]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Stand Alone Mode changes for NFC (part 2)
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include "usb_cdc.h"
14 #include "cmd.h"
15
16 #include "proxmark3.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "printf.h"
20 #include "string.h"
21
22 #include <stdarg.h>
23
24 #include "legicrf.h"
25 #include <hitag2.h>
26 #include "lfsampling.h"
27 #include "BigBuf.h"
28 #include "mifareutil.h"
29 #ifdef WITH_LCD
30 #include "LCD.h"
31 #endif
32
33 // Craig Young - 14a stand-alone code
34 #ifdef WITH_ISO14443a_StandAlone
35 #include "iso14443a.h"
36 #endif
37
38 #define abs(x) ( ((x)<0) ? -(x) : (x) )
39
40 //=============================================================================
41 // A buffer where we can queue things up to be sent through the FPGA, for
42 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
43 // is the order in which they go out on the wire.
44 //=============================================================================
45
46 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
47 uint8_t ToSend[TOSEND_BUFFER_SIZE];
48 int ToSendMax;
49 static int ToSendBit;
50 struct common_area common_area __attribute__((section(".commonarea")));
51
52 void ToSendReset(void)
53 {
54 ToSendMax = -1;
55 ToSendBit = 8;
56 }
57
58 void ToSendStuffBit(int b)
59 {
60 if(ToSendBit >= 8) {
61 ToSendMax++;
62 ToSend[ToSendMax] = 0;
63 ToSendBit = 0;
64 }
65
66 if(b) {
67 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
68 }
69
70 ToSendBit++;
71
72 if(ToSendMax >= sizeof(ToSend)) {
73 ToSendBit = 0;
74 DbpString("ToSendStuffBit overflowed!");
75 }
76 }
77
78 //=============================================================================
79 // Debug print functions, to go out over USB, to the usual PC-side client.
80 //=============================================================================
81
82 void DbpString(char *str)
83 {
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
86 }
87
88 #if 0
89 void DbpIntegers(int x1, int x2, int x3)
90 {
91 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
92 }
93 #endif
94
95 void Dbprintf(const char *fmt, ...) {
96 // should probably limit size here; oh well, let's just use a big buffer
97 char output_string[128];
98 va_list ap;
99
100 va_start(ap, fmt);
101 kvsprintf(fmt, output_string, 10, ap);
102 va_end(ap);
103
104 DbpString(output_string);
105 }
106
107 // prints HEX & ASCII
108 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
109 int l=0,i;
110 char ascii[9];
111
112 while (len>0) {
113 if (len>8) l=8;
114 else l=len;
115
116 memcpy(ascii,d,l);
117 ascii[l]=0;
118
119 // filter safe ascii
120 for (i=0;i<l;i++)
121 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
122
123 if (bAsci) {
124 Dbprintf("%-8s %*D",ascii,l,d," ");
125 } else {
126 Dbprintf("%*D",l,d," ");
127 }
128
129 len-=8;
130 d+=8;
131 }
132 }
133
134 //-----------------------------------------------------------------------------
135 // Read an ADC channel and block till it completes, then return the result
136 // in ADC units (0 to 1023). Also a routine to average 32 samples and
137 // return that.
138 //-----------------------------------------------------------------------------
139 static int ReadAdc(int ch)
140 {
141 uint32_t d;
142
143 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
144 AT91C_BASE_ADC->ADC_MR =
145 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
146 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
147 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
148
149 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
150 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
151 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
152 //
153 // The maths are:
154 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
155 //
156 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
157 //
158 // Note: with the "historic" values in the comments above, the error was 34% !!!
159
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161
162 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
163
164 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
165 ;
166 d = AT91C_BASE_ADC->ADC_CDR[ch];
167
168 return d;
169 }
170
171 int AvgAdc(int ch) // was static - merlok
172 {
173 int i;
174 int a = 0;
175
176 for(i = 0; i < 32; i++) {
177 a += ReadAdc(ch);
178 }
179
180 return (a + 15) >> 5;
181 }
182
183 void MeasureAntennaTuning(void)
184 {
185 uint8_t LF_Results[256];
186 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
187 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
188
189 LED_B_ON();
190
191 /*
192 * Sweeps the useful LF range of the proxmark from
193 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
194 * read the voltage in the antenna, the result left
195 * in the buffer is a graph which should clearly show
196 * the resonating frequency of your LF antenna
197 * ( hopefully around 95 if it is tuned to 125kHz!)
198 */
199
200 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
201 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
202 for (i=255; i>=19; i--) {
203 WDT_HIT();
204 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
205 SpinDelay(20);
206 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
207 if (i==95) vLf125 = adcval; // voltage at 125Khz
208 if (i==89) vLf134 = adcval; // voltage at 134Khz
209
210 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
211 if(LF_Results[i] > peak) {
212 peakv = adcval;
213 peak = LF_Results[i];
214 peakf = i;
215 //ptr = i;
216 }
217 }
218
219 for (i=18; i >= 0; i--) LF_Results[i] = 0;
220
221 LED_A_ON();
222 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
223 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
224 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
225 SpinDelay(20);
226 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
227
228 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
229 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
230 LED_A_OFF();
231 LED_B_OFF();
232 return;
233 }
234
235 void MeasureAntennaTuningHf(void)
236 {
237 int vHf = 0; // in mV
238
239 DbpString("Measuring HF antenna, press button to exit");
240
241 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
242 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
243 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
244
245 for (;;) {
246 SpinDelay(20);
247 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
248
249 Dbprintf("%d mV",vHf);
250 if (BUTTON_PRESS()) break;
251 }
252 DbpString("cancelled");
253
254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
255
256 }
257
258
259 void ReadMem(int addr)
260 {
261 const uint8_t *data = ((uint8_t *)addr);
262
263 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
264 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
265 }
266
267 /* osimage version information is linked in */
268 extern struct version_information version_information;
269 /* bootrom version information is pointed to from _bootphase1_version_pointer */
270 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
271 void SendVersion(void)
272 {
273 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
274 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
275
276 /* Try to find the bootrom version information. Expect to find a pointer at
277 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
278 * pointer, then use it.
279 */
280 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
281 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
282 strcat(VersionString, "bootrom version information appears invalid\n");
283 } else {
284 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
285 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
286 }
287
288 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
289 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
290
291 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
292 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
293 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
294 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
295
296 // Send Chip ID and used flash memory
297 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
298 uint32_t compressed_data_section_size = common_area.arg1;
299 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
300 }
301 /**
302 * Prints runtime information about the PM3.
303 **/
304 void SendStatus(void)
305 {
306 BigBuf_print_status();
307 Fpga_print_status();
308 printConfig(); //LF Sampling config
309 Dbprintf("Various");
310 Dbprintf(" MF_DBGLEVEL......%d", MF_DBGLEVEL);
311 Dbprintf(" ToSendMax........%d",ToSendMax);
312 Dbprintf(" ToSendBit........%d",ToSendBit);
313 }
314
315 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
316
317 #define OPTS 2
318
319 void StandAloneMode()
320 {
321 DbpString("Stand-alone mode! No PC necessary.");
322 // Oooh pretty -- notify user we're in elite samy mode now
323 LED(LED_RED, 200);
324 LED(LED_ORANGE, 200);
325 LED(LED_GREEN, 200);
326 LED(LED_ORANGE, 200);
327 LED(LED_RED, 200);
328 LED(LED_ORANGE, 200);
329 LED(LED_GREEN, 200);
330 LED(LED_ORANGE, 200);
331 LED(LED_RED, 200);
332
333 }
334
335 #endif
336
337
338
339 #ifdef WITH_ISO14443a_StandAlone
340 void StandAloneMode14a()
341 {
342 StandAloneMode();
343 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
344
345 int selected = 0;
346 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
347 int cardRead[OPTS] = {0};
348 uint8_t readUID[10] = {0};
349 uint32_t uid_1st[OPTS]={0};
350 uint32_t uid_2nd[OPTS]={0};
351 uint32_t uid_tmp1 = 0;
352 uint32_t uid_tmp2 = 0;
353 iso14a_card_select_t hi14a_card[OPTS];
354
355 LED(selected + 1, 0);
356
357 for (;;)
358 {
359 usb_poll();
360 WDT_HIT();
361 SpinDelay(300);
362
363 if (iGotoRecord == 1 || cardRead[selected] == 0)
364 {
365 iGotoRecord = 0;
366 LEDsoff();
367 LED(selected + 1, 0);
368 LED(LED_RED2, 0);
369
370 // record
371 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
372 /* need this delay to prevent catching some weird data */
373 SpinDelay(500);
374 /* Code for reading from 14a tag */
375 uint8_t uid[10] ={0};
376 uint32_t cuid;
377 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
378
379 for ( ; ; )
380 {
381 WDT_HIT();
382 if (BUTTON_PRESS()) {
383 if (cardRead[selected]) {
384 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
385 break;
386 }
387 else if (cardRead[(selected+1)%OPTS]) {
388 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
389 selected = (selected+1)%OPTS;
390 break; // playing = 1;
391 }
392 else {
393 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
394 SpinDelay(300);
395 }
396 }
397 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
398 continue;
399 else
400 {
401 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
402 memcpy(readUID,uid,10*sizeof(uint8_t));
403 uint8_t *dst = (uint8_t *)&uid_tmp1;
404 // Set UID byte order
405 for (int i=0; i<4; i++)
406 dst[i] = uid[3-i];
407 dst = (uint8_t *)&uid_tmp2;
408 for (int i=0; i<4; i++)
409 dst[i] = uid[7-i];
410 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
411 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
412 }
413 else {
414 if (uid_tmp2) {
415 Dbprintf("Bank[%d] received a 7-byte UID",selected);
416 uid_1st[selected] = (uid_tmp1)>>8;
417 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
418 }
419 else {
420 Dbprintf("Bank[%d] received a 4-byte UID",selected);
421 uid_1st[selected] = uid_tmp1;
422 uid_2nd[selected] = uid_tmp2;
423 }
424 break;
425 }
426 }
427 }
428 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
429 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
430 LEDsoff();
431 LED(LED_GREEN, 200);
432 LED(LED_ORANGE, 200);
433 LED(LED_GREEN, 200);
434 LED(LED_ORANGE, 200);
435
436 LEDsoff();
437 LED(selected + 1, 0);
438
439 // Next state is replay:
440 playing = 1;
441
442 cardRead[selected] = 1;
443 }
444 /* MF Classic UID clone */
445 else if (iGotoClone==1)
446 {
447 iGotoClone=0;
448 LEDsoff();
449 LED(selected + 1, 0);
450 LED(LED_ORANGE, 250);
451
452
453 // record
454 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
455
456 // wait for button to be released
457 while(BUTTON_PRESS())
458 {
459 // Delay cloning until card is in place
460 WDT_HIT();
461 }
462 Dbprintf("Starting clone. [Bank: %u]", selected);
463 // need this delay to prevent catching some weird data
464 SpinDelay(500);
465 // Begin clone function here:
466 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
467 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
468 memcpy(c.d.asBytes, data, 16);
469 SendCommand(&c);
470
471 Block read is similar:
472 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
473 We need to imitate that call with blockNo 0 to set a uid.
474
475 The get and set commands are handled in this file:
476 // Work with "magic Chinese" card
477 case CMD_MIFARE_CSETBLOCK:
478 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
479 break;
480 case CMD_MIFARE_CGETBLOCK:
481 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
482 break;
483
484 mfCSetUID provides example logic for UID set workflow:
485 -Read block0 from card in field with MifareCGetBlock()
486 -Configure new values without replacing reserved bytes
487 memcpy(block0, uid, 4); // Copy UID bytes from byte array
488 // Mifare UID BCC
489 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
490 Bytes 5-7 are reserved SAK and ATQA for mifare classic
491 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
492 */
493 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
494 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
495 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
496 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
497 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
498 playing = 1;
499 }
500 else {
501 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
502 memcpy(newBlock0,oldBlock0,16);
503 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
504
505 newBlock0[0] = uid_1st[selected]>>24;
506 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
507 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
508 newBlock0[3] = 0xFF & (uid_1st[selected]);
509 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
510 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
511 MifareCSetBlock(0, 0xFF,0, newBlock0);
512 MifareCGetBlock(0x3F, 1, 0, testBlock0);
513 if (memcmp(testBlock0,newBlock0,16)==0)
514 {
515 DbpString("Cloned successfull!");
516 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
517 playing = 0;
518 iGotoRecord = 1;
519 selected = (selected+1) % OPTS;
520 }
521 else {
522 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
523 playing = 1;
524 }
525 }
526 LEDsoff();
527 LED(selected + 1, 0);
528
529 }
530 // Change where to record (or begin playing)
531 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
532 {
533 LEDsoff();
534 LED(selected + 1, 0);
535
536 // Begin transmitting
537 if (playing)
538 {
539 LED(LED_GREEN, 0);
540 DbpString("Playing");
541 for ( ; ; ) {
542 WDT_HIT();
543 int button_action = BUTTON_HELD(1000);
544 if (button_action == 0) { // No button action, proceed with sim
545 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
546 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
547 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
548 DbpString("Mifare Classic");
549 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
550 }
551 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
552 DbpString("Mifare Ultralight");
553 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
554 }
555 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
556 DbpString("Mifare DESFire");
557 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
558 }
559 else {
560 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
561 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
562 }
563 }
564 else if (button_action == BUTTON_SINGLE_CLICK) {
565 selected = (selected + 1) % OPTS;
566 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
567 iGotoRecord = 1;
568 break;
569 }
570 else if (button_action == BUTTON_HOLD) {
571 Dbprintf("Playtime over. Begin cloning...");
572 iGotoClone = 1;
573 break;
574 }
575 WDT_HIT();
576 }
577
578 /* We pressed a button so ignore it here with a delay */
579 SpinDelay(300);
580 LEDsoff();
581 LED(selected + 1, 0);
582 }
583 else
584 while(BUTTON_PRESS())
585 WDT_HIT();
586 }
587 }
588 }
589 #elif WITH_LF
590 // samy's sniff and repeat routine
591 void SamyRun()
592 {
593 StandAloneMode();
594 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
595
596 int high[OPTS], low[OPTS];
597 int selected = 0;
598 int playing = 0;
599 int cardRead = 0;
600
601 // Turn on selected LED
602 LED(selected + 1, 0);
603
604 for (;;)
605 {
606 usb_poll();
607 WDT_HIT();
608
609 // Was our button held down or pressed?
610 int button_pressed = BUTTON_HELD(1000);
611 SpinDelay(300);
612
613 // Button was held for a second, begin recording
614 if (button_pressed > 0 && cardRead == 0)
615 {
616 LEDsoff();
617 LED(selected + 1, 0);
618 LED(LED_RED2, 0);
619
620 // record
621 DbpString("Starting recording");
622
623 // wait for button to be released
624 while(BUTTON_PRESS())
625 WDT_HIT();
626
627 /* need this delay to prevent catching some weird data */
628 SpinDelay(500);
629
630 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
631 Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
632
633 LEDsoff();
634 LED(selected + 1, 0);
635 // Finished recording
636
637 // If we were previously playing, set playing off
638 // so next button push begins playing what we recorded
639 playing = 0;
640
641 cardRead = 1;
642
643 }
644
645 else if (button_pressed > 0 && cardRead == 1)
646 {
647 LEDsoff();
648 LED(selected + 1, 0);
649 LED(LED_ORANGE, 0);
650
651 // record
652 Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
653
654 // wait for button to be released
655 while(BUTTON_PRESS())
656 WDT_HIT();
657
658 /* need this delay to prevent catching some weird data */
659 SpinDelay(500);
660
661 CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
662 Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
663
664 LEDsoff();
665 LED(selected + 1, 0);
666 // Finished recording
667
668 // If we were previously playing, set playing off
669 // so next button push begins playing what we recorded
670 playing = 0;
671
672 cardRead = 0;
673
674 }
675
676 // Change where to record (or begin playing)
677 else if (button_pressed)
678 {
679 // Next option if we were previously playing
680 if (playing)
681 selected = (selected + 1) % OPTS;
682 playing = !playing;
683
684 LEDsoff();
685 LED(selected + 1, 0);
686
687 // Begin transmitting
688 if (playing)
689 {
690 LED(LED_GREEN, 0);
691 DbpString("Playing");
692 // wait for button to be released
693 while(BUTTON_PRESS())
694 WDT_HIT();
695 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
696 CmdHIDsimTAG(high[selected], low[selected], 0);
697 DbpString("Done playing");
698 if (BUTTON_HELD(1000) > 0)
699 {
700 DbpString("Exiting");
701 LEDsoff();
702 return;
703 }
704
705 /* We pressed a button so ignore it here with a delay */
706 SpinDelay(300);
707
708 // when done, we're done playing, move to next option
709 selected = (selected + 1) % OPTS;
710 playing = !playing;
711 LEDsoff();
712 LED(selected + 1, 0);
713 }
714 else
715 while(BUTTON_PRESS())
716 WDT_HIT();
717 }
718 }
719 }
720
721 #endif
722 /*
723 OBJECTIVE
724 Listen and detect an external reader. Determine the best location
725 for the antenna.
726
727 INSTRUCTIONS:
728 Inside the ListenReaderField() function, there is two mode.
729 By default, when you call the function, you will enter mode 1.
730 If you press the PM3 button one time, you will enter mode 2.
731 If you press the PM3 button a second time, you will exit the function.
732
733 DESCRIPTION OF MODE 1:
734 This mode just listens for an external reader field and lights up green
735 for HF and/or red for LF. This is the original mode of the detectreader
736 function.
737
738 DESCRIPTION OF MODE 2:
739 This mode will visually represent, using the LEDs, the actual strength of the
740 current compared to the maximum current detected. Basically, once you know
741 what kind of external reader is present, it will help you spot the best location to place
742 your antenna. You will probably not get some good results if there is a LF and a HF reader
743 at the same place! :-)
744
745 LIGHT SCHEME USED:
746 */
747 static const char LIGHT_SCHEME[] = {
748 0x0, /* ---- | No field detected */
749 0x1, /* X--- | 14% of maximum current detected */
750 0x2, /* -X-- | 29% of maximum current detected */
751 0x4, /* --X- | 43% of maximum current detected */
752 0x8, /* ---X | 57% of maximum current detected */
753 0xC, /* --XX | 71% of maximum current detected */
754 0xE, /* -XXX | 86% of maximum current detected */
755 0xF, /* XXXX | 100% of maximum current detected */
756 };
757 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
758
759 void ListenReaderField(int limit)
760 {
761 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
762 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
763 int mode=1, display_val, display_max, i;
764
765 #define LF_ONLY 1
766 #define HF_ONLY 2
767 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
768
769
770 // switch off FPGA - we don't want to measure our own signal
771 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
772 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
773
774 LEDsoff();
775
776 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
777
778 if(limit != HF_ONLY) {
779 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
780 lf_baseline = lf_av;
781 }
782
783 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
784
785 if (limit != LF_ONLY) {
786 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
787 hf_baseline = hf_av;
788 }
789
790 for(;;) {
791 if (BUTTON_PRESS()) {
792 SpinDelay(500);
793 switch (mode) {
794 case 1:
795 mode=2;
796 DbpString("Signal Strength Mode");
797 break;
798 case 2:
799 default:
800 DbpString("Stopped");
801 LEDsoff();
802 return;
803 break;
804 }
805 }
806 WDT_HIT();
807
808 if (limit != HF_ONLY) {
809 if(mode == 1) {
810 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
811 LED_D_ON();
812 else
813 LED_D_OFF();
814 }
815
816 lf_av_new = AvgAdc(ADC_CHAN_LF);
817 // see if there's a significant change
818 if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
819 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
820 lf_av = lf_av_new;
821 if (lf_av > lf_max)
822 lf_max = lf_av;
823 }
824 }
825
826 if (limit != LF_ONLY) {
827 if (mode == 1){
828 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
829 LED_B_ON();
830 else
831 LED_B_OFF();
832 }
833
834 hf_av_new = AvgAdc(ADC_CHAN_HF);
835 // see if there's a significant change
836 if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
837 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
838 hf_av = hf_av_new;
839 if (hf_av > hf_max)
840 hf_max = hf_av;
841 }
842 }
843
844 if(mode == 2) {
845 if (limit == LF_ONLY) {
846 display_val = lf_av;
847 display_max = lf_max;
848 } else if (limit == HF_ONLY) {
849 display_val = hf_av;
850 display_max = hf_max;
851 } else { /* Pick one at random */
852 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
853 display_val = hf_av;
854 display_max = hf_max;
855 } else {
856 display_val = lf_av;
857 display_max = lf_max;
858 }
859 }
860 for (i=0; i<LIGHT_LEN; i++) {
861 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
862 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
863 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
864 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
865 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
866 break;
867 }
868 }
869 }
870 }
871 }
872
873 void UsbPacketReceived(uint8_t *packet, int len)
874 {
875 UsbCommand *c = (UsbCommand *)packet;
876
877 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
878
879 switch(c->cmd) {
880 #ifdef WITH_LF
881 case CMD_SET_LF_SAMPLING_CONFIG:
882 setSamplingConfig((sample_config *) c->d.asBytes);
883 break;
884 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
885 cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
886 break;
887 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
888 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
889 break;
890 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
891 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
892 break;
893 case CMD_HID_DEMOD_FSK:
894 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
895 break;
896 case CMD_HID_SIM_TAG:
897 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
898 break;
899 case CMD_FSK_SIM_TAG:
900 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
901 break;
902 case CMD_ASK_SIM_TAG:
903 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
904 break;
905 case CMD_PSK_SIM_TAG:
906 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
907 break;
908 case CMD_HID_CLONE_TAG:
909 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
910 break;
911 case CMD_IO_DEMOD_FSK:
912 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
913 break;
914 case CMD_IO_CLONE_TAG:
915 CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
916 break;
917 case CMD_EM410X_DEMOD:
918 CmdEM410xdemod(c->arg[0], 0, 0, 1);
919 break;
920 case CMD_EM410X_WRITE_TAG:
921 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
922 break;
923 case CMD_READ_TI_TYPE:
924 ReadTItag();
925 break;
926 case CMD_WRITE_TI_TYPE:
927 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
928 break;
929 case CMD_SIMULATE_TAG_125K:
930 LED_A_ON();
931 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
932 LED_A_OFF();
933 break;
934 case CMD_LF_SIMULATE_BIDIR:
935 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
936 break;
937 case CMD_INDALA_CLONE_TAG:
938 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
939 break;
940 case CMD_INDALA_CLONE_TAG_L:
941 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
942 break;
943 case CMD_T55XX_READ_BLOCK:
944 T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
945 break;
946 case CMD_T55XX_WRITE_BLOCK:
947 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
948 cmd_send(CMD_ACK,0,0,0,0,0);
949 break;
950 case CMD_T55XX_READ_TRACE:
951 T55xxReadTrace();
952 break;
953 case CMD_PCF7931_READ:
954 ReadPCF7931();
955 cmd_send(CMD_ACK,0,0,0,0,0);
956 break;
957 case CMD_EM4X_READ_WORD:
958 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
959 break;
960 case CMD_EM4X_WRITE_WORD:
961 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
962 break;
963 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
964 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
965 break;
966 #endif
967
968 #ifdef WITH_HITAG
969 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
970 SnoopHitag(c->arg[0]);
971 break;
972 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
973 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
974 break;
975 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
976 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
977 break;
978 #endif
979
980 #ifdef WITH_ISO15693
981 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
982 AcquireRawAdcSamplesIso15693();
983 break;
984 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
985 RecordRawAdcSamplesIso15693();
986 break;
987
988 case CMD_ISO_15693_COMMAND:
989 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
990 break;
991
992 case CMD_ISO_15693_FIND_AFI:
993 BruteforceIso15693Afi(c->arg[0]);
994 break;
995
996 case CMD_ISO_15693_DEBUG:
997 SetDebugIso15693(c->arg[0]);
998 break;
999
1000 case CMD_READER_ISO_15693:
1001 ReaderIso15693(c->arg[0]);
1002 break;
1003 case CMD_SIMTAG_ISO_15693:
1004 SimTagIso15693(c->arg[0], c->d.asBytes);
1005 break;
1006 #endif
1007
1008 #ifdef WITH_LEGICRF
1009 case CMD_SIMULATE_TAG_LEGIC_RF:
1010 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1011 break;
1012
1013 case CMD_WRITER_LEGIC_RF:
1014 LegicRfWriter(c->arg[1], c->arg[0]);
1015 break;
1016
1017 case CMD_READER_LEGIC_RF:
1018 LegicRfReader(c->arg[0], c->arg[1]);
1019 break;
1020 #endif
1021
1022 #ifdef WITH_ISO14443b
1023 case CMD_READ_SRI512_TAG:
1024 ReadSTMemoryIso14443b(0x0F);
1025 break;
1026 case CMD_READ_SRIX4K_TAG:
1027 ReadSTMemoryIso14443b(0x7F);
1028 break;
1029 case CMD_SNOOP_ISO_14443B:
1030 SnoopIso14443b();
1031 break;
1032 case CMD_SIMULATE_TAG_ISO_14443B:
1033 SimulateIso14443bTag();
1034 break;
1035 case CMD_ISO_14443B_COMMAND:
1036 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1037 break;
1038 #endif
1039
1040 #ifdef WITH_ISO14443a
1041 case CMD_SNOOP_ISO_14443a:
1042 SnoopIso14443a(c->arg[0]);
1043 break;
1044 case CMD_READER_ISO_14443a:
1045 ReaderIso14443a(c);
1046 break;
1047 case CMD_SIMULATE_TAG_ISO_14443a:
1048 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1049 break;
1050
1051 case CMD_EPA_PACE_COLLECT_NONCE:
1052 EPA_PACE_Collect_Nonce(c);
1053 break;
1054 case CMD_EPA_PACE_REPLAY:
1055 EPA_PACE_Replay(c);
1056 break;
1057
1058 case CMD_READER_MIFARE:
1059 ReaderMifare(c->arg[0]);
1060 break;
1061 case CMD_MIFARE_READBL:
1062 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1063 break;
1064 case CMD_MIFAREU_READBL:
1065 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1066 break;
1067 case CMD_MIFAREUC_AUTH:
1068 MifareUC_Auth(c->arg[0],c->d.asBytes);
1069 break;
1070 case CMD_MIFAREU_READCARD:
1071 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1072 break;
1073 case CMD_MIFAREUC_SETPWD:
1074 MifareUSetPwd(c->arg[0], c->d.asBytes);
1075 break;
1076 case CMD_MIFARE_READSC:
1077 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1078 break;
1079 case CMD_MIFARE_WRITEBL:
1080 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1081 break;
1082 //case CMD_MIFAREU_WRITEBL_COMPAT:
1083 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1084 //break;
1085 case CMD_MIFAREU_WRITEBL:
1086 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1087 break;
1088 case CMD_MIFARE_NESTED:
1089 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1090 break;
1091 case CMD_MIFARE_CHKKEYS:
1092 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1093 break;
1094 case CMD_SIMULATE_MIFARE_CARD:
1095 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1096 break;
1097
1098 // emulator
1099 case CMD_MIFARE_SET_DBGMODE:
1100 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1101 break;
1102 case CMD_MIFARE_EML_MEMCLR:
1103 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1104 break;
1105 case CMD_MIFARE_EML_MEMSET:
1106 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1107 break;
1108 case CMD_MIFARE_EML_MEMGET:
1109 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1110 break;
1111 case CMD_MIFARE_EML_CARDLOAD:
1112 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1113 break;
1114
1115 // Work with "magic Chinese" card
1116 case CMD_MIFARE_CSETBLOCK:
1117 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1118 break;
1119 case CMD_MIFARE_CGETBLOCK:
1120 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1121 break;
1122 case CMD_MIFARE_CIDENT:
1123 MifareCIdent();
1124 break;
1125
1126 // mifare sniffer
1127 case CMD_MIFARE_SNIFFER:
1128 SniffMifare(c->arg[0]);
1129 break;
1130
1131 #endif
1132
1133 #ifdef WITH_ICLASS
1134 // Makes use of ISO14443a FPGA Firmware
1135 case CMD_SNOOP_ICLASS:
1136 SnoopIClass();
1137 break;
1138 case CMD_SIMULATE_TAG_ICLASS:
1139 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1140 break;
1141 case CMD_READER_ICLASS:
1142 ReaderIClass(c->arg[0]);
1143 break;
1144 case CMD_READER_ICLASS_REPLAY:
1145 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1146 break;
1147 case CMD_ICLASS_EML_MEMSET:
1148 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1149 break;
1150 #endif
1151
1152 case CMD_BUFF_CLEAR:
1153 BigBuf_Clear();
1154 break;
1155
1156 case CMD_MEASURE_ANTENNA_TUNING:
1157 MeasureAntennaTuning();
1158 break;
1159
1160 case CMD_MEASURE_ANTENNA_TUNING_HF:
1161 MeasureAntennaTuningHf();
1162 break;
1163
1164 case CMD_LISTEN_READER_FIELD:
1165 ListenReaderField(c->arg[0]);
1166 break;
1167
1168 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1169 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1170 SpinDelay(200);
1171 LED_D_OFF(); // LED D indicates field ON or OFF
1172 break;
1173
1174 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1175
1176 LED_B_ON();
1177 uint8_t *BigBuf = BigBuf_get_addr();
1178 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1179 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1180 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1181 }
1182 // Trigger a finish downloading signal with an ACK frame
1183 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1184 LED_B_OFF();
1185 break;
1186
1187 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1188 uint8_t *b = BigBuf_get_addr();
1189 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1190 cmd_send(CMD_ACK,0,0,0,0,0);
1191 break;
1192 }
1193 case CMD_READ_MEM:
1194 ReadMem(c->arg[0]);
1195 break;
1196
1197 case CMD_SET_LF_DIVISOR:
1198 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1199 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1200 break;
1201
1202 case CMD_SET_ADC_MUX:
1203 switch(c->arg[0]) {
1204 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1205 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1206 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1207 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1208 }
1209 break;
1210
1211 case CMD_VERSION:
1212 SendVersion();
1213 break;
1214 case CMD_STATUS:
1215 SendStatus();
1216 break;
1217 case CMD_PING:
1218 cmd_send(CMD_ACK,0,0,0,0,0);
1219 break;
1220 #ifdef WITH_LCD
1221 case CMD_LCD_RESET:
1222 LCDReset();
1223 break;
1224 case CMD_LCD:
1225 LCDSend(c->arg[0]);
1226 break;
1227 #endif
1228 case CMD_SETUP_WRITE:
1229 case CMD_FINISH_WRITE:
1230 case CMD_HARDWARE_RESET:
1231 usb_disable();
1232 SpinDelay(1000);
1233 SpinDelay(1000);
1234 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1235 for(;;) {
1236 // We're going to reset, and the bootrom will take control.
1237 }
1238 break;
1239
1240 case CMD_START_FLASH:
1241 if(common_area.flags.bootrom_present) {
1242 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1243 }
1244 usb_disable();
1245 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1246 for(;;);
1247 break;
1248
1249 case CMD_DEVICE_INFO: {
1250 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1251 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1252 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1253 break;
1254 }
1255 default:
1256 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1257 break;
1258 }
1259 }
1260
1261 void __attribute__((noreturn)) AppMain(void)
1262 {
1263 SpinDelay(100);
1264 clear_trace();
1265 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1266 /* Initialize common area */
1267 memset(&common_area, 0, sizeof(common_area));
1268 common_area.magic = COMMON_AREA_MAGIC;
1269 common_area.version = 1;
1270 }
1271 common_area.flags.osimage_present = 1;
1272
1273 LED_D_OFF();
1274 LED_C_OFF();
1275 LED_B_OFF();
1276 LED_A_OFF();
1277
1278 // Init USB device
1279 usb_enable();
1280
1281 // The FPGA gets its clock from us from PCK0 output, so set that up.
1282 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1283 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1284 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1285 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1286 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1287 AT91C_PMC_PRES_CLK_4;
1288 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1289
1290 // Reset SPI
1291 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1292 // Reset SSC
1293 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1294
1295 // Load the FPGA image, which we have stored in our flash.
1296 // (the HF version by default)
1297 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1298
1299 StartTickCount();
1300
1301 #ifdef WITH_LCD
1302 LCDInit();
1303 #endif
1304
1305 byte_t rx[sizeof(UsbCommand)];
1306 size_t rx_len;
1307
1308 for(;;) {
1309 if (usb_poll()) {
1310 rx_len = usb_read(rx,sizeof(UsbCommand));
1311 if (rx_len) {
1312 UsbPacketReceived(rx,rx_len);
1313 }
1314 }
1315 WDT_HIT();
1316
1317 #ifdef WITH_LF
1318 #ifndef WITH_ISO14443a_StandAlone
1319 if (BUTTON_HELD(1000) > 0)
1320 SamyRun();
1321 #endif
1322 #endif
1323 #ifdef WITH_ISO14443a
1324 #ifdef WITH_ISO14443a_StandAlone
1325 if (BUTTON_HELD(1000) > 0)
1326 StandAloneMode14a();
1327 #endif
1328 #endif
1329 }
1330 }
Proxmark3 GIT tracking
Impressum, Datenschutz