]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443b.c
projects / proxmark3-svn / blob
? search:


5a335e25afab1d27076665cbc36a0ea047e82932
[proxmark3-svn] / armsrc / iso14443b.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 // piwi 2018
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // Routines to support ISO 14443B. This includes both the reader software and
10 // the `fake tag' modes.
11 //-----------------------------------------------------------------------------
12
13 #include "iso14443b.h"
14
15 #include "proxmark3.h"
16 #include "apps.h"
17 #include "cmd.h"
18 #include "util.h"
19 #include "string.h"
20 #include "iso14443crc.h"
21 #include "fpgaloader.h"
22 #include "BigBuf.h"
23
24 #define RECEIVE_SAMPLES_TIMEOUT 64 // TR0 max is 256/fs = 256/(848kHz) = 302us or 64 samples from FPGA
25 #define ISO14443B_DMA_BUFFER_SIZE 128
26
27 // PCB Block number for APDUs
28 static uint8_t pcb_blocknum = 0;
29
30 //=============================================================================
31 // An ISO 14443 Type B tag. We listen for commands from the reader, using
32 // a UART kind of thing that's implemented in software. When we get a
33 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
34 // If it's good, then we can do something appropriate with it, and send
35 // a response.
36 //=============================================================================
37
38 //-----------------------------------------------------------------------------
39 // Code up a string of octets at layer 2 (including CRC, we don't generate
40 // that here) so that they can be transmitted to the reader. Doesn't transmit
41 // them yet, just leaves them ready to send in ToSend[].
42 //-----------------------------------------------------------------------------
43 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
44 {
45 int i;
46
47 ToSendReset();
48
49 // Transmit a burst of ones, as the initial thing that lets the
50 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
51 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
52 // so I will too.
53 for(i = 0; i < 20; i++) {
54 ToSendStuffBit(1);
55 ToSendStuffBit(1);
56 ToSendStuffBit(1);
57 ToSendStuffBit(1);
58 }
59
60 // Send SOF.
61 for(i = 0; i < 10; i++) {
62 ToSendStuffBit(0);
63 ToSendStuffBit(0);
64 ToSendStuffBit(0);
65 ToSendStuffBit(0);
66 }
67 for(i = 0; i < 2; i++) {
68 ToSendStuffBit(1);
69 ToSendStuffBit(1);
70 ToSendStuffBit(1);
71 ToSendStuffBit(1);
72 }
73
74 for(i = 0; i < len; i++) {
75 int j;
76 uint8_t b = cmd[i];
77
78 // Start bit
79 ToSendStuffBit(0);
80 ToSendStuffBit(0);
81 ToSendStuffBit(0);
82 ToSendStuffBit(0);
83
84 // Data bits
85 for(j = 0; j < 8; j++) {
86 if(b & 1) {
87 ToSendStuffBit(1);
88 ToSendStuffBit(1);
89 ToSendStuffBit(1);
90 ToSendStuffBit(1);
91 } else {
92 ToSendStuffBit(0);
93 ToSendStuffBit(0);
94 ToSendStuffBit(0);
95 ToSendStuffBit(0);
96 }
97 b >>= 1;
98 }
99
100 // Stop bit
101 ToSendStuffBit(1);
102 ToSendStuffBit(1);
103 ToSendStuffBit(1);
104 ToSendStuffBit(1);
105 }
106
107 // Send EOF.
108 for(i = 0; i < 10; i++) {
109 ToSendStuffBit(0);
110 ToSendStuffBit(0);
111 ToSendStuffBit(0);
112 ToSendStuffBit(0);
113 }
114 for(i = 0; i < 2; i++) {
115 ToSendStuffBit(1);
116 ToSendStuffBit(1);
117 ToSendStuffBit(1);
118 ToSendStuffBit(1);
119 }
120
121 // Convert from last byte pos to length
122 ToSendMax++;
123 }
124
125 //-----------------------------------------------------------------------------
126 // The software UART that receives commands from the reader, and its state
127 // variables.
128 //-----------------------------------------------------------------------------
129 static struct {
130 enum {
131 STATE_UNSYNCD,
132 STATE_GOT_FALLING_EDGE_OF_SOF,
133 STATE_AWAITING_START_BIT,
134 STATE_RECEIVING_DATA
135 } state;
136 uint16_t shiftReg;
137 int bitCnt;
138 int byteCnt;
139 int byteCntMax;
140 int posCnt;
141 uint8_t *output;
142 } Uart;
143
144 /* Receive & handle a bit coming from the reader.
145 *
146 * This function is called 4 times per bit (every 2 subcarrier cycles).
147 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
148 *
149 * LED handling:
150 * LED A -> ON once we have received the SOF and are expecting the rest.
151 * LED A -> OFF once we have received EOF or are in error state or unsynced
152 *
153 * Returns: true if we received a EOF
154 * false if we are still waiting for some more
155 */
156 static RAMFUNC int Handle14443bUartBit(uint8_t bit)
157 {
158 switch(Uart.state) {
159 case STATE_UNSYNCD:
160 if(!bit) {
161 // we went low, so this could be the beginning
162 // of an SOF
163 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
164 Uart.posCnt = 0;
165 Uart.bitCnt = 0;
166 }
167 break;
168
169 case STATE_GOT_FALLING_EDGE_OF_SOF:
170 Uart.posCnt++;
171 if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit
172 if(bit) {
173 if(Uart.bitCnt > 9) {
174 // we've seen enough consecutive
175 // zeros that it's a valid SOF
176 Uart.posCnt = 0;
177 Uart.byteCnt = 0;
178 Uart.state = STATE_AWAITING_START_BIT;
179 LED_A_ON(); // Indicate we got a valid SOF
180 } else {
181 // didn't stay down long enough
182 // before going high, error
183 Uart.state = STATE_UNSYNCD;
184 }
185 } else {
186 // do nothing, keep waiting
187 }
188 Uart.bitCnt++;
189 }
190 if(Uart.posCnt >= 4) Uart.posCnt = 0;
191 if(Uart.bitCnt > 12) {
192 // Give up if we see too many zeros without
193 // a one, too.
194 LED_A_OFF();
195 Uart.state = STATE_UNSYNCD;
196 }
197 break;
198
199 case STATE_AWAITING_START_BIT:
200 Uart.posCnt++;
201 if(bit) {
202 if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
203 // stayed high for too long between
204 // characters, error
205 Uart.state = STATE_UNSYNCD;
206 }
207 } else {
208 // falling edge, this starts the data byte
209 Uart.posCnt = 0;
210 Uart.bitCnt = 0;
211 Uart.shiftReg = 0;
212 Uart.state = STATE_RECEIVING_DATA;
213 }
214 break;
215
216 case STATE_RECEIVING_DATA:
217 Uart.posCnt++;
218 if(Uart.posCnt == 2) {
219 // time to sample a bit
220 Uart.shiftReg >>= 1;
221 if(bit) {
222 Uart.shiftReg |= 0x200;
223 }
224 Uart.bitCnt++;
225 }
226 if(Uart.posCnt >= 4) {
227 Uart.posCnt = 0;
228 }
229 if(Uart.bitCnt == 10) {
230 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
231 {
232 // this is a data byte, with correct
233 // start and stop bits
234 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
235 Uart.byteCnt++;
236
237 if(Uart.byteCnt >= Uart.byteCntMax) {
238 // Buffer overflowed, give up
239 LED_A_OFF();
240 Uart.state = STATE_UNSYNCD;
241 } else {
242 // so get the next byte now
243 Uart.posCnt = 0;
244 Uart.state = STATE_AWAITING_START_BIT;
245 }
246 } else if (Uart.shiftReg == 0x000) {
247 // this is an EOF byte
248 LED_A_OFF(); // Finished receiving
249 Uart.state = STATE_UNSYNCD;
250 if (Uart.byteCnt != 0) {
251 return true;
252 }
253 } else {
254 // this is an error
255 LED_A_OFF();
256 Uart.state = STATE_UNSYNCD;
257 }
258 }
259 break;
260
261 default:
262 LED_A_OFF();
263 Uart.state = STATE_UNSYNCD;
264 break;
265 }
266
267 return false;
268 }
269
270
271 static void UartReset()
272 {
273 Uart.byteCntMax = MAX_FRAME_SIZE;
274 Uart.state = STATE_UNSYNCD;
275 Uart.byteCnt = 0;
276 Uart.bitCnt = 0;
277 }
278
279
280 static void UartInit(uint8_t *data)
281 {
282 Uart.output = data;
283 UartReset();
284 }
285
286
287 //-----------------------------------------------------------------------------
288 // Receive a command (from the reader to us, where we are the simulated tag),
289 // and store it in the given buffer, up to the given maximum length. Keeps
290 // spinning, waiting for a well-framed command, until either we get one
291 // (returns true) or someone presses the pushbutton on the board (false).
292 //
293 // Assume that we're called with the SSC (to the FPGA) and ADC path set
294 // correctly.
295 //-----------------------------------------------------------------------------
296 static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len)
297 {
298 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
299 // only, since we are receiving, not transmitting).
300 // Signal field is off with the appropriate LED
301 LED_D_OFF();
302 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
303
304 // Now run a `software UART' on the stream of incoming samples.
305 UartInit(received);
306
307 for(;;) {
308 WDT_HIT();
309
310 if(BUTTON_PRESS()) return false;
311
312 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
313 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
314 for(uint8_t mask = 0x80; mask != 0x00; mask >>= 1) {
315 if(Handle14443bUartBit(b & mask)) {
316 *len = Uart.byteCnt;
317 return true;
318 }
319 }
320 }
321 }
322
323 return false;
324 }
325
326 //-----------------------------------------------------------------------------
327 // Main loop of simulated tag: receive commands from reader, decide what
328 // response to send, and send it.
329 //-----------------------------------------------------------------------------
330 void SimulateIso14443bTag(void)
331 {
332 LED_A_ON();
333 // the only commands we understand is WUPB, AFI=0, Select All, N=1:
334 static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB
335 // ... and REQB, AFI=0, Normal Request, N=1:
336 static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB
337 // ... and HLTB
338 static const uint8_t cmd3[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB
339 // ... and ATTRIB
340 static const uint8_t cmd4[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB
341
342 // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
343 // supports only 106kBit/s in both directions, max frame size = 32Bytes,
344 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
345 static const uint8_t response1[] = {
346 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
347 0x00, 0x21, 0x85, 0x5e, 0xd7
348 };
349 // response to HLTB and ATTRIB
350 static const uint8_t response2[] = {0x00, 0x78, 0xF0};
351
352
353 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
354
355 clear_trace();
356 set_tracing(true);
357
358 const uint8_t *resp;
359 uint8_t *respCode;
360 uint16_t respLen, respCodeLen;
361
362 // allocate command receive buffer
363 BigBuf_free();
364 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
365
366 uint16_t len;
367 uint16_t cmdsRecvd = 0;
368
369 // prepare the (only one) tag answer:
370 CodeIso14443bAsTag(response1, sizeof(response1));
371 uint8_t *resp1Code = BigBuf_malloc(ToSendMax);
372 memcpy(resp1Code, ToSend, ToSendMax);
373 uint16_t resp1CodeLen = ToSendMax;
374
375 // prepare the (other) tag answer:
376 CodeIso14443bAsTag(response2, sizeof(response2));
377 uint8_t *resp2Code = BigBuf_malloc(ToSendMax);
378 memcpy(resp2Code, ToSend, ToSendMax);
379 uint16_t resp2CodeLen = ToSendMax;
380
381 // We need to listen to the high-frequency, peak-detected path.
382 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
383 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
384
385 cmdsRecvd = 0;
386
387 for(;;) {
388
389 if(!GetIso14443bCommandFromReader(receivedCmd, &len)) {
390 Dbprintf("button pressed, received %d commands", cmdsRecvd);
391 break;
392 }
393
394 LogTrace(receivedCmd, len, 0, 0, NULL, true);
395
396 // Good, look at the command now.
397 if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0)
398 || (len == sizeof(cmd2) && memcmp(receivedCmd, cmd2, len) == 0) ) {
399 resp = response1;
400 respLen = sizeof(response1);
401 respCode = resp1Code;
402 respCodeLen = resp1CodeLen;
403 } else if ( (len == sizeof(cmd3) && receivedCmd[0] == cmd3[0])
404 || (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) ) {
405 resp = response2;
406 respLen = sizeof(response2);
407 respCode = resp2Code;
408 respCodeLen = resp2CodeLen;
409 } else {
410 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
411 // And print whether the CRC fails, just for good measure
412 uint8_t b1, b2;
413 if (len >= 3){ // if crc exists
414 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
415 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
416 // Not so good, try again.
417 DbpString("+++CRC fail");
418
419 } else {
420 DbpString("CRC passes");
421 }
422 }
423 //get rid of compiler warning
424 respCodeLen = 0;
425 resp = response1;
426 respLen = 0;
427 respCode = resp1Code;
428 //don't crash at new command just wait and see if reader will send other new cmds.
429 //break;
430 }
431
432 cmdsRecvd++;
433
434 if(cmdsRecvd > 0x30) {
435 DbpString("many commands later...");
436 break;
437 }
438
439 if(respCodeLen <= 0) continue;
440
441 // Modulate BPSK
442 // Signal field is off with the appropriate LED
443 LED_D_OFF();
444 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
445 AT91C_BASE_SSC->SSC_THR = 0xff;
446 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
447
448 // Transmit the response.
449 uint16_t i = 0;
450 for(;;) {
451 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
452 uint8_t b = respCode[i];
453
454 AT91C_BASE_SSC->SSC_THR = b;
455
456 i++;
457 if(i > respCodeLen) {
458 break;
459 }
460 }
461 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
462 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
463 (void)b;
464 }
465 }
466
467 // trace the response:
468 LogTrace(resp, respLen, 0, 0, NULL, false);
469
470 }
471
472 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
473 LED_A_OFF();
474 }
475
476 //=============================================================================
477 // An ISO 14443 Type B reader. We take layer two commands, code them
478 // appropriately, and then send them to the tag. We then listen for the
479 // tag's response, which we leave in the buffer to be demodulated on the
480 // PC side.
481 //=============================================================================
482
483 static struct {
484 enum {
485 DEMOD_UNSYNCD,
486 DEMOD_PHASE_REF_TRAINING,
487 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
488 DEMOD_GOT_FALLING_EDGE_OF_SOF,
489 DEMOD_AWAITING_START_BIT,
490 DEMOD_RECEIVING_DATA
491 } state;
492 int bitCount;
493 int posCount;
494 int thisBit;
495 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
496 int metric;
497 int metricN;
498 */
499 uint16_t shiftReg;
500 uint8_t *output;
501 int len;
502 int sumI;
503 int sumQ;
504 } Demod;
505
506 /*
507 * Handles reception of a bit from the tag
508 *
509 * This function is called 2 times per bit (every 4 subcarrier cycles).
510 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
511 *
512 * LED handling:
513 * LED C -> ON once we have received the SOF and are expecting the rest.
514 * LED C -> OFF once we have received EOF or are unsynced
515 *
516 * Returns: true if we received a EOF
517 * false if we are still waiting for some more
518 *
519 */
520 static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
521 {
522 int v;
523
524 // The soft decision on the bit uses an estimate of just the
525 // quadrant of the reference angle, not the exact angle.
526 #define MAKE_SOFT_DECISION() { \
527 if(Demod.sumI > 0) { \
528 v = ci; \
529 } else { \
530 v = -ci; \
531 } \
532 if(Demod.sumQ > 0) { \
533 v += cq; \
534 } else { \
535 v -= cq; \
536 } \
537 }
538
539 #define SUBCARRIER_DETECT_THRESHOLD 8
540
541 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
542 #define AMPLITUDE(ci,cq) (MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2))
543 switch(Demod.state) {
544 case DEMOD_UNSYNCD:
545 if(AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected
546 Demod.state = DEMOD_PHASE_REF_TRAINING;
547 Demod.sumI = ci;
548 Demod.sumQ = cq;
549 Demod.posCount = 1;
550 }
551 break;
552
553 case DEMOD_PHASE_REF_TRAINING:
554 if(Demod.posCount < 8) {
555 if (AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) {
556 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
557 // note: synchronization time > 80 1/fs
558 Demod.sumI += ci;
559 Demod.sumQ += cq;
560 Demod.posCount++;
561 } else { // subcarrier lost
562 Demod.state = DEMOD_UNSYNCD;
563 }
564 } else {
565 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
566 }
567 break;
568
569 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
570 MAKE_SOFT_DECISION();
571 if(v < 0) { // logic '0' detected
572 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
573 Demod.posCount = 0; // start of SOF sequence
574 } else {
575 if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs
576 Demod.state = DEMOD_UNSYNCD;
577 }
578 }
579 Demod.posCount++;
580 break;
581
582 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
583 Demod.posCount++;
584 MAKE_SOFT_DECISION();
585 if(v > 0) {
586 if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
587 Demod.state = DEMOD_UNSYNCD;
588 } else {
589 LED_C_ON(); // Got SOF
590 Demod.posCount = 0;
591 Demod.bitCount = 0;
592 Demod.len = 0;
593 Demod.state = DEMOD_AWAITING_START_BIT;
594 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
595 Demod.metricN = 0;
596 Demod.metric = 0;
597 */
598 }
599 } else {
600 if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu)
601 Demod.state = DEMOD_UNSYNCD;
602 LED_C_OFF();
603 }
604 }
605 break;
606
607 case DEMOD_AWAITING_START_BIT:
608 Demod.posCount++;
609 MAKE_SOFT_DECISION();
610 if (v > 0) {
611 if (Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
612 LED_C_OFF();
613 if (Demod.bitCount == 0 && Demod.len == 0) { // received SOF only, this is valid for iClass/Picopass
614 return true;
615 } else {
616 Demod.state = DEMOD_UNSYNCD;
617 }
618 }
619 } else { // start bit detected
620 Demod.posCount = 1; // this was the first half
621 Demod.thisBit = v;
622 Demod.shiftReg = 0;
623 Demod.state = DEMOD_RECEIVING_DATA;
624 }
625 break;
626
627 case DEMOD_RECEIVING_DATA:
628 MAKE_SOFT_DECISION();
629 if (Demod.posCount == 0) { // first half of bit
630 Demod.thisBit = v;
631 Demod.posCount = 1;
632 } else { // second half of bit
633 Demod.thisBit += v;
634
635 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
636 if(Demod.thisBit > 0) {
637 Demod.metric += Demod.thisBit;
638 } else {
639 Demod.metric -= Demod.thisBit;
640 }
641 (Demod.metricN)++;
642 */
643
644 Demod.shiftReg >>= 1;
645 if (Demod.thisBit > 0) { // logic '1'
646 Demod.shiftReg |= 0x200;
647 }
648
649 Demod.bitCount++;
650 if (Demod.bitCount == 10) {
651 uint16_t s = Demod.shiftReg;
652 if ((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'
653 uint8_t b = (s >> 1);
654 Demod.output[Demod.len] = b;
655 Demod.len++;
656 Demod.bitCount = 0;
657 Demod.state = DEMOD_AWAITING_START_BIT;
658 } else {
659 Demod.state = DEMOD_UNSYNCD;
660 LED_C_OFF();
661 if (s == 0x000) {
662 // This is EOF (start, stop and all data bits == '0'
663 return true;
664 }
665 }
666 }
667 Demod.posCount = 0;
668 }
669 break;
670
671 default:
672 Demod.state = DEMOD_UNSYNCD;
673 LED_C_OFF();
674 break;
675 }
676
677 return false;
678 }
679
680
681 static void DemodReset()
682 {
683 // Clear out the state of the "UART" that receives from the tag.
684 Demod.len = 0;
685 Demod.state = DEMOD_UNSYNCD;
686 Demod.posCount = 0;
687 memset(Demod.output, 0x00, MAX_FRAME_SIZE);
688 }
689
690
691 static void DemodInit(uint8_t *data)
692 {
693 Demod.output = data;
694 DemodReset();
695 }
696
697
698 /*
699 * Demodulate the samples we received from the tag, also log to tracebuffer
700 * quiet: set to 'true' to disable debug output
701 */
702 static int GetSamplesFor14443bDemod(int timeout, bool quiet) {
703 int ret = 0;
704 int maxBehindBy = 0;
705 bool gotFrame = false;
706 int lastRxCounter, samples = 0;
707 int8_t ci, cq;
708
709 // Allocate memory from BigBuf for some buffers
710 // free all previous allocations first
711 BigBuf_free();
712
713 // The response (tag -> reader) that we're receiving.
714 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
715
716 // The DMA buffer, used to stream samples from the FPGA
717 uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));
718
719 // Set up the demodulator for tag -> reader responses.
720 DemodInit(receivedResponse);
721
722 // wait for last transfer to complete
723 while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY))
724
725 // Setup and start DMA.
726 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
727 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
728
729 uint16_t *upTo = dmaBuf;
730 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
731
732 // Signal field is ON with the appropriate LED:
733 LED_D_ON();
734 // And put the FPGA in the appropriate mode
735 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_848_KHZ | FPGA_HF_READER_MODE_RECEIVE_IQ);
736
737 for(;;) {
738 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
739 if(behindBy > maxBehindBy) {
740 maxBehindBy = behindBy;
741 }
742
743 if(behindBy < 1) continue;
744
745 ci = *upTo >> 8;
746 cq = *upTo;
747 upTo++;
748 lastRxCounter--;
749 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
750 upTo = dmaBuf; // start reading the circular buffer from the beginning
751 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
752 }
753 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
754 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
755 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers
756 }
757 samples++;
758
759 if (Handle14443bSamplesDemod(ci, cq)) {
760 ret = Demod.len;
761 gotFrame = true;
762 break;
763 }
764
765 if(samples > timeout && Demod.state < DEMOD_PHASE_REF_TRAINING) {
766 ret = -1;
767 LED_C_OFF();
768 break;
769 }
770 }
771
772 FpgaDisableSscDma();
773
774 if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", maxBehindBy, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
775
776 if (ret < 0) {
777 return ret;
778 }
779 //Tracing
780 LogTrace(Demod.output, Demod.len, 0, 0, NULL, false);
781
782 return ret;
783 }
784
785
786 //-----------------------------------------------------------------------------
787 // Transmit the command (to the tag) that was placed in ToSend[].
788 //-----------------------------------------------------------------------------
789 static void TransmitFor14443b(void)
790 {
791 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);
792 LED_B_ON();
793 for(int c = 0; c < ToSendMax; c++) {
794 uint8_t data = ToSend[c];
795 for (int i = 0; i < 8; i++) {
796 uint16_t send_word = (data & 0x80) ? 0x0000 : 0xffff;
797 while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;
798 AT91C_BASE_SSC->SSC_THR = send_word;
799 while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;
800 AT91C_BASE_SSC->SSC_THR = send_word;
801 data <<= 1;
802 }
803 WDT_HIT();
804 }
805 LED_B_OFF();
806 }
807
808
809 //-----------------------------------------------------------------------------
810 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
811 // so that it is ready to transmit to the tag using TransmitFor14443b().
812 //-----------------------------------------------------------------------------
813 static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
814 {
815 int i, j;
816 uint8_t b;
817
818 ToSendReset();
819
820 // Send SOF
821 for(i = 0; i < 10; i++) {
822 ToSendStuffBit(0);
823 }
824 ToSendStuffBit(1);
825 ToSendStuffBit(1);
826
827 for(i = 0; i < len; i++) {
828 // Start bit
829 ToSendStuffBit(0);
830 // Data bits
831 b = cmd[i];
832 for(j = 0; j < 8; j++) {
833 if(b & 1) {
834 ToSendStuffBit(1);
835 } else {
836 ToSendStuffBit(0);
837 }
838 b >>= 1;
839 }
840 // Stop bit
841 ToSendStuffBit(1);
842 }
843
844 // Send EOF
845 for(i = 0; i < 10; i++) {
846 ToSendStuffBit(0);
847 }
848 ToSendStuffBit(1);
849
850 // ensure that last byte is filled up
851 for(i = 0; i < 8; i++) {
852 ToSendStuffBit(1);
853 }
854
855 // Convert from last character reference to length
856 ToSendMax++;
857 }
858
859
860 /**
861 Convenience function to encode, transmit and trace iso 14443b comms
862 **/
863 static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
864 {
865 CodeIso14443bAsReader(cmd, len);
866 TransmitFor14443b();
867 LogTrace(cmd,len, 0, 0, NULL, true);
868 }
869
870 /* Sends an APDU to the tag
871 * TODO: check CRC and preamble
872 */
873 int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response) {
874 LED_A_ON();
875 uint8_t message_frame[message_length + 4];
876 // PCB
877 message_frame[0] = 0x0A | pcb_blocknum;
878 pcb_blocknum ^= 1;
879 // CID
880 message_frame[1] = 0;
881 // INF
882 memcpy(message_frame + 2, message, message_length);
883 // EDC (CRC)
884 ComputeCrc14443(CRC_14443_B, message_frame, message_length + 2, &message_frame[message_length + 2], &message_frame[message_length + 3]);
885 // send
886 CodeAndTransmit14443bAsReader(message_frame, message_length + 4);
887 // get response
888 int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
889 FpgaDisableTracing();
890 if (ret < 3) {
891 LED_A_OFF();
892 return 0;
893 }
894 // TODO: Check CRC
895 // copy response contents
896 if (response != NULL) {
897 memcpy(response, Demod.output, Demod.len);
898 }
899 LED_A_OFF();
900 return ret;
901 }
902
903 /* Perform the ISO 14443 B Card Selection procedure
904 * Currently does NOT do any collision handling.
905 * It expects 0-1 cards in the device's range.
906 * TODO: Support multiple cards (perform anticollision)
907 * TODO: Verify CRC checksums
908 */
909 int iso14443b_select_card()
910 {
911 // WUPB command (including CRC)
912 // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state
913 static const uint8_t wupb[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
914 // ATTRIB command (with space for CRC)
915 uint8_t attrib[] = { 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00};
916
917 // first, wake up the tag
918 CodeAndTransmit14443bAsReader(wupb, sizeof(wupb));
919 int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
920 // ATQB too short?
921 if (ret < 14) {
922 return 2;
923 }
924
925 // select the tag
926 // copy the PUPI to ATTRIB
927 memcpy(attrib + 1, Demod.output + 1, 4);
928 /* copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into
929 ATTRIB (Param 3) */
930 attrib[7] = Demod.output[10] & 0x0F;
931 ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10);
932 CodeAndTransmit14443bAsReader(attrib, sizeof(attrib));
933 ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
934 // Answer to ATTRIB too short?
935 if (ret < 3) {
936 return 2;
937 }
938 // reset PCB block number
939 pcb_blocknum = 0;
940 return 1;
941 }
942
943 // Set up ISO 14443 Type B communication (similar to iso14443a_setup)
944 void iso14443b_setup() {
945 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
946 // Set up the synchronous serial port
947 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
948 // connect Demodulated Signal to ADC:
949 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
950
951 // Signal field is on with the appropriate LED
952 LED_D_ON();
953 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);
954
955 DemodReset();
956 UartReset();
957 }
958
959 //-----------------------------------------------------------------------------
960 // Read a SRI512 ISO 14443B tag.
961 //
962 // SRI512 tags are just simple memory tags, here we're looking at making a dump
963 // of the contents of the memory. No anticollision algorithm is done, we assume
964 // we have a single tag in the field.
965 //
966 // I tried to be systematic and check every answer of the tag, every CRC, etc...
967 //-----------------------------------------------------------------------------
968 void ReadSTMemoryIso14443b(uint32_t dwLast)
969 {
970 LED_A_ON();
971 uint8_t i = 0x00;
972
973 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
974 // Make sure that we start from off, since the tags are stateful;
975 // confusing things will happen if we don't reset them between reads.
976 LED_D_OFF();
977 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
978 SpinDelay(200);
979
980 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
981 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
982
983 // Now give it time to spin up.
984 // Signal field is on with the appropriate LED
985 LED_D_ON();
986 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);
987 SpinDelay(200);
988
989 clear_trace();
990 set_tracing(true);
991
992 // First command: wake up the tag using the INITIATE command
993 uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
994 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
995 int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
996
997 if (ret < 0) {
998 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
999 DbpString("No response from tag");
1000 LEDsoff();
1001 return;
1002 } else {
1003 Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
1004 Demod.output[0], Demod.output[1], Demod.output[2]);
1005 }
1006
1007 // There is a response, SELECT the uid
1008 DbpString("Now SELECT tag:");
1009 cmd1[0] = 0x0E; // 0x0E is SELECT
1010 cmd1[1] = Demod.output[0];
1011 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1012 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
1013 ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
1014 if (Demod.len != 3) {
1015 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1016 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
1017 LEDsoff();
1018 return;
1019 }
1020 // Check the CRC of the answer:
1021 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
1022 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
1023 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1024 DbpString("CRC Error reading select response.");
1025 LEDsoff();
1026 return;
1027 }
1028 // Check response from the tag: should be the same UID as the command we just sent:
1029 if (cmd1[1] != Demod.output[0]) {
1030 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1031 Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
1032 LEDsoff();
1033 return;
1034 }
1035
1036 // Tag is now selected,
1037 // First get the tag's UID:
1038 cmd1[0] = 0x0B;
1039 ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
1040 CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
1041 ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
1042 if (ret != 10) {
1043 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1044 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
1045 LEDsoff();
1046 return;
1047 }
1048 // The check the CRC of the answer (use cmd1 as temporary variable):
1049 ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
1050 if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
1051 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1052 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
1053 // Do not return;, let's go on... (we should retry, maybe ?)
1054 }
1055 Dbprintf("Tag UID (64 bits): %08x %08x",
1056 (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
1057 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
1058
1059 // Now loop to read all 16 blocks, address from 0 to last block
1060 Dbprintf("Tag memory dump, block 0 to %d", dwLast);
1061 cmd1[0] = 0x08;
1062 i = 0x00;
1063 dwLast++;
1064 for (;;) {
1065 if (i == dwLast) {
1066 DbpString("System area block (0xff):");
1067 i = 0xff;
1068 }
1069 cmd1[1] = i;
1070 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1071 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
1072 ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
1073 if (ret != 6) { // Check if we got an answer from the tag
1074 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1075 DbpString("Expected 6 bytes from tag, got less...");
1076 LEDsoff();
1077 return;
1078 }
1079 // The check the CRC of the answer (use cmd1 as temporary variable):
1080 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
1081 if (cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
1082 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1083 (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
1084 // Do not return;, let's go on... (we should retry, maybe ?)
1085 }
1086 // Now print out the memory location:
1087 Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
1088 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1089 (Demod.output[4]<<8)+Demod.output[5]);
1090 if (i == 0xff) {
1091 break;
1092 }
1093 i++;
1094 }
1095
1096 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1097 LEDsoff();
1098 }
1099
1100
1101 //=============================================================================
1102 // Finally, the `sniffer' combines elements from both the reader and
1103 // simulated tag, to show both sides of the conversation.
1104 //=============================================================================
1105
1106 //-----------------------------------------------------------------------------
1107 // Record the sequence of commands sent by the reader to the tag, with
1108 // triggering so that we start recording at the point that the tag is moved
1109 // near the reader.
1110 //-----------------------------------------------------------------------------
1111 /*
1112 * Memory usage for this function, (within BigBuf)
1113 * Last Received command (reader->tag) - MAX_FRAME_SIZE
1114 * Last Received command (tag->reader) - MAX_FRAME_SIZE
1115 * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
1116 * Demodulated samples received - all the rest
1117 */
1118 void RAMFUNC SnoopIso14443b(void)
1119 {
1120 LED_A_ON();
1121 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1122 BigBuf_free();
1123
1124 clear_trace();
1125 set_tracing(true);
1126
1127 // The DMA buffer, used to stream samples from the FPGA
1128 uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));
1129 int lastRxCounter;
1130 uint16_t *upTo;
1131 int8_t ci, cq;
1132 int maxBehindBy = 0;
1133
1134 // Count of samples received so far, so that we can include timing
1135 // information in the trace buffer.
1136 int samples = 0;
1137
1138 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
1139 UartInit(BigBuf_malloc(MAX_FRAME_SIZE));
1140
1141 // Print some debug information about the buffer sizes
1142 Dbprintf("Snooping buffers initialized:");
1143 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1144 Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
1145 Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
1146 Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
1147
1148 // Signal field is off
1149 LED_D_OFF();
1150
1151 // And put the FPGA in the appropriate mode
1152 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_848_KHZ | FPGA_HF_READER_MODE_SNOOP_IQ);
1153 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1154
1155 // Setup for the DMA.
1156 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
1157 upTo = dmaBuf;
1158 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
1159 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
1160
1161 bool TagIsActive = false;
1162 bool ReaderIsActive = false;
1163 // We won't start recording the frames that we acquire until we trigger.
1164 // A good trigger condition to get started is probably when we see a
1165 // reader command
1166 bool triggered = false;
1167
1168 // And now we loop, receiving samples.
1169 for(;;) {
1170 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
1171 if(behindBy > maxBehindBy) {
1172 maxBehindBy = behindBy;
1173 }
1174
1175 if(behindBy < 1) continue;
1176
1177 ci = *upTo>>8;
1178 cq = *upTo;
1179 upTo++;
1180 lastRxCounter--;
1181 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
1182 upTo = dmaBuf; // start reading the circular buffer from the beginning again
1183 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
1184 if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) {
1185 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);
1186 break;
1187 }
1188 }
1189 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
1190 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
1191 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers
1192 WDT_HIT();
1193 if(BUTTON_PRESS()) {
1194 DbpString("cancelled");
1195 break;
1196 }
1197 }
1198
1199 samples++;
1200
1201 if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
1202 if(Handle14443bUartBit(ci & 0x01)) {
1203 triggered = true;
1204 LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);
1205 /* And ready to receive another command. */
1206 UartReset();
1207 /* And also reset the demod code, which might have been */
1208 /* false-triggered by the commands from the reader. */
1209 DemodReset();
1210 }
1211 if(Handle14443bUartBit(cq & 0x01)) {
1212 triggered = true;
1213 LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);
1214 /* And ready to receive another command. */
1215 UartReset();
1216 /* And also reset the demod code, which might have been */
1217 /* false-triggered by the commands from the reader. */
1218 DemodReset();
1219 }
1220 ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);
1221 }
1222
1223 if (!ReaderIsActive && triggered) { // no need to try decoding tag data if the reader is sending or not yet triggered
1224 if (Handle14443bSamplesDemod(ci/2, cq/2) >= 0) {
1225 //Use samples as a time measurement
1226 LogTrace(Demod.output, Demod.len, samples, samples, NULL, false);
1227 // And ready to receive another response.
1228 DemodReset();
1229 }
1230 TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF);
1231 }
1232
1233 }
1234
1235 FpgaDisableSscDma();
1236 DbpString("Snoop statistics:");
1237 Dbprintf(" Max behind by: %i", maxBehindBy);
1238 Dbprintf(" Uart State: %x", Uart.state);
1239 Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);
1240 Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);
1241 Dbprintf(" Trace length: %i", BigBuf_get_traceLen());
1242 LEDsoff();
1243 }
1244
1245
1246 /*
1247 * Send raw command to tag ISO14443B
1248 * @Input
1249 * datalen len of buffer data
1250 * recv bool when true wait for data from tag and send to client
1251 * powerfield bool leave the field on when true
1252 * data buffer with byte to send
1253 *
1254 * @Output
1255 * none
1256 *
1257 */
1258 void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])
1259 {
1260 LED_A_ON();
1261 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1262 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1263
1264 // switch field on and give tag some time to power up
1265 LED_D_ON();
1266 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);
1267 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);
1268 SpinDelay(10);
1269
1270 if (datalen){
1271 set_tracing(true);
1272
1273 CodeAndTransmit14443bAsReader(data, datalen);
1274
1275 if (recv) {
1276 int ret = GetSamplesFor14443bDemod(5*RECEIVE_SAMPLES_TIMEOUT, true);
1277 FpgaDisableTracing();
1278 uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
1279 cmd_send(CMD_ACK, ret, 0, 0, Demod.output, iLen);
1280 }
1281
1282 FpgaDisableTracing();
1283 }
1284
1285 if (!powerfield) {
1286 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1287 LED_D_OFF();
1288 }
1289
1290 LED_A_OFF();
1291 }
1292
Proxmark3 GIT tracking
Impressum, Datenschutz