]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


926ac52ebbb5c362abf98ee1107ce1c2dcbc74c7
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "legicrfsim.h"
25 #include "hitag2.h"
26 #include "hitagS.h"
27 #include "iso14443b.h"
28 #include "iso15693.h"
29 #include "lfsampling.h"
30 #include "BigBuf.h"
31 #include "mifareutil.h"
32 #include "pcf7931.h"
33 #include "i2c.h"
34 #include "hfsnoop.h"
35 #include "fpgaloader.h"
36 #ifdef WITH_LCD
37 #include "LCD.h"
38 #endif
39
40 static uint32_t hw_capabilities;
41
42 // Craig Young - 14a stand-alone code
43 #ifdef WITH_ISO14443a
44 #include "iso14443a.h"
45 #endif
46
47 //=============================================================================
48 // A buffer where we can queue things up to be sent through the FPGA, for
49 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
50 // is the order in which they go out on the wire.
51 //=============================================================================
52
53 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
54 uint8_t ToSend[TOSEND_BUFFER_SIZE];
55 int ToSendMax;
56 static int ToSendBit;
57 struct common_area common_area __attribute__((section(".commonarea")));
58
59 void ToSendReset(void)
60 {
61 ToSendMax = -1;
62 ToSendBit = 8;
63 }
64
65 void ToSendStuffBit(int b)
66 {
67 if(ToSendBit >= 8) {
68 ToSendMax++;
69 ToSend[ToSendMax] = 0;
70 ToSendBit = 0;
71 }
72
73 if(b) {
74 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
75 }
76
77 ToSendBit++;
78
79 if(ToSendMax >= sizeof(ToSend)) {
80 ToSendBit = 0;
81 DbpString("ToSendStuffBit overflowed!");
82 }
83 }
84
85 //=============================================================================
86 // Debug print functions, to go out over USB, to the usual PC-side client.
87 //=============================================================================
88
89 void DbpString(char *str)
90 {
91 byte_t len = strlen(str);
92 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
93 }
94
95 #if 0
96 void DbpIntegers(int x1, int x2, int x3)
97 {
98 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
99 }
100 #endif
101
102 void Dbprintf(const char *fmt, ...) {
103 // should probably limit size here; oh well, let's just use a big buffer
104 char output_string[128];
105 va_list ap;
106
107 va_start(ap, fmt);
108 kvsprintf(fmt, output_string, 10, ap);
109 va_end(ap);
110
111 DbpString(output_string);
112 }
113
114 // prints HEX & ASCII
115 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
116 int l=0,i;
117 char ascii[9];
118
119 while (len>0) {
120 if (len>8) l=8;
121 else l=len;
122
123 memcpy(ascii,d,l);
124 ascii[l]=0;
125
126 // filter safe ascii
127 for (i=0;i<l;i++)
128 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
129
130 if (bAsci) {
131 Dbprintf("%-8s %*D",ascii,l,d," ");
132 } else {
133 Dbprintf("%*D",l,d," ");
134 }
135
136 len-=8;
137 d+=8;
138 }
139 }
140
141 //-----------------------------------------------------------------------------
142 // Read an ADC channel and block till it completes, then return the result
143 // in ADC units (0 to 1023). Also a routine to average 32 samples and
144 // return that.
145 //-----------------------------------------------------------------------------
146 static int ReadAdc(int ch)
147 {
148 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
149 // AMPL_HI is a high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
150 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
151 //
152 // The maths are:
153 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
154 //
155 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
156
157 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
158 AT91C_BASE_ADC->ADC_MR =
159 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
160 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
161 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
162
163 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
164 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
165
166 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
167
168 return AT91C_BASE_ADC->ADC_CDR[ch] & 0x3ff;
169 }
170
171 int AvgAdc(int ch) // was static - merlok
172 {
173 int i;
174 int a = 0;
175
176 for(i = 0; i < 32; i++) {
177 a += ReadAdc(ch);
178 }
179
180 return (a + 15) >> 5;
181 }
182
183 static int AvgAdc_Voltage_HF(void)
184 {
185 int AvgAdc_Voltage_Low, AvgAdc_Voltage_High;
186
187 AvgAdc_Voltage_Low= (MAX_ADC_HF_VOLTAGE_LOW * AvgAdc(ADC_CHAN_HF_LOW)) >> 10;
188 // if voltage range is about to be exceeded, use high voltage ADC channel if available (RDV40 only)
189 if (AvgAdc_Voltage_Low > MAX_ADC_HF_VOLTAGE_LOW - 300) {
190 AvgAdc_Voltage_High = (MAX_ADC_HF_VOLTAGE_HIGH * AvgAdc(ADC_CHAN_HF_HIGH)) >> 10;
191 if (AvgAdc_Voltage_High >= AvgAdc_Voltage_Low) {
192 return AvgAdc_Voltage_High;
193 }
194 }
195 return AvgAdc_Voltage_Low;
196 }
197
198 static int AvgAdc_Voltage_LF(void)
199 {
200 return (MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10;
201 }
202
203 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
204 {
205 int i, adcval = 0, peak = 0;
206
207 /*
208 * Sweeps the useful LF range of the proxmark from
209 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
210 * read the voltage in the antenna, the result left
211 * in the buffer is a graph which should clearly show
212 * the resonating frequency of your LF antenna
213 * ( hopefully around 95 if it is tuned to 125kHz!)
214 */
215
216 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
217 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
218 SpinDelay(50);
219
220 for (i=255; i>=19; i--) {
221 WDT_HIT();
222 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
223 SpinDelay(20);
224 adcval = AvgAdc_Voltage_LF();
225 if (i==95) *vLf125 = adcval; // voltage at 125Khz
226 if (i==89) *vLf134 = adcval; // voltage at 134Khz
227
228 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
229 if(LF_Results[i] > peak) {
230 *peakv = adcval;
231 peak = LF_Results[i];
232 *peakf = i;
233 //ptr = i;
234 }
235 }
236
237 for (i=18; i >= 0; i--) LF_Results[i] = 0;
238
239 return;
240 }
241
242 void MeasureAntennaTuningHfOnly(int *vHf)
243 {
244 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
245 LED_A_ON();
246 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
247 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
248 SpinDelay(20);
249 *vHf = AvgAdc_Voltage_HF();
250 LED_A_OFF();
251 return;
252 }
253
254 void MeasureAntennaTuning(int mode)
255 {
256 uint8_t LF_Results[256] = {0};
257 int peakv = 0, peakf = 0;
258 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
259
260 LED_B_ON();
261
262 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
263 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
264 MeasureAntennaTuningHfOnly(&vHf);
265 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
266 } else {
267 if (mode & FLAG_TUNE_LF) {
268 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
269 }
270 if (mode & FLAG_TUNE_HF) {
271 MeasureAntennaTuningHfOnly(&vHf);
272 }
273 }
274
275 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
276 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
277 LED_B_OFF();
278 return;
279 }
280
281 void MeasureAntennaTuningHf(void)
282 {
283 int vHf = 0; // in mV
284
285 DbpString("Measuring HF antenna, press button to exit");
286
287 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
288 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
289 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
290
291 for (;;) {
292 SpinDelay(500);
293 vHf = AvgAdc_Voltage_HF();
294
295 Dbprintf("%d mV",vHf);
296 if (BUTTON_PRESS()) break;
297 }
298 DbpString("cancelled");
299
300 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
301
302 }
303
304
305 void ReadMem(int addr)
306 {
307 const uint8_t *data = ((uint8_t *)addr);
308
309 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
310 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
311 }
312
313 /* osimage version information is linked in */
314 extern struct version_information version_information;
315 /* bootrom version information is pointed to from _bootphase1_version_pointer */
316 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
317
318
319 void set_hw_capabilities(void)
320 {
321 if (I2C_is_available()) {
322 hw_capabilities |= HAS_SMARTCARD_SLOT;
323 }
324
325 if (false) { // TODO: implement a test
326 hw_capabilities |= HAS_EXTRA_FLASH_MEM;
327 }
328 }
329
330
331 void SendVersion(void)
332 {
333 set_hw_capabilities();
334
335 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
336 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
337
338 /* Try to find the bootrom version information. Expect to find a pointer at
339 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
340 * pointer, then use it.
341 */
342 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
343 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
344 strcat(VersionString, "bootrom version information appears invalid\n");
345 } else {
346 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
347 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
348 }
349
350 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
351 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
352
353 for (int i = 0; i < fpga_bitstream_num; i++) {
354 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
355 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
356 }
357
358 // test availability of SmartCard slot
359 if (I2C_is_available()) {
360 strncat(VersionString, "SmartCard Slot: available\n", sizeof(VersionString) - strlen(VersionString) - 1);
361 } else {
362 strncat(VersionString, "SmartCard Slot: not available\n", sizeof(VersionString) - strlen(VersionString) - 1);
363 }
364
365 // Send Chip ID and used flash memory
366 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
367 uint32_t compressed_data_section_size = common_area.arg1;
368 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, hw_capabilities, VersionString, strlen(VersionString));
369 }
370
371 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
372 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
373 void printUSBSpeed(void)
374 {
375 Dbprintf("USB Speed:");
376 Dbprintf(" Sending USB packets to client...");
377
378 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
379 uint8_t *test_data = BigBuf_get_addr();
380 uint32_t end_time;
381
382 uint32_t start_time = end_time = GetTickCount();
383 uint32_t bytes_transferred = 0;
384
385 LED_B_ON();
386 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
387 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
388 end_time = GetTickCount();
389 bytes_transferred += USB_CMD_DATA_SIZE;
390 }
391 LED_B_OFF();
392
393 Dbprintf(" Time elapsed: %dms", end_time - start_time);
394 Dbprintf(" Bytes transferred: %d", bytes_transferred);
395 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
396 1000 * bytes_transferred / (end_time - start_time));
397
398 }
399
400 /**
401 * Prints runtime information about the PM3.
402 **/
403 void SendStatus(void)
404 {
405 BigBuf_print_status();
406 Fpga_print_status();
407 #ifdef WITH_SMARTCARD
408 I2C_print_status();
409 #endif
410 printConfig(); //LF Sampling config
411 printUSBSpeed();
412 Dbprintf("Various");
413 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
414 Dbprintf(" ToSendMax..........%d", ToSendMax);
415 Dbprintf(" ToSendBit..........%d", ToSendBit);
416
417 cmd_send(CMD_ACK,1,0,0,0,0);
418 }
419
420 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
421
422 #define OPTS 2
423
424 void StandAloneMode()
425 {
426 DbpString("Stand-alone mode! No PC necessary.");
427 // Oooh pretty -- notify user we're in elite samy mode now
428 LED(LED_RED, 200);
429 LED(LED_ORANGE, 200);
430 LED(LED_GREEN, 200);
431 LED(LED_ORANGE, 200);
432 LED(LED_RED, 200);
433 LED(LED_ORANGE, 200);
434 LED(LED_GREEN, 200);
435 LED(LED_ORANGE, 200);
436 LED(LED_RED, 200);
437
438 }
439
440 #endif
441
442
443
444 #ifdef WITH_ISO14443a_StandAlone
445 void StandAloneMode14a()
446 {
447 StandAloneMode();
448 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
449
450 int selected = 0;
451 bool playing = false, GotoRecord = false, GotoClone = false;
452 bool cardRead[OPTS] = {false};
453 uint8_t readUID[10] = {0};
454 uint32_t uid_1st[OPTS]={0};
455 uint32_t uid_2nd[OPTS]={0};
456 uint32_t uid_tmp1 = 0;
457 uint32_t uid_tmp2 = 0;
458 iso14a_card_select_t hi14a_card[OPTS];
459
460 LED(selected + 1, 0);
461
462 for (;;)
463 {
464 usb_poll();
465 WDT_HIT();
466 SpinDelay(300);
467
468 if (GotoRecord || !cardRead[selected])
469 {
470 GotoRecord = false;
471 LEDsoff();
472 LED(selected + 1, 0);
473 LED(LED_RED2, 0);
474
475 // record
476 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
477 /* need this delay to prevent catching some weird data */
478 SpinDelay(500);
479 /* Code for reading from 14a tag */
480 uint8_t uid[10] ={0};
481 uint32_t cuid;
482 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
483
484 for ( ; ; )
485 {
486 WDT_HIT();
487 if (BUTTON_PRESS()) {
488 if (cardRead[selected]) {
489 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
490 break;
491 }
492 else if (cardRead[(selected+1)%OPTS]) {
493 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
494 selected = (selected+1)%OPTS;
495 break;
496 }
497 else {
498 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
499 SpinDelay(300);
500 }
501 }
502 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
503 continue;
504 else
505 {
506 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
507 memcpy(readUID,uid,10*sizeof(uint8_t));
508 uint8_t *dst = (uint8_t *)&uid_tmp1;
509 // Set UID byte order
510 for (int i=0; i<4; i++)
511 dst[i] = uid[3-i];
512 dst = (uint8_t *)&uid_tmp2;
513 for (int i=0; i<4; i++)
514 dst[i] = uid[7-i];
515 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
516 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
517 }
518 else {
519 if (uid_tmp2) {
520 Dbprintf("Bank[%d] received a 7-byte UID",selected);
521 uid_1st[selected] = (uid_tmp1)>>8;
522 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
523 }
524 else {
525 Dbprintf("Bank[%d] received a 4-byte UID",selected);
526 uid_1st[selected] = uid_tmp1;
527 uid_2nd[selected] = uid_tmp2;
528 }
529 break;
530 }
531 }
532 }
533 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
534 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
535 LEDsoff();
536 LED(LED_GREEN, 200);
537 LED(LED_ORANGE, 200);
538 LED(LED_GREEN, 200);
539 LED(LED_ORANGE, 200);
540
541 LEDsoff();
542 LED(selected + 1, 0);
543
544 // Next state is replay:
545 playing = true;
546
547 cardRead[selected] = true;
548 }
549 /* MF Classic UID clone */
550 else if (GotoClone)
551 {
552 GotoClone=false;
553 LEDsoff();
554 LED(selected + 1, 0);
555 LED(LED_ORANGE, 250);
556
557
558 // record
559 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
560
561 // wait for button to be released
562 while(BUTTON_PRESS())
563 {
564 // Delay cloning until card is in place
565 WDT_HIT();
566 }
567 Dbprintf("Starting clone. [Bank: %u]", selected);
568 // need this delay to prevent catching some weird data
569 SpinDelay(500);
570 // Begin clone function here:
571 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
572 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
573 memcpy(c.d.asBytes, data, 16);
574 SendCommand(&c);
575
576 Block read is similar:
577 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
578 We need to imitate that call with blockNo 0 to set a uid.
579
580 The get and set commands are handled in this file:
581 // Work with "magic Chinese" card
582 case CMD_MIFARE_CSETBLOCK:
583 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
584 break;
585 case CMD_MIFARE_CGETBLOCK:
586 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
587 break;
588
589 mfCSetUID provides example logic for UID set workflow:
590 -Read block0 from card in field with MifareCGetBlock()
591 -Configure new values without replacing reserved bytes
592 memcpy(block0, uid, 4); // Copy UID bytes from byte array
593 // Mifare UID BCC
594 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
595 Bytes 5-7 are reserved SAK and ATQA for mifare classic
596 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
597 */
598 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
599 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
600 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
601 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
602 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
603 playing = true;
604 }
605 else {
606 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
607 memcpy(newBlock0,oldBlock0,16);
608 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
609
610 newBlock0[0] = uid_1st[selected]>>24;
611 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
612 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
613 newBlock0[3] = 0xFF & (uid_1st[selected]);
614 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
615 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
616 MifareCSetBlock(0, 0xFF,0, newBlock0);
617 MifareCGetBlock(0x3F, 1, 0, testBlock0);
618 if (memcmp(testBlock0,newBlock0,16)==0)
619 {
620 DbpString("Cloned successfull!");
621 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
622 playing = false;
623 GotoRecord = true;
624 selected = (selected+1) % OPTS;
625 }
626 else {
627 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
628 playing = true;
629 }
630 }
631 LEDsoff();
632 LED(selected + 1, 0);
633
634 }
635 // Change where to record (or begin playing)
636 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
637 {
638 LEDsoff();
639 LED(selected + 1, 0);
640
641 // Begin transmitting
642 LED(LED_GREEN, 0);
643 DbpString("Playing");
644 for ( ; ; ) {
645 WDT_HIT();
646 int button_action = BUTTON_HELD(1000);
647 if (button_action == 0) { // No button action, proceed with sim
648 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
649 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
650 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
651 DbpString("Mifare Classic");
652 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
653 }
654 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
655 DbpString("Mifare Ultralight");
656 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
657 }
658 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
659 DbpString("Mifare DESFire");
660 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
661 }
662 else {
663 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
664 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
665 }
666 }
667 else if (button_action == BUTTON_SINGLE_CLICK) {
668 selected = (selected + 1) % OPTS;
669 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
670 GotoRecord = true;
671 break;
672 }
673 else if (button_action == BUTTON_HOLD) {
674 Dbprintf("Playtime over. Begin cloning...");
675 GotoClone = true;
676 break;
677 }
678 WDT_HIT();
679 }
680
681 /* We pressed a button so ignore it here with a delay */
682 SpinDelay(300);
683 LEDsoff();
684 LED(selected + 1, 0);
685 }
686 }
687 }
688 #elif WITH_LF_StandAlone
689 // samy's sniff and repeat routine
690 void SamyRun()
691 {
692 StandAloneMode();
693 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
694
695 int tops[OPTS], high[OPTS], low[OPTS];
696 int selected = 0;
697 int playing = 0;
698 int cardRead = 0;
699
700 // Turn on selected LED
701 LED(selected + 1, 0);
702
703 for (;;)
704 {
705 usb_poll();
706 WDT_HIT();
707
708 // Was our button held down or pressed?
709 int button_pressed = BUTTON_HELD(1000);
710 SpinDelay(300);
711
712 // Button was held for a second, begin recording
713 if (button_pressed > 0 && cardRead == 0)
714 {
715 LEDsoff();
716 LED(selected + 1, 0);
717 LED(LED_RED2, 0);
718
719 // record
720 DbpString("Starting recording");
721
722 // wait for button to be released
723 while(BUTTON_PRESS())
724 WDT_HIT();
725
726 /* need this delay to prevent catching some weird data */
727 SpinDelay(500);
728
729 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
730 if (tops[selected] > 0)
731 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
732 else
733 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
734
735 LEDsoff();
736 LED(selected + 1, 0);
737 // Finished recording
738
739 // If we were previously playing, set playing off
740 // so next button push begins playing what we recorded
741 playing = 0;
742
743 cardRead = 1;
744
745 }
746
747 else if (button_pressed > 0 && cardRead == 1)
748 {
749 LEDsoff();
750 LED(selected + 1, 0);
751 LED(LED_ORANGE, 0);
752
753 // record
754 if (tops[selected] > 0)
755 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
756 else
757 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
758
759 // wait for button to be released
760 while(BUTTON_PRESS())
761 WDT_HIT();
762
763 /* need this delay to prevent catching some weird data */
764 SpinDelay(500);
765
766 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)), 0x1D);
767 if (tops[selected] > 0)
768 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
769 else
770 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
771
772 LEDsoff();
773 LED(selected + 1, 0);
774 // Finished recording
775
776 // If we were previously playing, set playing off
777 // so next button push begins playing what we recorded
778 playing = 0;
779
780 cardRead = 0;
781
782 }
783
784 // Change where to record (or begin playing)
785 else if (button_pressed)
786 {
787 // Next option if we were previously playing
788 if (playing)
789 selected = (selected + 1) % OPTS;
790 playing = !playing;
791
792 LEDsoff();
793 LED(selected + 1, 0);
794
795 // Begin transmitting
796 if (playing)
797 {
798 LED(LED_GREEN, 0);
799 DbpString("Playing");
800 // wait for button to be released
801 while(BUTTON_PRESS())
802 WDT_HIT();
803 if (tops[selected] > 0)
804 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
805 else
806 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
807
808 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
809 DbpString("Done playing");
810 if (BUTTON_HELD(1000) > 0)
811 {
812 DbpString("Exiting");
813 LEDsoff();
814 return;
815 }
816
817 /* We pressed a button so ignore it here with a delay */
818 SpinDelay(300);
819
820 // when done, we're done playing, move to next option
821 selected = (selected + 1) % OPTS;
822 playing = !playing;
823 LEDsoff();
824 LED(selected + 1, 0);
825 }
826 else
827 while(BUTTON_PRESS())
828 WDT_HIT();
829 }
830 }
831 }
832
833 #endif
834 /*
835 OBJECTIVE
836 Listen and detect an external reader. Determine the best location
837 for the antenna.
838
839 INSTRUCTIONS:
840 Inside the ListenReaderField() function, there is two mode.
841 By default, when you call the function, you will enter mode 1.
842 If you press the PM3 button one time, you will enter mode 2.
843 If you press the PM3 button a second time, you will exit the function.
844
845 DESCRIPTION OF MODE 1:
846 This mode just listens for an external reader field and lights up green
847 for HF and/or red for LF. This is the original mode of the detectreader
848 function.
849
850 DESCRIPTION OF MODE 2:
851 This mode will visually represent, using the LEDs, the actual strength of the
852 current compared to the maximum current detected. Basically, once you know
853 what kind of external reader is present, it will help you spot the best location to place
854 your antenna. You will probably not get some good results if there is a LF and a HF reader
855 at the same place! :-)
856
857 LIGHT SCHEME USED:
858 */
859 static const char LIGHT_SCHEME[] = {
860 0x0, /* ---- | No field detected */
861 0x1, /* X--- | 14% of maximum current detected */
862 0x2, /* -X-- | 29% of maximum current detected */
863 0x4, /* --X- | 43% of maximum current detected */
864 0x8, /* ---X | 57% of maximum current detected */
865 0xC, /* --XX | 71% of maximum current detected */
866 0xE, /* -XXX | 86% of maximum current detected */
867 0xF, /* XXXX | 100% of maximum current detected */
868 };
869 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
870
871 void ListenReaderField(int limit)
872 {
873 int lf_av, lf_av_new=0, lf_baseline= 0, lf_max;
874 int hf_av, hf_av_new=0, hf_baseline= 0, hf_max;
875 int mode=1, display_val, display_max, i;
876
877 #define LF_ONLY 1
878 #define HF_ONLY 2
879 #define REPORT_CHANGE_PERCENT 5 // report new values only if they have changed at least by REPORT_CHANGE_PERCENT
880 #define MIN_HF_FIELD 300 // in mode 1 signal HF field greater than MIN_HF_FIELD above baseline
881 #define MIN_LF_FIELD 1200 // in mode 1 signal LF field greater than MIN_LF_FIELD above baseline
882
883
884 // switch off FPGA - we don't want to measure our own signal
885 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
886 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
887
888 LEDsoff();
889
890 lf_av = lf_max = AvgAdc_Voltage_LF();
891
892 if(limit != HF_ONLY) {
893 Dbprintf("LF 125/134kHz Baseline: %dmV", lf_av);
894 lf_baseline = lf_av;
895 }
896
897 hf_av = hf_max = AvgAdc_Voltage_HF();
898
899 if (limit != LF_ONLY) {
900 Dbprintf("HF 13.56MHz Baseline: %dmV", hf_av);
901 hf_baseline = hf_av;
902 }
903
904 for(;;) {
905 SpinDelay(500);
906 if (BUTTON_PRESS()) {
907 switch (mode) {
908 case 1:
909 mode=2;
910 DbpString("Signal Strength Mode");
911 break;
912 case 2:
913 default:
914 DbpString("Stopped");
915 LEDsoff();
916 return;
917 break;
918 }
919 while (BUTTON_PRESS());
920 }
921 WDT_HIT();
922
923 if (limit != HF_ONLY) {
924 if(mode == 1) {
925 if (lf_av - lf_baseline > MIN_LF_FIELD)
926 LED_D_ON();
927 else
928 LED_D_OFF();
929 }
930
931 lf_av_new = AvgAdc_Voltage_LF();
932 // see if there's a significant change
933 if (ABS((lf_av - lf_av_new)*100/(lf_av?lf_av:1)) > REPORT_CHANGE_PERCENT) {
934 Dbprintf("LF 125/134kHz Field Change: %5dmV", lf_av_new);
935 lf_av = lf_av_new;
936 if (lf_av > lf_max)
937 lf_max = lf_av;
938 }
939 }
940
941 if (limit != LF_ONLY) {
942 if (mode == 1){
943 if (hf_av - hf_baseline > MIN_HF_FIELD)
944 LED_B_ON();
945 else
946 LED_B_OFF();
947 }
948
949 hf_av_new = AvgAdc_Voltage_HF();
950
951 // see if there's a significant change
952 if (ABS((hf_av - hf_av_new)*100/(hf_av?hf_av:1)) > REPORT_CHANGE_PERCENT) {
953 Dbprintf("HF 13.56MHz Field Change: %5dmV", hf_av_new);
954 hf_av = hf_av_new;
955 if (hf_av > hf_max)
956 hf_max = hf_av;
957 }
958 }
959
960 if(mode == 2) {
961 if (limit == LF_ONLY) {
962 display_val = lf_av;
963 display_max = lf_max;
964 } else if (limit == HF_ONLY) {
965 display_val = hf_av;
966 display_max = hf_max;
967 } else { /* Pick one at random */
968 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
969 display_val = hf_av;
970 display_max = hf_max;
971 } else {
972 display_val = lf_av;
973 display_max = lf_max;
974 }
975 }
976 for (i=0; i<LIGHT_LEN; i++) {
977 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
978 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
979 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
980 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
981 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
982 break;
983 }
984 }
985 }
986 }
987 }
988
989 void UsbPacketReceived(uint8_t *packet, int len)
990 {
991 UsbCommand *c = (UsbCommand *)packet;
992
993 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
994
995 switch(c->cmd) {
996 #ifdef WITH_LF
997 case CMD_SET_LF_SAMPLING_CONFIG:
998 setSamplingConfig((sample_config *) c->d.asBytes);
999 break;
1000 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1001 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
1002 break;
1003 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
1004 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1005 break;
1006 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
1007 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
1008 break;
1009 case CMD_HID_DEMOD_FSK:
1010 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
1011 break;
1012 case CMD_HID_SIM_TAG:
1013 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
1014 break;
1015 case CMD_FSK_SIM_TAG:
1016 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1017 break;
1018 case CMD_ASK_SIM_TAG:
1019 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1020 break;
1021 case CMD_PSK_SIM_TAG:
1022 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1023 break;
1024 case CMD_HID_CLONE_TAG:
1025 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x1D);
1026 break;
1027 case CMD_PARADOX_CLONE_TAG:
1028 // Paradox cards are the same as HID, with a different preamble, so we can reuse the same function
1029 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x0F);
1030 break;
1031 case CMD_IO_DEMOD_FSK:
1032 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
1033 break;
1034 case CMD_IO_CLONE_TAG:
1035 CopyIOtoT55x7(c->arg[0], c->arg[1]);
1036 break;
1037 case CMD_EM410X_DEMOD:
1038 CmdEM410xdemod(c->arg[0], 0, 0, 1);
1039 break;
1040 case CMD_EM410X_WRITE_TAG:
1041 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
1042 break;
1043 case CMD_READ_TI_TYPE:
1044 ReadTItag();
1045 break;
1046 case CMD_WRITE_TI_TYPE:
1047 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
1048 break;
1049 case CMD_SIMULATE_TAG_125K:
1050 LED_A_ON();
1051 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
1052 LED_A_OFF();
1053 break;
1054 case CMD_LF_SIMULATE_BIDIR:
1055 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1056 break;
1057 case CMD_INDALA_CLONE_TAG:
1058 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1059 break;
1060 case CMD_INDALA_CLONE_TAG_L:
1061 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1062 break;
1063 case CMD_T55XX_READ_BLOCK:
1064 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1065 break;
1066 case CMD_T55XX_WRITE_BLOCK:
1067 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1068 break;
1069 case CMD_T55XX_WAKEUP:
1070 T55xxWakeUp(c->arg[0]);
1071 break;
1072 case CMD_T55XX_RESET_READ:
1073 T55xxResetRead();
1074 break;
1075 case CMD_PCF7931_READ:
1076 ReadPCF7931();
1077 break;
1078 case CMD_PCF7931_WRITE:
1079 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1080 break;
1081 case CMD_PCF7931_BRUTEFORCE:
1082 BruteForcePCF7931(c->arg[0], (c->arg[1] & 0xFF), c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128);
1083 break;
1084 case CMD_EM4X_READ_WORD:
1085 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1086 break;
1087 case CMD_EM4X_WRITE_WORD:
1088 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1089 break;
1090 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1091 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1092 break;
1093 case CMD_VIKING_CLONE_TAG:
1094 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1095 break;
1096 case CMD_COTAG:
1097 Cotag(c->arg[0]);
1098 break;
1099 #endif
1100
1101 #ifdef WITH_HITAG
1102 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1103 SnoopHitag(c->arg[0]);
1104 break;
1105 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1106 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1107 break;
1108 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1109 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1110 break;
1111 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1112 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1113 break;
1114 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1115 check_challenges_cmd((bool)c->arg[0], (byte_t*)c->d.asBytes, (uint8_t)c->arg[1]);
1116 break;
1117 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1118 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], false);
1119 break;
1120 case CMD_READ_HITAG_S_BLK:
1121 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], true);
1122 break;
1123 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1124 if ((hitag_function)c->arg[0] < 10) {
1125 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1126 }
1127 else if ((hitag_function)c->arg[0] >= 10) {
1128 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1129 }
1130 break;
1131 #endif
1132
1133 #ifdef WITH_ISO15693
1134 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1135 AcquireRawAdcSamplesIso15693();
1136 break;
1137
1138 case CMD_SNOOP_ISO_15693:
1139 SnoopIso15693();
1140 break;
1141
1142 case CMD_ISO_15693_COMMAND:
1143 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1144 break;
1145
1146 case CMD_ISO_15693_FIND_AFI:
1147 BruteforceIso15693Afi(c->arg[0]);
1148 break;
1149
1150 case CMD_ISO_15693_DEBUG:
1151 SetDebugIso15693(c->arg[0]);
1152 break;
1153
1154 case CMD_READER_ISO_15693:
1155 ReaderIso15693(c->arg[0]);
1156 break;
1157 case CMD_SIMTAG_ISO_15693:
1158 SimTagIso15693(c->arg[0], c->d.asBytes);
1159 break;
1160 #endif
1161
1162 #ifdef WITH_LEGICRF
1163 case CMD_SIMULATE_TAG_LEGIC_RF:
1164 LegicRfSimulate(c->arg[0]);
1165 break;
1166
1167 case CMD_WRITER_LEGIC_RF:
1168 LegicRfWriter(c->arg[1], c->arg[0]);
1169 break;
1170
1171 case CMD_READER_LEGIC_RF:
1172 LegicRfReader(c->arg[0], c->arg[1]);
1173 break;
1174 #endif
1175
1176 #ifdef WITH_ISO14443b
1177 case CMD_READ_SRI512_TAG:
1178 ReadSTMemoryIso14443b(0x0F);
1179 break;
1180 case CMD_READ_SRIX4K_TAG:
1181 ReadSTMemoryIso14443b(0x7F);
1182 break;
1183 case CMD_SNOOP_ISO_14443B:
1184 SnoopIso14443b();
1185 break;
1186 case CMD_SIMULATE_TAG_ISO_14443B:
1187 SimulateIso14443bTag();
1188 break;
1189 case CMD_ISO_14443B_COMMAND:
1190 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1191 break;
1192 #endif
1193
1194 #ifdef WITH_ISO14443a
1195 case CMD_SNOOP_ISO_14443a:
1196 SnoopIso14443a(c->arg[0]);
1197 break;
1198 case CMD_READER_ISO_14443a:
1199 ReaderIso14443a(c);
1200 break;
1201 case CMD_SIMULATE_TAG_ISO_14443a:
1202 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1203 break;
1204
1205 case CMD_EPA_PACE_COLLECT_NONCE:
1206 EPA_PACE_Collect_Nonce(c);
1207 break;
1208 case CMD_EPA_PACE_REPLAY:
1209 EPA_PACE_Replay(c);
1210 break;
1211
1212 case CMD_READER_MIFARE:
1213 ReaderMifare(c->arg[0]);
1214 break;
1215 case CMD_MIFARE_READBL:
1216 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1217 break;
1218 case CMD_MIFAREU_READBL:
1219 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1220 break;
1221 case CMD_MIFAREUC_AUTH:
1222 MifareUC_Auth(c->arg[0],c->d.asBytes);
1223 break;
1224 case CMD_MIFAREU_READCARD:
1225 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1226 break;
1227 case CMD_MIFAREUC_SETPWD:
1228 MifareUSetPwd(c->arg[0], c->d.asBytes);
1229 break;
1230 case CMD_MIFARE_READSC:
1231 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1232 break;
1233 case CMD_MIFARE_WRITEBL:
1234 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1235 break;
1236 //case CMD_MIFAREU_WRITEBL_COMPAT:
1237 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1238 //break;
1239 case CMD_MIFAREU_WRITEBL:
1240 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1241 break;
1242 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1243 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1244 break;
1245 case CMD_MIFARE_NESTED:
1246 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1247 break;
1248 case CMD_MIFARE_CHKKEYS:
1249 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1250 break;
1251 case CMD_SIMULATE_MIFARE_CARD:
1252 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1253 break;
1254
1255 // emulator
1256 case CMD_MIFARE_SET_DBGMODE:
1257 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1258 break;
1259 case CMD_MIFARE_EML_MEMCLR:
1260 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1261 break;
1262 case CMD_MIFARE_EML_MEMSET:
1263 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1264 break;
1265 case CMD_MIFARE_EML_MEMGET:
1266 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1267 break;
1268 case CMD_MIFARE_EML_CARDLOAD:
1269 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1270 break;
1271
1272 // Work with "magic Chinese" card
1273 case CMD_MIFARE_CWIPE:
1274 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1275 break;
1276 case CMD_MIFARE_CSETBLOCK:
1277 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1278 break;
1279 case CMD_MIFARE_CGETBLOCK:
1280 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1281 break;
1282 case CMD_MIFARE_CIDENT:
1283 MifareCIdent();
1284 break;
1285
1286 // mifare sniffer
1287 case CMD_MIFARE_SNIFFER:
1288 SniffMifare(c->arg[0]);
1289 break;
1290
1291 #endif
1292
1293 #ifdef WITH_ICLASS
1294 // Makes use of ISO14443a FPGA Firmware
1295 case CMD_SNOOP_ICLASS:
1296 SnoopIClass();
1297 break;
1298 case CMD_SIMULATE_TAG_ICLASS:
1299 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1300 break;
1301 case CMD_READER_ICLASS:
1302 ReaderIClass(c->arg[0]);
1303 break;
1304 case CMD_READER_ICLASS_REPLAY:
1305 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1306 break;
1307 case CMD_ICLASS_EML_MEMSET:
1308 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1309 break;
1310 case CMD_ICLASS_WRITEBLOCK:
1311 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1312 break;
1313 case CMD_ICLASS_READCHECK: // auth step 1
1314 iClass_ReadCheck(c->arg[0], c->arg[1]);
1315 break;
1316 case CMD_ICLASS_READBLOCK:
1317 iClass_ReadBlk(c->arg[0]);
1318 break;
1319 case CMD_ICLASS_AUTHENTICATION: //check
1320 iClass_Authentication(c->d.asBytes);
1321 break;
1322 case CMD_ICLASS_DUMP:
1323 iClass_Dump(c->arg[0], c->arg[1]);
1324 break;
1325 case CMD_ICLASS_CLONE:
1326 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1327 break;
1328 #endif
1329
1330 #ifdef WITH_HFSNOOP
1331 case CMD_HF_SNIFFER:
1332 HfSnoop(c->arg[0], c->arg[1]);
1333 break;
1334 case CMD_HF_PLOT:
1335 HfPlot();
1336 break;
1337 #endif
1338
1339 #ifdef WITH_SMARTCARD
1340 case CMD_SMART_ATR: {
1341 SmartCardAtr();
1342 break;
1343 }
1344 case CMD_SMART_SETCLOCK:{
1345 SmartCardSetClock(c->arg[0]);
1346 break;
1347 }
1348 case CMD_SMART_RAW: {
1349 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1350 break;
1351 }
1352 case CMD_SMART_UPLOAD: {
1353 // upload file from client
1354 uint8_t *mem = BigBuf_get_addr();
1355 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1356 cmd_send(CMD_ACK,1,0,0,0,0);
1357 break;
1358 }
1359 case CMD_SMART_UPGRADE: {
1360 SmartCardUpgrade(c->arg[0]);
1361 break;
1362 }
1363 #endif
1364
1365 case CMD_BUFF_CLEAR:
1366 BigBuf_Clear();
1367 break;
1368
1369 case CMD_MEASURE_ANTENNA_TUNING:
1370 MeasureAntennaTuning(c->arg[0]);
1371 break;
1372
1373 case CMD_MEASURE_ANTENNA_TUNING_HF:
1374 MeasureAntennaTuningHf();
1375 break;
1376
1377 case CMD_LISTEN_READER_FIELD:
1378 ListenReaderField(c->arg[0]);
1379 break;
1380
1381 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1382 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1383 SpinDelay(200);
1384 LED_D_OFF(); // LED D indicates field ON or OFF
1385 break;
1386
1387 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1388 LED_B_ON();
1389 uint8_t *BigBuf = BigBuf_get_addr();
1390 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1391 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1392 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1393 }
1394 // Trigger a finish downloading signal with an ACK frame
1395 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1396 LED_B_OFF();
1397 break;
1398
1399 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1400 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1401 // to be able to use this one for uploading data to device
1402 // arg1 = 0 upload for LF usage
1403 // 1 upload for HF usage
1404 if (c->arg[1] == 0)
1405 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1406 else
1407 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1408
1409 uint8_t *b = BigBuf_get_addr();
1410 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1411 cmd_send(CMD_ACK,0,0,0,0,0);
1412 break;
1413 }
1414 case CMD_READ_MEM:
1415 ReadMem(c->arg[0]);
1416 break;
1417
1418 case CMD_SET_LF_DIVISOR:
1419 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1420 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1421 break;
1422
1423 case CMD_SET_ADC_MUX:
1424 switch(c->arg[0]) {
1425 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1426 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1427 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1428 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1429 }
1430 break;
1431
1432 case CMD_VERSION:
1433 SendVersion();
1434 break;
1435 case CMD_STATUS:
1436 SendStatus();
1437 break;
1438 case CMD_PING:
1439 cmd_send(CMD_ACK,0,0,0,0,0);
1440 break;
1441 #ifdef WITH_LCD
1442 case CMD_LCD_RESET:
1443 LCDReset();
1444 break;
1445 case CMD_LCD:
1446 LCDSend(c->arg[0]);
1447 break;
1448 #endif
1449 case CMD_SETUP_WRITE:
1450 case CMD_FINISH_WRITE:
1451 case CMD_HARDWARE_RESET:
1452 usb_disable();
1453 SpinDelay(1000);
1454 SpinDelay(1000);
1455 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1456 for(;;) {
1457 // We're going to reset, and the bootrom will take control.
1458 }
1459 break;
1460
1461 case CMD_START_FLASH:
1462 if(common_area.flags.bootrom_present) {
1463 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1464 }
1465 usb_disable();
1466 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1467 for(;;);
1468 break;
1469
1470 case CMD_DEVICE_INFO: {
1471 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1472 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1473 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1474 break;
1475 }
1476 default:
1477 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1478 break;
1479 }
1480 }
1481
1482 void __attribute__((noreturn)) AppMain(void)
1483 {
1484 SpinDelay(100);
1485 clear_trace();
1486 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1487 /* Initialize common area */
1488 memset(&common_area, 0, sizeof(common_area));
1489 common_area.magic = COMMON_AREA_MAGIC;
1490 common_area.version = 1;
1491 }
1492 common_area.flags.osimage_present = 1;
1493
1494 LEDsoff();
1495
1496 // Init USB device
1497 usb_enable();
1498
1499 // The FPGA gets its clock from us from PCK0 output, so set that up.
1500 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1501 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1502 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1503 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1504 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1505 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1506 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1507
1508 // Reset SPI
1509 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1510 // Reset SSC
1511 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1512
1513 // Load the FPGA image, which we have stored in our flash.
1514 // (the HF version by default)
1515 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1516
1517 StartTickCount();
1518
1519 #ifdef WITH_LCD
1520 LCDInit();
1521 #endif
1522
1523 byte_t rx[sizeof(UsbCommand)];
1524 size_t rx_len;
1525
1526 for(;;) {
1527 if (usb_poll()) {
1528 rx_len = usb_read(rx,sizeof(UsbCommand));
1529 if (rx_len) {
1530 UsbPacketReceived(rx,rx_len);
1531 }
1532 }
1533 WDT_HIT();
1534
1535 #ifdef WITH_LF_StandAlone
1536 #ifndef WITH_ISO14443a_StandAlone
1537 if (BUTTON_HELD(1000) > 0)
1538 SamyRun();
1539 #endif
1540 #endif
1541 #ifdef WITH_ISO14443a
1542 #ifdef WITH_ISO14443a_StandAlone
1543 if (BUTTON_HELD(1000) > 0)
1544 StandAloneMode14a();
1545 #endif
1546 #endif
1547 }
1548 }
Proxmark3 GIT tracking
Impressum, Datenschutz