git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443.c

   1 //-----------------------------------------------------------------------------
   2 // Jonathan Westhues, split Nov 2006
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Routines to support ISO 14443. This includes both the reader software and
   9 // the `fake tag' modes. At the moment only the Type B modulation is
  10 // supported.
  11 //-----------------------------------------------------------------------------
  12
  13 #include "proxmark3.h"
  14 #include "apps.h"
  15 #include "util.h"
  16 #include "string.h"
  17
  18 #include "iso14443crc.h"
  19
  20 //static void GetSamplesFor14443(int weTx, int n);
  21
  22 #define DEMOD_TRACE_SIZE 4096
  23 #define READER_TAG_BUFFER_SIZE 2048
  24 #define TAG_READER_BUFFER_SIZE 2048
  25 #define DEMOD_DMA_BUFFER_SIZE 1024
  26
  27 //=============================================================================
  28 // An ISO 14443 Type B tag. We listen for commands from the reader, using
  29 // a UART kind of thing that's implemented in software. When we get a
  30 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
  31 // If it's good, then we can do something appropriate with it, and send
  32 // a response.
  33 //=============================================================================
  34
  35 //-----------------------------------------------------------------------------
  36 // Code up a string of octets at layer 2 (including CRC, we don't generate
  37 // that here) so that they can be transmitted to the reader. Doesn't transmit
  38 // them yet, just leaves them ready to send in ToSend[].
  39 //-----------------------------------------------------------------------------
  40 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
  41 {
  42     int i;
  43
  44     ToSendReset();
  45
  46     // Transmit a burst of ones, as the initial thing that lets the
  47     // reader get phase sync. This (TR1) must be > 80/fs, per spec,
  48     // but tag that I've tried (a Paypass) exceeds that by a fair bit,
  49     // so I will too.
  50     for(i = 0; i < 20; i++) {
  51         ToSendStuffBit(1);
  52         ToSendStuffBit(1);
  53         ToSendStuffBit(1);
  54         ToSendStuffBit(1);
  55     }
  56
  57     // Send SOF.
  58     for(i = 0; i < 10; i++) {
  59         ToSendStuffBit(0);
  60         ToSendStuffBit(0);
  61         ToSendStuffBit(0);
  62         ToSendStuffBit(0);
  63     }
  64     for(i = 0; i < 2; i++) {
  65         ToSendStuffBit(1);
  66         ToSendStuffBit(1);
  67         ToSendStuffBit(1);
  68         ToSendStuffBit(1);
  69     }
  70
  71     for(i = 0; i < len; i++) {
  72         int j;
  73         uint8_t b = cmd[i];
  74
  75         // Start bit
  76         ToSendStuffBit(0);
  77         ToSendStuffBit(0);
  78         ToSendStuffBit(0);
  79         ToSendStuffBit(0);
  80
  81         // Data bits
  82         for(j = 0; j < 8; j++) {
  83             if(b & 1) {
  84                 ToSendStuffBit(1);
  85                 ToSendStuffBit(1);
  86                 ToSendStuffBit(1);
  87                 ToSendStuffBit(1);
  88             } else {
  89                 ToSendStuffBit(0);
  90                 ToSendStuffBit(0);
  91                 ToSendStuffBit(0);
  92                 ToSendStuffBit(0);
  93             }
  94             b >>= 1;
  95         }
  96
  97         // Stop bit
  98         ToSendStuffBit(1);
  99         ToSendStuffBit(1);
 100         ToSendStuffBit(1);
 101         ToSendStuffBit(1);
 102     }
 103
 104     // Send SOF.
 105     for(i = 0; i < 10; i++) {
 106         ToSendStuffBit(0);
 107         ToSendStuffBit(0);
 108         ToSendStuffBit(0);
 109         ToSendStuffBit(0);
 110     }
 111     for(i = 0; i < 10; i++) {
 112         ToSendStuffBit(1);
 113         ToSendStuffBit(1);
 114         ToSendStuffBit(1);
 115         ToSendStuffBit(1);
 116     }
 117
 118     // Convert from last byte pos to length
 119     ToSendMax++;
 120
 121     // Add a few more for slop
 122     ToSendMax += 2;
 123 }
 124
 125 //-----------------------------------------------------------------------------
 126 // The software UART that receives commands from the reader, and its state
 127 // variables.
 128 //-----------------------------------------------------------------------------
 129 static struct {
 130     enum {
 131         STATE_UNSYNCD,
 132         STATE_GOT_FALLING_EDGE_OF_SOF,
 133         STATE_AWAITING_START_BIT,
 134         STATE_RECEIVING_DATA,
 135         STATE_ERROR_WAIT
 136     }       state;
 137     uint16_t    shiftReg;
 138     int     bitCnt;
 139     int     byteCnt;
 140     int     byteCntMax;
 141     int     posCnt;
 142     uint8_t   *output;
 143 } Uart;
 144
 145 /* Receive & handle a bit coming from the reader.
 146  *
 147  * LED handling:
 148  * LED A -> ON once we have received the SOF and are expecting the rest.
 149  * LED A -> OFF once we have received EOF or are in error state or unsynced
 150  *
 151  * Returns: true if we received a EOF
 152  *          false if we are still waiting for some more
 153  */
 154 static int Handle14443UartBit(int bit)
 155 {
 156     switch(Uart.state) {
 157         case STATE_UNSYNCD:
 158                 LED_A_OFF();
 159             if(!bit) {
 160                 // we went low, so this could be the beginning
 161                 // of an SOF
 162                 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
 163                 Uart.posCnt = 0;
 164                 Uart.bitCnt = 0;
 165             }
 166             break;
 167
 168         case STATE_GOT_FALLING_EDGE_OF_SOF:
 169             Uart.posCnt++;
 170             if(Uart.posCnt == 2) {
 171                 if(bit) {
 172                     if(Uart.bitCnt >= 10) {
 173                         // we've seen enough consecutive
 174                         // zeros that it's a valid SOF
 175                         Uart.posCnt = 0;
 176                         Uart.byteCnt = 0;
 177                         Uart.state = STATE_AWAITING_START_BIT;
 178                         LED_A_ON(); // Indicate we got a valid SOF
 179                     } else {
 180                         // didn't stay down long enough
 181                         // before going high, error
 182                         Uart.state = STATE_ERROR_WAIT;
 183                     }
 184                 } else {
 185                     // do nothing, keep waiting
 186                 }
 187                 Uart.bitCnt++;
 188             }
 189             if(Uart.posCnt >= 4) Uart.posCnt = 0;
 190             if(Uart.bitCnt > 14) {
 191                 // Give up if we see too many zeros without
 192                 // a one, too.
 193                 Uart.state = STATE_ERROR_WAIT;
 194             }
 195             break;
 196
 197         case STATE_AWAITING_START_BIT:
 198             Uart.posCnt++;
 199             if(bit) {
 200                 if(Uart.posCnt > 25) {
 201                     // stayed high for too long between
 202                     // characters, error
 203                     Uart.state = STATE_ERROR_WAIT;
 204                 }
 205             } else {
 206                 // falling edge, this starts the data byte
 207                 Uart.posCnt = 0;
 208                 Uart.bitCnt = 0;
 209                 Uart.shiftReg = 0;
 210                 Uart.state = STATE_RECEIVING_DATA;
 211                 LED_A_ON(); // Indicate we're receiving
 212             }
 213             break;
 214
 215         case STATE_RECEIVING_DATA:
 216             Uart.posCnt++;
 217             if(Uart.posCnt == 2) {
 218                 // time to sample a bit
 219                 Uart.shiftReg >>= 1;
 220                 if(bit) {
 221                     Uart.shiftReg |= 0x200;
 222                 }
 223                 Uart.bitCnt++;
 224             }
 225             if(Uart.posCnt >= 4) {
 226                 Uart.posCnt = 0;
 227             }
 228             if(Uart.bitCnt == 10) {
 229                 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
 230                 {
 231                     // this is a data byte, with correct
 232                     // start and stop bits
 233                     Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
 234                     Uart.byteCnt++;
 235
 236                     if(Uart.byteCnt >= Uart.byteCntMax) {
 237                         // Buffer overflowed, give up
 238                         Uart.posCnt = 0;
 239                         Uart.state = STATE_ERROR_WAIT;
 240                     } else {
 241                         // so get the next byte now
 242                         Uart.posCnt = 0;
 243                         Uart.state = STATE_AWAITING_START_BIT;
 244                     }
 245                 } else if(Uart.shiftReg == 0x000) {
 246                     // this is an EOF byte
 247                         LED_A_OFF(); // Finished receiving
 248                     return TRUE;
 249                 } else {
 250                     // this is an error
 251                     Uart.posCnt = 0;
 252                     Uart.state = STATE_ERROR_WAIT;
 253                 }
 254             }
 255             break;
 256
 257         case STATE_ERROR_WAIT:
 258             // We're all screwed up, so wait a little while
 259             // for whatever went wrong to finish, and then
 260             // start over.
 261             Uart.posCnt++;
 262             if(Uart.posCnt > 10) {
 263                 Uart.state = STATE_UNSYNCD;
 264             }
 265             break;
 266
 267         default:
 268             Uart.state = STATE_UNSYNCD;
 269             break;
 270     }
 271
 272     if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error
 273
 274     return FALSE;
 275 }
 276
 277 //-----------------------------------------------------------------------------
 278 // Receive a command (from the reader to us, where we are the simulated tag),
 279 // and store it in the given buffer, up to the given maximum length. Keeps
 280 // spinning, waiting for a well-framed command, until either we get one
 281 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
 282 //
 283 // Assume that we're called with the SSC (to the FPGA) and ADC path set
 284 // correctly.
 285 //-----------------------------------------------------------------------------
 286 static int GetIso14443CommandFromReader(uint8_t *received, int *len, int maxLen)
 287 {
 288     uint8_t mask;
 289     int i, bit;
 290
 291     // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
 292     // only, since we are receiving, not transmitting).
 293     // Signal field is off with the appropriate LED
 294     LED_D_OFF();
 295     FpgaWriteConfWord(
 296         FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
 297
 298
 299     // Now run a `software UART' on the stream of incoming samples.
 300     Uart.output = received;
 301     Uart.byteCntMax = maxLen;
 302     Uart.state = STATE_UNSYNCD;
 303
 304     for(;;) {
 305         WDT_HIT();
 306
 307         if(BUTTON_PRESS()) return FALSE;
 308
 309         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 310             AT91C_BASE_SSC->SSC_THR = 0x00;
 311         }
 312         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 313             uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 314
 315             mask = 0x80;
 316             for(i = 0; i < 8; i++, mask >>= 1) {
 317                 bit = (b & mask);
 318                 if(Handle14443UartBit(bit)) {
 319                     *len = Uart.byteCnt;
 320                     return TRUE;
 321                 }
 322             }
 323         }
 324     }
 325 }
 326
 327 //-----------------------------------------------------------------------------
 328 // Main loop of simulated tag: receive commands from reader, decide what
 329 // response to send, and send it.
 330 //-----------------------------------------------------------------------------
 331 void SimulateIso14443Tag(void)
 332 {
 333     static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 334     static const uint8_t response1[] = {
 335         0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
 336         0x00, 0x21, 0x85, 0x5e, 0xd7
 337     };
 338
 339     uint8_t *resp;
 340     int respLen;
 341
 342     uint8_t *resp1 = (((uint8_t *)BigBuf) + 800);
 343     int resp1Len;
 344
 345     uint8_t *receivedCmd = (uint8_t *)BigBuf;
 346     int len;
 347
 348     int i;
 349
 350     int cmdsRecvd = 0;
 351
 352     memset(receivedCmd, 0x44, 400);
 353
 354     CodeIso14443bAsTag(response1, sizeof(response1));
 355     memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
 356
 357     // We need to listen to the high-frequency, peak-detected path.
 358     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 359     FpgaSetupSsc();
 360
 361     cmdsRecvd = 0;
 362
 363     for(;;) {
 364         uint8_t b1, b2;
 365
 366         if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {
 367                 Dbprintf("button pressed, received %d commands", cmdsRecvd);
 368                 break;
 369         }
 370
 371         // Good, look at the command now.
 372
 373         if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
 374             resp = resp1; respLen = resp1Len;
 375         } else {
 376             Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
 377             // And print whether the CRC fails, just for good measure
 378             ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
 379             if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
 380                 // Not so good, try again.
 381                 DbpString("+++CRC fail");
 382             } else {
 383                 DbpString("CRC passes");
 384             }
 385             break;
 386         }
 387
 388         memset(receivedCmd, 0x44, 32);
 389
 390         cmdsRecvd++;
 391
 392         if(cmdsRecvd > 0x30) {
 393             DbpString("many commands later...");
 394             break;
 395         }
 396
 397         if(respLen <= 0) continue;
 398
 399         // Modulate BPSK
 400         // Signal field is off with the appropriate LED
 401         LED_D_OFF();
 402         FpgaWriteConfWord(
 403                 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
 404         AT91C_BASE_SSC->SSC_THR = 0xff;
 405         FpgaSetupSsc();
 406
 407         // Transmit the response.
 408         i = 0;
 409         for(;;) {
 410             if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 411                 uint8_t b = resp[i];
 412
 413                 AT91C_BASE_SSC->SSC_THR = b;
 414
 415                 i++;
 416                 if(i > respLen) {
 417                     break;
 418                 }
 419             }
 420             if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 421                 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 422                 (void)b;
 423             }
 424         }
 425     }
 426 }
 427
 428 //=============================================================================
 429 // An ISO 14443 Type B reader. We take layer two commands, code them
 430 // appropriately, and then send them to the tag. We then listen for the
 431 // tag's response, which we leave in the buffer to be demodulated on the
 432 // PC side.
 433 //=============================================================================
 434
 435 static struct {
 436     enum {
 437         DEMOD_UNSYNCD,
 438         DEMOD_PHASE_REF_TRAINING,
 439         DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
 440         DEMOD_GOT_FALLING_EDGE_OF_SOF,
 441         DEMOD_AWAITING_START_BIT,
 442         DEMOD_RECEIVING_DATA,
 443         DEMOD_ERROR_WAIT
 444     }       state;
 445     int     bitCount;
 446     int     posCount;
 447     int     thisBit;
 448     int     metric;
 449     int     metricN;
 450     uint16_t    shiftReg;
 451     uint8_t   *output;
 452     int     len;
 453     int     sumI;
 454     int     sumQ;
 455 } Demod;
 456
 457 /*
 458  * Handles reception of a bit from the tag
 459  *
 460  * LED handling:
 461  * LED C -> ON once we have received the SOF and are expecting the rest.
 462  * LED C -> OFF once we have received EOF or are unsynced
 463  *
 464  * Returns: true if we received a EOF
 465  *          false if we are still waiting for some more
 466  *
 467  */
 468 static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)
 469 {
 470     int v;
 471
 472     // The soft decision on the bit uses an estimate of just the
 473     // quadrant of the reference angle, not the exact angle.
 474 #define MAKE_SOFT_DECISION() { \
 475         if(Demod.sumI > 0) { \
 476             v = ci; \
 477         } else { \
 478             v = -ci; \
 479         } \
 480         if(Demod.sumQ > 0) { \
 481             v += cq; \
 482         } else { \
 483             v -= cq; \
 484         } \
 485     }
 486
 487     switch(Demod.state) {
 488         case DEMOD_UNSYNCD:
 489             v = ci;
 490             if(v < 0) v = -v;
 491             if(cq > 0) {
 492                 v += cq;
 493             } else {
 494                 v -= cq;
 495             }
 496             if(v > 40) {
 497                 Demod.posCount = 0;
 498                 Demod.state = DEMOD_PHASE_REF_TRAINING;
 499                 Demod.sumI = 0;
 500                 Demod.sumQ = 0;
 501             }
 502             break;
 503
 504         case DEMOD_PHASE_REF_TRAINING:
 505             if(Demod.posCount < 8) {
 506                 Demod.sumI += ci;
 507                 Demod.sumQ += cq;
 508             } else if(Demod.posCount > 100) {
 509                 // error, waited too long
 510                 Demod.state = DEMOD_UNSYNCD;
 511             } else {
 512                 MAKE_SOFT_DECISION();
 513                 if(v < 0) {
 514                     Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
 515                     Demod.posCount = 0;
 516                 }
 517             }
 518             Demod.posCount++;
 519             break;
 520
 521         case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
 522             MAKE_SOFT_DECISION();
 523             if(v < 0) {
 524                 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
 525                 Demod.posCount = 0;
 526             } else {
 527                 if(Demod.posCount > 100) {
 528                     Demod.state = DEMOD_UNSYNCD;
 529                 }
 530             }
 531             Demod.posCount++;
 532             break;
 533
 534         case DEMOD_GOT_FALLING_EDGE_OF_SOF:
 535             MAKE_SOFT_DECISION();
 536             if(v > 0) {
 537                 if(Demod.posCount < 12) {
 538                     Demod.state = DEMOD_UNSYNCD;
 539                 } else {
 540                         LED_C_ON(); // Got SOF
 541                     Demod.state = DEMOD_AWAITING_START_BIT;
 542                     Demod.posCount = 0;
 543                     Demod.len = 0;
 544                     Demod.metricN = 0;
 545                     Demod.metric = 0;
 546                 }
 547             } else {
 548                 if(Demod.posCount > 100) {
 549                     Demod.state = DEMOD_UNSYNCD;
 550                 }
 551             }
 552             Demod.posCount++;
 553             break;
 554
 555         case DEMOD_AWAITING_START_BIT:
 556             MAKE_SOFT_DECISION();
 557             if(v > 0) {
 558                 if(Demod.posCount > 10) {
 559                     Demod.state = DEMOD_UNSYNCD;
 560                 }
 561             } else {
 562                 Demod.bitCount = 0;
 563                 Demod.posCount = 1;
 564                 Demod.thisBit = v;
 565                 Demod.shiftReg = 0;
 566                 Demod.state = DEMOD_RECEIVING_DATA;
 567             }
 568             break;
 569
 570         case DEMOD_RECEIVING_DATA:
 571             MAKE_SOFT_DECISION();
 572             if(Demod.posCount == 0) {
 573                 Demod.thisBit = v;
 574                 Demod.posCount = 1;
 575             } else {
 576                 Demod.thisBit += v;
 577
 578                 if(Demod.thisBit > 0) {
 579                     Demod.metric += Demod.thisBit;
 580                 } else {
 581                     Demod.metric -= Demod.thisBit;
 582                 }
 583                 (Demod.metricN)++;
 584
 585                 Demod.shiftReg >>= 1;
 586                 if(Demod.thisBit > 0) {
 587                     Demod.shiftReg |= 0x200;
 588                 }
 589
 590                 Demod.bitCount++;
 591                 if(Demod.bitCount == 10) {
 592                     uint16_t s = Demod.shiftReg;
 593                     if((s & 0x200) && !(s & 0x001)) {
 594                         uint8_t b = (s >> 1);
 595                         Demod.output[Demod.len] = b;
 596                         Demod.len++;
 597                         Demod.state = DEMOD_AWAITING_START_BIT;
 598                     } else if(s == 0x000) {
 599                         // This is EOF
 600                         LED_C_OFF();
 601                         return TRUE;
 602                         Demod.state = DEMOD_UNSYNCD;
 603                     } else {
 604                         Demod.state = DEMOD_UNSYNCD;
 605                     }
 606                 }
 607                 Demod.posCount = 0;
 608             }
 609             break;
 610
 611         default:
 612             Demod.state = DEMOD_UNSYNCD;
 613             break;
 614     }
 615
 616     if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...
 617     return FALSE;
 618 }
 619
 620 /*
 621  *  Demodulate the samples we received from the tag
 622  *  weTx: set to 'TRUE' if we behave like a reader
 623  *        set to 'FALSE' if we behave like a snooper
 624  *  quiet: set to 'TRUE' to disable debug output
 625  */
 626 static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
 627 {
 628     int max = 0;
 629     int gotFrame = FALSE;
 630
 631 //#   define DMA_BUFFER_SIZE 8
 632     int8_t *dmaBuf;
 633
 634     int lastRxCounter;
 635     int8_t *upTo;
 636
 637     int ci, cq;
 638
 639     int samples = 0;
 640
 641     // Clear out the state of the "UART" that receives from the tag.
 642     memset(BigBuf, 0x44, 400);
 643     Demod.output = (uint8_t *)BigBuf;
 644     Demod.len = 0;
 645     Demod.state = DEMOD_UNSYNCD;
 646
 647     // And the UART that receives from the reader
 648     Uart.output = (((uint8_t *)BigBuf) + 1024);
 649     Uart.byteCntMax = 100;
 650     Uart.state = STATE_UNSYNCD;
 651
 652     // Setup for the DMA.
 653     dmaBuf = (int8_t *)(BigBuf + 32);
 654     upTo = dmaBuf;
 655     lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
 656     FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
 657
 658     // Signal field is ON with the appropriate LED:
 659         if (weTx) LED_D_ON(); else LED_D_OFF();
 660     // And put the FPGA in the appropriate mode
 661     FpgaWriteConfWord(
 662         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
 663         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
 664
 665     for(;;) {
 666         int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
 667         if(behindBy > max) max = behindBy;
 668
 669         while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DEMOD_DMA_BUFFER_SIZE-1))
 670                     > 2)
 671         {
 672             ci = upTo[0];
 673             cq = upTo[1];
 674             upTo += 2;
 675             if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {
 676                 upTo -= DEMOD_DMA_BUFFER_SIZE;
 677                 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
 678                 AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;
 679             }
 680             lastRxCounter -= 2;
 681             if(lastRxCounter <= 0) {
 682                 lastRxCounter += DEMOD_DMA_BUFFER_SIZE;
 683             }
 684
 685             samples += 2;
 686
 687             Handle14443UartBit(1);
 688             Handle14443UartBit(1);
 689
 690             if(Handle14443SamplesDemod(ci, cq)) {
 691                 gotFrame = 1;
 692             }
 693         }
 694
 695         if(samples > 2000) {
 696             break;
 697         }
 698     }
 699     AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
 700     if (!quiet) Dbprintf("%x %x %x", max, gotFrame, Demod.len);
 701 }
 702
 703 //-----------------------------------------------------------------------------
 704 // Read the tag's response. We just receive a stream of slightly-processed
 705 // samples from the FPGA, which we will later do some signal processing on,
 706 // to get the bits.
 707 //-----------------------------------------------------------------------------
 708 /*static void GetSamplesFor14443(int weTx, int n)
 709 {
 710     uint8_t *dest = (uint8_t *)BigBuf;
 711     int c;
 712
 713     FpgaWriteConfWord(
 714         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
 715         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
 716
 717     c = 0;
 718     for(;;) {
 719         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 720             AT91C_BASE_SSC->SSC_THR = 0x43;
 721         }
 722         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 723             int8_t b;
 724             b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
 725
 726             dest[c++] = (uint8_t)b;
 727
 728             if(c >= n) {
 729                 break;
 730             }
 731         }
 732     }
 733 }*/
 734
 735 //-----------------------------------------------------------------------------
 736 // Transmit the command (to the tag) that was placed in ToSend[].
 737 //-----------------------------------------------------------------------------
 738 static void TransmitFor14443(void)
 739 {
 740     int c;
 741
 742     FpgaSetupSsc();
 743
 744     while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 745         AT91C_BASE_SSC->SSC_THR = 0xff;
 746     }
 747
 748     // Signal field is ON with the appropriate Red LED
 749         LED_D_ON();
 750         // Signal we are transmitting with the Green LED
 751         LED_B_ON();
 752         FpgaWriteConfWord(
 753         FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
 754
 755     for(c = 0; c < 10;) {
 756         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 757             AT91C_BASE_SSC->SSC_THR = 0xff;
 758             c++;
 759         }
 760         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 761             volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
 762             (void)r;
 763         }
 764         WDT_HIT();
 765     }
 766
 767     c = 0;
 768     for(;;) {
 769         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 770             AT91C_BASE_SSC->SSC_THR = ToSend[c];
 771             c++;
 772             if(c >= ToSendMax) {
 773                 break;
 774             }
 775         }
 776         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 777             volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
 778             (void)r;
 779         }
 780         WDT_HIT();
 781     }
 782     LED_B_OFF(); // Finished sending
 783 }
 784
 785 //-----------------------------------------------------------------------------
 786 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
 787 // so that it is ready to transmit to the tag using TransmitFor14443().
 788 //-----------------------------------------------------------------------------
 789 void CodeIso14443bAsReader(const uint8_t *cmd, int len)
 790 {
 791     int i, j;
 792     uint8_t b;
 793
 794     ToSendReset();
 795
 796     // Establish initial reference level
 797     for(i = 0; i < 40; i++) {
 798         ToSendStuffBit(1);
 799     }
 800     // Send SOF
 801     for(i = 0; i < 10; i++) {
 802         ToSendStuffBit(0);
 803     }
 804
 805     for(i = 0; i < len; i++) {
 806         // Stop bits/EGT
 807         ToSendStuffBit(1);
 808         ToSendStuffBit(1);
 809         // Start bit
 810         ToSendStuffBit(0);
 811         // Data bits
 812         b = cmd[i];
 813         for(j = 0; j < 8; j++) {
 814             if(b & 1) {
 815                 ToSendStuffBit(1);
 816             } else {
 817                 ToSendStuffBit(0);
 818             }
 819             b >>= 1;
 820         }
 821     }
 822     // Send EOF
 823     ToSendStuffBit(1);
 824     for(i = 0; i < 10; i++) {
 825         ToSendStuffBit(0);
 826     }
 827     for(i = 0; i < 8; i++) {
 828         ToSendStuffBit(1);
 829     }
 830
 831     // And then a little more, to make sure that the last character makes
 832     // it out before we switch to rx mode.
 833     for(i = 0; i < 24; i++) {
 834         ToSendStuffBit(1);
 835     }
 836
 837     // Convert from last character reference to length
 838     ToSendMax++;
 839 }
 840
 841 //-----------------------------------------------------------------------------
 842 // Read an ISO 14443 tag. We send it some set of commands, and record the
 843 // responses.
 844 // The command name is misleading, it actually decodes the reponse in HEX
 845 // into the output buffer (read the result using hexsamples, not hisamples)
 846 //-----------------------------------------------------------------------------
 847 void AcquireRawAdcSamplesIso14443(uint32_t parameter)
 848 {
 849     uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 850
 851     // Make sure that we start from off, since the tags are stateful;
 852     // confusing things will happen if we don't reset them between reads.
 853     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 854     LED_D_OFF();
 855     SpinDelay(200);
 856
 857     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 858     FpgaSetupSsc();
 859
 860     // Now give it time to spin up.
 861     // Signal field is on with the appropriate LED
 862     LED_D_ON();
 863     FpgaWriteConfWord(
 864         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 865     SpinDelay(200);
 866
 867     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 868     TransmitFor14443();
 869 //    LED_A_ON();
 870     GetSamplesFor14443Demod(TRUE, 2000, FALSE);
 871 //    LED_A_OFF();
 872 }
 873
 874 //-----------------------------------------------------------------------------
 875 // Read a SRI512 ISO 14443 tag.
 876 //
 877 // SRI512 tags are just simple memory tags, here we're looking at making a dump
 878 // of the contents of the memory. No anticollision algorithm is done, we assume
 879 // we have a single tag in the field.
 880 //
 881 // I tried to be systematic and check every answer of the tag, every CRC, etc...
 882 //-----------------------------------------------------------------------------
 883 void ReadSRI512Iso14443(uint32_t parameter)
 884 {
 885      ReadSTMemoryIso14443(parameter,0x0F);
 886 }
 887 void ReadSRIX4KIso14443(uint32_t parameter)
 888 {
 889      ReadSTMemoryIso14443(parameter,0x7F);
 890 }
 891
 892 void ReadSTMemoryIso14443(uint32_t parameter,uint32_t dwLast)
 893 {
 894     uint8_t i = 0x00;
 895
 896     // Make sure that we start from off, since the tags are stateful;
 897     // confusing things will happen if we don't reset them between reads.
 898     LED_D_OFF();
 899     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 900     SpinDelay(200);
 901
 902     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 903     FpgaSetupSsc();
 904
 905     // Now give it time to spin up.
 906     // Signal field is on with the appropriate LED
 907     LED_D_ON();
 908     FpgaWriteConfWord(
 909         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 910     SpinDelay(200);
 911
 912     // First command: wake up the tag using the INITIATE command
 913     uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
 914     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 915     TransmitFor14443();
 916 //    LED_A_ON();
 917     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 918 //    LED_A_OFF();
 919
 920     if (Demod.len == 0) {
 921         DbpString("No response from tag");
 922         return;
 923     } else {
 924         Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",
 925                 Demod.output[0], Demod.output[1],Demod.output[2]);
 926     }
 927     // There is a response, SELECT the uid
 928     DbpString("Now SELECT tag:");
 929     cmd1[0] = 0x0E; // 0x0E is SELECT
 930     cmd1[1] = Demod.output[0];
 931     ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 932     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 933     TransmitFor14443();
 934 //    LED_A_ON();
 935     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 936 //    LED_A_OFF();
 937     if (Demod.len != 3) {
 938         Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
 939         return;
 940     }
 941     // Check the CRC of the answer:
 942     ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
 943     if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
 944         DbpString("CRC Error reading select response.");
 945         return;
 946     }
 947     // Check response from the tag: should be the same UID as the command we just sent:
 948     if (cmd1[1] != Demod.output[0]) {
 949         Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);
 950         return;
 951     }
 952     // Tag is now selected,
 953     // First get the tag's UID:
 954     cmd1[0] = 0x0B;
 955     ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
 956     CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one
 957     TransmitFor14443();
 958 //    LED_A_ON();
 959     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 960 //    LED_A_OFF();
 961     if (Demod.len != 10) {
 962         Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
 963         return;
 964     }
 965     // The check the CRC of the answer (use cmd1 as temporary variable):
 966     ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
 967            if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
 968         Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
 969                 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
 970         // Do not return;, let's go on... (we should retry, maybe ?)
 971     }
 972     Dbprintf("Tag UID (64 bits): %08x %08x",
 973         (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
 974         (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
 975
 976     // Now loop to read all 16 blocks, address from 0 to 15
 977     DbpString("Tag memory dump, block 0 to 15");
 978     cmd1[0] = 0x08;
 979     i = 0x00;
 980     dwLast++;
 981     for (;;) {
 982            if (i == dwLast) {
 983                     DbpString("System area block (0xff):");
 984                     i = 0xff;
 985             }
 986             cmd1[1] = i;
 987             ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 988             CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 989             TransmitFor14443();
 990 //          LED_A_ON();
 991             GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 992 //          LED_A_OFF();
 993             if (Demod.len != 6) { // Check if we got an answer from the tag
 994                 DbpString("Expected 6 bytes from tag, got less...");
 995                 return;
 996             }
 997             // The check the CRC of the answer (use cmd1 as temporary variable):
 998             ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
 999             if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
1000                 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
1001                         (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
1002                 // Do not return;, let's go on... (we should retry, maybe ?)
1003             }
1004             // Now print out the memory location:
1005             Dbprintf("Address=%x, Contents=%x, CRC=%x", i,
1006                 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1007                 (Demod.output[4]<<8)+Demod.output[5]);
1008             if (i == 0xff) {
1009                 break;
1010             }
1011             i++;
1012     }
1013 }
1014
1015
1016 //=============================================================================
1017 // Finally, the `sniffer' combines elements from both the reader and
1018 // simulated tag, to show both sides of the conversation.
1019 //=============================================================================
1020
1021 //-----------------------------------------------------------------------------
1022 // Record the sequence of commands sent by the reader to the tag, with
1023 // triggering so that we start recording at the point that the tag is moved
1024 // near the reader.
1025 //-----------------------------------------------------------------------------
1026 /*
1027  * Memory usage for this function, (within BigBuf)
1028  * 0-4095 : Demodulated samples receive (4096 bytes) - DEMOD_TRACE_SIZE
1029  * 4096-6143 : Last Received command, 2048 bytes (reader->tag) - READER_TAG_BUFFER_SIZE
1030  * 6144-8191 : Last Received command, 2048 bytes(tag->reader) - TAG_READER_BUFFER_SIZE
1031  * 8192-9215 : DMA Buffer, 1024 bytes (samples) - DEMOD_DMA_BUFFER_SIZE
1032  */
1033 void RAMFUNC SnoopIso14443(void)
1034 {
1035     // We won't start recording the frames that we acquire until we trigger;
1036     // a good trigger condition to get started is probably when we see a
1037     // response from the tag.
1038     int triggered = TRUE;
1039
1040     // The command (reader -> tag) that we're working on receiving.
1041     uint8_t *receivedCmd = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE;
1042     // The response (tag -> reader) that we're working on receiving.
1043     uint8_t *receivedResponse = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE;
1044
1045     // As we receive stuff, we copy it from receivedCmd or receivedResponse
1046     // into trace, along with its length and other annotations.
1047     uint8_t *trace = (uint8_t *)BigBuf;
1048     int traceLen = 0;
1049
1050     // The DMA buffer, used to stream samples from the FPGA.
1051     int8_t *dmaBuf = (int8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE + TAG_READER_BUFFER_SIZE;
1052     int lastRxCounter;
1053     int8_t *upTo;
1054     int ci, cq;
1055     int maxBehindBy = 0;
1056
1057     // Count of samples received so far, so that we can include timing
1058     // information in the trace buffer.
1059     int samples = 0;
1060
1061     // Initialize the trace buffer
1062     memset(trace, 0x44, DEMOD_TRACE_SIZE);
1063
1064     // Set up the demodulator for tag -> reader responses.
1065     Demod.output = receivedResponse;
1066     Demod.len = 0;
1067     Demod.state = DEMOD_UNSYNCD;
1068
1069     // And the reader -> tag commands
1070     memset(&Uart, 0, sizeof(Uart));
1071     Uart.output = receivedCmd;
1072     Uart.byteCntMax = 100;
1073     Uart.state = STATE_UNSYNCD;
1074
1075         // Print some debug information about the buffer sizes
1076         Dbprintf("Snooping buffers initialized:");
1077         Dbprintf("  Trace: %i bytes", DEMOD_TRACE_SIZE);
1078         Dbprintf("  Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);
1079         Dbprintf("  tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);
1080         Dbprintf("  DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);
1081
1082
1083     // And put the FPGA in the appropriate mode
1084     // Signal field is off with the appropriate LED
1085     LED_D_OFF();
1086     FpgaWriteConfWord(
1087         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
1088         FPGA_HF_READER_RX_XCORR_SNOOP);
1089     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1090
1091     // Setup for the DMA.
1092     FpgaSetupSsc();
1093     upTo = dmaBuf;
1094     lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
1095     FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
1096
1097     LED_A_ON();
1098
1099     // And now we loop, receiving samples.
1100     for(;;) {
1101         int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
1102                                 (DEMOD_DMA_BUFFER_SIZE-1);
1103         if(behindBy > maxBehindBy) {
1104             maxBehindBy = behindBy;
1105             if(behindBy > (DEMOD_DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?
1106                 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
1107                 goto done;
1108             }
1109         }
1110         if(behindBy < 2) continue;
1111
1112         ci = upTo[0];
1113         cq = upTo[1];
1114         upTo += 2;
1115         lastRxCounter -= 2;
1116         if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {
1117             upTo -= DEMOD_DMA_BUFFER_SIZE;
1118             lastRxCounter += DEMOD_DMA_BUFFER_SIZE;
1119             AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
1120             AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;
1121         }
1122
1123         samples += 2;
1124
1125 #define HANDLE_BIT_IF_BODY \
1126             if(triggered) { \
1127                 trace[traceLen++] = ((samples >>  0) & 0xff); \
1128                 trace[traceLen++] = ((samples >>  8) & 0xff); \
1129                 trace[traceLen++] = ((samples >> 16) & 0xff); \
1130                 trace[traceLen++] = ((samples >> 24) & 0xff); \
1131                 trace[traceLen++] = 0; \
1132                 trace[traceLen++] = 0; \
1133                 trace[traceLen++] = 0; \
1134                 trace[traceLen++] = 0; \
1135                 trace[traceLen++] = Uart.byteCnt; \
1136                 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
1137                 traceLen += Uart.byteCnt; \
1138                 if(traceLen > 1000) break; \
1139             } \
1140             /* And ready to receive another command. */ \
1141             memset(&Uart, 0, sizeof(Uart)); \
1142             Uart.output = receivedCmd; \
1143             Uart.byteCntMax = 100; \
1144             Uart.state = STATE_UNSYNCD; \
1145             /* And also reset the demod code, which might have been */ \
1146             /* false-triggered by the commands from the reader. */ \
1147             memset(&Demod, 0, sizeof(Demod)); \
1148             Demod.output = receivedResponse; \
1149             Demod.state = DEMOD_UNSYNCD; \
1150
1151         if(Handle14443UartBit(ci & 1)) {
1152             HANDLE_BIT_IF_BODY
1153         }
1154         if(Handle14443UartBit(cq & 1)) {
1155             HANDLE_BIT_IF_BODY
1156         }
1157
1158         if(Handle14443SamplesDemod(ci, cq)) {
1159             // timestamp, as a count of samples
1160             trace[traceLen++] = ((samples >>  0) & 0xff);
1161             trace[traceLen++] = ((samples >>  8) & 0xff);
1162             trace[traceLen++] = ((samples >> 16) & 0xff);
1163             trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);
1164             // correlation metric (~signal strength estimate)
1165             if(Demod.metricN != 0) {
1166                 Demod.metric /= Demod.metricN;
1167             }
1168             trace[traceLen++] = ((Demod.metric >>  0) & 0xff);
1169             trace[traceLen++] = ((Demod.metric >>  8) & 0xff);
1170             trace[traceLen++] = ((Demod.metric >> 16) & 0xff);
1171             trace[traceLen++] = ((Demod.metric >> 24) & 0xff);
1172             // length
1173             trace[traceLen++] = Demod.len;
1174             memcpy(trace+traceLen, receivedResponse, Demod.len);
1175             traceLen += Demod.len;
1176             if(traceLen > DEMOD_TRACE_SIZE) {
1177                                 DbpString("Reached trace limit");
1178                                 goto done;
1179                         }
1180
1181             triggered = TRUE;
1182             LED_A_OFF();
1183             LED_B_ON();
1184
1185             // And ready to receive another response.
1186             memset(&Demod, 0, sizeof(Demod));
1187             Demod.output = receivedResponse;
1188             Demod.state = DEMOD_UNSYNCD;
1189         }
1190                 WDT_HIT();
1191
1192         if(BUTTON_PRESS()) {
1193             DbpString("cancelled");
1194             goto done;
1195         }
1196     }
1197
1198 done:
1199         LED_A_OFF();
1200         LED_B_OFF();
1201         LED_C_OFF();
1202   AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
1203         DbpString("Snoop statistics:");
1204   Dbprintf("  Max behind by: %i", maxBehindBy);
1205         Dbprintf("  Uart State: %x", Uart.state);
1206         Dbprintf("  Uart ByteCnt: %i", Uart.byteCnt);
1207         Dbprintf("  Uart ByteCntMax: %i", Uart.byteCntMax);
1208         Dbprintf("  Trace length: %i", traceLen);
1209 }