]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: Added the HitagS from @spenneb ref:https://events.ccc.de/congress/2015/Fahrplan...
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include "hitag2.h"
26 #include "hitagS.h"
27 #include "lfsampling.h"
28 #include "BigBuf.h"
29 #include "mifareutil.h"
30 #include "pcf7931.h"
31 #ifdef WITH_LCD
32 #include "LCD.h"
33 #endif
34
35 // Craig Young - 14a stand-alone code
36 #ifdef WITH_ISO14443a_StandAlone
37 #include "iso14443a.h"
38 #include "protocols.h"
39 #endif
40
41 #define abs(x) ( ((x)<0) ? -(x) : (x) )
42
43 //=============================================================================
44 // A buffer where we can queue things up to be sent through the FPGA, for
45 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
46 // is the order in which they go out on the wire.
47 //=============================================================================
48
49 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
50 uint8_t ToSend[TOSEND_BUFFER_SIZE];
51 int ToSendMax = 0;
52 static int ToSendBit;
53 struct common_area common_area __attribute__((section(".commonarea")));
54
55 void ToSendReset(void)
56 {
57 ToSendMax = -1;
58 ToSendBit = 8;
59 }
60
61 void ToSendStuffBit(int b) {
62 if(ToSendBit >= 8) {
63 ++ToSendMax;
64 ToSend[ToSendMax] = 0;
65 ToSendBit = 0;
66 }
67
68 if(b)
69 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
70
71 ++ToSendBit;
72
73 if(ToSendMax >= sizeof(ToSend)) {
74 ToSendBit = 0;
75 DbpString("ToSendStuffBit overflowed!");
76 }
77 }
78
79 //=============================================================================
80 // Debug print functions, to go out over USB, to the usual PC-side client.
81 //=============================================================================
82
83 void DbpString(char *str) {
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
86 }
87
88 #if 0
89 void DbpIntegers(int x1, int x2, int x3) {
90 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
91 }
92 #endif
93
94 void Dbprintf(const char *fmt, ...) {
95 // should probably limit size here; oh well, let's just use a big buffer
96 char output_string[128] = {0x00};
97 va_list ap;
98
99 va_start(ap, fmt);
100 kvsprintf(fmt, output_string, 10, ap);
101 va_end(ap);
102
103 DbpString(output_string);
104 }
105
106 // prints HEX & ASCII
107 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
108 int l=0, i;
109 char ascii[9];
110
111 while (len>0) {
112
113 l = (len>8) ? 8 : len;
114
115 memcpy(ascii,d,l);
116 ascii[l]=0;
117
118 // filter safe ascii
119 for (i=0; i<l; ++i)
120 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
121
122 if (bAsci)
123 Dbprintf("%-8s %*D",ascii,l,d," ");
124 else
125 Dbprintf("%*D",l,d," ");
126
127 len -= 8;
128 d += 8;
129 }
130 }
131
132 //-----------------------------------------------------------------------------
133 // Read an ADC channel and block till it completes, then return the result
134 // in ADC units (0 to 1023). Also a routine to average 32 samples and
135 // return that.
136 //-----------------------------------------------------------------------------
137 static int ReadAdc(int ch)
138 {
139 uint32_t d;
140
141 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
142 AT91C_BASE_ADC->ADC_MR =
143 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
144 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
145 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
146
147 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
148 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
149 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
150 //
151 // The maths are:
152 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
153 //
154 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
155 //
156 // Note: with the "historic" values in the comments above, the error was 34% !!!
157
158 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
159
160 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
161
162 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
163
164 d = AT91C_BASE_ADC->ADC_CDR[ch];
165 return d;
166 }
167
168 int AvgAdc(int ch) // was static - merlok
169 {
170 int i;
171 int a = 0;
172
173 for(i = 0; i < 32; ++i)
174 a += ReadAdc(ch);
175
176 return (a + 15) >> 5;
177 }
178
179 void MeasureAntennaTuning(void) {
180 uint8_t LF_Results[256];
181 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
182 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
183
184 LED_B_ON();
185
186 /*
187 * Sweeps the useful LF range of the proxmark from
188 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
189 * read the voltage in the antenna, the result left
190 * in the buffer is a graph which should clearly show
191 * the resonating frequency of your LF antenna
192 * ( hopefully around 95 if it is tuned to 125kHz!)
193 */
194
195 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
196 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
197
198 for (i=255; i>=19; i--) {
199 WDT_HIT();
200 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
201 SpinDelay(20);
202 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
203 if (i==95) vLf125 = adcval; // voltage at 125Khz
204 if (i==89) vLf134 = adcval; // voltage at 134Khz
205
206 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
207 if(LF_Results[i] > peak) {
208 peakv = adcval;
209 peak = LF_Results[i];
210 peakf = i;
211 //ptr = i;
212 }
213 }
214
215 for (i=18; i >= 0; i--) LF_Results[i] = 0;
216
217 LED_A_ON();
218 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
219 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
220 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
221 SpinDelay(20);
222 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
223
224 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
225 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
226
227 LEDsoff();
228 }
229
230 void MeasureAntennaTuningHf(void) {
231 int vHf = 0; // in mV
232
233 DbpString("Measuring HF antenna, press button to exit");
234
235 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
236 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
237 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
238
239 for (;;) {
240 SpinDelay(20);
241 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
242
243 Dbprintf("%d mV",vHf);
244 if (BUTTON_PRESS()) break;
245 }
246
247 DbpString("cancelled");
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
249 }
250
251
252 void ReadMem(int addr) {
253 const uint8_t *data = ((uint8_t *)addr);
254
255 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
256 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
257 }
258
259 /* osimage version information is linked in */
260 extern struct version_information version_information;
261 /* bootrom version information is pointed to from _bootphase1_version_pointer */
262 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
263 void SendVersion(void)
264 {
265 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
266 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
267
268 /* Try to find the bootrom version information. Expect to find a pointer at
269 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
270 * pointer, then use it.
271 */
272 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
273
274 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
275 strcat(VersionString, "bootrom version information appears invalid\n");
276 } else {
277 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
278 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
279 }
280
281 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
282 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
283
284 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
285 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
286
287 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
288 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
289
290 // Send Chip ID and used flash memory
291 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
292 uint32_t compressed_data_section_size = common_area.arg1;
293 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
294 }
295
296 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
297 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
298 void printUSBSpeed(void)
299 {
300 Dbprintf("USB Speed:");
301 Dbprintf(" Sending USB packets to client...");
302
303 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
304 uint8_t *test_data = BigBuf_get_addr();
305 uint32_t end_time;
306
307 uint32_t start_time = end_time = GetTickCount();
308 uint32_t bytes_transferred = 0;
309
310 LED_B_ON();
311 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
312 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
313 end_time = GetTickCount();
314 bytes_transferred += USB_CMD_DATA_SIZE;
315 }
316 LED_B_OFF();
317
318 Dbprintf(" Time elapsed: %dms", end_time - start_time);
319 Dbprintf(" Bytes transferred: %d", bytes_transferred);
320 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
321 1000 * bytes_transferred / (end_time - start_time));
322
323 }
324
325 /**
326 * Prints runtime information about the PM3.
327 **/
328 void SendStatus(void) {
329 BigBuf_print_status();
330 Fpga_print_status();
331 printConfig(); //LF Sampling config
332 printUSBSpeed();
333 Dbprintf("Various");
334 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
335 Dbprintf(" ToSendMax..........%d", ToSendMax);
336 Dbprintf(" ToSendBit..........%d", ToSendBit);
337 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
338
339 cmd_send(CMD_ACK,1,0,0,0,0);
340 }
341
342 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
343
344 #define OPTS 2
345 void StandAloneMode()
346 {
347 DbpString("Stand-alone mode! No PC necessary.");
348 // Oooh pretty -- notify user we're in elite samy mode now
349 LED(LED_RED, 200);
350 LED(LED_ORANGE, 200);
351 LED(LED_GREEN, 200);
352 LED(LED_ORANGE, 200);
353 LED(LED_RED, 200);
354 LED(LED_ORANGE, 200);
355 LED(LED_GREEN, 200);
356 LED(LED_ORANGE, 200);
357 LED(LED_RED, 200);
358 }
359 #endif
360
361 #ifdef WITH_ISO14443a_StandAlone
362 void StandAloneMode14a()
363 {
364 StandAloneMode();
365 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
366
367 int selected = 0;
368 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
369 int cardRead[OPTS] = {0};
370 uint8_t readUID[10] = {0};
371 uint32_t uid_1st[OPTS]={0};
372 uint32_t uid_2nd[OPTS]={0};
373 uint32_t uid_tmp1 = 0;
374 uint32_t uid_tmp2 = 0;
375 iso14a_card_select_t hi14a_card[OPTS];
376
377 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
378
379 LED(selected + 1, 0);
380
381 for (;;)
382 {
383 usb_poll();
384 WDT_HIT();
385 SpinDelay(300);
386
387 if (iGotoRecord == 1 || cardRead[selected] == 0)
388 {
389 iGotoRecord = 0;
390 LEDsoff();
391 LED(selected + 1, 0);
392 LED(LED_RED2, 0);
393
394 // record
395 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
396 /* need this delay to prevent catching some weird data */
397 SpinDelay(500);
398 /* Code for reading from 14a tag */
399 uint8_t uid[10] = {0};
400 uint32_t cuid = 0;
401 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
402
403 for ( ; ; )
404 {
405 WDT_HIT();
406 if (BUTTON_PRESS()) {
407 if (cardRead[selected]) {
408 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
409 break;
410 }
411 else if (cardRead[(selected+1)%OPTS]) {
412 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
413 selected = (selected+1)%OPTS;
414 break; // playing = 1;
415 }
416 else {
417 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
418 SpinDelay(300);
419 }
420 }
421 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
422 continue;
423 else
424 {
425 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
426 memcpy(readUID,uid,10*sizeof(uint8_t));
427 uint8_t *dst = (uint8_t *)&uid_tmp1;
428 // Set UID byte order
429 for (int i=0; i<4; i++)
430 dst[i] = uid[3-i];
431 dst = (uint8_t *)&uid_tmp2;
432 for (int i=0; i<4; i++)
433 dst[i] = uid[7-i];
434 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
435 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
436 }
437 else {
438 if (uid_tmp2) {
439 Dbprintf("Bank[%d] received a 7-byte UID",selected);
440 uid_1st[selected] = (uid_tmp1)>>8;
441 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
442 }
443 else {
444 Dbprintf("Bank[%d] received a 4-byte UID",selected);
445 uid_1st[selected] = uid_tmp1;
446 uid_2nd[selected] = uid_tmp2;
447 }
448 break;
449 }
450 }
451 }
452 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
453 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
454 LEDsoff();
455 LED(LED_GREEN, 200);
456 LED(LED_ORANGE, 200);
457 LED(LED_GREEN, 200);
458 LED(LED_ORANGE, 200);
459
460 LEDsoff();
461 LED(selected + 1, 0);
462
463 // Next state is replay:
464 playing = 1;
465
466 cardRead[selected] = 1;
467 }
468 /* MF Classic UID clone */
469 else if (iGotoClone==1)
470 {
471 iGotoClone=0;
472 LEDsoff();
473 LED(selected + 1, 0);
474 LED(LED_ORANGE, 250);
475
476 // record
477 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
478
479 // wait for button to be released
480 // Delay cloning until card is in place
481 while(BUTTON_PRESS())
482 WDT_HIT();
483
484 Dbprintf("Starting clone. [Bank: %u]", selected);
485 // need this delay to prevent catching some weird data
486 SpinDelay(500);
487 // Begin clone function here:
488 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
489 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
490 memcpy(c.d.asBytes, data, 16);
491 SendCommand(&c);
492
493 Block read is similar:
494 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
495 We need to imitate that call with blockNo 0 to set a uid.
496
497 The get and set commands are handled in this file:
498 // Work with "magic Chinese" card
499 case CMD_MIFARE_CSETBLOCK:
500 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
501 break;
502 case CMD_MIFARE_CGETBLOCK:
503 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
504 break;
505
506 mfCSetUID provides example logic for UID set workflow:
507 -Read block0 from card in field with MifareCGetBlock()
508 -Configure new values without replacing reserved bytes
509 memcpy(block0, uid, 4); // Copy UID bytes from byte array
510 // Mifare UID BCC
511 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
512 Bytes 5-7 are reserved SAK and ATQA for mifare classic
513 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
514 */
515 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
516 // arg0 = Flags, arg1=blockNo
517 MifareCGetBlock(params, 0, oldBlock0);
518 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
519 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
520 playing = 1;
521 }
522 else {
523 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
524 memcpy(newBlock0,oldBlock0,16);
525 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
526
527 newBlock0[0] = uid_1st[selected]>>24;
528 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
529 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
530 newBlock0[3] = 0xFF & (uid_1st[selected]);
531 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
532
533 // arg0 = workFlags, arg1 = blockNo, datain
534 MifareCSetBlock(params, 0, newBlock0);
535 MifareCGetBlock(params, 0, testBlock0);
536
537 if (memcmp(testBlock0, newBlock0, 16)==0) {
538 DbpString("Cloned successfull!");
539 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
540 playing = 0;
541 iGotoRecord = 1;
542 selected = (selected + 1) % OPTS;
543 } else {
544 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
545 playing = 1;
546 }
547 }
548 LEDsoff();
549 LED(selected + 1, 0);
550 }
551 // Change where to record (or begin playing)
552 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
553 {
554 LEDsoff();
555 LED(selected + 1, 0);
556
557 // Begin transmitting
558 if (playing)
559 {
560 LED(LED_GREEN, 0);
561 DbpString("Playing");
562 for ( ; ; ) {
563 WDT_HIT();
564 int button_action = BUTTON_HELD(1000);
565 if (button_action == 0) { // No button action, proceed with sim
566 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
567 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
568 num_to_bytes(uid_1st[selected], 3, data);
569 num_to_bytes(uid_2nd[selected], 4, data);
570
571 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
572 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
573 DbpString("Mifare Classic");
574 SimulateIso14443aTag(1, flags, data); // Mifare Classic
575 }
576 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
577 DbpString("Mifare Ultralight");
578 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
579 }
580 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
581 DbpString("Mifare DESFire");
582 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
583 }
584 else {
585 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
586 SimulateIso14443aTag(1, flags, data);
587 }
588 }
589 else if (button_action == BUTTON_SINGLE_CLICK) {
590 selected = (selected + 1) % OPTS;
591 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
592 iGotoRecord = 1;
593 break;
594 }
595 else if (button_action == BUTTON_HOLD) {
596 Dbprintf("Playtime over. Begin cloning...");
597 iGotoClone = 1;
598 break;
599 }
600 WDT_HIT();
601 }
602
603 /* We pressed a button so ignore it here with a delay */
604 SpinDelay(300);
605 LEDsoff();
606 LED(selected + 1, 0);
607 }
608 else
609 while(BUTTON_PRESS())
610 WDT_HIT();
611 }
612 }
613 }
614 #elif WITH_LF
615 // samy's sniff and repeat routine
616 void SamyRun()
617 {
618 StandAloneMode();
619 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
620
621 int high[OPTS], low[OPTS];
622 int selected = 0;
623 int playing = 0;
624 int cardRead = 0;
625
626 // Turn on selected LED
627 LED(selected + 1, 0);
628
629 for (;;) {
630 usb_poll();
631 WDT_HIT();
632
633 // Was our button held down or pressed?
634 int button_pressed = BUTTON_HELD(1000);
635 SpinDelay(300);
636
637 // Button was held for a second, begin recording
638 if (button_pressed > 0 && cardRead == 0)
639 {
640 LEDsoff();
641 LED(selected + 1, 0);
642 LED(LED_RED2, 0);
643
644 // record
645 DbpString("Starting recording");
646
647 // wait for button to be released
648 while(BUTTON_PRESS())
649 WDT_HIT();
650
651 /* need this delay to prevent catching some weird data */
652 SpinDelay(500);
653
654 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
655 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
656
657 LEDsoff();
658 LED(selected + 1, 0);
659 // Finished recording
660 // If we were previously playing, set playing off
661 // so next button push begins playing what we recorded
662 playing = 0;
663 cardRead = 1;
664 }
665 else if (button_pressed > 0 && cardRead == 1) {
666 LEDsoff();
667 LED(selected + 1, 0);
668 LED(LED_ORANGE, 0);
669
670 // record
671 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
672
673 // wait for button to be released
674 while(BUTTON_PRESS())
675 WDT_HIT();
676
677 /* need this delay to prevent catching some weird data */
678 SpinDelay(500);
679
680 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
681 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
682
683 LEDsoff();
684 LED(selected + 1, 0);
685 // Finished recording
686
687 // If we were previously playing, set playing off
688 // so next button push begins playing what we recorded
689 playing = 0;
690 cardRead = 0;
691 }
692
693 // Change where to record (or begin playing)
694 else if (button_pressed) {
695 // Next option if we were previously playing
696 if (playing)
697 selected = (selected + 1) % OPTS;
698 playing = !playing;
699
700 LEDsoff();
701 LED(selected + 1, 0);
702
703 // Begin transmitting
704 if (playing)
705 {
706 LED(LED_GREEN, 0);
707 DbpString("Playing");
708 // wait for button to be released
709 while(BUTTON_PRESS())
710 WDT_HIT();
711
712 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
713 CmdHIDsimTAG(high[selected], low[selected], 0);
714 DbpString("Done playing");
715
716 if (BUTTON_HELD(1000) > 0) {
717 DbpString("Exiting");
718 LEDsoff();
719 return;
720 }
721
722 /* We pressed a button so ignore it here with a delay */
723 SpinDelay(300);
724
725 // when done, we're done playing, move to next option
726 selected = (selected + 1) % OPTS;
727 playing = !playing;
728 LEDsoff();
729 LED(selected + 1, 0);
730 }
731 else
732 while(BUTTON_PRESS())
733 WDT_HIT();
734 }
735 }
736 }
737
738 #endif
739 /*
740 OBJECTIVE
741 Listen and detect an external reader. Determine the best location
742 for the antenna.
743
744 INSTRUCTIONS:
745 Inside the ListenReaderField() function, there is two mode.
746 By default, when you call the function, you will enter mode 1.
747 If you press the PM3 button one time, you will enter mode 2.
748 If you press the PM3 button a second time, you will exit the function.
749
750 DESCRIPTION OF MODE 1:
751 This mode just listens for an external reader field and lights up green
752 for HF and/or red for LF. This is the original mode of the detectreader
753 function.
754
755 DESCRIPTION OF MODE 2:
756 This mode will visually represent, using the LEDs, the actual strength of the
757 current compared to the maximum current detected. Basically, once you know
758 what kind of external reader is present, it will help you spot the best location to place
759 your antenna. You will probably not get some good results if there is a LF and a HF reader
760 at the same place! :-)
761
762 LIGHT SCHEME USED:
763 */
764 static const char LIGHT_SCHEME[] = {
765 0x0, /* ---- | No field detected */
766 0x1, /* X--- | 14% of maximum current detected */
767 0x2, /* -X-- | 29% of maximum current detected */
768 0x4, /* --X- | 43% of maximum current detected */
769 0x8, /* ---X | 57% of maximum current detected */
770 0xC, /* --XX | 71% of maximum current detected */
771 0xE, /* -XXX | 86% of maximum current detected */
772 0xF, /* XXXX | 100% of maximum current detected */
773 };
774 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
775
776 void ListenReaderField(int limit) {
777 #define LF_ONLY 1
778 #define HF_ONLY 2
779 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
780
781 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
782 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
783 int mode=1, display_val, display_max, i;
784
785 // switch off FPGA - we don't want to measure our own signal
786 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
787 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
788
789 LEDsoff();
790
791 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
792
793 if(limit != HF_ONLY) {
794 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
795 lf_baseline = lf_av;
796 }
797
798 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
799
800 if (limit != LF_ONLY) {
801 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
802 hf_baseline = hf_av;
803 }
804
805 for(;;) {
806 if (BUTTON_PRESS()) {
807 SpinDelay(500);
808 switch (mode) {
809 case 1:
810 mode=2;
811 DbpString("Signal Strength Mode");
812 break;
813 case 2:
814 default:
815 DbpString("Stopped");
816 LEDsoff();
817 return;
818 break;
819 }
820 }
821 WDT_HIT();
822
823 if (limit != HF_ONLY) {
824 if(mode == 1) {
825 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
826 LED_D_ON();
827 else
828 LED_D_OFF();
829 }
830
831 lf_av_new = AvgAdc(ADC_CHAN_LF);
832 // see if there's a significant change
833 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
834 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
835 lf_av = lf_av_new;
836 if (lf_av > lf_max)
837 lf_max = lf_av;
838 }
839 }
840
841 if (limit != LF_ONLY) {
842 if (mode == 1){
843 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
844 LED_B_ON();
845 else
846 LED_B_OFF();
847 }
848
849 hf_av_new = AvgAdc(ADC_CHAN_HF);
850 // see if there's a significant change
851 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
852 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
853 hf_av = hf_av_new;
854 if (hf_av > hf_max)
855 hf_max = hf_av;
856 }
857 }
858
859 if(mode == 2) {
860 if (limit == LF_ONLY) {
861 display_val = lf_av;
862 display_max = lf_max;
863 } else if (limit == HF_ONLY) {
864 display_val = hf_av;
865 display_max = hf_max;
866 } else { /* Pick one at random */
867 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
868 display_val = hf_av;
869 display_max = hf_max;
870 } else {
871 display_val = lf_av;
872 display_max = lf_max;
873 }
874 }
875 for (i=0; i<LIGHT_LEN; i++) {
876 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
877 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
878 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
879 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
880 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
881 break;
882 }
883 }
884 }
885 }
886 }
887
888 void UsbPacketReceived(uint8_t *packet, int len)
889 {
890 UsbCommand *c = (UsbCommand *)packet;
891
892 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
893
894 switch(c->cmd) {
895 #ifdef WITH_LF
896 case CMD_SET_LF_SAMPLING_CONFIG:
897 setSamplingConfig((sample_config *) c->d.asBytes);
898 break;
899 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
900 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
901 break;
902 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
903 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
904 break;
905 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
906 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
907 break;
908 case CMD_HID_DEMOD_FSK:
909 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
910 break;
911 case CMD_HID_SIM_TAG:
912 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
913 break;
914 case CMD_FSK_SIM_TAG:
915 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
916 break;
917 case CMD_ASK_SIM_TAG:
918 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
919 break;
920 case CMD_PSK_SIM_TAG:
921 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
922 break;
923 case CMD_HID_CLONE_TAG:
924 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
925 break;
926 case CMD_IO_DEMOD_FSK:
927 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
928 break;
929 case CMD_IO_CLONE_TAG:
930 CopyIOtoT55x7(c->arg[0], c->arg[1]);
931 break;
932 case CMD_EM410X_DEMOD:
933 CmdEM410xdemod(c->arg[0], 0, 0, 1);
934 break;
935 case CMD_EM410X_WRITE_TAG:
936 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
937 break;
938 case CMD_READ_TI_TYPE:
939 ReadTItag();
940 break;
941 case CMD_WRITE_TI_TYPE:
942 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
943 break;
944 case CMD_SIMULATE_TAG_125K:
945 LED_A_ON();
946 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
947 LED_A_OFF();
948 break;
949 case CMD_LF_SIMULATE_BIDIR:
950 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
951 break;
952 case CMD_INDALA_CLONE_TAG:
953 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
954 break;
955 case CMD_INDALA_CLONE_TAG_L:
956 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
957 break;
958 case CMD_T55XX_READ_BLOCK:
959 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
960 break;
961 case CMD_T55XX_WRITE_BLOCK:
962 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
963 break;
964 case CMD_T55XX_WAKEUP:
965 T55xxWakeUp(c->arg[0]);
966 break;
967 case CMD_T55XX_RESET_READ:
968 T55xxResetRead();
969 break;
970 case CMD_PCF7931_READ:
971 ReadPCF7931();
972 break;
973 case CMD_PCF7931_WRITE:
974 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
975 break;
976 case CMD_EM4X_READ_WORD:
977 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
978 break;
979 case CMD_EM4X_WRITE_WORD:
980 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
981 break;
982 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
983 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
984 break;
985 case CMD_VIKING_CLONE_TAG:
986 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
987 break;
988 #endif
989
990 #ifdef WITH_HITAG
991 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
992 SnoopHitag(c->arg[0]);
993 break;
994 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
995 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
996 break;
997 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
998 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
999 break;
1000 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1001 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1002 break;
1003 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1004 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1005 break;
1006 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1007 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1008 break;
1009 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1010 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1011 break;
1012 #endif
1013
1014 #ifdef WITH_ISO15693
1015 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1016 AcquireRawAdcSamplesIso15693();
1017 break;
1018 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1019 RecordRawAdcSamplesIso15693();
1020 break;
1021
1022 case CMD_ISO_15693_COMMAND:
1023 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1024 break;
1025
1026 case CMD_ISO_15693_FIND_AFI:
1027 BruteforceIso15693Afi(c->arg[0]);
1028 break;
1029
1030 case CMD_ISO_15693_DEBUG:
1031 SetDebugIso15693(c->arg[0]);
1032 break;
1033
1034 case CMD_READER_ISO_15693:
1035 ReaderIso15693(c->arg[0]);
1036 break;
1037 case CMD_SIMTAG_ISO_15693:
1038 SimTagIso15693(c->arg[0], c->d.asBytes);
1039 break;
1040 #endif
1041
1042 #ifdef WITH_LEGICRF
1043 case CMD_SIMULATE_TAG_LEGIC_RF:
1044 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1045 break;
1046
1047 case CMD_WRITER_LEGIC_RF:
1048 LegicRfWriter(c->arg[1], c->arg[0]);
1049 break;
1050
1051 case CMD_READER_LEGIC_RF:
1052 LegicRfReader(c->arg[0], c->arg[1]);
1053 break;
1054 #endif
1055
1056 #ifdef WITH_ISO14443b
1057 case CMD_READ_SRI512_TAG:
1058 ReadSTMemoryIso14443b(0x0F);
1059 break;
1060 case CMD_READ_SRIX4K_TAG:
1061 ReadSTMemoryIso14443b(0x7F);
1062 break;
1063 case CMD_SNOOP_ISO_14443B:
1064 SnoopIso14443b();
1065 break;
1066 case CMD_SIMULATE_TAG_ISO_14443B:
1067 SimulateIso14443bTag();
1068 break;
1069 case CMD_ISO_14443B_COMMAND:
1070 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1071 break;
1072 #endif
1073
1074 #ifdef WITH_ISO14443a
1075 case CMD_SNOOP_ISO_14443a:
1076 SniffIso14443a(c->arg[0]);
1077 break;
1078 case CMD_READER_ISO_14443a:
1079 ReaderIso14443a(c);
1080 break;
1081 case CMD_SIMULATE_TAG_ISO_14443a:
1082 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1083 break;
1084
1085 case CMD_EPA_PACE_COLLECT_NONCE:
1086 EPA_PACE_Collect_Nonce(c);
1087 break;
1088 case CMD_EPA_PACE_REPLAY:
1089 EPA_PACE_Replay(c);
1090 break;
1091
1092 case CMD_READER_MIFARE:
1093 ReaderMifare(c->arg[0], c->arg[1]);
1094 break;
1095 case CMD_MIFARE_READBL:
1096 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1097 break;
1098 case CMD_MIFAREU_READBL:
1099 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1100 break;
1101 case CMD_MIFAREUC_AUTH:
1102 MifareUC_Auth(c->arg[0],c->d.asBytes);
1103 break;
1104 case CMD_MIFAREU_READCARD:
1105 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1106 break;
1107 case CMD_MIFAREUC_SETPWD:
1108 MifareUSetPwd(c->arg[0], c->d.asBytes);
1109 break;
1110 case CMD_MIFARE_READSC:
1111 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1112 break;
1113 case CMD_MIFARE_WRITEBL:
1114 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1115 break;
1116 //case CMD_MIFAREU_WRITEBL_COMPAT:
1117 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1118 //break;
1119 case CMD_MIFAREU_WRITEBL:
1120 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1121 break;
1122 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1123 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1124 break;
1125 case CMD_MIFARE_NESTED:
1126 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1127 break;
1128 case CMD_MIFARE_CHKKEYS:
1129 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1130 break;
1131 case CMD_SIMULATE_MIFARE_CARD:
1132 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1133 break;
1134
1135 // emulator
1136 case CMD_MIFARE_SET_DBGMODE:
1137 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1138 break;
1139 case CMD_MIFARE_EML_MEMCLR:
1140 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1141 break;
1142 case CMD_MIFARE_EML_MEMSET:
1143 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1144 break;
1145 case CMD_MIFARE_EML_MEMGET:
1146 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1147 break;
1148 case CMD_MIFARE_EML_CARDLOAD:
1149 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1150 break;
1151
1152 // Work with "magic Chinese" card
1153 case CMD_MIFARE_CSETBLOCK:
1154 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_CGETBLOCK:
1157 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1158 break;
1159 case CMD_MIFARE_CIDENT:
1160 MifareCIdent();
1161 break;
1162
1163 // mifare sniffer
1164 case CMD_MIFARE_SNIFFER:
1165 SniffMifare(c->arg[0]);
1166 break;
1167
1168 //mifare desfire
1169 case CMD_MIFARE_DESFIRE_READBL: break;
1170 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1171 case CMD_MIFARE_DESFIRE_AUTH1:
1172 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1173 break;
1174 case CMD_MIFARE_DESFIRE_AUTH2:
1175 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1176 break;
1177 case CMD_MIFARE_DES_READER:
1178 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1179 break;
1180 case CMD_MIFARE_DESFIRE_INFO:
1181 MifareDesfireGetInformation();
1182 break;
1183 case CMD_MIFARE_DESFIRE:
1184 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1185 break;
1186
1187 case CMD_MIFARE_COLLECT_NONCES:
1188 break;
1189 #endif
1190 #ifdef WITH_EMV
1191 case CMD_EMV_TRANSACTION:
1192 EMVTransaction();
1193 break;
1194 case CMD_EMV_GET_RANDOM_NUM:
1195 //EMVgetUDOL();
1196 break;
1197 case CMD_EMV_LOAD_VALUE:
1198 EMVloadvalue(c->arg[0], c->d.asBytes);
1199 break;
1200 case CMD_EMV_DUMP_CARD:
1201 EMVdumpcard();
1202 #endif
1203 #ifdef WITH_ICLASS
1204 // Makes use of ISO14443a FPGA Firmware
1205 case CMD_SNOOP_ICLASS:
1206 SnoopIClass();
1207 break;
1208 case CMD_SIMULATE_TAG_ICLASS:
1209 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1210 break;
1211 case CMD_READER_ICLASS:
1212 ReaderIClass(c->arg[0]);
1213 break;
1214 case CMD_READER_ICLASS_REPLAY:
1215 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1216 break;
1217 case CMD_ICLASS_EML_MEMSET:
1218 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1219 break;
1220 case CMD_ICLASS_WRITEBLOCK:
1221 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1222 break;
1223 case CMD_ICLASS_READCHECK: // auth step 1
1224 iClass_ReadCheck(c->arg[0], c->arg[1]);
1225 break;
1226 case CMD_ICLASS_READBLOCK:
1227 iClass_ReadBlk(c->arg[0]);
1228 break;
1229 case CMD_ICLASS_AUTHENTICATION: //check
1230 iClass_Authentication(c->d.asBytes);
1231 break;
1232 case CMD_ICLASS_DUMP:
1233 iClass_Dump(c->arg[0], c->arg[1]);
1234 break;
1235 case CMD_ICLASS_CLONE:
1236 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1237 break;
1238 #endif
1239 #ifdef WITH_HFSNOOP
1240 case CMD_HF_SNIFFER:
1241 HfSnoop(c->arg[0], c->arg[1]);
1242 break;
1243 #endif
1244
1245 case CMD_BUFF_CLEAR:
1246 BigBuf_Clear();
1247 break;
1248
1249 case CMD_MEASURE_ANTENNA_TUNING:
1250 MeasureAntennaTuning();
1251 break;
1252
1253 case CMD_MEASURE_ANTENNA_TUNING_HF:
1254 MeasureAntennaTuningHf();
1255 break;
1256
1257 case CMD_LISTEN_READER_FIELD:
1258 ListenReaderField(c->arg[0]);
1259 break;
1260
1261 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1262 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1263 SpinDelay(200);
1264 LED_D_OFF(); // LED D indicates field ON or OFF
1265 break;
1266
1267 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1268
1269 LED_B_ON();
1270 uint8_t *BigBuf = BigBuf_get_addr();
1271 size_t len = 0;
1272 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1273 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1274 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1275 }
1276 // Trigger a finish downloading signal with an ACK frame
1277 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1278 LED_B_OFF();
1279 break;
1280
1281 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1282 uint8_t *b = BigBuf_get_addr();
1283 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1284 cmd_send(CMD_ACK,0,0,0,0,0);
1285 break;
1286 }
1287 case CMD_READ_MEM:
1288 ReadMem(c->arg[0]);
1289 break;
1290
1291 case CMD_SET_LF_DIVISOR:
1292 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1293 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1294 break;
1295
1296 case CMD_SET_ADC_MUX:
1297 switch(c->arg[0]) {
1298 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1299 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1300 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1301 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1302 }
1303 break;
1304
1305 case CMD_VERSION:
1306 SendVersion();
1307 break;
1308 case CMD_STATUS:
1309 SendStatus();
1310 break;
1311 case CMD_PING:
1312 cmd_send(CMD_ACK,0,0,0,0,0);
1313 break;
1314 #ifdef WITH_LCD
1315 case CMD_LCD_RESET:
1316 LCDReset();
1317 break;
1318 case CMD_LCD:
1319 LCDSend(c->arg[0]);
1320 break;
1321 #endif
1322 case CMD_SETUP_WRITE:
1323 case CMD_FINISH_WRITE:
1324 case CMD_HARDWARE_RESET:
1325 usb_disable();
1326 SpinDelay(2000);
1327 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1328 for(;;) {
1329 // We're going to reset, and the bootrom will take control.
1330 }
1331 break;
1332
1333 case CMD_START_FLASH:
1334 if(common_area.flags.bootrom_present) {
1335 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1336 }
1337 usb_disable();
1338 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1339 for(;;);
1340 break;
1341
1342 case CMD_DEVICE_INFO: {
1343 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1344 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1345 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1346 break;
1347 }
1348 default:
1349 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1350 break;
1351 }
1352 }
1353
1354 void __attribute__((noreturn)) AppMain(void)
1355 {
1356 SpinDelay(100);
1357 clear_trace();
1358 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1359 /* Initialize common area */
1360 memset(&common_area, 0, sizeof(common_area));
1361 common_area.magic = COMMON_AREA_MAGIC;
1362 common_area.version = 1;
1363 }
1364 common_area.flags.osimage_present = 1;
1365
1366 LED_D_OFF();
1367 LED_C_OFF();
1368 LED_B_OFF();
1369 LED_A_OFF();
1370
1371 // Init USB device
1372 usb_enable();
1373
1374 // The FPGA gets its clock from us from PCK0 output, so set that up.
1375 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1376 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1377 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1378 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1379 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1380 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1381 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1382
1383 // Reset SPI
1384 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1385 // Reset SSC
1386 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1387
1388 // Load the FPGA image, which we have stored in our flash.
1389 // (the HF version by default)
1390 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1391
1392 StartTickCount();
1393
1394 #ifdef WITH_LCD
1395 LCDInit();
1396 #endif
1397
1398 byte_t rx[sizeof(UsbCommand)];
1399 size_t rx_len;
1400
1401 for(;;) {
1402 if (usb_poll()) {
1403 rx_len = usb_read(rx,sizeof(UsbCommand));
1404 if (rx_len)
1405 UsbPacketReceived(rx,rx_len);
1406 }
1407 WDT_HIT();
1408
1409 #ifdef WITH_LF
1410 #ifndef WITH_ISO14443a_StandAlone
1411 if (BUTTON_HELD(1000) > 0)
1412 SamyRun();
1413 #endif
1414 #endif
1415 #ifdef WITH_ISO14443a
1416 #ifdef WITH_ISO14443a_StandAlone
1417 if (BUTTON_HELD(1000) > 0)
1418 StandAloneMode14a();
1419 #endif
1420 #endif
1421 }
1422 }
Proxmark3 GIT tracking
Impressum, Datenschutz