]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/iso14443a.c
Added Unique Code to EM41x
[proxmark3-svn] / armsrc / iso14443a.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
b62a5a84 2// Merlok - June 2011, 2012
15c4dc5a 3// Gerhard de Koning Gans - May 2008
534983d7 4// Hagen Fritsch - June 2010
bd20f8f4 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
15c4dc5a 9//-----------------------------------------------------------------------------
bd20f8f4 10// Routines to support ISO 14443 type A.
11//-----------------------------------------------------------------------------
12
e30c654b 13#include "proxmark3.h"
15c4dc5a 14#include "apps.h"
f7e3ed82 15#include "util.h"
9ab7a6c7 16#include "string.h"
902cb3c0 17#include "cmd.h"
9ab7a6c7 18
15c4dc5a 19#include "iso14443crc.h"
534983d7 20#include "iso14443a.h"
20f9a2a1
M
21#include "crapto1.h"
22#include "mifareutil.h"
15c4dc5a 23
534983d7 24static uint32_t iso14a_timeout;
d19929cb 25uint8_t *trace = (uint8_t *) BigBuf+TRACE_OFFSET;
1e262141 26int rsamples = 0;
7bc95e2e 27int traceLen = 0;
1e262141 28int tracing = TRUE;
29uint8_t trigger = 0;
b0127e65 30// the block number for the ISO14443-4 PCB
31static uint8_t iso14_pcb_blocknum = 0;
15c4dc5a 32
7bc95e2e 33//
34// ISO14443 timing:
35//
36// minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
37#define REQUEST_GUARD_TIME (7000/16 + 1)
38// minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
39#define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
40// bool LastCommandWasRequest = FALSE;
41
42//
43// Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
44//
45// When the PM acts as reader and is receiving, it takes
46// 3 ticks for the A/D conversion
47// 10 ticks ( 16 on average) delay in the modulation detector.
48// 6 ticks until the SSC samples the first data
49// 7*16 ticks to complete the transfer from FPGA to ARM
50// 8 ticks to the next ssp_clk rising edge
51// 4*16 ticks until we measure the time
52// - 8*16 ticks because we measure the time of the previous transfer
53#define DELAY_AIR2ARM_AS_READER (3 + 10 + 6 + 7*16 + 8 + 4*16 - 8*16)
54
55// When the PM acts as a reader and is sending, it takes
56// 4*16 ticks until we can write data to the sending hold register
57// 8*16 ticks until the SHR is transferred to the Sending Shift Register
58// 8 ticks until the first transfer starts
59// 8 ticks later the FPGA samples the data
60// 1 tick to assign mod_sig_coil
61#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
62
63// When the PM acts as tag and is receiving it takes
64// 12 ticks delay in the RF part,
65// 3 ticks for the A/D conversion,
66// 8 ticks on average until the start of the SSC transfer,
67// 8 ticks until the SSC samples the first data
68// 7*16 ticks to complete the transfer from FPGA to ARM
69// 8 ticks until the next ssp_clk rising edge
70// 3*16 ticks until we measure the time
71// - 8*16 ticks because we measure the time of the previous transfer
72#define DELAY_AIR2ARM_AS_TAG (12 + 3 + 8 + 8 + 7*16 + 8 + 3*16 - 8*16)
73
74// The FPGA will report its internal sending delay in
75uint16_t FpgaSendQueueDelay;
76// the 5 first bits are the number of bits buffered in mod_sig_buf
77// the last three bits are the remaining ticks/2 after the mod_sig_buf shift
78#define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
79
80// When the PM acts as tag and is sending, it takes
81// 5*16 ticks until we can write data to the sending hold register
82// 8*16 ticks until the SHR is transferred to the Sending Shift Register
83// 8 ticks until the first transfer starts
84// 8 ticks later the FPGA samples the data
85// + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
86// + 1 tick to assign mod_sig_coil
87#define DELAY_ARM2AIR_AS_TAG (5*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
88
89// When the PM acts as sniffer and is receiving tag data, it takes
90// 3 ticks A/D conversion
91// 16 ticks delay in the modulation detector (on average).
92// + 16 ticks until it's result is sampled.
93// + the delays in transferring data - which is the same for
94// sniffing reader and tag data and therefore not relevant
95#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 16 + 16)
96
97// When the PM acts as sniffer and is receiving tag data, it takes
98// 12 ticks delay in analogue RF receiver
99// 3 ticks A/D conversion
100// 8 ticks on average until we sample the data.
101// + the delays in transferring data - which is the same for
102// sniffing reader and tag data and therefore not relevant
103#define DELAY_READER_AIR2ARM_AS_SNIFFER (12 + 3 + 8)
104
105//variables used for timing purposes:
106//these are in ssp_clk cycles:
107uint32_t NextTransferTime;
108uint32_t LastTimeProxToAirStart;
109uint32_t LastProxToAirDuration;
110
111
112
8f51ddb0 113// CARD TO READER - manchester
72934aa3 114// Sequence D: 11110000 modulation with subcarrier during first half
115// Sequence E: 00001111 modulation with subcarrier during second half
116// Sequence F: 00000000 no modulation with subcarrier
8f51ddb0 117// READER TO CARD - miller
72934aa3 118// Sequence X: 00001100 drop after half a period
119// Sequence Y: 00000000 no drop
120// Sequence Z: 11000000 drop at start
121#define SEC_D 0xf0
122#define SEC_E 0x0f
123#define SEC_F 0x00
124#define SEC_X 0x0c
125#define SEC_Y 0x00
126#define SEC_Z 0xc0
15c4dc5a 127
1e262141 128const uint8_t OddByteParity[256] = {
15c4dc5a 129 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
130 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
131 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
132 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
138 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
139 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
140 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
141 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
142 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
143 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
144 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
145};
146
1e262141 147
902cb3c0 148void iso14a_set_trigger(bool enable) {
534983d7 149 trigger = enable;
150}
151
902cb3c0 152void iso14a_clear_trace() {
7bc95e2e 153 memset(trace, 0x44, TRACE_SIZE);
8556b852
M
154 traceLen = 0;
155}
d19929cb 156
902cb3c0 157void iso14a_set_tracing(bool enable) {
8556b852
M
158 tracing = enable;
159}
d19929cb 160
b0127e65 161void iso14a_set_timeout(uint32_t timeout) {
162 iso14a_timeout = timeout;
163}
8556b852 164
15c4dc5a 165//-----------------------------------------------------------------------------
166// Generate the parity value for a byte sequence
e30c654b 167//
15c4dc5a 168//-----------------------------------------------------------------------------
20f9a2a1
M
169byte_t oddparity (const byte_t bt)
170{
5f6d6c90 171 return OddByteParity[bt];
20f9a2a1
M
172}
173
f7e3ed82 174uint32_t GetParity(const uint8_t * pbtCmd, int iLen)
15c4dc5a 175{
5f6d6c90 176 int i;
177 uint32_t dwPar = 0;
72934aa3 178
e691fc45 179 // Generate the parity bits
5f6d6c90 180 for (i = 0; i < iLen; i++) {
e691fc45 181 // and save them to a 32Bit word
5f6d6c90 182 dwPar |= ((OddByteParity[pbtCmd[i]]) << i);
183 }
184 return dwPar;
15c4dc5a 185}
186
534983d7 187void AppendCrc14443a(uint8_t* data, int len)
15c4dc5a 188{
5f6d6c90 189 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
15c4dc5a 190}
191
1e262141 192// The function LogTrace() is also used by the iClass implementation in iClass.c
7bc95e2e 193bool RAMFUNC LogTrace(const uint8_t * btBytes, uint8_t iLen, uint32_t timestamp, uint32_t dwParity, bool bReader)
15c4dc5a 194{
7bc95e2e 195 // Return when trace is full
196 if (traceLen + sizeof(timestamp) + sizeof(dwParity) + iLen >= TRACE_SIZE) {
197 tracing = FALSE; // don't trace any more
198 return FALSE;
199 }
200
201 // Trace the random, i'm curious
202 trace[traceLen++] = ((timestamp >> 0) & 0xff);
203 trace[traceLen++] = ((timestamp >> 8) & 0xff);
204 trace[traceLen++] = ((timestamp >> 16) & 0xff);
205 trace[traceLen++] = ((timestamp >> 24) & 0xff);
206 if (!bReader) {
207 trace[traceLen - 1] |= 0x80;
208 }
209 trace[traceLen++] = ((dwParity >> 0) & 0xff);
210 trace[traceLen++] = ((dwParity >> 8) & 0xff);
211 trace[traceLen++] = ((dwParity >> 16) & 0xff);
212 trace[traceLen++] = ((dwParity >> 24) & 0xff);
213 trace[traceLen++] = iLen;
214 if (btBytes != NULL && iLen != 0) {
215 memcpy(trace + traceLen, btBytes, iLen);
216 }
217 traceLen += iLen;
218 return TRUE;
15c4dc5a 219}
220
7bc95e2e 221//=============================================================================
222// ISO 14443 Type A - Miller decoder
223//=============================================================================
224// Basics:
225// This decoder is used when the PM3 acts as a tag.
226// The reader will generate "pauses" by temporarily switching of the field.
227// At the PM3 antenna we will therefore measure a modulated antenna voltage.
228// The FPGA does a comparison with a threshold and would deliver e.g.:
229// ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
230// The Miller decoder needs to identify the following sequences:
231// 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
232// 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
233// 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
234// Note 1: the bitstream may start at any time. We therefore need to sync.
235// Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
15c4dc5a 236//-----------------------------------------------------------------------------
b62a5a84 237static tUart Uart;
15c4dc5a 238
d7aa3739 239// Lookup-Table to decide if 4 raw bits are a modulation.
240// We accept two or three consecutive "0" in any position with the rest "1"
241const bool Mod_Miller_LUT[] = {
242 TRUE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, FALSE,
243 TRUE, TRUE, FALSE, FALSE, TRUE, FALSE, FALSE, FALSE
244};
245#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x00F0) >> 4])
246#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x000F)])
247
7bc95e2e 248void UartReset()
15c4dc5a 249{
7bc95e2e 250 Uart.state = STATE_UNSYNCD;
251 Uart.bitCount = 0;
252 Uart.len = 0; // number of decoded data bytes
253 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
254 Uart.parityBits = 0; //
255 Uart.twoBits = 0x0000; // buffer for 2 Bits
256 Uart.highCnt = 0;
257 Uart.startTime = 0;
258 Uart.endTime = 0;
259}
15c4dc5a 260
d7aa3739 261/* inline RAMFUNC Modulation_t MillerModulation(uint8_t b)
7bc95e2e 262{
263 // switch (b & 0x88) {
264 // case 0x00: return MILLER_MOD_BOTH_HALVES;
265 // case 0x08: return MILLER_MOD_FIRST_HALF;
266 // case 0x80: return MILLER_MOD_SECOND_HALF;
267 // case 0x88: return MILLER_MOD_NOMOD;
268 // }
269 // test the second cycle for a pause. For whatever reason the startbit tends to appear earlier than the rest.
270 switch (b & 0x44) {
271 case 0x00: return MOD_BOTH_HALVES;
272 case 0x04: return MOD_FIRST_HALF;
273 case 0x40: return MOD_SECOND_HALF;
274 default: return MOD_NOMOD;
15c4dc5a 275 }
7bc95e2e 276}
d7aa3739 277 */
7bc95e2e 278// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
279static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
280{
15c4dc5a 281
7bc95e2e 282 Uart.twoBits = (Uart.twoBits << 8) | bit;
283
284 if (Uart.state == STATE_UNSYNCD) { // not yet synced
285 if (Uart.highCnt < 7) { // wait for a stable unmodulated signal
286 if (Uart.twoBits == 0xffff) {
287 Uart.highCnt++;
288 } else {
289 Uart.highCnt = 0;
15c4dc5a 290 }
7bc95e2e 291 } else {
292 Uart.syncBit = 0xFFFF; // not set
293 // look for 00xx1111 (the start bit)
294 if ((Uart.twoBits & 0x6780) == 0x0780) Uart.syncBit = 7;
295 else if ((Uart.twoBits & 0x33C0) == 0x03C0) Uart.syncBit = 6;
296 else if ((Uart.twoBits & 0x19E0) == 0x01E0) Uart.syncBit = 5;
297 else if ((Uart.twoBits & 0x0CF0) == 0x00F0) Uart.syncBit = 4;
298 else if ((Uart.twoBits & 0x0678) == 0x0078) Uart.syncBit = 3;
299 else if ((Uart.twoBits & 0x033C) == 0x003C) Uart.syncBit = 2;
300 else if ((Uart.twoBits & 0x019E) == 0x001E) Uart.syncBit = 1;
301 else if ((Uart.twoBits & 0x00CF) == 0x000F) Uart.syncBit = 0;
302 if (Uart.syncBit != 0xFFFF) {
303 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
304 Uart.startTime -= Uart.syncBit;
d7aa3739 305 Uart.endTime = Uart.startTime;
7bc95e2e 306 Uart.state = STATE_START_OF_COMMUNICATION;
15c4dc5a 307 }
7bc95e2e 308 }
15c4dc5a 309
7bc95e2e 310 } else {
15c4dc5a 311
d7aa3739 312 if (IsMillerModulationNibble1(Uart.twoBits >> Uart.syncBit)) {
313 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation in both halves - error
314 UartReset();
315 Uart.highCnt = 6;
316 } else { // Modulation in first half = Sequence Z = logic "0"
7bc95e2e 317 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
318 UartReset();
319 Uart.highCnt = 6;
320 } else {
321 Uart.bitCount++;
322 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
323 Uart.state = STATE_MILLER_Z;
324 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
325 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
326 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
327 Uart.parityBits <<= 1; // make room for the parity bit
328 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
329 Uart.bitCount = 0;
330 Uart.shiftReg = 0;
15c4dc5a 331 }
7bc95e2e 332 }
d7aa3739 333 }
334 } else {
335 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
7bc95e2e 336 Uart.bitCount++;
337 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
338 Uart.state = STATE_MILLER_X;
339 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
340 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
341 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
342 Uart.parityBits <<= 1; // make room for the new parity bit
343 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
344 Uart.bitCount = 0;
345 Uart.shiftReg = 0;
346 }
d7aa3739 347 } else { // no modulation in both halves - Sequence Y
7bc95e2e 348 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
15c4dc5a 349 Uart.state = STATE_UNSYNCD;
7bc95e2e 350 if(Uart.len == 0 && Uart.bitCount > 0) { // if we decoded some bits
351 Uart.shiftReg >>= (9 - Uart.bitCount); // add them to the output
352 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
353 Uart.parityBits <<= 1; // no parity bit - add "0"
d7aa3739 354 Uart.bitCount--; // last "0" was part of the EOC sequence
7bc95e2e 355 }
15c4dc5a 356 return TRUE;
357 }
7bc95e2e 358 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
359 UartReset();
360 Uart.highCnt = 6;
361 } else { // a logic "0"
362 Uart.bitCount++;
363 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
364 Uart.state = STATE_MILLER_Y;
365 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
366 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
367 Uart.parityBits <<= 1; // make room for the parity bit
368 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
369 Uart.bitCount = 0;
370 Uart.shiftReg = 0;
15c4dc5a 371 }
372 }
d7aa3739 373 }
15c4dc5a 374 }
7bc95e2e 375
376 }
15c4dc5a 377
7bc95e2e 378 return FALSE; // not finished yet, need more data
15c4dc5a 379}
380
7bc95e2e 381
382
15c4dc5a 383//=============================================================================
e691fc45 384// ISO 14443 Type A - Manchester decoder
15c4dc5a 385//=============================================================================
e691fc45 386// Basics:
7bc95e2e 387// This decoder is used when the PM3 acts as a reader.
e691fc45 388// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
389// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
390// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
391// The Manchester decoder needs to identify the following sequences:
392// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
393// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
394// 8 ticks unmodulated: Sequence F = end of communication
395// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
7bc95e2e 396// Note 1: the bitstream may start at any time. We therefore need to sync.
e691fc45 397// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
b62a5a84 398static tDemod Demod;
15c4dc5a 399
d7aa3739 400// Lookup-Table to decide if 4 raw bits are a modulation.
401// We accept three or four consecutive "1" in any position
7bc95e2e 402const bool Mod_Manchester_LUT[] = {
d7aa3739 403 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
404 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE, TRUE
7bc95e2e 405};
406
407#define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
408#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
15c4dc5a 409
2f2d9fc5 410
7bc95e2e 411void DemodReset()
e691fc45 412{
7bc95e2e 413 Demod.state = DEMOD_UNSYNCD;
414 Demod.len = 0; // number of decoded data bytes
415 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
416 Demod.parityBits = 0; //
417 Demod.collisionPos = 0; // Position of collision bit
418 Demod.twoBits = 0xffff; // buffer for 2 Bits
419 Demod.highCnt = 0;
420 Demod.startTime = 0;
421 Demod.endTime = 0;
e691fc45 422}
15c4dc5a 423
7bc95e2e 424// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
425static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
e691fc45 426{
7bc95e2e 427
428 Demod.twoBits = (Demod.twoBits << 8) | bit;
e691fc45 429
7bc95e2e 430 if (Demod.state == DEMOD_UNSYNCD) {
431
432 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
433 if (Demod.twoBits == 0x0000) {
434 Demod.highCnt++;
435 } else {
436 Demod.highCnt = 0;
437 }
438 } else {
439 Demod.syncBit = 0xFFFF; // not set
440 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
441 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
442 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
443 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
444 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
445 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
446 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
447 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
d7aa3739 448 if (Demod.syncBit != 0xFFFF) {
7bc95e2e 449 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
450 Demod.startTime -= Demod.syncBit;
451 Demod.bitCount = offset; // number of decoded data bits
e691fc45 452 Demod.state = DEMOD_MANCHESTER_DATA;
2f2d9fc5 453 }
7bc95e2e 454 }
15c4dc5a 455
7bc95e2e 456 } else {
15c4dc5a 457
7bc95e2e 458 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
459 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
e691fc45 460 if (!Demod.collisionPos) {
461 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
462 }
463 } // modulation in first half only - Sequence D = 1
7bc95e2e 464 Demod.bitCount++;
465 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
466 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
e691fc45 467 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 468 Demod.parityBits <<= 1; // make room for the parity bit
e691fc45 469 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
470 Demod.bitCount = 0;
471 Demod.shiftReg = 0;
15c4dc5a 472 }
7bc95e2e 473 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
474 } else { // no modulation in first half
475 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
e691fc45 476 Demod.bitCount++;
7bc95e2e 477 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
e691fc45 478 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
e691fc45 479 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 480 Demod.parityBits <<= 1; // make room for the new parity bit
e691fc45 481 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
482 Demod.bitCount = 0;
483 Demod.shiftReg = 0;
15c4dc5a 484 }
7bc95e2e 485 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
e691fc45 486 } else { // no modulation in both halves - End of communication
d7aa3739 487 if (Demod.len > 0 || Demod.bitCount > 0) { // received something
488 if(Demod.bitCount > 0) { // if we decoded bits
489 Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
490 Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
491 // No parity bit, so just shift a 0
492 Demod.parityBits <<= 1;
493 }
494 return TRUE; // we are finished with decoding the raw data sequence
495 } else { // nothing received. Start over
496 DemodReset();
e691fc45 497 }
15c4dc5a 498 }
7bc95e2e 499 }
e691fc45 500
501 }
15c4dc5a 502
e691fc45 503 return FALSE; // not finished yet, need more data
15c4dc5a 504}
505
506//=============================================================================
507// Finally, a `sniffer' for ISO 14443 Type A
508// Both sides of communication!
509//=============================================================================
510
511//-----------------------------------------------------------------------------
512// Record the sequence of commands sent by the reader to the tag, with
513// triggering so that we start recording at the point that the tag is moved
514// near the reader.
515//-----------------------------------------------------------------------------
5cd9ec01
M
516void RAMFUNC SnoopIso14443a(uint8_t param) {
517 // param:
518 // bit 0 - trigger from first card answer
519 // bit 1 - trigger from first reader 7-bit request
520
521 LEDsoff();
522 // init trace buffer
5f6d6c90 523 iso14a_clear_trace();
5cd9ec01
M
524
525 // We won't start recording the frames that we acquire until we trigger;
526 // a good trigger condition to get started is probably when we see a
527 // response from the tag.
528 // triggered == FALSE -- to wait first for card
7bc95e2e 529 bool triggered = !(param & 0x03);
530
5cd9ec01 531 // The command (reader -> tag) that we're receiving.
15c4dc5a 532 // The length of a received command will in most cases be no more than 18 bytes.
533 // So 32 should be enough!
5cd9ec01
M
534 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
535 // The response (tag -> reader) that we're receiving.
536 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
15c4dc5a 537
5cd9ec01
M
538 // As we receive stuff, we copy it from receivedCmd or receivedResponse
539 // into trace, along with its length and other annotations.
540 //uint8_t *trace = (uint8_t *)BigBuf;
541
542 // The DMA buffer, used to stream samples from the FPGA
7bc95e2e 543 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
544 uint8_t *data = dmaBuf;
545 uint8_t previous_data = 0;
5cd9ec01
M
546 int maxDataLen = 0;
547 int dataLen = 0;
7bc95e2e 548 bool TagIsActive = FALSE;
549 bool ReaderIsActive = FALSE;
550
551 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
15c4dc5a 552
5cd9ec01
M
553 // Set up the demodulator for tag -> reader responses.
554 Demod.output = receivedResponse;
15c4dc5a 555
5cd9ec01 556 // Set up the demodulator for the reader -> tag commands
5cd9ec01 557 Uart.output = receivedCmd;
15c4dc5a 558
7bc95e2e 559 // Setup and start DMA.
5cd9ec01 560 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
7bc95e2e 561
5cd9ec01 562 // And now we loop, receiving samples.
7bc95e2e 563 for(uint32_t rsamples = 0; TRUE; ) {
564
5cd9ec01
M
565 if(BUTTON_PRESS()) {
566 DbpString("cancelled by button");
7bc95e2e 567 break;
5cd9ec01 568 }
15c4dc5a 569
5cd9ec01
M
570 LED_A_ON();
571 WDT_HIT();
15c4dc5a 572
5cd9ec01
M
573 int register readBufDataP = data - dmaBuf;
574 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
575 if (readBufDataP <= dmaBufDataP){
576 dataLen = dmaBufDataP - readBufDataP;
577 } else {
7bc95e2e 578 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
5cd9ec01
M
579 }
580 // test for length of buffer
581 if(dataLen > maxDataLen) {
582 maxDataLen = dataLen;
583 if(dataLen > 400) {
7bc95e2e 584 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
585 break;
5cd9ec01
M
586 }
587 }
588 if(dataLen < 1) continue;
589
590 // primary buffer was stopped( <-- we lost data!
591 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
592 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
593 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
7bc95e2e 594 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
595 }
596 // secondary buffer sets as primary, secondary buffer was stopped
597 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
598 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
599 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
600 }
601
602 LED_A_OFF();
7bc95e2e 603
604 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
3be2a5ae 605
7bc95e2e 606 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
607 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
608 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
609 LED_C_ON();
5cd9ec01 610
7bc95e2e 611 // check - if there is a short 7bit request from reader
612 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
5cd9ec01 613
7bc95e2e 614 if(triggered) {
615 if (!LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, Uart.parityBits, TRUE)) break;
616 if (!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
617 }
618 /* And ready to receive another command. */
619 UartReset();
620 /* And also reset the demod code, which might have been */
621 /* false-triggered by the commands from the reader. */
622 DemodReset();
623 LED_B_OFF();
624 }
625 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
5cd9ec01 626 }
3be2a5ae 627
7bc95e2e 628 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
629 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
630 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
631 LED_B_ON();
5cd9ec01 632
7bc95e2e 633 if (!LogTrace(receivedResponse, Demod.len, Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, Demod.parityBits, FALSE)) break;
634 if (!LogTrace(NULL, 0, Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, 0, FALSE)) break;
5cd9ec01 635
7bc95e2e 636 if ((!triggered) && (param & 0x01)) triggered = TRUE;
5cd9ec01 637
7bc95e2e 638 // And ready to receive another response.
639 DemodReset();
640 LED_C_OFF();
641 }
642 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
643 }
5cd9ec01
M
644 }
645
7bc95e2e 646 previous_data = *data;
647 rsamples++;
5cd9ec01
M
648 data++;
649 if(data > dmaBuf + DMA_BUFFER_SIZE) {
650 data = dmaBuf;
651 }
652 } // main cycle
653
654 DbpString("COMMAND FINISHED");
15c4dc5a 655
7bc95e2e 656 FpgaDisableSscDma();
657 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
658 Dbprintf("traceLen=%d, Uart.output[0]=%08x", traceLen, (uint32_t)Uart.output[0]);
5cd9ec01 659 LEDsoff();
15c4dc5a 660}
661
15c4dc5a 662//-----------------------------------------------------------------------------
663// Prepare tag messages
664//-----------------------------------------------------------------------------
8f51ddb0 665static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity)
15c4dc5a 666{
8f51ddb0 667 int i;
15c4dc5a 668
8f51ddb0 669 ToSendReset();
15c4dc5a 670
671 // Correction bit, might be removed when not needed
672 ToSendStuffBit(0);
673 ToSendStuffBit(0);
674 ToSendStuffBit(0);
675 ToSendStuffBit(0);
676 ToSendStuffBit(1); // 1
677 ToSendStuffBit(0);
678 ToSendStuffBit(0);
679 ToSendStuffBit(0);
8f51ddb0 680
15c4dc5a 681 // Send startbit
72934aa3 682 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 683 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 684
8f51ddb0
M
685 for(i = 0; i < len; i++) {
686 int j;
687 uint8_t b = cmd[i];
15c4dc5a 688
689 // Data bits
15c4dc5a 690 for(j = 0; j < 8; j++) {
15c4dc5a 691 if(b & 1) {
72934aa3 692 ToSend[++ToSendMax] = SEC_D;
15c4dc5a 693 } else {
72934aa3 694 ToSend[++ToSendMax] = SEC_E;
8f51ddb0
M
695 }
696 b >>= 1;
697 }
15c4dc5a 698
0014cb46 699 // Get the parity bit
8f51ddb0
M
700 if ((dwParity >> i) & 0x01) {
701 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 702 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 703 } else {
72934aa3 704 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 705 LastProxToAirDuration = 8 * ToSendMax;
15c4dc5a 706 }
8f51ddb0 707 }
15c4dc5a 708
8f51ddb0
M
709 // Send stopbit
710 ToSend[++ToSendMax] = SEC_F;
15c4dc5a 711
8f51ddb0
M
712 // Convert from last byte pos to length
713 ToSendMax++;
8f51ddb0
M
714}
715
716static void CodeIso14443aAsTag(const uint8_t *cmd, int len){
717 CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len));
15c4dc5a 718}
719
15c4dc5a 720
8f51ddb0
M
721static void Code4bitAnswerAsTag(uint8_t cmd)
722{
723 int i;
724
5f6d6c90 725 ToSendReset();
8f51ddb0
M
726
727 // Correction bit, might be removed when not needed
728 ToSendStuffBit(0);
729 ToSendStuffBit(0);
730 ToSendStuffBit(0);
731 ToSendStuffBit(0);
732 ToSendStuffBit(1); // 1
733 ToSendStuffBit(0);
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736
737 // Send startbit
738 ToSend[++ToSendMax] = SEC_D;
739
740 uint8_t b = cmd;
741 for(i = 0; i < 4; i++) {
742 if(b & 1) {
743 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 744 LastProxToAirDuration = 8 * ToSendMax - 4;
8f51ddb0
M
745 } else {
746 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 747 LastProxToAirDuration = 8 * ToSendMax;
8f51ddb0
M
748 }
749 b >>= 1;
750 }
751
752 // Send stopbit
753 ToSend[++ToSendMax] = SEC_F;
754
5f6d6c90 755 // Convert from last byte pos to length
756 ToSendMax++;
15c4dc5a 757}
758
759//-----------------------------------------------------------------------------
760// Wait for commands from reader
761// Stop when button is pressed
762// Or return TRUE when command is captured
763//-----------------------------------------------------------------------------
f7e3ed82 764static int GetIso14443aCommandFromReader(uint8_t *received, int *len, int maxLen)
15c4dc5a 765{
766 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
767 // only, since we are receiving, not transmitting).
768 // Signal field is off with the appropriate LED
769 LED_D_OFF();
770 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
771
772 // Now run a `software UART' on the stream of incoming samples.
7bc95e2e 773 UartReset();
15c4dc5a 774 Uart.output = received;
7bc95e2e 775
776 // clear RXRDY:
777 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 778
779 for(;;) {
780 WDT_HIT();
781
782 if(BUTTON_PRESS()) return FALSE;
7bc95e2e 783
15c4dc5a 784 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
7bc95e2e 785 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
786 if(MillerDecoding(b, 0)) {
787 *len = Uart.len;
15c4dc5a 788 return TRUE;
789 }
7bc95e2e 790 }
15c4dc5a 791 }
792}
28afbd2b 793
7bc95e2e 794static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded);
795int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
28afbd2b 796int EmSend4bit(uint8_t resp);
7bc95e2e 797int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
798int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
799int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded);
28afbd2b 800int EmSendCmd(uint8_t *resp, int respLen);
801int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par);
7bc95e2e 802bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
803 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity);
15c4dc5a 804
ce02f6f9 805static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
806
807typedef struct {
808 uint8_t* response;
809 size_t response_n;
810 uint8_t* modulation;
811 size_t modulation_n;
7bc95e2e 812 uint32_t ProxToAirDuration;
ce02f6f9 813} tag_response_info_t;
814
815void reset_free_buffer() {
816 free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
817}
818
819bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
7bc95e2e 820 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
ce02f6f9 821 // This will need the following byte array for a modulation sequence
822 // 144 data bits (18 * 8)
823 // 18 parity bits
824 // 2 Start and stop
825 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
826 // 1 just for the case
827 // ----------- +
828 // 166 bytes, since every bit that needs to be send costs us a byte
829 //
830
831 // Prepare the tag modulation bits from the message
832 CodeIso14443aAsTag(response_info->response,response_info->response_n);
833
834 // Make sure we do not exceed the free buffer space
835 if (ToSendMax > max_buffer_size) {
836 Dbprintf("Out of memory, when modulating bits for tag answer:");
837 Dbhexdump(response_info->response_n,response_info->response,false);
838 return false;
839 }
840
841 // Copy the byte array, used for this modulation to the buffer position
842 memcpy(response_info->modulation,ToSend,ToSendMax);
843
7bc95e2e 844 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
ce02f6f9 845 response_info->modulation_n = ToSendMax;
7bc95e2e 846 response_info->ProxToAirDuration = LastProxToAirDuration;
ce02f6f9 847
848 return true;
849}
850
851bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
852 // Retrieve and store the current buffer index
853 response_info->modulation = free_buffer_pointer;
854
855 // Determine the maximum size we can use from our buffer
856 size_t max_buffer_size = (((uint8_t *)BigBuf)+FREE_BUFFER_OFFSET+FREE_BUFFER_SIZE)-free_buffer_pointer;
857
858 // Forward the prepare tag modulation function to the inner function
859 if (prepare_tag_modulation(response_info,max_buffer_size)) {
860 // Update the free buffer offset
861 free_buffer_pointer += ToSendMax;
862 return true;
863 } else {
864 return false;
865 }
866}
867
15c4dc5a 868//-----------------------------------------------------------------------------
869// Main loop of simulated tag: receive commands from reader, decide what
870// response to send, and send it.
871//-----------------------------------------------------------------------------
28afbd2b 872void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
15c4dc5a 873{
5f6d6c90 874 // Enable and clear the trace
5f6d6c90 875 iso14a_clear_trace();
7bc95e2e 876 iso14a_set_tracing(TRUE);
81cd0474 877
81cd0474 878 uint8_t sak;
879
880 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
881 uint8_t response1[2];
882
883 switch (tagType) {
884 case 1: { // MIFARE Classic
885 // Says: I am Mifare 1k - original line
886 response1[0] = 0x04;
887 response1[1] = 0x00;
888 sak = 0x08;
889 } break;
890 case 2: { // MIFARE Ultralight
891 // Says: I am a stupid memory tag, no crypto
892 response1[0] = 0x04;
893 response1[1] = 0x00;
894 sak = 0x00;
895 } break;
896 case 3: { // MIFARE DESFire
897 // Says: I am a DESFire tag, ph33r me
898 response1[0] = 0x04;
899 response1[1] = 0x03;
900 sak = 0x20;
901 } break;
902 case 4: { // ISO/IEC 14443-4
903 // Says: I am a javacard (JCOP)
904 response1[0] = 0x04;
905 response1[1] = 0x00;
906 sak = 0x28;
907 } break;
908 default: {
909 Dbprintf("Error: unkown tagtype (%d)",tagType);
910 return;
911 } break;
912 }
913
914 // The second response contains the (mandatory) first 24 bits of the UID
915 uint8_t response2[5];
916
917 // Check if the uid uses the (optional) part
918 uint8_t response2a[5];
919 if (uid_2nd) {
920 response2[0] = 0x88;
921 num_to_bytes(uid_1st,3,response2+1);
922 num_to_bytes(uid_2nd,4,response2a);
923 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
924
925 // Configure the ATQA and SAK accordingly
926 response1[0] |= 0x40;
927 sak |= 0x04;
928 } else {
929 num_to_bytes(uid_1st,4,response2);
930 // Configure the ATQA and SAK accordingly
931 response1[0] &= 0xBF;
932 sak &= 0xFB;
933 }
934
935 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
936 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
937
938 // Prepare the mandatory SAK (for 4 and 7 byte UID)
939 uint8_t response3[3];
940 response3[0] = sak;
941 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
942
943 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
944 uint8_t response3a[3];
945 response3a[0] = sak & 0xFB;
946 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
947
254b70a4 948 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
ce02f6f9 949 uint8_t response6[] = { 0x04, 0x58, 0x00, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS
950 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
951
7bc95e2e 952 #define TAG_RESPONSE_COUNT 7
953 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
954 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
955 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
956 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
957 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
958 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
959 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
960 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
961 };
962
963 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
964 // Such a response is less time critical, so we can prepare them on the fly
965 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
966 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
967 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
968 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
969 tag_response_info_t dynamic_response_info = {
970 .response = dynamic_response_buffer,
971 .response_n = 0,
972 .modulation = dynamic_modulation_buffer,
973 .modulation_n = 0
974 };
ce02f6f9 975
7bc95e2e 976 // Reset the offset pointer of the free buffer
977 reset_free_buffer();
ce02f6f9 978
7bc95e2e 979 // Prepare the responses of the anticollision phase
ce02f6f9 980 // there will be not enough time to do this at the moment the reader sends it REQA
7bc95e2e 981 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
982 prepare_allocated_tag_modulation(&responses[i]);
983 }
15c4dc5a 984
254b70a4 985 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
7bc95e2e 986 int len = 0;
15c4dc5a 987
988 // To control where we are in the protocol
989 int order = 0;
990 int lastorder;
991
992 // Just to allow some checks
993 int happened = 0;
994 int happened2 = 0;
81cd0474 995 int cmdsRecvd = 0;
15c4dc5a 996
254b70a4 997 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 998 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
15c4dc5a 999
254b70a4 1000 cmdsRecvd = 0;
7bc95e2e 1001 tag_response_info_t* p_response;
15c4dc5a 1002
254b70a4 1003 LED_A_ON();
1004 for(;;) {
7bc95e2e 1005 // Clean receive command buffer
1006
81cd0474 1007 if(!GetIso14443aCommandFromReader(receivedCmd, &len, RECV_CMD_SIZE)) {
ce02f6f9 1008 DbpString("Button press");
254b70a4 1009 break;
1010 }
7bc95e2e 1011
1012 p_response = NULL;
1013
254b70a4 1014 // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
1015 // Okay, look at the command now.
1016 lastorder = order;
1017 if(receivedCmd[0] == 0x26) { // Received a REQUEST
ce02f6f9 1018 p_response = &responses[0]; order = 1;
254b70a4 1019 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
ce02f6f9 1020 p_response = &responses[0]; order = 6;
254b70a4 1021 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
ce02f6f9 1022 p_response = &responses[1]; order = 2;
254b70a4 1023 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
ce02f6f9 1024 p_response = &responses[2]; order = 20;
254b70a4 1025 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
ce02f6f9 1026 p_response = &responses[3]; order = 3;
254b70a4 1027 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
ce02f6f9 1028 p_response = &responses[4]; order = 30;
254b70a4 1029 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
5f6d6c90 1030 EmSendCmdEx(data+(4*receivedCmd[0]),16,false);
7bc95e2e 1031 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
5f6d6c90 1032 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
7bc95e2e 1033 p_response = NULL;
254b70a4 1034 } else if(receivedCmd[0] == 0x50) { // Received a HALT
17331e14 1035// DbpString("Reader requested we HALT!:");
7bc95e2e 1036 if (tracing) {
1037 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1038 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1039 }
1040 p_response = NULL;
254b70a4 1041 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
ce02f6f9 1042 p_response = &responses[5]; order = 7;
254b70a4 1043 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
7bc95e2e 1044 if (tagType == 1 || tagType == 2) { // RATS not supported
1045 EmSend4bit(CARD_NACK_NA);
1046 p_response = NULL;
1047 } else {
1048 p_response = &responses[6]; order = 70;
1049 }
1050 } else if (order == 7 && len == 8) { // Received authentication request
1051 if (tracing) {
1052 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1053 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1054 }
1055 uint32_t nr = bytes_to_num(receivedCmd,4);
1056 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1057 Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr,ar);
1058 } else {
1059 // Check for ISO 14443A-4 compliant commands, look at left nibble
1060 switch (receivedCmd[0]) {
1061
1062 case 0x0B:
1063 case 0x0A: { // IBlock (command)
1064 dynamic_response_info.response[0] = receivedCmd[0];
1065 dynamic_response_info.response[1] = 0x00;
1066 dynamic_response_info.response[2] = 0x90;
1067 dynamic_response_info.response[3] = 0x00;
1068 dynamic_response_info.response_n = 4;
1069 } break;
1070
1071 case 0x1A:
1072 case 0x1B: { // Chaining command
1073 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1074 dynamic_response_info.response_n = 2;
1075 } break;
1076
1077 case 0xaa:
1078 case 0xbb: {
1079 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1080 dynamic_response_info.response_n = 2;
1081 } break;
1082
1083 case 0xBA: { //
1084 memcpy(dynamic_response_info.response,"\xAB\x00",2);
1085 dynamic_response_info.response_n = 2;
1086 } break;
1087
1088 case 0xCA:
1089 case 0xC2: { // Readers sends deselect command
1090 memcpy(dynamic_response_info.response,"\xCA\x00",2);
1091 dynamic_response_info.response_n = 2;
1092 } break;
1093
1094 default: {
1095 // Never seen this command before
1096 if (tracing) {
1097 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1098 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1099 }
1100 Dbprintf("Received unknown command (len=%d):",len);
1101 Dbhexdump(len,receivedCmd,false);
1102 // Do not respond
1103 dynamic_response_info.response_n = 0;
1104 } break;
1105 }
ce02f6f9 1106
7bc95e2e 1107 if (dynamic_response_info.response_n > 0) {
1108 // Copy the CID from the reader query
1109 dynamic_response_info.response[1] = receivedCmd[1];
ce02f6f9 1110
7bc95e2e 1111 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1112 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1113 dynamic_response_info.response_n += 2;
ce02f6f9 1114
7bc95e2e 1115 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1116 Dbprintf("Error preparing tag response");
1117 if (tracing) {
1118 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1119 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1120 }
1121 break;
1122 }
1123 p_response = &dynamic_response_info;
1124 }
81cd0474 1125 }
15c4dc5a 1126
1127 // Count number of wakeups received after a halt
1128 if(order == 6 && lastorder == 5) { happened++; }
1129
1130 // Count number of other messages after a halt
1131 if(order != 6 && lastorder == 5) { happened2++; }
1132
15c4dc5a 1133 if(cmdsRecvd > 999) {
1134 DbpString("1000 commands later...");
254b70a4 1135 break;
15c4dc5a 1136 }
ce02f6f9 1137 cmdsRecvd++;
1138
1139 if (p_response != NULL) {
7bc95e2e 1140 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1141 // do the tracing for the previous reader request and this tag answer:
1142 EmLogTrace(Uart.output,
1143 Uart.len,
1144 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1145 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1146 Uart.parityBits,
1147 p_response->response,
1148 p_response->response_n,
1149 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1150 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1151 SwapBits(GetParity(p_response->response, p_response->response_n), p_response->response_n));
1152 }
1153
1154 if (!tracing) {
1155 Dbprintf("Trace Full. Simulation stopped.");
1156 break;
1157 }
1158 }
15c4dc5a 1159
1160 Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
1161 LED_A_OFF();
1162}
1163
9492e0b0 1164
1165// prepare a delayed transfer. This simply shifts ToSend[] by a number
1166// of bits specified in the delay parameter.
1167void PrepareDelayedTransfer(uint16_t delay)
1168{
1169 uint8_t bitmask = 0;
1170 uint8_t bits_to_shift = 0;
1171 uint8_t bits_shifted = 0;
1172
1173 delay &= 0x07;
1174 if (delay) {
1175 for (uint16_t i = 0; i < delay; i++) {
1176 bitmask |= (0x01 << i);
1177 }
7bc95e2e 1178 ToSend[ToSendMax++] = 0x00;
9492e0b0 1179 for (uint16_t i = 0; i < ToSendMax; i++) {
1180 bits_to_shift = ToSend[i] & bitmask;
1181 ToSend[i] = ToSend[i] >> delay;
1182 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1183 bits_shifted = bits_to_shift;
1184 }
1185 }
1186}
1187
7bc95e2e 1188
1189//-------------------------------------------------------------------------------------
15c4dc5a 1190// Transmit the command (to the tag) that was placed in ToSend[].
9492e0b0 1191// Parameter timing:
7bc95e2e 1192// if NULL: transfer at next possible time, taking into account
1193// request guard time and frame delay time
1194// if == 0: transfer immediately and return time of transfer
9492e0b0 1195// if != 0: delay transfer until time specified
7bc95e2e 1196//-------------------------------------------------------------------------------------
9492e0b0 1197static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
15c4dc5a 1198{
7bc95e2e 1199
9492e0b0 1200 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
e30c654b 1201
7bc95e2e 1202 uint32_t ThisTransferTime = 0;
e30c654b 1203
9492e0b0 1204 if (timing) {
1205 if(*timing == 0) { // Measure time
7bc95e2e 1206 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
9492e0b0 1207 } else {
1208 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1209 }
7bc95e2e 1210 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1211 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1212 LastTimeProxToAirStart = *timing;
1213 } else {
1214 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1215 while(GetCountSspClk() < ThisTransferTime);
1216 LastTimeProxToAirStart = ThisTransferTime;
9492e0b0 1217 }
1218
7bc95e2e 1219 // clear TXRDY
1220 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1221
1222 // for(uint16_t c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission)
1223 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1224 // AT91C_BASE_SSC->SSC_THR = SEC_Y;
1225 // c++;
1226 // }
1227 // }
1228
1229 uint16_t c = 0;
9492e0b0 1230 for(;;) {
1231 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1232 AT91C_BASE_SSC->SSC_THR = cmd[c];
1233 c++;
1234 if(c >= len) {
1235 break;
1236 }
1237 }
1238 }
7bc95e2e 1239
1240 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
1241
15c4dc5a 1242}
1243
7bc95e2e 1244
15c4dc5a 1245//-----------------------------------------------------------------------------
195af472 1246// Prepare reader command (in bits, support short frames) to send to FPGA
15c4dc5a 1247//-----------------------------------------------------------------------------
195af472 1248void CodeIso14443aBitsAsReaderPar(const uint8_t * cmd, int bits, uint32_t dwParity)
15c4dc5a 1249{
7bc95e2e 1250 int i, j;
1251 int last;
1252 uint8_t b;
e30c654b 1253
7bc95e2e 1254 ToSendReset();
e30c654b 1255
7bc95e2e 1256 // Start of Communication (Seq. Z)
1257 ToSend[++ToSendMax] = SEC_Z;
1258 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1259 last = 0;
1260
1261 size_t bytecount = nbytes(bits);
1262 // Generate send structure for the data bits
1263 for (i = 0; i < bytecount; i++) {
1264 // Get the current byte to send
1265 b = cmd[i];
1266 size_t bitsleft = MIN((bits-(i*8)),8);
1267
1268 for (j = 0; j < bitsleft; j++) {
1269 if (b & 1) {
1270 // Sequence X
1271 ToSend[++ToSendMax] = SEC_X;
1272 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1273 last = 1;
1274 } else {
1275 if (last == 0) {
1276 // Sequence Z
1277 ToSend[++ToSendMax] = SEC_Z;
1278 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1279 } else {
1280 // Sequence Y
1281 ToSend[++ToSendMax] = SEC_Y;
1282 last = 0;
1283 }
1284 }
1285 b >>= 1;
1286 }
1287
1288 // Only transmit (last) parity bit if we transmitted a complete byte
1289 if (j == 8) {
1290 // Get the parity bit
1291 if ((dwParity >> i) & 0x01) {
1292 // Sequence X
1293 ToSend[++ToSendMax] = SEC_X;
1294 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1295 last = 1;
1296 } else {
1297 if (last == 0) {
1298 // Sequence Z
1299 ToSend[++ToSendMax] = SEC_Z;
1300 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1301 } else {
1302 // Sequence Y
1303 ToSend[++ToSendMax] = SEC_Y;
1304 last = 0;
1305 }
1306 }
1307 }
1308 }
e30c654b 1309
7bc95e2e 1310 // End of Communication: Logic 0 followed by Sequence Y
1311 if (last == 0) {
1312 // Sequence Z
1313 ToSend[++ToSendMax] = SEC_Z;
1314 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1315 } else {
1316 // Sequence Y
1317 ToSend[++ToSendMax] = SEC_Y;
1318 last = 0;
1319 }
1320 ToSend[++ToSendMax] = SEC_Y;
e30c654b 1321
7bc95e2e 1322 // Convert to length of command:
1323 ToSendMax++;
15c4dc5a 1324}
1325
195af472 1326//-----------------------------------------------------------------------------
1327// Prepare reader command to send to FPGA
1328//-----------------------------------------------------------------------------
1329void CodeIso14443aAsReaderPar(const uint8_t * cmd, int len, uint32_t dwParity)
1330{
1331 CodeIso14443aBitsAsReaderPar(cmd,len*8,dwParity);
1332}
1333
9ca155ba
M
1334//-----------------------------------------------------------------------------
1335// Wait for commands from reader
1336// Stop when button is pressed (return 1) or field was gone (return 2)
1337// Or return 0 when command is captured
1338//-----------------------------------------------------------------------------
7bc95e2e 1339static int EmGetCmd(uint8_t *received, int *len)
9ca155ba
M
1340{
1341 *len = 0;
1342
1343 uint32_t timer = 0, vtime = 0;
1344 int analogCnt = 0;
1345 int analogAVG = 0;
1346
1347 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1348 // only, since we are receiving, not transmitting).
1349 // Signal field is off with the appropriate LED
1350 LED_D_OFF();
1351 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1352
1353 // Set ADC to read field strength
1354 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1355 AT91C_BASE_ADC->ADC_MR =
1356 ADC_MODE_PRESCALE(32) |
1357 ADC_MODE_STARTUP_TIME(16) |
1358 ADC_MODE_SAMPLE_HOLD_TIME(8);
1359 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1360 // start ADC
1361 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1362
1363 // Now run a 'software UART' on the stream of incoming samples.
7bc95e2e 1364 UartReset();
9ca155ba 1365 Uart.output = received;
7bc95e2e 1366
1367 // Clear RXRDY:
1368 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba
M
1369
1370 for(;;) {
1371 WDT_HIT();
1372
1373 if (BUTTON_PRESS()) return 1;
1374
1375 // test if the field exists
1376 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1377 analogCnt++;
1378 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1379 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1380 if (analogCnt >= 32) {
1381 if ((33000 * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1382 vtime = GetTickCount();
1383 if (!timer) timer = vtime;
1384 // 50ms no field --> card to idle state
1385 if (vtime - timer > 50) return 2;
1386 } else
1387 if (timer) timer = 0;
1388 analogCnt = 0;
1389 analogAVG = 0;
1390 }
1391 }
7bc95e2e 1392
9ca155ba 1393 // receive and test the miller decoding
7bc95e2e 1394 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1395 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1396 if(MillerDecoding(b, 0)) {
1397 *len = Uart.len;
9ca155ba
M
1398 return 0;
1399 }
7bc95e2e 1400 }
1401
9ca155ba
M
1402 }
1403}
1404
9ca155ba 1405
7bc95e2e 1406static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded)
1407{
1408 uint8_t b;
1409 uint16_t i = 0;
1410 uint32_t ThisTransferTime;
1411
9ca155ba
M
1412 // Modulate Manchester
1413 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
7bc95e2e 1414
1415 // include correction bit if necessary
1416 if (Uart.parityBits & 0x01) {
1417 correctionNeeded = TRUE;
1418 }
1419 if(correctionNeeded) {
9ca155ba
M
1420 // 1236, so correction bit needed
1421 i = 0;
7bc95e2e 1422 } else {
1423 i = 1;
9ca155ba 1424 }
7bc95e2e 1425
1426 // clear receiving shift register and holding register
1427 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1428 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1429 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1430 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
9ca155ba 1431
7bc95e2e 1432 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1433 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1434 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1435 if (AT91C_BASE_SSC->SSC_RHR) break;
1436 }
1437
1438 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1439
1440 // Clear TXRDY:
1441 AT91C_BASE_SSC->SSC_THR = SEC_F;
1442
9ca155ba 1443 // send cycle
7bc95e2e 1444 for(; i <= respLen; ) {
9ca155ba 1445 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
7bc95e2e 1446 AT91C_BASE_SSC->SSC_THR = resp[i++];
1447 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba 1448 }
7bc95e2e 1449
9ca155ba
M
1450 if(BUTTON_PRESS()) {
1451 break;
1452 }
1453 }
1454
7bc95e2e 1455 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1456 for (i = 0; i < 2 ; ) {
1457 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1458 AT91C_BASE_SSC->SSC_THR = SEC_F;
1459 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1460 i++;
1461 }
1462 }
1463
1464 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1465
9ca155ba
M
1466 return 0;
1467}
1468
7bc95e2e 1469int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1470 Code4bitAnswerAsTag(resp);
0a39986e 1471 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1472 // do the tracing for the previous reader request and this tag answer:
1473 EmLogTrace(Uart.output,
1474 Uart.len,
1475 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1476 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1477 Uart.parityBits,
1478 &resp,
1479 1,
1480 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1481 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1482 SwapBits(GetParity(&resp, 1), 1));
0a39986e 1483 return res;
9ca155ba
M
1484}
1485
8f51ddb0 1486int EmSend4bit(uint8_t resp){
7bc95e2e 1487 return EmSend4bitEx(resp, false);
8f51ddb0
M
1488}
1489
7bc95e2e 1490int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par){
1491 CodeIso14443aAsTagPar(resp, respLen, par);
8f51ddb0 1492 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1493 // do the tracing for the previous reader request and this tag answer:
1494 EmLogTrace(Uart.output,
1495 Uart.len,
1496 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1497 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1498 Uart.parityBits,
1499 resp,
1500 respLen,
1501 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1502 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1503 SwapBits(GetParity(resp, respLen), respLen));
8f51ddb0
M
1504 return res;
1505}
1506
7bc95e2e 1507int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded){
8f51ddb0
M
1508 return EmSendCmdExPar(resp, respLen, correctionNeeded, GetParity(resp, respLen));
1509}
1510
1511int EmSendCmd(uint8_t *resp, int respLen){
7bc95e2e 1512 return EmSendCmdExPar(resp, respLen, false, GetParity(resp, respLen));
8f51ddb0
M
1513}
1514
1515int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
7bc95e2e 1516 return EmSendCmdExPar(resp, respLen, false, par);
1517}
1518
1519bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
1520 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity)
1521{
1522 if (tracing) {
1523 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1524 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1525 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1526 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1527 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1528 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1529 reader_EndTime = tag_StartTime - exact_fdt;
1530 reader_StartTime = reader_EndTime - reader_modlen;
1531 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_Parity, TRUE)) {
1532 return FALSE;
1533 } else if (!LogTrace(NULL, 0, reader_EndTime, 0, TRUE)) {
1534 return FALSE;
1535 } else if (!LogTrace(tag_data, tag_len, tag_StartTime, tag_Parity, FALSE)) {
1536 return FALSE;
1537 } else {
1538 return (!LogTrace(NULL, 0, tag_EndTime, 0, FALSE));
1539 }
1540 } else {
1541 return TRUE;
1542 }
9ca155ba
M
1543}
1544
15c4dc5a 1545//-----------------------------------------------------------------------------
1546// Wait a certain time for tag response
1547// If a response is captured return TRUE
e691fc45 1548// If it takes too long return FALSE
15c4dc5a 1549//-----------------------------------------------------------------------------
7bc95e2e 1550static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen)
15c4dc5a 1551{
7bc95e2e 1552 uint16_t c;
e691fc45 1553
15c4dc5a 1554 // Set FPGA mode to "reader listen mode", no modulation (listen
534983d7 1555 // only, since we are receiving, not transmitting).
1556 // Signal field is on with the appropriate LED
1557 LED_D_ON();
1558 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1c611bbd 1559
534983d7 1560 // Now get the answer from the card
7bc95e2e 1561 DemodReset();
534983d7 1562 Demod.output = receivedResponse;
15c4dc5a 1563
7bc95e2e 1564 // clear RXRDY:
1565 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1566
15c4dc5a 1567 c = 0;
1568 for(;;) {
534983d7 1569 WDT_HIT();
15c4dc5a 1570
534983d7 1571 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
534983d7 1572 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
7bc95e2e 1573 if(ManchesterDecoding(b, offset, 0)) {
1574 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
15c4dc5a 1575 return TRUE;
7bc95e2e 1576 } else if(c++ > iso14a_timeout) {
1577 return FALSE;
15c4dc5a 1578 }
534983d7 1579 }
1580 }
15c4dc5a 1581}
1582
9492e0b0 1583void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing)
15c4dc5a 1584{
981bd429 1585
7bc95e2e 1586 CodeIso14443aBitsAsReaderPar(frame,bits,par);
dfc3c505 1587
7bc95e2e 1588 // Send command to tag
1589 TransmitFor14443a(ToSend, ToSendMax, timing);
1590 if(trigger)
1591 LED_A_ON();
dfc3c505 1592
7bc95e2e 1593 // Log reader command in trace buffer
1594 if (tracing) {
1595 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1596 LogTrace(NULL, 0, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, 0, TRUE);
1597 }
15c4dc5a 1598}
1599
9492e0b0 1600void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing)
dfc3c505 1601{
9492e0b0 1602 ReaderTransmitBitsPar(frame,len*8,par, timing);
dfc3c505 1603}
15c4dc5a 1604
e691fc45 1605void ReaderTransmitBits(uint8_t* frame, int len, uint32_t *timing)
1606{
1607 // Generate parity and redirect
1608 ReaderTransmitBitsPar(frame,len,GetParity(frame,len/8), timing);
1609}
1610
9492e0b0 1611void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing)
15c4dc5a 1612{
1613 // Generate parity and redirect
9492e0b0 1614 ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing);
15c4dc5a 1615}
1616
e691fc45 1617int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
1618{
7bc95e2e 1619 if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160)) return FALSE;
1620 if (tracing) {
1621 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
1622 LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
1623 }
e691fc45 1624 return Demod.len;
1625}
1626
f7e3ed82 1627int ReaderReceive(uint8_t* receivedAnswer)
15c4dc5a 1628{
e691fc45 1629 return ReaderReceiveOffset(receivedAnswer, 0);
15c4dc5a 1630}
1631
e691fc45 1632int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
f89c7050 1633{
7bc95e2e 1634 if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160)) return FALSE;
1635 if (tracing) {
1636 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
1637 LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
1638 }
f89c7050 1639 *parptr = Demod.parityBits;
e691fc45 1640 return Demod.len;
f89c7050
M
1641}
1642
e691fc45 1643/* performs iso14443a anticollision procedure
534983d7 1644 * fills the uid pointer unless NULL
1645 * fills resp_data unless NULL */
79a73ab2 1646int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) {
ed258538 1647 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1648 uint8_t sel_all[] = { 0x93,0x20 };
e691fc45 1649 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
ed258538 1650 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1651 uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes
79a73ab2 1652 byte_t uid_resp[4];
1653 size_t uid_resp_len;
15c4dc5a 1654
ed258538 1655 uint8_t sak = 0x04; // cascade uid
1656 int cascade_level = 0;
1657 int len;
79a73ab2 1658
ed258538 1659 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
9492e0b0 1660 ReaderTransmitBitsPar(wupa,7,0, NULL);
7bc95e2e 1661
ed258538 1662 // Receive the ATQA
1663 if(!ReaderReceive(resp)) return 0;
e691fc45 1664 // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
1c611bbd 1665
ed258538 1666 if(p_hi14a_card) {
1667 memcpy(p_hi14a_card->atqa, resp, 2);
79a73ab2 1668 p_hi14a_card->uidlen = 0;
1669 memset(p_hi14a_card->uid,0,10);
1670 }
5f6d6c90 1671
79a73ab2 1672 // clear uid
1673 if (uid_ptr) {
1c611bbd 1674 memset(uid_ptr,0,10);
79a73ab2 1675 }
1676
ed258538 1677 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1678 // which case we need to make a cascade 2 request and select - this is a long UID
1679 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1680 for(; sak & 0x04; cascade_level++) {
1681 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1682 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1683
1684 // SELECT_ALL
9492e0b0 1685 ReaderTransmit(sel_all,sizeof(sel_all), NULL);
ed258538 1686 if (!ReaderReceive(resp)) return 0;
5f6d6c90 1687
e691fc45 1688 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1689 memset(uid_resp, 0, 4);
1690 uint16_t uid_resp_bits = 0;
1691 uint16_t collision_answer_offset = 0;
1692 // anti-collision-loop:
1693 while (Demod.collisionPos) {
1694 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1695 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1696 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1697 uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8);
1698 }
1699 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1700 uid_resp_bits++;
1701 // construct anticollosion command:
1702 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1703 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1704 sel_uid[2+i] = uid_resp[i];
1705 }
1706 collision_answer_offset = uid_resp_bits%8;
1707 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1708 if (!ReaderReceiveOffset(resp, collision_answer_offset)) return 0;
1709 }
1710 // finally, add the last bits and BCC of the UID
1711 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1712 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1713 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1714 }
1715
1716 } else { // no collision, use the response to SELECT_ALL as current uid
1717 memcpy(uid_resp,resp,4);
1718 }
1719 uid_resp_len = 4;
7bc95e2e 1720 // Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
5f6d6c90 1721
e691fc45 1722 // calculate crypto UID. Always use last 4 Bytes.
5f6d6c90 1723 if(cuid_ptr) {
1724 *cuid_ptr = bytes_to_num(uid_resp, 4);
79a73ab2 1725 }
e30c654b 1726
ed258538 1727 // Construct SELECT UID command
e691fc45 1728 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1729 memcpy(sel_uid+2,uid_resp,4); // the UID
1730 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1731 AppendCrc14443a(sel_uid,7); // calculate and add CRC
9492e0b0 1732 ReaderTransmit(sel_uid,sizeof(sel_uid), NULL);
534983d7 1733
ed258538 1734 // Receive the SAK
1735 if (!ReaderReceive(resp)) return 0;
1736 sak = resp[0];
79a73ab2 1737
1738 // Test if more parts of the uid are comming
e691fc45 1739 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
79a73ab2 1740 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1741 // http://www.nxp.com/documents/application_note/AN10927.pdf
ed258538 1742 memcpy(uid_resp, uid_resp + 1, 3);
79a73ab2 1743 uid_resp_len = 3;
1744 }
5f6d6c90 1745
79a73ab2 1746 if(uid_ptr) {
1747 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
1748 }
5f6d6c90 1749
79a73ab2 1750 if(p_hi14a_card) {
1751 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
1752 p_hi14a_card->uidlen += uid_resp_len;
1753 }
ed258538 1754 }
79a73ab2 1755
ed258538 1756 if(p_hi14a_card) {
1757 p_hi14a_card->sak = sak;
1758 p_hi14a_card->ats_len = 0;
1759 }
534983d7 1760
ed258538 1761 if( (sak & 0x20) == 0) {
1762 return 2; // non iso14443a compliant tag
79a73ab2 1763 }
534983d7 1764
ed258538 1765 // Request for answer to select
5191b3d1 1766 AppendCrc14443a(rats, 2);
9492e0b0 1767 ReaderTransmit(rats, sizeof(rats), NULL);
1c611bbd 1768
5191b3d1 1769 if (!(len = ReaderReceive(resp))) return 0;
1770
1771 if(p_hi14a_card) {
ed258538 1772 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
1773 p_hi14a_card->ats_len = len;
1774 }
5f6d6c90 1775
ed258538 1776 // reset the PCB block number
1777 iso14_pcb_blocknum = 0;
1778 return 1;
7e758047 1779}
15c4dc5a 1780
7bc95e2e 1781void iso14443a_setup(uint8_t fpga_minor_mode) {
9492e0b0 1782 // Set up the synchronous serial port
1783 FpgaSetupSsc();
7bc95e2e 1784 // connect Demodulated Signal to ADC:
7e758047 1785 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
e30c654b 1786
7e758047 1787 // Signal field is on with the appropriate LED
7bc95e2e 1788 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
1789 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
1790 LED_D_ON();
1791 } else {
1792 LED_D_OFF();
1793 }
1794 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
534983d7 1795
7bc95e2e 1796 // Start the timer
1797 StartCountSspClk();
1798
1799 DemodReset();
1800 UartReset();
1801 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
1802 iso14a_set_timeout(1050); // 10ms default
7e758047 1803}
15c4dc5a 1804
534983d7 1805int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) {
1806 uint8_t real_cmd[cmd_len+4];
1807 real_cmd[0] = 0x0a; //I-Block
b0127e65 1808 // put block number into the PCB
1809 real_cmd[0] |= iso14_pcb_blocknum;
534983d7 1810 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
1811 memcpy(real_cmd+2, cmd, cmd_len);
1812 AppendCrc14443a(real_cmd,cmd_len+2);
1813
9492e0b0 1814 ReaderTransmit(real_cmd, cmd_len+4, NULL);
534983d7 1815 size_t len = ReaderReceive(data);
b0127e65 1816 uint8_t * data_bytes = (uint8_t *) data;
1817 if (!len)
1818 return 0; //DATA LINK ERROR
1819 // if we received an I- or R(ACK)-Block with a block number equal to the
1820 // current block number, toggle the current block number
1821 else if (len >= 4 // PCB+CID+CRC = 4 bytes
1822 && ((data_bytes[0] & 0xC0) == 0 // I-Block
1823 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1824 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
1825 {
1826 iso14_pcb_blocknum ^= 1;
1827 }
1828
534983d7 1829 return len;
1830}
1831
7e758047 1832//-----------------------------------------------------------------------------
1833// Read an ISO 14443a tag. Send out commands and store answers.
1834//
1835//-----------------------------------------------------------------------------
7bc95e2e 1836void ReaderIso14443a(UsbCommand *c)
7e758047 1837{
534983d7 1838 iso14a_command_t param = c->arg[0];
7bc95e2e 1839 uint8_t *cmd = c->d.asBytes;
534983d7 1840 size_t len = c->arg[1];
5f6d6c90 1841 size_t lenbits = c->arg[2];
9492e0b0 1842 uint32_t arg0 = 0;
1843 byte_t buf[USB_CMD_DATA_SIZE];
902cb3c0 1844
5f6d6c90 1845 if(param & ISO14A_CONNECT) {
1846 iso14a_clear_trace();
1847 }
e691fc45 1848
7bc95e2e 1849 iso14a_set_tracing(TRUE);
e30c654b 1850
79a73ab2 1851 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 1852 iso14a_set_trigger(TRUE);
9492e0b0 1853 }
15c4dc5a 1854
534983d7 1855 if(param & ISO14A_CONNECT) {
7bc95e2e 1856 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
5f6d6c90 1857 if(!(param & ISO14A_NO_SELECT)) {
1858 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
1859 arg0 = iso14443a_select_card(NULL,card,NULL);
1860 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
1861 }
534983d7 1862 }
e30c654b 1863
534983d7 1864 if(param & ISO14A_SET_TIMEOUT) {
1865 iso14a_timeout = c->arg[2];
1866 }
e30c654b 1867
534983d7 1868 if(param & ISO14A_APDU) {
902cb3c0 1869 arg0 = iso14_apdu(cmd, len, buf);
79a73ab2 1870 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 1871 }
e30c654b 1872
534983d7 1873 if(param & ISO14A_RAW) {
1874 if(param & ISO14A_APPEND_CRC) {
1875 AppendCrc14443a(cmd,len);
1876 len += 2;
15c4dc5a 1877 }
5f6d6c90 1878 if(lenbits>0) {
1879 ReaderTransmitBitsPar(cmd,lenbits,GetParity(cmd,lenbits/8), NULL);
1880 } else {
1881 ReaderTransmit(cmd,len, NULL);
1882 }
902cb3c0 1883 arg0 = ReaderReceive(buf);
9492e0b0 1884 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 1885 }
15c4dc5a 1886
79a73ab2 1887 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 1888 iso14a_set_trigger(FALSE);
9492e0b0 1889 }
15c4dc5a 1890
79a73ab2 1891 if(param & ISO14A_NO_DISCONNECT) {
534983d7 1892 return;
9492e0b0 1893 }
15c4dc5a 1894
15c4dc5a 1895 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1896 LEDsoff();
15c4dc5a 1897}
b0127e65 1898
1c611bbd 1899
1c611bbd 1900// Determine the distance between two nonces.
1901// Assume that the difference is small, but we don't know which is first.
1902// Therefore try in alternating directions.
1903int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
1904
1905 uint16_t i;
1906 uint32_t nttmp1, nttmp2;
e772353f 1907
1c611bbd 1908 if (nt1 == nt2) return 0;
1909
1910 nttmp1 = nt1;
1911 nttmp2 = nt2;
1912
1913 for (i = 1; i < 32768; i++) {
1914 nttmp1 = prng_successor(nttmp1, 1);
1915 if (nttmp1 == nt2) return i;
1916 nttmp2 = prng_successor(nttmp2, 1);
1917 if (nttmp2 == nt1) return -i;
1918 }
1919
1920 return(-99999); // either nt1 or nt2 are invalid nonces
e772353f 1921}
1922
e772353f 1923
1c611bbd 1924//-----------------------------------------------------------------------------
1925// Recover several bits of the cypher stream. This implements (first stages of)
1926// the algorithm described in "The Dark Side of Security by Obscurity and
1927// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
1928// (article by Nicolas T. Courtois, 2009)
1929//-----------------------------------------------------------------------------
1930void ReaderMifare(bool first_try)
1931{
1932 // Mifare AUTH
1933 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
1934 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
1935 static uint8_t mf_nr_ar3;
e772353f 1936
1c611bbd 1937 uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
7bc95e2e 1938
d2f487af 1939 iso14a_clear_trace();
7bc95e2e 1940 iso14a_set_tracing(TRUE);
e772353f 1941
1c611bbd 1942 byte_t nt_diff = 0;
1943 byte_t par = 0;
1944 //byte_t par_mask = 0xff;
1945 static byte_t par_low = 0;
1946 bool led_on = TRUE;
1947 uint8_t uid[10];
1948 uint32_t cuid;
e772353f 1949
1c611bbd 1950 uint32_t nt, previous_nt;
1951 static uint32_t nt_attacked = 0;
1952 byte_t par_list[8] = {0,0,0,0,0,0,0,0};
1953 byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
e772353f 1954
1c611bbd 1955 static uint32_t sync_time;
1956 static uint32_t sync_cycles;
1957 int catch_up_cycles = 0;
1958 int last_catch_up = 0;
1959 uint16_t consecutive_resyncs = 0;
1960 int isOK = 0;
e772353f 1961
e772353f 1962
e772353f 1963
1c611bbd 1964 if (first_try) {
1c611bbd 1965 mf_nr_ar3 = 0;
7bc95e2e 1966 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
1967 sync_time = GetCountSspClk() & 0xfffffff8;
1c611bbd 1968 sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
1969 nt_attacked = 0;
1970 nt = 0;
1971 par = 0;
1972 }
1973 else {
1974 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
1975 // nt_attacked = prng_successor(nt_attacked, 1);
1976 mf_nr_ar3++;
1977 mf_nr_ar[3] = mf_nr_ar3;
1978 par = par_low;
1979 }
e30c654b 1980
15c4dc5a 1981 LED_A_ON();
1982 LED_B_OFF();
1983 LED_C_OFF();
1c611bbd 1984
7bc95e2e 1985
1c611bbd 1986 for(uint16_t i = 0; TRUE; i++) {
1987
1988 WDT_HIT();
e30c654b 1989
1c611bbd 1990 // Test if the action was cancelled
1991 if(BUTTON_PRESS()) {
1992 break;
1993 }
1994
1995 LED_C_ON();
e30c654b 1996
1c611bbd 1997 if(!iso14443a_select_card(uid, NULL, &cuid)) {
9492e0b0 1998 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
1c611bbd 1999 continue;
2000 }
2001
9492e0b0 2002 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
1c611bbd 2003 catch_up_cycles = 0;
2004
2005 // if we missed the sync time already, advance to the next nonce repeat
7bc95e2e 2006 while(GetCountSspClk() > sync_time) {
9492e0b0 2007 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
1c611bbd 2008 }
e30c654b 2009
9492e0b0 2010 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2011 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
f89c7050 2012
1c611bbd 2013 // Receive the (4 Byte) "random" nonce
2014 if (!ReaderReceive(receivedAnswer)) {
9492e0b0 2015 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
1c611bbd 2016 continue;
2017 }
2018
1c611bbd 2019 previous_nt = nt;
2020 nt = bytes_to_num(receivedAnswer, 4);
2021
2022 // Transmit reader nonce with fake par
9492e0b0 2023 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
1c611bbd 2024
2025 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2026 int nt_distance = dist_nt(previous_nt, nt);
2027 if (nt_distance == 0) {
2028 nt_attacked = nt;
2029 }
2030 else {
2031 if (nt_distance == -99999) { // invalid nonce received, try again
2032 continue;
2033 }
2034 sync_cycles = (sync_cycles - nt_distance);
9492e0b0 2035 if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
1c611bbd 2036 continue;
2037 }
2038 }
2039
2040 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2041 catch_up_cycles = -dist_nt(nt_attacked, nt);
2042 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2043 catch_up_cycles = 0;
2044 continue;
2045 }
2046 if (catch_up_cycles == last_catch_up) {
2047 consecutive_resyncs++;
2048 }
2049 else {
2050 last_catch_up = catch_up_cycles;
2051 consecutive_resyncs = 0;
2052 }
2053 if (consecutive_resyncs < 3) {
9492e0b0 2054 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
1c611bbd 2055 }
2056 else {
2057 sync_cycles = sync_cycles + catch_up_cycles;
9492e0b0 2058 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
1c611bbd 2059 }
2060 continue;
2061 }
2062
2063 consecutive_resyncs = 0;
2064
2065 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2066 if (ReaderReceive(receivedAnswer))
2067 {
9492e0b0 2068 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
1c611bbd 2069
2070 if (nt_diff == 0)
2071 {
2072 par_low = par & 0x07; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2073 }
2074
2075 led_on = !led_on;
2076 if(led_on) LED_B_ON(); else LED_B_OFF();
2077
2078 par_list[nt_diff] = par;
2079 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2080
2081 // Test if the information is complete
2082 if (nt_diff == 0x07) {
2083 isOK = 1;
2084 break;
2085 }
2086
2087 nt_diff = (nt_diff + 1) & 0x07;
2088 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2089 par = par_low;
2090 } else {
2091 if (nt_diff == 0 && first_try)
2092 {
2093 par++;
2094 } else {
2095 par = (((par >> 3) + 1) << 3) | par_low;
2096 }
2097 }
2098 }
2099
1c611bbd 2100
2101 mf_nr_ar[3] &= 0x1F;
2102
2103 byte_t buf[28];
2104 memcpy(buf + 0, uid, 4);
2105 num_to_bytes(nt, 4, buf + 4);
2106 memcpy(buf + 8, par_list, 8);
2107 memcpy(buf + 16, ks_list, 8);
2108 memcpy(buf + 24, mf_nr_ar, 4);
2109
2110 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2111
2112 // Thats it...
2113 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2114 LEDsoff();
7bc95e2e 2115
2116 iso14a_set_tracing(FALSE);
20f9a2a1 2117}
1c611bbd 2118
d2f487af 2119/**
2120 *MIFARE 1K simulate.
2121 *
2122 *@param flags :
2123 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2124 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2125 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2126 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2127 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2128 */
2129void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
20f9a2a1 2130{
50193c1e 2131 int cardSTATE = MFEMUL_NOFIELD;
8556b852 2132 int _7BUID = 0;
9ca155ba 2133 int vHf = 0; // in mV
8f51ddb0 2134 int res;
0a39986e
M
2135 uint32_t selTimer = 0;
2136 uint32_t authTimer = 0;
2137 uint32_t par = 0;
9ca155ba 2138 int len = 0;
8f51ddb0 2139 uint8_t cardWRBL = 0;
9ca155ba
M
2140 uint8_t cardAUTHSC = 0;
2141 uint8_t cardAUTHKEY = 0xff; // no authentication
51969283 2142 uint32_t cardRr = 0;
9ca155ba 2143 uint32_t cuid = 0;
d2f487af 2144 //uint32_t rn_enc = 0;
51969283 2145 uint32_t ans = 0;
0014cb46
M
2146 uint32_t cardINTREG = 0;
2147 uint8_t cardINTBLOCK = 0;
9ca155ba
M
2148 struct Crypto1State mpcs = {0, 0};
2149 struct Crypto1State *pcs;
2150 pcs = &mpcs;
d2f487af 2151 uint32_t numReads = 0;//Counts numer of times reader read a block
8f51ddb0
M
2152 uint8_t* receivedCmd = eml_get_bigbufptr_recbuf();
2153 uint8_t *response = eml_get_bigbufptr_sendbuf();
9ca155ba 2154
d2f487af 2155 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2156 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2157 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2158 uint8_t rSAK[] = {0x08, 0xb6, 0xdd};
2159 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
9ca155ba 2160
d2f487af 2161 uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
2162 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
7bc95e2e 2163
d2f487af 2164 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2165 // This can be used in a reader-only attack.
2166 // (it can also be retrieved via 'hf 14a list', but hey...
2167 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0};
2168 uint8_t ar_nr_collected = 0;
0014cb46 2169
0a39986e 2170 // clear trace
7bc95e2e 2171 iso14a_clear_trace();
2172 iso14a_set_tracing(TRUE);
51969283 2173
7bc95e2e 2174 // Authenticate response - nonce
51969283 2175 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
7bc95e2e 2176
d2f487af 2177 //-- Determine the UID
2178 // Can be set from emulator memory, incoming data
2179 // and can be 7 or 4 bytes long
7bc95e2e 2180 if (flags & FLAG_4B_UID_IN_DATA)
d2f487af 2181 {
2182 // 4B uid comes from data-portion of packet
2183 memcpy(rUIDBCC1,datain,4);
8556b852 2184 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852 2185
7bc95e2e 2186 } else if (flags & FLAG_7B_UID_IN_DATA) {
d2f487af 2187 // 7B uid comes from data-portion of packet
2188 memcpy(&rUIDBCC1[1],datain,3);
2189 memcpy(rUIDBCC2, datain+3, 4);
2190 _7BUID = true;
7bc95e2e 2191 } else {
d2f487af 2192 // get UID from emul memory
2193 emlGetMemBt(receivedCmd, 7, 1);
2194 _7BUID = !(receivedCmd[0] == 0x00);
2195 if (!_7BUID) { // ---------- 4BUID
2196 emlGetMemBt(rUIDBCC1, 0, 4);
2197 } else { // ---------- 7BUID
2198 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2199 emlGetMemBt(rUIDBCC2, 3, 4);
2200 }
2201 }
7bc95e2e 2202
d2f487af 2203 /*
2204 * Regardless of what method was used to set the UID, set fifth byte and modify
2205 * the ATQA for 4 or 7-byte UID
2206 */
d2f487af 2207 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
7bc95e2e 2208 if (_7BUID) {
d2f487af 2209 rATQA[0] = 0x44;
8556b852 2210 rUIDBCC1[0] = 0x88;
8556b852
M
2211 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2212 }
2213
9ca155ba 2214 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 2215 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
9ca155ba 2216
9ca155ba 2217
d2f487af 2218 if (MF_DBGLEVEL >= 1) {
2219 if (!_7BUID) {
2220 Dbprintf("4B UID: %02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3]);
7bc95e2e 2221 } else {
d2f487af 2222 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3],rUIDBCC2[0],rUIDBCC2[1] ,rUIDBCC2[2] , rUIDBCC2[3]);
2223 }
2224 }
7bc95e2e 2225
2226 bool finished = FALSE;
d2f487af 2227 while (!BUTTON_PRESS() && !finished) {
9ca155ba 2228 WDT_HIT();
9ca155ba
M
2229
2230 // find reader field
2231 // Vref = 3300mV, and an 10:1 voltage divider on the input
2232 // can measure voltages up to 33000 mV
2233 if (cardSTATE == MFEMUL_NOFIELD) {
2234 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
2235 if (vHf > MF_MINFIELDV) {
0014cb46 2236 cardSTATE_TO_IDLE();
9ca155ba
M
2237 LED_A_ON();
2238 }
2239 }
d2f487af 2240 if(cardSTATE == MFEMUL_NOFIELD) continue;
9ca155ba 2241
d2f487af 2242 //Now, get data
2243
7bc95e2e 2244 res = EmGetCmd(receivedCmd, &len);
d2f487af 2245 if (res == 2) { //Field is off!
2246 cardSTATE = MFEMUL_NOFIELD;
2247 LEDsoff();
2248 continue;
7bc95e2e 2249 } else if (res == 1) {
2250 break; //return value 1 means button press
2251 }
2252
d2f487af 2253 // REQ or WUP request in ANY state and WUP in HALTED state
2254 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2255 selTimer = GetTickCount();
2256 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2257 cardSTATE = MFEMUL_SELECT1;
2258
2259 // init crypto block
2260 LED_B_OFF();
2261 LED_C_OFF();
2262 crypto1_destroy(pcs);
2263 cardAUTHKEY = 0xff;
2264 continue;
0a39986e 2265 }
7bc95e2e 2266
50193c1e 2267 switch (cardSTATE) {
d2f487af 2268 case MFEMUL_NOFIELD:
2269 case MFEMUL_HALTED:
50193c1e 2270 case MFEMUL_IDLE:{
7bc95e2e 2271 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2272 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
50193c1e
M
2273 break;
2274 }
2275 case MFEMUL_SELECT1:{
9ca155ba
M
2276 // select all
2277 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
d2f487af 2278 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
9ca155ba 2279 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
0014cb46 2280 break;
9ca155ba
M
2281 }
2282
d2f487af 2283 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2284 {
2285 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2286 }
9ca155ba 2287 // select card
0a39986e
M
2288 if (len == 9 &&
2289 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
7bc95e2e 2290 EmSendCmd(_7BUID?rSAK1:rSAK, sizeof(_7BUID?rSAK1:rSAK));
9ca155ba 2291 cuid = bytes_to_num(rUIDBCC1, 4);
8556b852
M
2292 if (!_7BUID) {
2293 cardSTATE = MFEMUL_WORK;
0014cb46
M
2294 LED_B_ON();
2295 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2296 break;
8556b852
M
2297 } else {
2298 cardSTATE = MFEMUL_SELECT2;
8556b852 2299 }
9ca155ba 2300 }
50193c1e
M
2301 break;
2302 }
d2f487af 2303 case MFEMUL_AUTH1:{
2304 if( len != 8)
2305 {
2306 cardSTATE_TO_IDLE();
7bc95e2e 2307 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2308 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
d2f487af 2309 break;
2310 }
2311 uint32_t ar = bytes_to_num(receivedCmd, 4);
2312 uint32_t nr= bytes_to_num(&receivedCmd[4], 4);
2313
2314 //Collect AR/NR
2315 if(ar_nr_collected < 2){
273b57a7 2316 if(ar_nr_responses[2] != ar)
2317 {// Avoid duplicates... probably not necessary, ar should vary.
d2f487af 2318 ar_nr_responses[ar_nr_collected*4] = cuid;
2319 ar_nr_responses[ar_nr_collected*4+1] = nonce;
2320 ar_nr_responses[ar_nr_collected*4+2] = ar;
2321 ar_nr_responses[ar_nr_collected*4+3] = nr;
273b57a7 2322 ar_nr_collected++;
d2f487af 2323 }
2324 }
2325
2326 // --- crypto
2327 crypto1_word(pcs, ar , 1);
2328 cardRr = nr ^ crypto1_word(pcs, 0, 0);
2329
2330 // test if auth OK
2331 if (cardRr != prng_successor(nonce, 64)){
2332 if (MF_DBGLEVEL >= 2) Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x",cardRr, prng_successor(nonce, 64));
7bc95e2e 2333 // Shouldn't we respond anything here?
d2f487af 2334 // Right now, we don't nack or anything, which causes the
2335 // reader to do a WUPA after a while. /Martin
2336 cardSTATE_TO_IDLE();
7bc95e2e 2337 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2338 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
d2f487af 2339 break;
2340 }
2341
2342 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2343
2344 num_to_bytes(ans, 4, rAUTH_AT);
2345 // --- crypto
2346 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2347 LED_C_ON();
2348 cardSTATE = MFEMUL_WORK;
2349 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED. sector=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer);
2350 break;
2351 }
50193c1e 2352 case MFEMUL_SELECT2:{
7bc95e2e 2353 if (!len) {
2354 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2355 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2356 break;
2357 }
8556b852 2358 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
9ca155ba 2359 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
8556b852
M
2360 break;
2361 }
9ca155ba 2362
8556b852
M
2363 // select 2 card
2364 if (len == 9 &&
2365 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2366 EmSendCmd(rSAK, sizeof(rSAK));
8556b852
M
2367 cuid = bytes_to_num(rUIDBCC2, 4);
2368 cardSTATE = MFEMUL_WORK;
2369 LED_B_ON();
0014cb46 2370 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
8556b852
M
2371 break;
2372 }
0014cb46
M
2373
2374 // i guess there is a command). go into the work state.
7bc95e2e 2375 if (len != 4) {
2376 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2377 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2378 break;
2379 }
0014cb46 2380 cardSTATE = MFEMUL_WORK;
d2f487af 2381 //goto lbWORK;
2382 //intentional fall-through to the next case-stmt
50193c1e 2383 }
51969283 2384
7bc95e2e 2385 case MFEMUL_WORK:{
2386 if (len == 0) {
2387 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2388 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2389 break;
2390 }
2391
d2f487af 2392 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2393
7bc95e2e 2394 if(encrypted_data) {
51969283
M
2395 // decrypt seqence
2396 mf_crypto1_decrypt(pcs, receivedCmd, len);
d2f487af 2397 }
7bc95e2e 2398
d2f487af 2399 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2400 authTimer = GetTickCount();
2401 cardAUTHSC = receivedCmd[1] / 4; // received block num
2402 cardAUTHKEY = receivedCmd[0] - 0x60;
2403 crypto1_destroy(pcs);//Added by martin
2404 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
51969283 2405
d2f487af 2406 if (!encrypted_data) { // first authentication
2407 if (MF_DBGLEVEL >= 2) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
51969283 2408
d2f487af 2409 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2410 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
7bc95e2e 2411 } else { // nested authentication
d2f487af 2412 if (MF_DBGLEVEL >= 2) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
7bc95e2e 2413 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
d2f487af 2414 num_to_bytes(ans, 4, rAUTH_AT);
2415 }
2416 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2417 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2418 cardSTATE = MFEMUL_AUTH1;
2419 break;
51969283 2420 }
7bc95e2e 2421
8f51ddb0
M
2422 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2423 // BUT... ACK --> NACK
2424 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2425 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2426 break;
2427 }
2428
2429 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2430 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2431 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2432 break;
0a39986e
M
2433 }
2434
7bc95e2e 2435 if(len != 4) {
2436 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2437 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2438 break;
2439 }
d2f487af 2440
2441 if(receivedCmd[0] == 0x30 // read block
2442 || receivedCmd[0] == 0xA0 // write block
2443 || receivedCmd[0] == 0xC0
2444 || receivedCmd[0] == 0xC1
2445 || receivedCmd[0] == 0xC2 // inc dec restore
7bc95e2e 2446 || receivedCmd[0] == 0xB0) { // transfer
2447 if (receivedCmd[1] >= 16 * 4) {
d2f487af 2448 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2449 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2450 break;
2451 }
2452
7bc95e2e 2453 if (receivedCmd[1] / 4 != cardAUTHSC) {
8f51ddb0 2454 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
d2f487af 2455 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
8f51ddb0
M
2456 break;
2457 }
d2f487af 2458 }
2459 // read block
2460 if (receivedCmd[0] == 0x30) {
2461 if (MF_DBGLEVEL >= 2) {
2462 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2463 }
8f51ddb0
M
2464 emlGetMem(response, receivedCmd[1], 1);
2465 AppendCrc14443a(response, 16);
2466 mf_crypto1_encrypt(pcs, response, 18, &par);
2467 EmSendCmdPar(response, 18, par);
d2f487af 2468 numReads++;
7bc95e2e 2469 if(exitAfterNReads > 0 && numReads == exitAfterNReads) {
d2f487af 2470 Dbprintf("%d reads done, exiting", numReads);
2471 finished = true;
2472 }
0a39986e
M
2473 break;
2474 }
0a39986e 2475 // write block
d2f487af 2476 if (receivedCmd[0] == 0xA0) {
2477 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
8f51ddb0 2478 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
8f51ddb0
M
2479 cardSTATE = MFEMUL_WRITEBL2;
2480 cardWRBL = receivedCmd[1];
0a39986e 2481 break;
7bc95e2e 2482 }
0014cb46 2483 // increment, decrement, restore
d2f487af 2484 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
2485 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2486 if (emlCheckValBl(receivedCmd[1])) {
2487 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
0014cb46
M
2488 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2489 break;
2490 }
2491 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2492 if (receivedCmd[0] == 0xC1)
2493 cardSTATE = MFEMUL_INTREG_INC;
2494 if (receivedCmd[0] == 0xC0)
2495 cardSTATE = MFEMUL_INTREG_DEC;
2496 if (receivedCmd[0] == 0xC2)
2497 cardSTATE = MFEMUL_INTREG_REST;
2498 cardWRBL = receivedCmd[1];
0014cb46
M
2499 break;
2500 }
0014cb46 2501 // transfer
d2f487af 2502 if (receivedCmd[0] == 0xB0) {
2503 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
0014cb46
M
2504 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2505 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2506 else
2507 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
0014cb46
M
2508 break;
2509 }
9ca155ba 2510 // halt
d2f487af 2511 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
9ca155ba 2512 LED_B_OFF();
0a39986e 2513 LED_C_OFF();
0014cb46
M
2514 cardSTATE = MFEMUL_HALTED;
2515 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
7bc95e2e 2516 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2517 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0a39986e 2518 break;
9ca155ba 2519 }
d2f487af 2520 // RATS
2521 if (receivedCmd[0] == 0xe0) {//RATS
8f51ddb0
M
2522 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2523 break;
2524 }
d2f487af 2525 // command not allowed
2526 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2527 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
51969283 2528 break;
8f51ddb0
M
2529 }
2530 case MFEMUL_WRITEBL2:{
2531 if (len == 18){
2532 mf_crypto1_decrypt(pcs, receivedCmd, len);
2533 emlSetMem(receivedCmd, cardWRBL, 1);
2534 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2535 cardSTATE = MFEMUL_WORK;
51969283 2536 } else {
0014cb46 2537 cardSTATE_TO_IDLE();
7bc95e2e 2538 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2539 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
8f51ddb0 2540 }
8f51ddb0 2541 break;
50193c1e 2542 }
0014cb46
M
2543
2544 case MFEMUL_INTREG_INC:{
2545 mf_crypto1_decrypt(pcs, receivedCmd, len);
2546 memcpy(&ans, receivedCmd, 4);
2547 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2548 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2549 cardSTATE_TO_IDLE();
2550 break;
7bc95e2e 2551 }
2552 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2553 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2554 cardINTREG = cardINTREG + ans;
2555 cardSTATE = MFEMUL_WORK;
2556 break;
2557 }
2558 case MFEMUL_INTREG_DEC:{
2559 mf_crypto1_decrypt(pcs, receivedCmd, len);
2560 memcpy(&ans, receivedCmd, 4);
2561 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2562 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2563 cardSTATE_TO_IDLE();
2564 break;
2565 }
7bc95e2e 2566 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2567 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2568 cardINTREG = cardINTREG - ans;
2569 cardSTATE = MFEMUL_WORK;
2570 break;
2571 }
2572 case MFEMUL_INTREG_REST:{
2573 mf_crypto1_decrypt(pcs, receivedCmd, len);
2574 memcpy(&ans, receivedCmd, 4);
2575 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2576 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2577 cardSTATE_TO_IDLE();
2578 break;
2579 }
7bc95e2e 2580 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2581 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2582 cardSTATE = MFEMUL_WORK;
2583 break;
2584 }
50193c1e 2585 }
50193c1e
M
2586 }
2587
9ca155ba
M
2588 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2589 LEDsoff();
2590
d2f487af 2591 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2592 {
2593 //May just aswell send the collected ar_nr in the response aswell
2594 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,0,0,&ar_nr_responses,ar_nr_collected*4*4);
2595 }
2596 if(flags & FLAG_NR_AR_ATTACK)
2597 {
7bc95e2e 2598 if(ar_nr_collected > 1) {
d2f487af 2599 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
f87941bd 2600 Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x",
d2f487af 2601 ar_nr_responses[0], // UID
2602 ar_nr_responses[1], //NT
2603 ar_nr_responses[2], //AR1
2604 ar_nr_responses[3], //NR1
2605 ar_nr_responses[6], //AR2
2606 ar_nr_responses[7] //NR2
2607 );
7bc95e2e 2608 } else {
d2f487af 2609 Dbprintf("Failed to obtain two AR/NR pairs!");
7bc95e2e 2610 if(ar_nr_collected >0) {
d2f487af 2611 Dbprintf("Only got these: UID=%08d, nonce=%08d, AR1=%08d, NR1=%08d",
2612 ar_nr_responses[0], // UID
2613 ar_nr_responses[1], //NT
2614 ar_nr_responses[2], //AR1
2615 ar_nr_responses[3] //NR1
2616 );
2617 }
2618 }
2619 }
0014cb46 2620 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, traceLen);
15c4dc5a 2621}
b62a5a84 2622
d2f487af 2623
2624
b62a5a84
M
2625//-----------------------------------------------------------------------------
2626// MIFARE sniffer.
2627//
2628//-----------------------------------------------------------------------------
5cd9ec01
M
2629void RAMFUNC SniffMifare(uint8_t param) {
2630 // param:
2631 // bit 0 - trigger from first card answer
2632 // bit 1 - trigger from first reader 7-bit request
39864b0b
M
2633
2634 // C(red) A(yellow) B(green)
b62a5a84
M
2635 LEDsoff();
2636 // init trace buffer
d19929cb 2637 iso14a_clear_trace();
b62a5a84 2638
b62a5a84
M
2639 // The command (reader -> tag) that we're receiving.
2640 // The length of a received command will in most cases be no more than 18 bytes.
2641 // So 32 should be enough!
2642 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
2643 // The response (tag -> reader) that we're receiving.
2644 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
2645
2646 // As we receive stuff, we copy it from receivedCmd or receivedResponse
2647 // into trace, along with its length and other annotations.
2648 //uint8_t *trace = (uint8_t *)BigBuf;
2649
2650 // The DMA buffer, used to stream samples from the FPGA
7bc95e2e 2651 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
2652 uint8_t *data = dmaBuf;
2653 uint8_t previous_data = 0;
5cd9ec01
M
2654 int maxDataLen = 0;
2655 int dataLen = 0;
7bc95e2e 2656 bool ReaderIsActive = FALSE;
2657 bool TagIsActive = FALSE;
2658
2659 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
b62a5a84
M
2660
2661 // Set up the demodulator for tag -> reader responses.
2662 Demod.output = receivedResponse;
b62a5a84
M
2663
2664 // Set up the demodulator for the reader -> tag commands
b62a5a84 2665 Uart.output = receivedCmd;
b62a5a84
M
2666
2667 // Setup for the DMA.
7bc95e2e 2668 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
b62a5a84 2669
b62a5a84 2670 LED_D_OFF();
39864b0b
M
2671
2672 // init sniffer
2673 MfSniffInit();
b62a5a84 2674
b62a5a84 2675 // And now we loop, receiving samples.
7bc95e2e 2676 for(uint32_t sniffCounter = 0; TRUE; ) {
2677
5cd9ec01
M
2678 if(BUTTON_PRESS()) {
2679 DbpString("cancelled by button");
7bc95e2e 2680 break;
5cd9ec01
M
2681 }
2682
b62a5a84
M
2683 LED_A_ON();
2684 WDT_HIT();
39864b0b 2685
7bc95e2e 2686 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
2687 // check if a transaction is completed (timeout after 2000ms).
2688 // if yes, stop the DMA transfer and send what we have so far to the client
2689 if (MfSniffSend(2000)) {
2690 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2691 sniffCounter = 0;
2692 data = dmaBuf;
2693 maxDataLen = 0;
2694 ReaderIsActive = FALSE;
2695 TagIsActive = FALSE;
2696 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
39864b0b 2697 }
39864b0b 2698 }
7bc95e2e 2699
2700 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
2701 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
2702 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
2703 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
2704 } else {
2705 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
5cd9ec01
M
2706 }
2707 // test for length of buffer
7bc95e2e 2708 if(dataLen > maxDataLen) { // we are more behind than ever...
2709 maxDataLen = dataLen;
5cd9ec01
M
2710 if(dataLen > 400) {
2711 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
7bc95e2e 2712 break;
b62a5a84
M
2713 }
2714 }
5cd9ec01 2715 if(dataLen < 1) continue;
b62a5a84 2716
7bc95e2e 2717 // primary buffer was stopped ( <-- we lost data!
5cd9ec01
M
2718 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
2719 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
2720 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
55acbb2a 2721 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
2722 }
2723 // secondary buffer sets as primary, secondary buffer was stopped
2724 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
2725 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
b62a5a84
M
2726 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
2727 }
5cd9ec01
M
2728
2729 LED_A_OFF();
b62a5a84 2730
7bc95e2e 2731 if (sniffCounter & 0x01) {
b62a5a84 2732
7bc95e2e 2733 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
2734 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
2735 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
2736 LED_C_INV();
2737 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parityBits, Uart.bitCount, TRUE)) break;
b62a5a84 2738
7bc95e2e 2739 /* And ready to receive another command. */
2740 UartReset();
2741
2742 /* And also reset the demod code */
2743 DemodReset();
2744 }
2745 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
2746 }
2747
2748 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
2749 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
2750 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
2751 LED_C_INV();
b62a5a84 2752
7bc95e2e 2753 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;
39864b0b 2754
7bc95e2e 2755 // And ready to receive another response.
2756 DemodReset();
2757 }
2758 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
2759 }
b62a5a84
M
2760 }
2761
7bc95e2e 2762 previous_data = *data;
2763 sniffCounter++;
5cd9ec01
M
2764 data++;
2765 if(data > dmaBuf + DMA_BUFFER_SIZE) {
2766 data = dmaBuf;
b62a5a84 2767 }
7bc95e2e 2768
b62a5a84
M
2769 } // main cycle
2770
2771 DbpString("COMMAND FINISHED");
2772
55acbb2a 2773 FpgaDisableSscDma();
39864b0b
M
2774 MfSniffEnd();
2775
7bc95e2e 2776 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
b62a5a84 2777 LEDsoff();
3803d529 2778}
Impressum, Datenschutz