]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: added triplesided UID to "hf mf sniff"
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12 #include "usb_cdc.h"
13 #include "cmd.h"
14 #include "proxmark3.h"
15 #include "apps.h"
16 #include "util.h"
17 #include "printf.h"
18 #include "string.h"
19 #include <stdarg.h>
20 #include "legicrf.h"
21 #include "hitag2.h"
22 #include "hitagS.h"
23 #include "lfsampling.h"
24 #include "BigBuf.h"
25 #include "mifareutil.h"
26 #include "pcf7931.h"
27
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 // Craig Young - 14a stand-alone code
33 #ifdef WITH_ISO14443a_StandAlone
34 #include "iso14443a.h"
35 #include "protocols.h"
36 #endif
37
38 //=============================================================================
39 // A buffer where we can queue things up to be sent through the FPGA, for
40 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
41 // is the order in which they go out on the wire.
42 //=============================================================================
43
44 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
45 uint8_t ToSend[TOSEND_BUFFER_SIZE];
46 int ToSendMax = 0;
47 static int ToSendBit;
48 struct common_area common_area __attribute__((section(".commonarea")));
49
50 void ToSendReset(void)
51 {
52 ToSendMax = -1;
53 ToSendBit = 8;
54 }
55
56 void ToSendStuffBit(int b) {
57 if(ToSendBit >= 8) {
58 ++ToSendMax;
59 ToSend[ToSendMax] = 0;
60 ToSendBit = 0;
61 }
62
63 if(b)
64 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
65
66 ++ToSendBit;
67
68 if(ToSendMax >= sizeof(ToSend)) {
69 ToSendBit = 0;
70 DbpString("ToSendStuffBit overflowed!");
71 }
72 }
73
74 //=============================================================================
75 // Debug print functions, to go out over USB, to the usual PC-side client.
76 //=============================================================================
77
78 void DbpStringEx(char *str, uint32_t cmd){
79 byte_t len = strlen(str);
80 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
81 }
82
83 void DbpString(char *str) {
84 DbpStringEx(str, 0);
85 }
86
87 #if 0
88 void DbpIntegers(int x1, int x2, int x3) {
89 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
90 }
91 #endif
92 void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
93 // should probably limit size here; oh well, let's just use a big buffer
94 char output_string[128] = {0x00};
95 va_list ap;
96
97 va_start(ap, fmt);
98 kvsprintf(fmt, output_string, 10, ap);
99 va_end(ap);
100
101 DbpStringEx(output_string, cmd);
102 }
103
104 void Dbprintf(const char *fmt, ...) {
105 // should probably limit size here; oh well, let's just use a big buffer
106 char output_string[128] = {0x00};
107 va_list ap;
108
109 va_start(ap, fmt);
110 kvsprintf(fmt, output_string, 10, ap);
111 va_end(ap);
112
113 DbpString(output_string);
114 }
115
116 // prints HEX & ASCII
117 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
118 int l=0, i;
119 char ascii[9];
120
121 while (len>0) {
122
123 l = (len>8) ? 8 : len;
124
125 memcpy(ascii,d,l);
126 ascii[l]=0;
127
128 // filter safe ascii
129 for (i=0; i<l; ++i)
130 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
131
132 if (bAsci)
133 Dbprintf("%-8s %*D",ascii,l,d," ");
134 else
135 Dbprintf("%*D",l,d," ");
136
137 len -= 8;
138 d += 8;
139 }
140 }
141
142 //-----------------------------------------------------------------------------
143 // Read an ADC channel and block till it completes, then return the result
144 // in ADC units (0 to 1023). Also a routine to average 32 samples and
145 // return that.
146 //-----------------------------------------------------------------------------
147 static int ReadAdc(int ch)
148 {
149 uint32_t d;
150
151 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
152 AT91C_BASE_ADC->ADC_MR =
153 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
154 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
155 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
156
157 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
158 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
159 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
160 //
161 // The maths are:
162 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
163 //
164 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
165 //
166 // Note: with the "historic" values in the comments above, the error was 34% !!!
167
168 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
169
170 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
171
172 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
173
174 d = AT91C_BASE_ADC->ADC_CDR[ch];
175 return d;
176 }
177
178 int AvgAdc(int ch) // was static - merlok
179 {
180 int i;
181 int a = 0;
182
183 for(i = 0; i < 32; ++i)
184 a += ReadAdc(ch);
185
186 return (a + 15) >> 5;
187 }
188
189 void MeasureAntennaTuning(void) {
190 uint8_t LF_Results[256];
191 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
192 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
193
194 LED_B_ON();
195
196 /*
197 * Sweeps the useful LF range of the proxmark from
198 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
199 * read the voltage in the antenna, the result left
200 * in the buffer is a graph which should clearly show
201 * the resonating frequency of your LF antenna
202 * ( hopefully around 95 if it is tuned to 125kHz!)
203 */
204
205 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
206 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
207
208 for (i=255; i>=19; i--) {
209 WDT_HIT();
210 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
211 SpinDelay(20);
212 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
213 if (i==95) vLf125 = adcval; // voltage at 125Khz
214 if (i==89) vLf134 = adcval; // voltage at 134Khz
215
216 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
217 if(LF_Results[i] > peak) {
218 peakv = adcval;
219 peak = LF_Results[i];
220 peakf = i;
221 //ptr = i;
222 }
223 }
224
225 for (i=18; i >= 0; i--) LF_Results[i] = 0;
226
227 LED_A_ON();
228 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
229 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
230 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
231 SpinDelay(20);
232 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
233
234 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
235 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
236
237 LEDsoff();
238 }
239
240 void MeasureAntennaTuningHf(void) {
241 int vHf = 0; // in mV
242 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
243 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
244 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
245
246 while ( !BUTTON_PRESS() ){
247 SpinDelay(20);
248 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
249 //Dbprintf("%d mV",vHf);
250 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
251 }
252 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
253 DbpString("cancelled");
254 }
255
256
257 void ReadMem(int addr) {
258 const uint8_t *data = ((uint8_t *)addr);
259
260 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
261 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
262 }
263
264 /* osimage version information is linked in */
265 extern struct version_information version_information;
266 /* bootrom version information is pointed to from _bootphase1_version_pointer */
267 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
268 void SendVersion(void)
269 {
270 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
271 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
272
273 /* Try to find the bootrom version information. Expect to find a pointer at
274 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
275 * pointer, then use it.
276 */
277 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
278
279 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
280 strcat(VersionString, "bootrom version information appears invalid\n");
281 } else {
282 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
283 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
284 }
285
286 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
287 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
288
289 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
290 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
291
292 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
293 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
294
295 // Send Chip ID and used flash memory
296 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
297 uint32_t compressed_data_section_size = common_area.arg1;
298 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
299 }
300
301 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
302 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
303 void printUSBSpeed(void)
304 {
305 Dbprintf("USB Speed:");
306 Dbprintf(" Sending USB packets to client...");
307
308 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
309 uint8_t *test_data = BigBuf_get_addr();
310 uint32_t end_time;
311
312 uint32_t start_time = end_time = GetTickCount();
313 uint32_t bytes_transferred = 0;
314
315 LED_B_ON();
316 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
317 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
318 end_time = GetTickCount();
319 bytes_transferred += USB_CMD_DATA_SIZE;
320 }
321 LED_B_OFF();
322
323 Dbprintf(" Time elapsed: %dms", end_time - start_time);
324 Dbprintf(" Bytes transferred: %d", bytes_transferred);
325 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
326 1000 * bytes_transferred / (end_time - start_time));
327
328 }
329
330 /**
331 * Prints runtime information about the PM3.
332 **/
333 void SendStatus(void) {
334 BigBuf_print_status();
335 Fpga_print_status();
336 printConfig(); //LF Sampling config
337 printUSBSpeed();
338 Dbprintf("Various");
339 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
340 Dbprintf(" ToSendMax..........%d", ToSendMax);
341 Dbprintf(" ToSendBit..........%d", ToSendBit);
342 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
343
344 cmd_send(CMD_ACK,1,0,0,0,0);
345 }
346
347 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
348
349 #define OPTS 2
350 void StandAloneMode()
351 {
352 DbpString("Stand-alone mode! No PC necessary.");
353 // Oooh pretty -- notify user we're in elite samy mode now
354 LED(LED_RED, 200);
355 LED(LED_ORANGE, 200);
356 LED(LED_GREEN, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_RED, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_GREEN, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_RED, 200);
363 }
364 #endif
365
366 #ifdef WITH_ISO14443a_StandAlone
367 void StandAloneMode14a()
368 {
369 StandAloneMode();
370 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
371
372 int selected = 0;
373 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
374 int cardRead[OPTS] = {0};
375 uint8_t readUID[10] = {0};
376 uint32_t uid_1st[OPTS]={0};
377 uint32_t uid_2nd[OPTS]={0};
378 uint32_t uid_tmp1 = 0;
379 uint32_t uid_tmp2 = 0;
380 iso14a_card_select_t hi14a_card[OPTS];
381
382 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
383
384 LED(selected + 1, 0);
385
386 for (;;)
387 {
388 usb_poll();
389 WDT_HIT();
390 SpinDelay(300);
391
392 if (iGotoRecord == 1 || cardRead[selected] == 0)
393 {
394 iGotoRecord = 0;
395 LEDsoff();
396 LED(selected + 1, 0);
397 LED(LED_RED2, 0);
398
399 // record
400 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
401 /* need this delay to prevent catching some weird data */
402 SpinDelay(500);
403 /* Code for reading from 14a tag */
404 uint8_t uid[10] = {0};
405 uint32_t cuid = 0;
406 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
407
408 for ( ; ; )
409 {
410 WDT_HIT();
411 if (BUTTON_PRESS()) {
412 if (cardRead[selected]) {
413 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
414 break;
415 }
416 else if (cardRead[(selected+1)%OPTS]) {
417 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
418 selected = (selected+1)%OPTS;
419 break; // playing = 1;
420 }
421 else {
422 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
423 SpinDelay(300);
424 }
425 }
426 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
427 continue;
428 else
429 {
430 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
431 memcpy(readUID,uid,10*sizeof(uint8_t));
432 uint8_t *dst = (uint8_t *)&uid_tmp1;
433 // Set UID byte order
434 for (int i=0; i<4; i++)
435 dst[i] = uid[3-i];
436 dst = (uint8_t *)&uid_tmp2;
437 for (int i=0; i<4; i++)
438 dst[i] = uid[7-i];
439 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
440 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
441 }
442 else {
443 if (uid_tmp2) {
444 Dbprintf("Bank[%d] received a 7-byte UID",selected);
445 uid_1st[selected] = (uid_tmp1)>>8;
446 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
447 }
448 else {
449 Dbprintf("Bank[%d] received a 4-byte UID",selected);
450 uid_1st[selected] = uid_tmp1;
451 uid_2nd[selected] = uid_tmp2;
452 }
453 break;
454 }
455 }
456 }
457 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
458 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
459 LEDsoff();
460 LED(LED_GREEN, 200);
461 LED(LED_ORANGE, 200);
462 LED(LED_GREEN, 200);
463 LED(LED_ORANGE, 200);
464
465 LEDsoff();
466 LED(selected + 1, 0);
467
468 // Next state is replay:
469 playing = 1;
470
471 cardRead[selected] = 1;
472 }
473 /* MF Classic UID clone */
474 else if (iGotoClone==1)
475 {
476 iGotoClone=0;
477 LEDsoff();
478 LED(selected + 1, 0);
479 LED(LED_ORANGE, 250);
480
481 // record
482 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
483
484 // wait for button to be released
485 // Delay cloning until card is in place
486 while(BUTTON_PRESS())
487 WDT_HIT();
488
489 Dbprintf("Starting clone. [Bank: %u]", selected);
490 // need this delay to prevent catching some weird data
491 SpinDelay(500);
492 // Begin clone function here:
493 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
494 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
495 memcpy(c.d.asBytes, data, 16);
496 SendCommand(&c);
497
498 Block read is similar:
499 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
500 We need to imitate that call with blockNo 0 to set a uid.
501
502 The get and set commands are handled in this file:
503 // Work with "magic Chinese" card
504 case CMD_MIFARE_CSETBLOCK:
505 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
506 break;
507 case CMD_MIFARE_CGETBLOCK:
508 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
509 break;
510
511 mfCSetUID provides example logic for UID set workflow:
512 -Read block0 from card in field with MifareCGetBlock()
513 -Configure new values without replacing reserved bytes
514 memcpy(block0, uid, 4); // Copy UID bytes from byte array
515 // Mifare UID BCC
516 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
517 Bytes 5-7 are reserved SAK and ATQA for mifare classic
518 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
519 */
520 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
521 // arg0 = Flags, arg1=blockNo
522 MifareCGetBlock(params, 0, oldBlock0);
523 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
524 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
525 playing = 1;
526 }
527 else {
528 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
529 memcpy(newBlock0,oldBlock0,16);
530 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
531
532 newBlock0[0] = uid_1st[selected]>>24;
533 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
534 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
535 newBlock0[3] = 0xFF & (uid_1st[selected]);
536 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
537
538 // arg0 = workFlags, arg1 = blockNo, datain
539 MifareCSetBlock(params, 0, newBlock0);
540 MifareCGetBlock(params, 0, testBlock0);
541
542 if (memcmp(testBlock0, newBlock0, 16)==0) {
543 DbpString("Cloned successfull!");
544 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
545 playing = 0;
546 iGotoRecord = 1;
547 selected = (selected + 1) % OPTS;
548 } else {
549 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
550 playing = 1;
551 }
552 }
553 LEDsoff();
554 LED(selected + 1, 0);
555 }
556 // Change where to record (or begin playing)
557 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
558 {
559 LEDsoff();
560 LED(selected + 1, 0);
561
562 // Begin transmitting
563 if (playing)
564 {
565 LED(LED_GREEN, 0);
566 DbpString("Playing");
567 for ( ; ; ) {
568 WDT_HIT();
569 int button_action = BUTTON_HELD(1000);
570 if (button_action == 0) { // No button action, proceed with sim
571 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
572 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
573 num_to_bytes(uid_1st[selected], 3, data);
574 num_to_bytes(uid_2nd[selected], 4, data);
575
576 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
577 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
578 DbpString("Mifare Classic");
579 SimulateIso14443aTag(1, flags, data); // Mifare Classic
580 }
581 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
582 DbpString("Mifare Ultralight");
583 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
584 }
585 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
586 DbpString("Mifare DESFire");
587 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
588 }
589 else {
590 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
591 SimulateIso14443aTag(1, flags, data);
592 }
593 }
594 else if (button_action == BUTTON_SINGLE_CLICK) {
595 selected = (selected + 1) % OPTS;
596 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
597 iGotoRecord = 1;
598 break;
599 }
600 else if (button_action == BUTTON_HOLD) {
601 Dbprintf("Playtime over. Begin cloning...");
602 iGotoClone = 1;
603 break;
604 }
605 WDT_HIT();
606 }
607
608 /* We pressed a button so ignore it here with a delay */
609 SpinDelay(300);
610 LEDsoff();
611 LED(selected + 1, 0);
612 }
613 else
614 while(BUTTON_PRESS())
615 WDT_HIT();
616 }
617 }
618 }
619 #elif WITH_LF
620 // samy's sniff and repeat routine
621 void SamyRun()
622 {
623 StandAloneMode();
624 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
625
626 int high[OPTS], low[OPTS];
627 int selected = 0;
628 int playing = 0;
629 int cardRead = 0;
630
631 // Turn on selected LED
632 LED(selected + 1, 0);
633
634 for (;;) {
635 usb_poll();
636 WDT_HIT();
637
638 // Was our button held down or pressed?
639 int button_pressed = BUTTON_HELD(1000);
640 SpinDelay(300);
641
642 // Button was held for a second, begin recording
643 if (button_pressed > 0 && cardRead == 0)
644 {
645 LEDsoff();
646 LED(selected + 1, 0);
647 LED(LED_RED2, 0);
648
649 // record
650 DbpString("Starting recording");
651
652 // wait for button to be released
653 while(BUTTON_PRESS())
654 WDT_HIT();
655
656 /* need this delay to prevent catching some weird data */
657 SpinDelay(500);
658
659 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
660 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
661
662 LEDsoff();
663 LED(selected + 1, 0);
664 // Finished recording
665 // If we were previously playing, set playing off
666 // so next button push begins playing what we recorded
667 playing = 0;
668 cardRead = 1;
669 }
670 else if (button_pressed > 0 && cardRead == 1) {
671 LEDsoff();
672 LED(selected + 1, 0);
673 LED(LED_ORANGE, 0);
674
675 // record
676 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
677
678 // wait for button to be released
679 while(BUTTON_PRESS())
680 WDT_HIT();
681
682 /* need this delay to prevent catching some weird data */
683 SpinDelay(500);
684
685 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
686 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
687
688 LEDsoff();
689 LED(selected + 1, 0);
690 // Finished recording
691
692 // If we were previously playing, set playing off
693 // so next button push begins playing what we recorded
694 playing = 0;
695 cardRead = 0;
696 }
697
698 // Change where to record (or begin playing)
699 else if (button_pressed) {
700 // Next option if we were previously playing
701 if (playing)
702 selected = (selected + 1) % OPTS;
703 playing = !playing;
704
705 LEDsoff();
706 LED(selected + 1, 0);
707
708 // Begin transmitting
709 if (playing)
710 {
711 LED(LED_GREEN, 0);
712 DbpString("Playing");
713 // wait for button to be released
714 while(BUTTON_PRESS())
715 WDT_HIT();
716
717 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
718 CmdHIDsimTAG(high[selected], low[selected], 0);
719 DbpString("Done playing");
720
721 if (BUTTON_HELD(1000) > 0) {
722 DbpString("Exiting");
723 LEDsoff();
724 return;
725 }
726
727 /* We pressed a button so ignore it here with a delay */
728 SpinDelay(300);
729
730 // when done, we're done playing, move to next option
731 selected = (selected + 1) % OPTS;
732 playing = !playing;
733 LEDsoff();
734 LED(selected + 1, 0);
735 }
736 else
737 while(BUTTON_PRESS())
738 WDT_HIT();
739 }
740 }
741 }
742
743 #endif
744 /*
745 OBJECTIVE
746 Listen and detect an external reader. Determine the best location
747 for the antenna.
748
749 INSTRUCTIONS:
750 Inside the ListenReaderField() function, there is two mode.
751 By default, when you call the function, you will enter mode 1.
752 If you press the PM3 button one time, you will enter mode 2.
753 If you press the PM3 button a second time, you will exit the function.
754
755 DESCRIPTION OF MODE 1:
756 This mode just listens for an external reader field and lights up green
757 for HF and/or red for LF. This is the original mode of the detectreader
758 function.
759
760 DESCRIPTION OF MODE 2:
761 This mode will visually represent, using the LEDs, the actual strength of the
762 current compared to the maximum current detected. Basically, once you know
763 what kind of external reader is present, it will help you spot the best location to place
764 your antenna. You will probably not get some good results if there is a LF and a HF reader
765 at the same place! :-)
766
767 LIGHT SCHEME USED:
768 */
769 static const char LIGHT_SCHEME[] = {
770 0x0, /* ---- | No field detected */
771 0x1, /* X--- | 14% of maximum current detected */
772 0x2, /* -X-- | 29% of maximum current detected */
773 0x4, /* --X- | 43% of maximum current detected */
774 0x8, /* ---X | 57% of maximum current detected */
775 0xC, /* --XX | 71% of maximum current detected */
776 0xE, /* -XXX | 86% of maximum current detected */
777 0xF, /* XXXX | 100% of maximum current detected */
778 };
779 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
780
781 void ListenReaderField(int limit) {
782 #define LF_ONLY 1
783 #define HF_ONLY 2
784 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
785
786 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
787 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
788 int mode=1, display_val, display_max, i;
789
790 // switch off FPGA - we don't want to measure our own signal
791 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
792 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
793
794 LEDsoff();
795
796 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
797
798 if(limit != HF_ONLY) {
799 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
800 lf_baseline = lf_av;
801 }
802
803 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
804
805 if (limit != LF_ONLY) {
806 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
807 hf_baseline = hf_av;
808 }
809
810 for(;;) {
811 if (BUTTON_PRESS()) {
812 SpinDelay(500);
813 switch (mode) {
814 case 1:
815 mode=2;
816 DbpString("Signal Strength Mode");
817 break;
818 case 2:
819 default:
820 DbpString("Stopped");
821 LEDsoff();
822 return;
823 break;
824 }
825 }
826 WDT_HIT();
827
828 if (limit != HF_ONLY) {
829 if(mode == 1) {
830 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
831 LED_D_ON();
832 else
833 LED_D_OFF();
834 }
835
836 lf_av_new = AvgAdc(ADC_CHAN_LF);
837 // see if there's a significant change
838 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
839 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
840 lf_av = lf_av_new;
841 if (lf_av > lf_max)
842 lf_max = lf_av;
843 }
844 }
845
846 if (limit != LF_ONLY) {
847 if (mode == 1){
848 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
849 LED_B_ON();
850 else
851 LED_B_OFF();
852 }
853
854 hf_av_new = AvgAdc(ADC_CHAN_HF);
855 // see if there's a significant change
856 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
857 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
858 hf_av = hf_av_new;
859 if (hf_av > hf_max)
860 hf_max = hf_av;
861 }
862 }
863
864 if(mode == 2) {
865 if (limit == LF_ONLY) {
866 display_val = lf_av;
867 display_max = lf_max;
868 } else if (limit == HF_ONLY) {
869 display_val = hf_av;
870 display_max = hf_max;
871 } else { /* Pick one at random */
872 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
873 display_val = hf_av;
874 display_max = hf_max;
875 } else {
876 display_val = lf_av;
877 display_max = lf_max;
878 }
879 }
880 for (i=0; i<LIGHT_LEN; i++) {
881 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
882 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
883 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
884 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
885 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
886 break;
887 }
888 }
889 }
890 }
891 }
892
893 void UsbPacketReceived(uint8_t *packet, int len)
894 {
895 UsbCommand *c = (UsbCommand *)packet;
896
897 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
898
899 switch(c->cmd) {
900 #ifdef WITH_LF
901 case CMD_SET_LF_SAMPLING_CONFIG:
902 setSamplingConfig((sample_config *) c->d.asBytes);
903 break;
904 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
905 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
906 break;
907 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
908 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
909 break;
910 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
911 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
912 break;
913 case CMD_HID_DEMOD_FSK:
914 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
915 break;
916 case CMD_HID_SIM_TAG:
917 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
918 break;
919 case CMD_FSK_SIM_TAG:
920 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
921 break;
922 case CMD_ASK_SIM_TAG:
923 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
924 break;
925 case CMD_PSK_SIM_TAG:
926 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
927 break;
928 case CMD_HID_CLONE_TAG:
929 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
930 break;
931 case CMD_IO_DEMOD_FSK:
932 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
933 break;
934 case CMD_IO_CLONE_TAG:
935 CopyIOtoT55x7(c->arg[0], c->arg[1]);
936 break;
937 case CMD_EM410X_DEMOD:
938 CmdEM410xdemod(c->arg[0], 0, 0, 1);
939 break;
940 case CMD_EM410X_WRITE_TAG:
941 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
942 break;
943 case CMD_READ_TI_TYPE:
944 ReadTItag();
945 break;
946 case CMD_WRITE_TI_TYPE:
947 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
948 break;
949 case CMD_SIMULATE_TAG_125K:
950 LED_A_ON();
951 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
952 LED_A_OFF();
953 break;
954 case CMD_LF_SIMULATE_BIDIR:
955 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
956 break;
957 case CMD_INDALA_CLONE_TAG:
958 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
959 break;
960 case CMD_INDALA_CLONE_TAG_L:
961 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
962 break;
963 case CMD_T55XX_READ_BLOCK:
964 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
965 break;
966 case CMD_T55XX_WRITE_BLOCK:
967 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
968 break;
969 case CMD_T55XX_WAKEUP:
970 T55xxWakeUp(c->arg[0]);
971 break;
972 case CMD_T55XX_RESET_READ:
973 T55xxResetRead();
974 break;
975 case CMD_PCF7931_READ:
976 ReadPCF7931();
977 break;
978 case CMD_PCF7931_WRITE:
979 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
980 break;
981 case CMD_EM4X_READ_WORD:
982 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
983 break;
984 case CMD_EM4X_WRITE_WORD:
985 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
986 break;
987 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
988 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
989 break;
990 case CMD_VIKING_CLONE_TAG:
991 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
992 break;
993 #endif
994
995 #ifdef WITH_HITAG
996 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
997 SnoopHitag(c->arg[0]);
998 break;
999 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1000 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1001 break;
1002 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1003 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1004 break;
1005 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1006 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1007 break;
1008 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1009 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1010 break;
1011 case CMD_READ_HITAG_S: //Reader for only Hitag S tags, args = key or challenge
1012 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1013 break;
1014 case CMD_WR_HITAG_S: //writer for Hitag tags args=data to write,page and key or challenge
1015 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1016 break;
1017 #endif
1018
1019 #ifdef WITH_ISO15693
1020 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1021 AcquireRawAdcSamplesIso15693();
1022 break;
1023 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1024 RecordRawAdcSamplesIso15693();
1025 break;
1026
1027 case CMD_ISO_15693_COMMAND:
1028 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1029 break;
1030
1031 case CMD_ISO_15693_FIND_AFI:
1032 BruteforceIso15693Afi(c->arg[0]);
1033 break;
1034
1035 case CMD_ISO_15693_DEBUG:
1036 SetDebugIso15693(c->arg[0]);
1037 break;
1038
1039 case CMD_READER_ISO_15693:
1040 ReaderIso15693(c->arg[0]);
1041 break;
1042 case CMD_SIMTAG_ISO_15693:
1043 SimTagIso15693(c->arg[0], c->d.asBytes);
1044 break;
1045 #endif
1046
1047 #ifdef WITH_LEGICRF
1048 case CMD_SIMULATE_TAG_LEGIC_RF:
1049 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1050 break;
1051
1052 case CMD_WRITER_LEGIC_RF:
1053 LegicRfWriter(c->arg[1], c->arg[0]);
1054 break;
1055
1056 case CMD_READER_LEGIC_RF:
1057 LegicRfReader(c->arg[0], c->arg[1]);
1058 break;
1059 #endif
1060
1061 #ifdef WITH_ISO14443b
1062 case CMD_READ_SRI_TAG:
1063 ReadSTMemoryIso14443b(c->arg[0]);
1064 break;
1065 case CMD_SNOOP_ISO_14443B:
1066 SnoopIso14443b();
1067 break;
1068 case CMD_SIMULATE_TAG_ISO_14443B:
1069 SimulateIso14443bTag();
1070 break;
1071 case CMD_ISO_14443B_COMMAND:
1072 //SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1073 SendRawCommand14443B_Ex(c);
1074 break;
1075 #endif
1076
1077 #ifdef WITH_ISO14443a
1078 case CMD_SNOOP_ISO_14443a:
1079 SniffIso14443a(c->arg[0]);
1080 break;
1081 case CMD_READER_ISO_14443a:
1082 ReaderIso14443a(c);
1083 break;
1084 case CMD_SIMULATE_TAG_ISO_14443a:
1085 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1086 break;
1087 case CMD_EPA_PACE_COLLECT_NONCE:
1088 EPA_PACE_Collect_Nonce(c);
1089 break;
1090 case CMD_EPA_PACE_REPLAY:
1091 EPA_PACE_Replay(c);
1092 break;
1093 case CMD_READER_MIFARE:
1094 ReaderMifare(c->arg[0], c->arg[1]);
1095 break;
1096 case CMD_MIFARE_READBL:
1097 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1098 break;
1099 case CMD_MIFAREU_READBL:
1100 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1101 break;
1102 case CMD_MIFAREUC_AUTH:
1103 MifareUC_Auth(c->arg[0],c->d.asBytes);
1104 break;
1105 case CMD_MIFAREU_READCARD:
1106 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1107 break;
1108 case CMD_MIFAREUC_SETPWD:
1109 MifareUSetPwd(c->arg[0], c->d.asBytes);
1110 break;
1111 case CMD_MIFARE_READSC:
1112 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1113 break;
1114 case CMD_MIFARE_WRITEBL:
1115 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1116 break;
1117 //case CMD_MIFAREU_WRITEBL_COMPAT:
1118 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1119 //break;
1120 case CMD_MIFAREU_WRITEBL:
1121 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1122 break;
1123 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1124 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1125 break;
1126 case CMD_MIFARE_NESTED:
1127 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1128 break;
1129 case CMD_MIFARE_CHKKEYS:
1130 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1131 break;
1132 case CMD_SIMULATE_MIFARE_CARD:
1133 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1134 break;
1135
1136 // emulator
1137 case CMD_MIFARE_SET_DBGMODE:
1138 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1139 break;
1140 case CMD_MIFARE_EML_MEMCLR:
1141 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1142 break;
1143 case CMD_MIFARE_EML_MEMSET:
1144 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1145 break;
1146 case CMD_MIFARE_EML_MEMGET:
1147 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1148 break;
1149 case CMD_MIFARE_EML_CARDLOAD:
1150 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1151 break;
1152
1153 // Work with "magic Chinese" card
1154 case CMD_MIFARE_CSETBLOCK:
1155 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1156 break;
1157 case CMD_MIFARE_CGETBLOCK:
1158 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1159 break;
1160 case CMD_MIFARE_CIDENT:
1161 MifareCIdent();
1162 break;
1163
1164 // mifare sniffer
1165 case CMD_MIFARE_SNIFFER:
1166 SniffMifare(c->arg[0]);
1167 break;
1168
1169 //mifare desfire
1170 case CMD_MIFARE_DESFIRE_READBL: break;
1171 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1172 case CMD_MIFARE_DESFIRE_AUTH1:
1173 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1174 break;
1175 case CMD_MIFARE_DESFIRE_AUTH2:
1176 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1177 break;
1178 case CMD_MIFARE_DES_READER:
1179 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1180 break;
1181 case CMD_MIFARE_DESFIRE_INFO:
1182 MifareDesfireGetInformation();
1183 break;
1184 case CMD_MIFARE_DESFIRE:
1185 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1186 break;
1187
1188 case CMD_MIFARE_COLLECT_NONCES:
1189 break;
1190 #endif
1191 #ifdef WITH_EMV
1192 case CMD_EMV_TRANSACTION:
1193 EMVTransaction();
1194 break;
1195 case CMD_EMV_GET_RANDOM_NUM:
1196 //EMVgetUDOL();
1197 break;
1198 case CMD_EMV_LOAD_VALUE:
1199 EMVloadvalue(c->arg[0], c->d.asBytes);
1200 break;
1201 case CMD_EMV_DUMP_CARD:
1202 EMVdumpcard();
1203 #endif
1204 #ifdef WITH_ICLASS
1205 // Makes use of ISO14443a FPGA Firmware
1206 case CMD_SNOOP_ICLASS:
1207 SnoopIClass();
1208 break;
1209 case CMD_SIMULATE_TAG_ICLASS:
1210 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1211 break;
1212 case CMD_READER_ICLASS:
1213 ReaderIClass(c->arg[0]);
1214 break;
1215 case CMD_READER_ICLASS_REPLAY:
1216 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1217 break;
1218 case CMD_ICLASS_EML_MEMSET:
1219 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1220 break;
1221 case CMD_ICLASS_WRITEBLOCK:
1222 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1223 break;
1224 case CMD_ICLASS_READCHECK: // auth step 1
1225 iClass_ReadCheck(c->arg[0], c->arg[1]);
1226 break;
1227 case CMD_ICLASS_READBLOCK:
1228 iClass_ReadBlk(c->arg[0]);
1229 break;
1230 case CMD_ICLASS_AUTHENTICATION: //check
1231 iClass_Authentication(c->d.asBytes);
1232 break;
1233 case CMD_ICLASS_DUMP:
1234 iClass_Dump(c->arg[0], c->arg[1]);
1235 break;
1236 case CMD_ICLASS_CLONE:
1237 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1238 break;
1239 #endif
1240 #ifdef WITH_HFSNOOP
1241 case CMD_HF_SNIFFER:
1242 HfSnoop(c->arg[0], c->arg[1]);
1243 break;
1244 #endif
1245
1246 case CMD_BUFF_CLEAR:
1247 BigBuf_Clear();
1248 break;
1249
1250 case CMD_MEASURE_ANTENNA_TUNING:
1251 MeasureAntennaTuning();
1252 break;
1253
1254 case CMD_MEASURE_ANTENNA_TUNING_HF:
1255 MeasureAntennaTuningHf();
1256 break;
1257
1258 case CMD_LISTEN_READER_FIELD:
1259 ListenReaderField(c->arg[0]);
1260 break;
1261
1262 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1263 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1264 SpinDelay(200);
1265 LED_D_OFF(); // LED D indicates field ON or OFF
1266 break;
1267
1268 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1269 LED_B_ON();
1270 uint8_t *BigBuf = BigBuf_get_addr();
1271 size_t len = 0;
1272 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1273 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1274 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1275 }
1276 // Trigger a finish downloading signal with an ACK frame
1277 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1278 LED_B_OFF();
1279 break;
1280 }
1281 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1282 uint8_t *b = BigBuf_get_addr();
1283 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1284 cmd_send(CMD_ACK,0,0,0,0,0);
1285 break;
1286 }
1287 case CMD_DOWNLOAD_EML_BIGBUF: {
1288 LED_B_ON();
1289 uint8_t *cardmem = BigBuf_get_EM_addr();
1290 size_t len = 0;
1291 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1292 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1293 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1294 }
1295 // Trigger a finish downloading signal with an ACK frame
1296 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1297 LED_B_OFF();
1298 break;
1299 }
1300 case CMD_READ_MEM:
1301 ReadMem(c->arg[0]);
1302 break;
1303
1304 case CMD_SET_LF_DIVISOR:
1305 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1306 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1307 break;
1308
1309 case CMD_SET_ADC_MUX:
1310 switch(c->arg[0]) {
1311 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1312 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1313 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1314 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1315 }
1316 break;
1317
1318 case CMD_VERSION:
1319 SendVersion();
1320 break;
1321 case CMD_STATUS:
1322 SendStatus();
1323 break;
1324 case CMD_PING:
1325 cmd_send(CMD_ACK,0,0,0,0,0);
1326 break;
1327 #ifdef WITH_LCD
1328 case CMD_LCD_RESET:
1329 LCDReset();
1330 break;
1331 case CMD_LCD:
1332 LCDSend(c->arg[0]);
1333 break;
1334 #endif
1335 case CMD_SETUP_WRITE:
1336 case CMD_FINISH_WRITE:
1337 case CMD_HARDWARE_RESET:
1338 usb_disable();
1339 SpinDelay(2000);
1340 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1341 for(;;) {
1342 // We're going to reset, and the bootrom will take control.
1343 }
1344 break;
1345
1346 case CMD_START_FLASH:
1347 if(common_area.flags.bootrom_present) {
1348 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1349 }
1350 usb_disable();
1351 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1352 for(;;);
1353 break;
1354
1355 case CMD_DEVICE_INFO: {
1356 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1357 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1358 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1359 break;
1360 }
1361 default:
1362 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1363 break;
1364 }
1365 }
1366
1367 void __attribute__((noreturn)) AppMain(void)
1368 {
1369 SpinDelay(100);
1370 clear_trace();
1371 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1372 /* Initialize common area */
1373 memset(&common_area, 0, sizeof(common_area));
1374 common_area.magic = COMMON_AREA_MAGIC;
1375 common_area.version = 1;
1376 }
1377 common_area.flags.osimage_present = 1;
1378
1379 LED_D_OFF();
1380 LED_C_OFF();
1381 LED_B_OFF();
1382 LED_A_OFF();
1383
1384 // Init USB device
1385 usb_enable();
1386
1387 // The FPGA gets its clock from us from PCK0 output, so set that up.
1388 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1389 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1390 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1391 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1392 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1393 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1394 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1395
1396 // Reset SPI
1397 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1398 // Reset SSC
1399 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1400
1401 // Load the FPGA image, which we have stored in our flash.
1402 // (the HF version by default)
1403 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1404
1405 StartTickCount();
1406
1407 #ifdef WITH_LCD
1408 LCDInit();
1409 #endif
1410
1411 byte_t rx[sizeof(UsbCommand)];
1412 size_t rx_len;
1413
1414 for(;;) {
1415 if (usb_poll()) {
1416 rx_len = usb_read(rx,sizeof(UsbCommand));
1417 if (rx_len)
1418 UsbPacketReceived(rx,rx_len);
1419 }
1420 WDT_HIT();
1421
1422 #ifdef WITH_LF
1423 #ifndef WITH_ISO14443a_StandAlone
1424 if (BUTTON_HELD(1000) > 0)
1425 SamyRun();
1426 #endif
1427 #endif
1428 #ifdef WITH_ISO14443a
1429 #ifdef WITH_ISO14443a_StandAlone
1430 if (BUTTON_HELD(1000) > 0)
1431 StandAloneMode14a();
1432 #endif
1433 #endif
1434 }
1435 }
Proxmark3 GIT tracking
Impressum, Datenschutz