]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
fixing iso14443b (issue #103):
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
902cb3c0 13#include "usb_cdc.h"
14#include "cmd.h"
15
e30c654b 16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
31d1caa5 21
9ab7a6c7 22#include <stdarg.h>
f7e3ed82 23
15c4dc5a 24#include "legicrf.h"
d19929cb 25#include <hitag2.h>
31abe49f 26#include "lfsampling.h"
3000dc4e 27#include "BigBuf.h"
15c4dc5a 28#ifdef WITH_LCD
902cb3c0 29 #include "LCD.h"
15c4dc5a 30#endif
31
15c4dc5a 32#define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34//=============================================================================
35// A buffer where we can queue things up to be sent through the FPGA, for
36// any purpose (fake tag, as reader, whatever). We go MSB first, since that
37// is the order in which they go out on the wire.
38//=============================================================================
39
6a1f2d82 40#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 42int ToSendMax;
43static int ToSendBit;
44struct common_area common_area __attribute__((section(".commonarea")));
45
15c4dc5a 46void ToSendReset(void)
47{
48 ToSendMax = -1;
49 ToSendBit = 8;
50}
51
52void ToSendStuffBit(int b)
53{
54 if(ToSendBit >= 8) {
55 ToSendMax++;
56 ToSend[ToSendMax] = 0;
57 ToSendBit = 0;
58 }
59
60 if(b) {
61 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
62 }
63
64 ToSendBit++;
65
6a1f2d82 66 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 67 ToSendBit = 0;
68 DbpString("ToSendStuffBit overflowed!");
69 }
70}
71
72//=============================================================================
73// Debug print functions, to go out over USB, to the usual PC-side client.
74//=============================================================================
75
76void DbpString(char *str)
77{
9440213d 78 byte_t len = strlen(str);
79 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
15c4dc5a 80}
81
82#if 0
83void DbpIntegers(int x1, int x2, int x3)
84{
902cb3c0 85 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
15c4dc5a 86}
87#endif
88
89void Dbprintf(const char *fmt, ...) {
90// should probably limit size here; oh well, let's just use a big buffer
91 char output_string[128];
92 va_list ap;
93
94 va_start(ap, fmt);
95 kvsprintf(fmt, output_string, 10, ap);
96 va_end(ap);
e30c654b 97
15c4dc5a 98 DbpString(output_string);
99}
100
9455b51c 101// prints HEX & ASCII
d19929cb 102void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 103 int l=0,i;
104 char ascii[9];
d19929cb 105
9455b51c 106 while (len>0) {
107 if (len>8) l=8;
108 else l=len;
109
110 memcpy(ascii,d,l);
d19929cb 111 ascii[l]=0;
9455b51c 112
113 // filter safe ascii
d19929cb 114 for (i=0;i<l;i++)
9455b51c 115 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 116
117 if (bAsci) {
118 Dbprintf("%-8s %*D",ascii,l,d," ");
119 } else {
120 Dbprintf("%*D",l,d," ");
121 }
122
9455b51c 123 len-=8;
124 d+=8;
125 }
126}
127
15c4dc5a 128//-----------------------------------------------------------------------------
129// Read an ADC channel and block till it completes, then return the result
130// in ADC units (0 to 1023). Also a routine to average 32 samples and
131// return that.
132//-----------------------------------------------------------------------------
133static int ReadAdc(int ch)
134{
f7e3ed82 135 uint32_t d;
15c4dc5a 136
137 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
138 AT91C_BASE_ADC->ADC_MR =
3b692427 139 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
140 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
141 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
142
143 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
144 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
145 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
146 //
147 // The maths are:
148 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
149 //
150 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
151 //
152 // Note: with the "historic" values in the comments above, the error was 34% !!!
153
15c4dc5a 154 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
155
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
3b692427 157
15c4dc5a 158 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
159 ;
160 d = AT91C_BASE_ADC->ADC_CDR[ch];
161
162 return d;
163}
164
9ca155ba 165int AvgAdc(int ch) // was static - merlok
15c4dc5a 166{
167 int i;
168 int a = 0;
169
170 for(i = 0; i < 32; i++) {
171 a += ReadAdc(ch);
172 }
173
174 return (a + 15) >> 5;
175}
176
177void MeasureAntennaTuning(void)
178{
2bdd68c3 179 uint8_t LF_Results[256];
9f693930 180 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 181 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
182
2bdd68c3 183 LED_B_ON();
15c4dc5a 184
185/*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
d19929cb 193
7cc204bf 194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2bdd68c3 196 for (i=255; i>=19; i--) {
d19929cb 197 WDT_HIT();
15c4dc5a 198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
3b692427 200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
15c4dc5a 201 if (i==95) vLf125 = adcval; // voltage at 125Khz
202 if (i==89) vLf134 = adcval; // voltage at 134Khz
203
2bdd68c3 204 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
205 if(LF_Results[i] > peak) {
15c4dc5a 206 peakv = adcval;
2bdd68c3 207 peak = LF_Results[i];
15c4dc5a 208 peakf = i;
9f693930 209 //ptr = i;
15c4dc5a 210 }
211 }
212
2bdd68c3 213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
214
215 LED_A_ON();
15c4dc5a 216 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 217 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 218 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
219 SpinDelay(20);
3b692427 220 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
15c4dc5a 221
3b692427 222 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
d19929cb 223 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 224 LED_A_OFF();
225 LED_B_OFF();
226 return;
15c4dc5a 227}
228
229void MeasureAntennaTuningHf(void)
230{
231 int vHf = 0; // in mV
232
233 DbpString("Measuring HF antenna, press button to exit");
234
3b692427 235 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
236 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
237 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
238
15c4dc5a 239 for (;;) {
15c4dc5a 240 SpinDelay(20);
3b692427 241 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 242
15c4dc5a 243 Dbprintf("%d mV",vHf);
244 if (BUTTON_PRESS()) break;
245 }
246 DbpString("cancelled");
3b692427 247
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
249
15c4dc5a 250}
251
252
15c4dc5a 253void ReadMem(int addr)
254{
f7e3ed82 255 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 256
257 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
258 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
259}
260
261/* osimage version information is linked in */
262extern struct version_information version_information;
263/* bootrom version information is pointed to from _bootphase1_version_pointer */
264extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
265void SendVersion(void)
266{
3fe4ff4f 267 char temp[512]; /* Limited data payload in USB packets */
15c4dc5a 268 DbpString("Prox/RFID mark3 RFID instrument");
e30c654b 269
270 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 271 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
272 * pointer, then use it.
273 */
274 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
275 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
276 DbpString("bootrom version information appears invalid");
277 } else {
278 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
279 DbpString(temp);
280 }
e30c654b 281
15c4dc5a 282 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
283 DbpString(temp);
e30c654b 284
15c4dc5a 285 FpgaGatherVersion(temp, sizeof(temp));
286 DbpString(temp);
4f269f63 287 // Send Chip ID
288 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
15c4dc5a 289}
290
291#ifdef WITH_LF
292// samy's sniff and repeat routine
293void SamyRun()
294{
295 DbpString("Stand-alone mode! No PC necessary.");
7cc204bf 296 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 297
298 // 3 possible options? no just 2 for now
299#define OPTS 2
300
301 int high[OPTS], low[OPTS];
302
303 // Oooh pretty -- notify user we're in elite samy mode now
304 LED(LED_RED, 200);
305 LED(LED_ORANGE, 200);
306 LED(LED_GREEN, 200);
307 LED(LED_ORANGE, 200);
308 LED(LED_RED, 200);
309 LED(LED_ORANGE, 200);
310 LED(LED_GREEN, 200);
311 LED(LED_ORANGE, 200);
312 LED(LED_RED, 200);
313
314 int selected = 0;
315 int playing = 0;
3fe4ff4f 316 int cardRead = 0;
15c4dc5a 317
318 // Turn on selected LED
319 LED(selected + 1, 0);
320
321 for (;;)
322 {
6e82300d 323 usb_poll();
324 WDT_HIT();
15c4dc5a 325
326 // Was our button held down or pressed?
327 int button_pressed = BUTTON_HELD(1000);
328 SpinDelay(300);
329
330 // Button was held for a second, begin recording
3fe4ff4f 331 if (button_pressed > 0 && cardRead == 0)
15c4dc5a 332 {
333 LEDsoff();
334 LED(selected + 1, 0);
335 LED(LED_RED2, 0);
336
337 // record
338 DbpString("Starting recording");
339
340 // wait for button to be released
341 while(BUTTON_PRESS())
342 WDT_HIT();
343
344 /* need this delay to prevent catching some weird data */
345 SpinDelay(500);
346
347 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
348 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
349
350 LEDsoff();
351 LED(selected + 1, 0);
352 // Finished recording
353
354 // If we were previously playing, set playing off
355 // so next button push begins playing what we recorded
356 playing = 0;
3fe4ff4f 357
358 cardRead = 1;
359
360 }
361
362 else if (button_pressed > 0 && cardRead == 1)
363 {
364 LEDsoff();
365 LED(selected + 1, 0);
366 LED(LED_ORANGE, 0);
367
368 // record
369 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
370
371 // wait for button to be released
372 while(BUTTON_PRESS())
373 WDT_HIT();
374
375 /* need this delay to prevent catching some weird data */
376 SpinDelay(500);
377
378 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
379 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
380
381 LEDsoff();
382 LED(selected + 1, 0);
383 // Finished recording
384
385 // If we were previously playing, set playing off
386 // so next button push begins playing what we recorded
387 playing = 0;
388
389 cardRead = 0;
390
15c4dc5a 391 }
392
393 // Change where to record (or begin playing)
394 else if (button_pressed)
395 {
396 // Next option if we were previously playing
397 if (playing)
398 selected = (selected + 1) % OPTS;
399 playing = !playing;
400
401 LEDsoff();
402 LED(selected + 1, 0);
403
404 // Begin transmitting
405 if (playing)
406 {
407 LED(LED_GREEN, 0);
408 DbpString("Playing");
409 // wait for button to be released
410 while(BUTTON_PRESS())
411 WDT_HIT();
412 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
413 CmdHIDsimTAG(high[selected], low[selected], 0);
414 DbpString("Done playing");
415 if (BUTTON_HELD(1000) > 0)
416 {
417 DbpString("Exiting");
418 LEDsoff();
419 return;
420 }
421
422 /* We pressed a button so ignore it here with a delay */
423 SpinDelay(300);
424
425 // when done, we're done playing, move to next option
426 selected = (selected + 1) % OPTS;
427 playing = !playing;
428 LEDsoff();
429 LED(selected + 1, 0);
430 }
431 else
432 while(BUTTON_PRESS())
433 WDT_HIT();
434 }
435 }
436}
437#endif
438
439/*
440OBJECTIVE
441Listen and detect an external reader. Determine the best location
442for the antenna.
443
444INSTRUCTIONS:
445Inside the ListenReaderField() function, there is two mode.
446By default, when you call the function, you will enter mode 1.
447If you press the PM3 button one time, you will enter mode 2.
448If you press the PM3 button a second time, you will exit the function.
449
450DESCRIPTION OF MODE 1:
451This mode just listens for an external reader field and lights up green
452for HF and/or red for LF. This is the original mode of the detectreader
453function.
454
455DESCRIPTION OF MODE 2:
456This mode will visually represent, using the LEDs, the actual strength of the
457current compared to the maximum current detected. Basically, once you know
458what kind of external reader is present, it will help you spot the best location to place
459your antenna. You will probably not get some good results if there is a LF and a HF reader
460at the same place! :-)
461
462LIGHT SCHEME USED:
463*/
464static const char LIGHT_SCHEME[] = {
465 0x0, /* ---- | No field detected */
466 0x1, /* X--- | 14% of maximum current detected */
467 0x2, /* -X-- | 29% of maximum current detected */
468 0x4, /* --X- | 43% of maximum current detected */
469 0x8, /* ---X | 57% of maximum current detected */
470 0xC, /* --XX | 71% of maximum current detected */
471 0xE, /* -XXX | 86% of maximum current detected */
472 0xF, /* XXXX | 100% of maximum current detected */
473};
474static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
475
476void ListenReaderField(int limit)
477{
3b692427 478 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
479 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
15c4dc5a 480 int mode=1, display_val, display_max, i;
481
3b692427 482#define LF_ONLY 1
483#define HF_ONLY 2
484#define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
485
486
487 // switch off FPGA - we don't want to measure our own signal
488 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
489 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 490
491 LEDsoff();
492
3b692427 493 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
15c4dc5a 494
495 if(limit != HF_ONLY) {
3b692427 496 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
15c4dc5a 497 lf_baseline = lf_av;
498 }
499
3b692427 500 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
15c4dc5a 501
502 if (limit != LF_ONLY) {
3b692427 503 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
15c4dc5a 504 hf_baseline = hf_av;
505 }
506
507 for(;;) {
508 if (BUTTON_PRESS()) {
509 SpinDelay(500);
510 switch (mode) {
511 case 1:
512 mode=2;
513 DbpString("Signal Strength Mode");
514 break;
515 case 2:
516 default:
517 DbpString("Stopped");
518 LEDsoff();
519 return;
520 break;
521 }
522 }
523 WDT_HIT();
524
525 if (limit != HF_ONLY) {
3b692427 526 if(mode == 1) {
527 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
528 LED_D_ON();
529 else
530 LED_D_OFF();
15c4dc5a 531 }
e30c654b 532
3b692427 533 lf_av_new = AvgAdc(ADC_CHAN_LF);
15c4dc5a 534 // see if there's a significant change
3b692427 535 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
536 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
15c4dc5a 537 lf_av = lf_av_new;
538 if (lf_av > lf_max)
539 lf_max = lf_av;
15c4dc5a 540 }
541 }
542
543 if (limit != LF_ONLY) {
544 if (mode == 1){
3b692427 545 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
546 LED_B_ON();
547 else
548 LED_B_OFF();
15c4dc5a 549 }
e30c654b 550
3b692427 551 hf_av_new = AvgAdc(ADC_CHAN_HF);
15c4dc5a 552 // see if there's a significant change
3b692427 553 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
554 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
15c4dc5a 555 hf_av = hf_av_new;
556 if (hf_av > hf_max)
557 hf_max = hf_av;
15c4dc5a 558 }
559 }
e30c654b 560
15c4dc5a 561 if(mode == 2) {
562 if (limit == LF_ONLY) {
563 display_val = lf_av;
564 display_max = lf_max;
565 } else if (limit == HF_ONLY) {
566 display_val = hf_av;
567 display_max = hf_max;
568 } else { /* Pick one at random */
569 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
570 display_val = hf_av;
571 display_max = hf_max;
572 } else {
573 display_val = lf_av;
574 display_max = lf_max;
575 }
576 }
577 for (i=0; i<LIGHT_LEN; i++) {
578 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
579 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
580 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
581 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
582 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
583 break;
584 }
585 }
586 }
587 }
588}
589
f7e3ed82 590void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 591{
592 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 593
902cb3c0 594// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
595
15c4dc5a 596 switch(c->cmd) {
597#ifdef WITH_LF
31abe49f
MHS
598 case CMD_SET_LF_SAMPLING_CONFIG:
599 setSamplingConfig((sample_config *) c->d.asBytes);
600 break;
15c4dc5a 601 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
1fbf8956 602 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
15c4dc5a 603 break;
15c4dc5a 604 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
605 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
606 break;
b014c96d 607 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
31abe49f 608 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
b014c96d 609 break;
7e67e42f 610 case CMD_HID_DEMOD_FSK:
3fe4ff4f 611 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
7e67e42f 612 break;
613 case CMD_HID_SIM_TAG:
3fe4ff4f 614 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
7e67e42f 615 break;
abd6112f 616 case CMD_FSK_SIM_TAG:
617 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
618 break;
619 case CMD_ASK_SIM_TAG:
620 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
621 break;
872e3d4d 622 case CMD_PSK_SIM_TAG:
623 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
624 break;
625 case CMD_HID_CLONE_TAG:
1c611bbd 626 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 627 break;
a1f3bb12 628 case CMD_IO_DEMOD_FSK:
3fe4ff4f 629 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
a1f3bb12 630 break;
3fe4ff4f 631 case CMD_IO_CLONE_TAG:
a1f3bb12 632 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
633 break;
66707a3b 634 case CMD_EM410X_DEMOD:
635 CmdEM410xdemod(c->arg[0], 0, 0, 1);
636 break;
2d4eae76 637 case CMD_EM410X_WRITE_TAG:
638 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
639 break;
7e67e42f 640 case CMD_READ_TI_TYPE:
641 ReadTItag();
642 break;
643 case CMD_WRITE_TI_TYPE:
644 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
645 break;
646 case CMD_SIMULATE_TAG_125K:
31d1caa5 647 LED_A_ON();
7e67e42f 648 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
31d1caa5 649 LED_A_OFF();
7e67e42f 650 break;
651 case CMD_LF_SIMULATE_BIDIR:
652 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
653 break;
3fe4ff4f 654 case CMD_INDALA_CLONE_TAG:
2414f978 655 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
656 break;
3fe4ff4f 657 case CMD_INDALA_CLONE_TAG_L:
2414f978 658 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
659 break;
1c611bbd 660 case CMD_T55XX_READ_BLOCK:
661 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
662 break;
663 case CMD_T55XX_WRITE_BLOCK:
664 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
665 break;
3fe4ff4f 666 case CMD_T55XX_READ_TRACE:
1c611bbd 667 T55xxReadTrace();
668 break;
3fe4ff4f 669 case CMD_PCF7931_READ:
1c611bbd 670 ReadPCF7931();
671 cmd_send(CMD_ACK,0,0,0,0,0);
1c611bbd 672 break;
673 case CMD_EM4X_READ_WORD:
674 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
675 break;
676 case CMD_EM4X_WRITE_WORD:
677 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
678 break;
15c4dc5a 679#endif
680
d19929cb 681#ifdef WITH_HITAG
682 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
683 SnoopHitag(c->arg[0]);
684 break;
685 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
686 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
687 break;
688 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
689 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
690 break;
691#endif
f168b263 692
15c4dc5a 693#ifdef WITH_ISO15693
694 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
695 AcquireRawAdcSamplesIso15693();
696 break;
9455b51c 697 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
698 RecordRawAdcSamplesIso15693();
699 break;
700
701 case CMD_ISO_15693_COMMAND:
702 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
703 break;
704
705 case CMD_ISO_15693_FIND_AFI:
706 BruteforceIso15693Afi(c->arg[0]);
707 break;
708
709 case CMD_ISO_15693_DEBUG:
710 SetDebugIso15693(c->arg[0]);
711 break;
15c4dc5a 712
15c4dc5a 713 case CMD_READER_ISO_15693:
714 ReaderIso15693(c->arg[0]);
715 break;
7e67e42f 716 case CMD_SIMTAG_ISO_15693:
3fe4ff4f 717 SimTagIso15693(c->arg[0], c->d.asBytes);
7e67e42f 718 break;
15c4dc5a 719#endif
720
7e67e42f 721#ifdef WITH_LEGICRF
722 case CMD_SIMULATE_TAG_LEGIC_RF:
723 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
724 break;
3612a8a8 725
7e67e42f 726 case CMD_WRITER_LEGIC_RF:
727 LegicRfWriter(c->arg[1], c->arg[0]);
728 break;
3612a8a8 729
15c4dc5a 730 case CMD_READER_LEGIC_RF:
731 LegicRfReader(c->arg[0], c->arg[1]);
732 break;
15c4dc5a 733#endif
734
735#ifdef WITH_ISO14443b
15c4dc5a 736 case CMD_READ_SRI512_TAG:
51d4f6f1 737 ReadSTMemoryIso14443b(0x0F);
15c4dc5a 738 break;
7e67e42f 739 case CMD_READ_SRIX4K_TAG:
51d4f6f1 740 ReadSTMemoryIso14443b(0x7F);
7e67e42f 741 break;
132a0217 742 case CMD_SNOOP_ISO_14443B:
51d4f6f1 743 SnoopIso14443b();
7e67e42f 744 break;
132a0217 745 case CMD_SIMULATE_TAG_ISO_14443B:
51d4f6f1 746 SimulateIso14443bTag();
7e67e42f 747 break;
7cf3ef20 748 case CMD_ISO_14443B_COMMAND:
749 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
750 break;
15c4dc5a 751#endif
752
753#ifdef WITH_ISO14443a
7e67e42f 754 case CMD_SNOOP_ISO_14443a:
5cd9ec01 755 SnoopIso14443a(c->arg[0]);
7e67e42f 756 break;
15c4dc5a 757 case CMD_READER_ISO_14443a:
902cb3c0 758 ReaderIso14443a(c);
15c4dc5a 759 break;
7e67e42f 760 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 761 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 762 break;
3fe4ff4f 763
5acd09bd 764 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 765 EPA_PACE_Collect_Nonce(c);
5acd09bd 766 break;
7e67e42f 767
15c4dc5a 768 case CMD_READER_MIFARE:
f168b263 769 ReaderMifare(c->arg[0]);
15c4dc5a 770 break;
20f9a2a1
M
771 case CMD_MIFARE_READBL:
772 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
773 break;
981bd429 774 case CMD_MIFAREU_READBL:
f168b263 775 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
981bd429 776 break;
8258f409 777 case CMD_MIFAREUC_AUTH:
778 MifareUC_Auth(c->arg[0],c->d.asBytes);
a631936e 779 break;
981bd429 780 case CMD_MIFAREU_READCARD:
75377d29 781 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
117d9ec2 782 break;
f168b263 783 case CMD_MIFAREUC_SETPWD:
784 MifareUSetPwd(c->arg[0], c->d.asBytes);
785 break;
20f9a2a1
M
786 case CMD_MIFARE_READSC:
787 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
788 break;
789 case CMD_MIFARE_WRITEBL:
790 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
791 break;
4973f23d 792 //case CMD_MIFAREU_WRITEBL_COMPAT:
793 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
794 //break;
981bd429 795 case CMD_MIFAREU_WRITEBL:
4973f23d 796 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
f168b263 797 break;
20f9a2a1
M
798 case CMD_MIFARE_NESTED:
799 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
800 break;
801 case CMD_MIFARE_CHKKEYS:
802 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
803 break;
804 case CMD_SIMULATE_MIFARE_CARD:
805 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
806 break;
8556b852
M
807
808 // emulator
809 case CMD_MIFARE_SET_DBGMODE:
810 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
811 break;
812 case CMD_MIFARE_EML_MEMCLR:
813 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
814 break;
815 case CMD_MIFARE_EML_MEMSET:
816 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
817 break;
818 case CMD_MIFARE_EML_MEMGET:
819 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
820 break;
821 case CMD_MIFARE_EML_CARDLOAD:
822 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
823 break;
824
825 // Work with "magic Chinese" card
3fe4ff4f 826 case CMD_MIFARE_CSETBLOCK:
0675f200 827 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38 828 break;
3fe4ff4f 829 case CMD_MIFARE_CGETBLOCK:
545a1f38 830 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 831 break;
3fe4ff4f 832 case CMD_MIFARE_CIDENT:
833 MifareCIdent();
834 break;
b62a5a84
M
835
836 // mifare sniffer
837 case CMD_MIFARE_SNIFFER:
5cd9ec01 838 SniffMifare(c->arg[0]);
b62a5a84 839 break;
a631936e 840
20f9a2a1
M
841#endif
842
7e67e42f 843#ifdef WITH_ICLASS
cee5a30d 844 // Makes use of ISO14443a FPGA Firmware
845 case CMD_SNOOP_ICLASS:
846 SnoopIClass();
847 break;
1e262141 848 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 849 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 850 break;
851 case CMD_READER_ICLASS:
852 ReaderIClass(c->arg[0]);
853 break;
c3963755 854 case CMD_READER_ICLASS_REPLAY:
fecd8202 855 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 856 break;
e80aeb96
MHS
857 case CMD_ICLASS_EML_MEMSET:
858 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
859 break;
cee5a30d 860#endif
861
7e67e42f 862 case CMD_BUFF_CLEAR:
117d9ec2 863 BigBuf_Clear();
15c4dc5a 864 break;
15c4dc5a 865
866 case CMD_MEASURE_ANTENNA_TUNING:
867 MeasureAntennaTuning();
868 break;
869
870 case CMD_MEASURE_ANTENNA_TUNING_HF:
871 MeasureAntennaTuningHf();
872 break;
873
874 case CMD_LISTEN_READER_FIELD:
875 ListenReaderField(c->arg[0]);
876 break;
877
15c4dc5a 878 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
879 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
880 SpinDelay(200);
881 LED_D_OFF(); // LED D indicates field ON or OFF
882 break;
883
1c611bbd 884 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 885
1c611bbd 886 LED_B_ON();
117d9ec2 887 uint8_t *BigBuf = BigBuf_get_addr();
1c611bbd 888 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
889 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
3000dc4e 890 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1c611bbd 891 }
892 // Trigger a finish downloading signal with an ACK frame
3000dc4e 893 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
d3b1f4e4 894 LED_B_OFF();
1c611bbd 895 break;
15c4dc5a 896
897 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
117d9ec2 898 uint8_t *b = BigBuf_get_addr();
3fe4ff4f 899 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1c611bbd 900 cmd_send(CMD_ACK,0,0,0,0,0);
901 break;
902 }
15c4dc5a 903 case CMD_READ_MEM:
904 ReadMem(c->arg[0]);
905 break;
906
907 case CMD_SET_LF_DIVISOR:
7cc204bf 908 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 909 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
910 break;
911
912 case CMD_SET_ADC_MUX:
913 switch(c->arg[0]) {
914 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
915 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
916 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
917 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
918 }
919 break;
920
921 case CMD_VERSION:
922 SendVersion();
923 break;
924
15c4dc5a 925#ifdef WITH_LCD
926 case CMD_LCD_RESET:
927 LCDReset();
928 break;
929 case CMD_LCD:
930 LCDSend(c->arg[0]);
931 break;
932#endif
933 case CMD_SETUP_WRITE:
934 case CMD_FINISH_WRITE:
1c611bbd 935 case CMD_HARDWARE_RESET:
936 usb_disable();
15c4dc5a 937 SpinDelay(1000);
938 SpinDelay(1000);
939 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
940 for(;;) {
941 // We're going to reset, and the bootrom will take control.
942 }
1c611bbd 943 break;
15c4dc5a 944
1c611bbd 945 case CMD_START_FLASH:
15c4dc5a 946 if(common_area.flags.bootrom_present) {
947 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
948 }
1c611bbd 949 usb_disable();
15c4dc5a 950 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
951 for(;;);
1c611bbd 952 break;
e30c654b 953
15c4dc5a 954 case CMD_DEVICE_INFO: {
902cb3c0 955 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
956 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1c611bbd 957 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
958 break;
959 }
960 default:
15c4dc5a 961 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 962 break;
15c4dc5a 963 }
964}
965
966void __attribute__((noreturn)) AppMain(void)
967{
968 SpinDelay(100);
9e8255d4 969 clear_trace();
15c4dc5a 970 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
971 /* Initialize common area */
972 memset(&common_area, 0, sizeof(common_area));
973 common_area.magic = COMMON_AREA_MAGIC;
974 common_area.version = 1;
975 }
976 common_area.flags.osimage_present = 1;
977
978 LED_D_OFF();
979 LED_C_OFF();
980 LED_B_OFF();
981 LED_A_OFF();
982
3fe4ff4f 983 // Init USB device
902cb3c0 984 usb_enable();
15c4dc5a 985
986 // The FPGA gets its clock from us from PCK0 output, so set that up.
987 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
988 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
989 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
990 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
991 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
992 AT91C_PMC_PRES_CLK_4;
993 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
994
995 // Reset SPI
996 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
997 // Reset SSC
998 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
999
1000 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1001 // (the HF version by default)
1002 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1003
9ca155ba 1004 StartTickCount();
902cb3c0 1005
15c4dc5a 1006#ifdef WITH_LCD
15c4dc5a 1007 LCDInit();
15c4dc5a 1008#endif
1009
902cb3c0 1010 byte_t rx[sizeof(UsbCommand)];
1011 size_t rx_len;
1012
15c4dc5a 1013 for(;;) {
902cb3c0 1014 if (usb_poll()) {
1015 rx_len = usb_read(rx,sizeof(UsbCommand));
1016 if (rx_len) {
1017 UsbPacketReceived(rx,rx_len);
1018 }
1019 }
15c4dc5a 1020 WDT_HIT();
1021
1022#ifdef WITH_LF
1023 if (BUTTON_HELD(1000) > 0)
1024 SamyRun();
1025#endif
1026 }
1027}
Impressum, Datenschutz