github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-21 05:43:48 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Merge remote-tracking branch 'upstream/master'

Browse source
This commit is contained in:
Gabriele Gristina 2016-10-20 20:00:06 +02:00
commit 64c87a8c5f
14 changed files with 187 additions and 93 deletions
Download patch file Download diff file Expand all files Collapse all files

5
README.md
View file

@ -222,7 +222,10 @@ You only need devkitARM, nothing more (no extra lib or anything else) to compile
`export DEVKITARM=/c/devkitPro/devkitARM` `export DEVKITARM=/c/devkitPro/devkitARM`
`export PATH=$PATH:$DEVKITARM/bin` `export PATH=$PATH:$DEVKITARM/bin`
### 6. Build and run ### 6 - Install Strawberry Perl
Download and install: http://strawberry-perl.googlecode.com/files/strawberry-perl-5.10.1.1.msi
### 7. Build and run
Download and install Git for Windows: https://git-scm.com/download/win Download and install Git for Windows: https://git-scm.com/download/win
- Run minimal system: `C:\Qt\msys\msys.bat` - Run minimal system: `C:\Qt\msys\msys.bat`

6
armsrc/appmain.c
View file

@ -1284,6 +1284,12 @@ void UsbPacketReceived(uint8_t *packet, int len)
break; break;
} }
case CMD_DOWNLOADED_SIM_SAMPLES_125K: { case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
// iceman; since changing fpga_bitstreams clears bigbuff, Its better to call it before.
// to be able to use this one for uploading data to device not only for LF, I use c->arg[1]
if ( c->arg[1] == 0 )
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
else
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
uint8_t *b = BigBuf_get_addr(); uint8_t *b = BigBuf_get_addr();
memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE); memcpy( b + c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
cmd_send(CMD_ACK,0,0,0,0,0); cmd_send(CMD_ACK,0,0,0,0,0);

11
armsrc/fpgaloader.c
View file

@ -117,7 +117,7 @@ void SetupSpi(int mode)
// Set up the synchronous serial port, with the one set of options that we // Set up the synchronous serial port, with the one set of options that we
// always use when we are talking to the FPGA. Both RX and TX are enabled. // always use when we are talking to the FPGA. Both RX and TX are enabled.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void FpgaSetupSsc(void) { void FpgaSetupSscExt(uint8_t clearPCER) {
// First configure the GPIOs, and get ourselves a clock. // First configure the GPIOs, and get ourselves a clock.
AT91C_BASE_PIOA->PIO_ASR = AT91C_BASE_PIOA->PIO_ASR =
GPIO_SSC_FRAME | GPIO_SSC_FRAME |
@ -126,7 +126,10 @@ void FpgaSetupSsc(void) {
GPIO_SSC_CLK; GPIO_SSC_CLK;
AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DOUT;
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_SSC); if ( clearPCER )
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_SSC);
else
AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_SSC);
// Now set up the SSC proper, starting from a known state. // Now set up the SSC proper, starting from a known state.
AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST; AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
@ -148,7 +151,9 @@ void FpgaSetupSsc(void) {
AT91C_BASE_SSC->SSC_CR = AT91C_SSC_RXEN | AT91C_SSC_TXEN; AT91C_BASE_SSC->SSC_CR = AT91C_SSC_RXEN | AT91C_SSC_TXEN;
} }
void FpgaSetupSsc(void) {
FpgaSetupSscExt(TRUE);
}
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Set up DMA to receive samples from the FPGA. We will use the PDC, with // Set up DMA to receive samples from the FPGA. We will use the PDC, with
// a single buffer as a circular buffer (so that we just chain back to // a single buffer as a circular buffer (so that we just chain back to

12
armsrc/fpgaloader.h
View file

@ -14,6 +14,7 @@ void FpgaSendCommand(uint16_t cmd, uint16_t v);
void FpgaWriteConfWord(uint8_t v); void FpgaWriteConfWord(uint8_t v);
void FpgaDownloadAndGo(int bitstream_version); void FpgaDownloadAndGo(int bitstream_version);
void FpgaGatherVersion(int bitstream_version, char *dst, int len); void FpgaGatherVersion(int bitstream_version, char *dst, int len);
void FpgaSetupSscExt(uint8_t clearPCER);
void FpgaSetupSsc(void); void FpgaSetupSsc(void);
void SetupSpi(int mode); void SetupSpi(int mode);
bool FpgaSetupSscDma(uint8_t *buf, int len); bool FpgaSetupSscDma(uint8_t *buf, int len);
@ -28,7 +29,6 @@ void SetAdcMuxFor(uint32_t whichGpio);
#define FPGA_BITSTREAM_LF 1 #define FPGA_BITSTREAM_LF 1
#define FPGA_BITSTREAM_HF 2 #define FPGA_BITSTREAM_HF 2
// Definitions for the FPGA commands. // Definitions for the FPGA commands.
#define FPGA_CMD_SET_CONFREG (1<<12) #define FPGA_CMD_SET_CONFREG (1<<12)
#define FPGA_CMD_SET_DIVISOR (2<<12) #define FPGA_CMD_SET_DIVISOR (2<<12)
@ -59,11 +59,11 @@ void SetAdcMuxFor(uint32_t whichGpio);
#define FPGA_HF_READER_RX_XCORR_SNOOP (1<<1) #define FPGA_HF_READER_RX_XCORR_SNOOP (1<<1)
#define FPGA_HF_READER_RX_XCORR_QUARTER_FREQ (1<<2) #define FPGA_HF_READER_RX_XCORR_QUARTER_FREQ (1<<2)
// Options for the HF simulated tag, how to modulate // Options for the HF simulated tag, how to modulate
#define FPGA_HF_SIMULATOR_NO_MODULATION (0<<0) #define FPGA_HF_SIMULATOR_NO_MODULATION (0<<0) // 0000
#define FPGA_HF_SIMULATOR_MODULATE_BPSK (1<<0) #define FPGA_HF_SIMULATOR_MODULATE_BPSK (1<<0) // 0001
#define FPGA_HF_SIMULATOR_MODULATE_212K (2<<0) #define FPGA_HF_SIMULATOR_MODULATE_212K (2<<0) // 0010
#define FPGA_HF_SIMULATOR_MODULATE_424K (4<<0) #define FPGA_HF_SIMULATOR_MODULATE_424K (4<<0) // 0100
#define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT 0x5//101 #define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT 0x5 // 0101
// no 848K // no 848K
// Options for ISO14443A // Options for ISO14443A

20
armsrc/iso14443b.c
View file

@ -216,16 +216,19 @@ static void CodeIso14443bAsTag(const uint8_t *cmd, int len) {
* -TO VERIFY THIS BELOW- * -TO VERIFY THIS BELOW-
* The mode FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK which we use to simulate tag * The mode FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK which we use to simulate tag
* works like this: * works like this:
* - A 1-bit input to the FPGA becomes 8 pulses at 847.5kHz (9.44µS) * - A 1-bit input to the FPGA becomes 8 pulses at 847.5kHz (1.18µS / pulse) == 9.44us
* - A 0-bit input to the FPGA becomes an unmodulated time of 9.44µS * - A 0-bit input to the FPGA becomes an unmodulated time of 1.18µS or does it become 8 nonpulses for 9.44us
*
* *
* FPGA doesn't seem to work with ETU. It seems to work with pulse / duration instead.
* *
* Card sends data ub 847.e kHz subcarrier * Card sends data ub 847.e kHz subcarrier
* 848k = 9.44µS = 128 fc * subcar |duration| FC division
* 424k = 18.88µS = 256 fc * -------+--------+------------
* 212k = 37.76µS = 512 fc * 106kHz | 9.44µS | FC/128
* 106k = 75.52µS = 1024 fc * 212kHz | 4.72µS | FC/64
* 424kHz | 2.36µS | FC/32
* 848kHz | 1.18µS | FC/16
* -------+--------+------------
* *
* Reader data transmission: * Reader data transmission:
* - no modulation ONES * - no modulation ONES
@ -496,8 +499,7 @@ void ClearFpgaShiftingRegisters(void){
while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)) {}; while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)) {};
b = AT91C_BASE_SSC->SSC_RHR; (void) b; b = AT91C_BASE_SSC->SSC_RHR; (void) b;
// wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line) // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
for (uint8_t j = 0; j < 5; j++) { // allow timeout - better late than never for (uint8_t j = 0; j < 5; j++) { // allow timeout - better late than never
while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)); while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));

41
armsrc/lfops.c
View file

@ -91,6 +91,7 @@ void ModThenAcquireRawAdcSamples125k(uint32_t delay_off, uint32_t periods, uint3
*/ */
void ReadTItag(void) void ReadTItag(void)
{ {
StartTicks();
// some hardcoded initial params // some hardcoded initial params
// when we read a TI tag we sample the zerocross line at 2Mhz // when we read a TI tag we sample the zerocross line at 2Mhz
// TI tags modulate a 1 as 16 cycles of 123.2Khz // TI tags modulate a 1 as 16 cycles of 123.2Khz
@ -216,6 +217,7 @@ void ReadTItag(void)
DbpString("Info: CRC is good"); DbpString("Info: CRC is good");
} }
} }
StopTicks();
} }
void WriteTIbyte(uint8_t b) void WriteTIbyte(uint8_t b)
@ -282,7 +284,7 @@ void AcquireTiType(void)
HIGH(GPIO_SSC_DOUT); HIGH(GPIO_SSC_DOUT);
// Charge TI tag for 50ms. // Charge TI tag for 50ms.
SpinDelay(50); WaitMS(50);
// stop modulating antenna and listen // stop modulating antenna and listen
LOW(GPIO_SSC_DOUT); LOW(GPIO_SSC_DOUT);
@ -322,6 +324,7 @@ void AcquireTiType(void)
// if not provided a valid crc will be computed from the data and written. // if not provided a valid crc will be computed from the data and written.
void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc) void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
{ {
StartTicks();
FpgaDownloadAndGo(FPGA_BITSTREAM_LF); FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
if(crc == 0) { if(crc == 0) {
crc = update_crc16(crc, (idlo)&0xff); crc = update_crc16(crc, (idlo)&0xff);
@ -360,7 +363,7 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
// modulate antenna // modulate antenna
HIGH(GPIO_SSC_DOUT); HIGH(GPIO_SSC_DOUT);
SpinDelay(50); // charge time WaitMS(50); // charge time
WriteTIbyte(0xbb); // keyword WriteTIbyte(0xbb); // keyword
WriteTIbyte(0xeb); // password WriteTIbyte(0xeb); // password
@ -377,7 +380,7 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
WriteTIbyte(0x00); // write frame lo WriteTIbyte(0x00); // write frame lo
WriteTIbyte(0x03); // write frame hi WriteTIbyte(0x03); // write frame hi
HIGH(GPIO_SSC_DOUT); HIGH(GPIO_SSC_DOUT);
SpinDelay(50); // programming time WaitMS(50); // programming time
LED_A_OFF(); LED_A_OFF();
@ -386,35 +389,38 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
DbpString("Now use `lf ti read` to check"); DbpString("Now use `lf ti read` to check");
StopTicks();
} }
void SimulateTagLowFrequency(int period, int gap, int ledcontrol) void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
{ {
int i = 0; int i = 0;
uint8_t *tab = BigBuf_get_addr(); uint8_t *buf = BigBuf_get_addr();
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD); FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD);
//FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK; AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
//AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK; AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
StartTicks();
for(;;) { for(;;) {
WDT_HIT(); WDT_HIT();
if (ledcontrol) LED_D_ON(); if (ledcontrol) LED_D_ON();
//wait until SSC_CLK goes HIGH // wait until SSC_CLK goes HIGH
// used as a simple detection of a reader field?
while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) { while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
WDT_HIT(); WDT_HIT();
if ( usb_poll_validate_length() || BUTTON_PRESS() ) { if ( usb_poll_validate_length() || BUTTON_PRESS() )
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); goto OUT;
LED_D_OFF();
return;
}
} }
if(tab[i]) if(buf[i])
OPEN_COIL(); OPEN_COIL();
else else
SHORT_COIL(); SHORT_COIL();
@ -424,11 +430,8 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
//wait until SSC_CLK goes LOW //wait until SSC_CLK goes LOW
while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) { while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
WDT_HIT(); WDT_HIT();
if ( usb_poll_validate_length() || BUTTON_PRESS() ) { if ( usb_poll_validate_length() || BUTTON_PRESS() )
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); goto OUT;
LED_D_OFF();
return;
}
} }
i++; i++;
@ -441,6 +444,12 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
} }
} }
} }
OUT:
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
StopTicks();
LED_D_OFF();
DbpString("Simulation stopped");
return;
} }
#define DEBUG_FRAME_CONTENTS 1 #define DEBUG_FRAME_CONTENTS 1

4
armsrc/lfsampling.c
View file

@ -87,11 +87,10 @@ void LFSetupFPGAForADC(int divisor, bool lf_field) {
// Connect the A/D to the peak-detected low-frequency path. // Connect the A/D to the peak-detected low-frequency path.
SetAdcMuxFor(GPIO_MUXSEL_LOPKD); SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
// Give it a bit of time for the resonant antenna to settle. // 50ms for the resonant antenna to settle.
SpinDelay(50); SpinDelay(50);
// Now set up the SSC to get the ADC samples that are now streaming at us. // Now set up the SSC to get the ADC samples that are now streaming at us.
FpgaSetupSsc(); FpgaSetupSsc();
// start a 1.5ticks is 1us // start a 1.5ticks is 1us
StartTicks(); StartTicks();
} }
@ -286,7 +285,6 @@ void doT55x7Acquisition(size_t sample_size) {
continue; continue;
} }
// skip until first high samples begin to change // skip until first high samples begin to change
if (startFound || curSample > T55xx_READ_LOWER_THRESHOLD + T55xx_READ_TOL){ if (startFound || curSample > T55xx_READ_LOWER_THRESHOLD + T55xx_READ_TOL){
// if just found start - recover last sample // if just found start - recover last sample

2
armsrc/pcf7931.c
View file

@ -402,7 +402,7 @@ void SendCmdPCF7931(uint32_t * tab){
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
//initialization of the timer //initialization of the timer
AT91C_BASE_PMC->PMC_PCER |= (0x1 << 12) | (0x1 << 13) | (0x1 << 14); AT91C_BASE_PMC->PMC_PCER |= (0x1 << AT91C_ID_TC0);
AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE; AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE;
AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable
AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK; //clock at 48/32 MHz AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK; //clock at 48/32 MHz

10
armsrc/ticks.c
View file

@ -9,7 +9,6 @@
// Timers, Clocks functions used in LF or Legic where you would need detailed time. // Timers, Clocks functions used in LF or Legic where you would need detailed time.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
#include "ticks.h" #include "ticks.h"
// attempt at high resolution microsecond timer // attempt at high resolution microsecond timer
// beware: timer counts in 21.3uS increments (1024/48Mhz) // beware: timer counts in 21.3uS increments (1024/48Mhz)
void SpinDelayUs(int us) { void SpinDelayUs(int us) {
@ -67,7 +66,7 @@ uint32_t RAMFUNC GetTickCount(void){
// microseconds timer // microseconds timer
// ------------------------------------------------------------------------- // -------------------------------------------------------------------------
void StartCountUS(void) { void StartCountUS(void) {
AT91C_BASE_PMC->PMC_PCER |= (1 << 12) | (1 << 13) | (1 << 14); AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1);
AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE; AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE;
// fast clock // fast clock
@ -95,12 +94,11 @@ uint32_t RAMFUNC GetCountUS(void){
return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV * 2) / 3); return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV * 2) / 3);
} }
// ------------------------------------------------------------------------- // -------------------------------------------------------------------------
// Timer for iso14443 commands. Uses ssp_clk from FPGA // Timer for iso14443 commands. Uses ssp_clk from FPGA
// ------------------------------------------------------------------------- // -------------------------------------------------------------------------
void StartCountSspClk(void) { void StartCountSspClk(void) {
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1) | (1 << AT91C_ID_TC2); // Enable Clock to all timers AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1) | (1 << AT91C_ID_TC2); // Enable Clock to all timers
AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_TIOA1 // XC0 Clock = TIOA1 AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_TIOA1 // XC0 Clock = TIOA1
| AT91C_TCB_TC1XC1S_NONE // XC1 Clock = none | AT91C_TCB_TC1XC1S_NONE // XC1 Clock = none
| AT91C_TCB_TC2XC2S_TIOA0; // XC2 Clock = TIOA0 | AT91C_TCB_TC2XC2S_TIOA0; // XC2 Clock = TIOA0
@ -163,7 +161,6 @@ void ResetSspClk(void) {
AT91C_BASE_TC2->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; AT91C_BASE_TC2->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
while (AT91C_BASE_TC2->TC_CV >= 1); while (AT91C_BASE_TC2->TC_CV >= 1);
} }
uint32_t RAMFUNC GetCountSspClk(void) { uint32_t RAMFUNC GetCountSspClk(void) {
uint32_t tmp_count = (AT91C_BASE_TC2->TC_CV << 16) | AT91C_BASE_TC0->TC_CV; uint32_t tmp_count = (AT91C_BASE_TC2->TC_CV << 16) | AT91C_BASE_TC0->TC_CV;
if ((tmp_count & 0x0000ffff) == 0) //small chance that we may have missed an increment in TC2 if ((tmp_count & 0x0000ffff) == 0) //small chance that we may have missed an increment in TC2
@ -171,7 +168,6 @@ uint32_t RAMFUNC GetCountSspClk(void) {
return tmp_count; return tmp_count;
} }
// ------------------------------------------------------------------------- // -------------------------------------------------------------------------
// Timer for bitbanging, or LF stuff when you need a very precis timer // Timer for bitbanging, or LF stuff when you need a very precis timer
// 1us = 1.5ticks // 1us = 1.5ticks
@ -180,7 +176,7 @@ void StartTicks(void){
//initialization of the timer //initialization of the timer
// tc1 is higher 0xFFFF0000 // tc1 is higher 0xFFFF0000
// tc0 is lower 0x0000FFFF // tc0 is lower 0x0000FFFF
AT91C_BASE_PMC->PMC_PCER |= (1 << 12) | (1 << 13) | (1 << 14); AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1);
AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE; AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE;
AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK | // MCK(48MHz) / 32 AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK | // MCK(48MHz) / 32

12
client/cmdlf.c
View file

@ -596,8 +596,10 @@ int CmdLFSim(const char *Cmd) {
// convert to bitstream if necessary // convert to bitstream if necessary
ChkBitstream(Cmd); ChkBitstream(Cmd);
if (g_debugMode)
printf("DEBUG: Sending [%d bytes]\n", GraphTraceLen);
//can send only 512 bits at a time (1 byte sent per bit...) //can send only 512 bits at a time (1 byte sent per bit...)
printf("Sending [%d bytes]", GraphTraceLen);
for (i = 0; i < GraphTraceLen; i += USB_CMD_DATA_SIZE) { for (i = 0; i < GraphTraceLen; i += USB_CMD_DATA_SIZE) {
UsbCommand c = {CMD_DOWNLOADED_SIM_SAMPLES_125K, {i, 0, 0}}; UsbCommand c = {CMD_DOWNLOADED_SIM_SAMPLES_125K, {i, 0, 0}};
@ -606,11 +608,12 @@ int CmdLFSim(const char *Cmd) {
} }
clearCommandBuffer(); clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
WaitForResponse(CMD_ACK,NULL); WaitForResponse(CMD_ACK, NULL);
printf("."); printf(".");
} }
PrintAndLog("\nStarting to simulate"); PrintAndLog("Starting to simulate");
UsbCommand c = {CMD_SIMULATE_TAG_125K, {GraphTraceLen, gap, 0}}; UsbCommand c = {CMD_SIMULATE_TAG_125K, {GraphTraceLen, gap, 0}};
clearCommandBuffer(); clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
@ -730,6 +733,7 @@ int CmdLFaskSim(const char *Cmd)
while(param_getchar(Cmd, cmdp) != 0x00) { while(param_getchar(Cmd, cmdp) != 0x00) {
switch(param_getchar(Cmd, cmdp)) { switch(param_getchar(Cmd, cmdp)) {
case 'H':
case 'h': return usage_lf_simask(); case 'h': return usage_lf_simask();
case 'i': case 'i':
invert = 1; invert = 1;
@ -788,7 +792,7 @@ int CmdLFaskSim(const char *Cmd)
setDemodBuf(data, dataLen, 0); setDemodBuf(data, dataLen, 0);
} }
if (clk == 0) clk = 64; if (clk == 0) clk = 64;
if (encoding == 0) clk = clk/2; //askraw needs to double the clock speed if (encoding == 0) clk >>= 2; //askraw needs to double the clock speed
size_t size = DemodBufferLen; size_t size = DemodBufferLen;

76
client/cmdlfem4x.c
View file

@ -13,7 +13,7 @@
#include <inttypes.h> #include <inttypes.h>
#include "cmdlfem4x.h" #include "cmdlfem4x.h"
char *global_em410xId; uint64_t g_em410xid = 0;
static int CmdHelp(const char *Cmd); static int CmdHelp(const char *Cmd);
@ -47,11 +47,7 @@ int CmdEM410xRead(const char *Cmd)
PrintAndLog ("EM410x XL pattern found"); PrintAndLog ("EM410x XL pattern found");
return 0; return 0;
} }
char id[12] = {0x00}; g_em410xid = lo;
//sprintf(id, "%010llx",lo);
sprintf(id, "%010"PRIu64, lo);
global_em410xId = id;
return 1; return 1;
} }
@ -59,10 +55,9 @@ int CmdEM410xRead(const char *Cmd)
int CmdEM410xSim(const char *Cmd) int CmdEM410xSim(const char *Cmd)
{ {
int i, n, j, binary[4], parity[4]; int i, n, j, binary[4], parity[4];
char cmdp = param_getchar(Cmd, 0);
uint8_t uid[5] = {0x00}; uint8_t uid[5] = {0x00};
char cmdp = param_getchar(Cmd, 0);
if (cmdp == 'h' || cmdp == 'H') { if (cmdp == 'h' || cmdp == 'H') {
PrintAndLog("Usage: lf em4x em410xsim <UID> <clock>"); PrintAndLog("Usage: lf em4x em410xsim <UID> <clock>");
PrintAndLog(""); PrintAndLog("");
@ -81,46 +76,45 @@ int CmdEM410xSim(const char *Cmd)
PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X clock: %d", uid[0],uid[1],uid[2],uid[3],uid[4],clock); PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X clock: %d", uid[0],uid[1],uid[2],uid[3],uid[4],clock);
PrintAndLog("Press pm3-button to about simulation"); PrintAndLog("Press pm3-button to about simulation");
/* clear our graph */ /* clear our graph */
ClearGraph(0); ClearGraph(0);
/* write 9 start bits */ /* write 9 start bits */
for (i = 0; i < 9; i++) for (i = 0; i < 9; i++)
AppendGraph(0, clock, 1); AppendGraph(0, clock, 1);
/* for each hex char */ /* for each hex char */
parity[0] = parity[1] = parity[2] = parity[3] = 0; parity[0] = parity[1] = parity[2] = parity[3] = 0;
for (i = 0; i < 10; i++) for (i = 0; i < 10; i++)
{ {
/* read each hex char */ /* read each hex char */
sscanf(&Cmd[i], "%1x", &n); sscanf(&Cmd[i], "%1x", &n);
for (j = 3; j >= 0; j--, n/= 2) for (j = 3; j >= 0; j--, n/= 2)
binary[j] = n % 2; binary[j] = n % 2;
/* append each bit */ /* append each bit */
AppendGraph(0, clock, binary[0]); AppendGraph(0, clock, binary[0]);
AppendGraph(0, clock, binary[1]); AppendGraph(0, clock, binary[1]);
AppendGraph(0, clock, binary[2]); AppendGraph(0, clock, binary[2]);
AppendGraph(0, clock, binary[3]); AppendGraph(0, clock, binary[3]);
/* append parity bit */ /* append parity bit */
AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]); AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
/* keep track of column parity */ /* keep track of column parity */
parity[0] ^= binary[0]; parity[0] ^= binary[0];
parity[1] ^= binary[1]; parity[1] ^= binary[1];
parity[2] ^= binary[2]; parity[2] ^= binary[2];
parity[3] ^= binary[3]; parity[3] ^= binary[3];
} }
/* parity columns */ /* parity columns */
AppendGraph(0, clock, parity[0]); AppendGraph(0, clock, parity[0]);
AppendGraph(0, clock, parity[1]); AppendGraph(0, clock, parity[1]);
AppendGraph(0, clock, parity[2]); AppendGraph(0, clock, parity[2]);
AppendGraph(0, clock, parity[3]); AppendGraph(0, clock, parity[3]);
/* stop bit */ /* stop bit */
AppendGraph(1, clock, 0); AppendGraph(1, clock, 0);
CmdLFSim("0"); //240 start_gap. CmdLFSim("0"); //240 start_gap.
@ -152,10 +146,12 @@ int CmdEM410xWatch(const char *Cmd)
} }
//currently only supports manchester modulations //currently only supports manchester modulations
// todo: helptext
int CmdEM410xWatchnSpoof(const char *Cmd) int CmdEM410xWatchnSpoof(const char *Cmd)
{ {
// loops if the captured ID was in XL-format.
CmdEM410xWatch(Cmd); CmdEM410xWatch(Cmd);
PrintAndLog("# Replaying captured ID: %s",global_em410xId); PrintAndLog("# Replaying captured ID: %llu", g_em410xid);
CmdLFaskSim(""); CmdLFaskSim("");
return 0; return 0;
} }

40
client/default_keys.dic
View file

@ -246,4 +246,42 @@ c2b7ec7d4eb1,
71f3a315ad26, 71f3a315ad26,
51044efb5aab, 51044efb5aab,
ac70ca327a04, ac70ca327a04,
eb0a8ff88ade eb0a8ff88ade,
#
# Data from: https://github.com/RadioWar/NFCGUI
44dd5a385aaf,
21a600056cb0,
b1aca33180a5,
dd61eb6bce22,
1565a172770f,
3e84d2612e2a,
f23442436765,
79674f96c771,
87df99d496cb,
c5132c8980bc,
a21680c27773,
f26e21edcee2,
675557ecc92e,
f4396e468114,
6db17c16b35b,
4186562a5bb2,
2feae851c199,
db1a3338b2eb,
157b10d84c6b,
a643f952ea57,
df37dcb6afb3,
4c32baf326e0,
91ce16c07ac5,
3c5d1c2bcd18,
c3f19ec592a2,
f72a29005459,
185fa3438949,
321a695bd266,
d327083a60a7,
45635ef66ef3,
5481986d2d62,
cba6ae869ad5,
645a166b1eeb,
a7abbc77cc9e,
f792c4c76a5c,
bfb6796a11db

39
client/lualibs/mf_default_keys.lua
View file

@ -370,6 +370,45 @@ local _keys = {
--]] --]]
'668770666644', '668770666644',
'003003003003', '003003003003',
--[[
Data from: https://github.com/RadioWar/NFCGUI
--]]
'44dd5a385aaf',
'21a600056cb0',
'b1aca33180a5',
'dd61eb6bce22',
'1565a172770f',
'3e84d2612e2a',
'f23442436765',
'79674f96c771',
'87df99d496cb',
'c5132c8980bc',
'a21680c27773',
'f26e21edcee2',
'675557ecc92e',
'f4396e468114',
'6db17c16b35b',
'4186562a5bb2',
'2feae851c199',
'db1a3338b2eb',
'157b10d84c6b',
'a643f952ea57',
'df37dcb6afb3',
'4c32baf326e0',
'91ce16c07ac5',
'3c5d1c2bcd18',
'c3f19ec592a2',
'f72a29005459',
'185fa3438949',
'321a695bd266',
'd327083a60a7',
'45635ef66ef3',
'5481986d2d62',
'cba6ae869ad5',
'645a166b1eeb',
'a7abbc77cc9e',
'f792c4c76a5c',
'bfb6796a11db',
} }
--- ---

2
client/scripts/mifare_autopwn.lua
View file

@ -4,8 +4,6 @@ local cmds = require('commands')
example = "script run mifare_autopwn" example = "script run mifare_autopwn"
author = "Martin Holst Swende" author = "Martin Holst Swende"
desc = desc =
[[ [[
This is a which automates cracking and dumping mifare classic cards. It sets itself into This is a which automates cracking and dumping mifare classic cards. It sets itself into