]);
1260 break;
1261
15c4dc5a 1262 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1263 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1264 SpinDelay(200);
1265 LED_D_OFF(); // LED D indicates field ON or OFF
1266 break;
1267
aaa1a9a2 1268 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1c611bbd 1269 LED_B_ON();
117d9ec2 1270 uint8_t *BigBuf = BigBuf_get_addr();
0de8e387 1271 size_t len = 0;
1c611bbd 1272 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
0de8e387 1273 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 1274 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 1275 }
1276 // Trigger a finish downloading signal with an ACK frame
3000dc4e 1277 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 1278 LED_B_OFF();
1c611bbd 1279 break;
aaa1a9a2 1280 }
15c4dc5a 1281 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
117d9ec2 1282 uint8_t *b = BigBuf_get_addr();
aaa1a9a2 1283 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 1284 cmd_send(CMD_ACK,0,0,0,0,0);
1285 break;
aaa1a9a2 1286 }
1287 case CMD_DOWNLOAD_EML_BIGBUF: {
1288 LED_B_ON();
1289 uint8_t *cardmem = BigBuf_get_EM_addr();
1290 size_t len = 0;
1291 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1292 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1293 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1294 }
1295 // Trigger a finish downloading signal with an ACK frame
1296 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1297 LED_B_OFF();
1298 break;
1299 }
15c4dc5a 1300 case CMD_READ_MEM:
1301 ReadMem(c->arg[0]);
1302 break;
1303
1304 case CMD_SET_LF_DIVISOR:
7cc204bf 1305 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 1306 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1307 break;
1308
1309 case CMD_SET_ADC_MUX:
1310 switch(c->arg[0]) {
1311 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1312 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1313 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1314 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1315 }
1316 break;
1317
1318 case CMD_VERSION:
1319 SendVersion();
1320 break;
7838f4be 1321 case CMD_STATUS:
0de8e387 1322 SendStatus();
7838f4be 1323 break;
1324 case CMD_PING:
1325 cmd_send(CMD_ACK,0,0,0,0,0);
1326 break;
15c4dc5a 1327#ifdef WITH_LCD
1328 case CMD_LCD_RESET:
1329 LCDReset();
1330 break;
1331 case CMD_LCD:
1332 LCDSend(c->arg[0]);
1333 break;
1334#endif
1335 case CMD_SETUP_WRITE:
1336 case CMD_FINISH_WRITE:
1c611bbd 1337 case CMD_HARDWARE_RESET:
1338 usb_disable();
f62b5e12 1339 SpinDelay(2000);
15c4dc5a 1340 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1341 for(;;) {
1342 // We're going to reset, and the bootrom will take control.
1343 }
1c611bbd 1344 break;
15c4dc5a 1345
1c611bbd 1346 case CMD_START_FLASH:
15c4dc5a 1347 if(common_area.flags.bootrom_present) {
1348 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1349 }
1c611bbd 1350 usb_disable();
15c4dc5a 1351 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1352 for(;;);
1c611bbd 1353 break;
e30c654b 1354
15c4dc5a 1355 case CMD_DEVICE_INFO: {
902cb3c0 1356 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1357 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1358 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1359 break;
1360 }
1361 default:
15c4dc5a 1362 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1363 break;
15c4dc5a 1364 }
1365}
1366
1367void __attribute__((noreturn)) AppMain(void)
1368{
1369 SpinDelay(100);
9e8255d4 1370 clear_trace();
15c4dc5a 1371 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1372 /* Initialize common area */
1373 memset(&common_area, 0, sizeof(common_area));
1374 common_area.magic = COMMON_AREA_MAGIC;
1375 common_area.version = 1;
1376 }
1377 common_area.flags.osimage_present = 1;
1378
1379 LED_D_OFF();
1380 LED_C_OFF();
1381 LED_B_OFF();
1382 LED_A_OFF();
1383
b44e5233 1384 // Init USB device
313ee67e 1385 usb_enable();
15c4dc5a 1386
1387 // The FPGA gets its clock from us from PCK0 output, so set that up.
1388 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1389 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1390 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1391 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1392 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1d0ccbe0 1393 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
15c4dc5a 1394 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1395
1396 // Reset SPI
1397 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1398 // Reset SSC
1399 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1400
1401 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1402 // (the HF version by default)
1403 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1404
9ca155ba 1405 StartTickCount();
902cb3c0 1406
15c4dc5a 1407#ifdef WITH_LCD
15c4dc5a 1408 LCDInit();
15c4dc5a 1409#endif
1410
f62b5e12 1411 byte_t rx[sizeof(UsbCommand)];
902cb3c0 1412 size_t rx_len;
1413
15c4dc5a 1414 for(;;) {
313ee67e 1415 if (usb_poll()) {
1416 rx_len = usb_read(rx,sizeof(UsbCommand));
da198be4 1417 if (rx_len)
313ee67e 1418 UsbPacketReceived(rx,rx_len);
313ee67e 1419 }
15c4dc5a 1420 WDT_HIT();
1421
1422#ifdef WITH_LF
7838f4be 1423#ifndef WITH_ISO14443a_StandAlone
15c4dc5a 1424 if (BUTTON_HELD(1000) > 0)
1425 SamyRun();
7838f4be 1426#endif
1427#endif
1428#ifdef WITH_ISO14443a
1429#ifdef WITH_ISO14443a_StandAlone
1430 if (BUTTON_HELD(1000) > 0)
1431 StandAloneMode14a();
1432#endif
15c4dc5a 1433#endif
1434 }
1435}
Impressum, Datenschutz