1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Aug 2005
3 // Gerhard de Koning Gans, April 2008, May 2011
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // Definitions internal to the app source.
10 //-----------------------------------------------------------------------------
25 #include "fpgaloader.h"
31 #include "iso14443b.h"
32 //#include "iso14443a.h"
35 extern int rsamples
; // = 0;
36 extern int tracing
; // = TRUE;
37 extern uint8_t trigger
;
39 // This may be used (sparingly) to declare a function to be copied to
40 // and executed from RAM
41 #define RAMFUNC __attribute((long_call, section(".ramfunc")))
44 void ReadMem(int addr
);
45 void __attribute__((noreturn
)) AppMain(void);
47 //void DbpIntegers(int a, int b, int c);
48 void DbpString(char *str
);
49 void Dbprintf(const char *fmt
, ...);
50 void DbprintfEx(uint32_t cmd
, const char *fmt
, ...);
51 void Dbhexdump(int len
, uint8_t *d
, bool bAsci
);
53 // ADC Vref = 3300mV, and an (10M+1M):1M voltage divider on the HF input can measure voltages up to 36300 mV
54 #define MAX_ADC_HF_VOLTAGE 36300
55 // ADC Vref = 3300mV, and an (10000k+240k):240k voltage divider on the LF input can measure voltages up to 140800 mV
56 #define MAX_ADC_LF_VOLTAGE 140800
59 void print_result(char *name
, uint8_t *buf
, size_t len
);
60 void PrintToSendBuffer(void);
61 void ToSendStuffBit(int b
);
62 void ToSendReset(void);
63 void ListenReaderField(int limit
);
65 extern uint8_t ToSend
[];
68 extern uint8_t decimation
;
69 extern uint8_t bits_per_sample
;
70 extern bool averaging
;
72 void AcquireRawAdcSamples125k(int divisor
);
73 void ModThenAcquireRawAdcSamples125k(uint32_t delay_off
, uint32_t period_0
, uint32_t period_1
, uint8_t *command
);
75 void WriteTItag(uint32_t idhi
, uint32_t idlo
, uint16_t crc
);
77 void AcquireTiType(void);
78 void AcquireRawBitsTI(void);
79 void SimulateTagLowFrequency(int period
, int gap
, int ledcontrol
);
80 void SimulateTagLowFrequencyBidir(int divisor
, int max_bitlen
);
81 void CmdHIDsimTAG(int hi
, int lo
, int ledcontrol
);
82 void CmdFSKsimTAG(uint16_t arg1
, uint16_t arg2
, size_t size
, uint8_t *BitStream
);
83 void CmdASKsimTag(uint16_t arg1
, uint16_t arg2
, size_t size
, uint8_t *BitStream
);
84 void CmdPSKsimTag(uint16_t arg1
, uint16_t arg2
, size_t size
, uint8_t *BitStream
);
85 void CmdHIDdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
);
86 void CmdAWIDdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
); // Realtime demodulation mode for AWID26
87 void CmdEM410xdemod(int findone
, int *high
, int *low
, int ledcontrol
);
88 void CmdIOdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
);
89 void CopyIOtoT55x7(uint32_t hi
, uint32_t lo
); // Clone an ioProx card to T5557/T5567
90 void CopyHIDtoT55x7(uint32_t hi2
, uint32_t hi
, uint32_t lo
, uint8_t longFMT
); // Clone an HID card to T5557/T5567
91 void CopyVikingtoT55xx(uint32_t block1
, uint32_t block2
, uint8_t Q5
);
92 void WriteEM410x(uint32_t card
, uint32_t id_hi
, uint32_t id_lo
);
93 void CopyIndala64toT55x7(uint32_t hi
, uint32_t lo
); // Clone Indala 64-bit tag by UID to T55x7
94 void CopyIndala224toT55x7(uint32_t uid1
, uint32_t uid2
, uint32_t uid3
, uint32_t uid4
, uint32_t uid5
, uint32_t uid6
, uint32_t uid7
); // Clone Indala 224-bit tag by UID to T55x7
95 void T55xxResetRead(void);
96 void T55xxWriteBlock(uint32_t Data
, uint8_t Block
, uint32_t Pwd
, uint8_t PwdMode
);
97 void T55xxWriteBlockExt(uint32_t Data
, uint8_t Block
, uint32_t Pwd
, uint8_t PwdMode
);
98 void T55xxReadBlock(uint16_t arg0
, uint8_t Block
, uint32_t Pwd
);
99 void T55xxWakeUp(uint32_t Pwd
);
100 void TurnReadLFOn(uint32_t delay
);
101 void EM4xReadWord(uint8_t addr
, uint32_t pwd
, uint8_t usepwd
);
102 void EM4xWriteWord(uint32_t flag
, uint32_t data
, uint32_t pwd
);
103 void Cotag(uint32_t arg0
);
106 void SimulateIso14443bTag(uint32_t pupi
);
107 void AcquireRawAdcSamplesIso14443b(uint32_t parameter
);
108 void ReadSTMemoryIso14443b(uint8_t numofblocks
);
109 void RAMFUNC
SnoopIso14443b(void);
110 void SendRawCommand14443B(uint32_t, uint32_t, uint8_t, uint8_t[]);
111 void SendRawCommand14443B_Ex(UsbCommand
*c
);
112 void AppendCrc14443b(uint8_t* data
, int len
);
113 void ClearFpgaShiftingRegisters(void);
116 void RAMFUNC
SniffIso14443a(uint8_t param
);
117 void SimulateIso14443aTag(int tagType
, int flags
, byte_t
* data
);
118 void ReaderIso14443a(UsbCommand
* c
);
119 // Also used in iclass.c
120 //bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t len, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag);
121 void GetParity(const uint8_t *pbtCmd
, uint16_t len
, uint8_t *parity
);
122 void iso14a_set_trigger(bool enable
);
124 bool prepare_allocated_tag_modulation(tag_response_info_t
* response_info
);
125 int GetIso14443aCommandFromReader(uint8_t *received
, uint8_t *parity
, int *len
);
128 void EPA_PACE_Collect_Nonce(UsbCommand
* c
);
129 void EPA_PACE_Replay(UsbCommand
*c
);
132 void MifareReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *data
);
133 void MifareUReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
);
134 void MifareUC_Auth(uint8_t arg0
, uint8_t *datain
);
135 void MifareUReadCard(uint8_t arg0
, uint16_t arg1
, uint8_t arg2
, uint8_t *datain
);
136 void MifareReadSector(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
);
137 void MifareWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
);
138 //void MifareUWriteBlockCompat(uint8_t arg0,uint8_t *datain);
139 void MifareUWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
);
140 void MifareNested(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
141 void MifareAcquireEncryptedNonces(uint32_t arg0
, uint32_t arg1
, uint32_t flags
, uint8_t *datain
);
142 void MifareChkKeys(uint16_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
);
143 void Mifare1ksim(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
);
144 void MifareSetDbgLvl(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
145 void MifareEMemClr(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
146 void MifareEMemSet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
147 void MifareEMemGet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
148 void MifareECardLoad(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
149 void MifareCSetBlock(uint32_t arg0
, uint32_t arg1
, uint8_t *datain
); // Work with "magic Chinese" card
150 void MifareCGetBlock(uint32_t arg0
, uint32_t arg1
, uint8_t *datain
);
151 void MifareCIdent(); // is "magic chinese" card?
152 void MifareUSetPwd(uint8_t arg0
, uint8_t *datain
);
153 void OnSuccessMagic();
154 void OnErrorMagic(uint8_t reason
);
156 int32_t dist_nt(uint32_t nt1
, uint32_t nt2
);
157 void ReaderMifare(bool first_try
, uint8_t block
, uint8_t keytype
);
158 void RAMFUNC
SniffMifare(uint8_t param
);
161 void Mifare_DES_Auth1(uint8_t arg0
,uint8_t *datain
);
162 void Mifare_DES_Auth2(uint32_t arg0
, uint8_t *datain
);
165 bool InitDesfireCard();
166 void MifareSendCommand(uint8_t arg0
,uint8_t arg1
, uint8_t *datain
);
167 void MifareDesfireGetInformation();
168 void MifareDES_Auth1(uint8_t arg0
,uint8_t arg1
,uint8_t arg2
, uint8_t *datain
);
169 void ReaderMifareDES(uint32_t param
, uint32_t param2
, uint8_t * datain
);
170 int DesfireAPDU(uint8_t *cmd
, size_t cmd_len
, uint8_t *dataout
);
171 size_t CreateAPDU( uint8_t *datain
, size_t len
, uint8_t *dataout
);
173 void OnError(uint8_t reason
);
176 void *mifare_cryto_preprocess_data (desfiretag_t tag
, void *data
, size_t *nbytes
, size_t offset
, int communication_settings
);
177 void *mifare_cryto_postprocess_data (desfiretag_t tag
, void *data
, size_t *nbytes
, int communication_settings
);
178 void mifare_cypher_single_block (desfirekey_t key
, uint8_t *data
, uint8_t *ivect
, MifareCryptoDirection direction
, MifareCryptoOperation operation
, size_t block_size
);
179 void mifare_cypher_blocks_chained (desfiretag_t tag
, desfirekey_t key
, uint8_t *ivect
, uint8_t *data
, size_t data_size
, MifareCryptoDirection direction
, MifareCryptoOperation operation
);
180 size_t key_block_size (const desfirekey_t key
);
181 size_t padded_data_length (const size_t nbytes
, const size_t block_size
);
182 size_t maced_data_length (const desfirekey_t key
, const size_t nbytes
);
183 size_t enciphered_data_length (const desfiretag_t tag
, const size_t nbytes
, int communication_settings
);
184 void cmac_generate_subkeys (desfirekey_t key
);
185 void cmac (const desfirekey_t key
, uint8_t *ivect
, const uint8_t *data
, size_t len
, uint8_t *cmac
);
188 void RecordRawAdcSamplesIso15693(void);
189 void AcquireRawAdcSamplesIso15693(void);
190 void ReaderIso15693(uint32_t parameter
); // Simulate an ISO15693 reader - greg
191 void SimTagIso15693(uint32_t parameter
, uint8_t *uid
); // simulate an ISO15693 tag - greg
192 void BruteforceIso15693Afi(uint32_t speed
); // find an AFI of a tag - atrox
193 void DirectTag15693Command(uint32_t datalen
,uint32_t speed
, uint32_t recv
, uint8_t data
[]); // send arbitrary commands from CLI - atrox
194 void SetDebugIso15693(uint32_t flag
);
197 void RAMFUNC
SnoopIClass(void);
198 void SimulateIClass(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
199 void ReaderIClass(uint8_t arg0
);
200 void ReaderIClass_Replay(uint8_t arg0
,uint8_t *MAC
);
201 void IClass_iso14443A_GetPublic(uint8_t arg0
);
202 void iClass_Authentication(uint8_t *MAC
);
203 void iClass_WriteBlock(uint8_t blockNo
, uint8_t *data
);
204 void iClass_ReadBlk(uint8_t blockNo
);
205 bool iClass_ReadBlock(uint8_t blockNo
, uint8_t *readdata
);
206 void iClass_Dump(uint8_t blockno
, uint8_t numblks
);
207 void iClass_Clone(uint8_t startblock
, uint8_t endblock
, uint8_t *data
);
208 void iClass_ReadCheck(uint8_t blockNo
, uint8_t keyType
);
211 void SnoopHitag(uint32_t type
);
212 void SimulateHitagTag(bool tag_mem_supplied
, byte_t
* data
);
213 void ReaderHitag(hitag_function htf
, hitag_data
* htd
);
216 void SimulateHitagSTag(bool tag_mem_supplied
, byte_t
* data
);
217 void ReadHitagS(hitag_function htf
, hitag_data
* htd
);
218 void WritePageHitagS(hitag_function htf
, hitag_data
* htd
,int page
);
219 void check_challenges(bool file_given
, byte_t
* data
);
222 bool cmd_receive(UsbCommand
* cmd
);
223 bool cmd_send(uint32_t cmd
, uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, void* data
, size_t len
);
226 void HfSnoop(int , int);
230 void EMVTransaction(void);
231 void EMVgetUDOL(void);
232 void EMVloadvalue(uint32_t tag
, uint8_t* datain
);
233 void EMVdumpcard(void);
234 //void EMVSelect(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data);
235 void EMVFuzz_RATS(uint8_t ratslen
, uint8_t* RATS
);
236 void EMVReadRecord(uint8_t arg0
, uint8_t arg1
,emvcard
* inputcard
);
237 void EMVSelectPPSE();
238 void EMVSelectAID(uint8_t *AID
, uint8_t AIDlen
, emvcard
* inputcard
);
239 void EMVTransaction();
240 void EMVClone(uint8_t maxsfi
, uint8_t maxrecord
);
243 void SimulateEMVcard();