]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
CHG: Added @icsom 's changes to his legic.lua script.
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #include "mifareutil.h"
29 #include "pcf7931.h"
30 #ifdef WITH_LCD
31 #include "LCD.h"
32 #endif
33
34 // Craig Young - 14a stand-alone code
35 #ifdef WITH_ISO14443a_StandAlone
36 #include "iso14443a.h"
37 #include "protocols.h"
38 #endif
39
40 #define abs(x) ( ((x)<0) ? -(x) : (x) )
41
42 //=============================================================================
43 // A buffer where we can queue things up to be sent through the FPGA, for
44 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
45 // is the order in which they go out on the wire.
46 //=============================================================================
47
48 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
49 uint8_t ToSend[TOSEND_BUFFER_SIZE];
50 int ToSendMax = 0;
51 static int ToSendBit;
52 struct common_area common_area __attribute__((section(".commonarea")));
53
54 void ToSendReset(void)
55 {
56 ToSendMax = -1;
57 ToSendBit = 8;
58 }
59
60 void ToSendStuffBit(int b) {
61 if(ToSendBit >= 8) {
62 ++ToSendMax;
63 ToSend[ToSendMax] = 0;
64 ToSendBit = 0;
65 }
66
67 if(b)
68 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
69
70 ++ToSendBit;
71
72 if(ToSendMax >= sizeof(ToSend)) {
73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76 }
77
78 //=============================================================================
79 // Debug print functions, to go out over USB, to the usual PC-side client.
80 //=============================================================================
81
82 void DbpString(char *str) {
83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
85 }
86
87 #if 0
88 void DbpIntegers(int x1, int x2, int x3) {
89 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
90 }
91 #endif
92
93 void Dbprintf(const char *fmt, ...) {
94 // should probably limit size here; oh well, let's just use a big buffer
95 char output_string[128] = {0x00};
96 va_list ap;
97
98 va_start(ap, fmt);
99 kvsprintf(fmt, output_string, 10, ap);
100 va_end(ap);
101
102 DbpString(output_string);
103 }
104
105 // prints HEX & ASCII
106 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
107 int l=0, i;
108 char ascii[9];
109
110 while (len>0) {
111
112 l = (len>8) ? 8 : len;
113
114 memcpy(ascii,d,l);
115 ascii[l]=0;
116
117 // filter safe ascii
118 for (i=0; i<l; ++i)
119 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
120
121 if (bAsci)
122 Dbprintf("%-8s %*D",ascii,l,d," ");
123 else
124 Dbprintf("%*D",l,d," ");
125
126 len -= 8;
127 d += 8;
128 }
129 }
130
131 //-----------------------------------------------------------------------------
132 // Read an ADC channel and block till it completes, then return the result
133 // in ADC units (0 to 1023). Also a routine to average 32 samples and
134 // return that.
135 //-----------------------------------------------------------------------------
136 static int ReadAdc(int ch)
137 {
138 uint32_t d;
139
140 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
141 AT91C_BASE_ADC->ADC_MR =
142 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
143 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
144 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
145
146 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
147 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
148 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
149 //
150 // The maths are:
151 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
152 //
153 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
154 //
155 // Note: with the "historic" values in the comments above, the error was 34% !!!
156
157 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
158
159 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
160
161 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
162
163 d = AT91C_BASE_ADC->ADC_CDR[ch];
164 return d;
165 }
166
167 int AvgAdc(int ch) // was static - merlok
168 {
169 int i;
170 int a = 0;
171
172 for(i = 0; i < 32; ++i)
173 a += ReadAdc(ch);
174
175 return (a + 15) >> 5;
176 }
177
178 void MeasureAntennaTuning(void) {
179 uint8_t LF_Results[256];
180 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
181 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
182
183 LED_B_ON();
184
185 /*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
193
194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
196
197 for (i=255; i>=19; i--) {
198 WDT_HIT();
199 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
200 SpinDelay(20);
201 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
202 if (i==95) vLf125 = adcval; // voltage at 125Khz
203 if (i==89) vLf134 = adcval; // voltage at 134Khz
204
205 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
206 if(LF_Results[i] > peak) {
207 peakv = adcval;
208 peak = LF_Results[i];
209 peakf = i;
210 //ptr = i;
211 }
212 }
213
214 for (i=18; i >= 0; i--) LF_Results[i] = 0;
215
216 LED_A_ON();
217 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
218 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
219 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
220 SpinDelay(20);
221 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
222
223 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
224 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
225
226 LEDsoff();
227 }
228
229 void MeasureAntennaTuningHf(void) {
230 int vHf = 0; // in mV
231
232 DbpString("Measuring HF antenna, press button to exit");
233
234 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
235 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
236 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
237
238 for (;;) {
239 SpinDelay(20);
240 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
241
242 Dbprintf("%d mV",vHf);
243 if (BUTTON_PRESS()) break;
244 }
245
246 DbpString("cancelled");
247 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
248 }
249
250
251 void ReadMem(int addr) {
252 const uint8_t *data = ((uint8_t *)addr);
253
254 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
255 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
256 }
257
258 /* osimage version information is linked in */
259 extern struct version_information version_information;
260 /* bootrom version information is pointed to from _bootphase1_version_pointer */
261 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
262 void SendVersion(void)
263 {
264 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
265 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
266
267 /* Try to find the bootrom version information. Expect to find a pointer at
268 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
269 * pointer, then use it.
270 */
271 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
272
273 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
274 strcat(VersionString, "bootrom version information appears invalid\n");
275 } else {
276 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
277 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
278 }
279
280 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
281 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
282
283 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
284 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
285
286 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
287 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
288
289 // Send Chip ID and used flash memory
290 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
291 uint32_t compressed_data_section_size = common_area.arg1;
292 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
293 }
294
295 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
296 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
297 void printUSBSpeed(void)
298 {
299 Dbprintf("USB Speed:");
300 Dbprintf(" Sending USB packets to client...");
301
302 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
303 uint8_t *test_data = BigBuf_get_addr();
304 uint32_t end_time;
305
306 uint32_t start_time = end_time = GetTickCount();
307 uint32_t bytes_transferred = 0;
308
309 LED_B_ON();
310 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
311 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
312 end_time = GetTickCount();
313 bytes_transferred += USB_CMD_DATA_SIZE;
314 }
315 LED_B_OFF();
316
317 Dbprintf(" Time elapsed: %dms", end_time - start_time);
318 Dbprintf(" Bytes transferred: %d", bytes_transferred);
319 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
320 1000 * bytes_transferred / (end_time - start_time));
321
322 }
323
324 /**
325 * Prints runtime information about the PM3.
326 **/
327 void SendStatus(void) {
328 BigBuf_print_status();
329 Fpga_print_status();
330 printConfig(); //LF Sampling config
331 printUSBSpeed();
332 Dbprintf("Various");
333 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
334 Dbprintf(" ToSendMax..........%d", ToSendMax);
335 Dbprintf(" ToSendBit..........%d", ToSendBit);
336 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
337
338 cmd_send(CMD_ACK,1,0,0,0,0);
339 }
340
341 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
342
343 #define OPTS 2
344 void StandAloneMode()
345 {
346 DbpString("Stand-alone mode! No PC necessary.");
347 // Oooh pretty -- notify user we're in elite samy mode now
348 LED(LED_RED, 200);
349 LED(LED_ORANGE, 200);
350 LED(LED_GREEN, 200);
351 LED(LED_ORANGE, 200);
352 LED(LED_RED, 200);
353 LED(LED_ORANGE, 200);
354 LED(LED_GREEN, 200);
355 LED(LED_ORANGE, 200);
356 LED(LED_RED, 200);
357 }
358 #endif
359
360 #ifdef WITH_ISO14443a_StandAlone
361 void StandAloneMode14a()
362 {
363 StandAloneMode();
364 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
365
366 int selected = 0;
367 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
368 int cardRead[OPTS] = {0};
369 uint8_t readUID[10] = {0};
370 uint32_t uid_1st[OPTS]={0};
371 uint32_t uid_2nd[OPTS]={0};
372 uint32_t uid_tmp1 = 0;
373 uint32_t uid_tmp2 = 0;
374 iso14a_card_select_t hi14a_card[OPTS];
375
376 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
377
378 LED(selected + 1, 0);
379
380 for (;;)
381 {
382 usb_poll();
383 WDT_HIT();
384 SpinDelay(300);
385
386 if (iGotoRecord == 1 || cardRead[selected] == 0)
387 {
388 iGotoRecord = 0;
389 LEDsoff();
390 LED(selected + 1, 0);
391 LED(LED_RED2, 0);
392
393 // record
394 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
395 /* need this delay to prevent catching some weird data */
396 SpinDelay(500);
397 /* Code for reading from 14a tag */
398 uint8_t uid[10] = {0};
399 uint32_t cuid = 0;
400 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
401
402 for ( ; ; )
403 {
404 WDT_HIT();
405 if (BUTTON_PRESS()) {
406 if (cardRead[selected]) {
407 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
408 break;
409 }
410 else if (cardRead[(selected+1)%OPTS]) {
411 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
412 selected = (selected+1)%OPTS;
413 break; // playing = 1;
414 }
415 else {
416 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
417 SpinDelay(300);
418 }
419 }
420 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
421 continue;
422 else
423 {
424 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
425 memcpy(readUID,uid,10*sizeof(uint8_t));
426 uint8_t *dst = (uint8_t *)&uid_tmp1;
427 // Set UID byte order
428 for (int i=0; i<4; i++)
429 dst[i] = uid[3-i];
430 dst = (uint8_t *)&uid_tmp2;
431 for (int i=0; i<4; i++)
432 dst[i] = uid[7-i];
433 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
434 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
435 }
436 else {
437 if (uid_tmp2) {
438 Dbprintf("Bank[%d] received a 7-byte UID",selected);
439 uid_1st[selected] = (uid_tmp1)>>8;
440 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
441 }
442 else {
443 Dbprintf("Bank[%d] received a 4-byte UID",selected);
444 uid_1st[selected] = uid_tmp1;
445 uid_2nd[selected] = uid_tmp2;
446 }
447 break;
448 }
449 }
450 }
451 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
452 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
453 LEDsoff();
454 LED(LED_GREEN, 200);
455 LED(LED_ORANGE, 200);
456 LED(LED_GREEN, 200);
457 LED(LED_ORANGE, 200);
458
459 LEDsoff();
460 LED(selected + 1, 0);
461
462 // Next state is replay:
463 playing = 1;
464
465 cardRead[selected] = 1;
466 }
467 /* MF Classic UID clone */
468 else if (iGotoClone==1)
469 {
470 iGotoClone=0;
471 LEDsoff();
472 LED(selected + 1, 0);
473 LED(LED_ORANGE, 250);
474
475 // record
476 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
477
478 // wait for button to be released
479 // Delay cloning until card is in place
480 while(BUTTON_PRESS())
481 WDT_HIT();
482
483 Dbprintf("Starting clone. [Bank: %u]", selected);
484 // need this delay to prevent catching some weird data
485 SpinDelay(500);
486 // Begin clone function here:
487 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
488 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
489 memcpy(c.d.asBytes, data, 16);
490 SendCommand(&c);
491
492 Block read is similar:
493 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
494 We need to imitate that call with blockNo 0 to set a uid.
495
496 The get and set commands are handled in this file:
497 // Work with "magic Chinese" card
498 case CMD_MIFARE_CSETBLOCK:
499 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
500 break;
501 case CMD_MIFARE_CGETBLOCK:
502 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
503 break;
504
505 mfCSetUID provides example logic for UID set workflow:
506 -Read block0 from card in field with MifareCGetBlock()
507 -Configure new values without replacing reserved bytes
508 memcpy(block0, uid, 4); // Copy UID bytes from byte array
509 // Mifare UID BCC
510 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
511 Bytes 5-7 are reserved SAK and ATQA for mifare classic
512 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
513 */
514 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
515 // arg0 = Flags, arg1=blockNo
516 MifareCGetBlock(params, 0, oldBlock0);
517 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
518 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
519 playing = 1;
520 }
521 else {
522 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
523 memcpy(newBlock0,oldBlock0,16);
524 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
525
526 newBlock0[0] = uid_1st[selected]>>24;
527 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
528 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
529 newBlock0[3] = 0xFF & (uid_1st[selected]);
530 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
531
532 // arg0 = workFlags, arg1 = blockNo, datain
533 MifareCSetBlock(params, 0, newBlock0);
534 MifareCGetBlock(params, 0, testBlock0);
535
536 if (memcmp(testBlock0, newBlock0, 16)==0) {
537 DbpString("Cloned successfull!");
538 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
539 playing = 0;
540 iGotoRecord = 1;
541 selected = (selected + 1) % OPTS;
542 } else {
543 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
544 playing = 1;
545 }
546 }
547 LEDsoff();
548 LED(selected + 1, 0);
549 }
550 // Change where to record (or begin playing)
551 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
552 {
553 LEDsoff();
554 LED(selected + 1, 0);
555
556 // Begin transmitting
557 if (playing)
558 {
559 LED(LED_GREEN, 0);
560 DbpString("Playing");
561 for ( ; ; ) {
562 WDT_HIT();
563 int button_action = BUTTON_HELD(1000);
564 if (button_action == 0) { // No button action, proceed with sim
565 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
566 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
567 num_to_bytes(uid_1st[selected], 3, data);
568 num_to_bytes(uid_2nd[selected], 4, data);
569
570 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
571 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
572 DbpString("Mifare Classic");
573 SimulateIso14443aTag(1, flags, data); // Mifare Classic
574 }
575 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
576 DbpString("Mifare Ultralight");
577 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
578 }
579 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
580 DbpString("Mifare DESFire");
581 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
582 }
583 else {
584 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
585 SimulateIso14443aTag(1, flags, data);
586 }
587 }
588 else if (button_action == BUTTON_SINGLE_CLICK) {
589 selected = (selected + 1) % OPTS;
590 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
591 iGotoRecord = 1;
592 break;
593 }
594 else if (button_action == BUTTON_HOLD) {
595 Dbprintf("Playtime over. Begin cloning...");
596 iGotoClone = 1;
597 break;
598 }
599 WDT_HIT();
600 }
601
602 /* We pressed a button so ignore it here with a delay */
603 SpinDelay(300);
604 LEDsoff();
605 LED(selected + 1, 0);
606 }
607 else
608 while(BUTTON_PRESS())
609 WDT_HIT();
610 }
611 }
612 }
613 #elif WITH_LF
614 // samy's sniff and repeat routine
615 void SamyRun()
616 {
617 StandAloneMode();
618 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
619
620 int high[OPTS], low[OPTS];
621 int selected = 0;
622 int playing = 0;
623 int cardRead = 0;
624
625 // Turn on selected LED
626 LED(selected + 1, 0);
627
628 for (;;) {
629 usb_poll();
630 WDT_HIT();
631
632 // Was our button held down or pressed?
633 int button_pressed = BUTTON_HELD(1000);
634 SpinDelay(300);
635
636 // Button was held for a second, begin recording
637 if (button_pressed > 0 && cardRead == 0)
638 {
639 LEDsoff();
640 LED(selected + 1, 0);
641 LED(LED_RED2, 0);
642
643 // record
644 DbpString("Starting recording");
645
646 // wait for button to be released
647 while(BUTTON_PRESS())
648 WDT_HIT();
649
650 /* need this delay to prevent catching some weird data */
651 SpinDelay(500);
652
653 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
654 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
655
656 LEDsoff();
657 LED(selected + 1, 0);
658 // Finished recording
659 // If we were previously playing, set playing off
660 // so next button push begins playing what we recorded
661 playing = 0;
662 cardRead = 1;
663 }
664 else if (button_pressed > 0 && cardRead == 1) {
665 LEDsoff();
666 LED(selected + 1, 0);
667 LED(LED_ORANGE, 0);
668
669 // record
670 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
671
672 // wait for button to be released
673 while(BUTTON_PRESS())
674 WDT_HIT();
675
676 /* need this delay to prevent catching some weird data */
677 SpinDelay(500);
678
679 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
680 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
681
682 LEDsoff();
683 LED(selected + 1, 0);
684 // Finished recording
685
686 // If we were previously playing, set playing off
687 // so next button push begins playing what we recorded
688 playing = 0;
689 cardRead = 0;
690 }
691
692 // Change where to record (or begin playing)
693 else if (button_pressed) {
694 // Next option if we were previously playing
695 if (playing)
696 selected = (selected + 1) % OPTS;
697 playing = !playing;
698
699 LEDsoff();
700 LED(selected + 1, 0);
701
702 // Begin transmitting
703 if (playing)
704 {
705 LED(LED_GREEN, 0);
706 DbpString("Playing");
707 // wait for button to be released
708 while(BUTTON_PRESS())
709 WDT_HIT();
710
711 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
712 CmdHIDsimTAG(high[selected], low[selected], 0);
713 DbpString("Done playing");
714
715 if (BUTTON_HELD(1000) > 0) {
716 DbpString("Exiting");
717 LEDsoff();
718 return;
719 }
720
721 /* We pressed a button so ignore it here with a delay */
722 SpinDelay(300);
723
724 // when done, we're done playing, move to next option
725 selected = (selected + 1) % OPTS;
726 playing = !playing;
727 LEDsoff();
728 LED(selected + 1, 0);
729 }
730 else
731 while(BUTTON_PRESS())
732 WDT_HIT();
733 }
734 }
735 }
736
737 #endif
738 /*
739 OBJECTIVE
740 Listen and detect an external reader. Determine the best location
741 for the antenna.
742
743 INSTRUCTIONS:
744 Inside the ListenReaderField() function, there is two mode.
745 By default, when you call the function, you will enter mode 1.
746 If you press the PM3 button one time, you will enter mode 2.
747 If you press the PM3 button a second time, you will exit the function.
748
749 DESCRIPTION OF MODE 1:
750 This mode just listens for an external reader field and lights up green
751 for HF and/or red for LF. This is the original mode of the detectreader
752 function.
753
754 DESCRIPTION OF MODE 2:
755 This mode will visually represent, using the LEDs, the actual strength of the
756 current compared to the maximum current detected. Basically, once you know
757 what kind of external reader is present, it will help you spot the best location to place
758 your antenna. You will probably not get some good results if there is a LF and a HF reader
759 at the same place! :-)
760
761 LIGHT SCHEME USED:
762 */
763 static const char LIGHT_SCHEME[] = {
764 0x0, /* ---- | No field detected */
765 0x1, /* X--- | 14% of maximum current detected */
766 0x2, /* -X-- | 29% of maximum current detected */
767 0x4, /* --X- | 43% of maximum current detected */
768 0x8, /* ---X | 57% of maximum current detected */
769 0xC, /* --XX | 71% of maximum current detected */
770 0xE, /* -XXX | 86% of maximum current detected */
771 0xF, /* XXXX | 100% of maximum current detected */
772 };
773 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
774
775 void ListenReaderField(int limit) {
776 #define LF_ONLY 1
777 #define HF_ONLY 2
778 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
779
780 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
781 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
782 int mode=1, display_val, display_max, i;
783
784 // switch off FPGA - we don't want to measure our own signal
785 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
786 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
787
788 LEDsoff();
789
790 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
791
792 if(limit != HF_ONLY) {
793 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
794 lf_baseline = lf_av;
795 }
796
797 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
798
799 if (limit != LF_ONLY) {
800 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
801 hf_baseline = hf_av;
802 }
803
804 for(;;) {
805 if (BUTTON_PRESS()) {
806 SpinDelay(500);
807 switch (mode) {
808 case 1:
809 mode=2;
810 DbpString("Signal Strength Mode");
811 break;
812 case 2:
813 default:
814 DbpString("Stopped");
815 LEDsoff();
816 return;
817 break;
818 }
819 }
820 WDT_HIT();
821
822 if (limit != HF_ONLY) {
823 if(mode == 1) {
824 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
825 LED_D_ON();
826 else
827 LED_D_OFF();
828 }
829
830 lf_av_new = AvgAdc(ADC_CHAN_LF);
831 // see if there's a significant change
832 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
833 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
834 lf_av = lf_av_new;
835 if (lf_av > lf_max)
836 lf_max = lf_av;
837 }
838 }
839
840 if (limit != LF_ONLY) {
841 if (mode == 1){
842 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
843 LED_B_ON();
844 else
845 LED_B_OFF();
846 }
847
848 hf_av_new = AvgAdc(ADC_CHAN_HF);
849 // see if there's a significant change
850 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
851 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
852 hf_av = hf_av_new;
853 if (hf_av > hf_max)
854 hf_max = hf_av;
855 }
856 }
857
858 if(mode == 2) {
859 if (limit == LF_ONLY) {
860 display_val = lf_av;
861 display_max = lf_max;
862 } else if (limit == HF_ONLY) {
863 display_val = hf_av;
864 display_max = hf_max;
865 } else { /* Pick one at random */
866 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
867 display_val = hf_av;
868 display_max = hf_max;
869 } else {
870 display_val = lf_av;
871 display_max = lf_max;
872 }
873 }
874 for (i=0; i<LIGHT_LEN; i++) {
875 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
876 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
877 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
878 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
879 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
880 break;
881 }
882 }
883 }
884 }
885 }
886
887 void UsbPacketReceived(uint8_t *packet, int len)
888 {
889 UsbCommand *c = (UsbCommand *)packet;
890
891 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
892
893 switch(c->cmd) {
894 #ifdef WITH_LF
895 case CMD_SET_LF_SAMPLING_CONFIG:
896 setSamplingConfig((sample_config *) c->d.asBytes);
897 break;
898 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
899 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
900 break;
901 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
902 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
903 break;
904 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
905 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
906 break;
907 case CMD_HID_DEMOD_FSK:
908 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
909 break;
910 case CMD_HID_SIM_TAG:
911 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
912 break;
913 case CMD_FSK_SIM_TAG:
914 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
915 break;
916 case CMD_ASK_SIM_TAG:
917 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
918 break;
919 case CMD_PSK_SIM_TAG:
920 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
921 break;
922 case CMD_HID_CLONE_TAG:
923 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
924 break;
925 case CMD_IO_DEMOD_FSK:
926 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
927 break;
928 case CMD_IO_CLONE_TAG:
929 CopyIOtoT55x7(c->arg[0], c->arg[1]);
930 break;
931 case CMD_EM410X_DEMOD:
932 CmdEM410xdemod(c->arg[0], 0, 0, 1);
933 break;
934 case CMD_EM410X_WRITE_TAG:
935 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
936 break;
937 case CMD_READ_TI_TYPE:
938 ReadTItag();
939 break;
940 case CMD_WRITE_TI_TYPE:
941 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
942 break;
943 case CMD_SIMULATE_TAG_125K:
944 LED_A_ON();
945 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
946 LED_A_OFF();
947 break;
948 case CMD_LF_SIMULATE_BIDIR:
949 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
950 break;
951 case CMD_INDALA_CLONE_TAG:
952 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
953 break;
954 case CMD_INDALA_CLONE_TAG_L:
955 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
956 break;
957 case CMD_T55XX_READ_BLOCK:
958 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
959 break;
960 case CMD_T55XX_WRITE_BLOCK:
961 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
962 break;
963 case CMD_T55XX_WAKEUP:
964 T55xxWakeUp(c->arg[0]);
965 break;
966 case CMD_T55XX_RESET_READ:
967 T55xxResetRead();
968 break;
969 case CMD_PCF7931_READ:
970 ReadPCF7931();
971 break;
972 case CMD_PCF7931_WRITE:
973 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
974 break;
975 case CMD_EM4X_READ_WORD:
976 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
977 break;
978 case CMD_EM4X_WRITE_WORD:
979 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
980 break;
981 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
982 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
983 break;
984 case CMD_VIKING_CLONE_TAG:
985 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
986 break;
987 #endif
988
989 #ifdef WITH_HITAG
990 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
991 SnoopHitag(c->arg[0]);
992 break;
993 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
994 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
995 break;
996 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
997 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
998 break;
999 #endif
1000
1001 #ifdef WITH_ISO15693
1002 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1003 AcquireRawAdcSamplesIso15693();
1004 break;
1005 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1006 RecordRawAdcSamplesIso15693();
1007 break;
1008
1009 case CMD_ISO_15693_COMMAND:
1010 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1011 break;
1012
1013 case CMD_ISO_15693_FIND_AFI:
1014 BruteforceIso15693Afi(c->arg[0]);
1015 break;
1016
1017 case CMD_ISO_15693_DEBUG:
1018 SetDebugIso15693(c->arg[0]);
1019 break;
1020
1021 case CMD_READER_ISO_15693:
1022 ReaderIso15693(c->arg[0]);
1023 break;
1024 case CMD_SIMTAG_ISO_15693:
1025 SimTagIso15693(c->arg[0], c->d.asBytes);
1026 break;
1027 #endif
1028
1029 #ifdef WITH_LEGICRF
1030 case CMD_SIMULATE_TAG_LEGIC_RF:
1031 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1032 break;
1033
1034 case CMD_WRITER_LEGIC_RF:
1035 LegicRfWriter(c->arg[1], c->arg[0]);
1036 break;
1037
1038 case CMD_READER_LEGIC_RF:
1039 LegicRfReader(c->arg[0], c->arg[1]);
1040 break;
1041 #endif
1042
1043 #ifdef WITH_ISO14443b
1044 case CMD_READ_SRI512_TAG:
1045 ReadSTMemoryIso14443b(0x0F);
1046 break;
1047 case CMD_READ_SRIX4K_TAG:
1048 ReadSTMemoryIso14443b(0x7F);
1049 break;
1050 case CMD_SNOOP_ISO_14443B:
1051 SnoopIso14443b();
1052 break;
1053 case CMD_SIMULATE_TAG_ISO_14443B:
1054 SimulateIso14443bTag();
1055 break;
1056 case CMD_ISO_14443B_COMMAND:
1057 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1058 break;
1059 #endif
1060
1061 #ifdef WITH_ISO14443a
1062 case CMD_SNOOP_ISO_14443a:
1063 SniffIso14443a(c->arg[0]);
1064 break;
1065 case CMD_READER_ISO_14443a:
1066 ReaderIso14443a(c);
1067 break;
1068 case CMD_SIMULATE_TAG_ISO_14443a:
1069 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1070 break;
1071
1072 case CMD_EPA_PACE_COLLECT_NONCE:
1073 EPA_PACE_Collect_Nonce(c);
1074 break;
1075 case CMD_EPA_PACE_REPLAY:
1076 EPA_PACE_Replay(c);
1077 break;
1078
1079 case CMD_READER_MIFARE:
1080 ReaderMifare(c->arg[0], c->arg[1]);
1081 break;
1082 case CMD_MIFARE_READBL:
1083 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1084 break;
1085 case CMD_MIFAREU_READBL:
1086 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1087 break;
1088 case CMD_MIFAREUC_AUTH:
1089 MifareUC_Auth(c->arg[0],c->d.asBytes);
1090 break;
1091 case CMD_MIFAREU_READCARD:
1092 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1093 break;
1094 case CMD_MIFAREUC_SETPWD:
1095 MifareUSetPwd(c->arg[0], c->d.asBytes);
1096 break;
1097 case CMD_MIFARE_READSC:
1098 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1099 break;
1100 case CMD_MIFARE_WRITEBL:
1101 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1102 break;
1103 //case CMD_MIFAREU_WRITEBL_COMPAT:
1104 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1105 //break;
1106 case CMD_MIFAREU_WRITEBL:
1107 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1108 break;
1109 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1110 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1111 break;
1112 case CMD_MIFARE_NESTED:
1113 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1114 break;
1115 case CMD_MIFARE_CHKKEYS:
1116 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1117 break;
1118 case CMD_SIMULATE_MIFARE_CARD:
1119 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1120 break;
1121
1122 // emulator
1123 case CMD_MIFARE_SET_DBGMODE:
1124 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1125 break;
1126 case CMD_MIFARE_EML_MEMCLR:
1127 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1128 break;
1129 case CMD_MIFARE_EML_MEMSET:
1130 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1131 break;
1132 case CMD_MIFARE_EML_MEMGET:
1133 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1134 break;
1135 case CMD_MIFARE_EML_CARDLOAD:
1136 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1137 break;
1138
1139 // Work with "magic Chinese" card
1140 case CMD_MIFARE_CSETBLOCK:
1141 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1142 break;
1143 case CMD_MIFARE_CGETBLOCK:
1144 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1145 break;
1146 case CMD_MIFARE_CIDENT:
1147 MifareCIdent();
1148 break;
1149
1150 // mifare sniffer
1151 case CMD_MIFARE_SNIFFER:
1152 SniffMifare(c->arg[0]);
1153 break;
1154
1155 //mifare desfire
1156 case CMD_MIFARE_DESFIRE_READBL: break;
1157 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1158 case CMD_MIFARE_DESFIRE_AUTH1:
1159 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1160 break;
1161 case CMD_MIFARE_DESFIRE_AUTH2:
1162 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1163 break;
1164 case CMD_MIFARE_DES_READER:
1165 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1166 break;
1167 case CMD_MIFARE_DESFIRE_INFO:
1168 MifareDesfireGetInformation();
1169 break;
1170 case CMD_MIFARE_DESFIRE:
1171 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1172 break;
1173
1174 case CMD_MIFARE_COLLECT_NONCES:
1175 break;
1176 #endif
1177 #ifdef WITH_EMV
1178 case CMD_EMV_TRANSACTION:
1179 EMVTransaction();
1180 break;
1181 case CMD_EMV_GET_RANDOM_NUM:
1182 //EMVgetUDOL();
1183 break;
1184 case CMD_EMV_LOAD_VALUE:
1185 EMVloadvalue(c->arg[0], c->d.asBytes);
1186 break;
1187 case CMD_EMV_DUMP_CARD:
1188 EMVdumpcard();
1189 #endif
1190 #ifdef WITH_ICLASS
1191 // Makes use of ISO14443a FPGA Firmware
1192 case CMD_SNOOP_ICLASS:
1193 SnoopIClass();
1194 break;
1195 case CMD_SIMULATE_TAG_ICLASS:
1196 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1197 break;
1198 case CMD_READER_ICLASS:
1199 ReaderIClass(c->arg[0]);
1200 break;
1201 case CMD_READER_ICLASS_REPLAY:
1202 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1203 break;
1204 case CMD_ICLASS_EML_MEMSET:
1205 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1206 break;
1207 case CMD_ICLASS_WRITEBLOCK:
1208 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1209 break;
1210 case CMD_ICLASS_READCHECK: // auth step 1
1211 iClass_ReadCheck(c->arg[0], c->arg[1]);
1212 break;
1213 case CMD_ICLASS_READBLOCK:
1214 iClass_ReadBlk(c->arg[0]);
1215 break;
1216 case CMD_ICLASS_AUTHENTICATION: //check
1217 iClass_Authentication(c->d.asBytes);
1218 break;
1219 case CMD_ICLASS_DUMP:
1220 iClass_Dump(c->arg[0], c->arg[1]);
1221 break;
1222 case CMD_ICLASS_CLONE:
1223 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1224 break;
1225 #endif
1226 #ifdef WITH_HFSNOOP
1227 case CMD_HF_SNIFFER:
1228 HfSnoop(c->arg[0], c->arg[1]);
1229 break;
1230 #endif
1231
1232 case CMD_BUFF_CLEAR:
1233 BigBuf_Clear();
1234 break;
1235
1236 case CMD_MEASURE_ANTENNA_TUNING:
1237 MeasureAntennaTuning();
1238 break;
1239
1240 case CMD_MEASURE_ANTENNA_TUNING_HF:
1241 MeasureAntennaTuningHf();
1242 break;
1243
1244 case CMD_LISTEN_READER_FIELD:
1245 ListenReaderField(c->arg[0]);
1246 break;
1247
1248 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1249 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1250 SpinDelay(200);
1251 LED_D_OFF(); // LED D indicates field ON or OFF
1252 break;
1253
1254 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1255
1256 LED_B_ON();
1257 uint8_t *BigBuf = BigBuf_get_addr();
1258 size_t len = 0;
1259 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1260 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1261 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1262 }
1263 // Trigger a finish downloading signal with an ACK frame
1264 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1265 LED_B_OFF();
1266 break;
1267
1268 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1269 uint8_t *b = BigBuf_get_addr();
1270 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1271 cmd_send(CMD_ACK,0,0,0,0,0);
1272 break;
1273 }
1274 case CMD_READ_MEM:
1275 ReadMem(c->arg[0]);
1276 break;
1277
1278 case CMD_SET_LF_DIVISOR:
1279 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1280 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1281 break;
1282
1283 case CMD_SET_ADC_MUX:
1284 switch(c->arg[0]) {
1285 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1286 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1287 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1288 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1289 }
1290 break;
1291
1292 case CMD_VERSION:
1293 SendVersion();
1294 break;
1295 case CMD_STATUS:
1296 SendStatus();
1297 break;
1298 case CMD_PING:
1299 cmd_send(CMD_ACK,0,0,0,0,0);
1300 break;
1301 #ifdef WITH_LCD
1302 case CMD_LCD_RESET:
1303 LCDReset();
1304 break;
1305 case CMD_LCD:
1306 LCDSend(c->arg[0]);
1307 break;
1308 #endif
1309 case CMD_SETUP_WRITE:
1310 case CMD_FINISH_WRITE:
1311 case CMD_HARDWARE_RESET:
1312 usb_disable();
1313 SpinDelay(2000);
1314 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1315 for(;;) {
1316 // We're going to reset, and the bootrom will take control.
1317 }
1318 break;
1319
1320 case CMD_START_FLASH:
1321 if(common_area.flags.bootrom_present) {
1322 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1323 }
1324 usb_disable();
1325 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1326 for(;;);
1327 break;
1328
1329 case CMD_DEVICE_INFO: {
1330 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1331 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1332 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1333 break;
1334 }
1335 default:
1336 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1337 break;
1338 }
1339 }
1340
1341 void __attribute__((noreturn)) AppMain(void)
1342 {
1343 SpinDelay(100);
1344 clear_trace();
1345 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1346 /* Initialize common area */
1347 memset(&common_area, 0, sizeof(common_area));
1348 common_area.magic = COMMON_AREA_MAGIC;
1349 common_area.version = 1;
1350 }
1351 common_area.flags.osimage_present = 1;
1352
1353 LED_D_OFF();
1354 LED_C_OFF();
1355 LED_B_OFF();
1356 LED_A_OFF();
1357
1358 // Init USB device
1359 usb_enable();
1360
1361 // The FPGA gets its clock from us from PCK0 output, so set that up.
1362 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1363 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1364 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1365 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1366 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1367 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1368 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1369
1370 // Reset SPI
1371 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1372 // Reset SSC
1373 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1374
1375 // Load the FPGA image, which we have stored in our flash.
1376 // (the HF version by default)
1377 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1378
1379 StartTickCount();
1380
1381 #ifdef WITH_LCD
1382 LCDInit();
1383 #endif
1384
1385 byte_t rx[sizeof(UsbCommand)];
1386 size_t rx_len;
1387
1388 for(;;) {
1389 if (usb_poll()) {
1390 rx_len = usb_read(rx,sizeof(UsbCommand));
1391 if (rx_len)
1392 UsbPacketReceived(rx,rx_len);
1393 }
1394 WDT_HIT();
1395
1396 #ifdef WITH_LF
1397 #ifndef WITH_ISO14443a_StandAlone
1398 if (BUTTON_HELD(1000) > 0)
1399 SamyRun();
1400 #endif
1401 #endif
1402 #ifdef WITH_ISO14443a
1403 #ifdef WITH_ISO14443a_StandAlone
1404 if (BUTTON_HELD(1000) > 0)
1405 StandAloneMode14a();
1406 #endif
1407 #endif
1408 }
1409 }
Proxmark3 GIT tracking
Impressum, Datenschutz