git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

2 // Jonathan Westhues, Mar 2006

3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)

4 //

5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

6 // at your option, any later version. See the LICENSE.txt file for the text of

7 // the license.

8 //-----------------------------------------------------------------------------

9 // The main application code. This is the first thing called after start.c

10 // executes.

11 //-----------------------------------------------------------------------------

13 #include <stdarg.h>

15 #include "usb_cdc.h"

16 #include "cmd.h"

17 #include "proxmark3.h"

18 #include "apps.h"

19 #include "fpga.h"

20 #include "util.h"

21 #include "printf.h"

22 #include "string.h"

23 #include "legicrf.h"

24 #include "legicrfsim.h"

25 #include "hitag2.h"

26 #include "hitagS.h"

27 #include "iso14443b.h"

28 #include "iso15693.h"

29 #include "lfsampling.h"

30 #include "BigBuf.h"

31 #include "mifareutil.h"

32 #include "pcf7931.h"

33 #include "i2c.h"

34 #include "hfsnoop.h"

35 #include "fpgaloader.h"

36 #ifdef WITH_LCD

37 #include "LCD.h"

38 #endif

40 static uint32_t hw_capabilities;

42 // Craig Young - 14a stand-alone code

43 #ifdef WITH_ISO14443a

44 #include "iso14443a.h"

45 #endif

47 //=============================================================================

48 // A buffer where we can queue things up to be sent through the FPGA, for

49 // any purpose (fake tag, as reader, whatever). We go MSB first, since that

50 // is the order in which they go out on the wire.

51 //=============================================================================

53 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits

54 uint8_t ToSend[TOSEND_BUFFER_SIZE];

55 int ToSendMax;

56 static int ToSendBit;

 struct common_area common_area __attribute__((section(".commonarea")));

 void ToSendReset(void)

60 {

61 ToSendMax = -1;

62 ToSendBit = 8;

63 }

 void ToSendStuffBit(int b)

66 {

         if(ToSendBit >= 8) {

68 ToSendMax++;

69 ToSend[ToSendMax] = 0;

70 ToSendBit = 0;

71 }

73 if(b) {

                 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));

75 }

77 ToSendBit++;

         if(ToSendMax >= sizeof(ToSend)) {

80 ToSendBit = 0;

81 DbpString("ToSendStuffBit overflowed!");

82 }

83 }

85 //=============================================================================

86 // Debug print functions, to go out over USB, to the usual PC-side client.

87 //=============================================================================

 void DbpString(char *str)

90 {

91 byte_t len = strlen(str);

   cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);

93 }

95 #if 0

 void DbpIntegers(int x1, int x2, int x3)

97 {

   cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);

99 }

100 #endif

101

 void Dbprintf(const char *fmt, ...) {

103 // should probably limit size here; oh well, let's just use a big buffer

104 char output_string[128];

105 va_list ap;

106

107 va_start(ap, fmt);

         kvsprintf(fmt, output_string, 10, ap);

109 va_end(ap);

110

111 DbpString(output_string);

112 }

113

114 // prints HEX & ASCII

 void Dbhexdump(int len, uint8_t *d, bool bAsci) {

         int l=0,i;

117 char ascii[9];

118

         while (len>0) {

                 if (len>8) l=8;

121 else l=len;

122

                 memcpy(ascii,d,l);

124 ascii[l]=0;

125

126 // filter safe ascii

                 for (i=0;i<l;i++)

                         if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';

129

130 if (bAsci) {

                         Dbprintf("%-8s %*D",ascii,l,d," ");

132 } else {

                         Dbprintf("%*D",l,d," ");

134 }

135

136 len-=8;

137 d+=8;

138 }

139 }

140

141 //-----------------------------------------------------------------------------

142 // Read an ADC channel and block till it completes, then return the result

143 // in ADC units (0 to 1023). Also a routine to average 32 samples and

144 // return that.

145 //-----------------------------------------------------------------------------

 static int ReadAdc(int ch)

147 {

148 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.

149 // AMPL_HI is a high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant

150 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.

151 //

152 // The maths are:

153 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be

154 //

155 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)

156

157 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;

158 AT91C_BASE_ADC->ADC_MR =

                 ADC_MODE_PRESCALE(63) |                                                 // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz

                 ADC_MODE_STARTUP_TIME(1) |                                              // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us     Note: must be > 20us

                 ADC_MODE_SAMPLE_HOLD_TIME(15);                                  // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us

162

         AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);

164 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;

165

         while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};

167

         return AT91C_BASE_ADC->ADC_CDR[ch] & 0x3ff;

169 }

170

 int AvgAdc(int ch) // was static - merlok

172 {

173 int i;

174 int a = 0;

175

         for(i = 0; i < 32; i++) {

177 a += ReadAdc(ch);

178 }

179

         return (a + 15) >> 5;

181 }

182

 static int AvgAdc_Voltage_HF(void)

184 {

185 int AvgAdc_Voltage_Low, AvgAdc_Voltage_High;

186

         AvgAdc_Voltage_Low= (MAX_ADC_HF_VOLTAGE_LOW * AvgAdc(ADC_CHAN_HF_LOW)) >> 10;

188 // if voltage range is about to be exceeded, use high voltage ADC channel if available (RDV40 only)

         if (AvgAdc_Voltage_Low > MAX_ADC_HF_VOLTAGE_LOW - 300) {

                 AvgAdc_Voltage_High = (MAX_ADC_HF_VOLTAGE_HIGH * AvgAdc(ADC_CHAN_HF_HIGH)) >> 10;

191 if (AvgAdc_Voltage_High >= AvgAdc_Voltage_Low) {

192 return AvgAdc_Voltage_High;

193 }

194 }

195 return AvgAdc_Voltage_Low;

196 }

197

 static int AvgAdc_Voltage_LF(void)

199 {

         return (MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10;

201 }

202

 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])

204 {

         int i, adcval = 0, peak = 0;

206

207 /*

208 * Sweeps the useful LF range of the proxmark from

209 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and

210 * read the voltage in the antenna, the result left

211 * in the buffer is a graph which should clearly show

212 * the resonating frequency of your LF antenna

213 * ( hopefully around 95 if it is tuned to 125kHz!)

214 */

215

216 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);

217 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);

218 SpinDelay(50);

219

         for (i=255; i>=19; i--) {

221 WDT_HIT();

222 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);

223 SpinDelay(20);

224 adcval = AvgAdc_Voltage_LF();

                 if (i==95) *vLf125 = adcval; // voltage at 125Khz

                 if (i==89) *vLf134 = adcval; // voltage at 134Khz

227

                 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes

                 if(LF_Results[i] > peak) {

230 *peakv = adcval;

231 peak = LF_Results[i];

232 *peakf = i;

233 //ptr = i;

234 }

235 }

236

         for (i=18; i >= 0; i--) LF_Results[i] = 0;

238

239 return;

240 }

241

 void MeasureAntennaTuningHfOnly(int *vHf)

243 {

244 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.

245 LED_A_ON();

246 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

247 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);

248 SpinDelay(20);

249 *vHf = AvgAdc_Voltage_HF();

250 LED_A_OFF();

251 return;

252 }

253

 void MeasureAntennaTuning(int mode)

255 {

         uint8_t LF_Results[256] = {0};

         int peakv = 0, peakf = 0;

         int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV

259

260 LED_B_ON();

261

         if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {

263 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.

264 MeasureAntennaTuningHfOnly(&vHf);

                 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);

266 } else {

267 if (mode & FLAG_TUNE_LF) {

                         MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);

269 }

270 if (mode & FLAG_TUNE_HF) {

271 MeasureAntennaTuningHfOnly(&vHf);

272 }

273 }

274

         cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);

276 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

277 LED_B_OFF();

278 return;

279 }

280

 void MeasureAntennaTuningHf(void)

282 {

         int vHf = 0;    // in mV

284

285 DbpString("Measuring HF antenna, press button to exit");

286

287 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.

288 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

289 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);

290

291 for (;;) {

292 SpinDelay(500);

293 vHf = AvgAdc_Voltage_HF();

294

                 Dbprintf("%d mV",vHf);

                 if (BUTTON_PRESS()) break;

297 }

298 DbpString("cancelled");

299

300 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

301

302 }

303

304

 void ReadMem(int addr)

306 {

         const uint8_t *data = ((uint8_t *)addr);

308

309 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",

                 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);

311 }

312

313 /* osimage version information is linked in */

314 extern struct version_information version_information;

315 /* bootrom version information is pointed to from _bootphase1_version_pointer */

 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;

317

318

 void set_hw_capabilities(void)

320 {

321 if (I2C_is_available()) {

322 hw_capabilities |= HAS_SMARTCARD_SLOT;

323 }

324

         if (false) { // TODO: implement a test

326 hw_capabilities |= HAS_EXTRA_FLASH_MEM;

327 }

328 }

329

330

 void SendVersion(void)

332 {

333 set_hw_capabilities();

334

335 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */

         char VersionString[USB_CMD_DATA_SIZE] = { '\0' };

337

338 /* Try to find the bootrom version information. Expect to find a pointer at

339 * symbol _bootphase1_version_pointer, perform slight sanity checks on the

340 * pointer, then use it.

341 */

         char *bootrom_version = *(char**)&_bootphase1_version_pointer;

         if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {

                 strcat(VersionString, "bootrom version information appears invalid\n");

345 } else {

                 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);

                 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);

348 }

349

         FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);

         strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);

352

         for (int i = 0; i < fpga_bitstream_num; i++) {

                 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);

                 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);

356 }

357

358 // test availability of SmartCard slot

359 if (I2C_is_available()) {

                 strncat(VersionString, "SmartCard Slot: available\n", sizeof(VersionString) - strlen(VersionString) - 1);

361 } else {

                 strncat(VersionString, "SmartCard Slot: not available\n", sizeof(VersionString) - strlen(VersionString) - 1);

363 }

364

365 // Send Chip ID and used flash memory

         uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;

367 uint32_t compressed_data_section_size = common_area.arg1;

         cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, hw_capabilities, VersionString, strlen(VersionString));

369 }

370

371 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.

372 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.

 void printUSBSpeed(void) 

374 {

375 Dbprintf("USB Speed:");

376 Dbprintf(" Sending USB packets to client...");

377

378 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds

         uint8_t *test_data = BigBuf_get_addr();

380 uint32_t end_time;

381

         uint32_t start_time = end_time = GetTickCount();

383 uint32_t bytes_transferred = 0;

384

385 LED_B_ON();

         while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {

                 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);

388 end_time = GetTickCount();

389 bytes_transferred += USB_CMD_DATA_SIZE;

390 }

391 LED_B_OFF();

392

         Dbprintf("  Time elapsed:      %dms", end_time - start_time);

         Dbprintf("  Bytes transferred: %d", bytes_transferred);

395 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",

                 1000 * bytes_transferred / (end_time - start_time));

397

398 }

399

400 /**

401 * Prints runtime information about the PM3.

402 **/

 void SendStatus(void)

404 {

405 BigBuf_print_status();

406 Fpga_print_status();

407 #ifdef WITH_SMARTCARD

408 I2C_print_status();

409 #endif

410 printConfig(); //LF Sampling config

411 printUSBSpeed();

412 Dbprintf("Various");

         Dbprintf("  MF_DBGLEVEL........%d", MF_DBGLEVEL);

         Dbprintf("  ToSendMax..........%d", ToSendMax);

         Dbprintf("  ToSendBit..........%d", ToSendBit);

416

         cmd_send(CMD_ACK,1,0,0,0,0);

418 }

419

420 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)

421

422 #define OPTS 2

423

424 void StandAloneMode()

425 {

426 DbpString("Stand-alone mode! No PC necessary.");

427 // Oooh pretty -- notify user we're in elite samy mode now

         LED(LED_RED,    200);

         LED(LED_ORANGE, 200);

         LED(LED_GREEN,  200);

         LED(LED_ORANGE, 200);

         LED(LED_RED,    200);

         LED(LED_ORANGE, 200);

         LED(LED_GREEN,  200);

         LED(LED_ORANGE, 200);

         LED(LED_RED,    200);

438 }

440 #endif

444 #ifdef WITH_ISO14443a_StandAlone

445 void StandAloneMode14a()

446 {

447 StandAloneMode();

448 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

449

450 int selected = 0;

         bool playing = false, GotoRecord = false, GotoClone = false;

         bool cardRead[OPTS] = {false};

         uint8_t readUID[10] = {0};

         uint32_t uid_1st[OPTS]={0};

         uint32_t uid_2nd[OPTS]={0};

456 uint32_t uid_tmp1 = 0;

457 uint32_t uid_tmp2 = 0;

458 iso14a_card_select_t hi14a_card[OPTS];

459

         LED(selected + 1, 0);

461

462 for (;;)

463 {

464 usb_poll();

465 WDT_HIT();

466 SpinDelay(300);

467

                 if (GotoRecord || !cardRead[selected])

469 {

470 GotoRecord = false;

471 LEDsoff();

                         LED(selected + 1, 0);

                         LED(LED_RED2, 0);

474

475 // record

                         Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);

477 /* need this delay to prevent catching some weird data */

478 SpinDelay(500);

479 /* Code for reading from 14a tag */

                         uint8_t uid[10]  ={0};

481 uint32_t cuid;

482 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);

483

484 for ( ; ; )

485 {

486 WDT_HIT();

487 if (BUTTON_PRESS()) {

488 if (cardRead[selected]) {

                                                 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);

490 break;

491 }

                                         else if (cardRead[(selected+1)%OPTS]) {

                                                 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);

                                                 selected = (selected+1)%OPTS;

495 break;

496 }

497 else {

498 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");

499 SpinDelay(300);

500 }

501 }

                                 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))

503 continue;

504 else

505 {

                                         Dbprintf("Read UID:"); Dbhexdump(10,uid,0);

                                         memcpy(readUID,uid,10*sizeof(uint8_t));

                                         uint8_t *dst = (uint8_t *)&uid_tmp1;

509 // Set UID byte order

                                         for (int i=0; i<4; i++)

                                                 dst[i] = uid[3-i];

512 dst = (uint8_t *)&uid_tmp2;

                                         for (int i=0; i<4; i++)

                                                 dst[i] = uid[7-i];

                                         if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {

516 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");

517 }

518 else {

519 if (uid_tmp2) {

                                                         Dbprintf("Bank[%d] received a 7-byte UID",selected);

                                                         uid_1st[selected] = (uid_tmp1)>>8;

                                                         uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);

523 }

524 else {

                                                         Dbprintf("Bank[%d] received a 4-byte UID",selected);

526 uid_1st[selected] = uid_tmp1;

527 uid_2nd[selected] = uid_tmp2;

528 }

529 break;

530 }

531 }

532 }

                         Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);

                         Dbprintf("SAK = %02X",hi14a_card[selected].sak);

535 LEDsoff();

                         LED(LED_GREEN,  200);

                         LED(LED_ORANGE, 200);

                         LED(LED_GREEN,  200);

                         LED(LED_ORANGE, 200);

540

541 LEDsoff();

                         LED(selected + 1, 0);

543

544 // Next state is replay:

545 playing = true;

546

547 cardRead[selected] = true;

548 }

549 /* MF Classic UID clone */

550 else if (GotoClone)

551 {

552 GotoClone=false;

553 LEDsoff();

                         LED(selected + 1, 0);

                         LED(LED_ORANGE, 250);

556

557

558 // record

                         Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);

560

561 // wait for button to be released

562 while(BUTTON_PRESS())

563 {

564 // Delay cloning until card is in place

565 WDT_HIT();

566 }

                         Dbprintf("Starting clone. [Bank: %u]", selected);

568 // need this delay to prevent catching some weird data

569 SpinDelay(500);

570 // Begin clone function here:

571 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:

572 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};

573 memcpy(c.d.asBytes, data, 16);

574 SendCommand(&c);

575

576 Block read is similar:

577 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};

578 We need to imitate that call with blockNo 0 to set a uid.

579

580 The get and set commands are handled in this file:

581 // Work with "magic Chinese" card

582 case CMD_MIFARE_CSETBLOCK:

583 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

584 break;

585 case CMD_MIFARE_CGETBLOCK:

586 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

587 break;

588

589 mfCSetUID provides example logic for UID set workflow:

590 -Read block0 from card in field with MifareCGetBlock()

591 -Configure new values without replacing reserved bytes

592 memcpy(block0, uid, 4); // Copy UID bytes from byte array

593 // Mifare UID BCC

594 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5

595 Bytes 5-7 are reserved SAK and ATQA for mifare classic

596 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it

597 */

                         uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};

599 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo

                         MifareCGetBlock(0x3F, 1, 0, oldBlock0);

                         if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1]  && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {

                                 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);

603 playing = true;

604 }

605 else {

                                 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);

                                 memcpy(newBlock0,oldBlock0,16);

608 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)

609

                                 newBlock0[0] = uid_1st[selected]>>24;

                                 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);

                                 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);

                                 newBlock0[3] = 0xFF & (uid_1st[selected]);

                                 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];

615 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain

                                 MifareCSetBlock(0, 0xFF,0, newBlock0);

                                 MifareCGetBlock(0x3F, 1, 0, testBlock0);

                                 if (memcmp(testBlock0,newBlock0,16)==0)

619 {

620 DbpString("Cloned successfull!");

                                         cardRead[selected] = false; // Only if the card was cloned successfully should we clear it

622 playing = false;

623 GotoRecord = true;

                                         selected = (selected+1) % OPTS;

625 }

626 else {

                                         Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);

628 playing = true;

629 }

630 }

631 LEDsoff();

                         LED(selected + 1, 0);

633

634 }

635 // Change where to record (or begin playing)

636 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])

637 {

638 LEDsoff();

                         LED(selected + 1, 0);

640

641 // Begin transmitting

                         LED(LED_GREEN, 0);

643 DbpString("Playing");

644 for ( ; ; ) {

645 WDT_HIT();

                                 int button_action = BUTTON_HELD(1000);

                                 if (button_action == 0) { // No button action, proceed with sim

                                         uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break

                                         Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);

                                         if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {

651 DbpString("Mifare Classic");

                                                 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic

653 }

                                         else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {

655 DbpString("Mifare Ultralight");

                                                 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight

657 }

                                         else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {

659 DbpString("Mifare DESFire");

                                                 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire

661 }

662 else {

663 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");

                                                 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);

665 }

666 }

667 else if (button_action == BUTTON_SINGLE_CLICK) {

                                         selected = (selected + 1) % OPTS;

                                         Dbprintf("Done playing. Switching to record mode on bank %d",selected);

670 GotoRecord = true;

671 break;

672 }

673 else if (button_action == BUTTON_HOLD) {

674 Dbprintf("Playtime over. Begin cloning...");

675 GotoClone = true;

676 break;

677 }

678 WDT_HIT();

679 }

680

681 /* We pressed a button so ignore it here with a delay */

682 SpinDelay(300);

683 LEDsoff();

                         LED(selected + 1, 0);

685 }

686 }

687 }

688 #elif WITH_LF_StandAlone

689 // samy's sniff and repeat routine

690 void SamyRun()

691 {

692 StandAloneMode();

693 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);

694

         int tops[OPTS], high[OPTS], low[OPTS];

696 int selected = 0;

697 int playing = 0;

698 int cardRead = 0;

699

700 // Turn on selected LED

         LED(selected + 1, 0);

702

703 for (;;)

704 {

705 usb_poll();

706 WDT_HIT();

707

708 // Was our button held down or pressed?

                 int button_pressed = BUTTON_HELD(1000);

710 SpinDelay(300);

711

712 // Button was held for a second, begin recording

                 if (button_pressed > 0 && cardRead == 0)

714 {

715 LEDsoff();

                         LED(selected + 1, 0);

                         LED(LED_RED2, 0);

718

719 // record

720 DbpString("Starting recording");

721

722 // wait for button to be released

723 while(BUTTON_PRESS())

724 WDT_HIT();

725

726 /* need this delay to prevent catching some weird data */

727 SpinDelay(500);

728

                         CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);

                         if (tops[selected] > 0)

                                 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);

732 else

                                 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);

734

735 LEDsoff();

                         LED(selected + 1, 0);

737 // Finished recording

738

739 // If we were previously playing, set playing off

740 // so next button push begins playing what we recorded

741 playing = 0;

742

743 cardRead = 1;

744

745 }

746

                 else if (button_pressed > 0 && cardRead == 1)

748 {

749 LEDsoff();

                                         LED(selected + 1, 0);

                                         LED(LED_ORANGE, 0);

752

753 // record

                                         if (tops[selected] > 0)

                                                 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);

756 else

                                                 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);

758

759 // wait for button to be released

760 while(BUTTON_PRESS())

761 WDT_HIT();

762

763 /* need this delay to prevent catching some weird data */

764 SpinDelay(500);

765

                                         CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)), 0x1D);

                                         if (tops[selected] > 0)

                                                 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);

769 else

                                                 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);

771

772 LEDsoff();

                                         LED(selected + 1, 0);

774 // Finished recording

775

776 // If we were previously playing, set playing off

777 // so next button push begins playing what we recorded

778 playing = 0;

779

780 cardRead = 0;

781

782 }

783

784 // Change where to record (or begin playing)

785 else if (button_pressed)

786 {

787 // Next option if we were previously playing

788 if (playing)

                                 selected = (selected + 1) % OPTS;

790 playing = !playing;

791

792 LEDsoff();

                         LED(selected + 1, 0);

794

795 // Begin transmitting

796 if (playing)

797 {

                                 LED(LED_GREEN, 0);

799 DbpString("Playing");

800 // wait for button to be released

801 while(BUTTON_PRESS())

802 WDT_HIT();

                                 if (tops[selected] > 0)

                                         Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);

805 else

                                         Dbprintf("%x %x%08x", selected, high[selected], low[selected]);

807

                                 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);

809 DbpString("Done playing");

                                 if (BUTTON_HELD(1000) > 0)

811 {

812 DbpString("Exiting");

813 LEDsoff();

814 return;

815 }

816

817 /* We pressed a button so ignore it here with a delay */

818 SpinDelay(300);

819

820 // when done, we're done playing, move to next option

                                 selected = (selected + 1) % OPTS;

822 playing = !playing;

823 LEDsoff();

                                 LED(selected + 1, 0);

825 }

826 else

827 while(BUTTON_PRESS())

828 WDT_HIT();

829 }

830 }

831 }

832

833 #endif

834 /*

835 OBJECTIVE

836 Listen and detect an external reader. Determine the best location

837 for the antenna.

838

839 INSTRUCTIONS:

840 Inside the ListenReaderField() function, there is two mode.

841 By default, when you call the function, you will enter mode 1.

842 If you press the PM3 button one time, you will enter mode 2.

843 If you press the PM3 button a second time, you will exit the function.

844

845 DESCRIPTION OF MODE 1:

846 This mode just listens for an external reader field and lights up green

847 for HF and/or red for LF. This is the original mode of the detectreader

848 function.

849

850 DESCRIPTION OF MODE 2:

851 This mode will visually represent, using the LEDs, the actual strength of the

852 current compared to the maximum current detected. Basically, once you know

853 what kind of external reader is present, it will help you spot the best location to place

854 your antenna. You will probably not get some good results if there is a LF and a HF reader

855 at the same place! :-)

856

857 LIGHT SCHEME USED:

858 */

859 static const char LIGHT_SCHEME[] = {

860 0x0, /* ---- | No field detected */

861 0x1, /* X--- | 14% of maximum current detected */

862 0x2, /* -X-- | 29% of maximum current detected */

863 0x4, /* --X- | 43% of maximum current detected */

864 0x8, /* ---X | 57% of maximum current detected */

865 0xC, /* --XX | 71% of maximum current detected */

866 0xE, /* -XXX | 86% of maximum current detected */

867 0xF, /* XXXX | 100% of maximum current detected */

868 };

 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);

870

 void ListenReaderField(int limit)

872 {

         int lf_av, lf_av_new=0, lf_baseline= 0, lf_max;

         int hf_av, hf_av_new=0,  hf_baseline= 0, hf_max;

         int mode=1, display_val, display_max, i;

876

877 #define LF_ONLY 1

878 #define HF_ONLY 2

879 #define REPORT_CHANGE_PERCENT 5 // report new values only if they have changed at least by REPORT_CHANGE_PERCENT

880 #define MIN_HF_FIELD 300 // in mode 1 signal HF field greater than MIN_HF_FIELD above baseline

881 #define MIN_LF_FIELD 1200 // in mode 1 signal LF field greater than MIN_LF_FIELD above baseline

882

883

884 // switch off FPGA - we don't want to measure our own signal

885 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

886 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

887

888 LEDsoff();

889

890 lf_av = lf_max = AvgAdc_Voltage_LF();

891

892 if(limit != HF_ONLY) {

                 Dbprintf("LF 125/134kHz Baseline: %dmV", lf_av);

894 lf_baseline = lf_av;

895 }

896

897 hf_av = hf_max = AvgAdc_Voltage_HF();

898

899 if (limit != LF_ONLY) {

                 Dbprintf("HF 13.56MHz Baseline: %dmV", hf_av);

901 hf_baseline = hf_av;

902 }

903

904 for(;;) {

905 SpinDelay(500);

906 if (BUTTON_PRESS()) {

907 switch (mode) {

908 case 1:

909 mode=2;

910 DbpString("Signal Strength Mode");

911 break;

912 case 2:

913 default:

914 DbpString("Stopped");

915 LEDsoff();

916 return;

917 break;

918 }

919 while (BUTTON_PRESS());

920 }

921 WDT_HIT();

922

923 if (limit != HF_ONLY) {

                         if(mode == 1) {

                                 if (lf_av - lf_baseline > MIN_LF_FIELD)

926 LED_D_ON();

927 else

928 LED_D_OFF();

929 }

930

931 lf_av_new = AvgAdc_Voltage_LF();

932 // see if there's a significant change

                         if (ABS((lf_av - lf_av_new)*100/(lf_av?lf_av:1)) > REPORT_CHANGE_PERCENT) {

                                 Dbprintf("LF 125/134kHz Field Change: %5dmV", lf_av_new);

935 lf_av = lf_av_new;

936 if (lf_av > lf_max)

937 lf_max = lf_av;

938 }

939 }

940

941 if (limit != LF_ONLY) {

                         if (mode == 1){

                                 if (hf_av - hf_baseline > MIN_HF_FIELD)

944 LED_B_ON();

945 else

946 LED_B_OFF();

947 }

948

949 hf_av_new = AvgAdc_Voltage_HF();

950

951 // see if there's a significant change

                         if (ABS((hf_av - hf_av_new)*100/(hf_av?hf_av:1)) > REPORT_CHANGE_PERCENT) {

                                 Dbprintf("HF 13.56MHz Field Change: %5dmV", hf_av_new);

954 hf_av = hf_av_new;

955 if (hf_av > hf_max)

956 hf_max = hf_av;

957 }

958 }

959

                 if(mode == 2) {

961 if (limit == LF_ONLY) {

962 display_val = lf_av;

963 display_max = lf_max;

                         } else if (limit == HF_ONLY) {

965 display_val = hf_av;

966 display_max = hf_max;

967 } else { /* Pick one at random */

                                 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {

969 display_val = hf_av;

970 display_max = hf_max;

971 } else {

972 display_val = lf_av;

973 display_max = lf_max;

974 }

975 }

                         for (i=0; i<LIGHT_LEN; i++) {

                                 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {

                                         if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();

                                         if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();

                                         if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();

                                         if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();

982 break;

983 }

984 }

985 }

986 }

987 }

988

 void UsbPacketReceived(uint8_t *packet, int len)

990 {

991 UsbCommand *c = (UsbCommand *)packet;

992

993 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);

994

995 switch(c->cmd) {

996 #ifdef WITH_LF

997 case CMD_SET_LF_SAMPLING_CONFIG:

                         setSamplingConfig((sample_config *) c->d.asBytes);

999 break;

1000 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:

                         cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);

1002 break;

1003 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:

                         ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);

1005 break;

1006 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:

                         cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);

1008 break;

1009 case CMD_HID_DEMOD_FSK:

                         CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);

1011 break;

1012 case CMD_HID_SIM_TAG:

                         CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);

1014 break;

1015 case CMD_FSK_SIM_TAG:

                         CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1017 break;

1018 case CMD_ASK_SIM_TAG:

                         CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1020 break;

1021 case CMD_PSK_SIM_TAG:

                         CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1023 break;

1024 case CMD_HID_CLONE_TAG:

                         CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x1D);

1026 break;

1027 case CMD_PARADOX_CLONE_TAG:

1028 // Paradox cards are the same as HID, with a different preamble, so we can reuse the same function

                         CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x0F);

1030 break;

1031 case CMD_IO_DEMOD_FSK:

                         CmdIOdemodFSK(c->arg[0], 0, 0, 1);

1033 break;

1034 case CMD_IO_CLONE_TAG:

                         CopyIOtoT55x7(c->arg[0], c->arg[1]);

1036 break;

1037 case CMD_EM410X_DEMOD:

                         CmdEM410xdemod(c->arg[0], 0, 0, 1);

1039 break;

1040 case CMD_EM410X_WRITE_TAG:

                         WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);

1042 break;

1043 case CMD_READ_TI_TYPE:

1044 ReadTItag();

1045 break;

1046 case CMD_WRITE_TI_TYPE:

                         WriteTItag(c->arg[0],c->arg[1],c->arg[2]);

1048 break;

1049 case CMD_SIMULATE_TAG_125K:

1050 LED_A_ON();

                         SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);

1052 LED_A_OFF();

1053 break;

1054 case CMD_LF_SIMULATE_BIDIR:

                         SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);

1056 break;

1057 case CMD_INDALA_CLONE_TAG:

                         CopyIndala64toT55x7(c->arg[0], c->arg[1]);                                      

1059 break;

1060 case CMD_INDALA_CLONE_TAG_L:

                         CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);

1062 break;

1063 case CMD_T55XX_READ_BLOCK:

                         T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);

1065 break;

1066 case CMD_T55XX_WRITE_BLOCK:

                         T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);

1068 break;

1069 case CMD_T55XX_WAKEUP:

                         T55xxWakeUp(c->arg[0]);

1071 break;

1072 case CMD_T55XX_RESET_READ:

1073 T55xxResetRead();

1074 break;

1075 case CMD_PCF7931_READ:

1076 ReadPCF7931();

1077 break;

1078 case CMD_PCF7931_WRITE:

                         WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);

1080 break;

1081 case CMD_PCF7931_BRUTEFORCE:

                         BruteForcePCF7931(c->arg[0], (c->arg[1] & 0xFF), c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128);

1083 break;

1084 case CMD_EM4X_READ_WORD:

                         EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);

1086 break;

1087 case CMD_EM4X_WRITE_WORD:

                         EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);

1089 break;

1090 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation

                         CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);

1092 break;

1093 case CMD_VIKING_CLONE_TAG:

                         CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);

1095 break;

1096 case CMD_COTAG:

                         Cotag(c->arg[0]);

1098 break;

1099 #endif

1100

1101 #ifdef WITH_HITAG

1102 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type

                         SnoopHitag(c->arg[0]);

1104 break;

1105 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content

                         SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);

1107 break;

1108 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function

                         ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);

1110 break;

1111 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content

                         SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);

1113 break;

1114 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file

                         check_challenges_cmd((bool)c->arg[0], (byte_t*)c->d.asBytes, (uint8_t)c->arg[1]);

1116 break;

1117 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge

                         ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], false);

1119 break;

1120 case CMD_READ_HITAG_S_BLK:

                         ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], true);

1122 break;

1123 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge

                         if ((hitag_function)c->arg[0] < 10) {

                                 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);

1126 }

                         else if ((hitag_function)c->arg[0] >= 10) {

                           WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);

1129 }

1130 break;

1131 #endif

1132

1133 #ifdef WITH_ISO15693

1134 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:

1135 AcquireRawAdcSamplesIso15693();

1136 break;

1137

1138 case CMD_SNOOP_ISO_15693:

1139 SnoopIso15693();

1140 break;

1141

1142 case CMD_ISO_15693_COMMAND:

                         DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);

1144 break;

1145

1146 case CMD_ISO_15693_FIND_AFI:

                         BruteforceIso15693Afi(c->arg[0]);

1148 break;

1149

1150 case CMD_ISO_15693_DEBUG:

                         SetDebugIso15693(c->arg[0]);

1152 break;

1153

1154 case CMD_READER_ISO_15693:

                         ReaderIso15693(c->arg[0]);

1156 break;

1157 case CMD_SIMTAG_ISO_15693:

                         SimTagIso15693(c->arg[0], c->d.asBytes);

1159 break;

1160 #endif

1161

1162 #ifdef WITH_LEGICRF

1163 case CMD_SIMULATE_TAG_LEGIC_RF:

                         LegicRfSimulate(c->arg[0]);

1165 break;

1166

1167 case CMD_WRITER_LEGIC_RF:

                         LegicRfWriter(c->arg[1], c->arg[0]);

1169 break;

1170

1171 case CMD_READER_LEGIC_RF:

                         LegicRfReader(c->arg[0], c->arg[1]);

1173 break;

1174 #endif

1175

1176 #ifdef WITH_ISO14443b

1177 case CMD_READ_SRI512_TAG:

1178 ReadSTMemoryIso14443b(0x0F);

1179 break;

1180 case CMD_READ_SRIX4K_TAG:

1181 ReadSTMemoryIso14443b(0x7F);

1182 break;

1183 case CMD_SNOOP_ISO_14443B:

1184 SnoopIso14443b();

1185 break;

1186 case CMD_SIMULATE_TAG_ISO_14443B:

1187 SimulateIso14443bTag();

1188 break;

1189 case CMD_ISO_14443B_COMMAND:

                         SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);

1191 break;

1192 #endif

1193

1194 #ifdef WITH_ISO14443a

1195 case CMD_SNOOP_ISO_14443a:

                         SnoopIso14443a(c->arg[0]);

1197 break;

1198 case CMD_READER_ISO_14443a:

1199 ReaderIso14443a(c);

1200 break;

1201 case CMD_SIMULATE_TAG_ISO_14443a:

                         SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);  // ## Simulate iso14443a tag - pass tag type & UID

1203 break;

1204

1205 case CMD_EPA_PACE_COLLECT_NONCE:

1206 EPA_PACE_Collect_Nonce(c);

1207 break;

1208 case CMD_EPA_PACE_REPLAY:

1209 EPA_PACE_Replay(c);

1210 break;

1211

1212 case CMD_READER_MIFARE:

                         ReaderMifare(c->arg[0]);

1214 break;

1215 case CMD_MIFARE_READBL:

                         MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1217 break;

1218 case CMD_MIFAREU_READBL:

                         MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);

1220 break;

1221 case CMD_MIFAREUC_AUTH:

                         MifareUC_Auth(c->arg[0],c->d.asBytes);

1223 break;

1224 case CMD_MIFAREU_READCARD:

                         MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1226 break;

1227 case CMD_MIFAREUC_SETPWD:

                         MifareUSetPwd(c->arg[0], c->d.asBytes);

1229 break;

1230 case CMD_MIFARE_READSC:

                         MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1232 break;

1233 case CMD_MIFARE_WRITEBL:

                         MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1235 break;

1236 //case CMD_MIFAREU_WRITEBL_COMPAT:

1237 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);

1238 //break;

1239 case CMD_MIFAREU_WRITEBL:

                         MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);

1241 break;

1242 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:

                         MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1244 break;

1245 case CMD_MIFARE_NESTED:

                         MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1247 break;

1248 case CMD_MIFARE_CHKKEYS:

                         MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1250 break;

1251 case CMD_SIMULATE_MIFARE_CARD:

                         Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1253 break;

1254

1255 // emulator

1256 case CMD_MIFARE_SET_DBGMODE:

                         MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1258 break;

1259 case CMD_MIFARE_EML_MEMCLR:

                         MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1261 break;

1262 case CMD_MIFARE_EML_MEMSET:

                         MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1264 break;

1265 case CMD_MIFARE_EML_MEMGET:

                         MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1267 break;

1268 case CMD_MIFARE_EML_CARDLOAD:

                         MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1270 break;

1271

1272 // Work with "magic Chinese" card

1273 case CMD_MIFARE_CWIPE:

                         MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1275 break;

1276 case CMD_MIFARE_CSETBLOCK:

                         MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1278 break;

1279 case CMD_MIFARE_CGETBLOCK:

                         MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1281 break;

1282 case CMD_MIFARE_CIDENT:

1283 MifareCIdent();

1284 break;

1285

1286 // mifare sniffer

1287 case CMD_MIFARE_SNIFFER:

                         SniffMifare(c->arg[0]);

1289 break;

1290

1291 #endif

1292

1293 #ifdef WITH_ICLASS

1294 // Makes use of ISO14443a FPGA Firmware

1295 case CMD_SNOOP_ICLASS:

1296 SnoopIClass();

1297 break;

1298 case CMD_SIMULATE_TAG_ICLASS:

                         SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);

1300 break;

1301 case CMD_READER_ICLASS:

                         ReaderIClass(c->arg[0]);

1303 break;

1304 case CMD_READER_ICLASS_REPLAY:

                         ReaderIClass_Replay(c->arg[0], c->d.asBytes);

1306 break;

1307 case CMD_ICLASS_EML_MEMSET:

                         emlSet(c->d.asBytes,c->arg[0], c->arg[1]);

1309 break;

1310 case CMD_ICLASS_WRITEBLOCK:

                         iClass_WriteBlock(c->arg[0], c->d.asBytes);

1312 break;

1313 case CMD_ICLASS_READCHECK: // auth step 1

                         iClass_ReadCheck(c->arg[0], c->arg[1]);

1315 break;

1316 case CMD_ICLASS_READBLOCK:

                         iClass_ReadBlk(c->arg[0]);

1318 break;

1319 case CMD_ICLASS_AUTHENTICATION: //check

                         iClass_Authentication(c->d.asBytes);

1321 break;

1322 case CMD_ICLASS_DUMP:

                         iClass_Dump(c->arg[0], c->arg[1]);

1324 break;

1325 case CMD_ICLASS_CLONE:

                         iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);

1327 break;

1328 #endif

1329

1330 #ifdef WITH_HFSNOOP

1331 case CMD_HF_SNIFFER:

                         HfSnoop(c->arg[0], c->arg[1]);

1333 break;

1334 case CMD_HF_PLOT:

1335 HfPlot();

1336 break;

1337 #endif

1338

1339 #ifdef WITH_SMARTCARD

1340 case CMD_SMART_ATR: {

1341 SmartCardAtr();

1342 break;

1343 }

1344 case CMD_SMART_SETCLOCK:{

                         SmartCardSetClock(c->arg[0]);

1346 break;

1347 }

1348 case CMD_SMART_RAW: {

                         SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);

1350 break;

1351 }

1352 case CMD_SMART_UPLOAD: {

1353 // upload file from client

                         uint8_t *mem = BigBuf_get_addr();

                         memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);

                         cmd_send(CMD_ACK,1,0,0,0,0);

1357 break;

1358 }

1359 case CMD_SMART_UPGRADE: {

                         SmartCardUpgrade(c->arg[0]);

1361 break;

1362 }

1363 #endif

1364

1365 case CMD_BUFF_CLEAR:

1366 BigBuf_Clear();

1367 break;

1368

1369 case CMD_MEASURE_ANTENNA_TUNING:

                         MeasureAntennaTuning(c->arg[0]);

1371 break;

1372

1373 case CMD_MEASURE_ANTENNA_TUNING_HF:

1374 MeasureAntennaTuningHf();

1375 break;

1376

1377 case CMD_LISTEN_READER_FIELD:

                         ListenReaderField(c->arg[0]);

1379 break;

1380

1381 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control

1382 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1383 SpinDelay(200);

1384 LED_D_OFF(); // LED D indicates field ON or OFF

1385 break;

1386

1387 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:

1388 LED_B_ON();

                         uint8_t *BigBuf = BigBuf_get_addr();

                         for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {

                                 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);

                                 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);

1393 }

1394 // Trigger a finish downloading signal with an ACK frame

                         cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));

1396 LED_B_OFF();

1397 break;

1398

1399 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {

1400 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.

1401 // to be able to use this one for uploading data to device

1402 // arg1 = 0 upload for LF usage

1403 // 1 upload for HF usage

                         if (c->arg[1] == 0)

1405 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);

1406 else

1407 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1408

                         uint8_t *b = BigBuf_get_addr();

                         memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);

                         cmd_send(CMD_ACK,0,0,0,0,0);

1412 break;

1413 }

1414 case CMD_READ_MEM:

                         ReadMem(c->arg[0]);

1416 break;

1417

1418 case CMD_SET_LF_DIVISOR:

1419 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);

                         FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);

1421 break;

1422

1423 case CMD_SET_ADC_MUX:

                         switch(c->arg[0]) {

                                 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;

                                 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;

                                 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;

                                 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;

1429 }

1430 break;

1431

1432 case CMD_VERSION:

1433 SendVersion();

1434 break;

1435 case CMD_STATUS:

1436 SendStatus();

1437 break;

1438 case CMD_PING:

                         cmd_send(CMD_ACK,0,0,0,0,0);

1440 break;

1441 #ifdef WITH_LCD

1442 case CMD_LCD_RESET:

1443 LCDReset();

1444 break;

1445 case CMD_LCD:

                         LCDSend(c->arg[0]);

1447 break;

1448 #endif

1449 case CMD_SETUP_WRITE:

1450 case CMD_FINISH_WRITE:

1451 case CMD_HARDWARE_RESET:

1452 usb_disable();

1453 SpinDelay(1000);

1454 SpinDelay(1000);

1455 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;

1456 for(;;) {

1457 // We're going to reset, and the bootrom will take control.

1458 }

1459 break;

1460

1461 case CMD_START_FLASH:

                         if(common_area.flags.bootrom_present) {

1463 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;

1464 }

1465 usb_disable();

1466 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;

1467 for(;;);

1468 break;

1469

1470 case CMD_DEVICE_INFO: {

1471 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;

                         if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;

                         cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);     

1474 break;

1475 }

1476 default:

                         Dbprintf("%s: 0x%04x","unknown command:",c->cmd);

1478 break;

1479 }

1480 }

1481

 void  __attribute__((noreturn)) AppMain(void)

1483 {

1484 SpinDelay(100);

1485 clear_trace();

         if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {

1487 /* Initialize common area */

                 memset(&common_area, 0, sizeof(common_area));

1489 common_area.magic = COMMON_AREA_MAGIC;

1490 common_area.version = 1;

1491 }

         common_area.flags.osimage_present = 1;

1493

1494 LEDsoff();

1495

1496 // Init USB device

1497 usb_enable();

1498

1499 // The FPGA gets its clock from us from PCK0 output, so set that up.

1500 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;

1501 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;

1502 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;

1503 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz

         AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |

1505 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0

1506 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;

1507

1508 // Reset SPI

1509 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;

1510 // Reset SSC

1511 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;

1512

1513 // Load the FPGA image, which we have stored in our flash.

1514 // (the HF version by default)

1515 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1516

1517 StartTickCount();

1518

1519 #ifdef WITH_LCD

1520 LCDInit();

1521 #endif

1522

1523 byte_t rx[sizeof(UsbCommand)];

1524 size_t rx_len;

1525

1526 for(;;) {

1527 if (usb_poll()) {

       rx_len = usb_read(rx,sizeof(UsbCommand));

1529 if (rx_len) {

1530 UsbPacketReceived(rx,rx_len);

1531 }

1532 }

1533 WDT_HIT();

1534

1535 #ifdef WITH_LF_StandAlone

1536 #ifndef WITH_ISO14443a_StandAlone

                 if (BUTTON_HELD(1000) > 0)

1538 SamyRun();

1539 #endif

1540 #endif

1541 #ifdef WITH_ISO14443a

1542 #ifdef WITH_ISO14443a_StandAlone

                 if (BUTTON_HELD(1000) > 0)

1544 StandAloneMode14a();

1545 #endif

1546 #endif

1547 }

1548 }