]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


4411a0c54915778a9a29bd1dc3e2245079773c83
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "util.h"
20 #include "printf.h"
21 #include "string.h"
22 #include "legicrf.h"
23 #include "hitag2.h"
24 #include "hitagS.h"
25 #include "lfsampling.h"
26 #include "BigBuf.h"
27 #include "mifareutil.h"
28 #include "pcf7931.h"
29 #ifdef WITH_LCD
30 #include "LCD.h"
31 #endif
32
33 // Craig Young - 14a stand-alone code
34 #ifdef WITH_ISO14443a_StandAlone
35 #include "iso14443a.h"
36 #endif
37
38 //=============================================================================
39 // A buffer where we can queue things up to be sent through the FPGA, for
40 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
41 // is the order in which they go out on the wire.
42 //=============================================================================
43
44 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
45 uint8_t ToSend[TOSEND_BUFFER_SIZE];
46 int ToSendMax;
47 static int ToSendBit;
48 struct common_area common_area __attribute__((section(".commonarea")));
49
50 void ToSendReset(void)
51 {
52 ToSendMax = -1;
53 ToSendBit = 8;
54 }
55
56 void ToSendStuffBit(int b)
57 {
58 if(ToSendBit >= 8) {
59 ToSendMax++;
60 ToSend[ToSendMax] = 0;
61 ToSendBit = 0;
62 }
63
64 if(b) {
65 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
66 }
67
68 ToSendBit++;
69
70 if(ToSendMax >= sizeof(ToSend)) {
71 ToSendBit = 0;
72 DbpString("ToSendStuffBit overflowed!");
73 }
74 }
75
76 //=============================================================================
77 // Debug print functions, to go out over USB, to the usual PC-side client.
78 //=============================================================================
79
80 void DbpString(char *str)
81 {
82 byte_t len = strlen(str);
83 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
84 }
85
86 #if 0
87 void DbpIntegers(int x1, int x2, int x3)
88 {
89 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
90 }
91 #endif
92
93 void Dbprintf(const char *fmt, ...) {
94 // should probably limit size here; oh well, let's just use a big buffer
95 char output_string[128];
96 va_list ap;
97
98 va_start(ap, fmt);
99 kvsprintf(fmt, output_string, 10, ap);
100 va_end(ap);
101
102 DbpString(output_string);
103 }
104
105 // prints HEX & ASCII
106 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
107 int l=0,i;
108 char ascii[9];
109
110 while (len>0) {
111 if (len>8) l=8;
112 else l=len;
113
114 memcpy(ascii,d,l);
115 ascii[l]=0;
116
117 // filter safe ascii
118 for (i=0;i<l;i++)
119 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
120
121 if (bAsci) {
122 Dbprintf("%-8s %*D",ascii,l,d," ");
123 } else {
124 Dbprintf("%*D",l,d," ");
125 }
126
127 len-=8;
128 d+=8;
129 }
130 }
131
132 //-----------------------------------------------------------------------------
133 // Read an ADC channel and block till it completes, then return the result
134 // in ADC units (0 to 1023). Also a routine to average 32 samples and
135 // return that.
136 //-----------------------------------------------------------------------------
137 static int ReadAdc(int ch)
138 {
139 uint32_t d;
140
141 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
142 AT91C_BASE_ADC->ADC_MR =
143 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
144 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
145 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
146
147 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
148 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
149 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
150 //
151 // The maths are:
152 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
153 //
154 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
155 //
156 // Note: with the "historic" values in the comments above, the error was 34% !!!
157
158 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
159
160 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
161
162 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
163 ;
164 d = AT91C_BASE_ADC->ADC_CDR[ch];
165
166 return d;
167 }
168
169 int AvgAdc(int ch) // was static - merlok
170 {
171 int i;
172 int a = 0;
173
174 for(i = 0; i < 32; i++) {
175 a += ReadAdc(ch);
176 }
177
178 return (a + 15) >> 5;
179 }
180
181 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
182 {
183 int i, adcval = 0, peak = 0;
184
185 /*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
193
194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
196 for (i=255; i>=19; i--) {
197 WDT_HIT();
198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
201 if (i==95) *vLf125 = adcval; // voltage at 125Khz
202 if (i==89) *vLf134 = adcval; // voltage at 134Khz
203
204 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
205 if(LF_Results[i] > peak) {
206 *peakv = adcval;
207 peak = LF_Results[i];
208 *peakf = i;
209 //ptr = i;
210 }
211 }
212
213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
214
215 return;
216 }
217
218 void MeasureAntennaTuningHfOnly(int *vHf)
219 {
220 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
221 LED_A_ON();
222 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
223 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
224 SpinDelay(20);
225 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
226 LED_A_OFF();
227
228 return;
229 }
230
231 void MeasureAntennaTuning(int mode)
232 {
233 uint8_t LF_Results[256] = {0};
234 int peakv = 0, peakf = 0;
235 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
236
237 LED_B_ON();
238
239 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
240 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
241 MeasureAntennaTuningHfOnly(&vHf);
242 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
243 } else {
244 if (mode & FLAG_TUNE_LF) {
245 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
246 }
247 if (mode & FLAG_TUNE_HF) {
248 MeasureAntennaTuningHfOnly(&vHf);
249 }
250 }
251
252 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
253 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
254 LED_B_OFF();
255 return;
256 }
257
258 void MeasureAntennaTuningHf(void)
259 {
260 int vHf = 0; // in mV
261
262 DbpString("Measuring HF antenna, press button to exit");
263
264 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
265 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
266 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
267
268 for (;;) {
269 SpinDelay(20);
270 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
271
272 Dbprintf("%d mV",vHf);
273 if (BUTTON_PRESS()) break;
274 }
275 DbpString("cancelled");
276
277 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
278
279 }
280
281
282 void ReadMem(int addr)
283 {
284 const uint8_t *data = ((uint8_t *)addr);
285
286 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
287 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
288 }
289
290 /* osimage version information is linked in */
291 extern struct version_information version_information;
292 /* bootrom version information is pointed to from _bootphase1_version_pointer */
293 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
294 void SendVersion(void)
295 {
296 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
297 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
298
299 /* Try to find the bootrom version information. Expect to find a pointer at
300 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
301 * pointer, then use it.
302 */
303 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
304 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
305 strcat(VersionString, "bootrom version information appears invalid\n");
306 } else {
307 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
308 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
309 }
310
311 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
312 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
313
314 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
315 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
316 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
317 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
318
319 // Send Chip ID and used flash memory
320 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
321 uint32_t compressed_data_section_size = common_area.arg1;
322 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
323 }
324
325 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
326 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
327 void printUSBSpeed(void)
328 {
329 Dbprintf("USB Speed:");
330 Dbprintf(" Sending USB packets to client...");
331
332 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
333 uint8_t *test_data = BigBuf_get_addr();
334 uint32_t end_time;
335
336 uint32_t start_time = end_time = GetTickCount();
337 uint32_t bytes_transferred = 0;
338
339 LED_B_ON();
340 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
341 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
342 end_time = GetTickCount();
343 bytes_transferred += USB_CMD_DATA_SIZE;
344 }
345 LED_B_OFF();
346
347 Dbprintf(" Time elapsed: %dms", end_time - start_time);
348 Dbprintf(" Bytes transferred: %d", bytes_transferred);
349 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
350 1000 * bytes_transferred / (end_time - start_time));
351
352 }
353
354 /**
355 * Prints runtime information about the PM3.
356 **/
357 void SendStatus(void)
358 {
359 BigBuf_print_status();
360 Fpga_print_status();
361 printConfig(); //LF Sampling config
362 printUSBSpeed();
363 Dbprintf("Various");
364 Dbprintf(" MF_DBGLEVEL......%d", MF_DBGLEVEL);
365 Dbprintf(" ToSendMax........%d",ToSendMax);
366 Dbprintf(" ToSendBit........%d",ToSendBit);
367
368 cmd_send(CMD_ACK,1,0,0,0,0);
369 }
370
371 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
372
373 #define OPTS 2
374
375 void StandAloneMode()
376 {
377 DbpString("Stand-alone mode! No PC necessary.");
378 // Oooh pretty -- notify user we're in elite samy mode now
379 LED(LED_RED, 200);
380 LED(LED_ORANGE, 200);
381 LED(LED_GREEN, 200);
382 LED(LED_ORANGE, 200);
383 LED(LED_RED, 200);
384 LED(LED_ORANGE, 200);
385 LED(LED_GREEN, 200);
386 LED(LED_ORANGE, 200);
387 LED(LED_RED, 200);
388
389 }
390
391 #endif
392
393
394
395 #ifdef WITH_ISO14443a_StandAlone
396 void StandAloneMode14a()
397 {
398 StandAloneMode();
399 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
400
401 int selected = 0;
402 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
403 int cardRead[OPTS] = {0};
404 uint8_t readUID[10] = {0};
405 uint32_t uid_1st[OPTS]={0};
406 uint32_t uid_2nd[OPTS]={0};
407 uint32_t uid_tmp1 = 0;
408 uint32_t uid_tmp2 = 0;
409 iso14a_card_select_t hi14a_card[OPTS];
410
411 LED(selected + 1, 0);
412
413 for (;;)
414 {
415 usb_poll();
416 WDT_HIT();
417 SpinDelay(300);
418
419 if (iGotoRecord == 1 || cardRead[selected] == 0)
420 {
421 iGotoRecord = 0;
422 LEDsoff();
423 LED(selected + 1, 0);
424 LED(LED_RED2, 0);
425
426 // record
427 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
428 /* need this delay to prevent catching some weird data */
429 SpinDelay(500);
430 /* Code for reading from 14a tag */
431 uint8_t uid[10] ={0};
432 uint32_t cuid;
433 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
434
435 for ( ; ; )
436 {
437 WDT_HIT();
438 if (BUTTON_PRESS()) {
439 if (cardRead[selected]) {
440 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
441 break;
442 }
443 else if (cardRead[(selected+1)%OPTS]) {
444 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
445 selected = (selected+1)%OPTS;
446 break; // playing = 1;
447 }
448 else {
449 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
450 SpinDelay(300);
451 }
452 }
453 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
454 continue;
455 else
456 {
457 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
458 memcpy(readUID,uid,10*sizeof(uint8_t));
459 uint8_t *dst = (uint8_t *)&uid_tmp1;
460 // Set UID byte order
461 for (int i=0; i<4; i++)
462 dst[i] = uid[3-i];
463 dst = (uint8_t *)&uid_tmp2;
464 for (int i=0; i<4; i++)
465 dst[i] = uid[7-i];
466 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
467 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
468 }
469 else {
470 if (uid_tmp2) {
471 Dbprintf("Bank[%d] received a 7-byte UID",selected);
472 uid_1st[selected] = (uid_tmp1)>>8;
473 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
474 }
475 else {
476 Dbprintf("Bank[%d] received a 4-byte UID",selected);
477 uid_1st[selected] = uid_tmp1;
478 uid_2nd[selected] = uid_tmp2;
479 }
480 break;
481 }
482 }
483 }
484 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
485 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
486 LEDsoff();
487 LED(LED_GREEN, 200);
488 LED(LED_ORANGE, 200);
489 LED(LED_GREEN, 200);
490 LED(LED_ORANGE, 200);
491
492 LEDsoff();
493 LED(selected + 1, 0);
494
495 // Next state is replay:
496 playing = 1;
497
498 cardRead[selected] = 1;
499 }
500 /* MF Classic UID clone */
501 else if (iGotoClone==1)
502 {
503 iGotoClone=0;
504 LEDsoff();
505 LED(selected + 1, 0);
506 LED(LED_ORANGE, 250);
507
508
509 // record
510 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
511
512 // wait for button to be released
513 while(BUTTON_PRESS())
514 {
515 // Delay cloning until card is in place
516 WDT_HIT();
517 }
518 Dbprintf("Starting clone. [Bank: %u]", selected);
519 // need this delay to prevent catching some weird data
520 SpinDelay(500);
521 // Begin clone function here:
522 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
523 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
524 memcpy(c.d.asBytes, data, 16);
525 SendCommand(&c);
526
527 Block read is similar:
528 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
529 We need to imitate that call with blockNo 0 to set a uid.
530
531 The get and set commands are handled in this file:
532 // Work with "magic Chinese" card
533 case CMD_MIFARE_CSETBLOCK:
534 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
535 break;
536 case CMD_MIFARE_CGETBLOCK:
537 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
538 break;
539
540 mfCSetUID provides example logic for UID set workflow:
541 -Read block0 from card in field with MifareCGetBlock()
542 -Configure new values without replacing reserved bytes
543 memcpy(block0, uid, 4); // Copy UID bytes from byte array
544 // Mifare UID BCC
545 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
546 Bytes 5-7 are reserved SAK and ATQA for mifare classic
547 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
548 */
549 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
550 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
551 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
552 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
553 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
554 playing = 1;
555 }
556 else {
557 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
558 memcpy(newBlock0,oldBlock0,16);
559 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
560
561 newBlock0[0] = uid_1st[selected]>>24;
562 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
563 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
564 newBlock0[3] = 0xFF & (uid_1st[selected]);
565 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
566 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
567 MifareCSetBlock(0, 0xFF,0, newBlock0);
568 MifareCGetBlock(0x3F, 1, 0, testBlock0);
569 if (memcmp(testBlock0,newBlock0,16)==0)
570 {
571 DbpString("Cloned successfull!");
572 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
573 playing = 0;
574 iGotoRecord = 1;
575 selected = (selected+1) % OPTS;
576 }
577 else {
578 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
579 playing = 1;
580 }
581 }
582 LEDsoff();
583 LED(selected + 1, 0);
584
585 }
586 // Change where to record (or begin playing)
587 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
588 {
589 LEDsoff();
590 LED(selected + 1, 0);
591
592 // Begin transmitting
593 if (playing)
594 {
595 LED(LED_GREEN, 0);
596 DbpString("Playing");
597 for ( ; ; ) {
598 WDT_HIT();
599 int button_action = BUTTON_HELD(1000);
600 if (button_action == 0) { // No button action, proceed with sim
601 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
602 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
603 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
604 DbpString("Mifare Classic");
605 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
606 }
607 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
608 DbpString("Mifare Ultralight");
609 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
610 }
611 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
612 DbpString("Mifare DESFire");
613 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
614 }
615 else {
616 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
617 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
618 }
619 }
620 else if (button_action == BUTTON_SINGLE_CLICK) {
621 selected = (selected + 1) % OPTS;
622 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
623 iGotoRecord = 1;
624 break;
625 }
626 else if (button_action == BUTTON_HOLD) {
627 Dbprintf("Playtime over. Begin cloning...");
628 iGotoClone = 1;
629 break;
630 }
631 WDT_HIT();
632 }
633
634 /* We pressed a button so ignore it here with a delay */
635 SpinDelay(300);
636 LEDsoff();
637 LED(selected + 1, 0);
638 }
639 else
640 while(BUTTON_PRESS())
641 WDT_HIT();
642 }
643 }
644 }
645 #elif WITH_LF
646 // samy's sniff and repeat routine
647 void SamyRun()
648 {
649 StandAloneMode();
650 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
651
652 int high[OPTS], low[OPTS];
653 int selected = 0;
654 int playing = 0;
655 int cardRead = 0;
656
657 // Turn on selected LED
658 LED(selected + 1, 0);
659
660 for (;;)
661 {
662 usb_poll();
663 WDT_HIT();
664
665 // Was our button held down or pressed?
666 int button_pressed = BUTTON_HELD(1000);
667 SpinDelay(300);
668
669 // Button was held for a second, begin recording
670 if (button_pressed > 0 && cardRead == 0)
671 {
672 LEDsoff();
673 LED(selected + 1, 0);
674 LED(LED_RED2, 0);
675
676 // record
677 DbpString("Starting recording");
678
679 // wait for button to be released
680 while(BUTTON_PRESS())
681 WDT_HIT();
682
683 /* need this delay to prevent catching some weird data */
684 SpinDelay(500);
685
686 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
687 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
688
689 LEDsoff();
690 LED(selected + 1, 0);
691 // Finished recording
692
693 // If we were previously playing, set playing off
694 // so next button push begins playing what we recorded
695 playing = 0;
696
697 cardRead = 1;
698
699 }
700
701 else if (button_pressed > 0 && cardRead == 1)
702 {
703 LEDsoff();
704 LED(selected + 1, 0);
705 LED(LED_ORANGE, 0);
706
707 // record
708 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
709
710 // wait for button to be released
711 while(BUTTON_PRESS())
712 WDT_HIT();
713
714 /* need this delay to prevent catching some weird data */
715 SpinDelay(500);
716
717 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
718 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
719
720 LEDsoff();
721 LED(selected + 1, 0);
722 // Finished recording
723
724 // If we were previously playing, set playing off
725 // so next button push begins playing what we recorded
726 playing = 0;
727
728 cardRead = 0;
729
730 }
731
732 // Change where to record (or begin playing)
733 else if (button_pressed)
734 {
735 // Next option if we were previously playing
736 if (playing)
737 selected = (selected + 1) % OPTS;
738 playing = !playing;
739
740 LEDsoff();
741 LED(selected + 1, 0);
742
743 // Begin transmitting
744 if (playing)
745 {
746 LED(LED_GREEN, 0);
747 DbpString("Playing");
748 // wait for button to be released
749 while(BUTTON_PRESS())
750 WDT_HIT();
751 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
752 CmdHIDsimTAG(high[selected], low[selected], 0);
753 DbpString("Done playing");
754 if (BUTTON_HELD(1000) > 0)
755 {
756 DbpString("Exiting");
757 LEDsoff();
758 return;
759 }
760
761 /* We pressed a button so ignore it here with a delay */
762 SpinDelay(300);
763
764 // when done, we're done playing, move to next option
765 selected = (selected + 1) % OPTS;
766 playing = !playing;
767 LEDsoff();
768 LED(selected + 1, 0);
769 }
770 else
771 while(BUTTON_PRESS())
772 WDT_HIT();
773 }
774 }
775 }
776
777 #endif
778 /*
779 OBJECTIVE
780 Listen and detect an external reader. Determine the best location
781 for the antenna.
782
783 INSTRUCTIONS:
784 Inside the ListenReaderField() function, there is two mode.
785 By default, when you call the function, you will enter mode 1.
786 If you press the PM3 button one time, you will enter mode 2.
787 If you press the PM3 button a second time, you will exit the function.
788
789 DESCRIPTION OF MODE 1:
790 This mode just listens for an external reader field and lights up green
791 for HF and/or red for LF. This is the original mode of the detectreader
792 function.
793
794 DESCRIPTION OF MODE 2:
795 This mode will visually represent, using the LEDs, the actual strength of the
796 current compared to the maximum current detected. Basically, once you know
797 what kind of external reader is present, it will help you spot the best location to place
798 your antenna. You will probably not get some good results if there is a LF and a HF reader
799 at the same place! :-)
800
801 LIGHT SCHEME USED:
802 */
803 static const char LIGHT_SCHEME[] = {
804 0x0, /* ---- | No field detected */
805 0x1, /* X--- | 14% of maximum current detected */
806 0x2, /* -X-- | 29% of maximum current detected */
807 0x4, /* --X- | 43% of maximum current detected */
808 0x8, /* ---X | 57% of maximum current detected */
809 0xC, /* --XX | 71% of maximum current detected */
810 0xE, /* -XXX | 86% of maximum current detected */
811 0xF, /* XXXX | 100% of maximum current detected */
812 };
813 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
814
815 void ListenReaderField(int limit)
816 {
817 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
818 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
819 int mode=1, display_val, display_max, i;
820
821 #define LF_ONLY 1
822 #define HF_ONLY 2
823 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
824
825
826 // switch off FPGA - we don't want to measure our own signal
827 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
828 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
829
830 LEDsoff();
831
832 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
833
834 if(limit != HF_ONLY) {
835 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
836 lf_baseline = lf_av;
837 }
838
839 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
840
841 if (limit != LF_ONLY) {
842 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
843 hf_baseline = hf_av;
844 }
845
846 for(;;) {
847 if (BUTTON_PRESS()) {
848 SpinDelay(500);
849 switch (mode) {
850 case 1:
851 mode=2;
852 DbpString("Signal Strength Mode");
853 break;
854 case 2:
855 default:
856 DbpString("Stopped");
857 LEDsoff();
858 return;
859 break;
860 }
861 }
862 WDT_HIT();
863
864 if (limit != HF_ONLY) {
865 if(mode == 1) {
866 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
867 LED_D_ON();
868 else
869 LED_D_OFF();
870 }
871
872 lf_av_new = AvgAdc(ADC_CHAN_LF);
873 // see if there's a significant change
874 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
875 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
876 lf_av = lf_av_new;
877 if (lf_av > lf_max)
878 lf_max = lf_av;
879 }
880 }
881
882 if (limit != LF_ONLY) {
883 if (mode == 1){
884 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
885 LED_B_ON();
886 else
887 LED_B_OFF();
888 }
889
890 hf_av_new = AvgAdc(ADC_CHAN_HF);
891 // see if there's a significant change
892 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
893 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
894 hf_av = hf_av_new;
895 if (hf_av > hf_max)
896 hf_max = hf_av;
897 }
898 }
899
900 if(mode == 2) {
901 if (limit == LF_ONLY) {
902 display_val = lf_av;
903 display_max = lf_max;
904 } else if (limit == HF_ONLY) {
905 display_val = hf_av;
906 display_max = hf_max;
907 } else { /* Pick one at random */
908 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
909 display_val = hf_av;
910 display_max = hf_max;
911 } else {
912 display_val = lf_av;
913 display_max = lf_max;
914 }
915 }
916 for (i=0; i<LIGHT_LEN; i++) {
917 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
918 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
919 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
920 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
921 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
922 break;
923 }
924 }
925 }
926 }
927 }
928
929 void UsbPacketReceived(uint8_t *packet, int len)
930 {
931 UsbCommand *c = (UsbCommand *)packet;
932
933 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
934
935 switch(c->cmd) {
936 #ifdef WITH_LF
937 case CMD_SET_LF_SAMPLING_CONFIG:
938 setSamplingConfig((sample_config *) c->d.asBytes);
939 break;
940 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
941 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
942 break;
943 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
944 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
945 break;
946 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
947 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
948 break;
949 case CMD_HID_DEMOD_FSK:
950 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
951 break;
952 case CMD_HID_SIM_TAG:
953 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
954 break;
955 case CMD_FSK_SIM_TAG:
956 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
957 break;
958 case CMD_ASK_SIM_TAG:
959 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
960 break;
961 case CMD_PSK_SIM_TAG:
962 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
963 break;
964 case CMD_HID_CLONE_TAG:
965 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
966 break;
967 case CMD_IO_DEMOD_FSK:
968 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
969 break;
970 case CMD_IO_CLONE_TAG:
971 CopyIOtoT55x7(c->arg[0], c->arg[1]);
972 break;
973 case CMD_EM410X_DEMOD:
974 CmdEM410xdemod(c->arg[0], 0, 0, 1);
975 break;
976 case CMD_EM410X_WRITE_TAG:
977 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
978 break;
979 case CMD_READ_TI_TYPE:
980 ReadTItag();
981 break;
982 case CMD_WRITE_TI_TYPE:
983 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
984 break;
985 case CMD_SIMULATE_TAG_125K:
986 LED_A_ON();
987 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
988 LED_A_OFF();
989 break;
990 case CMD_LF_SIMULATE_BIDIR:
991 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
992 break;
993 case CMD_INDALA_CLONE_TAG:
994 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
995 break;
996 case CMD_INDALA_CLONE_TAG_L:
997 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
998 break;
999 case CMD_T55XX_READ_BLOCK:
1000 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1001 break;
1002 case CMD_T55XX_WRITE_BLOCK:
1003 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1004 break;
1005 case CMD_T55XX_WAKEUP:
1006 T55xxWakeUp(c->arg[0]);
1007 break;
1008 case CMD_T55XX_RESET_READ:
1009 T55xxResetRead();
1010 break;
1011 case CMD_PCF7931_READ:
1012 ReadPCF7931();
1013 break;
1014 case CMD_PCF7931_WRITE:
1015 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1016 break;
1017 case CMD_EM4X_READ_WORD:
1018 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1019 break;
1020 case CMD_EM4X_WRITE_WORD:
1021 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1022 break;
1023 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1024 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1025 break;
1026 case CMD_VIKING_CLONE_TAG:
1027 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1028 break;
1029 case CMD_COTAG:
1030 Cotag(c->arg[0]);
1031 break;
1032 #endif
1033
1034 #ifdef WITH_HITAG
1035 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1036 SnoopHitag(c->arg[0]);
1037 break;
1038 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1039 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1040 break;
1041 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1042 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1043 break;
1044 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1045 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1046 break;
1047 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1048 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1049 break;
1050 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1051 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1052 break;
1053 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1054 if ((hitag_function)c->arg[0] < 10) {
1055 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1056 }
1057 else if ((hitag_function)c->arg[0] >= 10) {
1058 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1059 }
1060 break;
1061 #endif
1062
1063 #ifdef WITH_ISO15693
1064 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1065 AcquireRawAdcSamplesIso15693();
1066 break;
1067 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1068 RecordRawAdcSamplesIso15693();
1069 break;
1070
1071 case CMD_ISO_15693_COMMAND:
1072 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1073 break;
1074
1075 case CMD_ISO_15693_FIND_AFI:
1076 BruteforceIso15693Afi(c->arg[0]);
1077 break;
1078
1079 case CMD_ISO_15693_DEBUG:
1080 SetDebugIso15693(c->arg[0]);
1081 break;
1082
1083 case CMD_READER_ISO_15693:
1084 ReaderIso15693(c->arg[0]);
1085 break;
1086 case CMD_SIMTAG_ISO_15693:
1087 SimTagIso15693(c->arg[0], c->d.asBytes);
1088 break;
1089 #endif
1090
1091 #ifdef WITH_LEGICRF
1092 case CMD_SIMULATE_TAG_LEGIC_RF:
1093 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1094 break;
1095
1096 case CMD_WRITER_LEGIC_RF:
1097 LegicRfWriter(c->arg[1], c->arg[0]);
1098 break;
1099
1100 case CMD_READER_LEGIC_RF:
1101 LegicRfReader(c->arg[0], c->arg[1]);
1102 break;
1103 #endif
1104
1105 #ifdef WITH_ISO14443b
1106 case CMD_READ_SRI512_TAG:
1107 ReadSTMemoryIso14443b(0x0F);
1108 break;
1109 case CMD_READ_SRIX4K_TAG:
1110 ReadSTMemoryIso14443b(0x7F);
1111 break;
1112 case CMD_SNOOP_ISO_14443B:
1113 SnoopIso14443b();
1114 break;
1115 case CMD_SIMULATE_TAG_ISO_14443B:
1116 SimulateIso14443bTag();
1117 break;
1118 case CMD_ISO_14443B_COMMAND:
1119 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1120 break;
1121 #endif
1122
1123 #ifdef WITH_ISO14443a
1124 case CMD_SNOOP_ISO_14443a:
1125 SnoopIso14443a(c->arg[0]);
1126 break;
1127 case CMD_READER_ISO_14443a:
1128 ReaderIso14443a(c);
1129 break;
1130 case CMD_SIMULATE_TAG_ISO_14443a:
1131 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1132 break;
1133
1134 case CMD_EPA_PACE_COLLECT_NONCE:
1135 EPA_PACE_Collect_Nonce(c);
1136 break;
1137 case CMD_EPA_PACE_REPLAY:
1138 EPA_PACE_Replay(c);
1139 break;
1140
1141 case CMD_READER_MIFARE:
1142 ReaderMifare(c->arg[0]);
1143 break;
1144 case CMD_MIFARE_READBL:
1145 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1146 break;
1147 case CMD_MIFAREU_READBL:
1148 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1149 break;
1150 case CMD_MIFAREUC_AUTH:
1151 MifareUC_Auth(c->arg[0],c->d.asBytes);
1152 break;
1153 case CMD_MIFAREU_READCARD:
1154 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156 case CMD_MIFAREUC_SETPWD:
1157 MifareUSetPwd(c->arg[0], c->d.asBytes);
1158 break;
1159 case CMD_MIFARE_READSC:
1160 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1161 break;
1162 case CMD_MIFARE_WRITEBL:
1163 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1164 break;
1165 //case CMD_MIFAREU_WRITEBL_COMPAT:
1166 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1167 //break;
1168 case CMD_MIFAREU_WRITEBL:
1169 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1170 break;
1171 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1172 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1173 break;
1174 case CMD_MIFARE_NESTED:
1175 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1176 break;
1177 case CMD_MIFARE_CHKKEYS:
1178 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1179 break;
1180 case CMD_SIMULATE_MIFARE_CARD:
1181 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1182 break;
1183
1184 // emulator
1185 case CMD_MIFARE_SET_DBGMODE:
1186 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1187 break;
1188 case CMD_MIFARE_EML_MEMCLR:
1189 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1190 break;
1191 case CMD_MIFARE_EML_MEMSET:
1192 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1193 break;
1194 case CMD_MIFARE_EML_MEMGET:
1195 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1196 break;
1197 case CMD_MIFARE_EML_CARDLOAD:
1198 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1199 break;
1200
1201 // Work with "magic Chinese" card
1202 case CMD_MIFARE_CSETBLOCK:
1203 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1204 break;
1205 case CMD_MIFARE_CGETBLOCK:
1206 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1207 break;
1208 case CMD_MIFARE_CIDENT:
1209 MifareCIdent();
1210 break;
1211
1212 // mifare sniffer
1213 case CMD_MIFARE_SNIFFER:
1214 SniffMifare(c->arg[0]);
1215 break;
1216
1217 #endif
1218
1219 #ifdef WITH_ICLASS
1220 // Makes use of ISO14443a FPGA Firmware
1221 case CMD_SNOOP_ICLASS:
1222 SnoopIClass();
1223 break;
1224 case CMD_SIMULATE_TAG_ICLASS:
1225 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1226 break;
1227 case CMD_READER_ICLASS:
1228 ReaderIClass(c->arg[0]);
1229 break;
1230 case CMD_READER_ICLASS_REPLAY:
1231 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1232 break;
1233 case CMD_ICLASS_EML_MEMSET:
1234 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1235 break;
1236 case CMD_ICLASS_WRITEBLOCK:
1237 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1238 break;
1239 case CMD_ICLASS_READCHECK: // auth step 1
1240 iClass_ReadCheck(c->arg[0], c->arg[1]);
1241 break;
1242 case CMD_ICLASS_READBLOCK:
1243 iClass_ReadBlk(c->arg[0]);
1244 break;
1245 case CMD_ICLASS_AUTHENTICATION: //check
1246 iClass_Authentication(c->d.asBytes);
1247 break;
1248 case CMD_ICLASS_DUMP:
1249 iClass_Dump(c->arg[0], c->arg[1]);
1250 break;
1251 case CMD_ICLASS_CLONE:
1252 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1253 break;
1254 #endif
1255 #ifdef WITH_HFSNOOP
1256 case CMD_HF_SNIFFER:
1257 HfSnoop(c->arg[0], c->arg[1]);
1258 break;
1259 #endif
1260
1261 case CMD_BUFF_CLEAR:
1262 BigBuf_Clear();
1263 break;
1264
1265 case CMD_MEASURE_ANTENNA_TUNING:
1266 MeasureAntennaTuning(c->arg[0]);
1267 break;
1268
1269 case CMD_MEASURE_ANTENNA_TUNING_HF:
1270 MeasureAntennaTuningHf();
1271 break;
1272
1273 case CMD_LISTEN_READER_FIELD:
1274 ListenReaderField(c->arg[0]);
1275 break;
1276
1277 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1278 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1279 SpinDelay(200);
1280 LED_D_OFF(); // LED D indicates field ON or OFF
1281 break;
1282
1283 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1284
1285 LED_B_ON();
1286 uint8_t *BigBuf = BigBuf_get_addr();
1287 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1288 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1289 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1290 }
1291 // Trigger a finish downloading signal with an ACK frame
1292 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1293 LED_B_OFF();
1294 break;
1295
1296 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1297 uint8_t *b = BigBuf_get_addr();
1298 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1299 cmd_send(CMD_ACK,0,0,0,0,0);
1300 break;
1301 }
1302 case CMD_READ_MEM:
1303 ReadMem(c->arg[0]);
1304 break;
1305
1306 case CMD_SET_LF_DIVISOR:
1307 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1308 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1309 break;
1310
1311 case CMD_SET_ADC_MUX:
1312 switch(c->arg[0]) {
1313 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1314 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1315 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1316 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1317 }
1318 break;
1319
1320 case CMD_VERSION:
1321 SendVersion();
1322 break;
1323 case CMD_STATUS:
1324 SendStatus();
1325 break;
1326 case CMD_PING:
1327 cmd_send(CMD_ACK,0,0,0,0,0);
1328 break;
1329 #ifdef WITH_LCD
1330 case CMD_LCD_RESET:
1331 LCDReset();
1332 break;
1333 case CMD_LCD:
1334 LCDSend(c->arg[0]);
1335 break;
1336 #endif
1337 case CMD_SETUP_WRITE:
1338 case CMD_FINISH_WRITE:
1339 case CMD_HARDWARE_RESET:
1340 usb_disable();
1341 SpinDelay(1000);
1342 SpinDelay(1000);
1343 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1344 for(;;) {
1345 // We're going to reset, and the bootrom will take control.
1346 }
1347 break;
1348
1349 case CMD_START_FLASH:
1350 if(common_area.flags.bootrom_present) {
1351 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1352 }
1353 usb_disable();
1354 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1355 for(;;);
1356 break;
1357
1358 case CMD_DEVICE_INFO: {
1359 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1360 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1361 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1362 break;
1363 }
1364 default:
1365 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1366 break;
1367 }
1368 }
1369
1370 void __attribute__((noreturn)) AppMain(void)
1371 {
1372 SpinDelay(100);
1373 clear_trace();
1374 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1375 /* Initialize common area */
1376 memset(&common_area, 0, sizeof(common_area));
1377 common_area.magic = COMMON_AREA_MAGIC;
1378 common_area.version = 1;
1379 }
1380 common_area.flags.osimage_present = 1;
1381
1382 LED_D_OFF();
1383 LED_C_OFF();
1384 LED_B_OFF();
1385 LED_A_OFF();
1386
1387 // Init USB device
1388 usb_enable();
1389
1390 // The FPGA gets its clock from us from PCK0 output, so set that up.
1391 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1392 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1393 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1394 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1395 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1396 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1397 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1398
1399 // Reset SPI
1400 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1401 // Reset SSC
1402 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1403
1404 // Load the FPGA image, which we have stored in our flash.
1405 // (the HF version by default)
1406 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1407
1408 StartTickCount();
1409
1410 #ifdef WITH_LCD
1411 LCDInit();
1412 #endif
1413
1414 byte_t rx[sizeof(UsbCommand)];
1415 size_t rx_len;
1416
1417 for(;;) {
1418 if (usb_poll()) {
1419 rx_len = usb_read(rx,sizeof(UsbCommand));
1420 if (rx_len) {
1421 UsbPacketReceived(rx,rx_len);
1422 }
1423 }
1424 WDT_HIT();
1425
1426 #ifdef WITH_LF
1427 #ifndef WITH_ISO14443a_StandAlone
1428 if (BUTTON_HELD(1000) > 0)
1429 SamyRun();
1430 #endif
1431 #endif
1432 #ifdef WITH_ISO14443a
1433 #ifdef WITH_ISO14443a_StandAlone
1434 if (BUTTON_HELD(1000) > 0)
1435 StandAloneMode14a();
1436 #endif
1437 #endif
1438 }
1439 }
Proxmark3 GIT tracking
Impressum, Datenschutz