1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Aug 2005
3 // Gerhard de Koning Gans, April 2008, May 2011
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // Definitions internal to the app source.
10 //-----------------------------------------------------------------------------
18 #include <sys/types.h>
22 #include "../include/common.h"
23 #include "../include/hitag2.h"
24 #include "../include/mifare.h"
26 //#include <openssl/des.h>
27 //#include <openssl/aes.h>
30 #include "../common/desfire.h"
31 #include "../common/crc32.h"
33 // The large multi-purpose buffer, typically used to hold A/D samples,
34 // maybe processed in some way.
35 #define BIGBUF_SIZE 40000
36 uint32_t BigBuf
[BIGBUF_SIZE
/ sizeof(uint32_t)];
37 #define TRACE_OFFSET 0
38 #define TRACE_SIZE 3000
39 #define RECV_CMD_OFFSET (TRACE_OFFSET + TRACE_SIZE)
40 #define MAX_FRAME_SIZE 256
41 #define MAX_PARITY_SIZE ((MAX_FRAME_SIZE + 1)/ 8)
42 #define RECV_CMD_PAR_OFFSET (RECV_CMD_OFFSET + MAX_FRAME_SIZE)
43 #define RECV_RESP_OFFSET (RECV_CMD_PAR_OFFSET + MAX_PARITY_SIZE)
44 #define RECV_RESP_PAR_OFFSET (RECV_RESP_OFFSET + MAX_FRAME_SIZE)
45 #define CARD_MEMORY_OFFSET (RECV_RESP_PAR_OFFSET + MAX_PARITY_SIZE)
46 #define CARD_MEMORY_SIZE 4096
47 #define DMA_BUFFER_OFFSET CARD_MEMORY_OFFSET
48 #define DMA_BUFFER_SIZE CARD_MEMORY_SIZE
49 #define FREE_BUFFER_OFFSET (CARD_MEMORY_OFFSET + CARD_MEMORY_SIZE)
50 #define FREE_BUFFER_SIZE (BIGBUF_SIZE - FREE_BUFFER_OFFSET - 1)
52 extern const uint8_t OddByteParity
[256];
53 extern uint8_t *trace
; // = (uint8_t *) BigBuf;
54 extern int traceLen
; // = 0;
55 extern int rsamples
; // = 0;
56 extern int tracing
; // = TRUE;
57 extern uint8_t trigger
;
59 // This may be used (sparingly) to declare a function to be copied to
60 // and executed from RAM
61 #define RAMFUNC __attribute((long_call, section(".ramfunc")))
64 void ReadMem(int addr
);
65 void __attribute__((noreturn
)) AppMain(void);
67 //void DbpIntegers(int a, int b, int c);
68 void DbpString(char *str
);
69 void Dbprintf(const char *fmt
, ...);
70 void Dbhexdump(int len
, uint8_t *d
, bool bAsci
);
74 void ToSendStuffBit(int b
);
75 void ToSendReset(void);
76 void ListenReaderField(int limit
);
77 void AcquireRawAdcSamples125k(int at134khz
);
78 void SnoopLFRawAdcSamples(int divisor
, int trigger_threshold
);
79 void DoAcquisition125k_internal(int trigger_threshold
, bool silent
);
80 void DoAcquisition125k_threshold(int trigger_threshold
);
81 void DoAcquisition125k();
84 extern uint8_t ToSend
[];
85 extern uint32_t BigBuf
[];
88 void FpgaSendCommand(uint16_t cmd
, uint16_t v
);
89 void FpgaWriteConfWord(uint8_t v
);
90 void FpgaDownloadAndGo(int bitstream_version
);
91 int FpgaGatherBitstreamVersion();
92 void FpgaGatherVersion(char *dst
, int len
);
93 void FpgaSetupSsc(void);
94 void SetupSpi(int mode
);
95 bool FpgaSetupSscDma(uint8_t *buf
, int len
);
96 #define FpgaDisableSscDma(void) AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
97 #define FpgaEnableSscDma(void) AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTEN;
98 void SetAdcMuxFor(uint32_t whichGpio
);
100 // Definitions for the FPGA commands.
101 #define FPGA_CMD_SET_CONFREG (1<<12)
102 #define FPGA_CMD_SET_DIVISOR (2<<12)
103 #define FPGA_CMD_SET_USER_BYTE1 (3<<12)
104 // Definitions for the FPGA configuration word.
106 #define FPGA_MAJOR_MODE_LF_ADC (0<<5)
107 #define FPGA_MAJOR_MODE_LF_EDGE_DETECT (1<<5)
108 #define FPGA_MAJOR_MODE_LF_PASSTHRU (2<<5)
110 #define FPGA_MAJOR_MODE_HF_READER_TX (0<<5)
111 #define FPGA_MAJOR_MODE_HF_READER_RX_XCORR (1<<5)
112 #define FPGA_MAJOR_MODE_HF_SIMULATOR (2<<5)
113 #define FPGA_MAJOR_MODE_HF_ISO14443A (3<<5)
115 #define FPGA_MAJOR_MODE_OFF (7<<5)
116 // Options for LF_ADC
117 #define FPGA_LF_ADC_READER_FIELD (1<<0)
118 // Options for LF_EDGE_DETECT
119 #define FPGA_CMD_SET_EDGE_DETECT_THRESHOLD FPGA_CMD_SET_USER_BYTE1
120 #define FPGA_LF_EDGE_DETECT_READER_FIELD (1<<0)
121 #define FPGA_LF_EDGE_DETECT_TOGGLE_MODE (1<<1)
122 // Options for the HF reader, tx to tag
123 #define FPGA_HF_READER_TX_SHALLOW_MOD (1<<0)
124 // Options for the HF reader, correlating against rx from tag
125 #define FPGA_HF_READER_RX_XCORR_848_KHZ (1<<0)
126 #define FPGA_HF_READER_RX_XCORR_SNOOP (1<<1)
127 #define FPGA_HF_READER_RX_XCORR_QUARTER_FREQ (1<<2)
128 // Options for the HF simulated tag, how to modulate
129 #define FPGA_HF_SIMULATOR_NO_MODULATION (0<<0)
130 #define FPGA_HF_SIMULATOR_MODULATE_BPSK (1<<0)
131 #define FPGA_HF_SIMULATOR_MODULATE_212K (2<<0)
132 #define FPGA_HF_SIMULATOR_MODULATE_424K (4<<0)
133 // Options for ISO14443A
134 #define FPGA_HF_ISO14443A_SNIFFER (0<<0)
135 #define FPGA_HF_ISO14443A_TAGSIM_LISTEN (1<<0)
136 #define FPGA_HF_ISO14443A_TAGSIM_MOD (2<<0)
137 #define FPGA_HF_ISO14443A_READER_LISTEN (3<<0)
138 #define FPGA_HF_ISO14443A_READER_MOD (4<<0)
141 void AcquireRawAdcSamples125k(int divisor
);
142 void ModThenAcquireRawAdcSamples125k(int delay_off
,int period_0
,int period_1
,uint8_t *command
);
143 void ReadTItag(void);
144 void WriteTItag(uint32_t idhi
, uint32_t idlo
, uint16_t crc
);
145 void AcquireTiType(void);
146 void AcquireRawBitsTI(void);
147 void SimulateTagLowFrequency( uint16_t period
, uint32_t gap
, uint8_t ledcontrol
);
148 void SimulateTagLowFrequencyA(int period
, int gap
);
150 void CmdHIDsimTAG(int hi
, int lo
, uint8_t ledcontrol
);
151 void CmdHIDdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
);
152 void CmdIOdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
);
153 void CopyIOtoT55x7(uint32_t hi
, uint32_t lo
, uint8_t longFMT
); // Clone an ioProx card to T5557/T5567
154 void SimulateTagLowFrequencyBidir(int divisor
, int max_bitlen
);
155 void CopyHIDtoT55x7(uint32_t hi2
, uint32_t hi
, uint32_t lo
, uint8_t longFMT
); // Clone an HID card to T5557/T5567
156 void WriteEM410x(uint32_t card
, uint32_t id_hi
, uint32_t id_lo
);
157 void CopyIndala64toT55x7(int hi
, int lo
); // Clone Indala 64-bit tag by UID to T55x7
158 void CopyIndala224toT55x7(int uid1
, int uid2
, int uid3
, int uid4
, int uid5
, int uid6
, int uid7
); // Clone Indala 224-bit tag by UID to T55x7
159 void T55xxWriteBlock(uint32_t Data
, uint32_t Block
, uint32_t Pwd
, uint8_t PwdMode
);
160 void T55xxReadBlock(uint32_t Block
, uint32_t Pwd
, uint8_t PwdMode
);
161 void T55xxReadTrace(void);
163 int DemodPCF7931(uint8_t **outBlocks
);
164 int IsBlock0PCF7931(uint8_t *Block
);
165 int IsBlock1PCF7931(uint8_t *Block
);
167 void EM4xReadWord(uint8_t Address
, uint32_t Pwd
, uint8_t PwdMode
);
168 void EM4xWriteWord(uint32_t Data
, uint8_t Address
, uint32_t Pwd
, uint8_t PwdMode
);
171 void SimulateIso14443Tag(void);
172 void AcquireRawAdcSamplesIso14443(uint32_t parameter
);
173 void ReadSTMemoryIso14443(uint32_t);
174 void RAMFUNC
SnoopIso14443(void);
175 void SendRawCommand14443B(uint32_t, uint32_t, uint8_t, uint8_t[]);
178 void RAMFUNC
SnoopIso14443a(uint8_t param
);
179 void SimulateIso14443aTag(int tagType
, int uid_1st
, int uid_2nd
, byte_t
* data
);
180 void ReaderIso14443a(UsbCommand
* c
);
181 // Also used in iclass.c
182 bool RAMFUNC
LogTrace(const uint8_t *btBytes
, uint16_t len
, uint32_t timestamp_start
, uint32_t timestamp_end
, uint8_t *parity
, bool readerToTag
);
183 void GetParity(const uint8_t * pbtCmd
, uint16_t len
, uint8_t *parity
);
184 void iso14a_set_trigger(bool enable
);
185 void iso14a_clear_trace();
186 void iso14a_set_tracing(bool enable
);
187 void RAMFUNC
SniffMifare(uint8_t param
);
190 void EPA_PACE_Collect_Nonce(UsbCommand
* c
);
193 void ReaderMifare(bool first_try
);
194 int32_t dist_nt(uint32_t nt1
, uint32_t nt2
);
195 void MifareReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *data
);
196 void MifareUReadBlock(uint8_t arg0
,uint8_t *datain
);
197 void MifareUC_Auth1(uint8_t arg0
, uint8_t *datain
);
198 void MifareUC_Auth2(uint32_t arg0
, uint8_t *datain
);
199 void MifareUReadCard(uint8_t arg0
, int Pages
, uint8_t *datain
);
200 void MifareReadSector(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
);
201 void MifareWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
);
202 void MifareUWriteBlock(uint8_t arg0
,uint8_t *datain
);
203 void MifareUWriteBlock_Special(uint8_t arg0
,uint8_t *datain
);
204 void MifareNested(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
205 void MifareChkKeys(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
);
206 void Mifare1ksim(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
);
207 void MifareSetDbgLvl(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
208 void MifareEMemClr(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
209 void MifareEMemSet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
210 void MifareEMemGet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
211 void MifareECardLoad(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
212 void MifareCSetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); // Work with "magic Chinese" card
213 void MifareCGetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
216 bool InitDesfireCard();
217 void MifareSendCommand(uint8_t arg0
,uint8_t arg1
, uint8_t *datain
);
218 void MifareDesfireGetInformation();
219 void MifareDES_Auth1(uint8_t arg0
,uint8_t arg1
,uint8_t arg2
, uint8_t *datain
);
220 void ReaderMifareDES(uint32_t param
, uint32_t param2
, uint8_t * datain
);
221 int DesfireAPDU(uint8_t *cmd
, size_t cmd_len
, uint8_t *dataout
);
222 size_t CreateAPDU( uint8_t *datain
, size_t len
, uint8_t *dataout
);
229 void *mifare_cryto_preprocess_data (desfiretag_t tag
, void *data
, size_t *nbytes
, off_t offset
, int communication_settings
);
230 void *mifare_cryto_postprocess_data (desfiretag_t tag
, void *data
, ssize_t
*nbytes
, int communication_settings
);
231 void mifare_cypher_single_block (desfirekey_t key
, uint8_t *data
, uint8_t *ivect
, MifareCryptoDirection direction
, MifareCryptoOperation operation
, size_t block_size
);
232 void mifare_cypher_blocks_chained (desfiretag_t tag
, desfirekey_t key
, uint8_t *ivect
, uint8_t *data
, size_t data_size
, MifareCryptoDirection direction
, MifareCryptoOperation operation
);
233 size_t key_block_size (const desfirekey_t key
);
234 size_t padded_data_length (const size_t nbytes
, const size_t block_size
);
235 size_t maced_data_length (const desfirekey_t key
, const size_t nbytes
);
236 size_t enciphered_data_length (const desfiretag_t tag
, const size_t nbytes
, int communication_settings
);
237 void cmac_generate_subkeys (desfirekey_t key
);
238 void cmac (const desfirekey_t key
, uint8_t *ivect
, const uint8_t *data
, size_t len
, uint8_t *cmac
);
242 void RecordRawAdcSamplesIso15693(void);
243 void AcquireRawAdcSamplesIso15693(void);
244 void ReaderIso15693(uint32_t parameter
); // Simulate an ISO15693 reader - greg
245 void SimTagIso15693(uint32_t parameter
, uint8_t *uid
); // simulate an ISO15693 tag - greg
246 void BruteforceIso15693Afi(uint32_t speed
); // find an AFI of a tag - atrox
247 void DirectTag15693Command(uint32_t datalen
,uint32_t speed
, uint32_t recv
, uint8_t data
[]); // send arbitrary commands from CLI - atrox
248 void SetDebugIso15693(uint32_t flag
);
251 void RAMFUNC
SnoopIClass(void);
252 void SimulateIClass(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);
253 void ReaderIClass(uint8_t arg0
);
254 void ReaderIClass_Replay(uint8_t arg0
,uint8_t *MAC
);
255 void IClass_iso14443A_GetPublic(uint8_t arg0
);
258 void SnoopHitag(uint32_t type
);
259 void SimulateHitagTag(bool tag_mem_supplied
, byte_t
* data
);
260 void ReaderHitag(hitag_function htf
, hitag_data
* htd
);
263 bool cmd_receive(UsbCommand
* cmd
);
264 bool cmd_send(uint32_t cmd
, uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, void* data
, size_t len
);