]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
syntax sugar
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
57778a46 12#include <stdarg.h>
c3c241f3 13#include "usb_cdc.h"
c3c241f3 14#include "proxmark3.h"
15c4dc5a 15#include "apps.h"
f7e3ed82 16#include "util.h"
9ab7a6c7 17#include "printf.h"
18#include "string.h"
15c4dc5a 19#include "legicrf.h"
31abe49f 20#include "lfsampling.h"
3000dc4e 21#include "BigBuf.h"
7838f4be 22#include "mifareutil.h"
f2c2b174 23
15c4dc5a 24#ifdef WITH_LCD
902cb3c0 25 #include "LCD.h"
15c4dc5a 26#endif
27
7838f4be 28// Craig Young - 14a stand-alone code
29#ifdef WITH_ISO14443a_StandAlone
30 #include "iso14443a.h"
c2731f37 31 #include "protocols.h"
7838f4be 32#endif
33
15c4dc5a 34//=============================================================================
35// A buffer where we can queue things up to be sent through the FPGA, for
36// any purpose (fake tag, as reader, whatever). We go MSB first, since that
37// is the order in which they go out on the wire.
38//=============================================================================
39
6a1f2d82 40#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
a501c82b 41uint8_t ToSend[TOSEND_BUFFER_SIZE];
7838f4be 42int ToSendMax = 0;
15c4dc5a 43static int ToSendBit;
44struct common_area common_area __attribute__((section(".commonarea")));
45
15c4dc5a 46void ToSendReset(void)
47{
48 ToSendMax = -1;
49 ToSendBit = 8;
50}
51
da198be4 52void ToSendStuffBit(int b) {
15c4dc5a 53 if(ToSendBit >= 8) {
da198be4 54 ++ToSendMax;
15c4dc5a 55 ToSend[ToSendMax] = 0;
56 ToSendBit = 0;
57 }
58
da198be4 59 if(b)
15c4dc5a 60 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
15c4dc5a 61
da198be4 62 ++ToSendBit;
15c4dc5a 63
6a1f2d82 64 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 65 ToSendBit = 0;
66 DbpString("ToSendStuffBit overflowed!");
67 }
68}
69
dccddaef 70void PrintToSendBuffer(void){
71 DbpString("Printing ToSendBuffer:");
72 Dbhexdump(ToSendMax, ToSend, 0);
73}
74
53d5dc64 75void print_result(char *name, uint8_t *buf, size_t len) {
76 uint8_t *p = buf;
77
78 if ( len % 16 == 0 ) {
79 for(; p-buf < len; p += 16)
80 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
81 name,
82 p-buf,
83 len,
84 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7],p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]
85 );
86 }
87 else {
88 for(; p-buf < len; p += 8)
89 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x",
90 name,
91 p-buf,
92 len,
93 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
94 }
95}
96
15c4dc5a 97//=============================================================================
98// Debug print functions, to go out over USB, to the usual PC-side client.
99//=============================================================================
100
38e41917 101void DbpStringEx(char *str, uint32_t cmd){
102 byte_t len = strlen(str);
103 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
104}
105
da198be4 106void DbpString(char *str) {
38e41917 107 DbpStringEx(str, 0);
15c4dc5a 108}
109
110#if 0
da198be4 111void DbpIntegers(int x1, int x2, int x3) {
38e41917 112 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 113}
114#endif
38e41917 115void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
116 // should probably limit size here; oh well, let's just use a big buffer
117 char output_string[128] = {0x00};
118 va_list ap;
119
120 va_start(ap, fmt);
121 kvsprintf(fmt, output_string, 10, ap);
122 va_end(ap);
123
124 DbpStringEx(output_string, cmd);
125}
15c4dc5a 126
127void Dbprintf(const char *fmt, ...) {
da198be4 128 // should probably limit size here; oh well, let's just use a big buffer
129 char output_string[128] = {0x00};
15c4dc5a 130 va_list ap;
131
132 va_start(ap, fmt);
133 kvsprintf(fmt, output_string, 10, ap);
134 va_end(ap);
e30c654b 135
15c4dc5a 136 DbpString(output_string);
137}
138
9455b51c 139// prints HEX & ASCII
d19929cb 140void Dbhexdump(int len, uint8_t *d, bool bAsci) {
da198be4 141 int l=0, i;
9455b51c 142 char ascii[9];
d19929cb 143
9455b51c 144 while (len>0) {
da198be4 145
146 l = (len>8) ? 8 : len;
9455b51c 147
148 memcpy(ascii,d,l);
d19929cb 149 ascii[l]=0;
9455b51c 150
151 // filter safe ascii
da198be4 152 for (i=0; i<l; ++i)
9455b51c 153 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 154
da198be4 155 if (bAsci)
d19929cb 156 Dbprintf("%-8s %*D",ascii,l,d," ");
da198be4 157 else
d19929cb 158 Dbprintf("%*D",l,d," ");
d19929cb 159
da198be4 160 len -= 8;
161 d += 8;
9455b51c 162 }
163}
164
15c4dc5a 165//-----------------------------------------------------------------------------
166// Read an ADC channel and block till it completes, then return the result
167// in ADC units (0 to 1023). Also a routine to average 32 samples and
168// return that.
169//-----------------------------------------------------------------------------
170static int ReadAdc(int ch)
171{
f7e3ed82 172 uint32_t d;
15c4dc5a 173
174 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
175 AT91C_BASE_ADC->ADC_MR =
3b692427 176 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
177 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
178 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
179
180 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
181 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
182 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
183 //
184 // The maths are:
185 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
186 //
187 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
188 //
189 // Note: with the "historic" values in the comments above, the error was 34% !!!
190
15c4dc5a 191 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
192
193 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
3b692427 194
da198be4 195 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
196
15c4dc5a 197 d = AT91C_BASE_ADC->ADC_CDR[ch];
15c4dc5a 198 return d;
199}
200
9ca155ba 201int AvgAdc(int ch) // was static - merlok
15c4dc5a 202{
b069fb8b 203 int i, a = 0;
da198be4 204 for(i = 0; i < 32; ++i)
15c4dc5a 205 a += ReadAdc(ch);
15c4dc5a 206
207 return (a + 15) >> 5;
208}
209
f121b478 210
da198be4 211void MeasureAntennaTuning(void) {
15c4dc5a 212
2deea574 213 uint8_t LF_Results[256];
f121b478 214 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0;
215 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
2deea574 216
217 memset(LF_Results, 0, sizeof(LF_Results));
7838f4be 218 LED_B_ON();
15c4dc5a 219
220/*
221 * Sweeps the useful LF range of the proxmark from
222 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
223 * read the voltage in the antenna, the result left
224 * in the buffer is a graph which should clearly show
225 * the resonating frequency of your LF antenna
226 * ( hopefully around 95 if it is tuned to 125kHz!)
227 */
d19929cb 228
7cc204bf 229 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 230 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2deea574 231
f121b478 232 for (i = 255; i >= 19; i--) {
da198be4 233 WDT_HIT();
15c4dc5a 234 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
235 SpinDelay(20);
3b692427 236 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
15c4dc5a 237 if (i==95) vLf125 = adcval; // voltage at 125Khz
238 if (i==89) vLf134 = adcval; // voltage at 134Khz
239
153a4a78 240 LF_Results[i] = adcval >> 8; // scale int to fit in byte for graphing purposes
d3499d36 241 if(LF_Results[i] > peak) {
15c4dc5a 242 peakv = adcval;
d3499d36 243 peak = LF_Results[i];
15c4dc5a 244 peakf = i;
15c4dc5a 245 }
246 }
247
7838f4be 248 LED_A_ON();
15c4dc5a 249 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7838f4be 250 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 251 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
252 SpinDelay(20);
3b692427 253 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
15c4dc5a 254
153a4a78 255 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134 << 16), vHf, peakf | (peakv << 16), LF_Results, 256);
d19929cb 256 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
da198be4 257 LEDsoff();
15c4dc5a 258}
259
da198be4 260void MeasureAntennaTuningHf(void) {
15c4dc5a 261 int vHf = 0; // in mV
3b692427 262 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
263 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
264 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
265
38e41917 266 while ( !BUTTON_PRESS() ){
15c4dc5a 267 SpinDelay(20);
3b692427 268 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
38e41917 269 //Dbprintf("%d mV",vHf);
270 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
15c4dc5a 271 }
3b692427 272 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
38e41917 273 DbpString("cancelled");
15c4dc5a 274}
275
276
da198be4 277void ReadMem(int addr) {
f7e3ed82 278 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 279
280 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
281 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
282}
283
284/* osimage version information is linked in */
285extern struct version_information version_information;
286/* bootrom version information is pointed to from _bootphase1_version_pointer */
9783989b 287extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
15c4dc5a 288void SendVersion(void)
289{
9783989b 290 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
291 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 292
293 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 294 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
295 * pointer, then use it.
296 */
297 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
da198be4 298
15c4dc5a 299 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
9783989b 300 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 301 } else {
302 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
9783989b 303 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 304 }
e30c654b 305
15c4dc5a 306 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
9783989b 307 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 308
9783989b 309 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
da198be4 311
9783989b 312 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
313 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
314
315 // Send Chip ID and used flash memory
316 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
317 uint32_t compressed_data_section_size = common_area.arg1;
318 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 319}
f62b5e12 320
321// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
322// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
0de8e387 323void printUSBSpeed(void)
f62b5e12 324{
325 Dbprintf("USB Speed:");
0de8e387 326 Dbprintf(" Sending USB packets to client...");
f62b5e12 327
0de8e387 328 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
f62b5e12 329 uint8_t *test_data = BigBuf_get_addr();
0de8e387 330 uint32_t end_time;
f62b5e12 331
0de8e387 332 uint32_t start_time = end_time = GetTickCount();
333 uint32_t bytes_transferred = 0;
f62b5e12 334
335 LED_B_ON();
0de8e387 336 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
337 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
338 end_time = GetTickCount();
339 bytes_transferred += USB_CMD_DATA_SIZE;
f62b5e12 340 }
341 LED_B_OFF();
342
0de8e387 343 Dbprintf(" Time elapsed: %dms", end_time - start_time);
344 Dbprintf(" Bytes transferred: %d", bytes_transferred);
345 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
346 1000 * bytes_transferred / (end_time - start_time));
f62b5e12 347
348}
349
7838f4be 350/**
351 * Prints runtime information about the PM3.
352**/
da198be4 353void SendStatus(void) {
7838f4be 354 BigBuf_print_status();
355 Fpga_print_status();
356 printConfig(); //LF Sampling config
0de8e387 357 printUSBSpeed();
7838f4be 358 Dbprintf("Various");
f62b5e12 359 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
360 Dbprintf(" ToSendMax..........%d", ToSendMax);
361 Dbprintf(" ToSendBit..........%d", ToSendBit);
362 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
363
364 cmd_send(CMD_ACK,1,0,0,0,0);
7838f4be 365}
15c4dc5a 366
7838f4be 367#if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
15c4dc5a 368
7838f4be 369#define OPTS 2
7838f4be 370void StandAloneMode()
371{
372 DbpString("Stand-alone mode! No PC necessary.");
15c4dc5a 373 // Oooh pretty -- notify user we're in elite samy mode now
374 LED(LED_RED, 200);
375 LED(LED_ORANGE, 200);
376 LED(LED_GREEN, 200);
377 LED(LED_ORANGE, 200);
378 LED(LED_RED, 200);
379 LED(LED_ORANGE, 200);
380 LED(LED_GREEN, 200);
381 LED(LED_ORANGE, 200);
382 LED(LED_RED, 200);
7838f4be 383}
7838f4be 384#endif
385
7838f4be 386#ifdef WITH_ISO14443a_StandAlone
d760c7b3 387
388typedef struct {
389 uint8_t uid[10];
390 uint8_t uidlen;
391 uint8_t atqa[2];
392 uint8_t sak;
393} __attribute__((__packed__)) card_clone_t;
394
7838f4be 395void StandAloneMode14a()
396{
397 StandAloneMode();
398 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
399
d760c7b3 400 int selected = 0, playing = 0, iGotoRecord = 0, iGotoClone = 0;
7838f4be 401 int cardRead[OPTS] = {0};
7838f4be 402
d760c7b3 403 card_clone_t uids[OPTS];
404 iso14a_card_select_t card_info[OPTS];
c2731f37 405 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
406
7838f4be 407 LED(selected + 1, 0);
408
409 for (;;)
410 {
411 usb_poll();
412 WDT_HIT();
7838f4be 413 SpinDelay(300);
414
0db6ed9a 415 if (iGotoRecord == 1 || cardRead[selected] == 0)
7838f4be 416 {
0db6ed9a 417 iGotoRecord = 0;
7838f4be 418 LEDsoff();
419 LED(selected + 1, 0);
420 LED(LED_RED2, 0);
421
422 // record
423 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
7838f4be 424 /* need this delay to prevent catching some weird data */
425 SpinDelay(500);
7838f4be 426 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
427
428 for ( ; ; )
429 {
430 WDT_HIT();
0db6ed9a 431 if (BUTTON_PRESS()) {
432 if (cardRead[selected]) {
433 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
434 break;
435 }
d760c7b3 436 else if (cardRead[(selected+1) % OPTS]) {
0db6ed9a 437 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
d760c7b3 438 selected = (selected+1) % OPTS;
0db6ed9a 439 break; // playing = 1;
440 }
441 else {
442 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
443 SpinDelay(300);
444 }
445 }
d760c7b3 446 if (!iso14443a_select_card(NULL, &card_info[selected], NULL, true, 0))
7838f4be 447 continue;
448 else
449 {
16cfceb6 450 Dbprintf("Read UID:");
d760c7b3 451 Dbhexdump(card_info[selected].uidlen, card_info[selected].uid, 0);
452
453 if (memcmp(uids[(selected+1)%OPTS].uid, card_info[selected].uid, card_info[selected].uidlen ) == 0 ) {
0db6ed9a 454 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
455 }
456 else {
d760c7b3 457
458 uids[selected].sak = card_info[selected].sak;
459 uids[selected].uidlen = card_info[selected].uidlen;
460 memcpy(uids[selected].uid , card_info[selected].uid, uids[selected].uidlen);
461 memcpy(uids[selected].atqa, card_info[selected].atqa, 2);
462
463 if (uids[selected].uidlen > 4)
464 Dbprintf("Bank[%d] received a 7-byte UID", selected);
465 else
466 Dbprintf("Bank[%d] received a 4-byte UID", selected);
7838f4be 467 break;
468 }
469 }
0db6ed9a 470 }
d760c7b3 471 Dbprintf("ATQA = %02X%02X", uids[selected].atqa[0], uids[selected].atqa[1]);
472 Dbprintf("SAK = %02X", uids[selected].sak);
7838f4be 473 LEDsoff();
474 LED(LED_GREEN, 200);
475 LED(LED_ORANGE, 200);
476 LED(LED_GREEN, 200);
477 LED(LED_ORANGE, 200);
478
479 LEDsoff();
480 LED(selected + 1, 0);
7838f4be 481
0db6ed9a 482 // Next state is replay:
483 playing = 1;
7838f4be 484
485 cardRead[selected] = 1;
7838f4be 486 }
0db6ed9a 487 /* MF Classic UID clone */
488 else if (iGotoClone==1)
7838f4be 489 {
0db6ed9a 490 iGotoClone=0;
c2731f37 491 LEDsoff();
492 LED(selected + 1, 0);
493 LED(LED_ORANGE, 250);
7838f4be 494
d760c7b3 495 // magiccards holds 4bytes uid.
496 uint64_t tmpuid = bytes_to_num(uids[selected].uid, 4);
497
c2731f37 498 // record
d760c7b3 499 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, tmpuid & 0xFFFFFFFF);
7838f4be 500
c2731f37 501 // wait for button to be released
502 // Delay cloning until card is in place
503 while(BUTTON_PRESS())
504 WDT_HIT();
7838f4be 505
c2731f37 506 Dbprintf("Starting clone. [Bank: %u]", selected);
507 // need this delay to prevent catching some weird data
508 SpinDelay(500);
509 // Begin clone function here:
510 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
511 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
512 memcpy(c.d.asBytes, data, 16);
513 SendCommand(&c);
514
515 Block read is similar:
516 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
517 We need to imitate that call with blockNo 0 to set a uid.
518
519 The get and set commands are handled in this file:
520 // Work with "magic Chinese" card
521 case CMD_MIFARE_CSETBLOCK:
522 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
523 break;
524 case CMD_MIFARE_CGETBLOCK:
525 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
526 break;
527
528 mfCSetUID provides example logic for UID set workflow:
529 -Read block0 from card in field with MifareCGetBlock()
530 -Configure new values without replacing reserved bytes
531 memcpy(block0, uid, 4); // Copy UID bytes from byte array
532 // Mifare UID BCC
533 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
534 Bytes 5-7 are reserved SAK and ATQA for mifare classic
535 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
536 */
537 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
538 // arg0 = Flags, arg1=blockNo
539 MifareCGetBlock(params, 0, oldBlock0);
0db6ed9a 540 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
541 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
542 playing = 1;
543 }
544 else {
16cfceb6 545 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0], oldBlock0[1], oldBlock0[2], oldBlock0[3]);
546 memcpy(newBlock0, oldBlock0, 16);
c2731f37 547
d760c7b3 548 // Copy uid for bank (2nd is for longer UIDs not supported if classic)
549 memcpy(newBlock0, uids[selected].uid, 4);
16cfceb6 550 newBlock0[4] = newBlock0[0] ^ newBlock0[1] ^ newBlock0[2] ^ newBlock0[3];
c2731f37 551
552 // arg0 = workFlags, arg1 = blockNo, datain
553 MifareCSetBlock(params, 0, newBlock0);
554 MifareCGetBlock(params, 0, testBlock0);
555
556 if (memcmp(testBlock0, newBlock0, 16)==0) {
557 DbpString("Cloned successfull!");
558 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
7838f4be 559 playing = 0;
0db6ed9a 560 iGotoRecord = 1;
c2731f37 561 selected = (selected + 1) % OPTS;
562 } else {
0db6ed9a 563 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
564 playing = 1;
565 }
566 }
567 LEDsoff();
568 LED(selected + 1, 0);
7838f4be 569 }
570 // Change where to record (or begin playing)
0db6ed9a 571 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
7838f4be 572 {
7838f4be 573 LEDsoff();
574 LED(selected + 1, 0);
575
576 // Begin transmitting
577 if (playing)
578 {
579 LED(LED_GREEN, 0);
580 DbpString("Playing");
0db6ed9a 581 for ( ; ; ) {
582 WDT_HIT();
583 int button_action = BUTTON_HELD(1000);
584 if (button_action == 0) { // No button action, proceed with sim
d760c7b3 585
586 uint8_t flags = FLAG_4B_UID_IN_DATA;
587 uint8_t data[USB_CMD_DATA_SIZE] = {0}; // in case there is a read command received we shouldn't break
588
589 memcpy(data, uids[selected].uid, uids[selected].uidlen);
590
591 uint64_t tmpuid = bytes_to_num(uids[selected].uid, uids[selected].uidlen);
592
593 if ( uids[selected].uidlen == 7 ) {
594 flags = FLAG_7B_UID_IN_DATA;
595 Dbprintf("Simulating ISO14443a tag with uid: %02x%08x [Bank: %u]", tmpuid >> 32, tmpuid & 0xFFFFFFFF , selected);
596 } else {
597 Dbprintf("Simulating ISO14443a tag with uid: %08x [Bank: %u]", tmpuid & 0xFFFFFFFF , selected);
598 }
0db6ed9a 599
4401050b 600 if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0) {
601 DbpString("Mifare Classic 1k");
602 SimulateIso14443aTag(1, flags, data);
603 } else if (uids[selected].sak == 0x18 && uids[selected].atqa[0] == 0x02 && uids[selected].atqa[1] == 0) {
604 DbpString("Mifare Classic 4k (4b uid)");
605 SimulateIso14443aTag(8, flags, data);
606 } else if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
607 DbpString("Mifare Classic 4k (7b uid)");
608 SimulateIso14443aTag(8, flags, data);
609 } else if (uids[selected].sak == 0x00 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
0db6ed9a 610 DbpString("Mifare Ultralight");
4401050b 611 SimulateIso14443aTag(2, flags, data);
612 } else if (uids[selected].sak == 0x20 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0x03) {
0db6ed9a 613 DbpString("Mifare DESFire");
4401050b 614 SimulateIso14443aTag(3, flags, data);
0db6ed9a 615 }
616 else {
617 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
4401050b 618 SimulateIso14443aTag(1, flags, data);
0db6ed9a 619 }
620 }
621 else if (button_action == BUTTON_SINGLE_CLICK) {
622 selected = (selected + 1) % OPTS;
623 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
624 iGotoRecord = 1;
625 break;
626 }
627 else if (button_action == BUTTON_HOLD) {
628 Dbprintf("Playtime over. Begin cloning...");
629 iGotoClone = 1;
630 break;
7838f4be 631 }
0db6ed9a 632 WDT_HIT();
633 }
7838f4be 634
635 /* We pressed a button so ignore it here with a delay */
636 SpinDelay(300);
7838f4be 637 LEDsoff();
638 LED(selected + 1, 0);
639 }
640 else
641 while(BUTTON_PRESS())
642 WDT_HIT();
643 }
644 }
645}
646#elif WITH_LF
647// samy's sniff and repeat routine
648void SamyRun()
649{
650 StandAloneMode();
651 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
652
653 int high[OPTS], low[OPTS];
15c4dc5a 654 int selected = 0;
655 int playing = 0;
72e930ef 656 int cardRead = 0;
15c4dc5a 657
658 // Turn on selected LED
659 LED(selected + 1, 0);
660
614da335 661 for (;;) {
6e82300d 662 usb_poll();
95e63594 663 WDT_HIT();
15c4dc5a 664
665 // Was our button held down or pressed?
666 int button_pressed = BUTTON_HELD(1000);
667 SpinDelay(300);
668
669 // Button was held for a second, begin recording
72e930ef 670 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 671 {
672 LEDsoff();
673 LED(selected + 1, 0);
674 LED(LED_RED2, 0);
675
676 // record
677 DbpString("Starting recording");
678
679 // wait for button to be released
680 while(BUTTON_PRESS())
681 WDT_HIT();
682
683 /* need this delay to prevent catching some weird data */
684 SpinDelay(500);
685
686 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
b7536e11 687 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
15c4dc5a 688
689 LEDsoff();
690 LED(selected + 1, 0);
691 // Finished recording
15c4dc5a 692 // If we were previously playing, set playing off
693 // so next button push begins playing what we recorded
614da335 694 playing = 0;
695 cardRead = 1;
72e930ef 696 }
614da335 697 else if (button_pressed > 0 && cardRead == 1) {
698 LEDsoff();
699 LED(selected + 1, 0);
700 LED(LED_ORANGE, 0);
72e930ef 701
614da335 702 // record
b7536e11 703 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
72e930ef 704
614da335 705 // wait for button to be released
706 while(BUTTON_PRESS())
707 WDT_HIT();
72e930ef 708
614da335 709 /* need this delay to prevent catching some weird data */
710 SpinDelay(500);
72e930ef 711
b7536e11 712 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
713 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
72e930ef 714
614da335 715 LEDsoff();
716 LED(selected + 1, 0);
717 // Finished recording
72e930ef 718
614da335 719 // If we were previously playing, set playing off
720 // so next button push begins playing what we recorded
721 playing = 0;
722 cardRead = 0;
15c4dc5a 723 }
724
725 // Change where to record (or begin playing)
614da335 726 else if (button_pressed) {
15c4dc5a 727 // Next option if we were previously playing
728 if (playing)
729 selected = (selected + 1) % OPTS;
730 playing = !playing;
731
732 LEDsoff();
733 LED(selected + 1, 0);
734
735 // Begin transmitting
736 if (playing)
737 {
738 LED(LED_GREEN, 0);
739 DbpString("Playing");
740 // wait for button to be released
741 while(BUTTON_PRESS())
742 WDT_HIT();
0d5ee8e2 743
b7536e11 744 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
0d5ee8e2 745 CmdHIDsimTAG(high[selected], low[selected], 0);
15c4dc5a 746 DbpString("Done playing");
0d5ee8e2 747
748 if (BUTTON_HELD(1000) > 0) {
15c4dc5a 749 DbpString("Exiting");
750 LEDsoff();
751 return;
0d5ee8e2 752 }
15c4dc5a 753
754 /* We pressed a button so ignore it here with a delay */
755 SpinDelay(300);
756
757 // when done, we're done playing, move to next option
758 selected = (selected + 1) % OPTS;
759 playing = !playing;
760 LEDsoff();
761 LED(selected + 1, 0);
762 }
763 else
764 while(BUTTON_PRESS())
765 WDT_HIT();
766 }
767 }
768}
15c4dc5a 769
7838f4be 770#endif
15c4dc5a 771/*
772OBJECTIVE
773Listen and detect an external reader. Determine the best location
774for the antenna.
775
776INSTRUCTIONS:
777Inside the ListenReaderField() function, there is two mode.
778By default, when you call the function, you will enter mode 1.
779If you press the PM3 button one time, you will enter mode 2.
780If you press the PM3 button a second time, you will exit the function.
781
782DESCRIPTION OF MODE 1:
783This mode just listens for an external reader field and lights up green
784for HF and/or red for LF. This is the original mode of the detectreader
785function.
786
787DESCRIPTION OF MODE 2:
788This mode will visually represent, using the LEDs, the actual strength of the
789current compared to the maximum current detected. Basically, once you know
790what kind of external reader is present, it will help you spot the best location to place
791your antenna. You will probably not get some good results if there is a LF and a HF reader
792at the same place! :-)
793
794LIGHT SCHEME USED:
795*/
796static const char LIGHT_SCHEME[] = {
797 0x0, /* ---- | No field detected */
798 0x1, /* X--- | 14% of maximum current detected */
799 0x2, /* -X-- | 29% of maximum current detected */
800 0x4, /* --X- | 43% of maximum current detected */
801 0x8, /* ---X | 57% of maximum current detected */
802 0xC, /* --XX | 71% of maximum current detected */
803 0xE, /* -XXX | 86% of maximum current detected */
804 0xF, /* XXXX | 100% of maximum current detected */
805};
806static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
807
da198be4 808void ListenReaderField(int limit) {
3b692427 809#define LF_ONLY 1
810#define HF_ONLY 2
811#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
812
da198be4 813 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
814 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
815 int mode=1, display_val, display_max, i;
3b692427 816
817 // switch off FPGA - we don't want to measure our own signal
818 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
819 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 820
821 LEDsoff();
822
3b692427 823 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 824
825 if(limit != HF_ONLY) {
3b692427 826 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 827 lf_baseline = lf_av;
828 }
829
3b692427 830 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 831
832 if (limit != LF_ONLY) {
3b692427 833 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 834 hf_baseline = hf_av;
835 }
836
837 for(;;) {
838 if (BUTTON_PRESS()) {
839 SpinDelay(500);
840 switch (mode) {
841 case 1:
842 mode=2;
843 DbpString("Signal Strength Mode");
844 break;
845 case 2:
846 default:
847 DbpString("Stopped");
848 LEDsoff();
849 return;
850 break;
851 }
852 }
853 WDT_HIT();
854
855 if (limit != HF_ONLY) {
3b692427 856 if(mode == 1) {
f2c2b174 857 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
3b692427 858 LED_D_ON();
859 else
860 LED_D_OFF();
15c4dc5a 861 }
e30c654b 862
3b692427 863 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 864 // see if there's a significant change
f2c2b174 865 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
3b692427 866 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 867 lf_av = lf_av_new;
868 if (lf_av > lf_max)
869 lf_max = lf_av;
15c4dc5a 870 }
871 }
872
873 if (limit != LF_ONLY) {
874 if (mode == 1){
f2c2b174 875 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
3b692427 876 LED_B_ON();
877 else
878 LED_B_OFF();
15c4dc5a 879 }
e30c654b 880
3b692427 881 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 882 // see if there's a significant change
f2c2b174 883 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
3b692427 884 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 885 hf_av = hf_av_new;
886 if (hf_av > hf_max)
887 hf_max = hf_av;
15c4dc5a 888 }
889 }
e30c654b 890
15c4dc5a 891 if(mode == 2) {
892 if (limit == LF_ONLY) {
893 display_val = lf_av;
894 display_max = lf_max;
895 } else if (limit == HF_ONLY) {
896 display_val = hf_av;
897 display_max = hf_max;
898 } else { /* Pick one at random */
899 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
900 display_val = hf_av;
901 display_max = hf_max;
902 } else {
903 display_val = lf_av;
904 display_max = lf_max;
905 }
906 }
907 for (i=0; i<LIGHT_LEN; i++) {
908 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
909 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
910 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
911 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
912 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
913 break;
914 }
915 }
916 }
917 }
918}
919
f7e3ed82 920void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 921{
922 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 923
f121b478 924 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
902cb3c0 925
15c4dc5a 926 switch(c->cmd) {
927#ifdef WITH_LF
31abe49f
MHS
928 case CMD_SET_LF_SAMPLING_CONFIG:
929 setSamplingConfig((sample_config *) c->d.asBytes);
930 break;
15c4dc5a 931 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1c8fbeb9 932 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
15c4dc5a 933 break;
15c4dc5a 934 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
d0724780 935 ModThenAcquireRawAdcSamples125k(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
15c4dc5a 936 break;
b014c96d 937 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 938 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 939 break;
7e67e42f 940 case CMD_HID_DEMOD_FSK:
a501c82b 941 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 942 break;
943 case CMD_HID_SIM_TAG:
a501c82b 944 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 945 break;
abd6112f 946 case CMD_FSK_SIM_TAG:
947 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
948 break;
949 case CMD_ASK_SIM_TAG:
950 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
951 break;
872e3d4d 952 case CMD_PSK_SIM_TAG:
953 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
954 break;
a501c82b 955 case CMD_HID_CLONE_TAG:
1c611bbd 956 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 957 break;
a1f3bb12 958 case CMD_IO_DEMOD_FSK:
a501c82b 959 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 960 break;
a501c82b 961 case CMD_IO_CLONE_TAG:
94422fa2 962 CopyIOtoT55x7(c->arg[0], c->arg[1]);
a1f3bb12 963 break;
6ff6ade2 964 case CMD_EM410X_DEMOD:
965 CmdEM410xdemod(c->arg[0], 0, 0, 1);
966 break;
2d4eae76 967 case CMD_EM410X_WRITE_TAG:
968 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
969 break;
7e67e42f 970 case CMD_READ_TI_TYPE:
971 ReadTItag();
972 break;
973 case CMD_WRITE_TI_TYPE:
974 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
975 break;
976 case CMD_SIMULATE_TAG_125K:
f121b478 977 LED_A_ON();
74daee24 978 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
979 LED_A_OFF();
7e67e42f 980 break;
981 case CMD_LF_SIMULATE_BIDIR:
982 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
983 break;
a501c82b 984 case CMD_INDALA_CLONE_TAG:
2414f978 985 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
986 break;
a501c82b 987 case CMD_INDALA_CLONE_TAG_L:
2414f978 988 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
989 break;
1c611bbd 990 case CMD_T55XX_READ_BLOCK:
9276e859 991 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 992 break;
993 case CMD_T55XX_WRITE_BLOCK:
994 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
995 break;
9276e859 996 case CMD_T55XX_WAKEUP:
997 T55xxWakeUp(c->arg[0]);
998 break;
94422fa2 999 case CMD_T55XX_RESET_READ:
1000 T55xxResetRead();
1001 break;
a501c82b 1002 case CMD_PCF7931_READ:
1c611bbd 1003 ReadPCF7931();
1c611bbd 1004 break;
e98572a1 1005 case CMD_PCF7931_WRITE:
ac2df346 1006 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
e98572a1 1007 break;
1c611bbd 1008 case CMD_EM4X_READ_WORD:
cb1ba30a 1009 EM4xReadWord(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1010 break;
1011 case CMD_EM4X_WRITE_WORD:
cb1ba30a 1012 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1013 break;
db25599d 1014 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1015 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
70459879 1016 break;
0de8e387 1017 case CMD_VIKING_CLONE_TAG:
a126332a 1018 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
0de8e387 1019 break;
4653da43 1020 case CMD_COTAG:
5f5b83b7 1021 Cotag(c->arg[0]);
4653da43 1022 break;
15c4dc5a 1023#endif
1024
d19929cb 1025#ifdef WITH_HITAG
1026 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1027 SnoopHitag(c->arg[0]);
1028 break;
1029 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1030 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1031 break;
1032 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1033 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1034 break;
0db11b71 1035 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1036 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1037 break;
1038 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1039 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1040 break;
6fc68747 1041 case CMD_READ_HITAG_S: //Reader for only Hitag S tags, args = key or challenge
0db11b71 1042 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1043 break;
6fc68747 1044 case CMD_WR_HITAG_S: //writer for Hitag tags args=data to write,page and key or challenge
0db11b71 1045 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1046 break;
d19929cb 1047#endif
f168b263 1048
15c4dc5a 1049#ifdef WITH_ISO15693
1050 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1051 AcquireRawAdcSamplesIso15693();
1052 break;
9455b51c 1053 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1054 RecordRawAdcSamplesIso15693();
1055 break;
9455b51c 1056 case CMD_ISO_15693_COMMAND:
1057 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1058 break;
9455b51c 1059 case CMD_ISO_15693_FIND_AFI:
1060 BruteforceIso15693Afi(c->arg[0]);
1061 break;
9455b51c 1062 case CMD_ISO_15693_DEBUG:
1063 SetDebugIso15693(c->arg[0]);
1064 break;
15c4dc5a 1065 case CMD_READER_ISO_15693:
1066 ReaderIso15693(c->arg[0]);
1067 break;
7e67e42f 1068 case CMD_SIMTAG_ISO_15693:
3649b640 1069 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 1070 break;
15c4dc5a 1071#endif
1072
7e67e42f 1073#ifdef WITH_LEGICRF
1074 case CMD_SIMULATE_TAG_LEGIC_RF:
1075 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1076 break;
7e67e42f 1077 case CMD_WRITER_LEGIC_RF:
0e8cabed 1078 LegicRfWriter( c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
3e134b4c 1079 break;
15c4dc5a 1080 case CMD_READER_LEGIC_RF:
f121b478 1081 LegicRfReader(c->arg[0], c->arg[1], c->arg[2]);
0e8cabed 1082 break;
3e750be3 1083 case CMD_LEGIC_INFO:
1084 LegicRfInfo();
1085 break;
0e8cabed 1086 case CMD_LEGIC_ESET:
1087 LegicEMemSet(c->arg[0], c->arg[1], c->d.asBytes);
1088 break;
15c4dc5a 1089#endif
1090
1091#ifdef WITH_ISO14443b
6fc68747 1092 case CMD_READ_SRI_TAG:
1093 ReadSTMemoryIso14443b(c->arg[0]);
7e67e42f 1094 break;
22e24700 1095 case CMD_SNOOP_ISO_14443B:
abb21530 1096 SnoopIso14443b();
7e67e42f 1097 break;
22e24700 1098 case CMD_SIMULATE_TAG_ISO_14443B:
dccddaef 1099 SimulateIso14443bTag(c->arg[0]);
7e67e42f 1100 break;
7cf3ef20 1101 case CMD_ISO_14443B_COMMAND:
6fc68747 1102 //SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1103 SendRawCommand14443B_Ex(c);
7cf3ef20 1104 break;
15c4dc5a 1105#endif
1106
1107#ifdef WITH_ISO14443a
7e67e42f 1108 case CMD_SNOOP_ISO_14443a:
4d2e4eea 1109 SniffIso14443a(c->arg[0]);
7e67e42f 1110 break;
15c4dc5a 1111 case CMD_READER_ISO_14443a:
902cb3c0 1112 ReaderIso14443a(c);
15c4dc5a 1113 break;
7e67e42f 1114 case CMD_SIMULATE_TAG_ISO_14443a:
0db6ed9a 1115 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 1116 break;
5acd09bd 1117 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 1118 EPA_PACE_Collect_Nonce(c);
5acd09bd 1119 break;
d0f3338e 1120 case CMD_EPA_PACE_REPLAY:
1121 EPA_PACE_Replay(c);
1122 break;
15c4dc5a 1123 case CMD_READER_MIFARE:
df007486 1124 ReaderMifare(c->arg[0], c->arg[1], c->arg[2]);
15c4dc5a 1125 break;
20f9a2a1
M
1126 case CMD_MIFARE_READBL:
1127 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1128 break;
981bd429 1129 case CMD_MIFAREU_READBL:
aa60d156 1130 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 1131 break;
4d2e4eea 1132 case CMD_MIFAREUC_AUTH:
1133 MifareUC_Auth(c->arg[0],c->d.asBytes);
f38a1528 1134 break;
981bd429 1135 case CMD_MIFAREU_READCARD:
74daee24 1136 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 1137 break;
aa60d156 1138 case CMD_MIFAREUC_SETPWD:
1139 MifareUSetPwd(c->arg[0], c->d.asBytes);
117d9ec2 1140 break;
20f9a2a1
M
1141 case CMD_MIFARE_READSC:
1142 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1143 break;
1144 case CMD_MIFARE_WRITEBL:
1145 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1146 break;
95aeb706 1147 //case CMD_MIFAREU_WRITEBL_COMPAT:
1148 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1149 //break;
981bd429 1150 case CMD_MIFAREU_WRITEBL:
95aeb706 1151 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
aa60d156 1152 break;
c188b1b9 1153 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1154 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
20f9a2a1
M
1156 case CMD_MIFARE_NESTED:
1157 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
1158 break;
1159 case CMD_MIFARE_CHKKEYS:
1160 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
1161 break;
1162 case CMD_SIMULATE_MIFARE_CARD:
1163 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1164 break;
8556b852
M
1165
1166 // emulator
1167 case CMD_MIFARE_SET_DBGMODE:
1168 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1169 break;
1170 case CMD_MIFARE_EML_MEMCLR:
1171 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1172 break;
1173 case CMD_MIFARE_EML_MEMSET:
1174 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1175 break;
1176 case CMD_MIFARE_EML_MEMGET:
1177 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1178 break;
1179 case CMD_MIFARE_EML_CARDLOAD:
1180 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
1181 break;
1182
1183 // Work with "magic Chinese" card
d52e4e88 1184 case CMD_MIFARE_CSETBLOCK:
c2731f37 1185 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
545a1f38 1186 break;
d52e4e88 1187 case CMD_MIFARE_CGETBLOCK:
c2731f37 1188 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
8556b852 1189 break;
d52e4e88 1190 case CMD_MIFARE_CIDENT:
1191 MifareCIdent();
1192 break;
b62a5a84
M
1193
1194 // mifare sniffer
1195 case CMD_MIFARE_SNIFFER:
5cd9ec01 1196 SniffMifare(c->arg[0]);
b62a5a84 1197 break;
313ee67e 1198
aa60d156 1199 //mifare desfire
1200 case CMD_MIFARE_DESFIRE_READBL: break;
1201 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1202 case CMD_MIFARE_DESFIRE_AUTH1:
1203 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1204 break;
1205 case CMD_MIFARE_DESFIRE_AUTH2:
1206 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1207 break;
1208 case CMD_MIFARE_DES_READER:
1209 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1210 break;
1211 case CMD_MIFARE_DESFIRE_INFO:
1212 MifareDesfireGetInformation();
1213 break;
1214 case CMD_MIFARE_DESFIRE:
1215 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1216 break;
add0504d 1217 case CMD_MIFARE_COLLECT_NONCES:
add0504d 1218 break;
20f9a2a1 1219#endif
810f5379 1220#ifdef WITH_EMV
1221 case CMD_EMV_TRANSACTION:
1222 EMVTransaction();
1223 break;
1224 case CMD_EMV_GET_RANDOM_NUM:
1225 //EMVgetUDOL();
1226 break;
1227 case CMD_EMV_LOAD_VALUE:
1228 EMVloadvalue(c->arg[0], c->d.asBytes);
1229 break;
1230 case CMD_EMV_DUMP_CARD:
1231 EMVdumpcard();
573e8d72 1232 break;
9c624f67 1233/*
1234 case CMD_EMV_READ_RECORD:
1235 EMVReadRecord(c->arg[0], c->arg[1], NULL);
1236 break;
9c624f67 1237 case CMD_EMV_CLONE:
1238 EMVClone(c->arg[0], c->arg[1]);
1239 break;
1240 case CMD_EMV_SIM:
1241 EMVSim();
1242 break;
1243 case CMD_EMV_TEST:
1244 EMVTest();
1245 break;
1246 case CMD_EMV_FUZZ_RATS:
1247 EMVFuzz_RATS(c->arg[0],c->d.asBytes);
1248 break;
1249 */
810f5379 1250#endif
7e67e42f 1251#ifdef WITH_ICLASS
cee5a30d 1252 // Makes use of ISO14443a FPGA Firmware
1253 case CMD_SNOOP_ICLASS:
1254 SnoopIClass();
1255 break;
1e262141 1256 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 1257 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 1258 break;
1259 case CMD_READER_ICLASS:
1260 ReaderIClass(c->arg[0]);
1261 break;
f38a1528 1262 case CMD_READER_ICLASS_REPLAY:
f62b5e12 1263 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
f38a1528 1264 break;
0e8cabed 1265 case CMD_ICLASS_EML_MEMSET:
e80aeb96
MHS
1266 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1267 break;
e98572a1 1268 case CMD_ICLASS_WRITEBLOCK:
1269 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1270 break;
1271 case CMD_ICLASS_READCHECK: // auth step 1
1272 iClass_ReadCheck(c->arg[0], c->arg[1]);
1273 break;
1274 case CMD_ICLASS_READBLOCK:
1275 iClass_ReadBlk(c->arg[0]);
1276 break;
1277 case CMD_ICLASS_AUTHENTICATION: //check
1278 iClass_Authentication(c->d.asBytes);
1279 break;
1280 case CMD_ICLASS_DUMP:
1281 iClass_Dump(c->arg[0], c->arg[1]);
1282 break;
1283 case CMD_ICLASS_CLONE:
1284 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1285 break;
cee5a30d 1286#endif
1d0ccbe0 1287#ifdef WITH_HFSNOOP
1288 case CMD_HF_SNIFFER:
1289 HfSnoop(c->arg[0], c->arg[1]);
1290 break;
1291#endif
cee5a30d 1292
7e67e42f 1293 case CMD_BUFF_CLEAR:
117d9ec2 1294 BigBuf_Clear();
15c4dc5a 1295 break;
15c4dc5a 1296
1297 case CMD_MEASURE_ANTENNA_TUNING:
1298 MeasureAntennaTuning();
1299 break;
1300
1301 case CMD_MEASURE_ANTENNA_TUNING_HF:
1302 MeasureAntennaTuningHf();
1303 break;
1304
1305 case CMD_LISTEN_READER_FIELD:
1306 ListenReaderField(c->arg[0]);
1307 break;
1308
15c4dc5a 1309 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1310 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1311 SpinDelay(200);
1312 LED_D_OFF(); // LED D indicates field ON or OFF
1313 break;
1314
aaa1a9a2 1315 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1c611bbd 1316 LED_B_ON();
117d9ec2 1317 uint8_t *BigBuf = BigBuf_get_addr();
0de8e387 1318 size_t len = 0;
f1333898 1319 size_t startidx = c->arg[0];
1320 uint8_t isok = FALSE;
81b7e894 1321 // arg0 = startindex
1322 // arg1 = length bytes to transfer
1323 // arg2 = RFU
9c624f67 1324 //Dbprintf("transfer to client parameters: %" PRIu64 " | %" PRIu64 " | %" PRIu64, c->arg[0], c->arg[1], c->arg[2]);
81b7e894 1325
f1333898 1326 for(size_t i = 0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
81b7e894 1327 len = MIN( (c->arg[1] - i), USB_CMD_DATA_SIZE);
f1333898 1328 isok = cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, i, len, BigBuf_get_traceLen(), BigBuf + startidx + i, len);
1329 if (!isok)
1330 Dbprintf("transfer to client failed :: | bytes %d", len);
1c611bbd 1331 }
1332 // Trigger a finish downloading signal with an ACK frame
f1333898 1333 cmd_send(CMD_ACK, 1, 0, BigBuf_get_traceLen(), getSamplingConfig(), sizeof(sample_config));
d3b1f4e4 1334 LED_B_OFF();
1c611bbd 1335 break;
aaa1a9a2 1336 }
15c4dc5a 1337 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
8fd25db3 1338 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
81b7e894 1339 // to be able to use this one for uploading data to device
1340 // arg1 = 0 upload for LF usage
1341 // 1 upload for HF usage
8fd25db3 1342 if ( c->arg[1] == 0 )
1343 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1344 else
1345 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
117d9ec2 1346 uint8_t *b = BigBuf_get_addr();
aaa1a9a2 1347 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
aed36ae5 1348 cmd_send(CMD_ACK,1,0,0,0,0);
1c611bbd 1349 break;
aaa1a9a2 1350 }
1351 case CMD_DOWNLOAD_EML_BIGBUF: {
1352 LED_B_ON();
1353 uint8_t *cardmem = BigBuf_get_EM_addr();
1354 size_t len = 0;
1355 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1356 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1357 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1358 }
1359 // Trigger a finish downloading signal with an ACK frame
1360 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1361 LED_B_OFF();
1362 break;
1363 }
15c4dc5a 1364 case CMD_READ_MEM:
1365 ReadMem(c->arg[0]);
1366 break;
1367
1368 case CMD_SET_LF_DIVISOR:
7cc204bf 1369 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 1370 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1371 break;
1372
1373 case CMD_SET_ADC_MUX:
1374 switch(c->arg[0]) {
1375 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1376 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1377 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1378 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1379 }
1380 break;
1381
1382 case CMD_VERSION:
1383 SendVersion();
1384 break;
7838f4be 1385 case CMD_STATUS:
0de8e387 1386 SendStatus();
7838f4be 1387 break;
1388 case CMD_PING:
1389 cmd_send(CMD_ACK,0,0,0,0,0);
1390 break;
15c4dc5a 1391#ifdef WITH_LCD
1392 case CMD_LCD_RESET:
1393 LCDReset();
1394 break;
1395 case CMD_LCD:
1396 LCDSend(c->arg[0]);
1397 break;
1398#endif
1399 case CMD_SETUP_WRITE:
1400 case CMD_FINISH_WRITE:
1c611bbd 1401 case CMD_HARDWARE_RESET:
1402 usb_disable();
f62b5e12 1403 SpinDelay(2000);
15c4dc5a 1404 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1405 for(;;) {
1406 // We're going to reset, and the bootrom will take control.
1407 }
1c611bbd 1408 break;
15c4dc5a 1409
1c611bbd 1410 case CMD_START_FLASH:
15c4dc5a 1411 if(common_area.flags.bootrom_present) {
1412 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1413 }
1c611bbd 1414 usb_disable();
15c4dc5a 1415 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1416 for(;;);
1c611bbd 1417 break;
e30c654b 1418
15c4dc5a 1419 case CMD_DEVICE_INFO: {
902cb3c0 1420 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1421 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1422 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1423 break;
1424 }
1425 default:
15c4dc5a 1426 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1427 break;
15c4dc5a 1428 }
1429}
1430
1431void __attribute__((noreturn)) AppMain(void)
1432{
1433 SpinDelay(100);
9e8255d4 1434 clear_trace();
15c4dc5a 1435 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1436 /* Initialize common area */
1437 memset(&common_area, 0, sizeof(common_area));
1438 common_area.magic = COMMON_AREA_MAGIC;
1439 common_area.version = 1;
1440 }
1441 common_area.flags.osimage_present = 1;
1442
f121b478 1443 LEDsoff();
15c4dc5a 1444
b44e5233 1445 // Init USB device
313ee67e 1446 usb_enable();
15c4dc5a 1447
1448 // The FPGA gets its clock from us from PCK0 output, so set that up.
1449 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1450 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1451 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1452 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
f121b478 1453 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK | AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
15c4dc5a 1454 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1455
1456 // Reset SPI
1457 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1458 // Reset SSC
1459 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1460
1461 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1462 // (the HF version by default)
1463 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1464
9ca155ba 1465 StartTickCount();
902cb3c0 1466
15c4dc5a 1467#ifdef WITH_LCD
15c4dc5a 1468 LCDInit();
15c4dc5a 1469#endif
1470
f62b5e12 1471 byte_t rx[sizeof(UsbCommand)];
902cb3c0 1472 size_t rx_len;
1473
15c4dc5a 1474 for(;;) {
f121b478 1475 if ( usb_poll_validate_length() ) {
1476 rx_len = usb_read(rx, sizeof(UsbCommand));
1477
da198be4 1478 if (rx_len)
f121b478 1479 UsbPacketReceived(rx, rx_len);
313ee67e 1480 }
15c4dc5a 1481 WDT_HIT();
1482
1483#ifdef WITH_LF
7838f4be 1484#ifndef WITH_ISO14443a_StandAlone
15c4dc5a 1485 if (BUTTON_HELD(1000) > 0)
1486 SamyRun();
7838f4be 1487#endif
1488#endif
1489#ifdef WITH_ISO14443a
1490#ifdef WITH_ISO14443a_StandAlone
1491 if (BUTTON_HELD(1000) > 0)
1492 StandAloneMode14a();
1493#endif
15c4dc5a 1494#endif
1495 }
1496}
Impressum, Datenschutz