]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso15693.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
fix some iclass reader bugs (#350)
[proxmark3-svn] / armsrc / iso15693.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 // Modified by Greg Jones, Jan 2009
4 // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 15693. This includes both the reader software and
11 // the `fake tag' modes, but at the moment I've implemented only the reader
12 // stuff, and that barely.
13 // Modified to perform modulation onboard in arm rather than on PC
14 // Also added additional reader commands (SELECT, READ etc.)
15 //-----------------------------------------------------------------------------
16 // The ISO 15693 describes two transmission modes from reader to tag, and 4
17 // transmission modes from tag to reader. As of Mar 2010 this code only
18 // supports one of each: "1of4" mode from reader to tag, and the highspeed
19 // variant with one subcarrier from card to reader.
20 // As long, as the card fully support ISO 15693 this is no problem, since the
21 // reader chooses both data rates, but some non-standard tags do not. Further for
22 // the simulation to work, we will need to support all data rates.
23 //
24 // VCD (reader) -> VICC (tag)
25 // 1 out of 256:
26 // data rate: 1,66 kbit/s (fc/8192)
27 // used for long range
28 // 1 out of 4:
29 // data rate: 26,48 kbit/s (fc/512)
30 // used for short range, high speed
31 //
32 // VICC (tag) -> VCD (reader)
33 // Modulation:
34 // ASK / one subcarrier (423,75 khz)
35 // FSK / two subcarriers (423,75 khz && 484,28 khz)
36 // Data Rates / Modes:
37 // low ASK: 6,62 kbit/s
38 // low FSK: 6.67 kbit/s
39 // high ASK: 26,48 kbit/s
40 // high FSK: 26,69 kbit/s
41 //-----------------------------------------------------------------------------
42 // added "1 out of 256" mode (for VCD->PICC) - atrox 20100911
43
44
45 // Random Remarks:
46 // *) UID is always used "transmission order" (LSB), which is reverse to display order
47
48 // TODO / BUGS / ISSUES:
49 // *) writing to tags takes longer: we miss the answer from the tag in most cases
50 // -> tweak the read-timeout times
51 // *) signal decoding from the card is still a bit shaky.
52 // *) signal decoding is unable to detect collissions.
53 // *) add anti-collission support for inventory-commands
54 // *) read security status of a block
55 // *) sniffing and simulation do only support one transmission mode. need to support
56 // all 8 transmission combinations
57 // *) remove or refactor code under "depricated"
58 // *) document all the functions
59
60
61 #include "proxmark3.h"
62 #include "util.h"
63 #include "apps.h"
64 #include "string.h"
65 #include "iso15693tools.h"
66 #include "cmd.h"
67
68 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
69
70 ///////////////////////////////////////////////////////////////////////
71 // ISO 15693 Part 2 - Air Interface
72 // This section basicly contains transmission and receiving of bits
73 ///////////////////////////////////////////////////////////////////////
74
75 #define FrameSOF Iso15693FrameSOF
76 #define Logic0 Iso15693Logic0
77 #define Logic1 Iso15693Logic1
78 #define FrameEOF Iso15693FrameEOF
79
80 #define Crc(data,datalen) Iso15693Crc(data,datalen)
81 #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
82 #define sprintUID(target,uid) Iso15693sprintUID(target,uid)
83
84 int DEBUG=0;
85
86
87 // ---------------------------
88 // Signal Processing
89 // ---------------------------
90
91 // prepare data using "1 out of 4" code for later transmission
92 // resulting data rate is 26,48 kbit/s (fc/512)
93 // cmd ... data
94 // n ... length of data
95 static void CodeIso15693AsReader(uint8_t *cmd, int n)
96 {
97 int i, j;
98
99 ToSendReset();
100
101 // Give it a bit of slack at the beginning
102 for(i = 0; i < 24; i++) {
103 ToSendStuffBit(1);
104 }
105
106 // SOF for 1of4
107 ToSendStuffBit(0);
108 ToSendStuffBit(1);
109 ToSendStuffBit(1);
110 ToSendStuffBit(1);
111 ToSendStuffBit(1);
112 ToSendStuffBit(0);
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 for(i = 0; i < n; i++) {
116 for(j = 0; j < 8; j += 2) {
117 int these = (cmd[i] >> j) & 3;
118 switch(these) {
119 case 0:
120 ToSendStuffBit(1);
121 ToSendStuffBit(0);
122 ToSendStuffBit(1);
123 ToSendStuffBit(1);
124 ToSendStuffBit(1);
125 ToSendStuffBit(1);
126 ToSendStuffBit(1);
127 ToSendStuffBit(1);
128 break;
129 case 1:
130 ToSendStuffBit(1);
131 ToSendStuffBit(1);
132 ToSendStuffBit(1);
133 ToSendStuffBit(0);
134 ToSendStuffBit(1);
135 ToSendStuffBit(1);
136 ToSendStuffBit(1);
137 ToSendStuffBit(1);
138 break;
139 case 2:
140 ToSendStuffBit(1);
141 ToSendStuffBit(1);
142 ToSendStuffBit(1);
143 ToSendStuffBit(1);
144 ToSendStuffBit(1);
145 ToSendStuffBit(0);
146 ToSendStuffBit(1);
147 ToSendStuffBit(1);
148 break;
149 case 3:
150 ToSendStuffBit(1);
151 ToSendStuffBit(1);
152 ToSendStuffBit(1);
153 ToSendStuffBit(1);
154 ToSendStuffBit(1);
155 ToSendStuffBit(1);
156 ToSendStuffBit(1);
157 ToSendStuffBit(0);
158 break;
159 }
160 }
161 }
162 // EOF
163 ToSendStuffBit(1);
164 ToSendStuffBit(1);
165 ToSendStuffBit(0);
166 ToSendStuffBit(1);
167
168 // And slack at the end, too.
169 for(i = 0; i < 24; i++) {
170 ToSendStuffBit(1);
171 }
172 }
173
174 // encode data using "1 out of 256" sheme
175 // data rate is 1,66 kbit/s (fc/8192)
176 // is designed for more robust communication over longer distances
177 static void CodeIso15693AsReader256(uint8_t *cmd, int n)
178 {
179 int i, j;
180
181 ToSendReset();
182
183 // Give it a bit of slack at the beginning
184 for(i = 0; i < 24; i++) {
185 ToSendStuffBit(1);
186 }
187
188 // SOF for 1of256
189 ToSendStuffBit(0);
190 ToSendStuffBit(1);
191 ToSendStuffBit(1);
192 ToSendStuffBit(1);
193 ToSendStuffBit(1);
194 ToSendStuffBit(1);
195 ToSendStuffBit(1);
196 ToSendStuffBit(0);
197
198 for(i = 0; i < n; i++) {
199 for (j = 0; j<=255; j++) {
200 if (cmd[i]==j) {
201 ToSendStuffBit(1);
202 ToSendStuffBit(0);
203 } else {
204 ToSendStuffBit(1);
205 ToSendStuffBit(1);
206 }
207 }
208 }
209 // EOF
210 ToSendStuffBit(1);
211 ToSendStuffBit(1);
212 ToSendStuffBit(0);
213 ToSendStuffBit(1);
214
215 // And slack at the end, too.
216 for(i = 0; i < 24; i++) {
217 ToSendStuffBit(1);
218 }
219 }
220
221
222 // Transmit the command (to the tag) that was placed in ToSend[].
223 static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
224 {
225 int c;
226
227 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
228 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
229 if(*wait < 10) { *wait = 10; }
230
231 // for(c = 0; c < *wait;) {
232 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
233 // AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
234 // c++;
235 // }
236 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
237 // volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
238 // (void)r;
239 // }
240 // WDT_HIT();
241 // }
242
243 c = 0;
244 for(;;) {
245 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
246 AT91C_BASE_SSC->SSC_THR = cmd[c];
247 c++;
248 if(c >= len) {
249 break;
250 }
251 }
252 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
253 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
254 (void)r;
255 }
256 WDT_HIT();
257 }
258 *samples = (c + *wait) << 3;
259 }
260
261 //-----------------------------------------------------------------------------
262 // Transmit the command (to the reader) that was placed in ToSend[].
263 //-----------------------------------------------------------------------------
264 static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
265 {
266 int c = 0;
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
268 if(*wait < 10) { *wait = 10; }
269
270 for(;;) {
271 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
272 AT91C_BASE_SSC->SSC_THR = cmd[c];
273 c++;
274 if(c >= len) {
275 break;
276 }
277 }
278 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
279 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
280 (void)r;
281 }
282 WDT_HIT();
283 }
284 *samples = (c + *wait) << 3;
285 }
286
287
288 // Read from Tag
289 // Parameters:
290 // receivedResponse
291 // maxLen
292 // samples
293 // elapsed
294 // returns:
295 // number of decoded bytes
296 static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
297 {
298 int c = 0;
299 uint8_t *dest = BigBuf_get_addr();
300 int getNext = 0;
301
302 int8_t prev = 0;
303
304 // NOW READ RESPONSE
305 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
306 //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
307 c = 0;
308 getNext = FALSE;
309 for(;;) {
310 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
311 AT91C_BASE_SSC->SSC_THR = 0x43;
312 }
313 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
314 int8_t b;
315 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
316
317 // The samples are correlations against I and Q versions of the
318 // tone that the tag AM-modulates, so every other sample is I,
319 // every other is Q. We just want power, so abs(I) + abs(Q) is
320 // close to what we want.
321 if(getNext) {
322 uint8_t r = ABS(b) + ABS(prev);
323
324 dest[c++] = (uint8_t)r;
325
326 if(c >= 2000) {
327 break;
328 }
329 } else {
330 prev = b;
331 }
332
333 getNext = !getNext;
334 }
335 }
336
337 //////////////////////////////////////////
338 /////////// DEMODULATE ///////////////////
339 //////////////////////////////////////////
340
341 int i, j;
342 int max = 0, maxPos=0;
343
344 int skip = 4;
345
346 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
347
348 // First, correlate for SOF
349 for(i = 0; i < 100; i++) {
350 int corr = 0;
351 for(j = 0; j < arraylen(FrameSOF); j += skip) {
352 corr += FrameSOF[j]*dest[i+(j/skip)];
353 }
354 if(corr > max) {
355 max = corr;
356 maxPos = i;
357 }
358 }
359 // Dbprintf("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
360
361 int k = 0; // this will be our return value
362
363 // greg - If correlation is less than 1 then there's little point in continuing
364 if ((max/(arraylen(FrameSOF)/skip)) >= 1)
365 {
366
367 i = maxPos + arraylen(FrameSOF)/skip;
368
369 uint8_t outBuf[20];
370 memset(outBuf, 0, sizeof(outBuf));
371 uint8_t mask = 0x01;
372 for(;;) {
373 int corr0 = 0, corr1 = 0, corrEOF = 0;
374 for(j = 0; j < arraylen(Logic0); j += skip) {
375 corr0 += Logic0[j]*dest[i+(j/skip)];
376 }
377 for(j = 0; j < arraylen(Logic1); j += skip) {
378 corr1 += Logic1[j]*dest[i+(j/skip)];
379 }
380 for(j = 0; j < arraylen(FrameEOF); j += skip) {
381 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
382 }
383 // Even things out by the length of the target waveform.
384 corr0 *= 4;
385 corr1 *= 4;
386
387 if(corrEOF > corr1 && corrEOF > corr0) {
388 // Dbprintf("EOF at %d", i);
389 break;
390 } else if(corr1 > corr0) {
391 i += arraylen(Logic1)/skip;
392 outBuf[k] |= mask;
393 } else {
394 i += arraylen(Logic0)/skip;
395 }
396 mask <<= 1;
397 if(mask == 0) {
398 k++;
399 mask = 0x01;
400 }
401 if((i+(int)arraylen(FrameEOF)) >= 2000) {
402 DbpString("ran off end!");
403 break;
404 }
405 }
406 if(mask != 0x01) { // this happens, when we miss the EOF
407 // TODO: for some reason this happens quite often
408 if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
409 if (mask<0x08) k--; // discard the last uneven octet;
410 // 0x08 is an assumption - but works quite often
411 }
412 // uint8_t str1 [8];
413 // itoa(k,str1);
414 // strncat(str1," octets read",8);
415
416 // DbpString( str1); // DbpString("%d octets", k);
417
418 // for(i = 0; i < k; i+=3) {
419 // //DbpString("# %2d: %02x ", i, outBuf[i]);
420 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
421 // }
422
423 for(i = 0; i < k; i++) {
424 receivedResponse[i] = outBuf[i];
425 }
426 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
427 return k; // return the number of bytes demodulated
428
429 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
430
431 }
432
433
434 // Now the GetISO15693 message from sniffing command
435 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
436 {
437 int c = 0;
438 uint8_t *dest = BigBuf_get_addr();
439 int getNext = 0;
440
441 int8_t prev = 0;
442
443 // NOW READ RESPONSE
444 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
445 //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
446 c = 0;
447 getNext = FALSE;
448 for(;;) {
449 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
450 AT91C_BASE_SSC->SSC_THR = 0x43;
451 }
452 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
453 int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
454
455 // The samples are correlations against I and Q versions of the
456 // tone that the tag AM-modulates, so every other sample is I,
457 // every other is Q. We just want power, so abs(I) + abs(Q) is
458 // close to what we want.
459 if(getNext) {
460 uint8_t r = ABS(b) + ABS(prev);
461
462 dest[c++] = (uint8_t)r;
463
464 if(c >= 20000) {
465 break;
466 }
467 } else {
468 prev = b;
469 }
470
471 getNext = !getNext;
472 }
473 }
474
475 //////////////////////////////////////////
476 /////////// DEMODULATE ///////////////////
477 //////////////////////////////////////////
478
479 int i, j;
480 int max = 0, maxPos=0;
481
482 int skip = 4;
483
484 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
485
486 // First, correlate for SOF
487 for(i = 0; i < 19000; i++) {
488 int corr = 0;
489 for(j = 0; j < arraylen(FrameSOF); j += skip) {
490 corr += FrameSOF[j]*dest[i+(j/skip)];
491 }
492 if(corr > max) {
493 max = corr;
494 maxPos = i;
495 }
496 }
497 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
498
499 int k = 0; // this will be our return value
500
501 // greg - If correlation is less than 1 then there's little point in continuing
502 if ((max/(arraylen(FrameSOF)/skip)) >= 1) // THIS SHOULD BE 1
503 {
504
505 i = maxPos + arraylen(FrameSOF)/skip;
506
507 uint8_t outBuf[20];
508 memset(outBuf, 0, sizeof(outBuf));
509 uint8_t mask = 0x01;
510 for(;;) {
511 int corr0 = 0, corr1 = 0, corrEOF = 0;
512 for(j = 0; j < arraylen(Logic0); j += skip) {
513 corr0 += Logic0[j]*dest[i+(j/skip)];
514 }
515 for(j = 0; j < arraylen(Logic1); j += skip) {
516 corr1 += Logic1[j]*dest[i+(j/skip)];
517 }
518 for(j = 0; j < arraylen(FrameEOF); j += skip) {
519 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
520 }
521 // Even things out by the length of the target waveform.
522 corr0 *= 4;
523 corr1 *= 4;
524
525 if(corrEOF > corr1 && corrEOF > corr0) {
526 // DbpString("EOF at %d", i);
527 break;
528 } else if(corr1 > corr0) {
529 i += arraylen(Logic1)/skip;
530 outBuf[k] |= mask;
531 } else {
532 i += arraylen(Logic0)/skip;
533 }
534 mask <<= 1;
535 if(mask == 0) {
536 k++;
537 mask = 0x01;
538 }
539 if((i+(int)arraylen(FrameEOF)) >= 2000) {
540 DbpString("ran off end!");
541 break;
542 }
543 }
544 if(mask != 0x01) {
545 DbpString("sniff: error, uneven octet! (discard extra bits!)");
546 /// DbpString(" mask=%02x", mask);
547 }
548 // uint8_t str1 [8];
549 // itoa(k,str1);
550 // strncat(str1," octets read",8);
551
552 // DbpString( str1); // DbpString("%d octets", k);
553
554 // for(i = 0; i < k; i+=3) {
555 // //DbpString("# %2d: %02x ", i, outBuf[i]);
556 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
557 // }
558
559 for(i = 0; i < k; i++) {
560 receivedResponse[i] = outBuf[i];
561 }
562 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
563 return k; // return the number of bytes demodulated
564
565 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
566 }
567
568
569 static void BuildIdentifyRequest(void);
570 //-----------------------------------------------------------------------------
571 // Start to read an ISO 15693 tag. We send an identify request, then wait
572 // for the response. The response is not demodulated, just left in the buffer
573 // so that it can be downloaded to a PC and processed there.
574 //-----------------------------------------------------------------------------
575 void AcquireRawAdcSamplesIso15693(void)
576 {
577 uint8_t *dest = BigBuf_get_addr();
578
579 int c = 0;
580 int getNext = 0;
581 int8_t prev = 0;
582
583 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
584 BuildIdentifyRequest();
585
586 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
587
588 // Give the tags time to energize
589 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
590 SpinDelay(100);
591
592 // Now send the command
593 FpgaSetupSsc();
594 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
595
596 c = 0;
597 for(;;) {
598 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
599 AT91C_BASE_SSC->SSC_THR = ToSend[c];
600 c++;
601 if(c == ToSendMax+3) {
602 break;
603 }
604 }
605 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
606 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
607 (void)r;
608 }
609 WDT_HIT();
610 }
611
612 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
613
614 c = 0;
615 getNext = FALSE;
616 for(;;) {
617 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
618 AT91C_BASE_SSC->SSC_THR = 0x43;
619 }
620 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
621 int8_t b;
622 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
623
624 // The samples are correlations against I and Q versions of the
625 // tone that the tag AM-modulates, so every other sample is I,
626 // every other is Q. We just want power, so abs(I) + abs(Q) is
627 // close to what we want.
628 if(getNext) {
629 uint8_t r = ABS(b) + ABS(prev);
630
631 dest[c++] = (uint8_t)r;
632
633 if(c >= 2000) {
634 break;
635 }
636 } else {
637 prev = b;
638 }
639
640 getNext = !getNext;
641 }
642 }
643 }
644
645
646 void RecordRawAdcSamplesIso15693(void)
647 {
648 uint8_t *dest = BigBuf_get_addr();
649
650 int c = 0;
651 int getNext = 0;
652 int8_t prev = 0;
653
654 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
655 // Setup SSC
656 FpgaSetupSsc();
657
658 // Start from off (no field generated)
659 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
660 SpinDelay(200);
661
662 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
663
664 SpinDelay(100);
665
666 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
667
668 c = 0;
669 getNext = FALSE;
670 for(;;) {
671 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
672 AT91C_BASE_SSC->SSC_THR = 0x43;
673 }
674 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
675 int8_t b;
676 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
677
678 // The samples are correlations against I and Q versions of the
679 // tone that the tag AM-modulates, so every other sample is I,
680 // every other is Q. We just want power, so abs(I) + abs(Q) is
681 // close to what we want.
682 if(getNext) {
683 uint8_t r = ABS(b) + ABS(prev);
684
685 dest[c++] = (uint8_t)r;
686
687 if(c >= 7000) {
688 break;
689 }
690 } else {
691 prev = b;
692 }
693
694 getNext = !getNext;
695 WDT_HIT();
696 }
697 }
698 Dbprintf("fin record");
699 }
700
701
702 // Initialize the proxmark as iso15k reader
703 // (this might produces glitches that confuse some tags
704 void Iso15693InitReader() {
705 LED_A_ON();
706 LED_B_ON();
707 LED_C_OFF();
708 LED_D_OFF();
709
710 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
711 // Setup SSC
712 // FpgaSetupSsc();
713
714 // Start from off (no field generated)
715 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
716 SpinDelay(10);
717
718 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
719 FpgaSetupSsc();
720
721 // Give the tags time to energize
722 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
723 SpinDelay(250);
724
725 LED_A_ON();
726 LED_B_OFF();
727 LED_C_OFF();
728 LED_D_OFF();
729 }
730
731 ///////////////////////////////////////////////////////////////////////
732 // ISO 15693 Part 3 - Air Interface
733 // This section basicly contains transmission and receiving of bits
734 ///////////////////////////////////////////////////////////////////////
735
736 // Encode (into the ToSend buffers) an identify request, which is the first
737 // thing that you must send to a tag to get a response.
738 static void BuildIdentifyRequest(void)
739 {
740 uint8_t cmd[5];
741
742 uint16_t crc;
743 // one sub-carrier, inventory, 1 slot, fast rate
744 // AFI is at bit 5 (1<<4) when doing an INVENTORY
745 cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
746 // inventory command code
747 cmd[1] = 0x01;
748 // no mask
749 cmd[2] = 0x00;
750 //Now the CRC
751 crc = Crc(cmd, 3);
752 cmd[3] = crc & 0xff;
753 cmd[4] = crc >> 8;
754
755 CodeIso15693AsReader(cmd, sizeof(cmd));
756 }
757
758 // uid is in transmission order (which is reverse of display order)
759 static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
760 {
761 uint8_t cmd[13];
762
763 uint16_t crc;
764 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
765 // followed by teh block data
766 // one sub-carrier, inventory, 1 slot, fast rate
767 cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit, ADDR bit, OPTION bit
768 // READ BLOCK command code
769 cmd[1] = 0x20;
770 // UID may be optionally specified here
771 // 64-bit UID
772 cmd[2] = uid[0];
773 cmd[3] = uid[1];
774 cmd[4] = uid[2];
775 cmd[5] = uid[3];
776 cmd[6] = uid[4];
777 cmd[7] = uid[5];
778 cmd[8] = uid[6];
779 cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique)
780 // Block number to read
781 cmd[10] = blockNumber;//0x00;
782 //Now the CRC
783 crc = Crc(cmd, 11); // the crc needs to be calculated over 12 bytes
784 cmd[11] = crc & 0xff;
785 cmd[12] = crc >> 8;
786
787 CodeIso15693AsReader(cmd, sizeof(cmd));
788 }
789
790 // Now the VICC>VCD responses when we are simulating a tag
791 static void BuildInventoryResponse( uint8_t *uid)
792 {
793 uint8_t cmd[12];
794
795 uint16_t crc;
796 // one sub-carrier, inventory, 1 slot, fast rate
797 // AFI is at bit 5 (1<<4) when doing an INVENTORY
798 //(1 << 2) | (1 << 5) | (1 << 1);
799 cmd[0] = 0; //
800 cmd[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported
801 // 64-bit UID
802 cmd[2] = uid[7]; //0x32;
803 cmd[3] = uid[6]; //0x4b;
804 cmd[4] = uid[5]; //0x03;
805 cmd[5] = uid[4]; //0x01;
806 cmd[6] = uid[3]; //0x00;
807 cmd[7] = uid[2]; //0x10;
808 cmd[8] = uid[1]; //0x05;
809 cmd[9] = uid[0]; //0xe0;
810 //Now the CRC
811 crc = Crc(cmd, 10);
812 cmd[10] = crc & 0xff;
813 cmd[11] = crc >> 8;
814
815 CodeIso15693AsReader(cmd, sizeof(cmd));
816 }
817
818 // Universal Method for sending to and recv bytes from a tag
819 // init ... should we initialize the reader?
820 // speed ... 0 low speed, 1 hi speed
821 // **recv will return you a pointer to the received data
822 // If you do not need the answer use NULL for *recv[]
823 // return: lenght of received data
824 int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) {
825
826 int samples = 0;
827 int tsamples = 0;
828 int wait = 0;
829 int elapsed = 0;
830
831 LED_A_ON();
832 LED_B_ON();
833 LED_C_OFF();
834 LED_D_OFF();
835
836 if (init) Iso15693InitReader();
837
838 int answerLen=0;
839 uint8_t *answer = BigBuf_get_addr() + 3660;
840 if (recv != NULL) memset(answer, 0, 100);
841
842 if (!speed) {
843 // low speed (1 out of 256)
844 CodeIso15693AsReader256(send, sendlen);
845 } else {
846 // high speed (1 out of 4)
847 CodeIso15693AsReader(send, sendlen);
848 }
849
850 LED_A_ON();
851 LED_B_OFF();
852
853 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
854 // Now wait for a response
855 if (recv!=NULL) {
856 LED_A_OFF();
857 LED_B_ON();
858 answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ;
859 *recv=answer;
860 }
861
862 LED_A_OFF();
863 LED_B_OFF();
864 LED_C_OFF();
865 LED_D_OFF();
866
867 return answerLen;
868 }
869
870
871 // --------------------------------------------------------------------
872 // Debug Functions
873 // --------------------------------------------------------------------
874
875 // Decodes a message from a tag and displays its metadata and content
876 #define DBD15STATLEN 48
877 void DbdecodeIso15693Answer(int len, uint8_t *d) {
878 char status[DBD15STATLEN+1]={0};
879 uint16_t crc;
880
881 if (len>3) {
882 if (d[0]&(1<<3))
883 strncat(status,"ProtExt ",DBD15STATLEN);
884 if (d[0]&1) {
885 // error
886 strncat(status,"Error ",DBD15STATLEN);
887 switch (d[1]) {
888 case 0x01:
889 strncat(status,"01:notSupp",DBD15STATLEN);
890 break;
891 case 0x02:
892 strncat(status,"02:notRecog",DBD15STATLEN);
893 break;
894 case 0x03:
895 strncat(status,"03:optNotSupp",DBD15STATLEN);
896 break;
897 case 0x0f:
898 strncat(status,"0f:noInfo",DBD15STATLEN);
899 break;
900 case 0x10:
901 strncat(status,"10:dontExist",DBD15STATLEN);
902 break;
903 case 0x11:
904 strncat(status,"11:lockAgain",DBD15STATLEN);
905 break;
906 case 0x12:
907 strncat(status,"12:locked",DBD15STATLEN);
908 break;
909 case 0x13:
910 strncat(status,"13:progErr",DBD15STATLEN);
911 break;
912 case 0x14:
913 strncat(status,"14:lockErr",DBD15STATLEN);
914 break;
915 default:
916 strncat(status,"unknownErr",DBD15STATLEN);
917 }
918 strncat(status," ",DBD15STATLEN);
919 } else {
920 strncat(status,"NoErr ",DBD15STATLEN);
921 }
922
923 crc=Crc(d,len-2);
924 if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) )
925 strncat(status,"CrcOK",DBD15STATLEN);
926 else
927 strncat(status,"CrcFail!",DBD15STATLEN);
928
929 Dbprintf("%s",status);
930 }
931 }
932
933
934
935 ///////////////////////////////////////////////////////////////////////
936 // Functions called via USB/Client
937 ///////////////////////////////////////////////////////////////////////
938
939 void SetDebugIso15693(uint32_t debug) {
940 DEBUG=debug;
941 Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off");
942 return;
943 }
944
945
946
947 //-----------------------------------------------------------------------------
948 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
949 // all demodulation performed in arm rather than host. - greg
950 //-----------------------------------------------------------------------------
951 void ReaderIso15693(uint32_t parameter)
952 {
953 LED_A_ON();
954 LED_B_ON();
955 LED_C_OFF();
956 LED_D_OFF();
957
958 int answerLen1 = 0;
959 int answerLen2 = 0;
960 int answerLen3 = 0;
961 int i = 0;
962 int samples = 0;
963 int tsamples = 0;
964 int wait = 0;
965 int elapsed = 0;
966 uint8_t TagUID[8] = {0x00};
967
968 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
969
970 uint8_t *answer1 = BigBuf_get_addr() + 3660;
971 uint8_t *answer2 = BigBuf_get_addr() + 3760;
972 uint8_t *answer3 = BigBuf_get_addr() + 3860;
973 // Blank arrays
974 memset(answer1, 0x00, 300);
975
976 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
977 // Setup SSC
978 FpgaSetupSsc();
979
980 // Start from off (no field generated)
981 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
982 SpinDelay(200);
983
984 // Give the tags time to energize
985 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
986 SpinDelay(200);
987
988 LED_A_ON();
989 LED_B_OFF();
990 LED_C_OFF();
991 LED_D_OFF();
992
993 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
994 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
995
996 // Now send the IDENTIFY command
997 BuildIdentifyRequest();
998
999 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
1000
1001 // Now wait for a response
1002 answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
1003
1004 if (answerLen1 >=12) // we should do a better check than this
1005 {
1006 TagUID[0] = answer1[2];
1007 TagUID[1] = answer1[3];
1008 TagUID[2] = answer1[4];
1009 TagUID[3] = answer1[5];
1010 TagUID[4] = answer1[6];
1011 TagUID[5] = answer1[7];
1012 TagUID[6] = answer1[8]; // IC Manufacturer code
1013 TagUID[7] = answer1[9]; // always E0
1014
1015 }
1016
1017 Dbprintf("%d octets read from IDENTIFY request:", answerLen1);
1018 DbdecodeIso15693Answer(answerLen1,answer1);
1019 Dbhexdump(answerLen1,answer1,true);
1020
1021 // UID is reverse
1022 if (answerLen1>=12)
1023 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1024 TagUID[7],TagUID[6],TagUID[5],TagUID[4],
1025 TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
1026
1027
1028 Dbprintf("%d octets read from SELECT request:", answerLen2);
1029 DbdecodeIso15693Answer(answerLen2,answer2);
1030 Dbhexdump(answerLen2,answer2,true);
1031
1032 Dbprintf("%d octets read from XXX request:", answerLen3);
1033 DbdecodeIso15693Answer(answerLen3,answer3);
1034 Dbhexdump(answerLen3,answer3,true);
1035
1036 // read all pages
1037 if (answerLen1>=12 && DEBUG) {
1038 i=0;
1039 while (i<32) { // sanity check, assume max 32 pages
1040 BuildReadBlockRequest(TagUID,i);
1041 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
1042 answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
1043 if (answerLen2>0) {
1044 Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
1045 DbdecodeIso15693Answer(answerLen2,answer2);
1046 Dbhexdump(answerLen2,answer2,true);
1047 if ( *((uint32_t*) answer2) == 0x07160101 ) break; // exit on NoPageErr
1048 }
1049 i++;
1050 }
1051 }
1052
1053 LED_A_OFF();
1054 LED_B_OFF();
1055 LED_C_OFF();
1056 LED_D_OFF();
1057 }
1058
1059 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1060 // all demodulation performed in arm rather than host. - greg
1061 void SimTagIso15693(uint32_t parameter, uint8_t *uid)
1062 {
1063 LED_A_ON();
1064 LED_B_ON();
1065 LED_C_OFF();
1066 LED_D_OFF();
1067
1068 int answerLen1 = 0;
1069 int samples = 0;
1070 int tsamples = 0;
1071 int wait = 0;
1072 int elapsed = 0;
1073
1074 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1075
1076 uint8_t *buf = BigBuf_get_addr() + 3660;
1077 memset(buf, 0x00, 100);
1078
1079 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1080 FpgaSetupSsc();
1081
1082 // Start from off (no field generated)
1083 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1084 SpinDelay(200);
1085
1086 LED_A_OFF();
1087 LED_B_OFF();
1088 LED_C_ON();
1089 LED_D_OFF();
1090
1091 // Listen to reader
1092 answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
1093
1094 if (answerLen1 >=1) // we should do a better check than this
1095 {
1096 // Build a suitable reponse to the reader INVENTORY cocmmand
1097 // not so obsvious, but in the call to BuildInventoryResponse, the command is copied to the global ToSend buffer used below.
1098
1099 BuildInventoryResponse(uid);
1100
1101 TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
1102 }
1103
1104 Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
1105 buf[0], buf[1], buf[2], buf[3],
1106 buf[4], buf[5], buf[6], buf[7], buf[8]);
1107
1108 Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x",
1109 uid[0], uid[1], uid[2], uid[3],
1110 uid[4], uid[5], uid[6], uid[7]);
1111
1112 LED_A_OFF();
1113 LED_B_OFF();
1114 LED_C_OFF();
1115 LED_D_OFF();
1116 }
1117
1118
1119 // Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1120 // (some manufactures offer a way to read the AFI, though)
1121 void BruteforceIso15693Afi(uint32_t speed)
1122 {
1123 uint8_t data[20];
1124 uint8_t *recv=data;
1125 int datalen=0, recvlen=0;
1126
1127 Iso15693InitReader();
1128
1129 // first without AFI
1130 // Tags should respond wihtout AFI and with AFI=0 even when AFI is active
1131
1132 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1133 ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
1134 data[1]=ISO15_CMD_INVENTORY;
1135 data[2]=0; // mask length
1136 datalen=AddCrc(data,3);
1137 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1138 WDT_HIT();
1139 if (recvlen>=12) {
1140 Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
1141 }
1142
1143 // now with AFI
1144
1145 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1146 ISO15_REQ_INVENTORY | ISO15_REQINV_AFI | ISO15_REQINV_SLOT1;
1147 data[1]=ISO15_CMD_INVENTORY;
1148 data[2]=0; // AFI
1149 data[3]=0; // mask length
1150
1151 for (int i=0;i<256;i++) {
1152 data[2]=i & 0xFF;
1153 datalen=AddCrc(data,4);
1154 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1155 WDT_HIT();
1156 if (recvlen>=12) {
1157 Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
1158 }
1159 }
1160 Dbprintf("AFI Bruteforcing done.");
1161
1162 }
1163
1164 // Allows to directly send commands to the tag via the client
1165 void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
1166
1167 int recvlen=0;
1168 uint8_t *recvbuf = BigBuf_get_addr();
1169 // UsbCommand n;
1170
1171 if (DEBUG) {
1172 Dbprintf("SEND");
1173 Dbhexdump(datalen,data,true);
1174 }
1175
1176 recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
1177
1178 if (recv) {
1179 LED_B_ON();
1180 cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
1181 LED_B_OFF();
1182
1183 if (DEBUG) {
1184 Dbprintf("RECV");
1185 DbdecodeIso15693Answer(recvlen,recvbuf);
1186 Dbhexdump(recvlen,recvbuf,true);
1187 }
1188 }
1189
1190 }
1191
1192
1193
1194
1195 // --------------------------------------------------------------------
1196 // -- Misc & deprecated functions
1197 // --------------------------------------------------------------------
1198
1199 /*
1200
1201 // do not use; has a fix UID
1202 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1203 {
1204 uint8_t cmd[12];
1205
1206 uint16_t crc;
1207 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1208 // followed by teh block data
1209 // one sub-carrier, inventory, 1 slot, fast rate
1210 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1211 // System Information command code
1212 cmd[1] = 0x2B;
1213 // UID may be optionally specified here
1214 // 64-bit UID
1215 cmd[2] = 0x32;
1216 cmd[3]= 0x4b;
1217 cmd[4] = 0x03;
1218 cmd[5] = 0x01;
1219 cmd[6] = 0x00;
1220 cmd[7] = 0x10;
1221 cmd[8] = 0x05;
1222 cmd[9]= 0xe0; // always e0 (not exactly unique)
1223 //Now the CRC
1224 crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1225 cmd[10] = crc & 0xff;
1226 cmd[11] = crc >> 8;
1227
1228 CodeIso15693AsReader(cmd, sizeof(cmd));
1229 }
1230
1231
1232 // do not use; has a fix UID
1233 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1234 {
1235 uint8_t cmd[14];
1236
1237 uint16_t crc;
1238 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1239 // followed by teh block data
1240 // one sub-carrier, inventory, 1 slot, fast rate
1241 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1242 // READ Multi BLOCK command code
1243 cmd[1] = 0x23;
1244 // UID may be optionally specified here
1245 // 64-bit UID
1246 cmd[2] = 0x32;
1247 cmd[3]= 0x4b;
1248 cmd[4] = 0x03;
1249 cmd[5] = 0x01;
1250 cmd[6] = 0x00;
1251 cmd[7] = 0x10;
1252 cmd[8] = 0x05;
1253 cmd[9]= 0xe0; // always e0 (not exactly unique)
1254 // First Block number to read
1255 cmd[10] = 0x00;
1256 // Number of Blocks to read
1257 cmd[11] = 0x2f; // read quite a few
1258 //Now the CRC
1259 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1260 cmd[12] = crc & 0xff;
1261 cmd[13] = crc >> 8;
1262
1263 CodeIso15693AsReader(cmd, sizeof(cmd));
1264 }
1265
1266 // do not use; has a fix UID
1267 static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1268 {
1269 uint8_t cmd[14];
1270
1271 uint16_t crc;
1272 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1273 // followed by teh block data
1274 // one sub-carrier, inventory, 1 slot, fast rate
1275 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1276 // READ BLOCK command code
1277 cmd[1] = CmdCode;
1278 // UID may be optionally specified here
1279 // 64-bit UID
1280 cmd[2] = 0x32;
1281 cmd[3]= 0x4b;
1282 cmd[4] = 0x03;
1283 cmd[5] = 0x01;
1284 cmd[6] = 0x00;
1285 cmd[7] = 0x10;
1286 cmd[8] = 0x05;
1287 cmd[9]= 0xe0; // always e0 (not exactly unique)
1288 // Parameter
1289 cmd[10] = 0x00;
1290 cmd[11] = 0x0a;
1291
1292 // cmd[12] = 0x00;
1293 // cmd[13] = 0x00; //Now the CRC
1294 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1295 cmd[12] = crc & 0xff;
1296 cmd[13] = crc >> 8;
1297
1298 CodeIso15693AsReader(cmd, sizeof(cmd));
1299 }
1300
1301 // do not use; has a fix UID
1302 static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1303 {
1304 uint8_t cmd[14];
1305
1306 uint16_t crc;
1307 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1308 // followed by teh block data
1309 // one sub-carrier, inventory, 1 slot, fast rate
1310 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1311 // READ BLOCK command code
1312 cmd[1] = CmdCode;
1313 // UID may be optionally specified here
1314 // 64-bit UID
1315 cmd[2] = 0x32;
1316 cmd[3]= 0x4b;
1317 cmd[4] = 0x03;
1318 cmd[5] = 0x01;
1319 cmd[6] = 0x00;
1320 cmd[7] = 0x10;
1321 cmd[8] = 0x05;
1322 cmd[9]= 0xe0; // always e0 (not exactly unique)
1323 // Parameter
1324 cmd[10] = 0x05; // for custom codes this must be manufcturer code
1325 cmd[11] = 0x00;
1326
1327 // cmd[12] = 0x00;
1328 // cmd[13] = 0x00; //Now the CRC
1329 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1330 cmd[12] = crc & 0xff;
1331 cmd[13] = crc >> 8;
1332
1333 CodeIso15693AsReader(cmd, sizeof(cmd));
1334 }
1335
1336
1337
1338
1339 */
1340
1341
Proxmark3 GIT tracking
Impressum, Datenschutz