]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


428d187ec8535590678a4bbe7137c84e221d108f
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12 #include "usb_cdc.h"
13 #include "cmd.h"
14 #include "proxmark3.h"
15 #include "apps.h"
16 #include "util.h"
17 #include "printf.h"
18 #include "string.h"
19 #include <stdarg.h>
20 #include "legicrf.h"
21 #include "hitag2.h"
22 #include "hitagS.h"
23 #include "lfsampling.h"
24 #include "BigBuf.h"
25 #include "mifareutil.h"
26 #include "pcf7931.h"
27
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 // Craig Young - 14a stand-alone code
33 #ifdef WITH_ISO14443a_StandAlone
34 #include "iso14443a.h"
35 #include "protocols.h"
36 #endif
37
38 //=============================================================================
39 // A buffer where we can queue things up to be sent through the FPGA, for
40 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
41 // is the order in which they go out on the wire.
42 //=============================================================================
43
44 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
45 uint8_t ToSend[TOSEND_BUFFER_SIZE];
46 int ToSendMax = 0;
47 static int ToSendBit;
48 struct common_area common_area __attribute__((section(".commonarea")));
49
50 void ToSendReset(void)
51 {
52 ToSendMax = -1;
53 ToSendBit = 8;
54 }
55
56 void ToSendStuffBit(int b) {
57 if(ToSendBit >= 8) {
58 ++ToSendMax;
59 ToSend[ToSendMax] = 0;
60 ToSendBit = 0;
61 }
62
63 if(b)
64 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
65
66 ++ToSendBit;
67
68 if(ToSendMax >= sizeof(ToSend)) {
69 ToSendBit = 0;
70 DbpString("ToSendStuffBit overflowed!");
71 }
72 }
73
74 //=============================================================================
75 // Debug print functions, to go out over USB, to the usual PC-side client.
76 //=============================================================================
77
78 void DbpStringEx(char *str, uint32_t cmd){
79 byte_t len = strlen(str);
80 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
81 }
82
83 void DbpString(char *str) {
84 DbpStringEx(str, 0);
85 }
86
87 #if 0
88 void DbpIntegers(int x1, int x2, int x3) {
89 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
90 }
91 #endif
92 void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
93 // should probably limit size here; oh well, let's just use a big buffer
94 char output_string[128] = {0x00};
95 va_list ap;
96
97 va_start(ap, fmt);
98 kvsprintf(fmt, output_string, 10, ap);
99 va_end(ap);
100
101 DbpStringEx(output_string, cmd);
102 }
103
104 void Dbprintf(const char *fmt, ...) {
105 // should probably limit size here; oh well, let's just use a big buffer
106 char output_string[128] = {0x00};
107 va_list ap;
108
109 va_start(ap, fmt);
110 kvsprintf(fmt, output_string, 10, ap);
111 va_end(ap);
112
113 DbpString(output_string);
114 }
115
116 // prints HEX & ASCII
117 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
118 int l=0, i;
119 char ascii[9];
120
121 while (len>0) {
122
123 l = (len>8) ? 8 : len;
124
125 memcpy(ascii,d,l);
126 ascii[l]=0;
127
128 // filter safe ascii
129 for (i=0; i<l; ++i)
130 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
131
132 if (bAsci)
133 Dbprintf("%-8s %*D",ascii,l,d," ");
134 else
135 Dbprintf("%*D",l,d," ");
136
137 len -= 8;
138 d += 8;
139 }
140 }
141
142 //-----------------------------------------------------------------------------
143 // Read an ADC channel and block till it completes, then return the result
144 // in ADC units (0 to 1023). Also a routine to average 32 samples and
145 // return that.
146 //-----------------------------------------------------------------------------
147 static int ReadAdc(int ch)
148 {
149 uint32_t d;
150
151 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
152 AT91C_BASE_ADC->ADC_MR =
153 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
154 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
155 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
156
157 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
158 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
159 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
160 //
161 // The maths are:
162 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
163 //
164 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
165 //
166 // Note: with the "historic" values in the comments above, the error was 34% !!!
167
168 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
169
170 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
171
172 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
173
174 d = AT91C_BASE_ADC->ADC_CDR[ch];
175 return d;
176 }
177
178 int AvgAdc(int ch) // was static - merlok
179 {
180 int i;
181 int a = 0;
182
183 for(i = 0; i < 32; ++i)
184 a += ReadAdc(ch);
185
186 return (a + 15) >> 5;
187 }
188
189 void MeasureAntennaTuning(void) {
190 uint8_t LF_Results[256];
191 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
192 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
193
194 LED_B_ON();
195
196 /*
197 * Sweeps the useful LF range of the proxmark from
198 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
199 * read the voltage in the antenna, the result left
200 * in the buffer is a graph which should clearly show
201 * the resonating frequency of your LF antenna
202 * ( hopefully around 95 if it is tuned to 125kHz!)
203 */
204
205 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
206 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
207
208 for (i=255; i>=19; i--) {
209 WDT_HIT();
210 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
211 SpinDelay(20);
212 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
213 if (i==95) vLf125 = adcval; // voltage at 125Khz
214 if (i==89) vLf134 = adcval; // voltage at 134Khz
215
216 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
217 if(LF_Results[i] > peak) {
218 peakv = adcval;
219 peak = LF_Results[i];
220 peakf = i;
221 //ptr = i;
222 }
223 }
224
225 for (i=18; i >= 0; i--) LF_Results[i] = 0;
226
227 LED_A_ON();
228 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
229 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
230 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
231 SpinDelay(20);
232 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
233
234 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
235 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
236
237 LEDsoff();
238 }
239
240 void MeasureAntennaTuningHf(void) {
241 int vHf = 0; // in mV
242 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
243 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
244 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
245
246 while ( !BUTTON_PRESS() ){
247 SpinDelay(20);
248 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
249 //Dbprintf("%d mV",vHf);
250 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
251 }
252 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
253 DbpString("cancelled");
254 }
255
256
257 void ReadMem(int addr) {
258 const uint8_t *data = ((uint8_t *)addr);
259
260 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
261 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
262 }
263
264 /* osimage version information is linked in */
265 extern struct version_information version_information;
266 /* bootrom version information is pointed to from _bootphase1_version_pointer */
267 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
268 void SendVersion(void)
269 {
270 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
271 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
272
273 /* Try to find the bootrom version information. Expect to find a pointer at
274 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
275 * pointer, then use it.
276 */
277 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
278
279 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
280 strcat(VersionString, "bootrom version information appears invalid\n");
281 } else {
282 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
283 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
284 }
285
286 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
287 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
288
289 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
290 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
291
292 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
293 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
294
295 // Send Chip ID and used flash memory
296 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
297 uint32_t compressed_data_section_size = common_area.arg1;
298 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
299 }
300
301 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
302 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
303 void printUSBSpeed(void)
304 {
305 Dbprintf("USB Speed:");
306 Dbprintf(" Sending USB packets to client...");
307
308 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
309 uint8_t *test_data = BigBuf_get_addr();
310 uint32_t end_time;
311
312 uint32_t start_time = end_time = GetTickCount();
313 uint32_t bytes_transferred = 0;
314
315 LED_B_ON();
316 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
317 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
318 end_time = GetTickCount();
319 bytes_transferred += USB_CMD_DATA_SIZE;
320 }
321 LED_B_OFF();
322
323 Dbprintf(" Time elapsed: %dms", end_time - start_time);
324 Dbprintf(" Bytes transferred: %d", bytes_transferred);
325 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
326 1000 * bytes_transferred / (end_time - start_time));
327
328 }
329
330 /**
331 * Prints runtime information about the PM3.
332 **/
333 void SendStatus(void) {
334 BigBuf_print_status();
335 Fpga_print_status();
336 printConfig(); //LF Sampling config
337 printUSBSpeed();
338 Dbprintf("Various");
339 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
340 Dbprintf(" ToSendMax..........%d", ToSendMax);
341 Dbprintf(" ToSendBit..........%d", ToSendBit);
342 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
343
344 cmd_send(CMD_ACK,1,0,0,0,0);
345 }
346
347 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
348
349 #define OPTS 2
350 void StandAloneMode()
351 {
352 DbpString("Stand-alone mode! No PC necessary.");
353 // Oooh pretty -- notify user we're in elite samy mode now
354 LED(LED_RED, 200);
355 LED(LED_ORANGE, 200);
356 LED(LED_GREEN, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_RED, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_GREEN, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_RED, 200);
363 }
364 #endif
365
366 #ifdef WITH_ISO14443a_StandAlone
367 void StandAloneMode14a()
368 {
369 StandAloneMode();
370 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
371
372 int selected = 0;
373 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
374 int cardRead[OPTS] = {0};
375 uint8_t readUID[10] = {0};
376 uint32_t uid_1st[OPTS]={0};
377 uint32_t uid_2nd[OPTS]={0};
378 uint32_t uid_tmp1 = 0;
379 uint32_t uid_tmp2 = 0;
380 iso14a_card_select_t hi14a_card[OPTS];
381
382 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
383
384 LED(selected + 1, 0);
385
386 for (;;)
387 {
388 usb_poll();
389 WDT_HIT();
390 SpinDelay(300);
391
392 if (iGotoRecord == 1 || cardRead[selected] == 0)
393 {
394 iGotoRecord = 0;
395 LEDsoff();
396 LED(selected + 1, 0);
397 LED(LED_RED2, 0);
398
399 // record
400 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
401 /* need this delay to prevent catching some weird data */
402 SpinDelay(500);
403 /* Code for reading from 14a tag */
404 uint8_t uid[10] = {0};
405 uint32_t cuid = 0;
406 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
407
408 for ( ; ; )
409 {
410 WDT_HIT();
411 if (BUTTON_PRESS()) {
412 if (cardRead[selected]) {
413 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
414 break;
415 }
416 else if (cardRead[(selected+1)%OPTS]) {
417 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
418 selected = (selected+1)%OPTS;
419 break; // playing = 1;
420 }
421 else {
422 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
423 SpinDelay(300);
424 }
425 }
426 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
427 continue;
428 else
429 {
430 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
431 memcpy(readUID,uid,10*sizeof(uint8_t));
432 uint8_t *dst = (uint8_t *)&uid_tmp1;
433 // Set UID byte order
434 for (int i=0; i<4; i++)
435 dst[i] = uid[3-i];
436 dst = (uint8_t *)&uid_tmp2;
437 for (int i=0; i<4; i++)
438 dst[i] = uid[7-i];
439 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
440 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
441 }
442 else {
443 if (uid_tmp2) {
444 Dbprintf("Bank[%d] received a 7-byte UID",selected);
445 uid_1st[selected] = (uid_tmp1)>>8;
446 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
447 }
448 else {
449 Dbprintf("Bank[%d] received a 4-byte UID",selected);
450 uid_1st[selected] = uid_tmp1;
451 uid_2nd[selected] = uid_tmp2;
452 }
453 break;
454 }
455 }
456 }
457 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
458 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
459 LEDsoff();
460 LED(LED_GREEN, 200);
461 LED(LED_ORANGE, 200);
462 LED(LED_GREEN, 200);
463 LED(LED_ORANGE, 200);
464
465 LEDsoff();
466 LED(selected + 1, 0);
467
468 // Next state is replay:
469 playing = 1;
470
471 cardRead[selected] = 1;
472 }
473 /* MF Classic UID clone */
474 else if (iGotoClone==1)
475 {
476 iGotoClone=0;
477 LEDsoff();
478 LED(selected + 1, 0);
479 LED(LED_ORANGE, 250);
480
481 // record
482 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
483
484 // wait for button to be released
485 // Delay cloning until card is in place
486 while(BUTTON_PRESS())
487 WDT_HIT();
488
489 Dbprintf("Starting clone. [Bank: %u]", selected);
490 // need this delay to prevent catching some weird data
491 SpinDelay(500);
492 // Begin clone function here:
493 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
494 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
495 memcpy(c.d.asBytes, data, 16);
496 SendCommand(&c);
497
498 Block read is similar:
499 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
500 We need to imitate that call with blockNo 0 to set a uid.
501
502 The get and set commands are handled in this file:
503 // Work with "magic Chinese" card
504 case CMD_MIFARE_CSETBLOCK:
505 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
506 break;
507 case CMD_MIFARE_CGETBLOCK:
508 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
509 break;
510
511 mfCSetUID provides example logic for UID set workflow:
512 -Read block0 from card in field with MifareCGetBlock()
513 -Configure new values without replacing reserved bytes
514 memcpy(block0, uid, 4); // Copy UID bytes from byte array
515 // Mifare UID BCC
516 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
517 Bytes 5-7 are reserved SAK and ATQA for mifare classic
518 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
519 */
520 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
521 // arg0 = Flags, arg1=blockNo
522 MifareCGetBlock(params, 0, oldBlock0);
523 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
524 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
525 playing = 1;
526 }
527 else {
528 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
529 memcpy(newBlock0,oldBlock0,16);
530 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
531
532 newBlock0[0] = uid_1st[selected]>>24;
533 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
534 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
535 newBlock0[3] = 0xFF & (uid_1st[selected]);
536 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
537
538 // arg0 = workFlags, arg1 = blockNo, datain
539 MifareCSetBlock(params, 0, newBlock0);
540 MifareCGetBlock(params, 0, testBlock0);
541
542 if (memcmp(testBlock0, newBlock0, 16)==0) {
543 DbpString("Cloned successfull!");
544 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
545 playing = 0;
546 iGotoRecord = 1;
547 selected = (selected + 1) % OPTS;
548 } else {
549 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
550 playing = 1;
551 }
552 }
553 LEDsoff();
554 LED(selected + 1, 0);
555 }
556 // Change where to record (or begin playing)
557 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
558 {
559 LEDsoff();
560 LED(selected + 1, 0);
561
562 // Begin transmitting
563 if (playing)
564 {
565 LED(LED_GREEN, 0);
566 DbpString("Playing");
567 for ( ; ; ) {
568 WDT_HIT();
569 int button_action = BUTTON_HELD(1000);
570 if (button_action == 0) { // No button action, proceed with sim
571 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
572 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
573 num_to_bytes(uid_1st[selected], 3, data);
574 num_to_bytes(uid_2nd[selected], 4, data);
575
576 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
577 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
578 DbpString("Mifare Classic");
579 SimulateIso14443aTag(1, flags, data); // Mifare Classic
580 }
581 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
582 DbpString("Mifare Ultralight");
583 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
584 }
585 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
586 DbpString("Mifare DESFire");
587 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
588 }
589 else {
590 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
591 SimulateIso14443aTag(1, flags, data);
592 }
593 }
594 else if (button_action == BUTTON_SINGLE_CLICK) {
595 selected = (selected + 1) % OPTS;
596 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
597 iGotoRecord = 1;
598 break;
599 }
600 else if (button_action == BUTTON_HOLD) {
601 Dbprintf("Playtime over. Begin cloning...");
602 iGotoClone = 1;
603 break;
604 }
605 WDT_HIT();
606 }
607
608 /* We pressed a button so ignore it here with a delay */
609 SpinDelay(300);
610 LEDsoff();
611 LED(selected + 1, 0);
612 }
613 else
614 while(BUTTON_PRESS())
615 WDT_HIT();
616 }
617 }
618 }
619 #elif WITH_LF
620 // samy's sniff and repeat routine
621 void SamyRun()
622 {
623 StandAloneMode();
624 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
625
626 int high[OPTS], low[OPTS];
627 int selected = 0;
628 int playing = 0;
629 int cardRead = 0;
630
631 // Turn on selected LED
632 LED(selected + 1, 0);
633
634 for (;;) {
635 usb_poll();
636 WDT_HIT();
637
638 // Was our button held down or pressed?
639 int button_pressed = BUTTON_HELD(1000);
640 SpinDelay(300);
641
642 // Button was held for a second, begin recording
643 if (button_pressed > 0 && cardRead == 0)
644 {
645 LEDsoff();
646 LED(selected + 1, 0);
647 LED(LED_RED2, 0);
648
649 // record
650 DbpString("Starting recording");
651
652 // wait for button to be released
653 while(BUTTON_PRESS())
654 WDT_HIT();
655
656 /* need this delay to prevent catching some weird data */
657 SpinDelay(500);
658
659 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
660 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
661
662 LEDsoff();
663 LED(selected + 1, 0);
664 // Finished recording
665 // If we were previously playing, set playing off
666 // so next button push begins playing what we recorded
667 playing = 0;
668 cardRead = 1;
669 }
670 else if (button_pressed > 0 && cardRead == 1) {
671 LEDsoff();
672 LED(selected + 1, 0);
673 LED(LED_ORANGE, 0);
674
675 // record
676 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
677
678 // wait for button to be released
679 while(BUTTON_PRESS())
680 WDT_HIT();
681
682 /* need this delay to prevent catching some weird data */
683 SpinDelay(500);
684
685 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
686 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
687
688 LEDsoff();
689 LED(selected + 1, 0);
690 // Finished recording
691
692 // If we were previously playing, set playing off
693 // so next button push begins playing what we recorded
694 playing = 0;
695 cardRead = 0;
696 }
697
698 // Change where to record (or begin playing)
699 else if (button_pressed) {
700 // Next option if we were previously playing
701 if (playing)
702 selected = (selected + 1) % OPTS;
703 playing = !playing;
704
705 LEDsoff();
706 LED(selected + 1, 0);
707
708 // Begin transmitting
709 if (playing)
710 {
711 LED(LED_GREEN, 0);
712 DbpString("Playing");
713 // wait for button to be released
714 while(BUTTON_PRESS())
715 WDT_HIT();
716
717 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
718 CmdHIDsimTAG(high[selected], low[selected], 0);
719 DbpString("Done playing");
720
721 if (BUTTON_HELD(1000) > 0) {
722 DbpString("Exiting");
723 LEDsoff();
724 return;
725 }
726
727 /* We pressed a button so ignore it here with a delay */
728 SpinDelay(300);
729
730 // when done, we're done playing, move to next option
731 selected = (selected + 1) % OPTS;
732 playing = !playing;
733 LEDsoff();
734 LED(selected + 1, 0);
735 }
736 else
737 while(BUTTON_PRESS())
738 WDT_HIT();
739 }
740 }
741 }
742
743 #endif
744 /*
745 OBJECTIVE
746 Listen and detect an external reader. Determine the best location
747 for the antenna.
748
749 INSTRUCTIONS:
750 Inside the ListenReaderField() function, there is two mode.
751 By default, when you call the function, you will enter mode 1.
752 If you press the PM3 button one time, you will enter mode 2.
753 If you press the PM3 button a second time, you will exit the function.
754
755 DESCRIPTION OF MODE 1:
756 This mode just listens for an external reader field and lights up green
757 for HF and/or red for LF. This is the original mode of the detectreader
758 function.
759
760 DESCRIPTION OF MODE 2:
761 This mode will visually represent, using the LEDs, the actual strength of the
762 current compared to the maximum current detected. Basically, once you know
763 what kind of external reader is present, it will help you spot the best location to place
764 your antenna. You will probably not get some good results if there is a LF and a HF reader
765 at the same place! :-)
766
767 LIGHT SCHEME USED:
768 */
769 static const char LIGHT_SCHEME[] = {
770 0x0, /* ---- | No field detected */
771 0x1, /* X--- | 14% of maximum current detected */
772 0x2, /* -X-- | 29% of maximum current detected */
773 0x4, /* --X- | 43% of maximum current detected */
774 0x8, /* ---X | 57% of maximum current detected */
775 0xC, /* --XX | 71% of maximum current detected */
776 0xE, /* -XXX | 86% of maximum current detected */
777 0xF, /* XXXX | 100% of maximum current detected */
778 };
779 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
780
781 void ListenReaderField(int limit) {
782 #define LF_ONLY 1
783 #define HF_ONLY 2
784 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
785
786 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
787 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
788 int mode=1, display_val, display_max, i;
789
790 // switch off FPGA - we don't want to measure our own signal
791 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
792 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
793
794 LEDsoff();
795
796 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
797
798 if(limit != HF_ONLY) {
799 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
800 lf_baseline = lf_av;
801 }
802
803 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
804
805 if (limit != LF_ONLY) {
806 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
807 hf_baseline = hf_av;
808 }
809
810 for(;;) {
811 if (BUTTON_PRESS()) {
812 SpinDelay(500);
813 switch (mode) {
814 case 1:
815 mode=2;
816 DbpString("Signal Strength Mode");
817 break;
818 case 2:
819 default:
820 DbpString("Stopped");
821 LEDsoff();
822 return;
823 break;
824 }
825 }
826 WDT_HIT();
827
828 if (limit != HF_ONLY) {
829 if(mode == 1) {
830 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
831 LED_D_ON();
832 else
833 LED_D_OFF();
834 }
835
836 lf_av_new = AvgAdc(ADC_CHAN_LF);
837 // see if there's a significant change
838 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
839 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
840 lf_av = lf_av_new;
841 if (lf_av > lf_max)
842 lf_max = lf_av;
843 }
844 }
845
846 if (limit != LF_ONLY) {
847 if (mode == 1){
848 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
849 LED_B_ON();
850 else
851 LED_B_OFF();
852 }
853
854 hf_av_new = AvgAdc(ADC_CHAN_HF);
855 // see if there's a significant change
856 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
857 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
858 hf_av = hf_av_new;
859 if (hf_av > hf_max)
860 hf_max = hf_av;
861 }
862 }
863
864 if(mode == 2) {
865 if (limit == LF_ONLY) {
866 display_val = lf_av;
867 display_max = lf_max;
868 } else if (limit == HF_ONLY) {
869 display_val = hf_av;
870 display_max = hf_max;
871 } else { /* Pick one at random */
872 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
873 display_val = hf_av;
874 display_max = hf_max;
875 } else {
876 display_val = lf_av;
877 display_max = lf_max;
878 }
879 }
880 for (i=0; i<LIGHT_LEN; i++) {
881 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
882 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
883 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
884 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
885 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
886 break;
887 }
888 }
889 }
890 }
891 }
892
893 void UsbPacketReceived(uint8_t *packet, int len)
894 {
895 UsbCommand *c = (UsbCommand *)packet;
896
897 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
898
899 switch(c->cmd) {
900 #ifdef WITH_LF
901 case CMD_SET_LF_SAMPLING_CONFIG:
902 setSamplingConfig((sample_config *) c->d.asBytes);
903 break;
904 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
905 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
906 break;
907 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
908 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
909 break;
910 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
911 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
912 break;
913 case CMD_HID_DEMOD_FSK:
914 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
915 break;
916 case CMD_HID_SIM_TAG:
917 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
918 break;
919 case CMD_FSK_SIM_TAG:
920 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
921 break;
922 case CMD_ASK_SIM_TAG:
923 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
924 break;
925 case CMD_PSK_SIM_TAG:
926 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
927 break;
928 case CMD_HID_CLONE_TAG:
929 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
930 break;
931 case CMD_IO_DEMOD_FSK:
932 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
933 break;
934 case CMD_IO_CLONE_TAG:
935 CopyIOtoT55x7(c->arg[0], c->arg[1]);
936 break;
937 case CMD_EM410X_DEMOD:
938 CmdEM410xdemod(c->arg[0], 0, 0, 1);
939 break;
940 case CMD_EM410X_WRITE_TAG:
941 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
942 break;
943 case CMD_READ_TI_TYPE:
944 ReadTItag();
945 break;
946 case CMD_WRITE_TI_TYPE:
947 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
948 break;
949 case CMD_SIMULATE_TAG_125K:
950 LED_A_ON();
951 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
952 LED_A_OFF();
953 break;
954 case CMD_LF_SIMULATE_BIDIR:
955 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
956 break;
957 case CMD_INDALA_CLONE_TAG:
958 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
959 break;
960 case CMD_INDALA_CLONE_TAG_L:
961 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
962 break;
963 case CMD_T55XX_READ_BLOCK:
964 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
965 break;
966 case CMD_T55XX_WRITE_BLOCK:
967 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
968 break;
969 case CMD_T55XX_WAKEUP:
970 T55xxWakeUp(c->arg[0]);
971 break;
972 case CMD_T55XX_RESET_READ:
973 T55xxResetRead();
974 break;
975 case CMD_PCF7931_READ:
976 ReadPCF7931();
977 break;
978 case CMD_PCF7931_WRITE:
979 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
980 break;
981 case CMD_EM4X_READ_WORD:
982 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
983 break;
984 case CMD_EM4X_WRITE_WORD:
985 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
986 break;
987 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
988 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
989 break;
990 case CMD_VIKING_CLONE_TAG:
991 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
992 break;
993 #endif
994
995 #ifdef WITH_HITAG
996 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
997 SnoopHitag(c->arg[0]);
998 break;
999 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1000 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1001 break;
1002 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1003 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1004 break;
1005 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1006 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1007 break;
1008 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1009 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1010 break;
1011 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1012 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1013 break;
1014 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1015 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1016 break;
1017 #endif
1018
1019 #ifdef WITH_ISO15693
1020 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1021 AcquireRawAdcSamplesIso15693();
1022 break;
1023 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1024 RecordRawAdcSamplesIso15693();
1025 break;
1026
1027 case CMD_ISO_15693_COMMAND:
1028 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1029 break;
1030
1031 case CMD_ISO_15693_FIND_AFI:
1032 BruteforceIso15693Afi(c->arg[0]);
1033 break;
1034
1035 case CMD_ISO_15693_DEBUG:
1036 SetDebugIso15693(c->arg[0]);
1037 break;
1038
1039 case CMD_READER_ISO_15693:
1040 ReaderIso15693(c->arg[0]);
1041 break;
1042 case CMD_SIMTAG_ISO_15693:
1043 SimTagIso15693(c->arg[0], c->d.asBytes);
1044 break;
1045 #endif
1046
1047 #ifdef WITH_LEGICRF
1048 case CMD_SIMULATE_TAG_LEGIC_RF:
1049 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1050 break;
1051
1052 case CMD_WRITER_LEGIC_RF:
1053 LegicRfWriter(c->arg[1], c->arg[0]);
1054 break;
1055
1056 case CMD_READER_LEGIC_RF:
1057 LegicRfReader(c->arg[0], c->arg[1]);
1058 break;
1059 #endif
1060
1061 #ifdef WITH_ISO14443b
1062 case CMD_READ_SRI512_TAG:
1063 ReadSTMemoryIso14443b(0x0F);
1064 break;
1065 case CMD_READ_SRIX4K_TAG:
1066 ReadSTMemoryIso14443b(0x7F);
1067 break;
1068 case CMD_SNOOP_ISO_14443B:
1069 SnoopIso14443b();
1070 break;
1071 case CMD_SIMULATE_TAG_ISO_14443B:
1072 SimulateIso14443bTag();
1073 break;
1074 case CMD_ISO_14443B_COMMAND:
1075 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1076 break;
1077 #endif
1078
1079 #ifdef WITH_ISO14443a
1080 case CMD_SNOOP_ISO_14443a:
1081 SniffIso14443a(c->arg[0]);
1082 break;
1083 case CMD_READER_ISO_14443a:
1084 ReaderIso14443a(c);
1085 break;
1086 case CMD_SIMULATE_TAG_ISO_14443a:
1087 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1088 break;
1089
1090 case CMD_EPA_PACE_COLLECT_NONCE:
1091 EPA_PACE_Collect_Nonce(c);
1092 break;
1093 case CMD_EPA_PACE_REPLAY:
1094 EPA_PACE_Replay(c);
1095 break;
1096
1097 case CMD_READER_MIFARE:
1098 ReaderMifare(c->arg[0], c->arg[1]);
1099 break;
1100 case CMD_MIFARE_READBL:
1101 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1102 break;
1103 case CMD_MIFAREU_READBL:
1104 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1105 break;
1106 case CMD_MIFAREUC_AUTH:
1107 MifareUC_Auth(c->arg[0],c->d.asBytes);
1108 break;
1109 case CMD_MIFAREU_READCARD:
1110 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1111 break;
1112 case CMD_MIFAREUC_SETPWD:
1113 MifareUSetPwd(c->arg[0], c->d.asBytes);
1114 break;
1115 case CMD_MIFARE_READSC:
1116 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1117 break;
1118 case CMD_MIFARE_WRITEBL:
1119 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1120 break;
1121 //case CMD_MIFAREU_WRITEBL_COMPAT:
1122 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1123 //break;
1124 case CMD_MIFAREU_WRITEBL:
1125 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1126 break;
1127 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1128 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1129 break;
1130 case CMD_MIFARE_NESTED:
1131 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1132 break;
1133 case CMD_MIFARE_CHKKEYS:
1134 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1135 break;
1136 case CMD_SIMULATE_MIFARE_CARD:
1137 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1138 break;
1139
1140 // emulator
1141 case CMD_MIFARE_SET_DBGMODE:
1142 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1143 break;
1144 case CMD_MIFARE_EML_MEMCLR:
1145 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1146 break;
1147 case CMD_MIFARE_EML_MEMSET:
1148 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1149 break;
1150 case CMD_MIFARE_EML_MEMGET:
1151 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1152 break;
1153 case CMD_MIFARE_EML_CARDLOAD:
1154 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156
1157 // Work with "magic Chinese" card
1158 case CMD_MIFARE_CSETBLOCK:
1159 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1160 break;
1161 case CMD_MIFARE_CGETBLOCK:
1162 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1163 break;
1164 case CMD_MIFARE_CIDENT:
1165 MifareCIdent();
1166 break;
1167
1168 // mifare sniffer
1169 case CMD_MIFARE_SNIFFER:
1170 SniffMifare(c->arg[0]);
1171 break;
1172
1173 //mifare desfire
1174 case CMD_MIFARE_DESFIRE_READBL: break;
1175 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1176 case CMD_MIFARE_DESFIRE_AUTH1:
1177 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1178 break;
1179 case CMD_MIFARE_DESFIRE_AUTH2:
1180 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1181 break;
1182 case CMD_MIFARE_DES_READER:
1183 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1184 break;
1185 case CMD_MIFARE_DESFIRE_INFO:
1186 MifareDesfireGetInformation();
1187 break;
1188 case CMD_MIFARE_DESFIRE:
1189 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1190 break;
1191
1192 case CMD_MIFARE_COLLECT_NONCES:
1193 break;
1194 #endif
1195 #ifdef WITH_EMV
1196 case CMD_EMV_TRANSACTION:
1197 EMVTransaction();
1198 break;
1199 case CMD_EMV_GET_RANDOM_NUM:
1200 //EMVgetUDOL();
1201 break;
1202 case CMD_EMV_LOAD_VALUE:
1203 EMVloadvalue(c->arg[0], c->d.asBytes);
1204 break;
1205 case CMD_EMV_DUMP_CARD:
1206 EMVdumpcard();
1207 #endif
1208 #ifdef WITH_ICLASS
1209 // Makes use of ISO14443a FPGA Firmware
1210 case CMD_SNOOP_ICLASS:
1211 SnoopIClass();
1212 break;
1213 case CMD_SIMULATE_TAG_ICLASS:
1214 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1215 break;
1216 case CMD_READER_ICLASS:
1217 ReaderIClass(c->arg[0]);
1218 break;
1219 case CMD_READER_ICLASS_REPLAY:
1220 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1221 break;
1222 case CMD_ICLASS_EML_MEMSET:
1223 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1224 break;
1225 case CMD_ICLASS_WRITEBLOCK:
1226 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1227 break;
1228 case CMD_ICLASS_READCHECK: // auth step 1
1229 iClass_ReadCheck(c->arg[0], c->arg[1]);
1230 break;
1231 case CMD_ICLASS_READBLOCK:
1232 iClass_ReadBlk(c->arg[0]);
1233 break;
1234 case CMD_ICLASS_AUTHENTICATION: //check
1235 iClass_Authentication(c->d.asBytes);
1236 break;
1237 case CMD_ICLASS_DUMP:
1238 iClass_Dump(c->arg[0], c->arg[1]);
1239 break;
1240 case CMD_ICLASS_CLONE:
1241 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1242 break;
1243 #endif
1244 #ifdef WITH_HFSNOOP
1245 case CMD_HF_SNIFFER:
1246 HfSnoop(c->arg[0], c->arg[1]);
1247 break;
1248 #endif
1249
1250 case CMD_BUFF_CLEAR:
1251 BigBuf_Clear();
1252 break;
1253
1254 case CMD_MEASURE_ANTENNA_TUNING:
1255 MeasureAntennaTuning();
1256 break;
1257
1258 case CMD_MEASURE_ANTENNA_TUNING_HF:
1259 MeasureAntennaTuningHf();
1260 break;
1261
1262 case CMD_LISTEN_READER_FIELD:
1263 ListenReaderField(c->arg[0]);
1264 break;
1265
1266 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1267 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1268 SpinDelay(200);
1269 LED_D_OFF(); // LED D indicates field ON or OFF
1270 break;
1271
1272 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1273 LED_B_ON();
1274 uint8_t *BigBuf = BigBuf_get_addr();
1275 size_t len = 0;
1276 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1277 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1278 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1279 }
1280 // Trigger a finish downloading signal with an ACK frame
1281 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1282 LED_B_OFF();
1283 break;
1284 }
1285 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1286 uint8_t *b = BigBuf_get_addr();
1287 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1288 cmd_send(CMD_ACK,0,0,0,0,0);
1289 break;
1290 }
1291 case CMD_DOWNLOAD_EML_BIGBUF: {
1292 LED_B_ON();
1293 uint8_t *cardmem = BigBuf_get_EM_addr();
1294 size_t len = 0;
1295 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1296 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1297 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1298 }
1299 // Trigger a finish downloading signal with an ACK frame
1300 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1301 LED_B_OFF();
1302 break;
1303 }
1304 case CMD_READ_MEM:
1305 ReadMem(c->arg[0]);
1306 break;
1307
1308 case CMD_SET_LF_DIVISOR:
1309 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1310 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1311 break;
1312
1313 case CMD_SET_ADC_MUX:
1314 switch(c->arg[0]) {
1315 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1316 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1317 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1318 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1319 }
1320 break;
1321
1322 case CMD_VERSION:
1323 SendVersion();
1324 break;
1325 case CMD_STATUS:
1326 SendStatus();
1327 break;
1328 case CMD_PING:
1329 cmd_send(CMD_ACK,0,0,0,0,0);
1330 break;
1331 #ifdef WITH_LCD
1332 case CMD_LCD_RESET:
1333 LCDReset();
1334 break;
1335 case CMD_LCD:
1336 LCDSend(c->arg[0]);
1337 break;
1338 #endif
1339 case CMD_SETUP_WRITE:
1340 case CMD_FINISH_WRITE:
1341 case CMD_HARDWARE_RESET:
1342 usb_disable();
1343 SpinDelay(2000);
1344 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1345 for(;;) {
1346 // We're going to reset, and the bootrom will take control.
1347 }
1348 break;
1349
1350 case CMD_START_FLASH:
1351 if(common_area.flags.bootrom_present) {
1352 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1353 }
1354 usb_disable();
1355 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1356 for(;;);
1357 break;
1358
1359 case CMD_DEVICE_INFO: {
1360 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1361 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1362 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1363 break;
1364 }
1365 default:
1366 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1367 break;
1368 }
1369 }
1370
1371 void __attribute__((noreturn)) AppMain(void)
1372 {
1373 SpinDelay(100);
1374 clear_trace();
1375 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1376 /* Initialize common area */
1377 memset(&common_area, 0, sizeof(common_area));
1378 common_area.magic = COMMON_AREA_MAGIC;
1379 common_area.version = 1;
1380 }
1381 common_area.flags.osimage_present = 1;
1382
1383 LED_D_OFF();
1384 LED_C_OFF();
1385 LED_B_OFF();
1386 LED_A_OFF();
1387
1388 // Init USB device
1389 usb_enable();
1390
1391 // The FPGA gets its clock from us from PCK0 output, so set that up.
1392 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1393 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1394 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1395 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1396 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1397 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1398 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1399
1400 // Reset SPI
1401 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1402 // Reset SSC
1403 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1404
1405 // Load the FPGA image, which we have stored in our flash.
1406 // (the HF version by default)
1407 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1408
1409 StartTickCount();
1410
1411 #ifdef WITH_LCD
1412 LCDInit();
1413 #endif
1414
1415 byte_t rx[sizeof(UsbCommand)];
1416 size_t rx_len;
1417
1418 for(;;) {
1419 if (usb_poll()) {
1420 rx_len = usb_read(rx,sizeof(UsbCommand));
1421 if (rx_len)
1422 UsbPacketReceived(rx,rx_len);
1423 }
1424 WDT_HIT();
1425
1426 #ifdef WITH_LF
1427 #ifndef WITH_ISO14443a_StandAlone
1428 if (BUTTON_HELD(1000) > 0)
1429 SamyRun();
1430 #endif
1431 #endif
1432 #ifdef WITH_ISO14443a
1433 #ifdef WITH_ISO14443a_StandAlone
1434 if (BUTTON_HELD(1000) > 0)
1435 StandAloneMode14a();
1436 #endif
1437 #endif
1438 }
1439 }
Proxmark3 GIT tracking
Impressum, Datenschutz