]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
Add PACE replay functionality
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
902cb3c0 13#include "usb_cdc.h"
14#include "cmd.h"
15
e30c654b 16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
31d1caa5 21
9ab7a6c7 22#include <stdarg.h>
f7e3ed82 23
15c4dc5a 24#include "legicrf.h"
d19929cb 25#include <hitag2.h>
31abe49f 26#include "lfsampling.h"
3000dc4e 27#include "BigBuf.h"
15c4dc5a 28#ifdef WITH_LCD
902cb3c0 29 #include "LCD.h"
15c4dc5a 30#endif
31
15c4dc5a 32#define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34//=============================================================================
35// A buffer where we can queue things up to be sent through the FPGA, for
36// any purpose (fake tag, as reader, whatever). We go MSB first, since that
37// is the order in which they go out on the wire.
38//=============================================================================
39
6a1f2d82 40#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 42int ToSendMax;
43static int ToSendBit;
44struct common_area common_area __attribute__((section(".commonarea")));
45
15c4dc5a 46void ToSendReset(void)
47{
48 ToSendMax = -1;
49 ToSendBit = 8;
50}
51
52void ToSendStuffBit(int b)
53{
54 if(ToSendBit >= 8) {
55 ToSendMax++;
56 ToSend[ToSendMax] = 0;
57 ToSendBit = 0;
58 }
59
60 if(b) {
61 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
62 }
63
64 ToSendBit++;
65
6a1f2d82 66 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 67 ToSendBit = 0;
68 DbpString("ToSendStuffBit overflowed!");
69 }
70}
71
72//=============================================================================
73// Debug print functions, to go out over USB, to the usual PC-side client.
74//=============================================================================
75
76void DbpString(char *str)
77{
9440213d 78 byte_t len = strlen(str);
79 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 80}
81
82#if 0
83void DbpIntegers(int x1, int x2, int x3)
84{
902cb3c0 85 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 86}
87#endif
88
89void Dbprintf(const char *fmt, ...) {
90// should probably limit size here; oh well, let's just use a big buffer
91 char output_string[128];
92 va_list ap;
93
94 va_start(ap, fmt);
95 kvsprintf(fmt, output_string, 10, ap);
96 va_end(ap);
e30c654b 97
15c4dc5a 98 DbpString(output_string);
99}
100
9455b51c 101// prints HEX & ASCII
d19929cb 102void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 103 int l=0,i;
104 char ascii[9];
d19929cb 105
9455b51c 106 while (len>0) {
107 if (len>8) l=8;
108 else l=len;
109
110 memcpy(ascii,d,l);
d19929cb 111 ascii[l]=0;
9455b51c 112
113 // filter safe ascii
d19929cb 114 for (i=0;i<l;i++)
9455b51c 115 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 116
117 if (bAsci) {
118 Dbprintf("%-8s %*D",ascii,l,d," ");
119 } else {
120 Dbprintf("%*D",l,d," ");
121 }
122
9455b51c 123 len-=8;
124 d+=8;
125 }
126}
127
15c4dc5a 128//-----------------------------------------------------------------------------
129// Read an ADC channel and block till it completes, then return the result
130// in ADC units (0 to 1023). Also a routine to average 32 samples and
131// return that.
132//-----------------------------------------------------------------------------
133static int ReadAdc(int ch)
134{
f7e3ed82 135 uint32_t d;
15c4dc5a 136
137 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
138 AT91C_BASE_ADC->ADC_MR =
3b692427 139 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
140 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
141 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
142
143 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
144 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
145 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
146 //
147 // The maths are:
148 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
149 //
150 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
151 //
152 // Note: with the "historic" values in the comments above, the error was 34% !!!
153
15c4dc5a 154 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
155
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
3b692427 157
15c4dc5a 158 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
159 ;
160 d = AT91C_BASE_ADC->ADC_CDR[ch];
161
162 return d;
163}
164
9ca155ba 165int AvgAdc(int ch) // was static - merlok
15c4dc5a 166{
167 int i;
168 int a = 0;
169
170 for(i = 0; i < 32; i++) {
171 a += ReadAdc(ch);
172 }
173
174 return (a + 15) >> 5;
175}
176
177void MeasureAntennaTuning(void)
178{
2bdd68c3 179 uint8_t LF_Results[256];
9f693930 180 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 181 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
182
2bdd68c3 183 LED_B_ON();
15c4dc5a 184
185/*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
d19929cb 193
7cc204bf 194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2bdd68c3 196 for (i=255; i>=19; i--) {
d19929cb 197 WDT_HIT();
15c4dc5a 198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
3b692427 200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
15c4dc5a 201 if (i==95) vLf125 = adcval; // voltage at 125Khz
202 if (i==89) vLf134 = adcval; // voltage at 134Khz
203
2bdd68c3 204 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
205 if(LF_Results[i] > peak) {
15c4dc5a 206 peakv = adcval;
2bdd68c3 207 peak = LF_Results[i];
15c4dc5a 208 peakf = i;
9f693930 209 //ptr = i;
15c4dc5a 210 }
211 }
212
2bdd68c3 213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
214
215 LED_A_ON();
15c4dc5a 216 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 217 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 218 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
219 SpinDelay(20);
3b692427 220 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
15c4dc5a 221
3b692427 222 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
d19929cb 223 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 224 LED_A_OFF();
225 LED_B_OFF();
226 return;
15c4dc5a 227}
228
229void MeasureAntennaTuningHf(void)
230{
231 int vHf = 0; // in mV
232
233 DbpString("Measuring HF antenna, press button to exit");
234
3b692427 235 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
236 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
237 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
238
15c4dc5a 239 for (;;) {
15c4dc5a 240 SpinDelay(20);
3b692427 241 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 242
15c4dc5a 243 Dbprintf("%d mV",vHf);
244 if (BUTTON_PRESS()) break;
245 }
246 DbpString("cancelled");
3b692427 247
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
249
15c4dc5a 250}
251
252
253void SimulateTagHfListen(void)
254{
f71f4deb 255 // ToDo: historically this used the free buffer, which was 2744 Bytes long.
256 // There might be a better size to be defined:
257 #define HF_14B_SNOOP_BUFFER_SIZE 2744
258 uint8_t *dest = BigBuf_malloc(HF_14B_SNOOP_BUFFER_SIZE);
f7e3ed82 259 uint8_t v = 0;
15c4dc5a 260 int i;
261 int p = 0;
262
263 // We're using this mode just so that I can test it out; the simulated
264 // tag mode would work just as well and be simpler.
7cc204bf 265 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 266 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
267
268 // We need to listen to the high-frequency, peak-detected path.
269 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
270
271 FpgaSetupSsc();
272
273 i = 0;
274 for(;;) {
275 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
276 AT91C_BASE_SSC->SSC_THR = 0xff;
277 }
278 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 279 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 280
281 v <<= 1;
282 if(r & 1) {
283 v |= 1;
284 }
285 p++;
286
287 if(p >= 8) {
288 dest[i] = v;
289 v = 0;
290 p = 0;
291 i++;
292
f71f4deb 293 if(i >= HF_14B_SNOOP_BUFFER_SIZE) {
15c4dc5a 294 break;
295 }
296 }
297 }
298 }
299 DbpString("simulate tag (now type bitsamples)");
300}
301
302void ReadMem(int addr)
303{
f7e3ed82 304 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 305
306 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
307 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
308}
309
310/* osimage version information is linked in */
311extern struct version_information version_information;
312/* bootrom version information is pointed to from _bootphase1_version_pointer */
313extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
314void SendVersion(void)
315{
3fe4ff4f 316 char temp[512]; /* Limited data payload in USB packets */
15c4dc5a 317 DbpString("Prox/RFID mark3 RFID instrument");
e30c654b 318
319 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 320 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
321 * pointer, then use it.
322 */
323 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
324 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
325 DbpString("bootrom version information appears invalid");
326 } else {
327 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
328 DbpString(temp);
329 }
e30c654b 330
15c4dc5a 331 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
332 DbpString(temp);
e30c654b 333
15c4dc5a 334 FpgaGatherVersion(temp, sizeof(temp));
335 DbpString(temp);
4f269f63 336 // Send Chip ID
337 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
15c4dc5a 338}
339
340#ifdef WITH_LF
341// samy's sniff and repeat routine
342void SamyRun()
343{
344 DbpString("Stand-alone mode! No PC necessary.");
7cc204bf 345 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 346
347 // 3 possible options? no just 2 for now
348#define OPTS 2
349
350 int high[OPTS], low[OPTS];
351
352 // Oooh pretty -- notify user we're in elite samy mode now
353 LED(LED_RED, 200);
354 LED(LED_ORANGE, 200);
355 LED(LED_GREEN, 200);
356 LED(LED_ORANGE, 200);
357 LED(LED_RED, 200);
358 LED(LED_ORANGE, 200);
359 LED(LED_GREEN, 200);
360 LED(LED_ORANGE, 200);
361 LED(LED_RED, 200);
362
363 int selected = 0;
364 int playing = 0;
3fe4ff4f 365 int cardRead = 0;
15c4dc5a 366
367 // Turn on selected LED
368 LED(selected + 1, 0);
369
370 for (;;)
371 {
6e82300d 372 usb_poll();
373 WDT_HIT();
15c4dc5a 374
375 // Was our button held down or pressed?
376 int button_pressed = BUTTON_HELD(1000);
377 SpinDelay(300);
378
379 // Button was held for a second, begin recording
3fe4ff4f 380 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 381 {
382 LEDsoff();
383 LED(selected + 1, 0);
384 LED(LED_RED2, 0);
385
386 // record
387 DbpString("Starting recording");
388
389 // wait for button to be released
390 while(BUTTON_PRESS())
391 WDT_HIT();
392
393 /* need this delay to prevent catching some weird data */
394 SpinDelay(500);
395
396 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
397 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
398
399 LEDsoff();
400 LED(selected + 1, 0);
401 // Finished recording
402
403 // If we were previously playing, set playing off
404 // so next button push begins playing what we recorded
405 playing = 0;
3fe4ff4f 406
407 cardRead = 1;
408
409 }
410
411 else if (button_pressed > 0 && cardRead == 1)
412 {
413 LEDsoff();
414 LED(selected + 1, 0);
415 LED(LED_ORANGE, 0);
416
417 // record
418 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
419
420 // wait for button to be released
421 while(BUTTON_PRESS())
422 WDT_HIT();
423
424 /* need this delay to prevent catching some weird data */
425 SpinDelay(500);
426
427 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
428 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
429
430 LEDsoff();
431 LED(selected + 1, 0);
432 // Finished recording
433
434 // If we were previously playing, set playing off
435 // so next button push begins playing what we recorded
436 playing = 0;
437
438 cardRead = 0;
439
15c4dc5a 440 }
441
442 // Change where to record (or begin playing)
443 else if (button_pressed)
444 {
445 // Next option if we were previously playing
446 if (playing)
447 selected = (selected + 1) % OPTS;
448 playing = !playing;
449
450 LEDsoff();
451 LED(selected + 1, 0);
452
453 // Begin transmitting
454 if (playing)
455 {
456 LED(LED_GREEN, 0);
457 DbpString("Playing");
458 // wait for button to be released
459 while(BUTTON_PRESS())
460 WDT_HIT();
461 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
462 CmdHIDsimTAG(high[selected], low[selected], 0);
463 DbpString("Done playing");
464 if (BUTTON_HELD(1000) > 0)
465 {
466 DbpString("Exiting");
467 LEDsoff();
468 return;
469 }
470
471 /* We pressed a button so ignore it here with a delay */
472 SpinDelay(300);
473
474 // when done, we're done playing, move to next option
475 selected = (selected + 1) % OPTS;
476 playing = !playing;
477 LEDsoff();
478 LED(selected + 1, 0);
479 }
480 else
481 while(BUTTON_PRESS())
482 WDT_HIT();
483 }
484 }
485}
486#endif
487
488/*
489OBJECTIVE
490Listen and detect an external reader. Determine the best location
491for the antenna.
492
493INSTRUCTIONS:
494Inside the ListenReaderField() function, there is two mode.
495By default, when you call the function, you will enter mode 1.
496If you press the PM3 button one time, you will enter mode 2.
497If you press the PM3 button a second time, you will exit the function.
498
499DESCRIPTION OF MODE 1:
500This mode just listens for an external reader field and lights up green
501for HF and/or red for LF. This is the original mode of the detectreader
502function.
503
504DESCRIPTION OF MODE 2:
505This mode will visually represent, using the LEDs, the actual strength of the
506current compared to the maximum current detected. Basically, once you know
507what kind of external reader is present, it will help you spot the best location to place
508your antenna. You will probably not get some good results if there is a LF and a HF reader
509at the same place! :-)
510
511LIGHT SCHEME USED:
512*/
513static const char LIGHT_SCHEME[] = {
514 0x0, /* ---- | No field detected */
515 0x1, /* X--- | 14% of maximum current detected */
516 0x2, /* -X-- | 29% of maximum current detected */
517 0x4, /* --X- | 43% of maximum current detected */
518 0x8, /* ---X | 57% of maximum current detected */
519 0xC, /* --XX | 71% of maximum current detected */
520 0xE, /* -XXX | 86% of maximum current detected */
521 0xF, /* XXXX | 100% of maximum current detected */
522};
523static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
524
525void ListenReaderField(int limit)
526{
3b692427 527 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
528 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
15c4dc5a 529 int mode=1, display_val, display_max, i;
530
3b692427 531#define LF_ONLY 1
532#define HF_ONLY 2
533#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
534
535
536 // switch off FPGA - we don't want to measure our own signal
537 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
538 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 539
540 LEDsoff();
541
3b692427 542 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 543
544 if(limit != HF_ONLY) {
3b692427 545 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 546 lf_baseline = lf_av;
547 }
548
3b692427 549 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 550
551 if (limit != LF_ONLY) {
3b692427 552 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 553 hf_baseline = hf_av;
554 }
555
556 for(;;) {
557 if (BUTTON_PRESS()) {
558 SpinDelay(500);
559 switch (mode) {
560 case 1:
561 mode=2;
562 DbpString("Signal Strength Mode");
563 break;
564 case 2:
565 default:
566 DbpString("Stopped");
567 LEDsoff();
568 return;
569 break;
570 }
571 }
572 WDT_HIT();
573
574 if (limit != HF_ONLY) {
3b692427 575 if(mode == 1) {
576 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
577 LED_D_ON();
578 else
579 LED_D_OFF();
15c4dc5a 580 }
e30c654b 581
3b692427 582 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 583 // see if there's a significant change
3b692427 584 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
585 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 586 lf_av = lf_av_new;
587 if (lf_av > lf_max)
588 lf_max = lf_av;
15c4dc5a 589 }
590 }
591
592 if (limit != LF_ONLY) {
593 if (mode == 1){
3b692427 594 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
595 LED_B_ON();
596 else
597 LED_B_OFF();
15c4dc5a 598 }
e30c654b 599
3b692427 600 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 601 // see if there's a significant change
3b692427 602 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
603 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 604 hf_av = hf_av_new;
605 if (hf_av > hf_max)
606 hf_max = hf_av;
15c4dc5a 607 }
608 }
e30c654b 609
15c4dc5a 610 if(mode == 2) {
611 if (limit == LF_ONLY) {
612 display_val = lf_av;
613 display_max = lf_max;
614 } else if (limit == HF_ONLY) {
615 display_val = hf_av;
616 display_max = hf_max;
617 } else { /* Pick one at random */
618 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
619 display_val = hf_av;
620 display_max = hf_max;
621 } else {
622 display_val = lf_av;
623 display_max = lf_max;
624 }
625 }
626 for (i=0; i<LIGHT_LEN; i++) {
627 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
628 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
629 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
630 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
631 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
632 break;
633 }
634 }
635 }
636 }
637}
638
f7e3ed82 639void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 640{
641 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 642
902cb3c0 643// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
644
15c4dc5a 645 switch(c->cmd) {
646#ifdef WITH_LF
31abe49f
MHS
647 case CMD_SET_LF_SAMPLING_CONFIG:
648 setSamplingConfig((sample_config *) c->d.asBytes);
649 break;
15c4dc5a 650 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1fbf8956 651 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
15c4dc5a 652 break;
15c4dc5a 653 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
654 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
655 break;
b014c96d 656 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 657 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 658 break;
7e67e42f 659 case CMD_HID_DEMOD_FSK:
3fe4ff4f 660 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 661 break;
662 case CMD_HID_SIM_TAG:
3fe4ff4f 663 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 664 break;
abd6112f 665 case CMD_FSK_SIM_TAG:
666 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
667 break;
668 case CMD_ASK_SIM_TAG:
669 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
670 break;
872e3d4d 671 case CMD_PSK_SIM_TAG:
672 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
673 break;
674 case CMD_HID_CLONE_TAG:
1c611bbd 675 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 676 break;
a1f3bb12 677 case CMD_IO_DEMOD_FSK:
3fe4ff4f 678 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 679 break;
3fe4ff4f 680 case CMD_IO_CLONE_TAG:
a1f3bb12 681 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
682 break;
66707a3b 683 case CMD_EM410X_DEMOD:
684 CmdEM410xdemod(c->arg[0], 0, 0, 1);
685 break;
2d4eae76 686 case CMD_EM410X_WRITE_TAG:
687 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
688 break;
7e67e42f 689 case CMD_READ_TI_TYPE:
690 ReadTItag();
691 break;
692 case CMD_WRITE_TI_TYPE:
693 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
694 break;
695 case CMD_SIMULATE_TAG_125K:
31d1caa5 696 LED_A_ON();
7e67e42f 697 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
31d1caa5 698 LED_A_OFF();
7e67e42f 699 break;
700 case CMD_LF_SIMULATE_BIDIR:
701 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
702 break;
3fe4ff4f 703 case CMD_INDALA_CLONE_TAG:
2414f978 704 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
705 break;
3fe4ff4f 706 case CMD_INDALA_CLONE_TAG_L:
2414f978 707 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
708 break;
1c611bbd 709 case CMD_T55XX_READ_BLOCK:
710 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
711 break;
712 case CMD_T55XX_WRITE_BLOCK:
713 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
714 break;
3fe4ff4f 715 case CMD_T55XX_READ_TRACE:
1c611bbd 716 T55xxReadTrace();
717 break;
3fe4ff4f 718 case CMD_PCF7931_READ:
1c611bbd 719 ReadPCF7931();
720 cmd_send(CMD_ACK,0,0,0,0,0);
1c611bbd 721 break;
722 case CMD_EM4X_READ_WORD:
723 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
724 break;
725 case CMD_EM4X_WRITE_WORD:
726 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
727 break;
15c4dc5a 728#endif
729
d19929cb 730#ifdef WITH_HITAG
731 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
732 SnoopHitag(c->arg[0]);
733 break;
734 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
735 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
736 break;
737 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
738 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
739 break;
740#endif
f168b263 741
15c4dc5a 742#ifdef WITH_ISO15693
743 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
744 AcquireRawAdcSamplesIso15693();
745 break;
9455b51c 746 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
747 RecordRawAdcSamplesIso15693();
748 break;
749
750 case CMD_ISO_15693_COMMAND:
751 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
752 break;
753
754 case CMD_ISO_15693_FIND_AFI:
755 BruteforceIso15693Afi(c->arg[0]);
756 break;
757
758 case CMD_ISO_15693_DEBUG:
759 SetDebugIso15693(c->arg[0]);
760 break;
15c4dc5a 761
15c4dc5a 762 case CMD_READER_ISO_15693:
763 ReaderIso15693(c->arg[0]);
764 break;
7e67e42f 765 case CMD_SIMTAG_ISO_15693:
3fe4ff4f 766 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 767 break;
15c4dc5a 768#endif
769
7e67e42f 770#ifdef WITH_LEGICRF
771 case CMD_SIMULATE_TAG_LEGIC_RF:
772 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
773 break;
3612a8a8 774
7e67e42f 775 case CMD_WRITER_LEGIC_RF:
776 LegicRfWriter(c->arg[1], c->arg[0]);
777 break;
3612a8a8 778
15c4dc5a 779 case CMD_READER_LEGIC_RF:
780 LegicRfReader(c->arg[0], c->arg[1]);
781 break;
15c4dc5a 782#endif
783
784#ifdef WITH_ISO14443b
785 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
786 AcquireRawAdcSamplesIso14443(c->arg[0]);
787 break;
15c4dc5a 788 case CMD_READ_SRI512_TAG:
7cf3ef20 789 ReadSTMemoryIso14443(0x0F);
15c4dc5a 790 break;
7e67e42f 791 case CMD_READ_SRIX4K_TAG:
7cf3ef20 792 ReadSTMemoryIso14443(0x7F);
7e67e42f 793 break;
794 case CMD_SNOOP_ISO_14443:
795 SnoopIso14443();
796 break;
797 case CMD_SIMULATE_TAG_ISO_14443:
798 SimulateIso14443Tag();
799 break;
7cf3ef20 800 case CMD_ISO_14443B_COMMAND:
801 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
802 break;
15c4dc5a 803#endif
804
805#ifdef WITH_ISO14443a
7e67e42f 806 case CMD_SNOOP_ISO_14443a:
5cd9ec01 807 SnoopIso14443a(c->arg[0]);
7e67e42f 808 break;
15c4dc5a 809 case CMD_READER_ISO_14443a:
902cb3c0 810 ReaderIso14443a(c);
15c4dc5a 811 break;
7e67e42f 812 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 813 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 814 break;
3fe4ff4f 815
5acd09bd 816 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 817 EPA_PACE_Collect_Nonce(c);
5acd09bd 818 break;
3bb07d96
FM
819 case CMD_EPA_PACE_REPLAY:
820 EPA_PACE_Replay(c);
821 break;
7e67e42f 822
15c4dc5a 823 case CMD_READER_MIFARE:
f168b263 824 ReaderMifare(c->arg[0]);
15c4dc5a 825 break;
20f9a2a1
M
826 case CMD_MIFARE_READBL:
827 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
828 break;
981bd429 829 case CMD_MIFAREU_READBL:
f168b263 830 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 831 break;
8258f409 832 case CMD_MIFAREUC_AUTH:
833 MifareUC_Auth(c->arg[0],c->d.asBytes);
a631936e 834 break;
981bd429 835 case CMD_MIFAREU_READCARD:
75377d29 836 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 837 break;
f168b263 838 case CMD_MIFAREUC_SETPWD:
839 MifareUSetPwd(c->arg[0], c->d.asBytes);
840 break;
20f9a2a1
M
841 case CMD_MIFARE_READSC:
842 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
843 break;
844 case CMD_MIFARE_WRITEBL:
845 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
846 break;
4973f23d 847 //case CMD_MIFAREU_WRITEBL_COMPAT:
848 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
849 //break;
981bd429 850 case CMD_MIFAREU_WRITEBL:
4973f23d 851 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
f168b263 852 break;
20f9a2a1
M
853 case CMD_MIFARE_NESTED:
854 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
855 break;
856 case CMD_MIFARE_CHKKEYS:
857 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
858 break;
859 case CMD_SIMULATE_MIFARE_CARD:
860 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
861 break;
8556b852
M
862
863 // emulator
864 case CMD_MIFARE_SET_DBGMODE:
865 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
866 break;
867 case CMD_MIFARE_EML_MEMCLR:
868 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
869 break;
870 case CMD_MIFARE_EML_MEMSET:
871 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
872 break;
873 case CMD_MIFARE_EML_MEMGET:
874 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
875 break;
876 case CMD_MIFARE_EML_CARDLOAD:
877 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
878 break;
879
880 // Work with "magic Chinese" card
3fe4ff4f 881 case CMD_MIFARE_CSETBLOCK:
0675f200 882 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 883 break;
3fe4ff4f 884 case CMD_MIFARE_CGETBLOCK:
545a1f38 885 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 886 break;
3fe4ff4f 887 case CMD_MIFARE_CIDENT:
888 MifareCIdent();
889 break;
b62a5a84
M
890
891 // mifare sniffer
892 case CMD_MIFARE_SNIFFER:
5cd9ec01 893 SniffMifare(c->arg[0]);
b62a5a84 894 break;
a631936e 895
20f9a2a1
M
896#endif
897
7e67e42f 898#ifdef WITH_ICLASS
cee5a30d 899 // Makes use of ISO14443a FPGA Firmware
900 case CMD_SNOOP_ICLASS:
901 SnoopIClass();
902 break;
1e262141 903 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 904 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 905 break;
906 case CMD_READER_ICLASS:
907 ReaderIClass(c->arg[0]);
908 break;
c3963755 909 case CMD_READER_ICLASS_REPLAY:
fecd8202 910 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 911 break;
e80aeb96
MHS
912 case CMD_ICLASS_EML_MEMSET:
913 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
914 break;
cee5a30d 915#endif
916
15c4dc5a 917 case CMD_SIMULATE_TAG_HF_LISTEN:
918 SimulateTagHfListen();
919 break;
920
7e67e42f 921 case CMD_BUFF_CLEAR:
117d9ec2 922 BigBuf_Clear();
15c4dc5a 923 break;
15c4dc5a 924
925 case CMD_MEASURE_ANTENNA_TUNING:
926 MeasureAntennaTuning();
927 break;
928
929 case CMD_MEASURE_ANTENNA_TUNING_HF:
930 MeasureAntennaTuningHf();
931 break;
932
933 case CMD_LISTEN_READER_FIELD:
934 ListenReaderField(c->arg[0]);
935 break;
936
15c4dc5a 937 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
938 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
939 SpinDelay(200);
940 LED_D_OFF(); // LED D indicates field ON or OFF
941 break;
942
1c611bbd 943 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 944
1c611bbd 945 LED_B_ON();
117d9ec2 946 uint8_t *BigBuf = BigBuf_get_addr();
1c611bbd 947 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
948 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 949 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 950 }
951 // Trigger a finish downloading signal with an ACK frame
3000dc4e 952 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 953 LED_B_OFF();
1c611bbd 954 break;
15c4dc5a 955
956 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
117d9ec2 957 uint8_t *b = BigBuf_get_addr();
3fe4ff4f 958 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 959 cmd_send(CMD_ACK,0,0,0,0,0);
960 break;
961 }
15c4dc5a 962 case CMD_READ_MEM:
963 ReadMem(c->arg[0]);
964 break;
965
966 case CMD_SET_LF_DIVISOR:
7cc204bf 967 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 968 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
969 break;
970
971 case CMD_SET_ADC_MUX:
972 switch(c->arg[0]) {
973 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
974 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
975 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
976 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
977 }
978 break;
979
980 case CMD_VERSION:
981 SendVersion();
982 break;
983
15c4dc5a 984#ifdef WITH_LCD
985 case CMD_LCD_RESET:
986 LCDReset();
987 break;
988 case CMD_LCD:
989 LCDSend(c->arg[0]);
990 break;
991#endif
992 case CMD_SETUP_WRITE:
993 case CMD_FINISH_WRITE:
1c611bbd 994 case CMD_HARDWARE_RESET:
995 usb_disable();
15c4dc5a 996 SpinDelay(1000);
997 SpinDelay(1000);
998 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
999 for(;;) {
1000 // We're going to reset, and the bootrom will take control.
1001 }
1c611bbd 1002 break;
15c4dc5a 1003
1c611bbd 1004 case CMD_START_FLASH:
15c4dc5a 1005 if(common_area.flags.bootrom_present) {
1006 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1007 }
1c611bbd 1008 usb_disable();
15c4dc5a 1009 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1010 for(;;);
1c611bbd 1011 break;
e30c654b 1012
15c4dc5a 1013 case CMD_DEVICE_INFO: {
902cb3c0 1014 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1015 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1016 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1017 break;
1018 }
1019 default:
15c4dc5a 1020 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1021 break;
15c4dc5a 1022 }
1023}
1024
1025void __attribute__((noreturn)) AppMain(void)
1026{
1027 SpinDelay(100);
9e8255d4 1028 clear_trace();
15c4dc5a 1029 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1030 /* Initialize common area */
1031 memset(&common_area, 0, sizeof(common_area));
1032 common_area.magic = COMMON_AREA_MAGIC;
1033 common_area.version = 1;
1034 }
1035 common_area.flags.osimage_present = 1;
1036
1037 LED_D_OFF();
1038 LED_C_OFF();
1039 LED_B_OFF();
1040 LED_A_OFF();
1041
3fe4ff4f 1042 // Init USB device
902cb3c0 1043 usb_enable();
15c4dc5a 1044
1045 // The FPGA gets its clock from us from PCK0 output, so set that up.
1046 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1047 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1048 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1049 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1050 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1051 AT91C_PMC_PRES_CLK_4;
1052 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1053
1054 // Reset SPI
1055 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1056 // Reset SSC
1057 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1058
1059 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1060 // (the HF version by default)
1061 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1062
9ca155ba 1063 StartTickCount();
902cb3c0 1064
15c4dc5a 1065#ifdef WITH_LCD
15c4dc5a 1066 LCDInit();
15c4dc5a 1067#endif
1068
902cb3c0 1069 byte_t rx[sizeof(UsbCommand)];
1070 size_t rx_len;
1071
15c4dc5a 1072 for(;;) {
902cb3c0 1073 if (usb_poll()) {
1074 rx_len = usb_read(rx,sizeof(UsbCommand));
1075 if (rx_len) {
1076 UsbPacketReceived(rx,rx_len);
1077 }
1078 }
15c4dc5a 1079 WDT_HIT();
1080
1081#ifdef WITH_LF
1082 if (BUTTON_HELD(1000) > 0)
1083 SamyRun();
1084#endif
1085 }
1086}
Impressum, Datenschutz