]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


2e1a43afc40dd3dca27479bdbe0a3de3978cb506
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #include "mifareutil.h"
29 #ifdef WITH_LCD
30 #include "LCD.h"
31 #endif
32
33 // Craig Young - 14a stand-alone code
34 #ifdef WITH_ISO14443a_StandAlone
35 #include "iso14443a.h"
36 #endif
37
38 #define abs(x) ( ((x)<0) ? -(x) : (x) )
39
40 //=============================================================================
41 // A buffer where we can queue things up to be sent through the FPGA, for
42 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
43 // is the order in which they go out on the wire.
44 //=============================================================================
45
46 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
47 uint8_t ToSend[TOSEND_BUFFER_SIZE];
48 int ToSendMax = 0;
49 static int ToSendBit;
50 struct common_area common_area __attribute__((section(".commonarea")));
51
52 void ToSendReset(void)
53 {
54 ToSendMax = -1;
55 ToSendBit = 8;
56 }
57
58 void ToSendStuffBit(int b)
59 {
60 if(ToSendBit >= 8) {
61 ToSendMax++;
62 ToSend[ToSendMax] = 0;
63 ToSendBit = 0;
64 }
65
66 if(b) {
67 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
68 }
69
70 ToSendBit++;
71
72 if(ToSendMax >= sizeof(ToSend)) {
73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76 }
77
78 //=============================================================================
79 // Debug print functions, to go out over USB, to the usual PC-side client.
80 //=============================================================================
81
82 void DbpString(char *str)
83 {
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
86 }
87
88 #if 0
89 void DbpIntegers(int x1, int x2, int x3)
90 {
91 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
92 }
93 #endif
94
95 void Dbprintf(const char *fmt, ...) {
96 // should probably limit size here; oh well, let's just use a big buffer
97 char output_string[128];
98 va_list ap;
99
100 va_start(ap, fmt);
101 kvsprintf(fmt, output_string, 10, ap);
102 va_end(ap);
103
104 DbpString(output_string);
105 }
106
107 // prints HEX & ASCII
108 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
109 int l=0,i;
110 char ascii[9];
111
112 while (len>0) {
113 if (len>8) l=8;
114 else l=len;
115
116 memcpy(ascii,d,l);
117 ascii[l]=0;
118
119 // filter safe ascii
120 for (i=0;i<l;i++)
121 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
122
123 if (bAsci) {
124 Dbprintf("%-8s %*D",ascii,l,d," ");
125 } else {
126 Dbprintf("%*D",l,d," ");
127 }
128
129 len-=8;
130 d+=8;
131 }
132 }
133
134 //-----------------------------------------------------------------------------
135 // Read an ADC channel and block till it completes, then return the result
136 // in ADC units (0 to 1023). Also a routine to average 32 samples and
137 // return that.
138 //-----------------------------------------------------------------------------
139 static int ReadAdc(int ch)
140 {
141 uint32_t d;
142
143 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
144 AT91C_BASE_ADC->ADC_MR =
145 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
146 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
147 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
148
149 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
150 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
151 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
152 //
153 // The maths are:
154 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
155 //
156 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
157 //
158 // Note: with the "historic" values in the comments above, the error was 34% !!!
159
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161
162 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
163
164 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
165 ;
166 d = AT91C_BASE_ADC->ADC_CDR[ch];
167
168 return d;
169 }
170
171 int AvgAdc(int ch) // was static - merlok
172 {
173 int i;
174 int a = 0;
175
176 for(i = 0; i < 32; i++) {
177 a += ReadAdc(ch);
178 }
179
180 return (a + 15) >> 5;
181 }
182
183 void MeasureAntennaTuning(void)
184 {
185 uint8_t LF_Results[256];
186 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
187 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
188
189 LED_B_ON();
190
191 /*
192 * Sweeps the useful LF range of the proxmark from
193 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
194 * read the voltage in the antenna, the result left
195 * in the buffer is a graph which should clearly show
196 * the resonating frequency of your LF antenna
197 * ( hopefully around 95 if it is tuned to 125kHz!)
198 */
199
200 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
201 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
202 for (i=255; i>=19; i--) {
203 WDT_HIT();
204 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
205 SpinDelay(20);
206 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
207 if (i==95) vLf125 = adcval; // voltage at 125Khz
208 if (i==89) vLf134 = adcval; // voltage at 134Khz
209
210 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
211 if(LF_Results[i] > peak) {
212 peakv = adcval;
213 peak = LF_Results[i];
214 peakf = i;
215 //ptr = i;
216 }
217 }
218
219 for (i=18; i >= 0; i--) LF_Results[i] = 0;
220
221 LED_A_ON();
222 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
223 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
224 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
225 SpinDelay(20);
226 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
227
228 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
229 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
230 LED_A_OFF();
231 LED_B_OFF();
232 return;
233 }
234
235 void MeasureAntennaTuningHf(void)
236 {
237 int vHf = 0; // in mV
238
239 DbpString("Measuring HF antenna, press button to exit");
240
241 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
242 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
243 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
244
245 for (;;) {
246 SpinDelay(20);
247 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
248
249 Dbprintf("%d mV",vHf);
250 if (BUTTON_PRESS()) break;
251 }
252 DbpString("cancelled");
253
254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
255
256 }
257
258
259 void ReadMem(int addr)
260 {
261 const uint8_t *data = ((uint8_t *)addr);
262
263 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
264 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
265 }
266
267 /* osimage version information is linked in */
268 extern struct version_information version_information;
269 /* bootrom version information is pointed to from _bootphase1_version_pointer */
270 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
271 void SendVersion(void)
272 {
273 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
274 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
275
276 /* Try to find the bootrom version information. Expect to find a pointer at
277 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
278 * pointer, then use it.
279 */
280 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
281 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
282 strcat(VersionString, "bootrom version information appears invalid\n");
283 } else {
284 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
285 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
286 }
287
288 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
289 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
290
291 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
292 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
293 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
294 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
295
296 // Send Chip ID and used flash memory
297 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
298 uint32_t compressed_data_section_size = common_area.arg1;
299 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
300 }
301
302 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
303 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
304 void printUSBSpeed(uint32_t SpeedTestBufferSize)
305 {
306 Dbprintf("USB Speed:");
307 Dbprintf(" Sending %d bytes payload...", SpeedTestBufferSize);
308
309 uint8_t *test_data = BigBuf_get_addr();
310
311 uint32_t start_time = GetTickCount();
312
313 LED_B_ON();
314 for(size_t i=0; i < SpeedTestBufferSize; i += USB_CMD_DATA_SIZE) {
315 size_t len = MIN((SpeedTestBufferSize - i), USB_CMD_DATA_SIZE);
316 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,0,len,0,test_data,len);
317 }
318 LED_B_OFF();
319
320 uint32_t end_time = GetTickCount();
321
322 Dbprintf(" Time elapsed: %dms, USB Transfer Speed PM3 -> Client = %d Bytes/s",
323 end_time - start_time,
324 1000* SpeedTestBufferSize / (end_time - start_time));
325
326 }
327
328 /**
329 * Prints runtime information about the PM3.
330 **/
331 void SendStatus(uint32_t SpeedTestBufferSize)
332 {
333 BigBuf_print_status();
334 Fpga_print_status();
335 printConfig(); //LF Sampling config
336 printUSBSpeed(SpeedTestBufferSize);
337 Dbprintf("Various");
338 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
339 Dbprintf(" ToSendMax..........%d", ToSendMax);
340 Dbprintf(" ToSendBit..........%d", ToSendBit);
341 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
342
343 cmd_send(CMD_ACK,1,0,0,0,0);
344 }
345
346 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
347
348 #define OPTS 2
349
350 void StandAloneMode()
351 {
352 DbpString("Stand-alone mode! No PC necessary.");
353 // Oooh pretty -- notify user we're in elite samy mode now
354 LED(LED_RED, 200);
355 LED(LED_ORANGE, 200);
356 LED(LED_GREEN, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_RED, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_GREEN, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_RED, 200);
363
364 }
365
366 #endif
367
368
369
370 #ifdef WITH_ISO14443a_StandAlone
371 void StandAloneMode14a()
372 {
373 StandAloneMode();
374 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
375
376 int selected = 0;
377 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
378 int cardRead[OPTS] = {0};
379 uint8_t readUID[10] = {0};
380 uint32_t uid_1st[OPTS]={0};
381 uint32_t uid_2nd[OPTS]={0};
382 uint32_t uid_tmp1 = 0;
383 uint32_t uid_tmp2 = 0;
384 iso14a_card_select_t hi14a_card[OPTS];
385
386 LED(selected + 1, 0);
387
388 for (;;)
389 {
390 usb_poll();
391 WDT_HIT();
392 SpinDelay(300);
393
394 if (iGotoRecord == 1 || cardRead[selected] == 0)
395 {
396 iGotoRecord = 0;
397 LEDsoff();
398 LED(selected + 1, 0);
399 LED(LED_RED2, 0);
400
401 // record
402 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
403 /* need this delay to prevent catching some weird data */
404 SpinDelay(500);
405 /* Code for reading from 14a tag */
406 uint8_t uid[10] ={0};
407 uint32_t cuid;
408 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
409
410 for ( ; ; )
411 {
412 WDT_HIT();
413 if (BUTTON_PRESS()) {
414 if (cardRead[selected]) {
415 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
416 break;
417 }
418 else if (cardRead[(selected+1)%OPTS]) {
419 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
420 selected = (selected+1)%OPTS;
421 break; // playing = 1;
422 }
423 else {
424 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
425 SpinDelay(300);
426 }
427 }
428 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
429 continue;
430 else
431 {
432 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
433 memcpy(readUID,uid,10*sizeof(uint8_t));
434 uint8_t *dst = (uint8_t *)&uid_tmp1;
435 // Set UID byte order
436 for (int i=0; i<4; i++)
437 dst[i] = uid[3-i];
438 dst = (uint8_t *)&uid_tmp2;
439 for (int i=0; i<4; i++)
440 dst[i] = uid[7-i];
441 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
442 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
443 }
444 else {
445 if (uid_tmp2) {
446 Dbprintf("Bank[%d] received a 7-byte UID",selected);
447 uid_1st[selected] = (uid_tmp1)>>8;
448 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
449 }
450 else {
451 Dbprintf("Bank[%d] received a 4-byte UID",selected);
452 uid_1st[selected] = uid_tmp1;
453 uid_2nd[selected] = uid_tmp2;
454 }
455 break;
456 }
457 }
458 }
459 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
460 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
461 LEDsoff();
462 LED(LED_GREEN, 200);
463 LED(LED_ORANGE, 200);
464 LED(LED_GREEN, 200);
465 LED(LED_ORANGE, 200);
466
467 LEDsoff();
468 LED(selected + 1, 0);
469
470 // Next state is replay:
471 playing = 1;
472
473 cardRead[selected] = 1;
474 }
475 /* MF Classic UID clone */
476 else if (iGotoClone==1)
477 {
478 iGotoClone=0;
479 LEDsoff();
480 LED(selected + 1, 0);
481 LED(LED_ORANGE, 250);
482
483
484 // record
485 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
486
487 // wait for button to be released
488 while(BUTTON_PRESS())
489 {
490 // Delay cloning until card is in place
491 WDT_HIT();
492 }
493 Dbprintf("Starting clone. [Bank: %u]", selected);
494 // need this delay to prevent catching some weird data
495 SpinDelay(500);
496 // Begin clone function here:
497 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
498 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
499 memcpy(c.d.asBytes, data, 16);
500 SendCommand(&c);
501
502 Block read is similar:
503 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
504 We need to imitate that call with blockNo 0 to set a uid.
505
506 The get and set commands are handled in this file:
507 // Work with "magic Chinese" card
508 case CMD_MIFARE_CSETBLOCK:
509 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
510 break;
511 case CMD_MIFARE_CGETBLOCK:
512 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
513 break;
514
515 mfCSetUID provides example logic for UID set workflow:
516 -Read block0 from card in field with MifareCGetBlock()
517 -Configure new values without replacing reserved bytes
518 memcpy(block0, uid, 4); // Copy UID bytes from byte array
519 // Mifare UID BCC
520 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
521 Bytes 5-7 are reserved SAK and ATQA for mifare classic
522 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
523 */
524 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
525 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
526 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
527 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
528 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
529 playing = 1;
530 }
531 else {
532 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
533 memcpy(newBlock0,oldBlock0,16);
534 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
535
536 newBlock0[0] = uid_1st[selected]>>24;
537 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
538 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
539 newBlock0[3] = 0xFF & (uid_1st[selected]);
540 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
541 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
542 MifareCSetBlock(0, 0xFF,0, newBlock0);
543 MifareCGetBlock(0x3F, 1, 0, testBlock0);
544 if (memcmp(testBlock0,newBlock0,16)==0)
545 {
546 DbpString("Cloned successfull!");
547 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
548 playing = 0;
549 iGotoRecord = 1;
550 selected = (selected + 1) % OPTS;
551 }
552 else {
553 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
554 playing = 1;
555 }
556 }
557 LEDsoff();
558 LED(selected + 1, 0);
559
560 }
561 // Change where to record (or begin playing)
562 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
563 {
564 LEDsoff();
565 LED(selected + 1, 0);
566
567 // Begin transmitting
568 if (playing)
569 {
570 LED(LED_GREEN, 0);
571 DbpString("Playing");
572 for ( ; ; ) {
573 WDT_HIT();
574 int button_action = BUTTON_HELD(1000);
575 if (button_action == 0) { // No button action, proceed with sim
576 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
577 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
578 num_to_bytes(uid_1st[selected], 3, data);
579 num_to_bytes(uid_2nd[selected], 4, data);
580
581 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
582 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
583 DbpString("Mifare Classic");
584 SimulateIso14443aTag(1, flags, data); // Mifare Classic
585 }
586 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
587 DbpString("Mifare Ultralight");
588 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
589 }
590 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
591 DbpString("Mifare DESFire");
592 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
593 }
594 else {
595 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
596 SimulateIso14443aTag(1, flags, data);
597 }
598 }
599 else if (button_action == BUTTON_SINGLE_CLICK) {
600 selected = (selected + 1) % OPTS;
601 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
602 iGotoRecord = 1;
603 break;
604 }
605 else if (button_action == BUTTON_HOLD) {
606 Dbprintf("Playtime over. Begin cloning...");
607 iGotoClone = 1;
608 break;
609 }
610 WDT_HIT();
611 }
612
613 /* We pressed a button so ignore it here with a delay */
614 SpinDelay(300);
615 LEDsoff();
616 LED(selected + 1, 0);
617 }
618 else
619 while(BUTTON_PRESS())
620 WDT_HIT();
621 }
622 }
623 }
624 #elif WITH_LF
625 // samy's sniff and repeat routine
626 void SamyRun()
627 {
628 StandAloneMode();
629 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
630
631 int high[OPTS], low[OPTS];
632 int selected = 0;
633 int playing = 0;
634 int cardRead = 0;
635
636 // Turn on selected LED
637 LED(selected + 1, 0);
638
639 for (;;)
640 {
641 usb_poll();
642 WDT_HIT();
643
644 // Was our button held down or pressed?
645 int button_pressed = BUTTON_HELD(1000);
646 SpinDelay(300);
647
648 // Button was held for a second, begin recording
649 if (button_pressed > 0 && cardRead == 0)
650 {
651 LEDsoff();
652 LED(selected + 1, 0);
653 LED(LED_RED2, 0);
654
655 // record
656 DbpString("Starting recording");
657
658 // wait for button to be released
659 while(BUTTON_PRESS())
660 WDT_HIT();
661
662 /* need this delay to prevent catching some weird data */
663 SpinDelay(500);
664
665 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
666 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
667
668 LEDsoff();
669 LED(selected + 1, 0);
670 // Finished recording
671
672 // If we were previously playing, set playing off
673 // so next button push begins playing what we recorded
674 playing = 0;
675
676 cardRead = 1;
677
678 }
679
680 else if (button_pressed > 0 && cardRead == 1)
681 {
682 LEDsoff();
683 LED(selected + 1, 0);
684 LED(LED_ORANGE, 0);
685
686 // record
687 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
688
689 // wait for button to be released
690 while(BUTTON_PRESS())
691 WDT_HIT();
692
693 /* need this delay to prevent catching some weird data */
694 SpinDelay(500);
695
696 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
697 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
698
699 LEDsoff();
700 LED(selected + 1, 0);
701 // Finished recording
702
703 // If we were previously playing, set playing off
704 // so next button push begins playing what we recorded
705 playing = 0;
706
707 cardRead = 0;
708
709 }
710
711 // Change where to record (or begin playing)
712 else if (button_pressed)
713 {
714 // Next option if we were previously playing
715 if (playing)
716 selected = (selected + 1) % OPTS;
717 playing = !playing;
718
719 LEDsoff();
720 LED(selected + 1, 0);
721
722 // Begin transmitting
723 if (playing)
724 {
725 LED(LED_GREEN, 0);
726 DbpString("Playing");
727 // wait for button to be released
728 while(BUTTON_PRESS())
729 WDT_HIT();
730 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
731 CmdHIDsimTAG(high[selected], low[selected], 0);
732 DbpString("Done playing");
733 if (BUTTON_HELD(1000) > 0)
734 {
735 DbpString("Exiting");
736 LEDsoff();
737 return;
738 }
739
740 /* We pressed a button so ignore it here with a delay */
741 SpinDelay(300);
742
743 // when done, we're done playing, move to next option
744 selected = (selected + 1) % OPTS;
745 playing = !playing;
746 LEDsoff();
747 LED(selected + 1, 0);
748 }
749 else
750 while(BUTTON_PRESS())
751 WDT_HIT();
752 }
753 }
754 }
755
756 #endif
757 /*
758 OBJECTIVE
759 Listen and detect an external reader. Determine the best location
760 for the antenna.
761
762 INSTRUCTIONS:
763 Inside the ListenReaderField() function, there is two mode.
764 By default, when you call the function, you will enter mode 1.
765 If you press the PM3 button one time, you will enter mode 2.
766 If you press the PM3 button a second time, you will exit the function.
767
768 DESCRIPTION OF MODE 1:
769 This mode just listens for an external reader field and lights up green
770 for HF and/or red for LF. This is the original mode of the detectreader
771 function.
772
773 DESCRIPTION OF MODE 2:
774 This mode will visually represent, using the LEDs, the actual strength of the
775 current compared to the maximum current detected. Basically, once you know
776 what kind of external reader is present, it will help you spot the best location to place
777 your antenna. You will probably not get some good results if there is a LF and a HF reader
778 at the same place! :-)
779
780 LIGHT SCHEME USED:
781 */
782 static const char LIGHT_SCHEME[] = {
783 0x0, /* ---- | No field detected */
784 0x1, /* X--- | 14% of maximum current detected */
785 0x2, /* -X-- | 29% of maximum current detected */
786 0x4, /* --X- | 43% of maximum current detected */
787 0x8, /* ---X | 57% of maximum current detected */
788 0xC, /* --XX | 71% of maximum current detected */
789 0xE, /* -XXX | 86% of maximum current detected */
790 0xF, /* XXXX | 100% of maximum current detected */
791 };
792 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
793
794 void ListenReaderField(int limit)
795 {
796 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
797 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
798 int mode=1, display_val, display_max, i;
799
800 #define LF_ONLY 1
801 #define HF_ONLY 2
802 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
803
804
805 // switch off FPGA - we don't want to measure our own signal
806 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
807 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
808
809 LEDsoff();
810
811 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
812
813 if(limit != HF_ONLY) {
814 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
815 lf_baseline = lf_av;
816 }
817
818 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
819
820 if (limit != LF_ONLY) {
821 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
822 hf_baseline = hf_av;
823 }
824
825 for(;;) {
826 if (BUTTON_PRESS()) {
827 SpinDelay(500);
828 switch (mode) {
829 case 1:
830 mode=2;
831 DbpString("Signal Strength Mode");
832 break;
833 case 2:
834 default:
835 DbpString("Stopped");
836 LEDsoff();
837 return;
838 break;
839 }
840 }
841 WDT_HIT();
842
843 if (limit != HF_ONLY) {
844 if(mode == 1) {
845 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
846 LED_D_ON();
847 else
848 LED_D_OFF();
849 }
850
851 lf_av_new = AvgAdc(ADC_CHAN_LF);
852 // see if there's a significant change
853 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
854 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
855 lf_av = lf_av_new;
856 if (lf_av > lf_max)
857 lf_max = lf_av;
858 }
859 }
860
861 if (limit != LF_ONLY) {
862 if (mode == 1){
863 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
864 LED_B_ON();
865 else
866 LED_B_OFF();
867 }
868
869 hf_av_new = AvgAdc(ADC_CHAN_HF);
870 // see if there's a significant change
871 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
872 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
873 hf_av = hf_av_new;
874 if (hf_av > hf_max)
875 hf_max = hf_av;
876 }
877 }
878
879 if(mode == 2) {
880 if (limit == LF_ONLY) {
881 display_val = lf_av;
882 display_max = lf_max;
883 } else if (limit == HF_ONLY) {
884 display_val = hf_av;
885 display_max = hf_max;
886 } else { /* Pick one at random */
887 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
888 display_val = hf_av;
889 display_max = hf_max;
890 } else {
891 display_val = lf_av;
892 display_max = lf_max;
893 }
894 }
895 for (i=0; i<LIGHT_LEN; i++) {
896 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
897 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
898 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
899 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
900 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
901 break;
902 }
903 }
904 }
905 }
906 }
907
908 void UsbPacketReceived(uint8_t *packet, int len)
909 {
910 UsbCommand *c = (UsbCommand *)packet;
911
912 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
913
914 switch(c->cmd) {
915 #ifdef WITH_LF
916 case CMD_SET_LF_SAMPLING_CONFIG:
917 setSamplingConfig((sample_config *) c->d.asBytes);
918 break;
919 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
920 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
921 break;
922 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
923 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
924 break;
925 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
926 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
927 break;
928 case CMD_HID_DEMOD_FSK:
929 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
930 break;
931 case CMD_HID_SIM_TAG:
932 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
933 break;
934 case CMD_FSK_SIM_TAG:
935 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
936 break;
937 case CMD_ASK_SIM_TAG:
938 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
939 break;
940 case CMD_PSK_SIM_TAG:
941 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
942 break;
943 case CMD_HID_CLONE_TAG:
944 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
945 break;
946 case CMD_IO_DEMOD_FSK:
947 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
948 break;
949 case CMD_IO_CLONE_TAG:
950 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
951 break;
952 case CMD_EM410X_DEMOD:
953 CmdEM410xdemod(c->arg[0], 0, 0, 1);
954 break;
955 case CMD_EM410X_WRITE_TAG:
956 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
957 break;
958 case CMD_READ_TI_TYPE:
959 ReadTItag();
960 break;
961 case CMD_WRITE_TI_TYPE:
962 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
963 break;
964 case CMD_SIMULATE_TAG_125K:
965 LED_A_ON();
966 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
967 LED_A_OFF();
968 break;
969 case CMD_LF_SIMULATE_BIDIR:
970 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
971 break;
972 case CMD_INDALA_CLONE_TAG:
973 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
974 break;
975 case CMD_INDALA_CLONE_TAG_L:
976 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
977 break;
978 case CMD_T55XX_READ_BLOCK:
979 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
980 break;
981 case CMD_T55XX_WRITE_BLOCK:
982 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
983 cmd_send(CMD_ACK,0,0,0,0,0);
984 break;
985 case CMD_T55XX_READ_TRACE:
986 T55xxReadTrace();
987 break;
988 case CMD_PCF7931_READ:
989 ReadPCF7931();
990 cmd_send(CMD_ACK,0,0,0,0,0);
991 break;
992 case CMD_EM4X_READ_WORD:
993 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
994 break;
995 case CMD_EM4X_WRITE_WORD:
996 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
997 break;
998 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
999 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1000 break;
1001 #endif
1002
1003 #ifdef WITH_HITAG
1004 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1005 SnoopHitag(c->arg[0]);
1006 break;
1007 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1008 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1009 break;
1010 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1011 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1012 break;
1013 #endif
1014
1015 #ifdef WITH_ISO15693
1016 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1017 AcquireRawAdcSamplesIso15693();
1018 break;
1019 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1020 RecordRawAdcSamplesIso15693();
1021 break;
1022
1023 case CMD_ISO_15693_COMMAND:
1024 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1025 break;
1026
1027 case CMD_ISO_15693_FIND_AFI:
1028 BruteforceIso15693Afi(c->arg[0]);
1029 break;
1030
1031 case CMD_ISO_15693_DEBUG:
1032 SetDebugIso15693(c->arg[0]);
1033 break;
1034
1035 case CMD_READER_ISO_15693:
1036 ReaderIso15693(c->arg[0]);
1037 break;
1038 case CMD_SIMTAG_ISO_15693:
1039 SimTagIso15693(c->arg[0], c->d.asBytes);
1040 break;
1041 #endif
1042
1043 #ifdef WITH_LEGICRF
1044 case CMD_SIMULATE_TAG_LEGIC_RF:
1045 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1046 break;
1047
1048 case CMD_WRITER_LEGIC_RF:
1049 LegicRfWriter(c->arg[1], c->arg[0]);
1050 break;
1051
1052 case CMD_READER_LEGIC_RF:
1053 LegicRfReader(c->arg[0], c->arg[1]);
1054 break;
1055 #endif
1056
1057 #ifdef WITH_ISO14443b
1058 case CMD_READ_SRI512_TAG:
1059 ReadSTMemoryIso14443b(0x0F);
1060 break;
1061 case CMD_READ_SRIX4K_TAG:
1062 ReadSTMemoryIso14443b(0x7F);
1063 break;
1064 case CMD_SNOOP_ISO_14443B:
1065 SnoopIso14443b();
1066 break;
1067 case CMD_SIMULATE_TAG_ISO_14443B:
1068 SimulateIso14443bTag();
1069 break;
1070 case CMD_ISO_14443B_COMMAND:
1071 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1072 break;
1073 #endif
1074
1075 #ifdef WITH_ISO14443a
1076 case CMD_SNOOP_ISO_14443a:
1077 SniffIso14443a(c->arg[0]);
1078 break;
1079 case CMD_READER_ISO_14443a:
1080 ReaderIso14443a(c);
1081 break;
1082 case CMD_SIMULATE_TAG_ISO_14443a:
1083 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1084 break;
1085
1086 case CMD_EPA_PACE_COLLECT_NONCE:
1087 EPA_PACE_Collect_Nonce(c);
1088 break;
1089 case CMD_EPA_PACE_REPLAY:
1090 EPA_PACE_Replay(c);
1091 break;
1092
1093 case CMD_READER_MIFARE:
1094 ReaderMifare(c->arg[0]);
1095 break;
1096 case CMD_MIFARE_READBL:
1097 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1098 break;
1099 case CMD_MIFAREU_READBL:
1100 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1101 break;
1102 case CMD_MIFAREUC_AUTH:
1103 MifareUC_Auth(c->arg[0],c->d.asBytes);
1104 break;
1105 case CMD_MIFAREU_READCARD:
1106 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1107 break;
1108 case CMD_MIFAREUC_SETPWD:
1109 MifareUSetPwd(c->arg[0], c->d.asBytes);
1110 break;
1111 case CMD_MIFARE_READSC:
1112 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1113 break;
1114 case CMD_MIFARE_WRITEBL:
1115 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1116 break;
1117 //case CMD_MIFAREU_WRITEBL_COMPAT:
1118 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1119 //break;
1120 case CMD_MIFAREU_WRITEBL:
1121 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1122 break;
1123 case CMD_MIFARE_NESTED:
1124 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1125 break;
1126 case CMD_MIFARE_CHKKEYS:
1127 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1128 break;
1129 case CMD_SIMULATE_MIFARE_CARD:
1130 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1131 break;
1132
1133 // emulator
1134 case CMD_MIFARE_SET_DBGMODE:
1135 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1136 break;
1137 case CMD_MIFARE_EML_MEMCLR:
1138 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1139 break;
1140 case CMD_MIFARE_EML_MEMSET:
1141 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1142 break;
1143 case CMD_MIFARE_EML_MEMGET:
1144 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1145 break;
1146 case CMD_MIFARE_EML_CARDLOAD:
1147 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1148 break;
1149
1150 // Work with "magic Chinese" card
1151 case CMD_MIFARE_CSETBLOCK:
1152 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1153 break;
1154 case CMD_MIFARE_CGETBLOCK:
1155 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1156 break;
1157 case CMD_MIFARE_CIDENT:
1158 MifareCIdent();
1159 break;
1160
1161 // mifare sniffer
1162 case CMD_MIFARE_SNIFFER:
1163 SniffMifare(c->arg[0]);
1164 break;
1165
1166 //mifare desfire
1167 case CMD_MIFARE_DESFIRE_READBL: break;
1168 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1169 case CMD_MIFARE_DESFIRE_AUTH1:
1170 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1171 break;
1172 case CMD_MIFARE_DESFIRE_AUTH2:
1173 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1174 break;
1175 case CMD_MIFARE_DES_READER:
1176 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1177 break;
1178 case CMD_MIFARE_DESFIRE_INFO:
1179 MifareDesfireGetInformation();
1180 break;
1181 case CMD_MIFARE_DESFIRE:
1182 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1183 break;
1184
1185 case CMD_MIFARE_COLLECT_NONCES:
1186 MifareCollectNonces(c->arg[0], c->arg[1]);
1187 break;
1188 #endif
1189
1190 #ifdef WITH_ICLASS
1191 // Makes use of ISO14443a FPGA Firmware
1192 case CMD_SNOOP_ICLASS:
1193 SnoopIClass();
1194 break;
1195 case CMD_SIMULATE_TAG_ICLASS:
1196 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1197 break;
1198 case CMD_READER_ICLASS:
1199 ReaderIClass(c->arg[0]);
1200 break;
1201 case CMD_READER_ICLASS_REPLAY:
1202 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1203 break;
1204 case CMD_ICLASS_EML_MEMSET:
1205 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1206 break;
1207 #endif
1208
1209 case CMD_BUFF_CLEAR:
1210 BigBuf_Clear();
1211 break;
1212
1213 case CMD_MEASURE_ANTENNA_TUNING:
1214 MeasureAntennaTuning();
1215 break;
1216
1217 case CMD_MEASURE_ANTENNA_TUNING_HF:
1218 MeasureAntennaTuningHf();
1219 break;
1220
1221 case CMD_LISTEN_READER_FIELD:
1222 ListenReaderField(c->arg[0]);
1223 break;
1224
1225 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1226 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1227 SpinDelay(200);
1228 LED_D_OFF(); // LED D indicates field ON or OFF
1229 break;
1230
1231 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1232
1233 LED_B_ON();
1234 uint8_t *BigBuf = BigBuf_get_addr();
1235 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1236 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1237 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1238 }
1239 // Trigger a finish downloading signal with an ACK frame
1240 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1241 LED_B_OFF();
1242 break;
1243
1244 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1245 uint8_t *b = BigBuf_get_addr();
1246 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1247 cmd_send(CMD_ACK,0,0,0,0,0);
1248 break;
1249 }
1250 case CMD_READ_MEM:
1251 ReadMem(c->arg[0]);
1252 break;
1253
1254 case CMD_SET_LF_DIVISOR:
1255 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1256 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1257 break;
1258
1259 case CMD_SET_ADC_MUX:
1260 switch(c->arg[0]) {
1261 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1262 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1263 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1264 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1265 }
1266 break;
1267
1268 case CMD_VERSION:
1269 SendVersion();
1270 break;
1271 case CMD_STATUS:
1272 SendStatus(c->arg[0]);
1273 break;
1274 case CMD_PING:
1275 cmd_send(CMD_ACK,0,0,0,0,0);
1276 break;
1277 #ifdef WITH_LCD
1278 case CMD_LCD_RESET:
1279 LCDReset();
1280 break;
1281 case CMD_LCD:
1282 LCDSend(c->arg[0]);
1283 break;
1284 #endif
1285 case CMD_SETUP_WRITE:
1286 case CMD_FINISH_WRITE:
1287 case CMD_HARDWARE_RESET:
1288 usb_disable();
1289 SpinDelay(2000);
1290 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1291 for(;;) {
1292 // We're going to reset, and the bootrom will take control.
1293 }
1294 break;
1295
1296 case CMD_START_FLASH:
1297 if(common_area.flags.bootrom_present) {
1298 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1299 }
1300 usb_disable();
1301 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1302 for(;;);
1303 break;
1304
1305 case CMD_DEVICE_INFO: {
1306 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1307 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1308 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1309 break;
1310 }
1311 default:
1312 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1313 break;
1314 }
1315 }
1316
1317 void __attribute__((noreturn)) AppMain(void)
1318 {
1319 SpinDelay(100);
1320 clear_trace();
1321 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1322 /* Initialize common area */
1323 memset(&common_area, 0, sizeof(common_area));
1324 common_area.magic = COMMON_AREA_MAGIC;
1325 common_area.version = 1;
1326 }
1327 common_area.flags.osimage_present = 1;
1328
1329 LED_D_OFF();
1330 LED_C_OFF();
1331 LED_B_OFF();
1332 LED_A_OFF();
1333
1334 // Init USB device
1335 usb_enable();
1336
1337 // The FPGA gets its clock from us from PCK0 output, so set that up.
1338 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1339 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1340 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1341 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1342 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1343 AT91C_PMC_PRES_CLK_4;
1344 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1345
1346 // Reset SPI
1347 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1348 // Reset SSC
1349 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1350
1351 // Load the FPGA image, which we have stored in our flash.
1352 // (the HF version by default)
1353 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1354
1355 StartTickCount();
1356
1357 #ifdef WITH_LCD
1358 LCDInit();
1359 #endif
1360
1361 byte_t rx[sizeof(UsbCommand)];
1362 size_t rx_len;
1363
1364 for(;;) {
1365 if (usb_poll()) {
1366 rx_len = usb_read(rx,sizeof(UsbCommand));
1367 if (rx_len) {
1368 UsbPacketReceived(rx,rx_len);
1369 }
1370 }
1371 WDT_HIT();
1372
1373 #ifdef WITH_LF
1374 #ifndef WITH_ISO14443a_StandAlone
1375 if (BUTTON_HELD(1000) > 0)
1376 SamyRun();
1377 #endif
1378 #endif
1379 #ifdef WITH_ISO14443a
1380 #ifdef WITH_ISO14443a_StandAlone
1381 if (BUTTON_HELD(1000) > 0)
1382 StandAloneMode14a();
1383 #endif
1384 #endif
1385 }
1386 }
Proxmark3 GIT tracking
Impressum, Datenschutz