]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


6996c82edcf5e350060f0af10f769c6d13b6a8e0
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 #define abs(x) ( ((x)<0) ? -(x) : (x) )
33
34 //=============================================================================
35 // A buffer where we can queue things up to be sent through the FPGA, for
36 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
37 // is the order in which they go out on the wire.
38 //=============================================================================
39
40 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
41 uint8_t ToSend[TOSEND_BUFFER_SIZE];
42 int ToSendMax;
43 static int ToSendBit;
44 struct common_area common_area __attribute__((section(".commonarea")));
45
46 void ToSendReset(void)
47 {
48 ToSendMax = -1;
49 ToSendBit = 8;
50 }
51
52 void ToSendStuffBit(int b)
53 {
54 if(ToSendBit >= 8) {
55 ToSendMax++;
56 ToSend[ToSendMax] = 0;
57 ToSendBit = 0;
58 }
59
60 if(b) {
61 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
62 }
63
64 ToSendBit++;
65
66 if(ToSendMax >= sizeof(ToSend)) {
67 ToSendBit = 0;
68 DbpString("ToSendStuffBit overflowed!");
69 }
70 }
71
72 //=============================================================================
73 // Debug print functions, to go out over USB, to the usual PC-side client.
74 //=============================================================================
75
76 void DbpString(char *str)
77 {
78 byte_t len = strlen(str);
79 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
80 }
81
82 #if 0
83 void DbpIntegers(int x1, int x2, int x3)
84 {
85 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
86 }
87 #endif
88
89 void Dbprintf(const char *fmt, ...) {
90 // should probably limit size here; oh well, let's just use a big buffer
91 char output_string[128];
92 va_list ap;
93
94 va_start(ap, fmt);
95 kvsprintf(fmt, output_string, 10, ap);
96 va_end(ap);
97
98 DbpString(output_string);
99 }
100
101 // prints HEX & ASCII
102 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
103 int l=0,i;
104 char ascii[9];
105
106 while (len>0) {
107 if (len>8) l=8;
108 else l=len;
109
110 memcpy(ascii,d,l);
111 ascii[l]=0;
112
113 // filter safe ascii
114 for (i=0;i<l;i++)
115 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
116
117 if (bAsci) {
118 Dbprintf("%-8s %*D",ascii,l,d," ");
119 } else {
120 Dbprintf("%*D",l,d," ");
121 }
122
123 len-=8;
124 d+=8;
125 }
126 }
127
128 //-----------------------------------------------------------------------------
129 // Read an ADC channel and block till it completes, then return the result
130 // in ADC units (0 to 1023). Also a routine to average 32 samples and
131 // return that.
132 //-----------------------------------------------------------------------------
133 static int ReadAdc(int ch)
134 {
135 uint32_t d;
136
137 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
138 AT91C_BASE_ADC->ADC_MR =
139 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
140 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
141 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
142
143 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
144 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
145 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
146 //
147 // The maths are:
148 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
149 //
150 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
151 //
152 // Note: with the "historic" values in the comments above, the error was 34% !!!
153
154 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
155
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
157
158 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
159 ;
160 d = AT91C_BASE_ADC->ADC_CDR[ch];
161
162 return d;
163 }
164
165 int AvgAdc(int ch) // was static - merlok
166 {
167 int i;
168 int a = 0;
169
170 for(i = 0; i < 32; i++) {
171 a += ReadAdc(ch);
172 }
173
174 return (a + 15) >> 5;
175 }
176
177 void MeasureAntennaTuning(void)
178 {
179 uint8_t LF_Results[256];
180 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
181 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
182
183 LED_B_ON();
184
185 /*
186 * Sweeps the useful LF range of the proxmark from
187 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
188 * read the voltage in the antenna, the result left
189 * in the buffer is a graph which should clearly show
190 * the resonating frequency of your LF antenna
191 * ( hopefully around 95 if it is tuned to 125kHz!)
192 */
193
194 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
195 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
196 for (i=255; i>=19; i--) {
197 WDT_HIT();
198 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
199 SpinDelay(20);
200 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
201 if (i==95) vLf125 = adcval; // voltage at 125Khz
202 if (i==89) vLf134 = adcval; // voltage at 134Khz
203
204 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
205 if(LF_Results[i] > peak) {
206 peakv = adcval;
207 peak = LF_Results[i];
208 peakf = i;
209 //ptr = i;
210 }
211 }
212
213 for (i=18; i >= 0; i--) LF_Results[i] = 0;
214
215 LED_A_ON();
216 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
217 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
218 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
219 SpinDelay(20);
220 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
221
222 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
223 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
224 LED_A_OFF();
225 LED_B_OFF();
226 return;
227 }
228
229 void MeasureAntennaTuningHf(void)
230 {
231 int vHf = 0; // in mV
232
233 DbpString("Measuring HF antenna, press button to exit");
234
235 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
236 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
237 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
238
239 for (;;) {
240 SpinDelay(20);
241 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
242
243 Dbprintf("%d mV",vHf);
244 if (BUTTON_PRESS()) break;
245 }
246 DbpString("cancelled");
247
248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
249
250 }
251
252
253 void ReadMem(int addr)
254 {
255 const uint8_t *data = ((uint8_t *)addr);
256
257 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
258 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
259 }
260
261 /* osimage version information is linked in */
262 extern struct version_information version_information;
263 /* bootrom version information is pointed to from _bootphase1_version_pointer */
264 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
265 void SendVersion(void)
266 {
267 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
268 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
269
270 /* Try to find the bootrom version information. Expect to find a pointer at
271 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
272 * pointer, then use it.
273 */
274 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
275 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
276 strcat(VersionString, "bootrom version information appears invalid\n");
277 } else {
278 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
279 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
280 }
281
282 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
283 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
284
285 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
286 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
287 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
288 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
289
290 // Send Chip ID and used flash memory
291 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
292 uint32_t compressed_data_section_size = common_area.arg1;
293 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
294 }
295
296 #ifdef WITH_LF
297 // samy's sniff and repeat routine
298 void SamyRun()
299 {
300 DbpString("Stand-alone mode! No PC necessary.");
301 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
302
303 // 3 possible options? no just 2 for now
304 #define OPTS 2
305
306 int high[OPTS], low[OPTS];
307
308 // Oooh pretty -- notify user we're in elite samy mode now
309 LED(LED_RED, 200);
310 LED(LED_ORANGE, 200);
311 LED(LED_GREEN, 200);
312 LED(LED_ORANGE, 200);
313 LED(LED_RED, 200);
314 LED(LED_ORANGE, 200);
315 LED(LED_GREEN, 200);
316 LED(LED_ORANGE, 200);
317 LED(LED_RED, 200);
318
319 int selected = 0;
320 int playing = 0;
321 int cardRead = 0;
322
323 // Turn on selected LED
324 LED(selected + 1, 0);
325
326 for (;;)
327 {
328 usb_poll();
329 WDT_HIT();
330
331 // Was our button held down or pressed?
332 int button_pressed = BUTTON_HELD(1000);
333 SpinDelay(300);
334
335 // Button was held for a second, begin recording
336 if (button_pressed > 0 && cardRead == 0)
337 {
338 LEDsoff();
339 LED(selected + 1, 0);
340 LED(LED_RED2, 0);
341
342 // record
343 DbpString("Starting recording");
344
345 // wait for button to be released
346 while(BUTTON_PRESS())
347 WDT_HIT();
348
349 /* need this delay to prevent catching some weird data */
350 SpinDelay(500);
351
352 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
353 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
354
355 LEDsoff();
356 LED(selected + 1, 0);
357 // Finished recording
358
359 // If we were previously playing, set playing off
360 // so next button push begins playing what we recorded
361 playing = 0;
362
363 cardRead = 1;
364
365 }
366
367 else if (button_pressed > 0 && cardRead == 1)
368 {
369 LEDsoff();
370 LED(selected + 1, 0);
371 LED(LED_ORANGE, 0);
372
373 // record
374 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
375
376 // wait for button to be released
377 while(BUTTON_PRESS())
378 WDT_HIT();
379
380 /* need this delay to prevent catching some weird data */
381 SpinDelay(500);
382
383 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
384 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
385
386 LEDsoff();
387 LED(selected + 1, 0);
388 // Finished recording
389
390 // If we were previously playing, set playing off
391 // so next button push begins playing what we recorded
392 playing = 0;
393
394 cardRead = 0;
395
396 }
397
398 // Change where to record (or begin playing)
399 else if (button_pressed)
400 {
401 // Next option if we were previously playing
402 if (playing)
403 selected = (selected + 1) % OPTS;
404 playing = !playing;
405
406 LEDsoff();
407 LED(selected + 1, 0);
408
409 // Begin transmitting
410 if (playing)
411 {
412 LED(LED_GREEN, 0);
413 DbpString("Playing");
414 // wait for button to be released
415 while(BUTTON_PRESS())
416 WDT_HIT();
417 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
418 CmdHIDsimTAG(high[selected], low[selected], 0);
419 DbpString("Done playing");
420 if (BUTTON_HELD(1000) > 0)
421 {
422 DbpString("Exiting");
423 LEDsoff();
424 return;
425 }
426
427 /* We pressed a button so ignore it here with a delay */
428 SpinDelay(300);
429
430 // when done, we're done playing, move to next option
431 selected = (selected + 1) % OPTS;
432 playing = !playing;
433 LEDsoff();
434 LED(selected + 1, 0);
435 }
436 else
437 while(BUTTON_PRESS())
438 WDT_HIT();
439 }
440 }
441 }
442 #endif
443
444 /*
445 OBJECTIVE
446 Listen and detect an external reader. Determine the best location
447 for the antenna.
448
449 INSTRUCTIONS:
450 Inside the ListenReaderField() function, there is two mode.
451 By default, when you call the function, you will enter mode 1.
452 If you press the PM3 button one time, you will enter mode 2.
453 If you press the PM3 button a second time, you will exit the function.
454
455 DESCRIPTION OF MODE 1:
456 This mode just listens for an external reader field and lights up green
457 for HF and/or red for LF. This is the original mode of the detectreader
458 function.
459
460 DESCRIPTION OF MODE 2:
461 This mode will visually represent, using the LEDs, the actual strength of the
462 current compared to the maximum current detected. Basically, once you know
463 what kind of external reader is present, it will help you spot the best location to place
464 your antenna. You will probably not get some good results if there is a LF and a HF reader
465 at the same place! :-)
466
467 LIGHT SCHEME USED:
468 */
469 static const char LIGHT_SCHEME[] = {
470 0x0, /* ---- | No field detected */
471 0x1, /* X--- | 14% of maximum current detected */
472 0x2, /* -X-- | 29% of maximum current detected */
473 0x4, /* --X- | 43% of maximum current detected */
474 0x8, /* ---X | 57% of maximum current detected */
475 0xC, /* --XX | 71% of maximum current detected */
476 0xE, /* -XXX | 86% of maximum current detected */
477 0xF, /* XXXX | 100% of maximum current detected */
478 };
479 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
480
481 void ListenReaderField(int limit)
482 {
483 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
484 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
485 int mode=1, display_val, display_max, i;
486
487 #define LF_ONLY 1
488 #define HF_ONLY 2
489 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
490
491
492 // switch off FPGA - we don't want to measure our own signal
493 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
494 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
495
496 LEDsoff();
497
498 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
499
500 if(limit != HF_ONLY) {
501 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
502 lf_baseline = lf_av;
503 }
504
505 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
506
507 if (limit != LF_ONLY) {
508 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
509 hf_baseline = hf_av;
510 }
511
512 for(;;) {
513 if (BUTTON_PRESS()) {
514 SpinDelay(500);
515 switch (mode) {
516 case 1:
517 mode=2;
518 DbpString("Signal Strength Mode");
519 break;
520 case 2:
521 default:
522 DbpString("Stopped");
523 LEDsoff();
524 return;
525 break;
526 }
527 }
528 WDT_HIT();
529
530 if (limit != HF_ONLY) {
531 if(mode == 1) {
532 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
533 LED_D_ON();
534 else
535 LED_D_OFF();
536 }
537
538 lf_av_new = AvgAdc(ADC_CHAN_LF);
539 // see if there's a significant change
540 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
541 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
542 lf_av = lf_av_new;
543 if (lf_av > lf_max)
544 lf_max = lf_av;
545 }
546 }
547
548 if (limit != LF_ONLY) {
549 if (mode == 1){
550 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
551 LED_B_ON();
552 else
553 LED_B_OFF();
554 }
555
556 hf_av_new = AvgAdc(ADC_CHAN_HF);
557 // see if there's a significant change
558 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
559 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
560 hf_av = hf_av_new;
561 if (hf_av > hf_max)
562 hf_max = hf_av;
563 }
564 }
565
566 if(mode == 2) {
567 if (limit == LF_ONLY) {
568 display_val = lf_av;
569 display_max = lf_max;
570 } else if (limit == HF_ONLY) {
571 display_val = hf_av;
572 display_max = hf_max;
573 } else { /* Pick one at random */
574 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
575 display_val = hf_av;
576 display_max = hf_max;
577 } else {
578 display_val = lf_av;
579 display_max = lf_max;
580 }
581 }
582 for (i=0; i<LIGHT_LEN; i++) {
583 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
584 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
585 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
586 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
587 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
588 break;
589 }
590 }
591 }
592 }
593 }
594
595 void UsbPacketReceived(uint8_t *packet, int len)
596 {
597 UsbCommand *c = (UsbCommand *)packet;
598
599 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
600
601 switch(c->cmd) {
602 #ifdef WITH_LF
603 case CMD_SET_LF_SAMPLING_CONFIG:
604 setSamplingConfig((sample_config *) c->d.asBytes);
605 break;
606 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
607 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
608 break;
609 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
610 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
611 break;
612 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
613 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
614 break;
615 case CMD_HID_DEMOD_FSK:
616 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
617 break;
618 case CMD_HID_SIM_TAG:
619 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
620 break;
621 case CMD_FSK_SIM_TAG:
622 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
623 break;
624 case CMD_ASK_SIM_TAG:
625 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
626 break;
627 case CMD_PSK_SIM_TAG:
628 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
629 break;
630 case CMD_HID_CLONE_TAG:
631 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
632 break;
633 case CMD_IO_DEMOD_FSK:
634 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
635 break;
636 case CMD_IO_CLONE_TAG:
637 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
638 break;
639 case CMD_EM410X_DEMOD:
640 CmdEM410xdemod(c->arg[0], 0, 0, 1);
641 break;
642 case CMD_EM410X_WRITE_TAG:
643 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
644 break;
645 case CMD_READ_TI_TYPE:
646 ReadTItag();
647 break;
648 case CMD_WRITE_TI_TYPE:
649 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
650 break;
651 case CMD_SIMULATE_TAG_125K:
652 LED_A_ON();
653 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
654 LED_A_OFF();
655 break;
656 case CMD_LF_SIMULATE_BIDIR:
657 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
658 break;
659 case CMD_INDALA_CLONE_TAG:
660 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
661 break;
662 case CMD_INDALA_CLONE_TAG_L:
663 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
664 break;
665 case CMD_T55XX_READ_BLOCK:
666 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
667 break;
668 case CMD_T55XX_WRITE_BLOCK:
669 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
670 break;
671 case CMD_T55XX_READ_TRACE:
672 T55xxReadTrace();
673 break;
674 case CMD_PCF7931_READ:
675 ReadPCF7931();
676 cmd_send(CMD_ACK,0,0,0,0,0);
677 break;
678 case CMD_EM4X_READ_WORD:
679 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
680 break;
681 case CMD_EM4X_WRITE_WORD:
682 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
683 break;
684 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
685 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
686 break;
687 #endif
688
689 #ifdef WITH_HITAG
690 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
691 SnoopHitag(c->arg[0]);
692 break;
693 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
694 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
695 break;
696 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
697 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
698 break;
699 #endif
700
701 #ifdef WITH_ISO15693
702 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
703 AcquireRawAdcSamplesIso15693();
704 break;
705 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
706 RecordRawAdcSamplesIso15693();
707 break;
708
709 case CMD_ISO_15693_COMMAND:
710 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
711 break;
712
713 case CMD_ISO_15693_FIND_AFI:
714 BruteforceIso15693Afi(c->arg[0]);
715 break;
716
717 case CMD_ISO_15693_DEBUG:
718 SetDebugIso15693(c->arg[0]);
719 break;
720
721 case CMD_READER_ISO_15693:
722 ReaderIso15693(c->arg[0]);
723 break;
724 case CMD_SIMTAG_ISO_15693:
725 SimTagIso15693(c->arg[0], c->d.asBytes);
726 break;
727 #endif
728
729 #ifdef WITH_LEGICRF
730 case CMD_SIMULATE_TAG_LEGIC_RF:
731 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
732 break;
733
734 case CMD_WRITER_LEGIC_RF:
735 LegicRfWriter(c->arg[1], c->arg[0]);
736 break;
737
738 case CMD_READER_LEGIC_RF:
739 LegicRfReader(c->arg[0], c->arg[1]);
740 break;
741 #endif
742
743 #ifdef WITH_ISO14443b
744 case CMD_READ_SRI512_TAG:
745 ReadSTMemoryIso14443b(0x0F);
746 break;
747 case CMD_READ_SRIX4K_TAG:
748 ReadSTMemoryIso14443b(0x7F);
749 break;
750 case CMD_SNOOP_ISO_14443B:
751 SnoopIso14443b();
752 break;
753 case CMD_SIMULATE_TAG_ISO_14443B:
754 SimulateIso14443bTag();
755 break;
756 case CMD_ISO_14443B_COMMAND:
757 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
758 break;
759 #endif
760
761 #ifdef WITH_ISO14443a
762 case CMD_SNOOP_ISO_14443a:
763 SniffIso14443a(c->arg[0]);
764 break;
765 case CMD_READER_ISO_14443a:
766 ReaderIso14443a(c);
767 break;
768 case CMD_SIMULATE_TAG_ISO_14443a:
769 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
770 break;
771
772 case CMD_EPA_PACE_COLLECT_NONCE:
773 EPA_PACE_Collect_Nonce(c);
774 break;
775 case CMD_EPA_PACE_REPLAY:
776 EPA_PACE_Replay(c);
777 break;
778
779 case CMD_READER_MIFARE:
780 ReaderMifare(c->arg[0]);
781 break;
782 case CMD_MIFARE_READBL:
783 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
784 break;
785 case CMD_MIFAREU_READBL:
786 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
787 break;
788 case CMD_MIFAREUC_AUTH:
789 MifareUC_Auth(c->arg[0],c->d.asBytes);
790 break;
791 case CMD_MIFAREU_READCARD:
792 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
793 break;
794 case CMD_MIFAREUC_SETPWD:
795 MifareUSetPwd(c->arg[0], c->d.asBytes);
796 break;
797 case CMD_MIFARE_READSC:
798 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
799 break;
800 case CMD_MIFARE_WRITEBL:
801 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
802 break;
803 //case CMD_MIFAREU_WRITEBL_COMPAT:
804 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
805 //break;
806 case CMD_MIFAREU_WRITEBL:
807 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
808 break;
809 case CMD_MIFARE_NESTED:
810 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
811 break;
812 case CMD_MIFARE_CHKKEYS:
813 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
814 break;
815 case CMD_SIMULATE_MIFARE_CARD:
816 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
817 break;
818
819 // emulator
820 case CMD_MIFARE_SET_DBGMODE:
821 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
822 break;
823 case CMD_MIFARE_EML_MEMCLR:
824 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
825 break;
826 case CMD_MIFARE_EML_MEMSET:
827 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
828 break;
829 case CMD_MIFARE_EML_MEMGET:
830 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
831 break;
832 case CMD_MIFARE_EML_CARDLOAD:
833 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
834 break;
835
836 // Work with "magic Chinese" card
837 case CMD_MIFARE_CSETBLOCK:
838 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
839 break;
840 case CMD_MIFARE_CGETBLOCK:
841 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
842 break;
843 case CMD_MIFARE_CIDENT:
844 MifareCIdent();
845 break;
846
847 // mifare sniffer
848 case CMD_MIFARE_SNIFFER:
849 SniffMifare(c->arg[0]);
850 break;
851
852 //mifare desfire
853 case CMD_MIFARE_DESFIRE_READBL: break;
854 case CMD_MIFARE_DESFIRE_WRITEBL: break;
855 case CMD_MIFARE_DESFIRE_AUTH1:
856 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
857 break;
858 case CMD_MIFARE_DESFIRE_AUTH2:
859 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
860 break;
861 case CMD_MIFARE_DES_READER:
862 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
863 break;
864 case CMD_MIFARE_DESFIRE_INFO:
865 MifareDesfireGetInformation();
866 break;
867 case CMD_MIFARE_DESFIRE:
868 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
869 break;
870
871 case CMD_MIFARE_COLLECT_NONCES:
872 MifareCollectNonces(c->arg[0], c->arg[1]);
873 break;
874 #endif
875
876 #ifdef WITH_ICLASS
877 // Makes use of ISO14443a FPGA Firmware
878 case CMD_SNOOP_ICLASS:
879 SnoopIClass();
880 break;
881 case CMD_SIMULATE_TAG_ICLASS:
882 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
883 break;
884 case CMD_READER_ICLASS:
885 ReaderIClass(c->arg[0]);
886 break;
887 case CMD_READER_ICLASS_REPLAY:
888 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
889 break;
890 case CMD_ICLASS_EML_MEMSET:
891 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
892 break;
893 #endif
894
895 case CMD_BUFF_CLEAR:
896 BigBuf_Clear();
897 break;
898
899 case CMD_MEASURE_ANTENNA_TUNING:
900 MeasureAntennaTuning();
901 break;
902
903 case CMD_MEASURE_ANTENNA_TUNING_HF:
904 MeasureAntennaTuningHf();
905 break;
906
907 case CMD_LISTEN_READER_FIELD:
908 ListenReaderField(c->arg[0]);
909 break;
910
911 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
912 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
913 SpinDelay(200);
914 LED_D_OFF(); // LED D indicates field ON or OFF
915 break;
916
917 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
918
919 LED_B_ON();
920 uint8_t *BigBuf = BigBuf_get_addr();
921 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
922 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
923 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
924 }
925 // Trigger a finish downloading signal with an ACK frame
926 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
927 LED_B_OFF();
928 break;
929
930 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
931 uint8_t *b = BigBuf_get_addr();
932 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
933 cmd_send(CMD_ACK,0,0,0,0,0);
934 break;
935 }
936 case CMD_READ_MEM:
937 ReadMem(c->arg[0]);
938 break;
939
940 case CMD_SET_LF_DIVISOR:
941 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
942 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
943 break;
944
945 case CMD_SET_ADC_MUX:
946 switch(c->arg[0]) {
947 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
948 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
949 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
950 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
951 }
952 break;
953
954 case CMD_VERSION:
955 SendVersion();
956 break;
957
958 #ifdef WITH_LCD
959 case CMD_LCD_RESET:
960 LCDReset();
961 break;
962 case CMD_LCD:
963 LCDSend(c->arg[0]);
964 break;
965 #endif
966 case CMD_SETUP_WRITE:
967 case CMD_FINISH_WRITE:
968 case CMD_HARDWARE_RESET:
969 usb_disable();
970 SpinDelay(1000);
971 SpinDelay(1000);
972 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
973 for(;;) {
974 // We're going to reset, and the bootrom will take control.
975 }
976 break;
977
978 case CMD_START_FLASH:
979 if(common_area.flags.bootrom_present) {
980 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
981 }
982 usb_disable();
983 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
984 for(;;);
985 break;
986
987 case CMD_DEVICE_INFO: {
988 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
989 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
990 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
991 break;
992 }
993 default:
994 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
995 break;
996 }
997 }
998
999 void __attribute__((noreturn)) AppMain(void)
1000 {
1001 SpinDelay(100);
1002 clear_trace();
1003 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1004 /* Initialize common area */
1005 memset(&common_area, 0, sizeof(common_area));
1006 common_area.magic = COMMON_AREA_MAGIC;
1007 common_area.version = 1;
1008 }
1009 common_area.flags.osimage_present = 1;
1010
1011 LED_D_OFF();
1012 LED_C_OFF();
1013 LED_B_OFF();
1014 LED_A_OFF();
1015
1016 // Init USB device
1017 usb_enable();
1018
1019 // The FPGA gets its clock from us from PCK0 output, so set that up.
1020 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1021 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1022 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1023 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1024 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1025 AT91C_PMC_PRES_CLK_4;
1026 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1027
1028 // Reset SPI
1029 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1030 // Reset SSC
1031 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1032
1033 // Load the FPGA image, which we have stored in our flash.
1034 // (the HF version by default)
1035 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1036
1037 StartTickCount();
1038
1039 #ifdef WITH_LCD
1040 LCDInit();
1041 #endif
1042
1043 byte_t rx[sizeof(UsbCommand)];
1044 size_t rx_len;
1045
1046 for(;;) {
1047 if (usb_poll()) {
1048 rx_len = usb_read(rx,sizeof(UsbCommand));
1049 if (rx_len) {
1050 UsbPacketReceived(rx,rx_len);
1051 }
1052 }
1053 WDT_HIT();
1054
1055 #ifdef WITH_LF
1056 if (BUTTON_HELD(1000) > 0)
1057 SamyRun();
1058 #endif
1059 }
1060 }
Proxmark3 GIT tracking
Impressum, Datenschutz