]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Finish support for compressed FPGA images in fpgaloader.c
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 #define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34 //=============================================================================
35 // A buffer where we can queue things up to be sent through the FPGA, for
36 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
37 // is the order in which they go out on the wire.
38 //=============================================================================
39
40 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41 uint8_t ToSend[TOSEND_BUFFER_SIZE];
42 int ToSendMax;
43 static int ToSendBit;
44 struct common_area common_area __attribute__((section(".commonarea")));
45
46 void ToSendReset(void)
47 {
48 ToSendMax = -1;
49 ToSendBit = 8;
50 }
51
52 void ToSendStuffBit(int b)
53 {
54 if(ToSendBit >= 8) {
55 ToSendMax++;
56 ToSend[ToSendMax] = 0;
57 ToSendBit = 0;
58 }
59
60 if(b) {
61 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
62 }
63
64 ToSendBit++;
65
66 if(ToSendMax >= sizeof(ToSend)) {
67 ToSendBit = 0;
68 DbpString("ToSendStuffBit overflowed!");
69 }
70 }
71
72 //=============================================================================
73 // Debug print functions, to go out over USB, to the usual PC-side client.
74 //=============================================================================
75
76 void DbpString(char *str)
77 {
78 byte_t len = strlen(str);
79 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
80 }
81
82 #if 0
83 void DbpIntegers(int x1, int x2, int x3)
84 {
85 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
86 }
87 #endif
88
89 void Dbprintf(const char *fmt, ...) {
90 // should probably limit size here; oh well, let's just use a big buffer
91 char output_string[128];
92 va_list ap;
93
94 va_start(ap, fmt);
95 kvsprintf(fmt, output_string, 10, ap);
96 va_end(ap);
97
98 DbpString(output_string);
99 }
100
101 // prints HEX & ASCII
102 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
103 int l=0,i;
104 char ascii[9];
105
106 while (len>0) {
107 if (len>8) l=8;
108 else l=len;
109
110 memcpy(ascii,d,l);
111 ascii[l]=0;
112
113 // filter safe ascii
114 for (i=0;i<l;i++)
115 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
116
117 if (bAsci) {
118 Dbprintf("%-8s %*D",ascii,l,d," ");
119 } else {
120 Dbprintf("%*D",l,d," ");
121 }
122
123 len-=8;
124 d+=8;
125 }
126 }
127
128 //-----------------------------------------------------------------------------
129 // Read an ADC channel and block till it completes, then return the result
130 // in ADC units (0 to 1023). Also a routine to average 32 samples and
131 // return that.
132 //-----------------------------------------------------------------------------
133 static int ReadAdc(int ch)
134 {
135 uint32_t d;
136
137 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
138 AT91C_BASE_ADC->ADC_MR =
139 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
140 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
141 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
142
143 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
144 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
145 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
146 //
147 // The maths are:
148 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
149 //
150 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
151 //
152 // Note: with the "historic" values in the comments above, the error was 34% !!!
153
154 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
155
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
157
158 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
159 ;
160 d = AT91C_BASE_ADC->ADC_CDR[ch];
161
162 return d;
163 }
164
165 int AvgAdc(int ch) // was static - merlok
166 {
167 int i;
168 int a = 0;
169
170 for(i = 0; i < 32; i++) {
171 a += ReadAdc(ch);
172 }
173
174 return (a + 15) >> 5;
175 }
176
177 void MeasureAntennaTuning(void)
178 {
179 uint8_t LF_Results[256];
180 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
181 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
182
183 LED_B_ON();
184
185 /*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
193
194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
196 for (i=255; i>=19; i--) {
197 WDT_HIT();
198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
201 if (i==95) vLf125 = adcval; // voltage at 125Khz
202 if (i==89) vLf134 = adcval; // voltage at 134Khz
203
204 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
205 if(LF_Results[i] > peak) {
206 peakv = adcval;
207 peak = LF_Results[i];
208 peakf = i;
209 //ptr = i;
210 }
211 }
212
213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
214
215 LED_A_ON();
216 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
217 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
218 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
219 SpinDelay(20);
220 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
221
222 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
223 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
224 LED_A_OFF();
225 LED_B_OFF();
226 return;
227 }
228
229 void MeasureAntennaTuningHf(void)
230 {
231 int vHf = 0; // in mV
232
233 DbpString("Measuring HF antenna, press button to exit");
234
235 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
236 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
237 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
238
239 for (;;) {
240 SpinDelay(20);
241 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
242
243 Dbprintf("%d mV",vHf);
244 if (BUTTON_PRESS()) break;
245 }
246 DbpString("cancelled");
247
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
249
250 }
251
252
253 void SimulateTagHfListen(void)
254 {
255 // ToDo: historically this used the free buffer, which was 2744 Bytes long.
256 // There might be a better size to be defined:
257 #define HF_14B_SNOOP_BUFFER_SIZE 2744
258 uint8_t *dest = BigBuf_malloc(HF_14B_SNOOP_BUFFER_SIZE);
259 uint8_t v = 0;
260 int i;
261 int p = 0;
262
263 // We're using this mode just so that I can test it out; the simulated
264 // tag mode would work just as well and be simpler.
265 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
266 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
267
268 // We need to listen to the high-frequency, peak-detected path.
269 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
270
271 FpgaSetupSsc();
272
273 i = 0;
274 for(;;) {
275 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
276 AT91C_BASE_SSC->SSC_THR = 0xff;
277 }
278 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
279 uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
280
281 v <<= 1;
282 if(r & 1) {
283 v |= 1;
284 }
285 p++;
286
287 if(p >= 8) {
288 dest[i] = v;
289 v = 0;
290 p = 0;
291 i++;
292
293 if(i >= HF_14B_SNOOP_BUFFER_SIZE) {
294 break;
295 }
296 }
297 }
298 }
299 DbpString("simulate tag (now type bitsamples)");
300 }
301
302 void ReadMem(int addr)
303 {
304 const uint8_t *data = ((uint8_t *)addr);
305
306 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
307 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
308 }
309
310 /* osimage version information is linked in */
311 extern struct version_information version_information;
312 /* bootrom version information is pointed to from _bootphase1_version_pointer */
313 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __os_size__;
314 void SendVersion(void)
315 {
316 char temp[512]; /* Limited data payload in USB packets */
317 DbpString("Prox/RFID mark3 RFID instrument");
318
319 /* Try to find the bootrom version information. Expect to find a pointer at
320 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
321 * pointer, then use it.
322 */
323 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
324 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
325 DbpString("bootrom version information appears invalid");
326 } else {
327 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
328 DbpString(temp);
329 }
330
331 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
332 DbpString(temp);
333
334 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
335 DbpString(temp);
336 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
337 DbpString(temp);
338
339 // Send Chip ID and used flash memory
340 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), (uint32_t)&_bootrom_end - (uint32_t)&_bootrom_start + (uint32_t)&__os_size__, 0, NULL, 0);
341 }
342
343 #ifdef WITH_LF
344 // samy's sniff and repeat routine
345 void SamyRun()
346 {
347 DbpString("Stand-alone mode! No PC necessary.");
348 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
349
350 // 3 possible options? no just 2 for now
351 #define OPTS 2
352
353 int high[OPTS], low[OPTS];
354
355 // Oooh pretty -- notify user we're in elite samy mode now
356 LED(LED_RED, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_GREEN, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_RED, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_GREEN, 200);
363 LED(LED_ORANGE, 200);
364 LED(LED_RED, 200);
365
366 int selected = 0;
367 int playing = 0;
368 int cardRead = 0;
369
370 // Turn on selected LED
371 LED(selected + 1, 0);
372
373 for (;;)
374 {
375 usb_poll();
376 WDT_HIT();
377
378 // Was our button held down or pressed?
379 int button_pressed = BUTTON_HELD(1000);
380 SpinDelay(300);
381
382 // Button was held for a second, begin recording
383 if (button_pressed > 0 && cardRead == 0)
384 {
385 LEDsoff();
386 LED(selected + 1, 0);
387 LED(LED_RED2, 0);
388
389 // record
390 DbpString("Starting recording");
391
392 // wait for button to be released
393 while(BUTTON_PRESS())
394 WDT_HIT();
395
396 /* need this delay to prevent catching some weird data */
397 SpinDelay(500);
398
399 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
400 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
401
402 LEDsoff();
403 LED(selected + 1, 0);
404 // Finished recording
405
406 // If we were previously playing, set playing off
407 // so next button push begins playing what we recorded
408 playing = 0;
409
410 cardRead = 1;
411
412 }
413
414 else if (button_pressed > 0 && cardRead == 1)
415 {
416 LEDsoff();
417 LED(selected + 1, 0);
418 LED(LED_ORANGE, 0);
419
420 // record
421 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
422
423 // wait for button to be released
424 while(BUTTON_PRESS())
425 WDT_HIT();
426
427 /* need this delay to prevent catching some weird data */
428 SpinDelay(500);
429
430 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
431 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
432
433 LEDsoff();
434 LED(selected + 1, 0);
435 // Finished recording
436
437 // If we were previously playing, set playing off
438 // so next button push begins playing what we recorded
439 playing = 0;
440
441 cardRead = 0;
442
443 }
444
445 // Change where to record (or begin playing)
446 else if (button_pressed)
447 {
448 // Next option if we were previously playing
449 if (playing)
450 selected = (selected + 1) % OPTS;
451 playing = !playing;
452
453 LEDsoff();
454 LED(selected + 1, 0);
455
456 // Begin transmitting
457 if (playing)
458 {
459 LED(LED_GREEN, 0);
460 DbpString("Playing");
461 // wait for button to be released
462 while(BUTTON_PRESS())
463 WDT_HIT();
464 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
465 CmdHIDsimTAG(high[selected], low[selected], 0);
466 DbpString("Done playing");
467 if (BUTTON_HELD(1000) > 0)
468 {
469 DbpString("Exiting");
470 LEDsoff();
471 return;
472 }
473
474 /* We pressed a button so ignore it here with a delay */
475 SpinDelay(300);
476
477 // when done, we're done playing, move to next option
478 selected = (selected + 1) % OPTS;
479 playing = !playing;
480 LEDsoff();
481 LED(selected + 1, 0);
482 }
483 else
484 while(BUTTON_PRESS())
485 WDT_HIT();
486 }
487 }
488 }
489 #endif
490
491 /*
492 OBJECTIVE
493 Listen and detect an external reader. Determine the best location
494 for the antenna.
495
496 INSTRUCTIONS:
497 Inside the ListenReaderField() function, there is two mode.
498 By default, when you call the function, you will enter mode 1.
499 If you press the PM3 button one time, you will enter mode 2.
500 If you press the PM3 button a second time, you will exit the function.
501
502 DESCRIPTION OF MODE 1:
503 This mode just listens for an external reader field and lights up green
504 for HF and/or red for LF. This is the original mode of the detectreader
505 function.
506
507 DESCRIPTION OF MODE 2:
508 This mode will visually represent, using the LEDs, the actual strength of the
509 current compared to the maximum current detected. Basically, once you know
510 what kind of external reader is present, it will help you spot the best location to place
511 your antenna. You will probably not get some good results if there is a LF and a HF reader
512 at the same place! :-)
513
514 LIGHT SCHEME USED:
515 */
516 static const char LIGHT_SCHEME[] = {
517 0x0, /* ---- | No field detected */
518 0x1, /* X--- | 14% of maximum current detected */
519 0x2, /* -X-- | 29% of maximum current detected */
520 0x4, /* --X- | 43% of maximum current detected */
521 0x8, /* ---X | 57% of maximum current detected */
522 0xC, /* --XX | 71% of maximum current detected */
523 0xE, /* -XXX | 86% of maximum current detected */
524 0xF, /* XXXX | 100% of maximum current detected */
525 };
526 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
527
528 void ListenReaderField(int limit)
529 {
530 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
531 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
532 int mode=1, display_val, display_max, i;
533
534 #define LF_ONLY 1
535 #define HF_ONLY 2
536 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
537
538
539 // switch off FPGA - we don't want to measure our own signal
540 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
541 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
542
543 LEDsoff();
544
545 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
546
547 if(limit != HF_ONLY) {
548 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
549 lf_baseline = lf_av;
550 }
551
552 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
553
554 if (limit != LF_ONLY) {
555 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
556 hf_baseline = hf_av;
557 }
558
559 for(;;) {
560 if (BUTTON_PRESS()) {
561 SpinDelay(500);
562 switch (mode) {
563 case 1:
564 mode=2;
565 DbpString("Signal Strength Mode");
566 break;
567 case 2:
568 default:
569 DbpString("Stopped");
570 LEDsoff();
571 return;
572 break;
573 }
574 }
575 WDT_HIT();
576
577 if (limit != HF_ONLY) {
578 if(mode == 1) {
579 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
580 LED_D_ON();
581 else
582 LED_D_OFF();
583 }
584
585 lf_av_new = AvgAdc(ADC_CHAN_LF);
586 // see if there's a significant change
587 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
588 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
589 lf_av = lf_av_new;
590 if (lf_av > lf_max)
591 lf_max = lf_av;
592 }
593 }
594
595 if (limit != LF_ONLY) {
596 if (mode == 1){
597 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
598 LED_B_ON();
599 else
600 LED_B_OFF();
601 }
602
603 hf_av_new = AvgAdc(ADC_CHAN_HF);
604 // see if there's a significant change
605 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
606 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
607 hf_av = hf_av_new;
608 if (hf_av > hf_max)
609 hf_max = hf_av;
610 }
611 }
612
613 if(mode == 2) {
614 if (limit == LF_ONLY) {
615 display_val = lf_av;
616 display_max = lf_max;
617 } else if (limit == HF_ONLY) {
618 display_val = hf_av;
619 display_max = hf_max;
620 } else { /* Pick one at random */
621 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
622 display_val = hf_av;
623 display_max = hf_max;
624 } else {
625 display_val = lf_av;
626 display_max = lf_max;
627 }
628 }
629 for (i=0; i<LIGHT_LEN; i++) {
630 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
631 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
632 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
633 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
634 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
635 break;
636 }
637 }
638 }
639 }
640 }
641
642 void UsbPacketReceived(uint8_t *packet, int len)
643 {
644 UsbCommand *c = (UsbCommand *)packet;
645
646 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
647
648 switch(c->cmd) {
649 #ifdef WITH_LF
650 case CMD_SET_LF_SAMPLING_CONFIG:
651 setSamplingConfig((sample_config *) c->d.asBytes);
652 break;
653 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
654 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
655 break;
656 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
657 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
658 break;
659 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
660 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
661 break;
662 case CMD_HID_DEMOD_FSK:
663 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
664 break;
665 case CMD_HID_SIM_TAG:
666 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
667 break;
668 case CMD_FSK_SIM_TAG:
669 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
670 break;
671 case CMD_ASK_SIM_TAG:
672 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
673 break;
674 case CMD_PSK_SIM_TAG:
675 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
676 break;
677 case CMD_HID_CLONE_TAG:
678 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
679 break;
680 case CMD_IO_DEMOD_FSK:
681 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
682 break;
683 case CMD_IO_CLONE_TAG:
684 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
685 break;
686 case CMD_EM410X_DEMOD:
687 CmdEM410xdemod(c->arg[0], 0, 0, 1);
688 break;
689 case CMD_EM410X_WRITE_TAG:
690 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
691 break;
692 case CMD_READ_TI_TYPE:
693 ReadTItag();
694 break;
695 case CMD_WRITE_TI_TYPE:
696 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
697 break;
698 case CMD_SIMULATE_TAG_125K:
699 LED_A_ON();
700 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
701 LED_A_OFF();
702 break;
703 case CMD_LF_SIMULATE_BIDIR:
704 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
705 break;
706 case CMD_INDALA_CLONE_TAG:
707 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
708 break;
709 case CMD_INDALA_CLONE_TAG_L:
710 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
711 break;
712 case CMD_T55XX_READ_BLOCK:
713 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
714 break;
715 case CMD_T55XX_WRITE_BLOCK:
716 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
717 break;
718 case CMD_T55XX_READ_TRACE:
719 T55xxReadTrace();
720 break;
721 case CMD_PCF7931_READ:
722 ReadPCF7931();
723 cmd_send(CMD_ACK,0,0,0,0,0);
724 break;
725 case CMD_EM4X_READ_WORD:
726 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
727 break;
728 case CMD_EM4X_WRITE_WORD:
729 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
730 break;
731 #endif
732
733 #ifdef WITH_HITAG
734 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
735 SnoopHitag(c->arg[0]);
736 break;
737 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
738 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
739 break;
740 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
741 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
742 break;
743 #endif
744
745 #ifdef WITH_ISO15693
746 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
747 AcquireRawAdcSamplesIso15693();
748 break;
749 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
750 RecordRawAdcSamplesIso15693();
751 break;
752
753 case CMD_ISO_15693_COMMAND:
754 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
755 break;
756
757 case CMD_ISO_15693_FIND_AFI:
758 BruteforceIso15693Afi(c->arg[0]);
759 break;
760
761 case CMD_ISO_15693_DEBUG:
762 SetDebugIso15693(c->arg[0]);
763 break;
764
765 case CMD_READER_ISO_15693:
766 ReaderIso15693(c->arg[0]);
767 break;
768 case CMD_SIMTAG_ISO_15693:
769 SimTagIso15693(c->arg[0], c->d.asBytes);
770 break;
771 #endif
772
773 #ifdef WITH_LEGICRF
774 case CMD_SIMULATE_TAG_LEGIC_RF:
775 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
776 break;
777
778 case CMD_WRITER_LEGIC_RF:
779 LegicRfWriter(c->arg[1], c->arg[0]);
780 break;
781
782 case CMD_READER_LEGIC_RF:
783 LegicRfReader(c->arg[0], c->arg[1]);
784 break;
785 #endif
786
787 #ifdef WITH_ISO14443b
788 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
789 AcquireRawAdcSamplesIso14443(c->arg[0]);
790 break;
791 case CMD_READ_SRI512_TAG:
792 ReadSTMemoryIso14443(0x0F);
793 break;
794 case CMD_READ_SRIX4K_TAG:
795 ReadSTMemoryIso14443(0x7F);
796 break;
797 case CMD_SNOOP_ISO_14443:
798 SnoopIso14443();
799 break;
800 case CMD_SIMULATE_TAG_ISO_14443:
801 SimulateIso14443Tag();
802 break;
803 case CMD_ISO_14443B_COMMAND:
804 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
805 break;
806 #endif
807
808 #ifdef WITH_ISO14443a
809 case CMD_SNOOP_ISO_14443a:
810 SnoopIso14443a(c->arg[0]);
811 break;
812 case CMD_READER_ISO_14443a:
813 ReaderIso14443a(c);
814 break;
815 case CMD_SIMULATE_TAG_ISO_14443a:
816 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
817 break;
818
819 case CMD_EPA_PACE_COLLECT_NONCE:
820 EPA_PACE_Collect_Nonce(c);
821 break;
822
823 case CMD_READER_MIFARE:
824 ReaderMifare(c->arg[0]);
825 break;
826 case CMD_MIFARE_READBL:
827 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
828 break;
829 case CMD_MIFAREU_READBL:
830 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
831 break;
832 case CMD_MIFAREUC_AUTH:
833 MifareUC_Auth(c->arg[0],c->d.asBytes);
834 break;
835 case CMD_MIFAREU_READCARD:
836 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
837 break;
838 case CMD_MIFAREUC_SETPWD:
839 MifareUSetPwd(c->arg[0], c->d.asBytes);
840 break;
841 case CMD_MIFARE_READSC:
842 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
843 break;
844 case CMD_MIFARE_WRITEBL:
845 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
846 break;
847 case CMD_MIFAREU_WRITEBL_COMPAT:
848 MifareUWriteBlock(c->arg[0], c->d.asBytes);
849 break;
850 case CMD_MIFAREU_WRITEBL:
851 MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
852 break;
853 case CMD_MIFARE_NESTED:
854 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
855 break;
856 case CMD_MIFARE_CHKKEYS:
857 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
858 break;
859 case CMD_SIMULATE_MIFARE_CARD:
860 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
861 break;
862
863 // emulator
864 case CMD_MIFARE_SET_DBGMODE:
865 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
866 break;
867 case CMD_MIFARE_EML_MEMCLR:
868 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
869 break;
870 case CMD_MIFARE_EML_MEMSET:
871 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
872 break;
873 case CMD_MIFARE_EML_MEMGET:
874 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
875 break;
876 case CMD_MIFARE_EML_CARDLOAD:
877 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
878 break;
879
880 // Work with "magic Chinese" card
881 case CMD_MIFARE_CSETBLOCK:
882 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
883 break;
884 case CMD_MIFARE_CGETBLOCK:
885 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
886 break;
887 case CMD_MIFARE_CIDENT:
888 MifareCIdent();
889 break;
890
891 // mifare sniffer
892 case CMD_MIFARE_SNIFFER:
893 SniffMifare(c->arg[0]);
894 break;
895
896 #endif
897
898 #ifdef WITH_ICLASS
899 // Makes use of ISO14443a FPGA Firmware
900 case CMD_SNOOP_ICLASS:
901 SnoopIClass();
902 break;
903 case CMD_SIMULATE_TAG_ICLASS:
904 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
905 break;
906 case CMD_READER_ICLASS:
907 ReaderIClass(c->arg[0]);
908 break;
909 case CMD_READER_ICLASS_REPLAY:
910 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
911 break;
912 case CMD_ICLASS_EML_MEMSET:
913 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
914 break;
915 #endif
916
917 case CMD_SIMULATE_TAG_HF_LISTEN:
918 SimulateTagHfListen();
919 break;
920
921 case CMD_BUFF_CLEAR:
922 BigBuf_Clear();
923 break;
924
925 case CMD_MEASURE_ANTENNA_TUNING:
926 MeasureAntennaTuning();
927 break;
928
929 case CMD_MEASURE_ANTENNA_TUNING_HF:
930 MeasureAntennaTuningHf();
931 break;
932
933 case CMD_LISTEN_READER_FIELD:
934 ListenReaderField(c->arg[0]);
935 break;
936
937 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
938 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
939 SpinDelay(200);
940 LED_D_OFF(); // LED D indicates field ON or OFF
941 break;
942
943 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
944
945 LED_B_ON();
946 uint8_t *BigBuf = BigBuf_get_addr();
947 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
948 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
949 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
950 }
951 // Trigger a finish downloading signal with an ACK frame
952 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
953 LED_B_OFF();
954 break;
955
956 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
957 uint8_t *b = BigBuf_get_addr();
958 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
959 cmd_send(CMD_ACK,0,0,0,0,0);
960 break;
961 }
962 case CMD_READ_MEM:
963 ReadMem(c->arg[0]);
964 break;
965
966 case CMD_SET_LF_DIVISOR:
967 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
968 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
969 break;
970
971 case CMD_SET_ADC_MUX:
972 switch(c->arg[0]) {
973 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
974 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
975 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
976 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
977 }
978 break;
979
980 case CMD_VERSION:
981 SendVersion();
982 break;
983
984 #ifdef WITH_LCD
985 case CMD_LCD_RESET:
986 LCDReset();
987 break;
988 case CMD_LCD:
989 LCDSend(c->arg[0]);
990 break;
991 #endif
992 case CMD_SETUP_WRITE:
993 case CMD_FINISH_WRITE:
994 case CMD_HARDWARE_RESET:
995 usb_disable();
996 SpinDelay(1000);
997 SpinDelay(1000);
998 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
999 for(;;) {
1000 // We're going to reset, and the bootrom will take control.
1001 }
1002 break;
1003
1004 case CMD_START_FLASH:
1005 if(common_area.flags.bootrom_present) {
1006 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1007 }
1008 usb_disable();
1009 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1010 for(;;);
1011 break;
1012
1013 case CMD_DEVICE_INFO: {
1014 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1015 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1016 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1017 break;
1018 }
1019 default:
1020 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1021 break;
1022 }
1023 }
1024
1025 void __attribute__((noreturn)) AppMain(void)
1026 {
1027 SpinDelay(100);
1028 clear_trace();
1029 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1030 /* Initialize common area */
1031 memset(&common_area, 0, sizeof(common_area));
1032 common_area.magic = COMMON_AREA_MAGIC;
1033 common_area.version = 1;
1034 }
1035 common_area.flags.osimage_present = 1;
1036
1037 LED_D_OFF();
1038 LED_C_OFF();
1039 LED_B_OFF();
1040 LED_A_OFF();
1041
1042 // Init USB device
1043 usb_enable();
1044
1045 // The FPGA gets its clock from us from PCK0 output, so set that up.
1046 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1047 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1048 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1049 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1050 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1051 AT91C_PMC_PRES_CLK_4;
1052 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1053
1054 // Reset SPI
1055 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1056 // Reset SSC
1057 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1058
1059 // Load the FPGA image, which we have stored in our flash.
1060 // (the HF version by default)
1061 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1062
1063 StartTickCount();
1064
1065 #ifdef WITH_LCD
1066 LCDInit();
1067 #endif
1068
1069 byte_t rx[sizeof(UsbCommand)];
1070 size_t rx_len;
1071
1072 for(;;) {
1073 if (usb_poll()) {
1074 rx_len = usb_read(rx,sizeof(UsbCommand));
1075 if (rx_len) {
1076 UsbPacketReceived(rx,rx_len);
1077 }
1078 }
1079 WDT_HIT();
1080
1081 #ifdef WITH_LF
1082 if (BUTTON_HELD(1000) > 0)
1083 SamyRun();
1084 #endif
1085 }
1086 }
Proxmark3 GIT tracking
Impressum, Datenschutz