1 ; ---------------------------------------------------------------------------
2 ; Proxmark3 RDV4 SIM module firmware
4 ; Copyright (C) 2019 Sentinel
6 ; This program is free software: you can redistribute it and/or modify it
7 ; under the terms of the GNU Lesser General Public License as published by the
8 ; Free Software Foundation, either version 3 of the License, or (at your
9 ; option) any later version.
11 ; This program is distributed in the hope that it will be useful, but WITHOUT
12 ; ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 ; FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 ; You should have received a copy of the GNU Lesser General Public License
17 ; along with this program. If not, see <http://www.gnu.org/licenses/>
18 ; ---------------------------------------------------------------------------
21 ; ---------------------------------------------------------------------------
22 ; ===========================================================================
23 ; ---------------------------------------------------------------------------
49 ; ---------------------------------------------------------------------------
52 ; ---------------------------------------------------------------------------
54 SFRS
equ 091h ;TA Protection
55 ; ---------------------------------------------------------------------------
57 ; ---------------------------------------------------------------------------
75 ; ---------------------------------------------------------------------------
76 ; ===========================================================================
77 ; ---------------------------------------------------------------------------
90 ; ---------------------------------------------------------------------------
91 ; ===========================================================================
94 CMD_GENERATE_ATR
equ 01h
95 CMD_WRITE_DATA_SIM
equ 02h
96 CMD_READ_DATA_SIM
equ 03h
98 CMD_SET_BAUD_RATE
equ 04h
99 CMD_SET_SIM_CLC
equ 05h
101 CMD_WRITE_CONFIRM
equ 07h
105 ; ---------------------------------------------------------------------------
106 ; ===========================================================================
109 bit_command_receive
equ 32.1
110 bit_generate_ATR
equ 32.2
111 i2c_write_mode
equ 32.3
112 i2c_write_done
equ 32.4
113 bit_data_sim_wr
equ 32.5
114 bit_length_answer
equ 32.6
117 bit_command_buff
equ 33.0
118 i2c_write_command
equ 33.1
119 i2c_command_done
equ 33.2
120 bit_wait_confirm
equ 33.3
121 bit_first_ATR
equ 33.4 ;11/03/2019
122 ; ---------------------------------------------------------------------------
123 ; ---------------------------------------------------------------------------
124 ; ---------------------------------------------------------------------------
127 pointer_RX1
equ 34 ;save SBUF(SIM) to XRAM
128 pointer_RX2
equ 35 ;read XRAM to I2C
131 length_send_to_sim
equ 37
132 length_answer_sim
equ 38
133 length_command
equ 39
134 time_data_read
equ 40
142 ; ---------------------------------------------------------------------------
143 ; ---------------------------------------------------------------------------
144 ; ---------------------------------------------------------------------------
145 ; ---------------------------------------------------------------------------
146 ; ---------------------------------------------------------------------------
148 ; ---------------------------------------------------------------------------
149 ; ===========================================================================
150 ; ---------------------------------------------------------------------------
151 ; Beginning of the main program
155 ; ---------------------------------------------------------------------------
156 ; ===========================================================================
157 ; ---------------------------------------------------------------------------
158 cseg at
11 ;1302Hz = 4MHZ(Fsys)/12/256
159 ; ---------------------------------------------------------------------------
160 jb time_confirm
.7, $
+3+2 ;3
162 ; ---------------------------------------------------------------------------
163 jb time_data_read
.7,reti_timer0
164 djnz time_data_read
, reti_timer0
170 ; ---------------------------------------------------------------------------
171 ; ===========================================================================
172 ; ---------------------------------------------------------------------------
174 ajmp jmp_UART0_interrupt
176 ; ---------------------------------------------------------------------------
177 ; ===========================================================================
178 ; ---------------------------------------------------------------------------
180 ajmp jmp_i2c_interrupt
182 ; ---------------------------------------------------------------------------
183 ; ===========================================================================
184 ; ---------------------------------------------------------------------------
190 ; ---------------------------------------------------------------------------
191 ; ===========================================================================
192 ; ---------------------------------------------------------------------------
197 ; ---------------------------------------------------------------------------
199 jnb bit_first_ATR
, jmp_not_collect
;11/03/2019
202 jb i2c_write_done
,jmp_not_collect
206 ;mov SBUF_1,DPL ;DPTR2
207 mov DPL
,pointer_RX1
;DPTR2
210 inc pointer_RX1
;DPTR2
215 mov time_data_read
,#
52 ;52/1302Hz = 40mS
217 inc length_answer_sim
220 ; ---------------------------------------------------------------------------
226 ; ===========================================================================
227 ; ---------------------------------------------------------------------------
233 ; ---------------------------------------------------------------------------
234 ; ---------------------------------------------------------------------------
235 ; ---------------------------------------------------------------------------
236 cjne R7
,#
000h,nextttt00000
242 ; ---------------------------------------------------------------------------
243 ; ---------------------------------------------------------------------------
244 ; ---------------------------------------------------------------------------
245 cjne R7
,#
060h,nextttt00001
;START+MY ADDRESS
248 clr bit_command_receive
251 clr bit_length_answer
253 clr i2c_write_command
255 ajmp end_i2c_interrupt
257 ; ---------------------------------------------------------------------------
258 ; ---------------------------------------------------------------------------
259 ; ---------------------------------------------------------------------------
260 ; ---------------------------------------------------------------------------
261 ; ---------------------------------------------------------------------------
262 cjne R7
,#
080h,nextttt00002
;RAM ADRESS
264 jb bit_command_receive
,jmp_data_receive
265 setb bit_command_receive
268 ; ---------------------------------------------------------------------------
269 ; ---------------------------------------------------------------------------
270 ; ---------------------------------------------------------------------------
271 cjne a
,#CMD_WRITE_CONFIRM
,next_comm001a
273 setb bit_wait_confirm
275 sjmp jmp_WRITEDATASIM
277 ; ---------------------------------------------------------------------------
278 cjne a
,#CMD_WRITE_DATA_SIM
,next_comm001b
281 mov length_send_to_sim
,#
0
284 ajmp end_i2c_interrupt
286 ; ---------------------------------------------------------------------------
287 cjne a
,#CMD_GENERATE_ATR
,next_comm002
288 setb bit_generate_ATR
290 mov length_answer_sim
,#
0
293 ajmp end_i2c_interrupt
295 ; ---------------------------------------------------------------------------
296 cjne a
,#CMD_GET_VERS
,next_comm003
299 ; ---------------------------------------------------------------------------
300 cjne a
,#CMD_SET_BAUD_RATE
,next_comm004
302 mov length_command
,#
0
303 mov cmd_command
,#CMD_SET_BAUD_RATE
304 setb i2c_write_command
305 ajmp end_i2c_interrupt
307 ; ---------------------------------------------------------------------------
308 cjne a
,#CMD_SET_SIM_CLC
,next_comm005
310 mov length_command
,#
0
311 mov cmd_command
,#CMD_SET_SIM_CLC
312 setb i2c_write_command
313 ajmp end_i2c_interrupt
315 ; ---------------------------------------------------------------------------
316 ajmp end_i2c_interrupt
317 ; ---------------------------------------------------------------------------
318 ; ---------------------------------------------------------------------------
319 ; ---------------------------------------------------------------------------
320 ; ---------------------------------------------------------------------------
322 ;What receive ? Data to SIM/Command to bridge
323 jb bit_data_sim_wr
, jmp_data_sim_receive
324 jb i2c_write_command
,jmp_comm_bridge_receive
325 ajmp end_i2c_interrupt
326 ; ---------------------------------------------------------------------------
327 jmp_comm_bridge_receive:
331 ajmp end_i2c_interrupt
332 ; ---------------------------------------------------------------------------
333 jmp_data_sim_receive:
339 mov DPL
,pointer_TX
;DPTR2
342 inc pointer_TX
;DPTR2
345 inc length_send_to_sim
346 ajmp end_i2c_interrupt
348 ; ---------------------------------------------------------------------------
349 ; ---------------------------------------------------------------------------
350 ; ---------------------------------------------------------------------------
351 cjne R7
,#
0A0h
,nextttt00003
;STOP
352 setb pin_led
;LED OFF
355 jnb i2c_write_command
,jmp_not_command
356 clr i2c_write_command
357 setb i2c_command_done
360 ;data to SIM finish ?
361 jnb i2c_write_mode
,end_i2c_interrupt
366 mov length_answer_sim
,#
0
370 ajmp end_i2c_interrupt
372 ; ---------------------------------------------------------------------------
373 ; ---------------------------------------------------------------------------
374 ; ---------------------------------------------------------------------------
375 cjne R7
,#
0A8h
,nextttt00004
378 ; ---------------------------------------------------------------------------
379 ; ---------------------------------------------------------------------------
380 ; ---------------------------------------------------------------------------
381 cjne R7
,#
0B8h,nextttt00005
383 jnb bit_command_buff
,jmp_not_comm_buff2
386 ajmp end_i2c_interrupt
389 jb bit_length_answer
,read_byte_APROM
390 setb bit_length_answer
392 mov I2DAT
,length_answer_sim
393 ajmp end_i2c_interrupt
396 mov DPL
,pointer_RX2
;DPTR2
400 inc pointer_RX2
;DPTR2
403 ; ---------------------------------------------------------------------------
404 ; ---------------------------------------------------------------------------
405 ; ---------------------------------------------------------------------------
410 ; ---------------------------------------------------------------------------
411 ; ---------------------------------------------------------------------------
412 ; ---------------------------------------------------------------------------
420 ; ---------------------------------------------------------------------------
421 ; ===========================================================================
422 ; ---------------------------------------------------------------------------
425 mov cmd_command
,#CMD_GET_VERS
426 mov (data_command
+0),#
2
427 mov (data_command
+1),#VERS_HI
428 mov (data_command
+2),#VERS_LO
429 setb bit_command_buff
430 ajmp end_i2c_interrupt
433 ; ---------------------------------------------------------------------------
434 ; ===========================================================================
435 ; ---------------------------------------------------------------------------
436 ; %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
439 ; ---------------------------------------------------------------------------
440 ;0-bidirect 1-push pull 0-input only 1-open drain
442 ; ---------------------------------------------------------------------------
443 mov P0M2
,#
01000000b ;Ð 0
444 mov P0M1
,#
11111111b ;P1.6-Tx0 SIM;
446 mov P1M2
,#
01011111b ;Ð 1
447 mov P1M1
,#
10111000b ;P1.6-Tx1 DEBUG; P1.4,P1.3 - I2C;
449 mov P3M2
,#
00000000b ;P3
450 mov P3M1
,#
11111111b ;
451 ; ---------------------------------------------------------------------------
454 mov TH1
, #
0E9h
;UART0 10800 Bit/sec
456 ; ---------------------------------------------------------------------------
457 ; ---------------------------------------------------------------------------
462 mov P1S
, #
00010000b ;P1.4 trigger schmiddt
467 ; ---------------------------------------------------------------------------
468 ; ---------------------------------------------------------------------------
469 ; ---------------------------------------------------------------------------
470 ;------- CONFIG I2C ---------
471 mov I2CON
, #
44h ;set AA, set I2C enable
475 ; ---------------------------------------------------------------------------
476 ; ---------------------------------------------------------------------------
477 ; ---------------------------------------------------------------------------
478 ; ---------------------------------------------------------------------------
479 ; ---------------------------------------------------------------------------
480 ;mov SCON, #050h ;UART0 8bit
481 mov SCON
, #
0D0h
;UART0 9bit
482 ;mov PCON, #11000000b;FE_0 enable
483 mov PCON
, #
10000000b;FE_0 disable
484 ; ---------------------------------------------------------------------------
485 mov SCON_1
,#
050h ;UART1
486 ;mov T3CON, #01101000b;FE_1 enable TIMER3 UART0 BAUD
487 ;mov T3CON, #00101000b;FE_1 disable TIMER3 UART0 BAUD
488 mov T3CON
, #
00001000b;FE_1 disable TIMER1 UART0 BAUD
489 ;mov RL3,#0E9h ;10800/21600
491 ; ---------------------------------------------------------------------------
493 mov RL3
,#
0F7h
;27777/55556
495 ; ---------------------------------------------------------------------------
496 ; ---------------------------------------------------------------------------
497 ; ---------------------------------------------------------------------------
498 mov CKDIV
,#
2 ;Fsys=4.00MHZ
499 ;mov CKDIV,#1 ;Fsys=8.00MHZ
500 ; ---------------------------------------------------------------------------
503 setb time_data_read
.7
504 ; ---------------------------------------------------------------------------
505 ;orl CKCON,#00000010b ;ENABLE CLC TIMER1 Fsys/12
506 orl CKCON
,#
00010010b ;ENABLE CLC TIMER1 Fsys
507 ; ---------------------------------------------------------------------------
513 ; ---------------------------------------------------------------------------
514 ; ---------------------------------------------------------------------------
516 ; ---------------------------------------------------------------------------
517 mov EIE
, #
00000001b ;I2C Interrupt
518 ;mov IE, #10010000b ;EA, SERIAL0
519 mov IE
, #
10010010b ;EA, SERIAL0, TIMER0
520 ; ---------------------------------------------------------------------------
521 ; ---------------------------------------------------------------------------
522 ; ---------------------------------------------------------------------------
523 ; ---------------------------------------------------------------------------
524 ; ---------------------------------------------------------------------------
527 acall control_send_to_sim
528 acall control_command
531 ; ---------------------------------------------------------------------------
532 ; ===========================================================================
533 ; ---------------------------------------------------------------------------
535 jbc i2c_command_done
,$
+3+1 ;3
537 ; ---------------------------------------------------------------------------
538 ; ---------------------------------------------------------------------------
539 ;Control Length command=1
541 cjne a
,#
1,next_commandEND
;error length_command != 1
542 ; ---------------------------------------------------------------------------
543 ; ---------------------------------------------------------------------------
545 cjne a
,#CMD_SET_BAUD_RATE
,next_command001
546 mov TH1
,data_command
;Timer1 HIGH byte
549 ; ---------------------------------------------------------------------------
550 cjne a
,#CMD_SET_SIM_CLC
, next_command002
551 mov CKDIV
,data_command
;Fsys DIV
554 ; ---------------------------------------------------------------------------
558 ; ---------------------------------------------------------------------------
559 ; ===========================================================================
560 ; ---------------------------------------------------------------------------
562 jb i2c_write_done
,$
+3+1 ;3
564 ; ---------------------------------------------------------------------------
565 ; ---------------------------------------------------------------------------
566 jbc bit_wait_confirm
,jmp_wait_confirm
567 ; ---------------------------------------------------------------------------
568 ; ---------------------------------------------------------------------------
574 djnz length_send_to_sim
,looop_send
575 ; ---------------------------------------------------------------------------
576 ; ---------------------------------------------------------------------------
582 ; ---------------------------------------------------------------------------
583 ; ===========================================================================
584 ; ---------------------------------------------------------------------------
590 ; ---------------------------------------------------------------------------
596 djnz R4
,jmp_not_5byte
601 mov time_confirm
,#
65 ;New timeout 50mS
603 jb time_confirm
.7,jmp_no_answer
604 jnb bit_RX0
,looop_waitconf
606 ;clr pin_scl ;TEST PULSE!
609 ;setb pin_scl ;TEST PULSE!
611 jnz jmp_no_correct_answer
;18/12/2018
613 ;pause for next byte 17/12/2018
620 djnz length_send_to_sim
,looop_seend
621 ; ---------------------------------------------------------------------------
622 ; ---------------------------------------------------------------------------
629 ; ---------------------------------------------------------------------------
630 ; ---------------------------------------------------------------------------
632 jmp_no_correct_answer:
641 mov time_data_read
,#
52 ;52/1302Hz = 40mS
642 inc length_answer_sim
648 ; ---------------------------------------------------------------------------
649 ; ===========================================================================
650 ; ---------------------------------------------------------------------------
652 jbc bit_generate_ATR
,$
+3+1 ;3
654 ; ---------------------------------------------------------------------------
657 ; Add rezet pause 17/12/2018
662 djnz R6
,looop_pause50mS
664 ;Prepare to answer 11/03/2019
666 mov length_answer_sim
,#
0
673 ; ---------------------------------------------------------------------------
674 ; ===========================================================================
675 ; ---------------------------------------------------------------------------
679 mov TB8
,c
;9bit parity
687 ; ---------------------------------------------------------------------------
688 ; ===========================================================================
689 ; ---------------------------------------------------------------------------
691 mov DPTR
,#
0256 ;Receive SIM buffer
697 djnz R7
,looop_clr_bufff
700 ; ---------------------------------------------------------------------------
701 ; ===========================================================================
702 ; ---------------------------------------------------------------------------
709 ; ---------------------------------------------------------------------------
710 ; ===========================================================================
711 ; ---------------------------------------------------------------------------