]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: @marshmellow42 's help text changes to the reveng
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21 #include <stdarg.h>
22 #include "legicrf.h"
23 #include <hitag2.h>
24 #include "lfsampling.h"
25 #include "BigBuf.h"
26
27 #ifdef WITH_LCD
28 #include "LCD.h"
29 #endif
30
31 #define abs(x) ( ((x)<0) ? -(x) : (x) )
32
33 //=============================================================================
34 // A buffer where we can queue things up to be sent through the FPGA, for
35 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
36 // is the order in which they go out on the wire.
37 //=============================================================================
38
39 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
40 uint8_t ToSend[TOSEND_BUFFER_SIZE];
41 int ToSendMax;
42 static int ToSendBit;
43 struct common_area common_area __attribute__((section(".commonarea")));
44
45 void ToSendReset(void)
46 {
47 ToSendMax = -1;
48 ToSendBit = 8;
49 }
50
51 void ToSendStuffBit(int b)
52 {
53 if(ToSendBit >= 8) {
54 ToSendMax++;
55 ToSend[ToSendMax] = 0;
56 ToSendBit = 0;
57 }
58
59 if(b) {
60 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
61 }
62
63 ToSendBit++;
64
65 if(ToSendMax >= sizeof(ToSend)) {
66 ToSendBit = 0;
67 DbpString("ToSendStuffBit overflowed!");
68 }
69 }
70
71 //=============================================================================
72 // Debug print functions, to go out over USB, to the usual PC-side client.
73 //=============================================================================
74
75 void DbpString(char *str)
76 {
77 byte_t len = strlen(str);
78 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
79 }
80
81 #if 0
82 void DbpIntegers(int x1, int x2, int x3)
83 {
84 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
85 }
86 #endif
87
88 void Dbprintf(const char *fmt, ...) {
89 // should probably limit size here; oh well, let's just use a big buffer
90 char output_string[128];
91 va_list ap;
92
93 va_start(ap, fmt);
94 kvsprintf(fmt, output_string, 10, ap);
95 va_end(ap);
96
97 DbpString(output_string);
98 }
99
100 // prints HEX & ASCII
101 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
102 int l=0,i;
103 char ascii[9];
104
105 while (len>0) {
106 if (len>8) l=8;
107 else l=len;
108
109 memcpy(ascii,d,l);
110 ascii[l]=0;
111
112 // filter safe ascii
113 for (i=0;i<l;i++)
114 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
115
116 if (bAsci) {
117 Dbprintf("%-8s %*D",ascii,l,d," ");
118 } else {
119 Dbprintf("%*D",l,d," ");
120 }
121
122 len-=8;
123 d+=8;
124 }
125 }
126
127 //-----------------------------------------------------------------------------
128 // Read an ADC channel and block till it completes, then return the result
129 // in ADC units (0 to 1023). Also a routine to average 32 samples and
130 // return that.
131 //-----------------------------------------------------------------------------
132 static int ReadAdc(int ch)
133 {
134 uint32_t d;
135
136 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
137 AT91C_BASE_ADC->ADC_MR =
138 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
139 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
140 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
141
142 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
143 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
144 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
145 //
146 // The maths are:
147 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
148 //
149 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
150 //
151 // Note: with the "historic" values in the comments above, the error was 34% !!!
152
153 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
154
155 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
156
157 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
158 ;
159 d = AT91C_BASE_ADC->ADC_CDR[ch];
160
161 return d;
162 }
163
164 int AvgAdc(int ch) // was static - merlok
165 {
166 int i;
167 int a = 0;
168
169 for(i = 0; i < 32; i++) {
170 a += ReadAdc(ch);
171 }
172
173 return (a + 15) >> 5;
174 }
175
176 void MeasureAntennaTuning(void)
177 {
178 uint8_t LF_Results[256];
179 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
180 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
181
182 LED_B_ON();
183
184 /*
185 * Sweeps the useful LF range of the proxmark from
186 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
187 * read the voltage in the antenna, the result left
188 * in the buffer is a graph which should clearly show
189 * the resonating frequency of your LF antenna
190 * ( hopefully around 95 if it is tuned to 125kHz!)
191 */
192
193 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
194 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
195 for (i=255; i>=19; i--) {
196 WDT_HIT();
197 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
198 SpinDelay(20);
199 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
200 if (i==95) vLf125 = adcval; // voltage at 125Khz
201 if (i==89) vLf134 = adcval; // voltage at 134Khz
202
203 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
204 if(LF_Results[i] > peak) {
205 peakv = adcval;
206 peak = LF_Results[i];
207 peakf = i;
208 //ptr = i;
209 }
210 }
211
212 for (i=18; i >= 0; i--) LF_Results[i] = 0;
213
214 LED_A_ON();
215 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
216 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
217 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
218 SpinDelay(20);
219 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
220
221 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
222 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
223 LED_A_OFF();
224 LED_B_OFF();
225 return;
226 }
227
228 void MeasureAntennaTuningHf(void)
229 {
230 int vHf = 0; // in mV
231
232 DbpString("Measuring HF antenna, press button to exit");
233
234 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
235 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
236 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
237
238 for (;;) {
239 SpinDelay(20);
240 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
241
242 Dbprintf("%d mV",vHf);
243 if (BUTTON_PRESS()) break;
244 }
245 DbpString("cancelled");
246
247 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
248
249 }
250
251
252 void SimulateTagHfListen(void)
253 {
254 // ToDo: historically this used the free buffer, which was 2744 Bytes long.
255 // There might be a better size to be defined:
256 #define HF_14B_SNOOP_BUFFER_SIZE 2744
257 uint8_t *dest = BigBuf_malloc(HF_14B_SNOOP_BUFFER_SIZE);
258 uint8_t v = 0;
259 int i;
260 int p = 0;
261
262 // We're using this mode just so that I can test it out; the simulated
263 // tag mode would work just as well and be simpler.
264 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
265 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
266
267 // We need to listen to the high-frequency, peak-detected path.
268 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
269
270 FpgaSetupSsc();
271
272 i = 0;
273 for(;;) {
274 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
275 AT91C_BASE_SSC->SSC_THR = 0xff;
276 }
277 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
278 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
279
280 v <<= 1;
281 if(r & 1) {
282 v |= 1;
283 }
284 p++;
285
286 if(p >= 8) {
287 dest[i] = v;
288 v = 0;
289 p = 0;
290 i++;
291
292 if(i >= HF_14B_SNOOP_BUFFER_SIZE) {
293 break;
294 }
295 }
296 }
297 }
298 DbpString("simulate tag (now type bitsamples)");
299 }
300
301 void ReadMem(int addr)
302 {
303 const uint8_t *data = ((uint8_t *)addr);
304
305 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
306 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
307 }
308
309 /* osimage version information is linked in */
310 extern struct version_information version_information;
311 /* bootrom version information is pointed to from _bootphase1_version_pointer */
312 extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
313 void SendVersion(void)
314 {
315 char temp[512]; /* Limited data payload in USB packets */
316 DbpString("Prox/RFID mark3 RFID instrument");
317
318 /* Try to find the bootrom version information. Expect to find a pointer at
319 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
320 * pointer, then use it.
321 */
322 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
323 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
324 DbpString("bootrom version information appears invalid");
325 } else {
326 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
327 DbpString(temp);
328 }
329
330 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
331 DbpString(temp);
332
333 FpgaGatherVersion(temp, sizeof(temp));
334 DbpString(temp);
335 // Send Chip ID
336 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
337 }
338
339 #ifdef WITH_LF
340 // samy's sniff and repeat routine
341 void SamyRun()
342 {
343 DbpString("Stand-alone mode! No PC necessary.");
344 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
345
346 // 3 possible options? no just 2 for now
347 #define OPTS 2
348
349 int high[OPTS], low[OPTS];
350
351 // Oooh pretty -- notify user we're in elite samy mode now
352 LED(LED_RED, 200);
353 LED(LED_ORANGE, 200);
354 LED(LED_GREEN, 200);
355 LED(LED_ORANGE, 200);
356 LED(LED_RED, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_GREEN, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_RED, 200);
361
362 int selected = 0;
363 int playing = 0;
364 int cardRead = 0;
365
366 // Turn on selected LED
367 LED(selected + 1, 0);
368
369 for (;;)
370 {
371 usb_poll();
372 WDT_HIT();
373
374 // Was our button held down or pressed?
375 int button_pressed = BUTTON_HELD(1000);
376 SpinDelay(300);
377
378 // Button was held for a second, begin recording
379 if (button_pressed > 0 && cardRead == 0)
380 {
381 LEDsoff();
382 LED(selected + 1, 0);
383 LED(LED_RED2, 0);
384
385 // record
386 DbpString("Starting recording");
387
388 // wait for button to be released
389 while(BUTTON_PRESS())
390 WDT_HIT();
391
392 /* need this delay to prevent catching some weird data */
393 SpinDelay(500);
394
395 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
396 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
397
398 LEDsoff();
399 LED(selected + 1, 0);
400 // Finished recording
401
402 // If we were previously playing, set playing off
403 // so next button push begins playing what we recorded
404 playing = 0;
405
406 cardRead = 1;
407
408 }
409
410 else if (button_pressed > 0 && cardRead == 1)
411 {
412 LEDsoff();
413 LED(selected + 1, 0);
414 LED(LED_ORANGE, 0);
415
416 // record
417 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
418
419 // wait for button to be released
420 while(BUTTON_PRESS())
421 WDT_HIT();
422
423 /* need this delay to prevent catching some weird data */
424 SpinDelay(500);
425
426 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
427 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
428
429 LEDsoff();
430 LED(selected + 1, 0);
431 // Finished recording
432
433 // If we were previously playing, set playing off
434 // so next button push begins playing what we recorded
435 playing = 0;
436
437 cardRead = 0;
438
439 }
440
441 // Change where to record (or begin playing)
442 else if (button_pressed)
443 {
444 // Next option if we were previously playing
445 if (playing)
446 selected = (selected + 1) % OPTS;
447 playing = !playing;
448
449 LEDsoff();
450 LED(selected + 1, 0);
451
452 // Begin transmitting
453 if (playing)
454 {
455 LED(LED_GREEN, 0);
456 DbpString("Playing");
457 // wait for button to be released
458 while(BUTTON_PRESS())
459 WDT_HIT();
460 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
461 CmdHIDsimTAG(high[selected], low[selected], 0);
462 DbpString("Done playing");
463 if (BUTTON_HELD(1000) > 0)
464 {
465 DbpString("Exiting");
466 LEDsoff();
467 return;
468 }
469
470 /* We pressed a button so ignore it here with a delay */
471 SpinDelay(300);
472
473 // when done, we're done playing, move to next option
474 selected = (selected + 1) % OPTS;
475 playing = !playing;
476 LEDsoff();
477 LED(selected + 1, 0);
478 }
479 else
480 while(BUTTON_PRESS())
481 WDT_HIT();
482 }
483 }
484 }
485 #endif
486
487 /*
488 OBJECTIVE
489 Listen and detect an external reader. Determine the best location
490 for the antenna.
491
492 INSTRUCTIONS:
493 Inside the ListenReaderField() function, there is two mode.
494 By default, when you call the function, you will enter mode 1.
495 If you press the PM3 button one time, you will enter mode 2.
496 If you press the PM3 button a second time, you will exit the function.
497
498 DESCRIPTION OF MODE 1:
499 This mode just listens for an external reader field and lights up green
500 for HF and/or red for LF. This is the original mode of the detectreader
501 function.
502
503 DESCRIPTION OF MODE 2:
504 This mode will visually represent, using the LEDs, the actual strength of the
505 current compared to the maximum current detected. Basically, once you know
506 what kind of external reader is present, it will help you spot the best location to place
507 your antenna. You will probably not get some good results if there is a LF and a HF reader
508 at the same place! :-)
509
510 LIGHT SCHEME USED:
511 */
512 static const char LIGHT_SCHEME[] = {
513 0x0, /* ---- | No field detected */
514 0x1, /* X--- | 14% of maximum current detected */
515 0x2, /* -X-- | 29% of maximum current detected */
516 0x4, /* --X- | 43% of maximum current detected */
517 0x8, /* ---X | 57% of maximum current detected */
518 0xC, /* --XX | 71% of maximum current detected */
519 0xE, /* -XXX | 86% of maximum current detected */
520 0xF, /* XXXX | 100% of maximum current detected */
521 };
522 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
523
524 void ListenReaderField(int limit)
525 {
526 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
527 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
528 int mode=1, display_val, display_max, i;
529
530 #define LF_ONLY 1
531 #define HF_ONLY 2
532 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
533
534
535 // switch off FPGA - we don't want to measure our own signal
536 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
537 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
538
539 LEDsoff();
540
541 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
542
543 if(limit != HF_ONLY) {
544 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
545 lf_baseline = lf_av;
546 }
547
548 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
549
550 if (limit != LF_ONLY) {
551 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
552 hf_baseline = hf_av;
553 }
554
555 for(;;) {
556 if (BUTTON_PRESS()) {
557 SpinDelay(500);
558 switch (mode) {
559 case 1:
560 mode=2;
561 DbpString("Signal Strength Mode");
562 break;
563 case 2:
564 default:
565 DbpString("Stopped");
566 LEDsoff();
567 return;
568 break;
569 }
570 }
571 WDT_HIT();
572
573 if (limit != HF_ONLY) {
574 if(mode == 1) {
575 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
576 LED_D_ON();
577 else
578 LED_D_OFF();
579 }
580
581 lf_av_new = AvgAdc(ADC_CHAN_LF);
582 // see if there's a significant change
583 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
584 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
585 lf_av = lf_av_new;
586 if (lf_av > lf_max)
587 lf_max = lf_av;
588 }
589 }
590
591 if (limit != LF_ONLY) {
592 if (mode == 1){
593 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
594 LED_B_ON();
595 else
596 LED_B_OFF();
597 }
598
599 hf_av_new = AvgAdc(ADC_CHAN_HF);
600 // see if there's a significant change
601 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
602 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
603 hf_av = hf_av_new;
604 if (hf_av > hf_max)
605 hf_max = hf_av;
606 }
607 }
608
609 if(mode == 2) {
610 if (limit == LF_ONLY) {
611 display_val = lf_av;
612 display_max = lf_max;
613 } else if (limit == HF_ONLY) {
614 display_val = hf_av;
615 display_max = hf_max;
616 } else { /* Pick one at random */
617 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
618 display_val = hf_av;
619 display_max = hf_max;
620 } else {
621 display_val = lf_av;
622 display_max = lf_max;
623 }
624 }
625 for (i=0; i<LIGHT_LEN; i++) {
626 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
627 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
628 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
629 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
630 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
631 break;
632 }
633 }
634 }
635 }
636 }
637
638 void UsbPacketReceived(uint8_t *packet, int len)
639 {
640 UsbCommand *c = (UsbCommand *)packet;
641
642 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
643
644 switch(c->cmd) {
645 #ifdef WITH_LF
646 case CMD_SET_LF_SAMPLING_CONFIG:
647 setSamplingConfig((sample_config *) c->d.asBytes);
648 break;
649 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
650 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
651 break;
652 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
653 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
654 break;
655 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
656 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
657 break;
658 case CMD_HID_DEMOD_FSK:
659 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
660 break;
661 case CMD_HID_SIM_TAG:
662 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
663 break;
664 case CMD_FSK_SIM_TAG:
665 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
666 break;
667 case CMD_ASK_SIM_TAG:
668 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
669 break;
670 case CMD_PSK_SIM_TAG:
671 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
672 break;
673 case CMD_HID_CLONE_TAG:
674 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
675 break;
676 case CMD_IO_DEMOD_FSK:
677 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
678 break;
679 case CMD_IO_CLONE_TAG:
680 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
681 break;
682 case CMD_EM410X_DEMOD:
683 CmdEM410xdemod(c->arg[0], 0, 0, 1);
684 break;
685 case CMD_EM410X_WRITE_TAG:
686 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
687 break;
688 case CMD_READ_TI_TYPE:
689 ReadTItag();
690 break;
691 case CMD_WRITE_TI_TYPE:
692 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
693 break;
694 case CMD_SIMULATE_TAG_125K:
695 LED_A_ON();
696 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
697 LED_A_OFF();
698 break;
699 case CMD_LF_SIMULATE_BIDIR:
700 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
701 break;
702 case CMD_INDALA_CLONE_TAG:
703 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
704 break;
705 case CMD_INDALA_CLONE_TAG_L:
706 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
707 break;
708 case CMD_T55XX_READ_BLOCK:
709 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
710 break;
711 case CMD_T55XX_WRITE_BLOCK:
712 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
713 break;
714 case CMD_T55XX_READ_TRACE:
715 T55xxReadTrace();
716 break;
717 case CMD_PCF7931_READ:
718 ReadPCF7931();
719 cmd_send(CMD_ACK,0,0,0,0,0);
720 break;
721 case CMD_EM4X_READ_WORD:
722 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
723 break;
724 case CMD_EM4X_WRITE_WORD:
725 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
726 break;
727 #endif
728
729 #ifdef WITH_HITAG
730 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
731 SnoopHitag(c->arg[0]);
732 break;
733 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
734 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
735 break;
736 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
737 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
738 break;
739 #endif
740
741 #ifdef WITH_ISO15693
742 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
743 AcquireRawAdcSamplesIso15693();
744 break;
745 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
746 RecordRawAdcSamplesIso15693();
747 break;
748
749 case CMD_ISO_15693_COMMAND:
750 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
751 break;
752
753 case CMD_ISO_15693_FIND_AFI:
754 BruteforceIso15693Afi(c->arg[0]);
755 break;
756
757 case CMD_ISO_15693_DEBUG:
758 SetDebugIso15693(c->arg[0]);
759 break;
760
761 case CMD_READER_ISO_15693:
762 ReaderIso15693(c->arg[0]);
763 break;
764 case CMD_SIMTAG_ISO_15693:
765 SimTagIso15693(c->arg[0], c->d.asBytes);
766 break;
767 #endif
768
769 #ifdef WITH_LEGICRF
770 case CMD_SIMULATE_TAG_LEGIC_RF:
771 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
772 break;
773
774 case CMD_WRITER_LEGIC_RF:
775 LegicRfWriter(c->arg[1], c->arg[0]);
776 break;
777
778 case CMD_READER_LEGIC_RF:
779 LegicRfReader(c->arg[0], c->arg[1]);
780 break;
781 #endif
782
783 #ifdef WITH_ISO14443b
784 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
785 AcquireRawAdcSamplesIso14443(c->arg[0]);
786 break;
787 case CMD_READ_SRI512_TAG:
788 ReadSTMemoryIso14443(0x0F);
789 break;
790 case CMD_READ_SRIX4K_TAG:
791 ReadSTMemoryIso14443(0x7F);
792 break;
793 case CMD_SNOOP_ISO_14443:
794 SnoopIso14443();
795 break;
796 case CMD_SIMULATE_TAG_ISO_14443:
797 SimulateIso14443Tag();
798 break;
799 case CMD_ISO_14443B_COMMAND:
800 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
801 break;
802 #endif
803
804 #ifdef WITH_ISO14443a
805 case CMD_SNOOP_ISO_14443a:
806 SniffIso14443a(c->arg[0]);
807 break;
808 case CMD_READER_ISO_14443a:
809 ReaderIso14443a(c);
810 break;
811 case CMD_SIMULATE_TAG_ISO_14443a:
812 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
813 break;
814
815 case CMD_EPA_PACE_COLLECT_NONCE:
816 EPA_PACE_Collect_Nonce(c);
817 break;
818
819 // case CMD_EPA_:
820 // EpaFoo(c);
821 // break;
822
823 case CMD_READER_MIFARE:
824 ReaderMifare(c->arg[0]);
825 break;
826 case CMD_MIFARE_READBL:
827 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
828 break;
829 case CMD_MIFAREU_READBL:
830 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
831 break;
832 case CMD_MIFAREUC_AUTH:
833 MifareUC_Auth(c->arg[0],c->d.asBytes);
834 break;
835 case CMD_MIFAREU_READCARD:
836 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
837 break;
838 case CMD_MIFAREUC_SETPWD:
839 MifareUSetPwd(c->arg[0], c->d.asBytes);
840 break;
841 case CMD_MIFARE_READSC:
842 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
843 break;
844 case CMD_MIFARE_WRITEBL:
845 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
846 break;
847 //case CMD_MIFAREU_WRITEBL_COMPAT:
848 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
849 //break;
850 case CMD_MIFAREU_WRITEBL:
851 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
852 break;
853 case CMD_MIFARE_NESTED:
854 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
855 break;
856 case CMD_MIFARE_CHKKEYS:
857 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
858 break;
859 case CMD_SIMULATE_MIFARE_CARD:
860 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
861 break;
862
863 // emulator
864 case CMD_MIFARE_SET_DBGMODE:
865 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
866 break;
867 case CMD_MIFARE_EML_MEMCLR:
868 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
869 break;
870 case CMD_MIFARE_EML_MEMSET:
871 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
872 break;
873 case CMD_MIFARE_EML_MEMGET:
874 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
875 break;
876 case CMD_MIFARE_EML_CARDLOAD:
877 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
878 break;
879
880 // Work with "magic Chinese" card
881 case CMD_MIFARE_CSETBLOCK:
882 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
883 break;
884 case CMD_MIFARE_CGETBLOCK:
885 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
886 break;
887 case CMD_MIFARE_CIDENT:
888 MifareCIdent();
889 break;
890
891 // mifare sniffer
892 case CMD_MIFARE_SNIFFER:
893 SniffMifare(c->arg[0]);
894 break;
895
896 //mifare desfire
897 case CMD_MIFARE_DESFIRE_READBL: break;
898 case CMD_MIFARE_DESFIRE_WRITEBL: break;
899 case CMD_MIFARE_DESFIRE_AUTH1:
900 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
901 break;
902 case CMD_MIFARE_DESFIRE_AUTH2:
903 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
904 break;
905 case CMD_MIFARE_DES_READER:
906 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
907 break;
908 case CMD_MIFARE_DESFIRE_INFO:
909 MifareDesfireGetInformation();
910 break;
911 case CMD_MIFARE_DESFIRE:
912 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
913 break;
914
915 case CMD_MIFARE_COLLECT_NONCES:
916 MifareCollectNonces(c->arg[0], c->arg[1]);
917 break;
918 #endif
919
920 #ifdef WITH_ICLASS
921 // Makes use of ISO14443a FPGA Firmware
922 case CMD_SNOOP_ICLASS:
923 SnoopIClass();
924 break;
925 case CMD_SIMULATE_TAG_ICLASS:
926 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
927 break;
928 case CMD_READER_ICLASS:
929 ReaderIClass(c->arg[0]);
930 break;
931 case CMD_READER_ICLASS_REPLAY:
932 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
933 break;
934 case CMD_ICLASS_EML_MEMSET:
935 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
936 break;
937 #endif
938
939 case CMD_SIMULATE_TAG_HF_LISTEN:
940 SimulateTagHfListen();
941 break;
942
943 case CMD_BUFF_CLEAR:
944 BigBuf_Clear();
945 break;
946
947 case CMD_MEASURE_ANTENNA_TUNING:
948 MeasureAntennaTuning();
949 break;
950
951 case CMD_MEASURE_ANTENNA_TUNING_HF:
952 MeasureAntennaTuningHf();
953 break;
954
955 case CMD_LISTEN_READER_FIELD:
956 ListenReaderField(c->arg[0]);
957 break;
958
959 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
960 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
961 SpinDelay(200);
962 LED_D_OFF(); // LED D indicates field ON or OFF
963 break;
964
965 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
966
967 LED_B_ON();
968 uint8_t *BigBuf = BigBuf_get_addr();
969 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
970 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
971 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
972 }
973 // Trigger a finish downloading signal with an ACK frame
974 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
975 LED_B_OFF();
976 break;
977
978 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
979 uint8_t *b = BigBuf_get_addr();
980 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
981 cmd_send(CMD_ACK,0,0,0,0,0);
982 break;
983 }
984 case CMD_READ_MEM:
985 ReadMem(c->arg[0]);
986 break;
987
988 case CMD_SET_LF_DIVISOR:
989 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
990 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
991 break;
992
993 case CMD_SET_ADC_MUX:
994 switch(c->arg[0]) {
995 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
996 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
997 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
998 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
999 }
1000 break;
1001
1002 case CMD_VERSION:
1003 SendVersion();
1004 break;
1005
1006 #ifdef WITH_LCD
1007 case CMD_LCD_RESET:
1008 LCDReset();
1009 break;
1010 case CMD_LCD:
1011 LCDSend(c->arg[0]);
1012 break;
1013 #endif
1014 case CMD_SETUP_WRITE:
1015 case CMD_FINISH_WRITE:
1016 case CMD_HARDWARE_RESET:
1017 usb_disable();
1018 SpinDelay(1000);
1019 SpinDelay(1000);
1020 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1021 for(;;) {
1022 // We're going to reset, and the bootrom will take control.
1023 }
1024 break;
1025
1026 case CMD_START_FLASH:
1027 if(common_area.flags.bootrom_present) {
1028 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1029 }
1030 usb_disable();
1031 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1032 for(;;);
1033 break;
1034
1035 case CMD_DEVICE_INFO: {
1036 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1037 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1038 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1039 break;
1040 }
1041 default:
1042 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1043 break;
1044 }
1045 }
1046
1047 void __attribute__((noreturn)) AppMain(void)
1048 {
1049 SpinDelay(100);
1050 clear_trace();
1051 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1052 /* Initialize common area */
1053 memset(&common_area, 0, sizeof(common_area));
1054 common_area.magic = COMMON_AREA_MAGIC;
1055 common_area.version = 1;
1056 }
1057 common_area.flags.osimage_present = 1;
1058
1059 LED_D_OFF();
1060 LED_C_OFF();
1061 LED_B_OFF();
1062 LED_A_OFF();
1063
1064 // Init USB device
1065 usb_enable();
1066
1067 // The FPGA gets its clock from us from PCK0 output, so set that up.
1068 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1069 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1070 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1071 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1072 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1073 AT91C_PMC_PRES_CLK_4;
1074 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1075
1076 // Reset SPI
1077 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1078 // Reset SSC
1079 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1080
1081 // Load the FPGA image, which we have stored in our flash.
1082 // (the HF version by default)
1083 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1084
1085 StartTickCount();
1086
1087 #ifdef WITH_LCD
1088 LCDInit();
1089 #endif
1090
1091 byte_t rx[sizeof(UsbCommand)];
1092 size_t rx_len;
1093
1094 for(;;) {
1095 if (usb_poll()) {
1096 rx_len = usb_read(rx,sizeof(UsbCommand));
1097 if (rx_len) {
1098 UsbPacketReceived(rx,rx_len);
1099 }
1100 }
1101 WDT_HIT();
1102
1103 #ifdef WITH_LF
1104 if (BUTTON_HELD(1000) > 0)
1105 SamyRun();
1106 #endif
1107 }
1108 }
Proxmark3 GIT tracking
Impressum, Datenschutz