1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Sept 2005
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Utility functions used in many places, not specific to any piece of code.
9 //-----------------------------------------------------------------------------
11 #include "proxmark3.h"
20 void print_result(char *name
, uint8_t *buf
, size_t len
) {
23 if ( len
% 16 == 0 ) {
24 for(; p
-buf
< len
; p
+= 16)
25 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
29 p
[0], p
[1], p
[2], p
[3], p
[4], p
[5], p
[6], p
[7],p
[8], p
[9], p
[10], p
[11], p
[12], p
[13], p
[14], p
[15]
33 for(; p
-buf
< len
; p
+= 8)
34 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x", name
, p
-buf
, len
, p
[0], p
[1], p
[2], p
[3], p
[4], p
[5], p
[6], p
[7]);
38 size_t nbytes(size_t nbits
) {
39 return (nbits
/8)+((nbits
%8)>0);
42 uint32_t SwapBits(uint32_t value
, int nrbits
) {
44 uint32_t newvalue
= 0;
45 for(i
= 0; i
< nrbits
; i
++) {
46 newvalue
^= ((value
>> i
) & 1) << (nrbits
- 1 - i
);
51 void num_to_bytes(uint64_t n
, size_t len
, uint8_t* dest
)
54 dest
[len
] = (uint8_t) n
;
59 uint64_t bytes_to_num(uint8_t* src
, size_t len
)
64 num
= (num
<< 8) | (*src
);
70 // RotateLeft - Ultralight, Desfire
71 void rol(uint8_t *data
, const size_t len
){
72 uint8_t first
= data
[0];
73 for (size_t i
= 0; i
< len
-1; i
++) {
78 void lsl (uint8_t *data
, size_t len
) {
79 for (size_t n
= 0; n
< len
- 1; n
++) {
80 data
[n
] = (data
[n
] << 1) | (data
[n
+1] >> 7);
85 int32_t le24toh (uint8_t data
[3])
87 return (data
[2] << 16) | (data
[1] << 8) | data
[0];
98 // LEDs: R(C) O(A) G(B) -- R(D) [1, 2, 4 and 8]
99 void LED(int led
, int ms
)
103 if (led
& LED_ORANGE
)
117 if (led
& LED_ORANGE
)
126 // Determine if a button is double clicked, single clicked,
127 // not clicked, or held down (for ms || 1sec)
128 // In general, don't use this function unless you expect a
129 // double click, otherwise it will waste 500ms -- use BUTTON_HELD instead
130 int BUTTON_CLICKED(int ms
)
132 // Up to 500ms in between clicks to mean a double click
133 int ticks
= (48000 * (ms
? ms
: 1000)) >> 10;
135 // If we're not even pressed, forget about it!
137 return BUTTON_NO_CLICK
;
139 // Borrow a PWM unit for my real-time clock
140 AT91C_BASE_PWMC
->PWMC_ENA
= PWM_CHANNEL(0);
141 // 48 MHz / 1024 gives 46.875 kHz
142 AT91C_BASE_PWMC_CH0
->PWMC_CMR
= PWM_CH_MODE_PRESCALER(10);
143 AT91C_BASE_PWMC_CH0
->PWMC_CDTYR
= 0;
144 AT91C_BASE_PWMC_CH0
->PWMC_CPRDR
= 0xffff;
146 uint16_t start
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
151 uint16_t now
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
153 // We haven't let off the button yet
156 // We just let it off!
161 // reset our timer for 500ms
162 start
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
163 ticks
= (48000 * (500)) >> 10;
166 // Still haven't let it off
168 // Have we held down a full second?
169 if (now
== (uint16_t)(start
+ ticks
))
173 // We already let off, did we click again?
175 // Sweet, double click!
177 return BUTTON_DOUBLE_CLICK
;
179 // Have we ran out of time to double click?
181 if (now
== (uint16_t)(start
+ ticks
))
182 // At least we did a single click
183 return BUTTON_SINGLE_CLICK
;
188 // We should never get here
192 // Determine if a button is held down
193 int BUTTON_HELD(int ms
)
195 // If button is held for one second
196 int ticks
= (48000 * (ms
? ms
: 1000)) >> 10;
198 // If we're not even pressed, forget about it!
200 return BUTTON_NO_CLICK
;
202 // Borrow a PWM unit for my real-time clock
203 AT91C_BASE_PWMC
->PWMC_ENA
= PWM_CHANNEL(0);
204 // 48 MHz / 1024 gives 46.875 kHz
205 AT91C_BASE_PWMC_CH0
->PWMC_CMR
= PWM_CH_MODE_PRESCALER(10);
206 AT91C_BASE_PWMC_CH0
->PWMC_CDTYR
= 0;
207 AT91C_BASE_PWMC_CH0
->PWMC_CPRDR
= 0xffff;
209 uint16_t start
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
213 uint16_t now
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
215 // As soon as our button let go, we didn't hold long enough
217 return BUTTON_SINGLE_CLICK
;
219 // Have we waited the full second?
221 if (now
== (uint16_t)(start
+ ticks
))
227 // We should never get here
231 // attempt at high resolution microsecond timer
232 // beware: timer counts in 21.3uS increments (1024/48Mhz)
233 void SpinDelayUs(int us
)
235 int ticks
= (48*us
) >> 10;
237 // Borrow a PWM unit for my real-time clock
238 AT91C_BASE_PWMC
->PWMC_ENA
= PWM_CHANNEL(0);
239 // 48 MHz / 1024 gives 46.875 kHz
240 AT91C_BASE_PWMC_CH0
->PWMC_CMR
= PWM_CH_MODE_PRESCALER(10);
241 AT91C_BASE_PWMC_CH0
->PWMC_CDTYR
= 0;
242 AT91C_BASE_PWMC_CH0
->PWMC_CPRDR
= 0xffff;
244 uint16_t start
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
247 uint16_t now
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
248 if (now
== (uint16_t)(start
+ ticks
))
255 void SpinDelay(int ms
)
257 // convert to uS and call microsecond delay function
258 SpinDelayUs(ms
*1000);
261 /* Similar to FpgaGatherVersion this formats stored version information
262 * into a string representation. It takes a pointer to the struct version_information,
263 * verifies the magic properties, then stores a formatted string, prefixed by
266 void FormatVersionInformation(char *dst
, int len
, const char *prefix
, void *version_information
)
268 struct version_information
*v
= (struct version_information
*)version_information
;
270 strncat(dst
, prefix
, len
-1);
271 if(v
->magic
!= VERSION_INFORMATION_MAGIC
) {
272 strncat(dst
, "Missing/Invalid version information", len
- strlen(dst
) - 1);
275 if(v
->versionversion
!= 1) {
276 strncat(dst
, "Version information not understood", len
- strlen(dst
) - 1);
280 strncat(dst
, "Version information not available", len
- strlen(dst
) - 1);
284 strncat(dst
, v
->gitversion
, len
- strlen(dst
) - 1);
286 strncat(dst
, "-unclean", len
- strlen(dst
) - 1);
287 } else if(v
->clean
== 2) {
288 strncat(dst
, "-suspect", len
- strlen(dst
) - 1);
291 strncat(dst
, " ", len
- strlen(dst
) - 1);
292 strncat(dst
, v
->buildtime
, len
- strlen(dst
) - 1);
295 // -------------------------------------------------------------------------
297 // -------------------------------------------------------------------------
300 // ti = GetTickCount();
302 // ti = GetTickCount() - ti;
303 // Dbprintf("timer(1s): %d t=%d", ti, GetTickCount());
305 void StartTickCount()
307 // must be 0x40, but on my cpu - included divider is optimal
311 AT91C_BASE_RTTC
->RTTC_RTMR
= AT91C_RTTC_RTTRST
+ 0x001D; // was 0x003B
315 * Get the current count.
317 uint32_t RAMFUNC
GetTickCount(){
318 return AT91C_BASE_RTTC
->RTTC_RTVR
;// was * 2;
321 // -------------------------------------------------------------------------
322 // microseconds timer
323 // -------------------------------------------------------------------------
326 AT91C_BASE_PMC
->PMC_PCER
|= (0x1 << 12) | (0x1 << 13) | (0x1 << 14);
327 // AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC1XC1S_TIOA0;
328 AT91C_BASE_TCB
->TCB_BMR
= AT91C_TCB_TC0XC0S_NONE
| AT91C_TCB_TC1XC1S_TIOA0
| AT91C_TCB_TC2XC2S_NONE
;
331 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
; // timer disable
332 AT91C_BASE_TC0
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV3_CLOCK
| // MCK(48MHz)/32 -- tick=1.5mks
333 AT91C_TC_WAVE
| AT91C_TC_WAVESEL_UP_AUTO
| AT91C_TC_ACPA_CLEAR
|
334 AT91C_TC_ACPC_SET
| AT91C_TC_ASWTRG_SET
;
335 AT91C_BASE_TC0
->TC_RA
= 1;
336 AT91C_BASE_TC0
->TC_RC
= 0xBFFF + 1; // 0xC000
338 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
; // timer disable
339 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_XC1
; // from timer 0
341 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
;
342 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
;
343 AT91C_BASE_TCB
->TCB_BCR
= 1;
346 uint32_t RAMFUNC
GetCountUS(){
347 return (AT91C_BASE_TC1
->TC_CV
* 0x8000) + ((AT91C_BASE_TC0
->TC_CV
/ 15) * 10);
350 static uint32_t GlobalUsCounter
= 0;
352 uint32_t RAMFUNC
GetDeltaCountUS(){
353 uint32_t g_cnt
= GetCountUS();
354 uint32_t g_res
= g_cnt
- GlobalUsCounter
;
355 GlobalUsCounter
= g_cnt
;
360 // -------------------------------------------------------------------------
361 // Timer for iso14443 commands. Uses ssp_clk from FPGA
362 // -------------------------------------------------------------------------
363 void StartCountSspClk()
365 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC0
) | (1 << AT91C_ID_TC1
) | (1 << AT91C_ID_TC2
); // Enable Clock to all timers
366 AT91C_BASE_TCB
->TCB_BMR
= AT91C_TCB_TC0XC0S_TIOA1
// XC0 Clock = TIOA1
367 | AT91C_TCB_TC1XC1S_NONE
// XC1 Clock = none
368 | AT91C_TCB_TC2XC2S_TIOA0
; // XC2 Clock = TIOA0
370 // configure TC1 to create a short pulse on TIOA1 when a rising edge on TIOB1 (= ssp_clk from FPGA) occurs:
371 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
; // disable TC1
372 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV1_CLOCK
// TC1 Clock = MCK(48MHz)/2 = 24MHz
373 | AT91C_TC_CPCSTOP
// Stop clock on RC compare
374 | AT91C_TC_EEVTEDG_RISING
// Trigger on rising edge of Event
375 | AT91C_TC_EEVT_TIOB
// Event-Source: TIOB1 (= ssp_clk from FPGA = 13,56MHz/16)
376 | AT91C_TC_ENETRG
// Enable external trigger event
377 | AT91C_TC_WAVESEL_UP
// Upmode without automatic trigger on RC compare
378 | AT91C_TC_WAVE
// Waveform Mode
379 | AT91C_TC_AEEVT_SET
// Set TIOA1 on external event
380 | AT91C_TC_ACPC_CLEAR
; // Clear TIOA1 on RC Compare
381 AT91C_BASE_TC1
->TC_RC
= 0x04; // RC Compare value = 0x04
383 // use TC0 to count TIOA1 pulses
384 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
; // disable TC0
385 AT91C_BASE_TC0
->TC_CMR
= AT91C_TC_CLKS_XC0
// TC0 clock = XC0 clock = TIOA1
386 | AT91C_TC_WAVE
// Waveform Mode
387 | AT91C_TC_WAVESEL_UP
// just count
388 | AT91C_TC_ACPA_CLEAR
// Clear TIOA0 on RA Compare
389 | AT91C_TC_ACPC_SET
; // Set TIOA0 on RC Compare
390 AT91C_BASE_TC0
->TC_RA
= 1; // RA Compare value = 1; pulse width to TC2
391 AT91C_BASE_TC0
->TC_RC
= 0; // RC Compare value = 0; increment TC2 on overflow
393 // use TC2 to count TIOA0 pulses (giving us a 32bit counter (TC0/TC2) clocked by ssp_clk)
394 AT91C_BASE_TC2
->TC_CCR
= AT91C_TC_CLKDIS
; // disable TC2
395 AT91C_BASE_TC2
->TC_CMR
= AT91C_TC_CLKS_XC2
// TC2 clock = XC2 clock = TIOA0
396 | AT91C_TC_WAVE
// Waveform Mode
397 | AT91C_TC_WAVESEL_UP
; // just count
399 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
; // enable TC0
400 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
; // enable TC1
401 AT91C_BASE_TC2
->TC_CCR
= AT91C_TC_CLKEN
; // enable TC2
404 // synchronize the counter with the ssp_frame signal. Note: FPGA must be in any iso14446 mode, otherwise the frame signal would not be present
406 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_FRAME
)); // wait for ssp_frame to go high (start of frame)
407 while(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_FRAME
); // wait for ssp_frame to be low
408 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
)); // wait for ssp_clk to go high
409 // note: up to now two ssp_clk rising edges have passed since the rising edge of ssp_frame
410 // it is now safe to assert a sync signal. This sets all timers to 0 on next active clock edge
411 AT91C_BASE_TCB
->TCB_BCR
= 1; // assert Sync (set all timers to 0 on next active clock edge)
412 // at the next (3rd) ssp_clk rising edge, TC1 will be reset (and not generate a clock signal to TC0)
413 // at the next (4th) ssp_clk rising edge, TC0 (the low word of our counter) will be reset. From now on,
414 // whenever the last three bits of our counter go 0, we can be sure to be in the middle of a frame transfer.
415 // (just started with the transfer of the 4th Bit).
416 // The high word of the counter (TC2) will not reset until the low word (TC0) overflows. Therefore need to wait quite some time before
417 // we can use the counter.
418 while (AT91C_BASE_TC0
->TC_CV
< 0xFFF0);
422 uint32_t RAMFUNC
GetCountSspClk(){
424 tmp_count
= (AT91C_BASE_TC2
->TC_CV
<< 16) | AT91C_BASE_TC0
->TC_CV
;
425 if ((tmp_count
& 0x0000ffff) == 0) { //small chance that we may have missed an increment in TC2
426 return (AT91C_BASE_TC2
->TC_CV
<< 16);
432 void iso14a_clear_trace() {
436 void iso14a_set_tracing(bool enable
) {
441 uint8_t *trace
= BigBuf_get_addr();
442 uint16_t max_traceLen
= BigBuf_max_traceLen();
443 memset(trace
, 0x44, max_traceLen
);
447 void set_tracing(bool enable
) {
452 This is a function to store traces. All protocols can use this generic tracer-function.
453 The traces produced by calling this function can be fetched on the client-side
454 by 'hf list raw', alternatively 'hf list <proto>' for protocol-specific
455 annotation of commands/responses.
458 bool RAMFUNC
LogTrace(const uint8_t *btBytes
, uint16_t iLen
, uint32_t timestamp_start
, uint32_t timestamp_end
, uint8_t *parity
, bool readerToTag
)
460 if (!tracing
) return FALSE
;
462 uint8_t *trace
= BigBuf_get_addr();
464 uint16_t num_paritybytes
= (iLen
-1)/8 + 1; // number of valid paritybytes in *parity
465 uint16_t duration
= timestamp_end
- timestamp_start
;
467 // Return when trace is full
468 uint16_t max_traceLen
= BigBuf_max_traceLen();
470 if (traceLen
+ sizeof(iLen
) + sizeof(timestamp_start
) + sizeof(duration
) + num_paritybytes
+ iLen
>= max_traceLen
) {
471 tracing
= FALSE
; // don't trace any more
475 // 32 bits timestamp (little endian)
476 // 16 bits duration (little endian)
477 // 16 bits data length (little endian, Highest Bit used as readerToTag flag)
479 // x Bytes parity (one byte per 8 bytes data)
482 trace
[traceLen
++] = ((timestamp_start
>> 0) & 0xff);
483 trace
[traceLen
++] = ((timestamp_start
>> 8) & 0xff);
484 trace
[traceLen
++] = ((timestamp_start
>> 16) & 0xff);
485 trace
[traceLen
++] = ((timestamp_start
>> 24) & 0xff);
488 trace
[traceLen
++] = ((duration
>> 0) & 0xff);
489 trace
[traceLen
++] = ((duration
>> 8) & 0xff);
492 trace
[traceLen
++] = ((iLen
>> 0) & 0xff);
493 trace
[traceLen
++] = ((iLen
>> 8) & 0xff);
497 trace
[traceLen
- 1] |= 0x80;
501 if (btBytes
!= NULL
&& iLen
!= 0) {
502 memcpy(trace
+ traceLen
, btBytes
, iLen
);
507 if (parity
!= NULL
&& iLen
!= 0) {
508 memcpy(trace
+ traceLen
, parity
, num_paritybytes
);
510 traceLen
+= num_paritybytes
;
512 if(traceLen
+4 < max_traceLen
)
513 { //If it hadn't been cleared, for whatever reason..
514 memset(trace
+traceLen
,0x44, 4);