1 //-----------------------------------------------------------------------------
2 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
3 // at your option, any later version. See the LICENSE.txt file for the text of
5 //-----------------------------------------------------------------------------
6 // HitagS emulation (preliminary test version)
8 // (c) 2016 Oguzhan Cicek, Hendrik Schwartke, Ralf Spenneberg
10 //-----------------------------------------------------------------------------
11 // Some code was copied from Hitag2.c
12 //-----------------------------------------------------------------------------
17 #include "proxmark3.h"
25 #define CRC_PRESET 0xFF
26 #define CRC_POLYNOM 0x1D
31 #define rev8(x) ((((x)>>7)&1)+((((x)>>6)&1)<<1)+((((x)>>5)&1)<<2)+((((x)>>4)&1)<<3)+((((x)>>3)&1)<<4)+((((x)>>2)&1)<<5)+((((x)>>1)&1)<<6)+(((x)&1)<<7))
32 #define rev16(x) (rev8 (x)+(rev8 (x>> 8)<< 8))
33 #define rev32(x) (rev16(x)+(rev16(x>>16)<<16))
34 #define rev64(x) (rev32(x)+(rev32(x>>32)<<32))
35 #define bit(x,n) (((x)>>(n))&1)
36 #define bit32(x,n) ((((x)[(n)>>5])>>((n)))&1)
37 #define inv32(x,i,n) ((x)[(i)>>5]^=((u32)(n))<<((i)&31))
38 #define rotl64(x, n) ((((u64)(x))<<((n)&63))+(((u64)(x))>>((0-(n))&63)))
41 static bool bSuccessful
;
42 static struct hitagS_tag tag
;
43 static byte_t page_to_be_written
= 0;
44 static int block_data_left
= 0;
45 typedef enum modulation
{
51 static MOD m
= AC2K
; //used modulation
52 static uint32_t temp_uid
;
54 static int sof_bits
; //number of start-of-frame bits
55 static byte_t pwdh0
, pwdl0
, pwdl1
; //password bytes
56 static uint32_t rnd
= 0x74124485; //randomnumber
61 // Single bit Hitag2 functions:
62 #define i4(x,a,b,c,d) ((u32)((((x)>>(a))&1)+(((x)>>(b))&1)*2+(((x)>>(c))&1)*4+(((x)>>(d))&1)*8))
63 static const u32 ht2_f4a
= 0x2C79; // 0010 1100 0111 1001
64 static const u32 ht2_f4b
= 0x6671; // 0110 0110 0111 0001
65 static const u32 ht2_f5c
= 0x7907287B; // 0111 1001 0000 0111 0010 1000 0111 1011
66 #define ht2bs_4a(a,b,c,d) (~(((a|b)&c)^(a|d)^b))
67 #define ht2bs_4b(a,b,c,d) (~(((d|c)&(a^b))^(d|a|b)))
68 #define ht2bs_5c(a,b,c,d,e) (~((((((c^e)|d)&a)^b)&(c^b))^(((d^e)|a)&((d^b)|c))))
71 static u32
f20(const u64 x
) {
74 i5
= ((ht2_f4a
>> i4(x
, 1, 2, 4, 5)) & 1) * 1
75 + ((ht2_f4b
>> i4(x
, 7, 11, 13, 14)) & 1) * 2
76 + ((ht2_f4b
>> i4(x
, 16, 20, 22, 25)) & 1) * 4
77 + ((ht2_f4b
>> i4(x
, 27, 28, 30, 32)) & 1) * 8
78 + ((ht2_f4a
>> i4(x
, 33, 42, 43, 45)) & 1) * 16;
80 return (ht2_f5c
>> i5
) & 1;
82 static u64
hitag2_round(u64
*state
) {
86 + ((((x
>> 0) ^ (x
>> 2) ^ (x
>> 3) ^ (x
>> 6) ^ (x
>> 7) ^ (x
>> 8)
87 ^ (x
>> 16) ^ (x
>> 22) ^ (x
>> 23) ^ (x
>> 26) ^ (x
>> 30)
88 ^ (x
>> 41) ^ (x
>> 42) ^ (x
>> 43) ^ (x
>> 46) ^ (x
>> 47))
94 static u64
hitag2_init(const u64 key
, const u32 serial
, const u32 IV
) {
96 u64 x
= ((key
& 0xFFFF) << 32) + serial
;
97 for (i
= 0; i
< 32; i
++) {
99 x
+= (u64
) (f20(x
) ^ (((IV
>> i
) ^ (key
>> (i
+ 16))) & 1)) << 47;
103 static u32
hitag2_byte(u64
*x
) {
106 for (i
= 0, c
= 0; i
< 8; i
++)
107 c
+= (u32
) hitag2_round(x
) << (i
^ 7);
111 // Sam7s has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK)
112 // TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz
113 // Hitag units (T0) have duration of 8 microseconds (us), which is 1/125000 per second (carrier)
114 // T0 = TIMER_CLOCK1 / 125000 = 192
117 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
118 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
120 #define HITAG_FRAME_LEN 20
121 #define HITAG_T_STOP 36 /* T_EOF should be > 36 */
122 #define HITAG_T_LOW 8 /* T_LOW should be 4..10 */
123 #define HITAG_T_0_MIN 15 /* T[0] should be 18..22 */
124 #define HITAG_T_1_MIN 25 /* T[1] should be 26..30 */
125 //#define HITAG_T_EOF 40 /* T_EOF should be > 36 */
126 #define HITAG_T_EOF 80 /* T_EOF should be > 36 */
127 #define HITAG_T_WAIT_1 200 /* T_wresp should be 199..206 */
128 #define HITAG_T_WAIT_2 90 /* T_wresp should be 199..206 */
129 #define HITAG_T_WAIT_MAX 300 /* bit more than HITAG_T_WAIT_1 + HITAG_T_WAIT_2 */
131 #define HITAG_T_TAG_ONE_HALF_PERIOD 10
132 #define HITAG_T_TAG_TWO_HALF_PERIOD 25
133 #define HITAG_T_TAG_THREE_HALF_PERIOD 41
134 #define HITAG_T_TAG_FOUR_HALF_PERIOD 57
136 #define HITAG_T_TAG_HALF_PERIOD 16
137 #define HITAG_T_TAG_FULL_PERIOD 32
139 #define HITAG_T_TAG_CAPTURE_ONE_HALF 13
140 #define HITAG_T_TAG_CAPTURE_TWO_HALF 25
141 #define HITAG_T_TAG_CAPTURE_THREE_HALF 41
142 #define HITAG_T_TAG_CAPTURE_FOUR_HALF 57
147 * Implementation of the crc8 calculation from Hitag S
148 * from http://www.proxmark.org/files/Documents/125%20kHz%20-%20Hitag/HitagS.V11.pdf
150 void calc_crc(unsigned char * crc
, unsigned char data
, unsigned char Bitcount
) {
151 *crc
^= data
; // crc = crc (exor) data
153 if (*crc
& 0x80) // if (MSB-CRC == 1)
155 *crc
<<= 1; // CRC = CRC Bit-shift left
156 *crc
^= CRC_POLYNOM
; // CRC = CRC (exor) CRC_POLYNOM
158 *crc
<<= 1; // CRC = CRC Bit-shift left
160 } while (--Bitcount
);
163 static void hitag_send_bit(int bit
) {
165 // Reset clock for the next bit
166 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_SWTRG
;
173 while (AT91C_BASE_TC0
->TC_CV
< T0
* 32)
176 while (AT91C_BASE_TC0
->TC_CV
< T0
* 64)
181 while (AT91C_BASE_TC0
->TC_CV
< T0
* 16)
184 while (AT91C_BASE_TC0
->TC_CV
< T0
* 32)
187 while (AT91C_BASE_TC0
->TC_CV
< T0
* 48)
190 while (AT91C_BASE_TC0
->TC_CV
< T0
* 64)
199 while (AT91C_BASE_TC0
->TC_CV
< T0
* HITAG_T_TAG_HALF_PERIOD
)
202 while (AT91C_BASE_TC0
->TC_CV
< T0
* HITAG_T_TAG_FULL_PERIOD
)
207 while (AT91C_BASE_TC0
->TC_CV
< T0
* 8)
210 while (AT91C_BASE_TC0
->TC_CV
< T0
* 16)
213 while (AT91C_BASE_TC0
->TC_CV
< T0
* 24)
216 while (AT91C_BASE_TC0
->TC_CV
< T0
* 32)
223 // Manchester: Unloaded, then loaded |__--|
225 while (AT91C_BASE_TC0
->TC_CV
< T0
* 16)
228 while (AT91C_BASE_TC0
->TC_CV
< T0
* 32)
231 // Manchester: Loaded, then unloaded |--__|
233 while (AT91C_BASE_TC0
->TC_CV
< T0
* 16)
236 while (AT91C_BASE_TC0
->TC_CV
< T0
* 32)
243 // Manchester: Unloaded, then loaded |__--|
245 while (AT91C_BASE_TC0
->TC_CV
< T0
* 8)
248 while (AT91C_BASE_TC0
->TC_CV
< T0
* 16)
251 // Manchester: Loaded, then unloaded |--__|
253 while (AT91C_BASE_TC0
->TC_CV
< T0
* 8)
256 while (AT91C_BASE_TC0
->TC_CV
< T0
* 16)
266 static void hitag_send_frame(const byte_t
* frame
, size_t frame_len
) {
267 // Send start of frame
269 for (size_t i
= 0; i
< sof_bits
; i
++) {
273 // Send the content of the frame
274 for (size_t i
= 0; i
< frame_len
; i
++) {
275 hitag_send_bit((frame
[i
/ 8] >> (7 - (i
% 8))) & 1);
277 // Drop the modulation
281 static void hitag_reader_send_bit(int bit
) {
282 //Dbprintf("BIT: %d",bit);
284 // Reset clock for the next bit
285 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_SWTRG
;
287 // Binary puls length modulation (BPLM) is used to encode the data stream
288 // This means that a transmission of a one takes longer than that of a zero
290 // Enable modulation, which means, drop the the field
293 // Wait for 4-10 times the carrier period
294 while (AT91C_BASE_TC0
->TC_CV
< T0
* 6)
298 // Disable modulation, just activates the field again
303 while (AT91C_BASE_TC0
->TC_CV
< T0
* 11)
305 // SpinDelayUs(16*8);
308 while (AT91C_BASE_TC0
->TC_CV
< T0
* 14)
310 // SpinDelayUs(22*8);
313 // Wait for 4-10 times the carrier period
314 while (AT91C_BASE_TC0
->TC_CV
< T0
* 6)
318 // Disable modulation, just activates the field again
323 while (AT91C_BASE_TC0
->TC_CV
< T0
* 22)
325 // SpinDelayUs(16*8);
328 while (AT91C_BASE_TC0
->TC_CV
< T0
* 28)
330 // SpinDelayUs(22*8);
337 static void hitag_reader_send_frame(const byte_t
* frame
, size_t frame_len
) {
338 // Send the content of the frame
339 for (size_t i
= 0; i
< frame_len
; i
++) {
340 if (frame
[0] == 0xf8) {
341 //Dbprintf("BIT: %d",(frame[i / 8] >> (7 - (i % 8))) & 1);
343 hitag_reader_send_bit((frame
[i
/ 8] >> (7 - (i
% 8))) & 1);
346 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_SWTRG
;
347 // Enable modulation, which means, drop the the field
349 // Wait for 4-10 times the carrier period
350 while (AT91C_BASE_TC0
->TC_CV
< T0
* 6)
352 // Disable modulation, just activates the field again
357 * to check if the right uid was selected
359 static int check_select(byte_t
* rx
, uint32_t uid
) {
360 unsigned char resp
[48];
363 for (i
= 0; i
< 48; i
++)
364 resp
[i
] = (rx
[i
/ 8] >> (7 - (i
% 8))) & 0x1;
365 for (i
= 0; i
< 32; i
++)
366 ans
+= resp
[5 + i
] << (31 - i
);
367 /*if (rx[0] == 0x01 && rx[1] == 0x15 && rx[2] == 0xc1 && rx[3] == 0x14
368 && rx[4] == 0x65 && rx[5] == 0x38)
369 Dbprintf("got uid %X", ans);*/
377 * handles all commands from a reader
379 static void hitagS_handle_reader_command(byte_t
* rx
, const size_t rxlen
,
380 byte_t
* tx
, size_t* txlen
) {
381 byte_t rx_air
[HITAG_FRAME_LEN
];
387 // Copy the (original) received frame how it is send over the air
388 memcpy(rx_air
, rx
, nbytes(rxlen
));
389 // Reset the transmission frame length
391 // Try to find out which command was send by selecting on length (in bits)
394 //UID request with a selected response protocol mode
395 tag
.pstate
= HT_READY
;
396 tag
.tstate
= HT_NO_OP
;
397 if ((rx
[0] & 0xf0) == 0x30) {
398 tag
.mode
= HT_STANDARD
;
402 if ((rx
[0] & 0xf0) == 0xc0) {
403 tag
.mode
= HT_ADVANCED
;
408 if ((rx
[0] & 0xf0) == 0xd0) {
409 tag
.mode
= HT_FAST_ADVANCED
;
413 //send uid as a response
415 for (i
= 0; i
< 4; i
++)
416 tx
[i
] = (tag
.uid
>> (24 - (i
* 8))) & 0xff;
420 //select command from reader received
421 if (check_select(rx
, tag
.uid
) == 1) {
422 //if the right tag was selected
433 case HT_FAST_ADVANCED
:
442 for (i
= 0; i
< 4; i
++)
443 tx
[i
] = (tag
.pages
[0][1] >> (i
* 8)) & 0xff;
445 if (tag
.mode
!= HT_STANDARD
) {
448 for (i
= 0; i
< 4; i
++)
449 calc_crc(&crc
, tx
[i
], 8);
456 //challenge message received
457 Dbprintf("Challenge for UID: %X", temp_uid
);
460 state
= hitag2_init(rev64(tag
.key
), rev32(tag
.pages
[0][0]),
461 rev32(((rx
[3] << 24) + (rx
[2] << 16) + (rx
[1] << 8) + rx
[0])));
463 ",{0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X}",
464 rx
[0], rx
[1], rx
[2], rx
[3], rx
[4], rx
[5], rx
[6], rx
[7]);
474 case HT_FAST_ADVANCED
:
482 for (i
= 0; i
< 4; i
++)
484 //send con2,pwdh0,pwdl0,pwdl1 encrypted as a response
485 tx
[0] = hitag2_byte(&state
) ^ ((tag
.pages
[0][1] >> 16) & 0xff);
486 tx
[1] = hitag2_byte(&state
) ^ tag
.pwdh0
;
487 tx
[2] = hitag2_byte(&state
) ^ tag
.pwdl0
;
488 tx
[3] = hitag2_byte(&state
) ^ tag
.pwdl1
;
489 if (tag
.mode
!= HT_STANDARD
) {
493 calc_crc(&crc
, ((tag
.pages
[0][1] >> 16) & 0xff), 8);
494 calc_crc(&crc
, tag
.pwdh0
, 8);
495 calc_crc(&crc
, tag
.pwdl0
, 8);
496 calc_crc(&crc
, tag
.pwdl1
, 8);
497 tx
[4] = (crc
^ hitag2_byte(&state
));
500 * some readers do not allow to authenticate multiple times in a row with the same tag.
501 * use this to change the uid between authentications.
505 if (temp2 % 2 == 0) {
506 tag.uid = 0x11223344;
507 tag.pages[0][0] = 0x44332211;
509 tag.uid = 0x55667788;
510 tag.pages[0][0] = 0x88776655;
515 //data received to be written
516 if (tag
.tstate
== HT_WRITING_PAGE_DATA
) {
517 tag
.tstate
= HT_NO_OP
;
518 tag
.pages
[page_to_be_written
/ 4][page_to_be_written
% 4] = (rx
[0]
519 << 0) + (rx
[1] << 8) + (rx
[2] << 16) + (rx
[3] << 24);
523 page_to_be_written
= 0;
533 case HT_FAST_ADVANCED
:
540 } else if (tag
.tstate
== HT_WRITING_BLOCK_DATA
) {
541 tag
.pages
[page_to_be_written
/ 4][page_to_be_written
% 4] = (rx
[0]
542 << 24) + (rx
[1] << 16) + (rx
[2] << 8) + rx
[3];
555 case HT_FAST_ADVANCED
:
562 page_to_be_written
++;
564 if (block_data_left
== 0) {
565 tag
.tstate
= HT_NO_OP
;
566 page_to_be_written
= 0;
571 //write page, write block, read page or read block command received
572 if ((rx
[0] & 0xf0) == 0xc0) //read page
575 page
= ((rx
[0] & 0x0f) * 16) + ((rx
[1] & 0xf0) / 16);
577 tx
[0] = (tag
.pages
[page
/ 4][page
% 4]) & 0xff;
578 tx
[1] = (tag
.pages
[page
/ 4][page
% 4] >> 8) & 0xff;
579 tx
[2] = (tag
.pages
[page
/ 4][page
% 4] >> 16) & 0xff;
580 tx
[3] = (tag
.pages
[page
/ 4][page
% 4] >> 24) & 0xff;
581 if (tag
.LKP
&& page
== 1)
593 case HT_FAST_ADVANCED
:
601 if (tag
.mode
!= HT_STANDARD
) {
605 for (i
= 0; i
< 4; i
++)
606 calc_crc(&crc
, tx
[i
], 8);
610 if (tag
.LKP
&& (page
== 2 || page
== 3)) {
611 //if reader asks for key or password and the LKP-mark is set do not respond
615 } else if ((rx
[0] & 0xf0) == 0xd0) //read block
617 page
= ((rx
[0] & 0x0f) * 16) + ((rx
[1] & 0xf0) / 16);
619 //send page,...,page+3 data
620 for (i
= 0; i
< 4; i
++) {
621 tx
[0 + i
* 4] = (tag
.pages
[page
/ 4][page
% 4]) & 0xff;
622 tx
[1 + i
* 4] = (tag
.pages
[page
/ 4][page
% 4] >> 8) & 0xff;
623 tx
[2 + i
* 4] = (tag
.pages
[page
/ 4][page
% 4] >> 16) & 0xff;
624 tx
[3 + i
* 4] = (tag
.pages
[page
/ 4][page
% 4] >> 24) & 0xff;
637 case HT_FAST_ADVANCED
:
645 if (tag
.mode
!= HT_STANDARD
) {
649 for (i
= 0; i
< 16; i
++)
650 calc_crc(&crc
, tx
[i
], 8);
654 if ((page
- 4) % 4 != 0 || (tag
.LKP
&& (page
- 4) == 0)) {
658 } else if ((rx
[0] & 0xf0) == 0x80) //write page
660 page
= ((rx
[0] & 0x0f) * 16) + ((rx
[1] & 0xf0) / 16);
671 case HT_FAST_ADVANCED
:
678 if ((tag
.LCON
&& page
== 1)
679 || (tag
.LKP
&& (page
== 2 || page
== 3))) {
686 page_to_be_written
= page
;
687 tag
.tstate
= HT_WRITING_PAGE_DATA
;
690 } else if ((rx
[0] & 0xf0) == 0x90) //write block
692 page
= ((rx
[0] & 0x0f) * 6) + ((rx
[1] & 0xf0) / 16);
702 case HT_FAST_ADVANCED
:
709 if (page
% 4 != 0 || page
== 0) {
716 page_to_be_written
= page
;
718 tag
.tstate
= HT_WRITING_BLOCK_DATA
;
730 * to autenticate to a tag with the given key or challenge
732 static int hitagS_handle_tag_auth(hitag_function htf
,uint64_t key
, uint64_t NrAr
, byte_t
* rx
, const size_t rxlen
, byte_t
* tx
,
734 byte_t rx_air
[HITAG_FRAME_LEN
];
735 int response_bit
[200];
737 unsigned char mask
= 1;
738 unsigned char uid
[32];
739 byte_t uid1
= 0x00, uid2
= 0x00, uid3
= 0x00, uid4
= 0x00;
743 byte_t conf_pages
[3];
744 memcpy(rx_air
, rx
, nbytes(rxlen
));
747 if (tag
.pstate
== HT_READY
&& rxlen
>= 67) {
750 Dbprintf("authentication failed!");
754 for (i
= 0; i
< 10; i
++) {
755 for (j
= 0; j
< 8; j
++) {
757 if ((rx
[i
] & ((mask
<< 7) >> j
)) != 0)
763 for (i
= 5; i
< z
; i
+= 2) {
764 uid
[k
] = response_bit
[i
];
769 uid1
= (uid
[0] << 7) | (uid
[1] << 6) | (uid
[2] << 5) | (uid
[3] << 4)
770 | (uid
[4] << 3) | (uid
[5] << 2) | (uid
[6] << 1) | uid
[7];
771 uid2
= (uid
[8] << 7) | (uid
[9] << 6) | (uid
[10] << 5) | (uid
[11] << 4)
772 | (uid
[12] << 3) | (uid
[13] << 2) | (uid
[14] << 1) | uid
[15];
773 uid3
= (uid
[16] << 7) | (uid
[17] << 6) | (uid
[18] << 5) | (uid
[19] << 4)
774 | (uid
[20] << 3) | (uid
[21] << 2) | (uid
[22] << 1) | uid
[23];
775 uid4
= (uid
[24] << 7) | (uid
[25] << 6) | (uid
[26] << 5) | (uid
[27] << 4)
776 | (uid
[28] << 3) | (uid
[29] << 2) | (uid
[30] << 1) | uid
[31];
778 Dbprintf("UID: %02X %02X %02X %02X", uid1
, uid2
, uid3
, uid4
);
779 tag
.uid
= (uid4
<< 24 | uid3
<< 16 | uid2
<< 8 | uid1
);
784 calc_crc(&crc
, 0x00, 5);
785 calc_crc(&crc
, uid1
, 8);
786 calc_crc(&crc
, uid2
, 8);
787 calc_crc(&crc
, uid3
, 8);
788 calc_crc(&crc
, uid4
, 8);
789 for (i
= 0; i
< 100; i
++) {
792 for (i
= 0; i
< 5; i
++) {
795 for (i
= 5; i
< 37; i
++) {
796 response_bit
[i
] = uid
[i
- 5];
798 for (j
= 0; j
< 8; j
++) {
800 if ((crc
& ((mask
<< 7) >> j
)) != 0)
805 for (i
= 0; i
< 6; i
++) {
806 tx
[i
] = (response_bit
[k
] << 7) | (response_bit
[k
+ 1] << 6)
807 | (response_bit
[k
+ 2] << 5) | (response_bit
[k
+ 3] << 4)
808 | (response_bit
[k
+ 4] << 3) | (response_bit
[k
+ 5] << 2)
809 | (response_bit
[k
+ 6] << 1) | response_bit
[k
+ 7];
812 tag
.pstate
= HT_INIT
;
813 } else if (tag
.pstate
== HT_INIT
&& rxlen
== 44) {
814 // received configuration after select command
816 for (i
= 0; i
< 6; i
++) {
817 for (j
= 0; j
< 8; j
++) {
819 if ((rx
[i
] & ((mask
<< 7) >> j
)) != 0)
824 conf_pages
[0] = ((response_bit
[4] << 7) | (response_bit
[5] << 6)
825 | (response_bit
[6] << 5) | (response_bit
[7] << 4)
826 | (response_bit
[8] << 3) | (response_bit
[9] << 2)
827 | (response_bit
[10] << 1) | response_bit
[11]);
828 //check wich memorysize this tag has
829 if (response_bit
[10] == 0 && response_bit
[11] == 0)
830 tag
.max_page
= 32 / 32;
831 if (response_bit
[10] == 0 && response_bit
[11] == 1)
832 tag
.max_page
= 256 / 32;
833 if (response_bit
[10] == 1 && response_bit
[11] == 0)
834 tag
.max_page
= 2048 / 32;
835 conf_pages
[1] = ((response_bit
[12] << 7) | (response_bit
[13] << 6)
836 | (response_bit
[14] << 5) | (response_bit
[15] << 4)
837 | (response_bit
[16] << 3) | (response_bit
[17] << 2)
838 | (response_bit
[18] << 1) | response_bit
[19]);
839 tag
.auth
= response_bit
[12];
840 tag
.TTFC
= response_bit
[13];
841 //tag.TTFDR in response_bit[14] and response_bit[15]
842 //tag.TTFM in response_bit[16] and response_bit[17]
843 tag
.LCON
= response_bit
[18];
844 tag
.LKP
= response_bit
[19];
845 conf_pages
[2] = ((response_bit
[20] << 7) | (response_bit
[21] << 6)
846 | (response_bit
[22] << 5) | (response_bit
[23] << 4)
847 | (response_bit
[24] << 3) | (response_bit
[25] << 2)
848 | (response_bit
[26] << 1) | response_bit
[27]);
849 tag
.LCK7
= response_bit
[20];
850 tag
.LCK6
= response_bit
[21];
851 tag
.LCK5
= response_bit
[22];
852 tag
.LCK4
= response_bit
[23];
853 tag
.LCK3
= response_bit
[24];
854 tag
.LCK2
= response_bit
[25];
855 tag
.LCK1
= response_bit
[26];
856 tag
.LCK0
= response_bit
[27];
859 Dbprintf("conf0: %02X conf1: %02X conf2: %02X", conf_pages
[0],
860 conf_pages
[1], conf_pages
[2]);
862 //if the tag is in authentication mode try the key or challenge
865 if(htf
==02||htf
==04){ //RHTS_KEY //WHTS_KEY
866 state
= hitag2_init(rev64(key
), rev32(tag
.uid
),
869 for (i
= 0; i
< 4; i
++) {
870 auth_ks
[i
] = hitag2_byte(&state
) ^ 0xff;
874 tx
[1] = (rnd
>> 8) & 0xff;
875 tx
[2] = (rnd
>> 16) & 0xff;
876 tx
[3] = (rnd
>> 24) & 0xff;
883 Dbprintf("%02X %02X %02X %02X %02X %02X %02X %02X", tx
[0],
884 tx
[1], tx
[2], tx
[3], tx
[4], tx
[5], tx
[6], tx
[7]);
885 } else if(htf
==01 || htf
==03) { //RHTS_CHALLENGE //WHTS_CHALLENGE
886 for (i
= 0; i
< 8; i
++)
887 tx
[i
]=((NrAr
>>(56-(i
*8)))&0xff);
890 tag
.pstate
= HT_AUTHENTICATE
;
892 Dbprintf("authentication failed!");
895 } else if (tag
.auth
== 0) {
896 tag
.pstate
= HT_SELECTED
;
899 } else if (tag
.pstate
== HT_AUTHENTICATE
&& rxlen
== 44) {
900 //encrypted con2,password received.
902 calc_crc(&crc
, 0x80, 1);
903 calc_crc(&crc
, ((rx
[0] & 0x0f) * 16 + ((rx
[1] & 0xf0) / 16)), 8);
904 calc_crc(&crc
, ((rx
[1] & 0x0f) * 16 + ((rx
[2] & 0xf0) / 16)), 8);
905 calc_crc(&crc
, ((rx
[2] & 0x0f) * 16 + ((rx
[3] & 0xf0) / 16)), 8);
906 calc_crc(&crc
, ((rx
[3] & 0x0f) * 16 + ((rx
[4] & 0xf0) / 16)), 8);
908 Dbprintf("UID:::%X", tag
.uid
);
909 Dbprintf("RND:::%X", rnd
);
916 if(htf
==02 || htf
==04){ //RHTS_KEY //WHTS_KEY
918 state
= hitag2_init(rev64(key
), rev32(tag
.uid
), rev32(rnd
));
919 for (i
= 0; i
< 5; i
++)
921 pwdh0
= ((rx
[1] & 0x0f) * 16 + ((rx
[2] & 0xf0) / 16))
922 ^ hitag2_byte(&state
);
923 pwdl0
= ((rx
[2] & 0x0f) * 16 + ((rx
[3] & 0xf0) / 16))
924 ^ hitag2_byte(&state
);
925 pwdl1
= ((rx
[3] & 0x0f) * 16 + ((rx
[4] & 0xf0) / 16))
926 ^ hitag2_byte(&state
);
930 Dbprintf("pwdh0 %02X pwdl0 %02X pwdl1 %02X", pwdh0
, pwdl0
, pwdl1
);
933 //Dbprintf("%X %02X", rnd, ((rx[4] & 0x0f) * 16) + ((rx[5] & 0xf0) / 16));
936 tag
.pstate
= HT_SELECTED
; //tag is now ready for read/write commands
943 * Emulates a Hitag S Tag with the given data from the .hts file
945 void SimulateHitagSTag(bool tag_mem_supplied
, byte_t
* data
) {
950 byte_t rx
[HITAG_FRAME_LEN
];
952 //bool bQuitTraceFull = false;
954 byte_t txbuf
[HITAG_FRAME_LEN
];
959 // Clean up trace and prepare it for storing frames
963 DbpString("Starting HitagS simulation");
966 tag
.pstate
= HT_READY
;
967 tag
.tstate
= HT_NO_OP
;
968 tag
.tstate
= HT_NO_OP
;
969 for (i
= 0; i
< 16; i
++)
970 for (j
= 0; j
< 4; j
++)
971 tag
.pages
[i
][j
] = 0x0;
972 //read tag data into memory
973 if (tag_mem_supplied
) {
974 DbpString("Loading hitagS memory...");
975 memcpy((byte_t
*)tag
.pages
,data
,4*64);
977 tag
.uid
=(uint32_t)tag
.pages
[0];
978 Dbprintf("Hitag S simulation started");
979 tag
.key
=(intptr_t)tag
.pages
[3];
981 tag
.key
+=((tag
.pages
[2][0])<<8)+tag
.pages
[2][1];
982 tag
.pwdl0
=tag
.pages
[2][3];
983 tag
.pwdl1
=tag
.pages
[2][2];
984 tag
.pwdh0
=tag
.pages
[1][0];
987 if((tag
.pages
[1][3]&0x2)==0 && (tag
.pages
[1][3]&0x1)==1)
989 if((tag
.pages
[1][3]&0x2)==0 && (tag
.pages
[1][3]&0x1)==0)
993 if((tag
.pages
[1][2]&0x80)==1)
996 if((tag
.pages
[1][2]&0x2)==1)
999 if((tag
.pages
[1][2]&0x1)==1)
1002 //0=read write 1=read only
1004 if((tag
.pages
[1][1]&0x80)==1)
1007 if((tag
.pages
[1][1]&0x40)==1)
1010 if((tag
.pages
[1][1]&0x20)==1)
1013 if((tag
.pages
[1][1]&0x10)==1)
1016 if((tag
.pages
[1][1]&0x8)==1)
1019 if((tag
.pages
[1][1]&0x4)==1)
1022 if((tag
.pages
[1][1]&0x2)==1)
1025 if((tag
.pages
[1][1]&0x1)==1)
1028 // Set up simulator mode, frequency divisor which will drive the FPGA
1029 // and analog mux selection.
1030 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
1032 FPGA_MAJOR_MODE_LF_EDGE_DETECT
| FPGA_LF_EDGE_DETECT_READER_FIELD
);
1033 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1034 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
1037 // Configure output pin that is connected to the FPGA (for modulating)
1038 AT91C_BASE_PIOA
->PIO_OER
= GPIO_SSC_DOUT
;
1039 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DOUT
;
1041 // Disable modulation at default, which means release resistance
1044 // Enable Peripheral Clock for TIMER_CLOCK0, used to measure exact timing before answering
1045 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC0
);
1047 // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the reader frames
1048 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC1
);
1049 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_SSC_FRAME
;
1051 // Disable timer during configuration
1052 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1054 // Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
1055 // external trigger rising edge, load RA on rising edge of TIOA.
1056 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV1_CLOCK
1057 | AT91C_TC_ETRGEDG_RISING
| AT91C_TC_ABETRG
| AT91C_TC_LDRA_RISING
;
1059 // Reset the received frame, frame count and timing info
1060 memset(rx
, 0x00, sizeof(rx
));
1065 // Enable and reset counter
1066 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1068 while (!BUTTON_PRESS()) {
1072 // Receive frame, watch for at most T0*EOF periods
1073 while (AT91C_BASE_TC1
->TC_CV
< T0
* HITAG_T_EOF
) {
1074 // Check if rising edge in modulation is detected
1075 if (AT91C_BASE_TC1
->TC_SR
& AT91C_TC_LDRAS
) {
1076 // Retrieve the new timing values
1077 int ra
= (AT91C_BASE_TC1
->TC_RA
/ T0
) + overflow
;
1080 // Reset timer every frame, we have to capture the last edge for timing
1081 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1085 // Capture reader frame
1086 if (ra
>= HITAG_T_STOP
) {
1088 //DbpString("wierd0?");
1090 // Capture the T0 periods that have passed since last communication or field drop (reset)
1091 response
= (ra
- HITAG_T_LOW
);
1092 } else if (ra
>= HITAG_T_1_MIN
) {
1094 rx
[rxlen
/ 8] |= 1 << (7 - (rxlen
% 8));
1096 } else if (ra
>= HITAG_T_0_MIN
) {
1098 rx
[rxlen
/ 8] |= 0 << (7 - (rxlen
% 8));
1101 // Ignore wierd value, is to small to mean anything
1106 // Check if frame was captured
1110 if (!LogTraceHitag(rx
, rxlen
, response
, 0, true)) {
1111 DbpString("Trace full");
1116 // Disable timer 1 with external trigger to avoid triggers during our own modulation
1117 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1119 // Process the incoming frame (rx) and prepare the outgoing frame (tx)
1120 hitagS_handle_reader_command(rx
, rxlen
, tx
, &txlen
);
1122 // Wait for HITAG_T_WAIT_1 carrier periods after the last reader bit,
1123 // not that since the clock counts since the rising edge, but T_Wait1 is
1124 // with respect to the falling edge, we need to wait actually (T_Wait1 - T_Low)
1125 // periods. The gap time T_Low varies (4..10). All timer values are in
1126 // terms of T0 units
1127 while (AT91C_BASE_TC0
->TC_CV
< T0
* (HITAG_T_WAIT_1
- HITAG_T_LOW
))
1130 // Send and store the tag answer (if there is any)
1132 // Transmit the tag frame
1133 hitag_send_frame(tx
, txlen
);
1134 // Store the frame in the trace
1136 if (!LogTraceHitag(tx
, txlen
, 0, 0, false)) {
1137 DbpString("Trace full");
1143 // Reset the received frame and response timing info
1144 memset(rx
, 0x00, sizeof(rx
));
1147 // Enable and reset external trigger in timer for capturing future frames
1148 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1151 // Reset the frame length
1153 // Save the timer overflow, will be 0 when frame was received
1154 overflow
+= (AT91C_BASE_TC1
->TC_CV
/ T0
);
1155 // Reset the timer to restart while-loop that receives frames
1156 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_SWTRG
;
1160 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1161 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
;
1162 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1166 * Authenticates to the Tag with the given key or challenge.
1167 * If the key was given the password will be decrypted.
1168 * Reads every page of a hitag S transpoder.
1170 void ReadHitagS(hitag_function htf
, hitag_data
* htd
) {
1173 int response_bit
[200];
1175 byte_t rx
[HITAG_FRAME_LEN
];
1177 byte_t txbuf
[HITAG_FRAME_LEN
];
1184 int t_wait
= HITAG_T_WAIT_MAX
;
1186 bool bQuitTraceFull
= false;
1188 unsigned char mask
= 1;
1190 unsigned char pageData
[32];
1191 page_to_be_written
= 0;
1193 //read given key/challenge
1199 case 01: { //RHTS_CHALLENGE
1200 DbpString("Authenticating using nr,ar pair:");
1201 memcpy(NrAr_
,htd
->auth
.NrAr
,8);
1202 Dbhexdump(8,NrAr_
,false);
1203 NrAr
=NrAr_
[7] | ((uint64_t)NrAr_
[6]) << 8 | ((uint64_t)NrAr_
[5]) << 16 | ((uint64_t)NrAr_
[4]) << 24 | ((uint64_t)NrAr_
[3]) << 32 |
1204 ((uint64_t)NrAr_
[2]) << 40| ((uint64_t)NrAr_
[1]) << 48 | ((uint64_t)NrAr_
[0]) << 56;
1206 case 02: { //RHTS_KEY
1207 DbpString("Authenticating using key:");
1208 memcpy(key_
,htd
->crypto
.key
,6);
1209 Dbhexdump(6,key_
,false);
1210 key
=key_
[5] | ((uint64_t)key_
[4]) << 8 | ((uint64_t)key_
[3]) << 16 | ((uint64_t)key_
[2]) << 24 | ((uint64_t)key_
[1]) << 32 | ((uint64_t)key_
[0]) << 40;
1213 Dbprintf("Error , unknown function: %d",htf
);
1220 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
1221 // Reset the return status
1222 bSuccessful
= false;
1224 // Clean up trace and prepare it for storing frames
1229 bQuitTraceFull
= true;
1233 // Configure output and enable pin that is connected to the FPGA (for modulating)
1234 AT91C_BASE_PIOA
->PIO_OER
= GPIO_SSC_DOUT
;
1235 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DOUT
;
1237 // Set fpga in edge detect with reader field, we can modulate as reader now
1239 FPGA_MAJOR_MODE_LF_EDGE_DETECT
| FPGA_LF_EDGE_DETECT_READER_FIELD
);
1241 // Set Frequency divisor which will drive the FPGA and analog mux selection
1242 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1243 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
1246 // Disable modulation at default, which means enable the field
1249 // Give it a bit of time for the resonant antenna to settle.
1252 // Enable Peripheral Clock for TIMER_CLOCK0, used to measure exact timing before answering
1253 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC0
);
1255 // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the tag frames
1256 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC1
);
1257 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_SSC_FRAME
;
1259 // Disable timer during configuration
1260 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1262 // Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
1263 // external trigger rising edge, load RA on falling edge of TIOA.
1264 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV1_CLOCK
1266 | AT91C_TC_ETRGEDG_FALLING
| AT91C_TC_ABETRG
| AT91C_TC_LDRA_FALLING
;
1268 // Enable and reset counters
1269 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1270 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1272 // Reset the received frame, frame count and timing info
1281 while (!bStop
&& !BUTTON_PRESS()) {
1285 // Check if frame was captured and store it
1289 if (!LogTraceHitag(rx
, rxlen
, response
, 0, false)) {
1290 DbpString("Trace full");
1291 if (bQuitTraceFull
) {
1300 // By default reset the transmission buffer
1305 //start authentication
1307 memcpy(tx
, "\xc0", nbytes(txlen
));
1308 tag
.pstate
= HT_READY
;
1309 tag
.tstate
= HT_NO_OP
;
1310 } else if (tag
.pstate
!= HT_SELECTED
) {
1311 if (hitagS_handle_tag_auth(htf
, key
,NrAr
,rx
, rxlen
, tx
, &txlen
) == -1)
1314 if (tag
.pstate
== HT_SELECTED
&& tag
.tstate
== HT_NO_OP
&& rxlen
> 0) {
1316 tag
.tstate
= HT_READING_PAGE
;
1319 tx
[0] = 0xc0 + (sendNum
/ 16);
1320 calc_crc(&crc
, tx
[0], 8);
1321 calc_crc(&crc
, 0x00 + ((sendNum
% 16) * 16), 4);
1322 tx
[1] = 0x00 + ((sendNum
% 16) * 16) + (crc
/ 16);
1323 tx
[2] = 0x00 + (crc
% 16) * 16;
1324 } else if (tag
.pstate
== HT_SELECTED
&& tag
.tstate
== HT_READING_PAGE
1326 //save received data
1328 for (i
= 0; i
< 5; i
++) {
1329 for (j
= 0; j
< 8; j
++) {
1330 response_bit
[z
] = 0;
1331 if ((rx
[i
] & ((mask
<< 7) >> j
)) != 0)
1332 response_bit
[z
] = 1;
1337 for (i
= 4; i
< 36; i
++) {
1338 pageData
[k
] = response_bit
[i
];
1341 for (i
= 0; i
< 4; i
++)
1342 tag
.pages
[sendNum
/ 4][sendNum
% 4] = 0x0;
1343 for (i
= 0; i
< 4; i
++) {
1344 tag
.pages
[sendNum
/ 4][sendNum
% 4] += ((pageData
[i
* 8] << 7)
1345 | (pageData
[1 + (i
* 8)] << 6)
1346 | (pageData
[2 + (i
* 8)] << 5)
1347 | (pageData
[3 + (i
* 8)] << 4)
1348 | (pageData
[4 + (i
* 8)] << 3)
1349 | (pageData
[5 + (i
* 8)] << 2)
1350 | (pageData
[6 + (i
* 8)] << 1) | pageData
[7 + (i
* 8)])
1353 if (tag
.auth
&& tag
.LKP
&& sendNum
== 1) {
1354 Dbprintf("Page[%2d]: %02X %02X %02X %02X", sendNum
, pwdh0
,
1355 (tag
.pages
[sendNum
/ 4][sendNum
% 4] >> 16) & 0xff,
1356 (tag
.pages
[sendNum
/ 4][sendNum
% 4] >> 8) & 0xff,
1357 tag
.pages
[sendNum
/ 4][sendNum
% 4] & 0xff);
1359 Dbprintf("Page[%2d]: %02X %02X %02X %02X", sendNum
,
1360 (tag
.pages
[sendNum
/ 4][sendNum
% 4] >> 24) & 0xff,
1361 (tag
.pages
[sendNum
/ 4][sendNum
% 4] >> 16) & 0xff,
1362 (tag
.pages
[sendNum
/ 4][sendNum
% 4] >> 8) & 0xff,
1363 tag
.pages
[sendNum
/ 4][sendNum
% 4] & 0xff);
1367 //display key and password if possible
1368 if (sendNum
== 2 && tag
.auth
== 1 && tag
.LKP
) {
1369 if (htf
== 02) { //RHTS_KEY
1370 Dbprintf("Page[ 2]: %02X %02X %02X %02X",
1371 (byte_t
)(key
>> 8) & 0xff,
1372 (byte_t
) key
& 0xff, pwdl1
, pwdl0
);
1373 Dbprintf("Page[ 3]: %02X %02X %02X %02X",
1374 (byte_t
)(key
>> 40) & 0xff,
1375 (byte_t
)(key
>> 32) & 0xff,
1376 (byte_t
)(key
>> 24) & 0xff,
1377 (byte_t
)(key
>> 16) & 0xff);
1379 //if the authentication is done with a challenge the key and password are unknown
1380 Dbprintf("Page[ 2]: __ __ __ __");
1381 Dbprintf("Page[ 3]: __ __ __ __");
1387 tx
[0] = 0xc0 + (sendNum
/ 16);
1388 calc_crc(&crc
, tx
[0], 8);
1389 calc_crc(&crc
, 0x00 + ((sendNum
% 16) * 16), 4);
1390 tx
[1] = 0x00 + ((sendNum
% 16) * 16) + (crc
/ 16);
1391 tx
[2] = 0x00 + (crc
% 16) * 16;
1392 if (sendNum
>= tag
.max_page
) {
1397 // Send and store the reader command
1398 // Disable timer 1 with external trigger to avoid triggers during our own modulation
1399 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1401 // Wait for HITAG_T_WAIT_2 carrier periods after the last tag bit before transmitting,
1402 // Since the clock counts since the last falling edge, a 'one' means that the
1403 // falling edge occured halfway the period. with respect to this falling edge,
1404 // we need to wait (T_Wait2 + half_tag_period) when the last was a 'one'.
1405 // All timer values are in terms of T0 units
1407 while (AT91C_BASE_TC0
->TC_CV
1408 < T0
* (t_wait
+ (HITAG_T_TAG_HALF_PERIOD
* lastbit
)))
1411 // Transmit the reader frame
1412 hitag_reader_send_frame(tx
, txlen
);
1414 // Enable and reset external trigger in timer for capturing future frames
1415 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1417 // Add transmitted frame to total count
1421 // Store the frame in the trace
1422 if (!LogTraceHitag(tx
, txlen
, HITAG_T_WAIT_2
, 0, true)) {
1423 if (bQuitTraceFull
) {
1424 DbpString("Trace full");
1433 // Reset values for receiving frames
1434 memset(rx
, 0x00, sizeof(rx
));
1438 tag_sof
= reset_sof
;
1441 // Receive frame, watch for at most T0*EOF periods
1442 while (AT91C_BASE_TC1
->TC_CV
< T0
* HITAG_T_WAIT_MAX
) {
1443 // Check if falling edge in tag modulation is detected
1444 if (AT91C_BASE_TC1
->TC_SR
& AT91C_TC_LDRAS
) {
1445 // Retrieve the new timing values
1446 int ra
= (AT91C_BASE_TC1
->TC_RA
/ T0
);
1448 // Reset timer every frame, we have to capture the last edge for timing
1449 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_SWTRG
;
1453 // Capture tag frame (manchester decoding using only falling edges)
1454 if (ra
>= HITAG_T_EOF
) {
1456 //DbpString("wierd1?");
1458 // Capture the T0 periods that have passed since last communication or field drop (reset)
1459 // We always recieve a 'one' first, which has the falling edge after a half period |-_|
1460 response
= ra
- HITAG_T_TAG_HALF_PERIOD
;
1461 } else if (ra
>= HITAG_T_TAG_CAPTURE_FOUR_HALF
) {
1462 // Manchester coding example |-_|_-|-_| (101)
1463 rx
[rxlen
/ 8] |= 0 << (7 - (rxlen
% 8));
1465 rx
[rxlen
/ 8] |= 1 << (7 - (rxlen
% 8));
1467 } else if (ra
>= HITAG_T_TAG_CAPTURE_THREE_HALF
) {
1468 // Manchester coding example |_-|...|_-|-_| (0...01)
1469 rx
[rxlen
/ 8] |= 0 << (7 - (rxlen
% 8));
1471 // We have to skip this half period at start and add the 'one' the second time
1473 rx
[rxlen
/ 8] |= 1 << (7 - (rxlen
% 8));
1478 } else if (ra
>= HITAG_T_TAG_CAPTURE_TWO_HALF
) {
1479 // Manchester coding example |_-|_-| (00) or |-_|-_| (11)
1481 // Ignore bits that are transmitted during SOF
1484 // bit is same as last bit
1485 rx
[rxlen
/ 8] |= lastbit
<< (7 - (rxlen
% 8));
1489 // Ignore wierd value, is to small to mean anything
1493 // We can break this loop if we received the last bit from a frame
1494 if (AT91C_BASE_TC1
->TC_CV
> T0
* HITAG_T_EOF
) {
1503 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1504 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
;
1505 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1506 cmd_send(CMD_ACK
, bSuccessful
, 0, 0, 0, 0);
1510 * Authenticates to the Tag with the given Key or Challenge.
1511 * Writes the given 32Bit data into page_
1513 void WritePageHitagS(hitag_function htf
, hitag_data
* htd
,int page_
) {
1516 byte_t rx
[HITAG_FRAME_LEN
];
1518 byte_t txbuf
[HITAG_FRAME_LEN
];
1525 int t_wait
= HITAG_T_WAIT_MAX
;
1527 bool bQuitTraceFull
= false;
1530 byte_t data
[4]= {0,0,0,0};
1532 //read given key/challenge, the page and the data
1538 case 03: { //WHTS_CHALLENGE
1539 memcpy(data
,htd
->auth
.data
,4);
1540 DbpString("Authenticating using nr,ar pair:");
1541 memcpy(NrAr_
,htd
->auth
.NrAr
,8);
1542 Dbhexdump(8,NrAr_
,false);
1543 NrAr
=NrAr_
[7] | ((uint64_t)NrAr_
[6]) << 8 | ((uint64_t)NrAr_
[5]) << 16 | ((uint64_t)NrAr_
[4]) << 24 | ((uint64_t)NrAr_
[3]) << 32 |
1544 ((uint64_t)NrAr_
[2]) << 40| ((uint64_t)NrAr_
[1]) << 48 | ((uint64_t)NrAr_
[0]) << 56;
1546 case 04: { //WHTS_KEY
1547 memcpy(data
,htd
->crypto
.data
,4);
1548 DbpString("Authenticating using key:");
1549 memcpy(key_
,htd
->crypto
.key
,6);
1550 Dbhexdump(6,key_
,false);
1551 key
=key_
[5] | ((uint64_t)key_
[4]) << 8 | ((uint64_t)key_
[3]) << 16 | ((uint64_t)key_
[2]) << 24 | ((uint64_t)key_
[1]) << 32 | ((uint64_t)key_
[0]) << 40;
1554 Dbprintf("Error , unknown function: %d",htf
);
1559 Dbprintf("Page: %d",page_
);
1560 Dbprintf("DATA: %02X %02X %02X %02X", data
[0], data
[1], data
[2], data
[3]);
1561 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
1562 // Reset the return status
1563 bSuccessful
= false;
1565 tag
.pstate
= HT_READY
;
1566 tag
.tstate
= HT_NO_OP
;
1568 // Clean up trace and prepare it for storing frames
1573 bQuitTraceFull
= true;
1577 // Configure output and enable pin that is connected to the FPGA (for modulating)
1578 AT91C_BASE_PIOA
->PIO_OER
= GPIO_SSC_DOUT
;
1579 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DOUT
;
1581 // Set fpga in edge detect with reader field, we can modulate as reader now
1583 FPGA_MAJOR_MODE_LF_EDGE_DETECT
| FPGA_LF_EDGE_DETECT_READER_FIELD
);
1585 // Set Frequency divisor which will drive the FPGA and analog mux selection
1586 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1587 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
1590 // Disable modulation at default, which means enable the field
1593 // Give it a bit of time for the resonant antenna to settle.
1596 // Enable Peripheral Clock for TIMER_CLOCK0, used to measure exact timing before answering
1597 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC0
);
1599 // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the tag frames
1600 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC1
);
1601 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_SSC_FRAME
;
1603 // Disable timer during configuration
1604 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1606 // Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
1607 // external trigger rising edge, load RA on falling edge of TIOA.
1608 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV1_CLOCK
1609 | AT91C_TC_ETRGEDG_FALLING
| AT91C_TC_ABETRG
1610 | AT91C_TC_LDRA_FALLING
;
1612 // Enable and reset counters
1613 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1614 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1616 // Reset the received frame, frame count and timing info
1625 while (!bStop
&& !BUTTON_PRESS()) {
1629 // Check if frame was captured and store it
1633 if (!LogTraceHitag(rx
, rxlen
, response
, 0, false)) {
1634 DbpString("Trace full");
1635 if (bQuitTraceFull
) {
1644 //check for valid input
1647 "usage: lf hitag writer [03 | 04] [CHALLENGE | KEY] [page] [byte0] [byte1] [byte2] [byte3]");
1651 // By default reset the transmission buffer
1655 if (rxlen
== 0 && tag
.tstate
== HT_WRITING_PAGE_ACK
) {
1656 //no write access on this page
1657 Dbprintf("no write access on page %d", page_
);
1659 } else if (rxlen
== 0 && tag
.tstate
!= HT_WRITING_PAGE_DATA
) {
1660 //start the authetication
1662 memcpy(tx
, "\xc0", nbytes(txlen
));
1663 tag
.pstate
= HT_READY
;
1664 tag
.tstate
= HT_NO_OP
;
1665 } else if (tag
.pstate
!= HT_SELECTED
) {
1666 //try to authenticate with the given key or challenge
1667 if (hitagS_handle_tag_auth(htf
,key
,NrAr
,rx
, rxlen
, tx
, &txlen
) == -1)
1670 if (tag
.pstate
== HT_SELECTED
&& tag
.tstate
== HT_NO_OP
&& rxlen
> 0) {
1671 //check if the given page exists
1672 if (page
> tag
.max_page
) {
1673 Dbprintf("page number too big");
1676 //ask Tag for write permission
1677 tag
.tstate
= HT_WRITING_PAGE_ACK
;
1680 tx
[0] = 0x90 + (page
/ 16);
1681 calc_crc(&crc
, tx
[0], 8);
1682 calc_crc(&crc
, 0x00 + ((page
% 16) * 16), 4);
1683 tx
[1] = 0x00 + ((page
% 16) * 16) + (crc
/ 16);
1684 tx
[2] = 0x00 + (crc
% 16) * 16;
1685 } else if (tag
.pstate
== HT_SELECTED
&& tag
.tstate
== HT_WRITING_PAGE_ACK
1686 && rxlen
== 6 && rx
[0] == 0xf4) {
1687 //ACK recieved to write the page. send data
1688 tag
.tstate
= HT_WRITING_PAGE_DATA
;
1691 calc_crc(&crc
, data
[3], 8);
1692 calc_crc(&crc
, data
[2], 8);
1693 calc_crc(&crc
, data
[1], 8);
1694 calc_crc(&crc
, data
[0], 8);
1700 } else if (tag
.pstate
== HT_SELECTED
&& tag
.tstate
== HT_WRITING_PAGE_DATA
1701 && rxlen
== 6 && rx
[0] == 0xf4) {
1703 Dbprintf("Successful!");
1707 // Send and store the reader command
1708 // Disable timer 1 with external trigger to avoid triggers during our own modulation
1709 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1711 // Wait for HITAG_T_WAIT_2 carrier periods after the last tag bit before transmitting,
1712 // Since the clock counts since the last falling edge, a 'one' means that the
1713 // falling edge occured halfway the period. with respect to this falling edge,
1714 // we need to wait (T_Wait2 + half_tag_period) when the last was a 'one'.
1715 // All timer values are in terms of T0 units
1717 while (AT91C_BASE_TC0
->TC_CV
1718 < T0
* (t_wait
+ (HITAG_T_TAG_HALF_PERIOD
* lastbit
)))
1721 // Transmit the reader frame
1722 hitag_reader_send_frame(tx
, txlen
);
1724 // Enable and reset external trigger in timer for capturing future frames
1725 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1727 // Add transmitted frame to total count
1731 // Store the frame in the trace
1732 if (!LogTraceHitag(tx
, txlen
, HITAG_T_WAIT_2
, 0, true)) {
1733 if (bQuitTraceFull
) {
1734 DbpString("Trace full");
1743 // Reset values for receiving frames
1744 memset(rx
, 0x00, sizeof(rx
));
1748 tag_sof
= reset_sof
;
1751 // Receive frame, watch for at most T0*EOF periods
1752 while (AT91C_BASE_TC1
->TC_CV
< T0
* HITAG_T_WAIT_MAX
) {
1753 // Check if falling edge in tag modulation is detected
1754 if (AT91C_BASE_TC1
->TC_SR
& AT91C_TC_LDRAS
) {
1755 // Retrieve the new timing values
1756 int ra
= (AT91C_BASE_TC1
->TC_RA
/ T0
);
1758 // Reset timer every frame, we have to capture the last edge for timing
1759 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_SWTRG
;
1763 // Capture tag frame (manchester decoding using only falling edges)
1764 if (ra
>= HITAG_T_EOF
) {
1766 //DbpString("wierd1?");
1768 // Capture the T0 periods that have passed since last communication or field drop (reset)
1769 // We always recieve a 'one' first, which has the falling edge after a half period |-_|
1770 response
= ra
- HITAG_T_TAG_HALF_PERIOD
;
1771 } else if (ra
>= HITAG_T_TAG_CAPTURE_FOUR_HALF
) {
1772 // Manchester coding example |-_|_-|-_| (101)
1773 rx
[rxlen
/ 8] |= 0 << (7 - (rxlen
% 8));
1775 rx
[rxlen
/ 8] |= 1 << (7 - (rxlen
% 8));
1777 } else if (ra
>= HITAG_T_TAG_CAPTURE_THREE_HALF
) {
1778 // Manchester coding example |_-|...|_-|-_| (0...01)
1779 rx
[rxlen
/ 8] |= 0 << (7 - (rxlen
% 8));
1781 // We have to skip this half period at start and add the 'one' the second time
1783 rx
[rxlen
/ 8] |= 1 << (7 - (rxlen
% 8));
1788 } else if (ra
>= HITAG_T_TAG_CAPTURE_TWO_HALF
) {
1789 // Manchester coding example |_-|_-| (00) or |-_|-_| (11)
1791 // Ignore bits that are transmitted during SOF
1794 // bit is same as last bit
1795 rx
[rxlen
/ 8] |= lastbit
<< (7 - (rxlen
% 8));
1799 // Ignore wierd value, is to small to mean anything
1803 // We can break this loop if we received the last bit from a frame
1804 if (AT91C_BASE_TC1
->TC_CV
> T0
* HITAG_T_EOF
) {
1813 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1814 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
;
1815 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1816 cmd_send(CMD_ACK
, bSuccessful
, 0, 0, 0, 0);
1820 * Tries to authenticate to a Hitag S Transponder with the given challenges from a .cc file.
1821 * Displays all Challenges that failed.
1822 * When collecting Challenges to break the key it is possible that some data
1823 * is not received correctly due to Antenna problems. This function
1824 * detects these challenges.
1826 void check_challenges(bool file_given
, byte_t
* data
) {
1831 byte_t rx
[HITAG_FRAME_LEN
];
1832 byte_t unlocker
[60][8];
1835 byte_t txbuf
[HITAG_FRAME_LEN
];
1842 int t_wait
= HITAG_T_WAIT_MAX
;
1845 bool bQuitTraceFull
= false;
1846 int response_bit
[200];
1847 unsigned char mask
= 1;
1848 unsigned char uid
[32];
1851 FpgaDownloadAndGo(FPGA_BITSTREAM_LF
);
1852 // Reset the return status
1853 bSuccessful
= false;
1855 // Clean up trace and prepare it for storing frames
1860 bQuitTraceFull
= true;
1864 // Configure output and enable pin that is connected to the FPGA (for modulating)
1865 AT91C_BASE_PIOA
->PIO_OER
= GPIO_SSC_DOUT
;
1866 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DOUT
;
1868 // Set fpga in edge detect with reader field, we can modulate as reader now
1870 FPGA_MAJOR_MODE_LF_EDGE_DETECT
| FPGA_LF_EDGE_DETECT_READER_FIELD
);
1872 // Set Frequency divisor which will drive the FPGA and analog mux selection
1873 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1874 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
1877 // Disable modulation at default, which means enable the field
1880 // Give it a bit of time for the resonant antenna to settle.
1883 // Enable Peripheral Clock for TIMER_CLOCK0, used to measure exact timing before answering
1884 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC0
);
1886 // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the tag frames
1887 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_TC1
);
1888 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_SSC_FRAME
;
1890 // Disable timer during configuration
1891 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
1893 // Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
1894 // external trigger rising edge, load RA on falling edge of TIOA.
1895 AT91C_BASE_TC1
->TC_CMR
= AT91C_TC_CLKS_TIMER_DIV1_CLOCK
1897 | AT91C_TC_ETRGEDG_FALLING
| AT91C_TC_ABETRG
| AT91C_TC_LDRA_FALLING
;
1899 // Enable and reset counters
1900 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1901 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
1903 // Reset the received frame, frame count and timing info
1913 DbpString("Loading challenges...");
1914 memcpy((byte_t
*)unlocker
,data
,60*8);
1917 while (file_given
&& !bStop
&& !BUTTON_PRESS()) {
1921 // Check if frame was captured and store it
1925 if (!LogTraceHitag(rx
, rxlen
, response
, 0, false)) {
1926 DbpString("Trace full");
1927 if (bQuitTraceFull
) {
1941 Dbprintf("Challenge failed: %02X %02X %02X %02X %02X %02X %02X %02X",
1942 unlocker
[u1
- 1][0], unlocker
[u1
- 1][1],
1943 unlocker
[u1
- 1][2], unlocker
[u1
- 1][3],
1944 unlocker
[u1
- 1][4], unlocker
[u1
- 1][5],
1945 unlocker
[u1
- 1][6], unlocker
[u1
- 1][7]);
1948 //start new authentication
1949 memcpy(tx
, "\xc0", nbytes(txlen
));
1950 } else if (rxlen
>= 67 && STATE
== 0) {
1953 for (i
= 0; i
< 10; i
++) {
1954 for (j
= 0; j
< 8; j
++) {
1955 response_bit
[z
] = 0;
1956 if ((rx
[i
] & ((mask
<< 7) >> j
)) != 0)
1957 response_bit
[z
] = 1;
1962 for (i
= 5; i
< z
; i
+= 2) {
1963 uid
[k
] = response_bit
[i
];
1968 uid_byte
[0] = (uid
[0] << 7) | (uid
[1] << 6) | (uid
[2] << 5)
1969 | (uid
[3] << 4) | (uid
[4] << 3) | (uid
[5] << 2)
1970 | (uid
[6] << 1) | uid
[7];
1971 uid_byte
[1] = (uid
[8] << 7) | (uid
[9] << 6) | (uid
[10] << 5)
1972 | (uid
[11] << 4) | (uid
[12] << 3) | (uid
[13] << 2)
1973 | (uid
[14] << 1) | uid
[15];
1974 uid_byte
[2] = (uid
[16] << 7) | (uid
[17] << 6) | (uid
[18] << 5)
1975 | (uid
[19] << 4) | (uid
[20] << 3) | (uid
[21] << 2)
1976 | (uid
[22] << 1) | uid
[23];
1977 uid_byte
[3] = (uid
[24] << 7) | (uid
[25] << 6) | (uid
[26] << 5)
1978 | (uid
[27] << 4) | (uid
[28] << 3) | (uid
[29] << 2)
1979 | (uid
[30] << 1) | uid
[31];
1980 //Dbhexdump(10, rx, rxlen);
1984 calc_crc(&crc
, 0x00, 5);
1985 calc_crc(&crc
, uid_byte
[0], 8);
1986 calc_crc(&crc
, uid_byte
[1], 8);
1987 calc_crc(&crc
, uid_byte
[2], 8);
1988 calc_crc(&crc
, uid_byte
[3], 8);
1989 for (i
= 0; i
< 100; i
++) {
1990 response_bit
[i
] = 0;
1992 for (i
= 0; i
< 5; i
++) {
1993 response_bit
[i
] = 0;
1995 for (i
= 5; i
< 37; i
++) {
1996 response_bit
[i
] = uid
[i
- 5];
1998 for (j
= 0; j
< 8; j
++) {
1999 response_bit
[i
] = 0;
2000 if ((crc
& ((mask
<< 7) >> j
)) != 0)
2001 response_bit
[i
] = 1;
2005 for (i
= 0; i
< 6; i
++) {
2006 tx
[i
] = (response_bit
[k
] << 7) | (response_bit
[k
+ 1] << 6)
2007 | (response_bit
[k
+ 2] << 5)
2008 | (response_bit
[k
+ 3] << 4)
2009 | (response_bit
[k
+ 4] << 3)
2010 | (response_bit
[k
+ 5] << 2)
2011 | (response_bit
[k
+ 6] << 1) | response_bit
[k
+ 7];
2015 } else if (STATE
== 1 && rxlen
== 44) {
2016 //received configuration
2019 for (i
= 0; i
< 6; i
++) {
2020 for (j
= 0; j
< 8; j
++) {
2021 response_bit
[z
] = 0;
2022 if ((rx
[i
] & ((mask
<< 7) >> j
)) != 0)
2023 response_bit
[z
] = 1;
2029 if (u1
>= (sizeof(unlocker
) / sizeof(unlocker
[0])))
2031 for (i
= 0; i
< 8; i
++)
2032 tx
[i
] = unlocker
[u1
][i
];
2035 } else if (STATE
== 2 && rxlen
>= 44) {
2039 // Send and store the reader command
2040 // Disable timer 1 with external trigger to avoid triggers during our own modulation
2041 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
2043 // Wait for HITAG_T_WAIT_2 carrier periods after the last tag bit before transmitting,
2044 // Since the clock counts since the last falling edge, a 'one' means that the
2045 // falling edge occured halfway the period. with respect to this falling edge,
2046 // we need to wait (T_Wait2 + half_tag_period) when the last was a 'one'.
2047 // All timer values are in terms of T0 units
2049 while (AT91C_BASE_TC0
->TC_CV
2050 < T0
* (t_wait
+ (HITAG_T_TAG_HALF_PERIOD
* lastbit
)))
2053 // Transmit the reader frame
2054 hitag_reader_send_frame(tx
, txlen
);
2056 // Enable and reset external trigger in timer for capturing future frames
2057 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKEN
| AT91C_TC_SWTRG
;
2059 // Add transmitted frame to total count
2063 // Store the frame in the trace
2064 if (!LogTraceHitag(tx
, txlen
, HITAG_T_WAIT_2
, 0, true)) {
2065 if (bQuitTraceFull
) {
2066 DbpString("Trace full");
2075 // Reset values for receiving frames
2076 memset(rx
, 0x00, sizeof(rx
));
2080 tag_sof
= reset_sof
;
2083 // Receive frame, watch for at most T0*EOF periods
2084 while (AT91C_BASE_TC1
->TC_CV
< T0
* HITAG_T_WAIT_MAX
) {
2085 // Check if falling edge in tag modulation is detected
2086 if (AT91C_BASE_TC1
->TC_SR
& AT91C_TC_LDRAS
) {
2087 // Retrieve the new timing values
2088 int ra
= (AT91C_BASE_TC1
->TC_RA
/ T0
);
2090 // Reset timer every frame, we have to capture the last edge for timing
2091 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_SWTRG
;
2095 // Capture tag frame (manchester decoding using only falling edges)
2096 if (ra
>= HITAG_T_EOF
) {
2098 //DbpString("wierd1?");
2100 // Capture the T0 periods that have passed since last communication or field drop (reset)
2101 // We always recieve a 'one' first, which has the falling edge after a half period |-_|
2102 response
= ra
- HITAG_T_TAG_HALF_PERIOD
;
2103 } else if (ra
>= HITAG_T_TAG_CAPTURE_FOUR_HALF
) {
2104 // Manchester coding example |-_|_-|-_| (101)
2105 rx
[rxlen
/ 8] |= 0 << (7 - (rxlen
% 8));
2107 rx
[rxlen
/ 8] |= 1 << (7 - (rxlen
% 8));
2109 } else if (ra
>= HITAG_T_TAG_CAPTURE_THREE_HALF
) {
2110 // Manchester coding example |_-|...|_-|-_| (0...01)
2111 rx
[rxlen
/ 8] |= 0 << (7 - (rxlen
% 8));
2113 // We have to skip this half period at start and add the 'one' the second time
2115 rx
[rxlen
/ 8] |= 1 << (7 - (rxlen
% 8));
2120 } else if (ra
>= HITAG_T_TAG_CAPTURE_TWO_HALF
) {
2121 // Manchester coding example |_-|_-| (00) or |-_|-_| (11)
2123 // Ignore bits that are transmitted during SOF
2126 // bit is same as last bit
2127 rx
[rxlen
/ 8] |= lastbit
<< (7 - (rxlen
% 8));
2131 // Ignore wierd value, is to small to mean anything
2135 // We can break this loop if we received the last bit from a frame
2136 if (AT91C_BASE_TC1
->TC_CV
> T0
* HITAG_T_EOF
) {
2144 AT91C_BASE_TC1
->TC_CCR
= AT91C_TC_CLKDIS
;
2145 AT91C_BASE_TC0
->TC_CCR
= AT91C_TC_CLKDIS
;
2146 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
2147 cmd_send(CMD_ACK
, bSuccessful
, 0, 0, 0, 0);