X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/ebd7aaf9e7560bfbffb9781bd31eebeed4996005..3628c31882e371997087ecc0249710340bf170e6:/armsrc/appmain.c?ds=sidebyside

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index f42b0209..7dba687f 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -5,7 +5,6 @@
 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
 //-----------------------------------------------------------------------------
 
-
 #include <proxmark3.h>
 #include <stdlib.h>
 #include "apps.h"
@@ -14,9 +13,6 @@
 #include "LCD.h"
 #endif
 
-// The large multi-purpose buffer, typically used to hold A/D samples,
-// maybe pre-processed in some way.
-DWORD BigBuf[16000];
 int usbattached = 0;
 
 //=============================================================================
@@ -29,7 +25,6 @@ BYTE ToSend[256];
 int ToSendMax;
 static int ToSendBit;
 
-
 void BufferClear(void)
 {
 	memset(BigBuf,0,sizeof(BigBuf));
@@ -99,185 +94,6 @@ void DbpIntegers(int x1, int x2, int x3)
 	SpinDelay(50);
 }
 
-void AcquireRawAdcSamples125k(BOOL at134khz)
-{
-	if(at134khz) {
-		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-	} else {
-		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-	}
-
-	// Connect the A/D to the peak-detected low-frequency path.
-	SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
-
-	// Give it a bit of time for the resonant antenna to settle.
-	SpinDelay(50);
-
-	// Now set up the SSC to get the ADC samples that are now streaming at us.
-	FpgaSetupSsc();
-
-	// Now call the acquisition routine
-	DoAcquisition125k(at134khz);
-}
-
-// split into two routines so we can avoid timing issues after sending commands //
-void DoAcquisition125k(BOOL at134khz)
-{
-	BYTE *dest = (BYTE *)BigBuf;
-	int n = sizeof(BigBuf);
-	int i;
-
-	memset(dest,0,n);
-	i = 0;
-	for(;;) {
-		if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
-			SSC_TRANSMIT_HOLDING = 0x43;
-			LED_D_ON();
-		}
-		if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
-			dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
-			i++;
-			LED_D_OFF();
-			if(i >= n) {
-				break;
-			}
-		}
-	}
-	DbpIntegers(dest[0], dest[1], at134khz);
-}
-
-void ModThenAcquireRawAdcSamples125k(int delay_off,int period_0,int period_1,BYTE *command)
-{
-	BOOL at134khz;
-
-	// see if 'h' was specified
-	if(command[strlen((char *) command) - 1] == 'h')
-		at134khz= TRUE;
-	else
-		at134khz= FALSE;
-
-	if(at134khz) {
-		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-	} else {
-		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-	}
-
-	// Give it a bit of time for the resonant antenna to settle.
-	SpinDelay(50);
-
-	// Now set up the SSC to get the ADC samples that are now streaming at us.
-	FpgaSetupSsc();
-
-	// now modulate the reader field
-	while(*command != '\0' && *command != ' ')
-		{
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-		LED_D_OFF();
-		SpinDelayUs(delay_off);
-		if(at134khz) {
-			FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-			FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-		} else {
-			FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-			FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-		}
-		LED_D_ON();
-		if(*(command++) == '0')
-			SpinDelayUs(period_0);
-		else
-			SpinDelayUs(period_1);
-		}
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-	LED_D_OFF();
-	SpinDelayUs(delay_off);
-	if(at134khz) {
-		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-	} else {
-		FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-	}
-
-	// now do the read
-	DoAcquisition125k(at134khz);
-}
-
-void AcquireTiType(void)
-{
-	int i;
-	int n = 5000;
-
-	// clear buffer
-	memset(BigBuf,0,sizeof(BigBuf));
-
-	// Set up the synchronous serial port
-  PIO_DISABLE = (1<<GPIO_SSC_DIN);
-  PIO_PERIPHERAL_A_SEL = (1<<GPIO_SSC_DIN);
-
-	// steal this pin from the SSP and use it to control the modulation
-  PIO_ENABLE = (1<<GPIO_SSC_DOUT);
-	PIO_OUTPUT_ENABLE	= (1<<GPIO_SSC_DOUT);
-
-  SSC_CONTROL = SSC_CONTROL_RESET;
-  SSC_CONTROL = SSC_CONTROL_RX_ENABLE | SSC_CONTROL_TX_ENABLE;
-
-  // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long
-  // 48/2 = 24 MHz clock must be divided by 12
-  SSC_CLOCK_DIVISOR = 12;
-
-  SSC_RECEIVE_CLOCK_MODE = SSC_CLOCK_MODE_SELECT(0);
-	SSC_RECEIVE_FRAME_MODE = SSC_FRAME_MODE_BITS_IN_WORD(32) | SSC_FRAME_MODE_MSB_FIRST;
-	SSC_TRANSMIT_CLOCK_MODE = 0;
-	SSC_TRANSMIT_FRAME_MODE = 0;
-
-	LED_D_ON();
-
-	// modulate antenna
-	PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);
-
-	// Charge TI tag for 50ms.
-	SpinDelay(50);
-
-	// stop modulating antenna and listen
-	PIO_OUTPUT_DATA_CLEAR = (1<<GPIO_SSC_DOUT);
-
-	LED_D_OFF();
-
-	i = 0;
-	for(;;) {
-			if(SSC_STATUS & SSC_STATUS_RX_READY) {
-					BigBuf[i] = SSC_RECEIVE_HOLDING;	// store 32 bit values in buffer
-					i++; if(i >= n) return;
-			}
-			WDT_HIT();
-	}
-
-	// return stolen pin ro SSP
-	PIO_DISABLE = (1<<GPIO_SSC_DOUT);
-	PIO_PERIPHERAL_A_SEL = (1<<GPIO_SSC_DIN) | (1<<GPIO_SSC_DOUT);
-}
-
-void AcquireRawBitsTI(void)
-{
-	LED_D_ON();
-	// TI tags charge at 134.2Khz
-	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-	// Place FPGA in passthrough mode, in this mode the CROSS_LO line
-	// connects to SSP_DIN and the SSP_DOUT logic level controls
-	// whether we're modulating the antenna (high)
-	// or listening to the antenna (low)
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
-
-	// get TI tag data into the buffer
-	AcquireTiType();
-
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-}
-
 //-----------------------------------------------------------------------------
 // Read an ADC channel and block till it completes, then return the result
 // in ADC units (0 to 1023). Also a routine to average 32 samples and
@@ -364,397 +180,338 @@ void MeasureAntennaTuning(void)
 	UsbSendPacket((BYTE *)&c, sizeof(c));
 }
 
-void SimulateTagLowFrequency(int period, int ledcontrol)
+void SimulateTagHfListen(void)
 {
+	BYTE *dest = (BYTE *)BigBuf;
+	int n = sizeof(BigBuf);
+	BYTE v = 0;
 	int i;
-	BYTE *tab = (BYTE *)BigBuf;
-
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR);
+	int p = 0;
 
-	PIO_ENABLE = (1 << GPIO_SSC_DOUT) | (1 << GPIO_SSC_CLK);
+	// We're using this mode just so that I can test it out; the simulated
+	// tag mode would work just as well and be simpler.
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
 
-	PIO_OUTPUT_ENABLE = (1 << GPIO_SSC_DOUT);
-	PIO_OUTPUT_DISABLE = (1 << GPIO_SSC_CLK);
+	// We need to listen to the high-frequency, peak-detected path.
+	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
-#define SHORT_COIL()	LOW(GPIO_SSC_DOUT)
-#define OPEN_COIL()	HIGH(GPIO_SSC_DOUT)
+	FpgaSetupSsc();
 
 	i = 0;
 	for(;;) {
-		while(!(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK))) {
-			if(BUTTON_PRESS()) {
-				DbpString("Stopped");
-				return;
-			}
-			WDT_HIT();
+		if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
+			SSC_TRANSMIT_HOLDING = 0xff;
 		}
+		if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
+			BYTE r = (BYTE)SSC_RECEIVE_HOLDING;
 
-		if (ledcontrol)
-			LED_D_ON();
-
-		if(tab[i])
-			OPEN_COIL();
-		else
-			SHORT_COIL();
+			v <<= 1;
+			if(r & 1) {
+				v |= 1;
+			}
+			p++;
 
-		if (ledcontrol)
-			LED_D_OFF();
+			if(p >= 8) {
+				dest[i] = v;
+				v = 0;
+				p = 0;
+				i++;
 
-		while(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK)) {
-			if(BUTTON_PRESS()) {
-				DbpString("Stopped");
-				return;
+				if(i >= n) {
+					break;
+				}
 			}
-			WDT_HIT();
 		}
-
-		i++;
-		if(i == period) i = 0;
 	}
+	DbpString("simulate tag (now type bitsamples)");
 }
 
-// compose fc/8 fc/10 waveform
-static void fc(int c, int *n) {
-	BYTE *dest = (BYTE *)BigBuf;
-	int idx;
-
-	// for when we want an fc8 pattern every 4 logical bits
-	if(c==0) {
-		dest[((*n)++)]=1;
-		dest[((*n)++)]=1;
-		dest[((*n)++)]=0;
-		dest[((*n)++)]=0;
-		dest[((*n)++)]=0;
-		dest[((*n)++)]=0;
-		dest[((*n)++)]=0;
-		dest[((*n)++)]=0;
-	}
-	//	an fc/8  encoded bit is a bit pattern of  11000000  x6 = 48 samples
-	if(c==8) {
-		for (idx=0; idx<6; idx++) {
-			dest[((*n)++)]=1;
-			dest[((*n)++)]=1;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-		}
-	}
+void ReadMem(int addr)
+{
+	const DWORD *data = ((DWORD *)addr);
+	int i;
 
-	//	an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
-	if(c==10) {
-		for (idx=0; idx<5; idx++) {
-			dest[((*n)++)]=1;
-			dest[((*n)++)]=1;
-			dest[((*n)++)]=1;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-			dest[((*n)++)]=0;
-		}
-	}
+	DbpString("Reading memory at address");
+	DbpIntegers(0, 0, addr);
+	for (i = 0; i < 8; i+= 2)
+		DbpIntegers(0, data[i], data[i+1]);
 }
 
-// prepare a waveform pattern in the buffer based on the ID given then
-// simulate a HID tag until the button is pressed
-static void CmdHIDsimTAG(int hi, int lo, int ledcontrol)
+// samy's sniff and repeat routine
+void SamyRun()
 {
-	int n=0, i=0;
-	/*
-	 HID tag bitstream format
-	 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
-	 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
-	 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
-	 A fc8 is inserted before every 4 bits
-	 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
-	 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
-	*/
-
-	if (hi>0xFFF) {
-		DbpString("Tags can only have 44 bits.");
-		return;
-	}
-	fc(0,&n);
-	// special start of frame marker containing invalid bit sequences
-	fc(8,  &n);	fc(8,  &n);	// invalid
-	fc(8,  &n);	fc(10, &n); // logical 0
-	fc(10, &n);	fc(10, &n); // invalid
-	fc(8,  &n);	fc(10, &n); // logical 0
-
-	WDT_HIT();
-	// manchester encode bits 43 to 32
-	for (i=11; i>=0; i--) {
-		if ((i%4)==3) fc(0,&n);
-		if ((hi>>i)&1) {
-			fc(10, &n);	fc(8,  &n);		// low-high transition
-		} else {
-			fc(8,  &n);	fc(10, &n);		// high-low transition
-		}
-	}
+	DbpString("Stand-alone mode! No PC necessary.");
 
-	WDT_HIT();
-	// manchester encode bits 31 to 0
-	for (i=31; i>=0; i--) {
-		if ((i%4)==3) fc(0,&n);
-		if ((lo>>i)&1) {
-			fc(10, &n);	fc(8,  &n);		// low-high transition
-		} else {
-			fc(8,  &n);	fc(10, &n);		// high-low transition
-		}
-	}
+	// 3 possible options? no just 2 for now
+#define OPTS 2
 
-	if (ledcontrol)
-		LED_A_ON();
-	SimulateTagLowFrequency(n, ledcontrol);
+	int high[OPTS], low[OPTS];
 
-	if (ledcontrol)
-		LED_A_OFF();
-}
+	// Oooh pretty -- notify user we're in elite samy mode now
+	LED(LED_RED,	200);
+	LED(LED_ORANGE, 200);
+	LED(LED_GREEN,	200);
+	LED(LED_ORANGE, 200);
+	LED(LED_RED,	200);
+	LED(LED_ORANGE, 200);
+	LED(LED_GREEN,	200);
+	LED(LED_ORANGE, 200);
+	LED(LED_RED,	200);
 
-// loop to capture raw HID waveform then FSK demodulate the TAG ID from it
-static void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
-{
-	BYTE *dest = (BYTE *)BigBuf;
-	int m=0, n=0, i=0, idx=0, found=0, lastval=0;
-	DWORD hi=0, lo=0;
+	int selected = 0;
+	int playing = 0;
 
-	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+	// Turn on selected LED
+	LED(selected + 1, 0);
 
-	// Connect the A/D to the peak-detected low-frequency path.
-	SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
+	for (;;)
+	{
+		usbattached = UsbPoll(FALSE);
+		WDT_HIT();
 
-	// Give it a bit of time for the resonant antenna to settle.
-	SpinDelay(50);
+		// Was our button held down or pressed?
+		int button_pressed = BUTTON_HELD(1000);
+		SpinDelay(300);
 
-	// Now set up the SSC to get the ADC samples that are now streaming at us.
-	FpgaSetupSsc();
+		// Button was held for a second, begin recording
+		if (button_pressed > 0)
+		{
+			LEDsoff();
+			LED(selected + 1, 0);
+			LED(LED_RED2, 0);
 
-	for(;;) {
-		WDT_HIT();
-		if (ledcontrol)
-			LED_A_ON();
-		if(BUTTON_PRESS()) {
-			DbpString("Stopped");
-			if (ledcontrol)
-				LED_A_OFF();
-			return;
-		}
+			// record
+			DbpString("Starting recording");
 
-		i = 0;
-		m = sizeof(BigBuf);
-		memset(dest,128,m);
-		for(;;) {
-			if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
-				SSC_TRANSMIT_HOLDING = 0x43;
-				if (ledcontrol)
-					LED_D_ON();
-			}
-			if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
-				dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
-				// we don't care about actual value, only if it's more or less than a
-				// threshold essentially we capture zero crossings for later analysis
-				if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
-				i++;
-				if (ledcontrol)
-					LED_D_OFF();
-				if(i >= m) {
-					break;
-				}
-			}
-		}
+			// wait for button to be released
+			while(BUTTON_PRESS())
+				WDT_HIT();
 
-		// FSK demodulator
+			/* need this delay to prevent catching some weird data */
+			SpinDelay(500);
 
-		// sync to first lo-hi transition
-		for( idx=1; idx<m; idx++) {
-			if (dest[idx-1]<dest[idx])
-				lastval=idx;
-				break;
-		}
-		WDT_HIT();
+			CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
+			DbpString("Recorded");
+			DbpIntegers(selected, high[selected], low[selected]);
 
-		// count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
-		// or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
-		// between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
-		for( i=0; idx<m; idx++) {
-			if (dest[idx-1]<dest[idx]) {
-				dest[i]=idx-lastval;
-				if (dest[i] <= 8) {
-						dest[i]=1;
-				} else {
-						dest[i]=0;
-				}
+			LEDsoff();
+			LED(selected + 1, 0);
+			// Finished recording
 
-				lastval=idx;
-				i++;
-			}
+			// If we were previously playing, set playing off
+			// so next button push begins playing what we recorded
+			playing = 0;
 		}
-		m=i;
-		WDT_HIT();
 
-		// we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
-		lastval=dest[0];
-		idx=0;
-		i=0;
-		n=0;
-		for( idx=0; idx<m; idx++) {
-			if (dest[idx]==lastval) {
-				n++;
-			} else {
-				// a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
-				// an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
-				// swallowed up by rounding
-				// expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
-				// special start of frame markers use invalid manchester states (no transitions) by using sequences
-				// like 111000
-				if (dest[idx-1]) {
-					n=(n+1)/6;			// fc/8 in sets of 6
-				} else {
-					n=(n+1)/5;			// fc/10 in sets of 5
-				}
-				switch (n) {			// stuff appropriate bits in buffer
-					case 0:
-					case 1:	// one bit
-						dest[i++]=dest[idx-1];
-						break;
-					case 2: // two bits
-						dest[i++]=dest[idx-1];
-						dest[i++]=dest[idx-1];
-						break;
-					case 3: // 3 bit start of frame markers
-						dest[i++]=dest[idx-1];
-						dest[i++]=dest[idx-1];
-						dest[i++]=dest[idx-1];
-						break;
-					// When a logic 0 is immediately followed by the start of the next transmisson
-					// (special pattern) a pattern of 4 bit duration lengths is created.
-					case 4:
-						dest[i++]=dest[idx-1];
-						dest[i++]=dest[idx-1];
-						dest[i++]=dest[idx-1];
-						dest[i++]=dest[idx-1];
-						break;
-					default:	// this shouldn't happen, don't stuff any bits
-						break;
-				}
-				n=0;
-				lastval=dest[idx];
-			}
-		}
-		m=i;
-		WDT_HIT();
+		// Change where to record (or begin playing)
+		else if (button_pressed)
+		{
+			// Next option if we were previously playing
+			if (playing)
+				selected = (selected + 1) % OPTS;
+			playing = !playing;
 
-		// final loop, go over previously decoded manchester data and decode into usable tag ID
-		// 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
-		for( idx=0; idx<m-6; idx++) {
-			// search for a start of frame marker
-			if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
-			{
-				found=1;
-				idx+=6;
-				if (found && (hi|lo)) {
-					DbpString("TAG ID");
-					DbpIntegers(hi, lo, (lo>>1)&0xffff);
-					/* if we're only looking for one tag */
-					if (findone)
-					{
-						*high = hi;
-						*low = lo;
-						return;
-					}
-					hi=0;
-					lo=0;
-					found=0;
-				}
-			}
-			if (found) {
-				if (dest[idx] && (!dest[idx+1]) ) {
-					hi=(hi<<1)|(lo>>31);
-					lo=(lo<<1)|0;
-				} else if ( (!dest[idx]) && dest[idx+1]) {
-					hi=(hi<<1)|(lo>>31);
-					lo=(lo<<1)|1;
-				} else {
-					found=0;
-					hi=0;
-					lo=0;
-				}
-				idx++;
-			}
-			if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
+			LEDsoff();
+			LED(selected + 1, 0);
+
+			// Begin transmitting
+			if (playing)
 			{
-				found=1;
-				idx+=6;
-				if (found && (hi|lo)) {
-					DbpString("TAG ID");
-					DbpIntegers(hi, lo, (lo>>1)&0xffff);
-					/* if we're only looking for one tag */
-					if (findone)
+				LED(LED_GREEN, 0);
+				DbpString("Playing");
+				// wait for button to be released
+				while(BUTTON_PRESS())
+					WDT_HIT();
+				DbpIntegers(selected, high[selected], low[selected]);
+				CmdHIDsimTAG(high[selected], low[selected], 0);
+				DbpString("Done playing");
+				if (BUTTON_HELD(1000) > 0)
 					{
-						*high = hi;
-						*low = lo;
-						return;
+					DbpString("Exiting");
+					LEDsoff();
+					return;
 					}
-					hi=0;
-					lo=0;
-					found=0;
-				}
+
+				/* We pressed a button so ignore it here with a delay */
+				SpinDelay(300);
+
+				// when done, we're done playing, move to next option
+				selected = (selected + 1) % OPTS;
+				playing = !playing;
+				LEDsoff();
+				LED(selected + 1, 0);
 			}
+			else
+				while(BUTTON_PRESS())
+					WDT_HIT();
 		}
-		WDT_HIT();
 	}
 }
 
-void SimulateTagHfListen(void)
+
+/*
+OBJECTIVE
+Listen and detect an external reader. Determine the best location
+for the antenna.
+
+INSTRUCTIONS:
+Inside the ListenReaderField() function, there is two mode.
+By default, when you call the function, you will enter mode 1.
+If you press the PM3 button one time, you will enter mode 2.
+If you press the PM3 button a second time, you will exit the function.
+
+DESCRIPTION OF MODE 1:
+This mode just listens for an external reader field and lights up green
+for HF and/or red for LF. This is the original mode of the detectreader
+function.
+
+DESCRIPTION OF MODE 2:
+This mode will visually represent, using the LEDs, the actual strength of the
+current compared to the maximum current detected. Basically, once you know
+what kind of external reader is present, it will help you spot the best location to place
+your antenna. You will probably not get some good results if there is a LF and a HF reader
+at the same place! :-)
+
+LIGHT SCHEME USED:
+
+Light scheme | Descriptiong
+----------------------------------------------------
+    ----     | No field detected
+    X---     | 14% of maximum current detected
+    -X--     | 29% of maximum current detected
+    --X-     | 43% of maximum current detected
+    ---X     | 57% of maximum current detected
+    --XX     | 71% of maximum current detected
+    -XXX     | 86% of maximum current detected
+    XXXX     | 100% of maximum current detected
+
+TODO:
+Add the LF part for MODE 2
+
+*/
+void ListenReaderField(int limit)
 {
-	BYTE *dest = (BYTE *)BigBuf;
-	int n = sizeof(BigBuf);
-	BYTE v = 0;
-	int i;
-	int p = 0;
+	int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0;
+	int hf_av, hf_av_new,  hf_baseline= 0, hf_count= 0, hf_max;
+	int mode=1;
 
-	// We're using this mode just so that I can test it out; the simulated
-	// tag mode would work just as well and be simpler.
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
+#define LF_ONLY		1
+#define HF_ONLY		2
 
-	// We need to listen to the high-frequency, peak-detected path.
-	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+	LED_A_OFF();
+	LED_B_OFF();
+	LED_C_OFF();
+	LED_D_OFF();
 
-	FpgaSetupSsc();
+	lf_av= ReadAdc(ADC_CHAN_LF);
 
-	i = 0;
-	for(;;) {
-		if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
-			SSC_TRANSMIT_HOLDING = 0xff;
+	if(limit != HF_ONLY)
+		{
+		DbpString("LF 125/134 Baseline:");
+		DbpIntegers(lf_av,0,0);
+		lf_baseline= lf_av;
 		}
-		if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
-			BYTE r = (BYTE)SSC_RECEIVE_HOLDING;
 
-			v <<= 1;
-			if(r & 1) {
-				v |= 1;
-			}
-			p++;
+	hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
 
-			if(p >= 8) {
-				dest[i] = v;
-				v = 0;
-				p = 0;
-				i++;
+	if (limit != LF_ONLY)
+		{
+		DbpString("HF 13.56 Baseline:");
+		DbpIntegers(hf_av,0,0);
+		hf_baseline= hf_av;
+		}
 
-				if(i >= n) {
+	for(;;)
+		{
+		if (BUTTON_PRESS()) {
+			SpinDelay(500);
+			switch (mode) {
+				case 1:
+					mode=2;
+					DbpString("Signal Strength Mode");
 					break;
+				case 2:
+				default:
+					DbpString("Stopped");
+					LED_A_OFF();
+					LED_B_OFF();
+					LED_C_OFF();
+					LED_D_OFF();
+					return;
+					break;
+			}
+		}
+		WDT_HIT();
+
+		if (limit != HF_ONLY)
+			{
+			if (abs(lf_av - lf_baseline) > 10)
+				LED_D_ON();
+			else
+				LED_D_OFF();
+			++lf_count;
+			lf_av_new= ReadAdc(ADC_CHAN_LF);
+			// see if there's a significant change
+			if(abs(lf_av - lf_av_new) > 10)
+				{
+				DbpString("LF 125/134 Field Change:");
+				DbpIntegers(lf_av,lf_av_new,lf_count);
+				lf_av= lf_av_new;
+				lf_count= 0;
+				}
+			}
+
+		if (limit != LF_ONLY)
+			{
+			if (abs(hf_av - hf_baseline) > 10) {
+				if (mode == 1)
+					LED_B_ON();
+				if (mode == 2) {
+					if ( hf_av>(hf_max/7)*6) {
+						LED_A_ON();	LED_B_ON();	LED_C_ON();	LED_D_ON();
+					}
+					if ( (hf_av>(hf_max/7)*5) && (hf_av<=(hf_max/7)*6) ) {
+						LED_A_ON();	LED_B_ON();	LED_C_OFF(); LED_D_ON();
+					}
+					if ( (hf_av>(hf_max/7)*4) && (hf_av<=(hf_max/7)*5) ) {
+						LED_A_OFF(); LED_B_ON(); LED_C_OFF(); LED_D_ON();
+					}
+					if ( (hf_av>(hf_max/7)*3) && (hf_av<=(hf_max/7)*4) ) {
+						LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); LED_D_ON();
+					}
+					if ( (hf_av>(hf_max/7)*2) && (hf_av<=(hf_max/7)*3) ) {
+						LED_A_OFF(); LED_B_ON(); LED_C_OFF(); LED_D_OFF();
+					}
+					if ( (hf_av>(hf_max/7)*1) && (hf_av<=(hf_max/7)*2) ) {
+						LED_A_ON();	LED_B_OFF(); LED_C_OFF(); LED_D_OFF();
+					}
+					if ( (hf_av>(hf_max/7)*0) && (hf_av<=(hf_max/7)*1) ) {
+						LED_A_OFF(); LED_B_OFF(); LED_C_ON(); LED_D_OFF();
+					}
+				}
+			} else {
+				if (mode == 1) {
+					LED_B_OFF();
+				}
+				if (mode == 2) {
+					LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); LED_D_OFF();
+				}
+			}
+
+			++hf_count;
+			hf_av_new= ReadAdc(ADC_CHAN_HF);
+			// see if there's a significant change
+			if(abs(hf_av - hf_av_new) > 10)
+				{
+				DbpString("HF 13.56 Field Change:");
+				DbpIntegers(hf_av,hf_av_new,hf_count);
+				hf_av= hf_av_new;
+				if (hf_av > hf_max)
+					hf_max = hf_av;
+				hf_count= 0;
 				}
 			}
 		}
-	}
-	DbpString("simulate tag (now type bitsamples)");
 }
 
 void UsbPacketReceived(BYTE *packet, int len)
@@ -770,10 +527,6 @@ void UsbPacketReceived(BYTE *packet, int len)
 			ModThenAcquireRawAdcSamples125k(c->ext1,c->ext2,c->ext3,c->d.asBytes);
 			break;
 
-		case CMD_ACQUIRE_RAW_BITS_TI_TYPE:
-			AcquireRawBitsTI();
-			break;
-
 		case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
 			AcquireRawAdcSamplesIso15693();
 			break;
@@ -844,6 +597,18 @@ void UsbPacketReceived(BYTE *packet, int len)
 			LED_D_OFF(); // LED D indicates field ON or OFF
 			break;
 
+		case CMD_ACQUIRE_RAW_BITS_TI_TYPE:
+			AcquireRawBitsTI();
+			break;
+
+		case CMD_READ_TI_TYPE:
+			ReadTItag();
+			break;
+
+		case CMD_WRITE_TI_TYPE:
+			WriteTItag(c->ext1,c->ext2,c->ext3);
+			break;
+
 		case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
 		case CMD_DOWNLOAD_RAW_BITS_TI_TYPE: {
 			UsbCommand n;
@@ -883,7 +648,7 @@ void UsbPacketReceived(BYTE *packet, int len)
 			LCDSend(c->ext1);
 			break;
 #endif
-        case CMD_SETUP_WRITE:
+		case CMD_SETUP_WRITE:
 		case CMD_FINISH_WRITE:
 		case CMD_HARDWARE_RESET:
 			USB_D_PLUS_PULLUP_OFF();
@@ -902,17 +667,6 @@ void UsbPacketReceived(BYTE *packet, int len)
 	}
 }
 
-void ReadMem(int addr)
-{
-	const DWORD *data = ((DWORD *)addr);
-	int i;
-
-	DbpString("Reading memory at address");
-	DbpIntegers(0, 0, addr);
-	for (i = 0; i < 8; i+= 2)
-		DbpIntegers(0, data[i], data[i+1]);
-}
-
 void AppMain(void)
 {
 	memset(BigBuf,0,sizeof(BigBuf));
@@ -976,282 +730,3 @@ void AppMain(void)
 			SamyRun();
 	}
 }
-
-
-// samy's sniff and repeat routine
-void SamyRun()
-{
-	DbpString("Stand-alone mode! No PC necessary.");
-
-	// 3 possible options? no just 2 for now
-#define OPTS 2
-
-	int high[OPTS], low[OPTS];
-
-	// Oooh pretty -- notify user we're in elite samy mode now
-	LED(LED_RED,	200);
-	LED(LED_ORANGE, 200);
-	LED(LED_GREEN,	200);
-	LED(LED_ORANGE, 200);
-	LED(LED_RED,	200);
-	LED(LED_ORANGE, 200);
-	LED(LED_GREEN,	200);
-	LED(LED_ORANGE, 200);
-	LED(LED_RED,	200);
-
-	int selected = 0;
-	int playing = 0;
-
-	// Turn on selected LED
-	LED(selected + 1, 0);
-
-	for (;;)
-	{
-		usbattached = UsbPoll(FALSE);
-		WDT_HIT();
-
-		// Was our button held down or pressed?
-		int button_pressed = BUTTON_HELD(1000);
-		SpinDelay(300);
-
-		// Button was held for a second, begin recording
-		if (button_pressed > 0)
-		{
-			LEDsoff();
-			LED(selected + 1, 0);
-			LED(LED_RED2, 0);
-
-			// record
-			DbpString("Starting recording");
-
-			// wait for button to be released
-			while(BUTTON_PRESS())
-				WDT_HIT();
-
-			/* need this delay to prevent catching some weird data */
-			SpinDelay(500);
-
-			CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
-			DbpString("Recorded");
-			DbpIntegers(selected, high[selected], low[selected]);
-
-			LEDsoff();
-			LED(selected + 1, 0);
-			// Finished recording
-
-			// If we were previously playing, set playing off
-			// so next button push begins playing what we recorded
-			playing = 0;
-		}
-
-		// Change where to record (or begin playing)
-		else if (button_pressed)
-		{
-			// Next option if we were previously playing
-			if (playing)
-				selected = (selected + 1) % OPTS;
-			playing = !playing;
-
-			LEDsoff();
-			LED(selected + 1, 0);
-
-			// Begin transmitting
-			if (playing)
-			{
-				LED(LED_GREEN, 0);
-				DbpString("Playing");
-				// wait for button to be released
-				while(BUTTON_PRESS())
-					WDT_HIT();
-				DbpIntegers(selected, high[selected], low[selected]);
-				CmdHIDsimTAG(high[selected], low[selected], 0);
-				DbpString("Done playing");
-				if (BUTTON_HELD(1000) > 0)
-					{
-					DbpString("Exiting");
-					LEDsoff();
-					return;
-					}
-
-				/* We pressed a button so ignore it here with a delay */
-				SpinDelay(300);
-
-				// when done, we're done playing, move to next option
-				selected = (selected + 1) % OPTS;
-				playing = !playing;
-				LEDsoff();
-				LED(selected + 1, 0);
-			}
-			else
-				while(BUTTON_PRESS())
-					WDT_HIT();
-		}
-	}
-}
-
-
-/* 
-OBJECTIVE
-Listen and detect an external reader. Determine the best location
-for the antenna.
-
-INSTRUCTIONS:
-Inside the ListenReaderField() function, there is two mode. 
-By default, when you call the function, you will enter mode 1.
-If you press the PM3 button one time, you will enter mode 2.
-If you press the PM3 button a second time, you will exit the function.
-
-DESCRIPTION OF MODE 1:
-This mode just listens for an external reader field and lights up green 
-for HF and/or red for LF. This is the original mode of the detectreader
-function.
-
-DESCRIPTION OF MODE 2:
-This mode will visually represent, using the LEDs, the actual strength of the
-current compared to the maximum current detected. Basically, once you know 
-what kind of external reader is present, it will help you spot the best location to place
-your antenna. You will probably not get some good results if there is a LF and a HF reader
-at the same place! :-)
-
-LIGHT SCHEME USED:
-
-Light scheme | Descriptiong
-----------------------------------------------------
-    ----     | No field detected
-    X---     | 14% of maximum current detected
-    -X--     | 29% of maximum current detected
-    --X-     | 43% of maximum current detected
-    ---X     | 57% of maximum current detected
-    --XX     | 71% of maximum current detected
-    -XXX     | 86% of maximum current detected
-    XXXX     | 100% of maximum current detected
-
-TODO:
-Add the LF part for MODE 2
-
-*/
-void ListenReaderField(int limit)
-{
-	int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0;
-	int hf_av, hf_av_new,  hf_baseline= 0, hf_count= 0, hf_max;
-	int mode=1;
-
-#define LF_ONLY		1
-#define HF_ONLY		2
-
-	LED_A_OFF();
-	LED_B_OFF();
-	LED_C_OFF();
-	LED_D_OFF();
-
-	lf_av= ReadAdc(ADC_CHAN_LF);
-
-	if(limit != HF_ONLY) 
-		{
-		DbpString("LF 125/134 Baseline:");
-		DbpIntegers(lf_av,0,0);
-		lf_baseline= lf_av;
-		}
-
-	hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
-
-	if (limit != LF_ONLY) 
-		{
-		DbpString("HF 13.56 Baseline:");
-		DbpIntegers(hf_av,0,0);
-		hf_baseline= hf_av;
-		}
-
-	for(;;) 
-		{
-		if (BUTTON_PRESS()) {
-			SpinDelay(500);
-			switch (mode) {
-				case 1:
-					mode=2;
-					DbpString("Signal Strength Mode");
-					break;
-				case 2:
-				default:
-					DbpString("Stopped");
-					LED_A_OFF();
-					LED_B_OFF();
-					LED_C_OFF();
-					LED_D_OFF();
-					return;
-					break;
-			}
-		}
-		WDT_HIT();
-
-		if (limit != HF_ONLY) 
-			{
-			if (abs(lf_av - lf_baseline) > 10)
-				LED_D_ON();
-			else
-				LED_D_OFF();
-			++lf_count;
-			lf_av_new= ReadAdc(ADC_CHAN_LF);
-			// see if there's a significant change
-			if(abs(lf_av - lf_av_new) > 10) 
-				{
-				DbpString("LF 125/134 Field Change:");
-				DbpIntegers(lf_av,lf_av_new,lf_count);
-				lf_av= lf_av_new;
-				lf_count= 0;
-				}
-			}
-
-		if (limit != LF_ONLY) 
-			{
-			if (abs(hf_av - hf_baseline) > 10) {
-				if (mode == 1)
-					LED_B_ON();
-				if (mode == 2) {
-					if ( hf_av>(hf_max/7)*6) {
-						LED_A_ON();	LED_B_ON();	LED_C_ON();	LED_D_ON();
-					}
-					if ( (hf_av>(hf_max/7)*5) && (hf_av<=(hf_max/7)*6) ) {
-						LED_A_ON();	LED_B_ON();	LED_C_OFF(); LED_D_ON();
-					}
-					if ( (hf_av>(hf_max/7)*4) && (hf_av<=(hf_max/7)*5) ) {
-						LED_A_OFF(); LED_B_ON(); LED_C_OFF(); LED_D_ON();
-					}
-					if ( (hf_av>(hf_max/7)*3) && (hf_av<=(hf_max/7)*4) ) {
-						LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); LED_D_ON();
-					}
-					if ( (hf_av>(hf_max/7)*2) && (hf_av<=(hf_max/7)*3) ) {
-						LED_A_OFF(); LED_B_ON(); LED_C_OFF(); LED_D_OFF();
-					}
-					if ( (hf_av>(hf_max/7)*1) && (hf_av<=(hf_max/7)*2) ) {
-						LED_A_ON();	LED_B_OFF(); LED_C_OFF(); LED_D_OFF();
-					}
-					if ( (hf_av>(hf_max/7)*0) && (hf_av<=(hf_max/7)*1) ) {
-						LED_A_OFF(); LED_B_OFF(); LED_C_ON(); LED_D_OFF();
-					}
-				} 
-			} else {
-				if (mode == 1) {
-					LED_B_OFF();
-				}
-				if (mode == 2) {
-					LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); LED_D_OFF();
-				}
-			}
-
-			++hf_count;
-			hf_av_new= ReadAdc(ADC_CHAN_HF);
-			// see if there's a significant change
-			if(abs(hf_av - hf_av_new) > 10) 
-				{
-				DbpString("HF 13.56 Field Change:");
-				DbpIntegers(hf_av,hf_av_new,hf_count);
-				hf_av= hf_av_new;
-				if (hf_av > hf_max)
-					hf_max = hf_av;
-				hf_count= 0;
-				}
-			}
-		}
-}
-