]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/iso14443a.c
FIX: Another try to see if the "lf em4x 410xsim" becomes better, added the clock...
[proxmark3-svn] / armsrc / iso14443a.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
b62a5a84 2// Merlok - June 2011, 2012
15c4dc5a 3// Gerhard de Koning Gans - May 2008
534983d7 4// Hagen Fritsch - June 2010
bd20f8f4 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
15c4dc5a 9//-----------------------------------------------------------------------------
bd20f8f4 10// Routines to support ISO 14443 type A.
11//-----------------------------------------------------------------------------
12
f38a1528 13#include "../include/proxmark3.h"
15c4dc5a 14#include "apps.h"
f7e3ed82 15#include "util.h"
9ab7a6c7 16#include "string.h"
f38a1528 17#include "../common/cmd.h"
18#include "../common/iso14443crc.h"
534983d7 19#include "iso14443a.h"
20f9a2a1
M
20#include "crapto1.h"
21#include "mifareutil.h"
15c4dc5a 22
534983d7 23static uint32_t iso14a_timeout;
d19929cb 24uint8_t *trace = (uint8_t *) BigBuf+TRACE_OFFSET;
1e262141 25int rsamples = 0;
7bc95e2e 26int traceLen = 0;
1e262141 27int tracing = TRUE;
28uint8_t trigger = 0;
b0127e65 29// the block number for the ISO14443-4 PCB
30static uint8_t iso14_pcb_blocknum = 0;
15c4dc5a 31
7bc95e2e 32//
33// ISO14443 timing:
34//
35// minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
36#define REQUEST_GUARD_TIME (7000/16 + 1)
37// minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
38#define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
39// bool LastCommandWasRequest = FALSE;
40
41//
42// Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
43//
d714d3ef 44// When the PM acts as reader and is receiving tag data, it takes
45// 3 ticks delay in the AD converter
46// 16 ticks until the modulation detector completes and sets curbit
47// 8 ticks until bit_to_arm is assigned from curbit
48// 8*16 ticks for the transfer from FPGA to ARM
7bc95e2e 49// 4*16 ticks until we measure the time
50// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 51#define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
7bc95e2e 52
53// When the PM acts as a reader and is sending, it takes
54// 4*16 ticks until we can write data to the sending hold register
55// 8*16 ticks until the SHR is transferred to the Sending Shift Register
56// 8 ticks until the first transfer starts
57// 8 ticks later the FPGA samples the data
58// 1 tick to assign mod_sig_coil
59#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
60
61// When the PM acts as tag and is receiving it takes
d714d3ef 62// 2 ticks delay in the RF part (for the first falling edge),
7bc95e2e 63// 3 ticks for the A/D conversion,
64// 8 ticks on average until the start of the SSC transfer,
65// 8 ticks until the SSC samples the first data
66// 7*16 ticks to complete the transfer from FPGA to ARM
67// 8 ticks until the next ssp_clk rising edge
d714d3ef 68// 4*16 ticks until we measure the time
7bc95e2e 69// - 8*16 ticks because we measure the time of the previous transfer
d714d3ef 70#define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
7bc95e2e 71
72// The FPGA will report its internal sending delay in
73uint16_t FpgaSendQueueDelay;
74// the 5 first bits are the number of bits buffered in mod_sig_buf
75// the last three bits are the remaining ticks/2 after the mod_sig_buf shift
76#define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
77
78// When the PM acts as tag and is sending, it takes
d714d3ef 79// 4*16 ticks until we can write data to the sending hold register
7bc95e2e 80// 8*16 ticks until the SHR is transferred to the Sending Shift Register
81// 8 ticks until the first transfer starts
82// 8 ticks later the FPGA samples the data
83// + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
84// + 1 tick to assign mod_sig_coil
d714d3ef 85#define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
7bc95e2e 86
87// When the PM acts as sniffer and is receiving tag data, it takes
88// 3 ticks A/D conversion
d714d3ef 89// 14 ticks to complete the modulation detection
90// 8 ticks (on average) until the result is stored in to_arm
7bc95e2e 91// + the delays in transferring data - which is the same for
92// sniffing reader and tag data and therefore not relevant
d714d3ef 93#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
7bc95e2e 94
d714d3ef 95// When the PM acts as sniffer and is receiving reader data, it takes
96// 2 ticks delay in analogue RF receiver (for the falling edge of the
97// start bit, which marks the start of the communication)
7bc95e2e 98// 3 ticks A/D conversion
d714d3ef 99// 8 ticks on average until the data is stored in to_arm.
7bc95e2e 100// + the delays in transferring data - which is the same for
101// sniffing reader and tag data and therefore not relevant
d714d3ef 102#define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
7bc95e2e 103
104//variables used for timing purposes:
105//these are in ssp_clk cycles:
106uint32_t NextTransferTime;
107uint32_t LastTimeProxToAirStart;
108uint32_t LastProxToAirDuration;
109
110
111
8f51ddb0 112// CARD TO READER - manchester
72934aa3 113// Sequence D: 11110000 modulation with subcarrier during first half
114// Sequence E: 00001111 modulation with subcarrier during second half
115// Sequence F: 00000000 no modulation with subcarrier
8f51ddb0 116// READER TO CARD - miller
72934aa3 117// Sequence X: 00001100 drop after half a period
118// Sequence Y: 00000000 no drop
119// Sequence Z: 11000000 drop at start
120#define SEC_D 0xf0
121#define SEC_E 0x0f
122#define SEC_F 0x00
123#define SEC_X 0x0c
124#define SEC_Y 0x00
125#define SEC_Z 0xc0
15c4dc5a 126
1e262141 127const uint8_t OddByteParity[256] = {
15c4dc5a 128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
141 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
142 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
143 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
144};
145
1e262141 146
902cb3c0 147void iso14a_set_trigger(bool enable) {
534983d7 148 trigger = enable;
149}
150
902cb3c0 151void iso14a_clear_trace() {
7bc95e2e 152 memset(trace, 0x44, TRACE_SIZE);
8556b852
M
153 traceLen = 0;
154}
d19929cb 155
902cb3c0 156void iso14a_set_tracing(bool enable) {
8556b852
M
157 tracing = enable;
158}
d19929cb 159
b0127e65 160void iso14a_set_timeout(uint32_t timeout) {
161 iso14a_timeout = timeout;
162}
8556b852 163
15c4dc5a 164//-----------------------------------------------------------------------------
165// Generate the parity value for a byte sequence
e30c654b 166//
15c4dc5a 167//-----------------------------------------------------------------------------
20f9a2a1
M
168byte_t oddparity (const byte_t bt)
169{
5f6d6c90 170 return OddByteParity[bt];
20f9a2a1
M
171}
172
f7e3ed82 173uint32_t GetParity(const uint8_t * pbtCmd, int iLen)
15c4dc5a 174{
5f6d6c90 175 int i;
176 uint32_t dwPar = 0;
72934aa3 177
e691fc45 178 // Generate the parity bits
5f6d6c90 179 for (i = 0; i < iLen; i++) {
e691fc45 180 // and save them to a 32Bit word
5f6d6c90 181 dwPar |= ((OddByteParity[pbtCmd[i]]) << i);
182 }
183 return dwPar;
15c4dc5a 184}
185
534983d7 186void AppendCrc14443a(uint8_t* data, int len)
15c4dc5a 187{
5f6d6c90 188 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
15c4dc5a 189}
190
1e262141 191// The function LogTrace() is also used by the iClass implementation in iClass.c
17cba269 192bool RAMFUNC LogTrace(const uint8_t * btBytes, uint8_t iLen, uint32_t timestamp, uint32_t dwParity, bool readerToTag)
15c4dc5a 193{
fdcd43eb 194 if (!tracing) return FALSE;
7bc95e2e 195 // Return when trace is full
196 if (traceLen + sizeof(timestamp) + sizeof(dwParity) + iLen >= TRACE_SIZE) {
197 tracing = FALSE; // don't trace any more
198 return FALSE;
199 }
200
201 // Trace the random, i'm curious
202 trace[traceLen++] = ((timestamp >> 0) & 0xff);
203 trace[traceLen++] = ((timestamp >> 8) & 0xff);
204 trace[traceLen++] = ((timestamp >> 16) & 0xff);
205 trace[traceLen++] = ((timestamp >> 24) & 0xff);
17cba269
MHS
206
207 if (!readerToTag) {
7bc95e2e 208 trace[traceLen - 1] |= 0x80;
209 }
210 trace[traceLen++] = ((dwParity >> 0) & 0xff);
211 trace[traceLen++] = ((dwParity >> 8) & 0xff);
212 trace[traceLen++] = ((dwParity >> 16) & 0xff);
213 trace[traceLen++] = ((dwParity >> 24) & 0xff);
214 trace[traceLen++] = iLen;
215 if (btBytes != NULL && iLen != 0) {
216 memcpy(trace + traceLen, btBytes, iLen);
217 }
218 traceLen += iLen;
219 return TRUE;
15c4dc5a 220}
221
7bc95e2e 222//=============================================================================
223// ISO 14443 Type A - Miller decoder
224//=============================================================================
225// Basics:
226// This decoder is used when the PM3 acts as a tag.
227// The reader will generate "pauses" by temporarily switching of the field.
228// At the PM3 antenna we will therefore measure a modulated antenna voltage.
229// The FPGA does a comparison with a threshold and would deliver e.g.:
230// ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
231// The Miller decoder needs to identify the following sequences:
232// 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
233// 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
234// 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
235// Note 1: the bitstream may start at any time. We therefore need to sync.
236// Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
15c4dc5a 237//-----------------------------------------------------------------------------
b62a5a84 238static tUart Uart;
15c4dc5a 239
d7aa3739 240// Lookup-Table to decide if 4 raw bits are a modulation.
241// We accept two or three consecutive "0" in any position with the rest "1"
242const bool Mod_Miller_LUT[] = {
243 TRUE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, FALSE,
244 TRUE, TRUE, FALSE, FALSE, TRUE, FALSE, FALSE, FALSE
245};
246#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x00F0) >> 4])
247#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x000F)])
248
7bc95e2e 249void UartReset()
15c4dc5a 250{
7bc95e2e 251 Uart.state = STATE_UNSYNCD;
252 Uart.bitCount = 0;
253 Uart.len = 0; // number of decoded data bytes
254 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
255 Uart.parityBits = 0; //
256 Uart.twoBits = 0x0000; // buffer for 2 Bits
257 Uart.highCnt = 0;
258 Uart.startTime = 0;
259 Uart.endTime = 0;
260}
15c4dc5a 261
d714d3ef 262
7bc95e2e 263// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
264static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
265{
15c4dc5a 266
7bc95e2e 267 Uart.twoBits = (Uart.twoBits << 8) | bit;
268
269 if (Uart.state == STATE_UNSYNCD) { // not yet synced
270 if (Uart.highCnt < 7) { // wait for a stable unmodulated signal
271 if (Uart.twoBits == 0xffff) {
272 Uart.highCnt++;
273 } else {
274 Uart.highCnt = 0;
15c4dc5a 275 }
7bc95e2e 276 } else {
277 Uart.syncBit = 0xFFFF; // not set
278 // look for 00xx1111 (the start bit)
279 if ((Uart.twoBits & 0x6780) == 0x0780) Uart.syncBit = 7;
280 else if ((Uart.twoBits & 0x33C0) == 0x03C0) Uart.syncBit = 6;
281 else if ((Uart.twoBits & 0x19E0) == 0x01E0) Uart.syncBit = 5;
282 else if ((Uart.twoBits & 0x0CF0) == 0x00F0) Uart.syncBit = 4;
283 else if ((Uart.twoBits & 0x0678) == 0x0078) Uart.syncBit = 3;
284 else if ((Uart.twoBits & 0x033C) == 0x003C) Uart.syncBit = 2;
285 else if ((Uart.twoBits & 0x019E) == 0x001E) Uart.syncBit = 1;
286 else if ((Uart.twoBits & 0x00CF) == 0x000F) Uart.syncBit = 0;
287 if (Uart.syncBit != 0xFFFF) {
288 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
289 Uart.startTime -= Uart.syncBit;
d7aa3739 290 Uart.endTime = Uart.startTime;
7bc95e2e 291 Uart.state = STATE_START_OF_COMMUNICATION;
15c4dc5a 292 }
7bc95e2e 293 }
15c4dc5a 294
7bc95e2e 295 } else {
15c4dc5a 296
d7aa3739 297 if (IsMillerModulationNibble1(Uart.twoBits >> Uart.syncBit)) {
298 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation in both halves - error
299 UartReset();
300 Uart.highCnt = 6;
301 } else { // Modulation in first half = Sequence Z = logic "0"
7bc95e2e 302 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
303 UartReset();
304 Uart.highCnt = 6;
305 } else {
306 Uart.bitCount++;
307 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
308 Uart.state = STATE_MILLER_Z;
309 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
310 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
311 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
312 Uart.parityBits <<= 1; // make room for the parity bit
313 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
314 Uart.bitCount = 0;
315 Uart.shiftReg = 0;
15c4dc5a 316 }
7bc95e2e 317 }
d7aa3739 318 }
319 } else {
320 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
7bc95e2e 321 Uart.bitCount++;
322 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
323 Uart.state = STATE_MILLER_X;
324 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
325 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
326 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
327 Uart.parityBits <<= 1; // make room for the new parity bit
328 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
329 Uart.bitCount = 0;
330 Uart.shiftReg = 0;
331 }
d7aa3739 332 } else { // no modulation in both halves - Sequence Y
7bc95e2e 333 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
15c4dc5a 334 Uart.state = STATE_UNSYNCD;
7bc95e2e 335 if(Uart.len == 0 && Uart.bitCount > 0) { // if we decoded some bits
336 Uart.shiftReg >>= (9 - Uart.bitCount); // add them to the output
337 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
338 Uart.parityBits <<= 1; // no parity bit - add "0"
d7aa3739 339 Uart.bitCount--; // last "0" was part of the EOC sequence
7bc95e2e 340 }
15c4dc5a 341 return TRUE;
342 }
7bc95e2e 343 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
344 UartReset();
345 Uart.highCnt = 6;
346 } else { // a logic "0"
347 Uart.bitCount++;
348 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
349 Uart.state = STATE_MILLER_Y;
350 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
351 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
352 Uart.parityBits <<= 1; // make room for the parity bit
353 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
354 Uart.bitCount = 0;
355 Uart.shiftReg = 0;
15c4dc5a 356 }
357 }
d7aa3739 358 }
15c4dc5a 359 }
7bc95e2e 360
361 }
15c4dc5a 362
7bc95e2e 363 return FALSE; // not finished yet, need more data
15c4dc5a 364}
365
7bc95e2e 366
367
15c4dc5a 368//=============================================================================
e691fc45 369// ISO 14443 Type A - Manchester decoder
15c4dc5a 370//=============================================================================
e691fc45 371// Basics:
7bc95e2e 372// This decoder is used when the PM3 acts as a reader.
e691fc45 373// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
374// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
375// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
376// The Manchester decoder needs to identify the following sequences:
377// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
378// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
379// 8 ticks unmodulated: Sequence F = end of communication
380// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
7bc95e2e 381// Note 1: the bitstream may start at any time. We therefore need to sync.
e691fc45 382// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
b62a5a84 383static tDemod Demod;
15c4dc5a 384
d7aa3739 385// Lookup-Table to decide if 4 raw bits are a modulation.
d714d3ef 386// We accept three or four "1" in any position
7bc95e2e 387const bool Mod_Manchester_LUT[] = {
d7aa3739 388 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
d714d3ef 389 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
7bc95e2e 390};
391
392#define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
393#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
15c4dc5a 394
2f2d9fc5 395
7bc95e2e 396void DemodReset()
e691fc45 397{
7bc95e2e 398 Demod.state = DEMOD_UNSYNCD;
399 Demod.len = 0; // number of decoded data bytes
400 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
401 Demod.parityBits = 0; //
402 Demod.collisionPos = 0; // Position of collision bit
403 Demod.twoBits = 0xffff; // buffer for 2 Bits
404 Demod.highCnt = 0;
405 Demod.startTime = 0;
406 Demod.endTime = 0;
e691fc45 407}
15c4dc5a 408
7bc95e2e 409// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
410static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
e691fc45 411{
7bc95e2e 412
413 Demod.twoBits = (Demod.twoBits << 8) | bit;
e691fc45 414
7bc95e2e 415 if (Demod.state == DEMOD_UNSYNCD) {
416
417 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
418 if (Demod.twoBits == 0x0000) {
419 Demod.highCnt++;
420 } else {
421 Demod.highCnt = 0;
422 }
423 } else {
424 Demod.syncBit = 0xFFFF; // not set
425 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
426 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
427 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
428 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
429 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
430 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
431 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
432 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
d7aa3739 433 if (Demod.syncBit != 0xFFFF) {
7bc95e2e 434 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
435 Demod.startTime -= Demod.syncBit;
436 Demod.bitCount = offset; // number of decoded data bits
e691fc45 437 Demod.state = DEMOD_MANCHESTER_DATA;
2f2d9fc5 438 }
7bc95e2e 439 }
15c4dc5a 440
7bc95e2e 441 } else {
15c4dc5a 442
7bc95e2e 443 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
444 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
e691fc45 445 if (!Demod.collisionPos) {
446 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
447 }
448 } // modulation in first half only - Sequence D = 1
7bc95e2e 449 Demod.bitCount++;
450 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
451 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
e691fc45 452 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 453 Demod.parityBits <<= 1; // make room for the parity bit
e691fc45 454 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
455 Demod.bitCount = 0;
456 Demod.shiftReg = 0;
15c4dc5a 457 }
7bc95e2e 458 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
459 } else { // no modulation in first half
460 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
e691fc45 461 Demod.bitCount++;
7bc95e2e 462 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
e691fc45 463 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
e691fc45 464 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
7bc95e2e 465 Demod.parityBits <<= 1; // make room for the new parity bit
e691fc45 466 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
467 Demod.bitCount = 0;
468 Demod.shiftReg = 0;
15c4dc5a 469 }
7bc95e2e 470 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
e691fc45 471 } else { // no modulation in both halves - End of communication
d7aa3739 472 if (Demod.len > 0 || Demod.bitCount > 0) { // received something
473 if(Demod.bitCount > 0) { // if we decoded bits
474 Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
475 Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
476 // No parity bit, so just shift a 0
477 Demod.parityBits <<= 1;
478 }
479 return TRUE; // we are finished with decoding the raw data sequence
480 } else { // nothing received. Start over
481 DemodReset();
e691fc45 482 }
15c4dc5a 483 }
7bc95e2e 484 }
e691fc45 485
486 }
15c4dc5a 487
e691fc45 488 return FALSE; // not finished yet, need more data
15c4dc5a 489}
490
491//=============================================================================
492// Finally, a `sniffer' for ISO 14443 Type A
493// Both sides of communication!
494//=============================================================================
495
496//-----------------------------------------------------------------------------
497// Record the sequence of commands sent by the reader to the tag, with
498// triggering so that we start recording at the point that the tag is moved
499// near the reader.
500//-----------------------------------------------------------------------------
5cd9ec01
M
501void RAMFUNC SnoopIso14443a(uint8_t param) {
502 // param:
503 // bit 0 - trigger from first card answer
504 // bit 1 - trigger from first reader 7-bit request
505
506 LEDsoff();
507 // init trace buffer
5f6d6c90 508 iso14a_clear_trace();
991f13f2 509 iso14a_set_tracing(TRUE);
5cd9ec01
M
510
511 // We won't start recording the frames that we acquire until we trigger;
512 // a good trigger condition to get started is probably when we see a
513 // response from the tag.
514 // triggered == FALSE -- to wait first for card
7bc95e2e 515 bool triggered = !(param & 0x03);
516
5cd9ec01 517 // The command (reader -> tag) that we're receiving.
15c4dc5a 518 // The length of a received command will in most cases be no more than 18 bytes.
519 // So 32 should be enough!
5cd9ec01
M
520 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
521 // The response (tag -> reader) that we're receiving.
522 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
15c4dc5a 523
5cd9ec01
M
524 // As we receive stuff, we copy it from receivedCmd or receivedResponse
525 // into trace, along with its length and other annotations.
526 //uint8_t *trace = (uint8_t *)BigBuf;
527
528 // The DMA buffer, used to stream samples from the FPGA
7bc95e2e 529 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
530 uint8_t *data = dmaBuf;
531 uint8_t previous_data = 0;
5cd9ec01
M
532 int maxDataLen = 0;
533 int dataLen = 0;
7bc95e2e 534 bool TagIsActive = FALSE;
535 bool ReaderIsActive = FALSE;
536
537 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
15c4dc5a 538
5cd9ec01
M
539 // Set up the demodulator for tag -> reader responses.
540 Demod.output = receivedResponse;
15c4dc5a 541
5cd9ec01 542 // Set up the demodulator for the reader -> tag commands
5cd9ec01 543 Uart.output = receivedCmd;
15c4dc5a 544
7bc95e2e 545 // Setup and start DMA.
5cd9ec01 546 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
7bc95e2e 547
5cd9ec01 548 // And now we loop, receiving samples.
7bc95e2e 549 for(uint32_t rsamples = 0; TRUE; ) {
550
5cd9ec01
M
551 if(BUTTON_PRESS()) {
552 DbpString("cancelled by button");
7bc95e2e 553 break;
5cd9ec01 554 }
15c4dc5a 555
5cd9ec01
M
556 LED_A_ON();
557 WDT_HIT();
15c4dc5a 558
5cd9ec01
M
559 int register readBufDataP = data - dmaBuf;
560 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
561 if (readBufDataP <= dmaBufDataP){
562 dataLen = dmaBufDataP - readBufDataP;
563 } else {
7bc95e2e 564 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
5cd9ec01
M
565 }
566 // test for length of buffer
567 if(dataLen > maxDataLen) {
568 maxDataLen = dataLen;
569 if(dataLen > 400) {
7bc95e2e 570 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
571 break;
5cd9ec01
M
572 }
573 }
574 if(dataLen < 1) continue;
575
576 // primary buffer was stopped( <-- we lost data!
577 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
578 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
579 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
7bc95e2e 580 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
581 }
582 // secondary buffer sets as primary, secondary buffer was stopped
583 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
584 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
585 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
586 }
587
588 LED_A_OFF();
7bc95e2e 589
590 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
3be2a5ae 591
7bc95e2e 592 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
593 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
594 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
595 LED_C_ON();
5cd9ec01 596
7bc95e2e 597 // check - if there is a short 7bit request from reader
598 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
5cd9ec01 599
7bc95e2e 600 if(triggered) {
601 if (!LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, Uart.parityBits, TRUE)) break;
602 if (!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
603 }
604 /* And ready to receive another command. */
605 UartReset();
606 /* And also reset the demod code, which might have been */
607 /* false-triggered by the commands from the reader. */
608 DemodReset();
609 LED_B_OFF();
610 }
611 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
5cd9ec01 612 }
3be2a5ae 613
7bc95e2e 614 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
615 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
616 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
617 LED_B_ON();
5cd9ec01 618
7bc95e2e 619 if (!LogTrace(receivedResponse, Demod.len, Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, Demod.parityBits, FALSE)) break;
620 if (!LogTrace(NULL, 0, Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, 0, FALSE)) break;
5cd9ec01 621
7bc95e2e 622 if ((!triggered) && (param & 0x01)) triggered = TRUE;
5cd9ec01 623
7bc95e2e 624 // And ready to receive another response.
625 DemodReset();
626 LED_C_OFF();
627 }
628 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
629 }
5cd9ec01
M
630 }
631
7bc95e2e 632 previous_data = *data;
633 rsamples++;
5cd9ec01 634 data++;
d714d3ef 635 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01
M
636 data = dmaBuf;
637 }
638 } // main cycle
639
640 DbpString("COMMAND FINISHED");
15c4dc5a 641
7bc95e2e 642 FpgaDisableSscDma();
643 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
644 Dbprintf("traceLen=%d, Uart.output[0]=%08x", traceLen, (uint32_t)Uart.output[0]);
5cd9ec01 645 LEDsoff();
15c4dc5a 646}
647
15c4dc5a 648//-----------------------------------------------------------------------------
649// Prepare tag messages
650//-----------------------------------------------------------------------------
8f51ddb0 651static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity)
15c4dc5a 652{
8f51ddb0 653 int i;
15c4dc5a 654
8f51ddb0 655 ToSendReset();
15c4dc5a 656
657 // Correction bit, might be removed when not needed
658 ToSendStuffBit(0);
659 ToSendStuffBit(0);
660 ToSendStuffBit(0);
661 ToSendStuffBit(0);
662 ToSendStuffBit(1); // 1
663 ToSendStuffBit(0);
664 ToSendStuffBit(0);
665 ToSendStuffBit(0);
8f51ddb0 666
15c4dc5a 667 // Send startbit
72934aa3 668 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 669 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 670
8f51ddb0
M
671 for(i = 0; i < len; i++) {
672 int j;
673 uint8_t b = cmd[i];
15c4dc5a 674
675 // Data bits
15c4dc5a 676 for(j = 0; j < 8; j++) {
15c4dc5a 677 if(b & 1) {
72934aa3 678 ToSend[++ToSendMax] = SEC_D;
15c4dc5a 679 } else {
72934aa3 680 ToSend[++ToSendMax] = SEC_E;
8f51ddb0
M
681 }
682 b >>= 1;
683 }
15c4dc5a 684
0014cb46 685 // Get the parity bit
8f51ddb0
M
686 if ((dwParity >> i) & 0x01) {
687 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 688 LastProxToAirDuration = 8 * ToSendMax - 4;
15c4dc5a 689 } else {
72934aa3 690 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 691 LastProxToAirDuration = 8 * ToSendMax;
15c4dc5a 692 }
8f51ddb0 693 }
15c4dc5a 694
8f51ddb0
M
695 // Send stopbit
696 ToSend[++ToSendMax] = SEC_F;
15c4dc5a 697
8f51ddb0
M
698 // Convert from last byte pos to length
699 ToSendMax++;
8f51ddb0
M
700}
701
702static void CodeIso14443aAsTag(const uint8_t *cmd, int len){
703 CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len));
15c4dc5a 704}
705
15c4dc5a 706
8f51ddb0
M
707static void Code4bitAnswerAsTag(uint8_t cmd)
708{
709 int i;
710
5f6d6c90 711 ToSendReset();
8f51ddb0
M
712
713 // Correction bit, might be removed when not needed
714 ToSendStuffBit(0);
715 ToSendStuffBit(0);
716 ToSendStuffBit(0);
717 ToSendStuffBit(0);
718 ToSendStuffBit(1); // 1
719 ToSendStuffBit(0);
720 ToSendStuffBit(0);
721 ToSendStuffBit(0);
722
723 // Send startbit
724 ToSend[++ToSendMax] = SEC_D;
725
726 uint8_t b = cmd;
727 for(i = 0; i < 4; i++) {
728 if(b & 1) {
729 ToSend[++ToSendMax] = SEC_D;
7bc95e2e 730 LastProxToAirDuration = 8 * ToSendMax - 4;
8f51ddb0
M
731 } else {
732 ToSend[++ToSendMax] = SEC_E;
7bc95e2e 733 LastProxToAirDuration = 8 * ToSendMax;
8f51ddb0
M
734 }
735 b >>= 1;
736 }
737
738 // Send stopbit
739 ToSend[++ToSendMax] = SEC_F;
740
5f6d6c90 741 // Convert from last byte pos to length
742 ToSendMax++;
15c4dc5a 743}
744
745//-----------------------------------------------------------------------------
746// Wait for commands from reader
747// Stop when button is pressed
748// Or return TRUE when command is captured
749//-----------------------------------------------------------------------------
f7e3ed82 750static int GetIso14443aCommandFromReader(uint8_t *received, int *len, int maxLen)
15c4dc5a 751{
752 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
753 // only, since we are receiving, not transmitting).
754 // Signal field is off with the appropriate LED
755 LED_D_OFF();
756 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
757
758 // Now run a `software UART' on the stream of incoming samples.
7bc95e2e 759 UartReset();
15c4dc5a 760 Uart.output = received;
7bc95e2e 761
762 // clear RXRDY:
763 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 764
765 for(;;) {
766 WDT_HIT();
767
768 if(BUTTON_PRESS()) return FALSE;
7bc95e2e 769
15c4dc5a 770 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
7bc95e2e 771 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
772 if(MillerDecoding(b, 0)) {
773 *len = Uart.len;
15c4dc5a 774 return TRUE;
775 }
7bc95e2e 776 }
15c4dc5a 777 }
778}
28afbd2b 779
7bc95e2e 780static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded);
781int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
28afbd2b 782int EmSend4bit(uint8_t resp);
7bc95e2e 783int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
784int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
785int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded);
28afbd2b 786int EmSendCmd(uint8_t *resp, int respLen);
787int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par);
7bc95e2e 788bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
789 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity);
15c4dc5a 790
ce02f6f9 791static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
792
793typedef struct {
794 uint8_t* response;
795 size_t response_n;
796 uint8_t* modulation;
797 size_t modulation_n;
7bc95e2e 798 uint32_t ProxToAirDuration;
ce02f6f9 799} tag_response_info_t;
800
801void reset_free_buffer() {
802 free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
803}
804
805bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
7bc95e2e 806 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
ce02f6f9 807 // This will need the following byte array for a modulation sequence
808 // 144 data bits (18 * 8)
809 // 18 parity bits
810 // 2 Start and stop
811 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
812 // 1 just for the case
813 // ----------- +
814 // 166 bytes, since every bit that needs to be send costs us a byte
815 //
816
817 // Prepare the tag modulation bits from the message
818 CodeIso14443aAsTag(response_info->response,response_info->response_n);
819
820 // Make sure we do not exceed the free buffer space
821 if (ToSendMax > max_buffer_size) {
822 Dbprintf("Out of memory, when modulating bits for tag answer:");
823 Dbhexdump(response_info->response_n,response_info->response,false);
824 return false;
825 }
826
827 // Copy the byte array, used for this modulation to the buffer position
828 memcpy(response_info->modulation,ToSend,ToSendMax);
829
7bc95e2e 830 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
ce02f6f9 831 response_info->modulation_n = ToSendMax;
7bc95e2e 832 response_info->ProxToAirDuration = LastProxToAirDuration;
ce02f6f9 833
834 return true;
835}
836
837bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
838 // Retrieve and store the current buffer index
839 response_info->modulation = free_buffer_pointer;
840
841 // Determine the maximum size we can use from our buffer
842 size_t max_buffer_size = (((uint8_t *)BigBuf)+FREE_BUFFER_OFFSET+FREE_BUFFER_SIZE)-free_buffer_pointer;
843
844 // Forward the prepare tag modulation function to the inner function
845 if (prepare_tag_modulation(response_info,max_buffer_size)) {
846 // Update the free buffer offset
847 free_buffer_pointer += ToSendMax;
848 return true;
849 } else {
850 return false;
851 }
852}
853
15c4dc5a 854//-----------------------------------------------------------------------------
855// Main loop of simulated tag: receive commands from reader, decide what
856// response to send, and send it.
857//-----------------------------------------------------------------------------
28afbd2b 858void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
15c4dc5a 859{
5f6d6c90 860 // Enable and clear the trace
5f6d6c90 861 iso14a_clear_trace();
7bc95e2e 862 iso14a_set_tracing(TRUE);
81cd0474 863
81cd0474 864 uint8_t sak;
865
866 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
867 uint8_t response1[2];
868
869 switch (tagType) {
870 case 1: { // MIFARE Classic
871 // Says: I am Mifare 1k - original line
872 response1[0] = 0x04;
873 response1[1] = 0x00;
874 sak = 0x08;
875 } break;
876 case 2: { // MIFARE Ultralight
877 // Says: I am a stupid memory tag, no crypto
878 response1[0] = 0x04;
879 response1[1] = 0x00;
880 sak = 0x00;
881 } break;
882 case 3: { // MIFARE DESFire
883 // Says: I am a DESFire tag, ph33r me
884 response1[0] = 0x04;
885 response1[1] = 0x03;
886 sak = 0x20;
887 } break;
888 case 4: { // ISO/IEC 14443-4
889 // Says: I am a javacard (JCOP)
890 response1[0] = 0x04;
891 response1[1] = 0x00;
892 sak = 0x28;
893 } break;
894 default: {
895 Dbprintf("Error: unkown tagtype (%d)",tagType);
896 return;
897 } break;
898 }
899
900 // The second response contains the (mandatory) first 24 bits of the UID
901 uint8_t response2[5];
902
903 // Check if the uid uses the (optional) part
904 uint8_t response2a[5];
905 if (uid_2nd) {
906 response2[0] = 0x88;
907 num_to_bytes(uid_1st,3,response2+1);
908 num_to_bytes(uid_2nd,4,response2a);
909 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
910
911 // Configure the ATQA and SAK accordingly
912 response1[0] |= 0x40;
913 sak |= 0x04;
914 } else {
915 num_to_bytes(uid_1st,4,response2);
916 // Configure the ATQA and SAK accordingly
917 response1[0] &= 0xBF;
918 sak &= 0xFB;
919 }
920
921 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
922 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
923
924 // Prepare the mandatory SAK (for 4 and 7 byte UID)
925 uint8_t response3[3];
926 response3[0] = sak;
927 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
928
929 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
930 uint8_t response3a[3];
931 response3a[0] = sak & 0xFB;
932 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
933
254b70a4 934 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
ce02f6f9 935 uint8_t response6[] = { 0x04, 0x58, 0x00, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS
936 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
937
7bc95e2e 938 #define TAG_RESPONSE_COUNT 7
939 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
940 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
941 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
942 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
943 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
944 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
945 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
946 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
947 };
948
949 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
950 // Such a response is less time critical, so we can prepare them on the fly
951 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
952 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
953 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
954 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
955 tag_response_info_t dynamic_response_info = {
956 .response = dynamic_response_buffer,
957 .response_n = 0,
958 .modulation = dynamic_modulation_buffer,
959 .modulation_n = 0
960 };
ce02f6f9 961
7bc95e2e 962 // Reset the offset pointer of the free buffer
963 reset_free_buffer();
ce02f6f9 964
7bc95e2e 965 // Prepare the responses of the anticollision phase
ce02f6f9 966 // there will be not enough time to do this at the moment the reader sends it REQA
7bc95e2e 967 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
968 prepare_allocated_tag_modulation(&responses[i]);
969 }
15c4dc5a 970
254b70a4 971 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
7bc95e2e 972 int len = 0;
15c4dc5a 973
974 // To control where we are in the protocol
975 int order = 0;
976 int lastorder;
977
978 // Just to allow some checks
979 int happened = 0;
980 int happened2 = 0;
81cd0474 981 int cmdsRecvd = 0;
15c4dc5a 982
254b70a4 983 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 984 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
15c4dc5a 985
254b70a4 986 cmdsRecvd = 0;
7bc95e2e 987 tag_response_info_t* p_response;
15c4dc5a 988
254b70a4 989 LED_A_ON();
990 for(;;) {
7bc95e2e 991 // Clean receive command buffer
992
81cd0474 993 if(!GetIso14443aCommandFromReader(receivedCmd, &len, RECV_CMD_SIZE)) {
ce02f6f9 994 DbpString("Button press");
254b70a4 995 break;
996 }
7bc95e2e 997
998 p_response = NULL;
999
254b70a4 1000 // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
1001 // Okay, look at the command now.
1002 lastorder = order;
1003 if(receivedCmd[0] == 0x26) { // Received a REQUEST
ce02f6f9 1004 p_response = &responses[0]; order = 1;
254b70a4 1005 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
ce02f6f9 1006 p_response = &responses[0]; order = 6;
254b70a4 1007 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
ce02f6f9 1008 p_response = &responses[1]; order = 2;
254b70a4 1009 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
ce02f6f9 1010 p_response = &responses[2]; order = 20;
254b70a4 1011 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
ce02f6f9 1012 p_response = &responses[3]; order = 3;
254b70a4 1013 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
ce02f6f9 1014 p_response = &responses[4]; order = 30;
254b70a4 1015 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
5f6d6c90 1016 EmSendCmdEx(data+(4*receivedCmd[0]),16,false);
7bc95e2e 1017 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
5f6d6c90 1018 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
7bc95e2e 1019 p_response = NULL;
254b70a4 1020 } else if(receivedCmd[0] == 0x50) { // Received a HALT
17331e14 1021// DbpString("Reader requested we HALT!:");
7bc95e2e 1022 if (tracing) {
1023 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1024 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1025 }
1026 p_response = NULL;
254b70a4 1027 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
ce02f6f9 1028 p_response = &responses[5]; order = 7;
254b70a4 1029 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
7bc95e2e 1030 if (tagType == 1 || tagType == 2) { // RATS not supported
1031 EmSend4bit(CARD_NACK_NA);
1032 p_response = NULL;
1033 } else {
1034 p_response = &responses[6]; order = 70;
1035 }
1036 } else if (order == 7 && len == 8) { // Received authentication request
1037 if (tracing) {
1038 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1039 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1040 }
1041 uint32_t nr = bytes_to_num(receivedCmd,4);
1042 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1043 Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr,ar);
1044 } else {
1045 // Check for ISO 14443A-4 compliant commands, look at left nibble
1046 switch (receivedCmd[0]) {
1047
1048 case 0x0B:
1049 case 0x0A: { // IBlock (command)
1050 dynamic_response_info.response[0] = receivedCmd[0];
1051 dynamic_response_info.response[1] = 0x00;
1052 dynamic_response_info.response[2] = 0x90;
1053 dynamic_response_info.response[3] = 0x00;
1054 dynamic_response_info.response_n = 4;
1055 } break;
1056
1057 case 0x1A:
1058 case 0x1B: { // Chaining command
1059 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1060 dynamic_response_info.response_n = 2;
1061 } break;
1062
1063 case 0xaa:
1064 case 0xbb: {
1065 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1066 dynamic_response_info.response_n = 2;
1067 } break;
1068
1069 case 0xBA: { //
1070 memcpy(dynamic_response_info.response,"\xAB\x00",2);
1071 dynamic_response_info.response_n = 2;
1072 } break;
1073
1074 case 0xCA:
1075 case 0xC2: { // Readers sends deselect command
1076 memcpy(dynamic_response_info.response,"\xCA\x00",2);
1077 dynamic_response_info.response_n = 2;
1078 } break;
1079
1080 default: {
1081 // Never seen this command before
1082 if (tracing) {
1083 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1084 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1085 }
1086 Dbprintf("Received unknown command (len=%d):",len);
1087 Dbhexdump(len,receivedCmd,false);
1088 // Do not respond
1089 dynamic_response_info.response_n = 0;
1090 } break;
1091 }
ce02f6f9 1092
7bc95e2e 1093 if (dynamic_response_info.response_n > 0) {
1094 // Copy the CID from the reader query
1095 dynamic_response_info.response[1] = receivedCmd[1];
ce02f6f9 1096
7bc95e2e 1097 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1098 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1099 dynamic_response_info.response_n += 2;
ce02f6f9 1100
7bc95e2e 1101 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1102 Dbprintf("Error preparing tag response");
1103 if (tracing) {
1104 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
1105 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
1106 }
1107 break;
1108 }
1109 p_response = &dynamic_response_info;
1110 }
81cd0474 1111 }
15c4dc5a 1112
1113 // Count number of wakeups received after a halt
1114 if(order == 6 && lastorder == 5) { happened++; }
1115
1116 // Count number of other messages after a halt
1117 if(order != 6 && lastorder == 5) { happened2++; }
1118
15c4dc5a 1119 if(cmdsRecvd > 999) {
1120 DbpString("1000 commands later...");
254b70a4 1121 break;
15c4dc5a 1122 }
ce02f6f9 1123 cmdsRecvd++;
1124
1125 if (p_response != NULL) {
7bc95e2e 1126 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1127 // do the tracing for the previous reader request and this tag answer:
1128 EmLogTrace(Uart.output,
1129 Uart.len,
1130 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1131 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1132 Uart.parityBits,
1133 p_response->response,
1134 p_response->response_n,
1135 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1136 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1137 SwapBits(GetParity(p_response->response, p_response->response_n), p_response->response_n));
1138 }
1139
1140 if (!tracing) {
1141 Dbprintf("Trace Full. Simulation stopped.");
1142 break;
1143 }
1144 }
15c4dc5a 1145
1146 Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
1147 LED_A_OFF();
1148}
1149
9492e0b0 1150
1151// prepare a delayed transfer. This simply shifts ToSend[] by a number
1152// of bits specified in the delay parameter.
1153void PrepareDelayedTransfer(uint16_t delay)
1154{
1155 uint8_t bitmask = 0;
1156 uint8_t bits_to_shift = 0;
1157 uint8_t bits_shifted = 0;
1158
1159 delay &= 0x07;
1160 if (delay) {
1161 for (uint16_t i = 0; i < delay; i++) {
1162 bitmask |= (0x01 << i);
1163 }
7bc95e2e 1164 ToSend[ToSendMax++] = 0x00;
9492e0b0 1165 for (uint16_t i = 0; i < ToSendMax; i++) {
1166 bits_to_shift = ToSend[i] & bitmask;
1167 ToSend[i] = ToSend[i] >> delay;
1168 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1169 bits_shifted = bits_to_shift;
1170 }
1171 }
1172}
1173
7bc95e2e 1174
1175//-------------------------------------------------------------------------------------
15c4dc5a 1176// Transmit the command (to the tag) that was placed in ToSend[].
9492e0b0 1177// Parameter timing:
7bc95e2e 1178// if NULL: transfer at next possible time, taking into account
1179// request guard time and frame delay time
1180// if == 0: transfer immediately and return time of transfer
9492e0b0 1181// if != 0: delay transfer until time specified
7bc95e2e 1182//-------------------------------------------------------------------------------------
9492e0b0 1183static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
15c4dc5a 1184{
7bc95e2e 1185
9492e0b0 1186 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
e30c654b 1187
7bc95e2e 1188 uint32_t ThisTransferTime = 0;
e30c654b 1189
9492e0b0 1190 if (timing) {
1191 if(*timing == 0) { // Measure time
7bc95e2e 1192 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
9492e0b0 1193 } else {
1194 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1195 }
7bc95e2e 1196 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1197 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1198 LastTimeProxToAirStart = *timing;
1199 } else {
1200 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1201 while(GetCountSspClk() < ThisTransferTime);
1202 LastTimeProxToAirStart = ThisTransferTime;
9492e0b0 1203 }
1204
7bc95e2e 1205 // clear TXRDY
1206 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1207
7bc95e2e 1208 uint16_t c = 0;
9492e0b0 1209 for(;;) {
1210 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1211 AT91C_BASE_SSC->SSC_THR = cmd[c];
1212 c++;
1213 if(c >= len) {
1214 break;
1215 }
1216 }
1217 }
7bc95e2e 1218
f6c18637 1219 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
15c4dc5a 1220}
1221
7bc95e2e 1222
15c4dc5a 1223//-----------------------------------------------------------------------------
195af472 1224// Prepare reader command (in bits, support short frames) to send to FPGA
15c4dc5a 1225//-----------------------------------------------------------------------------
195af472 1226void CodeIso14443aBitsAsReaderPar(const uint8_t * cmd, int bits, uint32_t dwParity)
15c4dc5a 1227{
7bc95e2e 1228 int i, j;
1229 int last;
1230 uint8_t b;
e30c654b 1231
7bc95e2e 1232 ToSendReset();
e30c654b 1233
7bc95e2e 1234 // Start of Communication (Seq. Z)
1235 ToSend[++ToSendMax] = SEC_Z;
1236 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1237 last = 0;
1238
1239 size_t bytecount = nbytes(bits);
1240 // Generate send structure for the data bits
1241 for (i = 0; i < bytecount; i++) {
1242 // Get the current byte to send
1243 b = cmd[i];
1244 size_t bitsleft = MIN((bits-(i*8)),8);
1245
1246 for (j = 0; j < bitsleft; j++) {
1247 if (b & 1) {
1248 // Sequence X
1249 ToSend[++ToSendMax] = SEC_X;
1250 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1251 last = 1;
1252 } else {
1253 if (last == 0) {
1254 // Sequence Z
1255 ToSend[++ToSendMax] = SEC_Z;
1256 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1257 } else {
1258 // Sequence Y
1259 ToSend[++ToSendMax] = SEC_Y;
1260 last = 0;
1261 }
1262 }
1263 b >>= 1;
1264 }
1265
1266 // Only transmit (last) parity bit if we transmitted a complete byte
1267 if (j == 8) {
1268 // Get the parity bit
1269 if ((dwParity >> i) & 0x01) {
1270 // Sequence X
1271 ToSend[++ToSendMax] = SEC_X;
1272 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1273 last = 1;
1274 } else {
1275 if (last == 0) {
1276 // Sequence Z
1277 ToSend[++ToSendMax] = SEC_Z;
1278 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1279 } else {
1280 // Sequence Y
1281 ToSend[++ToSendMax] = SEC_Y;
1282 last = 0;
1283 }
1284 }
1285 }
1286 }
e30c654b 1287
7bc95e2e 1288 // End of Communication: Logic 0 followed by Sequence Y
1289 if (last == 0) {
1290 // Sequence Z
1291 ToSend[++ToSendMax] = SEC_Z;
1292 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1293 } else {
1294 // Sequence Y
1295 ToSend[++ToSendMax] = SEC_Y;
1296 last = 0;
1297 }
1298 ToSend[++ToSendMax] = SEC_Y;
e30c654b 1299
7bc95e2e 1300 // Convert to length of command:
1301 ToSendMax++;
15c4dc5a 1302}
1303
195af472 1304//-----------------------------------------------------------------------------
1305// Prepare reader command to send to FPGA
1306//-----------------------------------------------------------------------------
1307void CodeIso14443aAsReaderPar(const uint8_t * cmd, int len, uint32_t dwParity)
1308{
1309 CodeIso14443aBitsAsReaderPar(cmd,len*8,dwParity);
1310}
1311
9ca155ba
M
1312//-----------------------------------------------------------------------------
1313// Wait for commands from reader
1314// Stop when button is pressed (return 1) or field was gone (return 2)
1315// Or return 0 when command is captured
1316//-----------------------------------------------------------------------------
7bc95e2e 1317static int EmGetCmd(uint8_t *received, int *len)
9ca155ba
M
1318{
1319 *len = 0;
1320
1321 uint32_t timer = 0, vtime = 0;
1322 int analogCnt = 0;
1323 int analogAVG = 0;
1324
1325 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1326 // only, since we are receiving, not transmitting).
1327 // Signal field is off with the appropriate LED
1328 LED_D_OFF();
1329 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1330
1331 // Set ADC to read field strength
1332 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1333 AT91C_BASE_ADC->ADC_MR =
1334 ADC_MODE_PRESCALE(32) |
1335 ADC_MODE_STARTUP_TIME(16) |
1336 ADC_MODE_SAMPLE_HOLD_TIME(8);
1337 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1338 // start ADC
1339 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1340
1341 // Now run a 'software UART' on the stream of incoming samples.
7bc95e2e 1342 UartReset();
9ca155ba 1343 Uart.output = received;
7bc95e2e 1344
1345 // Clear RXRDY:
1346 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba
M
1347
1348 for(;;) {
1349 WDT_HIT();
1350
1351 if (BUTTON_PRESS()) return 1;
1352
1353 // test if the field exists
1354 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1355 analogCnt++;
1356 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1357 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1358 if (analogCnt >= 32) {
1359 if ((33000 * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1360 vtime = GetTickCount();
1361 if (!timer) timer = vtime;
1362 // 50ms no field --> card to idle state
1363 if (vtime - timer > 50) return 2;
1364 } else
1365 if (timer) timer = 0;
1366 analogCnt = 0;
1367 analogAVG = 0;
1368 }
1369 }
7bc95e2e 1370
9ca155ba 1371 // receive and test the miller decoding
7bc95e2e 1372 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1373 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1374 if(MillerDecoding(b, 0)) {
1375 *len = Uart.len;
9ca155ba
M
1376 return 0;
1377 }
7bc95e2e 1378 }
1379
9ca155ba
M
1380 }
1381}
1382
9ca155ba 1383
7bc95e2e 1384static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded)
1385{
1386 uint8_t b;
1387 uint16_t i = 0;
1388 uint32_t ThisTransferTime;
1389
9ca155ba
M
1390 // Modulate Manchester
1391 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
7bc95e2e 1392
1393 // include correction bit if necessary
1394 if (Uart.parityBits & 0x01) {
1395 correctionNeeded = TRUE;
1396 }
1397 if(correctionNeeded) {
9ca155ba
M
1398 // 1236, so correction bit needed
1399 i = 0;
7bc95e2e 1400 } else {
1401 i = 1;
9ca155ba 1402 }
7bc95e2e 1403
d714d3ef 1404 // clear receiving shift register and holding register
7bc95e2e 1405 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1406 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1407 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1408 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
9ca155ba 1409
7bc95e2e 1410 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1411 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1412 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1413 if (AT91C_BASE_SSC->SSC_RHR) break;
1414 }
1415
1416 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1417
1418 // Clear TXRDY:
1419 AT91C_BASE_SSC->SSC_THR = SEC_F;
1420
9ca155ba 1421 // send cycle
7bc95e2e 1422 for(; i <= respLen; ) {
9ca155ba 1423 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
7bc95e2e 1424 AT91C_BASE_SSC->SSC_THR = resp[i++];
1425 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
9ca155ba 1426 }
7bc95e2e 1427
9ca155ba
M
1428 if(BUTTON_PRESS()) {
1429 break;
1430 }
1431 }
1432
7bc95e2e 1433 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1434 for (i = 0; i < 2 ; ) {
1435 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1436 AT91C_BASE_SSC->SSC_THR = SEC_F;
1437 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1438 i++;
1439 }
1440 }
1441
1442 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1443
9ca155ba
M
1444 return 0;
1445}
1446
7bc95e2e 1447int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1448 Code4bitAnswerAsTag(resp);
0a39986e 1449 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1450 // do the tracing for the previous reader request and this tag answer:
1451 EmLogTrace(Uart.output,
1452 Uart.len,
1453 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1454 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1455 Uart.parityBits,
1456 &resp,
1457 1,
1458 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1459 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1460 SwapBits(GetParity(&resp, 1), 1));
0a39986e 1461 return res;
9ca155ba
M
1462}
1463
8f51ddb0 1464int EmSend4bit(uint8_t resp){
7bc95e2e 1465 return EmSend4bitEx(resp, false);
8f51ddb0
M
1466}
1467
7bc95e2e 1468int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par){
1469 CodeIso14443aAsTagPar(resp, respLen, par);
8f51ddb0 1470 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
7bc95e2e 1471 // do the tracing for the previous reader request and this tag answer:
1472 EmLogTrace(Uart.output,
1473 Uart.len,
1474 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1475 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1476 Uart.parityBits,
1477 resp,
1478 respLen,
1479 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1480 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1481 SwapBits(GetParity(resp, respLen), respLen));
8f51ddb0
M
1482 return res;
1483}
1484
7bc95e2e 1485int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded){
8f51ddb0
M
1486 return EmSendCmdExPar(resp, respLen, correctionNeeded, GetParity(resp, respLen));
1487}
1488
1489int EmSendCmd(uint8_t *resp, int respLen){
7bc95e2e 1490 return EmSendCmdExPar(resp, respLen, false, GetParity(resp, respLen));
8f51ddb0
M
1491}
1492
1493int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
7bc95e2e 1494 return EmSendCmdExPar(resp, respLen, false, par);
1495}
1496
1497bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
1498 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity)
1499{
1500 if (tracing) {
1501 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1502 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1503 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1504 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1505 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1506 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1507 reader_EndTime = tag_StartTime - exact_fdt;
1508 reader_StartTime = reader_EndTime - reader_modlen;
1509 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_Parity, TRUE)) {
1510 return FALSE;
1511 } else if (!LogTrace(NULL, 0, reader_EndTime, 0, TRUE)) {
1512 return FALSE;
1513 } else if (!LogTrace(tag_data, tag_len, tag_StartTime, tag_Parity, FALSE)) {
1514 return FALSE;
1515 } else {
1516 return (!LogTrace(NULL, 0, tag_EndTime, 0, FALSE));
1517 }
1518 } else {
1519 return TRUE;
1520 }
9ca155ba
M
1521}
1522
15c4dc5a 1523//-----------------------------------------------------------------------------
1524// Wait a certain time for tag response
1525// If a response is captured return TRUE
e691fc45 1526// If it takes too long return FALSE
15c4dc5a 1527//-----------------------------------------------------------------------------
7bc95e2e 1528static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen)
15c4dc5a 1529{
7bc95e2e 1530 uint16_t c;
e691fc45 1531
15c4dc5a 1532 // Set FPGA mode to "reader listen mode", no modulation (listen
534983d7 1533 // only, since we are receiving, not transmitting).
1534 // Signal field is on with the appropriate LED
1535 LED_D_ON();
1536 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1c611bbd 1537
534983d7 1538 // Now get the answer from the card
7bc95e2e 1539 DemodReset();
534983d7 1540 Demod.output = receivedResponse;
15c4dc5a 1541
7bc95e2e 1542 // clear RXRDY:
1543 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1544
15c4dc5a 1545 c = 0;
1546 for(;;) {
534983d7 1547 WDT_HIT();
15c4dc5a 1548
534983d7 1549 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
534983d7 1550 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
7bc95e2e 1551 if(ManchesterDecoding(b, offset, 0)) {
1552 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
15c4dc5a 1553 return TRUE;
7bc95e2e 1554 } else if(c++ > iso14a_timeout) {
1555 return FALSE;
15c4dc5a 1556 }
534983d7 1557 }
1558 }
15c4dc5a 1559}
1560
9492e0b0 1561void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing)
15c4dc5a 1562{
981bd429 1563
7bc95e2e 1564 CodeIso14443aBitsAsReaderPar(frame,bits,par);
dfc3c505 1565
7bc95e2e 1566 // Send command to tag
1567 TransmitFor14443a(ToSend, ToSendMax, timing);
1568 if(trigger)
1569 LED_A_ON();
dfc3c505 1570
7bc95e2e 1571 // Log reader command in trace buffer
1572 if (tracing) {
1573 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1574 LogTrace(NULL, 0, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, 0, TRUE);
1575 }
15c4dc5a 1576}
1577
9492e0b0 1578void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing)
dfc3c505 1579{
9492e0b0 1580 ReaderTransmitBitsPar(frame,len*8,par, timing);
dfc3c505 1581}
15c4dc5a 1582
e691fc45 1583void ReaderTransmitBits(uint8_t* frame, int len, uint32_t *timing)
1584{
1585 // Generate parity and redirect
1586 ReaderTransmitBitsPar(frame,len,GetParity(frame,len/8), timing);
1587}
1588
9492e0b0 1589void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing)
15c4dc5a 1590{
1591 // Generate parity and redirect
9492e0b0 1592 ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing);
15c4dc5a 1593}
1594
e691fc45 1595int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
1596{
7bc95e2e 1597 if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160)) return FALSE;
1598 if (tracing) {
1599 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
1600 LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
1601 }
e691fc45 1602 return Demod.len;
1603}
1604
f7e3ed82 1605int ReaderReceive(uint8_t* receivedAnswer)
15c4dc5a 1606{
e691fc45 1607 return ReaderReceiveOffset(receivedAnswer, 0);
15c4dc5a 1608}
1609
e691fc45 1610int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
f89c7050 1611{
7bc95e2e 1612 if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160)) return FALSE;
1613 if (tracing) {
1614 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
1615 LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
1616 }
f89c7050 1617 *parptr = Demod.parityBits;
e691fc45 1618 return Demod.len;
f89c7050
M
1619}
1620
e691fc45 1621/* performs iso14443a anticollision procedure
534983d7 1622 * fills the uid pointer unless NULL
1623 * fills resp_data unless NULL */
79a73ab2 1624int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) {
ed258538 1625 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1626 uint8_t sel_all[] = { 0x93,0x20 };
e691fc45 1627 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
ed258538 1628 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1629 uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes
79a73ab2 1630 byte_t uid_resp[4];
1631 size_t uid_resp_len;
15c4dc5a 1632
ed258538 1633 uint8_t sak = 0x04; // cascade uid
1634 int cascade_level = 0;
1635 int len;
79a73ab2 1636
ed258538 1637 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
9492e0b0 1638 ReaderTransmitBitsPar(wupa,7,0, NULL);
7bc95e2e 1639
ed258538 1640 // Receive the ATQA
1641 if(!ReaderReceive(resp)) return 0;
e691fc45 1642 // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
1c611bbd 1643
ed258538 1644 if(p_hi14a_card) {
1645 memcpy(p_hi14a_card->atqa, resp, 2);
79a73ab2 1646 p_hi14a_card->uidlen = 0;
1647 memset(p_hi14a_card->uid,0,10);
1648 }
5f6d6c90 1649
79a73ab2 1650 // clear uid
1651 if (uid_ptr) {
1c611bbd 1652 memset(uid_ptr,0,10);
79a73ab2 1653 }
1654
ed258538 1655 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1656 // which case we need to make a cascade 2 request and select - this is a long UID
1657 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1658 for(; sak & 0x04; cascade_level++) {
1659 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1660 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1661
1662 // SELECT_ALL
9492e0b0 1663 ReaderTransmit(sel_all,sizeof(sel_all), NULL);
ed258538 1664 if (!ReaderReceive(resp)) return 0;
5f6d6c90 1665
e691fc45 1666 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1667 memset(uid_resp, 0, 4);
1668 uint16_t uid_resp_bits = 0;
1669 uint16_t collision_answer_offset = 0;
1670 // anti-collision-loop:
1671 while (Demod.collisionPos) {
1672 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1673 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1674 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1675 uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8);
1676 }
1677 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1678 uid_resp_bits++;
1679 // construct anticollosion command:
1680 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1681 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1682 sel_uid[2+i] = uid_resp[i];
1683 }
1684 collision_answer_offset = uid_resp_bits%8;
1685 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1686 if (!ReaderReceiveOffset(resp, collision_answer_offset)) return 0;
1687 }
1688 // finally, add the last bits and BCC of the UID
1689 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1690 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1691 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1692 }
1693
1694 } else { // no collision, use the response to SELECT_ALL as current uid
1695 memcpy(uid_resp,resp,4);
1696 }
1697 uid_resp_len = 4;
7bc95e2e 1698 // Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
5f6d6c90 1699
e691fc45 1700 // calculate crypto UID. Always use last 4 Bytes.
5f6d6c90 1701 if(cuid_ptr) {
1702 *cuid_ptr = bytes_to_num(uid_resp, 4);
79a73ab2 1703 }
e30c654b 1704
ed258538 1705 // Construct SELECT UID command
e691fc45 1706 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1707 memcpy(sel_uid+2,uid_resp,4); // the UID
1708 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1709 AppendCrc14443a(sel_uid,7); // calculate and add CRC
9492e0b0 1710 ReaderTransmit(sel_uid,sizeof(sel_uid), NULL);
534983d7 1711
ed258538 1712 // Receive the SAK
1713 if (!ReaderReceive(resp)) return 0;
1714 sak = resp[0];
79a73ab2 1715
1716 // Test if more parts of the uid are comming
e691fc45 1717 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
79a73ab2 1718 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1719 // http://www.nxp.com/documents/application_note/AN10927.pdf
ed258538 1720 memcpy(uid_resp, uid_resp + 1, 3);
79a73ab2 1721 uid_resp_len = 3;
1722 }
5f6d6c90 1723
79a73ab2 1724 if(uid_ptr) {
1725 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
1726 }
5f6d6c90 1727
79a73ab2 1728 if(p_hi14a_card) {
1729 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
1730 p_hi14a_card->uidlen += uid_resp_len;
1731 }
ed258538 1732 }
79a73ab2 1733
ed258538 1734 if(p_hi14a_card) {
1735 p_hi14a_card->sak = sak;
1736 p_hi14a_card->ats_len = 0;
1737 }
534983d7 1738
ed258538 1739 if( (sak & 0x20) == 0) {
1740 return 2; // non iso14443a compliant tag
79a73ab2 1741 }
534983d7 1742
ed258538 1743 // Request for answer to select
5191b3d1 1744 AppendCrc14443a(rats, 2);
9492e0b0 1745 ReaderTransmit(rats, sizeof(rats), NULL);
1c611bbd 1746
5191b3d1 1747 if (!(len = ReaderReceive(resp))) return 0;
1748
1749 if(p_hi14a_card) {
ed258538 1750 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
1751 p_hi14a_card->ats_len = len;
1752 }
5f6d6c90 1753
ed258538 1754 // reset the PCB block number
1755 iso14_pcb_blocknum = 0;
1756 return 1;
7e758047 1757}
15c4dc5a 1758
7bc95e2e 1759void iso14443a_setup(uint8_t fpga_minor_mode) {
7cc204bf 1760 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9492e0b0 1761 // Set up the synchronous serial port
1762 FpgaSetupSsc();
7bc95e2e 1763 // connect Demodulated Signal to ADC:
7e758047 1764 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
e30c654b 1765
7e758047 1766 // Signal field is on with the appropriate LED
7bc95e2e 1767 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
1768 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
1769 LED_D_ON();
1770 } else {
1771 LED_D_OFF();
1772 }
1773 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
534983d7 1774
7bc95e2e 1775 // Start the timer
1776 StartCountSspClk();
1777
1778 DemodReset();
1779 UartReset();
1780 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
f38a1528 1781 iso14a_set_timeout(1050); // 10ms default 10*105 =
7e758047 1782}
15c4dc5a 1783
534983d7 1784int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) {
1785 uint8_t real_cmd[cmd_len+4];
1786 real_cmd[0] = 0x0a; //I-Block
b0127e65 1787 // put block number into the PCB
1788 real_cmd[0] |= iso14_pcb_blocknum;
534983d7 1789 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
1790 memcpy(real_cmd+2, cmd, cmd_len);
1791 AppendCrc14443a(real_cmd,cmd_len+2);
1792
9492e0b0 1793 ReaderTransmit(real_cmd, cmd_len+4, NULL);
534983d7 1794 size_t len = ReaderReceive(data);
b0127e65 1795 uint8_t * data_bytes = (uint8_t *) data;
1796 if (!len)
1797 return 0; //DATA LINK ERROR
1798 // if we received an I- or R(ACK)-Block with a block number equal to the
1799 // current block number, toggle the current block number
1800 else if (len >= 4 // PCB+CID+CRC = 4 bytes
1801 && ((data_bytes[0] & 0xC0) == 0 // I-Block
1802 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1803 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
1804 {
1805 iso14_pcb_blocknum ^= 1;
1806 }
1807
534983d7 1808 return len;
1809}
1810
7e758047 1811//-----------------------------------------------------------------------------
1812// Read an ISO 14443a tag. Send out commands and store answers.
1813//
1814//-----------------------------------------------------------------------------
7bc95e2e 1815void ReaderIso14443a(UsbCommand *c)
7e758047 1816{
534983d7 1817 iso14a_command_t param = c->arg[0];
7bc95e2e 1818 uint8_t *cmd = c->d.asBytes;
f38a1528 1819 size_t len = c->arg[1] & 0xFFFF;
1820 size_t lenbits = c->arg[1] >> 16;
9492e0b0 1821 uint32_t arg0 = 0;
1822 byte_t buf[USB_CMD_DATA_SIZE];
902cb3c0 1823
5f6d6c90 1824 if(param & ISO14A_CONNECT) {
1825 iso14a_clear_trace();
1826 }
e691fc45 1827
7bc95e2e 1828 iso14a_set_tracing(TRUE);
e30c654b 1829
79a73ab2 1830 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 1831 iso14a_set_trigger(TRUE);
9492e0b0 1832 }
15c4dc5a 1833
534983d7 1834 if(param & ISO14A_CONNECT) {
7bc95e2e 1835 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
5f6d6c90 1836 if(!(param & ISO14A_NO_SELECT)) {
1837 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
1838 arg0 = iso14443a_select_card(NULL,card,NULL);
1839 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
1840 }
534983d7 1841 }
e30c654b 1842
534983d7 1843 if(param & ISO14A_SET_TIMEOUT) {
313ee67e 1844 iso14a_set_timeout(c->arg[2]);
534983d7 1845 }
e30c654b 1846
534983d7 1847 if(param & ISO14A_APDU) {
902cb3c0 1848 arg0 = iso14_apdu(cmd, len, buf);
79a73ab2 1849 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 1850 }
e30c654b 1851
534983d7 1852 if(param & ISO14A_RAW) {
1853 if(param & ISO14A_APPEND_CRC) {
1854 AppendCrc14443a(cmd,len);
1855 len += 2;
f38a1528 1856 lenbits += 16;
15c4dc5a 1857 }
5f6d6c90 1858 if(lenbits>0) {
f38a1528 1859
5f6d6c90 1860 ReaderTransmitBitsPar(cmd,lenbits,GetParity(cmd,lenbits/8), NULL);
1861 } else {
1862 ReaderTransmit(cmd,len, NULL);
1863 }
902cb3c0 1864 arg0 = ReaderReceive(buf);
9492e0b0 1865 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
534983d7 1866 }
15c4dc5a 1867
79a73ab2 1868 if(param & ISO14A_REQUEST_TRIGGER) {
7bc95e2e 1869 iso14a_set_trigger(FALSE);
9492e0b0 1870 }
15c4dc5a 1871
79a73ab2 1872 if(param & ISO14A_NO_DISCONNECT) {
534983d7 1873 return;
9492e0b0 1874 }
15c4dc5a 1875
15c4dc5a 1876 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1877 LEDsoff();
15c4dc5a 1878}
b0127e65 1879
1c611bbd 1880
1c611bbd 1881// Determine the distance between two nonces.
1882// Assume that the difference is small, but we don't know which is first.
1883// Therefore try in alternating directions.
1884int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
1885
1886 uint16_t i;
1887 uint32_t nttmp1, nttmp2;
e772353f 1888
1c611bbd 1889 if (nt1 == nt2) return 0;
1890
1891 nttmp1 = nt1;
1892 nttmp2 = nt2;
1893
1894 for (i = 1; i < 32768; i++) {
1895 nttmp1 = prng_successor(nttmp1, 1);
1896 if (nttmp1 == nt2) return i;
1897 nttmp2 = prng_successor(nttmp2, 1);
1898 if (nttmp2 == nt1) return -i;
1899 }
1900
1901 return(-99999); // either nt1 or nt2 are invalid nonces
e772353f 1902}
1903
e772353f 1904
1c611bbd 1905//-----------------------------------------------------------------------------
1906// Recover several bits of the cypher stream. This implements (first stages of)
1907// the algorithm described in "The Dark Side of Security by Obscurity and
1908// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
1909// (article by Nicolas T. Courtois, 2009)
1910//-----------------------------------------------------------------------------
1911void ReaderMifare(bool first_try)
1912{
1913 // Mifare AUTH
1914 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
1915 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
1916 static uint8_t mf_nr_ar3;
e772353f 1917
1c611bbd 1918 uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
7bc95e2e 1919
d2f487af 1920 iso14a_clear_trace();
7bc95e2e 1921 iso14a_set_tracing(TRUE);
e772353f 1922
1c611bbd 1923 byte_t nt_diff = 0;
1924 byte_t par = 0;
1925 //byte_t par_mask = 0xff;
1926 static byte_t par_low = 0;
1927 bool led_on = TRUE;
1928 uint8_t uid[10];
1929 uint32_t cuid;
e772353f 1930
1c611bbd 1931 uint32_t nt, previous_nt;
1932 static uint32_t nt_attacked = 0;
1933 byte_t par_list[8] = {0,0,0,0,0,0,0,0};
1934 byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
e772353f 1935
1c611bbd 1936 static uint32_t sync_time;
1937 static uint32_t sync_cycles;
1938 int catch_up_cycles = 0;
1939 int last_catch_up = 0;
1940 uint16_t consecutive_resyncs = 0;
1941 int isOK = 0;
e772353f 1942
e772353f 1943
e772353f 1944
1c611bbd 1945 if (first_try) {
1c611bbd 1946 mf_nr_ar3 = 0;
7bc95e2e 1947 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
1948 sync_time = GetCountSspClk() & 0xfffffff8;
1c611bbd 1949 sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
1950 nt_attacked = 0;
1951 nt = 0;
1952 par = 0;
1953 }
1954 else {
1955 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
1956 // nt_attacked = prng_successor(nt_attacked, 1);
1957 mf_nr_ar3++;
1958 mf_nr_ar[3] = mf_nr_ar3;
1959 par = par_low;
1960 }
e30c654b 1961
15c4dc5a 1962 LED_A_ON();
1963 LED_B_OFF();
1964 LED_C_OFF();
1c611bbd 1965
7bc95e2e 1966
1c611bbd 1967 for(uint16_t i = 0; TRUE; i++) {
1968
1969 WDT_HIT();
e30c654b 1970
1c611bbd 1971 // Test if the action was cancelled
1972 if(BUTTON_PRESS()) {
1973 break;
1974 }
1975
1976 LED_C_ON();
e30c654b 1977
1c611bbd 1978 if(!iso14443a_select_card(uid, NULL, &cuid)) {
9492e0b0 1979 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
1c611bbd 1980 continue;
1981 }
1982
9492e0b0 1983 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
1c611bbd 1984 catch_up_cycles = 0;
1985
1986 // if we missed the sync time already, advance to the next nonce repeat
7bc95e2e 1987 while(GetCountSspClk() > sync_time) {
9492e0b0 1988 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
1c611bbd 1989 }
e30c654b 1990
9492e0b0 1991 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
1992 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
f89c7050 1993
1c611bbd 1994 // Receive the (4 Byte) "random" nonce
1995 if (!ReaderReceive(receivedAnswer)) {
9492e0b0 1996 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
1c611bbd 1997 continue;
1998 }
1999
1c611bbd 2000 previous_nt = nt;
2001 nt = bytes_to_num(receivedAnswer, 4);
2002
2003 // Transmit reader nonce with fake par
9492e0b0 2004 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
1c611bbd 2005
2006 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2007 int nt_distance = dist_nt(previous_nt, nt);
2008 if (nt_distance == 0) {
2009 nt_attacked = nt;
2010 }
2011 else {
2012 if (nt_distance == -99999) { // invalid nonce received, try again
2013 continue;
2014 }
2015 sync_cycles = (sync_cycles - nt_distance);
9492e0b0 2016 if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
1c611bbd 2017 continue;
2018 }
2019 }
2020
2021 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2022 catch_up_cycles = -dist_nt(nt_attacked, nt);
2023 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2024 catch_up_cycles = 0;
2025 continue;
2026 }
2027 if (catch_up_cycles == last_catch_up) {
2028 consecutive_resyncs++;
2029 }
2030 else {
2031 last_catch_up = catch_up_cycles;
2032 consecutive_resyncs = 0;
2033 }
2034 if (consecutive_resyncs < 3) {
9492e0b0 2035 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
1c611bbd 2036 }
2037 else {
2038 sync_cycles = sync_cycles + catch_up_cycles;
9492e0b0 2039 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
1c611bbd 2040 }
2041 continue;
2042 }
2043
2044 consecutive_resyncs = 0;
2045
2046 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2047 if (ReaderReceive(receivedAnswer))
2048 {
9492e0b0 2049 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
1c611bbd 2050
2051 if (nt_diff == 0)
2052 {
2053 par_low = par & 0x07; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2054 }
2055
2056 led_on = !led_on;
2057 if(led_on) LED_B_ON(); else LED_B_OFF();
2058
2059 par_list[nt_diff] = par;
2060 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2061
2062 // Test if the information is complete
2063 if (nt_diff == 0x07) {
2064 isOK = 1;
2065 break;
2066 }
2067
2068 nt_diff = (nt_diff + 1) & 0x07;
2069 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2070 par = par_low;
2071 } else {
2072 if (nt_diff == 0 && first_try)
2073 {
2074 par++;
2075 } else {
2076 par = (((par >> 3) + 1) << 3) | par_low;
2077 }
2078 }
2079 }
2080
1c611bbd 2081
2082 mf_nr_ar[3] &= 0x1F;
2083
2084 byte_t buf[28];
2085 memcpy(buf + 0, uid, 4);
2086 num_to_bytes(nt, 4, buf + 4);
2087 memcpy(buf + 8, par_list, 8);
2088 memcpy(buf + 16, ks_list, 8);
2089 memcpy(buf + 24, mf_nr_ar, 4);
2090
2091 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2092
2093 // Thats it...
2094 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2095 LEDsoff();
7bc95e2e 2096
2097 iso14a_set_tracing(FALSE);
20f9a2a1 2098}
1c611bbd 2099
d2f487af 2100/**
2101 *MIFARE 1K simulate.
2102 *
2103 *@param flags :
2104 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2105 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2106 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2107 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2108 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2109 */
2110void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
20f9a2a1 2111{
50193c1e 2112 int cardSTATE = MFEMUL_NOFIELD;
8556b852 2113 int _7BUID = 0;
9ca155ba 2114 int vHf = 0; // in mV
8f51ddb0 2115 int res;
0a39986e
M
2116 uint32_t selTimer = 0;
2117 uint32_t authTimer = 0;
2118 uint32_t par = 0;
9ca155ba 2119 int len = 0;
8f51ddb0 2120 uint8_t cardWRBL = 0;
9ca155ba
M
2121 uint8_t cardAUTHSC = 0;
2122 uint8_t cardAUTHKEY = 0xff; // no authentication
51969283 2123 uint32_t cardRr = 0;
9ca155ba 2124 uint32_t cuid = 0;
d2f487af 2125 //uint32_t rn_enc = 0;
51969283 2126 uint32_t ans = 0;
0014cb46
M
2127 uint32_t cardINTREG = 0;
2128 uint8_t cardINTBLOCK = 0;
9ca155ba
M
2129 struct Crypto1State mpcs = {0, 0};
2130 struct Crypto1State *pcs;
2131 pcs = &mpcs;
d2f487af 2132 uint32_t numReads = 0;//Counts numer of times reader read a block
8f51ddb0
M
2133 uint8_t* receivedCmd = eml_get_bigbufptr_recbuf();
2134 uint8_t *response = eml_get_bigbufptr_sendbuf();
9ca155ba 2135
d2f487af 2136 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2137 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2138 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2139 uint8_t rSAK[] = {0x08, 0xb6, 0xdd};
2140 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
9ca155ba 2141
d2f487af 2142 uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
2143 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
7bc95e2e 2144
d2f487af 2145 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2146 // This can be used in a reader-only attack.
2147 // (it can also be retrieved via 'hf 14a list', but hey...
2148 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0};
2149 uint8_t ar_nr_collected = 0;
0014cb46 2150
0a39986e 2151 // clear trace
7bc95e2e 2152 iso14a_clear_trace();
2153 iso14a_set_tracing(TRUE);
51969283 2154
7bc95e2e 2155 // Authenticate response - nonce
51969283 2156 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
7bc95e2e 2157
d2f487af 2158 //-- Determine the UID
2159 // Can be set from emulator memory, incoming data
2160 // and can be 7 or 4 bytes long
7bc95e2e 2161 if (flags & FLAG_4B_UID_IN_DATA)
d2f487af 2162 {
2163 // 4B uid comes from data-portion of packet
2164 memcpy(rUIDBCC1,datain,4);
8556b852 2165 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
8556b852 2166
7bc95e2e 2167 } else if (flags & FLAG_7B_UID_IN_DATA) {
d2f487af 2168 // 7B uid comes from data-portion of packet
2169 memcpy(&rUIDBCC1[1],datain,3);
2170 memcpy(rUIDBCC2, datain+3, 4);
2171 _7BUID = true;
7bc95e2e 2172 } else {
d2f487af 2173 // get UID from emul memory
2174 emlGetMemBt(receivedCmd, 7, 1);
2175 _7BUID = !(receivedCmd[0] == 0x00);
2176 if (!_7BUID) { // ---------- 4BUID
2177 emlGetMemBt(rUIDBCC1, 0, 4);
2178 } else { // ---------- 7BUID
2179 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2180 emlGetMemBt(rUIDBCC2, 3, 4);
2181 }
2182 }
7bc95e2e 2183
d2f487af 2184 /*
2185 * Regardless of what method was used to set the UID, set fifth byte and modify
2186 * the ATQA for 4 or 7-byte UID
2187 */
d2f487af 2188 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
7bc95e2e 2189 if (_7BUID) {
d2f487af 2190 rATQA[0] = 0x44;
8556b852 2191 rUIDBCC1[0] = 0x88;
8556b852
M
2192 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2193 }
2194
9ca155ba 2195 // We need to listen to the high-frequency, peak-detected path.
7bc95e2e 2196 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
9ca155ba 2197
9ca155ba 2198
d2f487af 2199 if (MF_DBGLEVEL >= 1) {
2200 if (!_7BUID) {
f38a1528 2201 Dbprintf("4B UID: %02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3]);
7bc95e2e 2202 } else {
f38a1528 2203 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3],rUIDBCC2[0],rUIDBCC2[1] ,rUIDBCC2[2] , rUIDBCC2[3]);
d2f487af 2204 }
2205 }
7bc95e2e 2206
2207 bool finished = FALSE;
d2f487af 2208 while (!BUTTON_PRESS() && !finished) {
9ca155ba 2209 WDT_HIT();
9ca155ba
M
2210
2211 // find reader field
2212 // Vref = 3300mV, and an 10:1 voltage divider on the input
2213 // can measure voltages up to 33000 mV
2214 if (cardSTATE == MFEMUL_NOFIELD) {
2215 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
2216 if (vHf > MF_MINFIELDV) {
0014cb46 2217 cardSTATE_TO_IDLE();
9ca155ba
M
2218 LED_A_ON();
2219 }
2220 }
d2f487af 2221 if(cardSTATE == MFEMUL_NOFIELD) continue;
9ca155ba 2222
d2f487af 2223 //Now, get data
2224
7bc95e2e 2225 res = EmGetCmd(receivedCmd, &len);
d2f487af 2226 if (res == 2) { //Field is off!
2227 cardSTATE = MFEMUL_NOFIELD;
2228 LEDsoff();
2229 continue;
7bc95e2e 2230 } else if (res == 1) {
2231 break; //return value 1 means button press
2232 }
2233
d2f487af 2234 // REQ or WUP request in ANY state and WUP in HALTED state
2235 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2236 selTimer = GetTickCount();
2237 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2238 cardSTATE = MFEMUL_SELECT1;
2239
2240 // init crypto block
2241 LED_B_OFF();
2242 LED_C_OFF();
2243 crypto1_destroy(pcs);
2244 cardAUTHKEY = 0xff;
2245 continue;
0a39986e 2246 }
7bc95e2e 2247
50193c1e 2248 switch (cardSTATE) {
d2f487af 2249 case MFEMUL_NOFIELD:
2250 case MFEMUL_HALTED:
50193c1e 2251 case MFEMUL_IDLE:{
7bc95e2e 2252 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2253 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
50193c1e
M
2254 break;
2255 }
2256 case MFEMUL_SELECT1:{
9ca155ba
M
2257 // select all
2258 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
d2f487af 2259 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
9ca155ba 2260 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
0014cb46 2261 break;
9ca155ba
M
2262 }
2263
d2f487af 2264 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2265 {
2266 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2267 }
9ca155ba 2268 // select card
0a39986e
M
2269 if (len == 9 &&
2270 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
bfb6a143 2271 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
9ca155ba 2272 cuid = bytes_to_num(rUIDBCC1, 4);
8556b852
M
2273 if (!_7BUID) {
2274 cardSTATE = MFEMUL_WORK;
0014cb46
M
2275 LED_B_ON();
2276 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2277 break;
8556b852
M
2278 } else {
2279 cardSTATE = MFEMUL_SELECT2;
8556b852 2280 }
9ca155ba 2281 }
50193c1e
M
2282 break;
2283 }
d2f487af 2284 case MFEMUL_AUTH1:{
2285 if( len != 8)
2286 {
2287 cardSTATE_TO_IDLE();
7bc95e2e 2288 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2289 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
d2f487af 2290 break;
2291 }
2292 uint32_t ar = bytes_to_num(receivedCmd, 4);
2293 uint32_t nr= bytes_to_num(&receivedCmd[4], 4);
2294
2295 //Collect AR/NR
2296 if(ar_nr_collected < 2){
273b57a7 2297 if(ar_nr_responses[2] != ar)
2298 {// Avoid duplicates... probably not necessary, ar should vary.
d2f487af 2299 ar_nr_responses[ar_nr_collected*4] = cuid;
2300 ar_nr_responses[ar_nr_collected*4+1] = nonce;
2301 ar_nr_responses[ar_nr_collected*4+2] = ar;
2302 ar_nr_responses[ar_nr_collected*4+3] = nr;
273b57a7 2303 ar_nr_collected++;
d2f487af 2304 }
2305 }
2306
2307 // --- crypto
2308 crypto1_word(pcs, ar , 1);
2309 cardRr = nr ^ crypto1_word(pcs, 0, 0);
2310
2311 // test if auth OK
2312 if (cardRr != prng_successor(nonce, 64)){
f38a1528 2313 if (MF_DBGLEVEL >= 2) Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x",cardRr, prng_successor(nonce, 64));
7bc95e2e 2314 // Shouldn't we respond anything here?
d2f487af 2315 // Right now, we don't nack or anything, which causes the
2316 // reader to do a WUPA after a while. /Martin
b03c0f2d 2317 // -- which is the correct response. /piwi
d2f487af 2318 cardSTATE_TO_IDLE();
7bc95e2e 2319 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2320 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
d2f487af 2321 break;
2322 }
2323
2324 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2325
2326 num_to_bytes(ans, 4, rAUTH_AT);
2327 // --- crypto
2328 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2329 LED_C_ON();
2330 cardSTATE = MFEMUL_WORK;
b03c0f2d 2331 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2332 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2333 GetTickCount() - authTimer);
d2f487af 2334 break;
2335 }
50193c1e 2336 case MFEMUL_SELECT2:{
7bc95e2e 2337 if (!len) {
2338 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2339 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2340 break;
2341 }
8556b852 2342 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
9ca155ba 2343 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
8556b852
M
2344 break;
2345 }
9ca155ba 2346
8556b852
M
2347 // select 2 card
2348 if (len == 9 &&
2349 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2350 EmSendCmd(rSAK, sizeof(rSAK));
8556b852
M
2351 cuid = bytes_to_num(rUIDBCC2, 4);
2352 cardSTATE = MFEMUL_WORK;
2353 LED_B_ON();
0014cb46 2354 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
8556b852
M
2355 break;
2356 }
0014cb46
M
2357
2358 // i guess there is a command). go into the work state.
7bc95e2e 2359 if (len != 4) {
2360 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2361 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2362 break;
2363 }
0014cb46 2364 cardSTATE = MFEMUL_WORK;
d2f487af 2365 //goto lbWORK;
2366 //intentional fall-through to the next case-stmt
50193c1e 2367 }
51969283 2368
7bc95e2e 2369 case MFEMUL_WORK:{
2370 if (len == 0) {
2371 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2372 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2373 break;
2374 }
2375
d2f487af 2376 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2377
7bc95e2e 2378 if(encrypted_data) {
51969283
M
2379 // decrypt seqence
2380 mf_crypto1_decrypt(pcs, receivedCmd, len);
d2f487af 2381 }
7bc95e2e 2382
d2f487af 2383 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2384 authTimer = GetTickCount();
2385 cardAUTHSC = receivedCmd[1] / 4; // received block num
2386 cardAUTHKEY = receivedCmd[0] - 0x60;
2387 crypto1_destroy(pcs);//Added by martin
2388 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
51969283 2389
d2f487af 2390 if (!encrypted_data) { // first authentication
b03c0f2d 2391 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
51969283 2392
d2f487af 2393 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2394 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
7bc95e2e 2395 } else { // nested authentication
b03c0f2d 2396 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
7bc95e2e 2397 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
d2f487af 2398 num_to_bytes(ans, 4, rAUTH_AT);
2399 }
2400 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2401 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2402 cardSTATE = MFEMUL_AUTH1;
2403 break;
51969283 2404 }
7bc95e2e 2405
8f51ddb0
M
2406 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2407 // BUT... ACK --> NACK
2408 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2409 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2410 break;
2411 }
2412
2413 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2414 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2415 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2416 break;
0a39986e
M
2417 }
2418
7bc95e2e 2419 if(len != 4) {
2420 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2421 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
2422 break;
2423 }
d2f487af 2424
2425 if(receivedCmd[0] == 0x30 // read block
2426 || receivedCmd[0] == 0xA0 // write block
b03c0f2d 2427 || receivedCmd[0] == 0xC0 // inc
2428 || receivedCmd[0] == 0xC1 // dec
2429 || receivedCmd[0] == 0xC2 // restore
7bc95e2e 2430 || receivedCmd[0] == 0xB0) { // transfer
2431 if (receivedCmd[1] >= 16 * 4) {
d2f487af 2432 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2433 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2434 break;
2435 }
2436
7bc95e2e 2437 if (receivedCmd[1] / 4 != cardAUTHSC) {
8f51ddb0 2438 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
d2f487af 2439 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
8f51ddb0
M
2440 break;
2441 }
d2f487af 2442 }
2443 // read block
2444 if (receivedCmd[0] == 0x30) {
b03c0f2d 2445 if (MF_DBGLEVEL >= 4) {
d2f487af 2446 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2447 }
8f51ddb0
M
2448 emlGetMem(response, receivedCmd[1], 1);
2449 AppendCrc14443a(response, 16);
2450 mf_crypto1_encrypt(pcs, response, 18, &par);
2451 EmSendCmdPar(response, 18, par);
d2f487af 2452 numReads++;
7bc95e2e 2453 if(exitAfterNReads > 0 && numReads == exitAfterNReads) {
d2f487af 2454 Dbprintf("%d reads done, exiting", numReads);
2455 finished = true;
2456 }
0a39986e
M
2457 break;
2458 }
0a39986e 2459 // write block
d2f487af 2460 if (receivedCmd[0] == 0xA0) {
b03c0f2d 2461 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
8f51ddb0 2462 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
8f51ddb0
M
2463 cardSTATE = MFEMUL_WRITEBL2;
2464 cardWRBL = receivedCmd[1];
0a39986e 2465 break;
7bc95e2e 2466 }
0014cb46 2467 // increment, decrement, restore
d2f487af 2468 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
b03c0f2d 2469 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
d2f487af 2470 if (emlCheckValBl(receivedCmd[1])) {
2471 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
0014cb46
M
2472 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2473 break;
2474 }
2475 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2476 if (receivedCmd[0] == 0xC1)
2477 cardSTATE = MFEMUL_INTREG_INC;
2478 if (receivedCmd[0] == 0xC0)
2479 cardSTATE = MFEMUL_INTREG_DEC;
2480 if (receivedCmd[0] == 0xC2)
2481 cardSTATE = MFEMUL_INTREG_REST;
2482 cardWRBL = receivedCmd[1];
0014cb46
M
2483 break;
2484 }
0014cb46 2485 // transfer
d2f487af 2486 if (receivedCmd[0] == 0xB0) {
b03c0f2d 2487 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
0014cb46
M
2488 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2489 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2490 else
2491 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
0014cb46
M
2492 break;
2493 }
9ca155ba 2494 // halt
d2f487af 2495 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
9ca155ba 2496 LED_B_OFF();
0a39986e 2497 LED_C_OFF();
0014cb46
M
2498 cardSTATE = MFEMUL_HALTED;
2499 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
7bc95e2e 2500 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2501 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0a39986e 2502 break;
9ca155ba 2503 }
d2f487af 2504 // RATS
2505 if (receivedCmd[0] == 0xe0) {//RATS
8f51ddb0
M
2506 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2507 break;
2508 }
d2f487af 2509 // command not allowed
2510 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2511 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
51969283 2512 break;
8f51ddb0
M
2513 }
2514 case MFEMUL_WRITEBL2:{
2515 if (len == 18){
2516 mf_crypto1_decrypt(pcs, receivedCmd, len);
2517 emlSetMem(receivedCmd, cardWRBL, 1);
2518 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2519 cardSTATE = MFEMUL_WORK;
51969283 2520 } else {
0014cb46 2521 cardSTATE_TO_IDLE();
7bc95e2e 2522 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2523 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
8f51ddb0 2524 }
8f51ddb0 2525 break;
50193c1e 2526 }
0014cb46
M
2527
2528 case MFEMUL_INTREG_INC:{
2529 mf_crypto1_decrypt(pcs, receivedCmd, len);
2530 memcpy(&ans, receivedCmd, 4);
2531 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2532 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2533 cardSTATE_TO_IDLE();
2534 break;
7bc95e2e 2535 }
2536 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2537 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2538 cardINTREG = cardINTREG + ans;
2539 cardSTATE = MFEMUL_WORK;
2540 break;
2541 }
2542 case MFEMUL_INTREG_DEC:{
2543 mf_crypto1_decrypt(pcs, receivedCmd, len);
2544 memcpy(&ans, receivedCmd, 4);
2545 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2546 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2547 cardSTATE_TO_IDLE();
2548 break;
2549 }
7bc95e2e 2550 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2551 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2552 cardINTREG = cardINTREG - ans;
2553 cardSTATE = MFEMUL_WORK;
2554 break;
2555 }
2556 case MFEMUL_INTREG_REST:{
2557 mf_crypto1_decrypt(pcs, receivedCmd, len);
2558 memcpy(&ans, receivedCmd, 4);
2559 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2560 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2561 cardSTATE_TO_IDLE();
2562 break;
2563 }
7bc95e2e 2564 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
2565 LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
0014cb46
M
2566 cardSTATE = MFEMUL_WORK;
2567 break;
2568 }
50193c1e 2569 }
50193c1e
M
2570 }
2571
9ca155ba
M
2572 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2573 LEDsoff();
2574
d2f487af 2575 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2576 {
2577 //May just aswell send the collected ar_nr in the response aswell
2578 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,0,0,&ar_nr_responses,ar_nr_collected*4*4);
2579 }
d714d3ef 2580
d2f487af 2581 if(flags & FLAG_NR_AR_ATTACK)
2582 {
7bc95e2e 2583 if(ar_nr_collected > 1) {
d2f487af 2584 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
d714d3ef 2585 Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
d2f487af 2586 ar_nr_responses[0], // UID
2587 ar_nr_responses[1], //NT
2588 ar_nr_responses[2], //AR1
2589 ar_nr_responses[3], //NR1
2590 ar_nr_responses[6], //AR2
2591 ar_nr_responses[7] //NR2
2592 );
7bc95e2e 2593 } else {
d2f487af 2594 Dbprintf("Failed to obtain two AR/NR pairs!");
7bc95e2e 2595 if(ar_nr_collected >0) {
d714d3ef 2596 Dbprintf("Only got these: UID=%08x, nonce=%08x, AR1=%08x, NR1=%08x",
d2f487af 2597 ar_nr_responses[0], // UID
2598 ar_nr_responses[1], //NT
2599 ar_nr_responses[2], //AR1
2600 ar_nr_responses[3] //NR1
2601 );
2602 }
2603 }
2604 }
0014cb46 2605 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, traceLen);
15c4dc5a 2606}
b62a5a84 2607
d2f487af 2608
2609
b62a5a84
M
2610//-----------------------------------------------------------------------------
2611// MIFARE sniffer.
2612//
2613//-----------------------------------------------------------------------------
5cd9ec01
M
2614void RAMFUNC SniffMifare(uint8_t param) {
2615 // param:
2616 // bit 0 - trigger from first card answer
2617 // bit 1 - trigger from first reader 7-bit request
39864b0b
M
2618
2619 // C(red) A(yellow) B(green)
b62a5a84
M
2620 LEDsoff();
2621 // init trace buffer
991f13f2 2622 iso14a_clear_trace();
2623 iso14a_set_tracing(TRUE);
b62a5a84 2624
b62a5a84
M
2625 // The command (reader -> tag) that we're receiving.
2626 // The length of a received command will in most cases be no more than 18 bytes.
2627 // So 32 should be enough!
2628 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
2629 // The response (tag -> reader) that we're receiving.
2630 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
2631
2632 // As we receive stuff, we copy it from receivedCmd or receivedResponse
2633 // into trace, along with its length and other annotations.
2634 //uint8_t *trace = (uint8_t *)BigBuf;
2635
2636 // The DMA buffer, used to stream samples from the FPGA
7bc95e2e 2637 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
2638 uint8_t *data = dmaBuf;
2639 uint8_t previous_data = 0;
5cd9ec01
M
2640 int maxDataLen = 0;
2641 int dataLen = 0;
7bc95e2e 2642 bool ReaderIsActive = FALSE;
2643 bool TagIsActive = FALSE;
2644
2645 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
b62a5a84
M
2646
2647 // Set up the demodulator for tag -> reader responses.
2648 Demod.output = receivedResponse;
b62a5a84
M
2649
2650 // Set up the demodulator for the reader -> tag commands
b62a5a84 2651 Uart.output = receivedCmd;
b62a5a84
M
2652
2653 // Setup for the DMA.
7bc95e2e 2654 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
b62a5a84 2655
b62a5a84 2656 LED_D_OFF();
39864b0b
M
2657
2658 // init sniffer
2659 MfSniffInit();
b62a5a84 2660
b62a5a84 2661 // And now we loop, receiving samples.
7bc95e2e 2662 for(uint32_t sniffCounter = 0; TRUE; ) {
2663
5cd9ec01
M
2664 if(BUTTON_PRESS()) {
2665 DbpString("cancelled by button");
7bc95e2e 2666 break;
5cd9ec01
M
2667 }
2668
b62a5a84
M
2669 LED_A_ON();
2670 WDT_HIT();
39864b0b 2671
7bc95e2e 2672 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
2673 // check if a transaction is completed (timeout after 2000ms).
2674 // if yes, stop the DMA transfer and send what we have so far to the client
2675 if (MfSniffSend(2000)) {
2676 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2677 sniffCounter = 0;
2678 data = dmaBuf;
2679 maxDataLen = 0;
2680 ReaderIsActive = FALSE;
2681 TagIsActive = FALSE;
2682 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
39864b0b 2683 }
39864b0b 2684 }
7bc95e2e 2685
2686 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
2687 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
2688 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
2689 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
2690 } else {
2691 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
5cd9ec01
M
2692 }
2693 // test for length of buffer
7bc95e2e 2694 if(dataLen > maxDataLen) { // we are more behind than ever...
2695 maxDataLen = dataLen;
5cd9ec01
M
2696 if(dataLen > 400) {
2697 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
7bc95e2e 2698 break;
b62a5a84
M
2699 }
2700 }
5cd9ec01 2701 if(dataLen < 1) continue;
b62a5a84 2702
7bc95e2e 2703 // primary buffer was stopped ( <-- we lost data!
5cd9ec01
M
2704 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
2705 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
2706 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
55acbb2a 2707 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
5cd9ec01
M
2708 }
2709 // secondary buffer sets as primary, secondary buffer was stopped
2710 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
2711 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
b62a5a84
M
2712 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
2713 }
5cd9ec01
M
2714
2715 LED_A_OFF();
b62a5a84 2716
7bc95e2e 2717 if (sniffCounter & 0x01) {
b62a5a84 2718
7bc95e2e 2719 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
2720 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
2721 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
2722 LED_C_INV();
2723 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parityBits, Uart.bitCount, TRUE)) break;
b62a5a84 2724
7bc95e2e 2725 /* And ready to receive another command. */
2726 UartReset();
2727
2728 /* And also reset the demod code */
2729 DemodReset();
2730 }
2731 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
2732 }
2733
2734 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
2735 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
2736 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
2737 LED_C_INV();
b62a5a84 2738
7bc95e2e 2739 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;
39864b0b 2740
7bc95e2e 2741 // And ready to receive another response.
2742 DemodReset();
2743 }
2744 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
2745 }
b62a5a84
M
2746 }
2747
7bc95e2e 2748 previous_data = *data;
2749 sniffCounter++;
5cd9ec01 2750 data++;
d714d3ef 2751 if(data == dmaBuf + DMA_BUFFER_SIZE) {
5cd9ec01 2752 data = dmaBuf;
b62a5a84 2753 }
7bc95e2e 2754
b62a5a84
M
2755 } // main cycle
2756
2757 DbpString("COMMAND FINISHED");
2758
55acbb2a 2759 FpgaDisableSscDma();
39864b0b
M
2760 MfSniffEnd();
2761
7bc95e2e 2762 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
b62a5a84 2763 LEDsoff();
3803d529 2764}
Impressum, Datenschutz