X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/6658905f18a1eebc148836f26c731dea9c1377dc..6949aca9fa0e37539fc277bac78e3d7a22117467:/armsrc/iso14443a.c diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index a687d877..dbada076 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -5,7 +5,7 @@ //----------------------------------------------------------------------------- #include #include "apps.h" -#include "..\common\iso14443_crc.c" +#include "../common/iso14443_crc.c" typedef enum { SEC_D = 1, @@ -516,8 +516,8 @@ void SnoopIso14443a(void) #define RECV_RES_OFFSET 3096 #define DMA_BUFFER_OFFSET 3160 #define DMA_BUFFER_SIZE 4096 - #define TRACE_LENGTH 3000 - + #define TRACE_LENGTH 3000 + // #define RECV_CMD_OFFSET 2032 // original (working as of 21/2/09) values // #define RECV_RES_OFFSET 2096 // original (working as of 21/2/09) values // #define DMA_BUFFER_OFFSET 2160 // original (working as of 21/2/09) values @@ -567,6 +567,8 @@ void SnoopIso14443a(void) Uart.state = STATE_UNSYNCD; // And put the FPGA in the appropriate mode + // Signal field is off with the appropriate LED + LED_D_OFF(); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER); SetAdcMuxFor(GPIO_MUXSEL_HIPKD); @@ -581,7 +583,7 @@ void SnoopIso14443a(void) // And now we loop, receiving samples. for(;;) { WDT_HIT(); - int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) & + int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1); if(behindBy > maxBehindBy) { maxBehindBy = behindBy; @@ -598,8 +600,8 @@ void SnoopIso14443a(void) if(upTo - dmaBuf > DMA_BUFFER_SIZE) { upTo -= DMA_BUFFER_SIZE; lastRxCounter += DMA_BUFFER_SIZE; - PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo; - PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE; + AT91C_BASE_PDC_SSC->PDC_RNPR = (DWORD)upTo; + AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE; } samples += 4; @@ -670,7 +672,7 @@ void SnoopIso14443a(void) DbpIntegers(Uart.byteCntMax, traceLen, (int)Uart.output[0]); done: - PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE; + AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt); DbpIntegers(Uart.byteCntMax, traceLen, (int)Uart.output[0]); LED_A_OFF(); @@ -841,6 +843,8 @@ static BOOL GetIso14443aCommandFromReader(BYTE *received, int *len, int maxLen) { // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen // only, since we are receiving, not transmitting). + // Signal field is off with the appropriate LED + LED_D_OFF(); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN); // Now run a `software UART' on the stream of incoming samples. @@ -853,11 +857,11 @@ static BOOL GetIso14443aCommandFromReader(BYTE *received, int *len, int maxLen) if(BUTTON_PRESS()) return FALSE; - if(SSC_STATUS & (SSC_STATUS_TX_READY)) { - SSC_TRANSMIT_HOLDING = 0x00; + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { + AT91C_BASE_SSC->SSC_THR = 0x00; } - if(SSC_STATUS & (SSC_STATUS_RX_READY)) { - BYTE b = (BYTE)SSC_RECEIVE_HOLDING; + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { + BYTE b = (BYTE)AT91C_BASE_SSC->SSC_RHR; if(MillerDecoding((b & 0xf0) >> 4)) { *len = Uart.byteCnt; return TRUE; @@ -893,8 +897,8 @@ void SimulateIso14443aTag(int tagType, int TagUid) // my desfire static const BYTE response2[] = { 0x88, 0x04, 0x21, 0x3f, 0x4d }; // known uid - note cascade (0x88), 2nd byte (0x04) = NXP/Phillips - - + + // When reader selects us during cascade1 it will send cmd3 //BYTE response3[] = { 0x04, 0x00, 0x00 }; // SAK Select (cascade1) successful response (ULTRALITE) BYTE response3[] = { 0x24, 0x00, 0x00 }; // SAK Select (cascade1) successful response (DESFire) @@ -909,9 +913,7 @@ static const BYTE response2a[] = { 0x51, 0x48, 0x1d, 0x80, 0x84 }; // uid - cas //BYTE response3a[] = { 0x00, 0x00, 0x00 }; // SAK Select (cascade2) successful response (ULTRALITE) BYTE response3a[] = { 0x20, 0x00, 0x00 }; // SAK Select (cascade2) successful response (DESFire) ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); - -// When reader tries to authenticate - // static const BYTE cmd5[] = { 0x60, 0x00, 0xf5, 0x7b }; + static const BYTE response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce BYTE *resp; @@ -1126,7 +1128,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); // Modulate Manchester FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD); - SSC_TRANSMIT_HOLDING = 0x00; + AT91C_BASE_SSC->SSC_THR = 0x00; FpgaSetupSsc(); // ### Transmit the response ### @@ -1134,11 +1136,11 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); b = 0x00; fdt_indicator = FALSE; for(;;) { - if(SSC_STATUS & (SSC_STATUS_RX_READY)) { - volatile BYTE b = (BYTE)SSC_RECEIVE_HOLDING; + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { + volatile BYTE b = (BYTE)AT91C_BASE_SSC->SSC_RHR; (void)b; } - if(SSC_STATUS & (SSC_STATUS_TX_READY)) { + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { if(i > respLen) { b = 0x00; u++; @@ -1146,7 +1148,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); b = resp[i]; i++; } - SSC_TRANSMIT_HOLDING = b; + AT91C_BASE_SSC->SSC_THR = b; if(u > 4) { break; @@ -1175,12 +1177,12 @@ static void TransmitFor14443a(const BYTE *cmd, int len, int *samples, int *wait) if(*wait < 10) { *wait = 10; } for(c = 0; c < *wait;) { - if(SSC_STATUS & (SSC_STATUS_TX_READY)) { - SSC_TRANSMIT_HOLDING = 0x00; // For exact timing! + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { + AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing! c++; } - if(SSC_STATUS & (SSC_STATUS_RX_READY)) { - volatile DWORD r = SSC_RECEIVE_HOLDING; + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { + volatile DWORD r = AT91C_BASE_SSC->SSC_RHR; (void)r; } WDT_HIT(); @@ -1188,15 +1190,15 @@ static void TransmitFor14443a(const BYTE *cmd, int len, int *samples, int *wait) c = 0; for(;;) { - if(SSC_STATUS & (SSC_STATUS_TX_READY)) { - SSC_TRANSMIT_HOLDING = cmd[c]; + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { + AT91C_BASE_SSC->SSC_THR = cmd[c]; c++; if(c >= len) { break; } } - if(SSC_STATUS & (SSC_STATUS_RX_READY)) { - volatile DWORD r = SSC_RECEIVE_HOLDING; + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { + volatile DWORD r = AT91C_BASE_SSC->SSC_RHR; (void)r; } WDT_HIT(); @@ -1434,8 +1436,10 @@ static BOOL GetIso14443aAnswerFromTag(BYTE *receivedResponse, int maxLen, int *s // buffer needs to be 512 bytes int c; - // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen + // Set FPGA mode to "reader listen mode", no modulation (listen // only, since we are receiving, not transmitting). + // Signal field is on with the appropriate LED + LED_D_ON(); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN); // Now get the answer from the card @@ -1450,13 +1454,13 @@ static BOOL GetIso14443aAnswerFromTag(BYTE *receivedResponse, int maxLen, int *s for(;;) { WDT_HIT(); - if(SSC_STATUS & (SSC_STATUS_TX_READY)) { - SSC_TRANSMIT_HOLDING = 0x00; // To make use of exact timing of next command from reader!! + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { + AT91C_BASE_SSC->SSC_THR = 0x00; // To make use of exact timing of next command from reader!! (*elapsed)++; } - if(SSC_STATUS & (SSC_STATUS_RX_READY)) { + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { if(c < 512) { c++; } else { return FALSE; } - b = (BYTE)SSC_RECEIVE_HOLDING; + b = (BYTE)AT91C_BASE_SSC->SSC_RHR; if(ManchesterDecoding((b & 0xf0) >> 4)) { *samples = ((c - 1) << 3) + 4; return TRUE; @@ -1497,6 +1501,9 @@ void ReaderIso14443a(DWORD parameter) //BYTE cmd6[] = { 0xe0,0x50,0xbc,0xa5 }; // original RATS BYTE cmd6[] = { 0xe0,0x21,0xb2,0xc7 }; // Desfire RATS + // Mifare AUTH + BYTE cmd7[] = { 0x60, 0x00, 0x00, 0x00 }; + int reqaddr = 2024; // was 2024 - tied to other size changes int reqsize = 60; @@ -1519,8 +1526,8 @@ void ReaderIso14443a(DWORD parameter) BYTE *req6 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 5)); int req6Len; - //BYTE *req7 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 6)); - //int req7Len; + BYTE *req7 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 6)); + int req7Len; BYTE *receivedAnswer = (((BYTE *)BigBuf) + 3560); // was 3560 - tied to other size changes @@ -1528,7 +1535,7 @@ void ReaderIso14443a(DWORD parameter) int traceLen = 0; int rsamples = 0; - memset(trace, 0x44, 2000); // was 2000 - tied to oter size chnages + memset(trace, 0x44, 2000); // was 2000 - tied to oter size chnages // setting it to 3000 causes no tag responses to be detected (2900 is ok) // setting it to 1000 causes no tag responses to be detected @@ -1558,6 +1565,8 @@ void ReaderIso14443a(DWORD parameter) FpgaSetupSsc(); // Start from off (no field generated) + // Signal field is off with the appropriate LED + LED_D_OFF(); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); SpinDelay(200); @@ -1565,13 +1574,14 @@ void ReaderIso14443a(DWORD parameter) FpgaSetupSsc(); // Now give it time to spin up. + // Signal field is on with the appropriate LED + LED_D_ON(); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); SpinDelay(200); LED_A_ON(); LED_B_OFF(); LED_C_OFF(); - LED_D_OFF(); int samples = 0; int tsamples = 0; @@ -1684,9 +1694,9 @@ void ReaderIso14443a(DWORD parameter) traceLen += Demod.len; if(traceLen > TRACE_LENGTH) goto done; -// OK we have selected at least at cascade 1, lets see if first byte of UID was 0x88 in +// OK we have selected at least at cascade 1, lets see if first byte of UID was 0x88 in // which case we need to make a cascade 2 request and select - this is a long UID - if (receivedAnswer[0] = 0x88) + if (receivedAnswer[0] == 0x88) { // Do cascade level 2 stuff /////////////////////////////////////////////////////////////////// @@ -1759,23 +1769,18 @@ void ReaderIso14443a(DWORD parameter) traceLen += Demod.len; if(traceLen > TRACE_LENGTH) goto done; - - - - - - } - - + } // Secondly compute the two CRC bytes at the end - ComputeCrc14443(CRC_14443_A, cmd5, 2, &cmd5[2], &cmd5[3]); + ComputeCrc14443(CRC_14443_A, cmd7, 2, &cmd7[2], &cmd7[3]); + CodeIso14443aAsReader(cmd7, sizeof(cmd7)); + memcpy(req7, ToSend, ToSendMax); req7Len = ToSendMax; // Send authentication request (Mifare Classic) - TransmitFor14443a(req5, req5Len, &samples, &wait); + TransmitFor14443a(req7, req7Len, &samples, &wait); trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 4; - memcpy(trace+traceLen, cmd5, 4); + memcpy(trace+traceLen, cmd7, 4); traceLen += 4; if(traceLen > TRACE_LENGTH) goto done; if(GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) { @@ -1806,10 +1811,8 @@ void ReaderIso14443a(DWORD parameter) } done: - LED_A_OFF(); - LED_B_OFF(); - LED_C_OFF(); - LED_D_OFF(); + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + LEDsoff(); DbpIntegers(rsamples, 0xCC, 0xCC); DbpString("ready.."); }