]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso15693.c
projects / proxmark3-svn / blob
? search:


7fdf2a35056738991fea82d15e032a90fce12e52
[proxmark3-svn] / armsrc / iso15693.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 // Modified by Greg Jones, Jan 2009
4 // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
5 // Modified by piwi, Oct 2018
6 //
7 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
8 // at your option, any later version. See the LICENSE.txt file for the text of
9 // the license.
10 //-----------------------------------------------------------------------------
11 // Routines to support ISO 15693. This includes both the reader software and
12 // the `fake tag' modes.
13 //-----------------------------------------------------------------------------
14
15 // The ISO 15693 describes two transmission modes from reader to tag, and four
16 // transmission modes from tag to reader. As of Oct 2018 this code supports
17 // both reader modes and the high speed variant with one subcarrier from card to reader.
18 // As long as the card fully support ISO 15693 this is no problem, since the
19 // reader chooses both data rates, but some non-standard tags do not.
20 // For card simulation, the code supports both high and low speed modes with one subcarrier.
21 //
22 // VCD (reader) -> VICC (tag)
23 // 1 out of 256:
24 // data rate: 1,66 kbit/s (fc/8192)
25 // used for long range
26 // 1 out of 4:
27 // data rate: 26,48 kbit/s (fc/512)
28 // used for short range, high speed
29 //
30 // VICC (tag) -> VCD (reader)
31 // Modulation:
32 // ASK / one subcarrier (423,75 khz)
33 // FSK / two subcarriers (423,75 khz && 484,28 khz)
34 // Data Rates / Modes:
35 // low ASK: 6,62 kbit/s
36 // low FSK: 6.67 kbit/s
37 // high ASK: 26,48 kbit/s
38 // high FSK: 26,69 kbit/s
39 //-----------------------------------------------------------------------------
40
41
42 // Random Remarks:
43 // *) UID is always used "transmission order" (LSB), which is reverse to display order
44
45 // TODO / BUGS / ISSUES:
46 // *) signal decoding is unable to detect collisions.
47 // *) add anti-collision support for inventory-commands
48 // *) read security status of a block
49 // *) sniffing and simulation do not support two subcarrier modes.
50 // *) remove or refactor code under "deprecated"
51 // *) document all the functions
52
53 #include "iso15693.h"
54
55 #include "proxmark3.h"
56 #include "util.h"
57 #include "apps.h"
58 #include "string.h"
59 #include "iso15693tools.h"
60 #include "protocols.h"
61 #include "cmd.h"
62 #include "BigBuf.h"
63 #include "fpgaloader.h"
64
65 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
66
67 static int DEBUG = 0;
68
69 ///////////////////////////////////////////////////////////////////////
70 // ISO 15693 Part 2 - Air Interface
71 // This section basically contains transmission and receiving of bits
72 ///////////////////////////////////////////////////////////////////////
73
74 // buffers
75 #define ISO15693_DMA_BUFFER_SIZE 2048 // must be a power of 2
76 #define ISO15693_MAX_RESPONSE_LENGTH 36 // allows read single block with the maximum block size of 256bits. Read multiple blocks not supported yet
77 #define ISO15693_MAX_COMMAND_LENGTH 45 // allows write single block with the maximum block size of 256bits. Write multiple blocks not supported yet
78
79 // ---------------------------
80 // Signal Processing
81 // ---------------------------
82
83 // prepare data using "1 out of 4" code for later transmission
84 // resulting data rate is 26.48 kbit/s (fc/512)
85 // cmd ... data
86 // n ... length of data
87 static void CodeIso15693AsReader(uint8_t *cmd, int n)
88 {
89 int i, j;
90
91 ToSendReset();
92
93 // Give it a bit of slack at the beginning
94 for(i = 0; i < 24; i++) {
95 ToSendStuffBit(1);
96 }
97
98 // SOF for 1of4
99 ToSendStuffBit(0);
100 ToSendStuffBit(1);
101 ToSendStuffBit(1);
102 ToSendStuffBit(1);
103 ToSendStuffBit(1);
104 ToSendStuffBit(0);
105 ToSendStuffBit(1);
106 ToSendStuffBit(1);
107 for(i = 0; i < n; i++) {
108 for(j = 0; j < 8; j += 2) {
109 int these = (cmd[i] >> j) & 3;
110 switch(these) {
111 case 0:
112 ToSendStuffBit(1);
113 ToSendStuffBit(0);
114 ToSendStuffBit(1);
115 ToSendStuffBit(1);
116 ToSendStuffBit(1);
117 ToSendStuffBit(1);
118 ToSendStuffBit(1);
119 ToSendStuffBit(1);
120 break;
121 case 1:
122 ToSendStuffBit(1);
123 ToSendStuffBit(1);
124 ToSendStuffBit(1);
125 ToSendStuffBit(0);
126 ToSendStuffBit(1);
127 ToSendStuffBit(1);
128 ToSendStuffBit(1);
129 ToSendStuffBit(1);
130 break;
131 case 2:
132 ToSendStuffBit(1);
133 ToSendStuffBit(1);
134 ToSendStuffBit(1);
135 ToSendStuffBit(1);
136 ToSendStuffBit(1);
137 ToSendStuffBit(0);
138 ToSendStuffBit(1);
139 ToSendStuffBit(1);
140 break;
141 case 3:
142 ToSendStuffBit(1);
143 ToSendStuffBit(1);
144 ToSendStuffBit(1);
145 ToSendStuffBit(1);
146 ToSendStuffBit(1);
147 ToSendStuffBit(1);
148 ToSendStuffBit(1);
149 ToSendStuffBit(0);
150 break;
151 }
152 }
153 }
154 // EOF
155 ToSendStuffBit(1);
156 ToSendStuffBit(1);
157 ToSendStuffBit(0);
158 ToSendStuffBit(1);
159
160 // Fill remainder of last byte with 1
161 for(i = 0; i < 4; i++) {
162 ToSendStuffBit(1);
163 }
164
165 ToSendMax++;
166 }
167
168 // encode data using "1 out of 256" scheme
169 // data rate is 1,66 kbit/s (fc/8192)
170 // is designed for more robust communication over longer distances
171 static void CodeIso15693AsReader256(uint8_t *cmd, int n)
172 {
173 int i, j;
174
175 ToSendReset();
176
177 // Give it a bit of slack at the beginning
178 for(i = 0; i < 24; i++) {
179 ToSendStuffBit(1);
180 }
181
182 // SOF for 1of256
183 ToSendStuffBit(0);
184 ToSendStuffBit(1);
185 ToSendStuffBit(1);
186 ToSendStuffBit(1);
187 ToSendStuffBit(1);
188 ToSendStuffBit(1);
189 ToSendStuffBit(1);
190 ToSendStuffBit(0);
191
192 for(i = 0; i < n; i++) {
193 for (j = 0; j<=255; j++) {
194 if (cmd[i]==j) {
195 ToSendStuffBit(1);
196 ToSendStuffBit(0);
197 } else {
198 ToSendStuffBit(1);
199 ToSendStuffBit(1);
200 }
201 }
202 }
203 // EOF
204 ToSendStuffBit(1);
205 ToSendStuffBit(1);
206 ToSendStuffBit(0);
207 ToSendStuffBit(1);
208
209 // Fill remainder of last byte with 1
210 for(i = 0; i < 4; i++) {
211 ToSendStuffBit(1);
212 }
213
214 ToSendMax++;
215 }
216
217
218 // static uint8_t encode4Bits(const uint8_t b) {
219 // uint8_t c = b & 0xF;
220 // // OTA, the least significant bits first
221 // // The columns are
222 // // 1 - Bit value to send
223 // // 2 - Reversed (big-endian)
224 // // 3 - Manchester Encoded
225 // // 4 - Hex values
226
227 // switch(c){
228 // // 1 2 3 4
229 // case 15: return 0x55; // 1111 -> 1111 -> 01010101 -> 0x55
230 // case 14: return 0x95; // 1110 -> 0111 -> 10010101 -> 0x95
231 // case 13: return 0x65; // 1101 -> 1011 -> 01100101 -> 0x65
232 // case 12: return 0xa5; // 1100 -> 0011 -> 10100101 -> 0xa5
233 // case 11: return 0x59; // 1011 -> 1101 -> 01011001 -> 0x59
234 // case 10: return 0x99; // 1010 -> 0101 -> 10011001 -> 0x99
235 // case 9: return 0x69; // 1001 -> 1001 -> 01101001 -> 0x69
236 // case 8: return 0xa9; // 1000 -> 0001 -> 10101001 -> 0xa9
237 // case 7: return 0x56; // 0111 -> 1110 -> 01010110 -> 0x56
238 // case 6: return 0x96; // 0110 -> 0110 -> 10010110 -> 0x96
239 // case 5: return 0x66; // 0101 -> 1010 -> 01100110 -> 0x66
240 // case 4: return 0xa6; // 0100 -> 0010 -> 10100110 -> 0xa6
241 // case 3: return 0x5a; // 0011 -> 1100 -> 01011010 -> 0x5a
242 // case 2: return 0x9a; // 0010 -> 0100 -> 10011010 -> 0x9a
243 // case 1: return 0x6a; // 0001 -> 1000 -> 01101010 -> 0x6a
244 // default: return 0xaa; // 0000 -> 0000 -> 10101010 -> 0xaa
245
246 // }
247 // }
248
249 void CodeIso15693AsTag(uint8_t *cmd, size_t len) {
250 /*
251 * SOF comprises 3 parts;
252 * * An unmodulated time of 56.64 us
253 * * 24 pulses of 423.75 kHz (fc/32)
254 * * A logic 1, which starts with an unmodulated time of 18.88us
255 * followed by 8 pulses of 423.75kHz (fc/32)
256 *
257 * EOF comprises 3 parts:
258 * - A logic 0 (which starts with 8 pulses of fc/32 followed by an unmodulated
259 * time of 18.88us.
260 * - 24 pulses of fc/32
261 * - An unmodulated time of 56.64 us
262 *
263 * A logic 0 starts with 8 pulses of fc/32
264 * followed by an unmodulated time of 256/fc (~18,88us).
265 *
266 * A logic 0 starts with unmodulated time of 256/fc (~18,88us) followed by
267 * 8 pulses of fc/32 (also 18.88us)
268 *
269 * A bit here becomes 8 pulses of fc/32. Therefore:
270 * The SOF can be written as 00011101 = 0x1D
271 * The EOF can be written as 10111000 = 0xb8
272 * A logic 1 is 01
273 * A logic 0 is 10
274 *
275 * */
276
277 ToSendReset();
278
279 // SOF
280 ToSend[++ToSendMax] = 0x1D; // 00011101
281
282 // data
283 for(int i = 0; i < len; i++) {
284 for(int j = 0; j < 8; j++) {
285 if ((cmd[i] >> j) & 0x01) {
286 ToSendStuffBit(0);
287 ToSendStuffBit(1);
288 } else {
289 ToSendStuffBit(1);
290 ToSendStuffBit(0);
291 }
292 }
293 }
294
295 // EOF
296 ToSend[++ToSendMax] = 0xB8; // 10111000
297
298 ToSendMax++;
299 }
300
301
302 // Transmit the command (to the tag) that was placed in cmd[].
303 static void TransmitTo15693Tag(const uint8_t *cmd, int len, uint32_t start_time)
304 {
305 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_FULL_MOD);
306 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
307
308 while (GetCountSspClk() < start_time) ;
309
310 LED_B_ON();
311 for(int c = 0; c < len; c++) {
312 uint8_t data = cmd[c];
313 for (int i = 0; i < 8; i++) {
314 uint16_t send_word = (data & 0x80) ? 0x0000 : 0xffff;
315 while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;
316 AT91C_BASE_SSC->SSC_THR = send_word;
317 while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;
318 AT91C_BASE_SSC->SSC_THR = send_word;
319 data <<= 1;
320 }
321 WDT_HIT();
322 }
323 LED_B_OFF();
324 }
325
326
327 //-----------------------------------------------------------------------------
328 // Transmit the tag response (to the reader) that was placed in cmd[].
329 //-----------------------------------------------------------------------------
330 void TransmitTo15693Reader(const uint8_t *cmd, size_t len, uint32_t start_time, bool slow) {
331 // don't use the FPGA_HF_SIMULATOR_MODULATE_424K_8BIT minor mode. It would spoil GetCountSspClk()
332 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_424K);
333
334 uint8_t shift_delay = start_time & 0x00000007;
335
336 while (GetCountSspClk() < (start_time & 0xfffffff8)) ;
337
338 LED_C_ON();
339 uint8_t bits_to_shift = 0x00;
340 uint8_t bits_to_send = 0x00;
341 for(size_t c = 0; c < len; c++) {
342 for (int i = 7; i >= 0; i--) {
343 uint8_t cmd_bits = ((cmd[c] >> i) & 0x01) ? 0xff : 0x00;
344 for (int j = 0; j < (slow?4:1); ) {
345 bits_to_send = bits_to_shift << (8 - shift_delay) | cmd_bits >> shift_delay;
346 bits_to_shift = cmd_bits;
347 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
348 AT91C_BASE_SSC->SSC_THR = bits_to_send;
349 j++;
350 }
351 }
352 }
353 WDT_HIT();
354 }
355 // send the remaining bits, padded with 0:
356 bits_to_send = bits_to_shift << (8 - shift_delay);
357 for ( ; ; ) {
358 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
359 AT91C_BASE_SSC->SSC_THR = bits_to_send;
360 break;
361 }
362 }
363 LED_C_OFF();
364
365 }
366
367
368 //=============================================================================
369 // An ISO 15693 decoder for tag responses (one subcarrier only).
370 // Uses cross correlation to identify each bit and EOF.
371 // This function is called 8 times per bit (every 2 subcarrier cycles).
372 // Subcarrier frequency fs is 424kHz, 1/fs = 2,36us,
373 // i.e. function is called every 4,72us
374 // LED handling:
375 // LED C -> ON once we have received the SOF and are expecting the rest.
376 // LED C -> OFF once we have received EOF or are unsynced
377 //
378 // Returns: true if we received a EOF
379 // false if we are still waiting for some more
380 //=============================================================================
381
382 #define NOISE_THRESHOLD 160 // don't try to correlate noise
383
384 typedef struct DecodeTag {
385 enum {
386 STATE_TAG_SOF_LOW,
387 STATE_TAG_SOF_HIGH,
388 STATE_TAG_SOF_HIGH_END,
389 STATE_TAG_RECEIVING_DATA,
390 STATE_TAG_EOF
391 } state;
392 int bitCount;
393 int posCount;
394 enum {
395 LOGIC0,
396 LOGIC1,
397 SOF_PART1,
398 SOF_PART2
399 } lastBit;
400 uint16_t shiftReg;
401 uint16_t max_len;
402 uint8_t *output;
403 int len;
404 int sum1, sum2;
405 } DecodeTag_t;
406
407
408 static int inline __attribute__((always_inline)) Handle15693SamplesFromTag(uint16_t amplitude, DecodeTag_t *DecodeTag)
409 {
410 switch(DecodeTag->state) {
411 case STATE_TAG_SOF_LOW:
412 // waiting for 12 times low (11 times low is accepted as well)
413 if (amplitude < NOISE_THRESHOLD) {
414 DecodeTag->posCount++;
415 } else {
416 if (DecodeTag->posCount > 10) {
417 DecodeTag->posCount = 1;
418 DecodeTag->sum1 = 0;
419 DecodeTag->state = STATE_TAG_SOF_HIGH;
420 } else {
421 DecodeTag->posCount = 0;
422 }
423 }
424 break;
425
426 case STATE_TAG_SOF_HIGH:
427 // waiting for 10 times high. Take average over the last 8
428 if (amplitude > NOISE_THRESHOLD) {
429 DecodeTag->posCount++;
430 if (DecodeTag->posCount > 2) {
431 DecodeTag->sum1 += amplitude; // keep track of average high value
432 }
433 if (DecodeTag->posCount == 10) {
434 DecodeTag->sum1 >>= 4; // calculate half of average high value (8 samples)
435 DecodeTag->state = STATE_TAG_SOF_HIGH_END;
436 }
437 } else { // high phase was too short
438 DecodeTag->posCount = 1;
439 DecodeTag->state = STATE_TAG_SOF_LOW;
440 }
441 break;
442
443 case STATE_TAG_SOF_HIGH_END:
444 // waiting for a falling edge
445 if (amplitude < DecodeTag->sum1) { // signal drops below 50% average high: a falling edge
446 DecodeTag->lastBit = SOF_PART1; // detected 1st part of SOF (12 samples low and 12 samples high)
447 DecodeTag->shiftReg = 0;
448 DecodeTag->bitCount = 0;
449 DecodeTag->len = 0;
450 DecodeTag->sum1 = amplitude;
451 DecodeTag->sum2 = 0;
452 DecodeTag->posCount = 2;
453 DecodeTag->state = STATE_TAG_RECEIVING_DATA;
454 LED_C_ON();
455 } else {
456 DecodeTag->posCount++;
457 if (DecodeTag->posCount > 13) { // high phase too long
458 DecodeTag->posCount = 0;
459 DecodeTag->state = STATE_TAG_SOF_LOW;
460 LED_C_OFF();
461 }
462 }
463 break;
464
465 case STATE_TAG_RECEIVING_DATA:
466 if (DecodeTag->posCount == 1) {
467 DecodeTag->sum1 = 0;
468 DecodeTag->sum2 = 0;
469 }
470 if (DecodeTag->posCount <= 4) {
471 DecodeTag->sum1 += amplitude;
472 } else {
473 DecodeTag->sum2 += amplitude;
474 }
475 if (DecodeTag->posCount == 8) {
476 int32_t corr_1 = DecodeTag->sum2 - DecodeTag->sum1;
477 int32_t corr_0 = -corr_1;
478 int32_t corr_EOF = (DecodeTag->sum1 + DecodeTag->sum2) / 2;
479 if (corr_EOF > corr_0 && corr_EOF > corr_1) {
480 if (DecodeTag->lastBit == LOGIC0) { // this was already part of EOF
481 DecodeTag->state = STATE_TAG_EOF;
482 } else {
483 DecodeTag->posCount = 0;
484 DecodeTag->state = STATE_TAG_SOF_LOW;
485 LED_C_OFF();
486 }
487 } else if (corr_1 > corr_0) {
488 // logic 1
489 if (DecodeTag->lastBit == SOF_PART1) { // still part of SOF
490 DecodeTag->lastBit = SOF_PART2; // SOF completed
491 } else {
492 DecodeTag->lastBit = LOGIC1;
493 DecodeTag->shiftReg >>= 1;
494 DecodeTag->shiftReg |= 0x80;
495 DecodeTag->bitCount++;
496 if (DecodeTag->bitCount == 8) {
497 DecodeTag->output[DecodeTag->len] = DecodeTag->shiftReg;
498 DecodeTag->len++;
499 if (DecodeTag->len > DecodeTag->max_len) {
500 // buffer overflow, give up
501 DecodeTag->posCount = 0;
502 DecodeTag->state = STATE_TAG_SOF_LOW;
503 LED_C_OFF();
504 }
505 DecodeTag->bitCount = 0;
506 DecodeTag->shiftReg = 0;
507 }
508 }
509 } else {
510 // logic 0
511 if (DecodeTag->lastBit == SOF_PART1) { // incomplete SOF
512 DecodeTag->posCount = 0;
513 DecodeTag->state = STATE_TAG_SOF_LOW;
514 LED_C_OFF();
515 } else {
516 DecodeTag->lastBit = LOGIC0;
517 DecodeTag->shiftReg >>= 1;
518 DecodeTag->bitCount++;
519 if (DecodeTag->bitCount == 8) {
520 DecodeTag->output[DecodeTag->len] = DecodeTag->shiftReg;
521 DecodeTag->len++;
522 if (DecodeTag->len > DecodeTag->max_len) {
523 // buffer overflow, give up
524 DecodeTag->posCount = 0;
525 DecodeTag->state = STATE_TAG_SOF_LOW;
526 LED_C_OFF();
527 }
528 DecodeTag->bitCount = 0;
529 DecodeTag->shiftReg = 0;
530 }
531 }
532 }
533 DecodeTag->posCount = 0;
534 }
535 DecodeTag->posCount++;
536 break;
537
538 case STATE_TAG_EOF:
539 if (DecodeTag->posCount == 1) {
540 DecodeTag->sum1 = 0;
541 DecodeTag->sum2 = 0;
542 }
543 if (DecodeTag->posCount <= 4) {
544 DecodeTag->sum1 += amplitude;
545 } else {
546 DecodeTag->sum2 += amplitude;
547 }
548 if (DecodeTag->posCount == 8) {
549 int32_t corr_1 = DecodeTag->sum2 - DecodeTag->sum1;
550 int32_t corr_0 = -corr_1;
551 int32_t corr_EOF = (DecodeTag->sum1 + DecodeTag->sum2) / 2;
552 if (corr_EOF > corr_0 || corr_1 > corr_0) {
553 DecodeTag->posCount = 0;
554 DecodeTag->state = STATE_TAG_SOF_LOW;
555 LED_C_OFF();
556 } else {
557 LED_C_OFF();
558 return true;
559 }
560 }
561 DecodeTag->posCount++;
562 break;
563
564 }
565
566 return false;
567 }
568
569
570 static void DecodeTagInit(DecodeTag_t *DecodeTag, uint8_t *data, uint16_t max_len)
571 {
572 DecodeTag->posCount = 0;
573 DecodeTag->state = STATE_TAG_SOF_LOW;
574 DecodeTag->output = data;
575 DecodeTag->max_len = max_len;
576 }
577
578
579 static void DecodeTagReset(DecodeTag_t *DecodeTag)
580 {
581 DecodeTag->posCount = 0;
582 DecodeTag->state = STATE_TAG_SOF_LOW;
583 }
584
585
586 /*
587 * Receive and decode the tag response, also log to tracebuffer
588 */
589 static int GetIso15693AnswerFromTag(uint8_t* response, uint16_t max_len, int timeout)
590 {
591 int samples = 0;
592 bool gotFrame = false;
593
594 uint16_t *dmaBuf = (uint16_t*)BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE*sizeof(uint16_t));
595
596 // the Decoder data structure
597 DecodeTag_t DecodeTag = { 0 };
598 DecodeTagInit(&DecodeTag, response, max_len);
599
600 // wait for last transfer to complete
601 while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));
602
603 // And put the FPGA in the appropriate mode
604 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_424_KHZ | FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE);
605
606 // Setup and start DMA.
607 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
608 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);
609 uint16_t *upTo = dmaBuf;
610
611 for(;;) {
612 uint16_t behindBy = ((uint16_t*)AT91C_BASE_PDC_SSC->PDC_RPR - upTo) & (ISO15693_DMA_BUFFER_SIZE-1);
613
614 if (behindBy == 0) continue;
615
616 uint16_t tagdata = *upTo++;
617
618 if(upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
619 upTo = dmaBuf; // start reading the circular buffer from the beginning
620 if(behindBy > (9*ISO15693_DMA_BUFFER_SIZE/10)) {
621 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);
622 break;
623 }
624 }
625 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
626 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
627 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE; // DMA Next Counter registers
628 }
629
630 samples++;
631
632 if (Handle15693SamplesFromTag(tagdata, &DecodeTag)) {
633 gotFrame = true;
634 break;
635 }
636
637 if (samples > timeout && DecodeTag.state < STATE_TAG_RECEIVING_DATA) {
638 DecodeTag.len = 0;
639 break;
640 }
641
642 }
643
644 FpgaDisableSscDma();
645 BigBuf_free();
646
647 if (DEBUG) Dbprintf("samples = %d, gotFrame = %d, Decoder: state = %d, len = %d, bitCount = %d, posCount = %d",
648 samples, gotFrame, DecodeTag.state, DecodeTag.len, DecodeTag.bitCount, DecodeTag.posCount);
649
650 if (DecodeTag.len > 0) {
651 LogTrace(DecodeTag.output, DecodeTag.len, 0, 0, NULL, false);
652 }
653
654 return DecodeTag.len;
655 }
656
657
658 //=============================================================================
659 // An ISO15693 decoder for reader commands.
660 //
661 // This function is called 4 times per bit (every 2 subcarrier cycles).
662 // Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
663 // LED handling:
664 // LED B -> ON once we have received the SOF and are expecting the rest.
665 // LED B -> OFF once we have received EOF or are in error state or unsynced
666 //
667 // Returns: true if we received a EOF
668 // false if we are still waiting for some more
669 //=============================================================================
670
671 typedef struct DecodeReader {
672 enum {
673 STATE_READER_UNSYNCD,
674 STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF,
675 STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF,
676 STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF,
677 STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4,
678 STATE_READER_RECEIVE_DATA_1_OUT_OF_4,
679 STATE_READER_RECEIVE_DATA_1_OUT_OF_256
680 } state;
681 enum {
682 CODING_1_OUT_OF_4,
683 CODING_1_OUT_OF_256
684 } Coding;
685 uint8_t shiftReg;
686 uint8_t bitCount;
687 int byteCount;
688 int byteCountMax;
689 int posCount;
690 int sum1, sum2;
691 uint8_t *output;
692 } DecodeReader_t;
693
694
695 static void DecodeReaderInit(DecodeReader_t* DecodeReader, uint8_t *data, uint16_t max_len)
696 {
697 DecodeReader->output = data;
698 DecodeReader->byteCountMax = max_len;
699 DecodeReader->state = STATE_READER_UNSYNCD;
700 DecodeReader->byteCount = 0;
701 DecodeReader->bitCount = 0;
702 DecodeReader->posCount = 1;
703 DecodeReader->shiftReg = 0;
704 }
705
706
707 static void DecodeReaderReset(DecodeReader_t* DecodeReader)
708 {
709 DecodeReader->state = STATE_READER_UNSYNCD;
710 }
711
712
713 static int inline __attribute__((always_inline)) Handle15693SampleFromReader(uint8_t bit, DecodeReader_t *restrict DecodeReader)
714 {
715 switch (DecodeReader->state) {
716 case STATE_READER_UNSYNCD:
717 if (!bit) {
718 // we went low, so this could be the beginning of a SOF
719 DecodeReader->posCount = 1;
720 DecodeReader->state = STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF;
721 }
722 break;
723
724 case STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF:
725 DecodeReader->posCount++;
726 if (bit) { // detected rising edge
727 if (DecodeReader->posCount < 4) { // rising edge too early (nominally expected at 5)
728 DecodeReaderReset(DecodeReader);
729 } else { // SOF
730 DecodeReader->state = STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF;
731 }
732 } else {
733 if (DecodeReader->posCount > 5) { // stayed low for too long
734 DecodeReaderReset(DecodeReader);
735 } else {
736 // do nothing, keep waiting
737 }
738 }
739 break;
740
741 case STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF:
742 DecodeReader->posCount++;
743 if (!bit) { // detected a falling edge
744 if (DecodeReader->posCount < 20) { // falling edge too early (nominally expected at 21 earliest)
745 DecodeReaderReset(DecodeReader);
746 } else if (DecodeReader->posCount < 23) { // SOF for 1 out of 4 coding
747 DecodeReader->Coding = CODING_1_OUT_OF_4;
748 DecodeReader->state = STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF;
749 } else if (DecodeReader->posCount < 28) { // falling edge too early (nominally expected at 29 latest)
750 DecodeReaderReset(DecodeReader);
751 } else { // SOF for 1 out of 4 coding
752 DecodeReader->Coding = CODING_1_OUT_OF_256;
753 DecodeReader->state = STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF;
754 }
755 } else {
756 if (DecodeReader->posCount > 29) { // stayed high for too long
757 DecodeReaderReset(DecodeReader);
758 } else {
759 // do nothing, keep waiting
760 }
761 }
762 break;
763
764 case STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF:
765 DecodeReader->posCount++;
766 if (bit) { // detected rising edge
767 if (DecodeReader->Coding == CODING_1_OUT_OF_256) {
768 if (DecodeReader->posCount < 32) { // rising edge too early (nominally expected at 33)
769 DecodeReaderReset(DecodeReader);
770 } else {
771 DecodeReader->posCount = 1;
772 DecodeReader->bitCount = 0;
773 DecodeReader->byteCount = 0;
774 DecodeReader->sum1 = 1;
775 DecodeReader->state = STATE_READER_RECEIVE_DATA_1_OUT_OF_256;
776 LED_B_ON();
777 }
778 } else { // CODING_1_OUT_OF_4
779 if (DecodeReader->posCount < 24) { // rising edge too early (nominally expected at 25)
780 DecodeReaderReset(DecodeReader);
781 } else {
782 DecodeReader->state = STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4;
783 }
784 }
785 } else {
786 if (DecodeReader->Coding == CODING_1_OUT_OF_256) {
787 if (DecodeReader->posCount > 34) { // signal stayed low for too long
788 DecodeReaderReset(DecodeReader);
789 } else {
790 // do nothing, keep waiting
791 }
792 } else { // CODING_1_OUT_OF_4
793 if (DecodeReader->posCount > 26) { // signal stayed low for too long
794 DecodeReaderReset(DecodeReader);
795 } else {
796 // do nothing, keep waiting
797 }
798 }
799 }
800 break;
801
802 case STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4:
803 DecodeReader->posCount++;
804 if (bit) {
805 if (DecodeReader->posCount == 33) {
806 DecodeReader->posCount = 1;
807 DecodeReader->bitCount = 0;
808 DecodeReader->byteCount = 0;
809 DecodeReader->sum1 = 1;
810 DecodeReader->state = STATE_READER_RECEIVE_DATA_1_OUT_OF_4;
811 LED_B_ON();
812 } else {
813 // do nothing, keep waiting
814 }
815 } else { // unexpected falling edge
816 DecodeReaderReset(DecodeReader);
817 }
818 break;
819
820 case STATE_READER_RECEIVE_DATA_1_OUT_OF_4:
821 DecodeReader->posCount++;
822 if (DecodeReader->posCount == 1) {
823 DecodeReader->sum1 = bit;
824 } else if (DecodeReader->posCount <= 4) {
825 DecodeReader->sum1 += bit;
826 } else if (DecodeReader->posCount == 5) {
827 DecodeReader->sum2 = bit;
828 } else {
829 DecodeReader->sum2 += bit;
830 }
831 if (DecodeReader->posCount == 8) {
832 DecodeReader->posCount = 0;
833 int corr10 = DecodeReader->sum1 - DecodeReader->sum2;
834 int corr01 = DecodeReader->sum2 - DecodeReader->sum1;
835 int corr11 = (DecodeReader->sum1 + DecodeReader->sum2) / 2;
836 if (corr01 > corr11 && corr01 > corr10) { // EOF
837 LED_B_OFF(); // Finished receiving
838 DecodeReaderReset(DecodeReader);
839 if (DecodeReader->byteCount != 0) {
840 return true;
841 }
842 }
843 if (corr10 > corr11) { // detected a 2bit position
844 DecodeReader->shiftReg >>= 2;
845 DecodeReader->shiftReg |= (DecodeReader->bitCount << 6);
846 }
847 if (DecodeReader->bitCount == 15) { // we have a full byte
848 DecodeReader->output[DecodeReader->byteCount++] = DecodeReader->shiftReg;
849 if (DecodeReader->byteCount > DecodeReader->byteCountMax) {
850 // buffer overflow, give up
851 LED_B_OFF();
852 DecodeReaderReset(DecodeReader);
853 }
854 DecodeReader->bitCount = 0;
855 DecodeReader->shiftReg = 0;
856 } else {
857 DecodeReader->bitCount++;
858 }
859 }
860 break;
861
862 case STATE_READER_RECEIVE_DATA_1_OUT_OF_256:
863 DecodeReader->posCount++;
864 if (DecodeReader->posCount == 1) {
865 DecodeReader->sum1 = bit;
866 } else if (DecodeReader->posCount <= 4) {
867 DecodeReader->sum1 += bit;
868 } else if (DecodeReader->posCount == 5) {
869 DecodeReader->sum2 = bit;
870 } else {
871 DecodeReader->sum2 += bit;
872 }
873 if (DecodeReader->posCount == 8) {
874 DecodeReader->posCount = 0;
875 int corr10 = DecodeReader->sum1 - DecodeReader->sum2;
876 int corr01 = DecodeReader->sum2 - DecodeReader->sum1;
877 int corr11 = (DecodeReader->sum1 + DecodeReader->sum2) / 2;
878 if (corr01 > corr11 && corr01 > corr10) { // EOF
879 LED_B_OFF(); // Finished receiving
880 DecodeReaderReset(DecodeReader);
881 if (DecodeReader->byteCount != 0) {
882 return true;
883 }
884 }
885 if (corr10 > corr11) { // detected the bit position
886 DecodeReader->shiftReg = DecodeReader->bitCount;
887 }
888 if (DecodeReader->bitCount == 255) { // we have a full byte
889 DecodeReader->output[DecodeReader->byteCount++] = DecodeReader->shiftReg;
890 if (DecodeReader->byteCount > DecodeReader->byteCountMax) {
891 // buffer overflow, give up
892 LED_B_OFF();
893 DecodeReaderReset(DecodeReader);
894 }
895 }
896 DecodeReader->bitCount++;
897 }
898 break;
899
900 default:
901 LED_B_OFF();
902 DecodeReaderReset(DecodeReader);
903 break;
904 }
905
906 return false;
907 }
908
909
910 //-----------------------------------------------------------------------------
911 // Receive a command (from the reader to us, where we are the simulated tag),
912 // and store it in the given buffer, up to the given maximum length. Keeps
913 // spinning, waiting for a well-framed command, until either we get one
914 // (returns len) or someone presses the pushbutton on the board (returns -1).
915 //
916 // Assume that we're called with the SSC (to the FPGA) and ADC path set
917 // correctly.
918 //-----------------------------------------------------------------------------
919
920 int GetIso15693CommandFromReader(uint8_t *received, size_t max_len, uint32_t *eof_time) {
921 int samples = 0;
922 bool gotFrame = false;
923 uint8_t b;
924
925 uint8_t dmaBuf[ISO15693_DMA_BUFFER_SIZE];
926
927 // the decoder data structure
928 DecodeReader_t DecodeReader = {0};
929 DecodeReaderInit(&DecodeReader, received, max_len);
930
931 // wait for last transfer to complete
932 while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));
933
934 LED_D_OFF();
935 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
936
937 // clear receive register and wait for next transfer
938 uint32_t temp = AT91C_BASE_SSC->SSC_RHR;
939 (void) temp;
940 while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)) ;
941
942 uint32_t dma_start_time = GetCountSspClk() & 0xfffffff8;
943
944 // Setup and start DMA.
945 FpgaSetupSscDma(dmaBuf, ISO15693_DMA_BUFFER_SIZE);
946 uint8_t *upTo = dmaBuf;
947
948 for (;;) {
949 uint16_t behindBy = ((uint8_t*)AT91C_BASE_PDC_SSC->PDC_RPR - upTo) & (ISO15693_DMA_BUFFER_SIZE-1);
950
951 if (behindBy == 0) continue;
952
953 b = *upTo++;
954 if (upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
955 upTo = dmaBuf; // start reading the circular buffer from the beginning
956 if (behindBy > (9*ISO15693_DMA_BUFFER_SIZE/10)) {
957 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);
958 break;
959 }
960 }
961 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
962 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
963 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE; // DMA Next Counter registers
964 }
965
966 for (int i = 7; i >= 0; i--) {
967 if (Handle15693SampleFromReader((b >> i) & 0x01, &DecodeReader)) {
968 *eof_time = dma_start_time + samples - DELAY_READER_TO_ARM_SIM; // end of EOF
969 gotFrame = true;
970 break;
971 }
972 samples++;
973 }
974
975 if (gotFrame) {
976 break;
977 }
978
979 if (BUTTON_PRESS()) {
980 DecodeReader.byteCount = -1;
981 break;
982 }
983
984 WDT_HIT();
985 }
986
987 FpgaDisableSscDma();
988
989 if (DEBUG) Dbprintf("samples = %d, gotFrame = %d, Decoder: state = %d, len = %d, bitCount = %d, posCount = %d",
990 samples, gotFrame, DecodeReader.state, DecodeReader.byteCount, DecodeReader.bitCount, DecodeReader.posCount);
991
992 if (DecodeReader.byteCount > 0) {
993 uint32_t sof_time = *eof_time
994 - DecodeReader.byteCount * (DecodeReader.Coding==CODING_1_OUT_OF_4?128:2048) // time for byte transfers
995 - 32 // time for SOF transfer
996 - 16; // time for EOF transfer
997 LogTrace(DecodeReader.output, DecodeReader.byteCount, sof_time, *eof_time, NULL, true);
998 }
999
1000 return DecodeReader.byteCount;
1001 }
1002
1003
1004 // Encode (into the ToSend buffers) an identify request, which is the first
1005 // thing that you must send to a tag to get a response.
1006 static void BuildIdentifyRequest(void)
1007 {
1008 uint8_t cmd[5];
1009
1010 uint16_t crc;
1011 // one sub-carrier, inventory, 1 slot, fast rate
1012 // AFI is at bit 5 (1<<4) when doing an INVENTORY
1013 cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
1014 // inventory command code
1015 cmd[1] = 0x01;
1016 // no mask
1017 cmd[2] = 0x00;
1018 //Now the CRC
1019 crc = Iso15693Crc(cmd, 3);
1020 cmd[3] = crc & 0xff;
1021 cmd[4] = crc >> 8;
1022
1023 CodeIso15693AsReader(cmd, sizeof(cmd));
1024 }
1025
1026
1027 //-----------------------------------------------------------------------------
1028 // Start to read an ISO 15693 tag. We send an identify request, then wait
1029 // for the response. The response is not demodulated, just left in the buffer
1030 // so that it can be downloaded to a PC and processed there.
1031 //-----------------------------------------------------------------------------
1032 void AcquireRawAdcSamplesIso15693(void)
1033 {
1034 LEDsoff();
1035 LED_A_ON();
1036
1037 uint8_t *dest = BigBuf_get_addr();
1038
1039 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1040 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
1041 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
1042 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1043
1044 BuildIdentifyRequest();
1045
1046 // Give the tags time to energize
1047 LED_D_ON();
1048 SpinDelay(100);
1049
1050 // Now send the command
1051 TransmitTo15693Tag(ToSend, ToSendMax, 0);
1052
1053 // wait for last transfer to complete
1054 while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY)) ;
1055
1056 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_424_KHZ | FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE);
1057
1058 for(int c = 0; c < 4000; ) {
1059 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1060 uint16_t r = AT91C_BASE_SSC->SSC_RHR;
1061 dest[c++] = r >> 5;
1062 }
1063 }
1064
1065 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1066 LEDsoff();
1067 }
1068
1069
1070 void SnoopIso15693(void)
1071 {
1072 LED_A_ON();
1073 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1074 BigBuf_free();
1075
1076 clear_trace();
1077 set_tracing(true);
1078
1079 // The DMA buffer, used to stream samples from the FPGA
1080 uint16_t* dmaBuf = (uint16_t*)BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE*sizeof(uint16_t));
1081 uint16_t *upTo;
1082
1083 // Count of samples received so far, so that we can include timing
1084 // information in the trace buffer.
1085 int samples = 0;
1086
1087 DecodeTag_t DecodeTag = {0};
1088 uint8_t response[ISO15693_MAX_RESPONSE_LENGTH];
1089 DecodeTagInit(&DecodeTag, response, sizeof(response));
1090
1091 DecodeReader_t DecodeReader = {0};;
1092 uint8_t cmd[ISO15693_MAX_COMMAND_LENGTH];
1093 DecodeReaderInit(&DecodeReader, cmd, sizeof(cmd));
1094
1095 // Print some debug information about the buffer sizes
1096 if (DEBUG) {
1097 Dbprintf("Snooping buffers initialized:");
1098 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1099 Dbprintf(" Reader -> tag: %i bytes", ISO15693_MAX_COMMAND_LENGTH);
1100 Dbprintf(" tag -> Reader: %i bytes", ISO15693_MAX_RESPONSE_LENGTH);
1101 Dbprintf(" DMA: %i bytes", ISO15693_DMA_BUFFER_SIZE * sizeof(uint16_t));
1102 }
1103 Dbprintf("Snoop started. Press PM3 Button to stop.");
1104
1105 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SNOOP_AMPLITUDE);
1106 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1107
1108 // Setup for the DMA.
1109 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
1110 upTo = dmaBuf;
1111 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);
1112
1113 bool TagIsActive = false;
1114 bool ReaderIsActive = false;
1115 bool ExpectTagAnswer = false;
1116
1117 // And now we loop, receiving samples.
1118 for(;;) {
1119 uint16_t behindBy = ((uint16_t*)AT91C_BASE_PDC_SSC->PDC_RPR - upTo) & (ISO15693_DMA_BUFFER_SIZE-1);
1120
1121 if (behindBy == 0) continue;
1122
1123 uint16_t snoopdata = *upTo++;
1124
1125 if(upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
1126 upTo = dmaBuf; // start reading the circular buffer from the beginning
1127 if(behindBy > (9*ISO15693_DMA_BUFFER_SIZE/10)) {
1128 Dbprintf("About to blow circular buffer - aborted! behindBy=%d, samples=%d", behindBy, samples);
1129 break;
1130 }
1131 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
1132 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
1133 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE; // DMA Next Counter registers
1134 WDT_HIT();
1135 if(BUTTON_PRESS()) {
1136 DbpString("Snoop stopped.");
1137 break;
1138 }
1139 }
1140 }
1141 samples++;
1142
1143 if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
1144 if (Handle15693SampleFromReader(snoopdata & 0x02, &DecodeReader)) {
1145 FpgaDisableSscDma();
1146 ExpectTagAnswer = true;
1147 LogTrace(DecodeReader.output, DecodeReader.byteCount, samples, samples, NULL, true);
1148 /* And ready to receive another command. */
1149 DecodeReaderReset(&DecodeReader);
1150 /* And also reset the demod code, which might have been */
1151 /* false-triggered by the commands from the reader. */
1152 DecodeTagReset(&DecodeTag);
1153 upTo = dmaBuf;
1154 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);
1155 }
1156 if (Handle15693SampleFromReader(snoopdata & 0x01, &DecodeReader)) {
1157 FpgaDisableSscDma();
1158 ExpectTagAnswer = true;
1159 LogTrace(DecodeReader.output, DecodeReader.byteCount, samples, samples, NULL, true);
1160 /* And ready to receive another command. */
1161 DecodeReaderReset(&DecodeReader);
1162 /* And also reset the demod code, which might have been */
1163 /* false-triggered by the commands from the reader. */
1164 DecodeTagReset(&DecodeTag);
1165 upTo = dmaBuf;
1166 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);
1167 }
1168 ReaderIsActive = (DecodeReader.state >= STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF);
1169 }
1170
1171 if (!ReaderIsActive && ExpectTagAnswer) { // no need to try decoding tag data if the reader is currently sending or no answer expected yet
1172 if (Handle15693SamplesFromTag(snoopdata >> 2, &DecodeTag)) {
1173 FpgaDisableSscDma();
1174 //Use samples as a time measurement
1175 LogTrace(DecodeTag.output, DecodeTag.len, samples, samples, NULL, false);
1176 // And ready to receive another response.
1177 DecodeTagReset(&DecodeTag);
1178 DecodeReaderReset(&DecodeReader);
1179 ExpectTagAnswer = false;
1180 upTo = dmaBuf;
1181 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);
1182 }
1183 TagIsActive = (DecodeTag.state >= STATE_TAG_RECEIVING_DATA);
1184 }
1185
1186 }
1187
1188 FpgaDisableSscDma();
1189 BigBuf_free();
1190
1191 LEDsoff();
1192
1193 DbpString("Snoop statistics:");
1194 Dbprintf(" ExpectTagAnswer: %d", ExpectTagAnswer);
1195 Dbprintf(" DecodeTag State: %d", DecodeTag.state);
1196 Dbprintf(" DecodeTag byteCnt: %d", DecodeTag.len);
1197 Dbprintf(" DecodeReader State: %d", DecodeReader.state);
1198 Dbprintf(" DecodeReader byteCnt: %d", DecodeReader.byteCount);
1199 Dbprintf(" Trace length: %d", BigBuf_get_traceLen());
1200 }
1201
1202
1203 // Initialize the proxmark as iso15k reader
1204 static void Iso15693InitReader() {
1205 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1206 // Setup SSC
1207 // FpgaSetupSsc();
1208
1209 // Start from off (no field generated)
1210 LED_D_OFF();
1211 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1212 SpinDelay(10);
1213
1214 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1215 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
1216
1217 // Give the tags time to energize
1218 LED_D_ON();
1219 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
1220 SpinDelay(250);
1221 }
1222
1223 ///////////////////////////////////////////////////////////////////////
1224 // ISO 15693 Part 3 - Air Interface
1225 // This section basically contains transmission and receiving of bits
1226 ///////////////////////////////////////////////////////////////////////
1227
1228
1229 // uid is in transmission order (which is reverse of display order)
1230 static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
1231 {
1232 uint8_t cmd[13];
1233
1234 uint16_t crc;
1235 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1236 // followed by the block data
1237 cmd[0] = ISO15693_REQ_OPTION | ISO15693_REQ_ADDRESS | ISO15693_REQ_DATARATE_HIGH;
1238 // READ BLOCK command code
1239 cmd[1] = ISO15693_READBLOCK;
1240 // UID may be optionally specified here
1241 // 64-bit UID
1242 cmd[2] = uid[0];
1243 cmd[3] = uid[1];
1244 cmd[4] = uid[2];
1245 cmd[5] = uid[3];
1246 cmd[6] = uid[4];
1247 cmd[7] = uid[5];
1248 cmd[8] = uid[6];
1249 cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique)
1250 // Block number to read
1251 cmd[10] = blockNumber;
1252 //Now the CRC
1253 crc = Iso15693Crc(cmd, 11); // the crc needs to be calculated over 11 bytes
1254 cmd[11] = crc & 0xff;
1255 cmd[12] = crc >> 8;
1256
1257 CodeIso15693AsReader(cmd, sizeof(cmd));
1258 }
1259
1260
1261 // Now the VICC>VCD responses when we are simulating a tag
1262 static void BuildInventoryResponse(uint8_t *uid)
1263 {
1264 uint8_t cmd[12];
1265
1266 uint16_t crc;
1267
1268 cmd[0] = 0; // No error, no protocol format extension
1269 cmd[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported
1270 // 64-bit UID
1271 cmd[2] = uid[7]; //0x32;
1272 cmd[3] = uid[6]; //0x4b;
1273 cmd[4] = uid[5]; //0x03;
1274 cmd[5] = uid[4]; //0x01;
1275 cmd[6] = uid[3]; //0x00;
1276 cmd[7] = uid[2]; //0x10;
1277 cmd[8] = uid[1]; //0x05;
1278 cmd[9] = uid[0]; //0xe0;
1279 //Now the CRC
1280 crc = Iso15693Crc(cmd, 10);
1281 cmd[10] = crc & 0xff;
1282 cmd[11] = crc >> 8;
1283
1284 CodeIso15693AsTag(cmd, sizeof(cmd));
1285 }
1286
1287 // Universal Method for sending to and recv bytes from a tag
1288 // init ... should we initialize the reader?
1289 // speed ... 0 low speed, 1 hi speed
1290 // *recv will contain the tag's answer
1291 // return: lenght of received data
1292 int SendDataTag(uint8_t *send, int sendlen, bool init, int speed, uint8_t *recv, uint16_t max_recv_len, uint32_t start_time) {
1293
1294 LED_A_ON();
1295 LED_B_OFF();
1296 LED_C_OFF();
1297
1298 if (init) Iso15693InitReader();
1299
1300 int answerLen=0;
1301
1302 if (!speed) {
1303 // low speed (1 out of 256)
1304 CodeIso15693AsReader256(send, sendlen);
1305 } else {
1306 // high speed (1 out of 4)
1307 CodeIso15693AsReader(send, sendlen);
1308 }
1309
1310 TransmitTo15693Tag(ToSend, ToSendMax, start_time);
1311
1312 // Now wait for a response
1313 if (recv != NULL) {
1314 answerLen = GetIso15693AnswerFromTag(recv, max_recv_len, DELAY_ISO15693_VCD_TO_VICC_READER * 2);
1315 }
1316
1317 LED_A_OFF();
1318
1319 return answerLen;
1320 }
1321
1322
1323 // --------------------------------------------------------------------
1324 // Debug Functions
1325 // --------------------------------------------------------------------
1326
1327 // Decodes a message from a tag and displays its metadata and content
1328 #define DBD15STATLEN 48
1329 void DbdecodeIso15693Answer(int len, uint8_t *d) {
1330 char status[DBD15STATLEN+1]={0};
1331 uint16_t crc;
1332
1333 if (len > 3) {
1334 if (d[0] & ISO15693_RES_EXT)
1335 strncat(status,"ProtExt ", DBD15STATLEN);
1336 if (d[0] & ISO15693_RES_ERROR) {
1337 // error
1338 strncat(status,"Error ", DBD15STATLEN);
1339 switch (d[1]) {
1340 case 0x01:
1341 strncat(status,"01:notSupp", DBD15STATLEN);
1342 break;
1343 case 0x02:
1344 strncat(status,"02:notRecog", DBD15STATLEN);
1345 break;
1346 case 0x03:
1347 strncat(status,"03:optNotSupp", DBD15STATLEN);
1348 break;
1349 case 0x0f:
1350 strncat(status,"0f:noInfo", DBD15STATLEN);
1351 break;
1352 case 0x10:
1353 strncat(status,"10:doesn'tExist", DBD15STATLEN);
1354 break;
1355 case 0x11:
1356 strncat(status,"11:lockAgain", DBD15STATLEN);
1357 break;
1358 case 0x12:
1359 strncat(status,"12:locked", DBD15STATLEN);
1360 break;
1361 case 0x13:
1362 strncat(status,"13:progErr", DBD15STATLEN);
1363 break;
1364 case 0x14:
1365 strncat(status,"14:lockErr", DBD15STATLEN);
1366 break;
1367 default:
1368 strncat(status,"unknownErr", DBD15STATLEN);
1369 }
1370 strncat(status," ", DBD15STATLEN);
1371 } else {
1372 strncat(status,"NoErr ", DBD15STATLEN);
1373 }
1374
1375 crc=Iso15693Crc(d,len-2);
1376 if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) )
1377 strncat(status,"CrcOK",DBD15STATLEN);
1378 else
1379 strncat(status,"CrcFail!",DBD15STATLEN);
1380
1381 Dbprintf("%s",status);
1382 }
1383 }
1384
1385
1386
1387 ///////////////////////////////////////////////////////////////////////
1388 // Functions called via USB/Client
1389 ///////////////////////////////////////////////////////////////////////
1390
1391 void SetDebugIso15693(uint32_t debug) {
1392 DEBUG=debug;
1393 Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off");
1394 return;
1395 }
1396
1397
1398 //---------------------------------------------------------------------------------------
1399 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector.
1400 // all demodulation performed in arm rather than host. - greg
1401 //---------------------------------------------------------------------------------------
1402 void ReaderIso15693(uint32_t parameter)
1403 {
1404 LEDsoff();
1405 LED_A_ON();
1406
1407 set_tracing(true);
1408
1409 int answerLen = 0;
1410 uint8_t TagUID[8] = {0x00};
1411
1412 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1413
1414 uint8_t answer[ISO15693_MAX_RESPONSE_LENGTH];
1415
1416 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1417 // Setup SSC
1418 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
1419
1420 // Start from off (no field generated)
1421 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1422 SpinDelay(200);
1423
1424 // Give the tags time to energize
1425 LED_D_ON();
1426 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);
1427 SpinDelay(200);
1428 StartCountSspClk();
1429
1430
1431 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
1432 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
1433
1434 // Now send the IDENTIFY command
1435 BuildIdentifyRequest();
1436 TransmitTo15693Tag(ToSend, ToSendMax, 0);
1437
1438 // Now wait for a response
1439 answerLen = GetIso15693AnswerFromTag(answer, sizeof(answer), DELAY_ISO15693_VCD_TO_VICC_READER * 2) ;
1440 uint32_t start_time = GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER;
1441
1442 if (answerLen >=12) // we should do a better check than this
1443 {
1444 TagUID[0] = answer[2];
1445 TagUID[1] = answer[3];
1446 TagUID[2] = answer[4];
1447 TagUID[3] = answer[5];
1448 TagUID[4] = answer[6];
1449 TagUID[5] = answer[7];
1450 TagUID[6] = answer[8]; // IC Manufacturer code
1451 TagUID[7] = answer[9]; // always E0
1452
1453 }
1454
1455 Dbprintf("%d octets read from IDENTIFY request:", answerLen);
1456 DbdecodeIso15693Answer(answerLen, answer);
1457 Dbhexdump(answerLen, answer, false);
1458
1459 // UID is reverse
1460 if (answerLen >= 12)
1461 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1462 TagUID[7],TagUID[6],TagUID[5],TagUID[4],
1463 TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
1464
1465
1466 // Dbprintf("%d octets read from SELECT request:", answerLen2);
1467 // DbdecodeIso15693Answer(answerLen2,answer2);
1468 // Dbhexdump(answerLen2,answer2,true);
1469
1470 // Dbprintf("%d octets read from XXX request:", answerLen3);
1471 // DbdecodeIso15693Answer(answerLen3,answer3);
1472 // Dbhexdump(answerLen3,answer3,true);
1473
1474 // read all pages
1475 if (answerLen >= 12 && DEBUG) {
1476 for (int i = 0; i < 32; i++) { // sanity check, assume max 32 pages
1477 BuildReadBlockRequest(TagUID, i);
1478 TransmitTo15693Tag(ToSend, ToSendMax, start_time);
1479 int answerLen = GetIso15693AnswerFromTag(answer, sizeof(answer), DELAY_ISO15693_VCD_TO_VICC_READER * 2);
1480 start_time = GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER;
1481 if (answerLen > 0) {
1482 Dbprintf("READ SINGLE BLOCK %d returned %d octets:", i, answerLen);
1483 DbdecodeIso15693Answer(answerLen, answer);
1484 Dbhexdump(answerLen, answer, false);
1485 if ( *((uint32_t*) answer) == 0x07160101 ) break; // exit on NoPageErr
1486 }
1487 }
1488 }
1489
1490 // for the time being, switch field off to protect rdv4.0
1491 // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
1492 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1493 LED_D_OFF();
1494
1495 LED_A_OFF();
1496 }
1497
1498
1499 // Simulate an ISO15693 TAG.
1500 // For Inventory command: print command and send Inventory Response with given UID
1501 // TODO: interpret other reader commands and send appropriate response
1502 void SimTagIso15693(uint32_t parameter, uint8_t *uid)
1503 {
1504 LEDsoff();
1505 LED_A_ON();
1506
1507 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1508 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1509 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
1510 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
1511
1512 StartCountSspClk();
1513
1514 uint8_t cmd[ISO15693_MAX_COMMAND_LENGTH];
1515
1516 // Build a suitable response to the reader INVENTORY command
1517 BuildInventoryResponse(uid);
1518
1519 // Listen to reader
1520 while (!BUTTON_PRESS()) {
1521 uint32_t eof_time = 0, start_time = 0;
1522 int cmd_len = GetIso15693CommandFromReader(cmd, sizeof(cmd), &eof_time);
1523
1524 if ((cmd_len >= 5) && (cmd[0] & ISO15693_REQ_INVENTORY) && (cmd[1] == ISO15693_INVENTORY)) { // TODO: check more flags
1525 bool slow = !(cmd[0] & ISO15693_REQ_DATARATE_HIGH);
1526 start_time = eof_time + DELAY_ISO15693_VCD_TO_VICC_SIM - DELAY_ARM_TO_READER_SIM;
1527 TransmitTo15693Reader(ToSend, ToSendMax, start_time, slow);
1528 }
1529
1530 Dbprintf("%d bytes read from reader:", cmd_len);
1531 Dbhexdump(cmd_len, cmd, false);
1532 }
1533
1534 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1535 LEDsoff();
1536 }
1537
1538
1539 // Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1540 // (some manufactures offer a way to read the AFI, though)
1541 void BruteforceIso15693Afi(uint32_t speed)
1542 {
1543 LEDsoff();
1544 LED_A_ON();
1545
1546 uint8_t data[6];
1547 uint8_t recv[ISO15693_MAX_RESPONSE_LENGTH];
1548
1549 int datalen=0, recvlen=0;
1550
1551 Iso15693InitReader();
1552 StartCountSspClk();
1553
1554 // first without AFI
1555 // Tags should respond without AFI and with AFI=0 even when AFI is active
1556
1557 data[0] = ISO15693_REQ_DATARATE_HIGH | ISO15693_REQ_INVENTORY | ISO15693_REQINV_SLOT1;
1558 data[1] = ISO15693_INVENTORY;
1559 data[2] = 0; // mask length
1560 datalen = Iso15693AddCrc(data,3);
1561 recvlen = SendDataTag(data, datalen, false, speed, recv, sizeof(recv), 0);
1562 uint32_t start_time = GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER;
1563 WDT_HIT();
1564 if (recvlen>=12) {
1565 Dbprintf("NoAFI UID=%s", Iso15693sprintUID(NULL, &recv[2]));
1566 }
1567
1568 // now with AFI
1569
1570 data[0] = ISO15693_REQ_DATARATE_HIGH | ISO15693_REQ_INVENTORY | ISO15693_REQINV_AFI | ISO15693_REQINV_SLOT1;
1571 data[1] = ISO15693_INVENTORY;
1572 data[2] = 0; // AFI
1573 data[3] = 0; // mask length
1574
1575 for (int i = 0; i < 256; i++) {
1576 data[2] = i & 0xFF;
1577 datalen = Iso15693AddCrc(data,4);
1578 recvlen = SendDataTag(data, datalen, false, speed, recv, sizeof(recv), start_time);
1579 start_time = GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER;
1580 WDT_HIT();
1581 if (recvlen >= 12) {
1582 Dbprintf("AFI=%i UID=%s", i, Iso15693sprintUID(NULL, &recv[2]));
1583 }
1584 }
1585 Dbprintf("AFI Bruteforcing done.");
1586
1587 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1588 LEDsoff();
1589 }
1590
1591 // Allows to directly send commands to the tag via the client
1592 void DirectTag15693Command(uint32_t datalen, uint32_t speed, uint32_t recv, uint8_t data[]) {
1593
1594 int recvlen = 0;
1595 uint8_t recvbuf[ISO15693_MAX_RESPONSE_LENGTH];
1596
1597 LED_A_ON();
1598
1599 if (DEBUG) {
1600 Dbprintf("SEND:");
1601 Dbhexdump(datalen, data, false);
1602 }
1603
1604 recvlen = SendDataTag(data, datalen, true, speed, (recv?recvbuf:NULL), sizeof(recvbuf), 0);
1605
1606 if (recv) {
1607 if (DEBUG) {
1608 Dbprintf("RECV:");
1609 Dbhexdump(recvlen, recvbuf, false);
1610 DbdecodeIso15693Answer(recvlen, recvbuf);
1611 }
1612
1613 cmd_send(CMD_ACK, recvlen>ISO15693_MAX_RESPONSE_LENGTH?ISO15693_MAX_RESPONSE_LENGTH:recvlen, 0, 0, recvbuf, ISO15693_MAX_RESPONSE_LENGTH);
1614
1615 }
1616
1617 // for the time being, switch field off to protect rdv4.0
1618 // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
1619 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1620 LED_D_OFF();
1621
1622 LED_A_OFF();
1623 }
1624
1625 //-----------------------------------------------------------------------------
1626 // Work with "magic Chinese" card.
1627 //
1628 //-----------------------------------------------------------------------------
1629
1630 // Set the UID to the tag (based on Iceman work).
1631 void SetTag15693Uid(uint8_t *uid)
1632 {
1633 uint8_t cmd[4][9] = {0x00};
1634
1635 uint16_t crc;
1636
1637 int recvlen = 0;
1638 uint8_t recvbuf[ISO15693_MAX_RESPONSE_LENGTH];
1639
1640 LED_A_ON();
1641
1642 // Command 1 : 02213E00000000
1643 cmd[0][0] = 0x02;
1644 cmd[0][1] = 0x21;
1645 cmd[0][2] = 0x3e;
1646 cmd[0][3] = 0x00;
1647 cmd[0][4] = 0x00;
1648 cmd[0][5] = 0x00;
1649 cmd[0][6] = 0x00;
1650
1651 // Command 2 : 02213F69960000
1652 cmd[1][0] = 0x02;
1653 cmd[1][1] = 0x21;
1654 cmd[1][2] = 0x3f;
1655 cmd[1][3] = 0x69;
1656 cmd[1][4] = 0x96;
1657 cmd[1][5] = 0x00;
1658 cmd[1][6] = 0x00;
1659
1660 // Command 3 : 022138u8u7u6u5 (where uX = uid byte X)
1661 cmd[2][0] = 0x02;
1662 cmd[2][1] = 0x21;
1663 cmd[2][2] = 0x38;
1664 cmd[2][3] = uid[7];
1665 cmd[2][4] = uid[6];
1666 cmd[2][5] = uid[5];
1667 cmd[2][6] = uid[4];
1668
1669 // Command 4 : 022139u4u3u2u1 (where uX = uid byte X)
1670 cmd[3][0] = 0x02;
1671 cmd[3][1] = 0x21;
1672 cmd[3][2] = 0x39;
1673 cmd[3][3] = uid[3];
1674 cmd[3][4] = uid[2];
1675 cmd[3][5] = uid[1];
1676 cmd[3][6] = uid[0];
1677
1678 for (int i=0; i<4; i++) {
1679 // Add the CRC
1680 crc = Iso15693Crc(cmd[i], 7);
1681 cmd[i][7] = crc & 0xff;
1682 cmd[i][8] = crc >> 8;
1683
1684 if (DEBUG) {
1685 Dbprintf("SEND:");
1686 Dbhexdump(sizeof(cmd[i]), cmd[i], false);
1687 }
1688
1689 recvlen = SendDataTag(cmd[i], sizeof(cmd[i]), true, 1, recvbuf, sizeof(recvbuf), 0);
1690
1691 if (DEBUG) {
1692 Dbprintf("RECV:");
1693 Dbhexdump(recvlen, recvbuf, false);
1694 DbdecodeIso15693Answer(recvlen, recvbuf);
1695 }
1696
1697 cmd_send(CMD_ACK, recvlen>ISO15693_MAX_RESPONSE_LENGTH?ISO15693_MAX_RESPONSE_LENGTH:recvlen, 0, 0, recvbuf, ISO15693_MAX_RESPONSE_LENGTH);
1698 }
1699
1700 LED_D_OFF();
1701
1702 LED_A_OFF();
1703 }
1704
1705
1706
1707 // --------------------------------------------------------------------
1708 // -- Misc & deprecated functions
1709 // --------------------------------------------------------------------
1710
1711 /*
1712
1713 // do not use; has a fix UID
1714 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1715 {
1716 uint8_t cmd[12];
1717
1718 uint16_t crc;
1719 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1720 // followed by the block data
1721 // one sub-carrier, inventory, 1 slot, fast rate
1722 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1723 // System Information command code
1724 cmd[1] = 0x2B;
1725 // UID may be optionally specified here
1726 // 64-bit UID
1727 cmd[2] = 0x32;
1728 cmd[3]= 0x4b;
1729 cmd[4] = 0x03;
1730 cmd[5] = 0x01;
1731 cmd[6] = 0x00;
1732 cmd[7] = 0x10;
1733 cmd[8] = 0x05;
1734 cmd[9]= 0xe0; // always e0 (not exactly unique)
1735 //Now the CRC
1736 crc = Iso15693Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1737 cmd[10] = crc & 0xff;
1738 cmd[11] = crc >> 8;
1739
1740 CodeIso15693AsReader(cmd, sizeof(cmd));
1741 }
1742
1743
1744 // do not use; has a fix UID
1745 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1746 {
1747 uint8_t cmd[14];
1748
1749 uint16_t crc;
1750 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1751 // followed by the block data
1752 // one sub-carrier, inventory, 1 slot, fast rate
1753 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1754 // READ Multi BLOCK command code
1755 cmd[1] = 0x23;
1756 // UID may be optionally specified here
1757 // 64-bit UID
1758 cmd[2] = 0x32;
1759 cmd[3]= 0x4b;
1760 cmd[4] = 0x03;
1761 cmd[5] = 0x01;
1762 cmd[6] = 0x00;
1763 cmd[7] = 0x10;
1764 cmd[8] = 0x05;
1765 cmd[9]= 0xe0; // always e0 (not exactly unique)
1766 // First Block number to read
1767 cmd[10] = 0x00;
1768 // Number of Blocks to read
1769 cmd[11] = 0x2f; // read quite a few
1770 //Now the CRC
1771 crc = Iso15693Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1772 cmd[12] = crc & 0xff;
1773 cmd[13] = crc >> 8;
1774
1775 CodeIso15693AsReader(cmd, sizeof(cmd));
1776 }
1777
1778 // do not use; has a fix UID
1779 static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1780 {
1781 uint8_t cmd[14];
1782
1783 uint16_t crc;
1784 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1785 // followed by the block data
1786 // one sub-carrier, inventory, 1 slot, fast rate
1787 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1788 // READ BLOCK command code
1789 cmd[1] = CmdCode;
1790 // UID may be optionally specified here
1791 // 64-bit UID
1792 cmd[2] = 0x32;
1793 cmd[3]= 0x4b;
1794 cmd[4] = 0x03;
1795 cmd[5] = 0x01;
1796 cmd[6] = 0x00;
1797 cmd[7] = 0x10;
1798 cmd[8] = 0x05;
1799 cmd[9]= 0xe0; // always e0 (not exactly unique)
1800 // Parameter
1801 cmd[10] = 0x00;
1802 cmd[11] = 0x0a;
1803
1804 // cmd[12] = 0x00;
1805 // cmd[13] = 0x00; //Now the CRC
1806 crc = Iso15693Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1807 cmd[12] = crc & 0xff;
1808 cmd[13] = crc >> 8;
1809
1810 CodeIso15693AsReader(cmd, sizeof(cmd));
1811 }
1812
1813 // do not use; has a fix UID
1814 static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1815 {
1816 uint8_t cmd[14];
1817
1818 uint16_t crc;
1819 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1820 // followed by the block data
1821 // one sub-carrier, inventory, 1 slot, fast rate
1822 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1823 // READ BLOCK command code
1824 cmd[1] = CmdCode;
1825 // UID may be optionally specified here
1826 // 64-bit UID
1827 cmd[2] = 0x32;
1828 cmd[3]= 0x4b;
1829 cmd[4] = 0x03;
1830 cmd[5] = 0x01;
1831 cmd[6] = 0x00;
1832 cmd[7] = 0x10;
1833 cmd[8] = 0x05;
1834 cmd[9]= 0xe0; // always e0 (not exactly unique)
1835 // Parameter
1836 cmd[10] = 0x05; // for custom codes this must be manufacturer code
1837 cmd[11] = 0x00;
1838
1839 // cmd[12] = 0x00;
1840 // cmd[13] = 0x00; //Now the CRC
1841 crc = Iso15693Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1842 cmd[12] = crc & 0xff;
1843 cmd[13] = crc >> 8;
1844
1845 CodeIso15693AsReader(cmd, sizeof(cmd));
1846 }
1847
1848
1849
1850
1851 */
1852
1853
Proxmark3 GIT tracking
Impressum, Datenschutz