]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
FIX: tnp3sim, now can insert keys if the dumpfile is blank. Like the ,,,lander dumps...
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
c3c241f3 13#include "usb_cdc.h"
14#include "cmd.h"
15
16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
22e24700 21
9ab7a6c7 22#include <stdarg.h>
22e24700 23
15c4dc5a 24#include "legicrf.h"
c3c241f3 25#include <hitag2.h>
31abe49f 26#include "lfsampling.h"
3000dc4e 27#include "BigBuf.h"
7838f4be 28#include "mifareutil.h"
36804420 29#include "pcf7931.h"
15c4dc5a 30#ifdef WITH_LCD
902cb3c0 31 #include "LCD.h"
15c4dc5a 32#endif
33
7838f4be 34// Craig Young - 14a stand-alone code
35#ifdef WITH_ISO14443a_StandAlone
36 #include "iso14443a.h"
37#endif
38
15c4dc5a 39#define abs(x) ( ((x)<0) ? -(x) : (x) )
40
41//=============================================================================
42// A buffer where we can queue things up to be sent through the FPGA, for
43// any purpose (fake tag, as reader, whatever). We go MSB first, since that
44// is the order in which they go out on the wire.
45//=============================================================================
46
6a1f2d82 47#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
a501c82b 48uint8_t ToSend[TOSEND_BUFFER_SIZE];
7838f4be 49int ToSendMax = 0;
15c4dc5a 50static int ToSendBit;
51struct common_area common_area __attribute__((section(".commonarea")));
52
15c4dc5a 53void ToSendReset(void)
54{
55 ToSendMax = -1;
56 ToSendBit = 8;
57}
58
59void ToSendStuffBit(int b)
60{
61 if(ToSendBit >= 8) {
62 ToSendMax++;
63 ToSend[ToSendMax] = 0;
64 ToSendBit = 0;
65 }
66
67 if(b) {
68 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
69 }
70
71 ToSendBit++;
72
6a1f2d82 73 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 74 ToSendBit = 0;
75 DbpString("ToSendStuffBit overflowed!");
76 }
77}
78
79//=============================================================================
80// Debug print functions, to go out over USB, to the usual PC-side client.
81//=============================================================================
82
83void DbpString(char *str)
84{
9440213d 85 byte_t len = strlen(str);
86 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 87}
88
89#if 0
90void DbpIntegers(int x1, int x2, int x3)
91{
902cb3c0 92 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 93}
94#endif
95
96void Dbprintf(const char *fmt, ...) {
97// should probably limit size here; oh well, let's just use a big buffer
98 char output_string[128];
99 va_list ap;
100
101 va_start(ap, fmt);
102 kvsprintf(fmt, output_string, 10, ap);
103 va_end(ap);
e30c654b 104
15c4dc5a 105 DbpString(output_string);
106}
107
9455b51c 108// prints HEX & ASCII
d19929cb 109void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 110 int l=0,i;
111 char ascii[9];
d19929cb 112
9455b51c 113 while (len>0) {
114 if (len>8) l=8;
115 else l=len;
116
117 memcpy(ascii,d,l);
d19929cb 118 ascii[l]=0;
9455b51c 119
120 // filter safe ascii
d19929cb 121 for (i=0;i<l;i++)
9455b51c 122 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 123
124 if (bAsci) {
125 Dbprintf("%-8s %*D",ascii,l,d," ");
126 } else {
127 Dbprintf("%*D",l,d," ");
128 }
129
9455b51c 130 len-=8;
131 d+=8;
132 }
133}
134
15c4dc5a 135//-----------------------------------------------------------------------------
136// Read an ADC channel and block till it completes, then return the result
137// in ADC units (0 to 1023). Also a routine to average 32 samples and
138// return that.
139//-----------------------------------------------------------------------------
140static int ReadAdc(int ch)
141{
f7e3ed82 142 uint32_t d;
15c4dc5a 143
144 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
145 AT91C_BASE_ADC->ADC_MR =
3b692427 146 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
147 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
148 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
149
150 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
151 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
152 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
153 //
154 // The maths are:
155 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
156 //
157 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
158 //
159 // Note: with the "historic" values in the comments above, the error was 34% !!!
160
15c4dc5a 161 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
162
163 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
3b692427 164
15c4dc5a 165 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
166 ;
167 d = AT91C_BASE_ADC->ADC_CDR[ch];
168
169 return d;
170}
171
9ca155ba 172int AvgAdc(int ch) // was static - merlok
15c4dc5a 173{
174 int i;
175 int a = 0;
176
177 for(i = 0; i < 32; i++) {
178 a += ReadAdc(ch);
179 }
180
181 return (a + 15) >> 5;
182}
183
184void MeasureAntennaTuning(void)
185{
d3499d36 186 uint8_t LF_Results[256];
9f693930 187 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 188 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
189
7838f4be 190 LED_B_ON();
15c4dc5a 191
192/*
193 * Sweeps the useful LF range of the proxmark from
194 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
195 * read the voltage in the antenna, the result left
196 * in the buffer is a graph which should clearly show
197 * the resonating frequency of your LF antenna
198 * ( hopefully around 95 if it is tuned to 125kHz!)
199 */
d19929cb 200
7cc204bf 201 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 202 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
d3499d36 203 for (i=255; i>=19; i--) {
d19929cb 204 WDT_HIT();
15c4dc5a 205 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
206 SpinDelay(20);
3b692427 207 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
15c4dc5a 208 if (i==95) vLf125 = adcval; // voltage at 125Khz
209 if (i==89) vLf134 = adcval; // voltage at 134Khz
210
d3499d36 211 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
212 if(LF_Results[i] > peak) {
15c4dc5a 213 peakv = adcval;
d3499d36 214 peak = LF_Results[i];
15c4dc5a 215 peakf = i;
9f693930 216 //ptr = i;
15c4dc5a 217 }
218 }
219
d3499d36 220 for (i=18; i >= 0; i--) LF_Results[i] = 0;
221
7838f4be 222 LED_A_ON();
15c4dc5a 223 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7838f4be 224 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 225 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
226 SpinDelay(20);
3b692427 227 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
15c4dc5a 228
3b692427 229 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
d19929cb 230 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
7838f4be 231 LED_A_OFF();
232 LED_B_OFF();
d19929cb 233 return;
15c4dc5a 234}
235
236void MeasureAntennaTuningHf(void)
237{
238 int vHf = 0; // in mV
239
240 DbpString("Measuring HF antenna, press button to exit");
241
3b692427 242 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
243 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
244 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
245
15c4dc5a 246 for (;;) {
15c4dc5a 247 SpinDelay(20);
3b692427 248 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 249
15c4dc5a 250 Dbprintf("%d mV",vHf);
251 if (BUTTON_PRESS()) break;
252 }
253 DbpString("cancelled");
3b692427 254
255 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
256
15c4dc5a 257}
258
259
15c4dc5a 260void ReadMem(int addr)
261{
f7e3ed82 262 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 263
264 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
265 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
266}
267
268/* osimage version information is linked in */
269extern struct version_information version_information;
270/* bootrom version information is pointed to from _bootphase1_version_pointer */
9783989b 271extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
15c4dc5a 272void SendVersion(void)
273{
9783989b 274 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
275 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 276
277 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 278 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
279 * pointer, then use it.
280 */
281 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
282 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
9783989b 283 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 284 } else {
285 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
9783989b 286 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 287 }
e30c654b 288
15c4dc5a 289 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
9783989b 290 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 291
9783989b 292 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
293 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
294 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
295 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
296
297 // Send Chip ID and used flash memory
298 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
299 uint32_t compressed_data_section_size = common_area.arg1;
300 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 301}
f62b5e12 302
303// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
304// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
0de8e387 305void printUSBSpeed(void)
f62b5e12 306{
307 Dbprintf("USB Speed:");
0de8e387 308 Dbprintf(" Sending USB packets to client...");
f62b5e12 309
0de8e387 310 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
f62b5e12 311 uint8_t *test_data = BigBuf_get_addr();
0de8e387 312 uint32_t end_time;
f62b5e12 313
0de8e387 314 uint32_t start_time = end_time = GetTickCount();
315 uint32_t bytes_transferred = 0;
f62b5e12 316
317 LED_B_ON();
0de8e387 318 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
319 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
320 end_time = GetTickCount();
321 bytes_transferred += USB_CMD_DATA_SIZE;
f62b5e12 322 }
323 LED_B_OFF();
324
0de8e387 325 Dbprintf(" Time elapsed: %dms", end_time - start_time);
326 Dbprintf(" Bytes transferred: %d", bytes_transferred);
327 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
328 1000 * bytes_transferred / (end_time - start_time));
f62b5e12 329
330}
331
7838f4be 332/**
333 * Prints runtime information about the PM3.
334**/
0de8e387 335void SendStatus(void)
15c4dc5a 336{
7838f4be 337 BigBuf_print_status();
338 Fpga_print_status();
339 printConfig(); //LF Sampling config
0de8e387 340 printUSBSpeed();
7838f4be 341 Dbprintf("Various");
f62b5e12 342 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
343 Dbprintf(" ToSendMax..........%d", ToSendMax);
344 Dbprintf(" ToSendBit..........%d", ToSendBit);
345 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
346
347 cmd_send(CMD_ACK,1,0,0,0,0);
7838f4be 348}
15c4dc5a 349
7838f4be 350#if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
15c4dc5a 351
7838f4be 352#define OPTS 2
15c4dc5a 353
7838f4be 354void StandAloneMode()
355{
356 DbpString("Stand-alone mode! No PC necessary.");
15c4dc5a 357 // Oooh pretty -- notify user we're in elite samy mode now
358 LED(LED_RED, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_GREEN, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_RED, 200);
363 LED(LED_ORANGE, 200);
364 LED(LED_GREEN, 200);
365 LED(LED_ORANGE, 200);
366 LED(LED_RED, 200);
367
7838f4be 368}
369
370#endif
371
372
373
374#ifdef WITH_ISO14443a_StandAlone
375void StandAloneMode14a()
376{
377 StandAloneMode();
378 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
379
380 int selected = 0;
0db6ed9a 381 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
7838f4be 382 int cardRead[OPTS] = {0};
383 uint8_t readUID[10] = {0};
384 uint32_t uid_1st[OPTS]={0};
385 uint32_t uid_2nd[OPTS]={0};
0db6ed9a 386 uint32_t uid_tmp1 = 0;
387 uint32_t uid_tmp2 = 0;
388 iso14a_card_select_t hi14a_card[OPTS];
7838f4be 389
390 LED(selected + 1, 0);
391
392 for (;;)
393 {
394 usb_poll();
395 WDT_HIT();
7838f4be 396 SpinDelay(300);
397
0db6ed9a 398 if (iGotoRecord == 1 || cardRead[selected] == 0)
7838f4be 399 {
0db6ed9a 400 iGotoRecord = 0;
7838f4be 401 LEDsoff();
402 LED(selected + 1, 0);
403 LED(LED_RED2, 0);
404
405 // record
406 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
7838f4be 407 /* need this delay to prevent catching some weird data */
408 SpinDelay(500);
409 /* Code for reading from 14a tag */
410 uint8_t uid[10] ={0};
411 uint32_t cuid;
412 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
413
414 for ( ; ; )
415 {
416 WDT_HIT();
0db6ed9a 417 if (BUTTON_PRESS()) {
418 if (cardRead[selected]) {
419 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
420 break;
421 }
422 else if (cardRead[(selected+1)%OPTS]) {
423 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
424 selected = (selected+1)%OPTS;
425 break; // playing = 1;
426 }
427 else {
428 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
429 SpinDelay(300);
430 }
431 }
432 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
7838f4be 433 continue;
434 else
435 {
436 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
437 memcpy(readUID,uid,10*sizeof(uint8_t));
0db6ed9a 438 uint8_t *dst = (uint8_t *)&uid_tmp1;
7838f4be 439 // Set UID byte order
440 for (int i=0; i<4; i++)
441 dst[i] = uid[3-i];
0db6ed9a 442 dst = (uint8_t *)&uid_tmp2;
7838f4be 443 for (int i=0; i<4; i++)
444 dst[i] = uid[7-i];
0db6ed9a 445 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
446 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
447 }
448 else {
449 if (uid_tmp2) {
450 Dbprintf("Bank[%d] received a 7-byte UID",selected);
451 uid_1st[selected] = (uid_tmp1)>>8;
452 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
453 }
454 else {
455 Dbprintf("Bank[%d] received a 4-byte UID",selected);
456 uid_1st[selected] = uid_tmp1;
457 uid_2nd[selected] = uid_tmp2;
458 }
7838f4be 459 break;
460 }
461 }
0db6ed9a 462 }
463 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
464 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
7838f4be 465 LEDsoff();
466 LED(LED_GREEN, 200);
467 LED(LED_ORANGE, 200);
468 LED(LED_GREEN, 200);
469 LED(LED_ORANGE, 200);
470
471 LEDsoff();
472 LED(selected + 1, 0);
7838f4be 473
0db6ed9a 474 // Next state is replay:
475 playing = 1;
7838f4be 476
477 cardRead[selected] = 1;
7838f4be 478 }
0db6ed9a 479 /* MF Classic UID clone */
480 else if (iGotoClone==1)
7838f4be 481 {
0db6ed9a 482 iGotoClone=0;
7838f4be 483 LEDsoff();
484 LED(selected + 1, 0);
485 LED(LED_ORANGE, 250);
486
487
488 // record
489 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
490
491 // wait for button to be released
492 while(BUTTON_PRESS())
493 {
494 // Delay cloning until card is in place
495 WDT_HIT();
496 }
497 Dbprintf("Starting clone. [Bank: %u]", selected);
498 // need this delay to prevent catching some weird data
499 SpinDelay(500);
500 // Begin clone function here:
501 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
502 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
503 memcpy(c.d.asBytes, data, 16);
504 SendCommand(&c);
505
506 Block read is similar:
507 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
508 We need to imitate that call with blockNo 0 to set a uid.
509
510 The get and set commands are handled in this file:
511 // Work with "magic Chinese" card
512 case CMD_MIFARE_CSETBLOCK:
513 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
514 break;
515 case CMD_MIFARE_CGETBLOCK:
516 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
7838f4be 517 break;
518
519 mfCSetUID provides example logic for UID set workflow:
520 -Read block0 from card in field with MifareCGetBlock()
521 -Configure new values without replacing reserved bytes
522 memcpy(block0, uid, 4); // Copy UID bytes from byte array
523 // Mifare UID BCC
524 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
525 Bytes 5-7 are reserved SAK and ATQA for mifare classic
526 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
527 */
528 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
529 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
0db6ed9a 530 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
531 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
532 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
533 playing = 1;
534 }
535 else {
7838f4be 536 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
537 memcpy(newBlock0,oldBlock0,16);
538 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
539
540 newBlock0[0] = uid_1st[selected]>>24;
541 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
542 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
543 newBlock0[3] = 0xFF & (uid_1st[selected]);
544 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
545 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
546 MifareCSetBlock(0, 0xFF,0, newBlock0);
0db6ed9a 547 MifareCGetBlock(0x3F, 1, 0, testBlock0);
7838f4be 548 if (memcmp(testBlock0,newBlock0,16)==0)
549 {
550 DbpString("Cloned successfull!");
551 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
7838f4be 552 playing = 0;
0db6ed9a 553 iGotoRecord = 1;
554 selected = (selected + 1) % OPTS;
555 }
556 else {
557 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
558 playing = 1;
559 }
560 }
561 LEDsoff();
562 LED(selected + 1, 0);
7838f4be 563
564 }
565 // Change where to record (or begin playing)
0db6ed9a 566 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
7838f4be 567 {
7838f4be 568 LEDsoff();
569 LED(selected + 1, 0);
570
571 // Begin transmitting
572 if (playing)
573 {
574 LED(LED_GREEN, 0);
575 DbpString("Playing");
0db6ed9a 576 for ( ; ; ) {
577 WDT_HIT();
578 int button_action = BUTTON_HELD(1000);
579 if (button_action == 0) { // No button action, proceed with sim
580 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
581 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
582 num_to_bytes(uid_1st[selected], 3, data);
583 num_to_bytes(uid_2nd[selected], 4, data);
584
7838f4be 585 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
0db6ed9a 586 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
587 DbpString("Mifare Classic");
588 SimulateIso14443aTag(1, flags, data); // Mifare Classic
589 }
590 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
591 DbpString("Mifare Ultralight");
592 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
593 }
594 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
595 DbpString("Mifare DESFire");
596 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
597 }
598 else {
599 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
600 SimulateIso14443aTag(1, flags, data);
601 }
602 }
603 else if (button_action == BUTTON_SINGLE_CLICK) {
604 selected = (selected + 1) % OPTS;
605 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
606 iGotoRecord = 1;
607 break;
608 }
609 else if (button_action == BUTTON_HOLD) {
610 Dbprintf("Playtime over. Begin cloning...");
611 iGotoClone = 1;
612 break;
7838f4be 613 }
0db6ed9a 614 WDT_HIT();
615 }
7838f4be 616
617 /* We pressed a button so ignore it here with a delay */
618 SpinDelay(300);
7838f4be 619 LEDsoff();
620 LED(selected + 1, 0);
621 }
622 else
623 while(BUTTON_PRESS())
624 WDT_HIT();
625 }
626 }
627}
628#elif WITH_LF
629// samy's sniff and repeat routine
630void SamyRun()
631{
632 StandAloneMode();
633 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
634
635 int high[OPTS], low[OPTS];
15c4dc5a 636 int selected = 0;
637 int playing = 0;
72e930ef 638 int cardRead = 0;
15c4dc5a 639
640 // Turn on selected LED
641 LED(selected + 1, 0);
642
643 for (;;)
644 {
6e82300d 645 usb_poll();
95e63594 646 WDT_HIT();
15c4dc5a 647
648 // Was our button held down or pressed?
649 int button_pressed = BUTTON_HELD(1000);
650 SpinDelay(300);
651
652 // Button was held for a second, begin recording
72e930ef 653 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 654 {
655 LEDsoff();
656 LED(selected + 1, 0);
657 LED(LED_RED2, 0);
658
659 // record
660 DbpString("Starting recording");
661
662 // wait for button to be released
663 while(BUTTON_PRESS())
664 WDT_HIT();
665
666 /* need this delay to prevent catching some weird data */
667 SpinDelay(500);
668
669 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
670 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
671
672 LEDsoff();
673 LED(selected + 1, 0);
674 // Finished recording
675
676 // If we were previously playing, set playing off
677 // so next button push begins playing what we recorded
678 playing = 0;
72e930ef 679
680 cardRead = 1;
681
682 }
683
684 else if (button_pressed > 0 && cardRead == 1)
685 {
686 LEDsoff();
687 LED(selected + 1, 0);
688 LED(LED_ORANGE, 0);
689
690 // record
691 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
692
693 // wait for button to be released
694 while(BUTTON_PRESS())
695 WDT_HIT();
696
697 /* need this delay to prevent catching some weird data */
698 SpinDelay(500);
699
700 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
701 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
702
703 LEDsoff();
704 LED(selected + 1, 0);
705 // Finished recording
706
707 // If we were previously playing, set playing off
708 // so next button push begins playing what we recorded
709 playing = 0;
710
711 cardRead = 0;
712
15c4dc5a 713 }
714
715 // Change where to record (or begin playing)
716 else if (button_pressed)
717 {
718 // Next option if we were previously playing
719 if (playing)
720 selected = (selected + 1) % OPTS;
721 playing = !playing;
722
723 LEDsoff();
724 LED(selected + 1, 0);
725
726 // Begin transmitting
727 if (playing)
728 {
729 LED(LED_GREEN, 0);
730 DbpString("Playing");
731 // wait for button to be released
732 while(BUTTON_PRESS())
733 WDT_HIT();
734 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
735 CmdHIDsimTAG(high[selected], low[selected], 0);
736 DbpString("Done playing");
737 if (BUTTON_HELD(1000) > 0)
738 {
739 DbpString("Exiting");
740 LEDsoff();
741 return;
742 }
743
744 /* We pressed a button so ignore it here with a delay */
745 SpinDelay(300);
746
747 // when done, we're done playing, move to next option
748 selected = (selected + 1) % OPTS;
749 playing = !playing;
750 LEDsoff();
751 LED(selected + 1, 0);
752 }
753 else
754 while(BUTTON_PRESS())
755 WDT_HIT();
756 }
757 }
758}
15c4dc5a 759
7838f4be 760#endif
15c4dc5a 761/*
762OBJECTIVE
763Listen and detect an external reader. Determine the best location
764for the antenna.
765
766INSTRUCTIONS:
767Inside the ListenReaderField() function, there is two mode.
768By default, when you call the function, you will enter mode 1.
769If you press the PM3 button one time, you will enter mode 2.
770If you press the PM3 button a second time, you will exit the function.
771
772DESCRIPTION OF MODE 1:
773This mode just listens for an external reader field and lights up green
774for HF and/or red for LF. This is the original mode of the detectreader
775function.
776
777DESCRIPTION OF MODE 2:
778This mode will visually represent, using the LEDs, the actual strength of the
779current compared to the maximum current detected. Basically, once you know
780what kind of external reader is present, it will help you spot the best location to place
781your antenna. You will probably not get some good results if there is a LF and a HF reader
782at the same place! :-)
783
784LIGHT SCHEME USED:
785*/
786static const char LIGHT_SCHEME[] = {
787 0x0, /* ---- | No field detected */
788 0x1, /* X--- | 14% of maximum current detected */
789 0x2, /* -X-- | 29% of maximum current detected */
790 0x4, /* --X- | 43% of maximum current detected */
791 0x8, /* ---X | 57% of maximum current detected */
792 0xC, /* --XX | 71% of maximum current detected */
793 0xE, /* -XXX | 86% of maximum current detected */
794 0xF, /* XXXX | 100% of maximum current detected */
795};
796static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
797
798void ListenReaderField(int limit)
799{
3b692427 800 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
801 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
15c4dc5a 802 int mode=1, display_val, display_max, i;
803
3b692427 804#define LF_ONLY 1
805#define HF_ONLY 2
806#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
807
808
809 // switch off FPGA - we don't want to measure our own signal
810 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
811 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 812
813 LEDsoff();
814
3b692427 815 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 816
817 if(limit != HF_ONLY) {
3b692427 818 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 819 lf_baseline = lf_av;
820 }
821
3b692427 822 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 823
824 if (limit != LF_ONLY) {
3b692427 825 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 826 hf_baseline = hf_av;
827 }
828
829 for(;;) {
830 if (BUTTON_PRESS()) {
831 SpinDelay(500);
832 switch (mode) {
833 case 1:
834 mode=2;
835 DbpString("Signal Strength Mode");
836 break;
837 case 2:
838 default:
839 DbpString("Stopped");
840 LEDsoff();
841 return;
842 break;
843 }
844 }
845 WDT_HIT();
846
847 if (limit != HF_ONLY) {
3b692427 848 if(mode == 1) {
849 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
850 LED_D_ON();
851 else
852 LED_D_OFF();
15c4dc5a 853 }
e30c654b 854
3b692427 855 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 856 // see if there's a significant change
3b692427 857 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
858 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 859 lf_av = lf_av_new;
860 if (lf_av > lf_max)
861 lf_max = lf_av;
15c4dc5a 862 }
863 }
864
865 if (limit != LF_ONLY) {
866 if (mode == 1){
3b692427 867 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
868 LED_B_ON();
869 else
870 LED_B_OFF();
15c4dc5a 871 }
e30c654b 872
3b692427 873 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 874 // see if there's a significant change
3b692427 875 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
876 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 877 hf_av = hf_av_new;
878 if (hf_av > hf_max)
879 hf_max = hf_av;
15c4dc5a 880 }
881 }
e30c654b 882
15c4dc5a 883 if(mode == 2) {
884 if (limit == LF_ONLY) {
885 display_val = lf_av;
886 display_max = lf_max;
887 } else if (limit == HF_ONLY) {
888 display_val = hf_av;
889 display_max = hf_max;
890 } else { /* Pick one at random */
891 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
892 display_val = hf_av;
893 display_max = hf_max;
894 } else {
895 display_val = lf_av;
896 display_max = lf_max;
897 }
898 }
899 for (i=0; i<LIGHT_LEN; i++) {
900 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
901 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
902 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
903 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
904 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
905 break;
906 }
907 }
908 }
909 }
910}
911
f7e3ed82 912void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 913{
914 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 915
313ee67e 916 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
902cb3c0 917
15c4dc5a 918 switch(c->cmd) {
919#ifdef WITH_LF
31abe49f
MHS
920 case CMD_SET_LF_SAMPLING_CONFIG:
921 setSamplingConfig((sample_config *) c->d.asBytes);
922 break;
15c4dc5a 923 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1fbf8956 924 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
15c4dc5a 925 break;
15c4dc5a 926 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
927 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
928 break;
b014c96d 929 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 930 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 931 break;
7e67e42f 932 case CMD_HID_DEMOD_FSK:
a501c82b 933 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 934 break;
935 case CMD_HID_SIM_TAG:
a501c82b 936 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 937 break;
abd6112f 938 case CMD_FSK_SIM_TAG:
939 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
940 break;
941 case CMD_ASK_SIM_TAG:
942 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
943 break;
872e3d4d 944 case CMD_PSK_SIM_TAG:
945 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
946 break;
a501c82b 947 case CMD_HID_CLONE_TAG:
1c611bbd 948 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 949 break;
a1f3bb12 950 case CMD_IO_DEMOD_FSK:
a501c82b 951 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 952 break;
a501c82b 953 case CMD_IO_CLONE_TAG:
a1f3bb12 954 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
955 break;
6ff6ade2 956 case CMD_EM410X_DEMOD:
957 CmdEM410xdemod(c->arg[0], 0, 0, 1);
958 break;
2d4eae76 959 case CMD_EM410X_WRITE_TAG:
960 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
961 break;
7e67e42f 962 case CMD_READ_TI_TYPE:
963 ReadTItag();
964 break;
965 case CMD_WRITE_TI_TYPE:
966 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
967 break;
968 case CMD_SIMULATE_TAG_125K:
74daee24 969 LED_A_ON();
970 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
971 LED_A_OFF();
7e67e42f 972 break;
973 case CMD_LF_SIMULATE_BIDIR:
974 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
975 break;
a501c82b 976 case CMD_INDALA_CLONE_TAG:
2414f978 977 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
978 break;
a501c82b 979 case CMD_INDALA_CLONE_TAG_L:
2414f978 980 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
981 break;
1c611bbd 982 case CMD_T55XX_READ_BLOCK:
983 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
984 break;
985 case CMD_T55XX_WRITE_BLOCK:
986 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
987 break;
a501c82b 988 case CMD_T55XX_READ_TRACE:
1c611bbd 989 T55xxReadTrace();
990 break;
a501c82b 991 case CMD_PCF7931_READ:
1c611bbd 992 ReadPCF7931();
1c611bbd 993 break;
e98572a1 994 case CMD_PCF7931_WRITE:
ac2df346 995 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
e98572a1 996 break;
1c611bbd 997 case CMD_EM4X_READ_WORD:
998 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
999 break;
1000 case CMD_EM4X_WRITE_WORD:
1001 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1002 break;
db25599d 1003 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1004 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1005 break;
0de8e387 1006 case CMD_VIKING_CLONE_TAG:
1007 CopyViKingtoT55x7(c->arg[0],c->arg[1]);
1008 break;
1009
1010
15c4dc5a 1011#endif
1012
d19929cb 1013#ifdef WITH_HITAG
1014 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1015 SnoopHitag(c->arg[0]);
1016 break;
1017 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1018 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1019 break;
1020 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1021 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1022 break;
1023#endif
f168b263 1024
15c4dc5a 1025#ifdef WITH_ISO15693
1026 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1027 AcquireRawAdcSamplesIso15693();
1028 break;
9455b51c 1029 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1030 RecordRawAdcSamplesIso15693();
1031 break;
1032
1033 case CMD_ISO_15693_COMMAND:
1034 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1035 break;
1036
1037 case CMD_ISO_15693_FIND_AFI:
1038 BruteforceIso15693Afi(c->arg[0]);
1039 break;
1040
1041 case CMD_ISO_15693_DEBUG:
1042 SetDebugIso15693(c->arg[0]);
1043 break;
15c4dc5a 1044
15c4dc5a 1045 case CMD_READER_ISO_15693:
1046 ReaderIso15693(c->arg[0]);
1047 break;
7e67e42f 1048 case CMD_SIMTAG_ISO_15693:
3649b640 1049 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 1050 break;
15c4dc5a 1051#endif
1052
7e67e42f 1053#ifdef WITH_LEGICRF
1054 case CMD_SIMULATE_TAG_LEGIC_RF:
1055 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1056 break;
3612a8a8 1057
7e67e42f 1058 case CMD_WRITER_LEGIC_RF:
1059 LegicRfWriter(c->arg[1], c->arg[0]);
1060 break;
3612a8a8 1061
15c4dc5a 1062 case CMD_READER_LEGIC_RF:
1063 LegicRfReader(c->arg[0], c->arg[1]);
1064 break;
15c4dc5a 1065#endif
1066
1067#ifdef WITH_ISO14443b
15c4dc5a 1068 case CMD_READ_SRI512_TAG:
abb21530 1069 ReadSTMemoryIso14443b(0x0F);
15c4dc5a 1070 break;
7e67e42f 1071 case CMD_READ_SRIX4K_TAG:
abb21530 1072 ReadSTMemoryIso14443b(0x7F);
7e67e42f 1073 break;
22e24700 1074 case CMD_SNOOP_ISO_14443B:
abb21530 1075 SnoopIso14443b();
7e67e42f 1076 break;
22e24700 1077 case CMD_SIMULATE_TAG_ISO_14443B:
abb21530 1078 SimulateIso14443bTag();
7e67e42f 1079 break;
7cf3ef20 1080 case CMD_ISO_14443B_COMMAND:
1081 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1082 break;
15c4dc5a 1083#endif
1084
1085#ifdef WITH_ISO14443a
7e67e42f 1086 case CMD_SNOOP_ISO_14443a:
4d2e4eea 1087 SniffIso14443a(c->arg[0]);
7e67e42f 1088 break;
15c4dc5a 1089 case CMD_READER_ISO_14443a:
902cb3c0 1090 ReaderIso14443a(c);
15c4dc5a 1091 break;
7e67e42f 1092 case CMD_SIMULATE_TAG_ISO_14443a:
0db6ed9a 1093 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 1094 break;
95e63594 1095
5acd09bd 1096 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 1097 EPA_PACE_Collect_Nonce(c);
5acd09bd 1098 break;
d0f3338e 1099 case CMD_EPA_PACE_REPLAY:
1100 EPA_PACE_Replay(c);
1101 break;
7e67e42f 1102
15c4dc5a 1103 case CMD_READER_MIFARE:
1c611bbd 1104 ReaderMifare(c->arg[0]);
15c4dc5a 1105 break;
20f9a2a1
M
1106 case CMD_MIFARE_READBL:
1107 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1108 break;
981bd429 1109 case CMD_MIFAREU_READBL:
aa60d156 1110 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 1111 break;
4d2e4eea 1112 case CMD_MIFAREUC_AUTH:
1113 MifareUC_Auth(c->arg[0],c->d.asBytes);
f38a1528 1114 break;
981bd429 1115 case CMD_MIFAREU_READCARD:
74daee24 1116 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 1117 break;
aa60d156 1118 case CMD_MIFAREUC_SETPWD:
1119 MifareUSetPwd(c->arg[0], c->d.asBytes);
117d9ec2 1120 break;
20f9a2a1
M
1121 case CMD_MIFARE_READSC:
1122 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1123 break;
1124 case CMD_MIFARE_WRITEBL:
1125 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1126 break;
95aeb706 1127 //case CMD_MIFAREU_WRITEBL_COMPAT:
1128 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1129 //break;
981bd429 1130 case CMD_MIFAREU_WRITEBL:
95aeb706 1131 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
aa60d156 1132 break;
20f9a2a1
M
1133 case CMD_MIFARE_NESTED:
1134 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
1135 break;
1136 case CMD_MIFARE_CHKKEYS:
1137 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
1138 break;
1139 case CMD_SIMULATE_MIFARE_CARD:
1140 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1141 break;
8556b852
M
1142
1143 // emulator
1144 case CMD_MIFARE_SET_DBGMODE:
1145 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1146 break;
1147 case CMD_MIFARE_EML_MEMCLR:
1148 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1149 break;
1150 case CMD_MIFARE_EML_MEMSET:
1151 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1152 break;
1153 case CMD_MIFARE_EML_MEMGET:
1154 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_EML_CARDLOAD:
1157 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
1158 break;
1159
1160 // Work with "magic Chinese" card
d52e4e88 1161 case CMD_MIFARE_CSETBLOCK:
0675f200 1162 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 1163 break;
d52e4e88 1164 case CMD_MIFARE_CGETBLOCK:
545a1f38 1165 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 1166 break;
d52e4e88 1167 case CMD_MIFARE_CIDENT:
1168 MifareCIdent();
1169 break;
b62a5a84
M
1170
1171 // mifare sniffer
1172 case CMD_MIFARE_SNIFFER:
5cd9ec01 1173 SniffMifare(c->arg[0]);
b62a5a84 1174 break;
313ee67e 1175
aa60d156 1176 //mifare desfire
1177 case CMD_MIFARE_DESFIRE_READBL: break;
1178 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1179 case CMD_MIFARE_DESFIRE_AUTH1:
1180 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1181 break;
1182 case CMD_MIFARE_DESFIRE_AUTH2:
1183 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1184 break;
1185 case CMD_MIFARE_DES_READER:
1186 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1187 break;
1188 case CMD_MIFARE_DESFIRE_INFO:
1189 MifareDesfireGetInformation();
1190 break;
1191 case CMD_MIFARE_DESFIRE:
1192 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1193 break;
1194
add0504d 1195 case CMD_MIFARE_COLLECT_NONCES:
76984409 1196 MifareCollectNonces(c->arg[0], c->arg[1]);
add0504d 1197 break;
20f9a2a1
M
1198#endif
1199
7e67e42f 1200#ifdef WITH_ICLASS
cee5a30d 1201 // Makes use of ISO14443a FPGA Firmware
1202 case CMD_SNOOP_ICLASS:
1203 SnoopIClass();
1204 break;
1e262141 1205 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 1206 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 1207 break;
1208 case CMD_READER_ICLASS:
1209 ReaderIClass(c->arg[0]);
1210 break;
f38a1528 1211 case CMD_READER_ICLASS_REPLAY:
f62b5e12 1212 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
f38a1528 1213 break;
e80aeb96
MHS
1214 case CMD_ICLASS_EML_MEMSET:
1215 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1216 break;
e98572a1 1217 case CMD_ICLASS_WRITEBLOCK:
1218 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1219 break;
1220 case CMD_ICLASS_READCHECK: // auth step 1
1221 iClass_ReadCheck(c->arg[0], c->arg[1]);
1222 break;
1223 case CMD_ICLASS_READBLOCK:
1224 iClass_ReadBlk(c->arg[0]);
1225 break;
1226 case CMD_ICLASS_AUTHENTICATION: //check
1227 iClass_Authentication(c->d.asBytes);
1228 break;
1229 case CMD_ICLASS_DUMP:
1230 iClass_Dump(c->arg[0], c->arg[1]);
1231 break;
1232 case CMD_ICLASS_CLONE:
1233 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1234 break;
cee5a30d 1235#endif
1236
7e67e42f 1237 case CMD_BUFF_CLEAR:
117d9ec2 1238 BigBuf_Clear();
15c4dc5a 1239 break;
15c4dc5a 1240
1241 case CMD_MEASURE_ANTENNA_TUNING:
1242 MeasureAntennaTuning();
1243 break;
1244
1245 case CMD_MEASURE_ANTENNA_TUNING_HF:
1246 MeasureAntennaTuningHf();
1247 break;
1248
1249 case CMD_LISTEN_READER_FIELD:
1250 ListenReaderField(c->arg[0]);
1251 break;
1252
15c4dc5a 1253 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1255 SpinDelay(200);
1256 LED_D_OFF(); // LED D indicates field ON or OFF
1257 break;
1258
1c611bbd 1259 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 1260
1c611bbd 1261 LED_B_ON();
117d9ec2 1262 uint8_t *BigBuf = BigBuf_get_addr();
0de8e387 1263 size_t len = 0;
1c611bbd 1264 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
0de8e387 1265 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 1266 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 1267 }
1268 // Trigger a finish downloading signal with an ACK frame
3000dc4e 1269 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 1270 LED_B_OFF();
1c611bbd 1271 break;
15c4dc5a 1272
1273 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
117d9ec2 1274 uint8_t *b = BigBuf_get_addr();
7c756d68 1275 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 1276 cmd_send(CMD_ACK,0,0,0,0,0);
1277 break;
1278 }
15c4dc5a 1279 case CMD_READ_MEM:
1280 ReadMem(c->arg[0]);
1281 break;
1282
1283 case CMD_SET_LF_DIVISOR:
7cc204bf 1284 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 1285 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1286 break;
1287
1288 case CMD_SET_ADC_MUX:
1289 switch(c->arg[0]) {
1290 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1291 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1292 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1293 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1294 }
1295 break;
1296
1297 case CMD_VERSION:
1298 SendVersion();
1299 break;
7838f4be 1300 case CMD_STATUS:
0de8e387 1301 SendStatus();
7838f4be 1302 break;
1303 case CMD_PING:
1304 cmd_send(CMD_ACK,0,0,0,0,0);
1305 break;
15c4dc5a 1306#ifdef WITH_LCD
1307 case CMD_LCD_RESET:
1308 LCDReset();
1309 break;
1310 case CMD_LCD:
1311 LCDSend(c->arg[0]);
1312 break;
1313#endif
1314 case CMD_SETUP_WRITE:
1315 case CMD_FINISH_WRITE:
1c611bbd 1316 case CMD_HARDWARE_RESET:
1317 usb_disable();
f62b5e12 1318 SpinDelay(2000);
15c4dc5a 1319 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1320 for(;;) {
1321 // We're going to reset, and the bootrom will take control.
1322 }
1c611bbd 1323 break;
15c4dc5a 1324
1c611bbd 1325 case CMD_START_FLASH:
15c4dc5a 1326 if(common_area.flags.bootrom_present) {
1327 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1328 }
1c611bbd 1329 usb_disable();
15c4dc5a 1330 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1331 for(;;);
1c611bbd 1332 break;
e30c654b 1333
15c4dc5a 1334 case CMD_DEVICE_INFO: {
902cb3c0 1335 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1336 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1337 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1338 break;
1339 }
1340 default:
15c4dc5a 1341 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1342 break;
15c4dc5a 1343 }
1344}
1345
1346void __attribute__((noreturn)) AppMain(void)
1347{
1348 SpinDelay(100);
9e8255d4 1349 clear_trace();
15c4dc5a 1350 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1351 /* Initialize common area */
1352 memset(&common_area, 0, sizeof(common_area));
1353 common_area.magic = COMMON_AREA_MAGIC;
1354 common_area.version = 1;
1355 }
1356 common_area.flags.osimage_present = 1;
1357
1358 LED_D_OFF();
1359 LED_C_OFF();
1360 LED_B_OFF();
1361 LED_A_OFF();
1362
b44e5233 1363 // Init USB device
313ee67e 1364 usb_enable();
15c4dc5a 1365
1366 // The FPGA gets its clock from us from PCK0 output, so set that up.
1367 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1368 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1369 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1370 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1371 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1372 AT91C_PMC_PRES_CLK_4;
1373 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1374
1375 // Reset SPI
1376 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1377 // Reset SSC
1378 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1379
1380 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1381 // (the HF version by default)
1382 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1383
9ca155ba 1384 StartTickCount();
902cb3c0 1385
15c4dc5a 1386#ifdef WITH_LCD
15c4dc5a 1387 LCDInit();
15c4dc5a 1388#endif
1389
f62b5e12 1390 byte_t rx[sizeof(UsbCommand)];
902cb3c0 1391 size_t rx_len;
1392
15c4dc5a 1393 for(;;) {
313ee67e 1394 if (usb_poll()) {
1395 rx_len = usb_read(rx,sizeof(UsbCommand));
1396 if (rx_len) {
1397 UsbPacketReceived(rx,rx_len);
1398 }
1399 }
15c4dc5a 1400 WDT_HIT();
1401
1402#ifdef WITH_LF
7838f4be 1403#ifndef WITH_ISO14443a_StandAlone
15c4dc5a 1404 if (BUTTON_HELD(1000) > 0)
1405 SamyRun();
7838f4be 1406#endif
1407#endif
1408#ifdef WITH_ISO14443a
1409#ifdef WITH_ISO14443a_StandAlone
1410 if (BUTTON_HELD(1000) > 0)
1411 StandAloneMode14a();
1412#endif
15c4dc5a 1413#endif
1414 }
1415}
Impressum, Datenschutz