projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
FIX: 133853, If you have 3items in a array, don't start with index 4 or 3, mental...
[proxmark3-svn] / armsrc / iso15693.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
bd20f8f4 2// Jonathan Westhues, split Nov 2006
3// Modified by Greg Jones, Jan 2009
e6304bca 4// Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
bd20f8f4 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
15c4dc5a 10// Routines to support ISO 15693. This includes both the reader software and
11// the `fake tag' modes, but at the moment I've implemented only the reader
12// stuff, and that barely.
bd20f8f4 13// Modified to perform modulation onboard in arm rather than on PC
15c4dc5a 14// Also added additional reader commands (SELECT, READ etc.)
15c4dc5a 15//-----------------------------------------------------------------------------
9455b51c 16// The ISO 15693 describes two transmission modes from reader to tag, and 4
17// transmission modes from tag to reader. As of Mar 2010 this code only
18// supports one of each: "1of4" mode from reader to tag, and the highspeed
19// variant with one subcarrier from card to reader.
20// As long, as the card fully support ISO 15693 this is no problem, since the
21// reader chooses both data rates, but some non-standard tags do not. Further for
22// the simulation to work, we will need to support all data rates.
23//
24// VCD (reader) -> VICC (tag)
25// 1 out of 256:
26// data rate: 1,66 kbit/s (fc/8192)
27// used for long range
28// 1 out of 4:
29// data rate: 26,48 kbit/s (fc/512)
30// used for short range, high speed
31//
32// VICC (tag) -> VCD (reader)
33// Modulation:
34// ASK / one subcarrier (423,75 khz)
35// FSK / two subcarriers (423,75 khz && 484,28 khz)
36// Data Rates / Modes:
37// low ASK: 6,62 kbit/s
38// low FSK: 6.67 kbit/s
39// high ASK: 26,48 kbit/s
40// high FSK: 26,69 kbit/s
41//-----------------------------------------------------------------------------
42// added "1 out of 256" mode (for VCD->PICC) - atrox 20100911
43
44
45// Random Remarks:
46// *) UID is always used "transmission order" (LSB), which is reverse to display order
47
48// TODO / BUGS / ISSUES:
49// *) writing to tags takes longer: we miss the answer from the tag in most cases
50// -> tweak the read-timeout times
51// *) signal decoding from the card is still a bit shaky.
52// *) signal decoding is unable to detect collissions.
53// *) add anti-collission support for inventory-commands
e6304bca 54// *) read security status of a block
9455b51c 55// *) sniffing and simulation do only support one transmission mode. need to support
56// all 8 transmission combinations
57// *) remove or refactor code under "depricated"
58// *) document all the functions
59
bd20f8f4 60
e30c654b 61#include "proxmark3.h"
f7e3ed82 62#include "util.h"
15c4dc5a 63#include "apps.h"
9ab7a6c7 64#include "string.h"
9455b51c 65#include "iso15693tools.h"
902cb3c0 66#include "cmd.h"
15c4dc5a 67
15c4dc5a 68#define arraylen(x) (sizeof(x)/sizeof((x)[0]))
69
9455b51c 70///////////////////////////////////////////////////////////////////////
71// ISO 15693 Part 2 - Air Interface
72// This section basicly contains transmission and receiving of bits
73///////////////////////////////////////////////////////////////////////
74
75#define FrameSOF Iso15693FrameSOF
76#define Logic0 Iso15693Logic0
77#define Logic1 Iso15693Logic1
78#define FrameEOF Iso15693FrameEOF
15c4dc5a 79
9455b51c 80#define Crc(data,datalen) Iso15693Crc(data,datalen)
81#define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
82#define sprintUID(target,uid) Iso15693sprintUID(target,uid)
15c4dc5a 83
9455b51c 84int DEBUG=0;
85
86
87// ---------------------------
88// Signal Processing
89// ---------------------------
90
91// prepare data using "1 out of 4" code for later transmission
92// resulting data rate is 26,48 kbit/s (fc/512)
93// cmd ... data
94// n ... length of data
f7e3ed82 95static void CodeIso15693AsReader(uint8_t *cmd, int n)
15c4dc5a 96{
97 int i, j;
98
99 ToSendReset();
100
101 // Give it a bit of slack at the beginning
102 for(i = 0; i < 24; i++) {
103 ToSendStuffBit(1);
104 }
105
9455b51c 106 // SOF for 1of4
15c4dc5a 107 ToSendStuffBit(0);
108 ToSendStuffBit(1);
109 ToSendStuffBit(1);
110 ToSendStuffBit(1);
111 ToSendStuffBit(1);
112 ToSendStuffBit(0);
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 for(i = 0; i < n; i++) {
116 for(j = 0; j < 8; j += 2) {
117 int these = (cmd[i] >> j) & 3;
118 switch(these) {
119 case 0:
120 ToSendStuffBit(1);
121 ToSendStuffBit(0);
122 ToSendStuffBit(1);
123 ToSendStuffBit(1);
124 ToSendStuffBit(1);
125 ToSendStuffBit(1);
126 ToSendStuffBit(1);
127 ToSendStuffBit(1);
128 break;
129 case 1:
130 ToSendStuffBit(1);
131 ToSendStuffBit(1);
132 ToSendStuffBit(1);
133 ToSendStuffBit(0);
134 ToSendStuffBit(1);
135 ToSendStuffBit(1);
136 ToSendStuffBit(1);
137 ToSendStuffBit(1);
138 break;
139 case 2:
140 ToSendStuffBit(1);
141 ToSendStuffBit(1);
142 ToSendStuffBit(1);
143 ToSendStuffBit(1);
144 ToSendStuffBit(1);
145 ToSendStuffBit(0);
146 ToSendStuffBit(1);
147 ToSendStuffBit(1);
148 break;
149 case 3:
150 ToSendStuffBit(1);
151 ToSendStuffBit(1);
152 ToSendStuffBit(1);
153 ToSendStuffBit(1);
154 ToSendStuffBit(1);
155 ToSendStuffBit(1);
156 ToSendStuffBit(1);
157 ToSendStuffBit(0);
158 break;
159 }
160 }
161 }
9455b51c 162 // EOF
15c4dc5a 163 ToSendStuffBit(1);
164 ToSendStuffBit(1);
165 ToSendStuffBit(0);
166 ToSendStuffBit(1);
167
168 // And slack at the end, too.
169 for(i = 0; i < 24; i++) {
170 ToSendStuffBit(1);
171 }
172}
173
9455b51c 174// encode data using "1 out of 256" sheme
175// data rate is 1,66 kbit/s (fc/8192)
176// is designed for more robust communication over longer distances
177static void CodeIso15693AsReader256(uint8_t *cmd, int n)
15c4dc5a 178{
15c4dc5a 179 int i, j;
180
9455b51c 181 ToSendReset();
182
183 // Give it a bit of slack at the beginning
184 for(i = 0; i < 24; i++) {
185 ToSendStuffBit(1);
186 }
187
188 // SOF for 1of256
189 ToSendStuffBit(0);
190 ToSendStuffBit(1);
191 ToSendStuffBit(1);
192 ToSendStuffBit(1);
193 ToSendStuffBit(1);
194 ToSendStuffBit(1);
195 ToSendStuffBit(1);
196 ToSendStuffBit(0);
197
15c4dc5a 198 for(i = 0; i < n; i++) {
9455b51c 199 for (j = 0; j<=255; j++) {
200 if (cmd[i]==j) {
201 ToSendStuffBit(1);
202 ToSendStuffBit(0);
15c4dc5a 203 } else {
9455b51c 204 ToSendStuffBit(1);
205 ToSendStuffBit(1);
206 }
207 }
15c4dc5a 208 }
9455b51c 209 // EOF
210 ToSendStuffBit(1);
211 ToSendStuffBit(1);
212 ToSendStuffBit(0);
213 ToSendStuffBit(1);
15c4dc5a 214
9455b51c 215 // And slack at the end, too.
216 for(i = 0; i < 24; i++) {
217 ToSendStuffBit(1);
218 }
15c4dc5a 219}
220
9455b51c 221
15c4dc5a 222// Transmit the command (to the tag) that was placed in ToSend[].
f7e3ed82 223static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
15c4dc5a 224{
225 int c;
1b4a446a 226 volatile uint32_t r;
15c4dc5a 227// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
228 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
229 if(*wait < 10) { *wait = 10; }
230
231// for(c = 0; c < *wait;) {
232// if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
233// AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
1b4a446a 234// ++c;
15c4dc5a 235// }
236// if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1b4a446a 237// r = AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 238// (void)r;
239// }
240// WDT_HIT();
241// }
242
243 c = 0;
244 for(;;) {
245 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
246 AT91C_BASE_SSC->SSC_THR = cmd[c];
1b4a446a 247 if( ++c >= len) break;
15c4dc5a 248 }
249 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1b4a446a 250 r = AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 251 (void)r;
252 }
253 WDT_HIT();
254 }
255 *samples = (c + *wait) << 3;
256}
257
258//-----------------------------------------------------------------------------
259// Transmit the command (to the reader) that was placed in ToSend[].
260//-----------------------------------------------------------------------------
f7e3ed82 261static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
15c4dc5a 262{
3fe4ff4f 263 int c = 0;
1b4a446a 264 volatile uint32_t r;
3fe4ff4f 265 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
15c4dc5a 266 if(*wait < 10) { *wait = 10; }
267
15c4dc5a 268 for(;;) {
269 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
270 AT91C_BASE_SSC->SSC_THR = cmd[c];
1b4a446a 271 if( ++c >= len) break;
15c4dc5a 272 }
273 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1b4a446a 274 r = AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 275 (void)r;
276 }
277 WDT_HIT();
278 }
279 *samples = (c + *wait) << 3;
280}
281
9455b51c 282
283// Read from Tag
284// Parameters:
285// receivedResponse
286// maxLen
287// samples
288// elapsed
289// returns:
290// number of decoded bytes
f7e3ed82 291static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
15c4dc5a 292{
117d9ec2 293 uint8_t *dest = BigBuf_get_addr();
15c4dc5a 294
f2c2b174 295 int c = 0;
296 int getNext = FALSE;
f7e3ed82 297 int8_t prev = 0;
15c4dc5a 298
15c4dc5a 299 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
f2c2b174 300 SpinDelay(100); // greg - experiment to get rid of some of the 0 byte/failed reads
301
15c4dc5a 302 for(;;) {
f2c2b174 303 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
15c4dc5a 304 AT91C_BASE_SSC->SSC_THR = 0x43;
f2c2b174 305
15c4dc5a 306 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 307 int8_t b;
308 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 309
310 // The samples are correlations against I and Q versions of the
311 // tone that the tag AM-modulates, so every other sample is I,
312 // every other is Q. We just want power, so abs(I) + abs(Q) is
313 // close to what we want.
314 if(getNext) {
6fc68747 315 int8_t r = ABS(b) + ABS(prev);
15c4dc5a 316
f7e3ed82 317 dest[c++] = (uint8_t)r;
15c4dc5a 318
319 if(c >= 2000) {
320 break;
321 }
322 } else {
323 prev = b;
324 }
325
326 getNext = !getNext;
327 }
328 }
329
9455b51c 330 //////////////////////////////////////////
331 /////////// DEMODULATE ///////////////////
332 //////////////////////////////////////////
15c4dc5a 333
334 int i, j;
335 int max = 0, maxPos=0;
336
337 int skip = 4;
338
9455b51c 339 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
15c4dc5a 340
341 // First, correlate for SOF
342 for(i = 0; i < 100; i++) {
343 int corr = 0;
344 for(j = 0; j < arraylen(FrameSOF); j += skip) {
345 corr += FrameSOF[j]*dest[i+(j/skip)];
346 }
347 if(corr > max) {
348 max = corr;
349 maxPos = i;
350 }
351 }
9455b51c 352 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
15c4dc5a 353
354 int k = 0; // this will be our return value
355
356 // greg - If correlation is less than 1 then there's little point in continuing
357 if ((max/(arraylen(FrameSOF)/skip)) >= 1)
358 {
359
9455b51c 360 i = maxPos + arraylen(FrameSOF)/skip;
361
362 uint8_t outBuf[20];
363 memset(outBuf, 0, sizeof(outBuf));
364 uint8_t mask = 0x01;
365 for(;;) {
366 int corr0 = 0, corr1 = 0, corrEOF = 0;
367 for(j = 0; j < arraylen(Logic0); j += skip) {
368 corr0 += Logic0[j]*dest[i+(j/skip)];
369 }
370 for(j = 0; j < arraylen(Logic1); j += skip) {
371 corr1 += Logic1[j]*dest[i+(j/skip)];
372 }
373 for(j = 0; j < arraylen(FrameEOF); j += skip) {
374 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
375 }
376 // Even things out by the length of the target waveform.
377 corr0 *= 4;
378 corr1 *= 4;
379
380 if(corrEOF > corr1 && corrEOF > corr0) {
381 // DbpString("EOF at %d", i);
382 break;
383 } else if(corr1 > corr0) {
384 i += arraylen(Logic1)/skip;
385 outBuf[k] |= mask;
386 } else {
387 i += arraylen(Logic0)/skip;
388 }
389 mask <<= 1;
390 if(mask == 0) {
391 k++;
392 mask = 0x01;
393 }
394 if((i+(int)arraylen(FrameEOF)) >= 2000) {
395 DbpString("ran off end!");
396 break;
397 }
15c4dc5a 398 }
9455b51c 399 if(mask != 0x01) { // this happens, when we miss the EOF
400 // TODO: for some reason this happens quite often
401 if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
402 if (mask<0x08) k--; // discard the last uneven octet;
403 // 0x08 is an assumption - but works quite often
15c4dc5a 404 }
9455b51c 405 // uint8_t str1 [8];
406 // itoa(k,str1);
407 // strncat(str1," octets read",8);
408
409 // DbpString( str1); // DbpString("%d octets", k);
410
411 // for(i = 0; i < k; i+=3) {
412 // //DbpString("# %2d: %02x ", i, outBuf[i]);
413 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
414 // }
415
416 for(i = 0; i < k; i++) {
417 receivedResponse[i] = outBuf[i];
15c4dc5a 418 }
15c4dc5a 419 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
420 return k; // return the number of bytes demodulated
421
f2c2b174 422// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
15c4dc5a 423}
424
9455b51c 425
15c4dc5a 426// Now the GetISO15693 message from sniffing command
f7e3ed82 427static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
15c4dc5a 428{
117d9ec2 429 uint8_t *dest = BigBuf_get_addr();
15c4dc5a 430
f2c2b174 431 int c = 0;
432 int getNext = FALSE;
f7e3ed82 433 int8_t prev = 0;
15c4dc5a 434
15c4dc5a 435 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
f2c2b174 436 SpinDelay(100); // greg - experiment to get rid of some of the 0 byte/failed reads
437
15c4dc5a 438 for(;;) {
f2c2b174 439 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
15c4dc5a 440 AT91C_BASE_SSC->SSC_THR = 0x43;
f2c2b174 441
15c4dc5a 442 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
3fe4ff4f 443 int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 444
445 // The samples are correlations against I and Q versions of the
446 // tone that the tag AM-modulates, so every other sample is I,
447 // every other is Q. We just want power, so abs(I) + abs(Q) is
448 // close to what we want.
449 if(getNext) {
6fc68747 450 int8_t r = ABS(b) + ABS(prev);
15c4dc5a 451
f7e3ed82 452 dest[c++] = (uint8_t)r;
15c4dc5a 453
454 if(c >= 20000) {
455 break;
456 }
457 } else {
458 prev = b;
459 }
460
461 getNext = !getNext;
462 }
463 }
464
9455b51c 465 //////////////////////////////////////////
466 /////////// DEMODULATE ///////////////////
467 //////////////////////////////////////////
15c4dc5a 468
469 int i, j;
470 int max = 0, maxPos=0;
471
472 int skip = 4;
473
474// if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
475
476 // First, correlate for SOF
477 for(i = 0; i < 19000; i++) {
478 int corr = 0;
479 for(j = 0; j < arraylen(FrameSOF); j += skip) {
480 corr += FrameSOF[j]*dest[i+(j/skip)];
481 }
482 if(corr > max) {
483 max = corr;
484 maxPos = i;
485 }
486 }
487// DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
488
489 int k = 0; // this will be our return value
490
491 // greg - If correlation is less than 1 then there's little point in continuing
492 if ((max/(arraylen(FrameSOF)/skip)) >= 1) // THIS SHOULD BE 1
493 {
9455b51c 494
495 i = maxPos + arraylen(FrameSOF)/skip;
496
497 uint8_t outBuf[20];
498 memset(outBuf, 0, sizeof(outBuf));
499 uint8_t mask = 0x01;
500 for(;;) {
501 int corr0 = 0, corr1 = 0, corrEOF = 0;
502 for(j = 0; j < arraylen(Logic0); j += skip) {
503 corr0 += Logic0[j]*dest[i+(j/skip)];
504 }
505 for(j = 0; j < arraylen(Logic1); j += skip) {
506 corr1 += Logic1[j]*dest[i+(j/skip)];
507 }
508 for(j = 0; j < arraylen(FrameEOF); j += skip) {
509 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
510 }
511 // Even things out by the length of the target waveform.
512 corr0 *= 4;
513 corr1 *= 4;
514
515 if(corrEOF > corr1 && corrEOF > corr0) {
516 // DbpString("EOF at %d", i);
517 break;
518 } else if(corr1 > corr0) {
519 i += arraylen(Logic1)/skip;
520 outBuf[k] |= mask;
521 } else {
522 i += arraylen(Logic0)/skip;
523 }
524 mask <<= 1;
525 if(mask == 0) {
526 k++;
527 mask = 0x01;
528 }
529 if((i+(int)arraylen(FrameEOF)) >= 2000) {
530 DbpString("ran off end!");
531 break;
532 }
15c4dc5a 533 }
9455b51c 534 if(mask != 0x01) {
535 DbpString("sniff: error, uneven octet! (discard extra bits!)");
536 /// DbpString(" mask=%02x", mask);
15c4dc5a 537 }
9455b51c 538 // uint8_t str1 [8];
539 // itoa(k,str1);
540 // strncat(str1," octets read",8);
541
542 // DbpString( str1); // DbpString("%d octets", k);
543
544 // for(i = 0; i < k; i+=3) {
545 // //DbpString("# %2d: %02x ", i, outBuf[i]);
546 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
547 // }
548
549 for(i = 0; i < k; i++) {
550 receivedResponse[i] = outBuf[i];
15c4dc5a 551 }
15c4dc5a 552 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
553 return k; // return the number of bytes demodulated
554
555/// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
556}
557
9455b51c 558
559static void BuildIdentifyRequest(void);
15c4dc5a 560//-----------------------------------------------------------------------------
561// Start to read an ISO 15693 tag. We send an identify request, then wait
562// for the response. The response is not demodulated, just left in the buffer
563// so that it can be downloaded to a PC and processed there.
564//-----------------------------------------------------------------------------
565void AcquireRawAdcSamplesIso15693(void)
566{
1b4a446a 567 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 568
3fe4ff4f 569 int c = 0;
570 int getNext = 0;
f7e3ed82 571 int8_t prev = 0;
1b4a446a 572 volatile uint32_t r;
15c4dc5a 573
1b4a446a 574 uint8_t *dest = BigBuf_get_addr();
15c4dc5a 575 BuildIdentifyRequest();
576
577 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
578
579 // Give the tags time to energize
580 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
581 SpinDelay(100);
582
583 // Now send the command
584 FpgaSetupSsc();
585 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
586
587 c = 0;
588 for(;;) {
589 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
590 AT91C_BASE_SSC->SSC_THR = ToSend[c];
1b4a446a 591 if( ++c == ToSendMax+3) break;
15c4dc5a 592 }
593 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1b4a446a 594 r = AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 595 (void)r;
596 }
597 WDT_HIT();
598 }
599
600 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
601
602 c = 0;
603 getNext = FALSE;
604 for(;;) {
1b4a446a 605 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
15c4dc5a 606 AT91C_BASE_SSC->SSC_THR = 0x43;
1b4a446a 607
15c4dc5a 608 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 609 int8_t b;
610 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 611
9455b51c 612 // The samples are correlations against I and Q versions of the
613 // tone that the tag AM-modulates, so every other sample is I,
614 // every other is Q. We just want power, so abs(I) + abs(Q) is
615 // close to what we want.
616 if(getNext) {
1b4a446a 617
618 dest[c++] = (uint8_t)(ABS(b) + ABS(prev));
9455b51c 619
1b4a446a 620 if(c >= 2000) break;
621
9455b51c 622 } else {
623 prev = b;
624 }
625
626 getNext = !getNext;
627 }
628 }
629}
630
631
632void RecordRawAdcSamplesIso15693(void)
633{
117d9ec2 634 uint8_t *dest = BigBuf_get_addr();
3fe4ff4f 635
9455b51c 636 int c = 0;
9455b51c 637 int getNext = 0;
9455b51c 638 int8_t prev = 0;
639
7cc204bf 640 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9455b51c 641 // Setup SSC
642 FpgaSetupSsc();
643
644 // Start from off (no field generated)
5ee53a0e 645 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
646 SpinDelay(200);
9455b51c 647
648 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
649
650 SpinDelay(100);
651
652 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
653
654 c = 0;
655 getNext = FALSE;
656 for(;;) {
657 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
658 AT91C_BASE_SSC->SSC_THR = 0x43;
659 }
660 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
661 int8_t b;
662 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
663
664 // The samples are correlations against I and Q versions of the
665 // tone that the tag AM-modulates, so every other sample is I,
666 // every other is Q. We just want power, so abs(I) + abs(Q) is
667 // close to what we want.
668 if(getNext) {
6fc68747 669 int8_t r = ABS(b) + ABS(prev);
9455b51c 670
671 dest[c++] = (uint8_t)r;
672
673 if(c >= 7000) {
674 break;
675 }
676 } else {
677 prev = b;
678 }
679
680 getNext = !getNext;
681 WDT_HIT();
682 }
683 }
684 Dbprintf("fin record");
685}
686
687
688// Initialize the proxmark as iso15k reader
e6304bca 689// (this might produces glitches that confuse some tags
9455b51c 690void Iso15693InitReader() {
691 LED_A_ON();
692 LED_B_ON();
693 LED_C_OFF();
694 LED_D_OFF();
695
7cc204bf 696 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9455b51c 697 // Setup SSC
e6304bca 698 // FpgaSetupSsc();
9455b51c 699
700 // Start from off (no field generated)
701 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
e6304bca 702 SpinDelay(10);
9455b51c 703
704 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
705 FpgaSetupSsc();
706
707 // Give the tags time to energize
708 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
e6304bca 709 SpinDelay(250);
9455b51c 710
711 LED_A_ON();
712 LED_B_OFF();
713 LED_C_OFF();
714 LED_D_OFF();
715}
716
717///////////////////////////////////////////////////////////////////////
718// ISO 15693 Part 3 - Air Interface
719// This section basicly contains transmission and receiving of bits
720///////////////////////////////////////////////////////////////////////
721
722// Encode (into the ToSend buffers) an identify request, which is the first
723// thing that you must send to a tag to get a response.
724static void BuildIdentifyRequest(void)
725{
726 uint8_t cmd[5];
727
728 uint16_t crc;
729 // one sub-carrier, inventory, 1 slot, fast rate
730 // AFI is at bit 5 (1<<4) when doing an INVENTORY
731 cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
732 // inventory command code
733 cmd[1] = 0x01;
734 // no mask
735 cmd[2] = 0x00;
736 //Now the CRC
737 crc = Crc(cmd, 3);
738 cmd[3] = crc & 0xff;
739 cmd[4] = crc >> 8;
740
741 CodeIso15693AsReader(cmd, sizeof(cmd));
742}
743
744// uid is in transmission order (which is reverse of display order)
745static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
746{
747 uint8_t cmd[13];
748
749 uint16_t crc;
750 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
751 // followed by teh block data
752 // one sub-carrier, inventory, 1 slot, fast rate
753 cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit, ADDR bit, OPTION bit
754 // READ BLOCK command code
755 cmd[1] = 0x20;
756 // UID may be optionally specified here
757 // 64-bit UID
758 cmd[2] = uid[0];
759 cmd[3] = uid[1];
760 cmd[4] = uid[2];
761 cmd[5] = uid[3];
762 cmd[6] = uid[4];
763 cmd[7] = uid[5];
764 cmd[8] = uid[6];
765 cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique)
766 // Block number to read
767 cmd[10] = blockNumber;//0x00;
768 //Now the CRC
769 crc = Crc(cmd, 11); // the crc needs to be calculated over 12 bytes
770 cmd[11] = crc & 0xff;
771 cmd[12] = crc >> 8;
772
773 CodeIso15693AsReader(cmd, sizeof(cmd));
774}
775
776// Now the VICC>VCD responses when we are simulating a tag
3fe4ff4f 777 static void BuildInventoryResponse( uint8_t *uid)
9455b51c 778{
779 uint8_t cmd[12];
780
781 uint16_t crc;
782 // one sub-carrier, inventory, 1 slot, fast rate
783 // AFI is at bit 5 (1<<4) when doing an INVENTORY
3fe4ff4f 784 //(1 << 2) | (1 << 5) | (1 << 1);
785 cmd[0] = 0; //
786 cmd[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported
9455b51c 787 // 64-bit UID
3fe4ff4f 788 cmd[2] = uid[7]; //0x32;
789 cmd[3] = uid[6]; //0x4b;
790 cmd[4] = uid[5]; //0x03;
791 cmd[5] = uid[4]; //0x01;
792 cmd[6] = uid[3]; //0x00;
793 cmd[7] = uid[2]; //0x10;
794 cmd[8] = uid[1]; //0x05;
795 cmd[9] = uid[0]; //0xe0;
9455b51c 796 //Now the CRC
797 crc = Crc(cmd, 10);
798 cmd[10] = crc & 0xff;
799 cmd[11] = crc >> 8;
800
801 CodeIso15693AsReader(cmd, sizeof(cmd));
802}
803
e6304bca 804// Universal Method for sending to and recv bytes from a tag
9455b51c 805// init ... should we initialize the reader?
806// speed ... 0 low speed, 1 hi speed
807// **recv will return you a pointer to the received data
808// If you do not need the answer use NULL for *recv[]
809// return: lenght of received data
810int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) {
811
812 int samples = 0;
813 int tsamples = 0;
814 int wait = 0;
815 int elapsed = 0;
816
817 LED_A_ON();
818 LED_B_ON();
819 LED_C_OFF();
820 LED_D_OFF();
821
99cf19d9 822 if (init) Iso15693InitReader();
823
9455b51c 824 int answerLen=0;
117d9ec2 825 uint8_t *answer = BigBuf_get_addr() + 3660;
826 if (recv != NULL) memset(answer, 0, 100);
9455b51c 827
9455b51c 828 if (!speed) {
829 // low speed (1 out of 256)
830 CodeIso15693AsReader256(send, sendlen);
831 } else {
832 // high speed (1 out of 4)
833 CodeIso15693AsReader(send, sendlen);
834 }
835
836 LED_A_ON();
837 LED_B_OFF();
838
839 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
840 // Now wait for a response
841 if (recv!=NULL) {
842 LED_A_OFF();
843 LED_B_ON();
844 answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ;
845 *recv=answer;
846 }
847
4a71da5a 848 LEDsoff();
9455b51c 849
850 return answerLen;
851}
15c4dc5a 852
15c4dc5a 853
9455b51c 854// --------------------------------------------------------------------
855// Debug Functions
856// --------------------------------------------------------------------
15c4dc5a 857
9455b51c 858// Decodes a message from a tag and displays its metadata and content
859#define DBD15STATLEN 48
860void DbdecodeIso15693Answer(int len, uint8_t *d) {
861 char status[DBD15STATLEN+1]={0};
862 uint16_t crc;
863
864 if (len>3) {
865 if (d[0]&(1<<3))
866 strncat(status,"ProtExt ",DBD15STATLEN);
867 if (d[0]&1) {
868 // error
869 strncat(status,"Error ",DBD15STATLEN);
870 switch (d[1]) {
871 case 0x01:
872 strncat(status,"01:notSupp",DBD15STATLEN);
15c4dc5a 873 break;
9455b51c 874 case 0x02:
875 strncat(status,"02:notRecog",DBD15STATLEN);
876 break;
877 case 0x03:
878 strncat(status,"03:optNotSupp",DBD15STATLEN);
879 break;
880 case 0x0f:
881 strncat(status,"0f:noInfo",DBD15STATLEN);
882 break;
883 case 0x10:
884 strncat(status,"10:dontExist",DBD15STATLEN);
885 break;
886 case 0x11:
887 strncat(status,"11:lockAgain",DBD15STATLEN);
888 break;
889 case 0x12:
890 strncat(status,"12:locked",DBD15STATLEN);
891 break;
892 case 0x13:
893 strncat(status,"13:progErr",DBD15STATLEN);
894 break;
895 case 0x14:
896 strncat(status,"14:lockErr",DBD15STATLEN);
897 break;
898 default:
899 strncat(status,"unknownErr",DBD15STATLEN);
15c4dc5a 900 }
9455b51c 901 strncat(status," ",DBD15STATLEN);
902 } else {
903 strncat(status,"NoErr ",DBD15STATLEN);
15c4dc5a 904 }
9455b51c 905
906 crc=Crc(d,len-2);
907 if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) )
908 strncat(status,"CrcOK",DBD15STATLEN);
909 else
910 strncat(status,"CrcFail!",DBD15STATLEN);
911
912 Dbprintf("%s",status);
15c4dc5a 913 }
914}
915
9455b51c 916
917
918///////////////////////////////////////////////////////////////////////
919// Functions called via USB/Client
920///////////////////////////////////////////////////////////////////////
921
922void SetDebugIso15693(uint32_t debug) {
923 DEBUG=debug;
924 Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off");
925 return;
926}
927
928
929
15c4dc5a 930//-----------------------------------------------------------------------------
931// Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
932// all demodulation performed in arm rather than host. - greg
933//-----------------------------------------------------------------------------
f7e3ed82 934void ReaderIso15693(uint32_t parameter)
15c4dc5a 935{
936 LED_A_ON();
937 LED_B_ON();
938 LED_C_OFF();
939 LED_D_OFF();
940
15c4dc5a 941 int answerLen1 = 0;
942 int answerLen2 = 0;
943 int answerLen3 = 0;
3fe4ff4f 944 int i = 0;
945 int samples = 0;
946 int tsamples = 0;
947 int wait = 0;
948 int elapsed = 0;
949 uint8_t TagUID[8] = {0x00};
950
99cf19d9 951 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 952
99cf19d9 953 uint8_t *answer1 = BigBuf_get_addr() + 3660;
954 uint8_t *answer2 = BigBuf_get_addr() + 3760;
955 uint8_t *answer3 = BigBuf_get_addr() + 3860;
15c4dc5a 956 // Blank arrays
117d9ec2 957 memset(answer1, 0x00, 300);
15c4dc5a 958
3fe4ff4f 959 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
15c4dc5a 960 // Setup SSC
961 FpgaSetupSsc();
962
963 // Start from off (no field generated)
5ee53a0e 964 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
965 SpinDelay(200);
15c4dc5a 966
15c4dc5a 967 // Give the tags time to energize
968 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
969 SpinDelay(200);
970
971 LED_A_ON();
972 LED_B_OFF();
973 LED_C_OFF();
974 LED_D_OFF();
975
15c4dc5a 976 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
977 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
15c4dc5a 978
979 // Now send the IDENTIFY command
980 BuildIdentifyRequest();
3fe4ff4f 981
982 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
983
15c4dc5a 984 // Now wait for a response
985 answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
986
987 if (answerLen1 >=12) // we should do a better check than this
988 {
15c4dc5a 989 TagUID[0] = answer1[2];
990 TagUID[1] = answer1[3];
991 TagUID[2] = answer1[4];
992 TagUID[3] = answer1[5];
993 TagUID[4] = answer1[6];
994 TagUID[5] = answer1[7];
995 TagUID[6] = answer1[8]; // IC Manufacturer code
9455b51c 996 TagUID[7] = answer1[9]; // always E0
15c4dc5a 997
15c4dc5a 998 }
999
9455b51c 1000 Dbprintf("%d octets read from IDENTIFY request:", answerLen1);
1001 DbdecodeIso15693Answer(answerLen1,answer1);
d19929cb 1002 Dbhexdump(answerLen1,answer1,true);
9455b51c 1003
1004 // UID is reverse
1005 if (answerLen1>=12)
3fe4ff4f 1006 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1007 TagUID[7],TagUID[6],TagUID[5],TagUID[4],
1008 TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
9455b51c 1009
1010
1011 Dbprintf("%d octets read from SELECT request:", answerLen2);
1012 DbdecodeIso15693Answer(answerLen2,answer2);
d19929cb 1013 Dbhexdump(answerLen2,answer2,true);
9455b51c 1014
1015 Dbprintf("%d octets read from XXX request:", answerLen3);
1016 DbdecodeIso15693Answer(answerLen3,answer3);
d19929cb 1017 Dbhexdump(answerLen3,answer3,true);
9455b51c 1018
9455b51c 1019 // read all pages
1020 if (answerLen1>=12 && DEBUG) {
1021 i=0;
1022 while (i<32) { // sanity check, assume max 32 pages
1023 BuildReadBlockRequest(TagUID,i);
1024 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
1025 answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
1026 if (answerLen2>0) {
1027 Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
1028 DbdecodeIso15693Answer(answerLen2,answer2);
d19929cb 1029 Dbhexdump(answerLen2,answer2,true);
9455b51c 1030 if ( *((uint32_t*) answer2) == 0x07160101 ) break; // exit on NoPageErr
1031 }
1032 i++;
1033 }
1034 }
15c4dc5a 1035
15c4dc5a 1036 LED_A_OFF();
1037 LED_B_OFF();
1038 LED_C_OFF();
1039 LED_D_OFF();
1040}
1041
15c4dc5a 1042// Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1043// all demodulation performed in arm rather than host. - greg
3fe4ff4f 1044void SimTagIso15693(uint32_t parameter, uint8_t *uid)
15c4dc5a 1045{
1046 LED_A_ON();
1047 LED_B_ON();
1048 LED_C_OFF();
1049 LED_D_OFF();
1050
15c4dc5a 1051 int answerLen1 = 0;
3fe4ff4f 1052 int samples = 0;
1053 int tsamples = 0;
1054 int wait = 0;
1055 int elapsed = 0;
15c4dc5a 1056
7cc204bf 1057 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1058
99cf19d9 1059 uint8_t *buf = BigBuf_get_addr() + 3660;
1060 memset(buf, 0x00, 100);
3fe4ff4f 1061
99cf19d9 1062 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
15c4dc5a 1063 FpgaSetupSsc();
1064
3fe4ff4f 1065 // Start from off (no field generated)
5ee53a0e 1066 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 1067 SpinDelay(200);
1068
1069 LED_A_OFF();
1070 LED_B_OFF();
1071 LED_C_ON();
1072 LED_D_OFF();
1073
3fe4ff4f 1074 // Listen to reader
1075 answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
15c4dc5a 1076
1077 if (answerLen1 >=1) // we should do a better check than this
1078 {
1079 // Build a suitable reponse to the reader INVENTORY cocmmand
3fe4ff4f 1080 // not so obsvious, but in the call to BuildInventoryResponse, the command is copied to the global ToSend buffer used below.
1081
1082 BuildInventoryResponse(uid);
1083
15c4dc5a 1084 TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
1085 }
1086
1087 Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
3fe4ff4f 1088 buf[0], buf[1], buf[2], buf[3],
1089 buf[4], buf[5], buf[6], buf[7], buf[8]);
1090
1091 Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x",
1092 uid[0], uid[1], uid[2], uid[3],
1093 uid[4], uid[5], uid[6], uid[7]);
15c4dc5a 1094
1095 LED_A_OFF();
1096 LED_B_OFF();
1097 LED_C_OFF();
1098 LED_D_OFF();
1099}
9455b51c 1100
1101
1102// Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1103// (some manufactures offer a way to read the AFI, though)
1104void BruteforceIso15693Afi(uint32_t speed)
1105{
1106 uint8_t data[20];
1107 uint8_t *recv=data;
1108 int datalen=0, recvlen=0;
1109
1110 Iso15693InitReader();
1111
1112 // first without AFI
1113 // Tags should respond wihtout AFI and with AFI=0 even when AFI is active
1114
1115 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1116 ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
1117 data[1]=ISO15_CMD_INVENTORY;
1118 data[2]=0; // mask length
1119 datalen=AddCrc(data,3);
1120 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1121 WDT_HIT();
1122 if (recvlen>=12) {
1123 Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
1124 }
1125
1126 // now with AFI
1127
1128 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1129 ISO15_REQ_INVENTORY | ISO15_REQINV_AFI | ISO15_REQINV_SLOT1;
1130 data[1]=ISO15_CMD_INVENTORY;
1131 data[2]=0; // AFI
1132 data[3]=0; // mask length
1133
1134 for (int i=0;i<256;i++) {
1135 data[2]=i & 0xFF;
1136 datalen=AddCrc(data,4);
1137 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1138 WDT_HIT();
1139 if (recvlen>=12) {
1140 Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
1141 }
1142 }
1143 Dbprintf("AFI Bruteforcing done.");
1144
1145}
1146
1147// Allows to directly send commands to the tag via the client
1148void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
1149
1150 int recvlen=0;
117d9ec2 1151 uint8_t *recvbuf = BigBuf_get_addr();
902cb3c0 1152// UsbCommand n;
9455b51c 1153
1154 if (DEBUG) {
1155 Dbprintf("SEND");
d19929cb 1156 Dbhexdump(datalen,data,true);
9455b51c 1157 }
1158
1159 recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
1160
1161 if (recv) {
9455b51c 1162 LED_B_ON();
902cb3c0 1163 cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
9455b51c 1164 LED_B_OFF();
1165
1166 if (DEBUG) {
1167 Dbprintf("RECV");
1168 DbdecodeIso15693Answer(recvlen,recvbuf);
d19929cb 1169 Dbhexdump(recvlen,recvbuf,true);
9455b51c 1170 }
1171 }
1172
1173}
1174
1175
1176
1177
1178// --------------------------------------------------------------------
1179// -- Misc & deprecated functions
1180// --------------------------------------------------------------------
1181
e6304bca 1182/*
9455b51c 1183
1184// do not use; has a fix UID
1185static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1186{
1187 uint8_t cmd[12];
1188
1189 uint16_t crc;
1190 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1191 // followed by teh block data
1192 // one sub-carrier, inventory, 1 slot, fast rate
1193 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1194 // System Information command code
1195 cmd[1] = 0x2B;
1196 // UID may be optionally specified here
1197 // 64-bit UID
1198 cmd[2] = 0x32;
1199 cmd[3]= 0x4b;
1200 cmd[4] = 0x03;
1201 cmd[5] = 0x01;
1202 cmd[6] = 0x00;
1203 cmd[7] = 0x10;
1204 cmd[8] = 0x05;
1205 cmd[9]= 0xe0; // always e0 (not exactly unique)
1206 //Now the CRC
1207 crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1208 cmd[10] = crc & 0xff;
1209 cmd[11] = crc >> 8;
1210
1211 CodeIso15693AsReader(cmd, sizeof(cmd));
1212}
1213
9455b51c 1214
1215// do not use; has a fix UID
1216static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1217{
1218 uint8_t cmd[14];
1219
1220 uint16_t crc;
1221 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1222 // followed by teh block data
1223 // one sub-carrier, inventory, 1 slot, fast rate
1224 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1225 // READ Multi BLOCK command code
1226 cmd[1] = 0x23;
1227 // UID may be optionally specified here
1228 // 64-bit UID
1229 cmd[2] = 0x32;
1230 cmd[3]= 0x4b;
1231 cmd[4] = 0x03;
1232 cmd[5] = 0x01;
1233 cmd[6] = 0x00;
1234 cmd[7] = 0x10;
1235 cmd[8] = 0x05;
1236 cmd[9]= 0xe0; // always e0 (not exactly unique)
1237 // First Block number to read
1238 cmd[10] = 0x00;
1239 // Number of Blocks to read
1240 cmd[11] = 0x2f; // read quite a few
1241 //Now the CRC
1242 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1243 cmd[12] = crc & 0xff;
1244 cmd[13] = crc >> 8;
1245
1246 CodeIso15693AsReader(cmd, sizeof(cmd));
1247}
1248
1249// do not use; has a fix UID
1250static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1251{
1252 uint8_t cmd[14];
1253
1254 uint16_t crc;
1255 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1256 // followed by teh block data
1257 // one sub-carrier, inventory, 1 slot, fast rate
1258 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1259 // READ BLOCK command code
1260 cmd[1] = CmdCode;
1261 // UID may be optionally specified here
1262 // 64-bit UID
1263 cmd[2] = 0x32;
1264 cmd[3]= 0x4b;
1265 cmd[4] = 0x03;
1266 cmd[5] = 0x01;
1267 cmd[6] = 0x00;
1268 cmd[7] = 0x10;
1269 cmd[8] = 0x05;
1270 cmd[9]= 0xe0; // always e0 (not exactly unique)
1271 // Parameter
1272 cmd[10] = 0x00;
1273 cmd[11] = 0x0a;
1274
1275// cmd[12] = 0x00;
1276// cmd[13] = 0x00; //Now the CRC
1277 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1278 cmd[12] = crc & 0xff;
1279 cmd[13] = crc >> 8;
1280
1281 CodeIso15693AsReader(cmd, sizeof(cmd));
1282}
1283
1284// do not use; has a fix UID
1285static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1286{
1287 uint8_t cmd[14];
1288
1289 uint16_t crc;
1290 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1291 // followed by teh block data
1292 // one sub-carrier, inventory, 1 slot, fast rate
1293 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1294 // READ BLOCK command code
1295 cmd[1] = CmdCode;
1296 // UID may be optionally specified here
1297 // 64-bit UID
1298 cmd[2] = 0x32;
1299 cmd[3]= 0x4b;
1300 cmd[4] = 0x03;
1301 cmd[5] = 0x01;
1302 cmd[6] = 0x00;
1303 cmd[7] = 0x10;
1304 cmd[8] = 0x05;
1305 cmd[9]= 0xe0; // always e0 (not exactly unique)
1306 // Parameter
1307 cmd[10] = 0x05; // for custom codes this must be manufcturer code
1308 cmd[11] = 0x00;
1309
1310// cmd[12] = 0x00;
1311// cmd[13] = 0x00; //Now the CRC
1312 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1313 cmd[12] = crc & 0xff;
1314 cmd[13] = crc >> 8;
1315
1316 CodeIso15693AsReader(cmd, sizeof(cmd));
1317}
1318
1319
1320
1321
e6304bca 1322*/
9455b51c 1323
1324
Proxmark3 GIT tracking
Impressum, Datenschutz