| 1 | //----------------------------------------------------------------------------- |
| 2 | // Jonathan Westhues, Aug 2005 |
| 3 | // Gerhard de Koning Gans, April 2008, May 2011 |
| 4 | // |
| 5 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| 6 | // at your option, any later version. See the LICENSE.txt file for the text of |
| 7 | // the license. |
| 8 | //----------------------------------------------------------------------------- |
| 9 | // Definitions internal to the app source. |
| 10 | //----------------------------------------------------------------------------- |
| 11 | |
| 12 | #ifndef __APPS_H |
| 13 | #define __APPS_H |
| 14 | |
| 15 | #include <stdint.h> |
| 16 | #include <stddef.h> |
| 17 | #include <stdlib.h> |
| 18 | #include <sys/types.h> |
| 19 | #include <string.h> |
| 20 | #include <strings.h> |
| 21 | #include "../common/crc32.h" |
| 22 | #include "BigBuf.h" |
| 23 | #include "../include/hitag2.h" |
| 24 | #include "../include/mifare.h" |
| 25 | //#include "des.h" |
| 26 | //#include "aes.h" |
| 27 | #include "desfire.h" |
| 28 | |
| 29 | |
| 30 | extern const uint8_t OddByteParity[256]; |
| 31 | extern int rsamples; // = 0; |
| 32 | extern int tracing; // = TRUE; |
| 33 | extern uint8_t trigger; |
| 34 | |
| 35 | // This may be used (sparingly) to declare a function to be copied to |
| 36 | // and executed from RAM |
| 37 | #define RAMFUNC __attribute((long_call, section(".ramfunc"))) |
| 38 | |
| 39 | /// appmain.h |
| 40 | void ReadMem(int addr); |
| 41 | void __attribute__((noreturn)) AppMain(void); |
| 42 | void SamyRun(void); |
| 43 | //void DbpIntegers(int a, int b, int c); |
| 44 | void DbpString(char *str); |
| 45 | void Dbprintf(const char *fmt, ...); |
| 46 | void Dbhexdump(int len, uint8_t *d, bool bAsci); |
| 47 | |
| 48 | // ADC Vref = 3300mV, and an (10M+1M):1M voltage divider on the HF input can measure voltages up to 36300 mV |
| 49 | #define MAX_ADC_HF_VOLTAGE 36300 |
| 50 | // ADC Vref = 3300mV, and an (10000k+240k):240k voltage divider on the LF input can measure voltages up to 140800 mV |
| 51 | #define MAX_ADC_LF_VOLTAGE 140800 |
| 52 | int AvgAdc(int ch); |
| 53 | |
| 54 | void ToSendStuffBit(int b); |
| 55 | void ToSendReset(void); |
| 56 | void ListenReaderField(int limit); |
| 57 | extern int ToSendMax; |
| 58 | extern uint8_t ToSend[]; |
| 59 | |
| 60 | /// fpga.h |
| 61 | void FpgaSendCommand(uint16_t cmd, uint16_t v); |
| 62 | void FpgaWriteConfWord(uint8_t v); |
| 63 | void FpgaDownloadAndGo(int bitstream_version); |
| 64 | int FpgaGatherBitstreamVersion(); |
| 65 | void FpgaGatherVersion(char *dst, int len); |
| 66 | void FpgaSetupSsc(void); |
| 67 | void SetupSpi(int mode); |
| 68 | bool FpgaSetupSscDma(uint8_t *buf, int len); |
| 69 | #define FpgaDisableSscDma(void) AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; |
| 70 | #define FpgaEnableSscDma(void) AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTEN; |
| 71 | void SetAdcMuxFor(uint32_t whichGpio); |
| 72 | |
| 73 | // Definitions for the FPGA commands. |
| 74 | #define FPGA_CMD_SET_CONFREG (1<<12) |
| 75 | #define FPGA_CMD_SET_DIVISOR (2<<12) |
| 76 | #define FPGA_CMD_SET_USER_BYTE1 (3<<12) |
| 77 | // Definitions for the FPGA configuration word. |
| 78 | // LF |
| 79 | #define FPGA_MAJOR_MODE_LF_ADC (0<<5) |
| 80 | #define FPGA_MAJOR_MODE_LF_EDGE_DETECT (1<<5) |
| 81 | #define FPGA_MAJOR_MODE_LF_PASSTHRU (2<<5) |
| 82 | // HF |
| 83 | #define FPGA_MAJOR_MODE_HF_READER_TX (0<<5) |
| 84 | #define FPGA_MAJOR_MODE_HF_READER_RX_XCORR (1<<5) |
| 85 | #define FPGA_MAJOR_MODE_HF_SIMULATOR (2<<5) |
| 86 | #define FPGA_MAJOR_MODE_HF_ISO14443A (3<<5) |
| 87 | // BOTH |
| 88 | #define FPGA_MAJOR_MODE_OFF (7<<5) |
| 89 | // Options for LF_ADC |
| 90 | #define FPGA_LF_ADC_READER_FIELD (1<<0) |
| 91 | // Options for LF_EDGE_DETECT |
| 92 | #define FPGA_CMD_SET_EDGE_DETECT_THRESHOLD FPGA_CMD_SET_USER_BYTE1 |
| 93 | #define FPGA_LF_EDGE_DETECT_READER_FIELD (1<<0) |
| 94 | #define FPGA_LF_EDGE_DETECT_TOGGLE_MODE (1<<1) |
| 95 | // Options for the HF reader, tx to tag |
| 96 | #define FPGA_HF_READER_TX_SHALLOW_MOD (1<<0) |
| 97 | // Options for the HF reader, correlating against rx from tag |
| 98 | #define FPGA_HF_READER_RX_XCORR_848_KHZ (1<<0) |
| 99 | #define FPGA_HF_READER_RX_XCORR_SNOOP (1<<1) |
| 100 | #define FPGA_HF_READER_RX_XCORR_QUARTER_FREQ (1<<2) |
| 101 | // Options for the HF simulated tag, how to modulate |
| 102 | #define FPGA_HF_SIMULATOR_NO_MODULATION (0<<0) |
| 103 | #define FPGA_HF_SIMULATOR_MODULATE_BPSK (1<<0) |
| 104 | #define FPGA_HF_SIMULATOR_MODULATE_212K (2<<0) |
| 105 | #define FPGA_HF_SIMULATOR_MODULATE_424K (4<<0) |
| 106 | #define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT 0x5//101 |
| 107 | |
| 108 | // Options for ISO14443A |
| 109 | #define FPGA_HF_ISO14443A_SNIFFER (0<<0) |
| 110 | #define FPGA_HF_ISO14443A_TAGSIM_LISTEN (1<<0) |
| 111 | #define FPGA_HF_ISO14443A_TAGSIM_MOD (2<<0) |
| 112 | #define FPGA_HF_ISO14443A_READER_LISTEN (3<<0) |
| 113 | #define FPGA_HF_ISO14443A_READER_MOD (4<<0) |
| 114 | |
| 115 | /// lfops.h |
| 116 | extern uint8_t decimation; |
| 117 | extern uint8_t bits_per_sample ; |
| 118 | extern bool averaging; |
| 119 | |
| 120 | void AcquireRawAdcSamples125k(int divisor); |
| 121 | void ModThenAcquireRawAdcSamples125k(int delay_off,int period_0,int period_1,uint8_t *command); |
| 122 | void ReadTItag(void); |
| 123 | void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc); |
| 124 | void AcquireTiType(void); |
| 125 | void AcquireRawBitsTI(void); |
| 126 | void SimulateTagLowFrequency( uint16_t period, uint32_t gap, uint8_t ledcontrol); |
| 127 | //void SimulateTagLowFrequencyA(int period, int gap); |
| 128 | |
| 129 | void CmdHIDsimTAG(int hi, int lo, int ledcontrol); |
| 130 | void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream); |
| 131 | void CmdASKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream); |
| 132 | void CmdPSKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream); |
| 133 | void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol); |
| 134 | void CmdEM410xdemod(int findone, int *high, int *low, int ledcontrol); |
| 135 | void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol); |
| 136 | void CopyIOtoT55x7(uint32_t hi, uint32_t lo, uint8_t longFMT); // Clone an ioProx card to T5557/T5567 |
| 137 | void SimulateTagLowFrequencyBidir(int divisor, int max_bitlen); |
| 138 | void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT); // Clone an HID card to T5557/T5567 |
| 139 | void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo); |
| 140 | void CopyIndala64toT55x7(int hi, int lo); // Clone Indala 64-bit tag by UID to T55x7 |
| 141 | void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int uid6, int uid7); // Clone Indala 224-bit tag by UID to T55x7 |
| 142 | void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode); |
| 143 | void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode ); |
| 144 | void T55xxReadTrace(void); |
| 145 | void TurnReadLFOn(); |
| 146 | int DemodPCF7931(uint8_t **outBlocks); |
| 147 | int IsBlock0PCF7931(uint8_t *Block); |
| 148 | int IsBlock1PCF7931(uint8_t *Block); |
| 149 | void ReadPCF7931(); |
| 150 | void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode); |
| 151 | void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode); |
| 152 | |
| 153 | /// iso14443.h |
| 154 | void SimulateIso14443Tag(void); |
| 155 | void AcquireRawAdcSamplesIso14443(uint32_t parameter); |
| 156 | void ReadSTMemoryIso14443(uint32_t); |
| 157 | void RAMFUNC SnoopIso14443(void); |
| 158 | void SendRawCommand14443B(uint32_t, uint32_t, uint8_t, uint8_t[]); |
| 159 | |
| 160 | /// iso14443a.h |
| 161 | void RAMFUNC SnoopIso14443a(uint8_t param); |
| 162 | void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data); |
| 163 | void ReaderIso14443a(UsbCommand * c); |
| 164 | // Also used in iclass.c |
| 165 | bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t len, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag); |
| 166 | void GetParity(const uint8_t *pbtCmd, uint16_t len, uint8_t *parity); |
| 167 | void iso14a_set_trigger(bool enable); |
| 168 | |
| 169 | void RAMFUNC SniffMifare(uint8_t param); |
| 170 | |
| 171 | /// epa.h |
| 172 | void EPA_PACE_Collect_Nonce(UsbCommand * c); |
| 173 | |
| 174 | // mifarecmd.h |
| 175 | void ReaderMifare(bool first_try); |
| 176 | int32_t dist_nt(uint32_t nt1, uint32_t nt2); |
| 177 | void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data); |
| 178 | void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain); |
| 179 | void MifareUC_Auth1(uint8_t arg0, uint8_t *datain); |
| 180 | void MifareUC_Auth2(uint32_t arg0, uint8_t *datain); |
| 181 | void MifareUReadCard(uint8_t arg0, int Pages, uint8_t *datain); |
| 182 | void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); |
| 183 | void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); |
| 184 | void MifareUWriteBlock(uint8_t arg0,uint8_t *datain); |
| 185 | void MifareUWriteBlock_Special(uint8_t arg0,uint8_t *datain); |
| 186 | void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); |
| 187 | void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); |
| 188 | void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); |
| 189 | void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); |
| 190 | void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); |
| 191 | void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); |
| 192 | void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); |
| 193 | void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); |
| 194 | void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); // Work with "magic Chinese" card |
| 195 | void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); |
| 196 | void MifareCIdent(); // is "magic chinese" card? |
| 197 | void MifareUSetPwd(uint8_t arg0, uint8_t *datain); |
| 198 | |
| 199 | //desfire |
| 200 | void Mifare_DES_Auth1(uint8_t arg0,uint8_t *datain); |
| 201 | void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain); |
| 202 | |
| 203 | // mifaredesfire.h |
| 204 | bool InitDesfireCard(); |
| 205 | void MifareSendCommand(uint8_t arg0,uint8_t arg1, uint8_t *datain); |
| 206 | void MifareDesfireGetInformation(); |
| 207 | void MifareDES_Auth1(uint8_t arg0,uint8_t arg1,uint8_t arg2, uint8_t *datain); |
| 208 | void ReaderMifareDES(uint32_t param, uint32_t param2, uint8_t * datain); |
| 209 | int DesfireAPDU(uint8_t *cmd, size_t cmd_len, uint8_t *dataout); |
| 210 | size_t CreateAPDU( uint8_t *datain, size_t len, uint8_t *dataout); |
| 211 | void OnSuccess(); |
| 212 | void OnError(uint8_t reason); |
| 213 | |
| 214 | |
| 215 | |
| 216 | // desfire_crypto.h |
| 217 | void *mifare_cryto_preprocess_data (desfiretag_t tag, void *data, size_t *nbytes, off_t offset, int communication_settings); |
| 218 | void *mifare_cryto_postprocess_data (desfiretag_t tag, void *data, ssize_t *nbytes, int communication_settings); |
| 219 | void mifare_cypher_single_block (desfirekey_t key, uint8_t *data, uint8_t *ivect, MifareCryptoDirection direction, MifareCryptoOperation operation, size_t block_size); |
| 220 | void mifare_cypher_blocks_chained (desfiretag_t tag, desfirekey_t key, uint8_t *ivect, uint8_t *data, size_t data_size, MifareCryptoDirection direction, MifareCryptoOperation operation); |
| 221 | size_t key_block_size (const desfirekey_t key); |
| 222 | size_t padded_data_length (const size_t nbytes, const size_t block_size); |
| 223 | size_t maced_data_length (const desfirekey_t key, const size_t nbytes); |
| 224 | size_t enciphered_data_length (const desfiretag_t tag, const size_t nbytes, int communication_settings); |
| 225 | void cmac_generate_subkeys (desfirekey_t key); |
| 226 | void cmac (const desfirekey_t key, uint8_t *ivect, const uint8_t *data, size_t len, uint8_t *cmac); |
| 227 | |
| 228 | |
| 229 | /// iso15693.h |
| 230 | void RecordRawAdcSamplesIso15693(void); |
| 231 | void AcquireRawAdcSamplesIso15693(void); |
| 232 | void ReaderIso15693(uint32_t parameter); // Simulate an ISO15693 reader - greg |
| 233 | void SimTagIso15693(uint32_t parameter, uint8_t *uid); // simulate an ISO15693 tag - greg |
| 234 | void BruteforceIso15693Afi(uint32_t speed); // find an AFI of a tag - atrox |
| 235 | void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]); // send arbitrary commands from CLI - atrox |
| 236 | void SetDebugIso15693(uint32_t flag); |
| 237 | |
| 238 | /// iclass.h |
| 239 | void RAMFUNC SnoopIClass(void); |
| 240 | void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); |
| 241 | void ReaderIClass(uint8_t arg0); |
| 242 | void ReaderIClass_Replay(uint8_t arg0,uint8_t *MAC); |
| 243 | void IClass_iso14443A_GetPublic(uint8_t arg0); |
| 244 | |
| 245 | // hitag2.h |
| 246 | void SnoopHitag(uint32_t type); |
| 247 | void SimulateHitagTag(bool tag_mem_supplied, byte_t* data); |
| 248 | void ReaderHitag(hitag_function htf, hitag_data* htd); |
| 249 | |
| 250 | // cmd.h |
| 251 | bool cmd_receive(UsbCommand* cmd); |
| 252 | bool cmd_send(uint32_t cmd, uint32_t arg0, uint32_t arg1, uint32_t arg2, void* data, size_t len); |
| 253 | |
| 254 | /// util.h |
| 255 | |
| 256 | #endif |