1 //----------------------------------------------------------------------------- 
   2 // Jonathan Westhues, Aug 2005 
   3 // Gerhard de Koning Gans, April 2008, May 2011 
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or, 
   6 // at your option, any later version. See the LICENSE.txt file for the text of 
   8 //----------------------------------------------------------------------------- 
   9 // Definitions internal to the app source. 
  10 //----------------------------------------------------------------------------- 
  18 #include <sys/types.h> 
  21 #include "../common/crc32.h" 
  23 #include "../include/hitag2.h" 
  24 #include "../include/mifare.h" 
  30 extern const uint8_t OddByteParity
[256]; 
  31 extern int rsamples
;   // = 0; 
  32 extern int tracing
;    // = TRUE; 
  33 extern uint8_t trigger
; 
  35 // This may be used (sparingly) to declare a function to be copied to 
  36 // and executed from RAM 
  37 #define RAMFUNC __attribute((long_call, section(".ramfunc"))) 
  40 void ReadMem(int addr
); 
  41 void __attribute__((noreturn
)) AppMain(void); 
  43 //void DbpIntegers(int a, int b, int c); 
  44 void DbpString(char *str
); 
  45 void Dbprintf(const char *fmt
, ...); 
  46 void Dbhexdump(int len
, uint8_t *d
, bool bAsci
); 
  48 // ADC Vref = 3300mV, and an (10M+1M):1M voltage divider on the HF input can measure voltages up to 36300 mV 
  49 #define MAX_ADC_HF_VOLTAGE 36300 
  50 // ADC Vref = 3300mV, and an (10000k+240k):240k voltage divider on the LF input can measure voltages up to 140800 mV 
  51 #define MAX_ADC_LF_VOLTAGE 140800 
  54 void ToSendStuffBit(int b
); 
  55 void ToSendReset(void); 
  56 void ListenReaderField(int limit
); 
  58 extern uint8_t ToSend
[]; 
  61 void FpgaSendCommand(uint16_t cmd
, uint16_t v
); 
  62 void FpgaWriteConfWord(uint8_t v
); 
  63 void FpgaDownloadAndGo(int bitstream_version
); 
  64 int FpgaGatherBitstreamVersion(); 
  65 void FpgaGatherVersion(char *dst
, int len
); 
  66 void FpgaSetupSsc(void); 
  67 void SetupSpi(int mode
); 
  68 bool FpgaSetupSscDma(uint8_t *buf
, int len
); 
  69 #define FpgaDisableSscDma(void) AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; 
  70 #define FpgaEnableSscDma(void) AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTEN; 
  71 void SetAdcMuxFor(uint32_t whichGpio
); 
  73 // Definitions for the FPGA commands. 
  74 #define FPGA_CMD_SET_CONFREG                                    (1<<12) 
  75 #define FPGA_CMD_SET_DIVISOR                                    (2<<12) 
  76 #define FPGA_CMD_SET_USER_BYTE1                                 (3<<12) 
  77 // Definitions for the FPGA configuration word. 
  79 #define FPGA_MAJOR_MODE_LF_ADC                                  (0<<5) 
  80 #define FPGA_MAJOR_MODE_LF_EDGE_DETECT                  (1<<5) 
  81 #define FPGA_MAJOR_MODE_LF_PASSTHRU                             (2<<5) 
  83 #define FPGA_MAJOR_MODE_HF_READER_TX                            (0<<5) 
  84 #define FPGA_MAJOR_MODE_HF_READER_RX_XCORR                      (1<<5) 
  85 #define FPGA_MAJOR_MODE_HF_SIMULATOR                            (2<<5) 
  86 #define FPGA_MAJOR_MODE_HF_ISO14443A                            (3<<5) 
  88 #define FPGA_MAJOR_MODE_OFF                                     (7<<5) 
  90 #define FPGA_LF_ADC_READER_FIELD                                (1<<0) 
  91 // Options for LF_EDGE_DETECT 
  92 #define FPGA_CMD_SET_EDGE_DETECT_THRESHOLD                      FPGA_CMD_SET_USER_BYTE1 
  93 #define FPGA_LF_EDGE_DETECT_READER_FIELD                        (1<<0) 
  94 #define FPGA_LF_EDGE_DETECT_TOGGLE_MODE                         (1<<1) 
  95 // Options for the HF reader, tx to tag 
  96 #define FPGA_HF_READER_TX_SHALLOW_MOD                           (1<<0) 
  97 // Options for the HF reader, correlating against rx from tag 
  98 #define FPGA_HF_READER_RX_XCORR_848_KHZ                         (1<<0) 
  99 #define FPGA_HF_READER_RX_XCORR_SNOOP                           (1<<1) 
 100 #define FPGA_HF_READER_RX_XCORR_QUARTER_FREQ                    (1<<2) 
 101 // Options for the HF simulated tag, how to modulate 
 102 #define FPGA_HF_SIMULATOR_NO_MODULATION                         (0<<0) 
 103 #define FPGA_HF_SIMULATOR_MODULATE_BPSK                         (1<<0) 
 104 #define FPGA_HF_SIMULATOR_MODULATE_212K                         (2<<0) 
 105 #define FPGA_HF_SIMULATOR_MODULATE_424K                         (4<<0) 
 106 #define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT            0x5//101 
 108 // Options for ISO14443A 
 109 #define FPGA_HF_ISO14443A_SNIFFER                               (0<<0) 
 110 #define FPGA_HF_ISO14443A_TAGSIM_LISTEN                         (1<<0) 
 111 #define FPGA_HF_ISO14443A_TAGSIM_MOD                            (2<<0) 
 112 #define FPGA_HF_ISO14443A_READER_LISTEN                         (3<<0) 
 113 #define FPGA_HF_ISO14443A_READER_MOD                            (4<<0) 
 116 extern uint8_t decimation
; 
 117 extern uint8_t bits_per_sample 
; 
 118 extern bool averaging
; 
 120 void AcquireRawAdcSamples125k(int divisor
); 
 121 void ModThenAcquireRawAdcSamples125k(int delay_off
,int period_0
,int period_1
,uint8_t *command
); 
 122 void ReadTItag(void); 
 123 void WriteTItag(uint32_t idhi
, uint32_t idlo
, uint16_t crc
); 
 124 void AcquireTiType(void); 
 125 void AcquireRawBitsTI(void); 
 126 void SimulateTagLowFrequency( uint16_t period
, uint32_t gap
, uint8_t ledcontrol
); 
 127 //void SimulateTagLowFrequencyA(int period, int gap); 
 129 void CmdHIDsimTAG(int hi
, int lo
, int ledcontrol
); 
 130 void CmdFSKsimTAG(uint16_t arg1
, uint16_t arg2
, size_t size
, uint8_t *BitStream
); 
 131 void CmdASKsimTag(uint16_t arg1
, uint16_t arg2
, size_t size
, uint8_t *BitStream
); 
 132 void CmdPSKsimTag(uint16_t arg1
, uint16_t arg2
, size_t size
, uint8_t *BitStream
); 
 133 void CmdHIDdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
); 
 134 void CmdEM410xdemod(int findone
, int *high
, int *low
, int ledcontrol
); 
 135 void CmdIOdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
); 
 136 void CopyIOtoT55x7(uint32_t hi
, uint32_t lo
, uint8_t longFMT
); // Clone an ioProx card to T5557/T5567 
 137 void SimulateTagLowFrequencyBidir(int divisor
, int max_bitlen
); 
 138 void CopyHIDtoT55x7(uint32_t hi2
, uint32_t hi
, uint32_t lo
, uint8_t longFMT
); // Clone an HID card to T5557/T5567 
 139 void WriteEM410x(uint32_t card
, uint32_t id_hi
, uint32_t id_lo
); 
 140 void CopyIndala64toT55x7(int hi
, int lo
); // Clone Indala 64-bit tag by UID to T55x7 
 141 void CopyIndala224toT55x7(int uid1
, int uid2
, int uid3
, int uid4
, int uid5
, int uid6
, int uid7
); // Clone Indala 224-bit tag by UID to T55x7 
 142 void T55xxWriteBlock(uint32_t Data
, uint32_t Block
, uint32_t Pwd
, uint8_t PwdMode
); 
 143 void T55xxReadBlock(uint32_t Block
, uint32_t Pwd
, uint8_t PwdMode 
); 
 144 void T55xxReadTrace(void); 
 146 int DemodPCF7931(uint8_t **outBlocks
); 
 147 int IsBlock0PCF7931(uint8_t *Block
); 
 148 int IsBlock1PCF7931(uint8_t *Block
); 
 150 void EM4xReadWord(uint8_t Address
, uint32_t Pwd
, uint8_t PwdMode
); 
 151 void EM4xWriteWord(uint32_t Data
, uint8_t Address
, uint32_t Pwd
, uint8_t PwdMode
); 
 154 void SimulateIso14443Tag(void); 
 155 void AcquireRawAdcSamplesIso14443(uint32_t parameter
); 
 156 void ReadSTMemoryIso14443(uint32_t); 
 157 void RAMFUNC 
SnoopIso14443(void); 
 158 void SendRawCommand14443B(uint32_t, uint32_t, uint8_t, uint8_t[]); 
 161 void RAMFUNC 
SnoopIso14443a(uint8_t param
); 
 162 void SimulateIso14443aTag(int tagType
, int uid_1st
, int uid_2nd
, byte_t
* data
); 
 163 void ReaderIso14443a(UsbCommand 
* c
); 
 164 // Also used in iclass.c 
 165 bool RAMFUNC 
LogTrace(const uint8_t *btBytes
, uint16_t len
, uint32_t timestamp_start
, uint32_t timestamp_end
, uint8_t *parity
, bool readerToTag
); 
 166 void GetParity(const uint8_t *pbtCmd
, uint16_t len
, uint8_t *parity
); 
 167 void iso14a_set_trigger(bool enable
); 
 169 void RAMFUNC 
SniffMifare(uint8_t param
); 
 172 void EPA_PACE_Collect_Nonce(UsbCommand 
* c
); 
 175 void ReaderMifare(bool first_try
); 
 176 int32_t dist_nt(uint32_t nt1
, uint32_t nt2
); 
 177 void MifareReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *data
); 
 178 void MifareUReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
); 
 179 void MifareUC_Auth1(uint8_t arg0
, uint8_t *datain
); 
 180 void MifareUC_Auth2(uint32_t arg0
, uint8_t *datain
); 
 181 void MifareUReadCard(uint8_t arg0
, int Pages
, uint8_t *datain
); 
 182 void MifareReadSector(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
); 
 183 void MifareWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
); 
 184 void MifareUWriteBlock(uint8_t arg0
,uint8_t *datain
); 
 185 void MifareUWriteBlock_Special(uint8_t arg0
,uint8_t *datain
); 
 186 void MifareNested(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); 
 187 void MifareChkKeys(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
); 
 188 void Mifare1ksim(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
); 
 189 void MifareSetDbgLvl(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); 
 190 void MifareEMemClr(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); 
 191 void MifareEMemSet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); 
 192 void MifareEMemGet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); 
 193 void MifareECardLoad(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); 
 194 void MifareCSetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
);  // Work with "magic Chinese" card 
 195 void MifareCGetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); 
 196 void MifareCIdent();  // is "magic chinese" card? 
 197 void MifareUSetPwd(uint8_t arg0
, uint8_t *datain
); 
 200 void Mifare_DES_Auth1(uint8_t arg0
,uint8_t *datain
); 
 201 void Mifare_DES_Auth2(uint32_t arg0
, uint8_t *datain
);                                      
 204 bool    InitDesfireCard(); 
 205 void    MifareSendCommand(uint8_t arg0
,uint8_t arg1
, uint8_t *datain
); 
 206 void    MifareDesfireGetInformation(); 
 207 void    MifareDES_Auth1(uint8_t arg0
,uint8_t arg1
,uint8_t arg2
, uint8_t *datain
); 
 208 void    ReaderMifareDES(uint32_t param
, uint32_t param2
, uint8_t * datain
); 
 209 int     DesfireAPDU(uint8_t *cmd
, size_t cmd_len
, uint8_t *dataout
); 
 210 size_t  CreateAPDU( uint8_t *datain
, size_t len
, uint8_t *dataout
); 
 212 void    OnError(uint8_t reason
); 
 217 void    *mifare_cryto_preprocess_data (desfiretag_t tag
, void *data
, size_t *nbytes
, off_t offset
, int communication_settings
); 
 218 void    *mifare_cryto_postprocess_data (desfiretag_t tag
, void *data
, ssize_t 
*nbytes
, int communication_settings
); 
 219 void    mifare_cypher_single_block (desfirekey_t  key
, uint8_t *data
, uint8_t *ivect
, MifareCryptoDirection direction
, MifareCryptoOperation operation
, size_t block_size
); 
 220 void    mifare_cypher_blocks_chained (desfiretag_t tag
, desfirekey_t key
, uint8_t *ivect
, uint8_t *data
, size_t data_size
, MifareCryptoDirection direction
, MifareCryptoOperation operation
); 
 221 size_t  key_block_size (const desfirekey_t  key
); 
 222 size_t  padded_data_length (const size_t nbytes
, const size_t block_size
); 
 223 size_t  maced_data_length (const desfirekey_t  key
, const size_t nbytes
); 
 224 size_t  enciphered_data_length (const desfiretag_t tag
, const size_t nbytes
, int communication_settings
); 
 225 void    cmac_generate_subkeys (desfirekey_t key
); 
 226 void    cmac (const desfirekey_t  key
, uint8_t *ivect
, const uint8_t *data
, size_t len
, uint8_t *cmac
); 
 230 void RecordRawAdcSamplesIso15693(void); 
 231 void AcquireRawAdcSamplesIso15693(void); 
 232 void ReaderIso15693(uint32_t parameter
);        // Simulate an ISO15693 reader - greg 
 233 void SimTagIso15693(uint32_t parameter
, uint8_t *uid
);  // simulate an ISO15693 tag - greg 
 234 void BruteforceIso15693Afi(uint32_t speed
); // find an AFI of a tag - atrox 
 235 void DirectTag15693Command(uint32_t datalen
,uint32_t speed
, uint32_t recv
, uint8_t data
[]); // send arbitrary commands from CLI - atrox  
 236 void SetDebugIso15693(uint32_t flag
); 
 239 void RAMFUNC 
SnoopIClass(void); 
 240 void SimulateIClass(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
); 
 241 void ReaderIClass(uint8_t arg0
); 
 242 void ReaderIClass_Replay(uint8_t arg0
,uint8_t *MAC
); 
 243 void IClass_iso14443A_GetPublic(uint8_t arg0
); 
 246 void SnoopHitag(uint32_t type
); 
 247 void SimulateHitagTag(bool tag_mem_supplied
, byte_t
* data
); 
 248 void ReaderHitag(hitag_function htf
, hitag_data
* htd
); 
 251 bool cmd_receive(UsbCommand
* cmd
); 
 252 bool cmd_send(uint32_t cmd
, uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, void* data
, size_t len
);