]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443.c
projects / proxmark3-svn / blob
? search:


3a4a9ac1f63af0029188f3785771a629c54c6d28
[proxmark3-svn] / armsrc / iso14443.c
1 //-----------------------------------------------------------------------------
2 // Routines to support ISO 14443. This includes both the reader software and
3 // the `fake tag' modes. At the moment only the Type B modulation is
4 // supported.
5 // Jonathan Westhues, split Nov 2006
6 //-----------------------------------------------------------------------------
7 #include <proxmark3.h>
8 #include "apps.h"
9 #include "../common/iso14443_crc.c"
10
11
12 //static void GetSamplesFor14443(BOOL weTx, int n);
13
14 #define DMA_BUFFER_SIZE 256
15
16 //=============================================================================
17 // An ISO 14443 Type B tag. We listen for commands from the reader, using
18 // a UART kind of thing that's implemented in software. When we get a
19 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
20 // If it's good, then we can do something appropriate with it, and send
21 // a response.
22 //=============================================================================
23
24 //-----------------------------------------------------------------------------
25 // Code up a string of octets at layer 2 (including CRC, we don't generate
26 // that here) so that they can be transmitted to the reader. Doesn't transmit
27 // them yet, just leaves them ready to send in ToSend[].
28 //-----------------------------------------------------------------------------
29 static void CodeIso14443bAsTag(const BYTE *cmd, int len)
30 {
31 int i;
32
33 ToSendReset();
34
35 // Transmit a burst of ones, as the initial thing that lets the
36 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
37 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
38 // so I will too.
39 for(i = 0; i < 20; i++) {
40 ToSendStuffBit(1);
41 ToSendStuffBit(1);
42 ToSendStuffBit(1);
43 ToSendStuffBit(1);
44 }
45
46 // Send SOF.
47 for(i = 0; i < 10; i++) {
48 ToSendStuffBit(0);
49 ToSendStuffBit(0);
50 ToSendStuffBit(0);
51 ToSendStuffBit(0);
52 }
53 for(i = 0; i < 2; i++) {
54 ToSendStuffBit(1);
55 ToSendStuffBit(1);
56 ToSendStuffBit(1);
57 ToSendStuffBit(1);
58 }
59
60 for(i = 0; i < len; i++) {
61 int j;
62 BYTE b = cmd[i];
63
64 // Start bit
65 ToSendStuffBit(0);
66 ToSendStuffBit(0);
67 ToSendStuffBit(0);
68 ToSendStuffBit(0);
69
70 // Data bits
71 for(j = 0; j < 8; j++) {
72 if(b & 1) {
73 ToSendStuffBit(1);
74 ToSendStuffBit(1);
75 ToSendStuffBit(1);
76 ToSendStuffBit(1);
77 } else {
78 ToSendStuffBit(0);
79 ToSendStuffBit(0);
80 ToSendStuffBit(0);
81 ToSendStuffBit(0);
82 }
83 b >>= 1;
84 }
85
86 // Stop bit
87 ToSendStuffBit(1);
88 ToSendStuffBit(1);
89 ToSendStuffBit(1);
90 ToSendStuffBit(1);
91 }
92
93 // Send SOF.
94 for(i = 0; i < 10; i++) {
95 ToSendStuffBit(0);
96 ToSendStuffBit(0);
97 ToSendStuffBit(0);
98 ToSendStuffBit(0);
99 }
100 for(i = 0; i < 10; i++) {
101 ToSendStuffBit(1);
102 ToSendStuffBit(1);
103 ToSendStuffBit(1);
104 ToSendStuffBit(1);
105 }
106
107 // Convert from last byte pos to length
108 ToSendMax++;
109
110 // Add a few more for slop
111 ToSendMax += 2;
112 }
113
114 //-----------------------------------------------------------------------------
115 // The software UART that receives commands from the reader, and its state
116 // variables.
117 //-----------------------------------------------------------------------------
118 static struct {
119 enum {
120 STATE_UNSYNCD,
121 STATE_GOT_FALLING_EDGE_OF_SOF,
122 STATE_AWAITING_START_BIT,
123 STATE_RECEIVING_DATA,
124 STATE_ERROR_WAIT
125 } state;
126 WORD shiftReg;
127 int bitCnt;
128 int byteCnt;
129 int byteCntMax;
130 int posCnt;
131 BYTE *output;
132 } Uart;
133
134 static BOOL Handle14443UartBit(int bit)
135 {
136 switch(Uart.state) {
137 case STATE_UNSYNCD:
138 if(!bit) {
139 // we went low, so this could be the beginning
140 // of an SOF
141 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
142 Uart.posCnt = 0;
143 Uart.bitCnt = 0;
144 }
145 break;
146
147 case STATE_GOT_FALLING_EDGE_OF_SOF:
148 Uart.posCnt++;
149 if(Uart.posCnt == 2) {
150 if(bit) {
151 if(Uart.bitCnt >= 10) {
152 // we've seen enough consecutive
153 // zeros that it's a valid SOF
154 Uart.posCnt = 0;
155 Uart.byteCnt = 0;
156 Uart.state = STATE_AWAITING_START_BIT;
157 } else {
158 // didn't stay down long enough
159 // before going high, error
160 Uart.state = STATE_ERROR_WAIT;
161 }
162 } else {
163 // do nothing, keep waiting
164 }
165 Uart.bitCnt++;
166 }
167 if(Uart.posCnt >= 4) Uart.posCnt = 0;
168 if(Uart.bitCnt > 14) {
169 // Give up if we see too many zeros without
170 // a one, too.
171 Uart.state = STATE_ERROR_WAIT;
172 }
173 break;
174
175 case STATE_AWAITING_START_BIT:
176 Uart.posCnt++;
177 if(bit) {
178 if(Uart.posCnt > 25) {
179 // stayed high for too long between
180 // characters, error
181 Uart.state = STATE_ERROR_WAIT;
182 }
183 } else {
184 // falling edge, this starts the data byte
185 Uart.posCnt = 0;
186 Uart.bitCnt = 0;
187 Uart.shiftReg = 0;
188 Uart.state = STATE_RECEIVING_DATA;
189 }
190 break;
191
192 case STATE_RECEIVING_DATA:
193 Uart.posCnt++;
194 if(Uart.posCnt == 2) {
195 // time to sample a bit
196 Uart.shiftReg >>= 1;
197 if(bit) {
198 Uart.shiftReg |= 0x200;
199 }
200 Uart.bitCnt++;
201 }
202 if(Uart.posCnt >= 4) {
203 Uart.posCnt = 0;
204 }
205 if(Uart.bitCnt == 10) {
206 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
207 {
208 // this is a data byte, with correct
209 // start and stop bits
210 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
211 Uart.byteCnt++;
212
213 if(Uart.byteCnt >= Uart.byteCntMax) {
214 // Buffer overflowed, give up
215 Uart.posCnt = 0;
216 Uart.state = STATE_ERROR_WAIT;
217 } else {
218 // so get the next byte now
219 Uart.posCnt = 0;
220 Uart.state = STATE_AWAITING_START_BIT;
221 }
222 } else if(Uart.shiftReg == 0x000) {
223 // this is an EOF byte
224 return TRUE;
225 } else {
226 // this is an error
227 Uart.posCnt = 0;
228 Uart.state = STATE_ERROR_WAIT;
229 }
230 }
231 break;
232
233 case STATE_ERROR_WAIT:
234 // We're all screwed up, so wait a little while
235 // for whatever went wrong to finish, and then
236 // start over.
237 Uart.posCnt++;
238 if(Uart.posCnt > 10) {
239 Uart.state = STATE_UNSYNCD;
240 }
241 break;
242
243 default:
244 Uart.state = STATE_UNSYNCD;
245 break;
246 }
247
248 return FALSE;
249 }
250
251 //-----------------------------------------------------------------------------
252 // Receive a command (from the reader to us, where we are the simulated tag),
253 // and store it in the given buffer, up to the given maximum length. Keeps
254 // spinning, waiting for a well-framed command, until either we get one
255 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
256 //
257 // Assume that we're called with the SSC (to the FPGA) and ADC path set
258 // correctly.
259 //-----------------------------------------------------------------------------
260 static BOOL GetIso14443CommandFromReader(BYTE *received, int *len, int maxLen)
261 {
262 BYTE mask;
263 int i, bit;
264
265 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
266 // only, since we are receiving, not transmitting).
267 FpgaWriteConfWord(
268 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
269
270
271 // Now run a `software UART' on the stream of incoming samples.
272 Uart.output = received;
273 Uart.byteCntMax = maxLen;
274 Uart.state = STATE_UNSYNCD;
275
276 for(;;) {
277 WDT_HIT();
278
279 if(BUTTON_PRESS()) return FALSE;
280
281 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
282 SSC_TRANSMIT_HOLDING = 0x00;
283 }
284 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
285 BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
286
287 mask = 0x80;
288 for(i = 0; i < 8; i++, mask >>= 1) {
289 bit = (b & mask);
290 if(Handle14443UartBit(bit)) {
291 *len = Uart.byteCnt;
292 return TRUE;
293 }
294 }
295 }
296 }
297 }
298
299 //-----------------------------------------------------------------------------
300 // Main loop of simulated tag: receive commands from reader, decide what
301 // response to send, and send it.
302 //-----------------------------------------------------------------------------
303 void SimulateIso14443Tag(void)
304 {
305 static const BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
306 static const BYTE response1[] = {
307 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
308 0x00, 0x21, 0x85, 0x5e, 0xd7
309 };
310
311 BYTE *resp;
312 int respLen;
313
314 BYTE *resp1 = (((BYTE *)BigBuf) + 800);
315 int resp1Len;
316
317 BYTE *receivedCmd = (BYTE *)BigBuf;
318 int len;
319
320 int i;
321
322 int cmdsRecvd = 0;
323
324 memset(receivedCmd, 0x44, 400);
325
326 CodeIso14443bAsTag(response1, sizeof(response1));
327 memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
328
329 // We need to listen to the high-frequency, peak-detected path.
330 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
331 FpgaSetupSsc();
332
333 cmdsRecvd = 0;
334
335 for(;;) {
336 BYTE b1, b2;
337
338 if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {
339 DbpIntegers(cmdsRecvd, 0, 0);
340 DbpString("button press");
341 break;
342 }
343
344 // Good, look at the command now.
345
346 if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
347 resp = resp1; respLen = resp1Len;
348 } else {
349 DbpString("new cmd from reader:");
350 DbpIntegers(len, 0x1234, cmdsRecvd);
351 // And print whether the CRC fails, just for good measure
352 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
353 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
354 // Not so good, try again.
355 DbpString("+++CRC fail");
356 } else {
357 DbpString("CRC passes");
358 }
359 break;
360 }
361
362 memset(receivedCmd, 0x44, 32);
363
364 cmdsRecvd++;
365
366 if(cmdsRecvd > 0x30) {
367 DbpString("many commands later...");
368 break;
369 }
370
371 if(respLen <= 0) continue;
372
373 // Modulate BPSK
374 FpgaWriteConfWord(
375 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
376 SSC_TRANSMIT_HOLDING = 0xff;
377 FpgaSetupSsc();
378
379 // Transmit the response.
380 i = 0;
381 for(;;) {
382 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
383 BYTE b = resp[i];
384
385 SSC_TRANSMIT_HOLDING = b;
386
387 i++;
388 if(i > respLen) {
389 break;
390 }
391 }
392 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
393 volatile BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
394 (void)b;
395 }
396 }
397 }
398 }
399
400 //=============================================================================
401 // An ISO 14443 Type B reader. We take layer two commands, code them
402 // appropriately, and then send them to the tag. We then listen for the
403 // tag's response, which we leave in the buffer to be demodulated on the
404 // PC side.
405 //=============================================================================
406
407 static struct {
408 enum {
409 DEMOD_UNSYNCD,
410 DEMOD_PHASE_REF_TRAINING,
411 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
412 DEMOD_GOT_FALLING_EDGE_OF_SOF,
413 DEMOD_AWAITING_START_BIT,
414 DEMOD_RECEIVING_DATA,
415 DEMOD_ERROR_WAIT
416 } state;
417 int bitCount;
418 int posCount;
419 int thisBit;
420 int metric;
421 int metricN;
422 WORD shiftReg;
423 BYTE *output;
424 int len;
425 int sumI;
426 int sumQ;
427 } Demod;
428
429 static BOOL Handle14443SamplesDemod(int ci, int cq)
430 {
431 int v;
432
433 // The soft decision on the bit uses an estimate of just the
434 // quadrant of the reference angle, not the exact angle.
435 #define MAKE_SOFT_DECISION() { \
436 if(Demod.sumI > 0) { \
437 v = ci; \
438 } else { \
439 v = -ci; \
440 } \
441 if(Demod.sumQ > 0) { \
442 v += cq; \
443 } else { \
444 v -= cq; \
445 } \
446 }
447
448 switch(Demod.state) {
449 case DEMOD_UNSYNCD:
450 v = ci;
451 if(v < 0) v = -v;
452 if(cq > 0) {
453 v += cq;
454 } else {
455 v -= cq;
456 }
457 if(v > 40) {
458 Demod.posCount = 0;
459 Demod.state = DEMOD_PHASE_REF_TRAINING;
460 Demod.sumI = 0;
461 Demod.sumQ = 0;
462 }
463 break;
464
465 case DEMOD_PHASE_REF_TRAINING:
466 if(Demod.posCount < 8) {
467 Demod.sumI += ci;
468 Demod.sumQ += cq;
469 } else if(Demod.posCount > 100) {
470 // error, waited too long
471 Demod.state = DEMOD_UNSYNCD;
472 } else {
473 MAKE_SOFT_DECISION();
474 if(v < 0) {
475 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
476 Demod.posCount = 0;
477 }
478 }
479 Demod.posCount++;
480 break;
481
482 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
483 MAKE_SOFT_DECISION();
484 if(v < 0) {
485 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
486 Demod.posCount = 0;
487 } else {
488 if(Demod.posCount > 100) {
489 Demod.state = DEMOD_UNSYNCD;
490 }
491 }
492 Demod.posCount++;
493 break;
494
495 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
496 MAKE_SOFT_DECISION();
497 if(v > 0) {
498 if(Demod.posCount < 12) {
499 Demod.state = DEMOD_UNSYNCD;
500 } else {
501 Demod.state = DEMOD_AWAITING_START_BIT;
502 Demod.posCount = 0;
503 Demod.len = 0;
504 Demod.metricN = 0;
505 Demod.metric = 0;
506 }
507 } else {
508 if(Demod.posCount > 100) {
509 Demod.state = DEMOD_UNSYNCD;
510 }
511 }
512 Demod.posCount++;
513 break;
514
515 case DEMOD_AWAITING_START_BIT:
516 MAKE_SOFT_DECISION();
517 if(v > 0) {
518 if(Demod.posCount > 10) {
519 Demod.state = DEMOD_UNSYNCD;
520 }
521 } else {
522 Demod.bitCount = 0;
523 Demod.posCount = 1;
524 Demod.thisBit = v;
525 Demod.shiftReg = 0;
526 Demod.state = DEMOD_RECEIVING_DATA;
527 }
528 break;
529
530 case DEMOD_RECEIVING_DATA:
531 MAKE_SOFT_DECISION();
532 if(Demod.posCount == 0) {
533 Demod.thisBit = v;
534 Demod.posCount = 1;
535 } else {
536 Demod.thisBit += v;
537
538 if(Demod.thisBit > 0) {
539 Demod.metric += Demod.thisBit;
540 } else {
541 Demod.metric -= Demod.thisBit;
542 }
543 (Demod.metricN)++;
544
545 Demod.shiftReg >>= 1;
546 if(Demod.thisBit > 0) {
547 Demod.shiftReg |= 0x200;
548 }
549
550 Demod.bitCount++;
551 if(Demod.bitCount == 10) {
552 WORD s = Demod.shiftReg;
553 if((s & 0x200) && !(s & 0x001)) {
554 BYTE b = (s >> 1);
555 Demod.output[Demod.len] = b;
556 Demod.len++;
557 Demod.state = DEMOD_AWAITING_START_BIT;
558 } else if(s == 0x000) {
559 // This is EOF
560 return TRUE;
561 Demod.state = DEMOD_UNSYNCD;
562 } else {
563 Demod.state = DEMOD_UNSYNCD;
564 }
565 }
566 Demod.posCount = 0;
567 }
568 break;
569
570 default:
571 Demod.state = DEMOD_UNSYNCD;
572 break;
573 }
574
575 return FALSE;
576 }
577
578 static void GetSamplesFor14443Demod(BOOL weTx, int n, BOOL quiet)
579 {
580 int max = 0;
581 BOOL gotFrame = FALSE;
582
583 //# define DMA_BUFFER_SIZE 8
584 SBYTE *dmaBuf;
585
586 int lastRxCounter;
587 SBYTE *upTo;
588
589 int ci, cq;
590
591 int samples = 0;
592
593 // Clear out the state of the "UART" that receives from the tag.
594 memset(BigBuf, 0x44, 400);
595 Demod.output = (BYTE *)BigBuf;
596 Demod.len = 0;
597 Demod.state = DEMOD_UNSYNCD;
598
599 // And the UART that receives from the reader
600 Uart.output = (((BYTE *)BigBuf) + 1024);
601 Uart.byteCntMax = 100;
602 Uart.state = STATE_UNSYNCD;
603
604 // Setup for the DMA.
605 dmaBuf = (SBYTE *)(BigBuf + 32);
606 upTo = dmaBuf;
607 lastRxCounter = DMA_BUFFER_SIZE;
608 FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
609
610 // And put the FPGA in the appropriate mode
611 FpgaWriteConfWord(
612 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
613 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
614
615 for(;;) {
616 int behindBy = lastRxCounter - PDC_RX_COUNTER(SSC_BASE);
617 if(behindBy > max) max = behindBy;
618
619 LED_D_ON();
620 while(((lastRxCounter-PDC_RX_COUNTER(SSC_BASE)) & (DMA_BUFFER_SIZE-1))
621 > 2)
622 {
623 ci = upTo[0];
624 cq = upTo[1];
625 upTo += 2;
626 if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
627 upTo -= DMA_BUFFER_SIZE;
628 PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;
629 PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;
630 }
631 lastRxCounter -= 2;
632 if(lastRxCounter <= 0) {
633 lastRxCounter += DMA_BUFFER_SIZE;
634 }
635
636 samples += 2;
637
638 Handle14443UartBit(1);
639 Handle14443UartBit(1);
640
641 if(Handle14443SamplesDemod(ci, cq)) {
642 gotFrame = 1;
643 }
644 }
645 LED_D_OFF();
646
647 if(samples > 2000) {
648 break;
649 }
650 }
651 PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;
652 if (!quiet) DbpIntegers(max, gotFrame, Demod.len);
653 }
654
655 //-----------------------------------------------------------------------------
656 // Read the tag's response. We just receive a stream of slightly-processed
657 // samples from the FPGA, which we will later do some signal processing on,
658 // to get the bits.
659 //-----------------------------------------------------------------------------
660 /*static void GetSamplesFor14443(BOOL weTx, int n)
661 {
662 BYTE *dest = (BYTE *)BigBuf;
663 int c;
664
665 FpgaWriteConfWord(
666 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
667 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
668
669 c = 0;
670 for(;;) {
671 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
672 SSC_TRANSMIT_HOLDING = 0x43;
673 }
674 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
675 SBYTE b;
676 b = (SBYTE)SSC_RECEIVE_HOLDING;
677
678 dest[c++] = (BYTE)b;
679
680 if(c >= n) {
681 break;
682 }
683 }
684 }
685 }*/
686
687 //-----------------------------------------------------------------------------
688 // Transmit the command (to the tag) that was placed in ToSend[].
689 //-----------------------------------------------------------------------------
690 static void TransmitFor14443(void)
691 {
692 int c;
693
694 FpgaSetupSsc();
695
696 while(SSC_STATUS & (SSC_STATUS_TX_READY)) {
697 SSC_TRANSMIT_HOLDING = 0xff;
698 }
699
700 FpgaWriteConfWord(
701 FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
702
703 for(c = 0; c < 10;) {
704 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
705 SSC_TRANSMIT_HOLDING = 0xff;
706 c++;
707 }
708 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
709 volatile DWORD r = SSC_RECEIVE_HOLDING;
710 (void)r;
711 }
712 WDT_HIT();
713 }
714
715 c = 0;
716 for(;;) {
717 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
718 SSC_TRANSMIT_HOLDING = ToSend[c];
719 c++;
720 if(c >= ToSendMax) {
721 break;
722 }
723 }
724 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
725 volatile DWORD r = SSC_RECEIVE_HOLDING;
726 (void)r;
727 }
728 WDT_HIT();
729 }
730 }
731
732 //-----------------------------------------------------------------------------
733 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
734 // so that it is ready to transmit to the tag using TransmitFor14443().
735 //-----------------------------------------------------------------------------
736 void CodeIso14443bAsReader(const BYTE *cmd, int len)
737 {
738 int i, j;
739 BYTE b;
740
741 ToSendReset();
742
743 // Establish initial reference level
744 for(i = 0; i < 40; i++) {
745 ToSendStuffBit(1);
746 }
747 // Send SOF
748 for(i = 0; i < 10; i++) {
749 ToSendStuffBit(0);
750 }
751
752 for(i = 0; i < len; i++) {
753 // Stop bits/EGT
754 ToSendStuffBit(1);
755 ToSendStuffBit(1);
756 // Start bit
757 ToSendStuffBit(0);
758 // Data bits
759 b = cmd[i];
760 for(j = 0; j < 8; j++) {
761 if(b & 1) {
762 ToSendStuffBit(1);
763 } else {
764 ToSendStuffBit(0);
765 }
766 b >>= 1;
767 }
768 }
769 // Send EOF
770 ToSendStuffBit(1);
771 for(i = 0; i < 10; i++) {
772 ToSendStuffBit(0);
773 }
774 for(i = 0; i < 8; i++) {
775 ToSendStuffBit(1);
776 }
777
778 // And then a little more, to make sure that the last character makes
779 // it out before we switch to rx mode.
780 for(i = 0; i < 24; i++) {
781 ToSendStuffBit(1);
782 }
783
784 // Convert from last character reference to length
785 ToSendMax++;
786 }
787
788 //-----------------------------------------------------------------------------
789 // Read an ISO 14443 tag. We send it some set of commands, and record the
790 // responses.
791 // The command name is misleading, it actually decodes the reponse in HEX
792 // into the output buffer (read the result using hexsamples, not hisamples)
793 //-----------------------------------------------------------------------------
794 void AcquireRawAdcSamplesIso14443(DWORD parameter)
795 {
796 BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
797
798 // Make sure that we start from off, since the tags are stateful;
799 // confusing things will happen if we don't reset them between reads.
800 LED_D_OFF();
801 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
802 SpinDelay(200);
803
804 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
805 FpgaSetupSsc();
806
807 // Now give it time to spin up.
808 FpgaWriteConfWord(
809 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
810 SpinDelay(200);
811
812 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
813 TransmitFor14443();
814 LED_A_ON();
815 GetSamplesFor14443Demod(TRUE, 2000, FALSE);
816 LED_A_OFF();
817 }
818
819 //-----------------------------------------------------------------------------
820 // Read a SRI512 ISO 14443 tag.
821 //
822 // SRI512 tags are just simple memory tags, here we're looking at making a dump
823 // of the contents of the memory. No anticollision algorithm is done, we assume
824 // we have a single tag in the field.
825 //
826 // I tried to be systematic and check every answer of the tag, every CRC, etc...
827 //-----------------------------------------------------------------------------
828 void ReadSRI512Iso14443(DWORD parameter)
829 {
830 BYTE i = 0x00;
831
832 // Make sure that we start from off, since the tags are stateful;
833 // confusing things will happen if we don't reset them between reads.
834 LED_D_OFF();
835 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
836 SpinDelay(200);
837
838 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
839 FpgaSetupSsc();
840
841 // Now give it time to spin up.
842 FpgaWriteConfWord(
843 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
844 SpinDelay(200);
845
846 // First command: wake up the tag using the INITIATE command
847 BYTE cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
848 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
849 TransmitFor14443();
850 LED_A_ON();
851 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
852 LED_A_OFF();
853
854 if (Demod.len == 0) {
855 DbpString("No response from tag");
856 return;
857 } else {
858 DbpString("Randomly generated UID from tag (+ 2 byte CRC):");
859 DbpIntegers(Demod.output[0], Demod.output[1],Demod.output[2]);
860 }
861 // There is a response, SELECT the uid
862 DbpString("Now SELECT tag:");
863 cmd1[0] = 0x0E; // 0x0E is SELECT
864 cmd1[1] = Demod.output[0];
865 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
866 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
867 TransmitFor14443();
868 LED_A_ON();
869 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
870 LED_A_OFF();
871 if (Demod.len != 3) {
872 DbpString("Expected 3 bytes from tag, got:");
873 DbpIntegers(Demod.len,0x0,0x0);
874 return;
875 }
876 // Check the CRC of the answer:
877 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
878 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
879 DbpString("CRC Error reading select response.");
880 return;
881 }
882 // Check response from the tag: should be the same UID as the command we just sent:
883 if (cmd1[1] != Demod.output[0]) {
884 DbpString("Bad response to SELECT from Tag, aborting:");
885 DbpIntegers(cmd1[1],Demod.output[0],0x0);
886 return;
887 }
888 // Tag is now selected,
889 // loop to read all 16 blocks, address from 0 to 15
890 DbpString("Tag memory dump, block 0 to 15");
891 cmd1[0] = 0x08;
892 i = 0x00;
893 for (;;) {
894 if (i == 0x10) {
895 DbpString("System area block (0xff):");
896 i = 0xff;
897 }
898 cmd1[1] = i;
899 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
900 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
901 TransmitFor14443();
902 LED_A_ON();
903 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
904 LED_A_OFF();
905 if (Demod.len != 6) { // Check if we got an answer from the tag
906 DbpString("Expected 6 bytes from tag, got less...");
907 return;
908 }
909 // The check the CRC of the answer (use cmd1 as temporary variable):
910 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
911 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
912 DbpString("CRC Error reading block! - Below: expected, got, 0x0: ");
913 DbpIntegers( (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5],0);
914 // Do not return;, let's go on... (we should retry, maybe ?)
915 }
916 // Now print out the memory location:
917 DbpString("Address , Contents, CRC");
918 DbpIntegers(i, (Demod.output[0]<<24) + (Demod.output[1]<<16) + (Demod.output[2]<<8) + Demod.output[3], (Demod.output[4]<<8)+Demod.output[5]);
919 if (i == 0xff) {
920 break;
921 }
922 i++;
923 }
924 }
925
926
927 //=============================================================================
928 // Finally, the `sniffer' combines elements from both the reader and
929 // simulated tag, to show both sides of the conversation.
930 //=============================================================================
931
932 //-----------------------------------------------------------------------------
933 // Record the sequence of commands sent by the reader to the tag, with
934 // triggering so that we start recording at the point that the tag is moved
935 // near the reader.
936 //-----------------------------------------------------------------------------
937 void SnoopIso14443(void)
938 {
939 // We won't start recording the frames that we acquire until we trigger;
940 // a good trigger condition to get started is probably when we see a
941 // response from the tag.
942 BOOL triggered = FALSE;
943
944 // The command (reader -> tag) that we're working on receiving.
945 BYTE *receivedCmd = (((BYTE *)BigBuf) + 1024);
946 // The response (tag -> reader) that we're working on receiving.
947 BYTE *receivedResponse = (((BYTE *)BigBuf) + 1536);
948
949 // As we receive stuff, we copy it from receivedCmd or receivedResponse
950 // into trace, along with its length and other annotations.
951 BYTE *trace = (BYTE *)BigBuf;
952 int traceLen = 0;
953
954 // The DMA buffer, used to stream samples from the FPGA.
955 //# define DMA_BUFFER_SIZE 256
956 SBYTE *dmaBuf = ((SBYTE *)BigBuf) + 2048;
957 int lastRxCounter;
958 SBYTE *upTo;
959 int ci, cq;
960 int maxBehindBy = 0;
961
962 // Count of samples received so far, so that we can include timing
963 // information in the trace buffer.
964 int samples = 0;
965
966 memset(trace, 0x44, 1000);
967
968 // Set up the demodulator for tag -> reader responses.
969 Demod.output = receivedResponse;
970 Demod.len = 0;
971 Demod.state = DEMOD_UNSYNCD;
972
973 // And the reader -> tag commands
974 memset(&Uart, 0, sizeof(Uart));
975 Uart.output = receivedCmd;
976 Uart.byteCntMax = 100;
977 Uart.state = STATE_UNSYNCD;
978
979 // And put the FPGA in the appropriate mode
980 FpgaWriteConfWord(
981 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
982 FPGA_HF_READER_RX_XCORR_SNOOP);
983 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
984
985 // Setup for the DMA.
986 FpgaSetupSsc();
987 upTo = dmaBuf;
988 lastRxCounter = DMA_BUFFER_SIZE;
989 FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
990
991 LED_A_ON();
992
993 // And now we loop, receiving samples.
994 for(;;) {
995 int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &
996 (DMA_BUFFER_SIZE-1);
997 if(behindBy > maxBehindBy) {
998 maxBehindBy = behindBy;
999 if(behindBy > 100) {
1000 DbpString("blew circular buffer!");
1001 goto done;
1002 }
1003 }
1004 if(behindBy < 2) continue;
1005
1006 ci = upTo[0];
1007 cq = upTo[1];
1008 upTo += 2;
1009 lastRxCounter -= 2;
1010 if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
1011 upTo -= DMA_BUFFER_SIZE;
1012 lastRxCounter += DMA_BUFFER_SIZE;
1013 PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;
1014 PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;
1015 }
1016
1017 samples += 2;
1018
1019 #define HANDLE_BIT_IF_BODY \
1020 if(triggered) { \
1021 trace[traceLen++] = ((samples >> 0) & 0xff); \
1022 trace[traceLen++] = ((samples >> 8) & 0xff); \
1023 trace[traceLen++] = ((samples >> 16) & 0xff); \
1024 trace[traceLen++] = ((samples >> 24) & 0xff); \
1025 trace[traceLen++] = 0; \
1026 trace[traceLen++] = 0; \
1027 trace[traceLen++] = 0; \
1028 trace[traceLen++] = 0; \
1029 trace[traceLen++] = Uart.byteCnt; \
1030 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
1031 traceLen += Uart.byteCnt; \
1032 if(traceLen > 1000) break; \
1033 } \
1034 /* And ready to receive another command. */ \
1035 memset(&Uart, 0, sizeof(Uart)); \
1036 Uart.output = receivedCmd; \
1037 Uart.byteCntMax = 100; \
1038 Uart.state = STATE_UNSYNCD; \
1039 /* And also reset the demod code, which might have been */ \
1040 /* false-triggered by the commands from the reader. */ \
1041 memset(&Demod, 0, sizeof(Demod)); \
1042 Demod.output = receivedResponse; \
1043 Demod.state = DEMOD_UNSYNCD; \
1044
1045 if(Handle14443UartBit(ci & 1)) {
1046 HANDLE_BIT_IF_BODY
1047 }
1048 if(Handle14443UartBit(cq & 1)) {
1049 HANDLE_BIT_IF_BODY
1050 }
1051
1052 if(Handle14443SamplesDemod(ci, cq)) {
1053 // timestamp, as a count of samples
1054 trace[traceLen++] = ((samples >> 0) & 0xff);
1055 trace[traceLen++] = ((samples >> 8) & 0xff);
1056 trace[traceLen++] = ((samples >> 16) & 0xff);
1057 trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);
1058 // correlation metric (~signal strength estimate)
1059 if(Demod.metricN != 0) {
1060 Demod.metric /= Demod.metricN;
1061 }
1062 trace[traceLen++] = ((Demod.metric >> 0) & 0xff);
1063 trace[traceLen++] = ((Demod.metric >> 8) & 0xff);
1064 trace[traceLen++] = ((Demod.metric >> 16) & 0xff);
1065 trace[traceLen++] = ((Demod.metric >> 24) & 0xff);
1066 // length
1067 trace[traceLen++] = Demod.len;
1068 memcpy(trace+traceLen, receivedResponse, Demod.len);
1069 traceLen += Demod.len;
1070 if(traceLen > 1000) break;
1071
1072 triggered = TRUE;
1073 LED_A_OFF();
1074 LED_B_ON();
1075
1076 // And ready to receive another response.
1077 memset(&Demod, 0, sizeof(Demod));
1078 Demod.output = receivedResponse;
1079 Demod.state = DEMOD_UNSYNCD;
1080 }
1081
1082 if(BUTTON_PRESS()) {
1083 DbpString("cancelled");
1084 goto done;
1085 }
1086 }
1087
1088 DbpString("in done pt");
1089
1090 DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
1091 DbpIntegers(Uart.byteCntMax, traceLen, 0x23);
1092
1093 done:
1094 PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;
1095 LED_A_OFF();
1096 LED_B_OFF();
1097 }
Proxmark3 GIT tracking
Impressum, Datenschutz