]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
cleanup
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include <hitagS.h>
27 #include "lfsampling.h"
28 #include "BigBuf.h"
29 #include "mifareutil.h"
30 #include "pcf7931.h"
31 #ifdef WITH_LCD
32 #include "LCD.h"
33 #endif
34
35 // Craig Young - 14a stand-alone code
36 #ifdef WITH_ISO14443a_StandAlone
37 #include "iso14443a.h"
38 #endif
39
40 //=============================================================================
41 // A buffer where we can queue things up to be sent through the FPGA, for
42 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
43 // is the order in which they go out on the wire.
44 //=============================================================================
45
46 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
47 uint8_t ToSend[TOSEND_BUFFER_SIZE];
48 int ToSendMax;
49 static int ToSendBit;
50 struct common_area common_area __attribute__((section(".commonarea")));
51
52 void ToSendReset(void)
53 {
54 ToSendMax = -1;
55 ToSendBit = 8;
56 }
57
58 void ToSendStuffBit(int b)
59 {
60 if(ToSendBit >= 8) {
61 ToSendMax++;
62 ToSend[ToSendMax] = 0;
63 ToSendBit = 0;
64 }
65
66 if(b) {
67 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
68 }
69
70 ToSendBit++;
71
72 if(ToSendMax >= sizeof(ToSend)) {
73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76 }
77
78 //=============================================================================
79 // Debug print functions, to go out over USB, to the usual PC-side client.
80 //=============================================================================
81
82 void DbpString(char *str)
83 {
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
86 }
87
88 #if 0
89 void DbpIntegers(int x1, int x2, int x3)
90 {
91 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
92 }
93 #endif
94
95 void Dbprintf(const char *fmt, ...) {
96 // should probably limit size here; oh well, let's just use a big buffer
97 char output_string[128];
98 va_list ap;
99
100 va_start(ap, fmt);
101 kvsprintf(fmt, output_string, 10, ap);
102 va_end(ap);
103
104 DbpString(output_string);
105 }
106
107 // prints HEX & ASCII
108 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
109 int l=0,i;
110 char ascii[9];
111
112 while (len>0) {
113 if (len>8) l=8;
114 else l=len;
115
116 memcpy(ascii,d,l);
117 ascii[l]=0;
118
119 // filter safe ascii
120 for (i=0;i<l;i++)
121 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
122
123 if (bAsci) {
124 Dbprintf("%-8s %*D",ascii,l,d," ");
125 } else {
126 Dbprintf("%*D",l,d," ");
127 }
128
129 len-=8;
130 d+=8;
131 }
132 }
133
134 //-----------------------------------------------------------------------------
135 // Read an ADC channel and block till it completes, then return the result
136 // in ADC units (0 to 1023). Also a routine to average 32 samples and
137 // return that.
138 //-----------------------------------------------------------------------------
139 static int ReadAdc(int ch)
140 {
141 uint32_t d;
142
143 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
144 AT91C_BASE_ADC->ADC_MR =
145 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
146 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
147 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
148
149 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
150 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
151 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
152 //
153 // The maths are:
154 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
155 //
156 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
157 //
158 // Note: with the "historic" values in the comments above, the error was 34% !!!
159
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161
162 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
163
164 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
165 ;
166 d = AT91C_BASE_ADC->ADC_CDR[ch];
167
168 return d;
169 }
170
171 int AvgAdc(int ch) // was static - merlok
172 {
173 int i;
174 int a = 0;
175
176 for(i = 0; i < 32; i++) {
177 a += ReadAdc(ch);
178 }
179
180 return (a + 15) >> 5;
181 }
182
183 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
184 {
185 int i, adcval = 0, peak = 0;
186
187 /*
188 * Sweeps the useful LF range of the proxmark from
189 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
190 * read the voltage in the antenna, the result left
191 * in the buffer is a graph which should clearly show
192 * the resonating frequency of your LF antenna
193 * ( hopefully around 95 if it is tuned to 125kHz!)
194 */
195
196 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
197 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
198 for (i=255; i>=19; i--) {
199 WDT_HIT();
200 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
201 SpinDelay(20);
202 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
203 if (i==95) *vLf125 = adcval; // voltage at 125Khz
204 if (i==89) *vLf134 = adcval; // voltage at 134Khz
205
206 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
207 if(LF_Results[i] > peak) {
208 *peakv = adcval;
209 peak = LF_Results[i];
210 *peakf = i;
211 //ptr = i;
212 }
213 }
214
215 for (i=18; i >= 0; i--) LF_Results[i] = 0;
216
217 return;
218 }
219
220 void MeasureAntennaTuningHfOnly(int *vHf)
221 {
222 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
223 LED_A_ON();
224 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
225 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
226 SpinDelay(20);
227 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
228 LED_A_OFF();
229
230 return;
231 }
232
233 void MeasureAntennaTuning(int mode)
234 {
235 uint8_t LF_Results[256] = {0};
236 int peakv = 0, peakf = 0;
237 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
238
239 LED_B_ON();
240
241 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
242 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
243 MeasureAntennaTuningHfOnly(&vHf);
244 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
245 } else {
246 if (mode & FLAG_TUNE_LF) {
247 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
248 }
249 if (mode & FLAG_TUNE_HF) {
250 MeasureAntennaTuningHfOnly(&vHf);
251 }
252 }
253
254 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
255 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
256 LED_B_OFF();
257 return;
258 }
259
260 void MeasureAntennaTuningHf(void)
261 {
262 int vHf = 0; // in mV
263
264 DbpString("Measuring HF antenna, press button to exit");
265
266 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
267 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
268 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
269
270 for (;;) {
271 SpinDelay(20);
272 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
273
274 Dbprintf("%d mV",vHf);
275 if (BUTTON_PRESS()) break;
276 }
277 DbpString("cancelled");
278
279 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
280
281 }
282
283
284 void ReadMem(int addr)
285 {
286 const uint8_t *data = ((uint8_t *)addr);
287
288 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
289 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
290 }
291
292 /* osimage version information is linked in */
293 extern struct version_information version_information;
294 /* bootrom version information is pointed to from _bootphase1_version_pointer */
295 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
296 void SendVersion(void)
297 {
298 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
299 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
300
301 /* Try to find the bootrom version information. Expect to find a pointer at
302 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
303 * pointer, then use it.
304 */
305 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
306 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
307 strcat(VersionString, "bootrom version information appears invalid\n");
308 } else {
309 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
311 }
312
313 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
314 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
315
316 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
317 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
318 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
319 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
320
321 // Send Chip ID and used flash memory
322 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
323 uint32_t compressed_data_section_size = common_area.arg1;
324 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
325 }
326
327 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
328 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
329 void printUSBSpeed(void)
330 {
331 Dbprintf("USB Speed:");
332 Dbprintf(" Sending USB packets to client...");
333
334 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
335 uint8_t *test_data = BigBuf_get_addr();
336 uint32_t end_time;
337
338 uint32_t start_time = end_time = GetTickCount();
339 uint32_t bytes_transferred = 0;
340
341 LED_B_ON();
342 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
343 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
344 end_time = GetTickCount();
345 bytes_transferred += USB_CMD_DATA_SIZE;
346 }
347 LED_B_OFF();
348
349 Dbprintf(" Time elapsed: %dms", end_time - start_time);
350 Dbprintf(" Bytes transferred: %d", bytes_transferred);
351 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
352 1000 * bytes_transferred / (end_time - start_time));
353
354 }
355
356 /**
357 * Prints runtime information about the PM3.
358 **/
359 void SendStatus(void)
360 {
361 BigBuf_print_status();
362 Fpga_print_status();
363 printConfig(); //LF Sampling config
364 printUSBSpeed();
365 Dbprintf("Various");
366 Dbprintf(" MF_DBGLEVEL......%d", MF_DBGLEVEL);
367 Dbprintf(" ToSendMax........%d",ToSendMax);
368 Dbprintf(" ToSendBit........%d",ToSendBit);
369
370 cmd_send(CMD_ACK,1,0,0,0,0);
371 }
372
373 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
374
375 #define OPTS 2
376
377 void StandAloneMode()
378 {
379 DbpString("Stand-alone mode! No PC necessary.");
380 // Oooh pretty -- notify user we're in elite samy mode now
381 LED(LED_RED, 200);
382 LED(LED_ORANGE, 200);
383 LED(LED_GREEN, 200);
384 LED(LED_ORANGE, 200);
385 LED(LED_RED, 200);
386 LED(LED_ORANGE, 200);
387 LED(LED_GREEN, 200);
388 LED(LED_ORANGE, 200);
389 LED(LED_RED, 200);
390
391 }
392
393 #endif
394
395
396
397 #ifdef WITH_ISO14443a_StandAlone
398 void StandAloneMode14a()
399 {
400 StandAloneMode();
401 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
402
403 int selected = 0;
404 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
405 int cardRead[OPTS] = {0};
406 uint8_t readUID[10] = {0};
407 uint32_t uid_1st[OPTS]={0};
408 uint32_t uid_2nd[OPTS]={0};
409 uint32_t uid_tmp1 = 0;
410 uint32_t uid_tmp2 = 0;
411 iso14a_card_select_t hi14a_card[OPTS];
412
413 LED(selected + 1, 0);
414
415 for (;;)
416 {
417 usb_poll();
418 WDT_HIT();
419 SpinDelay(300);
420
421 if (iGotoRecord == 1 || cardRead[selected] == 0)
422 {
423 iGotoRecord = 0;
424 LEDsoff();
425 LED(selected + 1, 0);
426 LED(LED_RED2, 0);
427
428 // record
429 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
430 /* need this delay to prevent catching some weird data */
431 SpinDelay(500);
432 /* Code for reading from 14a tag */
433 uint8_t uid[10] ={0};
434 uint32_t cuid;
435 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
436
437 for ( ; ; )
438 {
439 WDT_HIT();
440 if (BUTTON_PRESS()) {
441 if (cardRead[selected]) {
442 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
443 break;
444 }
445 else if (cardRead[(selected+1)%OPTS]) {
446 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
447 selected = (selected+1)%OPTS;
448 break; // playing = 1;
449 }
450 else {
451 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
452 SpinDelay(300);
453 }
454 }
455 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
456 continue;
457 else
458 {
459 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
460 memcpy(readUID,uid,10*sizeof(uint8_t));
461 uint8_t *dst = (uint8_t *)&uid_tmp1;
462 // Set UID byte order
463 for (int i=0; i<4; i++)
464 dst[i] = uid[3-i];
465 dst = (uint8_t *)&uid_tmp2;
466 for (int i=0; i<4; i++)
467 dst[i] = uid[7-i];
468 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
469 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
470 }
471 else {
472 if (uid_tmp2) {
473 Dbprintf("Bank[%d] received a 7-byte UID",selected);
474 uid_1st[selected] = (uid_tmp1)>>8;
475 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
476 }
477 else {
478 Dbprintf("Bank[%d] received a 4-byte UID",selected);
479 uid_1st[selected] = uid_tmp1;
480 uid_2nd[selected] = uid_tmp2;
481 }
482 break;
483 }
484 }
485 }
486 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
487 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
488 LEDsoff();
489 LED(LED_GREEN, 200);
490 LED(LED_ORANGE, 200);
491 LED(LED_GREEN, 200);
492 LED(LED_ORANGE, 200);
493
494 LEDsoff();
495 LED(selected + 1, 0);
496
497 // Next state is replay:
498 playing = 1;
499
500 cardRead[selected] = 1;
501 }
502 /* MF Classic UID clone */
503 else if (iGotoClone==1)
504 {
505 iGotoClone=0;
506 LEDsoff();
507 LED(selected + 1, 0);
508 LED(LED_ORANGE, 250);
509
510
511 // record
512 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
513
514 // wait for button to be released
515 while(BUTTON_PRESS())
516 {
517 // Delay cloning until card is in place
518 WDT_HIT();
519 }
520 Dbprintf("Starting clone. [Bank: %u]", selected);
521 // need this delay to prevent catching some weird data
522 SpinDelay(500);
523 // Begin clone function here:
524 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
525 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
526 memcpy(c.d.asBytes, data, 16);
527 SendCommand(&c);
528
529 Block read is similar:
530 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
531 We need to imitate that call with blockNo 0 to set a uid.
532
533 The get and set commands are handled in this file:
534 // Work with "magic Chinese" card
535 case CMD_MIFARE_CSETBLOCK:
536 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
537 break;
538 case CMD_MIFARE_CGETBLOCK:
539 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
540 break;
541
542 mfCSetUID provides example logic for UID set workflow:
543 -Read block0 from card in field with MifareCGetBlock()
544 -Configure new values without replacing reserved bytes
545 memcpy(block0, uid, 4); // Copy UID bytes from byte array
546 // Mifare UID BCC
547 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
548 Bytes 5-7 are reserved SAK and ATQA for mifare classic
549 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
550 */
551 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
552 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
553 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
554 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
555 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
556 playing = 1;
557 }
558 else {
559 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
560 memcpy(newBlock0,oldBlock0,16);
561 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
562
563 newBlock0[0] = uid_1st[selected]>>24;
564 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
565 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
566 newBlock0[3] = 0xFF & (uid_1st[selected]);
567 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
568 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
569 MifareCSetBlock(0, 0xFF,0, newBlock0);
570 MifareCGetBlock(0x3F, 1, 0, testBlock0);
571 if (memcmp(testBlock0,newBlock0,16)==0)
572 {
573 DbpString("Cloned successfull!");
574 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
575 playing = 0;
576 iGotoRecord = 1;
577 selected = (selected+1) % OPTS;
578 }
579 else {
580 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
581 playing = 1;
582 }
583 }
584 LEDsoff();
585 LED(selected + 1, 0);
586
587 }
588 // Change where to record (or begin playing)
589 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
590 {
591 LEDsoff();
592 LED(selected + 1, 0);
593
594 // Begin transmitting
595 if (playing)
596 {
597 LED(LED_GREEN, 0);
598 DbpString("Playing");
599 for ( ; ; ) {
600 WDT_HIT();
601 int button_action = BUTTON_HELD(1000);
602 if (button_action == 0) { // No button action, proceed with sim
603 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
604 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
605 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
606 DbpString("Mifare Classic");
607 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
608 }
609 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
610 DbpString("Mifare Ultralight");
611 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
612 }
613 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
614 DbpString("Mifare DESFire");
615 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
616 }
617 else {
618 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
619 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
620 }
621 }
622 else if (button_action == BUTTON_SINGLE_CLICK) {
623 selected = (selected + 1) % OPTS;
624 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
625 iGotoRecord = 1;
626 break;
627 }
628 else if (button_action == BUTTON_HOLD) {
629 Dbprintf("Playtime over. Begin cloning...");
630 iGotoClone = 1;
631 break;
632 }
633 WDT_HIT();
634 }
635
636 /* We pressed a button so ignore it here with a delay */
637 SpinDelay(300);
638 LEDsoff();
639 LED(selected + 1, 0);
640 }
641 else
642 while(BUTTON_PRESS())
643 WDT_HIT();
644 }
645 }
646 }
647 #elif WITH_LF
648 // samy's sniff and repeat routine
649 void SamyRun()
650 {
651 StandAloneMode();
652 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
653
654 int high[OPTS], low[OPTS];
655 int selected = 0;
656 int playing = 0;
657 int cardRead = 0;
658
659 // Turn on selected LED
660 LED(selected + 1, 0);
661
662 for (;;)
663 {
664 usb_poll();
665 WDT_HIT();
666
667 // Was our button held down or pressed?
668 int button_pressed = BUTTON_HELD(1000);
669 SpinDelay(300);
670
671 // Button was held for a second, begin recording
672 if (button_pressed > 0 && cardRead == 0)
673 {
674 LEDsoff();
675 LED(selected + 1, 0);
676 LED(LED_RED2, 0);
677
678 // record
679 DbpString("Starting recording");
680
681 // wait for button to be released
682 while(BUTTON_PRESS())
683 WDT_HIT();
684
685 /* need this delay to prevent catching some weird data */
686 SpinDelay(500);
687
688 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
689 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
690
691 LEDsoff();
692 LED(selected + 1, 0);
693 // Finished recording
694
695 // If we were previously playing, set playing off
696 // so next button push begins playing what we recorded
697 playing = 0;
698
699 cardRead = 1;
700
701 }
702
703 else if (button_pressed > 0 && cardRead == 1)
704 {
705 LEDsoff();
706 LED(selected + 1, 0);
707 LED(LED_ORANGE, 0);
708
709 // record
710 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
711
712 // wait for button to be released
713 while(BUTTON_PRESS())
714 WDT_HIT();
715
716 /* need this delay to prevent catching some weird data */
717 SpinDelay(500);
718
719 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
720 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
721
722 LEDsoff();
723 LED(selected + 1, 0);
724 // Finished recording
725
726 // If we were previously playing, set playing off
727 // so next button push begins playing what we recorded
728 playing = 0;
729
730 cardRead = 0;
731
732 }
733
734 // Change where to record (or begin playing)
735 else if (button_pressed)
736 {
737 // Next option if we were previously playing
738 if (playing)
739 selected = (selected + 1) % OPTS;
740 playing = !playing;
741
742 LEDsoff();
743 LED(selected + 1, 0);
744
745 // Begin transmitting
746 if (playing)
747 {
748 LED(LED_GREEN, 0);
749 DbpString("Playing");
750 // wait for button to be released
751 while(BUTTON_PRESS())
752 WDT_HIT();
753 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
754 CmdHIDsimTAG(high[selected], low[selected], 0);
755 DbpString("Done playing");
756 if (BUTTON_HELD(1000) > 0)
757 {
758 DbpString("Exiting");
759 LEDsoff();
760 return;
761 }
762
763 /* We pressed a button so ignore it here with a delay */
764 SpinDelay(300);
765
766 // when done, we're done playing, move to next option
767 selected = (selected + 1) % OPTS;
768 playing = !playing;
769 LEDsoff();
770 LED(selected + 1, 0);
771 }
772 else
773 while(BUTTON_PRESS())
774 WDT_HIT();
775 }
776 }
777 }
778
779 #endif
780 /*
781 OBJECTIVE
782 Listen and detect an external reader. Determine the best location
783 for the antenna.
784
785 INSTRUCTIONS:
786 Inside the ListenReaderField() function, there is two mode.
787 By default, when you call the function, you will enter mode 1.
788 If you press the PM3 button one time, you will enter mode 2.
789 If you press the PM3 button a second time, you will exit the function.
790
791 DESCRIPTION OF MODE 1:
792 This mode just listens for an external reader field and lights up green
793 for HF and/or red for LF. This is the original mode of the detectreader
794 function.
795
796 DESCRIPTION OF MODE 2:
797 This mode will visually represent, using the LEDs, the actual strength of the
798 current compared to the maximum current detected. Basically, once you know
799 what kind of external reader is present, it will help you spot the best location to place
800 your antenna. You will probably not get some good results if there is a LF and a HF reader
801 at the same place! :-)
802
803 LIGHT SCHEME USED:
804 */
805 static const char LIGHT_SCHEME[] = {
806 0x0, /* ---- | No field detected */
807 0x1, /* X--- | 14% of maximum current detected */
808 0x2, /* -X-- | 29% of maximum current detected */
809 0x4, /* --X- | 43% of maximum current detected */
810 0x8, /* ---X | 57% of maximum current detected */
811 0xC, /* --XX | 71% of maximum current detected */
812 0xE, /* -XXX | 86% of maximum current detected */
813 0xF, /* XXXX | 100% of maximum current detected */
814 };
815 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
816
817 void ListenReaderField(int limit)
818 {
819 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
820 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
821 int mode=1, display_val, display_max, i;
822
823 #define LF_ONLY 1
824 #define HF_ONLY 2
825 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
826
827
828 // switch off FPGA - we don't want to measure our own signal
829 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
830 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
831
832 LEDsoff();
833
834 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
835
836 if(limit != HF_ONLY) {
837 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
838 lf_baseline = lf_av;
839 }
840
841 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
842
843 if (limit != LF_ONLY) {
844 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
845 hf_baseline = hf_av;
846 }
847
848 for(;;) {
849 if (BUTTON_PRESS()) {
850 SpinDelay(500);
851 switch (mode) {
852 case 1:
853 mode=2;
854 DbpString("Signal Strength Mode");
855 break;
856 case 2:
857 default:
858 DbpString("Stopped");
859 LEDsoff();
860 return;
861 break;
862 }
863 }
864 WDT_HIT();
865
866 if (limit != HF_ONLY) {
867 if(mode == 1) {
868 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
869 LED_D_ON();
870 else
871 LED_D_OFF();
872 }
873
874 lf_av_new = AvgAdc(ADC_CHAN_LF);
875 // see if there's a significant change
876 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
877 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
878 lf_av = lf_av_new;
879 if (lf_av > lf_max)
880 lf_max = lf_av;
881 }
882 }
883
884 if (limit != LF_ONLY) {
885 if (mode == 1){
886 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
887 LED_B_ON();
888 else
889 LED_B_OFF();
890 }
891
892 hf_av_new = AvgAdc(ADC_CHAN_HF);
893 // see if there's a significant change
894 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
895 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
896 hf_av = hf_av_new;
897 if (hf_av > hf_max)
898 hf_max = hf_av;
899 }
900 }
901
902 if(mode == 2) {
903 if (limit == LF_ONLY) {
904 display_val = lf_av;
905 display_max = lf_max;
906 } else if (limit == HF_ONLY) {
907 display_val = hf_av;
908 display_max = hf_max;
909 } else { /* Pick one at random */
910 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
911 display_val = hf_av;
912 display_max = hf_max;
913 } else {
914 display_val = lf_av;
915 display_max = lf_max;
916 }
917 }
918 for (i=0; i<LIGHT_LEN; i++) {
919 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
920 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
921 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
922 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
923 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
924 break;
925 }
926 }
927 }
928 }
929 }
930
931 void UsbPacketReceived(uint8_t *packet, int len)
932 {
933 UsbCommand *c = (UsbCommand *)packet;
934
935 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
936
937 switch(c->cmd) {
938 #ifdef WITH_LF
939 case CMD_SET_LF_SAMPLING_CONFIG:
940 setSamplingConfig((sample_config *) c->d.asBytes);
941 break;
942 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
943 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
944 break;
945 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
946 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
947 break;
948 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
949 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
950 break;
951 case CMD_HID_DEMOD_FSK:
952 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
953 break;
954 case CMD_HID_SIM_TAG:
955 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
956 break;
957 case CMD_FSK_SIM_TAG:
958 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
959 break;
960 case CMD_ASK_SIM_TAG:
961 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
962 break;
963 case CMD_PSK_SIM_TAG:
964 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
965 break;
966 case CMD_HID_CLONE_TAG:
967 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
968 break;
969 case CMD_IO_DEMOD_FSK:
970 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
971 break;
972 case CMD_IO_CLONE_TAG:
973 CopyIOtoT55x7(c->arg[0], c->arg[1]);
974 break;
975 case CMD_EM410X_DEMOD:
976 CmdEM410xdemod(c->arg[0], 0, 0, 1);
977 break;
978 case CMD_EM410X_WRITE_TAG:
979 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
980 break;
981 case CMD_READ_TI_TYPE:
982 ReadTItag();
983 break;
984 case CMD_WRITE_TI_TYPE:
985 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
986 break;
987 case CMD_SIMULATE_TAG_125K:
988 LED_A_ON();
989 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
990 LED_A_OFF();
991 break;
992 case CMD_LF_SIMULATE_BIDIR:
993 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
994 break;
995 case CMD_INDALA_CLONE_TAG:
996 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
997 break;
998 case CMD_INDALA_CLONE_TAG_L:
999 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1000 break;
1001 case CMD_T55XX_READ_BLOCK:
1002 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1003 break;
1004 case CMD_T55XX_WRITE_BLOCK:
1005 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1006 break;
1007 case CMD_T55XX_WAKEUP:
1008 T55xxWakeUp(c->arg[0]);
1009 break;
1010 case CMD_T55XX_RESET_READ:
1011 T55xxResetRead();
1012 break;
1013 case CMD_PCF7931_READ:
1014 ReadPCF7931();
1015 break;
1016 case CMD_PCF7931_WRITE:
1017 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1018 break;
1019 case CMD_EM4X_READ_WORD:
1020 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1021 break;
1022 case CMD_EM4X_WRITE_WORD:
1023 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1024 break;
1025 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1026 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1027 break;
1028 case CMD_VIKING_CLONE_TAG:
1029 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1030 break;
1031 case CMD_COTAG:
1032 Cotag(c->arg[0]);
1033 break;
1034 #endif
1035
1036 #ifdef WITH_HITAG
1037 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1038 SnoopHitag(c->arg[0]);
1039 break;
1040 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1041 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1042 break;
1043 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1044 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1045 break;
1046 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1047 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1048 break;
1049 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1050 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1051 break;
1052 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1053 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1054 break;
1055 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1056 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1057 break;
1058 #endif
1059
1060 #ifdef WITH_ISO15693
1061 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1062 AcquireRawAdcSamplesIso15693();
1063 break;
1064 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1065 RecordRawAdcSamplesIso15693();
1066 break;
1067
1068 case CMD_ISO_15693_COMMAND:
1069 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1070 break;
1071
1072 case CMD_ISO_15693_FIND_AFI:
1073 BruteforceIso15693Afi(c->arg[0]);
1074 break;
1075
1076 case CMD_ISO_15693_DEBUG:
1077 SetDebugIso15693(c->arg[0]);
1078 break;
1079
1080 case CMD_READER_ISO_15693:
1081 ReaderIso15693(c->arg[0]);
1082 break;
1083 case CMD_SIMTAG_ISO_15693:
1084 SimTagIso15693(c->arg[0], c->d.asBytes);
1085 break;
1086 #endif
1087
1088 #ifdef WITH_LEGICRF
1089 case CMD_SIMULATE_TAG_LEGIC_RF:
1090 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1091 break;
1092
1093 case CMD_WRITER_LEGIC_RF:
1094 LegicRfWriter(c->arg[1], c->arg[0]);
1095 break;
1096
1097 case CMD_READER_LEGIC_RF:
1098 LegicRfReader(c->arg[0], c->arg[1]);
1099 break;
1100 #endif
1101
1102 #ifdef WITH_ISO14443b
1103 case CMD_READ_SRI512_TAG:
1104 ReadSTMemoryIso14443b(0x0F);
1105 break;
1106 case CMD_READ_SRIX4K_TAG:
1107 ReadSTMemoryIso14443b(0x7F);
1108 break;
1109 case CMD_SNOOP_ISO_14443B:
1110 SnoopIso14443b();
1111 break;
1112 case CMD_SIMULATE_TAG_ISO_14443B:
1113 SimulateIso14443bTag();
1114 break;
1115 case CMD_ISO_14443B_COMMAND:
1116 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1117 break;
1118 #endif
1119
1120 #ifdef WITH_ISO14443a
1121 case CMD_SNOOP_ISO_14443a:
1122 SnoopIso14443a(c->arg[0]);
1123 break;
1124 case CMD_READER_ISO_14443a:
1125 ReaderIso14443a(c);
1126 break;
1127 case CMD_SIMULATE_TAG_ISO_14443a:
1128 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1129 break;
1130
1131 case CMD_EPA_PACE_COLLECT_NONCE:
1132 EPA_PACE_Collect_Nonce(c);
1133 break;
1134 case CMD_EPA_PACE_REPLAY:
1135 EPA_PACE_Replay(c);
1136 break;
1137
1138 case CMD_READER_MIFARE:
1139 ReaderMifare(c->arg[0]);
1140 break;
1141 case CMD_MIFARE_READBL:
1142 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1143 break;
1144 case CMD_MIFAREU_READBL:
1145 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1146 break;
1147 case CMD_MIFAREUC_AUTH:
1148 MifareUC_Auth(c->arg[0],c->d.asBytes);
1149 break;
1150 case CMD_MIFAREU_READCARD:
1151 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1152 break;
1153 case CMD_MIFAREUC_SETPWD:
1154 MifareUSetPwd(c->arg[0], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_READSC:
1157 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1158 break;
1159 case CMD_MIFARE_WRITEBL:
1160 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1161 break;
1162 //case CMD_MIFAREU_WRITEBL_COMPAT:
1163 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1164 //break;
1165 case CMD_MIFAREU_WRITEBL:
1166 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1167 break;
1168 case CMD_MIFARE_NESTED:
1169 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1170 break;
1171 case CMD_MIFARE_CHKKEYS:
1172 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1173 break;
1174 case CMD_SIMULATE_MIFARE_CARD:
1175 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1176 break;
1177
1178 // emulator
1179 case CMD_MIFARE_SET_DBGMODE:
1180 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1181 break;
1182 case CMD_MIFARE_EML_MEMCLR:
1183 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1184 break;
1185 case CMD_MIFARE_EML_MEMSET:
1186 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1187 break;
1188 case CMD_MIFARE_EML_MEMGET:
1189 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1190 break;
1191 case CMD_MIFARE_EML_CARDLOAD:
1192 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1193 break;
1194
1195 // Work with "magic Chinese" card
1196 case CMD_MIFARE_CSETBLOCK:
1197 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1198 break;
1199 case CMD_MIFARE_CGETBLOCK:
1200 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1201 break;
1202 case CMD_MIFARE_CIDENT:
1203 MifareCIdent();
1204 break;
1205
1206 // mifare sniffer
1207 case CMD_MIFARE_SNIFFER:
1208 SniffMifare(c->arg[0]);
1209 break;
1210
1211 #endif
1212
1213 #ifdef WITH_ICLASS
1214 // Makes use of ISO14443a FPGA Firmware
1215 case CMD_SNOOP_ICLASS:
1216 SnoopIClass();
1217 break;
1218 case CMD_SIMULATE_TAG_ICLASS:
1219 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1220 break;
1221 case CMD_READER_ICLASS:
1222 ReaderIClass(c->arg[0]);
1223 break;
1224 case CMD_READER_ICLASS_REPLAY:
1225 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1226 break;
1227 case CMD_ICLASS_EML_MEMSET:
1228 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1229 break;
1230 case CMD_ICLASS_WRITEBLOCK:
1231 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1232 break;
1233 case CMD_ICLASS_READCHECK: // auth step 1
1234 iClass_ReadCheck(c->arg[0], c->arg[1]);
1235 break;
1236 case CMD_ICLASS_READBLOCK:
1237 iClass_ReadBlk(c->arg[0]);
1238 break;
1239 case CMD_ICLASS_AUTHENTICATION: //check
1240 iClass_Authentication(c->d.asBytes);
1241 break;
1242 case CMD_ICLASS_DUMP:
1243 iClass_Dump(c->arg[0], c->arg[1]);
1244 break;
1245 case CMD_ICLASS_CLONE:
1246 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1247 break;
1248 #endif
1249 #ifdef WITH_HFSNOOP
1250 case CMD_HF_SNIFFER:
1251 HfSnoop(c->arg[0], c->arg[1]);
1252 break;
1253 #endif
1254
1255 case CMD_BUFF_CLEAR:
1256 BigBuf_Clear();
1257 break;
1258
1259 case CMD_MEASURE_ANTENNA_TUNING:
1260 MeasureAntennaTuning(c->arg[0]);
1261 break;
1262
1263 case CMD_MEASURE_ANTENNA_TUNING_HF:
1264 MeasureAntennaTuningHf();
1265 break;
1266
1267 case CMD_LISTEN_READER_FIELD:
1268 ListenReaderField(c->arg[0]);
1269 break;
1270
1271 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1272 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1273 SpinDelay(200);
1274 LED_D_OFF(); // LED D indicates field ON or OFF
1275 break;
1276
1277 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1278
1279 LED_B_ON();
1280 uint8_t *BigBuf = BigBuf_get_addr();
1281 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1282 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1283 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1284 }
1285 // Trigger a finish downloading signal with an ACK frame
1286 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1287 LED_B_OFF();
1288 break;
1289
1290 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1291 uint8_t *b = BigBuf_get_addr();
1292 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1293 cmd_send(CMD_ACK,0,0,0,0,0);
1294 break;
1295 }
1296 case CMD_READ_MEM:
1297 ReadMem(c->arg[0]);
1298 break;
1299
1300 case CMD_SET_LF_DIVISOR:
1301 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1302 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1303 break;
1304
1305 case CMD_SET_ADC_MUX:
1306 switch(c->arg[0]) {
1307 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1308 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1309 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1310 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1311 }
1312 break;
1313
1314 case CMD_VERSION:
1315 SendVersion();
1316 break;
1317 case CMD_STATUS:
1318 SendStatus();
1319 break;
1320 case CMD_PING:
1321 cmd_send(CMD_ACK,0,0,0,0,0);
1322 break;
1323 #ifdef WITH_LCD
1324 case CMD_LCD_RESET:
1325 LCDReset();
1326 break;
1327 case CMD_LCD:
1328 LCDSend(c->arg[0]);
1329 break;
1330 #endif
1331 case CMD_SETUP_WRITE:
1332 case CMD_FINISH_WRITE:
1333 case CMD_HARDWARE_RESET:
1334 usb_disable();
1335 SpinDelay(1000);
1336 SpinDelay(1000);
1337 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1338 for(;;) {
1339 // We're going to reset, and the bootrom will take control.
1340 }
1341 break;
1342
1343 case CMD_START_FLASH:
1344 if(common_area.flags.bootrom_present) {
1345 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1346 }
1347 usb_disable();
1348 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1349 for(;;);
1350 break;
1351
1352 case CMD_DEVICE_INFO: {
1353 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1354 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1355 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1356 break;
1357 }
1358 default:
1359 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1360 break;
1361 }
1362 }
1363
1364 void __attribute__((noreturn)) AppMain(void)
1365 {
1366 SpinDelay(100);
1367 clear_trace();
1368 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1369 /* Initialize common area */
1370 memset(&common_area, 0, sizeof(common_area));
1371 common_area.magic = COMMON_AREA_MAGIC;
1372 common_area.version = 1;
1373 }
1374 common_area.flags.osimage_present = 1;
1375
1376 LED_D_OFF();
1377 LED_C_OFF();
1378 LED_B_OFF();
1379 LED_A_OFF();
1380
1381 // Init USB device
1382 usb_enable();
1383
1384 // The FPGA gets its clock from us from PCK0 output, so set that up.
1385 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1386 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1387 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1388 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1389 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1390 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1391 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1392
1393 // Reset SPI
1394 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1395 // Reset SSC
1396 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1397
1398 // Load the FPGA image, which we have stored in our flash.
1399 // (the HF version by default)
1400 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1401
1402 StartTickCount();
1403
1404 #ifdef WITH_LCD
1405 LCDInit();
1406 #endif
1407
1408 byte_t rx[sizeof(UsbCommand)];
1409 size_t rx_len;
1410
1411 for(;;) {
1412 if (usb_poll()) {
1413 rx_len = usb_read(rx,sizeof(UsbCommand));
1414 if (rx_len) {
1415 UsbPacketReceived(rx,rx_len);
1416 }
1417 }
1418 WDT_HIT();
1419
1420 #ifdef WITH_LF
1421 #ifndef WITH_ISO14443a_StandAlone
1422 if (BUTTON_HELD(1000) > 0)
1423 SamyRun();
1424 #endif
1425 #endif
1426 #ifdef WITH_ISO14443a
1427 #ifdef WITH_ISO14443a_StandAlone
1428 if (BUTTON_HELD(1000) > 0)
1429 StandAloneMode14a();
1430 #endif
1431 #endif
1432 }
1433 }
Proxmark3 GIT tracking
Impressum, Datenschutz