armsrc/appmain.c

   1 //-----------------------------------------------------------------------------
   2 // Jonathan Westhues, Mar 2006
   3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // The main application code. This is the first thing called after start.c
  10 // executes.
  11 //-----------------------------------------------------------------------------
  12
  13 #include "usb_cdc.h"
  14 #include "cmd.h"
  15
  16 #include "proxmark3.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "printf.h"
  20 #include "string.h"
  21
  22 #include <stdarg.h>
  23
  24 #include "legicrf.h"
  25 #include <hitag2.h>
  26 #include "lfsampling.h"
  27 #ifdef WITH_LCD
  28  #include "LCD.h"
  29 #endif
  30
  31 #define abs(x) ( ((x)<0) ? -(x) : (x) )
  32
  33 //=============================================================================
  34 // A buffer where we can queue things up to be sent through the FPGA, for
  35 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
  36 // is the order in which they go out on the wire.
  37 //=============================================================================
  38
  39 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2)  // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
  40 uint8_t ToSend[TOSEND_BUFFER_SIZE];
  41 int ToSendMax;
  42 static int ToSendBit;
  43 struct common_area common_area __attribute__((section(".commonarea")));
  44
  45 void BufferClear(void)
  46 {
  47         memset(BigBuf,0,sizeof(BigBuf));
  48         Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
  49 }
  50
  51 void ToSendReset(void)
  52 {
  53         ToSendMax = -1;
  54         ToSendBit = 8;
  55 }
  56
  57 void ToSendStuffBit(int b)
  58 {
  59         if(ToSendBit >= 8) {
  60                 ToSendMax++;
  61                 ToSend[ToSendMax] = 0;
  62                 ToSendBit = 0;
  63         }
  64
  65         if(b) {
  66                 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
  67         }
  68
  69         ToSendBit++;
  70
  71         if(ToSendMax >= sizeof(ToSend)) {
  72                 ToSendBit = 0;
  73                 DbpString("ToSendStuffBit overflowed!");
  74         }
  75 }
  76
  77 //=============================================================================
  78 // Debug print functions, to go out over USB, to the usual PC-side client.
  79 //=============================================================================
  80
  81 void DbpString(char *str)
  82 {
  83   byte_t len = strlen(str);
  84   cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
  85 }
  86
  87 #if 0
  88 void DbpIntegers(int x1, int x2, int x3)
  89 {
  90   cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
  91 }
  92 #endif
  93
  94 void Dbprintf(const char *fmt, ...) {
  95 // should probably limit size here; oh well, let's just use a big buffer
  96         char output_string[128];
  97         va_list ap;
  98
  99         va_start(ap, fmt);
 100         kvsprintf(fmt, output_string, 10, ap);
 101         va_end(ap);
 102
 103         DbpString(output_string);
 104 }
 105
 106 // prints HEX & ASCII
 107 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
 108         int l=0,i;
 109         char ascii[9];
 110
 111         while (len>0) {
 112                 if (len>8) l=8;
 113                 else l=len;
 114
 115                 memcpy(ascii,d,l);
 116                 ascii[l]=0;
 117
 118                 // filter safe ascii
 119                 for (i=0;i<l;i++)
 120                         if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
 121
 122                 if (bAsci) {
 123                         Dbprintf("%-8s %*D",ascii,l,d," ");
 124                 } else {
 125                         Dbprintf("%*D",l,d," ");
 126                 }
 127
 128                 len-=8;
 129                 d+=8;
 130         }
 131 }
 132
 133 //-----------------------------------------------------------------------------
 134 // Read an ADC channel and block till it completes, then return the result
 135 // in ADC units (0 to 1023). Also a routine to average 32 samples and
 136 // return that.
 137 //-----------------------------------------------------------------------------
 138 static int ReadAdc(int ch)
 139 {
 140         uint32_t d;
 141
 142         AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
 143         AT91C_BASE_ADC->ADC_MR =
 144                 ADC_MODE_PRESCALE(32) |
 145                 ADC_MODE_STARTUP_TIME(16) |
 146                 ADC_MODE_SAMPLE_HOLD_TIME(8);
 147         AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
 148
 149         AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
 150         while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
 151                 ;
 152         d = AT91C_BASE_ADC->ADC_CDR[ch];
 153
 154         return d;
 155 }
 156
 157 int AvgAdc(int ch) // was static - merlok
 158 {
 159         int i;
 160         int a = 0;
 161
 162         for(i = 0; i < 32; i++) {
 163                 a += ReadAdc(ch);
 164         }
 165
 166         return (a + 15) >> 5;
 167 }
 168
 169 void MeasureAntennaTuning(void)
 170 {
 171         uint8_t LF_Results[256];
 172         int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
 173         int vLf125 = 0, vLf134 = 0, vHf = 0;    // in mV
 174
 175         LED_B_ON();
 176
 177 /*
 178  * Sweeps the useful LF range of the proxmark from
 179  * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
 180  * read the voltage in the antenna, the result left
 181  * in the buffer is a graph which should clearly show
 182  * the resonating frequency of your LF antenna
 183  * ( hopefully around 95 if it is tuned to 125kHz!)
 184  */
 185
 186         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 187         FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
 188         for (i=255; i>=19; i--) {
 189     WDT_HIT();
 190                 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
 191                 SpinDelay(20);
 192                 // Vref = 3.3V, and a 10000:240 voltage divider on the input
 193                 // can measure voltages up to 137500 mV
 194                 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
 195                 if (i==95)      vLf125 = adcval; // voltage at 125Khz
 196                 if (i==89)      vLf134 = adcval; // voltage at 134Khz
 197
 198                 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
 199                 if(LF_Results[i] > peak) {
 200                         peakv = adcval;
 201                         peak = LF_Results[i];
 202                         peakf = i;
 203                         //ptr = i;
 204                 }
 205         }
 206
 207         for (i=18; i >= 0; i--) LF_Results[i] = 0;
 208
 209         LED_A_ON();
 210         // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
 211         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 212         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 213         SpinDelay(20);
 214         // Vref = 3300mV, and an 10:1 voltage divider on the input
 215         // can measure voltages up to 33000 mV
 216         vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
 217
 218         cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),LF_Results,256);
 219         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 220         LED_A_OFF();
 221         LED_B_OFF();
 222         return;
 223 }
 224
 225 void MeasureAntennaTuningHf(void)
 226 {
 227         int vHf = 0;    // in mV
 228
 229         DbpString("Measuring HF antenna, press button to exit");
 230
 231         for (;;) {
 232                 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
 233                 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 234                 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 235                 SpinDelay(20);
 236                 // Vref = 3300mV, and an 10:1 voltage divider on the input
 237                 // can measure voltages up to 33000 mV
 238                 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
 239
 240                 Dbprintf("%d mV",vHf);
 241                 if (BUTTON_PRESS()) break;
 242         }
 243         DbpString("cancelled");
 244 }
 245
 246
 247 void SimulateTagHfListen(void)
 248 {
 249         uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
 250         uint8_t v = 0;
 251         int i;
 252         int p = 0;
 253
 254         // We're using this mode just so that I can test it out; the simulated
 255         // tag mode would work just as well and be simpler.
 256         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 257         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
 258
 259         // We need to listen to the high-frequency, peak-detected path.
 260         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 261
 262         FpgaSetupSsc();
 263
 264         i = 0;
 265         for(;;) {
 266                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 267                         AT91C_BASE_SSC->SSC_THR = 0xff;
 268                 }
 269                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 270                         uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 271
 272                         v <<= 1;
 273                         if(r & 1) {
 274                                 v |= 1;
 275                         }
 276                         p++;
 277
 278                         if(p >= 8) {
 279                                 dest[i] = v;
 280                                 v = 0;
 281                                 p = 0;
 282                                 i++;
 283
 284                                 if(i >= FREE_BUFFER_SIZE) {
 285                                         break;
 286                                 }
 287                         }
 288                 }
 289         }
 290         DbpString("simulate tag (now type bitsamples)");
 291 }
 292
 293 void ReadMem(int addr)
 294 {
 295         const uint8_t *data = ((uint8_t *)addr);
 296
 297         Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
 298                 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
 299 }
 300
 301 /* osimage version information is linked in */
 302 extern struct version_information version_information;
 303 /* bootrom version information is pointed to from _bootphase1_version_pointer */
 304 extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
 305 void SendVersion(void)
 306 {
 307         char temp[512]; /* Limited data payload in USB packets */
 308         DbpString("Prox/RFID mark3 RFID instrument");
 309
 310         /* Try to find the bootrom version information. Expect to find a pointer at
 311          * symbol _bootphase1_version_pointer, perform slight sanity checks on the
 312          * pointer, then use it.
 313          */
 314         char *bootrom_version = *(char**)&_bootphase1_version_pointer;
 315         if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
 316                 DbpString("bootrom version information appears invalid");
 317         } else {
 318                 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
 319                 DbpString(temp);
 320         }
 321
 322         FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
 323         DbpString(temp);
 324
 325         FpgaGatherVersion(temp, sizeof(temp));
 326         DbpString(temp);
 327         // Send Chip ID
 328         cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
 329 }
 330
 331 #ifdef WITH_LF
 332 // samy's sniff and repeat routine
 333 void SamyRun()
 334 {
 335         DbpString("Stand-alone mode! No PC necessary.");
 336         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 337
 338         // 3 possible options? no just 2 for now
 339 #define OPTS 2
 340
 341         int high[OPTS], low[OPTS];
 342
 343         // Oooh pretty -- notify user we're in elite samy mode now
 344         LED(LED_RED,    200);
 345         LED(LED_ORANGE, 200);
 346         LED(LED_GREEN,  200);
 347         LED(LED_ORANGE, 200);
 348         LED(LED_RED,    200);
 349         LED(LED_ORANGE, 200);
 350         LED(LED_GREEN,  200);
 351         LED(LED_ORANGE, 200);
 352         LED(LED_RED,    200);
 353
 354         int selected = 0;
 355         int playing = 0;
 356         int cardRead = 0;
 357
 358         // Turn on selected LED
 359         LED(selected + 1, 0);
 360
 361         for (;;)
 362         {
 363                 usb_poll();
 364     WDT_HIT();
 365
 366                 // Was our button held down or pressed?
 367                 int button_pressed = BUTTON_HELD(1000);
 368                 SpinDelay(300);
 369
 370                 // Button was held for a second, begin recording
 371                 if (button_pressed > 0 && cardRead == 0)
 372                 {
 373                         LEDsoff();
 374                         LED(selected + 1, 0);
 375                         LED(LED_RED2, 0);
 376
 377                         // record
 378                         DbpString("Starting recording");
 379
 380                         // wait for button to be released
 381                         while(BUTTON_PRESS())
 382                                 WDT_HIT();
 383
 384                         /* need this delay to prevent catching some weird data */
 385                         SpinDelay(500);
 386
 387                         CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
 388                         Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
 389
 390                         LEDsoff();
 391                         LED(selected + 1, 0);
 392                         // Finished recording
 393
 394                         // If we were previously playing, set playing off
 395                         // so next button push begins playing what we recorded
 396                         playing = 0;
 397
 398                         cardRead = 1;
 399
 400                 }
 401
 402                 else if (button_pressed > 0 && cardRead == 1)
 403                 {
 404                                         LEDsoff();
 405                                         LED(selected + 1, 0);
 406                                         LED(LED_ORANGE, 0);
 407
 408                                         // record
 409                                         Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
 410
 411                                         // wait for button to be released
 412                                         while(BUTTON_PRESS())
 413                                                 WDT_HIT();
 414
 415                                         /* need this delay to prevent catching some weird data */
 416                                         SpinDelay(500);
 417
 418                                         CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
 419                                         Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
 420
 421                                         LEDsoff();
 422                                         LED(selected + 1, 0);
 423                                         // Finished recording
 424
 425                                         // If we were previously playing, set playing off
 426                                         // so next button push begins playing what we recorded
 427                                         playing = 0;
 428
 429                                         cardRead = 0;
 430
 431                 }
 432
 433                 // Change where to record (or begin playing)
 434                 else if (button_pressed)
 435                 {
 436                         // Next option if we were previously playing
 437                         if (playing)
 438                                 selected = (selected + 1) % OPTS;
 439                         playing = !playing;
 440
 441                         LEDsoff();
 442                         LED(selected + 1, 0);
 443
 444                         // Begin transmitting
 445                         if (playing)
 446                         {
 447                                 LED(LED_GREEN, 0);
 448                                 DbpString("Playing");
 449                                 // wait for button to be released
 450                                 while(BUTTON_PRESS())
 451                                         WDT_HIT();
 452                                 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
 453                                 CmdHIDsimTAG(high[selected], low[selected], 0);
 454                                 DbpString("Done playing");
 455                                 if (BUTTON_HELD(1000) > 0)
 456                                         {
 457                                         DbpString("Exiting");
 458                                         LEDsoff();
 459                                         return;
 460                                         }
 461
 462                                 /* We pressed a button so ignore it here with a delay */
 463                                 SpinDelay(300);
 464
 465                                 // when done, we're done playing, move to next option
 466                                 selected = (selected + 1) % OPTS;
 467                                 playing = !playing;
 468                                 LEDsoff();
 469                                 LED(selected + 1, 0);
 470                         }
 471                         else
 472                                 while(BUTTON_PRESS())
 473                                         WDT_HIT();
 474                 }
 475         }
 476 }
 477 #endif
 478
 479 /*
 480 OBJECTIVE
 481 Listen and detect an external reader. Determine the best location
 482 for the antenna.
 483
 484 INSTRUCTIONS:
 485 Inside the ListenReaderField() function, there is two mode.
 486 By default, when you call the function, you will enter mode 1.
 487 If you press the PM3 button one time, you will enter mode 2.
 488 If you press the PM3 button a second time, you will exit the function.
 489
 490 DESCRIPTION OF MODE 1:
 491 This mode just listens for an external reader field and lights up green
 492 for HF and/or red for LF. This is the original mode of the detectreader
 493 function.
 494
 495 DESCRIPTION OF MODE 2:
 496 This mode will visually represent, using the LEDs, the actual strength of the
 497 current compared to the maximum current detected. Basically, once you know
 498 what kind of external reader is present, it will help you spot the best location to place
 499 your antenna. You will probably not get some good results if there is a LF and a HF reader
 500 at the same place! :-)
 501
 502 LIGHT SCHEME USED:
 503 */
 504 static const char LIGHT_SCHEME[] = {
 505                 0x0, /* ----     | No field detected */
 506                 0x1, /* X---     | 14% of maximum current detected */
 507                 0x2, /* -X--     | 29% of maximum current detected */
 508                 0x4, /* --X-     | 43% of maximum current detected */
 509                 0x8, /* ---X     | 57% of maximum current detected */
 510                 0xC, /* --XX     | 71% of maximum current detected */
 511                 0xE, /* -XXX     | 86% of maximum current detected */
 512                 0xF, /* XXXX     | 100% of maximum current detected */
 513 };
 514 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
 515
 516 void ListenReaderField(int limit)
 517 {
 518         int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
 519         int hf_av, hf_av_new,  hf_baseline= 0, hf_count= 0, hf_max;
 520         int mode=1, display_val, display_max, i;
 521
 522 #define LF_ONLY         1
 523 #define HF_ONLY         2
 524
 525         LEDsoff();
 526
 527         lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
 528
 529         if(limit != HF_ONLY) {
 530                 Dbprintf("LF 125/134 Baseline: %d", lf_av);
 531                 lf_baseline = lf_av;
 532         }
 533
 534         hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
 535
 536         if (limit != LF_ONLY) {
 537                 Dbprintf("HF 13.56 Baseline: %d", hf_av);
 538                 hf_baseline = hf_av;
 539         }
 540
 541         for(;;) {
 542                 if (BUTTON_PRESS()) {
 543                         SpinDelay(500);
 544                         switch (mode) {
 545                                 case 1:
 546                                         mode=2;
 547                                         DbpString("Signal Strength Mode");
 548                                         break;
 549                                 case 2:
 550                                 default:
 551                                         DbpString("Stopped");
 552                                         LEDsoff();
 553                                         return;
 554                                         break;
 555                         }
 556                 }
 557                 WDT_HIT();
 558
 559                 if (limit != HF_ONLY) {
 560                         if(mode==1) {
 561                                 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
 562                                 else                               LED_D_OFF();
 563                         }
 564
 565                         ++lf_count;
 566                         lf_av_new= ReadAdc(ADC_CHAN_LF);
 567                         // see if there's a significant change
 568                         if(abs(lf_av - lf_av_new) > 10) {
 569                                 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
 570                                 lf_av = lf_av_new;
 571                                 if (lf_av > lf_max)
 572                                         lf_max = lf_av;
 573                                 lf_count= 0;
 574                         }
 575                 }
 576
 577                 if (limit != LF_ONLY) {
 578                         if (mode == 1){
 579                                 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
 580                                 else                               LED_B_OFF();
 581                         }
 582
 583                         ++hf_count;
 584                         hf_av_new= ReadAdc(ADC_CHAN_HF);
 585                         // see if there's a significant change
 586                         if(abs(hf_av - hf_av_new) > 10) {
 587                                 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
 588                                 hf_av = hf_av_new;
 589                                 if (hf_av > hf_max)
 590                                         hf_max = hf_av;
 591                                 hf_count= 0;
 592                         }
 593                 }
 594
 595                 if(mode == 2) {
 596                         if (limit == LF_ONLY) {
 597                                 display_val = lf_av;
 598                                 display_max = lf_max;
 599                         } else if (limit == HF_ONLY) {
 600                                 display_val = hf_av;
 601                                 display_max = hf_max;
 602                         } else { /* Pick one at random */
 603                                 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
 604                                         display_val = hf_av;
 605                                         display_max = hf_max;
 606                                 } else {
 607                                         display_val = lf_av;
 608                                         display_max = lf_max;
 609                                 }
 610                         }
 611                         for (i=0; i<LIGHT_LEN; i++) {
 612                                 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
 613                                         if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
 614                                         if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
 615                                         if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
 616                                         if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
 617                                         break;
 618                                 }
 619                         }
 620                 }
 621         }
 622 }
 623
 624 void UsbPacketReceived(uint8_t *packet, int len)
 625 {
 626         UsbCommand *c = (UsbCommand *)packet;
 627
 628 //  Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
 629
 630         switch(c->cmd) {
 631 #ifdef WITH_LF
 632                 case CMD_SET_LF_SAMPLING_CONFIG:
 633                         setSamplingConfig((sample_config *) c->d.asBytes);
 634                         break;
 635                 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
 636                         cmd_send(CMD_ACK,SampleLF(),0,0,0,0);
 637                         break;
 638                 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
 639                         ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
 640                         break;
 641                 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
 642                         cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
 643                         break;
 644                 case CMD_HID_DEMOD_FSK:
 645                         CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
 646                         break;
 647                 case CMD_HID_SIM_TAG:
 648                         CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
 649                         break;
 650                 case CMD_HID_CLONE_TAG:
 651                         CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 652                         break;
 653                 case CMD_IO_DEMOD_FSK:
 654                         CmdIOdemodFSK(c->arg[0], 0, 0, 1);
 655                         break;
 656                 case CMD_IO_CLONE_TAG:
 657                         CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
 658                         break;
 659                 case CMD_EM410X_DEMOD:
 660                         CmdEM410xdemod(c->arg[0], 0, 0, 1);
 661                         break;
 662                 case CMD_EM410X_WRITE_TAG:
 663                         WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
 664                         break;
 665                 case CMD_READ_TI_TYPE:
 666                         ReadTItag();
 667                         break;
 668                 case CMD_WRITE_TI_TYPE:
 669                         WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
 670                         break;
 671                 case CMD_SIMULATE_TAG_125K:
 672                         LED_A_ON();
 673                         SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
 674                         LED_A_OFF();
 675                         break;
 676                 case CMD_LF_SIMULATE_BIDIR:
 677                         SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
 678                         break;
 679                 case CMD_INDALA_CLONE_TAG:
 680                         CopyIndala64toT55x7(c->arg[0], c->arg[1]);
 681                         break;
 682                 case CMD_INDALA_CLONE_TAG_L:
 683                         CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
 684                         break;
 685                 case CMD_T55XX_READ_BLOCK:
 686                         T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
 687                         break;
 688                 case CMD_T55XX_WRITE_BLOCK:
 689                         T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 690                         break;
 691                 case CMD_T55XX_READ_TRACE:
 692                         T55xxReadTrace();
 693                         break;
 694                 case CMD_PCF7931_READ:
 695                         ReadPCF7931();
 696                         cmd_send(CMD_ACK,0,0,0,0,0);
 697                         break;
 698                 case CMD_EM4X_READ_WORD:
 699                         EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
 700                         break;
 701                 case CMD_EM4X_WRITE_WORD:
 702                         EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 703                         break;
 704 #endif
 705
 706 #ifdef WITH_HITAG
 707                 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
 708                         SnoopHitag(c->arg[0]);
 709                         break;
 710                 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
 711                         SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
 712                         break;
 713                 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
 714                         ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
 715                         break;
 716 #endif
 717
 718 #ifdef WITH_ISO15693
 719                 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
 720                         AcquireRawAdcSamplesIso15693();
 721                         break;
 722                 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
 723                         RecordRawAdcSamplesIso15693();
 724                         break;
 725
 726                 case CMD_ISO_15693_COMMAND:
 727                         DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
 728                         break;
 729
 730                 case CMD_ISO_15693_FIND_AFI:
 731                         BruteforceIso15693Afi(c->arg[0]);
 732                         break;
 733
 734                 case CMD_ISO_15693_DEBUG:
 735                         SetDebugIso15693(c->arg[0]);
 736                         break;
 737
 738                 case CMD_READER_ISO_15693:
 739                         ReaderIso15693(c->arg[0]);
 740                         break;
 741                 case CMD_SIMTAG_ISO_15693:
 742                         SimTagIso15693(c->arg[0], c->d.asBytes);
 743                         break;
 744 #endif
 745
 746 #ifdef WITH_LEGICRF
 747                 case CMD_SIMULATE_TAG_LEGIC_RF:
 748                         LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
 749                         break;
 750
 751                 case CMD_WRITER_LEGIC_RF:
 752                         LegicRfWriter(c->arg[1], c->arg[0]);
 753                         break;
 754
 755                 case CMD_READER_LEGIC_RF:
 756                         LegicRfReader(c->arg[0], c->arg[1]);
 757                         break;
 758 #endif
 759
 760 #ifdef WITH_ISO14443b
 761                 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
 762                         AcquireRawAdcSamplesIso14443(c->arg[0]);
 763                         break;
 764                 case CMD_READ_SRI512_TAG:
 765                         ReadSTMemoryIso14443(0x0F);
 766                         break;
 767                 case CMD_READ_SRIX4K_TAG:
 768                         ReadSTMemoryIso14443(0x7F);
 769                         break;
 770                 case CMD_SNOOP_ISO_14443:
 771                         SnoopIso14443();
 772                         break;
 773                 case CMD_SIMULATE_TAG_ISO_14443:
 774                         SimulateIso14443Tag();
 775                         break;
 776                 case CMD_ISO_14443B_COMMAND:
 777                         SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
 778                         break;
 779 #endif
 780
 781 #ifdef WITH_ISO14443a
 782                 case CMD_SNOOP_ISO_14443a:
 783                         SnoopIso14443a(c->arg[0]);
 784                         break;
 785                 case CMD_READER_ISO_14443a:
 786                         ReaderIso14443a(c);
 787                         break;
 788                 case CMD_SIMULATE_TAG_ISO_14443a:
 789                         SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);  // ## Simulate iso14443a tag - pass tag type & UID
 790                         break;
 791
 792                 case CMD_EPA_PACE_COLLECT_NONCE:
 793                         EPA_PACE_Collect_Nonce(c);
 794                         break;
 795
 796                 case CMD_READER_MIFARE:
 797             ReaderMifare(c->arg[0]);
 798                         break;
 799                 case CMD_MIFARE_READBL:
 800                         MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 801                         break;
 802                 case CMD_MIFAREU_READBL:
 803                         MifareUReadBlock(c->arg[0],c->d.asBytes);
 804                         break;
 805                 case CMD_MIFAREU_READCARD:
 806                         MifareUReadCard(c->arg[0], c->arg[1], c->d.asBytes);
 807                         break;
 808                 case CMD_MIFARE_READSC:
 809                         MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 810                         break;
 811                 case CMD_MIFARE_WRITEBL:
 812                         MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 813                         break;
 814                 case CMD_MIFAREU_WRITEBL_COMPAT:
 815                         MifareUWriteBlock(c->arg[0], c->d.asBytes);
 816                         break;
 817                 case CMD_MIFAREU_WRITEBL:
 818                         MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
 819                         break;
 820                 case CMD_MIFARE_NESTED:
 821                         MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 822                         break;
 823                 case CMD_MIFARE_CHKKEYS:
 824                         MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 825                         break;
 826                 case CMD_SIMULATE_MIFARE_CARD:
 827                         Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 828                         break;
 829
 830                 // emulator
 831                 case CMD_MIFARE_SET_DBGMODE:
 832                         MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 833                         break;
 834                 case CMD_MIFARE_EML_MEMCLR:
 835                         MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 836                         break;
 837                 case CMD_MIFARE_EML_MEMSET:
 838                         MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 839                         break;
 840                 case CMD_MIFARE_EML_MEMGET:
 841                         MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 842                         break;
 843                 case CMD_MIFARE_EML_CARDLOAD:
 844                         MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 845                         break;
 846
 847                 // Work with "magic Chinese" card
 848                 case CMD_MIFARE_CSETBLOCK:
 849                         MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 850                         break;
 851                 case CMD_MIFARE_CGETBLOCK:
 852                         MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 853                         break;
 854                 case CMD_MIFARE_CIDENT:
 855                         MifareCIdent();
 856                         break;
 857
 858                 // mifare sniffer
 859                 case CMD_MIFARE_SNIFFER:
 860                         SniffMifare(c->arg[0]);
 861                         break;
 862 #endif
 863
 864 #ifdef WITH_ICLASS
 865                 // Makes use of ISO14443a FPGA Firmware
 866                 case CMD_SNOOP_ICLASS:
 867                         SnoopIClass();
 868                         break;
 869                 case CMD_SIMULATE_TAG_ICLASS:
 870                         SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 871                         break;
 872                 case CMD_READER_ICLASS:
 873                         ReaderIClass(c->arg[0]);
 874                         break;
 875                 case CMD_READER_ICLASS_REPLAY:
 876                     ReaderIClass_Replay(c->arg[0], c->d.asBytes);
 877                         break;
 878 #endif
 879
 880                 case CMD_SIMULATE_TAG_HF_LISTEN:
 881                         SimulateTagHfListen();
 882                         break;
 883
 884                 case CMD_BUFF_CLEAR:
 885                         BufferClear();
 886                         break;
 887
 888                 case CMD_MEASURE_ANTENNA_TUNING:
 889                         MeasureAntennaTuning();
 890                         break;
 891
 892                 case CMD_MEASURE_ANTENNA_TUNING_HF:
 893                         MeasureAntennaTuningHf();
 894                         break;
 895
 896                 case CMD_LISTEN_READER_FIELD:
 897                         ListenReaderField(c->arg[0]);
 898                         break;
 899
 900                 case CMD_FPGA_MAJOR_MODE_OFF:           // ## FPGA Control
 901                         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 902                         SpinDelay(200);
 903                         LED_D_OFF(); // LED D indicates field ON or OFF
 904                         break;
 905
 906                 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
 907
 908                         LED_B_ON();
 909                         for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
 910                                 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
 911                                 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
 912                         }
 913                         // Trigger a finish downloading signal with an ACK frame
 914                         // We put a 1 in arg[0] to alert the host we're also sending sample_config
 915                         cmd_send(CMD_ACK,1,0,0,getSamplingConfig(),sizeof(sample_config));
 916                         LED_B_OFF();
 917                         break;
 918
 919                 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
 920                         uint8_t *b = (uint8_t *)BigBuf;
 921                         memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
 922                         cmd_send(CMD_ACK,0,0,0,0,0);
 923                         break;
 924                 }
 925                 case CMD_READ_MEM:
 926                         ReadMem(c->arg[0]);
 927                         break;
 928
 929                 case CMD_SET_LF_DIVISOR:
 930                         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 931                         FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
 932                         break;
 933
 934                 case CMD_SET_ADC_MUX:
 935                         switch(c->arg[0]) {
 936                                 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
 937                                 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
 938                                 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
 939                                 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
 940                         }
 941                         break;
 942
 943                 case CMD_VERSION:
 944                         SendVersion();
 945                         break;
 946
 947 #ifdef WITH_LCD
 948                 case CMD_LCD_RESET:
 949                         LCDReset();
 950                         break;
 951                 case CMD_LCD:
 952                         LCDSend(c->arg[0]);
 953                         break;
 954 #endif
 955                 case CMD_SETUP_WRITE:
 956                 case CMD_FINISH_WRITE:
 957                 case CMD_HARDWARE_RESET:
 958                         usb_disable();
 959                         SpinDelay(1000);
 960                         SpinDelay(1000);
 961                         AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
 962                         for(;;) {
 963                                 // We're going to reset, and the bootrom will take control.
 964                         }
 965                         break;
 966
 967                 case CMD_START_FLASH:
 968                         if(common_area.flags.bootrom_present) {
 969                                 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
 970                         }
 971                         usb_disable();
 972                         AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
 973                         for(;;);
 974                         break;
 975
 976                 case CMD_DEVICE_INFO: {
 977                         uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
 978                         if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
 979                         cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
 980                         break;
 981                 }
 982                 default:
 983                         Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
 984                         break;
 985         }
 986 }
 987
 988 void  __attribute__((noreturn)) AppMain(void)
 989 {
 990         SpinDelay(100);
 991
 992         if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
 993                 /* Initialize common area */
 994                 memset(&common_area, 0, sizeof(common_area));
 995                 common_area.magic = COMMON_AREA_MAGIC;
 996                 common_area.version = 1;
 997         }
 998         common_area.flags.osimage_present = 1;
 999
1000         LED_D_OFF();
1001         LED_C_OFF();
1002         LED_B_OFF();
1003         LED_A_OFF();
1004
1005         // Init USB device
1006   usb_enable();
1007
1008         // The FPGA gets its clock from us from PCK0 output, so set that up.
1009         AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1010         AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1011         AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1012         // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1013         AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1014                 AT91C_PMC_PRES_CLK_4;
1015         AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1016
1017         // Reset SPI
1018         AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1019         // Reset SSC
1020         AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1021
1022         // Load the FPGA image, which we have stored in our flash.
1023         // (the HF version by default)
1024         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1025
1026         StartTickCount();
1027
1028 #ifdef WITH_LCD
1029         LCDInit();
1030 #endif
1031
1032   byte_t rx[sizeof(UsbCommand)];
1033         size_t rx_len;
1034
1035         for(;;) {
1036     if (usb_poll()) {
1037       rx_len = usb_read(rx,sizeof(UsbCommand));
1038       if (rx_len) {
1039         UsbPacketReceived(rx,rx_len);
1040       }
1041     }
1042                 WDT_HIT();
1043
1044 #ifdef WITH_LF
1045                 if (BUTTON_HELD(1000) > 0)
1046                         SamyRun();
1047 #endif
1048         }
1049 }