1 //-----------------------------------------------------------------------------
2 // The main application code. This is the first thing called after start.c
4 // Jonathan Westhues, Mar 2006
5 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
6 //-----------------------------------------------------------------------------
17 #define va_list __builtin_va_list
18 #define va_start __builtin_va_start
19 #define va_arg __builtin_va_arg
20 #define va_end __builtin_va_end
21 int kvsprintf(char const *fmt
, void *arg
, int radix
, va_list ap
);
23 //=============================================================================
24 // A buffer where we can queue things up to be sent through the FPGA, for
25 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
26 // is the order in which they go out on the wire.
27 //=============================================================================
32 struct common_area common_area
__attribute__((section(".commonarea")));
34 void BufferClear(void)
36 memset(BigBuf
,0,sizeof(BigBuf
));
37 DbpString("Buffer cleared");
40 void ToSendReset(void)
46 void ToSendStuffBit(int b
)
50 ToSend
[ToSendMax
] = 0;
55 ToSend
[ToSendMax
] |= (1 << (7 - ToSendBit
));
60 if(ToSendBit
>= sizeof(ToSend
)) {
62 DbpString("ToSendStuffBit overflowed!");
66 //=============================================================================
67 // Debug print functions, to go out over USB, to the usual PC-side client.
68 //=============================================================================
70 void DbpString(char *str
)
72 /* this holds up stuff unless we're connected to usb */
77 c
.cmd
= CMD_DEBUG_PRINT_STRING
;
78 c
.arg
[0] = strlen(str
);
79 memcpy(c
.d
.asBytes
, str
, c
.arg
[0]);
81 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
82 // TODO fix USB so stupid things like this aren't req'd
86 void DbpIntegers(int x1
, int x2
, int x3
)
88 /* this holds up stuff unless we're connected to usb */
93 c
.cmd
= CMD_DEBUG_PRINT_INTEGERS
;
98 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
103 void Dbprintf(const char *fmt
, ...) {
104 // should probably limit size here; oh well, let's just use a big buffer
105 char output_string
[128];
109 kvsprintf(fmt
, output_string
, 10, ap
);
112 DbpString(output_string
);
115 //-----------------------------------------------------------------------------
116 // Read an ADC channel and block till it completes, then return the result
117 // in ADC units (0 to 1023). Also a routine to average 32 samples and
119 //-----------------------------------------------------------------------------
120 static int ReadAdc(int ch
)
124 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_SWRST
;
125 AT91C_BASE_ADC
->ADC_MR
=
126 ADC_MODE_PRESCALE(32) |
127 ADC_MODE_STARTUP_TIME(16) |
128 ADC_MODE_SAMPLE_HOLD_TIME(8);
129 AT91C_BASE_ADC
->ADC_CHER
= ADC_CHANNEL(ch
);
131 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
;
132 while(!(AT91C_BASE_ADC
->ADC_SR
& ADC_END_OF_CONVERSION(ch
)))
134 d
= AT91C_BASE_ADC
->ADC_CDR
[ch
];
139 static int AvgAdc(int ch
)
144 for(i
= 0; i
< 32; i
++) {
148 return (a
+ 15) >> 5;
151 void MeasureAntennaTuning(void)
153 BYTE
*dest
= (BYTE
*)BigBuf
;
154 int i
, ptr
= 0, adcval
= 0, peak
= 0, peakv
= 0, peakf
= 0;;
155 int vLf125
= 0, vLf134
= 0, vHf
= 0; // in mV
159 DbpString("Measuring antenna characteristics, please wait.");
160 memset(BigBuf
,0,sizeof(BigBuf
));
163 * Sweeps the useful LF range of the proxmark from
164 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
165 * read the voltage in the antenna, the result left
166 * in the buffer is a graph which should clearly show
167 * the resonating frequency of your LF antenna
168 * ( hopefully around 95 if it is tuned to 125kHz!)
170 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
171 for (i
=255; i
>19; i
--) {
172 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, i
);
174 // Vref = 3.3V, and a 10000:240 voltage divider on the input
175 // can measure voltages up to 137500 mV
176 adcval
= ((137500 * AvgAdc(ADC_CHAN_LF
)) >> 10);
177 if (i
==95) vLf125
= adcval
; // voltage at 125Khz
178 if (i
==89) vLf134
= adcval
; // voltage at 134Khz
180 dest
[i
] = adcval
>>8; // scale int to fit in byte for graphing purposes
189 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
190 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
192 // Vref = 3300mV, and an 10:1 voltage divider on the input
193 // can measure voltages up to 33000 mV
194 vHf
= (33000 * AvgAdc(ADC_CHAN_HF
)) >> 10;
196 c
.cmd
= CMD_MEASURED_ANTENNA_TUNING
;
197 c
.arg
[0] = (vLf125
<< 0) | (vLf134
<< 16);
199 c
.arg
[2] = peakf
| (peakv
<< 16);
200 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
203 void SimulateTagHfListen(void)
205 BYTE
*dest
= (BYTE
*)BigBuf
;
206 int n
= sizeof(BigBuf
);
211 // We're using this mode just so that I can test it out; the simulated
212 // tag mode would work just as well and be simpler.
213 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
| FPGA_HF_READER_RX_XCORR_SNOOP
);
215 // We need to listen to the high-frequency, peak-detected path.
216 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
222 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
223 AT91C_BASE_SSC
->SSC_THR
= 0xff;
225 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
226 BYTE r
= (BYTE
)AT91C_BASE_SSC
->SSC_RHR
;
246 DbpString("simulate tag (now type bitsamples)");
249 void ReadMem(int addr
)
251 const DWORD
*data
= ((DWORD
*)addr
);
254 DbpString("Reading memory at address");
255 DbpIntegers(0, 0, addr
);
256 for (i
= 0; i
< 8; i
+= 2)
257 DbpIntegers(0, data
[i
], data
[i
+1]);
260 /* osimage version information is linked in */
261 extern struct version_information version_information
;
262 /* bootrom version information is pointed to from _bootphase1_version_pointer */
263 extern char *_bootphase1_version_pointer
, _flash_start
, _flash_end
;
264 void SendVersion(void)
266 char temp
[48]; /* Limited data payload in USB packets */
267 DbpString("Prox/RFID mark3 RFID instrument");
269 /* Try to find the bootrom version information. Expect to find a pointer at
270 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
271 * pointer, then use it.
273 char *bootrom_version
= *(char**)&_bootphase1_version_pointer
;
274 if( bootrom_version
< &_flash_start
|| bootrom_version
>= &_flash_end
) {
275 DbpString("bootrom version information appears invalid");
277 FormatVersionInformation(temp
, sizeof(temp
), "bootrom: ", bootrom_version
);
281 FormatVersionInformation(temp
, sizeof(temp
), "os: ", &version_information
);
284 FpgaGatherVersion(temp
, sizeof(temp
));
289 // samy's sniff and repeat routine
292 DbpString("Stand-alone mode! No PC necessary.");
294 // 3 possible options? no just 2 for now
297 int high
[OPTS
], low
[OPTS
];
299 // Oooh pretty -- notify user we're in elite samy mode now
301 LED(LED_ORANGE
, 200);
303 LED(LED_ORANGE
, 200);
305 LED(LED_ORANGE
, 200);
307 LED(LED_ORANGE
, 200);
313 // Turn on selected LED
314 LED(selected
+ 1, 0);
321 // Was our button held down or pressed?
322 int button_pressed
= BUTTON_HELD(1000);
325 // Button was held for a second, begin recording
326 if (button_pressed
> 0)
329 LED(selected
+ 1, 0);
333 DbpString("Starting recording");
335 // wait for button to be released
336 while(BUTTON_PRESS())
339 /* need this delay to prevent catching some weird data */
342 CmdHIDdemodFSK(1, &high
[selected
], &low
[selected
], 0);
343 DbpString("Recorded");
344 DbpIntegers(selected
, high
[selected
], low
[selected
]);
347 LED(selected
+ 1, 0);
348 // Finished recording
350 // If we were previously playing, set playing off
351 // so next button push begins playing what we recorded
355 // Change where to record (or begin playing)
356 else if (button_pressed
)
358 // Next option if we were previously playing
360 selected
= (selected
+ 1) % OPTS
;
364 LED(selected
+ 1, 0);
366 // Begin transmitting
370 DbpString("Playing");
371 // wait for button to be released
372 while(BUTTON_PRESS())
374 DbpIntegers(selected
, high
[selected
], low
[selected
]);
375 CmdHIDsimTAG(high
[selected
], low
[selected
], 0);
376 DbpString("Done playing");
377 if (BUTTON_HELD(1000) > 0)
379 DbpString("Exiting");
384 /* We pressed a button so ignore it here with a delay */
387 // when done, we're done playing, move to next option
388 selected
= (selected
+ 1) % OPTS
;
391 LED(selected
+ 1, 0);
394 while(BUTTON_PRESS())
403 Listen and detect an external reader. Determine the best location
407 Inside the ListenReaderField() function, there is two mode.
408 By default, when you call the function, you will enter mode 1.
409 If you press the PM3 button one time, you will enter mode 2.
410 If you press the PM3 button a second time, you will exit the function.
412 DESCRIPTION OF MODE 1:
413 This mode just listens for an external reader field and lights up green
414 for HF and/or red for LF. This is the original mode of the detectreader
417 DESCRIPTION OF MODE 2:
418 This mode will visually represent, using the LEDs, the actual strength of the
419 current compared to the maximum current detected. Basically, once you know
420 what kind of external reader is present, it will help you spot the best location to place
421 your antenna. You will probably not get some good results if there is a LF and a HF reader
422 at the same place! :-)
426 static const char LIGHT_SCHEME
[] = {
427 0x0, /* ---- | No field detected */
428 0x1, /* X--- | 14% of maximum current detected */
429 0x2, /* -X-- | 29% of maximum current detected */
430 0x4, /* --X- | 43% of maximum current detected */
431 0x8, /* ---X | 57% of maximum current detected */
432 0xC, /* --XX | 71% of maximum current detected */
433 0xE, /* -XXX | 86% of maximum current detected */
434 0xF, /* XXXX | 100% of maximum current detected */
436 static const int LIGHT_LEN
= sizeof(LIGHT_SCHEME
)/sizeof(LIGHT_SCHEME
[0]);
438 void ListenReaderField(int limit
)
440 int lf_av
, lf_av_new
, lf_baseline
= 0, lf_count
= 0, lf_max
;
441 int hf_av
, hf_av_new
, hf_baseline
= 0, hf_count
= 0, hf_max
;
442 int mode
=1, display_val
, display_max
, i
;
449 lf_av
=lf_max
=ReadAdc(ADC_CHAN_LF
);
451 if(limit
!= HF_ONLY
) {
452 DbpString("LF 125/134 Baseline:");
453 DbpIntegers(lf_av
,0,0);
457 hf_av
=hf_max
=ReadAdc(ADC_CHAN_HF
);
459 if (limit
!= LF_ONLY
) {
460 DbpString("HF 13.56 Baseline:");
461 DbpIntegers(hf_av
,0,0);
466 if (BUTTON_PRESS()) {
471 DbpString("Signal Strength Mode");
475 DbpString("Stopped");
483 if (limit
!= HF_ONLY
) {
485 if (abs(lf_av
- lf_baseline
) > 10) LED_D_ON();
490 lf_av_new
= ReadAdc(ADC_CHAN_LF
);
491 // see if there's a significant change
492 if(abs(lf_av
- lf_av_new
) > 10) {
493 DbpString("LF 125/134 Field Change:");
494 DbpIntegers(lf_av
,lf_av_new
,lf_count
);
502 if (limit
!= LF_ONLY
) {
504 if (abs(hf_av
- hf_baseline
) > 10) LED_B_ON();
509 hf_av_new
= ReadAdc(ADC_CHAN_HF
);
510 // see if there's a significant change
511 if(abs(hf_av
- hf_av_new
) > 10) {
512 DbpString("HF 13.56 Field Change:");
513 DbpIntegers(hf_av
,hf_av_new
,hf_count
);
522 if (limit
== LF_ONLY
) {
524 display_max
= lf_max
;
525 } else if (limit
== HF_ONLY
) {
527 display_max
= hf_max
;
528 } else { /* Pick one at random */
529 if( (hf_max
- hf_baseline
) > (lf_max
- lf_baseline
) ) {
531 display_max
= hf_max
;
534 display_max
= lf_max
;
537 for (i
=0; i
<LIGHT_LEN
; i
++) {
538 if (display_val
>= ((display_max
/LIGHT_LEN
)*i
) && display_val
<= ((display_max
/LIGHT_LEN
)*(i
+1))) {
539 if (LIGHT_SCHEME
[i
] & 0x1) LED_C_ON(); else LED_C_OFF();
540 if (LIGHT_SCHEME
[i
] & 0x2) LED_A_ON(); else LED_A_OFF();
541 if (LIGHT_SCHEME
[i
] & 0x4) LED_B_ON(); else LED_B_OFF();
542 if (LIGHT_SCHEME
[i
] & 0x8) LED_D_ON(); else LED_D_OFF();
550 void UsbPacketReceived(BYTE
*packet
, int len
)
552 UsbCommand
*c
= (UsbCommand
*)packet
;
556 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
:
557 AcquireRawAdcSamples125k(c
->arg
[0]);
562 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
:
563 ModThenAcquireRawAdcSamples125k(c
->arg
[0],c
->arg
[1],c
->arg
[2],c
->d
.asBytes
);
568 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693
:
569 AcquireRawAdcSamplesIso15693();
578 case CMD_READER_ISO_15693
:
579 ReaderIso15693(c
->arg
[0]);
583 case CMD_READER_LEGIC_RF
:
588 case CMD_SIMTAG_ISO_15693
:
589 SimTagIso15693(c
->arg
[0]);
593 #ifdef WITH_ISO14443b
594 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443
:
595 AcquireRawAdcSamplesIso14443(c
->arg
[0]);
599 #ifdef WITH_ISO14443b
600 case CMD_READ_SRI512_TAG
:
601 ReadSRI512Iso14443(c
->arg
[0]);
603 case CMD_READ_SRIX4K_TAG
:
604 ReadSRIX4KIso14443(c
->arg
[0]);
608 #ifdef WITH_ISO14443a
609 case CMD_READER_ISO_14443a
:
610 ReaderIso14443a(c
->arg
[0]);
614 #ifdef WITH_ISO14443a
615 case CMD_READER_MIFARE
:
616 ReaderMifare(c
->arg
[0]);
620 #ifdef WITH_ISO14443b
621 case CMD_SNOOP_ISO_14443
:
626 #ifdef WITH_ISO14443a
627 case CMD_SNOOP_ISO_14443a
:
632 case CMD_SIMULATE_TAG_HF_LISTEN
:
633 SimulateTagHfListen();
636 #ifdef WITH_ISO14443b
637 case CMD_SIMULATE_TAG_ISO_14443
:
638 SimulateIso14443Tag();
642 #ifdef WITH_ISO14443a
643 case CMD_SIMULATE_TAG_ISO_14443a
:
644 SimulateIso14443aTag(c
->arg
[0], c
->arg
[1]); // ## Simulate iso14443a tag - pass tag type & UID
648 case CMD_MEASURE_ANTENNA_TUNING
:
649 MeasureAntennaTuning();
652 case CMD_LISTEN_READER_FIELD
:
653 ListenReaderField(c
->arg
[0]);
657 case CMD_HID_DEMOD_FSK
:
658 CmdHIDdemodFSK(0, 0, 0, 1); // Demodulate HID tag
663 case CMD_HID_SIM_TAG
:
664 CmdHIDsimTAG(c
->arg
[0], c
->arg
[1], 1); // Simulate HID tag by ID
668 case CMD_FPGA_MAJOR_MODE_OFF
: // ## FPGA Control
669 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
671 LED_D_OFF(); // LED D indicates field ON or OFF
675 case CMD_READ_TI_TYPE
:
681 case CMD_WRITE_TI_TYPE
:
682 WriteTItag(c
->arg
[0],c
->arg
[1],c
->arg
[2]);
686 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
: {
688 if(c
->cmd
== CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
) {
689 n
.cmd
= CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K
;
691 n
.cmd
= CMD_DOWNLOADED_RAW_BITS_TI_TYPE
;
693 n
.arg
[0] = c
->arg
[0];
694 memcpy(n
.d
.asDwords
, BigBuf
+c
->arg
[0], 12*sizeof(DWORD
));
695 UsbSendPacket((BYTE
*)&n
, sizeof(n
));
699 case CMD_DOWNLOADED_SIM_SAMPLES_125K
: {
700 BYTE
*b
= (BYTE
*)BigBuf
;
701 memcpy(b
+c
->arg
[0], c
->d
.asBytes
, 48);
706 case CMD_SIMULATE_TAG_125K
:
708 SimulateTagLowFrequency(c
->arg
[0], 1);
717 case CMD_SET_LF_DIVISOR
:
718 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, c
->arg
[0]);
721 case CMD_SET_ADC_MUX
:
723 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD
); break;
724 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW
); break;
725 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD
); break;
726 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW
); break;
735 case CMD_LF_SIMULATE_BIDIR
:
736 SimulateTagLowFrequencyBidir(c
->arg
[0], c
->arg
[1]);
748 case CMD_SETUP_WRITE
:
749 case CMD_FINISH_WRITE
:
750 case CMD_HARDWARE_RESET
:
751 USB_D_PLUS_PULLUP_OFF();
754 AT91C_BASE_RSTC
->RSTC_RCR
= RST_CONTROL_KEY
| AT91C_RSTC_PROCRST
;
756 // We're going to reset, and the bootrom will take control.
760 case CMD_START_FLASH
:
761 if(common_area
.flags
.bootrom_present
) {
762 common_area
.command
= COMMON_AREA_COMMAND_ENTER_FLASH_MODE
;
764 USB_D_PLUS_PULLUP_OFF();
765 AT91C_BASE_RSTC
->RSTC_RCR
= RST_CONTROL_KEY
| AT91C_RSTC_PROCRST
;
769 case CMD_DEVICE_INFO
: {
771 c
.cmd
= CMD_DEVICE_INFO
;
772 c
.arg
[0] = DEVICE_INFO_FLAG_OSIMAGE_PRESENT
| DEVICE_INFO_FLAG_CURRENT_MODE_OS
;
773 if(common_area
.flags
.bootrom_present
) c
.arg
[0] |= DEVICE_INFO_FLAG_BOOTROM_PRESENT
;
774 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
778 DbpString("unknown command");
783 void __attribute__((noreturn
)) AppMain(void)
787 if(common_area
.magic
!= COMMON_AREA_MAGIC
|| common_area
.version
!= 1) {
788 /* Initialize common area */
789 memset(&common_area
, 0, sizeof(common_area
));
790 common_area
.magic
= COMMON_AREA_MAGIC
;
791 common_area
.version
= 1;
793 common_area
.flags
.osimage_present
= 1;
802 // The FPGA gets its clock from us from PCK0 output, so set that up.
803 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_PCK0
;
804 AT91C_BASE_PIOA
->PIO_PDR
= GPIO_PCK0
;
805 AT91C_BASE_PMC
->PMC_SCER
= AT91C_PMC_PCK0
;
806 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
807 AT91C_BASE_PMC
->PMC_PCKR
[0] = AT91C_PMC_CSS_PLL_CLK
|
808 AT91C_PMC_PRES_CLK_4
;
809 AT91C_BASE_PIOA
->PIO_OER
= GPIO_PCK0
;
812 AT91C_BASE_SPI
->SPI_CR
= AT91C_SPI_SWRST
;
814 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_SWRST
;
816 // Load the FPGA image, which we have stored in our flash.
823 // test text on different colored backgrounds
824 LCDString(" The quick brown fox ", (char *)&FONT6x8
,1,1+8*0,WHITE
,BLACK
);
825 LCDString(" jumped over the ", (char *)&FONT6x8
,1,1+8*1,BLACK
,WHITE
);
826 LCDString(" lazy dog. ", (char *)&FONT6x8
,1,1+8*2,YELLOW
,RED
);
827 LCDString(" AaBbCcDdEeFfGgHhIiJj ", (char *)&FONT6x8
,1,1+8*3,RED
,GREEN
);
828 LCDString(" KkLlMmNnOoPpQqRrSsTt ", (char *)&FONT6x8
,1,1+8*4,MAGENTA
,BLUE
);
829 LCDString("UuVvWwXxYyZz0123456789", (char *)&FONT6x8
,1,1+8*5,BLUE
,YELLOW
);
830 LCDString("`-=[]_;',./~!@#$%^&*()", (char *)&FONT6x8
,1,1+8*6,BLACK
,CYAN
);
831 LCDString(" _+{}|:\\\"<>? ",(char *)&FONT6x8
,1,1+8*7,BLUE
,MAGENTA
);
834 LCDFill(0, 1+8* 8, 132, 8, BLACK
);
835 LCDFill(0, 1+8* 9, 132, 8, WHITE
);
836 LCDFill(0, 1+8*10, 132, 8, RED
);
837 LCDFill(0, 1+8*11, 132, 8, GREEN
);
838 LCDFill(0, 1+8*12, 132, 8, BLUE
);
839 LCDFill(0, 1+8*13, 132, 8, YELLOW
);
840 LCDFill(0, 1+8*14, 132, 8, CYAN
);
841 LCDFill(0, 1+8*15, 132, 8, MAGENTA
);
850 if (BUTTON_HELD(1000) > 0)