1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
11 //-----------------------------------------------------------------------------
16 #include "proxmark3.h"
26 #include "lfsampling.h"
32 #define abs(x) ( ((x)<0) ? -(x) : (x) )
34 //=============================================================================
35 // A buffer where we can queue things up to be sent through the FPGA, for
36 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
37 // is the order in which they go out on the wire.
38 //=============================================================================
40 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41 uint8_t ToSend
[TOSEND_BUFFER_SIZE
];
44 struct common_area common_area
__attribute__((section(".commonarea")));
46 void ToSendReset(void)
52 void ToSendStuffBit(int b
)
56 ToSend
[ToSendMax
] = 0;
61 ToSend
[ToSendMax
] |= (1 << (7 - ToSendBit
));
66 if(ToSendMax
>= sizeof(ToSend
)) {
68 DbpString("ToSendStuffBit overflowed!");
72 //=============================================================================
73 // Debug print functions, to go out over USB, to the usual PC-side client.
74 //=============================================================================
76 void DbpString(char *str
)
78 byte_t len
= strlen(str
);
79 cmd_send(CMD_DEBUG_PRINT_STRING
,len
,0,0,(byte_t
*)str
,len
);
83 void DbpIntegers(int x1
, int x2
, int x3
)
85 cmd_send(CMD_DEBUG_PRINT_INTEGERS
,x1
,x2
,x3
,0,0);
89 void Dbprintf(const char *fmt
, ...) {
90 // should probably limit size here; oh well, let's just use a big buffer
91 char output_string
[128];
95 kvsprintf(fmt
, output_string
, 10, ap
);
98 DbpString(output_string
);
101 // prints HEX & ASCII
102 void Dbhexdump(int len
, uint8_t *d
, bool bAsci
) {
115 if (ascii
[i
]<32 || ascii
[i
]>126) ascii
[i
]='.';
118 Dbprintf("%-8s %*D",ascii
,l
,d
," ");
120 Dbprintf("%*D",l
,d
," ");
128 //-----------------------------------------------------------------------------
129 // Read an ADC channel and block till it completes, then return the result
130 // in ADC units (0 to 1023). Also a routine to average 32 samples and
132 //-----------------------------------------------------------------------------
133 static int ReadAdc(int ch
)
137 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_SWRST
;
138 AT91C_BASE_ADC
->ADC_MR
=
139 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
140 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
141 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
143 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
144 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
145 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
148 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
150 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
152 // Note: with the "historic" values in the comments above, the error was 34% !!!
154 AT91C_BASE_ADC
->ADC_CHER
= ADC_CHANNEL(ch
);
156 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
;
158 while(!(AT91C_BASE_ADC
->ADC_SR
& ADC_END_OF_CONVERSION(ch
)))
160 d
= AT91C_BASE_ADC
->ADC_CDR
[ch
];
165 int AvgAdc(int ch
) // was static - merlok
170 for(i
= 0; i
< 32; i
++) {
174 return (a
+ 15) >> 5;
177 void MeasureAntennaTuning(void)
179 uint8_t LF_Results
[256];
180 int i
, adcval
= 0, peak
= 0, peakv
= 0, peakf
= 0; //ptr = 0
181 int vLf125
= 0, vLf134
= 0, vHf
= 0; // in mV
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC
| FPGA_LF_ADC_READER_FIELD
);
196 for (i
=255; i
>=19; i
--) {
198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, i
);
200 adcval
= ((MAX_ADC_LF_VOLTAGE
* AvgAdc(ADC_CHAN_LF
)) >> 10);
201 if (i
==95) vLf125
= adcval
; // voltage at 125Khz
202 if (i
==89) vLf134
= adcval
; // voltage at 134Khz
204 LF_Results
[i
] = adcval
>>8; // scale int to fit in byte for graphing purposes
205 if(LF_Results
[i
] > peak
) {
207 peak
= LF_Results
[i
];
213 for (i
=18; i
>= 0; i
--) LF_Results
[i
] = 0;
216 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
217 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
218 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
220 vHf
= (MAX_ADC_HF_VOLTAGE
* AvgAdc(ADC_CHAN_HF
)) >> 10;
222 cmd_send(CMD_MEASURED_ANTENNA_TUNING
, vLf125
| (vLf134
<<16), vHf
, peakf
| (peakv
<<16), LF_Results
, 256);
223 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
229 void MeasureAntennaTuningHf(void)
231 int vHf
= 0; // in mV
233 DbpString("Measuring HF antenna, press button to exit");
235 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
236 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
237 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
241 vHf
= (MAX_ADC_HF_VOLTAGE
* AvgAdc(ADC_CHAN_HF
)) >> 10;
243 Dbprintf("%d mV",vHf
);
244 if (BUTTON_PRESS()) break;
246 DbpString("cancelled");
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
253 void SimulateTagHfListen(void)
255 // ToDo: historically this used the free buffer, which was 2744 Bytes long.
256 // There might be a better size to be defined:
257 #define HF_14B_SNOOP_BUFFER_SIZE 2744
258 uint8_t *dest
= BigBuf_malloc(HF_14B_SNOOP_BUFFER_SIZE
);
263 // We're using this mode just so that I can test it out; the simulated
264 // tag mode would work just as well and be simpler.
265 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
266 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
| FPGA_HF_READER_RX_XCORR_SNOOP
);
268 // We need to listen to the high-frequency, peak-detected path.
269 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
275 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
276 AT91C_BASE_SSC
->SSC_THR
= 0xff;
278 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
279 uint8_t r
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
293 if(i
>= HF_14B_SNOOP_BUFFER_SIZE
) {
299 DbpString("simulate tag (now type bitsamples)");
302 void ReadMem(int addr
)
304 const uint8_t *data
= ((uint8_t *)addr
);
306 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
307 addr
, data
[0], data
[1], data
[2], data
[3], data
[4], data
[5], data
[6], data
[7]);
310 /* osimage version information is linked in */
311 extern struct version_information version_information
;
312 /* bootrom version information is pointed to from _bootphase1_version_pointer */
313 extern char *_bootphase1_version_pointer
, _flash_start
, _flash_end
;
314 void SendVersion(void)
316 char temp
[512]; /* Limited data payload in USB packets */
317 DbpString("Prox/RFID mark3 RFID instrument");
319 /* Try to find the bootrom version information. Expect to find a pointer at
320 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
321 * pointer, then use it.
323 char *bootrom_version
= *(char**)&_bootphase1_version_pointer
;
324 if( bootrom_version
< &_flash_start
|| bootrom_version
>= &_flash_end
) {
325 DbpString("bootrom version information appears invalid");
327 FormatVersionInformation(temp
, sizeof(temp
), "bootrom: ", bootrom_version
);
331 FormatVersionInformation(temp
, sizeof(temp
), "os: ", &version_information
);
334 FpgaGatherVersion(temp
, sizeof(temp
));
337 cmd_send(CMD_ACK
,*(AT91C_DBGU_CIDR
),0,0,NULL
,0);
341 // samy's sniff and repeat routine
344 DbpString("Stand-alone mode! No PC necessary.");
345 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
347 // 3 possible options? no just 2 for now
350 int high
[OPTS
], low
[OPTS
];
352 // Oooh pretty -- notify user we're in elite samy mode now
354 LED(LED_ORANGE
, 200);
356 LED(LED_ORANGE
, 200);
358 LED(LED_ORANGE
, 200);
360 LED(LED_ORANGE
, 200);
367 // Turn on selected LED
368 LED(selected
+ 1, 0);
375 // Was our button held down or pressed?
376 int button_pressed
= BUTTON_HELD(1000);
379 // Button was held for a second, begin recording
380 if (button_pressed
> 0 && cardRead
== 0)
383 LED(selected
+ 1, 0);
387 DbpString("Starting recording");
389 // wait for button to be released
390 while(BUTTON_PRESS())
393 /* need this delay to prevent catching some weird data */
396 CmdHIDdemodFSK(1, &high
[selected
], &low
[selected
], 0);
397 Dbprintf("Recorded %x %x %x", selected
, high
[selected
], low
[selected
]);
400 LED(selected
+ 1, 0);
401 // Finished recording
403 // If we were previously playing, set playing off
404 // so next button push begins playing what we recorded
411 else if (button_pressed
> 0 && cardRead
== 1)
414 LED(selected
+ 1, 0);
418 Dbprintf("Cloning %x %x %x", selected
, high
[selected
], low
[selected
]);
420 // wait for button to be released
421 while(BUTTON_PRESS())
424 /* need this delay to prevent catching some weird data */
427 CopyHIDtoT55x7(high
[selected
], low
[selected
], 0, 0);
428 Dbprintf("Cloned %x %x %x", selected
, high
[selected
], low
[selected
]);
431 LED(selected
+ 1, 0);
432 // Finished recording
434 // If we were previously playing, set playing off
435 // so next button push begins playing what we recorded
442 // Change where to record (or begin playing)
443 else if (button_pressed
)
445 // Next option if we were previously playing
447 selected
= (selected
+ 1) % OPTS
;
451 LED(selected
+ 1, 0);
453 // Begin transmitting
457 DbpString("Playing");
458 // wait for button to be released
459 while(BUTTON_PRESS())
461 Dbprintf("%x %x %x", selected
, high
[selected
], low
[selected
]);
462 CmdHIDsimTAG(high
[selected
], low
[selected
], 0);
463 DbpString("Done playing");
464 if (BUTTON_HELD(1000) > 0)
466 DbpString("Exiting");
471 /* We pressed a button so ignore it here with a delay */
474 // when done, we're done playing, move to next option
475 selected
= (selected
+ 1) % OPTS
;
478 LED(selected
+ 1, 0);
481 while(BUTTON_PRESS())
490 Listen and detect an external reader. Determine the best location
494 Inside the ListenReaderField() function, there is two mode.
495 By default, when you call the function, you will enter mode 1.
496 If you press the PM3 button one time, you will enter mode 2.
497 If you press the PM3 button a second time, you will exit the function.
499 DESCRIPTION OF MODE 1:
500 This mode just listens for an external reader field and lights up green
501 for HF and/or red for LF. This is the original mode of the detectreader
504 DESCRIPTION OF MODE 2:
505 This mode will visually represent, using the LEDs, the actual strength of the
506 current compared to the maximum current detected. Basically, once you know
507 what kind of external reader is present, it will help you spot the best location to place
508 your antenna. You will probably not get some good results if there is a LF and a HF reader
509 at the same place! :-)
513 static const char LIGHT_SCHEME
[] = {
514 0x0, /* ---- | No field detected */
515 0x1, /* X--- | 14% of maximum current detected */
516 0x2, /* -X-- | 29% of maximum current detected */
517 0x4, /* --X- | 43% of maximum current detected */
518 0x8, /* ---X | 57% of maximum current detected */
519 0xC, /* --XX | 71% of maximum current detected */
520 0xE, /* -XXX | 86% of maximum current detected */
521 0xF, /* XXXX | 100% of maximum current detected */
523 static const int LIGHT_LEN
= sizeof(LIGHT_SCHEME
)/sizeof(LIGHT_SCHEME
[0]);
525 void ListenReaderField(int limit
)
527 int lf_av
, lf_av_new
, lf_baseline
= 0, lf_max
;
528 int hf_av
, hf_av_new
, hf_baseline
= 0, hf_max
;
529 int mode
=1, display_val
, display_max
, i
;
533 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
536 // switch off FPGA - we don't want to measure our own signal
537 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
538 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
542 lf_av
= lf_max
= AvgAdc(ADC_CHAN_LF
);
544 if(limit
!= HF_ONLY
) {
545 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE
* lf_av
) >> 10);
549 hf_av
= hf_max
= AvgAdc(ADC_CHAN_HF
);
551 if (limit
!= LF_ONLY
) {
552 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE
* hf_av
) >> 10);
557 if (BUTTON_PRESS()) {
562 DbpString("Signal Strength Mode");
566 DbpString("Stopped");
574 if (limit
!= HF_ONLY
) {
576 if (abs(lf_av
- lf_baseline
) > REPORT_CHANGE
)
582 lf_av_new
= AvgAdc(ADC_CHAN_LF
);
583 // see if there's a significant change
584 if(abs(lf_av
- lf_av_new
) > REPORT_CHANGE
) {
585 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE
* lf_av_new
) >> 10);
592 if (limit
!= LF_ONLY
) {
594 if (abs(hf_av
- hf_baseline
) > REPORT_CHANGE
)
600 hf_av_new
= AvgAdc(ADC_CHAN_HF
);
601 // see if there's a significant change
602 if(abs(hf_av
- hf_av_new
) > REPORT_CHANGE
) {
603 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE
* hf_av_new
) >> 10);
611 if (limit
== LF_ONLY
) {
613 display_max
= lf_max
;
614 } else if (limit
== HF_ONLY
) {
616 display_max
= hf_max
;
617 } else { /* Pick one at random */
618 if( (hf_max
- hf_baseline
) > (lf_max
- lf_baseline
) ) {
620 display_max
= hf_max
;
623 display_max
= lf_max
;
626 for (i
=0; i
<LIGHT_LEN
; i
++) {
627 if (display_val
>= ((display_max
/LIGHT_LEN
)*i
) && display_val
<= ((display_max
/LIGHT_LEN
)*(i
+1))) {
628 if (LIGHT_SCHEME
[i
] & 0x1) LED_C_ON(); else LED_C_OFF();
629 if (LIGHT_SCHEME
[i
] & 0x2) LED_A_ON(); else LED_A_OFF();
630 if (LIGHT_SCHEME
[i
] & 0x4) LED_B_ON(); else LED_B_OFF();
631 if (LIGHT_SCHEME
[i
] & 0x8) LED_D_ON(); else LED_D_OFF();
639 void UsbPacketReceived(uint8_t *packet
, int len
)
641 UsbCommand
*c
= (UsbCommand
*)packet
;
643 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
647 case CMD_SET_LF_SAMPLING_CONFIG
:
648 setSamplingConfig((sample_config
*) c
->d
.asBytes
);
650 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
:
651 cmd_send(CMD_ACK
,SampleLF(c
->arg
[0]),0,0,0,0);
653 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
:
654 ModThenAcquireRawAdcSamples125k(c
->arg
[0],c
->arg
[1],c
->arg
[2],c
->d
.asBytes
);
656 case CMD_LF_SNOOP_RAW_ADC_SAMPLES
:
657 cmd_send(CMD_ACK
,SnoopLF(),0,0,0,0);
659 case CMD_HID_DEMOD_FSK
:
660 CmdHIDdemodFSK(c
->arg
[0], 0, 0, 1);
662 case CMD_HID_SIM_TAG
:
663 CmdHIDsimTAG(c
->arg
[0], c
->arg
[1], 1);
665 case CMD_FSK_SIM_TAG
:
666 CmdFSKsimTAG(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
668 case CMD_ASK_SIM_TAG
:
669 CmdASKsimTag(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
671 case CMD_PSK_SIM_TAG
:
672 CmdPSKsimTag(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
674 case CMD_HID_CLONE_TAG
:
675 CopyHIDtoT55x7(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
[0]);
677 case CMD_IO_DEMOD_FSK
:
678 CmdIOdemodFSK(c
->arg
[0], 0, 0, 1);
680 case CMD_IO_CLONE_TAG
:
681 CopyIOtoT55x7(c
->arg
[0], c
->arg
[1], c
->d
.asBytes
[0]);
683 case CMD_EM410X_DEMOD
:
684 CmdEM410xdemod(c
->arg
[0], 0, 0, 1);
686 case CMD_EM410X_WRITE_TAG
:
687 WriteEM410x(c
->arg
[0], c
->arg
[1], c
->arg
[2]);
689 case CMD_READ_TI_TYPE
:
692 case CMD_WRITE_TI_TYPE
:
693 WriteTItag(c
->arg
[0],c
->arg
[1],c
->arg
[2]);
695 case CMD_SIMULATE_TAG_125K
:
697 SimulateTagLowFrequency(c
->arg
[0], c
->arg
[1], 1);
700 case CMD_LF_SIMULATE_BIDIR
:
701 SimulateTagLowFrequencyBidir(c
->arg
[0], c
->arg
[1]);
703 case CMD_INDALA_CLONE_TAG
:
704 CopyIndala64toT55x7(c
->arg
[0], c
->arg
[1]);
706 case CMD_INDALA_CLONE_TAG_L
:
707 CopyIndala224toT55x7(c
->d
.asDwords
[0], c
->d
.asDwords
[1], c
->d
.asDwords
[2], c
->d
.asDwords
[3], c
->d
.asDwords
[4], c
->d
.asDwords
[5], c
->d
.asDwords
[6]);
709 case CMD_T55XX_READ_BLOCK
:
710 T55xxReadBlock(c
->arg
[1], c
->arg
[2],c
->d
.asBytes
[0]);
712 case CMD_T55XX_WRITE_BLOCK
:
713 T55xxWriteBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
[0]);
715 case CMD_T55XX_READ_TRACE
:
718 case CMD_PCF7931_READ
:
720 cmd_send(CMD_ACK
,0,0,0,0,0);
722 case CMD_EM4X_READ_WORD
:
723 EM4xReadWord(c
->arg
[1], c
->arg
[2],c
->d
.asBytes
[0]);
725 case CMD_EM4X_WRITE_WORD
:
726 EM4xWriteWord(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
[0]);
731 case CMD_SNOOP_HITAG
: // Eavesdrop Hitag tag, args = type
732 SnoopHitag(c
->arg
[0]);
734 case CMD_SIMULATE_HITAG
: // Simulate Hitag tag, args = memory content
735 SimulateHitagTag((bool)c
->arg
[0],(byte_t
*)c
->d
.asBytes
);
737 case CMD_READER_HITAG
: // Reader for Hitag tags, args = type and function
738 ReaderHitag((hitag_function
)c
->arg
[0],(hitag_data
*)c
->d
.asBytes
);
743 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693
:
744 AcquireRawAdcSamplesIso15693();
746 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693
:
747 RecordRawAdcSamplesIso15693();
750 case CMD_ISO_15693_COMMAND
:
751 DirectTag15693Command(c
->arg
[0],c
->arg
[1],c
->arg
[2],c
->d
.asBytes
);
754 case CMD_ISO_15693_FIND_AFI
:
755 BruteforceIso15693Afi(c
->arg
[0]);
758 case CMD_ISO_15693_DEBUG
:
759 SetDebugIso15693(c
->arg
[0]);
762 case CMD_READER_ISO_15693
:
763 ReaderIso15693(c
->arg
[0]);
765 case CMD_SIMTAG_ISO_15693
:
766 SimTagIso15693(c
->arg
[0], c
->d
.asBytes
);
771 case CMD_SIMULATE_TAG_LEGIC_RF
:
772 LegicRfSimulate(c
->arg
[0], c
->arg
[1], c
->arg
[2]);
775 case CMD_WRITER_LEGIC_RF
:
776 LegicRfWriter(c
->arg
[1], c
->arg
[0]);
779 case CMD_READER_LEGIC_RF
:
780 LegicRfReader(c
->arg
[0], c
->arg
[1]);
784 #ifdef WITH_ISO14443b
785 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443
:
786 AcquireRawAdcSamplesIso14443(c
->arg
[0]);
788 case CMD_READ_SRI512_TAG
:
789 ReadSTMemoryIso14443(0x0F);
791 case CMD_READ_SRIX4K_TAG
:
792 ReadSTMemoryIso14443(0x7F);
794 case CMD_SNOOP_ISO_14443
:
797 case CMD_SIMULATE_TAG_ISO_14443
:
798 SimulateIso14443Tag();
800 case CMD_ISO_14443B_COMMAND
:
801 SendRawCommand14443B(c
->arg
[0],c
->arg
[1],c
->arg
[2],c
->d
.asBytes
);
805 #ifdef WITH_ISO14443a
806 case CMD_SNOOP_ISO_14443a
:
807 SnoopIso14443a(c
->arg
[0]);
809 case CMD_READER_ISO_14443a
:
812 case CMD_SIMULATE_TAG_ISO_14443a
:
813 SimulateIso14443aTag(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
); // ## Simulate iso14443a tag - pass tag type & UID
816 case CMD_EPA_PACE_COLLECT_NONCE
:
817 EPA_PACE_Collect_Nonce(c
);
820 case CMD_READER_MIFARE
:
821 ReaderMifare(c
->arg
[0]);
823 case CMD_MIFARE_READBL
:
824 MifareReadBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
826 case CMD_MIFAREU_READBL
:
827 MifareUReadBlock(c
->arg
[0],c
->arg
[1], c
->d
.asBytes
);
829 case CMD_MIFAREUC_AUTH1
:
830 MifareUC_Auth1(c
->arg
[0],c
->d
.asBytes
);
832 case CMD_MIFAREUC_AUTH2
:
833 MifareUC_Auth2(c
->arg
[0],c
->d
.asBytes
);
835 case CMD_MIFAREU_READCARD
:
836 MifareUReadCard(c
->arg
[0], c
->arg
[1], c
->d
.asBytes
);
838 case CMD_MIFAREUC_READCARD
:
839 MifareUReadCard(c
->arg
[0], c
->arg
[1], c
->d
.asBytes
);
841 case CMD_MIFAREUC_SETPWD
:
842 MifareUSetPwd(c
->arg
[0], c
->d
.asBytes
);
844 case CMD_MIFARE_READSC
:
845 MifareReadSector(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
847 case CMD_MIFARE_WRITEBL
:
848 MifareWriteBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
850 case CMD_MIFAREU_WRITEBL_COMPAT
:
851 MifareUWriteBlock(c
->arg
[0], c
->d
.asBytes
);
853 case CMD_MIFAREU_WRITEBL
:
854 MifareUWriteBlock_Special(c
->arg
[0], c
->d
.asBytes
);
856 case CMD_MIFARE_NESTED
:
857 MifareNested(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
859 case CMD_MIFARE_CHKKEYS
:
860 MifareChkKeys(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
862 case CMD_SIMULATE_MIFARE_CARD
:
863 Mifare1ksim(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
867 case CMD_MIFARE_SET_DBGMODE
:
868 MifareSetDbgLvl(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
870 case CMD_MIFARE_EML_MEMCLR
:
871 MifareEMemClr(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
873 case CMD_MIFARE_EML_MEMSET
:
874 MifareEMemSet(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
876 case CMD_MIFARE_EML_MEMGET
:
877 MifareEMemGet(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
879 case CMD_MIFARE_EML_CARDLOAD
:
880 MifareECardLoad(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
883 // Work with "magic Chinese" card
884 case CMD_MIFARE_CSETBLOCK
:
885 MifareCSetBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
887 case CMD_MIFARE_CGETBLOCK
:
888 MifareCGetBlock(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
890 case CMD_MIFARE_CIDENT
:
895 case CMD_MIFARE_SNIFFER
:
896 SniffMifare(c
->arg
[0]);
902 // Makes use of ISO14443a FPGA Firmware
903 case CMD_SNOOP_ICLASS
:
906 case CMD_SIMULATE_TAG_ICLASS
:
907 SimulateIClass(c
->arg
[0], c
->arg
[1], c
->arg
[2], c
->d
.asBytes
);
909 case CMD_READER_ICLASS
:
910 ReaderIClass(c
->arg
[0]);
912 case CMD_READER_ICLASS_REPLAY
:
913 ReaderIClass_Replay(c
->arg
[0], c
->d
.asBytes
);
915 case CMD_ICLASS_EML_MEMSET
:
916 emlSet(c
->d
.asBytes
,c
->arg
[0], c
->arg
[1]);
920 case CMD_SIMULATE_TAG_HF_LISTEN
:
921 SimulateTagHfListen();
928 case CMD_MEASURE_ANTENNA_TUNING
:
929 MeasureAntennaTuning();
932 case CMD_MEASURE_ANTENNA_TUNING_HF
:
933 MeasureAntennaTuningHf();
936 case CMD_LISTEN_READER_FIELD
:
937 ListenReaderField(c
->arg
[0]);
940 case CMD_FPGA_MAJOR_MODE_OFF
: // ## FPGA Control
941 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
943 LED_D_OFF(); // LED D indicates field ON or OFF
946 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
:
949 uint8_t *BigBuf
= BigBuf_get_addr();
950 for(size_t i
=0; i
<c
->arg
[1]; i
+= USB_CMD_DATA_SIZE
) {
951 size_t len
= MIN((c
->arg
[1] - i
),USB_CMD_DATA_SIZE
);
952 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K
,i
,len
,BigBuf_get_traceLen(),BigBuf
+c
->arg
[0]+i
,len
);
954 // Trigger a finish downloading signal with an ACK frame
955 cmd_send(CMD_ACK
,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config
));
959 case CMD_DOWNLOADED_SIM_SAMPLES_125K
: {
960 uint8_t *b
= BigBuf_get_addr();
961 memcpy(b
+c
->arg
[0], c
->d
.asBytes
, USB_CMD_DATA_SIZE
);
962 cmd_send(CMD_ACK
,0,0,0,0,0);
969 case CMD_SET_LF_DIVISOR
:
970 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
971 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, c
->arg
[0]);
974 case CMD_SET_ADC_MUX
:
976 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD
); break;
977 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW
); break;
978 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD
); break;
979 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW
); break;
995 case CMD_SETUP_WRITE
:
996 case CMD_FINISH_WRITE
:
997 case CMD_HARDWARE_RESET
:
1001 AT91C_BASE_RSTC
->RSTC_RCR
= RST_CONTROL_KEY
| AT91C_RSTC_PROCRST
;
1003 // We're going to reset, and the bootrom will take control.
1007 case CMD_START_FLASH
:
1008 if(common_area
.flags
.bootrom_present
) {
1009 common_area
.command
= COMMON_AREA_COMMAND_ENTER_FLASH_MODE
;
1012 AT91C_BASE_RSTC
->RSTC_RCR
= RST_CONTROL_KEY
| AT91C_RSTC_PROCRST
;
1016 case CMD_DEVICE_INFO
: {
1017 uint32_t dev_info
= DEVICE_INFO_FLAG_OSIMAGE_PRESENT
| DEVICE_INFO_FLAG_CURRENT_MODE_OS
;
1018 if(common_area
.flags
.bootrom_present
) dev_info
|= DEVICE_INFO_FLAG_BOOTROM_PRESENT
;
1019 cmd_send(CMD_DEVICE_INFO
,dev_info
,0,0,0,0);
1023 Dbprintf("%s: 0x%04x","unknown command:",c
->cmd
);
1028 void __attribute__((noreturn
)) AppMain(void)
1032 if(common_area
.magic
!= COMMON_AREA_MAGIC
|| common_area
.version
!= 1) {
1033 /* Initialize common area */
1034 memset(&common_area
, 0, sizeof(common_area
));
1035 common_area
.magic
= COMMON_AREA_MAGIC
;
1036 common_area
.version
= 1;
1038 common_area
.flags
.osimage_present
= 1;
1048 // The FPGA gets its clock from us from PCK0 output, so set that up.
1049 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_PCK0
;
1050 AT91C_BASE_PIOA
->PIO_PDR
= GPIO_PCK0
;
1051 AT91C_BASE_PMC
->PMC_SCER
= AT91C_PMC_PCK0
;
1052 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1053 AT91C_BASE_PMC
->PMC_PCKR
[0] = AT91C_PMC_CSS_PLL_CLK
|
1054 AT91C_PMC_PRES_CLK_4
;
1055 AT91C_BASE_PIOA
->PIO_OER
= GPIO_PCK0
;
1058 AT91C_BASE_SPI
->SPI_CR
= AT91C_SPI_SWRST
;
1060 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_SWRST
;
1062 // Load the FPGA image, which we have stored in our flash.
1063 // (the HF version by default)
1064 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1072 byte_t rx
[sizeof(UsbCommand
)];
1077 rx_len
= usb_read(rx
,sizeof(UsbCommand
));
1079 UsbPacketReceived(rx
,rx_len
);
1085 if (BUTTON_HELD(1000) > 0)