1 ; ---------------------------------------------------------------------------
2 ; Proxmark3 RDV4 SIM module firmware
4 ; Copyright (C) 2109, 2022 Sentinel
6 ; This program is free software: you can redistribute it and/or modify it
7 ; under the terms of the GNU Lesser General Public License as published by the
8 ; Free Software Foundation, either version 3 of the License, or (at your
9 ; option) any later version.
11 ; This program is distributed in the hope that it will be useful, but WITHOUT
12 ; ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 ; FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 ; You should have received a copy of the GNU Lesser General Public License
17 ; along with this program. If not, see <http://www.gnu.org/licenses/>
18 ; ---------------------------------------------------------------------------
21 ; ---------------------------------------------------------------------------
22 ; ===========================================================================
23 ; ---------------------------------------------------------------------------
49 ; ---------------------------------------------------------------------------
52 ; ---------------------------------------------------------------------------
54 SFRS
equ 091h ;TA Protection
55 ; ---------------------------------------------------------------------------
57 ; ---------------------------------------------------------------------------
75 ; ---------------------------------------------------------------------------
76 ; ===========================================================================
77 ; ---------------------------------------------------------------------------
90 ; ---------------------------------------------------------------------------
91 ; ===========================================================================
94 CMD_GENERATE_ATR
equ 01h
95 CMD_WRITE_DATA_SIM
equ 02h
96 CMD_READ_DATA_SIM
equ 03h
98 CMD_SET_BAUD_RATE
equ 04h
99 CMD_SET_SIM_CLC
equ 05h
101 CMD_WRITE_CONFIRM
equ 07h
105 ; ---------------------------------------------------------------------------
106 ; ===========================================================================
109 bit_command_receive
equ 32.1
110 bit_generate_ATR
equ 32.2
111 i2c_write_mode
equ 32.3
112 i2c_write_done
equ 32.4
113 bit_data_sim_wr
equ 32.5
117 bit_command_buff
equ 33.0
118 i2c_write_command
equ 33.1
119 i2c_command_done
equ 33.2
120 bit_wait_confirm
equ 33.3
121 bit_first_ATR
equ 33.4 ;11/03/2019
122 bit_length_answerH
equ 33.5
123 bit_length_answerL
equ 33.6
124 ; ---------------------------------------------------------------------------
125 ; ---------------------------------------------------------------------------
126 ; ---------------------------------------------------------------------------
130 time_data_read
equ 34
133 pointer_RX1H
equ 36 ;save SBUF(SIM) to XRAM
134 pointer_RX1L
equ 37 ;save SBUF(SIM) to XRAM
136 pointer_RX2H
equ 38 ;read XRAM to I2C
137 pointer_RX2L
equ 39 ;read XRAM to I2C
142 length_send_to_simH
equ 42
143 length_send_to_simL
equ 43
145 length_answer_simH
equ 44
146 length_answer_simL
equ 45
148 length_command
equ 46
155 ; ---------------------------------------------------------------------------
156 ; ---------------------------------------------------------------------------
159 ; ---------------------------------------------------------------------------
160 ; ---------------------------------------------------------------------------
161 ; ---------------------------------------------------------------------------
163 ; ---------------------------------------------------------------------------
164 ; ===========================================================================
165 ; ---------------------------------------------------------------------------
166 ; Beginning of the main program
170 ; ---------------------------------------------------------------------------
171 ; ===========================================================================
172 ; ---------------------------------------------------------------------------
173 cseg at
11 ;1302Hz = 4MHZ(Fsys)/12/256
174 ; ---------------------------------------------------------------------------
175 jb time_confirm
.7, $
+3+2 ;3
177 ; ---------------------------------------------------------------------------
178 jb time_data_read
.7,reti_timer0
179 djnz time_data_read
, reti_timer0
185 ; ---------------------------------------------------------------------------
186 ; ===========================================================================
187 ; ---------------------------------------------------------------------------
189 ajmp jmp_UART0_interrupt
191 ; ---------------------------------------------------------------------------
192 ; ===========================================================================
193 ; ---------------------------------------------------------------------------
195 ajmp jmp_i2c_interrupt
197 ; ---------------------------------------------------------------------------
198 ; ===========================================================================
199 ; ---------------------------------------------------------------------------
205 ; ---------------------------------------------------------------------------
206 ; ===========================================================================
207 ; ---------------------------------------------------------------------------
212 ; ---------------------------------------------------------------------------
214 jnb bit_first_ATR
, jmp_not_collect
;11/03/2019
217 jb i2c_write_done
,jmp_not_collect
233 mov time_data_read
,#
52 ;52/1302Hz = 40mS
235 inc length_answer_simL
236 mov a
,length_answer_simL
238 inc length_answer_simH
;2
242 ; ---------------------------------------------------------------------------
248 ; ===========================================================================
249 ; ---------------------------------------------------------------------------
255 ; ---------------------------------------------------------------------------
256 ; ---------------------------------------------------------------------------
257 ; ---------------------------------------------------------------------------
258 cjne R7
,#
000h,nextttt00000
264 ; ---------------------------------------------------------------------------
265 ; ---------------------------------------------------------------------------
266 ; ---------------------------------------------------------------------------
267 cjne R7
,#
060h,nextttt00001
;START+MY ADRESS
270 clr bit_command_receive
273 clr bit_length_answerH
274 clr bit_length_answerL
276 clr i2c_write_command
278 ajmp end_i2c_interrupt
280 ; ---------------------------------------------------------------------------
281 ; ---------------------------------------------------------------------------
282 ; ---------------------------------------------------------------------------
283 ; ---------------------------------------------------------------------------
284 ; ---------------------------------------------------------------------------
285 cjne R7
,#
080h,nextttt00002
;RAM ADRESS
287 jb bit_command_receive
,jmp_data_receive
288 setb bit_command_receive
291 ; ---------------------------------------------------------------------------
292 ; ---------------------------------------------------------------------------
293 ; ---------------------------------------------------------------------------
294 cjne a
,#CMD_WRITE_CONFIRM
,next_comm001a
295 setb bit_wait_confirm
298 ; ---------------------------------------------------------------------------
299 cjne a
,#CMD_WRITE_DATA_SIM
,next_comm001b
303 ; ---------------------------------------------------------------------------
304 cjne a
,#CMD_GENERATE_ATR
,next_comm002
307 ; ---------------------------------------------------------------------------
308 cjne a
,#CMD_GET_VERS
,next_comm003
311 ; ---------------------------------------------------------------------------
312 cjne a
,#CMD_SET_BAUD_RATE
,next_comm004
315 ; ---------------------------------------------------------------------------
316 cjne a
,#CMD_SET_SIM_CLC
,next_comm005
319 ; ---------------------------------------------------------------------------
320 ajmp end_i2c_interrupt
321 ; ---------------------------------------------------------------------------
322 ; ---------------------------------------------------------------------------
323 ; ---------------------------------------------------------------------------
324 ; ---------------------------------------------------------------------------
326 ;What receive ? Data to SIM/Command to bridge
327 jb bit_data_sim_wr
, jmp_data_sim_receive
328 jb i2c_write_command
,jmp_comm_bridge_receive
329 ajmp end_i2c_interrupt
330 ; ---------------------------------------------------------------------------
331 jmp_comm_bridge_receive:
335 ajmp end_i2c_interrupt
336 ; ---------------------------------------------------------------------------
337 jmp_data_sim_receive:
353 inc length_send_to_simL
354 mov a
,length_send_to_simL
356 inc length_send_to_simH
;2
358 ajmp end_i2c_interrupt
360 ; ---------------------------------------------------------------------------
361 ; ---------------------------------------------------------------------------
362 ; ---------------------------------------------------------------------------
363 cjne R7
,#
0A0h
,nextttt00003
;STOP
364 setb pin_led
;LED OFF
367 jnb i2c_write_command
,jmp_not_command
368 clr i2c_write_command
369 setb i2c_command_done
372 ;data to SIM finish ?
373 jnb i2c_write_mode
,end_i2c_interrupt
378 mov length_answer_simH
,#
0
379 mov length_answer_simL
,#
0
380 mov pointer_RX1H
,#
HIGH(XRAM_RX_BUFF
)
381 mov pointer_RX1L
,#
LOW (XRAM_RX_BUFF
)
382 mov pointer_RX2H
,#
HIGH(XRAM_RX_BUFF
)
383 mov pointer_RX2L
,#
LOW (XRAM_RX_BUFF
)
385 ajmp end_i2c_interrupt
387 ; ---------------------------------------------------------------------------
388 ; ---------------------------------------------------------------------------
389 ; ---------------------------------------------------------------------------
390 cjne R7
,#
0A8h
,nextttt00004
393 ; ---------------------------------------------------------------------------
394 ; ---------------------------------------------------------------------------
395 ; ---------------------------------------------------------------------------
396 cjne R7
,#
0B8h,nextttt00005
398 jnb bit_command_buff
,jmp_not_comm_buff2
401 ajmp end_i2c_interrupt
404 jb bit_length_answerH
,jmp_not_comm_buff3
405 setb bit_length_answerH
406 mov I2DAT
,length_answer_simH
407 ajmp end_i2c_interrupt
410 jb bit_length_answerL
,read_byte_APROM
411 setb bit_length_answerL
412 mov I2DAT
,length_answer_simL
413 ajmp end_i2c_interrupt
429 ; ---------------------------------------------------------------------------
430 ; ---------------------------------------------------------------------------
431 ; ---------------------------------------------------------------------------
436 ; ---------------------------------------------------------------------------
437 ; ---------------------------------------------------------------------------
438 ; ---------------------------------------------------------------------------
446 ; ---------------------------------------------------------------------------
447 ; ===========================================================================
448 ; ---------------------------------------------------------------------------
451 mov cmd_command
,#CMD_GET_VERS
452 mov (data_command
+0),#
2
453 mov (data_command
+1),#VERS_HI
454 mov (data_command
+2),#VERS_LO
455 setb bit_command_buff
456 ajmp end_i2c_interrupt
458 ; ---------------------------------------------------------------------------
459 ; ===========================================================================
460 ; ---------------------------------------------------------------------------
462 setb bit_generate_ATR
464 mov length_answer_simH
,#
0
465 mov length_answer_simL
,#
0
466 mov pointer_RX1H
,#
HIGH(XRAM_RX_BUFF
)
467 mov pointer_RX1L
,#
LOW (XRAM_RX_BUFF
)
468 mov pointer_RX2H
,#
HIGH(XRAM_RX_BUFF
)
469 mov pointer_RX2L
,#
LOW (XRAM_RX_BUFF
)
470 ajmp end_i2c_interrupt
473 ; ---------------------------------------------------------------------------
474 ; ===========================================================================
475 ; ---------------------------------------------------------------------------
478 mov length_command
,#
0
479 mov cmd_command
,#CMD_SET_BAUD_RATE
480 setb i2c_write_command
481 ajmp end_i2c_interrupt
484 ; ---------------------------------------------------------------------------
485 ; ===========================================================================
486 ; ---------------------------------------------------------------------------
489 mov length_command
,#
0
490 mov cmd_command
,#CMD_SET_SIM_CLC
491 setb i2c_write_command
492 ajmp end_i2c_interrupt
494 ; ---------------------------------------------------------------------------
495 ; ===========================================================================
496 ; ---------------------------------------------------------------------------
498 mov length_send_to_simH
,#
0
499 mov length_send_to_simL
,#
0
501 mov pointer_TXH
,#
HIGH(XRAM_TX_BUFF
)
502 mov pointer_TXL
,#
LOW (XRAM_TX_BUFF
)
503 ajmp end_i2c_interrupt
505 ; ---------------------------------------------------------------------------
506 ; ===========================================================================
507 ; ---------------------------------------------------------------------------
508 ; %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
511 ; ---------------------------------------------------------------------------
512 ;0-bidirect 1-push pull 0-input only 1-open drain
514 ; ---------------------------------------------------------------------------
515 mov P0M2
,#
01000000b ;?0
516 mov P0M1
,#
11111111b ;P1.6-Tx0 SIM;
518 mov P1M2
,#
01011111b ;�1
519 mov P1M1
,#
10111000b ;P1.6-Tx1 DEBUG; P1.4,P1.3 - I2C;
521 mov P3M2
,#
00000000b ;P3
522 mov P3M1
,#
11111111b ;
523 ; ---------------------------------------------------------------------------
526 mov TH1
, #
0E9h
;UART0 10800 Bit/sec
528 ; ---------------------------------------------------------------------------
529 ; ---------------------------------------------------------------------------
534 mov P1S
, #
00010000b ;P1.4 trigger schmiddt
539 ; ---------------------------------------------------------------------------
540 ; ---------------------------------------------------------------------------
541 ; ---------------------------------------------------------------------------
542 ;------- CONFIG I2C ---------
543 mov I2CON
, #
44h ;set AA, set I2C enable
547 ; ---------------------------------------------------------------------------
548 ; ---------------------------------------------------------------------------
549 ; ---------------------------------------------------------------------------
550 ; ---------------------------------------------------------------------------
551 ; ---------------------------------------------------------------------------
552 ;mov SCON, #050h ;UART0 8bit
553 mov SCON
, #
0D0h
;UART0 9bit
554 ;mov PCON, #11000000b;FE_0 enable
555 mov PCON
, #
10000000b;FE_0 disable
556 ; ---------------------------------------------------------------------------
557 mov SCON_1
,#
050h ;UART1
558 ;mov T3CON, #01101000b;FE_1 enable TIMER3 UART0 BAUD
559 ;mov T3CON, #00101000b;FE_1 disable TIMER3 UART0 BAUD
560 mov T3CON
, #
00001000b;FE_1 disable TIMER1 UART0 BAUD
561 ;mov RL3,#0E9h ;10800/21600
563 ; ---------------------------------------------------------------------------
565 mov RL3
,#
0F7h
;27777/55556
567 ; ---------------------------------------------------------------------------
568 ; ---------------------------------------------------------------------------
569 ; ---------------------------------------------------------------------------
570 mov CKDIV
,#
2 ;Fsys=4.00MHZ
571 ;mov CKDIV,#1 ;Fsys=8.00MHZ
572 ; ---------------------------------------------------------------------------
575 setb time_data_read
.7
576 ; ---------------------------------------------------------------------------
577 ;orl CKCON,#00000010b ;ENABLE CLC TIMER1 Fsys/12
578 orl CKCON
,#
00010010b ;ENABLE CLC TIMER1 Fsys
579 ; ---------------------------------------------------------------------------
585 ; ---------------------------------------------------------------------------
586 ; ---------------------------------------------------------------------------
588 ; ---------------------------------------------------------------------------
589 mov EIE
, #
00000001b ;I2C Interrupt
590 ;mov IE, #10010000b ;EA, SERIAL0
591 mov IE
, #
10010010b ;EA, SERIAL0, TIMER0
592 ; ---------------------------------------------------------------------------
593 ; ---------------------------------------------------------------------------
594 ; ---------------------------------------------------------------------------
595 ; ---------------------------------------------------------------------------
596 ; ---------------------------------------------------------------------------
599 acall control_send_to_sim
600 acall control_command
603 ; ---------------------------------------------------------------------------
604 ; ===========================================================================
605 ; ---------------------------------------------------------------------------
607 jbc i2c_command_done
,$
+3+1 ;3
609 ; ---------------------------------------------------------------------------
610 ; ---------------------------------------------------------------------------
611 ;Control Length command=1
613 cjne a
,#
1,next_commandEND
;error length_command != 1
614 ; ---------------------------------------------------------------------------
615 ; ---------------------------------------------------------------------------
617 cjne a
,#CMD_SET_BAUD_RATE
,next_command001
618 mov TH1
,data_command
;Timer1 HIGH byte
621 ; ---------------------------------------------------------------------------
622 cjne a
,#CMD_SET_SIM_CLC
, next_command002
623 mov CKDIV
,data_command
;Fsys DIV
626 ; ---------------------------------------------------------------------------
630 ; ---------------------------------------------------------------------------
631 ; ===========================================================================
632 ; ---------------------------------------------------------------------------
634 jb i2c_write_done
,$
+3+1 ;3
636 ; ---------------------------------------------------------------------------
637 ; ---------------------------------------------------------------------------
638 jbc bit_wait_confirm
,jmp_wait_confirm
639 ; ---------------------------------------------------------------------------
640 ; ---------------------------------------------------------------------------
641 mov DPTR
,#XRAM_TX_BUFF
648 mov a
,length_send_to_simL
650 mov length_send_to_simL
,a
651 mov a
,length_send_to_simH
653 mov length_send_to_simH
,a
654 orl a
,length_send_to_simL
656 ; ---------------------------------------------------------------------------
657 ; ---------------------------------------------------------------------------
663 ; ---------------------------------------------------------------------------
664 ; ===========================================================================
665 ; ---------------------------------------------------------------------------
667 mov DPTR
,#
(XRAM_TX_BUFF
+1)
671 ; ---------------------------------------------------------------------------
672 mov DPTR
,#XRAM_TX_BUFF
677 djnz R4
,jmp_not_5byte
682 mov time_confirm
,#
65 ;New timeout 50mS
684 jb time_confirm
.7,jmp_no_answer
685 jnb bit_RX0
,looop_waitconf
687 ;clr pin_scl ;TEST PULSE!
690 ;setb pin_scl ;TEST PULSE!
692 jnz jmp_no_correct_answer
;18/12/2018
694 ;pause for next byte 17/12/2018
703 mov a
,length_send_to_simL
705 mov length_send_to_simL
,a
706 mov a
,length_send_to_simH
708 mov length_send_to_simH
,a
709 orl a
,length_send_to_simL
711 ; ---------------------------------------------------------------------------
712 ; ---------------------------------------------------------------------------
719 ; ---------------------------------------------------------------------------
720 ; ---------------------------------------------------------------------------
722 jmp_no_correct_answer:
735 mov time_data_read
,#
52 ;52/1302Hz = 40mS
737 inc length_answer_simL
738 mov a
,length_answer_simL
740 inc length_answer_simH
;2
747 ; ---------------------------------------------------------------------------
748 ; ===========================================================================
749 ; ---------------------------------------------------------------------------
751 jbc bit_generate_ATR
,$
+3+1 ;3
753 ; ---------------------------------------------------------------------------
756 ; Add rezet pause 17/12/2018
761 djnz R6
,looop_pause50mS
763 ;Prepare to answer 11/03/2019
766 mov length_answer_simH
,#
0
767 mov length_answer_simL
,#
0
768 mov pointer_RX1H
,#
HIGH(XRAM_RX_BUFF
)
769 mov pointer_RX1L
,#
LOW (XRAM_RX_BUFF
)
770 mov pointer_RX2H
,#
HIGH(XRAM_RX_BUFF
)
771 mov pointer_RX2L
,#
LOW (XRAM_RX_BUFF
)
776 ; ---------------------------------------------------------------------------
777 ; ===========================================================================
778 ; ---------------------------------------------------------------------------
782 mov TB8
,c
;9bit parity
790 ; ---------------------------------------------------------------------------
791 ; ===========================================================================
792 ; ---------------------------------------------------------------------------
794 mov DPTR
,#XRAM_RX_BUFF
;Receive SIM buffer 192+192 = 384b
795 acall clr_192buffer
;06/12/2022
796 ; ---------------------------------------------------------------------------
803 djnz R7
,looop_clr_bufff
806 ; ---------------------------------------------------------------------------
807 ; ===========================================================================
808 ; ---------------------------------------------------------------------------
815 ; ---------------------------------------------------------------------------
816 ; ===========================================================================
817 ; ---------------------------------------------------------------------------