]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
test-pr
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include <hitagS.h>
27 #include "lfsampling.h"
28 #include "BigBuf.h"
29 #include "mifareutil.h"
30 #include "pcf7931.h"
31 #ifdef WITH_LCD
32 #include "LCD.h"
33 #endif
34
35 // Craig Young - 14a stand-alone code
36 #ifdef WITH_ISO14443a_StandAlone
37 #include "iso14443a.h"
38 #endif
39
40 //=============================================================================
41 // A buffer where we can queue things up to be sent through the FPGA, for
42 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
43 // is the order in which they go out on the wire.
44 //=============================================================================
45
46 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
47 uint8_t ToSend[TOSEND_BUFFER_SIZE];
48 int ToSendMax;
49 static int ToSendBit;
50 struct common_area common_area __attribute__((section(".commonarea")));
51
52 void ToSendReset(void)
53 {
54 ToSendMax = -1;
55 ToSendBit = 8;
56 }
57
58 void ToSendStuffBit(int b)
59 {
60 if(ToSendBit >= 8) {
61 ToSendMax++;
62 ToSend[ToSendMax] = 0;
63 ToSendBit = 0;
64 }
65
66 if(b) {
67 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
68 }
69
70 ToSendBit++;
71
72 if(ToSendMax >= sizeof(ToSend)) {
73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76 }
77
78 //=============================================================================
79 // Debug print functions, to go out over USB, to the usual PC-side client.
80 //=============================================================================
81
82 void DbpString(char *str)
83 {
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
86 }
87
88 #if 0
89 void DbpIntegers(int x1, int x2, int x3)
90 {
91 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
92 }
93 #endif
94
95 void Dbprintf(const char *fmt, ...) {
96 // should probably limit size here; oh well, let's just use a big buffer
97 char output_string[128];
98 va_list ap;
99
100 va_start(ap, fmt);
101 kvsprintf(fmt, output_string, 10, ap);
102 va_end(ap);
103
104 DbpString(output_string);
105 }
106
107 // prints HEX & ASCII
108 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
109 int l=0,i;
110 char ascii[9];
111
112 while (len>0) {
113 if (len>8) l=8;
114 else l=len;
115
116 memcpy(ascii,d,l);
117 ascii[l]=0;
118
119 // filter safe ascii
120 for (i=0;i<l;i++)
121 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
122
123 if (bAsci) {
124 Dbprintf("%-8s %*D",ascii,l,d," ");
125 } else {
126 Dbprintf("%*D",l,d," ");
127 }
128
129 len-=8;
130 d+=8;
131 }
132 }
133
134 //-----------------------------------------------------------------------------
135 // Read an ADC channel and block till it completes, then return the result
136 // in ADC units (0 to 1023). Also a routine to average 32 samples and
137 // return that.
138 //-----------------------------------------------------------------------------
139 static int ReadAdc(int ch)
140 {
141 uint32_t d;
142
143 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
144 AT91C_BASE_ADC->ADC_MR =
145 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
146 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
147 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
148
149 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
150 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
151 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
152 //
153 // The maths are:
154 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
155 //
156 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
157 //
158 // Note: with the "historic" values in the comments above, the error was 34% !!!
159
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161
162 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
163
164 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
165 ;
166 d = AT91C_BASE_ADC->ADC_CDR[ch];
167
168 return d;
169 }
170
171 int AvgAdc(int ch) // was static - merlok
172 {
173 int i;
174 int a = 0;
175
176 for(i = 0; i < 32; i++) {
177 a += ReadAdc(ch);
178 }
179
180 return (a + 15) >> 5;
181 }
182
183 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
184 {
185 int i, adcval = 0, peak = 0;
186
187 /*
188 * Sweeps the useful LF range of the proxmark from
189 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
190 * read the voltage in the antenna, the result left
191 * in the buffer is a graph which should clearly show
192 * the resonating frequency of your LF antenna
193 * ( hopefully around 95 if it is tuned to 125kHz!)
194 */
195
196 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
197 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
198 for (i=255; i>=19; i--) {
199 WDT_HIT();
200 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
201 SpinDelay(20);
202 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
203 if (i==95) *vLf125 = adcval; // voltage at 125Khz
204 if (i==89) *vLf134 = adcval; // voltage at 134Khz
205
206 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
207 if(LF_Results[i] > peak) {
208 *peakv = adcval;
209 peak = LF_Results[i];
210 *peakf = i;
211 //ptr = i;
212 }
213 }
214
215 for (i=18; i >= 0; i--) LF_Results[i] = 0;
216
217 return;
218 }
219
220 void MeasureAntennaTuningHfOnly(int *vHf)
221 {
222 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
223 LED_A_ON();
224 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
225 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
226 SpinDelay(20);
227 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
228 LED_A_OFF();
229
230 return;
231 }
232
233 void MeasureAntennaTuning(int mode)
234 {
235 uint8_t LF_Results[256] = {0};
236 int peakv = 0, peakf = 0;
237 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
238
239 LED_B_ON();
240
241 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
242 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
243 MeasureAntennaTuningHfOnly(&vHf);
244 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
245 } else {
246 if (mode & FLAG_TUNE_LF) {
247 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
248 }
249 if (mode & FLAG_TUNE_HF) {
250 MeasureAntennaTuningHfOnly(&vHf);
251 }
252 }
253
254 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
255 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
256 LED_B_OFF();
257 return;
258 }
259
260 void MeasureAntennaTuningHf(void)
261 {
262 int vHf = 0; // in mV
263
264 DbpString("Measuring HF antenna, press button to exit");
265
266 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
267 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
268 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
269
270 for (;;) {
271 SpinDelay(20);
272 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
273
274 Dbprintf("%d mV",vHf);
275 if (BUTTON_PRESS()) break;
276 }
277 DbpString("cancelled");
278
279 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
280
281 }
282
283
284 void ReadMem(int addr)
285 {
286 const uint8_t *data = ((uint8_t *)addr);
287
288 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
289 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
290 }
291
292 /* osimage version information is linked in */
293 extern struct version_information version_information;
294 /* bootrom version information is pointed to from _bootphase1_version_pointer */
295 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
296 void SendVersion(void)
297 {
298 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
299 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
300
301 /* Try to find the bootrom version information. Expect to find a pointer at
302 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
303 * pointer, then use it.
304 */
305 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
306 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
307 strcat(VersionString, "bootrom version information appears invalid\n");
308 } else {
309 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
311 }
312
313 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
314 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
315
316 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
317 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
318 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
319 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
320
321 // Send Chip ID and used flash memory
322 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
323 uint32_t compressed_data_section_size = common_area.arg1;
324 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
325 }
326
327 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
328 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
329 void printUSBSpeed(void)
330 {
331 Dbprintf("USB Speed:");
332 Dbprintf(" Sending USB packets to client...");
333
334 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
335 uint8_t *test_data = BigBuf_get_addr();
336 uint32_t end_time;
337
338 uint32_t start_time = end_time = GetTickCount();
339 uint32_t bytes_transferred = 0;
340
341 LED_B_ON();
342 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
343 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
344 end_time = GetTickCount();
345 bytes_transferred += USB_CMD_DATA_SIZE;
346 }
347 LED_B_OFF();
348
349 Dbprintf(" Time elapsed: %dms", end_time - start_time);
350 Dbprintf(" Bytes transferred: %d", bytes_transferred);
351 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
352 1000 * bytes_transferred / (end_time - start_time));
353
354 }
355
356 /**
357 * Prints runtime information about the PM3.
358 **/
359 void SendStatus(void)
360 {
361 BigBuf_print_status();
362 Fpga_print_status();
363 printConfig(); //LF Sampling config
364 printUSBSpeed();
365 Dbprintf("Various");
366 Dbprintf(" MF_DBGLEVEL......%d", MF_DBGLEVEL);
367 Dbprintf(" ToSendMax........%d",ToSendMax);
368 Dbprintf(" ToSendBit........%d",ToSendBit);
369
370 cmd_send(CMD_ACK,1,0,0,0,0);
371 }
372
373 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
374
375 #define OPTS 2
376
377 void StandAloneMode()
378 {
379 DbpString("Stand-alone mode! No PC necessary.");
380 // Oooh pretty -- notify user we're in elite samy mode now
381 LED(LED_RED, 200);
382 LED(LED_ORANGE, 200);
383 LED(LED_GREEN, 200);
384 LED(LED_ORANGE, 200);
385 LED(LED_RED, 200);
386 LED(LED_ORANGE, 200);
387 LED(LED_GREEN, 200);
388 LED(LED_ORANGE, 200);
389 LED(LED_RED, 200);
390
391 }
392
393 #endif
394
395
396
397 #ifdef WITH_ISO14443a_StandAlone
398 void StandAloneMode14a()
399 {
400 StandAloneMode();
401 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
402
403 int selected = 0;
404 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
405 int cardRead[OPTS] = {0};
406 uint8_t readUID[10] = {0};
407 uint32_t uid_1st[OPTS]={0};
408 uint32_t uid_2nd[OPTS]={0};
409 uint32_t uid_tmp1 = 0;
410 uint32_t uid_tmp2 = 0;
411 iso14a_card_select_t hi14a_card[OPTS];
412
413 LED(selected + 1, 0);
414
415 for (;;)
416 {
417 usb_poll();
418 WDT_HIT();
419 SpinDelay(300);
420
421 if (iGotoRecord == 1 || cardRead[selected] == 0)
422 {
423 iGotoRecord = 0;
424 LEDsoff();
425 LED(selected + 1, 0);
426 LED(LED_RED2, 0);
427
428 // record
429 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
430 /* need this delay to prevent catching some weird data */
431 SpinDelay(500);
432 /* Code for reading from 14a tag */
433 uint8_t uid[10] ={0};
434 uint32_t cuid;
435 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
436
437 for ( ; ; )
438 {
439 WDT_HIT();
440 if (BUTTON_PRESS()) {
441 if (cardRead[selected]) {
442 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
443 break;
444 }
445 else if (cardRead[(selected+1)%OPTS]) {
446 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
447 selected = (selected+1)%OPTS;
448 break; // playing = 1;
449 }
450 else {
451 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
452 SpinDelay(300);
453 }
454 }
455 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
456 continue;
457 else
458 {
459 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
460 memcpy(readUID,uid,10*sizeof(uint8_t));
461 uint8_t *dst = (uint8_t *)&uid_tmp1;
462 // Set UID byte order
463 for (int i=0; i<4; i++)
464 dst[i] = uid[3-i];
465 dst = (uint8_t *)&uid_tmp2;
466 for (int i=0; i<4; i++)
467 dst[i] = uid[7-i];
468 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
469 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
470 }
471 else {
472 if (uid_tmp2) {
473 Dbprintf("Bank[%d] received a 7-byte UID",selected);
474 uid_1st[selected] = (uid_tmp1)>>8;
475 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
476 }
477 else {
478 Dbprintf("Bank[%d] received a 4-byte UID",selected);
479 uid_1st[selected] = uid_tmp1;
480 uid_2nd[selected] = uid_tmp2;
481 }
482 break;
483 }
484 }
485 }
486 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
487 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
488 LEDsoff();
489 LED(LED_GREEN, 200);
490 LED(LED_ORANGE, 200);
491 LED(LED_GREEN, 200);
492 LED(LED_ORANGE, 200);
493
494 LEDsoff();
495 LED(selected + 1, 0);
496
497 // Next state is replay:
498 playing = 1;
499
500 cardRead[selected] = 1;
501 }
502 /* MF Classic UID clone */
503 else if (iGotoClone==1)
504 {
505 iGotoClone=0;
506 LEDsoff();
507 LED(selected + 1, 0);
508 LED(LED_ORANGE, 250);
509
510
511 // record
512 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
513
514 // wait for button to be released
515 while(BUTTON_PRESS())
516 {
517 // Delay cloning until card is in place
518 WDT_HIT();
519 }
520 Dbprintf("Starting clone. [Bank: %u]", selected);
521 // need this delay to prevent catching some weird data
522 SpinDelay(500);
523 // Begin clone function here:
524 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
525 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
526 memcpy(c.d.asBytes, data, 16);
527 SendCommand(&c);
528
529 Block read is similar:
530 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
531 We need to imitate that call with blockNo 0 to set a uid.
532
533 The get and set commands are handled in this file:
534 // Work with "magic Chinese" card
535 case CMD_MIFARE_CSETBLOCK:
536 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
537 break;
538 case CMD_MIFARE_CGETBLOCK:
539 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
540 break;
541
542 mfCSetUID provides example logic for UID set workflow:
543 -Read block0 from card in field with MifareCGetBlock()
544 -Configure new values without replacing reserved bytes
545 memcpy(block0, uid, 4); // Copy UID bytes from byte array
546 // Mifare UID BCC
547 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
548 Bytes 5-7 are reserved SAK and ATQA for mifare classic
549 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
550 */
551 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
552 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
553 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
554 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
555 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
556 playing = 1;
557 }
558 else {
559 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
560 memcpy(newBlock0,oldBlock0,16);
561 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
562
563 newBlock0[0] = uid_1st[selected]>>24;
564 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
565 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
566 newBlock0[3] = 0xFF & (uid_1st[selected]);
567 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
568 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
569 MifareCSetBlock(0, 0xFF,0, newBlock0);
570 MifareCGetBlock(0x3F, 1, 0, testBlock0);
571 if (memcmp(testBlock0,newBlock0,16)==0)
572 {
573 DbpString("Cloned successfull!");
574 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
575 playing = 0;
576 iGotoRecord = 1;
577 selected = (selected+1) % OPTS;
578 }
579 else {
580 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
581 playing = 1;
582 }
583 }
584 LEDsoff();
585 LED(selected + 1, 0);
586
587 }
588 // Change where to record (or begin playing)
589 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
590 {
591 LEDsoff();
592 LED(selected + 1, 0);
593
594 // Begin transmitting
595 if (playing)
596 {
597 LED(LED_GREEN, 0);
598 DbpString("Playing");
599 for ( ; ; ) {
600 WDT_HIT();
601 int button_action = BUTTON_HELD(1000);
602 if (button_action == 0) { // No button action, proceed with sim
603 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
604 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
605 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
606 DbpString("Mifare Classic");
607 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
608 }
609 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
610 DbpString("Mifare Ultralight");
611 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
612 }
613 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
614 DbpString("Mifare DESFire");
615 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
616 }
617 else {
618 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
619 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
620 }
621 }
622 else if (button_action == BUTTON_SINGLE_CLICK) {
623 selected = (selected + 1) % OPTS;
624 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
625 iGotoRecord = 1;
626 break;
627 }
628 else if (button_action == BUTTON_HOLD) {
629 Dbprintf("Playtime over. Begin cloning...");
630 iGotoClone = 1;
631 break;
632 }
633 WDT_HIT();
634 }
635
636 /* We pressed a button so ignore it here with a delay */
637 SpinDelay(300);
638 LEDsoff();
639 LED(selected + 1, 0);
640 }
641 else
642 while(BUTTON_PRESS())
643 WDT_HIT();
644 }
645 }
646 }
647 #elif WITH_LF
648 // samy's sniff and repeat routine
649 void SamyRun()
650 {
651 StandAloneMode();
652 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
653
654 int high[OPTS], low[OPTS];
655 int selected = 0;
656 int playing = 0;
657 int cardRead = 0;
658
659 // Turn on selected LED
660 LED(selected + 1, 0);
661
662 for (;;)
663 {
664 usb_poll();
665 WDT_HIT();
666
667 // Was our button held down or pressed?
668 int button_pressed = BUTTON_HELD(1000);
669 SpinDelay(300);
670
671 // Button was held for a second, begin recording
672 if (button_pressed > 0 && cardRead == 0)
673 {
674 LEDsoff();
675 LED(selected + 1, 0);
676 LED(LED_RED2, 0);
677
678 // record
679 DbpString("Starting recording");
680
681 // wait for button to be released
682 while(BUTTON_PRESS())
683 WDT_HIT();
684
685 /* need this delay to prevent catching some weird data */
686 SpinDelay(500);
687
688 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
689 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
690
691 LEDsoff();
692 LED(selected + 1, 0);
693 // Finished recording
694
695 // If we were previously playing, set playing off
696 // so next button push begins playing what we recorded
697 playing = 0;
698
699 cardRead = 1;
700
701 }
702
703 else if (button_pressed > 0 && cardRead == 1)
704 {
705 LEDsoff();
706 LED(selected + 1, 0);
707 LED(LED_ORANGE, 0);
708
709 // record
710 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
711
712 // wait for button to be released
713 while(BUTTON_PRESS())
714 WDT_HIT();
715
716 /* need this delay to prevent catching some weird data */
717 SpinDelay(500);
718
719 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
720 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
721
722 LEDsoff();
723 LED(selected + 1, 0);
724 // Finished recording
725
726 // If we were previously playing, set playing off
727 // so next button push begins playing what we recorded
728 playing = 0;
729
730 cardRead = 0;
731
732 }
733
734 // Change where to record (or begin playing)
735 else if (button_pressed)
736 {
737 // Next option if we were previously playing
738 if (playing)
739 selected = (selected + 1) % OPTS;
740 playing = !playing;
741
742 LEDsoff();
743 LED(selected + 1, 0);
744
745 // Begin transmitting
746 if (playing)
747 {
748 LED(LED_GREEN, 0);
749 DbpString("Playing");
750 // wait for button to be released
751 while(BUTTON_PRESS())
752 WDT_HIT();
753 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
754 CmdHIDsimTAG(high[selected], low[selected], 0);
755 DbpString("Done playing");
756 if (BUTTON_HELD(1000) > 0)
757 {
758 DbpString("Exiting");
759 LEDsoff();
760 return;
761 }
762
763 /* We pressed a button so ignore it here with a delay */
764 SpinDelay(300);
765
766 // when done, we're done playing, move to next option
767 selected = (selected + 1) % OPTS;
768 playing = !playing;
769 LEDsoff();
770 LED(selected + 1, 0);
771 }
772 else
773 while(BUTTON_PRESS())
774 WDT_HIT();
775 }
776 }
777 }
778
779 #endif
780 /*
781 OBJECTIVE
782 Listen and detect an external reader. Determine the best location
783 for the antenna.
784
785 INSTRUCTIONS:
786 Inside the ListenReaderField() function, there is two mode.
787 By default, when you call the function, you will enter mode 1.
788 If you press the PM3 button one time, you will enter mode 2.
789 If you press the PM3 button a second time, you will exit the function.
790
791 DESCRIPTION OF MODE 1:
792 This mode just listens for an external reader field and lights up green
793 for HF and/or red for LF. This is the original mode of the detectreader
794 function.
795
796 DESCRIPTION OF MODE 2:
797 This mode will visually represent, using the LEDs, the actual strength of the
798 current compared to the maximum current detected. Basically, once you know
799 what kind of external reader is present, it will help you spot the best location to place
800 your antenna. You will probably not get some good results if there is a LF and a HF reader
801 at the same place! :-)
802
803 LIGHT SCHEME USED:
804 */
805 static const char LIGHT_SCHEME[] = {
806 0x0, /* ---- | No field detected */
807 0x1, /* X--- | 14% of maximum current detected */
808 0x2, /* -X-- | 29% of maximum current detected */
809 0x4, /* --X- | 43% of maximum current detected */
810 0x8, /* ---X | 57% of maximum current detected */
811 0xC, /* --XX | 71% of maximum current detected */
812 0xE, /* -XXX | 86% of maximum current detected */
813 0xF, /* XXXX | 100% of maximum current detected */
814 };
815 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
816
817 void ListenReaderField(int limit)
818 {
819 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
820 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
821 int mode=1, display_val, display_max, i;
822
823 #define LF_ONLY 1
824 #define HF_ONLY 2
825 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
826
827
828 // switch off FPGA - we don't want to measure our own signal
829 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
830 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
831
832 LEDsoff();
833
834 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
835
836 if(limit != HF_ONLY) {
837 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
838 lf_baseline = lf_av;
839 }
840
841 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
842
843 if (limit != LF_ONLY) {
844 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
845 hf_baseline = hf_av;
846 }
847
848 for(;;) {
849 if (BUTTON_PRESS()) {
850 SpinDelay(500);
851 switch (mode) {
852 case 1:
853 mode=2;
854 DbpString("Signal Strength Mode");
855 break;
856 case 2:
857 default:
858 DbpString("Stopped");
859 LEDsoff();
860 return;
861 break;
862 }
863 }
864 WDT_HIT();
865
866 if (limit != HF_ONLY) {
867 if(mode == 1) {
868 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
869 LED_D_ON();
870 else
871 LED_D_OFF();
872 }
873
874 lf_av_new = AvgAdc(ADC_CHAN_LF);
875 // see if there's a significant change
876 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
877 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
878 lf_av = lf_av_new;
879 if (lf_av > lf_max)
880 lf_max = lf_av;
881 }
882 }
883
884 if (limit != LF_ONLY) {
885 if (mode == 1){
886 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
887 LED_B_ON();
888 else
889 LED_B_OFF();
890 }
891
892 hf_av_new = AvgAdc(ADC_CHAN_HF);
893 // see if there's a significant change
894 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
895 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
896 hf_av = hf_av_new;
897 if (hf_av > hf_max)
898 hf_max = hf_av;
899 }
900 }
901
902 if(mode == 2) {
903 if (limit == LF_ONLY) {
904 display_val = lf_av;
905 display_max = lf_max;
906 } else if (limit == HF_ONLY) {
907 display_val = hf_av;
908 display_max = hf_max;
909 } else { /* Pick one at random */
910 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
911 display_val = hf_av;
912 display_max = hf_max;
913 } else {
914 display_val = lf_av;
915 display_max = lf_max;
916 }
917 }
918 for (i=0; i<LIGHT_LEN; i++) {
919 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
920 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
921 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
922 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
923 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
924 break;
925 }
926 }
927 }
928 }
929 }
930
931 void UsbPacketReceived(uint8_t *packet, int len)
932 {
933 UsbCommand *c = (UsbCommand *)packet;
934
935 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
936
937 switch(c->cmd) {
938 #ifdef WITH_LF
939 case CMD_SET_LF_SAMPLING_CONFIG:
940 setSamplingConfig((sample_config *) c->d.asBytes);
941 break;
942 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
943 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
944 break;
945 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
946 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
947 break;
948 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
949 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
950 break;
951 case CMD_HID_DEMOD_FSK:
952 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
953 break;
954 case CMD_HID_SIM_TAG:
955 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
956 break;
957 case CMD_FSK_SIM_TAG:
958 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
959 break;
960 case CMD_ASK_SIM_TAG:
961 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
962 break;
963 case CMD_PSK_SIM_TAG:
964 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
965 break;
966 case CMD_HID_CLONE_TAG:
967 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
968 break;
969 case CMD_IO_DEMOD_FSK:
970 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
971 break;
972 case CMD_IO_CLONE_TAG:
973 CopyIOtoT55x7(c->arg[0], c->arg[1]);
974 break;
975 case CMD_EM410X_DEMOD:
976 CmdEM410xdemod(c->arg[0], 0, 0, 1);
977 break;
978 case CMD_EM410X_WRITE_TAG:
979 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
980 break;
981 case CMD_READ_TI_TYPE:
982 ReadTItag();
983 break;
984 case CMD_WRITE_TI_TYPE:
985 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
986 break;
987 case CMD_SIMULATE_TAG_125K:
988 LED_A_ON();
989 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
990 LED_A_OFF();
991 break;
992 case CMD_LF_SIMULATE_BIDIR:
993 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
994 break;
995 case CMD_INDALA_CLONE_TAG:
996 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
997 break;
998 case CMD_INDALA_CLONE_TAG_L:
999 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1000 break;
1001 case CMD_T55XX_READ_BLOCK:
1002 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1003 break;
1004 case CMD_T55XX_WRITE_BLOCK:
1005 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1006 break;
1007 case CMD_T55XX_WAKEUP:
1008 T55xxWakeUp(c->arg[0]);
1009 break;
1010 case CMD_T55XX_RESET_READ:
1011 T55xxResetRead();
1012 break;
1013 case CMD_PCF7931_READ:
1014 ReadPCF7931();
1015 break;
1016 case CMD_PCF7931_WRITE:
1017 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1018 break;
1019 case CMD_EM4X_READ_WORD:
1020 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
1021 break;
1022 case CMD_EM4X_WRITE_WORD:
1023 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1024 break;
1025 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1026 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1027 break;
1028 case CMD_VIKING_CLONE_TAG:
1029 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1030 break;
1031 #endif
1032
1033 #ifdef WITH_HITAG
1034 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1035 SnoopHitag(c->arg[0]);
1036 break;
1037 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1038 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1039 break;
1040 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1041 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1042 break;
1043 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1044 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1045 break;
1046 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1047 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1048 break;
1049 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1050 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1051 break;
1052 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1053 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1054 break;
1055 #endif
1056
1057 #ifdef WITH_ISO15693
1058 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1059 AcquireRawAdcSamplesIso15693();
1060 break;
1061 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1062 RecordRawAdcSamplesIso15693();
1063 break;
1064
1065 case CMD_ISO_15693_COMMAND:
1066 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1067 break;
1068
1069 case CMD_ISO_15693_FIND_AFI:
1070 BruteforceIso15693Afi(c->arg[0]);
1071 break;
1072
1073 case CMD_ISO_15693_DEBUG:
1074 SetDebugIso15693(c->arg[0]);
1075 break;
1076
1077 case CMD_READER_ISO_15693:
1078 ReaderIso15693(c->arg[0]);
1079 break;
1080 case CMD_SIMTAG_ISO_15693:
1081 SimTagIso15693(c->arg[0], c->d.asBytes);
1082 break;
1083 #endif
1084
1085 #ifdef WITH_LEGICRF
1086 case CMD_SIMULATE_TAG_LEGIC_RF:
1087 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1088 break;
1089
1090 case CMD_WRITER_LEGIC_RF:
1091 LegicRfWriter(c->arg[1], c->arg[0]);
1092 break;
1093
1094 case CMD_READER_LEGIC_RF:
1095 LegicRfReader(c->arg[0], c->arg[1]);
1096 break;
1097 #endif
1098
1099 #ifdef WITH_ISO14443b
1100 case CMD_READ_SRI512_TAG:
1101 ReadSTMemoryIso14443b(0x0F);
1102 break;
1103 case CMD_READ_SRIX4K_TAG:
1104 ReadSTMemoryIso14443b(0x7F);
1105 break;
1106 case CMD_SNOOP_ISO_14443B:
1107 SnoopIso14443b();
1108 break;
1109 case CMD_SIMULATE_TAG_ISO_14443B:
1110 SimulateIso14443bTag();
1111 break;
1112 case CMD_ISO_14443B_COMMAND:
1113 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1114 break;
1115 #endif
1116
1117 #ifdef WITH_ISO14443a
1118 case CMD_SNOOP_ISO_14443a:
1119 SnoopIso14443a(c->arg[0]);
1120 break;
1121 case CMD_READER_ISO_14443a:
1122 ReaderIso14443a(c);
1123 break;
1124 case CMD_SIMULATE_TAG_ISO_14443a:
1125 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1126 break;
1127
1128 case CMD_EPA_PACE_COLLECT_NONCE:
1129 EPA_PACE_Collect_Nonce(c);
1130 break;
1131 case CMD_EPA_PACE_REPLAY:
1132 EPA_PACE_Replay(c);
1133 break;
1134
1135 case CMD_READER_MIFARE:
1136 ReaderMifare(c->arg[0]);
1137 break;
1138 case CMD_MIFARE_READBL:
1139 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1140 break;
1141 case CMD_MIFAREU_READBL:
1142 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1143 break;
1144 case CMD_MIFAREUC_AUTH:
1145 MifareUC_Auth(c->arg[0],c->d.asBytes);
1146 break;
1147 case CMD_MIFAREU_READCARD:
1148 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1149 break;
1150 case CMD_MIFAREUC_SETPWD:
1151 MifareUSetPwd(c->arg[0], c->d.asBytes);
1152 break;
1153 case CMD_MIFARE_READSC:
1154 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_WRITEBL:
1157 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1158 break;
1159 //case CMD_MIFAREU_WRITEBL_COMPAT:
1160 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1161 //break;
1162 case CMD_MIFAREU_WRITEBL:
1163 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1164 break;
1165 case CMD_MIFARE_NESTED:
1166 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1167 break;
1168 case CMD_MIFARE_CHKKEYS:
1169 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1170 break;
1171 case CMD_SIMULATE_MIFARE_CARD:
1172 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1173 break;
1174
1175 // emulator
1176 case CMD_MIFARE_SET_DBGMODE:
1177 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1178 break;
1179 case CMD_MIFARE_EML_MEMCLR:
1180 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1181 break;
1182 case CMD_MIFARE_EML_MEMSET:
1183 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1184 break;
1185 case CMD_MIFARE_EML_MEMGET:
1186 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1187 break;
1188 case CMD_MIFARE_EML_CARDLOAD:
1189 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1190 break;
1191
1192 // Work with "magic Chinese" card
1193 case CMD_MIFARE_CSETBLOCK:
1194 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1195 break;
1196 case CMD_MIFARE_CGETBLOCK:
1197 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1198 break;
1199 case CMD_MIFARE_CIDENT:
1200 MifareCIdent();
1201 break;
1202
1203 // mifare sniffer
1204 case CMD_MIFARE_SNIFFER:
1205 SniffMifare(c->arg[0]);
1206 break;
1207
1208 #endif
1209
1210 #ifdef WITH_ICLASS
1211 // Makes use of ISO14443a FPGA Firmware
1212 case CMD_SNOOP_ICLASS:
1213 SnoopIClass();
1214 break;
1215 case CMD_SIMULATE_TAG_ICLASS:
1216 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1217 break;
1218 case CMD_READER_ICLASS:
1219 ReaderIClass(c->arg[0]);
1220 break;
1221 case CMD_READER_ICLASS_REPLAY:
1222 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1223 break;
1224 case CMD_ICLASS_EML_MEMSET:
1225 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1226 break;
1227 case CMD_ICLASS_WRITEBLOCK:
1228 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1229 break;
1230 case CMD_ICLASS_READCHECK: // auth step 1
1231 iClass_ReadCheck(c->arg[0], c->arg[1]);
1232 break;
1233 case CMD_ICLASS_READBLOCK:
1234 iClass_ReadBlk(c->arg[0]);
1235 break;
1236 case CMD_ICLASS_AUTHENTICATION: //check
1237 iClass_Authentication(c->d.asBytes);
1238 break;
1239 case CMD_ICLASS_DUMP:
1240 iClass_Dump(c->arg[0], c->arg[1]);
1241 break;
1242 case CMD_ICLASS_CLONE:
1243 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1244 break;
1245 #endif
1246 #ifdef WITH_HFSNOOP
1247 case CMD_HF_SNIFFER:
1248 HfSnoop(c->arg[0], c->arg[1]);
1249 break;
1250 #endif
1251
1252 case CMD_BUFF_CLEAR:
1253 BigBuf_Clear();
1254 break;
1255
1256 case CMD_MEASURE_ANTENNA_TUNING:
1257 MeasureAntennaTuning(c->arg[0]);
1258 break;
1259
1260 case CMD_MEASURE_ANTENNA_TUNING_HF:
1261 MeasureAntennaTuningHf();
1262 break;
1263
1264 case CMD_LISTEN_READER_FIELD:
1265 ListenReaderField(c->arg[0]);
1266 break;
1267
1268 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1269 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1270 SpinDelay(200);
1271 LED_D_OFF(); // LED D indicates field ON or OFF
1272 break;
1273
1274 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1275
1276 LED_B_ON();
1277 uint8_t *BigBuf = BigBuf_get_addr();
1278 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1279 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1280 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1281 }
1282 // Trigger a finish downloading signal with an ACK frame
1283 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1284 LED_B_OFF();
1285 break;
1286
1287 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1288 uint8_t *b = BigBuf_get_addr();
1289 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1290 cmd_send(CMD_ACK,0,0,0,0,0);
1291 break;
1292 }
1293 case CMD_READ_MEM:
1294 ReadMem(c->arg[0]);
1295 break;
1296
1297 case CMD_SET_LF_DIVISOR:
1298 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1299 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1300 break;
1301
1302 case CMD_SET_ADC_MUX:
1303 switch(c->arg[0]) {
1304 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1305 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1306 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1307 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1308 }
1309 break;
1310
1311 case CMD_VERSION:
1312 SendVersion();
1313 break;
1314 case CMD_STATUS:
1315 SendStatus();
1316 break;
1317 case CMD_PING:
1318 cmd_send(CMD_ACK,0,0,0,0,0);
1319 break;
1320 #ifdef WITH_LCD
1321 case CMD_LCD_RESET:
1322 LCDReset();
1323 break;
1324 case CMD_LCD:
1325 LCDSend(c->arg[0]);
1326 break;
1327 #endif
1328 case CMD_SETUP_WRITE:
1329 case CMD_FINISH_WRITE:
1330 case CMD_HARDWARE_RESET:
1331 usb_disable();
1332 SpinDelay(1000);
1333 SpinDelay(1000);
1334 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1335 for(;;) {
1336 // We're going to reset, and the bootrom will take control.
1337 }
1338 break;
1339
1340 case CMD_START_FLASH:
1341 if(common_area.flags.bootrom_present) {
1342 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1343 }
1344 usb_disable();
1345 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1346 for(;;);
1347 break;
1348
1349 case CMD_DEVICE_INFO: {
1350 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1351 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1352 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1353 break;
1354 }
1355 default:
1356 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1357 break;
1358 }
1359 }
1360
1361 void __attribute__((noreturn)) AppMain(void)
1362 {
1363 SpinDelay(100);
1364 clear_trace();
1365 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1366 /* Initialize common area */
1367 memset(&common_area, 0, sizeof(common_area));
1368 common_area.magic = COMMON_AREA_MAGIC;
1369 common_area.version = 1;
1370 }
1371 common_area.flags.osimage_present = 1;
1372
1373 LED_D_OFF();
1374 LED_C_OFF();
1375 LED_B_OFF();
1376 LED_A_OFF();
1377
1378 // Init USB device
1379 usb_enable();
1380
1381 // The FPGA gets its clock from us from PCK0 output, so set that up.
1382 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1383 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1384 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1385 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1386 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1387 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1388 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1389
1390 // Reset SPI
1391 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1392 // Reset SSC
1393 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1394
1395 // Load the FPGA image, which we have stored in our flash.
1396 // (the HF version by default)
1397 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1398
1399 StartTickCount();
1400
1401 #ifdef WITH_LCD
1402 LCDInit();
1403 #endif
1404
1405 byte_t rx[sizeof(UsbCommand)];
1406 size_t rx_len;
1407
1408 for(;;) {
1409 if (usb_poll()) {
1410 rx_len = usb_read(rx,sizeof(UsbCommand));
1411 if (rx_len) {
1412 UsbPacketReceived(rx,rx_len);
1413 }
1414 }
1415 WDT_HIT();
1416
1417 #ifdef WITH_LF
1418 #ifndef WITH_ISO14443a_StandAlone
1419 if (BUTTON_HELD(1000) > 0)
1420 SamyRun();
1421 #endif
1422 #endif
1423 #ifdef WITH_ISO14443a
1424 #ifdef WITH_ISO14443a_StandAlone
1425 if (BUTTON_HELD(1000) > 0)
1426 StandAloneMode14a();
1427 #endif
1428 #endif
1429 }
1430 }
Proxmark3 GIT tracking
Impressum, Datenschutz