1 //-----------------------------------------------------------------------------
2 // Gerhard de Koning Gans - May 2008
3 // Hagen Fritsch - June 2010
4 // Gerhard de Koning Gans - May 2011
5 // Gerhard de Koning Gans - June 2012 - Added iClass card and reader emulation
7 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
8 // at your option, any later version. See the LICENSE.txt file for the text of
10 //-----------------------------------------------------------------------------
11 // Routines to support iClass.
12 //-----------------------------------------------------------------------------
13 // Based on ISO14443a implementation. Still in experimental phase.
14 // Contribution made during a security research at Radboud University Nijmegen
16 // Please feel free to contribute and extend iClass support!!
17 //-----------------------------------------------------------------------------
21 // We still have sometimes a demodulation error when snooping iClass communication.
22 // The resulting trace of a read-block-03 command may look something like this:
24 // + 22279: : 0c 03 e8 01
26 // ...with an incorrect answer...
28 // + 85: 0: TAG ff! ff! ff! ff! ff! ff! ff! ff! bb 33 bb 00 01! 0e! 04! bb !crc
30 // We still left the error signalling bytes in the traces like 0xbb
32 // A correct trace should look like this:
34 // + 21112: : 0c 03 e8 01
35 // + 85: 0: TAG ff ff ff ff ff ff ff ff ea f5
37 //-----------------------------------------------------------------------------
39 #include "proxmark3.h"
44 // Needed for CRC in emulation mode;
45 // same construction as in ISO 14443;
46 // different initial value (CRC_ICLASS)
47 #include "iso14443crc.h"
49 static int timeout
= 4096;
52 // Sequence D: 11110000 modulation with subcarrier during first half
53 // Sequence E: 00001111 modulation with subcarrier during second half
54 // Sequence F: 00000000 no modulation with subcarrier
56 // Sequence X: 00001100 drop after half a period
57 // Sequence Y: 00000000 no drop
58 // Sequence Z: 11000000 drop at start
63 // SAME AS IN iso14443a.
64 #define RECV_CMD_OFFSET 3032
65 #define RECV_RES_OFFSET 3096
66 #define DMA_BUFFER_OFFSET 3160
67 #define DMA_BUFFER_SIZE 4096
68 #define TRACE_LENGTH 3000
70 uint32_t SwapBits(uint32_t value
, int nrbits
) {
72 uint32_t newvalue
= 0;
73 for(i
= 0; i
< nrbits
; i
++) {
74 newvalue
^= ((value
>> i
) & 1) << (nrbits
- 1 - i
);
79 static int SendIClassAnswer(uint8_t *resp
, int respLen
, int delay
);
81 //-----------------------------------------------------------------------------
82 // The software UART that receives commands from the reader, and its state
84 //-----------------------------------------------------------------------------
88 STATE_START_OF_COMMUNICATION
,
109 static RAMFUNC
int OutOfNDecoding(int bit
)
114 if(!Uart
.bitBuffer
) {
115 Uart
.bitBuffer
= bit
^ 0xFF0;
119 Uart
.bitBuffer
<<= 4;
120 Uart
.bitBuffer
^= bit
;
124 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
127 if(Uart.byteCnt > 15) { return TRUE; }
133 if(Uart
.state
!= STATE_UNSYNCD
) {
136 if((Uart
.bitBuffer
& Uart
.syncBit
) ^ Uart
.syncBit
) {
142 if(((Uart
.bitBuffer
<< 1) & Uart
.syncBit
) ^ Uart
.syncBit
) {
148 if(bit
!= bitright
) { bit
= bitright
; }
151 // So, now we only have to deal with *bit*, lets see...
152 if(Uart
.posCnt
== 1) {
153 // measurement first half bitperiod
155 // Drop in first half means that we are either seeing
158 if(Uart
.nOutOfCnt
== 1) {
159 // End of Communication
160 Uart
.state
= STATE_UNSYNCD
;
162 if(Uart
.byteCnt
== 0) {
163 // Its not straightforward to show single EOFs
164 // So just leave it and do not return TRUE
165 Uart
.output
[Uart
.byteCnt
] = 0xf0;
168 // Calculate the parity bit for the client...
175 else if(Uart
.state
!= STATE_START_OF_COMMUNICATION
) {
176 // When not part of SOF or EOF, it is an error
177 Uart
.state
= STATE_UNSYNCD
;
184 // measurement second half bitperiod
185 // Count the bitslot we are in... (ISO 15693)
189 if(Uart
.dropPosition
) {
190 if(Uart
.state
== STATE_START_OF_COMMUNICATION
) {
196 // It is an error if we already have seen a drop in current frame
197 Uart
.state
= STATE_UNSYNCD
;
201 Uart
.dropPosition
= Uart
.nOutOfCnt
;
208 if(Uart
.nOutOfCnt
== Uart
.OutOfCnt
&& Uart
.OutOfCnt
== 4) {
211 if(Uart
.state
== STATE_START_OF_COMMUNICATION
) {
212 if(Uart
.dropPosition
== 4) {
213 Uart
.state
= STATE_RECEIVING
;
216 else if(Uart
.dropPosition
== 3) {
217 Uart
.state
= STATE_RECEIVING
;
219 //Uart.output[Uart.byteCnt] = 0xdd;
223 Uart
.state
= STATE_UNSYNCD
;
226 Uart
.dropPosition
= 0;
231 if(!Uart
.dropPosition
) {
232 Uart
.state
= STATE_UNSYNCD
;
241 //if(Uart.dropPosition == 1) { Uart.dropPosition = 2; }
242 //else if(Uart.dropPosition == 2) { Uart.dropPosition = 1; }
244 Uart
.shiftReg
^= ((Uart
.dropPosition
& 0x03) << 6);
246 Uart
.dropPosition
= 0;
248 if(Uart
.bitCnt
== 8) {
249 Uart
.output
[Uart
.byteCnt
] = (Uart
.shiftReg
& 0xff);
252 // Calculate the parity bit for the client...
253 Uart
.parityBits
<<= 1;
254 Uart
.parityBits
^= OddByteParity
[(Uart
.shiftReg
& 0xff)];
262 else if(Uart
.nOutOfCnt
== Uart
.OutOfCnt
) {
265 if(!Uart
.dropPosition
) {
266 Uart
.state
= STATE_UNSYNCD
;
272 Uart
.output
[Uart
.byteCnt
] = (Uart
.dropPosition
& 0xff);
275 // Calculate the parity bit for the client...
276 Uart
.parityBits
<<= 1;
277 Uart
.parityBits
^= OddByteParity
[(Uart
.dropPosition
& 0xff)];
282 Uart
.dropPosition
= 0;
287 Uart.output[Uart.byteCnt] = 0xAA;
289 Uart.output[Uart.byteCnt] = error & 0xFF;
291 Uart.output[Uart.byteCnt] = 0xAA;
293 Uart.output[Uart.byteCnt] = (Uart.bitBuffer >> 8) & 0xFF;
295 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
297 Uart.output[Uart.byteCnt] = (Uart.syncBit >> 3) & 0xFF;
299 Uart.output[Uart.byteCnt] = 0xAA;
307 bit
= Uart
.bitBuffer
& 0xf0;
309 bit
^= 0x0F; // drops become 1s ;-)
311 // should have been high or at least (4 * 128) / fc
312 // according to ISO this should be at least (9 * 128 + 20) / fc
313 if(Uart
.highCnt
== 8) {
314 // we went low, so this could be start of communication
315 // it turns out to be safer to choose a less significant
316 // syncbit... so we check whether the neighbour also represents the drop
317 Uart
.posCnt
= 1; // apparently we are busy with our first half bit period
318 Uart
.syncBit
= bit
& 8;
320 if(!Uart
.syncBit
) { Uart
.syncBit
= bit
& 4; Uart
.samples
= 2; }
321 else if(bit
& 4) { Uart
.syncBit
= bit
& 4; Uart
.samples
= 2; bit
<<= 2; }
322 if(!Uart
.syncBit
) { Uart
.syncBit
= bit
& 2; Uart
.samples
= 1; }
323 else if(bit
& 2) { Uart
.syncBit
= bit
& 2; Uart
.samples
= 1; bit
<<= 1; }
324 if(!Uart
.syncBit
) { Uart
.syncBit
= bit
& 1; Uart
.samples
= 0;
325 if(Uart
.syncBit
&& (Uart
.bitBuffer
& 8)) {
328 // the first half bit period is expected in next sample
333 else if(bit
& 1) { Uart
.syncBit
= bit
& 1; Uart
.samples
= 0; }
336 Uart
.state
= STATE_START_OF_COMMUNICATION
;
341 Uart
.OutOfCnt
= 4; // Start at 1/4, could switch to 1/256
342 Uart
.dropPosition
= 0;
351 if(Uart
.highCnt
< 8) {
360 //=============================================================================
362 //=============================================================================
367 DEMOD_START_OF_COMMUNICATION
,
368 DEMOD_START_OF_COMMUNICATION2
,
369 DEMOD_START_OF_COMMUNICATION3
,
373 DEMOD_END_OF_COMMUNICATION
,
374 DEMOD_END_OF_COMMUNICATION2
,
398 static RAMFUNC
int ManchesterDecoding(int v
)
405 Demod
.buffer
= Demod
.buffer2
;
406 Demod
.buffer2
= Demod
.buffer3
;
414 if(Demod
.state
==DEMOD_UNSYNCD
) {
415 Demod
.output
[Demod
.len
] = 0xfa;
418 Demod
.posCount
= 1; // This is the first half bit period, so after syncing handle the second part
421 Demod
.syncBit
= 0x08;
428 Demod
.syncBit
= 0x04;
435 Demod
.syncBit
= 0x02;
438 if(bit
& 0x01 && Demod
.syncBit
) {
439 Demod
.syncBit
= 0x01;
444 Demod
.state
= DEMOD_START_OF_COMMUNICATION
;
445 Demod
.sub
= SUB_FIRST_HALF
;
448 Demod
.parityBits
= 0;
451 //if(trigger) LED_A_OFF(); // Not useful in this case...
452 switch(Demod
.syncBit
) {
453 case 0x08: Demod
.samples
= 3; break;
454 case 0x04: Demod
.samples
= 2; break;
455 case 0x02: Demod
.samples
= 1; break;
456 case 0x01: Demod
.samples
= 0; break;
458 // SOF must be long burst... otherwise stay unsynced!!!
459 if(!(Demod
.buffer
& Demod
.syncBit
) || !(Demod
.buffer2
& Demod
.syncBit
)) {
460 Demod
.state
= DEMOD_UNSYNCD
;
464 // SOF must be long burst... otherwise stay unsynced!!!
465 if(!(Demod
.buffer2
& Demod
.syncBit
) || !(Demod
.buffer3
& Demod
.syncBit
)) {
466 Demod
.state
= DEMOD_UNSYNCD
;
476 modulation
= bit
& Demod
.syncBit
;
477 modulation
|= ((bit
<< 1) ^ ((Demod
.buffer
& 0x08) >> 3)) & Demod
.syncBit
;
478 //modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
482 if(Demod
.posCount
==0) {
485 Demod
.sub
= SUB_FIRST_HALF
;
488 Demod
.sub
= SUB_NONE
;
493 /*(modulation && (Demod.sub == SUB_FIRST_HALF)) {
494 if(Demod.state!=DEMOD_ERROR_WAIT) {
495 Demod.state = DEMOD_ERROR_WAIT;
496 Demod.output[Demod.len] = 0xaa;
500 //else if(modulation) {
502 if(Demod
.sub
== SUB_FIRST_HALF
) {
503 Demod
.sub
= SUB_BOTH
;
506 Demod
.sub
= SUB_SECOND_HALF
;
509 else if(Demod
.sub
== SUB_NONE
) {
510 if(Demod
.state
== DEMOD_SOF_COMPLETE
) {
511 Demod
.output
[Demod
.len
] = 0x0f;
513 Demod
.parityBits
<<= 1;
514 Demod
.parityBits
^= OddByteParity
[0x0f];
515 Demod
.state
= DEMOD_UNSYNCD
;
520 Demod
.state
= DEMOD_ERROR_WAIT
;
523 /*if(Demod.state!=DEMOD_ERROR_WAIT) {
524 Demod.state = DEMOD_ERROR_WAIT;
525 Demod.output[Demod.len] = 0xaa;
530 switch(Demod
.state
) {
531 case DEMOD_START_OF_COMMUNICATION
:
532 if(Demod
.sub
== SUB_BOTH
) {
533 //Demod.state = DEMOD_MANCHESTER_D;
534 Demod
.state
= DEMOD_START_OF_COMMUNICATION2
;
536 Demod
.sub
= SUB_NONE
;
539 Demod
.output
[Demod
.len
] = 0xab;
540 Demod
.state
= DEMOD_ERROR_WAIT
;
544 case DEMOD_START_OF_COMMUNICATION2
:
545 if(Demod
.sub
== SUB_SECOND_HALF
) {
546 Demod
.state
= DEMOD_START_OF_COMMUNICATION3
;
549 Demod
.output
[Demod
.len
] = 0xab;
550 Demod
.state
= DEMOD_ERROR_WAIT
;
554 case DEMOD_START_OF_COMMUNICATION3
:
555 if(Demod
.sub
== SUB_SECOND_HALF
) {
556 // Demod.state = DEMOD_MANCHESTER_D;
557 Demod
.state
= DEMOD_SOF_COMPLETE
;
558 //Demod.output[Demod.len] = Demod.syncBit & 0xFF;
562 Demod
.output
[Demod
.len
] = 0xab;
563 Demod
.state
= DEMOD_ERROR_WAIT
;
567 case DEMOD_SOF_COMPLETE
:
568 case DEMOD_MANCHESTER_D
:
569 case DEMOD_MANCHESTER_E
:
570 // OPPOSITE FROM ISO14443 - 11110000 = 0 (1 in 14443)
571 // 00001111 = 1 (0 in 14443)
572 if(Demod
.sub
== SUB_SECOND_HALF
) { // SUB_FIRST_HALF
574 Demod
.shiftReg
= (Demod
.shiftReg
>> 1) ^ 0x100;
575 Demod
.state
= DEMOD_MANCHESTER_D
;
577 else if(Demod
.sub
== SUB_FIRST_HALF
) { // SUB_SECOND_HALF
579 Demod
.shiftReg
>>= 1;
580 Demod
.state
= DEMOD_MANCHESTER_E
;
582 else if(Demod
.sub
== SUB_BOTH
) {
583 Demod
.state
= DEMOD_MANCHESTER_F
;
586 Demod
.state
= DEMOD_ERROR_WAIT
;
591 case DEMOD_MANCHESTER_F
:
592 // Tag response does not need to be a complete byte!
593 if(Demod
.len
> 0 || Demod
.bitCount
> 0) {
594 if(Demod
.bitCount
> 1) { // was > 0, do not interpret last closing bit, is part of EOF
595 Demod
.shiftReg
>>= (9 - Demod
.bitCount
);
596 Demod
.output
[Demod
.len
] = Demod
.shiftReg
& 0xff;
598 // No parity bit, so just shift a 0
599 Demod
.parityBits
<<= 1;
602 Demod
.state
= DEMOD_UNSYNCD
;
606 Demod
.output
[Demod
.len
] = 0xad;
607 Demod
.state
= DEMOD_ERROR_WAIT
;
612 case DEMOD_ERROR_WAIT
:
613 Demod
.state
= DEMOD_UNSYNCD
;
617 Demod
.output
[Demod
.len
] = 0xdd;
618 Demod
.state
= DEMOD_UNSYNCD
;
622 /*if(Demod.bitCount>=9) {
623 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
626 Demod.parityBits <<= 1;
627 Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);
632 if(Demod
.bitCount
>=8) {
633 Demod
.shiftReg
>>= 1;
634 Demod
.output
[Demod
.len
] = (Demod
.shiftReg
& 0xff);
637 // FOR ISO15639 PARITY NOT SEND OTA, JUST CALCULATE IT FOR THE CLIENT
638 Demod
.parityBits
<<= 1;
639 Demod
.parityBits
^= OddByteParity
[(Demod
.shiftReg
& 0xff)];
646 Demod
.output
[Demod
.len
] = 0xBB;
648 Demod
.output
[Demod
.len
] = error
& 0xFF;
650 Demod
.output
[Demod
.len
] = 0xBB;
652 Demod
.output
[Demod
.len
] = bit
& 0xFF;
654 Demod
.output
[Demod
.len
] = Demod
.buffer
& 0xFF;
657 Demod
.output
[Demod
.len
] = Demod
.buffer2
& 0xFF;
659 Demod
.output
[Demod
.len
] = Demod
.syncBit
& 0xFF;
661 Demod
.output
[Demod
.len
] = 0xBB;
668 } // end (state != UNSYNCED)
673 //=============================================================================
674 // Finally, a `sniffer' for iClass communication
675 // Both sides of communication!
676 //=============================================================================
678 //-----------------------------------------------------------------------------
679 // Record the sequence of commands sent by the reader to the tag, with
680 // triggering so that we start recording at the point that the tag is moved
682 //-----------------------------------------------------------------------------
683 void RAMFUNC
SnoopIClass(void)
686 // #define RECV_CMD_OFFSET 3032
687 // #define RECV_RES_OFFSET 3096
688 // #define DMA_BUFFER_OFFSET 3160
689 // #define DMA_BUFFER_SIZE 4096
690 // #define TRACE_LENGTH 3000
692 // We won't start recording the frames that we acquire until we trigger;
693 // a good trigger condition to get started is probably when we see a
694 // response from the tag.
695 //int triggered = FALSE; // FALSE to wait first for card
697 // The command (reader -> tag) that we're receiving.
698 // The length of a received command will in most cases be no more than 18 bytes.
699 // So 32 should be enough!
700 uint8_t *receivedCmd
= (((uint8_t *)BigBuf
) + RECV_CMD_OFFSET
);
701 // The response (tag -> reader) that we're receiving.
702 uint8_t *receivedResponse
= (((uint8_t *)BigBuf
) + RECV_RES_OFFSET
);
704 // As we receive stuff, we copy it from receivedCmd or receivedResponse
705 // into trace, along with its length and other annotations.
706 //uint8_t *trace = (uint8_t *)BigBuf;
708 // reset traceLen to 0
709 iso14a_set_tracing(TRUE
);
710 iso14a_clear_tracelen();
711 iso14a_set_trigger(FALSE
);
713 // The DMA buffer, used to stream samples from the FPGA
714 int8_t *dmaBuf
= ((int8_t *)BigBuf
) + DMA_BUFFER_OFFSET
;
720 // Count of samples received so far, so that we can include timing
721 // information in the trace buffer.
725 memset(trace
, 0x44, RECV_CMD_OFFSET
);
727 // Set up the demodulator for tag -> reader responses.
728 Demod
.output
= receivedResponse
;
730 Demod
.state
= DEMOD_UNSYNCD
;
732 // Setup for the DMA.
735 lastRxCounter
= DMA_BUFFER_SIZE
;
736 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
);
738 // And the reader -> tag commands
739 memset(&Uart
, 0, sizeof(Uart
));
740 Uart
.output
= receivedCmd
;
741 Uart
.byteCntMax
= 32; // was 100 (greg)////////////////////////////////////////////////////////////////////////
742 Uart
.state
= STATE_UNSYNCD
;
744 // And put the FPGA in the appropriate mode
745 // Signal field is off with the appropriate LED
747 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_SNIFFER
);
748 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
755 // And now we loop, receiving samples.
759 int behindBy
= (lastRxCounter
- AT91C_BASE_PDC_SSC
->PDC_RCR
) &
761 if(behindBy
> maxBehindBy
) {
762 maxBehindBy
= behindBy
;
764 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy
);
768 if(behindBy
< 1) continue;
774 if(upTo
- dmaBuf
> DMA_BUFFER_SIZE
) {
775 upTo
-= DMA_BUFFER_SIZE
;
776 lastRxCounter
+= DMA_BUFFER_SIZE
;
777 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) upTo
;
778 AT91C_BASE_PDC_SSC
->PDC_RNCR
= DMA_BUFFER_SIZE
;
787 //decbyte ^= ((smpl & 0x01) << (3 - div));
788 //decbyte ^= (((smpl & 0x01) | ((smpl & 0x02) >> 1)) << (3 - div)); // better already...
789 //decbyte ^= (((smpl & 0x01) | ((smpl & 0x02) >> 1) | ((smpl & 0x04) >> 2)) << (3 - div)); // even better...
791 decbyte
^= (1 << (3 - div
));
793 //decbyte ^= (MajorityNibble[(smpl & 0x0F)] << (3 - div));
795 // FOR READER SIDE COMMUMICATION...
796 //decbyte ^= ((smpl & 0x10) << (3 - div));
798 decbyter
^= (smpl
& 0x30);
802 if((div
+ 1) % 2 == 0) {
804 if(OutOfNDecoding((smpl
& 0xF0) >> 4)) {
805 rsamples
= samples
- Uart
.samples
;
808 trace
[traceLen
++] = ((rsamples
>> 0) & 0xff);
809 trace
[traceLen
++] = ((rsamples
>> 8) & 0xff);
810 trace
[traceLen
++] = ((rsamples
>> 16) & 0xff);
811 trace
[traceLen
++] = ((rsamples
>> 24) & 0xff);
812 trace
[traceLen
++] = ((Uart
.parityBits
>> 0) & 0xff);
813 trace
[traceLen
++] = ((Uart
.parityBits
>> 8) & 0xff);
814 trace
[traceLen
++] = ((Uart
.parityBits
>> 16) & 0xff);
815 trace
[traceLen
++] = ((Uart
.parityBits
>> 24) & 0xff);
816 trace
[traceLen
++] = Uart
.byteCnt
;
817 memcpy(trace
+traceLen
, receivedCmd
, Uart
.byteCnt
);
818 traceLen
+= Uart
.byteCnt
;
819 if(traceLen
> TRACE_LENGTH
) break;
821 /* And ready to receive another command. */
822 Uart
.state
= STATE_UNSYNCD
;
823 /* And also reset the demod code, which might have been */
824 /* false-triggered by the commands from the reader. */
825 Demod
.state
= DEMOD_UNSYNCD
;
834 if(ManchesterDecoding(smpl
& 0x0F)) {
835 rsamples
= samples
- Demod
.samples
;
838 // timestamp, as a count of samples
839 trace
[traceLen
++] = ((rsamples
>> 0) & 0xff);
840 trace
[traceLen
++] = ((rsamples
>> 8) & 0xff);
841 trace
[traceLen
++] = ((rsamples
>> 16) & 0xff);
842 trace
[traceLen
++] = 0x80 | ((rsamples
>> 24) & 0xff);
843 trace
[traceLen
++] = ((Demod
.parityBits
>> 0) & 0xff);
844 trace
[traceLen
++] = ((Demod
.parityBits
>> 8) & 0xff);
845 trace
[traceLen
++] = ((Demod
.parityBits
>> 16) & 0xff);
846 trace
[traceLen
++] = ((Demod
.parityBits
>> 24) & 0xff);
848 trace
[traceLen
++] = Demod
.len
;
849 memcpy(trace
+traceLen
, receivedResponse
, Demod
.len
);
850 traceLen
+= Demod
.len
;
851 if(traceLen
> TRACE_LENGTH
) break;
855 // And ready to receive another response.
856 memset(&Demod
, 0, sizeof(Demod
));
857 Demod
.output
= receivedResponse
;
858 Demod
.state
= DEMOD_UNSYNCD
;
868 DbpString("cancelled_a");
873 DbpString("COMMAND FINISHED");
875 Dbprintf("%x %x %x", maxBehindBy
, Uart
.state
, Uart
.byteCnt
);
876 Dbprintf("%x %x %x", Uart
.byteCntMax
, traceLen
, (int)Uart
.output
[0]);
879 AT91C_BASE_PDC_SSC
->PDC_PTCR
= AT91C_PDC_RXTDIS
;
880 Dbprintf("%x %x %x", maxBehindBy
, Uart
.state
, Uart
.byteCnt
);
881 Dbprintf("%x %x %x", Uart
.byteCntMax
, traceLen
, (int)Uart
.output
[0]);
888 void rotateCSN(uint8_t* originalCSN
, uint8_t* rotatedCSN
) {
890 for(i
= 0; i
< 8; i
++) {
891 rotatedCSN
[i
] = (originalCSN
[i
] >> 3) | (originalCSN
[(i
+1)%8] << 5);
895 //-----------------------------------------------------------------------------
896 // Wait for commands from reader
897 // Stop when button is pressed
898 // Or return TRUE when command is captured
899 //-----------------------------------------------------------------------------
900 static int GetIClassCommandFromReader(uint8_t *received
, int *len
, int maxLen
)
902 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
903 // only, since we are receiving, not transmitting).
904 // Signal field is off with the appropriate LED
906 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
908 // Now run a `software UART' on the stream of incoming samples.
909 Uart
.output
= received
;
910 Uart
.byteCntMax
= maxLen
;
911 Uart
.state
= STATE_UNSYNCD
;
916 if(BUTTON_PRESS()) return FALSE
;
918 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
919 AT91C_BASE_SSC
->SSC_THR
= 0x00;
921 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
922 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
923 /*if(OutOfNDecoding((b & 0xf0) >> 4)) {
927 if(OutOfNDecoding(b
& 0x0f)) {
936 //-----------------------------------------------------------------------------
937 // Prepare tag messages
938 //-----------------------------------------------------------------------------
939 static void CodeIClassTagAnswer(const uint8_t *cmd
, int len
)
946 ToSend
[++ToSendMax
] = 0x00;
947 ToSend
[++ToSendMax
] = 0x00;
948 ToSend
[++ToSendMax
] = 0x00;
949 ToSend
[++ToSendMax
] = 0xff;
950 ToSend
[++ToSendMax
] = 0xff;
951 ToSend
[++ToSendMax
] = 0xff;
952 ToSend
[++ToSendMax
] = 0x00;
953 ToSend
[++ToSendMax
] = 0xff;
955 for(i
= 0; i
< len
; i
++) {
960 for(j
= 0; j
< 8; j
++) {
962 ToSend
[++ToSendMax
] = 0x00;
963 ToSend
[++ToSendMax
] = 0xff;
965 ToSend
[++ToSendMax
] = 0xff;
966 ToSend
[++ToSendMax
] = 0x00;
973 ToSend
[++ToSendMax
] = 0xff;
974 ToSend
[++ToSendMax
] = 0x00;
975 ToSend
[++ToSendMax
] = 0xff;
976 ToSend
[++ToSendMax
] = 0xff;
977 ToSend
[++ToSendMax
] = 0xff;
978 ToSend
[++ToSendMax
] = 0x00;
979 ToSend
[++ToSendMax
] = 0x00;
980 ToSend
[++ToSendMax
] = 0x00;
982 // Convert from last byte pos to length
987 static void CodeIClassTagSOF()
992 ToSend
[++ToSendMax
] = 0x00;
993 ToSend
[++ToSendMax
] = 0x00;
994 ToSend
[++ToSendMax
] = 0x00;
995 ToSend
[++ToSendMax
] = 0xff;
996 ToSend
[++ToSendMax
] = 0xff;
997 ToSend
[++ToSendMax
] = 0xff;
998 ToSend
[++ToSendMax
] = 0x00;
999 ToSend
[++ToSendMax
] = 0xff;
1001 // Convert from last byte pos to length
1005 //-----------------------------------------------------------------------------
1006 // Simulate iClass Card
1007 // Only CSN (Card Serial Number)
1009 //-----------------------------------------------------------------------------
1010 void SimulateIClass(uint8_t arg0
, uint8_t *datain
)
1012 uint8_t simType
= arg0
;
1014 // CSN followed by two CRC bytes
1015 uint8_t response2
[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1016 uint8_t response3
[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 };
1019 uint8_t response4
[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1022 // Use the CSN from commandline
1023 memcpy(response3
, datain
, 8);
1026 // Construct anticollision-CSN
1027 rotateCSN(response3
,response2
);
1029 // Compute CRC on both CSNs
1030 ComputeCrc14443(CRC_ICLASS
, response2
, 8, &response2
[8], &response2
[9]);
1031 ComputeCrc14443(CRC_ICLASS
, response3
, 8, &response3
[8], &response3
[9]);
1036 // Tag anticoll. CSN
1037 // Reader 81 anticoll. CSN
1043 // Respond SOF -- takes 8 bytes
1044 uint8_t *resp1
= (((uint8_t *)BigBuf
) + 800);
1047 // Anticollision CSN (rotated CSN)
1048 // 176: Takes 16 bytes for SOF/EOF and 10 * 16 = 160 bytes (2 bytes/bit)
1049 uint8_t *resp2
= (((uint8_t *)BigBuf
) + 810);
1053 // 176: Takes 16 bytes for SOF/EOF and 10 * 16 = 160 bytes (2 bytes/bit)
1054 uint8_t *resp3
= (((uint8_t *)BigBuf
) + 990);
1058 // 144: Takes 16 bytes for SOF/EOF and 8 * 16 = 128 bytes (2 bytes/bit)
1059 uint8_t *resp4
= (((uint8_t *)BigBuf
) + 1170);
1063 uint8_t *receivedCmd
= (uint8_t *)BigBuf
;
1064 memset(receivedCmd
, 0x44, 400);
1067 // Prepare card messages
1070 // First card answer: SOF
1072 memcpy(resp1
, ToSend
, ToSendMax
); resp1Len
= ToSendMax
;
1074 // Anticollision CSN
1075 CodeIClassTagAnswer(response2
, sizeof(response2
));
1076 memcpy(resp2
, ToSend
, ToSendMax
); resp2Len
= ToSendMax
;
1079 CodeIClassTagAnswer(response3
, sizeof(response3
));
1080 memcpy(resp3
, ToSend
, ToSendMax
); resp3Len
= ToSendMax
;
1083 CodeIClassTagAnswer(response4
, sizeof(response4
));
1084 memcpy(resp4
, ToSend
, ToSendMax
); resp4Len
= ToSendMax
;
1086 // We need to listen to the high-frequency, peak-detected path.
1087 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1090 // To control where we are in the protocol
1096 if(!GetIClassCommandFromReader(receivedCmd
, &len
, 100)) {
1097 DbpString("button press");
1101 // Okay, look at the command now.
1102 if(receivedCmd
[0] == 0x0a) {
1103 // Reader in anticollission phase
1104 resp
= resp1
; respLen
= resp1Len
; //order = 1;
1105 //resp = resp2; respLen = resp2Len; order = 2;
1106 //DbpString("Hello request from reader:");
1107 } else if(receivedCmd
[0] == 0x0c) {
1108 // Reader asks for anticollission CSN
1109 resp
= resp2
; respLen
= resp2Len
; //order = 2;
1110 //DbpString("Reader requests anticollission CSN:");
1111 } else if(receivedCmd
[0] == 0x81) {
1112 // Reader selects anticollission CSN.
1113 // Tag sends the corresponding real CSN
1114 resp
= resp3
; respLen
= resp3Len
; //order = 3;
1115 //DbpString("Reader selects anticollission CSN:");
1116 } else if(receivedCmd
[0] == 0x88) {
1117 // Read e-purse (88 02)
1118 resp
= resp4
; respLen
= resp4Len
; //order = 4;
1120 } else if(receivedCmd
[0] == 0x05) {
1121 // Reader random and reader MAC!!!
1122 // Lets store this ;-)
1123 Dbprintf(" CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
1124 response3
[0], response3
[1], response3
[2],
1125 response3
[3], response3
[4], response3
[5],
1126 response3
[6], response3
[7]);
1127 Dbprintf("READER AUTH (len=%02d): %02x %02x %02x %02x %02x %02x %02x %02x %02x",
1129 receivedCmd
[0], receivedCmd
[1], receivedCmd
[2],
1130 receivedCmd
[3], receivedCmd
[4], receivedCmd
[5],
1131 receivedCmd
[6], receivedCmd
[7], receivedCmd
[8]);
1134 // We do not know what to answer, so lets keep quit
1135 resp
= resp1
; respLen
= 0; //order = 5;
1136 } else if(receivedCmd
[0] == 0x00 && len
== 1) {
1137 // Reader ends the session
1138 resp
= resp1
; respLen
= 0; //order = 0;
1139 /* } else if(receivedCmd[0] == 0x50) {
1141 resp = resp1; respLen = 0; order = 5; // Do nothing
1142 DbpString("Reader requested we HALT!:");
1145 // Never seen this command before
1146 Dbprintf("Unknown command received from reader (len=%d): %x %x %x %x %x %x %x %x %x",
1148 receivedCmd
[0], receivedCmd
[1], receivedCmd
[2],
1149 receivedCmd
[3], receivedCmd
[4], receivedCmd
[5],
1150 receivedCmd
[6], receivedCmd
[7], receivedCmd
[8]);
1152 resp
= resp1
; respLen
= 0; //order = 0;
1155 memset(receivedCmd
, 0x44, 32);
1157 if(cmdsRecvd
> 999) {
1158 DbpString("1000 commands later...");
1165 if(respLen
<= 0) continue;
1167 SendIClassAnswer(resp
, respLen
, 21);
1170 Dbprintf("%x", cmdsRecvd
);
1175 static int SendIClassAnswer(uint8_t *resp
, int respLen
, int delay
)
1177 int i
= 0, u
= 0, d
= 0;
1180 // Modulate Manchester
1181 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD424);
1182 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_MOD
);
1183 AT91C_BASE_SSC
->SSC_THR
= 0x00;
1188 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1189 volatile uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1192 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1197 else if(i
>= respLen
) {
1203 if(u
> 1) { i
++; u
= 0; }
1205 AT91C_BASE_SSC
->SSC_THR
= b
;
1209 if(BUTTON_PRESS()) {
1219 //-----------------------------------------------------------------------------
1220 // Transmit the command (to the tag) that was placed in ToSend[].
1221 //-----------------------------------------------------------------------------
1222 static void TransmitIClassCommand(const uint8_t *cmd
, int len
, int *samples
, int *wait
)
1226 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_MOD
);
1227 AT91C_BASE_SSC
->SSC_THR
= 0x00;
1234 for(c
= 0; c
< *wait
;) {
1235 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1236 AT91C_BASE_SSC
->SSC_THR
= 0x00; // For exact timing!
1239 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1240 volatile uint32_t r
= AT91C_BASE_SSC
->SSC_RHR
;
1247 bool firstpart
= TRUE
;
1250 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1252 // DOUBLE THE SAMPLES!
1254 sendbyte
= (cmd
[c
] & 0xf0) | (cmd
[c
] >> 4);
1257 sendbyte
= (cmd
[c
] & 0x0f) | (cmd
[c
] << 4);
1260 if(sendbyte
== 0xff) {
1263 AT91C_BASE_SSC
->SSC_THR
= sendbyte
;
1264 firstpart
= !firstpart
;
1270 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1271 volatile uint32_t r
= AT91C_BASE_SSC
->SSC_RHR
;
1276 if (samples
) *samples
= (c
+ *wait
) << 3;
1280 //-----------------------------------------------------------------------------
1281 // Prepare iClass reader command to send to FPGA
1282 //-----------------------------------------------------------------------------
1283 void CodeIClassCommand(const uint8_t * cmd
, int len
)
1290 // Start of Communication: 1 out of 4
1291 ToSend
[++ToSendMax
] = 0xf0;
1292 ToSend
[++ToSendMax
] = 0x00;
1293 ToSend
[++ToSendMax
] = 0x0f;
1294 ToSend
[++ToSendMax
] = 0x00;
1296 // Modulate the bytes
1297 for (i
= 0; i
< len
; i
++) {
1299 for(j
= 0; j
< 4; j
++) {
1300 for(k
= 0; k
< 4; k
++) {
1302 ToSend
[++ToSendMax
] = 0x0f;
1305 ToSend
[++ToSendMax
] = 0x00;
1312 // End of Communication
1313 ToSend
[++ToSendMax
] = 0x00;
1314 ToSend
[++ToSendMax
] = 0x00;
1315 ToSend
[++ToSendMax
] = 0xf0;
1316 ToSend
[++ToSendMax
] = 0x00;
1318 // Convert from last character reference to length
1322 void ReaderTransmitIClass(uint8_t* frame
, int len
)
1328 // This is tied to other size changes
1329 // uint8_t* frame_addr = ((uint8_t*)BigBuf) + 2024;
1330 CodeIClassCommand(frame
,len
);
1333 TransmitIClassCommand(ToSend
, ToSendMax
, &samples
, &wait
);
1337 // Store reader command in buffer
1338 if (tracing
) LogTrace(frame
,len
,0,par
,TRUE
);
1341 //-----------------------------------------------------------------------------
1342 // Wait a certain time for tag response
1343 // If a response is captured return TRUE
1344 // If it takes too long return FALSE
1345 //-----------------------------------------------------------------------------
1346 static int GetIClassAnswer(uint8_t *receivedResponse
, int maxLen
, int *samples
, int *elapsed
) //uint8_t *buffer
1348 // buffer needs to be 512 bytes
1351 // Set FPGA mode to "reader listen mode", no modulation (listen
1352 // only, since we are receiving, not transmitting).
1353 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_LISTEN
);
1355 // Now get the answer from the card
1356 Demod
.output
= receivedResponse
;
1358 Demod
.state
= DEMOD_UNSYNCD
;
1361 if (elapsed
) *elapsed
= 0;
1369 if(BUTTON_PRESS()) return FALSE
;
1371 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1372 AT91C_BASE_SSC
->SSC_THR
= 0x00; // To make use of exact timing of next command from reader!!
1373 if (elapsed
) (*elapsed
)++;
1375 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1376 if(c
< timeout
) { c
++; } else { return FALSE
; }
1377 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1380 /*if(ManchesterDecoding((b>>4) & 0xf)) {
1381 *samples = ((c - 1) << 3) + 4;
1384 if(ManchesterDecoding(b
& 0x0f)) {
1392 int ReaderReceiveIClass(uint8_t* receivedAnswer
)
1395 if (!GetIClassAnswer(receivedAnswer
,160,&samples
,0)) return FALSE
;
1396 if (tracing
) LogTrace(receivedAnswer
,Demod
.len
,samples
,Demod
.parityBits
,FALSE
);
1397 if(samples
== 0) return FALSE
;
1401 // Reader iClass Anticollission
1402 void ReaderIClass(uint8_t arg0
) {
1403 uint8_t act_all
[] = { 0x0a };
1404 uint8_t identify
[] = { 0x0c };
1405 //uint8_t select[] = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1407 uint8_t* resp
= (((uint8_t *)BigBuf
) + 3560); // was 3560 - tied to other size changes
1409 // Reset trace buffer
1410 memset(trace
, 0x44, RECV_CMD_OFFSET
);
1415 // Start from off (no field generated)
1416 // Signal field is off with the appropriate LED
1418 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1421 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1423 // Now give it time to spin up.
1424 // Signal field is on with the appropriate LED
1425 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_MOD
);
1431 if(traceLen
> TRACE_LENGTH
|| BUTTON_PRESS()) break;
1434 ReaderTransmitIClass(act_all
, 1);
1436 if(ReaderReceiveIClass(resp
)) {
1437 ReaderTransmitIClass(identify
, 1);
1438 if(ReaderReceiveIClass(resp
)) {
1439 //ReaderTransmitIClass(select, sizeof(select));
1448 memcpy(resp_data->atqa, resp, 2);
1450 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1451 // which case we need to make a cascade 2 request and select - this is a long UID
1452 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1453 for(; sak & 0x04; cascade_level++)
1455 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1456 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1459 ReaderTransmit(sel_all,sizeof(sel_all));
1460 if (!ReaderReceive(resp)) return 0;
1461 if(uid_ptr) memcpy(uid_ptr + cascade_level*4, resp, 4);
1463 // calculate crypto UID
1464 if(cuid_ptr) *cuid_ptr = bytes_to_num(resp, 4);
1466 // Construct SELECT UID command
1467 memcpy(sel_uid+2,resp,5);
1468 AppendCrc14443a(sel_uid,7);
1469 ReaderTransmit(sel_uid,sizeof(sel_uid));
1472 if (!ReaderReceive(resp)) return 0;
1476 resp_data->sak = sak;
1477 resp_data->ats_len = 0;
1479 //-- this byte not UID, it CT. http://www.nxp.com/documents/application_note/AN10927.pdf page 3
1480 if (uid_ptr[0] == 0x88) {
1481 memcpy(uid_ptr, uid_ptr + 1, 7);
1485 if( (sak & 0x20) == 0)
1486 return 2; // non iso14443a compliant tag
1488 // Request for answer to select
1489 if(resp_data) { // JCOP cards - if reader sent RATS then there is no MIFARE session at all!!!
1490 AppendCrc14443a(rats, 2);
1491 ReaderTransmit(rats, sizeof(rats));
1493 if (!(len = ReaderReceive(resp))) return 0;
1495 memcpy(resp_data->ats, resp, sizeof(resp_data->ats));
1496 resp_data->ats_len = len;