1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Sept 2005
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Utility functions used in many places, not specific to any piece of code.
9 //-----------------------------------------------------------------------------
11 #include "proxmark3.h"
19 void print_result(char *name
, uint8_t *buf
, size_t len
) {
22 if ( len
% 16 == 0 ) {
23 for(; p
-buf
< len
; p
+= 16)
24 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
28 p
[0], p
[1], p
[2], p
[3], p
[4], p
[5], p
[6], p
[7],p
[8], p
[9], p
[10], p
[11], p
[12], p
[13], p
[14], p
[15]
32 for(; p
-buf
< len
; p
+= 8)
33 Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x", name
, p
-buf
, len
, p
[0], p
[1], p
[2], p
[3], p
[4], p
[5], p
[6], p
[7]);
37 size_t nbytes(size_t nbits
) {
38 return (nbits
>> 3)+((nbits
% 8) > 0);
41 uint32_t SwapBits(uint32_t value
, int nrbits
) {
43 uint32_t newvalue
= 0;
44 for(i
= 0; i
< nrbits
; i
++) {
45 newvalue
^= ((value
>> i
) & 1) << (nrbits
- 1 - i
);
50 void num_to_bytes(uint64_t n
, size_t len
, uint8_t* dest
)
53 dest
[len
] = (uint8_t) n
;
58 uint64_t bytes_to_num(uint8_t* src
, size_t len
)
63 num
= (num
<< 8) | (*src
);
69 // RotateLeft - Ultralight, Desfire
70 void rol(uint8_t *data
, const size_t len
){
71 uint8_t first
= data
[0];
72 for (size_t i
= 0; i
< len
-1; i
++) {
77 void lsl (uint8_t *data
, size_t len
) {
78 for (size_t n
= 0; n
< len
- 1; n
++) {
79 data
[n
] = (data
[n
] << 1) | (data
[n
+1] >> 7);
108 // LEDs: R(C) O(A) G(B) -- R(D) [1, 2, 4 and 8]
109 void LED(int led
, int ms
)
113 if (led
& LED_ORANGE
)
127 if (led
& LED_ORANGE
)
136 // Determine if a button is double clicked, single clicked,
137 // not clicked, or held down (for ms || 1sec)
138 // In general, don't use this function unless you expect a
139 // double click, otherwise it will waste 500ms -- use BUTTON_HELD instead
140 int BUTTON_CLICKED(int ms
)
142 // Up to 500ms in between clicks to mean a double click
143 int ticks
= (48000 * (ms
? ms
: 1000)) >> 10;
145 // If we're not even pressed, forget about it!
147 return BUTTON_NO_CLICK
;
149 // Borrow a PWM unit for my real-time clock
150 AT91C_BASE_PWMC
->PWMC_ENA
= PWM_CHANNEL(0);
151 // 48 MHz / 1024 gives 46.875 kHz
152 AT91C_BASE_PWMC_CH0
->PWMC_CMR
= PWM_CH_MODE_PRESCALER(10);
153 AT91C_BASE_PWMC_CH0
->PWMC_CDTYR
= 0;
154 AT91C_BASE_PWMC_CH0
->PWMC_CPRDR
= 0xffff;
156 uint16_t start
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
161 uint16_t now
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
163 // We haven't let off the button yet
166 // We just let it off!
171 // reset our timer for 500ms
172 start
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
173 ticks
= (48000 * (500)) >> 10;
176 // Still haven't let it off
178 // Have we held down a full second?
179 if (now
== (uint16_t)(start
+ ticks
))
183 // We already let off, did we click again?
185 // Sweet, double click!
187 return BUTTON_DOUBLE_CLICK
;
189 // Have we ran out of time to double click?
191 if (now
== (uint16_t)(start
+ ticks
))
192 // At least we did a single click
193 return BUTTON_SINGLE_CLICK
;
198 // We should never get here
202 // Determine if a button is held down
203 int BUTTON_HELD(int ms
)
205 // If button is held for one second
206 int ticks
= (48000 * (ms
? ms
: 1000)) >> 10;
208 // If we're not even pressed, forget about it!
210 return BUTTON_NO_CLICK
;
212 // Borrow a PWM unit for my real-time clock
213 AT91C_BASE_PWMC
->PWMC_ENA
= PWM_CHANNEL(0);
214 // 48 MHz / 1024 gives 46.875 kHz
215 AT91C_BASE_PWMC_CH0
->PWMC_CMR
= PWM_CH_MODE_PRESCALER(10);
216 AT91C_BASE_PWMC_CH0
->PWMC_CDTYR
= 0;
217 AT91C_BASE_PWMC_CH0
->PWMC_CPRDR
= 0xffff;
219 uint16_t start
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
223 uint16_t now
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
225 // As soon as our button let go, we didn't hold long enough
227 return BUTTON_SINGLE_CLICK
;
229 // Have we waited the full second?
231 if (now
== (uint16_t)(start
+ ticks
))
237 // We should never get here
241 // attempt at high resolution microsecond timer
242 // beware: timer counts in 21.3uS increments (1024/48Mhz)
243 void SpinDelayUs(int us
)
245 int ticks
= (48*us
) >> 10;
247 // Borrow a PWM unit for my real-time clock
248 AT91C_BASE_PWMC
->PWMC_ENA
= PWM_CHANNEL(0);
249 // 48 MHz / 1024 gives 46.875 kHz
250 AT91C_BASE_PWMC_CH0
->PWMC_CMR
= PWM_CH_MODE_PRESCALER(10);
251 AT91C_BASE_PWMC_CH0
->PWMC_CDTYR
= 0;
252 AT91C_BASE_PWMC_CH0
->PWMC_CPRDR
= 0xffff;
254 uint16_t start
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
257 uint16_t now
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
;
258 if (now
== (uint16_t)(start
+ ticks
))
265 void SpinDelay(int ms
)
267 // convert to uS and call microsecond delay function
268 SpinDelayUs(ms
*1000);
271 /* Similar to FpgaGatherVersion this formats stored version information
272 * into a string representation. It takes a pointer to the struct version_information,
273 * verifies the magic properties, then stores a formatted string, prefixed by
276 void FormatVersionInformation(char *dst
, int len
, const char *prefix
, void *version_information
)
278 struct version_information
*v
= (struct version_information
*)version_information
;
280 strncat(dst
, prefix
, len
-1);
281 if(v
->magic
!= VERSION_INFORMATION_MAGIC
) {
282 strncat(dst
, "Missing/Invalid version information\n", len
- strlen(dst
) - 1);
285 if(v
->versionversion
!= 1) {
286 strncat(dst
, "Version information not understood\n", len
- strlen(dst
) - 1);
290 strncat(dst
, "Version information not available\n", len
- strlen(dst
) - 1);
294 strncat(dst
, v
->gitversion
, len
- strlen(dst
) - 1);
296 strncat(dst
, "-unclean", len
- strlen(dst
) - 1);
297 } else if(v
->clean
== 2) {
298 strncat(dst
, "-suspect", len
- strlen(dst
) - 1);
301 strncat(dst
, " ", len
- strlen(dst
) - 1);
302 strncat(dst
, v
->buildtime
, len
- strlen(dst
) - 1);
303 strncat(dst
, "\n", len
- strlen(dst
) - 1);
307 // -------------------------------------------------------------------------
309 // -------------------------------------------------------------------------
312 // ti = GetTickCount();
314 // ti = GetTickCount() - ti;
315 // Dbprintf("timer(1s): %d t=%d", ti, GetTickCount());
317 void StartTickCount()
319 // This timer is based on the slow clock. The slow clock frequency is between 22kHz and 40kHz.
320 // We can determine the actual slow clock frequency by looking at the Main Clock Frequency Register.
321 uint16_t mainf
= AT91C_BASE_PMC
->PMC_MCFR
& 0xffff; // = 16 * main clock frequency (16MHz) / slow clock frequency
322 // set RealTimeCounter divider to count at 1kHz:
323 AT91C_BASE_RTTC
->RTTC_RTMR
= AT91C_RTTC_RTTRST
| ((256000 + (mainf
/2)) / mainf
);
324 // note: worst case precision is approx 2.5%
329 * Get the current count.
331 uint32_t RAMFUNC
GetTickCount(){
332 return AT91C_BASE_RTTC
->RTTC_RTVR
;// was * 2;
336 // -------------------------------------------------------------------------
337 // microseconds timer
338 // -------------------------------------------------------------------------
341 AT91C_BASE_PMC
->PMC_PCER
|= (0x1 << 12) | (0x1 << 13) | (0x1 << 14);
342 // AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC1XC1S_TIOA0;
343 AT91C_BASE_TCB
->TCB_BMR
= AT91C_TCB_TC0XC0S_NONE
| AT91C_TCB_TC1XC1S_TIOA0
| AT91C_TCB_TC2XC2S_NONE
;
346 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
; // timer disable
347 AT91C_BASE_TC0
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV3_CLOCK
| // MCK(48MHz)/32 -- tick=1.5mks
348 AT91C_TC_WAVE
| AT91C_TC_WAVESEL_UP_AUTO
| AT91C_TC_ACPA_CLEAR
|
349 AT91C_TC_ACPC_SET
| AT91C_TC_ASWTRG_SET
;
350 AT91C_BASE_TC0
->TC_RA
= 1;
351 AT91C_BASE_TC0
->TC_RC
= 0xBFFF + 1; // 0xC000
353 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
; // timer disable
354 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_XC1
; // from timer 0
356 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
;
357 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
;
358 AT91C_BASE_TCB
->TCB_BCR
= 1;
362 uint32_t RAMFUNC
GetCountUS(){
363 return (AT91C_BASE_TC1
->TC_CV
* 0x8000) + ((AT91C_BASE_TC0
->TC_CV
* 2) / 3); //was /15) * 10);
367 static uint32_t GlobalUsCounter
= 0;
369 uint32_t RAMFUNC
GetDeltaCountUS(){
370 uint32_t g_cnt
= GetCountUS();
371 uint32_t g_res
= g_cnt
- GlobalUsCounter
;
372 GlobalUsCounter
= g_cnt
;
377 // -------------------------------------------------------------------------
378 // Timer for iso14443 commands. Uses ssp_clk from FPGA
379 // -------------------------------------------------------------------------
380 void StartCountSspClk()
382 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC0
) | (1 << AT91C_ID_TC1
) | (1 << AT91C_ID_TC2
); // Enable Clock to all timers
383 AT91C_BASE_TCB
->TCB_BMR
= AT91C_TCB_TC0XC0S_TIOA1
// XC0 Clock = TIOA1
384 | AT91C_TCB_TC1XC1S_NONE
// XC1 Clock = none
385 | AT91C_TCB_TC2XC2S_TIOA0
; // XC2 Clock = TIOA0
387 // configure TC1 to create a short pulse on TIOA1 when a rising edge on TIOB1 (= ssp_clk from FPGA) occurs:
388 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
; // disable TC1
389 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV1_CLOCK
// TC1 Clock = MCK(48MHz)/2 = 24MHz
390 | AT91C_TC_CPCSTOP
// Stop clock on RC compare
391 | AT91C_TC_EEVTEDG_RISING
// Trigger on rising edge of Event
392 | AT91C_TC_EEVT_TIOB
// Event-Source: TIOB1 (= ssp_clk from FPGA = 13,56MHz/16 ... 13,56MHz/4)
393 | AT91C_TC_ENETRG
// Enable external trigger event
394 | AT91C_TC_WAVESEL_UP
// Upmode without automatic trigger on RC compare
395 | AT91C_TC_WAVE
// Waveform Mode
396 | AT91C_TC_AEEVT_SET
// Set TIOA1 on external event
397 | AT91C_TC_ACPC_CLEAR
; // Clear TIOA1 on RC Compare
398 AT91C_BASE_TC1
->TC_RC
= 0x02; // RC Compare value = 0x02
400 // use TC0 to count TIOA1 pulses
401 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
; // disable TC0
402 AT91C_BASE_TC0
->TC_CMR
= AT91C_TC_CLKS_XC0
// TC0 clock = XC0 clock = TIOA1
403 | AT91C_TC_WAVE
// Waveform Mode
404 | AT91C_TC_WAVESEL_UP
// just count
405 | AT91C_TC_ACPA_CLEAR
// Clear TIOA0 on RA Compare
406 | AT91C_TC_ACPC_SET
; // Set TIOA0 on RC Compare
407 AT91C_BASE_TC0
->TC_RA
= 1; // RA Compare value = 1; pulse width to TC2
408 AT91C_BASE_TC0
->TC_RC
= 0; // RC Compare value = 0; increment TC2 on overflow
410 // use TC2 to count TIOA0 pulses (giving us a 32bit counter (TC0/TC2) clocked by ssp_clk)
411 AT91C_BASE_TC2
->TC_CCR
= AT91C_TC_CLKDIS
; // disable TC2
412 AT91C_BASE_TC2
->TC_CMR
= AT91C_TC_CLKS_XC2
// TC2 clock = XC2 clock = TIOA0
413 | AT91C_TC_WAVE
// Waveform Mode
414 | AT91C_TC_WAVESEL_UP
; // just count
416 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
; // enable TC0
417 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
; // enable TC1
418 AT91C_BASE_TC2
->TC_CCR
= AT91C_TC_CLKEN
; // enable TC2
421 // synchronize the counter with the ssp_frame signal. Note: FPGA must be in a FPGA mode with SSC transfer, otherwise SSC_FRAME and SSC_CLK signals would not be present
423 while(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_FRAME
); // wait for ssp_frame to be low
424 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_FRAME
)); // wait for ssp_frame to go high (start of frame)
425 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
)); // wait for ssp_clk to go high; 1st ssp_clk after start of frame
426 while(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
); // wait for ssp_clk to go low;
427 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
)); // wait for ssp_clk to go high; 2nd ssp_clk after start of frame
428 if ((AT91C_BASE_SSC
->SSC_RFMR
& SSC_FRAME_MODE_BITS_IN_WORD(32)) == SSC_FRAME_MODE_BITS_IN_WORD(16)) {
429 while(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
); // wait for ssp_clk to go low;
430 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
)); // wait for ssp_clk to go high; 3rd ssp_clk after start of frame
431 while(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
); // wait for ssp_clk to go low;
432 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
)); // wait for ssp_clk to go high; 4th ssp_clk after start of frame
433 while(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
); // wait for ssp_clk to go low;
434 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
)); // wait for ssp_clk to go high; 5th ssp_clk after start of frame
435 while(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
); // wait for ssp_clk to go low;
436 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
)); // wait for ssp_clk to go high; 6th ssp_clk after start of frame
438 // it is now safe to assert a sync signal. This sets all timers to 0 on next active clock edge
439 AT91C_BASE_TCB
->TCB_BCR
= 1; // assert Sync (set all timers to 0 on next active clock edge)
440 // at the next (3rd/7th) ssp_clk rising edge, TC1 will be reset (and not generate a clock signal to TC0)
441 // at the next (4th/8th) ssp_clk rising edge, TC0 (the low word of our counter) will be reset. From now on,
442 // whenever the last three bits of our counter go 0, we can be sure to be in the middle of a frame transfer.
443 // (just started with the transfer of the 3rd Bit).
444 // The high word of the counter (TC2) will not reset until the low word (TC0) overflows. Therefore need to wait quite some time before
445 // we can use the counter.
446 while (AT91C_BASE_TC0
->TC_CV
< 0xFFFF);
447 // Note: needs one more SSP_CLK cycle (1.18 us) until TC2 resets. Don't call GetCountSspClk() that soon.
451 void ResetSspClk(void) {
452 //enable clock of timer and software trigger
453 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
454 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
455 AT91C_BASE_TC2
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
456 while (AT91C_BASE_TC2
->TC_CV
> 0);
459 uint32_t GetCountSspClk(){
463 hi
= AT91C_BASE_TC2
->TC_CV
;
464 lo
= AT91C_BASE_TC0
->TC_CV
;
465 } while (hi
!= AT91C_BASE_TC2
->TC_CV
);
467 return (hi
<< 16) | lo
;
470 // -------------------------------------------------------------------------
471 // Timer for bitbanging, or LF stuff when you need a very precis timer
473 // -------------------------------------------------------------------------
474 void StartTicks(void){
475 // initialization of the timer
476 AT91C_BASE_PMC
->PMC_PCER
|= (1 << AT91C_ID_TC0
) | (1 << AT91C_ID_TC1
);
477 AT91C_BASE_TCB
->TCB_BMR
= AT91C_TCB_TC0XC0S_NONE
| AT91C_TCB_TC1XC1S_TIOA0
| AT91C_TCB_TC2XC2S_NONE
;
479 // disable TC0 and TC1 for re-configuration
480 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
;
481 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
483 // first configure TC1 (higher, 0xFFFF0000) 16 bit counter
484 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_XC1
; // just connect to TIOA0 from TC0
485 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
; // re-enable timer and wait for TC0
487 // second configure TC0 (lower, 0x0000FFFF) 16 bit counter
488 AT91C_BASE_TC0
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV3_CLOCK
| // MCK(48MHz) / 32
489 AT91C_TC_WAVE
| AT91C_TC_WAVESEL_UP_AUTO
|
490 AT91C_TC_ACPA_CLEAR
| // RA comperator clears TIOA (carry bit)
491 AT91C_TC_ACPC_SET
| // RC comperator sets TIOA (carry bit)
492 AT91C_TC_ASWTRG_SET
; // SWTriger sets TIOA (carry bit)
493 AT91C_BASE_TC0
->TC_RC
= 0; // set TIOA (carry bit) on overflow, return to zero
494 AT91C_BASE_TC0
->TC_RA
= 1; // clear carry bit on next clock cycle
495 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
; // reset and re-enable timer
497 // synchronized startup procedure
498 while (AT91C_BASE_TC0
->TC_CV
> 0); // wait until TC0 returned to zero
499 while (AT91C_BASE_TC0
->TC_CV
< 2); // and has started (TC_CV > TC_RA, now TC1 is cleared)
502 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_SWTRG
;
503 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_SWTRG
;
504 while (AT91C_BASE_TC0
->TC_CV
> 0);
508 uint32_t GetTicks(void) {
512 hi
= AT91C_BASE_TC1
->TC_CV
;
513 lo
= AT91C_BASE_TC0
->TC_CV
;
514 } while(hi
!= AT91C_BASE_TC1
->TC_CV
);
516 return (hi
<< 16) | lo
;
520 // Wait - Spindelay in ticks.
521 // if called with a high number, this will trigger the WDT...
522 void WaitTicks(uint32_t ticks
){
523 if ( ticks
== 0 ) return;
525 while (GetTicks() < ticks
);
529 // Wait / Spindelay in us (microseconds)
531 void WaitUS(uint16_t us
){
532 WaitTicks( (uint32_t)us
* 3 / 2 ) ;
536 void WaitMS(uint16_t ms
){
537 WaitTicks( (uint32_t)ms
* 1500 );
541 // Starts Clock and waits until its reset
542 void ResetTicks(void){
543 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
544 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
545 while (AT91C_BASE_TC0
->TC_CV
> 0);
549 void ResetTimer(AT91PS_TC timer
){
550 timer
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
551 while(timer
->TC_CV
> 0) ;
556 void StopTicks(void){
557 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
;
558 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
562 static uint64_t next_random
= 1;
564 /* Generates a (non-cryptographically secure) 32-bit random number.
566 * We don't have an implementation of the "rand" function or a clock to seed it
567 * with, so we just call GetTickCount the first time to seed ourselves.
570 if (next_random
== 1) {
571 next_random
= GetTickCount();
574 next_random
= next_random
* 6364136223846793005 + 1;
575 return (uint32_t)(next_random
>> 32) % 0xffffffff;