]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/appmain.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
added SoloKey certificate (#778)
[proxmark3-svn] / armsrc / appmain.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, Mar 2006
3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // The main application code. This is the first thing called after start.c
10 // executes.
11 //-----------------------------------------------------------------------------
12
13 #include <stdarg.h>
14
15 #include "usb_cdc.h"
16 #include "cmd.h"
17 #include "proxmark3.h"
18 #include "apps.h"
19 #include "fpga.h"
20 #include "util.h"
21 #include "printf.h"
22 #include "string.h"
23 #include "legicrf.h"
24 #include "legicrfsim.h"
25 #include "hitag2.h"
26 #include "hitagS.h"
27 #include "iso15693.h"
28 #include "lfsampling.h"
29 #include "BigBuf.h"
30 #include "mifareutil.h"
31 #include "pcf7931.h"
32 #include "i2c.h"
33 #ifdef WITH_LCD
34 #include "LCD.h"
35 #endif
36
37 static uint32_t hw_capabilities;
38
39 // Craig Young - 14a stand-alone code
40 #ifdef WITH_ISO14443a
41 #include "iso14443a.h"
42 #endif
43
44 //=============================================================================
45 // A buffer where we can queue things up to be sent through the FPGA, for
46 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
47 // is the order in which they go out on the wire.
48 //=============================================================================
49
50 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
51 uint8_t ToSend[TOSEND_BUFFER_SIZE];
52 int ToSendMax;
53 static int ToSendBit;
54 struct common_area common_area __attribute__((section(".commonarea")));
55
56 void ToSendReset(void)
57 {
58 ToSendMax = -1;
59 ToSendBit = 8;
60 }
61
62 void ToSendStuffBit(int b)
63 {
64 if(ToSendBit >= 8) {
65 ToSendMax++;
66 ToSend[ToSendMax] = 0;
67 ToSendBit = 0;
68 }
69
70 if(b) {
71 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
72 }
73
74 ToSendBit++;
75
76 if(ToSendMax >= sizeof(ToSend)) {
77 ToSendBit = 0;
78 DbpString("ToSendStuffBit overflowed!");
79 }
80 }
81
82 //=============================================================================
83 // Debug print functions, to go out over USB, to the usual PC-side client.
84 //=============================================================================
85
86 void DbpString(char *str)
87 {
88 byte_t len = strlen(str);
89 cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
90 }
91
92 #if 0
93 void DbpIntegers(int x1, int x2, int x3)
94 {
95 cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
96 }
97 #endif
98
99 void Dbprintf(const char *fmt, ...) {
100 // should probably limit size here; oh well, let's just use a big buffer
101 char output_string[128];
102 va_list ap;
103
104 va_start(ap, fmt);
105 kvsprintf(fmt, output_string, 10, ap);
106 va_end(ap);
107
108 DbpString(output_string);
109 }
110
111 // prints HEX & ASCII
112 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
113 int l=0,i;
114 char ascii[9];
115
116 while (len>0) {
117 if (len>8) l=8;
118 else l=len;
119
120 memcpy(ascii,d,l);
121 ascii[l]=0;
122
123 // filter safe ascii
124 for (i=0;i<l;i++)
125 if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
126
127 if (bAsci) {
128 Dbprintf("%-8s %*D",ascii,l,d," ");
129 } else {
130 Dbprintf("%*D",l,d," ");
131 }
132
133 len-=8;
134 d+=8;
135 }
136 }
137
138 //-----------------------------------------------------------------------------
139 // Read an ADC channel and block till it completes, then return the result
140 // in ADC units (0 to 1023). Also a routine to average 32 samples and
141 // return that.
142 //-----------------------------------------------------------------------------
143 static int ReadAdc(int ch)
144 {
145 // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
146 // AMPL_HI is a high impedance (10MOhm || 1MOhm) output, the input capacitance of the ADC is 12pF (typical). This results in a time constant
147 // of RC = (0.91MOhm) * 12pF = 10.9us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
148 //
149 // The maths are:
150 // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
151 //
152 // v_cap = v_in * (1 - exp(-SHTIM/RC)) = v_in * (1 - exp(-40us/10.9us)) = v_in * 0,97 (i.e. an error of 3%)
153
154 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
155 AT91C_BASE_ADC->ADC_MR =
156 ADC_MODE_PRESCALE(63) | // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
157 ADC_MODE_STARTUP_TIME(1) | // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us Note: must be > 20us
158 ADC_MODE_SAMPLE_HOLD_TIME(15); // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
159
160 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
161 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
162
163 while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch))) {};
164
165 return AT91C_BASE_ADC->ADC_CDR[ch] & 0x3ff;
166 }
167
168 int AvgAdc(int ch) // was static - merlok
169 {
170 int i;
171 int a = 0;
172
173 for(i = 0; i < 32; i++) {
174 a += ReadAdc(ch);
175 }
176
177 return (a + 15) >> 5;
178 }
179
180 static int AvgAdc_Voltage_HF(void)
181 {
182 int AvgAdc_Voltage_Low, AvgAdc_Voltage_High;
183
184 AvgAdc_Voltage_Low= (MAX_ADC_HF_VOLTAGE_LOW * AvgAdc(ADC_CHAN_HF_LOW)) >> 10;
185 // if voltage range is about to be exceeded, use high voltage ADC channel if available (RDV40 only)
186 if (AvgAdc_Voltage_Low > MAX_ADC_HF_VOLTAGE_LOW - 300) {
187 AvgAdc_Voltage_High = (MAX_ADC_HF_VOLTAGE_HIGH * AvgAdc(ADC_CHAN_HF_HIGH)) >> 10;
188 if (AvgAdc_Voltage_High >= AvgAdc_Voltage_Low) {
189 return AvgAdc_Voltage_High;
190 }
191 }
192 return AvgAdc_Voltage_Low;
193 }
194
195 static int AvgAdc_Voltage_LF(void)
196 {
197 return (MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10;
198 }
199
200 void MeasureAntennaTuningLfOnly(int *vLf125, int *vLf134, int *peakf, int *peakv, uint8_t LF_Results[])
201 {
202 int i, adcval = 0, peak = 0;
203
204 /*
205 * Sweeps the useful LF range of the proxmark from
206 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
207 * read the voltage in the antenna, the result left
208 * in the buffer is a graph which should clearly show
209 * the resonating frequency of your LF antenna
210 * ( hopefully around 95 if it is tuned to 125kHz!)
211 */
212
213 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
214 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
215 SpinDelay(50);
216
217 for (i=255; i>=19; i--) {
218 WDT_HIT();
219 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
220 SpinDelay(20);
221 adcval = AvgAdc_Voltage_LF();
222 if (i==95) *vLf125 = adcval; // voltage at 125Khz
223 if (i==89) *vLf134 = adcval; // voltage at 134Khz
224
225 LF_Results[i] = adcval >> 9; // scale int to fit in byte for graphing purposes
226 if(LF_Results[i] > peak) {
227 *peakv = adcval;
228 peak = LF_Results[i];
229 *peakf = i;
230 //ptr = i;
231 }
232 }
233
234 for (i=18; i >= 0; i--) LF_Results[i] = 0;
235
236 return;
237 }
238
239 void MeasureAntennaTuningHfOnly(int *vHf)
240 {
241 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
242 LED_A_ON();
243 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
244 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
245 SpinDelay(20);
246 *vHf = AvgAdc_Voltage_HF();
247 LED_A_OFF();
248 return;
249 }
250
251 void MeasureAntennaTuning(int mode)
252 {
253 uint8_t LF_Results[256] = {0};
254 int peakv = 0, peakf = 0;
255 int vLf125 = 0, vLf134 = 0, vHf = 0; // in mV
256
257 LED_B_ON();
258
259 if (((mode & FLAG_TUNE_ALL) == FLAG_TUNE_ALL) && (FpgaGetCurrent() == FPGA_BITSTREAM_HF)) {
260 // Reverse "standard" order if HF already loaded, to avoid unnecessary swap.
261 MeasureAntennaTuningHfOnly(&vHf);
262 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
263 } else {
264 if (mode & FLAG_TUNE_LF) {
265 MeasureAntennaTuningLfOnly(&vLf125, &vLf134, &peakf, &peakv, LF_Results);
266 }
267 if (mode & FLAG_TUNE_HF) {
268 MeasureAntennaTuningHfOnly(&vHf);
269 }
270 }
271
272 cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125>>1 | (vLf134>>1<<16), vHf, peakf | (peakv>>1<<16), LF_Results, 256);
273 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
274 LED_B_OFF();
275 return;
276 }
277
278 void MeasureAntennaTuningHf(void)
279 {
280 int vHf = 0; // in mV
281
282 DbpString("Measuring HF antenna, press button to exit");
283
284 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
285 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
286 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
287
288 for (;;) {
289 SpinDelay(500);
290 vHf = AvgAdc_Voltage_HF();
291
292 Dbprintf("%d mV",vHf);
293 if (BUTTON_PRESS()) break;
294 }
295 DbpString("cancelled");
296
297 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
298
299 }
300
301
302 void ReadMem(int addr)
303 {
304 const uint8_t *data = ((uint8_t *)addr);
305
306 Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
307 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
308 }
309
310 /* osimage version information is linked in */
311 extern struct version_information version_information;
312 /* bootrom version information is pointed to from _bootphase1_version_pointer */
313 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
314
315
316 void set_hw_capabilities(void)
317 {
318 if (I2C_is_available()) {
319 hw_capabilities |= HAS_SMARTCARD_SLOT;
320 }
321
322 if (false) { // TODO: implement a test
323 hw_capabilities |= HAS_EXTRA_FLASH_MEM;
324 }
325 }
326
327
328 void SendVersion(void)
329 {
330 set_hw_capabilities();
331
332 char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
333 char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
334
335 /* Try to find the bootrom version information. Expect to find a pointer at
336 * symbol _bootphase1_version_pointer, perform slight sanity checks on the
337 * pointer, then use it.
338 */
339 char *bootrom_version = *(char**)&_bootphase1_version_pointer;
340 if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
341 strcat(VersionString, "bootrom version information appears invalid\n");
342 } else {
343 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
344 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
345 }
346
347 FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
348 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
349
350 for (int i = 0; i < fpga_bitstream_num; i++) {
351 strncat(VersionString, fpga_version_information[i], sizeof(VersionString) - strlen(VersionString) - 1);
352 strncat(VersionString, "\n", sizeof(VersionString) - strlen(VersionString) - 1);
353 }
354
355 // test availability of SmartCard slot
356 if (I2C_is_available()) {
357 strncat(VersionString, "SmartCard Slot: available\n", sizeof(VersionString) - strlen(VersionString) - 1);
358 } else {
359 strncat(VersionString, "SmartCard Slot: not available\n", sizeof(VersionString) - strlen(VersionString) - 1);
360 }
361
362 // Send Chip ID and used flash memory
363 uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
364 uint32_t compressed_data_section_size = common_area.arg1;
365 cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, hw_capabilities, VersionString, strlen(VersionString));
366 }
367
368 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
369 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
370 void printUSBSpeed(void)
371 {
372 Dbprintf("USB Speed:");
373 Dbprintf(" Sending USB packets to client...");
374
375 #define USB_SPEED_TEST_MIN_TIME 1500 // in milliseconds
376 uint8_t *test_data = BigBuf_get_addr();
377 uint32_t end_time;
378
379 uint32_t start_time = end_time = GetTickCount();
380 uint32_t bytes_transferred = 0;
381
382 LED_B_ON();
383 while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
384 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
385 end_time = GetTickCount();
386 bytes_transferred += USB_CMD_DATA_SIZE;
387 }
388 LED_B_OFF();
389
390 Dbprintf(" Time elapsed: %dms", end_time - start_time);
391 Dbprintf(" Bytes transferred: %d", bytes_transferred);
392 Dbprintf(" USB Transfer Speed PM3 -> Client = %d Bytes/s",
393 1000 * bytes_transferred / (end_time - start_time));
394
395 }
396
397 /**
398 * Prints runtime information about the PM3.
399 **/
400 void SendStatus(void)
401 {
402 BigBuf_print_status();
403 Fpga_print_status();
404 #ifdef WITH_SMARTCARD
405 I2C_print_status();
406 #endif
407 printConfig(); //LF Sampling config
408 printUSBSpeed();
409 Dbprintf("Various");
410 Dbprintf(" MF_DBGLEVEL........%d", MF_DBGLEVEL);
411 Dbprintf(" ToSendMax..........%d", ToSendMax);
412 Dbprintf(" ToSendBit..........%d", ToSendBit);
413
414 cmd_send(CMD_ACK,1,0,0,0,0);
415 }
416
417 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF_StandAlone)
418
419 #define OPTS 2
420
421 void StandAloneMode()
422 {
423 DbpString("Stand-alone mode! No PC necessary.");
424 // Oooh pretty -- notify user we're in elite samy mode now
425 LED(LED_RED, 200);
426 LED(LED_ORANGE, 200);
427 LED(LED_GREEN, 200);
428 LED(LED_ORANGE, 200);
429 LED(LED_RED, 200);
430 LED(LED_ORANGE, 200);
431 LED(LED_GREEN, 200);
432 LED(LED_ORANGE, 200);
433 LED(LED_RED, 200);
434
435 }
436
437 #endif
438
439
440
441 #ifdef WITH_ISO14443a_StandAlone
442 void StandAloneMode14a()
443 {
444 StandAloneMode();
445 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
446
447 int selected = 0;
448 bool playing = false, GotoRecord = false, GotoClone = false;
449 bool cardRead[OPTS] = {false};
450 uint8_t readUID[10] = {0};
451 uint32_t uid_1st[OPTS]={0};
452 uint32_t uid_2nd[OPTS]={0};
453 uint32_t uid_tmp1 = 0;
454 uint32_t uid_tmp2 = 0;
455 iso14a_card_select_t hi14a_card[OPTS];
456
457 LED(selected + 1, 0);
458
459 for (;;)
460 {
461 usb_poll();
462 WDT_HIT();
463 SpinDelay(300);
464
465 if (GotoRecord || !cardRead[selected])
466 {
467 GotoRecord = false;
468 LEDsoff();
469 LED(selected + 1, 0);
470 LED(LED_RED2, 0);
471
472 // record
473 Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
474 /* need this delay to prevent catching some weird data */
475 SpinDelay(500);
476 /* Code for reading from 14a tag */
477 uint8_t uid[10] ={0};
478 uint32_t cuid;
479 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
480
481 for ( ; ; )
482 {
483 WDT_HIT();
484 if (BUTTON_PRESS()) {
485 if (cardRead[selected]) {
486 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
487 break;
488 }
489 else if (cardRead[(selected+1)%OPTS]) {
490 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
491 selected = (selected+1)%OPTS;
492 break;
493 }
494 else {
495 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
496 SpinDelay(300);
497 }
498 }
499 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid, true, 0, true))
500 continue;
501 else
502 {
503 Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
504 memcpy(readUID,uid,10*sizeof(uint8_t));
505 uint8_t *dst = (uint8_t *)&uid_tmp1;
506 // Set UID byte order
507 for (int i=0; i<4; i++)
508 dst[i] = uid[3-i];
509 dst = (uint8_t *)&uid_tmp2;
510 for (int i=0; i<4; i++)
511 dst[i] = uid[7-i];
512 if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
513 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
514 }
515 else {
516 if (uid_tmp2) {
517 Dbprintf("Bank[%d] received a 7-byte UID",selected);
518 uid_1st[selected] = (uid_tmp1)>>8;
519 uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
520 }
521 else {
522 Dbprintf("Bank[%d] received a 4-byte UID",selected);
523 uid_1st[selected] = uid_tmp1;
524 uid_2nd[selected] = uid_tmp2;
525 }
526 break;
527 }
528 }
529 }
530 Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
531 Dbprintf("SAK = %02X",hi14a_card[selected].sak);
532 LEDsoff();
533 LED(LED_GREEN, 200);
534 LED(LED_ORANGE, 200);
535 LED(LED_GREEN, 200);
536 LED(LED_ORANGE, 200);
537
538 LEDsoff();
539 LED(selected + 1, 0);
540
541 // Next state is replay:
542 playing = true;
543
544 cardRead[selected] = true;
545 }
546 /* MF Classic UID clone */
547 else if (GotoClone)
548 {
549 GotoClone=false;
550 LEDsoff();
551 LED(selected + 1, 0);
552 LED(LED_ORANGE, 250);
553
554
555 // record
556 Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
557
558 // wait for button to be released
559 while(BUTTON_PRESS())
560 {
561 // Delay cloning until card is in place
562 WDT_HIT();
563 }
564 Dbprintf("Starting clone. [Bank: %u]", selected);
565 // need this delay to prevent catching some weird data
566 SpinDelay(500);
567 // Begin clone function here:
568 /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
569 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
570 memcpy(c.d.asBytes, data, 16);
571 SendCommand(&c);
572
573 Block read is similar:
574 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
575 We need to imitate that call with blockNo 0 to set a uid.
576
577 The get and set commands are handled in this file:
578 // Work with "magic Chinese" card
579 case CMD_MIFARE_CSETBLOCK:
580 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
581 break;
582 case CMD_MIFARE_CGETBLOCK:
583 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
584 break;
585
586 mfCSetUID provides example logic for UID set workflow:
587 -Read block0 from card in field with MifareCGetBlock()
588 -Configure new values without replacing reserved bytes
589 memcpy(block0, uid, 4); // Copy UID bytes from byte array
590 // Mifare UID BCC
591 block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
592 Bytes 5-7 are reserved SAK and ATQA for mifare classic
593 -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
594 */
595 uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
596 // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
597 MifareCGetBlock(0x3F, 1, 0, oldBlock0);
598 if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
599 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
600 playing = true;
601 }
602 else {
603 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
604 memcpy(newBlock0,oldBlock0,16);
605 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
606
607 newBlock0[0] = uid_1st[selected]>>24;
608 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
609 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
610 newBlock0[3] = 0xFF & (uid_1st[selected]);
611 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
612 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
613 MifareCSetBlock(0, 0xFF,0, newBlock0);
614 MifareCGetBlock(0x3F, 1, 0, testBlock0);
615 if (memcmp(testBlock0,newBlock0,16)==0)
616 {
617 DbpString("Cloned successfull!");
618 cardRead[selected] = false; // Only if the card was cloned successfully should we clear it
619 playing = false;
620 GotoRecord = true;
621 selected = (selected+1) % OPTS;
622 }
623 else {
624 Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
625 playing = true;
626 }
627 }
628 LEDsoff();
629 LED(selected + 1, 0);
630
631 }
632 // Change where to record (or begin playing)
633 else if (playing) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
634 {
635 LEDsoff();
636 LED(selected + 1, 0);
637
638 // Begin transmitting
639 LED(LED_GREEN, 0);
640 DbpString("Playing");
641 for ( ; ; ) {
642 WDT_HIT();
643 int button_action = BUTTON_HELD(1000);
644 if (button_action == 0) { // No button action, proceed with sim
645 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
646 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
647 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
648 DbpString("Mifare Classic");
649 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
650 }
651 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
652 DbpString("Mifare Ultralight");
653 SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
654 }
655 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
656 DbpString("Mifare DESFire");
657 SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
658 }
659 else {
660 Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
661 SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
662 }
663 }
664 else if (button_action == BUTTON_SINGLE_CLICK) {
665 selected = (selected + 1) % OPTS;
666 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
667 GotoRecord = true;
668 break;
669 }
670 else if (button_action == BUTTON_HOLD) {
671 Dbprintf("Playtime over. Begin cloning...");
672 GotoClone = true;
673 break;
674 }
675 WDT_HIT();
676 }
677
678 /* We pressed a button so ignore it here with a delay */
679 SpinDelay(300);
680 LEDsoff();
681 LED(selected + 1, 0);
682 }
683 }
684 }
685 #elif WITH_LF_StandAlone
686 // samy's sniff and repeat routine
687 void SamyRun()
688 {
689 StandAloneMode();
690 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
691
692 int tops[OPTS], high[OPTS], low[OPTS];
693 int selected = 0;
694 int playing = 0;
695 int cardRead = 0;
696
697 // Turn on selected LED
698 LED(selected + 1, 0);
699
700 for (;;)
701 {
702 usb_poll();
703 WDT_HIT();
704
705 // Was our button held down or pressed?
706 int button_pressed = BUTTON_HELD(1000);
707 SpinDelay(300);
708
709 // Button was held for a second, begin recording
710 if (button_pressed > 0 && cardRead == 0)
711 {
712 LEDsoff();
713 LED(selected + 1, 0);
714 LED(LED_RED2, 0);
715
716 // record
717 DbpString("Starting recording");
718
719 // wait for button to be released
720 while(BUTTON_PRESS())
721 WDT_HIT();
722
723 /* need this delay to prevent catching some weird data */
724 SpinDelay(500);
725
726 CmdHIDdemodFSK(1, &tops[selected], &high[selected], &low[selected], 0);
727 if (tops[selected] > 0)
728 Dbprintf("Recorded %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
729 else
730 Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
731
732 LEDsoff();
733 LED(selected + 1, 0);
734 // Finished recording
735
736 // If we were previously playing, set playing off
737 // so next button push begins playing what we recorded
738 playing = 0;
739
740 cardRead = 1;
741
742 }
743
744 else if (button_pressed > 0 && cardRead == 1)
745 {
746 LEDsoff();
747 LED(selected + 1, 0);
748 LED(LED_ORANGE, 0);
749
750 // record
751 if (tops[selected] > 0)
752 Dbprintf("Cloning %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
753 else
754 Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
755
756 // wait for button to be released
757 while(BUTTON_PRESS())
758 WDT_HIT();
759
760 /* need this delay to prevent catching some weird data */
761 SpinDelay(500);
762
763 CopyHIDtoT55x7(tops[selected] & 0x000FFFFF, high[selected], low[selected], (tops[selected] != 0 && ((high[selected]& 0xFFFFFFC0) != 0)), 0x1D);
764 if (tops[selected] > 0)
765 Dbprintf("Cloned %x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
766 else
767 Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
768
769 LEDsoff();
770 LED(selected + 1, 0);
771 // Finished recording
772
773 // If we were previously playing, set playing off
774 // so next button push begins playing what we recorded
775 playing = 0;
776
777 cardRead = 0;
778
779 }
780
781 // Change where to record (or begin playing)
782 else if (button_pressed)
783 {
784 // Next option if we were previously playing
785 if (playing)
786 selected = (selected + 1) % OPTS;
787 playing = !playing;
788
789 LEDsoff();
790 LED(selected + 1, 0);
791
792 // Begin transmitting
793 if (playing)
794 {
795 LED(LED_GREEN, 0);
796 DbpString("Playing");
797 // wait for button to be released
798 while(BUTTON_PRESS())
799 WDT_HIT();
800 if (tops[selected] > 0)
801 Dbprintf("%x %x%08x%08x", selected, tops[selected], high[selected], low[selected]);
802 else
803 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
804
805 CmdHIDsimTAG(tops[selected], high[selected], low[selected], 0);
806 DbpString("Done playing");
807 if (BUTTON_HELD(1000) > 0)
808 {
809 DbpString("Exiting");
810 LEDsoff();
811 return;
812 }
813
814 /* We pressed a button so ignore it here with a delay */
815 SpinDelay(300);
816
817 // when done, we're done playing, move to next option
818 selected = (selected + 1) % OPTS;
819 playing = !playing;
820 LEDsoff();
821 LED(selected + 1, 0);
822 }
823 else
824 while(BUTTON_PRESS())
825 WDT_HIT();
826 }
827 }
828 }
829
830 #endif
831 /*
832 OBJECTIVE
833 Listen and detect an external reader. Determine the best location
834 for the antenna.
835
836 INSTRUCTIONS:
837 Inside the ListenReaderField() function, there is two mode.
838 By default, when you call the function, you will enter mode 1.
839 If you press the PM3 button one time, you will enter mode 2.
840 If you press the PM3 button a second time, you will exit the function.
841
842 DESCRIPTION OF MODE 1:
843 This mode just listens for an external reader field and lights up green
844 for HF and/or red for LF. This is the original mode of the detectreader
845 function.
846
847 DESCRIPTION OF MODE 2:
848 This mode will visually represent, using the LEDs, the actual strength of the
849 current compared to the maximum current detected. Basically, once you know
850 what kind of external reader is present, it will help you spot the best location to place
851 your antenna. You will probably not get some good results if there is a LF and a HF reader
852 at the same place! :-)
853
854 LIGHT SCHEME USED:
855 */
856 static const char LIGHT_SCHEME[] = {
857 0x0, /* ---- | No field detected */
858 0x1, /* X--- | 14% of maximum current detected */
859 0x2, /* -X-- | 29% of maximum current detected */
860 0x4, /* --X- | 43% of maximum current detected */
861 0x8, /* ---X | 57% of maximum current detected */
862 0xC, /* --XX | 71% of maximum current detected */
863 0xE, /* -XXX | 86% of maximum current detected */
864 0xF, /* XXXX | 100% of maximum current detected */
865 };
866 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
867
868 void ListenReaderField(int limit)
869 {
870 int lf_av, lf_av_new=0, lf_baseline= 0, lf_max;
871 int hf_av, hf_av_new=0, hf_baseline= 0, hf_max;
872 int mode=1, display_val, display_max, i;
873
874 #define LF_ONLY 1
875 #define HF_ONLY 2
876 #define REPORT_CHANGE_PERCENT 5 // report new values only if they have changed at least by REPORT_CHANGE_PERCENT
877 #define MIN_HF_FIELD 300 // in mode 1 signal HF field greater than MIN_HF_FIELD above baseline
878 #define MIN_LF_FIELD 1200 // in mode 1 signal LF field greater than MIN_LF_FIELD above baseline
879
880
881 // switch off FPGA - we don't want to measure our own signal
882 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
883 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
884
885 LEDsoff();
886
887 lf_av = lf_max = AvgAdc_Voltage_LF();
888
889 if(limit != HF_ONLY) {
890 Dbprintf("LF 125/134kHz Baseline: %dmV", lf_av);
891 lf_baseline = lf_av;
892 }
893
894 hf_av = hf_max = AvgAdc_Voltage_HF();
895
896 if (limit != LF_ONLY) {
897 Dbprintf("HF 13.56MHz Baseline: %dmV", hf_av);
898 hf_baseline = hf_av;
899 }
900
901 for(;;) {
902 SpinDelay(500);
903 if (BUTTON_PRESS()) {
904 switch (mode) {
905 case 1:
906 mode=2;
907 DbpString("Signal Strength Mode");
908 break;
909 case 2:
910 default:
911 DbpString("Stopped");
912 LEDsoff();
913 return;
914 break;
915 }
916 while (BUTTON_PRESS());
917 }
918 WDT_HIT();
919
920 if (limit != HF_ONLY) {
921 if(mode == 1) {
922 if (lf_av - lf_baseline > MIN_LF_FIELD)
923 LED_D_ON();
924 else
925 LED_D_OFF();
926 }
927
928 lf_av_new = AvgAdc_Voltage_LF();
929 // see if there's a significant change
930 if (ABS((lf_av - lf_av_new)*100/(lf_av?lf_av:1)) > REPORT_CHANGE_PERCENT) {
931 Dbprintf("LF 125/134kHz Field Change: %5dmV", lf_av_new);
932 lf_av = lf_av_new;
933 if (lf_av > lf_max)
934 lf_max = lf_av;
935 }
936 }
937
938 if (limit != LF_ONLY) {
939 if (mode == 1){
940 if (hf_av - hf_baseline > MIN_HF_FIELD)
941 LED_B_ON();
942 else
943 LED_B_OFF();
944 }
945
946 hf_av_new = AvgAdc_Voltage_HF();
947
948 // see if there's a significant change
949 if (ABS((hf_av - hf_av_new)*100/(hf_av?hf_av:1)) > REPORT_CHANGE_PERCENT) {
950 Dbprintf("HF 13.56MHz Field Change: %5dmV", hf_av_new);
951 hf_av = hf_av_new;
952 if (hf_av > hf_max)
953 hf_max = hf_av;
954 }
955 }
956
957 if(mode == 2) {
958 if (limit == LF_ONLY) {
959 display_val = lf_av;
960 display_max = lf_max;
961 } else if (limit == HF_ONLY) {
962 display_val = hf_av;
963 display_max = hf_max;
964 } else { /* Pick one at random */
965 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
966 display_val = hf_av;
967 display_max = hf_max;
968 } else {
969 display_val = lf_av;
970 display_max = lf_max;
971 }
972 }
973 for (i=0; i<LIGHT_LEN; i++) {
974 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
975 if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
976 if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
977 if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
978 if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
979 break;
980 }
981 }
982 }
983 }
984 }
985
986 void UsbPacketReceived(uint8_t *packet, int len)
987 {
988 UsbCommand *c = (UsbCommand *)packet;
989
990 // Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
991
992 switch(c->cmd) {
993 #ifdef WITH_LF
994 case CMD_SET_LF_SAMPLING_CONFIG:
995 setSamplingConfig((sample_config *) c->d.asBytes);
996 break;
997 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
998 cmd_send(CMD_ACK,SampleLF(c->arg[0], c->arg[1]),0,0,0,0);
999 break;
1000 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
1001 ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1002 break;
1003 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
1004 cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
1005 break;
1006 case CMD_HID_DEMOD_FSK:
1007 CmdHIDdemodFSK(c->arg[0], 0, 0, 0, 1);
1008 break;
1009 case CMD_HID_SIM_TAG:
1010 CmdHIDsimTAG(c->arg[0], c->arg[1], c->arg[2], 1);
1011 break;
1012 case CMD_FSK_SIM_TAG:
1013 CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1014 break;
1015 case CMD_ASK_SIM_TAG:
1016 CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1017 break;
1018 case CMD_PSK_SIM_TAG:
1019 CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1020 break;
1021 case CMD_HID_CLONE_TAG:
1022 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x1D);
1023 break;
1024 case CMD_PARADOX_CLONE_TAG:
1025 // Paradox cards are the same as HID, with a different preamble, so we can reuse the same function
1026 CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0], 0x0F);
1027 break;
1028 case CMD_IO_DEMOD_FSK:
1029 CmdIOdemodFSK(c->arg[0], 0, 0, 1);
1030 break;
1031 case CMD_IO_CLONE_TAG:
1032 CopyIOtoT55x7(c->arg[0], c->arg[1]);
1033 break;
1034 case CMD_EM410X_DEMOD:
1035 CmdEM410xdemod(c->arg[0], 0, 0, 1);
1036 break;
1037 case CMD_EM410X_WRITE_TAG:
1038 WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
1039 break;
1040 case CMD_READ_TI_TYPE:
1041 ReadTItag();
1042 break;
1043 case CMD_WRITE_TI_TYPE:
1044 WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
1045 break;
1046 case CMD_SIMULATE_TAG_125K:
1047 LED_A_ON();
1048 SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
1049 LED_A_OFF();
1050 break;
1051 case CMD_LF_SIMULATE_BIDIR:
1052 SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
1053 break;
1054 case CMD_INDALA_CLONE_TAG:
1055 CopyIndala64toT55x7(c->arg[0], c->arg[1]);
1056 break;
1057 case CMD_INDALA_CLONE_TAG_L:
1058 CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
1059 break;
1060 case CMD_T55XX_READ_BLOCK:
1061 T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
1062 break;
1063 case CMD_T55XX_WRITE_BLOCK:
1064 T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1065 break;
1066 case CMD_T55XX_WAKEUP:
1067 T55xxWakeUp(c->arg[0]);
1068 break;
1069 case CMD_T55XX_RESET_READ:
1070 T55xxResetRead();
1071 break;
1072 case CMD_PCF7931_READ:
1073 ReadPCF7931();
1074 break;
1075 case CMD_PCF7931_WRITE:
1076 WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
1077 break;
1078 case CMD_PCF7931_BRUTEFORCE:
1079 BruteForcePCF7931(c->arg[0], (c->arg[1] & 0xFF), c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128);
1080 break;
1081 case CMD_EM4X_READ_WORD:
1082 EM4xReadWord(c->arg[0], c->arg[1],c->arg[2]);
1083 break;
1084 case CMD_EM4X_WRITE_WORD:
1085 EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2]);
1086 break;
1087 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1088 CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1089 break;
1090 case CMD_VIKING_CLONE_TAG:
1091 CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1092 break;
1093 case CMD_COTAG:
1094 Cotag(c->arg[0]);
1095 break;
1096 #endif
1097
1098 #ifdef WITH_HITAG
1099 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1100 SnoopHitag(c->arg[0]);
1101 break;
1102 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1103 SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1104 break;
1105 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1106 ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1107 break;
1108 case CMD_SIMULATE_HITAG_S:// Simulate Hitag s tag, args = memory content
1109 SimulateHitagSTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1110 break;
1111 case CMD_TEST_HITAGS_TRACES:// Tests every challenge within the given file
1112 check_challenges_cmd((bool)c->arg[0], (byte_t*)c->d.asBytes, (uint8_t)c->arg[1]);
1113 break;
1114 case CMD_READ_HITAG_S://Reader for only Hitag S tags, args = key or challenge
1115 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], false);
1116 break;
1117 case CMD_READ_HITAG_S_BLK:
1118 ReadHitagSCmd((hitag_function)c->arg[0], (hitag_data*)c->d.asBytes, (uint8_t)c->arg[1], (uint8_t)c->arg[2], true);
1119 break;
1120 case CMD_WR_HITAG_S://writer for Hitag tags args=data to write,page and key or challenge
1121 if ((hitag_function)c->arg[0] < 10) {
1122 WritePageHitagS((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes,c->arg[2]);
1123 }
1124 else if ((hitag_function)c->arg[0] >= 10) {
1125 WriterHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes, c->arg[2]);
1126 }
1127 break;
1128 #endif
1129
1130 #ifdef WITH_ISO15693
1131 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1132 AcquireRawAdcSamplesIso15693();
1133 break;
1134
1135 case CMD_SNOOP_ISO_15693:
1136 SnoopIso15693();
1137 break;
1138
1139 case CMD_ISO_15693_COMMAND:
1140 DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1141 break;
1142
1143 case CMD_ISO_15693_FIND_AFI:
1144 BruteforceIso15693Afi(c->arg[0]);
1145 break;
1146
1147 case CMD_ISO_15693_DEBUG:
1148 SetDebugIso15693(c->arg[0]);
1149 break;
1150
1151 case CMD_READER_ISO_15693:
1152 ReaderIso15693(c->arg[0]);
1153 break;
1154 case CMD_SIMTAG_ISO_15693:
1155 SimTagIso15693(c->arg[0], c->d.asBytes);
1156 break;
1157 #endif
1158
1159 #ifdef WITH_LEGICRF
1160 case CMD_SIMULATE_TAG_LEGIC_RF:
1161 LegicRfSimulate(c->arg[0]);
1162 break;
1163
1164 case CMD_WRITER_LEGIC_RF:
1165 LegicRfWriter(c->arg[1], c->arg[0]);
1166 break;
1167
1168 case CMD_READER_LEGIC_RF:
1169 LegicRfReader(c->arg[0], c->arg[1]);
1170 break;
1171 #endif
1172
1173 #ifdef WITH_ISO14443b
1174 case CMD_READ_SRI512_TAG:
1175 ReadSTMemoryIso14443b(0x0F);
1176 break;
1177 case CMD_READ_SRIX4K_TAG:
1178 ReadSTMemoryIso14443b(0x7F);
1179 break;
1180 case CMD_SNOOP_ISO_14443B:
1181 SnoopIso14443b();
1182 break;
1183 case CMD_SIMULATE_TAG_ISO_14443B:
1184 SimulateIso14443bTag();
1185 break;
1186 case CMD_ISO_14443B_COMMAND:
1187 SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1188 break;
1189 #endif
1190
1191 #ifdef WITH_ISO14443a
1192 case CMD_SNOOP_ISO_14443a:
1193 SnoopIso14443a(c->arg[0]);
1194 break;
1195 case CMD_READER_ISO_14443a:
1196 ReaderIso14443a(c);
1197 break;
1198 case CMD_SIMULATE_TAG_ISO_14443a:
1199 SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); // ## Simulate iso14443a tag - pass tag type & UID
1200 break;
1201
1202 case CMD_EPA_PACE_COLLECT_NONCE:
1203 EPA_PACE_Collect_Nonce(c);
1204 break;
1205 case CMD_EPA_PACE_REPLAY:
1206 EPA_PACE_Replay(c);
1207 break;
1208
1209 case CMD_READER_MIFARE:
1210 ReaderMifare(c->arg[0]);
1211 break;
1212 case CMD_MIFARE_READBL:
1213 MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1214 break;
1215 case CMD_MIFAREU_READBL:
1216 MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1217 break;
1218 case CMD_MIFAREUC_AUTH:
1219 MifareUC_Auth(c->arg[0],c->d.asBytes);
1220 break;
1221 case CMD_MIFAREU_READCARD:
1222 MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1223 break;
1224 case CMD_MIFAREUC_SETPWD:
1225 MifareUSetPwd(c->arg[0], c->d.asBytes);
1226 break;
1227 case CMD_MIFARE_READSC:
1228 MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1229 break;
1230 case CMD_MIFARE_WRITEBL:
1231 MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1232 break;
1233 //case CMD_MIFAREU_WRITEBL_COMPAT:
1234 //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1235 //break;
1236 case CMD_MIFAREU_WRITEBL:
1237 MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1238 break;
1239 case CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES:
1240 MifareAcquireEncryptedNonces(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1241 break;
1242 case CMD_MIFARE_NESTED:
1243 MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1244 break;
1245 case CMD_MIFARE_CHKKEYS:
1246 MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1247 break;
1248 case CMD_SIMULATE_MIFARE_CARD:
1249 Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1250 break;
1251
1252 // emulator
1253 case CMD_MIFARE_SET_DBGMODE:
1254 MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1255 break;
1256 case CMD_MIFARE_EML_MEMCLR:
1257 MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1258 break;
1259 case CMD_MIFARE_EML_MEMSET:
1260 MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1261 break;
1262 case CMD_MIFARE_EML_MEMGET:
1263 MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1264 break;
1265 case CMD_MIFARE_EML_CARDLOAD:
1266 MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1267 break;
1268
1269 // Work with "magic Chinese" card
1270 case CMD_MIFARE_CWIPE:
1271 MifareCWipe(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1272 break;
1273 case CMD_MIFARE_CSETBLOCK:
1274 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1275 break;
1276 case CMD_MIFARE_CGETBLOCK:
1277 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1278 break;
1279 case CMD_MIFARE_CIDENT:
1280 MifareCIdent();
1281 break;
1282
1283 // mifare sniffer
1284 case CMD_MIFARE_SNIFFER:
1285 SniffMifare(c->arg[0]);
1286 break;
1287
1288 #endif
1289
1290 #ifdef WITH_ICLASS
1291 // Makes use of ISO14443a FPGA Firmware
1292 case CMD_SNOOP_ICLASS:
1293 SnoopIClass();
1294 break;
1295 case CMD_SIMULATE_TAG_ICLASS:
1296 SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1297 break;
1298 case CMD_READER_ICLASS:
1299 ReaderIClass(c->arg[0]);
1300 break;
1301 case CMD_READER_ICLASS_REPLAY:
1302 ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1303 break;
1304 case CMD_ICLASS_EML_MEMSET:
1305 emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1306 break;
1307 case CMD_ICLASS_WRITEBLOCK:
1308 iClass_WriteBlock(c->arg[0], c->d.asBytes);
1309 break;
1310 case CMD_ICLASS_READCHECK: // auth step 1
1311 iClass_ReadCheck(c->arg[0], c->arg[1]);
1312 break;
1313 case CMD_ICLASS_READBLOCK:
1314 iClass_ReadBlk(c->arg[0]);
1315 break;
1316 case CMD_ICLASS_AUTHENTICATION: //check
1317 iClass_Authentication(c->d.asBytes);
1318 break;
1319 case CMD_ICLASS_DUMP:
1320 iClass_Dump(c->arg[0], c->arg[1]);
1321 break;
1322 case CMD_ICLASS_CLONE:
1323 iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1324 break;
1325 #endif
1326 #ifdef WITH_HFSNOOP
1327 case CMD_HF_SNIFFER:
1328 HfSnoop(c->arg[0], c->arg[1]);
1329 break;
1330 #endif
1331 #ifdef WITH_SMARTCARD
1332 case CMD_SMART_ATR: {
1333 SmartCardAtr();
1334 break;
1335 }
1336 case CMD_SMART_SETCLOCK:{
1337 SmartCardSetClock(c->arg[0]);
1338 break;
1339 }
1340 case CMD_SMART_RAW: {
1341 SmartCardRaw(c->arg[0], c->arg[1], c->d.asBytes);
1342 break;
1343 }
1344 case CMD_SMART_UPLOAD: {
1345 // upload file from client
1346 uint8_t *mem = BigBuf_get_addr();
1347 memcpy( mem + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1348 cmd_send(CMD_ACK,1,0,0,0,0);
1349 break;
1350 }
1351 case CMD_SMART_UPGRADE: {
1352 SmartCardUpgrade(c->arg[0]);
1353 break;
1354 }
1355 #endif
1356
1357 case CMD_BUFF_CLEAR:
1358 BigBuf_Clear();
1359 break;
1360
1361 case CMD_MEASURE_ANTENNA_TUNING:
1362 MeasureAntennaTuning(c->arg[0]);
1363 break;
1364
1365 case CMD_MEASURE_ANTENNA_TUNING_HF:
1366 MeasureAntennaTuningHf();
1367 break;
1368
1369 case CMD_LISTEN_READER_FIELD:
1370 ListenReaderField(c->arg[0]);
1371 break;
1372
1373 case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control
1374 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1375 SpinDelay(200);
1376 LED_D_OFF(); // LED D indicates field ON or OFF
1377 break;
1378
1379 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1380
1381 LED_B_ON();
1382 uint8_t *BigBuf = BigBuf_get_addr();
1383 for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1384 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1385 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1386 }
1387 // Trigger a finish downloading signal with an ACK frame
1388 cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1389 LED_B_OFF();
1390 break;
1391
1392 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1393 // iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
1394 // to be able to use this one for uploading data to device
1395 // arg1 = 0 upload for LF usage
1396 // 1 upload for HF usage
1397 if (c->arg[1] == 0)
1398 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1399 else
1400 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1401
1402 uint8_t *b = BigBuf_get_addr();
1403 memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1404 cmd_send(CMD_ACK,0,0,0,0,0);
1405 break;
1406 }
1407 case CMD_READ_MEM:
1408 ReadMem(c->arg[0]);
1409 break;
1410
1411 case CMD_SET_LF_DIVISOR:
1412 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1413 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1414 break;
1415
1416 case CMD_SET_ADC_MUX:
1417 switch(c->arg[0]) {
1418 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1419 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1420 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1421 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1422 }
1423 break;
1424
1425 case CMD_VERSION:
1426 SendVersion();
1427 break;
1428 case CMD_STATUS:
1429 SendStatus();
1430 break;
1431 case CMD_PING:
1432 cmd_send(CMD_ACK,0,0,0,0,0);
1433 break;
1434 #ifdef WITH_LCD
1435 case CMD_LCD_RESET:
1436 LCDReset();
1437 break;
1438 case CMD_LCD:
1439 LCDSend(c->arg[0]);
1440 break;
1441 #endif
1442 case CMD_SETUP_WRITE:
1443 case CMD_FINISH_WRITE:
1444 case CMD_HARDWARE_RESET:
1445 usb_disable();
1446 SpinDelay(1000);
1447 SpinDelay(1000);
1448 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1449 for(;;) {
1450 // We're going to reset, and the bootrom will take control.
1451 }
1452 break;
1453
1454 case CMD_START_FLASH:
1455 if(common_area.flags.bootrom_present) {
1456 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1457 }
1458 usb_disable();
1459 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1460 for(;;);
1461 break;
1462
1463 case CMD_DEVICE_INFO: {
1464 uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1465 if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1466 cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1467 break;
1468 }
1469 default:
1470 Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1471 break;
1472 }
1473 }
1474
1475 void __attribute__((noreturn)) AppMain(void)
1476 {
1477 SpinDelay(100);
1478 clear_trace();
1479 if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1480 /* Initialize common area */
1481 memset(&common_area, 0, sizeof(common_area));
1482 common_area.magic = COMMON_AREA_MAGIC;
1483 common_area.version = 1;
1484 }
1485 common_area.flags.osimage_present = 1;
1486
1487 LED_D_OFF();
1488 LED_C_OFF();
1489 LED_B_OFF();
1490 LED_A_OFF();
1491
1492 // Init USB device
1493 usb_enable();
1494
1495 // The FPGA gets its clock from us from PCK0 output, so set that up.
1496 AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1497 AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1498 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1499 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1500 AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1501 AT91C_PMC_PRES_CLK_4; // 4 for 24Mhz pck0, 2 for 48 MHZ pck0
1502 AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1503
1504 // Reset SPI
1505 AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1506 // Reset SSC
1507 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1508
1509 // Load the FPGA image, which we have stored in our flash.
1510 // (the HF version by default)
1511 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1512
1513 StartTickCount();
1514
1515 #ifdef WITH_LCD
1516 LCDInit();
1517 #endif
1518
1519 byte_t rx[sizeof(UsbCommand)];
1520 size_t rx_len;
1521
1522 for(;;) {
1523 if (usb_poll()) {
1524 rx_len = usb_read(rx,sizeof(UsbCommand));
1525 if (rx_len) {
1526 UsbPacketReceived(rx,rx_len);
1527 }
1528 }
1529 WDT_HIT();
1530
1531 #ifdef WITH_LF_StandAlone
1532 #ifndef WITH_ISO14443a_StandAlone
1533 if (BUTTON_HELD(1000) > 0)
1534 SamyRun();
1535 #endif
1536 #endif
1537 #ifdef WITH_ISO14443a
1538 #ifdef WITH_ISO14443a_StandAlone
1539 if (BUTTON_HELD(1000) > 0)
1540 StandAloneMode14a();
1541 #endif
1542 #endif
1543 }
1544 }
Proxmark3 GIT tracking
Impressum, Datenschutz