]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443b.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
fixing iso14443b (issue #103):
[proxmark3-svn] / armsrc / iso14443b.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Routines to support ISO 14443B. This includes both the reader software and
9 // the `fake tag' modes.
10 //-----------------------------------------------------------------------------
11
12 #include "proxmark3.h"
13 #include "apps.h"
14 #include "util.h"
15 #include "string.h"
16
17 #include "iso14443crc.h"
18
19 #define RECEIVE_SAMPLES_TIMEOUT 2000
20 #define ISO14443B_DMA_BUFFER_SIZE 512
21
22 //=============================================================================
23 // An ISO 14443 Type B tag. We listen for commands from the reader, using
24 // a UART kind of thing that's implemented in software. When we get a
25 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
26 // If it's good, then we can do something appropriate with it, and send
27 // a response.
28 //=============================================================================
29
30 //-----------------------------------------------------------------------------
31 // Code up a string of octets at layer 2 (including CRC, we don't generate
32 // that here) so that they can be transmitted to the reader. Doesn't transmit
33 // them yet, just leaves them ready to send in ToSend[].
34 //-----------------------------------------------------------------------------
35 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
36 {
37 int i;
38
39 ToSendReset();
40
41 // Transmit a burst of ones, as the initial thing that lets the
42 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
43 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
44 // so I will too.
45 for(i = 0; i < 20; i++) {
46 ToSendStuffBit(1);
47 ToSendStuffBit(1);
48 ToSendStuffBit(1);
49 ToSendStuffBit(1);
50 }
51
52 // Send SOF.
53 for(i = 0; i < 10; i++) {
54 ToSendStuffBit(0);
55 ToSendStuffBit(0);
56 ToSendStuffBit(0);
57 ToSendStuffBit(0);
58 }
59 for(i = 0; i < 2; i++) {
60 ToSendStuffBit(1);
61 ToSendStuffBit(1);
62 ToSendStuffBit(1);
63 ToSendStuffBit(1);
64 }
65
66 for(i = 0; i < len; i++) {
67 int j;
68 uint8_t b = cmd[i];
69
70 // Start bit
71 ToSendStuffBit(0);
72 ToSendStuffBit(0);
73 ToSendStuffBit(0);
74 ToSendStuffBit(0);
75
76 // Data bits
77 for(j = 0; j < 8; j++) {
78 if(b & 1) {
79 ToSendStuffBit(1);
80 ToSendStuffBit(1);
81 ToSendStuffBit(1);
82 ToSendStuffBit(1);
83 } else {
84 ToSendStuffBit(0);
85 ToSendStuffBit(0);
86 ToSendStuffBit(0);
87 ToSendStuffBit(0);
88 }
89 b >>= 1;
90 }
91
92 // Stop bit
93 ToSendStuffBit(1);
94 ToSendStuffBit(1);
95 ToSendStuffBit(1);
96 ToSendStuffBit(1);
97 }
98
99 // Send EOF.
100 for(i = 0; i < 10; i++) {
101 ToSendStuffBit(0);
102 ToSendStuffBit(0);
103 ToSendStuffBit(0);
104 ToSendStuffBit(0);
105 }
106 for(i = 0; i < 2; i++) {
107 ToSendStuffBit(1);
108 ToSendStuffBit(1);
109 ToSendStuffBit(1);
110 ToSendStuffBit(1);
111 }
112
113 // Convert from last byte pos to length
114 ToSendMax++;
115 }
116
117 //-----------------------------------------------------------------------------
118 // The software UART that receives commands from the reader, and its state
119 // variables.
120 //-----------------------------------------------------------------------------
121 static struct {
122 enum {
123 STATE_UNSYNCD,
124 STATE_GOT_FALLING_EDGE_OF_SOF,
125 STATE_AWAITING_START_BIT,
126 STATE_RECEIVING_DATA,
127 STATE_ERROR_WAIT
128 } state;
129 uint16_t shiftReg;
130 int bitCnt;
131 int byteCnt;
132 int byteCntMax;
133 int posCnt;
134 uint8_t *output;
135 } Uart;
136
137 /* Receive & handle a bit coming from the reader.
138 *
139 * This function is called 4 times per bit (every 2 subcarrier cycles).
140 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
141 *
142 * LED handling:
143 * LED A -> ON once we have received the SOF and are expecting the rest.
144 * LED A -> OFF once we have received EOF or are in error state or unsynced
145 *
146 * Returns: true if we received a EOF
147 * false if we are still waiting for some more
148 */
149 static int Handle14443bUartBit(int bit)
150 {
151 switch(Uart.state) {
152 case STATE_UNSYNCD:
153 if(!bit) {
154 // we went low, so this could be the beginning
155 // of an SOF
156 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
157 Uart.posCnt = 0;
158 Uart.bitCnt = 0;
159 }
160 break;
161
162 case STATE_GOT_FALLING_EDGE_OF_SOF:
163 Uart.posCnt++;
164 if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit
165 if(bit) {
166 if(Uart.bitCnt > 9) {
167 // we've seen enough consecutive
168 // zeros that it's a valid SOF
169 Uart.posCnt = 0;
170 Uart.byteCnt = 0;
171 Uart.state = STATE_AWAITING_START_BIT;
172 LED_A_ON(); // Indicate we got a valid SOF
173 } else {
174 // didn't stay down long enough
175 // before going high, error
176 Uart.state = STATE_ERROR_WAIT;
177 }
178 } else {
179 // do nothing, keep waiting
180 }
181 Uart.bitCnt++;
182 }
183 if(Uart.posCnt >= 4) Uart.posCnt = 0;
184 if(Uart.bitCnt > 12) {
185 // Give up if we see too many zeros without
186 // a one, too.
187 Uart.state = STATE_ERROR_WAIT;
188 }
189 break;
190
191 case STATE_AWAITING_START_BIT:
192 Uart.posCnt++;
193 if(bit) {
194 if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
195 // stayed high for too long between
196 // characters, error
197 Uart.state = STATE_ERROR_WAIT;
198 }
199 } else {
200 // falling edge, this starts the data byte
201 Uart.posCnt = 0;
202 Uart.bitCnt = 0;
203 Uart.shiftReg = 0;
204 Uart.state = STATE_RECEIVING_DATA;
205 }
206 break;
207
208 case STATE_RECEIVING_DATA:
209 Uart.posCnt++;
210 if(Uart.posCnt == 2) {
211 // time to sample a bit
212 Uart.shiftReg >>= 1;
213 if(bit) {
214 Uart.shiftReg |= 0x200;
215 }
216 Uart.bitCnt++;
217 }
218 if(Uart.posCnt >= 4) {
219 Uart.posCnt = 0;
220 }
221 if(Uart.bitCnt == 10) {
222 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
223 {
224 // this is a data byte, with correct
225 // start and stop bits
226 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
227 Uart.byteCnt++;
228
229 if(Uart.byteCnt >= Uart.byteCntMax) {
230 // Buffer overflowed, give up
231 Uart.posCnt = 0;
232 Uart.state = STATE_ERROR_WAIT;
233 } else {
234 // so get the next byte now
235 Uart.posCnt = 0;
236 Uart.state = STATE_AWAITING_START_BIT;
237 }
238 } else if(Uart.shiftReg == 0x000) {
239 // this is an EOF byte
240 LED_A_OFF(); // Finished receiving
241 return TRUE;
242 } else {
243 // this is an error
244 Uart.posCnt = 0;
245 Uart.state = STATE_ERROR_WAIT;
246 }
247 }
248 break;
249
250 case STATE_ERROR_WAIT:
251 // We're all screwed up, so wait a little while
252 // for whatever went wrong to finish, and then
253 // start over.
254 Uart.posCnt++;
255 if(Uart.posCnt > 10) {
256 Uart.state = STATE_UNSYNCD;
257 LED_A_OFF();
258 }
259 break;
260
261 default:
262 Uart.state = STATE_UNSYNCD;
263 break;
264 }
265
266 return FALSE;
267 }
268
269 //-----------------------------------------------------------------------------
270 // Receive a command (from the reader to us, where we are the simulated tag),
271 // and store it in the given buffer, up to the given maximum length. Keeps
272 // spinning, waiting for a well-framed command, until either we get one
273 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
274 //
275 // Assume that we're called with the SSC (to the FPGA) and ADC path set
276 // correctly.
277 //-----------------------------------------------------------------------------
278 static int GetIso14443bCommandFromReader(uint8_t *received, int *len, int maxLen)
279 {
280 uint8_t mask;
281 int i, bit;
282
283 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
284 // only, since we are receiving, not transmitting).
285 // Signal field is off with the appropriate LED
286 LED_D_OFF();
287 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
288
289
290 // Now run a `software UART' on the stream of incoming samples.
291 Uart.output = received;
292 Uart.byteCntMax = maxLen;
293 Uart.state = STATE_UNSYNCD;
294
295 for(;;) {
296 WDT_HIT();
297
298 if(BUTTON_PRESS()) return FALSE;
299
300 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
301 AT91C_BASE_SSC->SSC_THR = 0x00;
302 }
303 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
304 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
305
306 mask = 0x80;
307 for(i = 0; i < 8; i++, mask >>= 1) {
308 bit = (b & mask);
309 if(Handle14443bUartBit(bit)) {
310 *len = Uart.byteCnt;
311 return TRUE;
312 }
313 }
314 }
315 }
316 }
317
318 //-----------------------------------------------------------------------------
319 // Main loop of simulated tag: receive commands from reader, decide what
320 // response to send, and send it.
321 //-----------------------------------------------------------------------------
322 void SimulateIso14443bTag(void)
323 {
324 // the only command we understand is REQB, AFI=0, Select All, N=0:
325 static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
326 // ... and we respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
327 // supports only 106kBit/s in both directions, max frame size = 32Bytes,
328 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
329 static const uint8_t response1[] = {
330 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
331 0x00, 0x21, 0x85, 0x5e, 0xd7
332 };
333
334 uint8_t *resp;
335 int respLen;
336
337 // allocate command receive buffer
338 BigBuf_free();
339 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
340 int len;
341
342 int i;
343
344 int cmdsRecvd = 0;
345
346 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
347
348 // prepare the (only one) tag answer:
349 CodeIso14443bAsTag(response1, sizeof(response1));
350 uint8_t *resp1 = BigBuf_malloc(ToSendMax);
351 memcpy(resp1, ToSend, ToSendMax);
352 uint16_t resp1Len = ToSendMax;
353
354 // We need to listen to the high-frequency, peak-detected path.
355 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
356 FpgaSetupSsc();
357
358 cmdsRecvd = 0;
359
360 for(;;) {
361 uint8_t b1, b2;
362
363 if(!GetIso14443bCommandFromReader(receivedCmd, &len, 100)) {
364 Dbprintf("button pressed, received %d commands", cmdsRecvd);
365 break;
366 }
367
368 // Good, look at the command now.
369
370 if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0) {
371 resp = resp1; respLen = resp1Len;
372 } else {
373 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
374 // And print whether the CRC fails, just for good measure
375 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
376 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
377 // Not so good, try again.
378 DbpString("+++CRC fail");
379 } else {
380 DbpString("CRC passes");
381 }
382 break;
383 }
384
385 cmdsRecvd++;
386
387 if(cmdsRecvd > 0x30) {
388 DbpString("many commands later...");
389 break;
390 }
391
392 if(respLen <= 0) continue;
393
394 // Modulate BPSK
395 // Signal field is off with the appropriate LED
396 LED_D_OFF();
397 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
398 AT91C_BASE_SSC->SSC_THR = 0xff;
399 FpgaSetupSsc();
400
401 // Transmit the response.
402 i = 0;
403 for(;;) {
404 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
405 uint8_t b = resp[i];
406
407 AT91C_BASE_SSC->SSC_THR = b;
408
409 i++;
410 if(i > respLen) {
411 break;
412 }
413 }
414 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
415 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
416 (void)b;
417 }
418 }
419 }
420 }
421
422 //=============================================================================
423 // An ISO 14443 Type B reader. We take layer two commands, code them
424 // appropriately, and then send them to the tag. We then listen for the
425 // tag's response, which we leave in the buffer to be demodulated on the
426 // PC side.
427 //=============================================================================
428
429 static struct {
430 enum {
431 DEMOD_UNSYNCD,
432 DEMOD_PHASE_REF_TRAINING,
433 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
434 DEMOD_GOT_FALLING_EDGE_OF_SOF,
435 DEMOD_AWAITING_START_BIT,
436 DEMOD_RECEIVING_DATA,
437 DEMOD_ERROR_WAIT
438 } state;
439 int bitCount;
440 int posCount;
441 int thisBit;
442 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
443 int metric;
444 int metricN;
445 */
446 uint16_t shiftReg;
447 uint8_t *output;
448 int len;
449 int sumI;
450 int sumQ;
451 } Demod;
452
453 /*
454 * Handles reception of a bit from the tag
455 *
456 * This function is called 2 times per bit (every 4 subcarrier cycles).
457 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
458 *
459 * LED handling:
460 * LED C -> ON once we have received the SOF and are expecting the rest.
461 * LED C -> OFF once we have received EOF or are unsynced
462 *
463 * Returns: true if we received a EOF
464 * false if we are still waiting for some more
465 *
466 */
467 static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
468 {
469 int v;
470
471 // The soft decision on the bit uses an estimate of just the
472 // quadrant of the reference angle, not the exact angle.
473 #define MAKE_SOFT_DECISION() { \
474 if(Demod.sumI > 0) { \
475 v = ci; \
476 } else { \
477 v = -ci; \
478 } \
479 if(Demod.sumQ > 0) { \
480 v += cq; \
481 } else { \
482 v -= cq; \
483 } \
484 }
485
486 #define SUBCARRIER_DETECT_THRESHOLD 8
487
488 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq)
489 /* #define CHECK_FOR_SUBCARRIER() { \
490 v = ci; \
491 if(v < 0) v = -v; \
492 if(cq > 0) { \
493 v += cq; \
494 } else { \
495 v -= cq; \
496 } \
497 }
498 */
499 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
500 #define CHECK_FOR_SUBCARRIER() { \
501 if(ci < 0) { \
502 if(cq < 0) { /* ci < 0, cq < 0 */ \
503 if (cq < ci) { \
504 v = -cq - (ci >> 1); \
505 } else { \
506 v = -ci - (cq >> 1); \
507 } \
508 } else { /* ci < 0, cq >= 0 */ \
509 if (cq < -ci) { \
510 v = -ci + (cq >> 1); \
511 } else { \
512 v = cq - (ci >> 1); \
513 } \
514 } \
515 } else { \
516 if(cq < 0) { /* ci >= 0, cq < 0 */ \
517 if (-cq < ci) { \
518 v = ci - (cq >> 1); \
519 } else { \
520 v = -cq + (ci >> 1); \
521 } \
522 } else { /* ci >= 0, cq >= 0 */ \
523 if (cq < ci) { \
524 v = ci + (cq >> 1); \
525 } else { \
526 v = cq + (ci >> 1); \
527 } \
528 } \
529 } \
530 }
531
532 switch(Demod.state) {
533 case DEMOD_UNSYNCD:
534 CHECK_FOR_SUBCARRIER();
535 if(v > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected
536 Demod.state = DEMOD_PHASE_REF_TRAINING;
537 Demod.sumI = ci;
538 Demod.sumQ = cq;
539 Demod.posCount = 1;
540 }
541 break;
542
543 case DEMOD_PHASE_REF_TRAINING:
544 if(Demod.posCount < 8) {
545 CHECK_FOR_SUBCARRIER();
546 if (v > SUBCARRIER_DETECT_THRESHOLD) {
547 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
548 // note: synchronization time > 80 1/fs
549 Demod.sumI += ci;
550 Demod.sumQ += cq;
551 Demod.posCount++;
552 } else { // subcarrier lost
553 Demod.state = DEMOD_UNSYNCD;
554 }
555 } else {
556 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
557 }
558 break;
559
560 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
561 MAKE_SOFT_DECISION();
562 if(v < 0) { // logic '0' detected
563 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
564 Demod.posCount = 0; // start of SOF sequence
565 } else {
566 if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs
567 Demod.state = DEMOD_UNSYNCD;
568 }
569 }
570 Demod.posCount++;
571 break;
572
573 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
574 Demod.posCount++;
575 MAKE_SOFT_DECISION();
576 if(v > 0) {
577 if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
578 Demod.state = DEMOD_UNSYNCD;
579 } else {
580 LED_C_ON(); // Got SOF
581 Demod.state = DEMOD_AWAITING_START_BIT;
582 Demod.posCount = 0;
583 Demod.len = 0;
584 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
585 Demod.metricN = 0;
586 Demod.metric = 0;
587 */
588 }
589 } else {
590 if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu)
591 Demod.state = DEMOD_UNSYNCD;
592 LED_C_OFF();
593 }
594 }
595 break;
596
597 case DEMOD_AWAITING_START_BIT:
598 Demod.posCount++;
599 MAKE_SOFT_DECISION();
600 if(v > 0) {
601 if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
602 Demod.state = DEMOD_UNSYNCD;
603 LED_C_OFF();
604 }
605 } else { // start bit detected
606 Demod.bitCount = 0;
607 Demod.posCount = 1; // this was the first half
608 Demod.thisBit = v;
609 Demod.shiftReg = 0;
610 Demod.state = DEMOD_RECEIVING_DATA;
611 }
612 break;
613
614 case DEMOD_RECEIVING_DATA:
615 MAKE_SOFT_DECISION();
616 if(Demod.posCount == 0) { // first half of bit
617 Demod.thisBit = v;
618 Demod.posCount = 1;
619 } else { // second half of bit
620 Demod.thisBit += v;
621
622 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
623 if(Demod.thisBit > 0) {
624 Demod.metric += Demod.thisBit;
625 } else {
626 Demod.metric -= Demod.thisBit;
627 }
628 (Demod.metricN)++;
629 */
630
631 Demod.shiftReg >>= 1;
632 if(Demod.thisBit > 0) { // logic '1'
633 Demod.shiftReg |= 0x200;
634 }
635
636 Demod.bitCount++;
637 if(Demod.bitCount == 10) {
638 uint16_t s = Demod.shiftReg;
639 if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'
640 uint8_t b = (s >> 1);
641 Demod.output[Demod.len] = b;
642 Demod.len++;
643 Demod.state = DEMOD_AWAITING_START_BIT;
644 } else {
645 Demod.state = DEMOD_UNSYNCD;
646 LED_C_OFF();
647 if(s == 0x000) {
648 // This is EOF (start, stop and all data bits == '0'
649 return TRUE;
650 }
651 }
652 }
653 Demod.posCount = 0;
654 }
655 break;
656
657 default:
658 Demod.state = DEMOD_UNSYNCD;
659 LED_C_OFF();
660 break;
661 }
662
663 return FALSE;
664 }
665
666
667 static void DemodReset()
668 {
669 // Clear out the state of the "UART" that receives from the tag.
670 Demod.len = 0;
671 Demod.state = DEMOD_UNSYNCD;
672 Demod.posCount = 0;
673 memset(Demod.output, 0x00, MAX_FRAME_SIZE);
674 }
675
676
677 static void DemodInit(uint8_t *data)
678 {
679 Demod.output = data;
680 DemodReset();
681 }
682
683
684 static void UartReset()
685 {
686 Uart.byteCntMax = MAX_FRAME_SIZE;
687 Uart.state = STATE_UNSYNCD;
688 Uart.byteCnt = 0;
689 Uart.bitCnt = 0;
690 }
691
692
693 static void UartInit(uint8_t *data)
694 {
695 Uart.output = data;
696 UartReset();
697 }
698
699
700 /*
701 * Demodulate the samples we received from the tag, also log to tracebuffer
702 * quiet: set to 'TRUE' to disable debug output
703 */
704 static void GetSamplesFor14443bDemod(int n, bool quiet)
705 {
706 int max = 0;
707 bool gotFrame = FALSE;
708 int lastRxCounter, ci, cq, samples = 0;
709
710 // Allocate memory from BigBuf for some buffers
711 // free all previous allocations first
712 BigBuf_free();
713
714 // The response (tag -> reader) that we're receiving.
715 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
716
717 // The DMA buffer, used to stream samples from the FPGA
718 int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
719
720 // Set up the demodulator for tag -> reader responses.
721 DemodInit(receivedResponse);
722
723 // Setup and start DMA.
724 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
725
726 int8_t *upTo = dmaBuf;
727 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
728
729 // Signal field is ON with the appropriate LED:
730 LED_D_ON();
731 // And put the FPGA in the appropriate mode
732 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
733
734 for(;;) {
735 int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
736 if(behindBy > max) max = behindBy;
737
738 while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
739 ci = upTo[0];
740 cq = upTo[1];
741 upTo += 2;
742 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
743 upTo = dmaBuf;
744 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
745 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
746 }
747 lastRxCounter -= 2;
748 if(lastRxCounter <= 0) {
749 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
750 }
751
752 samples += 2;
753
754 if(Handle14443bSamplesDemod(ci, cq)) {
755 gotFrame = TRUE;
756 break;
757 }
758 }
759
760 if(samples > n || gotFrame) {
761 break;
762 }
763 }
764
765 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
766
767 if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", max, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
768 //Tracing
769 if (tracing && Demod.len > 0) {
770 uint8_t parity[MAX_PARITY_SIZE];
771 GetParity(Demod.output, Demod.len, parity);
772 LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
773 }
774 }
775
776
777 //-----------------------------------------------------------------------------
778 // Transmit the command (to the tag) that was placed in ToSend[].
779 //-----------------------------------------------------------------------------
780 static void TransmitFor14443b(void)
781 {
782 int c;
783
784 FpgaSetupSsc();
785
786 while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
787 AT91C_BASE_SSC->SSC_THR = 0xff;
788 }
789
790 // Signal field is ON with the appropriate Red LED
791 LED_D_ON();
792 // Signal we are transmitting with the Green LED
793 LED_B_ON();
794 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
795
796 for(c = 0; c < 10;) {
797 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
798 AT91C_BASE_SSC->SSC_THR = 0xff;
799 c++;
800 }
801 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
802 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
803 (void)r;
804 }
805 WDT_HIT();
806 }
807
808 c = 0;
809 for(;;) {
810 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
811 AT91C_BASE_SSC->SSC_THR = ToSend[c];
812 c++;
813 if(c >= ToSendMax) {
814 break;
815 }
816 }
817 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
818 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
819 (void)r;
820 }
821 WDT_HIT();
822 }
823 LED_B_OFF(); // Finished sending
824 }
825
826
827 //-----------------------------------------------------------------------------
828 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
829 // so that it is ready to transmit to the tag using TransmitFor14443b().
830 //-----------------------------------------------------------------------------
831 static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
832 {
833 int i, j;
834 uint8_t b;
835
836 ToSendReset();
837
838 // Establish initial reference level
839 for(i = 0; i < 40; i++) {
840 ToSendStuffBit(1);
841 }
842 // Send SOF
843 for(i = 0; i < 10; i++) {
844 ToSendStuffBit(0);
845 }
846
847 for(i = 0; i < len; i++) {
848 // Stop bits/EGT
849 ToSendStuffBit(1);
850 ToSendStuffBit(1);
851 // Start bit
852 ToSendStuffBit(0);
853 // Data bits
854 b = cmd[i];
855 for(j = 0; j < 8; j++) {
856 if(b & 1) {
857 ToSendStuffBit(1);
858 } else {
859 ToSendStuffBit(0);
860 }
861 b >>= 1;
862 }
863 }
864 // Send EOF
865 ToSendStuffBit(1);
866 for(i = 0; i < 10; i++) {
867 ToSendStuffBit(0);
868 }
869 for(i = 0; i < 8; i++) {
870 ToSendStuffBit(1);
871 }
872
873 // And then a little more, to make sure that the last character makes
874 // it out before we switch to rx mode.
875 for(i = 0; i < 24; i++) {
876 ToSendStuffBit(1);
877 }
878
879 // Convert from last character reference to length
880 ToSendMax++;
881 }
882
883
884 //-----------------------------------------------------------------------------
885 // Read an ISO 14443B tag. We send it some set of commands, and record the
886 // responses.
887 // The command name is misleading, it actually decodes the reponse in HEX
888 // into the output buffer (read the result using hexsamples, not hisamples)
889 //
890 // obsolete function only for test
891 //-----------------------------------------------------------------------------
892 void AcquireRawAdcSamplesIso14443b(uint32_t parameter)
893 {
894 uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // REQB with AFI=0, Request All, N=0
895
896 SendRawCommand14443B(sizeof(cmd1),1,1,cmd1);
897 }
898
899
900 /**
901 Convenience function to encode, transmit and trace iso 14443b comms
902 **/
903 static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
904 {
905 CodeIso14443bAsReader(cmd, len);
906 TransmitFor14443b();
907 if (tracing) {
908 uint8_t parity[MAX_PARITY_SIZE];
909 GetParity(cmd, len, parity);
910 LogTrace(cmd,len, 0, 0, parity, TRUE);
911 }
912 }
913
914
915 //-----------------------------------------------------------------------------
916 // Read a SRI512 ISO 14443B tag.
917 //
918 // SRI512 tags are just simple memory tags, here we're looking at making a dump
919 // of the contents of the memory. No anticollision algorithm is done, we assume
920 // we have a single tag in the field.
921 //
922 // I tried to be systematic and check every answer of the tag, every CRC, etc...
923 //-----------------------------------------------------------------------------
924 void ReadSTMemoryIso14443b(uint32_t dwLast)
925 {
926 clear_trace();
927 set_tracing(TRUE);
928
929 uint8_t i = 0x00;
930
931 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
932 // Make sure that we start from off, since the tags are stateful;
933 // confusing things will happen if we don't reset them between reads.
934 LED_D_OFF();
935 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
936 SpinDelay(200);
937
938 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
939 FpgaSetupSsc();
940
941 // Now give it time to spin up.
942 // Signal field is on with the appropriate LED
943 LED_D_ON();
944 FpgaWriteConfWord(
945 FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
946 SpinDelay(200);
947
948 // First command: wake up the tag using the INITIATE command
949 uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
950
951 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
952 // LED_A_ON();
953 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
954 // LED_A_OFF();
955
956 if (Demod.len == 0) {
957 DbpString("No response from tag");
958 return;
959 } else {
960 Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",
961 Demod.output[0], Demod.output[1], Demod.output[2]);
962 }
963 // There is a response, SELECT the uid
964 DbpString("Now SELECT tag:");
965 cmd1[0] = 0x0E; // 0x0E is SELECT
966 cmd1[1] = Demod.output[0];
967 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
968 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
969
970 // LED_A_ON();
971 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
972 // LED_A_OFF();
973 if (Demod.len != 3) {
974 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
975 return;
976 }
977 // Check the CRC of the answer:
978 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
979 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
980 DbpString("CRC Error reading select response.");
981 return;
982 }
983 // Check response from the tag: should be the same UID as the command we just sent:
984 if (cmd1[1] != Demod.output[0]) {
985 Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);
986 return;
987 }
988 // Tag is now selected,
989 // First get the tag's UID:
990 cmd1[0] = 0x0B;
991 ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
992 CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
993
994 // LED_A_ON();
995 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
996 // LED_A_OFF();
997 if (Demod.len != 10) {
998 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
999 return;
1000 }
1001 // The check the CRC of the answer (use cmd1 as temporary variable):
1002 ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
1003 if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
1004 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
1005 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
1006 // Do not return;, let's go on... (we should retry, maybe ?)
1007 }
1008 Dbprintf("Tag UID (64 bits): %08x %08x",
1009 (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
1010 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
1011
1012 // Now loop to read all 16 blocks, address from 0 to last block
1013 Dbprintf("Tag memory dump, block 0 to %d",dwLast);
1014 cmd1[0] = 0x08;
1015 i = 0x00;
1016 dwLast++;
1017 for (;;) {
1018 if (i == dwLast) {
1019 DbpString("System area block (0xff):");
1020 i = 0xff;
1021 }
1022 cmd1[1] = i;
1023 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1024 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
1025
1026 // LED_A_ON();
1027 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
1028 // LED_A_OFF();
1029 if (Demod.len != 6) { // Check if we got an answer from the tag
1030 DbpString("Expected 6 bytes from tag, got less...");
1031 return;
1032 }
1033 // The check the CRC of the answer (use cmd1 as temporary variable):
1034 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
1035 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
1036 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
1037 (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
1038 // Do not return;, let's go on... (we should retry, maybe ?)
1039 }
1040 // Now print out the memory location:
1041 Dbprintf("Address=%x, Contents=%x, CRC=%x", i,
1042 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1043 (Demod.output[4]<<8)+Demod.output[5]);
1044 if (i == 0xff) {
1045 break;
1046 }
1047 i++;
1048 }
1049 }
1050
1051
1052 //=============================================================================
1053 // Finally, the `sniffer' combines elements from both the reader and
1054 // simulated tag, to show both sides of the conversation.
1055 //=============================================================================
1056
1057 //-----------------------------------------------------------------------------
1058 // Record the sequence of commands sent by the reader to the tag, with
1059 // triggering so that we start recording at the point that the tag is moved
1060 // near the reader.
1061 //-----------------------------------------------------------------------------
1062 /*
1063 * Memory usage for this function, (within BigBuf)
1064 * Last Received command (reader->tag) - MAX_FRAME_SIZE
1065 * Last Received command (tag->reader) - MAX_FRAME_SIZE
1066 * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
1067 * Demodulated samples received - all the rest
1068 */
1069 void RAMFUNC SnoopIso14443b(void)
1070 {
1071 // We won't start recording the frames that we acquire until we trigger;
1072 // a good trigger condition to get started is probably when we see a
1073 // response from the tag.
1074 int triggered = TRUE; // TODO: set and evaluate trigger condition
1075
1076 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1077 BigBuf_free();
1078
1079 clear_trace();
1080 set_tracing(TRUE);
1081
1082 // The DMA buffer, used to stream samples from the FPGA
1083 int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
1084 int lastRxCounter;
1085 int8_t *upTo;
1086 int ci, cq;
1087 int maxBehindBy = 0;
1088
1089 // Count of samples received so far, so that we can include timing
1090 // information in the trace buffer.
1091 int samples = 0;
1092
1093 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
1094 UartInit(BigBuf_malloc(MAX_FRAME_SIZE));
1095
1096 // Print some debug information about the buffer sizes
1097 Dbprintf("Snooping buffers initialized:");
1098 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1099 Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
1100 Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
1101 Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
1102
1103 // Signal field is off, no reader signal, no tag signal
1104 LEDsoff();
1105
1106 // And put the FPGA in the appropriate mode
1107 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_SNOOP);
1108 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1109
1110 // Setup for the DMA.
1111 FpgaSetupSsc();
1112 upTo = dmaBuf;
1113 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
1114 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
1115 uint8_t parity[MAX_PARITY_SIZE];
1116
1117 bool TagIsActive = FALSE;
1118 bool ReaderIsActive = FALSE;
1119
1120 // And now we loop, receiving samples.
1121 for(;;) {
1122 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
1123 (ISO14443B_DMA_BUFFER_SIZE-1);
1124 if(behindBy > maxBehindBy) {
1125 maxBehindBy = behindBy;
1126 }
1127
1128 if(behindBy < 2) continue;
1129
1130 ci = upTo[0];
1131 cq = upTo[1];
1132 upTo += 2;
1133 lastRxCounter -= 2;
1134 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
1135 upTo = dmaBuf;
1136 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
1137 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
1138 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
1139 WDT_HIT();
1140 if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
1141 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
1142 break;
1143 }
1144 if(!tracing) {
1145 DbpString("Reached trace limit");
1146 break;
1147 }
1148 if(BUTTON_PRESS()) {
1149 DbpString("cancelled");
1150 break;
1151 }
1152 }
1153
1154 samples += 2;
1155
1156 if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
1157 if(Handle14443bUartBit(ci & 0x01)) {
1158 if(triggered && tracing) {
1159 GetParity(Uart.output, Uart.byteCnt, parity);
1160 LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
1161 }
1162 /* And ready to receive another command. */
1163 UartReset();
1164 /* And also reset the demod code, which might have been */
1165 /* false-triggered by the commands from the reader. */
1166 DemodReset();
1167 }
1168 if(Handle14443bUartBit(cq & 0x01)) {
1169 if(triggered && tracing) {
1170 GetParity(Uart.output, Uart.byteCnt, parity);
1171 LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
1172 }
1173 /* And ready to receive another command. */
1174 UartReset();
1175 /* And also reset the demod code, which might have been */
1176 /* false-triggered by the commands from the reader. */
1177 DemodReset();
1178 }
1179 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
1180 }
1181
1182 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
1183 if(Handle14443bSamplesDemod(ci & 0xFE, cq & 0xFE)) {
1184
1185 //Use samples as a time measurement
1186 if(tracing)
1187 {
1188 uint8_t parity[MAX_PARITY_SIZE];
1189 GetParity(Demod.output, Demod.len, parity);
1190 LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE);
1191 }
1192 triggered = TRUE;
1193
1194 // And ready to receive another response.
1195 DemodReset();
1196 }
1197 TagIsActive = (Demod.state > DEMOD_PHASE_REF_TRAINING);
1198 }
1199
1200 }
1201
1202 FpgaDisableSscDma();
1203 LEDsoff();
1204 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
1205 DbpString("Snoop statistics:");
1206 Dbprintf(" Max behind by: %i", maxBehindBy);
1207 Dbprintf(" Uart State: %x", Uart.state);
1208 Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);
1209 Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);
1210 Dbprintf(" Trace length: %i", BigBuf_get_traceLen());
1211 }
1212
1213
1214 /*
1215 * Send raw command to tag ISO14443B
1216 * @Input
1217 * datalen len of buffer data
1218 * recv bool when true wait for data from tag and send to client
1219 * powerfield bool leave the field on when true
1220 * data buffer with byte to send
1221 *
1222 * @Output
1223 * none
1224 *
1225 */
1226 void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])
1227 {
1228 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1229 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1230 FpgaSetupSsc();
1231
1232 set_tracing(TRUE);
1233
1234 /* if(!powerfield) {
1235 // Make sure that we start from off, since the tags are stateful;
1236 // confusing things will happen if we don't reset them between reads.
1237 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1238 LED_D_OFF();
1239 SpinDelay(200);
1240 }
1241 */
1242
1243 // if(!GETBIT(GPIO_LED_D)) { // if field is off
1244 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
1245 // // Signal field is on with the appropriate LED
1246 // LED_D_ON();
1247 // SpinDelay(200);
1248 // }
1249
1250 CodeAndTransmit14443bAsReader(data, datalen);
1251
1252 if(recv) {
1253 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
1254 uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
1255 cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
1256 }
1257
1258 if(!powerfield) {
1259 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1260 LED_D_OFF();
1261 }
1262 }
1263
Proxmark3 GIT tracking
Impressum, Datenschutz