]>
Commit | Line | Data |
---|---|---|
489ef36c | 1 | //----------------------------------------------------------------------------- |
2 | // Jonathan Westhues, split Nov 2006 | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
abb21530 | 8 | // Routines to support ISO 14443B. This includes both the reader software and |
9 | // the `fake tag' modes. | |
489ef36c | 10 | //----------------------------------------------------------------------------- |
6fc68747 | 11 | #include "iso14443b.h" |
489ef36c | 12 | |
11c2df83 | 13 | #define RECEIVE_SAMPLES_TIMEOUT 50000 |
a62bf3af | 14 | #define ISO14443B_DMA_BUFFER_SIZE 256 |
489ef36c | 15 | |
11c2df83 | 16 | // Guard Time (per 14443-2) |
17 | #define TR0 0 | |
18 | // Synchronization time (per 14443-2) | |
19 | #define TR1 0 | |
20 | // Frame Delay Time PICC to PCD (per 14443-3 Amendment 1) | |
21 | #define TR2 0 | |
22 | static void switch_off(void); | |
23 | ||
6fc68747 | 24 | // the block number for the ISO14443-4 PCB (used with APDUs) |
a62bf3af | 25 | static uint8_t pcb_blocknum = 0; |
26 | ||
11c2df83 | 27 | static uint32_t iso14b_timeout = RECEIVE_SAMPLES_TIMEOUT; |
28 | // param timeout is in ftw_ | |
29 | void iso14b_set_timeout(uint32_t timeout) { | |
30 | // 9.4395us = 1etu. | |
31 | // clock is about 1.5 us | |
32 | iso14b_timeout = timeout; | |
33 | if(MF_DBGLEVEL >= 2) Dbprintf("ISO14443B Timeout set to %ld fwt", iso14b_timeout); | |
34 | } | |
35 | ||
36 | static void switch_off(void){ | |
37 | if (MF_DBGLEVEL > 3) Dbprintf("switch_off"); | |
38 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
39 | SpinDelay(100); | |
40 | FpgaDisableSscDma(); | |
41 | set_tracing(FALSE); | |
42 | LEDsoff(); | |
43 | } | |
44 | ||
489ef36c | 45 | //============================================================================= |
46 | // An ISO 14443 Type B tag. We listen for commands from the reader, using | |
47 | // a UART kind of thing that's implemented in software. When we get a | |
48 | // frame (i.e., a group of bytes between SOF and EOF), we check the CRC. | |
49 | // If it's good, then we can do something appropriate with it, and send | |
50 | // a response. | |
51 | //============================================================================= | |
52 | ||
cef590d9 | 53 | |
54 | //----------------------------------------------------------------------------- | |
11c2df83 | 55 | // The software UART that receives commands from the reader, and its state variables. |
cef590d9 | 56 | //----------------------------------------------------------------------------- |
57 | static struct { | |
58 | enum { | |
59 | STATE_UNSYNCD, | |
60 | STATE_GOT_FALLING_EDGE_OF_SOF, | |
61 | STATE_AWAITING_START_BIT, | |
62 | STATE_RECEIVING_DATA | |
63 | } state; | |
11c2df83 | 64 | uint16_t shiftReg; |
65 | int bitCnt; | |
66 | int byteCnt; | |
67 | int byteCntMax; | |
68 | int posCnt; | |
69 | uint8_t *output; | |
cef590d9 | 70 | } Uart; |
71 | ||
11c2df83 | 72 | static void UartReset() { |
cef590d9 | 73 | Uart.state = STATE_UNSYNCD; |
11c2df83 | 74 | Uart.shiftReg = 0; |
cef590d9 | 75 | Uart.bitCnt = 0; |
11c2df83 | 76 | Uart.byteCnt = 0; |
77 | Uart.byteCntMax = MAX_FRAME_SIZE; | |
cef590d9 | 78 | Uart.posCnt = 0; |
cef590d9 | 79 | } |
80 | ||
11c2df83 | 81 | static void UartInit(uint8_t *data) { |
cef590d9 | 82 | Uart.output = data; |
83 | UartReset(); | |
11c2df83 | 84 | // memset(Uart.output, 0x00, MAX_FRAME_SIZE); |
cef590d9 | 85 | } |
86 | ||
11c2df83 | 87 | //----------------------------------------------------------------------------- |
88 | // The software Demod that receives commands from the tag, and its state variables. | |
89 | //----------------------------------------------------------------------------- | |
cef590d9 | 90 | static struct { |
91 | enum { | |
92 | DEMOD_UNSYNCD, | |
93 | DEMOD_PHASE_REF_TRAINING, | |
94 | DEMOD_AWAITING_FALLING_EDGE_OF_SOF, | |
95 | DEMOD_GOT_FALLING_EDGE_OF_SOF, | |
96 | DEMOD_AWAITING_START_BIT, | |
97 | DEMOD_RECEIVING_DATA | |
98 | } state; | |
11c2df83 | 99 | uint16_t bitCount; |
100 | int posCount; | |
101 | int thisBit; | |
cef590d9 | 102 | /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented. |
103 | int metric; | |
104 | int metricN; | |
105 | */ | |
11c2df83 | 106 | uint16_t shiftReg; |
107 | uint8_t *output; | |
108 | uint16_t len; | |
109 | int sumI; | |
110 | int sumQ; | |
111 | uint32_t startTime, endTime; | |
cef590d9 | 112 | } Demod; |
113 | ||
11c2df83 | 114 | // Clear out the state of the "UART" that receives from the tag. |
115 | static void DemodReset() { | |
cef590d9 | 116 | Demod.state = DEMOD_UNSYNCD; |
cef590d9 | 117 | Demod.bitCount = 0; |
11c2df83 | 118 | Demod.posCount = 0; |
cef590d9 | 119 | Demod.thisBit = 0; |
120 | Demod.shiftReg = 0; | |
11c2df83 | 121 | Demod.len = 0; |
122 | Demod.sumI = 0; | |
123 | Demod.sumQ = 0; | |
124 | Demod.startTime = 0; | |
125 | Demod.endTime = 0; | |
cef590d9 | 126 | } |
127 | ||
11c2df83 | 128 | static void DemodInit(uint8_t *data) { |
cef590d9 | 129 | Demod.output = data; |
130 | DemodReset(); | |
11c2df83 | 131 | // memset(Demod.output, 0x00, MAX_FRAME_SIZE); |
cef590d9 | 132 | } |
133 | ||
11c2df83 | 134 | void AppendCrc14443b(uint8_t* data, int len) { |
dccddaef | 135 | ComputeCrc14443(CRC_14443_B, data, len, data+len, data+len+1); |
6fc68747 | 136 | } |
137 | ||
489ef36c | 138 | //----------------------------------------------------------------------------- |
139 | // Code up a string of octets at layer 2 (including CRC, we don't generate | |
140 | // that here) so that they can be transmitted to the reader. Doesn't transmit | |
141 | // them yet, just leaves them ready to send in ToSend[]. | |
142 | //----------------------------------------------------------------------------- | |
11c2df83 | 143 | static void CodeIso14443bAsTag(const uint8_t *cmd, int len) { |
144 | /* ISO 14443 B | |
145 | * | |
146 | * Reader to card | ASK - Amplitude Shift Keying Modulation (PCD to PICC for Type B) (NRZ-L encodig) | |
147 | * Card to reader | BPSK - Binary Phase Shift Keying Modulation, (PICC to PCD for Type B) | |
148 | * | |
149 | * fc - carrier frequency 13.56mHz | |
150 | * TR0 - Guard Time per 14443-2 | |
151 | * TR1 - Synchronization Time per 14443-2 | |
152 | * TR2 - PICC to PCD Frame Delay Time (per 14443-3 Amendment 1) | |
153 | * | |
154 | * Elementary Time Unit (ETU) is | |
155 | * - 128 Carrier Cycles (9.4395 µS) = 8 Subcarrier Units | |
156 | * - 1 ETU = 1 bit | |
157 | * - 10 ETU = 1 startbit, 8 databits, 1 stopbit (10bits length) | |
158 | * - startbit is a 0 | |
159 | * - stopbit is a 1 | |
160 | * | |
161 | * Start of frame (SOF) is | |
162 | * - [10-11] ETU of ZEROS, unmodulated time | |
163 | * - [2-3] ETU of ONES, | |
164 | * | |
165 | * End of frame (EOF) is | |
166 | * - [10-11] ETU of ZEROS, unmodulated time | |
167 | * | |
168 | * -TO VERIFY THIS BELOW- | |
169 | * The mode FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK which we use to simulate tag | |
170 | * works like this: | |
171 | * - A 1-bit input to the FPGA becomes 8 pulses at 847.5kHz (9.44µS) | |
172 | * - A 0-bit input to the FPGA becomes an unmodulated time of 9.44µS | |
173 | * | |
174 | * | |
175 | * | |
176 | * Card sends data ub 847.e kHz subcarrier | |
177 | * 848k = 9.44µS = 128 fc | |
178 | * 424k = 18.88µS = 256 fc | |
179 | * 212k = 37.76µS = 512 fc | |
180 | * 106k = 75.52µS = 1024 fc | |
181 | * | |
182 | * Reader data transmission: | |
183 | * - no modulation ONES | |
184 | * - SOF | |
185 | * - Command, data and CRC_B | |
186 | * - EOF | |
187 | * - no modulation ONES | |
188 | * | |
189 | * Card data transmission | |
190 | * - TR1 | |
191 | * - SOF | |
192 | * - data (each bytes is: 1startbit,8bits, 1stopbit) | |
193 | * - CRC_B | |
194 | * - EOF | |
195 | * | |
196 | * FPGA implementation : | |
197 | * At this point only Type A is implemented. This means that we are using a | |
198 | * bit rate of 106 kbit/s, or fc/128. Oversample by 4, which ought to make | |
199 | * things practical for the ARM (fc/32, 423.8 kbits/s, ~50 kbytes/s) | |
200 | * | |
201 | */ | |
202 | ||
203 | // ToSendStuffBit, 40 calls | |
204 | // 1 ETU = 1startbit, 1stopbit, 8databits == 10bits. | |
205 | // 1 ETU = 10 * 4 == 40 stuffbits ( ETU_TAG_BIT ) | |
206 | int i,j; | |
207 | uint8_t b; | |
208 | ||
489ef36c | 209 | ToSendReset(); |
210 | ||
211 | // Transmit a burst of ones, as the initial thing that lets the | |
11c2df83 | 212 | // reader get phase sync. |
213 | // This loop is TR1, per specification | |
214 | // TR1 minimum must be > 80/fs | |
215 | // TR1 maximum 200/fs | |
216 | // 80/fs < TR1 < 200/fs | |
217 | // 10 ETU < TR1 < 24 ETU | |
489ef36c | 218 | |
219 | // Send SOF. | |
11c2df83 | 220 | // 10-11 ETU * 4times samples ZEROS |
489ef36c | 221 | for(i = 0; i < 10; i++) { |
222 | ToSendStuffBit(0); | |
223 | ToSendStuffBit(0); | |
224 | ToSendStuffBit(0); | |
225 | ToSendStuffBit(0); | |
226 | } | |
11c2df83 | 227 | |
228 | // 2-3 ETU * 4times samples ONES | |
229 | for(i = 0; i < 3; i++) { | |
489ef36c | 230 | ToSendStuffBit(1); |
231 | ToSendStuffBit(1); | |
232 | ToSendStuffBit(1); | |
233 | ToSendStuffBit(1); | |
234 | } | |
11c2df83 | 235 | |
236 | // data | |
237 | for(i = 0; i < len; ++i) { | |
238 | ||
489ef36c | 239 | // Start bit |
240 | ToSendStuffBit(0); | |
241 | ToSendStuffBit(0); | |
242 | ToSendStuffBit(0); | |
243 | ToSendStuffBit(0); | |
244 | ||
245 | // Data bits | |
11c2df83 | 246 | b = cmd[i]; |
247 | for(j = 0; j < 8; ++j) { | |
489ef36c | 248 | if(b & 1) { |
249 | ToSendStuffBit(1); | |
250 | ToSendStuffBit(1); | |
251 | ToSendStuffBit(1); | |
252 | ToSendStuffBit(1); | |
253 | } else { | |
254 | ToSendStuffBit(0); | |
255 | ToSendStuffBit(0); | |
256 | ToSendStuffBit(0); | |
257 | ToSendStuffBit(0); | |
258 | } | |
259 | b >>= 1; | |
260 | } | |
261 | ||
262 | // Stop bit | |
263 | ToSendStuffBit(1); | |
264 | ToSendStuffBit(1); | |
265 | ToSendStuffBit(1); | |
266 | ToSendStuffBit(1); | |
11c2df83 | 267 | |
268 | // Extra Guard bit | |
269 | // For PICC it ranges 0-18us (1etu = 9us) | |
270 | ToSendStuffBit(1); | |
271 | ToSendStuffBit(1); | |
272 | ToSendStuffBit(1); | |
273 | ToSendStuffBit(1); | |
489ef36c | 274 | } |
275 | ||
abb21530 | 276 | // Send EOF. |
11c2df83 | 277 | // 10-11 ETU * 4 sample rate = ZEROS |
489ef36c | 278 | for(i = 0; i < 10; i++) { |
279 | ToSendStuffBit(0); | |
280 | ToSendStuffBit(0); | |
281 | ToSendStuffBit(0); | |
282 | ToSendStuffBit(0); | |
283 | } | |
11c2df83 | 284 | |
285 | // why this? | |
286 | for(i = 0; i < 40; i++) { | |
489ef36c | 287 | ToSendStuffBit(1); |
288 | ToSendStuffBit(1); | |
289 | ToSendStuffBit(1); | |
290 | ToSendStuffBit(1); | |
291 | } | |
11c2df83 | 292 | |
489ef36c | 293 | // Convert from last byte pos to length |
6fc68747 | 294 | ++ToSendMax; |
489ef36c | 295 | } |
296 | ||
cef590d9 | 297 | |
489ef36c | 298 | /* Receive & handle a bit coming from the reader. |
abb21530 | 299 | * |
300 | * This function is called 4 times per bit (every 2 subcarrier cycles). | |
301 | * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us | |
489ef36c | 302 | * |
303 | * LED handling: | |
304 | * LED A -> ON once we have received the SOF and are expecting the rest. | |
305 | * LED A -> OFF once we have received EOF or are in error state or unsynced | |
306 | * | |
307 | * Returns: true if we received a EOF | |
308 | * false if we are still waiting for some more | |
309 | */ | |
11c2df83 | 310 | static RAMFUNC int Handle14443bReaderUartBit(uint8_t bit) { |
489ef36c | 311 | switch(Uart.state) { |
312 | case STATE_UNSYNCD: | |
489ef36c | 313 | if(!bit) { |
dccddaef | 314 | // we went low, so this could be the beginning of an SOF |
489ef36c | 315 | Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF; |
316 | Uart.posCnt = 0; | |
317 | Uart.bitCnt = 0; | |
318 | } | |
319 | break; | |
320 | ||
321 | case STATE_GOT_FALLING_EDGE_OF_SOF: | |
322 | Uart.posCnt++; | |
abb21530 | 323 | if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit |
489ef36c | 324 | if(bit) { |
abb21530 | 325 | if(Uart.bitCnt > 9) { |
489ef36c | 326 | // we've seen enough consecutive |
327 | // zeros that it's a valid SOF | |
328 | Uart.posCnt = 0; | |
329 | Uart.byteCnt = 0; | |
330 | Uart.state = STATE_AWAITING_START_BIT; | |
331 | LED_A_ON(); // Indicate we got a valid SOF | |
332 | } else { | |
333 | // didn't stay down long enough | |
334 | // before going high, error | |
36f84d47 | 335 | Uart.state = STATE_UNSYNCD; |
489ef36c | 336 | } |
337 | } else { | |
338 | // do nothing, keep waiting | |
339 | } | |
340 | Uart.bitCnt++; | |
341 | } | |
342 | if(Uart.posCnt >= 4) Uart.posCnt = 0; | |
abb21530 | 343 | if(Uart.bitCnt > 12) { |
489ef36c | 344 | // Give up if we see too many zeros without |
345 | // a one, too. | |
36f84d47 | 346 | LED_A_OFF(); |
347 | Uart.state = STATE_UNSYNCD; | |
489ef36c | 348 | } |
349 | break; | |
350 | ||
351 | case STATE_AWAITING_START_BIT: | |
352 | Uart.posCnt++; | |
353 | if(bit) { | |
abb21530 | 354 | if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs |
489ef36c | 355 | // stayed high for too long between |
356 | // characters, error | |
36f84d47 | 357 | Uart.state = STATE_UNSYNCD; |
489ef36c | 358 | } |
359 | } else { | |
360 | // falling edge, this starts the data byte | |
361 | Uart.posCnt = 0; | |
362 | Uart.bitCnt = 0; | |
363 | Uart.shiftReg = 0; | |
364 | Uart.state = STATE_RECEIVING_DATA; | |
489ef36c | 365 | } |
366 | break; | |
367 | ||
368 | case STATE_RECEIVING_DATA: | |
369 | Uart.posCnt++; | |
370 | if(Uart.posCnt == 2) { | |
371 | // time to sample a bit | |
372 | Uart.shiftReg >>= 1; | |
373 | if(bit) { | |
374 | Uart.shiftReg |= 0x200; | |
375 | } | |
376 | Uart.bitCnt++; | |
377 | } | |
378 | if(Uart.posCnt >= 4) { | |
379 | Uart.posCnt = 0; | |
380 | } | |
381 | if(Uart.bitCnt == 10) { | |
382 | if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001)) | |
383 | { | |
384 | // this is a data byte, with correct | |
385 | // start and stop bits | |
386 | Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff; | |
387 | Uart.byteCnt++; | |
388 | ||
389 | if(Uart.byteCnt >= Uart.byteCntMax) { | |
390 | // Buffer overflowed, give up | |
36f84d47 | 391 | LED_A_OFF(); |
392 | Uart.state = STATE_UNSYNCD; | |
489ef36c | 393 | } else { |
394 | // so get the next byte now | |
395 | Uart.posCnt = 0; | |
396 | Uart.state = STATE_AWAITING_START_BIT; | |
397 | } | |
46734099 | 398 | } else if (Uart.shiftReg == 0x000) { |
489ef36c | 399 | // this is an EOF byte |
400 | LED_A_OFF(); // Finished receiving | |
36f84d47 | 401 | Uart.state = STATE_UNSYNCD; |
22e24700 | 402 | if (Uart.byteCnt != 0) { |
489ef36c | 403 | return TRUE; |
22e24700 | 404 | } |
489ef36c | 405 | } else { |
406 | // this is an error | |
36f84d47 | 407 | LED_A_OFF(); |
46734099 | 408 | Uart.state = STATE_UNSYNCD; |
36f84d47 | 409 | } |
489ef36c | 410 | } |
411 | break; | |
412 | ||
413 | default: | |
36f84d47 | 414 | LED_A_OFF(); |
489ef36c | 415 | Uart.state = STATE_UNSYNCD; |
416 | break; | |
417 | } | |
418 | ||
489ef36c | 419 | return FALSE; |
420 | } | |
421 | ||
422 | //----------------------------------------------------------------------------- | |
423 | // Receive a command (from the reader to us, where we are the simulated tag), | |
424 | // and store it in the given buffer, up to the given maximum length. Keeps | |
425 | // spinning, waiting for a well-framed command, until either we get one | |
426 | // (returns TRUE) or someone presses the pushbutton on the board (FALSE). | |
427 | // | |
428 | // Assume that we're called with the SSC (to the FPGA) and ADC path set | |
429 | // correctly. | |
430 | //----------------------------------------------------------------------------- | |
11c2df83 | 431 | static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len) { |
abb21530 | 432 | // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen |
489ef36c | 433 | // only, since we are receiving, not transmitting). |
434 | // Signal field is off with the appropriate LED | |
435 | LED_D_OFF(); | |
436 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION); | |
11c2df83 | 437 | |
438 | StartCountSspClk(); | |
439 | ||
489ef36c | 440 | // Now run a `software UART' on the stream of incoming samples. |
36f84d47 | 441 | UartInit(received); |
dccddaef | 442 | |
443 | uint8_t mask, b = 0; | |
444 | while( !BUTTON_PRESS() ) { | |
489ef36c | 445 | WDT_HIT(); |
446 | ||
dccddaef | 447 | if ( AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY ) { |
448 | b = (uint8_t) AT91C_BASE_SSC->SSC_RHR; | |
449 | for ( mask = 0x80; mask != 0; mask >>= 1) { | |
450 | if ( Handle14443bReaderUartBit(b & mask)) { | |
489ef36c | 451 | *len = Uart.byteCnt; |
452 | return TRUE; | |
453 | } | |
454 | } | |
455 | } | |
11c2df83 | 456 | } |
36f84d47 | 457 | return FALSE; |
489ef36c | 458 | } |
459 | ||
dccddaef | 460 | |
461 | static void TransmitFor14443b_AsTag( uint8_t *response, uint16_t len) { | |
462 | ||
463 | // Signal field is off with the appropriate LED | |
464 | LED_D_OFF(); | |
465 | ||
466 | // Modulate BPSK | |
467 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK); | |
468 | ||
469 | // 8 ETU / 8bits. 8/4= 2 etus. | |
470 | AT91C_BASE_SSC->SSC_THR = 0XFF; | |
471 | ||
472 | FpgaSetupSsc(); | |
473 | ||
474 | // Transmit the response. | |
475 | for(uint16_t i = 0; i < len;) { | |
476 | if(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) { | |
477 | AT91C_BASE_SSC->SSC_THR = response[i]; | |
478 | ++i; | |
479 | } | |
480 | } | |
481 | } | |
489ef36c | 482 | //----------------------------------------------------------------------------- |
483 | // Main loop of simulated tag: receive commands from reader, decide what | |
484 | // response to send, and send it. | |
485 | //----------------------------------------------------------------------------- | |
dccddaef | 486 | void SimulateIso14443bTag(uint32_t pupi) { |
b10a759f | 487 | // the only commands we understand is WUPB, AFI=0, Select All, N=1: |
6fc68747 | 488 | static const uint8_t cmd1[] = { ISO14443B_REQB, 0x00, 0x08, 0x39, 0x73 }; // WUPB |
b10a759f | 489 | // ... and REQB, AFI=0, Normal Request, N=1: |
6fc68747 | 490 | static const uint8_t cmd2[] = { ISO14443B_REQB, 0x00, 0x00, 0x71, 0xFF }; // REQB |
b10a759f | 491 | // ... and ATTRIB |
6fc68747 | 492 | static const uint8_t cmd4[] = { ISO14443B_ATTRIB, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB |
36f84d47 | 493 | |
dccddaef | 494 | // ... if not PUPI/UID is supplied we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922, |
abb21530 | 495 | // supports only 106kBit/s in both directions, max frame size = 32Bytes, |
496 | // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported: | |
dccddaef | 497 | uint8_t response1[] = { |
489ef36c | 498 | 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22, |
499 | 0x00, 0x21, 0x85, 0x5e, 0xd7 | |
500 | }; | |
b10a759f | 501 | // response to HLTB and ATTRIB |
502 | static const uint8_t response2[] = {0x00, 0x78, 0xF0}; | |
dccddaef | 503 | |
504 | // PUPI/UID supplied | |
505 | if ( pupi > 0 ) { | |
506 | uint8_t len = sizeof(response1); | |
507 | num_to_bytes(pupi, 4, response1+1); | |
508 | ComputeCrc14443(CRC_14443_B, response1, len-2, response1+len-2, response1+len-1); | |
509 | //print it.. | |
510 | } | |
511 | ||
512 | uint16_t len, cmdsRecvd = 0; | |
513 | uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE); | |
514 | ||
515 | uint8_t *resp1Code; | |
516 | uint8_t *resp2Code; | |
517 | uint16_t resp1CodeLen, resp2CodeLen; | |
518 | ||
519 | // uint32_t time_0 = 0; | |
520 | // uint32_t t2r_time = 0; | |
521 | // uint32_t r2t_time = 0; | |
522 | ||
523 | int cardSTATE = MFEMUL_NOFIELD; | |
524 | int vHf = 0; // in mV | |
525 | ||
99cf19d9 | 526 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
527 | ||
11c2df83 | 528 | // allocate command receive buffer |
529 | BigBuf_free(); | |
530 | BigBuf_Clear_ext(false); | |
531 | clear_trace(); //sim | |
36f84d47 | 532 | set_tracing(TRUE); |
11c2df83 | 533 | |
dccddaef | 534 | // connect Demodulated Signal to ADC: |
535 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
536 | ||
537 | // Set up the synchronous serial port | |
538 | FpgaSetupSsc(); | |
539 | ||
abb21530 | 540 | // prepare the (only one) tag answer: |
489ef36c | 541 | CodeIso14443bAsTag(response1, sizeof(response1)); |
dccddaef | 542 | resp1Code = BigBuf_malloc(ToSendMax); |
543 | resp1CodeLen = ToSendMax; | |
36f84d47 | 544 | memcpy(resp1Code, ToSend, ToSendMax); |
dccddaef | 545 | |
11c2df83 | 546 | |
b10a759f | 547 | // prepare the (other) tag answer: |
548 | CodeIso14443bAsTag(response2, sizeof(response2)); | |
dccddaef | 549 | resp2Code = BigBuf_malloc(ToSendMax); |
550 | resp2CodeLen = ToSendMax; | |
b10a759f | 551 | memcpy(resp2Code, ToSend, ToSendMax); |
11c2df83 | 552 | |
dccddaef | 553 | |
554 | while (!BUTTON_PRESS() && !usb_poll_validate_length()) { | |
555 | WDT_HIT(); | |
489ef36c | 556 | |
dccddaef | 557 | // find reader field |
558 | if (cardSTATE == MFEMUL_NOFIELD) { | |
559 | vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10; | |
560 | if ( vHf > MF_MINFIELDV ) | |
561 | cardSTATE = MFEMUL_IDLE; | |
562 | } | |
563 | if (cardSTATE == MFEMUL_NOFIELD) continue; | |
489ef36c | 564 | |
dccddaef | 565 | |
810f5379 | 566 | if (!GetIso14443bCommandFromReader(receivedCmd, &len)) { |
567 | Dbprintf("button pressed, received %d commands", cmdsRecvd); | |
568 | break; | |
489ef36c | 569 | } |
570 | ||
dccddaef | 571 | // REQ or WUP request in ANY state and WUP in HALTED state |
572 | if (len == 5 && ( | |
573 | (receivedCmd[0] == ISO14443B_REQB && cardSTATE != MFEMUL_HALTED) || | |
574 | receivedCmd[0] == ISO14443A_CMD_WUPA | |
575 | ) | |
576 | ) { | |
577 | TransmitFor14443b_AsTag( resp1Code, resp1CodeLen ); | |
578 | LogTrace(response1, sizeof(response1), 0, 0, NULL, FALSE); | |
579 | cardSTATE = MFEMUL_SELECT1; | |
580 | continue; | |
581 | } | |
cef590d9 | 582 | |
dccddaef | 583 | if ( (len == 5 && memcmp(receivedCmd, cmd1, len) == 0) || |
584 | (len == 5 && memcmp(receivedCmd, cmd2, len) == 0) ) { | |
585 | //WUPB && REQB | |
586 | cardSTATE = MFEMUL_SELECT1; | |
587 | } else if ( len == 7 && receivedCmd[0] == ISO14443B_HALT ) { | |
588 | cardSTATE = MFEMUL_HALTED; | |
589 | } else if ( len == sizeof(cmd4) && receivedCmd[0] == ISO14443B_ATTRIB ) { | |
590 | cardSTATE = MFEMUL_SELECT2; | |
489ef36c | 591 | } else { |
dccddaef | 592 | // SLOT MARKER command?!? |
593 | // ISO7816?!? | |
489ef36c | 594 | Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd); |
6fc68747 | 595 | |
dccddaef | 596 | // CRC Check |
36f84d47 | 597 | uint8_t b1, b2; |
b10a759f | 598 | if (len >= 3){ // if crc exists |
810f5379 | 599 | ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2); |
11c2df83 | 600 | if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) |
810f5379 | 601 | DbpString("+++CRC fail"); |
11c2df83 | 602 | else |
810f5379 | 603 | DbpString("CRC passes"); |
b10a759f | 604 | } |
dccddaef | 605 | cardSTATE = MFEMUL_IDLE; |
489ef36c | 606 | } |
607 | ||
dccddaef | 608 | switch(cardSTATE){ |
609 | case MFEMUL_NOFIELD: | |
610 | case MFEMUL_HALTED: | |
611 | case MFEMUL_IDLE:{ | |
612 | LogTrace(receivedCmd, len, 0, 0, NULL, TRUE); | |
613 | break; | |
614 | } | |
615 | case MFEMUL_SELECT1: | |
616 | TransmitFor14443b_AsTag( resp1Code, resp1CodeLen ); | |
617 | LogTrace(response1, sizeof(response1), 0, 0, NULL, FALSE); | |
618 | cardSTATE = MFEMUL_WORK; | |
619 | break; | |
620 | case MFEMUL_SELECT2: | |
621 | TransmitFor14443b_AsTag( resp2Code, resp2CodeLen ); | |
622 | LogTrace(response2, sizeof(response2), 0, 0, NULL, FALSE); | |
623 | cardSTATE = MFEMUL_HALTED; | |
624 | break; | |
625 | case MFEMUL_WORK: | |
626 | break; | |
627 | } | |
628 | ||
6fc68747 | 629 | ++cmdsRecvd; |
11c2df83 | 630 | if(cmdsRecvd > 1000) { |
dccddaef | 631 | DbpString("14B Simulate, 1000 commands later..."); |
489ef36c | 632 | break; |
633 | } | |
489ef36c | 634 | } |
dccddaef | 635 | if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen()); |
636 | ||
11c2df83 | 637 | switch_off(); //simulate |
489ef36c | 638 | } |
639 | ||
640 | //============================================================================= | |
641 | // An ISO 14443 Type B reader. We take layer two commands, code them | |
642 | // appropriately, and then send them to the tag. We then listen for the | |
643 | // tag's response, which we leave in the buffer to be demodulated on the | |
644 | // PC side. | |
645 | //============================================================================= | |
646 | ||
489ef36c | 647 | /* |
648 | * Handles reception of a bit from the tag | |
649 | * | |
abb21530 | 650 | * This function is called 2 times per bit (every 4 subcarrier cycles). |
651 | * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us | |
652 | * | |
489ef36c | 653 | * LED handling: |
654 | * LED C -> ON once we have received the SOF and are expecting the rest. | |
655 | * LED C -> OFF once we have received EOF or are unsynced | |
656 | * | |
657 | * Returns: true if we received a EOF | |
658 | * false if we are still waiting for some more | |
659 | * | |
660 | */ | |
cef590d9 | 661 | #ifndef SUBCARRIER_DETECT_THRESHOLD |
11c2df83 | 662 | # define SUBCARRIER_DETECT_THRESHOLD 8 |
cef590d9 | 663 | #endif |
664 | ||
11c2df83 | 665 | static RAMFUNC int Handle14443bTagSamplesDemod(int ci, int cq) { |
666 | int v=0;// , myI, myQ = 0; | |
51d4f6f1 | 667 | // The soft decision on the bit uses an estimate of just the |
668 | // quadrant of the reference angle, not the exact angle. | |
489ef36c | 669 | #define MAKE_SOFT_DECISION() { \ |
5b59bf20 | 670 | if(Demod.sumI > 0) { \ |
671 | v = ci; \ | |
672 | } else { \ | |
673 | v = -ci; \ | |
674 | } \ | |
489ef36c | 675 | if(Demod.sumQ > 0) { \ |
676 | v += cq; \ | |
677 | } else { \ | |
678 | v -= cq; \ | |
679 | } \ | |
680 | } | |
681 | ||
cef590d9 | 682 | // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq) |
abb21530 | 683 | // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq))) |
684 | #define CHECK_FOR_SUBCARRIER() { \ | |
cef590d9 | 685 | if(ci < 0) { \ |
686 | if(cq < 0) { /* ci < 0, cq < 0 */ \ | |
687 | if (cq < ci) { \ | |
688 | v = -cq - (ci >> 1); \ | |
689 | } else { \ | |
690 | v = -ci - (cq >> 1); \ | |
691 | } \ | |
692 | } else { /* ci < 0, cq >= 0 */ \ | |
693 | if (cq < -ci) { \ | |
694 | v = -ci + (cq >> 1); \ | |
695 | } else { \ | |
696 | v = cq - (ci >> 1); \ | |
697 | } \ | |
698 | } \ | |
699 | } else { \ | |
700 | if(cq < 0) { /* ci >= 0, cq < 0 */ \ | |
701 | if (-cq < ci) { \ | |
702 | v = ci - (cq >> 1); \ | |
703 | } else { \ | |
704 | v = -cq + (ci >> 1); \ | |
705 | } \ | |
706 | } else { /* ci >= 0, cq >= 0 */ \ | |
707 | if (cq < ci) { \ | |
708 | v = ci + (cq >> 1); \ | |
709 | } else { \ | |
710 | v = cq + (ci >> 1); \ | |
711 | } \ | |
712 | } \ | |
713 | } \ | |
714 | } | |
db25599d | 715 | |
6fc68747 | 716 | //note: couldn't we just use MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2) from common.h - marshmellow |
11c2df83 | 717 | #define CHECK_FOR_SUBCARRIER_un() { \ |
718 | myI = ABS(ci); \ | |
719 | myQ = ABS(cq); \ | |
720 | v = MAX(myI,myQ) + (MIN(myI,myQ) >> 1); \ | |
6fc68747 | 721 | } |
db25599d | 722 | |
489ef36c | 723 | switch(Demod.state) { |
724 | case DEMOD_UNSYNCD: | |
cef590d9 | 725 | |
abb21530 | 726 | CHECK_FOR_SUBCARRIER(); |
cef590d9 | 727 | |
728 | // subcarrier detected | |
729 | if(v > SUBCARRIER_DETECT_THRESHOLD) { | |
489ef36c | 730 | Demod.state = DEMOD_PHASE_REF_TRAINING; |
abb21530 | 731 | Demod.sumI = ci; |
732 | Demod.sumQ = cq; | |
733 | Demod.posCount = 1; | |
489ef36c | 734 | } |
735 | break; | |
736 | ||
737 | case DEMOD_PHASE_REF_TRAINING: | |
5b59bf20 | 738 | if(Demod.posCount < 8) { |
cef590d9 | 739 | |
abb21530 | 740 | CHECK_FOR_SUBCARRIER(); |
cef590d9 | 741 | |
abb21530 | 742 | if (v > SUBCARRIER_DETECT_THRESHOLD) { |
743 | // set the reference phase (will code a logic '1') by averaging over 32 1/fs. | |
744 | // note: synchronization time > 80 1/fs | |
b10a759f | 745 | Demod.sumI += ci; |
746 | Demod.sumQ += cq; | |
cef590d9 | 747 | ++Demod.posCount; |
748 | } else { | |
749 | // subcarrier lost | |
b10a759f | 750 | Demod.state = DEMOD_UNSYNCD; |
abb21530 | 751 | } |
489ef36c | 752 | } else { |
b10a759f | 753 | Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF; |
489ef36c | 754 | } |
489ef36c | 755 | break; |
756 | ||
757 | case DEMOD_AWAITING_FALLING_EDGE_OF_SOF: | |
cef590d9 | 758 | |
489ef36c | 759 | MAKE_SOFT_DECISION(); |
cef590d9 | 760 | |
cef590d9 | 761 | if(v < 0) { // logic '0' detected |
489ef36c | 762 | Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF; |
abb21530 | 763 | Demod.posCount = 0; // start of SOF sequence |
489ef36c | 764 | } else { |
cef590d9 | 765 | // maximum length of TR1 = 200 1/fs |
766 | if(Demod.posCount > 25*2) Demod.state = DEMOD_UNSYNCD; | |
489ef36c | 767 | } |
cef590d9 | 768 | ++Demod.posCount; |
489ef36c | 769 | break; |
770 | ||
771 | case DEMOD_GOT_FALLING_EDGE_OF_SOF: | |
cef590d9 | 772 | ++Demod.posCount; |
773 | ||
489ef36c | 774 | MAKE_SOFT_DECISION(); |
cef590d9 | 775 | |
489ef36c | 776 | if(v > 0) { |
cef590d9 | 777 | // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges |
778 | if(Demod.posCount < 9*2) { | |
489ef36c | 779 | Demod.state = DEMOD_UNSYNCD; |
780 | } else { | |
a62bf3af | 781 | LED_C_ON(); // Got SOF |
11c2df83 | 782 | Demod.startTime = GetCountSspClk(); |
489ef36c | 783 | Demod.state = DEMOD_AWAITING_START_BIT; |
784 | Demod.posCount = 0; | |
785 | Demod.len = 0; | |
489ef36c | 786 | } |
787 | } else { | |
cef590d9 | 788 | // low phase of SOF too long (> 12 etu) |
789 | if (Demod.posCount > 12*2) { | |
489ef36c | 790 | Demod.state = DEMOD_UNSYNCD; |
47286d89 | 791 | LED_C_OFF(); |
489ef36c | 792 | } |
793 | } | |
489ef36c | 794 | break; |
795 | ||
796 | case DEMOD_AWAITING_START_BIT: | |
cef590d9 | 797 | ++Demod.posCount; |
798 | ||
489ef36c | 799 | MAKE_SOFT_DECISION(); |
cef590d9 | 800 | |
801 | if (v > 0) { | |
abb21530 | 802 | if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs |
489ef36c | 803 | Demod.state = DEMOD_UNSYNCD; |
47286d89 | 804 | LED_C_OFF(); |
489ef36c | 805 | } |
abb21530 | 806 | } else { // start bit detected |
489ef36c | 807 | Demod.bitCount = 0; |
abb21530 | 808 | Demod.posCount = 1; // this was the first half |
489ef36c | 809 | Demod.thisBit = v; |
810 | Demod.shiftReg = 0; | |
811 | Demod.state = DEMOD_RECEIVING_DATA; | |
812 | } | |
813 | break; | |
814 | ||
815 | case DEMOD_RECEIVING_DATA: | |
cef590d9 | 816 | |
489ef36c | 817 | MAKE_SOFT_DECISION(); |
cef590d9 | 818 | |
819 | if (Demod.posCount == 0) { | |
820 | // first half of bit | |
489ef36c | 821 | Demod.thisBit = v; |
822 | Demod.posCount = 1; | |
cef590d9 | 823 | } else { |
824 | // second half of bit | |
489ef36c | 825 | Demod.thisBit += v; |
489ef36c | 826 | Demod.shiftReg >>= 1; |
489ef36c | 827 | |
cef590d9 | 828 | // logic '1' |
829 | if(Demod.thisBit > 0) Demod.shiftReg |= 0x200; | |
830 | ||
831 | ++Demod.bitCount; | |
832 | ||
489ef36c | 833 | if(Demod.bitCount == 10) { |
cef590d9 | 834 | |
489ef36c | 835 | uint16_t s = Demod.shiftReg; |
cef590d9 | 836 | |
837 | // stop bit == '1', start bit == '0' | |
838 | if((s & 0x200) && !(s & 0x001)) { | |
489ef36c | 839 | uint8_t b = (s >> 1); |
840 | Demod.output[Demod.len] = b; | |
cef590d9 | 841 | ++Demod.len; |
489ef36c | 842 | Demod.state = DEMOD_AWAITING_START_BIT; |
489ef36c | 843 | } else { |
844 | Demod.state = DEMOD_UNSYNCD; | |
11c2df83 | 845 | Demod.endTime = GetCountSspClk(); |
47286d89 | 846 | LED_C_OFF(); |
cef590d9 | 847 | |
848 | // This is EOF (start, stop and all data bits == '0' | |
849 | if(s == 0) return TRUE; | |
489ef36c | 850 | } |
851 | } | |
852 | Demod.posCount = 0; | |
853 | } | |
854 | break; | |
855 | ||
856 | default: | |
857 | Demod.state = DEMOD_UNSYNCD; | |
47286d89 | 858 | LED_C_OFF(); |
489ef36c | 859 | break; |
860 | } | |
489ef36c | 861 | return FALSE; |
862 | } | |
863 | ||
864 | ||
489ef36c | 865 | /* |
866 | * Demodulate the samples we received from the tag, also log to tracebuffer | |
489ef36c | 867 | * quiet: set to 'TRUE' to disable debug output |
868 | */ | |
dccddaef | 869 | static void GetTagSamplesFor14443bDemod() { |
abb21530 | 870 | bool gotFrame = FALSE; |
11c2df83 | 871 | int lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; |
872 | int max = 0, ci = 0, cq = 0, samples = 0; | |
873 | uint32_t time_0 = 0, time_stop = 0; | |
489ef36c | 874 | |
11c2df83 | 875 | BigBuf_free(); |
876 | ||
489ef36c | 877 | // Set up the demodulator for tag -> reader responses. |
db25599d | 878 | DemodInit(BigBuf_malloc(MAX_FRAME_SIZE)); |
b10a759f | 879 | |
880 | // The DMA buffer, used to stream samples from the FPGA | |
881 | int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); | |
11c2df83 | 882 | int8_t *upTo = dmaBuf; |
cef590d9 | 883 | |
db25599d | 884 | // Setup and start DMA. |
11c2df83 | 885 | if ( !FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE) ){ |
886 | if (MF_DBGLEVEL > 1) Dbprintf("FpgaSetupSscDma failed. Exiting"); | |
887 | return; | |
888 | } | |
db25599d | 889 | |
11c2df83 | 890 | time_0 = GetCountSspClk(); |
891 | ||
892 | // And put the FPGA in the appropriate mode | |
893 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); | |
894 | ||
895 | while( !BUTTON_PRESS() ) { | |
896 | WDT_HIT(); | |
489ef36c | 897 | |
489ef36c | 898 | int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR; |
899 | if(behindBy > max) max = behindBy; | |
900 | ||
11c2df83 | 901 | // rx counter - dma counter? (how much?) & (mod) dma buff / 2. (since 2bytes at the time is read) |
902 | while(((lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) { | |
903 | ||
489ef36c | 904 | ci = upTo[0]; |
905 | cq = upTo[1]; | |
906 | upTo += 2; | |
11c2df83 | 907 | samples += 2; |
908 | ||
909 | // restart DMA buffer to receive again. | |
705bfa10 | 910 | if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { |
489ef36c | 911 | upTo = dmaBuf; |
912 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo; | |
705bfa10 | 913 | AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; |
489ef36c | 914 | } |
11c2df83 | 915 | |
489ef36c | 916 | lastRxCounter -= 2; |
cef590d9 | 917 | if(lastRxCounter <= 0) |
918 | lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; | |
489ef36c | 919 | |
6fc68747 | 920 | // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103 |
11c2df83 | 921 | //gotFrame = Handle14443bTagSamplesDemod(ci & 0xfe, cq & 0xfe); |
922 | gotFrame = Handle14443bTagSamplesDemod(ci, cq); | |
923 | if ( gotFrame ) break; | |
924 | LED_A_INV(); | |
489ef36c | 925 | } |
926 | ||
11c2df83 | 927 | time_stop = GetCountSspClk() - time_0; |
928 | ||
929 | if(time_stop > iso14b_timeout || gotFrame) break; | |
489ef36c | 930 | } |
11c2df83 | 931 | |
932 | FpgaDisableSscDma(); | |
abb21530 | 933 | |
dccddaef | 934 | if (MF_DBGLEVEL >= 3) { |
11c2df83 | 935 | Dbprintf("max behindby = %d, samples = %d, gotFrame = %s, Demod.state = %d, Demod.len = %u", |
b10a759f | 936 | max, |
937 | samples, | |
ff3e0744 | 938 | (gotFrame) ? "true" : "false", |
cef590d9 | 939 | Demod.state, |
11c2df83 | 940 | Demod.len |
b10a759f | 941 | ); |
942 | } | |
11c2df83 | 943 | if ( Demod.len > 0 ) |
944 | LogTrace(Demod.output, Demod.len, Demod.startTime, Demod.endTime, NULL, FALSE); | |
489ef36c | 945 | } |
946 | ||
947 | ||
489ef36c | 948 | //----------------------------------------------------------------------------- |
949 | // Transmit the command (to the tag) that was placed in ToSend[]. | |
950 | //----------------------------------------------------------------------------- | |
11c2df83 | 951 | static void TransmitFor14443b_AsReader(void) { |
489ef36c | 952 | |
abb21530 | 953 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); |
11c2df83 | 954 | SpinDelay(20); |
b10a759f | 955 | |
11c2df83 | 956 | int c; |
957 | // we could been in following mode: | |
958 | // FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | |
959 | // if its second call or more | |
960 | ||
961 | // What does this loop do? Is it TR1? | |
962 | for(c = 0; c < 10;) { | |
489ef36c | 963 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
11c2df83 | 964 | AT91C_BASE_SSC->SSC_THR = 0xFF; |
cef590d9 | 965 | ++c; |
489ef36c | 966 | } |
489ef36c | 967 | } |
11c2df83 | 968 | |
969 | // Send frame loop | |
970 | for(c = 0; c < ToSendMax;) { | |
489ef36c | 971 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
972 | AT91C_BASE_SSC->SSC_THR = ToSend[c]; | |
cef590d9 | 973 | ++c; |
489ef36c | 974 | } |
489ef36c | 975 | } |
11c2df83 | 976 | WDT_HIT(); |
489ef36c | 977 | } |
978 | ||
489ef36c | 979 | //----------------------------------------------------------------------------- |
980 | // Code a layer 2 command (string of octets, including CRC) into ToSend[], | |
abb21530 | 981 | // so that it is ready to transmit to the tag using TransmitFor14443b(). |
489ef36c | 982 | //----------------------------------------------------------------------------- |
983 | static void CodeIso14443bAsReader(const uint8_t *cmd, int len) | |
984 | { | |
11c2df83 | 985 | /* |
986 | * Reader data transmission: | |
987 | * - no modulation ONES | |
988 | * - SOF | |
989 | * - Command, data and CRC_B | |
990 | * - EOF | |
991 | * - no modulation ONES | |
992 | * | |
993 | * 1 ETU == 1 BIT! | |
994 | * TR0 - 8 ETUS minimum. | |
995 | */ | |
996 | int i; | |
489ef36c | 997 | uint8_t b; |
11c2df83 | 998 | |
489ef36c | 999 | ToSendReset(); |
1000 | ||
489ef36c | 1001 | // Send SOF |
11c2df83 | 1002 | // 10-11 ETUs of ZERO |
1003 | for(i = 0; i < 10; ++i) ToSendStuffBit(0); | |
1004 | ||
1005 | // 2-3 ETUs of ONE | |
1006 | ToSendStuffBit(1); | |
1007 | ToSendStuffBit(1); | |
1008 | ToSendStuffBit(1); | |
1009 | ||
1010 | // Sending cmd, LSB | |
1011 | // from here we add BITS | |
6fc68747 | 1012 | for(i = 0; i < len; ++i) { |
11c2df83 | 1013 | // Start bit |
489ef36c | 1014 | ToSendStuffBit(0); |
1015 | // Data bits | |
11c2df83 | 1016 | b = cmd[i]; |
1017 | if ( b & 1 ) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1018 | if ( (b>>1) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1019 | if ( (b>>2) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1020 | if ( (b>>3) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1021 | if ( (b>>4) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1022 | if ( (b>>5) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1023 | if ( (b>>6) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1024 | if ( (b>>7) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1025 | // Stop bit | |
489ef36c | 1026 | ToSendStuffBit(1); |
11c2df83 | 1027 | // EGT extra guard time |
1028 | // For PCD it ranges 0-57us (1etu = 9us) | |
489ef36c | 1029 | ToSendStuffBit(1); |
11c2df83 | 1030 | ToSendStuffBit(1); |
1031 | ToSendStuffBit(1); | |
1032 | } | |
1033 | ||
1034 | // Send EOF | |
1035 | // 10-11 ETUs of ZERO | |
1036 | for(i = 0; i < 10; ++i) ToSendStuffBit(0); | |
489ef36c | 1037 | |
11c2df83 | 1038 | // Transition time. TR0 - guard time |
1039 | // 8ETUS minum? | |
1040 | // Per specification, Subcarrier must be stopped no later than 2 ETUs after EOF. | |
1041 | for(i = 0; i < 40 ; ++i) ToSendStuffBit(1); | |
1042 | ||
1043 | // TR1 - Synchronization time | |
489ef36c | 1044 | // Convert from last character reference to length |
cef590d9 | 1045 | ++ToSendMax; |
489ef36c | 1046 | } |
1047 | ||
1048 | ||
489ef36c | 1049 | /** |
1050 | Convenience function to encode, transmit and trace iso 14443b comms | |
1051 | **/ | |
11c2df83 | 1052 | static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len) { |
1053 | ||
489ef36c | 1054 | CodeIso14443bAsReader(cmd, len); |
11c2df83 | 1055 | |
1056 | uint32_t time_start = GetCountSspClk(); | |
6fc68747 | 1057 | |
11c2df83 | 1058 | TransmitFor14443b_AsReader(); |
1059 | ||
6fc68747 | 1060 | if(trigger) LED_A_ON(); |
1061 | ||
dccddaef | 1062 | LogTrace(cmd, len, time_start, GetCountSspClk()-time_start, NULL, TRUE); |
489ef36c | 1063 | } |
1064 | ||
a62bf3af | 1065 | /* Sends an APDU to the tag |
1066 | * TODO: check CRC and preamble | |
1067 | */ | |
6fc68747 | 1068 | uint8_t iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response) |
a62bf3af | 1069 | { |
6fc68747 | 1070 | uint8_t crc[2] = {0x00, 0x00}; |
a62bf3af | 1071 | uint8_t message_frame[message_length + 4]; |
1072 | // PCB | |
1073 | message_frame[0] = 0x0A | pcb_blocknum; | |
1074 | pcb_blocknum ^= 1; | |
1075 | // CID | |
1076 | message_frame[1] = 0; | |
1077 | // INF | |
1078 | memcpy(message_frame + 2, message, message_length); | |
1079 | // EDC (CRC) | |
1080 | ComputeCrc14443(CRC_14443_B, message_frame, message_length + 2, &message_frame[message_length + 2], &message_frame[message_length + 3]); | |
1081 | // send | |
11c2df83 | 1082 | CodeAndTransmit14443bAsReader(message_frame, message_length + 4); //no |
a62bf3af | 1083 | // get response |
dccddaef | 1084 | GetTagSamplesFor14443bDemod(); //no |
a62bf3af | 1085 | if(Demod.len < 3) |
a62bf3af | 1086 | return 0; |
cef590d9 | 1087 | |
6fc68747 | 1088 | // VALIDATE CRC |
1089 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]); | |
1090 | if ( crc[0] != Demod.output[Demod.len-2] || crc[1] != Demod.output[Demod.len-1] ) | |
1091 | return 0; | |
1092 | ||
a62bf3af | 1093 | // copy response contents |
1094 | if(response != NULL) | |
a62bf3af | 1095 | memcpy(response, Demod.output, Demod.len); |
cef590d9 | 1096 | |
a62bf3af | 1097 | return Demod.len; |
1098 | } | |
1099 | ||
6fc68747 | 1100 | /** |
1101 | * SRx Initialise. | |
1102 | */ | |
1103 | uint8_t iso14443b_select_srx_card(iso14b_card_select_t *card ) | |
1104 | { | |
1105 | // INITIATE command: wake up the tag using the INITIATE | |
1106 | static const uint8_t init_srx[] = { ISO14443B_INITIATE, 0x00, 0x97, 0x5b }; | |
1107 | // SELECT command (with space for CRC) | |
1108 | uint8_t select_srx[] = { ISO14443B_SELECT, 0x00, 0x00, 0x00}; | |
1109 | // temp to calc crc. | |
1110 | uint8_t crc[2] = {0x00, 0x00}; | |
1111 | ||
1112 | CodeAndTransmit14443bAsReader(init_srx, sizeof(init_srx)); | |
dccddaef | 1113 | GetTagSamplesFor14443bDemod(); //no |
6fc68747 | 1114 | |
1115 | if (Demod.len == 0) return 2; | |
1116 | ||
1117 | // Randomly generated Chip ID | |
1118 | if (card) card->chipid = Demod.output[0]; | |
1119 | ||
1120 | select_srx[1] = Demod.output[0]; | |
1121 | ||
1122 | ComputeCrc14443(CRC_14443_B, select_srx, 2, &select_srx[2], &select_srx[3]); | |
1123 | CodeAndTransmit14443bAsReader(select_srx, sizeof(select_srx)); | |
dccddaef | 1124 | GetTagSamplesFor14443bDemod(); //no |
6fc68747 | 1125 | |
1126 | if (Demod.len != 3) return 2; | |
1127 | ||
1128 | // Check the CRC of the answer: | |
1129 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2 , &crc[0], &crc[1]); | |
1130 | if(crc[0] != Demod.output[1] || crc[1] != Demod.output[2]) return 3; | |
1131 | ||
1132 | // Check response from the tag: should be the same UID as the command we just sent: | |
1133 | if (select_srx[1] != Demod.output[0]) return 1; | |
1134 | ||
1135 | // First get the tag's UID: | |
1136 | select_srx[0] = ISO14443B_GET_UID; | |
1137 | ||
1138 | ComputeCrc14443(CRC_14443_B, select_srx, 1 , &select_srx[1], &select_srx[2]); | |
1139 | CodeAndTransmit14443bAsReader(select_srx, 3); // Only first three bytes for this one | |
dccddaef | 1140 | GetTagSamplesFor14443bDemod(); //no |
6fc68747 | 1141 | |
1142 | if (Demod.len != 10) return 2; | |
1143 | ||
1144 | // The check the CRC of the answer | |
1145 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]); | |
1146 | if(crc[0] != Demod.output[8] || crc[1] != Demod.output[9]) return 3; | |
1147 | ||
1148 | if (card) { | |
1149 | card->uidlen = 8; | |
1150 | memcpy(card->uid, Demod.output, 8); | |
1151 | } | |
1152 | ||
1153 | return 0; | |
1154 | } | |
a62bf3af | 1155 | /* Perform the ISO 14443 B Card Selection procedure |
1156 | * Currently does NOT do any collision handling. | |
1157 | * It expects 0-1 cards in the device's range. | |
1158 | * TODO: Support multiple cards (perform anticollision) | |
1159 | * TODO: Verify CRC checksums | |
1160 | */ | |
6fc68747 | 1161 | uint8_t iso14443b_select_card(iso14b_card_select_t *card ) |
a62bf3af | 1162 | { |
1163 | // WUPB command (including CRC) | |
1164 | // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state | |
6fc68747 | 1165 | static const uint8_t wupb[] = { ISO14443B_REQB, 0x00, 0x08, 0x39, 0x73 }; |
a62bf3af | 1166 | // ATTRIB command (with space for CRC) |
6fc68747 | 1167 | uint8_t attrib[] = { ISO14443B_ATTRIB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00}; |
a62bf3af | 1168 | |
6fc68747 | 1169 | // temp to calc crc. |
1170 | uint8_t crc[2] = {0x00, 0x00}; | |
1171 | ||
a62bf3af | 1172 | // first, wake up the tag |
1173 | CodeAndTransmit14443bAsReader(wupb, sizeof(wupb)); | |
dccddaef | 1174 | GetTagSamplesFor14443bDemod(); //select_card |
6fc68747 | 1175 | |
a62bf3af | 1176 | // ATQB too short? |
6fc68747 | 1177 | if (Demod.len < 14) return 2; |
1178 | ||
1179 | // VALIDATE CRC | |
1180 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]); | |
1181 | if ( crc[0] != Demod.output[12] || crc[1] != Demod.output[13] ) | |
1182 | return 3; | |
1183 | ||
1184 | if (card) { | |
1185 | card->uidlen = 4; | |
1186 | memcpy(card->uid, Demod.output+1, 4); | |
1187 | memcpy(card->atqb, Demod.output+5, 7); | |
1188 | } | |
a62bf3af | 1189 | |
11c2df83 | 1190 | // copy the PUPI to ATTRIB ( PUPI == UID ) |
a62bf3af | 1191 | memcpy(attrib + 1, Demod.output + 1, 4); |
6fc68747 | 1192 | |
1193 | // copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into ATTRIB (Param 3) | |
a62bf3af | 1194 | attrib[7] = Demod.output[10] & 0x0F; |
1195 | ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10); | |
6fc68747 | 1196 | |
a62bf3af | 1197 | CodeAndTransmit14443bAsReader(attrib, sizeof(attrib)); |
dccddaef | 1198 | GetTagSamplesFor14443bDemod();//select_card |
6fc68747 | 1199 | |
a62bf3af | 1200 | // Answer to ATTRIB too short? |
6fc68747 | 1201 | if(Demod.len < 3) return 2; |
1202 | ||
1203 | // VALIDATE CRC | |
1204 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]); | |
1205 | if ( crc[0] != Demod.output[1] || crc[1] != Demod.output[2] ) | |
1206 | return 3; | |
1207 | ||
1208 | // CID | |
1209 | if (card) card->cid = Demod.output[0]; | |
cef590d9 | 1210 | |
11c2df83 | 1211 | uint8_t fwt = card->atqb[6]>>4; |
1212 | if ( fwt < 16 ){ | |
1213 | uint32_t fwt_time = (302 << fwt); | |
1214 | iso14b_set_timeout( fwt_time); | |
1215 | } | |
a62bf3af | 1216 | // reset PCB block number |
1217 | pcb_blocknum = 0; | |
6fc68747 | 1218 | return 0; |
a62bf3af | 1219 | } |
1220 | ||
1221 | // Set up ISO 14443 Type B communication (similar to iso14443a_setup) | |
11c2df83 | 1222 | // field is setup for "Sending as Reader" |
a62bf3af | 1223 | void iso14443b_setup() { |
11c2df83 | 1224 | if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup Enter"); |
1225 | LEDsoff(); | |
a62bf3af | 1226 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
11c2df83 | 1227 | //BigBuf_free(); |
1228 | //BigBuf_Clear_ext(false); | |
ff3e0744 | 1229 | |
11c2df83 | 1230 | // Initialize Demod and Uart structs |
1231 | DemodInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1232 | UartInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
cef590d9 | 1233 | |
a62bf3af | 1234 | // connect Demodulated Signal to ADC: |
1235 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
1236 | ||
11c2df83 | 1237 | // Set up the synchronous serial port |
1238 | FpgaSetupSsc(); | |
1239 | ||
a62bf3af | 1240 | // Signal field is on with the appropriate LED |
a62bf3af | 1241 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); |
11c2df83 | 1242 | SpinDelay(100); |
a62bf3af | 1243 | |
1244 | // Start the timer | |
ff3e0744 | 1245 | StartCountSspClk(); |
11c2df83 | 1246 | |
1247 | LED_D_ON(); | |
1248 | if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup Exit"); | |
a62bf3af | 1249 | } |
489ef36c | 1250 | |
1251 | //----------------------------------------------------------------------------- | |
abb21530 | 1252 | // Read a SRI512 ISO 14443B tag. |
489ef36c | 1253 | // |
1254 | // SRI512 tags are just simple memory tags, here we're looking at making a dump | |
1255 | // of the contents of the memory. No anticollision algorithm is done, we assume | |
1256 | // we have a single tag in the field. | |
1257 | // | |
1258 | // I tried to be systematic and check every answer of the tag, every CRC, etc... | |
1259 | //----------------------------------------------------------------------------- | |
6fc68747 | 1260 | void ReadSTMemoryIso14443b(uint8_t numofblocks) |
489ef36c | 1261 | { |
17ad0e09 | 1262 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
489ef36c | 1263 | |
489ef36c | 1264 | // Make sure that we start from off, since the tags are stateful; |
1265 | // confusing things will happen if we don't reset them between reads. | |
11c2df83 | 1266 | switch_off(); // before ReadStMemory |
1267 | ||
1268 | set_tracing(TRUE); | |
1269 | ||
1270 | uint8_t i = 0x00; | |
99cf19d9 | 1271 | |
489ef36c | 1272 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
1273 | FpgaSetupSsc(); | |
1274 | ||
1275 | // Now give it time to spin up. | |
1276 | // Signal field is on with the appropriate LED | |
1277 | LED_D_ON(); | |
22e24700 | 1278 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); |
11c2df83 | 1279 | SpinDelay(20); |
489ef36c | 1280 | |
1281 | // First command: wake up the tag using the INITIATE command | |
6fc68747 | 1282 | uint8_t cmd1[] = {ISO14443B_INITIATE, 0x00, 0x97, 0x5b}; |
11c2df83 | 1283 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no |
dccddaef | 1284 | GetTagSamplesFor14443bDemod(); // no |
489ef36c | 1285 | |
1286 | if (Demod.len == 0) { | |
22e24700 | 1287 | DbpString("No response from tag"); |
5ee53a0e | 1288 | set_tracing(FALSE); |
22e24700 | 1289 | return; |
489ef36c | 1290 | } else { |
705bfa10 | 1291 | Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x", |
1292 | Demod.output[0], Demod.output[1], Demod.output[2]); | |
489ef36c | 1293 | } |
705bfa10 | 1294 | |
489ef36c | 1295 | // There is a response, SELECT the uid |
1296 | DbpString("Now SELECT tag:"); | |
6fc68747 | 1297 | cmd1[0] = ISO14443B_SELECT; // 0x0E is SELECT |
489ef36c | 1298 | cmd1[1] = Demod.output[0]; |
1299 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); | |
11c2df83 | 1300 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no |
dccddaef | 1301 | GetTagSamplesFor14443bDemod(); //no |
489ef36c | 1302 | if (Demod.len != 3) { |
22e24700 | 1303 | Dbprintf("Expected 3 bytes from tag, got %d", Demod.len); |
5ee53a0e | 1304 | set_tracing(FALSE); |
22e24700 | 1305 | return; |
489ef36c | 1306 | } |
1307 | // Check the CRC of the answer: | |
1308 | ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]); | |
1309 | if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) { | |
22e24700 | 1310 | DbpString("CRC Error reading select response."); |
5ee53a0e | 1311 | set_tracing(FALSE); |
22e24700 | 1312 | return; |
489ef36c | 1313 | } |
1314 | // Check response from the tag: should be the same UID as the command we just sent: | |
1315 | if (cmd1[1] != Demod.output[0]) { | |
22e24700 | 1316 | Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]); |
5ee53a0e | 1317 | set_tracing(FALSE); |
22e24700 | 1318 | return; |
489ef36c | 1319 | } |
705bfa10 | 1320 | |
489ef36c | 1321 | // Tag is now selected, |
1322 | // First get the tag's UID: | |
6fc68747 | 1323 | cmd1[0] = ISO14443B_GET_UID; |
489ef36c | 1324 | ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]); |
11c2df83 | 1325 | CodeAndTransmit14443bAsReader(cmd1, 3); // no -- Only first three bytes for this one |
dccddaef | 1326 | GetTagSamplesFor14443bDemod(); //no |
489ef36c | 1327 | if (Demod.len != 10) { |
22e24700 | 1328 | Dbprintf("Expected 10 bytes from tag, got %d", Demod.len); |
5ee53a0e | 1329 | set_tracing(FALSE); |
22e24700 | 1330 | return; |
489ef36c | 1331 | } |
1332 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
1333 | ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]); | |
51d4f6f1 | 1334 | if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) { |
22e24700 | 1335 | Dbprintf("CRC Error reading block! Expected: %04x got: %04x", |
705bfa10 | 1336 | (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]); |
489ef36c | 1337 | // Do not return;, let's go on... (we should retry, maybe ?) |
1338 | } | |
1339 | Dbprintf("Tag UID (64 bits): %08x %08x", | |
705bfa10 | 1340 | (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], |
1341 | (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]); | |
489ef36c | 1342 | |
1343 | // Now loop to read all 16 blocks, address from 0 to last block | |
6fc68747 | 1344 | Dbprintf("Tag memory dump, block 0 to %d", numofblocks); |
489ef36c | 1345 | cmd1[0] = 0x08; |
1346 | i = 0x00; | |
6fc68747 | 1347 | ++numofblocks; |
1348 | ||
489ef36c | 1349 | for (;;) { |
6fc68747 | 1350 | if (i == numofblocks) { |
489ef36c | 1351 | DbpString("System area block (0xff):"); |
1352 | i = 0xff; | |
1353 | } | |
1354 | cmd1[1] = i; | |
1355 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); | |
11c2df83 | 1356 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no |
dccddaef | 1357 | GetTagSamplesFor14443bDemod(); //no |
6fc68747 | 1358 | |
489ef36c | 1359 | if (Demod.len != 6) { // Check if we got an answer from the tag |
6fc68747 | 1360 | DbpString("Expected 6 bytes from tag, got less..."); |
1361 | return; | |
489ef36c | 1362 | } |
1363 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
1364 | ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]); | |
1365 | if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) { | |
132a0217 | 1366 | Dbprintf("CRC Error reading block! Expected: %04x got: %04x", |
705bfa10 | 1367 | (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]); |
489ef36c | 1368 | // Do not return;, let's go on... (we should retry, maybe ?) |
1369 | } | |
1370 | // Now print out the memory location: | |
22e24700 | 1371 | Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i, |
705bfa10 | 1372 | (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], |
17ad0e09 | 1373 | (Demod.output[4]<<8)+Demod.output[5]); |
6fc68747 | 1374 | |
1375 | if (i == 0xff) break; | |
1376 | ++i; | |
489ef36c | 1377 | } |
5ee53a0e | 1378 | |
1379 | set_tracing(FALSE); | |
489ef36c | 1380 | } |
1381 | ||
11c2df83 | 1382 | |
1383 | static void iso1444b_setup_snoop(void){ | |
1384 | if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup_snoop Enter"); | |
1385 | LEDsoff(); | |
1386 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
1387 | BigBuf_free(); | |
1388 | BigBuf_Clear_ext(false); | |
1389 | clear_trace();//setup snoop | |
1390 | set_tracing(TRUE); | |
1391 | ||
1392 | // Initialize Demod and Uart structs | |
1393 | DemodInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1394 | UartInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1395 | ||
1396 | if (MF_DBGLEVEL > 1) { | |
1397 | // Print debug information about the buffer sizes | |
1398 | Dbprintf("Snooping buffers initialized:"); | |
1399 | Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen()); | |
1400 | Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE); | |
1401 | Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE); | |
1402 | Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE); | |
1403 | } | |
1404 | ||
1405 | // connect Demodulated Signal to ADC: | |
1406 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
1407 | ||
1408 | // Setup for the DMA. | |
1409 | FpgaSetupSsc(); | |
1410 | ||
1411 | // Set FPGA in the appropriate mode | |
1412 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP); | |
1413 | SpinDelay(20); | |
1414 | ||
1415 | // Start the SSP timer | |
1416 | StartCountSspClk(); | |
1417 | if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup_snoop Exit"); | |
1418 | } | |
1419 | ||
489ef36c | 1420 | //============================================================================= |
1421 | // Finally, the `sniffer' combines elements from both the reader and | |
1422 | // simulated tag, to show both sides of the conversation. | |
1423 | //============================================================================= | |
1424 | ||
1425 | //----------------------------------------------------------------------------- | |
1426 | // Record the sequence of commands sent by the reader to the tag, with | |
1427 | // triggering so that we start recording at the point that the tag is moved | |
1428 | // near the reader. | |
1429 | //----------------------------------------------------------------------------- | |
1430 | /* | |
1431 | * Memory usage for this function, (within BigBuf) | |
47286d89 | 1432 | * Last Received command (reader->tag) - MAX_FRAME_SIZE |
1433 | * Last Received command (tag->reader) - MAX_FRAME_SIZE | |
705bfa10 | 1434 | * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE |
47286d89 | 1435 | * Demodulated samples received - all the rest |
489ef36c | 1436 | */ |
11c2df83 | 1437 | void RAMFUNC SnoopIso14443b(void) { |
1438 | ||
1439 | uint32_t time_0 = 0, time_start = 0, time_stop = 0; | |
1440 | ||
489ef36c | 1441 | // We won't start recording the frames that we acquire until we trigger; |
1442 | // a good trigger condition to get started is probably when we see a | |
1443 | // response from the tag. | |
11c2df83 | 1444 | int triggered = TRUE; // TODO: set and evaluate trigger condition |
489ef36c | 1445 | int ci, cq; |
1446 | int maxBehindBy = 0; | |
11c2df83 | 1447 | //int behindBy = 0; |
1448 | int lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; | |
1449 | ||
f53020e7 | 1450 | bool TagIsActive = FALSE; |
1451 | bool ReaderIsActive = FALSE; | |
11c2df83 | 1452 | |
1453 | iso1444b_setup_snoop(); | |
1454 | ||
1455 | // The DMA buffer, used to stream samples from the FPGA | |
1456 | int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); | |
1457 | int8_t *upTo = dmaBuf; | |
1458 | ||
1459 | // Setup and start DMA. | |
1460 | if ( !FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE) ){ | |
1461 | if (MF_DBGLEVEL > 1) Dbprintf("FpgaSetupSscDma failed. Exiting"); | |
1462 | BigBuf_free(); | |
1463 | return; | |
1464 | } | |
1465 | ||
1466 | time_0 = GetCountSspClk(); | |
489ef36c | 1467 | |
1468 | // And now we loop, receiving samples. | |
1469 | for(;;) { | |
abb21530 | 1470 | |
11c2df83 | 1471 | WDT_HIT(); |
1472 | ||
1473 | int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1); | |
489ef36c | 1474 | |
11c2df83 | 1475 | if ( behindBy > maxBehindBy ) |
1476 | maxBehindBy = behindBy; | |
1477 | ||
1478 | if ( behindBy < 2 ) continue; | |
1479 | ||
489ef36c | 1480 | ci = upTo[0]; |
1481 | cq = upTo[1]; | |
1482 | upTo += 2; | |
11c2df83 | 1483 | |
489ef36c | 1484 | lastRxCounter -= 2; |
11c2df83 | 1485 | |
1486 | if (upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { | |
489ef36c | 1487 | upTo = dmaBuf; |
705bfa10 | 1488 | lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; |
489ef36c | 1489 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; |
705bfa10 | 1490 | AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; |
51d4f6f1 | 1491 | WDT_HIT(); |
11c2df83 | 1492 | |
1493 | // TODO: understand whether we can increase/decrease as we want or not? | |
1494 | if ( behindBy > ( 9 * ISO14443B_DMA_BUFFER_SIZE/10) ) { | |
132a0217 | 1495 | Dbprintf("blew circular buffer! behindBy=%d", behindBy); |
51d4f6f1 | 1496 | break; |
abb21530 | 1497 | } |
810f5379 | 1498 | |
abb21530 | 1499 | if(!tracing) { |
810f5379 | 1500 | DbpString("Trace full"); |
abb21530 | 1501 | break; |
1502 | } | |
11c2df83 | 1503 | |
abb21530 | 1504 | if(BUTTON_PRESS()) { |
1505 | DbpString("cancelled"); | |
1506 | break; | |
1507 | } | |
489ef36c | 1508 | } |
11c2df83 | 1509 | |
1510 | if (!TagIsActive) { | |
1511 | ||
1512 | LED_A_ON(); | |
1513 | ||
1514 | // no need to try decoding reader data if the tag is sending | |
1515 | if (Handle14443bReaderUartBit(ci & 0x01)) { | |
489ef36c | 1516 | |
11c2df83 | 1517 | time_stop = (GetCountSspClk()-time_0); |
1518 | ||
1519 | if (triggered) | |
1520 | LogTrace(Uart.output, Uart.byteCnt, time_start, time_stop, NULL, TRUE); | |
6fc68747 | 1521 | |
810f5379 | 1522 | /* And ready to receive another command. */ |
1523 | UartReset(); | |
1524 | /* And also reset the demod code, which might have been */ | |
1525 | /* false-triggered by the commands from the reader. */ | |
1526 | DemodReset(); | |
11c2df83 | 1527 | } else { |
1528 | time_start = (GetCountSspClk()-time_0); | |
489ef36c | 1529 | } |
6fc68747 | 1530 | |
11c2df83 | 1531 | if (Handle14443bReaderUartBit(cq & 0x01)) { |
1532 | ||
1533 | time_stop = (GetCountSspClk()-time_0); | |
1534 | ||
1535 | if (triggered) | |
1536 | LogTrace(Uart.output, Uart.byteCnt, time_start, time_stop, NULL, TRUE); | |
6fc68747 | 1537 | |
810f5379 | 1538 | /* And ready to receive another command. */ |
1539 | UartReset(); | |
1540 | /* And also reset the demod code, which might have been */ | |
1541 | /* false-triggered by the commands from the reader. */ | |
1542 | DemodReset(); | |
11c2df83 | 1543 | } else { |
1544 | time_start = (GetCountSspClk()-time_0); | |
6fc68747 | 1545 | } |
36f84d47 | 1546 | ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF); |
11c2df83 | 1547 | LED_A_OFF(); |
47286d89 | 1548 | } |
11c2df83 | 1549 | |
1550 | if(!ReaderIsActive) { | |
1551 | // no need to try decoding tag data if the reader is sending - and we cannot afford the time | |
d8af608f | 1552 | // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103 |
11c2df83 | 1553 | if(Handle14443bTagSamplesDemod(ci & 0xFE, cq & 0xFE)) { |
1554 | ||
1555 | time_stop = (GetCountSspClk()-time_0); | |
1556 | ||
1557 | LogTrace(Demod.output, Demod.len, time_start, time_stop, NULL, FALSE); | |
489ef36c | 1558 | |
810f5379 | 1559 | triggered = TRUE; |
1560 | ||
1561 | // And ready to receive another response. | |
1562 | DemodReset(); | |
11c2df83 | 1563 | } else { |
1564 | time_start = (GetCountSspClk()-time_0); | |
810f5379 | 1565 | } |
22e24700 | 1566 | TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF); |
47286d89 | 1567 | } |
489ef36c | 1568 | } |
abb21530 | 1569 | |
11c2df83 | 1570 | switch_off(); // Snoop |
810f5379 | 1571 | |
489ef36c | 1572 | DbpString("Snoop statistics:"); |
1573 | Dbprintf(" Max behind by: %i", maxBehindBy); | |
11c2df83 | 1574 | Dbprintf(" Uart State: %x ByteCount: %i ByteCountMax: %i", Uart.state, Uart.byteCnt, Uart.byteCntMax); |
489ef36c | 1575 | Dbprintf(" Trace length: %i", BigBuf_get_traceLen()); |
11c2df83 | 1576 | |
1577 | // free mem refs. | |
1578 | if ( dmaBuf ) dmaBuf = NULL; | |
1579 | if ( upTo ) upTo = NULL; | |
1580 | // Uart.byteCntMax should be set with ATQB value.. | |
489ef36c | 1581 | } |
1582 | ||
6fc68747 | 1583 | void iso14b_set_trigger(bool enable) { |
1584 | trigger = enable; | |
1585 | } | |
489ef36c | 1586 | |
1587 | /* | |
1588 | * Send raw command to tag ISO14443B | |
1589 | * @Input | |
6fc68747 | 1590 | * param flags enum ISO14B_COMMAND. (mifare.h) |
1591 | * len len of buffer data | |
1592 | * data buffer with bytes to send | |
489ef36c | 1593 | * |
1594 | * @Output | |
1595 | * none | |
1596 | * | |
1597 | */ | |
6fc68747 | 1598 | void SendRawCommand14443B_Ex(UsbCommand *c) |
489ef36c | 1599 | { |
6fc68747 | 1600 | iso14b_command_t param = c->arg[0]; |
1601 | size_t len = c->arg[1] & 0xffff; | |
1602 | uint8_t *cmd = c->d.asBytes; | |
1603 | uint8_t status = 0; | |
1604 | uint32_t sendlen = sizeof(iso14b_card_select_t); | |
1605 | uint8_t buf[USB_CMD_DATA_SIZE] = {0x00}; | |
1606 | ||
11c2df83 | 1607 | if (MF_DBGLEVEL > 3) Dbprintf("14b raw: param, %04x", param ); |
b10a759f | 1608 | |
6fc68747 | 1609 | // turn on trigger (LED_A) |
11c2df83 | 1610 | if ((param & ISO14B_REQUEST_TRIGGER) == ISO14B_REQUEST_TRIGGER) |
6fc68747 | 1611 | iso14b_set_trigger(TRUE); |
1612 | ||
11c2df83 | 1613 | if ((param & ISO14B_CONNECT) == ISO14B_CONNECT) { |
6fc68747 | 1614 | // Make sure that we start from off, since the tags are stateful; |
1615 | // confusing things will happen if we don't reset them between reads. | |
11c2df83 | 1616 | //switch_off(); // before connect in raw |
6fc68747 | 1617 | iso14443b_setup(); |
99cf19d9 | 1618 | } |
6fc68747 | 1619 | |
1620 | set_tracing(TRUE); | |
489ef36c | 1621 | |
11c2df83 | 1622 | if ((param & ISO14B_SELECT_STD) == ISO14B_SELECT_STD) { |
6fc68747 | 1623 | iso14b_card_select_t *card = (iso14b_card_select_t*)buf; |
1624 | status = iso14443b_select_card(card); | |
1625 | cmd_send(CMD_ACK, status, sendlen, 0, buf, sendlen); | |
1626 | // 0: OK 2: attrib fail, 3:crc fail, | |
1627 | if ( status > 0 ) return; | |
1628 | } | |
1629 | ||
11c2df83 | 1630 | if ((param & ISO14B_SELECT_SR) == ISO14B_SELECT_SR) { |
6fc68747 | 1631 | iso14b_card_select_t *card = (iso14b_card_select_t*)buf; |
1632 | status = iso14443b_select_srx_card(card); | |
1633 | cmd_send(CMD_ACK, status, sendlen, 0, buf, sendlen); | |
1634 | // 0: OK 2: attrib fail, 3:crc fail, | |
1635 | if ( status > 0 ) return; | |
1636 | } | |
1637 | ||
11c2df83 | 1638 | if ((param & ISO14B_APDU) == ISO14B_APDU) { |
6fc68747 | 1639 | status = iso14443b_apdu(cmd, len, buf); |
1640 | cmd_send(CMD_ACK, status, status, 0, buf, status); | |
489ef36c | 1641 | } |
abb21530 | 1642 | |
11c2df83 | 1643 | if ((param & ISO14B_RAW) == ISO14B_RAW) { |
1644 | if((param & ISO14B_APPEND_CRC) == ISO14B_APPEND_CRC) { | |
6fc68747 | 1645 | AppendCrc14443b(cmd, len); |
1646 | len += 2; | |
1647 | } | |
1648 | ||
11c2df83 | 1649 | CodeAndTransmit14443bAsReader(cmd, len); // raw |
dccddaef | 1650 | GetTagSamplesFor14443bDemod(); // raw |
6fc68747 | 1651 | |
1652 | sendlen = MIN(Demod.len, USB_CMD_DATA_SIZE); | |
1653 | status = (Demod.len > 0) ? 0 : 1; | |
1654 | cmd_send(CMD_ACK, status, sendlen, 0, Demod.output, sendlen); | |
1655 | } | |
1656 | ||
1657 | // turn off trigger (LED_A) | |
11c2df83 | 1658 | if ((param & ISO14B_REQUEST_TRIGGER) == ISO14B_REQUEST_TRIGGER) |
1659 | iso14b_set_trigger(FALSE); | |
6fc68747 | 1660 | |
1661 | // turn off antenna et al | |
1662 | // we don't send a HALT command. | |
11c2df83 | 1663 | if ((param & ISO14B_DISCONNECT) == ISO14B_DISCONNECT) { |
6fc68747 | 1664 | if (MF_DBGLEVEL > 3) Dbprintf("disconnect"); |
11c2df83 | 1665 | switch_off(); // disconnect raw |
1666 | } else { | |
1667 | //FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); | |
489ef36c | 1668 | } |
11c2df83 | 1669 | |
6fc68747 | 1670 | } |