]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443a.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Implemented client side changes for iclass hack, attempted to fix issues with trace...
[proxmark3-svn] / armsrc / iso14443a.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "proxmark3.h"
14 #include "apps.h"
15 #include "util.h"
16 #include "string.h"
17 #include "cmd.h"
18
19 #include "iso14443crc.h"
20 #include "iso14443a.h"
21 #include "crapto1.h"
22 #include "mifareutil.h"
23
24 static uint32_t iso14a_timeout;
25 uint8_t *trace = (uint8_t *) BigBuf+TRACE_OFFSET;
26 int rsamples = 0;
27 int traceLen = 0;
28 int tracing = TRUE;
29 uint8_t trigger = 0;
30 // the block number for the ISO14443-4 PCB
31 static uint8_t iso14_pcb_blocknum = 0;
32
33 //
34 // ISO14443 timing:
35 //
36 // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
37 #define REQUEST_GUARD_TIME (7000/16 + 1)
38 // minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
39 #define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
40 // bool LastCommandWasRequest = FALSE;
41
42 //
43 // Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
44 //
45 // When the PM acts as reader and is receiving tag data, it takes
46 // 3 ticks delay in the AD converter
47 // 16 ticks until the modulation detector completes and sets curbit
48 // 8 ticks until bit_to_arm is assigned from curbit
49 // 8*16 ticks for the transfer from FPGA to ARM
50 // 4*16 ticks until we measure the time
51 // - 8*16 ticks because we measure the time of the previous transfer
52 #define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
53
54 // When the PM acts as a reader and is sending, it takes
55 // 4*16 ticks until we can write data to the sending hold register
56 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
57 // 8 ticks until the first transfer starts
58 // 8 ticks later the FPGA samples the data
59 // 1 tick to assign mod_sig_coil
60 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
61
62 // When the PM acts as tag and is receiving it takes
63 // 2 ticks delay in the RF part (for the first falling edge),
64 // 3 ticks for the A/D conversion,
65 // 8 ticks on average until the start of the SSC transfer,
66 // 8 ticks until the SSC samples the first data
67 // 7*16 ticks to complete the transfer from FPGA to ARM
68 // 8 ticks until the next ssp_clk rising edge
69 // 4*16 ticks until we measure the time
70 // - 8*16 ticks because we measure the time of the previous transfer
71 #define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
72
73 // The FPGA will report its internal sending delay in
74 uint16_t FpgaSendQueueDelay;
75 // the 5 first bits are the number of bits buffered in mod_sig_buf
76 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
77 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
78
79 // When the PM acts as tag and is sending, it takes
80 // 4*16 ticks until we can write data to the sending hold register
81 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
82 // 8 ticks until the first transfer starts
83 // 8 ticks later the FPGA samples the data
84 // + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
85 // + 1 tick to assign mod_sig_coil
86 #define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
87
88 // When the PM acts as sniffer and is receiving tag data, it takes
89 // 3 ticks A/D conversion
90 // 14 ticks to complete the modulation detection
91 // 8 ticks (on average) until the result is stored in to_arm
92 // + the delays in transferring data - which is the same for
93 // sniffing reader and tag data and therefore not relevant
94 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
95
96 // When the PM acts as sniffer and is receiving reader data, it takes
97 // 2 ticks delay in analogue RF receiver (for the falling edge of the
98 // start bit, which marks the start of the communication)
99 // 3 ticks A/D conversion
100 // 8 ticks on average until the data is stored in to_arm.
101 // + the delays in transferring data - which is the same for
102 // sniffing reader and tag data and therefore not relevant
103 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
104
105 //variables used for timing purposes:
106 //these are in ssp_clk cycles:
107 uint32_t NextTransferTime;
108 uint32_t LastTimeProxToAirStart;
109 uint32_t LastProxToAirDuration;
110
111
112
113 // CARD TO READER - manchester
114 // Sequence D: 11110000 modulation with subcarrier during first half
115 // Sequence E: 00001111 modulation with subcarrier during second half
116 // Sequence F: 00000000 no modulation with subcarrier
117 // READER TO CARD - miller
118 // Sequence X: 00001100 drop after half a period
119 // Sequence Y: 00000000 no drop
120 // Sequence Z: 11000000 drop at start
121 #define SEC_D 0xf0
122 #define SEC_E 0x0f
123 #define SEC_F 0x00
124 #define SEC_X 0x0c
125 #define SEC_Y 0x00
126 #define SEC_Z 0xc0
127
128 const uint8_t OddByteParity[256] = {
129 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
130 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
131 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
132 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
138 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
139 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
140 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
141 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
142 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
143 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
144 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
145 };
146
147
148 void iso14a_set_trigger(bool enable) {
149 trigger = enable;
150 }
151
152 void iso14a_clear_trace() {
153 memset(trace, 0x44, TRACE_SIZE);
154 traceLen = 0;
155 }
156
157 void iso14a_set_tracing(bool enable) {
158 tracing = enable;
159 }
160
161 void iso14a_set_timeout(uint32_t timeout) {
162 iso14a_timeout = timeout;
163 }
164
165 //-----------------------------------------------------------------------------
166 // Generate the parity value for a byte sequence
167 //
168 //-----------------------------------------------------------------------------
169 byte_t oddparity (const byte_t bt)
170 {
171 return OddByteParity[bt];
172 }
173
174 uint32_t GetParity(const uint8_t * pbtCmd, int iLen)
175 {
176 int i;
177 uint32_t dwPar = 0;
178
179 // Generate the parity bits
180 for (i = 0; i < iLen; i++) {
181 // and save them to a 32Bit word
182 dwPar |= ((OddByteParity[pbtCmd[i]]) << i);
183 }
184 return dwPar;
185 }
186
187 void AppendCrc14443a(uint8_t* data, int len)
188 {
189 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
190 }
191
192 // The function LogTrace() is also used by the iClass implementation in iClass.c
193 bool RAMFUNC LogTrace(const uint8_t * btBytes, uint8_t iLen, uint32_t timestamp, uint32_t dwParity, bool readerToTag)
194 {
195 // Return when trace is full
196 if (traceLen + sizeof(timestamp) + sizeof(dwParity) + iLen >= TRACE_SIZE) {
197 tracing = FALSE; // don't trace any more
198 return FALSE;
199 }
200
201 // Trace the random, i'm curious
202 trace[traceLen++] = ((timestamp >> 0) & 0xff);
203 trace[traceLen++] = ((timestamp >> 8) & 0xff);
204 trace[traceLen++] = ((timestamp >> 16) & 0xff);
205 trace[traceLen++] = ((timestamp >> 24) & 0xff);
206
207 if (!readerToTag) {
208 trace[traceLen - 1] |= 0x80;
209 }
210 trace[traceLen++] = ((dwParity >> 0) & 0xff);
211 trace[traceLen++] = ((dwParity >> 8) & 0xff);
212 trace[traceLen++] = ((dwParity >> 16) & 0xff);
213 trace[traceLen++] = ((dwParity >> 24) & 0xff);
214 trace[traceLen++] = iLen;
215 if (btBytes != NULL && iLen != 0) {
216 memcpy(trace + traceLen, btBytes, iLen);
217 }
218 traceLen += iLen;
219 return TRUE;
220 }
221
222 //=============================================================================
223 // ISO 14443 Type A - Miller decoder
224 //=============================================================================
225 // Basics:
226 // This decoder is used when the PM3 acts as a tag.
227 // The reader will generate "pauses" by temporarily switching of the field.
228 // At the PM3 antenna we will therefore measure a modulated antenna voltage.
229 // The FPGA does a comparison with a threshold and would deliver e.g.:
230 // ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
231 // The Miller decoder needs to identify the following sequences:
232 // 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
233 // 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
234 // 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
235 // Note 1: the bitstream may start at any time. We therefore need to sync.
236 // Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
237 //-----------------------------------------------------------------------------
238 static tUart Uart;
239
240 // Lookup-Table to decide if 4 raw bits are a modulation.
241 // We accept two or three consecutive "0" in any position with the rest "1"
242 const bool Mod_Miller_LUT[] = {
243 TRUE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, FALSE,
244 TRUE, TRUE, FALSE, FALSE, TRUE, FALSE, FALSE, FALSE
245 };
246 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x00F0) >> 4])
247 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x000F)])
248
249 void UartReset()
250 {
251 Uart.state = STATE_UNSYNCD;
252 Uart.bitCount = 0;
253 Uart.len = 0; // number of decoded data bytes
254 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
255 Uart.parityBits = 0; //
256 Uart.twoBits = 0x0000; // buffer for 2 Bits
257 Uart.highCnt = 0;
258 Uart.startTime = 0;
259 Uart.endTime = 0;
260 }
261
262
263 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
264 static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
265 {
266
267 Uart.twoBits = (Uart.twoBits << 8) | bit;
268
269 if (Uart.state == STATE_UNSYNCD) { // not yet synced
270 if (Uart.highCnt < 7) { // wait for a stable unmodulated signal
271 if (Uart.twoBits == 0xffff) {
272 Uart.highCnt++;
273 } else {
274 Uart.highCnt = 0;
275 }
276 } else {
277 Uart.syncBit = 0xFFFF; // not set
278 // look for 00xx1111 (the start bit)
279 if ((Uart.twoBits & 0x6780) == 0x0780) Uart.syncBit = 7;
280 else if ((Uart.twoBits & 0x33C0) == 0x03C0) Uart.syncBit = 6;
281 else if ((Uart.twoBits & 0x19E0) == 0x01E0) Uart.syncBit = 5;
282 else if ((Uart.twoBits & 0x0CF0) == 0x00F0) Uart.syncBit = 4;
283 else if ((Uart.twoBits & 0x0678) == 0x0078) Uart.syncBit = 3;
284 else if ((Uart.twoBits & 0x033C) == 0x003C) Uart.syncBit = 2;
285 else if ((Uart.twoBits & 0x019E) == 0x001E) Uart.syncBit = 1;
286 else if ((Uart.twoBits & 0x00CF) == 0x000F) Uart.syncBit = 0;
287 if (Uart.syncBit != 0xFFFF) {
288 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
289 Uart.startTime -= Uart.syncBit;
290 Uart.endTime = Uart.startTime;
291 Uart.state = STATE_START_OF_COMMUNICATION;
292 }
293 }
294
295 } else {
296
297 if (IsMillerModulationNibble1(Uart.twoBits >> Uart.syncBit)) {
298 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation in both halves - error
299 UartReset();
300 Uart.highCnt = 6;
301 } else { // Modulation in first half = Sequence Z = logic "0"
302 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
303 UartReset();
304 Uart.highCnt = 6;
305 } else {
306 Uart.bitCount++;
307 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
308 Uart.state = STATE_MILLER_Z;
309 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
310 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
311 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
312 Uart.parityBits <<= 1; // make room for the parity bit
313 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
314 Uart.bitCount = 0;
315 Uart.shiftReg = 0;
316 }
317 }
318 }
319 } else {
320 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
321 Uart.bitCount++;
322 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
323 Uart.state = STATE_MILLER_X;
324 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
325 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
326 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
327 Uart.parityBits <<= 1; // make room for the new parity bit
328 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
329 Uart.bitCount = 0;
330 Uart.shiftReg = 0;
331 }
332 } else { // no modulation in both halves - Sequence Y
333 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
334 Uart.state = STATE_UNSYNCD;
335 if(Uart.len == 0 && Uart.bitCount > 0) { // if we decoded some bits
336 Uart.shiftReg >>= (9 - Uart.bitCount); // add them to the output
337 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
338 Uart.parityBits <<= 1; // no parity bit - add "0"
339 Uart.bitCount--; // last "0" was part of the EOC sequence
340 }
341 return TRUE;
342 }
343 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
344 UartReset();
345 Uart.highCnt = 6;
346 } else { // a logic "0"
347 Uart.bitCount++;
348 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
349 Uart.state = STATE_MILLER_Y;
350 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
351 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
352 Uart.parityBits <<= 1; // make room for the parity bit
353 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
354 Uart.bitCount = 0;
355 Uart.shiftReg = 0;
356 }
357 }
358 }
359 }
360
361 }
362
363 return FALSE; // not finished yet, need more data
364 }
365
366
367
368 //=============================================================================
369 // ISO 14443 Type A - Manchester decoder
370 //=============================================================================
371 // Basics:
372 // This decoder is used when the PM3 acts as a reader.
373 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
374 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
375 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
376 // The Manchester decoder needs to identify the following sequences:
377 // 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
378 // 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
379 // 8 ticks unmodulated: Sequence F = end of communication
380 // 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
381 // Note 1: the bitstream may start at any time. We therefore need to sync.
382 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
383 static tDemod Demod;
384
385 // Lookup-Table to decide if 4 raw bits are a modulation.
386 // We accept three or four "1" in any position
387 const bool Mod_Manchester_LUT[] = {
388 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
389 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
390 };
391
392 #define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
393 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
394
395
396 void DemodReset()
397 {
398 Demod.state = DEMOD_UNSYNCD;
399 Demod.len = 0; // number of decoded data bytes
400 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
401 Demod.parityBits = 0; //
402 Demod.collisionPos = 0; // Position of collision bit
403 Demod.twoBits = 0xffff; // buffer for 2 Bits
404 Demod.highCnt = 0;
405 Demod.startTime = 0;
406 Demod.endTime = 0;
407 }
408
409 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
410 static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
411 {
412
413 Demod.twoBits = (Demod.twoBits << 8) | bit;
414
415 if (Demod.state == DEMOD_UNSYNCD) {
416
417 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
418 if (Demod.twoBits == 0x0000) {
419 Demod.highCnt++;
420 } else {
421 Demod.highCnt = 0;
422 }
423 } else {
424 Demod.syncBit = 0xFFFF; // not set
425 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
426 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
427 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
428 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
429 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
430 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
431 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
432 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
433 if (Demod.syncBit != 0xFFFF) {
434 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
435 Demod.startTime -= Demod.syncBit;
436 Demod.bitCount = offset; // number of decoded data bits
437 Demod.state = DEMOD_MANCHESTER_DATA;
438 }
439 }
440
441 } else {
442
443 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
444 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
445 if (!Demod.collisionPos) {
446 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
447 }
448 } // modulation in first half only - Sequence D = 1
449 Demod.bitCount++;
450 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
451 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
452 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
453 Demod.parityBits <<= 1; // make room for the parity bit
454 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
455 Demod.bitCount = 0;
456 Demod.shiftReg = 0;
457 }
458 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
459 } else { // no modulation in first half
460 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
461 Demod.bitCount++;
462 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
463 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
464 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
465 Demod.parityBits <<= 1; // make room for the new parity bit
466 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
467 Demod.bitCount = 0;
468 Demod.shiftReg = 0;
469 }
470 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
471 } else { // no modulation in both halves - End of communication
472 if (Demod.len > 0 || Demod.bitCount > 0) { // received something
473 if(Demod.bitCount > 0) { // if we decoded bits
474 Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
475 Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
476 // No parity bit, so just shift a 0
477 Demod.parityBits <<= 1;
478 }
479 return TRUE; // we are finished with decoding the raw data sequence
480 } else { // nothing received. Start over
481 DemodReset();
482 }
483 }
484 }
485
486 }
487
488 return FALSE; // not finished yet, need more data
489 }
490
491 //=============================================================================
492 // Finally, a `sniffer' for ISO 14443 Type A
493 // Both sides of communication!
494 //=============================================================================
495
496 //-----------------------------------------------------------------------------
497 // Record the sequence of commands sent by the reader to the tag, with
498 // triggering so that we start recording at the point that the tag is moved
499 // near the reader.
500 //-----------------------------------------------------------------------------
501 void RAMFUNC SnoopIso14443a(uint8_t param) {
502 // param:
503 // bit 0 - trigger from first card answer
504 // bit 1 - trigger from first reader 7-bit request
505
506 LEDsoff();
507 // init trace buffer
508 iso14a_clear_trace();
509
510 // We won't start recording the frames that we acquire until we trigger;
511 // a good trigger condition to get started is probably when we see a
512 // response from the tag.
513 // triggered == FALSE -- to wait first for card
514 bool triggered = !(param & 0x03);
515
516 // The command (reader -> tag) that we're receiving.
517 // The length of a received command will in most cases be no more than 18 bytes.
518 // So 32 should be enough!
519 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
520 // The response (tag -> reader) that we're receiving.
521 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
522
523 // As we receive stuff, we copy it from receivedCmd or receivedResponse
524 // into trace, along with its length and other annotations.
525 //uint8_t *trace = (uint8_t *)BigBuf;
526
527 // The DMA buffer, used to stream samples from the FPGA
528 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
529 uint8_t *data = dmaBuf;
530 uint8_t previous_data = 0;
531 int maxDataLen = 0;
532 int dataLen = 0;
533 bool TagIsActive = FALSE;
534 bool ReaderIsActive = FALSE;
535
536 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
537
538 // Set up the demodulator for tag -> reader responses.
539 Demod.output = receivedResponse;
540
541 // Set up the demodulator for the reader -> tag commands
542 Uart.output = receivedCmd;
543
544 // Setup and start DMA.
545 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
546
547 // And now we loop, receiving samples.
548 for(uint32_t rsamples = 0; TRUE; ) {
549
550 if(BUTTON_PRESS()) {
551 DbpString("cancelled by button");
552 break;
553 }
554
555 LED_A_ON();
556 WDT_HIT();
557
558 int register readBufDataP = data - dmaBuf;
559 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
560 if (readBufDataP <= dmaBufDataP){
561 dataLen = dmaBufDataP - readBufDataP;
562 } else {
563 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
564 }
565 // test for length of buffer
566 if(dataLen > maxDataLen) {
567 maxDataLen = dataLen;
568 if(dataLen > 400) {
569 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
570 break;
571 }
572 }
573 if(dataLen < 1) continue;
574
575 // primary buffer was stopped( <-- we lost data!
576 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
577 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
578 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
579 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
580 }
581 // secondary buffer sets as primary, secondary buffer was stopped
582 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
583 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
584 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
585 }
586
587 LED_A_OFF();
588
589 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
590
591 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
592 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
593 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
594 LED_C_ON();
595
596 // check - if there is a short 7bit request from reader
597 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
598
599 if(triggered) {
600 if (!LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, Uart.parityBits, TRUE)) break;
601 if (!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
602 }
603 /* And ready to receive another command. */
604 UartReset();
605 /* And also reset the demod code, which might have been */
606 /* false-triggered by the commands from the reader. */
607 DemodReset();
608 LED_B_OFF();
609 }
610 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
611 }
612
613 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
614 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
615 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
616 LED_B_ON();
617
618 if (!LogTrace(receivedResponse, Demod.len, Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, Demod.parityBits, FALSE)) break;
619 if (!LogTrace(NULL, 0, Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, 0, FALSE)) break;
620
621 if ((!triggered) && (param & 0x01)) triggered = TRUE;
622
623 // And ready to receive another response.
624 DemodReset();
625 LED_C_OFF();
626 }
627 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
628 }
629 }
630
631 previous_data = *data;
632 rsamples++;
633 data++;
634 if(data == dmaBuf + DMA_BUFFER_SIZE) {
635 data = dmaBuf;
636 }
637 } // main cycle
638
639 DbpString("COMMAND FINISHED");
640
641 FpgaDisableSscDma();
642 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
643 Dbprintf("traceLen=%d, Uart.output[0]=%08x", traceLen, (uint32_t)Uart.output[0]);
644 LEDsoff();
645 }
646
647 //-----------------------------------------------------------------------------
648 // Prepare tag messages
649 //-----------------------------------------------------------------------------
650 static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity)
651 {
652 int i;
653
654 ToSendReset();
655
656 // Correction bit, might be removed when not needed
657 ToSendStuffBit(0);
658 ToSendStuffBit(0);
659 ToSendStuffBit(0);
660 ToSendStuffBit(0);
661 ToSendStuffBit(1); // 1
662 ToSendStuffBit(0);
663 ToSendStuffBit(0);
664 ToSendStuffBit(0);
665
666 // Send startbit
667 ToSend[++ToSendMax] = SEC_D;
668 LastProxToAirDuration = 8 * ToSendMax - 4;
669
670 for(i = 0; i < len; i++) {
671 int j;
672 uint8_t b = cmd[i];
673
674 // Data bits
675 for(j = 0; j < 8; j++) {
676 if(b & 1) {
677 ToSend[++ToSendMax] = SEC_D;
678 } else {
679 ToSend[++ToSendMax] = SEC_E;
680 }
681 b >>= 1;
682 }
683
684 // Get the parity bit
685 if ((dwParity >> i) & 0x01) {
686 ToSend[++ToSendMax] = SEC_D;
687 LastProxToAirDuration = 8 * ToSendMax - 4;
688 } else {
689 ToSend[++ToSendMax] = SEC_E;
690 LastProxToAirDuration = 8 * ToSendMax;
691 }
692 }
693
694 // Send stopbit
695 ToSend[++ToSendMax] = SEC_F;
696
697 // Convert from last byte pos to length
698 ToSendMax++;
699 }
700
701 static void CodeIso14443aAsTag(const uint8_t *cmd, int len){
702 CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len));
703 }
704
705
706 static void Code4bitAnswerAsTag(uint8_t cmd)
707 {
708 int i;
709
710 ToSendReset();
711
712 // Correction bit, might be removed when not needed
713 ToSendStuffBit(0);
714 ToSendStuffBit(0);
715 ToSendStuffBit(0);
716 ToSendStuffBit(0);
717 ToSendStuffBit(1); // 1
718 ToSendStuffBit(0);
719 ToSendStuffBit(0);
720 ToSendStuffBit(0);
721
722 // Send startbit
723 ToSend[++ToSendMax] = SEC_D;
724
725 uint8_t b = cmd;
726 for(i = 0; i < 4; i++) {
727 if(b & 1) {
728 ToSend[++ToSendMax] = SEC_D;
729 LastProxToAirDuration = 8 * ToSendMax - 4;
730 } else {
731 ToSend[++ToSendMax] = SEC_E;
732 LastProxToAirDuration = 8 * ToSendMax;
733 }
734 b >>= 1;
735 }
736
737 // Send stopbit
738 ToSend[++ToSendMax] = SEC_F;
739
740 // Convert from last byte pos to length
741 ToSendMax++;
742 }
743
744 //-----------------------------------------------------------------------------
745 // Wait for commands from reader
746 // Stop when button is pressed
747 // Or return TRUE when command is captured
748 //-----------------------------------------------------------------------------
749 static int GetIso14443aCommandFromReader(uint8_t *received, int *len, int maxLen)
750 {
751 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
752 // only, since we are receiving, not transmitting).
753 // Signal field is off with the appropriate LED
754 LED_D_OFF();
755 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
756
757 // Now run a `software UART' on the stream of incoming samples.
758 UartReset();
759 Uart.output = received;
760
761 // clear RXRDY:
762 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
763
764 for(;;) {
765 WDT_HIT();
766
767 if(BUTTON_PRESS()) return FALSE;
768
769 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
770 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
771 if(MillerDecoding(b, 0)) {
772 *len = Uart.len;
773 return TRUE;
774 }
775 }
776 }
777 }
778
779 static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded);
780 int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
781 int EmSend4bit(uint8_t resp);
782 int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
783 int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
784 int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded);
785 int EmSendCmd(uint8_t *resp, int respLen);
786 int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par);
787 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
788 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity);
789
790 static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
791
792 typedef struct {
793 uint8_t* response;
794 size_t response_n;
795 uint8_t* modulation;
796 size_t modulation_n;
797 uint32_t ProxToAirDuration;
798 } tag_response_info_t;
799
800 void reset_free_buffer() {
801 free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
802 }
803
804 bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
805 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
806 // This will need the following byte array for a modulation sequence
807 // 144 data bits (18 * 8)
808 // 18 parity bits
809 // 2 Start and stop
810 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
811 // 1 just for the case
812 // ----------- +
813 // 166 bytes, since every bit that needs to be send costs us a byte
814 //
815
816 // Prepare the tag modulation bits from the message
817 CodeIso14443aAsTag(response_info->response,response_info->response_n);
818
819 // Make sure we do not exceed the free buffer space
820 if (ToSendMax > max_buffer_size) {
821 Dbprintf("Out of memory, when modulating bits for tag answer:");
822 Dbhexdump(response_info->response_n,response_info->response,false);
823 return false;
824 }
825
826 // Copy the byte array, used for this modulation to the buffer position
827 memcpy(response_info->modulation,ToSend,ToSendMax);
828
829 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
830 response_info->modulation_n = ToSendMax;
831 response_info->ProxToAirDuration = LastProxToAirDuration;
832
833 return true;
834 }
835
836 bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
837 // Retrieve and store the current buffer index
838 response_info->modulation = free_buffer_pointer;
839
840 // Determine the maximum size we can use from our buffer
841 size_t max_buffer_size = (((uint8_t *)BigBuf)+FREE_BUFFER_OFFSET+FREE_BUFFER_SIZE)-free_buffer_pointer;
842
843 // Forward the prepare tag modulation function to the inner function
844 if (prepare_tag_modulation(response_info,max_buffer_size)) {
845 // Update the free buffer offset
846 free_buffer_pointer += ToSendMax;
847 return true;
848 } else {
849 return false;
850 }
851 }
852
853 //-----------------------------------------------------------------------------
854 // Main loop of simulated tag: receive commands from reader, decide what
855 // response to send, and send it.
856 //-----------------------------------------------------------------------------
857 void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
858 {
859 // Enable and clear the trace
860 iso14a_clear_trace();
861 iso14a_set_tracing(TRUE);
862
863 uint8_t sak;
864
865 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
866 uint8_t response1[2];
867
868 switch (tagType) {
869 case 1: { // MIFARE Classic
870 // Says: I am Mifare 1k - original line
871 response1[0] = 0x04;
872 response1[1] = 0x00;
873 sak = 0x08;
874 } break;
875 case 2: { // MIFARE Ultralight
876 // Says: I am a stupid memory tag, no crypto
877 response1[0] = 0x04;
878 response1[1] = 0x00;
879 sak = 0x00;
880 } break;
881 case 3: { // MIFARE DESFire
882 // Says: I am a DESFire tag, ph33r me
883 response1[0] = 0x04;
884 response1[1] = 0x03;
885 sak = 0x20;
886 } break;
887 case 4: { // ISO/IEC 14443-4
888 // Says: I am a javacard (JCOP)
889 response1[0] = 0x04;
890 response1[1] = 0x00;
891 sak = 0x28;
892 } break;
893 default: {
894 Dbprintf("Error: unkown tagtype (%d)",tagType);
895 return;
896 } break;
897 }
898
899 // The second response contains the (mandatory) first 24 bits of the UID
900 uint8_t response2[5];
901
902 // Check if the uid uses the (optional) part
903 uint8_t response2a[5];
904 if (uid_2nd) {
905 response2[0] = 0x88;
906 num_to_bytes(uid_1st,3,response2+1);
907 num_to_bytes(uid_2nd,4,response2a);
908 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
909
910 // Configure the ATQA and SAK accordingly
911 response1[0] |= 0x40;
912 sak |= 0x04;
913 } else {
914 num_to_bytes(uid_1st,4,response2);
915 // Configure the ATQA and SAK accordingly
916 response1[0] &= 0xBF;
917 sak &= 0xFB;
918 }
919
920 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
921 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
922
923 // Prepare the mandatory SAK (for 4 and 7 byte UID)
924 uint8_t response3[3];
925 response3[0] = sak;
926 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
927
928 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
929 uint8_t response3a[3];
930 response3a[0] = sak & 0xFB;
931 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
932
933 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
934 uint8_t response6[] = { 0x04, 0x58, 0x00, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS
935 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
936
937 #define TAG_RESPONSE_COUNT 7
938 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
939 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
940 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
941 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
942 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
943 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
944 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
945 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
946 };
947
948 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
949 // Such a response is less time critical, so we can prepare them on the fly
950 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
951 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
952 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
953 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
954 tag_response_info_t dynamic_response_info = {
955 .response = dynamic_response_buffer,
956 .response_n = 0,
957 .modulation = dynamic_modulation_buffer,
958 .modulation_n = 0
959 };
960
961 // Reset the offset pointer of the free buffer
962 reset_free_buffer();
963
964 // Prepare the responses of the anticollision phase
965 // there will be not enough time to do this at the moment the reader sends it REQA
966 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
967 prepare_allocated_tag_modulation(&responses[i]);
968 }
969
970 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
971 int len = 0;
972
973 // To control where we are in the protocol
974 int order = 0;
975 int lastorder;
976
977 // Just to allow some checks
978 int happened = 0;
979 int happened2 = 0;
980 int cmdsRecvd = 0;
981
982 // We need to listen to the high-frequency, peak-detected path.
983 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
984
985 cmdsRecvd = 0;
986 tag_response_info_t* p_response;
987
988 LED_A_ON();
989 for(;;) {
990 // Clean receive command buffer
991
992 if(!GetIso14443aCommandFromReader(receivedCmd, &len, RECV_CMD_SIZE)) {
993 DbpString("Button press");
994 break;
995 }
996
997 p_response = NULL;
998
999 // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
1000 // Okay, look at the command now.
1001 lastorder = order;
1002 if(receivedCmd[0] == 0x26) { // Received a REQUEST
1003 p_response = &responses[0]; order = 1;
1004 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
1005 p_response = &responses[0]; order = 6;
1006 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
1007 p_response = &responses[1]; order = 2;
1008 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
1009 p_response = &responses[2]; order = 20;
1010 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
1011 p_response = &responses[3]; order = 3;
1012 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
1013 p_response = &responses[4]; order = 30;
1014 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
1015 EmSendCmdEx(data+(4*receivedCmd[0]),16,false);
1016 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1017 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1018 p_response = NULL;
1019 } else if(receivedCmd[0] == 0x50) { // Received a HALT
1020 // DbpString("Reader requested we HALT!:");
1021 if (tracing) {
1022 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1023 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1024 }
1025 p_response = NULL;
1026 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
1027 p_response = &responses[5]; order = 7;
1028 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
1029 if (tagType == 1 || tagType == 2) { // RATS not supported
1030 EmSend4bit(CARD_NACK_NA);
1031 p_response = NULL;
1032 } else {
1033 p_response = &responses[6]; order = 70;
1034 }
1035 } else if (order == 7 && len == 8) { // Received authentication request
1036 if (tracing) {
1037 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1038 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1039 }
1040 uint32_t nr = bytes_to_num(receivedCmd,4);
1041 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1042 Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr,ar);
1043 } else {
1044 // Check for ISO 14443A-4 compliant commands, look at left nibble
1045 switch (receivedCmd[0]) {
1046
1047 case 0x0B:
1048 case 0x0A: { // IBlock (command)
1049 dynamic_response_info.response[0] = receivedCmd[0];
1050 dynamic_response_info.response[1] = 0x00;
1051 dynamic_response_info.response[2] = 0x90;
1052 dynamic_response_info.response[3] = 0x00;
1053 dynamic_response_info.response_n = 4;
1054 } break;
1055
1056 case 0x1A:
1057 case 0x1B: { // Chaining command
1058 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1059 dynamic_response_info.response_n = 2;
1060 } break;
1061
1062 case 0xaa:
1063 case 0xbb: {
1064 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1065 dynamic_response_info.response_n = 2;
1066 } break;
1067
1068 case 0xBA: { //
1069 memcpy(dynamic_response_info.response,"\xAB\x00",2);
1070 dynamic_response_info.response_n = 2;
1071 } break;
1072
1073 case 0xCA:
1074 case 0xC2: { // Readers sends deselect command
1075 memcpy(dynamic_response_info.response,"\xCA\x00",2);
1076 dynamic_response_info.response_n = 2;
1077 } break;
1078
1079 default: {
1080 // Never seen this command before
1081 if (tracing) {
1082 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1083 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1084 }
1085 Dbprintf("Received unknown command (len=%d):",len);
1086 Dbhexdump(len,receivedCmd,false);
1087 // Do not respond
1088 dynamic_response_info.response_n = 0;
1089 } break;
1090 }
1091
1092 if (dynamic_response_info.response_n > 0) {
1093 // Copy the CID from the reader query
1094 dynamic_response_info.response[1] = receivedCmd[1];
1095
1096 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1097 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1098 dynamic_response_info.response_n += 2;
1099
1100 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1101 Dbprintf("Error preparing tag response");
1102 if (tracing) {
1103 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1104 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1105 }
1106 break;
1107 }
1108 p_response = &dynamic_response_info;
1109 }
1110 }
1111
1112 // Count number of wakeups received after a halt
1113 if(order == 6 && lastorder == 5) { happened++; }
1114
1115 // Count number of other messages after a halt
1116 if(order != 6 && lastorder == 5) { happened2++; }
1117
1118 if(cmdsRecvd > 999) {
1119 DbpString("1000 commands later...");
1120 break;
1121 }
1122 cmdsRecvd++;
1123
1124 if (p_response != NULL) {
1125 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1126 // do the tracing for the previous reader request and this tag answer:
1127 EmLogTrace(Uart.output,
1128 Uart.len,
1129 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1130 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1131 Uart.parityBits,
1132 p_response->response,
1133 p_response->response_n,
1134 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1135 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1136 SwapBits(GetParity(p_response->response, p_response->response_n), p_response->response_n));
1137 }
1138
1139 if (!tracing) {
1140 Dbprintf("Trace Full. Simulation stopped.");
1141 break;
1142 }
1143 }
1144
1145 Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
1146 LED_A_OFF();
1147 }
1148
1149
1150 // prepare a delayed transfer. This simply shifts ToSend[] by a number
1151 // of bits specified in the delay parameter.
1152 void PrepareDelayedTransfer(uint16_t delay)
1153 {
1154 uint8_t bitmask = 0;
1155 uint8_t bits_to_shift = 0;
1156 uint8_t bits_shifted = 0;
1157
1158 delay &= 0x07;
1159 if (delay) {
1160 for (uint16_t i = 0; i < delay; i++) {
1161 bitmask |= (0x01 << i);
1162 }
1163 ToSend[ToSendMax++] = 0x00;
1164 for (uint16_t i = 0; i < ToSendMax; i++) {
1165 bits_to_shift = ToSend[i] & bitmask;
1166 ToSend[i] = ToSend[i] >> delay;
1167 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1168 bits_shifted = bits_to_shift;
1169 }
1170 }
1171 }
1172
1173
1174 //-------------------------------------------------------------------------------------
1175 // Transmit the command (to the tag) that was placed in ToSend[].
1176 // Parameter timing:
1177 // if NULL: transfer at next possible time, taking into account
1178 // request guard time and frame delay time
1179 // if == 0: transfer immediately and return time of transfer
1180 // if != 0: delay transfer until time specified
1181 //-------------------------------------------------------------------------------------
1182 static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
1183 {
1184
1185 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1186
1187 uint32_t ThisTransferTime = 0;
1188
1189 if (timing) {
1190 if(*timing == 0) { // Measure time
1191 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
1192 } else {
1193 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1194 }
1195 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1196 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1197 LastTimeProxToAirStart = *timing;
1198 } else {
1199 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1200 while(GetCountSspClk() < ThisTransferTime);
1201 LastTimeProxToAirStart = ThisTransferTime;
1202 }
1203
1204 // clear TXRDY
1205 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1206
1207 // for(uint16_t c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission)
1208 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1209 // AT91C_BASE_SSC->SSC_THR = SEC_Y;
1210 // c++;
1211 // }
1212 // }
1213
1214 uint16_t c = 0;
1215 for(;;) {
1216 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1217 AT91C_BASE_SSC->SSC_THR = cmd[c];
1218 c++;
1219 if(c >= len) {
1220 break;
1221 }
1222 }
1223 }
1224
1225 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
1226
1227 }
1228
1229
1230 //-----------------------------------------------------------------------------
1231 // Prepare reader command (in bits, support short frames) to send to FPGA
1232 //-----------------------------------------------------------------------------
1233 void CodeIso14443aBitsAsReaderPar(const uint8_t * cmd, int bits, uint32_t dwParity)
1234 {
1235 int i, j;
1236 int last;
1237 uint8_t b;
1238
1239 ToSendReset();
1240
1241 // Start of Communication (Seq. Z)
1242 ToSend[++ToSendMax] = SEC_Z;
1243 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1244 last = 0;
1245
1246 size_t bytecount = nbytes(bits);
1247 // Generate send structure for the data bits
1248 for (i = 0; i < bytecount; i++) {
1249 // Get the current byte to send
1250 b = cmd[i];
1251 size_t bitsleft = MIN((bits-(i*8)),8);
1252
1253 for (j = 0; j < bitsleft; j++) {
1254 if (b & 1) {
1255 // Sequence X
1256 ToSend[++ToSendMax] = SEC_X;
1257 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1258 last = 1;
1259 } else {
1260 if (last == 0) {
1261 // Sequence Z
1262 ToSend[++ToSendMax] = SEC_Z;
1263 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1264 } else {
1265 // Sequence Y
1266 ToSend[++ToSendMax] = SEC_Y;
1267 last = 0;
1268 }
1269 }
1270 b >>= 1;
1271 }
1272
1273 // Only transmit (last) parity bit if we transmitted a complete byte
1274 if (j == 8) {
1275 // Get the parity bit
1276 if ((dwParity >> i) & 0x01) {
1277 // Sequence X
1278 ToSend[++ToSendMax] = SEC_X;
1279 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1280 last = 1;
1281 } else {
1282 if (last == 0) {
1283 // Sequence Z
1284 ToSend[++ToSendMax] = SEC_Z;
1285 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1286 } else {
1287 // Sequence Y
1288 ToSend[++ToSendMax] = SEC_Y;
1289 last = 0;
1290 }
1291 }
1292 }
1293 }
1294
1295 // End of Communication: Logic 0 followed by Sequence Y
1296 if (last == 0) {
1297 // Sequence Z
1298 ToSend[++ToSendMax] = SEC_Z;
1299 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1300 } else {
1301 // Sequence Y
1302 ToSend[++ToSendMax] = SEC_Y;
1303 last = 0;
1304 }
1305 ToSend[++ToSendMax] = SEC_Y;
1306
1307 // Convert to length of command:
1308 ToSendMax++;
1309 }
1310
1311 //-----------------------------------------------------------------------------
1312 // Prepare reader command to send to FPGA
1313 //-----------------------------------------------------------------------------
1314 void CodeIso14443aAsReaderPar(const uint8_t * cmd, int len, uint32_t dwParity)
1315 {
1316 CodeIso14443aBitsAsReaderPar(cmd,len*8,dwParity);
1317 }
1318
1319 //-----------------------------------------------------------------------------
1320 // Wait for commands from reader
1321 // Stop when button is pressed (return 1) or field was gone (return 2)
1322 // Or return 0 when command is captured
1323 //-----------------------------------------------------------------------------
1324 static int EmGetCmd(uint8_t *received, int *len)
1325 {
1326 *len = 0;
1327
1328 uint32_t timer = 0, vtime = 0;
1329 int analogCnt = 0;
1330 int analogAVG = 0;
1331
1332 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1333 // only, since we are receiving, not transmitting).
1334 // Signal field is off with the appropriate LED
1335 LED_D_OFF();
1336 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1337
1338 // Set ADC to read field strength
1339 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1340 AT91C_BASE_ADC->ADC_MR =
1341 ADC_MODE_PRESCALE(32) |
1342 ADC_MODE_STARTUP_TIME(16) |
1343 ADC_MODE_SAMPLE_HOLD_TIME(8);
1344 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1345 // start ADC
1346 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1347
1348 // Now run a 'software UART' on the stream of incoming samples.
1349 UartReset();
1350 Uart.output = received;
1351
1352 // Clear RXRDY:
1353 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1354
1355 for(;;) {
1356 WDT_HIT();
1357
1358 if (BUTTON_PRESS()) return 1;
1359
1360 // test if the field exists
1361 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1362 analogCnt++;
1363 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1364 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1365 if (analogCnt >= 32) {
1366 if ((33000 * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1367 vtime = GetTickCount();
1368 if (!timer) timer = vtime;
1369 // 50ms no field --> card to idle state
1370 if (vtime - timer > 50) return 2;
1371 } else
1372 if (timer) timer = 0;
1373 analogCnt = 0;
1374 analogAVG = 0;
1375 }
1376 }
1377
1378 // receive and test the miller decoding
1379 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1380 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1381 if(MillerDecoding(b, 0)) {
1382 *len = Uart.len;
1383 return 0;
1384 }
1385 }
1386
1387 }
1388 }
1389
1390
1391 static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded)
1392 {
1393 uint8_t b;
1394 uint16_t i = 0;
1395 uint32_t ThisTransferTime;
1396
1397 // Modulate Manchester
1398 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1399
1400 // include correction bit if necessary
1401 if (Uart.parityBits & 0x01) {
1402 correctionNeeded = TRUE;
1403 }
1404 if(correctionNeeded) {
1405 // 1236, so correction bit needed
1406 i = 0;
1407 } else {
1408 i = 1;
1409 }
1410
1411 // clear receiving shift register and holding register
1412 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1413 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1414 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1415 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1416
1417 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1418 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1419 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1420 if (AT91C_BASE_SSC->SSC_RHR) break;
1421 }
1422
1423 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1424
1425 // Clear TXRDY:
1426 AT91C_BASE_SSC->SSC_THR = SEC_F;
1427
1428 // send cycle
1429 for(; i <= respLen; ) {
1430 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1431 AT91C_BASE_SSC->SSC_THR = resp[i++];
1432 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1433 }
1434
1435 if(BUTTON_PRESS()) {
1436 break;
1437 }
1438 }
1439
1440 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1441 for (i = 0; i < 2 ; ) {
1442 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1443 AT91C_BASE_SSC->SSC_THR = SEC_F;
1444 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1445 i++;
1446 }
1447 }
1448
1449 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1450
1451 return 0;
1452 }
1453
1454 int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1455 Code4bitAnswerAsTag(resp);
1456 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1457 // do the tracing for the previous reader request and this tag answer:
1458 EmLogTrace(Uart.output,
1459 Uart.len,
1460 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1461 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1462 Uart.parityBits,
1463 &resp,
1464 1,
1465 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1466 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1467 SwapBits(GetParity(&resp, 1), 1));
1468 return res;
1469 }
1470
1471 int EmSend4bit(uint8_t resp){
1472 return EmSend4bitEx(resp, false);
1473 }
1474
1475 int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par){
1476 CodeIso14443aAsTagPar(resp, respLen, par);
1477 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1478 // do the tracing for the previous reader request and this tag answer:
1479 EmLogTrace(Uart.output,
1480 Uart.len,
1481 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1482 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1483 Uart.parityBits,
1484 resp,
1485 respLen,
1486 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1487 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1488 SwapBits(GetParity(resp, respLen), respLen));
1489 return res;
1490 }
1491
1492 int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded){
1493 return EmSendCmdExPar(resp, respLen, correctionNeeded, GetParity(resp, respLen));
1494 }
1495
1496 int EmSendCmd(uint8_t *resp, int respLen){
1497 return EmSendCmdExPar(resp, respLen, false, GetParity(resp, respLen));
1498 }
1499
1500 int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
1501 return EmSendCmdExPar(resp, respLen, false, par);
1502 }
1503
1504 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
1505 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity)
1506 {
1507 if (tracing) {
1508 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1509 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1510 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1511 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1512 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1513 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1514 reader_EndTime = tag_StartTime - exact_fdt;
1515 reader_StartTime = reader_EndTime - reader_modlen;
1516 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_Parity, TRUE)) {
1517 return FALSE;
1518 } else if (!LogTrace(NULL, 0, reader_EndTime, 0, TRUE)) {
1519 return FALSE;
1520 } else if (!LogTrace(tag_data, tag_len, tag_StartTime, tag_Parity, FALSE)) {
1521 return FALSE;
1522 } else {
1523 return (!LogTrace(NULL, 0, tag_EndTime, 0, FALSE));
1524 }
1525 } else {
1526 return TRUE;
1527 }
1528 }
1529
1530 //-----------------------------------------------------------------------------
1531 // Wait a certain time for tag response
1532 // If a response is captured return TRUE
1533 // If it takes too long return FALSE
1534 //-----------------------------------------------------------------------------
1535 static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen)
1536 {
1537 uint16_t c;
1538
1539 // Set FPGA mode to "reader listen mode", no modulation (listen
1540 // only, since we are receiving, not transmitting).
1541 // Signal field is on with the appropriate LED
1542 LED_D_ON();
1543 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1544
1545 // Now get the answer from the card
1546 DemodReset();
1547 Demod.output = receivedResponse;
1548
1549 // clear RXRDY:
1550 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1551
1552 c = 0;
1553 for(;;) {
1554 WDT_HIT();
1555
1556 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1557 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1558 if(ManchesterDecoding(b, offset, 0)) {
1559 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
1560 return TRUE;
1561 } else if(c++ > iso14a_timeout) {
1562 return FALSE;
1563 }
1564 }
1565 }
1566 }
1567
1568 void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing)
1569 {
1570
1571 CodeIso14443aBitsAsReaderPar(frame,bits,par);
1572
1573 // Send command to tag
1574 TransmitFor14443a(ToSend, ToSendMax, timing);
1575 if(trigger)
1576 LED_A_ON();
1577
1578 // Log reader command in trace buffer
1579 if (tracing) {
1580 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1581 LogTrace(NULL, 0, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, 0, TRUE);
1582 }
1583 }
1584
1585 void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing)
1586 {
1587 ReaderTransmitBitsPar(frame,len*8,par, timing);
1588 }
1589
1590 void ReaderTransmitBits(uint8_t* frame, int len, uint32_t *timing)
1591 {
1592 // Generate parity and redirect
1593 ReaderTransmitBitsPar(frame,len,GetParity(frame,len/8), timing);
1594 }
1595
1596 void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing)
1597 {
1598 // Generate parity and redirect
1599 ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing);
1600 }
1601
1602 int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
1603 {
1604 if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160)) return FALSE;
1605 if (tracing) {
1606 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
1607 LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
1608 }
1609 return Demod.len;
1610 }
1611
1612 int ReaderReceive(uint8_t* receivedAnswer)
1613 {
1614 return ReaderReceiveOffset(receivedAnswer, 0);
1615 }
1616
1617 int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
1618 {
1619 if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160)) return FALSE;
1620 if (tracing) {
1621 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
1622 LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
1623 }
1624 *parptr = Demod.parityBits;
1625 return Demod.len;
1626 }
1627
1628 /* performs iso14443a anticollision procedure
1629 * fills the uid pointer unless NULL
1630 * fills resp_data unless NULL */
1631 int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) {
1632 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1633 uint8_t sel_all[] = { 0x93,0x20 };
1634 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1635 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1636 uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes
1637 byte_t uid_resp[4];
1638 size_t uid_resp_len;
1639
1640 uint8_t sak = 0x04; // cascade uid
1641 int cascade_level = 0;
1642 int len;
1643
1644 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1645 ReaderTransmitBitsPar(wupa,7,0, NULL);
1646
1647 // Receive the ATQA
1648 if(!ReaderReceive(resp)) return 0;
1649 // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
1650
1651 if(p_hi14a_card) {
1652 memcpy(p_hi14a_card->atqa, resp, 2);
1653 p_hi14a_card->uidlen = 0;
1654 memset(p_hi14a_card->uid,0,10);
1655 }
1656
1657 // clear uid
1658 if (uid_ptr) {
1659 memset(uid_ptr,0,10);
1660 }
1661
1662 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1663 // which case we need to make a cascade 2 request and select - this is a long UID
1664 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1665 for(; sak & 0x04; cascade_level++) {
1666 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1667 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1668
1669 // SELECT_ALL
1670 ReaderTransmit(sel_all,sizeof(sel_all), NULL);
1671 if (!ReaderReceive(resp)) return 0;
1672
1673 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1674 memset(uid_resp, 0, 4);
1675 uint16_t uid_resp_bits = 0;
1676 uint16_t collision_answer_offset = 0;
1677 // anti-collision-loop:
1678 while (Demod.collisionPos) {
1679 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1680 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1681 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1682 uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8);
1683 }
1684 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1685 uid_resp_bits++;
1686 // construct anticollosion command:
1687 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1688 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1689 sel_uid[2+i] = uid_resp[i];
1690 }
1691 collision_answer_offset = uid_resp_bits%8;
1692 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1693 if (!ReaderReceiveOffset(resp, collision_answer_offset)) return 0;
1694 }
1695 // finally, add the last bits and BCC of the UID
1696 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1697 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1698 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1699 }
1700
1701 } else { // no collision, use the response to SELECT_ALL as current uid
1702 memcpy(uid_resp,resp,4);
1703 }
1704 uid_resp_len = 4;
1705 // Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
1706
1707 // calculate crypto UID. Always use last 4 Bytes.
1708 if(cuid_ptr) {
1709 *cuid_ptr = bytes_to_num(uid_resp, 4);
1710 }
1711
1712 // Construct SELECT UID command
1713 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1714 memcpy(sel_uid+2,uid_resp,4); // the UID
1715 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1716 AppendCrc14443a(sel_uid,7); // calculate and add CRC
1717 ReaderTransmit(sel_uid,sizeof(sel_uid), NULL);
1718
1719 // Receive the SAK
1720 if (!ReaderReceive(resp)) return 0;
1721 sak = resp[0];
1722
1723 // Test if more parts of the uid are comming
1724 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
1725 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1726 // http://www.nxp.com/documents/application_note/AN10927.pdf
1727 memcpy(uid_resp, uid_resp + 1, 3);
1728 uid_resp_len = 3;
1729 }
1730
1731 if(uid_ptr) {
1732 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
1733 }
1734
1735 if(p_hi14a_card) {
1736 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
1737 p_hi14a_card->uidlen += uid_resp_len;
1738 }
1739 }
1740
1741 if(p_hi14a_card) {
1742 p_hi14a_card->sak = sak;
1743 p_hi14a_card->ats_len = 0;
1744 }
1745
1746 if( (sak & 0x20) == 0) {
1747 return 2; // non iso14443a compliant tag
1748 }
1749
1750 // Request for answer to select
1751 AppendCrc14443a(rats, 2);
1752 ReaderTransmit(rats, sizeof(rats), NULL);
1753
1754 if (!(len = ReaderReceive(resp))) return 0;
1755
1756 if(p_hi14a_card) {
1757 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
1758 p_hi14a_card->ats_len = len;
1759 }
1760
1761 // reset the PCB block number
1762 iso14_pcb_blocknum = 0;
1763 return 1;
1764 }
1765
1766 void iso14443a_setup(uint8_t fpga_minor_mode) {
1767 // Set up the synchronous serial port
1768 FpgaSetupSsc();
1769 // connect Demodulated Signal to ADC:
1770 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1771
1772 // Signal field is on with the appropriate LED
1773 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
1774 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
1775 LED_D_ON();
1776 } else {
1777 LED_D_OFF();
1778 }
1779 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
1780
1781 // Start the timer
1782 StartCountSspClk();
1783
1784 DemodReset();
1785 UartReset();
1786 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
1787 iso14a_set_timeout(1050); // 10ms default
1788 }
1789
1790 int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) {
1791 uint8_t real_cmd[cmd_len+4];
1792 real_cmd[0] = 0x0a; //I-Block
1793 // put block number into the PCB
1794 real_cmd[0] |= iso14_pcb_blocknum;
1795 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
1796 memcpy(real_cmd+2, cmd, cmd_len);
1797 AppendCrc14443a(real_cmd,cmd_len+2);
1798
1799 ReaderTransmit(real_cmd, cmd_len+4, NULL);
1800 size_t len = ReaderReceive(data);
1801 uint8_t * data_bytes = (uint8_t *) data;
1802 if (!len)
1803 return 0; //DATA LINK ERROR
1804 // if we received an I- or R(ACK)-Block with a block number equal to the
1805 // current block number, toggle the current block number
1806 else if (len >= 4 // PCB+CID+CRC = 4 bytes
1807 && ((data_bytes[0] & 0xC0) == 0 // I-Block
1808 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1809 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
1810 {
1811 iso14_pcb_blocknum ^= 1;
1812 }
1813
1814 return len;
1815 }
1816
1817 //-----------------------------------------------------------------------------
1818 // Read an ISO 14443a tag. Send out commands and store answers.
1819 //
1820 //-----------------------------------------------------------------------------
1821 void ReaderIso14443a(UsbCommand *c)
1822 {
1823 iso14a_command_t param = c->arg[0];
1824 uint8_t *cmd = c->d.asBytes;
1825 size_t len = c->arg[1];
1826 size_t lenbits = c->arg[2];
1827 uint32_t arg0 = 0;
1828 byte_t buf[USB_CMD_DATA_SIZE];
1829
1830 if(param & ISO14A_CONNECT) {
1831 iso14a_clear_trace();
1832 }
1833
1834 iso14a_set_tracing(TRUE);
1835
1836 if(param & ISO14A_REQUEST_TRIGGER) {
1837 iso14a_set_trigger(TRUE);
1838 }
1839
1840 if(param & ISO14A_CONNECT) {
1841 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1842 if(!(param & ISO14A_NO_SELECT)) {
1843 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
1844 arg0 = iso14443a_select_card(NULL,card,NULL);
1845 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
1846 }
1847 }
1848
1849 if(param & ISO14A_SET_TIMEOUT) {
1850 iso14a_timeout = c->arg[2];
1851 }
1852
1853 if(param & ISO14A_APDU) {
1854 arg0 = iso14_apdu(cmd, len, buf);
1855 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
1856 }
1857
1858 if(param & ISO14A_RAW) {
1859 if(param & ISO14A_APPEND_CRC) {
1860 AppendCrc14443a(cmd,len);
1861 len += 2;
1862 }
1863 if(lenbits>0) {
1864 ReaderTransmitBitsPar(cmd,lenbits,GetParity(cmd,lenbits/8), NULL);
1865 } else {
1866 ReaderTransmit(cmd,len, NULL);
1867 }
1868 arg0 = ReaderReceive(buf);
1869 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
1870 }
1871
1872 if(param & ISO14A_REQUEST_TRIGGER) {
1873 iso14a_set_trigger(FALSE);
1874 }
1875
1876 if(param & ISO14A_NO_DISCONNECT) {
1877 return;
1878 }
1879
1880 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1881 LEDsoff();
1882 }
1883
1884
1885 // Determine the distance between two nonces.
1886 // Assume that the difference is small, but we don't know which is first.
1887 // Therefore try in alternating directions.
1888 int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
1889
1890 uint16_t i;
1891 uint32_t nttmp1, nttmp2;
1892
1893 if (nt1 == nt2) return 0;
1894
1895 nttmp1 = nt1;
1896 nttmp2 = nt2;
1897
1898 for (i = 1; i < 32768; i++) {
1899 nttmp1 = prng_successor(nttmp1, 1);
1900 if (nttmp1 == nt2) return i;
1901 nttmp2 = prng_successor(nttmp2, 1);
1902 if (nttmp2 == nt1) return -i;
1903 }
1904
1905 return(-99999); // either nt1 or nt2 are invalid nonces
1906 }
1907
1908
1909 //-----------------------------------------------------------------------------
1910 // Recover several bits of the cypher stream. This implements (first stages of)
1911 // the algorithm described in "The Dark Side of Security by Obscurity and
1912 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
1913 // (article by Nicolas T. Courtois, 2009)
1914 //-----------------------------------------------------------------------------
1915 void ReaderMifare(bool first_try)
1916 {
1917 // Mifare AUTH
1918 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
1919 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
1920 static uint8_t mf_nr_ar3;
1921
1922 uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
1923
1924 iso14a_clear_trace();
1925 iso14a_set_tracing(TRUE);
1926
1927 byte_t nt_diff = 0;
1928 byte_t par = 0;
1929 //byte_t par_mask = 0xff;
1930 static byte_t par_low = 0;
1931 bool led_on = TRUE;
1932 uint8_t uid[10];
1933 uint32_t cuid;
1934
1935 uint32_t nt, previous_nt;
1936 static uint32_t nt_attacked = 0;
1937 byte_t par_list[8] = {0,0,0,0,0,0,0,0};
1938 byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
1939
1940 static uint32_t sync_time;
1941 static uint32_t sync_cycles;
1942 int catch_up_cycles = 0;
1943 int last_catch_up = 0;
1944 uint16_t consecutive_resyncs = 0;
1945 int isOK = 0;
1946
1947
1948
1949 if (first_try) {
1950 mf_nr_ar3 = 0;
1951 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
1952 sync_time = GetCountSspClk() & 0xfffffff8;
1953 sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
1954 nt_attacked = 0;
1955 nt = 0;
1956 par = 0;
1957 }
1958 else {
1959 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
1960 // nt_attacked = prng_successor(nt_attacked, 1);
1961 mf_nr_ar3++;
1962 mf_nr_ar[3] = mf_nr_ar3;
1963 par = par_low;
1964 }
1965
1966 LED_A_ON();
1967 LED_B_OFF();
1968 LED_C_OFF();
1969
1970
1971 for(uint16_t i = 0; TRUE; i++) {
1972
1973 WDT_HIT();
1974
1975 // Test if the action was cancelled
1976 if(BUTTON_PRESS()) {
1977 break;
1978 }
1979
1980 LED_C_ON();
1981
1982 if(!iso14443a_select_card(uid, NULL, &cuid)) {
1983 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
1984 continue;
1985 }
1986
1987 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
1988 catch_up_cycles = 0;
1989
1990 // if we missed the sync time already, advance to the next nonce repeat
1991 while(GetCountSspClk() > sync_time) {
1992 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
1993 }
1994
1995 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
1996 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
1997
1998 // Receive the (4 Byte) "random" nonce
1999 if (!ReaderReceive(receivedAnswer)) {
2000 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2001 continue;
2002 }
2003
2004 previous_nt = nt;
2005 nt = bytes_to_num(receivedAnswer, 4);
2006
2007 // Transmit reader nonce with fake par
2008 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
2009
2010 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2011 int nt_distance = dist_nt(previous_nt, nt);
2012 if (nt_distance == 0) {
2013 nt_attacked = nt;
2014 }
2015 else {
2016 if (nt_distance == -99999) { // invalid nonce received, try again
2017 continue;
2018 }
2019 sync_cycles = (sync_cycles - nt_distance);
2020 if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
2021 continue;
2022 }
2023 }
2024
2025 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2026 catch_up_cycles = -dist_nt(nt_attacked, nt);
2027 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2028 catch_up_cycles = 0;
2029 continue;
2030 }
2031 if (catch_up_cycles == last_catch_up) {
2032 consecutive_resyncs++;
2033 }
2034 else {
2035 last_catch_up = catch_up_cycles;
2036 consecutive_resyncs = 0;
2037 }
2038 if (consecutive_resyncs < 3) {
2039 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
2040 }
2041 else {
2042 sync_cycles = sync_cycles + catch_up_cycles;
2043 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
2044 }
2045 continue;
2046 }
2047
2048 consecutive_resyncs = 0;
2049
2050 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2051 if (ReaderReceive(receivedAnswer))
2052 {
2053 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2054
2055 if (nt_diff == 0)
2056 {
2057 par_low = par & 0x07; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2058 }
2059
2060 led_on = !led_on;
2061 if(led_on) LED_B_ON(); else LED_B_OFF();
2062
2063 par_list[nt_diff] = par;
2064 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2065
2066 // Test if the information is complete
2067 if (nt_diff == 0x07) {
2068 isOK = 1;
2069 break;
2070 }
2071
2072 nt_diff = (nt_diff + 1) & 0x07;
2073 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2074 par = par_low;
2075 } else {
2076 if (nt_diff == 0 && first_try)
2077 {
2078 par++;
2079 } else {
2080 par = (((par >> 3) + 1) << 3) | par_low;
2081 }
2082 }
2083 }
2084
2085
2086 mf_nr_ar[3] &= 0x1F;
2087
2088 byte_t buf[28];
2089 memcpy(buf + 0, uid, 4);
2090 num_to_bytes(nt, 4, buf + 4);
2091 memcpy(buf + 8, par_list, 8);
2092 memcpy(buf + 16, ks_list, 8);
2093 memcpy(buf + 24, mf_nr_ar, 4);
2094
2095 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2096
2097 // Thats it...
2098 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2099 LEDsoff();
2100
2101 iso14a_set_tracing(FALSE);
2102 }
2103
2104 /**
2105 *MIFARE 1K simulate.
2106 *
2107 *@param flags :
2108 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2109 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2110 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2111 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2112 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2113 */
2114 void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
2115 {
2116 int cardSTATE = MFEMUL_NOFIELD;
2117 int _7BUID = 0;
2118 int vHf = 0; // in mV
2119 int res;
2120 uint32_t selTimer = 0;
2121 uint32_t authTimer = 0;
2122 uint32_t par = 0;
2123 int len = 0;
2124 uint8_t cardWRBL = 0;
2125 uint8_t cardAUTHSC = 0;
2126 uint8_t cardAUTHKEY = 0xff; // no authentication
2127 uint32_t cardRr = 0;
2128 uint32_t cuid = 0;
2129 //uint32_t rn_enc = 0;
2130 uint32_t ans = 0;
2131 uint32_t cardINTREG = 0;
2132 uint8_t cardINTBLOCK = 0;
2133 struct Crypto1State mpcs = {0, 0};
2134 struct Crypto1State *pcs;
2135 pcs = &mpcs;
2136 uint32_t numReads = 0;//Counts numer of times reader read a block
2137 uint8_t* receivedCmd = eml_get_bigbufptr_recbuf();
2138 uint8_t *response = eml_get_bigbufptr_sendbuf();
2139
2140 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2141 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2142 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2143 uint8_t rSAK[] = {0x08, 0xb6, 0xdd};
2144 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
2145
2146 uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
2147 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
2148
2149 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2150 // This can be used in a reader-only attack.
2151 // (it can also be retrieved via 'hf 14a list', but hey...
2152 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0};
2153 uint8_t ar_nr_collected = 0;
2154
2155 // clear trace
2156 iso14a_clear_trace();
2157 iso14a_set_tracing(TRUE);
2158
2159 // Authenticate response - nonce
2160 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
2161
2162 //-- Determine the UID
2163 // Can be set from emulator memory, incoming data
2164 // and can be 7 or 4 bytes long
2165 if (flags & FLAG_4B_UID_IN_DATA)
2166 {
2167 // 4B uid comes from data-portion of packet
2168 memcpy(rUIDBCC1,datain,4);
2169 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2170
2171 } else if (flags & FLAG_7B_UID_IN_DATA) {
2172 // 7B uid comes from data-portion of packet
2173 memcpy(&rUIDBCC1[1],datain,3);
2174 memcpy(rUIDBCC2, datain+3, 4);
2175 _7BUID = true;
2176 } else {
2177 // get UID from emul memory
2178 emlGetMemBt(receivedCmd, 7, 1);
2179 _7BUID = !(receivedCmd[0] == 0x00);
2180 if (!_7BUID) { // ---------- 4BUID
2181 emlGetMemBt(rUIDBCC1, 0, 4);
2182 } else { // ---------- 7BUID
2183 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2184 emlGetMemBt(rUIDBCC2, 3, 4);
2185 }
2186 }
2187
2188 /*
2189 * Regardless of what method was used to set the UID, set fifth byte and modify
2190 * the ATQA for 4 or 7-byte UID
2191 */
2192 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2193 if (_7BUID) {
2194 rATQA[0] = 0x44;
2195 rUIDBCC1[0] = 0x88;
2196 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2197 }
2198
2199 // We need to listen to the high-frequency, peak-detected path.
2200 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
2201
2202
2203 if (MF_DBGLEVEL >= 1) {
2204 if (!_7BUID) {
2205 Dbprintf("4B UID: %02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3]);
2206 } else {
2207 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3],rUIDBCC2[0],rUIDBCC2[1] ,rUIDBCC2[2] , rUIDBCC2[3]);
2208 }
2209 }
2210
2211 bool finished = FALSE;
2212 while (!BUTTON_PRESS() && !finished) {
2213 WDT_HIT();
2214
2215 // find reader field
2216 // Vref = 3300mV, and an 10:1 voltage divider on the input
2217 // can measure voltages up to 33000 mV
2218 if (cardSTATE == MFEMUL_NOFIELD) {
2219 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
2220 if (vHf > MF_MINFIELDV) {
2221 cardSTATE_TO_IDLE();
2222 LED_A_ON();
2223 }
2224 }
2225 if(cardSTATE == MFEMUL_NOFIELD) continue;
2226
2227 //Now, get data
2228
2229 res = EmGetCmd(receivedCmd, &len);
2230 if (res == 2) { //Field is off!
2231 cardSTATE = MFEMUL_NOFIELD;
2232 LEDsoff();
2233 continue;
2234 } else if (res == 1) {
2235 break; //return value 1 means button press
2236 }
2237
2238 // REQ or WUP request in ANY state and WUP in HALTED state
2239 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2240 selTimer = GetTickCount();
2241 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2242 cardSTATE = MFEMUL_SELECT1;
2243
2244 // init crypto block
2245 LED_B_OFF();
2246 LED_C_OFF();
2247 crypto1_destroy(pcs);
2248 cardAUTHKEY = 0xff;
2249 continue;
2250 }
2251
2252 switch (cardSTATE) {
2253 case MFEMUL_NOFIELD:
2254 case MFEMUL_HALTED:
2255 case MFEMUL_IDLE:{
2256 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2257 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2258 break;
2259 }
2260 case MFEMUL_SELECT1:{
2261 // select all
2262 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
2263 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
2264 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
2265 break;
2266 }
2267
2268 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2269 {
2270 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2271 }
2272 // select card
2273 if (len == 9 &&
2274 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
2275 EmSendCmd(_7BUID?rSAK1:rSAK, sizeof(_7BUID?rSAK1:rSAK));
2276 cuid = bytes_to_num(rUIDBCC1, 4);
2277 if (!_7BUID) {
2278 cardSTATE = MFEMUL_WORK;
2279 LED_B_ON();
2280 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2281 break;
2282 } else {
2283 cardSTATE = MFEMUL_SELECT2;
2284 }
2285 }
2286 break;
2287 }
2288 case MFEMUL_AUTH1:{
2289 if( len != 8)
2290 {
2291 cardSTATE_TO_IDLE();
2292 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2293 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2294 break;
2295 }
2296 uint32_t ar = bytes_to_num(receivedCmd, 4);
2297 uint32_t nr= bytes_to_num(&receivedCmd[4], 4);
2298
2299 //Collect AR/NR
2300 if(ar_nr_collected < 2){
2301 if(ar_nr_responses[2] != ar)
2302 {// Avoid duplicates... probably not necessary, ar should vary.
2303 ar_nr_responses[ar_nr_collected*4] = cuid;
2304 ar_nr_responses[ar_nr_collected*4+1] = nonce;
2305 ar_nr_responses[ar_nr_collected*4+2] = ar;
2306 ar_nr_responses[ar_nr_collected*4+3] = nr;
2307 ar_nr_collected++;
2308 }
2309 }
2310
2311 // --- crypto
2312 crypto1_word(pcs, ar , 1);
2313 cardRr = nr ^ crypto1_word(pcs, 0, 0);
2314
2315 // test if auth OK
2316 if (cardRr != prng_successor(nonce, 64)){
2317 if (MF_DBGLEVEL >= 2) Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x",cardRr, prng_successor(nonce, 64));
2318 // Shouldn't we respond anything here?
2319 // Right now, we don't nack or anything, which causes the
2320 // reader to do a WUPA after a while. /Martin
2321 cardSTATE_TO_IDLE();
2322 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2323 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2324 break;
2325 }
2326
2327 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2328
2329 num_to_bytes(ans, 4, rAUTH_AT);
2330 // --- crypto
2331 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2332 LED_C_ON();
2333 cardSTATE = MFEMUL_WORK;
2334 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED. sector=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer);
2335 break;
2336 }
2337 case MFEMUL_SELECT2:{
2338 if (!len) {
2339 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2340 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2341 break;
2342 }
2343 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
2344 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
2345 break;
2346 }
2347
2348 // select 2 card
2349 if (len == 9 &&
2350 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2351 EmSendCmd(rSAK, sizeof(rSAK));
2352 cuid = bytes_to_num(rUIDBCC2, 4);
2353 cardSTATE = MFEMUL_WORK;
2354 LED_B_ON();
2355 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
2356 break;
2357 }
2358
2359 // i guess there is a command). go into the work state.
2360 if (len != 4) {
2361 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2362 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2363 break;
2364 }
2365 cardSTATE = MFEMUL_WORK;
2366 //goto lbWORK;
2367 //intentional fall-through to the next case-stmt
2368 }
2369
2370 case MFEMUL_WORK:{
2371 if (len == 0) {
2372 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2373 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2374 break;
2375 }
2376
2377 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2378
2379 if(encrypted_data) {
2380 // decrypt seqence
2381 mf_crypto1_decrypt(pcs, receivedCmd, len);
2382 }
2383
2384 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2385 authTimer = GetTickCount();
2386 cardAUTHSC = receivedCmd[1] / 4; // received block num
2387 cardAUTHKEY = receivedCmd[0] - 0x60;
2388 crypto1_destroy(pcs);//Added by martin
2389 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
2390
2391 if (!encrypted_data) { // first authentication
2392 if (MF_DBGLEVEL >= 2) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2393
2394 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2395 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
2396 } else { // nested authentication
2397 if (MF_DBGLEVEL >= 2) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2398 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
2399 num_to_bytes(ans, 4, rAUTH_AT);
2400 }
2401 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2402 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2403 cardSTATE = MFEMUL_AUTH1;
2404 break;
2405 }
2406
2407 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2408 // BUT... ACK --> NACK
2409 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2410 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2411 break;
2412 }
2413
2414 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2415 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2416 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2417 break;
2418 }
2419
2420 if(len != 4) {
2421 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2422 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2423 break;
2424 }
2425
2426 if(receivedCmd[0] == 0x30 // read block
2427 || receivedCmd[0] == 0xA0 // write block
2428 || receivedCmd[0] == 0xC0
2429 || receivedCmd[0] == 0xC1
2430 || receivedCmd[0] == 0xC2 // inc dec restore
2431 || receivedCmd[0] == 0xB0) { // transfer
2432 if (receivedCmd[1] >= 16 * 4) {
2433 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2434 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2435 break;
2436 }
2437
2438 if (receivedCmd[1] / 4 != cardAUTHSC) {
2439 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2440 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
2441 break;
2442 }
2443 }
2444 // read block
2445 if (receivedCmd[0] == 0x30) {
2446 if (MF_DBGLEVEL >= 2) {
2447 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2448 }
2449 emlGetMem(response, receivedCmd[1], 1);
2450 AppendCrc14443a(response, 16);
2451 mf_crypto1_encrypt(pcs, response, 18, &par);
2452 EmSendCmdPar(response, 18, par);
2453 numReads++;
2454 if(exitAfterNReads > 0 && numReads == exitAfterNReads) {
2455 Dbprintf("%d reads done, exiting", numReads);
2456 finished = true;
2457 }
2458 break;
2459 }
2460 // write block
2461 if (receivedCmd[0] == 0xA0) {
2462 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
2463 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2464 cardSTATE = MFEMUL_WRITEBL2;
2465 cardWRBL = receivedCmd[1];
2466 break;
2467 }
2468 // increment, decrement, restore
2469 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
2470 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2471 if (emlCheckValBl(receivedCmd[1])) {
2472 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
2473 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2474 break;
2475 }
2476 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2477 if (receivedCmd[0] == 0xC1)
2478 cardSTATE = MFEMUL_INTREG_INC;
2479 if (receivedCmd[0] == 0xC0)
2480 cardSTATE = MFEMUL_INTREG_DEC;
2481 if (receivedCmd[0] == 0xC2)
2482 cardSTATE = MFEMUL_INTREG_REST;
2483 cardWRBL = receivedCmd[1];
2484 break;
2485 }
2486 // transfer
2487 if (receivedCmd[0] == 0xB0) {
2488 if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2489 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2490 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2491 else
2492 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2493 break;
2494 }
2495 // halt
2496 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
2497 LED_B_OFF();
2498 LED_C_OFF();
2499 cardSTATE = MFEMUL_HALTED;
2500 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
2501 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2502 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2503 break;
2504 }
2505 // RATS
2506 if (receivedCmd[0] == 0xe0) {//RATS
2507 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2508 break;
2509 }
2510 // command not allowed
2511 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2512 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2513 break;
2514 }
2515 case MFEMUL_WRITEBL2:{
2516 if (len == 18){
2517 mf_crypto1_decrypt(pcs, receivedCmd, len);
2518 emlSetMem(receivedCmd, cardWRBL, 1);
2519 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2520 cardSTATE = MFEMUL_WORK;
2521 } else {
2522 cardSTATE_TO_IDLE();
2523 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2524 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2525 }
2526 break;
2527 }
2528
2529 case MFEMUL_INTREG_INC:{
2530 mf_crypto1_decrypt(pcs, receivedCmd, len);
2531 memcpy(&ans, receivedCmd, 4);
2532 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2533 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2534 cardSTATE_TO_IDLE();
2535 break;
2536 }
2537 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2538 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2539 cardINTREG = cardINTREG + ans;
2540 cardSTATE = MFEMUL_WORK;
2541 break;
2542 }
2543 case MFEMUL_INTREG_DEC:{
2544 mf_crypto1_decrypt(pcs, receivedCmd, len);
2545 memcpy(&ans, receivedCmd, 4);
2546 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2547 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2548 cardSTATE_TO_IDLE();
2549 break;
2550 }
2551 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2552 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2553 cardINTREG = cardINTREG - ans;
2554 cardSTATE = MFEMUL_WORK;
2555 break;
2556 }
2557 case MFEMUL_INTREG_REST:{
2558 mf_crypto1_decrypt(pcs, receivedCmd, len);
2559 memcpy(&ans, receivedCmd, 4);
2560 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2561 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2562 cardSTATE_TO_IDLE();
2563 break;
2564 }
2565 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2566 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2567 cardSTATE = MFEMUL_WORK;
2568 break;
2569 }
2570 }
2571 }
2572
2573 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2574 LEDsoff();
2575
2576 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2577 {
2578 //May just aswell send the collected ar_nr in the response aswell
2579 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,0,0,&ar_nr_responses,ar_nr_collected*4*4);
2580 }
2581
2582 if(flags & FLAG_NR_AR_ATTACK)
2583 {
2584 if(ar_nr_collected > 1) {
2585 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
2586 Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
2587 ar_nr_responses[0], // UID
2588 ar_nr_responses[1], //NT
2589 ar_nr_responses[2], //AR1
2590 ar_nr_responses[3], //NR1
2591 ar_nr_responses[6], //AR2
2592 ar_nr_responses[7] //NR2
2593 );
2594 } else {
2595 Dbprintf("Failed to obtain two AR/NR pairs!");
2596 if(ar_nr_collected >0) {
2597 Dbprintf("Only got these: UID=%08x, nonce=%08x, AR1=%08x, NR1=%08x",
2598 ar_nr_responses[0], // UID
2599 ar_nr_responses[1], //NT
2600 ar_nr_responses[2], //AR1
2601 ar_nr_responses[3] //NR1
2602 );
2603 }
2604 }
2605 }
2606 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, traceLen);
2607 }
2608
2609
2610
2611 //-----------------------------------------------------------------------------
2612 // MIFARE sniffer.
2613 //
2614 //-----------------------------------------------------------------------------
2615 void RAMFUNC SniffMifare(uint8_t param) {
2616 // param:
2617 // bit 0 - trigger from first card answer
2618 // bit 1 - trigger from first reader 7-bit request
2619
2620 // C(red) A(yellow) B(green)
2621 LEDsoff();
2622 // init trace buffer
2623 iso14a_clear_trace();
2624
2625 // The command (reader -> tag) that we're receiving.
2626 // The length of a received command will in most cases be no more than 18 bytes.
2627 // So 32 should be enough!
2628 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
2629 // The response (tag -> reader) that we're receiving.
2630 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
2631
2632 // As we receive stuff, we copy it from receivedCmd or receivedResponse
2633 // into trace, along with its length and other annotations.
2634 //uint8_t *trace = (uint8_t *)BigBuf;
2635
2636 // The DMA buffer, used to stream samples from the FPGA
2637 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
2638 uint8_t *data = dmaBuf;
2639 uint8_t previous_data = 0;
2640 int maxDataLen = 0;
2641 int dataLen = 0;
2642 bool ReaderIsActive = FALSE;
2643 bool TagIsActive = FALSE;
2644
2645 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
2646
2647 // Set up the demodulator for tag -> reader responses.
2648 Demod.output = receivedResponse;
2649
2650 // Set up the demodulator for the reader -> tag commands
2651 Uart.output = receivedCmd;
2652
2653 // Setup for the DMA.
2654 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
2655
2656 LED_D_OFF();
2657
2658 // init sniffer
2659 MfSniffInit();
2660
2661 // And now we loop, receiving samples.
2662 for(uint32_t sniffCounter = 0; TRUE; ) {
2663
2664 if(BUTTON_PRESS()) {
2665 DbpString("cancelled by button");
2666 break;
2667 }
2668
2669 LED_A_ON();
2670 WDT_HIT();
2671
2672 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
2673 // check if a transaction is completed (timeout after 2000ms).
2674 // if yes, stop the DMA transfer and send what we have so far to the client
2675 if (MfSniffSend(2000)) {
2676 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2677 sniffCounter = 0;
2678 data = dmaBuf;
2679 maxDataLen = 0;
2680 ReaderIsActive = FALSE;
2681 TagIsActive = FALSE;
2682 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
2683 }
2684 }
2685
2686 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
2687 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
2688 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
2689 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
2690 } else {
2691 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
2692 }
2693 // test for length of buffer
2694 if(dataLen > maxDataLen) { // we are more behind than ever...
2695 maxDataLen = dataLen;
2696 if(dataLen > 400) {
2697 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
2698 break;
2699 }
2700 }
2701 if(dataLen < 1) continue;
2702
2703 // primary buffer was stopped ( <-- we lost data!
2704 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
2705 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
2706 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
2707 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
2708 }
2709 // secondary buffer sets as primary, secondary buffer was stopped
2710 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
2711 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
2712 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
2713 }
2714
2715 LED_A_OFF();
2716
2717 if (sniffCounter & 0x01) {
2718
2719 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
2720 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
2721 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
2722 LED_C_INV();
2723 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parityBits, Uart.bitCount, TRUE)) break;
2724
2725 /* And ready to receive another command. */
2726 UartReset();
2727
2728 /* And also reset the demod code */
2729 DemodReset();
2730 }
2731 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
2732 }
2733
2734 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
2735 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
2736 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
2737 LED_C_INV();
2738
2739 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;
2740
2741 // And ready to receive another response.
2742 DemodReset();
2743 }
2744 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
2745 }
2746 }
2747
2748 previous_data = *data;
2749 sniffCounter++;
2750 data++;
2751 if(data == dmaBuf + DMA_BUFFER_SIZE) {
2752 data = dmaBuf;
2753 }
2754
2755 } // main cycle
2756
2757 DbpString("COMMAND FINISHED");
2758
2759 FpgaDisableSscDma();
2760 MfSniffEnd();
2761
2762 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
2763 LEDsoff();
2764 }
Proxmark3 GIT tracking
Impressum, Datenschutz