]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Add Mifare Classic EV1 set load modulation command
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12 #include <stdarg.h>
13 #include "usb_cdc.h"
14 #include "proxmark3.h"
15 #include "apps.h"
16 #include "util.h"
17 #include "printf.h"
18 #include "string.h"
19 #include "legicrf.h"
20 #include "lfsampling.h"
21 #include "BigBuf.h"
22 #include "mifareutil.h"
23
24 #ifdef WITH_LCD
25 #include "LCD.h"
26 #endif
27
28 // Craig Young - 14a stand-alone code
29 #ifdef WITH_ISO14443a_StandAlone
30 #include "iso14443a.h"
31 #include "protocols.h"
32 #endif
33
34 //=============================================================================
35 // A buffer where we can queue things up to be sent through the FPGA, for
36 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
37 // is the order in which they go out on the wire.
38 //=============================================================================
39
40 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41 uint8_t ToSend[TOSEND_BUFFER_SIZE];
42 int ToSendMax = 0;
43 static int ToSendBit;
44 struct common_area common_area __attribute__((section(".commonarea")));
45
46 void ToSendReset(void)
47 {
48 ToSendMax = -1;
49 ToSendBit = 8;
50 }
51
52 void ToSendStuffBit(int b) {
53 if(ToSendBit >= 8) {
54 ++ToSendMax;
55 ToSend[ToSendMax] = 0;
56 ToSendBit = 0;
57 }
58
59 if(b)
60 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
61
62 ++ToSendBit;
63
64 if(ToSendMax >= sizeof(ToSend)) {
65 ToSendBit = 0;
66 DbpString("ToSendStuffBit overflowed!");
67 }
68 }
69
70 void PrintToSendBuffer(void){
71 DbpString("Printing ToSendBuffer:");
72 Dbhexdump(ToSendMax, ToSend, 0);
73 }
74
75 void print_result(char *name, uint8_t *buf, size_t len) {
76 uint8_t *p = buf;
77
78 if ( len % 16 == 0 ) {
79 for(; p-buf < len; p += 16)
80 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
81 name,
82 p-buf,
83 len,
84 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7],p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]
85 );
86 }
87 else {
88 for(; p-buf < len; p += 8)
89 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x",
90 name,
91 p-buf,
92 len,
93 p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
94 }
95 }
96
97 //=============================================================================
98 // Debug print functions, to go out over USB, to the usual PC-side client.
99 //=============================================================================
100
101 void DbpStringEx(char *str, uint32_t cmd){
102 byte_t len = strlen(str);
103 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
104 }
105
106 void DbpString(char *str) {
107 DbpStringEx(str, 0);
108 }
109
110 #if 0
111 void DbpIntegers(int x1, int x2, int x3) {
112 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
113 }
114 #endif
115 void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
116 // should probably limit size here; oh well, let's just use a big buffer
117 char output_string[128] = {0x00};
118 va_list ap;
119
120 va_start(ap, fmt);
121 kvsprintf(fmt, output_string, 10, ap);
122 va_end(ap);
123
124 DbpStringEx(output_string, cmd);
125 }
126
127 void Dbprintf(const char *fmt, ...) {
128 // should probably limit size here; oh well, let's just use a big buffer
129 char output_string[128] = {0x00};
130 va_list ap;
131
132 va_start(ap, fmt);
133 kvsprintf(fmt, output_string, 10, ap);
134 va_end(ap);
135
136 DbpString(output_string);
137 }
138
139 // prints HEX & ASCII
140 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
141 int l=0, i;
142 char ascii[9];
143
144 while (len>0) {
145
146 l = (len>8) ? 8 : len;
147
148 memcpy(ascii,d,l);
149 ascii[l]=0;
150
151 // filter safe ascii
152 for (i=0; i<l; ++i)
153 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
154
155 if (bAsci)
156 Dbprintf("%-8s %*D",ascii,l,d," ");
157 else
158 Dbprintf("%*D",l,d," ");
159
160 len -= 8;
161 d += 8;
162 }
163 }
164
165 //-----------------------------------------------------------------------------
166 // Read an ADC channel and block till it completes, then return the result
167 // in ADC units (0 to 1023). Also a routine to average 32 samples and
168 // return that.
169 //-----------------------------------------------------------------------------
170 static int ReadAdc(int ch)
171 {
172 uint32_t d;
173
174 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
175 AT91C_BASE_ADC->ADC_MR =
176 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
177 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
178 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
179
180 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
181 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
182 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
183 //
184 // The maths are:
185 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
186 //
187 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
188 //
189 // Note: with the "historic" values in the comments above, the error was 34% !!!
190
191 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
192
193 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
194
195 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
196
197 d = AT91C_BASE_ADC->ADC_CDR[ch];
198 return d;
199 }
200
201 int AvgAdc(int ch) // was static - merlok
202 {
203 int i, a = 0;
204 for(i = 0; i < 32; ++i)
205 a += ReadAdc(ch);
206
207 return (a + 15) >> 5;
208 }
209
210
211 void MeasureAntennaTuning(void) {
212
213 uint8_t LF_Results[256];
214 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0;
215 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
216
217 memset(LF_Results, 0, sizeof(LF_Results));
218 LED_B_ON();
219
220 /*
221 * Sweeps the useful LF range of the proxmark from
222 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
223 * read the voltage in the antenna, the result left
224 * in the buffer is a graph which should clearly show
225 * the resonating frequency of your LF antenna
226 * ( hopefully around 95 if it is tuned to 125kHz!)
227 */
228
229 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
230 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
231
232 for (i = 255; i >= 19; i--) {
233 WDT_HIT();
234 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
235 SpinDelay(20);
236 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
237 if (i==95) vLf125 = adcval; // voltage at 125Khz
238 if (i==89) vLf134 = adcval; // voltage at 134Khz
239
240 LF_Results[i] = adcval >> 8; // scale int to fit in byte for graphing purposes
241 if(LF_Results[i] > peak) {
242 peakv = adcval;
243 peak = LF_Results[i];
244 peakf = i;
245 }
246 }
247
248 LED_A_ON();
249 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
250 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
251 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
252 SpinDelay(20);
253 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
254
255 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134 << 16), vHf, peakf | (peakv << 16), LF_Results, 256);
256 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
257 LEDsoff();
258 }
259
260 void MeasureAntennaTuningHf(void) {
261 int vHf = 0; // in mV
262 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
263 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
264 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
265
266 while ( !BUTTON_PRESS() ){
267 SpinDelay(20);
268 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
269 //Dbprintf("%d mV",vHf);
270 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
271 }
272 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
273 DbpString("cancelled");
274 }
275
276
277 void ReadMem(int addr) {
278 const uint8_t *data = ((uint8_t *)addr);
279
280 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
281 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
282 }
283
284 /* osimage version information is linked in */
285 extern struct version_information version_information;
286 /* bootrom version information is pointed to from _bootphase1_version_pointer */
287 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
288 void SendVersion(void)
289 {
290 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
291 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
292
293 /* Try to find the bootrom version information. Expect to find a pointer at
294 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
295 * pointer, then use it.
296 */
297 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
298
299 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
300 strcat(VersionString, "bootrom version information appears invalid\n");
301 } else {
302 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
303 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
304 }
305
306 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
307 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
308
309 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
311
312 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
313 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
314
315 // Send Chip ID and used flash memory
316 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
317 uint32_t compressed_data_section_size = common_area.arg1;
318 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
319 }
320
321 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
322 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
323 void printUSBSpeed(void)
324 {
325 Dbprintf("USB Speed:");
326 Dbprintf(" Sending USB packets to client...");
327
328 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
329 uint8_t *test_data = BigBuf_get_addr();
330 uint32_t end_time;
331
332 uint32_t start_time = end_time = GetTickCount();
333 uint32_t bytes_transferred = 0;
334
335 LED_B_ON();
336 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
337 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
338 end_time = GetTickCount();
339 bytes_transferred += USB_CMD_DATA_SIZE;
340 }
341 LED_B_OFF();
342
343 Dbprintf(" Time elapsed: %dms", end_time - start_time);
344 Dbprintf(" Bytes transferred: %d", bytes_transferred);
345 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
346 1000 * bytes_transferred / (end_time - start_time));
347
348 }
349
350 /**
351 * Prints runtime information about the PM3.
352 **/
353 void SendStatus(void) {
354 BigBuf_print_status();
355 Fpga_print_status();
356 printConfig(); //LF Sampling config
357 printUSBSpeed();
358 Dbprintf("Various");
359 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
360 Dbprintf(" ToSendMax..........%d", ToSendMax);
361 Dbprintf(" ToSendBit..........%d", ToSendBit);
362 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
363
364 cmd_send(CMD_ACK,1,0,0,0,0);
365 }
366
367 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
368
369 #define OPTS 2
370 void StandAloneMode()
371 {
372 DbpString("Stand-alone mode! No PC necessary.");
373 // Oooh pretty -- notify user we're in elite samy mode now
374 LED(LED_RED, 200);
375 LED(LED_ORANGE, 200);
376 LED(LED_GREEN, 200);
377 LED(LED_ORANGE, 200);
378 LED(LED_RED, 200);
379 LED(LED_ORANGE, 200);
380 LED(LED_GREEN, 200);
381 LED(LED_ORANGE, 200);
382 LED(LED_RED, 200);
383 }
384 #endif
385
386 #ifdef WITH_ISO14443a_StandAlone
387
388 typedef struct {
389 uint8_t uid[10];
390 uint8_t uidlen;
391 uint8_t atqa[2];
392 uint8_t sak;
393 } __attribute__((__packed__)) card_clone_t;
394
395 void StandAloneMode14a()
396 {
397 StandAloneMode();
398 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
399
400 int selected = 0, playing = 0, iGotoRecord = 0, iGotoClone = 0;
401 int cardRead[OPTS] = {0};
402
403 card_clone_t uids[OPTS];
404 iso14a_card_select_t card_info[OPTS];
405 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
406
407 LED(selected + 1, 0);
408
409 for (;;)
410 {
411 usb_poll();
412 WDT_HIT();
413 SpinDelay(300);
414
415 if (iGotoRecord == 1 || cardRead[selected] == 0)
416 {
417 iGotoRecord = 0;
418 LEDsoff();
419 LED(selected + 1, 0);
420 LED(LED_RED2, 0);
421
422 // record
423 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
424 /* need this delay to prevent catching some weird data */
425 SpinDelay(500);
426 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
427
428 for ( ; ; )
429 {
430 WDT_HIT();
431 if (BUTTON_PRESS()) {
432 if (cardRead[selected]) {
433 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
434 break;
435 }
436 else if (cardRead[(selected+1) % OPTS]) {
437 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
438 selected = (selected+1) % OPTS;
439 break; // playing = 1;
440 }
441 else {
442 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
443 SpinDelay(300);
444 }
445 }
446 if (!iso14443a_select_card(NULL, &card_info[selected], NULL, true, 0))
447 continue;
448 else
449 {
450 Dbprintf("Read UID:");
451 Dbhexdump(card_info[selected].uidlen, card_info[selected].uid, 0);
452
453 if (memcmp(uids[(selected+1)%OPTS].uid, card_info[selected].uid, card_info[selected].uidlen ) == 0 ) {
454 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
455 }
456 else {
457
458 uids[selected].sak = card_info[selected].sak;
459 uids[selected].uidlen = card_info[selected].uidlen;
460 memcpy(uids[selected].uid , card_info[selected].uid, uids[selected].uidlen);
461 memcpy(uids[selected].atqa, card_info[selected].atqa, 2);
462
463 if (uids[selected].uidlen > 4)
464 Dbprintf("Bank[%d] received a 7-byte UID", selected);
465 else
466 Dbprintf("Bank[%d] received a 4-byte UID", selected);
467 break;
468 }
469 }
470 }
471 Dbprintf("ATQA = %02X%02X", uids[selected].atqa[0], uids[selected].atqa[1]);
472 Dbprintf("SAK = %02X", uids[selected].sak);
473 LEDsoff();
474 LED(LED_GREEN, 200);
475 LED(LED_ORANGE, 200);
476 LED(LED_GREEN, 200);
477 LED(LED_ORANGE, 200);
478
479 LEDsoff();
480 LED(selected + 1, 0);
481
482 // Next state is replay:
483 playing = 1;
484
485 cardRead[selected] = 1;
486 }
487 /* MF Classic UID clone */
488 else if (iGotoClone==1)
489 {
490 iGotoClone=0;
491 LEDsoff();
492 LED(selected + 1, 0);
493 LED(LED_ORANGE, 250);
494
495 // magiccards holds 4bytes uid.
496 uint64_t tmpuid = bytes_to_num(uids[selected].uid, 4);
497
498 // record
499 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, tmpuid & 0xFFFFFFFF);
500
501 // wait for button to be released
502 // Delay cloning until card is in place
503 while(BUTTON_PRESS())
504 WDT_HIT();
505
506 Dbprintf("Starting clone. [Bank: %u]", selected);
507 // need this delay to prevent catching some weird data
508 SpinDelay(500);
509 // Begin clone function here:
510 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
511 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
512 memcpy(c.d.asBytes, data, 16);
513 SendCommand(&c);
514
515 Block read is similar:
516 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
517 We need to imitate that call with blockNo 0 to set a uid.
518
519 The get and set commands are handled in this file:
520 // Work with "magic Chinese" card
521 case CMD_MIFARE_CSETBLOCK:
522 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
523 break;
524 case CMD_MIFARE_CGETBLOCK:
525 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
526 break;
527
528 mfCSetUID provides example logic for UID set workflow:
529 -Read block0 from card in field with MifareCGetBlock()
530 -Configure new values without replacing reserved bytes
531 memcpy(block0, uid, 4); // Copy UID bytes from byte array
532 // Mifare UID BCC
533 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
534 Bytes 5-7 are reserved SAK and ATQA for mifare classic
535 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
536 */
537 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
538 // arg0 = Flags, arg1=blockNo
539 MifareCGetBlock(params, 0, oldBlock0);
540 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
541 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
542 playing = 1;
543 }
544 else {
545 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0], oldBlock0[1], oldBlock0[2], oldBlock0[3]);
546 memcpy(newBlock0, oldBlock0, 16);
547
548 // Copy uid for bank (2nd is for longer UIDs not supported if classic)
549 memcpy(newBlock0, uids[selected].uid, 4);
550 newBlock0[4] = newBlock0[0] ^ newBlock0[1] ^ newBlock0[2] ^ newBlock0[3];
551
552 // arg0 = workFlags, arg1 = blockNo, datain
553 MifareCSetBlock(params, 0, newBlock0);
554 MifareCGetBlock(params, 0, testBlock0);
555
556 if (memcmp(testBlock0, newBlock0, 16)==0) {
557 DbpString("Cloned successfull!");
558 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
559 playing = 0;
560 iGotoRecord = 1;
561 selected = (selected + 1) % OPTS;
562 } else {
563 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
564 playing = 1;
565 }
566 }
567 LEDsoff();
568 LED(selected + 1, 0);
569 }
570 // Change where to record (or begin playing)
571 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
572 {
573 LEDsoff();
574 LED(selected + 1, 0);
575
576 // Begin transmitting
577 if (playing)
578 {
579 LED(LED_GREEN, 0);
580 DbpString("Playing");
581 for ( ; ; ) {
582 WDT_HIT();
583 int button_action = BUTTON_HELD(1000);
584 if (button_action == 0) { // No button action, proceed with sim
585
586 uint8_t flags = FLAG_4B_UID_IN_DATA;
587 uint8_t data[USB_CMD_DATA_SIZE] = {0}; // in case there is a read command received we shouldn't break
588
589 memcpy(data, uids[selected].uid, uids[selected].uidlen);
590
591 uint64_t tmpuid = bytes_to_num(uids[selected].uid, uids[selected].uidlen);
592
593 if ( uids[selected].uidlen == 7 ) {
594 flags = FLAG_7B_UID_IN_DATA;
595 Dbprintf("Simulating ISO14443a tag with uid: %02x%08x [Bank: %u]", tmpuid >> 32, tmpuid & 0xFFFFFFFF , selected);
596 } else {
597 Dbprintf("Simulating ISO14443a tag with uid: %08x [Bank: %u]", tmpuid & 0xFFFFFFFF , selected);
598 }
599
600 if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0) {
601 DbpString("Mifare Classic 1k");
602 SimulateIso14443aTag(1, flags, data);
603 } else if (uids[selected].sak == 0x18 && uids[selected].atqa[0] == 0x02 && uids[selected].atqa[1] == 0) {
604 DbpString("Mifare Classic 4k (4b uid)");
605 SimulateIso14443aTag(8, flags, data);
606 } else if (uids[selected].sak == 0x08 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
607 DbpString("Mifare Classic 4k (7b uid)");
608 SimulateIso14443aTag(8, flags, data);
609 } else if (uids[selected].sak == 0x00 && uids[selected].atqa[0] == 0x44 && uids[selected].atqa[1] == 0) {
610 DbpString("Mifare Ultralight");
611 SimulateIso14443aTag(2, flags, data);
612 } else if (uids[selected].sak == 0x20 && uids[selected].atqa[0] == 0x04 && uids[selected].atqa[1] == 0x03) {
613 DbpString("Mifare DESFire");
614 SimulateIso14443aTag(3, flags, data);
615 }
616 else {
617 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
618 SimulateIso14443aTag(1, flags, data);
619 }
620 }
621 else if (button_action == BUTTON_SINGLE_CLICK) {
622 selected = (selected + 1) % OPTS;
623 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
624 iGotoRecord = 1;
625 break;
626 }
627 else if (button_action == BUTTON_HOLD) {
628 Dbprintf("Playtime over. Begin cloning...");
629 iGotoClone = 1;
630 break;
631 }
632 WDT_HIT();
633 }
634
635 /* We pressed a button so ignore it here with a delay */
636 SpinDelay(300);
637 LEDsoff();
638 LED(selected + 1, 0);
639 }
640 else
641 while(BUTTON_PRESS())
642 WDT_HIT();
643 }
644 }
645 }
646 #elif WITH_LF
647 // samy's sniff and repeat routine
648 void SamyRun()
649 {
650 StandAloneMode();
651 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
652
653 int high[OPTS], low[OPTS];
654 int selected = 0;
655 int playing = 0;
656 int cardRead = 0;
657
658 // Turn on selected LED
659 LED(selected + 1, 0);
660
661 for (;;) {
662 usb_poll();
663 WDT_HIT();
664
665 // Was our button held down or pressed?
666 int button_pressed = BUTTON_HELD(1000);
667 SpinDelay(300);
668
669 // Button was held for a second, begin recording
670 if (button_pressed > 0 && cardRead == 0)
671 {
672 LEDsoff();
673 LED(selected + 1, 0);
674 LED(LED_RED2, 0);
675
676 // record
677 DbpString("Starting recording");
678
679 // wait for button to be released
680 while(BUTTON_PRESS())
681 WDT_HIT();
682
683 /* need this delay to prevent catching some weird data */
684 SpinDelay(500);
685
686 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
687 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
688
689 LEDsoff();
690 LED(selected + 1, 0);
691 // Finished recording
692 // If we were previously playing, set playing off
693 // so next button push begins playing what we recorded
694 playing = 0;
695 cardRead = 1;
696 }
697 else if (button_pressed > 0 && cardRead == 1) {
698 LEDsoff();
699 LED(selected + 1, 0);
700 LED(LED_ORANGE, 0);
701
702 // record
703 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
704
705 // wait for button to be released
706 while(BUTTON_PRESS())
707 WDT_HIT();
708
709 /* need this delay to prevent catching some weird data */
710 SpinDelay(500);
711
712 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
713 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
714
715 LEDsoff();
716 LED(selected + 1, 0);
717 // Finished recording
718
719 // If we were previously playing, set playing off
720 // so next button push begins playing what we recorded
721 playing = 0;
722 cardRead = 0;
723 }
724
725 // Change where to record (or begin playing)
726 else if (button_pressed) {
727 // Next option if we were previously playing
728 if (playing)
729 selected = (selected + 1) % OPTS;
730 playing = !playing;
731
732 LEDsoff();
733 LED(selected + 1, 0);
734
735 // Begin transmitting
736 if (playing)
737 {
738 LED(LED_GREEN, 0);
739 DbpString("Playing");
740 // wait for button to be released
741 while(BUTTON_PRESS())
742 WDT_HIT();
743
744 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
745 CmdHIDsimTAG(high[selected], low[selected], 0);
746 DbpString("Done playing");
747
748 if (BUTTON_HELD(1000) > 0) {
749 DbpString("Exiting");
750 LEDsoff();
751 return;
752 }
753
754 /* We pressed a button so ignore it here with a delay */
755 SpinDelay(300);
756
757 // when done, we're done playing, move to next option
758 selected = (selected + 1) % OPTS;
759 playing = !playing;
760 LEDsoff();
761 LED(selected + 1, 0);
762 }
763 else
764 while(BUTTON_PRESS())
765 WDT_HIT();
766 }
767 }
768 }
769
770 #endif
771 /*
772 OBJECTIVE
773 Listen and detect an external reader. Determine the best location
774 for the antenna.
775
776 INSTRUCTIONS:
777 Inside the ListenReaderField() function, there is two mode.
778 By default, when you call the function, you will enter mode 1.
779 If you press the PM3 button one time, you will enter mode 2.
780 If you press the PM3 button a second time, you will exit the function.
781
782 DESCRIPTION OF MODE 1:
783 This mode just listens for an external reader field and lights up green
784 for HF and/or red for LF. This is the original mode of the detectreader
785 function.
786
787 DESCRIPTION OF MODE 2:
788 This mode will visually represent, using the LEDs, the actual strength of the
789 current compared to the maximum current detected. Basically, once you know
790 what kind of external reader is present, it will help you spot the best location to place
791 your antenna. You will probably not get some good results if there is a LF and a HF reader
792 at the same place! :-)
793
794 LIGHT SCHEME USED:
795 */
796 static const char LIGHT_SCHEME[] = {
797 0x0, /* ---- | No field detected */
798 0x1, /* X--- | 14% of maximum current detected */
799 0x2, /* -X-- | 29% of maximum current detected */
800 0x4, /* --X- | 43% of maximum current detected */
801 0x8, /* ---X | 57% of maximum current detected */
802 0xC, /* --XX | 71% of maximum current detected */
803 0xE, /* -XXX | 86% of maximum current detected */
804 0xF, /* XXXX | 100% of maximum current detected */
805 };
806 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
807
808 void ListenReaderField(int limit) {
809 #define LF_ONLY 1
810 #define HF_ONLY 2
811 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
812
813 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
814 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
815 int mode=1, display_val, display_max, i;
816
817 // switch off FPGA - we don't want to measure our own signal
818 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
819 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
820
821 LEDsoff();
822
823 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
824
825 if(limit != HF_ONLY) {
826 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
827 lf_baseline = lf_av;
828 }
829
830 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
831
832 if (limit != LF_ONLY) {
833 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
834 hf_baseline = hf_av;
835 }
836
837 for(;;) {
838 if (BUTTON_PRESS()) {
839 SpinDelay(500);
840 switch (mode) {
841 case 1:
842 mode=2;
843 DbpString("Signal Strength Mode");
844 break;
845 case 2:
846 default:
847 DbpString("Stopped");
848 LEDsoff();
849 return;
850 break;
851 }
852 }
853 WDT_HIT();
854
855 if (limit != HF_ONLY) {
856 if(mode == 1) {
857 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
858 LED_D_ON();
859 else
860 LED_D_OFF();
861 }
862
863 lf_av_new = AvgAdc(ADC_CHAN_LF);
864 // see if there's a significant change
865 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
866 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
867 lf_av = lf_av_new;
868 if (lf_av > lf_max)
869 lf_max = lf_av;
870 }
871 }
872
873 if (limit != LF_ONLY) {
874 if (mode == 1){
875 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
876 LED_B_ON();
877 else
878 LED_B_OFF();
879 }
880
881 hf_av_new = AvgAdc(ADC_CHAN_HF);
882 // see if there's a significant change
883 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
884 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
885 hf_av = hf_av_new;
886 if (hf_av > hf_max)
887 hf_max = hf_av;
888 }
889 }
890
891 if(mode == 2) {
892 if (limit == LF_ONLY) {
893 display_val = lf_av;
894 display_max = lf_max;
895 } else if (limit == HF_ONLY) {
896 display_val = hf_av;
897 display_max = hf_max;
898 } else { /* Pick one at random */
899 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
900 display_val = hf_av;
901 display_max = hf_max;
902 } else {
903 display_val = lf_av;
904 display_max = lf_max;
905 }
906 }
907 for (i=0; i<LIGHT_LEN; i++) {
908 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
909 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
910 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
911 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
912 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
913 break;
914 }
915 }
916 }
917 }
918 }
919
920 void UsbPacketReceived(uint8_t *packet, int len)
921 {
922 UsbCommand *c = (UsbCommand *)packet;
923
924 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
925
926 switch(c->cmd) {
927 #ifdef WITH_LF
928 case CMD_SET_LF_SAMPLING_CONFIG:
929 setSamplingConfig((sample_config *) c->d.asBytes);
930 break;
931 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
932 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
933 break;
934 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
935 ModThenAcquireRawAdcSamples125k(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
936 break;
937 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
938 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
939 break;
940 case CMD_HID_DEMOD_FSK:
941 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
942 break;
943 case CMD_HID_SIM_TAG:
944 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
945 break;
946 case CMD_FSK_SIM_TAG:
947 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
948 break;
949 case CMD_ASK_SIM_TAG:
950 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
951 break;
952 case CMD_PSK_SIM_TAG:
953 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
954 break;
955 case CMD_HID_CLONE_TAG:
956 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
957 break;
958 case CMD_IO_DEMOD_FSK:
959 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
960 break;
961 case CMD_IO_CLONE_TAG:
962 CopyIOtoT55x7(c->arg[0], c->arg[1]);
963 break;
964 case CMD_EM410X_DEMOD:
965 CmdEM410xdemod(c->arg[0], 0, 0, 1);
966 break;
967 case CMD_EM410X_WRITE_TAG:
968 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
969 break;
970 case CMD_READ_TI_TYPE:
971 ReadTItag();
972 break;
973 case CMD_WRITE_TI_TYPE:
974 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
975 break;
976 case CMD_SIMULATE_TAG_125K:
977 LED_A_ON();
978 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
979 LED_A_OFF();
980 break;
981 case CMD_LF_SIMULATE_BIDIR:
982 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
983 break;
984 case CMD_INDALA_CLONE_TAG:
985 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
986 break;
987 case CMD_INDALA_CLONE_TAG_L:
988 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
989 break;
990 case CMD_T55XX_READ_BLOCK:
991 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
992 break;
993 case CMD_T55XX_WRITE_BLOCK:
994 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
995 break;
996 case CMD_T55XX_WAKEUP:
997 T55xxWakeUp(c->arg[0]);
998 break;
999 case CMD_T55XX_RESET_READ:
1000 T55xxResetRead();
1001 break;
1002 case CMD_PCF7931_READ:
1003 ReadPCF7931();
1004 break;
1005 case CMD_PCF7931_WRITE:
1006 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1007 break;
1008 case CMD_EM4X_READ_WORD:
1009 EM4xReadWord(c->arg[0], c->arg[1], c->arg[2]);
1010 break;
1011 case CMD_EM4X_WRITE_WORD:
1012 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1013 break;
1014 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1015 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1016 break;
1017 case CMD_VIKING_CLONE_TAG:
1018 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1019 break;
1020 case CMD_COTAG:
1021 Cotag(c->arg[0]);
1022 break;
1023 #endif
1024
1025 #ifdef WITH_HITAG
1026 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1027 SnoopHitag(c->arg[0]);
1028 break;
1029 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1030 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1031 break;
1032 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1033 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1034 break;
1035 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1036 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1037 break;
1038 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1039 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1040 break;
1041 case CMD_READ_HITAG_S: //Reader for only Hitag S tags, args = key or challenge
1042 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1043 break;
1044 case CMD_WR_HITAG_S: //writer for Hitag tags args=data to write,page and key or challenge
1045 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1046 break;
1047 #endif
1048
1049 #ifdef WITH_ISO15693
1050 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1051 AcquireRawAdcSamplesIso15693();
1052 break;
1053 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1054 RecordRawAdcSamplesIso15693();
1055 break;
1056 case CMD_ISO_15693_COMMAND:
1057 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1058 break;
1059 case CMD_ISO_15693_FIND_AFI:
1060 BruteforceIso15693Afi(c->arg[0]);
1061 break;
1062 case CMD_ISO_15693_DEBUG:
1063 SetDebugIso15693(c->arg[0]);
1064 break;
1065 case CMD_READER_ISO_15693:
1066 ReaderIso15693(c->arg[0]);
1067 break;
1068 case CMD_SIMTAG_ISO_15693:
1069 SimTagIso15693(c->arg[0], c->d.asBytes);
1070 break;
1071 #endif
1072
1073 #ifdef WITH_LEGICRF
1074 case CMD_SIMULATE_TAG_LEGIC_RF:
1075 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1076 break;
1077 case CMD_WRITER_LEGIC_RF:
1078 LegicRfWriter( c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1079 break;
1080 case CMD_READER_LEGIC_RF:
1081 LegicRfReader(c->arg[0], c->arg[1], c->arg[2]);
1082 break;
1083 case CMD_LEGIC_INFO:
1084 LegicRfInfo();
1085 break;
1086 case CMD_LEGIC_ESET:
1087 LegicEMemSet(c->arg[0], c->arg[1], c->d.asBytes);
1088 break;
1089 #endif
1090
1091 #ifdef WITH_ISO14443b
1092 case CMD_READ_SRI_TAG:
1093 ReadSTMemoryIso14443b(c->arg[0]);
1094 break;
1095 case CMD_SNOOP_ISO_14443B:
1096 SnoopIso14443b();
1097 break;
1098 case CMD_SIMULATE_TAG_ISO_14443B:
1099 SimulateIso14443bTag(c->arg[0]);
1100 break;
1101 case CMD_ISO_14443B_COMMAND:
1102 //SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1103 SendRawCommand14443B_Ex(c);
1104 break;
1105 #endif
1106
1107 #ifdef WITH_ISO14443a
1108 case CMD_SNOOP_ISO_14443a:
1109 SniffIso14443a(c->arg[0]);
1110 break;
1111 case CMD_READER_ISO_14443a:
1112 ReaderIso14443a(c);
1113 break;
1114 case CMD_SIMULATE_TAG_ISO_14443a:
1115 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1116 break;
1117 case CMD_EPA_PACE_COLLECT_NONCE:
1118 EPA_PACE_Collect_Nonce(c);
1119 break;
1120 case CMD_EPA_PACE_REPLAY:
1121 EPA_PACE_Replay(c);
1122 break;
1123 case CMD_READER_MIFARE:
1124 ReaderMifare(c->arg[0], c->arg[1], c->arg[2]);
1125 break;
1126 case CMD_MIFARE_READBL:
1127 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1128 break;
1129 case CMD_MIFAREU_READBL:
1130 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1131 break;
1132 case CMD_MIFAREUC_AUTH:
1133 MifareUC_Auth(c->arg[0],c->d.asBytes);
1134 break;
1135 case CMD_MIFAREU_READCARD:
1136 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1137 break;
1138 case CMD_MIFAREUC_SETPWD:
1139 MifareUSetPwd(c->arg[0], c->d.asBytes);
1140 break;
1141 case CMD_MIFARE_READSC:
1142 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1143 break;
1144 case CMD_MIFARE_WRITEBL:
1145 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1146 break;
1147 //case CMD_MIFAREU_WRITEBL_COMPAT:
1148 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1149 //break;
1150 case CMD_MIFAREU_WRITEBL:
1151 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1152 break;
1153 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1154 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_NESTED:
1157 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1158 break;
1159 case CMD_MIFARE_CHKKEYS:
1160 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1161 break;
1162 case CMD_SIMULATE_MIFARE_CARD:
1163 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1164 break;
1165
1166 // emulator
1167 case CMD_MIFARE_SET_DBGMODE:
1168 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1169 break;
1170 case CMD_MIFARE_EML_MEMCLR:
1171 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1172 break;
1173 case CMD_MIFARE_EML_MEMSET:
1174 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1175 break;
1176 case CMD_MIFARE_EML_MEMGET:
1177 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1178 break;
1179 case CMD_MIFARE_EML_CARDLOAD:
1180 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1181 break;
1182
1183 // Work with "magic Chinese" card
1184 case CMD_MIFARE_CSETBLOCK:
1185 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1186 break;
1187 case CMD_MIFARE_CGETBLOCK:
1188 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1189 break;
1190 case CMD_MIFARE_CIDENT:
1191 MifareCIdent();
1192 break;
1193
1194 // mifare sniffer
1195 case CMD_MIFARE_SNIFFER:
1196 SniffMifare(c->arg[0]);
1197 break;
1198
1199 case CMD_MIFARE_SETMOD:
1200 MifareSetMod(c->arg[0], c->d.asBytes);
1201 break;
1202
1203 //mifare desfire
1204 case CMD_MIFARE_DESFIRE_READBL: break;
1205 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1206 case CMD_MIFARE_DESFIRE_AUTH1:
1207 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1208 break;
1209 case CMD_MIFARE_DESFIRE_AUTH2:
1210 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1211 break;
1212 case CMD_MIFARE_DES_READER:
1213 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1214 break;
1215 case CMD_MIFARE_DESFIRE_INFO:
1216 MifareDesfireGetInformation();
1217 break;
1218 case CMD_MIFARE_DESFIRE:
1219 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1220 break;
1221 case CMD_MIFARE_COLLECT_NONCES:
1222 break;
1223 #endif
1224 #ifdef WITH_EMV
1225 case CMD_EMV_TRANSACTION:
1226 EMVTransaction();
1227 break;
1228 case CMD_EMV_GET_RANDOM_NUM:
1229 //EMVgetUDOL();
1230 break;
1231 case CMD_EMV_LOAD_VALUE:
1232 EMVloadvalue(c->arg[0], c->d.asBytes);
1233 break;
1234 case CMD_EMV_DUMP_CARD:
1235 EMVdumpcard();
1236 break;
1237 /*
1238 case CMD_EMV_READ_RECORD:
1239 EMVReadRecord(c->arg[0], c->arg[1], NULL);
1240 break;
1241 case CMD_EMV_CLONE:
1242 EMVClone(c->arg[0], c->arg[1]);
1243 break;
1244 case CMD_EMV_SIM:
1245 EMVSim();
1246 break;
1247 case CMD_EMV_TEST:
1248 EMVTest();
1249 break;
1250 case CMD_EMV_FUZZ_RATS:
1251 EMVFuzz_RATS(c->arg[0],c->d.asBytes);
1252 break;
1253 */
1254 #endif
1255 #ifdef WITH_ICLASS
1256 // Makes use of ISO14443a FPGA Firmware
1257 case CMD_SNOOP_ICLASS:
1258 SnoopIClass();
1259 break;
1260 case CMD_SIMULATE_TAG_ICLASS:
1261 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1262 break;
1263 case CMD_READER_ICLASS:
1264 ReaderIClass(c->arg[0]);
1265 break;
1266 case CMD_READER_ICLASS_REPLAY:
1267 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1268 break;
1269 case CMD_ICLASS_EML_MEMSET:
1270 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1271 break;
1272 case CMD_ICLASS_WRITEBLOCK:
1273 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1274 break;
1275 case CMD_ICLASS_READCHECK: // auth step 1
1276 iClass_ReadCheck(c->arg[0], c->arg[1]);
1277 break;
1278 case CMD_ICLASS_READBLOCK:
1279 iClass_ReadBlk(c->arg[0]);
1280 break;
1281 case CMD_ICLASS_AUTHENTICATION: //check
1282 iClass_Authentication(c->d.asBytes);
1283 break;
1284 case CMD_ICLASS_DUMP:
1285 iClass_Dump(c->arg[0], c->arg[1]);
1286 break;
1287 case CMD_ICLASS_CLONE:
1288 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1289 break;
1290 #endif
1291 #ifdef WITH_HFSNOOP
1292 case CMD_HF_SNIFFER:
1293 HfSnoop(c->arg[0], c->arg[1]);
1294 break;
1295 #endif
1296
1297 case CMD_BUFF_CLEAR:
1298 BigBuf_Clear();
1299 break;
1300
1301 case CMD_MEASURE_ANTENNA_TUNING:
1302 MeasureAntennaTuning();
1303 break;
1304
1305 case CMD_MEASURE_ANTENNA_TUNING_HF:
1306 MeasureAntennaTuningHf();
1307 break;
1308
1309 case CMD_LISTEN_READER_FIELD:
1310 ListenReaderField(c->arg[0]);
1311 break;
1312
1313 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1314 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1315 SpinDelay(200);
1316 LED_D_OFF(); // LED D indicates field ON or OFF
1317 break;
1318
1319 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1320 LED_B_ON();
1321 uint8_t *BigBuf = BigBuf_get_addr();
1322 size_t len = 0;
1323 size_t startidx = c->arg[0];
1324 uint8_t isok = FALSE;
1325 // arg0 = startindex
1326 // arg1 = length bytes to transfer
1327 // arg2 = RFU
1328 //Dbprintf("transfer to client parameters: %" PRIu64 " | %" PRIu64 " | %" PRIu64, c->arg[0], c->arg[1], c->arg[2]);
1329
1330 for(size_t i = 0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1331 len = MIN( (c->arg[1] - i), USB_CMD_DATA_SIZE);
1332 isok = cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, i, len, BigBuf_get_traceLen(), BigBuf + startidx + i, len);
1333 if (!isok)
1334 Dbprintf("transfer to client failed :: | bytes %d", len);
1335 }
1336 // Trigger a finish downloading signal with an ACK frame
1337 cmd_send(CMD_ACK, 1, 0, BigBuf_get_traceLen(), getSamplingConfig(), sizeof(sample_config));
1338 LED_B_OFF();
1339 break;
1340 }
1341 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1342 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1343 // to be able to use this one for uploading data to device
1344 // arg1 = 0 upload for LF usage
1345 // 1 upload for HF usage
1346 if ( c->arg[1] == 0 )
1347 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1348 else
1349 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1350 uint8_t *b = BigBuf_get_addr();
1351 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1352 cmd_send(CMD_ACK,1,0,0,0,0);
1353 break;
1354 }
1355 case CMD_DOWNLOAD_EML_BIGBUF: {
1356 LED_B_ON();
1357 uint8_t *cardmem = BigBuf_get_EM_addr();
1358 size_t len = 0;
1359 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1360 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1361 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1362 }
1363 // Trigger a finish downloading signal with an ACK frame
1364 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1365 LED_B_OFF();
1366 break;
1367 }
1368 case CMD_READ_MEM:
1369 ReadMem(c->arg[0]);
1370 break;
1371
1372 case CMD_SET_LF_DIVISOR:
1373 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1374 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1375 break;
1376
1377 case CMD_SET_ADC_MUX:
1378 switch(c->arg[0]) {
1379 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1380 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1381 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1382 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1383 }
1384 break;
1385
1386 case CMD_VERSION:
1387 SendVersion();
1388 break;
1389 case CMD_STATUS:
1390 SendStatus();
1391 break;
1392 case CMD_PING:
1393 cmd_send(CMD_ACK,0,0,0,0,0);
1394 break;
1395 #ifdef WITH_LCD
1396 case CMD_LCD_RESET:
1397 LCDReset();
1398 break;
1399 case CMD_LCD:
1400 LCDSend(c->arg[0]);
1401 break;
1402 #endif
1403 case CMD_SETUP_WRITE:
1404 case CMD_FINISH_WRITE:
1405 case CMD_HARDWARE_RESET:
1406 usb_disable();
1407 SpinDelay(2000);
1408 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1409 for(;;) {
1410 // We're going to reset, and the bootrom will take control.
1411 }
1412 break;
1413
1414 case CMD_START_FLASH:
1415 if(common_area.flags.bootrom_present) {
1416 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1417 }
1418 usb_disable();
1419 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1420 for(;;);
1421 break;
1422
1423 case CMD_DEVICE_INFO: {
1424 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1425 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1426 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1427 break;
1428 }
1429 default:
1430 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1431 break;
1432 }
1433 }
1434
1435 void __attribute__((noreturn)) AppMain(void)
1436 {
1437 SpinDelay(100);
1438 clear_trace();
1439 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1440 /* Initialize common area */
1441 memset(&common_area, 0, sizeof(common_area));
1442 common_area.magic = COMMON_AREA_MAGIC;
1443 common_area.version = 1;
1444 }
1445 common_area.flags.osimage_present = 1;
1446
1447 LEDsoff();
1448
1449 // Init USB device
1450 usb_enable();
1451
1452 // The FPGA gets its clock from us from PCK0 output, so set that up.
1453 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1454 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1455 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1456 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1457 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK | AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1458 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1459
1460 // Reset SPI
1461 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1462 // Reset SSC
1463 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1464
1465 // Load the FPGA image, which we have stored in our flash.
1466 // (the HF version by default)
1467 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1468
1469 StartTickCount();
1470
1471 #ifdef WITH_LCD
1472 LCDInit();
1473 #endif
1474
1475 byte_t rx[sizeof(UsbCommand)];
1476 size_t rx_len;
1477
1478 for(;;) {
1479 if ( usb_poll_validate_length() ) {
1480 rx_len = usb_read(rx, sizeof(UsbCommand));
1481
1482 if (rx_len)
1483 UsbPacketReceived(rx, rx_len);
1484 }
1485 WDT_HIT();
1486
1487 #ifdef WITH_LF
1488 #ifndef WITH_ISO14443a_StandAlone
1489 if (BUTTON_HELD(1000) > 0)
1490 SamyRun();
1491 #endif
1492 #endif
1493 #ifdef WITH_ISO14443a
1494 #ifdef WITH_ISO14443a_StandAlone
1495 if (BUTTON_HELD(1000) > 0)
1496 StandAloneMode14a();
1497 #endif
1498 #endif
1499 }
1500 }
Proxmark3 GIT tracking
Impressum, Datenschutz