]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso15693.c
prettify tune output
[proxmark3-svn] / armsrc / iso15693.c
1 //-----------------------------------------------------------------------------
2 // Routines to support ISO 15693. This includes both the reader software and
3 // the `fake tag' modes, but at the moment I've implemented only the reader
4 // stuff, and that barely.
5 // Jonathan Westhues, split Nov 2006
6
7 // Modified by Greg Jones, Jan 2009 to perform modulation onboard in arm rather than on PC
8 // Also added additional reader commands (SELECT, READ etc.)
9
10 //-----------------------------------------------------------------------------
11 #include <proxmark3.h>
12 #include "apps.h"
13 #include <stdio.h>
14 #include <stdlib.h>
15
16 // FROM winsrc\prox.h //////////////////////////////////
17 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
18
19 //-----------------------------------------------------------------------------
20 // Map a sequence of octets (~layer 2 command) into the set of bits to feed
21 // to the FPGA, to transmit that command to the tag.
22 //-----------------------------------------------------------------------------
23
24
25
26
27 // The sampling rate is 106.353 ksps/s, for T = 18.8 us
28
29 // SOF defined as
30 // 1) Unmodulated time of 56.64us
31 // 2) 24 pulses of 423.75khz
32 // 3) logic '1' (unmodulated for 18.88us followed by 8 pulses of 423.75khz)
33
34 static const int FrameSOF[] = {
35 -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
36 -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
37 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
38 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
39 -1, -1, -1, -1,
40 -1, -1, -1, -1,
41 1, 1, 1, 1,
42 1, 1, 1, 1
43 };
44 static const int Logic0[] = {
45 1, 1, 1, 1,
46 1, 1, 1, 1,
47 -1, -1, -1, -1,
48 -1, -1, -1, -1
49 };
50 static const int Logic1[] = {
51 -1, -1, -1, -1,
52 -1, -1, -1, -1,
53 1, 1, 1, 1,
54 1, 1, 1, 1
55 };
56
57 // EOF defined as
58 // 1) logic '0' (8 pulses of 423.75khz followed by unmodulated for 18.88us)
59 // 2) 24 pulses of 423.75khz
60 // 3) Unmodulated time of 56.64us
61
62 static const int FrameEOF[] = {
63 1, 1, 1, 1,
64 1, 1, 1, 1,
65 -1, -1, -1, -1,
66 -1, -1, -1, -1,
67 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
68 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
69 -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
70 -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
71 };
72
73
74
75
76 static void CodeIso15693AsReader(BYTE *cmd, int n)
77 {
78 int i, j;
79
80 ToSendReset();
81
82 // Give it a bit of slack at the beginning
83 for(i = 0; i < 24; i++) {
84 ToSendStuffBit(1);
85 }
86
87 ToSendStuffBit(0);
88 ToSendStuffBit(1);
89 ToSendStuffBit(1);
90 ToSendStuffBit(1);
91 ToSendStuffBit(1);
92 ToSendStuffBit(0);
93 ToSendStuffBit(1);
94 ToSendStuffBit(1);
95 for(i = 0; i < n; i++) {
96 for(j = 0; j < 8; j += 2) {
97 int these = (cmd[i] >> j) & 3;
98 switch(these) {
99 case 0:
100 ToSendStuffBit(1);
101 ToSendStuffBit(0);
102 ToSendStuffBit(1);
103 ToSendStuffBit(1);
104 ToSendStuffBit(1);
105 ToSendStuffBit(1);
106 ToSendStuffBit(1);
107 ToSendStuffBit(1);
108 break;
109 case 1:
110 ToSendStuffBit(1);
111 ToSendStuffBit(1);
112 ToSendStuffBit(1);
113 ToSendStuffBit(0);
114 ToSendStuffBit(1);
115 ToSendStuffBit(1);
116 ToSendStuffBit(1);
117 ToSendStuffBit(1);
118 break;
119 case 2:
120 ToSendStuffBit(1);
121 ToSendStuffBit(1);
122 ToSendStuffBit(1);
123 ToSendStuffBit(1);
124 ToSendStuffBit(1);
125 ToSendStuffBit(0);
126 ToSendStuffBit(1);
127 ToSendStuffBit(1);
128 break;
129 case 3:
130 ToSendStuffBit(1);
131 ToSendStuffBit(1);
132 ToSendStuffBit(1);
133 ToSendStuffBit(1);
134 ToSendStuffBit(1);
135 ToSendStuffBit(1);
136 ToSendStuffBit(1);
137 ToSendStuffBit(0);
138 break;
139 }
140 }
141 }
142 ToSendStuffBit(1);
143 ToSendStuffBit(1);
144 ToSendStuffBit(0);
145 ToSendStuffBit(1);
146
147 // And slack at the end, too.
148 for(i = 0; i < 24; i++) {
149 ToSendStuffBit(1);
150 }
151 }
152
153 //-----------------------------------------------------------------------------
154 // The CRC used by ISO 15693.
155 //-----------------------------------------------------------------------------
156 static WORD Crc(BYTE *v, int n)
157 {
158 DWORD reg;
159 int i, j;
160
161 reg = 0xffff;
162 for(i = 0; i < n; i++) {
163 reg = reg ^ ((DWORD)v[i]);
164 for (j = 0; j < 8; j++) {
165 if (reg & 0x0001) {
166 reg = (reg >> 1) ^ 0x8408;
167 } else {
168 reg = (reg >> 1);
169 }
170 }
171 }
172
173 return ~reg;
174 }
175
176 ////////////////////////////////////////// code to do 'itoa'
177
178
179
180 /* reverse: reverse string s in place */
181 void reverse(char s[])
182 {
183 int c, i, j;
184
185 for (i = 0, j = strlen(s)-1; i<j; i++, j--) {
186 c = s[i];
187 s[i] = s[j];
188 s[j] = c;
189 }
190 }
191
192 /* itoa: convert n to characters in s */
193 void itoa(int n, char s[])
194 {
195 int i, sign;
196
197 if ((sign = n) < 0) /* record sign */
198 n = -n; /* make n positive */
199 i = 0;
200 do { /* generate digits in reverse order */
201 s[i++] = n % 10 + '0'; /* get next digit */
202 } while ((n /= 10) > 0); /* delete it */
203 if (sign < 0)
204 s[i++] = '-';
205 s[i] = '\0';
206 reverse(s);
207 }
208
209 //////////////////////////////////////// END 'itoa' CODE
210
211
212 //-----------------------------------------------------------------------------
213 // Encode (into the ToSend buffers) an identify request, which is the first
214 // thing that you must send to a tag to get a response.
215 //-----------------------------------------------------------------------------
216 static void BuildIdentifyRequest(void)
217 {
218 BYTE cmd[5];
219
220 WORD crc;
221 // one sub-carrier, inventory, 1 slot, fast rate
222 // AFI is at bit 5 (1<<4) when doing an INVENTORY
223 cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
224 // inventory command code
225 cmd[1] = 0x01;
226 // no mask
227 cmd[2] = 0x00;
228 //Now the CRC
229 crc = Crc(cmd, 3);
230 cmd[3] = crc & 0xff;
231 cmd[4] = crc >> 8;
232
233 CodeIso15693AsReader(cmd, sizeof(cmd));
234 }
235
236 static void BuildSysInfoRequest(BYTE *uid)
237 {
238 BYTE cmd[12];
239
240 WORD crc;
241 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
242 // followed by teh block data
243 // one sub-carrier, inventory, 1 slot, fast rate
244 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
245 // System Information command code
246 cmd[1] = 0x2B;
247 // UID may be optionally specified here
248 // 64-bit UID
249 cmd[2] = 0x32;
250 cmd[3]= 0x4b;
251 cmd[4] = 0x03;
252 cmd[5] = 0x01;
253 cmd[6] = 0x00;
254 cmd[7] = 0x10;
255 cmd[8] = 0x05;
256 cmd[9]= 0xe0; // always e0 (not exactly unique)
257 //Now the CRC
258 crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
259 cmd[10] = crc & 0xff;
260 cmd[11] = crc >> 8;
261
262 CodeIso15693AsReader(cmd, sizeof(cmd));
263 }
264
265 static void BuildSelectRequest( BYTE uid[])
266 {
267
268 // uid[6]=0x31; // this is getting ignored - the uid array is not happening...
269 BYTE cmd[12];
270
271 WORD crc;
272 // one sub-carrier, inventory, 1 slot, fast rate
273 //cmd[0] = (1 << 2) | (1 << 5) | (1 << 1); // INVENTROY FLAGS
274 cmd[0] = (1 << 4) | (1 << 5) | (1 << 1); // Select and addressed FLAGS
275 // SELECT command code
276 cmd[1] = 0x25;
277 // 64-bit UID
278 // cmd[2] = uid[0];//0x32;
279 // cmd[3]= uid[1];//0x4b;
280 // cmd[4] = uid[2];//0x03;
281 // cmd[5] = uid[3];//0x01;
282 // cmd[6] = uid[4];//0x00;
283 // cmd[7] = uid[5];//0x10;
284 // cmd[8] = uid[6];//0x05;
285 cmd[2] = 0x32;//
286 cmd[3]= 0x4b;
287 cmd[4] = 0x03;
288 cmd[5] = 0x01;
289 cmd[6] = 0x00;
290 cmd[7] = 0x10;
291 cmd[8] = 0x05; // infineon?
292
293 cmd[9]= 0xe0; // always e0 (not exactly unique)
294
295 // DbpIntegers(cmd[8],cmd[7],cmd[6]);
296 // Now the CRC
297 crc = Crc(cmd, 10); // the crc needs to be calculated over 10 bytes
298 cmd[10] = crc & 0xff;
299 cmd[11] = crc >> 8;
300
301 CodeIso15693AsReader(cmd, sizeof(cmd));
302 }
303
304 static void BuildReadBlockRequest(BYTE *uid, BYTE blockNumber )
305 {
306 BYTE cmd[13];
307
308 WORD crc;
309 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
310 // followed by teh block data
311 // one sub-carrier, inventory, 1 slot, fast rate
312 cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit
313 // READ BLOCK command code
314 cmd[1] = 0x20;
315 // UID may be optionally specified here
316 // 64-bit UID
317 cmd[2] = 0x32;
318 cmd[3]= 0x4b;
319 cmd[4] = 0x03;
320 cmd[5] = 0x01;
321 cmd[6] = 0x00;
322 cmd[7] = 0x10;
323 cmd[8] = 0x05;
324 cmd[9]= 0xe0; // always e0 (not exactly unique)
325 // Block number to read
326 cmd[10] = blockNumber;//0x00;
327 //Now the CRC
328 crc = Crc(cmd, 11); // the crc needs to be calculated over 2 bytes
329 cmd[11] = crc & 0xff;
330 cmd[12] = crc >> 8;
331
332 CodeIso15693AsReader(cmd, sizeof(cmd));
333 }
334
335
336 static void BuildReadMultiBlockRequest(BYTE *uid)
337 {
338 BYTE cmd[14];
339
340 WORD crc;
341 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
342 // followed by teh block data
343 // one sub-carrier, inventory, 1 slot, fast rate
344 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
345 // READ Multi BLOCK command code
346 cmd[1] = 0x23;
347 // UID may be optionally specified here
348 // 64-bit UID
349 cmd[2] = 0x32;
350 cmd[3]= 0x4b;
351 cmd[4] = 0x03;
352 cmd[5] = 0x01;
353 cmd[6] = 0x00;
354 cmd[7] = 0x10;
355 cmd[8] = 0x05;
356 cmd[9]= 0xe0; // always e0 (not exactly unique)
357 // First Block number to read
358 cmd[10] = 0x00;
359 // Number of Blocks to read
360 cmd[11] = 0x2f; // read quite a few
361 //Now the CRC
362 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
363 cmd[12] = crc & 0xff;
364 cmd[13] = crc >> 8;
365
366 CodeIso15693AsReader(cmd, sizeof(cmd));
367 }
368
369 static void BuildArbitraryRequest(BYTE *uid,BYTE CmdCode)
370 {
371 BYTE cmd[14];
372
373 WORD crc;
374 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
375 // followed by teh block data
376 // one sub-carrier, inventory, 1 slot, fast rate
377 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
378 // READ BLOCK command code
379 cmd[1] = CmdCode;
380 // UID may be optionally specified here
381 // 64-bit UID
382 cmd[2] = 0x32;
383 cmd[3]= 0x4b;
384 cmd[4] = 0x03;
385 cmd[5] = 0x01;
386 cmd[6] = 0x00;
387 cmd[7] = 0x10;
388 cmd[8] = 0x05;
389 cmd[9]= 0xe0; // always e0 (not exactly unique)
390 // Parameter
391 cmd[10] = 0x00;
392 cmd[11] = 0x0a;
393
394 // cmd[12] = 0x00;
395 // cmd[13] = 0x00; //Now the CRC
396 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
397 cmd[12] = crc & 0xff;
398 cmd[13] = crc >> 8;
399
400 CodeIso15693AsReader(cmd, sizeof(cmd));
401 }
402
403 static void BuildArbitraryCustomRequest(BYTE *uid,BYTE CmdCode)
404 {
405 BYTE cmd[14];
406
407 WORD crc;
408 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
409 // followed by teh block data
410 // one sub-carrier, inventory, 1 slot, fast rate
411 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
412 // READ BLOCK command code
413 cmd[1] = CmdCode;
414 // UID may be optionally specified here
415 // 64-bit UID
416 cmd[2] = 0x32;
417 cmd[3]= 0x4b;
418 cmd[4] = 0x03;
419 cmd[5] = 0x01;
420 cmd[6] = 0x00;
421 cmd[7] = 0x10;
422 cmd[8] = 0x05;
423 cmd[9]= 0xe0; // always e0 (not exactly unique)
424 // Parameter
425 cmd[10] = 0x05; // for custom codes this must be manufcturer code
426 cmd[11] = 0x00;
427
428 // cmd[12] = 0x00;
429 // cmd[13] = 0x00; //Now the CRC
430 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
431 cmd[12] = crc & 0xff;
432 cmd[13] = crc >> 8;
433
434 CodeIso15693AsReader(cmd, sizeof(cmd));
435 }
436
437 /////////////////////////////////////////////////////////////////////////
438 // Now the VICC>VCD responses when we are simulating a tag
439 ////////////////////////////////////////////////////////////////////
440
441 static void BuildInventoryResponse(void)
442 {
443 BYTE cmd[12];
444
445 WORD crc;
446 // one sub-carrier, inventory, 1 slot, fast rate
447 // AFI is at bit 5 (1<<4) when doing an INVENTORY
448 cmd[0] = 0; //(1 << 2) | (1 << 5) | (1 << 1);
449 cmd[1] = 0;
450 // 64-bit UID
451 cmd[2] = 0x32;
452 cmd[3]= 0x4b;
453 cmd[4] = 0x03;
454 cmd[5] = 0x01;
455 cmd[6] = 0x00;
456 cmd[7] = 0x10;
457 cmd[8] = 0x05;
458 cmd[9]= 0xe0;
459 //Now the CRC
460 crc = Crc(cmd, 10);
461 cmd[10] = crc & 0xff;
462 cmd[11] = crc >> 8;
463
464 CodeIso15693AsReader(cmd, sizeof(cmd));
465 }
466
467
468 //-----------------------------------------------------------------------------
469 // Transmit the command (to the tag) that was placed in ToSend[].
470 //-----------------------------------------------------------------------------
471 static void TransmitTo15693Tag(const BYTE *cmd, int len, int *samples, int *wait)
472 {
473 int c;
474
475 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
476 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
477 if(*wait < 10) { *wait = 10; }
478
479 // for(c = 0; c < *wait;) {
480 // if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
481 // SSC_TRANSMIT_HOLDING = 0x00; // For exact timing!
482 // c++;
483 // }
484 // if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
485 // volatile DWORD r = SSC_RECEIVE_HOLDING;
486 // (void)r;
487 // }
488 // WDT_HIT();
489 // }
490
491 c = 0;
492 for(;;) {
493 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
494 SSC_TRANSMIT_HOLDING = cmd[c];
495 c++;
496 if(c >= len) {
497 break;
498 }
499 }
500 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
501 volatile DWORD r = SSC_RECEIVE_HOLDING;
502 (void)r;
503 }
504 WDT_HIT();
505 }
506 *samples = (c + *wait) << 3;
507 }
508
509
510 //-----------------------------------------------------------------------------
511 // Transmit the command (to the reader) that was placed in ToSend[].
512 //-----------------------------------------------------------------------------
513 static void TransmitTo15693Reader(const BYTE *cmd, int len, int *samples, int *wait)
514 {
515 int c;
516
517 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
518 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR); // No requirement to energise my coils
519 if(*wait < 10) { *wait = 10; }
520
521 c = 0;
522 for(;;) {
523 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
524 SSC_TRANSMIT_HOLDING = cmd[c];
525 c++;
526 if(c >= len) {
527 break;
528 }
529 }
530 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
531 volatile DWORD r = SSC_RECEIVE_HOLDING;
532 (void)r;
533 }
534 WDT_HIT();
535 }
536 *samples = (c + *wait) << 3;
537 }
538
539
540
541
542
543
544 static int GetIso15693AnswerFromTag(BYTE *receivedResponse, int maxLen, int *samples, int *elapsed)
545 {
546 int c = 0;
547 BYTE *dest = (BYTE *)BigBuf;
548 int getNext = 0;
549
550
551 SBYTE prev = 0;
552
553 // NOW READ RESPONSE
554 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
555 //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
556 c = 0;
557 getNext = FALSE;
558 for(;;) {
559 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
560 SSC_TRANSMIT_HOLDING = 0x43;
561 }
562 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
563 SBYTE b;
564 b = (SBYTE)SSC_RECEIVE_HOLDING;
565
566 // The samples are correlations against I and Q versions of the
567 // tone that the tag AM-modulates, so every other sample is I,
568 // every other is Q. We just want power, so abs(I) + abs(Q) is
569 // close to what we want.
570 if(getNext) {
571 SBYTE r;
572
573 if(b < 0) {
574 r = -b;
575 } else {
576 r = b;
577 }
578 if(prev < 0) {
579 r -= prev;
580 } else {
581 r += prev;
582 }
583
584 dest[c++] = (BYTE)r;
585
586 if(c >= 2000) {
587 break;
588 }
589 } else {
590 prev = b;
591 }
592
593 getNext = !getNext;
594 }
595 }
596
597 //////////////////////////////////////////
598 /////////// DEMODULATE ///////////////////
599 //////////////////////////////////////////
600
601 int i, j;
602 int max = 0, maxPos;
603
604 int skip = 4;
605
606
607 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
608
609 // First, correlate for SOF
610 for(i = 0; i < 100; i++) {
611 int corr = 0;
612 for(j = 0; j < arraylen(FrameSOF); j += skip) {
613 corr += FrameSOF[j]*dest[i+(j/skip)];
614 }
615 if(corr > max) {
616 max = corr;
617 maxPos = i;
618 }
619 }
620 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
621
622 int k = 0; // this will be our return value
623
624 // greg - If correlation is less than 1 then there's little point in continuing
625 if ((max/(arraylen(FrameSOF)/skip)) >= 1)
626 {
627
628 i = maxPos + arraylen(FrameSOF)/skip;
629
630 BYTE outBuf[20];
631 memset(outBuf, 0, sizeof(outBuf));
632 BYTE mask = 0x01;
633 for(;;) {
634 int corr0 = 0, corr1 = 0, corrEOF = 0;
635 for(j = 0; j < arraylen(Logic0); j += skip) {
636 corr0 += Logic0[j]*dest[i+(j/skip)];
637 }
638 for(j = 0; j < arraylen(Logic1); j += skip) {
639 corr1 += Logic1[j]*dest[i+(j/skip)];
640 }
641 for(j = 0; j < arraylen(FrameEOF); j += skip) {
642 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
643 }
644 // Even things out by the length of the target waveform.
645 corr0 *= 4;
646 corr1 *= 4;
647
648 if(corrEOF > corr1 && corrEOF > corr0) {
649 // DbpString("EOF at %d", i);
650 break;
651 } else if(corr1 > corr0) {
652 i += arraylen(Logic1)/skip;
653 outBuf[k] |= mask;
654 } else {
655 i += arraylen(Logic0)/skip;
656 }
657 mask <<= 1;
658 if(mask == 0) {
659 k++;
660 mask = 0x01;
661 }
662 if((i+(int)arraylen(FrameEOF)) >= 2000) {
663 DbpString("ran off end!");
664 break;
665 }
666 }
667 if(mask != 0x01) {
668 DbpString("error, uneven octet! (discard extra bits!)");
669 /// DbpString(" mask=%02x", mask);
670 }
671 // BYTE str1 [8];
672 // itoa(k,str1);
673 // strcat(str1," octets read");
674
675 // DbpString( str1); // DbpString("%d octets", k);
676
677 // for(i = 0; i < k; i+=3) {
678 // //DbpString("# %2d: %02x ", i, outBuf[i]);
679 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
680 // }
681
682 for(i = 0; i < k; i++) {
683 receivedResponse[i] = outBuf[i];
684 }
685 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
686 return k; // return the number of bytes demodulated
687
688 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
689
690
691 }
692
693 // Now the GetISO15693 message from sniffing command
694 static int GetIso15693AnswerFromSniff(BYTE *receivedResponse, int maxLen, int *samples, int *elapsed)
695 {
696 int c = 0;
697 BYTE *dest = (BYTE *)BigBuf;
698 int getNext = 0;
699
700
701 SBYTE prev = 0;
702
703 // NOW READ RESPONSE
704 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
705 //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
706 c = 0;
707 getNext = FALSE;
708 for(;;) {
709 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
710 SSC_TRANSMIT_HOLDING = 0x43;
711 }
712 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
713 SBYTE b;
714 b = (SBYTE)SSC_RECEIVE_HOLDING;
715
716 // The samples are correlations against I and Q versions of the
717 // tone that the tag AM-modulates, so every other sample is I,
718 // every other is Q. We just want power, so abs(I) + abs(Q) is
719 // close to what we want.
720 if(getNext) {
721 SBYTE r;
722
723 if(b < 0) {
724 r = -b;
725 } else {
726 r = b;
727 }
728 if(prev < 0) {
729 r -= prev;
730 } else {
731 r += prev;
732 }
733
734 dest[c++] = (BYTE)r;
735
736 if(c >= 20000) {
737 break;
738 }
739 } else {
740 prev = b;
741 }
742
743 getNext = !getNext;
744 }
745 }
746
747 //////////////////////////////////////////
748 /////////// DEMODULATE ///////////////////
749 //////////////////////////////////////////
750
751 int i, j;
752 int max = 0, maxPos;
753
754 int skip = 4;
755
756
757 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
758
759 // First, correlate for SOF
760 for(i = 0; i < 19000; i++) {
761 int corr = 0;
762 for(j = 0; j < arraylen(FrameSOF); j += skip) {
763 corr += FrameSOF[j]*dest[i+(j/skip)];
764 }
765 if(corr > max) {
766 max = corr;
767 maxPos = i;
768 }
769 }
770 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
771
772 int k = 0; // this will be our return value
773
774 // greg - If correlation is less than 1 then there's little point in continuing
775 if ((max/(arraylen(FrameSOF)/skip)) >= 1) // THIS SHOULD BE 1
776 {
777
778 i = maxPos + arraylen(FrameSOF)/skip;
779
780 BYTE outBuf[20];
781 memset(outBuf, 0, sizeof(outBuf));
782 BYTE mask = 0x01;
783 for(;;) {
784 int corr0 = 0, corr1 = 0, corrEOF = 0;
785 for(j = 0; j < arraylen(Logic0); j += skip) {
786 corr0 += Logic0[j]*dest[i+(j/skip)];
787 }
788 for(j = 0; j < arraylen(Logic1); j += skip) {
789 corr1 += Logic1[j]*dest[i+(j/skip)];
790 }
791 for(j = 0; j < arraylen(FrameEOF); j += skip) {
792 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
793 }
794 // Even things out by the length of the target waveform.
795 corr0 *= 4;
796 corr1 *= 4;
797
798 if(corrEOF > corr1 && corrEOF > corr0) {
799 // DbpString("EOF at %d", i);
800 break;
801 } else if(corr1 > corr0) {
802 i += arraylen(Logic1)/skip;
803 outBuf[k] |= mask;
804 } else {
805 i += arraylen(Logic0)/skip;
806 }
807 mask <<= 1;
808 if(mask == 0) {
809 k++;
810 mask = 0x01;
811 }
812 if((i+(int)arraylen(FrameEOF)) >= 2000) {
813 DbpString("ran off end!");
814 break;
815 }
816 }
817 if(mask != 0x01) {
818 DbpString("error, uneven octet! (discard extra bits!)");
819 /// DbpString(" mask=%02x", mask);
820 }
821 // BYTE str1 [8];
822 // itoa(k,str1);
823 // strcat(str1," octets read");
824
825 // DbpString( str1); // DbpString("%d octets", k);
826
827 // for(i = 0; i < k; i+=3) {
828 // //DbpString("# %2d: %02x ", i, outBuf[i]);
829 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
830 // }
831
832 for(i = 0; i < k; i++) {
833 receivedResponse[i] = outBuf[i];
834 }
835 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
836 return k; // return the number of bytes demodulated
837
838 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
839
840
841 }
842
843
844
845 //-----------------------------------------------------------------------------
846 // Start to read an ISO 15693 tag. We send an identify request, then wait
847 // for the response. The response is not demodulated, just left in the buffer
848 // so that it can be downloaded to a PC and processed there.
849 //-----------------------------------------------------------------------------
850 void AcquireRawAdcSamplesIso15693(void)
851 {
852 int c = 0;
853 BYTE *dest = (BYTE *)BigBuf;
854 int getNext = 0;
855
856 SBYTE prev = 0;
857
858 BuildIdentifyRequest();
859
860 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
861
862 // Give the tags time to energize
863 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
864 SpinDelay(100);
865
866 // Now send the command
867 FpgaSetupSsc();
868 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
869
870 c = 0;
871 for(;;) {
872 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
873 SSC_TRANSMIT_HOLDING = ToSend[c];
874 c++;
875 if(c == ToSendMax+3) {
876 break;
877 }
878 }
879 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
880 volatile DWORD r = SSC_RECEIVE_HOLDING;
881 (void)r;
882 }
883 WDT_HIT();
884 }
885
886 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
887
888 c = 0;
889 getNext = FALSE;
890 for(;;) {
891 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
892 SSC_TRANSMIT_HOLDING = 0x43;
893 }
894 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
895 SBYTE b;
896 b = (SBYTE)SSC_RECEIVE_HOLDING;
897
898 // The samples are correlations against I and Q versions of the
899 // tone that the tag AM-modulates, so every other sample is I,
900 // every other is Q. We just want power, so abs(I) + abs(Q) is
901 // close to what we want.
902 if(getNext) {
903 SBYTE r;
904
905 if(b < 0) {
906 r = -b;
907 } else {
908 r = b;
909 }
910 if(prev < 0) {
911 r -= prev;
912 } else {
913 r += prev;
914 }
915
916 dest[c++] = (BYTE)r;
917
918 if(c >= 2000) {
919 break;
920 }
921 } else {
922 prev = b;
923 }
924
925 getNext = !getNext;
926 }
927 }
928 }
929
930
931
932 //-----------------------------------------------------------------------------
933 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
934 // all demodulation performed in arm rather than host. - greg
935 //-----------------------------------------------------------------------------
936 void ReaderIso15693(DWORD parameter)
937 {
938 LED_A_ON();
939 LED_B_ON();
940 LED_C_OFF();
941 LED_D_OFF();
942
943
944 //DbpString(parameter);
945
946 BYTE *receivedAnswer0 = (((BYTE *)BigBuf) + 3560); // allow 100 bytes per reponse (way too much)
947 BYTE *receivedAnswer1 = (((BYTE *)BigBuf) + 3660); //
948 BYTE *receivedAnswer2 = (((BYTE *)BigBuf) + 3760);
949 BYTE *receivedAnswer3 = (((BYTE *)BigBuf) + 3860);
950 //BYTE *TagUID= (((BYTE *)BigBuf) + 3960); // where we hold the uid for hi15reader
951 int responseLen0 = 0;
952 int responseLen1 = 0;
953 int responseLen2 = 0;
954 int responseLen3 = 0;
955
956 // Blank arrays
957 int j;
958 for(j = 0; j < 100; j++) {
959 receivedAnswer3[j] = 0;
960 receivedAnswer2[j] =0;
961 receivedAnswer1[j] = 0;
962 receivedAnswer0[j] = 0;
963 }
964
965 // Setup SSC
966 FpgaSetupSsc();
967
968 // Start from off (no field generated)
969 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
970 SpinDelay(200);
971
972 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
973 FpgaSetupSsc();
974
975 // Give the tags time to energize
976 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
977 SpinDelay(200);
978
979 LED_A_ON();
980 LED_B_OFF();
981 LED_C_OFF();
982 LED_D_OFF();
983
984 int samples = 0;
985 int tsamples = 0;
986 int wait = 0;
987 int elapsed = 0;
988
989 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
990 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
991 BYTE TagUID[7]; // where we hold the uid for hi15reader
992
993
994 // BuildIdentifyRequest();
995 // //TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
996 // TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
997 // // Now wait for a response
998 // responseLen0 = GetIso15693AnswerFromTag(receivedAnswer0, 100, &samples, &elapsed) ;
999 // if (responseLen0 >=12) // we should do a better check than this
1000 // {
1001 // // really we should check it is a valid mesg
1002 // // but for now just grab what we think is the uid
1003 // TagUID[0] = receivedAnswer0[2];
1004 // TagUID[1] = receivedAnswer0[3];
1005 // TagUID[2] = receivedAnswer0[4];
1006 // TagUID[3] = receivedAnswer0[5];
1007 // TagUID[4] = receivedAnswer0[6];
1008 // TagUID[5] = receivedAnswer0[7];
1009 // TagUID[6] = receivedAnswer0[8]; // IC Manufacturer code
1010 // DbpIntegers(TagUID[6],TagUID[5],TagUID[4]);
1011 //}
1012
1013 // Now send the IDENTIFY command
1014 BuildIdentifyRequest();
1015 //TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
1016 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
1017 // Now wait for a response
1018 responseLen1 = GetIso15693AnswerFromTag(receivedAnswer1, 100, &samples, &elapsed) ;
1019
1020 if (responseLen1 >=12) // we should do a better check than this
1021 {
1022
1023 TagUID[0] = receivedAnswer1[2];
1024 TagUID[1] = receivedAnswer1[3];
1025 TagUID[2] = receivedAnswer1[4];
1026 TagUID[3] = receivedAnswer1[5];
1027 TagUID[4] = receivedAnswer1[6];
1028 TagUID[5] = receivedAnswer1[7];
1029 TagUID[6] = receivedAnswer1[8]; // IC Manufacturer code
1030
1031 // Now send the SELECT command
1032 BuildSelectRequest(*TagUID);
1033 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
1034 // Now wait for a response
1035 responseLen2 = GetIso15693AnswerFromTag(receivedAnswer2, 100, &samples, &elapsed);
1036
1037 // Now send the MULTI READ command
1038 // BuildArbitraryRequest(*TagUID,parameter);
1039 BuildArbitraryCustomRequest(*TagUID,parameter);
1040 // BuildReadBlockRequest(*TagUID,parameter);
1041 // BuildSysInfoRequest(*TagUID);
1042 //TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
1043 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
1044 // Now wait for a response
1045 responseLen3 = GetIso15693AnswerFromTag(receivedAnswer3, 100, &samples, &elapsed) ;
1046
1047 }
1048
1049
1050
1051 BYTE str1 [4];
1052 //char str2 [200];
1053 int i;
1054
1055 itoa(responseLen1,str1);
1056 strcat(str1," octets read from IDENTIFY request");
1057 DbpString(str1);
1058 for(i = 0; i < responseLen1; i+=3) {
1059 DbpIntegers(receivedAnswer1[i],receivedAnswer1[i+1],receivedAnswer1[i+2]);
1060 }
1061
1062 itoa(responseLen2,str1);
1063 strcat(str1," octets read from SELECT request");
1064 DbpString(str1);
1065 for(i = 0; i < responseLen2; i+=3) {
1066 DbpIntegers(receivedAnswer2[i],receivedAnswer2[i+1],receivedAnswer2[i+2]);
1067 }
1068
1069 itoa(responseLen3,str1);
1070 strcat(str1," octets read from XXX request");
1071 DbpString(str1);
1072 for(i = 0; i < responseLen3; i+=3) {
1073 DbpIntegers(receivedAnswer3[i],receivedAnswer3[i+1],receivedAnswer3[i+2]);
1074 }
1075
1076
1077 // str2[0]=0;
1078 // for(i = 0; i < responseLen3; i++) {
1079 // itoa(str1,receivedAnswer3[i]);
1080 // strcat(str2,str1);
1081 // }
1082 // DbpString(str2);
1083
1084 LED_A_OFF();
1085 LED_B_OFF();
1086 LED_C_OFF();
1087 LED_D_OFF();
1088
1089
1090 }
1091
1092
1093
1094 //-----------------------------------------------------------------------------
1095 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1096 // all demodulation performed in arm rather than host. - greg
1097 //-----------------------------------------------------------------------------
1098 void SimTagIso15693(DWORD parameter)
1099 {
1100 LED_A_ON();
1101 LED_B_ON();
1102 LED_C_OFF();
1103 LED_D_OFF();
1104
1105
1106 //DbpString(parameter);
1107
1108 BYTE *receivedAnswer0 = (((BYTE *)BigBuf) + 3560); // allow 100 bytes per reponse (way too much)
1109 BYTE *receivedAnswer1 = (((BYTE *)BigBuf) + 3660); //
1110 BYTE *receivedAnswer2 = (((BYTE *)BigBuf) + 3760);
1111 BYTE *receivedAnswer3 = (((BYTE *)BigBuf) + 3860);
1112 //BYTE *TagUID= (((BYTE *)BigBuf) + 3960); // where we hold the uid for hi15reader
1113 int responseLen0 = 0;
1114 int responseLen1 = 0;
1115 int responseLen2 = 0;
1116 int responseLen3 = 0;
1117
1118 // Blank arrays
1119 int j;
1120 for(j = 0; j < 100; j++) {
1121 receivedAnswer3[j] = 0;
1122 receivedAnswer2[j] =0;
1123 receivedAnswer1[j] = 0;
1124 receivedAnswer0[j] = 0;
1125 }
1126
1127 // Setup SSC
1128 FpgaSetupSsc();
1129
1130 // Start from off (no field generated)
1131 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1132 SpinDelay(200);
1133
1134 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1135 FpgaSetupSsc();
1136
1137 // Give the tags time to energize
1138 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); // NO GOOD FOR SIM TAG!!!!
1139 SpinDelay(200);
1140
1141 LED_A_OFF();
1142 LED_B_OFF();
1143 LED_C_ON();
1144 LED_D_OFF();
1145
1146 int samples = 0;
1147 int tsamples = 0;
1148 int wait = 0;
1149 int elapsed = 0;
1150
1151 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
1152 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
1153 BYTE TagUID[7]; // where we hold the uid for hi15reader
1154
1155
1156
1157 // Now send the IDENTIFY command
1158 // BuildIdentifyRequest();
1159 // TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
1160
1161
1162 // Now wait for a command from the reader
1163 responseLen1=0;
1164 // while(responseLen1=0) {
1165 // if(BUTTON_PRESS()) break;
1166 responseLen1 = GetIso15693AnswerFromSniff(receivedAnswer1, 100, &samples, &elapsed) ;
1167 // }
1168
1169
1170 if (responseLen1 >=1) // we should do a better check than this
1171 {
1172 // Build a suitable reponse to the reader INVENTORY cocmmand
1173 BuildInventoryResponse;
1174 TransmitTo15693Reader(ToSend,ToSendMax,&tsamples, &wait);
1175
1176 // Now wait for a command from the reader
1177 // responseLen2 = GetIso15693AnswerFromTag(receivedAnswer2, 100, &samples, &elapsed);
1178
1179
1180 // Now wait for a command from the reader
1181 // responseLen3 = GetIso15693AnswerFromTag(receivedAnswer3, 100, &samples, &elapsed) ;
1182
1183 }
1184
1185
1186
1187 BYTE str1 [4];
1188 //char str2 [200];
1189 int i;
1190
1191 itoa(responseLen1,str1);
1192 strcat(str1," octets read from reader command");
1193 DbpString(str1);
1194 for(i = 0; i < responseLen1; i+=3) {
1195 DbpIntegers(receivedAnswer1[i],receivedAnswer1[i+1],receivedAnswer1[i+2]);
1196 }
1197
1198 // itoa(responseLen2,str1);
1199 // strcat(str1," octets read from SELECT request");
1200 // DbpString(str1);
1201 // for(i = 0; i < responseLen2; i+=3) {
1202 // DbpIntegers(receivedAnswer2[i],receivedAnswer2[i+1],receivedAnswer2[i+2]);
1203 // }
1204 //
1205 // itoa(responseLen3,str1);
1206 // strcat(str1," octets read from XXX request");
1207 // DbpString(str1);
1208 // for(i = 0; i < responseLen3; i+=3) {
1209 // DbpIntegers(receivedAnswer3[i],receivedAnswer3[i+1],receivedAnswer3[i+2]);
1210 // }
1211
1212
1213 // str2[0]=0;
1214 // for(i = 0; i < responseLen3; i++) {
1215 // itoa(str1,receivedAnswer3[i]);
1216 // strcat(str2,str1);
1217 // }
1218 // DbpString(str2);
1219
1220 LED_A_OFF();
1221 LED_B_OFF();
1222 LED_C_OFF();
1223 LED_D_OFF();
1224
1225
1226 }
Impressum, Datenschutz