+
+static void iso14a_set_ATS_times(uint8_t *ats) {
+
+ uint8_t tb1;
+ uint8_t fwi, sfgi;
+ uint32_t fwt, sfgt;
+
+ if (ats[0] > 1) { // there is a format byte T0
+ if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
+ if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
+ tb1 = ats[3];
+ } else {
+ tb1 = ats[2];
+ }
+ fwi = (tb1 & 0xf0) >> 4; // frame waiting time integer (FWI)
+ if (fwi != 15) {
+ fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc
+ iso14a_set_timeout(fwt/(8*16));
+ }
+ sfgi = tb1 & 0x0f; // startup frame guard time integer (SFGI)
+ if (sfgi != 0 && sfgi != 15) {
+ sfgt = 256 * 16 * (1 << sfgi); // startup frame guard time (SFGT) in 1/fc
+ NextTransferTime = MAX(NextTransferTime, Demod.endTime + (sfgt - DELAY_AIR2ARM_AS_READER - DELAY_ARM2AIR_AS_READER)/16);
+ }
+ }
+ }
+}
+
+
+static int GetATQA(uint8_t *resp, uint8_t *resp_par) {
+
+#define WUPA_RETRY_TIMEOUT 10 // 10ms
+ uint8_t wupa[] = {ISO14443A_CMD_WUPA}; // 0x26 - REQA 0x52 - WAKE-UP
+
+ uint32_t save_iso14a_timeout = iso14a_get_timeout();
+ iso14a_set_timeout(1236/(16*8)+1); // response to WUPA is expected at exactly 1236/fc. No need to wait longer.
+
+ uint32_t start_time = GetTickCount();
+ int len;
+
+ // we may need several tries if we did send an unknown command or a wrong authentication before...
+ do {
+ // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
+ ReaderTransmitBitsPar(wupa, 7, NULL, NULL);
+ // Receive the ATQA
+ len = ReaderReceive(resp, resp_par);
+ } while (len == 0 && GetTickCount() <= start_time + WUPA_RETRY_TIMEOUT);
+
+ iso14a_set_timeout(save_iso14a_timeout);
+ return len;
+}
+
+
+// performs iso14443a anticollision (optional) and card select procedure
+// fills the uid and cuid pointer unless NULL
+// fills the card info record unless NULL
+// if anticollision is false, then the UID must be provided in uid_ptr[]
+// and num_cascades must be set (1: 4 Byte UID, 2: 7 Byte UID, 3: 10 Byte UID)
+// requests ATS unless no_rats is true
+int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades, bool no_rats) {
+ uint8_t sel_all[] = { 0x93,0x20 };
+ uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+ uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
+ uint8_t resp[MAX_FRAME_SIZE]; // theoretically. A usual RATS will be much smaller
+ uint8_t resp_par[MAX_PARITY_SIZE];
+ byte_t uid_resp[4];
+ size_t uid_resp_len;
+
+ uint8_t sak = 0x04; // cascade uid
+ int cascade_level = 0;
+ int len;
+
+ // init card struct
+ if (p_hi14a_card) {
+ p_hi14a_card->uidlen = 0;
+ memset(p_hi14a_card->uid, 0, 10);
+ p_hi14a_card->ats_len = 0;
+ }
+
+ if (!GetATQA(resp, resp_par)) {
+ return 0;
+ }
+
+ if (p_hi14a_card) {
+ memcpy(p_hi14a_card->atqa, resp, 2);
+ }
+
+ if (anticollision) {
+ // clear uid
+ if (uid_ptr) {
+ memset(uid_ptr,0,10);
+ }
+ }
+
+ // check for proprietary anticollision:
+ if ((resp[0] & 0x1F) == 0) {
+ return 3;
+ }
+
+ // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
+ // which case we need to make a cascade 2 request and select - this is a long UID
+ // While the UID is not complete, the 3rd bit (from the right) is set in the SAK.
+ for (; sak & 0x04; cascade_level++) {
+ // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
+ sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
+
+ if (anticollision) {
+ // SELECT_ALL
+ ReaderTransmit(sel_all, sizeof(sel_all), NULL);
+ if (!ReaderReceive(resp, resp_par)) {
+ return 0;
+ }
+
+ if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
+ memset(uid_resp, 0, 4);
+ uint16_t uid_resp_bits = 0;
+ uint16_t collision_answer_offset = 0;
+ // anti-collision-loop:
+ while (Demod.collisionPos) {
+ Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
+ for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
+ uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
+ uid_resp[uid_resp_bits / 8] |= UIDbit << (uid_resp_bits % 8);
+ }
+ uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
+ uid_resp_bits++;
+ // construct anticollosion command:
+ sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
+ for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
+ sel_uid[2+i] = uid_resp[i];
+ }
+ collision_answer_offset = uid_resp_bits%8;
+ ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
+ if (!ReaderReceiveOffset(resp, collision_answer_offset, resp_par)) {
+ return 0;
+ }
+ }
+ // finally, add the last bits and BCC of the UID
+ for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
+ uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
+ uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
+ }
+
+ } else { // no collision, use the response to SELECT_ALL as current uid
+ memcpy(uid_resp, resp, 4);
+ }
+ } else {
+ if (cascade_level < num_cascades - 1) {
+ uid_resp[0] = 0x88;
+ memcpy(uid_resp+1, uid_ptr+cascade_level*3, 3);
+ } else {
+ memcpy(uid_resp, uid_ptr+cascade_level*3, 4);
+ }
+ }
+ uid_resp_len = 4;
+
+ // calculate crypto UID. Always use last 4 Bytes.
+ if(cuid_ptr) {
+ *cuid_ptr = bytes_to_num(uid_resp, 4);
+ }
+
+ // Construct SELECT UID command
+ sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
+ memcpy(sel_uid+2, uid_resp, 4); // the UID received during anticollision, or the provided UID
+ sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
+ AppendCrc14443a(sel_uid, 7); // calculate and add CRC
+ ReaderTransmit(sel_uid, sizeof(sel_uid), NULL);
+
+ // Receive the SAK
+ if (!ReaderReceive(resp, resp_par)) {
+ return 0;
+ }
+ sak = resp[0];
+
+ // Test if more parts of the uid are coming
+ if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
+ // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
+ // http://www.nxp.com/documents/application_note/AN10927.pdf
+ uid_resp[0] = uid_resp[1];
+ uid_resp[1] = uid_resp[2];
+ uid_resp[2] = uid_resp[3];
+ uid_resp_len = 3;
+ }
+
+ if(uid_ptr && anticollision) {
+ memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
+ }
+
+ if(p_hi14a_card) {
+ memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
+ p_hi14a_card->uidlen += uid_resp_len;
+ }
+ }
+
+ if(p_hi14a_card) {
+ p_hi14a_card->sak = sak;
+ }
+
+ // PICC compilant with iso14443a-4 ---> (SAK & 0x20 != 0)
+ if( (sak & 0x20) == 0) return 2;
+
+ if (!no_rats) {
+ // Request for answer to select
+ AppendCrc14443a(rats, 2);
+ ReaderTransmit(rats, sizeof(rats), NULL);
+
+ if (!(len = ReaderReceive(resp, resp_par))) {
+ return 0;
+ }
+
+ if(p_hi14a_card) {
+ memcpy(p_hi14a_card->ats, resp, len);
+ p_hi14a_card->ats_len = len;
+ }
+
+ // reset the PCB block number
+ iso14_pcb_blocknum = 0;
+
+ // set default timeout and delay next transfer based on ATS
+ iso14a_set_ATS_times(resp);
+
+ }
+ return 1;
+}
+
+
+void iso14443a_setup(uint8_t fpga_minor_mode) {
+ FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+ // Set up the synchronous serial port
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
+ // connect Demodulated Signal to ADC:
+ SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+
+ // Signal field is on with the appropriate LED
+ if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
+ || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
+ LED_D_ON();
+ } else {
+ LED_D_OFF();
+ }
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
+
+ // Set ADC to read field strength
+ AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
+ AT91C_BASE_ADC->ADC_MR =
+ ADC_MODE_PRESCALE(63) |
+ ADC_MODE_STARTUP_TIME(1) |
+ ADC_MODE_SAMPLE_HOLD_TIME(15);
+ AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF_LOW);
+
+ // Start the timer
+ StartCountSspClk();
+
+ DemodReset();
+ UartReset();
+ LastTimeProxToAirStart = 0;
+ FpgaSendQueueDelay = 0;
+ LastProxToAirDuration = 20; // arbitrary small value. Avoid lock in EmGetCmd()
+ NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
+ iso14a_set_timeout(1060); // 10ms default
+}
+
+/* Peter Fillmore 2015
+Added card id field to the function
+ info from ISO14443A standard
+b1 = Block Number
+b2 = RFU (always 1)
+b3 = depends on block
+b4 = Card ID following if set to 1
+b5 = depends on block type
+b6 = depends on block type
+b7,b8 = block type.
+Coding of I-BLOCK:
+b8 b7 b6 b5 b4 b3 b2 b1
+0 0 0 x x x 1 x
+b5 = chaining bit
+Coding of R-block:
+b8 b7 b6 b5 b4 b3 b2 b1
+1 0 1 x x 0 1 x
+b5 = ACK/NACK
+Coding of S-block:
+b8 b7 b6 b5 b4 b3 b2 b1
+1 1 x x x 0 1 0
+b5,b6 = 00 - DESELECT
+ 11 - WTX
+*/
+int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, bool send_chaining, void *data, uint8_t *res) {
+ uint8_t parity[MAX_PARITY_SIZE];
+ uint8_t real_cmd[cmd_len + 4];
+
+ if (cmd_len) {
+ // ISO 14443 APDU frame: PCB [CID] [NAD] APDU CRC PCB=0x02
+ real_cmd[0] = 0x02; // bnr,nad,cid,chn=0; i-block(0x00)
+ if (send_chaining) {
+ real_cmd[0] |= 0x10;
+ }
+ // put block number into the PCB
+ real_cmd[0] |= iso14_pcb_blocknum;
+ memcpy(real_cmd + 1, cmd, cmd_len);
+ } else {
+ // R-block. ACK
+ real_cmd[0] = 0xA2; // r-block + ACK
+ real_cmd[0] |= iso14_pcb_blocknum;
+ }
+ AppendCrc14443a(real_cmd, cmd_len + 1);
+
+ ReaderTransmit(real_cmd, cmd_len + 3, NULL);
+
+ size_t len = ReaderReceive(data, parity);
+ uint8_t *data_bytes = (uint8_t *) data;
+
+ if (!len) {
+ return 0; //DATA LINK ERROR
+ } else {
+ // S-Block WTX
+ while (len && ((data_bytes[0] & 0xF2) == 0xF2)) {
+ uint32_t save_iso14a_timeout = iso14a_get_timeout();
+ // temporarily increase timeout
+ iso14a_set_timeout(MAX((data_bytes[1] & 0x3f) * save_iso14a_timeout, MAX_ISO14A_TIMEOUT));
+ // Transmit WTX back
+ // byte1 - WTXM [1..59]. command FWT=FWT*WTXM
+ data_bytes[1] = data_bytes[1] & 0x3f; // 2 high bits mandatory set to 0b
+ // now need to fix CRC.
+ AppendCrc14443a(data_bytes, len - 2);
+ // transmit S-Block
+ ReaderTransmit(data_bytes, len, NULL);
+ // retrieve the result again (with increased timeout)
+ len = ReaderReceive(data, parity);
+ data_bytes = data;
+ // restore timeout
+ iso14a_set_timeout(save_iso14a_timeout);
+ }
+
+ // if we received an I- or R(ACK)-Block with a block number equal to the
+ // current block number, toggle the current block number
+ if (len >= 3 // PCB+CRC = 3 bytes
+ && ((data_bytes[0] & 0xC0) == 0 // I-Block
+ || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
+ && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
+ {
+ iso14_pcb_blocknum ^= 1;
+ }
+
+ // if we received I-block with chaining we need to send ACK and receive another block of data
+ if (res)
+ *res = data_bytes[0];
+
+ // crc check
+ if (len >= 3 && !CheckCrc14443(CRC_14443_A, data_bytes, len)) {
+ return -1;
+ }
+
+ }
+
+ if (len) {
+ // cut frame byte
+ len -= 1;
+ // memmove(data_bytes, data_bytes + 1, len);
+ for (int i = 0; i < len; i++)
+ data_bytes[i] = data_bytes[i + 1];
+ }
+
+ return len;
+}
+
+
projects / proxmark3-svn / blobdiff