]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
CHG: 'hf iclass replay' added help text.
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12 #include "usb_cdc.h"
13 //#include "cmd.h"
14 #include "proxmark3.h"
15 #include "apps.h"
16 #include "util.h"
17 #include "printf.h"
18 #include "string.h"
19 #include <stdarg.h>
20 #include "legicrf.h"
21 #include "hitag2.h"
22 #include "hitagS.h"
23 #include "lfsampling.h"
24 #include "BigBuf.h"
25 #include "mifareutil.h"
26 #include "pcf7931.h"
27
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 // Craig Young - 14a stand-alone code
33 #ifdef WITH_ISO14443a_StandAlone
34 #include "iso14443a.h"
35 #include "protocols.h"
36 #endif
37
38 //=============================================================================
39 // A buffer where we can queue things up to be sent through the FPGA, for
40 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
41 // is the order in which they go out on the wire.
42 //=============================================================================
43
44 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
45 uint8_t ToSend[TOSEND_BUFFER_SIZE];
46 int ToSendMax = 0;
47 static int ToSendBit;
48 struct common_area common_area __attribute__((section(".commonarea")));
49
50 void ToSendReset(void)
51 {
52 ToSendMax = -1;
53 ToSendBit = 8;
54 }
55
56 void ToSendStuffBit(int b) {
57 if(ToSendBit >= 8) {
58 ++ToSendMax;
59 ToSend[ToSendMax] = 0;
60 ToSendBit = 0;
61 }
62
63 if(b)
64 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
65
66 ++ToSendBit;
67
68 if(ToSendMax >= sizeof(ToSend)) {
69 ToSendBit = 0;
70 DbpString("ToSendStuffBit overflowed!");
71 }
72 }
73
74 void PrintToSendBuffer(void){
75 DbpString("Printing ToSendBuffer:");
76 Dbhexdump(ToSendMax, ToSend, 0);
77 }
78
79 //=============================================================================
80 // Debug print functions, to go out over USB, to the usual PC-side client.
81 //=============================================================================
82
83 void DbpStringEx(char *str, uint32_t cmd){
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
86 }
87
88 void DbpString(char *str) {
89 DbpStringEx(str, 0);
90 }
91
92 #if 0
93 void DbpIntegers(int x1, int x2, int x3) {
94 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
95 }
96 #endif
97 void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
98 // should probably limit size here; oh well, let's just use a big buffer
99 char output_string[128] = {0x00};
100 va_list ap;
101
102 va_start(ap, fmt);
103 kvsprintf(fmt, output_string, 10, ap);
104 va_end(ap);
105
106 DbpStringEx(output_string, cmd);
107 }
108
109 void Dbprintf(const char *fmt, ...) {
110 // should probably limit size here; oh well, let's just use a big buffer
111 char output_string[128] = {0x00};
112 va_list ap;
113
114 va_start(ap, fmt);
115 kvsprintf(fmt, output_string, 10, ap);
116 va_end(ap);
117
118 DbpString(output_string);
119 }
120
121 // prints HEX & ASCII
122 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
123 int l=0, i;
124 char ascii[9];
125
126 while (len>0) {
127
128 l = (len>8) ? 8 : len;
129
130 memcpy(ascii,d,l);
131 ascii[l]=0;
132
133 // filter safe ascii
134 for (i=0; i<l; ++i)
135 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
136
137 if (bAsci)
138 Dbprintf("%-8s %*D",ascii,l,d," ");
139 else
140 Dbprintf("%*D",l,d," ");
141
142 len -= 8;
143 d += 8;
144 }
145 }
146
147 //-----------------------------------------------------------------------------
148 // Read an ADC channel and block till it completes, then return the result
149 // in ADC units (0 to 1023). Also a routine to average 32 samples and
150 // return that.
151 //-----------------------------------------------------------------------------
152 static int ReadAdc(int ch)
153 {
154 uint32_t d;
155
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
157 AT91C_BASE_ADC->ADC_MR =
158 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
159 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
160 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
161
162 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
163 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
164 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
165 //
166 // The maths are:
167 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
168 //
169 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
170 //
171 // Note: with the "historic" values in the comments above, the error was 34% !!!
172
173 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
174
175 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
176
177 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
178
179 d = AT91C_BASE_ADC->ADC_CDR[ch];
180 return d;
181 }
182
183 int AvgAdc(int ch) // was static - merlok
184 {
185 int i, a = 0;
186 for(i = 0; i < 32; ++i)
187 a += ReadAdc(ch);
188
189 return (a + 15) >> 5;
190 }
191
192
193 void MeasureAntennaTuning(void) {
194
195 uint8_t LF_Results[256];
196 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0;
197 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
198
199 memset(LF_Results, 0, sizeof(LF_Results));
200 LED_B_ON();
201
202 /*
203 * Sweeps the useful LF range of the proxmark from
204 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
205 * read the voltage in the antenna, the result left
206 * in the buffer is a graph which should clearly show
207 * the resonating frequency of your LF antenna
208 * ( hopefully around 95 if it is tuned to 125kHz!)
209 */
210
211 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
212 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
213
214 for (i = 255; i >= 19; i--) {
215 WDT_HIT();
216 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
217 SpinDelay(20);
218 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
219 if (i==95) vLf125 = adcval; // voltage at 125Khz
220 if (i==89) vLf134 = adcval; // voltage at 134Khz
221
222 LF_Results[i] = adcval >> 8; // scale int to fit in byte for graphing purposes
223 if(LF_Results[i] > peak) {
224 peakv = adcval;
225 peak = LF_Results[i];
226 peakf = i;
227 }
228 }
229
230 LED_A_ON();
231 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
232 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
233 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
234 SpinDelay(20);
235 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
236
237 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134 << 16), vHf, peakf | (peakv << 16), LF_Results, 256);
238 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
239 LEDsoff();
240 }
241
242 void MeasureAntennaTuningHf(void) {
243 int vHf = 0; // in mV
244 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
245 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
246 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
247
248 while ( !BUTTON_PRESS() ){
249 SpinDelay(20);
250 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
251 //Dbprintf("%d mV",vHf);
252 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
253 }
254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
255 DbpString("cancelled");
256 }
257
258
259 void ReadMem(int addr) {
260 const uint8_t *data = ((uint8_t *)addr);
261
262 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
263 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
264 }
265
266 /* osimage version information is linked in */
267 extern struct version_information version_information;
268 /* bootrom version information is pointed to from _bootphase1_version_pointer */
269 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
270 void SendVersion(void)
271 {
272 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
273 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
274
275 /* Try to find the bootrom version information. Expect to find a pointer at
276 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
277 * pointer, then use it.
278 */
279 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
280
281 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
282 strcat(VersionString, "bootrom version information appears invalid\n");
283 } else {
284 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
285 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
286 }
287
288 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
289 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
290
291 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
292 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
293
294 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
295 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
296
297 // Send Chip ID and used flash memory
298 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
299 uint32_t compressed_data_section_size = common_area.arg1;
300 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
301 }
302
303 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
304 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
305 void printUSBSpeed(void)
306 {
307 Dbprintf("USB Speed:");
308 Dbprintf(" Sending USB packets to client...");
309
310 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
311 uint8_t *test_data = BigBuf_get_addr();
312 uint32_t end_time;
313
314 uint32_t start_time = end_time = GetTickCount();
315 uint32_t bytes_transferred = 0;
316
317 LED_B_ON();
318 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
319 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
320 end_time = GetTickCount();
321 bytes_transferred += USB_CMD_DATA_SIZE;
322 }
323 LED_B_OFF();
324
325 Dbprintf(" Time elapsed: %dms", end_time - start_time);
326 Dbprintf(" Bytes transferred: %d", bytes_transferred);
327 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
328 1000 * bytes_transferred / (end_time - start_time));
329
330 }
331
332 /**
333 * Prints runtime information about the PM3.
334 **/
335 void SendStatus(void) {
336 BigBuf_print_status();
337 Fpga_print_status();
338 printConfig(); //LF Sampling config
339 printUSBSpeed();
340 Dbprintf("Various");
341 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
342 Dbprintf(" ToSendMax..........%d", ToSendMax);
343 Dbprintf(" ToSendBit..........%d", ToSendBit);
344 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
345
346 cmd_send(CMD_ACK,1,0,0,0,0);
347 }
348
349 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
350
351 #define OPTS 2
352 void StandAloneMode()
353 {
354 DbpString("Stand-alone mode! No PC necessary.");
355 // Oooh pretty -- notify user we're in elite samy mode now
356 LED(LED_RED, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_GREEN, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_RED, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_GREEN, 200);
363 LED(LED_ORANGE, 200);
364 LED(LED_RED, 200);
365 }
366 #endif
367
368 #ifdef WITH_ISO14443a_StandAlone
369 void StandAloneMode14a()
370 {
371 StandAloneMode();
372 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
373
374 int selected = 0;
375 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
376 int cardRead[OPTS] = {0};
377 uint8_t readUID[10] = {0};
378 uint32_t uid_1st[OPTS]={0};
379 uint32_t uid_2nd[OPTS]={0};
380 uint32_t uid_tmp1 = 0;
381 uint32_t uid_tmp2 = 0;
382 iso14a_card_select_t hi14a_card[OPTS];
383
384 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
385
386 LED(selected + 1, 0);
387
388 for (;;)
389 {
390 usb_poll();
391 WDT_HIT();
392 SpinDelay(300);
393
394 if (iGotoRecord == 1 || cardRead[selected] == 0)
395 {
396 iGotoRecord = 0;
397 LEDsoff();
398 LED(selected + 1, 0);
399 LED(LED_RED2, 0);
400
401 // record
402 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
403 /* need this delay to prevent catching some weird data */
404 SpinDelay(500);
405 /* Code for reading from 14a tag */
406 uint8_t uid[10] = {0};
407 uint32_t cuid = 0;
408 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
409
410 for ( ; ; )
411 {
412 WDT_HIT();
413 if (BUTTON_PRESS()) {
414 if (cardRead[selected]) {
415 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
416 break;
417 }
418 else if (cardRead[(selected+1)%OPTS]) {
419 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
420 selected = (selected+1)%OPTS;
421 break; // playing = 1;
422 }
423 else {
424 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
425 SpinDelay(300);
426 }
427 }
428 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
429 continue;
430 else
431 {
432 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
433 memcpy(readUID,uid,10*sizeof(uint8_t));
434 uint8_t *dst = (uint8_t *)&uid_tmp1;
435 // Set UID byte order
436 for (int i=0; i<4; i++)
437 dst[i] = uid[3-i];
438 dst = (uint8_t *)&uid_tmp2;
439 for (int i=0; i<4; i++)
440 dst[i] = uid[7-i];
441 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
442 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
443 }
444 else {
445 if (uid_tmp2) {
446 Dbprintf("Bank[%d] received a 7-byte UID",selected);
447 uid_1st[selected] = (uid_tmp1)>>8;
448 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
449 }
450 else {
451 Dbprintf("Bank[%d] received a 4-byte UID",selected);
452 uid_1st[selected] = uid_tmp1;
453 uid_2nd[selected] = uid_tmp2;
454 }
455 break;
456 }
457 }
458 }
459 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
460 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
461 LEDsoff();
462 LED(LED_GREEN, 200);
463 LED(LED_ORANGE, 200);
464 LED(LED_GREEN, 200);
465 LED(LED_ORANGE, 200);
466
467 LEDsoff();
468 LED(selected + 1, 0);
469
470 // Next state is replay:
471 playing = 1;
472
473 cardRead[selected] = 1;
474 }
475 /* MF Classic UID clone */
476 else if (iGotoClone==1)
477 {
478 iGotoClone=0;
479 LEDsoff();
480 LED(selected + 1, 0);
481 LED(LED_ORANGE, 250);
482
483 // record
484 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
485
486 // wait for button to be released
487 // Delay cloning until card is in place
488 while(BUTTON_PRESS())
489 WDT_HIT();
490
491 Dbprintf("Starting clone. [Bank: %u]", selected);
492 // need this delay to prevent catching some weird data
493 SpinDelay(500);
494 // Begin clone function here:
495 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
496 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
497 memcpy(c.d.asBytes, data, 16);
498 SendCommand(&c);
499
500 Block read is similar:
501 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
502 We need to imitate that call with blockNo 0 to set a uid.
503
504 The get and set commands are handled in this file:
505 // Work with "magic Chinese" card
506 case CMD_MIFARE_CSETBLOCK:
507 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
508 break;
509 case CMD_MIFARE_CGETBLOCK:
510 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
511 break;
512
513 mfCSetUID provides example logic for UID set workflow:
514 -Read block0 from card in field with MifareCGetBlock()
515 -Configure new values without replacing reserved bytes
516 memcpy(block0, uid, 4); // Copy UID bytes from byte array
517 // Mifare UID BCC
518 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
519 Bytes 5-7 are reserved SAK and ATQA for mifare classic
520 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
521 */
522 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
523 // arg0 = Flags, arg1=blockNo
524 MifareCGetBlock(params, 0, oldBlock0);
525 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
526 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
527 playing = 1;
528 }
529 else {
530 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
531 memcpy(newBlock0,oldBlock0,16);
532 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
533
534 newBlock0[0] = uid_1st[selected]>>24;
535 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
536 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
537 newBlock0[3] = 0xFF & (uid_1st[selected]);
538 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
539
540 // arg0 = workFlags, arg1 = blockNo, datain
541 MifareCSetBlock(params, 0, newBlock0);
542 MifareCGetBlock(params, 0, testBlock0);
543
544 if (memcmp(testBlock0, newBlock0, 16)==0) {
545 DbpString("Cloned successfull!");
546 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
547 playing = 0;
548 iGotoRecord = 1;
549 selected = (selected + 1) % OPTS;
550 } else {
551 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
552 playing = 1;
553 }
554 }
555 LEDsoff();
556 LED(selected + 1, 0);
557 }
558 // Change where to record (or begin playing)
559 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
560 {
561 LEDsoff();
562 LED(selected + 1, 0);
563
564 // Begin transmitting
565 if (playing)
566 {
567 LED(LED_GREEN, 0);
568 DbpString("Playing");
569 for ( ; ; ) {
570 WDT_HIT();
571 int button_action = BUTTON_HELD(1000);
572 if (button_action == 0) { // No button action, proceed with sim
573 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
574 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
575 num_to_bytes(uid_1st[selected], 3, data);
576 num_to_bytes(uid_2nd[selected], 4, data);
577
578 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
579 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
580 DbpString("Mifare Classic");
581 SimulateIso14443aTag(1, flags, data); // Mifare Classic
582 }
583 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
584 DbpString("Mifare Ultralight");
585 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
586 }
587 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
588 DbpString("Mifare DESFire");
589 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
590 }
591 else {
592 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
593 SimulateIso14443aTag(1, flags, data);
594 }
595 }
596 else if (button_action == BUTTON_SINGLE_CLICK) {
597 selected = (selected + 1) % OPTS;
598 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
599 iGotoRecord = 1;
600 break;
601 }
602 else if (button_action == BUTTON_HOLD) {
603 Dbprintf("Playtime over. Begin cloning...");
604 iGotoClone = 1;
605 break;
606 }
607 WDT_HIT();
608 }
609
610 /* We pressed a button so ignore it here with a delay */
611 SpinDelay(300);
612 LEDsoff();
613 LED(selected + 1, 0);
614 }
615 else
616 while(BUTTON_PRESS())
617 WDT_HIT();
618 }
619 }
620 }
621 #elif WITH_LF
622 // samy's sniff and repeat routine
623 void SamyRun()
624 {
625 StandAloneMode();
626 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
627
628 int high[OPTS], low[OPTS];
629 int selected = 0;
630 int playing = 0;
631 int cardRead = 0;
632
633 // Turn on selected LED
634 LED(selected + 1, 0);
635
636 for (;;) {
637 usb_poll();
638 WDT_HIT();
639
640 // Was our button held down or pressed?
641 int button_pressed = BUTTON_HELD(1000);
642 SpinDelay(300);
643
644 // Button was held for a second, begin recording
645 if (button_pressed > 0 && cardRead == 0)
646 {
647 LEDsoff();
648 LED(selected + 1, 0);
649 LED(LED_RED2, 0);
650
651 // record
652 DbpString("Starting recording");
653
654 // wait for button to be released
655 while(BUTTON_PRESS())
656 WDT_HIT();
657
658 /* need this delay to prevent catching some weird data */
659 SpinDelay(500);
660
661 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
662 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
663
664 LEDsoff();
665 LED(selected + 1, 0);
666 // Finished recording
667 // If we were previously playing, set playing off
668 // so next button push begins playing what we recorded
669 playing = 0;
670 cardRead = 1;
671 }
672 else if (button_pressed > 0 && cardRead == 1) {
673 LEDsoff();
674 LED(selected + 1, 0);
675 LED(LED_ORANGE, 0);
676
677 // record
678 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
679
680 // wait for button to be released
681 while(BUTTON_PRESS())
682 WDT_HIT();
683
684 /* need this delay to prevent catching some weird data */
685 SpinDelay(500);
686
687 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
688 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
689
690 LEDsoff();
691 LED(selected + 1, 0);
692 // Finished recording
693
694 // If we were previously playing, set playing off
695 // so next button push begins playing what we recorded
696 playing = 0;
697 cardRead = 0;
698 }
699
700 // Change where to record (or begin playing)
701 else if (button_pressed) {
702 // Next option if we were previously playing
703 if (playing)
704 selected = (selected + 1) % OPTS;
705 playing = !playing;
706
707 LEDsoff();
708 LED(selected + 1, 0);
709
710 // Begin transmitting
711 if (playing)
712 {
713 LED(LED_GREEN, 0);
714 DbpString("Playing");
715 // wait for button to be released
716 while(BUTTON_PRESS())
717 WDT_HIT();
718
719 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
720 CmdHIDsimTAG(high[selected], low[selected], 0);
721 DbpString("Done playing");
722
723 if (BUTTON_HELD(1000) > 0) {
724 DbpString("Exiting");
725 LEDsoff();
726 return;
727 }
728
729 /* We pressed a button so ignore it here with a delay */
730 SpinDelay(300);
731
732 // when done, we're done playing, move to next option
733 selected = (selected + 1) % OPTS;
734 playing = !playing;
735 LEDsoff();
736 LED(selected + 1, 0);
737 }
738 else
739 while(BUTTON_PRESS())
740 WDT_HIT();
741 }
742 }
743 }
744
745 #endif
746 /*
747 OBJECTIVE
748 Listen and detect an external reader. Determine the best location
749 for the antenna.
750
751 INSTRUCTIONS:
752 Inside the ListenReaderField() function, there is two mode.
753 By default, when you call the function, you will enter mode 1.
754 If you press the PM3 button one time, you will enter mode 2.
755 If you press the PM3 button a second time, you will exit the function.
756
757 DESCRIPTION OF MODE 1:
758 This mode just listens for an external reader field and lights up green
759 for HF and/or red for LF. This is the original mode of the detectreader
760 function.
761
762 DESCRIPTION OF MODE 2:
763 This mode will visually represent, using the LEDs, the actual strength of the
764 current compared to the maximum current detected. Basically, once you know
765 what kind of external reader is present, it will help you spot the best location to place
766 your antenna. You will probably not get some good results if there is a LF and a HF reader
767 at the same place! :-)
768
769 LIGHT SCHEME USED:
770 */
771 static const char LIGHT_SCHEME[] = {
772 0x0, /* ---- | No field detected */
773 0x1, /* X--- | 14% of maximum current detected */
774 0x2, /* -X-- | 29% of maximum current detected */
775 0x4, /* --X- | 43% of maximum current detected */
776 0x8, /* ---X | 57% of maximum current detected */
777 0xC, /* --XX | 71% of maximum current detected */
778 0xE, /* -XXX | 86% of maximum current detected */
779 0xF, /* XXXX | 100% of maximum current detected */
780 };
781 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
782
783 void ListenReaderField(int limit) {
784 #define LF_ONLY 1
785 #define HF_ONLY 2
786 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
787
788 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
789 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
790 int mode=1, display_val, display_max, i;
791
792 // switch off FPGA - we don't want to measure our own signal
793 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
794 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
795
796 LEDsoff();
797
798 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
799
800 if(limit != HF_ONLY) {
801 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
802 lf_baseline = lf_av;
803 }
804
805 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
806
807 if (limit != LF_ONLY) {
808 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
809 hf_baseline = hf_av;
810 }
811
812 for(;;) {
813 if (BUTTON_PRESS()) {
814 SpinDelay(500);
815 switch (mode) {
816 case 1:
817 mode=2;
818 DbpString("Signal Strength Mode");
819 break;
820 case 2:
821 default:
822 DbpString("Stopped");
823 LEDsoff();
824 return;
825 break;
826 }
827 }
828 WDT_HIT();
829
830 if (limit != HF_ONLY) {
831 if(mode == 1) {
832 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
833 LED_D_ON();
834 else
835 LED_D_OFF();
836 }
837
838 lf_av_new = AvgAdc(ADC_CHAN_LF);
839 // see if there's a significant change
840 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
841 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
842 lf_av = lf_av_new;
843 if (lf_av > lf_max)
844 lf_max = lf_av;
845 }
846 }
847
848 if (limit != LF_ONLY) {
849 if (mode == 1){
850 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
851 LED_B_ON();
852 else
853 LED_B_OFF();
854 }
855
856 hf_av_new = AvgAdc(ADC_CHAN_HF);
857 // see if there's a significant change
858 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
859 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
860 hf_av = hf_av_new;
861 if (hf_av > hf_max)
862 hf_max = hf_av;
863 }
864 }
865
866 if(mode == 2) {
867 if (limit == LF_ONLY) {
868 display_val = lf_av;
869 display_max = lf_max;
870 } else if (limit == HF_ONLY) {
871 display_val = hf_av;
872 display_max = hf_max;
873 } else { /* Pick one at random */
874 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
875 display_val = hf_av;
876 display_max = hf_max;
877 } else {
878 display_val = lf_av;
879 display_max = lf_max;
880 }
881 }
882 for (i=0; i<LIGHT_LEN; i++) {
883 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
884 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
885 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
886 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
887 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
888 break;
889 }
890 }
891 }
892 }
893 }
894
895 void UsbPacketReceived(uint8_t *packet, int len)
896 {
897 UsbCommand *c = (UsbCommand *)packet;
898
899 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
900
901 switch(c->cmd) {
902 #ifdef WITH_LF
903 case CMD_SET_LF_SAMPLING_CONFIG:
904 setSamplingConfig((sample_config *) c->d.asBytes);
905 break;
906 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
907 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
908 break;
909 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
910 ModThenAcquireRawAdcSamples125k(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
911 break;
912 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
913 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
914 break;
915 case CMD_HID_DEMOD_FSK:
916 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
917 break;
918 case CMD_HID_SIM_TAG:
919 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
920 break;
921 case CMD_FSK_SIM_TAG:
922 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
923 break;
924 case CMD_ASK_SIM_TAG:
925 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
926 break;
927 case CMD_PSK_SIM_TAG:
928 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
929 break;
930 case CMD_HID_CLONE_TAG:
931 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
932 break;
933 case CMD_IO_DEMOD_FSK:
934 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
935 break;
936 case CMD_IO_CLONE_TAG:
937 CopyIOtoT55x7(c->arg[0], c->arg[1]);
938 break;
939 case CMD_EM410X_DEMOD:
940 CmdEM410xdemod(c->arg[0], 0, 0, 1);
941 break;
942 case CMD_EM410X_WRITE_TAG:
943 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
944 break;
945 case CMD_READ_TI_TYPE:
946 ReadTItag();
947 break;
948 case CMD_WRITE_TI_TYPE:
949 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
950 break;
951 case CMD_SIMULATE_TAG_125K:
952 LED_A_ON();
953 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
954 LED_A_OFF();
955 break;
956 case CMD_LF_SIMULATE_BIDIR:
957 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
958 break;
959 case CMD_INDALA_CLONE_TAG:
960 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
961 break;
962 case CMD_INDALA_CLONE_TAG_L:
963 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
964 break;
965 case CMD_T55XX_READ_BLOCK:
966 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
967 break;
968 case CMD_T55XX_WRITE_BLOCK:
969 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
970 break;
971 case CMD_T55XX_WAKEUP:
972 T55xxWakeUp(c->arg[0]);
973 break;
974 case CMD_T55XX_RESET_READ:
975 T55xxResetRead();
976 break;
977 case CMD_PCF7931_READ:
978 ReadPCF7931();
979 break;
980 case CMD_PCF7931_WRITE:
981 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
982 break;
983 case CMD_EM4X_READ_WORD:
984 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
985 break;
986 case CMD_EM4X_WRITE_WORD:
987 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
988 break;
989 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
990 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
991 break;
992 case CMD_VIKING_CLONE_TAG:
993 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
994 break;
995 #endif
996
997 #ifdef WITH_HITAG
998 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
999 SnoopHitag(c->arg[0]);
1000 break;
1001 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1002 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1003 break;
1004 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1005 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1006 break;
1007 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1008 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1009 break;
1010 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1011 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1012 break;
1013 case CMD_READ_HITAG_S: //Reader for only Hitag S tags, args = key or challenge
1014 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1015 break;
1016 case CMD_WR_HITAG_S: //writer for Hitag tags args=data to write,page and key or challenge
1017 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1018 break;
1019 #endif
1020
1021 #ifdef WITH_ISO15693
1022 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1023 AcquireRawAdcSamplesIso15693();
1024 break;
1025 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1026 RecordRawAdcSamplesIso15693();
1027 break;
1028
1029 case CMD_ISO_15693_COMMAND:
1030 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1031 break;
1032
1033 case CMD_ISO_15693_FIND_AFI:
1034 BruteforceIso15693Afi(c->arg[0]);
1035 break;
1036
1037 case CMD_ISO_15693_DEBUG:
1038 SetDebugIso15693(c->arg[0]);
1039 break;
1040
1041 case CMD_READER_ISO_15693:
1042 ReaderIso15693(c->arg[0]);
1043 break;
1044 case CMD_SIMTAG_ISO_15693:
1045 SimTagIso15693(c->arg[0], c->d.asBytes);
1046 break;
1047 #endif
1048
1049 #ifdef WITH_LEGICRF
1050 case CMD_SIMULATE_TAG_LEGIC_RF:
1051 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1052 break;
1053 case CMD_WRITER_LEGIC_RF:
1054 LegicRfWriter( c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1055 break;
1056 case CMD_READER_LEGIC_RF:
1057 LegicRfReader(c->arg[0], c->arg[1], c->arg[2]);
1058 break;
1059 case CMD_LEGIC_INFO:
1060 LegicRfInfo();
1061 break;
1062 case CMD_LEGIC_ESET:
1063 LegicEMemSet(c->arg[0], c->arg[1], c->d.asBytes);
1064 break;
1065 #endif
1066
1067 #ifdef WITH_ISO14443b
1068 case CMD_READ_SRI_TAG:
1069 ReadSTMemoryIso14443b(c->arg[0]);
1070 break;
1071 case CMD_SNOOP_ISO_14443B:
1072 SnoopIso14443b();
1073 break;
1074 case CMD_SIMULATE_TAG_ISO_14443B:
1075 SimulateIso14443bTag(c->arg[0]);
1076 break;
1077 case CMD_ISO_14443B_COMMAND:
1078 //SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1079 SendRawCommand14443B_Ex(c);
1080 break;
1081 #endif
1082
1083 #ifdef WITH_ISO14443a
1084 case CMD_SNOOP_ISO_14443a:
1085 SniffIso14443a(c->arg[0]);
1086 break;
1087 case CMD_READER_ISO_14443a:
1088 ReaderIso14443a(c);
1089 break;
1090 case CMD_SIMULATE_TAG_ISO_14443a:
1091 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1092 break;
1093 case CMD_EPA_PACE_COLLECT_NONCE:
1094 EPA_PACE_Collect_Nonce(c);
1095 break;
1096 case CMD_EPA_PACE_REPLAY:
1097 EPA_PACE_Replay(c);
1098 break;
1099 case CMD_READER_MIFARE:
1100 ReaderMifare(c->arg[0], c->arg[1], c->arg[2]);
1101 break;
1102 case CMD_MIFARE_READBL:
1103 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1104 break;
1105 case CMD_MIFAREU_READBL:
1106 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1107 break;
1108 case CMD_MIFAREUC_AUTH:
1109 MifareUC_Auth(c->arg[0],c->d.asBytes);
1110 break;
1111 case CMD_MIFAREU_READCARD:
1112 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1113 break;
1114 case CMD_MIFAREUC_SETPWD:
1115 MifareUSetPwd(c->arg[0], c->d.asBytes);
1116 break;
1117 case CMD_MIFARE_READSC:
1118 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1119 break;
1120 case CMD_MIFARE_WRITEBL:
1121 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1122 break;
1123 //case CMD_MIFAREU_WRITEBL_COMPAT:
1124 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1125 //break;
1126 case CMD_MIFAREU_WRITEBL:
1127 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1128 break;
1129 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1130 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1131 break;
1132 case CMD_MIFARE_NESTED:
1133 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1134 break;
1135 case CMD_MIFARE_CHKKEYS:
1136 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1137 break;
1138 case CMD_SIMULATE_MIFARE_CARD:
1139 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1140 break;
1141
1142 // emulator
1143 case CMD_MIFARE_SET_DBGMODE:
1144 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1145 break;
1146 case CMD_MIFARE_EML_MEMCLR:
1147 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1148 break;
1149 case CMD_MIFARE_EML_MEMSET:
1150 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1151 break;
1152 case CMD_MIFARE_EML_MEMGET:
1153 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1154 break;
1155 case CMD_MIFARE_EML_CARDLOAD:
1156 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1157 break;
1158
1159 // Work with "magic Chinese" card
1160 case CMD_MIFARE_CSETBLOCK:
1161 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1162 break;
1163 case CMD_MIFARE_CGETBLOCK:
1164 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1165 break;
1166 case CMD_MIFARE_CIDENT:
1167 MifareCIdent();
1168 break;
1169
1170 // mifare sniffer
1171 case CMD_MIFARE_SNIFFER:
1172 SniffMifare(c->arg[0]);
1173 break;
1174
1175 //mifare desfire
1176 case CMD_MIFARE_DESFIRE_READBL: break;
1177 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1178 case CMD_MIFARE_DESFIRE_AUTH1:
1179 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1180 break;
1181 case CMD_MIFARE_DESFIRE_AUTH2:
1182 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1183 break;
1184 case CMD_MIFARE_DES_READER:
1185 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1186 break;
1187 case CMD_MIFARE_DESFIRE_INFO:
1188 MifareDesfireGetInformation();
1189 break;
1190 case CMD_MIFARE_DESFIRE:
1191 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1192 break;
1193 case CMD_MIFARE_COLLECT_NONCES:
1194 break;
1195 #endif
1196 #ifdef WITH_EMV
1197 case CMD_EMV_TRANSACTION:
1198 EMVTransaction();
1199 break;
1200 case CMD_EMV_GET_RANDOM_NUM:
1201 //EMVgetUDOL();
1202 break;
1203 case CMD_EMV_LOAD_VALUE:
1204 EMVloadvalue(c->arg[0], c->d.asBytes);
1205 break;
1206 case CMD_EMV_DUMP_CARD:
1207 EMVdumpcard();
1208 #endif
1209 #ifdef WITH_ICLASS
1210 // Makes use of ISO14443a FPGA Firmware
1211 case CMD_SNOOP_ICLASS:
1212 SnoopIClass();
1213 break;
1214 case CMD_SIMULATE_TAG_ICLASS:
1215 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1216 break;
1217 case CMD_READER_ICLASS:
1218 ReaderIClass(c->arg[0]);
1219 break;
1220 case CMD_READER_ICLASS_REPLAY:
1221 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1222 break;
1223 case CMD_ICLASS_EML_MEMSET:
1224 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1225 break;
1226 case CMD_ICLASS_WRITEBLOCK:
1227 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1228 break;
1229 case CMD_ICLASS_READCHECK: // auth step 1
1230 iClass_ReadCheck(c->arg[0], c->arg[1]);
1231 break;
1232 case CMD_ICLASS_READBLOCK:
1233 iClass_ReadBlk(c->arg[0]);
1234 break;
1235 case CMD_ICLASS_AUTHENTICATION: //check
1236 iClass_Authentication(c->d.asBytes);
1237 break;
1238 case CMD_ICLASS_DUMP:
1239 iClass_Dump(c->arg[0], c->arg[1]);
1240 break;
1241 case CMD_ICLASS_CLONE:
1242 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1243 break;
1244 #endif
1245 #ifdef WITH_HFSNOOP
1246 case CMD_HF_SNIFFER:
1247 HfSnoop(c->arg[0], c->arg[1]);
1248 break;
1249 #endif
1250
1251 case CMD_BUFF_CLEAR:
1252 BigBuf_Clear();
1253 break;
1254
1255 case CMD_MEASURE_ANTENNA_TUNING:
1256 MeasureAntennaTuning();
1257 break;
1258
1259 case CMD_MEASURE_ANTENNA_TUNING_HF:
1260 MeasureAntennaTuningHf();
1261 break;
1262
1263 case CMD_LISTEN_READER_FIELD:
1264 ListenReaderField(c->arg[0]);
1265 break;
1266
1267 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1268 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1269 SpinDelay(200);
1270 LED_D_OFF(); // LED D indicates field ON or OFF
1271 break;
1272
1273 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1274 LED_B_ON();
1275 uint8_t *BigBuf = BigBuf_get_addr();
1276 size_t len = 0;
1277 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1278 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1279 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1280 }
1281 // Trigger a finish downloading signal with an ACK frame
1282 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1283 LED_B_OFF();
1284 break;
1285 }
1286 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1287 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1288 // to be able to use this one for uploading data to device not only for LF, I use c->arg[1]
1289 if ( c->arg[1] == 0 )
1290 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1291 else
1292 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1293 uint8_t *b = BigBuf_get_addr();
1294 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1295 cmd_send(CMD_ACK,0,0,0,0,0);
1296 break;
1297 }
1298 case CMD_DOWNLOAD_EML_BIGBUF: {
1299 LED_B_ON();
1300 uint8_t *cardmem = BigBuf_get_EM_addr();
1301 size_t len = 0;
1302 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1303 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1304 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1305 }
1306 // Trigger a finish downloading signal with an ACK frame
1307 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1308 LED_B_OFF();
1309 break;
1310 }
1311 case CMD_READ_MEM:
1312 ReadMem(c->arg[0]);
1313 break;
1314
1315 case CMD_SET_LF_DIVISOR:
1316 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1317 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1318 break;
1319
1320 case CMD_SET_ADC_MUX:
1321 switch(c->arg[0]) {
1322 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1323 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1324 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1325 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1326 }
1327 break;
1328
1329 case CMD_VERSION:
1330 SendVersion();
1331 break;
1332 case CMD_STATUS:
1333 SendStatus();
1334 break;
1335 case CMD_PING:
1336 cmd_send(CMD_ACK,0,0,0,0,0);
1337 break;
1338 #ifdef WITH_LCD
1339 case CMD_LCD_RESET:
1340 LCDReset();
1341 break;
1342 case CMD_LCD:
1343 LCDSend(c->arg[0]);
1344 break;
1345 #endif
1346 case CMD_SETUP_WRITE:
1347 case CMD_FINISH_WRITE:
1348 case CMD_HARDWARE_RESET:
1349 usb_disable();
1350 SpinDelay(2000);
1351 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1352 for(;;) {
1353 // We're going to reset, and the bootrom will take control.
1354 }
1355 break;
1356
1357 case CMD_START_FLASH:
1358 if(common_area.flags.bootrom_present) {
1359 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1360 }
1361 usb_disable();
1362 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1363 for(;;);
1364 break;
1365
1366 case CMD_DEVICE_INFO: {
1367 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1368 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1369 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1370 break;
1371 }
1372 default:
1373 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1374 break;
1375 }
1376 }
1377
1378 void __attribute__((noreturn)) AppMain(void)
1379 {
1380 SpinDelay(100);
1381 clear_trace();
1382 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1383 /* Initialize common area */
1384 memset(&common_area, 0, sizeof(common_area));
1385 common_area.magic = COMMON_AREA_MAGIC;
1386 common_area.version = 1;
1387 }
1388 common_area.flags.osimage_present = 1;
1389
1390 LEDsoff();
1391
1392 // Init USB device
1393 usb_enable();
1394
1395 // The FPGA gets its clock from us from PCK0 output, so set that up.
1396 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1397 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1398 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1399 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1400 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK | AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1401 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1402
1403 // Reset SPI
1404 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1405 // Reset SSC
1406 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1407
1408 // Load the FPGA image, which we have stored in our flash.
1409 // (the HF version by default)
1410 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1411
1412 StartTickCount();
1413
1414 #ifdef WITH_LCD
1415 LCDInit();
1416 #endif
1417
1418 byte_t rx[sizeof(UsbCommand)];
1419 size_t rx_len;
1420
1421 for(;;) {
1422 if ( usb_poll_validate_length() ) {
1423 rx_len = usb_read(rx, sizeof(UsbCommand));
1424
1425 if (rx_len)
1426 UsbPacketReceived(rx, rx_len);
1427 }
1428 WDT_HIT();
1429
1430 #ifdef WITH_LF
1431 #ifndef WITH_ISO14443a_StandAlone
1432 if (BUTTON_HELD(1000) > 0)
1433 SamyRun();
1434 #endif
1435 #endif
1436 #ifdef WITH_ISO14443a
1437 #ifdef WITH_ISO14443a_StandAlone
1438 if (BUTTON_HELD(1000) > 0)
1439 StandAloneMode14a();
1440 #endif
1441 #endif
1442 }
1443 }
Proxmark3 GIT tracking
Impressum, Datenschutz