]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - armsrc/iso14443a.c
FIX: the lfsampling.c for t55xx had a tendecy to enter a neverending loop. Moved...
[proxmark3-svn] / armsrc / iso14443a.c
... / ...
CommitLineData
1 //-----------------------------------------------------------------------------
2// Merlok - June 2011, 2012
3// Gerhard de Koning Gans - May 2008
4// Hagen Fritsch - June 2010
5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// Routines to support ISO 14443 type A.
11//-----------------------------------------------------------------------------
12
13#include "proxmark3.h"
14#include "apps.h"
15#include "util.h"
16#include "string.h"
17#include "cmd.h"
18#include "iso14443crc.h"
19#include "iso14443a.h"
20#include "crapto1.h"
21#include "mifareutil.h"
22#include "BigBuf.h"
23static uint32_t iso14a_timeout;
24int rsamples = 0;
25uint8_t trigger = 0;
26// the block number for the ISO14443-4 PCB
27static uint8_t iso14_pcb_blocknum = 0;
28
29//
30// ISO14443 timing:
31//
32// minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
33#define REQUEST_GUARD_TIME (7000/16 + 1)
34// minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
35#define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
36// bool LastCommandWasRequest = FALSE;
37
38//
39// Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
40//
41// When the PM acts as reader and is receiving tag data, it takes
42// 3 ticks delay in the AD converter
43// 16 ticks until the modulation detector completes and sets curbit
44// 8 ticks until bit_to_arm is assigned from curbit
45// 8*16 ticks for the transfer from FPGA to ARM
46// 4*16 ticks until we measure the time
47// - 8*16 ticks because we measure the time of the previous transfer
48#define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
49
50// When the PM acts as a reader and is sending, it takes
51// 4*16 ticks until we can write data to the sending hold register
52// 8*16 ticks until the SHR is transferred to the Sending Shift Register
53// 8 ticks until the first transfer starts
54// 8 ticks later the FPGA samples the data
55// 1 tick to assign mod_sig_coil
56#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
57
58// When the PM acts as tag and is receiving it takes
59// 2 ticks delay in the RF part (for the first falling edge),
60// 3 ticks for the A/D conversion,
61// 8 ticks on average until the start of the SSC transfer,
62// 8 ticks until the SSC samples the first data
63// 7*16 ticks to complete the transfer from FPGA to ARM
64// 8 ticks until the next ssp_clk rising edge
65// 4*16 ticks until we measure the time
66// - 8*16 ticks because we measure the time of the previous transfer
67#define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
68
69// The FPGA will report its internal sending delay in
70uint16_t FpgaSendQueueDelay;
71// the 5 first bits are the number of bits buffered in mod_sig_buf
72// the last three bits are the remaining ticks/2 after the mod_sig_buf shift
73#define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
74
75// When the PM acts as tag and is sending, it takes
76// 4*16 ticks until we can write data to the sending hold register
77// 8*16 ticks until the SHR is transferred to the Sending Shift Register
78// 8 ticks until the first transfer starts
79// 8 ticks later the FPGA samples the data
80// + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
81// + 1 tick to assign mod_sig_coil
82#define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
83
84// When the PM acts as sniffer and is receiving tag data, it takes
85// 3 ticks A/D conversion
86// 14 ticks to complete the modulation detection
87// 8 ticks (on average) until the result is stored in to_arm
88// + the delays in transferring data - which is the same for
89// sniffing reader and tag data and therefore not relevant
90#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
91
92// When the PM acts as sniffer and is receiving reader data, it takes
93// 2 ticks delay in analogue RF receiver (for the falling edge of the
94// start bit, which marks the start of the communication)
95// 3 ticks A/D conversion
96// 8 ticks on average until the data is stored in to_arm.
97// + the delays in transferring data - which is the same for
98// sniffing reader and tag data and therefore not relevant
99#define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
100
101//variables used for timing purposes:
102//these are in ssp_clk cycles:
103static uint32_t NextTransferTime;
104static uint32_t LastTimeProxToAirStart;
105static uint32_t LastProxToAirDuration;
106
107
108
109// CARD TO READER - manchester
110// Sequence D: 11110000 modulation with subcarrier during first half
111// Sequence E: 00001111 modulation with subcarrier during second half
112// Sequence F: 00000000 no modulation with subcarrier
113// READER TO CARD - miller
114// Sequence X: 00001100 drop after half a period
115// Sequence Y: 00000000 no drop
116// Sequence Z: 11000000 drop at start
117#define SEC_D 0xf0
118#define SEC_E 0x0f
119#define SEC_F 0x00
120#define SEC_X 0x0c
121#define SEC_Y 0x00
122#define SEC_Z 0xc0
123
124const uint8_t OddByteParity[256] = {
125 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
126 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
127 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
141};
142
143
144void iso14a_set_trigger(bool enable) {
145 trigger = enable;
146}
147
148
149void iso14a_set_timeout(uint32_t timeout) {
150 iso14a_timeout = timeout;
151 if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);
152}
153
154
155void iso14a_set_ATS_timeout(uint8_t *ats) {
156
157 uint8_t tb1;
158 uint8_t fwi;
159 uint32_t fwt;
160
161 if (ats[0] > 1) { // there is a format byte T0
162 if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
163 if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
164 tb1 = ats[3];
165 } else {
166 tb1 = ats[2];
167 }
168 fwi = (tb1 & 0xf0) >> 4; // frame waiting indicator (FWI)
169 fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc
170
171 iso14a_set_timeout(fwt/(8*16));
172 }
173 }
174}
175
176
177//-----------------------------------------------------------------------------
178// Generate the parity value for a byte sequence
179//
180//-----------------------------------------------------------------------------
181byte_t oddparity (const byte_t bt)
182{
183 return OddByteParity[bt];
184}
185
186void GetParity(const uint8_t *pbtCmd, uint16_t iLen, uint8_t *par)
187{
188 uint16_t paritybit_cnt = 0;
189 uint16_t paritybyte_cnt = 0;
190 uint8_t parityBits = 0;
191
192 for (uint16_t i = 0; i < iLen; i++) {
193 // Generate the parity bits
194 parityBits |= ((OddByteParity[pbtCmd[i]]) << (7-paritybit_cnt));
195 if (paritybit_cnt == 7) {
196 par[paritybyte_cnt] = parityBits; // save 8 Bits parity
197 parityBits = 0; // and advance to next Parity Byte
198 paritybyte_cnt++;
199 paritybit_cnt = 0;
200 } else {
201 paritybit_cnt++;
202 }
203 }
204
205 // save remaining parity bits
206 par[paritybyte_cnt] = parityBits;
207
208}
209
210void AppendCrc14443a(uint8_t* data, int len)
211{
212 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
213}
214
215void AppendCrc14443b(uint8_t* data, int len)
216{
217 ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
218}
219
220
221//=============================================================================
222// ISO 14443 Type A - Miller decoder
223//=============================================================================
224// Basics:
225// This decoder is used when the PM3 acts as a tag.
226// The reader will generate "pauses" by temporarily switching of the field.
227// At the PM3 antenna we will therefore measure a modulated antenna voltage.
228// The FPGA does a comparison with a threshold and would deliver e.g.:
229// ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
230// The Miller decoder needs to identify the following sequences:
231// 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
232// 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
233// 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
234// Note 1: the bitstream may start at any time. We therefore need to sync.
235// Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
236//-----------------------------------------------------------------------------
237static tUart Uart;
238
239// Lookup-Table to decide if 4 raw bits are a modulation.
240// We accept the following:
241// 0001 - a 3 tick wide pause
242// 0011 - a 2 tick wide pause, or a three tick wide pause shifted left
243// 0111 - a 2 tick wide pause shifted left
244// 1001 - a 2 tick wide pause shifted right
245const bool Mod_Miller_LUT[] = {
246 FALSE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, TRUE,
247 FALSE, TRUE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE
248};
249#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
250#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
251
252void UartReset()
253{
254 Uart.state = STATE_UNSYNCD;
255 Uart.bitCount = 0;
256 Uart.len = 0; // number of decoded data bytes
257 Uart.parityLen = 0; // number of decoded parity bytes
258 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
259 Uart.parityBits = 0; // holds 8 parity bits
260 Uart.startTime = 0;
261 Uart.endTime = 0;
262
263 Uart.byteCntMax = 0;
264 Uart.posCnt = 0;
265 Uart.syncBit = 9999;
266}
267
268void UartInit(uint8_t *data, uint8_t *parity)
269{
270 Uart.output = data;
271 Uart.parity = parity;
272 Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
273 UartReset();
274}
275
276// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
277static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
278{
279
280 Uart.fourBits = (Uart.fourBits << 8) | bit;
281
282 if (Uart.state == STATE_UNSYNCD) { // not yet synced
283
284 Uart.syncBit = 9999; // not set
285
286 // 00x11111 2|3 ticks pause followed by 6|5 ticks unmodulated Sequence Z (a "0" or "start of communication")
287 // 11111111 8 ticks unmodulation Sequence Y (a "0" or "end of communication" or "no information")
288 // 111100x1 4 ticks unmodulated followed by 2|3 ticks pause Sequence X (a "1")
289
290 // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
291 // Sequence X followed by Sequence Y followed by Sequence Z (111100x1 11111111 00x11111)
292 // we therefore look for a ...xx1111 11111111 00x11111xxxxxx... pattern
293 // (12 '1's followed by 2 '0's, eventually followed by another '0', followed by 5 '1's)
294 //
295#define ISO14443A_STARTBIT_MASK 0x07FFEF80 // mask is 00001111 11111111 1110 1111 10000000
296#define ISO14443A_STARTBIT_PATTERN 0x07FF8F80 // pattern is 00001111 11111111 1000 1111 10000000
297
298 if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 0)) == ISO14443A_STARTBIT_PATTERN >> 0) Uart.syncBit = 7;
299 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 1)) == ISO14443A_STARTBIT_PATTERN >> 1) Uart.syncBit = 6;
300 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 2)) == ISO14443A_STARTBIT_PATTERN >> 2) Uart.syncBit = 5;
301 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 3)) == ISO14443A_STARTBIT_PATTERN >> 3) Uart.syncBit = 4;
302 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 4)) == ISO14443A_STARTBIT_PATTERN >> 4) Uart.syncBit = 3;
303 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 5)) == ISO14443A_STARTBIT_PATTERN >> 5) Uart.syncBit = 2;
304 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 6)) == ISO14443A_STARTBIT_PATTERN >> 6) Uart.syncBit = 1;
305 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 7)) == ISO14443A_STARTBIT_PATTERN >> 7) Uart.syncBit = 0;
306
307 if (Uart.syncBit != 9999) { // found a sync bit
308 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
309 Uart.startTime -= Uart.syncBit;
310 Uart.endTime = Uart.startTime;
311 Uart.state = STATE_START_OF_COMMUNICATION;
312 }
313
314 } else {
315
316 if (IsMillerModulationNibble1(Uart.fourBits >> Uart.syncBit)) {
317 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation in both halves - error
318 UartReset();
319 } else { // Modulation in first half = Sequence Z = logic "0"
320 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
321 UartReset();
322 } else {
323 Uart.bitCount++;
324 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
325 Uart.state = STATE_MILLER_Z;
326 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
327 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
328 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
329 Uart.parityBits <<= 1; // make room for the parity bit
330 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
331 Uart.bitCount = 0;
332 Uart.shiftReg = 0;
333 if((Uart.len&0x0007) == 0) { // every 8 data bytes
334 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
335 Uart.parityBits = 0;
336 }
337 }
338 }
339 }
340 } else {
341 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
342 Uart.bitCount++;
343 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
344 Uart.state = STATE_MILLER_X;
345 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
346 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
347 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
348 Uart.parityBits <<= 1; // make room for the new parity bit
349 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
350 Uart.bitCount = 0;
351 Uart.shiftReg = 0;
352 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
353 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
354 Uart.parityBits = 0;
355 }
356 }
357 } else { // no modulation in both halves - Sequence Y
358 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
359 Uart.state = STATE_UNSYNCD;
360 Uart.bitCount--; // last "0" was part of EOC sequence
361 Uart.shiftReg <<= 1; // drop it
362 if(Uart.bitCount > 0) { // if we decoded some bits
363 Uart.shiftReg >>= (9 - Uart.bitCount); // right align them
364 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff); // add last byte to the output
365 Uart.parityBits <<= 1; // add a (void) parity bit
366 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align parity bits
367 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store it
368 return TRUE;
369 } else if (Uart.len & 0x0007) { // there are some parity bits to store
370 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align remaining parity bits
371 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store them
372 }
373 if (Uart.len) {
374 return TRUE; // we are finished with decoding the raw data sequence
375 } else {
376 UartReset(); // Nothing received - start over
377 }
378 }
379 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
380 UartReset();
381 } else { // a logic "0"
382 Uart.bitCount++;
383 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
384 Uart.state = STATE_MILLER_Y;
385 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
386 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
387 Uart.parityBits <<= 1; // make room for the parity bit
388 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
389 Uart.bitCount = 0;
390 Uart.shiftReg = 0;
391 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
392 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
393 Uart.parityBits = 0;
394 }
395 }
396 }
397 }
398 }
399
400 }
401
402 return FALSE; // not finished yet, need more data
403}
404
405
406
407//=============================================================================
408// ISO 14443 Type A - Manchester decoder
409//=============================================================================
410// Basics:
411// This decoder is used when the PM3 acts as a reader.
412// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
413// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
414// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
415// The Manchester decoder needs to identify the following sequences:
416// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
417// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
418// 8 ticks unmodulated: Sequence F = end of communication
419// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
420// Note 1: the bitstream may start at any time. We therefore need to sync.
421// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
422static tDemod Demod;
423
424// Lookup-Table to decide if 4 raw bits are a modulation.
425// We accept three or four "1" in any position
426const bool Mod_Manchester_LUT[] = {
427 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
428 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
429};
430
431#define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
432#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
433
434
435void DemodReset()
436{
437 Demod.state = DEMOD_UNSYNCD;
438 Demod.len = 0; // number of decoded data bytes
439 Demod.parityLen = 0;
440 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
441 Demod.parityBits = 0; //
442 Demod.collisionPos = 0; // Position of collision bit
443 Demod.twoBits = 0xffff; // buffer for 2 Bits
444 Demod.highCnt = 0;
445 Demod.startTime = 0;
446 Demod.endTime = 0;
447
448 //
449 Demod.bitCount = 0;
450 Demod.syncBit = 0xFFFF;
451 Demod.samples = 0;
452}
453
454void DemodInit(uint8_t *data, uint8_t *parity)
455{
456 Demod.output = data;
457 Demod.parity = parity;
458 DemodReset();
459}
460
461// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
462static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
463{
464
465 Demod.twoBits = (Demod.twoBits << 8) | bit;
466
467 if (Demod.state == DEMOD_UNSYNCD) {
468
469 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
470 if (Demod.twoBits == 0x0000) {
471 Demod.highCnt++;
472 } else {
473 Demod.highCnt = 0;
474 }
475 } else {
476 Demod.syncBit = 0xFFFF; // not set
477 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
478 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
479 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
480 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
481 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
482 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
483 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
484 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
485 if (Demod.syncBit != 0xFFFF) {
486 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
487 Demod.startTime -= Demod.syncBit;
488 Demod.bitCount = offset; // number of decoded data bits
489 Demod.state = DEMOD_MANCHESTER_DATA;
490 }
491 }
492
493 } else {
494
495 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
496 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
497 if (!Demod.collisionPos) {
498 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
499 }
500 } // modulation in first half only - Sequence D = 1
501 Demod.bitCount++;
502 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
503 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
504 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
505 Demod.parityBits <<= 1; // make room for the parity bit
506 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
507 Demod.bitCount = 0;
508 Demod.shiftReg = 0;
509 if((Demod.len&0x0007) == 0) { // every 8 data bytes
510 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits
511 Demod.parityBits = 0;
512 }
513 }
514 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
515 } else { // no modulation in first half
516 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
517 Demod.bitCount++;
518 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
519 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
520 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
521 Demod.parityBits <<= 1; // make room for the new parity bit
522 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
523 Demod.bitCount = 0;
524 Demod.shiftReg = 0;
525 if ((Demod.len&0x0007) == 0) { // every 8 data bytes
526 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits1
527 Demod.parityBits = 0;
528 }
529 }
530 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
531 } else { // no modulation in both halves - End of communication
532 if(Demod.bitCount > 0) { // there are some remaining data bits
533 Demod.shiftReg >>= (9 - Demod.bitCount); // right align the decoded bits
534 Demod.output[Demod.len++] = Demod.shiftReg & 0xff; // and add them to the output
535 Demod.parityBits <<= 1; // add a (void) parity bit
536 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
537 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
538 return TRUE;
539 } else if (Demod.len & 0x0007) { // there are some parity bits to store
540 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
541 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
542 }
543 if (Demod.len) {
544 return TRUE; // we are finished with decoding the raw data sequence
545 } else { // nothing received. Start over
546 DemodReset();
547 }
548 }
549 }
550 }
551 return FALSE; // not finished yet, need more data
552}
553
554//=============================================================================
555// Finally, a `sniffer' for ISO 14443 Type A
556// Both sides of communication!
557//=============================================================================
558
559//-----------------------------------------------------------------------------
560// Record the sequence of commands sent by the reader to the tag, with
561// triggering so that we start recording at the point that the tag is moved
562// near the reader.
563//-----------------------------------------------------------------------------
564void RAMFUNC SniffIso14443a(uint8_t param) {
565 // param:
566 // bit 0 - trigger from first card answer
567 // bit 1 - trigger from first reader 7-bit request
568 LEDsoff();
569
570 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
571
572 // Allocate memory from BigBuf for some buffers
573 // free all previous allocations first
574 BigBuf_free();
575
576 // init trace buffer
577 clear_trace();
578 set_tracing(TRUE);
579
580 // The command (reader -> tag) that we're receiving.
581 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
582 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
583
584 // The response (tag -> reader) that we're receiving.
585 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
586 uint8_t *receivedResponsePar = BigBuf_malloc(MAX_PARITY_SIZE);
587
588 // The DMA buffer, used to stream samples from the FPGA
589 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
590
591 uint8_t *data = dmaBuf;
592 uint8_t previous_data = 0;
593 int maxDataLen = 0;
594 int dataLen = 0;
595 bool TagIsActive = FALSE;
596 bool ReaderIsActive = FALSE;
597
598 // Set up the demodulator for tag -> reader responses.
599 DemodInit(receivedResponse, receivedResponsePar);
600
601 // Set up the demodulator for the reader -> tag commands
602 UartInit(receivedCmd, receivedCmdPar);
603
604 // Setup and start DMA.
605 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
606
607 // We won't start recording the frames that we acquire until we trigger;
608 // a good trigger condition to get started is probably when we see a
609 // response from the tag.
610 // triggered == FALSE -- to wait first for card
611 bool triggered = !(param & 0x03);
612
613 // And now we loop, receiving samples.
614 for(uint32_t rsamples = 0; TRUE; ) {
615
616 if(BUTTON_PRESS()) {
617 DbpString("cancelled by button");
618 break;
619 }
620
621 LED_A_ON();
622 WDT_HIT();
623
624 int register readBufDataP = data - dmaBuf;
625 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
626 if (readBufDataP <= dmaBufDataP){
627 dataLen = dmaBufDataP - readBufDataP;
628 } else {
629 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
630 }
631 // test for length of buffer
632 if(dataLen > maxDataLen) {
633 maxDataLen = dataLen;
634 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
635 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
636 break;
637 }
638 }
639 if(dataLen < 1) continue;
640
641 // primary buffer was stopped( <-- we lost data!
642 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
643 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
644 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
645 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
646 }
647 // secondary buffer sets as primary, secondary buffer was stopped
648 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
649 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
650 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
651 }
652
653 LED_A_OFF();
654
655 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
656
657 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
658 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
659 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
660 LED_C_ON();
661
662 // check - if there is a short 7bit request from reader
663 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
664
665 if(triggered) {
666 if (!LogTrace(receivedCmd,
667 Uart.len,
668 Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
669 Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
670 Uart.parity,
671 TRUE)) break;
672 }
673 /* And ready to receive another command. */
674 UartReset();
675 /* And also reset the demod code, which might have been */
676 /* false-triggered by the commands from the reader. */
677 DemodReset();
678 LED_B_OFF();
679 }
680 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
681 }
682
683 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
684 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
685 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
686 LED_B_ON();
687
688 if (!LogTrace(receivedResponse,
689 Demod.len,
690 Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
691 Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
692 Demod.parity,
693 FALSE)) break;
694
695 if ((!triggered) && (param & 0x01)) triggered = TRUE;
696
697 // And ready to receive another response.
698 DemodReset();
699 // And reset the Miller decoder including itS (now outdated) input buffer
700 UartInit(receivedCmd, receivedCmdPar);
701
702 LED_C_OFF();
703 }
704 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
705 }
706 }
707
708 previous_data = *data;
709 rsamples++;
710 data++;
711 if(data == dmaBuf + DMA_BUFFER_SIZE) {
712 data = dmaBuf;
713 }
714 } // main cycle
715
716 FpgaDisableSscDma();
717 LEDsoff();
718
719 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
720 Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);
721
722 set_tracing(FALSE);
723}
724
725//-----------------------------------------------------------------------------
726// Prepare tag messages
727//-----------------------------------------------------------------------------
728static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
729{
730 ToSendReset();
731
732 // Correction bit, might be removed when not needed
733 ToSendStuffBit(0);
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736 ToSendStuffBit(0);
737 ToSendStuffBit(1); // 1
738 ToSendStuffBit(0);
739 ToSendStuffBit(0);
740 ToSendStuffBit(0);
741
742 // Send startbit
743 ToSend[++ToSendMax] = SEC_D;
744 LastProxToAirDuration = 8 * ToSendMax - 4;
745
746 for(uint16_t i = 0; i < len; i++) {
747 uint8_t b = cmd[i];
748
749 // Data bits
750 for(uint16_t j = 0; j < 8; j++) {
751 if(b & 1) {
752 ToSend[++ToSendMax] = SEC_D;
753 } else {
754 ToSend[++ToSendMax] = SEC_E;
755 }
756 b >>= 1;
757 }
758
759 // Get the parity bit
760 if (parity[i>>3] & (0x80>>(i&0x0007))) {
761 ToSend[++ToSendMax] = SEC_D;
762 LastProxToAirDuration = 8 * ToSendMax - 4;
763 } else {
764 ToSend[++ToSendMax] = SEC_E;
765 LastProxToAirDuration = 8 * ToSendMax;
766 }
767 }
768
769 // Send stopbit
770 ToSend[++ToSendMax] = SEC_F;
771
772 // Convert from last byte pos to length
773 ToSendMax++;
774}
775
776static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
777{
778 uint8_t par[MAX_PARITY_SIZE];
779
780 GetParity(cmd, len, par);
781 CodeIso14443aAsTagPar(cmd, len, par);
782}
783
784
785static void Code4bitAnswerAsTag(uint8_t cmd)
786{
787 int i;
788
789 ToSendReset();
790
791 // Correction bit, might be removed when not needed
792 ToSendStuffBit(0);
793 ToSendStuffBit(0);
794 ToSendStuffBit(0);
795 ToSendStuffBit(0);
796 ToSendStuffBit(1); // 1
797 ToSendStuffBit(0);
798 ToSendStuffBit(0);
799 ToSendStuffBit(0);
800
801 // Send startbit
802 ToSend[++ToSendMax] = SEC_D;
803
804 uint8_t b = cmd;
805 for(i = 0; i < 4; i++) {
806 if(b & 1) {
807 ToSend[++ToSendMax] = SEC_D;
808 LastProxToAirDuration = 8 * ToSendMax - 4;
809 } else {
810 ToSend[++ToSendMax] = SEC_E;
811 LastProxToAirDuration = 8 * ToSendMax;
812 }
813 b >>= 1;
814 }
815
816 // Send stopbit
817 ToSend[++ToSendMax] = SEC_F;
818
819 // Convert from last byte pos to length
820 ToSendMax++;
821}
822
823//-----------------------------------------------------------------------------
824// Wait for commands from reader
825// Stop when button is pressed
826// Or return TRUE when command is captured
827//-----------------------------------------------------------------------------
828static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
829{
830 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
831 // only, since we are receiving, not transmitting).
832 // Signal field is off with the appropriate LED
833 LED_D_OFF();
834 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
835
836 // Now run a `software UART' on the stream of incoming samples.
837 UartInit(received, parity);
838
839 // clear RXRDY:
840 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
841
842 for(;;) {
843 WDT_HIT();
844
845 if(BUTTON_PRESS()) return FALSE;
846
847 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
848 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
849 if(MillerDecoding(b, 0)) {
850 *len = Uart.len;
851 return TRUE;
852 }
853 }
854 }
855}
856
857static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
858int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
859int EmSend4bit(uint8_t resp);
860int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
861int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
862int EmSendCmd(uint8_t *resp, uint16_t respLen);
863int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
864bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
865 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
866
867static uint8_t* free_buffer_pointer;
868
869typedef struct {
870 uint8_t* response;
871 size_t response_n;
872 uint8_t* modulation;
873 size_t modulation_n;
874 uint32_t ProxToAirDuration;
875} tag_response_info_t;
876
877bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
878 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
879 // This will need the following byte array for a modulation sequence
880 // 144 data bits (18 * 8)
881 // 18 parity bits
882 // 2 Start and stop
883 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
884 // 1 just for the case
885 // ----------- +
886 // 166 bytes, since every bit that needs to be send costs us a byte
887 //
888
889
890 // Prepare the tag modulation bits from the message
891 CodeIso14443aAsTag(response_info->response,response_info->response_n);
892
893 // Make sure we do not exceed the free buffer space
894 if (ToSendMax > max_buffer_size) {
895 Dbprintf("Out of memory, when modulating bits for tag answer:");
896 Dbhexdump(response_info->response_n,response_info->response,false);
897 return false;
898 }
899
900 // Copy the byte array, used for this modulation to the buffer position
901 memcpy(response_info->modulation,ToSend,ToSendMax);
902
903 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
904 response_info->modulation_n = ToSendMax;
905 response_info->ProxToAirDuration = LastProxToAirDuration;
906
907 return true;
908}
909
910
911// "precompile" responses. There are 7 predefined responses with a total of 28 bytes data to transmit.
912// Coded responses need one byte per bit to transfer (data, parity, start, stop, correction)
913// 28 * 8 data bits, 28 * 1 parity bits, 7 start bits, 7 stop bits, 7 correction bits
914// -> need 273 bytes buffer
915// 44 * 8 data bits, 44 * 1 parity bits, 9 start bits, 9 stop bits, 9 correction bits --370
916// 47 * 8 data bits, 47 * 1 parity bits, 10 start bits, 10 stop bits, 10 correction bits
917#define ALLOCATED_TAG_MODULATION_BUFFER_SIZE 453
918
919bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
920 // Retrieve and store the current buffer index
921 response_info->modulation = free_buffer_pointer;
922
923 // Determine the maximum size we can use from our buffer
924 size_t max_buffer_size = ALLOCATED_TAG_MODULATION_BUFFER_SIZE;
925
926 // Forward the prepare tag modulation function to the inner function
927 if (prepare_tag_modulation(response_info, max_buffer_size)) {
928 // Update the free buffer offset
929 free_buffer_pointer += ToSendMax;
930 return true;
931 } else {
932 return false;
933 }
934}
935
936//-----------------------------------------------------------------------------
937// Main loop of simulated tag: receive commands from reader, decide what
938// response to send, and send it.
939//-----------------------------------------------------------------------------
940void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
941{
942 uint32_t counters[] = {0,0,0};
943 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
944 // This can be used in a reader-only attack.
945 // (it can also be retrieved via 'hf 14a list', but hey...
946 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
947 uint8_t ar_nr_collected = 0;
948
949 uint8_t sak;
950
951 // PACK response to PWD AUTH for EV1/NTAG
952 uint8_t response8[4] = {0,0,0,0};
953
954 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
955 uint8_t response1[2] = {0,0};
956
957 switch (tagType) {
958 case 1: { // MIFARE Classic
959 // Says: I am Mifare 1k - original line
960 response1[0] = 0x04;
961 response1[1] = 0x00;
962 sak = 0x08;
963 } break;
964 case 2: { // MIFARE Ultralight
965 // Says: I am a stupid memory tag, no crypto
966 response1[0] = 0x44;
967 response1[1] = 0x00;
968 sak = 0x00;
969 } break;
970 case 3: { // MIFARE DESFire
971 // Says: I am a DESFire tag, ph33r me
972 response1[0] = 0x04;
973 response1[1] = 0x03;
974 sak = 0x20;
975 } break;
976 case 4: { // ISO/IEC 14443-4
977 // Says: I am a javacard (JCOP)
978 response1[0] = 0x04;
979 response1[1] = 0x00;
980 sak = 0x28;
981 } break;
982 case 5: { // MIFARE TNP3XXX
983 // Says: I am a toy
984 response1[0] = 0x01;
985 response1[1] = 0x0f;
986 sak = 0x01;
987 } break;
988 case 6: { // MIFARE Mini
989 // Says: I am a Mifare Mini, 320b
990 response1[0] = 0x44;
991 response1[1] = 0x00;
992 sak = 0x09;
993 } break;
994 case 7: { // NTAG?
995 // Says: I am a NTAG,
996 response1[0] = 0x44;
997 response1[1] = 0x00;
998 sak = 0x00;
999 // PACK
1000 response8[0] = 0x80;
1001 response8[1] = 0x80;
1002 ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);
1003 } break;
1004 default: {
1005 Dbprintf("Error: unkown tagtype (%d)",tagType);
1006 return;
1007 } break;
1008 }
1009
1010 // The second response contains the (mandatory) first 24 bits of the UID
1011 uint8_t response2[5] = {0x00};
1012
1013 // Check if the uid uses the (optional) part
1014 uint8_t response2a[5] = {0x00};
1015
1016 if (flags & FLAG_7B_UID_IN_DATA) {
1017 response2[0] = 0x88;
1018 response2[1] = data[0];
1019 response2[2] = data[1];
1020 response2[3] = data[2];
1021
1022 response2a[0] = data[3];
1023 response2a[1] = data[4];
1024 response2a[2] = data[5];
1025 response2a[3] = data[6]; //??
1026 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
1027
1028 // Configure the ATQA and SAK accordingly
1029 response1[0] |= 0x40;
1030 sak |= 0x04;
1031 } else {
1032 memcpy(response2, data, 4);
1033 //num_to_bytes(uid_1st,4,response2);
1034 // Configure the ATQA and SAK accordingly
1035 response1[0] &= 0xBF;
1036 sak &= 0xFB;
1037 }
1038
1039 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1040 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
1041
1042 // Prepare the mandatory SAK (for 4 and 7 byte UID)
1043 uint8_t response3[3] = {0x00};
1044 response3[0] = sak;
1045 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
1046
1047 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
1048 uint8_t response3a[3] = {0x00};
1049 response3a[0] = sak & 0xFB;
1050 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
1051
1052 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
1053 uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1054 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1055 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1056 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1057 // TC(1) = 0x02: CID supported, NAD not supported
1058 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
1059
1060 // Prepare GET_VERSION (different for EV-1 / NTAG)
1061 //uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7}; //EV1 48bytes VERSION.
1062 uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
1063
1064 // Prepare CHK_TEARING
1065 uint8_t response9[] = {0xBD,0x90,0x3f};
1066
1067 #define TAG_RESPONSE_COUNT 10
1068 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
1069 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
1070 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
1071 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1072 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
1073 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
1074 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
1075 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
1076 { .response = response7_NTAG, .response_n = sizeof(response7_NTAG) }, // EV1/NTAG GET_VERSION response
1077 { .response = response8, .response_n = sizeof(response8) }, // EV1/NTAG PACK response
1078 { .response = response9, .response_n = sizeof(response9) } // EV1/NTAG CHK_TEAR response
1079 };
1080
1081 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1082 // Such a response is less time critical, so we can prepare them on the fly
1083 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1084 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1085 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
1086 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
1087 tag_response_info_t dynamic_response_info = {
1088 .response = dynamic_response_buffer,
1089 .response_n = 0,
1090 .modulation = dynamic_modulation_buffer,
1091 .modulation_n = 0
1092 };
1093
1094 // We need to listen to the high-frequency, peak-detected path.
1095 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1096
1097 BigBuf_free_keep_EM();
1098
1099 // allocate buffers:
1100 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
1101 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
1102 free_buffer_pointer = BigBuf_malloc(ALLOCATED_TAG_MODULATION_BUFFER_SIZE);
1103
1104 // clear trace
1105 clear_trace();
1106 set_tracing(TRUE);
1107
1108 // Prepare the responses of the anticollision phase
1109 // there will be not enough time to do this at the moment the reader sends it REQA
1110 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
1111 prepare_allocated_tag_modulation(&responses[i]);
1112 }
1113
1114 int len = 0;
1115
1116 // To control where we are in the protocol
1117 int order = 0;
1118 int lastorder;
1119
1120 // Just to allow some checks
1121 int happened = 0;
1122 int happened2 = 0;
1123 int cmdsRecvd = 0;
1124
1125 cmdsRecvd = 0;
1126 tag_response_info_t* p_response;
1127
1128 LED_A_ON();
1129 for(;;) {
1130 // Clean receive command buffer
1131
1132 if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
1133 DbpString("Button press");
1134 break;
1135 }
1136
1137 p_response = NULL;
1138
1139 // Okay, look at the command now.
1140 lastorder = order;
1141 if(receivedCmd[0] == 0x26) { // Received a REQUEST
1142 p_response = &responses[0]; order = 1;
1143 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
1144 p_response = &responses[0]; order = 6;
1145 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
1146 p_response = &responses[1]; order = 2;
1147 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
1148 p_response = &responses[2]; order = 20;
1149 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
1150 p_response = &responses[3]; order = 3;
1151 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
1152 p_response = &responses[4]; order = 30;
1153 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
1154 uint8_t block = receivedCmd[1];
1155 if ( tagType == 7 ) {
1156 uint16_t start = 4 * block;
1157
1158 /*if ( block < 4 ) {
1159 //NTAG 215
1160 uint8_t blockdata[50] = {
1161 data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
1162 data[3],data[4],data[5],data[6],
1163 data[3] ^ data[4] ^ data[5] ^ data[6],0x48,0x0f,0xe0,
1164 0xe1,0x10,0x12,0x00,
1165 0x03,0x00,0xfe,0x00,
1166 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1167 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1168 0x00,0x00,0x00,0x00,
1169 0x00,0x00};
1170 AppendCrc14443a(blockdata+start, 16);
1171 EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
1172 } else {*/
1173 uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
1174 emlGetMemBt( emdata, start, 16);
1175 AppendCrc14443a(emdata, 16);
1176 EmSendCmdEx(emdata, sizeof(emdata), false);
1177 //}
1178 p_response = NULL;
1179
1180 } else {
1181 EmSendCmdEx(data+(4*block),16,false);
1182 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1183 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1184 p_response = NULL;
1185 }
1186 } else if(receivedCmd[0] == 0x3A) { // Received a FAST READ (ranged read)
1187
1188 uint8_t emdata[MAX_FRAME_SIZE];
1189 int start = receivedCmd[1] * 4;
1190 int len = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
1191 emlGetMemBt( emdata, start, len);
1192 AppendCrc14443a(emdata, len);
1193 EmSendCmdEx(emdata, len+2, false);
1194 p_response = NULL;
1195
1196 } else if(receivedCmd[0] == 0x3C && tagType == 7) { // Received a READ SIGNATURE --
1197 // ECC data, taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
1198 uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
1199 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
1200 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
1201 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
1202 0x00,0x00};
1203 AppendCrc14443a(data, sizeof(data)-2);
1204 EmSendCmdEx(data,sizeof(data),false);
1205 p_response = NULL;
1206 } else if (receivedCmd[0] == 0x39 && tagType == 7) { // Received a READ COUNTER --
1207 uint8_t index = receivedCmd[1];
1208 uint8_t data[] = {0x00,0x00,0x00,0x14,0xa5};
1209 if ( counters[index] > 0) {
1210 num_to_bytes(counters[index], 3, data);
1211 AppendCrc14443a(data, sizeof(data)-2);
1212 }
1213 EmSendCmdEx(data,sizeof(data),false);
1214 p_response = NULL;
1215 } else if (receivedCmd[0] == 0xA5 && tagType == 7) { // Received a INC COUNTER --
1216 // number of counter
1217 uint8_t counter = receivedCmd[1];
1218 uint32_t val = bytes_to_num(receivedCmd+2,4);
1219 counters[counter] = val;
1220
1221 // send ACK
1222 uint8_t ack[] = {0x0a};
1223 EmSendCmdEx(ack,sizeof(ack),false);
1224 p_response = NULL;
1225
1226 } else if(receivedCmd[0] == 0x3E && tagType == 7) { // Received a CHECK_TEARING_EVENT --
1227 p_response = &responses[9];
1228 } else if(receivedCmd[0] == 0x50) { // Received a HALT
1229
1230 if (tracing) {
1231 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1232 }
1233 p_response = NULL;
1234 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
1235
1236 if ( tagType == 7 ) { // IF NTAG /EV1 0x60 == GET_VERSION, not a authentication request.
1237 p_response = &responses[7];
1238 } else {
1239 p_response = &responses[5]; order = 7;
1240 }
1241 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
1242 if (tagType == 1 || tagType == 2) { // RATS not supported
1243 EmSend4bit(CARD_NACK_NA);
1244 p_response = NULL;
1245 } else {
1246 p_response = &responses[6]; order = 70;
1247 }
1248 } else if (order == 7 && len == 8) { // Received {nr] and {ar} (part of authentication)
1249 if (tracing) {
1250 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1251 }
1252 uint32_t nonce = bytes_to_num(response5,4);
1253 uint32_t nr = bytes_to_num(receivedCmd,4);
1254 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1255 //Dbprintf("Auth attempt {nonce}{nr}{ar}: %08x %08x %08x", nonce, nr, ar);
1256
1257 if(flags & FLAG_NR_AR_ATTACK )
1258 {
1259 if(ar_nr_collected < 2){
1260 // Avoid duplicates... probably not necessary, nr should vary.
1261 //if(ar_nr_responses[3] != nr){
1262 ar_nr_responses[ar_nr_collected*5] = 0;
1263 ar_nr_responses[ar_nr_collected*5+1] = 0;
1264 ar_nr_responses[ar_nr_collected*5+2] = nonce;
1265 ar_nr_responses[ar_nr_collected*5+3] = nr;
1266 ar_nr_responses[ar_nr_collected*5+4] = ar;
1267 ar_nr_collected++;
1268 //}
1269 }
1270
1271 if(ar_nr_collected > 1 ) {
1272
1273 if (MF_DBGLEVEL >= 2) {
1274 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
1275 Dbprintf("../tools/mfkey/mfkey32 %07x%08x %08x %08x %08x %08x %08x",
1276 ar_nr_responses[0], // UID1
1277 ar_nr_responses[1], // UID2
1278 ar_nr_responses[2], // NT
1279 ar_nr_responses[3], // AR1
1280 ar_nr_responses[4], // NR1
1281 ar_nr_responses[8], // AR2
1282 ar_nr_responses[9] // NR2
1283 );
1284 Dbprintf("../tools/mfkey/mfkey32v2 %06x%08x %08x %08x %08x %08x %08x %08x",
1285 ar_nr_responses[0], // UID1
1286 ar_nr_responses[1], // UID2
1287 ar_nr_responses[2], // NT1
1288 ar_nr_responses[3], // AR1
1289 ar_nr_responses[4], // NR1
1290 ar_nr_responses[7], // NT2
1291 ar_nr_responses[8], // AR2
1292 ar_nr_responses[9] // NR2
1293 );
1294 }
1295 uint8_t len = ar_nr_collected*5*4;
1296 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,len,0,&ar_nr_responses,len);
1297 ar_nr_collected = 0;
1298 memset(ar_nr_responses, 0x00, len);
1299 }
1300 }
1301 } else if (receivedCmd[0] == 0x1a ) // ULC authentication
1302 {
1303
1304 }
1305 else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
1306 {
1307 if ( tagType == 7 ) {
1308 p_response = &responses[8]; // PACK response
1309 uint32_t pwd = bytes_to_num(receivedCmd+1,4);
1310
1311 if ( MF_DBGLEVEL >= 3) Dbprintf("Auth attempt: %08x", pwd);
1312 }
1313 }
1314 else {
1315 // Check for ISO 14443A-4 compliant commands, look at left nibble
1316 switch (receivedCmd[0]) {
1317 case 0x02:
1318 case 0x03: { // IBlock (command no CID)
1319 dynamic_response_info.response[0] = receivedCmd[0];
1320 dynamic_response_info.response[1] = 0x90;
1321 dynamic_response_info.response[2] = 0x00;
1322 dynamic_response_info.response_n = 3;
1323 } break;
1324 case 0x0B:
1325 case 0x0A: { // IBlock (command CID)
1326 dynamic_response_info.response[0] = receivedCmd[0];
1327 dynamic_response_info.response[1] = 0x00;
1328 dynamic_response_info.response[2] = 0x90;
1329 dynamic_response_info.response[3] = 0x00;
1330 dynamic_response_info.response_n = 4;
1331 } break;
1332
1333 case 0x1A:
1334 case 0x1B: { // Chaining command
1335 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1336 dynamic_response_info.response_n = 2;
1337 } break;
1338
1339 case 0xaa:
1340 case 0xbb: {
1341 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1342 dynamic_response_info.response_n = 2;
1343 } break;
1344
1345 case 0xBA: { // ping / pong
1346 dynamic_response_info.response[0] = 0xAB;
1347 dynamic_response_info.response[1] = 0x00;
1348 dynamic_response_info.response_n = 2;
1349 } break;
1350
1351 case 0xCA:
1352 case 0xC2: { // Readers sends deselect command
1353 dynamic_response_info.response[0] = 0xCA;
1354 dynamic_response_info.response[1] = 0x00;
1355 dynamic_response_info.response_n = 2;
1356 } break;
1357
1358 default: {
1359 // Never seen this command before
1360 if (tracing) {
1361 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1362 }
1363 Dbprintf("Received unknown command (len=%d):",len);
1364 Dbhexdump(len,receivedCmd,false);
1365 // Do not respond
1366 dynamic_response_info.response_n = 0;
1367 } break;
1368 }
1369
1370 if (dynamic_response_info.response_n > 0) {
1371 // Copy the CID from the reader query
1372 dynamic_response_info.response[1] = receivedCmd[1];
1373
1374 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1375 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1376 dynamic_response_info.response_n += 2;
1377
1378 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1379 Dbprintf("Error preparing tag response");
1380 if (tracing) {
1381 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1382 }
1383 break;
1384 }
1385 p_response = &dynamic_response_info;
1386 }
1387 }
1388
1389 // Count number of wakeups received after a halt
1390 if(order == 6 && lastorder == 5) { happened++; }
1391
1392 // Count number of other messages after a halt
1393 if(order != 6 && lastorder == 5) { happened2++; }
1394
1395 if(cmdsRecvd > 999) {
1396 DbpString("1000 commands later...");
1397 break;
1398 }
1399 cmdsRecvd++;
1400
1401 if (p_response != NULL) {
1402 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1403 // do the tracing for the previous reader request and this tag answer:
1404 uint8_t par[MAX_PARITY_SIZE];
1405 GetParity(p_response->response, p_response->response_n, par);
1406
1407 EmLogTrace(Uart.output,
1408 Uart.len,
1409 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1410 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1411 Uart.parity,
1412 p_response->response,
1413 p_response->response_n,
1414 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1415 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1416 par);
1417 }
1418
1419 if (!tracing) {
1420 Dbprintf("Trace Full. Simulation stopped.");
1421 break;
1422 }
1423 }
1424
1425 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1426 set_tracing(FALSE);
1427 BigBuf_free_keep_EM();
1428 LED_A_OFF();
1429
1430 if (MF_DBGLEVEL >= 4){
1431 Dbprintf("-[ Wake ups after halt [%d]", happened);
1432 Dbprintf("-[ Messages after halt [%d]", happened2);
1433 Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
1434 }
1435}
1436
1437
1438// prepare a delayed transfer. This simply shifts ToSend[] by a number
1439// of bits specified in the delay parameter.
1440void PrepareDelayedTransfer(uint16_t delay)
1441{
1442 uint8_t bitmask = 0;
1443 uint8_t bits_to_shift = 0;
1444 uint8_t bits_shifted = 0;
1445
1446 delay &= 0x07;
1447 if (delay) {
1448 for (uint16_t i = 0; i < delay; i++) {
1449 bitmask |= (0x01 << i);
1450 }
1451 ToSend[ToSendMax++] = 0x00;
1452 for (uint16_t i = 0; i < ToSendMax; i++) {
1453 bits_to_shift = ToSend[i] & bitmask;
1454 ToSend[i] = ToSend[i] >> delay;
1455 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1456 bits_shifted = bits_to_shift;
1457 }
1458 }
1459}
1460
1461
1462//-------------------------------------------------------------------------------------
1463// Transmit the command (to the tag) that was placed in ToSend[].
1464// Parameter timing:
1465// if NULL: transfer at next possible time, taking into account
1466// request guard time and frame delay time
1467// if == 0: transfer immediately and return time of transfer
1468// if != 0: delay transfer until time specified
1469//-------------------------------------------------------------------------------------
1470static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
1471{
1472
1473 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1474
1475 uint32_t ThisTransferTime = 0;
1476
1477 if (timing) {
1478 if(*timing == 0) { // Measure time
1479 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
1480 } else {
1481 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1482 }
1483 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1484 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1485 LastTimeProxToAirStart = *timing;
1486 } else {
1487 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1488 while(GetCountSspClk() < ThisTransferTime);
1489 LastTimeProxToAirStart = ThisTransferTime;
1490 }
1491
1492 // clear TXRDY
1493 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1494
1495 uint16_t c = 0;
1496 for(;;) {
1497 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1498 AT91C_BASE_SSC->SSC_THR = cmd[c];
1499 c++;
1500 if(c >= len) {
1501 break;
1502 }
1503 }
1504 }
1505
1506 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
1507}
1508
1509
1510//-----------------------------------------------------------------------------
1511// Prepare reader command (in bits, support short frames) to send to FPGA
1512//-----------------------------------------------------------------------------
1513void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
1514{
1515 int i, j;
1516 int last;
1517 uint8_t b;
1518
1519 ToSendReset();
1520
1521 // Start of Communication (Seq. Z)
1522 ToSend[++ToSendMax] = SEC_Z;
1523 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1524 last = 0;
1525
1526 size_t bytecount = nbytes(bits);
1527 // Generate send structure for the data bits
1528 for (i = 0; i < bytecount; i++) {
1529 // Get the current byte to send
1530 b = cmd[i];
1531 size_t bitsleft = MIN((bits-(i*8)),8);
1532
1533 for (j = 0; j < bitsleft; j++) {
1534 if (b & 1) {
1535 // Sequence X
1536 ToSend[++ToSendMax] = SEC_X;
1537 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1538 last = 1;
1539 } else {
1540 if (last == 0) {
1541 // Sequence Z
1542 ToSend[++ToSendMax] = SEC_Z;
1543 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1544 } else {
1545 // Sequence Y
1546 ToSend[++ToSendMax] = SEC_Y;
1547 last = 0;
1548 }
1549 }
1550 b >>= 1;
1551 }
1552
1553 // Only transmit parity bit if we transmitted a complete byte
1554 if (j == 8 && parity != NULL) {
1555 // Get the parity bit
1556 if (parity[i>>3] & (0x80 >> (i&0x0007))) {
1557 // Sequence X
1558 ToSend[++ToSendMax] = SEC_X;
1559 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1560 last = 1;
1561 } else {
1562 if (last == 0) {
1563 // Sequence Z
1564 ToSend[++ToSendMax] = SEC_Z;
1565 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1566 } else {
1567 // Sequence Y
1568 ToSend[++ToSendMax] = SEC_Y;
1569 last = 0;
1570 }
1571 }
1572 }
1573 }
1574
1575 // End of Communication: Logic 0 followed by Sequence Y
1576 if (last == 0) {
1577 // Sequence Z
1578 ToSend[++ToSendMax] = SEC_Z;
1579 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1580 } else {
1581 // Sequence Y
1582 ToSend[++ToSendMax] = SEC_Y;
1583 last = 0;
1584 }
1585 ToSend[++ToSendMax] = SEC_Y;
1586
1587 // Convert to length of command:
1588 ToSendMax++;
1589}
1590
1591//-----------------------------------------------------------------------------
1592// Prepare reader command to send to FPGA
1593//-----------------------------------------------------------------------------
1594void CodeIso14443aAsReaderPar(const uint8_t *cmd, uint16_t len, const uint8_t *parity)
1595{
1596 CodeIso14443aBitsAsReaderPar(cmd, len*8, parity);
1597}
1598
1599
1600//-----------------------------------------------------------------------------
1601// Wait for commands from reader
1602// Stop when button is pressed (return 1) or field was gone (return 2)
1603// Or return 0 when command is captured
1604//-----------------------------------------------------------------------------
1605static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
1606{
1607 *len = 0;
1608
1609 uint32_t timer = 0, vtime = 0;
1610 int analogCnt = 0;
1611 int analogAVG = 0;
1612
1613 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1614 // only, since we are receiving, not transmitting).
1615 // Signal field is off with the appropriate LED
1616 LED_D_OFF();
1617 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1618
1619 // Set ADC to read field strength
1620 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1621 AT91C_BASE_ADC->ADC_MR =
1622 ADC_MODE_PRESCALE(63) |
1623 ADC_MODE_STARTUP_TIME(1) |
1624 ADC_MODE_SAMPLE_HOLD_TIME(15);
1625 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1626 // start ADC
1627 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1628
1629 // Now run a 'software UART' on the stream of incoming samples.
1630 UartInit(received, parity);
1631
1632 // Clear RXRDY:
1633 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1634
1635 for(;;) {
1636 WDT_HIT();
1637
1638 if (BUTTON_PRESS()) return 1;
1639
1640 // test if the field exists
1641 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1642 analogCnt++;
1643 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1644 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1645 if (analogCnt >= 32) {
1646 if ((MAX_ADC_HF_VOLTAGE * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1647 vtime = GetTickCount();
1648 if (!timer) timer = vtime;
1649 // 50ms no field --> card to idle state
1650 if (vtime - timer > 50) return 2;
1651 } else
1652 if (timer) timer = 0;
1653 analogCnt = 0;
1654 analogAVG = 0;
1655 }
1656 }
1657
1658 // receive and test the miller decoding
1659 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1660 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1661 if(MillerDecoding(b, 0)) {
1662 *len = Uart.len;
1663 return 0;
1664 }
1665 }
1666
1667 }
1668}
1669
1670
1671static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded)
1672{
1673 uint8_t b;
1674 uint16_t i = 0;
1675 uint32_t ThisTransferTime;
1676
1677 // Modulate Manchester
1678 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1679
1680 // include correction bit if necessary
1681 if (Uart.parityBits & 0x01) {
1682 correctionNeeded = TRUE;
1683 }
1684 if(correctionNeeded) {
1685 // 1236, so correction bit needed
1686 i = 0;
1687 } else {
1688 i = 1;
1689 }
1690
1691 // clear receiving shift register and holding register
1692 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1693 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1694 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1695 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1696
1697 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1698 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1699 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1700 if (AT91C_BASE_SSC->SSC_RHR) break;
1701 }
1702
1703 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1704
1705 // Clear TXRDY:
1706 AT91C_BASE_SSC->SSC_THR = SEC_F;
1707
1708 // send cycle
1709 for(; i < respLen; ) {
1710 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1711 AT91C_BASE_SSC->SSC_THR = resp[i++];
1712 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1713 }
1714
1715 if(BUTTON_PRESS()) break;
1716 }
1717
1718 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1719 uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3;
1720 for (i = 0; i <= fpga_queued_bits/8 + 1; ) {
1721 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1722 AT91C_BASE_SSC->SSC_THR = SEC_F;
1723 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1724 i++;
1725 }
1726 }
1727
1728 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1729
1730 return 0;
1731}
1732
1733int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1734 Code4bitAnswerAsTag(resp);
1735 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1736 // do the tracing for the previous reader request and this tag answer:
1737 uint8_t par[1];
1738 GetParity(&resp, 1, par);
1739 EmLogTrace(Uart.output,
1740 Uart.len,
1741 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1742 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1743 Uart.parity,
1744 &resp,
1745 1,
1746 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1747 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1748 par);
1749 return res;
1750}
1751
1752int EmSend4bit(uint8_t resp){
1753 return EmSend4bitEx(resp, false);
1754}
1755
1756int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par){
1757 CodeIso14443aAsTagPar(resp, respLen, par);
1758 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1759 // do the tracing for the previous reader request and this tag answer:
1760 EmLogTrace(Uart.output,
1761 Uart.len,
1762 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1763 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1764 Uart.parity,
1765 resp,
1766 respLen,
1767 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1768 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1769 par);
1770 return res;
1771}
1772
1773int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
1774 uint8_t par[MAX_PARITY_SIZE];
1775 GetParity(resp, respLen, par);
1776 return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
1777}
1778
1779int EmSendCmd(uint8_t *resp, uint16_t respLen){
1780 uint8_t par[MAX_PARITY_SIZE];
1781 GetParity(resp, respLen, par);
1782 return EmSendCmdExPar(resp, respLen, false, par);
1783}
1784
1785int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par){
1786 return EmSendCmdExPar(resp, respLen, false, par);
1787}
1788
1789bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
1790 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity)
1791{
1792 if (tracing) {
1793 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1794 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1795 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1796 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1797 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1798 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1799 reader_EndTime = tag_StartTime - exact_fdt;
1800 reader_StartTime = reader_EndTime - reader_modlen;
1801 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
1802 return FALSE;
1803 } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
1804 } else {
1805 return TRUE;
1806 }
1807}
1808
1809//-----------------------------------------------------------------------------
1810// Wait a certain time for tag response
1811// If a response is captured return TRUE
1812// If it takes too long return FALSE
1813//-----------------------------------------------------------------------------
1814static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
1815{
1816 uint32_t c = 0x00;
1817
1818 // Set FPGA mode to "reader listen mode", no modulation (listen
1819 // only, since we are receiving, not transmitting).
1820 // Signal field is on with the appropriate LED
1821 LED_D_ON();
1822 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1823
1824 // Now get the answer from the card
1825 DemodInit(receivedResponse, receivedResponsePar);
1826
1827 // clear RXRDY:
1828 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1829
1830 for(;;) {
1831 WDT_HIT();
1832
1833 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1834 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1835 if(ManchesterDecoding(b, offset, 0)) {
1836 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
1837 return TRUE;
1838 } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
1839 return FALSE;
1840 }
1841 }
1842 }
1843}
1844
1845void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
1846{
1847 CodeIso14443aBitsAsReaderPar(frame, bits, par);
1848
1849 // Send command to tag
1850 TransmitFor14443a(ToSend, ToSendMax, timing);
1851 if(trigger)
1852 LED_A_ON();
1853
1854 // Log reader command in trace buffer
1855 if (tracing) {
1856 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1857 }
1858}
1859
1860void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
1861{
1862 ReaderTransmitBitsPar(frame, len*8, par, timing);
1863}
1864
1865void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
1866{
1867 // Generate parity and redirect
1868 uint8_t par[MAX_PARITY_SIZE];
1869 GetParity(frame, len/8, par);
1870 ReaderTransmitBitsPar(frame, len, par, timing);
1871}
1872
1873void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
1874{
1875 // Generate parity and redirect
1876 uint8_t par[MAX_PARITY_SIZE];
1877 GetParity(frame, len, par);
1878 ReaderTransmitBitsPar(frame, len*8, par, timing);
1879}
1880
1881int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
1882{
1883 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE;
1884 if (tracing) {
1885 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1886 }
1887 return Demod.len;
1888}
1889
1890int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
1891{
1892 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
1893 if (tracing) {
1894 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1895 }
1896 return Demod.len;
1897}
1898
1899// performs iso14443a anticollision (optional) and card select procedure
1900// fills the uid and cuid pointer unless NULL
1901// fills the card info record unless NULL
1902// if anticollision is false, then the UID must be provided in uid_ptr[]
1903// and num_cascades must be set (1: 4 Byte UID, 2: 7 Byte UID, 3: 10 Byte UID)
1904int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades) {
1905 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1906 uint8_t sel_all[] = { 0x93,0x20 };
1907 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1908 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1909 uint8_t resp[MAX_FRAME_SIZE]; // theoretically. A usual RATS will be much smaller
1910 uint8_t resp_par[MAX_PARITY_SIZE];
1911 byte_t uid_resp[4];
1912 size_t uid_resp_len;
1913
1914 uint8_t sak = 0x04; // cascade uid
1915 int cascade_level = 0;
1916 int len;
1917
1918 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1919 ReaderTransmitBitsPar(wupa, 7, NULL, NULL);
1920
1921 // Receive the ATQA
1922 if(!ReaderReceive(resp, resp_par)) return 0;
1923
1924 if(p_hi14a_card) {
1925 memcpy(p_hi14a_card->atqa, resp, 2);
1926 p_hi14a_card->uidlen = 0;
1927 memset(p_hi14a_card->uid,0,10);
1928 }
1929
1930 if (anticollision) {
1931 // clear uid
1932 if (uid_ptr) {
1933 memset(uid_ptr,0,10);
1934 }
1935 }
1936
1937 // check for proprietary anticollision:
1938 if ((resp[0] & 0x1F) == 0) {
1939 return 3;
1940 }
1941
1942 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1943 // which case we need to make a cascade 2 request and select - this is a long UID
1944 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1945 for(; sak & 0x04; cascade_level++) {
1946 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1947 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1948
1949 if (anticollision) {
1950 // SELECT_ALL
1951 ReaderTransmit(sel_all, sizeof(sel_all), NULL);
1952 if (!ReaderReceive(resp, resp_par)) return 0;
1953
1954 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1955 memset(uid_resp, 0, 4);
1956 uint16_t uid_resp_bits = 0;
1957 uint16_t collision_answer_offset = 0;
1958 // anti-collision-loop:
1959 while (Demod.collisionPos) {
1960 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1961 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1962 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1963 uid_resp[uid_resp_bits / 8] |= UIDbit << (uid_resp_bits % 8);
1964 }
1965 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1966 uid_resp_bits++;
1967 // construct anticollosion command:
1968 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1969 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1970 sel_uid[2+i] = uid_resp[i];
1971 }
1972 collision_answer_offset = uid_resp_bits%8;
1973 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1974 if (!ReaderReceiveOffset(resp, collision_answer_offset, resp_par)) return 0;
1975 }
1976 // finally, add the last bits and BCC of the UID
1977 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1978 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1979 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1980 }
1981
1982 } else { // no collision, use the response to SELECT_ALL as current uid
1983 memcpy(uid_resp, resp, 4);
1984 }
1985 } else {
1986 if (cascade_level < num_cascades - 1) {
1987 uid_resp[0] = 0x88;
1988 memcpy(uid_resp+1, uid_ptr+cascade_level*3, 3);
1989 } else {
1990 memcpy(uid_resp, uid_ptr+cascade_level*3, 4);
1991 }
1992 }
1993 uid_resp_len = 4;
1994
1995 // calculate crypto UID. Always use last 4 Bytes.
1996 if(cuid_ptr) {
1997 *cuid_ptr = bytes_to_num(uid_resp, 4);
1998 }
1999
2000 // Construct SELECT UID command
2001 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
2002 memcpy(sel_uid+2, uid_resp, 4); // the UID received during anticollision, or the provided UID
2003 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
2004 AppendCrc14443a(sel_uid, 7); // calculate and add CRC
2005 ReaderTransmit(sel_uid, sizeof(sel_uid), NULL);
2006
2007 // Receive the SAK
2008 if (!ReaderReceive(resp, resp_par)) return 0;
2009 sak = resp[0];
2010
2011 // Test if more parts of the uid are coming
2012 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
2013 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
2014 // http://www.nxp.com/documents/application_note/AN10927.pdf
2015 uid_resp[0] = uid_resp[1];
2016 uid_resp[1] = uid_resp[2];
2017 uid_resp[2] = uid_resp[3];
2018 uid_resp_len = 3;
2019 }
2020
2021 if(uid_ptr && anticollision) {
2022 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
2023 }
2024
2025 if(p_hi14a_card) {
2026 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
2027 p_hi14a_card->uidlen += uid_resp_len;
2028 }
2029 }
2030
2031 if(p_hi14a_card) {
2032 p_hi14a_card->sak = sak;
2033 p_hi14a_card->ats_len = 0;
2034 }
2035
2036 // non iso14443a compliant tag
2037 if( (sak & 0x20) == 0) return 2;
2038
2039 // Request for answer to select
2040 AppendCrc14443a(rats, 2);
2041 ReaderTransmit(rats, sizeof(rats), NULL);
2042
2043 if (!(len = ReaderReceive(resp, resp_par))) return 0;
2044
2045
2046 if(p_hi14a_card) {
2047 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
2048 p_hi14a_card->ats_len = len;
2049 }
2050
2051 // reset the PCB block number
2052 iso14_pcb_blocknum = 0;
2053
2054 // set default timeout based on ATS
2055 iso14a_set_ATS_timeout(resp);
2056
2057 return 1;
2058}
2059
2060void iso14443a_setup(uint8_t fpga_minor_mode) {
2061 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
2062 // Set up the synchronous serial port
2063 FpgaSetupSsc();
2064 // connect Demodulated Signal to ADC:
2065 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
2066
2067 // Signal field is on with the appropriate LED
2068 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
2069 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
2070 LED_D_ON();
2071 } else {
2072 LED_D_OFF();
2073 }
2074 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
2075
2076 // Start the timer
2077 StartCountSspClk();
2078
2079 DemodReset();
2080 UartReset();
2081 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
2082 iso14a_set_timeout(10*106); // 10ms default
2083}
2084
2085int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
2086 uint8_t parity[MAX_PARITY_SIZE];
2087 uint8_t real_cmd[cmd_len+4];
2088 real_cmd[0] = 0x0a; //I-Block
2089 // put block number into the PCB
2090 real_cmd[0] |= iso14_pcb_blocknum;
2091 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
2092 memcpy(real_cmd+2, cmd, cmd_len);
2093 AppendCrc14443a(real_cmd,cmd_len+2);
2094
2095 ReaderTransmit(real_cmd, cmd_len+4, NULL);
2096 size_t len = ReaderReceive(data, parity);
2097 uint8_t *data_bytes = (uint8_t *) data;
2098 if (!len)
2099 return 0; //DATA LINK ERROR
2100 // if we received an I- or R(ACK)-Block with a block number equal to the
2101 // current block number, toggle the current block number
2102 else if (len >= 4 // PCB+CID+CRC = 4 bytes
2103 && ((data_bytes[0] & 0xC0) == 0 // I-Block
2104 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
2105 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
2106 {
2107 iso14_pcb_blocknum ^= 1;
2108 }
2109
2110 return len;
2111}
2112
2113//-----------------------------------------------------------------------------
2114// Read an ISO 14443a tag. Send out commands and store answers.
2115//
2116//-----------------------------------------------------------------------------
2117void ReaderIso14443a(UsbCommand *c)
2118{
2119 iso14a_command_t param = c->arg[0];
2120 uint8_t *cmd = c->d.asBytes;
2121 size_t len = c->arg[1] & 0xffff;
2122 size_t lenbits = c->arg[1] >> 16;
2123 uint32_t timeout = c->arg[2];
2124 uint32_t arg0 = 0;
2125 byte_t buf[USB_CMD_DATA_SIZE];
2126 uint8_t par[MAX_PARITY_SIZE];
2127
2128 if(param & ISO14A_CONNECT) {
2129 clear_trace();
2130 }
2131
2132 set_tracing(TRUE);
2133
2134 if(param & ISO14A_REQUEST_TRIGGER) {
2135 iso14a_set_trigger(TRUE);
2136 }
2137
2138 if(param & ISO14A_CONNECT) {
2139 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
2140 if(!(param & ISO14A_NO_SELECT)) {
2141 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
2142 arg0 = iso14443a_select_card(NULL,card,NULL, true, 0);
2143 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
2144 }
2145 }
2146
2147 if(param & ISO14A_SET_TIMEOUT) {
2148 iso14a_set_timeout(timeout);
2149 }
2150
2151 if(param & ISO14A_APDU) {
2152 arg0 = iso14_apdu(cmd, len, buf);
2153 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
2154 }
2155
2156 if(param & ISO14A_RAW) {
2157 if(param & ISO14A_APPEND_CRC) {
2158 if(param & ISO14A_TOPAZMODE) {
2159 AppendCrc14443b(cmd,len);
2160 } else {
2161 AppendCrc14443a(cmd,len);
2162 }
2163 len += 2;
2164 if (lenbits) lenbits += 16;
2165 }
2166 if(lenbits>0) { // want to send a specific number of bits (e.g. short commands)
2167 if(param & ISO14A_TOPAZMODE) {
2168 int bits_to_send = lenbits;
2169 uint16_t i = 0;
2170 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 7), NULL, NULL); // first byte is always short (7bits) and no parity
2171 bits_to_send -= 7;
2172 while (bits_to_send > 0) {
2173 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 8), NULL, NULL); // following bytes are 8 bit and no parity
2174 bits_to_send -= 8;
2175 }
2176 } else {
2177 GetParity(cmd, lenbits/8, par);
2178 ReaderTransmitBitsPar(cmd, lenbits, par, NULL); // bytes are 8 bit with odd parity
2179 }
2180 } else { // want to send complete bytes only
2181 if(param & ISO14A_TOPAZMODE) {
2182 uint16_t i = 0;
2183 ReaderTransmitBitsPar(&cmd[i++], 7, NULL, NULL); // first byte: 7 bits, no paritiy
2184 while (i < len) {
2185 ReaderTransmitBitsPar(&cmd[i++], 8, NULL, NULL); // following bytes: 8 bits, no paritiy
2186 }
2187 } else {
2188 ReaderTransmit(cmd,len, NULL); // 8 bits, odd parity
2189 }
2190 }
2191 arg0 = ReaderReceive(buf, par);
2192 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
2193 }
2194
2195 if(param & ISO14A_REQUEST_TRIGGER) {
2196 iso14a_set_trigger(FALSE);
2197 }
2198
2199 if(param & ISO14A_NO_DISCONNECT) {
2200 return;
2201 }
2202
2203 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2204 set_tracing(FALSE);
2205 LEDsoff();
2206}
2207
2208
2209// Determine the distance between two nonces.
2210// Assume that the difference is small, but we don't know which is first.
2211// Therefore try in alternating directions.
2212int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
2213
2214 uint16_t i;
2215 uint32_t nttmp1, nttmp2;
2216
2217 if (nt1 == nt2) return 0;
2218
2219 nttmp1 = nt1;
2220 nttmp2 = nt2;
2221
2222 for (i = 1; i < 0xFFFF; i++) {
2223 nttmp1 = prng_successor(nttmp1, 1);
2224 if (nttmp1 == nt2) return i;
2225 nttmp2 = prng_successor(nttmp2, 1);
2226 if (nttmp2 == nt1) return -i;
2227 }
2228
2229 return(-99999); // either nt1 or nt2 are invalid nonces
2230}
2231
2232
2233//-----------------------------------------------------------------------------
2234// Recover several bits of the cypher stream. This implements (first stages of)
2235// the algorithm described in "The Dark Side of Security by Obscurity and
2236// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2237// (article by Nicolas T. Courtois, 2009)
2238//-----------------------------------------------------------------------------
2239void ReaderMifare(bool first_try)
2240{
2241 // Mifare AUTH
2242 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
2243 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
2244 static uint8_t mf_nr_ar3;
2245
2246 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
2247 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
2248
2249 if (first_try) {
2250 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2251 }
2252
2253 // free eventually allocated BigBuf memory. We want all for tracing.
2254 BigBuf_free();
2255
2256 clear_trace();
2257 set_tracing(TRUE);
2258
2259 byte_t nt_diff = 0;
2260 uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
2261 static byte_t par_low = 0;
2262 bool led_on = TRUE;
2263 uint8_t uid[10] ={0};
2264 uint32_t cuid;
2265
2266 uint32_t nt = 0;
2267 uint32_t previous_nt = 0;
2268 static uint32_t nt_attacked = 0;
2269 byte_t par_list[8] = {0x00};
2270 byte_t ks_list[8] = {0x00};
2271
2272 #define PRNG_SEQUENCE_LENGTH (1 << 16);
2273 static uint32_t sync_time = 0;
2274 static int32_t sync_cycles = 0;
2275 int catch_up_cycles = 0;
2276 int last_catch_up = 0;
2277 uint16_t elapsed_prng_sequences;
2278 uint16_t consecutive_resyncs = 0;
2279 int isOK = 0;
2280
2281 if (first_try) {
2282 mf_nr_ar3 = 0;
2283 sync_time = GetCountSspClk() & 0xfffffff8;
2284 sync_cycles = PRNG_SEQUENCE_LENGTH; //65536; //0x10000 // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
2285 nt_attacked = 0;
2286 par[0] = 0;
2287 }
2288 else {
2289 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
2290 mf_nr_ar3++;
2291 mf_nr_ar[3] = mf_nr_ar3;
2292 par[0] = par_low;
2293 }
2294
2295 LED_A_ON();
2296 LED_B_OFF();
2297 LED_C_OFF();
2298
2299
2300 #define MAX_UNEXPECTED_RANDOM 4 // maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
2301 #define MAX_SYNC_TRIES 32
2302 #define NUM_DEBUG_INFOS 8 // per strategy
2303 #define MAX_STRATEGY 3
2304 uint16_t unexpected_random = 0;
2305 uint16_t sync_tries = 0;
2306 int16_t debug_info_nr = -1;
2307 uint16_t strategy = 0;
2308 int32_t debug_info[MAX_STRATEGY][NUM_DEBUG_INFOS];
2309 uint32_t select_time;
2310 uint32_t halt_time;
2311
2312 for(uint16_t i = 0; TRUE; i++) {
2313
2314 LED_C_ON();
2315 WDT_HIT();
2316
2317 // Test if the action was cancelled
2318 if(BUTTON_PRESS()) {
2319 isOK = -1;
2320 break;
2321 }
2322
2323 if (strategy == 2) {
2324 // test with additional hlt command
2325 halt_time = 0;
2326 int len = mifare_sendcmd_short(NULL, false, 0x50, 0x00, receivedAnswer, receivedAnswerPar, &halt_time);
2327 if (len && MF_DBGLEVEL >= 3) {
2328 Dbprintf("Unexpected response of %d bytes to hlt command (additional debugging).", len);
2329 }
2330 }
2331
2332 if (strategy == 3) {
2333 // test with FPGA power off/on
2334 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2335 SpinDelay(200);
2336 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2337 SpinDelay(100);
2338 }
2339
2340 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
2341 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
2342 continue;
2343 }
2344 select_time = GetCountSspClk();
2345
2346 elapsed_prng_sequences = 1;
2347 if (debug_info_nr == -1) {
2348 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
2349 catch_up_cycles = 0;
2350
2351 // if we missed the sync time already, advance to the next nonce repeat
2352 while(GetCountSspClk() > sync_time) {
2353 elapsed_prng_sequences++;
2354 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
2355 }
2356
2357 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2358 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2359 } else {
2360 // collect some information on tag nonces for debugging:
2361 #define DEBUG_FIXED_SYNC_CYCLES PRNG_SEQUENCE_LENGTH
2362 if (strategy == 0) {
2363 // nonce distances at fixed time after card select:
2364 sync_time = select_time + DEBUG_FIXED_SYNC_CYCLES;
2365 } else if (strategy == 1) {
2366 // nonce distances at fixed time between authentications:
2367 sync_time = sync_time + DEBUG_FIXED_SYNC_CYCLES;
2368 } else if (strategy == 2) {
2369 // nonce distances at fixed time after halt:
2370 sync_time = halt_time + DEBUG_FIXED_SYNC_CYCLES;
2371 } else {
2372 // nonce_distances at fixed time after power on
2373 sync_time = DEBUG_FIXED_SYNC_CYCLES;
2374 }
2375 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2376 }
2377
2378 // Receive the (4 Byte) "random" nonce
2379 if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
2380 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2381 continue;
2382 }
2383
2384 previous_nt = nt;
2385 nt = bytes_to_num(receivedAnswer, 4);
2386
2387 // Transmit reader nonce with fake par
2388 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
2389
2390 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2391 int nt_distance = dist_nt(previous_nt, nt);
2392 if (nt_distance == 0) {
2393 nt_attacked = nt;
2394 } else {
2395 if (nt_distance == -99999) { // invalid nonce received
2396 unexpected_random++;
2397 if (unexpected_random > MAX_UNEXPECTED_RANDOM) {
2398 isOK = -3; // Card has an unpredictable PRNG. Give up
2399 break;
2400 } else {
2401 continue; // continue trying...
2402 }
2403 }
2404 if (++sync_tries > MAX_SYNC_TRIES) {
2405 if (strategy > MAX_STRATEGY || MF_DBGLEVEL < 3) {
2406 isOK = -4; // Card's PRNG runs at an unexpected frequency or resets unexpectedly
2407 break;
2408 } else { // continue for a while, just to collect some debug info
2409 debug_info[strategy][debug_info_nr] = nt_distance;
2410 debug_info_nr++;
2411 if (debug_info_nr == NUM_DEBUG_INFOS) {
2412 strategy++;
2413 debug_info_nr = 0;
2414 }
2415 continue;
2416 }
2417 }
2418 sync_cycles = (sync_cycles - nt_distance/elapsed_prng_sequences);
2419 if (sync_cycles <= 0) {
2420 sync_cycles += PRNG_SEQUENCE_LENGTH;
2421 }
2422 if (MF_DBGLEVEL >= 3) {
2423 Dbprintf("calibrating in cycle %d. nt_distance=%d, elapsed_prng_sequences=%d, new sync_cycles: %d\n", i, nt_distance, elapsed_prng_sequences, sync_cycles);
2424 }
2425 continue;
2426 }
2427 }
2428
2429 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2430 catch_up_cycles = -dist_nt(nt_attacked, nt);
2431 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2432 catch_up_cycles = 0;
2433 continue;
2434 }
2435 catch_up_cycles /= elapsed_prng_sequences;
2436 if (catch_up_cycles == last_catch_up) {
2437 consecutive_resyncs++;
2438 }
2439 else {
2440 last_catch_up = catch_up_cycles;
2441 consecutive_resyncs = 0;
2442 }
2443 if (consecutive_resyncs < 3) {
2444 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
2445 }
2446 else {
2447 sync_cycles = sync_cycles + catch_up_cycles;
2448 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
2449 last_catch_up = 0;
2450 catch_up_cycles = 0;
2451 consecutive_resyncs = 0;
2452 }
2453 continue;
2454 }
2455
2456 consecutive_resyncs = 0;
2457
2458 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2459 if (ReaderReceive(receivedAnswer, receivedAnswerPar)) {
2460 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2461
2462 if (nt_diff == 0) {
2463 par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2464 }
2465
2466 led_on = !led_on;
2467 if(led_on) LED_B_ON(); else LED_B_OFF();
2468
2469 par_list[nt_diff] = SwapBits(par[0], 8);
2470 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2471
2472 // Test if the information is complete
2473 if (nt_diff == 0x07) {
2474 isOK = 1;
2475 break;
2476 }
2477
2478 nt_diff = (nt_diff + 1) & 0x07;
2479 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2480 par[0] = par_low;
2481 } else {
2482 if (nt_diff == 0 && first_try)
2483 {
2484 par[0]++;
2485 if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
2486 isOK = -2;
2487 break;
2488 }
2489 } else {
2490 par[0] = ((par[0] & 0x1F) + 1) | par_low;
2491 }
2492 }
2493 }
2494
2495
2496 mf_nr_ar[3] &= 0x1F;
2497
2498 if (isOK == -4) {
2499 if (MF_DBGLEVEL >= 3) {
2500 for (uint16_t i = 0; i <= MAX_STRATEGY; i++) {
2501 for(uint16_t j = 0; j < NUM_DEBUG_INFOS; j++) {
2502 Dbprintf("collected debug info[%d][%d] = %d", i, j, debug_info[i][j]);
2503 }
2504 }
2505 }
2506 }
2507
2508 byte_t buf[28];
2509 memcpy(buf + 0, uid, 4);
2510 num_to_bytes(nt, 4, buf + 4);
2511 memcpy(buf + 8, par_list, 8);
2512 memcpy(buf + 16, ks_list, 8);
2513 memcpy(buf + 24, mf_nr_ar, 4);
2514
2515 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2516
2517 // Thats it...
2518 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2519 LEDsoff();
2520
2521 set_tracing(FALSE);
2522}
2523
2524/**
2525 *MIFARE 1K simulate.
2526 *
2527 *@param flags :
2528 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2529 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2530 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2531 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2532 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2533 */
2534void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
2535{
2536 int cardSTATE = MFEMUL_NOFIELD;
2537 int _7BUID = 0;
2538 int vHf = 0; // in mV
2539 int res;
2540 uint32_t selTimer = 0;
2541 uint32_t authTimer = 0;
2542 uint16_t len = 0;
2543 uint8_t cardWRBL = 0;
2544 uint8_t cardAUTHSC = 0;
2545 uint8_t cardAUTHKEY = 0xff; // no authentication
2546// uint32_t cardRr = 0;
2547 uint32_t cuid = 0;
2548 //uint32_t rn_enc = 0;
2549 uint32_t ans = 0;
2550 uint32_t cardINTREG = 0;
2551 uint8_t cardINTBLOCK = 0;
2552 struct Crypto1State mpcs = {0, 0};
2553 struct Crypto1State *pcs;
2554 pcs = &mpcs;
2555 uint32_t numReads = 0;//Counts numer of times reader read a block
2556 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2557 uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE];
2558 uint8_t response[MAX_MIFARE_FRAME_SIZE];
2559 uint8_t response_par[MAX_MIFARE_PARITY_SIZE];
2560
2561 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2562 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2563 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2564 uint8_t rSAK[] = {0x08, 0xb6, 0xdd}; // Mifare Classic
2565 //uint8_t rSAK[] = {0x09, 0x3f, 0xcc }; // Mifare Mini
2566 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
2567
2568 uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
2569 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
2570
2571 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2572 // This can be used in a reader-only attack.
2573 // (it can also be retrieved via 'hf 14a list', but hey...
2574 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
2575 uint8_t ar_nr_collected = 0;
2576
2577 // Authenticate response - nonce
2578 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
2579
2580 //-- Determine the UID
2581 // Can be set from emulator memory, incoming data
2582 // and can be 7 or 4 bytes long
2583 if (flags & FLAG_4B_UID_IN_DATA)
2584 {
2585 // 4B uid comes from data-portion of packet
2586 memcpy(rUIDBCC1,datain,4);
2587 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2588
2589 } else if (flags & FLAG_7B_UID_IN_DATA) {
2590 // 7B uid comes from data-portion of packet
2591 memcpy(&rUIDBCC1[1],datain,3);
2592 memcpy(rUIDBCC2, datain+3, 4);
2593 _7BUID = true;
2594 } else {
2595 // get UID from emul memory
2596 emlGetMemBt(receivedCmd, 7, 1);
2597 _7BUID = !(receivedCmd[0] == 0x00);
2598 if (!_7BUID) { // ---------- 4BUID
2599 emlGetMemBt(rUIDBCC1, 0, 4);
2600 } else { // ---------- 7BUID
2601 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2602 emlGetMemBt(rUIDBCC2, 3, 4);
2603 }
2604 }
2605
2606 // save uid.
2607 ar_nr_responses[0*5] = bytes_to_num(rUIDBCC1+1, 3);
2608 if ( _7BUID )
2609 ar_nr_responses[0*5+1] = bytes_to_num(rUIDBCC2, 4);
2610
2611 /*
2612 * Regardless of what method was used to set the UID, set fifth byte and modify
2613 * the ATQA for 4 or 7-byte UID
2614 */
2615 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2616 if (_7BUID) {
2617 rATQA[0] = 0x44;
2618 rUIDBCC1[0] = 0x88;
2619 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2620 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2621 }
2622
2623 if (MF_DBGLEVEL >= 1) {
2624 if (!_7BUID) {
2625 Dbprintf("4B UID: %02x%02x%02x%02x",
2626 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
2627 } else {
2628 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2629 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
2630 rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
2631 }
2632 }
2633
2634 // We need to listen to the high-frequency, peak-detected path.
2635 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
2636
2637 // free eventually allocated BigBuf memory but keep Emulator Memory
2638 BigBuf_free_keep_EM();
2639
2640 // clear trace
2641 clear_trace();
2642 set_tracing(TRUE);
2643
2644
2645 bool finished = FALSE;
2646 while (!BUTTON_PRESS() && !finished) {
2647 WDT_HIT();
2648
2649 // find reader field
2650 if (cardSTATE == MFEMUL_NOFIELD) {
2651 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
2652 if (vHf > MF_MINFIELDV) {
2653 cardSTATE_TO_IDLE();
2654 LED_A_ON();
2655 }
2656 }
2657 if(cardSTATE == MFEMUL_NOFIELD) continue;
2658
2659 //Now, get data
2660 res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
2661 if (res == 2) { //Field is off!
2662 cardSTATE = MFEMUL_NOFIELD;
2663 LEDsoff();
2664 continue;
2665 } else if (res == 1) {
2666 break; //return value 1 means button press
2667 }
2668
2669 // REQ or WUP request in ANY state and WUP in HALTED state
2670 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2671 selTimer = GetTickCount();
2672 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2673 cardSTATE = MFEMUL_SELECT1;
2674
2675 // init crypto block
2676 LED_B_OFF();
2677 LED_C_OFF();
2678 crypto1_destroy(pcs);
2679 cardAUTHKEY = 0xff;
2680 continue;
2681 }
2682
2683 switch (cardSTATE) {
2684 case MFEMUL_NOFIELD:
2685 case MFEMUL_HALTED:
2686 case MFEMUL_IDLE:{
2687 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2688 break;
2689 }
2690 case MFEMUL_SELECT1:{
2691 // select all
2692 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
2693 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
2694 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
2695 break;
2696 }
2697
2698 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2699 {
2700 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2701 }
2702 // select card
2703 if (len == 9 &&
2704 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
2705 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
2706 cuid = bytes_to_num(rUIDBCC1, 4);
2707 if (!_7BUID) {
2708 cardSTATE = MFEMUL_WORK;
2709 LED_B_ON();
2710 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2711 break;
2712 } else {
2713 cardSTATE = MFEMUL_SELECT2;
2714 }
2715 }
2716 break;
2717 }
2718 case MFEMUL_AUTH1:{
2719 if( len != 8)
2720 {
2721 cardSTATE_TO_IDLE();
2722 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2723 break;
2724 }
2725
2726 uint32_t ar = bytes_to_num(receivedCmd, 4);
2727 uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
2728
2729 //Collect AR/NR
2730 //if(ar_nr_collected < 2 && cardAUTHSC == 2){
2731 if(ar_nr_collected < 2){
2732 if(ar_nr_responses[2] != ar)
2733 {// Avoid duplicates... probably not necessary, ar should vary.
2734 //ar_nr_responses[ar_nr_collected*5] = 0;
2735 //ar_nr_responses[ar_nr_collected*5+1] = 0;
2736 ar_nr_responses[ar_nr_collected*5+2] = nonce;
2737 ar_nr_responses[ar_nr_collected*5+3] = nr;
2738 ar_nr_responses[ar_nr_collected*5+4] = ar;
2739 ar_nr_collected++;
2740 }
2741 // Interactive mode flag, means we need to send ACK
2742 if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
2743 {
2744 finished = true;
2745 }
2746 }
2747
2748 // --- crypto
2749 //crypto1_word(pcs, ar , 1);
2750 //cardRr = nr ^ crypto1_word(pcs, 0, 0);
2751
2752 //test if auth OK
2753 //if (cardRr != prng_successor(nonce, 64)){
2754
2755 //if (MF_DBGLEVEL >= 4) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2756 // cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2757 // cardRr, prng_successor(nonce, 64));
2758 // Shouldn't we respond anything here?
2759 // Right now, we don't nack or anything, which causes the
2760 // reader to do a WUPA after a while. /Martin
2761 // -- which is the correct response. /piwi
2762 //cardSTATE_TO_IDLE();
2763 //LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2764 //break;
2765 //}
2766
2767 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2768
2769 num_to_bytes(ans, 4, rAUTH_AT);
2770 // --- crypto
2771 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2772 LED_C_ON();
2773 cardSTATE = MFEMUL_WORK;
2774 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2775 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2776 GetTickCount() - authTimer);
2777 break;
2778 }
2779 case MFEMUL_SELECT2:{
2780 if (!len) {
2781 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2782 break;
2783 }
2784 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
2785 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
2786 break;
2787 }
2788
2789 // select 2 card
2790 if (len == 9 &&
2791 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2792 EmSendCmd(rSAK, sizeof(rSAK));
2793 cuid = bytes_to_num(rUIDBCC2, 4);
2794 cardSTATE = MFEMUL_WORK;
2795 LED_B_ON();
2796 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
2797 break;
2798 }
2799
2800 // i guess there is a command). go into the work state.
2801 if (len != 4) {
2802 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2803 break;
2804 }
2805 cardSTATE = MFEMUL_WORK;
2806 //goto lbWORK;
2807 //intentional fall-through to the next case-stmt
2808 }
2809
2810 case MFEMUL_WORK:{
2811 if (len == 0) {
2812 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2813 break;
2814 }
2815
2816 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2817
2818 if(encrypted_data) {
2819 // decrypt seqence
2820 mf_crypto1_decrypt(pcs, receivedCmd, len);
2821 }
2822
2823 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2824 authTimer = GetTickCount();
2825 cardAUTHSC = receivedCmd[1] / 4; // received block num
2826 cardAUTHKEY = receivedCmd[0] - 0x60;
2827 crypto1_destroy(pcs);//Added by martin
2828 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
2829
2830 if (!encrypted_data) { // first authentication
2831 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2832
2833 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2834 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
2835 } else { // nested authentication
2836 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2837 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
2838 num_to_bytes(ans, 4, rAUTH_AT);
2839 }
2840
2841 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2842 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2843 cardSTATE = MFEMUL_AUTH1;
2844 break;
2845 }
2846
2847 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2848 // BUT... ACK --> NACK
2849 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2850 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2851 break;
2852 }
2853
2854 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2855 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2856 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2857 break;
2858 }
2859
2860 if(len != 4) {
2861 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2862 break;
2863 }
2864
2865 if(receivedCmd[0] == 0x30 // read block
2866 || receivedCmd[0] == 0xA0 // write block
2867 || receivedCmd[0] == 0xC0 // inc
2868 || receivedCmd[0] == 0xC1 // dec
2869 || receivedCmd[0] == 0xC2 // restore
2870 || receivedCmd[0] == 0xB0) { // transfer
2871 if (receivedCmd[1] >= 16 * 4) {
2872 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2873 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2874 break;
2875 }
2876
2877 if (receivedCmd[1] / 4 != cardAUTHSC) {
2878 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2879 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
2880 break;
2881 }
2882 }
2883 // read block
2884 if (receivedCmd[0] == 0x30) {
2885 if (MF_DBGLEVEL >= 4) {
2886 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2887 }
2888 emlGetMem(response, receivedCmd[1], 1);
2889 AppendCrc14443a(response, 16);
2890 mf_crypto1_encrypt(pcs, response, 18, response_par);
2891 EmSendCmdPar(response, 18, response_par);
2892 numReads++;
2893 if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
2894 Dbprintf("%d reads done, exiting", numReads);
2895 finished = true;
2896 }
2897 break;
2898 }
2899 // write block
2900 if (receivedCmd[0] == 0xA0) {
2901 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
2902 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2903 cardSTATE = MFEMUL_WRITEBL2;
2904 cardWRBL = receivedCmd[1];
2905 break;
2906 }
2907 // increment, decrement, restore
2908 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
2909 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2910 if (emlCheckValBl(receivedCmd[1])) {
2911 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
2912 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2913 break;
2914 }
2915 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2916 if (receivedCmd[0] == 0xC1)
2917 cardSTATE = MFEMUL_INTREG_INC;
2918 if (receivedCmd[0] == 0xC0)
2919 cardSTATE = MFEMUL_INTREG_DEC;
2920 if (receivedCmd[0] == 0xC2)
2921 cardSTATE = MFEMUL_INTREG_REST;
2922 cardWRBL = receivedCmd[1];
2923 break;
2924 }
2925 // transfer
2926 if (receivedCmd[0] == 0xB0) {
2927 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2928 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2929 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2930 else
2931 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2932 break;
2933 }
2934 // halt
2935 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
2936 LED_B_OFF();
2937 LED_C_OFF();
2938 cardSTATE = MFEMUL_HALTED;
2939 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
2940 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2941 break;
2942 }
2943 // RATS
2944 if (receivedCmd[0] == 0xe0) {//RATS
2945 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2946 break;
2947 }
2948 // command not allowed
2949 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2950 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2951 break;
2952 }
2953 case MFEMUL_WRITEBL2:{
2954 if (len == 18){
2955 mf_crypto1_decrypt(pcs, receivedCmd, len);
2956 emlSetMem(receivedCmd, cardWRBL, 1);
2957 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2958 cardSTATE = MFEMUL_WORK;
2959 } else {
2960 cardSTATE_TO_IDLE();
2961 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2962 }
2963 break;
2964 }
2965
2966 case MFEMUL_INTREG_INC:{
2967 mf_crypto1_decrypt(pcs, receivedCmd, len);
2968 memcpy(&ans, receivedCmd, 4);
2969 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2970 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2971 cardSTATE_TO_IDLE();
2972 break;
2973 }
2974 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2975 cardINTREG = cardINTREG + ans;
2976 cardSTATE = MFEMUL_WORK;
2977 break;
2978 }
2979 case MFEMUL_INTREG_DEC:{
2980 mf_crypto1_decrypt(pcs, receivedCmd, len);
2981 memcpy(&ans, receivedCmd, 4);
2982 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2983 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2984 cardSTATE_TO_IDLE();
2985 break;
2986 }
2987 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2988 cardINTREG = cardINTREG - ans;
2989 cardSTATE = MFEMUL_WORK;
2990 break;
2991 }
2992 case MFEMUL_INTREG_REST:{
2993 mf_crypto1_decrypt(pcs, receivedCmd, len);
2994 memcpy(&ans, receivedCmd, 4);
2995 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2996 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2997 cardSTATE_TO_IDLE();
2998 break;
2999 }
3000 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
3001 cardSTATE = MFEMUL_WORK;
3002 break;
3003 }
3004 }
3005 }
3006
3007 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
3008 LEDsoff();
3009
3010 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
3011 {
3012 //May just aswell send the collected ar_nr in the response aswell
3013 uint8_t len = ar_nr_collected*5*4;
3014 cmd_send(CMD_ACK, CMD_SIMULATE_MIFARE_CARD, len, 0, &ar_nr_responses, len);
3015 }
3016
3017 if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
3018 {
3019 if(ar_nr_collected > 1 ) {
3020 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
3021 Dbprintf("../tools/mfkey/mfkey32 %06x%08x %08x %08x %08x %08x %08x",
3022 ar_nr_responses[0], // UID1
3023 ar_nr_responses[1], // UID2
3024 ar_nr_responses[2], // NT
3025 ar_nr_responses[3], // AR1
3026 ar_nr_responses[4], // NR1
3027 ar_nr_responses[8], // AR2
3028 ar_nr_responses[9] // NR2
3029 );
3030 Dbprintf("../tools/mfkey/mfkey32v2 %06x%08x %08x %08x %08x %08x %08x %08x",
3031 ar_nr_responses[0], // UID1
3032 ar_nr_responses[1], // UID2
3033 ar_nr_responses[2], // NT1
3034 ar_nr_responses[3], // AR1
3035 ar_nr_responses[4], // NR1
3036 ar_nr_responses[7], // NT2
3037 ar_nr_responses[8], // AR2
3038 ar_nr_responses[9] // NR2
3039 );
3040 } else {
3041 Dbprintf("Failed to obtain two AR/NR pairs!");
3042 if(ar_nr_collected > 0 ) {
3043 Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
3044 ar_nr_responses[0], // UID1
3045 ar_nr_responses[1], // UID2
3046 ar_nr_responses[2], // NT
3047 ar_nr_responses[3], // AR1
3048 ar_nr_responses[4] // NR1
3049 );
3050 }
3051 }
3052 }
3053 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen());
3054
3055 set_tracing(FALSE);
3056}
3057
3058
3059//-----------------------------------------------------------------------------
3060// MIFARE sniffer.
3061//
3062//-----------------------------------------------------------------------------
3063void RAMFUNC SniffMifare(uint8_t param) {
3064 // param:
3065 // bit 0 - trigger from first card answer
3066 // bit 1 - trigger from first reader 7-bit request
3067
3068 // C(red) A(yellow) B(green)
3069 LEDsoff();
3070 // init trace buffer
3071 clear_trace();
3072 set_tracing(TRUE);
3073
3074 // The command (reader -> tag) that we're receiving.
3075 // The length of a received command will in most cases be no more than 18 bytes.
3076 // So 32 should be enough!
3077 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
3078 uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
3079 // The response (tag -> reader) that we're receiving.
3080 uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
3081 uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
3082
3083 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
3084
3085 // free eventually allocated BigBuf memory
3086 BigBuf_free();
3087 // allocate the DMA buffer, used to stream samples from the FPGA
3088 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
3089 uint8_t *data = dmaBuf;
3090 uint8_t previous_data = 0;
3091 int maxDataLen = 0;
3092 int dataLen = 0;
3093 bool ReaderIsActive = FALSE;
3094 bool TagIsActive = FALSE;
3095
3096 // Set up the demodulator for tag -> reader responses.
3097 DemodInit(receivedResponse, receivedResponsePar);
3098
3099 // Set up the demodulator for the reader -> tag commands
3100 UartInit(receivedCmd, receivedCmdPar);
3101
3102 // Setup for the DMA.
3103 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
3104
3105 LED_D_OFF();
3106
3107 // init sniffer
3108 MfSniffInit();
3109
3110 // And now we loop, receiving samples.
3111 for(uint32_t sniffCounter = 0; TRUE; ) {
3112
3113 if(BUTTON_PRESS()) {
3114 DbpString("cancelled by button");
3115 break;
3116 }
3117
3118 LED_A_ON();
3119 WDT_HIT();
3120
3121 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
3122 // check if a transaction is completed (timeout after 2000ms).
3123 // if yes, stop the DMA transfer and send what we have so far to the client
3124 if (MfSniffSend(2000)) {
3125 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
3126 sniffCounter = 0;
3127 data = dmaBuf;
3128 maxDataLen = 0;
3129 ReaderIsActive = FALSE;
3130 TagIsActive = FALSE;
3131 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
3132 }
3133 }
3134
3135 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
3136 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
3137 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
3138 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
3139 } else {
3140 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
3141 }
3142 // test for length of buffer
3143 if(dataLen > maxDataLen) { // we are more behind than ever...
3144 maxDataLen = dataLen;
3145 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
3146 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
3147 break;
3148 }
3149 }
3150 if(dataLen < 1) continue;
3151
3152 // primary buffer was stopped ( <-- we lost data!
3153 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
3154 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
3155 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
3156 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
3157 }
3158 // secondary buffer sets as primary, secondary buffer was stopped
3159 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
3160 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
3161 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
3162 }
3163
3164 LED_A_OFF();
3165
3166 if (sniffCounter & 0x01) {
3167
3168 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
3169 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
3170 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
3171 LED_C_INV();
3172 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
3173
3174 /* And ready to receive another command. */
3175 UartReset();
3176
3177 /* And also reset the demod code */
3178 DemodReset();
3179 }
3180 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
3181 }
3182
3183 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
3184 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
3185 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
3186 LED_C_INV();
3187
3188 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, FALSE)) break;
3189
3190 // And ready to receive another response.
3191 DemodReset();
3192
3193 // And reset the Miller decoder including its (now outdated) input buffer
3194 UartInit(receivedCmd, receivedCmdPar);
3195 // why not UartReset?
3196 }
3197 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
3198 }
3199 }
3200
3201 previous_data = *data;
3202 sniffCounter++;
3203 data++;
3204 if(data == dmaBuf + DMA_BUFFER_SIZE) {
3205 data = dmaBuf;
3206 }
3207
3208 } // main cycle
3209
3210 FpgaDisableSscDma();
3211 MfSniffEnd();
3212 LEDsoff();
3213 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
3214 set_tracing(FALSE);
3215}
Impressum, Datenschutz