]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:


e6d40abceb7e580ec4453b0a45a1c9509967c6d6
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "legicrfsim.h"
25 #include "hitag2.h"
26 #include "hitagS.h"
27 #include "lfsampling.h"
28 #include "BigBuf.h"
29 #include "mifareutil.h"
30 #include "pcf7931.h"
31 #ifdef WITH_LCD
32 #include "LCD.h"
33 #endif
34 #ifdef WITH_SMARTCARD
35 #include "i2c.h"
36 #endif
37
38
39 // Craig Young - 14a stand-alone code
40 #ifdef WITH_ISO14443a
41 #include "iso14443a.h"
42 #endif
43
44 //=============================================================================
45 // A buffer where we can queue things up to be sent through the FPGA, for
46 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
47 // is the order in which they go out on the wire.
48 //=============================================================================
49
50 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
51 uint8_t ToSend[TOSEND_BUFFER_SIZE];
52 int ToSendMax;
53 static int ToSendBit;
54 struct common_area common_area __attribute__((section(".commonarea")));
55
56 void ToSendReset(void)
57 {
58 ToSendMax = -1;
59 ToSendBit = 8;
60 }
61
62 void ToSendStuffBit(int b)
63 {
64 if(ToSendBit >= 8) {
65 ToSendMax++;
66 ToSend[ToSendMax] = 0;
67 ToSendBit = 0;
68 }
69
70 if(b) {
71 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
72 }
73
74 ToSendBit++;
75
76 if(ToSendMax >= sizeof(ToSend)) {
77 ToSendBit = 0;
78 DbpString("ToSendStuffBit overflowed!");
79 }
80 }
81
82 //=============================================================================
83 // Debug print functions, to go out over USB, to the usual PC-side client.
84 //=============================================================================
85
86 void DbpString(char *str)
87 {
88 byte_t len = strlen(str);
89 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
90 }
91
92 #if 0
93 void DbpIntegers(int x1, int x2, int x3)
94 {
95 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
96 }
97 #endif
98
99 void Dbprintf(const char *fmt, ...) {
100 // should probably limit size here; oh well, let's just use a big buffer
101 char output_string[128];
102 va_list ap;
103
104 va_start(ap, fmt);
105 kvsprintf(fmt, output_string, 10, ap);
106 va_end(ap);
107
108 DbpString(output_string);
109 }
110
111 // prints HEX & ASCII
112 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
113 int l=0,i;
114 char ascii[9];
115
116 while (len>0) {
117 if (len>8) l=8;
118 else l=len;
119
120 memcpy(ascii,d,l);
121 ascii[l]=0;
122
123 // filter safe ascii
124 for (i=0;i<l;i++)
125 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
126
127 if (bAsci) {
128 Dbprintf("%-8s %*D",ascii,l,d," ");
129 } else {
130 Dbprintf("%*D",l,d," ");
131 }
132
133 len-=8;
134 d+=8;
135 }
136 }
137
138 //-----------------------------------------------------------------------------
139 // Read an ADC channel and block till it completes, then return the result
140 // in ADC units (0 to 1023). Also a routine to average 32 samples and
141 // return that.
142 //-----------------------------------------------------------------------------
143 static int ReadAdc(int ch)
144 {
145 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
146 // AMPL_HI is are high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
147 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
148 //
149 // The maths are:
150 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
151 //
152 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
153
154 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
155 AT91C_BASE_ADC->ADC_MR =
156 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
157 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
158 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
159
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
162
163 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
164
165 return AT91C_BASE_ADC->ADC_CDR[ch];
166 }
167
168 int AvgAdc(int ch) // was static - merlok
169 {
170 int i;
171 int a = 0;
172
173 for(i = 0; i < 32; i++) {
174 a += ReadAdc(ch);
175 }
176
177 return (a + 15) >> 5;
178 }
179
180 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
181 {
182 int i, adcval = 0, peak = 0;
183
184 /*
185 * Sweeps the useful LF range of the proxmark from
186 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
187 * read the voltage in the antenna, the result left
188 * in the buffer is a graph which should clearly show
189 * the resonating frequency of your LF antenna
190 * ( hopefully around 95 if it is tuned to 125kHz!)
191 */
192
193 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
194 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
195 SpinDelay(50);
196
197 for (i=255; i>=19; i--) {
198 WDT_HIT();
199 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
200 SpinDelay(20);
201 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
202 if (i==95) *vLf125 = adcval; // voltage at 125Khz
203 if (i==89) *vLf134 = adcval; // voltage at 134Khz
204
205 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
206 if(LF_Results[i] > peak) {
207 *peakv = adcval;
208 peak = LF_Results[i];
209 *peakf = i;
210 //ptr = i;
211 }
212 }
213
214 for (i=18; i >= 0; i--) LF_Results[i] = 0;
215
216 return;
217 }
218
219 void MeasureAntennaTuningHfOnly(int *vHf)
220 {
221 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
222 LED_A_ON();
223 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
224 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
225 SpinDelay(20);
226 *vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
227 LED_A_OFF();
228
229 return;
230 }
231
232 void MeasureAntennaTuning(int mode)
233 {
234 uint8_t LF_Results[256] = {0};
235 int peakv = 0, peakf = 0;
236 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
237
238 LED_B_ON();
239
240 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
241 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
242 MeasureAntennaTuningHfOnly(&vHf);
243 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
244 } else {
245 if (mode & FLAG_TUNE_LF) {
246 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
247 }
248 if (mode & FLAG_TUNE_HF) {
249 MeasureAntennaTuningHfOnly(&vHf);
250 }
251 }
252
253 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
254 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
255 LED_B_OFF();
256 return;
257 }
258
259 void MeasureAntennaTuningHf(void)
260 {
261 int vHf = 0; // in mV
262
263 DbpString("Measuring HF antenna, press button to exit");
264
265 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
266 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
268
269 for (;;) {
270 SpinDelay(20);
271 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
272
273 Dbprintf("%d mV",vHf);
274 if (BUTTON_PRESS()) break;
275 }
276 DbpString("cancelled");
277
278 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
279
280 }
281
282
283 void ReadMem(int addr)
284 {
285 const uint8_t *data = ((uint8_t *)addr);
286
287 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
288 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
289 }
290
291 /* osimage version information is linked in */
292 extern struct version_information version_information;
293 /* bootrom version information is pointed to from _bootphase1_version_pointer */
294 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
295
296 void SendVersion(void)
297 {
298 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
299 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
300
301 /* Try to find the bootrom version information. Expect to find a pointer at
302 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
303 * pointer, then use it.
304 */
305 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
306 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
307 strcat(VersionString, "bootrom version information appears invalid\n");
308 } else {
309 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
310 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
311 }
312
313 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
314 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
315
316 for (int i = 0; i < fpga_bitstream_num; i++) {
317 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
318 if (i < fpga_bitstream_num - 1) {
319 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
320 }
321 }
322
323 // Send Chip ID and used flash memory
324 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
325 uint32_t compressed_data_section_size = common_area.arg1;
326 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
327 }
328
329 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
330 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
331 void printUSBSpeed(void)
332 {
333 Dbprintf("USB Speed:");
334 Dbprintf(" Sending USB packets to client...");
335
336 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
337 uint8_t *test_data = BigBuf_get_addr();
338 uint32_t end_time;
339
340 uint32_t start_time = end_time = GetTickCount();
341 uint32_t bytes_transferred = 0;
342
343 LED_B_ON();
344 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
345 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
346 end_time = GetTickCount();
347 bytes_transferred += USB_CMD_DATA_SIZE;
348 }
349 LED_B_OFF();
350
351 Dbprintf(" Time elapsed: %dms", end_time - start_time);
352 Dbprintf(" Bytes transferred: %d", bytes_transferred);
353 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
354 1000 * bytes_transferred / (end_time - start_time));
355
356 }
357
358 /**
359 * Prints runtime information about the PM3.
360 **/
361 void SendStatus(void)
362 {
363 BigBuf_print_status();
364 Fpga_print_status();
365 #ifdef WITH_SMARTCARD
366 I2C_print_status();
367 #endif
368 printConfig(); //LF Sampling config
369 printUSBSpeed();
370 Dbprintf("Various");
371 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
372 Dbprintf(" ToSendMax..........%d", ToSendMax);
373 Dbprintf(" ToSendBit..........%d", ToSendBit);
374
375 cmd_send(CMD_ACK,1,0,0,0,0);
376 }
377
378 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
379
380 #define OPTS 2
381
382 void StandAloneMode()
383 {
384 DbpString("Stand-alone mode! No PC necessary.");
385 // Oooh pretty -- notify user we're in elite samy mode now
386 LED(LED_RED, 200);
387 LED(LED_ORANGE, 200);
388 LED(LED_GREEN, 200);
389 LED(LED_ORANGE, 200);
390 LED(LED_RED, 200);
391 LED(LED_ORANGE, 200);
392 LED(LED_GREEN, 200);
393 LED(LED_ORANGE, 200);
394 LED(LED_RED, 200);
395
396 }
397
398 #endif
399
400
401
402 #ifdef WITH_ISO14443a_StandAlone
403 void StandAloneMode14a()
404 {
405 StandAloneMode();
406 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
407
408 int selected = 0;
409 bool playing = false, GotoRecord = false, GotoClone = false;
410 bool cardRead[OPTS] = {false};
411 uint8_t readUID[10] = {0};
412 uint32_t uid_1st[OPTS]={0};
413 uint32_t uid_2nd[OPTS]={0};
414 uint32_t uid_tmp1 = 0;
415 uint32_t uid_tmp2 = 0;
416 iso14a_card_select_t hi14a_card[OPTS];
417
418 LED(selected + 1, 0);
419
420 for (;;)
421 {
422 usb_poll();
423 WDT_HIT();
424 SpinDelay(300);
425
426 if (GotoRecord || !cardRead[selected])
427 {
428 GotoRecord = false;
429 LEDsoff();
430 LED(selected + 1, 0);
431 LED(LED_RED2, 0);
432
433 // record
434 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
435 /* need this delay to prevent catching some weird data */
436 SpinDelay(500);
437 /* Code for reading from 14a tag */
438 uint8_t uid[10] ={0};
439 uint32_t cuid;
440 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
441
442 for ( ; ; )
443 {
444 WDT_HIT();
445 if (BUTTON_PRESS()) {
446 if (cardRead[selected]) {
447 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
448 break;
449 }
450 else if (cardRead[(selected+1)%OPTS]) {
451 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
452 selected = (selected+1)%OPTS;
453 break;
454 }
455 else {
456 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
457 SpinDelay(300);
458 }
459 }
460 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
461 continue;
462 else
463 {
464 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
465 memcpy(readUID,uid,10*sizeof(uint8_t));
466 uint8_t *dst = (uint8_t *)&uid_tmp1;
467 // Set UID byte order
468 for (int i=0; i<4; i++)
469 dst[i] = uid[3-i];
470 dst = (uint8_t *)&uid_tmp2;
471 for (int i=0; i<4; i++)
472 dst[i] = uid[7-i];
473 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
474 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
475 }
476 else {
477 if (uid_tmp2) {
478 Dbprintf("Bank[%d] received a 7-byte UID",selected);
479 uid_1st[selected] = (uid_tmp1)>>8;
480 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
481 }
482 else {
483 Dbprintf("Bank[%d] received a 4-byte UID",selected);
484 uid_1st[selected] = uid_tmp1;
485 uid_2nd[selected] = uid_tmp2;
486 }
487 break;
488 }
489 }
490 }
491 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
492 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
493 LEDsoff();
494 LED(LED_GREEN, 200);
495 LED(LED_ORANGE, 200);
496 LED(LED_GREEN, 200);
497 LED(LED_ORANGE, 200);
498
499 LEDsoff();
500 LED(selected + 1, 0);
501
502 // Next state is replay:
503 playing = true;
504
505 cardRead[selected] = true;
506 }
507 /* MF Classic UID clone */
508 else if (GotoClone)
509 {
510 GotoClone=false;
511 LEDsoff();
512 LED(selected + 1, 0);
513 LED(LED_ORANGE, 250);
514
515
516 // record
517 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
518
519 // wait for button to be released
520 while(BUTTON_PRESS())
521 {
522 // Delay cloning until card is in place
523 WDT_HIT();
524 }
525 Dbprintf("Starting clone. [Bank: %u]", selected);
526 // need this delay to prevent catching some weird data
527 SpinDelay(500);
528 // Begin clone function here:
529 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
530 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
531 memcpy(c.d.asBytes, data, 16);
532 SendCommand(&c);
533
534 Block read is similar:
535 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
536 We need to imitate that call with blockNo 0 to set a uid.
537
538 The get and set commands are handled in this file:
539 // Work with "magic Chinese" card
540 case CMD_MIFARE_CSETBLOCK:
541 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
542 break;
543 case CMD_MIFARE_CGETBLOCK:
544 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
545 break;
546
547 mfCSetUID provides example logic for UID set workflow:
548 -Read block0 from card in field with MifareCGetBlock()
549 -Configure new values without replacing reserved bytes
550 memcpy(block0, uid, 4); // Copy UID bytes from byte array
551 // Mifare UID BCC
552 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
553 Bytes 5-7 are reserved SAK and ATQA for mifare classic
554 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
555 */
556 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
557 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
558 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
559 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
560 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
561 playing = true;
562 }
563 else {
564 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
565 memcpy(newBlock0,oldBlock0,16);
566 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
567
568 newBlock0[0] = uid_1st[selected]>>24;
569 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
570 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
571 newBlock0[3] = 0xFF & (uid_1st[selected]);
572 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
573 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
574 MifareCSetBlock(0, 0xFF,0, newBlock0);
575 MifareCGetBlock(0x3F, 1, 0, testBlock0);
576 if (memcmp(testBlock0,newBlock0,16)==0)
577 {
578 DbpString("Cloned successfull!");
579 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
580 playing = false;
581 GotoRecord = true;
582 selected = (selected+1) % OPTS;
583 }
584 else {
585 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
586 playing = true;
587 }
588 }
589 LEDsoff();
590 LED(selected + 1, 0);
591
592 }
593 // Change where to record (or begin playing)
594 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
595 {
596 LEDsoff();
597 LED(selected + 1, 0);
598
599 // Begin transmitting
600 LED(LED_GREEN, 0);
601 DbpString("Playing");
602 for ( ; ; ) {
603 WDT_HIT();
604 int button_action = BUTTON_HELD(1000);
605 if (button_action == 0) { // No button action, proceed with sim
606 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
607 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
608 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
609 DbpString("Mifare Classic");
610 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
611 }
612 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
613 DbpString("Mifare Ultralight");
614 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
615 }
616 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
617 DbpString("Mifare DESFire");
618 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
619 }
620 else {
621 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
622 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
623 }
624 }
625 else if (button_action == BUTTON_SINGLE_CLICK) {
626 selected = (selected + 1) % OPTS;
627 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
628 GotoRecord = true;
629 break;
630 }
631 else if (button_action == BUTTON_HOLD) {
632 Dbprintf("Playtime over. Begin cloning...");
633 GotoClone = true;
634 break;
635 }
636 WDT_HIT();
637 }
638
639 /* We pressed a button so ignore it here with a delay */
640 SpinDelay(300);
641 LEDsoff();
642 LED(selected + 1, 0);
643 }
644 }
645 }
646 #elif WITH_LF_StandAlone
647 // samy's sniff and repeat routine
648 void SamyRun()
649 {
650 StandAloneMode();
651 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
652
653 int tops[OPTS], high[OPTS], low[OPTS];
654 int selected = 0;
655 int playing = 0;
656 int cardRead = 0;
657
658 // Turn on selected LED
659 LED(selected + 1, 0);
660
661 for (;;)
662 {
663 usb_poll();
664 WDT_HIT();
665
666 // Was our button held down or pressed?
667 int button_pressed = BUTTON_HELD(1000);
668 SpinDelay(300);
669
670 // Button was held for a second, begin recording
671 if (button_pressed > 0 && cardRead == 0)
672 {
673 LEDsoff();
674 LED(selected + 1, 0);
675 LED(LED_RED2, 0);
676
677 // record
678 DbpString("Starting recording");
679
680 // wait for button to be released
681 while(BUTTON_PRESS())
682 WDT_HIT();
683
684 /* need this delay to prevent catching some weird data */
685 SpinDelay(500);
686
687 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
688 if (tops[selected] > 0)
689 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
690 else
691 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
692
693 LEDsoff();
694 LED(selected + 1, 0);
695 // Finished recording
696
697 // If we were previously playing, set playing off
698 // so next button push begins playing what we recorded
699 playing = 0;
700
701 cardRead = 1;
702
703 }
704
705 else if (button_pressed > 0 && cardRead == 1)
706 {
707 LEDsoff();
708 LED(selected + 1, 0);
709 LED(LED_ORANGE, 0);
710
711 // record
712 if (tops[selected] > 0)
713 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
714 else
715 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
716
717 // wait for button to be released
718 while(BUTTON_PRESS())
719 WDT_HIT();
720
721 /* need this delay to prevent catching some weird data */
722 SpinDelay(500);
723
724 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)));
725 if (tops[selected] > 0)
726 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
727 else
728 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
729
730 LEDsoff();
731 LED(selected + 1, 0);
732 // Finished recording
733
734 // If we were previously playing, set playing off
735 // so next button push begins playing what we recorded
736 playing = 0;
737
738 cardRead = 0;
739
740 }
741
742 // Change where to record (or begin playing)
743 else if (button_pressed)
744 {
745 // Next option if we were previously playing
746 if (playing)
747 selected = (selected + 1) % OPTS;
748 playing = !playing;
749
750 LEDsoff();
751 LED(selected + 1, 0);
752
753 // Begin transmitting
754 if (playing)
755 {
756 LED(LED_GREEN, 0);
757 DbpString("Playing");
758 // wait for button to be released
759 while(BUTTON_PRESS())
760 WDT_HIT();
761 if (tops[selected] > 0)
762 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
763 else
764 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
765
766 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
767 DbpString("Done playing");
768 if (BUTTON_HELD(1000) > 0)
769 {
770 DbpString("Exiting");
771 LEDsoff();
772 return;
773 }
774
775 /* We pressed a button so ignore it here with a delay */
776 SpinDelay(300);
777
778 // when done, we're done playing, move to next option
779 selected = (selected + 1) % OPTS;
780 playing = !playing;
781 LEDsoff();
782 LED(selected + 1, 0);
783 }
784 else
785 while(BUTTON_PRESS())
786 WDT_HIT();
787 }
788 }
789 }
790
791 #endif
792 /*
793 OBJECTIVE
794 Listen and detect an external reader. Determine the best location
795 for the antenna.
796
797 INSTRUCTIONS:
798 Inside the ListenReaderField() function, there is two mode.
799 By default, when you call the function, you will enter mode 1.
800 If you press the PM3 button one time, you will enter mode 2.
801 If you press the PM3 button a second time, you will exit the function.
802
803 DESCRIPTION OF MODE 1:
804 This mode just listens for an external reader field and lights up green
805 for HF and/or red for LF. This is the original mode of the detectreader
806 function.
807
808 DESCRIPTION OF MODE 2:
809 This mode will visually represent, using the LEDs, the actual strength of the
810 current compared to the maximum current detected. Basically, once you know
811 what kind of external reader is present, it will help you spot the best location to place
812 your antenna. You will probably not get some good results if there is a LF and a HF reader
813 at the same place! :-)
814
815 LIGHT SCHEME USED:
816 */
817 static const char LIGHT_SCHEME[] = {
818 0x0, /* ---- | No field detected */
819 0x1, /* X--- | 14% of maximum current detected */
820 0x2, /* -X-- | 29% of maximum current detected */
821 0x4, /* --X- | 43% of maximum current detected */
822 0x8, /* ---X | 57% of maximum current detected */
823 0xC, /* --XX | 71% of maximum current detected */
824 0xE, /* -XXX | 86% of maximum current detected */
825 0xF, /* XXXX | 100% of maximum current detected */
826 };
827 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
828
829 void ListenReaderField(int limit)
830 {
831 int lf_av, lf_av_new, lf_baseline= 0, lf_max;
832 int hf_av, hf_av_new, hf_baseline= 0, hf_max;
833 int mode=1, display_val, display_max, i;
834
835 #define LF_ONLY 1
836 #define HF_ONLY 2
837 #define REPORT_CHANGE 10 // report new values only if they have changed at least by REPORT_CHANGE
838
839
840 // switch off FPGA - we don't want to measure our own signal
841 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
842 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
843
844 LEDsoff();
845
846 lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
847
848 if(limit != HF_ONLY) {
849 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
850 lf_baseline = lf_av;
851 }
852
853 hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
854
855 if (limit != LF_ONLY) {
856 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
857 hf_baseline = hf_av;
858 }
859
860 for(;;) {
861 if (BUTTON_PRESS()) {
862 SpinDelay(500);
863 switch (mode) {
864 case 1:
865 mode=2;
866 DbpString("Signal Strength Mode");
867 break;
868 case 2:
869 default:
870 DbpString("Stopped");
871 LEDsoff();
872 return;
873 break;
874 }
875 }
876 WDT_HIT();
877
878 if (limit != HF_ONLY) {
879 if(mode == 1) {
880 if (ABS(lf_av - lf_baseline) > REPORT_CHANGE)
881 LED_D_ON();
882 else
883 LED_D_OFF();
884 }
885
886 lf_av_new = AvgAdc(ADC_CHAN_LF);
887 // see if there's a significant change
888 if(ABS(lf_av - lf_av_new) > REPORT_CHANGE) {
889 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
890 lf_av = lf_av_new;
891 if (lf_av > lf_max)
892 lf_max = lf_av;
893 }
894 }
895
896 if (limit != LF_ONLY) {
897 if (mode == 1){
898 if (ABS(hf_av - hf_baseline) > REPORT_CHANGE)
899 LED_B_ON();
900 else
901 LED_B_OFF();
902 }
903
904 hf_av_new = AvgAdc(ADC_CHAN_HF);
905 // see if there's a significant change
906 if(ABS(hf_av - hf_av_new) > REPORT_CHANGE) {
907 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
908 hf_av = hf_av_new;
909 if (hf_av > hf_max)
910 hf_max = hf_av;
911 }
912 }
913
914 if(mode == 2) {
915 if (limit == LF_ONLY) {
916 display_val = lf_av;
917 display_max = lf_max;
918 } else if (limit == HF_ONLY) {
919 display_val = hf_av;
920 display_max = hf_max;
921 } else { /* Pick one at random */
922 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
923 display_val = hf_av;
924 display_max = hf_max;
925 } else {
926 display_val = lf_av;
927 display_max = lf_max;
928 }
929 }
930 for (i=0; i<LIGHT_LEN; i++) {
931 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
932 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
933 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
934 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
935 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
936 break;
937 }
938 }
939 }
940 }
941 }
942
943 void UsbPacketReceived(uint8_t *packet, int len)
944 {
945 UsbCommand *c = (UsbCommand *)packet;
946
947 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
948
949 switch(c->cmd) {
950 #ifdef WITH_LF
951 case CMD_SET_LF_SAMPLING_CONFIG:
952 setSamplingConfig((sample_config *) c->d.asBytes);
953 break;
954 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
955 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
956 break;
957 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
958 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
959 break;
960 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
961 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
962 break;
963 case CMD_HID_DEMOD_FSK:
964 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
965 break;
966 case CMD_HID_SIM_TAG:
967 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
968 break;
969 case CMD_FSK_SIM_TAG:
970 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
971 break;
972 case CMD_ASK_SIM_TAG:
973 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
974 break;
975 case CMD_PSK_SIM_TAG:
976 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
977 break;
978 case CMD_HID_CLONE_TAG:
979 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
980 break;
981 case CMD_IO_DEMOD_FSK:
982 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
983 break;
984 case CMD_IO_CLONE_TAG:
985 CopyIOtoT55x7(c->arg[0], c->arg[1]);
986 break;
987 case CMD_EM410X_DEMOD:
988 CmdEM410xdemod(c->arg[0], 0, 0, 1);
989 break;
990 case CMD_EM410X_WRITE_TAG:
991 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
992 break;
993 case CMD_READ_TI_TYPE:
994 ReadTItag();
995 break;
996 case CMD_WRITE_TI_TYPE:
997 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
998 break;
999 case CMD_SIMULATE_TAG_125K:
1000 LED_A_ON();
1001 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
1002 LED_A_OFF();
1003 break;
1004 case CMD_LF_SIMULATE_BIDIR:
1005 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1006 break;
1007 case CMD_INDALA_CLONE_TAG:
1008 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1009 break;
1010 case CMD_INDALA_CLONE_TAG_L:
1011 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1012 break;
1013 case CMD_T55XX_READ_BLOCK:
1014 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1015 break;
1016 case CMD_T55XX_WRITE_BLOCK:
1017 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1018 break;
1019 case CMD_T55XX_WAKEUP:
1020 T55xxWakeUp(c->arg[0]);
1021 break;
1022 case CMD_T55XX_RESET_READ:
1023 T55xxResetRead();
1024 break;
1025 case CMD_PCF7931_READ:
1026 ReadPCF7931();
1027 break;
1028 case CMD_PCF7931_WRITE:
1029 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1030 break;
1031 case CMD_EM4X_READ_WORD:
1032 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1033 break;
1034 case CMD_EM4X_WRITE_WORD:
1035 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1036 break;
1037 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1038 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1039 break;
1040 case CMD_VIKING_CLONE_TAG:
1041 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1042 break;
1043 case CMD_COTAG:
1044 Cotag(c->arg[0]);
1045 break;
1046 #endif
1047
1048 #ifdef WITH_HITAG
1049 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1050 SnoopHitag(c->arg[0]);
1051 break;
1052 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1053 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1054 break;
1055 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1056 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1057 break;
1058 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1059 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1060 break;
1061 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1062 check_challenges((bool)c->arg[0],(byte_t*)c->d.asBytes);
1063 break;
1064 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1065 ReadHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1066 break;
1067 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1068 if ((hitag_function)c->arg[0] < 10) {
1069 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1070 }
1071 else if ((hitag_function)c->arg[0] >= 10) {
1072 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1073 }
1074 break;
1075 #endif
1076
1077 #ifdef WITH_ISO15693
1078 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1079 AcquireRawAdcSamplesIso15693();
1080 break;
1081 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1082 RecordRawAdcSamplesIso15693();
1083 break;
1084
1085 case CMD_ISO_15693_COMMAND:
1086 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1087 break;
1088
1089 case CMD_ISO_15693_FIND_AFI:
1090 BruteforceIso15693Afi(c->arg[0]);
1091 break;
1092
1093 case CMD_ISO_15693_DEBUG:
1094 SetDebugIso15693(c->arg[0]);
1095 break;
1096
1097 case CMD_READER_ISO_15693:
1098 ReaderIso15693(c->arg[0]);
1099 break;
1100 case CMD_SIMTAG_ISO_15693:
1101 SimTagIso15693(c->arg[0], c->d.asBytes);
1102 break;
1103 #endif
1104
1105 #ifdef WITH_LEGICRF
1106 case CMD_SIMULATE_TAG_LEGIC_RF:
1107 LegicRfSimulate(c->arg[0]);
1108 break;
1109
1110 case CMD_WRITER_LEGIC_RF:
1111 LegicRfWriter(c->arg[1], c->arg[0]);
1112 break;
1113
1114 case CMD_READER_LEGIC_RF:
1115 LegicRfReader(c->arg[0], c->arg[1]);
1116 break;
1117 #endif
1118
1119 #ifdef WITH_ISO14443b
1120 case CMD_READ_SRI512_TAG:
1121 ReadSTMemoryIso14443b(0x0F);
1122 break;
1123 case CMD_READ_SRIX4K_TAG:
1124 ReadSTMemoryIso14443b(0x7F);
1125 break;
1126 case CMD_SNOOP_ISO_14443B:
1127 SnoopIso14443b();
1128 break;
1129 case CMD_SIMULATE_TAG_ISO_14443B:
1130 SimulateIso14443bTag();
1131 break;
1132 case CMD_ISO_14443B_COMMAND:
1133 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1134 break;
1135 #endif
1136
1137 #ifdef WITH_ISO14443a
1138 case CMD_SNOOP_ISO_14443a:
1139 SnoopIso14443a(c->arg[0]);
1140 break;
1141 case CMD_READER_ISO_14443a:
1142 ReaderIso14443a(c);
1143 break;
1144 case CMD_SIMULATE_TAG_ISO_14443a:
1145 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1146 break;
1147
1148 case CMD_EPA_PACE_COLLECT_NONCE:
1149 EPA_PACE_Collect_Nonce(c);
1150 break;
1151 case CMD_EPA_PACE_REPLAY:
1152 EPA_PACE_Replay(c);
1153 break;
1154
1155 case CMD_READER_MIFARE:
1156 ReaderMifare(c->arg[0]);
1157 break;
1158 case CMD_MIFARE_READBL:
1159 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1160 break;
1161 case CMD_MIFAREU_READBL:
1162 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1163 break;
1164 case CMD_MIFAREUC_AUTH:
1165 MifareUC_Auth(c->arg[0],c->d.asBytes);
1166 break;
1167 case CMD_MIFAREU_READCARD:
1168 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1169 break;
1170 case CMD_MIFAREUC_SETPWD:
1171 MifareUSetPwd(c->arg[0], c->d.asBytes);
1172 break;
1173 case CMD_MIFARE_READSC:
1174 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1175 break;
1176 case CMD_MIFARE_WRITEBL:
1177 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1178 break;
1179 //case CMD_MIFAREU_WRITEBL_COMPAT:
1180 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1181 //break;
1182 case CMD_MIFAREU_WRITEBL:
1183 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1184 break;
1185 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1186 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1187 break;
1188 case CMD_MIFARE_NESTED:
1189 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1190 break;
1191 case CMD_MIFARE_CHKKEYS:
1192 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1193 break;
1194 case CMD_SIMULATE_MIFARE_CARD:
1195 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1196 break;
1197
1198 // emulator
1199 case CMD_MIFARE_SET_DBGMODE:
1200 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1201 break;
1202 case CMD_MIFARE_EML_MEMCLR:
1203 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1204 break;
1205 case CMD_MIFARE_EML_MEMSET:
1206 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1207 break;
1208 case CMD_MIFARE_EML_MEMGET:
1209 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1210 break;
1211 case CMD_MIFARE_EML_CARDLOAD:
1212 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1213 break;
1214
1215 // Work with "magic Chinese" card
1216 case CMD_MIFARE_CWIPE:
1217 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1218 break;
1219 case CMD_MIFARE_CSETBLOCK:
1220 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1221 break;
1222 case CMD_MIFARE_CGETBLOCK:
1223 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1224 break;
1225 case CMD_MIFARE_CIDENT:
1226 MifareCIdent();
1227 break;
1228
1229 // mifare sniffer
1230 case CMD_MIFARE_SNIFFER:
1231 SniffMifare(c->arg[0]);
1232 break;
1233
1234 #endif
1235
1236 #ifdef WITH_ICLASS
1237 // Makes use of ISO14443a FPGA Firmware
1238 case CMD_SNOOP_ICLASS:
1239 SnoopIClass();
1240 break;
1241 case CMD_SIMULATE_TAG_ICLASS:
1242 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1243 break;
1244 case CMD_READER_ICLASS:
1245 ReaderIClass(c->arg[0]);
1246 break;
1247 case CMD_READER_ICLASS_REPLAY:
1248 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1249 break;
1250 case CMD_ICLASS_EML_MEMSET:
1251 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1252 break;
1253 case CMD_ICLASS_WRITEBLOCK:
1254 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1255 break;
1256 case CMD_ICLASS_READCHECK: // auth step 1
1257 iClass_ReadCheck(c->arg[0], c->arg[1]);
1258 break;
1259 case CMD_ICLASS_READBLOCK:
1260 iClass_ReadBlk(c->arg[0]);
1261 break;
1262 case CMD_ICLASS_AUTHENTICATION: //check
1263 iClass_Authentication(c->d.asBytes);
1264 break;
1265 case CMD_ICLASS_DUMP:
1266 iClass_Dump(c->arg[0], c->arg[1]);
1267 break;
1268 case CMD_ICLASS_CLONE:
1269 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1270 break;
1271 #endif
1272 #ifdef WITH_HFSNOOP
1273 case CMD_HF_SNIFFER:
1274 HfSnoop(c->arg[0], c->arg[1]);
1275 break;
1276 #endif
1277 #ifdef WITH_SMARTCARD
1278 case CMD_SMART_ATR: {
1279 SmartCardAtr();
1280 break;
1281 }
1282 case CMD_SMART_SETCLOCK:{
1283 SmartCardSetClock(c->arg[0]);
1284 break;
1285 }
1286 case CMD_SMART_RAW: {
1287 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1288 break;
1289 }
1290 case CMD_SMART_UPLOAD: {
1291 // upload file from client
1292 uint8_t *mem = BigBuf_get_addr();
1293 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1294 cmd_send(CMD_ACK,1,0,0,0,0);
1295 break;
1296 }
1297 case CMD_SMART_UPGRADE: {
1298 SmartCardUpgrade(c->arg[0]);
1299 break;
1300 }
1301 #endif
1302
1303 case CMD_BUFF_CLEAR:
1304 BigBuf_Clear();
1305 break;
1306
1307 case CMD_MEASURE_ANTENNA_TUNING:
1308 MeasureAntennaTuning(c->arg[0]);
1309 break;
1310
1311 case CMD_MEASURE_ANTENNA_TUNING_HF:
1312 MeasureAntennaTuningHf();
1313 break;
1314
1315 case CMD_LISTEN_READER_FIELD:
1316 ListenReaderField(c->arg[0]);
1317 break;
1318
1319 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1320 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1321 SpinDelay(200);
1322 LED_D_OFF(); // LED D indicates field ON or OFF
1323 break;
1324
1325 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1326
1327 LED_B_ON();
1328 uint8_t *BigBuf = BigBuf_get_addr();
1329 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1330 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1331 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1332 }
1333 // Trigger a finish downloading signal with an ACK frame
1334 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1335 LED_B_OFF();
1336 break;
1337
1338 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1339 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1340 // to be able to use this one for uploading data to device
1341 // arg1 = 0 upload for LF usage
1342 // 1 upload for HF usage
1343 if (c->arg[1] == 0)
1344 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1345 else
1346 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1347
1348 uint8_t *b = BigBuf_get_addr();
1349 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1350 cmd_send(CMD_ACK,0,0,0,0,0);
1351 break;
1352 }
1353 case CMD_READ_MEM:
1354 ReadMem(c->arg[0]);
1355 break;
1356
1357 case CMD_SET_LF_DIVISOR:
1358 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1359 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1360 break;
1361
1362 case CMD_SET_ADC_MUX:
1363 switch(c->arg[0]) {
1364 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1365 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1366 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1367 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1368 }
1369 break;
1370
1371 case CMD_VERSION:
1372 SendVersion();
1373 break;
1374 case CMD_STATUS:
1375 SendStatus();
1376 break;
1377 case CMD_PING:
1378 cmd_send(CMD_ACK,0,0,0,0,0);
1379 break;
1380 #ifdef WITH_LCD
1381 case CMD_LCD_RESET:
1382 LCDReset();
1383 break;
1384 case CMD_LCD:
1385 LCDSend(c->arg[0]);
1386 break;
1387 #endif
1388 case CMD_SETUP_WRITE:
1389 case CMD_FINISH_WRITE:
1390 case CMD_HARDWARE_RESET:
1391 usb_disable();
1392 SpinDelay(1000);
1393 SpinDelay(1000);
1394 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1395 for(;;) {
1396 // We're going to reset, and the bootrom will take control.
1397 }
1398 break;
1399
1400 case CMD_START_FLASH:
1401 if(common_area.flags.bootrom_present) {
1402 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1403 }
1404 usb_disable();
1405 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1406 for(;;);
1407 break;
1408
1409 case CMD_DEVICE_INFO: {
1410 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1411 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1412 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1413 break;
1414 }
1415 default:
1416 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1417 break;
1418 }
1419 }
1420
1421 void __attribute__((noreturn)) AppMain(void)
1422 {
1423 SpinDelay(100);
1424 clear_trace();
1425 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1426 /* Initialize common area */
1427 memset(&common_area, 0, sizeof(common_area));
1428 common_area.magic = COMMON_AREA_MAGIC;
1429 common_area.version = 1;
1430 }
1431 common_area.flags.osimage_present = 1;
1432
1433 LED_D_OFF();
1434 LED_C_OFF();
1435 LED_B_OFF();
1436 LED_A_OFF();
1437
1438 // Init USB device
1439 usb_enable();
1440
1441 // The FPGA gets its clock from us from PCK0 output, so set that up.
1442 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1443 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1444 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1445 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1446 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1447 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1448 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1449
1450 // Reset SPI
1451 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1452 // Reset SSC
1453 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1454
1455 // Load the FPGA image, which we have stored in our flash.
1456 // (the HF version by default)
1457 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1458
1459 StartTickCount();
1460
1461 #ifdef WITH_LCD
1462 LCDInit();
1463 #endif
1464
1465 byte_t rx[sizeof(UsbCommand)];
1466 size_t rx_len;
1467
1468 for(;;) {
1469 if (usb_poll()) {
1470 rx_len = usb_read(rx,sizeof(UsbCommand));
1471 if (rx_len) {
1472 UsbPacketReceived(rx,rx_len);
1473 }
1474 }
1475 WDT_HIT();
1476
1477 #ifdef WITH_LF_StandAlone
1478 #ifndef WITH_ISO14443a_StandAlone
1479 if (BUTTON_HELD(1000) > 0)
1480 SamyRun();
1481 #endif
1482 #endif
1483 #ifdef WITH_ISO14443a
1484 #ifdef WITH_ISO14443a_StandAlone
1485 if (BUTTON_HELD(1000) > 0)
1486 StandAloneMode14a();
1487 #endif
1488 #endif
1489 }
1490 }
Proxmark3 GIT tracking
Impressum, Datenschutz