armsrc/appmain.c

   1 //-----------------------------------------------------------------------------
   2 // Jonathan Westhues, Mar 2006
   3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // The main application code. This is the first thing called after start.c
  10 // executes.
  11 //-----------------------------------------------------------------------------
  12
  13 #include "usb_cdc.h"
  14 #include "cmd.h"
  15
  16 #include "proxmark3.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "printf.h"
  20 #include "string.h"
  21
  22 #include <stdarg.h>
  23
  24 #include "legicrf.h"
  25 #include <hitag2.h>
  26 #include "lfsampling.h"
  27 #include "BigBuf.h"
  28 #include "mifareutil.h"
  29 #include "pcf7931.h"
  30 #ifdef WITH_LCD
  31  #include "LCD.h"
  32 #endif
  33
  34 // Craig Young - 14a stand-alone code
  35 #ifdef WITH_ISO14443a_StandAlone
  36  #include "iso14443a.h"
  37 #endif
  38
  39 #define abs(x) ( ((x)<0) ? -(x) : (x) )
  40
  41 //=============================================================================
  42 // A buffer where we can queue things up to be sent through the FPGA, for
  43 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
  44 // is the order in which they go out on the wire.
  45 //=============================================================================
  46
  47 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2)  // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
  48 uint8_t ToSend[TOSEND_BUFFER_SIZE];
  49 int ToSendMax;
  50 static int ToSendBit;
  51 struct common_area common_area __attribute__((section(".commonarea")));
  52
  53 void ToSendReset(void)
  54 {
  55         ToSendMax = -1;
  56         ToSendBit = 8;
  57 }
  58
  59 void ToSendStuffBit(int b)
  60 {
  61         if(ToSendBit >= 8) {
  62                 ToSendMax++;
  63                 ToSend[ToSendMax] = 0;
  64                 ToSendBit = 0;
  65         }
  66
  67         if(b) {
  68                 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
  69         }
  70
  71         ToSendBit++;
  72
  73         if(ToSendMax >= sizeof(ToSend)) {
  74                 ToSendBit = 0;
  75                 DbpString("ToSendStuffBit overflowed!");
  76         }
  77 }
  78
  79 //=============================================================================
  80 // Debug print functions, to go out over USB, to the usual PC-side client.
  81 //=============================================================================
  82
  83 void DbpString(char *str)
  84 {
  85   byte_t len = strlen(str);
  86   cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
  87 }
  88
  89 #if 0
  90 void DbpIntegers(int x1, int x2, int x3)
  91 {
  92   cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
  93 }
  94 #endif
  95
  96 void Dbprintf(const char *fmt, ...) {
  97 // should probably limit size here; oh well, let's just use a big buffer
  98         char output_string[128];
  99         va_list ap;
 100
 101         va_start(ap, fmt);
 102         kvsprintf(fmt, output_string, 10, ap);
 103         va_end(ap);
 104
 105         DbpString(output_string);
 106 }
 107
 108 // prints HEX & ASCII
 109 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
 110         int l=0,i;
 111         char ascii[9];
 112
 113         while (len>0) {
 114                 if (len>8) l=8;
 115                 else l=len;
 116
 117                 memcpy(ascii,d,l);
 118                 ascii[l]=0;
 119
 120                 // filter safe ascii
 121                 for (i=0;i<l;i++)
 122                         if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
 123
 124                 if (bAsci) {
 125                         Dbprintf("%-8s %*D",ascii,l,d," ");
 126                 } else {
 127                         Dbprintf("%*D",l,d," ");
 128                 }
 129
 130                 len-=8;
 131                 d+=8;
 132         }
 133 }
 134
 135 //-----------------------------------------------------------------------------
 136 // Read an ADC channel and block till it completes, then return the result
 137 // in ADC units (0 to 1023). Also a routine to average 32 samples and
 138 // return that.
 139 //-----------------------------------------------------------------------------
 140 static int ReadAdc(int ch)
 141 {
 142         uint32_t d;
 143
 144         AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
 145         AT91C_BASE_ADC->ADC_MR =
 146                 ADC_MODE_PRESCALE(63  /* was 32 */) |                                                   // ADC_CLK = MCK / ((63+1) * 2) = 48MHz / 128 = 375kHz
 147                 ADC_MODE_STARTUP_TIME(1  /* was 16 */) |                                                // Startup Time = (1+1) * 8 / ADC_CLK = 16 / 375kHz = 42,7us     Note: must be > 20us
 148                 ADC_MODE_SAMPLE_HOLD_TIME(15  /* was 8 */);                                     // Sample & Hold Time SHTIM = 15 / ADC_CLK = 15 / 375kHz = 40us
 149
 150         // Note: ADC_MODE_PRESCALE and ADC_MODE_SAMPLE_HOLD_TIME are set to the maximum allowed value.
 151         // Both AMPL_LO and AMPL_HI are very high impedance (10MOhm) outputs, the input capacitance of the ADC is 12pF (typical). This results in a time constant
 152         // of RC = 10MOhm * 12pF = 120us. Even after the maximum configurable sample&hold time of 40us the input capacitor will not be fully charged.
 153         //
 154         // The maths are:
 155         // If there is a voltage v_in at the input, the voltage v_cap at the capacitor (this is what we are measuring) will be
 156         //
 157         //       v_cap = v_in * (1 - exp(-RC/SHTIM))  =   v_in * (1 - exp(-3))  =  v_in * 0,95                   (i.e. an error of 5%)
 158         //
 159         // Note: with the "historic" values in the comments above, the error was 34%  !!!
 160
 161         AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
 162
 163         AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
 164
 165         while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
 166                 ;
 167         d = AT91C_BASE_ADC->ADC_CDR[ch];
 168
 169         return d;
 170 }
 171
 172 int AvgAdc(int ch) // was static - merlok
 173 {
 174         int i;
 175         int a = 0;
 176
 177         for(i = 0; i < 32; i++) {
 178                 a += ReadAdc(ch);
 179         }
 180
 181         return (a + 15) >> 5;
 182 }
 183
 184 void MeasureAntennaTuning(void)
 185 {
 186         uint8_t LF_Results[256];
 187         int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
 188         int vLf125 = 0, vLf134 = 0, vHf = 0;    // in mV
 189
 190         LED_B_ON();
 191
 192 /*
 193  * Sweeps the useful LF range of the proxmark from
 194  * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
 195  * read the voltage in the antenna, the result left
 196  * in the buffer is a graph which should clearly show
 197  * the resonating frequency of your LF antenna
 198  * ( hopefully around 95 if it is tuned to 125kHz!)
 199  */
 200
 201         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 202         FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
 203         for (i=255; i>=19; i--) {
 204     WDT_HIT();
 205                 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
 206                 SpinDelay(20);
 207                 adcval = ((MAX_ADC_LF_VOLTAGE * AvgAdc(ADC_CHAN_LF)) >> 10);
 208                 if (i==95)      vLf125 = adcval; // voltage at 125Khz
 209                 if (i==89)      vLf134 = adcval; // voltage at 134Khz
 210
 211                 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
 212                 if(LF_Results[i] > peak) {
 213                         peakv = adcval;
 214                         peak = LF_Results[i];
 215                         peakf = i;
 216                         //ptr = i;
 217                 }
 218         }
 219
 220         for (i=18; i >= 0; i--) LF_Results[i] = 0;
 221
 222         LED_A_ON();
 223         // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
 224         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 225         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 226         SpinDelay(20);
 227         vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
 228
 229         cmd_send(CMD_MEASURED_ANTENNA_TUNING, vLf125 | (vLf134<<16), vHf, peakf | (peakv<<16), LF_Results, 256);
 230         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 231         LED_A_OFF();
 232         LED_B_OFF();
 233         return;
 234 }
 235
 236 void MeasureAntennaTuningHf(void)
 237 {
 238         int vHf = 0;    // in mV
 239
 240         DbpString("Measuring HF antenna, press button to exit");
 241
 242         // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
 243         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 244         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 245
 246         for (;;) {
 247                 SpinDelay(20);
 248                 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
 249
 250                 Dbprintf("%d mV",vHf);
 251                 if (BUTTON_PRESS()) break;
 252         }
 253         DbpString("cancelled");
 254
 255         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 256
 257 }
 258
 259
 260 void ReadMem(int addr)
 261 {
 262         const uint8_t *data = ((uint8_t *)addr);
 263
 264         Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
 265                 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
 266 }
 267
 268 /* osimage version information is linked in */
 269 extern struct version_information version_information;
 270 /* bootrom version information is pointed to from _bootphase1_version_pointer */
 271 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, _bootrom_start, _bootrom_end, __data_src_start__;
 272 void SendVersion(void)
 273 {
 274         char temp[USB_CMD_DATA_SIZE]; /* Limited data payload in USB packets */
 275         char VersionString[USB_CMD_DATA_SIZE] = { '\0' };
 276
 277         /* Try to find the bootrom version information. Expect to find a pointer at
 278          * symbol _bootphase1_version_pointer, perform slight sanity checks on the
 279          * pointer, then use it.
 280          */
 281         char *bootrom_version = *(char**)&_bootphase1_version_pointer;
 282         if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
 283                 strcat(VersionString, "bootrom version information appears invalid\n");
 284         } else {
 285                 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
 286                 strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
 287         }
 288
 289         FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
 290         strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
 291
 292         FpgaGatherVersion(FPGA_BITSTREAM_LF, temp, sizeof(temp));
 293         strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
 294         FpgaGatherVersion(FPGA_BITSTREAM_HF, temp, sizeof(temp));
 295         strncat(VersionString, temp, sizeof(VersionString) - strlen(VersionString) - 1);
 296
 297         // Send Chip ID and used flash memory
 298         uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
 299         uint32_t compressed_data_section_size = common_area.arg1;
 300         cmd_send(CMD_ACK, *(AT91C_DBGU_CIDR), text_and_rodata_section_size + compressed_data_section_size, 0, VersionString, strlen(VersionString));
 301 }
 302
 303 // measure the USB Speed by sending SpeedTestBufferSize bytes to client and measuring the elapsed time.
 304 // Note: this mimics GetFromBigbuf(), i.e. we have the overhead of the UsbCommand structure included.
 305 void printUSBSpeed(void)
 306 {
 307         Dbprintf("USB Speed:");
 308         Dbprintf("  Sending USB packets to client...");
 309
 310         #define USB_SPEED_TEST_MIN_TIME 1500    // in milliseconds
 311         uint8_t *test_data = BigBuf_get_addr();
 312         uint32_t end_time;
 313
 314         uint32_t start_time = end_time = GetTickCount();
 315         uint32_t bytes_transferred = 0;
 316
 317         LED_B_ON();
 318         while(end_time < start_time + USB_SPEED_TEST_MIN_TIME) {
 319                 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, 0, USB_CMD_DATA_SIZE, 0, test_data, USB_CMD_DATA_SIZE);
 320                 end_time = GetTickCount();
 321                 bytes_transferred += USB_CMD_DATA_SIZE;
 322         }
 323         LED_B_OFF();
 324
 325         Dbprintf("  Time elapsed:      %dms", end_time - start_time);
 326         Dbprintf("  Bytes transferred: %d", bytes_transferred);
 327         Dbprintf("  USB Transfer Speed PM3 -> Client = %d Bytes/s",
 328                 1000 * bytes_transferred / (end_time - start_time));
 329
 330 }
 331
 332 /**
 333   * Prints runtime information about the PM3.
 334 **/
 335 void SendStatus(void)
 336 {
 337         BigBuf_print_status();
 338         Fpga_print_status();
 339         printConfig(); //LF Sampling config
 340         printUSBSpeed();
 341         Dbprintf("Various");
 342         Dbprintf("  MF_DBGLEVEL......%d", MF_DBGLEVEL);
 343         Dbprintf("  ToSendMax........%d",ToSendMax);
 344         Dbprintf("  ToSendBit........%d",ToSendBit);
 345
 346         cmd_send(CMD_ACK,1,0,0,0,0);
 347 }
 348
 349 #if defined(WITH_ISO14443a_StandAlone) || defined(WITH_LF)
 350
 351 #define OPTS 2
 352
 353 void StandAloneMode()
 354 {
 355         DbpString("Stand-alone mode! No PC necessary.");
 356         // Oooh pretty -- notify user we're in elite samy mode now
 357         LED(LED_RED,    200);
 358         LED(LED_ORANGE, 200);
 359         LED(LED_GREEN,  200);
 360         LED(LED_ORANGE, 200);
 361         LED(LED_RED,    200);
 362         LED(LED_ORANGE, 200);
 363         LED(LED_GREEN,  200);
 364         LED(LED_ORANGE, 200);
 365         LED(LED_RED,    200);
 366
 367 }
 368
 369 #endif
 370
 371
 372
 373 #ifdef WITH_ISO14443a_StandAlone
 374 void StandAloneMode14a()
 375 {
 376         StandAloneMode();
 377         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 378
 379         int selected = 0;
 380         int playing = 0, iGotoRecord = 0, iGotoClone = 0;
 381         int cardRead[OPTS] = {0};
 382         uint8_t readUID[10] = {0};
 383         uint32_t uid_1st[OPTS]={0};
 384         uint32_t uid_2nd[OPTS]={0};
 385         uint32_t uid_tmp1 = 0;
 386         uint32_t uid_tmp2 = 0;
 387         iso14a_card_select_t hi14a_card[OPTS];
 388
 389         LED(selected + 1, 0);
 390
 391         for (;;)
 392         {
 393                 usb_poll();
 394                 WDT_HIT();
 395                 SpinDelay(300);
 396
 397                 if (iGotoRecord == 1 || cardRead[selected] == 0)
 398                 {
 399                         iGotoRecord = 0;
 400                         LEDsoff();
 401                         LED(selected + 1, 0);
 402                         LED(LED_RED2, 0);
 403
 404                         // record
 405                         Dbprintf("Enabling iso14443a reader mode for [Bank: %u]...", selected);
 406                         /* need this delay to prevent catching some weird data */
 407                         SpinDelay(500);
 408                         /* Code for reading from 14a tag */
 409                         uint8_t uid[10]  ={0};
 410                         uint32_t cuid;
 411                         iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
 412
 413                         for ( ; ; )
 414                         {
 415                                 WDT_HIT();
 416                                 if (BUTTON_PRESS()) {
 417                                         if (cardRead[selected]) {
 418                                                 Dbprintf("Button press detected -- replaying card in bank[%d]", selected);
 419                                                 break;
 420                                         }
 421                                         else if (cardRead[(selected+1)%OPTS]) {
 422                                                 Dbprintf("Button press detected but no card in bank[%d] so playing from bank[%d]", selected, (selected+1)%OPTS);
 423                                                 selected = (selected+1)%OPTS;
 424                                                 break; // playing = 1;
 425                                         }
 426                                         else {
 427                                                 Dbprintf("Button press detected but no stored tag to play. (Ignoring button)");
 428                                                 SpinDelay(300);
 429                                         }
 430                                 }
 431                                 if (!iso14443a_select_card(uid, &hi14a_card[selected], &cuid))
 432                                         continue;
 433                                 else
 434                                 {
 435                                         Dbprintf("Read UID:"); Dbhexdump(10,uid,0);
 436                                         memcpy(readUID,uid,10*sizeof(uint8_t));
 437                                         uint8_t *dst = (uint8_t *)&uid_tmp1;
 438                                         // Set UID byte order
 439                                         for (int i=0; i<4; i++)
 440                                                 dst[i] = uid[3-i];
 441                                         dst = (uint8_t *)&uid_tmp2;
 442                                         for (int i=0; i<4; i++)
 443                                                 dst[i] = uid[7-i];
 444                                         if (uid_1st[(selected+1)%OPTS] == uid_tmp1 && uid_2nd[(selected+1)%OPTS] == uid_tmp2) {
 445                                                 Dbprintf("Card selected has same UID as what is stored in the other bank. Skipping.");
 446                                         }
 447                                         else {
 448                                                 if (uid_tmp2) {
 449                                                         Dbprintf("Bank[%d] received a 7-byte UID",selected);
 450                                                         uid_1st[selected] = (uid_tmp1)>>8;
 451                                                         uid_2nd[selected] = (uid_tmp1<<24) + (uid_tmp2>>8);
 452                                                 }
 453                                                 else {
 454                                                         Dbprintf("Bank[%d] received a 4-byte UID",selected);
 455                                                         uid_1st[selected] = uid_tmp1;
 456                                                         uid_2nd[selected] = uid_tmp2;
 457                                                 }
 458                                                 break;
 459                                         }
 460                                 }
 461                         }
 462                         Dbprintf("ATQA = %02X%02X",hi14a_card[selected].atqa[0],hi14a_card[selected].atqa[1]);
 463                         Dbprintf("SAK = %02X",hi14a_card[selected].sak);
 464                         LEDsoff();
 465                         LED(LED_GREEN,  200);
 466                         LED(LED_ORANGE, 200);
 467                         LED(LED_GREEN,  200);
 468                         LED(LED_ORANGE, 200);
 469
 470                         LEDsoff();
 471                         LED(selected + 1, 0);
 472
 473                         // Next state is replay:
 474                         playing = 1;
 475
 476                         cardRead[selected] = 1;
 477                 }
 478                 /* MF Classic UID clone */
 479                 else if (iGotoClone==1)
 480                 {
 481                         iGotoClone=0;
 482                         LEDsoff();
 483                         LED(selected + 1, 0);
 484                         LED(LED_ORANGE, 250);
 485
 486
 487                         // record
 488                         Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]);
 489
 490                         // wait for button to be released
 491                         while(BUTTON_PRESS())
 492                         {
 493                                 // Delay cloning until card is in place
 494                                 WDT_HIT();
 495                         }
 496                         Dbprintf("Starting clone. [Bank: %u]", selected);
 497                         // need this delay to prevent catching some weird data
 498                         SpinDelay(500);
 499                         // Begin clone function here:
 500                         /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards:
 501                                         UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
 502                                         memcpy(c.d.asBytes, data, 16);
 503                                         SendCommand(&c);
 504
 505                                         Block read is similar:
 506                                         UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};
 507                                         We need to imitate that call with blockNo 0 to set a uid.
 508
 509                                         The get and set commands are handled in this file:
 510                                         // Work with "magic Chinese" card
 511                                         case CMD_MIFARE_CSETBLOCK:
 512                                                 MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 513                                                 break;
 514                                         case CMD_MIFARE_CGETBLOCK:
 515                                                 MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 516                                                 break;
 517
 518                                 mfCSetUID provides example logic for UID set workflow:
 519                                         -Read block0 from card in field with MifareCGetBlock()
 520                                         -Configure new values without replacing reserved bytes
 521                                                         memcpy(block0, uid, 4); // Copy UID bytes from byte array
 522                                                         // Mifare UID BCC
 523                                                         block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5
 524                                                         Bytes 5-7 are reserved SAK and ATQA for mifare classic
 525                                         -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it
 526                         */
 527                         uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0};
 528                         // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo
 529                         MifareCGetBlock(0x3F, 1, 0, oldBlock0);
 530                         if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1]  && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) {
 531                                 Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected);
 532                                 playing = 1;
 533                         }
 534                         else {
 535                                 Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]);
 536                                 memcpy(newBlock0,oldBlock0,16);
 537                                 // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic)
 538
 539                                 newBlock0[0] = uid_1st[selected]>>24;
 540                                 newBlock0[1] = 0xFF & (uid_1st[selected]>>16);
 541                                 newBlock0[2] = 0xFF & (uid_1st[selected]>>8);
 542                                 newBlock0[3] = 0xFF & (uid_1st[selected]);
 543                                 newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3];
 544                                 // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain
 545                                 MifareCSetBlock(0, 0xFF,0, newBlock0);
 546                                 MifareCGetBlock(0x3F, 1, 0, testBlock0);
 547                                 if (memcmp(testBlock0,newBlock0,16)==0)
 548                                 {
 549                                         DbpString("Cloned successfull!");
 550                                         cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it
 551                                         playing = 0;
 552                                         iGotoRecord = 1;
 553                                         selected = (selected+1) % OPTS;
 554                                 }
 555                                 else {
 556                                         Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected);
 557                                         playing = 1;
 558                                 }
 559                         }
 560                         LEDsoff();
 561                         LED(selected + 1, 0);
 562
 563                 }
 564                 // Change where to record (or begin playing)
 565                 else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected])
 566                 {
 567                         LEDsoff();
 568                         LED(selected + 1, 0);
 569
 570                         // Begin transmitting
 571                         if (playing)
 572                         {
 573                                 LED(LED_GREEN, 0);
 574                                 DbpString("Playing");
 575                                 for ( ; ; ) {
 576                                         WDT_HIT();
 577                                         int button_action = BUTTON_HELD(1000);
 578                                         if (button_action == 0) { // No button action, proceed with sim
 579                                                 uint8_t data[512] = {0}; // in case there is a read command received we shouldn't break
 580                                                 Dbprintf("Simulating ISO14443a tag with uid[0]: %08x, uid[1]: %08x [Bank: %u]", uid_1st[selected],uid_2nd[selected],selected);
 581                                                 if (hi14a_card[selected].sak == 8 && hi14a_card[selected].atqa[0] == 4 && hi14a_card[selected].atqa[1] == 0) {
 582                                                         DbpString("Mifare Classic");
 583                                                         SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data); // Mifare Classic
 584                                                 }
 585                                                 else if (hi14a_card[selected].sak == 0 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 0) {
 586                                                         DbpString("Mifare Ultralight");
 587                                                         SimulateIso14443aTag(2,uid_1st[selected],uid_2nd[selected],data); // Mifare Ultralight
 588                                                 }
 589                                                 else if (hi14a_card[selected].sak == 20 && hi14a_card[selected].atqa[0] == 0x44 && hi14a_card[selected].atqa[1] == 3) {
 590                                                         DbpString("Mifare DESFire");
 591                                                         SimulateIso14443aTag(3,uid_1st[selected],uid_2nd[selected],data); // Mifare DESFire
 592                                                 }
 593                                                 else {
 594                                                         Dbprintf("Unrecognized tag type -- defaulting to Mifare Classic emulation");
 595                                                         SimulateIso14443aTag(1,uid_1st[selected], uid_2nd[selected], data);
 596                                                 }
 597                                         }
 598                                         else if (button_action == BUTTON_SINGLE_CLICK) {
 599                                                 selected = (selected + 1) % OPTS;
 600                                                 Dbprintf("Done playing. Switching to record mode on bank %d",selected);
 601                                                 iGotoRecord = 1;
 602                                                 break;
 603                                         }
 604                                         else if (button_action == BUTTON_HOLD) {
 605                                                 Dbprintf("Playtime over. Begin cloning...");
 606                                                 iGotoClone = 1;
 607                                                 break;
 608                                         }
 609                                         WDT_HIT();
 610                                 }
 611
 612                                 /* We pressed a button so ignore it here with a delay */
 613                                 SpinDelay(300);
 614                                 LEDsoff();
 615                                 LED(selected + 1, 0);
 616                         }
 617                         else
 618                                 while(BUTTON_PRESS())
 619                                         WDT_HIT();
 620                 }
 621         }
 622 }
 623 #elif WITH_LF
 624 // samy's sniff and repeat routine
 625 void SamyRun()
 626 {
 627         StandAloneMode();
 628         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 629
 630         int high[OPTS], low[OPTS];
 631         int selected = 0;
 632         int playing = 0;
 633         int cardRead = 0;
 634
 635         // Turn on selected LED
 636         LED(selected + 1, 0);
 637
 638         for (;;)
 639         {
 640                 usb_poll();
 641                 WDT_HIT();
 642
 643                 // Was our button held down or pressed?
 644                 int button_pressed = BUTTON_HELD(1000);
 645                 SpinDelay(300);
 646
 647                 // Button was held for a second, begin recording
 648                 if (button_pressed > 0 && cardRead == 0)
 649                 {
 650                         LEDsoff();
 651                         LED(selected + 1, 0);
 652                         LED(LED_RED2, 0);
 653
 654                         // record
 655                         DbpString("Starting recording");
 656
 657                         // wait for button to be released
 658                         while(BUTTON_PRESS())
 659                                 WDT_HIT();
 660
 661                         /* need this delay to prevent catching some weird data */
 662                         SpinDelay(500);
 663
 664                         CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
 665                         Dbprintf("Recorded %x %x%08x", selected, high[selected], low[selected]);
 666
 667                         LEDsoff();
 668                         LED(selected + 1, 0);
 669                         // Finished recording
 670
 671                         // If we were previously playing, set playing off
 672                         // so next button push begins playing what we recorded
 673                         playing = 0;
 674
 675                         cardRead = 1;
 676
 677                 }
 678
 679                 else if (button_pressed > 0 && cardRead == 1)
 680                 {
 681                                         LEDsoff();
 682                                         LED(selected + 1, 0);
 683                                         LED(LED_ORANGE, 0);
 684
 685                                         // record
 686                                         Dbprintf("Cloning %x %x%08x", selected, high[selected], low[selected]);
 687
 688                                         // wait for button to be released
 689                                         while(BUTTON_PRESS())
 690                                                 WDT_HIT();
 691
 692                                         /* need this delay to prevent catching some weird data */
 693                                         SpinDelay(500);
 694
 695                                         CopyHIDtoT55x7(0, high[selected], low[selected], 0);
 696                                         Dbprintf("Cloned %x %x%08x", selected, high[selected], low[selected]);
 697
 698                                         LEDsoff();
 699                                         LED(selected + 1, 0);
 700                                         // Finished recording
 701
 702                                         // If we were previously playing, set playing off
 703                                         // so next button push begins playing what we recorded
 704                                         playing = 0;
 705
 706                                         cardRead = 0;
 707
 708                 }
 709
 710                 // Change where to record (or begin playing)
 711                 else if (button_pressed)
 712                 {
 713                         // Next option if we were previously playing
 714                         if (playing)
 715                                 selected = (selected + 1) % OPTS;
 716                         playing = !playing;
 717
 718                         LEDsoff();
 719                         LED(selected + 1, 0);
 720
 721                         // Begin transmitting
 722                         if (playing)
 723                         {
 724                                 LED(LED_GREEN, 0);
 725                                 DbpString("Playing");
 726                                 // wait for button to be released
 727                                 while(BUTTON_PRESS())
 728                                         WDT_HIT();
 729                                 Dbprintf("%x %x%08x", selected, high[selected], low[selected]);
 730                                 CmdHIDsimTAG(high[selected], low[selected], 0);
 731                                 DbpString("Done playing");
 732                                 if (BUTTON_HELD(1000) > 0)
 733                                         {
 734                                         DbpString("Exiting");
 735                                         LEDsoff();
 736                                         return;
 737                                         }
 738
 739                                 /* We pressed a button so ignore it here with a delay */
 740                                 SpinDelay(300);
 741
 742                                 // when done, we're done playing, move to next option
 743                                 selected = (selected + 1) % OPTS;
 744                                 playing = !playing;
 745                                 LEDsoff();
 746                                 LED(selected + 1, 0);
 747                         }
 748                         else
 749                                 while(BUTTON_PRESS())
 750                                         WDT_HIT();
 751                 }
 752         }
 753 }
 754
 755 #endif
 756 /*
 757 OBJECTIVE
 758 Listen and detect an external reader. Determine the best location
 759 for the antenna.
 760
 761 INSTRUCTIONS:
 762 Inside the ListenReaderField() function, there is two mode.
 763 By default, when you call the function, you will enter mode 1.
 764 If you press the PM3 button one time, you will enter mode 2.
 765 If you press the PM3 button a second time, you will exit the function.
 766
 767 DESCRIPTION OF MODE 1:
 768 This mode just listens for an external reader field and lights up green
 769 for HF and/or red for LF. This is the original mode of the detectreader
 770 function.
 771
 772 DESCRIPTION OF MODE 2:
 773 This mode will visually represent, using the LEDs, the actual strength of the
 774 current compared to the maximum current detected. Basically, once you know
 775 what kind of external reader is present, it will help you spot the best location to place
 776 your antenna. You will probably not get some good results if there is a LF and a HF reader
 777 at the same place! :-)
 778
 779 LIGHT SCHEME USED:
 780 */
 781 static const char LIGHT_SCHEME[] = {
 782                 0x0, /* ----     | No field detected */
 783                 0x1, /* X---     | 14% of maximum current detected */
 784                 0x2, /* -X--     | 29% of maximum current detected */
 785                 0x4, /* --X-     | 43% of maximum current detected */
 786                 0x8, /* ---X     | 57% of maximum current detected */
 787                 0xC, /* --XX     | 71% of maximum current detected */
 788                 0xE, /* -XXX     | 86% of maximum current detected */
 789                 0xF, /* XXXX     | 100% of maximum current detected */
 790 };
 791 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
 792
 793 void ListenReaderField(int limit)
 794 {
 795         int lf_av, lf_av_new, lf_baseline= 0, lf_max;
 796         int hf_av, hf_av_new,  hf_baseline= 0, hf_max;
 797         int mode=1, display_val, display_max, i;
 798
 799 #define LF_ONLY                                         1
 800 #define HF_ONLY                                         2
 801 #define REPORT_CHANGE                           10    // report new values only if they have changed at least by REPORT_CHANGE
 802
 803
 804         // switch off FPGA - we don't want to measure our own signal
 805         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 806         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 807
 808         LEDsoff();
 809
 810         lf_av = lf_max = AvgAdc(ADC_CHAN_LF);
 811
 812         if(limit != HF_ONLY) {
 813                 Dbprintf("LF 125/134kHz Baseline: %dmV", (MAX_ADC_LF_VOLTAGE * lf_av) >> 10);
 814                 lf_baseline = lf_av;
 815         }
 816
 817         hf_av = hf_max = AvgAdc(ADC_CHAN_HF);
 818
 819         if (limit != LF_ONLY) {
 820                 Dbprintf("HF 13.56MHz Baseline: %dmV", (MAX_ADC_HF_VOLTAGE * hf_av) >> 10);
 821                 hf_baseline = hf_av;
 822         }
 823
 824         for(;;) {
 825                 if (BUTTON_PRESS()) {
 826                         SpinDelay(500);
 827                         switch (mode) {
 828                                 case 1:
 829                                         mode=2;
 830                                         DbpString("Signal Strength Mode");
 831                                         break;
 832                                 case 2:
 833                                 default:
 834                                         DbpString("Stopped");
 835                                         LEDsoff();
 836                                         return;
 837                                         break;
 838                         }
 839                 }
 840                 WDT_HIT();
 841
 842                 if (limit != HF_ONLY) {
 843                         if(mode == 1) {
 844                                 if (abs(lf_av - lf_baseline) > REPORT_CHANGE)
 845                                         LED_D_ON();
 846                                 else
 847                                         LED_D_OFF();
 848                         }
 849
 850                         lf_av_new = AvgAdc(ADC_CHAN_LF);
 851                         // see if there's a significant change
 852                         if(abs(lf_av - lf_av_new) > REPORT_CHANGE) {
 853                                 Dbprintf("LF 125/134kHz Field Change: %5dmV", (MAX_ADC_LF_VOLTAGE * lf_av_new) >> 10);
 854                                 lf_av = lf_av_new;
 855                                 if (lf_av > lf_max)
 856                                         lf_max = lf_av;
 857                         }
 858                 }
 859
 860                 if (limit != LF_ONLY) {
 861                         if (mode == 1){
 862                                 if (abs(hf_av - hf_baseline) > REPORT_CHANGE)
 863                                         LED_B_ON();
 864                                 else
 865                                         LED_B_OFF();
 866                         }
 867
 868                         hf_av_new = AvgAdc(ADC_CHAN_HF);
 869                         // see if there's a significant change
 870                         if(abs(hf_av - hf_av_new) > REPORT_CHANGE) {
 871                                 Dbprintf("HF 13.56MHz Field Change: %5dmV", (MAX_ADC_HF_VOLTAGE * hf_av_new) >> 10);
 872                                 hf_av = hf_av_new;
 873                                 if (hf_av > hf_max)
 874                                         hf_max = hf_av;
 875                         }
 876                 }
 877
 878                 if(mode == 2) {
 879                         if (limit == LF_ONLY) {
 880                                 display_val = lf_av;
 881                                 display_max = lf_max;
 882                         } else if (limit == HF_ONLY) {
 883                                 display_val = hf_av;
 884                                 display_max = hf_max;
 885                         } else { /* Pick one at random */
 886                                 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
 887                                         display_val = hf_av;
 888                                         display_max = hf_max;
 889                                 } else {
 890                                         display_val = lf_av;
 891                                         display_max = lf_max;
 892                                 }
 893                         }
 894                         for (i=0; i<LIGHT_LEN; i++) {
 895                                 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
 896                                         if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
 897                                         if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
 898                                         if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
 899                                         if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
 900                                         break;
 901                                 }
 902                         }
 903                 }
 904         }
 905 }
 906
 907 void UsbPacketReceived(uint8_t *packet, int len)
 908 {
 909         UsbCommand *c = (UsbCommand *)packet;
 910
 911 //  Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
 912
 913         switch(c->cmd) {
 914 #ifdef WITH_LF
 915                 case CMD_SET_LF_SAMPLING_CONFIG:
 916                         setSamplingConfig((sample_config *) c->d.asBytes);
 917                         break;
 918                 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
 919                         cmd_send(CMD_ACK,SampleLF(c->arg[0]),0,0,0,0);
 920                         break;
 921                 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
 922                         ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
 923                         break;
 924                 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
 925                         cmd_send(CMD_ACK,SnoopLF(),0,0,0,0);
 926                         break;
 927                 case CMD_HID_DEMOD_FSK:
 928                         CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
 929                         break;
 930                 case CMD_HID_SIM_TAG:
 931                         CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
 932                         break;
 933                 case CMD_FSK_SIM_TAG:
 934                         CmdFSKsimTAG(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 935                         break;
 936                 case CMD_ASK_SIM_TAG:
 937                         CmdASKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 938                         break;
 939                 case CMD_PSK_SIM_TAG:
 940                         CmdPSKsimTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 941                         break;
 942                 case CMD_HID_CLONE_TAG:
 943                         CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 944                         break;
 945                 case CMD_IO_DEMOD_FSK:
 946                         CmdIOdemodFSK(c->arg[0], 0, 0, 1);
 947                         break;
 948                 case CMD_IO_CLONE_TAG:
 949                         CopyIOtoT55x7(c->arg[0], c->arg[1]);
 950                         break;
 951                 case CMD_EM410X_DEMOD:
 952                         CmdEM410xdemod(c->arg[0], 0, 0, 1);
 953                         break;
 954                 case CMD_EM410X_WRITE_TAG:
 955                         WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
 956                         break;
 957                 case CMD_READ_TI_TYPE:
 958                         ReadTItag();
 959                         break;
 960                 case CMD_WRITE_TI_TYPE:
 961                         WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
 962                         break;
 963                 case CMD_SIMULATE_TAG_125K:
 964                         LED_A_ON();
 965                         SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
 966                         LED_A_OFF();
 967                         break;
 968                 case CMD_LF_SIMULATE_BIDIR:
 969                         SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
 970                         break;
 971                 case CMD_INDALA_CLONE_TAG:
 972                         CopyIndala64toT55x7(c->arg[0], c->arg[1]);
 973                         break;
 974                 case CMD_INDALA_CLONE_TAG_L:
 975                         CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
 976                         break;
 977                 case CMD_T55XX_READ_BLOCK:
 978                         T55xxReadBlock(c->arg[0], c->arg[1], c->arg[2]);
 979                         break;
 980                 case CMD_T55XX_WRITE_BLOCK:
 981                         T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 982                         break;
 983                 case CMD_T55XX_WAKEUP:
 984                         T55xxWakeUp(c->arg[0]);
 985                         break;
 986                 case CMD_T55XX_RESET_READ:
 987                         T55xxResetRead();
 988                         break;
 989                 case CMD_PCF7931_READ:
 990                         ReadPCF7931();
 991                         break;
 992                 case CMD_PCF7931_WRITE:
 993                         WritePCF7931(c->d.asBytes[0],c->d.asBytes[1],c->d.asBytes[2],c->d.asBytes[3],c->d.asBytes[4],c->d.asBytes[5],c->d.asBytes[6], c->d.asBytes[9], c->d.asBytes[7]-128,c->d.asBytes[8]-128, c->arg[0], c->arg[1], c->arg[2]);
 994                         break;
 995                 case CMD_EM4X_READ_WORD:
 996                         EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
 997                         break;
 998                 case CMD_EM4X_WRITE_WORD:
 999                         EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
1000                         break;
1001                 case CMD_AWID_DEMOD_FSK: // Set realtime AWID demodulation
1002                         CmdAWIDdemodFSK(c->arg[0], 0, 0, 1);
1003                         break;
1004                 case CMD_VIKING_CLONE_TAG:
1005                         CopyVikingtoT55xx(c->arg[0], c->arg[1], c->arg[2]);
1006                         break;
1007 #endif
1008
1009 #ifdef WITH_HITAG
1010                 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
1011                         SnoopHitag(c->arg[0]);
1012                         break;
1013                 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
1014                         SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
1015                         break;
1016                 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
1017                         ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
1018                         break;
1019 #endif
1020
1021 #ifdef WITH_ISO15693
1022                 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
1023                         AcquireRawAdcSamplesIso15693();
1024                         break;
1025                 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
1026                         RecordRawAdcSamplesIso15693();
1027                         break;
1028
1029                 case CMD_ISO_15693_COMMAND:
1030                         DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1031                         break;
1032
1033                 case CMD_ISO_15693_FIND_AFI:
1034                         BruteforceIso15693Afi(c->arg[0]);
1035                         break;
1036
1037                 case CMD_ISO_15693_DEBUG:
1038                         SetDebugIso15693(c->arg[0]);
1039                         break;
1040
1041                 case CMD_READER_ISO_15693:
1042                         ReaderIso15693(c->arg[0]);
1043                         break;
1044                 case CMD_SIMTAG_ISO_15693:
1045                         SimTagIso15693(c->arg[0], c->d.asBytes);
1046                         break;
1047 #endif
1048
1049 #ifdef WITH_LEGICRF
1050                 case CMD_SIMULATE_TAG_LEGIC_RF:
1051                         LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
1052                         break;
1053
1054                 case CMD_WRITER_LEGIC_RF:
1055                         LegicRfWriter(c->arg[1], c->arg[0]);
1056                         break;
1057
1058                 case CMD_READER_LEGIC_RF:
1059                         LegicRfReader(c->arg[0], c->arg[1]);
1060                         break;
1061 #endif
1062
1063 #ifdef WITH_ISO14443b
1064                 case CMD_READ_SRI512_TAG:
1065                         ReadSTMemoryIso14443b(0x0F);
1066                         break;
1067                 case CMD_READ_SRIX4K_TAG:
1068                         ReadSTMemoryIso14443b(0x7F);
1069                         break;
1070                 case CMD_SNOOP_ISO_14443B:
1071                         SnoopIso14443b();
1072                         break;
1073                 case CMD_SIMULATE_TAG_ISO_14443B:
1074                         SimulateIso14443bTag();
1075                         break;
1076                 case CMD_ISO_14443B_COMMAND:
1077                         SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
1078                         break;
1079 #endif
1080
1081 #ifdef WITH_ISO14443a
1082                 case CMD_SNOOP_ISO_14443a:
1083                         SnoopIso14443a(c->arg[0]);
1084                         break;
1085                 case CMD_READER_ISO_14443a:
1086                         ReaderIso14443a(c);
1087                         break;
1088                 case CMD_SIMULATE_TAG_ISO_14443a:
1089                         SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);  // ## Simulate iso14443a tag - pass tag type & UID
1090                         break;
1091
1092                 case CMD_EPA_PACE_COLLECT_NONCE:
1093                         EPA_PACE_Collect_Nonce(c);
1094                         break;
1095                 case CMD_EPA_PACE_REPLAY:
1096                         EPA_PACE_Replay(c);
1097                         break;
1098
1099                 case CMD_READER_MIFARE:
1100                         ReaderMifare(c->arg[0]);
1101                         break;
1102                 case CMD_MIFARE_READBL:
1103                         MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1104                         break;
1105                 case CMD_MIFAREU_READBL:
1106                         MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
1107                         break;
1108                 case CMD_MIFAREUC_AUTH:
1109                         MifareUC_Auth(c->arg[0],c->d.asBytes);
1110                         break;
1111                 case CMD_MIFAREU_READCARD:
1112                         MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1113                         break;
1114                 case CMD_MIFAREUC_SETPWD:
1115                         MifareUSetPwd(c->arg[0], c->d.asBytes);
1116                         break;
1117                 case CMD_MIFARE_READSC:
1118                         MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1119                         break;
1120                 case CMD_MIFARE_WRITEBL:
1121                         MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1122                         break;
1123                 //case CMD_MIFAREU_WRITEBL_COMPAT:
1124                         //MifareUWriteBlockCompat(c->arg[0], c->d.asBytes);
1125                         //break;
1126                 case CMD_MIFAREU_WRITEBL:
1127                         MifareUWriteBlock(c->arg[0], c->arg[1], c->d.asBytes);
1128                         break;
1129                 case CMD_MIFARE_NESTED:
1130                         MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1131                         break;
1132                 case CMD_MIFARE_CHKKEYS:
1133                         MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1134                         break;
1135                 case CMD_SIMULATE_MIFARE_CARD:
1136                         Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1137                         break;
1138
1139                 // emulator
1140                 case CMD_MIFARE_SET_DBGMODE:
1141                         MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1142                         break;
1143                 case CMD_MIFARE_EML_MEMCLR:
1144                         MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1145                         break;
1146                 case CMD_MIFARE_EML_MEMSET:
1147                         MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1148                         break;
1149                 case CMD_MIFARE_EML_MEMGET:
1150                         MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1151                         break;
1152                 case CMD_MIFARE_EML_CARDLOAD:
1153                         MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1154                         break;
1155
1156                 // Work with "magic Chinese" card
1157                 case CMD_MIFARE_CSETBLOCK:
1158                         MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1159                         break;
1160                 case CMD_MIFARE_CGETBLOCK:
1161                         MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1162                         break;
1163                 case CMD_MIFARE_CIDENT:
1164                         MifareCIdent();
1165                         break;
1166
1167                 // mifare sniffer
1168                 case CMD_MIFARE_SNIFFER:
1169                         SniffMifare(c->arg[0]);
1170                         break;
1171
1172 #endif
1173
1174 #ifdef WITH_ICLASS
1175                 // Makes use of ISO14443a FPGA Firmware
1176                 case CMD_SNOOP_ICLASS:
1177                         SnoopIClass();
1178                         break;
1179                 case CMD_SIMULATE_TAG_ICLASS:
1180                         SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
1181                         break;
1182                 case CMD_READER_ICLASS:
1183                         ReaderIClass(c->arg[0]);
1184                         break;
1185                 case CMD_READER_ICLASS_REPLAY:
1186                         ReaderIClass_Replay(c->arg[0], c->d.asBytes);
1187                         break;
1188                 case CMD_ICLASS_EML_MEMSET:
1189                         emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
1190                         break;
1191                 case CMD_ICLASS_WRITEBLOCK:
1192                         iClass_WriteBlock(c->arg[0], c->d.asBytes);
1193                         break;
1194                 case CMD_ICLASS_READCHECK:  // auth step 1
1195                         iClass_ReadCheck(c->arg[0], c->arg[1]);
1196                         break;
1197                 case CMD_ICLASS_READBLOCK:
1198                         iClass_ReadBlk(c->arg[0]);
1199                         break;
1200                 case CMD_ICLASS_AUTHENTICATION: //check
1201                         iClass_Authentication(c->d.asBytes);
1202                         break;
1203                 case CMD_ICLASS_DUMP:
1204                         iClass_Dump(c->arg[0], c->arg[1]);
1205                         break;
1206                 case CMD_ICLASS_CLONE:
1207                         iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
1208                         break;
1209 #endif
1210 #ifdef WITH_HFSNOOP
1211                 case CMD_HF_SNIFFER:
1212                         HfSnoop(c->arg[0], c->arg[1]);
1213                         break;
1214 #endif
1215
1216                 case CMD_BUFF_CLEAR:
1217                         BigBuf_Clear();
1218                         break;
1219
1220                 case CMD_MEASURE_ANTENNA_TUNING:
1221                         MeasureAntennaTuning();
1222                         break;
1223
1224                 case CMD_MEASURE_ANTENNA_TUNING_HF:
1225                         MeasureAntennaTuningHf();
1226                         break;
1227
1228                 case CMD_LISTEN_READER_FIELD:
1229                         ListenReaderField(c->arg[0]);
1230                         break;
1231
1232                 case CMD_FPGA_MAJOR_MODE_OFF:           // ## FPGA Control
1233                         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1234                         SpinDelay(200);
1235                         LED_D_OFF(); // LED D indicates field ON or OFF
1236                         break;
1237
1238                 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
1239
1240                         LED_B_ON();
1241                         uint8_t *BigBuf = BigBuf_get_addr();
1242                         for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
1243                                 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
1244                                 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,BigBuf_get_traceLen(),BigBuf+c->arg[0]+i,len);
1245                         }
1246                         // Trigger a finish downloading signal with an ACK frame
1247                         cmd_send(CMD_ACK,1,0,BigBuf_get_traceLen(),getSamplingConfig(),sizeof(sample_config));
1248                         LED_B_OFF();
1249                         break;
1250
1251                 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
1252                         uint8_t *b = BigBuf_get_addr();
1253                         memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
1254                         cmd_send(CMD_ACK,0,0,0,0,0);
1255                         break;
1256                 }
1257                 case CMD_READ_MEM:
1258                         ReadMem(c->arg[0]);
1259                         break;
1260
1261                 case CMD_SET_LF_DIVISOR:
1262                         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1263                         FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
1264                         break;
1265
1266                 case CMD_SET_ADC_MUX:
1267                         switch(c->arg[0]) {
1268                                 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
1269                                 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
1270                                 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
1271                                 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
1272                         }
1273                         break;
1274
1275                 case CMD_VERSION:
1276                         SendVersion();
1277                         break;
1278                 case CMD_STATUS:
1279                         SendStatus();
1280                         break;
1281                 case CMD_PING:
1282                         cmd_send(CMD_ACK,0,0,0,0,0);
1283                         break;
1284 #ifdef WITH_LCD
1285                 case CMD_LCD_RESET:
1286                         LCDReset();
1287                         break;
1288                 case CMD_LCD:
1289                         LCDSend(c->arg[0]);
1290                         break;
1291 #endif
1292                 case CMD_SETUP_WRITE:
1293                 case CMD_FINISH_WRITE:
1294                 case CMD_HARDWARE_RESET:
1295                         usb_disable();
1296                         SpinDelay(1000);
1297                         SpinDelay(1000);
1298                         AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1299                         for(;;) {
1300                                 // We're going to reset, and the bootrom will take control.
1301                         }
1302                         break;
1303
1304                 case CMD_START_FLASH:
1305                         if(common_area.flags.bootrom_present) {
1306                                 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
1307                         }
1308                         usb_disable();
1309                         AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
1310                         for(;;);
1311                         break;
1312
1313                 case CMD_DEVICE_INFO: {
1314                         uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
1315                         if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
1316                         cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
1317                         break;
1318                 }
1319                 default:
1320                         Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
1321                         break;
1322         }
1323 }
1324
1325 void  __attribute__((noreturn)) AppMain(void)
1326 {
1327         SpinDelay(100);
1328         clear_trace();
1329         if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
1330                 /* Initialize common area */
1331                 memset(&common_area, 0, sizeof(common_area));
1332                 common_area.magic = COMMON_AREA_MAGIC;
1333                 common_area.version = 1;
1334         }
1335         common_area.flags.osimage_present = 1;
1336
1337         LED_D_OFF();
1338         LED_C_OFF();
1339         LED_B_OFF();
1340         LED_A_OFF();
1341
1342         // Init USB device
1343   usb_enable();
1344
1345         // The FPGA gets its clock from us from PCK0 output, so set that up.
1346         AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1347         AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1348         AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1349         // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1350         AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1351                 AT91C_PMC_PRES_CLK_4; //  4 for 24Mhz pck0, 2 for 48 MHZ pck0
1352         AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1353
1354         // Reset SPI
1355         AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1356         // Reset SSC
1357         AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1358
1359         // Load the FPGA image, which we have stored in our flash.
1360         // (the HF version by default)
1361         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1362
1363         StartTickCount();
1364
1365 #ifdef WITH_LCD
1366         LCDInit();
1367 #endif
1368
1369   byte_t rx[sizeof(UsbCommand)];
1370         size_t rx_len;
1371
1372         for(;;) {
1373     if (usb_poll()) {
1374       rx_len = usb_read(rx,sizeof(UsbCommand));
1375       if (rx_len) {
1376         UsbPacketReceived(rx,rx_len);
1377       }
1378     }
1379                 WDT_HIT();
1380
1381 #ifdef WITH_LF
1382 #ifndef WITH_ISO14443a_StandAlone
1383                 if (BUTTON_HELD(1000) > 0)
1384                         SamyRun();
1385 #endif
1386 #endif
1387 #ifdef WITH_ISO14443a
1388 #ifdef WITH_ISO14443a_StandAlone
1389                 if (BUTTON_HELD(1000) > 0)
1390                         StandAloneMode14a();
1391 #endif
1392 #endif
1393         }
1394 }