]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // Jonathan Westhues, split Nov 2006 | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // Routines to support ISO 14443B. This includes both the reader software and | |
9 | // the `fake tag' modes. | |
10 | //----------------------------------------------------------------------------- | |
11 | #include "iso14443b.h" | |
12 | ||
13 | #define RECEIVE_SAMPLES_TIMEOUT 50000 | |
14 | #define ISO14443B_DMA_BUFFER_SIZE 256 | |
15 | ||
16 | // Guard Time (per 14443-2) | |
17 | #define TR0 0 | |
18 | // Synchronization time (per 14443-2) | |
19 | #define TR1 0 | |
20 | // Frame Delay Time PICC to PCD (per 14443-3 Amendment 1) | |
21 | #define TR2 0 | |
22 | static void switch_off(void); | |
23 | ||
24 | // the block number for the ISO14443-4 PCB (used with APDUs) | |
25 | static uint8_t pcb_blocknum = 0; | |
26 | ||
27 | static uint32_t iso14b_timeout = RECEIVE_SAMPLES_TIMEOUT; | |
28 | // param timeout is in ftw_ | |
29 | void iso14b_set_timeout(uint32_t timeout) { | |
30 | // 9.4395us = 1etu. | |
31 | // clock is about 1.5 us | |
32 | iso14b_timeout = timeout; | |
33 | if(MF_DBGLEVEL >= 2) Dbprintf("ISO14443B Timeout set to %ld fwt", iso14b_timeout); | |
34 | } | |
35 | ||
36 | static void switch_off(void){ | |
37 | if (MF_DBGLEVEL > 3) Dbprintf("switch_off"); | |
38 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
39 | SpinDelay(100); | |
40 | FpgaDisableSscDma(); | |
41 | set_tracing(FALSE); | |
42 | LEDsoff(); | |
43 | } | |
44 | ||
45 | //============================================================================= | |
46 | // An ISO 14443 Type B tag. We listen for commands from the reader, using | |
47 | // a UART kind of thing that's implemented in software. When we get a | |
48 | // frame (i.e., a group of bytes between SOF and EOF), we check the CRC. | |
49 | // If it's good, then we can do something appropriate with it, and send | |
50 | // a response. | |
51 | //============================================================================= | |
52 | ||
53 | ||
54 | //----------------------------------------------------------------------------- | |
55 | // The software UART that receives commands from the reader, and its state variables. | |
56 | //----------------------------------------------------------------------------- | |
57 | static struct { | |
58 | enum { | |
59 | STATE_UNSYNCD, | |
60 | STATE_GOT_FALLING_EDGE_OF_SOF, | |
61 | STATE_AWAITING_START_BIT, | |
62 | STATE_RECEIVING_DATA | |
63 | } state; | |
64 | uint16_t shiftReg; | |
65 | int bitCnt; | |
66 | int byteCnt; | |
67 | int byteCntMax; | |
68 | int posCnt; | |
69 | uint8_t *output; | |
70 | } Uart; | |
71 | ||
72 | static void UartReset() { | |
73 | Uart.state = STATE_UNSYNCD; | |
74 | Uart.shiftReg = 0; | |
75 | Uart.bitCnt = 0; | |
76 | Uart.byteCnt = 0; | |
77 | Uart.byteCntMax = MAX_FRAME_SIZE; | |
78 | Uart.posCnt = 0; | |
79 | } | |
80 | ||
81 | static void UartInit(uint8_t *data) { | |
82 | Uart.output = data; | |
83 | UartReset(); | |
84 | // memset(Uart.output, 0x00, MAX_FRAME_SIZE); | |
85 | } | |
86 | ||
87 | //----------------------------------------------------------------------------- | |
88 | // The software Demod that receives commands from the tag, and its state variables. | |
89 | //----------------------------------------------------------------------------- | |
90 | static struct { | |
91 | enum { | |
92 | DEMOD_UNSYNCD, | |
93 | DEMOD_PHASE_REF_TRAINING, | |
94 | DEMOD_AWAITING_FALLING_EDGE_OF_SOF, | |
95 | DEMOD_GOT_FALLING_EDGE_OF_SOF, | |
96 | DEMOD_AWAITING_START_BIT, | |
97 | DEMOD_RECEIVING_DATA | |
98 | } state; | |
99 | uint16_t bitCount; | |
100 | int posCount; | |
101 | int thisBit; | |
102 | /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented. | |
103 | int metric; | |
104 | int metricN; | |
105 | */ | |
106 | uint16_t shiftReg; | |
107 | uint8_t *output; | |
108 | uint16_t len; | |
109 | int sumI; | |
110 | int sumQ; | |
111 | uint32_t startTime, endTime; | |
112 | } Demod; | |
113 | ||
114 | // Clear out the state of the "UART" that receives from the tag. | |
115 | static void DemodReset() { | |
116 | Demod.state = DEMOD_UNSYNCD; | |
117 | Demod.bitCount = 0; | |
118 | Demod.posCount = 0; | |
119 | Demod.thisBit = 0; | |
120 | Demod.shiftReg = 0; | |
121 | Demod.len = 0; | |
122 | Demod.sumI = 0; | |
123 | Demod.sumQ = 0; | |
124 | Demod.startTime = 0; | |
125 | Demod.endTime = 0; | |
126 | } | |
127 | ||
128 | static void DemodInit(uint8_t *data) { | |
129 | Demod.output = data; | |
130 | DemodReset(); | |
131 | // memset(Demod.output, 0x00, MAX_FRAME_SIZE); | |
132 | } | |
133 | ||
134 | void AppendCrc14443b(uint8_t* data, int len) { | |
135 | ComputeCrc14443(CRC_14443_B, data, len, data+len, data+len+1); | |
136 | } | |
137 | ||
138 | //----------------------------------------------------------------------------- | |
139 | // Code up a string of octets at layer 2 (including CRC, we don't generate | |
140 | // that here) so that they can be transmitted to the reader. Doesn't transmit | |
141 | // them yet, just leaves them ready to send in ToSend[]. | |
142 | //----------------------------------------------------------------------------- | |
143 | static void CodeIso14443bAsTag(const uint8_t *cmd, int len) { | |
144 | /* ISO 14443 B | |
145 | * | |
146 | * Reader to card | ASK - Amplitude Shift Keying Modulation (PCD to PICC for Type B) (NRZ-L encodig) | |
147 | * Card to reader | BPSK - Binary Phase Shift Keying Modulation, (PICC to PCD for Type B) | |
148 | * | |
149 | * fc - carrier frequency 13.56mHz | |
150 | * TR0 - Guard Time per 14443-2 | |
151 | * TR1 - Synchronization Time per 14443-2 | |
152 | * TR2 - PICC to PCD Frame Delay Time (per 14443-3 Amendment 1) | |
153 | * | |
154 | * Elementary Time Unit (ETU) is | |
155 | * - 128 Carrier Cycles (9.4395 µS) = 8 Subcarrier Units | |
156 | * - 1 ETU = 1 bit | |
157 | * - 10 ETU = 1 startbit, 8 databits, 1 stopbit (10bits length) | |
158 | * - startbit is a 0 | |
159 | * - stopbit is a 1 | |
160 | * | |
161 | * Start of frame (SOF) is | |
162 | * - [10-11] ETU of ZEROS, unmodulated time | |
163 | * - [2-3] ETU of ONES, | |
164 | * | |
165 | * End of frame (EOF) is | |
166 | * - [10-11] ETU of ZEROS, unmodulated time | |
167 | * | |
168 | * -TO VERIFY THIS BELOW- | |
169 | * The mode FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK which we use to simulate tag | |
170 | * works like this: | |
171 | * - A 1-bit input to the FPGA becomes 8 pulses at 847.5kHz (9.44µS) | |
172 | * - A 0-bit input to the FPGA becomes an unmodulated time of 9.44µS | |
173 | * | |
174 | * | |
175 | * | |
176 | * Card sends data ub 847.e kHz subcarrier | |
177 | * 848k = 9.44µS = 128 fc | |
178 | * 424k = 18.88µS = 256 fc | |
179 | * 212k = 37.76µS = 512 fc | |
180 | * 106k = 75.52µS = 1024 fc | |
181 | * | |
182 | * Reader data transmission: | |
183 | * - no modulation ONES | |
184 | * - SOF | |
185 | * - Command, data and CRC_B | |
186 | * - EOF | |
187 | * - no modulation ONES | |
188 | * | |
189 | * Card data transmission | |
190 | * - TR1 | |
191 | * - SOF | |
192 | * - data (each bytes is: 1startbit,8bits, 1stopbit) | |
193 | * - CRC_B | |
194 | * - EOF | |
195 | * | |
196 | * FPGA implementation : | |
197 | * At this point only Type A is implemented. This means that we are using a | |
198 | * bit rate of 106 kbit/s, or fc/128. Oversample by 4, which ought to make | |
199 | * things practical for the ARM (fc/32, 423.8 kbits/s, ~50 kbytes/s) | |
200 | * | |
201 | */ | |
202 | ||
203 | // ToSendStuffBit, 40 calls | |
204 | // 1 ETU = 1startbit, 1stopbit, 8databits == 10bits. | |
205 | // 1 ETU = 10 * 4 == 40 stuffbits ( ETU_TAG_BIT ) | |
206 | int i,j; | |
207 | uint8_t b; | |
208 | ||
209 | ToSendReset(); | |
210 | ||
211 | // Transmit a burst of ones, as the initial thing that lets the | |
212 | // reader get phase sync. | |
213 | // This loop is TR1, per specification | |
214 | // TR1 minimum must be > 80/fs | |
215 | // TR1 maximum 200/fs | |
216 | // 80/fs < TR1 < 200/fs | |
217 | // 10 ETU < TR1 < 24 ETU | |
218 | ||
219 | // Send SOF. | |
220 | // 10-11 ETU * 4times samples ZEROS | |
221 | for(i = 0; i < 10; i++) { | |
222 | ToSendStuffBit(0); | |
223 | ToSendStuffBit(0); | |
224 | ToSendStuffBit(0); | |
225 | ToSendStuffBit(0); | |
226 | } | |
227 | ||
228 | // 2-3 ETU * 4times samples ONES | |
229 | for(i = 0; i < 3; i++) { | |
230 | ToSendStuffBit(1); | |
231 | ToSendStuffBit(1); | |
232 | ToSendStuffBit(1); | |
233 | ToSendStuffBit(1); | |
234 | } | |
235 | ||
236 | // data | |
237 | for(i = 0; i < len; ++i) { | |
238 | ||
239 | // Start bit | |
240 | ToSendStuffBit(0); | |
241 | ToSendStuffBit(0); | |
242 | ToSendStuffBit(0); | |
243 | ToSendStuffBit(0); | |
244 | ||
245 | // Data bits | |
246 | b = cmd[i]; | |
247 | for(j = 0; j < 8; ++j) { | |
248 | if(b & 1) { | |
249 | ToSendStuffBit(1); | |
250 | ToSendStuffBit(1); | |
251 | ToSendStuffBit(1); | |
252 | ToSendStuffBit(1); | |
253 | } else { | |
254 | ToSendStuffBit(0); | |
255 | ToSendStuffBit(0); | |
256 | ToSendStuffBit(0); | |
257 | ToSendStuffBit(0); | |
258 | } | |
259 | b >>= 1; | |
260 | } | |
261 | ||
262 | // Stop bit | |
263 | ToSendStuffBit(1); | |
264 | ToSendStuffBit(1); | |
265 | ToSendStuffBit(1); | |
266 | ToSendStuffBit(1); | |
267 | ||
268 | // Extra Guard bit | |
269 | // For PICC it ranges 0-18us (1etu = 9us) | |
270 | ToSendStuffBit(1); | |
271 | ToSendStuffBit(1); | |
272 | ToSendStuffBit(1); | |
273 | ToSendStuffBit(1); | |
274 | } | |
275 | ||
276 | // Send EOF. | |
277 | // 10-11 ETU * 4 sample rate = ZEROS | |
278 | for(i = 0; i < 10; i++) { | |
279 | ToSendStuffBit(0); | |
280 | ToSendStuffBit(0); | |
281 | ToSendStuffBit(0); | |
282 | ToSendStuffBit(0); | |
283 | } | |
284 | ||
285 | // why this? | |
286 | for(i = 0; i < 40; i++) { | |
287 | ToSendStuffBit(1); | |
288 | ToSendStuffBit(1); | |
289 | ToSendStuffBit(1); | |
290 | ToSendStuffBit(1); | |
291 | } | |
292 | ||
293 | // Convert from last byte pos to length | |
294 | ++ToSendMax; | |
295 | } | |
296 | ||
297 | ||
298 | /* Receive & handle a bit coming from the reader. | |
299 | * | |
300 | * This function is called 4 times per bit (every 2 subcarrier cycles). | |
301 | * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us | |
302 | * | |
303 | * LED handling: | |
304 | * LED A -> ON once we have received the SOF and are expecting the rest. | |
305 | * LED A -> OFF once we have received EOF or are in error state or unsynced | |
306 | * | |
307 | * Returns: true if we received a EOF | |
308 | * false if we are still waiting for some more | |
309 | */ | |
310 | static RAMFUNC int Handle14443bReaderUartBit(uint8_t bit) { | |
311 | switch(Uart.state) { | |
312 | case STATE_UNSYNCD: | |
313 | if(!bit) { | |
314 | // we went low, so this could be the beginning of an SOF | |
315 | Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF; | |
316 | Uart.posCnt = 0; | |
317 | Uart.bitCnt = 0; | |
318 | } | |
319 | break; | |
320 | ||
321 | case STATE_GOT_FALLING_EDGE_OF_SOF: | |
322 | Uart.posCnt++; | |
323 | if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit | |
324 | if(bit) { | |
325 | if(Uart.bitCnt > 9) { | |
326 | // we've seen enough consecutive | |
327 | // zeros that it's a valid SOF | |
328 | Uart.posCnt = 0; | |
329 | Uart.byteCnt = 0; | |
330 | Uart.state = STATE_AWAITING_START_BIT; | |
331 | LED_A_ON(); // Indicate we got a valid SOF | |
332 | } else { | |
333 | // didn't stay down long enough | |
334 | // before going high, error | |
335 | Uart.state = STATE_UNSYNCD; | |
336 | } | |
337 | } else { | |
338 | // do nothing, keep waiting | |
339 | } | |
340 | Uart.bitCnt++; | |
341 | } | |
342 | if(Uart.posCnt >= 4) Uart.posCnt = 0; | |
343 | if(Uart.bitCnt > 12) { | |
344 | // Give up if we see too many zeros without | |
345 | // a one, too. | |
346 | LED_A_OFF(); | |
347 | Uart.state = STATE_UNSYNCD; | |
348 | } | |
349 | break; | |
350 | ||
351 | case STATE_AWAITING_START_BIT: | |
352 | Uart.posCnt++; | |
353 | if(bit) { | |
354 | if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs | |
355 | // stayed high for too long between | |
356 | // characters, error | |
357 | Uart.state = STATE_UNSYNCD; | |
358 | } | |
359 | } else { | |
360 | // falling edge, this starts the data byte | |
361 | Uart.posCnt = 0; | |
362 | Uart.bitCnt = 0; | |
363 | Uart.shiftReg = 0; | |
364 | Uart.state = STATE_RECEIVING_DATA; | |
365 | } | |
366 | break; | |
367 | ||
368 | case STATE_RECEIVING_DATA: | |
369 | Uart.posCnt++; | |
370 | if(Uart.posCnt == 2) { | |
371 | // time to sample a bit | |
372 | Uart.shiftReg >>= 1; | |
373 | if(bit) { | |
374 | Uart.shiftReg |= 0x200; | |
375 | } | |
376 | Uart.bitCnt++; | |
377 | } | |
378 | if(Uart.posCnt >= 4) { | |
379 | Uart.posCnt = 0; | |
380 | } | |
381 | if(Uart.bitCnt == 10) { | |
382 | if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001)) | |
383 | { | |
384 | // this is a data byte, with correct | |
385 | // start and stop bits | |
386 | Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff; | |
387 | Uart.byteCnt++; | |
388 | ||
389 | if(Uart.byteCnt >= Uart.byteCntMax) { | |
390 | // Buffer overflowed, give up | |
391 | LED_A_OFF(); | |
392 | Uart.state = STATE_UNSYNCD; | |
393 | } else { | |
394 | // so get the next byte now | |
395 | Uart.posCnt = 0; | |
396 | Uart.state = STATE_AWAITING_START_BIT; | |
397 | } | |
398 | } else if (Uart.shiftReg == 0x000) { | |
399 | // this is an EOF byte | |
400 | LED_A_OFF(); // Finished receiving | |
401 | Uart.state = STATE_UNSYNCD; | |
402 | if (Uart.byteCnt != 0) { | |
403 | return TRUE; | |
404 | } | |
405 | } else { | |
406 | // this is an error | |
407 | LED_A_OFF(); | |
408 | Uart.state = STATE_UNSYNCD; | |
409 | } | |
410 | } | |
411 | break; | |
412 | ||
413 | default: | |
414 | LED_A_OFF(); | |
415 | Uart.state = STATE_UNSYNCD; | |
416 | break; | |
417 | } | |
418 | ||
419 | return FALSE; | |
420 | } | |
421 | ||
422 | //----------------------------------------------------------------------------- | |
423 | // Receive a command (from the reader to us, where we are the simulated tag), | |
424 | // and store it in the given buffer, up to the given maximum length. Keeps | |
425 | // spinning, waiting for a well-framed command, until either we get one | |
426 | // (returns TRUE) or someone presses the pushbutton on the board (FALSE). | |
427 | // | |
428 | // Assume that we're called with the SSC (to the FPGA) and ADC path set | |
429 | // correctly. | |
430 | //----------------------------------------------------------------------------- | |
431 | static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len) { | |
432 | // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen | |
433 | // only, since we are receiving, not transmitting). | |
434 | // Signal field is off with the appropriate LED | |
435 | LED_D_OFF(); | |
436 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION); | |
437 | ||
438 | StartCountSspClk(); | |
439 | ||
440 | // Now run a `software UART' on the stream of incoming samples. | |
441 | UartInit(received); | |
442 | ||
443 | uint8_t mask, b = 0; | |
444 | while( !BUTTON_PRESS() ) { | |
445 | WDT_HIT(); | |
446 | ||
447 | if ( AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY ) { | |
448 | b = (uint8_t) AT91C_BASE_SSC->SSC_RHR; | |
449 | for ( mask = 0x80; mask != 0; mask >>= 1) { | |
450 | if ( Handle14443bReaderUartBit(b & mask)) { | |
451 | *len = Uart.byteCnt; | |
452 | return TRUE; | |
453 | } | |
454 | } | |
455 | } | |
456 | } | |
457 | return FALSE; | |
458 | } | |
459 | ||
460 | ||
461 | static void TransmitFor14443b_AsTag( uint8_t *response, uint16_t len) { | |
462 | ||
463 | // Signal field is off with the appropriate LED | |
464 | LED_D_OFF(); | |
465 | ||
466 | // Modulate BPSK | |
467 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK); | |
468 | ||
469 | // 8 ETU / 8bits. 8/4= 2 etus. | |
470 | AT91C_BASE_SSC->SSC_THR = 0XFF; | |
471 | ||
472 | FpgaSetupSsc(); | |
473 | ||
474 | // Transmit the response. | |
475 | for(uint16_t i = 0; i < len;) { | |
476 | if(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) { | |
477 | AT91C_BASE_SSC->SSC_THR = response[i]; | |
478 | ++i; | |
479 | } | |
480 | } | |
481 | } | |
482 | //----------------------------------------------------------------------------- | |
483 | // Main loop of simulated tag: receive commands from reader, decide what | |
484 | // response to send, and send it. | |
485 | //----------------------------------------------------------------------------- | |
486 | void SimulateIso14443bTag(uint32_t pupi) { | |
487 | // the only commands we understand is WUPB, AFI=0, Select All, N=1: | |
488 | static const uint8_t cmd1[] = { ISO14443B_REQB, 0x00, 0x08, 0x39, 0x73 }; // WUPB | |
489 | // ... and REQB, AFI=0, Normal Request, N=1: | |
490 | static const uint8_t cmd2[] = { ISO14443B_REQB, 0x00, 0x00, 0x71, 0xFF }; // REQB | |
491 | // ... and ATTRIB | |
492 | static const uint8_t cmd4[] = { ISO14443B_ATTRIB, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB | |
493 | ||
494 | // ... if not PUPI/UID is supplied we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922, | |
495 | // supports only 106kBit/s in both directions, max frame size = 32Bytes, | |
496 | // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported: | |
497 | uint8_t response1[] = { | |
498 | 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22, | |
499 | 0x00, 0x21, 0x85, 0x5e, 0xd7 | |
500 | }; | |
501 | // response to HLTB and ATTRIB | |
502 | static const uint8_t response2[] = {0x00, 0x78, 0xF0}; | |
503 | ||
504 | // PUPI/UID supplied | |
505 | if ( pupi > 0 ) { | |
506 | uint8_t len = sizeof(response1); | |
507 | num_to_bytes(pupi, 4, response1+1); | |
508 | ComputeCrc14443(CRC_14443_B, response1, len-2, response1+len-2, response1+len-1); | |
509 | //print it.. | |
510 | } | |
511 | ||
512 | uint16_t len, cmdsRecvd = 0; | |
513 | uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE); | |
514 | ||
515 | uint8_t *resp1Code; | |
516 | uint8_t *resp2Code; | |
517 | uint16_t resp1CodeLen, resp2CodeLen; | |
518 | ||
519 | // uint32_t time_0 = 0; | |
520 | // uint32_t t2r_time = 0; | |
521 | // uint32_t r2t_time = 0; | |
522 | ||
523 | int cardSTATE = MFEMUL_NOFIELD; | |
524 | int vHf = 0; // in mV | |
525 | ||
526 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
527 | ||
528 | // allocate command receive buffer | |
529 | BigBuf_free(); | |
530 | BigBuf_Clear_ext(false); | |
531 | clear_trace(); //sim | |
532 | set_tracing(TRUE); | |
533 | ||
534 | // connect Demodulated Signal to ADC: | |
535 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
536 | ||
537 | // Set up the synchronous serial port | |
538 | FpgaSetupSsc(); | |
539 | ||
540 | // prepare the (only one) tag answer: | |
541 | CodeIso14443bAsTag(response1, sizeof(response1)); | |
542 | resp1Code = BigBuf_malloc(ToSendMax); | |
543 | resp1CodeLen = ToSendMax; | |
544 | memcpy(resp1Code, ToSend, ToSendMax); | |
545 | ||
546 | ||
547 | // prepare the (other) tag answer: | |
548 | CodeIso14443bAsTag(response2, sizeof(response2)); | |
549 | resp2Code = BigBuf_malloc(ToSendMax); | |
550 | resp2CodeLen = ToSendMax; | |
551 | memcpy(resp2Code, ToSend, ToSendMax); | |
552 | ||
553 | ||
554 | while (!BUTTON_PRESS() && !usb_poll_validate_length()) { | |
555 | WDT_HIT(); | |
556 | ||
557 | // find reader field | |
558 | if (cardSTATE == MFEMUL_NOFIELD) { | |
559 | vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10; | |
560 | if ( vHf > MF_MINFIELDV ) | |
561 | cardSTATE = MFEMUL_IDLE; | |
562 | } | |
563 | if (cardSTATE == MFEMUL_NOFIELD) continue; | |
564 | ||
565 | ||
566 | if (!GetIso14443bCommandFromReader(receivedCmd, &len)) { | |
567 | Dbprintf("button pressed, received %d commands", cmdsRecvd); | |
568 | break; | |
569 | } | |
570 | ||
571 | // REQ or WUP request in ANY state and WUP in HALTED state | |
572 | if (len == 5 && ( | |
573 | (receivedCmd[0] == ISO14443B_REQB && cardSTATE != MFEMUL_HALTED) || | |
574 | receivedCmd[0] == ISO14443A_CMD_WUPA | |
575 | ) | |
576 | ) { | |
577 | TransmitFor14443b_AsTag( resp1Code, resp1CodeLen ); | |
578 | LogTrace(response1, sizeof(response1), 0, 0, NULL, FALSE); | |
579 | cardSTATE = MFEMUL_SELECT1; | |
580 | continue; | |
581 | } | |
582 | ||
583 | if ( (len == 5 && memcmp(receivedCmd, cmd1, len) == 0) || | |
584 | (len == 5 && memcmp(receivedCmd, cmd2, len) == 0) ) { | |
585 | //WUPB && REQB | |
586 | cardSTATE = MFEMUL_SELECT1; | |
587 | } else if ( len == 7 && receivedCmd[0] == ISO14443B_HALT ) { | |
588 | cardSTATE = MFEMUL_HALTED; | |
589 | } else if ( len == sizeof(cmd4) && receivedCmd[0] == ISO14443B_ATTRIB ) { | |
590 | cardSTATE = MFEMUL_SELECT2; | |
591 | } else { | |
592 | // SLOT MARKER command?!? | |
593 | // ISO7816?!? | |
594 | Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd); | |
595 | ||
596 | // CRC Check | |
597 | uint8_t b1, b2; | |
598 | if (len >= 3){ // if crc exists | |
599 | ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2); | |
600 | if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) | |
601 | DbpString("+++CRC fail"); | |
602 | else | |
603 | DbpString("CRC passes"); | |
604 | } | |
605 | cardSTATE = MFEMUL_IDLE; | |
606 | } | |
607 | ||
608 | switch(cardSTATE){ | |
609 | case MFEMUL_NOFIELD: | |
610 | case MFEMUL_HALTED: | |
611 | case MFEMUL_IDLE:{ | |
612 | LogTrace(receivedCmd, len, 0, 0, NULL, TRUE); | |
613 | break; | |
614 | } | |
615 | case MFEMUL_SELECT1: | |
616 | TransmitFor14443b_AsTag( resp1Code, resp1CodeLen ); | |
617 | LogTrace(response1, sizeof(response1), 0, 0, NULL, FALSE); | |
618 | cardSTATE = MFEMUL_WORK; | |
619 | break; | |
620 | case MFEMUL_SELECT2: | |
621 | TransmitFor14443b_AsTag( resp2Code, resp2CodeLen ); | |
622 | LogTrace(response2, sizeof(response2), 0, 0, NULL, FALSE); | |
623 | cardSTATE = MFEMUL_HALTED; | |
624 | break; | |
625 | case MFEMUL_WORK: | |
626 | break; | |
627 | } | |
628 | ||
629 | ++cmdsRecvd; | |
630 | if(cmdsRecvd > 1000) { | |
631 | DbpString("14B Simulate, 1000 commands later..."); | |
632 | break; | |
633 | } | |
634 | } | |
635 | if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen()); | |
636 | ||
637 | switch_off(); //simulate | |
638 | } | |
639 | ||
640 | //============================================================================= | |
641 | // An ISO 14443 Type B reader. We take layer two commands, code them | |
642 | // appropriately, and then send them to the tag. We then listen for the | |
643 | // tag's response, which we leave in the buffer to be demodulated on the | |
644 | // PC side. | |
645 | //============================================================================= | |
646 | ||
647 | /* | |
648 | * Handles reception of a bit from the tag | |
649 | * | |
650 | * This function is called 2 times per bit (every 4 subcarrier cycles). | |
651 | * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us | |
652 | * | |
653 | * LED handling: | |
654 | * LED C -> ON once we have received the SOF and are expecting the rest. | |
655 | * LED C -> OFF once we have received EOF or are unsynced | |
656 | * | |
657 | * Returns: true if we received a EOF | |
658 | * false if we are still waiting for some more | |
659 | * | |
660 | */ | |
661 | #ifndef SUBCARRIER_DETECT_THRESHOLD | |
662 | # define SUBCARRIER_DETECT_THRESHOLD 8 | |
663 | #endif | |
664 | ||
665 | static RAMFUNC int Handle14443bTagSamplesDemod(int ci, int cq) { | |
666 | int v=0;// , myI, myQ = 0; | |
667 | // The soft decision on the bit uses an estimate of just the | |
668 | // quadrant of the reference angle, not the exact angle. | |
669 | #define MAKE_SOFT_DECISION() { \ | |
670 | if(Demod.sumI > 0) { \ | |
671 | v = ci; \ | |
672 | } else { \ | |
673 | v = -ci; \ | |
674 | } \ | |
675 | if(Demod.sumQ > 0) { \ | |
676 | v += cq; \ | |
677 | } else { \ | |
678 | v -= cq; \ | |
679 | } \ | |
680 | } | |
681 | ||
682 | // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq) | |
683 | // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq))) | |
684 | #define CHECK_FOR_SUBCARRIER() { \ | |
685 | if(ci < 0) { \ | |
686 | if(cq < 0) { /* ci < 0, cq < 0 */ \ | |
687 | if (cq < ci) { \ | |
688 | v = -cq - (ci >> 1); \ | |
689 | } else { \ | |
690 | v = -ci - (cq >> 1); \ | |
691 | } \ | |
692 | } else { /* ci < 0, cq >= 0 */ \ | |
693 | if (cq < -ci) { \ | |
694 | v = -ci + (cq >> 1); \ | |
695 | } else { \ | |
696 | v = cq - (ci >> 1); \ | |
697 | } \ | |
698 | } \ | |
699 | } else { \ | |
700 | if(cq < 0) { /* ci >= 0, cq < 0 */ \ | |
701 | if (-cq < ci) { \ | |
702 | v = ci - (cq >> 1); \ | |
703 | } else { \ | |
704 | v = -cq + (ci >> 1); \ | |
705 | } \ | |
706 | } else { /* ci >= 0, cq >= 0 */ \ | |
707 | if (cq < ci) { \ | |
708 | v = ci + (cq >> 1); \ | |
709 | } else { \ | |
710 | v = cq + (ci >> 1); \ | |
711 | } \ | |
712 | } \ | |
713 | } \ | |
714 | } | |
715 | ||
716 | //note: couldn't we just use MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2) from common.h - marshmellow | |
717 | #define CHECK_FOR_SUBCARRIER_un() { \ | |
718 | myI = ABS(ci); \ | |
719 | myQ = ABS(cq); \ | |
720 | v = MAX(myI,myQ) + (MIN(myI,myQ) >> 1); \ | |
721 | } | |
722 | ||
723 | switch(Demod.state) { | |
724 | case DEMOD_UNSYNCD: | |
725 | ||
726 | CHECK_FOR_SUBCARRIER(); | |
727 | ||
728 | // subcarrier detected | |
729 | if(v > SUBCARRIER_DETECT_THRESHOLD) { | |
730 | Demod.state = DEMOD_PHASE_REF_TRAINING; | |
731 | Demod.sumI = ci; | |
732 | Demod.sumQ = cq; | |
733 | Demod.posCount = 1; | |
734 | } | |
735 | break; | |
736 | ||
737 | case DEMOD_PHASE_REF_TRAINING: | |
738 | if(Demod.posCount < 8) { | |
739 | ||
740 | CHECK_FOR_SUBCARRIER(); | |
741 | ||
742 | if (v > SUBCARRIER_DETECT_THRESHOLD) { | |
743 | // set the reference phase (will code a logic '1') by averaging over 32 1/fs. | |
744 | // note: synchronization time > 80 1/fs | |
745 | Demod.sumI += ci; | |
746 | Demod.sumQ += cq; | |
747 | ++Demod.posCount; | |
748 | } else { | |
749 | // subcarrier lost | |
750 | Demod.state = DEMOD_UNSYNCD; | |
751 | } | |
752 | } else { | |
753 | Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF; | |
754 | } | |
755 | break; | |
756 | ||
757 | case DEMOD_AWAITING_FALLING_EDGE_OF_SOF: | |
758 | ||
759 | MAKE_SOFT_DECISION(); | |
760 | ||
761 | if(v < 0) { // logic '0' detected | |
762 | Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF; | |
763 | Demod.posCount = 0; // start of SOF sequence | |
764 | } else { | |
765 | // maximum length of TR1 = 200 1/fs | |
766 | if(Demod.posCount > 25*2) Demod.state = DEMOD_UNSYNCD; | |
767 | } | |
768 | ++Demod.posCount; | |
769 | break; | |
770 | ||
771 | case DEMOD_GOT_FALLING_EDGE_OF_SOF: | |
772 | ++Demod.posCount; | |
773 | ||
774 | MAKE_SOFT_DECISION(); | |
775 | ||
776 | if(v > 0) { | |
777 | // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges | |
778 | if(Demod.posCount < 9*2) { | |
779 | Demod.state = DEMOD_UNSYNCD; | |
780 | } else { | |
781 | LED_C_ON(); // Got SOF | |
782 | Demod.startTime = GetCountSspClk(); | |
783 | Demod.state = DEMOD_AWAITING_START_BIT; | |
784 | Demod.posCount = 0; | |
785 | Demod.len = 0; | |
786 | } | |
787 | } else { | |
788 | // low phase of SOF too long (> 12 etu) | |
789 | if (Demod.posCount > 12*2) { | |
790 | Demod.state = DEMOD_UNSYNCD; | |
791 | LED_C_OFF(); | |
792 | } | |
793 | } | |
794 | break; | |
795 | ||
796 | case DEMOD_AWAITING_START_BIT: | |
797 | ++Demod.posCount; | |
798 | ||
799 | MAKE_SOFT_DECISION(); | |
800 | ||
801 | if (v > 0) { | |
802 | if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs | |
803 | Demod.state = DEMOD_UNSYNCD; | |
804 | LED_C_OFF(); | |
805 | } | |
806 | } else { // start bit detected | |
807 | Demod.bitCount = 0; | |
808 | Demod.posCount = 1; // this was the first half | |
809 | Demod.thisBit = v; | |
810 | Demod.shiftReg = 0; | |
811 | Demod.state = DEMOD_RECEIVING_DATA; | |
812 | } | |
813 | break; | |
814 | ||
815 | case DEMOD_RECEIVING_DATA: | |
816 | ||
817 | MAKE_SOFT_DECISION(); | |
818 | ||
819 | if (Demod.posCount == 0) { | |
820 | // first half of bit | |
821 | Demod.thisBit = v; | |
822 | Demod.posCount = 1; | |
823 | } else { | |
824 | // second half of bit | |
825 | Demod.thisBit += v; | |
826 | Demod.shiftReg >>= 1; | |
827 | ||
828 | // logic '1' | |
829 | if(Demod.thisBit > 0) Demod.shiftReg |= 0x200; | |
830 | ||
831 | ++Demod.bitCount; | |
832 | ||
833 | if(Demod.bitCount == 10) { | |
834 | ||
835 | uint16_t s = Demod.shiftReg; | |
836 | ||
837 | // stop bit == '1', start bit == '0' | |
838 | if((s & 0x200) && !(s & 0x001)) { | |
839 | uint8_t b = (s >> 1); | |
840 | Demod.output[Demod.len] = b; | |
841 | ++Demod.len; | |
842 | Demod.state = DEMOD_AWAITING_START_BIT; | |
843 | } else { | |
844 | Demod.state = DEMOD_UNSYNCD; | |
845 | Demod.endTime = GetCountSspClk(); | |
846 | LED_C_OFF(); | |
847 | ||
848 | // This is EOF (start, stop and all data bits == '0' | |
849 | if(s == 0) return TRUE; | |
850 | } | |
851 | } | |
852 | Demod.posCount = 0; | |
853 | } | |
854 | break; | |
855 | ||
856 | default: | |
857 | Demod.state = DEMOD_UNSYNCD; | |
858 | LED_C_OFF(); | |
859 | break; | |
860 | } | |
861 | return FALSE; | |
862 | } | |
863 | ||
864 | ||
865 | /* | |
866 | * Demodulate the samples we received from the tag, also log to tracebuffer | |
867 | * quiet: set to 'TRUE' to disable debug output | |
868 | */ | |
869 | static void GetTagSamplesFor14443bDemod() { | |
870 | bool gotFrame = FALSE; | |
871 | int lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; | |
872 | int max = 0, ci = 0, cq = 0, samples = 0; | |
873 | uint32_t time_0 = 0, time_stop = 0; | |
874 | ||
875 | BigBuf_free(); | |
876 | ||
877 | // Set up the demodulator for tag -> reader responses. | |
878 | DemodInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
879 | ||
880 | // The DMA buffer, used to stream samples from the FPGA | |
881 | int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); | |
882 | int8_t *upTo = dmaBuf; | |
883 | ||
884 | // Setup and start DMA. | |
885 | if ( !FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE) ){ | |
886 | if (MF_DBGLEVEL > 1) Dbprintf("FpgaSetupSscDma failed. Exiting"); | |
887 | return; | |
888 | } | |
889 | ||
890 | time_0 = GetCountSspClk(); | |
891 | ||
892 | // And put the FPGA in the appropriate mode | |
893 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); | |
894 | ||
895 | while( !BUTTON_PRESS() ) { | |
896 | WDT_HIT(); | |
897 | ||
898 | int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR; | |
899 | if(behindBy > max) max = behindBy; | |
900 | ||
901 | // rx counter - dma counter? (how much?) & (mod) dma buff / 2. (since 2bytes at the time is read) | |
902 | while(((lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) { | |
903 | ||
904 | ci = upTo[0]; | |
905 | cq = upTo[1]; | |
906 | upTo += 2; | |
907 | samples += 2; | |
908 | ||
909 | // restart DMA buffer to receive again. | |
910 | if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { | |
911 | upTo = dmaBuf; | |
912 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo; | |
913 | AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; | |
914 | } | |
915 | ||
916 | lastRxCounter -= 2; | |
917 | if(lastRxCounter <= 0) | |
918 | lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; | |
919 | ||
920 | // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103 | |
921 | //gotFrame = Handle14443bTagSamplesDemod(ci & 0xfe, cq & 0xfe); | |
922 | gotFrame = Handle14443bTagSamplesDemod(ci, cq); | |
923 | if ( gotFrame ) break; | |
924 | LED_A_INV(); | |
925 | } | |
926 | ||
927 | time_stop = GetCountSspClk() - time_0; | |
928 | ||
929 | if(time_stop > iso14b_timeout || gotFrame) break; | |
930 | } | |
931 | ||
932 | FpgaDisableSscDma(); | |
933 | ||
934 | if (MF_DBGLEVEL >= 3) { | |
935 | Dbprintf("max behindby = %d, samples = %d, gotFrame = %s, Demod.state = %d, Demod.len = %u", | |
936 | max, | |
937 | samples, | |
938 | (gotFrame) ? "true" : "false", | |
939 | Demod.state, | |
940 | Demod.len | |
941 | ); | |
942 | } | |
943 | if ( Demod.len > 0 ) | |
944 | LogTrace(Demod.output, Demod.len, Demod.startTime, Demod.endTime, NULL, FALSE); | |
945 | } | |
946 | ||
947 | ||
948 | //----------------------------------------------------------------------------- | |
949 | // Transmit the command (to the tag) that was placed in ToSend[]. | |
950 | //----------------------------------------------------------------------------- | |
951 | static void TransmitFor14443b_AsReader(void) { | |
952 | ||
953 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); | |
954 | SpinDelay(20); | |
955 | ||
956 | int c; | |
957 | // we could been in following mode: | |
958 | // FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | |
959 | // if its second call or more | |
960 | ||
961 | // What does this loop do? Is it TR1? | |
962 | for(c = 0; c < 10;) { | |
963 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
964 | AT91C_BASE_SSC->SSC_THR = 0xFF; | |
965 | ++c; | |
966 | } | |
967 | } | |
968 | ||
969 | // Send frame loop | |
970 | for(c = 0; c < ToSendMax;) { | |
971 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
972 | AT91C_BASE_SSC->SSC_THR = ToSend[c]; | |
973 | ++c; | |
974 | } | |
975 | } | |
976 | WDT_HIT(); | |
977 | } | |
978 | ||
979 | //----------------------------------------------------------------------------- | |
980 | // Code a layer 2 command (string of octets, including CRC) into ToSend[], | |
981 | // so that it is ready to transmit to the tag using TransmitFor14443b(). | |
982 | //----------------------------------------------------------------------------- | |
983 | static void CodeIso14443bAsReader(const uint8_t *cmd, int len) | |
984 | { | |
985 | /* | |
986 | * Reader data transmission: | |
987 | * - no modulation ONES | |
988 | * - SOF | |
989 | * - Command, data and CRC_B | |
990 | * - EOF | |
991 | * - no modulation ONES | |
992 | * | |
993 | * 1 ETU == 1 BIT! | |
994 | * TR0 - 8 ETUS minimum. | |
995 | */ | |
996 | int i; | |
997 | uint8_t b; | |
998 | ||
999 | ToSendReset(); | |
1000 | ||
1001 | // Send SOF | |
1002 | // 10-11 ETUs of ZERO | |
1003 | for(i = 0; i < 10; ++i) ToSendStuffBit(0); | |
1004 | ||
1005 | // 2-3 ETUs of ONE | |
1006 | ToSendStuffBit(1); | |
1007 | ToSendStuffBit(1); | |
1008 | ToSendStuffBit(1); | |
1009 | ||
1010 | // Sending cmd, LSB | |
1011 | // from here we add BITS | |
1012 | for(i = 0; i < len; ++i) { | |
1013 | // Start bit | |
1014 | ToSendStuffBit(0); | |
1015 | // Data bits | |
1016 | b = cmd[i]; | |
1017 | if ( b & 1 ) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1018 | if ( (b>>1) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1019 | if ( (b>>2) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1020 | if ( (b>>3) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1021 | if ( (b>>4) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1022 | if ( (b>>5) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1023 | if ( (b>>6) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1024 | if ( (b>>7) & 1) ToSendStuffBit(1); else ToSendStuffBit(0); | |
1025 | // Stop bit | |
1026 | ToSendStuffBit(1); | |
1027 | // EGT extra guard time | |
1028 | // For PCD it ranges 0-57us (1etu = 9us) | |
1029 | ToSendStuffBit(1); | |
1030 | ToSendStuffBit(1); | |
1031 | ToSendStuffBit(1); | |
1032 | } | |
1033 | ||
1034 | // Send EOF | |
1035 | // 10-11 ETUs of ZERO | |
1036 | for(i = 0; i < 10; ++i) ToSendStuffBit(0); | |
1037 | ||
1038 | // Transition time. TR0 - guard time | |
1039 | // 8ETUS minum? | |
1040 | // Per specification, Subcarrier must be stopped no later than 2 ETUs after EOF. | |
1041 | for(i = 0; i < 40 ; ++i) ToSendStuffBit(1); | |
1042 | ||
1043 | // TR1 - Synchronization time | |
1044 | // Convert from last character reference to length | |
1045 | ++ToSendMax; | |
1046 | } | |
1047 | ||
1048 | ||
1049 | /** | |
1050 | Convenience function to encode, transmit and trace iso 14443b comms | |
1051 | **/ | |
1052 | static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len) { | |
1053 | ||
1054 | CodeIso14443bAsReader(cmd, len); | |
1055 | ||
1056 | uint32_t time_start = GetCountSspClk(); | |
1057 | ||
1058 | TransmitFor14443b_AsReader(); | |
1059 | ||
1060 | if(trigger) LED_A_ON(); | |
1061 | ||
1062 | LogTrace(cmd, len, time_start, GetCountSspClk()-time_start, NULL, TRUE); | |
1063 | } | |
1064 | ||
1065 | /* Sends an APDU to the tag | |
1066 | * TODO: check CRC and preamble | |
1067 | */ | |
1068 | uint8_t iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response) | |
1069 | { | |
1070 | uint8_t crc[2] = {0x00, 0x00}; | |
1071 | uint8_t message_frame[message_length + 4]; | |
1072 | // PCB | |
1073 | message_frame[0] = 0x0A | pcb_blocknum; | |
1074 | pcb_blocknum ^= 1; | |
1075 | // CID | |
1076 | message_frame[1] = 0; | |
1077 | // INF | |
1078 | memcpy(message_frame + 2, message, message_length); | |
1079 | // EDC (CRC) | |
1080 | ComputeCrc14443(CRC_14443_B, message_frame, message_length + 2, &message_frame[message_length + 2], &message_frame[message_length + 3]); | |
1081 | // send | |
1082 | CodeAndTransmit14443bAsReader(message_frame, message_length + 4); //no | |
1083 | // get response | |
1084 | GetTagSamplesFor14443bDemod(); //no | |
1085 | if(Demod.len < 3) | |
1086 | return 0; | |
1087 | ||
1088 | // VALIDATE CRC | |
1089 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]); | |
1090 | if ( crc[0] != Demod.output[Demod.len-2] || crc[1] != Demod.output[Demod.len-1] ) | |
1091 | return 0; | |
1092 | ||
1093 | // copy response contents | |
1094 | if(response != NULL) | |
1095 | memcpy(response, Demod.output, Demod.len); | |
1096 | ||
1097 | return Demod.len; | |
1098 | } | |
1099 | ||
1100 | /** | |
1101 | * SRx Initialise. | |
1102 | */ | |
1103 | uint8_t iso14443b_select_srx_card(iso14b_card_select_t *card ) | |
1104 | { | |
1105 | // INITIATE command: wake up the tag using the INITIATE | |
1106 | static const uint8_t init_srx[] = { ISO14443B_INITIATE, 0x00, 0x97, 0x5b }; | |
1107 | // SELECT command (with space for CRC) | |
1108 | uint8_t select_srx[] = { ISO14443B_SELECT, 0x00, 0x00, 0x00}; | |
1109 | // temp to calc crc. | |
1110 | uint8_t crc[2] = {0x00, 0x00}; | |
1111 | ||
1112 | CodeAndTransmit14443bAsReader(init_srx, sizeof(init_srx)); | |
1113 | GetTagSamplesFor14443bDemod(); //no | |
1114 | ||
1115 | if (Demod.len == 0) return 2; | |
1116 | ||
1117 | // Randomly generated Chip ID | |
1118 | if (card) card->chipid = Demod.output[0]; | |
1119 | ||
1120 | select_srx[1] = Demod.output[0]; | |
1121 | ||
1122 | ComputeCrc14443(CRC_14443_B, select_srx, 2, &select_srx[2], &select_srx[3]); | |
1123 | CodeAndTransmit14443bAsReader(select_srx, sizeof(select_srx)); | |
1124 | GetTagSamplesFor14443bDemod(); //no | |
1125 | ||
1126 | if (Demod.len != 3) return 2; | |
1127 | ||
1128 | // Check the CRC of the answer: | |
1129 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2 , &crc[0], &crc[1]); | |
1130 | if(crc[0] != Demod.output[1] || crc[1] != Demod.output[2]) return 3; | |
1131 | ||
1132 | // Check response from the tag: should be the same UID as the command we just sent: | |
1133 | if (select_srx[1] != Demod.output[0]) return 1; | |
1134 | ||
1135 | // First get the tag's UID: | |
1136 | select_srx[0] = ISO14443B_GET_UID; | |
1137 | ||
1138 | ComputeCrc14443(CRC_14443_B, select_srx, 1 , &select_srx[1], &select_srx[2]); | |
1139 | CodeAndTransmit14443bAsReader(select_srx, 3); // Only first three bytes for this one | |
1140 | GetTagSamplesFor14443bDemod(); //no | |
1141 | ||
1142 | if (Demod.len != 10) return 2; | |
1143 | ||
1144 | // The check the CRC of the answer | |
1145 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]); | |
1146 | if(crc[0] != Demod.output[8] || crc[1] != Demod.output[9]) return 3; | |
1147 | ||
1148 | if (card) { | |
1149 | card->uidlen = 8; | |
1150 | memcpy(card->uid, Demod.output, 8); | |
1151 | } | |
1152 | ||
1153 | return 0; | |
1154 | } | |
1155 | /* Perform the ISO 14443 B Card Selection procedure | |
1156 | * Currently does NOT do any collision handling. | |
1157 | * It expects 0-1 cards in the device's range. | |
1158 | * TODO: Support multiple cards (perform anticollision) | |
1159 | * TODO: Verify CRC checksums | |
1160 | */ | |
1161 | uint8_t iso14443b_select_card(iso14b_card_select_t *card ) | |
1162 | { | |
1163 | // WUPB command (including CRC) | |
1164 | // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state | |
1165 | static const uint8_t wupb[] = { ISO14443B_REQB, 0x00, 0x08, 0x39, 0x73 }; | |
1166 | // ATTRIB command (with space for CRC) | |
1167 | uint8_t attrib[] = { ISO14443B_ATTRIB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00}; | |
1168 | ||
1169 | // temp to calc crc. | |
1170 | uint8_t crc[2] = {0x00, 0x00}; | |
1171 | ||
1172 | // first, wake up the tag | |
1173 | CodeAndTransmit14443bAsReader(wupb, sizeof(wupb)); | |
1174 | GetTagSamplesFor14443bDemod(); //select_card | |
1175 | ||
1176 | // ATQB too short? | |
1177 | if (Demod.len < 14) return 2; | |
1178 | ||
1179 | // VALIDATE CRC | |
1180 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]); | |
1181 | if ( crc[0] != Demod.output[12] || crc[1] != Demod.output[13] ) | |
1182 | return 3; | |
1183 | ||
1184 | if (card) { | |
1185 | card->uidlen = 4; | |
1186 | memcpy(card->uid, Demod.output+1, 4); | |
1187 | memcpy(card->atqb, Demod.output+5, 7); | |
1188 | } | |
1189 | ||
1190 | // copy the PUPI to ATTRIB ( PUPI == UID ) | |
1191 | memcpy(attrib + 1, Demod.output + 1, 4); | |
1192 | ||
1193 | // copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into ATTRIB (Param 3) | |
1194 | attrib[7] = Demod.output[10] & 0x0F; | |
1195 | ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10); | |
1196 | ||
1197 | CodeAndTransmit14443bAsReader(attrib, sizeof(attrib)); | |
1198 | GetTagSamplesFor14443bDemod();//select_card | |
1199 | ||
1200 | // Answer to ATTRIB too short? | |
1201 | if(Demod.len < 3) return 2; | |
1202 | ||
1203 | // VALIDATE CRC | |
1204 | ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]); | |
1205 | if ( crc[0] != Demod.output[1] || crc[1] != Demod.output[2] ) | |
1206 | return 3; | |
1207 | ||
1208 | // CID | |
1209 | if (card) card->cid = Demod.output[0]; | |
1210 | ||
1211 | uint8_t fwt = card->atqb[6]>>4; | |
1212 | if ( fwt < 16 ){ | |
1213 | uint32_t fwt_time = (302 << fwt); | |
1214 | iso14b_set_timeout( fwt_time); | |
1215 | } | |
1216 | // reset PCB block number | |
1217 | pcb_blocknum = 0; | |
1218 | return 0; | |
1219 | } | |
1220 | ||
1221 | // Set up ISO 14443 Type B communication (similar to iso14443a_setup) | |
1222 | // field is setup for "Sending as Reader" | |
1223 | void iso14443b_setup() { | |
1224 | if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup Enter"); | |
1225 | LEDsoff(); | |
1226 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
1227 | //BigBuf_free(); | |
1228 | //BigBuf_Clear_ext(false); | |
1229 | ||
1230 | // Initialize Demod and Uart structs | |
1231 | DemodInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1232 | UartInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1233 | ||
1234 | // connect Demodulated Signal to ADC: | |
1235 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
1236 | ||
1237 | // Set up the synchronous serial port | |
1238 | FpgaSetupSsc(); | |
1239 | ||
1240 | // Signal field is on with the appropriate LED | |
1241 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); | |
1242 | SpinDelay(100); | |
1243 | ||
1244 | // Start the timer | |
1245 | StartCountSspClk(); | |
1246 | ||
1247 | LED_D_ON(); | |
1248 | if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup Exit"); | |
1249 | } | |
1250 | ||
1251 | //----------------------------------------------------------------------------- | |
1252 | // Read a SRI512 ISO 14443B tag. | |
1253 | // | |
1254 | // SRI512 tags are just simple memory tags, here we're looking at making a dump | |
1255 | // of the contents of the memory. No anticollision algorithm is done, we assume | |
1256 | // we have a single tag in the field. | |
1257 | // | |
1258 | // I tried to be systematic and check every answer of the tag, every CRC, etc... | |
1259 | //----------------------------------------------------------------------------- | |
1260 | void ReadSTMemoryIso14443b(uint8_t numofblocks) | |
1261 | { | |
1262 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
1263 | ||
1264 | // Make sure that we start from off, since the tags are stateful; | |
1265 | // confusing things will happen if we don't reset them between reads. | |
1266 | switch_off(); // before ReadStMemory | |
1267 | ||
1268 | set_tracing(TRUE); | |
1269 | ||
1270 | uint8_t i = 0x00; | |
1271 | ||
1272 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
1273 | FpgaSetupSsc(); | |
1274 | ||
1275 | // Now give it time to spin up. | |
1276 | // Signal field is on with the appropriate LED | |
1277 | LED_D_ON(); | |
1278 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); | |
1279 | SpinDelay(20); | |
1280 | ||
1281 | // First command: wake up the tag using the INITIATE command | |
1282 | uint8_t cmd1[] = {ISO14443B_INITIATE, 0x00, 0x97, 0x5b}; | |
1283 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no | |
1284 | GetTagSamplesFor14443bDemod(); // no | |
1285 | ||
1286 | if (Demod.len == 0) { | |
1287 | DbpString("No response from tag"); | |
1288 | set_tracing(FALSE); | |
1289 | return; | |
1290 | } else { | |
1291 | Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x", | |
1292 | Demod.output[0], Demod.output[1], Demod.output[2]); | |
1293 | } | |
1294 | ||
1295 | // There is a response, SELECT the uid | |
1296 | DbpString("Now SELECT tag:"); | |
1297 | cmd1[0] = ISO14443B_SELECT; // 0x0E is SELECT | |
1298 | cmd1[1] = Demod.output[0]; | |
1299 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); | |
1300 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no | |
1301 | GetTagSamplesFor14443bDemod(); //no | |
1302 | if (Demod.len != 3) { | |
1303 | Dbprintf("Expected 3 bytes from tag, got %d", Demod.len); | |
1304 | set_tracing(FALSE); | |
1305 | return; | |
1306 | } | |
1307 | // Check the CRC of the answer: | |
1308 | ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]); | |
1309 | if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) { | |
1310 | DbpString("CRC Error reading select response."); | |
1311 | set_tracing(FALSE); | |
1312 | return; | |
1313 | } | |
1314 | // Check response from the tag: should be the same UID as the command we just sent: | |
1315 | if (cmd1[1] != Demod.output[0]) { | |
1316 | Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]); | |
1317 | set_tracing(FALSE); | |
1318 | return; | |
1319 | } | |
1320 | ||
1321 | // Tag is now selected, | |
1322 | // First get the tag's UID: | |
1323 | cmd1[0] = ISO14443B_GET_UID; | |
1324 | ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]); | |
1325 | CodeAndTransmit14443bAsReader(cmd1, 3); // no -- Only first three bytes for this one | |
1326 | GetTagSamplesFor14443bDemod(); //no | |
1327 | if (Demod.len != 10) { | |
1328 | Dbprintf("Expected 10 bytes from tag, got %d", Demod.len); | |
1329 | set_tracing(FALSE); | |
1330 | return; | |
1331 | } | |
1332 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
1333 | ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]); | |
1334 | if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) { | |
1335 | Dbprintf("CRC Error reading block! Expected: %04x got: %04x", | |
1336 | (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]); | |
1337 | // Do not return;, let's go on... (we should retry, maybe ?) | |
1338 | } | |
1339 | Dbprintf("Tag UID (64 bits): %08x %08x", | |
1340 | (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], | |
1341 | (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]); | |
1342 | ||
1343 | // Now loop to read all 16 blocks, address from 0 to last block | |
1344 | Dbprintf("Tag memory dump, block 0 to %d", numofblocks); | |
1345 | cmd1[0] = 0x08; | |
1346 | i = 0x00; | |
1347 | ++numofblocks; | |
1348 | ||
1349 | for (;;) { | |
1350 | if (i == numofblocks) { | |
1351 | DbpString("System area block (0xff):"); | |
1352 | i = 0xff; | |
1353 | } | |
1354 | cmd1[1] = i; | |
1355 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); | |
1356 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no | |
1357 | GetTagSamplesFor14443bDemod(); //no | |
1358 | ||
1359 | if (Demod.len != 6) { // Check if we got an answer from the tag | |
1360 | DbpString("Expected 6 bytes from tag, got less..."); | |
1361 | return; | |
1362 | } | |
1363 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
1364 | ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]); | |
1365 | if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) { | |
1366 | Dbprintf("CRC Error reading block! Expected: %04x got: %04x", | |
1367 | (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]); | |
1368 | // Do not return;, let's go on... (we should retry, maybe ?) | |
1369 | } | |
1370 | // Now print out the memory location: | |
1371 | Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i, | |
1372 | (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], | |
1373 | (Demod.output[4]<<8)+Demod.output[5]); | |
1374 | ||
1375 | if (i == 0xff) break; | |
1376 | ++i; | |
1377 | } | |
1378 | ||
1379 | set_tracing(FALSE); | |
1380 | } | |
1381 | ||
1382 | ||
1383 | static void iso1444b_setup_snoop(void){ | |
1384 | if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup_snoop Enter"); | |
1385 | LEDsoff(); | |
1386 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
1387 | BigBuf_free(); | |
1388 | BigBuf_Clear_ext(false); | |
1389 | clear_trace();//setup snoop | |
1390 | set_tracing(TRUE); | |
1391 | ||
1392 | // Initialize Demod and Uart structs | |
1393 | DemodInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1394 | UartInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1395 | ||
1396 | if (MF_DBGLEVEL > 1) { | |
1397 | // Print debug information about the buffer sizes | |
1398 | Dbprintf("Snooping buffers initialized:"); | |
1399 | Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen()); | |
1400 | Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE); | |
1401 | Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE); | |
1402 | Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE); | |
1403 | } | |
1404 | ||
1405 | // connect Demodulated Signal to ADC: | |
1406 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
1407 | ||
1408 | // Setup for the DMA. | |
1409 | FpgaSetupSsc(); | |
1410 | ||
1411 | // Set FPGA in the appropriate mode | |
1412 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP); | |
1413 | SpinDelay(20); | |
1414 | ||
1415 | // Start the SSP timer | |
1416 | StartCountSspClk(); | |
1417 | if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup_snoop Exit"); | |
1418 | } | |
1419 | ||
1420 | //============================================================================= | |
1421 | // Finally, the `sniffer' combines elements from both the reader and | |
1422 | // simulated tag, to show both sides of the conversation. | |
1423 | //============================================================================= | |
1424 | ||
1425 | //----------------------------------------------------------------------------- | |
1426 | // Record the sequence of commands sent by the reader to the tag, with | |
1427 | // triggering so that we start recording at the point that the tag is moved | |
1428 | // near the reader. | |
1429 | //----------------------------------------------------------------------------- | |
1430 | /* | |
1431 | * Memory usage for this function, (within BigBuf) | |
1432 | * Last Received command (reader->tag) - MAX_FRAME_SIZE | |
1433 | * Last Received command (tag->reader) - MAX_FRAME_SIZE | |
1434 | * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE | |
1435 | * Demodulated samples received - all the rest | |
1436 | */ | |
1437 | void RAMFUNC SnoopIso14443b(void) { | |
1438 | ||
1439 | uint32_t time_0 = 0, time_start = 0, time_stop = 0; | |
1440 | ||
1441 | // We won't start recording the frames that we acquire until we trigger; | |
1442 | // a good trigger condition to get started is probably when we see a | |
1443 | // response from the tag. | |
1444 | int triggered = TRUE; // TODO: set and evaluate trigger condition | |
1445 | int ci, cq; | |
1446 | int maxBehindBy = 0; | |
1447 | //int behindBy = 0; | |
1448 | int lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; | |
1449 | ||
1450 | bool TagIsActive = FALSE; | |
1451 | bool ReaderIsActive = FALSE; | |
1452 | ||
1453 | iso1444b_setup_snoop(); | |
1454 | ||
1455 | // The DMA buffer, used to stream samples from the FPGA | |
1456 | int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); | |
1457 | int8_t *upTo = dmaBuf; | |
1458 | ||
1459 | // Setup and start DMA. | |
1460 | if ( !FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE) ){ | |
1461 | if (MF_DBGLEVEL > 1) Dbprintf("FpgaSetupSscDma failed. Exiting"); | |
1462 | BigBuf_free(); | |
1463 | return; | |
1464 | } | |
1465 | ||
1466 | time_0 = GetCountSspClk(); | |
1467 | ||
1468 | // And now we loop, receiving samples. | |
1469 | for(;;) { | |
1470 | ||
1471 | WDT_HIT(); | |
1472 | ||
1473 | int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1); | |
1474 | ||
1475 | if ( behindBy > maxBehindBy ) | |
1476 | maxBehindBy = behindBy; | |
1477 | ||
1478 | if ( behindBy < 2 ) continue; | |
1479 | ||
1480 | ci = upTo[0]; | |
1481 | cq = upTo[1]; | |
1482 | upTo += 2; | |
1483 | ||
1484 | lastRxCounter -= 2; | |
1485 | ||
1486 | if (upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { | |
1487 | upTo = dmaBuf; | |
1488 | lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; | |
1489 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; | |
1490 | AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; | |
1491 | WDT_HIT(); | |
1492 | ||
1493 | // TODO: understand whether we can increase/decrease as we want or not? | |
1494 | if ( behindBy > ( 9 * ISO14443B_DMA_BUFFER_SIZE/10) ) { | |
1495 | Dbprintf("blew circular buffer! behindBy=%d", behindBy); | |
1496 | break; | |
1497 | } | |
1498 | ||
1499 | if(!tracing) { | |
1500 | DbpString("Trace full"); | |
1501 | break; | |
1502 | } | |
1503 | ||
1504 | if(BUTTON_PRESS()) { | |
1505 | DbpString("cancelled"); | |
1506 | break; | |
1507 | } | |
1508 | } | |
1509 | ||
1510 | if (!TagIsActive) { | |
1511 | ||
1512 | LED_A_ON(); | |
1513 | ||
1514 | // no need to try decoding reader data if the tag is sending | |
1515 | if (Handle14443bReaderUartBit(ci & 0x01)) { | |
1516 | ||
1517 | time_stop = (GetCountSspClk()-time_0); | |
1518 | ||
1519 | if (triggered) | |
1520 | LogTrace(Uart.output, Uart.byteCnt, time_start, time_stop, NULL, TRUE); | |
1521 | ||
1522 | /* And ready to receive another command. */ | |
1523 | UartReset(); | |
1524 | /* And also reset the demod code, which might have been */ | |
1525 | /* false-triggered by the commands from the reader. */ | |
1526 | DemodReset(); | |
1527 | } else { | |
1528 | time_start = (GetCountSspClk()-time_0); | |
1529 | } | |
1530 | ||
1531 | if (Handle14443bReaderUartBit(cq & 0x01)) { | |
1532 | ||
1533 | time_stop = (GetCountSspClk()-time_0); | |
1534 | ||
1535 | if (triggered) | |
1536 | LogTrace(Uart.output, Uart.byteCnt, time_start, time_stop, NULL, TRUE); | |
1537 | ||
1538 | /* And ready to receive another command. */ | |
1539 | UartReset(); | |
1540 | /* And also reset the demod code, which might have been */ | |
1541 | /* false-triggered by the commands from the reader. */ | |
1542 | DemodReset(); | |
1543 | } else { | |
1544 | time_start = (GetCountSspClk()-time_0); | |
1545 | } | |
1546 | ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF); | |
1547 | LED_A_OFF(); | |
1548 | } | |
1549 | ||
1550 | if(!ReaderIsActive) { | |
1551 | // no need to try decoding tag data if the reader is sending - and we cannot afford the time | |
1552 | // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103 | |
1553 | if(Handle14443bTagSamplesDemod(ci & 0xFE, cq & 0xFE)) { | |
1554 | ||
1555 | time_stop = (GetCountSspClk()-time_0); | |
1556 | ||
1557 | LogTrace(Demod.output, Demod.len, time_start, time_stop, NULL, FALSE); | |
1558 | ||
1559 | triggered = TRUE; | |
1560 | ||
1561 | // And ready to receive another response. | |
1562 | DemodReset(); | |
1563 | } else { | |
1564 | time_start = (GetCountSspClk()-time_0); | |
1565 | } | |
1566 | TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF); | |
1567 | } | |
1568 | } | |
1569 | ||
1570 | switch_off(); // Snoop | |
1571 | ||
1572 | DbpString("Snoop statistics:"); | |
1573 | Dbprintf(" Max behind by: %i", maxBehindBy); | |
1574 | Dbprintf(" Uart State: %x ByteCount: %i ByteCountMax: %i", Uart.state, Uart.byteCnt, Uart.byteCntMax); | |
1575 | Dbprintf(" Trace length: %i", BigBuf_get_traceLen()); | |
1576 | ||
1577 | // free mem refs. | |
1578 | if ( dmaBuf ) dmaBuf = NULL; | |
1579 | if ( upTo ) upTo = NULL; | |
1580 | // Uart.byteCntMax should be set with ATQB value.. | |
1581 | } | |
1582 | ||
1583 | void iso14b_set_trigger(bool enable) { | |
1584 | trigger = enable; | |
1585 | } | |
1586 | ||
1587 | /* | |
1588 | * Send raw command to tag ISO14443B | |
1589 | * @Input | |
1590 | * param flags enum ISO14B_COMMAND. (mifare.h) | |
1591 | * len len of buffer data | |
1592 | * data buffer with bytes to send | |
1593 | * | |
1594 | * @Output | |
1595 | * none | |
1596 | * | |
1597 | */ | |
1598 | void SendRawCommand14443B_Ex(UsbCommand *c) | |
1599 | { | |
1600 | iso14b_command_t param = c->arg[0]; | |
1601 | size_t len = c->arg[1] & 0xffff; | |
1602 | uint8_t *cmd = c->d.asBytes; | |
1603 | uint8_t status = 0; | |
1604 | uint32_t sendlen = sizeof(iso14b_card_select_t); | |
1605 | uint8_t buf[USB_CMD_DATA_SIZE] = {0x00}; | |
1606 | ||
1607 | if (MF_DBGLEVEL > 3) Dbprintf("14b raw: param, %04x", param ); | |
1608 | ||
1609 | // turn on trigger (LED_A) | |
1610 | if ((param & ISO14B_REQUEST_TRIGGER) == ISO14B_REQUEST_TRIGGER) | |
1611 | iso14b_set_trigger(TRUE); | |
1612 | ||
1613 | if ((param & ISO14B_CONNECT) == ISO14B_CONNECT) { | |
1614 | // Make sure that we start from off, since the tags are stateful; | |
1615 | // confusing things will happen if we don't reset them between reads. | |
1616 | //switch_off(); // before connect in raw | |
1617 | iso14443b_setup(); | |
1618 | } | |
1619 | ||
1620 | set_tracing(TRUE); | |
1621 | ||
1622 | if ((param & ISO14B_SELECT_STD) == ISO14B_SELECT_STD) { | |
1623 | iso14b_card_select_t *card = (iso14b_card_select_t*)buf; | |
1624 | status = iso14443b_select_card(card); | |
1625 | cmd_send(CMD_ACK, status, sendlen, 0, buf, sendlen); | |
1626 | // 0: OK 2: attrib fail, 3:crc fail, | |
1627 | if ( status > 0 ) return; | |
1628 | } | |
1629 | ||
1630 | if ((param & ISO14B_SELECT_SR) == ISO14B_SELECT_SR) { | |
1631 | iso14b_card_select_t *card = (iso14b_card_select_t*)buf; | |
1632 | status = iso14443b_select_srx_card(card); | |
1633 | cmd_send(CMD_ACK, status, sendlen, 0, buf, sendlen); | |
1634 | // 0: OK 2: attrib fail, 3:crc fail, | |
1635 | if ( status > 0 ) return; | |
1636 | } | |
1637 | ||
1638 | if ((param & ISO14B_APDU) == ISO14B_APDU) { | |
1639 | status = iso14443b_apdu(cmd, len, buf); | |
1640 | cmd_send(CMD_ACK, status, status, 0, buf, status); | |
1641 | } | |
1642 | ||
1643 | if ((param & ISO14B_RAW) == ISO14B_RAW) { | |
1644 | if((param & ISO14B_APPEND_CRC) == ISO14B_APPEND_CRC) { | |
1645 | AppendCrc14443b(cmd, len); | |
1646 | len += 2; | |
1647 | } | |
1648 | ||
1649 | CodeAndTransmit14443bAsReader(cmd, len); // raw | |
1650 | GetTagSamplesFor14443bDemod(); // raw | |
1651 | ||
1652 | sendlen = MIN(Demod.len, USB_CMD_DATA_SIZE); | |
1653 | status = (Demod.len > 0) ? 0 : 1; | |
1654 | cmd_send(CMD_ACK, status, sendlen, 0, Demod.output, sendlen); | |
1655 | } | |
1656 | ||
1657 | // turn off trigger (LED_A) | |
1658 | if ((param & ISO14B_REQUEST_TRIGGER) == ISO14B_REQUEST_TRIGGER) | |
1659 | iso14b_set_trigger(FALSE); | |
1660 | ||
1661 | // turn off antenna et al | |
1662 | // we don't send a HALT command. | |
1663 | if ((param & ISO14B_DISCONNECT) == ISO14B_DISCONNECT) { | |
1664 | if (MF_DBGLEVEL > 3) Dbprintf("disconnect"); | |
1665 | switch_off(); // disconnect raw | |
1666 | } else { | |
1667 | //FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); | |
1668 | } | |
1669 | ||
1670 | } |