]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
test-pr
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
902cb3c0 13#include "usb_cdc.h"
14#include "cmd.h"
15
e30c654b 16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
31d1caa5 21
9ab7a6c7 22#include <stdarg.h>
f7e3ed82 23
15c4dc5a 24#include "legicrf.h"
d19929cb 25#include <hitag2.h>
4e12287d 26#include <hitagS.h>
31abe49f 27#include "lfsampling.h"
3000dc4e 28#include "BigBuf.h"
c89274cc 29#include "mifareutil.h"
d10e08ae 30#include "pcf7931.h"
15c4dc5a 31#ifdef WITH_LCD
902cb3c0 32 #include "LCD.h"
15c4dc5a 33#endif
34
e46fe044
CY
35// Craig Young - 14a stand-alone code
36#ifdef WITH_ISO14443a_StandAlone
37 #include "iso14443a.h"
38#endif
39
15c4dc5a 40//=============================================================================
41// A buffer where we can queue things up to be sent through the FPGA, for
42// any purpose (fake tag, as reader, whatever). We go MSB first, since that
43// is the order in which they go out on the wire.
44//=============================================================================
45
6a1f2d82 46#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
47uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 48int ToSendMax;
49static int ToSendBit;
50struct common_area common_area __attribute__((section(".commonarea")));
51
15c4dc5a 52void ToSendReset(void)
53{
54 ToSendMax = -1;
55 ToSendBit = 8;
56}
57
58void ToSendStuffBit(int b)
59{
60 if(ToSendBit >= 8) {
61 ToSendMax++;
62 ToSend[ToSendMax] = 0;
63 ToSendBit = 0;
64 }
65
66 if(b) {
67 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
68 }
69
70 ToSendBit++;
71
6a1f2d82 72 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76}
77
78//=============================================================================
79// Debug print functions, to go out over USB, to the usual PC-side client.
80//=============================================================================
81
82void DbpString(char *str)
83{
9440213d 84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 86}
87
88#if 0
89void DbpIntegers(int x1, int x2, int x3)
90{
902cb3c0 91 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 92}
93#endif
94
95void Dbprintf(const char *fmt, ...) {
96// should probably limit size here; oh well, let's just use a big buffer
97 char output_string[128];
98 va_list ap;
99
100 va_start(ap, fmt);
101 kvsprintf(fmt, output_string, 10, ap);
102 va_end(ap);
e30c654b 103
15c4dc5a 104 DbpString(output_string);
105}
106
9455b51c 107// prints HEX & ASCII
d19929cb 108void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 109 int l=0,i;
110 char ascii[9];
d19929cb 111
9455b51c 112 while (len>0) {
113 if (len>8) l=8;
114 else l=len;
115
116 memcpy(ascii,d,l);
d19929cb 117 ascii[l]=0;
9455b51c 118
119 // filter safe ascii
d19929cb 120 for (i=0;i<l;i++)
9455b51c 121 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 122
123 if (bAsci) {
124 Dbprintf("%-8s %*D",ascii,l,d," ");
125 } else {
126 Dbprintf("%*D",l,d," ");
127 }
128
9455b51c 129 len-=8;
130 d+=8;
131 }
132}
133
15c4dc5a 134//-----------------------------------------------------------------------------
135// Read an ADC channel and block till it completes, then return the result
136// in ADC units (0 to 1023). Also a routine to average 32 samples and
137// return that.
138//-----------------------------------------------------------------------------
139static int ReadAdc(int ch)
140{
f7e3ed82 141 uint32_t d;
15c4dc5a 142
143 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
144 AT91C_BASE_ADC->ADC_MR =
3b692427 145 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
146 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
147 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
148
149 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
150 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
151 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
152 //
153 // The maths are:
154 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
155 //
156 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
157 //
158 // Note: with the "historic" values in the comments above, the error was 34% !!!
159
15c4dc5a 160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161
162 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
3b692427 163
15c4dc5a 164 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
165 ;
166 d = AT91C_BASE_ADC->ADC_CDR[ch];
167
168 return d;
169}
170
9ca155ba 171int AvgAdc(int ch) // was static - merlok
15c4dc5a 172{
173 int i;
174 int a = 0;
175
176 for(i = 0; i < 32; i++) {
177 a += ReadAdc(ch);
178 }
179
180 return (a + 15) >> 5;
181}
182
fdcfbdcc 183void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
15c4dc5a 184{
fdcfbdcc 185 int i, adcval = 0, peak = 0;
15c4dc5a 186
187/*
188 * Sweeps the useful LF range of the proxmark from
189 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
190 * read the voltage in the antenna, the result left
191 * in the buffer is a graph which should clearly show
192 * the resonating frequency of your LF antenna
193 * ( hopefully around 95 if it is tuned to 125kHz!)
194 */
fdcfbdcc
RAB
195
196 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 197 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2bdd68c3 198 for (i=255; i>=19; i--) {
fdcfbdcc 199 WDT_HIT();
15c4dc5a 200 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
201 SpinDelay(20);
3b692427 202 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
fdcfbdcc
RAB
203 if (i==95) *vLf125 = adcval; // voltage at 125Khz
204 if (i==89) *vLf134 = adcval; // voltage at 134Khz
15c4dc5a 205
2bdd68c3 206 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
207 if(LF_Results[i] > peak) {
fdcfbdcc 208 *peakv = adcval;
2bdd68c3 209 peak = LF_Results[i];
fdcfbdcc 210 *peakf = i;
9f693930 211 //ptr = i;
15c4dc5a 212 }
213 }
214
2bdd68c3 215 for (i=18; i >= 0; i--) LF_Results[i] = 0;
fdcfbdcc
RAB
216
217 return;
218}
219
220void MeasureAntennaTuningHfOnly(int *vHf)
221{
15c4dc5a 222 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
fdcfbdcc
RAB
223 LED_A_ON();
224 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 225 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
226 SpinDelay(20);
fdcfbdcc
RAB
227 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
228 LED_A_OFF();
229
230 return;
231}
232
233void MeasureAntennaTuning(int mode)
234{
235 uint8_t LF_Results[256] = {0};
236 int peakv = 0, peakf = 0;
237 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
238
239 LED_B_ON();
240
241 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
242 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
243 MeasureAntennaTuningHfOnly(&vHf);
244 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
245 } else {
246 if (mode & FLAG_TUNE_LF) {
247 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
248 }
249 if (mode & FLAG_TUNE_HF) {
250 MeasureAntennaTuningHfOnly(&vHf);
251 }
252 }
15c4dc5a 253
3b692427 254 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
d19929cb 255 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 256 LED_B_OFF();
257 return;
15c4dc5a 258}
259
260void MeasureAntennaTuningHf(void)
261{
262 int vHf = 0; // in mV
263
264 DbpString("Measuring HF antenna, press button to exit");
265
3b692427 266 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
267 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
268 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
269
15c4dc5a 270 for (;;) {
15c4dc5a 271 SpinDelay(20);
3b692427 272 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 273
15c4dc5a 274 Dbprintf("%d mV",vHf);
275 if (BUTTON_PRESS()) break;
276 }
277 DbpString("cancelled");
3b692427 278
279 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
280
15c4dc5a 281}
282
283
15c4dc5a 284void ReadMem(int addr)
285{
f7e3ed82 286 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 287
288 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
289 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
290}
291
292/* osimage version information is linked in */
293extern struct version_information version_information;
294/* bootrom version information is pointed to from _bootphase1_version_pointer */
0fa01ec7 295extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
15c4dc5a 296void SendVersion(void)
297{
8e074056 298 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
299 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 300
301 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 302 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
303 * pointer, then use it.
304 */
305 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
306 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
8e074056 307 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 308 } else {
309 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
8e074056 310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 311 }
e30c654b 312
15c4dc5a 313 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
8e074056 314 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 315
e6153040 316 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
8e074056 317 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e6153040 318 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
8e074056 319 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
0fa01ec7 320
e6153040 321 // Send Chip ID and used flash memory
0fa01ec7 322 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
323 uint32_t compressed_data_section_size = common_area.arg1;
8e074056 324 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 325}
326
bfb01844 327// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
328// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
67b7d6fa 329void printUSBSpeed(void)
bfb01844 330{
331 Dbprintf("USB Speed:");
67b7d6fa 332 Dbprintf(" Sending USB packets to client...");
bfb01844 333
67b7d6fa 334 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
bfb01844 335 uint8_t *test_data = BigBuf_get_addr();
67b7d6fa 336 uint32_t end_time;
bfb01844 337
67b7d6fa 338 uint32_t start_time = end_time = GetTickCount();
339 uint32_t bytes_transferred = 0;
340
bfb01844 341 LED_B_ON();
67b7d6fa 342 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
343 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
344 end_time = GetTickCount();
345 bytes_transferred += USB_CMD_DATA_SIZE;
bfb01844 346 }
347 LED_B_OFF();
348
67b7d6fa 349 Dbprintf(" Time elapsed: %dms", end_time - start_time);
350 Dbprintf(" Bytes transferred: %d", bytes_transferred);
351 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
352 1000 * bytes_transferred / (end_time - start_time));
bfb01844 353
354}
355
c89274cc
CY
356/**
357 * Prints runtime information about the PM3.
358**/
67b7d6fa 359void SendStatus(void)
c89274cc
CY
360{
361 BigBuf_print_status();
362 Fpga_print_status();
363 printConfig(); //LF Sampling config
67b7d6fa 364 printUSBSpeed();
c89274cc
CY
365 Dbprintf("Various");
366 Dbprintf(" MF_DBGLEVEL......%d", MF_DBGLEVEL);
367 Dbprintf(" ToSendMax........%d",ToSendMax);
368 Dbprintf(" ToSendBit........%d",ToSendBit);
bfb01844 369
370 cmd_send(CMD_ACK,1,0,0,0,0);
c89274cc 371}
15c4dc5a 372
86a83668 373#if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
15c4dc5a 374
15c4dc5a 375#define OPTS 2
376
86a83668
MHS
377void StandAloneMode()
378{
379 DbpString("Stand-alone mode! No PC necessary.");
15c4dc5a 380 // Oooh pretty -- notify user we're in elite samy mode now
381 LED(LED_RED, 200);
382 LED(LED_ORANGE, 200);
383 LED(LED_GREEN, 200);
384 LED(LED_ORANGE, 200);
385 LED(LED_RED, 200);
386 LED(LED_ORANGE, 200);
387 LED(LED_GREEN, 200);
388 LED(LED_ORANGE, 200);
389 LED(LED_RED, 200);
390
86a83668
MHS
391}
392
393#endif
394
395
396
397#ifdef WITH_ISO14443a_StandAlone
398void StandAloneMode14a()
399{
400 StandAloneMode();
401 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
402
15c4dc5a 403 int selected = 0;
c89274cc 404 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
86a83668
MHS
405 int cardRead[OPTS] = {0};
406 uint8_t readUID[10] = {0};
407 uint32_t uid_1st[OPTS]={0};
408 uint32_t uid_2nd[OPTS]={0};
c89274cc
CY
409 uint32_t uid_tmp1 = 0;
410 uint32_t uid_tmp2 = 0;
411 iso14a_card_select_t hi14a_card[OPTS];
15c4dc5a 412
15c4dc5a 413 LED(selected + 1, 0);
414
415 for (;;)
416 {
6e82300d 417 usb_poll();
86a83668 418 WDT_HIT();
15c4dc5a 419 SpinDelay(300);
420
c89274cc 421 if (iGotoRecord == 1 || cardRead[selected] == 0)
15c4dc5a 422 {
c89274cc 423 iGotoRecord = 0;
15c4dc5a 424 LEDsoff();
425 LED(selected + 1, 0);
426 LED(LED_RED2, 0);
427
428 // record
86a83668 429 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
15c4dc5a 430 /* need this delay to prevent catching some weird data */
431 SpinDelay(500);
86a83668
MHS
432 /* Code for reading from 14a tag */
433 uint8_t uid[10] ={0};
434 uint32_t cuid;
435 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
15c4dc5a 436
86a83668
MHS
437 for ( ; ; )
438 {
439 WDT_HIT();
c89274cc
CY
440 if (BUTTON_PRESS()) {
441 if (cardRead[selected]) {
442 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
443 break;
444 }
445 else if (cardRead[(selected+1)%OPTS]) {
446 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
447 selected = (selected+1)%OPTS;
448 break; // playing = 1;
449 }
450 else {
451 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
452 SpinDelay(300);
453 }
454 }
455 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
86a83668
MHS
456 continue;
457 else
458 {
459 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
460 memcpy(readUID,uid,10*sizeof(uint8_t));
c89274cc 461 uint8_t *dst = (uint8_t *)&uid_tmp1;
86a83668
MHS
462 // Set UID byte order
463 for (int i=0; i<4; i++)
464 dst[i] = uid[3-i];
c89274cc 465 dst = (uint8_t *)&uid_tmp2;
86a83668
MHS
466 for (int i=0; i<4; i++)
467 dst[i] = uid[7-i];
c89274cc
CY
468 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
469 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
470 }
471 else {
472 if (uid_tmp2) {
473 Dbprintf("Bank[%d] received a 7-byte UID",selected);
474 uid_1st[selected] = (uid_tmp1)>>8;
475 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
476 }
477 else {
478 Dbprintf("Bank[%d] received a 4-byte UID",selected);
479 uid_1st[selected] = uid_tmp1;
480 uid_2nd[selected] = uid_tmp2;
481 }
482 break;
483 }
86a83668
MHS
484 }
485 }
c89274cc
CY
486 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
487 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
86a83668
MHS
488 LEDsoff();
489 LED(LED_GREEN, 200);
490 LED(LED_ORANGE, 200);
491 LED(LED_GREEN, 200);
492 LED(LED_ORANGE, 200);
15c4dc5a 493
494 LEDsoff();
495 LED(selected + 1, 0);
15c4dc5a 496
c89274cc
CY
497 // Next state is replay:
498 playing = 1;
3fe4ff4f 499
86a83668 500 cardRead[selected] = 1;
86a83668 501 }
c89274cc
CY
502 /* MF Classic UID clone */
503 else if (iGotoClone==1)
3fe4ff4f 504 {
c89274cc
CY
505 iGotoClone=0;
506 LEDsoff();
507 LED(selected + 1, 0);
508 LED(LED_ORANGE, 250);
3fe4ff4f 509
3fe4ff4f 510
c89274cc
CY
511 // record
512 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
3fe4ff4f 513
c89274cc
CY
514 // wait for button to be released
515 while(BUTTON_PRESS())
516 {
517 // Delay cloning until card is in place
518 WDT_HIT();
519 }
520 Dbprintf("Starting clone. [Bank: %u]", selected);
521 // need this delay to prevent catching some weird data
522 SpinDelay(500);
523 // Begin clone function here:
524 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
525 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
526 memcpy(c.d.asBytes, data, 16);
527 SendCommand(&c);
528
529 Block read is similar:
530 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
531 We need to imitate that call with blockNo 0 to set a uid.
532
533 The get and set commands are handled in this file:
534 // Work with "magic Chinese" card
535 case CMD_MIFARE_CSETBLOCK:
536 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
537 break;
538 case CMD_MIFARE_CGETBLOCK:
539 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
540 break;
541
542 mfCSetUID provides example logic for UID set workflow:
543 -Read block0 from card in field with MifareCGetBlock()
544 -Configure new values without replacing reserved bytes
545 memcpy(block0, uid, 4); // Copy UID bytes from byte array
546 // Mifare UID BCC
547 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
548 Bytes 5-7 are reserved SAK and ATQA for mifare classic
549 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
550 */
551 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
552 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
553 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
554 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
555 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
556 playing = 1;
557 }
558 else {
559 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
560 memcpy(newBlock0,oldBlock0,16);
561 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
562
563 newBlock0[0] = uid_1st[selected]>>24;
564 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
565 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
566 newBlock0[3] = 0xFF & (uid_1st[selected]);
567 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
568 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
569 MifareCSetBlock(0, 0xFF,0, newBlock0);
570 MifareCGetBlock(0x3F, 1, 0, testBlock0);
571 if (memcmp(testBlock0,newBlock0,16)==0)
572 {
573 DbpString("Cloned successfull!");
574 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
3fe4ff4f 575 playing = 0;
c89274cc
CY
576 iGotoRecord = 1;
577 selected = (selected+1) % OPTS;
578 }
579 else {
580 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
581 playing = 1;
582 }
583 }
584 LEDsoff();
585 LED(selected + 1, 0);
15c4dc5a 586
86a83668 587 }
15c4dc5a 588 // Change where to record (or begin playing)
c89274cc 589 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
15c4dc5a 590 {
15c4dc5a 591 LEDsoff();
592 LED(selected + 1, 0);
593
594 // Begin transmitting
595 if (playing)
596 {
597 LED(LED_GREEN, 0);
598 DbpString("Playing");
c89274cc
CY
599 for ( ; ; ) {
600 WDT_HIT();
601 int button_action = BUTTON_HELD(1000);
602 if (button_action == 0) { // No button action, proceed with sim
603 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
86a83668 604 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
c89274cc
CY
605 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
606 DbpString("Mifare Classic");
607 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
608 }
609 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
610 DbpString("Mifare Ultralight");
611 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
612 }
613 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
614 DbpString("Mifare DESFire");
615 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
616 }
617 else {
618 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
619 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
620 }
621 }
622 else if (button_action == BUTTON_SINGLE_CLICK) {
623 selected = (selected + 1) % OPTS;
624 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
625 iGotoRecord = 1;
626 break;
15c4dc5a 627 }
c89274cc
CY
628 else if (button_action == BUTTON_HOLD) {
629 Dbprintf("Playtime over. Begin cloning...");
630 iGotoClone = 1;
631 break;
632 }
633 WDT_HIT();
634 }
15c4dc5a 635
636 /* We pressed a button so ignore it here with a delay */
637 SpinDelay(300);
15c4dc5a 638 LEDsoff();
639 LED(selected + 1, 0);
640 }
641 else
642 while(BUTTON_PRESS())
643 WDT_HIT();
644 }
645 }
646}
86a83668
MHS
647#elif WITH_LF
648// samy's sniff and repeat routine
649void SamyRun()
e46fe044 650{
86a83668
MHS
651 StandAloneMode();
652 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
e46fe044 653
86a83668 654 int high[OPTS], low[OPTS];
15c4dc5a 655 int selected = 0;
656 int playing = 0;
3fe4ff4f 657 int cardRead = 0;
15c4dc5a 658
659 // Turn on selected LED
660 LED(selected + 1, 0);
661
662 for (;;)
663 {
6e82300d 664 usb_poll();
86a83668 665 WDT_HIT();
15c4dc5a 666
667 // Was our button held down or pressed?
668 int button_pressed = BUTTON_HELD(1000);
669 SpinDelay(300);
670
671 // Button was held for a second, begin recording
3fe4ff4f 672 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 673 {
674 LEDsoff();
675 LED(selected + 1, 0);
676 LED(LED_RED2, 0);
677
678 // record
679 DbpString("Starting recording");
680
681 // wait for button to be released
682 while(BUTTON_PRESS())
683 WDT_HIT();
684
685 /* need this delay to prevent catching some weird data */
686 SpinDelay(500);
687
688 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
098015eb 689 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
15c4dc5a 690
691 LEDsoff();
692 LED(selected + 1, 0);
693 // Finished recording
694
695 // If we were previously playing, set playing off
696 // so next button push begins playing what we recorded
697 playing = 0;
3fe4ff4f 698
699 cardRead = 1;
700
701 }
702
703 else if (button_pressed > 0 && cardRead == 1)
704 {
705 LEDsoff();
706 LED(selected + 1, 0);
707 LED(LED_ORANGE, 0);
708
709 // record
098015eb 710 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
3fe4ff4f 711
712 // wait for button to be released
713 while(BUTTON_PRESS())
714 WDT_HIT();
715
716 /* need this delay to prevent catching some weird data */
717 SpinDelay(500);
718
098015eb 719 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
720 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
3fe4ff4f 721
722 LEDsoff();
723 LED(selected + 1, 0);
724 // Finished recording
725
726 // If we were previously playing, set playing off
727 // so next button push begins playing what we recorded
728 playing = 0;
729
730 cardRead = 0;
731
15c4dc5a 732 }
733
734 // Change where to record (or begin playing)
735 else if (button_pressed)
736 {
737 // Next option if we were previously playing
738 if (playing)
739 selected = (selected + 1) % OPTS;
740 playing = !playing;
741
742 LEDsoff();
743 LED(selected + 1, 0);
744
745 // Begin transmitting
746 if (playing)
747 {
748 LED(LED_GREEN, 0);
749 DbpString("Playing");
750 // wait for button to be released
751 while(BUTTON_PRESS())
752 WDT_HIT();
098015eb 753 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
15c4dc5a 754 CmdHIDsimTAG(high[selected], low[selected], 0);
755 DbpString("Done playing");
756 if (BUTTON_HELD(1000) > 0)
757 {
758 DbpString("Exiting");
759 LEDsoff();
760 return;
761 }
762
763 /* We pressed a button so ignore it here with a delay */
764 SpinDelay(300);
765
766 // when done, we're done playing, move to next option
767 selected = (selected + 1) % OPTS;
768 playing = !playing;
769 LEDsoff();
770 LED(selected + 1, 0);
771 }
772 else
773 while(BUTTON_PRESS())
774 WDT_HIT();
775 }
776 }
777}
15c4dc5a 778
e46fe044 779#endif
15c4dc5a 780/*
781OBJECTIVE
782Listen and detect an external reader. Determine the best location
783for the antenna.
784
785INSTRUCTIONS:
786Inside the ListenReaderField() function, there is two mode.
787By default, when you call the function, you will enter mode 1.
788If you press the PM3 button one time, you will enter mode 2.
789If you press the PM3 button a second time, you will exit the function.
790
791DESCRIPTION OF MODE 1:
792This mode just listens for an external reader field and lights up green
793for HF and/or red for LF. This is the original mode of the detectreader
794function.
795
796DESCRIPTION OF MODE 2:
797This mode will visually represent, using the LEDs, the actual strength of the
798current compared to the maximum current detected. Basically, once you know
799what kind of external reader is present, it will help you spot the best location to place
800your antenna. You will probably not get some good results if there is a LF and a HF reader
801at the same place! :-)
802
803LIGHT SCHEME USED:
804*/
805static const char LIGHT_SCHEME[] = {
806 0x0, /* ---- | No field detected */
807 0x1, /* X--- | 14% of maximum current detected */
808 0x2, /* -X-- | 29% of maximum current detected */
809 0x4, /* --X- | 43% of maximum current detected */
810 0x8, /* ---X | 57% of maximum current detected */
811 0xC, /* --XX | 71% of maximum current detected */
812 0xE, /* -XXX | 86% of maximum current detected */
813 0xF, /* XXXX | 100% of maximum current detected */
814};
815static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
816
817void ListenReaderField(int limit)
818{
3b692427 819 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
820 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
15c4dc5a 821 int mode=1, display_val, display_max, i;
822
3b692427 823#define LF_ONLY 1
824#define HF_ONLY 2
825#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
826
827
828 // switch off FPGA - we don't want to measure our own signal
829 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
830 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 831
832 LEDsoff();
833
3b692427 834 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 835
836 if(limit != HF_ONLY) {
3b692427 837 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 838 lf_baseline = lf_av;
839 }
840
3b692427 841 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 842
843 if (limit != LF_ONLY) {
3b692427 844 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 845 hf_baseline = hf_av;
846 }
847
848 for(;;) {
849 if (BUTTON_PRESS()) {
850 SpinDelay(500);
851 switch (mode) {
852 case 1:
853 mode=2;
854 DbpString("Signal Strength Mode");
855 break;
856 case 2:
857 default:
858 DbpString("Stopped");
859 LEDsoff();
860 return;
861 break;
862 }
863 }
864 WDT_HIT();
865
866 if (limit != HF_ONLY) {
3b692427 867 if(mode == 1) {
cf194819 868 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
3b692427 869 LED_D_ON();
870 else
871 LED_D_OFF();
15c4dc5a 872 }
e30c654b 873
3b692427 874 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 875 // see if there's a significant change
cf194819 876 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
3b692427 877 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 878 lf_av = lf_av_new;
879 if (lf_av > lf_max)
880 lf_max = lf_av;
15c4dc5a 881 }
882 }
883
884 if (limit != LF_ONLY) {
885 if (mode == 1){
cf194819 886 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
3b692427 887 LED_B_ON();
888 else
889 LED_B_OFF();
15c4dc5a 890 }
e30c654b 891
3b692427 892 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 893 // see if there's a significant change
cf194819 894 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
3b692427 895 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 896 hf_av = hf_av_new;
897 if (hf_av > hf_max)
898 hf_max = hf_av;
15c4dc5a 899 }
900 }
e30c654b 901
15c4dc5a 902 if(mode == 2) {
903 if (limit == LF_ONLY) {
904 display_val = lf_av;
905 display_max = lf_max;
906 } else if (limit == HF_ONLY) {
907 display_val = hf_av;
908 display_max = hf_max;
909 } else { /* Pick one at random */
910 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
911 display_val = hf_av;
912 display_max = hf_max;
913 } else {
914 display_val = lf_av;
915 display_max = lf_max;
916 }
917 }
918 for (i=0; i<LIGHT_LEN; i++) {
919 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
920 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
921 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
922 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
923 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
924 break;
925 }
926 }
927 }
928 }
929}
930
f7e3ed82 931void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 932{
933 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 934
902cb3c0 935// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
936
15c4dc5a 937 switch(c->cmd) {
938#ifdef WITH_LF
31abe49f
MHS
939 case CMD_SET_LF_SAMPLING_CONFIG:
940 setSamplingConfig((sample_config *) c->d.asBytes);
941 break;
15c4dc5a 942 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1fbf8956 943 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
15c4dc5a 944 break;
15c4dc5a 945 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
946 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
947 break;
b014c96d 948 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 949 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 950 break;
7e67e42f 951 case CMD_HID_DEMOD_FSK:
3fe4ff4f 952 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 953 break;
954 case CMD_HID_SIM_TAG:
3fe4ff4f 955 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 956 break;
abd6112f 957 case CMD_FSK_SIM_TAG:
958 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
959 break;
960 case CMD_ASK_SIM_TAG:
961 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
962 break;
872e3d4d 963 case CMD_PSK_SIM_TAG:
964 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
965 break;
966 case CMD_HID_CLONE_TAG:
1c611bbd 967 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 968 break;
a1f3bb12 969 case CMD_IO_DEMOD_FSK:
3fe4ff4f 970 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 971 break;
3fe4ff4f 972 case CMD_IO_CLONE_TAG:
9f669cb2 973 CopyIOtoT55x7(c->arg[0], c->arg[1]);
a1f3bb12 974 break;
66707a3b 975 case CMD_EM410X_DEMOD:
976 CmdEM410xdemod(c->arg[0], 0, 0, 1);
977 break;
2d4eae76 978 case CMD_EM410X_WRITE_TAG:
979 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
980 break;
7e67e42f 981 case CMD_READ_TI_TYPE:
982 ReadTItag();
983 break;
984 case CMD_WRITE_TI_TYPE:
985 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
986 break;
987 case CMD_SIMULATE_TAG_125K:
31d1caa5 988 LED_A_ON();
7e67e42f 989 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
31d1caa5 990 LED_A_OFF();
7e67e42f 991 break;
992 case CMD_LF_SIMULATE_BIDIR:
993 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
994 break;
3fe4ff4f 995 case CMD_INDALA_CLONE_TAG:
2414f978 996 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
997 break;
3fe4ff4f 998 case CMD_INDALA_CLONE_TAG_L:
2414f978 999 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1000 break;
1c611bbd 1001 case CMD_T55XX_READ_BLOCK:
8e99ec25 1002 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1003 break;
1004 case CMD_T55XX_WRITE_BLOCK:
1005 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1006 break;
be2d41b7 1007 case CMD_T55XX_WAKEUP:
1008 T55xxWakeUp(c->arg[0]);
1c611bbd 1009 break;
66837a03 1010 case CMD_T55XX_RESET_READ:
1011 T55xxResetRead();
1012 break;
3fe4ff4f 1013 case CMD_PCF7931_READ:
1c611bbd 1014 ReadPCF7931();
1c611bbd 1015 break;
dc4300ba 1016 case CMD_PCF7931_WRITE:
d10e08ae 1017 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
dc4300ba 1018 break;
1c611bbd 1019 case CMD_EM4X_READ_WORD:
1020 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
1021 break;
1022 case CMD_EM4X_WRITE_WORD:
1023 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1024 break;
dbf6e824
CY
1025 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1026 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
7cfc777b 1027 break;
709665b5 1028 case CMD_VIKING_CLONE_TAG:
1029 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1030 break;
15c4dc5a 1031#endif
1032
d19929cb 1033#ifdef WITH_HITAG
1034 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1035 SnoopHitag(c->arg[0]);
1036 break;
1037 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1038 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1039 break;
1040 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1041 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1042 break;
4e12287d
RS
1043 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1044 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1045 break;
1046 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1047 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1048 break;
1049 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1050 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1051 break;
1052 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1053 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1054 break;
d19929cb 1055#endif
f168b263 1056
15c4dc5a 1057#ifdef WITH_ISO15693
1058 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1059 AcquireRawAdcSamplesIso15693();
1060 break;
9455b51c 1061 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1062 RecordRawAdcSamplesIso15693();
1063 break;
1064
1065 case CMD_ISO_15693_COMMAND:
1066 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1067 break;
1068
1069 case CMD_ISO_15693_FIND_AFI:
1070 BruteforceIso15693Afi(c->arg[0]);
1071 break;
1072
1073 case CMD_ISO_15693_DEBUG:
1074 SetDebugIso15693(c->arg[0]);
1075 break;
15c4dc5a 1076
15c4dc5a 1077 case CMD_READER_ISO_15693:
1078 ReaderIso15693(c->arg[0]);
1079 break;
7e67e42f 1080 case CMD_SIMTAG_ISO_15693:
3fe4ff4f 1081 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 1082 break;
15c4dc5a 1083#endif
1084
7e67e42f 1085#ifdef WITH_LEGICRF
1086 case CMD_SIMULATE_TAG_LEGIC_RF:
1087 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1088 break;
3612a8a8 1089
7e67e42f 1090 case CMD_WRITER_LEGIC_RF:
1091 LegicRfWriter(c->arg[1], c->arg[0]);
1092 break;
3612a8a8 1093
15c4dc5a 1094 case CMD_READER_LEGIC_RF:
1095 LegicRfReader(c->arg[0], c->arg[1]);
1096 break;
15c4dc5a 1097#endif
1098
1099#ifdef WITH_ISO14443b
15c4dc5a 1100 case CMD_READ_SRI512_TAG:
51d4f6f1 1101 ReadSTMemoryIso14443b(0x0F);
15c4dc5a 1102 break;
7e67e42f 1103 case CMD_READ_SRIX4K_TAG:
51d4f6f1 1104 ReadSTMemoryIso14443b(0x7F);
7e67e42f 1105 break;
132a0217 1106 case CMD_SNOOP_ISO_14443B:
51d4f6f1 1107 SnoopIso14443b();
7e67e42f 1108 break;
132a0217 1109 case CMD_SIMULATE_TAG_ISO_14443B:
51d4f6f1 1110 SimulateIso14443bTag();
7e67e42f 1111 break;
7cf3ef20 1112 case CMD_ISO_14443B_COMMAND:
1113 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1114 break;
15c4dc5a 1115#endif
1116
1117#ifdef WITH_ISO14443a
7e67e42f 1118 case CMD_SNOOP_ISO_14443a:
5cd9ec01 1119 SnoopIso14443a(c->arg[0]);
7e67e42f 1120 break;
15c4dc5a 1121 case CMD_READER_ISO_14443a:
902cb3c0 1122 ReaderIso14443a(c);
15c4dc5a 1123 break;
7e67e42f 1124 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 1125 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 1126 break;
3fe4ff4f 1127
5acd09bd 1128 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 1129 EPA_PACE_Collect_Nonce(c);
5acd09bd 1130 break;
3bb07d96
FM
1131 case CMD_EPA_PACE_REPLAY:
1132 EPA_PACE_Replay(c);
1133 break;
7e67e42f 1134
15c4dc5a 1135 case CMD_READER_MIFARE:
f168b263 1136 ReaderMifare(c->arg[0]);
15c4dc5a 1137 break;
20f9a2a1
M
1138 case CMD_MIFARE_READBL:
1139 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1140 break;
981bd429 1141 case CMD_MIFAREU_READBL:
f168b263 1142 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 1143 break;
8258f409 1144 case CMD_MIFAREUC_AUTH:
1145 MifareUC_Auth(c->arg[0],c->d.asBytes);
a631936e 1146 break;
981bd429 1147 case CMD_MIFAREU_READCARD:
75377d29 1148 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 1149 break;
f168b263 1150 case CMD_MIFAREUC_SETPWD:
1151 MifareUSetPwd(c->arg[0], c->d.asBytes);
1152 break;
20f9a2a1
M
1153 case CMD_MIFARE_READSC:
1154 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_WRITEBL:
1157 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1158 break;
4973f23d 1159 //case CMD_MIFAREU_WRITEBL_COMPAT:
1160 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1161 //break;
981bd429 1162 case CMD_MIFAREU_WRITEBL:
4973f23d 1163 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
f168b263 1164 break;
20f9a2a1
M
1165 case CMD_MIFARE_NESTED:
1166 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
1167 break;
1168 case CMD_MIFARE_CHKKEYS:
1169 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
1170 break;
1171 case CMD_SIMULATE_MIFARE_CARD:
1172 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1173 break;
8556b852
M
1174
1175 // emulator
1176 case CMD_MIFARE_SET_DBGMODE:
1177 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1178 break;
1179 case CMD_MIFARE_EML_MEMCLR:
1180 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1181 break;
1182 case CMD_MIFARE_EML_MEMSET:
1183 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1184 break;
1185 case CMD_MIFARE_EML_MEMGET:
1186 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1187 break;
1188 case CMD_MIFARE_EML_CARDLOAD:
1189 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
1190 break;
1191
1192 // Work with "magic Chinese" card
3fe4ff4f 1193 case CMD_MIFARE_CSETBLOCK:
0675f200 1194 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 1195 break;
3fe4ff4f 1196 case CMD_MIFARE_CGETBLOCK:
545a1f38 1197 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 1198 break;
3fe4ff4f 1199 case CMD_MIFARE_CIDENT:
1200 MifareCIdent();
1201 break;
b62a5a84
M
1202
1203 // mifare sniffer
1204 case CMD_MIFARE_SNIFFER:
5cd9ec01 1205 SniffMifare(c->arg[0]);
b62a5a84 1206 break;
a631936e 1207
20f9a2a1
M
1208#endif
1209
7e67e42f 1210#ifdef WITH_ICLASS
cee5a30d 1211 // Makes use of ISO14443a FPGA Firmware
1212 case CMD_SNOOP_ICLASS:
1213 SnoopIClass();
1214 break;
1e262141 1215 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 1216 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 1217 break;
1218 case CMD_READER_ICLASS:
1219 ReaderIClass(c->arg[0]);
1220 break;
c3963755 1221 case CMD_READER_ICLASS_REPLAY:
aa53efc3 1222 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 1223 break;
aa53efc3 1224 case CMD_ICLASS_EML_MEMSET:
e80aeb96
MHS
1225 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1226 break;
aa53efc3 1227 case CMD_ICLASS_WRITEBLOCK:
3ac22ee1 1228 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1229 break;
1230 case CMD_ICLASS_READCHECK: // auth step 1
1231 iClass_ReadCheck(c->arg[0], c->arg[1]);
aa53efc3 1232 break;
1233 case CMD_ICLASS_READBLOCK:
3ac22ee1 1234 iClass_ReadBlk(c->arg[0]);
aa53efc3 1235 break;
3ac22ee1 1236 case CMD_ICLASS_AUTHENTICATION: //check
aa53efc3 1237 iClass_Authentication(c->d.asBytes);
1238 break;
1239 case CMD_ICLASS_DUMP:
3ac22ee1 1240 iClass_Dump(c->arg[0], c->arg[1]);
aa53efc3 1241 break;
1242 case CMD_ICLASS_CLONE:
3ac22ee1 1243 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
aa53efc3 1244 break;
cee5a30d 1245#endif
0472d76d 1246#ifdef WITH_HFSNOOP
1247 case CMD_HF_SNIFFER:
1248 HfSnoop(c->arg[0], c->arg[1]);
1249 break;
1250#endif
cee5a30d 1251
7e67e42f 1252 case CMD_BUFF_CLEAR:
117d9ec2 1253 BigBuf_Clear();
15c4dc5a 1254 break;
15c4dc5a 1255
1256 case CMD_MEASURE_ANTENNA_TUNING:
fdcfbdcc 1257 MeasureAntennaTuning(c->arg[0]);
15c4dc5a 1258 break;
1259
1260 case CMD_MEASURE_ANTENNA_TUNING_HF:
1261 MeasureAntennaTuningHf();
1262 break;
1263
1264 case CMD_LISTEN_READER_FIELD:
1265 ListenReaderField(c->arg[0]);
1266 break;
1267
15c4dc5a 1268 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1269 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1270 SpinDelay(200);
1271 LED_D_OFF(); // LED D indicates field ON or OFF
1272 break;
1273
1c611bbd 1274 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 1275
1c611bbd 1276 LED_B_ON();
117d9ec2 1277 uint8_t *BigBuf = BigBuf_get_addr();
1c611bbd 1278 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1279 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 1280 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 1281 }
1282 // Trigger a finish downloading signal with an ACK frame
3000dc4e 1283 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 1284 LED_B_OFF();
1c611bbd 1285 break;
15c4dc5a 1286
1287 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
117d9ec2 1288 uint8_t *b = BigBuf_get_addr();
3fe4ff4f 1289 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 1290 cmd_send(CMD_ACK,0,0,0,0,0);
1291 break;
1292 }
15c4dc5a 1293 case CMD_READ_MEM:
1294 ReadMem(c->arg[0]);
1295 break;
1296
1297 case CMD_SET_LF_DIVISOR:
7cc204bf 1298 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 1299 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1300 break;
1301
1302 case CMD_SET_ADC_MUX:
1303 switch(c->arg[0]) {
1304 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1305 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1306 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1307 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1308 }
1309 break;
1310
1311 case CMD_VERSION:
1312 SendVersion();
1313 break;
c89274cc 1314 case CMD_STATUS:
67b7d6fa 1315 SendStatus();
c89274cc
CY
1316 break;
1317 case CMD_PING:
1318 cmd_send(CMD_ACK,0,0,0,0,0);
1319 break;
15c4dc5a 1320#ifdef WITH_LCD
1321 case CMD_LCD_RESET:
1322 LCDReset();
1323 break;
1324 case CMD_LCD:
1325 LCDSend(c->arg[0]);
1326 break;
1327#endif
1328 case CMD_SETUP_WRITE:
1329 case CMD_FINISH_WRITE:
1c611bbd 1330 case CMD_HARDWARE_RESET:
1331 usb_disable();
15c4dc5a 1332 SpinDelay(1000);
1333 SpinDelay(1000);
1334 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1335 for(;;) {
1336 // We're going to reset, and the bootrom will take control.
1337 }
1c611bbd 1338 break;
15c4dc5a 1339
1c611bbd 1340 case CMD_START_FLASH:
15c4dc5a 1341 if(common_area.flags.bootrom_present) {
1342 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1343 }
1c611bbd 1344 usb_disable();
15c4dc5a 1345 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1346 for(;;);
1c611bbd 1347 break;
e30c654b 1348
15c4dc5a 1349 case CMD_DEVICE_INFO: {
902cb3c0 1350 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1351 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1352 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1353 break;
1354 }
1355 default:
15c4dc5a 1356 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1357 break;
15c4dc5a 1358 }
1359}
1360
1361void __attribute__((noreturn)) AppMain(void)
1362{
1363 SpinDelay(100);
9e8255d4 1364 clear_trace();
15c4dc5a 1365 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1366 /* Initialize common area */
1367 memset(&common_area, 0, sizeof(common_area));
1368 common_area.magic = COMMON_AREA_MAGIC;
1369 common_area.version = 1;
1370 }
1371 common_area.flags.osimage_present = 1;
1372
1373 LED_D_OFF();
1374 LED_C_OFF();
1375 LED_B_OFF();
1376 LED_A_OFF();
1377
3fe4ff4f 1378 // Init USB device
902cb3c0 1379 usb_enable();
15c4dc5a 1380
1381 // The FPGA gets its clock from us from PCK0 output, so set that up.
1382 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1383 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1384 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1385 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1386 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
0472d76d 1387 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
15c4dc5a 1388 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1389
1390 // Reset SPI
1391 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1392 // Reset SSC
1393 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1394
1395 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1396 // (the HF version by default)
1397 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1398
9ca155ba 1399 StartTickCount();
902cb3c0 1400
15c4dc5a 1401#ifdef WITH_LCD
15c4dc5a 1402 LCDInit();
15c4dc5a 1403#endif
1404
902cb3c0 1405 byte_t rx[sizeof(UsbCommand)];
1406 size_t rx_len;
1407
15c4dc5a 1408 for(;;) {
902cb3c0 1409 if (usb_poll()) {
1410 rx_len = usb_read(rx,sizeof(UsbCommand));
1411 if (rx_len) {
1412 UsbPacketReceived(rx,rx_len);
1413 }
1414 }
15c4dc5a 1415 WDT_HIT();
1416
1417#ifdef WITH_LF
e46fe044 1418#ifndef WITH_ISO14443a_StandAlone
15c4dc5a 1419 if (BUTTON_HELD(1000) > 0)
1420 SamyRun();
e46fe044
CY
1421#endif
1422#endif
1423#ifdef WITH_ISO14443a
1424#ifdef WITH_ISO14443a_StandAlone
1425 if (BUTTON_HELD(1000) > 0)
1426 StandAloneMode14a();
1427#endif
15c4dc5a 1428#endif
1429 }
1430}
Impressum, Datenschutz