]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443a.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: @marshmellow42 's fixex and resetread t55x7
[proxmark3-svn] / armsrc / iso14443a.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "proxmark3.h"
14 #include "apps.h"
15 #include "util.h"
16 #include "string.h"
17 #include "cmd.h"
18 #include "iso14443crc.h"
19 #include "iso14443a.h"
20 #include "crapto1.h"
21 #include "mifareutil.h"
22 #include "BigBuf.h"
23 static uint32_t iso14a_timeout;
24 int rsamples = 0;
25 uint8_t trigger = 0;
26 // the block number for the ISO14443-4 PCB
27 static uint8_t iso14_pcb_blocknum = 0;
28
29 //
30 // ISO14443 timing:
31 //
32 // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
33 #define REQUEST_GUARD_TIME (7000/16 + 1)
34 // minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
35 #define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
36 // bool LastCommandWasRequest = FALSE;
37
38 //
39 // Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
40 //
41 // When the PM acts as reader and is receiving tag data, it takes
42 // 3 ticks delay in the AD converter
43 // 16 ticks until the modulation detector completes and sets curbit
44 // 8 ticks until bit_to_arm is assigned from curbit
45 // 8*16 ticks for the transfer from FPGA to ARM
46 // 4*16 ticks until we measure the time
47 // - 8*16 ticks because we measure the time of the previous transfer
48 #define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
49
50 // When the PM acts as a reader and is sending, it takes
51 // 4*16 ticks until we can write data to the sending hold register
52 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
53 // 8 ticks until the first transfer starts
54 // 8 ticks later the FPGA samples the data
55 // 1 tick to assign mod_sig_coil
56 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
57
58 // When the PM acts as tag and is receiving it takes
59 // 2 ticks delay in the RF part (for the first falling edge),
60 // 3 ticks for the A/D conversion,
61 // 8 ticks on average until the start of the SSC transfer,
62 // 8 ticks until the SSC samples the first data
63 // 7*16 ticks to complete the transfer from FPGA to ARM
64 // 8 ticks until the next ssp_clk rising edge
65 // 4*16 ticks until we measure the time
66 // - 8*16 ticks because we measure the time of the previous transfer
67 #define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
68
69 // The FPGA will report its internal sending delay in
70 uint16_t FpgaSendQueueDelay;
71 // the 5 first bits are the number of bits buffered in mod_sig_buf
72 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
73 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
74
75 // When the PM acts as tag and is sending, it takes
76 // 4*16 ticks until we can write data to the sending hold register
77 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
78 // 8 ticks until the first transfer starts
79 // 8 ticks later the FPGA samples the data
80 // + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
81 // + 1 tick to assign mod_sig_coil
82 #define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
83
84 // When the PM acts as sniffer and is receiving tag data, it takes
85 // 3 ticks A/D conversion
86 // 14 ticks to complete the modulation detection
87 // 8 ticks (on average) until the result is stored in to_arm
88 // + the delays in transferring data - which is the same for
89 // sniffing reader and tag data and therefore not relevant
90 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
91
92 // When the PM acts as sniffer and is receiving reader data, it takes
93 // 2 ticks delay in analogue RF receiver (for the falling edge of the
94 // start bit, which marks the start of the communication)
95 // 3 ticks A/D conversion
96 // 8 ticks on average until the data is stored in to_arm.
97 // + the delays in transferring data - which is the same for
98 // sniffing reader and tag data and therefore not relevant
99 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
100
101 //variables used for timing purposes:
102 //these are in ssp_clk cycles:
103 static uint32_t NextTransferTime;
104 static uint32_t LastTimeProxToAirStart;
105 static uint32_t LastProxToAirDuration;
106
107
108
109 // CARD TO READER - manchester
110 // Sequence D: 11110000 modulation with subcarrier during first half
111 // Sequence E: 00001111 modulation with subcarrier during second half
112 // Sequence F: 00000000 no modulation with subcarrier
113 // READER TO CARD - miller
114 // Sequence X: 00001100 drop after half a period
115 // Sequence Y: 00000000 no drop
116 // Sequence Z: 11000000 drop at start
117 #define SEC_D 0xf0
118 #define SEC_E 0x0f
119 #define SEC_F 0x00
120 #define SEC_X 0x0c
121 #define SEC_Y 0x00
122 #define SEC_Z 0xc0
123
124 const uint8_t OddByteParity[256] = {
125 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
126 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
127 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
141 };
142
143
144 void iso14a_set_trigger(bool enable) {
145 trigger = enable;
146 }
147
148
149 void iso14a_set_timeout(uint32_t timeout) {
150 iso14a_timeout = timeout;
151 if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);
152 }
153
154
155 void iso14a_set_ATS_timeout(uint8_t *ats) {
156
157 uint8_t tb1;
158 uint8_t fwi;
159 uint32_t fwt;
160
161 if (ats[0] > 1) { // there is a format byte T0
162 if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
163 if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
164 tb1 = ats[3];
165 } else {
166 tb1 = ats[2];
167 }
168 fwi = (tb1 & 0xf0) >> 4; // frame waiting indicator (FWI)
169 fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc
170
171 iso14a_set_timeout(fwt/(8*16));
172 }
173 }
174 }
175
176
177 //-----------------------------------------------------------------------------
178 // Generate the parity value for a byte sequence
179 //
180 //-----------------------------------------------------------------------------
181 byte_t oddparity (const byte_t bt)
182 {
183 return OddByteParity[bt];
184 }
185
186 void GetParity(const uint8_t *pbtCmd, uint16_t iLen, uint8_t *par)
187 {
188 uint16_t paritybit_cnt = 0;
189 uint16_t paritybyte_cnt = 0;
190 uint8_t parityBits = 0;
191
192 for (uint16_t i = 0; i < iLen; i++) {
193 // Generate the parity bits
194 parityBits |= ((OddByteParity[pbtCmd[i]]) << (7-paritybit_cnt));
195 if (paritybit_cnt == 7) {
196 par[paritybyte_cnt] = parityBits; // save 8 Bits parity
197 parityBits = 0; // and advance to next Parity Byte
198 paritybyte_cnt++;
199 paritybit_cnt = 0;
200 } else {
201 paritybit_cnt++;
202 }
203 }
204
205 // save remaining parity bits
206 par[paritybyte_cnt] = parityBits;
207
208 }
209
210 void AppendCrc14443a(uint8_t* data, int len)
211 {
212 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
213 }
214
215 void AppendCrc14443b(uint8_t* data, int len)
216 {
217 ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
218 }
219
220
221 //=============================================================================
222 // ISO 14443 Type A - Miller decoder
223 //=============================================================================
224 // Basics:
225 // This decoder is used when the PM3 acts as a tag.
226 // The reader will generate "pauses" by temporarily switching of the field.
227 // At the PM3 antenna we will therefore measure a modulated antenna voltage.
228 // The FPGA does a comparison with a threshold and would deliver e.g.:
229 // ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
230 // The Miller decoder needs to identify the following sequences:
231 // 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
232 // 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
233 // 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
234 // Note 1: the bitstream may start at any time. We therefore need to sync.
235 // Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
236 //-----------------------------------------------------------------------------
237 static tUart Uart;
238
239 // Lookup-Table to decide if 4 raw bits are a modulation.
240 // We accept the following:
241 // 0001 - a 3 tick wide pause
242 // 0011 - a 2 tick wide pause, or a three tick wide pause shifted left
243 // 0111 - a 2 tick wide pause shifted left
244 // 1001 - a 2 tick wide pause shifted right
245 const bool Mod_Miller_LUT[] = {
246 FALSE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, TRUE,
247 FALSE, TRUE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE
248 };
249 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
250 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
251
252 void UartReset()
253 {
254 Uart.state = STATE_UNSYNCD;
255 Uart.bitCount = 0;
256 Uart.len = 0; // number of decoded data bytes
257 Uart.parityLen = 0; // number of decoded parity bytes
258 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
259 Uart.parityBits = 0; // holds 8 parity bits
260 Uart.startTime = 0;
261 Uart.endTime = 0;
262
263 Uart.byteCntMax = 0;
264 Uart.posCnt = 0;
265 Uart.syncBit = 9999;
266 }
267
268 void UartInit(uint8_t *data, uint8_t *parity)
269 {
270 Uart.output = data;
271 Uart.parity = parity;
272 Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
273 UartReset();
274 }
275
276 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
277 static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
278 {
279
280 Uart.fourBits = (Uart.fourBits << 8) | bit;
281
282 if (Uart.state == STATE_UNSYNCD) { // not yet synced
283
284 Uart.syncBit = 9999; // not set
285
286 // 00x11111 2|3 ticks pause followed by 6|5 ticks unmodulated Sequence Z (a "0" or "start of communication")
287 // 11111111 8 ticks unmodulation Sequence Y (a "0" or "end of communication" or "no information")
288 // 111100x1 4 ticks unmodulated followed by 2|3 ticks pause Sequence X (a "1")
289
290 // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
291 // Sequence X followed by Sequence Y followed by Sequence Z (111100x1 11111111 00x11111)
292 // we therefore look for a ...xx1111 11111111 00x11111xxxxxx... pattern
293 // (12 '1's followed by 2 '0's, eventually followed by another '0', followed by 5 '1's)
294 //
295 #define ISO14443A_STARTBIT_MASK 0x07FFEF80 // mask is 00001111 11111111 1110 1111 10000000
296 #define ISO14443A_STARTBIT_PATTERN 0x07FF8F80 // pattern is 00001111 11111111 1000 1111 10000000
297
298 if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 0)) == ISO14443A_STARTBIT_PATTERN >> 0) Uart.syncBit = 7;
299 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 1)) == ISO14443A_STARTBIT_PATTERN >> 1) Uart.syncBit = 6;
300 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 2)) == ISO14443A_STARTBIT_PATTERN >> 2) Uart.syncBit = 5;
301 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 3)) == ISO14443A_STARTBIT_PATTERN >> 3) Uart.syncBit = 4;
302 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 4)) == ISO14443A_STARTBIT_PATTERN >> 4) Uart.syncBit = 3;
303 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 5)) == ISO14443A_STARTBIT_PATTERN >> 5) Uart.syncBit = 2;
304 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 6)) == ISO14443A_STARTBIT_PATTERN >> 6) Uart.syncBit = 1;
305 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 7)) == ISO14443A_STARTBIT_PATTERN >> 7) Uart.syncBit = 0;
306
307 if (Uart.syncBit != 9999) { // found a sync bit
308 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
309 Uart.startTime -= Uart.syncBit;
310 Uart.endTime = Uart.startTime;
311 Uart.state = STATE_START_OF_COMMUNICATION;
312 }
313
314 } else {
315
316 if (IsMillerModulationNibble1(Uart.fourBits >> Uart.syncBit)) {
317 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation in both halves - error
318 UartReset();
319 } else { // Modulation in first half = Sequence Z = logic "0"
320 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
321 UartReset();
322 } else {
323 Uart.bitCount++;
324 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
325 Uart.state = STATE_MILLER_Z;
326 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
327 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
328 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
329 Uart.parityBits <<= 1; // make room for the parity bit
330 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
331 Uart.bitCount = 0;
332 Uart.shiftReg = 0;
333 if((Uart.len&0x0007) == 0) { // every 8 data bytes
334 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
335 Uart.parityBits = 0;
336 }
337 }
338 }
339 }
340 } else {
341 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
342 Uart.bitCount++;
343 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
344 Uart.state = STATE_MILLER_X;
345 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
346 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
347 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
348 Uart.parityBits <<= 1; // make room for the new parity bit
349 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
350 Uart.bitCount = 0;
351 Uart.shiftReg = 0;
352 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
353 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
354 Uart.parityBits = 0;
355 }
356 }
357 } else { // no modulation in both halves - Sequence Y
358 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
359 Uart.state = STATE_UNSYNCD;
360 Uart.bitCount--; // last "0" was part of EOC sequence
361 Uart.shiftReg <<= 1; // drop it
362 if(Uart.bitCount > 0) { // if we decoded some bits
363 Uart.shiftReg >>= (9 - Uart.bitCount); // right align them
364 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff); // add last byte to the output
365 Uart.parityBits <<= 1; // add a (void) parity bit
366 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align parity bits
367 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store it
368 return TRUE;
369 } else if (Uart.len & 0x0007) { // there are some parity bits to store
370 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align remaining parity bits
371 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store them
372 }
373 if (Uart.len) {
374 return TRUE; // we are finished with decoding the raw data sequence
375 } else {
376 UartReset(); // Nothing received - start over
377 }
378 }
379 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
380 UartReset();
381 } else { // a logic "0"
382 Uart.bitCount++;
383 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
384 Uart.state = STATE_MILLER_Y;
385 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
386 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
387 Uart.parityBits <<= 1; // make room for the parity bit
388 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
389 Uart.bitCount = 0;
390 Uart.shiftReg = 0;
391 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
392 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
393 Uart.parityBits = 0;
394 }
395 }
396 }
397 }
398 }
399
400 }
401
402 return FALSE; // not finished yet, need more data
403 }
404
405
406
407 //=============================================================================
408 // ISO 14443 Type A - Manchester decoder
409 //=============================================================================
410 // Basics:
411 // This decoder is used when the PM3 acts as a reader.
412 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
413 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
414 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
415 // The Manchester decoder needs to identify the following sequences:
416 // 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
417 // 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
418 // 8 ticks unmodulated: Sequence F = end of communication
419 // 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
420 // Note 1: the bitstream may start at any time. We therefore need to sync.
421 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
422 static tDemod Demod;
423
424 // Lookup-Table to decide if 4 raw bits are a modulation.
425 // We accept three or four "1" in any position
426 const bool Mod_Manchester_LUT[] = {
427 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
428 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
429 };
430
431 #define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
432 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
433
434
435 void DemodReset()
436 {
437 Demod.state = DEMOD_UNSYNCD;
438 Demod.len = 0; // number of decoded data bytes
439 Demod.parityLen = 0;
440 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
441 Demod.parityBits = 0; //
442 Demod.collisionPos = 0; // Position of collision bit
443 Demod.twoBits = 0xffff; // buffer for 2 Bits
444 Demod.highCnt = 0;
445 Demod.startTime = 0;
446 Demod.endTime = 0;
447
448 //
449 Demod.bitCount = 0;
450 Demod.syncBit = 0xFFFF;
451 Demod.samples = 0;
452 }
453
454 void DemodInit(uint8_t *data, uint8_t *parity)
455 {
456 Demod.output = data;
457 Demod.parity = parity;
458 DemodReset();
459 }
460
461 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
462 static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
463 {
464
465 Demod.twoBits = (Demod.twoBits << 8) | bit;
466
467 if (Demod.state == DEMOD_UNSYNCD) {
468
469 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
470 if (Demod.twoBits == 0x0000) {
471 Demod.highCnt++;
472 } else {
473 Demod.highCnt = 0;
474 }
475 } else {
476 Demod.syncBit = 0xFFFF; // not set
477 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
478 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
479 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
480 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
481 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
482 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
483 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
484 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
485 if (Demod.syncBit != 0xFFFF) {
486 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
487 Demod.startTime -= Demod.syncBit;
488 Demod.bitCount = offset; // number of decoded data bits
489 Demod.state = DEMOD_MANCHESTER_DATA;
490 }
491 }
492
493 } else {
494
495 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
496 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
497 if (!Demod.collisionPos) {
498 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
499 }
500 } // modulation in first half only - Sequence D = 1
501 Demod.bitCount++;
502 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
503 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
504 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
505 Demod.parityBits <<= 1; // make room for the parity bit
506 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
507 Demod.bitCount = 0;
508 Demod.shiftReg = 0;
509 if((Demod.len&0x0007) == 0) { // every 8 data bytes
510 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits
511 Demod.parityBits = 0;
512 }
513 }
514 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
515 } else { // no modulation in first half
516 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
517 Demod.bitCount++;
518 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
519 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
520 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
521 Demod.parityBits <<= 1; // make room for the new parity bit
522 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
523 Demod.bitCount = 0;
524 Demod.shiftReg = 0;
525 if ((Demod.len&0x0007) == 0) { // every 8 data bytes
526 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits1
527 Demod.parityBits = 0;
528 }
529 }
530 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
531 } else { // no modulation in both halves - End of communication
532 if(Demod.bitCount > 0) { // there are some remaining data bits
533 Demod.shiftReg >>= (9 - Demod.bitCount); // right align the decoded bits
534 Demod.output[Demod.len++] = Demod.shiftReg & 0xff; // and add them to the output
535 Demod.parityBits <<= 1; // add a (void) parity bit
536 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
537 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
538 return TRUE;
539 } else if (Demod.len & 0x0007) { // there are some parity bits to store
540 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
541 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
542 }
543 if (Demod.len) {
544 return TRUE; // we are finished with decoding the raw data sequence
545 } else { // nothing received. Start over
546 DemodReset();
547 }
548 }
549 }
550 }
551 return FALSE; // not finished yet, need more data
552 }
553
554 //=============================================================================
555 // Finally, a `sniffer' for ISO 14443 Type A
556 // Both sides of communication!
557 //=============================================================================
558
559 //-----------------------------------------------------------------------------
560 // Record the sequence of commands sent by the reader to the tag, with
561 // triggering so that we start recording at the point that the tag is moved
562 // near the reader.
563 //-----------------------------------------------------------------------------
564 void RAMFUNC SniffIso14443a(uint8_t param) {
565 // param:
566 // bit 0 - trigger from first card answer
567 // bit 1 - trigger from first reader 7-bit request
568 LEDsoff();
569
570 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
571
572 // Allocate memory from BigBuf for some buffers
573 // free all previous allocations first
574 BigBuf_free();
575
576 // init trace buffer
577 clear_trace();
578 set_tracing(TRUE);
579
580 // The command (reader -> tag) that we're receiving.
581 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
582 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
583
584 // The response (tag -> reader) that we're receiving.
585 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
586 uint8_t *receivedResponsePar = BigBuf_malloc(MAX_PARITY_SIZE);
587
588 // The DMA buffer, used to stream samples from the FPGA
589 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
590
591 uint8_t *data = dmaBuf;
592 uint8_t previous_data = 0;
593 int maxDataLen = 0;
594 int dataLen = 0;
595 bool TagIsActive = FALSE;
596 bool ReaderIsActive = FALSE;
597
598 // Set up the demodulator for tag -> reader responses.
599 DemodInit(receivedResponse, receivedResponsePar);
600
601 // Set up the demodulator for the reader -> tag commands
602 UartInit(receivedCmd, receivedCmdPar);
603
604 // Setup and start DMA.
605 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
606
607 // We won't start recording the frames that we acquire until we trigger;
608 // a good trigger condition to get started is probably when we see a
609 // response from the tag.
610 // triggered == FALSE -- to wait first for card
611 bool triggered = !(param & 0x03);
612
613 // And now we loop, receiving samples.
614 for(uint32_t rsamples = 0; TRUE; ) {
615
616 if(BUTTON_PRESS()) {
617 DbpString("cancelled by button");
618 break;
619 }
620
621 LED_A_ON();
622 WDT_HIT();
623
624 int register readBufDataP = data - dmaBuf;
625 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
626 if (readBufDataP <= dmaBufDataP){
627 dataLen = dmaBufDataP - readBufDataP;
628 } else {
629 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
630 }
631 // test for length of buffer
632 if(dataLen > maxDataLen) {
633 maxDataLen = dataLen;
634 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
635 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
636 break;
637 }
638 }
639 if(dataLen < 1) continue;
640
641 // primary buffer was stopped( <-- we lost data!
642 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
643 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
644 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
645 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
646 }
647 // secondary buffer sets as primary, secondary buffer was stopped
648 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
649 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
650 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
651 }
652
653 LED_A_OFF();
654
655 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
656
657 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
658 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
659 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
660 LED_C_ON();
661
662 // check - if there is a short 7bit request from reader
663 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
664
665 if(triggered) {
666 if (!LogTrace(receivedCmd,
667 Uart.len,
668 Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
669 Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
670 Uart.parity,
671 TRUE)) break;
672 }
673 /* And ready to receive another command. */
674 UartReset();
675 /* And also reset the demod code, which might have been */
676 /* false-triggered by the commands from the reader. */
677 DemodReset();
678 LED_B_OFF();
679 }
680 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
681 }
682
683 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
684 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
685 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
686 LED_B_ON();
687
688 if (!LogTrace(receivedResponse,
689 Demod.len,
690 Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
691 Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
692 Demod.parity,
693 FALSE)) break;
694
695 if ((!triggered) && (param & 0x01)) triggered = TRUE;
696
697 // And ready to receive another response.
698 DemodReset();
699 // And reset the Miller decoder including itS (now outdated) input buffer
700 UartInit(receivedCmd, receivedCmdPar);
701
702 LED_C_OFF();
703 }
704 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
705 }
706 }
707
708 previous_data = *data;
709 rsamples++;
710 data++;
711 if(data == dmaBuf + DMA_BUFFER_SIZE) {
712 data = dmaBuf;
713 }
714 } // main cycle
715
716 FpgaDisableSscDma();
717 LEDsoff();
718
719 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
720 Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);
721
722 set_tracing(FALSE);
723 }
724
725 //-----------------------------------------------------------------------------
726 // Prepare tag messages
727 //-----------------------------------------------------------------------------
728 static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
729 {
730 ToSendReset();
731
732 // Correction bit, might be removed when not needed
733 ToSendStuffBit(0);
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736 ToSendStuffBit(0);
737 ToSendStuffBit(1); // 1
738 ToSendStuffBit(0);
739 ToSendStuffBit(0);
740 ToSendStuffBit(0);
741
742 // Send startbit
743 ToSend[++ToSendMax] = SEC_D;
744 LastProxToAirDuration = 8 * ToSendMax - 4;
745
746 for(uint16_t i = 0; i < len; i++) {
747 uint8_t b = cmd[i];
748
749 // Data bits
750 for(uint16_t j = 0; j < 8; j++) {
751 if(b & 1) {
752 ToSend[++ToSendMax] = SEC_D;
753 } else {
754 ToSend[++ToSendMax] = SEC_E;
755 }
756 b >>= 1;
757 }
758
759 // Get the parity bit
760 if (parity[i>>3] & (0x80>>(i&0x0007))) {
761 ToSend[++ToSendMax] = SEC_D;
762 LastProxToAirDuration = 8 * ToSendMax - 4;
763 } else {
764 ToSend[++ToSendMax] = SEC_E;
765 LastProxToAirDuration = 8 * ToSendMax;
766 }
767 }
768
769 // Send stopbit
770 ToSend[++ToSendMax] = SEC_F;
771
772 // Convert from last byte pos to length
773 ToSendMax++;
774 }
775
776 static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
777 {
778 uint8_t par[MAX_PARITY_SIZE];
779
780 GetParity(cmd, len, par);
781 CodeIso14443aAsTagPar(cmd, len, par);
782 }
783
784
785 static void Code4bitAnswerAsTag(uint8_t cmd)
786 {
787 int i;
788
789 ToSendReset();
790
791 // Correction bit, might be removed when not needed
792 ToSendStuffBit(0);
793 ToSendStuffBit(0);
794 ToSendStuffBit(0);
795 ToSendStuffBit(0);
796 ToSendStuffBit(1); // 1
797 ToSendStuffBit(0);
798 ToSendStuffBit(0);
799 ToSendStuffBit(0);
800
801 // Send startbit
802 ToSend[++ToSendMax] = SEC_D;
803
804 uint8_t b = cmd;
805 for(i = 0; i < 4; i++) {
806 if(b & 1) {
807 ToSend[++ToSendMax] = SEC_D;
808 LastProxToAirDuration = 8 * ToSendMax - 4;
809 } else {
810 ToSend[++ToSendMax] = SEC_E;
811 LastProxToAirDuration = 8 * ToSendMax;
812 }
813 b >>= 1;
814 }
815
816 // Send stopbit
817 ToSend[++ToSendMax] = SEC_F;
818
819 // Convert from last byte pos to length
820 ToSendMax++;
821 }
822
823 //-----------------------------------------------------------------------------
824 // Wait for commands from reader
825 // Stop when button is pressed
826 // Or return TRUE when command is captured
827 //-----------------------------------------------------------------------------
828 static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
829 {
830 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
831 // only, since we are receiving, not transmitting).
832 // Signal field is off with the appropriate LED
833 LED_D_OFF();
834 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
835
836 // Now run a `software UART' on the stream of incoming samples.
837 UartInit(received, parity);
838
839 // clear RXRDY:
840 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
841
842 for(;;) {
843 WDT_HIT();
844
845 if(BUTTON_PRESS()) return FALSE;
846
847 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
848 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
849 if(MillerDecoding(b, 0)) {
850 *len = Uart.len;
851 return TRUE;
852 }
853 }
854 }
855 }
856
857 static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
858 int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
859 int EmSend4bit(uint8_t resp);
860 int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
861 int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
862 int EmSendCmd(uint8_t *resp, uint16_t respLen);
863 int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
864 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
865 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
866
867 static uint8_t* free_buffer_pointer;
868
869 typedef struct {
870 uint8_t* response;
871 size_t response_n;
872 uint8_t* modulation;
873 size_t modulation_n;
874 uint32_t ProxToAirDuration;
875 } tag_response_info_t;
876
877 bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
878 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
879 // This will need the following byte array for a modulation sequence
880 // 144 data bits (18 * 8)
881 // 18 parity bits
882 // 2 Start and stop
883 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
884 // 1 just for the case
885 // ----------- +
886 // 166 bytes, since every bit that needs to be send costs us a byte
887 //
888
889
890 // Prepare the tag modulation bits from the message
891 CodeIso14443aAsTag(response_info->response,response_info->response_n);
892
893 // Make sure we do not exceed the free buffer space
894 if (ToSendMax > max_buffer_size) {
895 Dbprintf("Out of memory, when modulating bits for tag answer:");
896 Dbhexdump(response_info->response_n,response_info->response,false);
897 return false;
898 }
899
900 // Copy the byte array, used for this modulation to the buffer position
901 memcpy(response_info->modulation,ToSend,ToSendMax);
902
903 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
904 response_info->modulation_n = ToSendMax;
905 response_info->ProxToAirDuration = LastProxToAirDuration;
906
907 return true;
908 }
909
910
911 // "precompile" responses. There are 7 predefined responses with a total of 28 bytes data to transmit.
912 // Coded responses need one byte per bit to transfer (data, parity, start, stop, correction)
913 // 28 * 8 data bits, 28 * 1 parity bits, 7 start bits, 7 stop bits, 7 correction bits
914 // -> need 273 bytes buffer
915 // 44 * 8 data bits, 44 * 1 parity bits, 9 start bits, 9 stop bits, 9 correction bits --370
916 // 47 * 8 data bits, 47 * 1 parity bits, 10 start bits, 10 stop bits, 10 correction bits
917 #define ALLOCATED_TAG_MODULATION_BUFFER_SIZE 453
918
919 bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
920 // Retrieve and store the current buffer index
921 response_info->modulation = free_buffer_pointer;
922
923 // Determine the maximum size we can use from our buffer
924 size_t max_buffer_size = ALLOCATED_TAG_MODULATION_BUFFER_SIZE;
925
926 // Forward the prepare tag modulation function to the inner function
927 if (prepare_tag_modulation(response_info, max_buffer_size)) {
928 // Update the free buffer offset
929 free_buffer_pointer += ToSendMax;
930 return true;
931 } else {
932 return false;
933 }
934 }
935
936 //-----------------------------------------------------------------------------
937 // Main loop of simulated tag: receive commands from reader, decide what
938 // response to send, and send it.
939 //-----------------------------------------------------------------------------
940 void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
941 {
942 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
943 // This can be used in a reader-only attack.
944 // (it can also be retrieved via 'hf 14a list', but hey...
945 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
946 uint8_t ar_nr_collected = 0;
947
948 uint8_t sak;
949
950 // PACK response to PWD AUTH for EV1/NTAG
951 uint8_t response8[4] = {0,0,0,0};
952
953 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
954 uint8_t response1[2] = {0,0};
955
956 switch (tagType) {
957 case 1: { // MIFARE Classic
958 // Says: I am Mifare 1k - original line
959 response1[0] = 0x04;
960 response1[1] = 0x00;
961 sak = 0x08;
962 } break;
963 case 2: { // MIFARE Ultralight
964 // Says: I am a stupid memory tag, no crypto
965 response1[0] = 0x44;
966 response1[1] = 0x00;
967 sak = 0x00;
968 } break;
969 case 3: { // MIFARE DESFire
970 // Says: I am a DESFire tag, ph33r me
971 response1[0] = 0x04;
972 response1[1] = 0x03;
973 sak = 0x20;
974 } break;
975 case 4: { // ISO/IEC 14443-4
976 // Says: I am a javacard (JCOP)
977 response1[0] = 0x04;
978 response1[1] = 0x00;
979 sak = 0x28;
980 } break;
981 case 5: { // MIFARE TNP3XXX
982 // Says: I am a toy
983 response1[0] = 0x01;
984 response1[1] = 0x0f;
985 sak = 0x01;
986 } break;
987 case 6: { // MIFARE Mini
988 // Says: I am a Mifare Mini, 320b
989 response1[0] = 0x44;
990 response1[1] = 0x00;
991 sak = 0x09;
992 } break;
993 case 7: { // NTAG?
994 // Says: I am a NTAG,
995 response1[0] = 0x44;
996 response1[1] = 0x00;
997 sak = 0x00;
998 // PACK
999 response8[0] = 0x80;
1000 response8[1] = 0x80;
1001 ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);
1002 } break;
1003 default: {
1004 Dbprintf("Error: unkown tagtype (%d)",tagType);
1005 return;
1006 } break;
1007 }
1008
1009 // The second response contains the (mandatory) first 24 bits of the UID
1010 uint8_t response2[5] = {0x00};
1011
1012 // Check if the uid uses the (optional) part
1013 uint8_t response2a[5] = {0x00};
1014
1015 if (flags & FLAG_7B_UID_IN_DATA) {
1016 response2[0] = 0x88;
1017 response2[1] = data[0];
1018 response2[2] = data[1];
1019 response2[3] = data[2];
1020
1021 response2a[0] = data[3];
1022 response2a[1] = data[4];
1023 response2a[2] = data[5];
1024 response2a[3] = data[6]; //??
1025 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
1026
1027 // Configure the ATQA and SAK accordingly
1028 response1[0] |= 0x40;
1029 sak |= 0x04;
1030 } else {
1031 memcpy(response2, data, 4);
1032 //num_to_bytes(uid_1st,4,response2);
1033 // Configure the ATQA and SAK accordingly
1034 response1[0] &= 0xBF;
1035 sak &= 0xFB;
1036 }
1037
1038 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1039 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
1040
1041 // Prepare the mandatory SAK (for 4 and 7 byte UID)
1042 uint8_t response3[3] = {0x00};
1043 response3[0] = sak;
1044 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
1045
1046 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
1047 uint8_t response3a[3] = {0x00};
1048 response3a[0] = sak & 0xFB;
1049 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
1050
1051 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
1052 uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1053 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1054 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1055 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1056 // TC(1) = 0x02: CID supported, NAD not supported
1057 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
1058
1059 // Prepare GET_VERSION (different for EV-1 / NTAG)
1060 //uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7}; //EV1 48bytes VERSION.
1061 uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
1062
1063 // Prepare CHK_TEARING
1064 uint8_t response9[] = {0xBD,0x90,0x3f};
1065
1066 #define TAG_RESPONSE_COUNT 10
1067 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
1068 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
1069 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
1070 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1071 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
1072 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
1073 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
1074 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
1075 { .response = response7_NTAG, .response_n = sizeof(response7_NTAG) }, // EV1/NTAG GET_VERSION response
1076 { .response = response8, .response_n = sizeof(response8) }, // EV1/NTAG PACK response
1077 { .response = response9, .response_n = sizeof(response9) } // EV1/NTAG CHK_TEAR response
1078 };
1079
1080 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1081 // Such a response is less time critical, so we can prepare them on the fly
1082 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1083 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1084 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
1085 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
1086 tag_response_info_t dynamic_response_info = {
1087 .response = dynamic_response_buffer,
1088 .response_n = 0,
1089 .modulation = dynamic_modulation_buffer,
1090 .modulation_n = 0
1091 };
1092
1093 // We need to listen to the high-frequency, peak-detected path.
1094 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1095
1096 BigBuf_free_keep_EM();
1097
1098 // allocate buffers:
1099 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
1100 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
1101 free_buffer_pointer = BigBuf_malloc(ALLOCATED_TAG_MODULATION_BUFFER_SIZE);
1102
1103 // clear trace
1104 clear_trace();
1105 set_tracing(TRUE);
1106
1107 // Prepare the responses of the anticollision phase
1108 // there will be not enough time to do this at the moment the reader sends it REQA
1109 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
1110 prepare_allocated_tag_modulation(&responses[i]);
1111 }
1112
1113 int len = 0;
1114
1115 // To control where we are in the protocol
1116 int order = 0;
1117 int lastorder;
1118
1119 // Just to allow some checks
1120 int happened = 0;
1121 int happened2 = 0;
1122 int cmdsRecvd = 0;
1123
1124 cmdsRecvd = 0;
1125 tag_response_info_t* p_response;
1126
1127 LED_A_ON();
1128 for(;;) {
1129 // Clean receive command buffer
1130
1131 if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
1132 DbpString("Button press");
1133 break;
1134 }
1135
1136 p_response = NULL;
1137
1138 // Okay, look at the command now.
1139 lastorder = order;
1140 if(receivedCmd[0] == 0x26) { // Received a REQUEST
1141 p_response = &responses[0]; order = 1;
1142 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
1143 p_response = &responses[0]; order = 6;
1144 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
1145 p_response = &responses[1]; order = 2;
1146 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
1147 p_response = &responses[2]; order = 20;
1148 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
1149 p_response = &responses[3]; order = 3;
1150 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
1151 p_response = &responses[4]; order = 30;
1152 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
1153 uint8_t block = receivedCmd[1];
1154 if ( tagType == 7 ) {
1155 uint16_t start = 4 * block;
1156
1157 /*if ( block < 4 ) {
1158 //NTAG 215
1159 uint8_t blockdata[50] = {
1160 data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
1161 data[3],data[4],data[5],data[6],
1162 data[3] ^ data[4] ^ data[5] ^ data[6],0x48,0x0f,0xe0,
1163 0xe1,0x10,0x12,0x00,
1164 0x03,0x00,0xfe,0x00,
1165 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1166 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1167 0x00,0x00,0x00,0x00,
1168 0x00,0x00};
1169 AppendCrc14443a(blockdata+start, 16);
1170 EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
1171 } else {*/
1172 uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
1173 emlGetMemBt( emdata, start, 16);
1174 AppendCrc14443a(emdata, 16);
1175 EmSendCmdEx(emdata, sizeof(emdata), false);
1176 //}
1177 p_response = NULL;
1178
1179 } else {
1180 EmSendCmdEx(data+(4*block),16,false);
1181 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1182 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1183 p_response = NULL;
1184 }
1185 } else if(receivedCmd[0] == 0x3A) { // Received a FAST READ (ranged read) -- just returns all zeros.
1186
1187 uint8_t emdata[MAX_FRAME_SIZE];
1188 int start = receivedCmd[1] * 4;
1189 int len = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
1190 emlGetMemBt( emdata, start, len);
1191 AppendCrc14443a(emdata, len);
1192 EmSendCmdEx(emdata, len+2, false);
1193 p_response = NULL;
1194
1195 } else if(receivedCmd[0] == 0x3C && tagType == 7) { // Received a READ SIGNATURE --
1196 // ECC data, taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
1197 uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
1198 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
1199 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
1200 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
1201 0x00,0x00};
1202 AppendCrc14443a(data, sizeof(data)-2);
1203 EmSendCmdEx(data,sizeof(data),false);
1204 p_response = NULL;
1205 } else if(receivedCmd[0] == 0x39 && tagType == 7) { // Received a READ COUNTER --
1206 uint8_t data[] = {0x00,0x00,0x00,0x14,0xa5};
1207 EmSendCmdEx(data,sizeof(data),false);
1208 p_response = NULL;
1209 } else if(receivedCmd[0] == 0xA5 && tagType == 7) { // Received a INC COUNTER --
1210 // number of counter
1211 //uint8_t counter = receivedCmd[1];
1212 //uint32_t val = bytes_to_num(receivedCmd+2,4);
1213
1214 // send ACK
1215 uint8_t ack[] = {0x0a};
1216 EmSendCmdEx(ack,sizeof(ack),false);
1217 p_response = NULL;
1218
1219 } else if(receivedCmd[0] == 0x3E && tagType == 7) { // Received a CHECK_TEARING_EVENT --
1220 p_response = &responses[9];
1221 } else if(receivedCmd[0] == 0x50) { // Received a HALT
1222
1223 if (tracing) {
1224 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1225 }
1226 p_response = NULL;
1227 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
1228
1229 if ( tagType == 7 ) { // IF NTAG /EV1 0x60 == GET_VERSION, not a authentication request.
1230 p_response = &responses[7];
1231 } else {
1232 p_response = &responses[5]; order = 7;
1233 }
1234 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
1235 if (tagType == 1 || tagType == 2) { // RATS not supported
1236 EmSend4bit(CARD_NACK_NA);
1237 p_response = NULL;
1238 } else {
1239 p_response = &responses[6]; order = 70;
1240 }
1241 } else if (order == 7 && len == 8) { // Received {nr] and {ar} (part of authentication)
1242 if (tracing) {
1243 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1244 }
1245 uint32_t nonce = bytes_to_num(response5,4);
1246 uint32_t nr = bytes_to_num(receivedCmd,4);
1247 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1248 //Dbprintf("Auth attempt {nonce}{nr}{ar}: %08x %08x %08x", nonce, nr, ar);
1249
1250 if(flags & FLAG_NR_AR_ATTACK )
1251 {
1252 if(ar_nr_collected < 2){
1253 // Avoid duplicates... probably not necessary, nr should vary.
1254 //if(ar_nr_responses[3] != nr){
1255 ar_nr_responses[ar_nr_collected*5] = 0;
1256 ar_nr_responses[ar_nr_collected*5+1] = 0;
1257 ar_nr_responses[ar_nr_collected*5+2] = nonce;
1258 ar_nr_responses[ar_nr_collected*5+3] = nr;
1259 ar_nr_responses[ar_nr_collected*5+4] = ar;
1260 ar_nr_collected++;
1261 //}
1262 }
1263
1264 if(ar_nr_collected > 1 ) {
1265
1266 if (MF_DBGLEVEL >= 2) {
1267 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
1268 Dbprintf("../tools/mfkey/mfkey32 %07x%08x %08x %08x %08x %08x %08x",
1269 ar_nr_responses[0], // UID1
1270 ar_nr_responses[1], // UID2
1271 ar_nr_responses[2], // NT
1272 ar_nr_responses[3], // AR1
1273 ar_nr_responses[4], // NR1
1274 ar_nr_responses[8], // AR2
1275 ar_nr_responses[9] // NR2
1276 );
1277 Dbprintf("../tools/mfkey/mfkey32v2 %06x%08x %08x %08x %08x %08x %08x %08x",
1278 ar_nr_responses[0], // UID1
1279 ar_nr_responses[1], // UID2
1280 ar_nr_responses[2], // NT1
1281 ar_nr_responses[3], // AR1
1282 ar_nr_responses[4], // NR1
1283 ar_nr_responses[7], // NT2
1284 ar_nr_responses[8], // AR2
1285 ar_nr_responses[9] // NR2
1286 );
1287 }
1288 uint8_t len = ar_nr_collected*5*4;
1289 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,len,0,&ar_nr_responses,len);
1290 ar_nr_collected = 0;
1291 memset(ar_nr_responses, 0x00, len);
1292 }
1293 }
1294 } else if (receivedCmd[0] == 0x1a ) // ULC authentication
1295 {
1296
1297 }
1298 else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
1299 {
1300 if ( tagType == 7 ) {
1301 p_response = &responses[8]; // PACK response
1302 uint32_t pwd = bytes_to_num(receivedCmd+1,4);
1303
1304 if ( MF_DBGLEVEL >= 3) Dbprintf("Auth attempt: %08x", pwd);
1305 }
1306 }
1307 else {
1308 // Check for ISO 14443A-4 compliant commands, look at left nibble
1309 switch (receivedCmd[0]) {
1310 case 0x02:
1311 case 0x03: { // IBlock (command no CID)
1312 dynamic_response_info.response[0] = receivedCmd[0];
1313 dynamic_response_info.response[1] = 0x90;
1314 dynamic_response_info.response[2] = 0x00;
1315 dynamic_response_info.response_n = 3;
1316 } break;
1317 case 0x0B:
1318 case 0x0A: { // IBlock (command CID)
1319 dynamic_response_info.response[0] = receivedCmd[0];
1320 dynamic_response_info.response[1] = 0x00;
1321 dynamic_response_info.response[2] = 0x90;
1322 dynamic_response_info.response[3] = 0x00;
1323 dynamic_response_info.response_n = 4;
1324 } break;
1325
1326 case 0x1A:
1327 case 0x1B: { // Chaining command
1328 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1329 dynamic_response_info.response_n = 2;
1330 } break;
1331
1332 case 0xaa:
1333 case 0xbb: {
1334 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1335 dynamic_response_info.response_n = 2;
1336 } break;
1337
1338 case 0xBA: { // ping / pong
1339 dynamic_response_info.response[0] = 0xAB;
1340 dynamic_response_info.response[1] = 0x00;
1341 dynamic_response_info.response_n = 2;
1342 } break;
1343
1344 case 0xCA:
1345 case 0xC2: { // Readers sends deselect command
1346 dynamic_response_info.response[0] = 0xCA;
1347 dynamic_response_info.response[1] = 0x00;
1348 dynamic_response_info.response_n = 2;
1349 } break;
1350
1351 default: {
1352 // Never seen this command before
1353 if (tracing) {
1354 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1355 }
1356 Dbprintf("Received unknown command (len=%d):",len);
1357 Dbhexdump(len,receivedCmd,false);
1358 // Do not respond
1359 dynamic_response_info.response_n = 0;
1360 } break;
1361 }
1362
1363 if (dynamic_response_info.response_n > 0) {
1364 // Copy the CID from the reader query
1365 dynamic_response_info.response[1] = receivedCmd[1];
1366
1367 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1368 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1369 dynamic_response_info.response_n += 2;
1370
1371 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1372 Dbprintf("Error preparing tag response");
1373 if (tracing) {
1374 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1375 }
1376 break;
1377 }
1378 p_response = &dynamic_response_info;
1379 }
1380 }
1381
1382 // Count number of wakeups received after a halt
1383 if(order == 6 && lastorder == 5) { happened++; }
1384
1385 // Count number of other messages after a halt
1386 if(order != 6 && lastorder == 5) { happened2++; }
1387
1388 if(cmdsRecvd > 999) {
1389 DbpString("1000 commands later...");
1390 break;
1391 }
1392 cmdsRecvd++;
1393
1394 if (p_response != NULL) {
1395 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1396 // do the tracing for the previous reader request and this tag answer:
1397 uint8_t par[MAX_PARITY_SIZE];
1398 GetParity(p_response->response, p_response->response_n, par);
1399
1400 EmLogTrace(Uart.output,
1401 Uart.len,
1402 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1403 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1404 Uart.parity,
1405 p_response->response,
1406 p_response->response_n,
1407 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1408 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1409 par);
1410 }
1411
1412 if (!tracing) {
1413 Dbprintf("Trace Full. Simulation stopped.");
1414 break;
1415 }
1416 }
1417
1418 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1419 set_tracing(FALSE);
1420 BigBuf_free_keep_EM();
1421 LED_A_OFF();
1422
1423 if (MF_DBGLEVEL >= 4){
1424 Dbprintf("-[ Wake ups after halt [%d]", happened);
1425 Dbprintf("-[ Messages after halt [%d]", happened2);
1426 Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
1427 }
1428 }
1429
1430
1431 // prepare a delayed transfer. This simply shifts ToSend[] by a number
1432 // of bits specified in the delay parameter.
1433 void PrepareDelayedTransfer(uint16_t delay)
1434 {
1435 uint8_t bitmask = 0;
1436 uint8_t bits_to_shift = 0;
1437 uint8_t bits_shifted = 0;
1438
1439 delay &= 0x07;
1440 if (delay) {
1441 for (uint16_t i = 0; i < delay; i++) {
1442 bitmask |= (0x01 << i);
1443 }
1444 ToSend[ToSendMax++] = 0x00;
1445 for (uint16_t i = 0; i < ToSendMax; i++) {
1446 bits_to_shift = ToSend[i] & bitmask;
1447 ToSend[i] = ToSend[i] >> delay;
1448 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1449 bits_shifted = bits_to_shift;
1450 }
1451 }
1452 }
1453
1454
1455 //-------------------------------------------------------------------------------------
1456 // Transmit the command (to the tag) that was placed in ToSend[].
1457 // Parameter timing:
1458 // if NULL: transfer at next possible time, taking into account
1459 // request guard time and frame delay time
1460 // if == 0: transfer immediately and return time of transfer
1461 // if != 0: delay transfer until time specified
1462 //-------------------------------------------------------------------------------------
1463 static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
1464 {
1465
1466 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1467
1468 uint32_t ThisTransferTime = 0;
1469
1470 if (timing) {
1471 if(*timing == 0) { // Measure time
1472 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
1473 } else {
1474 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1475 }
1476 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1477 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1478 LastTimeProxToAirStart = *timing;
1479 } else {
1480 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1481 while(GetCountSspClk() < ThisTransferTime);
1482 LastTimeProxToAirStart = ThisTransferTime;
1483 }
1484
1485 // clear TXRDY
1486 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1487
1488 uint16_t c = 0;
1489 for(;;) {
1490 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1491 AT91C_BASE_SSC->SSC_THR = cmd[c];
1492 c++;
1493 if(c >= len) {
1494 break;
1495 }
1496 }
1497 }
1498
1499 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
1500 }
1501
1502
1503 //-----------------------------------------------------------------------------
1504 // Prepare reader command (in bits, support short frames) to send to FPGA
1505 //-----------------------------------------------------------------------------
1506 void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
1507 {
1508 int i, j;
1509 int last;
1510 uint8_t b;
1511
1512 ToSendReset();
1513
1514 // Start of Communication (Seq. Z)
1515 ToSend[++ToSendMax] = SEC_Z;
1516 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1517 last = 0;
1518
1519 size_t bytecount = nbytes(bits);
1520 // Generate send structure for the data bits
1521 for (i = 0; i < bytecount; i++) {
1522 // Get the current byte to send
1523 b = cmd[i];
1524 size_t bitsleft = MIN((bits-(i*8)),8);
1525
1526 for (j = 0; j < bitsleft; j++) {
1527 if (b & 1) {
1528 // Sequence X
1529 ToSend[++ToSendMax] = SEC_X;
1530 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1531 last = 1;
1532 } else {
1533 if (last == 0) {
1534 // Sequence Z
1535 ToSend[++ToSendMax] = SEC_Z;
1536 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1537 } else {
1538 // Sequence Y
1539 ToSend[++ToSendMax] = SEC_Y;
1540 last = 0;
1541 }
1542 }
1543 b >>= 1;
1544 }
1545
1546 // Only transmit parity bit if we transmitted a complete byte
1547 if (j == 8 && parity != NULL) {
1548 // Get the parity bit
1549 if (parity[i>>3] & (0x80 >> (i&0x0007))) {
1550 // Sequence X
1551 ToSend[++ToSendMax] = SEC_X;
1552 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1553 last = 1;
1554 } else {
1555 if (last == 0) {
1556 // Sequence Z
1557 ToSend[++ToSendMax] = SEC_Z;
1558 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1559 } else {
1560 // Sequence Y
1561 ToSend[++ToSendMax] = SEC_Y;
1562 last = 0;
1563 }
1564 }
1565 }
1566 }
1567
1568 // End of Communication: Logic 0 followed by Sequence Y
1569 if (last == 0) {
1570 // Sequence Z
1571 ToSend[++ToSendMax] = SEC_Z;
1572 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1573 } else {
1574 // Sequence Y
1575 ToSend[++ToSendMax] = SEC_Y;
1576 last = 0;
1577 }
1578 ToSend[++ToSendMax] = SEC_Y;
1579
1580 // Convert to length of command:
1581 ToSendMax++;
1582 }
1583
1584 //-----------------------------------------------------------------------------
1585 // Prepare reader command to send to FPGA
1586 //-----------------------------------------------------------------------------
1587 void CodeIso14443aAsReaderPar(const uint8_t *cmd, uint16_t len, const uint8_t *parity)
1588 {
1589 CodeIso14443aBitsAsReaderPar(cmd, len*8, parity);
1590 }
1591
1592
1593 //-----------------------------------------------------------------------------
1594 // Wait for commands from reader
1595 // Stop when button is pressed (return 1) or field was gone (return 2)
1596 // Or return 0 when command is captured
1597 //-----------------------------------------------------------------------------
1598 static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
1599 {
1600 *len = 0;
1601
1602 uint32_t timer = 0, vtime = 0;
1603 int analogCnt = 0;
1604 int analogAVG = 0;
1605
1606 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1607 // only, since we are receiving, not transmitting).
1608 // Signal field is off with the appropriate LED
1609 LED_D_OFF();
1610 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1611
1612 // Set ADC to read field strength
1613 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1614 AT91C_BASE_ADC->ADC_MR =
1615 ADC_MODE_PRESCALE(63) |
1616 ADC_MODE_STARTUP_TIME(1) |
1617 ADC_MODE_SAMPLE_HOLD_TIME(15);
1618 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1619 // start ADC
1620 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1621
1622 // Now run a 'software UART' on the stream of incoming samples.
1623 UartInit(received, parity);
1624
1625 // Clear RXRDY:
1626 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1627
1628 for(;;) {
1629 WDT_HIT();
1630
1631 if (BUTTON_PRESS()) return 1;
1632
1633 // test if the field exists
1634 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1635 analogCnt++;
1636 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1637 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1638 if (analogCnt >= 32) {
1639 if ((MAX_ADC_HF_VOLTAGE * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1640 vtime = GetTickCount();
1641 if (!timer) timer = vtime;
1642 // 50ms no field --> card to idle state
1643 if (vtime - timer > 50) return 2;
1644 } else
1645 if (timer) timer = 0;
1646 analogCnt = 0;
1647 analogAVG = 0;
1648 }
1649 }
1650
1651 // receive and test the miller decoding
1652 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1653 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1654 if(MillerDecoding(b, 0)) {
1655 *len = Uart.len;
1656 return 0;
1657 }
1658 }
1659
1660 }
1661 }
1662
1663
1664 static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded)
1665 {
1666 uint8_t b;
1667 uint16_t i = 0;
1668 uint32_t ThisTransferTime;
1669
1670 // Modulate Manchester
1671 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1672
1673 // include correction bit if necessary
1674 if (Uart.parityBits & 0x01) {
1675 correctionNeeded = TRUE;
1676 }
1677 if(correctionNeeded) {
1678 // 1236, so correction bit needed
1679 i = 0;
1680 } else {
1681 i = 1;
1682 }
1683
1684 // clear receiving shift register and holding register
1685 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1686 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1687 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1688 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1689
1690 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1691 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1692 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1693 if (AT91C_BASE_SSC->SSC_RHR) break;
1694 }
1695
1696 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1697
1698 // Clear TXRDY:
1699 AT91C_BASE_SSC->SSC_THR = SEC_F;
1700
1701 // send cycle
1702 for(; i < respLen; ) {
1703 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1704 AT91C_BASE_SSC->SSC_THR = resp[i++];
1705 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1706 }
1707
1708 if(BUTTON_PRESS()) break;
1709 }
1710
1711 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1712 uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3;
1713 for (i = 0; i <= fpga_queued_bits/8 + 1; ) {
1714 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1715 AT91C_BASE_SSC->SSC_THR = SEC_F;
1716 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1717 i++;
1718 }
1719 }
1720
1721 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1722
1723 return 0;
1724 }
1725
1726 int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1727 Code4bitAnswerAsTag(resp);
1728 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1729 // do the tracing for the previous reader request and this tag answer:
1730 uint8_t par[1];
1731 GetParity(&resp, 1, par);
1732 EmLogTrace(Uart.output,
1733 Uart.len,
1734 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1735 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1736 Uart.parity,
1737 &resp,
1738 1,
1739 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1740 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1741 par);
1742 return res;
1743 }
1744
1745 int EmSend4bit(uint8_t resp){
1746 return EmSend4bitEx(resp, false);
1747 }
1748
1749 int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par){
1750 CodeIso14443aAsTagPar(resp, respLen, par);
1751 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1752 // do the tracing for the previous reader request and this tag answer:
1753 EmLogTrace(Uart.output,
1754 Uart.len,
1755 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1756 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1757 Uart.parity,
1758 resp,
1759 respLen,
1760 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1761 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1762 par);
1763 return res;
1764 }
1765
1766 int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
1767 uint8_t par[MAX_PARITY_SIZE];
1768 GetParity(resp, respLen, par);
1769 return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
1770 }
1771
1772 int EmSendCmd(uint8_t *resp, uint16_t respLen){
1773 uint8_t par[MAX_PARITY_SIZE];
1774 GetParity(resp, respLen, par);
1775 return EmSendCmdExPar(resp, respLen, false, par);
1776 }
1777
1778 int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par){
1779 return EmSendCmdExPar(resp, respLen, false, par);
1780 }
1781
1782 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
1783 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity)
1784 {
1785 if (tracing) {
1786 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1787 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1788 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1789 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1790 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1791 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1792 reader_EndTime = tag_StartTime - exact_fdt;
1793 reader_StartTime = reader_EndTime - reader_modlen;
1794 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
1795 return FALSE;
1796 } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
1797 } else {
1798 return TRUE;
1799 }
1800 }
1801
1802 //-----------------------------------------------------------------------------
1803 // Wait a certain time for tag response
1804 // If a response is captured return TRUE
1805 // If it takes too long return FALSE
1806 //-----------------------------------------------------------------------------
1807 static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
1808 {
1809 uint32_t c = 0x00;
1810
1811 // Set FPGA mode to "reader listen mode", no modulation (listen
1812 // only, since we are receiving, not transmitting).
1813 // Signal field is on with the appropriate LED
1814 LED_D_ON();
1815 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1816
1817 // Now get the answer from the card
1818 DemodInit(receivedResponse, receivedResponsePar);
1819
1820 // clear RXRDY:
1821 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1822
1823 for(;;) {
1824 WDT_HIT();
1825
1826 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1827 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1828 if(ManchesterDecoding(b, offset, 0)) {
1829 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
1830 return TRUE;
1831 } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
1832 return FALSE;
1833 }
1834 }
1835 }
1836 }
1837
1838 void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
1839 {
1840 CodeIso14443aBitsAsReaderPar(frame, bits, par);
1841
1842 // Send command to tag
1843 TransmitFor14443a(ToSend, ToSendMax, timing);
1844 if(trigger)
1845 LED_A_ON();
1846
1847 // Log reader command in trace buffer
1848 if (tracing) {
1849 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1850 }
1851 }
1852
1853 void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
1854 {
1855 ReaderTransmitBitsPar(frame, len*8, par, timing);
1856 }
1857
1858 void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
1859 {
1860 // Generate parity and redirect
1861 uint8_t par[MAX_PARITY_SIZE];
1862 GetParity(frame, len/8, par);
1863 ReaderTransmitBitsPar(frame, len, par, timing);
1864 }
1865
1866 void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
1867 {
1868 // Generate parity and redirect
1869 uint8_t par[MAX_PARITY_SIZE];
1870 GetParity(frame, len, par);
1871 ReaderTransmitBitsPar(frame, len*8, par, timing);
1872 }
1873
1874 int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
1875 {
1876 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE;
1877 if (tracing) {
1878 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1879 }
1880 return Demod.len;
1881 }
1882
1883 int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
1884 {
1885 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
1886 if (tracing) {
1887 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1888 }
1889 return Demod.len;
1890 }
1891
1892 /* performs iso14443a anticollision procedure
1893 * fills the uid pointer unless NULL
1894 * fills resp_data unless NULL */
1895 int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, uint32_t *cuid_ptr) {
1896 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1897 uint8_t sel_all[] = { 0x93,0x20 };
1898 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1899 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1900 uint8_t resp[MAX_FRAME_SIZE]; // theoretically. A usual RATS will be much smaller
1901 uint8_t resp_par[MAX_PARITY_SIZE];
1902 byte_t uid_resp[4];
1903 size_t uid_resp_len;
1904
1905 uint8_t sak = 0x04; // cascade uid
1906 int cascade_level = 0;
1907 int len;
1908
1909 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1910 ReaderTransmitBitsPar(wupa,7,0, NULL);
1911
1912 // Receive the ATQA
1913 if(!ReaderReceive(resp, resp_par)) return 0;
1914
1915 if(p_hi14a_card) {
1916 memcpy(p_hi14a_card->atqa, resp, 2);
1917 p_hi14a_card->uidlen = 0;
1918 memset(p_hi14a_card->uid,0,10);
1919 }
1920
1921 // clear uid
1922 if (uid_ptr) {
1923 memset(uid_ptr,0,10);
1924 }
1925
1926 // check for proprietary anticollision:
1927 if ((resp[0] & 0x1F) == 0) {
1928 return 3;
1929 }
1930
1931 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1932 // which case we need to make a cascade 2 request and select - this is a long UID
1933 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1934 for(; sak & 0x04; cascade_level++) {
1935 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1936 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1937
1938 // SELECT_ALL
1939 ReaderTransmit(sel_all, sizeof(sel_all), NULL);
1940 if (!ReaderReceive(resp, resp_par)) return 0;
1941
1942 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1943 memset(uid_resp, 0, 4);
1944 uint16_t uid_resp_bits = 0;
1945 uint16_t collision_answer_offset = 0;
1946 // anti-collision-loop:
1947 while (Demod.collisionPos) {
1948 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1949 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1950 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1951 uid_resp[uid_resp_bits / 8] |= UIDbit << (uid_resp_bits % 8);
1952 }
1953 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1954 uid_resp_bits++;
1955 // construct anticollosion command:
1956 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1957 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1958 sel_uid[2+i] = uid_resp[i];
1959 }
1960 collision_answer_offset = uid_resp_bits%8;
1961 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1962 if (!ReaderReceiveOffset(resp, collision_answer_offset, resp_par)) return 0;
1963 }
1964 // finally, add the last bits and BCC of the UID
1965 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1966 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1967 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1968 }
1969
1970 } else { // no collision, use the response to SELECT_ALL as current uid
1971 memcpy(uid_resp, resp, 4);
1972 }
1973 uid_resp_len = 4;
1974
1975 // calculate crypto UID. Always use last 4 Bytes.
1976 if(cuid_ptr) {
1977 *cuid_ptr = bytes_to_num(uid_resp, 4);
1978 }
1979
1980 // Construct SELECT UID command
1981 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1982 memcpy(sel_uid+2, uid_resp, 4); // the UID
1983 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1984 AppendCrc14443a(sel_uid, 7); // calculate and add CRC
1985 ReaderTransmit(sel_uid, sizeof(sel_uid), NULL);
1986
1987 // Receive the SAK
1988 if (!ReaderReceive(resp, resp_par)) return 0;
1989 sak = resp[0];
1990
1991 // Test if more parts of the uid are coming
1992 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
1993 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1994 // http://www.nxp.com/documents/application_note/AN10927.pdf
1995 uid_resp[0] = uid_resp[1];
1996 uid_resp[1] = uid_resp[2];
1997 uid_resp[2] = uid_resp[3];
1998
1999 uid_resp_len = 3;
2000 }
2001
2002 if(uid_ptr) {
2003 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
2004 }
2005
2006 if(p_hi14a_card) {
2007 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
2008 p_hi14a_card->uidlen += uid_resp_len;
2009 }
2010 }
2011
2012 if(p_hi14a_card) {
2013 p_hi14a_card->sak = sak;
2014 p_hi14a_card->ats_len = 0;
2015 }
2016
2017 // non iso14443a compliant tag
2018 if( (sak & 0x20) == 0) return 2;
2019
2020 // Request for answer to select
2021 AppendCrc14443a(rats, 2);
2022 ReaderTransmit(rats, sizeof(rats), NULL);
2023
2024 if (!(len = ReaderReceive(resp, resp_par))) return 0;
2025
2026
2027 if(p_hi14a_card) {
2028 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
2029 p_hi14a_card->ats_len = len;
2030 }
2031
2032 // reset the PCB block number
2033 iso14_pcb_blocknum = 0;
2034
2035 // set default timeout based on ATS
2036 iso14a_set_ATS_timeout(resp);
2037
2038 return 1;
2039 }
2040
2041 void iso14443a_setup(uint8_t fpga_minor_mode) {
2042 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
2043 // Set up the synchronous serial port
2044 FpgaSetupSsc();
2045 // connect Demodulated Signal to ADC:
2046 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
2047
2048 // Signal field is on with the appropriate LED
2049 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
2050 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
2051 LED_D_ON();
2052 } else {
2053 LED_D_OFF();
2054 }
2055 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
2056
2057 // Start the timer
2058 StartCountSspClk();
2059
2060 DemodReset();
2061 UartReset();
2062 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
2063 iso14a_set_timeout(10*106); // 10ms default
2064 }
2065
2066 int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
2067 uint8_t parity[MAX_PARITY_SIZE];
2068 uint8_t real_cmd[cmd_len+4];
2069 real_cmd[0] = 0x0a; //I-Block
2070 // put block number into the PCB
2071 real_cmd[0] |= iso14_pcb_blocknum;
2072 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
2073 memcpy(real_cmd+2, cmd, cmd_len);
2074 AppendCrc14443a(real_cmd,cmd_len+2);
2075
2076 ReaderTransmit(real_cmd, cmd_len+4, NULL);
2077 size_t len = ReaderReceive(data, parity);
2078 uint8_t *data_bytes = (uint8_t *) data;
2079 if (!len)
2080 return 0; //DATA LINK ERROR
2081 // if we received an I- or R(ACK)-Block with a block number equal to the
2082 // current block number, toggle the current block number
2083 else if (len >= 4 // PCB+CID+CRC = 4 bytes
2084 && ((data_bytes[0] & 0xC0) == 0 // I-Block
2085 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
2086 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
2087 {
2088 iso14_pcb_blocknum ^= 1;
2089 }
2090
2091 return len;
2092 }
2093
2094 //-----------------------------------------------------------------------------
2095 // Read an ISO 14443a tag. Send out commands and store answers.
2096 //
2097 //-----------------------------------------------------------------------------
2098 void ReaderIso14443a(UsbCommand *c)
2099 {
2100 iso14a_command_t param = c->arg[0];
2101 uint8_t *cmd = c->d.asBytes;
2102 size_t len = c->arg[1] & 0xffff;
2103 size_t lenbits = c->arg[1] >> 16;
2104 uint32_t timeout = c->arg[2];
2105 uint32_t arg0 = 0;
2106 byte_t buf[USB_CMD_DATA_SIZE];
2107 uint8_t par[MAX_PARITY_SIZE];
2108
2109 if(param & ISO14A_CONNECT) {
2110 clear_trace();
2111 }
2112
2113 set_tracing(TRUE);
2114
2115 if(param & ISO14A_REQUEST_TRIGGER) {
2116 iso14a_set_trigger(TRUE);
2117 }
2118
2119 if(param & ISO14A_CONNECT) {
2120 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
2121 if(!(param & ISO14A_NO_SELECT)) {
2122 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
2123 arg0 = iso14443a_select_card(NULL,card,NULL);
2124 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
2125 }
2126 }
2127
2128 if(param & ISO14A_SET_TIMEOUT) {
2129 iso14a_set_timeout(timeout);
2130 }
2131
2132 if(param & ISO14A_APDU) {
2133 arg0 = iso14_apdu(cmd, len, buf);
2134 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
2135 }
2136
2137 if(param & ISO14A_RAW) {
2138 if(param & ISO14A_APPEND_CRC) {
2139 if(param & ISO14A_TOPAZMODE) {
2140 AppendCrc14443b(cmd,len);
2141 } else {
2142 AppendCrc14443a(cmd,len);
2143 }
2144 len += 2;
2145 if (lenbits) lenbits += 16;
2146 }
2147 if(lenbits>0) { // want to send a specific number of bits (e.g. short commands)
2148 if(param & ISO14A_TOPAZMODE) {
2149 int bits_to_send = lenbits;
2150 uint16_t i = 0;
2151 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 7), NULL, NULL); // first byte is always short (7bits) and no parity
2152 bits_to_send -= 7;
2153 while (bits_to_send > 0) {
2154 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 8), NULL, NULL); // following bytes are 8 bit and no parity
2155 bits_to_send -= 8;
2156 }
2157 } else {
2158 GetParity(cmd, lenbits/8, par);
2159 ReaderTransmitBitsPar(cmd, lenbits, par, NULL); // bytes are 8 bit with odd parity
2160 }
2161 } else { // want to send complete bytes only
2162 if(param & ISO14A_TOPAZMODE) {
2163 uint16_t i = 0;
2164 ReaderTransmitBitsPar(&cmd[i++], 7, NULL, NULL); // first byte: 7 bits, no paritiy
2165 while (i < len) {
2166 ReaderTransmitBitsPar(&cmd[i++], 8, NULL, NULL); // following bytes: 8 bits, no paritiy
2167 }
2168 } else {
2169 ReaderTransmit(cmd,len, NULL); // 8 bits, odd parity
2170 }
2171 }
2172 arg0 = ReaderReceive(buf, par);
2173 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
2174 }
2175
2176 if(param & ISO14A_REQUEST_TRIGGER) {
2177 iso14a_set_trigger(FALSE);
2178 }
2179
2180 if(param & ISO14A_NO_DISCONNECT) {
2181 return;
2182 }
2183
2184 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2185 set_tracing(FALSE);
2186 LEDsoff();
2187 }
2188
2189
2190 // Determine the distance between two nonces.
2191 // Assume that the difference is small, but we don't know which is first.
2192 // Therefore try in alternating directions.
2193 int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
2194
2195 uint16_t i;
2196 uint32_t nttmp1, nttmp2;
2197
2198 if (nt1 == nt2) return 0;
2199
2200 nttmp1 = nt1;
2201 nttmp2 = nt2;
2202
2203 for (i = 1; i < 0xFFFF; i++) {
2204 nttmp1 = prng_successor(nttmp1, 1);
2205 if (nttmp1 == nt2) return i;
2206 nttmp2 = prng_successor(nttmp2, 1);
2207 if (nttmp2 == nt1) return -i;
2208 }
2209
2210 return(-99999); // either nt1 or nt2 are invalid nonces
2211 }
2212
2213
2214 //-----------------------------------------------------------------------------
2215 // Recover several bits of the cypher stream. This implements (first stages of)
2216 // the algorithm described in "The Dark Side of Security by Obscurity and
2217 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2218 // (article by Nicolas T. Courtois, 2009)
2219 //-----------------------------------------------------------------------------
2220 void ReaderMifare(bool first_try)
2221 {
2222 // Mifare AUTH
2223 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
2224 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
2225 static uint8_t mf_nr_ar3;
2226
2227 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
2228 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
2229
2230 if (first_try) {
2231 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2232 }
2233
2234 // free eventually allocated BigBuf memory. We want all for tracing.
2235 BigBuf_free();
2236
2237 clear_trace();
2238 set_tracing(TRUE);
2239
2240 byte_t nt_diff = 0;
2241 uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
2242 static byte_t par_low = 0;
2243 bool led_on = TRUE;
2244 uint8_t uid[10] ={0};
2245 uint32_t cuid;
2246
2247 uint32_t nt = 0;
2248 uint32_t previous_nt = 0;
2249 static uint32_t nt_attacked = 0;
2250 byte_t par_list[8] = {0x00};
2251 byte_t ks_list[8] = {0x00};
2252
2253 #define PRNG_SEQUENCE_LENGTH (1 << 16);
2254 static uint32_t sync_time = 0;
2255 static int32_t sync_cycles = 0;
2256 int catch_up_cycles = 0;
2257 int last_catch_up = 0;
2258 uint16_t elapsed_prng_sequences;
2259 uint16_t consecutive_resyncs = 0;
2260 int isOK = 0;
2261
2262 if (first_try) {
2263 mf_nr_ar3 = 0;
2264 sync_time = GetCountSspClk() & 0xfffffff8;
2265 sync_cycles = PRNG_SEQUENCE_LENGTH; //65536; //0x10000 // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
2266 nt_attacked = 0;
2267 par[0] = 0;
2268 }
2269 else {
2270 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
2271 mf_nr_ar3++;
2272 mf_nr_ar[3] = mf_nr_ar3;
2273 par[0] = par_low;
2274 }
2275
2276 LED_A_ON();
2277 LED_B_OFF();
2278 LED_C_OFF();
2279
2280
2281 #define MAX_UNEXPECTED_RANDOM 4 // maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
2282 #define MAX_SYNC_TRIES 32
2283 #define NUM_DEBUG_INFOS 8 // per strategy
2284 #define MAX_STRATEGY 3
2285 uint16_t unexpected_random = 0;
2286 uint16_t sync_tries = 0;
2287 int16_t debug_info_nr = -1;
2288 uint16_t strategy = 0;
2289 int32_t debug_info[MAX_STRATEGY][NUM_DEBUG_INFOS];
2290 uint32_t select_time;
2291 uint32_t halt_time;
2292
2293 for(uint16_t i = 0; TRUE; i++) {
2294
2295 LED_C_ON();
2296 WDT_HIT();
2297
2298 // Test if the action was cancelled
2299 if(BUTTON_PRESS()) {
2300 isOK = -1;
2301 break;
2302 }
2303
2304 if (strategy == 2) {
2305 // test with additional hlt command
2306 halt_time = 0;
2307 int len = mifare_sendcmd_short(NULL, false, 0x50, 0x00, receivedAnswer, receivedAnswerPar, &halt_time);
2308 if (len && MF_DBGLEVEL >= 3) {
2309 Dbprintf("Unexpected response of %d bytes to hlt command (additional debugging).", len);
2310 }
2311 }
2312
2313 if (strategy == 3) {
2314 // test with FPGA power off/on
2315 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2316 SpinDelay(200);
2317 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2318 SpinDelay(100);
2319 }
2320
2321 if(!iso14443a_select_card(uid, NULL, &cuid)) {
2322 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
2323 continue;
2324 }
2325 select_time = GetCountSspClk();
2326
2327 elapsed_prng_sequences = 1;
2328 if (debug_info_nr == -1) {
2329 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
2330 catch_up_cycles = 0;
2331
2332 // if we missed the sync time already, advance to the next nonce repeat
2333 while(GetCountSspClk() > sync_time) {
2334 elapsed_prng_sequences++;
2335 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
2336 }
2337
2338 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2339 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2340 } else {
2341 // collect some information on tag nonces for debugging:
2342 #define DEBUG_FIXED_SYNC_CYCLES PRNG_SEQUENCE_LENGTH
2343 if (strategy == 0) {
2344 // nonce distances at fixed time after card select:
2345 sync_time = select_time + DEBUG_FIXED_SYNC_CYCLES;
2346 } else if (strategy == 1) {
2347 // nonce distances at fixed time between authentications:
2348 sync_time = sync_time + DEBUG_FIXED_SYNC_CYCLES;
2349 } else if (strategy == 2) {
2350 // nonce distances at fixed time after halt:
2351 sync_time = halt_time + DEBUG_FIXED_SYNC_CYCLES;
2352 } else {
2353 // nonce_distances at fixed time after power on
2354 sync_time = DEBUG_FIXED_SYNC_CYCLES;
2355 }
2356 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2357 }
2358
2359 // Receive the (4 Byte) "random" nonce
2360 if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
2361 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2362 continue;
2363 }
2364
2365 previous_nt = nt;
2366 nt = bytes_to_num(receivedAnswer, 4);
2367
2368 // Transmit reader nonce with fake par
2369 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
2370
2371 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2372 int nt_distance = dist_nt(previous_nt, nt);
2373 if (nt_distance == 0) {
2374 nt_attacked = nt;
2375 } else {
2376 if (nt_distance == -99999) { // invalid nonce received
2377 unexpected_random++;
2378 if (unexpected_random > MAX_UNEXPECTED_RANDOM) {
2379 isOK = -3; // Card has an unpredictable PRNG. Give up
2380 break;
2381 } else {
2382 continue; // continue trying...
2383 }
2384 }
2385 if (++sync_tries > MAX_SYNC_TRIES) {
2386 if (strategy > MAX_STRATEGY || MF_DBGLEVEL < 3) {
2387 isOK = -4; // Card's PRNG runs at an unexpected frequency or resets unexpectedly
2388 break;
2389 } else { // continue for a while, just to collect some debug info
2390 debug_info[strategy][debug_info_nr] = nt_distance;
2391 debug_info_nr++;
2392 if (debug_info_nr == NUM_DEBUG_INFOS) {
2393 strategy++;
2394 debug_info_nr = 0;
2395 }
2396 continue;
2397 }
2398 }
2399 sync_cycles = (sync_cycles - nt_distance/elapsed_prng_sequences);
2400 if (sync_cycles <= 0) {
2401 sync_cycles += PRNG_SEQUENCE_LENGTH;
2402 }
2403 if (MF_DBGLEVEL >= 3) {
2404 Dbprintf("calibrating in cycle %d. nt_distance=%d, elapsed_prng_sequences=%d, new sync_cycles: %d\n", i, nt_distance, elapsed_prng_sequences, sync_cycles);
2405 }
2406 continue;
2407 }
2408 }
2409
2410 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2411 catch_up_cycles = -dist_nt(nt_attacked, nt);
2412 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2413 catch_up_cycles = 0;
2414 continue;
2415 }
2416 catch_up_cycles /= elapsed_prng_sequences;
2417 if (catch_up_cycles == last_catch_up) {
2418 consecutive_resyncs++;
2419 }
2420 else {
2421 last_catch_up = catch_up_cycles;
2422 consecutive_resyncs = 0;
2423 }
2424 if (consecutive_resyncs < 3) {
2425 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
2426 }
2427 else {
2428 sync_cycles = sync_cycles + catch_up_cycles;
2429 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
2430 last_catch_up = 0;
2431 catch_up_cycles = 0;
2432 consecutive_resyncs = 0;
2433 }
2434 continue;
2435 }
2436
2437 consecutive_resyncs = 0;
2438
2439 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2440 if (ReaderReceive(receivedAnswer, receivedAnswerPar)) {
2441 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2442
2443 if (nt_diff == 0) {
2444 par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2445 }
2446
2447 led_on = !led_on;
2448 if(led_on) LED_B_ON(); else LED_B_OFF();
2449
2450 par_list[nt_diff] = SwapBits(par[0], 8);
2451 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2452
2453 // Test if the information is complete
2454 if (nt_diff == 0x07) {
2455 isOK = 1;
2456 break;
2457 }
2458
2459 nt_diff = (nt_diff + 1) & 0x07;
2460 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2461 par[0] = par_low;
2462 } else {
2463 if (nt_diff == 0 && first_try)
2464 {
2465 par[0]++;
2466 if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
2467 isOK = -2;
2468 break;
2469 }
2470 } else {
2471 par[0] = ((par[0] & 0x1F) + 1) | par_low;
2472 }
2473 }
2474 }
2475
2476
2477 mf_nr_ar[3] &= 0x1F;
2478
2479 if (isOK == -4) {
2480 if (MF_DBGLEVEL >= 3) {
2481 for (uint16_t i = 0; i <= MAX_STRATEGY; i++) {
2482 for(uint16_t j = 0; j < NUM_DEBUG_INFOS; j++) {
2483 Dbprintf("collected debug info[%d][%d] = %d", i, j, debug_info[i][j]);
2484 }
2485 }
2486 }
2487 }
2488
2489 byte_t buf[28];
2490 memcpy(buf + 0, uid, 4);
2491 num_to_bytes(nt, 4, buf + 4);
2492 memcpy(buf + 8, par_list, 8);
2493 memcpy(buf + 16, ks_list, 8);
2494 memcpy(buf + 24, mf_nr_ar, 4);
2495
2496 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2497
2498 // Thats it...
2499 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2500 LEDsoff();
2501
2502 set_tracing(FALSE);
2503 }
2504
2505 /**
2506 *MIFARE 1K simulate.
2507 *
2508 *@param flags :
2509 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2510 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2511 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2512 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2513 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2514 */
2515 void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
2516 {
2517 int cardSTATE = MFEMUL_NOFIELD;
2518 int _7BUID = 0;
2519 int vHf = 0; // in mV
2520 int res;
2521 uint32_t selTimer = 0;
2522 uint32_t authTimer = 0;
2523 uint16_t len = 0;
2524 uint8_t cardWRBL = 0;
2525 uint8_t cardAUTHSC = 0;
2526 uint8_t cardAUTHKEY = 0xff; // no authentication
2527 // uint32_t cardRr = 0;
2528 uint32_t cuid = 0;
2529 //uint32_t rn_enc = 0;
2530 uint32_t ans = 0;
2531 uint32_t cardINTREG = 0;
2532 uint8_t cardINTBLOCK = 0;
2533 struct Crypto1State mpcs = {0, 0};
2534 struct Crypto1State *pcs;
2535 pcs = &mpcs;
2536 uint32_t numReads = 0;//Counts numer of times reader read a block
2537 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2538 uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE];
2539 uint8_t response[MAX_MIFARE_FRAME_SIZE];
2540 uint8_t response_par[MAX_MIFARE_PARITY_SIZE];
2541
2542 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2543 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2544 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2545 uint8_t rSAK[] = {0x08, 0xb6, 0xdd}; // Mifare Classic
2546 //uint8_t rSAK[] = {0x09, 0x3f, 0xcc }; // Mifare Mini
2547 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
2548
2549 uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
2550 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
2551
2552 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2553 // This can be used in a reader-only attack.
2554 // (it can also be retrieved via 'hf 14a list', but hey...
2555 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
2556 uint8_t ar_nr_collected = 0;
2557
2558 // Authenticate response - nonce
2559 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
2560
2561 //-- Determine the UID
2562 // Can be set from emulator memory, incoming data
2563 // and can be 7 or 4 bytes long
2564 if (flags & FLAG_4B_UID_IN_DATA)
2565 {
2566 // 4B uid comes from data-portion of packet
2567 memcpy(rUIDBCC1,datain,4);
2568 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2569
2570 } else if (flags & FLAG_7B_UID_IN_DATA) {
2571 // 7B uid comes from data-portion of packet
2572 memcpy(&rUIDBCC1[1],datain,3);
2573 memcpy(rUIDBCC2, datain+3, 4);
2574 _7BUID = true;
2575 } else {
2576 // get UID from emul memory
2577 emlGetMemBt(receivedCmd, 7, 1);
2578 _7BUID = !(receivedCmd[0] == 0x00);
2579 if (!_7BUID) { // ---------- 4BUID
2580 emlGetMemBt(rUIDBCC1, 0, 4);
2581 } else { // ---------- 7BUID
2582 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2583 emlGetMemBt(rUIDBCC2, 3, 4);
2584 }
2585 }
2586
2587 // save uid.
2588 ar_nr_responses[0*5] = bytes_to_num(rUIDBCC1+1, 3);
2589 if ( _7BUID )
2590 ar_nr_responses[0*5+1] = bytes_to_num(rUIDBCC2, 4);
2591
2592 /*
2593 * Regardless of what method was used to set the UID, set fifth byte and modify
2594 * the ATQA for 4 or 7-byte UID
2595 */
2596 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2597 if (_7BUID) {
2598 rATQA[0] = 0x44;
2599 rUIDBCC1[0] = 0x88;
2600 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2601 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2602 }
2603
2604 if (MF_DBGLEVEL >= 1) {
2605 if (!_7BUID) {
2606 Dbprintf("4B UID: %02x%02x%02x%02x",
2607 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
2608 } else {
2609 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2610 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
2611 rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
2612 }
2613 }
2614
2615 // We need to listen to the high-frequency, peak-detected path.
2616 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
2617
2618 // free eventually allocated BigBuf memory but keep Emulator Memory
2619 BigBuf_free_keep_EM();
2620
2621 // clear trace
2622 clear_trace();
2623 set_tracing(TRUE);
2624
2625
2626 bool finished = FALSE;
2627 while (!BUTTON_PRESS() && !finished) {
2628 WDT_HIT();
2629
2630 // find reader field
2631 if (cardSTATE == MFEMUL_NOFIELD) {
2632 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
2633 if (vHf > MF_MINFIELDV) {
2634 cardSTATE_TO_IDLE();
2635 LED_A_ON();
2636 }
2637 }
2638 if(cardSTATE == MFEMUL_NOFIELD) continue;
2639
2640 //Now, get data
2641 res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
2642 if (res == 2) { //Field is off!
2643 cardSTATE = MFEMUL_NOFIELD;
2644 LEDsoff();
2645 continue;
2646 } else if (res == 1) {
2647 break; //return value 1 means button press
2648 }
2649
2650 // REQ or WUP request in ANY state and WUP in HALTED state
2651 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2652 selTimer = GetTickCount();
2653 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2654 cardSTATE = MFEMUL_SELECT1;
2655
2656 // init crypto block
2657 LED_B_OFF();
2658 LED_C_OFF();
2659 crypto1_destroy(pcs);
2660 cardAUTHKEY = 0xff;
2661 continue;
2662 }
2663
2664 switch (cardSTATE) {
2665 case MFEMUL_NOFIELD:
2666 case MFEMUL_HALTED:
2667 case MFEMUL_IDLE:{
2668 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2669 break;
2670 }
2671 case MFEMUL_SELECT1:{
2672 // select all
2673 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
2674 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
2675 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
2676 break;
2677 }
2678
2679 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2680 {
2681 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2682 }
2683 // select card
2684 if (len == 9 &&
2685 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
2686 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
2687 cuid = bytes_to_num(rUIDBCC1, 4);
2688 if (!_7BUID) {
2689 cardSTATE = MFEMUL_WORK;
2690 LED_B_ON();
2691 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2692 break;
2693 } else {
2694 cardSTATE = MFEMUL_SELECT2;
2695 }
2696 }
2697 break;
2698 }
2699 case MFEMUL_AUTH1:{
2700 if( len != 8)
2701 {
2702 cardSTATE_TO_IDLE();
2703 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2704 break;
2705 }
2706
2707 uint32_t ar = bytes_to_num(receivedCmd, 4);
2708 uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
2709
2710 //Collect AR/NR
2711 //if(ar_nr_collected < 2 && cardAUTHSC == 2){
2712 if(ar_nr_collected < 2){
2713 if(ar_nr_responses[2] != ar)
2714 {// Avoid duplicates... probably not necessary, ar should vary.
2715 //ar_nr_responses[ar_nr_collected*5] = 0;
2716 //ar_nr_responses[ar_nr_collected*5+1] = 0;
2717 ar_nr_responses[ar_nr_collected*5+2] = nonce;
2718 ar_nr_responses[ar_nr_collected*5+3] = nr;
2719 ar_nr_responses[ar_nr_collected*5+4] = ar;
2720 ar_nr_collected++;
2721 }
2722 // Interactive mode flag, means we need to send ACK
2723 if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
2724 {
2725 finished = true;
2726 }
2727 }
2728
2729 // --- crypto
2730 //crypto1_word(pcs, ar , 1);
2731 //cardRr = nr ^ crypto1_word(pcs, 0, 0);
2732
2733 //test if auth OK
2734 //if (cardRr != prng_successor(nonce, 64)){
2735
2736 //if (MF_DBGLEVEL >= 4) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2737 // cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2738 // cardRr, prng_successor(nonce, 64));
2739 // Shouldn't we respond anything here?
2740 // Right now, we don't nack or anything, which causes the
2741 // reader to do a WUPA after a while. /Martin
2742 // -- which is the correct response. /piwi
2743 //cardSTATE_TO_IDLE();
2744 //LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2745 //break;
2746 //}
2747
2748 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2749
2750 num_to_bytes(ans, 4, rAUTH_AT);
2751 // --- crypto
2752 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2753 LED_C_ON();
2754 cardSTATE = MFEMUL_WORK;
2755 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2756 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2757 GetTickCount() - authTimer);
2758 break;
2759 }
2760 case MFEMUL_SELECT2:{
2761 if (!len) {
2762 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2763 break;
2764 }
2765 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
2766 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
2767 break;
2768 }
2769
2770 // select 2 card
2771 if (len == 9 &&
2772 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2773 EmSendCmd(rSAK, sizeof(rSAK));
2774 cuid = bytes_to_num(rUIDBCC2, 4);
2775 cardSTATE = MFEMUL_WORK;
2776 LED_B_ON();
2777 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
2778 break;
2779 }
2780
2781 // i guess there is a command). go into the work state.
2782 if (len != 4) {
2783 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2784 break;
2785 }
2786 cardSTATE = MFEMUL_WORK;
2787 //goto lbWORK;
2788 //intentional fall-through to the next case-stmt
2789 }
2790
2791 case MFEMUL_WORK:{
2792 if (len == 0) {
2793 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2794 break;
2795 }
2796
2797 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2798
2799 if(encrypted_data) {
2800 // decrypt seqence
2801 mf_crypto1_decrypt(pcs, receivedCmd, len);
2802 }
2803
2804 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2805 authTimer = GetTickCount();
2806 cardAUTHSC = receivedCmd[1] / 4; // received block num
2807 cardAUTHKEY = receivedCmd[0] - 0x60;
2808 crypto1_destroy(pcs);//Added by martin
2809 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
2810
2811 if (!encrypted_data) { // first authentication
2812 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2813
2814 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2815 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
2816 } else { // nested authentication
2817 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2818 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
2819 num_to_bytes(ans, 4, rAUTH_AT);
2820 }
2821
2822 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2823 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2824 cardSTATE = MFEMUL_AUTH1;
2825 break;
2826 }
2827
2828 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2829 // BUT... ACK --> NACK
2830 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2831 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2832 break;
2833 }
2834
2835 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2836 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2837 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2838 break;
2839 }
2840
2841 if(len != 4) {
2842 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2843 break;
2844 }
2845
2846 if(receivedCmd[0] == 0x30 // read block
2847 || receivedCmd[0] == 0xA0 // write block
2848 || receivedCmd[0] == 0xC0 // inc
2849 || receivedCmd[0] == 0xC1 // dec
2850 || receivedCmd[0] == 0xC2 // restore
2851 || receivedCmd[0] == 0xB0) { // transfer
2852 if (receivedCmd[1] >= 16 * 4) {
2853 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2854 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2855 break;
2856 }
2857
2858 if (receivedCmd[1] / 4 != cardAUTHSC) {
2859 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2860 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
2861 break;
2862 }
2863 }
2864 // read block
2865 if (receivedCmd[0] == 0x30) {
2866 if (MF_DBGLEVEL >= 4) {
2867 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2868 }
2869 emlGetMem(response, receivedCmd[1], 1);
2870 AppendCrc14443a(response, 16);
2871 mf_crypto1_encrypt(pcs, response, 18, response_par);
2872 EmSendCmdPar(response, 18, response_par);
2873 numReads++;
2874 if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
2875 Dbprintf("%d reads done, exiting", numReads);
2876 finished = true;
2877 }
2878 break;
2879 }
2880 // write block
2881 if (receivedCmd[0] == 0xA0) {
2882 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
2883 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2884 cardSTATE = MFEMUL_WRITEBL2;
2885 cardWRBL = receivedCmd[1];
2886 break;
2887 }
2888 // increment, decrement, restore
2889 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
2890 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2891 if (emlCheckValBl(receivedCmd[1])) {
2892 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
2893 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2894 break;
2895 }
2896 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2897 if (receivedCmd[0] == 0xC1)
2898 cardSTATE = MFEMUL_INTREG_INC;
2899 if (receivedCmd[0] == 0xC0)
2900 cardSTATE = MFEMUL_INTREG_DEC;
2901 if (receivedCmd[0] == 0xC2)
2902 cardSTATE = MFEMUL_INTREG_REST;
2903 cardWRBL = receivedCmd[1];
2904 break;
2905 }
2906 // transfer
2907 if (receivedCmd[0] == 0xB0) {
2908 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2909 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2910 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2911 else
2912 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2913 break;
2914 }
2915 // halt
2916 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
2917 LED_B_OFF();
2918 LED_C_OFF();
2919 cardSTATE = MFEMUL_HALTED;
2920 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
2921 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2922 break;
2923 }
2924 // RATS
2925 if (receivedCmd[0] == 0xe0) {//RATS
2926 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2927 break;
2928 }
2929 // command not allowed
2930 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2931 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2932 break;
2933 }
2934 case MFEMUL_WRITEBL2:{
2935 if (len == 18){
2936 mf_crypto1_decrypt(pcs, receivedCmd, len);
2937 emlSetMem(receivedCmd, cardWRBL, 1);
2938 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2939 cardSTATE = MFEMUL_WORK;
2940 } else {
2941 cardSTATE_TO_IDLE();
2942 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2943 }
2944 break;
2945 }
2946
2947 case MFEMUL_INTREG_INC:{
2948 mf_crypto1_decrypt(pcs, receivedCmd, len);
2949 memcpy(&ans, receivedCmd, 4);
2950 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2951 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2952 cardSTATE_TO_IDLE();
2953 break;
2954 }
2955 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2956 cardINTREG = cardINTREG + ans;
2957 cardSTATE = MFEMUL_WORK;
2958 break;
2959 }
2960 case MFEMUL_INTREG_DEC:{
2961 mf_crypto1_decrypt(pcs, receivedCmd, len);
2962 memcpy(&ans, receivedCmd, 4);
2963 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2964 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2965 cardSTATE_TO_IDLE();
2966 break;
2967 }
2968 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2969 cardINTREG = cardINTREG - ans;
2970 cardSTATE = MFEMUL_WORK;
2971 break;
2972 }
2973 case MFEMUL_INTREG_REST:{
2974 mf_crypto1_decrypt(pcs, receivedCmd, len);
2975 memcpy(&ans, receivedCmd, 4);
2976 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2977 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2978 cardSTATE_TO_IDLE();
2979 break;
2980 }
2981 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2982 cardSTATE = MFEMUL_WORK;
2983 break;
2984 }
2985 }
2986 }
2987
2988 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2989 LEDsoff();
2990
2991 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2992 {
2993 //May just aswell send the collected ar_nr in the response aswell
2994 uint8_t len = ar_nr_collected*5*4;
2995 cmd_send(CMD_ACK, CMD_SIMULATE_MIFARE_CARD, len, 0, &ar_nr_responses, len);
2996 }
2997
2998 if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
2999 {
3000 if(ar_nr_collected > 1 ) {
3001 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
3002 Dbprintf("../tools/mfkey/mfkey32 %06x%08x %08x %08x %08x %08x %08x",
3003 ar_nr_responses[0], // UID1
3004 ar_nr_responses[1], // UID2
3005 ar_nr_responses[2], // NT
3006 ar_nr_responses[3], // AR1
3007 ar_nr_responses[4], // NR1
3008 ar_nr_responses[8], // AR2
3009 ar_nr_responses[9] // NR2
3010 );
3011 Dbprintf("../tools/mfkey/mfkey32v2 %06x%08x %08x %08x %08x %08x %08x %08x",
3012 ar_nr_responses[0], // UID1
3013 ar_nr_responses[1], // UID2
3014 ar_nr_responses[2], // NT1
3015 ar_nr_responses[3], // AR1
3016 ar_nr_responses[4], // NR1
3017 ar_nr_responses[7], // NT2
3018 ar_nr_responses[8], // AR2
3019 ar_nr_responses[9] // NR2
3020 );
3021 } else {
3022 Dbprintf("Failed to obtain two AR/NR pairs!");
3023 if(ar_nr_collected > 0 ) {
3024 Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
3025 ar_nr_responses[0], // UID1
3026 ar_nr_responses[1], // UID2
3027 ar_nr_responses[2], // NT
3028 ar_nr_responses[3], // AR1
3029 ar_nr_responses[4] // NR1
3030 );
3031 }
3032 }
3033 }
3034 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen());
3035
3036 set_tracing(FALSE);
3037 }
3038
3039
3040 //-----------------------------------------------------------------------------
3041 // MIFARE sniffer.
3042 //
3043 //-----------------------------------------------------------------------------
3044 void RAMFUNC SniffMifare(uint8_t param) {
3045 // param:
3046 // bit 0 - trigger from first card answer
3047 // bit 1 - trigger from first reader 7-bit request
3048
3049 // C(red) A(yellow) B(green)
3050 LEDsoff();
3051 // init trace buffer
3052 clear_trace();
3053 set_tracing(TRUE);
3054
3055 // The command (reader -> tag) that we're receiving.
3056 // The length of a received command will in most cases be no more than 18 bytes.
3057 // So 32 should be enough!
3058 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
3059 uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
3060 // The response (tag -> reader) that we're receiving.
3061 uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
3062 uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
3063
3064 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
3065
3066 // free eventually allocated BigBuf memory
3067 BigBuf_free();
3068 // allocate the DMA buffer, used to stream samples from the FPGA
3069 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
3070 uint8_t *data = dmaBuf;
3071 uint8_t previous_data = 0;
3072 int maxDataLen = 0;
3073 int dataLen = 0;
3074 bool ReaderIsActive = FALSE;
3075 bool TagIsActive = FALSE;
3076
3077 // Set up the demodulator for tag -> reader responses.
3078 DemodInit(receivedResponse, receivedResponsePar);
3079
3080 // Set up the demodulator for the reader -> tag commands
3081 UartInit(receivedCmd, receivedCmdPar);
3082
3083 // Setup for the DMA.
3084 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
3085
3086 LED_D_OFF();
3087
3088 // init sniffer
3089 MfSniffInit();
3090
3091 // And now we loop, receiving samples.
3092 for(uint32_t sniffCounter = 0; TRUE; ) {
3093
3094 if(BUTTON_PRESS()) {
3095 DbpString("cancelled by button");
3096 break;
3097 }
3098
3099 LED_A_ON();
3100 WDT_HIT();
3101
3102 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
3103 // check if a transaction is completed (timeout after 2000ms).
3104 // if yes, stop the DMA transfer and send what we have so far to the client
3105 if (MfSniffSend(2000)) {
3106 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
3107 sniffCounter = 0;
3108 data = dmaBuf;
3109 maxDataLen = 0;
3110 ReaderIsActive = FALSE;
3111 TagIsActive = FALSE;
3112 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
3113 }
3114 }
3115
3116 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
3117 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
3118 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
3119 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
3120 } else {
3121 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
3122 }
3123 // test for length of buffer
3124 if(dataLen > maxDataLen) { // we are more behind than ever...
3125 maxDataLen = dataLen;
3126 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
3127 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
3128 break;
3129 }
3130 }
3131 if(dataLen < 1) continue;
3132
3133 // primary buffer was stopped ( <-- we lost data!
3134 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
3135 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
3136 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
3137 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
3138 }
3139 // secondary buffer sets as primary, secondary buffer was stopped
3140 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
3141 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
3142 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
3143 }
3144
3145 LED_A_OFF();
3146
3147 if (sniffCounter & 0x01) {
3148
3149 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
3150 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
3151 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
3152 LED_C_INV();
3153 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
3154
3155 /* And ready to receive another command. */
3156 UartReset();
3157
3158 /* And also reset the demod code */
3159 DemodReset();
3160 }
3161 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
3162 }
3163
3164 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
3165 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
3166 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
3167 LED_C_INV();
3168
3169 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, FALSE)) break;
3170
3171 // And ready to receive another response.
3172 DemodReset();
3173
3174 // And reset the Miller decoder including its (now outdated) input buffer
3175 UartInit(receivedCmd, receivedCmdPar);
3176 // why not UartReset?
3177 }
3178 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
3179 }
3180 }
3181
3182 previous_data = *data;
3183 sniffCounter++;
3184 data++;
3185 if(data == dmaBuf + DMA_BUFFER_SIZE) {
3186 data = dmaBuf;
3187 }
3188
3189 } // main cycle
3190
3191 FpgaDisableSscDma();
3192 MfSniffEnd();
3193 LEDsoff();
3194 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
3195 set_tracing(FALSE);
3196 }
Proxmark3 GIT tracking
Impressum, Datenschutz