1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
13 #include "proxmark3.h"
19 #include "iso14443crc.h"
20 #include "iso14443a.h"
22 #include "mifareutil.h"
24 static uint32_t iso14a_timeout
;
25 uint8_t *trace
= (uint8_t *) BigBuf
+TRACE_OFFSET
;
30 // the block number for the ISO14443-4 PCB
31 static uint8_t iso14_pcb_blocknum
= 0;
36 // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
37 #define REQUEST_GUARD_TIME (7000/16 + 1)
38 // minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
39 #define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
40 // bool LastCommandWasRequest = FALSE;
43 // Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
45 // When the PM acts as reader and is receiving tag data, it takes
46 // 3 ticks delay in the AD converter
47 // 16 ticks until the modulation detector completes and sets curbit
48 // 8 ticks until bit_to_arm is assigned from curbit
49 // 8*16 ticks for the transfer from FPGA to ARM
50 // 4*16 ticks until we measure the time
51 // - 8*16 ticks because we measure the time of the previous transfer
52 #define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
54 // When the PM acts as a reader and is sending, it takes
55 // 4*16 ticks until we can write data to the sending hold register
56 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
57 // 8 ticks until the first transfer starts
58 // 8 ticks later the FPGA samples the data
59 // 1 tick to assign mod_sig_coil
60 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
62 // When the PM acts as tag and is receiving it takes
63 // 2 ticks delay in the RF part (for the first falling edge),
64 // 3 ticks for the A/D conversion,
65 // 8 ticks on average until the start of the SSC transfer,
66 // 8 ticks until the SSC samples the first data
67 // 7*16 ticks to complete the transfer from FPGA to ARM
68 // 8 ticks until the next ssp_clk rising edge
69 // 4*16 ticks until we measure the time
70 // - 8*16 ticks because we measure the time of the previous transfer
71 #define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
73 // The FPGA will report its internal sending delay in
74 uint16_t FpgaSendQueueDelay
;
75 // the 5 first bits are the number of bits buffered in mod_sig_buf
76 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
77 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
79 // When the PM acts as tag and is sending, it takes
80 // 4*16 ticks until we can write data to the sending hold register
81 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
82 // 8 ticks until the first transfer starts
83 // 8 ticks later the FPGA samples the data
84 // + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
85 // + 1 tick to assign mod_sig_coil
86 #define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
88 // When the PM acts as sniffer and is receiving tag data, it takes
89 // 3 ticks A/D conversion
90 // 14 ticks to complete the modulation detection
91 // 8 ticks (on average) until the result is stored in to_arm
92 // + the delays in transferring data - which is the same for
93 // sniffing reader and tag data and therefore not relevant
94 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
96 // When the PM acts as sniffer and is receiving reader data, it takes
97 // 2 ticks delay in analogue RF receiver (for the falling edge of the
98 // start bit, which marks the start of the communication)
99 // 3 ticks A/D conversion
100 // 8 ticks on average until the data is stored in to_arm.
101 // + the delays in transferring data - which is the same for
102 // sniffing reader and tag data and therefore not relevant
103 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
105 //variables used for timing purposes:
106 //these are in ssp_clk cycles:
107 static uint32_t NextTransferTime
;
108 static uint32_t LastTimeProxToAirStart
;
109 static uint32_t LastProxToAirDuration
;
113 // CARD TO READER - manchester
114 // Sequence D: 11110000 modulation with subcarrier during first half
115 // Sequence E: 00001111 modulation with subcarrier during second half
116 // Sequence F: 00000000 no modulation with subcarrier
117 // READER TO CARD - miller
118 // Sequence X: 00001100 drop after half a period
119 // Sequence Y: 00000000 no drop
120 // Sequence Z: 11000000 drop at start
128 const uint8_t OddByteParity
[256] = {
129 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
130 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
131 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
132 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
138 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
139 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
140 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
141 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
142 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
143 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
144 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
147 void iso14a_set_trigger(bool enable
) {
151 void iso14a_clear_trace() {
152 memset(trace
, 0x44, TRACE_SIZE
);
156 void iso14a_set_tracing(bool enable
) {
160 void iso14a_set_timeout(uint32_t timeout
) {
161 iso14a_timeout
= timeout
;
164 //-----------------------------------------------------------------------------
165 // Generate the parity value for a byte sequence
167 //-----------------------------------------------------------------------------
168 byte_t
oddparity (const byte_t bt
)
170 return OddByteParity
[bt
];
173 void GetParity(const uint8_t *pbtCmd
, uint16_t iLen
, uint8_t *par
)
175 uint16_t paritybit_cnt
= 0;
176 uint16_t paritybyte_cnt
= 0;
177 uint8_t parityBits
= 0;
179 for (uint16_t i
= 0; i
< iLen
; i
++) {
180 // Generate the parity bits
181 parityBits
|= ((OddByteParity
[pbtCmd
[i
]]) << (7-paritybit_cnt
));
182 if (paritybit_cnt
== 7) {
183 par
[paritybyte_cnt
] = parityBits
; // save 8 Bits parity
184 parityBits
= 0; // and advance to next Parity Byte
192 // save remaining parity bits
193 par
[paritybyte_cnt
] = parityBits
;
197 void AppendCrc14443a(uint8_t* data
, int len
)
199 ComputeCrc14443(CRC_14443_A
,data
,len
,data
+len
,data
+len
+1);
203 //=============================================================================
204 // ISO 14443 Type A - Miller decoder
205 //=============================================================================
207 // This decoder is used when the PM3 acts as a tag.
208 // The reader will generate "pauses" by temporarily switching of the field.
209 // At the PM3 antenna we will therefore measure a modulated antenna voltage.
210 // The FPGA does a comparison with a threshold and would deliver e.g.:
211 // ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
212 // The Miller decoder needs to identify the following sequences:
213 // 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
214 // 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
215 // 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
216 // Note 1: the bitstream may start at any time. We therefore need to sync.
217 // Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
218 //-----------------------------------------------------------------------------
221 // Lookup-Table to decide if 4 raw bits are a modulation.
222 // We accept two or three consecutive "0" in any position with the rest "1"
223 const bool Mod_Miller_LUT
[] = {
224 TRUE
, TRUE
, FALSE
, TRUE
, FALSE
, FALSE
, FALSE
, FALSE
,
225 TRUE
, TRUE
, FALSE
, FALSE
, TRUE
, FALSE
, FALSE
, FALSE
227 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x00F0) >> 4])
228 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x000F)])
232 Uart
.state
= STATE_UNSYNCD
;
234 Uart
.len
= 0; // number of decoded data bytes
235 Uart
.parityLen
= 0; // number of decoded parity bytes
236 Uart
.shiftReg
= 0; // shiftreg to hold decoded data bits
237 Uart
.parityBits
= 0; // holds 8 parity bits
238 Uart
.twoBits
= 0x0000; // buffer for 2 Bits
244 void UartInit(uint8_t *data
, uint8_t *parity
)
247 Uart
.parity
= parity
;
251 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
252 static RAMFUNC
bool MillerDecoding(uint8_t bit
, uint32_t non_real_time
)
255 Uart
.twoBits
= (Uart
.twoBits
<< 8) | bit
;
257 if (Uart
.state
== STATE_UNSYNCD
) { // not yet synced
259 if (Uart
.highCnt
< 7) { // wait for a stable unmodulated signal
260 if (Uart
.twoBits
== 0xffff) {
266 Uart
.syncBit
= 0xFFFF; // not set
267 // look for 00xx1111 (the start bit)
268 if ((Uart
.twoBits
& 0x6780) == 0x0780) Uart
.syncBit
= 7;
269 else if ((Uart
.twoBits
& 0x33C0) == 0x03C0) Uart
.syncBit
= 6;
270 else if ((Uart
.twoBits
& 0x19E0) == 0x01E0) Uart
.syncBit
= 5;
271 else if ((Uart
.twoBits
& 0x0CF0) == 0x00F0) Uart
.syncBit
= 4;
272 else if ((Uart
.twoBits
& 0x0678) == 0x0078) Uart
.syncBit
= 3;
273 else if ((Uart
.twoBits
& 0x033C) == 0x003C) Uart
.syncBit
= 2;
274 else if ((Uart
.twoBits
& 0x019E) == 0x001E) Uart
.syncBit
= 1;
275 else if ((Uart
.twoBits
& 0x00CF) == 0x000F) Uart
.syncBit
= 0;
276 if (Uart
.syncBit
!= 0xFFFF) {
277 Uart
.startTime
= non_real_time
?non_real_time
:(GetCountSspClk() & 0xfffffff8);
278 Uart
.startTime
-= Uart
.syncBit
;
279 Uart
.endTime
= Uart
.startTime
;
280 Uart
.state
= STATE_START_OF_COMMUNICATION
;
286 if (IsMillerModulationNibble1(Uart
.twoBits
>> Uart
.syncBit
)) {
287 if (IsMillerModulationNibble2(Uart
.twoBits
>> Uart
.syncBit
)) { // Modulation in both halves - error
290 } else { // Modulation in first half = Sequence Z = logic "0"
291 if (Uart
.state
== STATE_MILLER_X
) { // error - must not follow after X
296 Uart
.shiftReg
= (Uart
.shiftReg
>> 1); // add a 0 to the shiftreg
297 Uart
.state
= STATE_MILLER_Z
;
298 Uart
.endTime
= Uart
.startTime
+ 8*(9*Uart
.len
+ Uart
.bitCount
+ 1) - 6;
299 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
300 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
301 Uart
.parityBits
<<= 1; // make room for the parity bit
302 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
305 if((Uart
.len
&0x0007) == 0) { // every 8 data bytes
306 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
313 if (IsMillerModulationNibble2(Uart
.twoBits
>> Uart
.syncBit
)) { // Modulation second half = Sequence X = logic "1"
315 Uart
.shiftReg
= (Uart
.shiftReg
>> 1) | 0x100; // add a 1 to the shiftreg
316 Uart
.state
= STATE_MILLER_X
;
317 Uart
.endTime
= Uart
.startTime
+ 8*(9*Uart
.len
+ Uart
.bitCount
+ 1) - 2;
318 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
319 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
320 Uart
.parityBits
<<= 1; // make room for the new parity bit
321 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
324 if ((Uart
.len
&0x0007) == 0) { // every 8 data bytes
325 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
329 } else { // no modulation in both halves - Sequence Y
330 if (Uart
.state
== STATE_MILLER_Z
|| Uart
.state
== STATE_MILLER_Y
) { // Y after logic "0" - End of Communication
331 Uart
.state
= STATE_UNSYNCD
;
332 Uart
.bitCount
--; // last "0" was part of EOC sequence
333 Uart
.shiftReg
<<= 1; // drop it
334 if(Uart
.bitCount
> 0) { // if we decoded some bits
335 Uart
.shiftReg
>>= (9 - Uart
.bitCount
); // right align them
336 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff); // add last byte to the output
337 Uart
.parityBits
<<= 1; // add a (void) parity bit
338 Uart
.parityBits
<<= (8 - (Uart
.len
&0x0007)); // left align parity bits
339 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // and store it
341 } else if (Uart
.len
& 0x0007) { // there are some parity bits to store
342 Uart
.parityBits
<<= (8 - (Uart
.len
&0x0007)); // left align remaining parity bits
343 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // and store them
346 return TRUE
; // we are finished with decoding the raw data sequence
348 UartReset(); // Nothing receiver - start over
351 if (Uart
.state
== STATE_START_OF_COMMUNICATION
) { // error - must not follow directly after SOC
354 } else { // a logic "0"
356 Uart
.shiftReg
= (Uart
.shiftReg
>> 1); // add a 0 to the shiftreg
357 Uart
.state
= STATE_MILLER_Y
;
358 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
359 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
360 Uart
.parityBits
<<= 1; // make room for the parity bit
361 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
364 if ((Uart
.len
&0x0007) == 0) { // every 8 data bytes
365 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
375 return FALSE
; // not finished yet, need more data
380 //=============================================================================
381 // ISO 14443 Type A - Manchester decoder
382 //=============================================================================
384 // This decoder is used when the PM3 acts as a reader.
385 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
386 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
387 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
388 // The Manchester decoder needs to identify the following sequences:
389 // 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
390 // 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
391 // 8 ticks unmodulated: Sequence F = end of communication
392 // 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
393 // Note 1: the bitstream may start at any time. We therefore need to sync.
394 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
397 // Lookup-Table to decide if 4 raw bits are a modulation.
398 // We accept three or four "1" in any position
399 const bool Mod_Manchester_LUT
[] = {
400 FALSE
, FALSE
, FALSE
, FALSE
, FALSE
, FALSE
, FALSE
, TRUE
,
401 FALSE
, FALSE
, FALSE
, TRUE
, FALSE
, TRUE
, TRUE
, TRUE
404 #define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
405 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
410 Demod
.state
= DEMOD_UNSYNCD
;
411 Demod
.len
= 0; // number of decoded data bytes
413 Demod
.shiftReg
= 0; // shiftreg to hold decoded data bits
414 Demod
.parityBits
= 0; //
415 Demod
.collisionPos
= 0; // Position of collision bit
416 Demod
.twoBits
= 0xffff; // buffer for 2 Bits
422 void DemodInit(uint8_t *data
, uint8_t *parity
)
425 Demod
.parity
= parity
;
429 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
430 static RAMFUNC
int ManchesterDecoding(uint8_t bit
, uint16_t offset
, uint32_t non_real_time
)
433 Demod
.twoBits
= (Demod
.twoBits
<< 8) | bit
;
435 if (Demod
.state
== DEMOD_UNSYNCD
) {
437 if (Demod
.highCnt
< 2) { // wait for a stable unmodulated signal
438 if (Demod
.twoBits
== 0x0000) {
444 Demod
.syncBit
= 0xFFFF; // not set
445 if ((Demod
.twoBits
& 0x7700) == 0x7000) Demod
.syncBit
= 7;
446 else if ((Demod
.twoBits
& 0x3B80) == 0x3800) Demod
.syncBit
= 6;
447 else if ((Demod
.twoBits
& 0x1DC0) == 0x1C00) Demod
.syncBit
= 5;
448 else if ((Demod
.twoBits
& 0x0EE0) == 0x0E00) Demod
.syncBit
= 4;
449 else if ((Demod
.twoBits
& 0x0770) == 0x0700) Demod
.syncBit
= 3;
450 else if ((Demod
.twoBits
& 0x03B8) == 0x0380) Demod
.syncBit
= 2;
451 else if ((Demod
.twoBits
& 0x01DC) == 0x01C0) Demod
.syncBit
= 1;
452 else if ((Demod
.twoBits
& 0x00EE) == 0x00E0) Demod
.syncBit
= 0;
453 if (Demod
.syncBit
!= 0xFFFF) {
454 Demod
.startTime
= non_real_time
?non_real_time
:(GetCountSspClk() & 0xfffffff8);
455 Demod
.startTime
-= Demod
.syncBit
;
456 Demod
.bitCount
= offset
; // number of decoded data bits
457 Demod
.state
= DEMOD_MANCHESTER_DATA
;
463 if (IsManchesterModulationNibble1(Demod
.twoBits
>> Demod
.syncBit
)) { // modulation in first half
464 if (IsManchesterModulationNibble2(Demod
.twoBits
>> Demod
.syncBit
)) { // ... and in second half = collision
465 if (!Demod
.collisionPos
) {
466 Demod
.collisionPos
= (Demod
.len
<< 3) + Demod
.bitCount
;
468 } // modulation in first half only - Sequence D = 1
470 Demod
.shiftReg
= (Demod
.shiftReg
>> 1) | 0x100; // in both cases, add a 1 to the shiftreg
471 if(Demod
.bitCount
== 9) { // if we decoded a full byte (including parity)
472 Demod
.output
[Demod
.len
++] = (Demod
.shiftReg
& 0xff);
473 Demod
.parityBits
<<= 1; // make room for the parity bit
474 Demod
.parityBits
|= ((Demod
.shiftReg
>> 8) & 0x01); // store parity bit
477 if((Demod
.len
&0x0007) == 0) { // every 8 data bytes
478 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // store 8 parity bits
479 Demod
.parityBits
= 0;
482 Demod
.endTime
= Demod
.startTime
+ 8*(9*Demod
.len
+ Demod
.bitCount
+ 1) - 4;
483 } else { // no modulation in first half
484 if (IsManchesterModulationNibble2(Demod
.twoBits
>> Demod
.syncBit
)) { // and modulation in second half = Sequence E = 0
486 Demod
.shiftReg
= (Demod
.shiftReg
>> 1); // add a 0 to the shiftreg
487 if(Demod
.bitCount
>= 9) { // if we decoded a full byte (including parity)
488 Demod
.output
[Demod
.len
++] = (Demod
.shiftReg
& 0xff);
489 Demod
.parityBits
<<= 1; // make room for the new parity bit
490 Demod
.parityBits
|= ((Demod
.shiftReg
>> 8) & 0x01); // store parity bit
493 if ((Demod
.len
&0x0007) == 0) { // every 8 data bytes
494 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // store 8 parity bits1
495 Demod
.parityBits
= 0;
498 Demod
.endTime
= Demod
.startTime
+ 8*(9*Demod
.len
+ Demod
.bitCount
+ 1);
499 } else { // no modulation in both halves - End of communication
500 if(Demod
.bitCount
> 0) { // there are some remaining data bits
501 Demod
.shiftReg
>>= (9 - Demod
.bitCount
); // right align the decoded bits
502 Demod
.output
[Demod
.len
++] = Demod
.shiftReg
& 0xff; // and add them to the output
503 Demod
.parityBits
<<= 1; // add a (void) parity bit
504 Demod
.parityBits
<<= (8 - (Demod
.len
&0x0007)); // left align remaining parity bits
505 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // and store them
507 } else if (Demod
.len
& 0x0007) { // there are some parity bits to store
508 Demod
.parityBits
<<= (8 - (Demod
.len
&0x0007)); // left align remaining parity bits
509 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // and store them
512 return TRUE
; // we are finished with decoding the raw data sequence
513 } else { // nothing received. Start over
521 return FALSE
; // not finished yet, need more data
524 //=============================================================================
525 // Finally, a `sniffer' for ISO 14443 Type A
526 // Both sides of communication!
527 //=============================================================================
529 //-----------------------------------------------------------------------------
530 // Record the sequence of commands sent by the reader to the tag, with
531 // triggering so that we start recording at the point that the tag is moved
533 //-----------------------------------------------------------------------------
534 void RAMFUNC
SnoopIso14443a(uint8_t param
) {
536 // bit 0 - trigger from first card answer
537 // bit 1 - trigger from first reader 7-bit request
541 iso14a_clear_trace();
542 iso14a_set_tracing(TRUE
);
544 // We won't start recording the frames that we acquire until we trigger;
545 // a good trigger condition to get started is probably when we see a
546 // response from the tag.
547 // triggered == FALSE -- to wait first for card
548 bool triggered
= !(param
& 0x03);
550 // The command (reader -> tag) that we're receiving.
551 // The length of a received command will in most cases be no more than 18 bytes.
552 // So 32 should be enough!
553 uint8_t *receivedCmd
= ((uint8_t *)BigBuf
) + RECV_CMD_OFFSET
;
554 uint8_t *receivedCmdPar
= ((uint8_t *)BigBuf
) + RECV_CMD_PAR_OFFSET
;
556 // The response (tag -> reader) that we're receiving.
557 uint8_t *receivedResponse
= ((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
;
558 uint8_t *receivedResponsePar
= ((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
;
560 // As we receive stuff, we copy it from receivedCmd or receivedResponse
561 // into trace, along with its length and other annotations.
562 //uint8_t *trace = (uint8_t *)BigBuf;
564 // The DMA buffer, used to stream samples from the FPGA
565 uint8_t *dmaBuf
= ((uint8_t *)BigBuf
) + DMA_BUFFER_OFFSET
;
566 uint8_t *data
= dmaBuf
;
567 uint8_t previous_data
= 0;
570 bool TagIsActive
= FALSE
;
571 bool ReaderIsActive
= FALSE
;
573 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER
);
575 // Set up the demodulator for tag -> reader responses.
576 DemodInit(receivedResponse
, receivedResponsePar
);
578 // Set up the demodulator for the reader -> tag commands
579 UartInit(receivedCmd
, receivedCmdPar
);
581 // Setup and start DMA.
582 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
);
584 // And now we loop, receiving samples.
585 for(uint32_t rsamples
= 0; TRUE
; ) {
588 DbpString("cancelled by button");
595 int register readBufDataP
= data
- dmaBuf
;
596 int register dmaBufDataP
= DMA_BUFFER_SIZE
- AT91C_BASE_PDC_SSC
->PDC_RCR
;
597 if (readBufDataP
<= dmaBufDataP
){
598 dataLen
= dmaBufDataP
- readBufDataP
;
600 dataLen
= DMA_BUFFER_SIZE
- readBufDataP
+ dmaBufDataP
;
602 // test for length of buffer
603 if(dataLen
> maxDataLen
) {
604 maxDataLen
= dataLen
;
606 Dbprintf("blew circular buffer! dataLen=%d", dataLen
);
610 if(dataLen
< 1) continue;
612 // primary buffer was stopped( <-- we lost data!
613 if (!AT91C_BASE_PDC_SSC
->PDC_RCR
) {
614 AT91C_BASE_PDC_SSC
->PDC_RPR
= (uint32_t) dmaBuf
;
615 AT91C_BASE_PDC_SSC
->PDC_RCR
= DMA_BUFFER_SIZE
;
616 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen
); // temporary
618 // secondary buffer sets as primary, secondary buffer was stopped
619 if (!AT91C_BASE_PDC_SSC
->PDC_RNCR
) {
620 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
;
621 AT91C_BASE_PDC_SSC
->PDC_RNCR
= DMA_BUFFER_SIZE
;
626 if (rsamples
& 0x01) { // Need two samples to feed Miller and Manchester-Decoder
628 if(!TagIsActive
) { // no need to try decoding reader data if the tag is sending
629 uint8_t readerdata
= (previous_data
& 0xF0) | (*data
>> 4);
630 if (MillerDecoding(readerdata
, (rsamples
-1)*4)) {
633 // check - if there is a short 7bit request from reader
634 if ((!triggered
) && (param
& 0x02) && (Uart
.len
== 1) && (Uart
.bitCount
== 7)) triggered
= TRUE
;
637 if (!LogTrace(receivedCmd
,
639 Uart
.startTime
*16 - DELAY_READER_AIR2ARM_AS_SNIFFER
,
640 Uart
.endTime
*16 - DELAY_READER_AIR2ARM_AS_SNIFFER
,
644 /* And ready to receive another command. */
646 /* And also reset the demod code, which might have been */
647 /* false-triggered by the commands from the reader. */
651 ReaderIsActive
= (Uart
.state
!= STATE_UNSYNCD
);
654 if(!ReaderIsActive
) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
655 uint8_t tagdata
= (previous_data
<< 4) | (*data
& 0x0F);
656 if(ManchesterDecoding(tagdata
, 0, (rsamples
-1)*4)) {
659 if (!LogTrace(receivedResponse
,
661 Demod
.startTime
*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER
,
662 Demod
.endTime
*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER
,
666 if ((!triggered
) && (param
& 0x01)) triggered
= TRUE
;
668 // And ready to receive another response.
672 TagIsActive
= (Demod
.state
!= DEMOD_UNSYNCD
);
676 previous_data
= *data
;
679 if(data
== dmaBuf
+ DMA_BUFFER_SIZE
) {
684 DbpString("COMMAND FINISHED");
687 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen
, Uart
.state
, Uart
.len
);
688 Dbprintf("traceLen=%d, Uart.output[0]=%08x", traceLen
, (uint32_t)Uart
.output
[0]);
692 //-----------------------------------------------------------------------------
693 // Prepare tag messages
694 //-----------------------------------------------------------------------------
695 static void CodeIso14443aAsTagPar(const uint8_t *cmd
, uint16_t len
, uint8_t *parity
)
699 // Correction bit, might be removed when not needed
704 ToSendStuffBit(1); // 1
710 ToSend
[++ToSendMax
] = SEC_D
;
711 LastProxToAirDuration
= 8 * ToSendMax
- 4;
713 for(uint16_t i
= 0; i
< len
; i
++) {
717 for(uint16_t j
= 0; j
< 8; j
++) {
719 ToSend
[++ToSendMax
] = SEC_D
;
721 ToSend
[++ToSendMax
] = SEC_E
;
726 // Get the parity bit
727 if (parity
[i
>>3] & (0x80>>(i
&0x0007))) {
728 ToSend
[++ToSendMax
] = SEC_D
;
729 LastProxToAirDuration
= 8 * ToSendMax
- 4;
731 ToSend
[++ToSendMax
] = SEC_E
;
732 LastProxToAirDuration
= 8 * ToSendMax
;
737 ToSend
[++ToSendMax
] = SEC_F
;
739 // Convert from last byte pos to length
743 static void CodeIso14443aAsTag(const uint8_t *cmd
, uint16_t len
)
745 uint8_t par
[MAX_PARITY_SIZE
];
747 GetParity(cmd
, len
, par
);
748 CodeIso14443aAsTagPar(cmd
, len
, par
);
752 static void Code4bitAnswerAsTag(uint8_t cmd
)
758 // Correction bit, might be removed when not needed
763 ToSendStuffBit(1); // 1
769 ToSend
[++ToSendMax
] = SEC_D
;
772 for(i
= 0; i
< 4; i
++) {
774 ToSend
[++ToSendMax
] = SEC_D
;
775 LastProxToAirDuration
= 8 * ToSendMax
- 4;
777 ToSend
[++ToSendMax
] = SEC_E
;
778 LastProxToAirDuration
= 8 * ToSendMax
;
784 ToSend
[++ToSendMax
] = SEC_F
;
786 // Convert from last byte pos to length
790 //-----------------------------------------------------------------------------
791 // Wait for commands from reader
792 // Stop when button is pressed
793 // Or return TRUE when command is captured
794 //-----------------------------------------------------------------------------
795 static int GetIso14443aCommandFromReader(uint8_t *received
, uint8_t *parity
, int *len
)
797 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
798 // only, since we are receiving, not transmitting).
799 // Signal field is off with the appropriate LED
801 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
803 // Now run a `software UART' on the stream of incoming samples.
804 UartInit(received
, parity
);
807 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
812 if(BUTTON_PRESS()) return FALSE
;
814 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
815 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
816 if(MillerDecoding(b
, 0)) {
824 static int EmSendCmd14443aRaw(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
);
825 int EmSend4bitEx(uint8_t resp
, bool correctionNeeded
);
826 int EmSend4bit(uint8_t resp
);
827 int EmSendCmdExPar(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
, uint8_t *par
);
828 int EmSendCmdEx(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
);
829 int EmSendCmd(uint8_t *resp
, uint16_t respLen
);
830 int EmSendCmdPar(uint8_t *resp
, uint16_t respLen
, uint8_t *par
);
831 bool EmLogTrace(uint8_t *reader_data
, uint16_t reader_len
, uint32_t reader_StartTime
, uint32_t reader_EndTime
, uint8_t *reader_Parity
,
832 uint8_t *tag_data
, uint16_t tag_len
, uint32_t tag_StartTime
, uint32_t tag_EndTime
, uint8_t *tag_Parity
);
834 static uint8_t* free_buffer_pointer
= (((uint8_t *)BigBuf
) + FREE_BUFFER_OFFSET
);
841 uint32_t ProxToAirDuration
;
842 } tag_response_info_t
;
844 void reset_free_buffer() {
845 free_buffer_pointer
= (((uint8_t *)BigBuf
) + FREE_BUFFER_OFFSET
);
848 bool prepare_tag_modulation(tag_response_info_t
* response_info
, size_t max_buffer_size
) {
849 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
850 // This will need the following byte array for a modulation sequence
851 // 144 data bits (18 * 8)
854 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
855 // 1 just for the case
857 // 166 bytes, since every bit that needs to be send costs us a byte
860 // Prepare the tag modulation bits from the message
861 CodeIso14443aAsTag(response_info
->response
,response_info
->response_n
);
863 // Make sure we do not exceed the free buffer space
864 if (ToSendMax
> max_buffer_size
) {
865 Dbprintf("Out of memory, when modulating bits for tag answer:");
866 Dbhexdump(response_info
->response_n
,response_info
->response
,false);
870 // Copy the byte array, used for this modulation to the buffer position
871 memcpy(response_info
->modulation
,ToSend
,ToSendMax
);
873 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
874 response_info
->modulation_n
= ToSendMax
;
875 response_info
->ProxToAirDuration
= LastProxToAirDuration
;
880 bool prepare_allocated_tag_modulation(tag_response_info_t
* response_info
) {
881 // Retrieve and store the current buffer index
882 response_info
->modulation
= free_buffer_pointer
;
884 // Determine the maximum size we can use from our buffer
885 size_t max_buffer_size
= (((uint8_t *)BigBuf
) + FREE_BUFFER_OFFSET
+ FREE_BUFFER_SIZE
) - free_buffer_pointer
;
887 // Forward the prepare tag modulation function to the inner function
888 if (prepare_tag_modulation(response_info
,max_buffer_size
)) {
889 // Update the free buffer offset
890 free_buffer_pointer
+= ToSendMax
;
897 //-----------------------------------------------------------------------------
898 // Main loop of simulated tag: receive commands from reader, decide what
899 // response to send, and send it.
900 //-----------------------------------------------------------------------------
901 void SimulateIso14443aTag(int tagType
, int uid_1st
, int uid_2nd
, byte_t
* data
)
903 // Enable and clear the trace
904 iso14a_clear_trace();
905 iso14a_set_tracing(TRUE
);
909 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
910 uint8_t response1
[2];
913 case 1: { // MIFARE Classic
914 // Says: I am Mifare 1k - original line
919 case 2: { // MIFARE Ultralight
920 // Says: I am a stupid memory tag, no crypto
925 case 3: { // MIFARE DESFire
926 // Says: I am a DESFire tag, ph33r me
931 case 4: { // ISO/IEC 14443-4
932 // Says: I am a javacard (JCOP)
937 case 5: { // MIFARE TNP3XXX
944 Dbprintf("Error: unkown tagtype (%d)",tagType
);
949 // The second response contains the (mandatory) first 24 bits of the UID
950 uint8_t response2
[5];
952 // Check if the uid uses the (optional) part
953 uint8_t response2a
[5];
956 num_to_bytes(uid_1st
,3,response2
+1);
957 num_to_bytes(uid_2nd
,4,response2a
);
958 response2a
[4] = response2a
[0] ^ response2a
[1] ^ response2a
[2] ^ response2a
[3];
960 // Configure the ATQA and SAK accordingly
961 response1
[0] |= 0x40;
964 num_to_bytes(uid_1st
,4,response2
);
965 // Configure the ATQA and SAK accordingly
966 response1
[0] &= 0xBF;
970 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
971 response2
[4] = response2
[0] ^ response2
[1] ^ response2
[2] ^ response2
[3];
973 // Prepare the mandatory SAK (for 4 and 7 byte UID)
974 uint8_t response3
[3];
976 ComputeCrc14443(CRC_14443_A
, response3
, 1, &response3
[1], &response3
[2]);
978 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
979 uint8_t response3a
[3];
980 response3a
[0] = sak
& 0xFB;
981 ComputeCrc14443(CRC_14443_A
, response3a
, 1, &response3a
[1], &response3a
[2]);
983 uint8_t response5
[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
984 uint8_t response6
[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
985 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
986 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
987 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
988 // TC(1) = 0x02: CID supported, NAD not supported
989 ComputeCrc14443(CRC_14443_A
, response6
, 4, &response6
[4], &response6
[5]);
991 #define TAG_RESPONSE_COUNT 7
992 tag_response_info_t responses
[TAG_RESPONSE_COUNT
] = {
993 { .response
= response1
, .response_n
= sizeof(response1
) }, // Answer to request - respond with card type
994 { .response
= response2
, .response_n
= sizeof(response2
) }, // Anticollision cascade1 - respond with uid
995 { .response
= response2a
, .response_n
= sizeof(response2a
) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
996 { .response
= response3
, .response_n
= sizeof(response3
) }, // Acknowledge select - cascade 1
997 { .response
= response3a
, .response_n
= sizeof(response3a
) }, // Acknowledge select - cascade 2
998 { .response
= response5
, .response_n
= sizeof(response5
) }, // Authentication answer (random nonce)
999 { .response
= response6
, .response_n
= sizeof(response6
) }, // dummy ATS (pseudo-ATR), answer to RATS
1002 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1003 // Such a response is less time critical, so we can prepare them on the fly
1004 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1005 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1006 uint8_t dynamic_response_buffer
[DYNAMIC_RESPONSE_BUFFER_SIZE
];
1007 uint8_t dynamic_modulation_buffer
[DYNAMIC_MODULATION_BUFFER_SIZE
];
1008 tag_response_info_t dynamic_response_info
= {
1009 .response
= dynamic_response_buffer
,
1011 .modulation
= dynamic_modulation_buffer
,
1015 // Reset the offset pointer of the free buffer
1016 reset_free_buffer();
1018 // Prepare the responses of the anticollision phase
1019 // there will be not enough time to do this at the moment the reader sends it REQA
1020 for (size_t i
=0; i
<TAG_RESPONSE_COUNT
; i
++) {
1021 prepare_allocated_tag_modulation(&responses
[i
]);
1026 // To control where we are in the protocol
1030 // Just to allow some checks
1035 // We need to listen to the high-frequency, peak-detected path.
1036 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
1038 // buffers used on software Uart:
1039 uint8_t *receivedCmd
= ((uint8_t *)BigBuf
) + RECV_CMD_OFFSET
;
1040 uint8_t *receivedCmdPar
= ((uint8_t *)BigBuf
) + RECV_CMD_PAR_OFFSET
;
1043 tag_response_info_t
* p_response
;
1047 // Clean receive command buffer
1049 if(!GetIso14443aCommandFromReader(receivedCmd
, receivedCmdPar
, &len
)) {
1050 DbpString("Button press");
1056 // Okay, look at the command now.
1058 if(receivedCmd
[0] == 0x26) { // Received a REQUEST
1059 p_response
= &responses
[0]; order
= 1;
1060 } else if(receivedCmd
[0] == 0x52) { // Received a WAKEUP
1061 p_response
= &responses
[0]; order
= 6;
1062 } else if(receivedCmd
[1] == 0x20 && receivedCmd
[0] == 0x93) { // Received request for UID (cascade 1)
1063 p_response
= &responses
[1]; order
= 2;
1064 } else if(receivedCmd
[1] == 0x20 && receivedCmd
[0] == 0x95) { // Received request for UID (cascade 2)
1065 p_response
= &responses
[2]; order
= 20;
1066 } else if(receivedCmd
[1] == 0x70 && receivedCmd
[0] == 0x93) { // Received a SELECT (cascade 1)
1067 p_response
= &responses
[3]; order
= 3;
1068 } else if(receivedCmd
[1] == 0x70 && receivedCmd
[0] == 0x95) { // Received a SELECT (cascade 2)
1069 p_response
= &responses
[4]; order
= 30;
1070 } else if(receivedCmd
[0] == 0x30) { // Received a (plain) READ
1071 EmSendCmdEx(data
+(4*receivedCmd
[1]),16,false);
1072 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1073 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1075 } else if(receivedCmd
[0] == 0x50) { // Received a HALT
1078 LogTrace(receivedCmd
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
1081 } else if(receivedCmd
[0] == 0x60 || receivedCmd
[0] == 0x61) { // Received an authentication request
1082 p_response
= &responses
[5]; order
= 7;
1083 } else if(receivedCmd
[0] == 0xE0) { // Received a RATS request
1084 if (tagType
== 1 || tagType
== 2) { // RATS not supported
1085 EmSend4bit(CARD_NACK_NA
);
1088 p_response
= &responses
[6]; order
= 70;
1090 } else if (order
== 7 && len
== 8) { // Received {nr] and {ar} (part of authentication)
1092 LogTrace(receivedCmd
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
1094 uint32_t nr
= bytes_to_num(receivedCmd
,4);
1095 uint32_t ar
= bytes_to_num(receivedCmd
+4,4);
1096 Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr
,ar
);
1098 // Check for ISO 14443A-4 compliant commands, look at left nibble
1099 switch (receivedCmd
[0]) {
1102 case 0x0A: { // IBlock (command)
1103 dynamic_response_info
.response
[0] = receivedCmd
[0];
1104 dynamic_response_info
.response
[1] = 0x00;
1105 dynamic_response_info
.response
[2] = 0x90;
1106 dynamic_response_info
.response
[3] = 0x00;
1107 dynamic_response_info
.response_n
= 4;
1111 case 0x1B: { // Chaining command
1112 dynamic_response_info
.response
[0] = 0xaa | ((receivedCmd
[0]) & 1);
1113 dynamic_response_info
.response_n
= 2;
1118 dynamic_response_info
.response
[0] = receivedCmd
[0] ^ 0x11;
1119 dynamic_response_info
.response_n
= 2;
1123 memcpy(dynamic_response_info
.response
,"\xAB\x00",2);
1124 dynamic_response_info
.response_n
= 2;
1128 case 0xC2: { // Readers sends deselect command
1129 memcpy(dynamic_response_info
.response
,"\xCA\x00",2);
1130 dynamic_response_info
.response_n
= 2;
1134 // Never seen this command before
1136 LogTrace(receivedCmd
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
1138 Dbprintf("Received unknown command (len=%d):",len
);
1139 Dbhexdump(len
,receivedCmd
,false);
1141 dynamic_response_info
.response_n
= 0;
1145 if (dynamic_response_info
.response_n
> 0) {
1146 // Copy the CID from the reader query
1147 dynamic_response_info
.response
[1] = receivedCmd
[1];
1149 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1150 AppendCrc14443a(dynamic_response_info
.response
,dynamic_response_info
.response_n
);
1151 dynamic_response_info
.response_n
+= 2;
1153 if (prepare_tag_modulation(&dynamic_response_info
,DYNAMIC_MODULATION_BUFFER_SIZE
) == false) {
1154 Dbprintf("Error preparing tag response");
1156 LogTrace(receivedCmd
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
1160 p_response
= &dynamic_response_info
;
1164 // Count number of wakeups received after a halt
1165 if(order
== 6 && lastorder
== 5) { happened
++; }
1167 // Count number of other messages after a halt
1168 if(order
!= 6 && lastorder
== 5) { happened2
++; }
1170 if(cmdsRecvd
> 999) {
1171 DbpString("1000 commands later...");
1176 if (p_response
!= NULL
) {
1177 EmSendCmd14443aRaw(p_response
->modulation
, p_response
->modulation_n
, receivedCmd
[0] == 0x52);
1178 // do the tracing for the previous reader request and this tag answer:
1179 uint8_t par
[MAX_PARITY_SIZE
];
1180 GetParity(p_response
->response
, p_response
->response_n
, par
);
1182 EmLogTrace(Uart
.output
,
1184 Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1185 Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1187 p_response
->response
,
1188 p_response
->response_n
,
1189 LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_TAG
,
1190 (LastTimeProxToAirStart
+ p_response
->ProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_TAG
,
1195 Dbprintf("Trace Full. Simulation stopped.");
1200 Dbprintf("%x %x %x", happened
, happened2
, cmdsRecvd
);
1205 // prepare a delayed transfer. This simply shifts ToSend[] by a number
1206 // of bits specified in the delay parameter.
1207 void PrepareDelayedTransfer(uint16_t delay
)
1209 uint8_t bitmask
= 0;
1210 uint8_t bits_to_shift
= 0;
1211 uint8_t bits_shifted
= 0;
1215 for (uint16_t i
= 0; i
< delay
; i
++) {
1216 bitmask
|= (0x01 << i
);
1218 ToSend
[ToSendMax
++] = 0x00;
1219 for (uint16_t i
= 0; i
< ToSendMax
; i
++) {
1220 bits_to_shift
= ToSend
[i
] & bitmask
;
1221 ToSend
[i
] = ToSend
[i
] >> delay
;
1222 ToSend
[i
] = ToSend
[i
] | (bits_shifted
<< (8 - delay
));
1223 bits_shifted
= bits_to_shift
;
1229 //-------------------------------------------------------------------------------------
1230 // Transmit the command (to the tag) that was placed in ToSend[].
1231 // Parameter timing:
1232 // if NULL: transfer at next possible time, taking into account
1233 // request guard time and frame delay time
1234 // if == 0: transfer immediately and return time of transfer
1235 // if != 0: delay transfer until time specified
1236 //-------------------------------------------------------------------------------------
1237 static void TransmitFor14443a(const uint8_t *cmd
, uint16_t len
, uint32_t *timing
)
1240 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_MOD
);
1242 uint32_t ThisTransferTime
= 0;
1245 if(*timing
== 0) { // Measure time
1246 *timing
= (GetCountSspClk() + 8) & 0xfffffff8;
1248 PrepareDelayedTransfer(*timing
& 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1250 if(MF_DBGLEVEL
>= 4 && GetCountSspClk() >= (*timing
& 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1251 while(GetCountSspClk() < (*timing
& 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1252 LastTimeProxToAirStart
= *timing
;
1254 ThisTransferTime
= ((MAX(NextTransferTime
, GetCountSspClk()) & 0xfffffff8) + 8);
1255 while(GetCountSspClk() < ThisTransferTime
);
1256 LastTimeProxToAirStart
= ThisTransferTime
;
1260 AT91C_BASE_SSC
->SSC_THR
= SEC_Y
;
1264 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1265 AT91C_BASE_SSC
->SSC_THR
= cmd
[c
];
1273 NextTransferTime
= MAX(NextTransferTime
, LastTimeProxToAirStart
+ REQUEST_GUARD_TIME
);
1277 //-----------------------------------------------------------------------------
1278 // Prepare reader command (in bits, support short frames) to send to FPGA
1279 //-----------------------------------------------------------------------------
1280 void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd
, uint16_t bits
, const uint8_t *parity
)
1288 // Start of Communication (Seq. Z)
1289 ToSend
[++ToSendMax
] = SEC_Z
;
1290 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1293 size_t bytecount
= nbytes(bits
);
1294 // Generate send structure for the data bits
1295 for (i
= 0; i
< bytecount
; i
++) {
1296 // Get the current byte to send
1298 size_t bitsleft
= MIN((bits
-(i
*8)),8);
1300 for (j
= 0; j
< bitsleft
; j
++) {
1303 ToSend
[++ToSendMax
] = SEC_X
;
1304 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 2;
1309 ToSend
[++ToSendMax
] = SEC_Z
;
1310 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1313 ToSend
[++ToSendMax
] = SEC_Y
;
1320 // Only transmit parity bit if we transmitted a complete byte
1322 // Get the parity bit
1323 if (parity
[i
>>3] & (0x80 >> (i
&0x0007))) {
1325 ToSend
[++ToSendMax
] = SEC_X
;
1326 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 2;
1331 ToSend
[++ToSendMax
] = SEC_Z
;
1332 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1335 ToSend
[++ToSendMax
] = SEC_Y
;
1342 // End of Communication: Logic 0 followed by Sequence Y
1345 ToSend
[++ToSendMax
] = SEC_Z
;
1346 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1349 ToSend
[++ToSendMax
] = SEC_Y
;
1352 ToSend
[++ToSendMax
] = SEC_Y
;
1354 // Convert to length of command:
1358 //-----------------------------------------------------------------------------
1359 // Prepare reader command to send to FPGA
1360 //-----------------------------------------------------------------------------
1361 void CodeIso14443aAsReaderPar(const uint8_t *cmd
, uint16_t len
, const uint8_t *parity
)
1363 CodeIso14443aBitsAsReaderPar(cmd
, len
*8, parity
);
1366 //-----------------------------------------------------------------------------
1367 // Wait for commands from reader
1368 // Stop when button is pressed (return 1) or field was gone (return 2)
1369 // Or return 0 when command is captured
1370 //-----------------------------------------------------------------------------
1371 static int EmGetCmd(uint8_t *received
, uint16_t *len
, uint8_t *parity
)
1375 uint32_t timer
= 0, vtime
= 0;
1379 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1380 // only, since we are receiving, not transmitting).
1381 // Signal field is off with the appropriate LED
1383 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
1385 // Set ADC to read field strength
1386 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_SWRST
;
1387 AT91C_BASE_ADC
->ADC_MR
=
1388 ADC_MODE_PRESCALE(32) |
1389 ADC_MODE_STARTUP_TIME(16) |
1390 ADC_MODE_SAMPLE_HOLD_TIME(8);
1391 AT91C_BASE_ADC
->ADC_CHER
= ADC_CHANNEL(ADC_CHAN_HF
);
1393 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
;
1395 // Now run a 'software UART' on the stream of incoming samples.
1396 UartInit(received
, parity
);
1399 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1404 if (BUTTON_PRESS()) return 1;
1406 // test if the field exists
1407 if (AT91C_BASE_ADC
->ADC_SR
& ADC_END_OF_CONVERSION(ADC_CHAN_HF
)) {
1409 analogAVG
+= AT91C_BASE_ADC
->ADC_CDR
[ADC_CHAN_HF
];
1410 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
;
1411 if (analogCnt
>= 32) {
1412 if ((33000 * (analogAVG
/ analogCnt
) >> 10) < MF_MINFIELDV
) {
1413 vtime
= GetTickCount();
1414 if (!timer
) timer
= vtime
;
1415 // 50ms no field --> card to idle state
1416 if (vtime
- timer
> 50) return 2;
1418 if (timer
) timer
= 0;
1424 // receive and test the miller decoding
1425 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1426 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1427 if(MillerDecoding(b
, 0)) {
1437 static int EmSendCmd14443aRaw(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
)
1441 uint32_t ThisTransferTime
;
1443 // Modulate Manchester
1444 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_MOD
);
1446 // include correction bit if necessary
1447 if (Uart
.parityBits
& 0x01) {
1448 correctionNeeded
= TRUE
;
1450 if(correctionNeeded
) {
1451 // 1236, so correction bit needed
1457 // clear receiving shift register and holding register
1458 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
1459 b
= AT91C_BASE_SSC
->SSC_RHR
; (void) b
;
1460 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
1461 b
= AT91C_BASE_SSC
->SSC_RHR
; (void) b
;
1463 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1464 for (uint16_t j
= 0; j
< 5; j
++) { // allow timeout - better late than never
1465 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
1466 if (AT91C_BASE_SSC
->SSC_RHR
) break;
1469 while ((ThisTransferTime
= GetCountSspClk()) & 0x00000007);
1472 AT91C_BASE_SSC
->SSC_THR
= SEC_F
;
1475 for(; i
<= respLen
; ) {
1476 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1477 AT91C_BASE_SSC
->SSC_THR
= resp
[i
++];
1478 FpgaSendQueueDelay
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1481 if(BUTTON_PRESS()) {
1486 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1487 for (i
= 0; i
< 2 ; ) {
1488 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1489 AT91C_BASE_SSC
->SSC_THR
= SEC_F
;
1490 FpgaSendQueueDelay
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1495 LastTimeProxToAirStart
= ThisTransferTime
+ (correctionNeeded
?8:0);
1500 int EmSend4bitEx(uint8_t resp
, bool correctionNeeded
){
1501 Code4bitAnswerAsTag(resp
);
1502 int res
= EmSendCmd14443aRaw(ToSend
, ToSendMax
, correctionNeeded
);
1503 // do the tracing for the previous reader request and this tag answer:
1505 GetParity(&resp
, 1, par
);
1506 EmLogTrace(Uart
.output
,
1508 Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1509 Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1513 LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_TAG
,
1514 (LastTimeProxToAirStart
+ LastProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_TAG
,
1519 int EmSend4bit(uint8_t resp
){
1520 return EmSend4bitEx(resp
, false);
1523 int EmSendCmdExPar(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
, uint8_t *par
){
1524 CodeIso14443aAsTagPar(resp
, respLen
, par
);
1525 int res
= EmSendCmd14443aRaw(ToSend
, ToSendMax
, correctionNeeded
);
1526 // do the tracing for the previous reader request and this tag answer:
1527 EmLogTrace(Uart
.output
,
1529 Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1530 Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1534 LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_TAG
,
1535 (LastTimeProxToAirStart
+ LastProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_TAG
,
1540 int EmSendCmdEx(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
){
1541 uint8_t par
[MAX_PARITY_SIZE
];
1542 GetParity(resp
, respLen
, par
);
1543 return EmSendCmdExPar(resp
, respLen
, correctionNeeded
, par
);
1546 int EmSendCmd(uint8_t *resp
, uint16_t respLen
){
1547 uint8_t par
[MAX_PARITY_SIZE
];
1548 GetParity(resp
, respLen
, par
);
1549 return EmSendCmdExPar(resp
, respLen
, false, par
);
1552 int EmSendCmdPar(uint8_t *resp
, uint16_t respLen
, uint8_t *par
){
1553 return EmSendCmdExPar(resp
, respLen
, false, par
);
1556 bool EmLogTrace(uint8_t *reader_data
, uint16_t reader_len
, uint32_t reader_StartTime
, uint32_t reader_EndTime
, uint8_t *reader_Parity
,
1557 uint8_t *tag_data
, uint16_t tag_len
, uint32_t tag_StartTime
, uint32_t tag_EndTime
, uint8_t *tag_Parity
)
1560 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1561 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1562 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1563 uint16_t reader_modlen
= reader_EndTime
- reader_StartTime
;
1564 uint16_t approx_fdt
= tag_StartTime
- reader_EndTime
;
1565 uint16_t exact_fdt
= (approx_fdt
- 20 + 32)/64 * 64 + 20;
1566 reader_EndTime
= tag_StartTime
- exact_fdt
;
1567 reader_StartTime
= reader_EndTime
- reader_modlen
;
1568 if (!LogTrace(reader_data
, reader_len
, reader_StartTime
, reader_EndTime
, reader_Parity
, TRUE
)) {
1570 } else return(!LogTrace(tag_data
, tag_len
, tag_StartTime
, tag_EndTime
, tag_Parity
, FALSE
));
1576 //-----------------------------------------------------------------------------
1577 // Wait a certain time for tag response
1578 // If a response is captured return TRUE
1579 // If it takes too long return FALSE
1580 //-----------------------------------------------------------------------------
1581 static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse
, uint8_t *receivedResponsePar
, uint16_t offset
)
1585 // Set FPGA mode to "reader listen mode", no modulation (listen
1586 // only, since we are receiving, not transmitting).
1587 // Signal field is on with the appropriate LED
1589 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_LISTEN
);
1591 // Now get the answer from the card
1592 DemodInit(receivedResponse
, receivedResponsePar
);
1595 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1601 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1602 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1603 if(ManchesterDecoding(b
, offset
, 0)) {
1604 NextTransferTime
= MAX(NextTransferTime
, Demod
.endTime
- (DELAY_AIR2ARM_AS_READER
+ DELAY_ARM2AIR_AS_READER
)/16 + FRAME_DELAY_TIME_PICC_TO_PCD
);
1606 } else if (c
++ > iso14a_timeout
) {
1613 void ReaderTransmitBitsPar(uint8_t* frame
, uint16_t bits
, uint8_t *par
, uint32_t *timing
)
1615 CodeIso14443aBitsAsReaderPar(frame
, bits
, par
);
1617 // Send command to tag
1618 TransmitFor14443a(ToSend
, ToSendMax
, timing
);
1622 // Log reader command in trace buffer
1624 LogTrace(frame
, nbytes(bits
), LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_READER
, (LastTimeProxToAirStart
+ LastProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_READER
, par
, TRUE
);
1628 void ReaderTransmitPar(uint8_t* frame
, uint16_t len
, uint8_t *par
, uint32_t *timing
)
1630 ReaderTransmitBitsPar(frame
, len
*8, par
, timing
);
1633 void ReaderTransmitBits(uint8_t* frame
, uint16_t len
, uint32_t *timing
)
1635 // Generate parity and redirect
1636 uint8_t par
[MAX_PARITY_SIZE
];
1637 GetParity(frame
, len
/8, par
);
1638 ReaderTransmitBitsPar(frame
, len
, par
, timing
);
1641 void ReaderTransmit(uint8_t* frame
, uint16_t len
, uint32_t *timing
)
1643 // Generate parity and redirect
1644 uint8_t par
[MAX_PARITY_SIZE
];
1645 GetParity(frame
, len
, par
);
1646 ReaderTransmitBitsPar(frame
, len
*8, par
, timing
);
1649 int ReaderReceiveOffset(uint8_t* receivedAnswer
, uint16_t offset
, uint8_t *parity
)
1651 if (!GetIso14443aAnswerFromTag(receivedAnswer
, parity
, offset
)) return FALSE
;
1653 LogTrace(receivedAnswer
, Demod
.len
, Demod
.startTime
*16 - DELAY_AIR2ARM_AS_READER
, Demod
.endTime
*16 - DELAY_AIR2ARM_AS_READER
, parity
, FALSE
);
1658 int ReaderReceive(uint8_t *receivedAnswer
, uint8_t *parity
)
1660 if (!GetIso14443aAnswerFromTag(receivedAnswer
, parity
, 0)) return FALSE
;
1662 LogTrace(receivedAnswer
, Demod
.len
, Demod
.startTime
*16 - DELAY_AIR2ARM_AS_READER
, Demod
.endTime
*16 - DELAY_AIR2ARM_AS_READER
, parity
, FALSE
);
1667 /* performs iso14443a anticollision procedure
1668 * fills the uid pointer unless NULL
1669 * fills resp_data unless NULL */
1670 int iso14443a_select_card(byte_t
*uid_ptr
, iso14a_card_select_t
*p_hi14a_card
, uint32_t *cuid_ptr
) {
1671 uint8_t wupa
[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1672 uint8_t sel_all
[] = { 0x93,0x20 };
1673 uint8_t sel_uid
[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1674 uint8_t rats
[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1675 uint8_t *resp
= ((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
;
1676 uint8_t *resp_par
= ((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
;
1678 size_t uid_resp_len
;
1680 uint8_t sak
= 0x04; // cascade uid
1681 int cascade_level
= 0;
1684 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1685 ReaderTransmitBitsPar(wupa
,7,0, NULL
);
1688 if(!ReaderReceive(resp
, resp_par
)) return 0;
1691 memcpy(p_hi14a_card
->atqa
, resp
, 2);
1692 p_hi14a_card
->uidlen
= 0;
1693 memset(p_hi14a_card
->uid
,0,10);
1698 memset(uid_ptr
,0,10);
1701 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1702 // which case we need to make a cascade 2 request and select - this is a long UID
1703 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1704 for(; sak
& 0x04; cascade_level
++) {
1705 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1706 sel_uid
[0] = sel_all
[0] = 0x93 + cascade_level
* 2;
1709 ReaderTransmit(sel_all
, sizeof(sel_all
), NULL
);
1710 if (!ReaderReceive(resp
, resp_par
)) return 0;
1712 if (Demod
.collisionPos
) { // we had a collision and need to construct the UID bit by bit
1713 memset(uid_resp
, 0, 4);
1714 uint16_t uid_resp_bits
= 0;
1715 uint16_t collision_answer_offset
= 0;
1716 // anti-collision-loop:
1717 while (Demod
.collisionPos
) {
1718 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod
.collisionPos
);
1719 for (uint16_t i
= collision_answer_offset
; i
< Demod
.collisionPos
; i
++, uid_resp_bits
++) { // add valid UID bits before collision point
1720 uint16_t UIDbit
= (resp
[i
/8] >> (i
% 8)) & 0x01;
1721 uid_resp
[uid_resp_bits
/ 8] |= UIDbit
<< (uid_resp_bits
% 8);
1723 uid_resp
[uid_resp_bits
/8] |= 1 << (uid_resp_bits
% 8); // next time select the card(s) with a 1 in the collision position
1725 // construct anticollosion command:
1726 sel_uid
[1] = ((2 + uid_resp_bits
/8) << 4) | (uid_resp_bits
& 0x07); // length of data in bytes and bits
1727 for (uint16_t i
= 0; i
<= uid_resp_bits
/8; i
++) {
1728 sel_uid
[2+i
] = uid_resp
[i
];
1730 collision_answer_offset
= uid_resp_bits
%8;
1731 ReaderTransmitBits(sel_uid
, 16 + uid_resp_bits
, NULL
);
1732 if (!ReaderReceiveOffset(resp
, collision_answer_offset
, resp_par
)) return 0;
1734 // finally, add the last bits and BCC of the UID
1735 for (uint16_t i
= collision_answer_offset
; i
< (Demod
.len
-1)*8; i
++, uid_resp_bits
++) {
1736 uint16_t UIDbit
= (resp
[i
/8] >> (i
%8)) & 0x01;
1737 uid_resp
[uid_resp_bits
/8] |= UIDbit
<< (uid_resp_bits
% 8);
1740 } else { // no collision, use the response to SELECT_ALL as current uid
1741 memcpy(uid_resp
, resp
, 4);
1745 // calculate crypto UID. Always use last 4 Bytes.
1747 *cuid_ptr
= bytes_to_num(uid_resp
, 4);
1750 // Construct SELECT UID command
1751 sel_uid
[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1752 memcpy(sel_uid
+2, uid_resp
, 4); // the UID
1753 sel_uid
[6] = sel_uid
[2] ^ sel_uid
[3] ^ sel_uid
[4] ^ sel_uid
[5]; // calculate and add BCC
1754 AppendCrc14443a(sel_uid
, 7); // calculate and add CRC
1755 ReaderTransmit(sel_uid
, sizeof(sel_uid
), NULL
);
1758 if (!ReaderReceive(resp
, resp_par
)) return 0;
1761 // Test if more parts of the uid are coming
1762 if ((sak
& 0x04) /* && uid_resp[0] == 0x88 */) {
1763 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1764 // http://www.nxp.com/documents/application_note/AN10927.pdf
1765 uid_resp
[0] = uid_resp
[1];
1766 uid_resp
[1] = uid_resp
[2];
1767 uid_resp
[2] = uid_resp
[3];
1773 memcpy(uid_ptr
+ (cascade_level
*3), uid_resp
, uid_resp_len
);
1777 memcpy(p_hi14a_card
->uid
+ (cascade_level
*3), uid_resp
, uid_resp_len
);
1778 p_hi14a_card
->uidlen
+= uid_resp_len
;
1783 p_hi14a_card
->sak
= sak
;
1784 p_hi14a_card
->ats_len
= 0;
1787 // non iso14443a compliant tag
1788 if( (sak
& 0x20) == 0) return 2;
1790 // Request for answer to select
1791 AppendCrc14443a(rats
, 2);
1792 ReaderTransmit(rats
, sizeof(rats
), NULL
);
1794 if (!(len
= ReaderReceive(resp
, resp_par
))) return 0;
1798 memcpy(p_hi14a_card
->ats
, resp
, sizeof(p_hi14a_card
->ats
));
1799 p_hi14a_card
->ats_len
= len
;
1802 // reset the PCB block number
1803 iso14_pcb_blocknum
= 0;
1807 void iso14443a_setup(uint8_t fpga_minor_mode
) {
1808 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1809 // Set up the synchronous serial port
1811 // connect Demodulated Signal to ADC:
1812 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1814 // Signal field is on with the appropriate LED
1815 if (fpga_minor_mode
== FPGA_HF_ISO14443A_READER_MOD
1816 || fpga_minor_mode
== FPGA_HF_ISO14443A_READER_LISTEN
) {
1821 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| fpga_minor_mode
);
1828 NextTransferTime
= 2*DELAY_ARM2AIR_AS_READER
;
1829 iso14a_set_timeout(1050); // 10ms default
1832 int iso14_apdu(uint8_t *cmd
, uint16_t cmd_len
, void *data
) {
1833 uint8_t parity
[MAX_PARITY_SIZE
];
1834 uint8_t real_cmd
[cmd_len
+4];
1835 real_cmd
[0] = 0x0a; //I-Block
1836 // put block number into the PCB
1837 real_cmd
[0] |= iso14_pcb_blocknum
;
1838 real_cmd
[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
1839 memcpy(real_cmd
+2, cmd
, cmd_len
);
1840 AppendCrc14443a(real_cmd
,cmd_len
+2);
1842 ReaderTransmit(real_cmd
, cmd_len
+4, NULL
);
1843 size_t len
= ReaderReceive(data
, parity
);
1844 uint8_t *data_bytes
= (uint8_t *) data
;
1846 return 0; //DATA LINK ERROR
1847 // if we received an I- or R(ACK)-Block with a block number equal to the
1848 // current block number, toggle the current block number
1849 else if (len
>= 4 // PCB+CID+CRC = 4 bytes
1850 && ((data_bytes
[0] & 0xC0) == 0 // I-Block
1851 || (data_bytes
[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1852 && (data_bytes
[0] & 0x01) == iso14_pcb_blocknum
) // equal block numbers
1854 iso14_pcb_blocknum
^= 1;
1860 //-----------------------------------------------------------------------------
1861 // Read an ISO 14443a tag. Send out commands and store answers.
1863 //-----------------------------------------------------------------------------
1864 void ReaderIso14443a(UsbCommand
*c
)
1866 iso14a_command_t param
= c
->arg
[0];
1867 uint8_t *cmd
= c
->d
.asBytes
;
1868 size_t len
= c
->arg
[1];
1869 size_t lenbits
= c
->arg
[2];
1871 byte_t buf
[USB_CMD_DATA_SIZE
];
1872 uint8_t par
[MAX_PARITY_SIZE
];
1874 if(param
& ISO14A_CONNECT
) {
1875 iso14a_clear_trace();
1878 iso14a_set_tracing(TRUE
);
1880 if(param
& ISO14A_REQUEST_TRIGGER
) {
1881 iso14a_set_trigger(TRUE
);
1884 if(param
& ISO14A_CONNECT
) {
1885 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1886 if(!(param
& ISO14A_NO_SELECT
)) {
1887 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)buf
;
1888 arg0
= iso14443a_select_card(NULL
,card
,NULL
);
1889 cmd_send(CMD_ACK
,arg0
,card
->uidlen
,0,buf
,sizeof(iso14a_card_select_t
));
1893 if(param
& ISO14A_SET_TIMEOUT
) {
1894 iso14a_set_timeout(c
->arg
[2]);
1897 if(param
& ISO14A_APDU
) {
1898 arg0
= iso14_apdu(cmd
, len
, buf
);
1899 cmd_send(CMD_ACK
,arg0
,0,0,buf
,sizeof(buf
));
1902 if(param
& ISO14A_RAW
) {
1903 if(param
& ISO14A_APPEND_CRC
) {
1904 AppendCrc14443a(cmd
,len
);
1906 if (lenbits
) lenbits
+= 16;
1909 GetParity(cmd
, lenbits
/8, par
);
1910 ReaderTransmitBitsPar(cmd
, lenbits
, par
, NULL
);
1912 ReaderTransmit(cmd
,len
, NULL
);
1914 arg0
= ReaderReceive(buf
, par
);
1915 cmd_send(CMD_ACK
,arg0
,0,0,buf
,sizeof(buf
));
1918 if(param
& ISO14A_REQUEST_TRIGGER
) {
1919 iso14a_set_trigger(FALSE
);
1922 if(param
& ISO14A_NO_DISCONNECT
) {
1926 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1931 // Determine the distance between two nonces.
1932 // Assume that the difference is small, but we don't know which is first.
1933 // Therefore try in alternating directions.
1934 int32_t dist_nt(uint32_t nt1
, uint32_t nt2
) {
1937 uint32_t nttmp1
, nttmp2
;
1939 if (nt1
== nt2
) return 0;
1944 for (i
= 1; i
< 32768; i
++) {
1945 nttmp1
= prng_successor(nttmp1
, 1);
1946 if (nttmp1
== nt2
) return i
;
1947 nttmp2
= prng_successor(nttmp2
, 1);
1948 if (nttmp2
== nt1
) return -i
;
1951 return(-99999); // either nt1 or nt2 are invalid nonces
1955 //-----------------------------------------------------------------------------
1956 // Recover several bits of the cypher stream. This implements (first stages of)
1957 // the algorithm described in "The Dark Side of Security by Obscurity and
1958 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
1959 // (article by Nicolas T. Courtois, 2009)
1960 //-----------------------------------------------------------------------------
1961 void ReaderMifare(bool first_try
)
1964 uint8_t mf_auth
[] = { 0x60,0x00,0xf5,0x7b };
1965 uint8_t mf_nr_ar
[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
1966 static uint8_t mf_nr_ar3
;
1968 uint8_t* receivedAnswer
= (((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
);
1969 uint8_t* receivedAnswerPar
= (((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
);
1971 iso14a_clear_trace();
1972 iso14a_set_tracing(TRUE
);
1975 uint8_t par
[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
1976 static byte_t par_low
= 0;
1978 uint8_t uid
[10] ={0};
1982 uint32_t previous_nt
= 0;
1983 static uint32_t nt_attacked
= 0;
1984 byte_t par_list
[8] = {0x00};
1985 byte_t ks_list
[8] = {0x00};
1987 static uint32_t sync_time
;
1988 static uint32_t sync_cycles
;
1989 int catch_up_cycles
= 0;
1990 int last_catch_up
= 0;
1991 uint16_t consecutive_resyncs
= 0;
1996 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD
);
1997 sync_time
= GetCountSspClk() & 0xfffffff8;
1998 sync_cycles
= 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
2004 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
2006 mf_nr_ar
[3] = mf_nr_ar3
;
2015 for(uint16_t i
= 0; TRUE
; i
++) {
2019 // Test if the action was cancelled
2020 if(BUTTON_PRESS()) {
2026 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
2027 if (MF_DBGLEVEL
>= 1) Dbprintf("Mifare: Can't select card");
2031 sync_time
= (sync_time
& 0xfffffff8) + sync_cycles
+ catch_up_cycles
;
2032 catch_up_cycles
= 0;
2034 // if we missed the sync time already, advance to the next nonce repeat
2035 while(GetCountSspClk() > sync_time
) {
2036 sync_time
= (sync_time
& 0xfffffff8) + sync_cycles
;
2039 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2040 ReaderTransmit(mf_auth
, sizeof(mf_auth
), &sync_time
);
2042 // Receive the (4 Byte) "random" nonce
2043 if (!ReaderReceive(receivedAnswer
, receivedAnswerPar
)) {
2044 if (MF_DBGLEVEL
>= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2049 nt
= bytes_to_num(receivedAnswer
, 4);
2051 // Transmit reader nonce with fake par
2052 ReaderTransmitPar(mf_nr_ar
, sizeof(mf_nr_ar
), par
, NULL
);
2054 if (first_try
&& previous_nt
&& !nt_attacked
) { // we didn't calibrate our clock yet
2055 int nt_distance
= dist_nt(previous_nt
, nt
);
2056 if (nt_distance
== 0) {
2060 if (nt_distance
== -99999) { // invalid nonce received, try again
2063 sync_cycles
= (sync_cycles
- nt_distance
);
2064 if (MF_DBGLEVEL
>= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i
, nt_distance
, sync_cycles
);
2069 if ((nt
!= nt_attacked
) && nt_attacked
) { // we somehow lost sync. Try to catch up again...
2070 catch_up_cycles
= -dist_nt(nt_attacked
, nt
);
2071 if (catch_up_cycles
== 99999) { // invalid nonce received. Don't resync on that one.
2072 catch_up_cycles
= 0;
2075 if (catch_up_cycles
== last_catch_up
) {
2076 consecutive_resyncs
++;
2079 last_catch_up
= catch_up_cycles
;
2080 consecutive_resyncs
= 0;
2082 if (consecutive_resyncs
< 3) {
2083 if (MF_DBGLEVEL
>= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i
, -catch_up_cycles
, consecutive_resyncs
);
2086 sync_cycles
= sync_cycles
+ catch_up_cycles
;
2087 if (MF_DBGLEVEL
>= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i
, -catch_up_cycles
, sync_cycles
);
2092 consecutive_resyncs
= 0;
2094 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2095 if (ReaderReceive(receivedAnswer
, receivedAnswerPar
))
2097 catch_up_cycles
= 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2101 par_low
= par
[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2105 if(led_on
) LED_B_ON(); else LED_B_OFF();
2107 par_list
[nt_diff
] = SwapBits(par
[0], 8);
2108 ks_list
[nt_diff
] = receivedAnswer
[0] ^ 0x05;
2110 // Test if the information is complete
2111 if (nt_diff
== 0x07) {
2116 nt_diff
= (nt_diff
+ 1) & 0x07;
2117 mf_nr_ar
[3] = (mf_nr_ar
[3] & 0x1F) | (nt_diff
<< 5);
2120 if (nt_diff
== 0 && first_try
)
2124 par
[0] = ((par
[0] & 0x1F) + 1) | par_low
;
2130 mf_nr_ar
[3] &= 0x1F;
2133 memcpy(buf
+ 0, uid
, 4);
2134 num_to_bytes(nt
, 4, buf
+ 4);
2135 memcpy(buf
+ 8, par_list
, 8);
2136 memcpy(buf
+ 16, ks_list
, 8);
2137 memcpy(buf
+ 24, mf_nr_ar
, 4);
2139 cmd_send(CMD_ACK
,isOK
,0,0,buf
,28);
2142 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
2145 iso14a_set_tracing(FALSE
);
2149 *MIFARE 1K simulate.
2152 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2153 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2154 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2155 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2156 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2158 void Mifare1ksim(uint8_t flags
, uint8_t exitAfterNReads
, uint8_t arg2
, uint8_t *datain
)
2160 int cardSTATE
= MFEMUL_NOFIELD
;
2162 int vHf
= 0; // in mV
2164 uint32_t selTimer
= 0;
2165 uint32_t authTimer
= 0;
2167 uint8_t cardWRBL
= 0;
2168 uint8_t cardAUTHSC
= 0;
2169 uint8_t cardAUTHKEY
= 0xff; // no authentication
2170 uint32_t cardRr
= 0;
2172 //uint32_t rn_enc = 0;
2174 uint32_t cardINTREG
= 0;
2175 uint8_t cardINTBLOCK
= 0;
2176 struct Crypto1State mpcs
= {0, 0};
2177 struct Crypto1State
*pcs
;
2179 uint32_t numReads
= 0;//Counts numer of times reader read a block
2180 uint8_t* receivedCmd
= get_bigbufptr_recvcmdbuf();
2181 uint8_t* receivedCmd_par
= receivedCmd
+ MAX_FRAME_SIZE
;
2182 uint8_t* response
= get_bigbufptr_recvrespbuf();
2183 uint8_t* response_par
= response
+ MAX_FRAME_SIZE
;
2185 uint8_t rATQA
[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2186 uint8_t rUIDBCC1
[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2187 uint8_t rUIDBCC2
[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2188 uint8_t rSAK
[] = {0x08, 0xb6, 0xdd};
2189 uint8_t rSAK1
[] = {0x04, 0xda, 0x17};
2191 uint8_t rAUTH_NT
[] = {0x01, 0x02, 0x03, 0x04};
2192 uint8_t rAUTH_AT
[] = {0x00, 0x00, 0x00, 0x00};
2194 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2195 // This can be used in a reader-only attack.
2196 // (it can also be retrieved via 'hf 14a list', but hey...
2197 uint32_t ar_nr_responses
[] = {0,0,0,0,0,0,0,0};
2198 uint8_t ar_nr_collected
= 0;
2201 iso14a_clear_trace();
2202 iso14a_set_tracing(TRUE
);
2204 // Authenticate response - nonce
2205 uint32_t nonce
= bytes_to_num(rAUTH_NT
, 4);
2207 //-- Determine the UID
2208 // Can be set from emulator memory, incoming data
2209 // and can be 7 or 4 bytes long
2210 if (flags
& FLAG_4B_UID_IN_DATA
)
2212 // 4B uid comes from data-portion of packet
2213 memcpy(rUIDBCC1
,datain
,4);
2214 rUIDBCC1
[4] = rUIDBCC1
[0] ^ rUIDBCC1
[1] ^ rUIDBCC1
[2] ^ rUIDBCC1
[3];
2216 } else if (flags
& FLAG_7B_UID_IN_DATA
) {
2217 // 7B uid comes from data-portion of packet
2218 memcpy(&rUIDBCC1
[1],datain
,3);
2219 memcpy(rUIDBCC2
, datain
+3, 4);
2222 // get UID from emul memory
2223 emlGetMemBt(receivedCmd
, 7, 1);
2224 _7BUID
= !(receivedCmd
[0] == 0x00);
2225 if (!_7BUID
) { // ---------- 4BUID
2226 emlGetMemBt(rUIDBCC1
, 0, 4);
2227 } else { // ---------- 7BUID
2228 emlGetMemBt(&rUIDBCC1
[1], 0, 3);
2229 emlGetMemBt(rUIDBCC2
, 3, 4);
2234 * Regardless of what method was used to set the UID, set fifth byte and modify
2235 * the ATQA for 4 or 7-byte UID
2237 rUIDBCC1
[4] = rUIDBCC1
[0] ^ rUIDBCC1
[1] ^ rUIDBCC1
[2] ^ rUIDBCC1
[3];
2241 rUIDBCC2
[4] = rUIDBCC2
[0] ^ rUIDBCC2
[1] ^ rUIDBCC2
[2] ^ rUIDBCC2
[3];
2244 // We need to listen to the high-frequency, peak-detected path.
2245 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
2248 if (MF_DBGLEVEL
>= 1) {
2250 Dbprintf("4B UID: %02x%02x%02x%02x",
2251 rUIDBCC1
[0], rUIDBCC1
[1], rUIDBCC1
[2], rUIDBCC1
[3]);
2253 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2254 rUIDBCC1
[0], rUIDBCC1
[1], rUIDBCC1
[2], rUIDBCC1
[3],
2255 rUIDBCC2
[0], rUIDBCC2
[1] ,rUIDBCC2
[2], rUIDBCC2
[3]);
2259 bool finished
= FALSE
;
2260 while (!BUTTON_PRESS() && !finished
) {
2263 // find reader field
2264 // Vref = 3300mV, and an 10:1 voltage divider on the input
2265 // can measure voltages up to 33000 mV
2266 if (cardSTATE
== MFEMUL_NOFIELD
) {
2267 vHf
= (33000 * AvgAdc(ADC_CHAN_HF
)) >> 10;
2268 if (vHf
> MF_MINFIELDV
) {
2269 cardSTATE_TO_IDLE();
2273 if(cardSTATE
== MFEMUL_NOFIELD
) continue;
2277 res
= EmGetCmd(receivedCmd
, &len
, receivedCmd_par
);
2278 if (res
== 2) { //Field is off!
2279 cardSTATE
= MFEMUL_NOFIELD
;
2282 } else if (res
== 1) {
2283 break; //return value 1 means button press
2286 // REQ or WUP request in ANY state and WUP in HALTED state
2287 if (len
== 1 && ((receivedCmd
[0] == 0x26 && cardSTATE
!= MFEMUL_HALTED
) || receivedCmd
[0] == 0x52)) {
2288 selTimer
= GetTickCount();
2289 EmSendCmdEx(rATQA
, sizeof(rATQA
), (receivedCmd
[0] == 0x52));
2290 cardSTATE
= MFEMUL_SELECT1
;
2292 // init crypto block
2295 crypto1_destroy(pcs
);
2300 switch (cardSTATE
) {
2301 case MFEMUL_NOFIELD
:
2304 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2307 case MFEMUL_SELECT1
:{
2309 if (len
== 2 && (receivedCmd
[0] == 0x93 && receivedCmd
[1] == 0x20)) {
2310 if (MF_DBGLEVEL
>= 4) Dbprintf("SELECT ALL received");
2311 EmSendCmd(rUIDBCC1
, sizeof(rUIDBCC1
));
2315 if (MF_DBGLEVEL
>= 4 && len
== 9 && receivedCmd
[0] == 0x93 && receivedCmd
[1] == 0x70 )
2317 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd
[2],receivedCmd
[3],receivedCmd
[4],receivedCmd
[5]);
2321 (receivedCmd
[0] == 0x93 && receivedCmd
[1] == 0x70 && memcmp(&receivedCmd
[2], rUIDBCC1
, 4) == 0)) {
2322 EmSendCmd(_7BUID
?rSAK1
:rSAK
, _7BUID
?sizeof(rSAK1
):sizeof(rSAK
));
2323 cuid
= bytes_to_num(rUIDBCC1
, 4);
2325 cardSTATE
= MFEMUL_WORK
;
2327 if (MF_DBGLEVEL
>= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer
);
2330 cardSTATE
= MFEMUL_SELECT2
;
2338 cardSTATE_TO_IDLE();
2339 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2342 uint32_t ar
= bytes_to_num(receivedCmd
, 4);
2343 uint32_t nr
= bytes_to_num(&receivedCmd
[4], 4);
2346 if(ar_nr_collected
< 2){
2347 if(ar_nr_responses
[2] != ar
)
2348 {// Avoid duplicates... probably not necessary, ar should vary.
2349 ar_nr_responses
[ar_nr_collected
*4] = cuid
;
2350 ar_nr_responses
[ar_nr_collected
*4+1] = nonce
;
2351 ar_nr_responses
[ar_nr_collected
*4+2] = ar
;
2352 ar_nr_responses
[ar_nr_collected
*4+3] = nr
;
2358 crypto1_word(pcs
, ar
, 1);
2359 cardRr
= nr
^ crypto1_word(pcs
, 0, 0);
2362 if (cardRr
!= prng_successor(nonce
, 64)){
2363 if (MF_DBGLEVEL
>= 2) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2364 cardAUTHSC
, cardAUTHKEY
== 0 ? 'A' : 'B',
2365 cardRr
, prng_successor(nonce
, 64));
2366 // Shouldn't we respond anything here?
2367 // Right now, we don't nack or anything, which causes the
2368 // reader to do a WUPA after a while. /Martin
2369 // -- which is the correct response. /piwi
2370 cardSTATE_TO_IDLE();
2371 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2375 ans
= prng_successor(nonce
, 96) ^ crypto1_word(pcs
, 0, 0);
2377 num_to_bytes(ans
, 4, rAUTH_AT
);
2379 EmSendCmd(rAUTH_AT
, sizeof(rAUTH_AT
));
2381 cardSTATE
= MFEMUL_WORK
;
2382 if (MF_DBGLEVEL
>= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2383 cardAUTHSC
, cardAUTHKEY
== 0 ? 'A' : 'B',
2384 GetTickCount() - authTimer
);
2387 case MFEMUL_SELECT2
:{
2389 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2392 if (len
== 2 && (receivedCmd
[0] == 0x95 && receivedCmd
[1] == 0x20)) {
2393 EmSendCmd(rUIDBCC2
, sizeof(rUIDBCC2
));
2399 (receivedCmd
[0] == 0x95 && receivedCmd
[1] == 0x70 && memcmp(&receivedCmd
[2], rUIDBCC2
, 4) == 0)) {
2400 EmSendCmd(rSAK
, sizeof(rSAK
));
2401 cuid
= bytes_to_num(rUIDBCC2
, 4);
2402 cardSTATE
= MFEMUL_WORK
;
2404 if (MF_DBGLEVEL
>= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer
);
2408 // i guess there is a command). go into the work state.
2410 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2413 cardSTATE
= MFEMUL_WORK
;
2415 //intentional fall-through to the next case-stmt
2420 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2424 bool encrypted_data
= (cardAUTHKEY
!= 0xFF) ;
2426 if(encrypted_data
) {
2428 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2431 if (len
== 4 && (receivedCmd
[0] == 0x60 || receivedCmd
[0] == 0x61)) {
2432 authTimer
= GetTickCount();
2433 cardAUTHSC
= receivedCmd
[1] / 4; // received block num
2434 cardAUTHKEY
= receivedCmd
[0] - 0x60;
2435 crypto1_destroy(pcs
);//Added by martin
2436 crypto1_create(pcs
, emlGetKey(cardAUTHSC
, cardAUTHKEY
));
2438 if (!encrypted_data
) { // first authentication
2439 if (MF_DBGLEVEL
>= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd
[1] ,receivedCmd
[1],cardAUTHKEY
);
2441 crypto1_word(pcs
, cuid
^ nonce
, 0);//Update crypto state
2442 num_to_bytes(nonce
, 4, rAUTH_AT
); // Send nonce
2443 } else { // nested authentication
2444 if (MF_DBGLEVEL
>= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd
[1] ,receivedCmd
[1],cardAUTHKEY
);
2445 ans
= nonce
^ crypto1_word(pcs
, cuid
^ nonce
, 0);
2446 num_to_bytes(ans
, 4, rAUTH_AT
);
2448 EmSendCmd(rAUTH_AT
, sizeof(rAUTH_AT
));
2449 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2450 cardSTATE
= MFEMUL_AUTH1
;
2454 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2455 // BUT... ACK --> NACK
2456 if (len
== 1 && receivedCmd
[0] == CARD_ACK
) {
2457 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2461 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2462 if (len
== 1 && receivedCmd
[0] == CARD_NACK_NA
) {
2463 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2468 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2472 if(receivedCmd
[0] == 0x30 // read block
2473 || receivedCmd
[0] == 0xA0 // write block
2474 || receivedCmd
[0] == 0xC0 // inc
2475 || receivedCmd
[0] == 0xC1 // dec
2476 || receivedCmd
[0] == 0xC2 // restore
2477 || receivedCmd
[0] == 0xB0) { // transfer
2478 if (receivedCmd
[1] >= 16 * 4) {
2479 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2480 if (MF_DBGLEVEL
>= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd
[0],receivedCmd
[1],receivedCmd
[1]);
2484 if (receivedCmd
[1] / 4 != cardAUTHSC
) {
2485 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2486 if (MF_DBGLEVEL
>= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd
[0],receivedCmd
[1],cardAUTHSC
);
2491 if (receivedCmd
[0] == 0x30) {
2492 if (MF_DBGLEVEL
>= 4) {
2493 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd
[1],receivedCmd
[1]);
2495 emlGetMem(response
, receivedCmd
[1], 1);
2496 AppendCrc14443a(response
, 16);
2497 mf_crypto1_encrypt(pcs
, response
, 18, response_par
);
2498 EmSendCmdPar(response
, 18, response_par
);
2500 if(exitAfterNReads
> 0 && numReads
== exitAfterNReads
) {
2501 Dbprintf("%d reads done, exiting", numReads
);
2507 if (receivedCmd
[0] == 0xA0) {
2508 if (MF_DBGLEVEL
>= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd
[1],receivedCmd
[1]);
2509 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2510 cardSTATE
= MFEMUL_WRITEBL2
;
2511 cardWRBL
= receivedCmd
[1];
2514 // increment, decrement, restore
2515 if (receivedCmd
[0] == 0xC0 || receivedCmd
[0] == 0xC1 || receivedCmd
[0] == 0xC2) {
2516 if (MF_DBGLEVEL
>= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd
[0],receivedCmd
[1],receivedCmd
[1]);
2517 if (emlCheckValBl(receivedCmd
[1])) {
2518 if (MF_DBGLEVEL
>= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
2519 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2522 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2523 if (receivedCmd
[0] == 0xC1)
2524 cardSTATE
= MFEMUL_INTREG_INC
;
2525 if (receivedCmd
[0] == 0xC0)
2526 cardSTATE
= MFEMUL_INTREG_DEC
;
2527 if (receivedCmd
[0] == 0xC2)
2528 cardSTATE
= MFEMUL_INTREG_REST
;
2529 cardWRBL
= receivedCmd
[1];
2533 if (receivedCmd
[0] == 0xB0) {
2534 if (MF_DBGLEVEL
>= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd
[0],receivedCmd
[1],receivedCmd
[1]);
2535 if (emlSetValBl(cardINTREG
, cardINTBLOCK
, receivedCmd
[1]))
2536 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2538 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2542 if (receivedCmd
[0] == 0x50 && receivedCmd
[1] == 0x00) {
2545 cardSTATE
= MFEMUL_HALTED
;
2546 if (MF_DBGLEVEL
>= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer
);
2547 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2551 if (receivedCmd
[0] == 0xe0) {//RATS
2552 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2555 // command not allowed
2556 if (MF_DBGLEVEL
>= 4) Dbprintf("Received command not allowed, nacking");
2557 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2560 case MFEMUL_WRITEBL2
:{
2562 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2563 emlSetMem(receivedCmd
, cardWRBL
, 1);
2564 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2565 cardSTATE
= MFEMUL_WORK
;
2567 cardSTATE_TO_IDLE();
2568 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2573 case MFEMUL_INTREG_INC
:{
2574 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2575 memcpy(&ans
, receivedCmd
, 4);
2576 if (emlGetValBl(&cardINTREG
, &cardINTBLOCK
, cardWRBL
)) {
2577 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2578 cardSTATE_TO_IDLE();
2581 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2582 cardINTREG
= cardINTREG
+ ans
;
2583 cardSTATE
= MFEMUL_WORK
;
2586 case MFEMUL_INTREG_DEC
:{
2587 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2588 memcpy(&ans
, receivedCmd
, 4);
2589 if (emlGetValBl(&cardINTREG
, &cardINTBLOCK
, cardWRBL
)) {
2590 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2591 cardSTATE_TO_IDLE();
2594 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2595 cardINTREG
= cardINTREG
- ans
;
2596 cardSTATE
= MFEMUL_WORK
;
2599 case MFEMUL_INTREG_REST
:{
2600 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2601 memcpy(&ans
, receivedCmd
, 4);
2602 if (emlGetValBl(&cardINTREG
, &cardINTBLOCK
, cardWRBL
)) {
2603 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2604 cardSTATE_TO_IDLE();
2607 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2608 cardSTATE
= MFEMUL_WORK
;
2614 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
2617 if(flags
& FLAG_INTERACTIVE
)// Interactive mode flag, means we need to send ACK
2619 //May just aswell send the collected ar_nr in the response aswell
2620 cmd_send(CMD_ACK
,CMD_SIMULATE_MIFARE_CARD
,0,0,&ar_nr_responses
,ar_nr_collected
*4*4);
2623 if(flags
& FLAG_NR_AR_ATTACK
)
2625 if(ar_nr_collected
> 1) {
2626 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
2627 Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
2628 ar_nr_responses
[0], // UID
2629 ar_nr_responses
[1], //NT
2630 ar_nr_responses
[2], //AR1
2631 ar_nr_responses
[3], //NR1
2632 ar_nr_responses
[6], //AR2
2633 ar_nr_responses
[7] //NR2
2636 Dbprintf("Failed to obtain two AR/NR pairs!");
2637 if(ar_nr_collected
>0) {
2638 Dbprintf("Only got these: UID=%08x, nonce=%08x, AR1=%08x, NR1=%08x",
2639 ar_nr_responses
[0], // UID
2640 ar_nr_responses
[1], //NT
2641 ar_nr_responses
[2], //AR1
2642 ar_nr_responses
[3] //NR1
2647 if (MF_DBGLEVEL
>= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing
, traceLen
);
2652 //-----------------------------------------------------------------------------
2655 //-----------------------------------------------------------------------------
2656 void RAMFUNC
SniffMifare(uint8_t param
) {
2658 // bit 0 - trigger from first card answer
2659 // bit 1 - trigger from first reader 7-bit request
2661 // C(red) A(yellow) B(green)
2663 // init trace buffer
2664 iso14a_clear_trace();
2665 iso14a_set_tracing(TRUE
);
2667 // The command (reader -> tag) that we're receiving.
2668 // The length of a received command will in most cases be no more than 18 bytes.
2669 // So 32 should be enough!
2670 uint8_t *receivedCmd
= (((uint8_t *)BigBuf
) + RECV_CMD_OFFSET
);
2671 uint8_t *receivedCmdPar
= ((uint8_t *)BigBuf
) + RECV_CMD_PAR_OFFSET
;
2672 // The response (tag -> reader) that we're receiving.
2673 uint8_t *receivedResponse
= (((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
);
2674 uint8_t *receivedResponsePar
= ((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
;
2676 // As we receive stuff, we copy it from receivedCmd or receivedResponse
2677 // into trace, along with its length and other annotations.
2678 //uint8_t *trace = (uint8_t *)BigBuf;
2680 // The DMA buffer, used to stream samples from the FPGA
2681 uint8_t *dmaBuf
= ((uint8_t *)BigBuf
) + DMA_BUFFER_OFFSET
;
2682 uint8_t *data
= dmaBuf
;
2683 uint8_t previous_data
= 0;
2686 bool ReaderIsActive
= FALSE
;
2687 bool TagIsActive
= FALSE
;
2689 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER
);
2691 // Set up the demodulator for tag -> reader responses.
2692 DemodInit(receivedResponse
, receivedResponsePar
);
2694 // Set up the demodulator for the reader -> tag commands
2695 UartInit(receivedCmd
, receivedCmdPar
);
2697 // Setup for the DMA.
2698 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
); // set transfer address and number of bytes. Start transfer.
2705 // And now we loop, receiving samples.
2706 for(uint32_t sniffCounter
= 0; TRUE
; ) {
2708 if(BUTTON_PRESS()) {
2709 DbpString("cancelled by button");
2716 if ((sniffCounter
& 0x0000FFFF) == 0) { // from time to time
2717 // check if a transaction is completed (timeout after 2000ms).
2718 // if yes, stop the DMA transfer and send what we have so far to the client
2719 if (MfSniffSend(2000)) {
2720 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2724 ReaderIsActive
= FALSE
;
2725 TagIsActive
= FALSE
;
2726 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
); // set transfer address and number of bytes. Start transfer.
2730 int register readBufDataP
= data
- dmaBuf
; // number of bytes we have processed so far
2731 int register dmaBufDataP
= DMA_BUFFER_SIZE
- AT91C_BASE_PDC_SSC
->PDC_RCR
; // number of bytes already transferred
2732 if (readBufDataP
<= dmaBufDataP
){ // we are processing the same block of data which is currently being transferred
2733 dataLen
= dmaBufDataP
- readBufDataP
; // number of bytes still to be processed
2735 dataLen
= DMA_BUFFER_SIZE
- readBufDataP
+ dmaBufDataP
; // number of bytes still to be processed
2737 // test for length of buffer
2738 if(dataLen
> maxDataLen
) { // we are more behind than ever...
2739 maxDataLen
= dataLen
;
2741 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen
);
2745 if(dataLen
< 1) continue;
2747 // primary buffer was stopped ( <-- we lost data!
2748 if (!AT91C_BASE_PDC_SSC
->PDC_RCR
) {
2749 AT91C_BASE_PDC_SSC
->PDC_RPR
= (uint32_t) dmaBuf
;
2750 AT91C_BASE_PDC_SSC
->PDC_RCR
= DMA_BUFFER_SIZE
;
2751 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen
); // temporary
2753 // secondary buffer sets as primary, secondary buffer was stopped
2754 if (!AT91C_BASE_PDC_SSC
->PDC_RNCR
) {
2755 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
;
2756 AT91C_BASE_PDC_SSC
->PDC_RNCR
= DMA_BUFFER_SIZE
;
2761 if (sniffCounter
& 0x01) {
2763 if(!TagIsActive
) { // no need to try decoding tag data if the reader is sending
2764 uint8_t readerdata
= (previous_data
& 0xF0) | (*data
>> 4);
2765 if(MillerDecoding(readerdata
, (sniffCounter
-1)*4)) {
2767 if (MfSniffLogic(receivedCmd
, Uart
.len
, Uart
.parity
, Uart
.bitCount
, TRUE
)) break;
2769 /* And ready to receive another command. */
2772 /* And also reset the demod code */
2775 ReaderIsActive
= (Uart
.state
!= STATE_UNSYNCD
);
2778 if(!ReaderIsActive
) { // no need to try decoding tag data if the reader is sending
2779 uint8_t tagdata
= (previous_data
<< 4) | (*data
& 0x0F);
2780 if(ManchesterDecoding(tagdata
, 0, (sniffCounter
-1)*4)) {
2783 if (MfSniffLogic(receivedResponse
, Demod
.len
, Demod
.parity
, Demod
.bitCount
, FALSE
)) break;
2785 // And ready to receive another response.
2788 TagIsActive
= (Demod
.state
!= DEMOD_UNSYNCD
);
2792 previous_data
= *data
;
2795 if(data
== dmaBuf
+ DMA_BUFFER_SIZE
) {
2801 DbpString("COMMAND FINISHED");
2803 FpgaDisableSscDma();
2806 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen
, Uart
.state
, Uart
.len
);