armsrc/appmain.c

   1 //-----------------------------------------------------------------------------
   2 // Jonathan Westhues, Mar 2006
   3 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // The main application code. This is the first thing called after start.c
  10 // executes.
  11 //-----------------------------------------------------------------------------
  12
  13 #include "usb_cdc.h"
  14 #include "cmd.h"
  15
  16 #include "proxmark3.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "printf.h"
  20 #include "string.h"
  21
  22 #include <stdarg.h>
  23
  24 #include "legicrf.h"
  25 #include <hitag2.h>
  26
  27 #ifdef WITH_LCD
  28  #include "LCD.h"
  29 #endif
  30
  31 #define abs(x) ( ((x)<0) ? -(x) : (x) )
  32
  33 //=============================================================================
  34 // A buffer where we can queue things up to be sent through the FPGA, for
  35 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
  36 // is the order in which they go out on the wire.
  37 //=============================================================================
  38
  39 #define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2)  // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
  40 uint8_t ToSend[TOSEND_BUFFER_SIZE];
  41 int ToSendMax;
  42 static int ToSendBit;
  43 struct common_area common_area __attribute__((section(".commonarea")));
  44
  45 void BufferClear(void)
  46 {
  47         memset(BigBuf,0,sizeof(BigBuf));
  48         Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
  49 }
  50
  51 void ToSendReset(void)
  52 {
  53         ToSendMax = -1;
  54         ToSendBit = 8;
  55 }
  56
  57 void ToSendStuffBit(int b)
  58 {
  59         if(ToSendBit >= 8) {
  60                 ToSendMax++;
  61                 ToSend[ToSendMax] = 0;
  62                 ToSendBit = 0;
  63         }
  64
  65         if(b) {
  66                 ToSend[ToSendMax] |= (1 << (7 - ToSendBit));
  67         }
  68
  69         ToSendBit++;
  70
  71         if(ToSendMax >= sizeof(ToSend)) {
  72                 ToSendBit = 0;
  73                 DbpString("ToSendStuffBit overflowed!");
  74         }
  75 }
  76
  77 //=============================================================================
  78 // Debug print functions, to go out over USB, to the usual PC-side client.
  79 //=============================================================================
  80
  81 void DbpString(char *str)
  82 {
  83   byte_t len = strlen(str);
  84   cmd_send(CMD_DEBUG_PRINT_STRING,len,0,0,(byte_t*)str,len);
  85 }
  86
  87 #if 0
  88 void DbpIntegers(int x1, int x2, int x3)
  89 {
  90   cmd_send(CMD_DEBUG_PRINT_INTEGERS,x1,x2,x3,0,0);
  91 }
  92 #endif
  93
  94 void Dbprintf(const char *fmt, ...) {
  95 // should probably limit size here; oh well, let's just use a big buffer
  96         char output_string[128];
  97         va_list ap;
  98
  99         va_start(ap, fmt);
 100         kvsprintf(fmt, output_string, 10, ap);
 101         va_end(ap);
 102
 103         DbpString(output_string);
 104 }
 105
 106 // prints HEX & ASCII
 107 void Dbhexdump(int len, uint8_t *d, bool bAsci) {
 108         int l=0,i;
 109         char ascii[9];
 110
 111         while (len>0) {
 112                 if (len>8) l=8;
 113                 else l=len;
 114
 115                 memcpy(ascii,d,l);
 116                 ascii[l]=0;
 117
 118                 // filter safe ascii
 119                 for (i=0;i<l;i++)
 120                         if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
 121
 122                 if (bAsci) {
 123                         Dbprintf("%-8s %*D",ascii,l,d," ");
 124                 } else {
 125                         Dbprintf("%*D",l,d," ");
 126                 }
 127
 128                 len-=8;
 129                 d+=8;
 130         }
 131 }
 132
 133 //-----------------------------------------------------------------------------
 134 // Read an ADC channel and block till it completes, then return the result
 135 // in ADC units (0 to 1023). Also a routine to average 32 samples and
 136 // return that.
 137 //-----------------------------------------------------------------------------
 138 static int ReadAdc(int ch)
 139 {
 140         uint32_t d;
 141
 142         AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
 143         AT91C_BASE_ADC->ADC_MR =
 144                 ADC_MODE_PRESCALE(32) |
 145                 ADC_MODE_STARTUP_TIME(16) |
 146                 ADC_MODE_SAMPLE_HOLD_TIME(8);
 147         AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ch);
 148
 149         AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
 150         while(!(AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ch)))
 151                 ;
 152         d = AT91C_BASE_ADC->ADC_CDR[ch];
 153
 154         return d;
 155 }
 156
 157 int AvgAdc(int ch) // was static - merlok
 158 {
 159         int i;
 160         int a = 0;
 161
 162         for(i = 0; i < 32; i++) {
 163                 a += ReadAdc(ch);
 164         }
 165
 166         return (a + 15) >> 5;
 167 }
 168
 169 void MeasureAntennaTuning(void)
 170 {
 171         uint8_t LF_Results[256];
 172         int i, adcval = 0, peak = 0, peakv = 0, peakf = 0; //ptr = 0
 173         int vLf125 = 0, vLf134 = 0, vHf = 0;    // in mV
 174
 175         LED_B_ON();
 176
 177 /*
 178  * Sweeps the useful LF range of the proxmark from
 179  * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
 180  * read the voltage in the antenna, the result left
 181  * in the buffer is a graph which should clearly show
 182  * the resonating frequency of your LF antenna
 183  * ( hopefully around 95 if it is tuned to 125kHz!)
 184  */
 185
 186         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 187         FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
 188         for (i=255; i>=19; i--) {
 189     WDT_HIT();
 190                 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i);
 191                 SpinDelay(20);
 192                 // Vref = 3.3V, and a 10000:240 voltage divider on the input
 193                 // can measure voltages up to 137500 mV
 194                 adcval = ((137500 * AvgAdc(ADC_CHAN_LF)) >> 10);
 195                 if (i==95)      vLf125 = adcval; // voltage at 125Khz
 196                 if (i==89)      vLf134 = adcval; // voltage at 134Khz
 197
 198                 LF_Results[i] = adcval>>8; // scale int to fit in byte for graphing purposes
 199                 if(LF_Results[i] > peak) {
 200                         peakv = adcval;
 201                         peak = LF_Results[i];
 202                         peakf = i;
 203                         //ptr = i;
 204                 }
 205         }
 206
 207         for (i=18; i >= 0; i--) LF_Results[i] = 0;
 208
 209         LED_A_ON();
 210         // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
 211         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 212         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 213         SpinDelay(20);
 214         // Vref = 3300mV, and an 10:1 voltage divider on the input
 215         // can measure voltages up to 33000 mV
 216         vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
 217
 218         cmd_send(CMD_MEASURED_ANTENNA_TUNING,vLf125|(vLf134<<16),vHf,peakf|(peakv<<16),LF_Results,256);
 219         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 220         LED_A_OFF();
 221         LED_B_OFF();
 222         return;
 223 }
 224
 225 void MeasureAntennaTuningHf(void)
 226 {
 227         int vHf = 0;    // in mV
 228
 229         DbpString("Measuring HF antenna, press button to exit");
 230
 231         for (;;) {
 232                 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
 233                 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 234                 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 235                 SpinDelay(20);
 236                 // Vref = 3300mV, and an 10:1 voltage divider on the input
 237                 // can measure voltages up to 33000 mV
 238                 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
 239
 240                 Dbprintf("%d mV",vHf);
 241                 if (BUTTON_PRESS()) break;
 242         }
 243         DbpString("cancelled");
 244 }
 245
 246
 247 void SimulateTagHfListen(void)
 248 {
 249         uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
 250         uint8_t v = 0;
 251         int i;
 252         int p = 0;
 253
 254         // We're using this mode just so that I can test it out; the simulated
 255         // tag mode would work just as well and be simpler.
 256         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 257         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
 258
 259         // We need to listen to the high-frequency, peak-detected path.
 260         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 261
 262         FpgaSetupSsc();
 263
 264         i = 0;
 265         for(;;) {
 266                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 267                         AT91C_BASE_SSC->SSC_THR = 0xff;
 268                 }
 269                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 270                         uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 271
 272                         v <<= 1;
 273                         if(r & 1) {
 274                                 v |= 1;
 275                         }
 276                         p++;
 277
 278                         if(p >= 8) {
 279                                 dest[i] = v;
 280                                 v = 0;
 281                                 p = 0;
 282                                 i++;
 283
 284                                 if(i >= FREE_BUFFER_SIZE) {
 285                                         break;
 286                                 }
 287                         }
 288                 }
 289         }
 290         DbpString("simulate tag (now type bitsamples)");
 291 }
 292
 293 void ReadMem(int addr)
 294 {
 295         const uint8_t *data = ((uint8_t *)addr);
 296
 297         Dbprintf("%x: %02x %02x %02x %02x %02x %02x %02x %02x",
 298                 addr, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
 299 }
 300
 301 /* osimage version information is linked in */
 302 extern struct version_information version_information;
 303 /* bootrom version information is pointed to from _bootphase1_version_pointer */
 304 extern char *_bootphase1_version_pointer, _flash_start, _flash_end;
 305 void SendVersion(void)
 306 {
 307         char temp[512]; /* Limited data payload in USB packets */
 308         DbpString("Prox/RFID mark3 RFID instrument");
 309
 310         /* Try to find the bootrom version information. Expect to find a pointer at
 311          * symbol _bootphase1_version_pointer, perform slight sanity checks on the
 312          * pointer, then use it.
 313          */
 314         char *bootrom_version = *(char**)&_bootphase1_version_pointer;
 315         if( bootrom_version < &_flash_start || bootrom_version >= &_flash_end ) {
 316                 DbpString("bootrom version information appears invalid");
 317         } else {
 318                 FormatVersionInformation(temp, sizeof(temp), "bootrom: ", bootrom_version);
 319                 DbpString(temp);
 320         }
 321
 322         FormatVersionInformation(temp, sizeof(temp), "os: ", &version_information);
 323         DbpString(temp);
 324
 325         FpgaGatherVersion(temp, sizeof(temp));
 326         DbpString(temp);
 327         // Send Chip ID
 328         cmd_send(CMD_ACK,*(AT91C_DBGU_CIDR),0,0,NULL,0);
 329 }
 330
 331 #ifdef WITH_LF
 332 // samy's sniff and repeat routine
 333 void SamyRun()
 334 {
 335         DbpString("Stand-alone mode! No PC necessary.");
 336         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 337
 338         // 3 possible options? no just 2 for now
 339 #define OPTS 2
 340
 341         int high[OPTS], low[OPTS];
 342
 343         // Oooh pretty -- notify user we're in elite samy mode now
 344         LED(LED_RED,    200);
 345         LED(LED_ORANGE, 200);
 346         LED(LED_GREEN,  200);
 347         LED(LED_ORANGE, 200);
 348         LED(LED_RED,    200);
 349         LED(LED_ORANGE, 200);
 350         LED(LED_GREEN,  200);
 351         LED(LED_ORANGE, 200);
 352         LED(LED_RED,    200);
 353
 354         int selected = 0;
 355         int playing = 0;
 356         int cardRead = 0;
 357
 358         // Turn on selected LED
 359         LED(selected + 1, 0);
 360
 361         for (;;)
 362         {
 363                 usb_poll();
 364     WDT_HIT();
 365
 366                 // Was our button held down or pressed?
 367                 int button_pressed = BUTTON_HELD(1000);
 368                 SpinDelay(300);
 369
 370                 // Button was held for a second, begin recording
 371                 if (button_pressed > 0 && cardRead == 0)
 372                 {
 373                         LEDsoff();
 374                         LED(selected + 1, 0);
 375                         LED(LED_RED2, 0);
 376
 377                         // record
 378                         DbpString("Starting recording");
 379
 380                         // wait for button to be released
 381                         while(BUTTON_PRESS())
 382                                 WDT_HIT();
 383
 384                         /* need this delay to prevent catching some weird data */
 385                         SpinDelay(500);
 386
 387                         CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
 388                         Dbprintf("Recorded %x %x %x", selected, high[selected], low[selected]);
 389
 390                         LEDsoff();
 391                         LED(selected + 1, 0);
 392                         // Finished recording
 393
 394                         // If we were previously playing, set playing off
 395                         // so next button push begins playing what we recorded
 396                         playing = 0;
 397
 398                         cardRead = 1;
 399
 400                 }
 401
 402                 else if (button_pressed > 0 && cardRead == 1)
 403                 {
 404                                         LEDsoff();
 405                                         LED(selected + 1, 0);
 406                                         LED(LED_ORANGE, 0);
 407
 408                                         // record
 409                                         Dbprintf("Cloning %x %x %x", selected, high[selected], low[selected]);
 410
 411                                         // wait for button to be released
 412                                         while(BUTTON_PRESS())
 413                                                 WDT_HIT();
 414
 415                                         /* need this delay to prevent catching some weird data */
 416                                         SpinDelay(500);
 417
 418                                         CopyHIDtoT55x7(high[selected], low[selected], 0, 0);
 419                                         Dbprintf("Cloned %x %x %x", selected, high[selected], low[selected]);
 420
 421                                         LEDsoff();
 422                                         LED(selected + 1, 0);
 423                                         // Finished recording
 424
 425                                         // If we were previously playing, set playing off
 426                                         // so next button push begins playing what we recorded
 427                                         playing = 0;
 428
 429                                         cardRead = 0;
 430
 431                 }
 432
 433                 // Change where to record (or begin playing)
 434                 else if (button_pressed)
 435                 {
 436                         // Next option if we were previously playing
 437                         if (playing)
 438                                 selected = (selected + 1) % OPTS;
 439                         playing = !playing;
 440
 441                         LEDsoff();
 442                         LED(selected + 1, 0);
 443
 444                         // Begin transmitting
 445                         if (playing)
 446                         {
 447                                 LED(LED_GREEN, 0);
 448                                 DbpString("Playing");
 449                                 // wait for button to be released
 450                                 while(BUTTON_PRESS())
 451                                         WDT_HIT();
 452                                 Dbprintf("%x %x %x", selected, high[selected], low[selected]);
 453                                 CmdHIDsimTAG(high[selected], low[selected], 0);
 454                                 DbpString("Done playing");
 455                                 if (BUTTON_HELD(1000) > 0)
 456                                         {
 457                                         DbpString("Exiting");
 458                                         LEDsoff();
 459                                         return;
 460                                         }
 461
 462                                 /* We pressed a button so ignore it here with a delay */
 463                                 SpinDelay(300);
 464
 465                                 // when done, we're done playing, move to next option
 466                                 selected = (selected + 1) % OPTS;
 467                                 playing = !playing;
 468                                 LEDsoff();
 469                                 LED(selected + 1, 0);
 470                         }
 471                         else
 472                                 while(BUTTON_PRESS())
 473                                         WDT_HIT();
 474                 }
 475         }
 476 }
 477 #endif
 478
 479 /*
 480 OBJECTIVE
 481 Listen and detect an external reader. Determine the best location
 482 for the antenna.
 483
 484 INSTRUCTIONS:
 485 Inside the ListenReaderField() function, there is two mode.
 486 By default, when you call the function, you will enter mode 1.
 487 If you press the PM3 button one time, you will enter mode 2.
 488 If you press the PM3 button a second time, you will exit the function.
 489
 490 DESCRIPTION OF MODE 1:
 491 This mode just listens for an external reader field and lights up green
 492 for HF and/or red for LF. This is the original mode of the detectreader
 493 function.
 494
 495 DESCRIPTION OF MODE 2:
 496 This mode will visually represent, using the LEDs, the actual strength of the
 497 current compared to the maximum current detected. Basically, once you know
 498 what kind of external reader is present, it will help you spot the best location to place
 499 your antenna. You will probably not get some good results if there is a LF and a HF reader
 500 at the same place! :-)
 501
 502 LIGHT SCHEME USED:
 503 */
 504 static const char LIGHT_SCHEME[] = {
 505                 0x0, /* ----     | No field detected */
 506                 0x1, /* X---     | 14% of maximum current detected */
 507                 0x2, /* -X--     | 29% of maximum current detected */
 508                 0x4, /* --X-     | 43% of maximum current detected */
 509                 0x8, /* ---X     | 57% of maximum current detected */
 510                 0xC, /* --XX     | 71% of maximum current detected */
 511                 0xE, /* -XXX     | 86% of maximum current detected */
 512                 0xF, /* XXXX     | 100% of maximum current detected */
 513 };
 514 static const int LIGHT_LEN = sizeof(LIGHT_SCHEME)/sizeof(LIGHT_SCHEME[0]);
 515
 516 void ListenReaderField(int limit)
 517 {
 518         int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0, lf_max;
 519         int hf_av, hf_av_new,  hf_baseline= 0, hf_count= 0, hf_max;
 520         int mode=1, display_val, display_max, i;
 521
 522 #define LF_ONLY         1
 523 #define HF_ONLY         2
 524
 525         LEDsoff();
 526
 527         lf_av=lf_max=ReadAdc(ADC_CHAN_LF);
 528
 529         if(limit != HF_ONLY) {
 530                 Dbprintf("LF 125/134 Baseline: %d", lf_av);
 531                 lf_baseline = lf_av;
 532         }
 533
 534         hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
 535
 536         if (limit != LF_ONLY) {
 537                 Dbprintf("HF 13.56 Baseline: %d", hf_av);
 538                 hf_baseline = hf_av;
 539         }
 540
 541         for(;;) {
 542                 if (BUTTON_PRESS()) {
 543                         SpinDelay(500);
 544                         switch (mode) {
 545                                 case 1:
 546                                         mode=2;
 547                                         DbpString("Signal Strength Mode");
 548                                         break;
 549                                 case 2:
 550                                 default:
 551                                         DbpString("Stopped");
 552                                         LEDsoff();
 553                                         return;
 554                                         break;
 555                         }
 556                 }
 557                 WDT_HIT();
 558
 559                 if (limit != HF_ONLY) {
 560                         if(mode==1) {
 561                                 if (abs(lf_av - lf_baseline) > 10) LED_D_ON();
 562                                 else                               LED_D_OFF();
 563                         }
 564
 565                         ++lf_count;
 566                         lf_av_new= ReadAdc(ADC_CHAN_LF);
 567                         // see if there's a significant change
 568                         if(abs(lf_av - lf_av_new) > 10) {
 569                                 Dbprintf("LF 125/134 Field Change: %x %x %x", lf_av, lf_av_new, lf_count);
 570                                 lf_av = lf_av_new;
 571                                 if (lf_av > lf_max)
 572                                         lf_max = lf_av;
 573                                 lf_count= 0;
 574                         }
 575                 }
 576
 577                 if (limit != LF_ONLY) {
 578                         if (mode == 1){
 579                                 if (abs(hf_av - hf_baseline) > 10) LED_B_ON();
 580                                 else                               LED_B_OFF();
 581                         }
 582
 583                         ++hf_count;
 584                         hf_av_new= ReadAdc(ADC_CHAN_HF);
 585                         // see if there's a significant change
 586                         if(abs(hf_av - hf_av_new) > 10) {
 587                                 Dbprintf("HF 13.56 Field Change: %x %x %x", hf_av, hf_av_new, hf_count);
 588                                 hf_av = hf_av_new;
 589                                 if (hf_av > hf_max)
 590                                         hf_max = hf_av;
 591                                 hf_count= 0;
 592                         }
 593                 }
 594
 595                 if(mode == 2) {
 596                         if (limit == LF_ONLY) {
 597                                 display_val = lf_av;
 598                                 display_max = lf_max;
 599                         } else if (limit == HF_ONLY) {
 600                                 display_val = hf_av;
 601                                 display_max = hf_max;
 602                         } else { /* Pick one at random */
 603                                 if( (hf_max - hf_baseline) > (lf_max - lf_baseline) ) {
 604                                         display_val = hf_av;
 605                                         display_max = hf_max;
 606                                 } else {
 607                                         display_val = lf_av;
 608                                         display_max = lf_max;
 609                                 }
 610                         }
 611                         for (i=0; i<LIGHT_LEN; i++) {
 612                                 if (display_val >= ((display_max/LIGHT_LEN)*i) && display_val <= ((display_max/LIGHT_LEN)*(i+1))) {
 613                                         if (LIGHT_SCHEME[i] & 0x1) LED_C_ON(); else LED_C_OFF();
 614                                         if (LIGHT_SCHEME[i] & 0x2) LED_A_ON(); else LED_A_OFF();
 615                                         if (LIGHT_SCHEME[i] & 0x4) LED_B_ON(); else LED_B_OFF();
 616                                         if (LIGHT_SCHEME[i] & 0x8) LED_D_ON(); else LED_D_OFF();
 617                                         break;
 618                                 }
 619                         }
 620                 }
 621         }
 622 }
 623
 624 void UsbPacketReceived(uint8_t *packet, int len)
 625 {
 626         UsbCommand *c = (UsbCommand *)packet;
 627
 628 //  Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
 629
 630         switch(c->cmd) {
 631 #ifdef WITH_LF
 632                 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
 633                         AcquireRawAdcSamples125k(c->arg[0], c->arg[1], c->arg[2]);
 634                         cmd_send(CMD_ACK,0,0,0,0,0);
 635                         break;
 636                 case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
 637                         ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
 638                         break;
 639                 case CMD_LF_SNOOP_RAW_ADC_SAMPLES:
 640                         SnoopLFRawAdcSamples(c->arg[0], c->arg[1]);
 641                         cmd_send(CMD_ACK,0,0,0,0,0);
 642                         break;
 643                 case CMD_HID_DEMOD_FSK:
 644                         CmdHIDdemodFSK(c->arg[0], 0, 0, 1);
 645                         break;
 646                 case CMD_HID_SIM_TAG:
 647                         CmdHIDsimTAG(c->arg[0], c->arg[1], 1);
 648                         break;
 649                 case CMD_HID_CLONE_TAG:
 650                         CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 651                         break;
 652                 case CMD_IO_DEMOD_FSK:
 653                         CmdIOdemodFSK(c->arg[0], 0, 0, 1);
 654                         break;
 655                 case CMD_IO_CLONE_TAG:
 656                         CopyIOtoT55x7(c->arg[0], c->arg[1], c->d.asBytes[0]);
 657                         break;
 658                 case CMD_EM410X_DEMOD:
 659                         CmdEM410xdemod(c->arg[0], 0, 0, 1);
 660                         break;
 661                 case CMD_EM410X_WRITE_TAG:
 662                         WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
 663                         break;
 664                 case CMD_READ_TI_TYPE:
 665                         ReadTItag();
 666                         break;
 667                 case CMD_WRITE_TI_TYPE:
 668                         WriteTItag(c->arg[0],c->arg[1],c->arg[2]);
 669                         break;
 670                 case CMD_SIMULATE_TAG_125K:
 671                         LED_A_ON();
 672                         SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
 673                         LED_A_OFF();
 674                         break;
 675                 case CMD_LF_SIMULATE_BIDIR:
 676                         SimulateTagLowFrequencyBidir(c->arg[0], c->arg[1]);
 677                         break;
 678                 case CMD_INDALA_CLONE_TAG:
 679                         CopyIndala64toT55x7(c->arg[0], c->arg[1]);
 680                         break;
 681                 case CMD_INDALA_CLONE_TAG_L:
 682                         CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
 683                         break;
 684                 case CMD_T55XX_READ_BLOCK:
 685                         T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
 686                         break;
 687                 case CMD_T55XX_WRITE_BLOCK:
 688                         T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 689                         break;
 690                 case CMD_T55XX_READ_TRACE:
 691                         T55xxReadTrace();
 692                         break;
 693                 case CMD_PCF7931_READ:
 694                         ReadPCF7931();
 695                         cmd_send(CMD_ACK,0,0,0,0,0);
 696                         break;
 697                 case CMD_EM4X_READ_WORD:
 698                         EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
 699                         break;
 700                 case CMD_EM4X_WRITE_WORD:
 701                         EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
 702                         break;
 703 #endif
 704
 705 #ifdef WITH_HITAG
 706                 case CMD_SNOOP_HITAG: // Eavesdrop Hitag tag, args = type
 707                         SnoopHitag(c->arg[0]);
 708                         break;
 709                 case CMD_SIMULATE_HITAG: // Simulate Hitag tag, args = memory content
 710                         SimulateHitagTag((bool)c->arg[0],(byte_t*)c->d.asBytes);
 711                         break;
 712                 case CMD_READER_HITAG: // Reader for Hitag tags, args = type and function
 713                         ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
 714                         break;
 715 #endif
 716
 717 #ifdef WITH_ISO15693
 718                 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
 719                         AcquireRawAdcSamplesIso15693();
 720                         break;
 721                 case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
 722                         RecordRawAdcSamplesIso15693();
 723                         break;
 724
 725                 case CMD_ISO_15693_COMMAND:
 726                         DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
 727                         break;
 728
 729                 case CMD_ISO_15693_FIND_AFI:
 730                         BruteforceIso15693Afi(c->arg[0]);
 731                         break;
 732
 733                 case CMD_ISO_15693_DEBUG:
 734                         SetDebugIso15693(c->arg[0]);
 735                         break;
 736
 737                 case CMD_READER_ISO_15693:
 738                         ReaderIso15693(c->arg[0]);
 739                         break;
 740                 case CMD_SIMTAG_ISO_15693:
 741                         SimTagIso15693(c->arg[0], c->d.asBytes);
 742                         break;
 743 #endif
 744
 745 #ifdef WITH_LEGICRF
 746                 case CMD_SIMULATE_TAG_LEGIC_RF:
 747                         LegicRfSimulate(c->arg[0], c->arg[1], c->arg[2]);
 748                         break;
 749
 750                 case CMD_WRITER_LEGIC_RF:
 751                         LegicRfWriter(c->arg[1], c->arg[0]);
 752                         break;
 753
 754                 case CMD_READER_LEGIC_RF:
 755                         LegicRfReader(c->arg[0], c->arg[1]);
 756                         break;
 757 #endif
 758
 759 #ifdef WITH_ISO14443b
 760                 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
 761                         AcquireRawAdcSamplesIso14443(c->arg[0]);
 762                         break;
 763                 case CMD_READ_SRI512_TAG:
 764                         ReadSTMemoryIso14443(0x0F);
 765                         break;
 766                 case CMD_READ_SRIX4K_TAG:
 767                         ReadSTMemoryIso14443(0x7F);
 768                         break;
 769                 case CMD_SNOOP_ISO_14443:
 770                         SnoopIso14443();
 771                         break;
 772                 case CMD_SIMULATE_TAG_ISO_14443:
 773                         SimulateIso14443Tag();
 774                         break;
 775                 case CMD_ISO_14443B_COMMAND:
 776                         SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
 777                         break;
 778 #endif
 779
 780 #ifdef WITH_ISO14443a
 781                 case CMD_SNOOP_ISO_14443a:
 782                         SnoopIso14443a(c->arg[0]);
 783                         break;
 784                 case CMD_READER_ISO_14443a:
 785                         ReaderIso14443a(c);
 786                         break;
 787                 case CMD_SIMULATE_TAG_ISO_14443a:
 788                         SimulateIso14443aTag(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);  // ## Simulate iso14443a tag - pass tag type & UID
 789                         break;
 790
 791                 case CMD_EPA_PACE_COLLECT_NONCE:
 792                         EPA_PACE_Collect_Nonce(c);
 793                         break;
 794
 795                 case CMD_READER_MIFARE:
 796             ReaderMifare(c->arg[0]);
 797                         break;
 798                 case CMD_MIFARE_READBL:
 799                         MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 800                         break;
 801                 case CMD_MIFAREU_READBL:
 802                         MifareUReadBlock(c->arg[0],c->d.asBytes);
 803                         break;
 804                 case CMD_MIFAREU_READCARD:
 805                         MifareUReadCard(c->arg[0], c->arg[1], c->d.asBytes);
 806                         break;
 807                 case CMD_MIFARE_READSC:
 808                         MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 809                         break;
 810                 case CMD_MIFARE_WRITEBL:
 811                         MifareWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 812                         break;
 813                 case CMD_MIFAREU_WRITEBL_COMPAT:
 814                         MifareUWriteBlock(c->arg[0], c->d.asBytes);
 815                         break;
 816                 case CMD_MIFAREU_WRITEBL:
 817                         MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
 818                         break;
 819                 case CMD_MIFARE_NESTED:
 820                         MifareNested(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 821                         break;
 822                 case CMD_MIFARE_CHKKEYS:
 823                         MifareChkKeys(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 824                         break;
 825                 case CMD_SIMULATE_MIFARE_CARD:
 826                         Mifare1ksim(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 827                         break;
 828
 829                 // emulator
 830                 case CMD_MIFARE_SET_DBGMODE:
 831                         MifareSetDbgLvl(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 832                         break;
 833                 case CMD_MIFARE_EML_MEMCLR:
 834                         MifareEMemClr(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 835                         break;
 836                 case CMD_MIFARE_EML_MEMSET:
 837                         MifareEMemSet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 838                         break;
 839                 case CMD_MIFARE_EML_MEMGET:
 840                         MifareEMemGet(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 841                         break;
 842                 case CMD_MIFARE_EML_CARDLOAD:
 843                         MifareECardLoad(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 844                         break;
 845
 846                 // Work with "magic Chinese" card
 847                 case CMD_MIFARE_CSETBLOCK:
 848                         MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 849                         break;
 850                 case CMD_MIFARE_CGETBLOCK:
 851                         MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 852                         break;
 853                 case CMD_MIFARE_CIDENT:
 854                         MifareCIdent();
 855                         break;
 856
 857                 // mifare sniffer
 858                 case CMD_MIFARE_SNIFFER:
 859                         SniffMifare(c->arg[0]);
 860                         break;
 861 #endif
 862
 863 #ifdef WITH_ICLASS
 864                 // Makes use of ISO14443a FPGA Firmware
 865                 case CMD_SNOOP_ICLASS:
 866                         SnoopIClass();
 867                         break;
 868                 case CMD_SIMULATE_TAG_ICLASS:
 869                         SimulateIClass(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 870                         break;
 871                 case CMD_READER_ICLASS:
 872                         ReaderIClass(c->arg[0]);
 873                         break;
 874                 case CMD_READER_ICLASS_REPLAY:
 875                     ReaderIClass_Replay(c->arg[0], c->d.asBytes);
 876                         break;
 877 #endif
 878
 879                 case CMD_SIMULATE_TAG_HF_LISTEN:
 880                         SimulateTagHfListen();
 881                         break;
 882
 883                 case CMD_BUFF_CLEAR:
 884                         BufferClear();
 885                         break;
 886
 887                 case CMD_MEASURE_ANTENNA_TUNING:
 888                         MeasureAntennaTuning();
 889                         break;
 890
 891                 case CMD_MEASURE_ANTENNA_TUNING_HF:
 892                         MeasureAntennaTuningHf();
 893                         break;
 894
 895                 case CMD_LISTEN_READER_FIELD:
 896                         ListenReaderField(c->arg[0]);
 897                         break;
 898
 899                 case CMD_FPGA_MAJOR_MODE_OFF:           // ## FPGA Control
 900                         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 901                         SpinDelay(200);
 902                         LED_D_OFF(); // LED D indicates field ON or OFF
 903                         break;
 904
 905                 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
 906
 907                         LED_B_ON();
 908                         for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
 909                                 size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
 910                                 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
 911                         }
 912                         // Trigger a finish downloading signal with an ACK frame
 913                         cmd_send(CMD_ACK,bits_per_sample,decimation,0,0,0);
 914                         LED_B_OFF();
 915                         break;
 916
 917                 case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
 918                         uint8_t *b = (uint8_t *)BigBuf;
 919                         memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
 920                         cmd_send(CMD_ACK,0,0,0,0,0);
 921                         break;
 922                 }
 923                 case CMD_READ_MEM:
 924                         ReadMem(c->arg[0]);
 925                         break;
 926
 927                 case CMD_SET_LF_DIVISOR:
 928                         FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 929                         FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->arg[0]);
 930                         break;
 931
 932                 case CMD_SET_ADC_MUX:
 933                         switch(c->arg[0]) {
 934                                 case 0: SetAdcMuxFor(GPIO_MUXSEL_LOPKD); break;
 935                                 case 1: SetAdcMuxFor(GPIO_MUXSEL_LORAW); break;
 936                                 case 2: SetAdcMuxFor(GPIO_MUXSEL_HIPKD); break;
 937                                 case 3: SetAdcMuxFor(GPIO_MUXSEL_HIRAW); break;
 938                         }
 939                         break;
 940
 941                 case CMD_VERSION:
 942                         SendVersion();
 943                         break;
 944
 945 #ifdef WITH_LCD
 946                 case CMD_LCD_RESET:
 947                         LCDReset();
 948                         break;
 949                 case CMD_LCD:
 950                         LCDSend(c->arg[0]);
 951                         break;
 952 #endif
 953                 case CMD_SETUP_WRITE:
 954                 case CMD_FINISH_WRITE:
 955                 case CMD_HARDWARE_RESET:
 956                         usb_disable();
 957                         SpinDelay(1000);
 958                         SpinDelay(1000);
 959                         AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
 960                         for(;;) {
 961                                 // We're going to reset, and the bootrom will take control.
 962                         }
 963                         break;
 964
 965                 case CMD_START_FLASH:
 966                         if(common_area.flags.bootrom_present) {
 967                                 common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
 968                         }
 969                         usb_disable();
 970                         AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
 971                         for(;;);
 972                         break;
 973
 974                 case CMD_DEVICE_INFO: {
 975                         uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
 976                         if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
 977                         cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
 978                         break;
 979                 }
 980                 default:
 981                         Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
 982                         break;
 983         }
 984 }
 985
 986 void  __attribute__((noreturn)) AppMain(void)
 987 {
 988         SpinDelay(100);
 989
 990         if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
 991                 /* Initialize common area */
 992                 memset(&common_area, 0, sizeof(common_area));
 993                 common_area.magic = COMMON_AREA_MAGIC;
 994                 common_area.version = 1;
 995         }
 996         common_area.flags.osimage_present = 1;
 997
 998         LED_D_OFF();
 999         LED_C_OFF();
1000         LED_B_OFF();
1001         LED_A_OFF();
1002
1003         // Init USB device
1004   usb_enable();
1005
1006         // The FPGA gets its clock from us from PCK0 output, so set that up.
1007         AT91C_BASE_PIOA->PIO_BSR = GPIO_PCK0;
1008         AT91C_BASE_PIOA->PIO_PDR = GPIO_PCK0;
1009         AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK0;
1010         // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
1011         AT91C_BASE_PMC->PMC_PCKR[0] = AT91C_PMC_CSS_PLL_CLK |
1012                 AT91C_PMC_PRES_CLK_4;
1013         AT91C_BASE_PIOA->PIO_OER = GPIO_PCK0;
1014
1015         // Reset SPI
1016         AT91C_BASE_SPI->SPI_CR = AT91C_SPI_SWRST;
1017         // Reset SSC
1018         AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
1019
1020         // Load the FPGA image, which we have stored in our flash.
1021         // (the HF version by default)
1022         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1023
1024         StartTickCount();
1025
1026 #ifdef WITH_LCD
1027         LCDInit();
1028 #endif
1029
1030   byte_t rx[sizeof(UsbCommand)];
1031         size_t rx_len;
1032
1033         for(;;) {
1034     if (usb_poll()) {
1035       rx_len = usb_read(rx,sizeof(UsbCommand));
1036       if (rx_len) {
1037         UsbPacketReceived(rx,rx_len);
1038       }
1039     }
1040                 WDT_HIT();
1041
1042 #ifdef WITH_LF
1043                 if (BUTTON_HELD(1000) > 0)
1044                         SamyRun();
1045 #endif
1046         }
1047 }