]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
Some documentation and formatting to LogTraceHitag
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
902cb3c0 13#include "usb_cdc.h"
14#include "cmd.h"
15
e30c654b 16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
31d1caa5 21
9ab7a6c7 22#include <stdarg.h>
f7e3ed82 23
15c4dc5a 24#include "legicrf.h"
d19929cb 25#include <hitag2.h>
31abe49f 26#include "lfsampling.h"
3000dc4e 27#include "BigBuf.h"
15c4dc5a 28#ifdef WITH_LCD
902cb3c0 29 #include "LCD.h"
15c4dc5a 30#endif
31
15c4dc5a 32#define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34//=============================================================================
35// A buffer where we can queue things up to be sent through the FPGA, for
36// any purpose (fake tag, as reader, whatever). We go MSB first, since that
37// is the order in which they go out on the wire.
38//=============================================================================
39
6a1f2d82 40#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 42int ToSendMax;
43static int ToSendBit;
44struct common_area common_area __attribute__((section(".commonarea")));
45
15c4dc5a 46void ToSendReset(void)
47{
48 ToSendMax = -1;
49 ToSendBit = 8;
50}
51
52void ToSendStuffBit(int b)
53{
54 if(ToSendBit >= 8) {
55 ToSendMax++;
56 ToSend[ToSendMax] = 0;
57 ToSendBit = 0;
58 }
59
60 if(b) {
61 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
62 }
63
64 ToSendBit++;
65
6a1f2d82 66 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 67 ToSendBit = 0;
68 DbpString("ToSendStuffBit overflowed!");
69 }
70}
71
72//=============================================================================
73// Debug print functions, to go out over USB, to the usual PC-side client.
74//=============================================================================
75
76void DbpString(char *str)
77{
9440213d 78 byte_t len = strlen(str);
79 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 80}
81
82#if 0
83void DbpIntegers(int x1, int x2, int x3)
84{
902cb3c0 85 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 86}
87#endif
88
89void Dbprintf(const char *fmt, ...) {
90// should probably limit size here; oh well, let's just use a big buffer
91 char output_string[128];
92 va_list ap;
93
94 va_start(ap, fmt);
95 kvsprintf(fmt, output_string, 10, ap);
96 va_end(ap);
e30c654b 97
15c4dc5a 98 DbpString(output_string);
99}
100
9455b51c 101// prints HEX & ASCII
d19929cb 102void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 103 int l=0,i;
104 char ascii[9];
d19929cb 105
9455b51c 106 while (len>0) {
107 if (len>8) l=8;
108 else l=len;
109
110 memcpy(ascii,d,l);
d19929cb 111 ascii[l]=0;
9455b51c 112
113 // filter safe ascii
d19929cb 114 for (i=0;i<l;i++)
9455b51c 115 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 116
117 if (bAsci) {
118 Dbprintf("%-8s %*D",ascii,l,d," ");
119 } else {
120 Dbprintf("%*D",l,d," ");
121 }
122
9455b51c 123 len-=8;
124 d+=8;
125 }
126}
127
15c4dc5a 128//-----------------------------------------------------------------------------
129// Read an ADC channel and block till it completes, then return the result
130// in ADC units (0 to 1023). Also a routine to average 32 samples and
131// return that.
132//-----------------------------------------------------------------------------
133static int ReadAdc(int ch)
134{
f7e3ed82 135 uint32_t d;
15c4dc5a 136
137 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
138 AT91C_BASE_ADC->ADC_MR =
139 ADC_MODE_PRESCALE(32) |
140 ADC_MODE_STARTUP_TIME(16) |
141 ADC_MODE_SAMPLE_HOLD_TIME(8);
142 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
143
144 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
145 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
146 ;
147 d = AT91C_BASE_ADC->ADC_CDR[ch];
148
149 return d;
150}
151
9ca155ba 152int AvgAdc(int ch) // was static - merlok
15c4dc5a 153{
154 int i;
155 int a = 0;
156
157 for(i = 0; i < 32; i++) {
158 a += ReadAdc(ch);
159 }
160
161 return (a + 15) >> 5;
162}
163
164void MeasureAntennaTuning(void)
165{
2bdd68c3 166 uint8_t LF_Results[256];
9f693930 167 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 168 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
169
2bdd68c3 170 LED_B_ON();
15c4dc5a 171
172/*
173 * Sweeps the useful LF range of the proxmark from
174 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
175 * read the voltage in the antenna, the result left
176 * in the buffer is a graph which should clearly show
177 * the resonating frequency of your LF antenna
178 * ( hopefully around 95 if it is tuned to 125kHz!)
179 */
d19929cb 180
7cc204bf 181 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 182 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2bdd68c3 183 for (i=255; i>=19; i--) {
d19929cb 184 WDT_HIT();
15c4dc5a 185 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
186 SpinDelay(20);
187 // Vref = 3.3V, and a 10000:240 voltage divider on the input
188 // can measure voltages up to 137500 mV
189 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
190 if (i==95) vLf125 = adcval; // voltage at 125Khz
191 if (i==89) vLf134 = adcval; // voltage at 134Khz
192
2bdd68c3 193 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
194 if(LF_Results[i] > peak) {
15c4dc5a 195 peakv = adcval;
2bdd68c3 196 peak = LF_Results[i];
15c4dc5a 197 peakf = i;
9f693930 198 //ptr = i;
15c4dc5a 199 }
200 }
201
2bdd68c3 202 for (i=18; i >= 0; i--) LF_Results[i] = 0;
203
204 LED_A_ON();
15c4dc5a 205 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 206 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 207 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
208 SpinDelay(20);
209 // Vref = 3300mV, and an 10:1 voltage divider on the input
210 // can measure voltages up to 33000 mV
211 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
212
2bdd68c3 213 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),LF_Results,256);
d19929cb 214 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 215 LED_A_OFF();
216 LED_B_OFF();
217 return;
15c4dc5a 218}
219
220void MeasureAntennaTuningHf(void)
221{
222 int vHf = 0; // in mV
223
224 DbpString("Measuring HF antenna, press button to exit");
225
226 for (;;) {
227 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 228 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 229 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
230 SpinDelay(20);
231 // Vref = 3300mV, and an 10:1 voltage divider on the input
232 // can measure voltages up to 33000 mV
233 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 234
15c4dc5a 235 Dbprintf("%d mV",vHf);
236 if (BUTTON_PRESS()) break;
237 }
238 DbpString("cancelled");
239}
240
241
242void SimulateTagHfListen(void)
243{
f71f4deb 244 // ToDo: historically this used the free buffer, which was 2744 Bytes long.
245 // There might be a better size to be defined:
246 #define HF_14B_SNOOP_BUFFER_SIZE 2744
247 uint8_t *dest = BigBuf_malloc(HF_14B_SNOOP_BUFFER_SIZE);
f7e3ed82 248 uint8_t v = 0;
15c4dc5a 249 int i;
250 int p = 0;
251
252 // We're using this mode just so that I can test it out; the simulated
253 // tag mode would work just as well and be simpler.
7cc204bf 254 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 255 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
256
257 // We need to listen to the high-frequency, peak-detected path.
258 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
259
260 FpgaSetupSsc();
261
262 i = 0;
263 for(;;) {
264 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
265 AT91C_BASE_SSC->SSC_THR = 0xff;
266 }
267 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 268 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 269
270 v <<= 1;
271 if(r & 1) {
272 v |= 1;
273 }
274 p++;
275
276 if(p >= 8) {
277 dest[i] = v;
278 v = 0;
279 p = 0;
280 i++;
281
f71f4deb 282 if(i >= HF_14B_SNOOP_BUFFER_SIZE) {
15c4dc5a 283 break;
284 }
285 }
286 }
287 }
288 DbpString("simulate tag (now type bitsamples)");
289}
290
291void ReadMem(int addr)
292{
f7e3ed82 293 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 294
295 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
296 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
297}
298
299/* osimage version information is linked in */
300extern struct version_information version_information;
301/* bootrom version information is pointed to from _bootphase1_version_pointer */
302extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
303void SendVersion(void)
304{
3fe4ff4f 305 char temp[512]; /* Limited data payload in USB packets */
15c4dc5a 306 DbpString("Prox/RFID mark3 RFID instrument");
e30c654b 307
308 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 309 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
310 * pointer, then use it.
311 */
312 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
313 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
314 DbpString("bootrom version information appears invalid");
315 } else {
316 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
317 DbpString(temp);
318 }
e30c654b 319
15c4dc5a 320 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
321 DbpString(temp);
e30c654b 322
15c4dc5a 323 FpgaGatherVersion(temp, sizeof(temp));
324 DbpString(temp);
4f269f63 325 // Send Chip ID
326 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
15c4dc5a 327}
328
329#ifdef WITH_LF
330// samy's sniff and repeat routine
331void SamyRun()
332{
333 DbpString("Stand-alone mode! No PC necessary.");
7cc204bf 334 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 335
336 // 3 possible options? no just 2 for now
337#define OPTS 2
338
339 int high[OPTS], low[OPTS];
340
341 // Oooh pretty -- notify user we're in elite samy mode now
342 LED(LED_RED, 200);
343 LED(LED_ORANGE, 200);
344 LED(LED_GREEN, 200);
345 LED(LED_ORANGE, 200);
346 LED(LED_RED, 200);
347 LED(LED_ORANGE, 200);
348 LED(LED_GREEN, 200);
349 LED(LED_ORANGE, 200);
350 LED(LED_RED, 200);
351
352 int selected = 0;
353 int playing = 0;
3fe4ff4f 354 int cardRead = 0;
15c4dc5a 355
356 // Turn on selected LED
357 LED(selected + 1, 0);
358
359 for (;;)
360 {
6e82300d 361 usb_poll();
362 WDT_HIT();
15c4dc5a 363
364 // Was our button held down or pressed?
365 int button_pressed = BUTTON_HELD(1000);
366 SpinDelay(300);
367
368 // Button was held for a second, begin recording
3fe4ff4f 369 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 370 {
371 LEDsoff();
372 LED(selected + 1, 0);
373 LED(LED_RED2, 0);
374
375 // record
376 DbpString("Starting recording");
377
378 // wait for button to be released
379 while(BUTTON_PRESS())
380 WDT_HIT();
381
382 /* need this delay to prevent catching some weird data */
383 SpinDelay(500);
384
385 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
386 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
387
388 LEDsoff();
389 LED(selected + 1, 0);
390 // Finished recording
391
392 // If we were previously playing, set playing off
393 // so next button push begins playing what we recorded
394 playing = 0;
3fe4ff4f 395
396 cardRead = 1;
397
398 }
399
400 else if (button_pressed > 0 && cardRead == 1)
401 {
402 LEDsoff();
403 LED(selected + 1, 0);
404 LED(LED_ORANGE, 0);
405
406 // record
407 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
408
409 // wait for button to be released
410 while(BUTTON_PRESS())
411 WDT_HIT();
412
413 /* need this delay to prevent catching some weird data */
414 SpinDelay(500);
415
416 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
417 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
418
419 LEDsoff();
420 LED(selected + 1, 0);
421 // Finished recording
422
423 // If we were previously playing, set playing off
424 // so next button push begins playing what we recorded
425 playing = 0;
426
427 cardRead = 0;
428
15c4dc5a 429 }
430
431 // Change where to record (or begin playing)
432 else if (button_pressed)
433 {
434 // Next option if we were previously playing
435 if (playing)
436 selected = (selected + 1) % OPTS;
437 playing = !playing;
438
439 LEDsoff();
440 LED(selected + 1, 0);
441
442 // Begin transmitting
443 if (playing)
444 {
445 LED(LED_GREEN, 0);
446 DbpString("Playing");
447 // wait for button to be released
448 while(BUTTON_PRESS())
449 WDT_HIT();
450 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
451 CmdHIDsimTAG(high[selected], low[selected], 0);
452 DbpString("Done playing");
453 if (BUTTON_HELD(1000) > 0)
454 {
455 DbpString("Exiting");
456 LEDsoff();
457 return;
458 }
459
460 /* We pressed a button so ignore it here with a delay */
461 SpinDelay(300);
462
463 // when done, we're done playing, move to next option
464 selected = (selected + 1) % OPTS;
465 playing = !playing;
466 LEDsoff();
467 LED(selected + 1, 0);
468 }
469 else
470 while(BUTTON_PRESS())
471 WDT_HIT();
472 }
473 }
474}
475#endif
476
477/*
478OBJECTIVE
479Listen and detect an external reader. Determine the best location
480for the antenna.
481
482INSTRUCTIONS:
483Inside the ListenReaderField() function, there is two mode.
484By default, when you call the function, you will enter mode 1.
485If you press the PM3 button one time, you will enter mode 2.
486If you press the PM3 button a second time, you will exit the function.
487
488DESCRIPTION OF MODE 1:
489This mode just listens for an external reader field and lights up green
490for HF and/or red for LF. This is the original mode of the detectreader
491function.
492
493DESCRIPTION OF MODE 2:
494This mode will visually represent, using the LEDs, the actual strength of the
495current compared to the maximum current detected. Basically, once you know
496what kind of external reader is present, it will help you spot the best location to place
497your antenna. You will probably not get some good results if there is a LF and a HF reader
498at the same place! :-)
499
500LIGHT SCHEME USED:
501*/
502static const char LIGHT_SCHEME[] = {
503 0x0, /* ---- | No field detected */
504 0x1, /* X--- | 14% of maximum current detected */
505 0x2, /* -X-- | 29% of maximum current detected */
506 0x4, /* --X- | 43% of maximum current detected */
507 0x8, /* ---X | 57% of maximum current detected */
508 0xC, /* --XX | 71% of maximum current detected */
509 0xE, /* -XXX | 86% of maximum current detected */
510 0xF, /* XXXX | 100% of maximum current detected */
511};
512static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
513
514void ListenReaderField(int limit)
515{
516 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
517 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
518 int mode=1, display_val, display_max, i;
519
520#define LF_ONLY 1
521#define HF_ONLY 2
522
523 LEDsoff();
524
525 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
526
527 if(limit != HF_ONLY) {
528 Dbprintf("LF 125/134 Baseline: %d", lf_av);
529 lf_baseline = lf_av;
530 }
531
532 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
533
534 if (limit != LF_ONLY) {
535 Dbprintf("HF 13.56 Baseline: %d", hf_av);
536 hf_baseline = hf_av;
537 }
538
539 for(;;) {
540 if (BUTTON_PRESS()) {
541 SpinDelay(500);
542 switch (mode) {
543 case 1:
544 mode=2;
545 DbpString("Signal Strength Mode");
546 break;
547 case 2:
548 default:
549 DbpString("Stopped");
550 LEDsoff();
551 return;
552 break;
553 }
554 }
555 WDT_HIT();
556
557 if (limit != HF_ONLY) {
558 if(mode==1) {
559 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
560 else LED_D_OFF();
561 }
e30c654b 562
15c4dc5a 563 ++lf_count;
564 lf_av_new= ReadAdc(ADC_CHAN_LF);
565 // see if there's a significant change
566 if(abs(lf_av - lf_av_new) > 10) {
567 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
568 lf_av = lf_av_new;
569 if (lf_av > lf_max)
570 lf_max = lf_av;
571 lf_count= 0;
572 }
573 }
574
575 if (limit != LF_ONLY) {
576 if (mode == 1){
577 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
578 else LED_B_OFF();
579 }
e30c654b 580
15c4dc5a 581 ++hf_count;
582 hf_av_new= ReadAdc(ADC_CHAN_HF);
583 // see if there's a significant change
584 if(abs(hf_av - hf_av_new) > 10) {
585 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
586 hf_av = hf_av_new;
587 if (hf_av > hf_max)
588 hf_max = hf_av;
589 hf_count= 0;
590 }
591 }
e30c654b 592
15c4dc5a 593 if(mode == 2) {
594 if (limit == LF_ONLY) {
595 display_val = lf_av;
596 display_max = lf_max;
597 } else if (limit == HF_ONLY) {
598 display_val = hf_av;
599 display_max = hf_max;
600 } else { /* Pick one at random */
601 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
602 display_val = hf_av;
603 display_max = hf_max;
604 } else {
605 display_val = lf_av;
606 display_max = lf_max;
607 }
608 }
609 for (i=0; i<LIGHT_LEN; i++) {
610 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
611 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
612 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
613 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
614 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
615 break;
616 }
617 }
618 }
619 }
620}
621
f7e3ed82 622void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 623{
624 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 625
902cb3c0 626// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
627
15c4dc5a 628 switch(c->cmd) {
629#ifdef WITH_LF
31abe49f
MHS
630 case CMD_SET_LF_SAMPLING_CONFIG:
631 setSamplingConfig((sample_config *) c->d.asBytes);
632 break;
15c4dc5a 633 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
31abe49f 634 cmd_send(CMD_ACK,SampleLF(),0,0,0,0);
15c4dc5a 635 break;
15c4dc5a 636 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
637 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
638 break;
b014c96d 639 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 640 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 641 break;
7e67e42f 642 case CMD_HID_DEMOD_FSK:
3fe4ff4f 643 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 644 break;
645 case CMD_HID_SIM_TAG:
3fe4ff4f 646 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 647 break;
3fe4ff4f 648 case CMD_HID_CLONE_TAG:
1c611bbd 649 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 650 break;
a1f3bb12 651 case CMD_IO_DEMOD_FSK:
3fe4ff4f 652 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 653 break;
3fe4ff4f 654 case CMD_IO_CLONE_TAG:
a1f3bb12 655 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
656 break;
66707a3b 657 case CMD_EM410X_DEMOD:
658 CmdEM410xdemod(c->arg[0], 0, 0, 1);
659 break;
2d4eae76 660 case CMD_EM410X_WRITE_TAG:
661 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
662 break;
7e67e42f 663 case CMD_READ_TI_TYPE:
664 ReadTItag();
665 break;
666 case CMD_WRITE_TI_TYPE:
667 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
668 break;
669 case CMD_SIMULATE_TAG_125K:
31d1caa5 670 LED_A_ON();
7e67e42f 671 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
31d1caa5 672 LED_A_OFF();
7e67e42f 673 break;
674 case CMD_LF_SIMULATE_BIDIR:
675 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
676 break;
3fe4ff4f 677 case CMD_INDALA_CLONE_TAG:
2414f978 678 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
679 break;
3fe4ff4f 680 case CMD_INDALA_CLONE_TAG_L:
2414f978 681 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
682 break;
1c611bbd 683 case CMD_T55XX_READ_BLOCK:
684 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
685 break;
686 case CMD_T55XX_WRITE_BLOCK:
687 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
688 break;
3fe4ff4f 689 case CMD_T55XX_READ_TRACE:
1c611bbd 690 T55xxReadTrace();
691 break;
3fe4ff4f 692 case CMD_PCF7931_READ:
1c611bbd 693 ReadPCF7931();
694 cmd_send(CMD_ACK,0,0,0,0,0);
1c611bbd 695 break;
696 case CMD_EM4X_READ_WORD:
697 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
698 break;
699 case CMD_EM4X_WRITE_WORD:
700 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
701 break;
15c4dc5a 702#endif
703
d19929cb 704#ifdef WITH_HITAG
705 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
706 SnoopHitag(c->arg[0]);
707 break;
708 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
709 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
710 break;
711 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
712 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
713 break;
714#endif
715
15c4dc5a 716#ifdef WITH_ISO15693
717 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
718 AcquireRawAdcSamplesIso15693();
719 break;
9455b51c 720 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
721 RecordRawAdcSamplesIso15693();
722 break;
723
724 case CMD_ISO_15693_COMMAND:
725 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
726 break;
727
728 case CMD_ISO_15693_FIND_AFI:
729 BruteforceIso15693Afi(c->arg[0]);
730 break;
731
732 case CMD_ISO_15693_DEBUG:
733 SetDebugIso15693(c->arg[0]);
734 break;
15c4dc5a 735
15c4dc5a 736 case CMD_READER_ISO_15693:
737 ReaderIso15693(c->arg[0]);
738 break;
7e67e42f 739 case CMD_SIMTAG_ISO_15693:
3fe4ff4f 740 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 741 break;
15c4dc5a 742#endif
743
7e67e42f 744#ifdef WITH_LEGICRF
745 case CMD_SIMULATE_TAG_LEGIC_RF:
746 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
747 break;
3612a8a8 748
7e67e42f 749 case CMD_WRITER_LEGIC_RF:
750 LegicRfWriter(c->arg[1], c->arg[0]);
751 break;
3612a8a8 752
15c4dc5a 753 case CMD_READER_LEGIC_RF:
754 LegicRfReader(c->arg[0], c->arg[1]);
755 break;
15c4dc5a 756#endif
757
758#ifdef WITH_ISO14443b
759 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
760 AcquireRawAdcSamplesIso14443(c->arg[0]);
761 break;
15c4dc5a 762 case CMD_READ_SRI512_TAG:
7cf3ef20 763 ReadSTMemoryIso14443(0x0F);
15c4dc5a 764 break;
7e67e42f 765 case CMD_READ_SRIX4K_TAG:
7cf3ef20 766 ReadSTMemoryIso14443(0x7F);
7e67e42f 767 break;
768 case CMD_SNOOP_ISO_14443:
769 SnoopIso14443();
770 break;
771 case CMD_SIMULATE_TAG_ISO_14443:
772 SimulateIso14443Tag();
773 break;
7cf3ef20 774 case CMD_ISO_14443B_COMMAND:
775 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
776 break;
15c4dc5a 777#endif
778
779#ifdef WITH_ISO14443a
7e67e42f 780 case CMD_SNOOP_ISO_14443a:
5cd9ec01 781 SnoopIso14443a(c->arg[0]);
7e67e42f 782 break;
15c4dc5a 783 case CMD_READER_ISO_14443a:
902cb3c0 784 ReaderIso14443a(c);
15c4dc5a 785 break;
7e67e42f 786 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 787 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 788 break;
3fe4ff4f 789
5acd09bd 790 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 791 EPA_PACE_Collect_Nonce(c);
5acd09bd 792 break;
7e67e42f 793
15c4dc5a 794 case CMD_READER_MIFARE:
1c611bbd 795 ReaderMifare(c->arg[0]);
15c4dc5a 796 break;
20f9a2a1
M
797 case CMD_MIFARE_READBL:
798 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
799 break;
981bd429 800 case CMD_MIFAREU_READBL:
801 MifareUReadBlock(c->arg[0],c->d.asBytes);
802 break;
a631936e 803 case CMD_MIFAREUC_AUTH1:
804 MifareUC_Auth1(c->arg[0],c->d.asBytes);
805 break;
806 case CMD_MIFAREUC_AUTH2:
807 MifareUC_Auth2(c->arg[0],c->d.asBytes);
808 break;
981bd429 809 case CMD_MIFAREU_READCARD:
31d1caa5 810 MifareUReadCard(c->arg[0], c->arg[1], c->d.asBytes);
117d9ec2 811 break;
a631936e 812 case CMD_MIFAREUC_READCARD:
117d9ec2 813 MifareUReadCard(c->arg[0], c->arg[1], c->d.asBytes);
814 break;
20f9a2a1
M
815 case CMD_MIFARE_READSC:
816 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
817 break;
818 case CMD_MIFARE_WRITEBL:
819 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
820 break;
981bd429 821 case CMD_MIFAREU_WRITEBL_COMPAT:
822 MifareUWriteBlock(c->arg[0], c->d.asBytes);
823 break;
824 case CMD_MIFAREU_WRITEBL:
825 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
826 break;
20f9a2a1
M
827 case CMD_MIFARE_NESTED:
828 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
829 break;
830 case CMD_MIFARE_CHKKEYS:
831 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
832 break;
833 case CMD_SIMULATE_MIFARE_CARD:
834 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
835 break;
8556b852
M
836
837 // emulator
838 case CMD_MIFARE_SET_DBGMODE:
839 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
840 break;
841 case CMD_MIFARE_EML_MEMCLR:
842 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
843 break;
844 case CMD_MIFARE_EML_MEMSET:
845 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
846 break;
847 case CMD_MIFARE_EML_MEMGET:
848 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
849 break;
850 case CMD_MIFARE_EML_CARDLOAD:
851 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
852 break;
853
854 // Work with "magic Chinese" card
3fe4ff4f 855 case CMD_MIFARE_CSETBLOCK:
0675f200 856 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 857 break;
3fe4ff4f 858 case CMD_MIFARE_CGETBLOCK:
545a1f38 859 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 860 break;
3fe4ff4f 861 case CMD_MIFARE_CIDENT:
862 MifareCIdent();
863 break;
b62a5a84
M
864
865 // mifare sniffer
866 case CMD_MIFARE_SNIFFER:
5cd9ec01 867 SniffMifare(c->arg[0]);
b62a5a84 868 break;
a631936e 869
20f9a2a1
M
870#endif
871
7e67e42f 872#ifdef WITH_ICLASS
cee5a30d 873 // Makes use of ISO14443a FPGA Firmware
874 case CMD_SNOOP_ICLASS:
875 SnoopIClass();
876 break;
1e262141 877 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 878 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 879 break;
880 case CMD_READER_ICLASS:
881 ReaderIClass(c->arg[0]);
882 break;
c3963755 883 case CMD_READER_ICLASS_REPLAY:
fecd8202 884 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 885 break;
cee5a30d 886#endif
887
15c4dc5a 888 case CMD_SIMULATE_TAG_HF_LISTEN:
889 SimulateTagHfListen();
890 break;
891
7e67e42f 892 case CMD_BUFF_CLEAR:
117d9ec2 893 BigBuf_Clear();
15c4dc5a 894 break;
15c4dc5a 895
896 case CMD_MEASURE_ANTENNA_TUNING:
897 MeasureAntennaTuning();
898 break;
899
900 case CMD_MEASURE_ANTENNA_TUNING_HF:
901 MeasureAntennaTuningHf();
902 break;
903
904 case CMD_LISTEN_READER_FIELD:
905 ListenReaderField(c->arg[0]);
906 break;
907
15c4dc5a 908 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
909 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
910 SpinDelay(200);
911 LED_D_OFF(); // LED D indicates field ON or OFF
912 break;
913
1c611bbd 914 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 915
1c611bbd 916 LED_B_ON();
117d9ec2 917 uint8_t *BigBuf = BigBuf_get_addr();
1c611bbd 918 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
919 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 920 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 921 }
922 // Trigger a finish downloading signal with an ACK frame
3000dc4e 923 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 924 LED_B_OFF();
1c611bbd 925 break;
15c4dc5a 926
927 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
117d9ec2 928 uint8_t *b = BigBuf_get_addr();
3fe4ff4f 929 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 930 cmd_send(CMD_ACK,0,0,0,0,0);
931 break;
932 }
15c4dc5a 933 case CMD_READ_MEM:
934 ReadMem(c->arg[0]);
935 break;
936
937 case CMD_SET_LF_DIVISOR:
7cc204bf 938 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 939 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
940 break;
941
942 case CMD_SET_ADC_MUX:
943 switch(c->arg[0]) {
944 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
945 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
946 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
947 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
948 }
949 break;
950
951 case CMD_VERSION:
952 SendVersion();
953 break;
954
15c4dc5a 955#ifdef WITH_LCD
956 case CMD_LCD_RESET:
957 LCDReset();
958 break;
959 case CMD_LCD:
960 LCDSend(c->arg[0]);
961 break;
962#endif
963 case CMD_SETUP_WRITE:
964 case CMD_FINISH_WRITE:
1c611bbd 965 case CMD_HARDWARE_RESET:
966 usb_disable();
15c4dc5a 967 SpinDelay(1000);
968 SpinDelay(1000);
969 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
970 for(;;) {
971 // We're going to reset, and the bootrom will take control.
972 }
1c611bbd 973 break;
15c4dc5a 974
1c611bbd 975 case CMD_START_FLASH:
15c4dc5a 976 if(common_area.flags.bootrom_present) {
977 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
978 }
1c611bbd 979 usb_disable();
15c4dc5a 980 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
981 for(;;);
1c611bbd 982 break;
e30c654b 983
15c4dc5a 984 case CMD_DEVICE_INFO: {
902cb3c0 985 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
986 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 987 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
988 break;
989 }
990 default:
15c4dc5a 991 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 992 break;
15c4dc5a 993 }
994}
995
996void __attribute__((noreturn)) AppMain(void)
997{
998 SpinDelay(100);
9e8255d4 999 clear_trace();
15c4dc5a 1000 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1001 /* Initialize common area */
1002 memset(&common_area, 0, sizeof(common_area));
1003 common_area.magic = COMMON_AREA_MAGIC;
1004 common_area.version = 1;
1005 }
1006 common_area.flags.osimage_present = 1;
1007
1008 LED_D_OFF();
1009 LED_C_OFF();
1010 LED_B_OFF();
1011 LED_A_OFF();
1012
3fe4ff4f 1013 // Init USB device
902cb3c0 1014 usb_enable();
15c4dc5a 1015
1016 // The FPGA gets its clock from us from PCK0 output, so set that up.
1017 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1018 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1019 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1020 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1021 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1022 AT91C_PMC_PRES_CLK_4;
1023 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1024
1025 // Reset SPI
1026 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1027 // Reset SSC
1028 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1029
1030 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1031 // (the HF version by default)
1032 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1033
9ca155ba 1034 StartTickCount();
902cb3c0 1035
15c4dc5a 1036#ifdef WITH_LCD
15c4dc5a 1037 LCDInit();
15c4dc5a 1038#endif
1039
902cb3c0 1040 byte_t rx[sizeof(UsbCommand)];
1041 size_t rx_len;
1042
15c4dc5a 1043 for(;;) {
902cb3c0 1044 if (usb_poll()) {
1045 rx_len = usb_read(rx,sizeof(UsbCommand));
1046 if (rx_len) {
1047 UsbPacketReceived(rx,rx_len);
1048 }
1049 }
15c4dc5a 1050 WDT_HIT();
1051
1052#ifdef WITH_LF
1053 if (BUTTON_HELD(1000) > 0)
1054 SamyRun();
1055#endif
1056 }
1057}
Impressum, Datenschutz