]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/iso14443a.c
ADD: @marshmellow42 's 14b fixes.
[proxmark3-svn] / armsrc / iso14443a.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
b62a5a84 2// Merlok - June 2011, 2012
15c4dc5a 3// Gerhard de Koning Gans - May 2008
534983d7 4// Hagen Fritsch - June 2010
bd20f8f4 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
15c4dc5a 9//-----------------------------------------------------------------------------
bd20f8f4 10// Routines to support ISO 14443 type A.
11//-----------------------------------------------------------------------------
12
e30c654b 13#include "proxmark3.h"
15c4dc5a 14#include "apps.h"
f7e3ed82 15#include "util.h"
9ab7a6c7 16#include "string.h"
902cb3c0 17#include "cmd.h"
15c4dc5a 18#include "iso14443crc.h"
534983d7 19#include "iso14443a.h"
20f9a2a1
M
20#include "crapto1.h"
21#include "mifareutil.h"
3000dc4e 22#include "BigBuf.h"
534983d7 23static uint32_t iso14a_timeout;
1e262141 24int rsamples = 0;
1e262141 25uint8_t trigger = 0;
b0127e65 26// the block number for the ISO14443-4 PCB
27static uint8_t iso14_pcb_blocknum = 0;
15c4dc5a 28
7bc95e2e 29//
30// ISO14443 timing:
31//
32// minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
33#define REQUEST_GUARD_TIME (7000/16 + 1)
34// minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
35#define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
36// bool LastCommandWasRequest = FALSE;
37
38//
39// Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
40//
d714d3ef 41// When the PM acts as reader and is receiving tag data, it takes
42// 3 ticks delay in the AD converter
43// 16 ticks until the modulation detector completes and sets curbit
44// 8 ticks until bit_to_arm is assigned from curbit
45// 8*16 ticks for the transfer from FPGA to ARM
7bc95e2e 46// 4*16 ticks until we measure the time
47// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 48#define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
7bc95e2e 49
50// When the PM acts as a reader and is sending, it takes
51// 4*16 ticks until we can write data to the sending hold register
52// 8*16 ticks until the SHR is transferred to the Sending Shift Register
53// 8 ticks until the first transfer starts
54// 8 ticks later the FPGA samples the data
55// 1 tick to assign mod_sig_coil
56#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
57
58// When the PM acts as tag and is receiving it takes
d714d3ef 59// 2 ticks delay in the RF part (for the first falling edge),
7bc95e2e 60// 3 ticks for the A/D conversion,
61// 8 ticks on average until the start of the SSC transfer,
62// 8 ticks until the SSC samples the first data
63// 7*16 ticks to complete the transfer from FPGA to ARM
64// 8 ticks until the next ssp_clk rising edge
d714d3ef 65// 4*16 ticks until we measure the time
7bc95e2e 66// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 67#define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
7bc95e2e 68
69// The FPGA will report its internal sending delay in
70uint16_t FpgaSendQueueDelay;
71// the 5 first bits are the number of bits buffered in mod_sig_buf
72// the last three bits are the remaining ticks/2 after the mod_sig_buf shift
73#define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
74
75// When the PM acts as tag and is sending, it takes
d714d3ef 76// 4*16 ticks until we can write data to the sending hold register
7bc95e2e 77// 8*16 ticks until the SHR is transferred to the Sending Shift Register
78// 8 ticks until the first transfer starts
79// 8 ticks later the FPGA samples the data
80// + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
81// + 1 tick to assign mod_sig_coil
d714d3ef 82#define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
7bc95e2e 83
84// When the PM acts as sniffer and is receiving tag data, it takes
85// 3 ticks A/D conversion
d714d3ef 86// 14 ticks to complete the modulation detection
87// 8 ticks (on average) until the result is stored in to_arm
7bc95e2e 88// + the delays in transferring data - which is the same for
89// sniffing reader and tag data and therefore not relevant
d714d3ef 90#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
7bc95e2e 91
d714d3ef 92// When the PM acts as sniffer and is receiving reader data, it takes
93// 2 ticks delay in analogue RF receiver (for the falling edge of the
94// start bit, which marks the start of the communication)
7bc95e2e 95// 3 ticks A/D conversion
d714d3ef 96// 8 ticks on average until the data is stored in to_arm.
7bc95e2e 97// + the delays in transferring data - which is the same for
98// sniffing reader and tag data and therefore not relevant
d714d3ef 99#define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
7bc95e2e 100
101//variables used for timing purposes:
102//these are in ssp_clk cycles:
6a1f2d82 103static uint32_t NextTransferTime;
104static uint32_t LastTimeProxToAirStart;
105static uint32_t LastProxToAirDuration;
7bc95e2e 106
107
108
8f51ddb0 109// CARD TO READER - manchester
72934aa3 110// Sequence D: 11110000 modulation with subcarrier during first half
111// Sequence E: 00001111 modulation with subcarrier during second half
112// Sequence F: 00000000 no modulation with subcarrier
8f51ddb0 113// READER TO CARD - miller
72934aa3 114// Sequence X: 00001100 drop after half a period
115// Sequence Y: 00000000 no drop
116// Sequence Z: 11000000 drop at start
117#define SEC_D 0xf0
118#define SEC_E 0x0f
119#define SEC_F 0x00
120#define SEC_X 0x0c
121#define SEC_Y 0x00
122#define SEC_Z 0xc0
15c4dc5a 123
1e262141 124const uint8_t OddByteParity[256] = {
15c4dc5a 125 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
126 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
127 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
141};
142
19a700a8 143
902cb3c0 144void iso14a_set_trigger(bool enable) {
534983d7 145 trigger = enable;
146}
147
d19929cb 148
b0127e65 149void iso14a_set_timeout(uint32_t timeout) {
150 iso14a_timeout = timeout;
19a700a8 151 if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);
b0127e65 152}
8556b852 153
19a700a8 154
155void iso14a_set_ATS_timeout(uint8_t *ats) {
156
157 uint8_t tb1;
158 uint8_t fwi;
159 uint32_t fwt;
160
161 if (ats[0] > 1) { // there is a format byte T0
162 if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
163 if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
164 tb1 = ats[3];
165 } else {
166 tb1 = ats[2];
167 }
168 fwi = (tb1 & 0xf0) >> 4; // frame waiting indicator (FWI)
169 fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc
170
171 iso14a_set_timeout(fwt/(8*16));
172 }
173 }
174}
175
176
15c4dc5a 177//-----------------------------------------------------------------------------
178// Generate the parity value for a byte sequence
e30c654b 179//
15c4dc5a 180//-----------------------------------------------------------------------------
20f9a2a1
M
181byte_t oddparity (const byte_t bt)
182{
5f6d6c90 183 return OddByteParity[bt];
20f9a2a1
M
184}
185
6a1f2d82 186void GetParity(const uint8_t *pbtCmd, uint16_t iLen, uint8_t *par)
15c4dc5a 187{
6a1f2d82 188 uint16_t paritybit_cnt = 0;
189 uint16_t paritybyte_cnt = 0;
190 uint8_t parityBits = 0;
191
192 for (uint16_t i = 0; i < iLen; i++) {
193 // Generate the parity bits
194 parityBits |= ((OddByteParity[pbtCmd[i]]) << (7-paritybit_cnt));
195 if (paritybit_cnt == 7) {
196 par[paritybyte_cnt] = parityBits; // save 8 Bits parity
197 parityBits = 0; // and advance to next Parity Byte
198 paritybyte_cnt++;
199 paritybit_cnt = 0;
200 } else {
201 paritybit_cnt++;
202 }
5f6d6c90 203 }
6a1f2d82 204
205 // save remaining parity bits
206 par[paritybyte_cnt] = parityBits;
207
15c4dc5a 208}
209
534983d7 210void AppendCrc14443a(uint8_t* data, int len)
15c4dc5a 211{
5f6d6c90 212 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
15c4dc5a 213}
214
0ec548dc 215void AppendCrc14443b(uint8_t* data, int len)
216{
217 ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
218}
219
220
7bc95e2e 221//=============================================================================
222// ISO 14443 Type A - Miller decoder
223//=============================================================================
224// Basics:
225// This decoder is used when the PM3 acts as a tag.
226// The reader will generate "pauses" by temporarily switching of the field.
227// At the PM3 antenna we will therefore measure a modulated antenna voltage.
228// The FPGA does a comparison with a threshold and would deliver e.g.:
229// ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
230// The Miller decoder needs to identify the following sequences:
231// 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
232// 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
233// 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
234// Note 1: the bitstream may start at any time. We therefore need to sync.
235// Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
15c4dc5a 236//-----------------------------------------------------------------------------
b62a5a84 237static tUart Uart;
15c4dc5a 238
d7aa3739 239// Lookup-Table to decide if 4 raw bits are a modulation.
0ec548dc 240// We accept the following:
241// 0001 - a 3 tick wide pause
242// 0011 - a 2 tick wide pause, or a three tick wide pause shifted left
243// 0111 - a 2 tick wide pause shifted left
244// 1001 - a 2 tick wide pause shifted right
d7aa3739 245const bool Mod_Miller_LUT[] = {
0ec548dc 246 FALSE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, TRUE,
247 FALSE, TRUE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE
d7aa3739 248};
0ec548dc 249#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
250#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
d7aa3739 251
7bc95e2e 252void UartReset()
15c4dc5a 253{
7bc95e2e 254 Uart.state = STATE_UNSYNCD;
255 Uart.bitCount = 0;
256 Uart.len = 0; // number of decoded data bytes
6a1f2d82 257 Uart.parityLen = 0; // number of decoded parity bytes
7bc95e2e 258 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
6a1f2d82 259 Uart.parityBits = 0; // holds 8 parity bits
7bc95e2e 260 Uart.startTime = 0;
261 Uart.endTime = 0;
46c65fed 262
263 Uart.byteCntMax = 0;
264 Uart.posCnt = 0;
265 Uart.syncBit = 9999;
7bc95e2e 266}
15c4dc5a 267
6a1f2d82 268void UartInit(uint8_t *data, uint8_t *parity)
269{
270 Uart.output = data;
271 Uart.parity = parity;
0ec548dc 272 Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
6a1f2d82 273 UartReset();
274}
d714d3ef 275
7bc95e2e 276// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
277static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
278{
15c4dc5a 279
0ec548dc 280 Uart.fourBits = (Uart.fourBits << 8) | bit;
7bc95e2e 281
0c8d25eb 282 if (Uart.state == STATE_UNSYNCD) { // not yet synced
3fe4ff4f 283
0ec548dc 284 Uart.syncBit = 9999; // not set
46c65fed 285
286 // 00x11111 2|3 ticks pause followed by 6|5 ticks unmodulated Sequence Z (a "0" or "start of communication")
287 // 11111111 8 ticks unmodulation Sequence Y (a "0" or "end of communication" or "no information")
288 // 111100x1 4 ticks unmodulated followed by 2|3 ticks pause Sequence X (a "1")
289
0ec548dc 290 // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
46c65fed 291 // Sequence X followed by Sequence Y followed by Sequence Z (111100x1 11111111 00x11111)
292 // we therefore look for a ...xx1111 11111111 00x11111xxxxxx... pattern
0ec548dc 293 // (12 '1's followed by 2 '0's, eventually followed by another '0', followed by 5 '1's)
46c65fed 294 //
295#define ISO14443A_STARTBIT_MASK 0x07FFEF80 // mask is 00001111 11111111 1110 1111 10000000
296#define ISO14443A_STARTBIT_PATTERN 0x07FF8F80 // pattern is 00001111 11111111 1000 1111 10000000
297
0ec548dc 298 if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 0)) == ISO14443A_STARTBIT_PATTERN >> 0) Uart.syncBit = 7;
299 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 1)) == ISO14443A_STARTBIT_PATTERN >> 1) Uart.syncBit = 6;
300 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 2)) == ISO14443A_STARTBIT_PATTERN >> 2) Uart.syncBit = 5;
301 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 3)) == ISO14443A_STARTBIT_PATTERN >> 3) Uart.syncBit = 4;
302 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 4)) == ISO14443A_STARTBIT_PATTERN >> 4) Uart.syncBit = 3;
303 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 5)) == ISO14443A_STARTBIT_PATTERN >> 5) Uart.syncBit = 2;
304 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 6)) == ISO14443A_STARTBIT_PATTERN >> 6) Uart.syncBit = 1;
305 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 7)) == ISO14443A_STARTBIT_PATTERN >> 7) Uart.syncBit = 0;
306
307 if (Uart.syncBit != 9999) { // found a sync bit
7bc95e2e 308 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
309 Uart.startTime -= Uart.syncBit;
d7aa3739 310 Uart.endTime = Uart.startTime;
7bc95e2e 311 Uart.state = STATE_START_OF_COMMUNICATION;
15c4dc5a 312 }
313
7bc95e2e 314 } else {
15c4dc5a 315
0ec548dc 316 if (IsMillerModulationNibble1(Uart.fourBits >> Uart.syncBit)) {
317 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation in both halves - error
d7aa3739 318 UartReset();
d7aa3739 319 } else { // Modulation in first half = Sequence Z = logic "0"
7bc95e2e 320 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
321 UartReset();
7bc95e2e 322 } else {
323 Uart.bitCount++;
324 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
325 Uart.state = STATE_MILLER_Z;
326 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
327 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
328 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
329 Uart.parityBits <<= 1; // make room for the parity bit
330 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
331 Uart.bitCount = 0;
332 Uart.shiftReg = 0;
6a1f2d82 333 if((Uart.len&0x0007) == 0) { // every 8 data bytes
334 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
335 Uart.parityBits = 0;
336 }
15c4dc5a 337 }
7bc95e2e 338 }
d7aa3739 339 }
340 } else {
0ec548dc 341 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
7bc95e2e 342 Uart.bitCount++;
343 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
344 Uart.state = STATE_MILLER_X;
345 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
346 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
347 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
348 Uart.parityBits <<= 1; // make room for the new parity bit
349 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
350 Uart.bitCount = 0;
351 Uart.shiftReg = 0;
6a1f2d82 352 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
353 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
354 Uart.parityBits = 0;
355 }
7bc95e2e 356 }
d7aa3739 357 } else { // no modulation in both halves - Sequence Y
7bc95e2e 358 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
15c4dc5a 359 Uart.state = STATE_UNSYNCD;
6a1f2d82 360 Uart.bitCount--; // last "0" was part of EOC sequence
361 Uart.shiftReg <<= 1; // drop it
362 if(Uart.bitCount > 0) { // if we decoded some bits
363 Uart.shiftReg >>= (9 - Uart.bitCount); // right align them
364 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff); // add last byte to the output
365 Uart.parityBits <<= 1; // add a (void) parity bit
366 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align parity bits
367 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store it
368 return TRUE;
369 } else if (Uart.len & 0x0007) { // there are some parity bits to store
370 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align remaining parity bits
371 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store them
52bfb955 372 }
373 if (Uart.len) {
6a1f2d82 374 return TRUE; // we are finished with decoding the raw data sequence
52bfb955 375 } else {
0c8d25eb 376 UartReset(); // Nothing received - start over
7bc95e2e 377 }
15c4dc5a 378 }
7bc95e2e 379 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
380 UartReset();
7bc95e2e 381 } else { // a logic "0"
382 Uart.bitCount++;
383 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
384 Uart.state = STATE_MILLER_Y;
385 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
386 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
387 Uart.parityBits <<= 1; // make room for the parity bit
388 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
389 Uart.bitCount = 0;
390 Uart.shiftReg = 0;
6a1f2d82 391 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
392 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
393 Uart.parityBits = 0;
394 }
15c4dc5a 395 }
396 }
d7aa3739 397 }
15c4dc5a 398 }
7bc95e2e 399
400 }
15c4dc5a 401
7bc95e2e 402 return FALSE; // not finished yet, need more data
15c4dc5a 403}
404
7bc95e2e 405
406
15c4dc5a 407//=============================================================================
e691fc45 408// ISO 14443 Type A - Manchester decoder
15c4dc5a 409//=============================================================================
e691fc45 410// Basics:
7bc95e2e 411// This decoder is used when the PM3 acts as a reader.
e691fc45 412// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
413// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
414// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
415// The Manchester decoder needs to identify the following sequences:
416// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
417// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
418// 8 ticks unmodulated: Sequence F = end of communication
419// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
7bc95e2e 420// Note 1: the bitstream may start at any time. We therefore need to sync.
e691fc45 421// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
b62a5a84 422static tDemod Demod;
15c4dc5a 423
d7aa3739 424// Lookup-Table to decide if 4 raw bits are a modulation.
d714d3ef 425// We accept three or four "1" in any position
7bc95e2e 426const bool Mod_Manchester_LUT[] = {
d7aa3739 427 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
d714d3ef 428 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
7bc95e2e 429};
430
431#define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
432#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
15c4dc5a 433
2f2d9fc5 434
7bc95e2e 435void DemodReset()
e691fc45 436{
7bc95e2e 437 Demod.state = DEMOD_UNSYNCD;
438 Demod.len = 0; // number of decoded data bytes
6a1f2d82 439 Demod.parityLen = 0;
7bc95e2e 440 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
441 Demod.parityBits = 0; //
442 Demod.collisionPos = 0; // Position of collision bit
443 Demod.twoBits = 0xffff; // buffer for 2 Bits
444 Demod.highCnt = 0;
445 Demod.startTime = 0;
446 Demod.endTime = 0;
46c65fed 447
448 //
449 Demod.bitCount = 0;
450 Demod.syncBit = 0xFFFF;
451 Demod.samples = 0;
e691fc45 452}
15c4dc5a 453
6a1f2d82 454void DemodInit(uint8_t *data, uint8_t *parity)
455{
456 Demod.output = data;
457 Demod.parity = parity;
458 DemodReset();
459}
460
7bc95e2e 461// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
462static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
e691fc45 463{
7bc95e2e 464
465 Demod.twoBits = (Demod.twoBits << 8) | bit;
e691fc45 466
7bc95e2e 467 if (Demod.state == DEMOD_UNSYNCD) {
468
469 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
470 if (Demod.twoBits == 0x0000) {
471 Demod.highCnt++;
472 } else {
473 Demod.highCnt = 0;
474 }
475 } else {
476 Demod.syncBit = 0xFFFF; // not set
477 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
478 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
479 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
480 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
481 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
482 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
483 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
484 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
d7aa3739 485 if (Demod.syncBit != 0xFFFF) {
7bc95e2e 486 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
487 Demod.startTime -= Demod.syncBit;
488 Demod.bitCount = offset; // number of decoded data bits
e691fc45 489 Demod.state = DEMOD_MANCHESTER_DATA;
2f2d9fc5 490 }
7bc95e2e 491 }
15c4dc5a 492
7bc95e2e 493 } else {
15c4dc5a 494
7bc95e2e 495 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
496 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
e691fc45 497 if (!Demod.collisionPos) {
498 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
499 }
500 } // modulation in first half only - Sequence D = 1
7bc95e2e 501 Demod.bitCount++;
502 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
503 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
e691fc45 504 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 505 Demod.parityBits <<= 1; // make room for the parity bit
e691fc45 506 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
507 Demod.bitCount = 0;
508 Demod.shiftReg = 0;
6a1f2d82 509 if((Demod.len&0x0007) == 0) { // every 8 data bytes
510 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits
511 Demod.parityBits = 0;
512 }
15c4dc5a 513 }
7bc95e2e 514 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
515 } else { // no modulation in first half
516 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
e691fc45 517 Demod.bitCount++;
7bc95e2e 518 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
e691fc45 519 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
e691fc45 520 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 521 Demod.parityBits <<= 1; // make room for the new parity bit
e691fc45 522 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
523 Demod.bitCount = 0;
524 Demod.shiftReg = 0;
6a1f2d82 525 if ((Demod.len&0x0007) == 0) { // every 8 data bytes
526 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits1
527 Demod.parityBits = 0;
528 }
15c4dc5a 529 }
7bc95e2e 530 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
e691fc45 531 } else { // no modulation in both halves - End of communication
6a1f2d82 532 if(Demod.bitCount > 0) { // there are some remaining data bits
533 Demod.shiftReg >>= (9 - Demod.bitCount); // right align the decoded bits
534 Demod.output[Demod.len++] = Demod.shiftReg & 0xff; // and add them to the output
535 Demod.parityBits <<= 1; // add a (void) parity bit
536 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
537 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
538 return TRUE;
539 } else if (Demod.len & 0x0007) { // there are some parity bits to store
540 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
541 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
52bfb955 542 }
543 if (Demod.len) {
d7aa3739 544 return TRUE; // we are finished with decoding the raw data sequence
545 } else { // nothing received. Start over
546 DemodReset();
e691fc45 547 }
15c4dc5a 548 }
7bc95e2e 549 }
e691fc45 550 }
e691fc45 551 return FALSE; // not finished yet, need more data
15c4dc5a 552}
553
554//=============================================================================
555// Finally, a `sniffer' for ISO 14443 Type A
556// Both sides of communication!
557//=============================================================================
558
559//-----------------------------------------------------------------------------
560// Record the sequence of commands sent by the reader to the tag, with
561// triggering so that we start recording at the point that the tag is moved
562// near the reader.
563//-----------------------------------------------------------------------------
d26849d4 564void RAMFUNC SniffIso14443a(uint8_t param) {
5cd9ec01
M
565 // param:
566 // bit 0 - trigger from first card answer
567 // bit 1 - trigger from first reader 7-bit request
568
569 LEDsoff();
5cd9ec01
M
570
571 // We won't start recording the frames that we acquire until we trigger;
572 // a good trigger condition to get started is probably when we see a
573 // response from the tag.
574 // triggered == FALSE -- to wait first for card
7bc95e2e 575 bool triggered = !(param & 0x03);
576
f71f4deb 577 // Allocate memory from BigBuf for some buffers
578 // free all previous allocations first
579 BigBuf_free();
580
5cd9ec01 581 // The command (reader -> tag) that we're receiving.
f71f4deb 582 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
583 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
6a1f2d82 584
5cd9ec01 585 // The response (tag -> reader) that we're receiving.
f71f4deb 586 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
587 uint8_t *receivedResponsePar = BigBuf_malloc(MAX_PARITY_SIZE);
5cd9ec01
M
588
589 // The DMA buffer, used to stream samples from the FPGA
f71f4deb 590 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
591
592 // init trace buffer
3000dc4e
MHS
593 clear_trace();
594 set_tracing(TRUE);
f71f4deb 595
7bc95e2e 596 uint8_t *data = dmaBuf;
597 uint8_t previous_data = 0;
5cd9ec01
M
598 int maxDataLen = 0;
599 int dataLen = 0;
7bc95e2e 600 bool TagIsActive = FALSE;
601 bool ReaderIsActive = FALSE;
602
603 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
15c4dc5a 604
5cd9ec01 605 // Set up the demodulator for tag -> reader responses.
6a1f2d82 606 DemodInit(receivedResponse, receivedResponsePar);
607
5cd9ec01 608 // Set up the demodulator for the reader -> tag commands
6a1f2d82 609 UartInit(receivedCmd, receivedCmdPar);
610
7bc95e2e 611 // Setup and start DMA.
5cd9ec01 612 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
7bc95e2e 613
5cd9ec01 614 // And now we loop, receiving samples.
7bc95e2e 615 for(uint32_t rsamples = 0; TRUE; ) {
616
5cd9ec01
M
617 if(BUTTON_PRESS()) {
618 DbpString("cancelled by button");
7bc95e2e 619 break;
5cd9ec01 620 }
15c4dc5a 621
5cd9ec01
M
622 LED_A_ON();
623 WDT_HIT();
15c4dc5a 624
5cd9ec01
M
625 int register readBufDataP = data - dmaBuf;
626 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
627 if (readBufDataP <= dmaBufDataP){
628 dataLen = dmaBufDataP - readBufDataP;
629 } else {
7bc95e2e 630 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
5cd9ec01
M
631 }
632 // test for length of buffer
633 if(dataLen > maxDataLen) {
634 maxDataLen = dataLen;
f71f4deb 635 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
7bc95e2e 636 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
637 break;
5cd9ec01
M
638 }
639 }
640 if(dataLen < 1) continue;
641
642 // primary buffer was stopped( <-- we lost data!
643 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
644 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
645 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
7bc95e2e 646 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
647 }
648 // secondary buffer sets as primary, secondary buffer was stopped
649 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
650 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
651 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
652 }
653
654 LED_A_OFF();
7bc95e2e 655
656 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
3be2a5ae 657
7bc95e2e 658 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
659 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
660 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
661 LED_C_ON();
5cd9ec01 662
7bc95e2e 663 // check - if there is a short 7bit request from reader
664 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
5cd9ec01 665
7bc95e2e 666 if(triggered) {
6a1f2d82 667 if (!LogTrace(receivedCmd,
668 Uart.len,
669 Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
670 Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
671 Uart.parity,
672 TRUE)) break;
7bc95e2e 673 }
674 /* And ready to receive another command. */
675 UartReset();
2d2f7d19 676 //UartInit(receivedCmd, receivedCmdPar);
7bc95e2e 677 /* And also reset the demod code, which might have been */
678 /* false-triggered by the commands from the reader. */
679 DemodReset();
680 LED_B_OFF();
681 }
682 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
5cd9ec01 683 }
3be2a5ae 684
7bc95e2e 685 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
686 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
687 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
688 LED_B_ON();
5cd9ec01 689
6a1f2d82 690 if (!LogTrace(receivedResponse,
691 Demod.len,
692 Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
693 Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
694 Demod.parity,
695 FALSE)) break;
5cd9ec01 696
7bc95e2e 697 if ((!triggered) && (param & 0x01)) triggered = TRUE;
5cd9ec01 698
7bc95e2e 699 // And ready to receive another response.
700 DemodReset();
0ec548dc 701 // And reset the Miller decoder including itS (now outdated) input buffer
702 UartInit(receivedCmd, receivedCmdPar);
703
7bc95e2e 704 LED_C_OFF();
705 }
706 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
707 }
5cd9ec01
M
708 }
709
7bc95e2e 710 previous_data = *data;
711 rsamples++;
5cd9ec01 712 data++;
d714d3ef 713 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01
M
714 data = dmaBuf;
715 }
716 } // main cycle
717
718 DbpString("COMMAND FINISHED");
15c4dc5a 719
7bc95e2e 720 FpgaDisableSscDma();
721 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
3000dc4e 722 Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);
5cd9ec01 723 LEDsoff();
15c4dc5a 724}
725
15c4dc5a 726//-----------------------------------------------------------------------------
727// Prepare tag messages
728//-----------------------------------------------------------------------------
6a1f2d82 729static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
15c4dc5a 730{
8f51ddb0 731 ToSendReset();
15c4dc5a 732
733 // Correction bit, might be removed when not needed
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736 ToSendStuffBit(0);
737 ToSendStuffBit(0);
738 ToSendStuffBit(1); // 1
739 ToSendStuffBit(0);
740 ToSendStuffBit(0);
741 ToSendStuffBit(0);
8f51ddb0 742
15c4dc5a 743 // Send startbit
72934aa3 744 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 745 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 746
6a1f2d82 747 for(uint16_t i = 0; i < len; i++) {
8f51ddb0 748 uint8_t b = cmd[i];
15c4dc5a 749
750 // Data bits
6a1f2d82 751 for(uint16_t j = 0; j < 8; j++) {
15c4dc5a 752 if(b & 1) {
72934aa3 753 ToSend[++ToSendMax] = SEC_D;
15c4dc5a 754 } else {
72934aa3 755 ToSend[++ToSendMax] = SEC_E;
8f51ddb0
M
756 }
757 b >>= 1;
758 }
15c4dc5a 759
0014cb46 760 // Get the parity bit
6a1f2d82 761 if (parity[i>>3] & (0x80>>(i&0x0007))) {
8f51ddb0 762 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 763 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 764 } else {
72934aa3 765 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 766 LastProxToAirDuration = 8 * ToSendMax;
15c4dc5a 767 }
8f51ddb0 768 }
15c4dc5a 769
8f51ddb0
M
770 // Send stopbit
771 ToSend[++ToSendMax] = SEC_F;
15c4dc5a 772
8f51ddb0
M
773 // Convert from last byte pos to length
774 ToSendMax++;
8f51ddb0
M
775}
776
6a1f2d82 777static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
778{
779 uint8_t par[MAX_PARITY_SIZE];
780
781 GetParity(cmd, len, par);
782 CodeIso14443aAsTagPar(cmd, len, par);
15c4dc5a 783}
784
15c4dc5a 785
8f51ddb0
M
786static void Code4bitAnswerAsTag(uint8_t cmd)
787{
788 int i;
789
5f6d6c90 790 ToSendReset();
8f51ddb0
M
791
792 // Correction bit, might be removed when not needed
793 ToSendStuffBit(0);
794 ToSendStuffBit(0);
795 ToSendStuffBit(0);
796 ToSendStuffBit(0);
797 ToSendStuffBit(1); // 1
798 ToSendStuffBit(0);
799 ToSendStuffBit(0);
800 ToSendStuffBit(0);
801
802 // Send startbit
803 ToSend[++ToSendMax] = SEC_D;
804
805 uint8_t b = cmd;
806 for(i = 0; i < 4; i++) {
807 if(b & 1) {
808 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 809 LastProxToAirDuration = 8 * ToSendMax - 4;
8f51ddb0
M
810 } else {
811 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 812 LastProxToAirDuration = 8 * ToSendMax;
8f51ddb0
M
813 }
814 b >>= 1;
815 }
816
817 // Send stopbit
818 ToSend[++ToSendMax] = SEC_F;
819
5f6d6c90 820 // Convert from last byte pos to length
821 ToSendMax++;
15c4dc5a 822}
823
824//-----------------------------------------------------------------------------
825// Wait for commands from reader
826// Stop when button is pressed
827// Or return TRUE when command is captured
828//-----------------------------------------------------------------------------
6a1f2d82 829static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
15c4dc5a 830{
831 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
832 // only, since we are receiving, not transmitting).
833 // Signal field is off with the appropriate LED
834 LED_D_OFF();
835 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
836
837 // Now run a `software UART' on the stream of incoming samples.
6a1f2d82 838 UartInit(received, parity);
7bc95e2e 839
840 // clear RXRDY:
841 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 842
843 for(;;) {
844 WDT_HIT();
845
846 if(BUTTON_PRESS()) return FALSE;
7bc95e2e 847
15c4dc5a 848 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
7bc95e2e 849 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
850 if(MillerDecoding(b, 0)) {
851 *len = Uart.len;
15c4dc5a 852 return TRUE;
853 }
7bc95e2e 854 }
15c4dc5a 855 }
856}
28afbd2b 857
6a1f2d82 858static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
7bc95e2e 859int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
28afbd2b 860int EmSend4bit(uint8_t resp);
6a1f2d82 861int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
862int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
863int EmSendCmd(uint8_t *resp, uint16_t respLen);
864int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
865bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
866 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
15c4dc5a 867
117d9ec2 868static uint8_t* free_buffer_pointer;
ce02f6f9 869
870typedef struct {
871 uint8_t* response;
872 size_t response_n;
873 uint8_t* modulation;
874 size_t modulation_n;
7bc95e2e 875 uint32_t ProxToAirDuration;
ce02f6f9 876} tag_response_info_t;
877
ce02f6f9 878bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
7bc95e2e 879 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
ce02f6f9 880 // This will need the following byte array for a modulation sequence
881 // 144 data bits (18 * 8)
882 // 18 parity bits
883 // 2 Start and stop
884 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
885 // 1 just for the case
886 // ----------- +
887 // 166 bytes, since every bit that needs to be send costs us a byte
888 //
f71f4deb 889
890
ce02f6f9 891 // Prepare the tag modulation bits from the message
892 CodeIso14443aAsTag(response_info->response,response_info->response_n);
893
894 // Make sure we do not exceed the free buffer space
895 if (ToSendMax > max_buffer_size) {
896 Dbprintf("Out of memory, when modulating bits for tag answer:");
897 Dbhexdump(response_info->response_n,response_info->response,false);
898 return false;
899 }
900
901 // Copy the byte array, used for this modulation to the buffer position
902 memcpy(response_info->modulation,ToSend,ToSendMax);
903
7bc95e2e 904 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
ce02f6f9 905 response_info->modulation_n = ToSendMax;
7bc95e2e 906 response_info->ProxToAirDuration = LastProxToAirDuration;
ce02f6f9 907
908 return true;
909}
910
f71f4deb 911
912// "precompile" responses. There are 7 predefined responses with a total of 28 bytes data to transmit.
913// Coded responses need one byte per bit to transfer (data, parity, start, stop, correction)
914// 28 * 8 data bits, 28 * 1 parity bits, 7 start bits, 7 stop bits, 7 correction bits
915// -> need 273 bytes buffer
c9216a92 916// 44 * 8 data bits, 44 * 1 parity bits, 9 start bits, 9 stop bits, 9 correction bits --370
917// 47 * 8 data bits, 47 * 1 parity bits, 10 start bits, 10 stop bits, 10 correction bits
918#define ALLOCATED_TAG_MODULATION_BUFFER_SIZE 453
f71f4deb 919
ce02f6f9 920bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
921 // Retrieve and store the current buffer index
922 response_info->modulation = free_buffer_pointer;
923
924 // Determine the maximum size we can use from our buffer
f71f4deb 925 size_t max_buffer_size = ALLOCATED_TAG_MODULATION_BUFFER_SIZE;
ce02f6f9 926
927 // Forward the prepare tag modulation function to the inner function
f71f4deb 928 if (prepare_tag_modulation(response_info, max_buffer_size)) {
ce02f6f9 929 // Update the free buffer offset
930 free_buffer_pointer += ToSendMax;
931 return true;
932 } else {
933 return false;
934 }
935}
936
15c4dc5a 937//-----------------------------------------------------------------------------
938// Main loop of simulated tag: receive commands from reader, decide what
939// response to send, and send it.
940//-----------------------------------------------------------------------------
d26849d4 941void SimulateIso14443aTag(int tagType, int flags, int uid_2nd, byte_t* data)
15c4dc5a 942{
d26849d4 943
944 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
945 // This can be used in a reader-only attack.
946 // (it can also be retrieved via 'hf 14a list', but hey...
947 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
948 uint8_t ar_nr_collected = 0;
949
81cd0474 950 uint8_t sak;
32719adf 951
952 // PACK response to PWD AUTH for EV1/NTAG
953 uint8_t response8[4];
954
81cd0474 955 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
956 uint8_t response1[2];
957
958 switch (tagType) {
959 case 1: { // MIFARE Classic
960 // Says: I am Mifare 1k - original line
961 response1[0] = 0x04;
962 response1[1] = 0x00;
963 sak = 0x08;
964 } break;
965 case 2: { // MIFARE Ultralight
966 // Says: I am a stupid memory tag, no crypto
32719adf 967 response1[0] = 0x44;
81cd0474 968 response1[1] = 0x00;
969 sak = 0x00;
970 } break;
971 case 3: { // MIFARE DESFire
972 // Says: I am a DESFire tag, ph33r me
973 response1[0] = 0x04;
974 response1[1] = 0x03;
975 sak = 0x20;
976 } break;
977 case 4: { // ISO/IEC 14443-4
978 // Says: I am a javacard (JCOP)
979 response1[0] = 0x04;
980 response1[1] = 0x00;
981 sak = 0x28;
982 } break;
3fe4ff4f 983 case 5: { // MIFARE TNP3XXX
984 // Says: I am a toy
985 response1[0] = 0x01;
986 response1[1] = 0x0f;
987 sak = 0x01;
d26849d4 988 } break;
989 case 6: { // MIFARE Mini
990 // Says: I am a Mifare Mini, 320b
991 response1[0] = 0x44;
992 response1[1] = 0x00;
993 sak = 0x09;
994 } break;
32719adf 995 case 7: { // NTAG?
996 // Says: I am a NTAG,
997 response1[0] = 0x44;
998 response1[1] = 0x00;
999 sak = 0x00;
1000 // PACK
1001 response8[0] = 0x80;
1002 response8[1] = 0x80;
1003 ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);
1004 } break;
81cd0474 1005 default: {
1006 Dbprintf("Error: unkown tagtype (%d)",tagType);
1007 return;
1008 } break;
1009 }
1010
1011 // The second response contains the (mandatory) first 24 bits of the UID
c8b6da22 1012 uint8_t response2[5] = {0x00};
81cd0474 1013
1014 // Check if the uid uses the (optional) part
c8b6da22 1015 uint8_t response2a[5] = {0x00};
1016
d26849d4 1017 if (flags & FLAG_7B_UID_IN_DATA) {
81cd0474 1018 response2[0] = 0x88;
d26849d4 1019 response2[1] = data[0];
1020 response2[2] = data[1];
1021 response2[3] = data[2];
1022
1023 response2a[0] = data[3];
1024 response2a[1] = data[4];
1025 response2a[2] = data[5];
c3c241f3 1026 response2a[3] = data[6]; //??
81cd0474 1027 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
1028
1029 // Configure the ATQA and SAK accordingly
1030 response1[0] |= 0x40;
1031 sak |= 0x04;
1032 } else {
d26849d4 1033 memcpy(response2, data, 4);
1034 //num_to_bytes(uid_1st,4,response2);
81cd0474 1035 // Configure the ATQA and SAK accordingly
1036 response1[0] &= 0xBF;
1037 sak &= 0xFB;
1038 }
1039
1040 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1041 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
1042
1043 // Prepare the mandatory SAK (for 4 and 7 byte UID)
c8b6da22 1044 uint8_t response3[3] = {0x00};
81cd0474 1045 response3[0] = sak;
1046 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
1047
1048 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
c8b6da22 1049 uint8_t response3a[3] = {0x00};
81cd0474 1050 response3a[0] = sak & 0xFB;
1051 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
1052
2d2f7d19 1053 uint8_t response5[] = { 0x01, 0x01, 0x01, 0x01 }; // Very random tag nonce
6a1f2d82 1054 uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1055 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1056 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1057 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1058 // TC(1) = 0x02: CID supported, NAD not supported
ce02f6f9 1059 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
1060
32719adf 1061 // Prepare GET_VERSION (different for EV-1 / NTAG)
1062 //uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7}; //EV1 48bytes VERSION.
1063 uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
1064
c9216a92 1065 // Prepare CHK_TEARING
1066 uint8_t response9[] = {0xBD,0x90,0x3f};
1067
1068 #define TAG_RESPONSE_COUNT 10
7bc95e2e 1069 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
1070 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
1071 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
1072 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1073 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
1074 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
1075 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
1076 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
32719adf 1077 { .response = response7_NTAG, .response_n = sizeof(response7_NTAG) }, // EV1/NTAG GET_VERSION response
1078 { .response = response8, .response_n = sizeof(response8) }, // EV1/NTAG PACK response
c9216a92 1079 { .response = response9, .response_n = sizeof(response9) } // EV1/NTAG CHK_TEAR response
7bc95e2e 1080 };
1081
1082 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1083 // Such a response is less time critical, so we can prepare them on the fly
1084 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1085 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1086 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
1087 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
1088 tag_response_info_t dynamic_response_info = {
1089 .response = dynamic_response_buffer,
1090 .response_n = 0,
1091 .modulation = dynamic_modulation_buffer,
1092 .modulation_n = 0
1093 };
ce02f6f9 1094
f71f4deb 1095 BigBuf_free_keep_EM();
1096
1097 // allocate buffers:
1098 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
1099 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
1100 free_buffer_pointer = BigBuf_malloc(ALLOCATED_TAG_MODULATION_BUFFER_SIZE);
1101
1102 // clear trace
3000dc4e
MHS
1103 clear_trace();
1104 set_tracing(TRUE);
f71f4deb 1105
7bc95e2e 1106 // Prepare the responses of the anticollision phase
ce02f6f9 1107 // there will be not enough time to do this at the moment the reader sends it REQA
7bc95e2e 1108 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
1109 prepare_allocated_tag_modulation(&responses[i]);
1110 }
15c4dc5a 1111
7bc95e2e 1112 int len = 0;
15c4dc5a 1113
1114 // To control where we are in the protocol
1115 int order = 0;
1116 int lastorder;
1117
1118 // Just to allow some checks
1119 int happened = 0;
1120 int happened2 = 0;
81cd0474 1121 int cmdsRecvd = 0;
15c4dc5a 1122
254b70a4 1123 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 1124 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
15c4dc5a 1125
254b70a4 1126 cmdsRecvd = 0;
7bc95e2e 1127 tag_response_info_t* p_response;
15c4dc5a 1128
254b70a4 1129 LED_A_ON();
1130 for(;;) {
7bc95e2e 1131 // Clean receive command buffer
1132
6a1f2d82 1133 if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
ce02f6f9 1134 DbpString("Button press");
254b70a4 1135 break;
1136 }
7bc95e2e 1137
1138 p_response = NULL;
1139
254b70a4 1140 // Okay, look at the command now.
1141 lastorder = order;
1142 if(receivedCmd[0] == 0x26) { // Received a REQUEST
ce02f6f9 1143 p_response = &responses[0]; order = 1;
254b70a4 1144 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
ce02f6f9 1145 p_response = &responses[0]; order = 6;
254b70a4 1146 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
ce02f6f9 1147 p_response = &responses[1]; order = 2;
6a1f2d82 1148 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
ce02f6f9 1149 p_response = &responses[2]; order = 20;
254b70a4 1150 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
ce02f6f9 1151 p_response = &responses[3]; order = 3;
254b70a4 1152 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
ce02f6f9 1153 p_response = &responses[4]; order = 30;
254b70a4 1154 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
32719adf 1155 uint8_t block = receivedCmd[1];
1156 if ( tagType == 7 ) {
5e428463 1157 uint8_t start = 4 * block;
32719adf 1158
1159 if ( block < 4 ) {
1160 //NTAG 215
32719adf 1161 uint8_t blockdata[50] = {
1162 data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
1163 data[3],data[4],data[5],data[6],
1164 data[3] ^ data[4] ^ data[5] ^ data[6],0x48,0x0f,0xe0,
1165 0xe1,0x10,0x12,0x00,
1166 0x03,0x00,0xfe,0x00,
1167 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1168 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1169 0x00,0x00,0x00,0x00,
1170 0x00,0x00};
c9216a92 1171 AppendCrc14443a(blockdata+start, 16);
5e428463 1172 EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
1173 } else {
1174 uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
1175 emlGetMemBt( emdata, start, 16);
1176 AppendCrc14443a(emdata, 16);
1177 EmSendCmdEx(emdata, sizeof(emdata), false);
32719adf 1178 }
1179 p_response = NULL;
1180
1181 } else {
1182 EmSendCmdEx(data+(4*block),16,false);
1183 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1184 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1185 p_response = NULL;
1186 }
c9216a92 1187 } else if(receivedCmd[0] == 0x3A) { // Received a FAST READ (ranged read) -- just returns all zeros.
5e428463 1188
1189 uint8_t emdata[MAX_FRAME_SIZE];
1190 int start = receivedCmd[1] * 4;
ce3d6bd2 1191 int len = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
5e428463 1192 emlGetMemBt( emdata, start, len);
1193 AppendCrc14443a(emdata, len);
1194 EmSendCmdEx(emdata, len+2, false);
1195 p_response = NULL;
1196
839a53ae 1197 } else if(receivedCmd[0] == 0x3C && tagType == 7) { // Received a READ SIGNATURE --
1198 // ECC data, taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
1199 uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
1200 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
1201 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
1202 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
1203 0x00,0x00};
5e428463 1204 AppendCrc14443a(data, sizeof(data)-2);
ce3d6bd2 1205 EmSendCmdEx(data,sizeof(data),false);
839a53ae 1206 p_response = NULL;
1207 } else if(receivedCmd[0] == 0x39 && tagType == 7) { // Received a READ COUNTER --
c9216a92 1208 uint8_t data[] = {0x00,0x00,0x00,0x14,0xa5};
839a53ae 1209 EmSendCmdEx(data,sizeof(data),false);
c9216a92 1210 p_response = NULL;
ce3d6bd2 1211 } else if(receivedCmd[0] == 0xA5 && tagType == 7) { // Received a INC COUNTER --
1212 // number of counter
1213 //uint8_t counter = receivedCmd[1];
1214 //uint32_t val = bytes_to_num(receivedCmd+2,4);
1215
1216 // send ACK
1217 uint8_t ack[] = {0x0a};
1218 EmSendCmdEx(ack,sizeof(ack),false);
1219 p_response = NULL;
1220
c9216a92 1221 } else if(receivedCmd[0] == 0x3E && tagType == 7) { // Received a CHECK_TEARING_EVENT --
1222 p_response = &responses[9];
254b70a4 1223 } else if(receivedCmd[0] == 0x50) { // Received a HALT
3fe4ff4f 1224
7bc95e2e 1225 if (tracing) {
6a1f2d82 1226 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1227 }
1228 p_response = NULL;
254b70a4 1229 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
32719adf 1230
1231 if ( tagType == 7 ) { // IF NTAG /EV1 0x60 == GET_VERSION, not a authentication request.
1232 p_response = &responses[7];
1233 } else {
1234 p_response = &responses[5]; order = 7;
1235 }
254b70a4 1236 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
7bc95e2e 1237 if (tagType == 1 || tagType == 2) { // RATS not supported
1238 EmSend4bit(CARD_NACK_NA);
1239 p_response = NULL;
1240 } else {
1241 p_response = &responses[6]; order = 70;
1242 }
6a1f2d82 1243 } else if (order == 7 && len == 8) { // Received {nr] and {ar} (part of authentication)
7bc95e2e 1244 if (tracing) {
6a1f2d82 1245 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1246 }
d26849d4 1247 uint32_t nonce = bytes_to_num(response5,4);
7bc95e2e 1248 uint32_t nr = bytes_to_num(receivedCmd,4);
1249 uint32_t ar = bytes_to_num(receivedCmd+4,4);
d26849d4 1250 //Dbprintf("Auth attempt {nonce}{nr}{ar}: %08x %08x %08x", nonce, nr, ar);
1251
1252 if(flags & FLAG_NR_AR_ATTACK )
1253 {
1254 if(ar_nr_collected < 2){
1255 // Avoid duplicates... probably not necessary, nr should vary.
1256 //if(ar_nr_responses[3] != nr){
1257 ar_nr_responses[ar_nr_collected*5] = 0;
1258 ar_nr_responses[ar_nr_collected*5+1] = 0;
1259 ar_nr_responses[ar_nr_collected*5+2] = nonce;
1260 ar_nr_responses[ar_nr_collected*5+3] = nr;
1261 ar_nr_responses[ar_nr_collected*5+4] = ar;
1262 ar_nr_collected++;
1263 //}
1264 }
1265
1266 if(ar_nr_collected > 1 ) {
1267
1268 if (MF_DBGLEVEL >= 2) {
1269 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
1270 Dbprintf("../tools/mfkey/mfkey32 %07x%08x %08x %08x %08x %08x %08x",
1271 ar_nr_responses[0], // UID1
1272 ar_nr_responses[1], // UID2
1273 ar_nr_responses[2], // NT
1274 ar_nr_responses[3], // AR1
1275 ar_nr_responses[4], // NR1
1276 ar_nr_responses[8], // AR2
1277 ar_nr_responses[9] // NR2
1278 );
1279 }
1280 uint8_t len = ar_nr_collected*5*4;
1281 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,len,0,&ar_nr_responses,len);
1282 ar_nr_collected = 0;
1283 memset(ar_nr_responses, 0x00, len);
d26849d4 1284 }
1285 }
32719adf 1286 } else if (receivedCmd[0] == 0x1a ) // ULC authentication
1287 {
1288
1289 }
1290 else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
1291 {
1292 if ( tagType == 7 ) {
1293 p_response = &responses[8]; // PACK response
ce3d6bd2 1294 uint32_t pwd = bytes_to_num(receivedCmd+1,4);
1295 Dbprintf("Auth attempt: %08x", pwd);
32719adf 1296 }
1297 }
1298 else {
7bc95e2e 1299 // Check for ISO 14443A-4 compliant commands, look at left nibble
1300 switch (receivedCmd[0]) {
1301
1302 case 0x0B:
1303 case 0x0A: { // IBlock (command)
1304 dynamic_response_info.response[0] = receivedCmd[0];
1305 dynamic_response_info.response[1] = 0x00;
1306 dynamic_response_info.response[2] = 0x90;
1307 dynamic_response_info.response[3] = 0x00;
1308 dynamic_response_info.response_n = 4;
1309 } break;
1310
1311 case 0x1A:
1312 case 0x1B: { // Chaining command
1313 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1314 dynamic_response_info.response_n = 2;
1315 } break;
1316
1317 case 0xaa:
1318 case 0xbb: {
1319 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1320 dynamic_response_info.response_n = 2;
1321 } break;
1322
1323 case 0xBA: { //
1324 memcpy(dynamic_response_info.response,"\xAB\x00",2);
1325 dynamic_response_info.response_n = 2;
1326 } break;
1327
1328 case 0xCA:
1329 case 0xC2: { // Readers sends deselect command
1330 memcpy(dynamic_response_info.response,"\xCA\x00",2);
1331 dynamic_response_info.response_n = 2;
1332 } break;
1333
1334 default: {
1335 // Never seen this command before
1336 if (tracing) {
6a1f2d82 1337 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1338 }
1339 Dbprintf("Received unknown command (len=%d):",len);
1340 Dbhexdump(len,receivedCmd,false);
1341 // Do not respond
1342 dynamic_response_info.response_n = 0;
1343 } break;
1344 }
ce02f6f9 1345
7bc95e2e 1346 if (dynamic_response_info.response_n > 0) {
1347 // Copy the CID from the reader query
1348 dynamic_response_info.response[1] = receivedCmd[1];
ce02f6f9 1349
7bc95e2e 1350 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1351 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1352 dynamic_response_info.response_n += 2;
ce02f6f9 1353
7bc95e2e 1354 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1355 Dbprintf("Error preparing tag response");
1356 if (tracing) {
6a1f2d82 1357 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1358 }
1359 break;
1360 }
1361 p_response = &dynamic_response_info;
1362 }
81cd0474 1363 }
15c4dc5a 1364
1365 // Count number of wakeups received after a halt
1366 if(order == 6 && lastorder == 5) { happened++; }
1367
1368 // Count number of other messages after a halt
1369 if(order != 6 && lastorder == 5) { happened2++; }
1370
15c4dc5a 1371 if(cmdsRecvd > 999) {
1372 DbpString("1000 commands later...");
254b70a4 1373 break;
15c4dc5a 1374 }
ce02f6f9 1375 cmdsRecvd++;
1376
1377 if (p_response != NULL) {
7bc95e2e 1378 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1379 // do the tracing for the previous reader request and this tag answer:
6a1f2d82 1380 uint8_t par[MAX_PARITY_SIZE];
1381 GetParity(p_response->response, p_response->response_n, par);
3fe4ff4f 1382
7bc95e2e 1383 EmLogTrace(Uart.output,
1384 Uart.len,
1385 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1386 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1387 Uart.parity,
7bc95e2e 1388 p_response->response,
1389 p_response->response_n,
1390 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1391 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1392 par);
7bc95e2e 1393 }
1394
1395 if (!tracing) {
1396 Dbprintf("Trace Full. Simulation stopped.");
1397 break;
1398 }
1399 }
15c4dc5a 1400
d26849d4 1401 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
f71f4deb 1402 BigBuf_free_keep_EM();
c9216a92 1403 LED_A_OFF();
1404
1405 Dbprintf("-[ Wake ups after halt [%d]", happened);
1406 Dbprintf("-[ Messages after halt [%d]", happened2);
1407 Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
15c4dc5a 1408}
1409
9492e0b0 1410
1411// prepare a delayed transfer. This simply shifts ToSend[] by a number
1412// of bits specified in the delay parameter.
1413void PrepareDelayedTransfer(uint16_t delay)
1414{
1415 uint8_t bitmask = 0;
1416 uint8_t bits_to_shift = 0;
1417 uint8_t bits_shifted = 0;
1418
1419 delay &= 0x07;
1420 if (delay) {
1421 for (uint16_t i = 0; i < delay; i++) {
1422 bitmask |= (0x01 << i);
1423 }
7bc95e2e 1424 ToSend[ToSendMax++] = 0x00;
9492e0b0 1425 for (uint16_t i = 0; i < ToSendMax; i++) {
1426 bits_to_shift = ToSend[i] & bitmask;
1427 ToSend[i] = ToSend[i] >> delay;
1428 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1429 bits_shifted = bits_to_shift;
1430 }
1431 }
1432}
1433
7bc95e2e 1434
1435//-------------------------------------------------------------------------------------
15c4dc5a 1436// Transmit the command (to the tag) that was placed in ToSend[].
9492e0b0 1437// Parameter timing:
7bc95e2e 1438// if NULL: transfer at next possible time, taking into account
1439// request guard time and frame delay time
1440// if == 0: transfer immediately and return time of transfer
9492e0b0 1441// if != 0: delay transfer until time specified
7bc95e2e 1442//-------------------------------------------------------------------------------------
6a1f2d82 1443static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
15c4dc5a 1444{
7bc95e2e 1445
9492e0b0 1446 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
e30c654b 1447
7bc95e2e 1448 uint32_t ThisTransferTime = 0;
e30c654b 1449
9492e0b0 1450 if (timing) {
1451 if(*timing == 0) { // Measure time
7bc95e2e 1452 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
9492e0b0 1453 } else {
1454 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1455 }
7bc95e2e 1456 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1457 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1458 LastTimeProxToAirStart = *timing;
1459 } else {
1460 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1461 while(GetCountSspClk() < ThisTransferTime);
1462 LastTimeProxToAirStart = ThisTransferTime;
9492e0b0 1463 }
1464
7bc95e2e 1465 // clear TXRDY
1466 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1467
7bc95e2e 1468 uint16_t c = 0;
9492e0b0 1469 for(;;) {
1470 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1471 AT91C_BASE_SSC->SSC_THR = cmd[c];
1472 c++;
1473 if(c >= len) {
1474 break;
1475 }
1476 }
1477 }
7bc95e2e 1478
1479 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
15c4dc5a 1480}
1481
7bc95e2e 1482
15c4dc5a 1483//-----------------------------------------------------------------------------
195af472 1484// Prepare reader command (in bits, support short frames) to send to FPGA
15c4dc5a 1485//-----------------------------------------------------------------------------
6a1f2d82 1486void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
15c4dc5a 1487{
7bc95e2e 1488 int i, j;
1489 int last;
1490 uint8_t b;
e30c654b 1491
7bc95e2e 1492 ToSendReset();
e30c654b 1493
7bc95e2e 1494 // Start of Communication (Seq. Z)
1495 ToSend[++ToSendMax] = SEC_Z;
1496 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1497 last = 0;
1498
1499 size_t bytecount = nbytes(bits);
1500 // Generate send structure for the data bits
1501 for (i = 0; i < bytecount; i++) {
1502 // Get the current byte to send
1503 b = cmd[i];
1504 size_t bitsleft = MIN((bits-(i*8)),8);
1505
1506 for (j = 0; j < bitsleft; j++) {
1507 if (b & 1) {
1508 // Sequence X
1509 ToSend[++ToSendMax] = SEC_X;
1510 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1511 last = 1;
1512 } else {
1513 if (last == 0) {
1514 // Sequence Z
1515 ToSend[++ToSendMax] = SEC_Z;
1516 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1517 } else {
1518 // Sequence Y
1519 ToSend[++ToSendMax] = SEC_Y;
1520 last = 0;
1521 }
1522 }
1523 b >>= 1;
1524 }
1525
6a1f2d82 1526 // Only transmit parity bit if we transmitted a complete byte
0ec548dc 1527 if (j == 8 && parity != NULL) {
7bc95e2e 1528 // Get the parity bit
6a1f2d82 1529 if (parity[i>>3] & (0x80 >> (i&0x0007))) {
7bc95e2e 1530 // Sequence X
1531 ToSend[++ToSendMax] = SEC_X;
1532 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1533 last = 1;
1534 } else {
1535 if (last == 0) {
1536 // Sequence Z
1537 ToSend[++ToSendMax] = SEC_Z;
1538 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1539 } else {
1540 // Sequence Y
1541 ToSend[++ToSendMax] = SEC_Y;
1542 last = 0;
1543 }
1544 }
1545 }
1546 }
e30c654b 1547
7bc95e2e 1548 // End of Communication: Logic 0 followed by Sequence Y
1549 if (last == 0) {
1550 // Sequence Z
1551 ToSend[++ToSendMax] = SEC_Z;
1552 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1553 } else {
1554 // Sequence Y
1555 ToSend[++ToSendMax] = SEC_Y;
1556 last = 0;
1557 }
1558 ToSend[++ToSendMax] = SEC_Y;
e30c654b 1559
7bc95e2e 1560 // Convert to length of command:
1561 ToSendMax++;
15c4dc5a 1562}
1563
195af472 1564//-----------------------------------------------------------------------------
1565// Prepare reader command to send to FPGA
1566//-----------------------------------------------------------------------------
6a1f2d82 1567void CodeIso14443aAsReaderPar(const uint8_t *cmd, uint16_t len, const uint8_t *parity)
195af472 1568{
6a1f2d82 1569 CodeIso14443aBitsAsReaderPar(cmd, len*8, parity);
195af472 1570}
1571
0c8d25eb 1572
9ca155ba
M
1573//-----------------------------------------------------------------------------
1574// Wait for commands from reader
1575// Stop when button is pressed (return 1) or field was gone (return 2)
1576// Or return 0 when command is captured
1577//-----------------------------------------------------------------------------
6a1f2d82 1578static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
9ca155ba
M
1579{
1580 *len = 0;
1581
1582 uint32_t timer = 0, vtime = 0;
1583 int analogCnt = 0;
1584 int analogAVG = 0;
1585
1586 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1587 // only, since we are receiving, not transmitting).
1588 // Signal field is off with the appropriate LED
1589 LED_D_OFF();
1590 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1591
1592 // Set ADC to read field strength
1593 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1594 AT91C_BASE_ADC->ADC_MR =
0c8d25eb 1595 ADC_MODE_PRESCALE(63) |
1596 ADC_MODE_STARTUP_TIME(1) |
1597 ADC_MODE_SAMPLE_HOLD_TIME(15);
9ca155ba
M
1598 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1599 // start ADC
1600 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1601
1602 // Now run a 'software UART' on the stream of incoming samples.
6a1f2d82 1603 UartInit(received, parity);
7bc95e2e 1604
1605 // Clear RXRDY:
1606 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
0c8d25eb 1607
9ca155ba
M
1608 for(;;) {
1609 WDT_HIT();
1610
1611 if (BUTTON_PRESS()) return 1;
1612
1613 // test if the field exists
1614 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1615 analogCnt++;
1616 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1617 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1618 if (analogCnt >= 32) {
0c8d25eb 1619 if ((MAX_ADC_HF_VOLTAGE * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
9ca155ba
M
1620 vtime = GetTickCount();
1621 if (!timer) timer = vtime;
1622 // 50ms no field --> card to idle state
1623 if (vtime - timer > 50) return 2;
1624 } else
1625 if (timer) timer = 0;
1626 analogCnt = 0;
1627 analogAVG = 0;
1628 }
1629 }
7bc95e2e 1630
9ca155ba 1631 // receive and test the miller decoding
7bc95e2e 1632 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1633 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1634 if(MillerDecoding(b, 0)) {
1635 *len = Uart.len;
9ca155ba
M
1636 return 0;
1637 }
7bc95e2e 1638 }
1639
9ca155ba
M
1640 }
1641}
1642
9ca155ba 1643
6a1f2d82 1644static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded)
7bc95e2e 1645{
1646 uint8_t b;
1647 uint16_t i = 0;
1648 uint32_t ThisTransferTime;
1649
9ca155ba
M
1650 // Modulate Manchester
1651 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
7bc95e2e 1652
1653 // include correction bit if necessary
1654 if (Uart.parityBits & 0x01) {
1655 correctionNeeded = TRUE;
1656 }
1657 if(correctionNeeded) {
9ca155ba
M
1658 // 1236, so correction bit needed
1659 i = 0;
7bc95e2e 1660 } else {
1661 i = 1;
9ca155ba 1662 }
7bc95e2e 1663
d714d3ef 1664 // clear receiving shift register and holding register
7bc95e2e 1665 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1666 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1667 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1668 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
9ca155ba 1669
7bc95e2e 1670 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1671 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1672 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1673 if (AT91C_BASE_SSC->SSC_RHR) break;
1674 }
1675
1676 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1677
1678 // Clear TXRDY:
1679 AT91C_BASE_SSC->SSC_THR = SEC_F;
1680
9ca155ba 1681 // send cycle
bb42a03e 1682 for(; i < respLen; ) {
9ca155ba 1683 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
7bc95e2e 1684 AT91C_BASE_SSC->SSC_THR = resp[i++];
1685 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba 1686 }
7bc95e2e 1687
17ad0e09 1688 if(BUTTON_PRESS()) break;
9ca155ba
M
1689 }
1690
7bc95e2e 1691 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
0c8d25eb 1692 uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3;
1693 for (i = 0; i <= fpga_queued_bits/8 + 1; ) {
7bc95e2e 1694 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1695 AT91C_BASE_SSC->SSC_THR = SEC_F;
1696 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1697 i++;
1698 }
1699 }
0c8d25eb 1700
7bc95e2e 1701 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1702
9ca155ba
M
1703 return 0;
1704}
1705
7bc95e2e 1706int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1707 Code4bitAnswerAsTag(resp);
0a39986e 1708 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1709 // do the tracing for the previous reader request and this tag answer:
6a1f2d82 1710 uint8_t par[1];
1711 GetParity(&resp, 1, par);
7bc95e2e 1712 EmLogTrace(Uart.output,
1713 Uart.len,
1714 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1715 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1716 Uart.parity,
7bc95e2e 1717 &resp,
1718 1,
1719 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1720 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1721 par);
0a39986e 1722 return res;
9ca155ba
M
1723}
1724
8f51ddb0 1725int EmSend4bit(uint8_t resp){
7bc95e2e 1726 return EmSend4bitEx(resp, false);
8f51ddb0
M
1727}
1728
6a1f2d82 1729int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par){
7bc95e2e 1730 CodeIso14443aAsTagPar(resp, respLen, par);
8f51ddb0 1731 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1732 // do the tracing for the previous reader request and this tag answer:
1733 EmLogTrace(Uart.output,
1734 Uart.len,
1735 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1736 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1737 Uart.parity,
7bc95e2e 1738 resp,
1739 respLen,
1740 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1741 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1742 par);
8f51ddb0
M
1743 return res;
1744}
1745
6a1f2d82 1746int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
1747 uint8_t par[MAX_PARITY_SIZE];
1748 GetParity(resp, respLen, par);
1749 return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
8f51ddb0
M
1750}
1751
6a1f2d82 1752int EmSendCmd(uint8_t *resp, uint16_t respLen){
1753 uint8_t par[MAX_PARITY_SIZE];
1754 GetParity(resp, respLen, par);
1755 return EmSendCmdExPar(resp, respLen, false, par);
8f51ddb0
M
1756}
1757
6a1f2d82 1758int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par){
7bc95e2e 1759 return EmSendCmdExPar(resp, respLen, false, par);
1760}
1761
6a1f2d82 1762bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
1763 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity)
7bc95e2e 1764{
1765 if (tracing) {
1766 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1767 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1768 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1769 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1770 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1771 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1772 reader_EndTime = tag_StartTime - exact_fdt;
1773 reader_StartTime = reader_EndTime - reader_modlen;
6a1f2d82 1774 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
7bc95e2e 1775 return FALSE;
6a1f2d82 1776 } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
7bc95e2e 1777 } else {
1778 return TRUE;
1779 }
9ca155ba
M
1780}
1781
15c4dc5a 1782//-----------------------------------------------------------------------------
1783// Wait a certain time for tag response
1784// If a response is captured return TRUE
e691fc45 1785// If it takes too long return FALSE
15c4dc5a 1786//-----------------------------------------------------------------------------
6a1f2d82 1787static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
15c4dc5a 1788{
46c65fed 1789 uint32_t c = 0x00;
e691fc45 1790
15c4dc5a 1791 // Set FPGA mode to "reader listen mode", no modulation (listen
534983d7 1792 // only, since we are receiving, not transmitting).
1793 // Signal field is on with the appropriate LED
1794 LED_D_ON();
1795 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1c611bbd 1796
534983d7 1797 // Now get the answer from the card
6a1f2d82 1798 DemodInit(receivedResponse, receivedResponsePar);
15c4dc5a 1799
7bc95e2e 1800 // clear RXRDY:
1801 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
0c8d25eb 1802
15c4dc5a 1803 for(;;) {
534983d7 1804 WDT_HIT();
15c4dc5a 1805
534983d7 1806 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
534983d7 1807 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
7bc95e2e 1808 if(ManchesterDecoding(b, offset, 0)) {
1809 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
15c4dc5a 1810 return TRUE;
19a700a8 1811 } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
7bc95e2e 1812 return FALSE;
15c4dc5a 1813 }
534983d7 1814 }
1815 }
15c4dc5a 1816}
1817
0ec548dc 1818
6a1f2d82 1819void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
15c4dc5a 1820{
6a1f2d82 1821 CodeIso14443aBitsAsReaderPar(frame, bits, par);
dfc3c505 1822
7bc95e2e 1823 // Send command to tag
1824 TransmitFor14443a(ToSend, ToSendMax, timing);
1825 if(trigger)
1826 LED_A_ON();
dfc3c505 1827
7bc95e2e 1828 // Log reader command in trace buffer
1829 if (tracing) {
6a1f2d82 1830 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
7bc95e2e 1831 }
15c4dc5a 1832}
1833
0ec548dc 1834
6a1f2d82 1835void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
dfc3c505 1836{
6a1f2d82 1837 ReaderTransmitBitsPar(frame, len*8, par, timing);
dfc3c505 1838}
15c4dc5a 1839
0ec548dc 1840
6a1f2d82 1841void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
e691fc45 1842{
1843 // Generate parity and redirect
6a1f2d82 1844 uint8_t par[MAX_PARITY_SIZE];
1845 GetParity(frame, len/8, par);
1846 ReaderTransmitBitsPar(frame, len, par, timing);
e691fc45 1847}
1848
0ec548dc 1849
6a1f2d82 1850void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
15c4dc5a 1851{
1852 // Generate parity and redirect
6a1f2d82 1853 uint8_t par[MAX_PARITY_SIZE];
1854 GetParity(frame, len, par);
1855 ReaderTransmitBitsPar(frame, len*8, par, timing);
15c4dc5a 1856}
1857
6a1f2d82 1858int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
e691fc45 1859{
6a1f2d82 1860 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE;
7bc95e2e 1861 if (tracing) {
6a1f2d82 1862 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
7bc95e2e 1863 }
e691fc45 1864 return Demod.len;
1865}
1866
6a1f2d82 1867int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
15c4dc5a 1868{
6a1f2d82 1869 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
7bc95e2e 1870 if (tracing) {
6a1f2d82 1871 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
7bc95e2e 1872 }
e691fc45 1873 return Demod.len;
f89c7050
M
1874}
1875
e691fc45 1876/* performs iso14443a anticollision procedure
534983d7 1877 * fills the uid pointer unless NULL
1878 * fills resp_data unless NULL */
6a1f2d82 1879int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, uint32_t *cuid_ptr) {
1880 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1881 uint8_t sel_all[] = { 0x93,0x20 };
1882 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1883 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
f71f4deb 1884 uint8_t resp[MAX_FRAME_SIZE]; // theoretically. A usual RATS will be much smaller
1885 uint8_t resp_par[MAX_PARITY_SIZE];
6a1f2d82 1886 byte_t uid_resp[4];
1887 size_t uid_resp_len;
1888
1889 uint8_t sak = 0x04; // cascade uid
1890 int cascade_level = 0;
1891 int len;
1892
1893 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
9492e0b0 1894 ReaderTransmitBitsPar(wupa,7,0, NULL);
7bc95e2e 1895
6a1f2d82 1896 // Receive the ATQA
1897 if(!ReaderReceive(resp, resp_par)) return 0;
6a1f2d82 1898
1899 if(p_hi14a_card) {
1900 memcpy(p_hi14a_card->atqa, resp, 2);
1901 p_hi14a_card->uidlen = 0;
1902 memset(p_hi14a_card->uid,0,10);
1903 }
5f6d6c90 1904
6a1f2d82 1905 // clear uid
1906 if (uid_ptr) {
1907 memset(uid_ptr,0,10);
1908 }
79a73ab2 1909
0ec548dc 1910 // check for proprietary anticollision:
1911 if ((resp[0] & 0x1F) == 0) {
1912 return 3;
1913 }
1914
6a1f2d82 1915 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1916 // which case we need to make a cascade 2 request and select - this is a long UID
1917 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1918 for(; sak & 0x04; cascade_level++) {
1919 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1920 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1921
1922 // SELECT_ALL
1923 ReaderTransmit(sel_all, sizeof(sel_all), NULL);
1924 if (!ReaderReceive(resp, resp_par)) return 0;
1925
1926 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1927 memset(uid_resp, 0, 4);
1928 uint16_t uid_resp_bits = 0;
1929 uint16_t collision_answer_offset = 0;
1930 // anti-collision-loop:
1931 while (Demod.collisionPos) {
1932 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1933 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1934 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
758f1fd1 1935 uid_resp[uid_resp_bits / 8] |= UIDbit << (uid_resp_bits % 8);
6a1f2d82 1936 }
1937 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1938 uid_resp_bits++;
1939 // construct anticollosion command:
1940 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1941 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1942 sel_uid[2+i] = uid_resp[i];
1943 }
1944 collision_answer_offset = uid_resp_bits%8;
1945 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1946 if (!ReaderReceiveOffset(resp, collision_answer_offset, resp_par)) return 0;
e691fc45 1947 }
6a1f2d82 1948 // finally, add the last bits and BCC of the UID
1949 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1950 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1951 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
e691fc45 1952 }
e691fc45 1953
6a1f2d82 1954 } else { // no collision, use the response to SELECT_ALL as current uid
1955 memcpy(uid_resp, resp, 4);
1956 }
1957 uid_resp_len = 4;
5f6d6c90 1958
6a1f2d82 1959 // calculate crypto UID. Always use last 4 Bytes.
1960 if(cuid_ptr) {
1961 *cuid_ptr = bytes_to_num(uid_resp, 4);
1962 }
e30c654b 1963
6a1f2d82 1964 // Construct SELECT UID command
1965 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1966 memcpy(sel_uid+2, uid_resp, 4); // the UID
1967 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1968 AppendCrc14443a(sel_uid, 7); // calculate and add CRC
1969 ReaderTransmit(sel_uid, sizeof(sel_uid), NULL);
1970
1971 // Receive the SAK
1972 if (!ReaderReceive(resp, resp_par)) return 0;
1973 sak = resp[0];
1974
52ab55ab 1975 // Test if more parts of the uid are coming
6a1f2d82 1976 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
1977 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1978 // http://www.nxp.com/documents/application_note/AN10927.pdf
6a1f2d82 1979 uid_resp[0] = uid_resp[1];
1980 uid_resp[1] = uid_resp[2];
1981 uid_resp[2] = uid_resp[3];
1982
1983 uid_resp_len = 3;
1984 }
5f6d6c90 1985
6a1f2d82 1986 if(uid_ptr) {
1987 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
1988 }
5f6d6c90 1989
6a1f2d82 1990 if(p_hi14a_card) {
1991 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
1992 p_hi14a_card->uidlen += uid_resp_len;
1993 }
1994 }
79a73ab2 1995
6a1f2d82 1996 if(p_hi14a_card) {
1997 p_hi14a_card->sak = sak;
1998 p_hi14a_card->ats_len = 0;
1999 }
534983d7 2000
3fe4ff4f 2001 // non iso14443a compliant tag
2002 if( (sak & 0x20) == 0) return 2;
534983d7 2003
6a1f2d82 2004 // Request for answer to select
2005 AppendCrc14443a(rats, 2);
2006 ReaderTransmit(rats, sizeof(rats), NULL);
1c611bbd 2007
6a1f2d82 2008 if (!(len = ReaderReceive(resp, resp_par))) return 0;
5191b3d1 2009
3fe4ff4f 2010
6a1f2d82 2011 if(p_hi14a_card) {
2012 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
2013 p_hi14a_card->ats_len = len;
2014 }
5f6d6c90 2015
6a1f2d82 2016 // reset the PCB block number
2017 iso14_pcb_blocknum = 0;
19a700a8 2018
2019 // set default timeout based on ATS
2020 iso14a_set_ATS_timeout(resp);
2021
6a1f2d82 2022 return 1;
7e758047 2023}
15c4dc5a 2024
7bc95e2e 2025void iso14443a_setup(uint8_t fpga_minor_mode) {
7cc204bf 2026 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9492e0b0 2027 // Set up the synchronous serial port
2028 FpgaSetupSsc();
7bc95e2e 2029 // connect Demodulated Signal to ADC:
7e758047 2030 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
e30c654b 2031
7e758047 2032 // Signal field is on with the appropriate LED
7bc95e2e 2033 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
2034 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
2035 LED_D_ON();
2036 } else {
2037 LED_D_OFF();
2038 }
2039 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
534983d7 2040
7bc95e2e 2041 // Start the timer
2042 StartCountSspClk();
2043
2044 DemodReset();
2045 UartReset();
2046 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
46c65fed 2047 iso14a_set_timeout(10*106); // 10ms default
7e758047 2048}
15c4dc5a 2049
6a1f2d82 2050int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
2051 uint8_t parity[MAX_PARITY_SIZE];
534983d7 2052 uint8_t real_cmd[cmd_len+4];
2053 real_cmd[0] = 0x0a; //I-Block
b0127e65 2054 // put block number into the PCB
2055 real_cmd[0] |= iso14_pcb_blocknum;
534983d7 2056 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
2057 memcpy(real_cmd+2, cmd, cmd_len);
2058 AppendCrc14443a(real_cmd,cmd_len+2);
2059
9492e0b0 2060 ReaderTransmit(real_cmd, cmd_len+4, NULL);
6a1f2d82 2061 size_t len = ReaderReceive(data, parity);
2062 uint8_t *data_bytes = (uint8_t *) data;
b0127e65 2063 if (!len)
2064 return 0; //DATA LINK ERROR
2065 // if we received an I- or R(ACK)-Block with a block number equal to the
2066 // current block number, toggle the current block number
2067 else if (len >= 4 // PCB+CID+CRC = 4 bytes
2068 && ((data_bytes[0] & 0xC0) == 0 // I-Block
2069 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
2070 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
2071 {
2072 iso14_pcb_blocknum ^= 1;
2073 }
2074
534983d7 2075 return len;
2076}
2077
7e758047 2078//-----------------------------------------------------------------------------
2079// Read an ISO 14443a tag. Send out commands and store answers.
2080//
2081//-----------------------------------------------------------------------------
7bc95e2e 2082void ReaderIso14443a(UsbCommand *c)
7e758047 2083{
534983d7 2084 iso14a_command_t param = c->arg[0];
7bc95e2e 2085 uint8_t *cmd = c->d.asBytes;
04bc1c66 2086 size_t len = c->arg[1] & 0xffff;
2087 size_t lenbits = c->arg[1] >> 16;
2088 uint32_t timeout = c->arg[2];
9492e0b0 2089 uint32_t arg0 = 0;
2090 byte_t buf[USB_CMD_DATA_SIZE];
6a1f2d82 2091 uint8_t par[MAX_PARITY_SIZE];
902cb3c0 2092
5f6d6c90 2093 if(param & ISO14A_CONNECT) {
3000dc4e 2094 clear_trace();
5f6d6c90 2095 }
e691fc45 2096
3000dc4e 2097 set_tracing(TRUE);
e30c654b 2098
79a73ab2 2099 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 2100 iso14a_set_trigger(TRUE);
9492e0b0 2101 }
15c4dc5a 2102
534983d7 2103 if(param & ISO14A_CONNECT) {
7bc95e2e 2104 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
5f6d6c90 2105 if(!(param & ISO14A_NO_SELECT)) {
2106 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
2107 arg0 = iso14443a_select_card(NULL,card,NULL);
2108 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
2109 }
534983d7 2110 }
e30c654b 2111
534983d7 2112 if(param & ISO14A_SET_TIMEOUT) {
04bc1c66 2113 iso14a_set_timeout(timeout);
534983d7 2114 }
e30c654b 2115
534983d7 2116 if(param & ISO14A_APDU) {
902cb3c0 2117 arg0 = iso14_apdu(cmd, len, buf);
79a73ab2 2118 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 2119 }
e30c654b 2120
534983d7 2121 if(param & ISO14A_RAW) {
2122 if(param & ISO14A_APPEND_CRC) {
0ec548dc 2123 if(param & ISO14A_TOPAZMODE) {
2124 AppendCrc14443b(cmd,len);
2125 } else {
d26849d4 2126 AppendCrc14443a(cmd,len);
0ec548dc 2127 }
534983d7 2128 len += 2;
c7324bef 2129 if (lenbits) lenbits += 16;
15c4dc5a 2130 }
0ec548dc 2131 if(lenbits>0) { // want to send a specific number of bits (e.g. short commands)
2132 if(param & ISO14A_TOPAZMODE) {
2133 int bits_to_send = lenbits;
2134 uint16_t i = 0;
2135 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 7), NULL, NULL); // first byte is always short (7bits) and no parity
2136 bits_to_send -= 7;
2137 while (bits_to_send > 0) {
2138 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 8), NULL, NULL); // following bytes are 8 bit and no parity
2139 bits_to_send -= 8;
2140 }
2141 } else {
6a1f2d82 2142 GetParity(cmd, lenbits/8, par);
0ec548dc 2143 ReaderTransmitBitsPar(cmd, lenbits, par, NULL); // bytes are 8 bit with odd parity
2144 }
2145 } else { // want to send complete bytes only
2146 if(param & ISO14A_TOPAZMODE) {
2147 uint16_t i = 0;
2148 ReaderTransmitBitsPar(&cmd[i++], 7, NULL, NULL); // first byte: 7 bits, no paritiy
2149 while (i < len) {
2150 ReaderTransmitBitsPar(&cmd[i++], 8, NULL, NULL); // following bytes: 8 bits, no paritiy
2151 }
5f6d6c90 2152 } else {
0ec548dc 2153 ReaderTransmit(cmd,len, NULL); // 8 bits, odd parity
2154 }
5f6d6c90 2155 }
6a1f2d82 2156 arg0 = ReaderReceive(buf, par);
9492e0b0 2157 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 2158 }
15c4dc5a 2159
79a73ab2 2160 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 2161 iso14a_set_trigger(FALSE);
9492e0b0 2162 }
15c4dc5a 2163
79a73ab2 2164 if(param & ISO14A_NO_DISCONNECT) {
534983d7 2165 return;
9492e0b0 2166 }
15c4dc5a 2167
15c4dc5a 2168 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2169 LEDsoff();
15c4dc5a 2170}
b0127e65 2171
1c611bbd 2172
1c611bbd 2173// Determine the distance between two nonces.
2174// Assume that the difference is small, but we don't know which is first.
2175// Therefore try in alternating directions.
2176int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
2177
1c611bbd 2178 if (nt1 == nt2) return 0;
2179
d26849d4 2180 uint16_t i;
2181 uint32_t nttmp1 = nt1;
2182 uint32_t nttmp2 = nt2;
1c611bbd 2183
2184 for (i = 1; i < 32768; i++) {
2185 nttmp1 = prng_successor(nttmp1, 1);
2186 if (nttmp1 == nt2) return i;
2187 nttmp2 = prng_successor(nttmp2, 1);
2188 if (nttmp2 == nt1) return -i;
2189 }
2190
2191 return(-99999); // either nt1 or nt2 are invalid nonces
e772353f 2192}
2193
e772353f 2194
1c611bbd 2195//-----------------------------------------------------------------------------
2196// Recover several bits of the cypher stream. This implements (first stages of)
2197// the algorithm described in "The Dark Side of Security by Obscurity and
2198// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2199// (article by Nicolas T. Courtois, 2009)
2200//-----------------------------------------------------------------------------
d26849d4 2201void ReaderMifare(bool first_try) {
f71f4deb 2202 // free eventually allocated BigBuf memory. We want all for tracing.
2203 BigBuf_free();
2204
3000dc4e
MHS
2205 clear_trace();
2206 set_tracing(TRUE);
e772353f 2207
d26849d4 2208 // Mifare AUTH
2209 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
2210 uint8_t mf_nr_ar[8] = { 0x00 }; //{ 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 };
2211 static uint8_t mf_nr_ar3 = 0;
2212
2213 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = { 0x00 };
2214 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = { 0x00 };
2215
1c611bbd 2216 byte_t nt_diff = 0;
6a1f2d82 2217 uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
1c611bbd 2218 static byte_t par_low = 0;
2219 bool led_on = TRUE;
d26849d4 2220 uint8_t uid[10] = {0x00};
2221 //uint32_t cuid = 0x00;
e772353f 2222
6a1f2d82 2223 uint32_t nt = 0;
2ed270a8 2224 uint32_t previous_nt = 0;
1c611bbd 2225 static uint32_t nt_attacked = 0;
3fe4ff4f 2226 byte_t par_list[8] = {0x00};
2227 byte_t ks_list[8] = {0x00};
e772353f 2228
d26849d4 2229 static uint32_t sync_time = 0;
2230 static uint32_t sync_cycles = 0;
1c611bbd 2231 int catch_up_cycles = 0;
2232 int last_catch_up = 0;
2233 uint16_t consecutive_resyncs = 0;
2234 int isOK = 0;
e772353f 2235
d26849d4 2236 int numWrongDistance = 0;
2237
1c611bbd 2238 if (first_try) {
1c611bbd 2239 mf_nr_ar3 = 0;
7bc95e2e 2240 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2241 sync_time = GetCountSspClk() & 0xfffffff8;
1c611bbd 2242 sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
2243 nt_attacked = 0;
2244 nt = 0;
6a1f2d82 2245 par[0] = 0;
1c611bbd 2246 }
2247 else {
2248 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
1c611bbd 2249 mf_nr_ar3++;
2250 mf_nr_ar[3] = mf_nr_ar3;
6a1f2d82 2251 par[0] = par_low;
1c611bbd 2252 }
e30c654b 2253
15c4dc5a 2254 LED_A_ON();
2255 LED_B_OFF();
2256 LED_C_OFF();
d26849d4 2257 LED_C_ON();
7bc95e2e 2258
1c611bbd 2259 for(uint16_t i = 0; TRUE; i++) {
2260
2261 WDT_HIT();
e30c654b 2262
1c611bbd 2263 // Test if the action was cancelled
d26849d4 2264 if(BUTTON_PRESS()) break;
2265
2266 if (numWrongDistance > 1000) {
2267 isOK = 0;
1c611bbd 2268 break;
2269 }
2270
d26849d4 2271 //if(!iso14443a_select_card(uid, NULL, &cuid)) {
2272 if(!iso14443a_select_card(uid, NULL, NULL)) {
9492e0b0 2273 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
1c611bbd 2274 continue;
2275 }
2276
9492e0b0 2277 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
1c611bbd 2278 catch_up_cycles = 0;
2279
2280 // if we missed the sync time already, advance to the next nonce repeat
7bc95e2e 2281 while(GetCountSspClk() > sync_time) {
9492e0b0 2282 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
1c611bbd 2283 }
e30c654b 2284
9492e0b0 2285 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2286 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
f89c7050 2287
1c611bbd 2288 // Receive the (4 Byte) "random" nonce
6a1f2d82 2289 if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
9492e0b0 2290 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
1c611bbd 2291 continue;
2292 }
2293
1c611bbd 2294 previous_nt = nt;
2295 nt = bytes_to_num(receivedAnswer, 4);
2296
2297 // Transmit reader nonce with fake par
9492e0b0 2298 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
1c611bbd 2299
2300 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2301 int nt_distance = dist_nt(previous_nt, nt);
2302 if (nt_distance == 0) {
2303 nt_attacked = nt;
2304 }
2305 else {
d26849d4 2306
2307 // invalid nonce received, try again
2308 if (nt_distance == -99999) {
2309 numWrongDistance++;
2310 if (MF_DBGLEVEL >= 3) Dbprintf("The two nonces has invalid distance, tag could have good PRNG\n");
1c611bbd 2311 continue;
2312 }
d26849d4 2313
1c611bbd 2314 sync_cycles = (sync_cycles - nt_distance);
9492e0b0 2315 if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
1c611bbd 2316 continue;
2317 }
2318 }
2319
2320 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2321 catch_up_cycles = -dist_nt(nt_attacked, nt);
d26849d4 2322 if (catch_up_cycles >= 99999) { // invalid nonce received. Don't resync on that one.
1c611bbd 2323 catch_up_cycles = 0;
2324 continue;
2325 }
2326 if (catch_up_cycles == last_catch_up) {
2327 consecutive_resyncs++;
2328 }
2329 else {
2330 last_catch_up = catch_up_cycles;
2331 consecutive_resyncs = 0;
2332 }
2333 if (consecutive_resyncs < 3) {
9492e0b0 2334 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
1c611bbd 2335 }
2336 else {
2337 sync_cycles = sync_cycles + catch_up_cycles;
9492e0b0 2338 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
1c611bbd 2339 }
2340 continue;
2341 }
2342
2343 consecutive_resyncs = 0;
2344
2345 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
6a1f2d82 2346 if (ReaderReceive(receivedAnswer, receivedAnswerPar))
1c611bbd 2347 {
9492e0b0 2348 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
1c611bbd 2349
2350 if (nt_diff == 0)
2351 {
6a1f2d82 2352 par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
1c611bbd 2353 }
2354
2355 led_on = !led_on;
2356 if(led_on) LED_B_ON(); else LED_B_OFF();
2357
6a1f2d82 2358 par_list[nt_diff] = SwapBits(par[0], 8);
1c611bbd 2359 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2360
2361 // Test if the information is complete
2362 if (nt_diff == 0x07) {
2363 isOK = 1;
2364 break;
2365 }
2366
2367 nt_diff = (nt_diff + 1) & 0x07;
2368 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
6a1f2d82 2369 par[0] = par_low;
1c611bbd 2370 } else {
2371 if (nt_diff == 0 && first_try)
2372 {
6a1f2d82 2373 par[0]++;
1c611bbd 2374 } else {
6a1f2d82 2375 par[0] = ((par[0] & 0x1F) + 1) | par_low;
1c611bbd 2376 }
2377 }
2378 }
2379
1c611bbd 2380 mf_nr_ar[3] &= 0x1F;
2381
d26849d4 2382 byte_t buf[28] = {0x00};
2383
1c611bbd 2384 memcpy(buf + 0, uid, 4);
2385 num_to_bytes(nt, 4, buf + 4);
2386 memcpy(buf + 8, par_list, 8);
2387 memcpy(buf + 16, ks_list, 8);
2388 memcpy(buf + 24, mf_nr_ar, 4);
2389
2390 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2391
d26849d4 2392 set_tracing(FALSE);
1c611bbd 2393 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2394 LEDsoff();
20f9a2a1 2395}
1c611bbd 2396
d26849d4 2397
2398 /*
d2f487af 2399 *MIFARE 1K simulate.
2400 *
2401 *@param flags :
2402 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2403 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2404 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2405 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2406 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2407 */
2408void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
20f9a2a1 2409{
50193c1e 2410 int cardSTATE = MFEMUL_NOFIELD;
8556b852 2411 int _7BUID = 0;
9ca155ba 2412 int vHf = 0; // in mV
8f51ddb0 2413 int res;
0a39986e
M
2414 uint32_t selTimer = 0;
2415 uint32_t authTimer = 0;
6a1f2d82 2416 uint16_t len = 0;
8f51ddb0 2417 uint8_t cardWRBL = 0;
9ca155ba
M
2418 uint8_t cardAUTHSC = 0;
2419 uint8_t cardAUTHKEY = 0xff; // no authentication
c3c241f3 2420// uint32_t cardRr = 0;
9ca155ba 2421 uint32_t cuid = 0;
d2f487af 2422 //uint32_t rn_enc = 0;
51969283 2423 uint32_t ans = 0;
0014cb46
M
2424 uint32_t cardINTREG = 0;
2425 uint8_t cardINTBLOCK = 0;
9ca155ba
M
2426 struct Crypto1State mpcs = {0, 0};
2427 struct Crypto1State *pcs;
2428 pcs = &mpcs;
d2f487af 2429 uint32_t numReads = 0;//Counts numer of times reader read a block
f71f4deb 2430 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2431 uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE];
2432 uint8_t response[MAX_MIFARE_FRAME_SIZE];
2433 uint8_t response_par[MAX_MIFARE_PARITY_SIZE];
9ca155ba 2434
d2f487af 2435 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2436 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2437 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
c3c241f3 2438 //uint8_t rSAK[] = {0x08, 0xb6, 0xdd}; // Mifare Classic
2439 uint8_t rSAK[] = {0x09, 0x3f, 0xcc }; // Mifare Mini
d2f487af 2440 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
9ca155ba 2441
2d2f7d19 2442 uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
d2f487af 2443 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
7bc95e2e 2444
d2f487af 2445 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2446 // This can be used in a reader-only attack.
2447 // (it can also be retrieved via 'hf 14a list', but hey...
c3c241f3 2448 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
d2f487af 2449 uint8_t ar_nr_collected = 0;
0014cb46 2450
f71f4deb 2451 // free eventually allocated BigBuf memory but keep Emulator Memory
2452 BigBuf_free_keep_EM();
0c8d25eb 2453
0a39986e 2454 // clear trace
3000dc4e
MHS
2455 clear_trace();
2456 set_tracing(TRUE);
51969283 2457
7bc95e2e 2458 // Authenticate response - nonce
51969283 2459 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
7bc95e2e 2460
d2f487af 2461 //-- Determine the UID
2462 // Can be set from emulator memory, incoming data
2463 // and can be 7 or 4 bytes long
7bc95e2e 2464 if (flags & FLAG_4B_UID_IN_DATA)
d2f487af 2465 {
2466 // 4B uid comes from data-portion of packet
2467 memcpy(rUIDBCC1,datain,4);
8556b852 2468 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852 2469
7bc95e2e 2470 } else if (flags & FLAG_7B_UID_IN_DATA) {
d2f487af 2471 // 7B uid comes from data-portion of packet
2472 memcpy(&rUIDBCC1[1],datain,3);
2473 memcpy(rUIDBCC2, datain+3, 4);
2474 _7BUID = true;
7bc95e2e 2475 } else {
d2f487af 2476 // get UID from emul memory
2477 emlGetMemBt(receivedCmd, 7, 1);
2478 _7BUID = !(receivedCmd[0] == 0x00);
2479 if (!_7BUID) { // ---------- 4BUID
2480 emlGetMemBt(rUIDBCC1, 0, 4);
2481 } else { // ---------- 7BUID
2482 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2483 emlGetMemBt(rUIDBCC2, 3, 4);
2484 }
2485 }
7bc95e2e 2486
c3c241f3 2487 // save uid.
2488 ar_nr_responses[0*5] = bytes_to_num(rUIDBCC1+1, 3);
2489 if ( _7BUID )
2490 ar_nr_responses[0*5+1] = bytes_to_num(rUIDBCC2, 4);
2491
d2f487af 2492 /*
2493 * Regardless of what method was used to set the UID, set fifth byte and modify
2494 * the ATQA for 4 or 7-byte UID
2495 */
d2f487af 2496 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
7bc95e2e 2497 if (_7BUID) {
d2f487af 2498 rATQA[0] = 0x44;
8556b852 2499 rUIDBCC1[0] = 0x88;
d26849d4 2500 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852
M
2501 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2502 }
2503
9ca155ba 2504 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 2505 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
9ca155ba 2506
9ca155ba 2507
d2f487af 2508 if (MF_DBGLEVEL >= 1) {
2509 if (!_7BUID) {
b03c0f2d 2510 Dbprintf("4B UID: %02x%02x%02x%02x",
2511 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
7bc95e2e 2512 } else {
b03c0f2d 2513 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2514 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
2515 rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
d2f487af 2516 }
2517 }
7bc95e2e 2518
2519 bool finished = FALSE;
d2f487af 2520 while (!BUTTON_PRESS() && !finished) {
9ca155ba 2521 WDT_HIT();
9ca155ba
M
2522
2523 // find reader field
9ca155ba 2524 if (cardSTATE == MFEMUL_NOFIELD) {
0c8d25eb 2525 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
9ca155ba 2526 if (vHf > MF_MINFIELDV) {
0014cb46 2527 cardSTATE_TO_IDLE();
9ca155ba
M
2528 LED_A_ON();
2529 }
2530 }
d2f487af 2531 if(cardSTATE == MFEMUL_NOFIELD) continue;
9ca155ba 2532
d2f487af 2533 //Now, get data
6a1f2d82 2534 res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
d2f487af 2535 if (res == 2) { //Field is off!
2536 cardSTATE = MFEMUL_NOFIELD;
2537 LEDsoff();
2538 continue;
7bc95e2e 2539 } else if (res == 1) {
2540 break; //return value 1 means button press
2541 }
2542
d2f487af 2543 // REQ or WUP request in ANY state and WUP in HALTED state
2544 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2545 selTimer = GetTickCount();
2546 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2547 cardSTATE = MFEMUL_SELECT1;
2548
2549 // init crypto block
2550 LED_B_OFF();
2551 LED_C_OFF();
2552 crypto1_destroy(pcs);
2553 cardAUTHKEY = 0xff;
2554 continue;
0a39986e 2555 }
7bc95e2e 2556
50193c1e 2557 switch (cardSTATE) {
d2f487af 2558 case MFEMUL_NOFIELD:
2559 case MFEMUL_HALTED:
50193c1e 2560 case MFEMUL_IDLE:{
6a1f2d82 2561 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
50193c1e
M
2562 break;
2563 }
2564 case MFEMUL_SELECT1:{
9ca155ba
M
2565 // select all
2566 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
d2f487af 2567 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
9ca155ba 2568 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
0014cb46 2569 break;
9ca155ba
M
2570 }
2571
d2f487af 2572 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2573 {
2574 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2575 }
9ca155ba 2576 // select card
0a39986e
M
2577 if (len == 9 &&
2578 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
bfb6a143 2579 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
9ca155ba 2580 cuid = bytes_to_num(rUIDBCC1, 4);
8556b852
M
2581 if (!_7BUID) {
2582 cardSTATE = MFEMUL_WORK;
0014cb46
M
2583 LED_B_ON();
2584 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2585 break;
8556b852
M
2586 } else {
2587 cardSTATE = MFEMUL_SELECT2;
8556b852 2588 }
9ca155ba 2589 }
50193c1e
M
2590 break;
2591 }
d2f487af 2592 case MFEMUL_AUTH1:{
2593 if( len != 8)
2594 {
2595 cardSTATE_TO_IDLE();
6a1f2d82 2596 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
d2f487af 2597 break;
2598 }
0c8d25eb 2599
d2f487af 2600 uint32_t ar = bytes_to_num(receivedCmd, 4);
6a1f2d82 2601 uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
d2f487af 2602
2603 //Collect AR/NR
46cd801c 2604 //if(ar_nr_collected < 2 && cardAUTHSC == 2){
2605 if(ar_nr_collected < 2){
273b57a7 2606 if(ar_nr_responses[2] != ar)
2607 {// Avoid duplicates... probably not necessary, ar should vary.
c3c241f3 2608 //ar_nr_responses[ar_nr_collected*5] = 0;
2609 //ar_nr_responses[ar_nr_collected*5+1] = 0;
2610 ar_nr_responses[ar_nr_collected*5+2] = nonce;
2611 ar_nr_responses[ar_nr_collected*5+3] = nr;
2612 ar_nr_responses[ar_nr_collected*5+4] = ar;
273b57a7 2613 ar_nr_collected++;
12d708fe 2614 }
2615 // Interactive mode flag, means we need to send ACK
2616 if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
2617 {
2618 finished = true;
46cd801c 2619 }
d2f487af 2620 }
2621
2622 // --- crypto
c3c241f3 2623 //crypto1_word(pcs, ar , 1);
2624 //cardRr = nr ^ crypto1_word(pcs, 0, 0);
2625
2626 //test if auth OK
2627 //if (cardRr != prng_successor(nonce, 64)){
2628
2629 //if (MF_DBGLEVEL >= 4) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2630 // cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2631 // cardRr, prng_successor(nonce, 64));
7bc95e2e 2632 // Shouldn't we respond anything here?
d2f487af 2633 // Right now, we don't nack or anything, which causes the
2634 // reader to do a WUPA after a while. /Martin
b03c0f2d 2635 // -- which is the correct response. /piwi
c3c241f3 2636 //cardSTATE_TO_IDLE();
2637 //LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2638 //break;
2639 //}
d2f487af 2640
2641 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2642
2643 num_to_bytes(ans, 4, rAUTH_AT);
2644 // --- crypto
2645 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2646 LED_C_ON();
2647 cardSTATE = MFEMUL_WORK;
b03c0f2d 2648 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2649 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2650 GetTickCount() - authTimer);
d2f487af 2651 break;
2652 }
50193c1e 2653 case MFEMUL_SELECT2:{
7bc95e2e 2654 if (!len) {
6a1f2d82 2655 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2656 break;
2657 }
8556b852 2658 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
9ca155ba 2659 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
8556b852
M
2660 break;
2661 }
9ca155ba 2662
8556b852
M
2663 // select 2 card
2664 if (len == 9 &&
2665 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2666 EmSendCmd(rSAK, sizeof(rSAK));
8556b852
M
2667 cuid = bytes_to_num(rUIDBCC2, 4);
2668 cardSTATE = MFEMUL_WORK;
2669 LED_B_ON();
0014cb46 2670 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
8556b852
M
2671 break;
2672 }
0014cb46
M
2673
2674 // i guess there is a command). go into the work state.
7bc95e2e 2675 if (len != 4) {
6a1f2d82 2676 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2677 break;
2678 }
0014cb46 2679 cardSTATE = MFEMUL_WORK;
d2f487af 2680 //goto lbWORK;
2681 //intentional fall-through to the next case-stmt
50193c1e 2682 }
51969283 2683
7bc95e2e 2684 case MFEMUL_WORK:{
2685 if (len == 0) {
6a1f2d82 2686 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2687 break;
2688 }
2689
d2f487af 2690 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2691
7bc95e2e 2692 if(encrypted_data) {
51969283
M
2693 // decrypt seqence
2694 mf_crypto1_decrypt(pcs, receivedCmd, len);
d2f487af 2695 }
7bc95e2e 2696
d2f487af 2697 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2698 authTimer = GetTickCount();
2699 cardAUTHSC = receivedCmd[1] / 4; // received block num
2700 cardAUTHKEY = receivedCmd[0] - 0x60;
2701 crypto1_destroy(pcs);//Added by martin
2702 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
51969283 2703
d2f487af 2704 if (!encrypted_data) { // first authentication
b03c0f2d 2705 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
51969283 2706
d2f487af 2707 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2708 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
7bc95e2e 2709 } else { // nested authentication
b03c0f2d 2710 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
7bc95e2e 2711 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
d2f487af 2712 num_to_bytes(ans, 4, rAUTH_AT);
2713 }
0c8d25eb 2714
d2f487af 2715 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2716 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2717 cardSTATE = MFEMUL_AUTH1;
2718 break;
51969283 2719 }
7bc95e2e 2720
8f51ddb0
M
2721 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2722 // BUT... ACK --> NACK
2723 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2724 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2725 break;
2726 }
2727
2728 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2729 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2730 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2731 break;
0a39986e
M
2732 }
2733
7bc95e2e 2734 if(len != 4) {
6a1f2d82 2735 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2736 break;
2737 }
d2f487af 2738
2739 if(receivedCmd[0] == 0x30 // read block
2740 || receivedCmd[0] == 0xA0 // write block
b03c0f2d 2741 || receivedCmd[0] == 0xC0 // inc
2742 || receivedCmd[0] == 0xC1 // dec
2743 || receivedCmd[0] == 0xC2 // restore
7bc95e2e 2744 || receivedCmd[0] == 0xB0) { // transfer
2745 if (receivedCmd[1] >= 16 * 4) {
d2f487af 2746 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
c3c241f3 2747 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2748 break;
2749 }
2750
7bc95e2e 2751 if (receivedCmd[1] / 4 != cardAUTHSC) {
8f51ddb0 2752 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
c3c241f3 2753 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
8f51ddb0
M
2754 break;
2755 }
d2f487af 2756 }
2757 // read block
2758 if (receivedCmd[0] == 0x30) {
b03c0f2d 2759 if (MF_DBGLEVEL >= 4) {
d2f487af 2760 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2761 }
8f51ddb0
M
2762 emlGetMem(response, receivedCmd[1], 1);
2763 AppendCrc14443a(response, 16);
6a1f2d82 2764 mf_crypto1_encrypt(pcs, response, 18, response_par);
2765 EmSendCmdPar(response, 18, response_par);
d2f487af 2766 numReads++;
12d708fe 2767 if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
d2f487af 2768 Dbprintf("%d reads done, exiting", numReads);
2769 finished = true;
2770 }
0a39986e
M
2771 break;
2772 }
0a39986e 2773 // write block
d2f487af 2774 if (receivedCmd[0] == 0xA0) {
b03c0f2d 2775 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
8f51ddb0 2776 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
8f51ddb0
M
2777 cardSTATE = MFEMUL_WRITEBL2;
2778 cardWRBL = receivedCmd[1];
0a39986e 2779 break;
7bc95e2e 2780 }
0014cb46 2781 // increment, decrement, restore
d2f487af 2782 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
b03c0f2d 2783 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2784 if (emlCheckValBl(receivedCmd[1])) {
c3c241f3 2785 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
0014cb46
M
2786 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2787 break;
2788 }
2789 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2790 if (receivedCmd[0] == 0xC1)
2791 cardSTATE = MFEMUL_INTREG_INC;
2792 if (receivedCmd[0] == 0xC0)
2793 cardSTATE = MFEMUL_INTREG_DEC;
2794 if (receivedCmd[0] == 0xC2)
2795 cardSTATE = MFEMUL_INTREG_REST;
2796 cardWRBL = receivedCmd[1];
0014cb46
M
2797 break;
2798 }
0014cb46 2799 // transfer
d2f487af 2800 if (receivedCmd[0] == 0xB0) {
b03c0f2d 2801 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
0014cb46
M
2802 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2803 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2804 else
2805 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
0014cb46
M
2806 break;
2807 }
9ca155ba 2808 // halt
d2f487af 2809 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
9ca155ba 2810 LED_B_OFF();
0a39986e 2811 LED_C_OFF();
0014cb46
M
2812 cardSTATE = MFEMUL_HALTED;
2813 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
6a1f2d82 2814 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0a39986e 2815 break;
9ca155ba 2816 }
d2f487af 2817 // RATS
2818 if (receivedCmd[0] == 0xe0) {//RATS
8f51ddb0
M
2819 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2820 break;
2821 }
d2f487af 2822 // command not allowed
2823 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2824 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
51969283 2825 break;
8f51ddb0
M
2826 }
2827 case MFEMUL_WRITEBL2:{
2828 if (len == 18){
2829 mf_crypto1_decrypt(pcs, receivedCmd, len);
2830 emlSetMem(receivedCmd, cardWRBL, 1);
2831 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2832 cardSTATE = MFEMUL_WORK;
51969283 2833 } else {
0014cb46 2834 cardSTATE_TO_IDLE();
6a1f2d82 2835 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
8f51ddb0 2836 }
8f51ddb0 2837 break;
50193c1e 2838 }
0014cb46
M
2839
2840 case MFEMUL_INTREG_INC:{
2841 mf_crypto1_decrypt(pcs, receivedCmd, len);
2842 memcpy(&ans, receivedCmd, 4);
2843 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2844 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2845 cardSTATE_TO_IDLE();
2846 break;
7bc95e2e 2847 }
6a1f2d82 2848 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2849 cardINTREG = cardINTREG + ans;
2850 cardSTATE = MFEMUL_WORK;
2851 break;
2852 }
2853 case MFEMUL_INTREG_DEC:{
2854 mf_crypto1_decrypt(pcs, receivedCmd, len);
2855 memcpy(&ans, receivedCmd, 4);
2856 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2857 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2858 cardSTATE_TO_IDLE();
2859 break;
2860 }
6a1f2d82 2861 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2862 cardINTREG = cardINTREG - ans;
2863 cardSTATE = MFEMUL_WORK;
2864 break;
2865 }
2866 case MFEMUL_INTREG_REST:{
2867 mf_crypto1_decrypt(pcs, receivedCmd, len);
2868 memcpy(&ans, receivedCmd, 4);
2869 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2870 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2871 cardSTATE_TO_IDLE();
2872 break;
2873 }
6a1f2d82 2874 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2875 cardSTATE = MFEMUL_WORK;
2876 break;
2877 }
50193c1e 2878 }
50193c1e
M
2879 }
2880
9ca155ba
M
2881 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2882 LEDsoff();
2883
d2f487af 2884 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2885 {
2886 //May just aswell send the collected ar_nr in the response aswell
c3c241f3 2887 uint8_t len = ar_nr_collected*5*4;
2888 cmd_send(CMD_ACK, CMD_SIMULATE_MIFARE_CARD, len, 0, &ar_nr_responses, len);
d2f487af 2889 }
d714d3ef 2890
12d708fe 2891 if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
d2f487af 2892 {
12d708fe 2893 if(ar_nr_collected > 1 ) {
d2f487af 2894 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
c3c241f3 2895 Dbprintf("../tools/mfkey/mfkey32 %06x%08x %08x %08x %08x %08x %08x",
2896 ar_nr_responses[0], // UID1
2897 ar_nr_responses[1], // UID2
2898 ar_nr_responses[2], // NT
2899 ar_nr_responses[3], // AR1
2900 ar_nr_responses[4], // NR1
2901 ar_nr_responses[8], // AR2
2902 ar_nr_responses[9] // NR2
d2f487af 2903 );
7bc95e2e 2904 } else {
d2f487af 2905 Dbprintf("Failed to obtain two AR/NR pairs!");
12d708fe 2906 if(ar_nr_collected > 0 ) {
c3c241f3 2907 Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
2908 ar_nr_responses[0], // UID1
2909 ar_nr_responses[1], // UID2
2910 ar_nr_responses[2], // NT
2911 ar_nr_responses[3], // AR1
2912 ar_nr_responses[4] // NR1
d2f487af 2913 );
2914 }
2915 }
2916 }
c3c241f3 2917 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen());
15c4dc5a 2918}
b62a5a84 2919
d2f487af 2920
b62a5a84
M
2921//-----------------------------------------------------------------------------
2922// MIFARE sniffer.
2923//
2924//-----------------------------------------------------------------------------
5cd9ec01
M
2925void RAMFUNC SniffMifare(uint8_t param) {
2926 // param:
2927 // bit 0 - trigger from first card answer
2928 // bit 1 - trigger from first reader 7-bit request
39864b0b 2929
d26849d4 2930 // free eventually allocated BigBuf memory
2931 BigBuf_free();
2932
39864b0b 2933 // C(red) A(yellow) B(green)
b62a5a84
M
2934 LEDsoff();
2935 // init trace buffer
3000dc4e
MHS
2936 clear_trace();
2937 set_tracing(TRUE);
b62a5a84 2938
b62a5a84
M
2939 // The command (reader -> tag) that we're receiving.
2940 // The length of a received command will in most cases be no more than 18 bytes.
2941 // So 32 should be enough!
f71f4deb 2942 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2943 uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
b62a5a84 2944 // The response (tag -> reader) that we're receiving.
f71f4deb 2945 uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
2946 uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
b62a5a84 2947
f71f4deb 2948 // allocate the DMA buffer, used to stream samples from the FPGA
2949 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
7bc95e2e 2950 uint8_t *data = dmaBuf;
2951 uint8_t previous_data = 0;
5cd9ec01
M
2952 int maxDataLen = 0;
2953 int dataLen = 0;
7bc95e2e 2954 bool ReaderIsActive = FALSE;
2955 bool TagIsActive = FALSE;
2956
2957 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
b62a5a84
M
2958
2959 // Set up the demodulator for tag -> reader responses.
6a1f2d82 2960 DemodInit(receivedResponse, receivedResponsePar);
b62a5a84
M
2961
2962 // Set up the demodulator for the reader -> tag commands
6a1f2d82 2963 UartInit(receivedCmd, receivedCmdPar);
b62a5a84
M
2964
2965 // Setup for the DMA.
7bc95e2e 2966 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
b62a5a84 2967
b62a5a84 2968 LED_D_OFF();
39864b0b
M
2969
2970 // init sniffer
2971 MfSniffInit();
b62a5a84 2972
b62a5a84 2973 // And now we loop, receiving samples.
7bc95e2e 2974 for(uint32_t sniffCounter = 0; TRUE; ) {
2975
5cd9ec01
M
2976 if(BUTTON_PRESS()) {
2977 DbpString("cancelled by button");
7bc95e2e 2978 break;
5cd9ec01
M
2979 }
2980
b62a5a84
M
2981 LED_A_ON();
2982 WDT_HIT();
39864b0b 2983
7bc95e2e 2984 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
2985 // check if a transaction is completed (timeout after 2000ms).
2986 // if yes, stop the DMA transfer and send what we have so far to the client
2987 if (MfSniffSend(2000)) {
2988 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2989 sniffCounter = 0;
2990 data = dmaBuf;
2991 maxDataLen = 0;
2992 ReaderIsActive = FALSE;
2993 TagIsActive = FALSE;
2994 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
39864b0b 2995 }
39864b0b 2996 }
7bc95e2e 2997
2998 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
2999 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
3000 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
3001 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
3002 } else {
3003 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
5cd9ec01
M
3004 }
3005 // test for length of buffer
7bc95e2e 3006 if(dataLen > maxDataLen) { // we are more behind than ever...
3007 maxDataLen = dataLen;
f71f4deb 3008 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
5cd9ec01 3009 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
7bc95e2e 3010 break;
b62a5a84
M
3011 }
3012 }
5cd9ec01 3013 if(dataLen < 1) continue;
b62a5a84 3014
7bc95e2e 3015 // primary buffer was stopped ( <-- we lost data!
5cd9ec01
M
3016 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
3017 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
3018 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
55acbb2a 3019 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
3020 }
3021 // secondary buffer sets as primary, secondary buffer was stopped
3022 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
3023 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
b62a5a84
M
3024 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
3025 }
5cd9ec01
M
3026
3027 LED_A_OFF();
b62a5a84 3028
7bc95e2e 3029 if (sniffCounter & 0x01) {
b62a5a84 3030
7bc95e2e 3031 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
3032 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
3033 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
3034 LED_C_INV();
6a1f2d82 3035 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
b62a5a84 3036
7bc95e2e 3037 /* And ready to receive another command. */
2d2f7d19 3038 //UartInit(receivedCmd, receivedCmdPar);
3039 UartReset();
7bc95e2e 3040
3041 /* And also reset the demod code */
3042 DemodReset();
3043 }
3044 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
3045 }
3046
3047 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
3048 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
3049 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
3050 LED_C_INV();
b62a5a84 3051
6a1f2d82 3052 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, FALSE)) break;
39864b0b 3053
7bc95e2e 3054 // And ready to receive another response.
3055 DemodReset();
46c65fed 3056
0ec548dc 3057 // And reset the Miller decoder including its (now outdated) input buffer
3058 UartInit(receivedCmd, receivedCmdPar);
7bc95e2e 3059 }
3060 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
3061 }
b62a5a84
M
3062 }
3063
7bc95e2e 3064 previous_data = *data;
3065 sniffCounter++;
5cd9ec01 3066 data++;
d714d3ef 3067 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01 3068 data = dmaBuf;
b62a5a84 3069 }
7bc95e2e 3070
b62a5a84
M
3071 } // main cycle
3072
3073 DbpString("COMMAND FINISHED");
3074
55acbb2a 3075 FpgaDisableSscDma();
39864b0b
M
3076 MfSniffEnd();
3077
7bc95e2e 3078 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
b62a5a84 3079 LEDsoff();
3803d529 3080}
Impressum, Datenschutz