]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/appmain.c
Merge pull request #33 from pwpiwi/master
[proxmark3-svn] / armsrc / appmain.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
15c4dc5a 2// Jonathan Westhues, Mar 2006
3// Edits by Gerhard de Koning Gans, Sep 2007 (##)
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// The main application code. This is the first thing called after start.c
10// executes.
15c4dc5a 11//-----------------------------------------------------------------------------
12
902cb3c0 13#include "usb_cdc.h"
14#include "cmd.h"
15
e30c654b 16#include "proxmark3.h"
15c4dc5a 17#include "apps.h"
f7e3ed82 18#include "util.h"
9ab7a6c7 19#include "printf.h"
20#include "string.h"
21
22#include <stdarg.h>
f7e3ed82 23
15c4dc5a 24#include "legicrf.h"
d19929cb 25#include <hitag2.h>
f7e3ed82 26
15c4dc5a 27#ifdef WITH_LCD
902cb3c0 28 #include "LCD.h"
15c4dc5a 29#endif
30
15c4dc5a 31#define abs(x) ( ((x)<0) ? -(x) : (x) )
32
33//=============================================================================
34// A buffer where we can queue things up to be sent through the FPGA, for
35// any purpose (fake tag, as reader, whatever). We go MSB first, since that
36// is the order in which they go out on the wire.
37//=============================================================================
38
6a1f2d82 39#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
40uint8_t ToSend[TOSEND_BUFFER_SIZE];
15c4dc5a 41int ToSendMax;
42static int ToSendBit;
43struct common_area common_area __attribute__((section(".commonarea")));
44
45void BufferClear(void)
46{
47 memset(BigBuf,0,sizeof(BigBuf));
48 Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
49}
50
51void ToSendReset(void)
52{
53 ToSendMax = -1;
54 ToSendBit = 8;
55}
56
57void ToSendStuffBit(int b)
58{
59 if(ToSendBit >= 8) {
60 ToSendMax++;
61 ToSend[ToSendMax] = 0;
62 ToSendBit = 0;
63 }
64
65 if(b) {
66 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
67 }
68
69 ToSendBit++;
70
6a1f2d82 71 if(ToSendMax >= sizeof(ToSend)) {
15c4dc5a 72 ToSendBit = 0;
73 DbpString("ToSendStuffBit overflowed!");
74 }
75}
76
77//=============================================================================
78// Debug print functions, to go out over USB, to the usual PC-side client.
79//=============================================================================
80
81void DbpString(char *str)
82{
9440213d 83 byte_t len = strlen(str);
84 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
902cb3c0 85// /* this holds up stuff unless we're connected to usb */
86// if (!UsbConnected())
87// return;
88//
89// UsbCommand c;
90// c.cmd = CMD_DEBUG_PRINT_STRING;
91// c.arg[0] = strlen(str);
92// if(c.arg[0] > sizeof(c.d.asBytes)) {
93// c.arg[0] = sizeof(c.d.asBytes);
94// }
95// memcpy(c.d.asBytes, str, c.arg[0]);
96//
97// UsbSendPacket((uint8_t *)&c, sizeof(c));
98// // TODO fix USB so stupid things like this aren't req'd
99// SpinDelay(50);
15c4dc5a 100}
101
102#if 0
103void DbpIntegers(int x1, int x2, int x3)
104{
902cb3c0 105 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
106// /* this holds up stuff unless we're connected to usb */
107// if (!UsbConnected())
108// return;
109//
110// UsbCommand c;
111// c.cmd = CMD_DEBUG_PRINT_INTEGERS;
112// c.arg[0] = x1;
113// c.arg[1] = x2;
114// c.arg[2] = x3;
115//
116// UsbSendPacket((uint8_t *)&c, sizeof(c));
117// // XXX
118// SpinDelay(50);
15c4dc5a 119}
120#endif
121
122void Dbprintf(const char *fmt, ...) {
123// should probably limit size here; oh well, let's just use a big buffer
124 char output_string[128];
125 va_list ap;
126
127 va_start(ap, fmt);
128 kvsprintf(fmt, output_string, 10, ap);
129 va_end(ap);
e30c654b 130
15c4dc5a 131 DbpString(output_string);
132}
133
9455b51c 134// prints HEX & ASCII
d19929cb 135void Dbhexdump(int len, uint8_t *d, bool bAsci) {
9455b51c 136 int l=0,i;
137 char ascii[9];
d19929cb 138
9455b51c 139 while (len>0) {
140 if (len>8) l=8;
141 else l=len;
142
143 memcpy(ascii,d,l);
d19929cb 144 ascii[l]=0;
9455b51c 145
146 // filter safe ascii
d19929cb 147 for (i=0;i<l;i++)
9455b51c 148 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
d19929cb 149
150 if (bAsci) {
151 Dbprintf("%-8s %*D",ascii,l,d," ");
152 } else {
153 Dbprintf("%*D",l,d," ");
154 }
155
9455b51c 156 len-=8;
157 d+=8;
158 }
159}
160
15c4dc5a 161//-----------------------------------------------------------------------------
162// Read an ADC channel and block till it completes, then return the result
163// in ADC units (0 to 1023). Also a routine to average 32 samples and
164// return that.
165//-----------------------------------------------------------------------------
166static int ReadAdc(int ch)
167{
f7e3ed82 168 uint32_t d;
15c4dc5a 169
170 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
171 AT91C_BASE_ADC->ADC_MR =
172 ADC_MODE_PRESCALE(32) |
173 ADC_MODE_STARTUP_TIME(16) |
174 ADC_MODE_SAMPLE_HOLD_TIME(8);
175 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
176
177 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
178 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
179 ;
180 d = AT91C_BASE_ADC->ADC_CDR[ch];
181
182 return d;
183}
184
9ca155ba 185int AvgAdc(int ch) // was static - merlok
15c4dc5a 186{
187 int i;
188 int a = 0;
189
190 for(i = 0; i < 32; i++) {
191 a += ReadAdc(ch);
192 }
193
194 return (a + 15) >> 5;
195}
196
197void MeasureAntennaTuning(void)
198{
2bdd68c3 199 uint8_t LF_Results[256];
9f693930 200 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
15c4dc5a 201 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
202
2bdd68c3 203 LED_B_ON();
15c4dc5a 204
205/*
206 * Sweeps the useful LF range of the proxmark from
207 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
208 * read the voltage in the antenna, the result left
209 * in the buffer is a graph which should clearly show
210 * the resonating frequency of your LF antenna
211 * ( hopefully around 95 if it is tuned to 125kHz!)
212 */
d19929cb 213
7cc204bf 214 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
b014c96d 215 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
2bdd68c3 216 for (i=255; i>=19; i--) {
d19929cb 217 WDT_HIT();
15c4dc5a 218 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
219 SpinDelay(20);
220 // Vref = 3.3V, and a 10000:240 voltage divider on the input
221 // can measure voltages up to 137500 mV
222 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
223 if (i==95) vLf125 = adcval; // voltage at 125Khz
224 if (i==89) vLf134 = adcval; // voltage at 134Khz
225
2bdd68c3 226 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
227 if(LF_Results[i] > peak) {
15c4dc5a 228 peakv = adcval;
2bdd68c3 229 peak = LF_Results[i];
15c4dc5a 230 peakf = i;
9f693930 231 //ptr = i;
15c4dc5a 232 }
233 }
234
2bdd68c3 235 for (i=18; i >= 0; i--) LF_Results[i] = 0;
236
237 LED_A_ON();
15c4dc5a 238 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 239 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 240 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
241 SpinDelay(20);
242 // Vref = 3300mV, and an 10:1 voltage divider on the input
243 // can measure voltages up to 33000 mV
244 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
245
2bdd68c3 246 cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),LF_Results,256);
d19929cb 247 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2bdd68c3 248 LED_A_OFF();
249 LED_B_OFF();
250 return;
15c4dc5a 251}
252
253void MeasureAntennaTuningHf(void)
254{
255 int vHf = 0; // in mV
256
257 DbpString("Measuring HF antenna, press button to exit");
258
259 for (;;) {
260 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
7cc204bf 261 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 262 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
263 SpinDelay(20);
264 // Vref = 3300mV, and an 10:1 voltage divider on the input
265 // can measure voltages up to 33000 mV
266 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
e30c654b 267
15c4dc5a 268 Dbprintf("%d mV",vHf);
269 if (BUTTON_PRESS()) break;
270 }
271 DbpString("cancelled");
272}
273
274
275void SimulateTagHfListen(void)
276{
d19929cb 277 uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
f7e3ed82 278 uint8_t v = 0;
15c4dc5a 279 int i;
280 int p = 0;
281
282 // We're using this mode just so that I can test it out; the simulated
283 // tag mode would work just as well and be simpler.
7cc204bf 284 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 285 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
286
287 // We need to listen to the high-frequency, peak-detected path.
288 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
289
290 FpgaSetupSsc();
291
292 i = 0;
293 for(;;) {
294 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
295 AT91C_BASE_SSC->SSC_THR = 0xff;
296 }
297 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 298 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 299
300 v <<= 1;
301 if(r & 1) {
302 v |= 1;
303 }
304 p++;
305
306 if(p >= 8) {
307 dest[i] = v;
308 v = 0;
309 p = 0;
310 i++;
311
d19929cb 312 if(i >= FREE_BUFFER_SIZE) {
15c4dc5a 313 break;
314 }
315 }
316 }
317 }
318 DbpString("simulate tag (now type bitsamples)");
319}
320
321void ReadMem(int addr)
322{
f7e3ed82 323 const uint8_t *data = ((uint8_t *)addr);
15c4dc5a 324
325 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
326 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
327}
328
329/* osimage version information is linked in */
330extern struct version_information version_information;
331/* bootrom version information is pointed to from _bootphase1_version_pointer */
332extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
333void SendVersion(void)
334{
cba867f2 335 char temp[256]; /* Limited data payload in USB packets */
15c4dc5a 336 DbpString("Prox/RFID mark3 RFID instrument");
e30c654b 337
338 /* Try to find the bootrom version information. Expect to find a pointer at
15c4dc5a 339 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
340 * pointer, then use it.
341 */
342 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
343 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
344 DbpString("bootrom version information appears invalid");
345 } else {
346 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
347 DbpString(temp);
348 }
e30c654b 349
15c4dc5a 350 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
351 DbpString(temp);
e30c654b 352
15c4dc5a 353 FpgaGatherVersion(temp, sizeof(temp));
354 DbpString(temp);
4f269f63 355 // Send Chip ID
356 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
15c4dc5a 357}
358
359#ifdef WITH_LF
360// samy's sniff and repeat routine
361void SamyRun()
362{
363 DbpString("Stand-alone mode! No PC necessary.");
7cc204bf 364 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 365
366 // 3 possible options? no just 2 for now
367#define OPTS 2
368
369 int high[OPTS], low[OPTS];
370
371 // Oooh pretty -- notify user we're in elite samy mode now
372 LED(LED_RED, 200);
373 LED(LED_ORANGE, 200);
374 LED(LED_GREEN, 200);
375 LED(LED_ORANGE, 200);
376 LED(LED_RED, 200);
377 LED(LED_ORANGE, 200);
378 LED(LED_GREEN, 200);
379 LED(LED_ORANGE, 200);
380 LED(LED_RED, 200);
381
382 int selected = 0;
383 int playing = 0;
384
385 // Turn on selected LED
386 LED(selected + 1, 0);
387
388 for (;;)
389 {
6e82300d 390// UsbPoll(FALSE);
391 usb_poll();
392 WDT_HIT();
15c4dc5a 393
394 // Was our button held down or pressed?
395 int button_pressed = BUTTON_HELD(1000);
396 SpinDelay(300);
397
398 // Button was held for a second, begin recording
399 if (button_pressed > 0)
400 {
401 LEDsoff();
402 LED(selected + 1, 0);
403 LED(LED_RED2, 0);
404
405 // record
406 DbpString("Starting recording");
407
408 // wait for button to be released
409 while(BUTTON_PRESS())
410 WDT_HIT();
411
412 /* need this delay to prevent catching some weird data */
413 SpinDelay(500);
414
415 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
416 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
417
418 LEDsoff();
419 LED(selected + 1, 0);
420 // Finished recording
421
422 // If we were previously playing, set playing off
423 // so next button push begins playing what we recorded
424 playing = 0;
425 }
426
427 // Change where to record (or begin playing)
428 else if (button_pressed)
429 {
430 // Next option if we were previously playing
431 if (playing)
432 selected = (selected + 1) % OPTS;
433 playing = !playing;
434
435 LEDsoff();
436 LED(selected + 1, 0);
437
438 // Begin transmitting
439 if (playing)
440 {
441 LED(LED_GREEN, 0);
442 DbpString("Playing");
443 // wait for button to be released
444 while(BUTTON_PRESS())
445 WDT_HIT();
446 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
447 CmdHIDsimTAG(high[selected], low[selected], 0);
448 DbpString("Done playing");
449 if (BUTTON_HELD(1000) > 0)
450 {
451 DbpString("Exiting");
452 LEDsoff();
453 return;
454 }
455
456 /* We pressed a button so ignore it here with a delay */
457 SpinDelay(300);
458
459 // when done, we're done playing, move to next option
460 selected = (selected + 1) % OPTS;
461 playing = !playing;
462 LEDsoff();
463 LED(selected + 1, 0);
464 }
465 else
466 while(BUTTON_PRESS())
467 WDT_HIT();
468 }
469 }
470}
471#endif
472
473/*
474OBJECTIVE
475Listen and detect an external reader. Determine the best location
476for the antenna.
477
478INSTRUCTIONS:
479Inside the ListenReaderField() function, there is two mode.
480By default, when you call the function, you will enter mode 1.
481If you press the PM3 button one time, you will enter mode 2.
482If you press the PM3 button a second time, you will exit the function.
483
484DESCRIPTION OF MODE 1:
485This mode just listens for an external reader field and lights up green
486for HF and/or red for LF. This is the original mode of the detectreader
487function.
488
489DESCRIPTION OF MODE 2:
490This mode will visually represent, using the LEDs, the actual strength of the
491current compared to the maximum current detected. Basically, once you know
492what kind of external reader is present, it will help you spot the best location to place
493your antenna. You will probably not get some good results if there is a LF and a HF reader
494at the same place! :-)
495
496LIGHT SCHEME USED:
497*/
498static const char LIGHT_SCHEME[] = {
499 0x0, /* ---- | No field detected */
500 0x1, /* X--- | 14% of maximum current detected */
501 0x2, /* -X-- | 29% of maximum current detected */
502 0x4, /* --X- | 43% of maximum current detected */
503 0x8, /* ---X | 57% of maximum current detected */
504 0xC, /* --XX | 71% of maximum current detected */
505 0xE, /* -XXX | 86% of maximum current detected */
506 0xF, /* XXXX | 100% of maximum current detected */
507};
508static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
509
510void ListenReaderField(int limit)
511{
512 int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
513 int hf_av, hf_av_new, hf_baseline= 0, hf_count= 0, hf_max;
514 int mode=1, display_val, display_max, i;
515
516#define LF_ONLY 1
517#define HF_ONLY 2
518
519 LEDsoff();
520
521 lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
522
523 if(limit != HF_ONLY) {
524 Dbprintf("LF 125/134 Baseline: %d", lf_av);
525 lf_baseline = lf_av;
526 }
527
528 hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
529
530 if (limit != LF_ONLY) {
531 Dbprintf("HF 13.56 Baseline: %d", hf_av);
532 hf_baseline = hf_av;
533 }
534
535 for(;;) {
536 if (BUTTON_PRESS()) {
537 SpinDelay(500);
538 switch (mode) {
539 case 1:
540 mode=2;
541 DbpString("Signal Strength Mode");
542 break;
543 case 2:
544 default:
545 DbpString("Stopped");
546 LEDsoff();
547 return;
548 break;
549 }
550 }
551 WDT_HIT();
552
553 if (limit != HF_ONLY) {
554 if(mode==1) {
555 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
556 else LED_D_OFF();
557 }
e30c654b 558
15c4dc5a 559 ++lf_count;
560 lf_av_new= ReadAdc(ADC_CHAN_LF);
561 // see if there's a significant change
562 if(abs(lf_av - lf_av_new) > 10) {
563 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
564 lf_av = lf_av_new;
565 if (lf_av > lf_max)
566 lf_max = lf_av;
567 lf_count= 0;
568 }
569 }
570
571 if (limit != LF_ONLY) {
572 if (mode == 1){
573 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
574 else LED_B_OFF();
575 }
e30c654b 576
15c4dc5a 577 ++hf_count;
578 hf_av_new= ReadAdc(ADC_CHAN_HF);
579 // see if there's a significant change
580 if(abs(hf_av - hf_av_new) > 10) {
581 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
582 hf_av = hf_av_new;
583 if (hf_av > hf_max)
584 hf_max = hf_av;
585 hf_count= 0;
586 }
587 }
e30c654b 588
15c4dc5a 589 if(mode == 2) {
590 if (limit == LF_ONLY) {
591 display_val = lf_av;
592 display_max = lf_max;
593 } else if (limit == HF_ONLY) {
594 display_val = hf_av;
595 display_max = hf_max;
596 } else { /* Pick one at random */
597 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
598 display_val = hf_av;
599 display_max = hf_max;
600 } else {
601 display_val = lf_av;
602 display_max = lf_max;
603 }
604 }
605 for (i=0; i<LIGHT_LEN; i++) {
606 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
607 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
608 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
609 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
610 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
611 break;
612 }
613 }
614 }
615 }
616}
617
f7e3ed82 618void UsbPacketReceived(uint8_t *packet, int len)
15c4dc5a 619{
620 UsbCommand *c = (UsbCommand *)packet;
15c4dc5a 621
902cb3c0 622// Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
623
15c4dc5a 624 switch(c->cmd) {
625#ifdef WITH_LF
626 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
627 AcquireRawAdcSamples125k(c->arg[0]);
1c611bbd 628 cmd_send(CMD_ACK,0,0,0,0,0);
15c4dc5a 629 break;
15c4dc5a 630 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
631 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
632 break;
b014c96d 633 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
634 SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
635 cmd_send(CMD_ACK,0,0,0,0,0);
636 break;
7e67e42f 637 case CMD_HID_DEMOD_FSK:
083ca3de 638 CmdHIDdemodFSK(c->arg[0], 0, 0, 1); // Demodulate HID tag
7e67e42f 639 break;
640 case CMD_HID_SIM_TAG:
641 CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID
642 break;
a1f3bb12 643 case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
1c611bbd 644 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
7e67e42f 645 break;
a1f3bb12 646 case CMD_IO_DEMOD_FSK:
083ca3de 647 CmdIOdemodFSK(c->arg[0], 0, 0, 1); // Demodulate IO tag
a1f3bb12 648 break;
649 case CMD_IO_CLONE_TAG: // Clone IO tag by ID to T55x7
650 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
651 break;
2d4eae76 652 case CMD_EM410X_WRITE_TAG:
653 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
654 break;
7e67e42f 655 case CMD_READ_TI_TYPE:
656 ReadTItag();
657 break;
658 case CMD_WRITE_TI_TYPE:
659 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
660 break;
661 case CMD_SIMULATE_TAG_125K:
662 LED_A_ON();
663 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
664 LED_A_OFF();
665 break;
666 case CMD_LF_SIMULATE_BIDIR:
667 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
668 break;
2414f978 669 case CMD_INDALA_CLONE_TAG: // Clone Indala 64-bit tag by UID to T55x7
670 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
671 break;
672 case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7
673 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
674 break;
1c611bbd 675 case CMD_T55XX_READ_BLOCK:
676 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
677 break;
678 case CMD_T55XX_WRITE_BLOCK:
679 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
680 break;
681 case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
682 T55xxReadTrace();
683 break;
684 case CMD_PCF7931_READ: // Read PCF7931 tag
685 ReadPCF7931();
686 cmd_send(CMD_ACK,0,0,0,0,0);
687// UsbSendPacket((uint8_t*)&ack, sizeof(ack));
688 break;
689 case CMD_EM4X_READ_WORD:
690 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
691 break;
692 case CMD_EM4X_WRITE_WORD:
693 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
694 break;
15c4dc5a 695#endif
696
d19929cb 697#ifdef WITH_HITAG
698 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
699 SnoopHitag(c->arg[0]);
700 break;
701 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
702 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
703 break;
704 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
705 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
706 break;
707#endif
708
15c4dc5a 709#ifdef WITH_ISO15693
710 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
711 AcquireRawAdcSamplesIso15693();
712 break;
9455b51c 713 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
714 RecordRawAdcSamplesIso15693();
715 break;
716
717 case CMD_ISO_15693_COMMAND:
718 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
719 break;
720
721 case CMD_ISO_15693_FIND_AFI:
722 BruteforceIso15693Afi(c->arg[0]);
723 break;
724
725 case CMD_ISO_15693_DEBUG:
726 SetDebugIso15693(c->arg[0]);
727 break;
15c4dc5a 728
15c4dc5a 729 case CMD_READER_ISO_15693:
730 ReaderIso15693(c->arg[0]);
731 break;
7e67e42f 732 case CMD_SIMTAG_ISO_15693:
733 SimTagIso15693(c->arg[0]);
734 break;
15c4dc5a 735#endif
736
7e67e42f 737#ifdef WITH_LEGICRF
738 case CMD_SIMULATE_TAG_LEGIC_RF:
739 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
740 break;
3612a8a8 741
7e67e42f 742 case CMD_WRITER_LEGIC_RF:
743 LegicRfWriter(c->arg[1], c->arg[0]);
744 break;
3612a8a8 745
15c4dc5a 746 case CMD_READER_LEGIC_RF:
747 LegicRfReader(c->arg[0], c->arg[1]);
748 break;
15c4dc5a 749#endif
750
751#ifdef WITH_ISO14443b
752 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
753 AcquireRawAdcSamplesIso14443(c->arg[0]);
754 break;
15c4dc5a 755 case CMD_READ_SRI512_TAG:
7cf3ef20 756 ReadSTMemoryIso14443(0x0F);
15c4dc5a 757 break;
7e67e42f 758 case CMD_READ_SRIX4K_TAG:
7cf3ef20 759 ReadSTMemoryIso14443(0x7F);
7e67e42f 760 break;
761 case CMD_SNOOP_ISO_14443:
762 SnoopIso14443();
763 break;
764 case CMD_SIMULATE_TAG_ISO_14443:
765 SimulateIso14443Tag();
766 break;
7cf3ef20 767 case CMD_ISO_14443B_COMMAND:
768 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
769 break;
15c4dc5a 770#endif
771
772#ifdef WITH_ISO14443a
7e67e42f 773 case CMD_SNOOP_ISO_14443a:
5cd9ec01 774 SnoopIso14443a(c->arg[0]);
7e67e42f 775 break;
15c4dc5a 776 case CMD_READER_ISO_14443a:
902cb3c0 777 ReaderIso14443a(c);
15c4dc5a 778 break;
7e67e42f 779 case CMD_SIMULATE_TAG_ISO_14443a:
28afbd2b 780 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
7e67e42f 781 break;
5acd09bd 782 case CMD_EPA_PACE_COLLECT_NONCE:
902cb3c0 783 EPA_PACE_Collect_Nonce(c);
5acd09bd 784 break;
7e67e42f 785
15c4dc5a 786 case CMD_READER_MIFARE:
1c611bbd 787 ReaderMifare(c->arg[0]);
15c4dc5a 788 break;
20f9a2a1
M
789 case CMD_MIFARE_READBL:
790 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
791 break;
981bd429 792 case CMD_MIFAREU_READBL:
793 MifareUReadBlock(c->arg[0],c->d.asBytes);
794 break;
795 case CMD_MIFAREU_READCARD:
796 MifareUReadCard(c->arg[0],c->d.asBytes);
797 break;
20f9a2a1
M
798 case CMD_MIFARE_READSC:
799 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
800 break;
801 case CMD_MIFARE_WRITEBL:
802 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
803 break;
981bd429 804 case CMD_MIFAREU_WRITEBL_COMPAT:
805 MifareUWriteBlock(c->arg[0], c->d.asBytes);
806 break;
807 case CMD_MIFAREU_WRITEBL:
808 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
809 break;
20f9a2a1
M
810 case CMD_MIFARE_NESTED:
811 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
f397b5cc
M
812 break;
813 case CMD_MIFARE_CHKKEYS:
814 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
20f9a2a1
M
815 break;
816 case CMD_SIMULATE_MIFARE_CARD:
817 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
818 break;
8556b852
M
819
820 // emulator
821 case CMD_MIFARE_SET_DBGMODE:
822 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
823 break;
824 case CMD_MIFARE_EML_MEMCLR:
825 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
826 break;
827 case CMD_MIFARE_EML_MEMSET:
828 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
829 break;
830 case CMD_MIFARE_EML_MEMGET:
831 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
832 break;
833 case CMD_MIFARE_EML_CARDLOAD:
834 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
0675f200
M
835 break;
836
837 // Work with "magic Chinese" card
838 case CMD_MIFARE_EML_CSETBLOCK:
839 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545a1f38
M
840 break;
841 case CMD_MIFARE_EML_CGETBLOCK:
842 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
8556b852 843 break;
b62a5a84
M
844
845 // mifare sniffer
846 case CMD_MIFARE_SNIFFER:
5cd9ec01 847 SniffMifare(c->arg[0]);
b62a5a84 848 break;
20f9a2a1
M
849#endif
850
7e67e42f 851#ifdef WITH_ICLASS
cee5a30d 852 // Makes use of ISO14443a FPGA Firmware
853 case CMD_SNOOP_ICLASS:
854 SnoopIClass();
855 break;
1e262141 856 case CMD_SIMULATE_TAG_ICLASS:
ff7bb4ef 857 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1e262141 858 break;
859 case CMD_READER_ICLASS:
860 ReaderIClass(c->arg[0]);
861 break;
c3963755 862 case CMD_READER_ICLASS_REPLAY:
fecd8202 863 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
c3963755 864 break;
cee5a30d 865#endif
866
15c4dc5a 867 case CMD_SIMULATE_TAG_HF_LISTEN:
868 SimulateTagHfListen();
869 break;
870
7e67e42f 871 case CMD_BUFF_CLEAR:
872 BufferClear();
15c4dc5a 873 break;
15c4dc5a 874
875 case CMD_MEASURE_ANTENNA_TUNING:
876 MeasureAntennaTuning();
877 break;
878
879 case CMD_MEASURE_ANTENNA_TUNING_HF:
880 MeasureAntennaTuningHf();
881 break;
882
883 case CMD_LISTEN_READER_FIELD:
884 ListenReaderField(c->arg[0]);
885 break;
886
15c4dc5a 887 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
888 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
889 SpinDelay(200);
890 LED_D_OFF(); // LED D indicates field ON or OFF
891 break;
892
1c611bbd 893 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
902cb3c0 894// UsbCommand n;
895// if(c->cmd == CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K) {
896// n.cmd = CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K;
897// } else {
898// n.cmd = CMD_DOWNLOADED_RAW_BITS_TI_TYPE;
899// }
900// n.arg[0] = c->arg[0];
901 // memcpy(n.d.asBytes, BigBuf+c->arg[0], 48); // 12*sizeof(uint32_t)
902 // LED_B_ON();
903 // usb_write((uint8_t *)&n, sizeof(n));
904 // UsbSendPacket((uint8_t *)&n, sizeof(n));
905 // LED_B_OFF();
906
1c611bbd 907 LED_B_ON();
908 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
909 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
910 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
911 }
912 // Trigger a finish downloading signal with an ACK frame
913 cmd_send(CMD_ACK,0,0,0,0,0);
d3b1f4e4 914 LED_B_OFF();
1c611bbd 915 break;
15c4dc5a 916
917 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
f7e3ed82 918 uint8_t *b = (uint8_t *)BigBuf;
15c4dc5a 919 memcpy(b+c->arg[0], c->d.asBytes, 48);
920 //Dbprintf("copied 48 bytes to %i",b+c->arg[0]);
902cb3c0 921// UsbSendPacket((uint8_t*)&ack, sizeof(ack));
1c611bbd 922 cmd_send(CMD_ACK,0,0,0,0,0);
923 break;
924 }
15c4dc5a 925 case CMD_READ_MEM:
926 ReadMem(c->arg[0]);
927 break;
928
929 case CMD_SET_LF_DIVISOR:
7cc204bf 930 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
15c4dc5a 931 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
932 break;
933
934 case CMD_SET_ADC_MUX:
935 switch(c->arg[0]) {
936 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
937 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
938 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
939 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
940 }
941 break;
942
943 case CMD_VERSION:
944 SendVersion();
945 break;
946
15c4dc5a 947#ifdef WITH_LCD
948 case CMD_LCD_RESET:
949 LCDReset();
950 break;
951 case CMD_LCD:
952 LCDSend(c->arg[0]);
953 break;
954#endif
955 case CMD_SETUP_WRITE:
956 case CMD_FINISH_WRITE:
1c611bbd 957 case CMD_HARDWARE_RESET:
958 usb_disable();
15c4dc5a 959 SpinDelay(1000);
960 SpinDelay(1000);
961 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
962 for(;;) {
963 // We're going to reset, and the bootrom will take control.
964 }
1c611bbd 965 break;
15c4dc5a 966
1c611bbd 967 case CMD_START_FLASH:
15c4dc5a 968 if(common_area.flags.bootrom_present) {
969 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
970 }
1c611bbd 971 usb_disable();
15c4dc5a 972 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
973 for(;;);
1c611bbd 974 break;
e30c654b 975
15c4dc5a 976 case CMD_DEVICE_INFO: {
902cb3c0 977 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
978 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
979// UsbSendPacket((uint8_t*)&c, sizeof(c));
1c611bbd 980 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
981 break;
982 }
983 default:
15c4dc5a 984 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1c611bbd 985 break;
15c4dc5a 986 }
987}
988
989void __attribute__((noreturn)) AppMain(void)
990{
991 SpinDelay(100);
e30c654b 992
15c4dc5a 993 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
994 /* Initialize common area */
995 memset(&common_area, 0, sizeof(common_area));
996 common_area.magic = COMMON_AREA_MAGIC;
997 common_area.version = 1;
998 }
999 common_area.flags.osimage_present = 1;
1000
1001 LED_D_OFF();
1002 LED_C_OFF();
1003 LED_B_OFF();
1004 LED_A_OFF();
1005
28fdb04f 1006 // Init USB device`
902cb3c0 1007 usb_enable();
902cb3c0 1008// UsbStart();
15c4dc5a 1009
1010 // The FPGA gets its clock from us from PCK0 output, so set that up.
1011 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1012 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1013 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1014 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1015 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1016 AT91C_PMC_PRES_CLK_4;
1017 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1018
1019 // Reset SPI
1020 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1021 // Reset SSC
1022 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1023
1024 // Load the FPGA image, which we have stored in our flash.
7cc204bf 1025 // (the HF version by default)
1026 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1027
9ca155ba 1028 StartTickCount();
902cb3c0 1029
15c4dc5a 1030#ifdef WITH_LCD
15c4dc5a 1031 LCDInit();
15c4dc5a 1032#endif
1033
902cb3c0 1034 byte_t rx[sizeof(UsbCommand)];
1035 size_t rx_len;
1036
15c4dc5a 1037 for(;;) {
902cb3c0 1038 if (usb_poll()) {
1039 rx_len = usb_read(rx,sizeof(UsbCommand));
1040 if (rx_len) {
1041 UsbPacketReceived(rx,rx_len);
1042 }
1043 }
1044// UsbPoll(FALSE);
1045
15c4dc5a 1046 WDT_HIT();
1047
1048#ifdef WITH_LF
1049 if (BUTTON_HELD(1000) > 0)
1050 SamyRun();
1051#endif
1052 }
1053}
Impressum, Datenschutz