]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - armsrc/iso14443b.c
add: @pwpipi 's fixes to 14B
[proxmark3-svn] / armsrc / iso14443b.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------
2// Jonathan Westhues, split Nov 2006
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// Routines to support ISO 14443B. This includes both the reader software and
9// the `fake tag' modes.
10//-----------------------------------------------------------------------------
11
12#include "proxmark3.h"
13#include "apps.h"
14#include "util.h"
15#include "string.h"
16
17#include "iso14443crc.h"
18
19#define RECEIVE_SAMPLES_TIMEOUT 2000
20#define ISO14443B_DMA_BUFFER_SIZE 512
21
22//=============================================================================
23// An ISO 14443 Type B tag. We listen for commands from the reader, using
24// a UART kind of thing that's implemented in software. When we get a
25// frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
26// If it's good, then we can do something appropriate with it, and send
27// a response.
28//=============================================================================
29
30//-----------------------------------------------------------------------------
31// Code up a string of octets at layer 2 (including CRC, we don't generate
32// that here) so that they can be transmitted to the reader. Doesn't transmit
33// them yet, just leaves them ready to send in ToSend[].
34//-----------------------------------------------------------------------------
35static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
36{
37 int i;
38
39 ToSendReset();
40
41 // Transmit a burst of ones, as the initial thing that lets the
42 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
43 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
44 // so I will too.
45 for(i = 0; i < 20; i++) {
46 ToSendStuffBit(1);
47 ToSendStuffBit(1);
48 ToSendStuffBit(1);
49 ToSendStuffBit(1);
50 }
51
52 // Send SOF.
53 for(i = 0; i < 10; i++) {
54 ToSendStuffBit(0);
55 ToSendStuffBit(0);
56 ToSendStuffBit(0);
57 ToSendStuffBit(0);
58 }
59 for(i = 0; i < 2; i++) {
60 ToSendStuffBit(1);
61 ToSendStuffBit(1);
62 ToSendStuffBit(1);
63 ToSendStuffBit(1);
64 }
65
66 for(i = 0; i < len; i++) {
67 int j;
68 uint8_t b = cmd[i];
69
70 // Start bit
71 ToSendStuffBit(0);
72 ToSendStuffBit(0);
73 ToSendStuffBit(0);
74 ToSendStuffBit(0);
75
76 // Data bits
77 for(j = 0; j < 8; j++) {
78 if(b & 1) {
79 ToSendStuffBit(1);
80 ToSendStuffBit(1);
81 ToSendStuffBit(1);
82 ToSendStuffBit(1);
83 } else {
84 ToSendStuffBit(0);
85 ToSendStuffBit(0);
86 ToSendStuffBit(0);
87 ToSendStuffBit(0);
88 }
89 b >>= 1;
90 }
91
92 // Stop bit
93 ToSendStuffBit(1);
94 ToSendStuffBit(1);
95 ToSendStuffBit(1);
96 ToSendStuffBit(1);
97 }
98
99 // Send EOF.
100 for(i = 0; i < 10; i++) {
101 ToSendStuffBit(0);
102 ToSendStuffBit(0);
103 ToSendStuffBit(0);
104 ToSendStuffBit(0);
105 }
106 for(i = 0; i < 2; i++) {
107 ToSendStuffBit(1);
108 ToSendStuffBit(1);
109 ToSendStuffBit(1);
110 ToSendStuffBit(1);
111 }
112
113 // Convert from last byte pos to length
114 ToSendMax++;
115}
116
117//-----------------------------------------------------------------------------
118// The software UART that receives commands from the reader, and its state
119// variables.
120//-----------------------------------------------------------------------------
121static struct {
122 enum {
123 STATE_UNSYNCD,
124 STATE_GOT_FALLING_EDGE_OF_SOF,
125 STATE_AWAITING_START_BIT,
126 STATE_RECEIVING_DATA,
127 STATE_ERROR_WAIT
128 } state;
129 uint16_t shiftReg;
130 int bitCnt;
131 int byteCnt;
132 int byteCntMax;
133 int posCnt;
134 uint8_t *output;
135} Uart;
136
137/* Receive & handle a bit coming from the reader.
138 *
139 * This function is called 4 times per bit (every 2 subcarrier cycles).
140 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
141 *
142 * LED handling:
143 * LED A -> ON once we have received the SOF and are expecting the rest.
144 * LED A -> OFF once we have received EOF or are in error state or unsynced
145 *
146 * Returns: true if we received a EOF
147 * false if we are still waiting for some more
148 */
149static int Handle14443bUartBit(int bit)
150{
151 switch(Uart.state) {
152 case STATE_UNSYNCD:
153 if(!bit) {
154 // we went low, so this could be the beginning
155 // of an SOF
156 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
157 Uart.posCnt = 0;
158 Uart.bitCnt = 0;
159 }
160 break;
161
162 case STATE_GOT_FALLING_EDGE_OF_SOF:
163 Uart.posCnt++;
164 if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit
165 if(bit) {
166 if(Uart.bitCnt > 9) {
167 // we've seen enough consecutive
168 // zeros that it's a valid SOF
169 Uart.posCnt = 0;
170 Uart.byteCnt = 0;
171 Uart.state = STATE_AWAITING_START_BIT;
172 LED_A_ON(); // Indicate we got a valid SOF
173 } else {
174 // didn't stay down long enough
175 // before going high, error
176 Uart.state = STATE_ERROR_WAIT;
177 }
178 } else {
179 // do nothing, keep waiting
180 }
181 Uart.bitCnt++;
182 }
183 if(Uart.posCnt >= 4) Uart.posCnt = 0;
184 if(Uart.bitCnt > 12) {
185 // Give up if we see too many zeros without
186 // a one, too.
187 Uart.state = STATE_ERROR_WAIT;
188 }
189 break;
190
191 case STATE_AWAITING_START_BIT:
192 Uart.posCnt++;
193 if(bit) {
194 if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
195 // stayed high for too long between
196 // characters, error
197 Uart.state = STATE_ERROR_WAIT;
198 }
199 } else {
200 // falling edge, this starts the data byte
201 Uart.posCnt = 0;
202 Uart.bitCnt = 0;
203 Uart.shiftReg = 0;
204 Uart.state = STATE_RECEIVING_DATA;
205 }
206 break;
207
208 case STATE_RECEIVING_DATA:
209 Uart.posCnt++;
210 if(Uart.posCnt == 2) {
211 // time to sample a bit
212 Uart.shiftReg >>= 1;
213 if(bit) {
214 Uart.shiftReg |= 0x200;
215 }
216 Uart.bitCnt++;
217 }
218 if(Uart.posCnt >= 4) {
219 Uart.posCnt = 0;
220 }
221 if(Uart.bitCnt == 10) {
222 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
223 {
224 // this is a data byte, with correct
225 // start and stop bits
226 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
227 Uart.byteCnt++;
228
229 if(Uart.byteCnt >= Uart.byteCntMax) {
230 // Buffer overflowed, give up
231 Uart.posCnt = 0;
232 Uart.state = STATE_ERROR_WAIT;
233 } else {
234 // so get the next byte now
235 Uart.posCnt = 0;
236 Uart.state = STATE_AWAITING_START_BIT;
237 }
238 } else if(Uart.shiftReg == 0x000) {
239 // this is an EOF byte
240 LED_A_OFF(); // Finished receiving
241 return TRUE;
242 } else {
243 // this is an error
244 Uart.posCnt = 0;
245 Uart.state = STATE_ERROR_WAIT;
246 }
247 }
248 break;
249
250 case STATE_ERROR_WAIT:
251 // We're all screwed up, so wait a little while
252 // for whatever went wrong to finish, and then
253 // start over.
254 Uart.posCnt++;
255 if(Uart.posCnt > 10) {
256 Uart.state = STATE_UNSYNCD;
257 LED_A_OFF();
258 }
259 break;
260
261 default:
262 Uart.state = STATE_UNSYNCD;
263 break;
264 }
265
266 return FALSE;
267}
268
269//-----------------------------------------------------------------------------
270// Receive a command (from the reader to us, where we are the simulated tag),
271// and store it in the given buffer, up to the given maximum length. Keeps
272// spinning, waiting for a well-framed command, until either we get one
273// (returns TRUE) or someone presses the pushbutton on the board (FALSE).
274//
275// Assume that we're called with the SSC (to the FPGA) and ADC path set
276// correctly.
277//-----------------------------------------------------------------------------
278static int GetIso14443bCommandFromReader(uint8_t *received, int *len, int maxLen)
279{
280 uint8_t mask;
281 int i, bit;
282
283 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
284 // only, since we are receiving, not transmitting).
285 // Signal field is off with the appropriate LED
286 LED_D_OFF();
287 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
288
289
290 // Now run a `software UART' on the stream of incoming samples.
291 Uart.output = received;
292 Uart.byteCntMax = maxLen;
293 Uart.state = STATE_UNSYNCD;
294
295 for(;;) {
296 WDT_HIT();
297
298 if(BUTTON_PRESS()) return FALSE;
299
300 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
301 AT91C_BASE_SSC->SSC_THR = 0x00;
302 }
303 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
304 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
305
306 mask = 0x80;
307 for(i = 0; i < 8; i++, mask >>= 1) {
308 bit = (b & mask);
309 if(Handle14443bUartBit(bit)) {
310 *len = Uart.byteCnt;
311 return TRUE;
312 }
313 }
314 }
315 }
316}
317
318//-----------------------------------------------------------------------------
319// Main loop of simulated tag: receive commands from reader, decide what
320// response to send, and send it.
321//-----------------------------------------------------------------------------
322void SimulateIso14443bTag(void)
323{
324 // the only command we understand is REQB, AFI=0, Select All, N=0:
325 static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
326 // ... and we respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
327 // supports only 106kBit/s in both directions, max frame size = 32Bytes,
328 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
329 static const uint8_t response1[] = {
330 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
331 0x00, 0x21, 0x85, 0x5e, 0xd7
332 };
333
334 uint8_t *resp;
335 int respLen;
336
337 // allocate command receive buffer
338 BigBuf_free();
339 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
340 int len;
341
342 int i;
343
344 int cmdsRecvd = 0;
345
346 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
347
348 // prepare the (only one) tag answer:
349 CodeIso14443bAsTag(response1, sizeof(response1));
350 uint8_t *resp1 = BigBuf_malloc(ToSendMax);
351 memcpy(resp1, ToSend, ToSendMax);
352 uint16_t resp1Len = ToSendMax;
353
354 // We need to listen to the high-frequency, peak-detected path.
355 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
356 FpgaSetupSsc();
357
358 cmdsRecvd = 0;
359
360 for(;;) {
361 uint8_t b1, b2;
362
363 if(!GetIso14443bCommandFromReader(receivedCmd, &len, 100)) {
364 Dbprintf("button pressed, received %d commands", cmdsRecvd);
365 break;
366 }
367
368 // Good, look at the command now.
369
370 if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
371 resp = resp1; respLen = resp1Len;
372 } else {
373 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
374 // And print whether the CRC fails, just for good measure
375 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
376 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
377 // Not so good, try again.
378 DbpString("+++CRC fail");
379 } else {
380 DbpString("CRC passes");
381 }
382 break;
383 }
384
385 cmdsRecvd++;
386
387 if(cmdsRecvd > 0x30) {
388 DbpString("many commands later...");
389 break;
390 }
391
392 if(respLen <= 0) continue;
393
394 // Modulate BPSK
395 // Signal field is off with the appropriate LED
396 LED_D_OFF();
397 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
398 AT91C_BASE_SSC->SSC_THR = 0xff;
399 FpgaSetupSsc();
400
401 // Transmit the response.
402 i = 0;
403 for(;;) {
404 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
405 uint8_t b = resp[i];
406
407 AT91C_BASE_SSC->SSC_THR = b;
408
409 i++;
410 if(i > respLen) {
411 break;
412 }
413 }
414 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
415 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
416 (void)b;
417 }
418 }
419 }
420}
421
422//=============================================================================
423// An ISO 14443 Type B reader. We take layer two commands, code them
424// appropriately, and then send them to the tag. We then listen for the
425// tag's response, which we leave in the buffer to be demodulated on the
426// PC side.
427//=============================================================================
428
429static struct {
430 enum {
431 DEMOD_UNSYNCD,
432 DEMOD_PHASE_REF_TRAINING,
433 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
434 DEMOD_GOT_FALLING_EDGE_OF_SOF,
435 DEMOD_AWAITING_START_BIT,
436 DEMOD_RECEIVING_DATA,
437 DEMOD_ERROR_WAIT
438 } state;
439 int bitCount;
440 int posCount;
441 int thisBit;
442/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
443 int metric;
444 int metricN;
445*/
446 uint16_t shiftReg;
447 uint8_t *output;
448 int len;
449 int sumI;
450 int sumQ;
451} Demod;
452
453/*
454 * Handles reception of a bit from the tag
455 *
456 * This function is called 2 times per bit (every 4 subcarrier cycles).
457 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
458 *
459 * LED handling:
460 * LED C -> ON once we have received the SOF and are expecting the rest.
461 * LED C -> OFF once we have received EOF or are unsynced
462 *
463 * Returns: true if we received a EOF
464 * false if we are still waiting for some more
465 *
466 */
467static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
468{
469 int v;
470
471 // The soft decision on the bit uses an estimate of just the
472 // quadrant of the reference angle, not the exact angle.
473#define MAKE_SOFT_DECISION() { \
474 if(Demod.sumI > 0) { \
475 v = ci; \
476 } else { \
477 v = -ci; \
478 } \
479 if(Demod.sumQ > 0) { \
480 v += cq; \
481 } else { \
482 v -= cq; \
483 } \
484 }
485
486#define SUBCARRIER_DETECT_THRESHOLD 8
487
488// Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq)
489/* #define CHECK_FOR_SUBCARRIER() { \
490 v = ci; \
491 if(v < 0) v = -v; \
492 if(cq > 0) { \
493 v += cq; \
494 } else { \
495 v -= cq; \
496 } \
497 }
498 */
499// Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
500#define CHECK_FOR_SUBCARRIER() { \
501 if(ci < 0) { \
502 if(cq < 0) { /* ci < 0, cq < 0 */ \
503 if (cq < ci) { \
504 v = -cq - (ci >> 1); \
505 } else { \
506 v = -ci - (cq >> 1); \
507 } \
508 } else { /* ci < 0, cq >= 0 */ \
509 if (cq < -ci) { \
510 v = -ci + (cq >> 1); \
511 } else { \
512 v = cq - (ci >> 1); \
513 } \
514 } \
515 } else { \
516 if(cq < 0) { /* ci >= 0, cq < 0 */ \
517 if (-cq < ci) { \
518 v = ci - (cq >> 1); \
519 } else { \
520 v = -cq + (ci >> 1); \
521 } \
522 } else { /* ci >= 0, cq >= 0 */ \
523 if (cq < ci) { \
524 v = ci + (cq >> 1); \
525 } else { \
526 v = cq + (ci >> 1); \
527 } \
528 } \
529 } \
530 }
531
532 switch(Demod.state) {
533 case DEMOD_UNSYNCD:
534 CHECK_FOR_SUBCARRIER();
535 if(v > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected
536 Demod.state = DEMOD_PHASE_REF_TRAINING;
537 Demod.sumI = ci;
538 Demod.sumQ = cq;
539 Demod.posCount = 1;
540 }
541 break;
542
543 case DEMOD_PHASE_REF_TRAINING:
544 if(Demod.posCount < 8) {
545 CHECK_FOR_SUBCARRIER();
546 if (v > SUBCARRIER_DETECT_THRESHOLD) {
547 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
548 // note: synchronization time > 80 1/fs
549 Demod.sumI += ci;
550 Demod.sumQ += cq;
551 Demod.posCount++;
552 } else { // subcarrier lost
553 Demod.state = DEMOD_UNSYNCD;
554 }
555 } else {
556 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
557 }
558 break;
559
560 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
561 MAKE_SOFT_DECISION();
562 if(v < 0) { // logic '0' detected
563 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
564 Demod.posCount = 0; // start of SOF sequence
565 } else {
566 if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs
567 Demod.state = DEMOD_UNSYNCD;
568 }
569 }
570 Demod.posCount++;
571 break;
572
573 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
574 Demod.posCount++;
575 MAKE_SOFT_DECISION();
576 if(v > 0) {
577 if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
578 Demod.state = DEMOD_UNSYNCD;
579 } else {
580 LED_C_ON(); // Got SOF
581 Demod.state = DEMOD_AWAITING_START_BIT;
582 Demod.posCount = 0;
583 Demod.len = 0;
584/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
585 Demod.metricN = 0;
586 Demod.metric = 0;
587*/
588 }
589 } else {
590 if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu)
591 Demod.state = DEMOD_UNSYNCD;
592 LED_C_OFF();
593 }
594 }
595 break;
596
597 case DEMOD_AWAITING_START_BIT:
598 Demod.posCount++;
599 MAKE_SOFT_DECISION();
600 if(v > 0) {
601 if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
602 Demod.state = DEMOD_UNSYNCD;
603 LED_C_OFF();
604 }
605 } else { // start bit detected
606 Demod.bitCount = 0;
607 Demod.posCount = 1; // this was the first half
608 Demod.thisBit = v;
609 Demod.shiftReg = 0;
610 Demod.state = DEMOD_RECEIVING_DATA;
611 }
612 break;
613
614 case DEMOD_RECEIVING_DATA:
615 MAKE_SOFT_DECISION();
616 if(Demod.posCount == 0) { // first half of bit
617 Demod.thisBit = v;
618 Demod.posCount = 1;
619 } else { // second half of bit
620 Demod.thisBit += v;
621
622/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
623 if(Demod.thisBit > 0) {
624 Demod.metric += Demod.thisBit;
625 } else {
626 Demod.metric -= Demod.thisBit;
627 }
628 (Demod.metricN)++;
629*/
630
631 Demod.shiftReg >>= 1;
632 if(Demod.thisBit > 0) { // logic '1'
633 Demod.shiftReg |= 0x200;
634 }
635
636 Demod.bitCount++;
637 if(Demod.bitCount == 10) {
638 uint16_t s = Demod.shiftReg;
639 if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'
640 uint8_t b = (s >> 1);
641 Demod.output[Demod.len] = b;
642 Demod.len++;
643 Demod.state = DEMOD_AWAITING_START_BIT;
644 } else {
645 Demod.state = DEMOD_UNSYNCD;
646 LED_C_OFF();
647 if(s == 0x000) {
648 // This is EOF (start, stop and all data bits == '0'
649 return TRUE;
650 }
651 }
652 }
653 Demod.posCount = 0;
654 }
655 break;
656
657 default:
658 Demod.state = DEMOD_UNSYNCD;
659 LED_C_OFF();
660 break;
661 }
662
663 return FALSE;
664}
665
666
667static void DemodReset()
668{
669 // Clear out the state of the "UART" that receives from the tag.
670 Demod.len = 0;
671 Demod.state = DEMOD_UNSYNCD;
672 Demod.posCount = 0;
673 memset(Demod.output, 0x00, MAX_FRAME_SIZE);
674}
675
676
677static void DemodInit(uint8_t *data)
678{
679 Demod.output = data;
680 DemodReset();
681}
682
683
684static void UartReset()
685{
686 Uart.byteCntMax = MAX_FRAME_SIZE;
687 Uart.state = STATE_UNSYNCD;
688 Uart.byteCnt = 0;
689 Uart.bitCnt = 0;
690}
691
692
693static void UartInit(uint8_t *data)
694{
695 Uart.output = data;
696 UartReset();
697}
698
699
700/*
701 * Demodulate the samples we received from the tag, also log to tracebuffer
702 * quiet: set to 'TRUE' to disable debug output
703 */
704static void GetSamplesFor14443bDemod(int n, bool quiet)
705{
706 int max = 0;
707 bool gotFrame = FALSE;
708 int lastRxCounter, ci, cq, samples = 0;
709
710 // Allocate memory from BigBuf for some buffers
711 // free all previous allocations first
712 BigBuf_free();
713
714 // The response (tag -> reader) that we're receiving.
715 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
716
717 // The DMA buffer, used to stream samples from the FPGA
718 int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
719
720 // Set up the demodulator for tag -> reader responses.
721 DemodInit(receivedResponse);
722
723 // Setup and start DMA.
724 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
725
726 int8_t *upTo = dmaBuf;
727 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
728
729 // Signal field is ON with the appropriate LED:
730 LED_D_ON();
731 // And put the FPGA in the appropriate mode
732 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
733
734 for(;;) {
735 int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
736 if(behindBy > max) max = behindBy;
737
738 while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
739 ci = upTo[0];
740 cq = upTo[1];
741 upTo += 2;
742 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
743 upTo = dmaBuf;
744 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
745 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
746 }
747 lastRxCounter -= 2;
748 if(lastRxCounter <= 0) {
749 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
750 }
751
752 samples += 2;
753
754 if(Handle14443bSamplesDemod(ci, cq)) {
755 gotFrame = TRUE;
756 break;
757 }
758 }
759
760 if(samples > n || gotFrame) {
761 break;
762 }
763 }
764
765 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
766
767 if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", max, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
768 //Tracing
769 if (tracing && Demod.len > 0) {
770 uint8_t parity[MAX_PARITY_SIZE];
771 GetParity(Demod.output, Demod.len, parity);
772 LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
773 }
774}
775
776
777//-----------------------------------------------------------------------------
778// Transmit the command (to the tag) that was placed in ToSend[].
779//-----------------------------------------------------------------------------
780static void TransmitFor14443b(void)
781{
782 int c;
783
784 FpgaSetupSsc();
785
786 while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
787 AT91C_BASE_SSC->SSC_THR = 0xff;
788 }
789
790 // Signal field is ON with the appropriate Red LED
791 LED_D_ON();
792 // Signal we are transmitting with the Green LED
793 LED_B_ON();
794 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
795
796 for(c = 0; c < 10;) {
797 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
798 AT91C_BASE_SSC->SSC_THR = 0xff;
799 c++;
800 }
801 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
802 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
803 (void)r;
804 }
805 WDT_HIT();
806 }
807
808 c = 0;
809 for(;;) {
810 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
811 AT91C_BASE_SSC->SSC_THR = ToSend[c];
812 c++;
813 if(c >= ToSendMax) {
814 break;
815 }
816 }
817 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
818 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
819 (void)r;
820 }
821 WDT_HIT();
822 }
823 LED_B_OFF(); // Finished sending
824}
825
826
827//-----------------------------------------------------------------------------
828// Code a layer 2 command (string of octets, including CRC) into ToSend[],
829// so that it is ready to transmit to the tag using TransmitFor14443b().
830//-----------------------------------------------------------------------------
831static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
832{
833 int i, j;
834 uint8_t b;
835
836 ToSendReset();
837
838 // Establish initial reference level
839 for(i = 0; i < 40; i++) {
840 ToSendStuffBit(1);
841 }
842 // Send SOF
843 for(i = 0; i < 10; i++) {
844 ToSendStuffBit(0);
845 }
846
847 for(i = 0; i < len; i++) {
848 // Stop bits/EGT
849 ToSendStuffBit(1);
850 ToSendStuffBit(1);
851 // Start bit
852 ToSendStuffBit(0);
853 // Data bits
854 b = cmd[i];
855 for(j = 0; j < 8; j++) {
856 if(b & 1) {
857 ToSendStuffBit(1);
858 } else {
859 ToSendStuffBit(0);
860 }
861 b >>= 1;
862 }
863 }
864 // Send EOF
865 ToSendStuffBit(1);
866 for(i = 0; i < 10; i++) {
867 ToSendStuffBit(0);
868 }
869 for(i = 0; i < 8; i++) {
870 ToSendStuffBit(1);
871 }
872
873 // And then a little more, to make sure that the last character makes
874 // it out before we switch to rx mode.
875 for(i = 0; i < 24; i++) {
876 ToSendStuffBit(1);
877 }
878
879 // Convert from last character reference to length
880 ToSendMax++;
881}
882
883
884//-----------------------------------------------------------------------------
885// Read an ISO 14443B tag. We send it some set of commands, and record the
886// responses.
887// The command name is misleading, it actually decodes the reponse in HEX
888// into the output buffer (read the result using hexsamples, not hisamples)
889//
890// obsolete function only for test
891//-----------------------------------------------------------------------------
892void AcquireRawAdcSamplesIso14443b(uint32_t parameter)
893{
894 uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // REQB with AFI=0, Request All, N=0
895
896 SendRawCommand14443B(sizeof(cmd1),1,1,cmd1);
897}
898
899
900/**
901 Convenience function to encode, transmit and trace iso 14443b comms
902 **/
903static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
904{
905 CodeIso14443bAsReader(cmd, len);
906 TransmitFor14443b();
907 if (tracing) {
908 uint8_t parity[MAX_PARITY_SIZE];
909 GetParity(cmd, len, parity);
910 LogTrace(cmd,len, 0, 0, parity, TRUE);
911 }
912}
913
914
915//-----------------------------------------------------------------------------
916// Read a SRI512 ISO 14443B tag.
917//
918// SRI512 tags are just simple memory tags, here we're looking at making a dump
919// of the contents of the memory. No anticollision algorithm is done, we assume
920// we have a single tag in the field.
921//
922// I tried to be systematic and check every answer of the tag, every CRC, etc...
923//-----------------------------------------------------------------------------
924void ReadSTMemoryIso14443b(uint32_t dwLast)
925{
926 clear_trace();
927 set_tracing(TRUE);
928
929 uint8_t i = 0x00;
930
931 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
932 // Make sure that we start from off, since the tags are stateful;
933 // confusing things will happen if we don't reset them between reads.
934 LED_D_OFF();
935 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
936 SpinDelay(200);
937
938 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
939 FpgaSetupSsc();
940
941 // Now give it time to spin up.
942 // Signal field is on with the appropriate LED
943 LED_D_ON();
944 FpgaWriteConfWord(
945 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
946 SpinDelay(200);
947
948 // First command: wake up the tag using the INITIATE command
949 uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
950
951 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
952// LED_A_ON();
953 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
954// LED_A_OFF();
955
956 if (Demod.len == 0) {
957 DbpString("No response from tag");
958 return;
959 } else {
960 Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",
961 Demod.output[0], Demod.output[1],Demod.output[2]);
962 }
963 // There is a response, SELECT the uid
964 DbpString("Now SELECT tag:");
965 cmd1[0] = 0x0E; // 0x0E is SELECT
966 cmd1[1] = Demod.output[0];
967 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
968 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
969
970// LED_A_ON();
971 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
972// LED_A_OFF();
973 if (Demod.len != 3) {
974 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
975 return;
976 }
977 // Check the CRC of the answer:
978 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
979 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
980 DbpString("CRC Error reading select response.");
981 return;
982 }
983 // Check response from the tag: should be the same UID as the command we just sent:
984 if (cmd1[1] != Demod.output[0]) {
985 Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);
986 return;
987 }
988 // Tag is now selected,
989 // First get the tag's UID:
990 cmd1[0] = 0x0B;
991 ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
992 CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
993
994// LED_A_ON();
995 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
996// LED_A_OFF();
997 if (Demod.len != 10) {
998 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
999 return;
1000 }
1001 // The check the CRC of the answer (use cmd1 as temporary variable):
1002 ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
1003 if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
1004 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
1005 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
1006 // Do not return;, let's go on... (we should retry, maybe ?)
1007 }
1008 Dbprintf("Tag UID (64 bits): %08x %08x",
1009 (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
1010 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
1011
1012 // Now loop to read all 16 blocks, address from 0 to last block
1013 Dbprintf("Tag memory dump, block 0 to %d",dwLast);
1014 cmd1[0] = 0x08;
1015 i = 0x00;
1016 dwLast++;
1017 for (;;) {
1018 if (i == dwLast) {
1019 DbpString("System area block (0xff):");
1020 i = 0xff;
1021 }
1022 cmd1[1] = i;
1023 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1024 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
1025
1026// LED_A_ON();
1027 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
1028// LED_A_OFF();
1029 if (Demod.len != 6) { // Check if we got an answer from the tag
1030 DbpString("Expected 6 bytes from tag, got less...");
1031 return;
1032 }
1033 // The check the CRC of the answer (use cmd1 as temporary variable):
1034 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
1035 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
1036 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
1037 (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
1038 // Do not return;, let's go on... (we should retry, maybe ?)
1039 }
1040 // Now print out the memory location:
1041 Dbprintf("Address=%x, Contents=%x, CRC=%x", i,
1042 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1043 (Demod.output[4]<<8)+Demod.output[5]);
1044 if (i == 0xff) {
1045 break;
1046 }
1047 i++;
1048 }
1049}
1050
1051
1052//=============================================================================
1053// Finally, the `sniffer' combines elements from both the reader and
1054// simulated tag, to show both sides of the conversation.
1055//=============================================================================
1056
1057//-----------------------------------------------------------------------------
1058// Record the sequence of commands sent by the reader to the tag, with
1059// triggering so that we start recording at the point that the tag is moved
1060// near the reader.
1061//-----------------------------------------------------------------------------
1062/*
1063 * Memory usage for this function, (within BigBuf)
1064 * Last Received command (reader->tag) - MAX_FRAME_SIZE
1065 * Last Received command (tag->reader) - MAX_FRAME_SIZE
1066 * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
1067 * Demodulated samples received - all the rest
1068 */
1069void RAMFUNC SnoopIso14443b(void)
1070{
1071 // We won't start recording the frames that we acquire until we trigger;
1072 // a good trigger condition to get started is probably when we see a
1073 // response from the tag.
1074 int triggered = TRUE; // TODO: set and evaluate trigger condition
1075
1076 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1077 BigBuf_free();
1078
1079 clear_trace();
1080 set_tracing(TRUE);
1081
1082 // The DMA buffer, used to stream samples from the FPGA
1083 int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
1084 int lastRxCounter;
1085 int8_t *upTo;
1086 int ci, cq;
1087 int maxBehindBy = 0;
1088
1089 // Count of samples received so far, so that we can include timing
1090 // information in the trace buffer.
1091 int samples = 0;
1092
1093 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
1094 UartInit(BigBuf_malloc(MAX_FRAME_SIZE));
1095
1096 // Print some debug information about the buffer sizes
1097 Dbprintf("Snooping buffers initialized:");
1098 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1099 Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
1100 Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
1101 Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
1102
1103 // Signal field is off, no reader signal, no tag signal
1104 LEDsoff();
1105
1106 // And put the FPGA in the appropriate mode
1107 FpgaWriteConfWord(
1108 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
1109 FPGA_HF_READER_RX_XCORR_SNOOP);
1110 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1111
1112 // Setup for the DMA.
1113 FpgaSetupSsc();
1114 upTo = dmaBuf;
1115 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
1116 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
1117 uint8_t parity[MAX_PARITY_SIZE];
1118
1119 bool TagIsActive = FALSE;
1120 bool ReaderIsActive = FALSE;
1121
1122 // And now we loop, receiving samples.
1123 for(;;) {
1124 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
1125 (ISO14443B_DMA_BUFFER_SIZE-1);
1126 if(behindBy > maxBehindBy) {
1127 maxBehindBy = behindBy;
1128 }
1129
1130 if(behindBy < 2) continue;
1131
1132 ci = upTo[0];
1133 cq = upTo[1];
1134 upTo += 2;
1135 lastRxCounter -= 2;
1136 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
1137 upTo = dmaBuf;
1138 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
1139 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
1140 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
1141 WDT_HIT();
1142 if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
1143 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
1144 break;
1145 }
1146 if(!tracing) {
1147 DbpString("Reached trace limit");
1148 break;
1149 }
1150 if(BUTTON_PRESS()) {
1151 DbpString("cancelled");
1152 break;
1153 }
1154 }
1155
1156 samples += 2;
1157
1158 if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
1159 if(Handle14443bUartBit(ci & 0x01)) {
1160 if(triggered && tracing) {
1161 GetParity(Uart.output, Uart.byteCnt, parity);
1162 LogTrace(Uart.output,Uart.byteCnt,samples, samples,parity,TRUE);
1163 }
1164 /* And ready to receive another command. */
1165 UartReset();
1166 /* And also reset the demod code, which might have been */
1167 /* false-triggered by the commands from the reader. */
1168 DemodReset();
1169 }
1170 if(Handle14443bUartBit(cq & 0x01)) {
1171 if(triggered && tracing) {
1172 GetParity(Uart.output, Uart.byteCnt, parity);
1173 LogTrace(Uart.output,Uart.byteCnt,samples, samples, parity, TRUE);
1174 }
1175 /* And ready to receive another command. */
1176 UartReset();
1177 /* And also reset the demod code, which might have been */
1178 /* false-triggered by the commands from the reader. */
1179 DemodReset();
1180 }
1181 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
1182 }
1183
1184 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
1185 if(Handle14443bSamplesDemod(ci & 0xFE, cq & 0xFE)) {
1186
1187 //Use samples as a time measurement
1188 if(tracing)
1189 {
1190 uint8_t parity[MAX_PARITY_SIZE];
1191 GetParity(Demod.output, Demod.len, parity);
1192 LogTrace(Demod.output, Demod.len,samples, samples, parity, FALSE);
1193 }
1194 triggered = TRUE;
1195
1196 // And ready to receive another response.
1197 DemodReset();
1198 }
1199 TagIsActive = (Demod.state > DEMOD_PHASE_REF_TRAINING);
1200 }
1201
1202 }
1203
1204 FpgaDisableSscDma();
1205 LEDsoff();
1206 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
1207 DbpString("Snoop statistics:");
1208 Dbprintf(" Max behind by: %i", maxBehindBy);
1209 Dbprintf(" Uart State: %x", Uart.state);
1210 Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);
1211 Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);
1212 Dbprintf(" Trace length: %i", BigBuf_get_traceLen());
1213}
1214
1215
1216/*
1217 * Send raw command to tag ISO14443B
1218 * @Input
1219 * datalen len of buffer data
1220 * recv bool when true wait for data from tag and send to client
1221 * powerfield bool leave the field on when true
1222 * data buffer with byte to send
1223 *
1224 * @Output
1225 * none
1226 *
1227 */
1228void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])
1229{
1230 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1231 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1232 FpgaSetupSsc();
1233
1234 set_tracing(TRUE);
1235
1236/* if(!powerfield) {
1237 // Make sure that we start from off, since the tags are stateful;
1238 // confusing things will happen if we don't reset them between reads.
1239 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1240 LED_D_OFF();
1241 SpinDelay(200);
1242 }
1243 */
1244
1245 // if(!GETBIT(GPIO_LED_D)) { // if field is off
1246 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
1247 // // Signal field is on with the appropriate LED
1248 // LED_D_ON();
1249 // SpinDelay(200);
1250 // }
1251
1252 CodeAndTransmit14443bAsReader(data, datalen);
1253
1254 if(recv) {
1255 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
1256 uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);
1257 cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);
1258 }
1259
1260 if(!powerfield) {
1261 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1262 LED_D_OFF();
1263 }
1264}
1265
Impressum, Datenschutz