]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/iso14443a.c
FIX: old bug back, and now fixed again. @marshmellow42
[proxmark3-svn] / armsrc / iso14443a.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
b62a5a84 2// Merlok - June 2011, 2012
15c4dc5a 3// Gerhard de Koning Gans - May 2008
534983d7 4// Hagen Fritsch - June 2010
bd20f8f4 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
15c4dc5a 9//-----------------------------------------------------------------------------
bd20f8f4 10// Routines to support ISO 14443 type A.
11//-----------------------------------------------------------------------------
12
e30c654b 13#include "proxmark3.h"
15c4dc5a 14#include "apps.h"
f7e3ed82 15#include "util.h"
9ab7a6c7 16#include "string.h"
902cb3c0 17#include "cmd.h"
15c4dc5a 18#include "iso14443crc.h"
534983d7 19#include "iso14443a.h"
20f9a2a1
M
20#include "crapto1.h"
21#include "mifareutil.h"
3000dc4e 22#include "BigBuf.h"
534983d7 23static uint32_t iso14a_timeout;
1e262141 24int rsamples = 0;
1e262141 25uint8_t trigger = 0;
b0127e65 26// the block number for the ISO14443-4 PCB
27static uint8_t iso14_pcb_blocknum = 0;
15c4dc5a 28
7bc95e2e 29//
30// ISO14443 timing:
31//
32// minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
33#define REQUEST_GUARD_TIME (7000/16 + 1)
34// minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
35#define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
36// bool LastCommandWasRequest = FALSE;
37
38//
39// Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
40//
d714d3ef 41// When the PM acts as reader and is receiving tag data, it takes
42// 3 ticks delay in the AD converter
43// 16 ticks until the modulation detector completes and sets curbit
44// 8 ticks until bit_to_arm is assigned from curbit
45// 8*16 ticks for the transfer from FPGA to ARM
7bc95e2e 46// 4*16 ticks until we measure the time
47// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 48#define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
7bc95e2e 49
50// When the PM acts as a reader and is sending, it takes
51// 4*16 ticks until we can write data to the sending hold register
52// 8*16 ticks until the SHR is transferred to the Sending Shift Register
53// 8 ticks until the first transfer starts
54// 8 ticks later the FPGA samples the data
55// 1 tick to assign mod_sig_coil
56#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
57
58// When the PM acts as tag and is receiving it takes
d714d3ef 59// 2 ticks delay in the RF part (for the first falling edge),
7bc95e2e 60// 3 ticks for the A/D conversion,
61// 8 ticks on average until the start of the SSC transfer,
62// 8 ticks until the SSC samples the first data
63// 7*16 ticks to complete the transfer from FPGA to ARM
64// 8 ticks until the next ssp_clk rising edge
d714d3ef 65// 4*16 ticks until we measure the time
7bc95e2e 66// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 67#define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
7bc95e2e 68
69// The FPGA will report its internal sending delay in
70uint16_t FpgaSendQueueDelay;
71// the 5 first bits are the number of bits buffered in mod_sig_buf
72// the last three bits are the remaining ticks/2 after the mod_sig_buf shift
73#define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
74
75// When the PM acts as tag and is sending, it takes
d714d3ef 76// 4*16 ticks until we can write data to the sending hold register
7bc95e2e 77// 8*16 ticks until the SHR is transferred to the Sending Shift Register
78// 8 ticks until the first transfer starts
79// 8 ticks later the FPGA samples the data
80// + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
81// + 1 tick to assign mod_sig_coil
d714d3ef 82#define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
7bc95e2e 83
84// When the PM acts as sniffer and is receiving tag data, it takes
85// 3 ticks A/D conversion
d714d3ef 86// 14 ticks to complete the modulation detection
87// 8 ticks (on average) until the result is stored in to_arm
7bc95e2e 88// + the delays in transferring data - which is the same for
89// sniffing reader and tag data and therefore not relevant
d714d3ef 90#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
7bc95e2e 91
d714d3ef 92// When the PM acts as sniffer and is receiving reader data, it takes
93// 2 ticks delay in analogue RF receiver (for the falling edge of the
94// start bit, which marks the start of the communication)
7bc95e2e 95// 3 ticks A/D conversion
d714d3ef 96// 8 ticks on average until the data is stored in to_arm.
7bc95e2e 97// + the delays in transferring data - which is the same for
98// sniffing reader and tag data and therefore not relevant
d714d3ef 99#define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
7bc95e2e 100
101//variables used for timing purposes:
102//these are in ssp_clk cycles:
6a1f2d82 103static uint32_t NextTransferTime;
104static uint32_t LastTimeProxToAirStart;
105static uint32_t LastProxToAirDuration;
7bc95e2e 106
107
108
8f51ddb0 109// CARD TO READER - manchester
72934aa3 110// Sequence D: 11110000 modulation with subcarrier during first half
111// Sequence E: 00001111 modulation with subcarrier during second half
112// Sequence F: 00000000 no modulation with subcarrier
8f51ddb0 113// READER TO CARD - miller
72934aa3 114// Sequence X: 00001100 drop after half a period
115// Sequence Y: 00000000 no drop
116// Sequence Z: 11000000 drop at start
117#define SEC_D 0xf0
118#define SEC_E 0x0f
119#define SEC_F 0x00
120#define SEC_X 0x0c
121#define SEC_Y 0x00
122#define SEC_Z 0xc0
15c4dc5a 123
1e262141 124const uint8_t OddByteParity[256] = {
15c4dc5a 125 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
126 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
127 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
141};
142
19a700a8 143
902cb3c0 144void iso14a_set_trigger(bool enable) {
534983d7 145 trigger = enable;
146}
147
d19929cb 148
b0127e65 149void iso14a_set_timeout(uint32_t timeout) {
150 iso14a_timeout = timeout;
19a700a8 151 if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);
b0127e65 152}
8556b852 153
19a700a8 154
155void iso14a_set_ATS_timeout(uint8_t *ats) {
156
157 uint8_t tb1;
158 uint8_t fwi;
159 uint32_t fwt;
160
161 if (ats[0] > 1) { // there is a format byte T0
162 if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
163 if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
164 tb1 = ats[3];
165 } else {
166 tb1 = ats[2];
167 }
168 fwi = (tb1 & 0xf0) >> 4; // frame waiting indicator (FWI)
169 fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc
170
171 iso14a_set_timeout(fwt/(8*16));
172 }
173 }
174}
175
176
15c4dc5a 177//-----------------------------------------------------------------------------
178// Generate the parity value for a byte sequence
e30c654b 179//
15c4dc5a 180//-----------------------------------------------------------------------------
20f9a2a1
M
181byte_t oddparity (const byte_t bt)
182{
5f6d6c90 183 return OddByteParity[bt];
20f9a2a1
M
184}
185
6a1f2d82 186void GetParity(const uint8_t *pbtCmd, uint16_t iLen, uint8_t *par)
15c4dc5a 187{
6a1f2d82 188 uint16_t paritybit_cnt = 0;
189 uint16_t paritybyte_cnt = 0;
190 uint8_t parityBits = 0;
191
192 for (uint16_t i = 0; i < iLen; i++) {
193 // Generate the parity bits
194 parityBits |= ((OddByteParity[pbtCmd[i]]) << (7-paritybit_cnt));
195 if (paritybit_cnt == 7) {
196 par[paritybyte_cnt] = parityBits; // save 8 Bits parity
197 parityBits = 0; // and advance to next Parity Byte
198 paritybyte_cnt++;
199 paritybit_cnt = 0;
200 } else {
201 paritybit_cnt++;
202 }
5f6d6c90 203 }
6a1f2d82 204
205 // save remaining parity bits
206 par[paritybyte_cnt] = parityBits;
207
15c4dc5a 208}
209
534983d7 210void AppendCrc14443a(uint8_t* data, int len)
15c4dc5a 211{
5f6d6c90 212 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
15c4dc5a 213}
214
0ec548dc 215void AppendCrc14443b(uint8_t* data, int len)
216{
217 ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
218}
219
220
7bc95e2e 221//=============================================================================
222// ISO 14443 Type A - Miller decoder
223//=============================================================================
224// Basics:
225// This decoder is used when the PM3 acts as a tag.
226// The reader will generate "pauses" by temporarily switching of the field.
227// At the PM3 antenna we will therefore measure a modulated antenna voltage.
228// The FPGA does a comparison with a threshold and would deliver e.g.:
229// ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
230// The Miller decoder needs to identify the following sequences:
231// 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
232// 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
233// 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
234// Note 1: the bitstream may start at any time. We therefore need to sync.
235// Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
15c4dc5a 236//-----------------------------------------------------------------------------
b62a5a84 237static tUart Uart;
15c4dc5a 238
d7aa3739 239// Lookup-Table to decide if 4 raw bits are a modulation.
0ec548dc 240// We accept the following:
241// 0001 - a 3 tick wide pause
242// 0011 - a 2 tick wide pause, or a three tick wide pause shifted left
243// 0111 - a 2 tick wide pause shifted left
244// 1001 - a 2 tick wide pause shifted right
d7aa3739 245const bool Mod_Miller_LUT[] = {
0ec548dc 246 FALSE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, TRUE,
247 FALSE, TRUE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE
d7aa3739 248};
0ec548dc 249#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
250#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
d7aa3739 251
7bc95e2e 252void UartReset()
15c4dc5a 253{
7bc95e2e 254 Uart.state = STATE_UNSYNCD;
255 Uart.bitCount = 0;
256 Uart.len = 0; // number of decoded data bytes
6a1f2d82 257 Uart.parityLen = 0; // number of decoded parity bytes
7bc95e2e 258 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
6a1f2d82 259 Uart.parityBits = 0; // holds 8 parity bits
7bc95e2e 260 Uart.startTime = 0;
261 Uart.endTime = 0;
46c65fed 262
263 Uart.byteCntMax = 0;
264 Uart.posCnt = 0;
265 Uart.syncBit = 9999;
7bc95e2e 266}
15c4dc5a 267
6a1f2d82 268void UartInit(uint8_t *data, uint8_t *parity)
269{
270 Uart.output = data;
271 Uart.parity = parity;
0ec548dc 272 Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
6a1f2d82 273 UartReset();
274}
d714d3ef 275
7bc95e2e 276// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
277static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
278{
15c4dc5a 279
0ec548dc 280 Uart.fourBits = (Uart.fourBits << 8) | bit;
7bc95e2e 281
0c8d25eb 282 if (Uart.state == STATE_UNSYNCD) { // not yet synced
3fe4ff4f 283
0ec548dc 284 Uart.syncBit = 9999; // not set
46c65fed 285
286 // 00x11111 2|3 ticks pause followed by 6|5 ticks unmodulated Sequence Z (a "0" or "start of communication")
287 // 11111111 8 ticks unmodulation Sequence Y (a "0" or "end of communication" or "no information")
288 // 111100x1 4 ticks unmodulated followed by 2|3 ticks pause Sequence X (a "1")
289
0ec548dc 290 // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
46c65fed 291 // Sequence X followed by Sequence Y followed by Sequence Z (111100x1 11111111 00x11111)
292 // we therefore look for a ...xx1111 11111111 00x11111xxxxxx... pattern
0ec548dc 293 // (12 '1's followed by 2 '0's, eventually followed by another '0', followed by 5 '1's)
46c65fed 294 //
295#define ISO14443A_STARTBIT_MASK 0x07FFEF80 // mask is 00001111 11111111 1110 1111 10000000
296#define ISO14443A_STARTBIT_PATTERN 0x07FF8F80 // pattern is 00001111 11111111 1000 1111 10000000
297
0ec548dc 298 if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 0)) == ISO14443A_STARTBIT_PATTERN >> 0) Uart.syncBit = 7;
299 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 1)) == ISO14443A_STARTBIT_PATTERN >> 1) Uart.syncBit = 6;
300 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 2)) == ISO14443A_STARTBIT_PATTERN >> 2) Uart.syncBit = 5;
301 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 3)) == ISO14443A_STARTBIT_PATTERN >> 3) Uart.syncBit = 4;
302 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 4)) == ISO14443A_STARTBIT_PATTERN >> 4) Uart.syncBit = 3;
303 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 5)) == ISO14443A_STARTBIT_PATTERN >> 5) Uart.syncBit = 2;
304 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 6)) == ISO14443A_STARTBIT_PATTERN >> 6) Uart.syncBit = 1;
305 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 7)) == ISO14443A_STARTBIT_PATTERN >> 7) Uart.syncBit = 0;
306
307 if (Uart.syncBit != 9999) { // found a sync bit
7bc95e2e 308 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
309 Uart.startTime -= Uart.syncBit;
d7aa3739 310 Uart.endTime = Uart.startTime;
7bc95e2e 311 Uart.state = STATE_START_OF_COMMUNICATION;
15c4dc5a 312 }
313
7bc95e2e 314 } else {
15c4dc5a 315
0ec548dc 316 if (IsMillerModulationNibble1(Uart.fourBits >> Uart.syncBit)) {
317 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation in both halves - error
d7aa3739 318 UartReset();
d7aa3739 319 } else { // Modulation in first half = Sequence Z = logic "0"
7bc95e2e 320 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
321 UartReset();
7bc95e2e 322 } else {
323 Uart.bitCount++;
324 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
325 Uart.state = STATE_MILLER_Z;
326 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
327 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
328 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
329 Uart.parityBits <<= 1; // make room for the parity bit
330 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
331 Uart.bitCount = 0;
332 Uart.shiftReg = 0;
6a1f2d82 333 if((Uart.len&0x0007) == 0) { // every 8 data bytes
334 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
335 Uart.parityBits = 0;
336 }
15c4dc5a 337 }
7bc95e2e 338 }
d7aa3739 339 }
340 } else {
0ec548dc 341 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
7bc95e2e 342 Uart.bitCount++;
343 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
344 Uart.state = STATE_MILLER_X;
345 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
346 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
347 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
348 Uart.parityBits <<= 1; // make room for the new parity bit
349 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
350 Uart.bitCount = 0;
351 Uart.shiftReg = 0;
6a1f2d82 352 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
353 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
354 Uart.parityBits = 0;
355 }
7bc95e2e 356 }
d7aa3739 357 } else { // no modulation in both halves - Sequence Y
7bc95e2e 358 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
15c4dc5a 359 Uart.state = STATE_UNSYNCD;
6a1f2d82 360 Uart.bitCount--; // last "0" was part of EOC sequence
361 Uart.shiftReg <<= 1; // drop it
362 if(Uart.bitCount > 0) { // if we decoded some bits
363 Uart.shiftReg >>= (9 - Uart.bitCount); // right align them
364 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff); // add last byte to the output
365 Uart.parityBits <<= 1; // add a (void) parity bit
366 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align parity bits
367 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store it
368 return TRUE;
369 } else if (Uart.len & 0x0007) { // there are some parity bits to store
370 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align remaining parity bits
371 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store them
52bfb955 372 }
373 if (Uart.len) {
6a1f2d82 374 return TRUE; // we are finished with decoding the raw data sequence
52bfb955 375 } else {
0c8d25eb 376 UartReset(); // Nothing received - start over
7bc95e2e 377 }
15c4dc5a 378 }
7bc95e2e 379 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
380 UartReset();
7bc95e2e 381 } else { // a logic "0"
382 Uart.bitCount++;
383 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
384 Uart.state = STATE_MILLER_Y;
385 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
386 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
387 Uart.parityBits <<= 1; // make room for the parity bit
388 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
389 Uart.bitCount = 0;
390 Uart.shiftReg = 0;
6a1f2d82 391 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
392 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
393 Uart.parityBits = 0;
394 }
15c4dc5a 395 }
396 }
d7aa3739 397 }
15c4dc5a 398 }
7bc95e2e 399
400 }
15c4dc5a 401
7bc95e2e 402 return FALSE; // not finished yet, need more data
15c4dc5a 403}
404
7bc95e2e 405
406
15c4dc5a 407//=============================================================================
e691fc45 408// ISO 14443 Type A - Manchester decoder
15c4dc5a 409//=============================================================================
e691fc45 410// Basics:
7bc95e2e 411// This decoder is used when the PM3 acts as a reader.
e691fc45 412// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
413// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
414// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
415// The Manchester decoder needs to identify the following sequences:
416// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
417// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
418// 8 ticks unmodulated: Sequence F = end of communication
419// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
7bc95e2e 420// Note 1: the bitstream may start at any time. We therefore need to sync.
e691fc45 421// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
b62a5a84 422static tDemod Demod;
15c4dc5a 423
d7aa3739 424// Lookup-Table to decide if 4 raw bits are a modulation.
d714d3ef 425// We accept three or four "1" in any position
7bc95e2e 426const bool Mod_Manchester_LUT[] = {
d7aa3739 427 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
d714d3ef 428 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
7bc95e2e 429};
430
431#define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
432#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
15c4dc5a 433
2f2d9fc5 434
7bc95e2e 435void DemodReset()
e691fc45 436{
7bc95e2e 437 Demod.state = DEMOD_UNSYNCD;
438 Demod.len = 0; // number of decoded data bytes
6a1f2d82 439 Demod.parityLen = 0;
7bc95e2e 440 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
441 Demod.parityBits = 0; //
442 Demod.collisionPos = 0; // Position of collision bit
443 Demod.twoBits = 0xffff; // buffer for 2 Bits
444 Demod.highCnt = 0;
445 Demod.startTime = 0;
446 Demod.endTime = 0;
46c65fed 447
448 //
449 Demod.bitCount = 0;
450 Demod.syncBit = 0xFFFF;
451 Demod.samples = 0;
e691fc45 452}
15c4dc5a 453
6a1f2d82 454void DemodInit(uint8_t *data, uint8_t *parity)
455{
456 Demod.output = data;
457 Demod.parity = parity;
458 DemodReset();
459}
460
7bc95e2e 461// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
462static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
e691fc45 463{
7bc95e2e 464
465 Demod.twoBits = (Demod.twoBits << 8) | bit;
e691fc45 466
7bc95e2e 467 if (Demod.state == DEMOD_UNSYNCD) {
468
469 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
470 if (Demod.twoBits == 0x0000) {
471 Demod.highCnt++;
472 } else {
473 Demod.highCnt = 0;
474 }
475 } else {
476 Demod.syncBit = 0xFFFF; // not set
477 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
478 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
479 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
480 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
481 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
482 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
483 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
484 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
d7aa3739 485 if (Demod.syncBit != 0xFFFF) {
7bc95e2e 486 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
487 Demod.startTime -= Demod.syncBit;
488 Demod.bitCount = offset; // number of decoded data bits
e691fc45 489 Demod.state = DEMOD_MANCHESTER_DATA;
2f2d9fc5 490 }
7bc95e2e 491 }
15c4dc5a 492
7bc95e2e 493 } else {
15c4dc5a 494
7bc95e2e 495 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
496 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
e691fc45 497 if (!Demod.collisionPos) {
498 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
499 }
500 } // modulation in first half only - Sequence D = 1
7bc95e2e 501 Demod.bitCount++;
502 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
503 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
e691fc45 504 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 505 Demod.parityBits <<= 1; // make room for the parity bit
e691fc45 506 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
507 Demod.bitCount = 0;
508 Demod.shiftReg = 0;
6a1f2d82 509 if((Demod.len&0x0007) == 0) { // every 8 data bytes
510 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits
511 Demod.parityBits = 0;
512 }
15c4dc5a 513 }
7bc95e2e 514 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
515 } else { // no modulation in first half
516 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
e691fc45 517 Demod.bitCount++;
7bc95e2e 518 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
e691fc45 519 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
e691fc45 520 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 521 Demod.parityBits <<= 1; // make room for the new parity bit
e691fc45 522 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
523 Demod.bitCount = 0;
524 Demod.shiftReg = 0;
6a1f2d82 525 if ((Demod.len&0x0007) == 0) { // every 8 data bytes
526 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits1
527 Demod.parityBits = 0;
528 }
15c4dc5a 529 }
7bc95e2e 530 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
e691fc45 531 } else { // no modulation in both halves - End of communication
6a1f2d82 532 if(Demod.bitCount > 0) { // there are some remaining data bits
533 Demod.shiftReg >>= (9 - Demod.bitCount); // right align the decoded bits
534 Demod.output[Demod.len++] = Demod.shiftReg & 0xff; // and add them to the output
535 Demod.parityBits <<= 1; // add a (void) parity bit
536 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
537 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
538 return TRUE;
539 } else if (Demod.len & 0x0007) { // there are some parity bits to store
540 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
541 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
52bfb955 542 }
543 if (Demod.len) {
d7aa3739 544 return TRUE; // we are finished with decoding the raw data sequence
545 } else { // nothing received. Start over
546 DemodReset();
e691fc45 547 }
15c4dc5a 548 }
7bc95e2e 549 }
e691fc45 550 }
e691fc45 551 return FALSE; // not finished yet, need more data
15c4dc5a 552}
553
554//=============================================================================
555// Finally, a `sniffer' for ISO 14443 Type A
556// Both sides of communication!
557//=============================================================================
558
559//-----------------------------------------------------------------------------
560// Record the sequence of commands sent by the reader to the tag, with
561// triggering so that we start recording at the point that the tag is moved
562// near the reader.
563//-----------------------------------------------------------------------------
d26849d4 564void RAMFUNC SniffIso14443a(uint8_t param) {
5cd9ec01
M
565 // param:
566 // bit 0 - trigger from first card answer
567 // bit 1 - trigger from first reader 7-bit request
568
569 LEDsoff();
5cd9ec01
M
570
571 // We won't start recording the frames that we acquire until we trigger;
572 // a good trigger condition to get started is probably when we see a
573 // response from the tag.
574 // triggered == FALSE -- to wait first for card
7bc95e2e 575 bool triggered = !(param & 0x03);
576
f71f4deb 577 // Allocate memory from BigBuf for some buffers
578 // free all previous allocations first
579 BigBuf_free();
580
5cd9ec01 581 // The command (reader -> tag) that we're receiving.
f71f4deb 582 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
583 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
6a1f2d82 584
5cd9ec01 585 // The response (tag -> reader) that we're receiving.
f71f4deb 586 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
587 uint8_t *receivedResponsePar = BigBuf_malloc(MAX_PARITY_SIZE);
5cd9ec01
M
588
589 // The DMA buffer, used to stream samples from the FPGA
f71f4deb 590 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
591
592 // init trace buffer
3000dc4e
MHS
593 clear_trace();
594 set_tracing(TRUE);
f71f4deb 595
7bc95e2e 596 uint8_t *data = dmaBuf;
597 uint8_t previous_data = 0;
5cd9ec01
M
598 int maxDataLen = 0;
599 int dataLen = 0;
7bc95e2e 600 bool TagIsActive = FALSE;
601 bool ReaderIsActive = FALSE;
602
603 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
15c4dc5a 604
5cd9ec01 605 // Set up the demodulator for tag -> reader responses.
6a1f2d82 606 DemodInit(receivedResponse, receivedResponsePar);
607
5cd9ec01 608 // Set up the demodulator for the reader -> tag commands
6a1f2d82 609 UartInit(receivedCmd, receivedCmdPar);
610
7bc95e2e 611 // Setup and start DMA.
5cd9ec01 612 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
7bc95e2e 613
5cd9ec01 614 // And now we loop, receiving samples.
7bc95e2e 615 for(uint32_t rsamples = 0; TRUE; ) {
616
5cd9ec01
M
617 if(BUTTON_PRESS()) {
618 DbpString("cancelled by button");
7bc95e2e 619 break;
5cd9ec01 620 }
15c4dc5a 621
5cd9ec01
M
622 LED_A_ON();
623 WDT_HIT();
15c4dc5a 624
5cd9ec01
M
625 int register readBufDataP = data - dmaBuf;
626 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
627 if (readBufDataP <= dmaBufDataP){
628 dataLen = dmaBufDataP - readBufDataP;
629 } else {
7bc95e2e 630 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
5cd9ec01
M
631 }
632 // test for length of buffer
633 if(dataLen > maxDataLen) {
634 maxDataLen = dataLen;
f71f4deb 635 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
7bc95e2e 636 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
637 break;
5cd9ec01
M
638 }
639 }
640 if(dataLen < 1) continue;
641
642 // primary buffer was stopped( <-- we lost data!
643 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
644 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
645 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
7bc95e2e 646 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
647 }
648 // secondary buffer sets as primary, secondary buffer was stopped
649 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
650 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
651 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
652 }
653
654 LED_A_OFF();
7bc95e2e 655
656 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
3be2a5ae 657
7bc95e2e 658 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
659 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
660 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
661 LED_C_ON();
5cd9ec01 662
7bc95e2e 663 // check - if there is a short 7bit request from reader
664 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
5cd9ec01 665
7bc95e2e 666 if(triggered) {
6a1f2d82 667 if (!LogTrace(receivedCmd,
668 Uart.len,
669 Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
670 Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
671 Uart.parity,
672 TRUE)) break;
7bc95e2e 673 }
674 /* And ready to receive another command. */
675 UartReset();
2d2f7d19 676 //UartInit(receivedCmd, receivedCmdPar);
7bc95e2e 677 /* And also reset the demod code, which might have been */
678 /* false-triggered by the commands from the reader. */
679 DemodReset();
680 LED_B_OFF();
681 }
682 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
5cd9ec01 683 }
3be2a5ae 684
7bc95e2e 685 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
686 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
687 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
688 LED_B_ON();
5cd9ec01 689
6a1f2d82 690 if (!LogTrace(receivedResponse,
691 Demod.len,
692 Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
693 Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
694 Demod.parity,
695 FALSE)) break;
5cd9ec01 696
7bc95e2e 697 if ((!triggered) && (param & 0x01)) triggered = TRUE;
5cd9ec01 698
7bc95e2e 699 // And ready to receive another response.
700 DemodReset();
0ec548dc 701 // And reset the Miller decoder including itS (now outdated) input buffer
702 UartInit(receivedCmd, receivedCmdPar);
703
7bc95e2e 704 LED_C_OFF();
705 }
706 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
707 }
5cd9ec01
M
708 }
709
7bc95e2e 710 previous_data = *data;
711 rsamples++;
5cd9ec01 712 data++;
d714d3ef 713 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01
M
714 data = dmaBuf;
715 }
716 } // main cycle
717
718 DbpString("COMMAND FINISHED");
15c4dc5a 719
7bc95e2e 720 FpgaDisableSscDma();
721 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
3000dc4e 722 Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);
5cd9ec01 723 LEDsoff();
15c4dc5a 724}
725
15c4dc5a 726//-----------------------------------------------------------------------------
727// Prepare tag messages
728//-----------------------------------------------------------------------------
6a1f2d82 729static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
15c4dc5a 730{
8f51ddb0 731 ToSendReset();
15c4dc5a 732
733 // Correction bit, might be removed when not needed
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736 ToSendStuffBit(0);
737 ToSendStuffBit(0);
738 ToSendStuffBit(1); // 1
739 ToSendStuffBit(0);
740 ToSendStuffBit(0);
741 ToSendStuffBit(0);
8f51ddb0 742
15c4dc5a 743 // Send startbit
72934aa3 744 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 745 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 746
6a1f2d82 747 for(uint16_t i = 0; i < len; i++) {
8f51ddb0 748 uint8_t b = cmd[i];
15c4dc5a 749
750 // Data bits
6a1f2d82 751 for(uint16_t j = 0; j < 8; j++) {
15c4dc5a 752 if(b & 1) {
72934aa3 753 ToSend[++ToSendMax] = SEC_D;
15c4dc5a 754 } else {
72934aa3 755 ToSend[++ToSendMax] = SEC_E;
8f51ddb0
M
756 }
757 b >>= 1;
758 }
15c4dc5a 759
0014cb46 760 // Get the parity bit
6a1f2d82 761 if (parity[i>>3] & (0x80>>(i&0x0007))) {
8f51ddb0 762 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 763 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 764 } else {
72934aa3 765 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 766 LastProxToAirDuration = 8 * ToSendMax;
15c4dc5a 767 }
8f51ddb0 768 }
15c4dc5a 769
8f51ddb0
M
770 // Send stopbit
771 ToSend[++ToSendMax] = SEC_F;
15c4dc5a 772
8f51ddb0
M
773 // Convert from last byte pos to length
774 ToSendMax++;
8f51ddb0
M
775}
776
6a1f2d82 777static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
778{
779 uint8_t par[MAX_PARITY_SIZE];
780
781 GetParity(cmd, len, par);
782 CodeIso14443aAsTagPar(cmd, len, par);
15c4dc5a 783}
784
15c4dc5a 785
8f51ddb0
M
786static void Code4bitAnswerAsTag(uint8_t cmd)
787{
788 int i;
789
5f6d6c90 790 ToSendReset();
8f51ddb0
M
791
792 // Correction bit, might be removed when not needed
793 ToSendStuffBit(0);
794 ToSendStuffBit(0);
795 ToSendStuffBit(0);
796 ToSendStuffBit(0);
797 ToSendStuffBit(1); // 1
798 ToSendStuffBit(0);
799 ToSendStuffBit(0);
800 ToSendStuffBit(0);
801
802 // Send startbit
803 ToSend[++ToSendMax] = SEC_D;
804
805 uint8_t b = cmd;
806 for(i = 0; i < 4; i++) {
807 if(b & 1) {
808 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 809 LastProxToAirDuration = 8 * ToSendMax - 4;
8f51ddb0
M
810 } else {
811 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 812 LastProxToAirDuration = 8 * ToSendMax;
8f51ddb0
M
813 }
814 b >>= 1;
815 }
816
817 // Send stopbit
818 ToSend[++ToSendMax] = SEC_F;
819
5f6d6c90 820 // Convert from last byte pos to length
821 ToSendMax++;
15c4dc5a 822}
823
824//-----------------------------------------------------------------------------
825// Wait for commands from reader
826// Stop when button is pressed
827// Or return TRUE when command is captured
828//-----------------------------------------------------------------------------
6a1f2d82 829static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
15c4dc5a 830{
831 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
832 // only, since we are receiving, not transmitting).
833 // Signal field is off with the appropriate LED
834 LED_D_OFF();
835 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
836
837 // Now run a `software UART' on the stream of incoming samples.
6a1f2d82 838 UartInit(received, parity);
7bc95e2e 839
840 // clear RXRDY:
841 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 842
843 for(;;) {
844 WDT_HIT();
845
846 if(BUTTON_PRESS()) return FALSE;
7bc95e2e 847
15c4dc5a 848 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
7bc95e2e 849 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
850 if(MillerDecoding(b, 0)) {
851 *len = Uart.len;
15c4dc5a 852 return TRUE;
853 }
7bc95e2e 854 }
15c4dc5a 855 }
856}
28afbd2b 857
6a1f2d82 858static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
7bc95e2e 859int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
28afbd2b 860int EmSend4bit(uint8_t resp);
6a1f2d82 861int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
862int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
863int EmSendCmd(uint8_t *resp, uint16_t respLen);
864int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
865bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
866 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
15c4dc5a 867
117d9ec2 868static uint8_t* free_buffer_pointer;
ce02f6f9 869
870typedef struct {
871 uint8_t* response;
872 size_t response_n;
873 uint8_t* modulation;
874 size_t modulation_n;
7bc95e2e 875 uint32_t ProxToAirDuration;
ce02f6f9 876} tag_response_info_t;
877
ce02f6f9 878bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
7bc95e2e 879 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
ce02f6f9 880 // This will need the following byte array for a modulation sequence
881 // 144 data bits (18 * 8)
882 // 18 parity bits
883 // 2 Start and stop
884 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
885 // 1 just for the case
886 // ----------- +
887 // 166 bytes, since every bit that needs to be send costs us a byte
888 //
f71f4deb 889
890
ce02f6f9 891 // Prepare the tag modulation bits from the message
892 CodeIso14443aAsTag(response_info->response,response_info->response_n);
893
894 // Make sure we do not exceed the free buffer space
895 if (ToSendMax > max_buffer_size) {
896 Dbprintf("Out of memory, when modulating bits for tag answer:");
897 Dbhexdump(response_info->response_n,response_info->response,false);
898 return false;
899 }
900
901 // Copy the byte array, used for this modulation to the buffer position
902 memcpy(response_info->modulation,ToSend,ToSendMax);
903
7bc95e2e 904 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
ce02f6f9 905 response_info->modulation_n = ToSendMax;
7bc95e2e 906 response_info->ProxToAirDuration = LastProxToAirDuration;
ce02f6f9 907
908 return true;
909}
910
f71f4deb 911
912// "precompile" responses. There are 7 predefined responses with a total of 28 bytes data to transmit.
913// Coded responses need one byte per bit to transfer (data, parity, start, stop, correction)
914// 28 * 8 data bits, 28 * 1 parity bits, 7 start bits, 7 stop bits, 7 correction bits
915// -> need 273 bytes buffer
916#define ALLOCATED_TAG_MODULATION_BUFFER_SIZE 273
917
ce02f6f9 918bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
919 // Retrieve and store the current buffer index
920 response_info->modulation = free_buffer_pointer;
921
922 // Determine the maximum size we can use from our buffer
f71f4deb 923 size_t max_buffer_size = ALLOCATED_TAG_MODULATION_BUFFER_SIZE;
ce02f6f9 924
925 // Forward the prepare tag modulation function to the inner function
f71f4deb 926 if (prepare_tag_modulation(response_info, max_buffer_size)) {
ce02f6f9 927 // Update the free buffer offset
928 free_buffer_pointer += ToSendMax;
929 return true;
930 } else {
931 return false;
932 }
933}
934
15c4dc5a 935//-----------------------------------------------------------------------------
936// Main loop of simulated tag: receive commands from reader, decide what
937// response to send, and send it.
938//-----------------------------------------------------------------------------
d26849d4 939void SimulateIso14443aTag(int tagType, int flags, int uid_2nd, byte_t* data)
15c4dc5a 940{
d26849d4 941
942 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
943 // This can be used in a reader-only attack.
944 // (it can also be retrieved via 'hf 14a list', but hey...
945 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
946 uint8_t ar_nr_collected = 0;
947
81cd0474 948 uint8_t sak;
949
950 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
951 uint8_t response1[2];
952
953 switch (tagType) {
954 case 1: { // MIFARE Classic
955 // Says: I am Mifare 1k - original line
956 response1[0] = 0x04;
957 response1[1] = 0x00;
958 sak = 0x08;
959 } break;
960 case 2: { // MIFARE Ultralight
961 // Says: I am a stupid memory tag, no crypto
962 response1[0] = 0x04;
963 response1[1] = 0x00;
964 sak = 0x00;
965 } break;
966 case 3: { // MIFARE DESFire
967 // Says: I am a DESFire tag, ph33r me
968 response1[0] = 0x04;
969 response1[1] = 0x03;
970 sak = 0x20;
971 } break;
972 case 4: { // ISO/IEC 14443-4
973 // Says: I am a javacard (JCOP)
974 response1[0] = 0x04;
975 response1[1] = 0x00;
976 sak = 0x28;
977 } break;
3fe4ff4f 978 case 5: { // MIFARE TNP3XXX
979 // Says: I am a toy
980 response1[0] = 0x01;
981 response1[1] = 0x0f;
982 sak = 0x01;
d26849d4 983 } break;
984 case 6: { // MIFARE Mini
985 // Says: I am a Mifare Mini, 320b
986 response1[0] = 0x44;
987 response1[1] = 0x00;
988 sak = 0x09;
989 } break;
81cd0474 990 default: {
991 Dbprintf("Error: unkown tagtype (%d)",tagType);
992 return;
993 } break;
994 }
995
996 // The second response contains the (mandatory) first 24 bits of the UID
c8b6da22 997 uint8_t response2[5] = {0x00};
81cd0474 998
999 // Check if the uid uses the (optional) part
c8b6da22 1000 uint8_t response2a[5] = {0x00};
1001
d26849d4 1002 if (flags & FLAG_7B_UID_IN_DATA) {
81cd0474 1003 response2[0] = 0x88;
d26849d4 1004 response2[1] = data[0];
1005 response2[2] = data[1];
1006 response2[3] = data[2];
1007
1008 response2a[0] = data[3];
1009 response2a[1] = data[4];
1010 response2a[2] = data[5];
c3c241f3 1011 response2a[3] = data[6]; //??
81cd0474 1012 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
1013
1014 // Configure the ATQA and SAK accordingly
1015 response1[0] |= 0x40;
1016 sak |= 0x04;
1017 } else {
d26849d4 1018 memcpy(response2, data, 4);
1019 //num_to_bytes(uid_1st,4,response2);
81cd0474 1020 // Configure the ATQA and SAK accordingly
1021 response1[0] &= 0xBF;
1022 sak &= 0xFB;
1023 }
1024
1025 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1026 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
1027
1028 // Prepare the mandatory SAK (for 4 and 7 byte UID)
c8b6da22 1029 uint8_t response3[3] = {0x00};
81cd0474 1030 response3[0] = sak;
1031 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
1032
1033 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
c8b6da22 1034 uint8_t response3a[3] = {0x00};
81cd0474 1035 response3a[0] = sak & 0xFB;
1036 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
1037
2d2f7d19 1038 uint8_t response5[] = { 0x01, 0x01, 0x01, 0x01 }; // Very random tag nonce
6a1f2d82 1039 uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1040 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1041 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1042 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1043 // TC(1) = 0x02: CID supported, NAD not supported
ce02f6f9 1044 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
1045
7bc95e2e 1046 #define TAG_RESPONSE_COUNT 7
1047 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
1048 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
1049 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
1050 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1051 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
1052 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
1053 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
1054 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
1055 };
1056
1057 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1058 // Such a response is less time critical, so we can prepare them on the fly
1059 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1060 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1061 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
1062 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
1063 tag_response_info_t dynamic_response_info = {
1064 .response = dynamic_response_buffer,
1065 .response_n = 0,
1066 .modulation = dynamic_modulation_buffer,
1067 .modulation_n = 0
1068 };
ce02f6f9 1069
f71f4deb 1070 BigBuf_free_keep_EM();
1071
1072 // allocate buffers:
1073 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
1074 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
1075 free_buffer_pointer = BigBuf_malloc(ALLOCATED_TAG_MODULATION_BUFFER_SIZE);
1076
1077 // clear trace
3000dc4e
MHS
1078 clear_trace();
1079 set_tracing(TRUE);
f71f4deb 1080
7bc95e2e 1081 // Prepare the responses of the anticollision phase
ce02f6f9 1082 // there will be not enough time to do this at the moment the reader sends it REQA
7bc95e2e 1083 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
1084 prepare_allocated_tag_modulation(&responses[i]);
1085 }
15c4dc5a 1086
7bc95e2e 1087 int len = 0;
15c4dc5a 1088
1089 // To control where we are in the protocol
1090 int order = 0;
1091 int lastorder;
1092
1093 // Just to allow some checks
1094 int happened = 0;
1095 int happened2 = 0;
81cd0474 1096 int cmdsRecvd = 0;
15c4dc5a 1097
254b70a4 1098 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 1099 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
15c4dc5a 1100
254b70a4 1101 cmdsRecvd = 0;
7bc95e2e 1102 tag_response_info_t* p_response;
15c4dc5a 1103
254b70a4 1104 LED_A_ON();
1105 for(;;) {
7bc95e2e 1106 // Clean receive command buffer
1107
6a1f2d82 1108 if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
ce02f6f9 1109 DbpString("Button press");
254b70a4 1110 break;
1111 }
7bc95e2e 1112
1113 p_response = NULL;
1114
254b70a4 1115 // Okay, look at the command now.
1116 lastorder = order;
1117 if(receivedCmd[0] == 0x26) { // Received a REQUEST
ce02f6f9 1118 p_response = &responses[0]; order = 1;
254b70a4 1119 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
ce02f6f9 1120 p_response = &responses[0]; order = 6;
254b70a4 1121 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
ce02f6f9 1122 p_response = &responses[1]; order = 2;
6a1f2d82 1123 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
ce02f6f9 1124 p_response = &responses[2]; order = 20;
254b70a4 1125 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
ce02f6f9 1126 p_response = &responses[3]; order = 3;
254b70a4 1127 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
ce02f6f9 1128 p_response = &responses[4]; order = 30;
254b70a4 1129 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
6a1f2d82 1130 EmSendCmdEx(data+(4*receivedCmd[1]),16,false);
7bc95e2e 1131 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
5f6d6c90 1132 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
7bc95e2e 1133 p_response = NULL;
254b70a4 1134 } else if(receivedCmd[0] == 0x50) { // Received a HALT
3fe4ff4f 1135
7bc95e2e 1136 if (tracing) {
6a1f2d82 1137 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1138 }
1139 p_response = NULL;
254b70a4 1140 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
ce02f6f9 1141 p_response = &responses[5]; order = 7;
254b70a4 1142 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
7bc95e2e 1143 if (tagType == 1 || tagType == 2) { // RATS not supported
1144 EmSend4bit(CARD_NACK_NA);
1145 p_response = NULL;
1146 } else {
1147 p_response = &responses[6]; order = 70;
1148 }
6a1f2d82 1149 } else if (order == 7 && len == 8) { // Received {nr] and {ar} (part of authentication)
7bc95e2e 1150 if (tracing) {
6a1f2d82 1151 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1152 }
d26849d4 1153 uint32_t nonce = bytes_to_num(response5,4);
7bc95e2e 1154 uint32_t nr = bytes_to_num(receivedCmd,4);
1155 uint32_t ar = bytes_to_num(receivedCmd+4,4);
d26849d4 1156 //Dbprintf("Auth attempt {nonce}{nr}{ar}: %08x %08x %08x", nonce, nr, ar);
1157
1158 if(flags & FLAG_NR_AR_ATTACK )
1159 {
1160 if(ar_nr_collected < 2){
1161 // Avoid duplicates... probably not necessary, nr should vary.
1162 //if(ar_nr_responses[3] != nr){
1163 ar_nr_responses[ar_nr_collected*5] = 0;
1164 ar_nr_responses[ar_nr_collected*5+1] = 0;
1165 ar_nr_responses[ar_nr_collected*5+2] = nonce;
1166 ar_nr_responses[ar_nr_collected*5+3] = nr;
1167 ar_nr_responses[ar_nr_collected*5+4] = ar;
1168 ar_nr_collected++;
1169 //}
1170 }
1171
1172 if(ar_nr_collected > 1 ) {
1173
1174 if (MF_DBGLEVEL >= 2) {
1175 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
1176 Dbprintf("../tools/mfkey/mfkey32 %07x%08x %08x %08x %08x %08x %08x",
1177 ar_nr_responses[0], // UID1
1178 ar_nr_responses[1], // UID2
1179 ar_nr_responses[2], // NT
1180 ar_nr_responses[3], // AR1
1181 ar_nr_responses[4], // NR1
1182 ar_nr_responses[8], // AR2
1183 ar_nr_responses[9] // NR2
1184 );
1185 }
1186 uint8_t len = ar_nr_collected*5*4;
1187 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,len,0,&ar_nr_responses,len);
1188 ar_nr_collected = 0;
1189 memset(ar_nr_responses, 0x00, len);
d26849d4 1190 }
1191 }
7bc95e2e 1192 } else {
1193 // Check for ISO 14443A-4 compliant commands, look at left nibble
1194 switch (receivedCmd[0]) {
1195
1196 case 0x0B:
1197 case 0x0A: { // IBlock (command)
1198 dynamic_response_info.response[0] = receivedCmd[0];
1199 dynamic_response_info.response[1] = 0x00;
1200 dynamic_response_info.response[2] = 0x90;
1201 dynamic_response_info.response[3] = 0x00;
1202 dynamic_response_info.response_n = 4;
1203 } break;
1204
1205 case 0x1A:
1206 case 0x1B: { // Chaining command
1207 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1208 dynamic_response_info.response_n = 2;
1209 } break;
1210
1211 case 0xaa:
1212 case 0xbb: {
1213 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1214 dynamic_response_info.response_n = 2;
1215 } break;
1216
1217 case 0xBA: { //
1218 memcpy(dynamic_response_info.response,"\xAB\x00",2);
1219 dynamic_response_info.response_n = 2;
1220 } break;
1221
1222 case 0xCA:
1223 case 0xC2: { // Readers sends deselect command
1224 memcpy(dynamic_response_info.response,"\xCA\x00",2);
1225 dynamic_response_info.response_n = 2;
1226 } break;
1227
1228 default: {
1229 // Never seen this command before
1230 if (tracing) {
6a1f2d82 1231 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1232 }
1233 Dbprintf("Received unknown command (len=%d):",len);
1234 Dbhexdump(len,receivedCmd,false);
1235 // Do not respond
1236 dynamic_response_info.response_n = 0;
1237 } break;
1238 }
ce02f6f9 1239
7bc95e2e 1240 if (dynamic_response_info.response_n > 0) {
1241 // Copy the CID from the reader query
1242 dynamic_response_info.response[1] = receivedCmd[1];
ce02f6f9 1243
7bc95e2e 1244 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1245 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1246 dynamic_response_info.response_n += 2;
ce02f6f9 1247
7bc95e2e 1248 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1249 Dbprintf("Error preparing tag response");
1250 if (tracing) {
6a1f2d82 1251 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1252 }
1253 break;
1254 }
1255 p_response = &dynamic_response_info;
1256 }
81cd0474 1257 }
15c4dc5a 1258
1259 // Count number of wakeups received after a halt
1260 if(order == 6 && lastorder == 5) { happened++; }
1261
1262 // Count number of other messages after a halt
1263 if(order != 6 && lastorder == 5) { happened2++; }
1264
15c4dc5a 1265 if(cmdsRecvd > 999) {
1266 DbpString("1000 commands later...");
254b70a4 1267 break;
15c4dc5a 1268 }
ce02f6f9 1269 cmdsRecvd++;
1270
1271 if (p_response != NULL) {
7bc95e2e 1272 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1273 // do the tracing for the previous reader request and this tag answer:
6a1f2d82 1274 uint8_t par[MAX_PARITY_SIZE];
1275 GetParity(p_response->response, p_response->response_n, par);
3fe4ff4f 1276
7bc95e2e 1277 EmLogTrace(Uart.output,
1278 Uart.len,
1279 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1280 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1281 Uart.parity,
7bc95e2e 1282 p_response->response,
1283 p_response->response_n,
1284 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1285 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1286 par);
7bc95e2e 1287 }
1288
1289 if (!tracing) {
1290 Dbprintf("Trace Full. Simulation stopped.");
1291 break;
1292 }
1293 }
15c4dc5a 1294
d26849d4 1295 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1296
15c4dc5a 1297 Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
1298 LED_A_OFF();
f71f4deb 1299 BigBuf_free_keep_EM();
15c4dc5a 1300}
1301
9492e0b0 1302
1303// prepare a delayed transfer. This simply shifts ToSend[] by a number
1304// of bits specified in the delay parameter.
1305void PrepareDelayedTransfer(uint16_t delay)
1306{
1307 uint8_t bitmask = 0;
1308 uint8_t bits_to_shift = 0;
1309 uint8_t bits_shifted = 0;
1310
1311 delay &= 0x07;
1312 if (delay) {
1313 for (uint16_t i = 0; i < delay; i++) {
1314 bitmask |= (0x01 << i);
1315 }
7bc95e2e 1316 ToSend[ToSendMax++] = 0x00;
9492e0b0 1317 for (uint16_t i = 0; i < ToSendMax; i++) {
1318 bits_to_shift = ToSend[i] & bitmask;
1319 ToSend[i] = ToSend[i] >> delay;
1320 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1321 bits_shifted = bits_to_shift;
1322 }
1323 }
1324}
1325
7bc95e2e 1326
1327//-------------------------------------------------------------------------------------
15c4dc5a 1328// Transmit the command (to the tag) that was placed in ToSend[].
9492e0b0 1329// Parameter timing:
7bc95e2e 1330// if NULL: transfer at next possible time, taking into account
1331// request guard time and frame delay time
1332// if == 0: transfer immediately and return time of transfer
9492e0b0 1333// if != 0: delay transfer until time specified
7bc95e2e 1334//-------------------------------------------------------------------------------------
6a1f2d82 1335static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
15c4dc5a 1336{
7bc95e2e 1337
9492e0b0 1338 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
e30c654b 1339
7bc95e2e 1340 uint32_t ThisTransferTime = 0;
e30c654b 1341
9492e0b0 1342 if (timing) {
1343 if(*timing == 0) { // Measure time
7bc95e2e 1344 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
9492e0b0 1345 } else {
1346 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1347 }
7bc95e2e 1348 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1349 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1350 LastTimeProxToAirStart = *timing;
1351 } else {
1352 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1353 while(GetCountSspClk() < ThisTransferTime);
1354 LastTimeProxToAirStart = ThisTransferTime;
9492e0b0 1355 }
1356
7bc95e2e 1357 // clear TXRDY
1358 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1359
7bc95e2e 1360 uint16_t c = 0;
9492e0b0 1361 for(;;) {
1362 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1363 AT91C_BASE_SSC->SSC_THR = cmd[c];
1364 c++;
1365 if(c >= len) {
1366 break;
1367 }
1368 }
1369 }
7bc95e2e 1370
1371 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
15c4dc5a 1372}
1373
7bc95e2e 1374
15c4dc5a 1375//-----------------------------------------------------------------------------
195af472 1376// Prepare reader command (in bits, support short frames) to send to FPGA
15c4dc5a 1377//-----------------------------------------------------------------------------
6a1f2d82 1378void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
15c4dc5a 1379{
7bc95e2e 1380 int i, j;
1381 int last;
1382 uint8_t b;
e30c654b 1383
7bc95e2e 1384 ToSendReset();
e30c654b 1385
7bc95e2e 1386 // Start of Communication (Seq. Z)
1387 ToSend[++ToSendMax] = SEC_Z;
1388 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1389 last = 0;
1390
1391 size_t bytecount = nbytes(bits);
1392 // Generate send structure for the data bits
1393 for (i = 0; i < bytecount; i++) {
1394 // Get the current byte to send
1395 b = cmd[i];
1396 size_t bitsleft = MIN((bits-(i*8)),8);
1397
1398 for (j = 0; j < bitsleft; j++) {
1399 if (b & 1) {
1400 // Sequence X
1401 ToSend[++ToSendMax] = SEC_X;
1402 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1403 last = 1;
1404 } else {
1405 if (last == 0) {
1406 // Sequence Z
1407 ToSend[++ToSendMax] = SEC_Z;
1408 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1409 } else {
1410 // Sequence Y
1411 ToSend[++ToSendMax] = SEC_Y;
1412 last = 0;
1413 }
1414 }
1415 b >>= 1;
1416 }
1417
6a1f2d82 1418 // Only transmit parity bit if we transmitted a complete byte
0ec548dc 1419 if (j == 8 && parity != NULL) {
7bc95e2e 1420 // Get the parity bit
6a1f2d82 1421 if (parity[i>>3] & (0x80 >> (i&0x0007))) {
7bc95e2e 1422 // Sequence X
1423 ToSend[++ToSendMax] = SEC_X;
1424 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1425 last = 1;
1426 } else {
1427 if (last == 0) {
1428 // Sequence Z
1429 ToSend[++ToSendMax] = SEC_Z;
1430 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1431 } else {
1432 // Sequence Y
1433 ToSend[++ToSendMax] = SEC_Y;
1434 last = 0;
1435 }
1436 }
1437 }
1438 }
e30c654b 1439
7bc95e2e 1440 // End of Communication: Logic 0 followed by Sequence Y
1441 if (last == 0) {
1442 // Sequence Z
1443 ToSend[++ToSendMax] = SEC_Z;
1444 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1445 } else {
1446 // Sequence Y
1447 ToSend[++ToSendMax] = SEC_Y;
1448 last = 0;
1449 }
1450 ToSend[++ToSendMax] = SEC_Y;
e30c654b 1451
7bc95e2e 1452 // Convert to length of command:
1453 ToSendMax++;
15c4dc5a 1454}
1455
195af472 1456//-----------------------------------------------------------------------------
1457// Prepare reader command to send to FPGA
1458//-----------------------------------------------------------------------------
6a1f2d82 1459void CodeIso14443aAsReaderPar(const uint8_t *cmd, uint16_t len, const uint8_t *parity)
195af472 1460{
6a1f2d82 1461 CodeIso14443aBitsAsReaderPar(cmd, len*8, parity);
195af472 1462}
1463
0c8d25eb 1464
9ca155ba
M
1465//-----------------------------------------------------------------------------
1466// Wait for commands from reader
1467// Stop when button is pressed (return 1) or field was gone (return 2)
1468// Or return 0 when command is captured
1469//-----------------------------------------------------------------------------
6a1f2d82 1470static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
9ca155ba
M
1471{
1472 *len = 0;
1473
1474 uint32_t timer = 0, vtime = 0;
1475 int analogCnt = 0;
1476 int analogAVG = 0;
1477
1478 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1479 // only, since we are receiving, not transmitting).
1480 // Signal field is off with the appropriate LED
1481 LED_D_OFF();
1482 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1483
1484 // Set ADC to read field strength
1485 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1486 AT91C_BASE_ADC->ADC_MR =
0c8d25eb 1487 ADC_MODE_PRESCALE(63) |
1488 ADC_MODE_STARTUP_TIME(1) |
1489 ADC_MODE_SAMPLE_HOLD_TIME(15);
9ca155ba
M
1490 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1491 // start ADC
1492 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1493
1494 // Now run a 'software UART' on the stream of incoming samples.
6a1f2d82 1495 UartInit(received, parity);
7bc95e2e 1496
1497 // Clear RXRDY:
1498 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
0c8d25eb 1499
9ca155ba
M
1500 for(;;) {
1501 WDT_HIT();
1502
1503 if (BUTTON_PRESS()) return 1;
1504
1505 // test if the field exists
1506 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1507 analogCnt++;
1508 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1509 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1510 if (analogCnt >= 32) {
0c8d25eb 1511 if ((MAX_ADC_HF_VOLTAGE * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
9ca155ba
M
1512 vtime = GetTickCount();
1513 if (!timer) timer = vtime;
1514 // 50ms no field --> card to idle state
1515 if (vtime - timer > 50) return 2;
1516 } else
1517 if (timer) timer = 0;
1518 analogCnt = 0;
1519 analogAVG = 0;
1520 }
1521 }
7bc95e2e 1522
9ca155ba 1523 // receive and test the miller decoding
7bc95e2e 1524 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1525 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1526 if(MillerDecoding(b, 0)) {
1527 *len = Uart.len;
9ca155ba
M
1528 return 0;
1529 }
7bc95e2e 1530 }
1531
9ca155ba
M
1532 }
1533}
1534
9ca155ba 1535
6a1f2d82 1536static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded)
7bc95e2e 1537{
1538 uint8_t b;
1539 uint16_t i = 0;
1540 uint32_t ThisTransferTime;
1541
9ca155ba
M
1542 // Modulate Manchester
1543 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
7bc95e2e 1544
1545 // include correction bit if necessary
1546 if (Uart.parityBits & 0x01) {
1547 correctionNeeded = TRUE;
1548 }
1549 if(correctionNeeded) {
9ca155ba
M
1550 // 1236, so correction bit needed
1551 i = 0;
7bc95e2e 1552 } else {
1553 i = 1;
9ca155ba 1554 }
7bc95e2e 1555
d714d3ef 1556 // clear receiving shift register and holding register
7bc95e2e 1557 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1558 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1559 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1560 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
9ca155ba 1561
7bc95e2e 1562 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1563 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1564 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1565 if (AT91C_BASE_SSC->SSC_RHR) break;
1566 }
1567
1568 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1569
1570 // Clear TXRDY:
1571 AT91C_BASE_SSC->SSC_THR = SEC_F;
1572
9ca155ba 1573 // send cycle
bb42a03e 1574 for(; i < respLen; ) {
9ca155ba 1575 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
7bc95e2e 1576 AT91C_BASE_SSC->SSC_THR = resp[i++];
1577 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba 1578 }
7bc95e2e 1579
9ca155ba
M
1580 if(BUTTON_PRESS()) {
1581 break;
1582 }
1583 }
1584
7bc95e2e 1585 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
0c8d25eb 1586 uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3;
1587 for (i = 0; i <= fpga_queued_bits/8 + 1; ) {
7bc95e2e 1588 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1589 AT91C_BASE_SSC->SSC_THR = SEC_F;
1590 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1591 i++;
1592 }
1593 }
0c8d25eb 1594
7bc95e2e 1595 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1596
9ca155ba
M
1597 return 0;
1598}
1599
7bc95e2e 1600int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1601 Code4bitAnswerAsTag(resp);
0a39986e 1602 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1603 // do the tracing for the previous reader request and this tag answer:
6a1f2d82 1604 uint8_t par[1];
1605 GetParity(&resp, 1, par);
7bc95e2e 1606 EmLogTrace(Uart.output,
1607 Uart.len,
1608 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1609 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1610 Uart.parity,
7bc95e2e 1611 &resp,
1612 1,
1613 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1614 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1615 par);
0a39986e 1616 return res;
9ca155ba
M
1617}
1618
8f51ddb0 1619int EmSend4bit(uint8_t resp){
7bc95e2e 1620 return EmSend4bitEx(resp, false);
8f51ddb0
M
1621}
1622
6a1f2d82 1623int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par){
7bc95e2e 1624 CodeIso14443aAsTagPar(resp, respLen, par);
8f51ddb0 1625 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1626 // do the tracing for the previous reader request and this tag answer:
1627 EmLogTrace(Uart.output,
1628 Uart.len,
1629 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1630 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1631 Uart.parity,
7bc95e2e 1632 resp,
1633 respLen,
1634 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1635 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1636 par);
8f51ddb0
M
1637 return res;
1638}
1639
6a1f2d82 1640int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
1641 uint8_t par[MAX_PARITY_SIZE];
1642 GetParity(resp, respLen, par);
1643 return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
8f51ddb0
M
1644}
1645
6a1f2d82 1646int EmSendCmd(uint8_t *resp, uint16_t respLen){
1647 uint8_t par[MAX_PARITY_SIZE];
1648 GetParity(resp, respLen, par);
1649 return EmSendCmdExPar(resp, respLen, false, par);
8f51ddb0
M
1650}
1651
6a1f2d82 1652int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par){
7bc95e2e 1653 return EmSendCmdExPar(resp, respLen, false, par);
1654}
1655
6a1f2d82 1656bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
1657 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity)
7bc95e2e 1658{
1659 if (tracing) {
1660 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1661 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1662 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1663 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1664 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1665 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1666 reader_EndTime = tag_StartTime - exact_fdt;
1667 reader_StartTime = reader_EndTime - reader_modlen;
6a1f2d82 1668 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
7bc95e2e 1669 return FALSE;
6a1f2d82 1670 } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
7bc95e2e 1671 } else {
1672 return TRUE;
1673 }
9ca155ba
M
1674}
1675
15c4dc5a 1676//-----------------------------------------------------------------------------
1677// Wait a certain time for tag response
1678// If a response is captured return TRUE
e691fc45 1679// If it takes too long return FALSE
15c4dc5a 1680//-----------------------------------------------------------------------------
6a1f2d82 1681static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
15c4dc5a 1682{
46c65fed 1683 uint32_t c = 0x00;
e691fc45 1684
15c4dc5a 1685 // Set FPGA mode to "reader listen mode", no modulation (listen
534983d7 1686 // only, since we are receiving, not transmitting).
1687 // Signal field is on with the appropriate LED
1688 LED_D_ON();
1689 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1c611bbd 1690
534983d7 1691 // Now get the answer from the card
6a1f2d82 1692 DemodInit(receivedResponse, receivedResponsePar);
15c4dc5a 1693
7bc95e2e 1694 // clear RXRDY:
1695 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
0c8d25eb 1696
15c4dc5a 1697 for(;;) {
534983d7 1698 WDT_HIT();
15c4dc5a 1699
534983d7 1700 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
534983d7 1701 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
7bc95e2e 1702 if(ManchesterDecoding(b, offset, 0)) {
1703 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
15c4dc5a 1704 return TRUE;
19a700a8 1705 } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
7bc95e2e 1706 return FALSE;
15c4dc5a 1707 }
534983d7 1708 }
1709 }
15c4dc5a 1710}
1711
0ec548dc 1712
6a1f2d82 1713void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
15c4dc5a 1714{
6a1f2d82 1715 CodeIso14443aBitsAsReaderPar(frame, bits, par);
dfc3c505 1716
7bc95e2e 1717 // Send command to tag
1718 TransmitFor14443a(ToSend, ToSendMax, timing);
1719 if(trigger)
1720 LED_A_ON();
dfc3c505 1721
7bc95e2e 1722 // Log reader command in trace buffer
1723 if (tracing) {
6a1f2d82 1724 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
7bc95e2e 1725 }
15c4dc5a 1726}
1727
0ec548dc 1728
6a1f2d82 1729void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
dfc3c505 1730{
6a1f2d82 1731 ReaderTransmitBitsPar(frame, len*8, par, timing);
dfc3c505 1732}
15c4dc5a 1733
0ec548dc 1734
6a1f2d82 1735void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
e691fc45 1736{
1737 // Generate parity and redirect
6a1f2d82 1738 uint8_t par[MAX_PARITY_SIZE];
1739 GetParity(frame, len/8, par);
1740 ReaderTransmitBitsPar(frame, len, par, timing);
e691fc45 1741}
1742
0ec548dc 1743
6a1f2d82 1744void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
15c4dc5a 1745{
1746 // Generate parity and redirect
6a1f2d82 1747 uint8_t par[MAX_PARITY_SIZE];
1748 GetParity(frame, len, par);
1749 ReaderTransmitBitsPar(frame, len*8, par, timing);
15c4dc5a 1750}
1751
6a1f2d82 1752int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
e691fc45 1753{
6a1f2d82 1754 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE;
7bc95e2e 1755 if (tracing) {
6a1f2d82 1756 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
7bc95e2e 1757 }
e691fc45 1758 return Demod.len;
1759}
1760
6a1f2d82 1761int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
15c4dc5a 1762{
6a1f2d82 1763 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
7bc95e2e 1764 if (tracing) {
6a1f2d82 1765 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
7bc95e2e 1766 }
e691fc45 1767 return Demod.len;
f89c7050
M
1768}
1769
e691fc45 1770/* performs iso14443a anticollision procedure
534983d7 1771 * fills the uid pointer unless NULL
1772 * fills resp_data unless NULL */
6a1f2d82 1773int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, uint32_t *cuid_ptr) {
1774 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1775 uint8_t sel_all[] = { 0x93,0x20 };
1776 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1777 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
f71f4deb 1778 uint8_t resp[MAX_FRAME_SIZE]; // theoretically. A usual RATS will be much smaller
1779 uint8_t resp_par[MAX_PARITY_SIZE];
6a1f2d82 1780 byte_t uid_resp[4];
1781 size_t uid_resp_len;
1782
1783 uint8_t sak = 0x04; // cascade uid
1784 int cascade_level = 0;
1785 int len;
1786
1787 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
9492e0b0 1788 ReaderTransmitBitsPar(wupa,7,0, NULL);
7bc95e2e 1789
6a1f2d82 1790 // Receive the ATQA
1791 if(!ReaderReceive(resp, resp_par)) return 0;
6a1f2d82 1792
1793 if(p_hi14a_card) {
1794 memcpy(p_hi14a_card->atqa, resp, 2);
1795 p_hi14a_card->uidlen = 0;
1796 memset(p_hi14a_card->uid,0,10);
1797 }
5f6d6c90 1798
6a1f2d82 1799 // clear uid
1800 if (uid_ptr) {
1801 memset(uid_ptr,0,10);
1802 }
79a73ab2 1803
0ec548dc 1804 // check for proprietary anticollision:
1805 if ((resp[0] & 0x1F) == 0) {
1806 return 3;
1807 }
1808
6a1f2d82 1809 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1810 // which case we need to make a cascade 2 request and select - this is a long UID
1811 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1812 for(; sak & 0x04; cascade_level++) {
1813 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1814 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1815
1816 // SELECT_ALL
1817 ReaderTransmit(sel_all, sizeof(sel_all), NULL);
1818 if (!ReaderReceive(resp, resp_par)) return 0;
1819
1820 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1821 memset(uid_resp, 0, 4);
1822 uint16_t uid_resp_bits = 0;
1823 uint16_t collision_answer_offset = 0;
1824 // anti-collision-loop:
1825 while (Demod.collisionPos) {
1826 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1827 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1828 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
758f1fd1 1829 uid_resp[uid_resp_bits / 8] |= UIDbit << (uid_resp_bits % 8);
6a1f2d82 1830 }
1831 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1832 uid_resp_bits++;
1833 // construct anticollosion command:
1834 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1835 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1836 sel_uid[2+i] = uid_resp[i];
1837 }
1838 collision_answer_offset = uid_resp_bits%8;
1839 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1840 if (!ReaderReceiveOffset(resp, collision_answer_offset, resp_par)) return 0;
e691fc45 1841 }
6a1f2d82 1842 // finally, add the last bits and BCC of the UID
1843 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1844 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1845 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
e691fc45 1846 }
e691fc45 1847
6a1f2d82 1848 } else { // no collision, use the response to SELECT_ALL as current uid
1849 memcpy(uid_resp, resp, 4);
1850 }
1851 uid_resp_len = 4;
5f6d6c90 1852
6a1f2d82 1853 // calculate crypto UID. Always use last 4 Bytes.
1854 if(cuid_ptr) {
1855 *cuid_ptr = bytes_to_num(uid_resp, 4);
1856 }
e30c654b 1857
6a1f2d82 1858 // Construct SELECT UID command
1859 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1860 memcpy(sel_uid+2, uid_resp, 4); // the UID
1861 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1862 AppendCrc14443a(sel_uid, 7); // calculate and add CRC
1863 ReaderTransmit(sel_uid, sizeof(sel_uid), NULL);
1864
1865 // Receive the SAK
1866 if (!ReaderReceive(resp, resp_par)) return 0;
1867 sak = resp[0];
1868
52ab55ab 1869 // Test if more parts of the uid are coming
6a1f2d82 1870 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
1871 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1872 // http://www.nxp.com/documents/application_note/AN10927.pdf
6a1f2d82 1873 uid_resp[0] = uid_resp[1];
1874 uid_resp[1] = uid_resp[2];
1875 uid_resp[2] = uid_resp[3];
1876
1877 uid_resp_len = 3;
1878 }
5f6d6c90 1879
6a1f2d82 1880 if(uid_ptr) {
1881 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
1882 }
5f6d6c90 1883
6a1f2d82 1884 if(p_hi14a_card) {
1885 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
1886 p_hi14a_card->uidlen += uid_resp_len;
1887 }
1888 }
79a73ab2 1889
6a1f2d82 1890 if(p_hi14a_card) {
1891 p_hi14a_card->sak = sak;
1892 p_hi14a_card->ats_len = 0;
1893 }
534983d7 1894
3fe4ff4f 1895 // non iso14443a compliant tag
1896 if( (sak & 0x20) == 0) return 2;
534983d7 1897
6a1f2d82 1898 // Request for answer to select
1899 AppendCrc14443a(rats, 2);
1900 ReaderTransmit(rats, sizeof(rats), NULL);
1c611bbd 1901
6a1f2d82 1902 if (!(len = ReaderReceive(resp, resp_par))) return 0;
5191b3d1 1903
3fe4ff4f 1904
6a1f2d82 1905 if(p_hi14a_card) {
1906 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
1907 p_hi14a_card->ats_len = len;
1908 }
5f6d6c90 1909
6a1f2d82 1910 // reset the PCB block number
1911 iso14_pcb_blocknum = 0;
19a700a8 1912
1913 // set default timeout based on ATS
1914 iso14a_set_ATS_timeout(resp);
1915
6a1f2d82 1916 return 1;
7e758047 1917}
15c4dc5a 1918
7bc95e2e 1919void iso14443a_setup(uint8_t fpga_minor_mode) {
7cc204bf 1920 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9492e0b0 1921 // Set up the synchronous serial port
1922 FpgaSetupSsc();
7bc95e2e 1923 // connect Demodulated Signal to ADC:
7e758047 1924 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
e30c654b 1925
7e758047 1926 // Signal field is on with the appropriate LED
7bc95e2e 1927 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
1928 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
1929 LED_D_ON();
1930 } else {
1931 LED_D_OFF();
1932 }
1933 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
534983d7 1934
7bc95e2e 1935 // Start the timer
1936 StartCountSspClk();
1937
1938 DemodReset();
1939 UartReset();
1940 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
46c65fed 1941 iso14a_set_timeout(10*106); // 10ms default
7e758047 1942}
15c4dc5a 1943
6a1f2d82 1944int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
1945 uint8_t parity[MAX_PARITY_SIZE];
534983d7 1946 uint8_t real_cmd[cmd_len+4];
1947 real_cmd[0] = 0x0a; //I-Block
b0127e65 1948 // put block number into the PCB
1949 real_cmd[0] |= iso14_pcb_blocknum;
534983d7 1950 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
1951 memcpy(real_cmd+2, cmd, cmd_len);
1952 AppendCrc14443a(real_cmd,cmd_len+2);
1953
9492e0b0 1954 ReaderTransmit(real_cmd, cmd_len+4, NULL);
6a1f2d82 1955 size_t len = ReaderReceive(data, parity);
1956 uint8_t *data_bytes = (uint8_t *) data;
b0127e65 1957 if (!len)
1958 return 0; //DATA LINK ERROR
1959 // if we received an I- or R(ACK)-Block with a block number equal to the
1960 // current block number, toggle the current block number
1961 else if (len >= 4 // PCB+CID+CRC = 4 bytes
1962 && ((data_bytes[0] & 0xC0) == 0 // I-Block
1963 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1964 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
1965 {
1966 iso14_pcb_blocknum ^= 1;
1967 }
1968
534983d7 1969 return len;
1970}
1971
7e758047 1972//-----------------------------------------------------------------------------
1973// Read an ISO 14443a tag. Send out commands and store answers.
1974//
1975//-----------------------------------------------------------------------------
7bc95e2e 1976void ReaderIso14443a(UsbCommand *c)
7e758047 1977{
534983d7 1978 iso14a_command_t param = c->arg[0];
7bc95e2e 1979 uint8_t *cmd = c->d.asBytes;
04bc1c66 1980 size_t len = c->arg[1] & 0xffff;
1981 size_t lenbits = c->arg[1] >> 16;
1982 uint32_t timeout = c->arg[2];
9492e0b0 1983 uint32_t arg0 = 0;
1984 byte_t buf[USB_CMD_DATA_SIZE];
6a1f2d82 1985 uint8_t par[MAX_PARITY_SIZE];
902cb3c0 1986
5f6d6c90 1987 if(param & ISO14A_CONNECT) {
3000dc4e 1988 clear_trace();
5f6d6c90 1989 }
e691fc45 1990
3000dc4e 1991 set_tracing(TRUE);
e30c654b 1992
79a73ab2 1993 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 1994 iso14a_set_trigger(TRUE);
9492e0b0 1995 }
15c4dc5a 1996
534983d7 1997 if(param & ISO14A_CONNECT) {
7bc95e2e 1998 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
5f6d6c90 1999 if(!(param & ISO14A_NO_SELECT)) {
2000 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
2001 arg0 = iso14443a_select_card(NULL,card,NULL);
2002 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
2003 }
534983d7 2004 }
e30c654b 2005
534983d7 2006 if(param & ISO14A_SET_TIMEOUT) {
04bc1c66 2007 iso14a_set_timeout(timeout);
534983d7 2008 }
e30c654b 2009
534983d7 2010 if(param & ISO14A_APDU) {
902cb3c0 2011 arg0 = iso14_apdu(cmd, len, buf);
79a73ab2 2012 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 2013 }
e30c654b 2014
534983d7 2015 if(param & ISO14A_RAW) {
2016 if(param & ISO14A_APPEND_CRC) {
0ec548dc 2017 if(param & ISO14A_TOPAZMODE) {
2018 AppendCrc14443b(cmd,len);
2019 } else {
d26849d4 2020 AppendCrc14443a(cmd,len);
0ec548dc 2021 }
534983d7 2022 len += 2;
c7324bef 2023 if (lenbits) lenbits += 16;
15c4dc5a 2024 }
0ec548dc 2025 if(lenbits>0) { // want to send a specific number of bits (e.g. short commands)
2026 if(param & ISO14A_TOPAZMODE) {
2027 int bits_to_send = lenbits;
2028 uint16_t i = 0;
2029 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 7), NULL, NULL); // first byte is always short (7bits) and no parity
2030 bits_to_send -= 7;
2031 while (bits_to_send > 0) {
2032 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 8), NULL, NULL); // following bytes are 8 bit and no parity
2033 bits_to_send -= 8;
2034 }
2035 } else {
6a1f2d82 2036 GetParity(cmd, lenbits/8, par);
0ec548dc 2037 ReaderTransmitBitsPar(cmd, lenbits, par, NULL); // bytes are 8 bit with odd parity
2038 }
2039 } else { // want to send complete bytes only
2040 if(param & ISO14A_TOPAZMODE) {
2041 uint16_t i = 0;
2042 ReaderTransmitBitsPar(&cmd[i++], 7, NULL, NULL); // first byte: 7 bits, no paritiy
2043 while (i < len) {
2044 ReaderTransmitBitsPar(&cmd[i++], 8, NULL, NULL); // following bytes: 8 bits, no paritiy
2045 }
5f6d6c90 2046 } else {
0ec548dc 2047 ReaderTransmit(cmd,len, NULL); // 8 bits, odd parity
2048 }
5f6d6c90 2049 }
6a1f2d82 2050 arg0 = ReaderReceive(buf, par);
9492e0b0 2051 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 2052 }
15c4dc5a 2053
79a73ab2 2054 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 2055 iso14a_set_trigger(FALSE);
9492e0b0 2056 }
15c4dc5a 2057
79a73ab2 2058 if(param & ISO14A_NO_DISCONNECT) {
534983d7 2059 return;
9492e0b0 2060 }
15c4dc5a 2061
15c4dc5a 2062 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2063 LEDsoff();
15c4dc5a 2064}
b0127e65 2065
1c611bbd 2066
1c611bbd 2067// Determine the distance between two nonces.
2068// Assume that the difference is small, but we don't know which is first.
2069// Therefore try in alternating directions.
2070int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
2071
1c611bbd 2072 if (nt1 == nt2) return 0;
2073
d26849d4 2074 uint16_t i;
2075 uint32_t nttmp1 = nt1;
2076 uint32_t nttmp2 = nt2;
1c611bbd 2077
2078 for (i = 1; i < 32768; i++) {
2079 nttmp1 = prng_successor(nttmp1, 1);
2080 if (nttmp1 == nt2) return i;
2081 nttmp2 = prng_successor(nttmp2, 1);
2082 if (nttmp2 == nt1) return -i;
2083 }
2084
2085 return(-99999); // either nt1 or nt2 are invalid nonces
e772353f 2086}
2087
e772353f 2088
1c611bbd 2089//-----------------------------------------------------------------------------
2090// Recover several bits of the cypher stream. This implements (first stages of)
2091// the algorithm described in "The Dark Side of Security by Obscurity and
2092// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2093// (article by Nicolas T. Courtois, 2009)
2094//-----------------------------------------------------------------------------
d26849d4 2095void ReaderMifare(bool first_try) {
f71f4deb 2096 // free eventually allocated BigBuf memory. We want all for tracing.
2097 BigBuf_free();
2098
3000dc4e
MHS
2099 clear_trace();
2100 set_tracing(TRUE);
e772353f 2101
d26849d4 2102 // Mifare AUTH
2103 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
2104 uint8_t mf_nr_ar[8] = { 0x00 }; //{ 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 };
2105 static uint8_t mf_nr_ar3 = 0;
2106
2107 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = { 0x00 };
2108 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = { 0x00 };
2109
1c611bbd 2110 byte_t nt_diff = 0;
6a1f2d82 2111 uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
1c611bbd 2112 static byte_t par_low = 0;
2113 bool led_on = TRUE;
d26849d4 2114 uint8_t uid[10] = {0x00};
2115 //uint32_t cuid = 0x00;
e772353f 2116
6a1f2d82 2117 uint32_t nt = 0;
2ed270a8 2118 uint32_t previous_nt = 0;
1c611bbd 2119 static uint32_t nt_attacked = 0;
3fe4ff4f 2120 byte_t par_list[8] = {0x00};
2121 byte_t ks_list[8] = {0x00};
e772353f 2122
d26849d4 2123 static uint32_t sync_time = 0;
2124 static uint32_t sync_cycles = 0;
1c611bbd 2125 int catch_up_cycles = 0;
2126 int last_catch_up = 0;
2127 uint16_t consecutive_resyncs = 0;
2128 int isOK = 0;
e772353f 2129
d26849d4 2130 int numWrongDistance = 0;
2131
1c611bbd 2132 if (first_try) {
1c611bbd 2133 mf_nr_ar3 = 0;
7bc95e2e 2134 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2135 sync_time = GetCountSspClk() & 0xfffffff8;
1c611bbd 2136 sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
2137 nt_attacked = 0;
2138 nt = 0;
6a1f2d82 2139 par[0] = 0;
1c611bbd 2140 }
2141 else {
2142 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
1c611bbd 2143 mf_nr_ar3++;
2144 mf_nr_ar[3] = mf_nr_ar3;
6a1f2d82 2145 par[0] = par_low;
1c611bbd 2146 }
e30c654b 2147
15c4dc5a 2148 LED_A_ON();
2149 LED_B_OFF();
2150 LED_C_OFF();
d26849d4 2151 LED_C_ON();
7bc95e2e 2152
1c611bbd 2153 for(uint16_t i = 0; TRUE; i++) {
2154
2155 WDT_HIT();
e30c654b 2156
1c611bbd 2157 // Test if the action was cancelled
d26849d4 2158 if(BUTTON_PRESS()) break;
2159
2160 if (numWrongDistance > 1000) {
2161 isOK = 0;
1c611bbd 2162 break;
2163 }
2164
d26849d4 2165 //if(!iso14443a_select_card(uid, NULL, &cuid)) {
2166 if(!iso14443a_select_card(uid, NULL, NULL)) {
9492e0b0 2167 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
1c611bbd 2168 continue;
2169 }
2170
9492e0b0 2171 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
1c611bbd 2172 catch_up_cycles = 0;
2173
2174 // if we missed the sync time already, advance to the next nonce repeat
7bc95e2e 2175 while(GetCountSspClk() > sync_time) {
9492e0b0 2176 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
1c611bbd 2177 }
e30c654b 2178
9492e0b0 2179 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2180 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
f89c7050 2181
1c611bbd 2182 // Receive the (4 Byte) "random" nonce
6a1f2d82 2183 if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
9492e0b0 2184 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
1c611bbd 2185 continue;
2186 }
2187
1c611bbd 2188 previous_nt = nt;
2189 nt = bytes_to_num(receivedAnswer, 4);
2190
2191 // Transmit reader nonce with fake par
9492e0b0 2192 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
1c611bbd 2193
2194 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2195 int nt_distance = dist_nt(previous_nt, nt);
2196 if (nt_distance == 0) {
2197 nt_attacked = nt;
2198 }
2199 else {
d26849d4 2200
2201 // invalid nonce received, try again
2202 if (nt_distance == -99999) {
2203 numWrongDistance++;
2204 if (MF_DBGLEVEL >= 3) Dbprintf("The two nonces has invalid distance, tag could have good PRNG\n");
1c611bbd 2205 continue;
2206 }
d26849d4 2207
1c611bbd 2208 sync_cycles = (sync_cycles - nt_distance);
9492e0b0 2209 if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
1c611bbd 2210 continue;
2211 }
2212 }
2213
2214 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2215 catch_up_cycles = -dist_nt(nt_attacked, nt);
d26849d4 2216 if (catch_up_cycles >= 99999) { // invalid nonce received. Don't resync on that one.
1c611bbd 2217 catch_up_cycles = 0;
2218 continue;
2219 }
2220 if (catch_up_cycles == last_catch_up) {
2221 consecutive_resyncs++;
2222 }
2223 else {
2224 last_catch_up = catch_up_cycles;
2225 consecutive_resyncs = 0;
2226 }
2227 if (consecutive_resyncs < 3) {
9492e0b0 2228 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
1c611bbd 2229 }
2230 else {
2231 sync_cycles = sync_cycles + catch_up_cycles;
9492e0b0 2232 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
1c611bbd 2233 }
2234 continue;
2235 }
2236
2237 consecutive_resyncs = 0;
2238
2239 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
6a1f2d82 2240 if (ReaderReceive(receivedAnswer, receivedAnswerPar))
1c611bbd 2241 {
9492e0b0 2242 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
1c611bbd 2243
2244 if (nt_diff == 0)
2245 {
6a1f2d82 2246 par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
1c611bbd 2247 }
2248
2249 led_on = !led_on;
2250 if(led_on) LED_B_ON(); else LED_B_OFF();
2251
6a1f2d82 2252 par_list[nt_diff] = SwapBits(par[0], 8);
1c611bbd 2253 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2254
2255 // Test if the information is complete
2256 if (nt_diff == 0x07) {
2257 isOK = 1;
2258 break;
2259 }
2260
2261 nt_diff = (nt_diff + 1) & 0x07;
2262 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
6a1f2d82 2263 par[0] = par_low;
1c611bbd 2264 } else {
2265 if (nt_diff == 0 && first_try)
2266 {
6a1f2d82 2267 par[0]++;
1c611bbd 2268 } else {
6a1f2d82 2269 par[0] = ((par[0] & 0x1F) + 1) | par_low;
1c611bbd 2270 }
2271 }
2272 }
2273
1c611bbd 2274 mf_nr_ar[3] &= 0x1F;
2275
d26849d4 2276 byte_t buf[28] = {0x00};
2277
1c611bbd 2278 memcpy(buf + 0, uid, 4);
2279 num_to_bytes(nt, 4, buf + 4);
2280 memcpy(buf + 8, par_list, 8);
2281 memcpy(buf + 16, ks_list, 8);
2282 memcpy(buf + 24, mf_nr_ar, 4);
2283
2284 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2285
d26849d4 2286 set_tracing(FALSE);
1c611bbd 2287 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2288 LEDsoff();
20f9a2a1 2289}
1c611bbd 2290
d26849d4 2291
2292 /*
d2f487af 2293 *MIFARE 1K simulate.
2294 *
2295 *@param flags :
2296 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2297 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2298 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2299 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2300 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2301 */
2302void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
20f9a2a1 2303{
50193c1e 2304 int cardSTATE = MFEMUL_NOFIELD;
8556b852 2305 int _7BUID = 0;
9ca155ba 2306 int vHf = 0; // in mV
8f51ddb0 2307 int res;
0a39986e
M
2308 uint32_t selTimer = 0;
2309 uint32_t authTimer = 0;
6a1f2d82 2310 uint16_t len = 0;
8f51ddb0 2311 uint8_t cardWRBL = 0;
9ca155ba
M
2312 uint8_t cardAUTHSC = 0;
2313 uint8_t cardAUTHKEY = 0xff; // no authentication
c3c241f3 2314// uint32_t cardRr = 0;
9ca155ba 2315 uint32_t cuid = 0;
d2f487af 2316 //uint32_t rn_enc = 0;
51969283 2317 uint32_t ans = 0;
0014cb46
M
2318 uint32_t cardINTREG = 0;
2319 uint8_t cardINTBLOCK = 0;
9ca155ba
M
2320 struct Crypto1State mpcs = {0, 0};
2321 struct Crypto1State *pcs;
2322 pcs = &mpcs;
d2f487af 2323 uint32_t numReads = 0;//Counts numer of times reader read a block
f71f4deb 2324 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2325 uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE];
2326 uint8_t response[MAX_MIFARE_FRAME_SIZE];
2327 uint8_t response_par[MAX_MIFARE_PARITY_SIZE];
9ca155ba 2328
d2f487af 2329 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2330 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2331 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
c3c241f3 2332 //uint8_t rSAK[] = {0x08, 0xb6, 0xdd}; // Mifare Classic
2333 uint8_t rSAK[] = {0x09, 0x3f, 0xcc }; // Mifare Mini
d2f487af 2334 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
9ca155ba 2335
2d2f7d19 2336 uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
d2f487af 2337 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
7bc95e2e 2338
d2f487af 2339 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2340 // This can be used in a reader-only attack.
2341 // (it can also be retrieved via 'hf 14a list', but hey...
c3c241f3 2342 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
d2f487af 2343 uint8_t ar_nr_collected = 0;
0014cb46 2344
f71f4deb 2345 // free eventually allocated BigBuf memory but keep Emulator Memory
2346 BigBuf_free_keep_EM();
0c8d25eb 2347
0a39986e 2348 // clear trace
3000dc4e
MHS
2349 clear_trace();
2350 set_tracing(TRUE);
51969283 2351
7bc95e2e 2352 // Authenticate response - nonce
51969283 2353 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
7bc95e2e 2354
d2f487af 2355 //-- Determine the UID
2356 // Can be set from emulator memory, incoming data
2357 // and can be 7 or 4 bytes long
7bc95e2e 2358 if (flags & FLAG_4B_UID_IN_DATA)
d2f487af 2359 {
2360 // 4B uid comes from data-portion of packet
2361 memcpy(rUIDBCC1,datain,4);
8556b852 2362 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852 2363
7bc95e2e 2364 } else if (flags & FLAG_7B_UID_IN_DATA) {
d2f487af 2365 // 7B uid comes from data-portion of packet
2366 memcpy(&rUIDBCC1[1],datain,3);
2367 memcpy(rUIDBCC2, datain+3, 4);
2368 _7BUID = true;
7bc95e2e 2369 } else {
d2f487af 2370 // get UID from emul memory
2371 emlGetMemBt(receivedCmd, 7, 1);
2372 _7BUID = !(receivedCmd[0] == 0x00);
2373 if (!_7BUID) { // ---------- 4BUID
2374 emlGetMemBt(rUIDBCC1, 0, 4);
2375 } else { // ---------- 7BUID
2376 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2377 emlGetMemBt(rUIDBCC2, 3, 4);
2378 }
2379 }
7bc95e2e 2380
c3c241f3 2381 // save uid.
2382 ar_nr_responses[0*5] = bytes_to_num(rUIDBCC1+1, 3);
2383 if ( _7BUID )
2384 ar_nr_responses[0*5+1] = bytes_to_num(rUIDBCC2, 4);
2385
d2f487af 2386 /*
2387 * Regardless of what method was used to set the UID, set fifth byte and modify
2388 * the ATQA for 4 or 7-byte UID
2389 */
d2f487af 2390 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
7bc95e2e 2391 if (_7BUID) {
d2f487af 2392 rATQA[0] = 0x44;
8556b852 2393 rUIDBCC1[0] = 0x88;
d26849d4 2394 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852
M
2395 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2396 }
2397
9ca155ba 2398 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 2399 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
9ca155ba 2400
9ca155ba 2401
d2f487af 2402 if (MF_DBGLEVEL >= 1) {
2403 if (!_7BUID) {
b03c0f2d 2404 Dbprintf("4B UID: %02x%02x%02x%02x",
2405 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
7bc95e2e 2406 } else {
b03c0f2d 2407 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2408 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
2409 rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
d2f487af 2410 }
2411 }
7bc95e2e 2412
2413 bool finished = FALSE;
d2f487af 2414 while (!BUTTON_PRESS() && !finished) {
9ca155ba 2415 WDT_HIT();
9ca155ba
M
2416
2417 // find reader field
9ca155ba 2418 if (cardSTATE == MFEMUL_NOFIELD) {
0c8d25eb 2419 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
9ca155ba 2420 if (vHf > MF_MINFIELDV) {
0014cb46 2421 cardSTATE_TO_IDLE();
9ca155ba
M
2422 LED_A_ON();
2423 }
2424 }
d2f487af 2425 if(cardSTATE == MFEMUL_NOFIELD) continue;
9ca155ba 2426
d2f487af 2427 //Now, get data
6a1f2d82 2428 res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
d2f487af 2429 if (res == 2) { //Field is off!
2430 cardSTATE = MFEMUL_NOFIELD;
2431 LEDsoff();
2432 continue;
7bc95e2e 2433 } else if (res == 1) {
2434 break; //return value 1 means button press
2435 }
2436
d2f487af 2437 // REQ or WUP request in ANY state and WUP in HALTED state
2438 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2439 selTimer = GetTickCount();
2440 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2441 cardSTATE = MFEMUL_SELECT1;
2442
2443 // init crypto block
2444 LED_B_OFF();
2445 LED_C_OFF();
2446 crypto1_destroy(pcs);
2447 cardAUTHKEY = 0xff;
2448 continue;
0a39986e 2449 }
7bc95e2e 2450
50193c1e 2451 switch (cardSTATE) {
d2f487af 2452 case MFEMUL_NOFIELD:
2453 case MFEMUL_HALTED:
50193c1e 2454 case MFEMUL_IDLE:{
6a1f2d82 2455 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
50193c1e
M
2456 break;
2457 }
2458 case MFEMUL_SELECT1:{
9ca155ba
M
2459 // select all
2460 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
d2f487af 2461 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
9ca155ba 2462 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
0014cb46 2463 break;
9ca155ba
M
2464 }
2465
d2f487af 2466 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2467 {
2468 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2469 }
9ca155ba 2470 // select card
0a39986e
M
2471 if (len == 9 &&
2472 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
bfb6a143 2473 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
9ca155ba 2474 cuid = bytes_to_num(rUIDBCC1, 4);
8556b852
M
2475 if (!_7BUID) {
2476 cardSTATE = MFEMUL_WORK;
0014cb46
M
2477 LED_B_ON();
2478 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2479 break;
8556b852
M
2480 } else {
2481 cardSTATE = MFEMUL_SELECT2;
8556b852 2482 }
9ca155ba 2483 }
50193c1e
M
2484 break;
2485 }
d2f487af 2486 case MFEMUL_AUTH1:{
2487 if( len != 8)
2488 {
2489 cardSTATE_TO_IDLE();
6a1f2d82 2490 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
d2f487af 2491 break;
2492 }
0c8d25eb 2493
d2f487af 2494 uint32_t ar = bytes_to_num(receivedCmd, 4);
6a1f2d82 2495 uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
d2f487af 2496
2497 //Collect AR/NR
46cd801c 2498 //if(ar_nr_collected < 2 && cardAUTHSC == 2){
2499 if(ar_nr_collected < 2){
273b57a7 2500 if(ar_nr_responses[2] != ar)
2501 {// Avoid duplicates... probably not necessary, ar should vary.
c3c241f3 2502 //ar_nr_responses[ar_nr_collected*5] = 0;
2503 //ar_nr_responses[ar_nr_collected*5+1] = 0;
2504 ar_nr_responses[ar_nr_collected*5+2] = nonce;
2505 ar_nr_responses[ar_nr_collected*5+3] = nr;
2506 ar_nr_responses[ar_nr_collected*5+4] = ar;
273b57a7 2507 ar_nr_collected++;
12d708fe 2508 }
2509 // Interactive mode flag, means we need to send ACK
2510 if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
2511 {
2512 finished = true;
46cd801c 2513 }
d2f487af 2514 }
2515
2516 // --- crypto
c3c241f3 2517 //crypto1_word(pcs, ar , 1);
2518 //cardRr = nr ^ crypto1_word(pcs, 0, 0);
2519
2520 //test if auth OK
2521 //if (cardRr != prng_successor(nonce, 64)){
2522
2523 //if (MF_DBGLEVEL >= 4) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2524 // cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2525 // cardRr, prng_successor(nonce, 64));
7bc95e2e 2526 // Shouldn't we respond anything here?
d2f487af 2527 // Right now, we don't nack or anything, which causes the
2528 // reader to do a WUPA after a while. /Martin
b03c0f2d 2529 // -- which is the correct response. /piwi
c3c241f3 2530 //cardSTATE_TO_IDLE();
2531 //LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2532 //break;
2533 //}
d2f487af 2534
2535 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2536
2537 num_to_bytes(ans, 4, rAUTH_AT);
2538 // --- crypto
2539 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2540 LED_C_ON();
2541 cardSTATE = MFEMUL_WORK;
b03c0f2d 2542 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2543 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2544 GetTickCount() - authTimer);
d2f487af 2545 break;
2546 }
50193c1e 2547 case MFEMUL_SELECT2:{
7bc95e2e 2548 if (!len) {
6a1f2d82 2549 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2550 break;
2551 }
8556b852 2552 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
9ca155ba 2553 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
8556b852
M
2554 break;
2555 }
9ca155ba 2556
8556b852
M
2557 // select 2 card
2558 if (len == 9 &&
2559 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2560 EmSendCmd(rSAK, sizeof(rSAK));
8556b852
M
2561 cuid = bytes_to_num(rUIDBCC2, 4);
2562 cardSTATE = MFEMUL_WORK;
2563 LED_B_ON();
0014cb46 2564 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
8556b852
M
2565 break;
2566 }
0014cb46
M
2567
2568 // i guess there is a command). go into the work state.
7bc95e2e 2569 if (len != 4) {
6a1f2d82 2570 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2571 break;
2572 }
0014cb46 2573 cardSTATE = MFEMUL_WORK;
d2f487af 2574 //goto lbWORK;
2575 //intentional fall-through to the next case-stmt
50193c1e 2576 }
51969283 2577
7bc95e2e 2578 case MFEMUL_WORK:{
2579 if (len == 0) {
6a1f2d82 2580 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2581 break;
2582 }
2583
d2f487af 2584 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2585
7bc95e2e 2586 if(encrypted_data) {
51969283
M
2587 // decrypt seqence
2588 mf_crypto1_decrypt(pcs, receivedCmd, len);
d2f487af 2589 }
7bc95e2e 2590
d2f487af 2591 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2592 authTimer = GetTickCount();
2593 cardAUTHSC = receivedCmd[1] / 4; // received block num
2594 cardAUTHKEY = receivedCmd[0] - 0x60;
2595 crypto1_destroy(pcs);//Added by martin
2596 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
51969283 2597
d2f487af 2598 if (!encrypted_data) { // first authentication
b03c0f2d 2599 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
51969283 2600
d2f487af 2601 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2602 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
7bc95e2e 2603 } else { // nested authentication
b03c0f2d 2604 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
7bc95e2e 2605 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
d2f487af 2606 num_to_bytes(ans, 4, rAUTH_AT);
2607 }
0c8d25eb 2608
d2f487af 2609 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2610 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2611 cardSTATE = MFEMUL_AUTH1;
2612 break;
51969283 2613 }
7bc95e2e 2614
8f51ddb0
M
2615 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2616 // BUT... ACK --> NACK
2617 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2618 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2619 break;
2620 }
2621
2622 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2623 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2624 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2625 break;
0a39986e
M
2626 }
2627
7bc95e2e 2628 if(len != 4) {
6a1f2d82 2629 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2630 break;
2631 }
d2f487af 2632
2633 if(receivedCmd[0] == 0x30 // read block
2634 || receivedCmd[0] == 0xA0 // write block
b03c0f2d 2635 || receivedCmd[0] == 0xC0 // inc
2636 || receivedCmd[0] == 0xC1 // dec
2637 || receivedCmd[0] == 0xC2 // restore
7bc95e2e 2638 || receivedCmd[0] == 0xB0) { // transfer
2639 if (receivedCmd[1] >= 16 * 4) {
d2f487af 2640 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
c3c241f3 2641 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2642 break;
2643 }
2644
7bc95e2e 2645 if (receivedCmd[1] / 4 != cardAUTHSC) {
8f51ddb0 2646 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
c3c241f3 2647 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
8f51ddb0
M
2648 break;
2649 }
d2f487af 2650 }
2651 // read block
2652 if (receivedCmd[0] == 0x30) {
b03c0f2d 2653 if (MF_DBGLEVEL >= 4) {
d2f487af 2654 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2655 }
8f51ddb0
M
2656 emlGetMem(response, receivedCmd[1], 1);
2657 AppendCrc14443a(response, 16);
6a1f2d82 2658 mf_crypto1_encrypt(pcs, response, 18, response_par);
2659 EmSendCmdPar(response, 18, response_par);
d2f487af 2660 numReads++;
12d708fe 2661 if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
d2f487af 2662 Dbprintf("%d reads done, exiting", numReads);
2663 finished = true;
2664 }
0a39986e
M
2665 break;
2666 }
0a39986e 2667 // write block
d2f487af 2668 if (receivedCmd[0] == 0xA0) {
b03c0f2d 2669 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
8f51ddb0 2670 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
8f51ddb0
M
2671 cardSTATE = MFEMUL_WRITEBL2;
2672 cardWRBL = receivedCmd[1];
0a39986e 2673 break;
7bc95e2e 2674 }
0014cb46 2675 // increment, decrement, restore
d2f487af 2676 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
b03c0f2d 2677 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2678 if (emlCheckValBl(receivedCmd[1])) {
c3c241f3 2679 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
0014cb46
M
2680 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2681 break;
2682 }
2683 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2684 if (receivedCmd[0] == 0xC1)
2685 cardSTATE = MFEMUL_INTREG_INC;
2686 if (receivedCmd[0] == 0xC0)
2687 cardSTATE = MFEMUL_INTREG_DEC;
2688 if (receivedCmd[0] == 0xC2)
2689 cardSTATE = MFEMUL_INTREG_REST;
2690 cardWRBL = receivedCmd[1];
0014cb46
M
2691 break;
2692 }
0014cb46 2693 // transfer
d2f487af 2694 if (receivedCmd[0] == 0xB0) {
b03c0f2d 2695 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
0014cb46
M
2696 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2697 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2698 else
2699 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
0014cb46
M
2700 break;
2701 }
9ca155ba 2702 // halt
d2f487af 2703 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
9ca155ba 2704 LED_B_OFF();
0a39986e 2705 LED_C_OFF();
0014cb46
M
2706 cardSTATE = MFEMUL_HALTED;
2707 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
6a1f2d82 2708 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0a39986e 2709 break;
9ca155ba 2710 }
d2f487af 2711 // RATS
2712 if (receivedCmd[0] == 0xe0) {//RATS
8f51ddb0
M
2713 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2714 break;
2715 }
d2f487af 2716 // command not allowed
2717 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2718 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
51969283 2719 break;
8f51ddb0
M
2720 }
2721 case MFEMUL_WRITEBL2:{
2722 if (len == 18){
2723 mf_crypto1_decrypt(pcs, receivedCmd, len);
2724 emlSetMem(receivedCmd, cardWRBL, 1);
2725 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2726 cardSTATE = MFEMUL_WORK;
51969283 2727 } else {
0014cb46 2728 cardSTATE_TO_IDLE();
6a1f2d82 2729 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
8f51ddb0 2730 }
8f51ddb0 2731 break;
50193c1e 2732 }
0014cb46
M
2733
2734 case MFEMUL_INTREG_INC:{
2735 mf_crypto1_decrypt(pcs, receivedCmd, len);
2736 memcpy(&ans, receivedCmd, 4);
2737 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2738 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2739 cardSTATE_TO_IDLE();
2740 break;
7bc95e2e 2741 }
6a1f2d82 2742 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2743 cardINTREG = cardINTREG + ans;
2744 cardSTATE = MFEMUL_WORK;
2745 break;
2746 }
2747 case MFEMUL_INTREG_DEC:{
2748 mf_crypto1_decrypt(pcs, receivedCmd, len);
2749 memcpy(&ans, receivedCmd, 4);
2750 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2751 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2752 cardSTATE_TO_IDLE();
2753 break;
2754 }
6a1f2d82 2755 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2756 cardINTREG = cardINTREG - ans;
2757 cardSTATE = MFEMUL_WORK;
2758 break;
2759 }
2760 case MFEMUL_INTREG_REST:{
2761 mf_crypto1_decrypt(pcs, receivedCmd, len);
2762 memcpy(&ans, receivedCmd, 4);
2763 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2764 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2765 cardSTATE_TO_IDLE();
2766 break;
2767 }
6a1f2d82 2768 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2769 cardSTATE = MFEMUL_WORK;
2770 break;
2771 }
50193c1e 2772 }
50193c1e
M
2773 }
2774
9ca155ba
M
2775 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2776 LEDsoff();
2777
d2f487af 2778 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2779 {
2780 //May just aswell send the collected ar_nr in the response aswell
c3c241f3 2781 uint8_t len = ar_nr_collected*5*4;
2782 cmd_send(CMD_ACK, CMD_SIMULATE_MIFARE_CARD, len, 0, &ar_nr_responses, len);
d2f487af 2783 }
d714d3ef 2784
12d708fe 2785 if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
d2f487af 2786 {
12d708fe 2787 if(ar_nr_collected > 1 ) {
d2f487af 2788 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
c3c241f3 2789 Dbprintf("../tools/mfkey/mfkey32 %06x%08x %08x %08x %08x %08x %08x",
2790 ar_nr_responses[0], // UID1
2791 ar_nr_responses[1], // UID2
2792 ar_nr_responses[2], // NT
2793 ar_nr_responses[3], // AR1
2794 ar_nr_responses[4], // NR1
2795 ar_nr_responses[8], // AR2
2796 ar_nr_responses[9] // NR2
d2f487af 2797 );
7bc95e2e 2798 } else {
d2f487af 2799 Dbprintf("Failed to obtain two AR/NR pairs!");
12d708fe 2800 if(ar_nr_collected > 0 ) {
c3c241f3 2801 Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
2802 ar_nr_responses[0], // UID1
2803 ar_nr_responses[1], // UID2
2804 ar_nr_responses[2], // NT
2805 ar_nr_responses[3], // AR1
2806 ar_nr_responses[4] // NR1
d2f487af 2807 );
2808 }
2809 }
2810 }
c3c241f3 2811 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen());
15c4dc5a 2812}
b62a5a84 2813
d2f487af 2814
b62a5a84
M
2815//-----------------------------------------------------------------------------
2816// MIFARE sniffer.
2817//
2818//-----------------------------------------------------------------------------
5cd9ec01
M
2819void RAMFUNC SniffMifare(uint8_t param) {
2820 // param:
2821 // bit 0 - trigger from first card answer
2822 // bit 1 - trigger from first reader 7-bit request
39864b0b 2823
d26849d4 2824 // free eventually allocated BigBuf memory
2825 BigBuf_free();
2826
39864b0b 2827 // C(red) A(yellow) B(green)
b62a5a84
M
2828 LEDsoff();
2829 // init trace buffer
3000dc4e
MHS
2830 clear_trace();
2831 set_tracing(TRUE);
b62a5a84 2832
b62a5a84
M
2833 // The command (reader -> tag) that we're receiving.
2834 // The length of a received command will in most cases be no more than 18 bytes.
2835 // So 32 should be enough!
f71f4deb 2836 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2837 uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
b62a5a84 2838 // The response (tag -> reader) that we're receiving.
f71f4deb 2839 uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
2840 uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
b62a5a84 2841
f71f4deb 2842 // allocate the DMA buffer, used to stream samples from the FPGA
2843 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
7bc95e2e 2844 uint8_t *data = dmaBuf;
2845 uint8_t previous_data = 0;
5cd9ec01
M
2846 int maxDataLen = 0;
2847 int dataLen = 0;
7bc95e2e 2848 bool ReaderIsActive = FALSE;
2849 bool TagIsActive = FALSE;
2850
2851 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
b62a5a84
M
2852
2853 // Set up the demodulator for tag -> reader responses.
6a1f2d82 2854 DemodInit(receivedResponse, receivedResponsePar);
b62a5a84
M
2855
2856 // Set up the demodulator for the reader -> tag commands
6a1f2d82 2857 UartInit(receivedCmd, receivedCmdPar);
b62a5a84
M
2858
2859 // Setup for the DMA.
7bc95e2e 2860 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
b62a5a84 2861
b62a5a84 2862 LED_D_OFF();
39864b0b
M
2863
2864 // init sniffer
2865 MfSniffInit();
b62a5a84 2866
b62a5a84 2867 // And now we loop, receiving samples.
7bc95e2e 2868 for(uint32_t sniffCounter = 0; TRUE; ) {
2869
5cd9ec01
M
2870 if(BUTTON_PRESS()) {
2871 DbpString("cancelled by button");
7bc95e2e 2872 break;
5cd9ec01
M
2873 }
2874
b62a5a84
M
2875 LED_A_ON();
2876 WDT_HIT();
39864b0b 2877
7bc95e2e 2878 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
2879 // check if a transaction is completed (timeout after 2000ms).
2880 // if yes, stop the DMA transfer and send what we have so far to the client
2881 if (MfSniffSend(2000)) {
2882 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2883 sniffCounter = 0;
2884 data = dmaBuf;
2885 maxDataLen = 0;
2886 ReaderIsActive = FALSE;
2887 TagIsActive = FALSE;
2888 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
39864b0b 2889 }
39864b0b 2890 }
7bc95e2e 2891
2892 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
2893 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
2894 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
2895 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
2896 } else {
2897 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
5cd9ec01
M
2898 }
2899 // test for length of buffer
7bc95e2e 2900 if(dataLen > maxDataLen) { // we are more behind than ever...
2901 maxDataLen = dataLen;
f71f4deb 2902 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
5cd9ec01 2903 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
7bc95e2e 2904 break;
b62a5a84
M
2905 }
2906 }
5cd9ec01 2907 if(dataLen < 1) continue;
b62a5a84 2908
7bc95e2e 2909 // primary buffer was stopped ( <-- we lost data!
5cd9ec01
M
2910 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
2911 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
2912 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
55acbb2a 2913 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
2914 }
2915 // secondary buffer sets as primary, secondary buffer was stopped
2916 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
2917 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
b62a5a84
M
2918 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
2919 }
5cd9ec01
M
2920
2921 LED_A_OFF();
b62a5a84 2922
7bc95e2e 2923 if (sniffCounter & 0x01) {
b62a5a84 2924
7bc95e2e 2925 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
2926 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
2927 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
2928 LED_C_INV();
6a1f2d82 2929 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
b62a5a84 2930
7bc95e2e 2931 /* And ready to receive another command. */
2d2f7d19 2932 //UartInit(receivedCmd, receivedCmdPar);
2933 UartReset();
7bc95e2e 2934
2935 /* And also reset the demod code */
2936 DemodReset();
2937 }
2938 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
2939 }
2940
2941 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
2942 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
2943 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
2944 LED_C_INV();
b62a5a84 2945
6a1f2d82 2946 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, FALSE)) break;
39864b0b 2947
7bc95e2e 2948 // And ready to receive another response.
2949 DemodReset();
46c65fed 2950
0ec548dc 2951 // And reset the Miller decoder including its (now outdated) input buffer
2952 UartInit(receivedCmd, receivedCmdPar);
7bc95e2e 2953 }
2954 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
2955 }
b62a5a84
M
2956 }
2957
7bc95e2e 2958 previous_data = *data;
2959 sniffCounter++;
5cd9ec01 2960 data++;
d714d3ef 2961 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01 2962 data = dmaBuf;
b62a5a84 2963 }
7bc95e2e 2964
b62a5a84
M
2965 } // main cycle
2966
2967 DbpString("COMMAND FINISHED");
2968
55acbb2a 2969 FpgaDisableSscDma();
39864b0b
M
2970 MfSniffEnd();
2971
7bc95e2e 2972 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
b62a5a84 2973 LEDsoff();
3803d529 2974}
Impressum, Datenschutz