]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


de6e442781328230d0e622d1e21eda4372598a21
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12 #include "usb_cdc.h"
13 #include "proxmark3.h"
14 #include "apps.h"
15 #include "util.h"
16 #include "printf.h"
17 #include "string.h"
18 #include "legicrf.h"
19 #include "lfsampling.h"
20 #include "BigBuf.h"
21 #include "mifareutil.h"
22
23 #ifdef WITH_LCD
24 #include "LCD.h"
25 #endif
26
27 // Craig Young - 14a stand-alone code
28 #ifdef WITH_ISO14443a_StandAlone
29 #include "iso14443a.h"
30 #include "protocols.h"
31 #endif
32
33 //=============================================================================
34 // A buffer where we can queue things up to be sent through the FPGA, for
35 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
36 // is the order in which they go out on the wire.
37 //=============================================================================
38
39 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
40 uint8_t ToSend[TOSEND_BUFFER_SIZE];
41 int ToSendMax = 0;
42 static int ToSendBit;
43 struct common_area common_area __attribute__((section(".commonarea")));
44
45 void ToSendReset(void)
46 {
47 ToSendMax = -1;
48 ToSendBit = 8;
49 }
50
51 void ToSendStuffBit(int b) {
52 if(ToSendBit >= 8) {
53 ++ToSendMax;
54 ToSend[ToSendMax] = 0;
55 ToSendBit = 0;
56 }
57
58 if(b)
59 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
60
61 ++ToSendBit;
62
63 if(ToSendMax >= sizeof(ToSend)) {
64 ToSendBit = 0;
65 DbpString("ToSendStuffBit overflowed!");
66 }
67 }
68
69 void PrintToSendBuffer(void){
70 DbpString("Printing ToSendBuffer:");
71 Dbhexdump(ToSendMax, ToSend, 0);
72 }
73
74 void print_result(char *name, uint8_t *buf, size_t len) {
75 uint8_t *p = buf;
76
77 if ( len % 16 == 0 ) {
78 for(; p-buf < len; p += 16)
79 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
80 name,
81 p-buf,
82 len,
83 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7],p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]
84 );
85 }
86 else {
87 for(; p-buf < len; p += 8)
88 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x",
89 name,
90 p-buf,
91 len,
92 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
93 }
94 }
95
96 //=============================================================================
97 // Debug print functions, to go out over USB, to the usual PC-side client.
98 //=============================================================================
99
100 void DbpStringEx(char *str, uint32_t cmd){
101 byte_t len = strlen(str);
102 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
103 }
104
105 void DbpString(char *str) {
106 DbpStringEx(str, 0);
107 }
108
109 #if 0
110 void DbpIntegers(int x1, int x2, int x3) {
111 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
112 }
113 #endif
114 void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
115 // should probably limit size here; oh well, let's just use a big buffer
116 char output_string[128] = {0x00};
117 va_list ap;
118
119 va_start(ap, fmt);
120 kvsprintf(fmt, output_string, 10, ap);
121 va_end(ap);
122
123 DbpStringEx(output_string, cmd);
124 }
125
126 void Dbprintf(const char *fmt, ...) {
127 // should probably limit size here; oh well, let's just use a big buffer
128 char output_string[128] = {0x00};
129 va_list ap;
130
131 va_start(ap, fmt);
132 kvsprintf(fmt, output_string, 10, ap);
133 va_end(ap);
134
135 DbpString(output_string);
136 }
137
138 // prints HEX & ASCII
139 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
140 int l=0, i;
141 char ascii[9];
142
143 while (len>0) {
144
145 l = (len>8) ? 8 : len;
146
147 memcpy(ascii,d,l);
148 ascii[l]=0;
149
150 // filter safe ascii
151 for (i=0; i<l; ++i)
152 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
153
154 if (bAsci)
155 Dbprintf("%-8s %*D",ascii,l,d," ");
156 else
157 Dbprintf("%*D",l,d," ");
158
159 len -= 8;
160 d += 8;
161 }
162 }
163
164 //-----------------------------------------------------------------------------
165 // Read an ADC channel and block till it completes, then return the result
166 // in ADC units (0 to 1023). Also a routine to average 32 samples and
167 // return that.
168 //-----------------------------------------------------------------------------
169 static int ReadAdc(int ch)
170 {
171 uint32_t d;
172
173 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
174 AT91C_BASE_ADC->ADC_MR =
175 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
176 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
177 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
178
179 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
180 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
181 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
182 //
183 // The maths are:
184 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
185 //
186 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
187 //
188 // Note: with the "historic" values in the comments above, the error was 34% !!!
189
190 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
191
192 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
193
194 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
195
196 d = AT91C_BASE_ADC->ADC_CDR[ch];
197 return d;
198 }
199
200 int AvgAdc(int ch) // was static - merlok
201 {
202 int i, a = 0;
203 for(i = 0; i < 32; ++i)
204 a += ReadAdc(ch);
205
206 return (a + 15) >> 5;
207 }
208
209
210 void MeasureAntennaTuning(void) {
211
212 uint8_t LF_Results[256];
213 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0;
214 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
215
216 memset(LF_Results, 0, sizeof(LF_Results));
217 LED_B_ON();
218
219 /*
220 * Sweeps the useful LF range of the proxmark from
221 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
222 * read the voltage in the antenna, the result left
223 * in the buffer is a graph which should clearly show
224 * the resonating frequency of your LF antenna
225 * ( hopefully around 95 if it is tuned to 125kHz!)
226 */
227
228 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
229 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
230
231 for (i = 255; i >= 19; i--) {
232 WDT_HIT();
233 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
234 SpinDelay(20);
235 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
236 if (i==95) vLf125 = adcval; // voltage at 125Khz
237 if (i==89) vLf134 = adcval; // voltage at 134Khz
238
239 LF_Results[i] = adcval >> 8; // scale int to fit in byte for graphing purposes
240 if(LF_Results[i] > peak) {
241 peakv = adcval;
242 peak = LF_Results[i];
243 peakf = i;
244 }
245 }
246
247 LED_A_ON();
248 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
249 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
250 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
251 SpinDelay(20);
252 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
253
254 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134 << 16), vHf, peakf | (peakv << 16), LF_Results, 256);
255 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
256 LEDsoff();
257 }
258
259 void MeasureAntennaTuningHf(void) {
260 int vHf = 0; // in mV
261 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
262 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
263 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
264
265 while ( !BUTTON_PRESS() ){
266 SpinDelay(20);
267 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
268 //Dbprintf("%d mV",vHf);
269 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
270 }
271 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
272 DbpString("cancelled");
273 }
274
275
276 void ReadMem(int addr) {
277 const uint8_t *data = ((uint8_t *)addr);
278
279 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
280 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
281 }
282
283 /* osimage version information is linked in */
284 extern struct version_information version_information;
285 /* bootrom version information is pointed to from _bootphase1_version_pointer */
286 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
287 void SendVersion(void)
288 {
289 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
290 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
291
292 /* Try to find the bootrom version information. Expect to find a pointer at
293 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
294 * pointer, then use it.
295 */
296 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
297
298 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
299 strcat(VersionString, "bootrom version information appears invalid\n");
300 } else {
301 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
302 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
303 }
304
305 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
306 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
307
308 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
309 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
310
311 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
312 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
313
314 // Send Chip ID and used flash memory
315 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
316 uint32_t compressed_data_section_size = common_area.arg1;
317 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
318 }
319
320 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
321 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
322 void printUSBSpeed(void)
323 {
324 Dbprintf("USB Speed:");
325 Dbprintf(" Sending USB packets to client...");
326
327 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
328 uint8_t *test_data = BigBuf_get_addr();
329 uint32_t end_time;
330
331 uint32_t start_time = end_time = GetTickCount();
332 uint32_t bytes_transferred = 0;
333
334 LED_B_ON();
335 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
336 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
337 end_time = GetTickCount();
338 bytes_transferred += USB_CMD_DATA_SIZE;
339 }
340 LED_B_OFF();
341
342 Dbprintf(" Time elapsed: %dms", end_time - start_time);
343 Dbprintf(" Bytes transferred: %d", bytes_transferred);
344 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
345 1000 * bytes_transferred / (end_time - start_time));
346
347 }
348
349 /**
350 * Prints runtime information about the PM3.
351 **/
352 void SendStatus(void) {
353 BigBuf_print_status();
354 Fpga_print_status();
355 printConfig(); //LF Sampling config
356 printUSBSpeed();
357 Dbprintf("Various");
358 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
359 Dbprintf(" ToSendMax..........%d", ToSendMax);
360 Dbprintf(" ToSendBit..........%d", ToSendBit);
361 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
362
363 cmd_send(CMD_ACK,1,0,0,0,0);
364 }
365
366 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
367
368 #define OPTS 2
369 void StandAloneMode()
370 {
371 DbpString("Stand-alone mode! No PC necessary.");
372 // Oooh pretty -- notify user we're in elite samy mode now
373 LED(LED_RED, 200);
374 LED(LED_ORANGE, 200);
375 LED(LED_GREEN, 200);
376 LED(LED_ORANGE, 200);
377 LED(LED_RED, 200);
378 LED(LED_ORANGE, 200);
379 LED(LED_GREEN, 200);
380 LED(LED_ORANGE, 200);
381 LED(LED_RED, 200);
382 }
383 #endif
384
385 #ifdef WITH_ISO14443a_StandAlone
386 void StandAloneMode14a()
387 {
388 StandAloneMode();
389 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
390
391 int selected = 0;
392 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
393 int cardRead[OPTS] = {0};
394 uint8_t readUID[10] = {0};
395 uint32_t uid_1st[OPTS]={0};
396 uint32_t uid_2nd[OPTS]={0};
397 uint32_t uid_tmp1 = 0;
398 uint32_t uid_tmp2 = 0;
399 iso14a_card_select_t hi14a_card[OPTS];
400
401 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
402
403 LED(selected + 1, 0);
404
405 for (;;)
406 {
407 usb_poll();
408 WDT_HIT();
409 SpinDelay(300);
410
411 if (iGotoRecord == 1 || cardRead[selected] == 0)
412 {
413 iGotoRecord = 0;
414 LEDsoff();
415 LED(selected + 1, 0);
416 LED(LED_RED2, 0);
417
418 // record
419 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
420 /* need this delay to prevent catching some weird data */
421 SpinDelay(500);
422 /* Code for reading from 14a tag */
423 uint8_t uid[10] = {0};
424 uint32_t cuid = 0;
425 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
426
427 for ( ; ; )
428 {
429 WDT_HIT();
430 if (BUTTON_PRESS()) {
431 if (cardRead[selected]) {
432 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
433 break;
434 }
435 else if (cardRead[(selected+1)%OPTS]) {
436 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
437 selected = (selected+1)%OPTS;
438 break; // playing = 1;
439 }
440 else {
441 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
442 SpinDelay(300);
443 }
444 }
445 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
446 continue;
447 else
448 {
449 Dbprintf("Read UID:");
450 Dbhexdump(10, uid, 0);
451 memcpy(readUID, uid, 10 * sizeof(uint8_t));
452 uint8_t *dst = (uint8_t *)&uid_tmp1;
453 // Set UID byte order
454 for (int i=0; i<4; i++)
455 dst[i] = uid[3-i];
456 dst = (uint8_t *)&uid_tmp2;
457 for (int i=0; i<4; i++)
458 dst[i] = uid[7-i];
459 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
460 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
461 }
462 else {
463 if (uid_tmp2) {
464 Dbprintf("Bank[%d] received a 7-byte UID",selected);
465 uid_1st[selected] = (uid_tmp1)>>8;
466 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
467 }
468 else {
469 Dbprintf("Bank[%d] received a 4-byte UID",selected);
470 uid_1st[selected] = uid_tmp1;
471 uid_2nd[selected] = uid_tmp2;
472 }
473 break;
474 }
475 }
476 }
477 Dbprintf("ATQA = %02X%02X", hi14a_card[selected].atqa[0], hi14a_card[selected].atqa[1]);
478 Dbprintf("SAK = %02X", hi14a_card[selected].sak);
479 LEDsoff();
480 LED(LED_GREEN, 200);
481 LED(LED_ORANGE, 200);
482 LED(LED_GREEN, 200);
483 LED(LED_ORANGE, 200);
484
485 LEDsoff();
486 LED(selected + 1, 0);
487
488 // Next state is replay:
489 playing = 1;
490
491 cardRead[selected] = 1;
492 }
493 /* MF Classic UID clone */
494 else if (iGotoClone==1)
495 {
496 iGotoClone=0;
497 LEDsoff();
498 LED(selected + 1, 0);
499 LED(LED_ORANGE, 250);
500
501 // record
502 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
503
504 // wait for button to be released
505 // Delay cloning until card is in place
506 while(BUTTON_PRESS())
507 WDT_HIT();
508
509 Dbprintf("Starting clone. [Bank: %u]", selected);
510 // need this delay to prevent catching some weird data
511 SpinDelay(500);
512 // Begin clone function here:
513 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
514 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
515 memcpy(c.d.asBytes, data, 16);
516 SendCommand(&c);
517
518 Block read is similar:
519 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
520 We need to imitate that call with blockNo 0 to set a uid.
521
522 The get and set commands are handled in this file:
523 // Work with "magic Chinese" card
524 case CMD_MIFARE_CSETBLOCK:
525 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
526 break;
527 case CMD_MIFARE_CGETBLOCK:
528 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
529 break;
530
531 mfCSetUID provides example logic for UID set workflow:
532 -Read block0 from card in field with MifareCGetBlock()
533 -Configure new values without replacing reserved bytes
534 memcpy(block0, uid, 4); // Copy UID bytes from byte array
535 // Mifare UID BCC
536 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
537 Bytes 5-7 are reserved SAK and ATQA for mifare classic
538 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
539 */
540 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
541 // arg0 = Flags, arg1=blockNo
542 MifareCGetBlock(params, 0, oldBlock0);
543 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
544 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
545 playing = 1;
546 }
547 else {
548 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0], oldBlock0[1], oldBlock0[2], oldBlock0[3]);
549 memcpy(newBlock0, oldBlock0, 16);
550 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
551
552 newBlock0[0] = uid_1st[selected]>>24;
553 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
554 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
555 newBlock0[3] = 0xFF & (uid_1st[selected]);
556 newBlock0[4] = newBlock0[0] ^ newBlock0[1] ^ newBlock0[2] ^ newBlock0[3];
557
558 // arg0 = workFlags, arg1 = blockNo, datain
559 MifareCSetBlock(params, 0, newBlock0);
560 MifareCGetBlock(params, 0, testBlock0);
561
562 if (memcmp(testBlock0, newBlock0, 16)==0) {
563 DbpString("Cloned successfull!");
564 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
565 playing = 0;
566 iGotoRecord = 1;
567 selected = (selected + 1) % OPTS;
568 } else {
569 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
570 playing = 1;
571 }
572 }
573 LEDsoff();
574 LED(selected + 1, 0);
575 }
576 // Change where to record (or begin playing)
577 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
578 {
579 LEDsoff();
580 LED(selected + 1, 0);
581
582 // Begin transmitting
583 if (playing)
584 {
585 LED(LED_GREEN, 0);
586 DbpString("Playing");
587 for ( ; ; ) {
588 WDT_HIT();
589 int button_action = BUTTON_HELD(1000);
590 if (button_action == 0) { // No button action, proceed with sim
591 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
592 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
593 num_to_bytes(uid_1st[selected], 3, data);
594 num_to_bytes(uid_2nd[selected], 4, data+3);
595
596 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected], uid_2nd[selected], selected);
597 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
598 DbpString("Mifare Classic");
599 SimulateIso14443aTag(1, flags, data); // Mifare Classic
600 }
601 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
602 DbpString("Mifare Ultralight");
603 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
604 }
605 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
606 DbpString("Mifare DESFire");
607 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
608 }
609 else {
610 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
611 SimulateIso14443aTag(1, flags, data); // Mifare Classic
612 }
613 }
614 else if (button_action == BUTTON_SINGLE_CLICK) {
615 selected = (selected + 1) % OPTS;
616 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
617 iGotoRecord = 1;
618 break;
619 }
620 else if (button_action == BUTTON_HOLD) {
621 Dbprintf("Playtime over. Begin cloning...");
622 iGotoClone = 1;
623 break;
624 }
625 WDT_HIT();
626 }
627
628 /* We pressed a button so ignore it here with a delay */
629 SpinDelay(300);
630 LEDsoff();
631 LED(selected + 1, 0);
632 }
633 else
634 while(BUTTON_PRESS())
635 WDT_HIT();
636 }
637 }
638 }
639 #elif WITH_LF
640 // samy's sniff and repeat routine
641 void SamyRun()
642 {
643 StandAloneMode();
644 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
645
646 int high[OPTS], low[OPTS];
647 int selected = 0;
648 int playing = 0;
649 int cardRead = 0;
650
651 // Turn on selected LED
652 LED(selected + 1, 0);
653
654 for (;;) {
655 usb_poll();
656 WDT_HIT();
657
658 // Was our button held down or pressed?
659 int button_pressed = BUTTON_HELD(1000);
660 SpinDelay(300);
661
662 // Button was held for a second, begin recording
663 if (button_pressed > 0 && cardRead == 0)
664 {
665 LEDsoff();
666 LED(selected + 1, 0);
667 LED(LED_RED2, 0);
668
669 // record
670 DbpString("Starting recording");
671
672 // wait for button to be released
673 while(BUTTON_PRESS())
674 WDT_HIT();
675
676 /* need this delay to prevent catching some weird data */
677 SpinDelay(500);
678
679 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
680 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
681
682 LEDsoff();
683 LED(selected + 1, 0);
684 // Finished recording
685 // If we were previously playing, set playing off
686 // so next button push begins playing what we recorded
687 playing = 0;
688 cardRead = 1;
689 }
690 else if (button_pressed > 0 && cardRead == 1) {
691 LEDsoff();
692 LED(selected + 1, 0);
693 LED(LED_ORANGE, 0);
694
695 // record
696 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
697
698 // wait for button to be released
699 while(BUTTON_PRESS())
700 WDT_HIT();
701
702 /* need this delay to prevent catching some weird data */
703 SpinDelay(500);
704
705 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
706 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
707
708 LEDsoff();
709 LED(selected + 1, 0);
710 // Finished recording
711
712 // If we were previously playing, set playing off
713 // so next button push begins playing what we recorded
714 playing = 0;
715 cardRead = 0;
716 }
717
718 // Change where to record (or begin playing)
719 else if (button_pressed) {
720 // Next option if we were previously playing
721 if (playing)
722 selected = (selected + 1) % OPTS;
723 playing = !playing;
724
725 LEDsoff();
726 LED(selected + 1, 0);
727
728 // Begin transmitting
729 if (playing)
730 {
731 LED(LED_GREEN, 0);
732 DbpString("Playing");
733 // wait for button to be released
734 while(BUTTON_PRESS())
735 WDT_HIT();
736
737 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
738 CmdHIDsimTAG(high[selected], low[selected], 0);
739 DbpString("Done playing");
740
741 if (BUTTON_HELD(1000) > 0) {
742 DbpString("Exiting");
743 LEDsoff();
744 return;
745 }
746
747 /* We pressed a button so ignore it here with a delay */
748 SpinDelay(300);
749
750 // when done, we're done playing, move to next option
751 selected = (selected + 1) % OPTS;
752 playing = !playing;
753 LEDsoff();
754 LED(selected + 1, 0);
755 }
756 else
757 while(BUTTON_PRESS())
758 WDT_HIT();
759 }
760 }
761 }
762
763 #endif
764 /*
765 OBJECTIVE
766 Listen and detect an external reader. Determine the best location
767 for the antenna.
768
769 INSTRUCTIONS:
770 Inside the ListenReaderField() function, there is two mode.
771 By default, when you call the function, you will enter mode 1.
772 If you press the PM3 button one time, you will enter mode 2.
773 If you press the PM3 button a second time, you will exit the function.
774
775 DESCRIPTION OF MODE 1:
776 This mode just listens for an external reader field and lights up green
777 for HF and/or red for LF. This is the original mode of the detectreader
778 function.
779
780 DESCRIPTION OF MODE 2:
781 This mode will visually represent, using the LEDs, the actual strength of the
782 current compared to the maximum current detected. Basically, once you know
783 what kind of external reader is present, it will help you spot the best location to place
784 your antenna. You will probably not get some good results if there is a LF and a HF reader
785 at the same place! :-)
786
787 LIGHT SCHEME USED:
788 */
789 static const char LIGHT_SCHEME[] = {
790 0x0, /* ---- | No field detected */
791 0x1, /* X--- | 14% of maximum current detected */
792 0x2, /* -X-- | 29% of maximum current detected */
793 0x4, /* --X- | 43% of maximum current detected */
794 0x8, /* ---X | 57% of maximum current detected */
795 0xC, /* --XX | 71% of maximum current detected */
796 0xE, /* -XXX | 86% of maximum current detected */
797 0xF, /* XXXX | 100% of maximum current detected */
798 };
799 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
800
801 void ListenReaderField(int limit) {
802 #define LF_ONLY 1
803 #define HF_ONLY 2
804 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
805
806 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
807 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
808 int mode=1, display_val, display_max, i;
809
810 // switch off FPGA - we don't want to measure our own signal
811 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
812 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
813
814 LEDsoff();
815
816 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
817
818 if(limit != HF_ONLY) {
819 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
820 lf_baseline = lf_av;
821 }
822
823 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
824
825 if (limit != LF_ONLY) {
826 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
827 hf_baseline = hf_av;
828 }
829
830 for(;;) {
831 if (BUTTON_PRESS()) {
832 SpinDelay(500);
833 switch (mode) {
834 case 1:
835 mode=2;
836 DbpString("Signal Strength Mode");
837 break;
838 case 2:
839 default:
840 DbpString("Stopped");
841 LEDsoff();
842 return;
843 break;
844 }
845 }
846 WDT_HIT();
847
848 if (limit != HF_ONLY) {
849 if(mode == 1) {
850 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
851 LED_D_ON();
852 else
853 LED_D_OFF();
854 }
855
856 lf_av_new = AvgAdc(ADC_CHAN_LF);
857 // see if there's a significant change
858 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
859 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
860 lf_av = lf_av_new;
861 if (lf_av > lf_max)
862 lf_max = lf_av;
863 }
864 }
865
866 if (limit != LF_ONLY) {
867 if (mode == 1){
868 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
869 LED_B_ON();
870 else
871 LED_B_OFF();
872 }
873
874 hf_av_new = AvgAdc(ADC_CHAN_HF);
875 // see if there's a significant change
876 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
877 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
878 hf_av = hf_av_new;
879 if (hf_av > hf_max)
880 hf_max = hf_av;
881 }
882 }
883
884 if(mode == 2) {
885 if (limit == LF_ONLY) {
886 display_val = lf_av;
887 display_max = lf_max;
888 } else if (limit == HF_ONLY) {
889 display_val = hf_av;
890 display_max = hf_max;
891 } else { /* Pick one at random */
892 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
893 display_val = hf_av;
894 display_max = hf_max;
895 } else {
896 display_val = lf_av;
897 display_max = lf_max;
898 }
899 }
900 for (i=0; i<LIGHT_LEN; i++) {
901 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
902 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
903 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
904 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
905 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
906 break;
907 }
908 }
909 }
910 }
911 }
912
913 void UsbPacketReceived(uint8_t *packet, int len)
914 {
915 UsbCommand *c = (UsbCommand *)packet;
916
917 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
918
919 switch(c->cmd) {
920 #ifdef WITH_LF
921 case CMD_SET_LF_SAMPLING_CONFIG:
922 setSamplingConfig((sample_config *) c->d.asBytes);
923 break;
924 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
925 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
926 break;
927 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
928 ModThenAcquireRawAdcSamples125k(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
929 break;
930 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
931 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
932 break;
933 case CMD_HID_DEMOD_FSK:
934 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
935 break;
936 case CMD_HID_SIM_TAG:
937 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
938 break;
939 case CMD_FSK_SIM_TAG:
940 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
941 break;
942 case CMD_ASK_SIM_TAG:
943 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
944 break;
945 case CMD_PSK_SIM_TAG:
946 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
947 break;
948 case CMD_HID_CLONE_TAG:
949 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
950 break;
951 case CMD_IO_DEMOD_FSK:
952 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
953 break;
954 case CMD_IO_CLONE_TAG:
955 CopyIOtoT55x7(c->arg[0], c->arg[1]);
956 break;
957 case CMD_EM410X_DEMOD:
958 CmdEM410xdemod(c->arg[0], 0, 0, 1);
959 break;
960 case CMD_EM410X_WRITE_TAG:
961 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
962 break;
963 case CMD_READ_TI_TYPE:
964 ReadTItag();
965 break;
966 case CMD_WRITE_TI_TYPE:
967 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
968 break;
969 case CMD_SIMULATE_TAG_125K:
970 LED_A_ON();
971 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
972 LED_A_OFF();
973 break;
974 case CMD_LF_SIMULATE_BIDIR:
975 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
976 break;
977 case CMD_INDALA_CLONE_TAG:
978 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
979 break;
980 case CMD_INDALA_CLONE_TAG_L:
981 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
982 break;
983 case CMD_T55XX_READ_BLOCK:
984 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
985 break;
986 case CMD_T55XX_WRITE_BLOCK:
987 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
988 break;
989 case CMD_T55XX_WAKEUP:
990 T55xxWakeUp(c->arg[0]);
991 break;
992 case CMD_T55XX_RESET_READ:
993 T55xxResetRead();
994 break;
995 case CMD_PCF7931_READ:
996 ReadPCF7931();
997 break;
998 case CMD_PCF7931_WRITE:
999 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1000 break;
1001 case CMD_EM4X_READ_WORD:
1002 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
1003 break;
1004 case CMD_EM4X_WRITE_WORD:
1005 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1006 break;
1007 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1008 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1009 break;
1010 case CMD_VIKING_CLONE_TAG:
1011 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1012 break;
1013 case CMD_COTAG:
1014 Cotag();
1015 break;
1016 #endif
1017
1018 #ifdef WITH_HITAG
1019 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1020 SnoopHitag(c->arg[0]);
1021 break;
1022 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1023 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1024 break;
1025 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1026 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1027 break;
1028 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1029 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1030 break;
1031 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1032 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1033 break;
1034 case CMD_READ_HITAG_S: //Reader for only Hitag S tags, args = key or challenge
1035 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1036 break;
1037 case CMD_WR_HITAG_S: //writer for Hitag tags args=data to write,page and key or challenge
1038 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1039 break;
1040 #endif
1041
1042 #ifdef WITH_ISO15693
1043 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1044 AcquireRawAdcSamplesIso15693();
1045 break;
1046 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1047 RecordRawAdcSamplesIso15693();
1048 break;
1049 case CMD_ISO_15693_COMMAND:
1050 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1051 break;
1052 case CMD_ISO_15693_FIND_AFI:
1053 BruteforceIso15693Afi(c->arg[0]);
1054 break;
1055 case CMD_ISO_15693_DEBUG:
1056 SetDebugIso15693(c->arg[0]);
1057 break;
1058 case CMD_READER_ISO_15693:
1059 ReaderIso15693(c->arg[0]);
1060 break;
1061 case CMD_SIMTAG_ISO_15693:
1062 SimTagIso15693(c->arg[0], c->d.asBytes);
1063 break;
1064 #endif
1065
1066 #ifdef WITH_LEGICRF
1067 case CMD_SIMULATE_TAG_LEGIC_RF:
1068 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1069 break;
1070 case CMD_WRITER_LEGIC_RF:
1071 LegicRfWriter( c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1072 break;
1073 case CMD_READER_LEGIC_RF:
1074 LegicRfReader(c->arg[0], c->arg[1], c->arg[2]);
1075 break;
1076 case CMD_LEGIC_INFO:
1077 LegicRfInfo();
1078 break;
1079 case CMD_LEGIC_ESET:
1080 LegicEMemSet(c->arg[0], c->arg[1], c->d.asBytes);
1081 break;
1082 #endif
1083
1084 #ifdef WITH_ISO14443b
1085 case CMD_READ_SRI_TAG:
1086 ReadSTMemoryIso14443b(c->arg[0]);
1087 break;
1088 case CMD_SNOOP_ISO_14443B:
1089 SnoopIso14443b();
1090 break;
1091 case CMD_SIMULATE_TAG_ISO_14443B:
1092 SimulateIso14443bTag(c->arg[0]);
1093 break;
1094 case CMD_ISO_14443B_COMMAND:
1095 //SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1096 SendRawCommand14443B_Ex(c);
1097 break;
1098 #endif
1099
1100 #ifdef WITH_ISO14443a
1101 case CMD_SNOOP_ISO_14443a:
1102 SniffIso14443a(c->arg[0]);
1103 break;
1104 case CMD_READER_ISO_14443a:
1105 ReaderIso14443a(c);
1106 break;
1107 case CMD_SIMULATE_TAG_ISO_14443a:
1108 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1109 break;
1110 case CMD_EPA_PACE_COLLECT_NONCE:
1111 EPA_PACE_Collect_Nonce(c);
1112 break;
1113 case CMD_EPA_PACE_REPLAY:
1114 EPA_PACE_Replay(c);
1115 break;
1116 case CMD_READER_MIFARE:
1117 ReaderMifare(c->arg[0], c->arg[1], c->arg[2]);
1118 break;
1119 case CMD_MIFARE_READBL:
1120 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1121 break;
1122 case CMD_MIFAREU_READBL:
1123 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1124 break;
1125 case CMD_MIFAREUC_AUTH:
1126 MifareUC_Auth(c->arg[0],c->d.asBytes);
1127 break;
1128 case CMD_MIFAREU_READCARD:
1129 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1130 break;
1131 case CMD_MIFAREUC_SETPWD:
1132 MifareUSetPwd(c->arg[0], c->d.asBytes);
1133 break;
1134 case CMD_MIFARE_READSC:
1135 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1136 break;
1137 case CMD_MIFARE_WRITEBL:
1138 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1139 break;
1140 //case CMD_MIFAREU_WRITEBL_COMPAT:
1141 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1142 //break;
1143 case CMD_MIFAREU_WRITEBL:
1144 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1145 break;
1146 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1147 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1148 break;
1149 case CMD_MIFARE_NESTED:
1150 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1151 break;
1152 case CMD_MIFARE_CHKKEYS:
1153 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1154 break;
1155 case CMD_SIMULATE_MIFARE_CARD:
1156 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1157 break;
1158
1159 // emulator
1160 case CMD_MIFARE_SET_DBGMODE:
1161 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1162 break;
1163 case CMD_MIFARE_EML_MEMCLR:
1164 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1165 break;
1166 case CMD_MIFARE_EML_MEMSET:
1167 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1168 break;
1169 case CMD_MIFARE_EML_MEMGET:
1170 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1171 break;
1172 case CMD_MIFARE_EML_CARDLOAD:
1173 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1174 break;
1175
1176 // Work with "magic Chinese" card
1177 case CMD_MIFARE_CSETBLOCK:
1178 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1179 break;
1180 case CMD_MIFARE_CGETBLOCK:
1181 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1182 break;
1183 case CMD_MIFARE_CIDENT:
1184 MifareCIdent();
1185 break;
1186
1187 // mifare sniffer
1188 case CMD_MIFARE_SNIFFER:
1189 SniffMifare(c->arg[0]);
1190 break;
1191
1192 //mifare desfire
1193 case CMD_MIFARE_DESFIRE_READBL: break;
1194 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1195 case CMD_MIFARE_DESFIRE_AUTH1:
1196 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1197 break;
1198 case CMD_MIFARE_DESFIRE_AUTH2:
1199 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1200 break;
1201 case CMD_MIFARE_DES_READER:
1202 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1203 break;
1204 case CMD_MIFARE_DESFIRE_INFO:
1205 MifareDesfireGetInformation();
1206 break;
1207 case CMD_MIFARE_DESFIRE:
1208 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1209 break;
1210 case CMD_MIFARE_COLLECT_NONCES:
1211 break;
1212 #endif
1213 #ifdef WITH_EMV
1214 case CMD_EMV_TRANSACTION:
1215 EMVTransaction();
1216 break;
1217 case CMD_EMV_GET_RANDOM_NUM:
1218 //EMVgetUDOL();
1219 break;
1220 case CMD_EMV_LOAD_VALUE:
1221 EMVloadvalue(c->arg[0], c->d.asBytes);
1222 break;
1223 case CMD_EMV_DUMP_CARD:
1224 EMVdumpcard();
1225 #endif
1226 #ifdef WITH_ICLASS
1227 // Makes use of ISO14443a FPGA Firmware
1228 case CMD_SNOOP_ICLASS:
1229 SnoopIClass();
1230 break;
1231 case CMD_SIMULATE_TAG_ICLASS:
1232 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1233 break;
1234 case CMD_READER_ICLASS:
1235 ReaderIClass(c->arg[0]);
1236 break;
1237 case CMD_READER_ICLASS_REPLAY:
1238 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1239 break;
1240 case CMD_ICLASS_EML_MEMSET:
1241 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1242 break;
1243 case CMD_ICLASS_WRITEBLOCK:
1244 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1245 break;
1246 case CMD_ICLASS_READCHECK: // auth step 1
1247 iClass_ReadCheck(c->arg[0], c->arg[1]);
1248 break;
1249 case CMD_ICLASS_READBLOCK:
1250 iClass_ReadBlk(c->arg[0]);
1251 break;
1252 case CMD_ICLASS_AUTHENTICATION: //check
1253 iClass_Authentication(c->d.asBytes);
1254 break;
1255 case CMD_ICLASS_DUMP:
1256 iClass_Dump(c->arg[0], c->arg[1]);
1257 break;
1258 case CMD_ICLASS_CLONE:
1259 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1260 break;
1261 #endif
1262 #ifdef WITH_HFSNOOP
1263 case CMD_HF_SNIFFER:
1264 HfSnoop(c->arg[0], c->arg[1]);
1265 break;
1266 #endif
1267
1268 case CMD_BUFF_CLEAR:
1269 BigBuf_Clear();
1270 break;
1271
1272 case CMD_MEASURE_ANTENNA_TUNING:
1273 MeasureAntennaTuning();
1274 break;
1275
1276 case CMD_MEASURE_ANTENNA_TUNING_HF:
1277 MeasureAntennaTuningHf();
1278 break;
1279
1280 case CMD_LISTEN_READER_FIELD:
1281 ListenReaderField(c->arg[0]);
1282 break;
1283
1284 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1285 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1286 SpinDelay(200);
1287 LED_D_OFF(); // LED D indicates field ON or OFF
1288 break;
1289
1290 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1291 LED_B_ON();
1292 uint8_t *BigBuf = BigBuf_get_addr();
1293 size_t len = 0;
1294 size_t startidx = c->arg[0];
1295 uint8_t isok = FALSE;
1296 // arg0 = startindex
1297 // arg1 = length bytes to transfer
1298 // arg2 = RFU
1299 //Dbprintf("transfer to client parameters: %llu | %llu | %llu", c->arg[0], c->arg[1], c->arg[2]);
1300
1301 for(size_t i = 0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1302 len = MIN( (c->arg[1] - i), USB_CMD_DATA_SIZE);
1303 isok = cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, i, len, BigBuf_get_traceLen(), BigBuf + startidx + i, len);
1304 if (!isok)
1305 Dbprintf("transfer to client failed :: | bytes %d", len);
1306 }
1307 // Trigger a finish downloading signal with an ACK frame
1308 cmd_send(CMD_ACK, 1, 0, BigBuf_get_traceLen(), getSamplingConfig(), sizeof(sample_config));
1309 LED_B_OFF();
1310 break;
1311 }
1312 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1313 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1314 // to be able to use this one for uploading data to device
1315 // arg1 = 0 upload for LF usage
1316 // 1 upload for HF usage
1317 if ( c->arg[1] == 0 )
1318 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1319 else
1320 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1321 uint8_t *b = BigBuf_get_addr();
1322 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1323 cmd_send(CMD_ACK,1,0,0,0,0);
1324 break;
1325 }
1326 case CMD_DOWNLOAD_EML_BIGBUF: {
1327 LED_B_ON();
1328 uint8_t *cardmem = BigBuf_get_EM_addr();
1329 size_t len = 0;
1330 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1331 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1332 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1333 }
1334 // Trigger a finish downloading signal with an ACK frame
1335 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1336 LED_B_OFF();
1337 break;
1338 }
1339 case CMD_READ_MEM:
1340 ReadMem(c->arg[0]);
1341 break;
1342
1343 case CMD_SET_LF_DIVISOR:
1344 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1345 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1346 break;
1347
1348 case CMD_SET_ADC_MUX:
1349 switch(c->arg[0]) {
1350 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1351 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1352 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1353 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1354 }
1355 break;
1356
1357 case CMD_VERSION:
1358 SendVersion();
1359 break;
1360 case CMD_STATUS:
1361 SendStatus();
1362 break;
1363 case CMD_PING:
1364 cmd_send(CMD_ACK,0,0,0,0,0);
1365 break;
1366 #ifdef WITH_LCD
1367 case CMD_LCD_RESET:
1368 LCDReset();
1369 break;
1370 case CMD_LCD:
1371 LCDSend(c->arg[0]);
1372 break;
1373 #endif
1374 case CMD_SETUP_WRITE:
1375 case CMD_FINISH_WRITE:
1376 case CMD_HARDWARE_RESET:
1377 usb_disable();
1378 SpinDelay(2000);
1379 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1380 for(;;) {
1381 // We're going to reset, and the bootrom will take control.
1382 }
1383 break;
1384
1385 case CMD_START_FLASH:
1386 if(common_area.flags.bootrom_present) {
1387 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1388 }
1389 usb_disable();
1390 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1391 for(;;);
1392 break;
1393
1394 case CMD_DEVICE_INFO: {
1395 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1396 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1397 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1398 break;
1399 }
1400 default:
1401 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1402 break;
1403 }
1404 }
1405
1406 void __attribute__((noreturn)) AppMain(void)
1407 {
1408 SpinDelay(100);
1409 clear_trace();
1410 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1411 /* Initialize common area */
1412 memset(&common_area, 0, sizeof(common_area));
1413 common_area.magic = COMMON_AREA_MAGIC;
1414 common_area.version = 1;
1415 }
1416 common_area.flags.osimage_present = 1;
1417
1418 LEDsoff();
1419
1420 // Init USB device
1421 usb_enable();
1422
1423 // The FPGA gets its clock from us from PCK0 output, so set that up.
1424 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1425 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1426 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1427 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1428 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK | AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1429 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1430
1431 // Reset SPI
1432 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1433 // Reset SSC
1434 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1435
1436 // Load the FPGA image, which we have stored in our flash.
1437 // (the HF version by default)
1438 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1439
1440 StartTickCount();
1441
1442 #ifdef WITH_LCD
1443 LCDInit();
1444 #endif
1445
1446 byte_t rx[sizeof(UsbCommand)];
1447 size_t rx_len;
1448
1449 for(;;) {
1450 if ( usb_poll_validate_length() ) {
1451 rx_len = usb_read(rx, sizeof(UsbCommand));
1452
1453 if (rx_len)
1454 UsbPacketReceived(rx, rx_len);
1455 }
1456 WDT_HIT();
1457
1458 #ifdef WITH_LF
1459 #ifndef WITH_ISO14443a_StandAlone
1460 if (BUTTON_HELD(1000) > 0)
1461 SamyRun();
1462 #endif
1463 #endif
1464 #ifdef WITH_ISO14443a
1465 #ifdef WITH_ISO14443a_StandAlone
1466 if (BUTTON_HELD(1000) > 0)
1467 StandAloneMode14a();
1468 #endif
1469 #endif
1470 }
1471 }
Proxmark3 GIT tracking
Impressum, Datenschutz