]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'master' into topaz
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #include "mifareutil.h"
29 #ifdef WITH_LCD
30 #include "LCD.h"
31 #endif
32
33 // Craig Young - 14a stand-alone code
34 #ifdef WITH_ISO14443a_StandAlone
35 #include "iso14443a.h"
36 #endif
37
38 #define abs(x) ( ((x)<0) ? -(x) : (x) )
39
40 //=============================================================================
41 // A buffer where we can queue things up to be sent through the FPGA, for
42 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
43 // is the order in which they go out on the wire.
44 //=============================================================================
45
46 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
47 uint8_t ToSend[TOSEND_BUFFER_SIZE];
48 int ToSendMax;
49 static int ToSendBit;
50 struct common_area common_area __attribute__((section(".commonarea")));
51
52 void ToSendReset(void)
53 {
54 ToSendMax = -1;
55 ToSendBit = 8;
56 }
57
58 void ToSendStuffBit(int b)
59 {
60 if(ToSendBit >= 8) {
61 ToSendMax++;
62 ToSend[ToSendMax] = 0;
63 ToSendBit = 0;
64 }
65
66 if(b) {
67 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
68 }
69
70 ToSendBit++;
71
72 if(ToSendMax >= sizeof(ToSend)) {
73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76 }
77
78 //=============================================================================
79 // Debug print functions, to go out over USB, to the usual PC-side client.
80 //=============================================================================
81
82 void DbpString(char *str)
83 {
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
86 }
87
88 #if 0
89 void DbpIntegers(int x1, int x2, int x3)
90 {
91 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
92 }
93 #endif
94
95 void Dbprintf(const char *fmt, ...) {
96 // should probably limit size here; oh well, let's just use a big buffer
97 char output_string[128];
98 va_list ap;
99
100 va_start(ap, fmt);
101 kvsprintf(fmt, output_string, 10, ap);
102 va_end(ap);
103
104 DbpString(output_string);
105 }
106
107 // prints HEX & ASCII
108 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
109 int l=0,i;
110 char ascii[9];
111
112 while (len>0) {
113 if (len>8) l=8;
114 else l=len;
115
116 memcpy(ascii,d,l);
117 ascii[l]=0;
118
119 // filter safe ascii
120 for (i=0;i<l;i++)
121 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
122
123 if (bAsci) {
124 Dbprintf("%-8s %*D",ascii,l,d," ");
125 } else {
126 Dbprintf("%*D",l,d," ");
127 }
128
129 len-=8;
130 d+=8;
131 }
132 }
133
134 //-----------------------------------------------------------------------------
135 // Read an ADC channel and block till it completes, then return the result
136 // in ADC units (0 to 1023). Also a routine to average 32 samples and
137 // return that.
138 //-----------------------------------------------------------------------------
139 static int ReadAdc(int ch)
140 {
141 uint32_t d;
142
143 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
144 AT91C_BASE_ADC->ADC_MR =
145 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
146 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
147 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
148
149 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
150 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
151 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
152 //
153 // The maths are:
154 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
155 //
156 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
157 //
158 // Note: with the "historic" values in the comments above, the error was 34% !!!
159
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161
162 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
163
164 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
165 ;
166 d = AT91C_BASE_ADC->ADC_CDR[ch];
167
168 return d;
169 }
170
171 int AvgAdc(int ch) // was static - merlok
172 {
173 int i;
174 int a = 0;
175
176 for(i = 0; i < 32; i++) {
177 a += ReadAdc(ch);
178 }
179
180 return (a + 15) >> 5;
181 }
182
183 void MeasureAntennaTuning(void)
184 {
185 uint8_t LF_Results[256];
186 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
187 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
188
189 LED_B_ON();
190
191 /*
192 * Sweeps the useful LF range of the proxmark from
193 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
194 * read the voltage in the antenna, the result left
195 * in the buffer is a graph which should clearly show
196 * the resonating frequency of your LF antenna
197 * ( hopefully around 95 if it is tuned to 125kHz!)
198 */
199
200 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
201 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
202 for (i=255; i>=19; i--) {
203 WDT_HIT();
204 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
205 SpinDelay(20);
206 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
207 if (i==95) vLf125 = adcval; // voltage at 125Khz
208 if (i==89) vLf134 = adcval; // voltage at 134Khz
209
210 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
211 if(LF_Results[i] > peak) {
212 peakv = adcval;
213 peak = LF_Results[i];
214 peakf = i;
215 //ptr = i;
216 }
217 }
218
219 for (i=18; i >= 0; i--) LF_Results[i] = 0;
220
221 LED_A_ON();
222 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
223 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
224 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
225 SpinDelay(20);
226 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
227
228 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
229 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
230 LED_A_OFF();
231 LED_B_OFF();
232 return;
233 }
234
235 void MeasureAntennaTuningHf(void)
236 {
237 int vHf = 0; // in mV
238
239 DbpString("Measuring HF antenna, press button to exit");
240
241 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
242 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
243 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
244
245 for (;;) {
246 SpinDelay(20);
247 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
248
249 Dbprintf("%d mV",vHf);
250 if (BUTTON_PRESS()) break;
251 }
252 DbpString("cancelled");
253
254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
255
256 }
257
258
259 void ReadMem(int addr)
260 {
261 const uint8_t *data = ((uint8_t *)addr);
262
263 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
264 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
265 }
266
267 /* osimage version information is linked in */
268 extern struct version_information version_information;
269 /* bootrom version information is pointed to from _bootphase1_version_pointer */
270 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
271 void SendVersion(void)
272 {
273 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
274 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
275
276 /* Try to find the bootrom version information. Expect to find a pointer at
277 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
278 * pointer, then use it.
279 */
280 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
281 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
282 strcat(VersionString, "bootrom version information appears invalid\n");
283 } else {
284 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
285 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
286 }
287
288 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
289 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
290
291 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
292 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
293 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
294 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
295
296 // Send Chip ID and used flash memory
297 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
298 uint32_t compressed_data_section_size = common_area.arg1;
299 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
300 }
301
302 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
303 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
304 void printUSBSpeed(void)
305 {
306 Dbprintf("USB Speed:");
307 Dbprintf(" Sending USB packets to client...");
308
309 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
310 uint8_t *test_data = BigBuf_get_addr();
311 uint32_t end_time;
312
313 uint32_t start_time = end_time = GetTickCount();
314 uint32_t bytes_transferred = 0;
315
316 LED_B_ON();
317 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
318 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
319 end_time = GetTickCount();
320 bytes_transferred += USB_CMD_DATA_SIZE;
321 }
322 LED_B_OFF();
323
324 Dbprintf(" Time elapsed: %dms", end_time - start_time);
325 Dbprintf(" Bytes transferred: %d", bytes_transferred);
326 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
327 1000 * bytes_transferred / (end_time - start_time));
328
329 }
330
331 /**
332 * Prints runtime information about the PM3.
333 **/
334 void SendStatus(void)
335 {
336 BigBuf_print_status();
337 Fpga_print_status();
338 printConfig(); //LF Sampling config
339 printUSBSpeed();
340 Dbprintf("Various");
341 Dbprintf(" MF_DBGLEVEL......%d", MF_DBGLEVEL);
342 Dbprintf(" ToSendMax........%d",ToSendMax);
343 Dbprintf(" ToSendBit........%d",ToSendBit);
344
345 cmd_send(CMD_ACK,1,0,0,0,0);
346 }
347
348 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
349
350 #define OPTS 2
351
352 void StandAloneMode()
353 {
354 DbpString("Stand-alone mode! No PC necessary.");
355 // Oooh pretty -- notify user we're in elite samy mode now
356 LED(LED_RED, 200);
357 LED(LED_ORANGE, 200);
358 LED(LED_GREEN, 200);
359 LED(LED_ORANGE, 200);
360 LED(LED_RED, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_GREEN, 200);
363 LED(LED_ORANGE, 200);
364 LED(LED_RED, 200);
365
366 }
367
368 #endif
369
370
371
372 #ifdef WITH_ISO14443a_StandAlone
373 void StandAloneMode14a()
374 {
375 StandAloneMode();
376 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
377
378 int selected = 0;
379 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
380 int cardRead[OPTS] = {0};
381 uint8_t readUID[10] = {0};
382 uint32_t uid_1st[OPTS]={0};
383 uint32_t uid_2nd[OPTS]={0};
384 uint32_t uid_tmp1 = 0;
385 uint32_t uid_tmp2 = 0;
386 iso14a_card_select_t hi14a_card[OPTS];
387
388 LED(selected + 1, 0);
389
390 for (;;)
391 {
392 usb_poll();
393 WDT_HIT();
394 SpinDelay(300);
395
396 if (iGotoRecord == 1 || cardRead[selected] == 0)
397 {
398 iGotoRecord = 0;
399 LEDsoff();
400 LED(selected + 1, 0);
401 LED(LED_RED2, 0);
402
403 // record
404 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
405 /* need this delay to prevent catching some weird data */
406 SpinDelay(500);
407 /* Code for reading from 14a tag */
408 uint8_t uid[10] ={0};
409 uint32_t cuid;
410 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
411
412 for ( ; ; )
413 {
414 WDT_HIT();
415 if (BUTTON_PRESS()) {
416 if (cardRead[selected]) {
417 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
418 break;
419 }
420 else if (cardRead[(selected+1)%OPTS]) {
421 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
422 selected = (selected+1)%OPTS;
423 break; // playing = 1;
424 }
425 else {
426 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
427 SpinDelay(300);
428 }
429 }
430 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
431 continue;
432 else
433 {
434 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
435 memcpy(readUID,uid,10*sizeof(uint8_t));
436 uint8_t *dst = (uint8_t *)&uid_tmp1;
437 // Set UID byte order
438 for (int i=0; i<4; i++)
439 dst[i] = uid[3-i];
440 dst = (uint8_t *)&uid_tmp2;
441 for (int i=0; i<4; i++)
442 dst[i] = uid[7-i];
443 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
444 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
445 }
446 else {
447 if (uid_tmp2) {
448 Dbprintf("Bank[%d] received a 7-byte UID",selected);
449 uid_1st[selected] = (uid_tmp1)>>8;
450 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
451 }
452 else {
453 Dbprintf("Bank[%d] received a 4-byte UID",selected);
454 uid_1st[selected] = uid_tmp1;
455 uid_2nd[selected] = uid_tmp2;
456 }
457 break;
458 }
459 }
460 }
461 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
462 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
463 LEDsoff();
464 LED(LED_GREEN, 200);
465 LED(LED_ORANGE, 200);
466 LED(LED_GREEN, 200);
467 LED(LED_ORANGE, 200);
468
469 LEDsoff();
470 LED(selected + 1, 0);
471
472 // Next state is replay:
473 playing = 1;
474
475 cardRead[selected] = 1;
476 }
477 /* MF Classic UID clone */
478 else if (iGotoClone==1)
479 {
480 iGotoClone=0;
481 LEDsoff();
482 LED(selected + 1, 0);
483 LED(LED_ORANGE, 250);
484
485
486 // record
487 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
488
489 // wait for button to be released
490 while(BUTTON_PRESS())
491 {
492 // Delay cloning until card is in place
493 WDT_HIT();
494 }
495 Dbprintf("Starting clone. [Bank: %u]", selected);
496 // need this delay to prevent catching some weird data
497 SpinDelay(500);
498 // Begin clone function here:
499 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
500 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
501 memcpy(c.d.asBytes, data, 16);
502 SendCommand(&c);
503
504 Block read is similar:
505 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
506 We need to imitate that call with blockNo 0 to set a uid.
507
508 The get and set commands are handled in this file:
509 // Work with "magic Chinese" card
510 case CMD_MIFARE_CSETBLOCK:
511 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
512 break;
513 case CMD_MIFARE_CGETBLOCK:
514 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
515 break;
516
517 mfCSetUID provides example logic for UID set workflow:
518 -Read block0 from card in field with MifareCGetBlock()
519 -Configure new values without replacing reserved bytes
520 memcpy(block0, uid, 4); // Copy UID bytes from byte array
521 // Mifare UID BCC
522 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
523 Bytes 5-7 are reserved SAK and ATQA for mifare classic
524 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
525 */
526 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
527 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
528 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
529 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
530 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
531 playing = 1;
532 }
533 else {
534 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
535 memcpy(newBlock0,oldBlock0,16);
536 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
537
538 newBlock0[0] = uid_1st[selected]>>24;
539 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
540 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
541 newBlock0[3] = 0xFF & (uid_1st[selected]);
542 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
543 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
544 MifareCSetBlock(0, 0xFF,0, newBlock0);
545 MifareCGetBlock(0x3F, 1, 0, testBlock0);
546 if (memcmp(testBlock0,newBlock0,16)==0)
547 {
548 DbpString("Cloned successfull!");
549 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
550 playing = 0;
551 iGotoRecord = 1;
552 selected = (selected+1) % OPTS;
553 }
554 else {
555 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
556 playing = 1;
557 }
558 }
559 LEDsoff();
560 LED(selected + 1, 0);
561
562 }
563 // Change where to record (or begin playing)
564 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
565 {
566 LEDsoff();
567 LED(selected + 1, 0);
568
569 // Begin transmitting
570 if (playing)
571 {
572 LED(LED_GREEN, 0);
573 DbpString("Playing");
574 for ( ; ; ) {
575 WDT_HIT();
576 int button_action = BUTTON_HELD(1000);
577 if (button_action == 0) { // No button action, proceed with sim
578 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
579 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
580 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
581 DbpString("Mifare Classic");
582 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
583 }
584 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
585 DbpString("Mifare Ultralight");
586 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
587 }
588 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
589 DbpString("Mifare DESFire");
590 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
591 }
592 else {
593 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
594 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
595 }
596 }
597 else if (button_action == BUTTON_SINGLE_CLICK) {
598 selected = (selected + 1) % OPTS;
599 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
600 iGotoRecord = 1;
601 break;
602 }
603 else if (button_action == BUTTON_HOLD) {
604 Dbprintf("Playtime over. Begin cloning...");
605 iGotoClone = 1;
606 break;
607 }
608 WDT_HIT();
609 }
610
611 /* We pressed a button so ignore it here with a delay */
612 SpinDelay(300);
613 LEDsoff();
614 LED(selected + 1, 0);
615 }
616 else
617 while(BUTTON_PRESS())
618 WDT_HIT();
619 }
620 }
621 }
622 #elif WITH_LF
623 // samy's sniff and repeat routine
624 void SamyRun()
625 {
626 StandAloneMode();
627 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
628
629 int high[OPTS], low[OPTS];
630 int selected = 0;
631 int playing = 0;
632 int cardRead = 0;
633
634 // Turn on selected LED
635 LED(selected + 1, 0);
636
637 for (;;)
638 {
639 usb_poll();
640 WDT_HIT();
641
642 // Was our button held down or pressed?
643 int button_pressed = BUTTON_HELD(1000);
644 SpinDelay(300);
645
646 // Button was held for a second, begin recording
647 if (button_pressed > 0 && cardRead == 0)
648 {
649 LEDsoff();
650 LED(selected + 1, 0);
651 LED(LED_RED2, 0);
652
653 // record
654 DbpString("Starting recording");
655
656 // wait for button to be released
657 while(BUTTON_PRESS())
658 WDT_HIT();
659
660 /* need this delay to prevent catching some weird data */
661 SpinDelay(500);
662
663 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
664 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
665
666 LEDsoff();
667 LED(selected + 1, 0);
668 // Finished recording
669
670 // If we were previously playing, set playing off
671 // so next button push begins playing what we recorded
672 playing = 0;
673
674 cardRead = 1;
675
676 }
677
678 else if (button_pressed > 0 && cardRead == 1)
679 {
680 LEDsoff();
681 LED(selected + 1, 0);
682 LED(LED_ORANGE, 0);
683
684 // record
685 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
686
687 // wait for button to be released
688 while(BUTTON_PRESS())
689 WDT_HIT();
690
691 /* need this delay to prevent catching some weird data */
692 SpinDelay(500);
693
694 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
695 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
696
697 LEDsoff();
698 LED(selected + 1, 0);
699 // Finished recording
700
701 // If we were previously playing, set playing off
702 // so next button push begins playing what we recorded
703 playing = 0;
704
705 cardRead = 0;
706
707 }
708
709 // Change where to record (or begin playing)
710 else if (button_pressed)
711 {
712 // Next option if we were previously playing
713 if (playing)
714 selected = (selected + 1) % OPTS;
715 playing = !playing;
716
717 LEDsoff();
718 LED(selected + 1, 0);
719
720 // Begin transmitting
721 if (playing)
722 {
723 LED(LED_GREEN, 0);
724 DbpString("Playing");
725 // wait for button to be released
726 while(BUTTON_PRESS())
727 WDT_HIT();
728 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
729 CmdHIDsimTAG(high[selected], low[selected], 0);
730 DbpString("Done playing");
731 if (BUTTON_HELD(1000) > 0)
732 {
733 DbpString("Exiting");
734 LEDsoff();
735 return;
736 }
737
738 /* We pressed a button so ignore it here with a delay */
739 SpinDelay(300);
740
741 // when done, we're done playing, move to next option
742 selected = (selected + 1) % OPTS;
743 playing = !playing;
744 LEDsoff();
745 LED(selected + 1, 0);
746 }
747 else
748 while(BUTTON_PRESS())
749 WDT_HIT();
750 }
751 }
752 }
753
754 #endif
755 /*
756 OBJECTIVE
757 Listen and detect an external reader. Determine the best location
758 for the antenna.
759
760 INSTRUCTIONS:
761 Inside the ListenReaderField() function, there is two mode.
762 By default, when you call the function, you will enter mode 1.
763 If you press the PM3 button one time, you will enter mode 2.
764 If you press the PM3 button a second time, you will exit the function.
765
766 DESCRIPTION OF MODE 1:
767 This mode just listens for an external reader field and lights up green
768 for HF and/or red for LF. This is the original mode of the detectreader
769 function.
770
771 DESCRIPTION OF MODE 2:
772 This mode will visually represent, using the LEDs, the actual strength of the
773 current compared to the maximum current detected. Basically, once you know
774 what kind of external reader is present, it will help you spot the best location to place
775 your antenna. You will probably not get some good results if there is a LF and a HF reader
776 at the same place! :-)
777
778 LIGHT SCHEME USED:
779 */
780 static const char LIGHT_SCHEME[] = {
781 0x0, /* ---- | No field detected */
782 0x1, /* X--- | 14% of maximum current detected */
783 0x2, /* -X-- | 29% of maximum current detected */
784 0x4, /* --X- | 43% of maximum current detected */
785 0x8, /* ---X | 57% of maximum current detected */
786 0xC, /* --XX | 71% of maximum current detected */
787 0xE, /* -XXX | 86% of maximum current detected */
788 0xF, /* XXXX | 100% of maximum current detected */
789 };
790 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
791
792 void ListenReaderField(int limit)
793 {
794 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
795 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
796 int mode=1, display_val, display_max, i;
797
798 #define LF_ONLY 1
799 #define HF_ONLY 2
800 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
801
802
803 // switch off FPGA - we don't want to measure our own signal
804 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
805 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
806
807 LEDsoff();
808
809 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
810
811 if(limit != HF_ONLY) {
812 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
813 lf_baseline = lf_av;
814 }
815
816 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
817
818 if (limit != LF_ONLY) {
819 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
820 hf_baseline = hf_av;
821 }
822
823 for(;;) {
824 if (BUTTON_PRESS()) {
825 SpinDelay(500);
826 switch (mode) {
827 case 1:
828 mode=2;
829 DbpString("Signal Strength Mode");
830 break;
831 case 2:
832 default:
833 DbpString("Stopped");
834 LEDsoff();
835 return;
836 break;
837 }
838 }
839 WDT_HIT();
840
841 if (limit != HF_ONLY) {
842 if(mode == 1) {
843 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
844 LED_D_ON();
845 else
846 LED_D_OFF();
847 }
848
849 lf_av_new = AvgAdc(ADC_CHAN_LF);
850 // see if there's a significant change
851 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
852 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
853 lf_av = lf_av_new;
854 if (lf_av > lf_max)
855 lf_max = lf_av;
856 }
857 }
858
859 if (limit != LF_ONLY) {
860 if (mode == 1){
861 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
862 LED_B_ON();
863 else
864 LED_B_OFF();
865 }
866
867 hf_av_new = AvgAdc(ADC_CHAN_HF);
868 // see if there's a significant change
869 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
870 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
871 hf_av = hf_av_new;
872 if (hf_av > hf_max)
873 hf_max = hf_av;
874 }
875 }
876
877 if(mode == 2) {
878 if (limit == LF_ONLY) {
879 display_val = lf_av;
880 display_max = lf_max;
881 } else if (limit == HF_ONLY) {
882 display_val = hf_av;
883 display_max = hf_max;
884 } else { /* Pick one at random */
885 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
886 display_val = hf_av;
887 display_max = hf_max;
888 } else {
889 display_val = lf_av;
890 display_max = lf_max;
891 }
892 }
893 for (i=0; i<LIGHT_LEN; i++) {
894 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
895 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
896 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
897 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
898 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
899 break;
900 }
901 }
902 }
903 }
904 }
905
906 void UsbPacketReceived(uint8_t *packet, int len)
907 {
908 UsbCommand *c = (UsbCommand *)packet;
909
910 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
911
912 switch(c->cmd) {
913 #ifdef WITH_LF
914 case CMD_SET_LF_SAMPLING_CONFIG:
915 setSamplingConfig((sample_config *) c->d.asBytes);
916 break;
917 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
918 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
919 break;
920 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
921 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
922 break;
923 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
924 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
925 break;
926 case CMD_HID_DEMOD_FSK:
927 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
928 break;
929 case CMD_HID_SIM_TAG:
930 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
931 break;
932 case CMD_FSK_SIM_TAG:
933 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
934 break;
935 case CMD_ASK_SIM_TAG:
936 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
937 break;
938 case CMD_PSK_SIM_TAG:
939 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
940 break;
941 case CMD_HID_CLONE_TAG:
942 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
943 break;
944 case CMD_IO_DEMOD_FSK:
945 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
946 break;
947 case CMD_IO_CLONE_TAG:
948 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
949 break;
950 case CMD_EM410X_DEMOD:
951 CmdEM410xdemod(c->arg[0], 0, 0, 1);
952 break;
953 case CMD_EM410X_WRITE_TAG:
954 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
955 break;
956 case CMD_READ_TI_TYPE:
957 ReadTItag();
958 break;
959 case CMD_WRITE_TI_TYPE:
960 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
961 break;
962 case CMD_SIMULATE_TAG_125K:
963 LED_A_ON();
964 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
965 LED_A_OFF();
966 break;
967 case CMD_LF_SIMULATE_BIDIR:
968 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
969 break;
970 case CMD_INDALA_CLONE_TAG:
971 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
972 break;
973 case CMD_INDALA_CLONE_TAG_L:
974 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
975 break;
976 case CMD_T55XX_READ_BLOCK:
977 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
978 break;
979 case CMD_T55XX_WRITE_BLOCK:
980 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
981 cmd_send(CMD_ACK,0,0,0,0,0);
982 break;
983 case CMD_T55XX_READ_TRACE:
984 T55xxReadTrace();
985 break;
986 case CMD_PCF7931_READ:
987 ReadPCF7931();
988 cmd_send(CMD_ACK,0,0,0,0,0);
989 break;
990 case CMD_EM4X_READ_WORD:
991 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
992 break;
993 case CMD_EM4X_WRITE_WORD:
994 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
995 break;
996 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
997 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
998 break;
999 #endif
1000
1001 #ifdef WITH_HITAG
1002 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1003 SnoopHitag(c->arg[0]);
1004 break;
1005 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1006 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1007 break;
1008 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1009 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1010 break;
1011 #endif
1012
1013 #ifdef WITH_ISO15693
1014 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1015 AcquireRawAdcSamplesIso15693();
1016 break;
1017 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1018 RecordRawAdcSamplesIso15693();
1019 break;
1020
1021 case CMD_ISO_15693_COMMAND:
1022 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1023 break;
1024
1025 case CMD_ISO_15693_FIND_AFI:
1026 BruteforceIso15693Afi(c->arg[0]);
1027 break;
1028
1029 case CMD_ISO_15693_DEBUG:
1030 SetDebugIso15693(c->arg[0]);
1031 break;
1032
1033 case CMD_READER_ISO_15693:
1034 ReaderIso15693(c->arg[0]);
1035 break;
1036 case CMD_SIMTAG_ISO_15693:
1037 SimTagIso15693(c->arg[0], c->d.asBytes);
1038 break;
1039 #endif
1040
1041 #ifdef WITH_LEGICRF
1042 case CMD_SIMULATE_TAG_LEGIC_RF:
1043 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1044 break;
1045
1046 case CMD_WRITER_LEGIC_RF:
1047 LegicRfWriter(c->arg[1], c->arg[0]);
1048 break;
1049
1050 case CMD_READER_LEGIC_RF:
1051 LegicRfReader(c->arg[0], c->arg[1]);
1052 break;
1053 #endif
1054
1055 #ifdef WITH_ISO14443b
1056 case CMD_READ_SRI512_TAG:
1057 ReadSTMemoryIso14443b(0x0F);
1058 break;
1059 case CMD_READ_SRIX4K_TAG:
1060 ReadSTMemoryIso14443b(0x7F);
1061 break;
1062 case CMD_SNOOP_ISO_14443B:
1063 SnoopIso14443b();
1064 break;
1065 case CMD_SIMULATE_TAG_ISO_14443B:
1066 SimulateIso14443bTag();
1067 break;
1068 case CMD_ISO_14443B_COMMAND:
1069 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1070 break;
1071 #endif
1072
1073 #ifdef WITH_ISO14443a
1074 case CMD_SNOOP_ISO_14443a:
1075 SnoopIso14443a(c->arg[0]);
1076 break;
1077 case CMD_READER_ISO_14443a:
1078 ReaderIso14443a(c);
1079 break;
1080 case CMD_SIMULATE_TAG_ISO_14443a:
1081 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1082 break;
1083
1084 case CMD_EPA_PACE_COLLECT_NONCE:
1085 EPA_PACE_Collect_Nonce(c);
1086 break;
1087 case CMD_EPA_PACE_REPLAY:
1088 EPA_PACE_Replay(c);
1089 break;
1090
1091 case CMD_READER_MIFARE:
1092 ReaderMifare(c->arg[0]);
1093 break;
1094 case CMD_MIFARE_READBL:
1095 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1096 break;
1097 case CMD_MIFAREU_READBL:
1098 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1099 break;
1100 case CMD_MIFAREUC_AUTH:
1101 MifareUC_Auth(c->arg[0],c->d.asBytes);
1102 break;
1103 case CMD_MIFAREU_READCARD:
1104 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1105 break;
1106 case CMD_MIFAREUC_SETPWD:
1107 MifareUSetPwd(c->arg[0], c->d.asBytes);
1108 break;
1109 case CMD_MIFARE_READSC:
1110 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1111 break;
1112 case CMD_MIFARE_WRITEBL:
1113 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1114 break;
1115 //case CMD_MIFAREU_WRITEBL_COMPAT:
1116 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1117 //break;
1118 case CMD_MIFAREU_WRITEBL:
1119 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1120 break;
1121 case CMD_MIFARE_NESTED:
1122 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1123 break;
1124 case CMD_MIFARE_CHKKEYS:
1125 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1126 break;
1127 case CMD_SIMULATE_MIFARE_CARD:
1128 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1129 break;
1130
1131 // emulator
1132 case CMD_MIFARE_SET_DBGMODE:
1133 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1134 break;
1135 case CMD_MIFARE_EML_MEMCLR:
1136 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1137 break;
1138 case CMD_MIFARE_EML_MEMSET:
1139 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1140 break;
1141 case CMD_MIFARE_EML_MEMGET:
1142 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1143 break;
1144 case CMD_MIFARE_EML_CARDLOAD:
1145 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1146 break;
1147
1148 // Work with "magic Chinese" card
1149 case CMD_MIFARE_CSETBLOCK:
1150 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1151 break;
1152 case CMD_MIFARE_CGETBLOCK:
1153 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1154 break;
1155 case CMD_MIFARE_CIDENT:
1156 MifareCIdent();
1157 break;
1158
1159 // mifare sniffer
1160 case CMD_MIFARE_SNIFFER:
1161 SniffMifare(c->arg[0]);
1162 break;
1163
1164 #endif
1165
1166 #ifdef WITH_ICLASS
1167 // Makes use of ISO14443a FPGA Firmware
1168 case CMD_SNOOP_ICLASS:
1169 SnoopIClass();
1170 break;
1171 case CMD_SIMULATE_TAG_ICLASS:
1172 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1173 break;
1174 case CMD_READER_ICLASS:
1175 ReaderIClass(c->arg[0]);
1176 break;
1177 case CMD_READER_ICLASS_REPLAY:
1178 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1179 break;
1180 case CMD_ICLASS_EML_MEMSET:
1181 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1182 break;
1183 #endif
1184
1185 case CMD_BUFF_CLEAR:
1186 BigBuf_Clear();
1187 break;
1188
1189 case CMD_MEASURE_ANTENNA_TUNING:
1190 MeasureAntennaTuning();
1191 break;
1192
1193 case CMD_MEASURE_ANTENNA_TUNING_HF:
1194 MeasureAntennaTuningHf();
1195 break;
1196
1197 case CMD_LISTEN_READER_FIELD:
1198 ListenReaderField(c->arg[0]);
1199 break;
1200
1201 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1202 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1203 SpinDelay(200);
1204 LED_D_OFF(); // LED D indicates field ON or OFF
1205 break;
1206
1207 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1208
1209 LED_B_ON();
1210 uint8_t *BigBuf = BigBuf_get_addr();
1211 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1212 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1213 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1214 }
1215 // Trigger a finish downloading signal with an ACK frame
1216 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1217 LED_B_OFF();
1218 break;
1219
1220 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1221 uint8_t *b = BigBuf_get_addr();
1222 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1223 cmd_send(CMD_ACK,0,0,0,0,0);
1224 break;
1225 }
1226 case CMD_READ_MEM:
1227 ReadMem(c->arg[0]);
1228 break;
1229
1230 case CMD_SET_LF_DIVISOR:
1231 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1232 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1233 break;
1234
1235 case CMD_SET_ADC_MUX:
1236 switch(c->arg[0]) {
1237 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1238 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1239 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1240 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1241 }
1242 break;
1243
1244 case CMD_VERSION:
1245 SendVersion();
1246 break;
1247 case CMD_STATUS:
1248 SendStatus();
1249 break;
1250 case CMD_PING:
1251 cmd_send(CMD_ACK,0,0,0,0,0);
1252 break;
1253 #ifdef WITH_LCD
1254 case CMD_LCD_RESET:
1255 LCDReset();
1256 break;
1257 case CMD_LCD:
1258 LCDSend(c->arg[0]);
1259 break;
1260 #endif
1261 case CMD_SETUP_WRITE:
1262 case CMD_FINISH_WRITE:
1263 case CMD_HARDWARE_RESET:
1264 usb_disable();
1265 SpinDelay(1000);
1266 SpinDelay(1000);
1267 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1268 for(;;) {
1269 // We're going to reset, and the bootrom will take control.
1270 }
1271 break;
1272
1273 case CMD_START_FLASH:
1274 if(common_area.flags.bootrom_present) {
1275 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1276 }
1277 usb_disable();
1278 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1279 for(;;);
1280 break;
1281
1282 case CMD_DEVICE_INFO: {
1283 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1284 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1285 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1286 break;
1287 }
1288 default:
1289 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1290 break;
1291 }
1292 }
1293
1294 void __attribute__((noreturn)) AppMain(void)
1295 {
1296 SpinDelay(100);
1297 clear_trace();
1298 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1299 /* Initialize common area */
1300 memset(&common_area, 0, sizeof(common_area));
1301 common_area.magic = COMMON_AREA_MAGIC;
1302 common_area.version = 1;
1303 }
1304 common_area.flags.osimage_present = 1;
1305
1306 LED_D_OFF();
1307 LED_C_OFF();
1308 LED_B_OFF();
1309 LED_A_OFF();
1310
1311 // Init USB device
1312 usb_enable();
1313
1314 // The FPGA gets its clock from us from PCK0 output, so set that up.
1315 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1316 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1317 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1318 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1319 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1320 AT91C_PMC_PRES_CLK_4;
1321 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1322
1323 // Reset SPI
1324 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1325 // Reset SSC
1326 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1327
1328 // Load the FPGA image, which we have stored in our flash.
1329 // (the HF version by default)
1330 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1331
1332 StartTickCount();
1333
1334 #ifdef WITH_LCD
1335 LCDInit();
1336 #endif
1337
1338 byte_t rx[sizeof(UsbCommand)];
1339 size_t rx_len;
1340
1341 for(;;) {
1342 if (usb_poll()) {
1343 rx_len = usb_read(rx,sizeof(UsbCommand));
1344 if (rx_len) {
1345 UsbPacketReceived(rx,rx_len);
1346 }
1347 }
1348 WDT_HIT();
1349
1350 #ifdef WITH_LF
1351 #ifndef WITH_ISO14443a_StandAlone
1352 if (BUTTON_HELD(1000) > 0)
1353 SamyRun();
1354 #endif
1355 #endif
1356 #ifdef WITH_ISO14443a
1357 #ifdef WITH_ISO14443a_StandAlone
1358 if (BUTTON_HELD(1000) > 0)
1359 StandAloneMode14a();
1360 #endif
1361 #endif
1362 }
1363 }
Proxmark3 GIT tracking
Impressum, Datenschutz