| 1 | //----------------------------------------------------------------------------- |
| 2 | // Jonathan Westhues, split Nov 2006 |
| 3 | // Modified by Greg Jones, Jan 2009 |
| 4 | // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011 |
| 5 | // |
| 6 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| 7 | // at your option, any later version. See the LICENSE.txt file for the text of |
| 8 | // the license. |
| 9 | //----------------------------------------------------------------------------- |
| 10 | // Routines to support ISO 15693. This includes both the reader software and |
| 11 | // the `fake tag' modes, but at the moment I've implemented only the reader |
| 12 | // stuff, and that barely. |
| 13 | // Modified to perform modulation onboard in arm rather than on PC |
| 14 | // Also added additional reader commands (SELECT, READ etc.) |
| 15 | //----------------------------------------------------------------------------- |
| 16 | // The ISO 15693 describes two transmission modes from reader to tag, and 4 |
| 17 | // transmission modes from tag to reader. As of Mar 2010 this code only |
| 18 | // supports one of each: "1of4" mode from reader to tag, and the highspeed |
| 19 | // variant with one subcarrier from card to reader. |
| 20 | // As long, as the card fully support ISO 15693 this is no problem, since the |
| 21 | // reader chooses both data rates, but some non-standard tags do not. Further for |
| 22 | // the simulation to work, we will need to support all data rates. |
| 23 | // |
| 24 | // VCD (reader) -> VICC (tag) |
| 25 | // 1 out of 256: |
| 26 | // data rate: 1,66 kbit/s (fc/8192) |
| 27 | // used for long range |
| 28 | // 1 out of 4: |
| 29 | // data rate: 26,48 kbit/s (fc/512) |
| 30 | // used for short range, high speed |
| 31 | // |
| 32 | // VICC (tag) -> VCD (reader) |
| 33 | // Modulation: |
| 34 | // ASK / one subcarrier (423,75 khz) |
| 35 | // FSK / two subcarriers (423,75 khz && 484,28 khz) |
| 36 | // Data Rates / Modes: |
| 37 | // low ASK: 6,62 kbit/s |
| 38 | // low FSK: 6.67 kbit/s |
| 39 | // high ASK: 26,48 kbit/s |
| 40 | // high FSK: 26,69 kbit/s |
| 41 | //----------------------------------------------------------------------------- |
| 42 | // added "1 out of 256" mode (for VCD->PICC) - atrox 20100911 |
| 43 | |
| 44 | |
| 45 | // Random Remarks: |
| 46 | // *) UID is always used "transmission order" (LSB), which is reverse to display order |
| 47 | |
| 48 | // TODO / BUGS / ISSUES: |
| 49 | // *) writing to tags takes longer: we miss the answer from the tag in most cases |
| 50 | // -> tweak the read-timeout times |
| 51 | // *) signal decoding from the card is still a bit shaky. |
| 52 | // *) signal decoding is unable to detect collissions. |
| 53 | // *) add anti-collission support for inventory-commands |
| 54 | // *) read security status of a block |
| 55 | // *) sniffing and simulation do only support one transmission mode. need to support |
| 56 | // all 8 transmission combinations |
| 57 | // *) remove or refactor code under "depricated" |
| 58 | // *) document all the functions |
| 59 | |
| 60 | |
| 61 | #include "proxmark3.h" |
| 62 | #include "util.h" |
| 63 | #include "apps.h" |
| 64 | #include "string.h" |
| 65 | #include "iso15693tools.h" |
| 66 | #include "cmd.h" |
| 67 | |
| 68 | #define arraylen(x) (sizeof(x)/sizeof((x)[0])) |
| 69 | |
| 70 | /////////////////////////////////////////////////////////////////////// |
| 71 | // ISO 15693 Part 2 - Air Interface |
| 72 | // This section basicly contains transmission and receiving of bits |
| 73 | /////////////////////////////////////////////////////////////////////// |
| 74 | |
| 75 | #define FrameSOF Iso15693FrameSOF |
| 76 | #define Logic0 Iso15693Logic0 |
| 77 | #define Logic1 Iso15693Logic1 |
| 78 | #define FrameEOF Iso15693FrameEOF |
| 79 | |
| 80 | #define Crc(data,datalen) Iso15693Crc(data,datalen) |
| 81 | #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen) |
| 82 | #define sprintUID(target,uid) Iso15693sprintUID(target,uid) |
| 83 | |
| 84 | int DEBUG=0; |
| 85 | |
| 86 | |
| 87 | // --------------------------- |
| 88 | // Signal Processing |
| 89 | // --------------------------- |
| 90 | |
| 91 | // prepare data using "1 out of 4" code for later transmission |
| 92 | // resulting data rate is 26,48 kbit/s (fc/512) |
| 93 | // cmd ... data |
| 94 | // n ... length of data |
| 95 | static void CodeIso15693AsReader(uint8_t *cmd, int n) |
| 96 | { |
| 97 | int i, j; |
| 98 | |
| 99 | ToSendReset(); |
| 100 | |
| 101 | // Give it a bit of slack at the beginning |
| 102 | for(i = 0; i < 24; i++) { |
| 103 | ToSendStuffBit(1); |
| 104 | } |
| 105 | |
| 106 | // SOF for 1of4 |
| 107 | ToSendStuffBit(0); |
| 108 | ToSendStuffBit(1); |
| 109 | ToSendStuffBit(1); |
| 110 | ToSendStuffBit(1); |
| 111 | ToSendStuffBit(1); |
| 112 | ToSendStuffBit(0); |
| 113 | ToSendStuffBit(1); |
| 114 | ToSendStuffBit(1); |
| 115 | for(i = 0; i < n; i++) { |
| 116 | for(j = 0; j < 8; j += 2) { |
| 117 | int these = (cmd[i] >> j) & 3; |
| 118 | switch(these) { |
| 119 | case 0: |
| 120 | ToSendStuffBit(1); |
| 121 | ToSendStuffBit(0); |
| 122 | ToSendStuffBit(1); |
| 123 | ToSendStuffBit(1); |
| 124 | ToSendStuffBit(1); |
| 125 | ToSendStuffBit(1); |
| 126 | ToSendStuffBit(1); |
| 127 | ToSendStuffBit(1); |
| 128 | break; |
| 129 | case 1: |
| 130 | ToSendStuffBit(1); |
| 131 | ToSendStuffBit(1); |
| 132 | ToSendStuffBit(1); |
| 133 | ToSendStuffBit(0); |
| 134 | ToSendStuffBit(1); |
| 135 | ToSendStuffBit(1); |
| 136 | ToSendStuffBit(1); |
| 137 | ToSendStuffBit(1); |
| 138 | break; |
| 139 | case 2: |
| 140 | ToSendStuffBit(1); |
| 141 | ToSendStuffBit(1); |
| 142 | ToSendStuffBit(1); |
| 143 | ToSendStuffBit(1); |
| 144 | ToSendStuffBit(1); |
| 145 | ToSendStuffBit(0); |
| 146 | ToSendStuffBit(1); |
| 147 | ToSendStuffBit(1); |
| 148 | break; |
| 149 | case 3: |
| 150 | ToSendStuffBit(1); |
| 151 | ToSendStuffBit(1); |
| 152 | ToSendStuffBit(1); |
| 153 | ToSendStuffBit(1); |
| 154 | ToSendStuffBit(1); |
| 155 | ToSendStuffBit(1); |
| 156 | ToSendStuffBit(1); |
| 157 | ToSendStuffBit(0); |
| 158 | break; |
| 159 | } |
| 160 | } |
| 161 | } |
| 162 | // EOF |
| 163 | ToSendStuffBit(1); |
| 164 | ToSendStuffBit(1); |
| 165 | ToSendStuffBit(0); |
| 166 | ToSendStuffBit(1); |
| 167 | |
| 168 | // And slack at the end, too. |
| 169 | for(i = 0; i < 24; i++) { |
| 170 | ToSendStuffBit(1); |
| 171 | } |
| 172 | } |
| 173 | |
| 174 | // encode data using "1 out of 256" sheme |
| 175 | // data rate is 1,66 kbit/s (fc/8192) |
| 176 | // is designed for more robust communication over longer distances |
| 177 | static void CodeIso15693AsReader256(uint8_t *cmd, int n) |
| 178 | { |
| 179 | int i, j; |
| 180 | |
| 181 | ToSendReset(); |
| 182 | |
| 183 | // Give it a bit of slack at the beginning |
| 184 | for(i = 0; i < 24; i++) { |
| 185 | ToSendStuffBit(1); |
| 186 | } |
| 187 | |
| 188 | // SOF for 1of256 |
| 189 | ToSendStuffBit(0); |
| 190 | ToSendStuffBit(1); |
| 191 | ToSendStuffBit(1); |
| 192 | ToSendStuffBit(1); |
| 193 | ToSendStuffBit(1); |
| 194 | ToSendStuffBit(1); |
| 195 | ToSendStuffBit(1); |
| 196 | ToSendStuffBit(0); |
| 197 | |
| 198 | for(i = 0; i < n; i++) { |
| 199 | for (j = 0; j<=255; j++) { |
| 200 | if (cmd[i]==j) { |
| 201 | ToSendStuffBit(1); |
| 202 | ToSendStuffBit(0); |
| 203 | } else { |
| 204 | ToSendStuffBit(1); |
| 205 | ToSendStuffBit(1); |
| 206 | } |
| 207 | } |
| 208 | } |
| 209 | // EOF |
| 210 | ToSendStuffBit(1); |
| 211 | ToSendStuffBit(1); |
| 212 | ToSendStuffBit(0); |
| 213 | ToSendStuffBit(1); |
| 214 | |
| 215 | // And slack at the end, too. |
| 216 | for(i = 0; i < 24; i++) { |
| 217 | ToSendStuffBit(1); |
| 218 | } |
| 219 | } |
| 220 | |
| 221 | |
| 222 | // Transmit the command (to the tag) that was placed in ToSend[]. |
| 223 | static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait) |
| 224 | { |
| 225 | int c; |
| 226 | |
| 227 | // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); |
| 228 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); |
| 229 | if(*wait < 10) { *wait = 10; } |
| 230 | |
| 231 | // for(c = 0; c < *wait;) { |
| 232 | // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 233 | // AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing! |
| 234 | // c++; |
| 235 | // } |
| 236 | // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 237 | // volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; |
| 238 | // (void)r; |
| 239 | // } |
| 240 | // WDT_HIT(); |
| 241 | // } |
| 242 | |
| 243 | c = 0; |
| 244 | for(;;) { |
| 245 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 246 | AT91C_BASE_SSC->SSC_THR = cmd[c]; |
| 247 | c++; |
| 248 | if(c >= len) { |
| 249 | break; |
| 250 | } |
| 251 | } |
| 252 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 253 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; |
| 254 | (void)r; |
| 255 | } |
| 256 | WDT_HIT(); |
| 257 | } |
| 258 | *samples = (c + *wait) << 3; |
| 259 | } |
| 260 | |
| 261 | //----------------------------------------------------------------------------- |
| 262 | // Transmit the command (to the reader) that was placed in ToSend[]. |
| 263 | //----------------------------------------------------------------------------- |
| 264 | static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait) |
| 265 | { |
| 266 | int c = 0; |
| 267 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K); |
| 268 | if(*wait < 10) { *wait = 10; } |
| 269 | |
| 270 | for(;;) { |
| 271 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 272 | AT91C_BASE_SSC->SSC_THR = cmd[c]; |
| 273 | c++; |
| 274 | if(c >= len) { |
| 275 | break; |
| 276 | } |
| 277 | } |
| 278 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 279 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; |
| 280 | (void)r; |
| 281 | } |
| 282 | WDT_HIT(); |
| 283 | } |
| 284 | *samples = (c + *wait) << 3; |
| 285 | } |
| 286 | |
| 287 | |
| 288 | // Read from Tag |
| 289 | // Parameters: |
| 290 | // receivedResponse |
| 291 | // maxLen |
| 292 | // samples |
| 293 | // elapsed |
| 294 | // returns: |
| 295 | // number of decoded bytes |
| 296 | static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) |
| 297 | { |
| 298 | int c = 0; |
| 299 | uint8_t *dest = BigBuf_get_addr(); |
| 300 | int getNext = 0; |
| 301 | |
| 302 | int8_t prev = 0; |
| 303 | |
| 304 | // NOW READ RESPONSE |
| 305 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); |
| 306 | //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads |
| 307 | c = 0; |
| 308 | getNext = FALSE; |
| 309 | for(;;) { |
| 310 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 311 | AT91C_BASE_SSC->SSC_THR = 0x43; |
| 312 | } |
| 313 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 314 | int8_t b; |
| 315 | b = (int8_t)AT91C_BASE_SSC->SSC_RHR; |
| 316 | |
| 317 | // The samples are correlations against I and Q versions of the |
| 318 | // tone that the tag AM-modulates, so every other sample is I, |
| 319 | // every other is Q. We just want power, so abs(I) + abs(Q) is |
| 320 | // close to what we want. |
| 321 | if(getNext) { |
| 322 | int8_t r = ABS(b) + ABS(prev); |
| 323 | |
| 324 | dest[c++] = (uint8_t)r; |
| 325 | |
| 326 | if(c >= 2000) { |
| 327 | break; |
| 328 | } |
| 329 | } else { |
| 330 | prev = b; |
| 331 | } |
| 332 | |
| 333 | getNext = !getNext; |
| 334 | } |
| 335 | } |
| 336 | |
| 337 | ////////////////////////////////////////// |
| 338 | /////////// DEMODULATE /////////////////// |
| 339 | ////////////////////////////////////////// |
| 340 | |
| 341 | int i, j; |
| 342 | int max = 0, maxPos=0; |
| 343 | |
| 344 | int skip = 4; |
| 345 | |
| 346 | // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL |
| 347 | |
| 348 | // First, correlate for SOF |
| 349 | for(i = 0; i < 100; i++) { |
| 350 | int corr = 0; |
| 351 | for(j = 0; j < arraylen(FrameSOF); j += skip) { |
| 352 | corr += FrameSOF[j]*dest[i+(j/skip)]; |
| 353 | } |
| 354 | if(corr > max) { |
| 355 | max = corr; |
| 356 | maxPos = i; |
| 357 | } |
| 358 | } |
| 359 | // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip)); |
| 360 | |
| 361 | int k = 0; // this will be our return value |
| 362 | |
| 363 | // greg - If correlation is less than 1 then there's little point in continuing |
| 364 | if ((max/(arraylen(FrameSOF)/skip)) >= 1) |
| 365 | { |
| 366 | |
| 367 | i = maxPos + arraylen(FrameSOF)/skip; |
| 368 | |
| 369 | uint8_t outBuf[20]; |
| 370 | memset(outBuf, 0, sizeof(outBuf)); |
| 371 | uint8_t mask = 0x01; |
| 372 | for(;;) { |
| 373 | int corr0 = 0, corr1 = 0, corrEOF = 0; |
| 374 | for(j = 0; j < arraylen(Logic0); j += skip) { |
| 375 | corr0 += Logic0[j]*dest[i+(j/skip)]; |
| 376 | } |
| 377 | for(j = 0; j < arraylen(Logic1); j += skip) { |
| 378 | corr1 += Logic1[j]*dest[i+(j/skip)]; |
| 379 | } |
| 380 | for(j = 0; j < arraylen(FrameEOF); j += skip) { |
| 381 | corrEOF += FrameEOF[j]*dest[i+(j/skip)]; |
| 382 | } |
| 383 | // Even things out by the length of the target waveform. |
| 384 | corr0 *= 4; |
| 385 | corr1 *= 4; |
| 386 | |
| 387 | if(corrEOF > corr1 && corrEOF > corr0) { |
| 388 | // DbpString("EOF at %d", i); |
| 389 | break; |
| 390 | } else if(corr1 > corr0) { |
| 391 | i += arraylen(Logic1)/skip; |
| 392 | outBuf[k] |= mask; |
| 393 | } else { |
| 394 | i += arraylen(Logic0)/skip; |
| 395 | } |
| 396 | mask <<= 1; |
| 397 | if(mask == 0) { |
| 398 | k++; |
| 399 | mask = 0x01; |
| 400 | } |
| 401 | if((i+(int)arraylen(FrameEOF)) >= 2000) { |
| 402 | DbpString("ran off end!"); |
| 403 | break; |
| 404 | } |
| 405 | } |
| 406 | if(mask != 0x01) { // this happens, when we miss the EOF |
| 407 | // TODO: for some reason this happens quite often |
| 408 | if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask); |
| 409 | if (mask<0x08) k--; // discard the last uneven octet; |
| 410 | // 0x08 is an assumption - but works quite often |
| 411 | } |
| 412 | // uint8_t str1 [8]; |
| 413 | // itoa(k,str1); |
| 414 | // strncat(str1," octets read",8); |
| 415 | |
| 416 | // DbpString( str1); // DbpString("%d octets", k); |
| 417 | |
| 418 | // for(i = 0; i < k; i+=3) { |
| 419 | // //DbpString("# %2d: %02x ", i, outBuf[i]); |
| 420 | // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]); |
| 421 | // } |
| 422 | |
| 423 | for(i = 0; i < k; i++) { |
| 424 | receivedResponse[i] = outBuf[i]; |
| 425 | } |
| 426 | } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip)) |
| 427 | return k; // return the number of bytes demodulated |
| 428 | |
| 429 | /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2)); |
| 430 | |
| 431 | } |
| 432 | |
| 433 | |
| 434 | // Now the GetISO15693 message from sniffing command |
| 435 | static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) |
| 436 | { |
| 437 | int c = 0; |
| 438 | uint8_t *dest = BigBuf_get_addr(); |
| 439 | int getNext = 0; |
| 440 | |
| 441 | int8_t prev = 0; |
| 442 | |
| 443 | // NOW READ RESPONSE |
| 444 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); |
| 445 | //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads |
| 446 | c = 0; |
| 447 | getNext = FALSE; |
| 448 | for(;;) { |
| 449 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 450 | AT91C_BASE_SSC->SSC_THR = 0x43; |
| 451 | } |
| 452 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 453 | int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR; |
| 454 | |
| 455 | // The samples are correlations against I and Q versions of the |
| 456 | // tone that the tag AM-modulates, so every other sample is I, |
| 457 | // every other is Q. We just want power, so abs(I) + abs(Q) is |
| 458 | // close to what we want. |
| 459 | if(getNext) { |
| 460 | int8_t r = ABS(b) + ABS(prev); |
| 461 | |
| 462 | dest[c++] = (uint8_t)r; |
| 463 | |
| 464 | if(c >= 20000) { |
| 465 | break; |
| 466 | } |
| 467 | } else { |
| 468 | prev = b; |
| 469 | } |
| 470 | |
| 471 | getNext = !getNext; |
| 472 | } |
| 473 | } |
| 474 | |
| 475 | ////////////////////////////////////////// |
| 476 | /////////// DEMODULATE /////////////////// |
| 477 | ////////////////////////////////////////// |
| 478 | |
| 479 | int i, j; |
| 480 | int max = 0, maxPos=0; |
| 481 | |
| 482 | int skip = 4; |
| 483 | |
| 484 | // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL |
| 485 | |
| 486 | // First, correlate for SOF |
| 487 | for(i = 0; i < 19000; i++) { |
| 488 | int corr = 0; |
| 489 | for(j = 0; j < arraylen(FrameSOF); j += skip) { |
| 490 | corr += FrameSOF[j]*dest[i+(j/skip)]; |
| 491 | } |
| 492 | if(corr > max) { |
| 493 | max = corr; |
| 494 | maxPos = i; |
| 495 | } |
| 496 | } |
| 497 | // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip)); |
| 498 | |
| 499 | int k = 0; // this will be our return value |
| 500 | |
| 501 | // greg - If correlation is less than 1 then there's little point in continuing |
| 502 | if ((max/(arraylen(FrameSOF)/skip)) >= 1) // THIS SHOULD BE 1 |
| 503 | { |
| 504 | |
| 505 | i = maxPos + arraylen(FrameSOF)/skip; |
| 506 | |
| 507 | uint8_t outBuf[20]; |
| 508 | memset(outBuf, 0, sizeof(outBuf)); |
| 509 | uint8_t mask = 0x01; |
| 510 | for(;;) { |
| 511 | int corr0 = 0, corr1 = 0, corrEOF = 0; |
| 512 | for(j = 0; j < arraylen(Logic0); j += skip) { |
| 513 | corr0 += Logic0[j]*dest[i+(j/skip)]; |
| 514 | } |
| 515 | for(j = 0; j < arraylen(Logic1); j += skip) { |
| 516 | corr1 += Logic1[j]*dest[i+(j/skip)]; |
| 517 | } |
| 518 | for(j = 0; j < arraylen(FrameEOF); j += skip) { |
| 519 | corrEOF += FrameEOF[j]*dest[i+(j/skip)]; |
| 520 | } |
| 521 | // Even things out by the length of the target waveform. |
| 522 | corr0 *= 4; |
| 523 | corr1 *= 4; |
| 524 | |
| 525 | if(corrEOF > corr1 && corrEOF > corr0) { |
| 526 | // DbpString("EOF at %d", i); |
| 527 | break; |
| 528 | } else if(corr1 > corr0) { |
| 529 | i += arraylen(Logic1)/skip; |
| 530 | outBuf[k] |= mask; |
| 531 | } else { |
| 532 | i += arraylen(Logic0)/skip; |
| 533 | } |
| 534 | mask <<= 1; |
| 535 | if(mask == 0) { |
| 536 | k++; |
| 537 | mask = 0x01; |
| 538 | } |
| 539 | if((i+(int)arraylen(FrameEOF)) >= 2000) { |
| 540 | DbpString("ran off end!"); |
| 541 | break; |
| 542 | } |
| 543 | } |
| 544 | if(mask != 0x01) { |
| 545 | DbpString("sniff: error, uneven octet! (discard extra bits!)"); |
| 546 | /// DbpString(" mask=%02x", mask); |
| 547 | } |
| 548 | // uint8_t str1 [8]; |
| 549 | // itoa(k,str1); |
| 550 | // strncat(str1," octets read",8); |
| 551 | |
| 552 | // DbpString( str1); // DbpString("%d octets", k); |
| 553 | |
| 554 | // for(i = 0; i < k; i+=3) { |
| 555 | // //DbpString("# %2d: %02x ", i, outBuf[i]); |
| 556 | // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]); |
| 557 | // } |
| 558 | |
| 559 | for(i = 0; i < k; i++) { |
| 560 | receivedResponse[i] = outBuf[i]; |
| 561 | } |
| 562 | } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip)) |
| 563 | return k; // return the number of bytes demodulated |
| 564 | |
| 565 | /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2)); |
| 566 | } |
| 567 | |
| 568 | |
| 569 | static void BuildIdentifyRequest(void); |
| 570 | //----------------------------------------------------------------------------- |
| 571 | // Start to read an ISO 15693 tag. We send an identify request, then wait |
| 572 | // for the response. The response is not demodulated, just left in the buffer |
| 573 | // so that it can be downloaded to a PC and processed there. |
| 574 | //----------------------------------------------------------------------------- |
| 575 | void AcquireRawAdcSamplesIso15693(void) |
| 576 | { |
| 577 | uint8_t *dest = BigBuf_get_addr(); |
| 578 | |
| 579 | int c = 0; |
| 580 | int getNext = 0; |
| 581 | int8_t prev = 0; |
| 582 | |
| 583 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
| 584 | BuildIdentifyRequest(); |
| 585 | |
| 586 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 587 | |
| 588 | // Give the tags time to energize |
| 589 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); |
| 590 | SpinDelay(100); |
| 591 | |
| 592 | // Now send the command |
| 593 | FpgaSetupSsc(); |
| 594 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); |
| 595 | |
| 596 | c = 0; |
| 597 | for(;;) { |
| 598 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 599 | AT91C_BASE_SSC->SSC_THR = ToSend[c]; |
| 600 | c++; |
| 601 | if(c == ToSendMax+3) { |
| 602 | break; |
| 603 | } |
| 604 | } |
| 605 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 606 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; |
| 607 | (void)r; |
| 608 | } |
| 609 | WDT_HIT(); |
| 610 | } |
| 611 | |
| 612 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); |
| 613 | |
| 614 | c = 0; |
| 615 | getNext = FALSE; |
| 616 | for(;;) { |
| 617 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 618 | AT91C_BASE_SSC->SSC_THR = 0x43; |
| 619 | } |
| 620 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 621 | int8_t b; |
| 622 | b = (int8_t)AT91C_BASE_SSC->SSC_RHR; |
| 623 | |
| 624 | // The samples are correlations against I and Q versions of the |
| 625 | // tone that the tag AM-modulates, so every other sample is I, |
| 626 | // every other is Q. We just want power, so abs(I) + abs(Q) is |
| 627 | // close to what we want. |
| 628 | if(getNext) { |
| 629 | int8_t r = ABS(b) + ABS(prev); |
| 630 | |
| 631 | dest[c++] = (uint8_t)r; |
| 632 | |
| 633 | if(c >= 2000) { |
| 634 | break; |
| 635 | } |
| 636 | } else { |
| 637 | prev = b; |
| 638 | } |
| 639 | |
| 640 | getNext = !getNext; |
| 641 | } |
| 642 | } |
| 643 | } |
| 644 | |
| 645 | |
| 646 | void RecordRawAdcSamplesIso15693(void) |
| 647 | { |
| 648 | uint8_t *dest = BigBuf_get_addr(); |
| 649 | |
| 650 | int c = 0; |
| 651 | int getNext = 0; |
| 652 | int8_t prev = 0; |
| 653 | |
| 654 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
| 655 | // Setup SSC |
| 656 | FpgaSetupSsc(); |
| 657 | |
| 658 | // Start from off (no field generated) |
| 659 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 660 | SpinDelay(200); |
| 661 | |
| 662 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 663 | |
| 664 | SpinDelay(100); |
| 665 | |
| 666 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); |
| 667 | |
| 668 | c = 0; |
| 669 | getNext = FALSE; |
| 670 | for(;;) { |
| 671 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 672 | AT91C_BASE_SSC->SSC_THR = 0x43; |
| 673 | } |
| 674 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 675 | int8_t b; |
| 676 | b = (int8_t)AT91C_BASE_SSC->SSC_RHR; |
| 677 | |
| 678 | // The samples are correlations against I and Q versions of the |
| 679 | // tone that the tag AM-modulates, so every other sample is I, |
| 680 | // every other is Q. We just want power, so abs(I) + abs(Q) is |
| 681 | // close to what we want. |
| 682 | if(getNext) { |
| 683 | int8_t r = ABS(b) + ABS(prev); |
| 684 | |
| 685 | dest[c++] = (uint8_t)r; |
| 686 | |
| 687 | if(c >= 7000) { |
| 688 | break; |
| 689 | } |
| 690 | } else { |
| 691 | prev = b; |
| 692 | } |
| 693 | |
| 694 | getNext = !getNext; |
| 695 | WDT_HIT(); |
| 696 | } |
| 697 | } |
| 698 | Dbprintf("fin record"); |
| 699 | } |
| 700 | |
| 701 | |
| 702 | // Initialize the proxmark as iso15k reader |
| 703 | // (this might produces glitches that confuse some tags |
| 704 | void Iso15693InitReader() { |
| 705 | LED_A_ON(); |
| 706 | LED_B_ON(); |
| 707 | LED_C_OFF(); |
| 708 | LED_D_OFF(); |
| 709 | |
| 710 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
| 711 | // Setup SSC |
| 712 | // FpgaSetupSsc(); |
| 713 | |
| 714 | // Start from off (no field generated) |
| 715 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 716 | SpinDelay(10); |
| 717 | |
| 718 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 719 | FpgaSetupSsc(); |
| 720 | |
| 721 | // Give the tags time to energize |
| 722 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); |
| 723 | SpinDelay(250); |
| 724 | |
| 725 | LED_A_ON(); |
| 726 | LED_B_OFF(); |
| 727 | LED_C_OFF(); |
| 728 | LED_D_OFF(); |
| 729 | } |
| 730 | |
| 731 | /////////////////////////////////////////////////////////////////////// |
| 732 | // ISO 15693 Part 3 - Air Interface |
| 733 | // This section basicly contains transmission and receiving of bits |
| 734 | /////////////////////////////////////////////////////////////////////// |
| 735 | |
| 736 | // Encode (into the ToSend buffers) an identify request, which is the first |
| 737 | // thing that you must send to a tag to get a response. |
| 738 | static void BuildIdentifyRequest(void) |
| 739 | { |
| 740 | uint8_t cmd[5]; |
| 741 | |
| 742 | uint16_t crc; |
| 743 | // one sub-carrier, inventory, 1 slot, fast rate |
| 744 | // AFI is at bit 5 (1<<4) when doing an INVENTORY |
| 745 | cmd[0] = (1 << 2) | (1 << 5) | (1 << 1); |
| 746 | // inventory command code |
| 747 | cmd[1] = 0x01; |
| 748 | // no mask |
| 749 | cmd[2] = 0x00; |
| 750 | //Now the CRC |
| 751 | crc = Crc(cmd, 3); |
| 752 | cmd[3] = crc & 0xff; |
| 753 | cmd[4] = crc >> 8; |
| 754 | |
| 755 | CodeIso15693AsReader(cmd, sizeof(cmd)); |
| 756 | } |
| 757 | |
| 758 | // uid is in transmission order (which is reverse of display order) |
| 759 | static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber ) |
| 760 | { |
| 761 | uint8_t cmd[13]; |
| 762 | |
| 763 | uint16_t crc; |
| 764 | // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block |
| 765 | // followed by teh block data |
| 766 | // one sub-carrier, inventory, 1 slot, fast rate |
| 767 | cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit, ADDR bit, OPTION bit |
| 768 | // READ BLOCK command code |
| 769 | cmd[1] = 0x20; |
| 770 | // UID may be optionally specified here |
| 771 | // 64-bit UID |
| 772 | cmd[2] = uid[0]; |
| 773 | cmd[3] = uid[1]; |
| 774 | cmd[4] = uid[2]; |
| 775 | cmd[5] = uid[3]; |
| 776 | cmd[6] = uid[4]; |
| 777 | cmd[7] = uid[5]; |
| 778 | cmd[8] = uid[6]; |
| 779 | cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique) |
| 780 | // Block number to read |
| 781 | cmd[10] = blockNumber;//0x00; |
| 782 | //Now the CRC |
| 783 | crc = Crc(cmd, 11); // the crc needs to be calculated over 12 bytes |
| 784 | cmd[11] = crc & 0xff; |
| 785 | cmd[12] = crc >> 8; |
| 786 | |
| 787 | CodeIso15693AsReader(cmd, sizeof(cmd)); |
| 788 | } |
| 789 | |
| 790 | // Now the VICC>VCD responses when we are simulating a tag |
| 791 | static void BuildInventoryResponse( uint8_t *uid) |
| 792 | { |
| 793 | uint8_t cmd[12]; |
| 794 | |
| 795 | uint16_t crc; |
| 796 | // one sub-carrier, inventory, 1 slot, fast rate |
| 797 | // AFI is at bit 5 (1<<4) when doing an INVENTORY |
| 798 | //(1 << 2) | (1 << 5) | (1 << 1); |
| 799 | cmd[0] = 0; // |
| 800 | cmd[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported |
| 801 | // 64-bit UID |
| 802 | cmd[2] = uid[7]; //0x32; |
| 803 | cmd[3] = uid[6]; //0x4b; |
| 804 | cmd[4] = uid[5]; //0x03; |
| 805 | cmd[5] = uid[4]; //0x01; |
| 806 | cmd[6] = uid[3]; //0x00; |
| 807 | cmd[7] = uid[2]; //0x10; |
| 808 | cmd[8] = uid[1]; //0x05; |
| 809 | cmd[9] = uid[0]; //0xe0; |
| 810 | //Now the CRC |
| 811 | crc = Crc(cmd, 10); |
| 812 | cmd[10] = crc & 0xff; |
| 813 | cmd[11] = crc >> 8; |
| 814 | |
| 815 | CodeIso15693AsReader(cmd, sizeof(cmd)); |
| 816 | } |
| 817 | |
| 818 | // Universal Method for sending to and recv bytes from a tag |
| 819 | // init ... should we initialize the reader? |
| 820 | // speed ... 0 low speed, 1 hi speed |
| 821 | // **recv will return you a pointer to the received data |
| 822 | // If you do not need the answer use NULL for *recv[] |
| 823 | // return: lenght of received data |
| 824 | int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) { |
| 825 | |
| 826 | int samples = 0; |
| 827 | int tsamples = 0; |
| 828 | int wait = 0; |
| 829 | int elapsed = 0; |
| 830 | |
| 831 | LED_A_ON(); |
| 832 | LED_B_ON(); |
| 833 | LED_C_OFF(); |
| 834 | LED_D_OFF(); |
| 835 | |
| 836 | if (init) Iso15693InitReader(); |
| 837 | |
| 838 | int answerLen=0; |
| 839 | uint8_t *answer = BigBuf_get_addr() + 3660; |
| 840 | if (recv != NULL) memset(answer, 0, 100); |
| 841 | |
| 842 | if (!speed) { |
| 843 | // low speed (1 out of 256) |
| 844 | CodeIso15693AsReader256(send, sendlen); |
| 845 | } else { |
| 846 | // high speed (1 out of 4) |
| 847 | CodeIso15693AsReader(send, sendlen); |
| 848 | } |
| 849 | |
| 850 | LED_A_ON(); |
| 851 | LED_B_OFF(); |
| 852 | |
| 853 | TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); |
| 854 | // Now wait for a response |
| 855 | if (recv!=NULL) { |
| 856 | LED_A_OFF(); |
| 857 | LED_B_ON(); |
| 858 | answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ; |
| 859 | *recv=answer; |
| 860 | } |
| 861 | |
| 862 | LED_A_OFF(); |
| 863 | LED_B_OFF(); |
| 864 | LED_C_OFF(); |
| 865 | LED_D_OFF(); |
| 866 | |
| 867 | return answerLen; |
| 868 | } |
| 869 | |
| 870 | |
| 871 | // -------------------------------------------------------------------- |
| 872 | // Debug Functions |
| 873 | // -------------------------------------------------------------------- |
| 874 | |
| 875 | // Decodes a message from a tag and displays its metadata and content |
| 876 | #define DBD15STATLEN 48 |
| 877 | void DbdecodeIso15693Answer(int len, uint8_t *d) { |
| 878 | char status[DBD15STATLEN+1]={0}; |
| 879 | uint16_t crc; |
| 880 | |
| 881 | if (len>3) { |
| 882 | if (d[0]&(1<<3)) |
| 883 | strncat(status,"ProtExt ",DBD15STATLEN); |
| 884 | if (d[0]&1) { |
| 885 | // error |
| 886 | strncat(status,"Error ",DBD15STATLEN); |
| 887 | switch (d[1]) { |
| 888 | case 0x01: |
| 889 | strncat(status,"01:notSupp",DBD15STATLEN); |
| 890 | break; |
| 891 | case 0x02: |
| 892 | strncat(status,"02:notRecog",DBD15STATLEN); |
| 893 | break; |
| 894 | case 0x03: |
| 895 | strncat(status,"03:optNotSupp",DBD15STATLEN); |
| 896 | break; |
| 897 | case 0x0f: |
| 898 | strncat(status,"0f:noInfo",DBD15STATLEN); |
| 899 | break; |
| 900 | case 0x10: |
| 901 | strncat(status,"10:dontExist",DBD15STATLEN); |
| 902 | break; |
| 903 | case 0x11: |
| 904 | strncat(status,"11:lockAgain",DBD15STATLEN); |
| 905 | break; |
| 906 | case 0x12: |
| 907 | strncat(status,"12:locked",DBD15STATLEN); |
| 908 | break; |
| 909 | case 0x13: |
| 910 | strncat(status,"13:progErr",DBD15STATLEN); |
| 911 | break; |
| 912 | case 0x14: |
| 913 | strncat(status,"14:lockErr",DBD15STATLEN); |
| 914 | break; |
| 915 | default: |
| 916 | strncat(status,"unknownErr",DBD15STATLEN); |
| 917 | } |
| 918 | strncat(status," ",DBD15STATLEN); |
| 919 | } else { |
| 920 | strncat(status,"NoErr ",DBD15STATLEN); |
| 921 | } |
| 922 | |
| 923 | crc=Crc(d,len-2); |
| 924 | if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) ) |
| 925 | strncat(status,"CrcOK",DBD15STATLEN); |
| 926 | else |
| 927 | strncat(status,"CrcFail!",DBD15STATLEN); |
| 928 | |
| 929 | Dbprintf("%s",status); |
| 930 | } |
| 931 | } |
| 932 | |
| 933 | |
| 934 | |
| 935 | /////////////////////////////////////////////////////////////////////// |
| 936 | // Functions called via USB/Client |
| 937 | /////////////////////////////////////////////////////////////////////// |
| 938 | |
| 939 | void SetDebugIso15693(uint32_t debug) { |
| 940 | DEBUG=debug; |
| 941 | Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off"); |
| 942 | return; |
| 943 | } |
| 944 | |
| 945 | |
| 946 | |
| 947 | //----------------------------------------------------------------------------- |
| 948 | // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector |
| 949 | // all demodulation performed in arm rather than host. - greg |
| 950 | //----------------------------------------------------------------------------- |
| 951 | void ReaderIso15693(uint32_t parameter) |
| 952 | { |
| 953 | LED_A_ON(); |
| 954 | LED_B_ON(); |
| 955 | LED_C_OFF(); |
| 956 | LED_D_OFF(); |
| 957 | |
| 958 | int answerLen1 = 0; |
| 959 | int answerLen2 = 0; |
| 960 | int answerLen3 = 0; |
| 961 | int i = 0; |
| 962 | int samples = 0; |
| 963 | int tsamples = 0; |
| 964 | int wait = 0; |
| 965 | int elapsed = 0; |
| 966 | uint8_t TagUID[8] = {0x00}; |
| 967 | |
| 968 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
| 969 | |
| 970 | uint8_t *answer1 = BigBuf_get_addr() + 3660; |
| 971 | uint8_t *answer2 = BigBuf_get_addr() + 3760; |
| 972 | uint8_t *answer3 = BigBuf_get_addr() + 3860; |
| 973 | // Blank arrays |
| 974 | memset(answer1, 0x00, 300); |
| 975 | |
| 976 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 977 | // Setup SSC |
| 978 | FpgaSetupSsc(); |
| 979 | |
| 980 | // Start from off (no field generated) |
| 981 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 982 | SpinDelay(200); |
| 983 | |
| 984 | // Give the tags time to energize |
| 985 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); |
| 986 | SpinDelay(200); |
| 987 | |
| 988 | LED_A_ON(); |
| 989 | LED_B_OFF(); |
| 990 | LED_C_OFF(); |
| 991 | LED_D_OFF(); |
| 992 | |
| 993 | // FIRST WE RUN AN INVENTORY TO GET THE TAG UID |
| 994 | // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME |
| 995 | |
| 996 | // Now send the IDENTIFY command |
| 997 | BuildIdentifyRequest(); |
| 998 | |
| 999 | TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); |
| 1000 | |
| 1001 | // Now wait for a response |
| 1002 | answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ; |
| 1003 | |
| 1004 | if (answerLen1 >=12) // we should do a better check than this |
| 1005 | { |
| 1006 | TagUID[0] = answer1[2]; |
| 1007 | TagUID[1] = answer1[3]; |
| 1008 | TagUID[2] = answer1[4]; |
| 1009 | TagUID[3] = answer1[5]; |
| 1010 | TagUID[4] = answer1[6]; |
| 1011 | TagUID[5] = answer1[7]; |
| 1012 | TagUID[6] = answer1[8]; // IC Manufacturer code |
| 1013 | TagUID[7] = answer1[9]; // always E0 |
| 1014 | |
| 1015 | } |
| 1016 | |
| 1017 | Dbprintf("%d octets read from IDENTIFY request:", answerLen1); |
| 1018 | DbdecodeIso15693Answer(answerLen1,answer1); |
| 1019 | Dbhexdump(answerLen1,answer1,true); |
| 1020 | |
| 1021 | // UID is reverse |
| 1022 | if (answerLen1>=12) |
| 1023 | Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX", |
| 1024 | TagUID[7],TagUID[6],TagUID[5],TagUID[4], |
| 1025 | TagUID[3],TagUID[2],TagUID[1],TagUID[0]); |
| 1026 | |
| 1027 | |
| 1028 | Dbprintf("%d octets read from SELECT request:", answerLen2); |
| 1029 | DbdecodeIso15693Answer(answerLen2,answer2); |
| 1030 | Dbhexdump(answerLen2,answer2,true); |
| 1031 | |
| 1032 | Dbprintf("%d octets read from XXX request:", answerLen3); |
| 1033 | DbdecodeIso15693Answer(answerLen3,answer3); |
| 1034 | Dbhexdump(answerLen3,answer3,true); |
| 1035 | |
| 1036 | // read all pages |
| 1037 | if (answerLen1>=12 && DEBUG) { |
| 1038 | i=0; |
| 1039 | while (i<32) { // sanity check, assume max 32 pages |
| 1040 | BuildReadBlockRequest(TagUID,i); |
| 1041 | TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); |
| 1042 | answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed); |
| 1043 | if (answerLen2>0) { |
| 1044 | Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2); |
| 1045 | DbdecodeIso15693Answer(answerLen2,answer2); |
| 1046 | Dbhexdump(answerLen2,answer2,true); |
| 1047 | if ( *((uint32_t*) answer2) == 0x07160101 ) break; // exit on NoPageErr |
| 1048 | } |
| 1049 | i++; |
| 1050 | } |
| 1051 | } |
| 1052 | |
| 1053 | LED_A_OFF(); |
| 1054 | LED_B_OFF(); |
| 1055 | LED_C_OFF(); |
| 1056 | LED_D_OFF(); |
| 1057 | } |
| 1058 | |
| 1059 | // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands |
| 1060 | // all demodulation performed in arm rather than host. - greg |
| 1061 | void SimTagIso15693(uint32_t parameter, uint8_t *uid) |
| 1062 | { |
| 1063 | LED_A_ON(); |
| 1064 | LED_B_ON(); |
| 1065 | LED_C_OFF(); |
| 1066 | LED_D_OFF(); |
| 1067 | |
| 1068 | int answerLen1 = 0; |
| 1069 | int samples = 0; |
| 1070 | int tsamples = 0; |
| 1071 | int wait = 0; |
| 1072 | int elapsed = 0; |
| 1073 | |
| 1074 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
| 1075 | |
| 1076 | uint8_t *buf = BigBuf_get_addr() + 3660; |
| 1077 | memset(buf, 0x00, 100); |
| 1078 | |
| 1079 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 1080 | FpgaSetupSsc(); |
| 1081 | |
| 1082 | // Start from off (no field generated) |
| 1083 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 1084 | SpinDelay(200); |
| 1085 | |
| 1086 | LED_A_OFF(); |
| 1087 | LED_B_OFF(); |
| 1088 | LED_C_ON(); |
| 1089 | LED_D_OFF(); |
| 1090 | |
| 1091 | // Listen to reader |
| 1092 | answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ; |
| 1093 | |
| 1094 | if (answerLen1 >=1) // we should do a better check than this |
| 1095 | { |
| 1096 | // Build a suitable reponse to the reader INVENTORY cocmmand |
| 1097 | // not so obsvious, but in the call to BuildInventoryResponse, the command is copied to the global ToSend buffer used below. |
| 1098 | |
| 1099 | BuildInventoryResponse(uid); |
| 1100 | |
| 1101 | TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait); |
| 1102 | } |
| 1103 | |
| 1104 | Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1, |
| 1105 | buf[0], buf[1], buf[2], buf[3], |
| 1106 | buf[4], buf[5], buf[6], buf[7], buf[8]); |
| 1107 | |
| 1108 | Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x", |
| 1109 | uid[0], uid[1], uid[2], uid[3], |
| 1110 | uid[4], uid[5], uid[6], uid[7]); |
| 1111 | |
| 1112 | LED_A_OFF(); |
| 1113 | LED_B_OFF(); |
| 1114 | LED_C_OFF(); |
| 1115 | LED_D_OFF(); |
| 1116 | } |
| 1117 | |
| 1118 | |
| 1119 | // Since there is no standardized way of reading the AFI out of a tag, we will brute force it |
| 1120 | // (some manufactures offer a way to read the AFI, though) |
| 1121 | void BruteforceIso15693Afi(uint32_t speed) |
| 1122 | { |
| 1123 | uint8_t data[20]; |
| 1124 | uint8_t *recv=data; |
| 1125 | int datalen=0, recvlen=0; |
| 1126 | |
| 1127 | Iso15693InitReader(); |
| 1128 | |
| 1129 | // first without AFI |
| 1130 | // Tags should respond wihtout AFI and with AFI=0 even when AFI is active |
| 1131 | |
| 1132 | data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
| 1133 | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1; |
| 1134 | data[1]=ISO15_CMD_INVENTORY; |
| 1135 | data[2]=0; // mask length |
| 1136 | datalen=AddCrc(data,3); |
| 1137 | recvlen=SendDataTag(data,datalen,0,speed,&recv); |
| 1138 | WDT_HIT(); |
| 1139 | if (recvlen>=12) { |
| 1140 | Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2])); |
| 1141 | } |
| 1142 | |
| 1143 | // now with AFI |
| 1144 | |
| 1145 | data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
| 1146 | ISO15_REQ_INVENTORY | ISO15_REQINV_AFI | ISO15_REQINV_SLOT1; |
| 1147 | data[1]=ISO15_CMD_INVENTORY; |
| 1148 | data[2]=0; // AFI |
| 1149 | data[3]=0; // mask length |
| 1150 | |
| 1151 | for (int i=0;i<256;i++) { |
| 1152 | data[2]=i & 0xFF; |
| 1153 | datalen=AddCrc(data,4); |
| 1154 | recvlen=SendDataTag(data,datalen,0,speed,&recv); |
| 1155 | WDT_HIT(); |
| 1156 | if (recvlen>=12) { |
| 1157 | Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2])); |
| 1158 | } |
| 1159 | } |
| 1160 | Dbprintf("AFI Bruteforcing done."); |
| 1161 | |
| 1162 | } |
| 1163 | |
| 1164 | // Allows to directly send commands to the tag via the client |
| 1165 | void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) { |
| 1166 | |
| 1167 | int recvlen=0; |
| 1168 | uint8_t *recvbuf = BigBuf_get_addr(); |
| 1169 | // UsbCommand n; |
| 1170 | |
| 1171 | if (DEBUG) { |
| 1172 | Dbprintf("SEND"); |
| 1173 | Dbhexdump(datalen,data,true); |
| 1174 | } |
| 1175 | |
| 1176 | recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL)); |
| 1177 | |
| 1178 | if (recv) { |
| 1179 | LED_B_ON(); |
| 1180 | cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48); |
| 1181 | LED_B_OFF(); |
| 1182 | |
| 1183 | if (DEBUG) { |
| 1184 | Dbprintf("RECV"); |
| 1185 | DbdecodeIso15693Answer(recvlen,recvbuf); |
| 1186 | Dbhexdump(recvlen,recvbuf,true); |
| 1187 | } |
| 1188 | } |
| 1189 | |
| 1190 | } |
| 1191 | |
| 1192 | |
| 1193 | |
| 1194 | |
| 1195 | // -------------------------------------------------------------------- |
| 1196 | // -- Misc & deprecated functions |
| 1197 | // -------------------------------------------------------------------- |
| 1198 | |
| 1199 | /* |
| 1200 | |
| 1201 | // do not use; has a fix UID |
| 1202 | static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid) |
| 1203 | { |
| 1204 | uint8_t cmd[12]; |
| 1205 | |
| 1206 | uint16_t crc; |
| 1207 | // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block |
| 1208 | // followed by teh block data |
| 1209 | // one sub-carrier, inventory, 1 slot, fast rate |
| 1210 | cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit |
| 1211 | // System Information command code |
| 1212 | cmd[1] = 0x2B; |
| 1213 | // UID may be optionally specified here |
| 1214 | // 64-bit UID |
| 1215 | cmd[2] = 0x32; |
| 1216 | cmd[3]= 0x4b; |
| 1217 | cmd[4] = 0x03; |
| 1218 | cmd[5] = 0x01; |
| 1219 | cmd[6] = 0x00; |
| 1220 | cmd[7] = 0x10; |
| 1221 | cmd[8] = 0x05; |
| 1222 | cmd[9]= 0xe0; // always e0 (not exactly unique) |
| 1223 | //Now the CRC |
| 1224 | crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes |
| 1225 | cmd[10] = crc & 0xff; |
| 1226 | cmd[11] = crc >> 8; |
| 1227 | |
| 1228 | CodeIso15693AsReader(cmd, sizeof(cmd)); |
| 1229 | } |
| 1230 | |
| 1231 | |
| 1232 | // do not use; has a fix UID |
| 1233 | static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid) |
| 1234 | { |
| 1235 | uint8_t cmd[14]; |
| 1236 | |
| 1237 | uint16_t crc; |
| 1238 | // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block |
| 1239 | // followed by teh block data |
| 1240 | // one sub-carrier, inventory, 1 slot, fast rate |
| 1241 | cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit |
| 1242 | // READ Multi BLOCK command code |
| 1243 | cmd[1] = 0x23; |
| 1244 | // UID may be optionally specified here |
| 1245 | // 64-bit UID |
| 1246 | cmd[2] = 0x32; |
| 1247 | cmd[3]= 0x4b; |
| 1248 | cmd[4] = 0x03; |
| 1249 | cmd[5] = 0x01; |
| 1250 | cmd[6] = 0x00; |
| 1251 | cmd[7] = 0x10; |
| 1252 | cmd[8] = 0x05; |
| 1253 | cmd[9]= 0xe0; // always e0 (not exactly unique) |
| 1254 | // First Block number to read |
| 1255 | cmd[10] = 0x00; |
| 1256 | // Number of Blocks to read |
| 1257 | cmd[11] = 0x2f; // read quite a few |
| 1258 | //Now the CRC |
| 1259 | crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes |
| 1260 | cmd[12] = crc & 0xff; |
| 1261 | cmd[13] = crc >> 8; |
| 1262 | |
| 1263 | CodeIso15693AsReader(cmd, sizeof(cmd)); |
| 1264 | } |
| 1265 | |
| 1266 | // do not use; has a fix UID |
| 1267 | static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode) |
| 1268 | { |
| 1269 | uint8_t cmd[14]; |
| 1270 | |
| 1271 | uint16_t crc; |
| 1272 | // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block |
| 1273 | // followed by teh block data |
| 1274 | // one sub-carrier, inventory, 1 slot, fast rate |
| 1275 | cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit |
| 1276 | // READ BLOCK command code |
| 1277 | cmd[1] = CmdCode; |
| 1278 | // UID may be optionally specified here |
| 1279 | // 64-bit UID |
| 1280 | cmd[2] = 0x32; |
| 1281 | cmd[3]= 0x4b; |
| 1282 | cmd[4] = 0x03; |
| 1283 | cmd[5] = 0x01; |
| 1284 | cmd[6] = 0x00; |
| 1285 | cmd[7] = 0x10; |
| 1286 | cmd[8] = 0x05; |
| 1287 | cmd[9]= 0xe0; // always e0 (not exactly unique) |
| 1288 | // Parameter |
| 1289 | cmd[10] = 0x00; |
| 1290 | cmd[11] = 0x0a; |
| 1291 | |
| 1292 | // cmd[12] = 0x00; |
| 1293 | // cmd[13] = 0x00; //Now the CRC |
| 1294 | crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes |
| 1295 | cmd[12] = crc & 0xff; |
| 1296 | cmd[13] = crc >> 8; |
| 1297 | |
| 1298 | CodeIso15693AsReader(cmd, sizeof(cmd)); |
| 1299 | } |
| 1300 | |
| 1301 | // do not use; has a fix UID |
| 1302 | static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode) |
| 1303 | { |
| 1304 | uint8_t cmd[14]; |
| 1305 | |
| 1306 | uint16_t crc; |
| 1307 | // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block |
| 1308 | // followed by teh block data |
| 1309 | // one sub-carrier, inventory, 1 slot, fast rate |
| 1310 | cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit |
| 1311 | // READ BLOCK command code |
| 1312 | cmd[1] = CmdCode; |
| 1313 | // UID may be optionally specified here |
| 1314 | // 64-bit UID |
| 1315 | cmd[2] = 0x32; |
| 1316 | cmd[3]= 0x4b; |
| 1317 | cmd[4] = 0x03; |
| 1318 | cmd[5] = 0x01; |
| 1319 | cmd[6] = 0x00; |
| 1320 | cmd[7] = 0x10; |
| 1321 | cmd[8] = 0x05; |
| 1322 | cmd[9]= 0xe0; // always e0 (not exactly unique) |
| 1323 | // Parameter |
| 1324 | cmd[10] = 0x05; // for custom codes this must be manufcturer code |
| 1325 | cmd[11] = 0x00; |
| 1326 | |
| 1327 | // cmd[12] = 0x00; |
| 1328 | // cmd[13] = 0x00; //Now the CRC |
| 1329 | crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes |
| 1330 | cmd[12] = crc & 0xff; |
| 1331 | cmd[13] = crc >> 8; |
| 1332 | |
| 1333 | CodeIso15693AsReader(cmd, sizeof(cmd)); |
| 1334 | } |
| 1335 | |
| 1336 | |
| 1337 | |
| 1338 | |
| 1339 | */ |
| 1340 | |
| 1341 | |