bla

2015-11-15 18:18:42 +00:00
parent 9ac343fc45
commit 72be7b0c2f
580 changed files with 356252 additions and 6 deletions
@@ -0,0 +1,8 @@
+
+all: pegoda
+
+pegoda: pegoda.o
+	$(CC) -lusb -o $@ $^
+
+clean:
+	rm -f pegoda *.o
@@ -0,0 +1,298 @@
+/*
+ *  (C) 2005 by Harald Welte <laforge@gnumonks.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 
+ *  as published by the Free Software Foundation
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+
+#include <usb.h>
+#include "pegoda.h"
+
+const char *
+hexdump(const void *data, unsigned int len)
+{
+	static char string[1024];
+	unsigned char *d = (unsigned char *) data;
+	unsigned int i, left;
+
+	string[0] = '\0';
+	left = sizeof(string);
+	for (i = 0; len--; i += 3) {
+		if (i >= sizeof(string) -4)
+			break;
+		snprintf(string+i, 4, " %02x", *d++);
+	}
+	return string;
+}
+
+struct pegoda_handle {
+	struct usb_dev_handle *handle;
+	unsigned char seq;
+	unsigned char snr[4];
+};
+
+
+struct usb_device *find_device(u_int16_t vendor, u_int16_t device)
+{
+	struct usb_bus *bus;
+
+	for (bus = usb_get_busses(); bus; bus = bus->next) {
+		struct usb_device *dev;
+		for (dev = bus->devices; dev; dev = dev->next) {
+			if (dev->descriptor.idVendor == vendor &&
+			    dev->descriptor.idProduct == device) {
+				return dev;
+			}
+		}
+	}
+	return NULL;
+}
+
+int pegoda_transceive(struct pegoda_handle *ph,
+		      u_int8_t cmd, unsigned char *tx, unsigned int tx_len,
+		      unsigned char *rx, unsigned int *rx_len)
+{
+	unsigned char txbuf[256];
+	unsigned char rxbuf[256];
+	int rc;
+	unsigned int len_expected;
+	struct pegoda_cmd_hdr *hdr = (struct pegoda_cmd_hdr *)txbuf;
+	struct pegoda_cmd_hdr *rxhdr = (struct pegoda_cmd_hdr *)rxbuf;
+
+	hdr->seq = ++(ph->seq);
+	hdr->cmd = cmd;
+	hdr->len = htons(tx_len);
+	memcpy(txbuf + sizeof(*hdr), tx, tx_len);
+
+	printf("tx [%u]: %s\n", tx_len+sizeof(*hdr),
+		hexdump(txbuf, tx_len + sizeof(*hdr)));
+	rc = usb_bulk_write(ph->handle, 0x02, (char *)txbuf,
+			    tx_len + sizeof(*hdr), 0);
+	if (rc < 0)
+		return rc;
+
+	rc = usb_bulk_read(ph->handle, 0x81, (char *)rxbuf, sizeof(rxbuf), 0);
+	if (rc <= 0)
+		return rc;
+
+	if (rc != 2) {
+		fprintf(stderr, "unexpected: received %u bytes as length?\n");
+		return -EIO;
+	}
+	printf("len [%u]: %s\n", rc, hexdump(rxbuf, rc));
+
+	len_expected = rxbuf[0];
+
+	if (len_expected > sizeof(rxbuf))
+		return -EIO;
+
+	rc = usb_bulk_read(ph->handle, 0x81, (char *)rxbuf, len_expected, 0);
+	if (rc <= 0)
+		return rc;
+	printf("rx [%u]: %s\n", rc, hexdump(rxbuf, rc));
+
+	if (rc < 4)
+		return -EIO;
+
+	if (rxhdr->seq != hdr->seq)
+		return -EIO;
+
+	*rx_len = ntohs(rxhdr->len);
+
+	memcpy(rx, rxbuf+sizeof(*rxhdr), rc-sizeof(*rxhdr));
+
+	return rxhdr->cmd;
+}
+
+struct pegoda_handle *pegoda_open(void)
+{
+	struct usb_device *pegoda;
+	unsigned char rbuf[16];
+	unsigned int rlen = sizeof(rbuf);
+	struct pegoda_handle *ph;
+
+	usb_init();
+	usb_find_busses();
+	usb_find_devices();
+
+	pegoda = find_device(USB_VENDOR_PHILIPS, USB_DEVICE_PEGODA);
+
+	if (!pegoda)
+		return NULL;
+
+	ph = malloc(sizeof(*ph));
+	if (!ph)
+		return NULL;
+	memset(ph, 0, sizeof(*ph));
+
+	printf("found pegoda, %u configurations\n",
+		pegoda->descriptor.bNumConfigurations);
+
+	printf("config 2 [nr %u] has %u interfaces\n",
+		pegoda->config[1].bConfigurationValue,
+		pegoda->config[1].bNumInterfaces);
+
+	printf("config 2 interface 0 has %u altsettings\n",
+		pegoda->config[1].interface[0].num_altsetting);
+
+	ph->handle = usb_open(pegoda);
+	if (!ph->handle) 
+		goto out_free;
+
+	if (usb_set_configuration(ph->handle, 2))
+		goto out_free;
+
+	printf("configuration 2 successfully set\n");
+
+	if (usb_claim_interface(ph->handle, 0))
+		goto out_free;
+
+	printf("interface 0 claimed\n");
+
+	if (usb_set_altinterface(ph->handle, 1))
+		goto out_free;
+
+	printf("alt setting 1 selected\n");
+
+	pegoda_transceive(ph, PEGODA_CMD_PCD_CONFIG, NULL, 0, rbuf, &rlen);
+
+	return ph;
+out_free:
+	free(ph);
+	return NULL;
+}
+
+/* Transform crypto1 key from generic 6byte into rc632 specific 12byte */
+static int
+mifare_transform_key(const u_int8_t *key6, u_int8_t *key12)
+{
+	int i;
+	u_int8_t ln;
+	u_int8_t hn;
+
+	for (i = 0; i < 6; i++) {
+		ln = key6[i] & 0x0f;
+		hn = key6[i] >> 4;
+		key12[i * 2 + 1] = (~ln << 4) | ln;
+		key12[i * 2] = (~hn << 4) | hn;
+	}
+	return 0;
+}
+
+static int pegoda_auth_e2(struct pegoda_handle *ph,
+			  u_int8_t keynr, u_int8_t sector)
+{
+	unsigned char buf[3];
+	unsigned char rbuf[16];
+	unsigned int rlen = sizeof(rbuf);
+
+	buf[0] = 0x60;
+	buf[1] = keynr;		/* key number */
+	buf[2] = sector;	/* sector */
+	rlen = sizeof(rbuf);
+	pegoda_transceive(ph, PEGODA_CMD_PICC_AUTH, buf, 3, rbuf, &rlen);
+
+	/* FIXME: check response */
+
+	return 0;
+}
+
+static int pegoda_auth_key(struct pegoda_handle *ph,
+			   u_int8_t sector, const unsigned char *key6)
+{
+	unsigned char buf[1+4+12+1];
+	unsigned char rbuf[16];
+	unsigned int rlen = sizeof(rbuf);
+
+	buf[0] = 0x60;
+	memcpy(buf+1, ph->snr, 4);
+	mifare_transform_key(key6, buf+5);
+	buf[17] = sector;
+
+	pegoda_transceive(ph, PEGODA_CMD_PICC_AUTH_KEY, buf, 18, rbuf, &rlen);
+
+	/* FIXME: check response */
+
+	return 0;
+}
+
+static int pegoda_read16(struct pegoda_handle *ph,
+			 u_int8_t page, unsigned char *rx)
+{
+	int rc;
+	unsigned int rlen = 16;
+
+	rc = pegoda_transceive(ph, PEGODA_CMD_PICC_READ,
+				&page, 1, rx, &rlen);
+	if (rlen != 16)
+		return -EIO;
+
+	return 0;
+}
+
+int main(int argc, char **argv)
+{
+	unsigned char buf[256];
+	unsigned char rbuf[256];
+	unsigned int rlen = sizeof(rbuf);
+	struct pegoda_handle *ph;
+	int i;
+
+	ph = pegoda_open();
+	if (!ph)
+		exit(1);
+
+	/* LED off */
+	buf[0] = 0x00;
+	rlen = sizeof(rbuf);
+	pegoda_transceive(ph, PEGODA_CMD_SWITCH_LED, buf, 1, rbuf, &rlen);
+
+	/* anticollision */
+
+	buf[0] = 0x26;
+	rlen = sizeof(rbuf);
+	pegoda_transceive(ph, PEGODA_CMD_PICC_COMMON_REQUEST, 
+			  buf, 1, rbuf, &rlen);
+
+	buf[0] = 0x93;
+	memset(buf+1, 0, 5);
+	rlen = sizeof(rbuf);
+	pegoda_transceive(ph, PEGODA_CMD_PICC_CASC_ANTICOLL, 
+			  buf, 6, rbuf, &rlen);
+
+	memcpy(ph->snr, rbuf, 4);
+
+	buf[0] = 0x93;
+	memcpy(buf+1, ph->snr, 4);
+	rlen = sizeof(rbuf);
+	pegoda_transceive(ph, PEGODA_CMD_PICC_CASC_SELECT, 
+			  buf, 5, rbuf, &rlen);
+
+	for (i = 0; i < 16; i++) {
+		int j;
+		pegoda_auth_key(ph, i, "\xff\xff\xff\xff\xff\xff");
+		for (j = 0; j < 4; j++) {
+			pegoda_read16(ph, (i*4)+j, rbuf);
+			printf("read16[%u:%u] = %s\n", i,j,hexdump(rbuf, 16));
+		}
+	}
+	
+	exit(0);
+}
@@ -0,0 +1,140 @@
+#ifndef _PEGODA_H
+#define _PEGODA_H
+/*
+ *  (C) 2005 by Harald Welte <laforge@gnumonks.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 
+ *  as published by the Free Software Foundation
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#define USB_VENDOR_PHILIPS	0x0742
+#define USB_DEVICE_PEGODA	0xff01
+
+/* header of a pegoda usb command packet */
+struct pegoda_cmd_hdr {
+	u_int8_t seq;
+	u_int8_t cmd;
+	u_int16_t len;
+};
+
+enum {
+	PEGODA_CMD_WRITE_RC			= 0x01,
+	PEGODA_CMD_READ_RC			= 0x02,
+	PEGODA_CMD_EXCHANGE_BYTESTREAM		= 0x03,
+	PEGODA_CMD_WRITE_MULTIPLE		= 0x04,
+	PEGODA_CMD_READ_MULTIPLE		= 0x05,
+	PEGODA_CMD_READ_WORD			= 0x06,
+
+	
+	PEGODA_CMD_PCD_CONFIG			= 0x10,
+	PEGODA_CMD_PICC_REQUEST			= 0x11,
+	PEGODA_CMD_PICC_ANTICOLL		= 0x12,
+	PEGODA_CMD_PICC_SELECT			= 0x13,
+	PEGODA_CMD_PICC_AUTH			= 0x14,
+	PEGODA_CMD_PICC_AUTH_E2			= 0x15,
+	PEGODA_CMD_LOAD_KEY_E2			= 0x17,
+	PEGODA_CMD_PICC_AUTH_KEY		= 0x18,
+	PEGODA_CMD_PICC_READ			= 0x19,
+	PEGODA_CMD_PICC_WRITE			= 0x1a,
+	PEGODA_CMD_PICC_VALUE			= 0x1b,
+	PEGODA_CMD_PICC_VALUE_DEBIT		= 0x1c,
+	PEGODA_CMD_PICC_HALT			= 0x1d,
+	PEGODA_CMD_PICC_WRITE4			= 0x1e,
+	PEGODA_CMD_PICC_COMMON_WRITE		= 0x1f,
+
+	PEGODA_CMD_PCD_RF_RESET			= 0x20,
+	PEGODA_CMD_PCD_RESET			= 0x21,
+	PEGODA_CMD_PCD_GET_SNR			= 0x22,
+	PEGODA_CMD_PCD_READ_E2			= 0x23,
+	PEGODA_CMD_PCD_SET_TMO			= 0x27,
+	PEGODA_CMD_PICC_COMMON_READ		= 0x28,
+	PEGODA_CMD_PCD_INITIALIZE_E2		= 0x29,
+	PEGODA_CMD_ACTIVE_ANTENNA_MASTER	= 0x2a,
+	PEGODA_CMD_ACTIVE_ANTENNA_SLAVE		= 0x2b,
+
+	PEGODA_CMD_HOST_TRANS_TMR_START		= 0x30,
+	PEGODA_CMD_HOST_TRANS_TMR_STOP		= 0x31,
+	PEGODA_CMD_HOST_GET_EXEC_TIME		= 0x32,
+
+	PEGODA_CMD_PICC_COMMON_REQUEST		= 0x40,
+	PEGODA_CMD_PICC_CASC_ANTICOLL		= 0x41,
+	PEGODA_CMD_PICC_CASC_SELECT		= 0x42,
+	PEGODA_CMD_PICC_ACTIVATE_IDLE		= 0x43,
+	PEGODA_CMD_PICC_ACTIVATE_WAKEUP		= 0x44,
+	PEGODA_CMD_PCD_SET_DEFAULT_ATTRIB	= 0x45,
+	PEGODA_CMD_PCD_SET_ATTRIB		= 0x46,
+	PEGODA_CMD_PCD_GET_ATTRIB		= 0x47,
+	PEGODA_CMD_PICC_EXCHANGE_BLOCK		= 0x48,
+	PEGODA_CMD_PICC_ACTIVATE_IDLE_LOOP	= 0x49,
+	PEGODA_CMD_PICC_ACTTIVATION		= 0x4a,
+	PEGODA_CMD_PCD_ENABLE_HIGH_BAUD_RATES	= 0x4b,
+
+	PEGODA_CMD_SWITCH_LED			= 0x60,
+	PEGODA_CMD_TEST_FLASH_NR		= 0x61,
+	PEGODA_CMD_START_DOWNLOAD		= 0x62,
+	PEGODA_CMD_GET_FW_VERSION		= 0x63,
+	PEGODA_CMD_GET_RIC_VERSION		= 0x64,
+	PEGODA_CMD_ENABLE_DEBUG_PINS		= 0x65,
+	PEGODA_CMD_MIRROR_DATA			= 0x66,
+	PEGODA_CMD_TEST_CMDS			= 0x67,
+
+	PEGODA_CMD_TEST_PCD			= 0x70,
+	PEGODA_CMD_TEST_PICC			= 0x71,
+	PEGODA_CMD_GET_ONLINE_STATUS		= 0x72,
+
+	PEGODA_CMD_I1_PCD_CONFIG		= 0x80,
+	PEGODA_CMD_I1_INIT_STD_MODE		= 0x81,
+	PEGODA_CMD_I1_CALC_TSE_HASH		= 0x82,
+	PEGODA_CMD_I1_INIT_FAST_MODE		= 0x83,
+	PEGODA_CMD_I1_OUTPUT_READ		= 0x85,
+	PEGODA_CMD_I1_OUTPUT_ANTICOL_SELECT	= 0x86,
+	PEGODA_CMD_I1_OUTPUT_WRITE		= 0x87,
+	PEGODA_CMD_I1_OUTPUT_HALT		= 0x88,
+	PEGODA_CMD_I1_OUTPUT_EAS		= 0x89,
+	PEGODA_CMD_I1_RESET_QUIET		= 0x8a,
+	PEGODA_CMD_I1_PCD_RF_RESET		= 0x8b,
+	PEGODA_CMD_I1_SET_BIT_PHASE		= 0x8c,
+
+	PEGODA_CMD_I2_INIT_STD_MODE		= 0x90,
+	PEGODA_CMD_I2_INIT_FAST_MODE		= 0x91,
+	PEGODA_CMD_15693_READ_SM		= 0x92,
+	PEGODA_CMD_15693_INVENTORY		= 0x93,
+	PEGODA_CMD_15693_WRITE_SM		= 0x94,
+	PEGODA_CMD_15693_STAY_QUIET		= 0x95,
+	PEGODA_CMD_15693_LOCK_BLOCK		= 0x96,
+	PEGODA_CMD_15693_SELECT			= 0x97,
+	PEGODA_CMD_15693_RESET_TO_READY		= 0x98,
+	PEGODA_CMD_15693_WRITE_AFI		= 0x99,
+	PEGODA_CMD_15693_LOCK_AFI		= 0x9a,
+	PEGODA_CMD_15693_WRITE_DSFID		= 0x9b,
+	PEGODA_CMD_15693_LOCK_DSFID		= 0x9c,
+	PEGODA_CMD_15693_GET_SYSTEM_INFO	= 0x9d,
+	PEGODA_CMD_15693_GET_MULTI_BLOCK_SEC	= 0x9e,
+	PEGODA_CMD_15693_INVENTORY_READ		= 0x9f,
+	PEGODA_CMD_15693_FAST_INVENTORY_READ	= 0xa0,
+	PEGODA_CMD_15693_SET_EAS		= 0xa1,
+	PEGODA_CMD_15693_RESET_EAS		= 0xa2,
+	PEGODA_CMD_15693_LOCK_EAS		= 0xa3,
+	PEGODA_CMD_15693_EAS_ALARM		= 0xa4,
+
+	PEGODA_CMD_PC_PCD_CONFIG		= 0xb0,
+	PEGODA_CMD_PC_BEGIN_ROUND		= 0xb1,
+	PEGODA_CMD_PC_WRITE			= 0xb3,
+
+	PEGODA_CMD_UID_PCD_CONFIG		= 0xb8,
+	PEGODA_CMD_UID_BEGIN_ROUND		= 0xb9,
+	PEGODA_CMD_UID_WRITE			= 0xba,
+	PEGODA_CMD_UID_DESTROY			= 0xbb,
+};
+
+#endif