Merge branch 'master' of https://github.com/Proxmark/proxmark3

Conflicts: armsrc/Makefile armsrc/appmain.c armsrc/apps.h armsrc/epa.c armsrc/iclass.c armsrc/iso14443a.c armsrc/iso14443a.h armsrc/iso15693.c armsrc/lfops.c armsrc/mifarecmd.c armsrc/mifareutil.c armsrc/mifareutil.h armsrc/string.h armsrc/util.h bootrom/bootrom.c client/Makefile client/cmddata.c client/cmddata.h client/cmdhf.c client/cmdhf14a.c client/cmdhf14b.c client/cmdhf15.c client/cmdhficlass.c client/cmdhfmf.c client/cmdhfmfu.c client/cmdlf.c client/cmdlfem4x.c client/cmdlfhid.c client/cmdlfhitag.c client/cmdlfio.c client/cmdmain.c client/data.h client/flash.c client/graph.c client/graph.h client/loclass/elite_crack.c client/loclass/fileutils.c client/lualibs/commands.lua client/lualibs/html_dumplib.lua client/lualibs/mf_default_keys.lua client/lualibs/utils.lua client/mifarehost.c client/nonce2key/crapto1.c client/proxmark3.c client/scripting.c client/scripts/tnp3dump.lua client/scripts/tnp3sim.lua client/scripts/tracetest.lua common/Makefile.common common/cmd.c common/cmd.h common/lfdemod.c common/lfdemod.h common/usb_cdc.c common/usb_cdc.h include/usb_cmd.h
2026-05-12 11:18:11 -07:00 · 2015-01-29 21:39:33 +01:00
parent f004ba08d4 92623113b4
commit 64d1b4efc9
104 changed files with 462564 additions and 5330 deletions
@@ -0,0 +1,97 @@
+//-----------------------------------------------------------------------------
+// Jonathan Westhues, Aug 2005
+// Gerhard de Koning Gans, April 2008, May 2011
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// BigBuf and functions to allocate/free parts of it.
+//-----------------------------------------------------------------------------
+
+#include <stdint.h>
+#include "proxmark3.h"
+#include "apps.h"
+#include "string.h"
+
+// BigBuf is the large multi-purpose buffer, typically used to hold A/D samples or traces.
+// Also used to hold various smaller buffers and the Mifare Emulator Memory.
+
+// declare it as uint32_t to achieve alignment to 4 Byte boundary
+static uint32_t BigBuf[BIGBUF_SIZE/sizeof(uint32_t)];
+
+// High memory mark
+static uint16_t BigBuf_hi = BIGBUF_SIZE;
+
+// pointer to the emulator memory.
+static uint8_t *emulator_memory = NULL;
+
+// trace related global variables
+// (only one left). ToDo: make this static as well?
+uint16_t traceLen = 0;
+
+
+// get the address of BigBuf
+uint8_t *BigBuf_get_addr(void)
+{
+	return (uint8_t *)BigBuf;
+}
+
+
+// get the address of the emulator memory. Allocate part of Bigbuf for it, if not yet done
+uint8_t *BigBuf_get_EM_addr(void)
+{
+	if (emulator_memory == NULL) {		// not yet allocated
+		emulator_memory = BigBuf_malloc(CARD_MEMORY_SIZE);
+	}
+	
+	return emulator_memory;
+}
+
+
+// clear ALL of BigBuf
+void BigBuf_Clear(void)
+{
+	memset(BigBuf,0,BIGBUF_SIZE);
+	Dbprintf("Buffer cleared (%i bytes)",BIGBUF_SIZE);
+}
+
+
+// allocate a chunk of memory from BigBuf. We allocate high memory first. The unallocated memory
+// at the beginning of BigBuf is always for traces/samples
+uint8_t *BigBuf_malloc(uint16_t chunksize)
+{
+	if (BigBuf_hi - chunksize < 0) { 
+		return NULL;							// no memory left
+	} else {
+		chunksize = (chunksize + 3) & 0xfffc;	// round to next multiple of 4
+		BigBuf_hi -= chunksize; 		  		// aligned to 4 Byte boundary 
+		return (uint8_t *)BigBuf + BigBuf_hi;
+	}
+}
+
+
+// free ALL allocated chunks. The whole BigBuf is available for traces or samples again.
+void BigBuf_free(void)
+{
+	BigBuf_hi = BIGBUF_SIZE;
+	emulator_memory = NULL;
+}
+
+
+// free allocated chunks EXCEPT the emulator memory
+void BigBuf_free_keep_EM(void)
+{
+	if (emulator_memory != NULL) {
+		BigBuf_hi = emulator_memory - (uint8_t *)BigBuf;
+	} else {
+		BigBuf_hi = BIGBUF_SIZE;
+	}
+}
+
+
+// return the maximum trace length (i.e. the unallocated size of BigBuf)
+uint16_t BigBuf_max_traceLen(void)
+{
+	return BigBuf_hi;
+}
@@ -0,0 +1,34 @@
+//-----------------------------------------------------------------------------
+// Jonathan Westhues, Aug 2005
+// Gerhard de Koning Gans, April 2008, May 2011
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// BigBuf and functions to allocate/free parts of it.
+//-----------------------------------------------------------------------------
+
+#ifndef __BIGBUF_H
+#define __BIGBUF_H
+
+
+#define BIGBUF_SIZE				40000
+#define MAX_FRAME_SIZE			256		// maximum allowed ISO14443 frame
+#define MAX_PARITY_SIZE			((MAX_FRAME_SIZE + 7) / 8)
+#define MAX_MIFARE_FRAME_SIZE	18		// biggest Mifare frame is answer to a read (one block = 16 Bytes) + 2 Bytes CRC
+#define MAX_MIFARE_PARITY_SIZE	3		// need 18 parity bits for the 18 Byte above. 3 Bytes are enough to store these
+#define CARD_MEMORY_SIZE		4096	
+#define DMA_BUFFER_SIZE    		128
+
+extern uint8_t *BigBuf_get_addr(void);
+extern uint8_t *BigBuf_get_EM_addr(void);
+extern uint16_t BigBuf_max_traceLen(void);
+void BigBuf_Clear(void);
+extern uint8_t *BigBuf_malloc(uint16_t);
+extern void BigBuf_free(void);
+extern void BigBuf_free_keep_EM(void);
+
+extern uint16_t traceLen;
+
+#endif /* __BIGBUF_H */
@@ -16,9 +16,9 @@ APP_CFLAGS	= -DWITH_LF -DWITH_ISO15693 -DWITH_ISO14443a -DWITH_ISO14443b -DWITH_
 #SRC_LCD = fonts.c LCD.c
 SRC_LF = lfops.c hitag2.c
 SRC_ISO15693 = iso15693.c iso15693tools.c 
-SRC_ISO14443a = epa.c iso14443a.c mifareutil.c mifarecmd.c mifaresniff.c 
-SRC_ISO14443b = iso14443.c 
-SRC_CRAPTO1 = crapto1.c crypto1.c des.c aes.c desfire_key.c desfire_crypto.c mifaredesfire.c
+SRC_ISO14443a = epa.c iso14443a.c mifareutil.c mifarecmd.c mifaresniff.c
+SRC_ISO14443b = iso14443.c
+SRC_CRAPTO1 = crapto1.c crypto1.c des.c aes.c 
 SRC_CRC = iso14443crc.c crc.c crc16.c crc32.c 

 THUMBSRC = start.c \
@@ -41,7 +41,8 @@ ARMSRC = fpgaloader.c \
 	$(SRC_CRAPTO1) \
 	$(SRC_CRC) \
 	legic_prng.c \
-	iclass.c
+	iclass.c \
+	BigBuf.c \


 # stdint.h provided locally until GCC 4.5 becomes C99 compliant
@@ -36,18 +36,12 @@
 // is the order in which they go out on the wire.
 //=============================================================================

-#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2) // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits
+#define TOSEND_BUFFER_SIZE (9*MAX_FRAME_SIZE + 1 + 1 + 2)  // 8 data bits and 1 parity bit per payload byte, 1 correction bit, 1 SOC bit, 2 EOC bits 
 uint8_t ToSend[TOSEND_BUFFER_SIZE];
 int ToSendMax;
 static int ToSendBit;
 struct common_area common_area __attribute__((section(".commonarea")));

-void BufferClear(void)
-{
-	memset(BigBuf,0,sizeof(BigBuf));
-	Dbprintf("Buffer cleared (%i bytes)",sizeof(BigBuf));
-}
-
 void ToSendReset(void)
 {
 	ToSendMax = -1;
@@ -68,7 +62,7 @@ void ToSendStuffBit(int b)

 	ToSendBit++;

-	if(ToSendMax  >= sizeof(ToSend)) {
+	if(ToSendMax >= sizeof(ToSend)) {
 		ToSendBit = 0;
 		DbpString("ToSendStuffBit overflowed!");
 	}
@@ -246,7 +240,10 @@ void MeasureAntennaTuningHf(void)

 void SimulateTagHfListen(void)
 {
-	uint8_t *dest = (uint8_t *)BigBuf+FREE_BUFFER_OFFSET;
+	// ToDo: historically this used the free buffer, which was 2744 Bytes long. 
+	// There might be a better size to be defined:
+	#define HF_14B_SNOOP_BUFFER_SIZE 2744
+	uint8_t *dest = BigBuf_malloc(HF_14B_SNOOP_BUFFER_SIZE);
 	uint8_t v = 0;
 	int i;
 	int p = 0;
@@ -281,7 +278,7 @@ void SimulateTagHfListen(void)
 				p = 0;
 				i++;

-				if(i >= FREE_BUFFER_SIZE) {
+				if(i >= HF_14B_SNOOP_BUFFER_SIZE) {
 					break;
 				}
 			}
@@ -811,11 +808,11 @@ void UsbPacketReceived(uint8_t *packet, int len)
 			MifareUC_Auth2(c->arg[0],c->d.asBytes);
 			break;
 		case CMD_MIFAREU_READCARD:
-			MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
+			MifareUReadCard(c->arg[0], c->arg[1], c->d.asBytes);
                        break;
 		case CMD_MIFAREUC_READCARD:
-			MifareUReadCard(c->arg[0],c->arg[1],c->d.asBytes);
-                        break;
+			MifareUReadCard(c->arg[0], c->arg[1], c->d.asBytes);
+			break;
 		case CMD_MIFARE_READSC:
 			MifareReadSector(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
 			break;
@@ -870,27 +867,6 @@ void UsbPacketReceived(uint8_t *packet, int len)
 		case CMD_MIFARE_SNIFFER:
 			SniffMifare(c->arg[0]);
 			break;
-			
-		// mifare desfire
-		case CMD_MIFARE_DESFIRE_READBL:
-			break;
-		case CMD_MIFARE_DESFIRE_WRITEBL:
-			break;
-		case CMD_MIFARE_DESFIRE_AUTH1:
-			MifareDES_Auth1(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
-			break;
-		case CMD_MIFARE_DESFIRE_AUTH2:
-			//MifareDES_Auth2(c->arg[0],c->d.asBytes);
-			break;
-		// case CMD_MIFARE_DES_READER:
-			// ReaderMifareDES(c->arg[0], c->arg[1], c->d.asBytes);
-			//break;
-		case CMD_MIFARE_DESFIRE_INFO:
-			MifareDesfireGetInformation();
-			break;
-		case CMD_MIFARE_DESFIRE:
-			MifareSendCommand(c->arg[0], c->arg[1], c->d.asBytes);
-			break;

 #endif

@@ -915,7 +891,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
 			break;

 		case CMD_BUFF_CLEAR:
-			BufferClear();
+			BigBuf_Clear();
 			break;

 		case CMD_MEASURE_ANTENNA_TUNING:
@@ -939,17 +915,18 @@ void UsbPacketReceived(uint8_t *packet, int len)
 		case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:

 			LED_B_ON();
+			uint8_t *BigBuf = BigBuf_get_addr();
 			for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
 				size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
-				cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
+				cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,traceLen,BigBuf+c->arg[0]+i,len);
 			}
 			// Trigger a finish downloading signal with an ACK frame
-			cmd_send(CMD_ACK,0,0,0,0,0);
+			cmd_send(CMD_ACK,0,0,traceLen,0,0);
 			LED_B_OFF();
 			break;

 		case CMD_DOWNLOADED_SIM_SAMPLES_125K: {
-			uint8_t *b = (uint8_t *)BigBuf;
+			uint8_t *b = BigBuf_get_addr();
 			memcpy(b+c->arg[0], c->d.asBytes, USB_CMD_DATA_SIZE);
 			cmd_send(CMD_ACK,0,0,0,0,0);
 			break;
@@ -18,40 +18,10 @@
 #include <sys/types.h>
 #include <string.h>
 #include <strings.h>
-
-#include "../include/common.h"
-#include "../include/hitag2.h"
-#include "../include/mifare.h"
-
-//#include <openssl/des.h>
-//#include <openssl/aes.h>
-//#include "des.h"
-//#include "aes.h"
-#include "../common/desfire.h"
 #include "../common/crc32.h"
-
-// The large multi-purpose buffer, typically used to hold A/D samples,
-// maybe processed in some way.
-#define BIGBUF_SIZE	40000      
-uint32_t BigBuf[BIGBUF_SIZE / sizeof(uint32_t)];
-#define TRACE_OFFSET	0
-#define TRACE_SIZE	3000
-#define RECV_CMD_OFFSET	(TRACE_OFFSET + TRACE_SIZE)
-#define MAX_FRAME_SIZE	256
-#define MAX_PARITY_SIZE	((MAX_FRAME_SIZE + 1)/ 8)
-#define RECV_CMD_PAR_OFFSET	(RECV_CMD_OFFSET + MAX_FRAME_SIZE)
-#define RECV_RESP_OFFSET	(RECV_CMD_PAR_OFFSET + MAX_PARITY_SIZE)
-#define RECV_RESP_PAR_OFFSET (RECV_RESP_OFFSET + MAX_FRAME_SIZE)
-#define CARD_MEMORY_OFFSET	(RECV_RESP_PAR_OFFSET + MAX_PARITY_SIZE)
-#define CARD_MEMORY_SIZE	4096	
-#define DMA_BUFFER_OFFSET CARD_MEMORY_OFFSET
-#define DMA_BUFFER_SIZE CARD_MEMORY_SIZE
-#define FREE_BUFFER_OFFSET (CARD_MEMORY_OFFSET + CARD_MEMORY_SIZE)
-#define FREE_BUFFER_SIZE (BIGBUF_SIZE - FREE_BUFFER_OFFSET - 1)
+#include "BigBuf.h"

 extern const uint8_t OddByteParity[256];
-extern uint8_t *trace; // = (uint8_t *) BigBuf;
-extern int traceLen;   // = 0;
 extern int rsamples;   // = 0;
 extern int tracing;    // = TRUE;
 extern uint8_t trigger;
@@ -82,7 +52,6 @@ void DoAcquisition125k();

 extern int ToSendMax;
 extern uint8_t ToSend[];
-extern uint32_t BigBuf[];

 /// fpga.h
 void FpgaSendCommand(uint16_t cmd, uint16_t v);
@@ -130,6 +99,8 @@ void SetAdcMuxFor(uint32_t whichGpio);
 #define FPGA_HF_SIMULATOR_MODULATE_BPSK				(1<<0)
 #define FPGA_HF_SIMULATOR_MODULATE_212K				(2<<0)
 #define FPGA_HF_SIMULATOR_MODULATE_424K				(4<<0)
+#define FPGA_HF_SIMULATOR_MODULATE_424K_8BIT		0x5//101
+
 // Options for ISO14443A
 #define FPGA_HF_ISO14443A_SNIFFER				(0<<0)
 #define FPGA_HF_ISO14443A_TAGSIM_LISTEN				(1<<0)
@@ -181,7 +152,7 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data);
 void ReaderIso14443a(UsbCommand * c);
 // Also used in iclass.c
 bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t len, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag);
-void GetParity(const uint8_t * pbtCmd, uint16_t len, uint8_t *parity);
+void GetParity(const uint8_t *pbtCmd, uint16_t len, uint8_t *parity);
 void iso14a_set_trigger(bool enable);
 void iso14a_clear_trace();
 void iso14a_set_tracing(bool enable);
@@ -231,17 +202,6 @@ void 	OnError(uint8_t reason);



-// desfire_crypto.h
-void	*mifare_cryto_preprocess_data (desfiretag_t tag, void *data, size_t *nbytes, off_t offset, int communication_settings);
-void    *mifare_cryto_postprocess_data (desfiretag_t tag, void *data, ssize_t *nbytes, int communication_settings);
-void    mifare_cypher_single_block (desfirekey_t  key, uint8_t *data, uint8_t *ivect, MifareCryptoDirection direction, MifareCryptoOperation operation, size_t block_size);
-void    mifare_cypher_blocks_chained (desfiretag_t tag, desfirekey_t key, uint8_t *ivect, uint8_t *data, size_t data_size, MifareCryptoDirection direction, MifareCryptoOperation operation);
-size_t  key_block_size (const desfirekey_t  key);
-size_t  padded_data_length (const size_t nbytes, const size_t block_size);
-size_t  maced_data_length (const desfirekey_t  key, const size_t nbytes);
-size_t  enciphered_data_length (const desfiretag_t tag, const size_t nbytes, int communication_settings);
-void    cmac_generate_subkeys (desfirekey_t key);
-void    cmac (const desfirekey_t  key, uint8_t *ivect, const uint8_t *data, size_t len, uint8_t *cmac);


 /// iso15693.h
@@ -435,6 +435,8 @@ int EPA_Setup()
 	
 	iso14a_set_timeout(10500);
 	
+	iso14a_set_timeout(10500);
+	
 	// select the card
 	return_code = iso14443a_select_card(uid, &card_select_info, NULL);
 	if (return_code != 1) {
@@ -24,15 +24,19 @@

 static bool bQuiet;

-bool bCrypto;
-bool bAuthenticating;
-bool bPwd;
-bool bSuccessful;
+static bool bCrypto;
+static bool bAuthenticating;
+static bool bPwd;
+static bool bSuccessful;

-int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int bReader)
+
+static int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int bReader)
 {
+  static uint16_t traceLen = 0;
+  uint8_t *trace = BigBuf_get_addr();
+
  // Return when trace is full
-  if (traceLen >= TRACE_SIZE) return FALSE;
+  if (traceLen + sizeof(rsamples) + sizeof(dwParity) + sizeof(iBits) + nbytes(iBits) > BigBuf_max_traceLen()) return FALSE;
  
  // Trace the random, i'm curious
  rsamples += iSamples;
@@ -85,21 +89,17 @@ static struct hitag2_tag tag = {
    },
 };

-//#define TRACE_LENGTH 3000
-//uint8_t *trace = (uint8_t *) BigBuf;
-//int traceLen = 0;
-//int rsamples = 0;
+// ToDo: define a meaningful maximum size for auth_table. The bigger this is, the lower will be the available memory for traces. 
+// Historically it used to be FREE_BUFFER_SIZE, which was 2744.
+#define AUTH_TABLE_LENGTH 2744
+static byte_t* auth_table;
+static size_t auth_table_pos = 0;
+static size_t auth_table_len = AUTH_TABLE_LENGTH;

-#define AUTH_TABLE_OFFSET FREE_BUFFER_OFFSET
-#define AUTH_TABLE_LENGTH FREE_BUFFER_SIZE
-byte_t* auth_table = (byte_t *)BigBuf+AUTH_TABLE_OFFSET;
-size_t auth_table_pos = 0;
-size_t auth_table_len = AUTH_TABLE_LENGTH;
-
-byte_t password[4];
-byte_t NrAr[8];
-byte_t key[8];
-uint64_t cipher_state;
+static byte_t password[4];
+static byte_t NrAr[8];
+static byte_t key[8];
+static uint64_t cipher_state;

 /* Following is a modified version of cryptolib.com/ciphers/hitag2/ */
 // Software optimized 48-bit Philips/NXP Mifare Hitag2 PCF7936/46/47/52 stream cipher algorithm by I.C. Wiener 2006-2007.
@@ -177,14 +177,14 @@ static u32 _hitag2_byte (u64 * x)
 	return c;
 }

-int hitag2_reset(void)
+static int hitag2_reset(void)
 {
 	tag.state = TAG_STATE_RESET;
 	tag.crypto_active = 0;
 	return 0;
 }

-int hitag2_init(void)
+static int hitag2_init(void)
 {
 //	memcpy(&tag, &resetdata, sizeof(tag));
 	hitag2_reset();
@@ -300,7 +300,8 @@ static void hitag_send_frame(const byte_t* frame, size_t frame_len)
 	LOW(GPIO_SSC_DOUT);
 }

-void hitag2_handle_reader_command(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen)
+
+static void hitag2_handle_reader_command(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen)
 {
 	byte_t rx_air[HITAG_FRAME_LEN];
 	
@@ -457,6 +458,7 @@ static void hitag_reader_send_bit(int bit) {
 	LED_A_OFF();
 }

+
 static void hitag_reader_send_frame(const byte_t* frame, size_t frame_len)
 {
 	// Send the content of the frame
@@ -475,7 +477,7 @@ static void hitag_reader_send_frame(const byte_t* frame, size_t frame_len)

 size_t blocknr;

-bool hitag2_password(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
+static bool hitag2_password(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
 	// Reset the transmission frame length
 	*txlen = 0;
 	
@@ -530,7 +532,7 @@ bool hitag2_password(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen)
 	return true;
 }

-bool hitag2_crypto(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
+static bool hitag2_crypto(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
 	// Reset the transmission frame length
 	*txlen = 0;
 	
@@ -623,7 +625,7 @@ bool hitag2_crypto(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
 }


-bool hitag2_authenticate(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
+static bool hitag2_authenticate(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
 	// Reset the transmission frame length 
 	*txlen = 0;
 	
@@ -663,7 +665,9 @@ bool hitag2_authenticate(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txl
 	return true;
 }

-bool hitag2_test_auth_attempts(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
+
+static bool hitag2_test_auth_attempts(byte_t* rx, const size_t rxlen, byte_t* tx, size_t* txlen) {
+
 	// Reset the transmission frame length 
 	*txlen = 0;
 	
@@ -675,17 +679,17 @@ bool hitag2_test_auth_attempts(byte_t* rx, const size_t rxlen, byte_t* tx, size_
 			if (bCrypto) {
 				Dbprintf("auth: %02x%02x%02x%02x%02x%02x%02x%02x Failed, removed entry!",NrAr[0],NrAr[1],NrAr[2],NrAr[3],NrAr[4],NrAr[5],NrAr[6],NrAr[7]);

-        // Removing failed entry from authentiations table
-        memcpy(auth_table+auth_table_pos,auth_table+auth_table_pos+8,8);
-        auth_table_len -= 8;
+				// Removing failed entry from authentiations table
+				memcpy(auth_table+auth_table_pos,auth_table+auth_table_pos+8,8);
+				auth_table_len -= 8;

-        // Return if we reached the end of the authentiactions table
+				// Return if we reached the end of the authentications table
 				bCrypto = false;
 				if (auth_table_pos == auth_table_len) {
 					return false;
 				}
-        
-        // Copy the next authentication attempt in row (at the same position, b/c we removed last failed entry)
+
+				// Copy the next authentication attempt in row (at the same position, b/c we removed last failed entry)
 				memcpy(NrAr,auth_table+auth_table_pos,8);
 			}
 			*txlen = 5;
@@ -718,6 +722,7 @@ bool hitag2_test_auth_attempts(byte_t* rx, const size_t rxlen, byte_t* tx, size_
 	return true;
 }

+
 void SnoopHitag(uint32_t type) {
 	int frame_count;
 	int response;
@@ -730,13 +735,15 @@ void SnoopHitag(uint32_t type) {
 	byte_t rx[HITAG_FRAME_LEN];
 	size_t rxlen=0;
 	
+	auth_table_len = 0;
+	auth_table_pos = 0;
+	BigBuf_free();
+    auth_table = (byte_t *)BigBuf_malloc(AUTH_TABLE_LENGTH);
+	memset(auth_table, 0x00, AUTH_TABLE_LENGTH);
+
 	// Clean up trace and prepare it for storing frames
 	iso14a_set_tracing(TRUE);
 	iso14a_clear_trace();
-
-	auth_table_len = 0;
-	auth_table_pos = 0;
-	memset(auth_table, 0x00, AUTH_TABLE_LENGTH);
 	
 	DbpString("Starting Hitag2 snoop");
 	LED_D_ON();
@@ -760,7 +767,7 @@ void SnoopHitag(uint32_t type) {
 	AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
 	AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
 	
-  // Disable timer during configuration	
+	// Disable timer during configuration	
 	AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
 	
 	// Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
@@ -940,13 +947,17 @@ void SimulateHitagTag(bool tag_mem_supplied, byte_t* data) {
 	bool bQuitTraceFull = false;
 	bQuiet = false;
 	
-	// Clean up trace and prepare it for storing frames
-  iso14a_set_tracing(TRUE);
-  iso14a_clear_trace();
 	auth_table_len = 0;
 	auth_table_pos = 0;
+    byte_t* auth_table;
+	BigBuf_free();
+    auth_table = (byte_t *)BigBuf_malloc(AUTH_TABLE_LENGTH);
 	memset(auth_table, 0x00, AUTH_TABLE_LENGTH);

+	// Clean up trace and prepare it for storing frames
+	iso14a_set_tracing(TRUE);
+	iso14a_clear_trace();
+
 	DbpString("Starting Hitag2 simulation");
 	LED_D_ON();
 	hitag2_init();
@@ -1126,21 +1137,22 @@ void ReaderHitag(hitag_function htf, hitag_data* htd) {
 	bool bStop;
 	bool bQuitTraceFull = false;
  
-  FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-  // Reset the return status
-  bSuccessful = false;
+	FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
+	// Reset the return status
+	bSuccessful = false;
  
 	// Clean up trace and prepare it for storing frames
-  iso14a_set_tracing(TRUE);
-  iso14a_clear_trace();
+	iso14a_set_tracing(TRUE);
+	iso14a_clear_trace();
+
 	DbpString("Starting Hitag reader family");

 	// Check configuration
 	switch(htf) {
 		case RHT2F_PASSWORD: {
-      Dbprintf("List identifier in password mode");
+			Dbprintf("List identifier in password mode");
 			memcpy(password,htd->pwd.password,4);
-      blocknr = 0;
+      		blocknr = 0;
 			bQuitTraceFull = false;
 			bQuiet = false;
 			bPwd = false;
@@ -1152,7 +1164,7 @@ void ReaderHitag(hitag_function htf, hitag_data* htd) {
 			Dbhexdump(8,NrAr,false);
 			bQuiet = false;
 			bCrypto = false;
-      bAuthenticating = false;
+			bAuthenticating = false;
 			bQuitTraceFull = true;
 		} break;
      
@@ -1160,17 +1172,17 @@ void ReaderHitag(hitag_function htf, hitag_data* htd) {
 			DbpString("Authenticating using key:");
 			memcpy(key,htd->crypto.key,4);	  //HACK; 4 or 6??  I read both in the code.
 			Dbhexdump(6,key,false);
-      blocknr = 0;
+			blocknr = 0;
 			bQuiet = false;
 			bCrypto = false;
-      bAuthenticating = false;
+			bAuthenticating = false;
 			bQuitTraceFull = true;
 		} break;

 		case RHT2F_TEST_AUTH_ATTEMPTS: {
 			Dbprintf("Testing %d authentication attempts",(auth_table_len/8));
 			auth_table_pos = 0;
-			memcpy(NrAr,auth_table,8);
+			memcpy(NrAr, auth_table, 8);
 			bQuitTraceFull = false;
 			bQuiet = false;
 			bCrypto = false;
@@ -339,10 +339,10 @@ void SimulateIso14443Tag(void)
    uint8_t *resp;
    int respLen;

-    uint8_t *resp1 = (((uint8_t *)BigBuf) + 800);
+    uint8_t *resp1 = BigBuf_get_addr() + 800;
    int resp1Len;

-    uint8_t *receivedCmd = (uint8_t *)BigBuf;
+    uint8_t *receivedCmd = BigBuf_get_addr();
    int len;

    int i;
@@ -629,31 +629,32 @@ static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
    int gotFrame = FALSE;

 //#   define DMA_BUFFER_SIZE 8
-    int8_t *dmaBuf;
+    uint8_t *dmaBuf;

    int lastRxCounter;
-    int8_t *upTo;
+    uint8_t *upTo;

    int ci, cq;

    int samples = 0;

    // Clear out the state of the "UART" that receives from the tag.
+	uint8_t *BigBuf = BigBuf_get_addr();
    memset(BigBuf, 0x00, 400);
-    Demod.output = (uint8_t *)BigBuf;
+    Demod.output = BigBuf;
    Demod.len = 0;
    Demod.state = DEMOD_UNSYNCD;

    // And the UART that receives from the reader
-    Uart.output = (((uint8_t *)BigBuf) + 1024);
+    Uart.output = BigBuf + 1024;
    Uart.byteCntMax = 100;
    Uart.state = STATE_UNSYNCD;

    // Setup for the DMA.
-    dmaBuf = (int8_t *)(BigBuf + 32);
+    dmaBuf = BigBuf + 32;
    upTo = dmaBuf;
    lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
-    FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
+    FpgaSetupSscDma(dmaBuf, DEMOD_DMA_BUFFER_SIZE);

    // Signal field is ON with the appropriate LED:
    if (weTx) LED_D_ON(); else LED_D_OFF();
@@ -1012,20 +1013,21 @@ void RAMFUNC SnoopIso14443(void)
    int triggered = TRUE;

    FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+	BigBuf_free();
    // The command (reader -> tag) that we're working on receiving.
-    uint8_t *receivedCmd = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE;
+    uint8_t *receivedCmd = BigBuf_malloc(READER_TAG_BUFFER_SIZE);
    // The response (tag -> reader) that we're working on receiving.
-    uint8_t *receivedResponse = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE;
+    uint8_t *receivedResponse = BigBuf_malloc(TAG_READER_BUFFER_SIZE);

    // As we receive stuff, we copy it from receivedCmd or receivedResponse
    // into trace, along with its length and other annotations.
-    uint8_t *trace = (uint8_t *)BigBuf;
-    int traceLen = 0;
+    uint8_t *trace = BigBuf_get_addr();
+    traceLen = 0;

    // The DMA buffer, used to stream samples from the FPGA.
-    int8_t *dmaBuf = (int8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE + TAG_READER_BUFFER_SIZE;
+    uint8_t *dmaBuf = BigBuf_malloc(DEMOD_DMA_BUFFER_SIZE);
    int lastRxCounter;
-    int8_t *upTo;
+    uint8_t *upTo;
    int ci, cq;
    int maxBehindBy = 0;

@@ -1034,7 +1036,7 @@ void RAMFUNC SnoopIso14443(void)
    int samples = 0;

    // Initialize the trace buffer
-    memset(trace, 0x44, DEMOD_TRACE_SIZE);
+    memset(trace, 0x44, BigBuf_max_traceLen());

    // Set up the demodulator for tag -> reader responses.
    Demod.output = receivedResponse;
@@ -1049,7 +1051,7 @@ void RAMFUNC SnoopIso14443(void)

    // Print some debug information about the buffer sizes
    Dbprintf("Snooping buffers initialized:");
-    Dbprintf("  Trace: %i bytes", DEMOD_TRACE_SIZE);
+    Dbprintf("  Trace: %i bytes", BigBuf_max_traceLen());
    Dbprintf("  Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);
    Dbprintf("  tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);
    Dbprintf("  DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);
@@ -1076,7 +1078,7 @@ void RAMFUNC SnoopIso14443(void)
                                (DEMOD_DMA_BUFFER_SIZE-1);
        if(behindBy > maxBehindBy) {
            maxBehindBy = behindBy;
-            if(behindBy > (DEMOD_DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?
+            if(behindBy > (9*DEMOD_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
                Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
                goto done;
            }
@@ -1147,7 +1149,7 @@ void RAMFUNC SnoopIso14443(void)
            trace[traceLen++] = Demod.len;
            memcpy(trace+traceLen, receivedResponse, Demod.len);
            traceLen += Demod.len;
-            if(traceLen > DEMOD_TRACE_SIZE) {
+            if(traceLen > BigBuf_max_traceLen()) {
 				DbpString("Reached trace limit");
 				goto done;
 			}
@@ -1173,9 +1175,9 @@ done:
 	LED_A_OFF();
 	LED_B_OFF();
 	LED_C_OFF();
-  AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
+	AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
 	DbpString("Snoop statistics:");
-  Dbprintf("  Max behind by: %i", maxBehindBy);
+	Dbprintf("  Max behind by: %i", maxBehindBy);
 	Dbprintf("  Uart State: %x", Uart.state);
 	Dbprintf("  Uart ByteCnt: %i", Uart.byteCnt);
 	Dbprintf("  Uart ByteCntMax: %i", Uart.byteCntMax);
@@ -28,8 +28,8 @@ typedef struct {
 	uint16_t bitCount;
 	uint16_t collisionPos;
 	uint16_t syncBit;
-	uint8_t parityBits;
-	uint8_t parityLen;
+	uint8_t  parityBits;
+	uint8_t  parityLen;
 	uint16_t shiftReg;
 	uint16_t samples;
 	uint16_t len;
@@ -61,8 +61,8 @@ typedef struct {
 	uint16_t byteCntMax;
 	uint16_t posCnt;
 	uint16_t syncBit;
-	uint8_t parityBits;
-	uint8_t parityLen;
+	uint8_t  parityBits;
+	uint8_t  parityLen;
 	uint16_t highCnt;
 	uint16_t twoBits;
 	uint32_t startTime, endTime;
@@ -58,13 +58,12 @@
 // *) document all the functions


-#include "../include/proxmark3.h"
+#include "proxmark3.h"
 #include "util.h"
 #include "apps.h"
 #include "string.h"
-#include "../common/iso15693tools.h"
-#include "../common/cmd.h"
-
+#include "iso15693tools.h"
+#include "cmd.h"

 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))

@@ -297,7 +296,7 @@ static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int
 static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 {
 	int c = 0;
-	uint8_t *dest = (uint8_t *)BigBuf;
+	uint8_t *dest = BigBuf_get_addr();
 	int getNext = 0;

 	int8_t prev = 0;
@@ -447,12 +446,12 @@ static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *
 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 {
 	int c = 0;
-	uint8_t *dest = (uint8_t *)BigBuf;
+	uint8_t *dest = BigBuf_get_addr();
 	int getNext = 0;

 	int8_t prev = 0;

-    // NOW READ RESPONSE
+// NOW READ RESPONSE
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 	//spindelay(60);	// greg - experiment to get rid of some of the 0 byte/failed reads
 	c = 0;
@@ -468,7 +467,7 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
 			// tone that the tag AM-modulates, so every other sample is I,
 			// every other is Q. We just want power, so abs(I) + abs(Q) is
 			// close to what we want.
-			if (getNext) {
+			if(getNext) {
 				int8_t r;

 				if(b < 0) {
@@ -597,7 +596,7 @@ static void BuildIdentifyRequest(void);
 //-----------------------------------------------------------------------------
 void AcquireRawAdcSamplesIso15693(void)
 {
-	uint8_t *dest = (uint8_t *)BigBuf;
+	uint8_t *dest = BigBuf_get_addr();

 	int c = 0;
 	int getNext = 0;
@@ -679,7 +678,7 @@ void AcquireRawAdcSamplesIso15693(void)

 void RecordRawAdcSamplesIso15693(void)
 {
-	uint8_t *dest =  (uint8_t *)BigBuf;
+	uint8_t *dest = BigBuf_get_addr();

 	int c = 0;
 	int getNext = 0;
@@ -690,8 +689,8 @@ void RecordRawAdcSamplesIso15693(void)
 	FpgaSetupSsc();

 	// Start from off (no field generated)
-   	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-   	SpinDelay(200);
+    	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    	SpinDelay(200);

 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

@@ -879,8 +878,8 @@ int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv)
 	LED_D_OFF();
 	
 	int answerLen=0;
-	uint8_t *answer = (((uint8_t *)BigBuf) + 3660);
-	if (recv!=NULL) memset(BigBuf + 3660, 0, 100);
+	uint8_t *answer = BigBuf_get_addr() + 3660;
+	if (recv != NULL) memset(answer, 0, 100);

 	if (init) Iso15693InitReader();
 	
@@ -993,16 +992,16 @@ void SetDebugIso15693(uint32_t debug) {
 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
 // all demodulation performed in arm rather than host. - greg
 //-----------------------------------------------------------------------------
-void ReaderIso15693(uint32_t parameter )
+void ReaderIso15693(uint32_t parameter)
 {
 	LED_A_ON();
 	LED_B_ON();
 	LED_C_OFF();
 	LED_D_OFF();

-	uint8_t *answer1 = (((uint8_t *)BigBuf) + 3660); //
-	uint8_t *answer2 = (((uint8_t *)BigBuf) + 3760);
-	uint8_t *answer3 = (((uint8_t *)BigBuf) + 3860);
+	uint8_t *answer1 = BigBuf_get_addr() + 3660;
+	uint8_t *answer2 = BigBuf_get_addr() + 3760;
+	uint8_t *answer3 = BigBuf_get_addr() + 3860;

 	int answerLen1 = 0;
 	int answerLen2 = 0;
@@ -1014,9 +1013,9 @@ void ReaderIso15693(uint32_t parameter )
 	int elapsed = 0;
 	uint8_t TagUID[8] = {0x00};

-	 
+
 	// Blank arrays
-	memset(BigBuf + 3660, 0x00, 300);
+	memset(answer1, 0x00, 300);

 	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

@@ -1025,9 +1024,9 @@ void ReaderIso15693(uint32_t parameter )
 	FpgaSetupSsc();

 	// Start from off (no field generated)
-   	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-   	SpinDelay(200);
-	
+    	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    	SpinDelay(200);
+
 	// Give the tags time to energize
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 	SpinDelay(200);
@@ -1066,7 +1065,7 @@ void ReaderIso15693(uint32_t parameter )
 	Dbhexdump(answerLen1,answer1,true);

 	// UID is reverse
-	if (answerLen1 >= 12) 
+	if (answerLen1>=12) 
 		Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
 			TagUID[7],TagUID[6],TagUID[5],TagUID[4],
 			TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
@@ -1080,14 +1079,14 @@ void ReaderIso15693(uint32_t parameter )
 	DbdecodeIso15693Answer(answerLen3,answer3);
 	Dbhexdump(answerLen3,answer3,true);

- 	// read all pages
-	if (answerLen1 >= 12 && DEBUG) {
+	// read all pages
+	if (answerLen1>=12 && DEBUG) {
 		i=0;			
-		while (i < 32) {  // sanity check, assume max 32 pages
+		while (i<32) {  // sanity check, assume max 32 pages
 			BuildReadBlockRequest(TagUID,i);
-			TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);  
-			answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
-			if (answerLen2 > 0) {
+	      TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);  
+         answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
+			if (answerLen2>0) {
 				Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
 				DbdecodeIso15693Answer(answerLen2,answer2);
 				Dbhexdump(answerLen2,answer2,true);
@@ -1112,16 +1111,16 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 	LED_C_OFF();
 	LED_D_OFF();

-	uint8_t *buf = (((uint8_t *)BigBuf) + 3660); //
+	uint8_t *buf = BigBuf_get_addr() + 3660;
 	
 	int answerLen1 = 0;
 	int samples = 0;
 	int tsamples = 0;
 	int wait = 0;
 	int elapsed = 0;
-	
+
 	memset(buf, 0x00, 100);
-	
+
 	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
@@ -1129,8 +1128,8 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 	FpgaSetupSsc();

 	// Start from off (no field generated)
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    SpinDelay(200);
+    	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	SpinDelay(200);

 	LED_A_OFF();
 	LED_B_OFF();
@@ -1147,7 +1146,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 		
 		BuildInventoryResponse(uid);
 	
-		TransmitTo15693Reader(ToSend, ToSendMax, &tsamples, &wait);
+		TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
 	}

 	Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
@@ -1214,7 +1213,7 @@ void BruteforceIso15693Afi(uint32_t speed)
 void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {

 	int recvlen=0;
-	uint8_t *recvbuf=(uint8_t *)BigBuf;
+	uint8_t *recvbuf = BigBuf_get_addr();
 //	UsbCommand n;
 	
 	if (DEBUG) {
@@ -98,13 +98,14 @@ static uint32_t get_key_stream(int skip, int count)
  }

  /* Write Time Data into LOG */
+  uint8_t *BigBuf = BigBuf_get_addr();
  if(count == 6) { i = -1; } else { i = legic_read_count; }
-  ((uint8_t*)BigBuf)[OFFSET_LOG+128+i] = legic_prng_count();
-  ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4]   = (legic_prng_bc >> 0) & 0xff;
-  ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff;
-  ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff;
-  ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff;
-  ((uint8_t*)BigBuf)[OFFSET_LOG+384+i] = count;
+  BigBuf[OFFSET_LOG+128+i] = legic_prng_count();
+  BigBuf[OFFSET_LOG+256+i*4]   = (legic_prng_bc >> 0) & 0xff;
+  BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff;
+  BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff;
+  BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff;
+  BigBuf[OFFSET_LOG+384+i] = count;

  /* Generate KeyStream */
  for(i=0; i<count; i++) {
@@ -426,6 +427,7 @@ int LegicRfReader(int offset, int bytes) {

 	LegicCommonInit();

+	uint8_t *BigBuf = BigBuf_get_addr();
 	memset(BigBuf, 0, 1024);

 	DbpString("setting up legic card");
@@ -465,7 +467,7 @@ int LegicRfReader(int offset, int bytes) {
       		LED_C_OFF();
 	        return -1;
 		}
-		((uint8_t*)BigBuf)[byte_index] = r;
+		BigBuf[byte_index] = r;
        WDT_HIT();
 		byte_index++;
 		if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF();
@@ -480,7 +482,8 @@ int LegicRfReader(int offset, int bytes) {

 void LegicRfWriter(int bytes, int offset) {
 	int byte_index=0, addr_sz=0;
-	
+	uint8_t *BigBuf = BigBuf_get_addr();
+
 	LegicCommonInit();
 	
 	DbpString("setting up legic card");
@@ -512,7 +515,7 @@ void LegicRfWriter(int bytes, int offset) {
 	perform_setup_phase_rwd(SESSION_IV);
    legic_prng_forward(2);
 	while(byte_index < bytes) {
-		int r = legic_write_byte(((uint8_t*)BigBuf)[byte_index+offset], byte_index+offset, addr_sz);
+		int r = legic_write_byte(BigBuf[byte_index+offset], byte_index+offset, addr_sz);
 		if((r != 0) || BUTTON_PRESS()) {
 			Dbprintf("operation aborted @ 0x%03.3x", byte_index);
 			switch_off_tag_rwd();
@@ -534,6 +537,8 @@ int timestamp;
 /* Handle (whether to respond) a frame in tag mode */
 static void frame_handle_tag(struct legic_frame const * const f)
 {
+	uint8_t *BigBuf = BigBuf_get_addr();
+
   /* First Part of Handshake (IV) */
   if(f->bits == 7) {
     if(f->data == SESSION_IV) {
@@ -582,9 +587,9 @@ static void frame_handle_tag(struct legic_frame const * const f)
      if(legic_state == STATE_CON) {
         int key   = get_key_stream(-1, 11); //legic_phase_drift, 11);
         int addr  = f->data ^ key; addr = addr >> 1;
-         int data = ((uint8_t*)BigBuf)[addr];
+         int data = BigBuf[addr];
         int hash = LegicCRC(addr, data, 11) << 8;
-         ((uint8_t*)BigBuf)[OFFSET_LOG+legic_read_count] = (uint8_t)addr;
+         BigBuf[OFFSET_LOG+legic_read_count] = (uint8_t)addr;
         legic_read_count++;

         //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c);
@@ -619,19 +624,19 @@ static void frame_handle_tag(struct legic_frame const * const f)
      int i;
      Dbprintf("IV: %03.3x", legic_prng_iv);
      for(i = 0; i<legic_read_count; i++) {
-         Dbprintf("Read Nb: %u, Addr: %u", i, ((uint8_t*)BigBuf)[OFFSET_LOG+i]);
+         Dbprintf("Read Nb: %u, Addr: %u", i, BigBuf[OFFSET_LOG+i]);
      }

      for(i = -1; i<legic_read_count; i++) {
         uint32_t t;
-         t  = ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4];
-         t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+1] << 8;
-         t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+2] <<16;
-         t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+3] <<24;
+         t  = BigBuf[OFFSET_LOG+256+i*4];
+         t |= BigBuf[OFFSET_LOG+256+i*4+1] << 8;
+         t |= BigBuf[OFFSET_LOG+256+i*4+2] <<16;
+         t |= BigBuf[OFFSET_LOG+256+i*4+3] <<24;

         Dbprintf("Cycles: %u, Frame Length: %u, Time: %u", 
-            ((uint8_t*)BigBuf)[OFFSET_LOG+128+i],
-            ((uint8_t*)BigBuf)[OFFSET_LOG+384+i],
+            BigBuf[OFFSET_LOG+128+i],
+            BigBuf[OFFSET_LOG+384+i],
            t);
      }
   }
@@ -16,8 +16,8 @@
 #include "mifarecmd.h"
 #include "apps.h"
 #include "util.h"
-#include "desfire.h"
-#include "../common/crc.h"
+
+#include "crc.h"

 //-----------------------------------------------------------------------------
 // Select, Authenticate, Read a MIFARE tag. 
@@ -76,7 +76,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-	if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
+	if (MF_DBGLEVEL >= 2)	DbpString("READ BLOCK FINISHED");

 	LED_B_ON();
 	cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
@@ -104,14 +104,14 @@ void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
 	if(!iso14443a_select_card(uid, NULL, &cuid)) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)
 			Dbprintf("Can't select card");
-		OnError(0);
+		//OnError(0);
 		return;
 	};
 	
 	if(mifare_ultra_auth1(cuid, dataoutbuf)){
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)	
 			Dbprintf("Authentication part1: Fail.");
-		OnError(1);
+		//OnError(1);
 		return;
 	}

@@ -138,7 +138,7 @@ void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 	if(mifare_ultra_auth2(cuid, key, dataoutbuf)){
 	    if (MF_DBGLEVEL >= MF_DBG_ERROR) 
 			Dbprintf("Authentication part2: Fail...");
-		OnError(1);
+		//OnError(1);
 		return;			
 	}
 	
@@ -161,30 +161,30 @@ void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
 	LED_A_ON();
 	LED_B_OFF();
 	LED_C_OFF();
-
+    
 	iso14a_clear_trace();
 	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
    
 	int len = iso14443a_select_card(uid, NULL, &cuid);
 	if(!len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)	Dbprintf("Can't select card");
-		OnError(1);
+		//OnError(1);
 		return;
-	};
-	
+		};
+        
 	len = mifare_ultra_readblock(cuid, blockNo, dataout);
 	if(len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)	Dbprintf("Read block error");
-		OnError(2);
+		//OnError(2);
 		return;
-	};
-	
+		};
+        
 	len = mifare_ultra_halt(cuid);
 	if(len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)	Dbprintf("Halt error");
-		OnError(3);
+		//OnError(3);
 		return;
-	};
+		};
 		
    cmd_send(CMD_ACK,1,0,0,dataout,16);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
@@ -261,14 +261,14 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)

 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 {
-	// params
-	uint8_t sectorNo = arg0;
+  // params
+        uint8_t sectorNo = arg0;
 	int Pages = arg1;
 	int count_Pages = 0;
 	byte_t dataout[176] = {0x00};;
 	uint8_t uid[10] = {0x00};
 	uint32_t cuid;
-	
+
 	LED_A_ON();
 	LED_B_OFF();
 	LED_C_OFF();
@@ -284,7 +284,7 @@ void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 	if (!len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)
 			Dbprintf("Can't select card");
-		OnError(1);
+		//OnError(1);
 		return;
 	}
 	
@@ -295,7 +295,7 @@ void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 		if (len) {
 			if (MF_DBGLEVEL >= MF_DBG_ERROR)
 				Dbprintf("Read block %d error",i);
-			OnError(2);
+			//OnError(2);
 			return;
 		} else {
 			count_Pages++;
@@ -306,7 +306,7 @@ void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 	if (len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)
 			Dbprintf("Halt error");
-		OnError(3);
+		//OnError(3);
 		return;
 	}
 	
@@ -400,49 +400,49 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)

 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 {
-	// params
-	uint8_t blockNo = arg0;
+        // params
+        uint8_t blockNo = arg0;
 	byte_t blockdata[16] = {0x00};

-	memcpy(blockdata, datain, 16);
-	
-	// variables
-	byte_t isOK = 0;
-	uint8_t uid[10] = {0x00};
-	uint32_t cuid;
-
-	iso14a_clear_trace();
-	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
-
-	LED_A_ON();
-	LED_B_OFF();
-	LED_C_OFF();
-
-	while (true) {
-		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-				if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
-				break;
-		};
-
-		if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
-				if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
-				break;
-		};
-
-		if(mifare_ultra_halt(cuid)) {
-				if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
-				break;
-		};
-		
-		isOK = 1;
-		break;
-	}
+        memcpy(blockdata, datain,16);
        
-	if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
+        // variables
+        byte_t isOK = 0;
+	uint8_t uid[10] = {0x00};
+        uint32_t cuid;

-	cmd_send(CMD_ACK,isOK,0,0,0,0);
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-	LEDsoff();
+        iso14a_clear_trace();
+		iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
+
+        LED_A_ON();
+        LED_B_OFF();
+        LED_C_OFF();
+
+        while (true) {
+                if(!iso14443a_select_card(uid, NULL, &cuid)) {
+                        if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
+                        break;
+                };
+
+                if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
+                        if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
+                        break;
+                };
+
+                if(mifare_ultra_halt(cuid)) {
+                        if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
+                        break;
+                };
+                
+                isOK = 1;
+                break;
+        }
+        
+        if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
+
+		cmd_send(CMD_ACK,isOK,0,0,0,0);
+        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+        LEDsoff();
 }

 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
@@ -493,7 +493,7 @@ void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 }

 // Return 1 if the nonce is invalid else return 0
-int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t * parity) {
+int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 	return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 	(oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 	(oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
@@ -529,11 +529,13 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 	struct Crypto1State mpcs = {0, 0};
 	struct Crypto1State *pcs;
 	pcs = &mpcs;
-	uint8_t* receivedAnswer =  get_bigbufptr_recvrespbuf();
+	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];

 	uint32_t auth1_time, auth2_time;
 	static uint16_t delta_time;

+	// free eventually allocated BigBuf memory
+	BigBuf_free();
 	// clear trace
 	iso14a_clear_trace();
 	iso14a_set_tracing(false);
@@ -550,7 +552,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 		WDT_HIT();

 		davg = dmax = 0;
-		dmin = 2000; 
+		dmin = 2000;
 		delta_time = 0;
 		
 		for (rtr = 0; rtr < 17; rtr++) {
@@ -605,7 +607,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 			}
 		}
 		
-		if (rtr <= 1) return;
+		if (rtr <= 1)	return;

 		davg = (davg + (rtr - 1)/2) / (rtr - 1);
 		
@@ -624,18 +626,9 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 	//  get crypted nonces for target sector
 	for(i=0; i < 2; i++) { // look for exactly two different nonces

-		WDT_HIT();	
-	    if(BUTTON_PRESS()) {
-			DbpString("Nested: cancelled");
-			crypto1_destroy(pcs);
-			FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-			LEDsoff();
-			return;
-		}
-
 		target_nt[i] = 0;
 		while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
-		 
+		
 			// prepare next select. No need to power down the card.
 			if(mifare_classic_halt(pcs, cuid)) {
 				if (MF_DBGLEVEL >= 1)	Dbprintf("Nested: Halt error");
@@ -695,7 +688,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 			if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 		}
 	}
-	
+
 	LED_C_OFF();
 	
 	//  ----------------------------- crypto1 destroy
@@ -929,15 +922,15 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 	uint8_t d_block[18] = {0x00};
 	uint32_t cuid;
 	
-	uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
-	uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
-	
+	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
+	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
+
 	// reset FPGA and LED
 	if (workFlags & 0x08) {
 		LED_A_ON();
 		LED_B_OFF();
 		LED_C_OFF();
-		
+	
 		iso14a_clear_trace();
 		iso14a_set_tracing(TRUE);
 		iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
@@ -1048,14 +1041,14 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 	uint8_t data[18] = {0x00};
 	uint32_t cuid = 0;
 	
-	uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
-	uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
+	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
+	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
 	
 	if (workFlags & 0x08) {
 		LED_A_ON();
 		LED_B_OFF();
 		LED_C_OFF();
-
+	
 		iso14a_clear_trace();
 		iso14a_set_tracing(TRUE);
 		iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
@@ -1113,8 +1106,8 @@ void MifareCIdent(){
 	// variables
 	byte_t isOK = 1;
 	
-	uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
-	uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
+	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
+	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];

 	ReaderTransmitBitsPar(wupC1,7,0, NULL);
 	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
@@ -1133,7 +1126,7 @@ void MifareCIdent(){
 	cmd_send(CMD_ACK,isOK,0,0,0,0);
 }

-//
+			//
 // DESFIRE
 //

@@ -1150,14 +1143,14 @@ void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
 	if(!len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)	
 			Dbprintf("Can't select card");
-		OnError(1);
+		//OnError(1);
 		return;
 	};

 	if(mifare_desfire_des_auth1(cuid, dataout)){
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)	
 			Dbprintf("Authentication part1: Fail.");
-		OnError(4);
+		//OnError(4);
 		return;
 	}

@@ -1180,7 +1173,7 @@ void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
 	if( isOK) {
 	    if (MF_DBGLEVEL >= MF_DBG_EXTENDED) 
 			Dbprintf("Authentication part2: Failed");  
-		OnError(4);
+		//OnError(4);
 		return;
 	}

@@ -1190,4 +1183,4 @@ void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
 	cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
-}
+}
@@ -13,10 +13,10 @@

 static int sniffState = SNF_INIT;
 static uint8_t sniffUIDType;
-static uint8_t sniffUID[8];
-static uint8_t sniffATQA[2];
+static uint8_t sniffUID[8] = {0x00};
+static uint8_t sniffATQA[2] = {0x00};
 static uint8_t sniffSAK;
-static uint8_t sniffBuf[16];
+static uint8_t sniffBuf[16] = {0x00};
 static uint32_t timerData = 0;


@@ -151,12 +151,13 @@ bool intMfSniffSend() {
 	int pckSize = 0;
 	int pckLen = traceLen;
 	int pckNum = 0;
-
+	uint8_t *trace = BigBuf_get_addr();
+	
 	FpgaDisableSscDma();
 	while (pckLen > 0) {
 		pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);
 		LED_B_ON();
-		cmd_send(CMD_ACK, 1, pckSize, pckNum, trace + traceLen - pckLen, pckSize);
+		cmd_send(CMD_ACK, 1, traceLen, pckSize, trace + traceLen - pckLen, pckSize);
 		LED_B_OFF();

 		pckLen -= pckSize;
@@ -16,7 +16,7 @@
 #define CRYPT_NONE    0
 #define CRYPT_ALL     1
 #define CRYPT_REQUEST 2
-#define AUTH_FIRST    0
+#define AUTH_FIRST    0	
 #define AUTH_NESTED   2

 // mifare 4bit card answers
@@ -53,9 +53,8 @@ extern int MF_DBGLEVEL;
 #define cardSTATE_TO_IDLE() cardSTATE = MFEMUL_IDLE; LED_B_OFF(); LED_C_OFF();

 //functions
-uint8_t* mifare_get_bigbufptr(void);
 int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
-int mifare_sendcmd_short_special(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);
+int mifare_sendcmd_short_special(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);

 int mifare_sendcmd_short_mfucauth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);
 int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
@@ -83,11 +82,6 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *receivedCmd, int len)
 void mf_crypto1_encrypt(struct Crypto1State *pcs, uint8_t *data, uint16_t len, uint8_t *par);
 uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data);

-// memory management
-uint8_t* get_bigbufptr_recvrespbuf(void);
-uint8_t* get_bigbufptr_recvcmdbuf(void);
-uint8_t* get_bigbufptr_emlcardmem(void);
-
 // Mifare memory structure
 uint8_t NumBlocksPerSector(uint8_t sectorNo);
 uint8_t FirstBlockOfSector(uint8_t sectorNo);
@@ -18,7 +18,7 @@
 int strlen(const char *str);
 RAMFUNC void *memcpy(void *dest, const void *src, int len);
 void *memset(void *dest, int c, int len);
-RAMFUNC  int memcmp(const void *av, const void *bv, int len);
+RAMFUNC int memcmp(const void *av, const void *bv, int len);
 void memxor(uint8_t * dest, uint8_t * src, size_t len);
 char *strncat(char *dest, const char *src, unsigned int n);
 char *strcat(char *dest, const char *src);
@@ -13,7 +13,7 @@

 #include <stddef.h>
 #include <stdint.h>
-#include "../include/common.h"
+#include "common.h"

 #define BYTEx(x, n) (((x) >> (n * 8)) & 0xff )

--- a/Show More
+++ b/Show More