]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
ADD: midnitesnakes desfire, ultralight changes from Unstable branch.
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
f38a1528 13#include "../common/usb_cdc.h"
14#include "../common/cmd.h"
902cb3c0 15
f38a1528 16#include "../include/proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
9ab7a6c7 21#include <stdarg.h>
f7e3ed82 22
f6c18637 23
15c4dc5a 24#include "legicrf.h"
f38a1528 25#include "../include/hitag2.h"
f7e3ed82 26
72e930ef 27
15c4dc5a 28#ifdef WITH_LCD
902cb3c0 29 #include "LCD.h"
15c4dc5a 30#endif
31
15c4dc5a 32#define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34//=============================================================================
35// A buffer where we can queue things up to be sent through the FPGA, for
36// any purpose (fake tag, as reader, whatever). We go MSB first, since that
37// is the order in which they go out on the wire.
38//=============================================================================
39
a501c82b 40#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 42int ToSendMax;
43static int ToSendBit;
44struct common_area common_area __attribute__((section(".commonarea")));
45
46void BufferClear(void)
47{
48 memset(BigBuf,0,sizeof(BigBuf));
49 Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
50}
51
52void ToSendReset(void)
53{
54 ToSendMax = -1;
55 ToSendBit = 8;
56}
57
58void ToSendStuffBit(int b)
59{
60 if(ToSendBit >= 8) {
61 ToSendMax++;
62 ToSend[ToSendMax] = 0;
63 ToSendBit = 0;
64 }
65
66 if(b) {
67 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
68 }
69
70 ToSendBit++;
71
a501c82b 72 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76}
77
78//=============================================================================
79// Debug print functions, to go out over USB, to the usual PC-side client.
80//=============================================================================
81
82void DbpString(char *str)
83{
9440213d 84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 86}
87
88#if 0
89void DbpIntegers(int x1, int x2, int x3)
90{
902cb3c0 91 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 92}
93#endif
94
95void Dbprintf(const char *fmt, ...) {
96// should probably limit size here; oh well, let's just use a big buffer
97 char output_string[128];
98 va_list ap;
99
100 va_start(ap, fmt);
101 kvsprintf(fmt, output_string, 10, ap);
102 va_end(ap);
e30c654b 103
15c4dc5a 104 DbpString(output_string);
105}
106
9455b51c 107// prints HEX & ASCII
d19929cb 108void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 109 int l=0,i;
110 char ascii[9];
d19929cb 111
9455b51c 112 while (len>0) {
113 if (len>8) l=8;
114 else l=len;
115
116 memcpy(ascii,d,l);
d19929cb 117 ascii[l]=0;
9455b51c 118
119 // filter safe ascii
d19929cb 120 for (i=0;i<l;i++)
9455b51c 121 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 122
123 if (bAsci) {
124 Dbprintf("%-8s %*D",ascii,l,d," ");
125 } else {
126 Dbprintf("%*D",l,d," ");
127 }
128
9455b51c 129 len-=8;
130 d+=8;
131 }
132}
133
15c4dc5a 134//-----------------------------------------------------------------------------
135// Read an ADC channel and block till it completes, then return the result
136// in ADC units (0 to 1023). Also a routine to average 32 samples and
137// return that.
138//-----------------------------------------------------------------------------
139static int ReadAdc(int ch)
140{
f7e3ed82 141 uint32_t d;
15c4dc5a 142
143 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
144 AT91C_BASE_ADC->ADC_MR =
145 ADC_MODE_PRESCALE(32) |
146 ADC_MODE_STARTUP_TIME(16) |
147 ADC_MODE_SAMPLE_HOLD_TIME(8);
148 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
149
150 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
151 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
152 ;
153 d = AT91C_BASE_ADC->ADC_CDR[ch];
154
155 return d;
156}
157
9ca155ba 158int AvgAdc(int ch) // was static - merlok
15c4dc5a 159{
160 int i;
161 int a = 0;
162
163 for(i = 0; i < 32; i++) {
164 a += ReadAdc(ch);
165 }
166
167 return (a + 15) >> 5;
168}
169
170void MeasureAntennaTuning(void)
171{
d3499d36 172 uint8_t LF_Results[256];
9f693930 173 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 174 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
175
d19929cb 176 LED_B_ON();
15c4dc5a 177
178/*
179 * Sweeps the useful LF range of the proxmark from
180 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
181 * read the voltage in the antenna, the result left
182 * in the buffer is a graph which should clearly show
183 * the resonating frequency of your LF antenna
184 * ( hopefully around 95 if it is tuned to 125kHz!)
185 */
d19929cb 186
7cc204bf 187 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 188 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
d3499d36 189 for (i=255; i>=19; i--) {
d19929cb 190 WDT_HIT();
15c4dc5a 191 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
192 SpinDelay(20);
193 // Vref = 3.3V, and a 10000:240 voltage divider on the input
194 // can measure voltages up to 137500 mV
195 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
196 if (i==95) vLf125 = adcval; // voltage at 125Khz
197 if (i==89) vLf134 = adcval; // voltage at 134Khz
198
d3499d36 199 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
200 if(LF_Results[i] > peak) {
15c4dc5a 201 peakv = adcval;
d3499d36 202 peak = LF_Results[i];
15c4dc5a 203 peakf = i;
9f693930 204 //ptr = i;
15c4dc5a 205 }
206 }
207
d3499d36 208 for (i=18; i >= 0; i--) LF_Results[i] = 0;
209
d19929cb 210 LED_A_ON();
15c4dc5a 211 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 212 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 213 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
214 SpinDelay(20);
215 // Vref = 3300mV, and an 10:1 voltage divider on the input
216 // can measure voltages up to 33000 mV
217 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
218
d3499d36 219 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),LF_Results,256);
d19929cb 220 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
221 LED_A_OFF();
222 LED_B_OFF();
223 return;
15c4dc5a 224}
225
226void MeasureAntennaTuningHf(void)
227{
228 int vHf = 0; // in mV
229
230 DbpString("Measuring HF antenna, press button to exit");
231
232 for (;;) {
233 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 234 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 235 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
236 SpinDelay(20);
237 // Vref = 3300mV, and an 10:1 voltage divider on the input
238 // can measure voltages up to 33000 mV
239 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 240
15c4dc5a 241 Dbprintf("%d mV",vHf);
242 if (BUTTON_PRESS()) break;
243 }
244 DbpString("cancelled");
245}
246
247
248void SimulateTagHfListen(void)
249{
d19929cb 250 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
f7e3ed82 251 uint8_t v = 0;
15c4dc5a 252 int i;
253 int p = 0;
254
255 // We're using this mode just so that I can test it out; the simulated
256 // tag mode would work just as well and be simpler.
7cc204bf 257 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 258 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
259
260 // We need to listen to the high-frequency, peak-detected path.
261 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
262
263 FpgaSetupSsc();
264
265 i = 0;
266 for(;;) {
267 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
268 AT91C_BASE_SSC->SSC_THR = 0xff;
269 }
270 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 271 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 272
273 v <<= 1;
274 if(r & 1) {
275 v |= 1;
276 }
277 p++;
278
279 if(p >= 8) {
280 dest[i] = v;
281 v = 0;
282 p = 0;
283 i++;
284
d19929cb 285 if(i >= FREE_BUFFER_SIZE) {
15c4dc5a 286 break;
287 }
288 }
289 }
290 }
291 DbpString("simulate tag (now type bitsamples)");
292}
293
294void ReadMem(int addr)
295{
f7e3ed82 296 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 297
298 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
299 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
300}
301
302/* osimage version information is linked in */
303extern struct version_information version_information;
304/* bootrom version information is pointed to from _bootphase1_version_pointer */
305extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
306void SendVersion(void)
307{
95e63594 308 char temp[512]; /* Limited data payload in USB packets */
15c4dc5a 309 DbpString("Prox/RFID mark3 RFID instrument");
e30c654b 310
311 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 312 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
313 * pointer, then use it.
314 */
315 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
316 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
317 DbpString("bootrom version information appears invalid");
318 } else {
319 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
320 DbpString(temp);
321 }
e30c654b 322
15c4dc5a 323 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
324 DbpString(temp);
e30c654b 325
15c4dc5a 326 FpgaGatherVersion(temp, sizeof(temp));
327 DbpString(temp);
4f269f63 328 // Send Chip ID
329 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
15c4dc5a 330}
331
332#ifdef WITH_LF
333// samy's sniff and repeat routine
334void SamyRun()
335{
336 DbpString("Stand-alone mode! No PC necessary.");
7cc204bf 337 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 338
339 // 3 possible options? no just 2 for now
340#define OPTS 2
341
342 int high[OPTS], low[OPTS];
343
344 // Oooh pretty -- notify user we're in elite samy mode now
345 LED(LED_RED, 200);
346 LED(LED_ORANGE, 200);
347 LED(LED_GREEN, 200);
348 LED(LED_ORANGE, 200);
349 LED(LED_RED, 200);
350 LED(LED_ORANGE, 200);
351 LED(LED_GREEN, 200);
352 LED(LED_ORANGE, 200);
353 LED(LED_RED, 200);
354
355 int selected = 0;
356 int playing = 0;
72e930ef 357 int cardRead = 0;
15c4dc5a 358
359 // Turn on selected LED
360 LED(selected + 1, 0);
361
362 for (;;)
363 {
6e82300d 364 usb_poll();
95e63594 365 WDT_HIT();
15c4dc5a 366
367 // Was our button held down or pressed?
368 int button_pressed = BUTTON_HELD(1000);
369 SpinDelay(300);
370
371 // Button was held for a second, begin recording
72e930ef 372 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 373 {
374 LEDsoff();
375 LED(selected + 1, 0);
376 LED(LED_RED2, 0);
377
378 // record
379 DbpString("Starting recording");
380
381 // wait for button to be released
382 while(BUTTON_PRESS())
383 WDT_HIT();
384
385 /* need this delay to prevent catching some weird data */
386 SpinDelay(500);
387
388 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
389 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
390
391 LEDsoff();
392 LED(selected + 1, 0);
393 // Finished recording
394
395 // If we were previously playing, set playing off
396 // so next button push begins playing what we recorded
397 playing = 0;
72e930ef 398
399 cardRead = 1;
400
401 }
402
403 else if (button_pressed > 0 && cardRead == 1)
404 {
405 LEDsoff();
406 LED(selected + 1, 0);
407 LED(LED_ORANGE, 0);
408
409 // record
410 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
411
412 // wait for button to be released
413 while(BUTTON_PRESS())
414 WDT_HIT();
415
416 /* need this delay to prevent catching some weird data */
417 SpinDelay(500);
418
419 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
420 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
421
422 LEDsoff();
423 LED(selected + 1, 0);
424 // Finished recording
425
426 // If we were previously playing, set playing off
427 // so next button push begins playing what we recorded
428 playing = 0;
429
430 cardRead = 0;
431
15c4dc5a 432 }
433
434 // Change where to record (or begin playing)
435 else if (button_pressed)
436 {
437 // Next option if we were previously playing
438 if (playing)
439 selected = (selected + 1) % OPTS;
440 playing = !playing;
441
442 LEDsoff();
443 LED(selected + 1, 0);
444
445 // Begin transmitting
446 if (playing)
447 {
448 LED(LED_GREEN, 0);
449 DbpString("Playing");
450 // wait for button to be released
451 while(BUTTON_PRESS())
452 WDT_HIT();
453 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
454 CmdHIDsimTAG(high[selected], low[selected], 0);
455 DbpString("Done playing");
456 if (BUTTON_HELD(1000) > 0)
457 {
458 DbpString("Exiting");
459 LEDsoff();
460 return;
461 }
462
463 /* We pressed a button so ignore it here with a delay */
464 SpinDelay(300);
465
466 // when done, we're done playing, move to next option
467 selected = (selected + 1) % OPTS;
468 playing = !playing;
469 LEDsoff();
470 LED(selected + 1, 0);
471 }
472 else
473 while(BUTTON_PRESS())
474 WDT_HIT();
475 }
476 }
477}
478#endif
479
480/*
481OBJECTIVE
482Listen and detect an external reader. Determine the best location
483for the antenna.
484
485INSTRUCTIONS:
486Inside the ListenReaderField() function, there is two mode.
487By default, when you call the function, you will enter mode 1.
488If you press the PM3 button one time, you will enter mode 2.
489If you press the PM3 button a second time, you will exit the function.
490
491DESCRIPTION OF MODE 1:
492This mode just listens for an external reader field and lights up green
493for HF and/or red for LF. This is the original mode of the detectreader
494function.
495
496DESCRIPTION OF MODE 2:
497This mode will visually represent, using the LEDs, the actual strength of the
498current compared to the maximum current detected. Basically, once you know
499what kind of external reader is present, it will help you spot the best location to place
500your antenna. You will probably not get some good results if there is a LF and a HF reader
501at the same place! :-)
502
503LIGHT SCHEME USED:
504*/
505static const char LIGHT_SCHEME[] = {
506 0x0, /* ---- | No field detected */
507 0x1, /* X--- | 14% of maximum current detected */
508 0x2, /* -X-- | 29% of maximum current detected */
509 0x4, /* --X- | 43% of maximum current detected */
510 0x8, /* ---X | 57% of maximum current detected */
511 0xC, /* --XX | 71% of maximum current detected */
512 0xE, /* -XXX | 86% of maximum current detected */
513 0xF, /* XXXX | 100% of maximum current detected */
514};
515static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
516
517void ListenReaderField(int limit)
518{
519 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
520 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
521 int mode=1, display_val, display_max, i;
522
523#define LF_ONLY 1
524#define HF_ONLY 2
525
526 LEDsoff();
527
528 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
529
530 if(limit != HF_ONLY) {
531 Dbprintf("LF 125/134 Baseline: %d", lf_av);
532 lf_baseline = lf_av;
533 }
534
535 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
536
537 if (limit != LF_ONLY) {
538 Dbprintf("HF 13.56 Baseline: %d", hf_av);
539 hf_baseline = hf_av;
540 }
541
542 for(;;) {
543 if (BUTTON_PRESS()) {
544 SpinDelay(500);
545 switch (mode) {
546 case 1:
547 mode=2;
548 DbpString("Signal Strength Mode");
549 break;
550 case 2:
551 default:
552 DbpString("Stopped");
553 LEDsoff();
554 return;
555 break;
556 }
557 }
558 WDT_HIT();
559
560 if (limit != HF_ONLY) {
561 if(mode==1) {
562 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
563 else LED_D_OFF();
564 }
e30c654b 565
15c4dc5a 566 ++lf_count;
567 lf_av_new= ReadAdc(ADC_CHAN_LF);
568 // see if there's a significant change
569 if(abs(lf_av - lf_av_new) > 10) {
570 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
571 lf_av = lf_av_new;
572 if (lf_av > lf_max)
573 lf_max = lf_av;
574 lf_count= 0;
575 }
576 }
577
578 if (limit != LF_ONLY) {
579 if (mode == 1){
580 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
581 else LED_B_OFF();
582 }
e30c654b 583
15c4dc5a 584 ++hf_count;
585 hf_av_new= ReadAdc(ADC_CHAN_HF);
586 // see if there's a significant change
587 if(abs(hf_av - hf_av_new) > 10) {
588 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
589 hf_av = hf_av_new;
590 if (hf_av > hf_max)
591 hf_max = hf_av;
592 hf_count= 0;
593 }
594 }
e30c654b 595
15c4dc5a 596 if(mode == 2) {
597 if (limit == LF_ONLY) {
598 display_val = lf_av;
599 display_max = lf_max;
600 } else if (limit == HF_ONLY) {
601 display_val = hf_av;
602 display_max = hf_max;
603 } else { /* Pick one at random */
604 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
605 display_val = hf_av;
606 display_max = hf_max;
607 } else {
608 display_val = lf_av;
609 display_max = lf_max;
610 }
611 }
612 for (i=0; i<LIGHT_LEN; i++) {
613 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
614 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
615 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
616 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
617 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
618 break;
619 }
620 }
621 }
622 }
623}
624
f7e3ed82 625void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 626{
627 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 628
313ee67e 629 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
902cb3c0 630
15c4dc5a 631 switch(c->cmd) {
632#ifdef WITH_LF
633 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
634 AcquireRawAdcSamples125k(c->arg[0]);
1c611bbd 635 cmd_send(CMD_ACK,0,0,0,0,0);
15c4dc5a 636 break;
15c4dc5a 637 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
638 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
639 break;
b014c96d 640 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
641 SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
642 cmd_send(CMD_ACK,0,0,0,0,0);
643 break;
7e67e42f 644 case CMD_HID_DEMOD_FSK:
a501c82b 645 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 646 break;
647 case CMD_HID_SIM_TAG:
a501c82b 648 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 649 break;
a501c82b 650 case CMD_HID_CLONE_TAG:
1c611bbd 651 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 652 break;
a1f3bb12 653 case CMD_IO_DEMOD_FSK:
a501c82b 654 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 655 break;
a501c82b 656 case CMD_IO_CLONE_TAG:
a1f3bb12 657 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
658 break;
6ff6ade2 659 case CMD_EM410X_DEMOD:
660 CmdEM410xdemod(c->arg[0], 0, 0, 1);
661 break;
2d4eae76 662 case CMD_EM410X_WRITE_TAG:
663 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
664 break;
7e67e42f 665 case CMD_READ_TI_TYPE:
666 ReadTItag();
667 break;
668 case CMD_WRITE_TI_TYPE:
669 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
670 break;
671 case CMD_SIMULATE_TAG_125K:
a61b4976 672 SimulateTagLowFrequency(c->arg[0], c->arg[1], 0);
a501c82b 673 //SimulateTagLowFrequencyA(c->arg[0], c->arg[1]);
7e67e42f 674 break;
675 case CMD_LF_SIMULATE_BIDIR:
676 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
677 break;
a501c82b 678 case CMD_INDALA_CLONE_TAG:
2414f978 679 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
680 break;
a501c82b 681 case CMD_INDALA_CLONE_TAG_L:
2414f978 682 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
683 break;
1c611bbd 684 case CMD_T55XX_READ_BLOCK:
685 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
686 break;
687 case CMD_T55XX_WRITE_BLOCK:
688 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
689 break;
a501c82b 690 case CMD_T55XX_READ_TRACE:
1c611bbd 691 T55xxReadTrace();
692 break;
a501c82b 693 case CMD_PCF7931_READ:
1c611bbd 694 ReadPCF7931();
695 cmd_send(CMD_ACK,0,0,0,0,0);
1c611bbd 696 break;
697 case CMD_EM4X_READ_WORD:
698 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
699 break;
700 case CMD_EM4X_WRITE_WORD:
701 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
702 break;
15c4dc5a 703#endif
704
d19929cb 705#ifdef WITH_HITAG
706 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
707 SnoopHitag(c->arg[0]);
708 break;
709 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
710 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
711 break;
712 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
713 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
714 break;
715#endif
716
15c4dc5a 717#ifdef WITH_ISO15693
718 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
719 AcquireRawAdcSamplesIso15693();
720 break;
9455b51c 721 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
722 RecordRawAdcSamplesIso15693();
723 break;
724
725 case CMD_ISO_15693_COMMAND:
726 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
727 break;
728
729 case CMD_ISO_15693_FIND_AFI:
730 BruteforceIso15693Afi(c->arg[0]);
731 break;
732
733 case CMD_ISO_15693_DEBUG:
734 SetDebugIso15693(c->arg[0]);
735 break;
15c4dc5a 736
15c4dc5a 737 case CMD_READER_ISO_15693:
738 ReaderIso15693(c->arg[0]);
739 break;
7e67e42f 740 case CMD_SIMTAG_ISO_15693:
3649b640 741 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 742 break;
15c4dc5a 743#endif
744
7e67e42f 745#ifdef WITH_LEGICRF
746 case CMD_SIMULATE_TAG_LEGIC_RF:
747 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
748 break;
3612a8a8 749
7e67e42f 750 case CMD_WRITER_LEGIC_RF:
751 LegicRfWriter(c->arg[1], c->arg[0]);
752 break;
3612a8a8 753
15c4dc5a 754 case CMD_READER_LEGIC_RF:
755 LegicRfReader(c->arg[0], c->arg[1]);
756 break;
15c4dc5a 757#endif
758
759#ifdef WITH_ISO14443b
760 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
761 AcquireRawAdcSamplesIso14443(c->arg[0]);
762 break;
15c4dc5a 763 case CMD_READ_SRI512_TAG:
7cf3ef20 764 ReadSTMemoryIso14443(0x0F);
15c4dc5a 765 break;
7e67e42f 766 case CMD_READ_SRIX4K_TAG:
7cf3ef20 767 ReadSTMemoryIso14443(0x7F);
7e67e42f 768 break;
769 case CMD_SNOOP_ISO_14443:
770 SnoopIso14443();
771 break;
772 case CMD_SIMULATE_TAG_ISO_14443:
773 SimulateIso14443Tag();
774 break;
7cf3ef20 775 case CMD_ISO_14443B_COMMAND:
776 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
777 break;
15c4dc5a 778#endif
779
780#ifdef WITH_ISO14443a
7e67e42f 781 case CMD_SNOOP_ISO_14443a:
5cd9ec01 782 SnoopIso14443a(c->arg[0]);
7e67e42f 783 break;
15c4dc5a 784 case CMD_READER_ISO_14443a:
902cb3c0 785 ReaderIso14443a(c);
15c4dc5a 786 break;
7e67e42f 787 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 788 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 789 break;
95e63594 790
5acd09bd 791 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 792 EPA_PACE_Collect_Nonce(c);
5acd09bd 793 break;
7e67e42f 794
95e63594 795 // case CMD_EPA_:
796 // EpaFoo(c);
797 // break;
798
15c4dc5a 799 case CMD_READER_MIFARE:
1c611bbd 800 ReaderMifare(c->arg[0]);
15c4dc5a 801 break;
20f9a2a1
M
802 case CMD_MIFARE_READBL:
803 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
804 break;
981bd429 805 case CMD_MIFAREU_READBL:
806 MifareUReadBlock(c->arg[0],c->d.asBytes);
807 break;
f38a1528 808 case CMD_MIFAREUC_AUTH1:
809 MifareUC_Auth1(c->arg[0],c->d.asBytes);
810 break;
811 case CMD_MIFAREUC_AUTH2:
812 MifareUC_Auth2(c->arg[0],c->d.asBytes);
813 break;
981bd429 814 case CMD_MIFAREU_READCARD:
f38a1528 815 MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
816 break;
817 case CMD_MIFAREUC_READCARD:
818 MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
981bd429 819 break;
20f9a2a1
M
820 case CMD_MIFARE_READSC:
821 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
822 break;
823 case CMD_MIFARE_WRITEBL:
824 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
825 break;
981bd429 826 case CMD_MIFAREU_WRITEBL_COMPAT:
827 MifareUWriteBlock(c->arg[0], c->d.asBytes);
828 break;
829 case CMD_MIFAREU_WRITEBL:
830 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
831 break;
20f9a2a1
M
832 case CMD_MIFARE_NESTED:
833 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
834 break;
835 case CMD_MIFARE_CHKKEYS:
836 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
837 break;
838 case CMD_SIMULATE_MIFARE_CARD:
839 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
840 break;
8556b852
M
841
842 // emulator
843 case CMD_MIFARE_SET_DBGMODE:
844 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
845 break;
846 case CMD_MIFARE_EML_MEMCLR:
847 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
848 break;
849 case CMD_MIFARE_EML_MEMSET:
850 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
851 break;
852 case CMD_MIFARE_EML_MEMGET:
853 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
854 break;
855 case CMD_MIFARE_EML_CARDLOAD:
856 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
857 break;
858
859 // Work with "magic Chinese" card
d52e4e88 860 case CMD_MIFARE_CSETBLOCK:
0675f200 861 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 862 break;
d52e4e88 863 case CMD_MIFARE_CGETBLOCK:
545a1f38 864 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 865 break;
d52e4e88 866 case CMD_MIFARE_CIDENT:
867 MifareCIdent();
868 break;
b62a5a84
M
869
870 // mifare sniffer
871 case CMD_MIFARE_SNIFFER:
5cd9ec01 872 SniffMifare(c->arg[0]);
b62a5a84 873 break;
f38a1528 874
875 // mifare desfire
876 case CMD_MIFARE_DESFIRE_READBL:
877 break;
878 case CMD_MIFARE_DESFIRE_WRITEBL:
879 break;
880 case CMD_MIFARE_DESFIRE_AUTH1:
881 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
882 break;
883 case CMD_MIFARE_DESFIRE_AUTH2:
f6c18637 884 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
f38a1528 885 break;
886 // case CMD_MIFARE_DES_READER:
887 // ReaderMifareDES(c->arg[0], c->arg[1], c->d.asBytes);
313ee67e 888 //break;
f38a1528 889 case CMD_MIFARE_DESFIRE_INFO:
890 MifareDesfireGetInformation();
891 break;
313ee67e 892 case CMD_MIFARE_DESFIRE:
893 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
894 break;
895
20f9a2a1
M
896#endif
897
7e67e42f 898#ifdef WITH_ICLASS
cee5a30d 899 // Makes use of ISO14443a FPGA Firmware
900 case CMD_SNOOP_ICLASS:
901 SnoopIClass();
902 break;
1e262141 903 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 904 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 905 break;
906 case CMD_READER_ICLASS:
907 ReaderIClass(c->arg[0]);
908 break;
f38a1528 909 case CMD_READER_ICLASS_REPLAY:
910 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
911 break;
cee5a30d 912#endif
913
15c4dc5a 914 case CMD_SIMULATE_TAG_HF_LISTEN:
915 SimulateTagHfListen();
916 break;
917
7e67e42f 918 case CMD_BUFF_CLEAR:
919 BufferClear();
15c4dc5a 920 break;
15c4dc5a 921
922 case CMD_MEASURE_ANTENNA_TUNING:
923 MeasureAntennaTuning();
924 break;
925
926 case CMD_MEASURE_ANTENNA_TUNING_HF:
927 MeasureAntennaTuningHf();
928 break;
929
930 case CMD_LISTEN_READER_FIELD:
931 ListenReaderField(c->arg[0]);
932 break;
933
15c4dc5a 934 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
935 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
936 SpinDelay(200);
937 LED_D_OFF(); // LED D indicates field ON or OFF
938 break;
939
1c611bbd 940 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 941
1c611bbd 942 LED_B_ON();
943 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
944 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
945 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
946 }
947 // Trigger a finish downloading signal with an ACK frame
948 cmd_send(CMD_ACK,0,0,0,0,0);
d3b1f4e4 949 LED_B_OFF();
1c611bbd 950 break;
15c4dc5a 951
952 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
f7e3ed82 953 uint8_t *b = (uint8_t *)BigBuf;
7c756d68 954 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 955 cmd_send(CMD_ACK,0,0,0,0,0);
956 break;
957 }
15c4dc5a 958 case CMD_READ_MEM:
959 ReadMem(c->arg[0]);
960 break;
961
962 case CMD_SET_LF_DIVISOR:
7cc204bf 963 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 964 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
965 break;
966
967 case CMD_SET_ADC_MUX:
968 switch(c->arg[0]) {
969 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
970 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
971 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
972 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
973 }
974 break;
975
976 case CMD_VERSION:
977 SendVersion();
978 break;
979
15c4dc5a 980#ifdef WITH_LCD
981 case CMD_LCD_RESET:
982 LCDReset();
983 break;
984 case CMD_LCD:
985 LCDSend(c->arg[0]);
986 break;
987#endif
988 case CMD_SETUP_WRITE:
989 case CMD_FINISH_WRITE:
1c611bbd 990 case CMD_HARDWARE_RESET:
991 usb_disable();
15c4dc5a 992 SpinDelay(1000);
993 SpinDelay(1000);
994 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
995 for(;;) {
996 // We're going to reset, and the bootrom will take control.
997 }
1c611bbd 998 break;
15c4dc5a 999
1c611bbd 1000 case CMD_START_FLASH:
15c4dc5a 1001 if(common_area.flags.bootrom_present) {
1002 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1003 }
1c611bbd 1004 usb_disable();
15c4dc5a 1005 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1006 for(;;);
1c611bbd 1007 break;
e30c654b 1008
15c4dc5a 1009 case CMD_DEVICE_INFO: {
902cb3c0 1010 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1011 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 1012 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1013 break;
1014 }
1015 default:
15c4dc5a 1016 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 1017 break;
15c4dc5a 1018 }
1019}
1020
1021void __attribute__((noreturn)) AppMain(void)
1022{
1023 SpinDelay(100);
e30c654b 1024
15c4dc5a 1025 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1026 /* Initialize common area */
1027 memset(&common_area, 0, sizeof(common_area));
1028 common_area.magic = COMMON_AREA_MAGIC;
1029 common_area.version = 1;
1030 }
1031 common_area.flags.osimage_present = 1;
1032
1033 LED_D_OFF();
1034 LED_C_OFF();
1035 LED_B_OFF();
1036 LED_A_OFF();
1037
b44e5233 1038 // Init USB device
313ee67e 1039 usb_enable();
15c4dc5a 1040
1041 // The FPGA gets its clock from us from PCK0 output, so set that up.
1042 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1043 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1044 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1045 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1046 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1047 AT91C_PMC_PRES_CLK_4;
1048 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1049
1050 // Reset SPI
1051 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1052 // Reset SSC
1053 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1054
1055 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1056 // (the HF version by default)
1057 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1058
9ca155ba 1059 StartTickCount();
902cb3c0 1060
15c4dc5a 1061#ifdef WITH_LCD
15c4dc5a 1062 LCDInit();
15c4dc5a 1063#endif
1064
902cb3c0 1065 byte_t rx[sizeof(UsbCommand)];
1066 size_t rx_len;
1067
15c4dc5a 1068 for(;;) {
313ee67e 1069 if (usb_poll()) {
1070 rx_len = usb_read(rx,sizeof(UsbCommand));
1071 if (rx_len) {
1072 UsbPacketReceived(rx,rx_len);
1073 }
1074 }
15c4dc5a 1075 WDT_HIT();
1076
1077#ifdef WITH_LF
1078 if (BUTTON_HELD(1000) > 0)
1079 SamyRun();
1080#endif
1081 }
1082}
Impressum, Datenschutz