]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: the option to simulate tnp3xxx inthe command "hf mf sim"
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "../common/usb_cdc.h"
14 #include "../common/cmd.h"
15
16 #include "../include/proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21 #include <stdarg.h>
22
23
24 #include "legicrf.h"
25 #include "../include/hitag2.h"
26
27
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 #define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34 //=============================================================================
35 // A buffer where we can queue things up to be sent through the FPGA, for
36 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
37 // is the order in which they go out on the wire.
38 //=============================================================================
39
40 uint8_t ToSend[512];
41 int ToSendMax;
42 static int ToSendBit;
43 struct common_area common_area __attribute__((section(".commonarea")));
44
45 void BufferClear(void)
46 {
47 memset(BigBuf,0,sizeof(BigBuf));
48 Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
49 }
50
51 void ToSendReset(void)
52 {
53 ToSendMax = -1;
54 ToSendBit = 8;
55 }
56
57 void ToSendStuffBit(int b)
58 {
59 if(ToSendBit >= 8) {
60 ToSendMax++;
61 ToSend[ToSendMax] = 0;
62 ToSendBit = 0;
63 }
64
65 if(b) {
66 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
67 }
68
69 ToSendBit++;
70
71 if(ToSendBit >= sizeof(ToSend)) {
72 ToSendBit = 0;
73 DbpString("ToSendStuffBit overflowed!");
74 }
75 }
76
77 //=============================================================================
78 // Debug print functions, to go out over USB, to the usual PC-side client.
79 //=============================================================================
80
81 void DbpString(char *str)
82 {
83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
85 }
86
87 #if 0
88 void DbpIntegers(int x1, int x2, int x3)
89 {
90 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
91 }
92 #endif
93
94 void Dbprintf(const char *fmt, ...) {
95 // should probably limit size here; oh well, let's just use a big buffer
96 char output_string[128];
97 va_list ap;
98
99 va_start(ap, fmt);
100 kvsprintf(fmt, output_string, 10, ap);
101 va_end(ap);
102
103 DbpString(output_string);
104 }
105
106 // prints HEX & ASCII
107 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
108 int l=0,i;
109 char ascii[9];
110
111 while (len>0) {
112 if (len>8) l=8;
113 else l=len;
114
115 memcpy(ascii,d,l);
116 ascii[l]=0;
117
118 // filter safe ascii
119 for (i=0;i<l;i++)
120 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
121
122 if (bAsci) {
123 Dbprintf("%-8s %*D",ascii,l,d," ");
124 } else {
125 Dbprintf("%*D",l,d," ");
126 }
127
128 len-=8;
129 d+=8;
130 }
131 }
132
133 //-----------------------------------------------------------------------------
134 // Read an ADC channel and block till it completes, then return the result
135 // in ADC units (0 to 1023). Also a routine to average 32 samples and
136 // return that.
137 //-----------------------------------------------------------------------------
138 static int ReadAdc(int ch)
139 {
140 uint32_t d;
141
142 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
143 AT91C_BASE_ADC->ADC_MR =
144 ADC_MODE_PRESCALE(32) |
145 ADC_MODE_STARTUP_TIME(16) |
146 ADC_MODE_SAMPLE_HOLD_TIME(8);
147 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
148
149 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
150 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
151 ;
152 d = AT91C_BASE_ADC->ADC_CDR[ch];
153
154 return d;
155 }
156
157 int AvgAdc(int ch) // was static - merlok
158 {
159 int i;
160 int a = 0;
161
162 for(i = 0; i < 32; i++) {
163 a += ReadAdc(ch);
164 }
165
166 return (a + 15) >> 5;
167 }
168
169 void MeasureAntennaTuning(void)
170 {
171 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
172 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
173 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
174
175 LED_B_ON();
176 DbpString("Measuring antenna characteristics, please wait...");
177 memset(dest,0,sizeof(FREE_BUFFER_SIZE));
178
179 /*
180 * Sweeps the useful LF range of the proxmark from
181 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
182 * read the voltage in the antenna, the result left
183 * in the buffer is a graph which should clearly show
184 * the resonating frequency of your LF antenna
185 * ( hopefully around 95 if it is tuned to 125kHz!)
186 */
187
188 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
189 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
190 for (i=255; i>19; i--) {
191 WDT_HIT();
192 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
193 SpinDelay(20);
194 // Vref = 3.3V, and a 10000:240 voltage divider on the input
195 // can measure voltages up to 137500 mV
196 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
197 if (i==95) vLf125 = adcval; // voltage at 125Khz
198 if (i==89) vLf134 = adcval; // voltage at 134Khz
199
200 dest[i] = adcval>>8; // scale int to fit in byte for graphing purposes
201 if(dest[i] > peak) {
202 peakv = adcval;
203 peak = dest[i];
204 peakf = i;
205 //ptr = i;
206 }
207 }
208
209 LED_A_ON();
210 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
211 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
212 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
213 SpinDelay(20);
214 // Vref = 3300mV, and an 10:1 voltage divider on the input
215 // can measure voltages up to 33000 mV
216 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
217
218 // c.cmd = CMD_MEASURED_ANTENNA_TUNING;
219 // c.arg[0] = (vLf125 << 0) | (vLf134 << 16);
220 // c.arg[1] = vHf;
221 // c.arg[2] = peakf | (peakv << 16);
222
223 DbpString("Measuring complete, sending report back to host");
224 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),0,0);
225 // UsbSendPacket((uint8_t *)&c, sizeof(c));
226 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
227 LED_A_OFF();
228 LED_B_OFF();
229 return;
230 }
231
232 void MeasureAntennaTuningHf(void)
233 {
234 int vHf = 0; // in mV
235
236 DbpString("Measuring HF antenna, press button to exit");
237
238 for (;;) {
239 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
240 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
241 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
242 SpinDelay(20);
243 // Vref = 3300mV, and an 10:1 voltage divider on the input
244 // can measure voltages up to 33000 mV
245 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
246
247 Dbprintf("%d mV",vHf);
248 if (BUTTON_PRESS()) break;
249 }
250 DbpString("cancelled");
251 }
252
253
254 void SimulateTagHfListen(void)
255 {
256 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
257 uint8_t v = 0;
258 int i;
259 int p = 0;
260
261 // We're using this mode just so that I can test it out; the simulated
262 // tag mode would work just as well and be simpler.
263 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
264 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
265
266 // We need to listen to the high-frequency, peak-detected path.
267 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
268
269 FpgaSetupSsc();
270
271 i = 0;
272 for(;;) {
273 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
274 AT91C_BASE_SSC->SSC_THR = 0xff;
275 }
276 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
277 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
278
279 v <<= 1;
280 if(r & 1) {
281 v |= 1;
282 }
283 p++;
284
285 if(p >= 8) {
286 dest[i] = v;
287 v = 0;
288 p = 0;
289 i++;
290
291 if(i >= FREE_BUFFER_SIZE) {
292 break;
293 }
294 }
295 }
296 }
297 DbpString("simulate tag (now type bitsamples)");
298 }
299
300 void ReadMem(int addr)
301 {
302 const uint8_t *data = ((uint8_t *)addr);
303
304 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
305 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
306 }
307
308 /* osimage version information is linked in */
309 extern struct version_information version_information;
310 /* bootrom version information is pointed to from _bootphase1_version_pointer */
311 extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
312 void SendVersion(void)
313 {
314 char temp[512]; /* Limited data payload in USB packets */
315 DbpString("Prox/RFID mark3 RFID instrument");
316
317 /* Try to find the bootrom version information. Expect to find a pointer at
318 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
319 * pointer, then use it.
320 */
321 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
322 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
323 DbpString("bootrom version information appears invalid");
324 } else {
325 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
326 DbpString(temp);
327 }
328
329 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
330 DbpString(temp);
331
332 FpgaGatherVersion(temp, sizeof(temp));
333 DbpString(temp);
334 // Send Chip ID
335 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
336 }
337
338 #ifdef WITH_LF
339 // samy's sniff and repeat routine
340 void SamyRun()
341 {
342 DbpString("Stand-alone mode! No PC necessary.");
343 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
344
345 // 3 possible options? no just 2 for now
346 #define OPTS 2
347
348 int high[OPTS], low[OPTS];
349
350 // Oooh pretty -- notify user we're in elite samy mode now
351 LED(LED_RED, 200);
352 LED(LED_ORANGE, 200);
353 LED(LED_GREEN, 200);
354 LED(LED_ORANGE, 200);
355 LED(LED_RED, 200);
356 LED(LED_ORANGE, 200);
357 LED(LED_GREEN, 200);
358 LED(LED_ORANGE, 200);
359 LED(LED_RED, 200);
360
361 int selected = 0;
362 int playing = 0;
363 int cardRead = 0;
364
365 // Turn on selected LED
366 LED(selected + 1, 0);
367
368 for (;;)
369 {
370 usb_poll();
371 WDT_HIT();
372
373 // Was our button held down or pressed?
374 int button_pressed = BUTTON_HELD(1000);
375 SpinDelay(300);
376
377 // Button was held for a second, begin recording
378 if (button_pressed > 0 && cardRead == 0)
379 {
380 LEDsoff();
381 LED(selected + 1, 0);
382 LED(LED_RED2, 0);
383
384 // record
385 DbpString("Starting recording");
386
387 // wait for button to be released
388 while(BUTTON_PRESS())
389 WDT_HIT();
390
391 /* need this delay to prevent catching some weird data */
392 SpinDelay(500);
393
394 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
395 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
396
397 LEDsoff();
398 LED(selected + 1, 0);
399 // Finished recording
400
401 // If we were previously playing, set playing off
402 // so next button push begins playing what we recorded
403 playing = 0;
404
405 cardRead = 1;
406
407 }
408
409 else if (button_pressed > 0 && cardRead == 1)
410 {
411 LEDsoff();
412 LED(selected + 1, 0);
413 LED(LED_ORANGE, 0);
414
415 // record
416 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
417
418 // wait for button to be released
419 while(BUTTON_PRESS())
420 WDT_HIT();
421
422 /* need this delay to prevent catching some weird data */
423 SpinDelay(500);
424
425 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
426 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
427
428 LEDsoff();
429 LED(selected + 1, 0);
430 // Finished recording
431
432 // If we were previously playing, set playing off
433 // so next button push begins playing what we recorded
434 playing = 0;
435
436 cardRead = 0;
437
438 }
439
440 // Change where to record (or begin playing)
441 else if (button_pressed)
442 {
443 // Next option if we were previously playing
444 if (playing)
445 selected = (selected + 1) % OPTS;
446 playing = !playing;
447
448 LEDsoff();
449 LED(selected + 1, 0);
450
451 // Begin transmitting
452 if (playing)
453 {
454 LED(LED_GREEN, 0);
455 DbpString("Playing");
456 // wait for button to be released
457 while(BUTTON_PRESS())
458 WDT_HIT();
459 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
460 CmdHIDsimTAG(high[selected], low[selected], 0);
461 DbpString("Done playing");
462 if (BUTTON_HELD(1000) > 0)
463 {
464 DbpString("Exiting");
465 LEDsoff();
466 return;
467 }
468
469 /* We pressed a button so ignore it here with a delay */
470 SpinDelay(300);
471
472 // when done, we're done playing, move to next option
473 selected = (selected + 1) % OPTS;
474 playing = !playing;
475 LEDsoff();
476 LED(selected + 1, 0);
477 }
478 else
479 while(BUTTON_PRESS())
480 WDT_HIT();
481 }
482 }
483 }
484 #endif
485
486 /*
487 OBJECTIVE
488 Listen and detect an external reader. Determine the best location
489 for the antenna.
490
491 INSTRUCTIONS:
492 Inside the ListenReaderField() function, there is two mode.
493 By default, when you call the function, you will enter mode 1.
494 If you press the PM3 button one time, you will enter mode 2.
495 If you press the PM3 button a second time, you will exit the function.
496
497 DESCRIPTION OF MODE 1:
498 This mode just listens for an external reader field and lights up green
499 for HF and/or red for LF. This is the original mode of the detectreader
500 function.
501
502 DESCRIPTION OF MODE 2:
503 This mode will visually represent, using the LEDs, the actual strength of the
504 current compared to the maximum current detected. Basically, once you know
505 what kind of external reader is present, it will help you spot the best location to place
506 your antenna. You will probably not get some good results if there is a LF and a HF reader
507 at the same place! :-)
508
509 LIGHT SCHEME USED:
510 */
511 static const char LIGHT_SCHEME[] = {
512 0x0, /* ---- | No field detected */
513 0x1, /* X--- | 14% of maximum current detected */
514 0x2, /* -X-- | 29% of maximum current detected */
515 0x4, /* --X- | 43% of maximum current detected */
516 0x8, /* ---X | 57% of maximum current detected */
517 0xC, /* --XX | 71% of maximum current detected */
518 0xE, /* -XXX | 86% of maximum current detected */
519 0xF, /* XXXX | 100% of maximum current detected */
520 };
521 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
522
523 void ListenReaderField(int limit)
524 {
525 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
526 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
527 int mode=1, display_val, display_max, i;
528
529 #define LF_ONLY 1
530 #define HF_ONLY 2
531
532 LEDsoff();
533
534 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
535
536 if(limit != HF_ONLY) {
537 Dbprintf("LF 125/134 Baseline: %d", lf_av);
538 lf_baseline = lf_av;
539 }
540
541 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
542
543 if (limit != LF_ONLY) {
544 Dbprintf("HF 13.56 Baseline: %d", hf_av);
545 hf_baseline = hf_av;
546 }
547
548 for(;;) {
549 if (BUTTON_PRESS()) {
550 SpinDelay(500);
551 switch (mode) {
552 case 1:
553 mode=2;
554 DbpString("Signal Strength Mode");
555 break;
556 case 2:
557 default:
558 DbpString("Stopped");
559 LEDsoff();
560 return;
561 break;
562 }
563 }
564 WDT_HIT();
565
566 if (limit != HF_ONLY) {
567 if(mode==1) {
568 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
569 else LED_D_OFF();
570 }
571
572 ++lf_count;
573 lf_av_new= ReadAdc(ADC_CHAN_LF);
574 // see if there's a significant change
575 if(abs(lf_av - lf_av_new) > 10) {
576 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
577 lf_av = lf_av_new;
578 if (lf_av > lf_max)
579 lf_max = lf_av;
580 lf_count= 0;
581 }
582 }
583
584 if (limit != LF_ONLY) {
585 if (mode == 1){
586 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
587 else LED_B_OFF();
588 }
589
590 ++hf_count;
591 hf_av_new= ReadAdc(ADC_CHAN_HF);
592 // see if there's a significant change
593 if(abs(hf_av - hf_av_new) > 10) {
594 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
595 hf_av = hf_av_new;
596 if (hf_av > hf_max)
597 hf_max = hf_av;
598 hf_count= 0;
599 }
600 }
601
602 if(mode == 2) {
603 if (limit == LF_ONLY) {
604 display_val = lf_av;
605 display_max = lf_max;
606 } else if (limit == HF_ONLY) {
607 display_val = hf_av;
608 display_max = hf_max;
609 } else { /* Pick one at random */
610 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
611 display_val = hf_av;
612 display_max = hf_max;
613 } else {
614 display_val = lf_av;
615 display_max = lf_max;
616 }
617 }
618 for (i=0; i<LIGHT_LEN; i++) {
619 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
620 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
621 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
622 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
623 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
624 break;
625 }
626 }
627 }
628 }
629 }
630
631 void UsbPacketReceived(uint8_t *packet, int len)
632 {
633 UsbCommand *c = (UsbCommand *)packet;
634
635 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
636
637 switch(c->cmd) {
638 #ifdef WITH_LF
639 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
640 AcquireRawAdcSamples125k(c->arg[0]);
641 cmd_send(CMD_ACK,0,0,0,0,0);
642 break;
643 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
644 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
645 break;
646 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
647 SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
648 cmd_send(CMD_ACK,0,0,0,0,0);
649 break;
650 case CMD_HID_DEMOD_FSK:
651 CmdHIDdemodFSK(0, 0, 0, 1); // Demodulate HID tag
652 break;
653 case CMD_HID_SIM_TAG:
654 CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID
655 break;
656 case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
657 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
658 break;
659 case CMD_IO_DEMOD_FSK:
660 CmdIOdemodFSK(1, 0, 0, 1); // Demodulate IO tag
661 break;
662 case CMD_IO_CLONE_TAG: // Clone IO tag by ID to T55x7
663 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
664 break;
665 case CMD_EM410X_WRITE_TAG:
666 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
667 break;
668 case CMD_READ_TI_TYPE:
669 ReadTItag();
670 break;
671 case CMD_WRITE_TI_TYPE:
672 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
673 break;
674 case CMD_SIMULATE_TAG_125K:
675 LED_A_ON();
676 SimulateTagLowFrequency(c->arg[0], c->arg[1], 0);
677 LED_A_OFF();
678 break;
679 case CMD_LF_SIMULATE_BIDIR:
680 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
681 break;
682 case CMD_INDALA_CLONE_TAG: // Clone Indala 64-bit tag by UID to T55x7
683 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
684 break;
685 case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7
686 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
687 break;
688 case CMD_T55XX_READ_BLOCK:
689 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
690 break;
691 case CMD_T55XX_WRITE_BLOCK:
692 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
693 break;
694 case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
695 T55xxReadTrace();
696 break;
697 case CMD_PCF7931_READ: // Read PCF7931 tag
698 ReadPCF7931();
699 cmd_send(CMD_ACK,0,0,0,0,0);
700 break;
701 case CMD_EM4X_READ_WORD:
702 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
703 break;
704 case CMD_EM4X_WRITE_WORD:
705 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
706 break;
707 #endif
708
709 #ifdef WITH_HITAG
710 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
711 SnoopHitag(c->arg[0]);
712 break;
713 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
714 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
715 break;
716 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
717 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
718 break;
719 #endif
720
721 #ifdef WITH_ISO15693
722 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
723 AcquireRawAdcSamplesIso15693();
724 break;
725 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
726 RecordRawAdcSamplesIso15693();
727 break;
728
729 case CMD_ISO_15693_COMMAND:
730 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
731 break;
732
733 case CMD_ISO_15693_FIND_AFI:
734 BruteforceIso15693Afi(c->arg[0]);
735 break;
736
737 case CMD_ISO_15693_DEBUG:
738 SetDebugIso15693(c->arg[0]);
739 break;
740
741 case CMD_READER_ISO_15693:
742 ReaderIso15693(c->arg[0]);
743 break;
744 case CMD_SIMTAG_ISO_15693:
745 SimTagIso15693(c->arg[0], c->d.asBytes);
746 break;
747 #endif
748
749 #ifdef WITH_LEGICRF
750 case CMD_SIMULATE_TAG_LEGIC_RF:
751 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
752 break;
753
754 case CMD_WRITER_LEGIC_RF:
755 LegicRfWriter(c->arg[1], c->arg[0]);
756 break;
757
758 case CMD_READER_LEGIC_RF:
759 LegicRfReader(c->arg[0], c->arg[1]);
760 break;
761 #endif
762
763 #ifdef WITH_ISO14443b
764 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
765 AcquireRawAdcSamplesIso14443(c->arg[0]);
766 break;
767 case CMD_READ_SRI512_TAG:
768 ReadSTMemoryIso14443(0x0F);
769 break;
770 case CMD_READ_SRIX4K_TAG:
771 ReadSTMemoryIso14443(0x7F);
772 break;
773 case CMD_SNOOP_ISO_14443:
774 SnoopIso14443();
775 break;
776 case CMD_SIMULATE_TAG_ISO_14443:
777 SimulateIso14443Tag();
778 break;
779 case CMD_ISO_14443B_COMMAND:
780 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
781 break;
782 #endif
783
784 #ifdef WITH_ISO14443a
785 case CMD_SNOOP_ISO_14443a:
786 SnoopIso14443a(c->arg[0]);
787 break;
788 case CMD_READER_ISO_14443a:
789 ReaderIso14443a(c);
790 break;
791 case CMD_SIMULATE_TAG_ISO_14443a:
792 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
793 break;
794
795 case CMD_EPA_PACE_COLLECT_NONCE:
796 EPA_PACE_Collect_Nonce(c);
797 break;
798
799 // case CMD_EPA_:
800 // EpaFoo(c);
801 // break;
802
803 case CMD_READER_MIFARE:
804 ReaderMifare(c->arg[0]);
805 break;
806 case CMD_MIFARE_READBL:
807 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
808 break;
809 case CMD_MIFAREU_READBL:
810 MifareUReadBlock(c->arg[0],c->d.asBytes);
811 break;
812 case CMD_MIFAREUC_AUTH1:
813 MifareUC_Auth1(c->arg[0],c->d.asBytes);
814 break;
815 case CMD_MIFAREUC_AUTH2:
816 MifareUC_Auth2(c->arg[0],c->d.asBytes);
817 break;
818 case CMD_MIFAREU_READCARD:
819 MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
820 break;
821 case CMD_MIFAREUC_READCARD:
822 MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
823 break;
824 case CMD_MIFARE_READSC:
825 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
826 break;
827 case CMD_MIFARE_WRITEBL:
828 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
829 break;
830 case CMD_MIFAREU_WRITEBL_COMPAT:
831 MifareUWriteBlock(c->arg[0], c->d.asBytes);
832 break;
833 case CMD_MIFAREU_WRITEBL:
834 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
835 break;
836 case CMD_MIFARE_NESTED:
837 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
838 break;
839 case CMD_MIFARE_CHKKEYS:
840 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
841 break;
842 case CMD_SIMULATE_MIFARE_CARD:
843 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
844 break;
845
846 // emulator
847 case CMD_MIFARE_SET_DBGMODE:
848 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
849 break;
850 case CMD_MIFARE_EML_MEMCLR:
851 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
852 break;
853 case CMD_MIFARE_EML_MEMSET:
854 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
855 break;
856 case CMD_MIFARE_EML_MEMGET:
857 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
858 break;
859 case CMD_MIFARE_EML_CARDLOAD:
860 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
861 break;
862
863 // Work with "magic Chinese" card
864 case CMD_MIFARE_EML_CSETBLOCK:
865 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
866 break;
867 case CMD_MIFARE_EML_CGETBLOCK:
868 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
869 break;
870
871 // mifare sniffer
872 case CMD_MIFARE_SNIFFER:
873 SniffMifare(c->arg[0]);
874 break;
875
876 // mifare desfire
877 case CMD_MIFARE_DESFIRE_READBL:
878 break;
879 case CMD_MIFARE_DESFIRE_WRITEBL:
880 break;
881 case CMD_MIFARE_DESFIRE_AUTH1:
882 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
883 break;
884 case CMD_MIFARE_DESFIRE_AUTH2:
885 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
886 break;
887 // case CMD_MIFARE_DES_READER:
888 // ReaderMifareDES(c->arg[0], c->arg[1], c->d.asBytes);
889 //break;
890 case CMD_MIFARE_DESFIRE_INFO:
891 MifareDesfireGetInformation();
892 break;
893 case CMD_MIFARE_DESFIRE:
894 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
895 break;
896
897 #endif
898
899 #ifdef WITH_ICLASS
900 // Makes use of ISO14443a FPGA Firmware
901 case CMD_SNOOP_ICLASS:
902 SnoopIClass();
903 break;
904 case CMD_SIMULATE_TAG_ICLASS:
905 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
906 break;
907 case CMD_READER_ICLASS:
908 ReaderIClass(c->arg[0]);
909 break;
910 case CMD_READER_ICLASS_REPLAY:
911 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
912 break;
913 #endif
914
915 case CMD_SIMULATE_TAG_HF_LISTEN:
916 SimulateTagHfListen();
917 break;
918
919 case CMD_BUFF_CLEAR:
920 BufferClear();
921 break;
922
923 case CMD_MEASURE_ANTENNA_TUNING:
924 MeasureAntennaTuning();
925 break;
926
927 case CMD_MEASURE_ANTENNA_TUNING_HF:
928 MeasureAntennaTuningHf();
929 break;
930
931 case CMD_LISTEN_READER_FIELD:
932 ListenReaderField(c->arg[0]);
933 break;
934
935 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
936 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
937 SpinDelay(200);
938 LED_D_OFF(); // LED D indicates field ON or OFF
939 break;
940
941 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
942
943 LED_B_ON();
944 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
945 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
946 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
947 }
948 // Trigger a finish downloading signal with an ACK frame
949 cmd_send(CMD_ACK,0,0,0,0,0);
950 LED_B_OFF();
951 break;
952
953 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
954 uint8_t *b = (uint8_t *)BigBuf;
955 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
956 cmd_send(CMD_ACK,0,0,0,0,0);
957 break;
958 }
959 case CMD_READ_MEM:
960 ReadMem(c->arg[0]);
961 break;
962
963 case CMD_SET_LF_DIVISOR:
964 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
965 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
966 break;
967
968 case CMD_SET_ADC_MUX:
969 switch(c->arg[0]) {
970 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
971 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
972 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
973 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
974 }
975 break;
976
977 case CMD_VERSION:
978 SendVersion();
979 break;
980
981 #ifdef WITH_LCD
982 case CMD_LCD_RESET:
983 LCDReset();
984 break;
985 case CMD_LCD:
986 LCDSend(c->arg[0]);
987 break;
988 #endif
989 case CMD_SETUP_WRITE:
990 case CMD_FINISH_WRITE:
991 case CMD_HARDWARE_RESET:
992 usb_disable();
993 SpinDelay(1000);
994 SpinDelay(1000);
995 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
996 for(;;) {
997 // We're going to reset, and the bootrom will take control.
998 }
999 break;
1000
1001 case CMD_START_FLASH:
1002 if(common_area.flags.bootrom_present) {
1003 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1004 }
1005 usb_disable();
1006 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1007 for(;;);
1008 break;
1009
1010 case CMD_DEVICE_INFO: {
1011 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1012 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1013 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1014 break;
1015 }
1016 default:
1017 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1018 break;
1019 }
1020 }
1021
1022 void __attribute__((noreturn)) AppMain(void)
1023 {
1024 SpinDelay(100);
1025
1026 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1027 /* Initialize common area */
1028 memset(&common_area, 0, sizeof(common_area));
1029 common_area.magic = COMMON_AREA_MAGIC;
1030 common_area.version = 1;
1031 }
1032 common_area.flags.osimage_present = 1;
1033
1034 LED_D_OFF();
1035 LED_C_OFF();
1036 LED_B_OFF();
1037 LED_A_OFF();
1038
1039 // Init USB device
1040 usb_enable();
1041
1042 // The FPGA gets its clock from us from PCK0 output, so set that up.
1043 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1044 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1045 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1046 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1047 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1048 AT91C_PMC_PRES_CLK_4;
1049 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1050
1051 // Reset SPI
1052 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1053 // Reset SSC
1054 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1055
1056 // Load the FPGA image, which we have stored in our flash.
1057 // (the HF version by default)
1058 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1059
1060 StartTickCount();
1061
1062 #ifdef WITH_LCD
1063 LCDInit();
1064 #endif
1065
1066 byte_t rx[sizeof(UsbCommand)];
1067 size_t rx_len;
1068
1069 for(;;) {
1070 if (usb_poll()) {
1071 rx_len = usb_read(rx,sizeof(UsbCommand));
1072 if (rx_len) {
1073 UsbPacketReceived(rx,rx_len);
1074 }
1075 }
1076 WDT_HIT();
1077
1078 #ifdef WITH_LF
1079 if (BUTTON_HELD(1000) > 0)
1080 SamyRun();
1081 #endif
1082 }
1083 }
Proxmark3 GIT tracking
Impressum, Datenschutz