]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: starting merge @holiman 's graphic branch.
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12 #include <stdarg.h>
13 #include "usb_cdc.h"
14 #include "proxmark3.h"
15 #include "apps.h"
16 #include "util.h"
17 #include "printf.h"
18 #include "string.h"
19 #include "legicrf.h"
20 #include "lfsampling.h"
21 #include "BigBuf.h"
22 #include "mifareutil.h"
23
24 #ifdef WITH_LCD
25 #include "LCD.h"
26 #endif
27
28 // Craig Young - 14a stand-alone code
29 #ifdef WITH_ISO14443a_StandAlone
30 #include "iso14443a.h"
31 #include "protocols.h"
32 #endif
33
34 //=============================================================================
35 // A buffer where we can queue things up to be sent through the FPGA, for
36 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
37 // is the order in which they go out on the wire.
38 //=============================================================================
39
40 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41 uint8_t ToSend[TOSEND_BUFFER_SIZE];
42 int ToSendMax = 0;
43 static int ToSendBit;
44 struct common_area common_area __attribute__((section(".commonarea")));
45
46 void ToSendReset(void)
47 {
48 ToSendMax = -1;
49 ToSendBit = 8;
50 }
51
52 void ToSendStuffBit(int b) {
53 if(ToSendBit >= 8) {
54 ++ToSendMax;
55 ToSend[ToSendMax] = 0;
56 ToSendBit = 0;
57 }
58
59 if(b)
60 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
61
62 ++ToSendBit;
63
64 if(ToSendMax >= sizeof(ToSend)) {
65 ToSendBit = 0;
66 DbpString("ToSendStuffBit overflowed!");
67 }
68 }
69
70 void PrintToSendBuffer(void){
71 DbpString("Printing ToSendBuffer:");
72 Dbhexdump(ToSendMax, ToSend, 0);
73 }
74
75 void print_result(char *name, uint8_t *buf, size_t len) {
76 uint8_t *p = buf;
77
78 if ( len % 16 == 0 ) {
79 for(; p-buf < len; p += 16)
80 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
81 name,
82 p-buf,
83 len,
84 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7],p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]
85 );
86 }
87 else {
88 for(; p-buf < len; p += 8)
89 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x",
90 name,
91 p-buf,
92 len,
93 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
94 }
95 }
96
97 //=============================================================================
98 // Debug print functions, to go out over USB, to the usual PC-side client.
99 //=============================================================================
100
101 void DbpStringEx(char *str, uint32_t cmd){
102 byte_t len = strlen(str);
103 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
104 }
105
106 void DbpString(char *str) {
107 DbpStringEx(str, 0);
108 }
109
110 #if 0
111 void DbpIntegers(int x1, int x2, int x3) {
112 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
113 }
114 #endif
115 void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
116 // should probably limit size here; oh well, let's just use a big buffer
117 char output_string[128] = {0x00};
118 va_list ap;
119
120 va_start(ap, fmt);
121 kvsprintf(fmt, output_string, 10, ap);
122 va_end(ap);
123
124 DbpStringEx(output_string, cmd);
125 }
126
127 void Dbprintf(const char *fmt, ...) {
128 // should probably limit size here; oh well, let's just use a big buffer
129 char output_string[128] = {0x00};
130 va_list ap;
131
132 va_start(ap, fmt);
133 kvsprintf(fmt, output_string, 10, ap);
134 va_end(ap);
135
136 DbpString(output_string);
137 }
138
139 // prints HEX & ASCII
140 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
141 int l=0, i;
142 char ascii[9];
143
144 while (len>0) {
145
146 l = (len>8) ? 8 : len;
147
148 memcpy(ascii,d,l);
149 ascii[l]=0;
150
151 // filter safe ascii
152 for (i=0; i<l; ++i)
153 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
154
155 if (bAsci)
156 Dbprintf("%-8s %*D",ascii,l,d," ");
157 else
158 Dbprintf("%*D",l,d," ");
159
160 len -= 8;
161 d += 8;
162 }
163 }
164
165 //-----------------------------------------------------------------------------
166 // Read an ADC channel and block till it completes, then return the result
167 // in ADC units (0 to 1023). Also a routine to average 32 samples and
168 // return that.
169 //-----------------------------------------------------------------------------
170 static int ReadAdc(int ch)
171 {
172 uint32_t d;
173
174 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
175 AT91C_BASE_ADC->ADC_MR =
176 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
177 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
178 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
179
180 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
181 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
182 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
183 //
184 // The maths are:
185 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
186 //
187 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
188 //
189 // Note: with the "historic" values in the comments above, the error was 34% !!!
190
191 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
192
193 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
194
195 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
196
197 d = AT91C_BASE_ADC->ADC_CDR[ch];
198 return d;
199 }
200
201 int AvgAdc(int ch) // was static - merlok
202 {
203 int i, a = 0;
204 for(i = 0; i < 32; ++i)
205 a += ReadAdc(ch);
206
207 return (a + 15) >> 5;
208 }
209
210
211 void MeasureAntennaTuning(void) {
212
213 uint8_t LF_Results[256];
214 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0;
215 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
216
217 memset(LF_Results, 0, sizeof(LF_Results));
218 LED_B_ON();
219
220 /*
221 * Sweeps the useful LF range of the proxmark from
222 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
223 * read the voltage in the antenna, the result left
224 * in the buffer is a graph which should clearly show
225 * the resonating frequency of your LF antenna
226 * ( hopefully around 95 if it is tuned to 125kHz!)
227 */
228
229 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
230 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
231
232 for (i = 255; i >= 19; i--) {
233 WDT_HIT();
234 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
235 SpinDelay(20);
236 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
237 if (i==95) vLf125 = adcval; // voltage at 125Khz
238 if (i==89) vLf134 = adcval; // voltage at 134Khz
239
240 LF_Results[i] = adcval >> 8; // scale int to fit in byte for graphing purposes
241 if(LF_Results[i] > peak) {
242 peakv = adcval;
243 peak = LF_Results[i];
244 peakf = i;
245 }
246 }
247
248 LED_A_ON();
249 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
250 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
251 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
252 SpinDelay(20);
253 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
254
255 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134 << 16), vHf, peakf | (peakv << 16), LF_Results, 256);
256 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
257 LEDsoff();
258 }
259
260 void MeasureAntennaTuningHf(void) {
261 int vHf = 0; // in mV
262 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
263 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
264 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
265
266 while ( !BUTTON_PRESS() ){
267 SpinDelay(20);
268 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
269 //Dbprintf("%d mV",vHf);
270 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
271 }
272 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
273 DbpString("cancelled");
274 }
275
276
277 void ReadMem(int addr) {
278 const uint8_t *data = ((uint8_t *)addr);
279
280 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
281 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
282 }
283
284 /* osimage version information is linked in */
285 extern struct version_information version_information;
286 /* bootrom version information is pointed to from _bootphase1_version_pointer */
287 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
288 void SendVersion(void)
289 {
290 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
291 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
292
293 /* Try to find the bootrom version information. Expect to find a pointer at
294 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
295 * pointer, then use it.
296 */
297 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
298
299 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
300 strcat(VersionString, "bootrom version information appears invalid\n");
301 } else {
302 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
303 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
304 }
305
306 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
307 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
308
309 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
311
312 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
313 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
314
315 // Send Chip ID and used flash memory
316 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
317 uint32_t compressed_data_section_size = common_area.arg1;
318 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
319 }
320
321 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
322 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
323 void printUSBSpeed(void)
324 {
325 Dbprintf("USB Speed:");
326 Dbprintf(" Sending USB packets to client...");
327
328 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
329 uint8_t *test_data = BigBuf_get_addr();
330 uint32_t end_time;
331
332 uint32_t start_time = end_time = GetTickCount();
333 uint32_t bytes_transferred = 0;
334
335 LED_B_ON();
336 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
337 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
338 end_time = GetTickCount();
339 bytes_transferred += USB_CMD_DATA_SIZE;
340 }
341 LED_B_OFF();
342
343 Dbprintf(" Time elapsed: %dms", end_time - start_time);
344 Dbprintf(" Bytes transferred: %d", bytes_transferred);
345 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
346 1000 * bytes_transferred / (end_time - start_time));
347
348 }
349
350 /**
351 * Prints runtime information about the PM3.
352 **/
353 void SendStatus(void) {
354 BigBuf_print_status();
355 Fpga_print_status();
356 printConfig(); //LF Sampling config
357 printUSBSpeed();
358 Dbprintf("Various");
359 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
360 Dbprintf(" ToSendMax..........%d", ToSendMax);
361 Dbprintf(" ToSendBit..........%d", ToSendBit);
362 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
363
364 cmd_send(CMD_ACK,1,0,0,0,0);
365 }
366
367 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
368
369 #define OPTS 2
370 void StandAloneMode()
371 {
372 DbpString("Stand-alone mode! No PC necessary.");
373 // Oooh pretty -- notify user we're in elite samy mode now
374 LED(LED_RED, 200);
375 LED(LED_ORANGE, 200);
376 LED(LED_GREEN, 200);
377 LED(LED_ORANGE, 200);
378 LED(LED_RED, 200);
379 LED(LED_ORANGE, 200);
380 LED(LED_GREEN, 200);
381 LED(LED_ORANGE, 200);
382 LED(LED_RED, 200);
383 }
384 #endif
385
386 #ifdef WITH_ISO14443a_StandAlone
387
388 typedef struct {
389 uint8_t uid[10];
390 uint8_t uidlen;
391 uint8_t atqa[2];
392 uint8_t sak;
393 } __attribute__((__packed__)) card_clone_t;
394
395 void StandAloneMode14a()
396 {
397 StandAloneMode();
398 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
399
400 int selected = 0, playing = 0, iGotoRecord = 0, iGotoClone = 0;
401 int cardRead[OPTS] = {0};
402
403 card_clone_t uids[OPTS];
404 iso14a_card_select_t card_info[OPTS];
405 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
406
407 LED(selected + 1, 0);
408
409 for (;;)
410 {
411 usb_poll();
412 WDT_HIT();
413 SpinDelay(300);
414
415 if (iGotoRecord == 1 || cardRead[selected] == 0)
416 {
417 iGotoRecord = 0;
418 LEDsoff();
419 LED(selected + 1, 0);
420 LED(LED_RED2, 0);
421
422 // record
423 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
424 /* need this delay to prevent catching some weird data */
425 SpinDelay(500);
426 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
427
428 for ( ; ; )
429 {
430 WDT_HIT();
431 if (BUTTON_PRESS()) {
432 if (cardRead[selected]) {
433 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
434 break;
435 }
436 else if (cardRead[(selected+1) % OPTS]) {
437 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
438 selected = (selected+1) % OPTS;
439 break; // playing = 1;
440 }
441 else {
442 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
443 SpinDelay(300);
444 }
445 }
446 if (!iso14443a_select_card(NULL, &card_info[selected], NULL, true, 0))
447 continue;
448 else
449 {
450 Dbprintf("Read UID:");
451 Dbhexdump(card_info[selected].uidlen, card_info[selected].uid, 0);
452
453 if (memcmp(uids[(selected+1)%OPTS].uid, card_info[selected].uid, card_info[selected].uidlen ) == 0 ) {
454 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
455 }
456 else {
457
458 uids[selected].sak = card_info[selected].sak;
459 uids[selected].uidlen = card_info[selected].uidlen;
460 memcpy(uids[selected].uid , card_info[selected].uid, uids[selected].uidlen);
461 memcpy(uids[selected].atqa, card_info[selected].atqa, 2);
462
463 if (uids[selected].uidlen > 4)
464 Dbprintf("Bank[%d] received a 7-byte UID", selected);
465 else
466 Dbprintf("Bank[%d] received a 4-byte UID", selected);
467 break;
468 }
469 }
470 }
471 Dbprintf("ATQA = %02X%02X", uids[selected].atqa[0], uids[selected].atqa[1]);
472 Dbprintf("SAK = %02X", uids[selected].sak);
473 LEDsoff();
474 LED(LED_GREEN, 200);
475 LED(LED_ORANGE, 200);
476 LED(LED_GREEN, 200);
477 LED(LED_ORANGE, 200);
478
479 LEDsoff();
480 LED(selected + 1, 0);
481
482 // Next state is replay:
483 playing = 1;
484
485 cardRead[selected] = 1;
486 }
487 /* MF Classic UID clone */
488 else if (iGotoClone==1)
489 {
490 iGotoClone=0;
491 LEDsoff();
492 LED(selected + 1, 0);
493 LED(LED_ORANGE, 250);
494
495 // magiccards holds 4bytes uid.
496 uint64_t tmpuid = bytes_to_num(uids[selected].uid, 4);
497
498 // record
499 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, tmpuid & 0xFFFFFFFF);
500
501 // wait for button to be released
502 // Delay cloning until card is in place
503 while(BUTTON_PRESS())
504 WDT_HIT();
505
506 Dbprintf("Starting clone. [Bank: %u]", selected);
507 // need this delay to prevent catching some weird data
508 SpinDelay(500);
509 // Begin clone function here:
510 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
511 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
512 memcpy(c.d.asBytes, data, 16);
513 SendCommand(&c);
514
515 Block read is similar:
516 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
517 We need to imitate that call with blockNo 0 to set a uid.
518
519 The get and set commands are handled in this file:
520 // Work with "magic Chinese" card
521 case CMD_MIFARE_CSETBLOCK:
522 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
523 break;
524 case CMD_MIFARE_CGETBLOCK:
525 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
526 break;
527
528 mfCSetUID provides example logic for UID set workflow:
529 -Read block0 from card in field with MifareCGetBlock()
530 -Configure new values without replacing reserved bytes
531 memcpy(block0, uid, 4); // Copy UID bytes from byte array
532 // Mifare UID BCC
533 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
534 Bytes 5-7 are reserved SAK and ATQA for mifare classic
535 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
536 */
537 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
538 // arg0 = Flags, arg1=blockNo
539 MifareCGetBlock(params, 0, oldBlock0);
540 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
541 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
542 playing = 1;
543 }
544 else {
545 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0], oldBlock0[1], oldBlock0[2], oldBlock0[3]);
546 memcpy(newBlock0, oldBlock0, 16);
547
548 // Copy uid for bank (2nd is for longer UIDs not supported if classic)
549 memcpy(newBlock0, uids[selected].uid, 4);
550 newBlock0[4] = newBlock0[0] ^ newBlock0[1] ^ newBlock0[2] ^ newBlock0[3];
551
552 // arg0 = workFlags, arg1 = blockNo, datain
553 MifareCSetBlock(params, 0, newBlock0);
554 MifareCGetBlock(params, 0, testBlock0);
555
556 if (memcmp(testBlock0, newBlock0, 16)==0) {
557 DbpString("Cloned successfull!");
558 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
559 playing = 0;
560 iGotoRecord = 1;
561 selected = (selected + 1) % OPTS;
562 } else {
563 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
564 playing = 1;
565 }
566 }
567 LEDsoff();
568 LED(selected + 1, 0);
569 }
570 // Change where to record (or begin playing)
571 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
572 {
573 LEDsoff();
574 LED(selected + 1, 0);
575
576 // Begin transmitting
577 if (playing)
578 {
579 LED(LED_GREEN, 0);
580 DbpString("Playing");
581 for ( ; ; ) {
582 WDT_HIT();
583 int button_action = BUTTON_HELD(1000);
584 if (button_action == 0) { // No button action, proceed with sim
585
586 uint8_t flags = FLAG_4B_UID_IN_DATA;
587 uint8_t data[USB_CMD_DATA_SIZE] = {0}; // in case there is a read command received we shouldn't break
588
589 memcpy(data, uids[selected].uid, uids[selected].uidlen);
590
591 uint64_t tmpuid = bytes_to_num(uids[selected].uid, uids[selected].uidlen);
592
593 if ( uids[selected].uidlen == 7 ) {
594 flags = FLAG_7B_UID_IN_DATA;
595 Dbprintf("Simulating ISO14443a tag with uid: %02x%08x [Bank: %u]", tmpuid >> 32, tmpuid & 0xFFFFFFFF , selected);
596 } else {
597 Dbprintf("Simulating ISO14443a tag with uid: %08x [Bank: %u]", tmpuid & 0xFFFFFFFF , selected);
598 }
599
600 if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0) {
601 DbpString("Mifare Classic 1k");
602 SimulateIso14443aTag(1, flags, data);
603 } else if (uids[selected].sak == 0x18 && uids[selected].atqa[0] == 0x02 && uids[selected].atqa[1] == 0) {
604 DbpString("Mifare Classic 4k (4b uid)");
605 SimulateIso14443aTag(8, flags, data);
606 } else if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
607 DbpString("Mifare Classic 4k (7b uid)");
608 SimulateIso14443aTag(8, flags, data);
609 } else if (uids[selected].sak == 0x00 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
610 DbpString("Mifare Ultralight");
611 SimulateIso14443aTag(2, flags, data);
612 } else if (uids[selected].sak == 0x20 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0x03) {
613 DbpString("Mifare DESFire");
614 SimulateIso14443aTag(3, flags, data);
615 }
616 else {
617 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
618 SimulateIso14443aTag(1, flags, data);
619 }
620 }
621 else if (button_action == BUTTON_SINGLE_CLICK) {
622 selected = (selected + 1) % OPTS;
623 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
624 iGotoRecord = 1;
625 break;
626 }
627 else if (button_action == BUTTON_HOLD) {
628 Dbprintf("Playtime over. Begin cloning...");
629 iGotoClone = 1;
630 break;
631 }
632 WDT_HIT();
633 }
634
635 /* We pressed a button so ignore it here with a delay */
636 SpinDelay(300);
637 LEDsoff();
638 LED(selected + 1, 0);
639 }
640 else
641 while(BUTTON_PRESS())
642 WDT_HIT();
643 }
644 }
645 }
646 #elif WITH_LF
647 // samy's sniff and repeat routine
648 void SamyRun()
649 {
650 StandAloneMode();
651 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
652
653 int high[OPTS], low[OPTS];
654 int selected = 0;
655 int playing = 0;
656 int cardRead = 0;
657
658 // Turn on selected LED
659 LED(selected + 1, 0);
660
661 for (;;) {
662 usb_poll();
663 WDT_HIT();
664
665 // Was our button held down or pressed?
666 int button_pressed = BUTTON_HELD(1000);
667 SpinDelay(300);
668
669 // Button was held for a second, begin recording
670 if (button_pressed > 0 && cardRead == 0)
671 {
672 LEDsoff();
673 LED(selected + 1, 0);
674 LED(LED_RED2, 0);
675
676 // record
677 DbpString("Starting recording");
678
679 // wait for button to be released
680 while(BUTTON_PRESS())
681 WDT_HIT();
682
683 /* need this delay to prevent catching some weird data */
684 SpinDelay(500);
685
686 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
687 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
688
689 LEDsoff();
690 LED(selected + 1, 0);
691 // Finished recording
692 // If we were previously playing, set playing off
693 // so next button push begins playing what we recorded
694 playing = 0;
695 cardRead = 1;
696 }
697 else if (button_pressed > 0 && cardRead == 1) {
698 LEDsoff();
699 LED(selected + 1, 0);
700 LED(LED_ORANGE, 0);
701
702 // record
703 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
704
705 // wait for button to be released
706 while(BUTTON_PRESS())
707 WDT_HIT();
708
709 /* need this delay to prevent catching some weird data */
710 SpinDelay(500);
711
712 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
713 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
714
715 LEDsoff();
716 LED(selected + 1, 0);
717 // Finished recording
718
719 // If we were previously playing, set playing off
720 // so next button push begins playing what we recorded
721 playing = 0;
722 cardRead = 0;
723 }
724
725 // Change where to record (or begin playing)
726 else if (button_pressed) {
727 // Next option if we were previously playing
728 if (playing)
729 selected = (selected + 1) % OPTS;
730 playing = !playing;
731
732 LEDsoff();
733 LED(selected + 1, 0);
734
735 // Begin transmitting
736 if (playing)
737 {
738 LED(LED_GREEN, 0);
739 DbpString("Playing");
740 // wait for button to be released
741 while(BUTTON_PRESS())
742 WDT_HIT();
743
744 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
745 CmdHIDsimTAG(high[selected], low[selected], 0);
746 DbpString("Done playing");
747
748 if (BUTTON_HELD(1000) > 0) {
749 DbpString("Exiting");
750 LEDsoff();
751 return;
752 }
753
754 /* We pressed a button so ignore it here with a delay */
755 SpinDelay(300);
756
757 // when done, we're done playing, move to next option
758 selected = (selected + 1) % OPTS;
759 playing = !playing;
760 LEDsoff();
761 LED(selected + 1, 0);
762 }
763 else
764 while(BUTTON_PRESS())
765 WDT_HIT();
766 }
767 }
768 }
769
770 #endif
771 /*
772 OBJECTIVE
773 Listen and detect an external reader. Determine the best location
774 for the antenna.
775
776 INSTRUCTIONS:
777 Inside the ListenReaderField() function, there is two mode.
778 By default, when you call the function, you will enter mode 1.
779 If you press the PM3 button one time, you will enter mode 2.
780 If you press the PM3 button a second time, you will exit the function.
781
782 DESCRIPTION OF MODE 1:
783 This mode just listens for an external reader field and lights up green
784 for HF and/or red for LF. This is the original mode of the detectreader
785 function.
786
787 DESCRIPTION OF MODE 2:
788 This mode will visually represent, using the LEDs, the actual strength of the
789 current compared to the maximum current detected. Basically, once you know
790 what kind of external reader is present, it will help you spot the best location to place
791 your antenna. You will probably not get some good results if there is a LF and a HF reader
792 at the same place! :-)
793
794 LIGHT SCHEME USED:
795 */
796 static const char LIGHT_SCHEME[] = {
797 0x0, /* ---- | No field detected */
798 0x1, /* X--- | 14% of maximum current detected */
799 0x2, /* -X-- | 29% of maximum current detected */
800 0x4, /* --X- | 43% of maximum current detected */
801 0x8, /* ---X | 57% of maximum current detected */
802 0xC, /* --XX | 71% of maximum current detected */
803 0xE, /* -XXX | 86% of maximum current detected */
804 0xF, /* XXXX | 100% of maximum current detected */
805 };
806 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
807
808 void ListenReaderField(int limit) {
809 #define LF_ONLY 1
810 #define HF_ONLY 2
811 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
812
813 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
814 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
815 int mode=1, display_val, display_max, i;
816
817 // switch off FPGA - we don't want to measure our own signal
818 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
819 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
820
821 LEDsoff();
822
823 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
824
825 if(limit != HF_ONLY) {
826 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
827 lf_baseline = lf_av;
828 }
829
830 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
831
832 if (limit != LF_ONLY) {
833 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
834 hf_baseline = hf_av;
835 }
836
837 for(;;) {
838 if (BUTTON_PRESS()) {
839 SpinDelay(500);
840 switch (mode) {
841 case 1:
842 mode=2;
843 DbpString("Signal Strength Mode");
844 break;
845 case 2:
846 default:
847 DbpString("Stopped");
848 LEDsoff();
849 return;
850 break;
851 }
852 }
853 WDT_HIT();
854
855 if (limit != HF_ONLY) {
856 if(mode == 1) {
857 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
858 LED_D_ON();
859 else
860 LED_D_OFF();
861 }
862
863 lf_av_new = AvgAdc(ADC_CHAN_LF);
864 // see if there's a significant change
865 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
866 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
867 lf_av = lf_av_new;
868 if (lf_av > lf_max)
869 lf_max = lf_av;
870 }
871 }
872
873 if (limit != LF_ONLY) {
874 if (mode == 1){
875 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
876 LED_B_ON();
877 else
878 LED_B_OFF();
879 }
880
881 hf_av_new = AvgAdc(ADC_CHAN_HF);
882 // see if there's a significant change
883 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
884 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
885 hf_av = hf_av_new;
886 if (hf_av > hf_max)
887 hf_max = hf_av;
888 }
889 }
890
891 if(mode == 2) {
892 if (limit == LF_ONLY) {
893 display_val = lf_av;
894 display_max = lf_max;
895 } else if (limit == HF_ONLY) {
896 display_val = hf_av;
897 display_max = hf_max;
898 } else { /* Pick one at random */
899 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
900 display_val = hf_av;
901 display_max = hf_max;
902 } else {
903 display_val = lf_av;
904 display_max = lf_max;
905 }
906 }
907 for (i=0; i<LIGHT_LEN; i++) {
908 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
909 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
910 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
911 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
912 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
913 break;
914 }
915 }
916 }
917 }
918 }
919
920 void UsbPacketReceived(uint8_t *packet, int len)
921 {
922 UsbCommand *c = (UsbCommand *)packet;
923
924 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
925
926 switch(c->cmd) {
927 #ifdef WITH_LF
928 case CMD_SET_LF_SAMPLING_CONFIG:
929 setSamplingConfig((sample_config *) c->d.asBytes);
930 break;
931 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
932 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
933 break;
934 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
935 ModThenAcquireRawAdcSamples125k(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
936 break;
937 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
938 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
939 break;
940 case CMD_HID_DEMOD_FSK:
941 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
942 break;
943 case CMD_HID_SIM_TAG:
944 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
945 break;
946 case CMD_FSK_SIM_TAG:
947 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
948 break;
949 case CMD_ASK_SIM_TAG:
950 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
951 break;
952 case CMD_PSK_SIM_TAG:
953 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
954 break;
955 case CMD_HID_CLONE_TAG:
956 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
957 break;
958 case CMD_IO_DEMOD_FSK:
959 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
960 break;
961 case CMD_IO_CLONE_TAG:
962 CopyIOtoT55x7(c->arg[0], c->arg[1]);
963 break;
964 case CMD_EM410X_DEMOD:
965 CmdEM410xdemod(c->arg[0], 0, 0, 1);
966 break;
967 case CMD_EM410X_WRITE_TAG:
968 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
969 break;
970 case CMD_READ_TI_TYPE:
971 ReadTItag();
972 break;
973 case CMD_WRITE_TI_TYPE:
974 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
975 break;
976 case CMD_SIMULATE_TAG_125K:
977 LED_A_ON();
978 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
979 LED_A_OFF();
980 break;
981 case CMD_LF_SIMULATE_BIDIR:
982 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
983 break;
984 case CMD_INDALA_CLONE_TAG:
985 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
986 break;
987 case CMD_INDALA_CLONE_TAG_L:
988 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
989 break;
990 case CMD_T55XX_READ_BLOCK:
991 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
992 break;
993 case CMD_T55XX_WRITE_BLOCK:
994 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
995 break;
996 case CMD_T55XX_WAKEUP:
997 T55xxWakeUp(c->arg[0]);
998 break;
999 case CMD_T55XX_RESET_READ:
1000 T55xxResetRead();
1001 break;
1002 case CMD_PCF7931_READ:
1003 ReadPCF7931();
1004 break;
1005 case CMD_PCF7931_WRITE:
1006 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1007 break;
1008 case CMD_EM4X_READ_WORD:
1009 EM4xReadWord(c->arg[0], c->arg[1], c->arg[2]);
1010 break;
1011 case CMD_EM4X_WRITE_WORD:
1012 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1013 break;
1014 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1015 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1016 break;
1017 case CMD_VIKING_CLONE_TAG:
1018 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1019 break;
1020 case CMD_COTAG:
1021 Cotag(c->arg[0]);
1022 break;
1023 #endif
1024
1025 #ifdef WITH_HITAG
1026 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1027 SnoopHitag(c->arg[0]);
1028 break;
1029 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1030 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1031 break;
1032 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1033 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1034 break;
1035 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1036 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1037 break;
1038 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1039 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1040 break;
1041 case CMD_READ_HITAG_S: //Reader for only Hitag S tags, args = key or challenge
1042 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1043 break;
1044 case CMD_WR_HITAG_S: //writer for Hitag tags args=data to write,page and key or challenge
1045 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1046 break;
1047 #endif
1048
1049 #ifdef WITH_ISO15693
1050 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1051 AcquireRawAdcSamplesIso15693();
1052 break;
1053 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1054 RecordRawAdcSamplesIso15693();
1055 break;
1056 case CMD_ISO_15693_COMMAND:
1057 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1058 break;
1059 case CMD_ISO_15693_FIND_AFI:
1060 BruteforceIso15693Afi(c->arg[0]);
1061 break;
1062 case CMD_ISO_15693_DEBUG:
1063 SetDebugIso15693(c->arg[0]);
1064 break;
1065 case CMD_READER_ISO_15693:
1066 ReaderIso15693(c->arg[0]);
1067 break;
1068 case CMD_SIMTAG_ISO_15693:
1069 SimTagIso15693(c->arg[0], c->d.asBytes);
1070 break;
1071 #endif
1072
1073 #ifdef WITH_LEGICRF
1074 case CMD_SIMULATE_TAG_LEGIC_RF:
1075 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1076 break;
1077 case CMD_WRITER_LEGIC_RF:
1078 LegicRfWriter( c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1079 break;
1080 case CMD_READER_LEGIC_RF:
1081 LegicRfReader(c->arg[0], c->arg[1], c->arg[2]);
1082 break;
1083 case CMD_LEGIC_INFO:
1084 LegicRfInfo();
1085 break;
1086 case CMD_LEGIC_ESET:
1087 LegicEMemSet(c->arg[0], c->arg[1], c->d.asBytes);
1088 break;
1089 #endif
1090
1091 #ifdef WITH_ISO14443b
1092 case CMD_READ_SRI_TAG:
1093 ReadSTMemoryIso14443b(c->arg[0]);
1094 break;
1095 case CMD_SNOOP_ISO_14443B:
1096 SnoopIso14443b();
1097 break;
1098 case CMD_SIMULATE_TAG_ISO_14443B:
1099 SimulateIso14443bTag(c->arg[0]);
1100 break;
1101 case CMD_ISO_14443B_COMMAND:
1102 //SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1103 SendRawCommand14443B_Ex(c);
1104 break;
1105 #endif
1106
1107 #ifdef WITH_ISO14443a
1108 case CMD_SNOOP_ISO_14443a:
1109 SniffIso14443a(c->arg[0]);
1110 break;
1111 case CMD_READER_ISO_14443a:
1112 ReaderIso14443a(c);
1113 break;
1114 case CMD_SIMULATE_TAG_ISO_14443a:
1115 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1116 break;
1117 case CMD_EPA_PACE_COLLECT_NONCE:
1118 EPA_PACE_Collect_Nonce(c);
1119 break;
1120 case CMD_EPA_PACE_REPLAY:
1121 EPA_PACE_Replay(c);
1122 break;
1123 case CMD_READER_MIFARE:
1124 ReaderMifare(c->arg[0], c->arg[1], c->arg[2]);
1125 break;
1126 case CMD_MIFARE_READBL:
1127 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1128 break;
1129 case CMD_MIFAREU_READBL:
1130 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1131 break;
1132 case CMD_MIFAREUC_AUTH:
1133 MifareUC_Auth(c->arg[0],c->d.asBytes);
1134 break;
1135 case CMD_MIFAREU_READCARD:
1136 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1137 break;
1138 case CMD_MIFAREUC_SETPWD:
1139 MifareUSetPwd(c->arg[0], c->d.asBytes);
1140 break;
1141 case CMD_MIFARE_READSC:
1142 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1143 break;
1144 case CMD_MIFARE_WRITEBL:
1145 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1146 break;
1147 //case CMD_MIFAREU_WRITEBL_COMPAT:
1148 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1149 //break;
1150 case CMD_MIFAREU_WRITEBL:
1151 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1152 break;
1153 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1154 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_NESTED:
1157 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1158 break;
1159 case CMD_MIFARE_CHKKEYS:
1160 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1161 break;
1162 case CMD_SIMULATE_MIFARE_CARD:
1163 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1164 break;
1165
1166 // emulator
1167 case CMD_MIFARE_SET_DBGMODE:
1168 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1169 break;
1170 case CMD_MIFARE_EML_MEMCLR:
1171 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1172 break;
1173 case CMD_MIFARE_EML_MEMSET:
1174 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1175 break;
1176 case CMD_MIFARE_EML_MEMGET:
1177 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1178 break;
1179 case CMD_MIFARE_EML_CARDLOAD:
1180 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1181 break;
1182
1183 // Work with "magic Chinese" card
1184 case CMD_MIFARE_CSETBLOCK:
1185 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1186 break;
1187 case CMD_MIFARE_CGETBLOCK:
1188 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1189 break;
1190 case CMD_MIFARE_CIDENT:
1191 MifareCIdent();
1192 break;
1193
1194 // mifare sniffer
1195 case CMD_MIFARE_SNIFFER:
1196 SniffMifare(c->arg[0]);
1197 break;
1198
1199 //mifare desfire
1200 case CMD_MIFARE_DESFIRE_READBL: break;
1201 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1202 case CMD_MIFARE_DESFIRE_AUTH1:
1203 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1204 break;
1205 case CMD_MIFARE_DESFIRE_AUTH2:
1206 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1207 break;
1208 case CMD_MIFARE_DES_READER:
1209 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1210 break;
1211 case CMD_MIFARE_DESFIRE_INFO:
1212 MifareDesfireGetInformation();
1213 break;
1214 case CMD_MIFARE_DESFIRE:
1215 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1216 break;
1217 case CMD_MIFARE_COLLECT_NONCES:
1218 break;
1219 #endif
1220 #ifdef WITH_EMV
1221 case CMD_EMV_TRANSACTION:
1222 EMVTransaction();
1223 break;
1224 case CMD_EMV_GET_RANDOM_NUM:
1225 //EMVgetUDOL();
1226 break;
1227 case CMD_EMV_LOAD_VALUE:
1228 EMVloadvalue(c->arg[0], c->d.asBytes);
1229 break;
1230 case CMD_EMV_DUMP_CARD:
1231 EMVdumpcard();
1232 break;
1233 /*
1234 case CMD_EMV_READ_RECORD:
1235 EMVReadRecord(c->arg[0], c->arg[1], NULL);
1236 break;
1237 case CMD_EMV_CLONE:
1238 EMVClone(c->arg[0], c->arg[1]);
1239 break;
1240 case CMD_EMV_SIM:
1241 EMVSim();
1242 break;
1243 case CMD_EMV_TEST:
1244 EMVTest();
1245 break;
1246 case CMD_EMV_FUZZ_RATS:
1247 EMVFuzz_RATS(c->arg[0],c->d.asBytes);
1248 break;
1249 */
1250 #endif
1251 #ifdef WITH_ICLASS
1252 // Makes use of ISO14443a FPGA Firmware
1253 case CMD_SNOOP_ICLASS:
1254 SnoopIClass();
1255 break;
1256 case CMD_SIMULATE_TAG_ICLASS:
1257 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1258 break;
1259 case CMD_READER_ICLASS:
1260 ReaderIClass(c->arg[0]);
1261 break;
1262 case CMD_READER_ICLASS_REPLAY:
1263 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1264 break;
1265 case CMD_ICLASS_EML_MEMSET:
1266 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1267 break;
1268 case CMD_ICLASS_WRITEBLOCK:
1269 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1270 break;
1271 case CMD_ICLASS_READCHECK: // auth step 1
1272 iClass_ReadCheck(c->arg[0], c->arg[1]);
1273 break;
1274 case CMD_ICLASS_READBLOCK:
1275 iClass_ReadBlk(c->arg[0]);
1276 break;
1277 case CMD_ICLASS_AUTHENTICATION: //check
1278 iClass_Authentication(c->d.asBytes);
1279 break;
1280 case CMD_ICLASS_DUMP:
1281 iClass_Dump(c->arg[0], c->arg[1]);
1282 break;
1283 case CMD_ICLASS_CLONE:
1284 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1285 break;
1286 #endif
1287 #ifdef WITH_HFSNOOP
1288 case CMD_HF_SNIFFER:
1289 HfSnoop(c->arg[0], c->arg[1]);
1290 break;
1291 #endif
1292
1293 case CMD_BUFF_CLEAR:
1294 BigBuf_Clear();
1295 break;
1296
1297 case CMD_MEASURE_ANTENNA_TUNING:
1298 MeasureAntennaTuning();
1299 break;
1300
1301 case CMD_MEASURE_ANTENNA_TUNING_HF:
1302 MeasureAntennaTuningHf();
1303 break;
1304
1305 case CMD_LISTEN_READER_FIELD:
1306 ListenReaderField(c->arg[0]);
1307 break;
1308
1309 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1310 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1311 SpinDelay(200);
1312 LED_D_OFF(); // LED D indicates field ON or OFF
1313 break;
1314
1315 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1316 LED_B_ON();
1317 uint8_t *BigBuf = BigBuf_get_addr();
1318 size_t len = 0;
1319 size_t startidx = c->arg[0];
1320 uint8_t isok = FALSE;
1321 // arg0 = startindex
1322 // arg1 = length bytes to transfer
1323 // arg2 = RFU
1324 //Dbprintf("transfer to client parameters: %" PRIu64 " | %" PRIu64 " | %" PRIu64, c->arg[0], c->arg[1], c->arg[2]);
1325
1326 for(size_t i = 0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1327 len = MIN( (c->arg[1] - i), USB_CMD_DATA_SIZE);
1328 isok = cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, i, len, BigBuf_get_traceLen(), BigBuf + startidx + i, len);
1329 if (!isok)
1330 Dbprintf("transfer to client failed :: | bytes %d", len);
1331 }
1332 // Trigger a finish downloading signal with an ACK frame
1333 cmd_send(CMD_ACK, 1, 0, BigBuf_get_traceLen(), getSamplingConfig(), sizeof(sample_config));
1334 LED_B_OFF();
1335 break;
1336 }
1337 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1338 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1339 // to be able to use this one for uploading data to device
1340 // arg1 = 0 upload for LF usage
1341 // 1 upload for HF usage
1342 if ( c->arg[1] == 0 )
1343 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1344 else
1345 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1346 uint8_t *b = BigBuf_get_addr();
1347 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1348 cmd_send(CMD_ACK,1,0,0,0,0);
1349 break;
1350 }
1351 case CMD_DOWNLOAD_EML_BIGBUF: {
1352 LED_B_ON();
1353 uint8_t *cardmem = BigBuf_get_EM_addr();
1354 size_t len = 0;
1355 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1356 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1357 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1358 }
1359 // Trigger a finish downloading signal with an ACK frame
1360 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1361 LED_B_OFF();
1362 break;
1363 }
1364 case CMD_READ_MEM:
1365 ReadMem(c->arg[0]);
1366 break;
1367
1368 case CMD_SET_LF_DIVISOR:
1369 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1370 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1371 break;
1372
1373 case CMD_SET_ADC_MUX:
1374 switch(c->arg[0]) {
1375 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1376 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1377 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1378 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1379 }
1380 break;
1381
1382 case CMD_VERSION:
1383 SendVersion();
1384 break;
1385 case CMD_STATUS:
1386 SendStatus();
1387 break;
1388 case CMD_PING:
1389 cmd_send(CMD_ACK,0,0,0,0,0);
1390 break;
1391 #ifdef WITH_LCD
1392 case CMD_LCD_RESET:
1393 LCDReset();
1394 break;
1395 case CMD_LCD:
1396 LCDSend(c->arg[0]);
1397 break;
1398 #endif
1399 case CMD_SETUP_WRITE:
1400 case CMD_FINISH_WRITE:
1401 case CMD_HARDWARE_RESET:
1402 usb_disable();
1403 SpinDelay(2000);
1404 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1405 for(;;) {
1406 // We're going to reset, and the bootrom will take control.
1407 }
1408 break;
1409
1410 case CMD_START_FLASH:
1411 if(common_area.flags.bootrom_present) {
1412 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1413 }
1414 usb_disable();
1415 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1416 for(;;);
1417 break;
1418
1419 case CMD_DEVICE_INFO: {
1420 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1421 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1422 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1423 break;
1424 }
1425 default:
1426 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1427 break;
1428 }
1429 }
1430
1431 void __attribute__((noreturn)) AppMain(void)
1432 {
1433 SpinDelay(100);
1434 clear_trace();
1435 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1436 /* Initialize common area */
1437 memset(&common_area, 0, sizeof(common_area));
1438 common_area.magic = COMMON_AREA_MAGIC;
1439 common_area.version = 1;
1440 }
1441 common_area.flags.osimage_present = 1;
1442
1443 LEDsoff();
1444
1445 // Init USB device
1446 usb_enable();
1447
1448 // The FPGA gets its clock from us from PCK0 output, so set that up.
1449 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1450 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1451 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1452 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1453 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK | AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1454 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1455
1456 // Reset SPI
1457 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1458 // Reset SSC
1459 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1460
1461 // Load the FPGA image, which we have stored in our flash.
1462 // (the HF version by default)
1463 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1464
1465 StartTickCount();
1466
1467 #ifdef WITH_LCD
1468 LCDInit();
1469 #endif
1470
1471 byte_t rx[sizeof(UsbCommand)];
1472 size_t rx_len;
1473
1474 for(;;) {
1475 if ( usb_poll_validate_length() ) {
1476 rx_len = usb_read(rx, sizeof(UsbCommand));
1477
1478 if (rx_len)
1479 UsbPacketReceived(rx, rx_len);
1480 }
1481 WDT_HIT();
1482
1483 #ifdef WITH_LF
1484 #ifndef WITH_ISO14443a_StandAlone
1485 if (BUTTON_HELD(1000) > 0)
1486 SamyRun();
1487 #endif
1488 #endif
1489 #ifdef WITH_ISO14443a
1490 #ifdef WITH_ISO14443a_StandAlone
1491 if (BUTTON_HELD(1000) > 0)
1492 StandAloneMode14a();
1493 #endif
1494 #endif
1495 }
1496 }
Proxmark3 GIT tracking
Impressum, Datenschutz