]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
CHG: added possiblity to send <UID> into the "HF 15 SIM"
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
f38a1528 13#include "../common/usb_cdc.h"
14#include "../common/cmd.h"
902cb3c0 15
f38a1528 16#include "../include/proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
9ab7a6c7 21#include <stdarg.h>
f7e3ed82 22
f6c18637 23
15c4dc5a 24#include "legicrf.h"
f38a1528 25#include "../include/hitag2.h"
f7e3ed82 26
72e930ef 27
15c4dc5a 28#ifdef WITH_LCD
902cb3c0 29 #include "LCD.h"
15c4dc5a 30#endif
31
15c4dc5a 32#define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34//=============================================================================
35// A buffer where we can queue things up to be sent through the FPGA, for
36// any purpose (fake tag, as reader, whatever). We go MSB first, since that
37// is the order in which they go out on the wire.
38//=============================================================================
39
f7e3ed82 40uint8_t ToSend[512];
15c4dc5a 41int ToSendMax;
42static int ToSendBit;
43struct common_area common_area __attribute__((section(".commonarea")));
44
45void BufferClear(void)
46{
47 memset(BigBuf,0,sizeof(BigBuf));
48 Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
49}
50
51void ToSendReset(void)
52{
53 ToSendMax = -1;
54 ToSendBit = 8;
55}
56
57void ToSendStuffBit(int b)
58{
59 if(ToSendBit >= 8) {
60 ToSendMax++;
61 ToSend[ToSendMax] = 0;
62 ToSendBit = 0;
63 }
64
65 if(b) {
66 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
67 }
68
69 ToSendBit++;
70
71 if(ToSendBit >= sizeof(ToSend)) {
72 ToSendBit = 0;
73 DbpString("ToSendStuffBit overflowed!");
74 }
75}
76
77//=============================================================================
78// Debug print functions, to go out over USB, to the usual PC-side client.
79//=============================================================================
80
81void DbpString(char *str)
82{
9440213d 83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 85}
86
87#if 0
88void DbpIntegers(int x1, int x2, int x3)
89{
902cb3c0 90 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 91}
92#endif
93
94void Dbprintf(const char *fmt, ...) {
95// should probably limit size here; oh well, let's just use a big buffer
96 char output_string[128];
97 va_list ap;
98
99 va_start(ap, fmt);
100 kvsprintf(fmt, output_string, 10, ap);
101 va_end(ap);
e30c654b 102
15c4dc5a 103 DbpString(output_string);
104}
105
9455b51c 106// prints HEX & ASCII
d19929cb 107void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 108 int l=0,i;
109 char ascii[9];
d19929cb 110
9455b51c 111 while (len>0) {
112 if (len>8) l=8;
113 else l=len;
114
115 memcpy(ascii,d,l);
d19929cb 116 ascii[l]=0;
9455b51c 117
118 // filter safe ascii
d19929cb 119 for (i=0;i<l;i++)
9455b51c 120 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 121
122 if (bAsci) {
123 Dbprintf("%-8s %*D",ascii,l,d," ");
124 } else {
125 Dbprintf("%*D",l,d," ");
126 }
127
9455b51c 128 len-=8;
129 d+=8;
130 }
131}
132
15c4dc5a 133//-----------------------------------------------------------------------------
134// Read an ADC channel and block till it completes, then return the result
135// in ADC units (0 to 1023). Also a routine to average 32 samples and
136// return that.
137//-----------------------------------------------------------------------------
138static int ReadAdc(int ch)
139{
f7e3ed82 140 uint32_t d;
15c4dc5a 141
142 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
143 AT91C_BASE_ADC->ADC_MR =
144 ADC_MODE_PRESCALE(32) |
145 ADC_MODE_STARTUP_TIME(16) |
146 ADC_MODE_SAMPLE_HOLD_TIME(8);
147 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
148
149 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
150 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
151 ;
152 d = AT91C_BASE_ADC->ADC_CDR[ch];
153
154 return d;
155}
156
9ca155ba 157int AvgAdc(int ch) // was static - merlok
15c4dc5a 158{
159 int i;
160 int a = 0;
161
162 for(i = 0; i < 32; i++) {
163 a += ReadAdc(ch);
164 }
165
166 return (a + 15) >> 5;
167}
168
169void MeasureAntennaTuning(void)
170{
d19929cb 171 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
9f693930 172 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 173 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
174
d19929cb 175 LED_B_ON();
176 DbpString("Measuring antenna characteristics, please wait...");
177 memset(dest,0,sizeof(FREE_BUFFER_SIZE));
15c4dc5a 178
179/*
180 * Sweeps the useful LF range of the proxmark from
181 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
182 * read the voltage in the antenna, the result left
183 * in the buffer is a graph which should clearly show
184 * the resonating frequency of your LF antenna
185 * ( hopefully around 95 if it is tuned to 125kHz!)
186 */
d19929cb 187
7cc204bf 188 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 189 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
15c4dc5a 190 for (i=255; i>19; i--) {
d19929cb 191 WDT_HIT();
15c4dc5a 192 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
193 SpinDelay(20);
194 // Vref = 3.3V, and a 10000:240 voltage divider on the input
195 // can measure voltages up to 137500 mV
196 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
197 if (i==95) vLf125 = adcval; // voltage at 125Khz
198 if (i==89) vLf134 = adcval; // voltage at 134Khz
199
200 dest[i] = adcval>>8; // scale int to fit in byte for graphing purposes
201 if(dest[i] > peak) {
202 peakv = adcval;
203 peak = dest[i];
204 peakf = i;
9f693930 205 //ptr = i;
15c4dc5a 206 }
207 }
208
d19929cb 209 LED_A_ON();
15c4dc5a 210 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 211 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 212 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
213 SpinDelay(20);
214 // Vref = 3300mV, and an 10:1 voltage divider on the input
215 // can measure voltages up to 33000 mV
216 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
217
902cb3c0 218// c.cmd = CMD_MEASURED_ANTENNA_TUNING;
219// c.arg[0] = (vLf125 << 0) | (vLf134 << 16);
220// c.arg[1] = vHf;
221// c.arg[2] = peakf | (peakv << 16);
d19929cb 222
223 DbpString("Measuring complete, sending report back to host");
902cb3c0 224 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),0,0);
225// UsbSendPacket((uint8_t *)&c, sizeof(c));
d19929cb 226 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
227 LED_A_OFF();
228 LED_B_OFF();
229 return;
15c4dc5a 230}
231
232void MeasureAntennaTuningHf(void)
233{
234 int vHf = 0; // in mV
235
236 DbpString("Measuring HF antenna, press button to exit");
237
238 for (;;) {
239 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 240 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 241 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
242 SpinDelay(20);
243 // Vref = 3300mV, and an 10:1 voltage divider on the input
244 // can measure voltages up to 33000 mV
245 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 246
15c4dc5a 247 Dbprintf("%d mV",vHf);
248 if (BUTTON_PRESS()) break;
249 }
250 DbpString("cancelled");
251}
252
253
254void SimulateTagHfListen(void)
255{
d19929cb 256 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
f7e3ed82 257 uint8_t v = 0;
15c4dc5a 258 int i;
259 int p = 0;
260
261 // We're using this mode just so that I can test it out; the simulated
262 // tag mode would work just as well and be simpler.
7cc204bf 263 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 264 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
265
266 // We need to listen to the high-frequency, peak-detected path.
267 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
268
269 FpgaSetupSsc();
270
271 i = 0;
272 for(;;) {
273 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
274 AT91C_BASE_SSC->SSC_THR = 0xff;
275 }
276 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 277 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 278
279 v <<= 1;
280 if(r & 1) {
281 v |= 1;
282 }
283 p++;
284
285 if(p >= 8) {
286 dest[i] = v;
287 v = 0;
288 p = 0;
289 i++;
290
d19929cb 291 if(i >= FREE_BUFFER_SIZE) {
15c4dc5a 292 break;
293 }
294 }
295 }
296 }
297 DbpString("simulate tag (now type bitsamples)");
298}
299
300void ReadMem(int addr)
301{
f7e3ed82 302 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 303
304 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
305 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
306}
307
308/* osimage version information is linked in */
309extern struct version_information version_information;
310/* bootrom version information is pointed to from _bootphase1_version_pointer */
311extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
312void SendVersion(void)
313{
cba867f2 314 char temp[256]; /* Limited data payload in USB packets */
15c4dc5a 315 DbpString("Prox/RFID mark3 RFID instrument");
e30c654b 316
317 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 318 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
319 * pointer, then use it.
320 */
321 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
322 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
323 DbpString("bootrom version information appears invalid");
324 } else {
325 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
326 DbpString(temp);
327 }
e30c654b 328
15c4dc5a 329 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
330 DbpString(temp);
e30c654b 331
15c4dc5a 332 FpgaGatherVersion(temp, sizeof(temp));
333 DbpString(temp);
4f269f63 334 // Send Chip ID
335 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
15c4dc5a 336}
337
338#ifdef WITH_LF
339// samy's sniff and repeat routine
340void SamyRun()
341{
342 DbpString("Stand-alone mode! No PC necessary.");
7cc204bf 343 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 344
345 // 3 possible options? no just 2 for now
346#define OPTS 2
347
348 int high[OPTS], low[OPTS];
349
350 // Oooh pretty -- notify user we're in elite samy mode now
351 LED(LED_RED, 200);
352 LED(LED_ORANGE, 200);
353 LED(LED_GREEN, 200);
354 LED(LED_ORANGE, 200);
355 LED(LED_RED, 200);
356 LED(LED_ORANGE, 200);
357 LED(LED_GREEN, 200);
358 LED(LED_ORANGE, 200);
359 LED(LED_RED, 200);
360
361 int selected = 0;
362 int playing = 0;
72e930ef 363 int cardRead = 0;
15c4dc5a 364
365 // Turn on selected LED
366 LED(selected + 1, 0);
367
368 for (;;)
369 {
6e82300d 370// UsbPoll(FALSE);
371 usb_poll();
372 WDT_HIT();
15c4dc5a 373
374 // Was our button held down or pressed?
375 int button_pressed = BUTTON_HELD(1000);
376 SpinDelay(300);
377
378 // Button was held for a second, begin recording
72e930ef 379 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 380 {
381 LEDsoff();
382 LED(selected + 1, 0);
383 LED(LED_RED2, 0);
384
385 // record
386 DbpString("Starting recording");
387
388 // wait for button to be released
389 while(BUTTON_PRESS())
390 WDT_HIT();
391
392 /* need this delay to prevent catching some weird data */
393 SpinDelay(500);
394
395 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
396 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
397
398 LEDsoff();
399 LED(selected + 1, 0);
400 // Finished recording
401
402 // If we were previously playing, set playing off
403 // so next button push begins playing what we recorded
404 playing = 0;
72e930ef 405
406 cardRead = 1;
407
408 }
409
410 else if (button_pressed > 0 && cardRead == 1)
411 {
412 LEDsoff();
413 LED(selected + 1, 0);
414 LED(LED_ORANGE, 0);
415
416 // record
417 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
418
419 // wait for button to be released
420 while(BUTTON_PRESS())
421 WDT_HIT();
422
423 /* need this delay to prevent catching some weird data */
424 SpinDelay(500);
425
426 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
427 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
428
429 LEDsoff();
430 LED(selected + 1, 0);
431 // Finished recording
432
433 // If we were previously playing, set playing off
434 // so next button push begins playing what we recorded
435 playing = 0;
436
437 cardRead = 0;
438
15c4dc5a 439 }
440
441 // Change where to record (or begin playing)
442 else if (button_pressed)
443 {
444 // Next option if we were previously playing
445 if (playing)
446 selected = (selected + 1) % OPTS;
447 playing = !playing;
448
449 LEDsoff();
450 LED(selected + 1, 0);
451
452 // Begin transmitting
453 if (playing)
454 {
455 LED(LED_GREEN, 0);
456 DbpString("Playing");
457 // wait for button to be released
458 while(BUTTON_PRESS())
459 WDT_HIT();
460 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
461 CmdHIDsimTAG(high[selected], low[selected], 0);
462 DbpString("Done playing");
463 if (BUTTON_HELD(1000) > 0)
464 {
465 DbpString("Exiting");
466 LEDsoff();
467 return;
468 }
469
470 /* We pressed a button so ignore it here with a delay */
471 SpinDelay(300);
472
473 // when done, we're done playing, move to next option
474 selected = (selected + 1) % OPTS;
475 playing = !playing;
476 LEDsoff();
477 LED(selected + 1, 0);
478 }
479 else
480 while(BUTTON_PRESS())
481 WDT_HIT();
482 }
483 }
484}
485#endif
486
487/*
488OBJECTIVE
489Listen and detect an external reader. Determine the best location
490for the antenna.
491
492INSTRUCTIONS:
493Inside the ListenReaderField() function, there is two mode.
494By default, when you call the function, you will enter mode 1.
495If you press the PM3 button one time, you will enter mode 2.
496If you press the PM3 button a second time, you will exit the function.
497
498DESCRIPTION OF MODE 1:
499This mode just listens for an external reader field and lights up green
500for HF and/or red for LF. This is the original mode of the detectreader
501function.
502
503DESCRIPTION OF MODE 2:
504This mode will visually represent, using the LEDs, the actual strength of the
505current compared to the maximum current detected. Basically, once you know
506what kind of external reader is present, it will help you spot the best location to place
507your antenna. You will probably not get some good results if there is a LF and a HF reader
508at the same place! :-)
509
510LIGHT SCHEME USED:
511*/
512static const char LIGHT_SCHEME[] = {
513 0x0, /* ---- | No field detected */
514 0x1, /* X--- | 14% of maximum current detected */
515 0x2, /* -X-- | 29% of maximum current detected */
516 0x4, /* --X- | 43% of maximum current detected */
517 0x8, /* ---X | 57% of maximum current detected */
518 0xC, /* --XX | 71% of maximum current detected */
519 0xE, /* -XXX | 86% of maximum current detected */
520 0xF, /* XXXX | 100% of maximum current detected */
521};
522static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
523
524void ListenReaderField(int limit)
525{
526 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
527 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
528 int mode=1, display_val, display_max, i;
529
530#define LF_ONLY 1
531#define HF_ONLY 2
532
533 LEDsoff();
534
535 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
536
537 if(limit != HF_ONLY) {
538 Dbprintf("LF 125/134 Baseline: %d", lf_av);
539 lf_baseline = lf_av;
540 }
541
542 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
543
544 if (limit != LF_ONLY) {
545 Dbprintf("HF 13.56 Baseline: %d", hf_av);
546 hf_baseline = hf_av;
547 }
548
549 for(;;) {
550 if (BUTTON_PRESS()) {
551 SpinDelay(500);
552 switch (mode) {
553 case 1:
554 mode=2;
555 DbpString("Signal Strength Mode");
556 break;
557 case 2:
558 default:
559 DbpString("Stopped");
560 LEDsoff();
561 return;
562 break;
563 }
564 }
565 WDT_HIT();
566
567 if (limit != HF_ONLY) {
568 if(mode==1) {
569 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
570 else LED_D_OFF();
571 }
e30c654b 572
15c4dc5a 573 ++lf_count;
574 lf_av_new= ReadAdc(ADC_CHAN_LF);
575 // see if there's a significant change
576 if(abs(lf_av - lf_av_new) > 10) {
577 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
578 lf_av = lf_av_new;
579 if (lf_av > lf_max)
580 lf_max = lf_av;
581 lf_count= 0;
582 }
583 }
584
585 if (limit != LF_ONLY) {
586 if (mode == 1){
587 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
588 else LED_B_OFF();
589 }
e30c654b 590
15c4dc5a 591 ++hf_count;
592 hf_av_new= ReadAdc(ADC_CHAN_HF);
593 // see if there's a significant change
594 if(abs(hf_av - hf_av_new) > 10) {
595 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
596 hf_av = hf_av_new;
597 if (hf_av > hf_max)
598 hf_max = hf_av;
599 hf_count= 0;
600 }
601 }
e30c654b 602
15c4dc5a 603 if(mode == 2) {
604 if (limit == LF_ONLY) {
605 display_val = lf_av;
606 display_max = lf_max;
607 } else if (limit == HF_ONLY) {
608 display_val = hf_av;
609 display_max = hf_max;
610 } else { /* Pick one at random */
611 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
612 display_val = hf_av;
613 display_max = hf_max;
614 } else {
615 display_val = lf_av;
616 display_max = lf_max;
617 }
618 }
619 for (i=0; i<LIGHT_LEN; i++) {
620 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
621 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
622 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
623 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
624 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
625 break;
626 }
627 }
628 }
629 }
630}
631
f7e3ed82 632void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 633{
634 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 635
313ee67e 636 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
902cb3c0 637
15c4dc5a 638 switch(c->cmd) {
639#ifdef WITH_LF
640 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
641 AcquireRawAdcSamples125k(c->arg[0]);
1c611bbd 642 cmd_send(CMD_ACK,0,0,0,0,0);
15c4dc5a 643 break;
15c4dc5a 644 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
645 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
646 break;
b014c96d 647 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
648 SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
649 cmd_send(CMD_ACK,0,0,0,0,0);
650 break;
7e67e42f 651 case CMD_HID_DEMOD_FSK:
2414f978 652 CmdHIDdemodFSK(0, 0, 0, 1); // Demodulate HID tag
7e67e42f 653 break;
654 case CMD_HID_SIM_TAG:
655 CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID
656 break;
a1f3bb12 657 case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
1c611bbd 658 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 659 break;
a1f3bb12 660 case CMD_IO_DEMOD_FSK:
661 CmdIOdemodFSK(1, 0, 0, 1); // Demodulate IO tag
662 break;
663 case CMD_IO_CLONE_TAG: // Clone IO tag by ID to T55x7
664 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
665 break;
2d4eae76 666 case CMD_EM410X_WRITE_TAG:
667 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
668 break;
7e67e42f 669 case CMD_READ_TI_TYPE:
670 ReadTItag();
671 break;
672 case CMD_WRITE_TI_TYPE:
673 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
674 break;
675 case CMD_SIMULATE_TAG_125K:
676 LED_A_ON();
a61b4976 677 SimulateTagLowFrequency(c->arg[0], c->arg[1], 0);
7e67e42f 678 LED_A_OFF();
679 break;
680 case CMD_LF_SIMULATE_BIDIR:
681 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
682 break;
2414f978 683 case CMD_INDALA_CLONE_TAG: // Clone Indala 64-bit tag by UID to T55x7
684 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
685 break;
686 case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7
687 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
688 break;
1c611bbd 689 case CMD_T55XX_READ_BLOCK:
690 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
691 break;
692 case CMD_T55XX_WRITE_BLOCK:
693 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
694 break;
695 case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
696 T55xxReadTrace();
697 break;
698 case CMD_PCF7931_READ: // Read PCF7931 tag
699 ReadPCF7931();
700 cmd_send(CMD_ACK,0,0,0,0,0);
1c611bbd 701 break;
702 case CMD_EM4X_READ_WORD:
703 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
704 break;
705 case CMD_EM4X_WRITE_WORD:
706 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
707 break;
15c4dc5a 708#endif
709
d19929cb 710#ifdef WITH_HITAG
711 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
712 SnoopHitag(c->arg[0]);
713 break;
714 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
715 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
716 break;
717 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
718 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
719 break;
720#endif
721
15c4dc5a 722#ifdef WITH_ISO15693
723 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
724 AcquireRawAdcSamplesIso15693();
725 break;
9455b51c 726 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
727 RecordRawAdcSamplesIso15693();
728 break;
729
730 case CMD_ISO_15693_COMMAND:
731 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
732 break;
733
734 case CMD_ISO_15693_FIND_AFI:
735 BruteforceIso15693Afi(c->arg[0]);
736 break;
737
738 case CMD_ISO_15693_DEBUG:
739 SetDebugIso15693(c->arg[0]);
740 break;
15c4dc5a 741
15c4dc5a 742 case CMD_READER_ISO_15693:
743 ReaderIso15693(c->arg[0]);
744 break;
7e67e42f 745 case CMD_SIMTAG_ISO_15693:
3649b640 746 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 747 break;
15c4dc5a 748#endif
749
7e67e42f 750#ifdef WITH_LEGICRF
751 case CMD_SIMULATE_TAG_LEGIC_RF:
752 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
753 break;
3612a8a8 754
7e67e42f 755 case CMD_WRITER_LEGIC_RF:
756 LegicRfWriter(c->arg[1], c->arg[0]);
757 break;
3612a8a8 758
15c4dc5a 759 case CMD_READER_LEGIC_RF:
760 LegicRfReader(c->arg[0], c->arg[1]);
761 break;
15c4dc5a 762#endif
763
764#ifdef WITH_ISO14443b
765 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
766 AcquireRawAdcSamplesIso14443(c->arg[0]);
767 break;
15c4dc5a 768 case CMD_READ_SRI512_TAG:
7cf3ef20 769 ReadSTMemoryIso14443(0x0F);
15c4dc5a 770 break;
7e67e42f 771 case CMD_READ_SRIX4K_TAG:
7cf3ef20 772 ReadSTMemoryIso14443(0x7F);
7e67e42f 773 break;
774 case CMD_SNOOP_ISO_14443:
775 SnoopIso14443();
776 break;
777 case CMD_SIMULATE_TAG_ISO_14443:
778 SimulateIso14443Tag();
779 break;
7cf3ef20 780 case CMD_ISO_14443B_COMMAND:
781 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
782 break;
15c4dc5a 783#endif
784
785#ifdef WITH_ISO14443a
7e67e42f 786 case CMD_SNOOP_ISO_14443a:
5cd9ec01 787 SnoopIso14443a(c->arg[0]);
7e67e42f 788 break;
15c4dc5a 789 case CMD_READER_ISO_14443a:
902cb3c0 790 ReaderIso14443a(c);
15c4dc5a 791 break;
7e67e42f 792 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 793 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 794 break;
5acd09bd 795 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 796 EPA_PACE_Collect_Nonce(c);
5acd09bd 797 break;
7e67e42f 798
15c4dc5a 799 case CMD_READER_MIFARE:
1c611bbd 800 ReaderMifare(c->arg[0]);
15c4dc5a 801 break;
20f9a2a1
M
802 case CMD_MIFARE_READBL:
803 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
804 break;
981bd429 805 case CMD_MIFAREU_READBL:
806 MifareUReadBlock(c->arg[0],c->d.asBytes);
807 break;
f38a1528 808 case CMD_MIFAREUC_AUTH1:
809 MifareUC_Auth1(c->arg[0],c->d.asBytes);
810 break;
811 case CMD_MIFAREUC_AUTH2:
812 MifareUC_Auth2(c->arg[0],c->d.asBytes);
813 break;
981bd429 814 case CMD_MIFAREU_READCARD:
f38a1528 815 MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
816 break;
817 case CMD_MIFAREUC_READCARD:
818 MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
981bd429 819 break;
20f9a2a1
M
820 case CMD_MIFARE_READSC:
821 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
822 break;
823 case CMD_MIFARE_WRITEBL:
824 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
825 break;
981bd429 826 case CMD_MIFAREU_WRITEBL_COMPAT:
827 MifareUWriteBlock(c->arg[0], c->d.asBytes);
828 break;
829 case CMD_MIFAREU_WRITEBL:
830 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
831 break;
20f9a2a1
M
832 case CMD_MIFARE_NESTED:
833 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
834 break;
835 case CMD_MIFARE_CHKKEYS:
836 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
837 break;
838 case CMD_SIMULATE_MIFARE_CARD:
839 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
840 break;
8556b852
M
841
842 // emulator
843 case CMD_MIFARE_SET_DBGMODE:
844 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
845 break;
846 case CMD_MIFARE_EML_MEMCLR:
847 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
848 break;
849 case CMD_MIFARE_EML_MEMSET:
850 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
851 break;
852 case CMD_MIFARE_EML_MEMGET:
853 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
854 break;
855 case CMD_MIFARE_EML_CARDLOAD:
856 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
857 break;
858
859 // Work with "magic Chinese" card
860 case CMD_MIFARE_EML_CSETBLOCK:
861 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38
M
862 break;
863 case CMD_MIFARE_EML_CGETBLOCK:
864 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 865 break;
b62a5a84
M
866
867 // mifare sniffer
868 case CMD_MIFARE_SNIFFER:
5cd9ec01 869 SniffMifare(c->arg[0]);
b62a5a84 870 break;
f38a1528 871
872 // mifare desfire
873 case CMD_MIFARE_DESFIRE_READBL:
874 break;
875 case CMD_MIFARE_DESFIRE_WRITEBL:
876 break;
877 case CMD_MIFARE_DESFIRE_AUTH1:
878 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
879 break;
880 case CMD_MIFARE_DESFIRE_AUTH2:
f6c18637 881 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
f38a1528 882 break;
883 // case CMD_MIFARE_DES_READER:
884 // ReaderMifareDES(c->arg[0], c->arg[1], c->d.asBytes);
313ee67e 885 //break;
f38a1528 886 case CMD_MIFARE_DESFIRE_INFO:
887 MifareDesfireGetInformation();
888 break;
313ee67e 889 case CMD_MIFARE_DESFIRE:
890 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
891 break;
892
20f9a2a1
M
893#endif
894
7e67e42f 895#ifdef WITH_ICLASS
cee5a30d 896 // Makes use of ISO14443a FPGA Firmware
897 case CMD_SNOOP_ICLASS:
898 SnoopIClass();
899 break;
1e262141 900 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 901 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 902 break;
903 case CMD_READER_ICLASS:
904 ReaderIClass(c->arg[0]);
905 break;
f38a1528 906 case CMD_READER_ICLASS_REPLAY:
907 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
908 break;
cee5a30d 909#endif
910
15c4dc5a 911 case CMD_SIMULATE_TAG_HF_LISTEN:
912 SimulateTagHfListen();
913 break;
914
7e67e42f 915 case CMD_BUFF_CLEAR:
916 BufferClear();
15c4dc5a 917 break;
15c4dc5a 918
919 case CMD_MEASURE_ANTENNA_TUNING:
920 MeasureAntennaTuning();
921 break;
922
923 case CMD_MEASURE_ANTENNA_TUNING_HF:
924 MeasureAntennaTuningHf();
925 break;
926
927 case CMD_LISTEN_READER_FIELD:
928 ListenReaderField(c->arg[0]);
929 break;
930
15c4dc5a 931 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
932 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
933 SpinDelay(200);
934 LED_D_OFF(); // LED D indicates field ON or OFF
935 break;
936
1c611bbd 937 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 938
1c611bbd 939 LED_B_ON();
940 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
941 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
942 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
943 }
944 // Trigger a finish downloading signal with an ACK frame
945 cmd_send(CMD_ACK,0,0,0,0,0);
d3b1f4e4 946 LED_B_OFF();
1c611bbd 947 break;
15c4dc5a 948
949 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
f7e3ed82 950 uint8_t *b = (uint8_t *)BigBuf;
7c756d68 951 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 952 cmd_send(CMD_ACK,0,0,0,0,0);
953 break;
954 }
15c4dc5a 955 case CMD_READ_MEM:
956 ReadMem(c->arg[0]);
957 break;
958
959 case CMD_SET_LF_DIVISOR:
7cc204bf 960 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 961 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
962 break;
963
964 case CMD_SET_ADC_MUX:
965 switch(c->arg[0]) {
966 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
967 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
968 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
969 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
970 }
971 break;
972
973 case CMD_VERSION:
974 SendVersion();
975 break;
976
15c4dc5a 977#ifdef WITH_LCD
978 case CMD_LCD_RESET:
979 LCDReset();
980 break;
981 case CMD_LCD:
982 LCDSend(c->arg[0]);
983 break;
984#endif
985 case CMD_SETUP_WRITE:
986 case CMD_FINISH_WRITE:
1c611bbd 987 case CMD_HARDWARE_RESET:
988 usb_disable();
15c4dc5a 989 SpinDelay(1000);
990 SpinDelay(1000);
991 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
992 for(;;) {
993 // We're going to reset, and the bootrom will take control.
994 }
1c611bbd 995 break;
15c4dc5a 996
1c611bbd 997 case CMD_START_FLASH:
15c4dc5a 998 if(common_area.flags.bootrom_present) {
999 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1000 }
1c611bbd 1001 usb_disable();
15c4dc5a 1002 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1003 for(;;);
1c611bbd 1004 break;
e30c654b 1005
15c4dc5a 1006 case CMD_DEVICE_INFO: {
902cb3c0 1007 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1008 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1009 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1010 break;
1011 }
1012 default:
15c4dc5a 1013 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1014 break;
15c4dc5a 1015 }
1016}
1017
1018void __attribute__((noreturn)) AppMain(void)
1019{
1020 SpinDelay(100);
e30c654b 1021
15c4dc5a 1022 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1023 /* Initialize common area */
1024 memset(&common_area, 0, sizeof(common_area));
1025 common_area.magic = COMMON_AREA_MAGIC;
1026 common_area.version = 1;
1027 }
1028 common_area.flags.osimage_present = 1;
1029
1030 LED_D_OFF();
1031 LED_C_OFF();
1032 LED_B_OFF();
1033 LED_A_OFF();
1034
b44e5233 1035 // Init USB device
313ee67e 1036 usb_enable();
15c4dc5a 1037
1038 // The FPGA gets its clock from us from PCK0 output, so set that up.
1039 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1040 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1041 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1042 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1043 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1044 AT91C_PMC_PRES_CLK_4;
1045 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1046
1047 // Reset SPI
1048 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1049 // Reset SSC
1050 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1051
1052 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1053 // (the HF version by default)
1054 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1055
9ca155ba 1056 StartTickCount();
902cb3c0 1057
15c4dc5a 1058#ifdef WITH_LCD
15c4dc5a 1059 LCDInit();
15c4dc5a 1060#endif
1061
902cb3c0 1062 byte_t rx[sizeof(UsbCommand)];
1063 size_t rx_len;
1064
15c4dc5a 1065 for(;;) {
313ee67e 1066 if (usb_poll()) {
1067 rx_len = usb_read(rx,sizeof(UsbCommand));
1068 if (rx_len) {
1069 UsbPacketReceived(rx,rx_len);
1070 }
1071 }
15c4dc5a 1072 WDT_HIT();
1073
1074#ifdef WITH_LF
1075 if (BUTTON_HELD(1000) > 0)
1076 SamyRun();
1077#endif
1078 }
1079}
Impressum, Datenschutz