]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


d50ef640e593c60bb70f730c796b3df9620984d5
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12 #include "usb_cdc.h"
13 //#include "cmd.h"
14 #include "proxmark3.h"
15 #include "apps.h"
16 #include "util.h"
17 #include "printf.h"
18 #include "string.h"
19 #include <stdarg.h>
20 #include "legicrf.h"
21 #include "hitag2.h"
22 #include "hitagS.h"
23 #include "lfsampling.h"
24 #include "BigBuf.h"
25 #include "mifareutil.h"
26 #include "pcf7931.h"
27
28 #ifdef WITH_LCD
29 #include "LCD.h"
30 #endif
31
32 // Craig Young - 14a stand-alone code
33 #ifdef WITH_ISO14443a_StandAlone
34 #include "iso14443a.h"
35 #include "protocols.h"
36 #endif
37
38 //=============================================================================
39 // A buffer where we can queue things up to be sent through the FPGA, for
40 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
41 // is the order in which they go out on the wire.
42 //=============================================================================
43
44 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
45 uint8_t ToSend[TOSEND_BUFFER_SIZE];
46 int ToSendMax = 0;
47 static int ToSendBit;
48 struct common_area common_area __attribute__((section(".commonarea")));
49
50 void ToSendReset(void)
51 {
52 ToSendMax = -1;
53 ToSendBit = 8;
54 }
55
56 void ToSendStuffBit(int b) {
57 if(ToSendBit >= 8) {
58 ++ToSendMax;
59 ToSend[ToSendMax] = 0;
60 ToSendBit = 0;
61 }
62
63 if(b)
64 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
65
66 ++ToSendBit;
67
68 if(ToSendMax >= sizeof(ToSend)) {
69 ToSendBit = 0;
70 DbpString("ToSendStuffBit overflowed!");
71 }
72 }
73
74 void PrintToSendBuffer(void){
75 DbpString("Printing ToSendBuffer:");
76 Dbhexdump(ToSendMax, ToSend, 0);
77 }
78
79 //=============================================================================
80 // Debug print functions, to go out over USB, to the usual PC-side client.
81 //=============================================================================
82
83 void DbpStringEx(char *str, uint32_t cmd){
84 byte_t len = strlen(str);
85 cmd_send(CMD_DEBUG_PRINT_STRING,len, cmd,0,(byte_t*)str,len);
86 }
87
88 void DbpString(char *str) {
89 DbpStringEx(str, 0);
90 }
91
92 #if 0
93 void DbpIntegers(int x1, int x2, int x3) {
94 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
95 }
96 #endif
97 void DbprintfEx(uint32_t cmd, const char *fmt, ...) {
98 // should probably limit size here; oh well, let's just use a big buffer
99 char output_string[128] = {0x00};
100 va_list ap;
101
102 va_start(ap, fmt);
103 kvsprintf(fmt, output_string, 10, ap);
104 va_end(ap);
105
106 DbpStringEx(output_string, cmd);
107 }
108
109 void Dbprintf(const char *fmt, ...) {
110 // should probably limit size here; oh well, let's just use a big buffer
111 char output_string[128] = {0x00};
112 va_list ap;
113
114 va_start(ap, fmt);
115 kvsprintf(fmt, output_string, 10, ap);
116 va_end(ap);
117
118 DbpString(output_string);
119 }
120
121 // prints HEX & ASCII
122 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
123 int l=0, i;
124 char ascii[9];
125
126 while (len>0) {
127
128 l = (len>8) ? 8 : len;
129
130 memcpy(ascii,d,l);
131 ascii[l]=0;
132
133 // filter safe ascii
134 for (i=0; i<l; ++i)
135 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
136
137 if (bAsci)
138 Dbprintf("%-8s %*D",ascii,l,d," ");
139 else
140 Dbprintf("%*D",l,d," ");
141
142 len -= 8;
143 d += 8;
144 }
145 }
146
147 //-----------------------------------------------------------------------------
148 // Read an ADC channel and block till it completes, then return the result
149 // in ADC units (0 to 1023). Also a routine to average 32 samples and
150 // return that.
151 //-----------------------------------------------------------------------------
152 static int ReadAdc(int ch)
153 {
154 uint32_t d;
155
156 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
157 AT91C_BASE_ADC->ADC_MR =
158 ADC_MODE_PRESCALE(63 /* was 32 */) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
159 ADC_MODE_STARTUP_TIME(1 /* was 16 */) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
160 ADC_MODE_SAMPLE_HOLD_TIME(15 /* was 8 */); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
161
162 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
163 // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
164 // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
165 //
166 // The maths are:
167 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
168 //
169 // v_cap = v_in * (1 - exp(-RC/SHTIM)) = v_in * (1 - exp(-3)) = v_in * 0,95 (i.e. an error of 5%)
170 //
171 // Note: with the "historic" values in the comments above, the error was 34% !!!
172
173 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
174
175 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
176
177 while (!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) ;
178
179 d = AT91C_BASE_ADC->ADC_CDR[ch];
180 return d;
181 }
182
183 int AvgAdc(int ch) // was static - merlok
184 {
185 int i;
186 int a = 0;
187
188 for(i = 0; i < 32; ++i)
189 a += ReadAdc(ch);
190
191 return (a + 15) >> 5;
192 }
193
194
195 void MeasureAntennaTuning(void) {
196
197 uint8_t LF_Results[256];
198 int i, adcval = 0, peak = 0, peakv = 0, peakf = 0;
199 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
200
201 memset(LF_Results, 0, sizeof(LF_Results));
202 LED_B_ON();
203
204 /*
205 * Sweeps the useful LF range of the proxmark from
206 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
207 * read the voltage in the antenna, the result left
208 * in the buffer is a graph which should clearly show
209 * the resonating frequency of your LF antenna
210 * ( hopefully around 95 if it is tuned to 125kHz!)
211 */
212
213 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
214 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
215
216 for (i = 255; i >= 19; i--) {
217 WDT_HIT();
218 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
219 SpinDelay(20);
220 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
221 if (i==95) vLf125 = adcval; // voltage at 125Khz
222 if (i==89) vLf134 = adcval; // voltage at 134Khz
223
224 LF_Results[i] = adcval >> 8; // scale int to fit in byte for graphing purposes
225 if(LF_Results[i] > peak) {
226 peakv = adcval;
227 peak = LF_Results[i];
228 peakf = i;
229 }
230 }
231
232 LED_A_ON();
233 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
234 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
235 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
236 SpinDelay(20);
237 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
238
239 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134 << 16), vHf, peakf | (peakv << 16), LF_Results, 256);
240 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
241
242 BigBuf_free(); BigBuf_Clear_ext(false);
243 LEDsoff();
244 }
245
246 void MeasureAntennaTuningHf(void) {
247 int vHf = 0; // in mV
248 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
249 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
250 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
251
252 while ( !BUTTON_PRESS() ){
253 SpinDelay(20);
254 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
255 //Dbprintf("%d mV",vHf);
256 DbprintfEx(CMD_MEASURE_ANTENNA_TUNING_HF, "%d mV",vHf);
257 }
258 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
259 DbpString("cancelled");
260 }
261
262
263 void ReadMem(int addr) {
264 const uint8_t *data = ((uint8_t *)addr);
265
266 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
267 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
268 }
269
270 /* osimage version information is linked in */
271 extern struct version_information version_information;
272 /* bootrom version information is pointed to from _bootphase1_version_pointer */
273 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
274 void SendVersion(void)
275 {
276 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
277 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
278
279 /* Try to find the bootrom version information. Expect to find a pointer at
280 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
281 * pointer, then use it.
282 */
283 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
284
285 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
286 strcat(VersionString, "bootrom version information appears invalid\n");
287 } else {
288 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
289 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
290 }
291
292 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
293 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
294
295 FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
296 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
297
298 FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
299 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
300
301 // Send Chip ID and used flash memory
302 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
303 uint32_t compressed_data_section_size = common_area.arg1;
304 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
305 }
306
307 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
308 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
309 void printUSBSpeed(void)
310 {
311 Dbprintf("USB Speed:");
312 Dbprintf(" Sending USB packets to client...");
313
314 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
315 uint8_t *test_data = BigBuf_get_addr();
316 uint32_t end_time;
317
318 uint32_t start_time = end_time = GetTickCount();
319 uint32_t bytes_transferred = 0;
320
321 LED_B_ON();
322 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
323 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
324 end_time = GetTickCount();
325 bytes_transferred += USB_CMD_DATA_SIZE;
326 }
327 LED_B_OFF();
328
329 Dbprintf(" Time elapsed: %dms", end_time - start_time);
330 Dbprintf(" Bytes transferred: %d", bytes_transferred);
331 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
332 1000 * bytes_transferred / (end_time - start_time));
333
334 }
335
336 /**
337 * Prints runtime information about the PM3.
338 **/
339 void SendStatus(void) {
340 BigBuf_print_status();
341 Fpga_print_status();
342 printConfig(); //LF Sampling config
343 printUSBSpeed();
344 Dbprintf("Various");
345 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
346 Dbprintf(" ToSendMax..........%d", ToSendMax);
347 Dbprintf(" ToSendBit..........%d", ToSendBit);
348 Dbprintf(" ToSend BUFFERSIZE..%d", TOSEND_BUFFER_SIZE);
349
350 cmd_send(CMD_ACK,1,0,0,0,0);
351 }
352
353 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
354
355 #define OPTS 2
356 void StandAloneMode()
357 {
358 DbpString("Stand-alone mode! No PC necessary.");
359 // Oooh pretty -- notify user we're in elite samy mode now
360 LED(LED_RED, 200);
361 LED(LED_ORANGE, 200);
362 LED(LED_GREEN, 200);
363 LED(LED_ORANGE, 200);
364 LED(LED_RED, 200);
365 LED(LED_ORANGE, 200);
366 LED(LED_GREEN, 200);
367 LED(LED_ORANGE, 200);
368 LED(LED_RED, 200);
369 }
370 #endif
371
372 #ifdef WITH_ISO14443a_StandAlone
373 void StandAloneMode14a()
374 {
375 StandAloneMode();
376 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
377
378 int selected = 0;
379 int playing = 0, iGotoRecord = 0, iGotoClone = 0;
380 int cardRead[OPTS] = {0};
381 uint8_t readUID[10] = {0};
382 uint32_t uid_1st[OPTS]={0};
383 uint32_t uid_2nd[OPTS]={0};
384 uint32_t uid_tmp1 = 0;
385 uint32_t uid_tmp2 = 0;
386 iso14a_card_select_t hi14a_card[OPTS];
387
388 uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN);
389
390 LED(selected + 1, 0);
391
392 for (;;)
393 {
394 usb_poll();
395 WDT_HIT();
396 SpinDelay(300);
397
398 if (iGotoRecord == 1 || cardRead[selected] == 0)
399 {
400 iGotoRecord = 0;
401 LEDsoff();
402 LED(selected + 1, 0);
403 LED(LED_RED2, 0);
404
405 // record
406 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
407 /* need this delay to prevent catching some weird data */
408 SpinDelay(500);
409 /* Code for reading from 14a tag */
410 uint8_t uid[10] = {0};
411 uint32_t cuid = 0;
412 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
413
414 for ( ; ; )
415 {
416 WDT_HIT();
417 if (BUTTON_PRESS()) {
418 if (cardRead[selected]) {
419 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
420 break;
421 }
422 else if (cardRead[(selected+1)%OPTS]) {
423 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
424 selected = (selected+1)%OPTS;
425 break; // playing = 1;
426 }
427 else {
428 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
429 SpinDelay(300);
430 }
431 }
432 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0))
433 continue;
434 else
435 {
436 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
437 memcpy(readUID,uid,10*sizeof(uint8_t));
438 uint8_t *dst = (uint8_t *)&uid_tmp1;
439 // Set UID byte order
440 for (int i=0; i<4; i++)
441 dst[i] = uid[3-i];
442 dst = (uint8_t *)&uid_tmp2;
443 for (int i=0; i<4; i++)
444 dst[i] = uid[7-i];
445 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
446 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
447 }
448 else {
449 if (uid_tmp2) {
450 Dbprintf("Bank[%d] received a 7-byte UID",selected);
451 uid_1st[selected] = (uid_tmp1)>>8;
452 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
453 }
454 else {
455 Dbprintf("Bank[%d] received a 4-byte UID",selected);
456 uid_1st[selected] = uid_tmp1;
457 uid_2nd[selected] = uid_tmp2;
458 }
459 break;
460 }
461 }
462 }
463 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
464 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
465 LEDsoff();
466 LED(LED_GREEN, 200);
467 LED(LED_ORANGE, 200);
468 LED(LED_GREEN, 200);
469 LED(LED_ORANGE, 200);
470
471 LEDsoff();
472 LED(selected + 1, 0);
473
474 // Next state is replay:
475 playing = 1;
476
477 cardRead[selected] = 1;
478 }
479 /* MF Classic UID clone */
480 else if (iGotoClone==1)
481 {
482 iGotoClone=0;
483 LEDsoff();
484 LED(selected + 1, 0);
485 LED(LED_ORANGE, 250);
486
487 // record
488 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
489
490 // wait for button to be released
491 // Delay cloning until card is in place
492 while(BUTTON_PRESS())
493 WDT_HIT();
494
495 Dbprintf("Starting clone. [Bank: %u]", selected);
496 // need this delay to prevent catching some weird data
497 SpinDelay(500);
498 // Begin clone function here:
499 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
500 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}};
501 memcpy(c.d.asBytes, data, 16);
502 SendCommand(&c);
503
504 Block read is similar:
505 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
506 We need to imitate that call with blockNo 0 to set a uid.
507
508 The get and set commands are handled in this file:
509 // Work with "magic Chinese" card
510 case CMD_MIFARE_CSETBLOCK:
511 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
512 break;
513 case CMD_MIFARE_CGETBLOCK:
514 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
515 break;
516
517 mfCSetUID provides example logic for UID set workflow:
518 -Read block0 from card in field with MifareCGetBlock()
519 -Configure new values without replacing reserved bytes
520 memcpy(block0, uid, 4); // Copy UID bytes from byte array
521 // Mifare UID BCC
522 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
523 Bytes 5-7 are reserved SAK and ATQA for mifare classic
524 -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it
525 */
526 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
527 // arg0 = Flags, arg1=blockNo
528 MifareCGetBlock(params, 0, oldBlock0);
529 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
530 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
531 playing = 1;
532 }
533 else {
534 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
535 memcpy(newBlock0,oldBlock0,16);
536 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
537
538 newBlock0[0] = uid_1st[selected]>>24;
539 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
540 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
541 newBlock0[3] = 0xFF & (uid_1st[selected]);
542 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
543
544 // arg0 = workFlags, arg1 = blockNo, datain
545 MifareCSetBlock(params, 0, newBlock0);
546 MifareCGetBlock(params, 0, testBlock0);
547
548 if (memcmp(testBlock0, newBlock0, 16)==0) {
549 DbpString("Cloned successfull!");
550 cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
551 playing = 0;
552 iGotoRecord = 1;
553 selected = (selected + 1) % OPTS;
554 } else {
555 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
556 playing = 1;
557 }
558 }
559 LEDsoff();
560 LED(selected + 1, 0);
561 }
562 // Change where to record (or begin playing)
563 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
564 {
565 LEDsoff();
566 LED(selected + 1, 0);
567
568 // Begin transmitting
569 if (playing)
570 {
571 LED(LED_GREEN, 0);
572 DbpString("Playing");
573 for ( ; ; ) {
574 WDT_HIT();
575 int button_action = BUTTON_HELD(1000);
576 if (button_action == 0) { // No button action, proceed with sim
577 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
578 uint8_t flags = ( uid_2nd[selected] > 0x00 ) ? FLAG_7B_UID_IN_DATA : FLAG_4B_UID_IN_DATA;
579 num_to_bytes(uid_1st[selected], 3, data);
580 num_to_bytes(uid_2nd[selected], 4, data);
581
582 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
583 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
584 DbpString("Mifare Classic");
585 SimulateIso14443aTag(1, flags, data); // Mifare Classic
586 }
587 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
588 DbpString("Mifare Ultralight");
589 SimulateIso14443aTag(2, flags, data); // Mifare Ultralight
590 }
591 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
592 DbpString("Mifare DESFire");
593 SimulateIso14443aTag(3, flags, data); // Mifare DESFire
594 }
595 else {
596 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
597 SimulateIso14443aTag(1, flags, data);
598 }
599 }
600 else if (button_action == BUTTON_SINGLE_CLICK) {
601 selected = (selected + 1) % OPTS;
602 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
603 iGotoRecord = 1;
604 break;
605 }
606 else if (button_action == BUTTON_HOLD) {
607 Dbprintf("Playtime over. Begin cloning...");
608 iGotoClone = 1;
609 break;
610 }
611 WDT_HIT();
612 }
613
614 /* We pressed a button so ignore it here with a delay */
615 SpinDelay(300);
616 LEDsoff();
617 LED(selected + 1, 0);
618 }
619 else
620 while(BUTTON_PRESS())
621 WDT_HIT();
622 }
623 }
624 }
625 #elif WITH_LF
626 // samy's sniff and repeat routine
627 void SamyRun()
628 {
629 StandAloneMode();
630 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
631
632 int high[OPTS], low[OPTS];
633 int selected = 0;
634 int playing = 0;
635 int cardRead = 0;
636
637 // Turn on selected LED
638 LED(selected + 1, 0);
639
640 for (;;) {
641 usb_poll();
642 WDT_HIT();
643
644 // Was our button held down or pressed?
645 int button_pressed = BUTTON_HELD(1000);
646 SpinDelay(300);
647
648 // Button was held for a second, begin recording
649 if (button_pressed > 0 && cardRead == 0)
650 {
651 LEDsoff();
652 LED(selected + 1, 0);
653 LED(LED_RED2, 0);
654
655 // record
656 DbpString("Starting recording");
657
658 // wait for button to be released
659 while(BUTTON_PRESS())
660 WDT_HIT();
661
662 /* need this delay to prevent catching some weird data */
663 SpinDelay(500);
664
665 CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
666 Dbprintf("Recorded %x %x %08x", selected, high[selected], low[selected]);
667
668 LEDsoff();
669 LED(selected + 1, 0);
670 // Finished recording
671 // If we were previously playing, set playing off
672 // so next button push begins playing what we recorded
673 playing = 0;
674 cardRead = 1;
675 }
676 else if (button_pressed > 0 && cardRead == 1) {
677 LEDsoff();
678 LED(selected + 1, 0);
679 LED(LED_ORANGE, 0);
680
681 // record
682 Dbprintf("Cloning %x %x %08x", selected, high[selected], low[selected]);
683
684 // wait for button to be released
685 while(BUTTON_PRESS())
686 WDT_HIT();
687
688 /* need this delay to prevent catching some weird data */
689 SpinDelay(500);
690
691 CopyHIDtoT55x7(0, high[selected], low[selected], 0);
692 Dbprintf("Cloned %x %x %08x", selected, high[selected], low[selected]);
693
694 LEDsoff();
695 LED(selected + 1, 0);
696 // Finished recording
697
698 // If we were previously playing, set playing off
699 // so next button push begins playing what we recorded
700 playing = 0;
701 cardRead = 0;
702 }
703
704 // Change where to record (or begin playing)
705 else if (button_pressed) {
706 // Next option if we were previously playing
707 if (playing)
708 selected = (selected + 1) % OPTS;
709 playing = !playing;
710
711 LEDsoff();
712 LED(selected + 1, 0);
713
714 // Begin transmitting
715 if (playing)
716 {
717 LED(LED_GREEN, 0);
718 DbpString("Playing");
719 // wait for button to be released
720 while(BUTTON_PRESS())
721 WDT_HIT();
722
723 Dbprintf("%x %x %08x", selected, high[selected], low[selected]);
724 CmdHIDsimTAG(high[selected], low[selected], 0);
725 DbpString("Done playing");
726
727 if (BUTTON_HELD(1000) > 0) {
728 DbpString("Exiting");
729 LEDsoff();
730 return;
731 }
732
733 /* We pressed a button so ignore it here with a delay */
734 SpinDelay(300);
735
736 // when done, we're done playing, move to next option
737 selected = (selected + 1) % OPTS;
738 playing = !playing;
739 LEDsoff();
740 LED(selected + 1, 0);
741 }
742 else
743 while(BUTTON_PRESS())
744 WDT_HIT();
745 }
746 }
747 }
748
749 #endif
750 /*
751 OBJECTIVE
752 Listen and detect an external reader. Determine the best location
753 for the antenna.
754
755 INSTRUCTIONS:
756 Inside the ListenReaderField() function, there is two mode.
757 By default, when you call the function, you will enter mode 1.
758 If you press the PM3 button one time, you will enter mode 2.
759 If you press the PM3 button a second time, you will exit the function.
760
761 DESCRIPTION OF MODE 1:
762 This mode just listens for an external reader field and lights up green
763 for HF and/or red for LF. This is the original mode of the detectreader
764 function.
765
766 DESCRIPTION OF MODE 2:
767 This mode will visually represent, using the LEDs, the actual strength of the
768 current compared to the maximum current detected. Basically, once you know
769 what kind of external reader is present, it will help you spot the best location to place
770 your antenna. You will probably not get some good results if there is a LF and a HF reader
771 at the same place! :-)
772
773 LIGHT SCHEME USED:
774 */
775 static const char LIGHT_SCHEME[] = {
776 0x0, /* ---- | No field detected */
777 0x1, /* X--- | 14% of maximum current detected */
778 0x2, /* -X-- | 29% of maximum current detected */
779 0x4, /* --X- | 43% of maximum current detected */
780 0x8, /* ---X | 57% of maximum current detected */
781 0xC, /* --XX | 71% of maximum current detected */
782 0xE, /* -XXX | 86% of maximum current detected */
783 0xF, /* XXXX | 100% of maximum current detected */
784 };
785 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
786
787 void ListenReaderField(int limit) {
788 #define LF_ONLY 1
789 #define HF_ONLY 2
790 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
791
792 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
793 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
794 int mode=1, display_val, display_max, i;
795
796 // switch off FPGA - we don't want to measure our own signal
797 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
798 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
799
800 LEDsoff();
801
802 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
803
804 if(limit != HF_ONLY) {
805 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
806 lf_baseline = lf_av;
807 }
808
809 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
810
811 if (limit != LF_ONLY) {
812 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
813 hf_baseline = hf_av;
814 }
815
816 for(;;) {
817 if (BUTTON_PRESS()) {
818 SpinDelay(500);
819 switch (mode) {
820 case 1:
821 mode=2;
822 DbpString("Signal Strength Mode");
823 break;
824 case 2:
825 default:
826 DbpString("Stopped");
827 LEDsoff();
828 return;
829 break;
830 }
831 }
832 WDT_HIT();
833
834 if (limit != HF_ONLY) {
835 if(mode == 1) {
836 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
837 LED_D_ON();
838 else
839 LED_D_OFF();
840 }
841
842 lf_av_new = AvgAdc(ADC_CHAN_LF);
843 // see if there's a significant change
844 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
845 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
846 lf_av = lf_av_new;
847 if (lf_av > lf_max)
848 lf_max = lf_av;
849 }
850 }
851
852 if (limit != LF_ONLY) {
853 if (mode == 1){
854 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
855 LED_B_ON();
856 else
857 LED_B_OFF();
858 }
859
860 hf_av_new = AvgAdc(ADC_CHAN_HF);
861 // see if there's a significant change
862 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
863 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
864 hf_av = hf_av_new;
865 if (hf_av > hf_max)
866 hf_max = hf_av;
867 }
868 }
869
870 if(mode == 2) {
871 if (limit == LF_ONLY) {
872 display_val = lf_av;
873 display_max = lf_max;
874 } else if (limit == HF_ONLY) {
875 display_val = hf_av;
876 display_max = hf_max;
877 } else { /* Pick one at random */
878 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
879 display_val = hf_av;
880 display_max = hf_max;
881 } else {
882 display_val = lf_av;
883 display_max = lf_max;
884 }
885 }
886 for (i=0; i<LIGHT_LEN; i++) {
887 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
888 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
889 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
890 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
891 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
892 break;
893 }
894 }
895 }
896 }
897 }
898
899 void UsbPacketReceived(uint8_t *packet, int len)
900 {
901 UsbCommand *c = (UsbCommand *)packet;
902
903 //Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
904
905 switch(c->cmd) {
906 #ifdef WITH_LF
907 case CMD_SET_LF_SAMPLING_CONFIG:
908 setSamplingConfig((sample_config *) c->d.asBytes);
909 break;
910 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
911 cmd_send(CMD_ACK, SampleLF(c->arg[0]),0,0,0,0);
912 break;
913 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
914 ModThenAcquireRawAdcSamples125k(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
915 break;
916 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
917 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
918 break;
919 case CMD_HID_DEMOD_FSK:
920 CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
921 break;
922 case CMD_HID_SIM_TAG:
923 CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
924 break;
925 case CMD_FSK_SIM_TAG:
926 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
927 break;
928 case CMD_ASK_SIM_TAG:
929 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
930 break;
931 case CMD_PSK_SIM_TAG:
932 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
933 break;
934 case CMD_HID_CLONE_TAG:
935 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
936 break;
937 case CMD_IO_DEMOD_FSK:
938 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
939 break;
940 case CMD_IO_CLONE_TAG:
941 CopyIOtoT55x7(c->arg[0], c->arg[1]);
942 break;
943 case CMD_EM410X_DEMOD:
944 CmdEM410xdemod(c->arg[0], 0, 0, 1);
945 break;
946 case CMD_EM410X_WRITE_TAG:
947 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
948 break;
949 case CMD_READ_TI_TYPE:
950 ReadTItag();
951 break;
952 case CMD_WRITE_TI_TYPE:
953 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
954 break;
955 case CMD_SIMULATE_TAG_125K:
956 LED_A_ON();
957 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
958 LED_A_OFF();
959 break;
960 case CMD_LF_SIMULATE_BIDIR:
961 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
962 break;
963 case CMD_INDALA_CLONE_TAG:
964 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
965 break;
966 case CMD_INDALA_CLONE_TAG_L:
967 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
968 break;
969 case CMD_T55XX_READ_BLOCK:
970 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
971 break;
972 case CMD_T55XX_WRITE_BLOCK:
973 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
974 break;
975 case CMD_T55XX_WAKEUP:
976 T55xxWakeUp(c->arg[0]);
977 break;
978 case CMD_T55XX_RESET_READ:
979 T55xxResetRead();
980 break;
981 case CMD_PCF7931_READ:
982 ReadPCF7931();
983 break;
984 case CMD_PCF7931_WRITE:
985 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
986 break;
987 case CMD_EM4X_READ_WORD:
988 EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
989 break;
990 case CMD_EM4X_WRITE_WORD:
991 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
992 break;
993 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
994 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
995 break;
996 case CMD_VIKING_CLONE_TAG:
997 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
998 break;
999 #endif
1000
1001 #ifdef WITH_HITAG
1002 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1003 SnoopHitag(c->arg[0]);
1004 break;
1005 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1006 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1007 break;
1008 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1009 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1010 break;
1011 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1012 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1013 break;
1014 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1015 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1016 break;
1017 case CMD_READ_HITAG_S: //Reader for only Hitag S tags, args = key or challenge
1018 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1019 break;
1020 case CMD_WR_HITAG_S: //writer for Hitag tags args=data to write,page and key or challenge
1021 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1022 break;
1023 #endif
1024
1025 #ifdef WITH_ISO15693
1026 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1027 AcquireRawAdcSamplesIso15693();
1028 break;
1029 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1030 RecordRawAdcSamplesIso15693();
1031 break;
1032
1033 case CMD_ISO_15693_COMMAND:
1034 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1035 break;
1036
1037 case CMD_ISO_15693_FIND_AFI:
1038 BruteforceIso15693Afi(c->arg[0]);
1039 break;
1040
1041 case CMD_ISO_15693_DEBUG:
1042 SetDebugIso15693(c->arg[0]);
1043 break;
1044
1045 case CMD_READER_ISO_15693:
1046 ReaderIso15693(c->arg[0]);
1047 break;
1048 case CMD_SIMTAG_ISO_15693:
1049 SimTagIso15693(c->arg[0], c->d.asBytes);
1050 break;
1051 #endif
1052
1053 #ifdef WITH_LEGICRF
1054 case CMD_SIMULATE_TAG_LEGIC_RF:
1055 LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1056 break;
1057
1058 case CMD_WRITER_LEGIC_RF:
1059 LegicRfWriter( c->arg[0], c->arg[1], c->arg[2]);
1060 break;
1061
1062 case CMD_RAW_WRITER_LEGIC_RF:
1063 LegicRfRawWriter(c->arg[0], c->arg[1], c->arg[2]);
1064 break;
1065
1066 case CMD_READER_LEGIC_RF:
1067 LegicRfReader(c->arg[0], c->arg[1], c->arg[2]);
1068 break;
1069 #endif
1070
1071 #ifdef WITH_ISO14443b
1072 case CMD_READ_SRI_TAG:
1073 ReadSTMemoryIso14443b(c->arg[0]);
1074 break;
1075 case CMD_SNOOP_ISO_14443B:
1076 SnoopIso14443b();
1077 break;
1078 case CMD_SIMULATE_TAG_ISO_14443B:
1079 SimulateIso14443bTag(c->arg[0]);
1080 break;
1081 case CMD_ISO_14443B_COMMAND:
1082 //SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1083 SendRawCommand14443B_Ex(c);
1084 break;
1085 #endif
1086
1087 #ifdef WITH_ISO14443a
1088 case CMD_SNOOP_ISO_14443a:
1089 SniffIso14443a(c->arg[0]);
1090 break;
1091 case CMD_READER_ISO_14443a:
1092 ReaderIso14443a(c);
1093 break;
1094 case CMD_SIMULATE_TAG_ISO_14443a:
1095 SimulateIso14443aTag(c->arg[0], c->arg[1], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1096 break;
1097 case CMD_EPA_PACE_COLLECT_NONCE:
1098 EPA_PACE_Collect_Nonce(c);
1099 break;
1100 case CMD_EPA_PACE_REPLAY:
1101 EPA_PACE_Replay(c);
1102 break;
1103 case CMD_READER_MIFARE:
1104 ReaderMifare(c->arg[0], c->arg[1], c->arg[2]);
1105 break;
1106 case CMD_MIFARE_READBL:
1107 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1108 break;
1109 case CMD_MIFAREU_READBL:
1110 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1111 break;
1112 case CMD_MIFAREUC_AUTH:
1113 MifareUC_Auth(c->arg[0],c->d.asBytes);
1114 break;
1115 case CMD_MIFAREU_READCARD:
1116 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1117 break;
1118 case CMD_MIFAREUC_SETPWD:
1119 MifareUSetPwd(c->arg[0], c->d.asBytes);
1120 break;
1121 case CMD_MIFARE_READSC:
1122 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1123 break;
1124 case CMD_MIFARE_WRITEBL:
1125 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1126 break;
1127 //case CMD_MIFAREU_WRITEBL_COMPAT:
1128 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1129 //break;
1130 case CMD_MIFAREU_WRITEBL:
1131 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1132 break;
1133 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1134 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1135 break;
1136 case CMD_MIFARE_NESTED:
1137 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1138 break;
1139 case CMD_MIFARE_CHKKEYS:
1140 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1141 break;
1142 case CMD_SIMULATE_MIFARE_CARD:
1143 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1144 break;
1145
1146 // emulator
1147 case CMD_MIFARE_SET_DBGMODE:
1148 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1149 break;
1150 case CMD_MIFARE_EML_MEMCLR:
1151 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1152 break;
1153 case CMD_MIFARE_EML_MEMSET:
1154 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1155 break;
1156 case CMD_MIFARE_EML_MEMGET:
1157 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1158 break;
1159 case CMD_MIFARE_EML_CARDLOAD:
1160 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1161 break;
1162
1163 // Work with "magic Chinese" card
1164 case CMD_MIFARE_CSETBLOCK:
1165 MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1166 break;
1167 case CMD_MIFARE_CGETBLOCK:
1168 MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes);
1169 break;
1170 case CMD_MIFARE_CIDENT:
1171 MifareCIdent();
1172 break;
1173
1174 // mifare sniffer
1175 case CMD_MIFARE_SNIFFER:
1176 SniffMifare(c->arg[0]);
1177 break;
1178
1179 //mifare desfire
1180 case CMD_MIFARE_DESFIRE_READBL: break;
1181 case CMD_MIFARE_DESFIRE_WRITEBL: break;
1182 case CMD_MIFARE_DESFIRE_AUTH1:
1183 MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1184 break;
1185 case CMD_MIFARE_DESFIRE_AUTH2:
1186 //MifareDES_Auth2(c->arg[0],c->d.asBytes);
1187 break;
1188 case CMD_MIFARE_DES_READER:
1189 //readermifaredes(c->arg[0], c->arg[1], c->d.asBytes);
1190 break;
1191 case CMD_MIFARE_DESFIRE_INFO:
1192 MifareDesfireGetInformation();
1193 break;
1194 case CMD_MIFARE_DESFIRE:
1195 MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
1196 break;
1197
1198 case CMD_MIFARE_COLLECT_NONCES:
1199 break;
1200 #endif
1201 #ifdef WITH_EMV
1202 case CMD_EMV_TRANSACTION:
1203 EMVTransaction();
1204 break;
1205 case CMD_EMV_GET_RANDOM_NUM:
1206 //EMVgetUDOL();
1207 break;
1208 case CMD_EMV_LOAD_VALUE:
1209 EMVloadvalue(c->arg[0], c->d.asBytes);
1210 break;
1211 case CMD_EMV_DUMP_CARD:
1212 EMVdumpcard();
1213 #endif
1214 #ifdef WITH_ICLASS
1215 // Makes use of ISO14443a FPGA Firmware
1216 case CMD_SNOOP_ICLASS:
1217 SnoopIClass();
1218 break;
1219 case CMD_SIMULATE_TAG_ICLASS:
1220 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1221 break;
1222 case CMD_READER_ICLASS:
1223 ReaderIClass(c->arg[0]);
1224 break;
1225 case CMD_READER_ICLASS_REPLAY:
1226 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1227 break;
1228 case CMD_ICLASS_EML_MEMSET:
1229 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1230 break;
1231 case CMD_ICLASS_WRITEBLOCK:
1232 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1233 break;
1234 case CMD_ICLASS_READCHECK: // auth step 1
1235 iClass_ReadCheck(c->arg[0], c->arg[1]);
1236 break;
1237 case CMD_ICLASS_READBLOCK:
1238 iClass_ReadBlk(c->arg[0]);
1239 break;
1240 case CMD_ICLASS_AUTHENTICATION: //check
1241 iClass_Authentication(c->d.asBytes);
1242 break;
1243 case CMD_ICLASS_DUMP:
1244 iClass_Dump(c->arg[0], c->arg[1]);
1245 break;
1246 case CMD_ICLASS_CLONE:
1247 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1248 break;
1249 #endif
1250 #ifdef WITH_HFSNOOP
1251 case CMD_HF_SNIFFER:
1252 HfSnoop(c->arg[0], c->arg[1]);
1253 break;
1254 #endif
1255
1256 case CMD_BUFF_CLEAR:
1257 BigBuf_Clear();
1258 break;
1259
1260 case CMD_MEASURE_ANTENNA_TUNING:
1261 MeasureAntennaTuning();
1262 break;
1263
1264 case CMD_MEASURE_ANTENNA_TUNING_HF:
1265 MeasureAntennaTuningHf();
1266 break;
1267
1268 case CMD_LISTEN_READER_FIELD:
1269 ListenReaderField(c->arg[0]);
1270 break;
1271
1272 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1273 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1274 SpinDelay(200);
1275 LED_D_OFF(); // LED D indicates field ON or OFF
1276 break;
1277
1278 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: {
1279 LED_B_ON();
1280 uint8_t *BigBuf = BigBuf_get_addr();
1281 size_t len = 0;
1282 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1283 len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1284 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1285 }
1286 // Trigger a finish downloading signal with an ACK frame
1287 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1288 LED_B_OFF();
1289 break;
1290 }
1291 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1292 uint8_t *b = BigBuf_get_addr();
1293 memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1294 cmd_send(CMD_ACK,0,0,0,0,0);
1295 break;
1296 }
1297 case CMD_DOWNLOAD_EML_BIGBUF: {
1298 LED_B_ON();
1299 uint8_t *cardmem = BigBuf_get_EM_addr();
1300 size_t len = 0;
1301 for(size_t i=0; i < c->arg[1]; i += USB_CMD_DATA_SIZE) {
1302 len = MIN((c->arg[1] - i), USB_CMD_DATA_SIZE);
1303 cmd_send(CMD_DOWNLOADED_EML_BIGBUF, i, len, CARD_MEMORY_SIZE, cardmem + c->arg[0] + i, len);
1304 }
1305 // Trigger a finish downloading signal with an ACK frame
1306 cmd_send(CMD_ACK, 1, 0, CARD_MEMORY_SIZE, 0, 0);
1307 LED_B_OFF();
1308 break;
1309 }
1310 case CMD_READ_MEM:
1311 ReadMem(c->arg[0]);
1312 break;
1313
1314 case CMD_SET_LF_DIVISOR:
1315 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1316 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1317 break;
1318
1319 case CMD_SET_ADC_MUX:
1320 switch(c->arg[0]) {
1321 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1322 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1323 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1324 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1325 }
1326 break;
1327
1328 case CMD_VERSION:
1329 SendVersion();
1330 break;
1331 case CMD_STATUS:
1332 SendStatus();
1333 break;
1334 case CMD_PING:
1335 cmd_send(CMD_ACK,0,0,0,0,0);
1336 break;
1337 #ifdef WITH_LCD
1338 case CMD_LCD_RESET:
1339 LCDReset();
1340 break;
1341 case CMD_LCD:
1342 LCDSend(c->arg[0]);
1343 break;
1344 #endif
1345 case CMD_SETUP_WRITE:
1346 case CMD_FINISH_WRITE:
1347 case CMD_HARDWARE_RESET:
1348 usb_disable();
1349 SpinDelay(2000);
1350 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1351 for(;;) {
1352 // We're going to reset, and the bootrom will take control.
1353 }
1354 break;
1355
1356 case CMD_START_FLASH:
1357 if(common_area.flags.bootrom_present) {
1358 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1359 }
1360 usb_disable();
1361 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1362 for(;;);
1363 break;
1364
1365 case CMD_DEVICE_INFO: {
1366 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1367 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1368 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1369 break;
1370 }
1371 default:
1372 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1373 break;
1374 }
1375 }
1376
1377 void __attribute__((noreturn)) AppMain(void)
1378 {
1379 SpinDelay(100);
1380 clear_trace();
1381 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1382 /* Initialize common area */
1383 memset(&common_area, 0, sizeof(common_area));
1384 common_area.magic = COMMON_AREA_MAGIC;
1385 common_area.version = 1;
1386 }
1387 common_area.flags.osimage_present = 1;
1388
1389 LEDsoff();
1390
1391 // Init USB device
1392 usb_enable();
1393
1394 // The FPGA gets its clock from us from PCK0 output, so set that up.
1395 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1396 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1397 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1398 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1399 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK | AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1400 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1401
1402 // Reset SPI
1403 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1404 // Reset SSC
1405 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1406
1407 // Load the FPGA image, which we have stored in our flash.
1408 // (the HF version by default)
1409 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1410
1411 StartTickCount();
1412
1413 #ifdef WITH_LCD
1414 LCDInit();
1415 #endif
1416
1417 byte_t rx[sizeof(UsbCommand)];
1418 size_t rx_len;
1419
1420 for(;;) {
1421 if ( usb_poll_validate_length() ) {
1422 rx_len = usb_read(rx, sizeof(UsbCommand));
1423
1424 if (rx_len)
1425 UsbPacketReceived(rx, rx_len);
1426 }
1427 WDT_HIT();
1428
1429 #ifdef WITH_LF
1430 #ifndef WITH_ISO14443a_StandAlone
1431 if (BUTTON_HELD(1000) > 0)
1432 SamyRun();
1433 #endif
1434 #endif
1435 #ifdef WITH_ISO14443a
1436 #ifdef WITH_ISO14443a_StandAlone
1437 if (BUTTON_HELD(1000) > 0)
1438 StandAloneMode14a();
1439 #endif
1440 #endif
1441 }
1442 }
Proxmark3 GIT tracking
Impressum, Datenschutz