]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - armsrc/iso14443.c
code cleanup. re-added psk commands.
[proxmark3-svn] / armsrc / iso14443.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------
2// Jonathan Westhues, split Nov 2006
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// Routines to support ISO 14443. This includes both the reader software and
9// the `fake tag' modes. At the moment only the Type B modulation is
10// supported.
11//-----------------------------------------------------------------------------
12
13#include "proxmark3.h"
14#include "apps.h"
15#include "util.h"
16#include "string.h"
17
18#include "iso14443crc.h"
19
20//static void GetSamplesFor14443(int weTx, int n);
21
22#define DEMOD_TRACE_SIZE 4096
23#define READER_TAG_BUFFER_SIZE 2048
24#define TAG_READER_BUFFER_SIZE 2048
25#define DEMOD_DMA_BUFFER_SIZE 1024
26
27//=============================================================================
28// An ISO 14443 Type B tag. We listen for commands from the reader, using
29// a UART kind of thing that's implemented in software. When we get a
30// frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
31// If it's good, then we can do something appropriate with it, and send
32// a response.
33//=============================================================================
34
35//-----------------------------------------------------------------------------
36// Code up a string of octets at layer 2 (including CRC, we don't generate
37// that here) so that they can be transmitted to the reader. Doesn't transmit
38// them yet, just leaves them ready to send in ToSend[].
39//-----------------------------------------------------------------------------
40static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
41{
42 int i;
43
44 ToSendReset();
45
46 // Transmit a burst of ones, as the initial thing that lets the
47 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
48 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
49 // so I will too.
50 for(i = 0; i < 20; i++) {
51 ToSendStuffBit(1);
52 ToSendStuffBit(1);
53 ToSendStuffBit(1);
54 ToSendStuffBit(1);
55 }
56
57 // Send SOF.
58 for(i = 0; i < 10; i++) {
59 ToSendStuffBit(0);
60 ToSendStuffBit(0);
61 ToSendStuffBit(0);
62 ToSendStuffBit(0);
63 }
64 for(i = 0; i < 2; i++) {
65 ToSendStuffBit(1);
66 ToSendStuffBit(1);
67 ToSendStuffBit(1);
68 ToSendStuffBit(1);
69 }
70
71 for(i = 0; i < len; i++) {
72 int j;
73 uint8_t b = cmd[i];
74
75 // Start bit
76 ToSendStuffBit(0);
77 ToSendStuffBit(0);
78 ToSendStuffBit(0);
79 ToSendStuffBit(0);
80
81 // Data bits
82 for(j = 0; j < 8; j++) {
83 if(b & 1) {
84 ToSendStuffBit(1);
85 ToSendStuffBit(1);
86 ToSendStuffBit(1);
87 ToSendStuffBit(1);
88 } else {
89 ToSendStuffBit(0);
90 ToSendStuffBit(0);
91 ToSendStuffBit(0);
92 ToSendStuffBit(0);
93 }
94 b >>= 1;
95 }
96
97 // Stop bit
98 ToSendStuffBit(1);
99 ToSendStuffBit(1);
100 ToSendStuffBit(1);
101 ToSendStuffBit(1);
102 }
103
104 // Send SOF.
105 for(i = 0; i < 10; i++) {
106 ToSendStuffBit(0);
107 ToSendStuffBit(0);
108 ToSendStuffBit(0);
109 ToSendStuffBit(0);
110 }
111 for(i = 0; i < 10; i++) {
112 ToSendStuffBit(1);
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 ToSendStuffBit(1);
116 }
117
118 // Convert from last byte pos to length
119 ToSendMax++;
120
121 // Add a few more for slop
122 ToSendMax += 2;
123}
124
125//-----------------------------------------------------------------------------
126// The software UART that receives commands from the reader, and its state
127// variables.
128//-----------------------------------------------------------------------------
129static struct {
130 enum {
131 STATE_UNSYNCD,
132 STATE_GOT_FALLING_EDGE_OF_SOF,
133 STATE_AWAITING_START_BIT,
134 STATE_RECEIVING_DATA,
135 STATE_ERROR_WAIT
136 } state;
137 uint16_t shiftReg;
138 int bitCnt;
139 int byteCnt;
140 int byteCntMax;
141 int posCnt;
142 uint8_t *output;
143} Uart;
144
145/* Receive & handle a bit coming from the reader.
146 *
147 * LED handling:
148 * LED A -> ON once we have received the SOF and are expecting the rest.
149 * LED A -> OFF once we have received EOF or are in error state or unsynced
150 *
151 * Returns: true if we received a EOF
152 * false if we are still waiting for some more
153 */
154static int Handle14443UartBit(int bit)
155{
156 switch(Uart.state) {
157 case STATE_UNSYNCD:
158 LED_A_OFF();
159 if(!bit) {
160 // we went low, so this could be the beginning
161 // of an SOF
162 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
163 Uart.posCnt = 0;
164 Uart.bitCnt = 0;
165 }
166 break;
167
168 case STATE_GOT_FALLING_EDGE_OF_SOF:
169 Uart.posCnt++;
170 if(Uart.posCnt == 2) {
171 if(bit) {
172 if(Uart.bitCnt >= 10) {
173 // we've seen enough consecutive
174 // zeros that it's a valid SOF
175 Uart.posCnt = 0;
176 Uart.byteCnt = 0;
177 Uart.state = STATE_AWAITING_START_BIT;
178 LED_A_ON(); // Indicate we got a valid SOF
179 } else {
180 // didn't stay down long enough
181 // before going high, error
182 Uart.state = STATE_ERROR_WAIT;
183 }
184 } else {
185 // do nothing, keep waiting
186 }
187 Uart.bitCnt++;
188 }
189 if(Uart.posCnt >= 4) Uart.posCnt = 0;
190 if(Uart.bitCnt > 14) {
191 // Give up if we see too many zeros without
192 // a one, too.
193 Uart.state = STATE_ERROR_WAIT;
194 }
195 break;
196
197 case STATE_AWAITING_START_BIT:
198 Uart.posCnt++;
199 if(bit) {
200 if(Uart.posCnt > 25) {
201 // stayed high for too long between
202 // characters, error
203 Uart.state = STATE_ERROR_WAIT;
204 }
205 } else {
206 // falling edge, this starts the data byte
207 Uart.posCnt = 0;
208 Uart.bitCnt = 0;
209 Uart.shiftReg = 0;
210 Uart.state = STATE_RECEIVING_DATA;
211 LED_A_ON(); // Indicate we're receiving
212 }
213 break;
214
215 case STATE_RECEIVING_DATA:
216 Uart.posCnt++;
217 if(Uart.posCnt == 2) {
218 // time to sample a bit
219 Uart.shiftReg >>= 1;
220 if(bit) {
221 Uart.shiftReg |= 0x200;
222 }
223 Uart.bitCnt++;
224 }
225 if(Uart.posCnt >= 4) {
226 Uart.posCnt = 0;
227 }
228 if(Uart.bitCnt == 10) {
229 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
230 {
231 // this is a data byte, with correct
232 // start and stop bits
233 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
234 Uart.byteCnt++;
235
236 if(Uart.byteCnt >= Uart.byteCntMax) {
237 // Buffer overflowed, give up
238 Uart.posCnt = 0;
239 Uart.state = STATE_ERROR_WAIT;
240 } else {
241 // so get the next byte now
242 Uart.posCnt = 0;
243 Uart.state = STATE_AWAITING_START_BIT;
244 }
245 } else if(Uart.shiftReg == 0x000) {
246 // this is an EOF byte
247 LED_A_OFF(); // Finished receiving
248 return TRUE;
249 } else {
250 // this is an error
251 Uart.posCnt = 0;
252 Uart.state = STATE_ERROR_WAIT;
253 }
254 }
255 break;
256
257 case STATE_ERROR_WAIT:
258 // We're all screwed up, so wait a little while
259 // for whatever went wrong to finish, and then
260 // start over.
261 Uart.posCnt++;
262 if(Uart.posCnt > 10) {
263 Uart.state = STATE_UNSYNCD;
264 }
265 break;
266
267 default:
268 Uart.state = STATE_UNSYNCD;
269 break;
270 }
271
272 // This row make the error blew circular buffer in hf 14b snoop
273 //if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error
274
275 return FALSE;
276}
277
278//-----------------------------------------------------------------------------
279// Receive a command (from the reader to us, where we are the simulated tag),
280// and store it in the given buffer, up to the given maximum length. Keeps
281// spinning, waiting for a well-framed command, until either we get one
282// (returns TRUE) or someone presses the pushbutton on the board (FALSE).
283//
284// Assume that we're called with the SSC (to the FPGA) and ADC path set
285// correctly.
286//-----------------------------------------------------------------------------
287static int GetIso14443CommandFromReader(uint8_t *received, int *len, int maxLen)
288{
289 uint8_t mask;
290 int i, bit;
291
292 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
293 // only, since we are receiving, not transmitting).
294 // Signal field is off with the appropriate LED
295 LED_D_OFF();
296 FpgaWriteConfWord(
297 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
298
299
300 // Now run a `software UART' on the stream of incoming samples.
301 Uart.output = received;
302 Uart.byteCntMax = maxLen;
303 Uart.state = STATE_UNSYNCD;
304
305 for(;;) {
306 WDT_HIT();
307
308 if(BUTTON_PRESS()) return FALSE;
309
310 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
311 AT91C_BASE_SSC->SSC_THR = 0x00;
312 }
313 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
314 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
315
316 mask = 0x80;
317 for(i = 0; i < 8; i++, mask >>= 1) {
318 bit = (b & mask);
319 if(Handle14443UartBit(bit)) {
320 *len = Uart.byteCnt;
321 return TRUE;
322 }
323 }
324 }
325 }
326}
327
328//-----------------------------------------------------------------------------
329// Main loop of simulated tag: receive commands from reader, decide what
330// response to send, and send it.
331//-----------------------------------------------------------------------------
332void SimulateIso14443Tag(void)
333{
334 static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
335 static const uint8_t response1[] = {
336 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
337 0x00, 0x21, 0x85, 0x5e, 0xd7
338 };
339
340 uint8_t *resp;
341 int respLen;
342
343 uint8_t *resp1 = (((uint8_t *)BigBuf) + 800);
344 int resp1Len;
345
346 uint8_t *receivedCmd = (uint8_t *)BigBuf;
347 int len;
348
349 int i;
350
351 int cmdsRecvd = 0;
352
353 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
354 memset(receivedCmd, 0x44, 400);
355
356 CodeIso14443bAsTag(response1, sizeof(response1));
357 memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
358
359 // We need to listen to the high-frequency, peak-detected path.
360 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
361 FpgaSetupSsc();
362
363 cmdsRecvd = 0;
364
365 for(;;) {
366 uint8_t b1, b2;
367
368 if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {
369 Dbprintf("button pressed, received %d commands", cmdsRecvd);
370 break;
371 }
372
373 // Good, look at the command now.
374
375 if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
376 resp = resp1; respLen = resp1Len;
377 } else {
378 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
379 // And print whether the CRC fails, just for good measure
380 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
381 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
382 // Not so good, try again.
383 DbpString("+++CRC fail");
384 } else {
385 DbpString("CRC passes");
386 }
387 break;
388 }
389
390 memset(receivedCmd, 0x44, 32);
391
392 cmdsRecvd++;
393
394 if(cmdsRecvd > 0x30) {
395 DbpString("many commands later...");
396 break;
397 }
398
399 if(respLen <= 0) continue;
400
401 // Modulate BPSK
402 // Signal field is off with the appropriate LED
403 LED_D_OFF();
404 FpgaWriteConfWord(
405 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
406 AT91C_BASE_SSC->SSC_THR = 0xff;
407 FpgaSetupSsc();
408
409 // Transmit the response.
410 i = 0;
411 for(;;) {
412 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
413 uint8_t b = resp[i];
414
415 AT91C_BASE_SSC->SSC_THR = b;
416
417 i++;
418 if(i > respLen) {
419 break;
420 }
421 }
422 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
423 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
424 (void)b;
425 }
426 }
427 }
428}
429
430//=============================================================================
431// An ISO 14443 Type B reader. We take layer two commands, code them
432// appropriately, and then send them to the tag. We then listen for the
433// tag's response, which we leave in the buffer to be demodulated on the
434// PC side.
435//=============================================================================
436
437static struct {
438 enum {
439 DEMOD_UNSYNCD,
440 DEMOD_PHASE_REF_TRAINING,
441 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
442 DEMOD_GOT_FALLING_EDGE_OF_SOF,
443 DEMOD_AWAITING_START_BIT,
444 DEMOD_RECEIVING_DATA,
445 DEMOD_ERROR_WAIT
446 } state;
447 int bitCount;
448 int posCount;
449 int thisBit;
450 int metric;
451 int metricN;
452 uint16_t shiftReg;
453 uint8_t *output;
454 int len;
455 int sumI;
456 int sumQ;
457} Demod;
458
459/*
460 * Handles reception of a bit from the tag
461 *
462 * LED handling:
463 * LED C -> ON once we have received the SOF and are expecting the rest.
464 * LED C -> OFF once we have received EOF or are unsynced
465 *
466 * Returns: true if we received a EOF
467 * false if we are still waiting for some more
468 *
469 */
470static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)
471{
472 int v;
473
474 // The soft decision on the bit uses an estimate of just the
475 // quadrant of the reference angle, not the exact angle.
476#define MAKE_SOFT_DECISION() { \
477 if(Demod.sumI > 0) { \
478 v = ci; \
479 } else { \
480 v = -ci; \
481 } \
482 if(Demod.sumQ > 0) { \
483 v += cq; \
484 } else { \
485 v -= cq; \
486 } \
487 }
488
489 switch(Demod.state) {
490 case DEMOD_UNSYNCD:
491 v = ci;
492 if(v < 0) v = -v;
493 if(cq > 0) {
494 v += cq;
495 } else {
496 v -= cq;
497 }
498 if(v > 40) {
499 Demod.posCount = 0;
500 Demod.state = DEMOD_PHASE_REF_TRAINING;
501 Demod.sumI = 0;
502 Demod.sumQ = 0;
503 }
504 break;
505
506 case DEMOD_PHASE_REF_TRAINING:
507 if(Demod.posCount < 8) {
508 Demod.sumI += ci;
509 Demod.sumQ += cq;
510 } else if(Demod.posCount > 100) {
511 // error, waited too long
512 Demod.state = DEMOD_UNSYNCD;
513 } else {
514 MAKE_SOFT_DECISION();
515 if(v < 0) {
516 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
517 Demod.posCount = 0;
518 }
519 }
520 Demod.posCount++;
521 break;
522
523 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
524 MAKE_SOFT_DECISION();
525 if(v < 0) {
526 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
527 Demod.posCount = 0;
528 } else {
529 if(Demod.posCount > 100) {
530 Demod.state = DEMOD_UNSYNCD;
531 }
532 }
533 Demod.posCount++;
534 break;
535
536 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
537 MAKE_SOFT_DECISION();
538 if(v > 0) {
539 if(Demod.posCount < 12) {
540 Demod.state = DEMOD_UNSYNCD;
541 } else {
542 LED_C_ON(); // Got SOF
543 Demod.state = DEMOD_AWAITING_START_BIT;
544 Demod.posCount = 0;
545 Demod.len = 0;
546 Demod.metricN = 0;
547 Demod.metric = 0;
548 }
549 } else {
550 if(Demod.posCount > 100) {
551 Demod.state = DEMOD_UNSYNCD;
552 }
553 }
554 Demod.posCount++;
555 break;
556
557 case DEMOD_AWAITING_START_BIT:
558 MAKE_SOFT_DECISION();
559 if(v > 0) {
560 if(Demod.posCount > 10) {
561 Demod.state = DEMOD_UNSYNCD;
562 }
563 } else {
564 Demod.bitCount = 0;
565 Demod.posCount = 1;
566 Demod.thisBit = v;
567 Demod.shiftReg = 0;
568 Demod.state = DEMOD_RECEIVING_DATA;
569 }
570 break;
571
572 case DEMOD_RECEIVING_DATA:
573 MAKE_SOFT_DECISION();
574 if(Demod.posCount == 0) {
575 Demod.thisBit = v;
576 Demod.posCount = 1;
577 } else {
578 Demod.thisBit += v;
579
580 if(Demod.thisBit > 0) {
581 Demod.metric += Demod.thisBit;
582 } else {
583 Demod.metric -= Demod.thisBit;
584 }
585 (Demod.metricN)++;
586
587 Demod.shiftReg >>= 1;
588 if(Demod.thisBit > 0) {
589 Demod.shiftReg |= 0x200;
590 }
591
592 Demod.bitCount++;
593 if(Demod.bitCount == 10) {
594 uint16_t s = Demod.shiftReg;
595 if((s & 0x200) && !(s & 0x001)) {
596 uint8_t b = (s >> 1);
597 Demod.output[Demod.len] = b;
598 Demod.len++;
599 Demod.state = DEMOD_AWAITING_START_BIT;
600 } else if(s == 0x000) {
601 // This is EOF
602 LED_C_OFF();
603 Demod.state = DEMOD_UNSYNCD;
604 return TRUE;
605 } else {
606 Demod.state = DEMOD_UNSYNCD;
607 }
608 }
609 Demod.posCount = 0;
610 }
611 break;
612
613 default:
614 Demod.state = DEMOD_UNSYNCD;
615 break;
616 }
617
618 if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...
619 return FALSE;
620}
621
622/*
623 * Demodulate the samples we received from the tag
624 * weTx: set to 'TRUE' if we behave like a reader
625 * set to 'FALSE' if we behave like a snooper
626 * quiet: set to 'TRUE' to disable debug output
627 */
628static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
629{
630 int max = 0;
631 int gotFrame = FALSE;
632
633//# define DMA_BUFFER_SIZE 8
634 int8_t *dmaBuf;
635
636 int lastRxCounter;
637 int8_t *upTo;
638
639 int ci, cq;
640
641 int samples = 0;
642
643 // Clear out the state of the "UART" that receives from the tag.
644 memset(BigBuf, 0x00, 400);
645 Demod.output = (uint8_t *)BigBuf;
646 Demod.len = 0;
647 Demod.state = DEMOD_UNSYNCD;
648
649 // And the UART that receives from the reader
650 Uart.output = (((uint8_t *)BigBuf) + 1024);
651 Uart.byteCntMax = 100;
652 Uart.state = STATE_UNSYNCD;
653
654 // Setup for the DMA.
655 dmaBuf = (int8_t *)(BigBuf + 32);
656 upTo = dmaBuf;
657 lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
658 FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
659
660 // Signal field is ON with the appropriate LED:
661 if (weTx) LED_D_ON(); else LED_D_OFF();
662 // And put the FPGA in the appropriate mode
663 FpgaWriteConfWord(
664 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
665 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
666
667 for(;;) {
668 int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
669 if(behindBy > max) max = behindBy;
670
671 while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DEMOD_DMA_BUFFER_SIZE-1))
672 > 2)
673 {
674 ci = upTo[0];
675 cq = upTo[1];
676 upTo += 2;
677 if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {
678 upTo -= DEMOD_DMA_BUFFER_SIZE;
679 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
680 AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;
681 }
682 lastRxCounter -= 2;
683 if(lastRxCounter <= 0) {
684 lastRxCounter += DEMOD_DMA_BUFFER_SIZE;
685 }
686
687 samples += 2;
688
689 Handle14443UartBit(1);
690 Handle14443UartBit(1);
691
692 if(Handle14443SamplesDemod(ci, cq)) {
693 gotFrame = 1;
694 }
695 }
696
697 if(samples > 2000) {
698 break;
699 }
700 }
701 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
702 if (!quiet) Dbprintf("%x %x %x", max, gotFrame, Demod.len);
703}
704
705//-----------------------------------------------------------------------------
706// Read the tag's response. We just receive a stream of slightly-processed
707// samples from the FPGA, which we will later do some signal processing on,
708// to get the bits.
709//-----------------------------------------------------------------------------
710/*static void GetSamplesFor14443(int weTx, int n)
711{
712 uint8_t *dest = (uint8_t *)BigBuf;
713 int c;
714
715 FpgaWriteConfWord(
716 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
717 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
718
719 c = 0;
720 for(;;) {
721 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
722 AT91C_BASE_SSC->SSC_THR = 0x43;
723 }
724 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
725 int8_t b;
726 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
727
728 dest[c++] = (uint8_t)b;
729
730 if(c >= n) {
731 break;
732 }
733 }
734 }
735}*/
736
737//-----------------------------------------------------------------------------
738// Transmit the command (to the tag) that was placed in ToSend[].
739//-----------------------------------------------------------------------------
740static void TransmitFor14443(void)
741{
742 int c;
743
744 FpgaSetupSsc();
745
746 while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
747 AT91C_BASE_SSC->SSC_THR = 0xff;
748 }
749
750 // Signal field is ON with the appropriate Red LED
751 LED_D_ON();
752 // Signal we are transmitting with the Green LED
753 LED_B_ON();
754 FpgaWriteConfWord(
755 FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
756
757 for(c = 0; c < 10;) {
758 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
759 AT91C_BASE_SSC->SSC_THR = 0xff;
760 c++;
761 }
762 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
763 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
764 (void)r;
765 }
766 WDT_HIT();
767 }
768
769 c = 0;
770 for(;;) {
771 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
772 AT91C_BASE_SSC->SSC_THR = ToSend[c];
773 c++;
774 if(c >= ToSendMax) {
775 break;
776 }
777 }
778 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
779 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
780 (void)r;
781 }
782 WDT_HIT();
783 }
784 LED_B_OFF(); // Finished sending
785}
786
787//-----------------------------------------------------------------------------
788// Code a layer 2 command (string of octets, including CRC) into ToSend[],
789// so that it is ready to transmit to the tag using TransmitFor14443().
790//-----------------------------------------------------------------------------
791static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
792{
793 int i, j;
794 uint8_t b;
795
796 ToSendReset();
797
798 // Establish initial reference level
799 for(i = 0; i < 40; i++) {
800 ToSendStuffBit(1);
801 }
802 // Send SOF
803 for(i = 0; i < 10; i++) {
804 ToSendStuffBit(0);
805 }
806
807 for(i = 0; i < len; i++) {
808 // Stop bits/EGT
809 ToSendStuffBit(1);
810 ToSendStuffBit(1);
811 // Start bit
812 ToSendStuffBit(0);
813 // Data bits
814 b = cmd[i];
815 for(j = 0; j < 8; j++) {
816 if(b & 1) {
817 ToSendStuffBit(1);
818 } else {
819 ToSendStuffBit(0);
820 }
821 b >>= 1;
822 }
823 }
824 // Send EOF
825 ToSendStuffBit(1);
826 for(i = 0; i < 10; i++) {
827 ToSendStuffBit(0);
828 }
829 for(i = 0; i < 8; i++) {
830 ToSendStuffBit(1);
831 }
832
833 // And then a little more, to make sure that the last character makes
834 // it out before we switch to rx mode.
835 for(i = 0; i < 24; i++) {
836 ToSendStuffBit(1);
837 }
838
839 // Convert from last character reference to length
840 ToSendMax++;
841}
842
843//-----------------------------------------------------------------------------
844// Read an ISO 14443 tag. We send it some set of commands, and record the
845// responses.
846// The command name is misleading, it actually decodes the reponse in HEX
847// into the output buffer (read the result using hexsamples, not hisamples)
848//
849// obsolete function only for test
850//-----------------------------------------------------------------------------
851void AcquireRawAdcSamplesIso14443(uint32_t parameter)
852{
853 uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
854
855 SendRawCommand14443B(sizeof(cmd1),1,1,cmd1);
856}
857
858//-----------------------------------------------------------------------------
859// Read a SRI512 ISO 14443 tag.
860//
861// SRI512 tags are just simple memory tags, here we're looking at making a dump
862// of the contents of the memory. No anticollision algorithm is done, we assume
863// we have a single tag in the field.
864//
865// I tried to be systematic and check every answer of the tag, every CRC, etc...
866//-----------------------------------------------------------------------------
867void ReadSTMemoryIso14443(uint32_t dwLast)
868{
869 uint8_t i = 0x00;
870
871 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
872 // Make sure that we start from off, since the tags are stateful;
873 // confusing things will happen if we don't reset them between reads.
874 LED_D_OFF();
875 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
876 SpinDelay(200);
877
878 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
879 FpgaSetupSsc();
880
881 // Now give it time to spin up.
882 // Signal field is on with the appropriate LED
883 LED_D_ON();
884 FpgaWriteConfWord(
885 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
886 SpinDelay(200);
887
888 // First command: wake up the tag using the INITIATE command
889 uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
890 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
891 TransmitFor14443();
892// LED_A_ON();
893 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
894// LED_A_OFF();
895
896 if (Demod.len == 0) {
897 DbpString("No response from tag");
898 return;
899 } else {
900 Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",
901 Demod.output[0], Demod.output[1],Demod.output[2]);
902 }
903 // There is a response, SELECT the uid
904 DbpString("Now SELECT tag:");
905 cmd1[0] = 0x0E; // 0x0E is SELECT
906 cmd1[1] = Demod.output[0];
907 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
908 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
909 TransmitFor14443();
910// LED_A_ON();
911 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
912// LED_A_OFF();
913 if (Demod.len != 3) {
914 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
915 return;
916 }
917 // Check the CRC of the answer:
918 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
919 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
920 DbpString("CRC Error reading select response.");
921 return;
922 }
923 // Check response from the tag: should be the same UID as the command we just sent:
924 if (cmd1[1] != Demod.output[0]) {
925 Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);
926 return;
927 }
928 // Tag is now selected,
929 // First get the tag's UID:
930 cmd1[0] = 0x0B;
931 ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
932 CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one
933 TransmitFor14443();
934// LED_A_ON();
935 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
936// LED_A_OFF();
937 if (Demod.len != 10) {
938 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
939 return;
940 }
941 // The check the CRC of the answer (use cmd1 as temporary variable):
942 ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
943 if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
944 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
945 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
946 // Do not return;, let's go on... (we should retry, maybe ?)
947 }
948 Dbprintf("Tag UID (64 bits): %08x %08x",
949 (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
950 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
951
952 // Now loop to read all 16 blocks, address from 0 to last block
953 Dbprintf("Tag memory dump, block 0 to %d",dwLast);
954 cmd1[0] = 0x08;
955 i = 0x00;
956 dwLast++;
957 for (;;) {
958 if (i == dwLast) {
959 DbpString("System area block (0xff):");
960 i = 0xff;
961 }
962 cmd1[1] = i;
963 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
964 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
965 TransmitFor14443();
966// LED_A_ON();
967 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
968// LED_A_OFF();
969 if (Demod.len != 6) { // Check if we got an answer from the tag
970 DbpString("Expected 6 bytes from tag, got less...");
971 return;
972 }
973 // The check the CRC of the answer (use cmd1 as temporary variable):
974 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
975 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
976 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
977 (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
978 // Do not return;, let's go on... (we should retry, maybe ?)
979 }
980 // Now print out the memory location:
981 Dbprintf("Address=%x, Contents=%x, CRC=%x", i,
982 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
983 (Demod.output[4]<<8)+Demod.output[5]);
984 if (i == 0xff) {
985 break;
986 }
987 i++;
988 }
989}
990
991
992//=============================================================================
993// Finally, the `sniffer' combines elements from both the reader and
994// simulated tag, to show both sides of the conversation.
995//=============================================================================
996
997//-----------------------------------------------------------------------------
998// Record the sequence of commands sent by the reader to the tag, with
999// triggering so that we start recording at the point that the tag is moved
1000// near the reader.
1001//-----------------------------------------------------------------------------
1002/*
1003 * Memory usage for this function, (within BigBuf)
1004 * 0-4095 : Demodulated samples receive (4096 bytes) - DEMOD_TRACE_SIZE
1005 * 4096-6143 : Last Received command, 2048 bytes (reader->tag) - READER_TAG_BUFFER_SIZE
1006 * 6144-8191 : Last Received command, 2048 bytes(tag->reader) - TAG_READER_BUFFER_SIZE
1007 * 8192-9215 : DMA Buffer, 1024 bytes (samples) - DEMOD_DMA_BUFFER_SIZE
1008 */
1009void RAMFUNC SnoopIso14443(void)
1010{
1011 // We won't start recording the frames that we acquire until we trigger;
1012 // a good trigger condition to get started is probably when we see a
1013 // response from the tag.
1014 int triggered = TRUE;
1015
1016 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1017 // The command (reader -> tag) that we're working on receiving.
1018 uint8_t *receivedCmd = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE;
1019 // The response (tag -> reader) that we're working on receiving.
1020 uint8_t *receivedResponse = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE;
1021
1022 // As we receive stuff, we copy it from receivedCmd or receivedResponse
1023 // into trace, along with its length and other annotations.
1024 uint8_t *trace = (uint8_t *)BigBuf;
1025 int traceLen = 0;
1026
1027 // The DMA buffer, used to stream samples from the FPGA.
1028 int8_t *dmaBuf = (int8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE + TAG_READER_BUFFER_SIZE;
1029 int lastRxCounter;
1030 int8_t *upTo;
1031 int ci, cq;
1032 int maxBehindBy = 0;
1033
1034 // Count of samples received so far, so that we can include timing
1035 // information in the trace buffer.
1036 int samples = 0;
1037
1038 // Initialize the trace buffer
1039 memset(trace, 0x44, DEMOD_TRACE_SIZE);
1040
1041 // Set up the demodulator for tag -> reader responses.
1042 Demod.output = receivedResponse;
1043 Demod.len = 0;
1044 Demod.state = DEMOD_UNSYNCD;
1045
1046 // And the reader -> tag commands
1047 memset(&Uart, 0, sizeof(Uart));
1048 Uart.output = receivedCmd;
1049 Uart.byteCntMax = 100;
1050 Uart.state = STATE_UNSYNCD;
1051
1052 // Print some debug information about the buffer sizes
1053 Dbprintf("Snooping buffers initialized:");
1054 Dbprintf(" Trace: %i bytes", DEMOD_TRACE_SIZE);
1055 Dbprintf(" Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);
1056 Dbprintf(" tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);
1057 Dbprintf(" DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);
1058
1059 // And put the FPGA in the appropriate mode
1060 // Signal field is off with the appropriate LED
1061 LED_D_OFF();
1062 FpgaWriteConfWord(
1063 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
1064 FPGA_HF_READER_RX_XCORR_SNOOP);
1065 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1066
1067 // Setup for the DMA.
1068 FpgaSetupSsc();
1069 upTo = dmaBuf;
1070 lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
1071 FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
1072
1073 LED_A_ON();
1074
1075 // And now we loop, receiving samples.
1076 for(;;) {
1077 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
1078 (DEMOD_DMA_BUFFER_SIZE-1);
1079 if(behindBy > maxBehindBy) {
1080 maxBehindBy = behindBy;
1081 if(behindBy > (DEMOD_DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?
1082 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
1083 goto done;
1084 }
1085 }
1086 if(behindBy < 2) continue;
1087
1088 ci = upTo[0];
1089 cq = upTo[1];
1090 upTo += 2;
1091 lastRxCounter -= 2;
1092 if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {
1093 upTo -= DEMOD_DMA_BUFFER_SIZE;
1094 lastRxCounter += DEMOD_DMA_BUFFER_SIZE;
1095 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
1096 AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;
1097 }
1098
1099 samples += 2;
1100
1101#define HANDLE_BIT_IF_BODY \
1102 if(triggered) { \
1103 trace[traceLen++] = ((samples >> 0) & 0xff); \
1104 trace[traceLen++] = ((samples >> 8) & 0xff); \
1105 trace[traceLen++] = ((samples >> 16) & 0xff); \
1106 trace[traceLen++] = ((samples >> 24) & 0xff); \
1107 trace[traceLen++] = 0; \
1108 trace[traceLen++] = 0; \
1109 trace[traceLen++] = 0; \
1110 trace[traceLen++] = 0; \
1111 trace[traceLen++] = Uart.byteCnt; \
1112 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
1113 traceLen += Uart.byteCnt; \
1114 if(traceLen > 1000) break; \
1115 } \
1116 /* And ready to receive another command. */ \
1117 memset(&Uart, 0, sizeof(Uart)); \
1118 Uart.output = receivedCmd; \
1119 Uart.byteCntMax = 100; \
1120 Uart.state = STATE_UNSYNCD; \
1121 /* And also reset the demod code, which might have been */ \
1122 /* false-triggered by the commands from the reader. */ \
1123 memset(&Demod, 0, sizeof(Demod)); \
1124 Demod.output = receivedResponse; \
1125 Demod.state = DEMOD_UNSYNCD; \
1126
1127 if(Handle14443UartBit(ci & 1)) {
1128 HANDLE_BIT_IF_BODY
1129 }
1130 if(Handle14443UartBit(cq & 1)) {
1131 HANDLE_BIT_IF_BODY
1132 }
1133
1134 if(Handle14443SamplesDemod(ci, cq)) {
1135 // timestamp, as a count of samples
1136 trace[traceLen++] = ((samples >> 0) & 0xff);
1137 trace[traceLen++] = ((samples >> 8) & 0xff);
1138 trace[traceLen++] = ((samples >> 16) & 0xff);
1139 trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);
1140 // correlation metric (~signal strength estimate)
1141 if(Demod.metricN != 0) {
1142 Demod.metric /= Demod.metricN;
1143 }
1144 trace[traceLen++] = ((Demod.metric >> 0) & 0xff);
1145 trace[traceLen++] = ((Demod.metric >> 8) & 0xff);
1146 trace[traceLen++] = ((Demod.metric >> 16) & 0xff);
1147 trace[traceLen++] = ((Demod.metric >> 24) & 0xff);
1148 // length
1149 trace[traceLen++] = Demod.len;
1150 memcpy(trace+traceLen, receivedResponse, Demod.len);
1151 traceLen += Demod.len;
1152 if(traceLen > DEMOD_TRACE_SIZE) {
1153 DbpString("Reached trace limit");
1154 goto done;
1155 }
1156
1157 triggered = TRUE;
1158 LED_A_OFF();
1159 LED_B_ON();
1160
1161 // And ready to receive another response.
1162 memset(&Demod, 0, sizeof(Demod));
1163 Demod.output = receivedResponse;
1164 Demod.state = DEMOD_UNSYNCD;
1165 }
1166 WDT_HIT();
1167
1168 if(BUTTON_PRESS()) {
1169 DbpString("cancelled");
1170 goto done;
1171 }
1172 }
1173
1174done:
1175 LED_A_OFF();
1176 LED_B_OFF();
1177 LED_C_OFF();
1178 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
1179 DbpString("Snoop statistics:");
1180 Dbprintf(" Max behind by: %i", maxBehindBy);
1181 Dbprintf(" Uart State: %x", Uart.state);
1182 Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);
1183 Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);
1184 Dbprintf(" Trace length: %i", traceLen);
1185}
1186
1187/*
1188 * Send raw command to tag ISO14443B
1189 * @Input
1190 * datalen len of buffer data
1191 * recv bool when true wait for data from tag and send to client
1192 * powerfield bool leave the field on when true
1193 * data buffer with byte to send
1194 *
1195 * @Output
1196 * none
1197 *
1198 */
1199
1200void SendRawCommand14443B(uint32_t datalen, uint32_t recv,uint8_t powerfield, uint8_t data[])
1201{
1202 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1203 if(!powerfield)
1204 {
1205 // Make sure that we start from off, since the tags are stateful;
1206 // confusing things will happen if we don't reset them between reads.
1207 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1208 LED_D_OFF();
1209 SpinDelay(200);
1210 }
1211
1212 if(!GETBIT(GPIO_LED_D))
1213 {
1214 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1215 FpgaSetupSsc();
1216
1217 // Now give it time to spin up.
1218 // Signal field is on with the appropriate LED
1219 LED_D_ON();
1220 FpgaWriteConfWord(
1221 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
1222 SpinDelay(200);
1223 }
1224
1225 CodeIso14443bAsReader(data, datalen);
1226 TransmitFor14443();
1227 if(recv)
1228 {
1229 uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);
1230 GetSamplesFor14443Demod(TRUE, 2000, TRUE);
1231 cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);
1232 }
1233 if(!powerfield)
1234 {
1235 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1236 LED_D_OFF();
1237 }
1238}
1239
Impressum, Datenschutz