]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443a.c
projects / proxmark3-svn / blob
? search:


a687d877905853ec01303eb29e1a03bd701b137a
[proxmark3-svn] / armsrc / iso14443a.c
1 //-----------------------------------------------------------------------------
2 // Routines to support ISO 14443 type A.
3 //
4 // Gerhard de Koning Gans - May 2008
5 //-----------------------------------------------------------------------------
6 #include <proxmark3.h>
7 #include "apps.h"
8 #include "..\common\iso14443_crc.c"
9
10 typedef enum {
11 SEC_D = 1,
12 SEC_E = 2,
13 SEC_F = 3,
14 SEC_X = 4,
15 SEC_Y = 5,
16 SEC_Z = 6
17 } SecType;
18
19 //-----------------------------------------------------------------------------
20 // The software UART that receives commands from the reader, and its state
21 // variables.
22 //-----------------------------------------------------------------------------
23 static struct {
24 enum {
25 STATE_UNSYNCD,
26 STATE_START_OF_COMMUNICATION,
27 STATE_MILLER_X,
28 STATE_MILLER_Y,
29 STATE_MILLER_Z,
30 STATE_ERROR_WAIT
31 } state;
32 WORD shiftReg;
33 int bitCnt;
34 int byteCnt;
35 int byteCntMax;
36 int posCnt;
37 int syncBit;
38 int parityBits;
39 int samples;
40 int highCnt;
41 int bitBuffer;
42 enum {
43 DROP_NONE,
44 DROP_FIRST_HALF,
45 DROP_SECOND_HALF
46 } drop;
47 BYTE *output;
48 } Uart;
49
50 static BOOL MillerDecoding(int bit)
51 {
52 int error = 0;
53 int bitright;
54
55 if(!Uart.bitBuffer) {
56 Uart.bitBuffer = bit ^ 0xFF0;
57 return FALSE;
58 }
59 else {
60 Uart.bitBuffer <<= 4;
61 Uart.bitBuffer ^= bit;
62 }
63
64 BOOL EOC = FALSE;
65
66 if(Uart.state != STATE_UNSYNCD) {
67 Uart.posCnt++;
68
69 if((Uart.bitBuffer & Uart.syncBit) ^ Uart.syncBit) {
70 bit = 0x00;
71 }
72 else {
73 bit = 0x01;
74 }
75 if(((Uart.bitBuffer << 1) & Uart.syncBit) ^ Uart.syncBit) {
76 bitright = 0x00;
77 }
78 else {
79 bitright = 0x01;
80 }
81 if(bit != bitright) { bit = bitright; }
82
83 if(Uart.posCnt == 1) {
84 // measurement first half bitperiod
85 if(!bit) {
86 Uart.drop = DROP_FIRST_HALF;
87 }
88 }
89 else {
90 // measurement second half bitperiod
91 if(!bit & (Uart.drop == DROP_NONE)) {
92 Uart.drop = DROP_SECOND_HALF;
93 }
94 else if(!bit) {
95 // measured a drop in first and second half
96 // which should not be possible
97 Uart.state = STATE_ERROR_WAIT;
98 error = 0x01;
99 }
100
101 Uart.posCnt = 0;
102
103 switch(Uart.state) {
104 case STATE_START_OF_COMMUNICATION:
105 Uart.shiftReg = 0;
106 if(Uart.drop == DROP_SECOND_HALF) {
107 // error, should not happen in SOC
108 Uart.state = STATE_ERROR_WAIT;
109 error = 0x02;
110 }
111 else {
112 // correct SOC
113 Uart.state = STATE_MILLER_Z;
114 }
115 break;
116
117 case STATE_MILLER_Z:
118 Uart.bitCnt++;
119 Uart.shiftReg >>= 1;
120 if(Uart.drop == DROP_NONE) {
121 // logic '0' followed by sequence Y
122 // end of communication
123 Uart.state = STATE_UNSYNCD;
124 EOC = TRUE;
125 }
126 // if(Uart.drop == DROP_FIRST_HALF) {
127 // Uart.state = STATE_MILLER_Z; stay the same
128 // we see a logic '0' }
129 if(Uart.drop == DROP_SECOND_HALF) {
130 // we see a logic '1'
131 Uart.shiftReg |= 0x100;
132 Uart.state = STATE_MILLER_X;
133 }
134 break;
135
136 case STATE_MILLER_X:
137 Uart.shiftReg >>= 1;
138 if(Uart.drop == DROP_NONE) {
139 // sequence Y, we see a '0'
140 Uart.state = STATE_MILLER_Y;
141 Uart.bitCnt++;
142 }
143 if(Uart.drop == DROP_FIRST_HALF) {
144 // Would be STATE_MILLER_Z
145 // but Z does not follow X, so error
146 Uart.state = STATE_ERROR_WAIT;
147 error = 0x03;
148 }
149 if(Uart.drop == DROP_SECOND_HALF) {
150 // We see a '1' and stay in state X
151 Uart.shiftReg |= 0x100;
152 Uart.bitCnt++;
153 }
154 break;
155
156 case STATE_MILLER_Y:
157 Uart.bitCnt++;
158 Uart.shiftReg >>= 1;
159 if(Uart.drop == DROP_NONE) {
160 // logic '0' followed by sequence Y
161 // end of communication
162 Uart.state = STATE_UNSYNCD;
163 EOC = TRUE;
164 }
165 if(Uart.drop == DROP_FIRST_HALF) {
166 // we see a '0'
167 Uart.state = STATE_MILLER_Z;
168 }
169 if(Uart.drop == DROP_SECOND_HALF) {
170 // We see a '1' and go to state X
171 Uart.shiftReg |= 0x100;
172 Uart.state = STATE_MILLER_X;
173 }
174 break;
175
176 case STATE_ERROR_WAIT:
177 // That went wrong. Now wait for at least two bit periods
178 // and try to sync again
179 if(Uart.drop == DROP_NONE) {
180 Uart.highCnt = 6;
181 Uart.state = STATE_UNSYNCD;
182 }
183 break;
184
185 default:
186 Uart.state = STATE_UNSYNCD;
187 Uart.highCnt = 0;
188 break;
189 }
190
191 Uart.drop = DROP_NONE;
192
193 // should have received at least one whole byte...
194 if((Uart.bitCnt == 2) && EOC && (Uart.byteCnt > 0)) {
195 return TRUE;
196 }
197
198 if(Uart.bitCnt == 9) {
199 Uart.output[Uart.byteCnt] = (Uart.shiftReg & 0xff);
200 Uart.byteCnt++;
201
202 Uart.parityBits <<= 1;
203 Uart.parityBits ^= ((Uart.shiftReg >> 8) & 0x01);
204
205 if(EOC) {
206 // when End of Communication received and
207 // all data bits processed..
208 return TRUE;
209 }
210 Uart.bitCnt = 0;
211 }
212
213 /*if(error) {
214 Uart.output[Uart.byteCnt] = 0xAA;
215 Uart.byteCnt++;
216 Uart.output[Uart.byteCnt] = error & 0xFF;
217 Uart.byteCnt++;
218 Uart.output[Uart.byteCnt] = 0xAA;
219 Uart.byteCnt++;
220 Uart.output[Uart.byteCnt] = (Uart.bitBuffer >> 8) & 0xFF;
221 Uart.byteCnt++;
222 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
223 Uart.byteCnt++;
224 Uart.output[Uart.byteCnt] = (Uart.syncBit >> 3) & 0xFF;
225 Uart.byteCnt++;
226 Uart.output[Uart.byteCnt] = 0xAA;
227 Uart.byteCnt++;
228 return TRUE;
229 }*/
230 }
231
232 }
233 else {
234 bit = Uart.bitBuffer & 0xf0;
235 bit >>= 4;
236 bit ^= 0x0F;
237 if(bit) {
238 // should have been high or at least (4 * 128) / fc
239 // according to ISO this should be at least (9 * 128 + 20) / fc
240 if(Uart.highCnt == 8) {
241 // we went low, so this could be start of communication
242 // it turns out to be safer to choose a less significant
243 // syncbit... so we check whether the neighbour also represents the drop
244 Uart.posCnt = 1; // apparently we are busy with our first half bit period
245 Uart.syncBit = bit & 8;
246 Uart.samples = 3;
247 if(!Uart.syncBit) { Uart.syncBit = bit & 4; Uart.samples = 2; }
248 else if(bit & 4) { Uart.syncBit = bit & 4; Uart.samples = 2; bit <<= 2; }
249 if(!Uart.syncBit) { Uart.syncBit = bit & 2; Uart.samples = 1; }
250 else if(bit & 2) { Uart.syncBit = bit & 2; Uart.samples = 1; bit <<= 1; }
251 if(!Uart.syncBit) { Uart.syncBit = bit & 1; Uart.samples = 0;
252 if(Uart.syncBit & (Uart.bitBuffer & 8)) {
253 Uart.syncBit = 8;
254
255 // the first half bit period is expected in next sample
256 Uart.posCnt = 0;
257 Uart.samples = 3;
258 }
259 }
260 else if(bit & 1) { Uart.syncBit = bit & 1; Uart.samples = 0; }
261
262 Uart.syncBit <<= 4;
263 Uart.state = STATE_START_OF_COMMUNICATION;
264 Uart.drop = DROP_FIRST_HALF;
265 Uart.bitCnt = 0;
266 Uart.byteCnt = 0;
267 Uart.parityBits = 0;
268 error = 0;
269 }
270 else {
271 Uart.highCnt = 0;
272 }
273 }
274 else {
275 if(Uart.highCnt < 8) {
276 Uart.highCnt++;
277 }
278 }
279 }
280
281 return FALSE;
282 }
283
284 //=============================================================================
285 // ISO 14443 Type A - Manchester
286 //=============================================================================
287
288 static struct {
289 enum {
290 DEMOD_UNSYNCD,
291 DEMOD_START_OF_COMMUNICATION,
292 DEMOD_MANCHESTER_D,
293 DEMOD_MANCHESTER_E,
294 DEMOD_MANCHESTER_F,
295 DEMOD_ERROR_WAIT
296 } state;
297 int bitCount;
298 int posCount;
299 int syncBit;
300 int parityBits;
301 WORD shiftReg;
302 int buffer;
303 int buff;
304 int samples;
305 int len;
306 enum {
307 SUB_NONE,
308 SUB_FIRST_HALF,
309 SUB_SECOND_HALF
310 } sub;
311 BYTE *output;
312 } Demod;
313
314 static BOOL ManchesterDecoding(int v)
315 {
316 int bit;
317 int modulation;
318 int error = 0;
319
320 if(!Demod.buff) {
321 Demod.buff = 1;
322 Demod.buffer = v;
323 return FALSE;
324 }
325 else {
326 bit = Demod.buffer;
327 Demod.buffer = v;
328 }
329
330 if(Demod.state==DEMOD_UNSYNCD) {
331 Demod.output[Demod.len] = 0xfa;
332 Demod.syncBit = 0;
333 //Demod.samples = 0;
334 Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part
335 if(bit & 0x08) { Demod.syncBit = 0x08; }
336 if(!Demod.syncBit) {
337 if(bit & 0x04) { Demod.syncBit = 0x04; }
338 }
339 else if(bit & 0x04) { Demod.syncBit = 0x04; bit <<= 4; }
340 if(!Demod.syncBit) {
341 if(bit & 0x02) { Demod.syncBit = 0x02; }
342 }
343 else if(bit & 0x02) { Demod.syncBit = 0x02; bit <<= 4; }
344 if(!Demod.syncBit) {
345 if(bit & 0x01) { Demod.syncBit = 0x01; }
346
347 if(Demod.syncBit & (Demod.buffer & 0x08)) {
348 Demod.syncBit = 0x08;
349
350 // The first half bitperiod is expected in next sample
351 Demod.posCount = 0;
352 Demod.output[Demod.len] = 0xfb;
353 }
354 }
355 else if(bit & 0x01) { Demod.syncBit = 0x01; }
356
357 if(Demod.syncBit) {
358 Demod.len = 0;
359 Demod.state = DEMOD_START_OF_COMMUNICATION;
360 Demod.sub = SUB_FIRST_HALF;
361 Demod.bitCount = 0;
362 Demod.shiftReg = 0;
363 Demod.parityBits = 0;
364 Demod.samples = 0;
365 if(Demod.posCount) {
366 switch(Demod.syncBit) {
367 case 0x08: Demod.samples = 3; break;
368 case 0x04: Demod.samples = 2; break;
369 case 0x02: Demod.samples = 1; break;
370 case 0x01: Demod.samples = 0; break;
371 }
372 }
373 error = 0;
374 }
375 }
376 else {
377 //modulation = bit & Demod.syncBit;
378 modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
379
380 Demod.samples += 4;
381
382 if(Demod.posCount==0) {
383 Demod.posCount = 1;
384 if(modulation) {
385 Demod.sub = SUB_FIRST_HALF;
386 }
387 else {
388 Demod.sub = SUB_NONE;
389 }
390 }
391 else {
392 Demod.posCount = 0;
393 if(modulation && (Demod.sub == SUB_FIRST_HALF)) {
394 if(Demod.state!=DEMOD_ERROR_WAIT) {
395 Demod.state = DEMOD_ERROR_WAIT;
396 Demod.output[Demod.len] = 0xaa;
397 error = 0x01;
398 }
399 }
400 else if(modulation) {
401 Demod.sub = SUB_SECOND_HALF;
402 }
403
404 switch(Demod.state) {
405 case DEMOD_START_OF_COMMUNICATION:
406 if(Demod.sub == SUB_FIRST_HALF) {
407 Demod.state = DEMOD_MANCHESTER_D;
408 }
409 else {
410 Demod.output[Demod.len] = 0xab;
411 Demod.state = DEMOD_ERROR_WAIT;
412 error = 0x02;
413 }
414 break;
415
416 case DEMOD_MANCHESTER_D:
417 case DEMOD_MANCHESTER_E:
418 if(Demod.sub == SUB_FIRST_HALF) {
419 Demod.bitCount++;
420 Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100;
421 Demod.state = DEMOD_MANCHESTER_D;
422 }
423 else if(Demod.sub == SUB_SECOND_HALF) {
424 Demod.bitCount++;
425 Demod.shiftReg >>= 1;
426 Demod.state = DEMOD_MANCHESTER_E;
427 }
428 else {
429 Demod.state = DEMOD_MANCHESTER_F;
430 }
431 break;
432
433 case DEMOD_MANCHESTER_F:
434 // Tag response does not need to be a complete byte!
435 if(Demod.len > 0 || Demod.bitCount > 0) {
436 if(Demod.bitCount > 0) {
437 Demod.shiftReg >>= (9 - Demod.bitCount);
438 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
439 Demod.len++;
440 // No parity bit, so just shift a 0
441 Demod.parityBits <<= 1;
442 }
443
444 Demod.state = DEMOD_UNSYNCD;
445 return TRUE;
446 }
447 else {
448 Demod.output[Demod.len] = 0xad;
449 Demod.state = DEMOD_ERROR_WAIT;
450 error = 0x03;
451 }
452 break;
453
454 case DEMOD_ERROR_WAIT:
455 Demod.state = DEMOD_UNSYNCD;
456 break;
457
458 default:
459 Demod.output[Demod.len] = 0xdd;
460 Demod.state = DEMOD_UNSYNCD;
461 break;
462 }
463
464 if(Demod.bitCount>=9) {
465 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
466 Demod.len++;
467
468 Demod.parityBits <<= 1;
469 Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);
470
471 Demod.bitCount = 0;
472 Demod.shiftReg = 0;
473 }
474
475 /*if(error) {
476 Demod.output[Demod.len] = 0xBB;
477 Demod.len++;
478 Demod.output[Demod.len] = error & 0xFF;
479 Demod.len++;
480 Demod.output[Demod.len] = 0xBB;
481 Demod.len++;
482 Demod.output[Demod.len] = bit & 0xFF;
483 Demod.len++;
484 Demod.output[Demod.len] = Demod.buffer & 0xFF;
485 Demod.len++;
486 Demod.output[Demod.len] = Demod.syncBit & 0xFF;
487 Demod.len++;
488 Demod.output[Demod.len] = 0xBB;
489 Demod.len++;
490 return TRUE;
491 }*/
492
493 }
494
495 } // end (state != UNSYNCED)
496
497 return FALSE;
498 }
499
500 //=============================================================================
501 // Finally, a `sniffer' for ISO 14443 Type A
502 // Both sides of communication!
503 //=============================================================================
504
505 //-----------------------------------------------------------------------------
506 // Record the sequence of commands sent by the reader to the tag, with
507 // triggering so that we start recording at the point that the tag is moved
508 // near the reader.
509 //-----------------------------------------------------------------------------
510 void SnoopIso14443a(void)
511 {
512
513 // BIG CHANGE - UNDERSTAND THIS BEFORE WE COMMIT
514
515 #define RECV_CMD_OFFSET 3032
516 #define RECV_RES_OFFSET 3096
517 #define DMA_BUFFER_OFFSET 3160
518 #define DMA_BUFFER_SIZE 4096
519 #define TRACE_LENGTH 3000
520
521 // #define RECV_CMD_OFFSET 2032 // original (working as of 21/2/09) values
522 // #define RECV_RES_OFFSET 2096 // original (working as of 21/2/09) values
523 // #define DMA_BUFFER_OFFSET 2160 // original (working as of 21/2/09) values
524 // #define DMA_BUFFER_SIZE 4096 // original (working as of 21/2/09) values
525 // #define TRACE_LENGTH 2000 // original (working as of 21/2/09) values
526
527 // We won't start recording the frames that we acquire until we trigger;
528 // a good trigger condition to get started is probably when we see a
529 // response from the tag.
530 BOOL triggered = TRUE; // FALSE to wait first for card
531
532 // The command (reader -> tag) that we're receiving.
533 // The length of a received command will in most cases be no more than 18 bytes.
534 // So 32 should be enough!
535 BYTE *receivedCmd = (((BYTE *)BigBuf) + RECV_CMD_OFFSET);
536 // The response (tag -> reader) that we're receiving.
537 BYTE *receivedResponse = (((BYTE *)BigBuf) + RECV_RES_OFFSET);
538
539 // As we receive stuff, we copy it from receivedCmd or receivedResponse
540 // into trace, along with its length and other annotations.
541 BYTE *trace = (BYTE *)BigBuf;
542 int traceLen = 0;
543
544 // The DMA buffer, used to stream samples from the FPGA
545 SBYTE *dmaBuf = ((SBYTE *)BigBuf) + DMA_BUFFER_OFFSET;
546 int lastRxCounter;
547 SBYTE *upTo;
548 int smpl;
549 int maxBehindBy = 0;
550
551 // Count of samples received so far, so that we can include timing
552 // information in the trace buffer.
553 int samples = 0;
554 int rsamples = 0;
555
556 memset(trace, 0x44, RECV_CMD_OFFSET);
557
558 // Set up the demodulator for tag -> reader responses.
559 Demod.output = receivedResponse;
560 Demod.len = 0;
561 Demod.state = DEMOD_UNSYNCD;
562
563 // And the reader -> tag commands
564 memset(&Uart, 0, sizeof(Uart));
565 Uart.output = receivedCmd;
566 Uart.byteCntMax = 32; // was 100 (greg)////////////////////////////////////////////////////////////////////////
567 Uart.state = STATE_UNSYNCD;
568
569 // And put the FPGA in the appropriate mode
570 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER);
571 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
572
573 // Setup for the DMA.
574 FpgaSetupSsc();
575 upTo = dmaBuf;
576 lastRxCounter = DMA_BUFFER_SIZE;
577 FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
578
579 LED_A_ON();
580
581 // And now we loop, receiving samples.
582 for(;;) {
583 WDT_HIT();
584 int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &
585 (DMA_BUFFER_SIZE-1);
586 if(behindBy > maxBehindBy) {
587 maxBehindBy = behindBy;
588 if(behindBy > 400) {
589 DbpString("blew circular buffer!");
590 goto done;
591 }
592 }
593 if(behindBy < 1) continue;
594
595 smpl = upTo[0];
596 upTo++;
597 lastRxCounter -= 1;
598 if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
599 upTo -= DMA_BUFFER_SIZE;
600 lastRxCounter += DMA_BUFFER_SIZE;
601 PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;
602 PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;
603 }
604
605 samples += 4;
606 #define HANDLE_BIT_IF_BODY \
607 LED_C_ON(); \
608 if(triggered) { \
609 trace[traceLen++] = ((rsamples >> 0) & 0xff); \
610 trace[traceLen++] = ((rsamples >> 8) & 0xff); \
611 trace[traceLen++] = ((rsamples >> 16) & 0xff); \
612 trace[traceLen++] = ((rsamples >> 24) & 0xff); \
613 trace[traceLen++] = ((Uart.parityBits >> 0) & 0xff); \
614 trace[traceLen++] = ((Uart.parityBits >> 8) & 0xff); \
615 trace[traceLen++] = ((Uart.parityBits >> 16) & 0xff); \
616 trace[traceLen++] = ((Uart.parityBits >> 24) & 0xff); \
617 trace[traceLen++] = Uart.byteCnt; \
618 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
619 traceLen += Uart.byteCnt; \
620 if(traceLen > TRACE_LENGTH) break; \
621 } \
622 /* And ready to receive another command. */ \
623 Uart.state = STATE_UNSYNCD; \
624 /* And also reset the demod code, which might have been */ \
625 /* false-triggered by the commands from the reader. */ \
626 Demod.state = DEMOD_UNSYNCD; \
627 LED_B_OFF(); \
628
629 if(MillerDecoding((smpl & 0xF0) >> 4)) {
630 rsamples = samples - Uart.samples;
631 HANDLE_BIT_IF_BODY
632 }
633 if(ManchesterDecoding(smpl & 0x0F)) {
634 rsamples = samples - Demod.samples;
635 LED_B_ON();
636
637 // timestamp, as a count of samples
638 trace[traceLen++] = ((rsamples >> 0) & 0xff);
639 trace[traceLen++] = ((rsamples >> 8) & 0xff);
640 trace[traceLen++] = ((rsamples >> 16) & 0xff);
641 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
642 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
643 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
644 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
645 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
646 // length
647 trace[traceLen++] = Demod.len;
648 memcpy(trace+traceLen, receivedResponse, Demod.len);
649 traceLen += Demod.len;
650 if(traceLen > TRACE_LENGTH) break;
651
652 triggered = TRUE;
653
654 // And ready to receive another response.
655 memset(&Demod, 0, sizeof(Demod));
656 Demod.output = receivedResponse;
657 Demod.state = DEMOD_UNSYNCD;
658 LED_C_OFF();
659 }
660
661 if(BUTTON_PRESS()) {
662 DbpString("cancelled_a");
663 goto done;
664 }
665 }
666
667 DbpString("COMMAND FINISHED");
668
669 DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
670 DbpIntegers(Uart.byteCntMax, traceLen, (int)Uart.output[0]);
671
672 done:
673 PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;
674 DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
675 DbpIntegers(Uart.byteCntMax, traceLen, (int)Uart.output[0]);
676 LED_A_OFF();
677 LED_B_OFF();
678 LED_C_OFF();
679 LED_D_OFF();
680 }
681
682 // Prepare communication bits to send to FPGA
683 void Sequence(SecType seq)
684 {
685 ToSendMax++;
686 switch(seq) {
687 // CARD TO READER
688 case SEC_D:
689 // Sequence D: 11110000
690 // modulation with subcarrier during first half
691 ToSend[ToSendMax] = 0xf0;
692 break;
693 case SEC_E:
694 // Sequence E: 00001111
695 // modulation with subcarrier during second half
696 ToSend[ToSendMax] = 0x0f;
697 break;
698 case SEC_F:
699 // Sequence F: 00000000
700 // no modulation with subcarrier
701 ToSend[ToSendMax] = 0x00;
702 break;
703 // READER TO CARD
704 case SEC_X:
705 // Sequence X: 00001100
706 // drop after half a period
707 ToSend[ToSendMax] = 0x0c;
708 break;
709 case SEC_Y:
710 default:
711 // Sequence Y: 00000000
712 // no drop
713 ToSend[ToSendMax] = 0x00;
714 break;
715 case SEC_Z:
716 // Sequence Z: 11000000
717 // drop at start
718 ToSend[ToSendMax] = 0xc0;
719 break;
720 }
721 }
722
723 //-----------------------------------------------------------------------------
724 // Prepare tag messages
725 //-----------------------------------------------------------------------------
726 static void CodeIso14443aAsTag(const BYTE *cmd, int len)
727 {
728 int i;
729 int oddparity;
730
731 ToSendReset();
732
733 // Correction bit, might be removed when not needed
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736 ToSendStuffBit(0);
737 ToSendStuffBit(0);
738 ToSendStuffBit(1); // 1
739 ToSendStuffBit(0);
740 ToSendStuffBit(0);
741 ToSendStuffBit(0);
742
743 // Send startbit
744 Sequence(SEC_D);
745
746 for(i = 0; i < len; i++) {
747 int j;
748 BYTE b = cmd[i];
749
750 // Data bits
751 oddparity = 0x01;
752 for(j = 0; j < 8; j++) {
753 oddparity ^= (b & 1);
754 if(b & 1) {
755 Sequence(SEC_D);
756 } else {
757 Sequence(SEC_E);
758 }
759 b >>= 1;
760 }
761
762 // Parity bit
763 if(oddparity) {
764 Sequence(SEC_D);
765 } else {
766 Sequence(SEC_E);
767 }
768 }
769
770 // Send stopbit
771 Sequence(SEC_F);
772
773 // Flush the buffer in FPGA!!
774 for(i = 0; i < 5; i++) {
775 Sequence(SEC_F);
776 }
777
778 // Convert from last byte pos to length
779 ToSendMax++;
780
781 // Add a few more for slop
782 ToSend[ToSendMax++] = 0x00;
783 ToSend[ToSendMax++] = 0x00;
784 //ToSendMax += 2;
785 }
786
787 //-----------------------------------------------------------------------------
788 // This is to send a NACK kind of answer, its only 3 bits, I know it should be 4
789 //-----------------------------------------------------------------------------
790 static void CodeStrangeAnswer()
791 {
792 int i;
793
794 ToSendReset();
795
796 // Correction bit, might be removed when not needed
797 ToSendStuffBit(0);
798 ToSendStuffBit(0);
799 ToSendStuffBit(0);
800 ToSendStuffBit(0);
801 ToSendStuffBit(1); // 1
802 ToSendStuffBit(0);
803 ToSendStuffBit(0);
804 ToSendStuffBit(0);
805
806 // Send startbit
807 Sequence(SEC_D);
808
809 // 0
810 Sequence(SEC_E);
811
812 // 0
813 Sequence(SEC_E);
814
815 // 1
816 Sequence(SEC_D);
817
818 // Send stopbit
819 Sequence(SEC_F);
820
821 // Flush the buffer in FPGA!!
822 for(i = 0; i < 5; i++) {
823 Sequence(SEC_F);
824 }
825
826 // Convert from last byte pos to length
827 ToSendMax++;
828
829 // Add a few more for slop
830 ToSend[ToSendMax++] = 0x00;
831 ToSend[ToSendMax++] = 0x00;
832 //ToSendMax += 2;
833 }
834
835 //-----------------------------------------------------------------------------
836 // Wait for commands from reader
837 // Stop when button is pressed
838 // Or return TRUE when command is captured
839 //-----------------------------------------------------------------------------
840 static BOOL GetIso14443aCommandFromReader(BYTE *received, int *len, int maxLen)
841 {
842 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
843 // only, since we are receiving, not transmitting).
844 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
845
846 // Now run a `software UART' on the stream of incoming samples.
847 Uart.output = received;
848 Uart.byteCntMax = maxLen;
849 Uart.state = STATE_UNSYNCD;
850
851 for(;;) {
852 WDT_HIT();
853
854 if(BUTTON_PRESS()) return FALSE;
855
856 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
857 SSC_TRANSMIT_HOLDING = 0x00;
858 }
859 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
860 BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
861 if(MillerDecoding((b & 0xf0) >> 4)) {
862 *len = Uart.byteCnt;
863 return TRUE;
864 }
865 if(MillerDecoding(b & 0x0f)) {
866 *len = Uart.byteCnt;
867 return TRUE;
868 }
869 }
870 }
871 }
872
873 //-----------------------------------------------------------------------------
874 // Main loop of simulated tag: receive commands from reader, decide what
875 // response to send, and send it.
876 //-----------------------------------------------------------------------------
877 void SimulateIso14443aTag(int tagType, int TagUid)
878 {
879 // This function contains the tag emulation
880
881 // Prepare protocol messages
882 // static const BYTE cmd1[] = { 0x26 };
883 // static const BYTE response1[] = { 0x02, 0x00 }; // Says: I am Mifare 4k - original line - greg
884 //
885 static const BYTE response1[] = { 0x44, 0x03 }; // Says: I am a DESFire Tag, ph33r me
886 // static const BYTE response1[] = { 0x44, 0x00 }; // Says: I am a ULTRALITE Tag, 0wn me
887
888 // UID response
889 // static const BYTE cmd2[] = { 0x93, 0x20 };
890 //static const BYTE response2[] = { 0x9a, 0xe5, 0xe4, 0x43, 0xd8 }; // original value - greg
891
892
893
894 // my desfire
895 static const BYTE response2[] = { 0x88, 0x04, 0x21, 0x3f, 0x4d }; // known uid - note cascade (0x88), 2nd byte (0x04) = NXP/Phillips
896
897
898 // When reader selects us during cascade1 it will send cmd3
899 //BYTE response3[] = { 0x04, 0x00, 0x00 }; // SAK Select (cascade1) successful response (ULTRALITE)
900 BYTE response3[] = { 0x24, 0x00, 0x00 }; // SAK Select (cascade1) successful response (DESFire)
901 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
902
903 // send cascade2 2nd half of UID
904 static const BYTE response2a[] = { 0x51, 0x48, 0x1d, 0x80, 0x84 }; // uid - cascade2 - 2nd half (4 bytes) of UID+ BCCheck
905 // NOTE : THE CRC on the above may be wrong as I have obfuscated the actual UID
906
907
908 // When reader selects us during cascade2 it will send cmd3a
909 //BYTE response3a[] = { 0x00, 0x00, 0x00 }; // SAK Select (cascade2) successful response (ULTRALITE)
910 BYTE response3a[] = { 0x20, 0x00, 0x00 }; // SAK Select (cascade2) successful response (DESFire)
911 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
912
913 // When reader tries to authenticate
914 // static const BYTE cmd5[] = { 0x60, 0x00, 0xf5, 0x7b };
915 static const BYTE response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
916
917 BYTE *resp;
918 int respLen;
919
920 // Longest possible response will be 16 bytes + 2 CRC = 18 bytes
921 // This will need
922 // 144 data bits (18 * 8)
923 // 18 parity bits
924 // 2 Start and stop
925 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
926 // 1 just for the case
927 // ----------- +
928 // 166
929 //
930 // 166 bytes, since every bit that needs to be send costs us a byte
931 //
932
933
934 // Respond with card type
935 BYTE *resp1 = (((BYTE *)BigBuf) + 800);
936 int resp1Len;
937
938 // Anticollision cascade1 - respond with uid
939 BYTE *resp2 = (((BYTE *)BigBuf) + 970);
940 int resp2Len;
941
942 // Anticollision cascade2 - respond with 2nd half of uid if asked
943 // we're only going to be asked if we set the 1st byte of the UID (during cascade1) to 0x88
944 BYTE *resp2a = (((BYTE *)BigBuf) + 1140);
945 int resp2aLen;
946
947 // Acknowledge select - cascade 1
948 BYTE *resp3 = (((BYTE *)BigBuf) + 1310);
949 int resp3Len;
950
951 // Acknowledge select - cascade 2
952 BYTE *resp3a = (((BYTE *)BigBuf) + 1480);
953 int resp3aLen;
954
955 // Response to a read request - not implemented atm
956 BYTE *resp4 = (((BYTE *)BigBuf) + 1550);
957 int resp4Len;
958
959 // Authenticate response - nonce
960 BYTE *resp5 = (((BYTE *)BigBuf) + 1720);
961 int resp5Len;
962
963 BYTE *receivedCmd = (BYTE *)BigBuf;
964 int len;
965
966 int i;
967 int u;
968 BYTE b;
969
970 // To control where we are in the protocol
971 int order = 0;
972 int lastorder;
973
974 // Just to allow some checks
975 int happened = 0;
976 int happened2 = 0;
977
978 int cmdsRecvd = 0;
979
980 BOOL fdt_indicator;
981
982 memset(receivedCmd, 0x44, 400);
983
984 // Prepare the responses of the anticollision phase
985 // there will be not enough time to do this at the moment the reader sends it REQA
986
987 // Answer to request
988 CodeIso14443aAsTag(response1, sizeof(response1));
989 memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
990
991 // Send our UID (cascade 1)
992 CodeIso14443aAsTag(response2, sizeof(response2));
993 memcpy(resp2, ToSend, ToSendMax); resp2Len = ToSendMax;
994
995 // Answer to select (cascade1)
996 CodeIso14443aAsTag(response3, sizeof(response3));
997 memcpy(resp3, ToSend, ToSendMax); resp3Len = ToSendMax;
998
999 // Send the cascade 2 2nd part of the uid
1000 CodeIso14443aAsTag(response2a, sizeof(response2a));
1001 memcpy(resp2a, ToSend, ToSendMax); resp2aLen = ToSendMax;
1002
1003 // Answer to select (cascade 2)
1004 CodeIso14443aAsTag(response3a, sizeof(response3a));
1005 memcpy(resp3a, ToSend, ToSendMax); resp3aLen = ToSendMax;
1006
1007 // Strange answer is an example of rare message size (3 bits)
1008 CodeStrangeAnswer();
1009 memcpy(resp4, ToSend, ToSendMax); resp4Len = ToSendMax;
1010
1011 // Authentication answer (random nonce)
1012 CodeIso14443aAsTag(response5, sizeof(response5));
1013 memcpy(resp5, ToSend, ToSendMax); resp5Len = ToSendMax;
1014
1015 // We need to listen to the high-frequency, peak-detected path.
1016 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1017 FpgaSetupSsc();
1018
1019 cmdsRecvd = 0;
1020
1021 LED_A_ON();
1022 for(;;) {
1023
1024 if(!GetIso14443aCommandFromReader(receivedCmd, &len, 100)) {
1025 DbpString("button press");
1026 break;
1027 }
1028 // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
1029 // Okay, look at the command now.
1030 lastorder = order;
1031 i = 1; // first byte transmitted
1032 if(receivedCmd[0] == 0x26) {
1033 // Received a REQUEST
1034 resp = resp1; respLen = resp1Len; order = 1;
1035 //DbpString("Hello request from reader:");
1036 } else if(receivedCmd[0] == 0x52) {
1037 // Received a WAKEUP
1038 resp = resp1; respLen = resp1Len; order = 6;
1039 // //DbpString("Wakeup request from reader:");
1040
1041 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // greg - cascade 1 anti-collision
1042 // Received request for UID (cascade 1)
1043 resp = resp2; respLen = resp2Len; order = 2;
1044 // DbpString("UID (cascade 1) request from reader:");
1045 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1046
1047
1048 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] ==0x95) { // greg - cascade 2 anti-collision
1049 // Received request for UID (cascade 2)
1050 resp = resp2a; respLen = resp2aLen; order = 20;
1051 // DbpString("UID (cascade 2) request from reader:");
1052 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1053
1054
1055 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] ==0x93) { // greg - cascade 1 select
1056 // Received a SELECT
1057 resp = resp3; respLen = resp3Len; order = 3;
1058 // DbpString("Select (cascade 1) request from reader:");
1059 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1060
1061
1062 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] ==0x95) { // greg - cascade 2 select
1063 // Received a SELECT
1064 resp = resp3a; respLen = resp3aLen; order = 30;
1065 // DbpString("Select (cascade 2) request from reader:");
1066 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1067
1068
1069 } else if(receivedCmd[0] == 0x30) {
1070 // Received a READ
1071 resp = resp4; respLen = resp4Len; order = 4; // Do nothing
1072 DbpString("Read request from reader:");
1073 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1074
1075
1076 } else if(receivedCmd[0] == 0x50) {
1077 // Received a HALT
1078 resp = resp1; respLen = 0; order = 5; // Do nothing
1079 DbpString("Reader requested we HALT!:");
1080
1081 } else if(receivedCmd[0] == 0x60) {
1082 // Received an authentication request
1083 resp = resp5; respLen = resp5Len; order = 7;
1084 DbpString("Authenticate request from reader:");
1085 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1086
1087 } else if(receivedCmd[0] == 0xE0) {
1088 // Received a RATS request
1089 resp = resp1; respLen = 0;order = 70;
1090 DbpString("RATS request from reader:");
1091 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1092 } else {
1093 // Never seen this command before
1094 DbpString("Unknown command received from reader:");
1095 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1096 DbpIntegers(receivedCmd[3], receivedCmd[4], receivedCmd[5]);
1097 DbpIntegers(receivedCmd[6], receivedCmd[7], receivedCmd[8]);
1098
1099 // Do not respond
1100 resp = resp1; respLen = 0; order = 0;
1101 }
1102
1103 // Count number of wakeups received after a halt
1104 if(order == 6 && lastorder == 5) { happened++; }
1105
1106 // Count number of other messages after a halt
1107 if(order != 6 && lastorder == 5) { happened2++; }
1108
1109 // Look at last parity bit to determine timing of answer
1110 if((Uart.parityBits & 0x01) || receivedCmd[0] == 0x52) {
1111 // 1236, so correction bit needed
1112 i = 0;
1113 }
1114
1115 memset(receivedCmd, 0x44, 32);
1116
1117 if(cmdsRecvd > 999) {
1118 DbpString("1000 commands later...");
1119 break;
1120 }
1121 else {
1122 cmdsRecvd++;
1123 }
1124
1125 if(respLen <= 0) continue;
1126
1127 // Modulate Manchester
1128 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1129 SSC_TRANSMIT_HOLDING = 0x00;
1130 FpgaSetupSsc();
1131
1132 // ### Transmit the response ###
1133 u = 0;
1134 b = 0x00;
1135 fdt_indicator = FALSE;
1136 for(;;) {
1137 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
1138 volatile BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
1139 (void)b;
1140 }
1141 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
1142 if(i > respLen) {
1143 b = 0x00;
1144 u++;
1145 } else {
1146 b = resp[i];
1147 i++;
1148 }
1149 SSC_TRANSMIT_HOLDING = b;
1150
1151 if(u > 4) {
1152 break;
1153 }
1154 }
1155 if(BUTTON_PRESS()) {
1156 break;
1157 }
1158 }
1159
1160 }
1161
1162 DbpIntegers(happened, happened2, cmdsRecvd);
1163 LED_A_OFF();
1164 }
1165
1166 //-----------------------------------------------------------------------------
1167 // Transmit the command (to the tag) that was placed in ToSend[].
1168 //-----------------------------------------------------------------------------
1169 static void TransmitFor14443a(const BYTE *cmd, int len, int *samples, int *wait)
1170 {
1171 int c;
1172
1173 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1174
1175 if(*wait < 10) { *wait = 10; }
1176
1177 for(c = 0; c < *wait;) {
1178 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
1179 SSC_TRANSMIT_HOLDING = 0x00; // For exact timing!
1180 c++;
1181 }
1182 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
1183 volatile DWORD r = SSC_RECEIVE_HOLDING;
1184 (void)r;
1185 }
1186 WDT_HIT();
1187 }
1188
1189 c = 0;
1190 for(;;) {
1191 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
1192 SSC_TRANSMIT_HOLDING = cmd[c];
1193 c++;
1194 if(c >= len) {
1195 break;
1196 }
1197 }
1198 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
1199 volatile DWORD r = SSC_RECEIVE_HOLDING;
1200 (void)r;
1201 }
1202 WDT_HIT();
1203 }
1204 *samples = (c + *wait) << 3;
1205 }
1206
1207 //-----------------------------------------------------------------------------
1208 // To generate an arbitrary stream from reader
1209 //
1210 //-----------------------------------------------------------------------------
1211 void ArbitraryFromReader(const BYTE *cmd, int parity, int len)
1212 {
1213 int i;
1214 int j;
1215 int last;
1216 BYTE b;
1217
1218 ToSendReset();
1219
1220 // Start of Communication (Seq. Z)
1221 Sequence(SEC_Z);
1222 last = 0;
1223
1224 for(i = 0; i < len; i++) {
1225 // Data bits
1226 b = cmd[i];
1227 for(j = 0; j < 8; j++) {
1228 if(b & 1) {
1229 // Sequence X
1230 Sequence(SEC_X);
1231 last = 1;
1232 } else {
1233 if(last == 0) {
1234 // Sequence Z
1235 Sequence(SEC_Z);
1236 }
1237 else {
1238 // Sequence Y
1239 Sequence(SEC_Y);
1240 last = 0;
1241 }
1242 }
1243 b >>= 1;
1244
1245 }
1246
1247 // Predefined parity bit, the flipper flips when needed, because of flips in byte sent
1248 if(((parity >> (len - i - 1)) & 1)) {
1249 // Sequence X
1250 Sequence(SEC_X);
1251 last = 1;
1252 } else {
1253 if(last == 0) {
1254 // Sequence Z
1255 Sequence(SEC_Z);
1256 }
1257 else {
1258 // Sequence Y
1259 Sequence(SEC_Y);
1260 last = 0;
1261 }
1262 }
1263 }
1264
1265 // End of Communication
1266 if(last == 0) {
1267 // Sequence Z
1268 Sequence(SEC_Z);
1269 }
1270 else {
1271 // Sequence Y
1272 Sequence(SEC_Y);
1273 last = 0;
1274 }
1275 // Sequence Y
1276 Sequence(SEC_Y);
1277
1278 // Just to be sure!
1279 Sequence(SEC_Y);
1280 Sequence(SEC_Y);
1281 Sequence(SEC_Y);
1282
1283 // Convert from last character reference to length
1284 ToSendMax++;
1285 }
1286
1287 //-----------------------------------------------------------------------------
1288 // Code a 7-bit command without parity bit
1289 // This is especially for 0x26 and 0x52 (REQA and WUPA)
1290 //-----------------------------------------------------------------------------
1291 void ShortFrameFromReader(const BYTE *cmd)
1292 {
1293 int j;
1294 int last;
1295 BYTE b;
1296
1297 ToSendReset();
1298
1299 // Start of Communication (Seq. Z)
1300 Sequence(SEC_Z);
1301 last = 0;
1302
1303 b = cmd[0];
1304 for(j = 0; j < 7; j++) {
1305 if(b & 1) {
1306 // Sequence X
1307 Sequence(SEC_X);
1308 last = 1;
1309 } else {
1310 if(last == 0) {
1311 // Sequence Z
1312 Sequence(SEC_Z);
1313 }
1314 else {
1315 // Sequence Y
1316 Sequence(SEC_Y);
1317 last = 0;
1318 }
1319 }
1320 b >>= 1;
1321 }
1322
1323 // End of Communication
1324 if(last == 0) {
1325 // Sequence Z
1326 Sequence(SEC_Z);
1327 }
1328 else {
1329 // Sequence Y
1330 Sequence(SEC_Y);
1331 last = 0;
1332 }
1333 // Sequence Y
1334 Sequence(SEC_Y);
1335
1336 // Just to be sure!
1337 Sequence(SEC_Y);
1338 Sequence(SEC_Y);
1339 Sequence(SEC_Y);
1340
1341 // Convert from last character reference to length
1342 ToSendMax++;
1343 }
1344
1345 //-----------------------------------------------------------------------------
1346 // Prepare reader command to send to FPGA
1347 //
1348 //-----------------------------------------------------------------------------
1349 void CodeIso14443aAsReader(const BYTE *cmd, int len)
1350 {
1351 int i, j;
1352 int last;
1353 int oddparity;
1354 BYTE b;
1355
1356 ToSendReset();
1357
1358 // Start of Communication (Seq. Z)
1359 Sequence(SEC_Z);
1360 last = 0;
1361
1362 for(i = 0; i < len; i++) {
1363 // Data bits
1364 b = cmd[i];
1365 oddparity = 0x01;
1366 for(j = 0; j < 8; j++) {
1367 oddparity ^= (b & 1);
1368 if(b & 1) {
1369 // Sequence X
1370 Sequence(SEC_X);
1371 last = 1;
1372 } else {
1373 if(last == 0) {
1374 // Sequence Z
1375 Sequence(SEC_Z);
1376 }
1377 else {
1378 // Sequence Y
1379 Sequence(SEC_Y);
1380 last = 0;
1381 }
1382 }
1383 b >>= 1;
1384 }
1385
1386 // Parity bit
1387 if(oddparity) {
1388 // Sequence X
1389 Sequence(SEC_X);
1390 last = 1;
1391 } else {
1392 if(last == 0) {
1393 // Sequence Z
1394 Sequence(SEC_Z);
1395 }
1396 else {
1397 // Sequence Y
1398 Sequence(SEC_Y);
1399 last = 0;
1400 }
1401 }
1402 }
1403
1404 // End of Communication
1405 if(last == 0) {
1406 // Sequence Z
1407 Sequence(SEC_Z);
1408 }
1409 else {
1410 // Sequence Y
1411 Sequence(SEC_Y);
1412 last = 0;
1413 }
1414 // Sequence Y
1415 Sequence(SEC_Y);
1416
1417 // Just to be sure!
1418 Sequence(SEC_Y);
1419 Sequence(SEC_Y);
1420 Sequence(SEC_Y);
1421
1422 // Convert from last character reference to length
1423 ToSendMax++;
1424 }
1425
1426
1427 //-----------------------------------------------------------------------------
1428 // Wait a certain time for tag response
1429 // If a response is captured return TRUE
1430 // If it takes to long return FALSE
1431 //-----------------------------------------------------------------------------
1432 static BOOL GetIso14443aAnswerFromTag(BYTE *receivedResponse, int maxLen, int *samples, int *elapsed) //BYTE *buffer
1433 {
1434 // buffer needs to be 512 bytes
1435 int c;
1436
1437 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1438 // only, since we are receiving, not transmitting).
1439 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1440
1441 // Now get the answer from the card
1442 Demod.output = receivedResponse;
1443 Demod.len = 0;
1444 Demod.state = DEMOD_UNSYNCD;
1445
1446 BYTE b;
1447 *elapsed = 0;
1448
1449 c = 0;
1450 for(;;) {
1451 WDT_HIT();
1452
1453 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
1454 SSC_TRANSMIT_HOLDING = 0x00; // To make use of exact timing of next command from reader!!
1455 (*elapsed)++;
1456 }
1457 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
1458 if(c < 512) { c++; } else { return FALSE; }
1459 b = (BYTE)SSC_RECEIVE_HOLDING;
1460 if(ManchesterDecoding((b & 0xf0) >> 4)) {
1461 *samples = ((c - 1) << 3) + 4;
1462 return TRUE;
1463 }
1464 if(ManchesterDecoding(b & 0x0f)) {
1465 *samples = c << 3;
1466 return TRUE;
1467 }
1468 }
1469 }
1470 }
1471
1472 //-----------------------------------------------------------------------------
1473 // Read an ISO 14443a tag. Send out commands and store answers.
1474 //
1475 //-----------------------------------------------------------------------------
1476 void ReaderIso14443a(DWORD parameter)
1477 {
1478 // Anticollision
1479 static const BYTE cmd1[] = { 0x52 }; // or 0x26
1480 static const BYTE cmd2[] = { 0x93,0x20 };
1481 // UID = 0x2a,0x69,0x8d,0x43,0x8d, last two bytes are CRC bytes
1482 BYTE cmd3[] = { 0x93,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1483
1484 // For Ultralight add an extra anticollission layer -> 95 20 and then 95 70
1485
1486 // greg - here we will add our cascade level 2 anticolission and select functions to deal with ultralight // and 7-byte UIDs in generall...
1487 BYTE cmd4[] = {0x95,0x20}; // ask for cascade 2 select
1488 // 95 20
1489 //BYTE cmd3a[] = { 0x95,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1490 // 95 70
1491
1492 // cascade 2 select
1493 BYTE cmd5[] = { 0x95,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1494
1495
1496 // RATS (request for answer to select)
1497 //BYTE cmd6[] = { 0xe0,0x50,0xbc,0xa5 }; // original RATS
1498 BYTE cmd6[] = { 0xe0,0x21,0xb2,0xc7 }; // Desfire RATS
1499
1500 int reqaddr = 2024; // was 2024 - tied to other size changes
1501 int reqsize = 60;
1502
1503 BYTE *req1 = (((BYTE *)BigBuf) + reqaddr);
1504 int req1Len;
1505
1506 BYTE *req2 = (((BYTE *)BigBuf) + reqaddr + reqsize);
1507 int req2Len;
1508
1509 BYTE *req3 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 2));
1510 int req3Len;
1511
1512 // greg added req 4 & 5 to deal with cascade 2 section
1513 BYTE *req4 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 3));
1514 int req4Len;
1515
1516 BYTE *req5 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 4));
1517 int req5Len;
1518
1519 BYTE *req6 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 5));
1520 int req6Len;
1521
1522 //BYTE *req7 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 6));
1523 //int req7Len;
1524
1525 BYTE *receivedAnswer = (((BYTE *)BigBuf) + 3560); // was 3560 - tied to other size changes
1526
1527 BYTE *trace = (BYTE *)BigBuf;
1528 int traceLen = 0;
1529 int rsamples = 0;
1530
1531 memset(trace, 0x44, 2000); // was 2000 - tied to oter size chnages
1532 // setting it to 3000 causes no tag responses to be detected (2900 is ok)
1533 // setting it to 1000 causes no tag responses to be detected
1534
1535 // Prepare some commands!
1536 ShortFrameFromReader(cmd1);
1537 memcpy(req1, ToSend, ToSendMax); req1Len = ToSendMax;
1538
1539 CodeIso14443aAsReader(cmd2, sizeof(cmd2));
1540 memcpy(req2, ToSend, ToSendMax); req2Len = ToSendMax;
1541
1542 CodeIso14443aAsReader(cmd3, sizeof(cmd3));
1543 memcpy(req3, ToSend, ToSendMax); req3Len = ToSendMax;
1544
1545
1546 CodeIso14443aAsReader(cmd4, sizeof(cmd4)); // 4 is cascade 2 request
1547 memcpy(req4, ToSend, ToSendMax); req4Len = ToSendMax;
1548
1549
1550 CodeIso14443aAsReader(cmd5, sizeof(cmd5)); // 5 is cascade 2 select
1551 memcpy(req5, ToSend, ToSendMax); req5Len = ToSendMax;
1552
1553
1554 CodeIso14443aAsReader(cmd6, sizeof(cmd6));
1555 memcpy(req6, ToSend, ToSendMax); req6Len = ToSendMax;
1556
1557 // Setup SSC
1558 FpgaSetupSsc();
1559
1560 // Start from off (no field generated)
1561 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1562 SpinDelay(200);
1563
1564 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1565 FpgaSetupSsc();
1566
1567 // Now give it time to spin up.
1568 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1569 SpinDelay(200);
1570
1571 LED_A_ON();
1572 LED_B_OFF();
1573 LED_C_OFF();
1574 LED_D_OFF();
1575
1576 int samples = 0;
1577 int tsamples = 0;
1578 int wait = 0;
1579 int elapsed = 0;
1580
1581 for(;;) {
1582 // Send WUPA (or REQA)
1583 TransmitFor14443a(req1, req1Len, &tsamples, &wait);
1584 // Store answer in buffer
1585 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1586 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1587 trace[traceLen++] = 1;
1588 memcpy(trace+traceLen, cmd1, 1);
1589 traceLen += 1;
1590 if(traceLen > TRACE_LENGTH) goto done;
1591
1592 while(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1593 if(BUTTON_PRESS()) goto done;
1594
1595 // No answer, just continue polling
1596 TransmitFor14443a(req1, req1Len, &tsamples, &wait);
1597 // Store answer in buffer
1598 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1599 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1600 trace[traceLen++] = 1;
1601 memcpy(trace+traceLen, cmd1, 1);
1602 traceLen += 1;
1603 if(traceLen > TRACE_LENGTH) goto done;
1604 }
1605
1606 // Store answer in buffer
1607 rsamples = rsamples + (samples - Demod.samples);
1608 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1609 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1610 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1611 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1612 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1613 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1614 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1615 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1616 trace[traceLen++] = Demod.len;
1617 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1618 traceLen += Demod.len;
1619 if(traceLen > TRACE_LENGTH) goto done;
1620
1621 // Ask for card UID
1622 TransmitFor14443a(req2, req2Len, &tsamples, &wait);
1623 // Store answer in buffer
1624 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1625 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1626 trace[traceLen++] = 2;
1627 memcpy(trace+traceLen, cmd2, 2);
1628 traceLen += 2;
1629 if(traceLen > TRACE_LENGTH) goto done;
1630
1631 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1632 continue;
1633 }
1634
1635 // Store answer in buffer
1636 rsamples = rsamples + (samples - Demod.samples);
1637 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1638 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1639 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1640 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1641 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1642 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1643 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1644 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1645 trace[traceLen++] = Demod.len;
1646 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1647 traceLen += Demod.len;
1648 if(traceLen > TRACE_LENGTH) goto done;
1649
1650 // Construct SELECT UID command
1651 // First copy the 5 bytes (Mifare Classic) after the 93 70
1652 memcpy(cmd3+2,receivedAnswer,5);
1653 // Secondly compute the two CRC bytes at the end
1654 ComputeCrc14443(CRC_14443_A, cmd3, 7, &cmd3[7], &cmd3[8]);
1655 // Prepare the bit sequence to modulate the subcarrier
1656 // Store answer in buffer
1657 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1658 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1659 trace[traceLen++] = 9;
1660 memcpy(trace+traceLen, cmd3, 9);
1661 traceLen += 9;
1662 if(traceLen > TRACE_LENGTH) goto done;
1663 CodeIso14443aAsReader(cmd3, sizeof(cmd3));
1664 memcpy(req3, ToSend, ToSendMax); req3Len = ToSendMax;
1665
1666 // Select the card
1667 TransmitFor14443a(req3, req3Len, &samples, &wait);
1668 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1669 continue;
1670 }
1671
1672 // Store answer in buffer
1673 rsamples = rsamples + (samples - Demod.samples);
1674 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1675 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1676 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1677 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1678 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1679 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1680 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1681 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1682 trace[traceLen++] = Demod.len;
1683 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1684 traceLen += Demod.len;
1685 if(traceLen > TRACE_LENGTH) goto done;
1686
1687 // OK we have selected at least at cascade 1, lets see if first byte of UID was 0x88 in
1688 // which case we need to make a cascade 2 request and select - this is a long UID
1689 if (receivedAnswer[0] = 0x88)
1690 {
1691 // Do cascade level 2 stuff
1692 ///////////////////////////////////////////////////////////////////
1693 // First issue a '95 20' identify request
1694 // Ask for card UID (part 2)
1695 TransmitFor14443a(req4, req4Len, &tsamples, &wait);
1696 // Store answer in buffer
1697 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1698 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1699 trace[traceLen++] = 2;
1700 memcpy(trace+traceLen, cmd4, 2);
1701 traceLen += 2;
1702 if(traceLen > TRACE_LENGTH) {
1703 DbpString("Bugging out, just popped tracelength");
1704 goto done;}
1705
1706 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1707 continue;
1708 }
1709 // Store answer in buffer
1710 rsamples = rsamples + (samples - Demod.samples);
1711 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1712 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1713 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1714 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1715 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1716 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1717 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1718 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1719 trace[traceLen++] = Demod.len;
1720 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1721 traceLen += Demod.len;
1722 if(traceLen > TRACE_LENGTH) goto done;
1723 //////////////////////////////////////////////////////////////////
1724 // Then Construct SELECT UID (cascasde 2) command
1725 DbpString("Just about to copy the UID out of the cascade 2 id req");
1726 // First copy the 5 bytes (Mifare Classic) after the 95 70
1727 memcpy(cmd5+2,receivedAnswer,5);
1728 // Secondly compute the two CRC bytes at the end
1729 ComputeCrc14443(CRC_14443_A, cmd4, 7, &cmd5[7], &cmd5[8]);
1730 // Prepare the bit sequence to modulate the subcarrier
1731 // Store answer in buffer
1732 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1733 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1734 trace[traceLen++] = 9;
1735 memcpy(trace+traceLen, cmd5, 9);
1736 traceLen += 9;
1737 if(traceLen > TRACE_LENGTH) goto done;
1738 CodeIso14443aAsReader(cmd5, sizeof(cmd5));
1739 memcpy(req5, ToSend, ToSendMax); req5Len = ToSendMax;
1740
1741 // Select the card
1742 TransmitFor14443a(req4, req4Len, &samples, &wait);
1743 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1744 continue;
1745 }
1746
1747 // Store answer in buffer
1748 rsamples = rsamples + (samples - Demod.samples);
1749 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1750 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1751 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1752 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1753 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1754 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1755 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1756 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1757 trace[traceLen++] = Demod.len;
1758 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1759 traceLen += Demod.len;
1760 if(traceLen > TRACE_LENGTH) goto done;
1761
1762
1763
1764
1765
1766
1767 }
1768
1769
1770
1771 // Secondly compute the two CRC bytes at the end
1772 ComputeCrc14443(CRC_14443_A, cmd5, 2, &cmd5[2], &cmd5[3]);
1773 // Send authentication request (Mifare Classic)
1774 TransmitFor14443a(req5, req5Len, &samples, &wait);
1775 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1776 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1777 trace[traceLen++] = 4;
1778 memcpy(trace+traceLen, cmd5, 4);
1779 traceLen += 4;
1780 if(traceLen > TRACE_LENGTH) goto done;
1781 if(GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1782 rsamples++;
1783 // We received probably a random, continue and trace!
1784 }
1785 else {
1786 // Received nothing
1787 continue;
1788 }
1789
1790 // Trace the random, i'm curious
1791 rsamples = rsamples + (samples - Demod.samples);
1792 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1793 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1794 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1795 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1796 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1797 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1798 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1799 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1800 trace[traceLen++] = Demod.len;
1801 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1802 traceLen += Demod.len;
1803 if(traceLen > TRACE_LENGTH) goto done;
1804
1805 // Thats it...
1806 }
1807
1808 done:
1809 LED_A_OFF();
1810 LED_B_OFF();
1811 LED_C_OFF();
1812 LED_D_OFF();
1813 DbpIntegers(rsamples, 0xCC, 0xCC);
1814 DbpString("ready..");
1815 }
Proxmark3 GIT tracking
Impressum, Datenschutz