]>
Commit | Line | Data |
---|---|---|
15c4dc5a | 1 | //----------------------------------------------------------------------------- |
bd20f8f4 | 2 | // Jonathan Westhues, split Nov 2006 |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
51d4f6f1 | 8 | // Routines to support ISO 14443B. This includes both the reader software and |
9 | // the `fake tag' modes. | |
15c4dc5a | 10 | //----------------------------------------------------------------------------- |
bd20f8f4 | 11 | |
e30c654b | 12 | #include "proxmark3.h" |
15c4dc5a | 13 | #include "apps.h" |
f7e3ed82 | 14 | #include "util.h" |
9ab7a6c7 | 15 | #include "string.h" |
15c4dc5a | 16 | |
f7e3ed82 | 17 | #include "iso14443crc.h" |
15c4dc5a | 18 | |
0d9a86c7 | 19 | #define RECEIVE_SAMPLES_TIMEOUT 2000 |
705bfa10 | 20 | #define ISO14443B_DMA_BUFFER_SIZE 256 |
0d9a86c7 | 21 | |
15c4dc5a | 22 | //============================================================================= |
23 | // An ISO 14443 Type B tag. We listen for commands from the reader, using | |
24 | // a UART kind of thing that's implemented in software. When we get a | |
25 | // frame (i.e., a group of bytes between SOF and EOF), we check the CRC. | |
26 | // If it's good, then we can do something appropriate with it, and send | |
27 | // a response. | |
28 | //============================================================================= | |
29 | ||
30 | //----------------------------------------------------------------------------- | |
31 | // Code up a string of octets at layer 2 (including CRC, we don't generate | |
32 | // that here) so that they can be transmitted to the reader. Doesn't transmit | |
33 | // them yet, just leaves them ready to send in ToSend[]. | |
34 | //----------------------------------------------------------------------------- | |
f7e3ed82 | 35 | static void CodeIso14443bAsTag(const uint8_t *cmd, int len) |
15c4dc5a | 36 | { |
7d5ebac9 MHS |
37 | int i; |
38 | ||
39 | ToSendReset(); | |
40 | ||
41 | // Transmit a burst of ones, as the initial thing that lets the | |
42 | // reader get phase sync. This (TR1) must be > 80/fs, per spec, | |
43 | // but tag that I've tried (a Paypass) exceeds that by a fair bit, | |
44 | // so I will too. | |
45 | for(i = 0; i < 20; i++) { | |
46 | ToSendStuffBit(1); | |
47 | ToSendStuffBit(1); | |
48 | ToSendStuffBit(1); | |
49 | ToSendStuffBit(1); | |
50 | } | |
51 | ||
52 | // Send SOF. | |
53 | for(i = 0; i < 10; i++) { | |
54 | ToSendStuffBit(0); | |
55 | ToSendStuffBit(0); | |
56 | ToSendStuffBit(0); | |
57 | ToSendStuffBit(0); | |
58 | } | |
59 | for(i = 0; i < 2; i++) { | |
60 | ToSendStuffBit(1); | |
61 | ToSendStuffBit(1); | |
62 | ToSendStuffBit(1); | |
63 | ToSendStuffBit(1); | |
64 | } | |
65 | ||
66 | for(i = 0; i < len; i++) { | |
67 | int j; | |
68 | uint8_t b = cmd[i]; | |
69 | ||
70 | // Start bit | |
71 | ToSendStuffBit(0); | |
72 | ToSendStuffBit(0); | |
73 | ToSendStuffBit(0); | |
74 | ToSendStuffBit(0); | |
75 | ||
76 | // Data bits | |
77 | for(j = 0; j < 8; j++) { | |
78 | if(b & 1) { | |
79 | ToSendStuffBit(1); | |
80 | ToSendStuffBit(1); | |
81 | ToSendStuffBit(1); | |
82 | ToSendStuffBit(1); | |
83 | } else { | |
84 | ToSendStuffBit(0); | |
85 | ToSendStuffBit(0); | |
86 | ToSendStuffBit(0); | |
87 | ToSendStuffBit(0); | |
88 | } | |
89 | b >>= 1; | |
90 | } | |
91 | ||
92 | // Stop bit | |
93 | ToSendStuffBit(1); | |
94 | ToSendStuffBit(1); | |
95 | ToSendStuffBit(1); | |
96 | ToSendStuffBit(1); | |
97 | } | |
98 | ||
51d4f6f1 | 99 | // Send EOF. |
7d5ebac9 MHS |
100 | for(i = 0; i < 10; i++) { |
101 | ToSendStuffBit(0); | |
102 | ToSendStuffBit(0); | |
103 | ToSendStuffBit(0); | |
104 | ToSendStuffBit(0); | |
105 | } | |
51d4f6f1 | 106 | for(i = 0; i < 2; i++) { |
7d5ebac9 MHS |
107 | ToSendStuffBit(1); |
108 | ToSendStuffBit(1); | |
109 | ToSendStuffBit(1); | |
110 | ToSendStuffBit(1); | |
111 | } | |
112 | ||
113 | // Convert from last byte pos to length | |
114 | ToSendMax++; | |
15c4dc5a | 115 | } |
116 | ||
117 | //----------------------------------------------------------------------------- | |
118 | // The software UART that receives commands from the reader, and its state | |
119 | // variables. | |
120 | //----------------------------------------------------------------------------- | |
121 | static struct { | |
7d5ebac9 MHS |
122 | enum { |
123 | STATE_UNSYNCD, | |
124 | STATE_GOT_FALLING_EDGE_OF_SOF, | |
125 | STATE_AWAITING_START_BIT, | |
46734099 | 126 | STATE_RECEIVING_DATA |
7d5ebac9 MHS |
127 | } state; |
128 | uint16_t shiftReg; | |
129 | int bitCnt; | |
130 | int byteCnt; | |
131 | int byteCntMax; | |
132 | int posCnt; | |
133 | uint8_t *output; | |
15c4dc5a | 134 | } Uart; |
135 | ||
136 | /* Receive & handle a bit coming from the reader. | |
51d4f6f1 | 137 | * |
138 | * This function is called 4 times per bit (every 2 subcarrier cycles). | |
139 | * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us | |
15c4dc5a | 140 | * |
141 | * LED handling: | |
142 | * LED A -> ON once we have received the SOF and are expecting the rest. | |
143 | * LED A -> OFF once we have received EOF or are in error state or unsynced | |
144 | * | |
145 | * Returns: true if we received a EOF | |
146 | * false if we are still waiting for some more | |
147 | */ | |
46734099 | 148 | static RAMFUNC int Handle14443bUartBit(uint8_t bit) |
15c4dc5a | 149 | { |
7d5ebac9 | 150 | switch(Uart.state) { |
03dc1740 | 151 | case STATE_UNSYNCD: |
7d5ebac9 MHS |
152 | if(!bit) { |
153 | // we went low, so this could be the beginning | |
154 | // of an SOF | |
155 | Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF; | |
156 | Uart.posCnt = 0; | |
157 | Uart.bitCnt = 0; | |
158 | } | |
159 | break; | |
160 | ||
161 | case STATE_GOT_FALLING_EDGE_OF_SOF: | |
162 | Uart.posCnt++; | |
51d4f6f1 | 163 | if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit |
7d5ebac9 | 164 | if(bit) { |
51d4f6f1 | 165 | if(Uart.bitCnt > 9) { |
7d5ebac9 MHS |
166 | // we've seen enough consecutive |
167 | // zeros that it's a valid SOF | |
168 | Uart.posCnt = 0; | |
169 | Uart.byteCnt = 0; | |
170 | Uart.state = STATE_AWAITING_START_BIT; | |
171 | LED_A_ON(); // Indicate we got a valid SOF | |
172 | } else { | |
173 | // didn't stay down long enough | |
174 | // before going high, error | |
46734099 | 175 | Uart.state = STATE_UNSYNCD; |
7d5ebac9 MHS |
176 | } |
177 | } else { | |
178 | // do nothing, keep waiting | |
179 | } | |
180 | Uart.bitCnt++; | |
181 | } | |
182 | if(Uart.posCnt >= 4) Uart.posCnt = 0; | |
51d4f6f1 | 183 | if(Uart.bitCnt > 12) { |
7d5ebac9 MHS |
184 | // Give up if we see too many zeros without |
185 | // a one, too. | |
46734099 | 186 | LED_A_OFF(); |
187 | Uart.state = STATE_UNSYNCD; | |
7d5ebac9 MHS |
188 | } |
189 | break; | |
190 | ||
191 | case STATE_AWAITING_START_BIT: | |
192 | Uart.posCnt++; | |
193 | if(bit) { | |
51d4f6f1 | 194 | if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs |
7d5ebac9 MHS |
195 | // stayed high for too long between |
196 | // characters, error | |
46734099 | 197 | Uart.state = STATE_UNSYNCD; |
7d5ebac9 MHS |
198 | } |
199 | } else { | |
200 | // falling edge, this starts the data byte | |
201 | Uart.posCnt = 0; | |
202 | Uart.bitCnt = 0; | |
203 | Uart.shiftReg = 0; | |
204 | Uart.state = STATE_RECEIVING_DATA; | |
7d5ebac9 MHS |
205 | } |
206 | break; | |
207 | ||
208 | case STATE_RECEIVING_DATA: | |
209 | Uart.posCnt++; | |
210 | if(Uart.posCnt == 2) { | |
211 | // time to sample a bit | |
212 | Uart.shiftReg >>= 1; | |
213 | if(bit) { | |
214 | Uart.shiftReg |= 0x200; | |
215 | } | |
216 | Uart.bitCnt++; | |
217 | } | |
218 | if(Uart.posCnt >= 4) { | |
219 | Uart.posCnt = 0; | |
220 | } | |
221 | if(Uart.bitCnt == 10) { | |
222 | if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001)) | |
223 | { | |
224 | // this is a data byte, with correct | |
225 | // start and stop bits | |
226 | Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff; | |
227 | Uart.byteCnt++; | |
228 | ||
229 | if(Uart.byteCnt >= Uart.byteCntMax) { | |
230 | // Buffer overflowed, give up | |
46734099 | 231 | LED_A_OFF(); |
232 | Uart.state = STATE_UNSYNCD; | |
7d5ebac9 MHS |
233 | } else { |
234 | // so get the next byte now | |
235 | Uart.posCnt = 0; | |
236 | Uart.state = STATE_AWAITING_START_BIT; | |
237 | } | |
46734099 | 238 | } else if (Uart.shiftReg == 0x000) { |
7d5ebac9 MHS |
239 | // this is an EOF byte |
240 | LED_A_OFF(); // Finished receiving | |
46734099 | 241 | Uart.state = STATE_UNSYNCD; |
132a0217 | 242 | if (Uart.byteCnt != 0) { |
243 | return TRUE; | |
244 | } | |
7d5ebac9 MHS |
245 | } else { |
246 | // this is an error | |
46734099 | 247 | LED_A_OFF(); |
248 | Uart.state = STATE_UNSYNCD; | |
7d5ebac9 MHS |
249 | } |
250 | } | |
251 | break; | |
252 | ||
7d5ebac9 | 253 | default: |
46734099 | 254 | LED_A_OFF(); |
7d5ebac9 MHS |
255 | Uart.state = STATE_UNSYNCD; |
256 | break; | |
257 | } | |
258 | ||
7d5ebac9 | 259 | return FALSE; |
15c4dc5a | 260 | } |
261 | ||
46734099 | 262 | |
263 | static void UartReset() | |
264 | { | |
265 | Uart.byteCntMax = MAX_FRAME_SIZE; | |
266 | Uart.state = STATE_UNSYNCD; | |
267 | Uart.byteCnt = 0; | |
268 | Uart.bitCnt = 0; | |
269 | } | |
270 | ||
271 | ||
272 | static void UartInit(uint8_t *data) | |
273 | { | |
274 | Uart.output = data; | |
275 | UartReset(); | |
276 | } | |
277 | ||
278 | ||
15c4dc5a | 279 | //----------------------------------------------------------------------------- |
280 | // Receive a command (from the reader to us, where we are the simulated tag), | |
281 | // and store it in the given buffer, up to the given maximum length. Keeps | |
282 | // spinning, waiting for a well-framed command, until either we get one | |
283 | // (returns TRUE) or someone presses the pushbutton on the board (FALSE). | |
284 | // | |
285 | // Assume that we're called with the SSC (to the FPGA) and ADC path set | |
286 | // correctly. | |
287 | //----------------------------------------------------------------------------- | |
46734099 | 288 | static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len) |
15c4dc5a | 289 | { |
51d4f6f1 | 290 | // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen |
7d5ebac9 MHS |
291 | // only, since we are receiving, not transmitting). |
292 | // Signal field is off with the appropriate LED | |
293 | LED_D_OFF(); | |
294 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION); | |
295 | ||
7d5ebac9 | 296 | // Now run a `software UART' on the stream of incoming samples. |
46734099 | 297 | UartInit(received); |
7d5ebac9 MHS |
298 | |
299 | for(;;) { | |
300 | WDT_HIT(); | |
301 | ||
302 | if(BUTTON_PRESS()) return FALSE; | |
303 | ||
7d5ebac9 MHS |
304 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
305 | uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; | |
46734099 | 306 | for(uint8_t mask = 0x80; mask != 0x00; mask >>= 1) { |
307 | if(Handle14443bUartBit(b & mask)) { | |
7d5ebac9 MHS |
308 | *len = Uart.byteCnt; |
309 | return TRUE; | |
310 | } | |
311 | } | |
312 | } | |
313 | } | |
46734099 | 314 | |
315 | return FALSE; | |
15c4dc5a | 316 | } |
317 | ||
318 | //----------------------------------------------------------------------------- | |
319 | // Main loop of simulated tag: receive commands from reader, decide what | |
320 | // response to send, and send it. | |
321 | //----------------------------------------------------------------------------- | |
51d4f6f1 | 322 | void SimulateIso14443bTag(void) |
15c4dc5a | 323 | { |
f3b83bee | 324 | // the only commands we understand is REQB, AFI=0, Select All, N=8: |
325 | static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // REQB | |
46734099 | 326 | // ... and REQB, AFI=0, Normal Request, N=0: |
f3b83bee | 327 | static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB |
328 | // ... and WUPB, AFI=0, N=8: | |
329 | static const uint8_t cmd3[] = { 0x05, 0x08, 0x08, 0xF9, 0xBD }; // WUPB | |
330 | // ... and HLTB | |
331 | static const uint8_t cmd4[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB | |
332 | // ... and ATTRIB | |
333 | static const uint8_t cmd5[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB | |
46734099 | 334 | |
335 | // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922, | |
51d4f6f1 | 336 | // supports only 106kBit/s in both directions, max frame size = 32Bytes, |
337 | // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported: | |
7d5ebac9 MHS |
338 | static const uint8_t response1[] = { |
339 | 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22, | |
340 | 0x00, 0x21, 0x85, 0x5e, 0xd7 | |
341 | }; | |
f3b83bee | 342 | // response to HLTB and ATTRIB |
343 | static const uint8_t response2[] = {0x00, 0x78, 0xF0}; | |
344 | ||
15c4dc5a | 345 | |
5f605b8f | 346 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
347 | ||
46734099 | 348 | clear_trace(); |
349 | set_tracing(TRUE); | |
350 | ||
351 | const uint8_t *resp; | |
352 | uint8_t *respCode; | |
353 | uint16_t respLen, respCodeLen; | |
15c4dc5a | 354 | |
51d4f6f1 | 355 | // allocate command receive buffer |
356 | BigBuf_free(); | |
357 | uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE); | |
15c4dc5a | 358 | |
46734099 | 359 | uint16_t len; |
360 | uint16_t cmdsRecvd = 0; | |
15c4dc5a | 361 | |
51d4f6f1 | 362 | // prepare the (only one) tag answer: |
7d5ebac9 | 363 | CodeIso14443bAsTag(response1, sizeof(response1)); |
46734099 | 364 | uint8_t *resp1Code = BigBuf_malloc(ToSendMax); |
365 | memcpy(resp1Code, ToSend, ToSendMax); | |
366 | uint16_t resp1CodeLen = ToSendMax; | |
15c4dc5a | 367 | |
f3b83bee | 368 | // prepare the (other) tag answer: |
369 | CodeIso14443bAsTag(response2, sizeof(response2)); | |
370 | uint8_t *resp2Code = BigBuf_malloc(ToSendMax); | |
371 | memcpy(resp2Code, ToSend, ToSendMax); | |
372 | uint16_t resp2CodeLen = ToSendMax; | |
373 | ||
7d5ebac9 MHS |
374 | // We need to listen to the high-frequency, peak-detected path. |
375 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
376 | FpgaSetupSsc(); | |
15c4dc5a | 377 | |
7d5ebac9 | 378 | cmdsRecvd = 0; |
15c4dc5a | 379 | |
7d5ebac9 | 380 | for(;;) { |
15c4dc5a | 381 | |
46734099 | 382 | if(!GetIso14443bCommandFromReader(receivedCmd, &len)) { |
51d4f6f1 | 383 | Dbprintf("button pressed, received %d commands", cmdsRecvd); |
384 | break; | |
46734099 | 385 | } |
7d5ebac9 | 386 | |
46734099 | 387 | if (tracing) { |
388 | uint8_t parity[MAX_PARITY_SIZE]; | |
389 | LogTrace(receivedCmd, len, 0, 0, parity, TRUE); | |
390 | } | |
7d5ebac9 | 391 | |
46734099 | 392 | // Good, look at the command now. |
393 | if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0) | |
f3b83bee | 394 | || (len == sizeof(cmd2) && memcmp(receivedCmd, cmd2, len) == 0) |
395 | || (len == sizeof(cmd3) && memcmp(receivedCmd, cmd3, len) == 0) ) { | |
46734099 | 396 | resp = response1; |
397 | respLen = sizeof(response1); | |
398 | respCode = resp1Code; | |
399 | respCodeLen = resp1CodeLen; | |
f3b83bee | 400 | } else if ( (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) |
401 | || (len == sizeof(cmd5) && receivedCmd[0] == cmd5[0]) ) { | |
402 | resp = response2; | |
403 | respLen = sizeof(response2); | |
404 | respCode = resp2Code; | |
405 | respCodeLen = resp2CodeLen; | |
7d5ebac9 MHS |
406 | } else { |
407 | Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd); | |
408 | // And print whether the CRC fails, just for good measure | |
46734099 | 409 | uint8_t b1, b2; |
f3b83bee | 410 | if (len >= 3){ // if crc exists |
411 | ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2); | |
412 | if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) { | |
413 | // Not so good, try again. | |
414 | DbpString("+++CRC fail"); | |
415 | } else { | |
416 | DbpString("CRC passes"); | |
417 | } | |
7d5ebac9 | 418 | } |
f3b83bee | 419 | //get rid of compiler warning |
420 | respCodeLen = 0; | |
421 | resp = response1; | |
422 | respLen = 0; | |
423 | respCode = resp1Code; | |
424 | //don't crash at new command just wait and see if reader will send other new cmds. | |
425 | //break; | |
7d5ebac9 MHS |
426 | } |
427 | ||
7d5ebac9 MHS |
428 | cmdsRecvd++; |
429 | ||
430 | if(cmdsRecvd > 0x30) { | |
431 | DbpString("many commands later..."); | |
432 | break; | |
433 | } | |
434 | ||
46734099 | 435 | if(respCodeLen <= 0) continue; |
7d5ebac9 MHS |
436 | |
437 | // Modulate BPSK | |
438 | // Signal field is off with the appropriate LED | |
439 | LED_D_OFF(); | |
440 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK); | |
441 | AT91C_BASE_SSC->SSC_THR = 0xff; | |
442 | FpgaSetupSsc(); | |
443 | ||
444 | // Transmit the response. | |
46734099 | 445 | uint16_t i = 0; |
7d5ebac9 MHS |
446 | for(;;) { |
447 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
46734099 | 448 | uint8_t b = respCode[i]; |
7d5ebac9 MHS |
449 | |
450 | AT91C_BASE_SSC->SSC_THR = b; | |
451 | ||
452 | i++; | |
46734099 | 453 | if(i > respCodeLen) { |
7d5ebac9 MHS |
454 | break; |
455 | } | |
456 | } | |
457 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { | |
458 | volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; | |
459 | (void)b; | |
460 | } | |
461 | } | |
46734099 | 462 | |
463 | // trace the response: | |
464 | if (tracing) { | |
465 | uint8_t parity[MAX_PARITY_SIZE]; | |
466 | LogTrace(resp, respLen, 0, 0, parity, FALSE); | |
467 | } | |
468 | ||
7d5ebac9 | 469 | } |
15c4dc5a | 470 | } |
471 | ||
472 | //============================================================================= | |
473 | // An ISO 14443 Type B reader. We take layer two commands, code them | |
474 | // appropriately, and then send them to the tag. We then listen for the | |
475 | // tag's response, which we leave in the buffer to be demodulated on the | |
476 | // PC side. | |
477 | //============================================================================= | |
478 | ||
479 | static struct { | |
7d5ebac9 MHS |
480 | enum { |
481 | DEMOD_UNSYNCD, | |
482 | DEMOD_PHASE_REF_TRAINING, | |
483 | DEMOD_AWAITING_FALLING_EDGE_OF_SOF, | |
484 | DEMOD_GOT_FALLING_EDGE_OF_SOF, | |
485 | DEMOD_AWAITING_START_BIT, | |
46734099 | 486 | DEMOD_RECEIVING_DATA |
7d5ebac9 MHS |
487 | } state; |
488 | int bitCount; | |
489 | int posCount; | |
490 | int thisBit; | |
51d4f6f1 | 491 | /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented. |
7d5ebac9 MHS |
492 | int metric; |
493 | int metricN; | |
51d4f6f1 | 494 | */ |
7d5ebac9 MHS |
495 | uint16_t shiftReg; |
496 | uint8_t *output; | |
497 | int len; | |
498 | int sumI; | |
499 | int sumQ; | |
15c4dc5a | 500 | } Demod; |
501 | ||
502 | /* | |
503 | * Handles reception of a bit from the tag | |
504 | * | |
51d4f6f1 | 505 | * This function is called 2 times per bit (every 4 subcarrier cycles). |
506 | * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us | |
507 | * | |
15c4dc5a | 508 | * LED handling: |
509 | * LED C -> ON once we have received the SOF and are expecting the rest. | |
510 | * LED C -> OFF once we have received EOF or are unsynced | |
511 | * | |
512 | * Returns: true if we received a EOF | |
513 | * false if we are still waiting for some more | |
514 | * | |
515 | */ | |
51d4f6f1 | 516 | static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) |
15c4dc5a | 517 | { |
7d5ebac9 | 518 | int v; |
15c4dc5a | 519 | |
51d4f6f1 | 520 | // The soft decision on the bit uses an estimate of just the |
521 | // quadrant of the reference angle, not the exact angle. | |
15c4dc5a | 522 | #define MAKE_SOFT_DECISION() { \ |
7d5ebac9 MHS |
523 | if(Demod.sumI > 0) { \ |
524 | v = ci; \ | |
525 | } else { \ | |
526 | v = -ci; \ | |
527 | } \ | |
528 | if(Demod.sumQ > 0) { \ | |
529 | v += cq; \ | |
530 | } else { \ | |
531 | v -= cq; \ | |
532 | } \ | |
533 | } | |
15c4dc5a | 534 | |
51d4f6f1 | 535 | #define SUBCARRIER_DETECT_THRESHOLD 8 |
536 | ||
537 | // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq) | |
538 | /* #define CHECK_FOR_SUBCARRIER() { \ | |
539 | v = ci; \ | |
540 | if(v < 0) v = -v; \ | |
541 | if(cq > 0) { \ | |
542 | v += cq; \ | |
543 | } else { \ | |
544 | v -= cq; \ | |
545 | } \ | |
546 | } | |
547 | */ | |
548 | // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq))) | |
549 | #define CHECK_FOR_SUBCARRIER() { \ | |
550 | if(ci < 0) { \ | |
551 | if(cq < 0) { /* ci < 0, cq < 0 */ \ | |
552 | if (cq < ci) { \ | |
553 | v = -cq - (ci >> 1); \ | |
554 | } else { \ | |
555 | v = -ci - (cq >> 1); \ | |
556 | } \ | |
557 | } else { /* ci < 0, cq >= 0 */ \ | |
558 | if (cq < -ci) { \ | |
559 | v = -ci + (cq >> 1); \ | |
560 | } else { \ | |
561 | v = cq - (ci >> 1); \ | |
562 | } \ | |
563 | } \ | |
564 | } else { \ | |
565 | if(cq < 0) { /* ci >= 0, cq < 0 */ \ | |
566 | if (-cq < ci) { \ | |
567 | v = ci - (cq >> 1); \ | |
568 | } else { \ | |
569 | v = -cq + (ci >> 1); \ | |
570 | } \ | |
571 | } else { /* ci >= 0, cq >= 0 */ \ | |
572 | if (cq < ci) { \ | |
573 | v = ci + (cq >> 1); \ | |
574 | } else { \ | |
575 | v = cq + (ci >> 1); \ | |
576 | } \ | |
577 | } \ | |
578 | } \ | |
579 | } | |
580 | ||
7d5ebac9 MHS |
581 | switch(Demod.state) { |
582 | case DEMOD_UNSYNCD: | |
51d4f6f1 | 583 | CHECK_FOR_SUBCARRIER(); |
584 | if(v > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected | |
7d5ebac9 | 585 | Demod.state = DEMOD_PHASE_REF_TRAINING; |
51d4f6f1 | 586 | Demod.sumI = ci; |
587 | Demod.sumQ = cq; | |
588 | Demod.posCount = 1; | |
589 | } | |
7d5ebac9 MHS |
590 | break; |
591 | ||
592 | case DEMOD_PHASE_REF_TRAINING: | |
593 | if(Demod.posCount < 8) { | |
51d4f6f1 | 594 | CHECK_FOR_SUBCARRIER(); |
595 | if (v > SUBCARRIER_DETECT_THRESHOLD) { | |
596 | // set the reference phase (will code a logic '1') by averaging over 32 1/fs. | |
597 | // note: synchronization time > 80 1/fs | |
598 | Demod.sumI += ci; | |
599 | Demod.sumQ += cq; | |
600 | Demod.posCount++; | |
601 | } else { // subcarrier lost | |
602 | Demod.state = DEMOD_UNSYNCD; | |
7d5ebac9 | 603 | } |
51d4f6f1 | 604 | } else { |
605 | Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF; | |
7d5ebac9 | 606 | } |
7d5ebac9 MHS |
607 | break; |
608 | ||
609 | case DEMOD_AWAITING_FALLING_EDGE_OF_SOF: | |
610 | MAKE_SOFT_DECISION(); | |
51d4f6f1 | 611 | if(v < 0) { // logic '0' detected |
7d5ebac9 | 612 | Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF; |
51d4f6f1 | 613 | Demod.posCount = 0; // start of SOF sequence |
7d5ebac9 | 614 | } else { |
51d4f6f1 | 615 | if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs |
7d5ebac9 MHS |
616 | Demod.state = DEMOD_UNSYNCD; |
617 | } | |
618 | } | |
619 | Demod.posCount++; | |
620 | break; | |
621 | ||
622 | case DEMOD_GOT_FALLING_EDGE_OF_SOF: | |
51d4f6f1 | 623 | Demod.posCount++; |
7d5ebac9 MHS |
624 | MAKE_SOFT_DECISION(); |
625 | if(v > 0) { | |
51d4f6f1 | 626 | if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges |
7d5ebac9 MHS |
627 | Demod.state = DEMOD_UNSYNCD; |
628 | } else { | |
629 | LED_C_ON(); // Got SOF | |
630 | Demod.state = DEMOD_AWAITING_START_BIT; | |
631 | Demod.posCount = 0; | |
632 | Demod.len = 0; | |
51d4f6f1 | 633 | /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented. |
7d5ebac9 MHS |
634 | Demod.metricN = 0; |
635 | Demod.metric = 0; | |
51d4f6f1 | 636 | */ |
7d5ebac9 MHS |
637 | } |
638 | } else { | |
51d4f6f1 | 639 | if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu) |
7d5ebac9 | 640 | Demod.state = DEMOD_UNSYNCD; |
09c66f1f | 641 | LED_C_OFF(); |
7d5ebac9 MHS |
642 | } |
643 | } | |
7d5ebac9 MHS |
644 | break; |
645 | ||
646 | case DEMOD_AWAITING_START_BIT: | |
51d4f6f1 | 647 | Demod.posCount++; |
7d5ebac9 MHS |
648 | MAKE_SOFT_DECISION(); |
649 | if(v > 0) { | |
51d4f6f1 | 650 | if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs |
7d5ebac9 | 651 | Demod.state = DEMOD_UNSYNCD; |
09c66f1f | 652 | LED_C_OFF(); |
7d5ebac9 | 653 | } |
51d4f6f1 | 654 | } else { // start bit detected |
7d5ebac9 | 655 | Demod.bitCount = 0; |
51d4f6f1 | 656 | Demod.posCount = 1; // this was the first half |
7d5ebac9 MHS |
657 | Demod.thisBit = v; |
658 | Demod.shiftReg = 0; | |
659 | Demod.state = DEMOD_RECEIVING_DATA; | |
660 | } | |
661 | break; | |
662 | ||
663 | case DEMOD_RECEIVING_DATA: | |
664 | MAKE_SOFT_DECISION(); | |
51d4f6f1 | 665 | if(Demod.posCount == 0) { // first half of bit |
7d5ebac9 MHS |
666 | Demod.thisBit = v; |
667 | Demod.posCount = 1; | |
51d4f6f1 | 668 | } else { // second half of bit |
7d5ebac9 MHS |
669 | Demod.thisBit += v; |
670 | ||
51d4f6f1 | 671 | /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented. |
7d5ebac9 MHS |
672 | if(Demod.thisBit > 0) { |
673 | Demod.metric += Demod.thisBit; | |
674 | } else { | |
675 | Demod.metric -= Demod.thisBit; | |
676 | } | |
677 | (Demod.metricN)++; | |
51d4f6f1 | 678 | */ |
7d5ebac9 MHS |
679 | |
680 | Demod.shiftReg >>= 1; | |
51d4f6f1 | 681 | if(Demod.thisBit > 0) { // logic '1' |
7d5ebac9 MHS |
682 | Demod.shiftReg |= 0x200; |
683 | } | |
684 | ||
685 | Demod.bitCount++; | |
686 | if(Demod.bitCount == 10) { | |
687 | uint16_t s = Demod.shiftReg; | |
51d4f6f1 | 688 | if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0' |
7d5ebac9 MHS |
689 | uint8_t b = (s >> 1); |
690 | Demod.output[Demod.len] = b; | |
691 | Demod.len++; | |
692 | Demod.state = DEMOD_AWAITING_START_BIT; | |
7d5ebac9 MHS |
693 | } else { |
694 | Demod.state = DEMOD_UNSYNCD; | |
09c66f1f | 695 | LED_C_OFF(); |
696 | if(s == 0x000) { | |
51d4f6f1 | 697 | // This is EOF (start, stop and all data bits == '0' |
09c66f1f | 698 | return TRUE; |
699 | } | |
7d5ebac9 MHS |
700 | } |
701 | } | |
702 | Demod.posCount = 0; | |
703 | } | |
704 | break; | |
705 | ||
706 | default: | |
707 | Demod.state = DEMOD_UNSYNCD; | |
09c66f1f | 708 | LED_C_OFF(); |
7d5ebac9 MHS |
709 | break; |
710 | } | |
711 | ||
7d5ebac9 MHS |
712 | return FALSE; |
713 | } | |
67ac4bf7 | 714 | |
715 | ||
aeadbdb2 MHS |
716 | static void DemodReset() |
717 | { | |
718 | // Clear out the state of the "UART" that receives from the tag. | |
aeadbdb2 MHS |
719 | Demod.len = 0; |
720 | Demod.state = DEMOD_UNSYNCD; | |
51d4f6f1 | 721 | Demod.posCount = 0; |
aeadbdb2 | 722 | memset(Demod.output, 0x00, MAX_FRAME_SIZE); |
7d5ebac9 | 723 | } |
67ac4bf7 | 724 | |
725 | ||
7d5ebac9 MHS |
726 | static void DemodInit(uint8_t *data) |
727 | { | |
728 | Demod.output = data; | |
729 | DemodReset(); | |
aeadbdb2 MHS |
730 | } |
731 | ||
67ac4bf7 | 732 | |
15c4dc5a | 733 | /* |
355c8b4a | 734 | * Demodulate the samples we received from the tag, also log to tracebuffer |
15c4dc5a | 735 | * quiet: set to 'TRUE' to disable debug output |
736 | */ | |
51d4f6f1 | 737 | static void GetSamplesFor14443bDemod(int n, bool quiet) |
15c4dc5a | 738 | { |
7d5ebac9 | 739 | int max = 0; |
51d4f6f1 | 740 | bool gotFrame = FALSE; |
7d5ebac9 MHS |
741 | int lastRxCounter, ci, cq, samples = 0; |
742 | ||
743 | // Allocate memory from BigBuf for some buffers | |
744 | // free all previous allocations first | |
745 | BigBuf_free(); | |
746 | ||
7d5ebac9 MHS |
747 | // The response (tag -> reader) that we're receiving. |
748 | uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE); | |
749 | ||
750 | // The DMA buffer, used to stream samples from the FPGA | |
705bfa10 | 751 | int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); |
15c4dc5a | 752 | |
7d5ebac9 MHS |
753 | // Set up the demodulator for tag -> reader responses. |
754 | DemodInit(receivedResponse); | |
15c4dc5a | 755 | |
7d5ebac9 | 756 | // Setup and start DMA. |
705bfa10 | 757 | FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE); |
15c4dc5a | 758 | |
67ac4bf7 | 759 | int8_t *upTo = dmaBuf; |
705bfa10 | 760 | lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; |
15c4dc5a | 761 | |
7d5ebac9 | 762 | // Signal field is ON with the appropriate LED: |
51d4f6f1 | 763 | LED_D_ON(); |
7d5ebac9 | 764 | // And put the FPGA in the appropriate mode |
da586b17 | 765 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); |
15c4dc5a | 766 | |
7d5ebac9 MHS |
767 | for(;;) { |
768 | int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR; | |
769 | if(behindBy > max) max = behindBy; | |
15c4dc5a | 770 | |
705bfa10 | 771 | while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) { |
7d5ebac9 MHS |
772 | ci = upTo[0]; |
773 | cq = upTo[1]; | |
774 | upTo += 2; | |
705bfa10 | 775 | if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { |
0d9a86c7 | 776 | upTo = dmaBuf; |
7d5ebac9 | 777 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo; |
705bfa10 | 778 | AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; |
7d5ebac9 MHS |
779 | } |
780 | lastRxCounter -= 2; | |
781 | if(lastRxCounter <= 0) { | |
705bfa10 | 782 | lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; |
7d5ebac9 | 783 | } |
15c4dc5a | 784 | |
7d5ebac9 | 785 | samples += 2; |
15c4dc5a | 786 | |
51d4f6f1 | 787 | if(Handle14443bSamplesDemod(ci, cq)) { |
788 | gotFrame = TRUE; | |
789 | break; | |
7d5ebac9 MHS |
790 | } |
791 | } | |
15c4dc5a | 792 | |
51d4f6f1 | 793 | if(samples > n || gotFrame) { |
7d5ebac9 MHS |
794 | break; |
795 | } | |
796 | } | |
51d4f6f1 | 797 | |
7d5ebac9 | 798 | AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; |
51d4f6f1 | 799 | |
800 | if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", max, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ); | |
355c8b4a MHS |
801 | //Tracing |
802 | if (tracing && Demod.len > 0) { | |
803 | uint8_t parity[MAX_PARITY_SIZE]; | |
0d9a86c7 | 804 | LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE); |
355c8b4a | 805 | } |
15c4dc5a | 806 | } |
807 | ||
67ac4bf7 | 808 | |
15c4dc5a | 809 | //----------------------------------------------------------------------------- |
810 | // Transmit the command (to the tag) that was placed in ToSend[]. | |
811 | //----------------------------------------------------------------------------- | |
51d4f6f1 | 812 | static void TransmitFor14443b(void) |
15c4dc5a | 813 | { |
7d5ebac9 | 814 | int c; |
15c4dc5a | 815 | |
7d5ebac9 | 816 | FpgaSetupSsc(); |
15c4dc5a | 817 | |
7d5ebac9 MHS |
818 | while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
819 | AT91C_BASE_SSC->SSC_THR = 0xff; | |
820 | } | |
15c4dc5a | 821 | |
7d5ebac9 | 822 | // Signal field is ON with the appropriate Red LED |
15c4dc5a | 823 | LED_D_ON(); |
824 | // Signal we are transmitting with the Green LED | |
825 | LED_B_ON(); | |
51d4f6f1 | 826 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); |
7d5ebac9 MHS |
827 | |
828 | for(c = 0; c < 10;) { | |
829 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
830 | AT91C_BASE_SSC->SSC_THR = 0xff; | |
831 | c++; | |
832 | } | |
833 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { | |
834 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; | |
835 | (void)r; | |
836 | } | |
837 | WDT_HIT(); | |
838 | } | |
839 | ||
840 | c = 0; | |
841 | for(;;) { | |
842 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
843 | AT91C_BASE_SSC->SSC_THR = ToSend[c]; | |
844 | c++; | |
845 | if(c >= ToSendMax) { | |
846 | break; | |
847 | } | |
848 | } | |
849 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { | |
850 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; | |
851 | (void)r; | |
852 | } | |
853 | WDT_HIT(); | |
854 | } | |
855 | LED_B_OFF(); // Finished sending | |
15c4dc5a | 856 | } |
857 | ||
67ac4bf7 | 858 | |
15c4dc5a | 859 | //----------------------------------------------------------------------------- |
860 | // Code a layer 2 command (string of octets, including CRC) into ToSend[], | |
51d4f6f1 | 861 | // so that it is ready to transmit to the tag using TransmitFor14443b(). |
15c4dc5a | 862 | //----------------------------------------------------------------------------- |
7cf3ef20 | 863 | static void CodeIso14443bAsReader(const uint8_t *cmd, int len) |
15c4dc5a | 864 | { |
7d5ebac9 MHS |
865 | int i, j; |
866 | uint8_t b; | |
867 | ||
868 | ToSendReset(); | |
869 | ||
870 | // Establish initial reference level | |
871 | for(i = 0; i < 40; i++) { | |
872 | ToSendStuffBit(1); | |
873 | } | |
874 | // Send SOF | |
875 | for(i = 0; i < 10; i++) { | |
876 | ToSendStuffBit(0); | |
877 | } | |
878 | ||
879 | for(i = 0; i < len; i++) { | |
880 | // Stop bits/EGT | |
881 | ToSendStuffBit(1); | |
882 | ToSendStuffBit(1); | |
883 | // Start bit | |
884 | ToSendStuffBit(0); | |
885 | // Data bits | |
886 | b = cmd[i]; | |
887 | for(j = 0; j < 8; j++) { | |
888 | if(b & 1) { | |
889 | ToSendStuffBit(1); | |
890 | } else { | |
891 | ToSendStuffBit(0); | |
892 | } | |
893 | b >>= 1; | |
894 | } | |
895 | } | |
896 | // Send EOF | |
897 | ToSendStuffBit(1); | |
898 | for(i = 0; i < 10; i++) { | |
899 | ToSendStuffBit(0); | |
900 | } | |
901 | for(i = 0; i < 8; i++) { | |
902 | ToSendStuffBit(1); | |
903 | } | |
904 | ||
905 | // And then a little more, to make sure that the last character makes | |
906 | // it out before we switch to rx mode. | |
907 | for(i = 0; i < 24; i++) { | |
908 | ToSendStuffBit(1); | |
909 | } | |
910 | ||
911 | // Convert from last character reference to length | |
912 | ToSendMax++; | |
15c4dc5a | 913 | } |
914 | ||
67ac4bf7 | 915 | |
355c8b4a MHS |
916 | /** |
917 | Convenience function to encode, transmit and trace iso 14443b comms | |
918 | **/ | |
919 | static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len) | |
920 | { | |
921 | CodeIso14443bAsReader(cmd, len); | |
51d4f6f1 | 922 | TransmitFor14443b(); |
355c8b4a MHS |
923 | if (tracing) { |
924 | uint8_t parity[MAX_PARITY_SIZE]; | |
355c8b4a MHS |
925 | LogTrace(cmd,len, 0, 0, parity, TRUE); |
926 | } | |
927 | } | |
928 | ||
67ac4bf7 | 929 | |
15c4dc5a | 930 | //----------------------------------------------------------------------------- |
51d4f6f1 | 931 | // Read a SRI512 ISO 14443B tag. |
15c4dc5a | 932 | // |
933 | // SRI512 tags are just simple memory tags, here we're looking at making a dump | |
934 | // of the contents of the memory. No anticollision algorithm is done, we assume | |
935 | // we have a single tag in the field. | |
936 | // | |
937 | // I tried to be systematic and check every answer of the tag, every CRC, etc... | |
938 | //----------------------------------------------------------------------------- | |
51d4f6f1 | 939 | void ReadSTMemoryIso14443b(uint32_t dwLast) |
15c4dc5a | 940 | { |
7d5ebac9 | 941 | uint8_t i = 0x00; |
15c4dc5a | 942 | |
7d5ebac9 MHS |
943 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
944 | // Make sure that we start from off, since the tags are stateful; | |
945 | // confusing things will happen if we don't reset them between reads. | |
946 | LED_D_OFF(); | |
947 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
948 | SpinDelay(200); | |
15c4dc5a | 949 | |
7d5ebac9 MHS |
950 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
951 | FpgaSetupSsc(); | |
15c4dc5a | 952 | |
7d5ebac9 MHS |
953 | // Now give it time to spin up. |
954 | // Signal field is on with the appropriate LED | |
955 | LED_D_ON(); | |
705bfa10 | 956 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); |
7d5ebac9 | 957 | SpinDelay(200); |
15c4dc5a | 958 | |
5f605b8f | 959 | clear_trace(); |
960 | set_tracing(TRUE); | |
961 | ||
7d5ebac9 | 962 | // First command: wake up the tag using the INITIATE command |
51d4f6f1 | 963 | uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b}; |
355c8b4a | 964 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); |
51d4f6f1 | 965 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); |
15c4dc5a | 966 | |
7d5ebac9 | 967 | if (Demod.len == 0) { |
705bfa10 | 968 | DbpString("No response from tag"); |
969 | return; | |
7d5ebac9 | 970 | } else { |
705bfa10 | 971 | Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x", |
972 | Demod.output[0], Demod.output[1], Demod.output[2]); | |
7d5ebac9 | 973 | } |
705bfa10 | 974 | |
7d5ebac9 MHS |
975 | // There is a response, SELECT the uid |
976 | DbpString("Now SELECT tag:"); | |
977 | cmd1[0] = 0x0E; // 0x0E is SELECT | |
978 | cmd1[1] = Demod.output[0]; | |
979 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); | |
355c8b4a | 980 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); |
51d4f6f1 | 981 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); |
7d5ebac9 | 982 | if (Demod.len != 3) { |
51d4f6f1 | 983 | Dbprintf("Expected 3 bytes from tag, got %d", Demod.len); |
984 | return; | |
7d5ebac9 MHS |
985 | } |
986 | // Check the CRC of the answer: | |
987 | ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]); | |
988 | if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) { | |
51d4f6f1 | 989 | DbpString("CRC Error reading select response."); |
990 | return; | |
7d5ebac9 MHS |
991 | } |
992 | // Check response from the tag: should be the same UID as the command we just sent: | |
993 | if (cmd1[1] != Demod.output[0]) { | |
132a0217 | 994 | Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]); |
51d4f6f1 | 995 | return; |
7d5ebac9 | 996 | } |
705bfa10 | 997 | |
7d5ebac9 MHS |
998 | // Tag is now selected, |
999 | // First get the tag's UID: | |
1000 | cmd1[0] = 0x0B; | |
1001 | ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]); | |
355c8b4a | 1002 | CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one |
51d4f6f1 | 1003 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); |
7d5ebac9 | 1004 | if (Demod.len != 10) { |
51d4f6f1 | 1005 | Dbprintf("Expected 10 bytes from tag, got %d", Demod.len); |
1006 | return; | |
7d5ebac9 MHS |
1007 | } |
1008 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
1009 | ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]); | |
51d4f6f1 | 1010 | if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) { |
132a0217 | 1011 | Dbprintf("CRC Error reading block! Expected: %04x got: %04x", |
705bfa10 | 1012 | (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]); |
51d4f6f1 | 1013 | // Do not return;, let's go on... (we should retry, maybe ?) |
7d5ebac9 MHS |
1014 | } |
1015 | Dbprintf("Tag UID (64 bits): %08x %08x", | |
705bfa10 | 1016 | (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], |
1017 | (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]); | |
15c4dc5a | 1018 | |
7d5ebac9 | 1019 | // Now loop to read all 16 blocks, address from 0 to last block |
132a0217 | 1020 | Dbprintf("Tag memory dump, block 0 to %d", dwLast); |
7d5ebac9 MHS |
1021 | cmd1[0] = 0x08; |
1022 | i = 0x00; | |
1023 | dwLast++; | |
1024 | for (;;) { | |
51d4f6f1 | 1025 | if (i == dwLast) { |
7d5ebac9 MHS |
1026 | DbpString("System area block (0xff):"); |
1027 | i = 0xff; | |
1028 | } | |
1029 | cmd1[1] = i; | |
1030 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); | |
355c8b4a | 1031 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); |
51d4f6f1 | 1032 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); |
7d5ebac9 | 1033 | if (Demod.len != 6) { // Check if we got an answer from the tag |
51d4f6f1 | 1034 | DbpString("Expected 6 bytes from tag, got less..."); |
1035 | return; | |
7d5ebac9 MHS |
1036 | } |
1037 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
1038 | ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]); | |
51d4f6f1 | 1039 | if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) { |
132a0217 | 1040 | Dbprintf("CRC Error reading block! Expected: %04x got: %04x", |
705bfa10 | 1041 | (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]); |
51d4f6f1 | 1042 | // Do not return;, let's go on... (we should retry, maybe ?) |
7d5ebac9 MHS |
1043 | } |
1044 | // Now print out the memory location: | |
132a0217 | 1045 | Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i, |
705bfa10 | 1046 | (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], |
1047 | (Demod.output[4]<<8)+Demod.output[5]); | |
7d5ebac9 | 1048 | if (i == 0xff) { |
51d4f6f1 | 1049 | break; |
7d5ebac9 MHS |
1050 | } |
1051 | i++; | |
1052 | } | |
15c4dc5a | 1053 | } |
1054 | ||
1055 | ||
1056 | //============================================================================= | |
1057 | // Finally, the `sniffer' combines elements from both the reader and | |
1058 | // simulated tag, to show both sides of the conversation. | |
1059 | //============================================================================= | |
1060 | ||
1061 | //----------------------------------------------------------------------------- | |
1062 | // Record the sequence of commands sent by the reader to the tag, with | |
1063 | // triggering so that we start recording at the point that the tag is moved | |
1064 | // near the reader. | |
1065 | //----------------------------------------------------------------------------- | |
1066 | /* | |
1067 | * Memory usage for this function, (within BigBuf) | |
5b95953d | 1068 | * Last Received command (reader->tag) - MAX_FRAME_SIZE |
1069 | * Last Received command (tag->reader) - MAX_FRAME_SIZE | |
705bfa10 | 1070 | * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE |
5b95953d | 1071 | * Demodulated samples received - all the rest |
15c4dc5a | 1072 | */ |
51d4f6f1 | 1073 | void RAMFUNC SnoopIso14443b(void) |
15c4dc5a | 1074 | { |
7d5ebac9 MHS |
1075 | // We won't start recording the frames that we acquire until we trigger; |
1076 | // a good trigger condition to get started is probably when we see a | |
1077 | // response from the tag. | |
5b95953d | 1078 | int triggered = TRUE; // TODO: set and evaluate trigger condition |
15c4dc5a | 1079 | |
7d5ebac9 | 1080 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
f71f4deb | 1081 | BigBuf_free(); |
15c4dc5a | 1082 | |
aeadbdb2 MHS |
1083 | clear_trace(); |
1084 | set_tracing(TRUE); | |
1085 | ||
7d5ebac9 | 1086 | // The DMA buffer, used to stream samples from the FPGA |
705bfa10 | 1087 | int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); |
7d5ebac9 | 1088 | int lastRxCounter; |
67ac4bf7 | 1089 | int8_t *upTo; |
7d5ebac9 MHS |
1090 | int ci, cq; |
1091 | int maxBehindBy = 0; | |
1092 | ||
1093 | // Count of samples received so far, so that we can include timing | |
1094 | // information in the trace buffer. | |
1095 | int samples = 0; | |
15c4dc5a | 1096 | |
7d5ebac9 MHS |
1097 | DemodInit(BigBuf_malloc(MAX_FRAME_SIZE)); |
1098 | UartInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
15c4dc5a | 1099 | |
7d5ebac9 MHS |
1100 | // Print some debug information about the buffer sizes |
1101 | Dbprintf("Snooping buffers initialized:"); | |
1102 | Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen()); | |
aeadbdb2 MHS |
1103 | Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE); |
1104 | Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE); | |
705bfa10 | 1105 | Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE); |
e30c654b | 1106 | |
51d4f6f1 | 1107 | // Signal field is off, no reader signal, no tag signal |
1108 | LEDsoff(); | |
aeadbdb2 MHS |
1109 | |
1110 | // And put the FPGA in the appropriate mode | |
da586b17 | 1111 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP); |
7d5ebac9 MHS |
1112 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
1113 | ||
1114 | // Setup for the DMA. | |
1115 | FpgaSetupSsc(); | |
1116 | upTo = dmaBuf; | |
705bfa10 | 1117 | lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; |
1118 | FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE); | |
aeadbdb2 | 1119 | uint8_t parity[MAX_PARITY_SIZE]; |
5b95953d | 1120 | |
1121 | bool TagIsActive = FALSE; | |
1122 | bool ReaderIsActive = FALSE; | |
1123 | ||
7d5ebac9 MHS |
1124 | // And now we loop, receiving samples. |
1125 | for(;;) { | |
1126 | int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & | |
705bfa10 | 1127 | (ISO14443B_DMA_BUFFER_SIZE-1); |
7d5ebac9 MHS |
1128 | if(behindBy > maxBehindBy) { |
1129 | maxBehindBy = behindBy; | |
7d5ebac9 | 1130 | } |
51d4f6f1 | 1131 | |
7d5ebac9 MHS |
1132 | if(behindBy < 2) continue; |
1133 | ||
1134 | ci = upTo[0]; | |
1135 | cq = upTo[1]; | |
1136 | upTo += 2; | |
1137 | lastRxCounter -= 2; | |
705bfa10 | 1138 | if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { |
0d9a86c7 | 1139 | upTo = dmaBuf; |
705bfa10 | 1140 | lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; |
0d9a86c7 | 1141 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; |
705bfa10 | 1142 | AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; |
51d4f6f1 | 1143 | WDT_HIT(); |
705bfa10 | 1144 | if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not? |
132a0217 | 1145 | Dbprintf("blew circular buffer! behindBy=%d", behindBy); |
51d4f6f1 | 1146 | break; |
1147 | } | |
1148 | if(!tracing) { | |
1149 | DbpString("Reached trace limit"); | |
1150 | break; | |
1151 | } | |
1152 | if(BUTTON_PRESS()) { | |
1153 | DbpString("cancelled"); | |
1154 | break; | |
1155 | } | |
7d5ebac9 | 1156 | } |
15c4dc5a | 1157 | |
7d5ebac9 | 1158 | samples += 2; |
15c4dc5a | 1159 | |
5b95953d | 1160 | if (!TagIsActive) { // no need to try decoding reader data if the tag is sending |
51d4f6f1 | 1161 | if(Handle14443bUartBit(ci & 0x01)) { |
5b95953d | 1162 | if(triggered && tracing) { |
51d4f6f1 | 1163 | LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE); |
5b95953d | 1164 | } |
5b95953d | 1165 | /* And ready to receive another command. */ |
1166 | UartReset(); | |
1167 | /* And also reset the demod code, which might have been */ | |
1168 | /* false-triggered by the commands from the reader. */ | |
1169 | DemodReset(); | |
aeadbdb2 | 1170 | } |
51d4f6f1 | 1171 | if(Handle14443bUartBit(cq & 0x01)) { |
5b95953d | 1172 | if(triggered && tracing) { |
51d4f6f1 | 1173 | LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE); |
5b95953d | 1174 | } |
5b95953d | 1175 | /* And ready to receive another command. */ |
1176 | UartReset(); | |
1177 | /* And also reset the demod code, which might have been */ | |
1178 | /* false-triggered by the commands from the reader. */ | |
1179 | DemodReset(); | |
1180 | } | |
46734099 | 1181 | ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF); |
aeadbdb2 | 1182 | } |
15c4dc5a | 1183 | |
5b95953d | 1184 | if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time |
46734099 | 1185 | if(Handle14443bSamplesDemod(ci | 0x01, cq | 0x01)) { |
15c4dc5a | 1186 | |
5b95953d | 1187 | //Use samples as a time measurement |
1188 | if(tracing) | |
1189 | { | |
1190 | uint8_t parity[MAX_PARITY_SIZE]; | |
09c66f1f | 1191 | LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE); |
5b95953d | 1192 | } |
1193 | triggered = TRUE; | |
15c4dc5a | 1194 | |
5b95953d | 1195 | // And ready to receive another response. |
1196 | DemodReset(); | |
1197 | } | |
d5875804 | 1198 | TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF); |
aeadbdb2 | 1199 | } |
15c4dc5a | 1200 | |
7d5ebac9 | 1201 | } |
51d4f6f1 | 1202 | |
aeadbdb2 | 1203 | FpgaDisableSscDma(); |
51d4f6f1 | 1204 | LEDsoff(); |
aeadbdb2 | 1205 | AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; |
15c4dc5a | 1206 | DbpString("Snoop statistics:"); |
355c8b4a | 1207 | Dbprintf(" Max behind by: %i", maxBehindBy); |
15c4dc5a | 1208 | Dbprintf(" Uart State: %x", Uart.state); |
1209 | Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt); | |
1210 | Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax); | |
3000dc4e | 1211 | Dbprintf(" Trace length: %i", BigBuf_get_traceLen()); |
15c4dc5a | 1212 | } |
7cf3ef20 | 1213 | |
67ac4bf7 | 1214 | |
7cf3ef20 | 1215 | /* |
1216 | * Send raw command to tag ISO14443B | |
1217 | * @Input | |
1218 | * datalen len of buffer data | |
1219 | * recv bool when true wait for data from tag and send to client | |
1220 | * powerfield bool leave the field on when true | |
1221 | * data buffer with byte to send | |
1222 | * | |
1223 | * @Output | |
1224 | * none | |
1225 | * | |
1226 | */ | |
67ac4bf7 | 1227 | void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[]) |
7cf3ef20 | 1228 | { |
7d5ebac9 | 1229 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
51d4f6f1 | 1230 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
1231 | FpgaSetupSsc(); | |
5f605b8f | 1232 | |
9d84e689 | 1233 | if (datalen){ |
1234 | set_tracing(TRUE); | |
1235 | ||
1236 | CodeAndTransmit14443bAsReader(data, datalen); | |
1237 | ||
1238 | if(recv) { | |
1239 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); | |
1240 | uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE); | |
1241 | cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen); | |
1242 | } | |
1243 | } | |
355c8b4a | 1244 | |
51d4f6f1 | 1245 | if(!powerfield) { |
7d5ebac9 MHS |
1246 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
1247 | LED_D_OFF(); | |
1248 | } | |
7cf3ef20 | 1249 | } |
1250 |