git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443.c

   1 //-----------------------------------------------------------------------------
   2 // Jonathan Westhues, split Nov 2006
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Routines to support ISO 14443. This includes both the reader software and
   9 // the `fake tag' modes. At the moment only the Type B modulation is
  10 // supported.
  11 //-----------------------------------------------------------------------------
  12
  13 #include "proxmark3.h"
  14 #include "apps.h"
  15 #include "util.h"
  16 #include "string.h"
  17
  18 #include "iso14443crc.h"
  19
  20 //static void GetSamplesFor14443(int weTx, int n);
  21
  22 #define DEMOD_TRACE_SIZE 4096
  23 #define READER_TAG_BUFFER_SIZE 2048
  24 #define TAG_READER_BUFFER_SIZE 2048
  25 #define DEMOD_DMA_BUFFER_SIZE 1024
  26
  27 //=============================================================================
  28 // An ISO 14443 Type B tag. We listen for commands from the reader, using
  29 // a UART kind of thing that's implemented in software. When we get a
  30 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
  31 // If it's good, then we can do something appropriate with it, and send
  32 // a response.
  33 //=============================================================================
  34
  35 //-----------------------------------------------------------------------------
  36 // Code up a string of octets at layer 2 (including CRC, we don't generate
  37 // that here) so that they can be transmitted to the reader. Doesn't transmit
  38 // them yet, just leaves them ready to send in ToSend[].
  39 //-----------------------------------------------------------------------------
  40 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
  41 {
  42     int i;
  43
  44     ToSendReset();
  45
  46     // Transmit a burst of ones, as the initial thing that lets the
  47     // reader get phase sync. This (TR1) must be > 80/fs, per spec,
  48     // but tag that I've tried (a Paypass) exceeds that by a fair bit,
  49     // so I will too.
  50     for(i = 0; i < 20; i++) {
  51         ToSendStuffBit(1);
  52         ToSendStuffBit(1);
  53         ToSendStuffBit(1);
  54         ToSendStuffBit(1);
  55     }
  56
  57     // Send SOF.
  58     for(i = 0; i < 10; i++) {
  59         ToSendStuffBit(0);
  60         ToSendStuffBit(0);
  61         ToSendStuffBit(0);
  62         ToSendStuffBit(0);
  63     }
  64     for(i = 0; i < 2; i++) {
  65         ToSendStuffBit(1);
  66         ToSendStuffBit(1);
  67         ToSendStuffBit(1);
  68         ToSendStuffBit(1);
  69     }
  70
  71     for(i = 0; i < len; i++) {
  72         int j;
  73         uint8_t b = cmd[i];
  74
  75         // Start bit
  76         ToSendStuffBit(0);
  77         ToSendStuffBit(0);
  78         ToSendStuffBit(0);
  79         ToSendStuffBit(0);
  80
  81         // Data bits
  82         for(j = 0; j < 8; j++) {
  83             if(b & 1) {
  84                 ToSendStuffBit(1);
  85                 ToSendStuffBit(1);
  86                 ToSendStuffBit(1);
  87                 ToSendStuffBit(1);
  88             } else {
  89                 ToSendStuffBit(0);
  90                 ToSendStuffBit(0);
  91                 ToSendStuffBit(0);
  92                 ToSendStuffBit(0);
  93             }
  94             b >>= 1;
  95         }
  96
  97         // Stop bit
  98         ToSendStuffBit(1);
  99         ToSendStuffBit(1);
 100         ToSendStuffBit(1);
 101         ToSendStuffBit(1);
 102     }
 103
 104     // Send SOF.
 105     for(i = 0; i < 10; i++) {
 106         ToSendStuffBit(0);
 107         ToSendStuffBit(0);
 108         ToSendStuffBit(0);
 109         ToSendStuffBit(0);
 110     }
 111     for(i = 0; i < 10; i++) {
 112         ToSendStuffBit(1);
 113         ToSendStuffBit(1);
 114         ToSendStuffBit(1);
 115         ToSendStuffBit(1);
 116     }
 117
 118     // Convert from last byte pos to length
 119     ToSendMax++;
 120
 121     // Add a few more for slop
 122     ToSendMax += 2;
 123 }
 124
 125 //-----------------------------------------------------------------------------
 126 // The software UART that receives commands from the reader, and its state
 127 // variables.
 128 //-----------------------------------------------------------------------------
 129 static struct {
 130     enum {
 131         STATE_UNSYNCD,
 132         STATE_GOT_FALLING_EDGE_OF_SOF,
 133         STATE_AWAITING_START_BIT,
 134         STATE_RECEIVING_DATA,
 135         STATE_ERROR_WAIT
 136     }       state;
 137     uint16_t    shiftReg;
 138     int     bitCnt;
 139     int     byteCnt;
 140     int     byteCntMax;
 141     int     posCnt;
 142     uint8_t   *output;
 143 } Uart;
 144
 145 /* Receive & handle a bit coming from the reader.
 146  *
 147  * LED handling:
 148  * LED A -> ON once we have received the SOF and are expecting the rest.
 149  * LED A -> OFF once we have received EOF or are in error state or unsynced
 150  *
 151  * Returns: true if we received a EOF
 152  *          false if we are still waiting for some more
 153  */
 154 static int Handle14443UartBit(int bit)
 155 {
 156     switch(Uart.state) {
 157         case STATE_UNSYNCD:
 158                 LED_A_OFF();
 159             if(!bit) {
 160                 // we went low, so this could be the beginning
 161                 // of an SOF
 162                 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
 163                 Uart.posCnt = 0;
 164                 Uart.bitCnt = 0;
 165             }
 166             break;
 167
 168         case STATE_GOT_FALLING_EDGE_OF_SOF:
 169             Uart.posCnt++;
 170             if(Uart.posCnt == 2) {
 171                 if(bit) {
 172                     if(Uart.bitCnt >= 10) {
 173                         // we've seen enough consecutive
 174                         // zeros that it's a valid SOF
 175                         Uart.posCnt = 0;
 176                         Uart.byteCnt = 0;
 177                         Uart.state = STATE_AWAITING_START_BIT;
 178                         LED_A_ON(); // Indicate we got a valid SOF
 179                     } else {
 180                         // didn't stay down long enough
 181                         // before going high, error
 182                         Uart.state = STATE_ERROR_WAIT;
 183                     }
 184                 } else {
 185                     // do nothing, keep waiting
 186                 }
 187                 Uart.bitCnt++;
 188             }
 189             if(Uart.posCnt >= 4) Uart.posCnt = 0;
 190             if(Uart.bitCnt > 14) {
 191                 // Give up if we see too many zeros without
 192                 // a one, too.
 193                 Uart.state = STATE_ERROR_WAIT;
 194             }
 195             break;
 196
 197         case STATE_AWAITING_START_BIT:
 198             Uart.posCnt++;
 199             if(bit) {
 200                 if(Uart.posCnt > 25) {
 201                     // stayed high for too long between
 202                     // characters, error
 203                     Uart.state = STATE_ERROR_WAIT;
 204                 }
 205             } else {
 206                 // falling edge, this starts the data byte
 207                 Uart.posCnt = 0;
 208                 Uart.bitCnt = 0;
 209                 Uart.shiftReg = 0;
 210                 Uart.state = STATE_RECEIVING_DATA;
 211                 LED_A_ON(); // Indicate we're receiving
 212             }
 213             break;
 214
 215         case STATE_RECEIVING_DATA:
 216             Uart.posCnt++;
 217             if(Uart.posCnt == 2) {
 218                 // time to sample a bit
 219                 Uart.shiftReg >>= 1;
 220                 if(bit) {
 221                     Uart.shiftReg |= 0x200;
 222                 }
 223                 Uart.bitCnt++;
 224             }
 225             if(Uart.posCnt >= 4) {
 226                 Uart.posCnt = 0;
 227             }
 228             if(Uart.bitCnt == 10) {
 229                 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
 230                 {
 231                     // this is a data byte, with correct
 232                     // start and stop bits
 233                     Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
 234                     Uart.byteCnt++;
 235
 236                     if(Uart.byteCnt >= Uart.byteCntMax) {
 237                         // Buffer overflowed, give up
 238                         Uart.posCnt = 0;
 239                         Uart.state = STATE_ERROR_WAIT;
 240                     } else {
 241                         // so get the next byte now
 242                         Uart.posCnt = 0;
 243                         Uart.state = STATE_AWAITING_START_BIT;
 244                     }
 245                 } else if(Uart.shiftReg == 0x000) {
 246                     // this is an EOF byte
 247                         LED_A_OFF(); // Finished receiving
 248                     return TRUE;
 249                 } else {
 250                     // this is an error
 251                     Uart.posCnt = 0;
 252                     Uart.state = STATE_ERROR_WAIT;
 253                 }
 254             }
 255             break;
 256
 257         case STATE_ERROR_WAIT:
 258             // We're all screwed up, so wait a little while
 259             // for whatever went wrong to finish, and then
 260             // start over.
 261             Uart.posCnt++;
 262             if(Uart.posCnt > 10) {
 263                 Uart.state = STATE_UNSYNCD;
 264             }
 265             break;
 266
 267         default:
 268             Uart.state = STATE_UNSYNCD;
 269             break;
 270     }
 271
 272     // This row make the error blew circular buffer in hf 14b snoop
 273     //if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error
 274
 275     return FALSE;
 276 }
 277
 278 //-----------------------------------------------------------------------------
 279 // Receive a command (from the reader to us, where we are the simulated tag),
 280 // and store it in the given buffer, up to the given maximum length. Keeps
 281 // spinning, waiting for a well-framed command, until either we get one
 282 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
 283 //
 284 // Assume that we're called with the SSC (to the FPGA) and ADC path set
 285 // correctly.
 286 //-----------------------------------------------------------------------------
 287 static int GetIso14443CommandFromReader(uint8_t *received, int *len, int maxLen)
 288 {
 289     uint8_t mask;
 290     int i, bit;
 291
 292     // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
 293     // only, since we are receiving, not transmitting).
 294     // Signal field is off with the appropriate LED
 295     LED_D_OFF();
 296     FpgaWriteConfWord(
 297         FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
 298
 299
 300     // Now run a `software UART' on the stream of incoming samples.
 301     Uart.output = received;
 302     Uart.byteCntMax = maxLen;
 303     Uart.state = STATE_UNSYNCD;
 304
 305     for(;;) {
 306         WDT_HIT();
 307
 308         if(BUTTON_PRESS()) return FALSE;
 309
 310         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 311             AT91C_BASE_SSC->SSC_THR = 0x00;
 312         }
 313         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 314             uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 315
 316             mask = 0x80;
 317             for(i = 0; i < 8; i++, mask >>= 1) {
 318                 bit = (b & mask);
 319                 if(Handle14443UartBit(bit)) {
 320                     *len = Uart.byteCnt;
 321                     return TRUE;
 322                 }
 323             }
 324         }
 325     }
 326 }
 327
 328 //-----------------------------------------------------------------------------
 329 // Main loop of simulated tag: receive commands from reader, decide what
 330 // response to send, and send it.
 331 //-----------------------------------------------------------------------------
 332 void SimulateIso14443Tag(void)
 333 {
 334     static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 335     static const uint8_t response1[] = {
 336         0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
 337         0x00, 0x21, 0x85, 0x5e, 0xd7
 338     };
 339
 340     uint8_t *resp;
 341     int respLen;
 342
 343     uint8_t *resp1 = (((uint8_t *)BigBuf) + 800);
 344     int resp1Len;
 345
 346     uint8_t *receivedCmd = (uint8_t *)BigBuf;
 347     int len;
 348
 349     int i;
 350
 351     int cmdsRecvd = 0;
 352
 353     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 354     memset(receivedCmd, 0x44, 400);
 355
 356     CodeIso14443bAsTag(response1, sizeof(response1));
 357     memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
 358
 359     // We need to listen to the high-frequency, peak-detected path.
 360     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 361     FpgaSetupSsc();
 362
 363     cmdsRecvd = 0;
 364
 365     for(;;) {
 366         uint8_t b1, b2;
 367
 368         if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {
 369                 Dbprintf("button pressed, received %d commands", cmdsRecvd);
 370                 break;
 371         }
 372
 373         // Good, look at the command now.
 374
 375         if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
 376             resp = resp1; respLen = resp1Len;
 377         } else {
 378             Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
 379             // And print whether the CRC fails, just for good measure
 380             ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
 381             if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
 382                 // Not so good, try again.
 383                 DbpString("+++CRC fail");
 384             } else {
 385                 DbpString("CRC passes");
 386             }
 387             break;
 388         }
 389
 390         memset(receivedCmd, 0x44, 32);
 391
 392         cmdsRecvd++;
 393
 394         if(cmdsRecvd > 0x30) {
 395             DbpString("many commands later...");
 396             break;
 397         }
 398
 399         if(respLen <= 0) continue;
 400
 401         // Modulate BPSK
 402         // Signal field is off with the appropriate LED
 403         LED_D_OFF();
 404         FpgaWriteConfWord(
 405                 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
 406         AT91C_BASE_SSC->SSC_THR = 0xff;
 407         FpgaSetupSsc();
 408
 409         // Transmit the response.
 410         i = 0;
 411         for(;;) {
 412             if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 413                 uint8_t b = resp[i];
 414
 415                 AT91C_BASE_SSC->SSC_THR = b;
 416
 417                 i++;
 418                 if(i > respLen) {
 419                     break;
 420                 }
 421             }
 422             if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 423                 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 424                 (void)b;
 425             }
 426         }
 427     }
 428 }
 429
 430 //=============================================================================
 431 // An ISO 14443 Type B reader. We take layer two commands, code them
 432 // appropriately, and then send them to the tag. We then listen for the
 433 // tag's response, which we leave in the buffer to be demodulated on the
 434 // PC side.
 435 //=============================================================================
 436
 437 static struct {
 438     enum {
 439         DEMOD_UNSYNCD,
 440         DEMOD_PHASE_REF_TRAINING,
 441         DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
 442         DEMOD_GOT_FALLING_EDGE_OF_SOF,
 443         DEMOD_AWAITING_START_BIT,
 444         DEMOD_RECEIVING_DATA,
 445         DEMOD_ERROR_WAIT
 446     }       state;
 447     int     bitCount;
 448     int     posCount;
 449     int     thisBit;
 450     int     metric;
 451     int     metricN;
 452     uint16_t    shiftReg;
 453     uint8_t   *output;
 454     int     len;
 455     int     sumI;
 456     int     sumQ;
 457 } Demod;
 458
 459 /*
 460  * Handles reception of a bit from the tag
 461  *
 462  * LED handling:
 463  * LED C -> ON once we have received the SOF and are expecting the rest.
 464  * LED C -> OFF once we have received EOF or are unsynced
 465  *
 466  * Returns: true if we received a EOF
 467  *          false if we are still waiting for some more
 468  *
 469  */
 470 static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)
 471 {
 472     int v;
 473
 474     // The soft decision on the bit uses an estimate of just the
 475     // quadrant of the reference angle, not the exact angle.
 476 #define MAKE_SOFT_DECISION() { \
 477         if(Demod.sumI > 0) { \
 478             v = ci; \
 479         } else { \
 480             v = -ci; \
 481         } \
 482         if(Demod.sumQ > 0) { \
 483             v += cq; \
 484         } else { \
 485             v -= cq; \
 486         } \
 487     }
 488
 489     switch(Demod.state) {
 490         case DEMOD_UNSYNCD:
 491             v = ci;
 492             if(v < 0) v = -v;
 493             if(cq > 0) {
 494                 v += cq;
 495             } else {
 496                 v -= cq;
 497             }
 498             if(v > 40) {
 499                 Demod.posCount = 0;
 500                 Demod.state = DEMOD_PHASE_REF_TRAINING;
 501                 Demod.sumI = 0;
 502                 Demod.sumQ = 0;
 503             }
 504             break;
 505
 506         case DEMOD_PHASE_REF_TRAINING:
 507             if(Demod.posCount < 8) {
 508                 Demod.sumI += ci;
 509                 Demod.sumQ += cq;
 510             } else if(Demod.posCount > 100) {
 511                 // error, waited too long
 512                 Demod.state = DEMOD_UNSYNCD;
 513             } else {
 514                 MAKE_SOFT_DECISION();
 515                 if(v < 0) {
 516                     Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
 517                     Demod.posCount = 0;
 518                 }
 519             }
 520             Demod.posCount++;
 521             break;
 522
 523         case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
 524             MAKE_SOFT_DECISION();
 525             if(v < 0) {
 526                 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
 527                 Demod.posCount = 0;
 528             } else {
 529                 if(Demod.posCount > 100) {
 530                     Demod.state = DEMOD_UNSYNCD;
 531                 }
 532             }
 533             Demod.posCount++;
 534             break;
 535
 536         case DEMOD_GOT_FALLING_EDGE_OF_SOF:
 537             MAKE_SOFT_DECISION();
 538             if(v > 0) {
 539                 if(Demod.posCount < 12) {
 540                     Demod.state = DEMOD_UNSYNCD;
 541                 } else {
 542                     LED_C_ON(); // Got SOF
 543                     Demod.state = DEMOD_AWAITING_START_BIT;
 544                     Demod.posCount = 0;
 545                     Demod.len = 0;
 546                     Demod.metricN = 0;
 547                     Demod.metric = 0;
 548                 }
 549             } else {
 550                 if(Demod.posCount > 100) {
 551                     Demod.state = DEMOD_UNSYNCD;
 552                 }
 553             }
 554             Demod.posCount++;
 555             break;
 556
 557         case DEMOD_AWAITING_START_BIT:
 558             MAKE_SOFT_DECISION();
 559             if(v > 0) {
 560                 if(Demod.posCount > 10) {
 561                     Demod.state = DEMOD_UNSYNCD;
 562                 }
 563             } else {
 564                 Demod.bitCount = 0;
 565                 Demod.posCount = 1;
 566                 Demod.thisBit = v;
 567                 Demod.shiftReg = 0;
 568                 Demod.state = DEMOD_RECEIVING_DATA;
 569             }
 570             break;
 571
 572         case DEMOD_RECEIVING_DATA:
 573             MAKE_SOFT_DECISION();
 574             if(Demod.posCount == 0) {
 575                 Demod.thisBit = v;
 576                 Demod.posCount = 1;
 577             } else {
 578                 Demod.thisBit += v;
 579
 580                 if(Demod.thisBit > 0) {
 581                     Demod.metric += Demod.thisBit;
 582                 } else {
 583                     Demod.metric -= Demod.thisBit;
 584                 }
 585                 (Demod.metricN)++;
 586
 587                 Demod.shiftReg >>= 1;
 588                 if(Demod.thisBit > 0) {
 589                     Demod.shiftReg |= 0x200;
 590                 }
 591
 592                 Demod.bitCount++;
 593                 if(Demod.bitCount == 10) {
 594                     uint16_t s = Demod.shiftReg;
 595                     if((s & 0x200) && !(s & 0x001)) {
 596                         uint8_t b = (s >> 1);
 597                         Demod.output[Demod.len] = b;
 598                         Demod.len++;
 599                         Demod.state = DEMOD_AWAITING_START_BIT;
 600                     } else if(s == 0x000) {
 601                         // This is EOF
 602                         LED_C_OFF();
 603                         Demod.state = DEMOD_UNSYNCD;
 604                         return TRUE;
 605                     } else {
 606                         Demod.state = DEMOD_UNSYNCD;
 607                     }
 608                 }
 609                 Demod.posCount = 0;
 610             }
 611             break;
 612
 613         default:
 614             Demod.state = DEMOD_UNSYNCD;
 615             break;
 616     }
 617
 618     if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...
 619     return FALSE;
 620 }
 621
 622 /*
 623  *  Demodulate the samples we received from the tag
 624  *  weTx: set to 'TRUE' if we behave like a reader
 625  *        set to 'FALSE' if we behave like a snooper
 626  *  quiet: set to 'TRUE' to disable debug output
 627  */
 628 static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
 629 {
 630     int max = 0;
 631     int gotFrame = FALSE;
 632
 633 //#   define DMA_BUFFER_SIZE 8
 634     int8_t *dmaBuf;
 635
 636     int lastRxCounter;
 637     int8_t *upTo;
 638
 639     int ci, cq;
 640
 641     int samples = 0;
 642
 643     // Clear out the state of the "UART" that receives from the tag.
 644     memset(BigBuf, 0x00, 400);
 645     Demod.output = (uint8_t *)BigBuf;
 646     Demod.len = 0;
 647     Demod.state = DEMOD_UNSYNCD;
 648
 649     // And the UART that receives from the reader
 650     Uart.output = (((uint8_t *)BigBuf) + 1024);
 651     Uart.byteCntMax = 100;
 652     Uart.state = STATE_UNSYNCD;
 653
 654     // Setup for the DMA.
 655     dmaBuf = (int8_t *)(BigBuf + 32);
 656     upTo = dmaBuf;
 657     lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
 658     FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
 659
 660     // Signal field is ON with the appropriate LED:
 661     if (weTx) LED_D_ON(); else LED_D_OFF();
 662     // And put the FPGA in the appropriate mode
 663     FpgaWriteConfWord(
 664         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
 665         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
 666
 667     for(;;) {
 668         int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
 669         if(behindBy > max) max = behindBy;
 670
 671         while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DEMOD_DMA_BUFFER_SIZE-1))
 672                     > 2)
 673         {
 674             ci = upTo[0];
 675             cq = upTo[1];
 676             upTo += 2;
 677             if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {
 678                 upTo -= DEMOD_DMA_BUFFER_SIZE;
 679                 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
 680                 AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;
 681             }
 682             lastRxCounter -= 2;
 683             if(lastRxCounter <= 0) {
 684                 lastRxCounter += DEMOD_DMA_BUFFER_SIZE;
 685             }
 686
 687             samples += 2;
 688
 689             Handle14443UartBit(1);
 690             Handle14443UartBit(1);
 691
 692             if(Handle14443SamplesDemod(ci, cq)) {
 693                 gotFrame = 1;
 694             }
 695         }
 696
 697         if(samples > 2000) {
 698             break;
 699         }
 700     }
 701     AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
 702     if (!quiet) Dbprintf("%x %x %x", max, gotFrame, Demod.len);
 703 }
 704
 705 //-----------------------------------------------------------------------------
 706 // Read the tag's response. We just receive a stream of slightly-processed
 707 // samples from the FPGA, which we will later do some signal processing on,
 708 // to get the bits.
 709 //-----------------------------------------------------------------------------
 710 /*static void GetSamplesFor14443(int weTx, int n)
 711 {
 712     uint8_t *dest = (uint8_t *)BigBuf;
 713     int c;
 714
 715     FpgaWriteConfWord(
 716         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
 717         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
 718
 719     c = 0;
 720     for(;;) {
 721         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 722             AT91C_BASE_SSC->SSC_THR = 0x43;
 723         }
 724         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 725             int8_t b;
 726             b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
 727
 728             dest[c++] = (uint8_t)b;
 729
 730             if(c >= n) {
 731                 break;
 732             }
 733         }
 734     }
 735 }*/
 736
 737 //-----------------------------------------------------------------------------
 738 // Transmit the command (to the tag) that was placed in ToSend[].
 739 //-----------------------------------------------------------------------------
 740 static void TransmitFor14443(void)
 741 {
 742     int c;
 743
 744     FpgaSetupSsc();
 745
 746     while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 747         AT91C_BASE_SSC->SSC_THR = 0xff;
 748     }
 749
 750     // Signal field is ON with the appropriate Red LED
 751         LED_D_ON();
 752         // Signal we are transmitting with the Green LED
 753         LED_B_ON();
 754         FpgaWriteConfWord(
 755         FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
 756
 757     for(c = 0; c < 10;) {
 758         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 759             AT91C_BASE_SSC->SSC_THR = 0xff;
 760             c++;
 761         }
 762         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 763             volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
 764             (void)r;
 765         }
 766         WDT_HIT();
 767     }
 768
 769     c = 0;
 770     for(;;) {
 771         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 772             AT91C_BASE_SSC->SSC_THR = ToSend[c];
 773             c++;
 774             if(c >= ToSendMax) {
 775                 break;
 776             }
 777         }
 778         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 779             volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
 780             (void)r;
 781         }
 782         WDT_HIT();
 783     }
 784     LED_B_OFF(); // Finished sending
 785 }
 786
 787 //-----------------------------------------------------------------------------
 788 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
 789 // so that it is ready to transmit to the tag using TransmitFor14443().
 790 //-----------------------------------------------------------------------------
 791 static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
 792 {
 793     int i, j;
 794     uint8_t b;
 795
 796     ToSendReset();
 797
 798     // Establish initial reference level
 799     for(i = 0; i < 40; i++) {
 800         ToSendStuffBit(1);
 801     }
 802     // Send SOF
 803     for(i = 0; i < 10; i++) {
 804         ToSendStuffBit(0);
 805     }
 806
 807     for(i = 0; i < len; i++) {
 808         // Stop bits/EGT
 809         ToSendStuffBit(1);
 810         ToSendStuffBit(1);
 811         // Start bit
 812         ToSendStuffBit(0);
 813         // Data bits
 814         b = cmd[i];
 815         for(j = 0; j < 8; j++) {
 816             if(b & 1) {
 817                 ToSendStuffBit(1);
 818             } else {
 819                 ToSendStuffBit(0);
 820             }
 821             b >>= 1;
 822         }
 823     }
 824     // Send EOF
 825     ToSendStuffBit(1);
 826     for(i = 0; i < 10; i++) {
 827         ToSendStuffBit(0);
 828     }
 829     for(i = 0; i < 8; i++) {
 830         ToSendStuffBit(1);
 831     }
 832
 833     // And then a little more, to make sure that the last character makes
 834     // it out before we switch to rx mode.
 835     for(i = 0; i < 24; i++) {
 836         ToSendStuffBit(1);
 837     }
 838
 839     // Convert from last character reference to length
 840     ToSendMax++;
 841 }
 842
 843 //-----------------------------------------------------------------------------
 844 // Read an ISO 14443 tag. We send it some set of commands, and record the
 845 // responses.
 846 // The command name is misleading, it actually decodes the reponse in HEX
 847 // into the output buffer (read the result using hexsamples, not hisamples)
 848 //
 849 // obsolete function only for test
 850 //-----------------------------------------------------------------------------
 851 void AcquireRawAdcSamplesIso14443(uint32_t parameter)
 852 {
 853     uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 854
 855     SendRawCommand14443B(sizeof(cmd1),1,1,cmd1);
 856 }
 857
 858 //-----------------------------------------------------------------------------
 859 // Read a SRI512 ISO 14443 tag.
 860 //
 861 // SRI512 tags are just simple memory tags, here we're looking at making a dump
 862 // of the contents of the memory. No anticollision algorithm is done, we assume
 863 // we have a single tag in the field.
 864 //
 865 // I tried to be systematic and check every answer of the tag, every CRC, etc...
 866 //-----------------------------------------------------------------------------
 867 void ReadSTMemoryIso14443(uint32_t dwLast)
 868 {
 869     uint8_t i = 0x00;
 870
 871     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 872     // Make sure that we start from off, since the tags are stateful;
 873     // confusing things will happen if we don't reset them between reads.
 874     LED_D_OFF();
 875     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 876     SpinDelay(200);
 877
 878     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 879     FpgaSetupSsc();
 880
 881     // Now give it time to spin up.
 882     // Signal field is on with the appropriate LED
 883     LED_D_ON();
 884     FpgaWriteConfWord(
 885         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 886     SpinDelay(200);
 887
 888     // First command: wake up the tag using the INITIATE command
 889     uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
 890     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 891     TransmitFor14443();
 892 //    LED_A_ON();
 893     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 894 //    LED_A_OFF();
 895
 896     if (Demod.len == 0) {
 897         DbpString("No response from tag");
 898         return;
 899     } else {
 900         Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",
 901                 Demod.output[0], Demod.output[1],Demod.output[2]);
 902     }
 903     // There is a response, SELECT the uid
 904     DbpString("Now SELECT tag:");
 905     cmd1[0] = 0x0E; // 0x0E is SELECT
 906     cmd1[1] = Demod.output[0];
 907     ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 908     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 909     TransmitFor14443();
 910 //    LED_A_ON();
 911     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 912 //    LED_A_OFF();
 913     if (Demod.len != 3) {
 914         Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
 915         return;
 916     }
 917     // Check the CRC of the answer:
 918     ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
 919     if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
 920         DbpString("CRC Error reading select response.");
 921         return;
 922     }
 923     // Check response from the tag: should be the same UID as the command we just sent:
 924     if (cmd1[1] != Demod.output[0]) {
 925         Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);
 926         return;
 927     }
 928     // Tag is now selected,
 929     // First get the tag's UID:
 930     cmd1[0] = 0x0B;
 931     ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
 932     CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one
 933     TransmitFor14443();
 934 //    LED_A_ON();
 935     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 936 //    LED_A_OFF();
 937     if (Demod.len != 10) {
 938         Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
 939         return;
 940     }
 941     // The check the CRC of the answer (use cmd1 as temporary variable):
 942     ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
 943            if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
 944         Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
 945                 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
 946         // Do not return;, let's go on... (we should retry, maybe ?)
 947     }
 948     Dbprintf("Tag UID (64 bits): %08x %08x",
 949         (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
 950         (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
 951
 952     // Now loop to read all 16 blocks, address from 0 to last block
 953     Dbprintf("Tag memory dump, block 0 to %d",dwLast);
 954     cmd1[0] = 0x08;
 955     i = 0x00;
 956     dwLast++;
 957     for (;;) {
 958            if (i == dwLast) {
 959                     DbpString("System area block (0xff):");
 960                     i = 0xff;
 961             }
 962             cmd1[1] = i;
 963             ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 964             CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 965             TransmitFor14443();
 966 //          LED_A_ON();
 967             GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 968 //          LED_A_OFF();
 969             if (Demod.len != 6) { // Check if we got an answer from the tag
 970                 DbpString("Expected 6 bytes from tag, got less...");
 971                 return;
 972             }
 973             // The check the CRC of the answer (use cmd1 as temporary variable):
 974             ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
 975             if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
 976                 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
 977                         (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
 978                 // Do not return;, let's go on... (we should retry, maybe ?)
 979             }
 980             // Now print out the memory location:
 981             Dbprintf("Address=%x, Contents=%x, CRC=%x", i,
 982                 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
 983                 (Demod.output[4]<<8)+Demod.output[5]);
 984             if (i == 0xff) {
 985                 break;
 986             }
 987             i++;
 988     }
 989 }
 990
 991
 992 //=============================================================================
 993 // Finally, the `sniffer' combines elements from both the reader and
 994 // simulated tag, to show both sides of the conversation.
 995 //=============================================================================
 996
 997 //-----------------------------------------------------------------------------
 998 // Record the sequence of commands sent by the reader to the tag, with
 999 // triggering so that we start recording at the point that the tag is moved
1000 // near the reader.
1001 //-----------------------------------------------------------------------------
1002 /*
1003  * Memory usage for this function, (within BigBuf)
1004  * 0-4095 : Demodulated samples receive (4096 bytes) - DEMOD_TRACE_SIZE
1005  * 4096-6143 : Last Received command, 2048 bytes (reader->tag) - READER_TAG_BUFFER_SIZE
1006  * 6144-8191 : Last Received command, 2048 bytes(tag->reader) - TAG_READER_BUFFER_SIZE
1007  * 8192-9215 : DMA Buffer, 1024 bytes (samples) - DEMOD_DMA_BUFFER_SIZE
1008  */
1009 void RAMFUNC SnoopIso14443(void)
1010 {
1011     // We won't start recording the frames that we acquire until we trigger;
1012     // a good trigger condition to get started is probably when we see a
1013     // response from the tag.
1014     int triggered = TRUE;
1015
1016     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1017     // The command (reader -> tag) that we're working on receiving.
1018     uint8_t *receivedCmd = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE;
1019     // The response (tag -> reader) that we're working on receiving.
1020     uint8_t *receivedResponse = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE;
1021
1022     // As we receive stuff, we copy it from receivedCmd or receivedResponse
1023     // into trace, along with its length and other annotations.
1024     uint8_t *trace = (uint8_t *)BigBuf;
1025     int traceLen = 0;
1026
1027     // The DMA buffer, used to stream samples from the FPGA.
1028     int8_t *dmaBuf = (int8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE + TAG_READER_BUFFER_SIZE;
1029     int lastRxCounter;
1030     int8_t *upTo;
1031     int ci, cq;
1032     int maxBehindBy = 0;
1033
1034     // Count of samples received so far, so that we can include timing
1035     // information in the trace buffer.
1036     int samples = 0;
1037
1038     // Initialize the trace buffer
1039     memset(trace, 0x44, DEMOD_TRACE_SIZE);
1040
1041     // Set up the demodulator for tag -> reader responses.
1042     Demod.output = receivedResponse;
1043     Demod.len = 0;
1044     Demod.state = DEMOD_UNSYNCD;
1045
1046     // And the reader -> tag commands
1047     memset(&Uart, 0, sizeof(Uart));
1048     Uart.output = receivedCmd;
1049     Uart.byteCntMax = 100;
1050     Uart.state = STATE_UNSYNCD;
1051
1052     // Print some debug information about the buffer sizes
1053     Dbprintf("Snooping buffers initialized:");
1054     Dbprintf("  Trace: %i bytes", DEMOD_TRACE_SIZE);
1055     Dbprintf("  Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);
1056     Dbprintf("  tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);
1057     Dbprintf("  DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);
1058
1059     // And put the FPGA in the appropriate mode
1060     // Signal field is off with the appropriate LED
1061     LED_D_OFF();
1062     FpgaWriteConfWord(
1063         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
1064         FPGA_HF_READER_RX_XCORR_SNOOP);
1065     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1066
1067     // Setup for the DMA.
1068     FpgaSetupSsc();
1069     upTo = dmaBuf;
1070     lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
1071     FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
1072
1073     LED_A_ON();
1074
1075     // And now we loop, receiving samples.
1076     for(;;) {
1077         int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
1078                                 (DEMOD_DMA_BUFFER_SIZE-1);
1079         if(behindBy > maxBehindBy) {
1080             maxBehindBy = behindBy;
1081             if(behindBy > (DEMOD_DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?
1082                 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
1083                 goto done;
1084             }
1085         }
1086         if(behindBy < 2) continue;
1087
1088         ci = upTo[0];
1089         cq = upTo[1];
1090         upTo += 2;
1091         lastRxCounter -= 2;
1092         if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {
1093             upTo -= DEMOD_DMA_BUFFER_SIZE;
1094             lastRxCounter += DEMOD_DMA_BUFFER_SIZE;
1095             AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
1096             AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;
1097         }
1098
1099         samples += 2;
1100
1101 #define HANDLE_BIT_IF_BODY \
1102             if(triggered) { \
1103                 trace[traceLen++] = ((samples >>  0) & 0xff); \
1104                 trace[traceLen++] = ((samples >>  8) & 0xff); \
1105                 trace[traceLen++] = ((samples >> 16) & 0xff); \
1106                 trace[traceLen++] = ((samples >> 24) & 0xff); \
1107                 trace[traceLen++] = 0; \
1108                 trace[traceLen++] = 0; \
1109                 trace[traceLen++] = 0; \
1110                 trace[traceLen++] = 0; \
1111                 trace[traceLen++] = Uart.byteCnt; \
1112                 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
1113                 traceLen += Uart.byteCnt; \
1114                 if(traceLen > 1000) break; \
1115             } \
1116             /* And ready to receive another command. */ \
1117             memset(&Uart, 0, sizeof(Uart)); \
1118             Uart.output = receivedCmd; \
1119             Uart.byteCntMax = 100; \
1120             Uart.state = STATE_UNSYNCD; \
1121             /* And also reset the demod code, which might have been */ \
1122             /* false-triggered by the commands from the reader. */ \
1123             memset(&Demod, 0, sizeof(Demod)); \
1124             Demod.output = receivedResponse; \
1125             Demod.state = DEMOD_UNSYNCD; \
1126
1127         if(Handle14443UartBit(ci & 1)) {
1128             HANDLE_BIT_IF_BODY
1129         }
1130         if(Handle14443UartBit(cq & 1)) {
1131             HANDLE_BIT_IF_BODY
1132         }
1133
1134         if(Handle14443SamplesDemod(ci, cq)) {
1135             // timestamp, as a count of samples
1136             trace[traceLen++] = ((samples >>  0) & 0xff);
1137             trace[traceLen++] = ((samples >>  8) & 0xff);
1138             trace[traceLen++] = ((samples >> 16) & 0xff);
1139             trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);
1140             // correlation metric (~signal strength estimate)
1141             if(Demod.metricN != 0) {
1142                 Demod.metric /= Demod.metricN;
1143             }
1144             trace[traceLen++] = ((Demod.metric >>  0) & 0xff);
1145             trace[traceLen++] = ((Demod.metric >>  8) & 0xff);
1146             trace[traceLen++] = ((Demod.metric >> 16) & 0xff);
1147             trace[traceLen++] = ((Demod.metric >> 24) & 0xff);
1148             // length
1149             trace[traceLen++] = Demod.len;
1150             memcpy(trace+traceLen, receivedResponse, Demod.len);
1151             traceLen += Demod.len;
1152             if(traceLen > DEMOD_TRACE_SIZE) {
1153                                 DbpString("Reached trace limit");
1154                                 goto done;
1155                         }
1156
1157             triggered = TRUE;
1158             LED_A_OFF();
1159             LED_B_ON();
1160
1161             // And ready to receive another response.
1162             memset(&Demod, 0, sizeof(Demod));
1163             Demod.output = receivedResponse;
1164             Demod.state = DEMOD_UNSYNCD;
1165         }
1166         WDT_HIT();
1167
1168         if(BUTTON_PRESS()) {
1169             DbpString("cancelled");
1170             goto done;
1171         }
1172     }
1173
1174 done:
1175         LED_A_OFF();
1176         LED_B_OFF();
1177         LED_C_OFF();
1178   AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
1179         DbpString("Snoop statistics:");
1180   Dbprintf("  Max behind by: %i", maxBehindBy);
1181         Dbprintf("  Uart State: %x", Uart.state);
1182         Dbprintf("  Uart ByteCnt: %i", Uart.byteCnt);
1183         Dbprintf("  Uart ByteCntMax: %i", Uart.byteCntMax);
1184         Dbprintf("  Trace length: %i", traceLen);
1185 }
1186
1187 /*
1188  * Send raw command to tag ISO14443B
1189  * @Input
1190  * datalen     len of buffer data
1191  * recv        bool when true wait for data from tag and send to client
1192  * powerfield  bool leave the field on when true
1193  * data        buffer with byte to send
1194  *
1195  * @Output
1196  * none
1197  *
1198  */
1199
1200 void SendRawCommand14443B(uint32_t datalen, uint32_t recv,uint8_t powerfield, uint8_t data[])
1201 {
1202     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1203     if(!powerfield)
1204     {
1205         // Make sure that we start from off, since the tags are stateful;
1206         // confusing things will happen if we don't reset them between reads.
1207         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1208         LED_D_OFF();
1209         SpinDelay(200);
1210     }
1211
1212     if(!GETBIT(GPIO_LED_D))
1213     {
1214         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1215         FpgaSetupSsc();
1216
1217         // Now give it time to spin up.
1218         // Signal field is on with the appropriate LED
1219         LED_D_ON();
1220         FpgaWriteConfWord(
1221             FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
1222         SpinDelay(200);
1223     }
1224
1225     CodeIso14443bAsReader(data, datalen);
1226     TransmitFor14443();
1227     if(recv)
1228     {
1229         uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);
1230         GetSamplesFor14443Demod(TRUE, 2000, TRUE);
1231         cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);
1232     }
1233     if(!powerfield)
1234     {
1235         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1236         LED_D_OFF();
1237     }
1238 }
1239