1 //----------------------------------------------------------------------------- 
   2 // Jonathan Westhues, Sept 2005 
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or, 
   5 // at your option, any later version. See the LICENSE.txt file for the text of 
   7 //----------------------------------------------------------------------------- 
   8 // Utility functions used in many places, not specific to any piece of code. 
   9 //----------------------------------------------------------------------------- 
  11 #include "proxmark3.h" 
  20 void print_result(char *name
, uint8_t *buf
, size_t len
) { 
  23    if ( len 
% 16 == 0 ) { 
  24            for(; p
-buf 
< len
; p 
+= 16) 
  25        Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x", 
  29                                 p
[0], p
[1], p
[2], p
[3], p
[4], p
[5], p
[6], p
[7],p
[8], p
[9], p
[10], p
[11], p
[12], p
[13], p
[14], p
[15] 
  33    for(; p
-buf 
< len
; p 
+= 8) 
  34        Dbprintf("[%s:%d/%d] %02x %02x %02x %02x %02x %02x %02x %02x", name
, p
-buf
, len
, p
[0], p
[1], p
[2], p
[3], p
[4], p
[5], p
[6], p
[7]); 
  38 size_t nbytes(size_t nbits
) { 
  39         return (nbits
/8)+((nbits%8
)>0); 
  42 uint32_t SwapBits(uint32_t value
, int nrbits
) { 
  44         uint32_t newvalue 
= 0; 
  45         for(i 
= 0; i 
< nrbits
; i
++) { 
  46                 newvalue 
^= ((value 
>> i
) & 1) << (nrbits 
- 1 - i
); 
  51 void num_to_bytes(uint64_t n
, size_t len
, uint8_t* dest
) 
  54                 dest
[len
] = (uint8_t) n
; 
  59 uint64_t bytes_to_num(uint8_t* src
, size_t len
) 
  64                 num 
= (num 
<< 8) | (*src
); 
  70 // RotateLeft - Ultralight, Desfire 
  71 void rol(uint8_t *data
, const size_t len
){ 
  72     uint8_t first 
= data
[0]; 
  73     for (size_t i 
= 0; i 
< len
-1; i
++) { 
  78 void lsl (uint8_t *data
, size_t len
) { 
  79     for (size_t n 
= 0; n 
< len 
- 1; n
++) { 
  80         data
[n
] = (data
[n
] << 1) | (data
[n
+1] >> 7); 
  85 int32_t le24toh (uint8_t data
[3]) 
  87     return (data
[2] << 16) | (data
[1] << 8) | data
[0]; 
  98 // LEDs: R(C) O(A) G(B) -- R(D) [1, 2, 4 and 8] 
  99 void LED(int led
, int ms
) 
 103         if (led 
& LED_ORANGE
) 
 117         if (led 
& LED_ORANGE
) 
 126 // Determine if a button is double clicked, single clicked, 
 127 // not clicked, or held down (for ms || 1sec) 
 128 // In general, don't use this function unless you expect a 
 129 // double click, otherwise it will waste 500ms -- use BUTTON_HELD instead 
 130 int BUTTON_CLICKED(int ms
) 
 132         // Up to 500ms in between clicks to mean a double click 
 133         int ticks 
= (48000 * (ms 
? ms 
: 1000)) >> 10; 
 135         // If we're not even pressed, forget about it! 
 137                 return BUTTON_NO_CLICK
; 
 139         // Borrow a PWM unit for my real-time clock 
 140         AT91C_BASE_PWMC
->PWMC_ENA 
= PWM_CHANNEL(0); 
 141         // 48 MHz / 1024 gives 46.875 kHz 
 142         AT91C_BASE_PWMC_CH0
->PWMC_CMR 
= PWM_CH_MODE_PRESCALER(10); 
 143         AT91C_BASE_PWMC_CH0
->PWMC_CDTYR 
= 0; 
 144         AT91C_BASE_PWMC_CH0
->PWMC_CPRDR 
= 0xffff; 
 146         uint16_t start 
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
; 
 151                 uint16_t now 
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
; 
 153                 // We haven't let off the button yet 
 156                         // We just let it off! 
 161                                 // reset our timer for 500ms 
 162                                 start 
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
; 
 163                                 ticks 
= (48000 * (500)) >> 10; 
 166                         // Still haven't let it off 
 168                                 // Have we held down a full second? 
 169                                 if (now 
== (uint16_t)(start 
+ ticks
)) 
 173                 // We already let off, did we click again? 
 175                         // Sweet, double click! 
 177                                 return BUTTON_DOUBLE_CLICK
; 
 179                         // Have we ran out of time to double click? 
 181                                 if (now 
== (uint16_t)(start 
+ ticks
)) 
 182                                         // At least we did a single click 
 183                                         return BUTTON_SINGLE_CLICK
; 
 188         // We should never get here 
 192 // Determine if a button is held down 
 193 int BUTTON_HELD(int ms
) 
 195         // If button is held for one second 
 196         int ticks 
= (48000 * (ms 
? ms 
: 1000)) >> 10; 
 198         // If we're not even pressed, forget about it! 
 200                 return BUTTON_NO_CLICK
; 
 202         // Borrow a PWM unit for my real-time clock 
 203         AT91C_BASE_PWMC
->PWMC_ENA 
= PWM_CHANNEL(0); 
 204         // 48 MHz / 1024 gives 46.875 kHz 
 205         AT91C_BASE_PWMC_CH0
->PWMC_CMR 
= PWM_CH_MODE_PRESCALER(10); 
 206         AT91C_BASE_PWMC_CH0
->PWMC_CDTYR 
= 0; 
 207         AT91C_BASE_PWMC_CH0
->PWMC_CPRDR 
= 0xffff; 
 209         uint16_t start 
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
; 
 213                 uint16_t now 
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
; 
 215                 // As soon as our button let go, we didn't hold long enough 
 217                         return BUTTON_SINGLE_CLICK
; 
 219                 // Have we waited the full second? 
 221                         if (now 
== (uint16_t)(start 
+ ticks
)) 
 227         // We should never get here 
 231 // attempt at high resolution microsecond timer 
 232 // beware: timer counts in 21.3uS increments (1024/48Mhz) 
 233 void SpinDelayUs(int us
) 
 235         int ticks 
= (48*us
) >> 10; 
 237         // Borrow a PWM unit for my real-time clock 
 238         AT91C_BASE_PWMC
->PWMC_ENA 
= PWM_CHANNEL(0); 
 239         // 48 MHz / 1024 gives 46.875 kHz 
 240         AT91C_BASE_PWMC_CH0
->PWMC_CMR 
= PWM_CH_MODE_PRESCALER(10); 
 241         AT91C_BASE_PWMC_CH0
->PWMC_CDTYR 
= 0; 
 242         AT91C_BASE_PWMC_CH0
->PWMC_CPRDR 
= 0xffff; 
 244         uint16_t start 
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
; 
 247                 uint16_t now 
= AT91C_BASE_PWMC_CH0
->PWMC_CCNTR
; 
 248                 if (now 
== (uint16_t)(start 
+ ticks
)) 
 255 void SpinDelay(int ms
) 
 257   // convert to uS and call microsecond delay function 
 258         SpinDelayUs(ms
*1000); 
 261 /* Similar to FpgaGatherVersion this formats stored version information 
 262  * into a string representation. It takes a pointer to the struct version_information, 
 263  * verifies the magic properties, then stores a formatted string, prefixed by 
 266 void FormatVersionInformation(char *dst
, int len
, const char *prefix
, void *version_information
) 
 268         struct version_information 
*v 
= (struct version_information
*)version_information
; 
 270         strncat(dst
, prefix
, len
-1); 
 271         if(v
->magic 
!= VERSION_INFORMATION_MAGIC
) { 
 272                 strncat(dst
, "Missing/Invalid version information", len 
- strlen(dst
) - 1); 
 275         if(v
->versionversion 
!= 1) { 
 276                 strncat(dst
, "Version information not understood", len 
- strlen(dst
) - 1); 
 280                 strncat(dst
, "Version information not available", len 
- strlen(dst
) - 1); 
 284         strncat(dst
, v
->gitversion
, len 
- strlen(dst
) - 1); 
 286                 strncat(dst
, "-unclean", len 
- strlen(dst
) - 1); 
 287         } else if(v
->clean 
== 2) { 
 288                 strncat(dst
, "-suspect", len 
- strlen(dst
) - 1); 
 291         strncat(dst
, " ", len 
- strlen(dst
) - 1); 
 292         strncat(dst
, v
->buildtime
, len 
- strlen(dst
) - 1); 
 295 //  ------------------------------------------------------------------------- 
 297 //  ------------------------------------------------------------------------- 
 300 //      ti = GetTickCount(); 
 302 //      ti = GetTickCount() - ti; 
 303 //      Dbprintf("timer(1s): %d t=%d", ti, GetTickCount()); 
 305 void StartTickCount() 
 307 //  must be 0x40, but on my cpu - included divider is optimal 
 311         AT91C_BASE_RTTC
->RTTC_RTMR 
= AT91C_RTTC_RTTRST 
+ 0x001D; // was 0x003B 
 315 * Get the current count. 
 317 uint32_t RAMFUNC 
GetTickCount(){ 
 318         return AT91C_BASE_RTTC
->RTTC_RTVR
;// was * 2; 
 321 //  ------------------------------------------------------------------------- 
 322 //  microseconds timer  
 323 //  ------------------------------------------------------------------------- 
 326         AT91C_BASE_PMC
->PMC_PCER 
|= (0x1 << 12) | (0x1 << 13) | (0x1 << 14); 
 327 //      AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC1XC1S_TIOA0; 
 328         AT91C_BASE_TCB
->TCB_BMR 
= AT91C_TCB_TC0XC0S_NONE 
| AT91C_TCB_TC1XC1S_TIOA0 
| AT91C_TCB_TC2XC2S_NONE
; 
 331         AT91C_BASE_TC0
->TC_CCR 
= AT91C_TC_CLKDIS
; // timer disable 
 332         AT91C_BASE_TC0
->TC_CMR 
= AT91C_TC_CLKS_TIMER_DIV3_CLOCK 
| // MCK(48MHz)/32 -- tick=1.5mks 
 333                                                                                                                 AT91C_TC_WAVE 
| AT91C_TC_WAVESEL_UP_AUTO 
| AT91C_TC_ACPA_CLEAR 
| 
 334                                                                                                                 AT91C_TC_ACPC_SET 
| AT91C_TC_ASWTRG_SET
; 
 335         AT91C_BASE_TC0
->TC_RA 
= 1; 
 336         AT91C_BASE_TC0
->TC_RC 
= 0xBFFF + 1; // 0xC000 
 338         AT91C_BASE_TC1
->TC_CCR 
= AT91C_TC_CLKDIS
; // timer disable   
 339         AT91C_BASE_TC1
->TC_CMR 
= AT91C_TC_CLKS_XC1
; // from timer 0 
 341         AT91C_BASE_TC0
->TC_CCR 
= AT91C_TC_CLKEN
; 
 342         AT91C_BASE_TC1
->TC_CCR 
= AT91C_TC_CLKEN
; 
 343         AT91C_BASE_TCB
->TCB_BCR 
= 1; 
 346 uint32_t RAMFUNC 
GetCountUS(){ 
 347         return (AT91C_BASE_TC1
->TC_CV 
* 0x8000) + ((AT91C_BASE_TC0
->TC_CV 
/ 15) * 10); 
 350 static uint32_t GlobalUsCounter 
= 0; 
 352 uint32_t RAMFUNC 
GetDeltaCountUS(){ 
 353         uint32_t g_cnt 
= GetCountUS(); 
 354         uint32_t g_res 
= g_cnt 
- GlobalUsCounter
; 
 355         GlobalUsCounter 
= g_cnt
; 
 360 //  ------------------------------------------------------------------------- 
 361 //  Timer for iso14443 commands. Uses ssp_clk from FPGA  
 362 //  ------------------------------------------------------------------------- 
 363 void StartCountSspClk() 
 365         AT91C_BASE_PMC
->PMC_PCER 
= (1 << AT91C_ID_TC0
) | (1 << AT91C_ID_TC1
) | (1 << AT91C_ID_TC2
);  // Enable Clock to all timers 
 366         AT91C_BASE_TCB
->TCB_BMR 
= AT91C_TCB_TC0XC0S_TIOA1               
// XC0 Clock = TIOA1 
 367                                                         | AT91C_TCB_TC1XC1S_NONE                
// XC1 Clock = none 
 368                                                         | AT91C_TCB_TC2XC2S_TIOA0
;              // XC2 Clock = TIOA0 
 370         // configure TC1 to create a short pulse on TIOA1 when a rising edge on TIOB1 (= ssp_clk from FPGA) occurs: 
 371         AT91C_BASE_TC1
->TC_CCR 
= AT91C_TC_CLKDIS
;                               // disable TC1 
 372         AT91C_BASE_TC1
->TC_CMR 
= AT91C_TC_CLKS_TIMER_DIV1_CLOCK 
// TC1 Clock = MCK(48MHz)/2 = 24MHz 
 373                                                         | AT91C_TC_CPCSTOP                              
// Stop clock on RC compare 
 374                                                         | AT91C_TC_EEVTEDG_RISING               
// Trigger on rising edge of Event 
 375                                                         | AT91C_TC_EEVT_TIOB                    
// Event-Source: TIOB1 (= ssp_clk from FPGA = 13,56MHz/16) 
 376                                                         | AT91C_TC_ENETRG                               
// Enable external trigger event 
 377                                                         | AT91C_TC_WAVESEL_UP                   
// Upmode without automatic trigger on RC compare 
 378                                                         | AT91C_TC_WAVE                                 
// Waveform Mode 
 379                                                         | AT91C_TC_AEEVT_SET                    
// Set TIOA1 on external event 
 380                                                         | AT91C_TC_ACPC_CLEAR
;                  // Clear TIOA1 on RC Compare 
 381         AT91C_BASE_TC1
->TC_RC 
= 0x04;                                                   // RC Compare value = 0x04 
 383         // use TC0 to count TIOA1 pulses 
 384         AT91C_BASE_TC0
->TC_CCR 
= AT91C_TC_CLKDIS
;                               // disable TC0 
 385         AT91C_BASE_TC0
->TC_CMR 
= AT91C_TC_CLKS_XC0                              
// TC0 clock = XC0 clock = TIOA1 
 386                                                         | AT91C_TC_WAVE                                 
// Waveform Mode 
 387                                                         | AT91C_TC_WAVESEL_UP                   
// just count 
 388                                                         | AT91C_TC_ACPA_CLEAR                   
// Clear TIOA0 on RA Compare 
 389                                                         | AT91C_TC_ACPC_SET
;                    // Set TIOA0 on RC Compare 
 390         AT91C_BASE_TC0
->TC_RA 
= 1;                                                              // RA Compare value = 1; pulse width to TC2 
 391         AT91C_BASE_TC0
->TC_RC 
= 0;                                                              // RC Compare value = 0; increment TC2 on overflow 
 393         // use TC2 to count TIOA0 pulses (giving us a 32bit counter (TC0/TC2) clocked by ssp_clk) 
 394         AT91C_BASE_TC2
->TC_CCR 
= AT91C_TC_CLKDIS
;                               // disable TC2   
 395         AT91C_BASE_TC2
->TC_CMR 
= AT91C_TC_CLKS_XC2                              
// TC2 clock = XC2 clock = TIOA0 
 396                                                         | AT91C_TC_WAVE                                 
// Waveform Mode 
 397                                                         | AT91C_TC_WAVESEL_UP
;                  // just count 
 399         AT91C_BASE_TC0
->TC_CCR 
= AT91C_TC_CLKEN
;                                // enable TC0 
 400         AT91C_BASE_TC1
->TC_CCR 
= AT91C_TC_CLKEN
;                                // enable TC1 
 401         AT91C_BASE_TC2
->TC_CCR 
= AT91C_TC_CLKEN
;                                // enable TC2 
 404         // synchronize the counter with the ssp_frame signal. Note: FPGA must be in any iso14446 mode, otherwise the frame signal would not be present  
 406         while(!(AT91C_BASE_PIOA
->PIO_PDSR 
& GPIO_SSC_FRAME
));   // wait for ssp_frame to go high (start of frame) 
 407         while(AT91C_BASE_PIOA
->PIO_PDSR 
& GPIO_SSC_FRAME
);              // wait for ssp_frame to be low 
 408         while(!(AT91C_BASE_PIOA
->PIO_PDSR 
& GPIO_SSC_CLK
));     // wait for ssp_clk to go high 
 409         // note: up to now two ssp_clk rising edges have passed since the rising edge of ssp_frame 
 410         // it is now safe to assert a sync signal. This sets all timers to 0 on next active clock edge 
 411         AT91C_BASE_TCB
->TCB_BCR 
= 1;                                                    // assert Sync (set all timers to 0 on next active clock edge) 
 412         // at the next (3rd) ssp_clk rising edge, TC1 will be reset (and not generate a clock signal to TC0) 
 413         // at the next (4th) ssp_clk rising edge, TC0 (the low word of our counter) will be reset. From now on, 
 414         // whenever the last three bits of our counter go 0, we can be sure to be in the middle of a frame transfer. 
 415         // (just started with the transfer of the 4th Bit). 
 416         // The high word of the counter (TC2) will not reset until the low word (TC0) overflows. Therefore need to wait quite some time before 
 417         // we can use the counter. 
 418         while (AT91C_BASE_TC0
->TC_CV 
< 0xFFF0); 
 422 uint32_t RAMFUNC 
GetCountSspClk(){ 
 424         tmp_count 
= (AT91C_BASE_TC2
->TC_CV 
<< 16) | AT91C_BASE_TC0
->TC_CV
; 
 425         if ((tmp_count 
& 0x0000ffff) == 0) { //small chance that we may have missed an increment in TC2 
 426                 return (AT91C_BASE_TC2
->TC_CV 
<< 16); 
 432 void iso14a_clear_trace() { 
 436 void iso14a_set_tracing(bool enable
) { 
 441         uint8_t *trace 
= BigBuf_get_addr(); 
 442         uint16_t max_traceLen 
= BigBuf_max_traceLen(); 
 443         memset(trace
, 0x44, max_traceLen
); 
 447 void set_tracing(bool enable
) { 
 452   This is a function to store traces. All protocols can use this generic tracer-function. 
 453   The traces produced by calling this function can be fetched on the client-side 
 454   by 'hf list raw', alternatively 'hf list <proto>' for protocol-specific 
 455   annotation of commands/responses. 
 458 bool RAMFUNC 
LogTrace(const uint8_t *btBytes
, uint16_t iLen
, uint32_t timestamp_start
, uint32_t timestamp_end
, uint8_t *parity
, bool readerToTag
) 
 460         if (!tracing
) return FALSE
; 
 462         uint8_t *trace 
= BigBuf_get_addr(); 
 464         uint16_t num_paritybytes 
= (iLen
-1)/8 + 1;      // number of valid paritybytes in *parity 
 465         uint16_t duration 
= timestamp_end 
- timestamp_start
; 
 467         // Return when trace is full 
 468         uint16_t max_traceLen 
= BigBuf_max_traceLen(); 
 470         if (traceLen 
+ sizeof(iLen
) + sizeof(timestamp_start
) + sizeof(duration
) + num_paritybytes 
+ iLen 
>= max_traceLen
) { 
 471                 tracing 
= FALSE
;        // don't trace any more 
 475         // 32 bits timestamp (little endian) 
 476         // 16 bits duration (little endian) 
 477         // 16 bits data length (little endian, Highest Bit used as readerToTag flag) 
 479         // x Bytes parity (one byte per 8 bytes data) 
 482         trace
[traceLen
++] = ((timestamp_start 
>> 0) & 0xff); 
 483         trace
[traceLen
++] = ((timestamp_start 
>> 8) & 0xff); 
 484         trace
[traceLen
++] = ((timestamp_start 
>> 16) & 0xff); 
 485         trace
[traceLen
++] = ((timestamp_start 
>> 24) & 0xff); 
 488         trace
[traceLen
++] = ((duration 
>> 0) & 0xff); 
 489         trace
[traceLen
++] = ((duration 
>> 8) & 0xff); 
 492         trace
[traceLen
++] = ((iLen 
>> 0) & 0xff); 
 493         trace
[traceLen
++] = ((iLen 
>> 8) & 0xff); 
 497                 trace
[traceLen 
- 1] |= 0x80; 
 501         if (btBytes 
!= NULL 
&& iLen 
!= 0) { 
 502                 memcpy(trace 
+ traceLen
, btBytes
, iLen
); 
 507         if (parity 
!= NULL 
&& iLen 
!= 0) { 
 508                 memcpy(trace 
+ traceLen
, parity
, num_paritybytes
); 
 510         traceLen 
+= num_paritybytes
; 
 512         if(traceLen 
+4 < max_traceLen
) 
 513         {       //If it hadn't been cleared, for whatever reason.. 
 514                 memset(trace
+traceLen
,0x44, 4);