]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/iso14443a.c
Increased Mifare Esave & Eload filename array to 255 from 20
[proxmark3-svn] / armsrc / iso14443a.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
b62a5a84 2// Merlok - June 2011, 2012
15c4dc5a 3// Gerhard de Koning Gans - May 2008
534983d7 4// Hagen Fritsch - June 2010
bd20f8f4 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
15c4dc5a 9//-----------------------------------------------------------------------------
bd20f8f4 10// Routines to support ISO 14443 type A.
11//-----------------------------------------------------------------------------
12
e30c654b 13#include "proxmark3.h"
15c4dc5a 14#include "apps.h"
f7e3ed82 15#include "util.h"
9ab7a6c7 16#include "string.h"
902cb3c0 17#include "cmd.h"
9ab7a6c7 18
15c4dc5a 19#include "iso14443crc.h"
534983d7 20#include "iso14443a.h"
20f9a2a1
M
21#include "crapto1.h"
22#include "mifareutil.h"
15c4dc5a 23
534983d7 24static uint32_t iso14a_timeout;
d19929cb 25uint8_t *trace = (uint8_t *) BigBuf+TRACE_OFFSET;
1e262141 26int rsamples = 0;
7bc95e2e 27int traceLen = 0;
1e262141 28int tracing = TRUE;
29uint8_t trigger = 0;
b0127e65 30// the block number for the ISO14443-4 PCB
31static uint8_t iso14_pcb_blocknum = 0;
15c4dc5a 32
7bc95e2e 33//
34// ISO14443 timing:
35//
36// minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
37#define REQUEST_GUARD_TIME (7000/16 + 1)
38// minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
39#define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
40// bool LastCommandWasRequest = FALSE;
41
42//
43// Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
44//
d714d3ef 45// When the PM acts as reader and is receiving tag data, it takes
46// 3 ticks delay in the AD converter
47// 16 ticks until the modulation detector completes and sets curbit
48// 8 ticks until bit_to_arm is assigned from curbit
49// 8*16 ticks for the transfer from FPGA to ARM
7bc95e2e 50// 4*16 ticks until we measure the time
51// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 52#define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
7bc95e2e 53
54// When the PM acts as a reader and is sending, it takes
55// 4*16 ticks until we can write data to the sending hold register
56// 8*16 ticks until the SHR is transferred to the Sending Shift Register
57// 8 ticks until the first transfer starts
58// 8 ticks later the FPGA samples the data
59// 1 tick to assign mod_sig_coil
60#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
61
62// When the PM acts as tag and is receiving it takes
d714d3ef 63// 2 ticks delay in the RF part (for the first falling edge),
7bc95e2e 64// 3 ticks for the A/D conversion,
65// 8 ticks on average until the start of the SSC transfer,
66// 8 ticks until the SSC samples the first data
67// 7*16 ticks to complete the transfer from FPGA to ARM
68// 8 ticks until the next ssp_clk rising edge
d714d3ef 69// 4*16 ticks until we measure the time
7bc95e2e 70// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 71#define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
7bc95e2e 72
73// The FPGA will report its internal sending delay in
74uint16_t FpgaSendQueueDelay;
75// the 5 first bits are the number of bits buffered in mod_sig_buf
76// the last three bits are the remaining ticks/2 after the mod_sig_buf shift
77#define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
78
79// When the PM acts as tag and is sending, it takes
d714d3ef 80// 4*16 ticks until we can write data to the sending hold register
7bc95e2e 81// 8*16 ticks until the SHR is transferred to the Sending Shift Register
82// 8 ticks until the first transfer starts
83// 8 ticks later the FPGA samples the data
84// + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
85// + 1 tick to assign mod_sig_coil
d714d3ef 86#define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
7bc95e2e 87
88// When the PM acts as sniffer and is receiving tag data, it takes
89// 3 ticks A/D conversion
d714d3ef 90// 14 ticks to complete the modulation detection
91// 8 ticks (on average) until the result is stored in to_arm
7bc95e2e 92// + the delays in transferring data - which is the same for
93// sniffing reader and tag data and therefore not relevant
d714d3ef 94#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
7bc95e2e 95
d714d3ef 96// When the PM acts as sniffer and is receiving reader data, it takes
97// 2 ticks delay in analogue RF receiver (for the falling edge of the
98// start bit, which marks the start of the communication)
7bc95e2e 99// 3 ticks A/D conversion
d714d3ef 100// 8 ticks on average until the data is stored in to_arm.
7bc95e2e 101// + the delays in transferring data - which is the same for
102// sniffing reader and tag data and therefore not relevant
d714d3ef 103#define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
7bc95e2e 104
105//variables used for timing purposes:
106//these are in ssp_clk cycles:
107uint32_t NextTransferTime;
108uint32_t LastTimeProxToAirStart;
109uint32_t LastProxToAirDuration;
110
111
112
8f51ddb0 113// CARD TO READER - manchester
72934aa3 114// Sequence D: 11110000 modulation with subcarrier during first half
115// Sequence E: 00001111 modulation with subcarrier during second half
116// Sequence F: 00000000 no modulation with subcarrier
8f51ddb0 117// READER TO CARD - miller
72934aa3 118// Sequence X: 00001100 drop after half a period
119// Sequence Y: 00000000 no drop
120// Sequence Z: 11000000 drop at start
121#define SEC_D 0xf0
122#define SEC_E 0x0f
123#define SEC_F 0x00
124#define SEC_X 0x0c
125#define SEC_Y 0x00
126#define SEC_Z 0xc0
15c4dc5a 127
1e262141 128const uint8_t OddByteParity[256] = {
15c4dc5a 129 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
130 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
131 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
132 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
138 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
139 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
140 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
141 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
142 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
143 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
144 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
145};
146
1e262141 147
902cb3c0 148void iso14a_set_trigger(bool enable) {
534983d7 149 trigger = enable;
150}
151
902cb3c0 152void iso14a_clear_trace() {
7bc95e2e 153 memset(trace, 0x44, TRACE_SIZE);
8556b852
M
154 traceLen = 0;
155}
d19929cb 156
902cb3c0 157void iso14a_set_tracing(bool enable) {
8556b852
M
158 tracing = enable;
159}
d19929cb 160
b0127e65 161void iso14a_set_timeout(uint32_t timeout) {
162 iso14a_timeout = timeout;
163}
8556b852 164
15c4dc5a 165//-----------------------------------------------------------------------------
166// Generate the parity value for a byte sequence
e30c654b 167//
15c4dc5a 168//-----------------------------------------------------------------------------
20f9a2a1
M
169byte_t oddparity (const byte_t bt)
170{
5f6d6c90 171 return OddByteParity[bt];
20f9a2a1
M
172}
173
f7e3ed82 174uint32_t GetParity(const uint8_t * pbtCmd, int iLen)
15c4dc5a 175{
5f6d6c90 176 int i;
177 uint32_t dwPar = 0;
72934aa3 178
e691fc45 179 // Generate the parity bits
5f6d6c90 180 for (i = 0; i < iLen; i++) {
e691fc45 181 // and save them to a 32Bit word
5f6d6c90 182 dwPar |= ((OddByteParity[pbtCmd[i]]) << i);
183 }
184 return dwPar;
15c4dc5a 185}
186
534983d7 187void AppendCrc14443a(uint8_t* data, int len)
15c4dc5a 188{
5f6d6c90 189 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
15c4dc5a 190}
191
1e262141 192// The function LogTrace() is also used by the iClass implementation in iClass.c
17cba269 193bool RAMFUNC LogTrace(const uint8_t * btBytes, uint8_t iLen, uint32_t timestamp, uint32_t dwParity, bool readerToTag)
15c4dc5a 194{
fdcd43eb 195 if (!tracing) return FALSE;
7bc95e2e 196 // Return when trace is full
197 if (traceLen + sizeof(timestamp) + sizeof(dwParity) + iLen >= TRACE_SIZE) {
198 tracing = FALSE; // don't trace any more
199 return FALSE;
200 }
201
202 // Trace the random, i'm curious
203 trace[traceLen++] = ((timestamp >> 0) & 0xff);
204 trace[traceLen++] = ((timestamp >> 8) & 0xff);
205 trace[traceLen++] = ((timestamp >> 16) & 0xff);
206 trace[traceLen++] = ((timestamp >> 24) & 0xff);
17cba269
MHS
207
208 if (!readerToTag) {
7bc95e2e 209 trace[traceLen - 1] |= 0x80;
210 }
211 trace[traceLen++] = ((dwParity >> 0) & 0xff);
212 trace[traceLen++] = ((dwParity >> 8) & 0xff);
213 trace[traceLen++] = ((dwParity >> 16) & 0xff);
214 trace[traceLen++] = ((dwParity >> 24) & 0xff);
215 trace[traceLen++] = iLen;
216 if (btBytes != NULL && iLen != 0) {
217 memcpy(trace + traceLen, btBytes, iLen);
218 }
219 traceLen += iLen;
220 return TRUE;
15c4dc5a 221}
222
7bc95e2e 223//=============================================================================
224// ISO 14443 Type A - Miller decoder
225//=============================================================================
226// Basics:
227// This decoder is used when the PM3 acts as a tag.
228// The reader will generate "pauses" by temporarily switching of the field.
229// At the PM3 antenna we will therefore measure a modulated antenna voltage.
230// The FPGA does a comparison with a threshold and would deliver e.g.:
231// ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
232// The Miller decoder needs to identify the following sequences:
233// 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
234// 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
235// 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
236// Note 1: the bitstream may start at any time. We therefore need to sync.
237// Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
15c4dc5a 238//-----------------------------------------------------------------------------
b62a5a84 239static tUart Uart;
15c4dc5a 240
d7aa3739 241// Lookup-Table to decide if 4 raw bits are a modulation.
242// We accept two or three consecutive "0" in any position with the rest "1"
243const bool Mod_Miller_LUT[] = {
244 TRUE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, FALSE,
245 TRUE, TRUE, FALSE, FALSE, TRUE, FALSE, FALSE, FALSE
246};
247#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x00F0) >> 4])
248#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x000F)])
249
7bc95e2e 250void UartReset()
15c4dc5a 251{
7bc95e2e 252 Uart.state = STATE_UNSYNCD;
253 Uart.bitCount = 0;
254 Uart.len = 0; // number of decoded data bytes
255 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
256 Uart.parityBits = 0; //
257 Uart.twoBits = 0x0000; // buffer for 2 Bits
258 Uart.highCnt = 0;
259 Uart.startTime = 0;
260 Uart.endTime = 0;
261}
15c4dc5a 262
d714d3ef 263
7bc95e2e 264// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
265static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
266{
15c4dc5a 267
7bc95e2e 268 Uart.twoBits = (Uart.twoBits << 8) | bit;
269
270 if (Uart.state == STATE_UNSYNCD) { // not yet synced
271 if (Uart.highCnt < 7) { // wait for a stable unmodulated signal
272 if (Uart.twoBits == 0xffff) {
273 Uart.highCnt++;
274 } else {
275 Uart.highCnt = 0;
15c4dc5a 276 }
7bc95e2e 277 } else {
278 Uart.syncBit = 0xFFFF; // not set
279 // look for 00xx1111 (the start bit)
280 if ((Uart.twoBits & 0x6780) == 0x0780) Uart.syncBit = 7;
281 else if ((Uart.twoBits & 0x33C0) == 0x03C0) Uart.syncBit = 6;
282 else if ((Uart.twoBits & 0x19E0) == 0x01E0) Uart.syncBit = 5;
283 else if ((Uart.twoBits & 0x0CF0) == 0x00F0) Uart.syncBit = 4;
284 else if ((Uart.twoBits & 0x0678) == 0x0078) Uart.syncBit = 3;
285 else if ((Uart.twoBits & 0x033C) == 0x003C) Uart.syncBit = 2;
286 else if ((Uart.twoBits & 0x019E) == 0x001E) Uart.syncBit = 1;
287 else if ((Uart.twoBits & 0x00CF) == 0x000F) Uart.syncBit = 0;
288 if (Uart.syncBit != 0xFFFF) {
289 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
290 Uart.startTime -= Uart.syncBit;
d7aa3739 291 Uart.endTime = Uart.startTime;
7bc95e2e 292 Uart.state = STATE_START_OF_COMMUNICATION;
15c4dc5a 293 }
7bc95e2e 294 }
15c4dc5a 295
7bc95e2e 296 } else {
15c4dc5a 297
d7aa3739 298 if (IsMillerModulationNibble1(Uart.twoBits >> Uart.syncBit)) {
299 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation in both halves - error
300 UartReset();
301 Uart.highCnt = 6;
302 } else { // Modulation in first half = Sequence Z = logic "0"
7bc95e2e 303 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
304 UartReset();
305 Uart.highCnt = 6;
306 } else {
307 Uart.bitCount++;
308 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
309 Uart.state = STATE_MILLER_Z;
310 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
311 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
312 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
313 Uart.parityBits <<= 1; // make room for the parity bit
314 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
315 Uart.bitCount = 0;
316 Uart.shiftReg = 0;
15c4dc5a 317 }
7bc95e2e 318 }
d7aa3739 319 }
320 } else {
321 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
7bc95e2e 322 Uart.bitCount++;
323 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
324 Uart.state = STATE_MILLER_X;
325 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
326 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
327 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
328 Uart.parityBits <<= 1; // make room for the new parity bit
329 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
330 Uart.bitCount = 0;
331 Uart.shiftReg = 0;
332 }
d7aa3739 333 } else { // no modulation in both halves - Sequence Y
7bc95e2e 334 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
15c4dc5a 335 Uart.state = STATE_UNSYNCD;
7bc95e2e 336 if(Uart.len == 0 && Uart.bitCount > 0) { // if we decoded some bits
337 Uart.shiftReg >>= (9 - Uart.bitCount); // add them to the output
338 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
339 Uart.parityBits <<= 1; // no parity bit - add "0"
d7aa3739 340 Uart.bitCount--; // last "0" was part of the EOC sequence
7bc95e2e 341 }
15c4dc5a 342 return TRUE;
343 }
7bc95e2e 344 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
345 UartReset();
346 Uart.highCnt = 6;
347 } else { // a logic "0"
348 Uart.bitCount++;
349 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
350 Uart.state = STATE_MILLER_Y;
351 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
352 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
353 Uart.parityBits <<= 1; // make room for the parity bit
354 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
355 Uart.bitCount = 0;
356 Uart.shiftReg = 0;
15c4dc5a 357 }
358 }
d7aa3739 359 }
15c4dc5a 360 }
7bc95e2e 361
362 }
15c4dc5a 363
7bc95e2e 364 return FALSE; // not finished yet, need more data
15c4dc5a 365}
366
7bc95e2e 367
368
15c4dc5a 369//=============================================================================
e691fc45 370// ISO 14443 Type A - Manchester decoder
15c4dc5a 371//=============================================================================
e691fc45 372// Basics:
7bc95e2e 373// This decoder is used when the PM3 acts as a reader.
e691fc45 374// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
375// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
376// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
377// The Manchester decoder needs to identify the following sequences:
378// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
379// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
380// 8 ticks unmodulated: Sequence F = end of communication
381// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
7bc95e2e 382// Note 1: the bitstream may start at any time. We therefore need to sync.
e691fc45 383// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
b62a5a84 384static tDemod Demod;
15c4dc5a 385
d7aa3739 386// Lookup-Table to decide if 4 raw bits are a modulation.
d714d3ef 387// We accept three or four "1" in any position
7bc95e2e 388const bool Mod_Manchester_LUT[] = {
d7aa3739 389 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
d714d3ef 390 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
7bc95e2e 391};
392
393#define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
394#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
15c4dc5a 395
2f2d9fc5 396
7bc95e2e 397void DemodReset()
e691fc45 398{
7bc95e2e 399 Demod.state = DEMOD_UNSYNCD;
400 Demod.len = 0; // number of decoded data bytes
401 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
402 Demod.parityBits = 0; //
403 Demod.collisionPos = 0; // Position of collision bit
404 Demod.twoBits = 0xffff; // buffer for 2 Bits
405 Demod.highCnt = 0;
406 Demod.startTime = 0;
407 Demod.endTime = 0;
e691fc45 408}
15c4dc5a 409
7bc95e2e 410// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
411static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
e691fc45 412{
7bc95e2e 413
414 Demod.twoBits = (Demod.twoBits << 8) | bit;
e691fc45 415
7bc95e2e 416 if (Demod.state == DEMOD_UNSYNCD) {
417
418 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
419 if (Demod.twoBits == 0x0000) {
420 Demod.highCnt++;
421 } else {
422 Demod.highCnt = 0;
423 }
424 } else {
425 Demod.syncBit = 0xFFFF; // not set
426 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
427 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
428 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
429 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
430 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
431 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
432 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
433 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
d7aa3739 434 if (Demod.syncBit != 0xFFFF) {
7bc95e2e 435 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
436 Demod.startTime -= Demod.syncBit;
437 Demod.bitCount = offset; // number of decoded data bits
e691fc45 438 Demod.state = DEMOD_MANCHESTER_DATA;
2f2d9fc5 439 }
7bc95e2e 440 }
15c4dc5a 441
7bc95e2e 442 } else {
15c4dc5a 443
7bc95e2e 444 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
445 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
e691fc45 446 if (!Demod.collisionPos) {
447 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
448 }
449 } // modulation in first half only - Sequence D = 1
7bc95e2e 450 Demod.bitCount++;
451 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
452 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
e691fc45 453 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 454 Demod.parityBits <<= 1; // make room for the parity bit
e691fc45 455 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
456 Demod.bitCount = 0;
457 Demod.shiftReg = 0;
15c4dc5a 458 }
7bc95e2e 459 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
460 } else { // no modulation in first half
461 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
e691fc45 462 Demod.bitCount++;
7bc95e2e 463 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
e691fc45 464 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
e691fc45 465 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 466 Demod.parityBits <<= 1; // make room for the new parity bit
e691fc45 467 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
468 Demod.bitCount = 0;
469 Demod.shiftReg = 0;
15c4dc5a 470 }
7bc95e2e 471 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
e691fc45 472 } else { // no modulation in both halves - End of communication
d7aa3739 473 if (Demod.len > 0 || Demod.bitCount > 0) { // received something
474 if(Demod.bitCount > 0) { // if we decoded bits
475 Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
476 Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
477 // No parity bit, so just shift a 0
478 Demod.parityBits <<= 1;
479 }
480 return TRUE; // we are finished with decoding the raw data sequence
481 } else { // nothing received. Start over
482 DemodReset();
e691fc45 483 }
15c4dc5a 484 }
7bc95e2e 485 }
e691fc45 486
487 }
15c4dc5a 488
e691fc45 489 return FALSE; // not finished yet, need more data
15c4dc5a 490}
491
492//=============================================================================
493// Finally, a `sniffer' for ISO 14443 Type A
494// Both sides of communication!
495//=============================================================================
496
497//-----------------------------------------------------------------------------
498// Record the sequence of commands sent by the reader to the tag, with
499// triggering so that we start recording at the point that the tag is moved
500// near the reader.
501//-----------------------------------------------------------------------------
5cd9ec01
M
502void RAMFUNC SnoopIso14443a(uint8_t param) {
503 // param:
504 // bit 0 - trigger from first card answer
505 // bit 1 - trigger from first reader 7-bit request
506
507 LEDsoff();
508 // init trace buffer
5f6d6c90 509 iso14a_clear_trace();
5cd9ec01
M
510
511 // We won't start recording the frames that we acquire until we trigger;
512 // a good trigger condition to get started is probably when we see a
513 // response from the tag.
514 // triggered == FALSE -- to wait first for card
7bc95e2e 515 bool triggered = !(param & 0x03);
516
5cd9ec01 517 // The command (reader -> tag) that we're receiving.
15c4dc5a 518 // The length of a received command will in most cases be no more than 18 bytes.
519 // So 32 should be enough!
5cd9ec01
M
520 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
521 // The response (tag -> reader) that we're receiving.
522 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
15c4dc5a 523
5cd9ec01
M
524 // As we receive stuff, we copy it from receivedCmd or receivedResponse
525 // into trace, along with its length and other annotations.
526 //uint8_t *trace = (uint8_t *)BigBuf;
527
528 // The DMA buffer, used to stream samples from the FPGA
7bc95e2e 529 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
530 uint8_t *data = dmaBuf;
531 uint8_t previous_data = 0;
5cd9ec01
M
532 int maxDataLen = 0;
533 int dataLen = 0;
7bc95e2e 534 bool TagIsActive = FALSE;
535 bool ReaderIsActive = FALSE;
536
537 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
15c4dc5a 538
5cd9ec01
M
539 // Set up the demodulator for tag -> reader responses.
540 Demod.output = receivedResponse;
15c4dc5a 541
5cd9ec01 542 // Set up the demodulator for the reader -> tag commands
5cd9ec01 543 Uart.output = receivedCmd;
15c4dc5a 544
7bc95e2e 545 // Setup and start DMA.
5cd9ec01 546 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
7bc95e2e 547
5cd9ec01 548 // And now we loop, receiving samples.
7bc95e2e 549 for(uint32_t rsamples = 0; TRUE; ) {
550
5cd9ec01
M
551 if(BUTTON_PRESS()) {
552 DbpString("cancelled by button");
7bc95e2e 553 break;
5cd9ec01 554 }
15c4dc5a 555
5cd9ec01
M
556 LED_A_ON();
557 WDT_HIT();
15c4dc5a 558
5cd9ec01
M
559 int register readBufDataP = data - dmaBuf;
560 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
561 if (readBufDataP <= dmaBufDataP){
562 dataLen = dmaBufDataP - readBufDataP;
563 } else {
7bc95e2e 564 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
5cd9ec01
M
565 }
566 // test for length of buffer
567 if(dataLen > maxDataLen) {
568 maxDataLen = dataLen;
569 if(dataLen > 400) {
7bc95e2e 570 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
571 break;
5cd9ec01
M
572 }
573 }
574 if(dataLen < 1) continue;
575
576 // primary buffer was stopped( <-- we lost data!
577 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
578 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
579 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
7bc95e2e 580 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
581 }
582 // secondary buffer sets as primary, secondary buffer was stopped
583 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
584 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
585 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
586 }
587
588 LED_A_OFF();
7bc95e2e 589
590 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
3be2a5ae 591
7bc95e2e 592 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
593 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
594 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
595 LED_C_ON();
5cd9ec01 596
7bc95e2e 597 // check - if there is a short 7bit request from reader
598 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
5cd9ec01 599
7bc95e2e 600 if(triggered) {
601 if (!LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, Uart.parityBits, TRUE)) break;
602 if (!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
603 }
604 /* And ready to receive another command. */
605 UartReset();
606 /* And also reset the demod code, which might have been */
607 /* false-triggered by the commands from the reader. */
608 DemodReset();
609 LED_B_OFF();
610 }
611 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
5cd9ec01 612 }
3be2a5ae 613
7bc95e2e 614 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
615 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
616 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
617 LED_B_ON();
5cd9ec01 618
7bc95e2e 619 if (!LogTrace(receivedResponse, Demod.len, Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, Demod.parityBits, FALSE)) break;
620 if (!LogTrace(NULL, 0, Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, 0, FALSE)) break;
5cd9ec01 621
7bc95e2e 622 if ((!triggered) && (param & 0x01)) triggered = TRUE;
5cd9ec01 623
7bc95e2e 624 // And ready to receive another response.
625 DemodReset();
626 LED_C_OFF();
627 }
628 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
629 }
5cd9ec01
M
630 }
631
7bc95e2e 632 previous_data = *data;
633 rsamples++;
5cd9ec01 634 data++;
d714d3ef 635 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01
M
636 data = dmaBuf;
637 }
638 } // main cycle
639
640 DbpString("COMMAND FINISHED");
15c4dc5a 641
7bc95e2e 642 FpgaDisableSscDma();
643 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
644 Dbprintf("traceLen=%d, Uart.output[0]=%08x", traceLen, (uint32_t)Uart.output[0]);
5cd9ec01 645 LEDsoff();
15c4dc5a 646}
647
15c4dc5a 648//-----------------------------------------------------------------------------
649// Prepare tag messages
650//-----------------------------------------------------------------------------
8f51ddb0 651static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity)
15c4dc5a 652{
8f51ddb0 653 int i;
15c4dc5a 654
8f51ddb0 655 ToSendReset();
15c4dc5a 656
657 // Correction bit, might be removed when not needed
658 ToSendStuffBit(0);
659 ToSendStuffBit(0);
660 ToSendStuffBit(0);
661 ToSendStuffBit(0);
662 ToSendStuffBit(1); // 1
663 ToSendStuffBit(0);
664 ToSendStuffBit(0);
665 ToSendStuffBit(0);
8f51ddb0 666
15c4dc5a 667 // Send startbit
72934aa3 668 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 669 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 670
8f51ddb0
M
671 for(i = 0; i < len; i++) {
672 int j;
673 uint8_t b = cmd[i];
15c4dc5a 674
675 // Data bits
15c4dc5a 676 for(j = 0; j < 8; j++) {
15c4dc5a 677 if(b & 1) {
72934aa3 678 ToSend[++ToSendMax] = SEC_D;
15c4dc5a 679 } else {
72934aa3 680 ToSend[++ToSendMax] = SEC_E;
8f51ddb0
M
681 }
682 b >>= 1;
683 }
15c4dc5a 684
0014cb46 685 // Get the parity bit
8f51ddb0
M
686 if ((dwParity >> i) & 0x01) {
687 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 688 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 689 } else {
72934aa3 690 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 691 LastProxToAirDuration = 8 * ToSendMax;
15c4dc5a 692 }
8f51ddb0 693 }
15c4dc5a 694
8f51ddb0
M
695 // Send stopbit
696 ToSend[++ToSendMax] = SEC_F;
15c4dc5a 697
8f51ddb0
M
698 // Convert from last byte pos to length
699 ToSendMax++;
8f51ddb0
M
700}
701
702static void CodeIso14443aAsTag(const uint8_t *cmd, int len){
703 CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len));
15c4dc5a 704}
705
15c4dc5a 706
8f51ddb0
M
707static void Code4bitAnswerAsTag(uint8_t cmd)
708{
709 int i;
710
5f6d6c90 711 ToSendReset();
8f51ddb0
M
712
713 // Correction bit, might be removed when not needed
714 ToSendStuffBit(0);
715 ToSendStuffBit(0);
716 ToSendStuffBit(0);
717 ToSendStuffBit(0);
718 ToSendStuffBit(1); // 1
719 ToSendStuffBit(0);
720 ToSendStuffBit(0);
721 ToSendStuffBit(0);
722
723 // Send startbit
724 ToSend[++ToSendMax] = SEC_D;
725
726 uint8_t b = cmd;
727 for(i = 0; i < 4; i++) {
728 if(b & 1) {
729 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 730 LastProxToAirDuration = 8 * ToSendMax - 4;
8f51ddb0
M
731 } else {
732 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 733 LastProxToAirDuration = 8 * ToSendMax;
8f51ddb0
M
734 }
735 b >>= 1;
736 }
737
738 // Send stopbit
739 ToSend[++ToSendMax] = SEC_F;
740
5f6d6c90 741 // Convert from last byte pos to length
742 ToSendMax++;
15c4dc5a 743}
744
745//-----------------------------------------------------------------------------
746// Wait for commands from reader
747// Stop when button is pressed
748// Or return TRUE when command is captured
749//-----------------------------------------------------------------------------
f7e3ed82 750static int GetIso14443aCommandFromReader(uint8_t *received, int *len, int maxLen)
15c4dc5a 751{
752 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
753 // only, since we are receiving, not transmitting).
754 // Signal field is off with the appropriate LED
755 LED_D_OFF();
756 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
757
758 // Now run a `software UART' on the stream of incoming samples.
7bc95e2e 759 UartReset();
15c4dc5a 760 Uart.output = received;
7bc95e2e 761
762 // clear RXRDY:
763 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 764
765 for(;;) {
766 WDT_HIT();
767
768 if(BUTTON_PRESS()) return FALSE;
7bc95e2e 769
15c4dc5a 770 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
7bc95e2e 771 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
772 if(MillerDecoding(b, 0)) {
773 *len = Uart.len;
15c4dc5a 774 return TRUE;
775 }
7bc95e2e 776 }
15c4dc5a 777 }
778}
28afbd2b 779
7bc95e2e 780static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded);
781int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
28afbd2b 782int EmSend4bit(uint8_t resp);
7bc95e2e 783int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
784int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
785int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded);
28afbd2b 786int EmSendCmd(uint8_t *resp, int respLen);
787int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par);
7bc95e2e 788bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
789 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity);
15c4dc5a 790
ce02f6f9 791static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
792
793typedef struct {
794 uint8_t* response;
795 size_t response_n;
796 uint8_t* modulation;
797 size_t modulation_n;
7bc95e2e 798 uint32_t ProxToAirDuration;
ce02f6f9 799} tag_response_info_t;
800
801void reset_free_buffer() {
802 free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
803}
804
805bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
7bc95e2e 806 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
ce02f6f9 807 // This will need the following byte array for a modulation sequence
808 // 144 data bits (18 * 8)
809 // 18 parity bits
810 // 2 Start and stop
811 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
812 // 1 just for the case
813 // ----------- +
814 // 166 bytes, since every bit that needs to be send costs us a byte
815 //
816
817 // Prepare the tag modulation bits from the message
818 CodeIso14443aAsTag(response_info->response,response_info->response_n);
819
820 // Make sure we do not exceed the free buffer space
821 if (ToSendMax > max_buffer_size) {
822 Dbprintf("Out of memory, when modulating bits for tag answer:");
823 Dbhexdump(response_info->response_n,response_info->response,false);
824 return false;
825 }
826
827 // Copy the byte array, used for this modulation to the buffer position
828 memcpy(response_info->modulation,ToSend,ToSendMax);
829
7bc95e2e 830 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
ce02f6f9 831 response_info->modulation_n = ToSendMax;
7bc95e2e 832 response_info->ProxToAirDuration = LastProxToAirDuration;
ce02f6f9 833
834 return true;
835}
836
837bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
838 // Retrieve and store the current buffer index
839 response_info->modulation = free_buffer_pointer;
840
841 // Determine the maximum size we can use from our buffer
842 size_t max_buffer_size = (((uint8_t *)BigBuf)+FREE_BUFFER_OFFSET+FREE_BUFFER_SIZE)-free_buffer_pointer;
843
844 // Forward the prepare tag modulation function to the inner function
845 if (prepare_tag_modulation(response_info,max_buffer_size)) {
846 // Update the free buffer offset
847 free_buffer_pointer += ToSendMax;
848 return true;
849 } else {
850 return false;
851 }
852}
853
15c4dc5a 854//-----------------------------------------------------------------------------
855// Main loop of simulated tag: receive commands from reader, decide what
856// response to send, and send it.
857//-----------------------------------------------------------------------------
28afbd2b 858void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
15c4dc5a 859{
5f6d6c90 860 // Enable and clear the trace
5f6d6c90 861 iso14a_clear_trace();
7bc95e2e 862 iso14a_set_tracing(TRUE);
81cd0474 863
81cd0474 864 uint8_t sak;
865
866 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
867 uint8_t response1[2];
868
869 switch (tagType) {
870 case 1: { // MIFARE Classic
871 // Says: I am Mifare 1k - original line
872 response1[0] = 0x04;
873 response1[1] = 0x00;
874 sak = 0x08;
875 } break;
876 case 2: { // MIFARE Ultralight
877 // Says: I am a stupid memory tag, no crypto
878 response1[0] = 0x04;
879 response1[1] = 0x00;
880 sak = 0x00;
881 } break;
882 case 3: { // MIFARE DESFire
883 // Says: I am a DESFire tag, ph33r me
884 response1[0] = 0x04;
885 response1[1] = 0x03;
886 sak = 0x20;
887 } break;
888 case 4: { // ISO/IEC 14443-4
889 // Says: I am a javacard (JCOP)
890 response1[0] = 0x04;
891 response1[1] = 0x00;
892 sak = 0x28;
893 } break;
894 default: {
895 Dbprintf("Error: unkown tagtype (%d)",tagType);
896 return;
897 } break;
898 }
899
900 // The second response contains the (mandatory) first 24 bits of the UID
901 uint8_t response2[5];
902
903 // Check if the uid uses the (optional) part
904 uint8_t response2a[5];
905 if (uid_2nd) {
906 response2[0] = 0x88;
907 num_to_bytes(uid_1st,3,response2+1);
908 num_to_bytes(uid_2nd,4,response2a);
909 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
910
911 // Configure the ATQA and SAK accordingly
912 response1[0] |= 0x40;
913 sak |= 0x04;
914 } else {
915 num_to_bytes(uid_1st,4,response2);
916 // Configure the ATQA and SAK accordingly
917 response1[0] &= 0xBF;
918 sak &= 0xFB;
919 }
920
921 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
922 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
923
924 // Prepare the mandatory SAK (for 4 and 7 byte UID)
925 uint8_t response3[3];
926 response3[0] = sak;
927 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
928
929 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
930 uint8_t response3a[3];
931 response3a[0] = sak & 0xFB;
932 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
933
254b70a4 934 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
ce02f6f9 935 uint8_t response6[] = { 0x04, 0x58, 0x00, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS
936 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
937
7bc95e2e 938 #define TAG_RESPONSE_COUNT 7
939 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
940 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
941 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
942 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
943 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
944 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
945 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
946 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
947 };
948
949 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
950 // Such a response is less time critical, so we can prepare them on the fly
951 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
952 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
953 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
954 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
955 tag_response_info_t dynamic_response_info = {
956 .response = dynamic_response_buffer,
957 .response_n = 0,
958 .modulation = dynamic_modulation_buffer,
959 .modulation_n = 0
960 };
ce02f6f9 961
7bc95e2e 962 // Reset the offset pointer of the free buffer
963 reset_free_buffer();
ce02f6f9 964
7bc95e2e 965 // Prepare the responses of the anticollision phase
ce02f6f9 966 // there will be not enough time to do this at the moment the reader sends it REQA
7bc95e2e 967 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
968 prepare_allocated_tag_modulation(&responses[i]);
969 }
15c4dc5a 970
254b70a4 971 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
7bc95e2e 972 int len = 0;
15c4dc5a 973
974 // To control where we are in the protocol
975 int order = 0;
976 int lastorder;
977
978 // Just to allow some checks
979 int happened = 0;
980 int happened2 = 0;
81cd0474 981 int cmdsRecvd = 0;
15c4dc5a 982
254b70a4 983 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 984 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
15c4dc5a 985
254b70a4 986 cmdsRecvd = 0;
7bc95e2e 987 tag_response_info_t* p_response;
15c4dc5a 988
254b70a4 989 LED_A_ON();
990 for(;;) {
7bc95e2e 991 // Clean receive command buffer
992
81cd0474 993 if(!GetIso14443aCommandFromReader(receivedCmd, &len, RECV_CMD_SIZE)) {
ce02f6f9 994 DbpString("Button press");
254b70a4 995 break;
996 }
7bc95e2e 997
998 p_response = NULL;
999
254b70a4 1000 // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
1001 // Okay, look at the command now.
1002 lastorder = order;
1003 if(receivedCmd[0] == 0x26) { // Received a REQUEST
ce02f6f9 1004 p_response = &responses[0]; order = 1;
254b70a4 1005 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
ce02f6f9 1006 p_response = &responses[0]; order = 6;
254b70a4 1007 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
ce02f6f9 1008 p_response = &responses[1]; order = 2;
254b70a4 1009 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
ce02f6f9 1010 p_response = &responses[2]; order = 20;
254b70a4 1011 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
ce02f6f9 1012 p_response = &responses[3]; order = 3;
254b70a4 1013 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
ce02f6f9 1014 p_response = &responses[4]; order = 30;
254b70a4 1015 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
5f6d6c90 1016 EmSendCmdEx(data+(4*receivedCmd[0]),16,false);
7bc95e2e 1017 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
5f6d6c90 1018 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
7bc95e2e 1019 p_response = NULL;
254b70a4 1020 } else if(receivedCmd[0] == 0x50) { // Received a HALT
17331e14 1021// DbpString("Reader requested we HALT!:");
7bc95e2e 1022 if (tracing) {
1023 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1024 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1025 }
1026 p_response = NULL;
254b70a4 1027 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
ce02f6f9 1028 p_response = &responses[5]; order = 7;
254b70a4 1029 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
7bc95e2e 1030 if (tagType == 1 || tagType == 2) { // RATS not supported
1031 EmSend4bit(CARD_NACK_NA);
1032 p_response = NULL;
1033 } else {
1034 p_response = &responses[6]; order = 70;
1035 }
1036 } else if (order == 7 && len == 8) { // Received authentication request
1037 if (tracing) {
1038 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1039 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1040 }
1041 uint32_t nr = bytes_to_num(receivedCmd,4);
1042 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1043 Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr,ar);
1044 } else {
1045 // Check for ISO 14443A-4 compliant commands, look at left nibble
1046 switch (receivedCmd[0]) {
1047
1048 case 0x0B:
1049 case 0x0A: { // IBlock (command)
1050 dynamic_response_info.response[0] = receivedCmd[0];
1051 dynamic_response_info.response[1] = 0x00;
1052 dynamic_response_info.response[2] = 0x90;
1053 dynamic_response_info.response[3] = 0x00;
1054 dynamic_response_info.response_n = 4;
1055 } break;
1056
1057 case 0x1A:
1058 case 0x1B: { // Chaining command
1059 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1060 dynamic_response_info.response_n = 2;
1061 } break;
1062
1063 case 0xaa:
1064 case 0xbb: {
1065 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1066 dynamic_response_info.response_n = 2;
1067 } break;
1068
1069 case 0xBA: { //
1070 memcpy(dynamic_response_info.response,"\xAB\x00",2);
1071 dynamic_response_info.response_n = 2;
1072 } break;
1073
1074 case 0xCA:
1075 case 0xC2: { // Readers sends deselect command
1076 memcpy(dynamic_response_info.response,"\xCA\x00",2);
1077 dynamic_response_info.response_n = 2;
1078 } break;
1079
1080 default: {
1081 // Never seen this command before
1082 if (tracing) {
1083 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1084 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1085 }
1086 Dbprintf("Received unknown command (len=%d):",len);
1087 Dbhexdump(len,receivedCmd,false);
1088 // Do not respond
1089 dynamic_response_info.response_n = 0;
1090 } break;
1091 }
ce02f6f9 1092
7bc95e2e 1093 if (dynamic_response_info.response_n > 0) {
1094 // Copy the CID from the reader query
1095 dynamic_response_info.response[1] = receivedCmd[1];
ce02f6f9 1096
7bc95e2e 1097 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1098 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1099 dynamic_response_info.response_n += 2;
ce02f6f9 1100
7bc95e2e 1101 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1102 Dbprintf("Error preparing tag response");
1103 if (tracing) {
1104 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1105 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1106 }
1107 break;
1108 }
1109 p_response = &dynamic_response_info;
1110 }
81cd0474 1111 }
15c4dc5a 1112
1113 // Count number of wakeups received after a halt
1114 if(order == 6 && lastorder == 5) { happened++; }
1115
1116 // Count number of other messages after a halt
1117 if(order != 6 && lastorder == 5) { happened2++; }
1118
15c4dc5a 1119 if(cmdsRecvd > 999) {
1120 DbpString("1000 commands later...");
254b70a4 1121 break;
15c4dc5a 1122 }
ce02f6f9 1123 cmdsRecvd++;
1124
1125 if (p_response != NULL) {
7bc95e2e 1126 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1127 // do the tracing for the previous reader request and this tag answer:
1128 EmLogTrace(Uart.output,
1129 Uart.len,
1130 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1131 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1132 Uart.parityBits,
1133 p_response->response,
1134 p_response->response_n,
1135 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1136 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1137 SwapBits(GetParity(p_response->response, p_response->response_n), p_response->response_n));
1138 }
1139
1140 if (!tracing) {
1141 Dbprintf("Trace Full. Simulation stopped.");
1142 break;
1143 }
1144 }
15c4dc5a 1145
1146 Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
1147 LED_A_OFF();
1148}
1149
9492e0b0 1150
1151// prepare a delayed transfer. This simply shifts ToSend[] by a number
1152// of bits specified in the delay parameter.
1153void PrepareDelayedTransfer(uint16_t delay)
1154{
1155 uint8_t bitmask = 0;
1156 uint8_t bits_to_shift = 0;
1157 uint8_t bits_shifted = 0;
1158
1159 delay &= 0x07;
1160 if (delay) {
1161 for (uint16_t i = 0; i < delay; i++) {
1162 bitmask |= (0x01 << i);
1163 }
7bc95e2e 1164 ToSend[ToSendMax++] = 0x00;
9492e0b0 1165 for (uint16_t i = 0; i < ToSendMax; i++) {
1166 bits_to_shift = ToSend[i] & bitmask;
1167 ToSend[i] = ToSend[i] >> delay;
1168 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1169 bits_shifted = bits_to_shift;
1170 }
1171 }
1172}
1173
7bc95e2e 1174
1175//-------------------------------------------------------------------------------------
15c4dc5a 1176// Transmit the command (to the tag) that was placed in ToSend[].
9492e0b0 1177// Parameter timing:
7bc95e2e 1178// if NULL: transfer at next possible time, taking into account
1179// request guard time and frame delay time
1180// if == 0: transfer immediately and return time of transfer
9492e0b0 1181// if != 0: delay transfer until time specified
7bc95e2e 1182//-------------------------------------------------------------------------------------
9492e0b0 1183static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
15c4dc5a 1184{
7bc95e2e 1185
9492e0b0 1186 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
e30c654b 1187
7bc95e2e 1188 uint32_t ThisTransferTime = 0;
e30c654b 1189
9492e0b0 1190 if (timing) {
1191 if(*timing == 0) { // Measure time
7bc95e2e 1192 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
9492e0b0 1193 } else {
1194 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1195 }
7bc95e2e 1196 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1197 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1198 LastTimeProxToAirStart = *timing;
1199 } else {
1200 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1201 while(GetCountSspClk() < ThisTransferTime);
1202 LastTimeProxToAirStart = ThisTransferTime;
9492e0b0 1203 }
1204
7bc95e2e 1205 // clear TXRDY
1206 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1207
1208 // for(uint16_t c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission)
1209 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1210 // AT91C_BASE_SSC->SSC_THR = SEC_Y;
1211 // c++;
1212 // }
1213 // }
1214
1215 uint16_t c = 0;
9492e0b0 1216 for(;;) {
1217 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1218 AT91C_BASE_SSC->SSC_THR = cmd[c];
1219 c++;
1220 if(c >= len) {
1221 break;
1222 }
1223 }
1224 }
7bc95e2e 1225
1226 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
1227
15c4dc5a 1228}
1229
7bc95e2e 1230
15c4dc5a 1231//-----------------------------------------------------------------------------
195af472 1232// Prepare reader command (in bits, support short frames) to send to FPGA
15c4dc5a 1233//-----------------------------------------------------------------------------
195af472 1234void CodeIso14443aBitsAsReaderPar(const uint8_t * cmd, int bits, uint32_t dwParity)
15c4dc5a 1235{
7bc95e2e 1236 int i, j;
1237 int last;
1238 uint8_t b;
e30c654b 1239
7bc95e2e 1240 ToSendReset();
e30c654b 1241
7bc95e2e 1242 // Start of Communication (Seq. Z)
1243 ToSend[++ToSendMax] = SEC_Z;
1244 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1245 last = 0;
1246
1247 size_t bytecount = nbytes(bits);
1248 // Generate send structure for the data bits
1249 for (i = 0; i < bytecount; i++) {
1250 // Get the current byte to send
1251 b = cmd[i];
1252 size_t bitsleft = MIN((bits-(i*8)),8);
1253
1254 for (j = 0; j < bitsleft; j++) {
1255 if (b & 1) {
1256 // Sequence X
1257 ToSend[++ToSendMax] = SEC_X;
1258 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1259 last = 1;
1260 } else {
1261 if (last == 0) {
1262 // Sequence Z
1263 ToSend[++ToSendMax] = SEC_Z;
1264 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1265 } else {
1266 // Sequence Y
1267 ToSend[++ToSendMax] = SEC_Y;
1268 last = 0;
1269 }
1270 }
1271 b >>= 1;
1272 }
1273
1274 // Only transmit (last) parity bit if we transmitted a complete byte
1275 if (j == 8) {
1276 // Get the parity bit
1277 if ((dwParity >> i) & 0x01) {
1278 // Sequence X
1279 ToSend[++ToSendMax] = SEC_X;
1280 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1281 last = 1;
1282 } else {
1283 if (last == 0) {
1284 // Sequence Z
1285 ToSend[++ToSendMax] = SEC_Z;
1286 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1287 } else {
1288 // Sequence Y
1289 ToSend[++ToSendMax] = SEC_Y;
1290 last = 0;
1291 }
1292 }
1293 }
1294 }
e30c654b 1295
7bc95e2e 1296 // End of Communication: Logic 0 followed by Sequence Y
1297 if (last == 0) {
1298 // Sequence Z
1299 ToSend[++ToSendMax] = SEC_Z;
1300 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1301 } else {
1302 // Sequence Y
1303 ToSend[++ToSendMax] = SEC_Y;
1304 last = 0;
1305 }
1306 ToSend[++ToSendMax] = SEC_Y;
e30c654b 1307
7bc95e2e 1308 // Convert to length of command:
1309 ToSendMax++;
15c4dc5a 1310}
1311
195af472 1312//-----------------------------------------------------------------------------
1313// Prepare reader command to send to FPGA
1314//-----------------------------------------------------------------------------
1315void CodeIso14443aAsReaderPar(const uint8_t * cmd, int len, uint32_t dwParity)
1316{
1317 CodeIso14443aBitsAsReaderPar(cmd,len*8,dwParity);
1318}
1319
9ca155ba
M
1320//-----------------------------------------------------------------------------
1321// Wait for commands from reader
1322// Stop when button is pressed (return 1) or field was gone (return 2)
1323// Or return 0 when command is captured
1324//-----------------------------------------------------------------------------
7bc95e2e 1325static int EmGetCmd(uint8_t *received, int *len)
9ca155ba
M
1326{
1327 *len = 0;
1328
1329 uint32_t timer = 0, vtime = 0;
1330 int analogCnt = 0;
1331 int analogAVG = 0;
1332
1333 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1334 // only, since we are receiving, not transmitting).
1335 // Signal field is off with the appropriate LED
1336 LED_D_OFF();
1337 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1338
1339 // Set ADC to read field strength
1340 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1341 AT91C_BASE_ADC->ADC_MR =
1342 ADC_MODE_PRESCALE(32) |
1343 ADC_MODE_STARTUP_TIME(16) |
1344 ADC_MODE_SAMPLE_HOLD_TIME(8);
1345 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1346 // start ADC
1347 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1348
1349 // Now run a 'software UART' on the stream of incoming samples.
7bc95e2e 1350 UartReset();
9ca155ba 1351 Uart.output = received;
7bc95e2e 1352
1353 // Clear RXRDY:
1354 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba
M
1355
1356 for(;;) {
1357 WDT_HIT();
1358
1359 if (BUTTON_PRESS()) return 1;
1360
1361 // test if the field exists
1362 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1363 analogCnt++;
1364 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1365 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1366 if (analogCnt >= 32) {
1367 if ((33000 * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1368 vtime = GetTickCount();
1369 if (!timer) timer = vtime;
1370 // 50ms no field --> card to idle state
1371 if (vtime - timer > 50) return 2;
1372 } else
1373 if (timer) timer = 0;
1374 analogCnt = 0;
1375 analogAVG = 0;
1376 }
1377 }
7bc95e2e 1378
9ca155ba 1379 // receive and test the miller decoding
7bc95e2e 1380 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1381 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1382 if(MillerDecoding(b, 0)) {
1383 *len = Uart.len;
9ca155ba
M
1384 return 0;
1385 }
7bc95e2e 1386 }
1387
9ca155ba
M
1388 }
1389}
1390
9ca155ba 1391
7bc95e2e 1392static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded)
1393{
1394 uint8_t b;
1395 uint16_t i = 0;
1396 uint32_t ThisTransferTime;
1397
9ca155ba
M
1398 // Modulate Manchester
1399 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
7bc95e2e 1400
1401 // include correction bit if necessary
1402 if (Uart.parityBits & 0x01) {
1403 correctionNeeded = TRUE;
1404 }
1405 if(correctionNeeded) {
9ca155ba
M
1406 // 1236, so correction bit needed
1407 i = 0;
7bc95e2e 1408 } else {
1409 i = 1;
9ca155ba 1410 }
7bc95e2e 1411
d714d3ef 1412 // clear receiving shift register and holding register
7bc95e2e 1413 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1414 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1415 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1416 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
9ca155ba 1417
7bc95e2e 1418 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1419 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1420 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1421 if (AT91C_BASE_SSC->SSC_RHR) break;
1422 }
1423
1424 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1425
1426 // Clear TXRDY:
1427 AT91C_BASE_SSC->SSC_THR = SEC_F;
1428
9ca155ba 1429 // send cycle
7bc95e2e 1430 for(; i <= respLen; ) {
9ca155ba 1431 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
7bc95e2e 1432 AT91C_BASE_SSC->SSC_THR = resp[i++];
1433 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba 1434 }
7bc95e2e 1435
9ca155ba
M
1436 if(BUTTON_PRESS()) {
1437 break;
1438 }
1439 }
1440
7bc95e2e 1441 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1442 for (i = 0; i < 2 ; ) {
1443 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1444 AT91C_BASE_SSC->SSC_THR = SEC_F;
1445 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1446 i++;
1447 }
1448 }
1449
1450 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1451
9ca155ba
M
1452 return 0;
1453}
1454
7bc95e2e 1455int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1456 Code4bitAnswerAsTag(resp);
0a39986e 1457 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1458 // do the tracing for the previous reader request and this tag answer:
1459 EmLogTrace(Uart.output,
1460 Uart.len,
1461 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1462 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1463 Uart.parityBits,
1464 &resp,
1465 1,
1466 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1467 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1468 SwapBits(GetParity(&resp, 1), 1));
0a39986e 1469 return res;
9ca155ba
M
1470}
1471
8f51ddb0 1472int EmSend4bit(uint8_t resp){
7bc95e2e 1473 return EmSend4bitEx(resp, false);
8f51ddb0
M
1474}
1475
7bc95e2e 1476int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par){
1477 CodeIso14443aAsTagPar(resp, respLen, par);
8f51ddb0 1478 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1479 // do the tracing for the previous reader request and this tag answer:
1480 EmLogTrace(Uart.output,
1481 Uart.len,
1482 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1483 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1484 Uart.parityBits,
1485 resp,
1486 respLen,
1487 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1488 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1489 SwapBits(GetParity(resp, respLen), respLen));
8f51ddb0
M
1490 return res;
1491}
1492
7bc95e2e 1493int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded){
8f51ddb0
M
1494 return EmSendCmdExPar(resp, respLen, correctionNeeded, GetParity(resp, respLen));
1495}
1496
1497int EmSendCmd(uint8_t *resp, int respLen){
7bc95e2e 1498 return EmSendCmdExPar(resp, respLen, false, GetParity(resp, respLen));
8f51ddb0
M
1499}
1500
1501int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
7bc95e2e 1502 return EmSendCmdExPar(resp, respLen, false, par);
1503}
1504
1505bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
1506 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity)
1507{
1508 if (tracing) {
1509 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1510 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1511 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1512 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1513 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1514 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1515 reader_EndTime = tag_StartTime - exact_fdt;
1516 reader_StartTime = reader_EndTime - reader_modlen;
1517 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_Parity, TRUE)) {
1518 return FALSE;
1519 } else if (!LogTrace(NULL, 0, reader_EndTime, 0, TRUE)) {
1520 return FALSE;
1521 } else if (!LogTrace(tag_data, tag_len, tag_StartTime, tag_Parity, FALSE)) {
1522 return FALSE;
1523 } else {
1524 return (!LogTrace(NULL, 0, tag_EndTime, 0, FALSE));
1525 }
1526 } else {
1527 return TRUE;
1528 }
9ca155ba
M
1529}
1530
15c4dc5a 1531//-----------------------------------------------------------------------------
1532// Wait a certain time for tag response
1533// If a response is captured return TRUE
e691fc45 1534// If it takes too long return FALSE
15c4dc5a 1535//-----------------------------------------------------------------------------
7bc95e2e 1536static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen)
15c4dc5a 1537{
7bc95e2e 1538 uint16_t c;
e691fc45 1539
15c4dc5a 1540 // Set FPGA mode to "reader listen mode", no modulation (listen
534983d7 1541 // only, since we are receiving, not transmitting).
1542 // Signal field is on with the appropriate LED
1543 LED_D_ON();
1544 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1c611bbd 1545
534983d7 1546 // Now get the answer from the card
7bc95e2e 1547 DemodReset();
534983d7 1548 Demod.output = receivedResponse;
15c4dc5a 1549
7bc95e2e 1550 // clear RXRDY:
1551 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1552
15c4dc5a 1553 c = 0;
1554 for(;;) {
534983d7 1555 WDT_HIT();
15c4dc5a 1556
534983d7 1557 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
534983d7 1558 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
7bc95e2e 1559 if(ManchesterDecoding(b, offset, 0)) {
1560 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
15c4dc5a 1561 return TRUE;
7bc95e2e 1562 } else if(c++ > iso14a_timeout) {
1563 return FALSE;
15c4dc5a 1564 }
534983d7 1565 }
1566 }
15c4dc5a 1567}
1568
9492e0b0 1569void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing)
15c4dc5a 1570{
981bd429 1571
7bc95e2e 1572 CodeIso14443aBitsAsReaderPar(frame,bits,par);
dfc3c505 1573
7bc95e2e 1574 // Send command to tag
1575 TransmitFor14443a(ToSend, ToSendMax, timing);
1576 if(trigger)
1577 LED_A_ON();
dfc3c505 1578
7bc95e2e 1579 // Log reader command in trace buffer
1580 if (tracing) {
1581 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1582 LogTrace(NULL, 0, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, 0, TRUE);
1583 }
15c4dc5a 1584}
1585
9492e0b0 1586void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing)
dfc3c505 1587{
9492e0b0 1588 ReaderTransmitBitsPar(frame,len*8,par, timing);
dfc3c505 1589}
15c4dc5a 1590
e691fc45 1591void ReaderTransmitBits(uint8_t* frame, int len, uint32_t *timing)
1592{
1593 // Generate parity and redirect
1594 ReaderTransmitBitsPar(frame,len,GetParity(frame,len/8), timing);
1595}
1596
9492e0b0 1597void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing)
15c4dc5a 1598{
1599 // Generate parity and redirect
9492e0b0 1600 ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing);
15c4dc5a 1601}
1602
e691fc45 1603int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
1604{
7bc95e2e 1605 if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160)) return FALSE;
1606 if (tracing) {
1607 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
1608 LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
1609 }
e691fc45 1610 return Demod.len;
1611}
1612
f7e3ed82 1613int ReaderReceive(uint8_t* receivedAnswer)
15c4dc5a 1614{
e691fc45 1615 return ReaderReceiveOffset(receivedAnswer, 0);
15c4dc5a 1616}
1617
e691fc45 1618int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
f89c7050 1619{
7bc95e2e 1620 if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160)) return FALSE;
1621 if (tracing) {
1622 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
1623 LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
1624 }
f89c7050 1625 *parptr = Demod.parityBits;
e691fc45 1626 return Demod.len;
f89c7050
M
1627}
1628
e691fc45 1629/* performs iso14443a anticollision procedure
534983d7 1630 * fills the uid pointer unless NULL
1631 * fills resp_data unless NULL */
79a73ab2 1632int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) {
ed258538 1633 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1634 uint8_t sel_all[] = { 0x93,0x20 };
e691fc45 1635 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
ed258538 1636 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1637 uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes
79a73ab2 1638 byte_t uid_resp[4];
1639 size_t uid_resp_len;
15c4dc5a 1640
ed258538 1641 uint8_t sak = 0x04; // cascade uid
1642 int cascade_level = 0;
1643 int len;
79a73ab2 1644
ed258538 1645 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
9492e0b0 1646 ReaderTransmitBitsPar(wupa,7,0, NULL);
7bc95e2e 1647
ed258538 1648 // Receive the ATQA
1649 if(!ReaderReceive(resp)) return 0;
e691fc45 1650 // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
1c611bbd 1651
ed258538 1652 if(p_hi14a_card) {
1653 memcpy(p_hi14a_card->atqa, resp, 2);
79a73ab2 1654 p_hi14a_card->uidlen = 0;
1655 memset(p_hi14a_card->uid,0,10);
1656 }
5f6d6c90 1657
79a73ab2 1658 // clear uid
1659 if (uid_ptr) {
1c611bbd 1660 memset(uid_ptr,0,10);
79a73ab2 1661 }
1662
ed258538 1663 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1664 // which case we need to make a cascade 2 request and select - this is a long UID
1665 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1666 for(; sak & 0x04; cascade_level++) {
1667 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1668 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1669
1670 // SELECT_ALL
9492e0b0 1671 ReaderTransmit(sel_all,sizeof(sel_all), NULL);
ed258538 1672 if (!ReaderReceive(resp)) return 0;
5f6d6c90 1673
e691fc45 1674 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1675 memset(uid_resp, 0, 4);
1676 uint16_t uid_resp_bits = 0;
1677 uint16_t collision_answer_offset = 0;
1678 // anti-collision-loop:
1679 while (Demod.collisionPos) {
1680 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1681 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1682 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1683 uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8);
1684 }
1685 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1686 uid_resp_bits++;
1687 // construct anticollosion command:
1688 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1689 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1690 sel_uid[2+i] = uid_resp[i];
1691 }
1692 collision_answer_offset = uid_resp_bits%8;
1693 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1694 if (!ReaderReceiveOffset(resp, collision_answer_offset)) return 0;
1695 }
1696 // finally, add the last bits and BCC of the UID
1697 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1698 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1699 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1700 }
1701
1702 } else { // no collision, use the response to SELECT_ALL as current uid
1703 memcpy(uid_resp,resp,4);
1704 }
1705 uid_resp_len = 4;
7bc95e2e 1706 // Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
5f6d6c90 1707
e691fc45 1708 // calculate crypto UID. Always use last 4 Bytes.
5f6d6c90 1709 if(cuid_ptr) {
1710 *cuid_ptr = bytes_to_num(uid_resp, 4);
79a73ab2 1711 }
e30c654b 1712
ed258538 1713 // Construct SELECT UID command
e691fc45 1714 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1715 memcpy(sel_uid+2,uid_resp,4); // the UID
1716 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1717 AppendCrc14443a(sel_uid,7); // calculate and add CRC
9492e0b0 1718 ReaderTransmit(sel_uid,sizeof(sel_uid), NULL);
534983d7 1719
ed258538 1720 // Receive the SAK
1721 if (!ReaderReceive(resp)) return 0;
1722 sak = resp[0];
79a73ab2 1723
1724 // Test if more parts of the uid are comming
e691fc45 1725 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
79a73ab2 1726 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1727 // http://www.nxp.com/documents/application_note/AN10927.pdf
ed258538 1728 memcpy(uid_resp, uid_resp + 1, 3);
79a73ab2 1729 uid_resp_len = 3;
1730 }
5f6d6c90 1731
79a73ab2 1732 if(uid_ptr) {
1733 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
1734 }
5f6d6c90 1735
79a73ab2 1736 if(p_hi14a_card) {
1737 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
1738 p_hi14a_card->uidlen += uid_resp_len;
1739 }
ed258538 1740 }
79a73ab2 1741
ed258538 1742 if(p_hi14a_card) {
1743 p_hi14a_card->sak = sak;
1744 p_hi14a_card->ats_len = 0;
1745 }
534983d7 1746
ed258538 1747 if( (sak & 0x20) == 0) {
1748 return 2; // non iso14443a compliant tag
79a73ab2 1749 }
534983d7 1750
ed258538 1751 // Request for answer to select
5191b3d1 1752 AppendCrc14443a(rats, 2);
9492e0b0 1753 ReaderTransmit(rats, sizeof(rats), NULL);
1c611bbd 1754
5191b3d1 1755 if (!(len = ReaderReceive(resp))) return 0;
1756
1757 if(p_hi14a_card) {
ed258538 1758 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
1759 p_hi14a_card->ats_len = len;
1760 }
5f6d6c90 1761
ed258538 1762 // reset the PCB block number
1763 iso14_pcb_blocknum = 0;
1764 return 1;
7e758047 1765}
15c4dc5a 1766
7bc95e2e 1767void iso14443a_setup(uint8_t fpga_minor_mode) {
7cc204bf 1768 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9492e0b0 1769 // Set up the synchronous serial port
1770 FpgaSetupSsc();
7bc95e2e 1771 // connect Demodulated Signal to ADC:
7e758047 1772 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
e30c654b 1773
7e758047 1774 // Signal field is on with the appropriate LED
7bc95e2e 1775 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
1776 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
1777 LED_D_ON();
1778 } else {
1779 LED_D_OFF();
1780 }
1781 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
534983d7 1782
7bc95e2e 1783 // Start the timer
1784 StartCountSspClk();
1785
1786 DemodReset();
1787 UartReset();
1788 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
1789 iso14a_set_timeout(1050); // 10ms default
7e758047 1790}
15c4dc5a 1791
534983d7 1792int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) {
1793 uint8_t real_cmd[cmd_len+4];
1794 real_cmd[0] = 0x0a; //I-Block
b0127e65 1795 // put block number into the PCB
1796 real_cmd[0] |= iso14_pcb_blocknum;
534983d7 1797 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
1798 memcpy(real_cmd+2, cmd, cmd_len);
1799 AppendCrc14443a(real_cmd,cmd_len+2);
1800
9492e0b0 1801 ReaderTransmit(real_cmd, cmd_len+4, NULL);
534983d7 1802 size_t len = ReaderReceive(data);
b0127e65 1803 uint8_t * data_bytes = (uint8_t *) data;
1804 if (!len)
1805 return 0; //DATA LINK ERROR
1806 // if we received an I- or R(ACK)-Block with a block number equal to the
1807 // current block number, toggle the current block number
1808 else if (len >= 4 // PCB+CID+CRC = 4 bytes
1809 && ((data_bytes[0] & 0xC0) == 0 // I-Block
1810 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1811 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
1812 {
1813 iso14_pcb_blocknum ^= 1;
1814 }
1815
534983d7 1816 return len;
1817}
1818
7e758047 1819//-----------------------------------------------------------------------------
1820// Read an ISO 14443a tag. Send out commands and store answers.
1821//
1822//-----------------------------------------------------------------------------
7bc95e2e 1823void ReaderIso14443a(UsbCommand *c)
7e758047 1824{
534983d7 1825 iso14a_command_t param = c->arg[0];
7bc95e2e 1826 uint8_t *cmd = c->d.asBytes;
534983d7 1827 size_t len = c->arg[1];
5f6d6c90 1828 size_t lenbits = c->arg[2];
9492e0b0 1829 uint32_t arg0 = 0;
1830 byte_t buf[USB_CMD_DATA_SIZE];
902cb3c0 1831
5f6d6c90 1832 if(param & ISO14A_CONNECT) {
1833 iso14a_clear_trace();
1834 }
e691fc45 1835
7bc95e2e 1836 iso14a_set_tracing(TRUE);
e30c654b 1837
79a73ab2 1838 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 1839 iso14a_set_trigger(TRUE);
9492e0b0 1840 }
15c4dc5a 1841
534983d7 1842 if(param & ISO14A_CONNECT) {
7bc95e2e 1843 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
5f6d6c90 1844 if(!(param & ISO14A_NO_SELECT)) {
1845 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
1846 arg0 = iso14443a_select_card(NULL,card,NULL);
1847 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
1848 }
534983d7 1849 }
e30c654b 1850
534983d7 1851 if(param & ISO14A_SET_TIMEOUT) {
1852 iso14a_timeout = c->arg[2];
1853 }
e30c654b 1854
534983d7 1855 if(param & ISO14A_APDU) {
902cb3c0 1856 arg0 = iso14_apdu(cmd, len, buf);
79a73ab2 1857 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 1858 }
e30c654b 1859
534983d7 1860 if(param & ISO14A_RAW) {
1861 if(param & ISO14A_APPEND_CRC) {
1862 AppendCrc14443a(cmd,len);
1863 len += 2;
fdcd43eb 1864 lenbits += 16;
15c4dc5a 1865 }
5f6d6c90 1866 if(lenbits>0) {
fdcd43eb 1867
5f6d6c90 1868 ReaderTransmitBitsPar(cmd,lenbits,GetParity(cmd,lenbits/8), NULL);
1869 } else {
1870 ReaderTransmit(cmd,len, NULL);
1871 }
902cb3c0 1872 arg0 = ReaderReceive(buf);
9492e0b0 1873 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 1874 }
15c4dc5a 1875
79a73ab2 1876 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 1877 iso14a_set_trigger(FALSE);
9492e0b0 1878 }
15c4dc5a 1879
79a73ab2 1880 if(param & ISO14A_NO_DISCONNECT) {
534983d7 1881 return;
9492e0b0 1882 }
15c4dc5a 1883
15c4dc5a 1884 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1885 LEDsoff();
15c4dc5a 1886}
b0127e65 1887
1c611bbd 1888
1c611bbd 1889// Determine the distance between two nonces.
1890// Assume that the difference is small, but we don't know which is first.
1891// Therefore try in alternating directions.
1892int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
1893
1894 uint16_t i;
1895 uint32_t nttmp1, nttmp2;
e772353f 1896
1c611bbd 1897 if (nt1 == nt2) return 0;
1898
1899 nttmp1 = nt1;
1900 nttmp2 = nt2;
1901
1902 for (i = 1; i < 32768; i++) {
1903 nttmp1 = prng_successor(nttmp1, 1);
1904 if (nttmp1 == nt2) return i;
1905 nttmp2 = prng_successor(nttmp2, 1);
1906 if (nttmp2 == nt1) return -i;
1907 }
1908
1909 return(-99999); // either nt1 or nt2 are invalid nonces
e772353f 1910}
1911
e772353f 1912
1c611bbd 1913//-----------------------------------------------------------------------------
1914// Recover several bits of the cypher stream. This implements (first stages of)
1915// the algorithm described in "The Dark Side of Security by Obscurity and
1916// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
1917// (article by Nicolas T. Courtois, 2009)
1918//-----------------------------------------------------------------------------
1919void ReaderMifare(bool first_try)
1920{
1921 // Mifare AUTH
1922 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
1923 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
1924 static uint8_t mf_nr_ar3;
e772353f 1925
1c611bbd 1926 uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
7bc95e2e 1927
d2f487af 1928 iso14a_clear_trace();
7bc95e2e 1929 iso14a_set_tracing(TRUE);
e772353f 1930
1c611bbd 1931 byte_t nt_diff = 0;
1932 byte_t par = 0;
1933 //byte_t par_mask = 0xff;
1934 static byte_t par_low = 0;
1935 bool led_on = TRUE;
1936 uint8_t uid[10];
1937 uint32_t cuid;
e772353f 1938
1c611bbd 1939 uint32_t nt, previous_nt;
1940 static uint32_t nt_attacked = 0;
1941 byte_t par_list[8] = {0,0,0,0,0,0,0,0};
1942 byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
e772353f 1943
1c611bbd 1944 static uint32_t sync_time;
1945 static uint32_t sync_cycles;
1946 int catch_up_cycles = 0;
1947 int last_catch_up = 0;
1948 uint16_t consecutive_resyncs = 0;
1949 int isOK = 0;
e772353f 1950
e772353f 1951
e772353f 1952
1c611bbd 1953 if (first_try) {
1c611bbd 1954 mf_nr_ar3 = 0;
7bc95e2e 1955 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
1956 sync_time = GetCountSspClk() & 0xfffffff8;
1c611bbd 1957 sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
1958 nt_attacked = 0;
1959 nt = 0;
1960 par = 0;
1961 }
1962 else {
1963 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
1964 // nt_attacked = prng_successor(nt_attacked, 1);
1965 mf_nr_ar3++;
1966 mf_nr_ar[3] = mf_nr_ar3;
1967 par = par_low;
1968 }
e30c654b 1969
15c4dc5a 1970 LED_A_ON();
1971 LED_B_OFF();
1972 LED_C_OFF();
1c611bbd 1973
7bc95e2e 1974
1c611bbd 1975 for(uint16_t i = 0; TRUE; i++) {
1976
1977 WDT_HIT();
e30c654b 1978
1c611bbd 1979 // Test if the action was cancelled
1980 if(BUTTON_PRESS()) {
1981 break;
1982 }
1983
1984 LED_C_ON();
e30c654b 1985
1c611bbd 1986 if(!iso14443a_select_card(uid, NULL, &cuid)) {
9492e0b0 1987 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
1c611bbd 1988 continue;
1989 }
1990
9492e0b0 1991 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
1c611bbd 1992 catch_up_cycles = 0;
1993
1994 // if we missed the sync time already, advance to the next nonce repeat
7bc95e2e 1995 while(GetCountSspClk() > sync_time) {
9492e0b0 1996 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
1c611bbd 1997 }
e30c654b 1998
9492e0b0 1999 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2000 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
f89c7050 2001
1c611bbd 2002 // Receive the (4 Byte) "random" nonce
2003 if (!ReaderReceive(receivedAnswer)) {
9492e0b0 2004 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
1c611bbd 2005 continue;
2006 }
2007
1c611bbd 2008 previous_nt = nt;
2009 nt = bytes_to_num(receivedAnswer, 4);
2010
2011 // Transmit reader nonce with fake par
9492e0b0 2012 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
1c611bbd 2013
2014 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2015 int nt_distance = dist_nt(previous_nt, nt);
2016 if (nt_distance == 0) {
2017 nt_attacked = nt;
2018 }
2019 else {
2020 if (nt_distance == -99999) { // invalid nonce received, try again
2021 continue;
2022 }
2023 sync_cycles = (sync_cycles - nt_distance);
9492e0b0 2024 if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
1c611bbd 2025 continue;
2026 }
2027 }
2028
2029 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2030 catch_up_cycles = -dist_nt(nt_attacked, nt);
2031 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2032 catch_up_cycles = 0;
2033 continue;
2034 }
2035 if (catch_up_cycles == last_catch_up) {
2036 consecutive_resyncs++;
2037 }
2038 else {
2039 last_catch_up = catch_up_cycles;
2040 consecutive_resyncs = 0;
2041 }
2042 if (consecutive_resyncs < 3) {
9492e0b0 2043 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
1c611bbd 2044 }
2045 else {
2046 sync_cycles = sync_cycles + catch_up_cycles;
9492e0b0 2047 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
1c611bbd 2048 }
2049 continue;
2050 }
2051
2052 consecutive_resyncs = 0;
2053
2054 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2055 if (ReaderReceive(receivedAnswer))
2056 {
9492e0b0 2057 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
1c611bbd 2058
2059 if (nt_diff == 0)
2060 {
2061 par_low = par & 0x07; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2062 }
2063
2064 led_on = !led_on;
2065 if(led_on) LED_B_ON(); else LED_B_OFF();
2066
2067 par_list[nt_diff] = par;
2068 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2069
2070 // Test if the information is complete
2071 if (nt_diff == 0x07) {
2072 isOK = 1;
2073 break;
2074 }
2075
2076 nt_diff = (nt_diff + 1) & 0x07;
2077 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2078 par = par_low;
2079 } else {
2080 if (nt_diff == 0 && first_try)
2081 {
2082 par++;
2083 } else {
2084 par = (((par >> 3) + 1) << 3) | par_low;
2085 }
2086 }
2087 }
2088
1c611bbd 2089
2090 mf_nr_ar[3] &= 0x1F;
2091
2092 byte_t buf[28];
2093 memcpy(buf + 0, uid, 4);
2094 num_to_bytes(nt, 4, buf + 4);
2095 memcpy(buf + 8, par_list, 8);
2096 memcpy(buf + 16, ks_list, 8);
2097 memcpy(buf + 24, mf_nr_ar, 4);
2098
2099 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2100
2101 // Thats it...
2102 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2103 LEDsoff();
7bc95e2e 2104
2105 iso14a_set_tracing(FALSE);
20f9a2a1 2106}
1c611bbd 2107
d2f487af 2108/**
2109 *MIFARE 1K simulate.
2110 *
2111 *@param flags :
2112 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2113 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2114 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2115 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2116 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2117 */
2118void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
20f9a2a1 2119{
50193c1e 2120 int cardSTATE = MFEMUL_NOFIELD;
8556b852 2121 int _7BUID = 0;
9ca155ba 2122 int vHf = 0; // in mV
8f51ddb0 2123 int res;
0a39986e
M
2124 uint32_t selTimer = 0;
2125 uint32_t authTimer = 0;
2126 uint32_t par = 0;
9ca155ba 2127 int len = 0;
8f51ddb0 2128 uint8_t cardWRBL = 0;
9ca155ba
M
2129 uint8_t cardAUTHSC = 0;
2130 uint8_t cardAUTHKEY = 0xff; // no authentication
51969283 2131 uint32_t cardRr = 0;
9ca155ba 2132 uint32_t cuid = 0;
d2f487af 2133 //uint32_t rn_enc = 0;
51969283 2134 uint32_t ans = 0;
0014cb46
M
2135 uint32_t cardINTREG = 0;
2136 uint8_t cardINTBLOCK = 0;
9ca155ba
M
2137 struct Crypto1State mpcs = {0, 0};
2138 struct Crypto1State *pcs;
2139 pcs = &mpcs;
d2f487af 2140 uint32_t numReads = 0;//Counts numer of times reader read a block
8f51ddb0
M
2141 uint8_t* receivedCmd = eml_get_bigbufptr_recbuf();
2142 uint8_t *response = eml_get_bigbufptr_sendbuf();
9ca155ba 2143
d2f487af 2144 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2145 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2146 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2147 uint8_t rSAK[] = {0x08, 0xb6, 0xdd};
2148 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
9ca155ba 2149
d2f487af 2150 uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
2151 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
7bc95e2e 2152
d2f487af 2153 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2154 // This can be used in a reader-only attack.
2155 // (it can also be retrieved via 'hf 14a list', but hey...
2156 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0};
2157 uint8_t ar_nr_collected = 0;
0014cb46 2158
0a39986e 2159 // clear trace
7bc95e2e 2160 iso14a_clear_trace();
2161 iso14a_set_tracing(TRUE);
51969283 2162
7bc95e2e 2163 // Authenticate response - nonce
51969283 2164 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
7bc95e2e 2165
d2f487af 2166 //-- Determine the UID
2167 // Can be set from emulator memory, incoming data
2168 // and can be 7 or 4 bytes long
7bc95e2e 2169 if (flags & FLAG_4B_UID_IN_DATA)
d2f487af 2170 {
2171 // 4B uid comes from data-portion of packet
2172 memcpy(rUIDBCC1,datain,4);
8556b852 2173 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852 2174
7bc95e2e 2175 } else if (flags & FLAG_7B_UID_IN_DATA) {
d2f487af 2176 // 7B uid comes from data-portion of packet
2177 memcpy(&rUIDBCC1[1],datain,3);
2178 memcpy(rUIDBCC2, datain+3, 4);
2179 _7BUID = true;
7bc95e2e 2180 } else {
d2f487af 2181 // get UID from emul memory
2182 emlGetMemBt(receivedCmd, 7, 1);
2183 _7BUID = !(receivedCmd[0] == 0x00);
2184 if (!_7BUID) { // ---------- 4BUID
2185 emlGetMemBt(rUIDBCC1, 0, 4);
2186 } else { // ---------- 7BUID
2187 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2188 emlGetMemBt(rUIDBCC2, 3, 4);
2189 }
2190 }
7bc95e2e 2191
d2f487af 2192 /*
2193 * Regardless of what method was used to set the UID, set fifth byte and modify
2194 * the ATQA for 4 or 7-byte UID
2195 */
d2f487af 2196 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
7bc95e2e 2197 if (_7BUID) {
d2f487af 2198 rATQA[0] = 0x44;
8556b852 2199 rUIDBCC1[0] = 0x88;
8556b852
M
2200 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2201 }
2202
9ca155ba 2203 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 2204 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
9ca155ba 2205
9ca155ba 2206
d2f487af 2207 if (MF_DBGLEVEL >= 1) {
2208 if (!_7BUID) {
2209 Dbprintf("4B UID: %02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3]);
7bc95e2e 2210 } else {
d2f487af 2211 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3],rUIDBCC2[0],rUIDBCC2[1] ,rUIDBCC2[2] , rUIDBCC2[3]);
2212 }
2213 }
7bc95e2e 2214
2215 bool finished = FALSE;
d2f487af 2216 while (!BUTTON_PRESS() && !finished) {
9ca155ba 2217 WDT_HIT();
9ca155ba
M
2218
2219 // find reader field
2220 // Vref = 3300mV, and an 10:1 voltage divider on the input
2221 // can measure voltages up to 33000 mV
2222 if (cardSTATE == MFEMUL_NOFIELD) {
2223 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
2224 if (vHf > MF_MINFIELDV) {
0014cb46 2225 cardSTATE_TO_IDLE();
9ca155ba
M
2226 LED_A_ON();
2227 }
2228 }
d2f487af 2229 if(cardSTATE == MFEMUL_NOFIELD) continue;
9ca155ba 2230
d2f487af 2231 //Now, get data
2232
7bc95e2e 2233 res = EmGetCmd(receivedCmd, &len);
d2f487af 2234 if (res == 2) { //Field is off!
2235 cardSTATE = MFEMUL_NOFIELD;
2236 LEDsoff();
2237 continue;
7bc95e2e 2238 } else if (res == 1) {
2239 break; //return value 1 means button press
2240 }
2241
d2f487af 2242 // REQ or WUP request in ANY state and WUP in HALTED state
2243 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2244 selTimer = GetTickCount();
2245 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2246 cardSTATE = MFEMUL_SELECT1;
2247
2248 // init crypto block
2249 LED_B_OFF();
2250 LED_C_OFF();
2251 crypto1_destroy(pcs);
2252 cardAUTHKEY = 0xff;
2253 continue;
0a39986e 2254 }
7bc95e2e 2255
50193c1e 2256 switch (cardSTATE) {
d2f487af 2257 case MFEMUL_NOFIELD:
2258 case MFEMUL_HALTED:
50193c1e 2259 case MFEMUL_IDLE:{
7bc95e2e 2260 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2261 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
50193c1e
M
2262 break;
2263 }
2264 case MFEMUL_SELECT1:{
9ca155ba
M
2265 // select all
2266 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
d2f487af 2267 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
9ca155ba 2268 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
0014cb46 2269 break;
9ca155ba
M
2270 }
2271
d2f487af 2272 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2273 {
2274 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2275 }
9ca155ba 2276 // select card
0a39986e
M
2277 if (len == 9 &&
2278 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
7bc95e2e 2279 EmSendCmd(_7BUID?rSAK1:rSAK, sizeof(_7BUID?rSAK1:rSAK));
9ca155ba 2280 cuid = bytes_to_num(rUIDBCC1, 4);
8556b852
M
2281 if (!_7BUID) {
2282 cardSTATE = MFEMUL_WORK;
0014cb46
M
2283 LED_B_ON();
2284 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2285 break;
8556b852
M
2286 } else {
2287 cardSTATE = MFEMUL_SELECT2;
8556b852 2288 }
9ca155ba 2289 }
50193c1e
M
2290 break;
2291 }
d2f487af 2292 case MFEMUL_AUTH1:{
2293 if( len != 8)
2294 {
2295 cardSTATE_TO_IDLE();
7bc95e2e 2296 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2297 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
d2f487af 2298 break;
2299 }
2300 uint32_t ar = bytes_to_num(receivedCmd, 4);
2301 uint32_t nr= bytes_to_num(&receivedCmd[4], 4);
2302
2303 //Collect AR/NR
2304 if(ar_nr_collected < 2){
273b57a7 2305 if(ar_nr_responses[2] != ar)
2306 {// Avoid duplicates... probably not necessary, ar should vary.
d2f487af 2307 ar_nr_responses[ar_nr_collected*4] = cuid;
2308 ar_nr_responses[ar_nr_collected*4+1] = nonce;
2309 ar_nr_responses[ar_nr_collected*4+2] = ar;
2310 ar_nr_responses[ar_nr_collected*4+3] = nr;
273b57a7 2311 ar_nr_collected++;
d2f487af 2312 }
2313 }
2314
2315 // --- crypto
2316 crypto1_word(pcs, ar , 1);
2317 cardRr = nr ^ crypto1_word(pcs, 0, 0);
2318
2319 // test if auth OK
2320 if (cardRr != prng_successor(nonce, 64)){
2321 if (MF_DBGLEVEL >= 2) Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x",cardRr, prng_successor(nonce, 64));
7bc95e2e 2322 // Shouldn't we respond anything here?
d2f487af 2323 // Right now, we don't nack or anything, which causes the
2324 // reader to do a WUPA after a while. /Martin
2325 cardSTATE_TO_IDLE();
7bc95e2e 2326 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2327 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
d2f487af 2328 break;
2329 }
2330
2331 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2332
2333 num_to_bytes(ans, 4, rAUTH_AT);
2334 // --- crypto
2335 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2336 LED_C_ON();
2337 cardSTATE = MFEMUL_WORK;
2338 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED. sector=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer);
2339 break;
2340 }
50193c1e 2341 case MFEMUL_SELECT2:{
7bc95e2e 2342 if (!len) {
2343 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2344 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2345 break;
2346 }
8556b852 2347 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
9ca155ba 2348 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
8556b852
M
2349 break;
2350 }
9ca155ba 2351
8556b852
M
2352 // select 2 card
2353 if (len == 9 &&
2354 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2355 EmSendCmd(rSAK, sizeof(rSAK));
8556b852
M
2356 cuid = bytes_to_num(rUIDBCC2, 4);
2357 cardSTATE = MFEMUL_WORK;
2358 LED_B_ON();
0014cb46 2359 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
8556b852
M
2360 break;
2361 }
0014cb46
M
2362
2363 // i guess there is a command). go into the work state.
7bc95e2e 2364 if (len != 4) {
2365 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2366 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2367 break;
2368 }
0014cb46 2369 cardSTATE = MFEMUL_WORK;
d2f487af 2370 //goto lbWORK;
2371 //intentional fall-through to the next case-stmt
50193c1e 2372 }
51969283 2373
7bc95e2e 2374 case MFEMUL_WORK:{
2375 if (len == 0) {
2376 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2377 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2378 break;
2379 }
2380
d2f487af 2381 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2382
7bc95e2e 2383 if(encrypted_data) {
51969283
M
2384 // decrypt seqence
2385 mf_crypto1_decrypt(pcs, receivedCmd, len);
d2f487af 2386 }
7bc95e2e 2387
d2f487af 2388 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2389 authTimer = GetTickCount();
2390 cardAUTHSC = receivedCmd[1] / 4; // received block num
2391 cardAUTHKEY = receivedCmd[0] - 0x60;
2392 crypto1_destroy(pcs);//Added by martin
2393 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
51969283 2394
d2f487af 2395 if (!encrypted_data) { // first authentication
2396 if (MF_DBGLEVEL >= 2) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
51969283 2397
d2f487af 2398 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2399 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
7bc95e2e 2400 } else { // nested authentication
d2f487af 2401 if (MF_DBGLEVEL >= 2) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
7bc95e2e 2402 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
d2f487af 2403 num_to_bytes(ans, 4, rAUTH_AT);
2404 }
2405 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2406 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2407 cardSTATE = MFEMUL_AUTH1;
2408 break;
51969283 2409 }
7bc95e2e 2410
8f51ddb0
M
2411 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2412 // BUT... ACK --> NACK
2413 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2414 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2415 break;
2416 }
2417
2418 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2419 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2420 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2421 break;
0a39986e
M
2422 }
2423
7bc95e2e 2424 if(len != 4) {
2425 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2426 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2427 break;
2428 }
d2f487af 2429
2430 if(receivedCmd[0] == 0x30 // read block
2431 || receivedCmd[0] == 0xA0 // write block
2432 || receivedCmd[0] == 0xC0
2433 || receivedCmd[0] == 0xC1
2434 || receivedCmd[0] == 0xC2 // inc dec restore
7bc95e2e 2435 || receivedCmd[0] == 0xB0) { // transfer
2436 if (receivedCmd[1] >= 16 * 4) {
d2f487af 2437 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2438 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2439 break;
2440 }
2441
7bc95e2e 2442 if (receivedCmd[1] / 4 != cardAUTHSC) {
8f51ddb0 2443 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
d2f487af 2444 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
8f51ddb0
M
2445 break;
2446 }
d2f487af 2447 }
2448 // read block
2449 if (receivedCmd[0] == 0x30) {
2450 if (MF_DBGLEVEL >= 2) {
2451 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2452 }
8f51ddb0
M
2453 emlGetMem(response, receivedCmd[1], 1);
2454 AppendCrc14443a(response, 16);
2455 mf_crypto1_encrypt(pcs, response, 18, &par);
2456 EmSendCmdPar(response, 18, par);
d2f487af 2457 numReads++;
7bc95e2e 2458 if(exitAfterNReads > 0 && numReads == exitAfterNReads) {
d2f487af 2459 Dbprintf("%d reads done, exiting", numReads);
2460 finished = true;
2461 }
0a39986e
M
2462 break;
2463 }
0a39986e 2464 // write block
d2f487af 2465 if (receivedCmd[0] == 0xA0) {
2466 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
8f51ddb0 2467 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
8f51ddb0
M
2468 cardSTATE = MFEMUL_WRITEBL2;
2469 cardWRBL = receivedCmd[1];
0a39986e 2470 break;
7bc95e2e 2471 }
0014cb46 2472 // increment, decrement, restore
d2f487af 2473 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
2474 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2475 if (emlCheckValBl(receivedCmd[1])) {
2476 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
0014cb46
M
2477 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2478 break;
2479 }
2480 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2481 if (receivedCmd[0] == 0xC1)
2482 cardSTATE = MFEMUL_INTREG_INC;
2483 if (receivedCmd[0] == 0xC0)
2484 cardSTATE = MFEMUL_INTREG_DEC;
2485 if (receivedCmd[0] == 0xC2)
2486 cardSTATE = MFEMUL_INTREG_REST;
2487 cardWRBL = receivedCmd[1];
0014cb46
M
2488 break;
2489 }
0014cb46 2490 // transfer
d2f487af 2491 if (receivedCmd[0] == 0xB0) {
2492 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
0014cb46
M
2493 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2494 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2495 else
2496 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
0014cb46
M
2497 break;
2498 }
9ca155ba 2499 // halt
d2f487af 2500 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
9ca155ba 2501 LED_B_OFF();
0a39986e 2502 LED_C_OFF();
0014cb46
M
2503 cardSTATE = MFEMUL_HALTED;
2504 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
7bc95e2e 2505 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2506 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0a39986e 2507 break;
9ca155ba 2508 }
d2f487af 2509 // RATS
2510 if (receivedCmd[0] == 0xe0) {//RATS
8f51ddb0
M
2511 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2512 break;
2513 }
d2f487af 2514 // command not allowed
2515 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2516 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
51969283 2517 break;
8f51ddb0
M
2518 }
2519 case MFEMUL_WRITEBL2:{
2520 if (len == 18){
2521 mf_crypto1_decrypt(pcs, receivedCmd, len);
2522 emlSetMem(receivedCmd, cardWRBL, 1);
2523 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2524 cardSTATE = MFEMUL_WORK;
51969283 2525 } else {
0014cb46 2526 cardSTATE_TO_IDLE();
7bc95e2e 2527 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2528 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
8f51ddb0 2529 }
8f51ddb0 2530 break;
50193c1e 2531 }
0014cb46
M
2532
2533 case MFEMUL_INTREG_INC:{
2534 mf_crypto1_decrypt(pcs, receivedCmd, len);
2535 memcpy(&ans, receivedCmd, 4);
2536 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2537 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2538 cardSTATE_TO_IDLE();
2539 break;
7bc95e2e 2540 }
2541 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2542 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2543 cardINTREG = cardINTREG + ans;
2544 cardSTATE = MFEMUL_WORK;
2545 break;
2546 }
2547 case MFEMUL_INTREG_DEC:{
2548 mf_crypto1_decrypt(pcs, receivedCmd, len);
2549 memcpy(&ans, receivedCmd, 4);
2550 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2551 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2552 cardSTATE_TO_IDLE();
2553 break;
2554 }
7bc95e2e 2555 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2556 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2557 cardINTREG = cardINTREG - ans;
2558 cardSTATE = MFEMUL_WORK;
2559 break;
2560 }
2561 case MFEMUL_INTREG_REST:{
2562 mf_crypto1_decrypt(pcs, receivedCmd, len);
2563 memcpy(&ans, receivedCmd, 4);
2564 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2565 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2566 cardSTATE_TO_IDLE();
2567 break;
2568 }
7bc95e2e 2569 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2570 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2571 cardSTATE = MFEMUL_WORK;
2572 break;
2573 }
50193c1e 2574 }
50193c1e
M
2575 }
2576
9ca155ba
M
2577 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2578 LEDsoff();
2579
d2f487af 2580 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2581 {
2582 //May just aswell send the collected ar_nr in the response aswell
2583 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,0,0,&ar_nr_responses,ar_nr_collected*4*4);
2584 }
d714d3ef 2585
d2f487af 2586 if(flags & FLAG_NR_AR_ATTACK)
2587 {
7bc95e2e 2588 if(ar_nr_collected > 1) {
d2f487af 2589 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
d714d3ef 2590 Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
d2f487af 2591 ar_nr_responses[0], // UID
2592 ar_nr_responses[1], //NT
2593 ar_nr_responses[2], //AR1
2594 ar_nr_responses[3], //NR1
2595 ar_nr_responses[6], //AR2
2596 ar_nr_responses[7] //NR2
2597 );
7bc95e2e 2598 } else {
d2f487af 2599 Dbprintf("Failed to obtain two AR/NR pairs!");
7bc95e2e 2600 if(ar_nr_collected >0) {
d714d3ef 2601 Dbprintf("Only got these: UID=%08x, nonce=%08x, AR1=%08x, NR1=%08x",
d2f487af 2602 ar_nr_responses[0], // UID
2603 ar_nr_responses[1], //NT
2604 ar_nr_responses[2], //AR1
2605 ar_nr_responses[3] //NR1
2606 );
2607 }
2608 }
2609 }
0014cb46 2610 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, traceLen);
15c4dc5a 2611}
b62a5a84 2612
d2f487af 2613
2614
b62a5a84
M
2615//-----------------------------------------------------------------------------
2616// MIFARE sniffer.
2617//
2618//-----------------------------------------------------------------------------
5cd9ec01
M
2619void RAMFUNC SniffMifare(uint8_t param) {
2620 // param:
2621 // bit 0 - trigger from first card answer
2622 // bit 1 - trigger from first reader 7-bit request
39864b0b
M
2623
2624 // C(red) A(yellow) B(green)
b62a5a84
M
2625 LEDsoff();
2626 // init trace buffer
d19929cb 2627 iso14a_clear_trace();
b62a5a84 2628
b62a5a84
M
2629 // The command (reader -> tag) that we're receiving.
2630 // The length of a received command will in most cases be no more than 18 bytes.
2631 // So 32 should be enough!
2632 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
2633 // The response (tag -> reader) that we're receiving.
2634 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
2635
2636 // As we receive stuff, we copy it from receivedCmd or receivedResponse
2637 // into trace, along with its length and other annotations.
2638 //uint8_t *trace = (uint8_t *)BigBuf;
2639
2640 // The DMA buffer, used to stream samples from the FPGA
7bc95e2e 2641 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
2642 uint8_t *data = dmaBuf;
2643 uint8_t previous_data = 0;
5cd9ec01
M
2644 int maxDataLen = 0;
2645 int dataLen = 0;
7bc95e2e 2646 bool ReaderIsActive = FALSE;
2647 bool TagIsActive = FALSE;
2648
2649 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
b62a5a84
M
2650
2651 // Set up the demodulator for tag -> reader responses.
2652 Demod.output = receivedResponse;
b62a5a84
M
2653
2654 // Set up the demodulator for the reader -> tag commands
b62a5a84 2655 Uart.output = receivedCmd;
b62a5a84
M
2656
2657 // Setup for the DMA.
7bc95e2e 2658 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
b62a5a84 2659
b62a5a84 2660 LED_D_OFF();
39864b0b
M
2661
2662 // init sniffer
2663 MfSniffInit();
b62a5a84 2664
b62a5a84 2665 // And now we loop, receiving samples.
7bc95e2e 2666 for(uint32_t sniffCounter = 0; TRUE; ) {
2667
5cd9ec01
M
2668 if(BUTTON_PRESS()) {
2669 DbpString("cancelled by button");
7bc95e2e 2670 break;
5cd9ec01
M
2671 }
2672
b62a5a84
M
2673 LED_A_ON();
2674 WDT_HIT();
39864b0b 2675
7bc95e2e 2676 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
2677 // check if a transaction is completed (timeout after 2000ms).
2678 // if yes, stop the DMA transfer and send what we have so far to the client
2679 if (MfSniffSend(2000)) {
2680 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2681 sniffCounter = 0;
2682 data = dmaBuf;
2683 maxDataLen = 0;
2684 ReaderIsActive = FALSE;
2685 TagIsActive = FALSE;
2686 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
39864b0b 2687 }
39864b0b 2688 }
7bc95e2e 2689
2690 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
2691 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
2692 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
2693 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
2694 } else {
2695 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
5cd9ec01
M
2696 }
2697 // test for length of buffer
7bc95e2e 2698 if(dataLen > maxDataLen) { // we are more behind than ever...
2699 maxDataLen = dataLen;
5cd9ec01
M
2700 if(dataLen > 400) {
2701 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
7bc95e2e 2702 break;
b62a5a84
M
2703 }
2704 }
5cd9ec01 2705 if(dataLen < 1) continue;
b62a5a84 2706
7bc95e2e 2707 // primary buffer was stopped ( <-- we lost data!
5cd9ec01
M
2708 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
2709 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
2710 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
55acbb2a 2711 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
2712 }
2713 // secondary buffer sets as primary, secondary buffer was stopped
2714 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
2715 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
b62a5a84
M
2716 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
2717 }
5cd9ec01
M
2718
2719 LED_A_OFF();
b62a5a84 2720
7bc95e2e 2721 if (sniffCounter & 0x01) {
b62a5a84 2722
7bc95e2e 2723 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
2724 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
2725 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
2726 LED_C_INV();
2727 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parityBits, Uart.bitCount, TRUE)) break;
b62a5a84 2728
7bc95e2e 2729 /* And ready to receive another command. */
2730 UartReset();
2731
2732 /* And also reset the demod code */
2733 DemodReset();
2734 }
2735 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
2736 }
2737
2738 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
2739 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
2740 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
2741 LED_C_INV();
b62a5a84 2742
7bc95e2e 2743 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;
39864b0b 2744
7bc95e2e 2745 // And ready to receive another response.
2746 DemodReset();
2747 }
2748 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
2749 }
b62a5a84
M
2750 }
2751
7bc95e2e 2752 previous_data = *data;
2753 sniffCounter++;
5cd9ec01 2754 data++;
d714d3ef 2755 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01 2756 data = dmaBuf;
b62a5a84 2757 }
7bc95e2e 2758
b62a5a84
M
2759 } // main cycle
2760
2761 DbpString("COMMAND FINISHED");
2762
55acbb2a 2763 FpgaDisableSscDma();
39864b0b
M
2764 MfSniffEnd();
2765
7bc95e2e 2766 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
b62a5a84 2767 LEDsoff();
3803d529 2768}
Impressum, Datenschutz