]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443.c
projects / proxmark3-svn / blob
? search:


2a079fdbe266199710e6feb9ab346b6b898e0625
[proxmark3-svn] / armsrc / iso14443.c
1 //-----------------------------------------------------------------------------
2 // Routines to support ISO 14443. This includes both the reader software and
3 // the `fake tag' modes. At the moment only the Type B modulation is
4 // supported.
5 // Jonathan Westhues, split Nov 2006
6 //-----------------------------------------------------------------------------
7 #include <proxmark3.h>
8 #include "apps.h"
9 #include "..\common\iso14443_crc.c"
10
11
12 //static void GetSamplesFor14443(BOOL weTx, int n);
13
14 #define DMA_BUFFER_SIZE 256
15
16 //=============================================================================
17 // An ISO 14443 Type B tag. We listen for commands from the reader, using
18 // a UART kind of thing that's implemented in software. When we get a
19 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
20 // If it's good, then we can do something appropriate with it, and send
21 // a response.
22 //=============================================================================
23
24 //-----------------------------------------------------------------------------
25 // Code up a string of octets at layer 2 (including CRC, we don't generate
26 // that here) so that they can be transmitted to the reader. Doesn't transmit
27 // them yet, just leaves them ready to send in ToSend[].
28 //-----------------------------------------------------------------------------
29 static void CodeIso14443bAsTag(const BYTE *cmd, int len)
30 {
31 int i;
32
33 ToSendReset();
34
35 // Transmit a burst of ones, as the initial thing that lets the
36 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
37 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
38 // so I will too.
39 for(i = 0; i < 20; i++) {
40 ToSendStuffBit(1);
41 ToSendStuffBit(1);
42 ToSendStuffBit(1);
43 ToSendStuffBit(1);
44 }
45
46 // Send SOF.
47 for(i = 0; i < 10; i++) {
48 ToSendStuffBit(0);
49 ToSendStuffBit(0);
50 ToSendStuffBit(0);
51 ToSendStuffBit(0);
52 }
53 for(i = 0; i < 2; i++) {
54 ToSendStuffBit(1);
55 ToSendStuffBit(1);
56 ToSendStuffBit(1);
57 ToSendStuffBit(1);
58 }
59
60 for(i = 0; i < len; i++) {
61 int j;
62 BYTE b = cmd[i];
63
64 // Start bit
65 ToSendStuffBit(0);
66 ToSendStuffBit(0);
67 ToSendStuffBit(0);
68 ToSendStuffBit(0);
69
70 // Data bits
71 for(j = 0; j < 8; j++) {
72 if(b & 1) {
73 ToSendStuffBit(1);
74 ToSendStuffBit(1);
75 ToSendStuffBit(1);
76 ToSendStuffBit(1);
77 } else {
78 ToSendStuffBit(0);
79 ToSendStuffBit(0);
80 ToSendStuffBit(0);
81 ToSendStuffBit(0);
82 }
83 b >>= 1;
84 }
85
86 // Stop bit
87 ToSendStuffBit(1);
88 ToSendStuffBit(1);
89 ToSendStuffBit(1);
90 ToSendStuffBit(1);
91 }
92
93 // Send SOF.
94 for(i = 0; i < 10; i++) {
95 ToSendStuffBit(0);
96 ToSendStuffBit(0);
97 ToSendStuffBit(0);
98 ToSendStuffBit(0);
99 }
100 for(i = 0; i < 10; i++) {
101 ToSendStuffBit(1);
102 ToSendStuffBit(1);
103 ToSendStuffBit(1);
104 ToSendStuffBit(1);
105 }
106
107 // Convert from last byte pos to length
108 ToSendMax++;
109
110 // Add a few more for slop
111 ToSendMax += 2;
112 }
113
114 //-----------------------------------------------------------------------------
115 // The software UART that receives commands from the reader, and its state
116 // variables.
117 //-----------------------------------------------------------------------------
118 static struct {
119 enum {
120 STATE_UNSYNCD,
121 STATE_GOT_FALLING_EDGE_OF_SOF,
122 STATE_AWAITING_START_BIT,
123 STATE_RECEIVING_DATA,
124 STATE_ERROR_WAIT
125 } state;
126 WORD shiftReg;
127 int bitCnt;
128 int byteCnt;
129 int byteCntMax;
130 int posCnt;
131 BYTE *output;
132 } Uart;
133
134 static BOOL Handle14443UartBit(int bit)
135 {
136 switch(Uart.state) {
137 case STATE_UNSYNCD:
138 if(!bit) {
139 // we went low, so this could be the beginning
140 // of an SOF
141 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
142 Uart.posCnt = 0;
143 Uart.bitCnt = 0;
144 }
145 break;
146
147 case STATE_GOT_FALLING_EDGE_OF_SOF:
148 Uart.posCnt++;
149 if(Uart.posCnt == 2) {
150 if(bit) {
151 if(Uart.bitCnt >= 10) {
152 // we've seen enough consecutive
153 // zeros that it's a valid SOF
154 Uart.posCnt = 0;
155 Uart.byteCnt = 0;
156 Uart.state = STATE_AWAITING_START_BIT;
157 } else {
158 // didn't stay down long enough
159 // before going high, error
160 Uart.state = STATE_ERROR_WAIT;
161 }
162 } else {
163 // do nothing, keep waiting
164 }
165 Uart.bitCnt++;
166 }
167 if(Uart.posCnt >= 4) Uart.posCnt = 0;
168 if(Uart.bitCnt > 14) {
169 // Give up if we see too many zeros without
170 // a one, too.
171 Uart.state = STATE_ERROR_WAIT;
172 }
173 break;
174
175 case STATE_AWAITING_START_BIT:
176 Uart.posCnt++;
177 if(bit) {
178 if(Uart.posCnt > 25) {
179 // stayed high for too long between
180 // characters, error
181 Uart.state = STATE_ERROR_WAIT;
182 }
183 } else {
184 // falling edge, this starts the data byte
185 Uart.posCnt = 0;
186 Uart.bitCnt = 0;
187 Uart.shiftReg = 0;
188 Uart.state = STATE_RECEIVING_DATA;
189 }
190 break;
191
192 case STATE_RECEIVING_DATA:
193 Uart.posCnt++;
194 if(Uart.posCnt == 2) {
195 // time to sample a bit
196 Uart.shiftReg >>= 1;
197 if(bit) {
198 Uart.shiftReg |= 0x200;
199 }
200 Uart.bitCnt++;
201 }
202 if(Uart.posCnt >= 4) {
203 Uart.posCnt = 0;
204 }
205 if(Uart.bitCnt == 10) {
206 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
207 {
208 // this is a data byte, with correct
209 // start and stop bits
210 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
211 Uart.byteCnt++;
212
213 if(Uart.byteCnt >= Uart.byteCntMax) {
214 // Buffer overflowed, give up
215 Uart.posCnt = 0;
216 Uart.state = STATE_ERROR_WAIT;
217 } else {
218 // so get the next byte now
219 Uart.posCnt = 0;
220 Uart.state = STATE_AWAITING_START_BIT;
221 }
222 } else if(Uart.shiftReg == 0x000) {
223 // this is an EOF byte
224 return TRUE;
225 } else {
226 // this is an error
227 Uart.posCnt = 0;
228 Uart.state = STATE_ERROR_WAIT;
229 }
230 }
231 break;
232
233 case STATE_ERROR_WAIT:
234 // We're all screwed up, so wait a little while
235 // for whatever went wrong to finish, and then
236 // start over.
237 Uart.posCnt++;
238 if(Uart.posCnt > 10) {
239 Uart.state = STATE_UNSYNCD;
240 }
241 break;
242
243 default:
244 Uart.state = STATE_UNSYNCD;
245 break;
246 }
247
248 return FALSE;
249 }
250
251 //-----------------------------------------------------------------------------
252 // Receive a command (from the reader to us, where we are the simulated tag),
253 // and store it in the given buffer, up to the given maximum length. Keeps
254 // spinning, waiting for a well-framed command, until either we get one
255 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
256 //
257 // Assume that we're called with the SSC (to the FPGA) and ADC path set
258 // correctly.
259 //-----------------------------------------------------------------------------
260 static BOOL GetIso14443CommandFromReader(BYTE *received, int *len, int maxLen)
261 {
262 BYTE mask;
263 int i, bit;
264
265 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
266 // only, since we are receiving, not transmitting).
267 FpgaWriteConfWord(
268 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
269
270
271 // Now run a `software UART' on the stream of incoming samples.
272 Uart.output = received;
273 Uart.byteCntMax = maxLen;
274 Uart.state = STATE_UNSYNCD;
275
276 for(;;) {
277 WDT_HIT();
278
279 if(BUTTON_PRESS()) return FALSE;
280
281 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
282 SSC_TRANSMIT_HOLDING = 0x00;
283 }
284 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
285 BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
286
287 mask = 0x80;
288 for(i = 0; i < 8; i++, mask >>= 1) {
289 bit = (b & mask);
290 if(Handle14443UartBit(bit)) {
291 *len = Uart.byteCnt;
292 return TRUE;
293 }
294 }
295 }
296 }
297 }
298
299 //-----------------------------------------------------------------------------
300 // Main loop of simulated tag: receive commands from reader, decide what
301 // response to send, and send it.
302 //-----------------------------------------------------------------------------
303 void SimulateIso14443Tag(void)
304 {
305 static const BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
306 static const BYTE response1[] = {
307 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
308 0x00, 0x21, 0x85, 0x5e, 0xd7
309 };
310
311 BYTE *resp;
312 int respLen;
313
314 BYTE *resp1 = (((BYTE *)BigBuf) + 800);
315 int resp1Len;
316
317 BYTE *receivedCmd = (BYTE *)BigBuf;
318 int len;
319
320 int i;
321
322 int cmdsRecvd = 0;
323
324 memset(receivedCmd, 0x44, 400);
325
326 CodeIso14443bAsTag(response1, sizeof(response1));
327 memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
328
329 // We need to listen to the high-frequency, peak-detected path.
330 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
331 FpgaSetupSsc();
332
333 cmdsRecvd = 0;
334
335 for(;;) {
336 BYTE b1, b2;
337
338 if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {
339 DbpIntegers(cmdsRecvd, 0, 0);
340 DbpString("button press");
341 break;
342 }
343
344 // Good, look at the command now.
345
346 if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
347 resp = resp1; respLen = resp1Len;
348 } else {
349 DbpString("new cmd from reader:");
350 DbpIntegers(len, 0x1234, cmdsRecvd);
351 // And print whether the CRC fails, just for good measure
352 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
353 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
354 // Not so good, try again.
355 DbpString("+++CRC fail");
356 } else {
357 DbpString("CRC passes");
358 }
359 break;
360 }
361
362 memset(receivedCmd, 0x44, 32);
363
364 cmdsRecvd++;
365
366 if(cmdsRecvd > 0x30) {
367 DbpString("many commands later...");
368 break;
369 }
370
371 if(respLen <= 0) continue;
372
373 // Modulate BPSK
374 FpgaWriteConfWord(
375 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
376 SSC_TRANSMIT_HOLDING = 0xff;
377 FpgaSetupSsc();
378
379 // Transmit the response.
380 i = 0;
381 for(;;) {
382 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
383 BYTE b = resp[i];
384
385 SSC_TRANSMIT_HOLDING = b;
386
387 i++;
388 if(i > respLen) {
389 break;
390 }
391 }
392 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
393 volatile BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
394 (void)b;
395 }
396 }
397 }
398 }
399
400 //=============================================================================
401 // An ISO 14443 Type B reader. We take layer two commands, code them
402 // appropriately, and then send them to the tag. We then listen for the
403 // tag's response, which we leave in the buffer to be demodulated on the
404 // PC side.
405 //=============================================================================
406
407 static struct {
408 enum {
409 DEMOD_UNSYNCD,
410 DEMOD_PHASE_REF_TRAINING,
411 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
412 DEMOD_GOT_FALLING_EDGE_OF_SOF,
413 DEMOD_AWAITING_START_BIT,
414 DEMOD_RECEIVING_DATA,
415 DEMOD_ERROR_WAIT
416 } state;
417 int bitCount;
418 int posCount;
419 int thisBit;
420 int metric;
421 int metricN;
422 WORD shiftReg;
423 BYTE *output;
424 int len;
425 int sumI;
426 int sumQ;
427 } Demod;
428
429 static BOOL Handle14443SamplesDemod(int ci, int cq)
430 {
431 int v;
432
433 // The soft decision on the bit uses an estimate of just the
434 // quadrant of the reference angle, not the exact angle.
435 #define MAKE_SOFT_DECISION() { \
436 if(Demod.sumI > 0) { \
437 v = ci; \
438 } else { \
439 v = -ci; \
440 } \
441 if(Demod.sumQ > 0) { \
442 v += cq; \
443 } else { \
444 v -= cq; \
445 } \
446 }
447
448 switch(Demod.state) {
449 case DEMOD_UNSYNCD:
450 v = ci;
451 if(v < 0) v = -v;
452 if(cq > 0) {
453 v += cq;
454 } else {
455 v -= cq;
456 }
457 if(v > 40) {
458 Demod.posCount = 0;
459 Demod.state = DEMOD_PHASE_REF_TRAINING;
460 Demod.sumI = 0;
461 Demod.sumQ = 0;
462 }
463 break;
464
465 case DEMOD_PHASE_REF_TRAINING:
466 if(Demod.posCount < 8) {
467 Demod.sumI += ci;
468 Demod.sumQ += cq;
469 } else if(Demod.posCount > 100) {
470 // error, waited too long
471 Demod.state = DEMOD_UNSYNCD;
472 } else {
473 MAKE_SOFT_DECISION();
474 if(v < 0) {
475 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
476 Demod.posCount = 0;
477 }
478 }
479 Demod.posCount++;
480 break;
481
482 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
483 MAKE_SOFT_DECISION();
484 if(v < 0) {
485 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
486 Demod.posCount = 0;
487 } else {
488 if(Demod.posCount > 100) {
489 Demod.state = DEMOD_UNSYNCD;
490 }
491 }
492 Demod.posCount++;
493 break;
494
495 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
496 MAKE_SOFT_DECISION();
497 if(v > 0) {
498 if(Demod.posCount < 12) {
499 Demod.state = DEMOD_UNSYNCD;
500 } else {
501 Demod.state = DEMOD_AWAITING_START_BIT;
502 Demod.posCount = 0;
503 Demod.len = 0;
504 Demod.metricN = 0;
505 Demod.metric = 0;
506 }
507 } else {
508 if(Demod.posCount > 100) {
509 Demod.state = DEMOD_UNSYNCD;
510 }
511 }
512 Demod.posCount++;
513 break;
514
515 case DEMOD_AWAITING_START_BIT:
516 MAKE_SOFT_DECISION();
517 if(v > 0) {
518 if(Demod.posCount > 10) {
519 Demod.state = DEMOD_UNSYNCD;
520 }
521 } else {
522 Demod.bitCount = 0;
523 Demod.posCount = 1;
524 Demod.thisBit = v;
525 Demod.shiftReg = 0;
526 Demod.state = DEMOD_RECEIVING_DATA;
527 }
528 break;
529
530 case DEMOD_RECEIVING_DATA:
531 MAKE_SOFT_DECISION();
532 if(Demod.posCount == 0) {
533 Demod.thisBit = v;
534 Demod.posCount = 1;
535 } else {
536 Demod.thisBit += v;
537
538 if(Demod.thisBit > 0) {
539 Demod.metric += Demod.thisBit;
540 } else {
541 Demod.metric -= Demod.thisBit;
542 }
543 (Demod.metricN)++;
544
545 Demod.shiftReg >>= 1;
546 if(Demod.thisBit > 0) {
547 Demod.shiftReg |= 0x200;
548 }
549
550 Demod.bitCount++;
551 if(Demod.bitCount == 10) {
552 WORD s = Demod.shiftReg;
553 if((s & 0x200) && !(s & 0x001)) {
554 BYTE b = (s >> 1);
555 Demod.output[Demod.len] = b;
556 Demod.len++;
557 Demod.state = DEMOD_AWAITING_START_BIT;
558 } else if(s == 0x000) {
559 // This is EOF
560 return TRUE;
561 Demod.state = DEMOD_UNSYNCD;
562 } else {
563 Demod.state = DEMOD_UNSYNCD;
564 }
565 }
566 Demod.posCount = 0;
567 }
568 break;
569
570 default:
571 Demod.state = DEMOD_UNSYNCD;
572 break;
573 }
574
575 return FALSE;
576 }
577
578 static void GetSamplesFor14443Demod(BOOL weTx, int n)
579 {
580 int max = 0;
581 BOOL gotFrame = FALSE;
582
583 //# define DMA_BUFFER_SIZE 8
584 SBYTE *dmaBuf;
585
586 int lastRxCounter;
587 SBYTE *upTo;
588
589 int ci, cq;
590
591 int samples = 0;
592
593 // Clear out the state of the "UART" that receives from the tag.
594 memset(BigBuf, 0x44, 400);
595 Demod.output = (BYTE *)BigBuf;
596 Demod.len = 0;
597 Demod.state = DEMOD_UNSYNCD;
598
599 // And the UART that receives from the reader
600 Uart.output = (((BYTE *)BigBuf) + 1024);
601 Uart.byteCntMax = 100;
602 Uart.state = STATE_UNSYNCD;
603
604 // Setup for the DMA.
605 dmaBuf = (SBYTE *)(BigBuf + 32);
606 upTo = dmaBuf;
607 lastRxCounter = DMA_BUFFER_SIZE;
608 FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
609
610 // And put the FPGA in the appropriate mode
611 FpgaWriteConfWord(
612 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
613 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
614
615 for(;;) {
616 int behindBy = lastRxCounter - PDC_RX_COUNTER(SSC_BASE);
617 if(behindBy > max) max = behindBy;
618
619 LED_D_ON();
620 while(((lastRxCounter-PDC_RX_COUNTER(SSC_BASE)) & (DMA_BUFFER_SIZE-1))
621 > 2)
622 {
623 ci = upTo[0];
624 cq = upTo[1];
625 upTo += 2;
626 if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
627 upTo -= DMA_BUFFER_SIZE;
628 PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;
629 PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;
630 }
631 lastRxCounter -= 2;
632 if(lastRxCounter <= 0) {
633 lastRxCounter += DMA_BUFFER_SIZE;
634 }
635
636 samples += 2;
637
638 Handle14443UartBit(1);
639 Handle14443UartBit(1);
640
641 if(Handle14443SamplesDemod(ci, cq)) {
642 gotFrame = 1;
643 }
644 }
645 LED_D_OFF();
646
647 if(samples > 2000) {
648 break;
649 }
650 }
651 PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;
652 DbpIntegers(max, gotFrame, -1);
653 }
654
655 //-----------------------------------------------------------------------------
656 // Read the tag's response. We just receive a stream of slightly-processed
657 // samples from the FPGA, which we will later do some signal processing on,
658 // to get the bits.
659 //-----------------------------------------------------------------------------
660 /*static void GetSamplesFor14443(BOOL weTx, int n)
661 {
662 BYTE *dest = (BYTE *)BigBuf;
663 int c;
664
665 FpgaWriteConfWord(
666 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
667 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
668
669 c = 0;
670 for(;;) {
671 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
672 SSC_TRANSMIT_HOLDING = 0x43;
673 }
674 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
675 SBYTE b;
676 b = (SBYTE)SSC_RECEIVE_HOLDING;
677
678 dest[c++] = (BYTE)b;
679
680 if(c >= n) {
681 break;
682 }
683 }
684 }
685 }*/
686
687 //-----------------------------------------------------------------------------
688 // Transmit the command (to the tag) that was placed in ToSend[].
689 //-----------------------------------------------------------------------------
690 static void TransmitFor14443(void)
691 {
692 int c;
693
694 FpgaSetupSsc();
695
696 while(SSC_STATUS & (SSC_STATUS_TX_READY)) {
697 SSC_TRANSMIT_HOLDING = 0xff;
698 }
699
700 FpgaWriteConfWord(
701 FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
702
703 for(c = 0; c < 10;) {
704 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
705 SSC_TRANSMIT_HOLDING = 0xff;
706 c++;
707 }
708 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
709 volatile DWORD r = SSC_RECEIVE_HOLDING;
710 (void)r;
711 }
712 WDT_HIT();
713 }
714
715 c = 0;
716 for(;;) {
717 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
718 SSC_TRANSMIT_HOLDING = ToSend[c];
719 c++;
720 if(c >= ToSendMax) {
721 break;
722 }
723 }
724 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
725 volatile DWORD r = SSC_RECEIVE_HOLDING;
726 (void)r;
727 }
728 WDT_HIT();
729 }
730 }
731
732 //-----------------------------------------------------------------------------
733 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
734 // so that it is ready to transmit to the tag using TransmitFor14443().
735 //-----------------------------------------------------------------------------
736 void CodeIso14443bAsReader(const BYTE *cmd, int len)
737 {
738 int i, j;
739 BYTE b;
740
741 ToSendReset();
742
743 // Establish initial reference level
744 for(i = 0; i < 40; i++) {
745 ToSendStuffBit(1);
746 }
747 // Send SOF
748 for(i = 0; i < 10; i++) {
749 ToSendStuffBit(0);
750 }
751
752 for(i = 0; i < len; i++) {
753 // Stop bits/EGT
754 ToSendStuffBit(1);
755 ToSendStuffBit(1);
756 // Start bit
757 ToSendStuffBit(0);
758 // Data bits
759 b = cmd[i];
760 for(j = 0; j < 8; j++) {
761 if(b & 1) {
762 ToSendStuffBit(1);
763 } else {
764 ToSendStuffBit(0);
765 }
766 b >>= 1;
767 }
768 }
769 // Send EOF
770 ToSendStuffBit(1);
771 for(i = 0; i < 10; i++) {
772 ToSendStuffBit(0);
773 }
774 for(i = 0; i < 8; i++) {
775 ToSendStuffBit(1);
776 }
777
778 // And then a little more, to make sure that the last character makes
779 // it out before we switch to rx mode.
780 for(i = 0; i < 24; i++) {
781 ToSendStuffBit(1);
782 }
783
784 // Convert from last character reference to length
785 ToSendMax++;
786 }
787
788 //-----------------------------------------------------------------------------
789 // Read an ISO 14443 tag. We send it some set of commands, and record the
790 // responses.
791 //-----------------------------------------------------------------------------
792 void AcquireRawAdcSamplesIso14443(DWORD parameter)
793 {
794 // BYTE cmd1[] = { 0x05, 0x00, 0x00, 0x71, 0xff };
795 BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
796
797 // Make sure that we start from off, since the tags are stateful;
798 // confusing things will happen if we don't reset them between reads.
799 LED_D_OFF();
800 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
801 SpinDelay(200);
802
803 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
804 FpgaSetupSsc();
805
806 // Now give it time to spin up.
807 FpgaWriteConfWord(
808 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
809 SpinDelay(200);
810
811 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
812 TransmitFor14443();
813 LED_A_ON();
814 GetSamplesFor14443Demod(TRUE, 2000);
815 LED_A_OFF();
816 }
817
818 //=============================================================================
819 // Finally, the `sniffer' combines elements from both the reader and
820 // simulated tag, to show both sides of the conversation.
821 //=============================================================================
822
823 //-----------------------------------------------------------------------------
824 // Record the sequence of commands sent by the reader to the tag, with
825 // triggering so that we start recording at the point that the tag is moved
826 // near the reader.
827 //-----------------------------------------------------------------------------
828 void SnoopIso14443(void)
829 {
830 // We won't start recording the frames that we acquire until we trigger;
831 // a good trigger condition to get started is probably when we see a
832 // response from the tag.
833 BOOL triggered = FALSE;
834
835 // The command (reader -> tag) that we're working on receiving.
836 BYTE *receivedCmd = (((BYTE *)BigBuf) + 1024);
837 // The response (tag -> reader) that we're working on receiving.
838 BYTE *receivedResponse = (((BYTE *)BigBuf) + 1536);
839
840 // As we receive stuff, we copy it from receivedCmd or receivedResponse
841 // into trace, along with its length and other annotations.
842 BYTE *trace = (BYTE *)BigBuf;
843 int traceLen = 0;
844
845 // The DMA buffer, used to stream samples from the FPGA.
846 //# define DMA_BUFFER_SIZE 256
847 SBYTE *dmaBuf = ((SBYTE *)BigBuf) + 2048;
848 int lastRxCounter;
849 SBYTE *upTo;
850 int ci, cq;
851 int maxBehindBy = 0;
852
853 // Count of samples received so far, so that we can include timing
854 // information in the trace buffer.
855 int samples = 0;
856
857 memset(trace, 0x44, 1000);
858
859 // Set up the demodulator for tag -> reader responses.
860 Demod.output = receivedResponse;
861 Demod.len = 0;
862 Demod.state = DEMOD_UNSYNCD;
863
864 // And the reader -> tag commands
865 memset(&Uart, 0, sizeof(Uart));
866 Uart.output = receivedCmd;
867 Uart.byteCntMax = 100;
868 Uart.state = STATE_UNSYNCD;
869
870 // And put the FPGA in the appropriate mode
871 FpgaWriteConfWord(
872 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
873 FPGA_HF_READER_RX_XCORR_SNOOP);
874 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
875
876 // Setup for the DMA.
877 FpgaSetupSsc();
878 upTo = dmaBuf;
879 lastRxCounter = DMA_BUFFER_SIZE;
880 FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
881
882 LED_A_ON();
883
884 // And now we loop, receiving samples.
885 for(;;) {
886 int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &
887 (DMA_BUFFER_SIZE-1);
888 if(behindBy > maxBehindBy) {
889 maxBehindBy = behindBy;
890 if(behindBy > 100) {
891 DbpString("blew circular buffer!");
892 goto done;
893 }
894 }
895 if(behindBy < 2) continue;
896
897 ci = upTo[0];
898 cq = upTo[1];
899 upTo += 2;
900 lastRxCounter -= 2;
901 if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
902 upTo -= DMA_BUFFER_SIZE;
903 lastRxCounter += DMA_BUFFER_SIZE;
904 PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;
905 PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;
906 }
907
908 samples += 2;
909
910 #define HANDLE_BIT_IF_BODY \
911 if(triggered) { \
912 trace[traceLen++] = ((samples >> 0) & 0xff); \
913 trace[traceLen++] = ((samples >> 8) & 0xff); \
914 trace[traceLen++] = ((samples >> 16) & 0xff); \
915 trace[traceLen++] = ((samples >> 24) & 0xff); \
916 trace[traceLen++] = 0; \
917 trace[traceLen++] = 0; \
918 trace[traceLen++] = 0; \
919 trace[traceLen++] = 0; \
920 trace[traceLen++] = Uart.byteCnt; \
921 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
922 traceLen += Uart.byteCnt; \
923 if(traceLen > 1000) break; \
924 } \
925 /* And ready to receive another command. */ \
926 memset(&Uart, 0, sizeof(Uart)); \
927 Uart.output = receivedCmd; \
928 Uart.byteCntMax = 100; \
929 Uart.state = STATE_UNSYNCD; \
930 /* And also reset the demod code, which might have been */ \
931 /* false-triggered by the commands from the reader. */ \
932 memset(&Demod, 0, sizeof(Demod)); \
933 Demod.output = receivedResponse; \
934 Demod.state = DEMOD_UNSYNCD; \
935
936 if(Handle14443UartBit(ci & 1)) {
937 HANDLE_BIT_IF_BODY
938 }
939 if(Handle14443UartBit(cq & 1)) {
940 HANDLE_BIT_IF_BODY
941 }
942
943 if(Handle14443SamplesDemod(ci, cq)) {
944 // timestamp, as a count of samples
945 trace[traceLen++] = ((samples >> 0) & 0xff);
946 trace[traceLen++] = ((samples >> 8) & 0xff);
947 trace[traceLen++] = ((samples >> 16) & 0xff);
948 trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);
949 // correlation metric (~signal strength estimate)
950 if(Demod.metricN != 0) {
951 Demod.metric /= Demod.metricN;
952 }
953 trace[traceLen++] = ((Demod.metric >> 0) & 0xff);
954 trace[traceLen++] = ((Demod.metric >> 8) & 0xff);
955 trace[traceLen++] = ((Demod.metric >> 16) & 0xff);
956 trace[traceLen++] = ((Demod.metric >> 24) & 0xff);
957 // length
958 trace[traceLen++] = Demod.len;
959 memcpy(trace+traceLen, receivedResponse, Demod.len);
960 traceLen += Demod.len;
961 if(traceLen > 1000) break;
962
963 triggered = TRUE;
964 LED_A_OFF();
965 LED_B_ON();
966
967 // And ready to receive another response.
968 memset(&Demod, 0, sizeof(Demod));
969 Demod.output = receivedResponse;
970 Demod.state = DEMOD_UNSYNCD;
971 }
972
973 if(BUTTON_PRESS()) {
974 DbpString("cancelled");
975 goto done;
976 }
977 }
978
979 DbpString("in done pt");
980
981 DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
982 DbpIntegers(Uart.byteCntMax, traceLen, 0x23);
983
984 done:
985 PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;
986 LED_A_OFF();
987 LED_B_OFF();
988 }
Proxmark3 GIT tracking
Impressum, Datenschutz