]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
Merge branch 'master' into master
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
b8e461ff 13#include <stdarg.h>
14
902cb3c0 15#include "usb_cdc.h"
16#include "cmd.h"
e30c654b 17#include "proxmark3.h"
15c4dc5a 18#include "apps.h"
472345da 19#include "fpga.h"
f7e3ed82 20#include "util.h"
9ab7a6c7 21#include "printf.h"
22#include "string.h"
15c4dc5a 23#include "legicrf.h"
1b902aa0 24#include "legicrfsim.h"
b8e461ff 25#include "hitag2.h"
26#include "hitagS.h"
31abe49f 27#include "lfsampling.h"
3000dc4e 28#include "BigBuf.h"
c89274cc 29#include "mifareutil.h"
d10e08ae 30#include "pcf7931.h"
15c4dc5a 31#ifdef WITH_LCD
902cb3c0 32 #include "LCD.h"
15c4dc5a 33#endif
43591e64 34#ifdef WITH_SMARTCARD
35 #include "i2c.h"
36#endif
37
15c4dc5a 38
e46fe044 39// Craig Young - 14a stand-alone code
854fdf15 40#ifdef WITH_ISO14443a
e46fe044
CY
41 #include "iso14443a.h"
42#endif
43
15c4dc5a 44//=============================================================================
45// A buffer where we can queue things up to be sent through the FPGA, for
46// any purpose (fake tag, as reader, whatever). We go MSB first, since that
47// is the order in which they go out on the wire.
48//=============================================================================
49
6a1f2d82 50#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
51uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 52int ToSendMax;
53static int ToSendBit;
54struct common_area common_area __attribute__((section(".commonarea")));
55
15c4dc5a 56void ToSendReset(void)
57{
58 ToSendMax = -1;
59 ToSendBit = 8;
60}
61
62void ToSendStuffBit(int b)
63{
64 if(ToSendBit >= 8) {
65 ToSendMax++;
66 ToSend[ToSendMax] = 0;
67 ToSendBit = 0;
68 }
69
70 if(b) {
71 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
72 }
73
74 ToSendBit++;
75
6a1f2d82 76 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 77 ToSendBit = 0;
78 DbpString("ToSendStuffBit overflowed!");
79 }
80}
81
82//=============================================================================
83// Debug print functions, to go out over USB, to the usual PC-side client.
84//=============================================================================
85
86void DbpString(char *str)
87{
9440213d 88 byte_t len = strlen(str);
89 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 90}
91
92#if 0
93void DbpIntegers(int x1, int x2, int x3)
94{
902cb3c0 95 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 96}
97#endif
98
99void Dbprintf(const char *fmt, ...) {
100// should probably limit size here; oh well, let's just use a big buffer
101 char output_string[128];
102 va_list ap;
103
104 va_start(ap, fmt);
105 kvsprintf(fmt, output_string, 10, ap);
106 va_end(ap);
e30c654b 107
15c4dc5a 108 DbpString(output_string);
109}
110
9455b51c 111// prints HEX & ASCII
d19929cb 112void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 113 int l=0,i;
114 char ascii[9];
d19929cb 115
9455b51c 116 while (len>0) {
117 if (len>8) l=8;
118 else l=len;
119
120 memcpy(ascii,d,l);
d19929cb 121 ascii[l]=0;
9455b51c 122
123 // filter safe ascii
d19929cb 124 for (i=0;i<l;i++)
9455b51c 125 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 126
127 if (bAsci) {
128 Dbprintf("%-8s %*D",ascii,l,d," ");
129 } else {
130 Dbprintf("%*D",l,d," ");
131 }
132
9455b51c 133 len-=8;
134 d+=8;
135 }
136}
137
15c4dc5a 138//-----------------------------------------------------------------------------
139// Read an ADC channel and block till it completes, then return the result
140// in ADC units (0 to 1023). Also a routine to average 32 samples and
141// return that.
142//-----------------------------------------------------------------------------
143static int ReadAdc(int ch)
2d51da38 144{
3b692427 145 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
9b32625c 146 // AMPL_HI is are high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
147 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
3b692427 148 //
149 // The maths are:
150 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
151 //
9b32625c 152 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
15c4dc5a 153
2d51da38
I
154 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
155 AT91C_BASE_ADC->ADC_MR =
9b32625c 156 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
157 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
158 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
3b692427 159
2d51da38
I
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
15c4dc5a 162
2d51da38
I
163 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
164
165 return AT91C_BASE_ADC->ADC_CDR[ch];
15c4dc5a 166}
167
9ca155ba 168int AvgAdc(int ch) // was static - merlok
15c4dc5a 169{
170 int i;
171 int a = 0;
172
173 for(i = 0; i < 32; i++) {
174 a += ReadAdc(ch);
175 }
176
177 return (a + 15) >> 5;
178}
179
fdcfbdcc 180void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
15c4dc5a 181{
9b32625c 182 int i, adcval = 0, peak = 0;
15c4dc5a 183
184/*
185 * Sweeps the useful LF range of the proxmark from
186 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
187 * read the voltage in the antenna, the result left
188 * in the buffer is a graph which should clearly show
189 * the resonating frequency of your LF antenna
190 * ( hopefully around 95 if it is tuned to 125kHz!)
191 */
fdcfbdcc
RAB
192
193 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 194 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2d51da38
I
195 SpinDelay(50);
196
2bdd68c3 197 for (i=255; i>=19; i--) {
fdcfbdcc 198 WDT_HIT();
15c4dc5a 199 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
200 SpinDelay(20);
3b692427 201 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
fdcfbdcc
RAB
202 if (i==95) *vLf125 = adcval; // voltage at 125Khz
203 if (i==89) *vLf134 = adcval; // voltage at 134Khz
15c4dc5a 204
2d51da38 205 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
2bdd68c3 206 if(LF_Results[i] > peak) {
fdcfbdcc 207 *peakv = adcval;
2bdd68c3 208 peak = LF_Results[i];
fdcfbdcc 209 *peakf = i;
9f693930 210 //ptr = i;
15c4dc5a 211 }
212 }
213
2bdd68c3 214 for (i=18; i >= 0; i--) LF_Results[i] = 0;
fdcfbdcc
RAB
215
216 return;
217}
218
219void MeasureAntennaTuningHfOnly(int *vHf)
220{
15c4dc5a 221 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
fdcfbdcc
RAB
222 LED_A_ON();
223 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 224 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
225 SpinDelay(20);
fdcfbdcc
RAB
226 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
227 LED_A_OFF();
228
229 return;
230}
231
232void MeasureAntennaTuning(int mode)
233{
234 uint8_t LF_Results[256] = {0};
235 int peakv = 0, peakf = 0;
236 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
237
238 LED_B_ON();
239
240 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
241 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
242 MeasureAntennaTuningHfOnly(&vHf);
243 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
244 } else {
245 if (mode & FLAG_TUNE_LF) {
246 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
247 }
248 if (mode & FLAG_TUNE_HF) {
249 MeasureAntennaTuningHfOnly(&vHf);
250 }
251 }
15c4dc5a 252
d040cb90 253 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
d19929cb 254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 255 LED_B_OFF();
256 return;
15c4dc5a 257}
258
259void MeasureAntennaTuningHf(void)
260{
261 int vHf = 0; // in mV
262
263 DbpString("Measuring HF antenna, press button to exit");
264
3b692427 265 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
266 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
268
15c4dc5a 269 for (;;) {
15c4dc5a 270 SpinDelay(20);
3b692427 271 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 272
15c4dc5a 273 Dbprintf("%d mV",vHf);
274 if (BUTTON_PRESS()) break;
275 }
276 DbpString("cancelled");
3b692427 277
278 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
279
15c4dc5a 280}
281
282
15c4dc5a 283void ReadMem(int addr)
284{
f7e3ed82 285 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 286
287 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
288 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
289}
290
291/* osimage version information is linked in */
292extern struct version_information version_information;
293/* bootrom version information is pointed to from _bootphase1_version_pointer */
0fa01ec7 294extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
472345da 295
15c4dc5a 296void SendVersion(void)
297{
8e074056 298 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
299 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
e30c654b 300
301 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 302 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
303 * pointer, then use it.
304 */
305 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
306 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
8e074056 307 strcat(VersionString, "bootrom version information appears invalid\n");
15c4dc5a 308 } else {
309 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
8e074056 310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
15c4dc5a 311 }
e30c654b 312
15c4dc5a 313 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
8e074056 314 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
e30c654b 315
472345da 316 for (int i = 0; i < fpga_bitstream_num; i++) {
317 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
318 if (i < fpga_bitstream_num - 1) {
319 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
320 }
321 }
0fa01ec7 322
e6153040 323 // Send Chip ID and used flash memory
0fa01ec7 324 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
325 uint32_t compressed_data_section_size = common_area.arg1;
8e074056 326 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
15c4dc5a 327}
328
bfb01844 329// measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
330// Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
67b7d6fa 331void printUSBSpeed(void)
bfb01844 332{
333 Dbprintf("USB Speed:");
67b7d6fa 334 Dbprintf(" Sending USB packets to client...");
bfb01844 335
67b7d6fa 336 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
bfb01844 337 uint8_t *test_data = BigBuf_get_addr();
67b7d6fa 338 uint32_t end_time;
bfb01844 339
67b7d6fa 340 uint32_t start_time = end_time = GetTickCount();
341 uint32_t bytes_transferred = 0;
342
bfb01844 343 LED_B_ON();
67b7d6fa 344 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
345 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
346 end_time = GetTickCount();
347 bytes_transferred += USB_CMD_DATA_SIZE;
bfb01844 348 }
349 LED_B_OFF();
350
67b7d6fa 351 Dbprintf(" Time elapsed: %dms", end_time - start_time);
352 Dbprintf(" Bytes transferred: %d", bytes_transferred);
353 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
354 1000 * bytes_transferred / (end_time - start_time));
bfb01844 355
356}
357
c89274cc
CY
358/**
359 * Prints runtime information about the PM3.
360**/
67b7d6fa 361void SendStatus(void)
c89274cc
CY
362{
363 BigBuf_print_status();
364 Fpga_print_status();
43591e64 365#ifdef WITH_SMARTCARD
366 I2C_print_status();
367#endif
c89274cc 368 printConfig(); //LF Sampling config
67b7d6fa 369 printUSBSpeed();
c89274cc 370 Dbprintf("Various");
43591e64 371 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
372 Dbprintf(" ToSendMax..........%d", ToSendMax);
373 Dbprintf(" ToSendBit..........%d", ToSendBit);
bfb01844 374
375 cmd_send(CMD_ACK,1,0,0,0,0);
c89274cc 376}
15c4dc5a 377
a2937cea 378#if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
15c4dc5a 379
15c4dc5a 380#define OPTS 2
381
86a83668
MHS
382void StandAloneMode()
383{
384 DbpString("Stand-alone mode! No PC necessary.");
15c4dc5a 385 // Oooh pretty -- notify user we're in elite samy mode now
386 LED(LED_RED, 200);
387 LED(LED_ORANGE, 200);
388 LED(LED_GREEN, 200);
389 LED(LED_ORANGE, 200);
390 LED(LED_RED, 200);
391 LED(LED_ORANGE, 200);
392 LED(LED_GREEN, 200);
393 LED(LED_ORANGE, 200);
394 LED(LED_RED, 200);
395
86a83668
MHS
396}
397
398#endif
399
400
401
402#ifdef WITH_ISO14443a_StandAlone
403void StandAloneMode14a()
404{
405 StandAloneMode();
406 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
407
15c4dc5a 408 int selected = 0;
44964fd1 409 bool playing = false, GotoRecord = false, GotoClone = false;
410 bool cardRead[OPTS] = {false};
86a83668
MHS
411 uint8_t readUID[10] = {0};
412 uint32_t uid_1st[OPTS]={0};
413 uint32_t uid_2nd[OPTS]={0};
c89274cc
CY
414 uint32_t uid_tmp1 = 0;
415 uint32_t uid_tmp2 = 0;
416 iso14a_card_select_t hi14a_card[OPTS];
15c4dc5a 417
15c4dc5a 418 LED(selected + 1, 0);
419
420 for (;;)
421 {
6e82300d 422 usb_poll();
86a83668 423 WDT_HIT();
15c4dc5a 424 SpinDelay(300);
425
44964fd1 426 if (GotoRecord || !cardRead[selected])
15c4dc5a 427 {
44964fd1 428 GotoRecord = false;
15c4dc5a 429 LEDsoff();
430 LED(selected + 1, 0);
431 LED(LED_RED2, 0);
432
433 // record
86a83668 434 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
15c4dc5a 435 /* need this delay to prevent catching some weird data */
436 SpinDelay(500);
86a83668
MHS
437 /* Code for reading from 14a tag */
438 uint8_t uid[10] ={0};
439 uint32_t cuid;
440 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
15c4dc5a 441
86a83668
MHS
442 for ( ; ; )
443 {
444 WDT_HIT();
c89274cc
CY
445 if (BUTTON_PRESS()) {
446 if (cardRead[selected]) {
447 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
448 break;
449 }
450 else if (cardRead[(selected+1)%OPTS]) {
451 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
452 selected = (selected+1)%OPTS;
44964fd1 453 break;
c89274cc
CY
454 }
455 else {
456 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
457 SpinDelay(300);
458 }
459 }
c04a4b60 460 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
86a83668
MHS
461 continue;
462 else
463 {
464 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
465 memcpy(readUID,uid,10*sizeof(uint8_t));
c89274cc 466 uint8_t *dst = (uint8_t *)&uid_tmp1;
86a83668
MHS
467 // Set UID byte order
468 for (int i=0; i<4; i++)
469 dst[i] = uid[3-i];
c89274cc 470 dst = (uint8_t *)&uid_tmp2;
86a83668
MHS
471 for (int i=0; i<4; i++)
472 dst[i] = uid[7-i];
c89274cc
CY
473 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
474 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
475 }
476 else {
477 if (uid_tmp2) {
478 Dbprintf("Bank[%d] received a 7-byte UID",selected);
479 uid_1st[selected] = (uid_tmp1)>>8;
480 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
481 }
482 else {
483 Dbprintf("Bank[%d] received a 4-byte UID",selected);
484 uid_1st[selected] = uid_tmp1;
485 uid_2nd[selected] = uid_tmp2;
486 }
487 break;
488 }
86a83668
MHS
489 }
490 }
c89274cc
CY
491 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
492 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
86a83668
MHS
493 LEDsoff();
494 LED(LED_GREEN, 200);
495 LED(LED_ORANGE, 200);
496 LED(LED_GREEN, 200);
497 LED(LED_ORANGE, 200);
15c4dc5a 498
499 LEDsoff();
500 LED(selected + 1, 0);
15c4dc5a 501
c89274cc 502 // Next state is replay:
44964fd1 503 playing = true;
3fe4ff4f 504
44964fd1 505 cardRead[selected] = true;
86a83668 506 }
c89274cc 507 /* MF Classic UID clone */
44964fd1 508 else if (GotoClone)
3fe4ff4f 509 {
44964fd1 510 GotoClone=false;
c89274cc
CY
511 LEDsoff();
512 LED(selected + 1, 0);
513 LED(LED_ORANGE, 250);
3fe4ff4f 514
3fe4ff4f 515
c89274cc
CY
516 // record
517 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
3fe4ff4f 518
c89274cc
CY
519 // wait for button to be released
520 while(BUTTON_PRESS())
521 {
522 // Delay cloning until card is in place
523 WDT_HIT();
524 }
525 Dbprintf("Starting clone. [Bank: %u]", selected);
526 // need this delay to prevent catching some weird data
527 SpinDelay(500);
528 // Begin clone function here:
529 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
530 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
531 memcpy(c.d.asBytes, data, 16);
532 SendCommand(&c);
533
534 Block read is similar:
535 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
536 We need to imitate that call with blockNo 0 to set a uid.
537
538 The get and set commands are handled in this file:
539 // Work with "magic Chinese" card
540 case CMD_MIFARE_CSETBLOCK:
541 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
542 break;
543 case CMD_MIFARE_CGETBLOCK:
544 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545 break;
546
547 mfCSetUID provides example logic for UID set workflow:
548 -Read block0 from card in field with MifareCGetBlock()
549 -Configure new values without replacing reserved bytes
550 memcpy(block0, uid, 4); // Copy UID bytes from byte array
551 // Mifare UID BCC
552 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
553 Bytes 5-7 are reserved SAK and ATQA for mifare classic
554 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
555 */
556 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
557 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
558 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
559 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
560 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
44964fd1 561 playing = true;
c89274cc
CY
562 }
563 else {
564 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
565 memcpy(newBlock0,oldBlock0,16);
566 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
567
568 newBlock0[0] = uid_1st[selected]>>24;
569 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
570 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
571 newBlock0[3] = 0xFF & (uid_1st[selected]);
572 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
573 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
574 MifareCSetBlock(0, 0xFF,0, newBlock0);
575 MifareCGetBlock(0x3F, 1, 0, testBlock0);
576 if (memcmp(testBlock0,newBlock0,16)==0)
577 {
578 DbpString("Cloned successfull!");
44964fd1 579 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
580 playing = false;
581 GotoRecord = true;
c89274cc
CY
582 selected = (selected+1) % OPTS;
583 }
584 else {
585 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
44964fd1 586 playing = true;
c89274cc
CY
587 }
588 }
589 LEDsoff();
590 LED(selected + 1, 0);
15c4dc5a 591
86a83668 592 }
15c4dc5a 593 // Change where to record (or begin playing)
44964fd1 594 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
15c4dc5a 595 {
15c4dc5a 596 LEDsoff();
597 LED(selected + 1, 0);
598
599 // Begin transmitting
44964fd1 600 LED(LED_GREEN, 0);
601 DbpString("Playing");
602 for ( ; ; ) {
603 WDT_HIT();
604 int button_action = BUTTON_HELD(1000);
605 if (button_action == 0) { // No button action, proceed with sim
606 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
607 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
608 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
609 DbpString("Mifare Classic");
610 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
c89274cc 611 }
44964fd1 612 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
613 DbpString("Mifare Ultralight");
614 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
15c4dc5a 615 }
44964fd1 616 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
617 DbpString("Mifare DESFire");
618 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
619 }
620 else {
621 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
622 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
c89274cc 623 }
c89274cc 624 }
44964fd1 625 else if (button_action == BUTTON_SINGLE_CLICK) {
626 selected = (selected + 1) % OPTS;
627 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
628 GotoRecord = true;
629 break;
630 }
631 else if (button_action == BUTTON_HOLD) {
632 Dbprintf("Playtime over. Begin cloning...");
633 GotoClone = true;
634 break;
635 }
636 WDT_HIT();
15c4dc5a 637 }
44964fd1 638
639 /* We pressed a button so ignore it here with a delay */
640 SpinDelay(300);
641 LEDsoff();
642 LED(selected + 1, 0);
15c4dc5a 643 }
644 }
645}
a2937cea 646#elif WITH_LF_StandAlone
86a83668
MHS
647// samy's sniff and repeat routine
648void SamyRun()
e46fe044 649{
86a83668
MHS
650 StandAloneMode();
651 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
e46fe044 652
53e2f2fa 653 int tops[OPTS], high[OPTS], low[OPTS];
15c4dc5a 654 int selected = 0;
655 int playing = 0;
3fe4ff4f 656 int cardRead = 0;
15c4dc5a 657
658 // Turn on selected LED
659 LED(selected + 1, 0);
660
661 for (;;)
662 {
6e82300d 663 usb_poll();
86a83668 664 WDT_HIT();
15c4dc5a 665
666 // Was our button held down or pressed?
667 int button_pressed = BUTTON_HELD(1000);
668 SpinDelay(300);
669
670 // Button was held for a second, begin recording
3fe4ff4f 671 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 672 {
673 LEDsoff();
674 LED(selected + 1, 0);
675 LED(LED_RED2, 0);
676
677 // record
678 DbpString("Starting recording");
679
680 // wait for button to be released
681 while(BUTTON_PRESS())
682 WDT_HIT();
683
684 /* need this delay to prevent catching some weird data */
685 SpinDelay(500);
686
53e2f2fa 687 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
688 if (tops[selected] > 0)
689 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
690 else
691 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
15c4dc5a 692
693 LEDsoff();
694 LED(selected + 1, 0);
695 // Finished recording
696
697 // If we were previously playing, set playing off
698 // so next button push begins playing what we recorded
699 playing = 0;
3fe4ff4f 700
701 cardRead = 1;
702
703 }
704
705 else if (button_pressed > 0 && cardRead == 1)
706 {
707 LEDsoff();
708 LED(selected + 1, 0);
709 LED(LED_ORANGE, 0);
710
711 // record
53e2f2fa 712 if (tops[selected] > 0)
713 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
714 else
715 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
3fe4ff4f 716
717 // wait for button to be released
718 while(BUTTON_PRESS())
719 WDT_HIT();
720
721 /* need this delay to prevent catching some weird data */
722 SpinDelay(500);
723
53e2f2fa 724 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)));
725 if (tops[selected] > 0)
726 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
727 else
728 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
3fe4ff4f 729
730 LEDsoff();
731 LED(selected + 1, 0);
732 // Finished recording
733
734 // If we were previously playing, set playing off
735 // so next button push begins playing what we recorded
736 playing = 0;
737
738 cardRead = 0;
739
15c4dc5a 740 }
741
742 // Change where to record (or begin playing)
743 else if (button_pressed)
744 {
745 // Next option if we were previously playing
746 if (playing)
747 selected = (selected + 1) % OPTS;
748 playing = !playing;
749
750 LEDsoff();
751 LED(selected + 1, 0);
752
753 // Begin transmitting
754 if (playing)
755 {
756 LED(LED_GREEN, 0);
757 DbpString("Playing");
758 // wait for button to be released
759 while(BUTTON_PRESS())
760 WDT_HIT();
53e2f2fa 761 if (tops[selected] > 0)
762 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
763 else
764 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
765
766 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
15c4dc5a 767 DbpString("Done playing");
768 if (BUTTON_HELD(1000) > 0)
769 {
770 DbpString("Exiting");
771 LEDsoff();
772 return;
773 }
774
775 /* We pressed a button so ignore it here with a delay */
776 SpinDelay(300);
777
778 // when done, we're done playing, move to next option
779 selected = (selected + 1) % OPTS;
780 playing = !playing;
781 LEDsoff();
782 LED(selected + 1, 0);
783 }
784 else
785 while(BUTTON_PRESS())
786 WDT_HIT();
787 }
788 }
789}
15c4dc5a 790
e46fe044 791#endif
15c4dc5a 792/*
793OBJECTIVE
794Listen and detect an external reader. Determine the best location
795for the antenna.
796
797INSTRUCTIONS:
798Inside the ListenReaderField() function, there is two mode.
799By default, when you call the function, you will enter mode 1.
800If you press the PM3 button one time, you will enter mode 2.
801If you press the PM3 button a second time, you will exit the function.
802
803DESCRIPTION OF MODE 1:
804This mode just listens for an external reader field and lights up green
805for HF and/or red for LF. This is the original mode of the detectreader
806function.
807
808DESCRIPTION OF MODE 2:
809This mode will visually represent, using the LEDs, the actual strength of the
810current compared to the maximum current detected. Basically, once you know
811what kind of external reader is present, it will help you spot the best location to place
812your antenna. You will probably not get some good results if there is a LF and a HF reader
813at the same place! :-)
814
815LIGHT SCHEME USED:
816*/
817static const char LIGHT_SCHEME[] = {
818 0x0, /* ---- | No field detected */
819 0x1, /* X--- | 14% of maximum current detected */
820 0x2, /* -X-- | 29% of maximum current detected */
821 0x4, /* --X- | 43% of maximum current detected */
822 0x8, /* ---X | 57% of maximum current detected */
823 0xC, /* --XX | 71% of maximum current detected */
824 0xE, /* -XXX | 86% of maximum current detected */
825 0xF, /* XXXX | 100% of maximum current detected */
826};
827static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
828
829void ListenReaderField(int limit)
830{
3b692427 831 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
832 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
15c4dc5a 833 int mode=1, display_val, display_max, i;
834
3b692427 835#define LF_ONLY 1
836#define HF_ONLY 2
837#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
838
839
840 // switch off FPGA - we don't want to measure our own signal
841 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
842 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 843
844 LEDsoff();
845
3b692427 846 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 847
848 if(limit != HF_ONLY) {
3b692427 849 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 850 lf_baseline = lf_av;
851 }
852
3b692427 853 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 854
855 if (limit != LF_ONLY) {
3b692427 856 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 857 hf_baseline = hf_av;
858 }
859
860 for(;;) {
861 if (BUTTON_PRESS()) {
862 SpinDelay(500);
863 switch (mode) {
864 case 1:
865 mode=2;
866 DbpString("Signal Strength Mode");
867 break;
868 case 2:
869 default:
870 DbpString("Stopped");
871 LEDsoff();
872 return;
873 break;
874 }
875 }
876 WDT_HIT();
877
878 if (limit != HF_ONLY) {
3b692427 879 if(mode == 1) {
cf194819 880 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
3b692427 881 LED_D_ON();
882 else
883 LED_D_OFF();
15c4dc5a 884 }
e30c654b 885
3b692427 886 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 887 // see if there's a significant change
cf194819 888 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
3b692427 889 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 890 lf_av = lf_av_new;
891 if (lf_av > lf_max)
892 lf_max = lf_av;
15c4dc5a 893 }
894 }
895
896 if (limit != LF_ONLY) {
897 if (mode == 1){
cf194819 898 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
3b692427 899 LED_B_ON();
900 else
901 LED_B_OFF();
15c4dc5a 902 }
e30c654b 903
3b692427 904 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 905 // see if there's a significant change
cf194819 906 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
3b692427 907 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 908 hf_av = hf_av_new;
909 if (hf_av > hf_max)
910 hf_max = hf_av;
15c4dc5a 911 }
912 }
e30c654b 913
15c4dc5a 914 if(mode == 2) {
915 if (limit == LF_ONLY) {
916 display_val = lf_av;
917 display_max = lf_max;
918 } else if (limit == HF_ONLY) {
919 display_val = hf_av;
920 display_max = hf_max;
921 } else { /* Pick one at random */
922 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
923 display_val = hf_av;
924 display_max = hf_max;
925 } else {
926 display_val = lf_av;
927 display_max = lf_max;
928 }
929 }
930 for (i=0; i<LIGHT_LEN; i++) {
931 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
932 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
933 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
934 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
935 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
936 break;
937 }
938 }
939 }
940 }
941}
942
f7e3ed82 943void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 944{
945 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 946
902cb3c0 947// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
948
15c4dc5a 949 switch(c->cmd) {
950#ifdef WITH_LF
31abe49f
MHS
951 case CMD_SET_LF_SAMPLING_CONFIG:
952 setSamplingConfig((sample_config *) c->d.asBytes);
953 break;
15c4dc5a 954 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
b9957414 955 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
15c4dc5a 956 break;
15c4dc5a 957 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
958 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
959 break;
b014c96d 960 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 961 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 962 break;
7e67e42f 963 case CMD_HID_DEMOD_FSK:
be59094d 964 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
7e67e42f 965 break;
966 case CMD_HID_SIM_TAG:
be59094d 967 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
7e67e42f 968 break;
abd6112f 969 case CMD_FSK_SIM_TAG:
970 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
971 break;
972 case CMD_ASK_SIM_TAG:
973 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
974 break;
872e3d4d 975 case CMD_PSK_SIM_TAG:
976 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
977 break;
978 case CMD_HID_CLONE_TAG:
1c611bbd 979 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 980 break;
a1f3bb12 981 case CMD_IO_DEMOD_FSK:
3fe4ff4f 982 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 983 break;
3fe4ff4f 984 case CMD_IO_CLONE_TAG:
9f669cb2 985 CopyIOtoT55x7(c->arg[0], c->arg[1]);
a1f3bb12 986 break;
66707a3b 987 case CMD_EM410X_DEMOD:
988 CmdEM410xdemod(c->arg[0], 0, 0, 1);
989 break;
2d4eae76 990 case CMD_EM410X_WRITE_TAG:
991 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
992 break;
7e67e42f 993 case CMD_READ_TI_TYPE:
994 ReadTItag();
995 break;
996 case CMD_WRITE_TI_TYPE:
997 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
998 break;
999 case CMD_SIMULATE_TAG_125K:
31d1caa5 1000 LED_A_ON();
7e67e42f 1001 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
31d1caa5 1002 LED_A_OFF();
7e67e42f 1003 break;
1004 case CMD_LF_SIMULATE_BIDIR:
1005 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1006 break;
3fe4ff4f 1007 case CMD_INDALA_CLONE_TAG:
2414f978 1008 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1009 break;
3fe4ff4f 1010 case CMD_INDALA_CLONE_TAG_L:
2414f978 1011 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1012 break;
1c611bbd 1013 case CMD_T55XX_READ_BLOCK:
8e99ec25 1014 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1015 break;
1016 case CMD_T55XX_WRITE_BLOCK:
1017 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1018 break;
be2d41b7 1019 case CMD_T55XX_WAKEUP:
1020 T55xxWakeUp(c->arg[0]);
1c611bbd 1021 break;
66837a03 1022 case CMD_T55XX_RESET_READ:
1023 T55xxResetRead();
1024 break;
3fe4ff4f 1025 case CMD_PCF7931_READ:
1c611bbd 1026 ReadPCF7931();
1c611bbd 1027 break;
dc4300ba 1028 case CMD_PCF7931_WRITE:
d10e08ae 1029 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
dc4300ba 1030 break;
1c611bbd 1031 case CMD_EM4X_READ_WORD:
7666f460 1032 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1c611bbd 1033 break;
1034 case CMD_EM4X_WRITE_WORD:
7666f460 1035 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1c611bbd 1036 break;
dbf6e824
CY
1037 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1038 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
7cfc777b 1039 break;
709665b5 1040 case CMD_VIKING_CLONE_TAG:
1041 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1042 break;
e04475c4 1043 case CMD_COTAG:
1044 Cotag(c->arg[0]);
1045 break;
15c4dc5a 1046#endif
1047
d19929cb 1048#ifdef WITH_HITAG
1049 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1050 SnoopHitag(c->arg[0]);
1051 break;
1052 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1053 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1054 break;
1055 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1056 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1057 break;
4e12287d
RS
1058 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1059 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1060 break;
1061 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1062 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1063 break;
1064 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1065 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1066 break;
1067 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
52244230
HJ
1068 if ((hitag_function)c->arg[0] < 10) {
1069 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1070 }
1071 else if ((hitag_function)c->arg[0] >= 10) {
1072 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1073 }
4e12287d 1074 break;
d19929cb 1075#endif
f168b263 1076
15c4dc5a 1077#ifdef WITH_ISO15693
1078 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1079 AcquireRawAdcSamplesIso15693();
1080 break;
9455b51c 1081 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1082 RecordRawAdcSamplesIso15693();
1083 break;
1084
1085 case CMD_ISO_15693_COMMAND:
1086 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1087 break;
1088
1089 case CMD_ISO_15693_FIND_AFI:
1090 BruteforceIso15693Afi(c->arg[0]);
1091 break;
1092
1093 case CMD_ISO_15693_DEBUG:
1094 SetDebugIso15693(c->arg[0]);
1095 break;
15c4dc5a 1096
15c4dc5a 1097 case CMD_READER_ISO_15693:
1098 ReaderIso15693(c->arg[0]);
1099 break;
7e67e42f 1100 case CMD_SIMTAG_ISO_15693:
3fe4ff4f 1101 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 1102 break;
15c4dc5a 1103#endif
1104
7e67e42f 1105#ifdef WITH_LEGICRF
1106 case CMD_SIMULATE_TAG_LEGIC_RF:
1b902aa0 1107 LegicRfSimulate(c->arg[0]);
7e67e42f 1108 break;
3612a8a8 1109
7e67e42f 1110 case CMD_WRITER_LEGIC_RF:
1111 LegicRfWriter(c->arg[1], c->arg[0]);
1112 break;
3612a8a8 1113
15c4dc5a 1114 case CMD_READER_LEGIC_RF:
1115 LegicRfReader(c->arg[0], c->arg[1]);
1116 break;
15c4dc5a 1117#endif
1118
1119#ifdef WITH_ISO14443b
15c4dc5a 1120 case CMD_READ_SRI512_TAG:
51d4f6f1 1121 ReadSTMemoryIso14443b(0x0F);
15c4dc5a 1122 break;
7e67e42f 1123 case CMD_READ_SRIX4K_TAG:
51d4f6f1 1124 ReadSTMemoryIso14443b(0x7F);
7e67e42f 1125 break;
132a0217 1126 case CMD_SNOOP_ISO_14443B:
51d4f6f1 1127 SnoopIso14443b();
7e67e42f 1128 break;
132a0217 1129 case CMD_SIMULATE_TAG_ISO_14443B:
51d4f6f1 1130 SimulateIso14443bTag();
7e67e42f 1131 break;
7cf3ef20 1132 case CMD_ISO_14443B_COMMAND:
1133 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1134 break;
15c4dc5a 1135#endif
1136
1137#ifdef WITH_ISO14443a
7e67e42f 1138 case CMD_SNOOP_ISO_14443a:
5cd9ec01 1139 SnoopIso14443a(c->arg[0]);
7e67e42f 1140 break;
15c4dc5a 1141 case CMD_READER_ISO_14443a:
902cb3c0 1142 ReaderIso14443a(c);
15c4dc5a 1143 break;
7e67e42f 1144 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 1145 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 1146 break;
3fe4ff4f 1147
5acd09bd 1148 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 1149 EPA_PACE_Collect_Nonce(c);
5acd09bd 1150 break;
3bb07d96
FM
1151 case CMD_EPA_PACE_REPLAY:
1152 EPA_PACE_Replay(c);
1153 break;
7e67e42f 1154
15c4dc5a 1155 case CMD_READER_MIFARE:
f168b263 1156 ReaderMifare(c->arg[0]);
15c4dc5a 1157 break;
20f9a2a1
M
1158 case CMD_MIFARE_READBL:
1159 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1160 break;
981bd429 1161 case CMD_MIFAREU_READBL:
f168b263 1162 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 1163 break;
8258f409 1164 case CMD_MIFAREUC_AUTH:
1165 MifareUC_Auth(c->arg[0],c->d.asBytes);
a631936e 1166 break;
981bd429 1167 case CMD_MIFAREU_READCARD:
75377d29 1168 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 1169 break;
f168b263 1170 case CMD_MIFAREUC_SETPWD:
1171 MifareUSetPwd(c->arg[0], c->d.asBytes);
1172 break;
20f9a2a1
M
1173 case CMD_MIFARE_READSC:
1174 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1175 break;
1176 case CMD_MIFARE_WRITEBL:
1177 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1178 break;
4973f23d 1179 //case CMD_MIFAREU_WRITEBL_COMPAT:
1180 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1181 //break;
981bd429 1182 case CMD_MIFAREU_WRITEBL:
4973f23d 1183 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
f168b263 1184 break;
c48c4d78 1185 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1186 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1187 break;
20f9a2a1
M
1188 case CMD_MIFARE_NESTED:
1189 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
1190 break;
1191 case CMD_MIFARE_CHKKEYS:
1192 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
1193 break;
1194 case CMD_SIMULATE_MIFARE_CARD:
1195 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1196 break;
8556b852
M
1197
1198 // emulator
1199 case CMD_MIFARE_SET_DBGMODE:
1200 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1201 break;
1202 case CMD_MIFARE_EML_MEMCLR:
1203 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1204 break;
1205 case CMD_MIFARE_EML_MEMSET:
1206 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1207 break;
1208 case CMD_MIFARE_EML_MEMGET:
1209 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1210 break;
1211 case CMD_MIFARE_EML_CARDLOAD:
1212 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
1213 break;
1214
1215 // Work with "magic Chinese" card
3a05a1e7
OM
1216 case CMD_MIFARE_CWIPE:
1217 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1218 break;
3fe4ff4f 1219 case CMD_MIFARE_CSETBLOCK:
0675f200 1220 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 1221 break;
3fe4ff4f 1222 case CMD_MIFARE_CGETBLOCK:
545a1f38 1223 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 1224 break;
3fe4ff4f 1225 case CMD_MIFARE_CIDENT:
1226 MifareCIdent();
1227 break;
b62a5a84
M
1228
1229 // mifare sniffer
1230 case CMD_MIFARE_SNIFFER:
5cd9ec01 1231 SniffMifare(c->arg[0]);
b62a5a84 1232 break;
a631936e 1233
20f9a2a1
M
1234#endif
1235
7e67e42f 1236#ifdef WITH_ICLASS
cee5a30d 1237 // Makes use of ISO14443a FPGA Firmware
1238 case CMD_SNOOP_ICLASS:
1239 SnoopIClass();
1240 break;
1e262141 1241 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 1242 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 1243 break;
1244 case CMD_READER_ICLASS:
1245 ReaderIClass(c->arg[0]);
1246 break;
c3963755 1247 case CMD_READER_ICLASS_REPLAY:
aa53efc3 1248 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 1249 break;
aa53efc3 1250 case CMD_ICLASS_EML_MEMSET:
e80aeb96
MHS
1251 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1252 break;
aa53efc3 1253 case CMD_ICLASS_WRITEBLOCK:
3ac22ee1 1254 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1255 break;
1256 case CMD_ICLASS_READCHECK: // auth step 1
1257 iClass_ReadCheck(c->arg[0], c->arg[1]);
aa53efc3 1258 break;
1259 case CMD_ICLASS_READBLOCK:
3ac22ee1 1260 iClass_ReadBlk(c->arg[0]);
aa53efc3 1261 break;
3ac22ee1 1262 case CMD_ICLASS_AUTHENTICATION: //check
aa53efc3 1263 iClass_Authentication(c->d.asBytes);
1264 break;
1265 case CMD_ICLASS_DUMP:
3ac22ee1 1266 iClass_Dump(c->arg[0], c->arg[1]);
aa53efc3 1267 break;
1268 case CMD_ICLASS_CLONE:
3ac22ee1 1269 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
aa53efc3 1270 break;
cee5a30d 1271#endif
0472d76d 1272#ifdef WITH_HFSNOOP
1273 case CMD_HF_SNIFFER:
1274 HfSnoop(c->arg[0], c->arg[1]);
1275 break;
1276#endif
43591e64 1277#ifdef WITH_SMARTCARD
1278 case CMD_SMART_ATR: {
1279 SmartCardAtr();
1280 break;
1281 }
1282 case CMD_SMART_SETCLOCK:{
1283 SmartCardSetClock(c->arg[0]);
1284 break;
1285 }
1286 case CMD_SMART_RAW: {
1287 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1288 break;
1289 }
1290 case CMD_SMART_UPLOAD: {
1291 // upload file from client
1292 uint8_t *mem = BigBuf_get_addr();
1293 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1294 cmd_send(CMD_ACK,1,0,0,0,0);
1295 break;
1296 }
1297 case CMD_SMART_UPGRADE: {
1298 SmartCardUpgrade(c->arg[0]);
1299 break;
1300 }
1301#endif
cee5a30d 1302
7e67e42f 1303 case CMD_BUFF_CLEAR:
117d9ec2 1304 BigBuf_Clear();
15c4dc5a 1305 break;
15c4dc5a 1306
1307 case CMD_MEASURE_ANTENNA_TUNING:
fdcfbdcc 1308 MeasureAntennaTuning(c->arg[0]);
15c4dc5a 1309 break;
1310
1311 case CMD_MEASURE_ANTENNA_TUNING_HF:
1312 MeasureAntennaTuningHf();
1313 break;
1314
1315 case CMD_LISTEN_READER_FIELD:
1316 ListenReaderField(c->arg[0]);
1317 break;
1318
15c4dc5a 1319 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1320 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1321 SpinDelay(200);
1322 LED_D_OFF(); // LED D indicates field ON or OFF
1323 break;
1324
1c611bbd 1325 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 1326
1c611bbd 1327 LED_B_ON();
117d9ec2 1328 uint8_t *BigBuf = BigBuf_get_addr();
1c611bbd 1329 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1330 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 1331 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 1332 }
1333 // Trigger a finish downloading signal with an ACK frame
3000dc4e 1334 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 1335 LED_B_OFF();
1c611bbd 1336 break;
15c4dc5a 1337
1338 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
8c8317a5 1339 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1340 // to be able to use this one for uploading data to device
1341 // arg1 = 0 upload for LF usage
1342 // 1 upload for HF usage
1343 if (c->arg[1] == 0)
1344 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1345 else
1346 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1347
117d9ec2 1348 uint8_t *b = BigBuf_get_addr();
3fe4ff4f 1349 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 1350 cmd_send(CMD_ACK,0,0,0,0,0);
1351 break;
1352 }
15c4dc5a 1353 case CMD_READ_MEM:
1354 ReadMem(c->arg[0]);
1355 break;
1356
1357 case CMD_SET_LF_DIVISOR:
8c8317a5 1358 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 1359 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1360 break;
1361
1362 case CMD_SET_ADC_MUX:
1363 switch(c->arg[0]) {
1364 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1365 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1366 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1367 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1368 }
1369 break;
1370
1371 case CMD_VERSION:
1372 SendVersion();
1373 break;
c89274cc 1374 case CMD_STATUS:
67b7d6fa 1375 SendStatus();
c89274cc
CY
1376 break;
1377 case CMD_PING:
1378 cmd_send(CMD_ACK,0,0,0,0,0);
1379 break;
15c4dc5a 1380#ifdef WITH_LCD
1381 case CMD_LCD_RESET:
1382 LCDReset();
1383 break;
1384 case CMD_LCD:
1385 LCDSend(c->arg[0]);
1386 break;
1387#endif
1388 case CMD_SETUP_WRITE:
1389 case CMD_FINISH_WRITE:
1c611bbd 1390 case CMD_HARDWARE_RESET:
1391 usb_disable();
15c4dc5a 1392 SpinDelay(1000);
1393 SpinDelay(1000);
1394 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1395 for(;;) {
1396 // We're going to reset, and the bootrom will take control.
1397 }
1c611bbd 1398 break;
15c4dc5a 1399
1c611bbd 1400 case CMD_START_FLASH:
15c4dc5a 1401 if(common_area.flags.bootrom_present) {
1402 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1403 }
1c611bbd 1404 usb_disable();
15c4dc5a 1405 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1406 for(;;);
1c611bbd 1407 break;
e30c654b 1408
15c4dc5a 1409 case CMD_DEVICE_INFO: {
902cb3c0 1410 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1411 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1412 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1413 break;
1414 }
1415 default:
15c4dc5a 1416 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1417 break;
15c4dc5a 1418 }
1419}
1420
1421void __attribute__((noreturn)) AppMain(void)
1422{
1423 SpinDelay(100);
9e8255d4 1424 clear_trace();
15c4dc5a 1425 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1426 /* Initialize common area */
1427 memset(&common_area, 0, sizeof(common_area));
1428 common_area.magic = COMMON_AREA_MAGIC;
1429 common_area.version = 1;
1430 }
1431 common_area.flags.osimage_present = 1;
1432
1433 LED_D_OFF();
1434 LED_C_OFF();
1435 LED_B_OFF();
1436 LED_A_OFF();
1437
3fe4ff4f 1438 // Init USB device
902cb3c0 1439 usb_enable();
15c4dc5a 1440
1441 // The FPGA gets its clock from us from PCK0 output, so set that up.
1442 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1443 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1444 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1445 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1446 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
0472d76d 1447 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
15c4dc5a 1448 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1449
1450 // Reset SPI
1451 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1452 // Reset SSC
1453 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1454
1455 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1456 // (the HF version by default)
1457 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1458
9ca155ba 1459 StartTickCount();
902cb3c0 1460
15c4dc5a 1461#ifdef WITH_LCD
15c4dc5a 1462 LCDInit();
15c4dc5a 1463#endif
1464
902cb3c0 1465 byte_t rx[sizeof(UsbCommand)];
1466 size_t rx_len;
1467
15c4dc5a 1468 for(;;) {
902cb3c0 1469 if (usb_poll()) {
1470 rx_len = usb_read(rx,sizeof(UsbCommand));
1471 if (rx_len) {
1472 UsbPacketReceived(rx,rx_len);
1473 }
1474 }
15c4dc5a 1475 WDT_HIT();
1476
a2937cea 1477#ifdef WITH_LF_StandAlone
e46fe044 1478#ifndef WITH_ISO14443a_StandAlone
15c4dc5a 1479 if (BUTTON_HELD(1000) > 0)
1480 SamyRun();
e46fe044
CY
1481#endif
1482#endif
1483#ifdef WITH_ISO14443a
1484#ifdef WITH_ISO14443a_StandAlone
1485 if (BUTTON_HELD(1000) > 0)
1486 StandAloneMode14a();
1487#endif
15c4dc5a 1488#endif
1489 }
1490}
Impressum, Datenschutz