]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/iso14443a.c
ADD: There were lot of calls to enable tracing, but very few to turn it of afterwar...
[proxmark3-svn] / armsrc / iso14443a.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
b62a5a84 2// Merlok - June 2011, 2012
15c4dc5a 3// Gerhard de Koning Gans - May 2008
534983d7 4// Hagen Fritsch - June 2010
bd20f8f4 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
15c4dc5a 9//-----------------------------------------------------------------------------
bd20f8f4 10// Routines to support ISO 14443 type A.
11//-----------------------------------------------------------------------------
12
e30c654b 13#include "proxmark3.h"
15c4dc5a 14#include "apps.h"
f7e3ed82 15#include "util.h"
9ab7a6c7 16#include "string.h"
902cb3c0 17#include "cmd.h"
15c4dc5a 18#include "iso14443crc.h"
534983d7 19#include "iso14443a.h"
20f9a2a1
M
20#include "crapto1.h"
21#include "mifareutil.h"
3000dc4e 22#include "BigBuf.h"
534983d7 23static uint32_t iso14a_timeout;
1e262141 24int rsamples = 0;
1e262141 25uint8_t trigger = 0;
b0127e65 26// the block number for the ISO14443-4 PCB
27static uint8_t iso14_pcb_blocknum = 0;
15c4dc5a 28
7bc95e2e 29//
30// ISO14443 timing:
31//
32// minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
33#define REQUEST_GUARD_TIME (7000/16 + 1)
34// minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
35#define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
36// bool LastCommandWasRequest = FALSE;
37
38//
39// Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
40//
d714d3ef 41// When the PM acts as reader and is receiving tag data, it takes
42// 3 ticks delay in the AD converter
43// 16 ticks until the modulation detector completes and sets curbit
44// 8 ticks until bit_to_arm is assigned from curbit
45// 8*16 ticks for the transfer from FPGA to ARM
7bc95e2e 46// 4*16 ticks until we measure the time
47// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 48#define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
7bc95e2e 49
50// When the PM acts as a reader and is sending, it takes
51// 4*16 ticks until we can write data to the sending hold register
52// 8*16 ticks until the SHR is transferred to the Sending Shift Register
53// 8 ticks until the first transfer starts
54// 8 ticks later the FPGA samples the data
55// 1 tick to assign mod_sig_coil
56#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
57
58// When the PM acts as tag and is receiving it takes
d714d3ef 59// 2 ticks delay in the RF part (for the first falling edge),
7bc95e2e 60// 3 ticks for the A/D conversion,
61// 8 ticks on average until the start of the SSC transfer,
62// 8 ticks until the SSC samples the first data
63// 7*16 ticks to complete the transfer from FPGA to ARM
64// 8 ticks until the next ssp_clk rising edge
d714d3ef 65// 4*16 ticks until we measure the time
7bc95e2e 66// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 67#define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
7bc95e2e 68
69// The FPGA will report its internal sending delay in
70uint16_t FpgaSendQueueDelay;
71// the 5 first bits are the number of bits buffered in mod_sig_buf
72// the last three bits are the remaining ticks/2 after the mod_sig_buf shift
73#define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
74
75// When the PM acts as tag and is sending, it takes
d714d3ef 76// 4*16 ticks until we can write data to the sending hold register
7bc95e2e 77// 8*16 ticks until the SHR is transferred to the Sending Shift Register
78// 8 ticks until the first transfer starts
79// 8 ticks later the FPGA samples the data
80// + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
81// + 1 tick to assign mod_sig_coil
d714d3ef 82#define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
7bc95e2e 83
84// When the PM acts as sniffer and is receiving tag data, it takes
85// 3 ticks A/D conversion
d714d3ef 86// 14 ticks to complete the modulation detection
87// 8 ticks (on average) until the result is stored in to_arm
7bc95e2e 88// + the delays in transferring data - which is the same for
89// sniffing reader and tag data and therefore not relevant
d714d3ef 90#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
7bc95e2e 91
d714d3ef 92// When the PM acts as sniffer and is receiving reader data, it takes
93// 2 ticks delay in analogue RF receiver (for the falling edge of the
94// start bit, which marks the start of the communication)
7bc95e2e 95// 3 ticks A/D conversion
d714d3ef 96// 8 ticks on average until the data is stored in to_arm.
7bc95e2e 97// + the delays in transferring data - which is the same for
98// sniffing reader and tag data and therefore not relevant
d714d3ef 99#define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
7bc95e2e 100
101//variables used for timing purposes:
102//these are in ssp_clk cycles:
6a1f2d82 103static uint32_t NextTransferTime;
104static uint32_t LastTimeProxToAirStart;
105static uint32_t LastProxToAirDuration;
7bc95e2e 106
107
108
8f51ddb0 109// CARD TO READER - manchester
72934aa3 110// Sequence D: 11110000 modulation with subcarrier during first half
111// Sequence E: 00001111 modulation with subcarrier during second half
112// Sequence F: 00000000 no modulation with subcarrier
8f51ddb0 113// READER TO CARD - miller
72934aa3 114// Sequence X: 00001100 drop after half a period
115// Sequence Y: 00000000 no drop
116// Sequence Z: 11000000 drop at start
117#define SEC_D 0xf0
118#define SEC_E 0x0f
119#define SEC_F 0x00
120#define SEC_X 0x0c
121#define SEC_Y 0x00
122#define SEC_Z 0xc0
15c4dc5a 123
1e262141 124const uint8_t OddByteParity[256] = {
15c4dc5a 125 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
126 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
127 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
141};
142
19a700a8 143
902cb3c0 144void iso14a_set_trigger(bool enable) {
534983d7 145 trigger = enable;
146}
147
d19929cb 148
b0127e65 149void iso14a_set_timeout(uint32_t timeout) {
150 iso14a_timeout = timeout;
19a700a8 151 if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);
b0127e65 152}
8556b852 153
19a700a8 154
155void iso14a_set_ATS_timeout(uint8_t *ats) {
156
157 uint8_t tb1;
158 uint8_t fwi;
159 uint32_t fwt;
160
161 if (ats[0] > 1) { // there is a format byte T0
162 if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
163 if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
164 tb1 = ats[3];
165 } else {
166 tb1 = ats[2];
167 }
168 fwi = (tb1 & 0xf0) >> 4; // frame waiting indicator (FWI)
169 fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc
170
171 iso14a_set_timeout(fwt/(8*16));
172 }
173 }
174}
175
176
15c4dc5a 177//-----------------------------------------------------------------------------
178// Generate the parity value for a byte sequence
e30c654b 179//
15c4dc5a 180//-----------------------------------------------------------------------------
20f9a2a1
M
181byte_t oddparity (const byte_t bt)
182{
5f6d6c90 183 return OddByteParity[bt];
20f9a2a1
M
184}
185
6a1f2d82 186void GetParity(const uint8_t *pbtCmd, uint16_t iLen, uint8_t *par)
15c4dc5a 187{
6a1f2d82 188 uint16_t paritybit_cnt = 0;
189 uint16_t paritybyte_cnt = 0;
190 uint8_t parityBits = 0;
191
192 for (uint16_t i = 0; i < iLen; i++) {
193 // Generate the parity bits
194 parityBits |= ((OddByteParity[pbtCmd[i]]) << (7-paritybit_cnt));
195 if (paritybit_cnt == 7) {
196 par[paritybyte_cnt] = parityBits; // save 8 Bits parity
197 parityBits = 0; // and advance to next Parity Byte
198 paritybyte_cnt++;
199 paritybit_cnt = 0;
200 } else {
201 paritybit_cnt++;
202 }
5f6d6c90 203 }
6a1f2d82 204
205 // save remaining parity bits
206 par[paritybyte_cnt] = parityBits;
207
15c4dc5a 208}
209
534983d7 210void AppendCrc14443a(uint8_t* data, int len)
15c4dc5a 211{
5f6d6c90 212 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
15c4dc5a 213}
214
0ec548dc 215void AppendCrc14443b(uint8_t* data, int len)
216{
217 ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
218}
219
220
7bc95e2e 221//=============================================================================
222// ISO 14443 Type A - Miller decoder
223//=============================================================================
224// Basics:
225// This decoder is used when the PM3 acts as a tag.
226// The reader will generate "pauses" by temporarily switching of the field.
227// At the PM3 antenna we will therefore measure a modulated antenna voltage.
228// The FPGA does a comparison with a threshold and would deliver e.g.:
229// ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
230// The Miller decoder needs to identify the following sequences:
231// 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
232// 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
233// 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
234// Note 1: the bitstream may start at any time. We therefore need to sync.
235// Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
15c4dc5a 236//-----------------------------------------------------------------------------
b62a5a84 237static tUart Uart;
15c4dc5a 238
d7aa3739 239// Lookup-Table to decide if 4 raw bits are a modulation.
0ec548dc 240// We accept the following:
241// 0001 - a 3 tick wide pause
242// 0011 - a 2 tick wide pause, or a three tick wide pause shifted left
243// 0111 - a 2 tick wide pause shifted left
244// 1001 - a 2 tick wide pause shifted right
d7aa3739 245const bool Mod_Miller_LUT[] = {
0ec548dc 246 FALSE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, TRUE,
247 FALSE, TRUE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE
d7aa3739 248};
0ec548dc 249#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
250#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
d7aa3739 251
7bc95e2e 252void UartReset()
15c4dc5a 253{
7bc95e2e 254 Uart.state = STATE_UNSYNCD;
255 Uart.bitCount = 0;
256 Uart.len = 0; // number of decoded data bytes
6a1f2d82 257 Uart.parityLen = 0; // number of decoded parity bytes
7bc95e2e 258 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
6a1f2d82 259 Uart.parityBits = 0; // holds 8 parity bits
7bc95e2e 260 Uart.startTime = 0;
261 Uart.endTime = 0;
46c65fed 262
263 Uart.byteCntMax = 0;
264 Uart.posCnt = 0;
265 Uart.syncBit = 9999;
7bc95e2e 266}
15c4dc5a 267
6a1f2d82 268void UartInit(uint8_t *data, uint8_t *parity)
269{
270 Uart.output = data;
271 Uart.parity = parity;
0ec548dc 272 Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
6a1f2d82 273 UartReset();
274}
d714d3ef 275
7bc95e2e 276// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
277static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
278{
15c4dc5a 279
0ec548dc 280 Uart.fourBits = (Uart.fourBits << 8) | bit;
7bc95e2e 281
0c8d25eb 282 if (Uart.state == STATE_UNSYNCD) { // not yet synced
3fe4ff4f 283
0ec548dc 284 Uart.syncBit = 9999; // not set
46c65fed 285
286 // 00x11111 2|3 ticks pause followed by 6|5 ticks unmodulated Sequence Z (a "0" or "start of communication")
287 // 11111111 8 ticks unmodulation Sequence Y (a "0" or "end of communication" or "no information")
288 // 111100x1 4 ticks unmodulated followed by 2|3 ticks pause Sequence X (a "1")
289
0ec548dc 290 // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
46c65fed 291 // Sequence X followed by Sequence Y followed by Sequence Z (111100x1 11111111 00x11111)
292 // we therefore look for a ...xx1111 11111111 00x11111xxxxxx... pattern
0ec548dc 293 // (12 '1's followed by 2 '0's, eventually followed by another '0', followed by 5 '1's)
46c65fed 294 //
295#define ISO14443A_STARTBIT_MASK 0x07FFEF80 // mask is 00001111 11111111 1110 1111 10000000
296#define ISO14443A_STARTBIT_PATTERN 0x07FF8F80 // pattern is 00001111 11111111 1000 1111 10000000
297
0ec548dc 298 if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 0)) == ISO14443A_STARTBIT_PATTERN >> 0) Uart.syncBit = 7;
299 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 1)) == ISO14443A_STARTBIT_PATTERN >> 1) Uart.syncBit = 6;
300 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 2)) == ISO14443A_STARTBIT_PATTERN >> 2) Uart.syncBit = 5;
301 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 3)) == ISO14443A_STARTBIT_PATTERN >> 3) Uart.syncBit = 4;
302 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 4)) == ISO14443A_STARTBIT_PATTERN >> 4) Uart.syncBit = 3;
303 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 5)) == ISO14443A_STARTBIT_PATTERN >> 5) Uart.syncBit = 2;
304 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 6)) == ISO14443A_STARTBIT_PATTERN >> 6) Uart.syncBit = 1;
305 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 7)) == ISO14443A_STARTBIT_PATTERN >> 7) Uart.syncBit = 0;
306
307 if (Uart.syncBit != 9999) { // found a sync bit
7bc95e2e 308 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
309 Uart.startTime -= Uart.syncBit;
d7aa3739 310 Uart.endTime = Uart.startTime;
7bc95e2e 311 Uart.state = STATE_START_OF_COMMUNICATION;
15c4dc5a 312 }
313
7bc95e2e 314 } else {
15c4dc5a 315
0ec548dc 316 if (IsMillerModulationNibble1(Uart.fourBits >> Uart.syncBit)) {
317 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation in both halves - error
d7aa3739 318 UartReset();
d7aa3739 319 } else { // Modulation in first half = Sequence Z = logic "0"
7bc95e2e 320 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
321 UartReset();
7bc95e2e 322 } else {
323 Uart.bitCount++;
324 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
325 Uart.state = STATE_MILLER_Z;
326 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
327 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
328 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
329 Uart.parityBits <<= 1; // make room for the parity bit
330 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
331 Uart.bitCount = 0;
332 Uart.shiftReg = 0;
6a1f2d82 333 if((Uart.len&0x0007) == 0) { // every 8 data bytes
334 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
335 Uart.parityBits = 0;
336 }
15c4dc5a 337 }
7bc95e2e 338 }
d7aa3739 339 }
340 } else {
0ec548dc 341 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
7bc95e2e 342 Uart.bitCount++;
343 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
344 Uart.state = STATE_MILLER_X;
345 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
346 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
347 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
348 Uart.parityBits <<= 1; // make room for the new parity bit
349 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
350 Uart.bitCount = 0;
351 Uart.shiftReg = 0;
6a1f2d82 352 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
353 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
354 Uart.parityBits = 0;
355 }
7bc95e2e 356 }
d7aa3739 357 } else { // no modulation in both halves - Sequence Y
7bc95e2e 358 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
15c4dc5a 359 Uart.state = STATE_UNSYNCD;
6a1f2d82 360 Uart.bitCount--; // last "0" was part of EOC sequence
361 Uart.shiftReg <<= 1; // drop it
362 if(Uart.bitCount > 0) { // if we decoded some bits
363 Uart.shiftReg >>= (9 - Uart.bitCount); // right align them
364 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff); // add last byte to the output
365 Uart.parityBits <<= 1; // add a (void) parity bit
366 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align parity bits
367 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store it
368 return TRUE;
369 } else if (Uart.len & 0x0007) { // there are some parity bits to store
370 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align remaining parity bits
371 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store them
52bfb955 372 }
373 if (Uart.len) {
6a1f2d82 374 return TRUE; // we are finished with decoding the raw data sequence
52bfb955 375 } else {
0c8d25eb 376 UartReset(); // Nothing received - start over
7bc95e2e 377 }
15c4dc5a 378 }
7bc95e2e 379 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
380 UartReset();
7bc95e2e 381 } else { // a logic "0"
382 Uart.bitCount++;
383 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
384 Uart.state = STATE_MILLER_Y;
385 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
386 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
387 Uart.parityBits <<= 1; // make room for the parity bit
388 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
389 Uart.bitCount = 0;
390 Uart.shiftReg = 0;
6a1f2d82 391 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
392 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
393 Uart.parityBits = 0;
394 }
15c4dc5a 395 }
396 }
d7aa3739 397 }
15c4dc5a 398 }
7bc95e2e 399
400 }
15c4dc5a 401
7bc95e2e 402 return FALSE; // not finished yet, need more data
15c4dc5a 403}
404
7bc95e2e 405
406
15c4dc5a 407//=============================================================================
e691fc45 408// ISO 14443 Type A - Manchester decoder
15c4dc5a 409//=============================================================================
e691fc45 410// Basics:
7bc95e2e 411// This decoder is used when the PM3 acts as a reader.
e691fc45 412// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
413// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
414// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
415// The Manchester decoder needs to identify the following sequences:
416// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
417// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
418// 8 ticks unmodulated: Sequence F = end of communication
419// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
7bc95e2e 420// Note 1: the bitstream may start at any time. We therefore need to sync.
e691fc45 421// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
b62a5a84 422static tDemod Demod;
15c4dc5a 423
d7aa3739 424// Lookup-Table to decide if 4 raw bits are a modulation.
d714d3ef 425// We accept three or four "1" in any position
7bc95e2e 426const bool Mod_Manchester_LUT[] = {
d7aa3739 427 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
d714d3ef 428 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
7bc95e2e 429};
430
431#define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
432#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
15c4dc5a 433
2f2d9fc5 434
7bc95e2e 435void DemodReset()
e691fc45 436{
7bc95e2e 437 Demod.state = DEMOD_UNSYNCD;
438 Demod.len = 0; // number of decoded data bytes
6a1f2d82 439 Demod.parityLen = 0;
7bc95e2e 440 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
441 Demod.parityBits = 0; //
442 Demod.collisionPos = 0; // Position of collision bit
443 Demod.twoBits = 0xffff; // buffer for 2 Bits
444 Demod.highCnt = 0;
445 Demod.startTime = 0;
446 Demod.endTime = 0;
46c65fed 447
448 //
449 Demod.bitCount = 0;
450 Demod.syncBit = 0xFFFF;
451 Demod.samples = 0;
e691fc45 452}
15c4dc5a 453
6a1f2d82 454void DemodInit(uint8_t *data, uint8_t *parity)
455{
456 Demod.output = data;
457 Demod.parity = parity;
458 DemodReset();
459}
460
7bc95e2e 461// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
462static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
e691fc45 463{
7bc95e2e 464
465 Demod.twoBits = (Demod.twoBits << 8) | bit;
e691fc45 466
7bc95e2e 467 if (Demod.state == DEMOD_UNSYNCD) {
468
469 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
470 if (Demod.twoBits == 0x0000) {
471 Demod.highCnt++;
472 } else {
473 Demod.highCnt = 0;
474 }
475 } else {
476 Demod.syncBit = 0xFFFF; // not set
477 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
478 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
479 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
480 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
481 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
482 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
483 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
484 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
d7aa3739 485 if (Demod.syncBit != 0xFFFF) {
7bc95e2e 486 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
487 Demod.startTime -= Demod.syncBit;
488 Demod.bitCount = offset; // number of decoded data bits
e691fc45 489 Demod.state = DEMOD_MANCHESTER_DATA;
2f2d9fc5 490 }
7bc95e2e 491 }
15c4dc5a 492
7bc95e2e 493 } else {
15c4dc5a 494
7bc95e2e 495 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
496 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
e691fc45 497 if (!Demod.collisionPos) {
498 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
499 }
500 } // modulation in first half only - Sequence D = 1
7bc95e2e 501 Demod.bitCount++;
502 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
503 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
e691fc45 504 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 505 Demod.parityBits <<= 1; // make room for the parity bit
e691fc45 506 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
507 Demod.bitCount = 0;
508 Demod.shiftReg = 0;
6a1f2d82 509 if((Demod.len&0x0007) == 0) { // every 8 data bytes
510 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits
511 Demod.parityBits = 0;
512 }
15c4dc5a 513 }
7bc95e2e 514 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
515 } else { // no modulation in first half
516 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
e691fc45 517 Demod.bitCount++;
7bc95e2e 518 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
e691fc45 519 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
e691fc45 520 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 521 Demod.parityBits <<= 1; // make room for the new parity bit
e691fc45 522 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
523 Demod.bitCount = 0;
524 Demod.shiftReg = 0;
6a1f2d82 525 if ((Demod.len&0x0007) == 0) { // every 8 data bytes
526 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits1
527 Demod.parityBits = 0;
528 }
15c4dc5a 529 }
7bc95e2e 530 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
e691fc45 531 } else { // no modulation in both halves - End of communication
6a1f2d82 532 if(Demod.bitCount > 0) { // there are some remaining data bits
533 Demod.shiftReg >>= (9 - Demod.bitCount); // right align the decoded bits
534 Demod.output[Demod.len++] = Demod.shiftReg & 0xff; // and add them to the output
535 Demod.parityBits <<= 1; // add a (void) parity bit
536 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
537 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
538 return TRUE;
539 } else if (Demod.len & 0x0007) { // there are some parity bits to store
540 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
541 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
52bfb955 542 }
543 if (Demod.len) {
d7aa3739 544 return TRUE; // we are finished with decoding the raw data sequence
545 } else { // nothing received. Start over
546 DemodReset();
e691fc45 547 }
15c4dc5a 548 }
7bc95e2e 549 }
e691fc45 550 }
e691fc45 551 return FALSE; // not finished yet, need more data
15c4dc5a 552}
553
554//=============================================================================
555// Finally, a `sniffer' for ISO 14443 Type A
556// Both sides of communication!
557//=============================================================================
558
559//-----------------------------------------------------------------------------
560// Record the sequence of commands sent by the reader to the tag, with
561// triggering so that we start recording at the point that the tag is moved
562// near the reader.
563//-----------------------------------------------------------------------------
d26849d4 564void RAMFUNC SniffIso14443a(uint8_t param) {
5cd9ec01
M
565 // param:
566 // bit 0 - trigger from first card answer
567 // bit 1 - trigger from first reader 7-bit request
5cd9ec01 568 LEDsoff();
5cd9ec01 569
99cf19d9 570 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
7bc95e2e 571
f71f4deb 572 // Allocate memory from BigBuf for some buffers
573 // free all previous allocations first
574 BigBuf_free();
7838f4be 575
576 // init trace buffer
577 clear_trace();
578 set_tracing(TRUE);
579
5cd9ec01 580 // The command (reader -> tag) that we're receiving.
f71f4deb 581 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
582 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
6a1f2d82 583
5cd9ec01 584 // The response (tag -> reader) that we're receiving.
f71f4deb 585 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
586 uint8_t *receivedResponsePar = BigBuf_malloc(MAX_PARITY_SIZE);
5cd9ec01
M
587
588 // The DMA buffer, used to stream samples from the FPGA
f71f4deb 589 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
590
7bc95e2e 591 uint8_t *data = dmaBuf;
592 uint8_t previous_data = 0;
5cd9ec01
M
593 int maxDataLen = 0;
594 int dataLen = 0;
7bc95e2e 595 bool TagIsActive = FALSE;
596 bool ReaderIsActive = FALSE;
597
5cd9ec01 598 // Set up the demodulator for tag -> reader responses.
6a1f2d82 599 DemodInit(receivedResponse, receivedResponsePar);
600
5cd9ec01 601 // Set up the demodulator for the reader -> tag commands
6a1f2d82 602 UartInit(receivedCmd, receivedCmdPar);
603
7bc95e2e 604 // Setup and start DMA.
5cd9ec01 605 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
7bc95e2e 606
99cf19d9 607 // We won't start recording the frames that we acquire until we trigger;
608 // a good trigger condition to get started is probably when we see a
609 // response from the tag.
610 // triggered == FALSE -- to wait first for card
611 bool triggered = !(param & 0x03);
612
5cd9ec01 613 // And now we loop, receiving samples.
7bc95e2e 614 for(uint32_t rsamples = 0; TRUE; ) {
615
5cd9ec01
M
616 if(BUTTON_PRESS()) {
617 DbpString("cancelled by button");
7bc95e2e 618 break;
5cd9ec01 619 }
15c4dc5a 620
5cd9ec01
M
621 LED_A_ON();
622 WDT_HIT();
15c4dc5a 623
5cd9ec01
M
624 int register readBufDataP = data - dmaBuf;
625 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
626 if (readBufDataP <= dmaBufDataP){
627 dataLen = dmaBufDataP - readBufDataP;
628 } else {
7bc95e2e 629 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
5cd9ec01
M
630 }
631 // test for length of buffer
632 if(dataLen > maxDataLen) {
633 maxDataLen = dataLen;
f71f4deb 634 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
7bc95e2e 635 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
636 break;
5cd9ec01
M
637 }
638 }
639 if(dataLen < 1) continue;
640
641 // primary buffer was stopped( <-- we lost data!
642 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
643 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
644 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
7bc95e2e 645 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
646 }
647 // secondary buffer sets as primary, secondary buffer was stopped
648 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
649 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
650 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
651 }
652
653 LED_A_OFF();
7bc95e2e 654
655 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
3be2a5ae 656
7bc95e2e 657 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
658 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
659 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
660 LED_C_ON();
5cd9ec01 661
7bc95e2e 662 // check - if there is a short 7bit request from reader
663 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
5cd9ec01 664
7bc95e2e 665 if(triggered) {
6a1f2d82 666 if (!LogTrace(receivedCmd,
667 Uart.len,
668 Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
669 Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
670 Uart.parity,
671 TRUE)) break;
7bc95e2e 672 }
673 /* And ready to receive another command. */
674 UartReset();
675 /* And also reset the demod code, which might have been */
676 /* false-triggered by the commands from the reader. */
677 DemodReset();
678 LED_B_OFF();
679 }
680 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
5cd9ec01 681 }
3be2a5ae 682
7bc95e2e 683 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
684 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
685 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
686 LED_B_ON();
5cd9ec01 687
6a1f2d82 688 if (!LogTrace(receivedResponse,
689 Demod.len,
690 Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
691 Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
692 Demod.parity,
693 FALSE)) break;
5cd9ec01 694
7bc95e2e 695 if ((!triggered) && (param & 0x01)) triggered = TRUE;
5cd9ec01 696
7bc95e2e 697 // And ready to receive another response.
698 DemodReset();
0ec548dc 699 // And reset the Miller decoder including itS (now outdated) input buffer
700 UartInit(receivedCmd, receivedCmdPar);
701
7bc95e2e 702 LED_C_OFF();
703 }
704 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
705 }
5cd9ec01
M
706 }
707
7bc95e2e 708 previous_data = *data;
709 rsamples++;
5cd9ec01 710 data++;
d714d3ef 711 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01
M
712 data = dmaBuf;
713 }
714 } // main cycle
715
7bc95e2e 716 FpgaDisableSscDma();
7838f4be 717 LEDsoff();
718
7bc95e2e 719 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
3000dc4e 720 Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);
5ee53a0e 721
722 set_tracing(FALSE);
15c4dc5a 723}
724
15c4dc5a 725//-----------------------------------------------------------------------------
726// Prepare tag messages
727//-----------------------------------------------------------------------------
6a1f2d82 728static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
15c4dc5a 729{
8f51ddb0 730 ToSendReset();
15c4dc5a 731
732 // Correction bit, might be removed when not needed
733 ToSendStuffBit(0);
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736 ToSendStuffBit(0);
737 ToSendStuffBit(1); // 1
738 ToSendStuffBit(0);
739 ToSendStuffBit(0);
740 ToSendStuffBit(0);
8f51ddb0 741
15c4dc5a 742 // Send startbit
72934aa3 743 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 744 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 745
6a1f2d82 746 for(uint16_t i = 0; i < len; i++) {
8f51ddb0 747 uint8_t b = cmd[i];
15c4dc5a 748
749 // Data bits
6a1f2d82 750 for(uint16_t j = 0; j < 8; j++) {
15c4dc5a 751 if(b & 1) {
72934aa3 752 ToSend[++ToSendMax] = SEC_D;
15c4dc5a 753 } else {
72934aa3 754 ToSend[++ToSendMax] = SEC_E;
8f51ddb0
M
755 }
756 b >>= 1;
757 }
15c4dc5a 758
0014cb46 759 // Get the parity bit
6a1f2d82 760 if (parity[i>>3] & (0x80>>(i&0x0007))) {
8f51ddb0 761 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 762 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 763 } else {
72934aa3 764 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 765 LastProxToAirDuration = 8 * ToSendMax;
15c4dc5a 766 }
8f51ddb0 767 }
15c4dc5a 768
8f51ddb0
M
769 // Send stopbit
770 ToSend[++ToSendMax] = SEC_F;
15c4dc5a 771
8f51ddb0
M
772 // Convert from last byte pos to length
773 ToSendMax++;
8f51ddb0
M
774}
775
6a1f2d82 776static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
777{
778 uint8_t par[MAX_PARITY_SIZE];
779
780 GetParity(cmd, len, par);
781 CodeIso14443aAsTagPar(cmd, len, par);
15c4dc5a 782}
783
15c4dc5a 784
8f51ddb0
M
785static void Code4bitAnswerAsTag(uint8_t cmd)
786{
787 int i;
788
5f6d6c90 789 ToSendReset();
8f51ddb0
M
790
791 // Correction bit, might be removed when not needed
792 ToSendStuffBit(0);
793 ToSendStuffBit(0);
794 ToSendStuffBit(0);
795 ToSendStuffBit(0);
796 ToSendStuffBit(1); // 1
797 ToSendStuffBit(0);
798 ToSendStuffBit(0);
799 ToSendStuffBit(0);
800
801 // Send startbit
802 ToSend[++ToSendMax] = SEC_D;
803
804 uint8_t b = cmd;
805 for(i = 0; i < 4; i++) {
806 if(b & 1) {
807 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 808 LastProxToAirDuration = 8 * ToSendMax - 4;
8f51ddb0
M
809 } else {
810 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 811 LastProxToAirDuration = 8 * ToSendMax;
8f51ddb0
M
812 }
813 b >>= 1;
814 }
815
816 // Send stopbit
817 ToSend[++ToSendMax] = SEC_F;
818
5f6d6c90 819 // Convert from last byte pos to length
820 ToSendMax++;
15c4dc5a 821}
822
823//-----------------------------------------------------------------------------
824// Wait for commands from reader
825// Stop when button is pressed
826// Or return TRUE when command is captured
827//-----------------------------------------------------------------------------
6a1f2d82 828static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
15c4dc5a 829{
830 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
831 // only, since we are receiving, not transmitting).
832 // Signal field is off with the appropriate LED
833 LED_D_OFF();
834 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
835
836 // Now run a `software UART' on the stream of incoming samples.
6a1f2d82 837 UartInit(received, parity);
7bc95e2e 838
839 // clear RXRDY:
840 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 841
842 for(;;) {
843 WDT_HIT();
844
845 if(BUTTON_PRESS()) return FALSE;
7bc95e2e 846
15c4dc5a 847 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
7bc95e2e 848 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
849 if(MillerDecoding(b, 0)) {
850 *len = Uart.len;
15c4dc5a 851 return TRUE;
852 }
7bc95e2e 853 }
15c4dc5a 854 }
855}
28afbd2b 856
6a1f2d82 857static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
7bc95e2e 858int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
28afbd2b 859int EmSend4bit(uint8_t resp);
6a1f2d82 860int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
861int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
862int EmSendCmd(uint8_t *resp, uint16_t respLen);
863int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
864bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
865 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
15c4dc5a 866
117d9ec2 867static uint8_t* free_buffer_pointer;
ce02f6f9 868
869typedef struct {
870 uint8_t* response;
871 size_t response_n;
872 uint8_t* modulation;
873 size_t modulation_n;
7bc95e2e 874 uint32_t ProxToAirDuration;
ce02f6f9 875} tag_response_info_t;
876
ce02f6f9 877bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
7bc95e2e 878 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
ce02f6f9 879 // This will need the following byte array for a modulation sequence
880 // 144 data bits (18 * 8)
881 // 18 parity bits
882 // 2 Start and stop
883 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
884 // 1 just for the case
885 // ----------- +
886 // 166 bytes, since every bit that needs to be send costs us a byte
887 //
f71f4deb 888
889
ce02f6f9 890 // Prepare the tag modulation bits from the message
891 CodeIso14443aAsTag(response_info->response,response_info->response_n);
892
893 // Make sure we do not exceed the free buffer space
894 if (ToSendMax > max_buffer_size) {
895 Dbprintf("Out of memory, when modulating bits for tag answer:");
896 Dbhexdump(response_info->response_n,response_info->response,false);
897 return false;
898 }
899
900 // Copy the byte array, used for this modulation to the buffer position
901 memcpy(response_info->modulation,ToSend,ToSendMax);
902
7bc95e2e 903 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
ce02f6f9 904 response_info->modulation_n = ToSendMax;
7bc95e2e 905 response_info->ProxToAirDuration = LastProxToAirDuration;
ce02f6f9 906
907 return true;
908}
909
f71f4deb 910
911// "precompile" responses. There are 7 predefined responses with a total of 28 bytes data to transmit.
912// Coded responses need one byte per bit to transfer (data, parity, start, stop, correction)
913// 28 * 8 data bits, 28 * 1 parity bits, 7 start bits, 7 stop bits, 7 correction bits
914// -> need 273 bytes buffer
c9216a92 915// 44 * 8 data bits, 44 * 1 parity bits, 9 start bits, 9 stop bits, 9 correction bits --370
916// 47 * 8 data bits, 47 * 1 parity bits, 10 start bits, 10 stop bits, 10 correction bits
917#define ALLOCATED_TAG_MODULATION_BUFFER_SIZE 453
f71f4deb 918
ce02f6f9 919bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
920 // Retrieve and store the current buffer index
921 response_info->modulation = free_buffer_pointer;
922
923 // Determine the maximum size we can use from our buffer
f71f4deb 924 size_t max_buffer_size = ALLOCATED_TAG_MODULATION_BUFFER_SIZE;
ce02f6f9 925
926 // Forward the prepare tag modulation function to the inner function
f71f4deb 927 if (prepare_tag_modulation(response_info, max_buffer_size)) {
ce02f6f9 928 // Update the free buffer offset
929 free_buffer_pointer += ToSendMax;
930 return true;
931 } else {
932 return false;
933 }
934}
935
15c4dc5a 936//-----------------------------------------------------------------------------
937// Main loop of simulated tag: receive commands from reader, decide what
938// response to send, and send it.
939//-----------------------------------------------------------------------------
0db6ed9a 940void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
15c4dc5a 941{
d26849d4 942
943 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
944 // This can be used in a reader-only attack.
945 // (it can also be retrieved via 'hf 14a list', but hey...
946 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
947 uint8_t ar_nr_collected = 0;
948
81cd0474 949 uint8_t sak;
32719adf 950
951 // PACK response to PWD AUTH for EV1/NTAG
e98572a1 952 uint8_t response8[4] = {0,0,0,0};
32719adf 953
81cd0474 954 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
e98572a1 955 uint8_t response1[2] = {0,0};
81cd0474 956
957 switch (tagType) {
958 case 1: { // MIFARE Classic
959 // Says: I am Mifare 1k - original line
960 response1[0] = 0x04;
961 response1[1] = 0x00;
962 sak = 0x08;
963 } break;
964 case 2: { // MIFARE Ultralight
965 // Says: I am a stupid memory tag, no crypto
32719adf 966 response1[0] = 0x44;
81cd0474 967 response1[1] = 0x00;
968 sak = 0x00;
969 } break;
970 case 3: { // MIFARE DESFire
971 // Says: I am a DESFire tag, ph33r me
972 response1[0] = 0x04;
973 response1[1] = 0x03;
974 sak = 0x20;
975 } break;
976 case 4: { // ISO/IEC 14443-4
977 // Says: I am a javacard (JCOP)
978 response1[0] = 0x04;
979 response1[1] = 0x00;
980 sak = 0x28;
981 } break;
3fe4ff4f 982 case 5: { // MIFARE TNP3XXX
983 // Says: I am a toy
984 response1[0] = 0x01;
985 response1[1] = 0x0f;
986 sak = 0x01;
d26849d4 987 } break;
988 case 6: { // MIFARE Mini
989 // Says: I am a Mifare Mini, 320b
990 response1[0] = 0x44;
991 response1[1] = 0x00;
992 sak = 0x09;
993 } break;
32719adf 994 case 7: { // NTAG?
995 // Says: I am a NTAG,
996 response1[0] = 0x44;
997 response1[1] = 0x00;
998 sak = 0x00;
999 // PACK
1000 response8[0] = 0x80;
1001 response8[1] = 0x80;
1002 ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);
1003 } break;
81cd0474 1004 default: {
1005 Dbprintf("Error: unkown tagtype (%d)",tagType);
1006 return;
1007 } break;
1008 }
1009
1010 // The second response contains the (mandatory) first 24 bits of the UID
c8b6da22 1011 uint8_t response2[5] = {0x00};
81cd0474 1012
1013 // Check if the uid uses the (optional) part
c8b6da22 1014 uint8_t response2a[5] = {0x00};
1015
d26849d4 1016 if (flags & FLAG_7B_UID_IN_DATA) {
81cd0474 1017 response2[0] = 0x88;
d26849d4 1018 response2[1] = data[0];
1019 response2[2] = data[1];
1020 response2[3] = data[2];
1021
1022 response2a[0] = data[3];
1023 response2a[1] = data[4];
1024 response2a[2] = data[5];
c3c241f3 1025 response2a[3] = data[6]; //??
81cd0474 1026 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
1027
1028 // Configure the ATQA and SAK accordingly
1029 response1[0] |= 0x40;
1030 sak |= 0x04;
1031 } else {
d26849d4 1032 memcpy(response2, data, 4);
1033 //num_to_bytes(uid_1st,4,response2);
81cd0474 1034 // Configure the ATQA and SAK accordingly
1035 response1[0] &= 0xBF;
1036 sak &= 0xFB;
1037 }
1038
1039 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1040 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
1041
1042 // Prepare the mandatory SAK (for 4 and 7 byte UID)
c8b6da22 1043 uint8_t response3[3] = {0x00};
81cd0474 1044 response3[0] = sak;
1045 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
1046
1047 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
c8b6da22 1048 uint8_t response3a[3] = {0x00};
81cd0474 1049 response3a[0] = sak & 0xFB;
1050 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
1051
0de8e387 1052 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
6a1f2d82 1053 uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1054 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1055 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1056 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1057 // TC(1) = 0x02: CID supported, NAD not supported
ce02f6f9 1058 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
1059
32719adf 1060 // Prepare GET_VERSION (different for EV-1 / NTAG)
1061 //uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7}; //EV1 48bytes VERSION.
1062 uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
1063
c9216a92 1064 // Prepare CHK_TEARING
1065 uint8_t response9[] = {0xBD,0x90,0x3f};
1066
1067 #define TAG_RESPONSE_COUNT 10
7bc95e2e 1068 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
1069 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
1070 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
1071 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1072 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
1073 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
1074 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
1075 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
32719adf 1076 { .response = response7_NTAG, .response_n = sizeof(response7_NTAG) }, // EV1/NTAG GET_VERSION response
1077 { .response = response8, .response_n = sizeof(response8) }, // EV1/NTAG PACK response
c9216a92 1078 { .response = response9, .response_n = sizeof(response9) } // EV1/NTAG CHK_TEAR response
7bc95e2e 1079 };
1080
1081 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1082 // Such a response is less time critical, so we can prepare them on the fly
1083 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1084 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1085 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
1086 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
1087 tag_response_info_t dynamic_response_info = {
1088 .response = dynamic_response_buffer,
1089 .response_n = 0,
1090 .modulation = dynamic_modulation_buffer,
1091 .modulation_n = 0
1092 };
ce02f6f9 1093
99cf19d9 1094 // We need to listen to the high-frequency, peak-detected path.
1095 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1096
f71f4deb 1097 BigBuf_free_keep_EM();
1098
1099 // allocate buffers:
1100 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
1101 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
1102 free_buffer_pointer = BigBuf_malloc(ALLOCATED_TAG_MODULATION_BUFFER_SIZE);
1103
1104 // clear trace
3000dc4e
MHS
1105 clear_trace();
1106 set_tracing(TRUE);
f71f4deb 1107
7bc95e2e 1108 // Prepare the responses of the anticollision phase
ce02f6f9 1109 // there will be not enough time to do this at the moment the reader sends it REQA
7bc95e2e 1110 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
1111 prepare_allocated_tag_modulation(&responses[i]);
1112 }
15c4dc5a 1113
7bc95e2e 1114 int len = 0;
15c4dc5a 1115
1116 // To control where we are in the protocol
1117 int order = 0;
1118 int lastorder;
1119
1120 // Just to allow some checks
1121 int happened = 0;
1122 int happened2 = 0;
81cd0474 1123 int cmdsRecvd = 0;
15c4dc5a 1124
254b70a4 1125 cmdsRecvd = 0;
7bc95e2e 1126 tag_response_info_t* p_response;
15c4dc5a 1127
254b70a4 1128 LED_A_ON();
1129 for(;;) {
7bc95e2e 1130 // Clean receive command buffer
1131
6a1f2d82 1132 if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
ce02f6f9 1133 DbpString("Button press");
254b70a4 1134 break;
1135 }
7bc95e2e 1136
1137 p_response = NULL;
1138
254b70a4 1139 // Okay, look at the command now.
1140 lastorder = order;
1141 if(receivedCmd[0] == 0x26) { // Received a REQUEST
ce02f6f9 1142 p_response = &responses[0]; order = 1;
254b70a4 1143 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
ce02f6f9 1144 p_response = &responses[0]; order = 6;
254b70a4 1145 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
ce02f6f9 1146 p_response = &responses[1]; order = 2;
6a1f2d82 1147 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
ce02f6f9 1148 p_response = &responses[2]; order = 20;
254b70a4 1149 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
ce02f6f9 1150 p_response = &responses[3]; order = 3;
254b70a4 1151 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
ce02f6f9 1152 p_response = &responses[4]; order = 30;
254b70a4 1153 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
32719adf 1154 uint8_t block = receivedCmd[1];
1155 if ( tagType == 7 ) {
0de8e387 1156 uint16_t start = 4 * block;
32719adf 1157
0de8e387 1158 /*if ( block < 4 ) {
32719adf 1159 //NTAG 215
32719adf 1160 uint8_t blockdata[50] = {
1161 data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
1162 data[3],data[4],data[5],data[6],
1163 data[3] ^ data[4] ^ data[5] ^ data[6],0x48,0x0f,0xe0,
1164 0xe1,0x10,0x12,0x00,
1165 0x03,0x00,0xfe,0x00,
1166 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1167 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1168 0x00,0x00,0x00,0x00,
1169 0x00,0x00};
c9216a92 1170 AppendCrc14443a(blockdata+start, 16);
5e428463 1171 EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
0de8e387 1172 } else {*/
5e428463 1173 uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
1174 emlGetMemBt( emdata, start, 16);
1175 AppendCrc14443a(emdata, 16);
1176 EmSendCmdEx(emdata, sizeof(emdata), false);
0de8e387 1177 //}
32719adf 1178 p_response = NULL;
1179
1180 } else {
1181 EmSendCmdEx(data+(4*block),16,false);
1182 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1183 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1184 p_response = NULL;
1185 }
c9216a92 1186 } else if(receivedCmd[0] == 0x3A) { // Received a FAST READ (ranged read) -- just returns all zeros.
5e428463 1187
1188 uint8_t emdata[MAX_FRAME_SIZE];
1189 int start = receivedCmd[1] * 4;
ce3d6bd2 1190 int len = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
5e428463 1191 emlGetMemBt( emdata, start, len);
1192 AppendCrc14443a(emdata, len);
1193 EmSendCmdEx(emdata, len+2, false);
1194 p_response = NULL;
1195
839a53ae 1196 } else if(receivedCmd[0] == 0x3C && tagType == 7) { // Received a READ SIGNATURE --
1197 // ECC data, taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
1198 uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
1199 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
1200 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
1201 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
1202 0x00,0x00};
5e428463 1203 AppendCrc14443a(data, sizeof(data)-2);
ce3d6bd2 1204 EmSendCmdEx(data,sizeof(data),false);
839a53ae 1205 p_response = NULL;
1206 } else if(receivedCmd[0] == 0x39 && tagType == 7) { // Received a READ COUNTER --
c9216a92 1207 uint8_t data[] = {0x00,0x00,0x00,0x14,0xa5};
839a53ae 1208 EmSendCmdEx(data,sizeof(data),false);
c9216a92 1209 p_response = NULL;
ce3d6bd2 1210 } else if(receivedCmd[0] == 0xA5 && tagType == 7) { // Received a INC COUNTER --
1211 // number of counter
1212 //uint8_t counter = receivedCmd[1];
1213 //uint32_t val = bytes_to_num(receivedCmd+2,4);
1214
1215 // send ACK
1216 uint8_t ack[] = {0x0a};
1217 EmSendCmdEx(ack,sizeof(ack),false);
1218 p_response = NULL;
1219
c9216a92 1220 } else if(receivedCmd[0] == 0x3E && tagType == 7) { // Received a CHECK_TEARING_EVENT --
1221 p_response = &responses[9];
254b70a4 1222 } else if(receivedCmd[0] == 0x50) { // Received a HALT
3fe4ff4f 1223
7bc95e2e 1224 if (tracing) {
6a1f2d82 1225 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1226 }
1227 p_response = NULL;
254b70a4 1228 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
32719adf 1229
1230 if ( tagType == 7 ) { // IF NTAG /EV1 0x60 == GET_VERSION, not a authentication request.
1231 p_response = &responses[7];
1232 } else {
1233 p_response = &responses[5]; order = 7;
1234 }
254b70a4 1235 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
7bc95e2e 1236 if (tagType == 1 || tagType == 2) { // RATS not supported
1237 EmSend4bit(CARD_NACK_NA);
1238 p_response = NULL;
1239 } else {
1240 p_response = &responses[6]; order = 70;
1241 }
6a1f2d82 1242 } else if (order == 7 && len == 8) { // Received {nr] and {ar} (part of authentication)
7bc95e2e 1243 if (tracing) {
6a1f2d82 1244 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1245 }
d26849d4 1246 uint32_t nonce = bytes_to_num(response5,4);
7bc95e2e 1247 uint32_t nr = bytes_to_num(receivedCmd,4);
1248 uint32_t ar = bytes_to_num(receivedCmd+4,4);
d26849d4 1249 //Dbprintf("Auth attempt {nonce}{nr}{ar}: %08x %08x %08x", nonce, nr, ar);
1250
1251 if(flags & FLAG_NR_AR_ATTACK )
1252 {
1253 if(ar_nr_collected < 2){
1254 // Avoid duplicates... probably not necessary, nr should vary.
1255 //if(ar_nr_responses[3] != nr){
1256 ar_nr_responses[ar_nr_collected*5] = 0;
1257 ar_nr_responses[ar_nr_collected*5+1] = 0;
1258 ar_nr_responses[ar_nr_collected*5+2] = nonce;
1259 ar_nr_responses[ar_nr_collected*5+3] = nr;
1260 ar_nr_responses[ar_nr_collected*5+4] = ar;
1261 ar_nr_collected++;
1262 //}
1263 }
1264
1265 if(ar_nr_collected > 1 ) {
1266
1267 if (MF_DBGLEVEL >= 2) {
1268 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
1269 Dbprintf("../tools/mfkey/mfkey32 %07x%08x %08x %08x %08x %08x %08x",
1270 ar_nr_responses[0], // UID1
1271 ar_nr_responses[1], // UID2
1272 ar_nr_responses[2], // NT
1273 ar_nr_responses[3], // AR1
1274 ar_nr_responses[4], // NR1
1275 ar_nr_responses[8], // AR2
1276 ar_nr_responses[9] // NR2
1277 );
7838f4be 1278 Dbprintf("../tools/mfkey/mfkey32v2 %06x%08x %08x %08x %08x %08x %08x %08x",
1279 ar_nr_responses[0], // UID1
1280 ar_nr_responses[1], // UID2
1281 ar_nr_responses[2], // NT1
1282 ar_nr_responses[3], // AR1
1283 ar_nr_responses[4], // NR1
1284 ar_nr_responses[7], // NT2
1285 ar_nr_responses[8], // AR2
1286 ar_nr_responses[9] // NR2
1287 );
d26849d4 1288 }
1289 uint8_t len = ar_nr_collected*5*4;
1290 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,len,0,&ar_nr_responses,len);
1291 ar_nr_collected = 0;
1292 memset(ar_nr_responses, 0x00, len);
d26849d4 1293 }
1294 }
32719adf 1295 } else if (receivedCmd[0] == 0x1a ) // ULC authentication
1296 {
1297
1298 }
1299 else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
1300 {
1301 if ( tagType == 7 ) {
1302 p_response = &responses[8]; // PACK response
ce3d6bd2 1303 uint32_t pwd = bytes_to_num(receivedCmd+1,4);
e98572a1 1304
1305 if ( MF_DBGLEVEL >= 3) Dbprintf("Auth attempt: %08x", pwd);
32719adf 1306 }
1307 }
1308 else {
7bc95e2e 1309 // Check for ISO 14443A-4 compliant commands, look at left nibble
1310 switch (receivedCmd[0]) {
7838f4be 1311 case 0x02:
1312 case 0x03: { // IBlock (command no CID)
1313 dynamic_response_info.response[0] = receivedCmd[0];
1314 dynamic_response_info.response[1] = 0x90;
1315 dynamic_response_info.response[2] = 0x00;
1316 dynamic_response_info.response_n = 3;
1317 } break;
7bc95e2e 1318 case 0x0B:
7838f4be 1319 case 0x0A: { // IBlock (command CID)
7bc95e2e 1320 dynamic_response_info.response[0] = receivedCmd[0];
1321 dynamic_response_info.response[1] = 0x00;
1322 dynamic_response_info.response[2] = 0x90;
1323 dynamic_response_info.response[3] = 0x00;
1324 dynamic_response_info.response_n = 4;
1325 } break;
1326
1327 case 0x1A:
1328 case 0x1B: { // Chaining command
1329 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1330 dynamic_response_info.response_n = 2;
1331 } break;
1332
1333 case 0xaa:
1334 case 0xbb: {
1335 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1336 dynamic_response_info.response_n = 2;
1337 } break;
1338
7838f4be 1339 case 0xBA: { // ping / pong
1340 dynamic_response_info.response[0] = 0xAB;
1341 dynamic_response_info.response[1] = 0x00;
1342 dynamic_response_info.response_n = 2;
7bc95e2e 1343 } break;
1344
1345 case 0xCA:
1346 case 0xC2: { // Readers sends deselect command
7838f4be 1347 dynamic_response_info.response[0] = 0xCA;
1348 dynamic_response_info.response[1] = 0x00;
1349 dynamic_response_info.response_n = 2;
7bc95e2e 1350 } break;
1351
1352 default: {
1353 // Never seen this command before
1354 if (tracing) {
6a1f2d82 1355 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1356 }
1357 Dbprintf("Received unknown command (len=%d):",len);
1358 Dbhexdump(len,receivedCmd,false);
1359 // Do not respond
1360 dynamic_response_info.response_n = 0;
1361 } break;
1362 }
ce02f6f9 1363
7bc95e2e 1364 if (dynamic_response_info.response_n > 0) {
1365 // Copy the CID from the reader query
1366 dynamic_response_info.response[1] = receivedCmd[1];
ce02f6f9 1367
7bc95e2e 1368 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1369 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1370 dynamic_response_info.response_n += 2;
ce02f6f9 1371
7bc95e2e 1372 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1373 Dbprintf("Error preparing tag response");
1374 if (tracing) {
6a1f2d82 1375 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 1376 }
1377 break;
1378 }
1379 p_response = &dynamic_response_info;
1380 }
81cd0474 1381 }
15c4dc5a 1382
1383 // Count number of wakeups received after a halt
1384 if(order == 6 && lastorder == 5) { happened++; }
1385
1386 // Count number of other messages after a halt
1387 if(order != 6 && lastorder == 5) { happened2++; }
1388
15c4dc5a 1389 if(cmdsRecvd > 999) {
1390 DbpString("1000 commands later...");
254b70a4 1391 break;
15c4dc5a 1392 }
ce02f6f9 1393 cmdsRecvd++;
1394
1395 if (p_response != NULL) {
7bc95e2e 1396 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1397 // do the tracing for the previous reader request and this tag answer:
6a1f2d82 1398 uint8_t par[MAX_PARITY_SIZE];
1399 GetParity(p_response->response, p_response->response_n, par);
3fe4ff4f 1400
7bc95e2e 1401 EmLogTrace(Uart.output,
1402 Uart.len,
1403 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1404 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1405 Uart.parity,
7bc95e2e 1406 p_response->response,
1407 p_response->response_n,
1408 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1409 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1410 par);
7bc95e2e 1411 }
1412
1413 if (!tracing) {
1414 Dbprintf("Trace Full. Simulation stopped.");
1415 break;
1416 }
1417 }
15c4dc5a 1418
d26849d4 1419 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
5ee53a0e 1420 set_tracing(FALSE);
f71f4deb 1421 BigBuf_free_keep_EM();
c9216a92 1422 LED_A_OFF();
1423
0de8e387 1424 if (MF_DBGLEVEL >= 4){
5ee53a0e 1425 Dbprintf("-[ Wake ups after halt [%d]", happened);
1426 Dbprintf("-[ Messages after halt [%d]", happened2);
1427 Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
0de8e387 1428 }
15c4dc5a 1429}
1430
9492e0b0 1431
1432// prepare a delayed transfer. This simply shifts ToSend[] by a number
1433// of bits specified in the delay parameter.
1434void PrepareDelayedTransfer(uint16_t delay)
1435{
1436 uint8_t bitmask = 0;
1437 uint8_t bits_to_shift = 0;
1438 uint8_t bits_shifted = 0;
1439
1440 delay &= 0x07;
1441 if (delay) {
1442 for (uint16_t i = 0; i < delay; i++) {
1443 bitmask |= (0x01 << i);
1444 }
7bc95e2e 1445 ToSend[ToSendMax++] = 0x00;
9492e0b0 1446 for (uint16_t i = 0; i < ToSendMax; i++) {
1447 bits_to_shift = ToSend[i] & bitmask;
1448 ToSend[i] = ToSend[i] >> delay;
1449 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1450 bits_shifted = bits_to_shift;
1451 }
1452 }
1453}
1454
7bc95e2e 1455
1456//-------------------------------------------------------------------------------------
15c4dc5a 1457// Transmit the command (to the tag) that was placed in ToSend[].
9492e0b0 1458// Parameter timing:
7bc95e2e 1459// if NULL: transfer at next possible time, taking into account
1460// request guard time and frame delay time
1461// if == 0: transfer immediately and return time of transfer
9492e0b0 1462// if != 0: delay transfer until time specified
7bc95e2e 1463//-------------------------------------------------------------------------------------
6a1f2d82 1464static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
15c4dc5a 1465{
7bc95e2e 1466
9492e0b0 1467 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
e30c654b 1468
7bc95e2e 1469 uint32_t ThisTransferTime = 0;
e30c654b 1470
9492e0b0 1471 if (timing) {
1472 if(*timing == 0) { // Measure time
7bc95e2e 1473 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
9492e0b0 1474 } else {
1475 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1476 }
7bc95e2e 1477 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1478 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1479 LastTimeProxToAirStart = *timing;
1480 } else {
1481 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1482 while(GetCountSspClk() < ThisTransferTime);
1483 LastTimeProxToAirStart = ThisTransferTime;
9492e0b0 1484 }
1485
7bc95e2e 1486 // clear TXRDY
1487 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1488
7bc95e2e 1489 uint16_t c = 0;
9492e0b0 1490 for(;;) {
1491 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1492 AT91C_BASE_SSC->SSC_THR = cmd[c];
1493 c++;
1494 if(c >= len) {
1495 break;
1496 }
1497 }
1498 }
7bc95e2e 1499
1500 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
15c4dc5a 1501}
1502
7bc95e2e 1503
15c4dc5a 1504//-----------------------------------------------------------------------------
195af472 1505// Prepare reader command (in bits, support short frames) to send to FPGA
15c4dc5a 1506//-----------------------------------------------------------------------------
6a1f2d82 1507void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
15c4dc5a 1508{
7bc95e2e 1509 int i, j;
1510 int last;
1511 uint8_t b;
e30c654b 1512
7bc95e2e 1513 ToSendReset();
e30c654b 1514
7bc95e2e 1515 // Start of Communication (Seq. Z)
1516 ToSend[++ToSendMax] = SEC_Z;
1517 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1518 last = 0;
1519
1520 size_t bytecount = nbytes(bits);
1521 // Generate send structure for the data bits
1522 for (i = 0; i < bytecount; i++) {
1523 // Get the current byte to send
1524 b = cmd[i];
1525 size_t bitsleft = MIN((bits-(i*8)),8);
1526
1527 for (j = 0; j < bitsleft; j++) {
1528 if (b & 1) {
1529 // Sequence X
1530 ToSend[++ToSendMax] = SEC_X;
1531 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1532 last = 1;
1533 } else {
1534 if (last == 0) {
1535 // Sequence Z
1536 ToSend[++ToSendMax] = SEC_Z;
1537 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1538 } else {
1539 // Sequence Y
1540 ToSend[++ToSendMax] = SEC_Y;
1541 last = 0;
1542 }
1543 }
1544 b >>= 1;
1545 }
1546
6a1f2d82 1547 // Only transmit parity bit if we transmitted a complete byte
0ec548dc 1548 if (j == 8 && parity != NULL) {
7bc95e2e 1549 // Get the parity bit
6a1f2d82 1550 if (parity[i>>3] & (0x80 >> (i&0x0007))) {
7bc95e2e 1551 // Sequence X
1552 ToSend[++ToSendMax] = SEC_X;
1553 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1554 last = 1;
1555 } else {
1556 if (last == 0) {
1557 // Sequence Z
1558 ToSend[++ToSendMax] = SEC_Z;
1559 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1560 } else {
1561 // Sequence Y
1562 ToSend[++ToSendMax] = SEC_Y;
1563 last = 0;
1564 }
1565 }
1566 }
1567 }
e30c654b 1568
7bc95e2e 1569 // End of Communication: Logic 0 followed by Sequence Y
1570 if (last == 0) {
1571 // Sequence Z
1572 ToSend[++ToSendMax] = SEC_Z;
1573 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1574 } else {
1575 // Sequence Y
1576 ToSend[++ToSendMax] = SEC_Y;
1577 last = 0;
1578 }
1579 ToSend[++ToSendMax] = SEC_Y;
e30c654b 1580
7bc95e2e 1581 // Convert to length of command:
1582 ToSendMax++;
15c4dc5a 1583}
1584
195af472 1585//-----------------------------------------------------------------------------
1586// Prepare reader command to send to FPGA
1587//-----------------------------------------------------------------------------
6a1f2d82 1588void CodeIso14443aAsReaderPar(const uint8_t *cmd, uint16_t len, const uint8_t *parity)
195af472 1589{
6a1f2d82 1590 CodeIso14443aBitsAsReaderPar(cmd, len*8, parity);
195af472 1591}
1592
0c8d25eb 1593
9ca155ba
M
1594//-----------------------------------------------------------------------------
1595// Wait for commands from reader
1596// Stop when button is pressed (return 1) or field was gone (return 2)
1597// Or return 0 when command is captured
1598//-----------------------------------------------------------------------------
6a1f2d82 1599static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
9ca155ba
M
1600{
1601 *len = 0;
1602
1603 uint32_t timer = 0, vtime = 0;
1604 int analogCnt = 0;
1605 int analogAVG = 0;
1606
1607 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1608 // only, since we are receiving, not transmitting).
1609 // Signal field is off with the appropriate LED
1610 LED_D_OFF();
1611 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1612
1613 // Set ADC to read field strength
1614 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1615 AT91C_BASE_ADC->ADC_MR =
0c8d25eb 1616 ADC_MODE_PRESCALE(63) |
1617 ADC_MODE_STARTUP_TIME(1) |
1618 ADC_MODE_SAMPLE_HOLD_TIME(15);
9ca155ba
M
1619 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1620 // start ADC
1621 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1622
1623 // Now run a 'software UART' on the stream of incoming samples.
6a1f2d82 1624 UartInit(received, parity);
7bc95e2e 1625
1626 // Clear RXRDY:
1627 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
0c8d25eb 1628
9ca155ba
M
1629 for(;;) {
1630 WDT_HIT();
1631
1632 if (BUTTON_PRESS()) return 1;
1633
1634 // test if the field exists
1635 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1636 analogCnt++;
1637 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1638 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1639 if (analogCnt >= 32) {
0c8d25eb 1640 if ((MAX_ADC_HF_VOLTAGE * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
9ca155ba
M
1641 vtime = GetTickCount();
1642 if (!timer) timer = vtime;
1643 // 50ms no field --> card to idle state
1644 if (vtime - timer > 50) return 2;
1645 } else
1646 if (timer) timer = 0;
1647 analogCnt = 0;
1648 analogAVG = 0;
1649 }
1650 }
7bc95e2e 1651
9ca155ba 1652 // receive and test the miller decoding
7bc95e2e 1653 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1654 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1655 if(MillerDecoding(b, 0)) {
1656 *len = Uart.len;
9ca155ba
M
1657 return 0;
1658 }
7bc95e2e 1659 }
1660
9ca155ba
M
1661 }
1662}
1663
9ca155ba 1664
6a1f2d82 1665static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded)
7bc95e2e 1666{
1667 uint8_t b;
1668 uint16_t i = 0;
1669 uint32_t ThisTransferTime;
1670
9ca155ba
M
1671 // Modulate Manchester
1672 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
7bc95e2e 1673
1674 // include correction bit if necessary
1675 if (Uart.parityBits & 0x01) {
1676 correctionNeeded = TRUE;
1677 }
1678 if(correctionNeeded) {
9ca155ba
M
1679 // 1236, so correction bit needed
1680 i = 0;
7bc95e2e 1681 } else {
1682 i = 1;
9ca155ba 1683 }
7bc95e2e 1684
d714d3ef 1685 // clear receiving shift register and holding register
7bc95e2e 1686 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1687 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1688 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1689 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
9ca155ba 1690
7bc95e2e 1691 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1692 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1693 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1694 if (AT91C_BASE_SSC->SSC_RHR) break;
1695 }
1696
1697 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1698
1699 // Clear TXRDY:
1700 AT91C_BASE_SSC->SSC_THR = SEC_F;
1701
9ca155ba 1702 // send cycle
bb42a03e 1703 for(; i < respLen; ) {
9ca155ba 1704 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
7bc95e2e 1705 AT91C_BASE_SSC->SSC_THR = resp[i++];
1706 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba 1707 }
7bc95e2e 1708
17ad0e09 1709 if(BUTTON_PRESS()) break;
9ca155ba
M
1710 }
1711
7bc95e2e 1712 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
0c8d25eb 1713 uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3;
1714 for (i = 0; i <= fpga_queued_bits/8 + 1; ) {
7bc95e2e 1715 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1716 AT91C_BASE_SSC->SSC_THR = SEC_F;
1717 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1718 i++;
1719 }
1720 }
0c8d25eb 1721
7bc95e2e 1722 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1723
9ca155ba
M
1724 return 0;
1725}
1726
7bc95e2e 1727int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1728 Code4bitAnswerAsTag(resp);
0a39986e 1729 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1730 // do the tracing for the previous reader request and this tag answer:
6a1f2d82 1731 uint8_t par[1];
1732 GetParity(&resp, 1, par);
7bc95e2e 1733 EmLogTrace(Uart.output,
1734 Uart.len,
1735 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1736 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1737 Uart.parity,
7bc95e2e 1738 &resp,
1739 1,
1740 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1741 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1742 par);
0a39986e 1743 return res;
9ca155ba
M
1744}
1745
8f51ddb0 1746int EmSend4bit(uint8_t resp){
7bc95e2e 1747 return EmSend4bitEx(resp, false);
8f51ddb0
M
1748}
1749
6a1f2d82 1750int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par){
7bc95e2e 1751 CodeIso14443aAsTagPar(resp, respLen, par);
8f51ddb0 1752 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1753 // do the tracing for the previous reader request and this tag answer:
1754 EmLogTrace(Uart.output,
1755 Uart.len,
1756 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1757 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
6a1f2d82 1758 Uart.parity,
7bc95e2e 1759 resp,
1760 respLen,
1761 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1762 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
6a1f2d82 1763 par);
8f51ddb0
M
1764 return res;
1765}
1766
6a1f2d82 1767int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
1768 uint8_t par[MAX_PARITY_SIZE];
1769 GetParity(resp, respLen, par);
1770 return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
8f51ddb0
M
1771}
1772
6a1f2d82 1773int EmSendCmd(uint8_t *resp, uint16_t respLen){
1774 uint8_t par[MAX_PARITY_SIZE];
1775 GetParity(resp, respLen, par);
1776 return EmSendCmdExPar(resp, respLen, false, par);
8f51ddb0
M
1777}
1778
6a1f2d82 1779int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par){
7bc95e2e 1780 return EmSendCmdExPar(resp, respLen, false, par);
1781}
1782
6a1f2d82 1783bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
1784 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity)
7bc95e2e 1785{
1786 if (tracing) {
1787 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1788 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1789 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1790 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1791 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1792 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1793 reader_EndTime = tag_StartTime - exact_fdt;
1794 reader_StartTime = reader_EndTime - reader_modlen;
6a1f2d82 1795 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
7bc95e2e 1796 return FALSE;
6a1f2d82 1797 } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
7bc95e2e 1798 } else {
1799 return TRUE;
1800 }
9ca155ba
M
1801}
1802
15c4dc5a 1803//-----------------------------------------------------------------------------
1804// Wait a certain time for tag response
1805// If a response is captured return TRUE
e691fc45 1806// If it takes too long return FALSE
15c4dc5a 1807//-----------------------------------------------------------------------------
6a1f2d82 1808static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
15c4dc5a 1809{
46c65fed 1810 uint32_t c = 0x00;
e691fc45 1811
15c4dc5a 1812 // Set FPGA mode to "reader listen mode", no modulation (listen
534983d7 1813 // only, since we are receiving, not transmitting).
1814 // Signal field is on with the appropriate LED
1815 LED_D_ON();
1816 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1c611bbd 1817
534983d7 1818 // Now get the answer from the card
6a1f2d82 1819 DemodInit(receivedResponse, receivedResponsePar);
15c4dc5a 1820
7bc95e2e 1821 // clear RXRDY:
1822 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
0c8d25eb 1823
15c4dc5a 1824 for(;;) {
534983d7 1825 WDT_HIT();
15c4dc5a 1826
534983d7 1827 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
534983d7 1828 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
7bc95e2e 1829 if(ManchesterDecoding(b, offset, 0)) {
1830 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
15c4dc5a 1831 return TRUE;
19a700a8 1832 } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
7bc95e2e 1833 return FALSE;
15c4dc5a 1834 }
534983d7 1835 }
1836 }
15c4dc5a 1837}
1838
6a1f2d82 1839void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
15c4dc5a 1840{
6a1f2d82 1841 CodeIso14443aBitsAsReaderPar(frame, bits, par);
dfc3c505 1842
7bc95e2e 1843 // Send command to tag
1844 TransmitFor14443a(ToSend, ToSendMax, timing);
1845 if(trigger)
1846 LED_A_ON();
dfc3c505 1847
7bc95e2e 1848 // Log reader command in trace buffer
1849 if (tracing) {
6a1f2d82 1850 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
7bc95e2e 1851 }
15c4dc5a 1852}
1853
6a1f2d82 1854void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
dfc3c505 1855{
6a1f2d82 1856 ReaderTransmitBitsPar(frame, len*8, par, timing);
dfc3c505 1857}
15c4dc5a 1858
6a1f2d82 1859void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
e691fc45 1860{
1861 // Generate parity and redirect
6a1f2d82 1862 uint8_t par[MAX_PARITY_SIZE];
1863 GetParity(frame, len/8, par);
1864 ReaderTransmitBitsPar(frame, len, par, timing);
e691fc45 1865}
1866
6a1f2d82 1867void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
15c4dc5a 1868{
1869 // Generate parity and redirect
6a1f2d82 1870 uint8_t par[MAX_PARITY_SIZE];
1871 GetParity(frame, len, par);
1872 ReaderTransmitBitsPar(frame, len*8, par, timing);
15c4dc5a 1873}
1874
6a1f2d82 1875int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
e691fc45 1876{
6a1f2d82 1877 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE;
7bc95e2e 1878 if (tracing) {
6a1f2d82 1879 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
7bc95e2e 1880 }
e691fc45 1881 return Demod.len;
1882}
1883
6a1f2d82 1884int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
15c4dc5a 1885{
6a1f2d82 1886 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
7bc95e2e 1887 if (tracing) {
6a1f2d82 1888 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
7bc95e2e 1889 }
e691fc45 1890 return Demod.len;
f89c7050
M
1891}
1892
e691fc45 1893/* performs iso14443a anticollision procedure
534983d7 1894 * fills the uid pointer unless NULL
1895 * fills resp_data unless NULL */
6a1f2d82 1896int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, uint32_t *cuid_ptr) {
1897 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1898 uint8_t sel_all[] = { 0x93,0x20 };
1899 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1900 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
f71f4deb 1901 uint8_t resp[MAX_FRAME_SIZE]; // theoretically. A usual RATS will be much smaller
1902 uint8_t resp_par[MAX_PARITY_SIZE];
6a1f2d82 1903 byte_t uid_resp[4];
1904 size_t uid_resp_len;
1905
1906 uint8_t sak = 0x04; // cascade uid
1907 int cascade_level = 0;
1908 int len;
1909
1910 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
9492e0b0 1911 ReaderTransmitBitsPar(wupa,7,0, NULL);
7bc95e2e 1912
6a1f2d82 1913 // Receive the ATQA
1914 if(!ReaderReceive(resp, resp_par)) return 0;
6a1f2d82 1915
1916 if(p_hi14a_card) {
1917 memcpy(p_hi14a_card->atqa, resp, 2);
1918 p_hi14a_card->uidlen = 0;
1919 memset(p_hi14a_card->uid,0,10);
1920 }
5f6d6c90 1921
6a1f2d82 1922 // clear uid
1923 if (uid_ptr) {
1924 memset(uid_ptr,0,10);
1925 }
79a73ab2 1926
0ec548dc 1927 // check for proprietary anticollision:
1928 if ((resp[0] & 0x1F) == 0) {
1929 return 3;
1930 }
1931
6a1f2d82 1932 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1933 // which case we need to make a cascade 2 request and select - this is a long UID
1934 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1935 for(; sak & 0x04; cascade_level++) {
1936 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1937 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1938
1939 // SELECT_ALL
1940 ReaderTransmit(sel_all, sizeof(sel_all), NULL);
1941 if (!ReaderReceive(resp, resp_par)) return 0;
1942
1943 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1944 memset(uid_resp, 0, 4);
1945 uint16_t uid_resp_bits = 0;
1946 uint16_t collision_answer_offset = 0;
1947 // anti-collision-loop:
1948 while (Demod.collisionPos) {
1949 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1950 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1951 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
758f1fd1 1952 uid_resp[uid_resp_bits / 8] |= UIDbit << (uid_resp_bits % 8);
6a1f2d82 1953 }
1954 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1955 uid_resp_bits++;
1956 // construct anticollosion command:
1957 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1958 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1959 sel_uid[2+i] = uid_resp[i];
1960 }
1961 collision_answer_offset = uid_resp_bits%8;
1962 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1963 if (!ReaderReceiveOffset(resp, collision_answer_offset, resp_par)) return 0;
e691fc45 1964 }
6a1f2d82 1965 // finally, add the last bits and BCC of the UID
1966 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1967 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1968 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
e691fc45 1969 }
e691fc45 1970
6a1f2d82 1971 } else { // no collision, use the response to SELECT_ALL as current uid
1972 memcpy(uid_resp, resp, 4);
1973 }
1974 uid_resp_len = 4;
5f6d6c90 1975
6a1f2d82 1976 // calculate crypto UID. Always use last 4 Bytes.
1977 if(cuid_ptr) {
1978 *cuid_ptr = bytes_to_num(uid_resp, 4);
1979 }
e30c654b 1980
6a1f2d82 1981 // Construct SELECT UID command
1982 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1983 memcpy(sel_uid+2, uid_resp, 4); // the UID
1984 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1985 AppendCrc14443a(sel_uid, 7); // calculate and add CRC
1986 ReaderTransmit(sel_uid, sizeof(sel_uid), NULL);
1987
1988 // Receive the SAK
1989 if (!ReaderReceive(resp, resp_par)) return 0;
1990 sak = resp[0];
1991
52ab55ab 1992 // Test if more parts of the uid are coming
6a1f2d82 1993 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
1994 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1995 // http://www.nxp.com/documents/application_note/AN10927.pdf
6a1f2d82 1996 uid_resp[0] = uid_resp[1];
1997 uid_resp[1] = uid_resp[2];
1998 uid_resp[2] = uid_resp[3];
1999
2000 uid_resp_len = 3;
2001 }
5f6d6c90 2002
6a1f2d82 2003 if(uid_ptr) {
2004 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
2005 }
5f6d6c90 2006
6a1f2d82 2007 if(p_hi14a_card) {
2008 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
2009 p_hi14a_card->uidlen += uid_resp_len;
2010 }
2011 }
79a73ab2 2012
6a1f2d82 2013 if(p_hi14a_card) {
2014 p_hi14a_card->sak = sak;
2015 p_hi14a_card->ats_len = 0;
2016 }
534983d7 2017
3fe4ff4f 2018 // non iso14443a compliant tag
2019 if( (sak & 0x20) == 0) return 2;
534983d7 2020
6a1f2d82 2021 // Request for answer to select
2022 AppendCrc14443a(rats, 2);
2023 ReaderTransmit(rats, sizeof(rats), NULL);
1c611bbd 2024
6a1f2d82 2025 if (!(len = ReaderReceive(resp, resp_par))) return 0;
5191b3d1 2026
3fe4ff4f 2027
6a1f2d82 2028 if(p_hi14a_card) {
2029 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
2030 p_hi14a_card->ats_len = len;
2031 }
5f6d6c90 2032
6a1f2d82 2033 // reset the PCB block number
2034 iso14_pcb_blocknum = 0;
19a700a8 2035
2036 // set default timeout based on ATS
2037 iso14a_set_ATS_timeout(resp);
2038
6a1f2d82 2039 return 1;
7e758047 2040}
15c4dc5a 2041
7bc95e2e 2042void iso14443a_setup(uint8_t fpga_minor_mode) {
7cc204bf 2043 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9492e0b0 2044 // Set up the synchronous serial port
2045 FpgaSetupSsc();
7bc95e2e 2046 // connect Demodulated Signal to ADC:
7e758047 2047 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
e30c654b 2048
7e758047 2049 // Signal field is on with the appropriate LED
7bc95e2e 2050 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
2051 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
2052 LED_D_ON();
2053 } else {
2054 LED_D_OFF();
2055 }
2056 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
534983d7 2057
7bc95e2e 2058 // Start the timer
2059 StartCountSspClk();
2060
2061 DemodReset();
2062 UartReset();
2063 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
46c65fed 2064 iso14a_set_timeout(10*106); // 10ms default
7e758047 2065}
15c4dc5a 2066
6a1f2d82 2067int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
2068 uint8_t parity[MAX_PARITY_SIZE];
534983d7 2069 uint8_t real_cmd[cmd_len+4];
2070 real_cmd[0] = 0x0a; //I-Block
b0127e65 2071 // put block number into the PCB
2072 real_cmd[0] |= iso14_pcb_blocknum;
534983d7 2073 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
2074 memcpy(real_cmd+2, cmd, cmd_len);
2075 AppendCrc14443a(real_cmd,cmd_len+2);
2076
9492e0b0 2077 ReaderTransmit(real_cmd, cmd_len+4, NULL);
6a1f2d82 2078 size_t len = ReaderReceive(data, parity);
2079 uint8_t *data_bytes = (uint8_t *) data;
b0127e65 2080 if (!len)
2081 return 0; //DATA LINK ERROR
2082 // if we received an I- or R(ACK)-Block with a block number equal to the
2083 // current block number, toggle the current block number
2084 else if (len >= 4 // PCB+CID+CRC = 4 bytes
2085 && ((data_bytes[0] & 0xC0) == 0 // I-Block
2086 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
2087 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
2088 {
2089 iso14_pcb_blocknum ^= 1;
2090 }
2091
534983d7 2092 return len;
2093}
2094
7e758047 2095//-----------------------------------------------------------------------------
2096// Read an ISO 14443a tag. Send out commands and store answers.
2097//
2098//-----------------------------------------------------------------------------
7bc95e2e 2099void ReaderIso14443a(UsbCommand *c)
7e758047 2100{
534983d7 2101 iso14a_command_t param = c->arg[0];
7bc95e2e 2102 uint8_t *cmd = c->d.asBytes;
04bc1c66 2103 size_t len = c->arg[1] & 0xffff;
2104 size_t lenbits = c->arg[1] >> 16;
2105 uint32_t timeout = c->arg[2];
9492e0b0 2106 uint32_t arg0 = 0;
2107 byte_t buf[USB_CMD_DATA_SIZE];
6a1f2d82 2108 uint8_t par[MAX_PARITY_SIZE];
902cb3c0 2109
5f6d6c90 2110 if(param & ISO14A_CONNECT) {
3000dc4e 2111 clear_trace();
5f6d6c90 2112 }
e691fc45 2113
3000dc4e 2114 set_tracing(TRUE);
e30c654b 2115
79a73ab2 2116 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 2117 iso14a_set_trigger(TRUE);
9492e0b0 2118 }
15c4dc5a 2119
534983d7 2120 if(param & ISO14A_CONNECT) {
7bc95e2e 2121 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
5f6d6c90 2122 if(!(param & ISO14A_NO_SELECT)) {
2123 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
2124 arg0 = iso14443a_select_card(NULL,card,NULL);
2125 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
2126 }
534983d7 2127 }
e30c654b 2128
534983d7 2129 if(param & ISO14A_SET_TIMEOUT) {
04bc1c66 2130 iso14a_set_timeout(timeout);
534983d7 2131 }
e30c654b 2132
534983d7 2133 if(param & ISO14A_APDU) {
902cb3c0 2134 arg0 = iso14_apdu(cmd, len, buf);
79a73ab2 2135 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 2136 }
e30c654b 2137
534983d7 2138 if(param & ISO14A_RAW) {
2139 if(param & ISO14A_APPEND_CRC) {
0ec548dc 2140 if(param & ISO14A_TOPAZMODE) {
2141 AppendCrc14443b(cmd,len);
2142 } else {
d26849d4 2143 AppendCrc14443a(cmd,len);
0ec548dc 2144 }
534983d7 2145 len += 2;
c7324bef 2146 if (lenbits) lenbits += 16;
15c4dc5a 2147 }
0ec548dc 2148 if(lenbits>0) { // want to send a specific number of bits (e.g. short commands)
2149 if(param & ISO14A_TOPAZMODE) {
2150 int bits_to_send = lenbits;
2151 uint16_t i = 0;
2152 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 7), NULL, NULL); // first byte is always short (7bits) and no parity
2153 bits_to_send -= 7;
2154 while (bits_to_send > 0) {
2155 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 8), NULL, NULL); // following bytes are 8 bit and no parity
2156 bits_to_send -= 8;
2157 }
2158 } else {
6a1f2d82 2159 GetParity(cmd, lenbits/8, par);
0ec548dc 2160 ReaderTransmitBitsPar(cmd, lenbits, par, NULL); // bytes are 8 bit with odd parity
2161 }
2162 } else { // want to send complete bytes only
2163 if(param & ISO14A_TOPAZMODE) {
2164 uint16_t i = 0;
2165 ReaderTransmitBitsPar(&cmd[i++], 7, NULL, NULL); // first byte: 7 bits, no paritiy
2166 while (i < len) {
2167 ReaderTransmitBitsPar(&cmd[i++], 8, NULL, NULL); // following bytes: 8 bits, no paritiy
2168 }
5f6d6c90 2169 } else {
0ec548dc 2170 ReaderTransmit(cmd,len, NULL); // 8 bits, odd parity
2171 }
5f6d6c90 2172 }
6a1f2d82 2173 arg0 = ReaderReceive(buf, par);
9492e0b0 2174 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 2175 }
15c4dc5a 2176
79a73ab2 2177 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 2178 iso14a_set_trigger(FALSE);
9492e0b0 2179 }
15c4dc5a 2180
79a73ab2 2181 if(param & ISO14A_NO_DISCONNECT) {
534983d7 2182 return;
9492e0b0 2183 }
15c4dc5a 2184
15c4dc5a 2185 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
5ee53a0e 2186 set_tracing(FALSE);
15c4dc5a 2187 LEDsoff();
15c4dc5a 2188}
b0127e65 2189
1c611bbd 2190
1c611bbd 2191// Determine the distance between two nonces.
2192// Assume that the difference is small, but we don't know which is first.
2193// Therefore try in alternating directions.
2194int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
2195
c830303d 2196 uint16_t i;
2197 uint32_t nttmp1, nttmp2;
2198
1c611bbd 2199 if (nt1 == nt2) return 0;
2200
c830303d 2201 nttmp1 = nt1;
2202 nttmp2 = nt2;
1c611bbd 2203
0de8e387 2204 for (i = 1; i < 0xFFFF; i++) {
1c611bbd 2205 nttmp1 = prng_successor(nttmp1, 1);
2206 if (nttmp1 == nt2) return i;
2207 nttmp2 = prng_successor(nttmp2, 1);
2208 if (nttmp2 == nt1) return -i;
2209 }
2210
2211 return(-99999); // either nt1 or nt2 are invalid nonces
e772353f 2212}
2213
e772353f 2214
1c611bbd 2215//-----------------------------------------------------------------------------
2216// Recover several bits of the cypher stream. This implements (first stages of)
2217// the algorithm described in "The Dark Side of Security by Obscurity and
2218// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2219// (article by Nicolas T. Courtois, 2009)
2220//-----------------------------------------------------------------------------
c830303d 2221void ReaderMifare(bool first_try)
2222{
2223 // Mifare AUTH
2224 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
2225 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
2226 static uint8_t mf_nr_ar3;
2227
2228 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
2229 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
2230
99cf19d9 2231 if (first_try) {
2232 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2233 }
2234
f71f4deb 2235 // free eventually allocated BigBuf memory. We want all for tracing.
2236 BigBuf_free();
2237
3000dc4e
MHS
2238 clear_trace();
2239 set_tracing(TRUE);
e772353f 2240
1c611bbd 2241 byte_t nt_diff = 0;
6a1f2d82 2242 uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
1c611bbd 2243 static byte_t par_low = 0;
2244 bool led_on = TRUE;
c830303d 2245 uint8_t uid[10] ={0};
2246 uint32_t cuid;
e772353f 2247
6a1f2d82 2248 uint32_t nt = 0;
2ed270a8 2249 uint32_t previous_nt = 0;
1c611bbd 2250 static uint32_t nt_attacked = 0;
3fe4ff4f 2251 byte_t par_list[8] = {0x00};
2252 byte_t ks_list[8] = {0x00};
e772353f 2253
0de8e387 2254 #define PRNG_SEQUENCE_LENGTH (1 << 16);
d26849d4 2255 static uint32_t sync_time = 0;
3bc7b13d 2256 static int32_t sync_cycles = 0;
1c611bbd 2257 int catch_up_cycles = 0;
2258 int last_catch_up = 0;
3bc7b13d 2259 uint16_t elapsed_prng_sequences;
1c611bbd 2260 uint16_t consecutive_resyncs = 0;
2261 int isOK = 0;
e772353f 2262
1c611bbd 2263 if (first_try) {
1c611bbd 2264 mf_nr_ar3 = 0;
7bc95e2e 2265 sync_time = GetCountSspClk() & 0xfffffff8;
0de8e387 2266 sync_cycles = PRNG_SEQUENCE_LENGTH; //65536; //0x10000 // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
1c611bbd 2267 nt_attacked = 0;
6a1f2d82 2268 par[0] = 0;
1c611bbd 2269 }
2270 else {
2271 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
1c611bbd 2272 mf_nr_ar3++;
2273 mf_nr_ar[3] = mf_nr_ar3;
6a1f2d82 2274 par[0] = par_low;
1c611bbd 2275 }
e30c654b 2276
15c4dc5a 2277 LED_A_ON();
2278 LED_B_OFF();
2279 LED_C_OFF();
c830303d 2280
2281
3bc7b13d 2282 #define MAX_UNEXPECTED_RANDOM 4 // maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
2283 #define MAX_SYNC_TRIES 32
2284 #define NUM_DEBUG_INFOS 8 // per strategy
2285 #define MAX_STRATEGY 3
0de8e387 2286 uint16_t unexpected_random = 0;
2287 uint16_t sync_tries = 0;
2288 int16_t debug_info_nr = -1;
3bc7b13d 2289 uint16_t strategy = 0;
2290 int32_t debug_info[MAX_STRATEGY][NUM_DEBUG_INFOS];
2291 uint32_t select_time;
2292 uint32_t halt_time;
7bc95e2e 2293
1c611bbd 2294 for(uint16_t i = 0; TRUE; i++) {
2295
c830303d 2296 LED_C_ON();
1c611bbd 2297 WDT_HIT();
e30c654b 2298
1c611bbd 2299 // Test if the action was cancelled
c830303d 2300 if(BUTTON_PRESS()) {
2301 isOK = -1;
1c611bbd 2302 break;
2303 }
2304
3bc7b13d 2305 if (strategy == 2) {
2306 // test with additional hlt command
2307 halt_time = 0;
2308 int len = mifare_sendcmd_short(NULL, false, 0x50, 0x00, receivedAnswer, receivedAnswerPar, &halt_time);
2309 if (len && MF_DBGLEVEL >= 3) {
2310 Dbprintf("Unexpected response of %d bytes to hlt command (additional debugging).", len);
2311 }
2312 }
2313
2314 if (strategy == 3) {
2315 // test with FPGA power off/on
2316 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2317 SpinDelay(200);
2318 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2319 SpinDelay(100);
2320 }
2321
c830303d 2322 if(!iso14443a_select_card(uid, NULL, &cuid)) {
9492e0b0 2323 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
1c611bbd 2324 continue;
2325 }
3bc7b13d 2326 select_time = GetCountSspClk();
1c611bbd 2327
3bc7b13d 2328 elapsed_prng_sequences = 1;
0de8e387 2329 if (debug_info_nr == -1) {
2330 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
2331 catch_up_cycles = 0;
1c611bbd 2332
0de8e387 2333 // if we missed the sync time already, advance to the next nonce repeat
2334 while(GetCountSspClk() > sync_time) {
3bc7b13d 2335 elapsed_prng_sequences++;
0de8e387 2336 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
2337 }
e30c654b 2338
0de8e387 2339 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2340 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2341 } else {
3bc7b13d 2342 // collect some information on tag nonces for debugging:
2343 #define DEBUG_FIXED_SYNC_CYCLES PRNG_SEQUENCE_LENGTH
2344 if (strategy == 0) {
2345 // nonce distances at fixed time after card select:
2346 sync_time = select_time + DEBUG_FIXED_SYNC_CYCLES;
2347 } else if (strategy == 1) {
2348 // nonce distances at fixed time between authentications:
2349 sync_time = sync_time + DEBUG_FIXED_SYNC_CYCLES;
2350 } else if (strategy == 2) {
2351 // nonce distances at fixed time after halt:
2352 sync_time = halt_time + DEBUG_FIXED_SYNC_CYCLES;
2353 } else {
2354 // nonce_distances at fixed time after power on
2355 sync_time = DEBUG_FIXED_SYNC_CYCLES;
2356 }
2357 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
0de8e387 2358 }
f89c7050 2359
1c611bbd 2360 // Receive the (4 Byte) "random" nonce
6a1f2d82 2361 if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
9492e0b0 2362 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
1c611bbd 2363 continue;
2364 }
2365
1c611bbd 2366 previous_nt = nt;
2367 nt = bytes_to_num(receivedAnswer, 4);
2368
2369 // Transmit reader nonce with fake par
9492e0b0 2370 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
1c611bbd 2371
2372 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2373 int nt_distance = dist_nt(previous_nt, nt);
2374 if (nt_distance == 0) {
2375 nt_attacked = nt;
0de8e387 2376 } else {
c830303d 2377 if (nt_distance == -99999) { // invalid nonce received
0de8e387 2378 unexpected_random++;
3bc7b13d 2379 if (unexpected_random > MAX_UNEXPECTED_RANDOM) {
c830303d 2380 isOK = -3; // Card has an unpredictable PRNG. Give up
2381 break;
2382 } else {
2383 continue; // continue trying...
2384 }
1c611bbd 2385 }
0de8e387 2386 if (++sync_tries > MAX_SYNC_TRIES) {
3bc7b13d 2387 if (strategy > MAX_STRATEGY || MF_DBGLEVEL < 3) {
0de8e387 2388 isOK = -4; // Card's PRNG runs at an unexpected frequency or resets unexpectedly
2389 break;
2390 } else { // continue for a while, just to collect some debug info
3bc7b13d 2391 debug_info[strategy][debug_info_nr] = nt_distance;
2392 debug_info_nr++;
2393 if (debug_info_nr == NUM_DEBUG_INFOS) {
2394 strategy++;
2395 debug_info_nr = 0;
2396 }
0de8e387 2397 continue;
2398 }
2399 }
3bc7b13d 2400 sync_cycles = (sync_cycles - nt_distance/elapsed_prng_sequences);
0de8e387 2401 if (sync_cycles <= 0) {
2402 sync_cycles += PRNG_SEQUENCE_LENGTH;
2403 }
2404 if (MF_DBGLEVEL >= 3) {
3bc7b13d 2405 Dbprintf("calibrating in cycle %d. nt_distance=%d, elapsed_prng_sequences=%d, new sync_cycles: %d\n", i, nt_distance, elapsed_prng_sequences, sync_cycles);
0de8e387 2406 }
1c611bbd 2407 continue;
2408 }
2409 }
2410
2411 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2412 catch_up_cycles = -dist_nt(nt_attacked, nt);
c830303d 2413 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
1c611bbd 2414 catch_up_cycles = 0;
2415 continue;
2416 }
3bc7b13d 2417 catch_up_cycles /= elapsed_prng_sequences;
1c611bbd 2418 if (catch_up_cycles == last_catch_up) {
2419 consecutive_resyncs++;
2420 }
2421 else {
2422 last_catch_up = catch_up_cycles;
2423 consecutive_resyncs = 0;
2424 }
2425 if (consecutive_resyncs < 3) {
9492e0b0 2426 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
1c611bbd 2427 }
2428 else {
2429 sync_cycles = sync_cycles + catch_up_cycles;
9492e0b0 2430 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
3bc7b13d 2431 last_catch_up = 0;
2432 catch_up_cycles = 0;
2433 consecutive_resyncs = 0;
1c611bbd 2434 }
2435 continue;
2436 }
2437
2438 consecutive_resyncs = 0;
2439
2440 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
3bc7b13d 2441 if (ReaderReceive(receivedAnswer, receivedAnswerPar)) {
9492e0b0 2442 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
1c611bbd 2443
3bc7b13d 2444 if (nt_diff == 0) {
6a1f2d82 2445 par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
1c611bbd 2446 }
2447
2448 led_on = !led_on;
2449 if(led_on) LED_B_ON(); else LED_B_OFF();
2450
6a1f2d82 2451 par_list[nt_diff] = SwapBits(par[0], 8);
1c611bbd 2452 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2453
2454 // Test if the information is complete
2455 if (nt_diff == 0x07) {
2456 isOK = 1;
2457 break;
2458 }
2459
2460 nt_diff = (nt_diff + 1) & 0x07;
2461 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
6a1f2d82 2462 par[0] = par_low;
1c611bbd 2463 } else {
2464 if (nt_diff == 0 && first_try)
2465 {
6a1f2d82 2466 par[0]++;
c830303d 2467 if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
2468 isOK = -2;
2469 break;
2470 }
1c611bbd 2471 } else {
6a1f2d82 2472 par[0] = ((par[0] & 0x1F) + 1) | par_low;
1c611bbd 2473 }
2474 }
2475 }
2476
c830303d 2477
1c611bbd 2478 mf_nr_ar[3] &= 0x1F;
2479
0de8e387 2480 if (isOK == -4) {
2481 if (MF_DBGLEVEL >= 3) {
3bc7b13d 2482 for (uint16_t i = 0; i <= MAX_STRATEGY; i++) {
2483 for(uint16_t j = 0; j < NUM_DEBUG_INFOS; j++) {
2484 Dbprintf("collected debug info[%d][%d] = %d", i, j, debug_info[i][j]);
2485 }
0de8e387 2486 }
2487 }
2488 }
d26849d4 2489
0de8e387 2490 byte_t buf[28];
1c611bbd 2491 memcpy(buf + 0, uid, 4);
2492 num_to_bytes(nt, 4, buf + 4);
2493 memcpy(buf + 8, par_list, 8);
2494 memcpy(buf + 16, ks_list, 8);
2495 memcpy(buf + 24, mf_nr_ar, 4);
2496
2497 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2498
99cf19d9 2499 // Thats it...
1c611bbd 2500 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2501 LEDsoff();
99cf19d9 2502
2503 set_tracing(FALSE);
20f9a2a1 2504}
1c611bbd 2505
0de8e387 2506/**
d2f487af 2507 *MIFARE 1K simulate.
2508 *
2509 *@param flags :
2510 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2511 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2512 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2513 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2514 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2515 */
2516void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
20f9a2a1 2517{
50193c1e 2518 int cardSTATE = MFEMUL_NOFIELD;
8556b852 2519 int _7BUID = 0;
9ca155ba 2520 int vHf = 0; // in mV
8f51ddb0 2521 int res;
0a39986e
M
2522 uint32_t selTimer = 0;
2523 uint32_t authTimer = 0;
6a1f2d82 2524 uint16_t len = 0;
8f51ddb0 2525 uint8_t cardWRBL = 0;
9ca155ba
M
2526 uint8_t cardAUTHSC = 0;
2527 uint8_t cardAUTHKEY = 0xff; // no authentication
c3c241f3 2528// uint32_t cardRr = 0;
9ca155ba 2529 uint32_t cuid = 0;
d2f487af 2530 //uint32_t rn_enc = 0;
51969283 2531 uint32_t ans = 0;
0014cb46
M
2532 uint32_t cardINTREG = 0;
2533 uint8_t cardINTBLOCK = 0;
9ca155ba
M
2534 struct Crypto1State mpcs = {0, 0};
2535 struct Crypto1State *pcs;
2536 pcs = &mpcs;
d2f487af 2537 uint32_t numReads = 0;//Counts numer of times reader read a block
f71f4deb 2538 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2539 uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE];
2540 uint8_t response[MAX_MIFARE_FRAME_SIZE];
2541 uint8_t response_par[MAX_MIFARE_PARITY_SIZE];
9ca155ba 2542
d2f487af 2543 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2544 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2545 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
c3c241f3 2546 //uint8_t rSAK[] = {0x08, 0xb6, 0xdd}; // Mifare Classic
2547 uint8_t rSAK[] = {0x09, 0x3f, 0xcc }; // Mifare Mini
d2f487af 2548 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
9ca155ba 2549
2d2f7d19 2550 uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
d2f487af 2551 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
7bc95e2e 2552
d2f487af 2553 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2554 // This can be used in a reader-only attack.
2555 // (it can also be retrieved via 'hf 14a list', but hey...
c3c241f3 2556 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
d2f487af 2557 uint8_t ar_nr_collected = 0;
0014cb46 2558
7bc95e2e 2559 // Authenticate response - nonce
51969283 2560 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
7bc95e2e 2561
d2f487af 2562 //-- Determine the UID
2563 // Can be set from emulator memory, incoming data
2564 // and can be 7 or 4 bytes long
7bc95e2e 2565 if (flags & FLAG_4B_UID_IN_DATA)
d2f487af 2566 {
2567 // 4B uid comes from data-portion of packet
2568 memcpy(rUIDBCC1,datain,4);
8556b852 2569 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852 2570
7bc95e2e 2571 } else if (flags & FLAG_7B_UID_IN_DATA) {
d2f487af 2572 // 7B uid comes from data-portion of packet
2573 memcpy(&rUIDBCC1[1],datain,3);
2574 memcpy(rUIDBCC2, datain+3, 4);
2575 _7BUID = true;
7bc95e2e 2576 } else {
d2f487af 2577 // get UID from emul memory
2578 emlGetMemBt(receivedCmd, 7, 1);
2579 _7BUID = !(receivedCmd[0] == 0x00);
2580 if (!_7BUID) { // ---------- 4BUID
2581 emlGetMemBt(rUIDBCC1, 0, 4);
2582 } else { // ---------- 7BUID
2583 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2584 emlGetMemBt(rUIDBCC2, 3, 4);
2585 }
2586 }
7bc95e2e 2587
c3c241f3 2588 // save uid.
2589 ar_nr_responses[0*5] = bytes_to_num(rUIDBCC1+1, 3);
2590 if ( _7BUID )
2591 ar_nr_responses[0*5+1] = bytes_to_num(rUIDBCC2, 4);
2592
d2f487af 2593 /*
2594 * Regardless of what method was used to set the UID, set fifth byte and modify
2595 * the ATQA for 4 or 7-byte UID
2596 */
d2f487af 2597 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
7bc95e2e 2598 if (_7BUID) {
d2f487af 2599 rATQA[0] = 0x44;
8556b852 2600 rUIDBCC1[0] = 0x88;
d26849d4 2601 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852
M
2602 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2603 }
2604
d2f487af 2605 if (MF_DBGLEVEL >= 1) {
2606 if (!_7BUID) {
b03c0f2d 2607 Dbprintf("4B UID: %02x%02x%02x%02x",
2608 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
7bc95e2e 2609 } else {
b03c0f2d 2610 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2611 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
2612 rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
d2f487af 2613 }
2614 }
7bc95e2e 2615
99cf19d9 2616 // We need to listen to the high-frequency, peak-detected path.
2617 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
2618
2619 // free eventually allocated BigBuf memory but keep Emulator Memory
2620 BigBuf_free_keep_EM();
2621
2622 // clear trace
2623 clear_trace();
2624 set_tracing(TRUE);
2625
2626
7bc95e2e 2627 bool finished = FALSE;
d2f487af 2628 while (!BUTTON_PRESS() && !finished) {
9ca155ba 2629 WDT_HIT();
9ca155ba
M
2630
2631 // find reader field
9ca155ba 2632 if (cardSTATE == MFEMUL_NOFIELD) {
0c8d25eb 2633 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
9ca155ba 2634 if (vHf > MF_MINFIELDV) {
0014cb46 2635 cardSTATE_TO_IDLE();
9ca155ba
M
2636 LED_A_ON();
2637 }
2638 }
d2f487af 2639 if(cardSTATE == MFEMUL_NOFIELD) continue;
9ca155ba 2640
d2f487af 2641 //Now, get data
6a1f2d82 2642 res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
d2f487af 2643 if (res == 2) { //Field is off!
2644 cardSTATE = MFEMUL_NOFIELD;
2645 LEDsoff();
2646 continue;
7bc95e2e 2647 } else if (res == 1) {
2648 break; //return value 1 means button press
2649 }
2650
d2f487af 2651 // REQ or WUP request in ANY state and WUP in HALTED state
2652 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2653 selTimer = GetTickCount();
2654 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2655 cardSTATE = MFEMUL_SELECT1;
2656
2657 // init crypto block
2658 LED_B_OFF();
2659 LED_C_OFF();
2660 crypto1_destroy(pcs);
2661 cardAUTHKEY = 0xff;
2662 continue;
0a39986e 2663 }
7bc95e2e 2664
50193c1e 2665 switch (cardSTATE) {
d2f487af 2666 case MFEMUL_NOFIELD:
2667 case MFEMUL_HALTED:
50193c1e 2668 case MFEMUL_IDLE:{
6a1f2d82 2669 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
50193c1e
M
2670 break;
2671 }
2672 case MFEMUL_SELECT1:{
9ca155ba
M
2673 // select all
2674 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
d2f487af 2675 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
9ca155ba 2676 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
0014cb46 2677 break;
9ca155ba
M
2678 }
2679
d2f487af 2680 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2681 {
2682 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2683 }
9ca155ba 2684 // select card
0a39986e
M
2685 if (len == 9 &&
2686 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
bfb6a143 2687 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
9ca155ba 2688 cuid = bytes_to_num(rUIDBCC1, 4);
8556b852
M
2689 if (!_7BUID) {
2690 cardSTATE = MFEMUL_WORK;
0014cb46
M
2691 LED_B_ON();
2692 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2693 break;
8556b852
M
2694 } else {
2695 cardSTATE = MFEMUL_SELECT2;
8556b852 2696 }
9ca155ba 2697 }
50193c1e
M
2698 break;
2699 }
d2f487af 2700 case MFEMUL_AUTH1:{
2701 if( len != 8)
2702 {
2703 cardSTATE_TO_IDLE();
6a1f2d82 2704 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
d2f487af 2705 break;
2706 }
0c8d25eb 2707
d2f487af 2708 uint32_t ar = bytes_to_num(receivedCmd, 4);
6a1f2d82 2709 uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
d2f487af 2710
2711 //Collect AR/NR
46cd801c 2712 //if(ar_nr_collected < 2 && cardAUTHSC == 2){
2713 if(ar_nr_collected < 2){
273b57a7 2714 if(ar_nr_responses[2] != ar)
2715 {// Avoid duplicates... probably not necessary, ar should vary.
c3c241f3 2716 //ar_nr_responses[ar_nr_collected*5] = 0;
2717 //ar_nr_responses[ar_nr_collected*5+1] = 0;
2718 ar_nr_responses[ar_nr_collected*5+2] = nonce;
2719 ar_nr_responses[ar_nr_collected*5+3] = nr;
2720 ar_nr_responses[ar_nr_collected*5+4] = ar;
273b57a7 2721 ar_nr_collected++;
12d708fe 2722 }
2723 // Interactive mode flag, means we need to send ACK
2724 if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
2725 {
2726 finished = true;
46cd801c 2727 }
d2f487af 2728 }
2729
2730 // --- crypto
c3c241f3 2731 //crypto1_word(pcs, ar , 1);
2732 //cardRr = nr ^ crypto1_word(pcs, 0, 0);
2733
2734 //test if auth OK
2735 //if (cardRr != prng_successor(nonce, 64)){
2736
2737 //if (MF_DBGLEVEL >= 4) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2738 // cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2739 // cardRr, prng_successor(nonce, 64));
7bc95e2e 2740 // Shouldn't we respond anything here?
d2f487af 2741 // Right now, we don't nack or anything, which causes the
2742 // reader to do a WUPA after a while. /Martin
b03c0f2d 2743 // -- which is the correct response. /piwi
c3c241f3 2744 //cardSTATE_TO_IDLE();
2745 //LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2746 //break;
2747 //}
d2f487af 2748
2749 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2750
2751 num_to_bytes(ans, 4, rAUTH_AT);
2752 // --- crypto
2753 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2754 LED_C_ON();
2755 cardSTATE = MFEMUL_WORK;
b03c0f2d 2756 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2757 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2758 GetTickCount() - authTimer);
d2f487af 2759 break;
2760 }
50193c1e 2761 case MFEMUL_SELECT2:{
7bc95e2e 2762 if (!len) {
6a1f2d82 2763 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2764 break;
2765 }
8556b852 2766 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
9ca155ba 2767 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
8556b852
M
2768 break;
2769 }
9ca155ba 2770
8556b852
M
2771 // select 2 card
2772 if (len == 9 &&
2773 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2774 EmSendCmd(rSAK, sizeof(rSAK));
8556b852
M
2775 cuid = bytes_to_num(rUIDBCC2, 4);
2776 cardSTATE = MFEMUL_WORK;
2777 LED_B_ON();
0014cb46 2778 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
8556b852
M
2779 break;
2780 }
0014cb46
M
2781
2782 // i guess there is a command). go into the work state.
7bc95e2e 2783 if (len != 4) {
6a1f2d82 2784 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2785 break;
2786 }
0014cb46 2787 cardSTATE = MFEMUL_WORK;
d2f487af 2788 //goto lbWORK;
2789 //intentional fall-through to the next case-stmt
50193c1e 2790 }
51969283 2791
7bc95e2e 2792 case MFEMUL_WORK:{
2793 if (len == 0) {
6a1f2d82 2794 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2795 break;
2796 }
2797
d2f487af 2798 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2799
7bc95e2e 2800 if(encrypted_data) {
51969283
M
2801 // decrypt seqence
2802 mf_crypto1_decrypt(pcs, receivedCmd, len);
d2f487af 2803 }
7bc95e2e 2804
d2f487af 2805 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2806 authTimer = GetTickCount();
2807 cardAUTHSC = receivedCmd[1] / 4; // received block num
2808 cardAUTHKEY = receivedCmd[0] - 0x60;
2809 crypto1_destroy(pcs);//Added by martin
2810 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
51969283 2811
d2f487af 2812 if (!encrypted_data) { // first authentication
b03c0f2d 2813 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
51969283 2814
d2f487af 2815 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2816 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
7bc95e2e 2817 } else { // nested authentication
b03c0f2d 2818 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
7bc95e2e 2819 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
d2f487af 2820 num_to_bytes(ans, 4, rAUTH_AT);
2821 }
0c8d25eb 2822
d2f487af 2823 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2824 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2825 cardSTATE = MFEMUL_AUTH1;
2826 break;
51969283 2827 }
7bc95e2e 2828
8f51ddb0
M
2829 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2830 // BUT... ACK --> NACK
2831 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2832 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2833 break;
2834 }
2835
2836 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2837 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2838 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2839 break;
0a39986e
M
2840 }
2841
7bc95e2e 2842 if(len != 4) {
6a1f2d82 2843 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
7bc95e2e 2844 break;
2845 }
d2f487af 2846
2847 if(receivedCmd[0] == 0x30 // read block
2848 || receivedCmd[0] == 0xA0 // write block
b03c0f2d 2849 || receivedCmd[0] == 0xC0 // inc
2850 || receivedCmd[0] == 0xC1 // dec
2851 || receivedCmd[0] == 0xC2 // restore
7bc95e2e 2852 || receivedCmd[0] == 0xB0) { // transfer
2853 if (receivedCmd[1] >= 16 * 4) {
d2f487af 2854 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
c3c241f3 2855 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2856 break;
2857 }
2858
7bc95e2e 2859 if (receivedCmd[1] / 4 != cardAUTHSC) {
8f51ddb0 2860 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
c3c241f3 2861 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
8f51ddb0
M
2862 break;
2863 }
d2f487af 2864 }
2865 // read block
2866 if (receivedCmd[0] == 0x30) {
b03c0f2d 2867 if (MF_DBGLEVEL >= 4) {
d2f487af 2868 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2869 }
8f51ddb0
M
2870 emlGetMem(response, receivedCmd[1], 1);
2871 AppendCrc14443a(response, 16);
6a1f2d82 2872 mf_crypto1_encrypt(pcs, response, 18, response_par);
2873 EmSendCmdPar(response, 18, response_par);
d2f487af 2874 numReads++;
12d708fe 2875 if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
d2f487af 2876 Dbprintf("%d reads done, exiting", numReads);
2877 finished = true;
2878 }
0a39986e
M
2879 break;
2880 }
0a39986e 2881 // write block
d2f487af 2882 if (receivedCmd[0] == 0xA0) {
b03c0f2d 2883 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
8f51ddb0 2884 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
8f51ddb0
M
2885 cardSTATE = MFEMUL_WRITEBL2;
2886 cardWRBL = receivedCmd[1];
0a39986e 2887 break;
7bc95e2e 2888 }
0014cb46 2889 // increment, decrement, restore
d2f487af 2890 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
b03c0f2d 2891 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2892 if (emlCheckValBl(receivedCmd[1])) {
c3c241f3 2893 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
0014cb46
M
2894 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2895 break;
2896 }
2897 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2898 if (receivedCmd[0] == 0xC1)
2899 cardSTATE = MFEMUL_INTREG_INC;
2900 if (receivedCmd[0] == 0xC0)
2901 cardSTATE = MFEMUL_INTREG_DEC;
2902 if (receivedCmd[0] == 0xC2)
2903 cardSTATE = MFEMUL_INTREG_REST;
2904 cardWRBL = receivedCmd[1];
0014cb46
M
2905 break;
2906 }
0014cb46 2907 // transfer
d2f487af 2908 if (receivedCmd[0] == 0xB0) {
b03c0f2d 2909 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
0014cb46
M
2910 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2911 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2912 else
2913 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
0014cb46
M
2914 break;
2915 }
9ca155ba 2916 // halt
d2f487af 2917 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
9ca155ba 2918 LED_B_OFF();
0a39986e 2919 LED_C_OFF();
0014cb46
M
2920 cardSTATE = MFEMUL_HALTED;
2921 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
6a1f2d82 2922 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0a39986e 2923 break;
9ca155ba 2924 }
d2f487af 2925 // RATS
2926 if (receivedCmd[0] == 0xe0) {//RATS
8f51ddb0
M
2927 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2928 break;
2929 }
d2f487af 2930 // command not allowed
2931 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2932 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
51969283 2933 break;
8f51ddb0
M
2934 }
2935 case MFEMUL_WRITEBL2:{
2936 if (len == 18){
2937 mf_crypto1_decrypt(pcs, receivedCmd, len);
2938 emlSetMem(receivedCmd, cardWRBL, 1);
2939 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2940 cardSTATE = MFEMUL_WORK;
51969283 2941 } else {
0014cb46 2942 cardSTATE_TO_IDLE();
6a1f2d82 2943 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
8f51ddb0 2944 }
8f51ddb0 2945 break;
50193c1e 2946 }
0014cb46
M
2947
2948 case MFEMUL_INTREG_INC:{
2949 mf_crypto1_decrypt(pcs, receivedCmd, len);
2950 memcpy(&ans, receivedCmd, 4);
2951 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2952 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2953 cardSTATE_TO_IDLE();
2954 break;
7bc95e2e 2955 }
6a1f2d82 2956 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2957 cardINTREG = cardINTREG + ans;
2958 cardSTATE = MFEMUL_WORK;
2959 break;
2960 }
2961 case MFEMUL_INTREG_DEC:{
2962 mf_crypto1_decrypt(pcs, receivedCmd, len);
2963 memcpy(&ans, receivedCmd, 4);
2964 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2965 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2966 cardSTATE_TO_IDLE();
2967 break;
2968 }
6a1f2d82 2969 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2970 cardINTREG = cardINTREG - ans;
2971 cardSTATE = MFEMUL_WORK;
2972 break;
2973 }
2974 case MFEMUL_INTREG_REST:{
2975 mf_crypto1_decrypt(pcs, receivedCmd, len);
2976 memcpy(&ans, receivedCmd, 4);
2977 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2978 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2979 cardSTATE_TO_IDLE();
2980 break;
2981 }
6a1f2d82 2982 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
0014cb46
M
2983 cardSTATE = MFEMUL_WORK;
2984 break;
2985 }
50193c1e 2986 }
50193c1e
M
2987 }
2988
9ca155ba
M
2989 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2990 LEDsoff();
2991
d2f487af 2992 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2993 {
2994 //May just aswell send the collected ar_nr in the response aswell
c3c241f3 2995 uint8_t len = ar_nr_collected*5*4;
2996 cmd_send(CMD_ACK, CMD_SIMULATE_MIFARE_CARD, len, 0, &ar_nr_responses, len);
d2f487af 2997 }
d714d3ef 2998
12d708fe 2999 if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
d2f487af 3000 {
12d708fe 3001 if(ar_nr_collected > 1 ) {
d2f487af 3002 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
c3c241f3 3003 Dbprintf("../tools/mfkey/mfkey32 %06x%08x %08x %08x %08x %08x %08x",
3004 ar_nr_responses[0], // UID1
3005 ar_nr_responses[1], // UID2
3006 ar_nr_responses[2], // NT
3007 ar_nr_responses[3], // AR1
3008 ar_nr_responses[4], // NR1
3009 ar_nr_responses[8], // AR2
3010 ar_nr_responses[9] // NR2
d2f487af 3011 );
7838f4be 3012 Dbprintf("../tools/mfkey/mfkey32v2 %06x%08x %08x %08x %08x %08x %08x %08x",
3013 ar_nr_responses[0], // UID1
3014 ar_nr_responses[1], // UID2
3015 ar_nr_responses[2], // NT1
3016 ar_nr_responses[3], // AR1
3017 ar_nr_responses[4], // NR1
3018 ar_nr_responses[7], // NT2
3019 ar_nr_responses[8], // AR2
3020 ar_nr_responses[9] // NR2
3021 );
7bc95e2e 3022 } else {
d2f487af 3023 Dbprintf("Failed to obtain two AR/NR pairs!");
12d708fe 3024 if(ar_nr_collected > 0 ) {
c3c241f3 3025 Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
3026 ar_nr_responses[0], // UID1
3027 ar_nr_responses[1], // UID2
3028 ar_nr_responses[2], // NT
3029 ar_nr_responses[3], // AR1
3030 ar_nr_responses[4] // NR1
d2f487af 3031 );
3032 }
3033 }
3034 }
c3c241f3 3035 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen());
5ee53a0e 3036
3037 set_tracing(FALSE);
15c4dc5a 3038}
b62a5a84 3039
d2f487af 3040
b62a5a84
M
3041//-----------------------------------------------------------------------------
3042// MIFARE sniffer.
3043//
3044//-----------------------------------------------------------------------------
5cd9ec01
M
3045void RAMFUNC SniffMifare(uint8_t param) {
3046 // param:
3047 // bit 0 - trigger from first card answer
3048 // bit 1 - trigger from first reader 7-bit request
39864b0b
M
3049
3050 // C(red) A(yellow) B(green)
b62a5a84
M
3051 LEDsoff();
3052 // init trace buffer
3000dc4e
MHS
3053 clear_trace();
3054 set_tracing(TRUE);
b62a5a84 3055
b62a5a84
M
3056 // The command (reader -> tag) that we're receiving.
3057 // The length of a received command will in most cases be no more than 18 bytes.
3058 // So 32 should be enough!
f71f4deb 3059 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
3060 uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
b62a5a84 3061 // The response (tag -> reader) that we're receiving.
f71f4deb 3062 uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
3063 uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
b62a5a84 3064
99cf19d9 3065 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
3066
3067 // free eventually allocated BigBuf memory
3068 BigBuf_free();
f71f4deb 3069 // allocate the DMA buffer, used to stream samples from the FPGA
3070 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
7bc95e2e 3071 uint8_t *data = dmaBuf;
3072 uint8_t previous_data = 0;
5cd9ec01
M
3073 int maxDataLen = 0;
3074 int dataLen = 0;
7bc95e2e 3075 bool ReaderIsActive = FALSE;
3076 bool TagIsActive = FALSE;
3077
b62a5a84 3078 // Set up the demodulator for tag -> reader responses.
6a1f2d82 3079 DemodInit(receivedResponse, receivedResponsePar);
b62a5a84
M
3080
3081 // Set up the demodulator for the reader -> tag commands
6a1f2d82 3082 UartInit(receivedCmd, receivedCmdPar);
b62a5a84
M
3083
3084 // Setup for the DMA.
7bc95e2e 3085 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
b62a5a84 3086
b62a5a84 3087 LED_D_OFF();
39864b0b
M
3088
3089 // init sniffer
3090 MfSniffInit();
b62a5a84 3091
b62a5a84 3092 // And now we loop, receiving samples.
7bc95e2e 3093 for(uint32_t sniffCounter = 0; TRUE; ) {
3094
5cd9ec01
M
3095 if(BUTTON_PRESS()) {
3096 DbpString("cancelled by button");
7bc95e2e 3097 break;
5cd9ec01
M
3098 }
3099
b62a5a84
M
3100 LED_A_ON();
3101 WDT_HIT();
39864b0b 3102
7bc95e2e 3103 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
3104 // check if a transaction is completed (timeout after 2000ms).
3105 // if yes, stop the DMA transfer and send what we have so far to the client
3106 if (MfSniffSend(2000)) {
3107 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
3108 sniffCounter = 0;
3109 data = dmaBuf;
3110 maxDataLen = 0;
3111 ReaderIsActive = FALSE;
3112 TagIsActive = FALSE;
3113 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
39864b0b 3114 }
39864b0b 3115 }
7bc95e2e 3116
3117 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
3118 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
3119 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
3120 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
3121 } else {
3122 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
5cd9ec01
M
3123 }
3124 // test for length of buffer
7bc95e2e 3125 if(dataLen > maxDataLen) { // we are more behind than ever...
3126 maxDataLen = dataLen;
f71f4deb 3127 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
5cd9ec01 3128 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
7bc95e2e 3129 break;
b62a5a84
M
3130 }
3131 }
5cd9ec01 3132 if(dataLen < 1) continue;
b62a5a84 3133
7bc95e2e 3134 // primary buffer was stopped ( <-- we lost data!
5cd9ec01
M
3135 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
3136 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
3137 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
55acbb2a 3138 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
3139 }
3140 // secondary buffer sets as primary, secondary buffer was stopped
3141 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
3142 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
b62a5a84
M
3143 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
3144 }
5cd9ec01
M
3145
3146 LED_A_OFF();
b62a5a84 3147
7bc95e2e 3148 if (sniffCounter & 0x01) {
b62a5a84 3149
7bc95e2e 3150 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
3151 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
3152 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
3153 LED_C_INV();
6a1f2d82 3154 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
b62a5a84 3155
7bc95e2e 3156 /* And ready to receive another command. */
2d2f7d19 3157 UartReset();
7bc95e2e 3158
3159 /* And also reset the demod code */
3160 DemodReset();
3161 }
3162 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
3163 }
3164
3165 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
3166 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
3167 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
3168 LED_C_INV();
b62a5a84 3169
6a1f2d82 3170 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, FALSE)) break;
39864b0b 3171
7bc95e2e 3172 // And ready to receive another response.
3173 DemodReset();
46c65fed 3174
0ec548dc 3175 // And reset the Miller decoder including its (now outdated) input buffer
3176 UartInit(receivedCmd, receivedCmdPar);
7838f4be 3177 // why not UartReset?
7bc95e2e 3178 }
3179 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
3180 }
b62a5a84
M
3181 }
3182
7bc95e2e 3183 previous_data = *data;
3184 sniffCounter++;
5cd9ec01 3185 data++;
d714d3ef 3186 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01 3187 data = dmaBuf;
b62a5a84 3188 }
7bc95e2e 3189
b62a5a84
M
3190 } // main cycle
3191
55acbb2a 3192 FpgaDisableSscDma();
39864b0b 3193 MfSniffEnd();
b62a5a84 3194 LEDsoff();
7838f4be 3195 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
5ee53a0e 3196 set_tracing(FALSE);
3803d529 3197}
Impressum, Datenschutz