]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


eabe9fbe627c15c97d8065bdb99b4b0c4939369a
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "hitag2.h"
25 #include "hitagS.h"
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #include "mifareutil.h"
29 #include "pcf7931.h"
30 #ifdef WITH_LCD
31 #include "LCD.h"
32 #endif
33
34 // Craig Young - 14a stand-alone code
35 #ifdef WITH_ISO14443a
36 #include "iso14443a.h"
37 #endif
38
39 //=============================================================================
40 // A buffer where we can queue things up to be sent through the FPGA, for
41 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
42 // is the order in which they go out on the wire.
43 //=============================================================================
44
45 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
46 uint8_t ToSend[TOSEND_BUFFER_SIZE];
47 int ToSendMax;
48 static int ToSendBit;
49 struct common_area common_area __attribute__((section(".commonarea")));
50
51 void ToSendReset(void)
52 {
53 ToSendMax = -1;
54 ToSendBit = 8;
55 }
56
57 void ToSendStuffBit(int b)
58 {
59 if(ToSendBit >= 8) {
60 ToSendMax++;
61 ToSend[ToSendMax] = 0;
62 ToSendBit = 0;
63 }
64
65 if(b) {
66 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
67 }
68
69 ToSendBit++;
70
71 if(ToSendMax >= sizeof(ToSend)) {
72 ToSendBit = 0;
73 DbpString("ToSendStuffBit overflowed!");
74 }
75 }
76
77 //=============================================================================
78 // Debug print functions, to go out over USB, to the usual PC-side client.
79 //=============================================================================
80
81 void DbpString(char *str)
82 {
83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
85 }
86
87 #if 0
88 void DbpIntegers(int x1, int x2, int x3)
89 {
90 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
91 }
92 #endif
93
94 void Dbprintf(const char *fmt, ...) {
95 // should probably limit size here; oh well, let's just use a big buffer
96 char output_string[128];
97 va_list ap;
98
99 va_start(ap, fmt);
100 kvsprintf(fmt, output_string, 10, ap);
101 va_end(ap);
102
103 DbpString(output_string);
104 }
105
106 // prints HEX & ASCII
107 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
108 int l=0,i;
109 char ascii[9];
110
111 while (len>0) {
112 if (len>8) l=8;
113 else l=len;
114
115 memcpy(ascii,d,l);
116 ascii[l]=0;
117
118 // filter safe ascii
119 for (i=0;i<l;i++)
120 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
121
122 if (bAsci) {
123 Dbprintf("%-8s %*D",ascii,l,d," ");
124 } else {
125 Dbprintf("%*D",l,d," ");
126 }
127
128 len-=8;
129 d+=8;
130 }
131 }
132
133 //-----------------------------------------------------------------------------
134 // Read an ADC channel and block till it completes, then return the result
135 // in ADC units (0 to 1023). Also a routine to average 32 samples and
136 // return that.
137 //-----------------------------------------------------------------------------
138 static int ReadAdc(int ch)
139 {
140 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
141 // AMPL_HI is are high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
142 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
143 //
144 // The maths are:
145 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
146 //
147 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
148
149 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
150 AT91C_BASE_ADC->ADC_MR =
151 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
152 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
153 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
154
155 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
157
158 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
159
160 return AT91C_BASE_ADC->ADC_CDR[ch];
161 }
162
163 int AvgAdc(int ch) // was static - merlok
164 {
165 int i;
166 int a = 0;
167
168 for(i = 0; i < 32; i++) {
169 a += ReadAdc(ch);
170 }
171
172 return (a + 15) >> 5;
173 }
174
175 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
176 {
177 int i, adcval = 0, peak = 0;
178
179 /*
180 * Sweeps the useful LF range of the proxmark from
181 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
182 * read the voltage in the antenna, the result left
183 * in the buffer is a graph which should clearly show
184 * the resonating frequency of your LF antenna
185 * ( hopefully around 95 if it is tuned to 125kHz!)
186 */
187
188 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
189 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
190 SpinDelay(50);
191
192 for (i=255; i>=19; i--) {
193 WDT_HIT();
194 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
195 SpinDelay(20);
196 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
197 if (i==95) *vLf125 = adcval; // voltage at 125Khz
198 if (i==89) *vLf134 = adcval; // voltage at 134Khz
199
200 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
201 if(LF_Results[i] > peak) {
202 *peakv = adcval;
203 peak = LF_Results[i];
204 *peakf = i;
205 //ptr = i;
206 }
207 }
208
209 for (i=18; i >= 0; i--) LF_Results[i] = 0;
210
211 return;
212 }
213
214 void MeasureAntennaTuningHfOnly(int *vHf)
215 {
216 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
217 LED_A_ON();
218 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
219 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
220 SpinDelay(20);
221 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
222 LED_A_OFF();
223
224 return;
225 }
226
227 void MeasureAntennaTuning(int mode)
228 {
229 uint8_t LF_Results[256] = {0};
230 int peakv = 0, peakf = 0;
231 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
232
233 LED_B_ON();
234
235 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
236 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
237 MeasureAntennaTuningHfOnly(&vHf);
238 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
239 } else {
240 if (mode & FLAG_TUNE_LF) {
241 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
242 }
243 if (mode & FLAG_TUNE_HF) {
244 MeasureAntennaTuningHfOnly(&vHf);
245 }
246 }
247
248 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
249 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
250 LED_B_OFF();
251 return;
252 }
253
254 void MeasureAntennaTuningHf(void)
255 {
256 int vHf = 0; // in mV
257
258 DbpString("Measuring HF antenna, press button to exit");
259
260 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
261 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
262 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
263
264 for (;;) {
265 SpinDelay(20);
266 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
267
268 Dbprintf("%d mV",vHf);
269 if (BUTTON_PRESS()) break;
270 }
271 DbpString("cancelled");
272
273 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
274
275 }
276
277
278 void ReadMem(int addr)
279 {
280 const uint8_t *data = ((uint8_t *)addr);
281
282 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
283 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
284 }
285
286 /* osimage version information is linked in */
287 extern struct version_information version_information;
288 /* bootrom version information is pointed to from _bootphase1_version_pointer */
289 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
290
291 void SendVersion(void)
292 {
293 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
294 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
295
296 /* Try to find the bootrom version information. Expect to find a pointer at
297 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
298 * pointer, then use it.
299 */
300 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
301 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
302 strcat(VersionString, "bootrom version information appears invalid\n");
303 } else {
304 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
305 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
306 }
307
308 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
309 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
310
311 for (int i = 0; i < fpga_bitstream_num; i++) {
312 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
313 if (i < fpga_bitstream_num - 1) {
314 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
315 }
316 }
317
318 // Send Chip ID and used flash memory
319 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
320 uint32_t compressed_data_section_size = common_area.arg1;
321 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
322 }
323
324 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
325 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
326 void printUSBSpeed(void)
327 {
328 Dbprintf("USB Speed:");
329 Dbprintf(" Sending USB packets to client...");
330
331 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
332 uint8_t *test_data = BigBuf_get_addr();
333 uint32_t end_time;
334
335 uint32_t start_time = end_time = GetTickCount();
336 uint32_t bytes_transferred = 0;
337
338 LED_B_ON();
339 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
340 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
341 end_time = GetTickCount();
342 bytes_transferred += USB_CMD_DATA_SIZE;
343 }
344 LED_B_OFF();
345
346 Dbprintf(" Time elapsed: %dms", end_time - start_time);
347 Dbprintf(" Bytes transferred: %d", bytes_transferred);
348 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
349 1000 * bytes_transferred / (end_time - start_time));
350
351 }
352
353 /**
354 * Prints runtime information about the PM3.
355 **/
356 void SendStatus(void)
357 {
358 BigBuf_print_status();
359 Fpga_print_status();
360 printConfig(); //LF Sampling config
361 printUSBSpeed();
362 Dbprintf("Various");
363 Dbprintf(" MF_DBGLEVEL......%d", MF_DBGLEVEL);
364 Dbprintf(" ToSendMax........%d",ToSendMax);
365 Dbprintf(" ToSendBit........%d",ToSendBit);
366
367 cmd_send(CMD_ACK,1,0,0,0,0);
368 }
369
370 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
371
372 #define OPTS 2
373
374 void StandAloneMode()
375 {
376 DbpString("Stand-alone mode! No PC necessary.");
377 // Oooh pretty -- notify user we're in elite samy mode now
378 LED(LED_RED, 200);
379 LED(LED_ORANGE, 200);
380 LED(LED_GREEN, 200);
381 LED(LED_ORANGE, 200);
382 LED(LED_RED, 200);
383 LED(LED_ORANGE, 200);
384 LED(LED_GREEN, 200);
385 LED(LED_ORANGE, 200);
386 LED(LED_RED, 200);
387
388 }
389
390 #endif
391
392
393
394 #ifdef WITH_ISO14443a_StandAlone
395 void StandAloneMode14a()
396 {
397 StandAloneMode();
398 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
399
400 int selected = 0;
401 bool playing = false, GotoRecord = false, GotoClone = false;
402 bool cardRead[OPTS] = {false};
403 uint8_t readUID[10] = {0};
404 uint32_t uid_1st[OPTS]={0};
405 uint32_t uid_2nd[OPTS]={0};
406 uint32_t uid_tmp1 = 0;
407 uint32_t uid_tmp2 = 0;
408 iso14a_card_select_t hi14a_card[OPTS];
409
410 LED(selected + 1, 0);
411
412 for (;;)
413 {
414 usb_poll();
415 WDT_HIT();
416 SpinDelay(300);
417
418 if (GotoRecord || !cardRead[selected])
419 {
420 GotoRecord = false;
421 LEDsoff();
422 LED(selected + 1, 0);
423 LED(LED_RED2, 0);
424
425 // record
426 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
427 /* need this delay to prevent catching some weird data */
428 SpinDelay(500);
429 /* Code for reading from 14a tag */
430 uint8_t uid[10] ={0};
431 uint32_t cuid;
432 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
433
434 for ( ; ; )
435 {
436 WDT_HIT();
437 if (BUTTON_PRESS()) {
438 if (cardRead[selected]) {
439 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
440 break;
441 }
442 else if (cardRead[(selected+1)%OPTS]) {
443 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
444 selected = (selected+1)%OPTS;
445 break;
446 }
447 else {
448 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
449 SpinDelay(300);
450 }
451 }
452 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
453 continue;
454 else
455 {
456 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
457 memcpy(readUID,uid,10*sizeof(uint8_t));
458 uint8_t *dst = (uint8_t *)&uid_tmp1;
459 // Set UID byte order
460 for (int i=0; i<4; i++)
461 dst[i] = uid[3-i];
462 dst = (uint8_t *)&uid_tmp2;
463 for (int i=0; i<4; i++)
464 dst[i] = uid[7-i];
465 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
466 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
467 }
468 else {
469 if (uid_tmp2) {
470 Dbprintf("Bank[%d] received a 7-byte UID",selected);
471 uid_1st[selected] = (uid_tmp1)>>8;
472 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
473 }
474 else {
475 Dbprintf("Bank[%d] received a 4-byte UID",selected);
476 uid_1st[selected] = uid_tmp1;
477 uid_2nd[selected] = uid_tmp2;
478 }
479 break;
480 }
481 }
482 }
483 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
484 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
485 LEDsoff();
486 LED(LED_GREEN, 200);
487 LED(LED_ORANGE, 200);
488 LED(LED_GREEN, 200);
489 LED(LED_ORANGE, 200);
490
491 LEDsoff();
492 LED(selected + 1, 0);
493
494 // Next state is replay:
495 playing = true;
496
497 cardRead[selected] = true;
498 }
499 /* MF Classic UID clone */
500 else if (GotoClone)
501 {
502 GotoClone=false;
503 LEDsoff();
504 LED(selected + 1, 0);
505 LED(LED_ORANGE, 250);
506
507
508 // record
509 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
510
511 // wait for button to be released
512 while(BUTTON_PRESS())
513 {
514 // Delay cloning until card is in place
515 WDT_HIT();
516 }
517 Dbprintf("Starting clone. [Bank: %u]", selected);
518 // need this delay to prevent catching some weird data
519 SpinDelay(500);
520 // Begin clone function here:
521 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
522 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
523 memcpy(c.d.asBytes, data, 16);
524 SendCommand(&c);
525
526 Block read is similar:
527 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
528 We need to imitate that call with blockNo 0 to set a uid.
529
530 The get and set commands are handled in this file:
531 // Work with "magic Chinese" card
532 case CMD_MIFARE_CSETBLOCK:
533 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
534 break;
535 case CMD_MIFARE_CGETBLOCK:
536 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
537 break;
538
539 mfCSetUID provides example logic for UID set workflow:
540 -Read block0 from card in field with MifareCGetBlock()
541 -Configure new values without replacing reserved bytes
542 memcpy(block0, uid, 4); // Copy UID bytes from byte array
543 // Mifare UID BCC
544 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
545 Bytes 5-7 are reserved SAK and ATQA for mifare classic
546 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
547 */
548 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
549 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
550 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
551 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
552 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
553 playing = true;
554 }
555 else {
556 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
557 memcpy(newBlock0,oldBlock0,16);
558 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
559
560 newBlock0[0] = uid_1st[selected]>>24;
561 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
562 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
563 newBlock0[3] = 0xFF & (uid_1st[selected]);
564 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
565 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
566 MifareCSetBlock(0, 0xFF,0, newBlock0);
567 MifareCGetBlock(0x3F, 1, 0, testBlock0);
568 if (memcmp(testBlock0,newBlock0,16)==0)
569 {
570 DbpString("Cloned successfull!");
571 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
572 playing = false;
573 GotoRecord = true;
574 selected = (selected+1) % OPTS;
575 }
576 else {
577 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
578 playing = true;
579 }
580 }
581 LEDsoff();
582 LED(selected + 1, 0);
583
584 }
585 // Change where to record (or begin playing)
586 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
587 {
588 LEDsoff();
589 LED(selected + 1, 0);
590
591 // Begin transmitting
592 LED(LED_GREEN, 0);
593 DbpString("Playing");
594 for ( ; ; ) {
595 WDT_HIT();
596 int button_action = BUTTON_HELD(1000);
597 if (button_action == 0) { // No button action, proceed with sim
598 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
599 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
600 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
601 DbpString("Mifare Classic");
602 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
603 }
604 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
605 DbpString("Mifare Ultralight");
606 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
607 }
608 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
609 DbpString("Mifare DESFire");
610 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
611 }
612 else {
613 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
614 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
615 }
616 }
617 else if (button_action == BUTTON_SINGLE_CLICK) {
618 selected = (selected + 1) % OPTS;
619 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
620 GotoRecord = true;
621 break;
622 }
623 else if (button_action == BUTTON_HOLD) {
624 Dbprintf("Playtime over. Begin cloning...");
625 GotoClone = true;
626 break;
627 }
628 WDT_HIT();
629 }
630
631 /* We pressed a button so ignore it here with a delay */
632 SpinDelay(300);
633 LEDsoff();
634 LED(selected + 1, 0);
635 }
636 }
637 }
638 #elif WITH_LF
639 // samy's sniff and repeat routine
640 void SamyRun()
641 {
642 StandAloneMode();
643 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
644
645 int high[OPTS], low[OPTS];
646 int selected = 0;
647 int playing = 0;
648 int cardRead = 0;
649
650 // Turn on selected LED
651 LED(selected + 1, 0);
652
653 for (;;)
654 {
655 usb_poll();
656 WDT_HIT();
657
658 // Was our button held down or pressed?
659 int button_pressed = BUTTON_HELD(1000);
660 SpinDelay(300);
661
662 // Button was held for a second, begin recording
663 if (button_pressed > 0 && cardRead == 0)
664 {
665 LEDsoff();
666 LED(selected + 1, 0);
667 LED(LED_RED2, 0);
668
669 // record
670 DbpString("Starting recording");
671
672 // wait for button to be released
673 while(BUTTON_PRESS())
674 WDT_HIT();
675
676 /* need this delay to prevent catching some weird data */
677 SpinDelay(500);
678
679 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
680 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
681
682 LEDsoff();
683 LED(selected + 1, 0);
684 // Finished recording
685
686 // If we were previously playing, set playing off
687 // so next button push begins playing what we recorded
688 playing = 0;
689
690 cardRead = 1;
691
692 }
693
694 else if (button_pressed > 0 && cardRead == 1)
695 {
696 LEDsoff();
697 LED(selected + 1, 0);
698 LED(LED_ORANGE, 0);
699
700 // record
701 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
702
703 // wait for button to be released
704 while(BUTTON_PRESS())
705 WDT_HIT();
706
707 /* need this delay to prevent catching some weird data */
708 SpinDelay(500);
709
710 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
711 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
712
713 LEDsoff();
714 LED(selected + 1, 0);
715 // Finished recording
716
717 // If we were previously playing, set playing off
718 // so next button push begins playing what we recorded
719 playing = 0;
720
721 cardRead = 0;
722
723 }
724
725 // Change where to record (or begin playing)
726 else if (button_pressed)
727 {
728 // Next option if we were previously playing
729 if (playing)
730 selected = (selected + 1) % OPTS;
731 playing = !playing;
732
733 LEDsoff();
734 LED(selected + 1, 0);
735
736 // Begin transmitting
737 if (playing)
738 {
739 LED(LED_GREEN, 0);
740 DbpString("Playing");
741 // wait for button to be released
742 while(BUTTON_PRESS())
743 WDT_HIT();
744 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
745 CmdHIDsimTAG(high[selected], low[selected], 0);
746 DbpString("Done playing");
747 if (BUTTON_HELD(1000) > 0)
748 {
749 DbpString("Exiting");
750 LEDsoff();
751 return;
752 }
753
754 /* We pressed a button so ignore it here with a delay */
755 SpinDelay(300);
756
757 // when done, we're done playing, move to next option
758 selected = (selected + 1) % OPTS;
759 playing = !playing;
760 LEDsoff();
761 LED(selected + 1, 0);
762 }
763 else
764 while(BUTTON_PRESS())
765 WDT_HIT();
766 }
767 }
768 }
769
770 #endif
771 /*
772 OBJECTIVE
773 Listen and detect an external reader. Determine the best location
774 for the antenna.
775
776 INSTRUCTIONS:
777 Inside the ListenReaderField() function, there is two mode.
778 By default, when you call the function, you will enter mode 1.
779 If you press the PM3 button one time, you will enter mode 2.
780 If you press the PM3 button a second time, you will exit the function.
781
782 DESCRIPTION OF MODE 1:
783 This mode just listens for an external reader field and lights up green
784 for HF and/or red for LF. This is the original mode of the detectreader
785 function.
786
787 DESCRIPTION OF MODE 2:
788 This mode will visually represent, using the LEDs, the actual strength of the
789 current compared to the maximum current detected. Basically, once you know
790 what kind of external reader is present, it will help you spot the best location to place
791 your antenna. You will probably not get some good results if there is a LF and a HF reader
792 at the same place! :-)
793
794 LIGHT SCHEME USED:
795 */
796 static const char LIGHT_SCHEME[] = {
797 0x0, /* ---- | No field detected */
798 0x1, /* X--- | 14% of maximum current detected */
799 0x2, /* -X-- | 29% of maximum current detected */
800 0x4, /* --X- | 43% of maximum current detected */
801 0x8, /* ---X | 57% of maximum current detected */
802 0xC, /* --XX | 71% of maximum current detected */
803 0xE, /* -XXX | 86% of maximum current detected */
804 0xF, /* XXXX | 100% of maximum current detected */
805 };
806 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
807
808 void ListenReaderField(int limit)
809 {
810 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
811 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
812 int mode=1, display_val, display_max, i;
813
814 #define LF_ONLY 1
815 #define HF_ONLY 2
816 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
817
818
819 // switch off FPGA - we don't want to measure our own signal
820 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
821 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
822
823 LEDsoff();
824
825 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
826
827 if(limit != HF_ONLY) {
828 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
829 lf_baseline = lf_av;
830 }
831
832 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
833
834 if (limit != LF_ONLY) {
835 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
836 hf_baseline = hf_av;
837 }
838
839 for(;;) {
840 if (BUTTON_PRESS()) {
841 SpinDelay(500);
842 switch (mode) {
843 case 1:
844 mode=2;
845 DbpString("Signal Strength Mode");
846 break;
847 case 2:
848 default:
849 DbpString("Stopped");
850 LEDsoff();
851 return;
852 break;
853 }
854 }
855 WDT_HIT();
856
857 if (limit != HF_ONLY) {
858 if(mode == 1) {
859 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
860 LED_D_ON();
861 else
862 LED_D_OFF();
863 }
864
865 lf_av_new = AvgAdc(ADC_CHAN_LF);
866 // see if there's a significant change
867 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
868 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
869 lf_av = lf_av_new;
870 if (lf_av > lf_max)
871 lf_max = lf_av;
872 }
873 }
874
875 if (limit != LF_ONLY) {
876 if (mode == 1){
877 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
878 LED_B_ON();
879 else
880 LED_B_OFF();
881 }
882
883 hf_av_new = AvgAdc(ADC_CHAN_HF);
884 // see if there's a significant change
885 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
886 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
887 hf_av = hf_av_new;
888 if (hf_av > hf_max)
889 hf_max = hf_av;
890 }
891 }
892
893 if(mode == 2) {
894 if (limit == LF_ONLY) {
895 display_val = lf_av;
896 display_max = lf_max;
897 } else if (limit == HF_ONLY) {
898 display_val = hf_av;
899 display_max = hf_max;
900 } else { /* Pick one at random */
901 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
902 display_val = hf_av;
903 display_max = hf_max;
904 } else {
905 display_val = lf_av;
906 display_max = lf_max;
907 }
908 }
909 for (i=0; i<LIGHT_LEN; i++) {
910 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
911 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
912 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
913 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
914 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
915 break;
916 }
917 }
918 }
919 }
920 }
921
922 void UsbPacketReceived(uint8_t *packet, int len)
923 {
924 UsbCommand *c = (UsbCommand *)packet;
925
926 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
927
928 switch(c->cmd) {
929 #ifdef WITH_LF
930 case CMD_SET_LF_SAMPLING_CONFIG:
931 setSamplingConfig((sample_config *) c->d.asBytes);
932 break;
933 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
934 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
935 break;
936 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
937 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
938 break;
939 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
940 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
941 break;
942 case CMD_HID_DEMOD_FSK:
943 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
944 break;
945 case CMD_HID_SIM_TAG:
946 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
947 break;
948 case CMD_FSK_SIM_TAG:
949 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
950 break;
951 case CMD_ASK_SIM_TAG:
952 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
953 break;
954 case CMD_PSK_SIM_TAG:
955 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
956 break;
957 case CMD_HID_CLONE_TAG:
958 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
959 break;
960 case CMD_IO_DEMOD_FSK:
961 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
962 break;
963 case CMD_IO_CLONE_TAG:
964 CopyIOtoT55x7(c->arg[0], c->arg[1]);
965 break;
966 case CMD_EM410X_DEMOD:
967 CmdEM410xdemod(c->arg[0], 0, 0, 1);
968 break;
969 case CMD_EM410X_WRITE_TAG:
970 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
971 break;
972 case CMD_READ_TI_TYPE:
973 ReadTItag();
974 break;
975 case CMD_WRITE_TI_TYPE:
976 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
977 break;
978 case CMD_SIMULATE_TAG_125K:
979 LED_A_ON();
980 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
981 LED_A_OFF();
982 break;
983 case CMD_LF_SIMULATE_BIDIR:
984 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
985 break;
986 case CMD_INDALA_CLONE_TAG:
987 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
988 break;
989 case CMD_INDALA_CLONE_TAG_L:
990 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
991 break;
992 case CMD_T55XX_READ_BLOCK:
993 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
994 break;
995 case CMD_T55XX_WRITE_BLOCK:
996 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
997 break;
998 case CMD_T55XX_WAKEUP:
999 T55xxWakeUp(c->arg[0]);
1000 break;
1001 case CMD_T55XX_RESET_READ:
1002 T55xxResetRead();
1003 break;
1004 case CMD_PCF7931_READ:
1005 ReadPCF7931();
1006 break;
1007 case CMD_PCF7931_WRITE:
1008 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1009 break;
1010 case CMD_EM4X_READ_WORD:
1011 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1012 break;
1013 case CMD_EM4X_WRITE_WORD:
1014 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1015 break;
1016 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1017 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1018 break;
1019 case CMD_VIKING_CLONE_TAG:
1020 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1021 break;
1022 case CMD_COTAG:
1023 Cotag(c->arg[0]);
1024 break;
1025 #endif
1026
1027 #ifdef WITH_HITAG
1028 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1029 SnoopHitag(c->arg[0]);
1030 break;
1031 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1032 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1033 break;
1034 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1035 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1036 break;
1037 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1038 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1039 break;
1040 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1041 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1042 break;
1043 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1044 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1045 break;
1046 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1047 if ((hitag_function)c->arg[0] < 10) {
1048 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1049 }
1050 else if ((hitag_function)c->arg[0] >= 10) {
1051 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1052 }
1053 break;
1054 #endif
1055
1056 #ifdef WITH_ISO15693
1057 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1058 AcquireRawAdcSamplesIso15693();
1059 break;
1060 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1061 RecordRawAdcSamplesIso15693();
1062 break;
1063
1064 case CMD_ISO_15693_COMMAND:
1065 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1066 break;
1067
1068 case CMD_ISO_15693_FIND_AFI:
1069 BruteforceIso15693Afi(c->arg[0]);
1070 break;
1071
1072 case CMD_ISO_15693_DEBUG:
1073 SetDebugIso15693(c->arg[0]);
1074 break;
1075
1076 case CMD_READER_ISO_15693:
1077 ReaderIso15693(c->arg[0]);
1078 break;
1079 case CMD_SIMTAG_ISO_15693:
1080 SimTagIso15693(c->arg[0], c->d.asBytes);
1081 break;
1082 #endif
1083
1084 #ifdef WITH_LEGICRF
1085 case CMD_SIMULATE_TAG_LEGIC_RF:
1086 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1087 break;
1088
1089 case CMD_WRITER_LEGIC_RF:
1090 LegicRfWriter(c->arg[1], c->arg[0]);
1091 break;
1092
1093 case CMD_READER_LEGIC_RF:
1094 LegicRfReader(c->arg[0], c->arg[1]);
1095 break;
1096 #endif
1097
1098 #ifdef WITH_ISO14443b
1099 case CMD_READ_SRI512_TAG:
1100 ReadSTMemoryIso14443b(0x0F);
1101 break;
1102 case CMD_READ_SRIX4K_TAG:
1103 ReadSTMemoryIso14443b(0x7F);
1104 break;
1105 case CMD_SNOOP_ISO_14443B:
1106 SnoopIso14443b();
1107 break;
1108 case CMD_SIMULATE_TAG_ISO_14443B:
1109 SimulateIso14443bTag();
1110 break;
1111 case CMD_ISO_14443B_COMMAND:
1112 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1113 break;
1114 #endif
1115
1116 #ifdef WITH_ISO14443a
1117 case CMD_SNOOP_ISO_14443a:
1118 SnoopIso14443a(c->arg[0]);
1119 break;
1120 case CMD_READER_ISO_14443a:
1121 ReaderIso14443a(c);
1122 break;
1123 case CMD_SIMULATE_TAG_ISO_14443a:
1124 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1125 break;
1126
1127 case CMD_EPA_PACE_COLLECT_NONCE:
1128 EPA_PACE_Collect_Nonce(c);
1129 break;
1130 case CMD_EPA_PACE_REPLAY:
1131 EPA_PACE_Replay(c);
1132 break;
1133
1134 case CMD_READER_MIFARE:
1135 ReaderMifare(c->arg[0]);
1136 break;
1137 case CMD_MIFARE_READBL:
1138 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1139 break;
1140 case CMD_MIFAREU_READBL:
1141 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1142 break;
1143 case CMD_MIFAREUC_AUTH:
1144 MifareUC_Auth(c->arg[0],c->d.asBytes);
1145 break;
1146 case CMD_MIFAREU_READCARD:
1147 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1148 break;
1149 case CMD_MIFAREUC_SETPWD:
1150 MifareUSetPwd(c->arg[0], c->d.asBytes);
1151 break;
1152 case CMD_MIFARE_READSC:
1153 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1154 break;
1155 case CMD_MIFARE_WRITEBL:
1156 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1157 break;
1158 //case CMD_MIFAREU_WRITEBL_COMPAT:
1159 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1160 //break;
1161 case CMD_MIFAREU_WRITEBL:
1162 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1163 break;
1164 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1165 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1166 break;
1167 case CMD_MIFARE_NESTED:
1168 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1169 break;
1170 case CMD_MIFARE_CHKKEYS:
1171 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1172 break;
1173 case CMD_SIMULATE_MIFARE_CARD:
1174 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1175 break;
1176
1177 // emulator
1178 case CMD_MIFARE_SET_DBGMODE:
1179 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1180 break;
1181 case CMD_MIFARE_EML_MEMCLR:
1182 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1183 break;
1184 case CMD_MIFARE_EML_MEMSET:
1185 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1186 break;
1187 case CMD_MIFARE_EML_MEMGET:
1188 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1189 break;
1190 case CMD_MIFARE_EML_CARDLOAD:
1191 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1192 break;
1193
1194 // Work with "magic Chinese" card
1195 case CMD_MIFARE_CWIPE:
1196 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1197 break;
1198 case CMD_MIFARE_CSETBLOCK:
1199 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1200 break;
1201 case CMD_MIFARE_CGETBLOCK:
1202 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1203 break;
1204 case CMD_MIFARE_CIDENT:
1205 MifareCIdent();
1206 break;
1207
1208 // mifare sniffer
1209 case CMD_MIFARE_SNIFFER:
1210 SniffMifare(c->arg[0]);
1211 break;
1212
1213 #endif
1214
1215 #ifdef WITH_ICLASS
1216 // Makes use of ISO14443a FPGA Firmware
1217 case CMD_SNOOP_ICLASS:
1218 SnoopIClass();
1219 break;
1220 case CMD_SIMULATE_TAG_ICLASS:
1221 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1222 break;
1223 case CMD_READER_ICLASS:
1224 ReaderIClass(c->arg[0]);
1225 break;
1226 case CMD_READER_ICLASS_REPLAY:
1227 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1228 break;
1229 case CMD_ICLASS_EML_MEMSET:
1230 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1231 break;
1232 case CMD_ICLASS_WRITEBLOCK:
1233 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1234 break;
1235 case CMD_ICLASS_READCHECK: // auth step 1
1236 iClass_ReadCheck(c->arg[0], c->arg[1]);
1237 break;
1238 case CMD_ICLASS_READBLOCK:
1239 iClass_ReadBlk(c->arg[0]);
1240 break;
1241 case CMD_ICLASS_AUTHENTICATION: //check
1242 iClass_Authentication(c->d.asBytes);
1243 break;
1244 case CMD_ICLASS_DUMP:
1245 iClass_Dump(c->arg[0], c->arg[1]);
1246 break;
1247 case CMD_ICLASS_CLONE:
1248 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1249 break;
1250 #endif
1251 #ifdef WITH_HFSNOOP
1252 case CMD_HF_SNIFFER:
1253 HfSnoop(c->arg[0], c->arg[1]);
1254 break;
1255 #endif
1256
1257 case CMD_BUFF_CLEAR:
1258 BigBuf_Clear();
1259 break;
1260
1261 case CMD_MEASURE_ANTENNA_TUNING:
1262 MeasureAntennaTuning(c->arg[0]);
1263 break;
1264
1265 case CMD_MEASURE_ANTENNA_TUNING_HF:
1266 MeasureAntennaTuningHf();
1267 break;
1268
1269 case CMD_LISTEN_READER_FIELD:
1270 ListenReaderField(c->arg[0]);
1271 break;
1272
1273 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1274 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1275 SpinDelay(200);
1276 LED_D_OFF(); // LED D indicates field ON or OFF
1277 break;
1278
1279 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1280
1281 LED_B_ON();
1282 uint8_t *BigBuf = BigBuf_get_addr();
1283 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1284 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1285 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1286 }
1287 // Trigger a finish downloading signal with an ACK frame
1288 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1289 LED_B_OFF();
1290 break;
1291
1292 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1293 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1294 // to be able to use this one for uploading data to device
1295 // arg1 = 0 upload for LF usage
1296 // 1 upload for HF usage
1297 if (c->arg[1] == 0)
1298 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1299 else
1300 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1301
1302 uint8_t *b = BigBuf_get_addr();
1303 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1304 cmd_send(CMD_ACK,0,0,0,0,0);
1305 break;
1306 }
1307 case CMD_READ_MEM:
1308 ReadMem(c->arg[0]);
1309 break;
1310
1311 case CMD_SET_LF_DIVISOR:
1312 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1313 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1314 break;
1315
1316 case CMD_SET_ADC_MUX:
1317 switch(c->arg[0]) {
1318 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1319 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1320 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1321 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1322 }
1323 break;
1324
1325 case CMD_VERSION:
1326 SendVersion();
1327 break;
1328 case CMD_STATUS:
1329 SendStatus();
1330 break;
1331 case CMD_PING:
1332 cmd_send(CMD_ACK,0,0,0,0,0);
1333 break;
1334 #ifdef WITH_LCD
1335 case CMD_LCD_RESET:
1336 LCDReset();
1337 break;
1338 case CMD_LCD:
1339 LCDSend(c->arg[0]);
1340 break;
1341 #endif
1342 case CMD_SETUP_WRITE:
1343 case CMD_FINISH_WRITE:
1344 case CMD_HARDWARE_RESET:
1345 usb_disable();
1346 SpinDelay(1000);
1347 SpinDelay(1000);
1348 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1349 for(;;) {
1350 // We're going to reset, and the bootrom will take control.
1351 }
1352 break;
1353
1354 case CMD_START_FLASH:
1355 if(common_area.flags.bootrom_present) {
1356 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1357 }
1358 usb_disable();
1359 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1360 for(;;);
1361 break;
1362
1363 case CMD_DEVICE_INFO: {
1364 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1365 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1366 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1367 break;
1368 }
1369 default:
1370 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1371 break;
1372 }
1373 }
1374
1375 void __attribute__((noreturn)) AppMain(void)
1376 {
1377 SpinDelay(100);
1378 clear_trace();
1379 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1380 /* Initialize common area */
1381 memset(&common_area, 0, sizeof(common_area));
1382 common_area.magic = COMMON_AREA_MAGIC;
1383 common_area.version = 1;
1384 }
1385 common_area.flags.osimage_present = 1;
1386
1387 LED_D_OFF();
1388 LED_C_OFF();
1389 LED_B_OFF();
1390 LED_A_OFF();
1391
1392 // Init USB device
1393 usb_enable();
1394
1395 // The FPGA gets its clock from us from PCK0 output, so set that up.
1396 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1397 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1398 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1399 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1400 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1401 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1402 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1403
1404 // Reset SPI
1405 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1406 // Reset SSC
1407 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1408
1409 // Load the FPGA image, which we have stored in our flash.
1410 // (the HF version by default)
1411 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1412
1413 StartTickCount();
1414
1415 #ifdef WITH_LCD
1416 LCDInit();
1417 #endif
1418
1419 byte_t rx[sizeof(UsbCommand)];
1420 size_t rx_len;
1421
1422 for(;;) {
1423 if (usb_poll()) {
1424 rx_len = usb_read(rx,sizeof(UsbCommand));
1425 if (rx_len) {
1426 UsbPacketReceived(rx,rx_len);
1427 }
1428 }
1429 WDT_HIT();
1430
1431 #ifdef WITH_LF
1432 #ifndef WITH_ISO14443a_StandAlone
1433 if (BUTTON_HELD(1000) > 0)
1434 SamyRun();
1435 #endif
1436 #endif
1437 #ifdef WITH_ISO14443a
1438 #ifdef WITH_ISO14443a_StandAlone
1439 if (BUTTON_HELD(1000) > 0)
1440 StandAloneMode14a();
1441 #endif
1442 #endif
1443 }
1444 }
Proxmark3 GIT tracking
Impressum, Datenschutz