]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


37328a506ce5492ba545da5da9b985508ea4e7b0
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "legicrfsim.h"
25 #include "hitag2.h"
26 #include "hitagS.h"
27 #include "iso14443b.h"
28 #include "iso15693.h"
29 #include "lfsampling.h"
30 #include "BigBuf.h"
31 #include "mifareutil.h"
32 #include "mifaresim.h"
33 #include "pcf7931.h"
34 #include "i2c.h"
35 #include "hfsnoop.h"
36 #include "fpgaloader.h"
37 #ifdef WITH_LCD
38 #include "LCD.h"
39 #endif
40
41 static uint32_t hw_capabilities;
42
43 // Craig Young - 14a stand-alone code
44 #ifdef WITH_ISO14443a
45 #include "iso14443a.h"
46 #endif
47
48 //=============================================================================
49 // A buffer where we can queue things up to be sent through the FPGA, for
50 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
51 // is the order in which they go out on the wire.
52 //=============================================================================
53
54 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
55 uint8_t ToSend[TOSEND_BUFFER_SIZE];
56 int ToSendMax;
57 static int ToSendBit;
58 struct common_area common_area __attribute__((section(".commonarea")));
59
60 void ToSendReset(void)
61 {
62 ToSendMax = -1;
63 ToSendBit = 8;
64 }
65
66 void ToSendStuffBit(int b)
67 {
68 if(ToSendBit >= 8) {
69 ToSendMax++;
70 ToSend[ToSendMax] = 0;
71 ToSendBit = 0;
72 }
73
74 if(b) {
75 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
76 }
77
78 ToSendBit++;
79
80 if(ToSendMax >= sizeof(ToSend)) {
81 ToSendBit = 0;
82 DbpString("ToSendStuffBit overflowed!");
83 }
84 }
85
86 //=============================================================================
87 // Debug print functions, to go out over USB, to the usual PC-side client.
88 //=============================================================================
89
90 void DbpString(char *str)
91 {
92 byte_t len = strlen(str);
93 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
94 }
95
96 #if 0
97 void DbpIntegers(int x1, int x2, int x3)
98 {
99 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
100 }
101 #endif
102
103 void Dbprintf(const char *fmt, ...) {
104 // should probably limit size here; oh well, let's just use a big buffer
105 char output_string[128];
106 va_list ap;
107
108 va_start(ap, fmt);
109 kvsprintf(fmt, output_string, 10, ap);
110 va_end(ap);
111
112 DbpString(output_string);
113 }
114
115 // prints HEX & ASCII
116 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
117 int l=0,i;
118 char ascii[9];
119
120 while (len>0) {
121 if (len>8) l=8;
122 else l=len;
123
124 memcpy(ascii,d,l);
125 ascii[l]=0;
126
127 // filter safe ascii
128 for (i=0;i<l;i++)
129 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
130
131 if (bAsci) {
132 Dbprintf("%-8s %*D",ascii,l,d," ");
133 } else {
134 Dbprintf("%*D",l,d," ");
135 }
136
137 len-=8;
138 d+=8;
139 }
140 }
141
142 //-----------------------------------------------------------------------------
143 // Read an ADC channel and block till it completes, then return the result
144 // in ADC units (0 to 1023). Also a routine to average 32 samples and
145 // return that.
146 //-----------------------------------------------------------------------------
147 static int ReadAdc(int ch)
148 {
149 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
150 // AMPL_HI is a high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
151 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
152 //
153 // The maths are:
154 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
155 //
156 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
157
158 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
159 AT91C_BASE_ADC->ADC_MR =
160 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
161 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
162 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
163
164 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
165 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
166
167 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
168
169 return AT91C_BASE_ADC->ADC_CDR[ch] & 0x3ff;
170 }
171
172 int AvgAdc(int ch) // was static - merlok
173 {
174 int i;
175 int a = 0;
176
177 for(i = 0; i < 32; i++) {
178 a += ReadAdc(ch);
179 }
180
181 return (a + 15) >> 5;
182 }
183
184 static int AvgAdc_Voltage_HF(void)
185 {
186 int AvgAdc_Voltage_Low, AvgAdc_Voltage_High;
187
188 AvgAdc_Voltage_Low= (MAX_ADC_HF_VOLTAGE_LOW * AvgAdc(ADC_CHAN_HF_LOW)) >> 10;
189 // if voltage range is about to be exceeded, use high voltage ADC channel if available (RDV40 only)
190 if (AvgAdc_Voltage_Low > MAX_ADC_HF_VOLTAGE_LOW - 300) {
191 AvgAdc_Voltage_High = (MAX_ADC_HF_VOLTAGE_HIGH * AvgAdc(ADC_CHAN_HF_HIGH)) >> 10;
192 if (AvgAdc_Voltage_High >= AvgAdc_Voltage_Low) {
193 return AvgAdc_Voltage_High;
194 }
195 }
196 return AvgAdc_Voltage_Low;
197 }
198
199 static int AvgAdc_Voltage_LF(void)
200 {
201 return (MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10;
202 }
203
204 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
205 {
206 int i, adcval = 0, peak = 0;
207
208 /*
209 * Sweeps the useful LF range of the proxmark from
210 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
211 * read the voltage in the antenna, the result left
212 * in the buffer is a graph which should clearly show
213 * the resonating frequency of your LF antenna
214 * ( hopefully around 95 if it is tuned to 125kHz!)
215 */
216
217 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
218 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
219 SpinDelay(50);
220
221 for (i=255; i>=19; i--) {
222 WDT_HIT();
223 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
224 SpinDelay(20);
225 adcval = AvgAdc_Voltage_LF();
226 if (i==95) *vLf125 = adcval; // voltage at 125Khz
227 if (i==89) *vLf134 = adcval; // voltage at 134Khz
228
229 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
230 if(LF_Results[i] > peak) {
231 *peakv = adcval;
232 peak = LF_Results[i];
233 *peakf = i;
234 //ptr = i;
235 }
236 }
237
238 for (i=18; i >= 0; i--) LF_Results[i] = 0;
239
240 return;
241 }
242
243 void MeasureAntennaTuningHfOnly(int *vHf)
244 {
245 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
246 LED_A_ON();
247 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
249 SpinDelay(20);
250 *vHf = AvgAdc_Voltage_HF();
251 LED_A_OFF();
252 return;
253 }
254
255 void MeasureAntennaTuning(int mode)
256 {
257 uint8_t LF_Results[256] = {0};
258 int peakv = 0, peakf = 0;
259 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
260
261 LED_B_ON();
262
263 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
264 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
265 MeasureAntennaTuningHfOnly(&vHf);
266 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
267 } else {
268 if (mode & FLAG_TUNE_LF) {
269 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
270 }
271 if (mode & FLAG_TUNE_HF) {
272 MeasureAntennaTuningHfOnly(&vHf);
273 }
274 }
275
276 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
277 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
278 LED_B_OFF();
279 return;
280 }
281
282 void MeasureAntennaTuningHf(void)
283 {
284 int vHf = 0; // in mV
285
286 DbpString("Measuring HF antenna, press button to exit");
287
288 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
289 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
290 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
291
292 for (;;) {
293 SpinDelay(500);
294 vHf = AvgAdc_Voltage_HF();
295
296 Dbprintf("%d mV",vHf);
297 if (BUTTON_PRESS()) break;
298 }
299 DbpString("cancelled");
300
301 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
302
303 }
304
305
306 void ReadMem(int addr)
307 {
308 const uint8_t *data = ((uint8_t *)addr);
309
310 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
311 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
312 }
313
314 /* osimage version information is linked in */
315 extern struct version_information version_information;
316 /* bootrom version information is pointed to from _bootphase1_version_pointer */
317 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
318
319
320 void set_hw_capabilities(void)
321 {
322 if (I2C_is_available()) {
323 hw_capabilities |= HAS_SMARTCARD_SLOT;
324 }
325
326 if (false) { // TODO: implement a test
327 hw_capabilities |= HAS_EXTRA_FLASH_MEM;
328 }
329 }
330
331
332 void SendVersion(void)
333 {
334 set_hw_capabilities();
335
336 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
337 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
338
339 /* Try to find the bootrom version information. Expect to find a pointer at
340 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
341 * pointer, then use it.
342 */
343 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
344 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
345 strcat(VersionString, "bootrom version information appears invalid\n");
346 } else {
347 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
348 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
349 }
350
351 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
352 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
353
354 for (int i = 0; i < fpga_bitstream_num; i++) {
355 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
356 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
357 }
358
359 // test availability of SmartCard slot
360 if (I2C_is_available()) {
361 strncat(VersionString, "SmartCard Slot: available\n", sizeof(VersionString) - strlen(VersionString) - 1);
362 } else {
363 strncat(VersionString, "SmartCard Slot: not available\n", sizeof(VersionString) - strlen(VersionString) - 1);
364 }
365
366 // Send Chip ID and used flash memory
367 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
368 uint32_t compressed_data_section_size = common_area.arg1;
369 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, hw_capabilities, VersionString, strlen(VersionString));
370 }
371
372 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
373 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
374 void printUSBSpeed(void)
375 {
376 Dbprintf("USB Speed:");
377 Dbprintf(" Sending USB packets to client...");
378
379 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
380 uint8_t *test_data = BigBuf_get_addr();
381 uint32_t end_time;
382
383 uint32_t start_time = end_time = GetTickCount();
384 uint32_t bytes_transferred = 0;
385
386 LED_B_ON();
387 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
388 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
389 end_time = GetTickCount();
390 bytes_transferred += USB_CMD_DATA_SIZE;
391 }
392 LED_B_OFF();
393
394 Dbprintf(" Time elapsed: %dms", end_time - start_time);
395 Dbprintf(" Bytes transferred: %d", bytes_transferred);
396 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
397 1000 * bytes_transferred / (end_time - start_time));
398
399 }
400
401 /**
402 * Prints runtime information about the PM3.
403 **/
404 void SendStatus(void)
405 {
406 BigBuf_print_status();
407 Fpga_print_status();
408 #ifdef WITH_SMARTCARD
409 I2C_print_status();
410 #endif
411 printConfig(); //LF Sampling config
412 printUSBSpeed();
413 Dbprintf("Various");
414 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
415 Dbprintf(" ToSendMax..........%d", ToSendMax);
416 Dbprintf(" ToSendBit..........%d", ToSendBit);
417
418 cmd_send(CMD_ACK,1,0,0,0,0);
419 }
420
421 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
422
423 #define OPTS 2
424
425 void StandAloneMode()
426 {
427 DbpString("Stand-alone mode! No PC necessary.");
428 // Oooh pretty -- notify user we're in elite samy mode now
429 LED(LED_RED, 200);
430 LED(LED_ORANGE, 200);
431 LED(LED_GREEN, 200);
432 LED(LED_ORANGE, 200);
433 LED(LED_RED, 200);
434 LED(LED_ORANGE, 200);
435 LED(LED_GREEN, 200);
436 LED(LED_ORANGE, 200);
437 LED(LED_RED, 200);
438
439 }
440
441 #endif
442
443
444
445 #ifdef WITH_ISO14443a_StandAlone
446 void StandAloneMode14a()
447 {
448 StandAloneMode();
449 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
450
451 int selected = 0;
452 bool playing = false, GotoRecord = false, GotoClone = false;
453 bool cardRead[OPTS] = {false};
454 uint8_t readUID[10] = {0};
455 uint32_t uid_1st[OPTS]={0};
456 uint32_t uid_2nd[OPTS]={0};
457 uint32_t uid_tmp1 = 0;
458 uint32_t uid_tmp2 = 0;
459 iso14a_card_select_t hi14a_card[OPTS];
460
461 LED(selected + 1, 0);
462
463 for (;;)
464 {
465 usb_poll();
466 WDT_HIT();
467 SpinDelay(300);
468
469 if (GotoRecord || !cardRead[selected])
470 {
471 GotoRecord = false;
472 LEDsoff();
473 LED(selected + 1, 0);
474 LED(LED_RED2, 0);
475
476 // record
477 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
478 /* need this delay to prevent catching some weird data */
479 SpinDelay(500);
480 /* Code for reading from 14a tag */
481 uint8_t uid[10] ={0};
482 uint32_t cuid;
483 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
484
485 for ( ; ; )
486 {
487 WDT_HIT();
488 if (BUTTON_PRESS()) {
489 if (cardRead[selected]) {
490 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
491 break;
492 }
493 else if (cardRead[(selected+1)%OPTS]) {
494 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
495 selected = (selected+1)%OPTS;
496 break;
497 }
498 else {
499 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
500 SpinDelay(300);
501 }
502 }
503 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
504 continue;
505 else
506 {
507 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
508 memcpy(readUID,uid,10*sizeof(uint8_t));
509 uint8_t *dst = (uint8_t *)&uid_tmp1;
510 // Set UID byte order
511 for (int i=0; i<4; i++)
512 dst[i] = uid[3-i];
513 dst = (uint8_t *)&uid_tmp2;
514 for (int i=0; i<4; i++)
515 dst[i] = uid[7-i];
516 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
517 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
518 }
519 else {
520 if (uid_tmp2) {
521 Dbprintf("Bank[%d] received a 7-byte UID",selected);
522 uid_1st[selected] = (uid_tmp1)>>8;
523 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
524 }
525 else {
526 Dbprintf("Bank[%d] received a 4-byte UID",selected);
527 uid_1st[selected] = uid_tmp1;
528 uid_2nd[selected] = uid_tmp2;
529 }
530 break;
531 }
532 }
533 }
534 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
535 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
536 LEDsoff();
537 LED(LED_GREEN, 200);
538 LED(LED_ORANGE, 200);
539 LED(LED_GREEN, 200);
540 LED(LED_ORANGE, 200);
541
542 LEDsoff();
543 LED(selected + 1, 0);
544
545 // Next state is replay:
546 playing = true;
547
548 cardRead[selected] = true;
549 }
550 /* MF Classic UID clone */
551 else if (GotoClone)
552 {
553 GotoClone=false;
554 LEDsoff();
555 LED(selected + 1, 0);
556 LED(LED_ORANGE, 250);
557
558
559 // record
560 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
561
562 // wait for button to be released
563 while(BUTTON_PRESS())
564 {
565 // Delay cloning until card is in place
566 WDT_HIT();
567 }
568 Dbprintf("Starting clone. [Bank: %u]", selected);
569 // need this delay to prevent catching some weird data
570 SpinDelay(500);
571 // Begin clone function here:
572 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
573 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
574 memcpy(c.d.asBytes, data, 16);
575 SendCommand(&c);
576
577 Block read is similar:
578 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
579 We need to imitate that call with blockNo 0 to set a uid.
580
581 The get and set commands are handled in this file:
582 // Work with "magic Chinese" card
583 case CMD_MIFARE_CSETBLOCK:
584 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
585 break;
586 case CMD_MIFARE_CGETBLOCK:
587 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
588 break;
589
590 mfCSetUID provides example logic for UID set workflow:
591 -Read block0 from card in field with MifareCGetBlock()
592 -Configure new values without replacing reserved bytes
593 memcpy(block0, uid, 4); // Copy UID bytes from byte array
594 // Mifare UID BCC
595 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
596 Bytes 5-7 are reserved SAK and ATQA for mifare classic
597 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
598 */
599 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
600 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
601 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
602 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
603 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
604 playing = true;
605 }
606 else {
607 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
608 memcpy(newBlock0,oldBlock0,16);
609 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
610
611 newBlock0[0] = uid_1st[selected]>>24;
612 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
613 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
614 newBlock0[3] = 0xFF & (uid_1st[selected]);
615 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
616 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
617 MifareCSetBlock(0, 0xFF,0, newBlock0);
618 MifareCGetBlock(0x3F, 1, 0, testBlock0);
619 if (memcmp(testBlock0,newBlock0,16)==0)
620 {
621 DbpString("Cloned successfull!");
622 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
623 playing = false;
624 GotoRecord = true;
625 selected = (selected+1) % OPTS;
626 }
627 else {
628 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
629 playing = true;
630 }
631 }
632 LEDsoff();
633 LED(selected + 1, 0);
634
635 }
636 // Change where to record (or begin playing)
637 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
638 {
639 LEDsoff();
640 LED(selected + 1, 0);
641
642 // Begin transmitting
643 LED(LED_GREEN, 0);
644 DbpString("Playing");
645 for ( ; ; ) {
646 WDT_HIT();
647 int button_action = BUTTON_HELD(1000);
648 if (button_action == 0) { // No button action, proceed with sim
649 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
650 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
651 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
652 DbpString("Mifare Classic");
653 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
654 }
655 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
656 DbpString("Mifare Ultralight");
657 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
658 }
659 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
660 DbpString("Mifare DESFire");
661 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
662 }
663 else {
664 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
665 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
666 }
667 }
668 else if (button_action == BUTTON_SINGLE_CLICK) {
669 selected = (selected + 1) % OPTS;
670 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
671 GotoRecord = true;
672 break;
673 }
674 else if (button_action == BUTTON_HOLD) {
675 Dbprintf("Playtime over. Begin cloning...");
676 GotoClone = true;
677 break;
678 }
679 WDT_HIT();
680 }
681
682 /* We pressed a button so ignore it here with a delay */
683 SpinDelay(300);
684 LEDsoff();
685 LED(selected + 1, 0);
686 }
687 }
688 }
689 #elif WITH_LF_StandAlone
690 // samy's sniff and repeat routine
691 void SamyRun()
692 {
693 StandAloneMode();
694 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
695
696 int tops[OPTS], high[OPTS], low[OPTS];
697 int selected = 0;
698 int playing = 0;
699 int cardRead = 0;
700
701 // Turn on selected LED
702 LED(selected + 1, 0);
703
704 for (;;)
705 {
706 usb_poll();
707 WDT_HIT();
708
709 // Was our button held down or pressed?
710 int button_pressed = BUTTON_HELD(1000);
711 SpinDelay(300);
712
713 // Button was held for a second, begin recording
714 if (button_pressed > 0 && cardRead == 0)
715 {
716 LEDsoff();
717 LED(selected + 1, 0);
718 LED(LED_RED2, 0);
719
720 // record
721 DbpString("Starting recording");
722
723 // wait for button to be released
724 while(BUTTON_PRESS())
725 WDT_HIT();
726
727 /* need this delay to prevent catching some weird data */
728 SpinDelay(500);
729
730 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
731 if (tops[selected] > 0)
732 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
733 else
734 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
735
736 LEDsoff();
737 LED(selected + 1, 0);
738 // Finished recording
739
740 // If we were previously playing, set playing off
741 // so next button push begins playing what we recorded
742 playing = 0;
743
744 cardRead = 1;
745
746 }
747
748 else if (button_pressed > 0 && cardRead == 1)
749 {
750 LEDsoff();
751 LED(selected + 1, 0);
752 LED(LED_ORANGE, 0);
753
754 // record
755 if (tops[selected] > 0)
756 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
757 else
758 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
759
760 // wait for button to be released
761 while(BUTTON_PRESS())
762 WDT_HIT();
763
764 /* need this delay to prevent catching some weird data */
765 SpinDelay(500);
766
767 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)), 0x1D);
768 if (tops[selected] > 0)
769 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
770 else
771 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
772
773 LEDsoff();
774 LED(selected + 1, 0);
775 // Finished recording
776
777 // If we were previously playing, set playing off
778 // so next button push begins playing what we recorded
779 playing = 0;
780
781 cardRead = 0;
782
783 }
784
785 // Change where to record (or begin playing)
786 else if (button_pressed)
787 {
788 // Next option if we were previously playing
789 if (playing)
790 selected = (selected + 1) % OPTS;
791 playing = !playing;
792
793 LEDsoff();
794 LED(selected + 1, 0);
795
796 // Begin transmitting
797 if (playing)
798 {
799 LED(LED_GREEN, 0);
800 DbpString("Playing");
801 // wait for button to be released
802 while(BUTTON_PRESS())
803 WDT_HIT();
804 if (tops[selected] > 0)
805 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
806 else
807 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
808
809 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
810 DbpString("Done playing");
811 if (BUTTON_HELD(1000) > 0)
812 {
813 DbpString("Exiting");
814 LEDsoff();
815 return;
816 }
817
818 /* We pressed a button so ignore it here with a delay */
819 SpinDelay(300);
820
821 // when done, we're done playing, move to next option
822 selected = (selected + 1) % OPTS;
823 playing = !playing;
824 LEDsoff();
825 LED(selected + 1, 0);
826 }
827 else
828 while(BUTTON_PRESS())
829 WDT_HIT();
830 }
831 }
832 }
833
834 #endif
835 /*
836 OBJECTIVE
837 Listen and detect an external reader. Determine the best location
838 for the antenna.
839
840 INSTRUCTIONS:
841 Inside the ListenReaderField() function, there is two mode.
842 By default, when you call the function, you will enter mode 1.
843 If you press the PM3 button one time, you will enter mode 2.
844 If you press the PM3 button a second time, you will exit the function.
845
846 DESCRIPTION OF MODE 1:
847 This mode just listens for an external reader field and lights up green
848 for HF and/or red for LF. This is the original mode of the detectreader
849 function.
850
851 DESCRIPTION OF MODE 2:
852 This mode will visually represent, using the LEDs, the actual strength of the
853 current compared to the maximum current detected. Basically, once you know
854 what kind of external reader is present, it will help you spot the best location to place
855 your antenna. You will probably not get some good results if there is a LF and a HF reader
856 at the same place! :-)
857
858 LIGHT SCHEME USED:
859 */
860 static const char LIGHT_SCHEME[] = {
861 0x0, /* ---- | No field detected */
862 0x1, /* X--- | 14% of maximum current detected */
863 0x2, /* -X-- | 29% of maximum current detected */
864 0x4, /* --X- | 43% of maximum current detected */
865 0x8, /* ---X | 57% of maximum current detected */
866 0xC, /* --XX | 71% of maximum current detected */
867 0xE, /* -XXX | 86% of maximum current detected */
868 0xF, /* XXXX | 100% of maximum current detected */
869 };
870 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
871
872 void ListenReaderField(int limit)
873 {
874 int lf_av, lf_av_new=0, lf_baseline= 0, lf_max;
875 int hf_av, hf_av_new=0, hf_baseline= 0, hf_max;
876 int mode=1, display_val, display_max, i;
877
878 #define LF_ONLY 1
879 #define HF_ONLY 2
880 #define REPORT_CHANGE_PERCENT 5 // report new values only if they have changed at least by REPORT_CHANGE_PERCENT
881 #define MIN_HF_FIELD 300 // in mode 1 signal HF field greater than MIN_HF_FIELD above baseline
882 #define MIN_LF_FIELD 1200 // in mode 1 signal LF field greater than MIN_LF_FIELD above baseline
883
884
885 // switch off FPGA - we don't want to measure our own signal
886 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
887 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
888
889 LEDsoff();
890
891 lf_av = lf_max = AvgAdc_Voltage_LF();
892
893 if(limit != HF_ONLY) {
894 Dbprintf("LF 125/134kHz Baseline: %dmV", lf_av);
895 lf_baseline = lf_av;
896 }
897
898 hf_av = hf_max = AvgAdc_Voltage_HF();
899
900 if (limit != LF_ONLY) {
901 Dbprintf("HF 13.56MHz Baseline: %dmV", hf_av);
902 hf_baseline = hf_av;
903 }
904
905 for(;;) {
906 SpinDelay(500);
907 if (BUTTON_PRESS()) {
908 switch (mode) {
909 case 1:
910 mode=2;
911 DbpString("Signal Strength Mode");
912 break;
913 case 2:
914 default:
915 DbpString("Stopped");
916 LEDsoff();
917 return;
918 break;
919 }
920 while (BUTTON_PRESS());
921 }
922 WDT_HIT();
923
924 if (limit != HF_ONLY) {
925 if(mode == 1) {
926 if (lf_av - lf_baseline > MIN_LF_FIELD)
927 LED_D_ON();
928 else
929 LED_D_OFF();
930 }
931
932 lf_av_new = AvgAdc_Voltage_LF();
933 // see if there's a significant change
934 if (ABS((lf_av - lf_av_new)*100/(lf_av?lf_av:1)) > REPORT_CHANGE_PERCENT) {
935 Dbprintf("LF 125/134kHz Field Change: %5dmV", lf_av_new);
936 lf_av = lf_av_new;
937 if (lf_av > lf_max)
938 lf_max = lf_av;
939 }
940 }
941
942 if (limit != LF_ONLY) {
943 if (mode == 1){
944 if (hf_av - hf_baseline > MIN_HF_FIELD)
945 LED_B_ON();
946 else
947 LED_B_OFF();
948 }
949
950 hf_av_new = AvgAdc_Voltage_HF();
951
952 // see if there's a significant change
953 if (ABS((hf_av - hf_av_new)*100/(hf_av?hf_av:1)) > REPORT_CHANGE_PERCENT) {
954 Dbprintf("HF 13.56MHz Field Change: %5dmV", hf_av_new);
955 hf_av = hf_av_new;
956 if (hf_av > hf_max)
957 hf_max = hf_av;
958 }
959 }
960
961 if(mode == 2) {
962 if (limit == LF_ONLY) {
963 display_val = lf_av;
964 display_max = lf_max;
965 } else if (limit == HF_ONLY) {
966 display_val = hf_av;
967 display_max = hf_max;
968 } else { /* Pick one at random */
969 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
970 display_val = hf_av;
971 display_max = hf_max;
972 } else {
973 display_val = lf_av;
974 display_max = lf_max;
975 }
976 }
977 for (i=0; i<LIGHT_LEN; i++) {
978 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
979 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
980 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
981 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
982 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
983 break;
984 }
985 }
986 }
987 }
988 }
989
990 void UsbPacketReceived(uint8_t *packet, int len)
991 {
992 UsbCommand *c = (UsbCommand *)packet;
993
994 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
995
996 switch(c->cmd) {
997 #ifdef WITH_LF
998 case CMD_SET_LF_SAMPLING_CONFIG:
999 setSamplingConfig((sample_config *) c->d.asBytes);
1000 break;
1001 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1002 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
1003 break;
1004 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
1005 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1006 break;
1007 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
1008 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
1009 break;
1010 case CMD_HID_DEMOD_FSK:
1011 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
1012 break;
1013 case CMD_HID_SIM_TAG:
1014 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
1015 break;
1016 case CMD_FSK_SIM_TAG:
1017 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1018 break;
1019 case CMD_ASK_SIM_TAG:
1020 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1021 break;
1022 case CMD_PSK_SIM_TAG:
1023 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1024 break;
1025 case CMD_HID_CLONE_TAG:
1026 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x1D);
1027 break;
1028 case CMD_PARADOX_CLONE_TAG:
1029 // Paradox cards are the same as HID, with a different preamble, so we can reuse the same function
1030 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x0F);
1031 break;
1032 case CMD_IO_DEMOD_FSK:
1033 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
1034 break;
1035 case CMD_IO_CLONE_TAG:
1036 CopyIOtoT55x7(c->arg[0], c->arg[1]);
1037 break;
1038 case CMD_EM410X_DEMOD:
1039 CmdEM410xdemod(c->arg[0], 0, 0, 1);
1040 break;
1041 case CMD_EM410X_WRITE_TAG:
1042 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
1043 break;
1044 case CMD_READ_TI_TYPE:
1045 ReadTItag();
1046 break;
1047 case CMD_WRITE_TI_TYPE:
1048 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
1049 break;
1050 case CMD_SIMULATE_TAG_125K:
1051 LED_A_ON();
1052 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
1053 LED_A_OFF();
1054 break;
1055 case CMD_LF_SIMULATE_BIDIR:
1056 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1057 break;
1058 case CMD_INDALA_CLONE_TAG:
1059 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1060 break;
1061 case CMD_INDALA_CLONE_TAG_L:
1062 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1063 break;
1064 case CMD_T55XX_READ_BLOCK:
1065 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1066 break;
1067 case CMD_T55XX_WRITE_BLOCK:
1068 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1069 break;
1070 case CMD_T55XX_WAKEUP:
1071 T55xxWakeUp(c->arg[0]);
1072 break;
1073 case CMD_T55XX_RESET_READ:
1074 T55xxResetRead();
1075 break;
1076 case CMD_PCF7931_READ:
1077 ReadPCF7931();
1078 break;
1079 case CMD_PCF7931_WRITE:
1080 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1081 break;
1082 case CMD_PCF7931_BRUTEFORCE:
1083 BruteForcePCF7931(c->arg[0], (c->arg[1] & 0xFF), c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128);
1084 break;
1085 case CMD_EM4X_READ_WORD:
1086 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1087 break;
1088 case CMD_EM4X_WRITE_WORD:
1089 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1090 break;
1091 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1092 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1093 break;
1094 case CMD_VIKING_CLONE_TAG:
1095 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1096 break;
1097 case CMD_COTAG:
1098 Cotag(c->arg[0]);
1099 break;
1100 #endif
1101
1102 #ifdef WITH_HITAG
1103 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1104 SnoopHitag(c->arg[0]);
1105 break;
1106 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1107 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1108 break;
1109 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1110 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1111 break;
1112 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1113 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1114 break;
1115 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1116 check_challenges_cmd((bool)c->arg[0], (byte_t*)c->d.asBytes, (uint8_t)c->arg[1]);
1117 break;
1118 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1119 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], false);
1120 break;
1121 case CMD_READ_HITAG_S_BLK:
1122 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], true);
1123 break;
1124 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1125 if ((hitag_function)c->arg[0] < 10) {
1126 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1127 }
1128 else if ((hitag_function)c->arg[0] >= 10) {
1129 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1130 }
1131 break;
1132 #endif
1133
1134 #ifdef WITH_ISO15693
1135 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1136 AcquireRawAdcSamplesIso15693();
1137 break;
1138
1139 case CMD_SNOOP_ISO_15693:
1140 SnoopIso15693();
1141 break;
1142
1143 case CMD_ISO_15693_COMMAND:
1144 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1145 break;
1146
1147 case CMD_ISO_15693_FIND_AFI:
1148 BruteforceIso15693Afi(c->arg[0]);
1149 break;
1150
1151 case CMD_ISO_15693_DEBUG:
1152 SetDebugIso15693(c->arg[0]);
1153 break;
1154
1155 case CMD_READER_ISO_15693:
1156 ReaderIso15693(c->arg[0]);
1157 break;
1158 case CMD_SIMTAG_ISO_15693:
1159 SimTagIso15693(c->arg[0], c->d.asBytes);
1160 break;
1161 #endif
1162
1163 #ifdef WITH_LEGICRF
1164 case CMD_SIMULATE_TAG_LEGIC_RF:
1165 LegicRfSimulate(c->arg[0]);
1166 break;
1167
1168 case CMD_WRITER_LEGIC_RF:
1169 LegicRfWriter(c->arg[1], c->arg[0]);
1170 break;
1171
1172 case CMD_READER_LEGIC_RF:
1173 LegicRfReader(c->arg[0], c->arg[1]);
1174 break;
1175 #endif
1176
1177 #ifdef WITH_ISO14443b
1178 case CMD_READ_SRI512_TAG:
1179 ReadSTMemoryIso14443b(0x0F);
1180 break;
1181 case CMD_READ_SRIX4K_TAG:
1182 ReadSTMemoryIso14443b(0x7F);
1183 break;
1184 case CMD_SNOOP_ISO_14443B:
1185 SnoopIso14443b();
1186 break;
1187 case CMD_SIMULATE_TAG_ISO_14443B:
1188 SimulateIso14443bTag();
1189 break;
1190 case CMD_ISO_14443B_COMMAND:
1191 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1192 break;
1193 #endif
1194
1195 #ifdef WITH_ISO14443a
1196 case CMD_SNOOP_ISO_14443a:
1197 SnoopIso14443a(c->arg[0]);
1198 break;
1199 case CMD_READER_ISO_14443a:
1200 ReaderIso14443a(c);
1201 break;
1202 case CMD_SIMULATE_TAG_ISO_14443a:
1203 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1204 break;
1205
1206 case CMD_EPA_PACE_COLLECT_NONCE:
1207 EPA_PACE_Collect_Nonce(c);
1208 break;
1209 case CMD_EPA_PACE_REPLAY:
1210 EPA_PACE_Replay(c);
1211 break;
1212
1213 case CMD_READER_MIFARE:
1214 ReaderMifare(c->arg[0]);
1215 break;
1216 case CMD_MIFARE_READBL:
1217 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1218 break;
1219 case CMD_MIFAREU_READBL:
1220 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1221 break;
1222 case CMD_MIFAREUC_AUTH:
1223 MifareUC_Auth(c->arg[0],c->d.asBytes);
1224 break;
1225 case CMD_MIFAREU_READCARD:
1226 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1227 break;
1228 case CMD_MIFAREUC_SETPWD:
1229 MifareUSetPwd(c->arg[0], c->d.asBytes);
1230 break;
1231 case CMD_MIFARE_READSC:
1232 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1233 break;
1234 case CMD_MIFARE_WRITEBL:
1235 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1236 break;
1237 //case CMD_MIFAREU_WRITEBL_COMPAT:
1238 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1239 //break;
1240 case CMD_MIFAREU_WRITEBL:
1241 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1242 break;
1243 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1244 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1245 break;
1246 case CMD_MIFARE_NESTED:
1247 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1248 break;
1249 case CMD_MIFARE_CHKKEYS:
1250 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1251 break;
1252 case CMD_SIMULATE_MIFARE_CARD:
1253 MifareSim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1254 break;
1255
1256 // emulator
1257 case CMD_MIFARE_SET_DBGMODE:
1258 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1259 break;
1260 case CMD_MIFARE_EML_MEMCLR:
1261 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1262 break;
1263 case CMD_MIFARE_EML_MEMSET:
1264 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1265 break;
1266 case CMD_MIFARE_EML_MEMGET:
1267 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1268 break;
1269 case CMD_MIFARE_EML_CARDLOAD:
1270 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1271 break;
1272
1273 // Work with "magic Chinese" card
1274 case CMD_MIFARE_CWIPE:
1275 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1276 break;
1277 case CMD_MIFARE_CSETBLOCK:
1278 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1279 break;
1280 case CMD_MIFARE_CGETBLOCK:
1281 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1282 break;
1283 case CMD_MIFARE_CIDENT:
1284 MifareCIdent();
1285 break;
1286
1287 // mifare sniffer
1288 case CMD_MIFARE_SNIFFER:
1289 SniffMifare(c->arg[0]);
1290 break;
1291
1292 #endif
1293
1294 #ifdef WITH_ICLASS
1295 // Makes use of ISO14443a FPGA Firmware
1296 case CMD_SNOOP_ICLASS:
1297 SnoopIClass();
1298 break;
1299 case CMD_SIMULATE_TAG_ICLASS:
1300 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1301 break;
1302 case CMD_READER_ICLASS:
1303 ReaderIClass(c->arg[0]);
1304 break;
1305 case CMD_READER_ICLASS_REPLAY:
1306 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1307 break;
1308 case CMD_ICLASS_EML_MEMSET:
1309 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1310 break;
1311 case CMD_ICLASS_WRITEBLOCK:
1312 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1313 break;
1314 case CMD_ICLASS_READCHECK: // auth step 1
1315 iClass_ReadCheck(c->arg[0], c->arg[1]);
1316 break;
1317 case CMD_ICLASS_READBLOCK:
1318 iClass_ReadBlk(c->arg[0]);
1319 break;
1320 case CMD_ICLASS_AUTHENTICATION: //check
1321 iClass_Authentication(c->d.asBytes);
1322 break;
1323 case CMD_ICLASS_DUMP:
1324 iClass_Dump(c->arg[0], c->arg[1]);
1325 break;
1326 case CMD_ICLASS_CLONE:
1327 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1328 break;
1329 #endif
1330
1331 #ifdef WITH_HFSNOOP
1332 case CMD_HF_SNIFFER:
1333 HfSnoop(c->arg[0], c->arg[1]);
1334 break;
1335 case CMD_HF_PLOT:
1336 HfPlot();
1337 break;
1338 #endif
1339
1340 #ifdef WITH_SMARTCARD
1341 case CMD_SMART_ATR: {
1342 SmartCardAtr();
1343 break;
1344 }
1345 case CMD_SMART_SETCLOCK:{
1346 SmartCardSetClock(c->arg[0]);
1347 break;
1348 }
1349 case CMD_SMART_RAW: {
1350 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1351 break;
1352 }
1353 case CMD_SMART_UPLOAD: {
1354 // upload file from client
1355 uint8_t *mem = BigBuf_get_addr();
1356 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1357 cmd_send(CMD_ACK,1,0,0,0,0);
1358 break;
1359 }
1360 case CMD_SMART_UPGRADE: {
1361 SmartCardUpgrade(c->arg[0]);
1362 break;
1363 }
1364 #endif
1365
1366 case CMD_BUFF_CLEAR:
1367 BigBuf_Clear();
1368 break;
1369
1370 case CMD_MEASURE_ANTENNA_TUNING:
1371 MeasureAntennaTuning(c->arg[0]);
1372 break;
1373
1374 case CMD_MEASURE_ANTENNA_TUNING_HF:
1375 MeasureAntennaTuningHf();
1376 break;
1377
1378 case CMD_LISTEN_READER_FIELD:
1379 ListenReaderField(c->arg[0]);
1380 break;
1381
1382 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1383 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1384 SpinDelay(200);
1385 LED_D_OFF(); // LED D indicates field ON or OFF
1386 break;
1387
1388 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1389 LED_B_ON();
1390 uint8_t *BigBuf = BigBuf_get_addr();
1391 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1392 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1393 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1394 }
1395 // Trigger a finish downloading signal with an ACK frame
1396 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1397 LED_B_OFF();
1398 break;
1399
1400 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1401 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1402 // to be able to use this one for uploading data to device
1403 // arg1 = 0 upload for LF usage
1404 // 1 upload for HF usage
1405 if (c->arg[1] == 0)
1406 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1407 else
1408 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1409
1410 uint8_t *b = BigBuf_get_addr();
1411 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1412 cmd_send(CMD_ACK,0,0,0,0,0);
1413 break;
1414 }
1415 case CMD_READ_MEM:
1416 ReadMem(c->arg[0]);
1417 break;
1418
1419 case CMD_SET_LF_DIVISOR:
1420 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1421 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1422 break;
1423
1424 case CMD_SET_ADC_MUX:
1425 switch(c->arg[0]) {
1426 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1427 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1428 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1429 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1430 }
1431 break;
1432
1433 case CMD_VERSION:
1434 SendVersion();
1435 break;
1436 case CMD_STATUS:
1437 SendStatus();
1438 break;
1439 case CMD_PING:
1440 cmd_send(CMD_ACK,0,0,0,0,0);
1441 break;
1442 #ifdef WITH_LCD
1443 case CMD_LCD_RESET:
1444 LCDReset();
1445 break;
1446 case CMD_LCD:
1447 LCDSend(c->arg[0]);
1448 break;
1449 #endif
1450 case CMD_SETUP_WRITE:
1451 case CMD_FINISH_WRITE:
1452 case CMD_HARDWARE_RESET:
1453 usb_disable();
1454 SpinDelay(1000);
1455 SpinDelay(1000);
1456 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1457 for(;;) {
1458 // We're going to reset, and the bootrom will take control.
1459 }
1460 break;
1461
1462 case CMD_START_FLASH:
1463 if(common_area.flags.bootrom_present) {
1464 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1465 }
1466 usb_disable();
1467 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1468 for(;;);
1469 break;
1470
1471 case CMD_DEVICE_INFO: {
1472 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1473 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1474 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1475 break;
1476 }
1477 default:
1478 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1479 break;
1480 }
1481 }
1482
1483 void __attribute__((noreturn)) AppMain(void)
1484 {
1485 SpinDelay(100);
1486 clear_trace();
1487 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1488 /* Initialize common area */
1489 memset(&common_area, 0, sizeof(common_area));
1490 common_area.magic = COMMON_AREA_MAGIC;
1491 common_area.version = 1;
1492 }
1493 common_area.flags.osimage_present = 1;
1494
1495 LEDsoff();
1496
1497 // Init USB device
1498 usb_enable();
1499
1500 // The FPGA gets its clock from us from PCK0 output, so set that up.
1501 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1502 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1503 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1504 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1505 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1506 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1507 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1508
1509 // Reset SPI
1510 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1511 // Reset SSC
1512 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1513
1514 // Load the FPGA image, which we have stored in our flash.
1515 // (the HF version by default)
1516 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1517
1518 StartTickCount();
1519
1520 #ifdef WITH_LCD
1521 LCDInit();
1522 #endif
1523
1524 byte_t rx[sizeof(UsbCommand)];
1525 size_t rx_len;
1526
1527 for(;;) {
1528 if (usb_poll()) {
1529 rx_len = usb_read(rx,sizeof(UsbCommand));
1530 if (rx_len) {
1531 UsbPacketReceived(rx,rx_len);
1532 }
1533 }
1534 WDT_HIT();
1535
1536 #ifdef WITH_LF_StandAlone
1537 #ifndef WITH_ISO14443a_StandAlone
1538 if (BUTTON_HELD(1000) > 0)
1539 SamyRun();
1540 #endif
1541 #endif
1542 #ifdef WITH_ISO14443a
1543 #ifdef WITH_ISO14443a_StandAlone
1544 if (BUTTON_HELD(1000) > 0)
1545 StandAloneMode14a();
1546 #endif
1547 #endif
1548 }
1549 }
Proxmark3 GIT tracking
Impressum, Datenschutz