]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


035b11c05084704a73b65d2fe79b78019e4d58d0
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 #define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34 //=============================================================================
35 // A buffer where we can queue things up to be sent through the FPGA, for
36 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
37 // is the order in which they go out on the wire.
38 //=============================================================================
39
40 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41 uint8_t ToSend[TOSEND_BUFFER_SIZE];
42 int ToSendMax;
43 static int ToSendBit;
44 struct common_area common_area __attribute__((section(".commonarea")));
45
46 void ToSendReset(void)
47 {
48 ToSendMax = -1;
49 ToSendBit = 8;
50 }
51
52 void ToSendStuffBit(int b)
53 {
54 if(ToSendBit >= 8) {
55 ToSendMax++;
56 ToSend[ToSendMax] = 0;
57 ToSendBit = 0;
58 }
59
60 if(b) {
61 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
62 }
63
64 ToSendBit++;
65
66 if(ToSendMax >= sizeof(ToSend)) {
67 ToSendBit = 0;
68 DbpString("ToSendStuffBit overflowed!");
69 }
70 }
71
72 //=============================================================================
73 // Debug print functions, to go out over USB, to the usual PC-side client.
74 //=============================================================================
75
76 void DbpString(char *str)
77 {
78 byte_t len = strlen(str);
79 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
80 }
81
82 #if 0
83 void DbpIntegers(int x1, int x2, int x3)
84 {
85 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
86 }
87 #endif
88
89 void Dbprintf(const char *fmt, ...) {
90 // should probably limit size here; oh well, let's just use a big buffer
91 char output_string[128];
92 va_list ap;
93
94 va_start(ap, fmt);
95 kvsprintf(fmt, output_string, 10, ap);
96 va_end(ap);
97
98 DbpString(output_string);
99 }
100
101 // prints HEX & ASCII
102 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
103 int l=0,i;
104 char ascii[9];
105
106 while (len>0) {
107 if (len>8) l=8;
108 else l=len;
109
110 memcpy(ascii,d,l);
111 ascii[l]=0;
112
113 // filter safe ascii
114 for (i=0;i<l;i++)
115 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
116
117 if (bAsci) {
118 Dbprintf("%-8s %*D",ascii,l,d," ");
119 } else {
120 Dbprintf("%*D",l,d," ");
121 }
122
123 len-=8;
124 d+=8;
125 }
126 }
127
128 //-----------------------------------------------------------------------------
129 // Read an ADC channel and block till it completes, then return the result
130 // in ADC units (0 to 1023). Also a routine to average 32 samples and
131 // return that.
132 //-----------------------------------------------------------------------------
133 static int ReadAdc(int ch)
134 {
135 uint32_t d;
136
137 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
138 AT91C_BASE_ADC->ADC_MR =
139 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
140 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
141 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
142
143 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
144 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
145 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
146 //
147 // The maths are:
148 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
149 //
150 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
151 //
152 // Note: with the "historic" values in the comments above, the error was 34% !!!
153
154 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
155
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
157
158 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
159 ;
160 d = AT91C_BASE_ADC->ADC_CDR[ch];
161
162 return d;
163 }
164
165 int AvgAdc(int ch) // was static - merlok
166 {
167 int i;
168 int a = 0;
169
170 for(i = 0; i < 32; i++) {
171 a += ReadAdc(ch);
172 }
173
174 return (a + 15) >> 5;
175 }
176
177 void MeasureAntennaTuning(void)
178 {
179 uint8_t LF_Results[256];
180 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
181 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
182
183 LED_B_ON();
184
185 /*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
193
194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
196 for (i=255; i>=19; i--) {
197 WDT_HIT();
198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
201 if (i==95) vLf125 = adcval; // voltage at 125Khz
202 if (i==89) vLf134 = adcval; // voltage at 134Khz
203
204 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
205 if(LF_Results[i] > peak) {
206 peakv = adcval;
207 peak = LF_Results[i];
208 peakf = i;
209 //ptr = i;
210 }
211 }
212
213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
214
215 LED_A_ON();
216 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
217 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
218 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
219 SpinDelay(20);
220 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
221
222 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
223 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
224 LED_A_OFF();
225 LED_B_OFF();
226 return;
227 }
228
229 void MeasureAntennaTuningHf(void)
230 {
231 int vHf = 0; // in mV
232
233 DbpString("Measuring HF antenna, press button to exit");
234
235 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
236 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
237 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
238
239 for (;;) {
240 SpinDelay(20);
241 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
242
243 Dbprintf("%d mV",vHf);
244 if (BUTTON_PRESS()) break;
245 }
246 DbpString("cancelled");
247
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
249
250 }
251
252
253 void ReadMem(int addr)
254 {
255 const uint8_t *data = ((uint8_t *)addr);
256
257 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
258 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
259 }
260
261 /* osimage version information is linked in */
262 extern struct version_information version_information;
263 /* bootrom version information is pointed to from _bootphase1_version_pointer */
264 extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
265 void SendVersion(void)
266 {
267 char temp[512]; /* Limited data payload in USB packets */
268 DbpString("Prox/RFID mark3 RFID instrument");
269
270 /* Try to find the bootrom version information. Expect to find a pointer at
271 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
272 * pointer, then use it.
273 */
274 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
275 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
276 DbpString("bootrom version information appears invalid");
277 } else {
278 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
279 DbpString(temp);
280 }
281
282 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
283 DbpString(temp);
284
285 FpgaGatherVersion(temp, sizeof(temp));
286 DbpString(temp);
287 // Send Chip ID
288 cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
289 }
290
291 #ifdef WITH_LF
292 // samy's sniff and repeat routine
293 void SamyRun()
294 {
295 DbpString("Stand-alone mode! No PC necessary.");
296 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
297
298 // 3 possible options? no just 2 for now
299 #define OPTS 2
300
301 int high[OPTS], low[OPTS];
302
303 // Oooh pretty -- notify user we're in elite samy mode now
304 LED(LED_RED, 200);
305 LED(LED_ORANGE, 200);
306 LED(LED_GREEN, 200);
307 LED(LED_ORANGE, 200);
308 LED(LED_RED, 200);
309 LED(LED_ORANGE, 200);
310 LED(LED_GREEN, 200);
311 LED(LED_ORANGE, 200);
312 LED(LED_RED, 200);
313
314 int selected = 0;
315 int playing = 0;
316 int cardRead = 0;
317
318 // Turn on selected LED
319 LED(selected + 1, 0);
320
321 for (;;)
322 {
323 usb_poll();
324 WDT_HIT();
325
326 // Was our button held down or pressed?
327 int button_pressed = BUTTON_HELD(1000);
328 SpinDelay(300);
329
330 // Button was held for a second, begin recording
331 if (button_pressed > 0 && cardRead == 0)
332 {
333 LEDsoff();
334 LED(selected + 1, 0);
335 LED(LED_RED2, 0);
336
337 // record
338 DbpString("Starting recording");
339
340 // wait for button to be released
341 while(BUTTON_PRESS())
342 WDT_HIT();
343
344 /* need this delay to prevent catching some weird data */
345 SpinDelay(500);
346
347 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
348 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
349
350 LEDsoff();
351 LED(selected + 1, 0);
352 // Finished recording
353
354 // If we were previously playing, set playing off
355 // so next button push begins playing what we recorded
356 playing = 0;
357
358 cardRead = 1;
359
360 }
361
362 else if (button_pressed > 0 && cardRead == 1)
363 {
364 LEDsoff();
365 LED(selected + 1, 0);
366 LED(LED_ORANGE, 0);
367
368 // record
369 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
370
371 // wait for button to be released
372 while(BUTTON_PRESS())
373 WDT_HIT();
374
375 /* need this delay to prevent catching some weird data */
376 SpinDelay(500);
377
378 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
379 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
380
381 LEDsoff();
382 LED(selected + 1, 0);
383 // Finished recording
384
385 // If we were previously playing, set playing off
386 // so next button push begins playing what we recorded
387 playing = 0;
388
389 cardRead = 0;
390
391 }
392
393 // Change where to record (or begin playing)
394 else if (button_pressed)
395 {
396 // Next option if we were previously playing
397 if (playing)
398 selected = (selected + 1) % OPTS;
399 playing = !playing;
400
401 LEDsoff();
402 LED(selected + 1, 0);
403
404 // Begin transmitting
405 if (playing)
406 {
407 LED(LED_GREEN, 0);
408 DbpString("Playing");
409 // wait for button to be released
410 while(BUTTON_PRESS())
411 WDT_HIT();
412 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
413 CmdHIDsimTAG(high[selected], low[selected], 0);
414 DbpString("Done playing");
415 if (BUTTON_HELD(1000) > 0)
416 {
417 DbpString("Exiting");
418 LEDsoff();
419 return;
420 }
421
422 /* We pressed a button so ignore it here with a delay */
423 SpinDelay(300);
424
425 // when done, we're done playing, move to next option
426 selected = (selected + 1) % OPTS;
427 playing = !playing;
428 LEDsoff();
429 LED(selected + 1, 0);
430 }
431 else
432 while(BUTTON_PRESS())
433 WDT_HIT();
434 }
435 }
436 }
437 #endif
438
439 /*
440 OBJECTIVE
441 Listen and detect an external reader. Determine the best location
442 for the antenna.
443
444 INSTRUCTIONS:
445 Inside the ListenReaderField() function, there is two mode.
446 By default, when you call the function, you will enter mode 1.
447 If you press the PM3 button one time, you will enter mode 2.
448 If you press the PM3 button a second time, you will exit the function.
449
450 DESCRIPTION OF MODE 1:
451 This mode just listens for an external reader field and lights up green
452 for HF and/or red for LF. This is the original mode of the detectreader
453 function.
454
455 DESCRIPTION OF MODE 2:
456 This mode will visually represent, using the LEDs, the actual strength of the
457 current compared to the maximum current detected. Basically, once you know
458 what kind of external reader is present, it will help you spot the best location to place
459 your antenna. You will probably not get some good results if there is a LF and a HF reader
460 at the same place! :-)
461
462 LIGHT SCHEME USED:
463 */
464 static const char LIGHT_SCHEME[] = {
465 0x0, /* ---- | No field detected */
466 0x1, /* X--- | 14% of maximum current detected */
467 0x2, /* -X-- | 29% of maximum current detected */
468 0x4, /* --X- | 43% of maximum current detected */
469 0x8, /* ---X | 57% of maximum current detected */
470 0xC, /* --XX | 71% of maximum current detected */
471 0xE, /* -XXX | 86% of maximum current detected */
472 0xF, /* XXXX | 100% of maximum current detected */
473 };
474 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
475
476 void ListenReaderField(int limit)
477 {
478 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
479 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
480 int mode=1, display_val, display_max, i;
481
482 #define LF_ONLY 1
483 #define HF_ONLY 2
484 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
485
486
487 // switch off FPGA - we don't want to measure our own signal
488 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
489 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
490
491 LEDsoff();
492
493 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
494
495 if(limit != HF_ONLY) {
496 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
497 lf_baseline = lf_av;
498 }
499
500 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
501
502 if (limit != LF_ONLY) {
503 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
504 hf_baseline = hf_av;
505 }
506
507 for(;;) {
508 if (BUTTON_PRESS()) {
509 SpinDelay(500);
510 switch (mode) {
511 case 1:
512 mode=2;
513 DbpString("Signal Strength Mode");
514 break;
515 case 2:
516 default:
517 DbpString("Stopped");
518 LEDsoff();
519 return;
520 break;
521 }
522 }
523 WDT_HIT();
524
525 if (limit != HF_ONLY) {
526 if(mode == 1) {
527 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
528 LED_D_ON();
529 else
530 LED_D_OFF();
531 }
532
533 lf_av_new = AvgAdc(ADC_CHAN_LF);
534 // see if there's a significant change
535 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
536 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
537 lf_av = lf_av_new;
538 if (lf_av > lf_max)
539 lf_max = lf_av;
540 }
541 }
542
543 if (limit != LF_ONLY) {
544 if (mode == 1){
545 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
546 LED_B_ON();
547 else
548 LED_B_OFF();
549 }
550
551 hf_av_new = AvgAdc(ADC_CHAN_HF);
552 // see if there's a significant change
553 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
554 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
555 hf_av = hf_av_new;
556 if (hf_av > hf_max)
557 hf_max = hf_av;
558 }
559 }
560
561 if(mode == 2) {
562 if (limit == LF_ONLY) {
563 display_val = lf_av;
564 display_max = lf_max;
565 } else if (limit == HF_ONLY) {
566 display_val = hf_av;
567 display_max = hf_max;
568 } else { /* Pick one at random */
569 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
570 display_val = hf_av;
571 display_max = hf_max;
572 } else {
573 display_val = lf_av;
574 display_max = lf_max;
575 }
576 }
577 for (i=0; i<LIGHT_LEN; i++) {
578 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
579 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
580 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
581 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
582 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
583 break;
584 }
585 }
586 }
587 }
588 }
589
590 void UsbPacketReceived(uint8_t *packet, int len)
591 {
592 UsbCommand *c = (UsbCommand *)packet;
593
594 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
595
596 switch(c->cmd) {
597 #ifdef WITH_LF
598 case CMD_SET_LF_SAMPLING_CONFIG:
599 setSamplingConfig((sample_config *) c->d.asBytes);
600 break;
601 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
602 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
603 break;
604 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
605 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
606 break;
607 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
608 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
609 break;
610 case CMD_HID_DEMOD_FSK:
611 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
612 break;
613 case CMD_HID_SIM_TAG:
614 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
615 break;
616 case CMD_FSK_SIM_TAG:
617 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
618 break;
619 case CMD_ASK_SIM_TAG:
620 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
621 break;
622 case CMD_PSK_SIM_TAG:
623 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
624 break;
625 case CMD_HID_CLONE_TAG:
626 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
627 break;
628 case CMD_IO_DEMOD_FSK:
629 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
630 break;
631 case CMD_IO_CLONE_TAG:
632 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
633 break;
634 case CMD_EM410X_DEMOD:
635 CmdEM410xdemod(c->arg[0], 0, 0, 1);
636 break;
637 case CMD_EM410X_WRITE_TAG:
638 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
639 break;
640 case CMD_READ_TI_TYPE:
641 ReadTItag();
642 break;
643 case CMD_WRITE_TI_TYPE:
644 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
645 break;
646 case CMD_SIMULATE_TAG_125K:
647 LED_A_ON();
648 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
649 LED_A_OFF();
650 break;
651 case CMD_LF_SIMULATE_BIDIR:
652 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
653 break;
654 case CMD_INDALA_CLONE_TAG:
655 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
656 break;
657 case CMD_INDALA_CLONE_TAG_L:
658 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
659 break;
660 case CMD_T55XX_READ_BLOCK:
661 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
662 break;
663 case CMD_T55XX_WRITE_BLOCK:
664 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
665 break;
666 case CMD_T55XX_READ_TRACE:
667 T55xxReadTrace();
668 break;
669 case CMD_PCF7931_READ:
670 ReadPCF7931();
671 cmd_send(CMD_ACK,0,0,0,0,0);
672 break;
673 case CMD_EM4X_READ_WORD:
674 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
675 break;
676 case CMD_EM4X_WRITE_WORD:
677 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
678 break;
679 #endif
680
681 #ifdef WITH_HITAG
682 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
683 SnoopHitag(c->arg[0]);
684 break;
685 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
686 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
687 break;
688 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
689 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
690 break;
691 #endif
692
693 #ifdef WITH_ISO15693
694 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
695 AcquireRawAdcSamplesIso15693();
696 break;
697 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
698 RecordRawAdcSamplesIso15693();
699 break;
700
701 case CMD_ISO_15693_COMMAND:
702 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
703 break;
704
705 case CMD_ISO_15693_FIND_AFI:
706 BruteforceIso15693Afi(c->arg[0]);
707 break;
708
709 case CMD_ISO_15693_DEBUG:
710 SetDebugIso15693(c->arg[0]);
711 break;
712
713 case CMD_READER_ISO_15693:
714 ReaderIso15693(c->arg[0]);
715 break;
716 case CMD_SIMTAG_ISO_15693:
717 SimTagIso15693(c->arg[0], c->d.asBytes);
718 break;
719 #endif
720
721 #ifdef WITH_LEGICRF
722 case CMD_SIMULATE_TAG_LEGIC_RF:
723 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
724 break;
725
726 case CMD_WRITER_LEGIC_RF:
727 LegicRfWriter(c->arg[1], c->arg[0]);
728 break;
729
730 case CMD_READER_LEGIC_RF:
731 LegicRfReader(c->arg[0], c->arg[1]);
732 break;
733 #endif
734
735 #ifdef WITH_ISO14443b
736 case CMD_READ_SRI512_TAG:
737 ReadSTMemoryIso14443b(0x0F);
738 break;
739 case CMD_READ_SRIX4K_TAG:
740 ReadSTMemoryIso14443b(0x7F);
741 break;
742 case CMD_SNOOP_ISO_14443B:
743 SnoopIso14443b();
744 break;
745 case CMD_SIMULATE_TAG_ISO_14443B:
746 SimulateIso14443bTag();
747 break;
748 case CMD_ISO_14443B_COMMAND:
749 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
750 break;
751 #endif
752
753 #ifdef WITH_ISO14443a
754 case CMD_SNOOP_ISO_14443a:
755 SniffIso14443a(c->arg[0]);
756 break;
757 case CMD_READER_ISO_14443a:
758 ReaderIso14443a(c);
759 break;
760 case CMD_SIMULATE_TAG_ISO_14443a:
761 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
762 break;
763
764 case CMD_EPA_PACE_COLLECT_NONCE:
765 EPA_PACE_Collect_Nonce(c);
766 break;
767 case CMD_EPA_PACE_REPLAY:
768 EPA_PACE_Replay(c);
769 break;
770
771 case CMD_READER_MIFARE:
772 ReaderMifare(c->arg[0]);
773 break;
774 case CMD_MIFARE_READBL:
775 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
776 break;
777 case CMD_MIFAREU_READBL:
778 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
779 break;
780 case CMD_MIFAREUC_AUTH:
781 MifareUC_Auth(c->arg[0],c->d.asBytes);
782 break;
783 case CMD_MIFAREU_READCARD:
784 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
785 break;
786 case CMD_MIFAREUC_SETPWD:
787 MifareUSetPwd(c->arg[0], c->d.asBytes);
788 break;
789 case CMD_MIFARE_READSC:
790 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
791 break;
792 case CMD_MIFARE_WRITEBL:
793 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
794 break;
795 //case CMD_MIFAREU_WRITEBL_COMPAT:
796 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
797 //break;
798 case CMD_MIFAREU_WRITEBL:
799 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
800 break;
801 case CMD_MIFARE_NESTED:
802 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
803 break;
804 case CMD_MIFARE_CHKKEYS:
805 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
806 break;
807 case CMD_SIMULATE_MIFARE_CARD:
808 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
809 break;
810
811 // emulator
812 case CMD_MIFARE_SET_DBGMODE:
813 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
814 break;
815 case CMD_MIFARE_EML_MEMCLR:
816 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
817 break;
818 case CMD_MIFARE_EML_MEMSET:
819 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
820 break;
821 case CMD_MIFARE_EML_MEMGET:
822 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
823 break;
824 case CMD_MIFARE_EML_CARDLOAD:
825 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
826 break;
827
828 // Work with "magic Chinese" card
829 case CMD_MIFARE_CSETBLOCK:
830 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
831 break;
832 case CMD_MIFARE_CGETBLOCK:
833 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
834 break;
835 case CMD_MIFARE_CIDENT:
836 MifareCIdent();
837 break;
838
839 // mifare sniffer
840 case CMD_MIFARE_SNIFFER:
841 SniffMifare(c->arg[0]);
842 break;
843
844 //mifare desfire
845 case CMD_MIFARE_DESFIRE_READBL: break;
846 case CMD_MIFARE_DESFIRE_WRITEBL: break;
847 case CMD_MIFARE_DESFIRE_AUTH1:
848 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
849 break;
850 case CMD_MIFARE_DESFIRE_AUTH2:
851 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
852 break;
853 case CMD_MIFARE_DES_READER:
854 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
855 break;
856 case CMD_MIFARE_DESFIRE_INFO:
857 MifareDesfireGetInformation();
858 break;
859 case CMD_MIFARE_DESFIRE:
860 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
861 break;
862
863 case CMD_MIFARE_COLLECT_NONCES:
864 MifareCollectNonces(c->arg[0], c->arg[1]);
865 break;
866 #endif
867
868 #ifdef WITH_ICLASS
869 // Makes use of ISO14443a FPGA Firmware
870 case CMD_SNOOP_ICLASS:
871 SnoopIClass();
872 break;
873 case CMD_SIMULATE_TAG_ICLASS:
874 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
875 break;
876 case CMD_READER_ICLASS:
877 ReaderIClass(c->arg[0]);
878 break;
879 case CMD_READER_ICLASS_REPLAY:
880 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
881 break;
882 case CMD_ICLASS_EML_MEMSET:
883 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
884 break;
885 #endif
886
887 case CMD_BUFF_CLEAR:
888 BigBuf_Clear();
889 break;
890
891 case CMD_MEASURE_ANTENNA_TUNING:
892 MeasureAntennaTuning();
893 break;
894
895 case CMD_MEASURE_ANTENNA_TUNING_HF:
896 MeasureAntennaTuningHf();
897 break;
898
899 case CMD_LISTEN_READER_FIELD:
900 ListenReaderField(c->arg[0]);
901 break;
902
903 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
904 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
905 SpinDelay(200);
906 LED_D_OFF(); // LED D indicates field ON or OFF
907 break;
908
909 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
910
911 LED_B_ON();
912 uint8_t *BigBuf = BigBuf_get_addr();
913 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
914 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
915 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
916 }
917 // Trigger a finish downloading signal with an ACK frame
918 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
919 LED_B_OFF();
920 break;
921
922 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
923 uint8_t *b = BigBuf_get_addr();
924 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
925 cmd_send(CMD_ACK,0,0,0,0,0);
926 break;
927 }
928 case CMD_READ_MEM:
929 ReadMem(c->arg[0]);
930 break;
931
932 case CMD_SET_LF_DIVISOR:
933 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
934 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
935 break;
936
937 case CMD_SET_ADC_MUX:
938 switch(c->arg[0]) {
939 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
940 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
941 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
942 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
943 }
944 break;
945
946 case CMD_VERSION:
947 SendVersion();
948 break;
949
950 #ifdef WITH_LCD
951 case CMD_LCD_RESET:
952 LCDReset();
953 break;
954 case CMD_LCD:
955 LCDSend(c->arg[0]);
956 break;
957 #endif
958 case CMD_SETUP_WRITE:
959 case CMD_FINISH_WRITE:
960 case CMD_HARDWARE_RESET:
961 usb_disable();
962 SpinDelay(1000);
963 SpinDelay(1000);
964 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
965 for(;;) {
966 // We're going to reset, and the bootrom will take control.
967 }
968 break;
969
970 case CMD_START_FLASH:
971 if(common_area.flags.bootrom_present) {
972 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
973 }
974 usb_disable();
975 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
976 for(;;);
977 break;
978
979 case CMD_DEVICE_INFO: {
980 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
981 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
982 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
983 break;
984 }
985 default:
986 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
987 break;
988 }
989 }
990
991 void __attribute__((noreturn)) AppMain(void)
992 {
993 SpinDelay(100);
994 clear_trace();
995 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
996 /* Initialize common area */
997 memset(&common_area, 0, sizeof(common_area));
998 common_area.magic = COMMON_AREA_MAGIC;
999 common_area.version = 1;
1000 }
1001 common_area.flags.osimage_present = 1;
1002
1003 LED_D_OFF();
1004 LED_C_OFF();
1005 LED_B_OFF();
1006 LED_A_OFF();
1007
1008 // Init USB device
1009 usb_enable();
1010
1011 // The FPGA gets its clock from us from PCK0 output, so set that up.
1012 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1013 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1014 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1015 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1016 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1017 AT91C_PMC_PRES_CLK_4;
1018 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1019
1020 // Reset SPI
1021 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1022 // Reset SSC
1023 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1024
1025 // Load the FPGA image, which we have stored in our flash.
1026 // (the HF version by default)
1027 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1028
1029 StartTickCount();
1030
1031 #ifdef WITH_LCD
1032 LCDInit();
1033 #endif
1034
1035 byte_t rx[sizeof(UsbCommand)];
1036 size_t rx_len;
1037
1038 for(;;) {
1039 if (usb_poll()) {
1040 rx_len = usb_read(rx,sizeof(UsbCommand));
1041 if (rx_len) {
1042 UsbPacketReceived(rx,rx_len);
1043 }
1044 }
1045 WDT_HIT();
1046
1047 #ifdef WITH_LF
1048 if (BUTTON_HELD(1000) > 0)
1049 SamyRun();
1050 #endif
1051 }
1052 }
Proxmark3 GIT tracking
Impressum, Datenschutz