git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

2 // Jonathan Westhues, split Nov 2006

3 // piwi 2018

4 //

5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

6 // at your option, any later version. See the LICENSE.txt file for the text of

7 // the license.

8 //-----------------------------------------------------------------------------

9 // Routines to support ISO 14443B. This includes both the reader software and

10 // the `fake tag' modes.

11 //-----------------------------------------------------------------------------

13 #include "iso14443b.h"

15 #include "proxmark3.h"

16 #include "apps.h"

17 #include "usb_cdc.h"

18 #include "util.h"

19 #include "string.h"

20 #include "iso14443crc.h"

21 #include "fpgaloader.h"

22 #include "BigBuf.h"

24 #define RECEIVE_SAMPLES_TIMEOUT 64 // TR0 max is 256/fs = 256/(848kHz) = 302us or 64 samples from FPGA

25 #define ISO14443B_DMA_BUFFER_SIZE 128

27 // PCB Block number for APDUs

28 static uint8_t pcb_blocknum = 0;

30 //=============================================================================

31 // An ISO 14443 Type B tag. We listen for commands from the reader, using

32 // a UART kind of thing that's implemented in software. When we get a

33 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.

34 // If it's good, then we can do something appropriate with it, and send

35 // a response.

36 //=============================================================================

38 //-----------------------------------------------------------------------------

39 // Code up a string of octets at layer 2 (including CRC, we don't generate

40 // that here) so that they can be transmitted to the reader. Doesn't transmit

41 // them yet, just leaves them ready to send in ToSend[].

42 //-----------------------------------------------------------------------------

 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)

44 {

45 int i;

47 ToSendReset();

49 // Transmit a burst of ones, as the initial thing that lets the

50 // reader get phase sync. This (TR1) must be > 80/fs, per spec,

51 // but tag that I've tried (a Paypass) exceeds that by a fair bit,

52 // so I will too.

         for(i = 0; i < 20; i++) {

54 ToSendStuffBit(1);

55 ToSendStuffBit(1);

56 ToSendStuffBit(1);

57 ToSendStuffBit(1);

58 }

60 // Send SOF.

         for(i = 0; i < 10; i++) {

62 ToSendStuffBit(0);

63 ToSendStuffBit(0);

64 ToSendStuffBit(0);

65 ToSendStuffBit(0);

66 }

         for(i = 0; i < 2; i++) {

68 ToSendStuffBit(1);

69 ToSendStuffBit(1);

70 ToSendStuffBit(1);

71 ToSendStuffBit(1);

72 }

         for(i = 0; i < len; i++) {

75 int j;

76 uint8_t b = cmd[i];

78 // Start bit

79 ToSendStuffBit(0);

80 ToSendStuffBit(0);

81 ToSendStuffBit(0);

82 ToSendStuffBit(0);

84 // Data bits

                 for(j = 0; j < 8; j++) {

                         if(b & 1) {

87 ToSendStuffBit(1);

88 ToSendStuffBit(1);

89 ToSendStuffBit(1);

90 ToSendStuffBit(1);

91 } else {

92 ToSendStuffBit(0);

93 ToSendStuffBit(0);

94 ToSendStuffBit(0);

95 ToSendStuffBit(0);

96 }

97 b >>= 1;

98 }

100 // Stop bit

101 ToSendStuffBit(1);

102 ToSendStuffBit(1);

103 ToSendStuffBit(1);

104 ToSendStuffBit(1);

105 }

106

107 // Send EOF.

         for(i = 0; i < 10; i++) {

109 ToSendStuffBit(0);

110 ToSendStuffBit(0);

111 ToSendStuffBit(0);

112 ToSendStuffBit(0);

113 }

         for(i = 0; i < 2; i++) {

115 ToSendStuffBit(1);

116 ToSendStuffBit(1);

117 ToSendStuffBit(1);

118 ToSendStuffBit(1);

119 }

120

121 // Convert from last byte pos to length

122 ToSendMax++;

123 }

124

125 //-----------------------------------------------------------------------------

126 // The software UART that receives commands from the reader, and its state

127 // variables.

128 //-----------------------------------------------------------------------------

129 static struct {

130 enum {

131 STATE_UNSYNCD,

132 STATE_GOT_FALLING_EDGE_OF_SOF,

133 STATE_AWAITING_START_BIT,

134 STATE_RECEIVING_DATA

135 } state;

136 uint16_t shiftReg;

137 int bitCnt;

138 int byteCnt;

139 int byteCntMax;

140 int posCnt;

141 uint8_t *output;

142 } Uart;

143

144 /* Receive & handle a bit coming from the reader.

145 *

146 * This function is called 4 times per bit (every 2 subcarrier cycles).

147 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us

148 *

149 * LED handling:

150 * LED A -> ON once we have received the SOF and are expecting the rest.

151 * LED A -> OFF once we have received EOF or are in error state or unsynced

152 *

153 * Returns: true if we received a EOF

154 * false if we are still waiting for some more

155 */

 static RAMFUNC int Handle14443bUartBit(uint8_t bit)

157 {

158 switch(Uart.state) {

159 case STATE_UNSYNCD:

160 if(!bit) {

161 // we went low, so this could be the beginning

162 // of an SOF

163 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;

164 Uart.posCnt = 0;

165 Uart.bitCnt = 0;

166 }

167 break;

168

169 case STATE_GOT_FALLING_EDGE_OF_SOF:

170 Uart.posCnt++;

                         if(Uart.posCnt == 2) {  // sample every 4 1/fs in the middle of a bit

172 if(bit) {

                                         if(Uart.bitCnt > 9) {

174 // we've seen enough consecutive

175 // zeros that it's a valid SOF

176 Uart.posCnt = 0;

177 Uart.byteCnt = 0;

178 Uart.state = STATE_AWAITING_START_BIT;

179 LED_A_ON(); // Indicate we got a valid SOF

180 } else {

181 // didn't stay down long enough

182 // before going high, error

183 Uart.state = STATE_UNSYNCD;

184 }

185 } else {

186 // do nothing, keep waiting

187 }

188 Uart.bitCnt++;

189 }

                         if(Uart.posCnt >= 4) Uart.posCnt = 0;

                         if(Uart.bitCnt > 12) {

192 // Give up if we see too many zeros without

193 // a one, too.

194 LED_A_OFF();

195 Uart.state = STATE_UNSYNCD;

196 }

197 break;

198

199 case STATE_AWAITING_START_BIT:

200 Uart.posCnt++;

201 if(bit) {

                                 if(Uart.posCnt > 50/2) {        // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs

203 // stayed high for too long between

204 // characters, error

205 Uart.state = STATE_UNSYNCD;

206 }

207 } else {

208 // falling edge, this starts the data byte

209 Uart.posCnt = 0;

210 Uart.bitCnt = 0;

211 Uart.shiftReg = 0;

212 Uart.state = STATE_RECEIVING_DATA;

213 }

214 break;

215

216 case STATE_RECEIVING_DATA:

217 Uart.posCnt++;

                         if(Uart.posCnt == 2) {

219 // time to sample a bit

220 Uart.shiftReg >>= 1;

221 if(bit) {

222 Uart.shiftReg |= 0x200;

223 }

224 Uart.bitCnt++;

225 }

                         if(Uart.posCnt >= 4) {

227 Uart.posCnt = 0;

228 }

                         if(Uart.bitCnt == 10) {

                                 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))

231 {

232 // this is a data byte, with correct

233 // start and stop bits

                                         Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;

235 Uart.byteCnt++;

236

                                         if(Uart.byteCnt >= Uart.byteCntMax) {

238 // Buffer overflowed, give up

239 LED_A_OFF();

240 Uart.state = STATE_UNSYNCD;

241 } else {

242 // so get the next byte now

243 Uart.posCnt = 0;

244 Uart.state = STATE_AWAITING_START_BIT;

245 }

                                 } else if (Uart.shiftReg == 0x000) {

247 // this is an EOF byte

248 LED_A_OFF(); // Finished receiving

249 Uart.state = STATE_UNSYNCD;

                                         if (Uart.byteCnt != 0) {

251 return true;

252 }

253 } else {

254 // this is an error

255 LED_A_OFF();

256 Uart.state = STATE_UNSYNCD;

257 }

258 }

259 break;

260

261 default:

262 LED_A_OFF();

263 Uart.state = STATE_UNSYNCD;

264 break;

265 }

266

267 return false;

268 }

269

270

271 static void UartReset()

272 {

273 Uart.byteCntMax = MAX_FRAME_SIZE;

274 Uart.state = STATE_UNSYNCD;

275 Uart.byteCnt = 0;

276 Uart.bitCnt = 0;

277 }

278

279

 static void UartInit(uint8_t *data)

281 {

282 Uart.output = data;

283 UartReset();

284 }

285

286

287 //-----------------------------------------------------------------------------

288 // Receive a command (from the reader to us, where we are the simulated tag),

289 // and store it in the given buffer, up to the given maximum length. Keeps

290 // spinning, waiting for a well-framed command, until either we get one

291 // (returns true) or someone presses the pushbutton on the board (false).

292 //

293 // Assume that we're called with the SSC (to the FPGA) and ADC path set

294 // correctly.

295 //-----------------------------------------------------------------------------

 static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len)

297 {

298 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen

299 // only, since we are receiving, not transmitting).

300 // Signal field is off with the appropriate LED

301 LED_D_OFF();

302 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);

303

304 // Now run a `software UART' on the stream of incoming samples.

305 UartInit(received);

306

307 for(;;) {

308 WDT_HIT();

309

                 if(BUTTON_PRESS()) return false;

311

                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

                         uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;

                         for(uint8_t mask = 0x80; mask != 0x00; mask >>= 1) {

                                 if(Handle14443bUartBit(b & mask)) {

316 *len = Uart.byteCnt;

317 return true;

318 }

319 }

320 }

321 }

322

323 return false;

324 }

325

326 //-----------------------------------------------------------------------------

327 // Main loop of simulated tag: receive commands from reader, decide what

328 // response to send, and send it.

329 //-----------------------------------------------------------------------------

 void SimulateIso14443bTag(void)

331 {

332 LED_A_ON();

333 // the only commands we understand is WUPB, AFI=0, Select All, N=1:

         static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB

335 // ... and REQB, AFI=0, Normal Request, N=1:

         static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB

337 // ... and HLTB

         static const uint8_t cmd3[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB

339 // ... and ATTRIB

         static const uint8_t cmd4[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB

341

342 // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,

343 // supports only 106kBit/s in both directions, max frame size = 32Bytes,

344 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:

345 static const uint8_t response1[] = {

                 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,

                 0x00, 0x21, 0x85, 0x5e, 0xd7

348 };

349 // response to HLTB and ATTRIB

         static const uint8_t response2[] = {0x00, 0x78, 0xF0};

351

352

353 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

354

355 clear_trace();

356 set_tracing(true);

357

358 const uint8_t *resp;

359 uint8_t *respCode;

360 uint16_t respLen, respCodeLen;

361

362 // allocate command receive buffer

363 BigBuf_free();

         uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);

365

366 uint16_t len;

367 uint16_t cmdsRecvd = 0;

368

369 // prepare the (only one) tag answer:

         CodeIso14443bAsTag(response1, sizeof(response1));

         uint8_t *resp1Code = BigBuf_malloc(ToSendMax);

         memcpy(resp1Code, ToSend, ToSendMax);

373 uint16_t resp1CodeLen = ToSendMax;

374

375 // prepare the (other) tag answer:

         CodeIso14443bAsTag(response2, sizeof(response2));

         uint8_t *resp2Code = BigBuf_malloc(ToSendMax);

         memcpy(resp2Code, ToSend, ToSendMax);

379 uint16_t resp2CodeLen = ToSendMax;

380

381 // We need to listen to the high-frequency, peak-detected path.

382 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

383 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);

384

385 cmdsRecvd = 0;

386

387 for(;;) {

388

                 if(!GetIso14443bCommandFromReader(receivedCmd, &len)) {

                         Dbprintf("button pressed, received %d commands", cmdsRecvd);

391 break;

392 }

393

                 LogTrace(receivedCmd, len, 0, 0, NULL, true);

395

396 // Good, look at the command now.

                 if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0)

                         || (len == sizeof(cmd2) && memcmp(receivedCmd, cmd2, len) == 0) ) {

399 resp = response1;

400 respLen = sizeof(response1);

401 respCode = resp1Code;

402 respCodeLen = resp1CodeLen;

                 } else if ( (len == sizeof(cmd3) && receivedCmd[0] == cmd3[0])

                         || (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) ) {

405 resp = response2;

406 respLen = sizeof(response2);

407 respCode = resp2Code;

408 respCodeLen = resp2CodeLen;

409 } else {

                         Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);

411 // And print whether the CRC fails, just for good measure

412 uint8_t b1, b2;

                         if (len >= 3){ // if crc exists

                                 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);

                                 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {

416 // Not so good, try again.

417 DbpString("+++CRC fail");

418

419 } else {

420 DbpString("CRC passes");

421 }

422 }

423 //get rid of compiler warning

424 respCodeLen = 0;

425 resp = response1;

426 respLen = 0;

427 respCode = resp1Code;

428 //don't crash at new command just wait and see if reader will send other new cmds.

429 //break;

430 }

431

432 cmdsRecvd++;

433

                 if(cmdsRecvd > 0x30) {

435 DbpString("many commands later...");

436 break;

437 }

438

                 if(respCodeLen <= 0) continue;

440

441 // Modulate BPSK

442 // Signal field is off with the appropriate LED

443 LED_D_OFF();

444 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);

445 AT91C_BASE_SSC->SSC_THR = 0xff;

446 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);

447

448 // Transmit the response.

449 uint16_t i = 0;

450 for(;;) {

                         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

452 uint8_t b = respCode[i];

453

454 AT91C_BASE_SSC->SSC_THR = b;

455

456 i++;

457 if(i > respCodeLen) {

458 break;

459 }

460 }

                         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

                                 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;

463 (void)b;

464 }

465 }

466

467 // trace the response:

                 LogTrace(resp, respLen, 0, 0, NULL, false);

469

470 }

471

472 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

473 LED_A_OFF();

474 }

475

476 //=============================================================================

477 // An ISO 14443 Type B reader. We take layer two commands, code them

478 // appropriately, and then send them to the tag. We then listen for the

479 // tag's response, which we leave in the buffer to be demodulated on the

480 // PC side.

481 //=============================================================================

482

483 static struct {

484 enum {

485 DEMOD_UNSYNCD,

486 DEMOD_PHASE_REF_TRAINING,

487 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,

488 DEMOD_GOT_FALLING_EDGE_OF_SOF,

489 DEMOD_AWAITING_START_BIT,

490 DEMOD_RECEIVING_DATA

491 } state;

492 int bitCount;

493 int posCount;

494 int thisBit;

495 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.

496 int metric;

497 int metricN;

498 */

499 uint16_t shiftReg;

500 uint8_t *output;

501 int len;

502 int sumI;

503 int sumQ;

504 } Demod;

505

506 /*

507 * Handles reception of a bit from the tag

508 *

509 * This function is called 2 times per bit (every 4 subcarrier cycles).

510 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us

511 *

512 * LED handling:

513 * LED C -> ON once we have received the SOF and are expecting the rest.

514 * LED C -> OFF once we have received EOF or are unsynced

515 *

516 * Returns: true if we received a EOF

517 * false if we are still waiting for some more

518 *

519 */

 static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)

521 {

522 int v;

523

524 // The soft decision on the bit uses an estimate of just the

525 // quadrant of the reference angle, not the exact angle.

526 #define MAKE_SOFT_DECISION() { \

527 if(Demod.sumI > 0) { \

528 v = ci; \

529 } else { \

530 v = -ci; \

531 } \

532 if(Demod.sumQ > 0) { \

533 v += cq; \

534 } else { \

535 v -= cq; \

536 } \

537 }

538

539 #define SUBCARRIER_DETECT_THRESHOLD 8

540

541 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))

542 #define AMPLITUDE(ci,cq) (MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2))

543 switch(Demod.state) {

544 case DEMOD_UNSYNCD:

                         if(AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) {    // subcarrier detected

546 Demod.state = DEMOD_PHASE_REF_TRAINING;

547 Demod.sumI = ci;

548 Demod.sumQ = cq;

549 Demod.posCount = 1;

550 }

551 break;

552

553 case DEMOD_PHASE_REF_TRAINING:

                         if(Demod.posCount < 8) {

                                 if (AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) {

556 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.

557 // note: synchronization time > 80 1/fs

558 Demod.sumI += ci;

559 Demod.sumQ += cq;

560 Demod.posCount++;

561 } else { // subcarrier lost

562 Demod.state = DEMOD_UNSYNCD;

563 }

564 } else {

565 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;

566 }

567 break;

568

569 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:

570 MAKE_SOFT_DECISION();

                         if(v < 0) {     // logic '0' detected

572 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;

                                 Demod.posCount = 0;     // start of SOF sequence

574 } else {

                                 if(Demod.posCount > 200/4) {    // maximum length of TR1 = 200 1/fs

576 Demod.state = DEMOD_UNSYNCD;

577 }

578 }

579 Demod.posCount++;

580 break;

581

582 case DEMOD_GOT_FALLING_EDGE_OF_SOF:

583 Demod.posCount++;

584 MAKE_SOFT_DECISION();

                         if(v > 0) {

                                 if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges

587 Demod.state = DEMOD_UNSYNCD;

588 } else {

589 LED_C_ON(); // Got SOF

590 Demod.posCount = 0;

591 Demod.bitCount = 0;

592 Demod.len = 0;

593 Demod.state = DEMOD_AWAITING_START_BIT;

594 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.

595 Demod.metricN = 0;

596 Demod.metric = 0;

597 */

598 }

599 } else {

                                 if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu)

601 Demod.state = DEMOD_UNSYNCD;

602 LED_C_OFF();

603 }

604 }

605 break;

606

607 case DEMOD_AWAITING_START_BIT:

608 Demod.posCount++;

609 MAKE_SOFT_DECISION();

                         if (v > 0) {

                                 if (Demod.posCount > 3*2) {             // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs

612 LED_C_OFF();

                                         if (Demod.bitCount == 0 && Demod.len == 0) { // received SOF only, this is valid for iClass/Picopass

614 return true;

615 } else {

616 Demod.state = DEMOD_UNSYNCD;

617 }

618 }

619 } else { // start bit detected

                                 Demod.posCount = 1;                             // this was the first half

621 Demod.thisBit = v;

622 Demod.shiftReg = 0;

623 Demod.state = DEMOD_RECEIVING_DATA;

624 }

625 break;

626

627 case DEMOD_RECEIVING_DATA:

628 MAKE_SOFT_DECISION();

                         if (Demod.posCount == 0) {                      // first half of bit

630 Demod.thisBit = v;

631 Demod.posCount = 1;

632 } else { // second half of bit

633 Demod.thisBit += v;

634

635 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.

636 if(Demod.thisBit > 0) {

637 Demod.metric += Demod.thisBit;

638 } else {

639 Demod.metric -= Demod.thisBit;

640 }

641 (Demod.metricN)++;

642 */

643

644 Demod.shiftReg >>= 1;

                                 if (Demod.thisBit > 0) {        // logic '1'

646 Demod.shiftReg |= 0x200;

647 }

648

649 Demod.bitCount++;

                                 if (Demod.bitCount == 10) {

651 uint16_t s = Demod.shiftReg;

                                         if ((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'

                                                 uint8_t b = (s >> 1);

                                                 Demod.output[Demod.len] = b;

655 Demod.len++;

656 Demod.bitCount = 0;

657 Demod.state = DEMOD_AWAITING_START_BIT;

658 } else {

659 Demod.state = DEMOD_UNSYNCD;

660 LED_C_OFF();

                                                 if (s == 0x000) {

662 // This is EOF (start, stop and all data bits == '0'

663 return true;

664 }

665 }

666 }

667 Demod.posCount = 0;

668 }

669 break;

670

671 default:

672 Demod.state = DEMOD_UNSYNCD;

673 LED_C_OFF();

674 break;

675 }

676

677 return false;

678 }

679

680

681 static void DemodReset()

682 {

683 // Clear out the state of the "UART" that receives from the tag.

684 Demod.len = 0;

685 Demod.state = DEMOD_UNSYNCD;

686 Demod.posCount = 0;

         memset(Demod.output, 0x00, MAX_FRAME_SIZE);

688 }

689

690

 static void DemodInit(uint8_t *data)

692 {

693 Demod.output = data;

694 DemodReset();

695 }

696

697

698 /*

699 * Demodulate the samples we received from the tag, also log to tracebuffer

700 * quiet: set to 'true' to disable debug output

701 */

 static int GetSamplesFor14443bDemod(int timeout, bool quiet) {

703 int ret = 0;

704 int maxBehindBy = 0;

705 bool gotFrame = false;

         int lastRxCounter, samples = 0;

707 int8_t ci, cq;

708

709 // Allocate memory from BigBuf for some buffers

710 // free all previous allocations first

711 BigBuf_free();

712

713 // The response (tag -> reader) that we're receiving.

         uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);

715

716 // The DMA buffer, used to stream samples from the FPGA

         uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));

718

719 // Set up the demodulator for tag -> reader responses.

720 DemodInit(receivedResponse);

721

722 // wait for last transfer to complete

         while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY))

724

725 // Setup and start DMA.

726 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

         FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);

728

729 uint16_t *upTo = dmaBuf;

730 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;

731

732 // Signal field is ON with the appropriate LED:

733 LED_D_ON();

734 // And put the FPGA in the appropriate mode

         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_848_KHZ | FPGA_HF_READER_MODE_RECEIVE_IQ);

736

737 for(;;) {

                 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);

739 if(behindBy > maxBehindBy) {

740 maxBehindBy = behindBy;

741 }

742

                 if(behindBy < 1) continue;

744

745 ci = *upTo >> 8;

746 cq = *upTo;

747 upTo++;

748 lastRxCounter--;

                 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {               // we have read all of the DMA buffer content.

750 upTo = dmaBuf; // start reading the circular buffer from the beginning

751 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;

752 }

                 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.

                         AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and

755 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers

756 }

757 samples++;

758

                 if (Handle14443bSamplesDemod(ci, cq)) {

760 ret = Demod.len;

761 gotFrame = true;

762 break;

763 }

764

                 if(samples > timeout && Demod.state < DEMOD_PHASE_REF_TRAINING) {

766 ret = -1;

767 LED_C_OFF();

768 break;

769 }

770 }

771

772 FpgaDisableSscDma();

773

         if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", maxBehindBy, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);

775

         if (ret < 0) {

777 return ret;

778 }

779 //Tracing

         LogTrace(Demod.output, Demod.len, 0, 0, NULL, false);

781

782 return ret;

783 }

784

785

786 //-----------------------------------------------------------------------------

787 // Transmit the command (to the tag) that was placed in ToSend[].

788 //-----------------------------------------------------------------------------

 static void TransmitFor14443b(void)

790 {

791 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);

792 LED_B_ON();

         for(int c = 0; c < ToSendMax; c++) {

794 uint8_t data = ToSend[c];

                 for (int i = 0; i < 8; i++) {

                         uint16_t send_word = (data & 0x80) ? 0x0000 : 0xffff;

                         while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;

798 AT91C_BASE_SSC->SSC_THR = send_word;

                         while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;

800 AT91C_BASE_SSC->SSC_THR = send_word;

801 data <<= 1;

802 }

803 WDT_HIT();

804 }

805 LED_B_OFF();

806 }

807

808

809 //-----------------------------------------------------------------------------

810 // Code a layer 2 command (string of octets, including CRC) into ToSend[],

811 // so that it is ready to transmit to the tag using TransmitFor14443b().

812 //-----------------------------------------------------------------------------

 static void CodeIso14443bAsReader(const uint8_t *cmd, int len)

814 {

815 int i, j;

816 uint8_t b;

817

818 ToSendReset();

819

820 // Send SOF

         for(i = 0; i < 10; i++) {

822 ToSendStuffBit(0);

823 }

824 ToSendStuffBit(1);

825 ToSendStuffBit(1);

826

         for(i = 0; i < len; i++) {

828 // Start bit

829 ToSendStuffBit(0);

830 // Data bits

831 b = cmd[i];

                 for(j = 0; j < 8; j++) {

                         if(b & 1) {

834 ToSendStuffBit(1);

835 } else {

836 ToSendStuffBit(0);

837 }

838 b >>= 1;

839 }

840 // Stop bit

841 ToSendStuffBit(1);

842 }

843

844 // Send EOF

         for(i = 0; i < 10; i++) {

846 ToSendStuffBit(0);

847 }

848 ToSendStuffBit(1);

849

850 // ensure that last byte is filled up

         for(i = 0; i < 8; i++) {

852 ToSendStuffBit(1);

853 }

854

855 // Convert from last character reference to length

856 ToSendMax++;

857 }

858

859

860 /**

861 Convenience function to encode, transmit and trace iso 14443b comms

862 **/

 static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)

864 {

865 CodeIso14443bAsReader(cmd, len);

866 TransmitFor14443b();

         LogTrace(cmd,len, 0, 0, NULL, true);

868 }

869

870 /* Sends an APDU to the tag

871 * TODO: check CRC and preamble

872 */

 int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response) {

874 LED_A_ON();

         uint8_t message_frame[message_length + 4];

876 // PCB

         message_frame[0] = 0x0A | pcb_blocknum;

878 pcb_blocknum ^= 1;

879 // CID

         message_frame[1] = 0;

881 // INF

         memcpy(message_frame + 2, message, message_length);

883 // EDC (CRC)

         ComputeCrc14443(CRC_14443_B, message_frame, message_length + 2, &message_frame[message_length + 2], &message_frame[message_length + 3]);

885 // send

         CodeAndTransmit14443bAsReader(message_frame, message_length + 4);

887 // get response

         int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

889 FpgaDisableTracing();

         if (ret < 3) {

891 LED_A_OFF();

892 return 0;

893 }

894 // TODO: Check CRC

895 // copy response contents

896 if (response != NULL) {

                 memcpy(response, Demod.output, Demod.len);

898 }

899 LED_A_OFF();

900 return ret;

901 }

902

903 /* Perform the ISO 14443 B Card Selection procedure

904 * Currently does NOT do any collision handling.

905 * It expects 0-1 cards in the device's range.

906 * TODO: Support multiple cards (perform anticollision)

907 * TODO: Verify CRC checksums

908 */

909 int iso14443b_select_card()

910 {

911 // WUPB command (including CRC)

912 // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state

         static const uint8_t wupb[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };

914 // ATTRIB command (with space for CRC)

         uint8_t attrib[] = { 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00};

916

917 // first, wake up the tag

         CodeAndTransmit14443bAsReader(wupb, sizeof(wupb));

         int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

920 // ATQB too short?

         if (ret < 14) {

922 return 2;

923 }

924

925 // select the tag

926 // copy the PUPI to ATTRIB

     memcpy(attrib + 1, Demod.output + 1, 4);

928 /* copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into

929 ATTRIB (Param 3) */

     attrib[7] = Demod.output[10] & 0x0F;

     ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10);

     CodeAndTransmit14443bAsReader(attrib, sizeof(attrib));

     ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

934 // Answer to ATTRIB too short?

     if (ret < 3) {

936 return 2;

937 }

938 // reset PCB block number

939 pcb_blocknum = 0;

940 return 1;

941 }

942

943 // Set up ISO 14443 Type B communication (similar to iso14443a_setup)

944 void iso14443b_setup() {

945 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

946 // Set up the synchronous serial port

947 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

948 // connect Demodulated Signal to ADC:

949 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

950

951 // Signal field is on with the appropriate LED

952 LED_D_ON();

953 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);

954

955 DemodReset();

956 UartReset();

957 }

958

959 //-----------------------------------------------------------------------------

960 // Read a SRI512 ISO 14443B tag.

961 //

962 // SRI512 tags are just simple memory tags, here we're looking at making a dump

963 // of the contents of the memory. No anticollision algorithm is done, we assume

964 // we have a single tag in the field.

965 //

966 // I tried to be systematic and check every answer of the tag, every CRC, etc...

967 //-----------------------------------------------------------------------------

 void ReadSTMemoryIso14443b(uint32_t dwLast)

969 {

970 LED_A_ON();

971 uint8_t i = 0x00;

972

973 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

974 // Make sure that we start from off, since the tags are stateful;

975 // confusing things will happen if we don't reset them between reads.

976 LED_D_OFF();

977 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

978 SpinDelay(200);

979

980 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

981 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

982

983 // Now give it time to spin up.

984 // Signal field is on with the appropriate LED

985 LED_D_ON();

986 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);

987 SpinDelay(200);

988

989 clear_trace();

990 set_tracing(true);

991

992 // First command: wake up the tag using the INITIATE command

         uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};

         CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

         int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

996

         if (ret < 0) {

998 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

999 DbpString("No response from tag");

1000 LEDsoff();

1001 return;

1002 } else {

1003 Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",

                                 Demod.output[0], Demod.output[1], Demod.output[2]);

1005 }

1006

1007 // There is a response, SELECT the uid

1008 DbpString("Now SELECT tag:");

         cmd1[0] = 0x0E; // 0x0E is SELECT

         cmd1[1] = Demod.output[0];

         ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);

         CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

         ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

         if (Demod.len != 3) {

1015 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

                 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);

1017 LEDsoff();

1018 return;

1019 }

1020 // Check the CRC of the answer:

         ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);

         if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {

1023 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1024 DbpString("CRC Error reading select response.");

1025 LEDsoff();

1026 return;

1027 }

1028 // Check response from the tag: should be the same UID as the command we just sent:

         if (cmd1[1] != Demod.output[0]) {

1030 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

                 Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);

1032 LEDsoff();

1033 return;

1034 }

1035

1036 // Tag is now selected,

1037 // First get the tag's UID:

         cmd1[0] = 0x0B;

         ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);

         CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one

         ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

         if (ret != 10) {

1043 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

                 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);

1045 LEDsoff();

1046 return;

1047 }

1048 // The check the CRC of the answer (use cmd1 as temporary variable):

         ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);

         if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {

1051 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",

                                 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);

1053 // Do not return;, let's go on... (we should retry, maybe ?)

1054 }

1055 Dbprintf("Tag UID (64 bits): %08x %08x",

                         (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],

                         (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);

1058

1059 // Now loop to read all 16 blocks, address from 0 to last block

         Dbprintf("Tag memory dump, block 0 to %d", dwLast);

         cmd1[0] = 0x08;

1062 i = 0x00;

1063 dwLast++;

1064 for (;;) {

1065 if (i == dwLast) {

1066 DbpString("System area block (0xff):");

1067 i = 0xff;

1068 }

1069 cmd1[1] = i;

                 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);

                 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

                 ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

                 if (ret != 6) { // Check if we got an answer from the tag

1074 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1075 DbpString("Expected 6 bytes from tag, got less...");

1076 LEDsoff();

1077 return;

1078 }

1079 // The check the CRC of the answer (use cmd1 as temporary variable):

                 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);

                 if (cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {

1082 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",

                                         (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);

1084 // Do not return;, let's go on... (we should retry, maybe ?)

1085 }

1086 // Now print out the memory location:

                 Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,

                                 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],

                                 (Demod.output[4]<<8)+Demod.output[5]);

                 if (i == 0xff) {

1091 break;

1092 }

1093 i++;

1094 }

1095

1096 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1097 LEDsoff();

1098 }

1099

1100

1101 //=============================================================================

1102 // Finally, the `sniffer' combines elements from both the reader and

1103 // simulated tag, to show both sides of the conversation.

1104 //=============================================================================

1105

1106 //-----------------------------------------------------------------------------

1107 // Record the sequence of commands sent by the reader to the tag, with

1108 // triggering so that we start recording at the point that the tag is moved

1109 // near the reader.

1110 //-----------------------------------------------------------------------------

1111 /*

1112 * Memory usage for this function, (within BigBuf)

1113 * Last Received command (reader->tag) - MAX_FRAME_SIZE

1114 * Last Received command (tag->reader) - MAX_FRAME_SIZE

1115 * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE

1116 * Demodulated samples received - all the rest

1117 */

 void RAMFUNC SnoopIso14443b(void)

1119 {

1120 LED_A_ON();

1121 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1122 BigBuf_free();

1123

1124 clear_trace();

1125 set_tracing(true);

1126

1127 // The DMA buffer, used to stream samples from the FPGA

         uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));

1129 int lastRxCounter;

1130 uint16_t *upTo;

1131 int8_t ci, cq;

1132 int maxBehindBy = 0;

1133

1134 // Count of samples received so far, so that we can include timing

1135 // information in the trace buffer.

1136 int samples = 0;

1137

         DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));

         UartInit(BigBuf_malloc(MAX_FRAME_SIZE));

1140

1141 // Print some debug information about the buffer sizes

1142 Dbprintf("Snooping buffers initialized:");

         Dbprintf("  Trace: %i bytes", BigBuf_max_traceLen());

         Dbprintf("  Reader -> tag: %i bytes", MAX_FRAME_SIZE);

         Dbprintf("  tag -> Reader: %i bytes", MAX_FRAME_SIZE);

         Dbprintf("  DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);

1147

1148 // Signal field is off

1149 LED_D_OFF();

1150

1151 // And put the FPGA in the appropriate mode

         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_848_KHZ | FPGA_HF_READER_MODE_SNOOP_IQ);

1153 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1154

1155 // Setup for the DMA.

1156 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

1157 upTo = dmaBuf;

1158 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;

         FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);

1160

1161 bool TagIsActive = false;

1162 bool ReaderIsActive = false;

1163 // We won't start recording the frames that we acquire until we trigger.

1164 // A good trigger condition to get started is probably when we see a

1165 // reader command

1166 bool triggered = false;

1167

1168 // And now we loop, receiving samples.

1169 for(;;) {

                 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);

1171 if(behindBy > maxBehindBy) {

1172 maxBehindBy = behindBy;

1173 }

1174

                 if(behindBy < 1) continue;

1176

1177 ci = *upTo>>8;

1178 cq = *upTo;

1179 upTo++;

1180 lastRxCounter--;

                 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {               // we have read all of the DMA buffer content.

1182 upTo = dmaBuf; // start reading the circular buffer from the beginning again

1183 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;

                         if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { 

                                 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);

1186 break;

1187 }

1188 }

                 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.

                         AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and

1191 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers

1192 WDT_HIT();

1193 if(BUTTON_PRESS()) {

1194 DbpString("cancelled");

1195 break;

1196 }

1197 }

1198

1199 samples++;

1200

1201 if (!TagIsActive) { // no need to try decoding reader data if the tag is sending

                         if(Handle14443bUartBit(ci & 0x01)) {

1203 triggered = true;

                                 LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);

1205 /* And ready to receive another command. */

1206 UartReset();

1207 /* And also reset the demod code, which might have been */

1208 /* false-triggered by the commands from the reader. */

1209 DemodReset();

1210 }

                         if(Handle14443bUartBit(cq & 0x01)) {

1212 triggered = true;

                                 LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);

1214 /* And ready to receive another command. */

1215 UartReset();

1216 /* And also reset the demod code, which might have been */

1217 /* false-triggered by the commands from the reader. */

1218 DemodReset();

1219 }

1220 ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);

1221 }

1222

                 if (!ReaderIsActive && triggered) {                                             // no need to try decoding tag data if the reader is sending or not yet triggered

                         if (Handle14443bSamplesDemod(ci/2, cq/2) >= 0) {

1225 //Use samples as a time measurement

                                 LogTrace(Demod.output, Demod.len, samples, samples, NULL, false);

1227 // And ready to receive another response.

1228 DemodReset();

1229 }

1230 TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF);

1231 }

1232

1233 }

1234

1235 FpgaDisableSscDma();

1236 DbpString("Snoop statistics:");

         Dbprintf("  Max behind by: %i", maxBehindBy);

         Dbprintf("  Uart State: %x", Uart.state);

         Dbprintf("  Uart ByteCnt: %i", Uart.byteCnt);

         Dbprintf("  Uart ByteCntMax: %i", Uart.byteCntMax);

         Dbprintf("  Trace length: %i", BigBuf_get_traceLen());

1242 LEDsoff();

1243 }

1244

1245

1246 /*

1247 * Send raw command to tag ISO14443B

1248 * @Input

1249 * datalen len of buffer data

1250 * recv bool when true wait for data from tag and send to client

1251 * powerfield bool leave the field on when true

1252 * data buffer with byte to send

1253 *

1254 * @Output

1255 * none

1256 *

1257 */

 void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])

1259 {

1260 LED_A_ON();

1261 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1262 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1263

1264 // switch field on and give tag some time to power up

1265 LED_D_ON();

1266 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);

1267 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

1268 SpinDelay(10);

1269

1270 if (datalen){

1271 set_tracing(true);

1272

1273 CodeAndTransmit14443bAsReader(data, datalen);

1274

1275 if (recv) {

                         int ret = GetSamplesFor14443bDemod(5*RECEIVE_SAMPLES_TIMEOUT, true);

1277 FpgaDisableTracing();

                         uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);

                         cmd_send(CMD_ACK, ret, 0, 0, Demod.output, iLen);

1280 }

1281

1282 FpgaDisableTracing();

1283 }

1284

1285 if (!powerfield) {

1286 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1287 LED_D_OFF();

1288 }

1289

1290 LED_A_OFF();

1291 }

1292