#include <proxmark3.h>
+#include <stdlib.h>
#include "apps.h"
#ifdef WITH_LCD
#include "fonts.h"
// The large multi-purpose buffer, typically used to hold A/D samples,
// maybe pre-processed in some way.
DWORD BigBuf[16000];
+int usbattached = 0;
//=============================================================================
// A buffer where we can queue things up to be sent through the FPGA, for
void DbpString(char *str)
{
+ /* this holds up stuff unless we're connected to usb */
+// if (!usbattached)
+// return;
+
UsbCommand c;
c.cmd = CMD_DEBUG_PRINT_STRING;
c.ext1 = strlen(str);
void DbpIntegers(int x1, int x2, int x3)
{
+ /* this holds up stuff unless we're connected to usb */
+// if (!usbattached)
+// return;
+
UsbCommand c;
c.cmd = CMD_DEBUG_PRINT_INTEGERS;
c.ext1 = x1;
BOOL at134khz;
// see if 'h' was specified
- if(command[strlen(command) - 1] == 'h')
+ if(command[strlen((char *) command) - 1] == 'h')
at134khz= TRUE;
else
at134khz= FALSE;
void SweepLFrange()
{
BYTE *dest = (BYTE *)BigBuf;
- int i;
+ char dummy[12];
+ int i, peak= 0, ptr= 0;
+ double freq;
// clear buffer
memset(BigBuf,0,sizeof(BigBuf));
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
SpinDelay(20);
dest[i] = (137500 * AvgAdc(ADC_CHAN_LF)) >> 18;
+ if(dest[i] > peak) {
+ peak= dest[i];
+ ptr= i;
+ }
}
+ dummy[11]= '\0';
+ dummy[10]= 'z';
+ dummy[9]= 'H';
+ dummy[8]= 'k';
+ dummy[7]= ' ';
+ freq= 12000000/(ptr + 1);
+ for(i= 6; i > 3 ; --i) {
+ dummy[i]= '0' + ((int) freq) % 10;
+ freq /= 10;
+ }
+ dummy[3]= '.';
+ for(i= 2; i >= 0 ; --i) {
+ dummy[i]= '0' + ((int) freq) % 10;
+ freq /= 10;
+ }
+ DbpString("Antenna resonates at:");
+ DbpString(dummy);
}
void MeasureAntennaTuning(void)
UsbSendPacket((BYTE *)&c, sizeof(c));
}
-void SimulateTagLowFrequency(int period)
+void SimulateTagLowFrequency(int period, int ledcontrol)
{
int i;
BYTE *tab = (BYTE *)BigBuf;
for(;;) {
while(!(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK))) {
if(BUTTON_PRESS()) {
+ DbpString("Stopped");
return;
}
WDT_HIT();
}
- LED_D_ON();
- if(tab[i]) {
+ if (ledcontrol)
+ LED_D_ON();
+
+ if(tab[i])
OPEN_COIL();
- } else {
+ else
SHORT_COIL();
- }
- LED_D_OFF();
+
+ if (ledcontrol)
+ LED_D_OFF();
while(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK)) {
if(BUTTON_PRESS()) {
+ DbpString("Stopped");
return;
}
WDT_HIT();
// prepare a waveform pattern in the buffer based on the ID given then
// simulate a HID tag until the button is pressed
-static void CmdHIDsimTAG(int hi, int lo)
+static void CmdHIDsimTAG(int hi, int lo, int ledcontrol)
{
int n=0, i=0;
/*
}
}
- LED_A_ON();
- SimulateTagLowFrequency(n);
- LED_A_OFF();
+ if (ledcontrol)
+ LED_A_ON();
+ SimulateTagLowFrequency(n, ledcontrol);
+
+ if (ledcontrol)
+ LED_A_OFF();
}
// loop to capture raw HID waveform then FSK demodulate the TAG ID from it
-static void CmdHIDdemodFSK(void)
+static void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
{
BYTE *dest = (BYTE *)BigBuf;
int m=0, n=0, i=0, idx=0, found=0, lastval=0;
for(;;) {
WDT_HIT();
- LED_A_ON();
+ if (ledcontrol)
+ LED_A_ON();
if(BUTTON_PRESS()) {
- LED_A_OFF();
+ DbpString("Stopped");
+ if (ledcontrol)
+ LED_A_OFF();
return;
}
for(;;) {
if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
SSC_TRANSMIT_HOLDING = 0x43;
- LED_D_ON();
+ if (ledcontrol)
+ LED_D_ON();
}
if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
// threshold essentially we capture zero crossings for later analysis
if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
i++;
- LED_D_OFF();
+ if (ledcontrol)
+ LED_D_OFF();
if(i >= m) {
break;
}
if (found && (hi|lo)) {
DbpString("TAG ID");
DbpIntegers(hi, lo, (lo>>1)&0xffff);
+ /* if we're only looking for one tag */
+ if (findone)
+ {
+ *high = hi;
+ *low = lo;
+ return;
+ }
hi=0;
lo=0;
found=0;
if (found && (hi|lo)) {
DbpString("TAG ID");
DbpIntegers(hi, lo, (lo>>1)&0xffff);
+ /* if we're only looking for one tag */
+ if (findone)
+ {
+ *high = hi;
+ *low = lo;
+ return;
+ }
hi=0;
lo=0;
found=0;
MeasureAntennaTuning();
break;
+ case CMD_LISTEN_READER_FIELD:
+ ListenReaderField(c->ext1);
+ break;
+
case CMD_HID_DEMOD_FSK:
- CmdHIDdemodFSK(); // Demodulate HID tag
+ CmdHIDdemodFSK(0, 0, 0, 1); // Demodulate HID tag
break;
case CMD_HID_SIM_TAG:
- CmdHIDsimTAG(c->ext1, c->ext2); // Simulate HID tag by ID
+ CmdHIDsimTAG(c->ext1, c->ext2, 1); // Simulate HID tag by ID
break;
case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
}
case CMD_SIMULATE_TAG_125K:
LED_A_ON();
- SimulateTagLowFrequency(c->ext1);
+ SimulateTagLowFrequency(c->ext1, 1);
LED_A_OFF();
break;
#ifdef WITH_LCD
LCDReset();
break;
#endif
+ case CMD_READ_MEM:
+ ReadMem(c->ext1);
+ break;
case CMD_SWEEP_LF:
SweepLFrange();
break;
}
}
+void ReadMem(int addr)
+{
+ const DWORD *data = ((DWORD *)addr);
+ int i;
+
+ DbpString("Reading memory at address");
+ DbpIntegers(0, 0, addr);
+ for (i = 0; i < 8; i+= 2)
+ DbpIntegers(0, data[i], data[i+1]);
+}
+
void AppMain(void)
{
memset(BigBuf,0,sizeof(BigBuf));
#endif
for(;;) {
- UsbPoll(FALSE);
+ usbattached = UsbPoll(FALSE);
WDT_HIT();
+
+ if (BUTTON_HELD(1000) > 0)
+ SamyRun();
}
}
-void SpinDelayUs(int us)
-{
- int ticks = (48*us) >> 10;
- // Borrow a PWM unit for my real-time clock
- PWM_ENABLE = PWM_CHANNEL(0);
- // 48 MHz / 1024 gives 46.875 kHz
- PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10);
- PWM_CH_DUTY_CYCLE(0) = 0;
- PWM_CH_PERIOD(0) = 0xffff;
+// samy's sniff and repeat routine
+void SamyRun()
+{
+ DbpString("Stand-alone mode! No PC necessary.");
- WORD start = (WORD)PWM_CH_COUNTER(0);
+ // 3 possible options? no just 2 for now
+#define OPTS 2
- for(;;) {
- WORD now = (WORD)PWM_CH_COUNTER(0);
- if(now == (WORD)(start + ticks)) {
- return;
- }
+ int high[OPTS], low[OPTS];
+
+ // Oooh pretty -- notify user we're in elite samy mode now
+ LED(LED_RED, 200);
+ LED(LED_ORANGE, 200);
+ LED(LED_GREEN, 200);
+ LED(LED_ORANGE, 200);
+ LED(LED_RED, 200);
+ LED(LED_ORANGE, 200);
+ LED(LED_GREEN, 200);
+ LED(LED_ORANGE, 200);
+ LED(LED_RED, 200);
+
+ int selected = 0;
+ int playing = 0;
+
+ // Turn on selected LED
+ LED(selected + 1, 0);
+
+ for (;;)
+ {
+ usbattached = UsbPoll(FALSE);
WDT_HIT();
+
+ // Was our button held down or pressed?
+ int button_pressed = BUTTON_HELD(1000);
+ SpinDelay(300);
+
+ // Button was held for a second, begin recording
+ if (button_pressed > 0)
+ {
+ LEDsoff();
+ LED(selected + 1, 0);
+ LED(LED_RED2, 0);
+
+ // record
+ DbpString("Starting recording");
+
+ /* need this delay to prevent catching some weird data */
+ SpinDelay(500);
+ CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
+ DbpString("Recorded");
+ DbpIntegers(selected, high[selected], low[selected]);
+
+ LEDsoff();
+ LED(selected + 1, 0);
+ // Finished recording
+
+ // If we were previously playing, set playing off
+ // so next button push begins playing what we recorded
+ playing = 0;
+ }
+
+ // Change where to record (or begin playing)
+ else if (button_pressed)
+ {
+ // Next option if we were previously playing
+ if (playing)
+ selected = (selected + 1) % OPTS;
+ playing = !playing;
+
+ LEDsoff();
+ LED(selected + 1, 0);
+
+ // Begin transmitting
+ if (playing)
+ {
+ LED(LED_GREEN, 0);
+ DbpString("Playing");
+ DbpIntegers(selected, high[selected], low[selected]);
+ CmdHIDsimTAG(high[selected], low[selected], 0);
+ DbpString("Done playing");
+
+ /* We pressed a button so ignore it here with a delay */
+ SpinDelay(300);
+
+ // when done, we're done playing, move to next option
+ selected = (selected + 1) % OPTS;
+ playing = !playing;
+ LEDsoff();
+ LED(selected + 1, 0);
+ }
+ }
}
}
-void SpinDelay(int ms)
+
+// listen for external reader
+void ListenReaderField(int limit)
{
- int ticks = (48000*ms) >> 10;
+ int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0;
+ int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0;
- // Borrow a PWM unit for my real-time clock
- PWM_ENABLE = PWM_CHANNEL(0);
- // 48 MHz / 1024 gives 46.875 kHz
- PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10);
- PWM_CH_DUTY_CYCLE(0) = 0;
- PWM_CH_PERIOD(0) = 0xffff;
+#define LF_ONLY 1
+#define HF_ONLY 2
- WORD start = (WORD)PWM_CH_COUNTER(0);
+ LED_A_OFF();
+ LED_B_OFF();
+ LED_C_OFF();
+ LED_D_OFF();
- for(;;) {
- WORD now = (WORD)PWM_CH_COUNTER(0);
- if(now == (WORD)(start + ticks)) {
- return;
+ lf_av= ReadAdc(ADC_CHAN_LF);
+
+ if(limit != HF_ONLY)
+ {
+ DbpString("LF 125/134 Baseline:");
+ DbpIntegers(lf_av,0,0);
+ lf_baseline= lf_av;
+ }
+
+ hf_av= ReadAdc(ADC_CHAN_HF);
+
+
+ if (limit != LF_ONLY)
+ {
+ DbpString("HF 13.56 Baseline:");
+ DbpIntegers(hf_av,0,0);
+ hf_baseline= hf_av;
}
+
+ for(;;)
+ {
+ if(BUTTON_PRESS())
+ {
+ DbpString("Stopped");
+ LED_B_OFF();
+ LED_D_OFF();
+ return;
+ }
WDT_HIT();
- }
+
+
+ if (limit != HF_ONLY)
+ {
+ if (abs(lf_av - lf_baseline) > 10)
+ LED_D_ON();
+ else
+ LED_D_OFF();
+ ++lf_count;
+ lf_av_new= ReadAdc(ADC_CHAN_LF);
+ // see if there's a significant change
+ if(abs(lf_av - lf_av_new) > 10)
+ {
+ DbpString("LF 125/134 Field Change:");
+ DbpIntegers(lf_av,lf_av_new,lf_count);
+ lf_av= lf_av_new;
+ lf_count= 0;
+ }
+ }
+
+ if (limit != LF_ONLY)
+ {
+ if (abs(hf_av - hf_baseline) > 10)
+ LED_B_ON();
+ else
+ LED_B_OFF();
+ ++hf_count;
+ hf_av_new= ReadAdc(ADC_CHAN_HF);
+ // see if there's a significant change
+ if(abs(hf_av - hf_av_new) > 10)
+ {
+ DbpString("HF 13.56 Field Change:");
+ DbpIntegers(hf_av,hf_av_new,hf_count);
+ hf_av= hf_av_new;
+ hf_count= 0;
+ }
+ }
+ }
}
projects / proxmark3-svn / blobdiff