]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
CHG: syntax suger
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
c3c241f3 13#include "usb_cdc.h"
14#include "cmd.h"
15
16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
22e24700 21
9ab7a6c7 22#include <stdarg.h>
22e24700 23
15c4dc5a 24#include "legicrf.h"
c3c241f3 25#include <hitag2.h>
31abe49f 26#include "lfsampling.h"
3000dc4e 27#include "BigBuf.h"
7838f4be 28#include "mifareutil.h"
36804420 29#include "pcf7931.h"
15c4dc5a 30#ifdef WITH_LCD
902cb3c0 31 #include "LCD.h"
15c4dc5a 32#endif
33
7838f4be 34// Craig Young - 14a stand-alone code
35#ifdef WITH_ISO14443a_StandAlone
36 #include "iso14443a.h"
c2731f37 37 #include "protocols.h"
7838f4be 38#endif
39
15c4dc5a 40#define abs(x) ( ((x)<0) ? -(x) : (x) )
41
42//=============================================================================
43// A buffer where we can queue things up to be sent through the FPGA, for
44// any purpose (fake tag, as reader, whatever). We go MSB first, since that
45// is the order in which they go out on the wire.
46//=============================================================================
47
6a1f2d82 48#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
a501c82b 49uint8_t ToSend[TOSEND_BUFFER_SIZE];
7838f4be 50int ToSendMax = 0;
15c4dc5a 51static int ToSendBit;
52struct common_area common_area __attribute__((section(".commonarea")));
53
15c4dc5a 54void ToSendReset(void)
55{
56 ToSendMax = -1;
57 ToSendBit = 8;
58}
59
da198be4 60void ToSendStuffBit(int b) {
15c4dc5a 61 if(ToSendBit >= 8) {
da198be4 62 ++ToSendMax;
15c4dc5a 63 ToSend[ToSendMax] = 0;
64 ToSendBit = 0;
65 }
66
da198be4 67 if(b)
15c4dc5a 68 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
15c4dc5a 69
da198be4 70 ++ToSendBit;
15c4dc5a 71
6a1f2d82 72 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76}
77
78//=============================================================================
79// Debug print functions, to go out over USB, to the usual PC-side client.
80//=============================================================================
81
da198be4 82void DbpString(char *str) {
9440213d 83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 85}
86
87#if 0
da198be4 88void DbpIntegers(int x1, int x2, int x3) {
902cb3c0 89 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 90}
91#endif
92
93void Dbprintf(const char *fmt, ...) {
da198be4 94 // should probably limit size here; oh well, let's just use a big buffer
95 char output_string[128] = {0x00};
15c4dc5a 96 va_list ap;
97
98 va_start(ap, fmt);
99 kvsprintf(fmt, output_string, 10, ap);
100 va_end(ap);
e30c654b 101
15c4dc5a 102 DbpString(output_string);
103}
104
9455b51c 105// prints HEX & ASCII
d19929cb 106void Dbhexdump(int len, uint8_t *d, bool bAsci) {
da198be4 107 int l=0, i;
9455b51c 108 char ascii[9];
d19929cb 109
9455b51c 110 while (len>0) {
da198be4 111
112 l = (len>8) ? 8 : len;
9455b51c 113
114 memcpy(ascii,d,l);
d19929cb 115 ascii[l]=0;
9455b51c 116
117 // filter safe ascii
da198be4 118 for (i=0; i<l; ++i)
9455b51c 119 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 120
da198be4 121 if (bAsci)
d19929cb 122 Dbprintf("%-8s %*D",ascii,l,d," ");
da198be4 123 else
d19929cb 124 Dbprintf("%*D",l,d," ");
d19929cb 125
da198be4 126 len -= 8;
127 d += 8;
9455b51c 128 }
129}
130
15c4dc5a 131//-----------------------------------------------------------------------------
132// Read an ADC channel and block till it completes, then return the result
133// in ADC units (0 to 1023). Also a routine to average 32 samples and
134// return that.
135//-----------------------------------------------------------------------------
136static int ReadAdc(int ch)
137{
f7e3ed82 138 uint32_t d;
15c4dc5a 139
140 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
141 AT91C_BASE_ADC->ADC_MR =
3b692427 142 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
143 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
144 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
145
146 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
147 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
148 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
149 //
150 // The maths are:
151 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
152 //
153 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
154 //
155 // Note: with the "historic" values in the comments above, the error was 34% !!!
156
15c4dc5a 157 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
158
159 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
3b692427 160
da198be4 161 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
162
15c4dc5a 163 d = AT91C_BASE_ADC->ADC_CDR[ch];
15c4dc5a 164 return d;
165}
166
9ca155ba 167int AvgAdc(int ch) // was static - merlok
15c4dc5a 168{
169 int i;
170 int a = 0;
171
da198be4 172 for(i = 0; i < 32; ++i)
15c4dc5a 173 a += ReadAdc(ch);
15c4dc5a 174
175 return (a + 15) >> 5;
176}
177
da198be4 178void MeasureAntennaTuning(void) {
d3499d36 179 uint8_t LF_Results[256];
9f693930 180 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 181 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
182
7838f4be 183 LED_B_ON();
15c4dc5a 184
185/*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
d19929cb 193
7cc204bf 194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
da198be4 196
d3499d36 197 for (i=255; i>=19; i--) {
da198be4 198 WDT_HIT();
15c4dc5a 199 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
200 SpinDelay(20);
3b692427 201 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
15c4dc5a 202 if (i==95) vLf125 = adcval; // voltage at 125Khz
203 if (i==89) vLf134 = adcval; // voltage at 134Khz
204
d3499d36 205 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
206 if(LF_Results[i] > peak) {
15c4dc5a 207 peakv = adcval;
d3499d36 208 peak = LF_Results[i];
15c4dc5a 209 peakf = i;
9f693930 210 //ptr = i;
15c4dc5a 211 }
212 }
213
d3499d36 214 for (i=18; i >= 0; i--) LF_Results[i] = 0;
215
7838f4be 216 LED_A_ON();
15c4dc5a 217 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7838f4be 218 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 219 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
220 SpinDelay(20);
3b692427 221 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
15c4dc5a 222
3b692427 223 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
d19929cb 224 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
da198be4 225
226 LEDsoff();
15c4dc5a 227}
228
da198be4 229void MeasureAntennaTuningHf(void) {
15c4dc5a 230 int vHf = 0; // in mV
231
232 DbpString("Measuring HF antenna, press button to exit");
233
3b692427 234 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
235 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
236 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
237
15c4dc5a 238 for (;;) {
15c4dc5a 239 SpinDelay(20);
3b692427 240 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 241
15c4dc5a 242 Dbprintf("%d mV",vHf);
243 if (BUTTON_PRESS()) break;
244 }
da198be4 245
15c4dc5a 246 DbpString("cancelled");
3b692427 247 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 248}
249
250
da198be4 251void ReadMem(int addr) {
f7e3ed82 252 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 253
254 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
255 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
256}
257
258/* osimage version information is linked in */
259extern struct version_information version_information;
260/* bootrom version information is pointed to from _bootphase1_version_pointer */
9783989b 261extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
15c4dc5a 262void SendVersion(void)
263{
9783989b 264 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
265 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 266
267 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 268 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
269 * pointer, then use it.
270 */
271 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
da198be4 272
15c4dc5a 273 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
9783989b 274 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 275 } else {
276 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
9783989b 277 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 278 }
e30c654b 279
15c4dc5a 280 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
9783989b 281 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 282
9783989b 283 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
284 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
da198be4 285
9783989b 286 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
287 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
288
289 // Send Chip ID and used flash memory
290 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
291 uint32_t compressed_data_section_size = common_area.arg1;
292 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 293}
f62b5e12 294
295// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
296// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
0de8e387 297void printUSBSpeed(void)
f62b5e12 298{
299 Dbprintf("USB Speed:");
0de8e387 300 Dbprintf(" Sending USB packets to client...");
f62b5e12 301
0de8e387 302 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
f62b5e12 303 uint8_t *test_data = BigBuf_get_addr();
0de8e387 304 uint32_t end_time;
f62b5e12 305
0de8e387 306 uint32_t start_time = end_time = GetTickCount();
307 uint32_t bytes_transferred = 0;
f62b5e12 308
309 LED_B_ON();
0de8e387 310 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
311 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
312 end_time = GetTickCount();
313 bytes_transferred += USB_CMD_DATA_SIZE;
f62b5e12 314 }
315 LED_B_OFF();
316
0de8e387 317 Dbprintf(" Time elapsed: %dms", end_time - start_time);
318 Dbprintf(" Bytes transferred: %d", bytes_transferred);
319 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
320 1000 * bytes_transferred / (end_time - start_time));
f62b5e12 321
322}
323
7838f4be 324/**
325 * Prints runtime information about the PM3.
326**/
da198be4 327void SendStatus(void) {
7838f4be 328 BigBuf_print_status();
329 Fpga_print_status();
330 printConfig(); //LF Sampling config
0de8e387 331 printUSBSpeed();
7838f4be 332 Dbprintf("Various");
f62b5e12 333 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
334 Dbprintf(" ToSendMax..........%d", ToSendMax);
335 Dbprintf(" ToSendBit..........%d", ToSendBit);
336 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
337
338 cmd_send(CMD_ACK,1,0,0,0,0);
7838f4be 339}
15c4dc5a 340
7838f4be 341#if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
15c4dc5a 342
7838f4be 343#define OPTS 2
7838f4be 344void StandAloneMode()
345{
346 DbpString("Stand-alone mode! No PC necessary.");
15c4dc5a 347 // Oooh pretty -- notify user we're in elite samy mode now
348 LED(LED_RED, 200);
349 LED(LED_ORANGE, 200);
350 LED(LED_GREEN, 200);
351 LED(LED_ORANGE, 200);
352 LED(LED_RED, 200);
353 LED(LED_ORANGE, 200);
354 LED(LED_GREEN, 200);
355 LED(LED_ORANGE, 200);
356 LED(LED_RED, 200);
7838f4be 357}
7838f4be 358#endif
359
7838f4be 360#ifdef WITH_ISO14443a_StandAlone
361void StandAloneMode14a()
362{
363 StandAloneMode();
364 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
365
366 int selected = 0;
0db6ed9a 367 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
7838f4be 368 int cardRead[OPTS] = {0};
369 uint8_t readUID[10] = {0};
370 uint32_t uid_1st[OPTS]={0};
371 uint32_t uid_2nd[OPTS]={0};
0db6ed9a 372 uint32_t uid_tmp1 = 0;
373 uint32_t uid_tmp2 = 0;
374 iso14a_card_select_t hi14a_card[OPTS];
7838f4be 375
c2731f37 376 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
377
7838f4be 378 LED(selected + 1, 0);
379
380 for (;;)
381 {
382 usb_poll();
383 WDT_HIT();
7838f4be 384 SpinDelay(300);
385
0db6ed9a 386 if (iGotoRecord == 1 || cardRead[selected] == 0)
7838f4be 387 {
0db6ed9a 388 iGotoRecord = 0;
7838f4be 389 LEDsoff();
390 LED(selected + 1, 0);
391 LED(LED_RED2, 0);
392
393 // record
394 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
7838f4be 395 /* need this delay to prevent catching some weird data */
396 SpinDelay(500);
397 /* Code for reading from 14a tag */
810f5379 398 uint8_t uid[10] = {0};
399 uint32_t cuid = 0;
7838f4be 400 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
401
402 for ( ; ; )
403 {
404 WDT_HIT();
0db6ed9a 405 if (BUTTON_PRESS()) {
406 if (cardRead[selected]) {
407 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
408 break;
409 }
410 else if (cardRead[(selected+1)%OPTS]) {
411 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
412 selected = (selected+1)%OPTS;
413 break; // playing = 1;
414 }
415 else {
416 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
417 SpinDelay(300);
418 }
419 }
c188b1b9 420 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
7838f4be 421 continue;
422 else
423 {
424 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
425 memcpy(readUID,uid,10*sizeof(uint8_t));
0db6ed9a 426 uint8_t *dst = (uint8_t *)&uid_tmp1;
7838f4be 427 // Set UID byte order
428 for (int i=0; i<4; i++)
429 dst[i] = uid[3-i];
0db6ed9a 430 dst = (uint8_t *)&uid_tmp2;
7838f4be 431 for (int i=0; i<4; i++)
432 dst[i] = uid[7-i];
0db6ed9a 433 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
434 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
435 }
436 else {
437 if (uid_tmp2) {
438 Dbprintf("Bank[%d] received a 7-byte UID",selected);
439 uid_1st[selected] = (uid_tmp1)>>8;
440 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
441 }
442 else {
443 Dbprintf("Bank[%d] received a 4-byte UID",selected);
444 uid_1st[selected] = uid_tmp1;
445 uid_2nd[selected] = uid_tmp2;
446 }
7838f4be 447 break;
448 }
449 }
0db6ed9a 450 }
451 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
452 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
7838f4be 453 LEDsoff();
454 LED(LED_GREEN, 200);
455 LED(LED_ORANGE, 200);
456 LED(LED_GREEN, 200);
457 LED(LED_ORANGE, 200);
458
459 LEDsoff();
460 LED(selected + 1, 0);
7838f4be 461
0db6ed9a 462 // Next state is replay:
463 playing = 1;
7838f4be 464
465 cardRead[selected] = 1;
7838f4be 466 }
0db6ed9a 467 /* MF Classic UID clone */
468 else if (iGotoClone==1)
7838f4be 469 {
0db6ed9a 470 iGotoClone=0;
c2731f37 471 LEDsoff();
472 LED(selected + 1, 0);
473 LED(LED_ORANGE, 250);
7838f4be 474
c2731f37 475 // record
476 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
7838f4be 477
c2731f37 478 // wait for button to be released
479 // Delay cloning until card is in place
480 while(BUTTON_PRESS())
481 WDT_HIT();
7838f4be 482
c2731f37 483 Dbprintf("Starting clone. [Bank: %u]", selected);
484 // need this delay to prevent catching some weird data
485 SpinDelay(500);
486 // Begin clone function here:
487 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
488 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
489 memcpy(c.d.asBytes, data, 16);
490 SendCommand(&c);
491
492 Block read is similar:
493 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
494 We need to imitate that call with blockNo 0 to set a uid.
495
496 The get and set commands are handled in this file:
497 // Work with "magic Chinese" card
498 case CMD_MIFARE_CSETBLOCK:
499 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
500 break;
501 case CMD_MIFARE_CGETBLOCK:
502 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
503 break;
504
505 mfCSetUID provides example logic for UID set workflow:
506 -Read block0 from card in field with MifareCGetBlock()
507 -Configure new values without replacing reserved bytes
508 memcpy(block0, uid, 4); // Copy UID bytes from byte array
509 // Mifare UID BCC
510 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
511 Bytes 5-7 are reserved SAK and ATQA for mifare classic
512 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
513 */
514 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
515 // arg0 = Flags, arg1=blockNo
516 MifareCGetBlock(params, 0, oldBlock0);
0db6ed9a 517 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
518 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
519 playing = 1;
520 }
521 else {
c2731f37 522 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
523 memcpy(newBlock0,oldBlock0,16);
524 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
525
526 newBlock0[0] = uid_1st[selected]>>24;
527 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
528 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
529 newBlock0[3] = 0xFF & (uid_1st[selected]);
530 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
531
532 // arg0 = workFlags, arg1 = blockNo, datain
533 MifareCSetBlock(params, 0, newBlock0);
534 MifareCGetBlock(params, 0, testBlock0);
535
536 if (memcmp(testBlock0, newBlock0, 16)==0) {
537 DbpString("Cloned successfull!");
538 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
7838f4be 539 playing = 0;
0db6ed9a 540 iGotoRecord = 1;
c2731f37 541 selected = (selected + 1) % OPTS;
542 } else {
0db6ed9a 543 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
544 playing = 1;
545 }
546 }
547 LEDsoff();
548 LED(selected + 1, 0);
7838f4be 549 }
550 // Change where to record (or begin playing)
0db6ed9a 551 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
7838f4be 552 {
7838f4be 553 LEDsoff();
554 LED(selected + 1, 0);
555
556 // Begin transmitting
557 if (playing)
558 {
559 LED(LED_GREEN, 0);
560 DbpString("Playing");
0db6ed9a 561 for ( ; ; ) {
562 WDT_HIT();
563 int button_action = BUTTON_HELD(1000);
564 if (button_action == 0) { // No button action, proceed with sim
565 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
566 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
567 num_to_bytes(uid_1st[selected], 3, data);
568 num_to_bytes(uid_2nd[selected], 4, data);
569
7838f4be 570 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
0db6ed9a 571 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
572 DbpString("Mifare Classic");
573 SimulateIso14443aTag(1, flags, data); // Mifare Classic
574 }
575 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
576 DbpString("Mifare Ultralight");
577 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
578 }
579 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
580 DbpString("Mifare DESFire");
581 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
582 }
583 else {
584 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
585 SimulateIso14443aTag(1, flags, data);
586 }
587 }
588 else if (button_action == BUTTON_SINGLE_CLICK) {
589 selected = (selected + 1) % OPTS;
590 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
591 iGotoRecord = 1;
592 break;
593 }
594 else if (button_action == BUTTON_HOLD) {
595 Dbprintf("Playtime over. Begin cloning...");
596 iGotoClone = 1;
597 break;
7838f4be 598 }
0db6ed9a 599 WDT_HIT();
600 }
7838f4be 601
602 /* We pressed a button so ignore it here with a delay */
603 SpinDelay(300);
7838f4be 604 LEDsoff();
605 LED(selected + 1, 0);
606 }
607 else
608 while(BUTTON_PRESS())
609 WDT_HIT();
610 }
611 }
612}
613#elif WITH_LF
614// samy's sniff and repeat routine
615void SamyRun()
616{
617 StandAloneMode();
618 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
619
620 int high[OPTS], low[OPTS];
15c4dc5a 621 int selected = 0;
622 int playing = 0;
72e930ef 623 int cardRead = 0;
15c4dc5a 624
625 // Turn on selected LED
626 LED(selected + 1, 0);
627
614da335 628 for (;;) {
6e82300d 629 usb_poll();
95e63594 630 WDT_HIT();
15c4dc5a 631
632 // Was our button held down or pressed?
633 int button_pressed = BUTTON_HELD(1000);
634 SpinDelay(300);
635
636 // Button was held for a second, begin recording
72e930ef 637 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 638 {
639 LEDsoff();
640 LED(selected + 1, 0);
641 LED(LED_RED2, 0);
642
643 // record
644 DbpString("Starting recording");
645
646 // wait for button to be released
647 while(BUTTON_PRESS())
648 WDT_HIT();
649
650 /* need this delay to prevent catching some weird data */
651 SpinDelay(500);
652
653 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
b7536e11 654 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
15c4dc5a 655
656 LEDsoff();
657 LED(selected + 1, 0);
658 // Finished recording
15c4dc5a 659 // If we were previously playing, set playing off
660 // so next button push begins playing what we recorded
614da335 661 playing = 0;
662 cardRead = 1;
72e930ef 663 }
614da335 664 else if (button_pressed > 0 && cardRead == 1) {
665 LEDsoff();
666 LED(selected + 1, 0);
667 LED(LED_ORANGE, 0);
72e930ef 668
614da335 669 // record
b7536e11 670 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
72e930ef 671
614da335 672 // wait for button to be released
673 while(BUTTON_PRESS())
674 WDT_HIT();
72e930ef 675
614da335 676 /* need this delay to prevent catching some weird data */
677 SpinDelay(500);
72e930ef 678
b7536e11 679 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
680 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
72e930ef 681
614da335 682 LEDsoff();
683 LED(selected + 1, 0);
684 // Finished recording
72e930ef 685
614da335 686 // If we were previously playing, set playing off
687 // so next button push begins playing what we recorded
688 playing = 0;
689 cardRead = 0;
15c4dc5a 690 }
691
692 // Change where to record (or begin playing)
614da335 693 else if (button_pressed) {
15c4dc5a 694 // Next option if we were previously playing
695 if (playing)
696 selected = (selected + 1) % OPTS;
697 playing = !playing;
698
699 LEDsoff();
700 LED(selected + 1, 0);
701
702 // Begin transmitting
703 if (playing)
704 {
705 LED(LED_GREEN, 0);
706 DbpString("Playing");
707 // wait for button to be released
708 while(BUTTON_PRESS())
709 WDT_HIT();
0d5ee8e2 710
b7536e11 711 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
0d5ee8e2 712 CmdHIDsimTAG(high[selected], low[selected], 0);
15c4dc5a 713 DbpString("Done playing");
0d5ee8e2 714
715 if (BUTTON_HELD(1000) > 0) {
15c4dc5a 716 DbpString("Exiting");
717 LEDsoff();
718 return;
0d5ee8e2 719 }
15c4dc5a 720
721 /* We pressed a button so ignore it here with a delay */
722 SpinDelay(300);
723
724 // when done, we're done playing, move to next option
725 selected = (selected + 1) % OPTS;
726 playing = !playing;
727 LEDsoff();
728 LED(selected + 1, 0);
729 }
730 else
731 while(BUTTON_PRESS())
732 WDT_HIT();
733 }
734 }
735}
15c4dc5a 736
7838f4be 737#endif
15c4dc5a 738/*
739OBJECTIVE
740Listen and detect an external reader. Determine the best location
741for the antenna.
742
743INSTRUCTIONS:
744Inside the ListenReaderField() function, there is two mode.
745By default, when you call the function, you will enter mode 1.
746If you press the PM3 button one time, you will enter mode 2.
747If you press the PM3 button a second time, you will exit the function.
748
749DESCRIPTION OF MODE 1:
750This mode just listens for an external reader field and lights up green
751for HF and/or red for LF. This is the original mode of the detectreader
752function.
753
754DESCRIPTION OF MODE 2:
755This mode will visually represent, using the LEDs, the actual strength of the
756current compared to the maximum current detected. Basically, once you know
757what kind of external reader is present, it will help you spot the best location to place
758your antenna. You will probably not get some good results if there is a LF and a HF reader
759at the same place! :-)
760
761LIGHT SCHEME USED:
762*/
763static const char LIGHT_SCHEME[] = {
764 0x0, /* ---- | No field detected */
765 0x1, /* X--- | 14% of maximum current detected */
766 0x2, /* -X-- | 29% of maximum current detected */
767 0x4, /* --X- | 43% of maximum current detected */
768 0x8, /* ---X | 57% of maximum current detected */
769 0xC, /* --XX | 71% of maximum current detected */
770 0xE, /* -XXX | 86% of maximum current detected */
771 0xF, /* XXXX | 100% of maximum current detected */
772};
773static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
774
da198be4 775void ListenReaderField(int limit) {
3b692427 776#define LF_ONLY 1
777#define HF_ONLY 2
778#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
779
da198be4 780 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
781 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
782 int mode=1, display_val, display_max, i;
3b692427 783
784 // switch off FPGA - we don't want to measure our own signal
785 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
786 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 787
788 LEDsoff();
789
3b692427 790 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 791
792 if(limit != HF_ONLY) {
3b692427 793 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 794 lf_baseline = lf_av;
795 }
796
3b692427 797 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 798
799 if (limit != LF_ONLY) {
3b692427 800 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 801 hf_baseline = hf_av;
802 }
803
804 for(;;) {
805 if (BUTTON_PRESS()) {
806 SpinDelay(500);
807 switch (mode) {
808 case 1:
809 mode=2;
810 DbpString("Signal Strength Mode");
811 break;
812 case 2:
813 default:
814 DbpString("Stopped");
815 LEDsoff();
816 return;
817 break;
818 }
819 }
820 WDT_HIT();
821
822 if (limit != HF_ONLY) {
3b692427 823 if(mode == 1) {
824 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
825 LED_D_ON();
826 else
827 LED_D_OFF();
15c4dc5a 828 }
e30c654b 829
3b692427 830 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 831 // see if there's a significant change
3b692427 832 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
833 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 834 lf_av = lf_av_new;
835 if (lf_av > lf_max)
836 lf_max = lf_av;
15c4dc5a 837 }
838 }
839
840 if (limit != LF_ONLY) {
841 if (mode == 1){
3b692427 842 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
843 LED_B_ON();
844 else
845 LED_B_OFF();
15c4dc5a 846 }
e30c654b 847
3b692427 848 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 849 // see if there's a significant change
3b692427 850 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
851 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 852 hf_av = hf_av_new;
853 if (hf_av > hf_max)
854 hf_max = hf_av;
15c4dc5a 855 }
856 }
e30c654b 857
15c4dc5a 858 if(mode == 2) {
859 if (limit == LF_ONLY) {
860 display_val = lf_av;
861 display_max = lf_max;
862 } else if (limit == HF_ONLY) {
863 display_val = hf_av;
864 display_max = hf_max;
865 } else { /* Pick one at random */
866 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
867 display_val = hf_av;
868 display_max = hf_max;
869 } else {
870 display_val = lf_av;
871 display_max = lf_max;
872 }
873 }
874 for (i=0; i<LIGHT_LEN; i++) {
875 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
876 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
877 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
878 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
879 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
880 break;
881 }
882 }
883 }
884 }
885}
886
f7e3ed82 887void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 888{
889 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 890
313ee67e 891 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
902cb3c0 892
15c4dc5a 893 switch(c->cmd) {
894#ifdef WITH_LF
31abe49f
MHS
895 case CMD_SET_LF_SAMPLING_CONFIG:
896 setSamplingConfig((sample_config *) c->d.asBytes);
897 break;
15c4dc5a 898 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1c8fbeb9 899 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
15c4dc5a 900 break;
15c4dc5a 901 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
902 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
903 break;
b014c96d 904 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 905 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 906 break;
7e67e42f 907 case CMD_HID_DEMOD_FSK:
a501c82b 908 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 909 break;
910 case CMD_HID_SIM_TAG:
a501c82b 911 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 912 break;
abd6112f 913 case CMD_FSK_SIM_TAG:
914 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
915 break;
916 case CMD_ASK_SIM_TAG:
917 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
918 break;
872e3d4d 919 case CMD_PSK_SIM_TAG:
920 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
921 break;
a501c82b 922 case CMD_HID_CLONE_TAG:
1c611bbd 923 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 924 break;
a1f3bb12 925 case CMD_IO_DEMOD_FSK:
a501c82b 926 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 927 break;
a501c82b 928 case CMD_IO_CLONE_TAG:
94422fa2 929 CopyIOtoT55x7(c->arg[0], c->arg[1]);
a1f3bb12 930 break;
6ff6ade2 931 case CMD_EM410X_DEMOD:
932 CmdEM410xdemod(c->arg[0], 0, 0, 1);
933 break;
2d4eae76 934 case CMD_EM410X_WRITE_TAG:
935 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
936 break;
7e67e42f 937 case CMD_READ_TI_TYPE:
938 ReadTItag();
939 break;
940 case CMD_WRITE_TI_TYPE:
941 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
942 break;
943 case CMD_SIMULATE_TAG_125K:
74daee24 944 LED_A_ON();
945 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
946 LED_A_OFF();
7e67e42f 947 break;
948 case CMD_LF_SIMULATE_BIDIR:
949 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
950 break;
a501c82b 951 case CMD_INDALA_CLONE_TAG:
2414f978 952 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
953 break;
a501c82b 954 case CMD_INDALA_CLONE_TAG_L:
2414f978 955 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
956 break;
1c611bbd 957 case CMD_T55XX_READ_BLOCK:
9276e859 958 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 959 break;
960 case CMD_T55XX_WRITE_BLOCK:
961 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
962 break;
9276e859 963 case CMD_T55XX_WAKEUP:
964 T55xxWakeUp(c->arg[0]);
965 break;
94422fa2 966 case CMD_T55XX_RESET_READ:
967 T55xxResetRead();
968 break;
a501c82b 969 case CMD_PCF7931_READ:
1c611bbd 970 ReadPCF7931();
1c611bbd 971 break;
e98572a1 972 case CMD_PCF7931_WRITE:
ac2df346 973 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
e98572a1 974 break;
1c611bbd 975 case CMD_EM4X_READ_WORD:
976 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
977 break;
978 case CMD_EM4X_WRITE_WORD:
979 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
980 break;
db25599d 981 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
982 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
70459879 983 break;
0de8e387 984 case CMD_VIKING_CLONE_TAG:
a126332a 985 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
0de8e387 986 break;
15c4dc5a 987#endif
988
d19929cb 989#ifdef WITH_HITAG
990 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
991 SnoopHitag(c->arg[0]);
992 break;
993 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
994 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
995 break;
996 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
997 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
998 break;
999#endif
f168b263 1000
15c4dc5a 1001#ifdef WITH_ISO15693
1002 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1003 AcquireRawAdcSamplesIso15693();
1004 break;
9455b51c 1005 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1006 RecordRawAdcSamplesIso15693();
1007 break;
1008
1009 case CMD_ISO_15693_COMMAND:
1010 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1011 break;
1012
1013 case CMD_ISO_15693_FIND_AFI:
1014 BruteforceIso15693Afi(c->arg[0]);
1015 break;
1016
1017 case CMD_ISO_15693_DEBUG:
1018 SetDebugIso15693(c->arg[0]);
1019 break;
15c4dc5a 1020
15c4dc5a 1021 case CMD_READER_ISO_15693:
1022 ReaderIso15693(c->arg[0]);
1023 break;
7e67e42f 1024 case CMD_SIMTAG_ISO_15693:
3649b640 1025 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 1026 break;
15c4dc5a 1027#endif
1028
7e67e42f 1029#ifdef WITH_LEGICRF
1030 case CMD_SIMULATE_TAG_LEGIC_RF:
1031 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1032 break;
3612a8a8 1033
7e67e42f 1034 case CMD_WRITER_LEGIC_RF:
1035 LegicRfWriter(c->arg[1], c->arg[0]);
1036 break;
3612a8a8 1037
15c4dc5a 1038 case CMD_READER_LEGIC_RF:
1039 LegicRfReader(c->arg[0], c->arg[1]);
1040 break;
15c4dc5a 1041#endif
1042
1043#ifdef WITH_ISO14443b
15c4dc5a 1044 case CMD_READ_SRI512_TAG:
abb21530 1045 ReadSTMemoryIso14443b(0x0F);
15c4dc5a 1046 break;
7e67e42f 1047 case CMD_READ_SRIX4K_TAG:
abb21530 1048 ReadSTMemoryIso14443b(0x7F);
7e67e42f 1049 break;
22e24700 1050 case CMD_SNOOP_ISO_14443B:
abb21530 1051 SnoopIso14443b();
7e67e42f 1052 break;
22e24700 1053 case CMD_SIMULATE_TAG_ISO_14443B:
abb21530 1054 SimulateIso14443bTag();
7e67e42f 1055 break;
7cf3ef20 1056 case CMD_ISO_14443B_COMMAND:
1057 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1058 break;
15c4dc5a 1059#endif
1060
1061#ifdef WITH_ISO14443a
7e67e42f 1062 case CMD_SNOOP_ISO_14443a:
4d2e4eea 1063 SniffIso14443a(c->arg[0]);
7e67e42f 1064 break;
15c4dc5a 1065 case CMD_READER_ISO_14443a:
902cb3c0 1066 ReaderIso14443a(c);
15c4dc5a 1067 break;
7e67e42f 1068 case CMD_SIMULATE_TAG_ISO_14443a:
0db6ed9a 1069 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 1070 break;
95e63594 1071
5acd09bd 1072 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 1073 EPA_PACE_Collect_Nonce(c);
5acd09bd 1074 break;
d0f3338e 1075 case CMD_EPA_PACE_REPLAY:
1076 EPA_PACE_Replay(c);
1077 break;
7e67e42f 1078
15c4dc5a 1079 case CMD_READER_MIFARE:
810f5379 1080 ReaderMifare(c->arg[0], c->arg[1]);
15c4dc5a 1081 break;
20f9a2a1
M
1082 case CMD_MIFARE_READBL:
1083 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1084 break;
981bd429 1085 case CMD_MIFAREU_READBL:
aa60d156 1086 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 1087 break;
4d2e4eea 1088 case CMD_MIFAREUC_AUTH:
1089 MifareUC_Auth(c->arg[0],c->d.asBytes);
f38a1528 1090 break;
981bd429 1091 case CMD_MIFAREU_READCARD:
74daee24 1092 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 1093 break;
aa60d156 1094 case CMD_MIFAREUC_SETPWD:
1095 MifareUSetPwd(c->arg[0], c->d.asBytes);
117d9ec2 1096 break;
20f9a2a1
M
1097 case CMD_MIFARE_READSC:
1098 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1099 break;
1100 case CMD_MIFARE_WRITEBL:
1101 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1102 break;
95aeb706 1103 //case CMD_MIFAREU_WRITEBL_COMPAT:
1104 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1105 //break;
981bd429 1106 case CMD_MIFAREU_WRITEBL:
95aeb706 1107 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
aa60d156 1108 break;
c188b1b9 1109 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1110 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1111 break;
20f9a2a1
M
1112 case CMD_MIFARE_NESTED:
1113 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
1114 break;
1115 case CMD_MIFARE_CHKKEYS:
1116 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
1117 break;
1118 case CMD_SIMULATE_MIFARE_CARD:
1119 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1120 break;
8556b852
M
1121
1122 // emulator
1123 case CMD_MIFARE_SET_DBGMODE:
1124 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1125 break;
1126 case CMD_MIFARE_EML_MEMCLR:
1127 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1128 break;
1129 case CMD_MIFARE_EML_MEMSET:
1130 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1131 break;
1132 case CMD_MIFARE_EML_MEMGET:
1133 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1134 break;
1135 case CMD_MIFARE_EML_CARDLOAD:
1136 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
1137 break;
1138
1139 // Work with "magic Chinese" card
d52e4e88 1140 case CMD_MIFARE_CSETBLOCK:
c2731f37 1141 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
545a1f38 1142 break;
d52e4e88 1143 case CMD_MIFARE_CGETBLOCK:
c2731f37 1144 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
8556b852 1145 break;
d52e4e88 1146 case CMD_MIFARE_CIDENT:
1147 MifareCIdent();
1148 break;
b62a5a84
M
1149
1150 // mifare sniffer
1151 case CMD_MIFARE_SNIFFER:
5cd9ec01 1152 SniffMifare(c->arg[0]);
b62a5a84 1153 break;
313ee67e 1154
aa60d156 1155 //mifare desfire
1156 case CMD_MIFARE_DESFIRE_READBL: break;
1157 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1158 case CMD_MIFARE_DESFIRE_AUTH1:
1159 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1160 break;
1161 case CMD_MIFARE_DESFIRE_AUTH2:
1162 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1163 break;
1164 case CMD_MIFARE_DES_READER:
1165 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1166 break;
1167 case CMD_MIFARE_DESFIRE_INFO:
1168 MifareDesfireGetInformation();
1169 break;
1170 case CMD_MIFARE_DESFIRE:
1171 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1172 break;
1173
add0504d 1174 case CMD_MIFARE_COLLECT_NONCES:
add0504d 1175 break;
20f9a2a1 1176#endif
810f5379 1177#ifdef WITH_EMV
1178 case CMD_EMV_TRANSACTION:
1179 EMVTransaction();
1180 break;
1181 case CMD_EMV_GET_RANDOM_NUM:
1182 //EMVgetUDOL();
1183 break;
1184 case CMD_EMV_LOAD_VALUE:
1185 EMVloadvalue(c->arg[0], c->d.asBytes);
1186 break;
1187 case CMD_EMV_DUMP_CARD:
1188 EMVdumpcard();
1189#endif
7e67e42f 1190#ifdef WITH_ICLASS
cee5a30d 1191 // Makes use of ISO14443a FPGA Firmware
1192 case CMD_SNOOP_ICLASS:
1193 SnoopIClass();
1194 break;
1e262141 1195 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 1196 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 1197 break;
1198 case CMD_READER_ICLASS:
1199 ReaderIClass(c->arg[0]);
1200 break;
f38a1528 1201 case CMD_READER_ICLASS_REPLAY:
f62b5e12 1202 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
f38a1528 1203 break;
e80aeb96
MHS
1204 case CMD_ICLASS_EML_MEMSET:
1205 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1206 break;
e98572a1 1207 case CMD_ICLASS_WRITEBLOCK:
1208 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1209 break;
1210 case CMD_ICLASS_READCHECK: // auth step 1
1211 iClass_ReadCheck(c->arg[0], c->arg[1]);
1212 break;
1213 case CMD_ICLASS_READBLOCK:
1214 iClass_ReadBlk(c->arg[0]);
1215 break;
1216 case CMD_ICLASS_AUTHENTICATION: //check
1217 iClass_Authentication(c->d.asBytes);
1218 break;
1219 case CMD_ICLASS_DUMP:
1220 iClass_Dump(c->arg[0], c->arg[1]);
1221 break;
1222 case CMD_ICLASS_CLONE:
1223 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1224 break;
cee5a30d 1225#endif
1d0ccbe0 1226#ifdef WITH_HFSNOOP
1227 case CMD_HF_SNIFFER:
1228 HfSnoop(c->arg[0], c->arg[1]);
1229 break;
1230#endif
cee5a30d 1231
7e67e42f 1232 case CMD_BUFF_CLEAR:
117d9ec2 1233 BigBuf_Clear();
15c4dc5a 1234 break;
15c4dc5a 1235
1236 case CMD_MEASURE_ANTENNA_TUNING:
1237 MeasureAntennaTuning();
1238 break;
1239
1240 case CMD_MEASURE_ANTENNA_TUNING_HF:
1241 MeasureAntennaTuningHf();
1242 break;
1243
1244 case CMD_LISTEN_READER_FIELD:
1245 ListenReaderField(c->arg[0]);
1246 break;
1247
15c4dc5a 1248 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1249 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1250 SpinDelay(200);
1251 LED_D_OFF(); // LED D indicates field ON or OFF
1252 break;
1253
1c611bbd 1254 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 1255
1c611bbd 1256 LED_B_ON();
117d9ec2 1257 uint8_t *BigBuf = BigBuf_get_addr();
0de8e387 1258 size_t len = 0;
1c611bbd 1259 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
0de8e387 1260 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 1261 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 1262 }
1263 // Trigger a finish downloading signal with an ACK frame
3000dc4e 1264 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 1265 LED_B_OFF();
1c611bbd 1266 break;
15c4dc5a 1267
1268 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
117d9ec2 1269 uint8_t *b = BigBuf_get_addr();
7c756d68 1270 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 1271 cmd_send(CMD_ACK,0,0,0,0,0);
1272 break;
1273 }
15c4dc5a 1274 case CMD_READ_MEM:
1275 ReadMem(c->arg[0]);
1276 break;
1277
1278 case CMD_SET_LF_DIVISOR:
7cc204bf 1279 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 1280 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1281 break;
1282
1283 case CMD_SET_ADC_MUX:
1284 switch(c->arg[0]) {
1285 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1286 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1287 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1288 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1289 }
1290 break;
1291
1292 case CMD_VERSION:
1293 SendVersion();
1294 break;
7838f4be 1295 case CMD_STATUS:
0de8e387 1296 SendStatus();
7838f4be 1297 break;
1298 case CMD_PING:
1299 cmd_send(CMD_ACK,0,0,0,0,0);
1300 break;
15c4dc5a 1301#ifdef WITH_LCD
1302 case CMD_LCD_RESET:
1303 LCDReset();
1304 break;
1305 case CMD_LCD:
1306 LCDSend(c->arg[0]);
1307 break;
1308#endif
1309 case CMD_SETUP_WRITE:
1310 case CMD_FINISH_WRITE:
1c611bbd 1311 case CMD_HARDWARE_RESET:
1312 usb_disable();
f62b5e12 1313 SpinDelay(2000);
15c4dc5a 1314 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1315 for(;;) {
1316 // We're going to reset, and the bootrom will take control.
1317 }
1c611bbd 1318 break;
15c4dc5a 1319
1c611bbd 1320 case CMD_START_FLASH:
15c4dc5a 1321 if(common_area.flags.bootrom_present) {
1322 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1323 }
1c611bbd 1324 usb_disable();
15c4dc5a 1325 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1326 for(;;);
1c611bbd 1327 break;
e30c654b 1328
15c4dc5a 1329 case CMD_DEVICE_INFO: {
902cb3c0 1330 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1331 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1332 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1333 break;
1334 }
1335 default:
15c4dc5a 1336 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1337 break;
15c4dc5a 1338 }
1339}
1340
1341void __attribute__((noreturn)) AppMain(void)
1342{
1343 SpinDelay(100);
9e8255d4 1344 clear_trace();
15c4dc5a 1345 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1346 /* Initialize common area */
1347 memset(&common_area, 0, sizeof(common_area));
1348 common_area.magic = COMMON_AREA_MAGIC;
1349 common_area.version = 1;
1350 }
1351 common_area.flags.osimage_present = 1;
1352
1353 LED_D_OFF();
1354 LED_C_OFF();
1355 LED_B_OFF();
1356 LED_A_OFF();
1357
b44e5233 1358 // Init USB device
313ee67e 1359 usb_enable();
15c4dc5a 1360
1361 // The FPGA gets its clock from us from PCK0 output, so set that up.
1362 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1363 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1364 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1365 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1366 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1d0ccbe0 1367 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
15c4dc5a 1368 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1369
1370 // Reset SPI
1371 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1372 // Reset SSC
1373 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1374
1375 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1376 // (the HF version by default)
1377 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1378
9ca155ba 1379 StartTickCount();
902cb3c0 1380
15c4dc5a 1381#ifdef WITH_LCD
15c4dc5a 1382 LCDInit();
15c4dc5a 1383#endif
1384
f62b5e12 1385 byte_t rx[sizeof(UsbCommand)];
902cb3c0 1386 size_t rx_len;
1387
15c4dc5a 1388 for(;;) {
313ee67e 1389 if (usb_poll()) {
1390 rx_len = usb_read(rx,sizeof(UsbCommand));
da198be4 1391 if (rx_len)
313ee67e 1392 UsbPacketReceived(rx,rx_len);
313ee67e 1393 }
15c4dc5a 1394 WDT_HIT();
1395
1396#ifdef WITH_LF
7838f4be 1397#ifndef WITH_ISO14443a_StandAlone
15c4dc5a 1398 if (BUTTON_HELD(1000) > 0)
1399 SamyRun();
7838f4be 1400#endif
1401#endif
1402#ifdef WITH_ISO14443a
1403#ifdef WITH_ISO14443a_StandAlone
1404 if (BUTTON_HELD(1000) > 0)
1405 StandAloneMode14a();
1406#endif
15c4dc5a 1407#endif
1408 }
1409}
Impressum, Datenschutz