]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
Revert "problems creating pull request with the new traces"
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
902cb3c0 13#include "usb_cdc.h"
14#include "cmd.h"
15
e30c654b 16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
21
22#include <stdarg.h>
f7e3ed82 23
15c4dc5a 24#include "legicrf.h"
d19929cb 25#include <hitag2.h>
f7e3ed82 26
15c4dc5a 27#ifdef WITH_LCD
902cb3c0 28 #include "LCD.h"
15c4dc5a 29#endif
30
15c4dc5a 31#define abs(x) ( ((x)<0) ? -(x) : (x) )
32
33//=============================================================================
34// A buffer where we can queue things up to be sent through the FPGA, for
35// any purpose (fake tag, as reader, whatever). We go MSB first, since that
36// is the order in which they go out on the wire.
37//=============================================================================
38
6a1f2d82 39#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
40uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 41int ToSendMax;
42static int ToSendBit;
43struct common_area common_area __attribute__((section(".commonarea")));
44
45void BufferClear(void)
46{
47 memset(BigBuf,0,sizeof(BigBuf));
48 Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
49}
50
51void ToSendReset(void)
52{
53 ToSendMax = -1;
54 ToSendBit = 8;
55}
56
57void ToSendStuffBit(int b)
58{
59 if(ToSendBit >= 8) {
60 ToSendMax++;
61 ToSend[ToSendMax] = 0;
62 ToSendBit = 0;
63 }
64
65 if(b) {
66 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
67 }
68
69 ToSendBit++;
70
6a1f2d82 71 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 72 ToSendBit = 0;
73 DbpString("ToSendStuffBit overflowed!");
74 }
75}
76
77//=============================================================================
78// Debug print functions, to go out over USB, to the usual PC-side client.
79//=============================================================================
80
81void DbpString(char *str)
82{
9440213d 83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
902cb3c0 85// /* this holds up stuff unless we're connected to usb */
86// if (!UsbConnected())
87// return;
88//
89// UsbCommand c;
90// c.cmd = CMD_DEBUG_PRINT_STRING;
91// c.arg[0] = strlen(str);
92// if(c.arg[0] > sizeof(c.d.asBytes)) {
93// c.arg[0] = sizeof(c.d.asBytes);
94// }
95// memcpy(c.d.asBytes, str, c.arg[0]);
96//
97// UsbSendPacket((uint8_t *)&c, sizeof(c));
98// // TODO fix USB so stupid things like this aren't req'd
99// SpinDelay(50);
15c4dc5a 100}
101
102#if 0
103void DbpIntegers(int x1, int x2, int x3)
104{
902cb3c0 105 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
106// /* this holds up stuff unless we're connected to usb */
107// if (!UsbConnected())
108// return;
109//
110// UsbCommand c;
111// c.cmd = CMD_DEBUG_PRINT_INTEGERS;
112// c.arg[0] = x1;
113// c.arg[1] = x2;
114// c.arg[2] = x3;
115//
116// UsbSendPacket((uint8_t *)&c, sizeof(c));
117// // XXX
118// SpinDelay(50);
15c4dc5a 119}
120#endif
121
122void Dbprintf(const char *fmt, ...) {
123// should probably limit size here; oh well, let's just use a big buffer
124 char output_string[128];
125 va_list ap;
126
127 va_start(ap, fmt);
128 kvsprintf(fmt, output_string, 10, ap);
129 va_end(ap);
e30c654b 130
15c4dc5a 131 DbpString(output_string);
132}
133
9455b51c 134// prints HEX & ASCII
d19929cb 135void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 136 int l=0,i;
137 char ascii[9];
d19929cb 138
9455b51c 139 while (len>0) {
140 if (len>8) l=8;
141 else l=len;
142
143 memcpy(ascii,d,l);
d19929cb 144 ascii[l]=0;
9455b51c 145
146 // filter safe ascii
d19929cb 147 for (i=0;i<l;i++)
9455b51c 148 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 149
150 if (bAsci) {
151 Dbprintf("%-8s %*D",ascii,l,d," ");
152 } else {
153 Dbprintf("%*D",l,d," ");
154 }
155
9455b51c 156 len-=8;
157 d+=8;
158 }
159}
160
15c4dc5a 161//-----------------------------------------------------------------------------
162// Read an ADC channel and block till it completes, then return the result
163// in ADC units (0 to 1023). Also a routine to average 32 samples and
164// return that.
165//-----------------------------------------------------------------------------
166static int ReadAdc(int ch)
167{
f7e3ed82 168 uint32_t d;
15c4dc5a 169
170 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
171 AT91C_BASE_ADC->ADC_MR =
172 ADC_MODE_PRESCALE(32) |
173 ADC_MODE_STARTUP_TIME(16) |
174 ADC_MODE_SAMPLE_HOLD_TIME(8);
175 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
176
177 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
178 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
179 ;
180 d = AT91C_BASE_ADC->ADC_CDR[ch];
181
182 return d;
183}
184
9ca155ba 185int AvgAdc(int ch) // was static - merlok
15c4dc5a 186{
187 int i;
188 int a = 0;
189
190 for(i = 0; i < 32; i++) {
191 a += ReadAdc(ch);
192 }
193
194 return (a + 15) >> 5;
195}
196
197void MeasureAntennaTuning(void)
198{
2bdd68c3 199 uint8_t LF_Results[256];
9f693930 200 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 201 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
202
2bdd68c3 203 LED_B_ON();
15c4dc5a 204
205/*
206 * Sweeps the useful LF range of the proxmark from
207 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
208 * read the voltage in the antenna, the result left
209 * in the buffer is a graph which should clearly show
210 * the resonating frequency of your LF antenna
211 * ( hopefully around 95 if it is tuned to 125kHz!)
212 */
d19929cb 213
7cc204bf 214 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 215 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2bdd68c3 216 for (i=255; i>=19; i--) {
d19929cb 217 WDT_HIT();
15c4dc5a 218 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
219 SpinDelay(20);
220 // Vref = 3.3V, and a 10000:240 voltage divider on the input
221 // can measure voltages up to 137500 mV
222 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
223 if (i==95) vLf125 = adcval; // voltage at 125Khz
224 if (i==89) vLf134 = adcval; // voltage at 134Khz
225
2bdd68c3 226 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
227 if(LF_Results[i] > peak) {
15c4dc5a 228 peakv = adcval;
2bdd68c3 229 peak = LF_Results[i];
15c4dc5a 230 peakf = i;
9f693930 231 //ptr = i;
15c4dc5a 232 }
233 }
234
2bdd68c3 235 for (i=18; i >= 0; i--) LF_Results[i] = 0;
236
237 LED_A_ON();
15c4dc5a 238 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 239 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 240 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
241 SpinDelay(20);
242 // Vref = 3300mV, and an 10:1 voltage divider on the input
243 // can measure voltages up to 33000 mV
244 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
245
2bdd68c3 246 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),LF_Results,256);
d19929cb 247 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 248 LED_A_OFF();
249 LED_B_OFF();
250 return;
15c4dc5a 251}
252
253void MeasureAntennaTuningHf(void)
254{
255 int vHf = 0; // in mV
256
257 DbpString("Measuring HF antenna, press button to exit");
258
259 for (;;) {
260 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 261 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 262 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
263 SpinDelay(20);
264 // Vref = 3300mV, and an 10:1 voltage divider on the input
265 // can measure voltages up to 33000 mV
266 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 267
15c4dc5a 268 Dbprintf("%d mV",vHf);
269 if (BUTTON_PRESS()) break;
270 }
271 DbpString("cancelled");
272}
273
274
275void SimulateTagHfListen(void)
276{
d19929cb 277 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
f7e3ed82 278 uint8_t v = 0;
15c4dc5a 279 int i;
280 int p = 0;
281
282 // We're using this mode just so that I can test it out; the simulated
283 // tag mode would work just as well and be simpler.
7cc204bf 284 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 285 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
286
287 // We need to listen to the high-frequency, peak-detected path.
288 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
289
290 FpgaSetupSsc();
291
292 i = 0;
293 for(;;) {
294 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
295 AT91C_BASE_SSC->SSC_THR = 0xff;
296 }
297 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 298 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 299
300 v <<= 1;
301 if(r & 1) {
302 v |= 1;
303 }
304 p++;
305
306 if(p >= 8) {
307 dest[i] = v;
308 v = 0;
309 p = 0;
310 i++;
311
d19929cb 312 if(i >= FREE_BUFFER_SIZE) {
15c4dc5a 313 break;
314 }
315 }
316 }
317 }
318 DbpString("simulate tag (now type bitsamples)");
319}
320
321void ReadMem(int addr)
322{
f7e3ed82 323 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 324
325 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
326 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
327}
328
329/* osimage version information is linked in */
330extern struct version_information version_information;
331/* bootrom version information is pointed to from _bootphase1_version_pointer */
332extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
333void SendVersion(void)
334{
cba867f2 335 char temp[256]; /* Limited data payload in USB packets */
15c4dc5a 336 DbpString("Prox/RFID mark3 RFID instrument");
e30c654b 337
338 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 339 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
340 * pointer, then use it.
341 */
342 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
343 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
344 DbpString("bootrom version information appears invalid");
345 } else {
346 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
347 DbpString(temp);
348 }
e30c654b 349
15c4dc5a 350 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
351 DbpString(temp);
e30c654b 352
15c4dc5a 353 FpgaGatherVersion(temp, sizeof(temp));
354 DbpString(temp);
4f269f63 355 // Send Chip ID
356 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
15c4dc5a 357}
358
359#ifdef WITH_LF
360// samy's sniff and repeat routine
361void SamyRun()
362{
363 DbpString("Stand-alone mode! No PC necessary.");
7cc204bf 364 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 365
366 // 3 possible options? no just 2 for now
367#define OPTS 2
368
369 int high[OPTS], low[OPTS];
370
371 // Oooh pretty -- notify user we're in elite samy mode now
372 LED(LED_RED, 200);
373 LED(LED_ORANGE, 200);
374 LED(LED_GREEN, 200);
375 LED(LED_ORANGE, 200);
376 LED(LED_RED, 200);
377 LED(LED_ORANGE, 200);
378 LED(LED_GREEN, 200);
379 LED(LED_ORANGE, 200);
380 LED(LED_RED, 200);
381
382 int selected = 0;
383 int playing = 0;
384
385 // Turn on selected LED
386 LED(selected + 1, 0);
387
388 for (;;)
389 {
6e82300d 390// UsbPoll(FALSE);
391 usb_poll();
392 WDT_HIT();
15c4dc5a 393
394 // Was our button held down or pressed?
395 int button_pressed = BUTTON_HELD(1000);
396 SpinDelay(300);
397
398 // Button was held for a second, begin recording
399 if (button_pressed > 0)
400 {
401 LEDsoff();
402 LED(selected + 1, 0);
403 LED(LED_RED2, 0);
404
405 // record
406 DbpString("Starting recording");
407
408 // wait for button to be released
409 while(BUTTON_PRESS())
410 WDT_HIT();
411
412 /* need this delay to prevent catching some weird data */
413 SpinDelay(500);
414
415 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
416 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
417
418 LEDsoff();
419 LED(selected + 1, 0);
420 // Finished recording
421
422 // If we were previously playing, set playing off
423 // so next button push begins playing what we recorded
424 playing = 0;
425 }
426
427 // Change where to record (or begin playing)
428 else if (button_pressed)
429 {
430 // Next option if we were previously playing
431 if (playing)
432 selected = (selected + 1) % OPTS;
433 playing = !playing;
434
435 LEDsoff();
436 LED(selected + 1, 0);
437
438 // Begin transmitting
439 if (playing)
440 {
441 LED(LED_GREEN, 0);
442 DbpString("Playing");
443 // wait for button to be released
444 while(BUTTON_PRESS())
445 WDT_HIT();
446 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
447 CmdHIDsimTAG(high[selected], low[selected], 0);
448 DbpString("Done playing");
449 if (BUTTON_HELD(1000) > 0)
450 {
451 DbpString("Exiting");
452 LEDsoff();
453 return;
454 }
455
456 /* We pressed a button so ignore it here with a delay */
457 SpinDelay(300);
458
459 // when done, we're done playing, move to next option
460 selected = (selected + 1) % OPTS;
461 playing = !playing;
462 LEDsoff();
463 LED(selected + 1, 0);
464 }
465 else
466 while(BUTTON_PRESS())
467 WDT_HIT();
468 }
469 }
470}
471#endif
472
473/*
474OBJECTIVE
475Listen and detect an external reader. Determine the best location
476for the antenna.
477
478INSTRUCTIONS:
479Inside the ListenReaderField() function, there is two mode.
480By default, when you call the function, you will enter mode 1.
481If you press the PM3 button one time, you will enter mode 2.
482If you press the PM3 button a second time, you will exit the function.
483
484DESCRIPTION OF MODE 1:
485This mode just listens for an external reader field and lights up green
486for HF and/or red for LF. This is the original mode of the detectreader
487function.
488
489DESCRIPTION OF MODE 2:
490This mode will visually represent, using the LEDs, the actual strength of the
491current compared to the maximum current detected. Basically, once you know
492what kind of external reader is present, it will help you spot the best location to place
493your antenna. You will probably not get some good results if there is a LF and a HF reader
494at the same place! :-)
495
496LIGHT SCHEME USED:
497*/
498static const char LIGHT_SCHEME[] = {
499 0x0, /* ---- | No field detected */
500 0x1, /* X--- | 14% of maximum current detected */
501 0x2, /* -X-- | 29% of maximum current detected */
502 0x4, /* --X- | 43% of maximum current detected */
503 0x8, /* ---X | 57% of maximum current detected */
504 0xC, /* --XX | 71% of maximum current detected */
505 0xE, /* -XXX | 86% of maximum current detected */
506 0xF, /* XXXX | 100% of maximum current detected */
507};
508static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
509
510void ListenReaderField(int limit)
511{
512 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
513 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
514 int mode=1, display_val, display_max, i;
515
516#define LF_ONLY 1
517#define HF_ONLY 2
518
519 LEDsoff();
520
521 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
522
523 if(limit != HF_ONLY) {
524 Dbprintf("LF 125/134 Baseline: %d", lf_av);
525 lf_baseline = lf_av;
526 }
527
528 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
529
530 if (limit != LF_ONLY) {
531 Dbprintf("HF 13.56 Baseline: %d", hf_av);
532 hf_baseline = hf_av;
533 }
534
535 for(;;) {
536 if (BUTTON_PRESS()) {
537 SpinDelay(500);
538 switch (mode) {
539 case 1:
540 mode=2;
541 DbpString("Signal Strength Mode");
542 break;
543 case 2:
544 default:
545 DbpString("Stopped");
546 LEDsoff();
547 return;
548 break;
549 }
550 }
551 WDT_HIT();
552
553 if (limit != HF_ONLY) {
554 if(mode==1) {
555 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
556 else LED_D_OFF();
557 }
e30c654b 558
15c4dc5a 559 ++lf_count;
560 lf_av_new= ReadAdc(ADC_CHAN_LF);
561 // see if there's a significant change
562 if(abs(lf_av - lf_av_new) > 10) {
563 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
564 lf_av = lf_av_new;
565 if (lf_av > lf_max)
566 lf_max = lf_av;
567 lf_count= 0;
568 }
569 }
570
571 if (limit != LF_ONLY) {
572 if (mode == 1){
573 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
574 else LED_B_OFF();
575 }
e30c654b 576
15c4dc5a 577 ++hf_count;
578 hf_av_new= ReadAdc(ADC_CHAN_HF);
579 // see if there's a significant change
580 if(abs(hf_av - hf_av_new) > 10) {
581 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
582 hf_av = hf_av_new;
583 if (hf_av > hf_max)
584 hf_max = hf_av;
585 hf_count= 0;
586 }
587 }
e30c654b 588
15c4dc5a 589 if(mode == 2) {
590 if (limit == LF_ONLY) {
591 display_val = lf_av;
592 display_max = lf_max;
593 } else if (limit == HF_ONLY) {
594 display_val = hf_av;
595 display_max = hf_max;
596 } else { /* Pick one at random */
597 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
598 display_val = hf_av;
599 display_max = hf_max;
600 } else {
601 display_val = lf_av;
602 display_max = lf_max;
603 }
604 }
605 for (i=0; i<LIGHT_LEN; i++) {
606 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
607 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
608 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
609 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
610 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
611 break;
612 }
613 }
614 }
615 }
616}
617
f7e3ed82 618void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 619{
620 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 621
902cb3c0 622// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
623
15c4dc5a 624 switch(c->cmd) {
625#ifdef WITH_LF
626 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
627 AcquireRawAdcSamples125k(c->arg[0]);
1c611bbd 628 cmd_send(CMD_ACK,0,0,0,0,0);
15c4dc5a 629 break;
15c4dc5a 630 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
631 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
632 break;
b014c96d 633 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
634 SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
635 cmd_send(CMD_ACK,0,0,0,0,0);
636 break;
7e67e42f 637 case CMD_HID_DEMOD_FSK:
083ca3de 638 CmdHIDdemodFSK(c->arg[0], 0, 0, 1); // Demodulate HID tag
7e67e42f 639 break;
640 case CMD_HID_SIM_TAG:
641 CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID
642 break;
a1f3bb12 643 case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
1c611bbd 644 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 645 break;
a1f3bb12 646 case CMD_IO_DEMOD_FSK:
083ca3de 647 CmdIOdemodFSK(c->arg[0], 0, 0, 1); // Demodulate IO tag
a1f3bb12 648 break;
649 case CMD_IO_CLONE_TAG: // Clone IO tag by ID to T55x7
650 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
651 break;
66707a3b 652 case CMD_EM410X_DEMOD:
653 CmdEM410xdemod(c->arg[0], 0, 0, 1);
654 break;
2d4eae76 655 case CMD_EM410X_WRITE_TAG:
656 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
657 break;
7e67e42f 658 case CMD_READ_TI_TYPE:
659 ReadTItag();
660 break;
661 case CMD_WRITE_TI_TYPE:
662 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
663 break;
664 case CMD_SIMULATE_TAG_125K:
665 LED_A_ON();
666 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
667 LED_A_OFF();
668 break;
669 case CMD_LF_SIMULATE_BIDIR:
670 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
671 break;
2414f978 672 case CMD_INDALA_CLONE_TAG: // Clone Indala 64-bit tag by UID to T55x7
673 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
674 break;
675 case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7
676 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
677 break;
1c611bbd 678 case CMD_T55XX_READ_BLOCK:
679 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
680 break;
681 case CMD_T55XX_WRITE_BLOCK:
682 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
683 break;
684 case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
685 T55xxReadTrace();
686 break;
687 case CMD_PCF7931_READ: // Read PCF7931 tag
688 ReadPCF7931();
689 cmd_send(CMD_ACK,0,0,0,0,0);
690// UsbSendPacket((uint8_t*)&ack, sizeof(ack));
691 break;
692 case CMD_EM4X_READ_WORD:
693 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
694 break;
695 case CMD_EM4X_WRITE_WORD:
696 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
697 break;
15c4dc5a 698#endif
699
d19929cb 700#ifdef WITH_HITAG
701 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
702 SnoopHitag(c->arg[0]);
703 break;
704 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
705 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
706 break;
707 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
708 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
709 break;
710#endif
711
15c4dc5a 712#ifdef WITH_ISO15693
713 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
714 AcquireRawAdcSamplesIso15693();
715 break;
9455b51c 716 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
717 RecordRawAdcSamplesIso15693();
718 break;
719
720 case CMD_ISO_15693_COMMAND:
721 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
722 break;
723
724 case CMD_ISO_15693_FIND_AFI:
725 BruteforceIso15693Afi(c->arg[0]);
726 break;
727
728 case CMD_ISO_15693_DEBUG:
729 SetDebugIso15693(c->arg[0]);
730 break;
15c4dc5a 731
15c4dc5a 732 case CMD_READER_ISO_15693:
733 ReaderIso15693(c->arg[0]);
734 break;
7e67e42f 735 case CMD_SIMTAG_ISO_15693:
736 SimTagIso15693(c->arg[0]);
737 break;
15c4dc5a 738#endif
739
7e67e42f 740#ifdef WITH_LEGICRF
741 case CMD_SIMULATE_TAG_LEGIC_RF:
742 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
743 break;
3612a8a8 744
7e67e42f 745 case CMD_WRITER_LEGIC_RF:
746 LegicRfWriter(c->arg[1], c->arg[0]);
747 break;
3612a8a8 748
15c4dc5a 749 case CMD_READER_LEGIC_RF:
750 LegicRfReader(c->arg[0], c->arg[1]);
751 break;
15c4dc5a 752#endif
753
754#ifdef WITH_ISO14443b
755 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
756 AcquireRawAdcSamplesIso14443(c->arg[0]);
757 break;
15c4dc5a 758 case CMD_READ_SRI512_TAG:
7cf3ef20 759 ReadSTMemoryIso14443(0x0F);
15c4dc5a 760 break;
7e67e42f 761 case CMD_READ_SRIX4K_TAG:
7cf3ef20 762 ReadSTMemoryIso14443(0x7F);
7e67e42f 763 break;
764 case CMD_SNOOP_ISO_14443:
765 SnoopIso14443();
766 break;
767 case CMD_SIMULATE_TAG_ISO_14443:
768 SimulateIso14443Tag();
769 break;
7cf3ef20 770 case CMD_ISO_14443B_COMMAND:
771 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
772 break;
15c4dc5a 773#endif
774
775#ifdef WITH_ISO14443a
7e67e42f 776 case CMD_SNOOP_ISO_14443a:
5cd9ec01 777 SnoopIso14443a(c->arg[0]);
7e67e42f 778 break;
15c4dc5a 779 case CMD_READER_ISO_14443a:
902cb3c0 780 ReaderIso14443a(c);
15c4dc5a 781 break;
7e67e42f 782 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 783 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 784 break;
5acd09bd 785 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 786 EPA_PACE_Collect_Nonce(c);
5acd09bd 787 break;
7e67e42f 788
15c4dc5a 789 case CMD_READER_MIFARE:
1c611bbd 790 ReaderMifare(c->arg[0]);
15c4dc5a 791 break;
20f9a2a1
M
792 case CMD_MIFARE_READBL:
793 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
794 break;
981bd429 795 case CMD_MIFAREU_READBL:
796 MifareUReadBlock(c->arg[0],c->d.asBytes);
797 break;
798 case CMD_MIFAREU_READCARD:
799 MifareUReadCard(c->arg[0],c->d.asBytes);
800 break;
20f9a2a1
M
801 case CMD_MIFARE_READSC:
802 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
803 break;
804 case CMD_MIFARE_WRITEBL:
805 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
806 break;
981bd429 807 case CMD_MIFAREU_WRITEBL_COMPAT:
808 MifareUWriteBlock(c->arg[0], c->d.asBytes);
809 break;
810 case CMD_MIFAREU_WRITEBL:
811 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
812 break;
20f9a2a1
M
813 case CMD_MIFARE_NESTED:
814 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
815 break;
816 case CMD_MIFARE_CHKKEYS:
817 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
818 break;
819 case CMD_SIMULATE_MIFARE_CARD:
820 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
821 break;
8556b852
M
822
823 // emulator
824 case CMD_MIFARE_SET_DBGMODE:
825 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
826 break;
827 case CMD_MIFARE_EML_MEMCLR:
828 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
829 break;
830 case CMD_MIFARE_EML_MEMSET:
831 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
832 break;
833 case CMD_MIFARE_EML_MEMGET:
834 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
835 break;
836 case CMD_MIFARE_EML_CARDLOAD:
837 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
838 break;
839
840 // Work with "magic Chinese" card
841 case CMD_MIFARE_EML_CSETBLOCK:
842 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38
M
843 break;
844 case CMD_MIFARE_EML_CGETBLOCK:
845 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 846 break;
b62a5a84
M
847
848 // mifare sniffer
849 case CMD_MIFARE_SNIFFER:
5cd9ec01 850 SniffMifare(c->arg[0]);
b62a5a84 851 break;
20f9a2a1
M
852#endif
853
7e67e42f 854#ifdef WITH_ICLASS
cee5a30d 855 // Makes use of ISO14443a FPGA Firmware
856 case CMD_SNOOP_ICLASS:
857 SnoopIClass();
858 break;
1e262141 859 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 860 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 861 break;
862 case CMD_READER_ICLASS:
863 ReaderIClass(c->arg[0]);
864 break;
c3963755 865 case CMD_READER_ICLASS_REPLAY:
fecd8202 866 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 867 break;
cee5a30d 868#endif
869
15c4dc5a 870 case CMD_SIMULATE_TAG_HF_LISTEN:
871 SimulateTagHfListen();
872 break;
873
7e67e42f 874 case CMD_BUFF_CLEAR:
875 BufferClear();
15c4dc5a 876 break;
15c4dc5a 877
878 case CMD_MEASURE_ANTENNA_TUNING:
879 MeasureAntennaTuning();
880 break;
881
882 case CMD_MEASURE_ANTENNA_TUNING_HF:
883 MeasureAntennaTuningHf();
884 break;
885
886 case CMD_LISTEN_READER_FIELD:
887 ListenReaderField(c->arg[0]);
888 break;
889
15c4dc5a 890 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
891 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
892 SpinDelay(200);
893 LED_D_OFF(); // LED D indicates field ON or OFF
894 break;
895
1c611bbd 896 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 897// UsbCommand n;
898// if(c->cmd == CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K) {
899// n.cmd = CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K;
900// } else {
901// n.cmd = CMD_DOWNLOADED_RAW_BITS_TI_TYPE;
902// }
903// n.arg[0] = c->arg[0];
904 // memcpy(n.d.asBytes, BigBuf+c->arg[0], 48); // 12*sizeof(uint32_t)
905 // LED_B_ON();
906 // usb_write((uint8_t *)&n, sizeof(n));
907 // UsbSendPacket((uint8_t *)&n, sizeof(n));
908 // LED_B_OFF();
909
1c611bbd 910 LED_B_ON();
911 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
912 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
913 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
914 }
915 // Trigger a finish downloading signal with an ACK frame
916 cmd_send(CMD_ACK,0,0,0,0,0);
d3b1f4e4 917 LED_B_OFF();
1c611bbd 918 break;
15c4dc5a 919
920 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
f7e3ed82 921 uint8_t *b = (uint8_t *)BigBuf;
15c4dc5a 922 memcpy(b+c->arg[0], c->d.asBytes, 48);
923 //Dbprintf("copied 48 bytes to %i",b+c->arg[0]);
902cb3c0 924// UsbSendPacket((uint8_t*)&ack, sizeof(ack));
1c611bbd 925 cmd_send(CMD_ACK,0,0,0,0,0);
926 break;
927 }
15c4dc5a 928 case CMD_READ_MEM:
929 ReadMem(c->arg[0]);
930 break;
931
932 case CMD_SET_LF_DIVISOR:
7cc204bf 933 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 934 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
935 break;
936
937 case CMD_SET_ADC_MUX:
938 switch(c->arg[0]) {
939 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
940 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
941 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
942 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
943 }
944 break;
945
946 case CMD_VERSION:
947 SendVersion();
948 break;
949
15c4dc5a 950#ifdef WITH_LCD
951 case CMD_LCD_RESET:
952 LCDReset();
953 break;
954 case CMD_LCD:
955 LCDSend(c->arg[0]);
956 break;
957#endif
958 case CMD_SETUP_WRITE:
959 case CMD_FINISH_WRITE:
1c611bbd 960 case CMD_HARDWARE_RESET:
961 usb_disable();
15c4dc5a 962 SpinDelay(1000);
963 SpinDelay(1000);
964 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
965 for(;;) {
966 // We're going to reset, and the bootrom will take control.
967 }
1c611bbd 968 break;
15c4dc5a 969
1c611bbd 970 case CMD_START_FLASH:
15c4dc5a 971 if(common_area.flags.bootrom_present) {
972 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
973 }
1c611bbd 974 usb_disable();
15c4dc5a 975 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
976 for(;;);
1c611bbd 977 break;
e30c654b 978
15c4dc5a 979 case CMD_DEVICE_INFO: {
902cb3c0 980 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
981 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
982// UsbSendPacket((uint8_t*)&c, sizeof(c));
1c611bbd 983 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
984 break;
985 }
986 default:
15c4dc5a 987 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 988 break;
15c4dc5a 989 }
990}
991
992void __attribute__((noreturn)) AppMain(void)
993{
994 SpinDelay(100);
e30c654b 995
15c4dc5a 996 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
997 /* Initialize common area */
998 memset(&common_area, 0, sizeof(common_area));
999 common_area.magic = COMMON_AREA_MAGIC;
1000 common_area.version = 1;
1001 }
1002 common_area.flags.osimage_present = 1;
1003
1004 LED_D_OFF();
1005 LED_C_OFF();
1006 LED_B_OFF();
1007 LED_A_OFF();
1008
28fdb04f 1009 // Init USB device`
902cb3c0 1010 usb_enable();
902cb3c0 1011// UsbStart();
15c4dc5a 1012
1013 // The FPGA gets its clock from us from PCK0 output, so set that up.
1014 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1015 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1016 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1017 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1018 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1019 AT91C_PMC_PRES_CLK_4;
1020 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1021
1022 // Reset SPI
1023 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1024 // Reset SSC
1025 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1026
1027 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1028 // (the HF version by default)
1029 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1030
9ca155ba 1031 StartTickCount();
902cb3c0 1032
15c4dc5a 1033#ifdef WITH_LCD
15c4dc5a 1034 LCDInit();
15c4dc5a 1035#endif
1036
902cb3c0 1037 byte_t rx[sizeof(UsbCommand)];
1038 size_t rx_len;
1039
15c4dc5a 1040 for(;;) {
902cb3c0 1041 if (usb_poll()) {
1042 rx_len = usb_read(rx,sizeof(UsbCommand));
1043 if (rx_len) {
1044 UsbPacketReceived(rx,rx_len);
1045 }
1046 }
1047// UsbPoll(FALSE);
1048
15c4dc5a 1049 WDT_HIT();
1050
1051#ifdef WITH_LF
1052 if (BUTTON_HELD(1000) > 0)
1053 SamyRun();
1054#endif
1055 }
1056}
Impressum, Datenschutz