]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443a.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: @pwpivi 's latest fixes for bigbuff
[proxmark3-svn] / armsrc / iso14443a.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "proxmark3.h"
14 #include "apps.h"
15 #include "util.h"
16 #include "string.h"
17 #include "cmd.h"
18 #include "iso14443crc.h"
19 #include "iso14443a.h"
20 #include "crapto1.h"
21 #include "mifareutil.h"
22 #include "BigBuf.h"
23 static uint32_t iso14a_timeout;
24 int rsamples = 0;
25 uint8_t trigger = 0;
26 // the block number for the ISO14443-4 PCB
27 static uint8_t iso14_pcb_blocknum = 0;
28
29 //
30 // ISO14443 timing:
31 //
32 // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
33 #define REQUEST_GUARD_TIME (7000/16 + 1)
34 // minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
35 #define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
36 // bool LastCommandWasRequest = FALSE;
37
38 //
39 // Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
40 //
41 // When the PM acts as reader and is receiving tag data, it takes
42 // 3 ticks delay in the AD converter
43 // 16 ticks until the modulation detector completes and sets curbit
44 // 8 ticks until bit_to_arm is assigned from curbit
45 // 8*16 ticks for the transfer from FPGA to ARM
46 // 4*16 ticks until we measure the time
47 // - 8*16 ticks because we measure the time of the previous transfer
48 #define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
49
50 // When the PM acts as a reader and is sending, it takes
51 // 4*16 ticks until we can write data to the sending hold register
52 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
53 // 8 ticks until the first transfer starts
54 // 8 ticks later the FPGA samples the data
55 // 1 tick to assign mod_sig_coil
56 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
57
58 // When the PM acts as tag and is receiving it takes
59 // 2 ticks delay in the RF part (for the first falling edge),
60 // 3 ticks for the A/D conversion,
61 // 8 ticks on average until the start of the SSC transfer,
62 // 8 ticks until the SSC samples the first data
63 // 7*16 ticks to complete the transfer from FPGA to ARM
64 // 8 ticks until the next ssp_clk rising edge
65 // 4*16 ticks until we measure the time
66 // - 8*16 ticks because we measure the time of the previous transfer
67 #define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
68
69 // The FPGA will report its internal sending delay in
70 uint16_t FpgaSendQueueDelay;
71 // the 5 first bits are the number of bits buffered in mod_sig_buf
72 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
73 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
74
75 // When the PM acts as tag and is sending, it takes
76 // 4*16 ticks until we can write data to the sending hold register
77 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
78 // 8 ticks until the first transfer starts
79 // 8 ticks later the FPGA samples the data
80 // + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
81 // + 1 tick to assign mod_sig_coil
82 #define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
83
84 // When the PM acts as sniffer and is receiving tag data, it takes
85 // 3 ticks A/D conversion
86 // 14 ticks to complete the modulation detection
87 // 8 ticks (on average) until the result is stored in to_arm
88 // + the delays in transferring data - which is the same for
89 // sniffing reader and tag data and therefore not relevant
90 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
91
92 // When the PM acts as sniffer and is receiving reader data, it takes
93 // 2 ticks delay in analogue RF receiver (for the falling edge of the
94 // start bit, which marks the start of the communication)
95 // 3 ticks A/D conversion
96 // 8 ticks on average until the data is stored in to_arm.
97 // + the delays in transferring data - which is the same for
98 // sniffing reader and tag data and therefore not relevant
99 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
100
101 //variables used for timing purposes:
102 //these are in ssp_clk cycles:
103 static uint32_t NextTransferTime;
104 static uint32_t LastTimeProxToAirStart;
105 static uint32_t LastProxToAirDuration;
106
107
108
109 // CARD TO READER - manchester
110 // Sequence D: 11110000 modulation with subcarrier during first half
111 // Sequence E: 00001111 modulation with subcarrier during second half
112 // Sequence F: 00000000 no modulation with subcarrier
113 // READER TO CARD - miller
114 // Sequence X: 00001100 drop after half a period
115 // Sequence Y: 00000000 no drop
116 // Sequence Z: 11000000 drop at start
117 #define SEC_D 0xf0
118 #define SEC_E 0x0f
119 #define SEC_F 0x00
120 #define SEC_X 0x0c
121 #define SEC_Y 0x00
122 #define SEC_Z 0xc0
123
124 const uint8_t OddByteParity[256] = {
125 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
126 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
127 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
141 };
142
143
144 void iso14a_set_trigger(bool enable) {
145 trigger = enable;
146 }
147
148
149 void iso14a_set_timeout(uint32_t timeout) {
150 iso14a_timeout = timeout;
151 if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);
152 }
153
154
155 void iso14a_set_ATS_timeout(uint8_t *ats) {
156
157 uint8_t tb1;
158 uint8_t fwi;
159 uint32_t fwt;
160
161 if (ats[0] > 1) { // there is a format byte T0
162 if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
163 if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
164 tb1 = ats[3];
165 } else {
166 tb1 = ats[2];
167 }
168 fwi = (tb1 & 0xf0) >> 4; // frame waiting indicator (FWI)
169 fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc
170
171 iso14a_set_timeout(fwt/(8*16));
172 }
173 }
174 }
175
176
177 //-----------------------------------------------------------------------------
178 // Generate the parity value for a byte sequence
179 //
180 //-----------------------------------------------------------------------------
181 byte_t oddparity (const byte_t bt)
182 {
183 return OddByteParity[bt];
184 }
185
186 void GetParity(const uint8_t *pbtCmd, uint16_t iLen, uint8_t *par)
187 {
188 uint16_t paritybit_cnt = 0;
189 uint16_t paritybyte_cnt = 0;
190 uint8_t parityBits = 0;
191
192 for (uint16_t i = 0; i < iLen; i++) {
193 // Generate the parity bits
194 parityBits |= ((OddByteParity[pbtCmd[i]]) << (7-paritybit_cnt));
195 if (paritybit_cnt == 7) {
196 par[paritybyte_cnt] = parityBits; // save 8 Bits parity
197 parityBits = 0; // and advance to next Parity Byte
198 paritybyte_cnt++;
199 paritybit_cnt = 0;
200 } else {
201 paritybit_cnt++;
202 }
203 }
204
205 // save remaining parity bits
206 par[paritybyte_cnt] = parityBits;
207
208 }
209
210 void AppendCrc14443a(uint8_t* data, int len)
211 {
212 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
213 }
214
215 void AppendCrc14443b(uint8_t* data, int len)
216 {
217 ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
218 }
219
220
221 //=============================================================================
222 // ISO 14443 Type A - Miller decoder
223 //=============================================================================
224 // Basics:
225 // This decoder is used when the PM3 acts as a tag.
226 // The reader will generate "pauses" by temporarily switching of the field.
227 // At the PM3 antenna we will therefore measure a modulated antenna voltage.
228 // The FPGA does a comparison with a threshold and would deliver e.g.:
229 // ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
230 // The Miller decoder needs to identify the following sequences:
231 // 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
232 // 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
233 // 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
234 // Note 1: the bitstream may start at any time. We therefore need to sync.
235 // Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
236 //-----------------------------------------------------------------------------
237 static tUart Uart;
238
239 // Lookup-Table to decide if 4 raw bits are a modulation.
240 // We accept the following:
241 // 0001 - a 3 tick wide pause
242 // 0011 - a 2 tick wide pause, or a three tick wide pause shifted left
243 // 0111 - a 2 tick wide pause shifted left
244 // 1001 - a 2 tick wide pause shifted right
245 const bool Mod_Miller_LUT[] = {
246 FALSE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, TRUE,
247 FALSE, TRUE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE
248 };
249 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
250 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
251
252 void UartReset()
253 {
254 Uart.state = STATE_UNSYNCD;
255 Uart.bitCount = 0;
256 Uart.len = 0; // number of decoded data bytes
257 Uart.parityLen = 0; // number of decoded parity bytes
258 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
259 Uart.parityBits = 0; // holds 8 parity bits
260 Uart.startTime = 0;
261 Uart.endTime = 0;
262
263 Uart.byteCntMax = 0;
264 Uart.posCnt = 0;
265 Uart.syncBit = 9999;
266 }
267
268 void UartInit(uint8_t *data, uint8_t *parity)
269 {
270 Uart.output = data;
271 Uart.parity = parity;
272 Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
273 UartReset();
274 }
275
276 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
277 static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
278 {
279
280 Uart.fourBits = (Uart.fourBits << 8) | bit;
281
282 if (Uart.state == STATE_UNSYNCD) { // not yet synced
283
284 Uart.syncBit = 9999; // not set
285
286 // 00x11111 2|3 ticks pause followed by 6|5 ticks unmodulated Sequence Z (a "0" or "start of communication")
287 // 11111111 8 ticks unmodulation Sequence Y (a "0" or "end of communication" or "no information")
288 // 111100x1 4 ticks unmodulated followed by 2|3 ticks pause Sequence X (a "1")
289
290 // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
291 // Sequence X followed by Sequence Y followed by Sequence Z (111100x1 11111111 00x11111)
292 // we therefore look for a ...xx1111 11111111 00x11111xxxxxx... pattern
293 // (12 '1's followed by 2 '0's, eventually followed by another '0', followed by 5 '1's)
294 //
295 #define ISO14443A_STARTBIT_MASK 0x07FFEF80 // mask is 00001111 11111111 1110 1111 10000000
296 #define ISO14443A_STARTBIT_PATTERN 0x07FF8F80 // pattern is 00001111 11111111 1000 1111 10000000
297
298 if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 0)) == ISO14443A_STARTBIT_PATTERN >> 0) Uart.syncBit = 7;
299 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 1)) == ISO14443A_STARTBIT_PATTERN >> 1) Uart.syncBit = 6;
300 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 2)) == ISO14443A_STARTBIT_PATTERN >> 2) Uart.syncBit = 5;
301 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 3)) == ISO14443A_STARTBIT_PATTERN >> 3) Uart.syncBit = 4;
302 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 4)) == ISO14443A_STARTBIT_PATTERN >> 4) Uart.syncBit = 3;
303 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 5)) == ISO14443A_STARTBIT_PATTERN >> 5) Uart.syncBit = 2;
304 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 6)) == ISO14443A_STARTBIT_PATTERN >> 6) Uart.syncBit = 1;
305 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 7)) == ISO14443A_STARTBIT_PATTERN >> 7) Uart.syncBit = 0;
306
307 if (Uart.syncBit != 9999) { // found a sync bit
308 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
309 Uart.startTime -= Uart.syncBit;
310 Uart.endTime = Uart.startTime;
311 Uart.state = STATE_START_OF_COMMUNICATION;
312 }
313
314 } else {
315
316 if (IsMillerModulationNibble1(Uart.fourBits >> Uart.syncBit)) {
317 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation in both halves - error
318 UartReset();
319 } else { // Modulation in first half = Sequence Z = logic "0"
320 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
321 UartReset();
322 } else {
323 Uart.bitCount++;
324 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
325 Uart.state = STATE_MILLER_Z;
326 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
327 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
328 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
329 Uart.parityBits <<= 1; // make room for the parity bit
330 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
331 Uart.bitCount = 0;
332 Uart.shiftReg = 0;
333 if((Uart.len&0x0007) == 0) { // every 8 data bytes
334 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
335 Uart.parityBits = 0;
336 }
337 }
338 }
339 }
340 } else {
341 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
342 Uart.bitCount++;
343 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
344 Uart.state = STATE_MILLER_X;
345 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
346 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
347 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
348 Uart.parityBits <<= 1; // make room for the new parity bit
349 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
350 Uart.bitCount = 0;
351 Uart.shiftReg = 0;
352 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
353 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
354 Uart.parityBits = 0;
355 }
356 }
357 } else { // no modulation in both halves - Sequence Y
358 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
359 Uart.state = STATE_UNSYNCD;
360 Uart.bitCount--; // last "0" was part of EOC sequence
361 Uart.shiftReg <<= 1; // drop it
362 if(Uart.bitCount > 0) { // if we decoded some bits
363 Uart.shiftReg >>= (9 - Uart.bitCount); // right align them
364 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff); // add last byte to the output
365 Uart.parityBits <<= 1; // add a (void) parity bit
366 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align parity bits
367 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store it
368 return TRUE;
369 } else if (Uart.len & 0x0007) { // there are some parity bits to store
370 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align remaining parity bits
371 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store them
372 }
373 if (Uart.len) {
374 return TRUE; // we are finished with decoding the raw data sequence
375 } else {
376 UartReset(); // Nothing received - start over
377 }
378 }
379 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
380 UartReset();
381 } else { // a logic "0"
382 Uart.bitCount++;
383 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
384 Uart.state = STATE_MILLER_Y;
385 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
386 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
387 Uart.parityBits <<= 1; // make room for the parity bit
388 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
389 Uart.bitCount = 0;
390 Uart.shiftReg = 0;
391 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
392 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
393 Uart.parityBits = 0;
394 }
395 }
396 }
397 }
398 }
399
400 }
401
402 return FALSE; // not finished yet, need more data
403 }
404
405
406
407 //=============================================================================
408 // ISO 14443 Type A - Manchester decoder
409 //=============================================================================
410 // Basics:
411 // This decoder is used when the PM3 acts as a reader.
412 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
413 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
414 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
415 // The Manchester decoder needs to identify the following sequences:
416 // 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
417 // 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
418 // 8 ticks unmodulated: Sequence F = end of communication
419 // 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
420 // Note 1: the bitstream may start at any time. We therefore need to sync.
421 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
422 static tDemod Demod;
423
424 // Lookup-Table to decide if 4 raw bits are a modulation.
425 // We accept three or four "1" in any position
426 const bool Mod_Manchester_LUT[] = {
427 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
428 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
429 };
430
431 #define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
432 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
433
434
435 void DemodReset()
436 {
437 Demod.state = DEMOD_UNSYNCD;
438 Demod.len = 0; // number of decoded data bytes
439 Demod.parityLen = 0;
440 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
441 Demod.parityBits = 0; //
442 Demod.collisionPos = 0; // Position of collision bit
443 Demod.twoBits = 0xffff; // buffer for 2 Bits
444 Demod.highCnt = 0;
445 Demod.startTime = 0;
446 Demod.endTime = 0;
447
448 //
449 Demod.bitCount = 0;
450 Demod.syncBit = 0xFFFF;
451 Demod.samples = 0;
452 }
453
454 void DemodInit(uint8_t *data, uint8_t *parity)
455 {
456 Demod.output = data;
457 Demod.parity = parity;
458 DemodReset();
459 }
460
461 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
462 static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
463 {
464
465 Demod.twoBits = (Demod.twoBits << 8) | bit;
466
467 if (Demod.state == DEMOD_UNSYNCD) {
468
469 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
470 if (Demod.twoBits == 0x0000) {
471 Demod.highCnt++;
472 } else {
473 Demod.highCnt = 0;
474 }
475 } else {
476 Demod.syncBit = 0xFFFF; // not set
477 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
478 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
479 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
480 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
481 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
482 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
483 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
484 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
485 if (Demod.syncBit != 0xFFFF) {
486 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
487 Demod.startTime -= Demod.syncBit;
488 Demod.bitCount = offset; // number of decoded data bits
489 Demod.state = DEMOD_MANCHESTER_DATA;
490 }
491 }
492
493 } else {
494
495 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
496 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
497 if (!Demod.collisionPos) {
498 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
499 }
500 } // modulation in first half only - Sequence D = 1
501 Demod.bitCount++;
502 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
503 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
504 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
505 Demod.parityBits <<= 1; // make room for the parity bit
506 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
507 Demod.bitCount = 0;
508 Demod.shiftReg = 0;
509 if((Demod.len&0x0007) == 0) { // every 8 data bytes
510 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits
511 Demod.parityBits = 0;
512 }
513 }
514 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
515 } else { // no modulation in first half
516 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
517 Demod.bitCount++;
518 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
519 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
520 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
521 Demod.parityBits <<= 1; // make room for the new parity bit
522 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
523 Demod.bitCount = 0;
524 Demod.shiftReg = 0;
525 if ((Demod.len&0x0007) == 0) { // every 8 data bytes
526 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits1
527 Demod.parityBits = 0;
528 }
529 }
530 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
531 } else { // no modulation in both halves - End of communication
532 if(Demod.bitCount > 0) { // there are some remaining data bits
533 Demod.shiftReg >>= (9 - Demod.bitCount); // right align the decoded bits
534 Demod.output[Demod.len++] = Demod.shiftReg & 0xff; // and add them to the output
535 Demod.parityBits <<= 1; // add a (void) parity bit
536 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
537 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
538 return TRUE;
539 } else if (Demod.len & 0x0007) { // there are some parity bits to store
540 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
541 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
542 }
543 if (Demod.len) {
544 return TRUE; // we are finished with decoding the raw data sequence
545 } else { // nothing received. Start over
546 DemodReset();
547 }
548 }
549 }
550 }
551 return FALSE; // not finished yet, need more data
552 }
553
554 //=============================================================================
555 // Finally, a `sniffer' for ISO 14443 Type A
556 // Both sides of communication!
557 //=============================================================================
558
559 //-----------------------------------------------------------------------------
560 // Record the sequence of commands sent by the reader to the tag, with
561 // triggering so that we start recording at the point that the tag is moved
562 // near the reader.
563 //-----------------------------------------------------------------------------
564 void RAMFUNC SniffIso14443a(uint8_t param) {
565 // param:
566 // bit 0 - trigger from first card answer
567 // bit 1 - trigger from first reader 7-bit request
568
569 LEDsoff();
570
571
572 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
573
574 // Allocate memory from BigBuf for some buffers
575 // free all previous allocations first
576 BigBuf_free();
577
578 // The command (reader -> tag) that we're receiving.
579 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
580 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
581
582 // The response (tag -> reader) that we're receiving.
583 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
584 uint8_t *receivedResponsePar = BigBuf_malloc(MAX_PARITY_SIZE);
585
586 // The DMA buffer, used to stream samples from the FPGA
587 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
588
589 // init trace buffer
590 clear_trace();
591 set_tracing(TRUE);
592
593 uint8_t *data = dmaBuf;
594 uint8_t previous_data = 0;
595 int maxDataLen = 0;
596 int dataLen = 0;
597 bool TagIsActive = FALSE;
598 bool ReaderIsActive = FALSE;
599
600 // Set up the demodulator for tag -> reader responses.
601 DemodInit(receivedResponse, receivedResponsePar);
602
603 // Set up the demodulator for the reader -> tag commands
604 UartInit(receivedCmd, receivedCmdPar);
605
606 // Setup and start DMA.
607 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
608
609 // We won't start recording the frames that we acquire until we trigger;
610 // a good trigger condition to get started is probably when we see a
611 // response from the tag.
612 // triggered == FALSE -- to wait first for card
613 bool triggered = !(param & 0x03);
614
615 // And now we loop, receiving samples.
616 for(uint32_t rsamples = 0; TRUE; ) {
617
618 if(BUTTON_PRESS()) {
619 DbpString("cancelled by button");
620 break;
621 }
622
623 LED_A_ON();
624 WDT_HIT();
625
626 int register readBufDataP = data - dmaBuf;
627 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
628 if (readBufDataP <= dmaBufDataP){
629 dataLen = dmaBufDataP - readBufDataP;
630 } else {
631 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
632 }
633 // test for length of buffer
634 if(dataLen > maxDataLen) {
635 maxDataLen = dataLen;
636 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
637 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
638 break;
639 }
640 }
641 if(dataLen < 1) continue;
642
643 // primary buffer was stopped( <-- we lost data!
644 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
645 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
646 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
647 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
648 }
649 // secondary buffer sets as primary, secondary buffer was stopped
650 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
651 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
652 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
653 }
654
655 LED_A_OFF();
656
657 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
658
659 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
660 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
661 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
662 LED_C_ON();
663
664 // check - if there is a short 7bit request from reader
665 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
666
667 if(triggered) {
668 if (!LogTrace(receivedCmd,
669 Uart.len,
670 Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
671 Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
672 Uart.parity,
673 TRUE)) break;
674 }
675 /* And ready to receive another command. */
676 UartReset();
677 /* And also reset the demod code, which might have been */
678 /* false-triggered by the commands from the reader. */
679 DemodReset();
680 LED_B_OFF();
681 }
682 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
683 }
684
685 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
686 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
687 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
688 LED_B_ON();
689
690 if (!LogTrace(receivedResponse,
691 Demod.len,
692 Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
693 Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
694 Demod.parity,
695 FALSE)) break;
696
697 if ((!triggered) && (param & 0x01)) triggered = TRUE;
698
699 // And ready to receive another response.
700 DemodReset();
701 // And reset the Miller decoder including itS (now outdated) input buffer
702 UartInit(receivedCmd, receivedCmdPar);
703
704 LED_C_OFF();
705 }
706 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
707 }
708 }
709
710 previous_data = *data;
711 rsamples++;
712 data++;
713 if(data == dmaBuf + DMA_BUFFER_SIZE) {
714 data = dmaBuf;
715 }
716 } // main cycle
717
718 DbpString("COMMAND FINISHED");
719
720 FpgaDisableSscDma();
721 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
722 Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);
723 LEDsoff();
724 }
725
726 //-----------------------------------------------------------------------------
727 // Prepare tag messages
728 //-----------------------------------------------------------------------------
729 static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
730 {
731 ToSendReset();
732
733 // Correction bit, might be removed when not needed
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736 ToSendStuffBit(0);
737 ToSendStuffBit(0);
738 ToSendStuffBit(1); // 1
739 ToSendStuffBit(0);
740 ToSendStuffBit(0);
741 ToSendStuffBit(0);
742
743 // Send startbit
744 ToSend[++ToSendMax] = SEC_D;
745 LastProxToAirDuration = 8 * ToSendMax - 4;
746
747 for(uint16_t i = 0; i < len; i++) {
748 uint8_t b = cmd[i];
749
750 // Data bits
751 for(uint16_t j = 0; j < 8; j++) {
752 if(b & 1) {
753 ToSend[++ToSendMax] = SEC_D;
754 } else {
755 ToSend[++ToSendMax] = SEC_E;
756 }
757 b >>= 1;
758 }
759
760 // Get the parity bit
761 if (parity[i>>3] & (0x80>>(i&0x0007))) {
762 ToSend[++ToSendMax] = SEC_D;
763 LastProxToAirDuration = 8 * ToSendMax - 4;
764 } else {
765 ToSend[++ToSendMax] = SEC_E;
766 LastProxToAirDuration = 8 * ToSendMax;
767 }
768 }
769
770 // Send stopbit
771 ToSend[++ToSendMax] = SEC_F;
772
773 // Convert from last byte pos to length
774 ToSendMax++;
775 }
776
777 static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
778 {
779 uint8_t par[MAX_PARITY_SIZE];
780
781 GetParity(cmd, len, par);
782 CodeIso14443aAsTagPar(cmd, len, par);
783 }
784
785
786 static void Code4bitAnswerAsTag(uint8_t cmd)
787 {
788 int i;
789
790 ToSendReset();
791
792 // Correction bit, might be removed when not needed
793 ToSendStuffBit(0);
794 ToSendStuffBit(0);
795 ToSendStuffBit(0);
796 ToSendStuffBit(0);
797 ToSendStuffBit(1); // 1
798 ToSendStuffBit(0);
799 ToSendStuffBit(0);
800 ToSendStuffBit(0);
801
802 // Send startbit
803 ToSend[++ToSendMax] = SEC_D;
804
805 uint8_t b = cmd;
806 for(i = 0; i < 4; i++) {
807 if(b & 1) {
808 ToSend[++ToSendMax] = SEC_D;
809 LastProxToAirDuration = 8 * ToSendMax - 4;
810 } else {
811 ToSend[++ToSendMax] = SEC_E;
812 LastProxToAirDuration = 8 * ToSendMax;
813 }
814 b >>= 1;
815 }
816
817 // Send stopbit
818 ToSend[++ToSendMax] = SEC_F;
819
820 // Convert from last byte pos to length
821 ToSendMax++;
822 }
823
824 //-----------------------------------------------------------------------------
825 // Wait for commands from reader
826 // Stop when button is pressed
827 // Or return TRUE when command is captured
828 //-----------------------------------------------------------------------------
829 static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
830 {
831 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
832 // only, since we are receiving, not transmitting).
833 // Signal field is off with the appropriate LED
834 LED_D_OFF();
835 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
836
837 // Now run a `software UART' on the stream of incoming samples.
838 UartInit(received, parity);
839
840 // clear RXRDY:
841 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
842
843 for(;;) {
844 WDT_HIT();
845
846 if(BUTTON_PRESS()) return FALSE;
847
848 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
849 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
850 if(MillerDecoding(b, 0)) {
851 *len = Uart.len;
852 return TRUE;
853 }
854 }
855 }
856 }
857
858 static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
859 int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
860 int EmSend4bit(uint8_t resp);
861 int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
862 int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
863 int EmSendCmd(uint8_t *resp, uint16_t respLen);
864 int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
865 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
866 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
867
868 static uint8_t* free_buffer_pointer;
869
870 typedef struct {
871 uint8_t* response;
872 size_t response_n;
873 uint8_t* modulation;
874 size_t modulation_n;
875 uint32_t ProxToAirDuration;
876 } tag_response_info_t;
877
878 bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
879 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
880 // This will need the following byte array for a modulation sequence
881 // 144 data bits (18 * 8)
882 // 18 parity bits
883 // 2 Start and stop
884 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
885 // 1 just for the case
886 // ----------- +
887 // 166 bytes, since every bit that needs to be send costs us a byte
888 //
889
890
891 // Prepare the tag modulation bits from the message
892 CodeIso14443aAsTag(response_info->response,response_info->response_n);
893
894 // Make sure we do not exceed the free buffer space
895 if (ToSendMax > max_buffer_size) {
896 Dbprintf("Out of memory, when modulating bits for tag answer:");
897 Dbhexdump(response_info->response_n,response_info->response,false);
898 return false;
899 }
900
901 // Copy the byte array, used for this modulation to the buffer position
902 memcpy(response_info->modulation,ToSend,ToSendMax);
903
904 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
905 response_info->modulation_n = ToSendMax;
906 response_info->ProxToAirDuration = LastProxToAirDuration;
907
908 return true;
909 }
910
911
912 // "precompile" responses. There are 7 predefined responses with a total of 28 bytes data to transmit.
913 // Coded responses need one byte per bit to transfer (data, parity, start, stop, correction)
914 // 28 * 8 data bits, 28 * 1 parity bits, 7 start bits, 7 stop bits, 7 correction bits
915 // -> need 273 bytes buffer
916 // 44 * 8 data bits, 44 * 1 parity bits, 9 start bits, 9 stop bits, 9 correction bits --370
917 // 47 * 8 data bits, 47 * 1 parity bits, 10 start bits, 10 stop bits, 10 correction bits
918 #define ALLOCATED_TAG_MODULATION_BUFFER_SIZE 453
919
920 bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
921 // Retrieve and store the current buffer index
922 response_info->modulation = free_buffer_pointer;
923
924 // Determine the maximum size we can use from our buffer
925 size_t max_buffer_size = ALLOCATED_TAG_MODULATION_BUFFER_SIZE;
926
927 // Forward the prepare tag modulation function to the inner function
928 if (prepare_tag_modulation(response_info, max_buffer_size)) {
929 // Update the free buffer offset
930 free_buffer_pointer += ToSendMax;
931 return true;
932 } else {
933 return false;
934 }
935 }
936
937 //-----------------------------------------------------------------------------
938 // Main loop of simulated tag: receive commands from reader, decide what
939 // response to send, and send it.
940 //-----------------------------------------------------------------------------
941 void SimulateIso14443aTag(int tagType, int flags, int uid_2nd, byte_t* data)
942 {
943
944 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
945 // This can be used in a reader-only attack.
946 // (it can also be retrieved via 'hf 14a list', but hey...
947 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
948 uint8_t ar_nr_collected = 0;
949
950 uint8_t sak;
951
952 // PACK response to PWD AUTH for EV1/NTAG
953 uint8_t response8[4];
954
955 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
956 uint8_t response1[2];
957
958 switch (tagType) {
959 case 1: { // MIFARE Classic
960 // Says: I am Mifare 1k - original line
961 response1[0] = 0x04;
962 response1[1] = 0x00;
963 sak = 0x08;
964 } break;
965 case 2: { // MIFARE Ultralight
966 // Says: I am a stupid memory tag, no crypto
967 response1[0] = 0x44;
968 response1[1] = 0x00;
969 sak = 0x00;
970 } break;
971 case 3: { // MIFARE DESFire
972 // Says: I am a DESFire tag, ph33r me
973 response1[0] = 0x04;
974 response1[1] = 0x03;
975 sak = 0x20;
976 } break;
977 case 4: { // ISO/IEC 14443-4
978 // Says: I am a javacard (JCOP)
979 response1[0] = 0x04;
980 response1[1] = 0x00;
981 sak = 0x28;
982 } break;
983 case 5: { // MIFARE TNP3XXX
984 // Says: I am a toy
985 response1[0] = 0x01;
986 response1[1] = 0x0f;
987 sak = 0x01;
988 } break;
989 case 6: { // MIFARE Mini
990 // Says: I am a Mifare Mini, 320b
991 response1[0] = 0x44;
992 response1[1] = 0x00;
993 sak = 0x09;
994 } break;
995 case 7: { // NTAG?
996 // Says: I am a NTAG,
997 response1[0] = 0x44;
998 response1[1] = 0x00;
999 sak = 0x00;
1000 // PACK
1001 response8[0] = 0x80;
1002 response8[1] = 0x80;
1003 ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);
1004 } break;
1005 default: {
1006 Dbprintf("Error: unkown tagtype (%d)",tagType);
1007 return;
1008 } break;
1009 }
1010
1011 // The second response contains the (mandatory) first 24 bits of the UID
1012 uint8_t response2[5] = {0x00};
1013
1014 // Check if the uid uses the (optional) part
1015 uint8_t response2a[5] = {0x00};
1016
1017 if (flags & FLAG_7B_UID_IN_DATA) {
1018 response2[0] = 0x88;
1019 response2[1] = data[0];
1020 response2[2] = data[1];
1021 response2[3] = data[2];
1022
1023 response2a[0] = data[3];
1024 response2a[1] = data[4];
1025 response2a[2] = data[5];
1026 response2a[3] = data[6]; //??
1027 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
1028
1029 // Configure the ATQA and SAK accordingly
1030 response1[0] |= 0x40;
1031 sak |= 0x04;
1032 } else {
1033 memcpy(response2, data, 4);
1034 //num_to_bytes(uid_1st,4,response2);
1035 // Configure the ATQA and SAK accordingly
1036 response1[0] &= 0xBF;
1037 sak &= 0xFB;
1038 }
1039
1040 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1041 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
1042
1043 // Prepare the mandatory SAK (for 4 and 7 byte UID)
1044 uint8_t response3[3] = {0x00};
1045 response3[0] = sak;
1046 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
1047
1048 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
1049 uint8_t response3a[3] = {0x00};
1050 response3a[0] = sak & 0xFB;
1051 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
1052
1053 uint8_t response5[] = { 0x01, 0x01, 0x01, 0x01 }; // Very random tag nonce
1054 uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1055 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1056 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1057 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1058 // TC(1) = 0x02: CID supported, NAD not supported
1059 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
1060
1061 // Prepare GET_VERSION (different for EV-1 / NTAG)
1062 //uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7}; //EV1 48bytes VERSION.
1063 uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
1064
1065 // Prepare CHK_TEARING
1066 uint8_t response9[] = {0xBD,0x90,0x3f};
1067
1068 #define TAG_RESPONSE_COUNT 10
1069 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
1070 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
1071 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
1072 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1073 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
1074 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
1075 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
1076 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
1077 { .response = response7_NTAG, .response_n = sizeof(response7_NTAG) }, // EV1/NTAG GET_VERSION response
1078 { .response = response8, .response_n = sizeof(response8) }, // EV1/NTAG PACK response
1079 { .response = response9, .response_n = sizeof(response9) } // EV1/NTAG CHK_TEAR response
1080 };
1081
1082 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1083 // Such a response is less time critical, so we can prepare them on the fly
1084 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1085 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1086 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
1087 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
1088 tag_response_info_t dynamic_response_info = {
1089 .response = dynamic_response_buffer,
1090 .response_n = 0,
1091 .modulation = dynamic_modulation_buffer,
1092 .modulation_n = 0
1093 };
1094
1095 // We need to listen to the high-frequency, peak-detected path.
1096 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1097
1098 BigBuf_free_keep_EM();
1099
1100 // allocate buffers:
1101 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
1102 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
1103 free_buffer_pointer = BigBuf_malloc(ALLOCATED_TAG_MODULATION_BUFFER_SIZE);
1104
1105 // clear trace
1106 clear_trace();
1107 set_tracing(TRUE);
1108
1109 // Prepare the responses of the anticollision phase
1110 // there will be not enough time to do this at the moment the reader sends it REQA
1111 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
1112 prepare_allocated_tag_modulation(&responses[i]);
1113 }
1114
1115 int len = 0;
1116
1117 // To control where we are in the protocol
1118 int order = 0;
1119 int lastorder;
1120
1121 // Just to allow some checks
1122 int happened = 0;
1123 int happened2 = 0;
1124 int cmdsRecvd = 0;
1125
1126 cmdsRecvd = 0;
1127 tag_response_info_t* p_response;
1128
1129 LED_A_ON();
1130 for(;;) {
1131 // Clean receive command buffer
1132
1133 if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
1134 DbpString("Button press");
1135 break;
1136 }
1137
1138 p_response = NULL;
1139
1140 // Okay, look at the command now.
1141 lastorder = order;
1142 if(receivedCmd[0] == 0x26) { // Received a REQUEST
1143 p_response = &responses[0]; order = 1;
1144 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
1145 p_response = &responses[0]; order = 6;
1146 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
1147 p_response = &responses[1]; order = 2;
1148 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
1149 p_response = &responses[2]; order = 20;
1150 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
1151 p_response = &responses[3]; order = 3;
1152 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
1153 p_response = &responses[4]; order = 30;
1154 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
1155 uint8_t block = receivedCmd[1];
1156 if ( tagType == 7 ) {
1157 uint8_t start = 4 * block;
1158
1159 if ( block < 4 ) {
1160 //NTAG 215
1161 uint8_t blockdata[50] = {
1162 data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
1163 data[3],data[4],data[5],data[6],
1164 data[3] ^ data[4] ^ data[5] ^ data[6],0x48,0x0f,0xe0,
1165 0xe1,0x10,0x12,0x00,
1166 0x03,0x00,0xfe,0x00,
1167 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1168 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1169 0x00,0x00,0x00,0x00,
1170 0x00,0x00};
1171 AppendCrc14443a(blockdata+start, 16);
1172 EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
1173 } else {
1174 uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
1175 emlGetMemBt( emdata, start, 16);
1176 AppendCrc14443a(emdata, 16);
1177 EmSendCmdEx(emdata, sizeof(emdata), false);
1178 }
1179 p_response = NULL;
1180
1181 } else {
1182 EmSendCmdEx(data+(4*block),16,false);
1183 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1184 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1185 p_response = NULL;
1186 }
1187 } else if(receivedCmd[0] == 0x3A) { // Received a FAST READ (ranged read) -- just returns all zeros.
1188
1189 uint8_t emdata[MAX_FRAME_SIZE];
1190 int start = receivedCmd[1] * 4;
1191 int len = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
1192 emlGetMemBt( emdata, start, len);
1193 AppendCrc14443a(emdata, len);
1194 EmSendCmdEx(emdata, len+2, false);
1195 p_response = NULL;
1196
1197 } else if(receivedCmd[0] == 0x3C && tagType == 7) { // Received a READ SIGNATURE --
1198 // ECC data, taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
1199 uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
1200 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
1201 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
1202 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
1203 0x00,0x00};
1204 AppendCrc14443a(data, sizeof(data)-2);
1205 EmSendCmdEx(data,sizeof(data),false);
1206 p_response = NULL;
1207 } else if(receivedCmd[0] == 0x39 && tagType == 7) { // Received a READ COUNTER --
1208 uint8_t data[] = {0x00,0x00,0x00,0x14,0xa5};
1209 EmSendCmdEx(data,sizeof(data),false);
1210 p_response = NULL;
1211 } else if(receivedCmd[0] == 0xA5 && tagType == 7) { // Received a INC COUNTER --
1212 // number of counter
1213 //uint8_t counter = receivedCmd[1];
1214 //uint32_t val = bytes_to_num(receivedCmd+2,4);
1215
1216 // send ACK
1217 uint8_t ack[] = {0x0a};
1218 EmSendCmdEx(ack,sizeof(ack),false);
1219 p_response = NULL;
1220
1221 } else if(receivedCmd[0] == 0x3E && tagType == 7) { // Received a CHECK_TEARING_EVENT --
1222 p_response = &responses[9];
1223 } else if(receivedCmd[0] == 0x50) { // Received a HALT
1224
1225 if (tracing) {
1226 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1227 }
1228 p_response = NULL;
1229 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
1230
1231 if ( tagType == 7 ) { // IF NTAG /EV1 0x60 == GET_VERSION, not a authentication request.
1232 p_response = &responses[7];
1233 } else {
1234 p_response = &responses[5]; order = 7;
1235 }
1236 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
1237 if (tagType == 1 || tagType == 2) { // RATS not supported
1238 EmSend4bit(CARD_NACK_NA);
1239 p_response = NULL;
1240 } else {
1241 p_response = &responses[6]; order = 70;
1242 }
1243 } else if (order == 7 && len == 8) { // Received {nr] and {ar} (part of authentication)
1244 if (tracing) {
1245 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1246 }
1247 uint32_t nonce = bytes_to_num(response5,4);
1248 uint32_t nr = bytes_to_num(receivedCmd,4);
1249 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1250 //Dbprintf("Auth attempt {nonce}{nr}{ar}: %08x %08x %08x", nonce, nr, ar);
1251
1252 if(flags & FLAG_NR_AR_ATTACK )
1253 {
1254 if(ar_nr_collected < 2){
1255 // Avoid duplicates... probably not necessary, nr should vary.
1256 //if(ar_nr_responses[3] != nr){
1257 ar_nr_responses[ar_nr_collected*5] = 0;
1258 ar_nr_responses[ar_nr_collected*5+1] = 0;
1259 ar_nr_responses[ar_nr_collected*5+2] = nonce;
1260 ar_nr_responses[ar_nr_collected*5+3] = nr;
1261 ar_nr_responses[ar_nr_collected*5+4] = ar;
1262 ar_nr_collected++;
1263 //}
1264 }
1265
1266 if(ar_nr_collected > 1 ) {
1267
1268 if (MF_DBGLEVEL >= 2) {
1269 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
1270 Dbprintf("../tools/mfkey/mfkey32 %07x%08x %08x %08x %08x %08x %08x",
1271 ar_nr_responses[0], // UID1
1272 ar_nr_responses[1], // UID2
1273 ar_nr_responses[2], // NT
1274 ar_nr_responses[3], // AR1
1275 ar_nr_responses[4], // NR1
1276 ar_nr_responses[8], // AR2
1277 ar_nr_responses[9] // NR2
1278 );
1279 }
1280 uint8_t len = ar_nr_collected*5*4;
1281 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,len,0,&ar_nr_responses,len);
1282 ar_nr_collected = 0;
1283 memset(ar_nr_responses, 0x00, len);
1284 }
1285 }
1286 } else if (receivedCmd[0] == 0x1a ) // ULC authentication
1287 {
1288
1289 }
1290 else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
1291 {
1292 if ( tagType == 7 ) {
1293 p_response = &responses[8]; // PACK response
1294 uint32_t pwd = bytes_to_num(receivedCmd+1,4);
1295 Dbprintf("Auth attempt: %08x", pwd);
1296 }
1297 }
1298 else {
1299 // Check for ISO 14443A-4 compliant commands, look at left nibble
1300 switch (receivedCmd[0]) {
1301
1302 case 0x0B:
1303 case 0x0A: { // IBlock (command)
1304 dynamic_response_info.response[0] = receivedCmd[0];
1305 dynamic_response_info.response[1] = 0x00;
1306 dynamic_response_info.response[2] = 0x90;
1307 dynamic_response_info.response[3] = 0x00;
1308 dynamic_response_info.response_n = 4;
1309 } break;
1310
1311 case 0x1A:
1312 case 0x1B: { // Chaining command
1313 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1314 dynamic_response_info.response_n = 2;
1315 } break;
1316
1317 case 0xaa:
1318 case 0xbb: {
1319 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1320 dynamic_response_info.response_n = 2;
1321 } break;
1322
1323 case 0xBA: { //
1324 memcpy(dynamic_response_info.response,"\xAB\x00",2);
1325 dynamic_response_info.response_n = 2;
1326 } break;
1327
1328 case 0xCA:
1329 case 0xC2: { // Readers sends deselect command
1330 memcpy(dynamic_response_info.response,"\xCA\x00",2);
1331 dynamic_response_info.response_n = 2;
1332 } break;
1333
1334 default: {
1335 // Never seen this command before
1336 if (tracing) {
1337 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1338 }
1339 Dbprintf("Received unknown command (len=%d):",len);
1340 Dbhexdump(len,receivedCmd,false);
1341 // Do not respond
1342 dynamic_response_info.response_n = 0;
1343 } break;
1344 }
1345
1346 if (dynamic_response_info.response_n > 0) {
1347 // Copy the CID from the reader query
1348 dynamic_response_info.response[1] = receivedCmd[1];
1349
1350 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1351 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1352 dynamic_response_info.response_n += 2;
1353
1354 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1355 Dbprintf("Error preparing tag response");
1356 if (tracing) {
1357 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1358 }
1359 break;
1360 }
1361 p_response = &dynamic_response_info;
1362 }
1363 }
1364
1365 // Count number of wakeups received after a halt
1366 if(order == 6 && lastorder == 5) { happened++; }
1367
1368 // Count number of other messages after a halt
1369 if(order != 6 && lastorder == 5) { happened2++; }
1370
1371 if(cmdsRecvd > 999) {
1372 DbpString("1000 commands later...");
1373 break;
1374 }
1375 cmdsRecvd++;
1376
1377 if (p_response != NULL) {
1378 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1379 // do the tracing for the previous reader request and this tag answer:
1380 uint8_t par[MAX_PARITY_SIZE];
1381 GetParity(p_response->response, p_response->response_n, par);
1382
1383 EmLogTrace(Uart.output,
1384 Uart.len,
1385 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1386 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1387 Uart.parity,
1388 p_response->response,
1389 p_response->response_n,
1390 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1391 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1392 par);
1393 }
1394
1395 if (!tracing) {
1396 Dbprintf("Trace Full. Simulation stopped.");
1397 break;
1398 }
1399 }
1400
1401 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1402 BigBuf_free_keep_EM();
1403 LED_A_OFF();
1404
1405 Dbprintf("-[ Wake ups after halt [%d]", happened);
1406 Dbprintf("-[ Messages after halt [%d]", happened2);
1407 Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
1408 }
1409
1410
1411 // prepare a delayed transfer. This simply shifts ToSend[] by a number
1412 // of bits specified in the delay parameter.
1413 void PrepareDelayedTransfer(uint16_t delay)
1414 {
1415 uint8_t bitmask = 0;
1416 uint8_t bits_to_shift = 0;
1417 uint8_t bits_shifted = 0;
1418
1419 delay &= 0x07;
1420 if (delay) {
1421 for (uint16_t i = 0; i < delay; i++) {
1422 bitmask |= (0x01 << i);
1423 }
1424 ToSend[ToSendMax++] = 0x00;
1425 for (uint16_t i = 0; i < ToSendMax; i++) {
1426 bits_to_shift = ToSend[i] & bitmask;
1427 ToSend[i] = ToSend[i] >> delay;
1428 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1429 bits_shifted = bits_to_shift;
1430 }
1431 }
1432 }
1433
1434
1435 //-------------------------------------------------------------------------------------
1436 // Transmit the command (to the tag) that was placed in ToSend[].
1437 // Parameter timing:
1438 // if NULL: transfer at next possible time, taking into account
1439 // request guard time and frame delay time
1440 // if == 0: transfer immediately and return time of transfer
1441 // if != 0: delay transfer until time specified
1442 //-------------------------------------------------------------------------------------
1443 static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
1444 {
1445
1446 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1447
1448 uint32_t ThisTransferTime = 0;
1449
1450 if (timing) {
1451 if(*timing == 0) { // Measure time
1452 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
1453 } else {
1454 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1455 }
1456 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1457 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1458 LastTimeProxToAirStart = *timing;
1459 } else {
1460 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1461 while(GetCountSspClk() < ThisTransferTime);
1462 LastTimeProxToAirStart = ThisTransferTime;
1463 }
1464
1465 // clear TXRDY
1466 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1467
1468 uint16_t c = 0;
1469 for(;;) {
1470 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1471 AT91C_BASE_SSC->SSC_THR = cmd[c];
1472 c++;
1473 if(c >= len) {
1474 break;
1475 }
1476 }
1477 }
1478
1479 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
1480 }
1481
1482
1483 //-----------------------------------------------------------------------------
1484 // Prepare reader command (in bits, support short frames) to send to FPGA
1485 //-----------------------------------------------------------------------------
1486 void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
1487 {
1488 int i, j;
1489 int last;
1490 uint8_t b;
1491
1492 ToSendReset();
1493
1494 // Start of Communication (Seq. Z)
1495 ToSend[++ToSendMax] = SEC_Z;
1496 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1497 last = 0;
1498
1499 size_t bytecount = nbytes(bits);
1500 // Generate send structure for the data bits
1501 for (i = 0; i < bytecount; i++) {
1502 // Get the current byte to send
1503 b = cmd[i];
1504 size_t bitsleft = MIN((bits-(i*8)),8);
1505
1506 for (j = 0; j < bitsleft; j++) {
1507 if (b & 1) {
1508 // Sequence X
1509 ToSend[++ToSendMax] = SEC_X;
1510 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1511 last = 1;
1512 } else {
1513 if (last == 0) {
1514 // Sequence Z
1515 ToSend[++ToSendMax] = SEC_Z;
1516 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1517 } else {
1518 // Sequence Y
1519 ToSend[++ToSendMax] = SEC_Y;
1520 last = 0;
1521 }
1522 }
1523 b >>= 1;
1524 }
1525
1526 // Only transmit parity bit if we transmitted a complete byte
1527 if (j == 8 && parity != NULL) {
1528 // Get the parity bit
1529 if (parity[i>>3] & (0x80 >> (i&0x0007))) {
1530 // Sequence X
1531 ToSend[++ToSendMax] = SEC_X;
1532 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1533 last = 1;
1534 } else {
1535 if (last == 0) {
1536 // Sequence Z
1537 ToSend[++ToSendMax] = SEC_Z;
1538 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1539 } else {
1540 // Sequence Y
1541 ToSend[++ToSendMax] = SEC_Y;
1542 last = 0;
1543 }
1544 }
1545 }
1546 }
1547
1548 // End of Communication: Logic 0 followed by Sequence Y
1549 if (last == 0) {
1550 // Sequence Z
1551 ToSend[++ToSendMax] = SEC_Z;
1552 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1553 } else {
1554 // Sequence Y
1555 ToSend[++ToSendMax] = SEC_Y;
1556 last = 0;
1557 }
1558 ToSend[++ToSendMax] = SEC_Y;
1559
1560 // Convert to length of command:
1561 ToSendMax++;
1562 }
1563
1564 //-----------------------------------------------------------------------------
1565 // Prepare reader command to send to FPGA
1566 //-----------------------------------------------------------------------------
1567 void CodeIso14443aAsReaderPar(const uint8_t *cmd, uint16_t len, const uint8_t *parity)
1568 {
1569 CodeIso14443aBitsAsReaderPar(cmd, len*8, parity);
1570 }
1571
1572
1573 //-----------------------------------------------------------------------------
1574 // Wait for commands from reader
1575 // Stop when button is pressed (return 1) or field was gone (return 2)
1576 // Or return 0 when command is captured
1577 //-----------------------------------------------------------------------------
1578 static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
1579 {
1580 *len = 0;
1581
1582 uint32_t timer = 0, vtime = 0;
1583 int analogCnt = 0;
1584 int analogAVG = 0;
1585
1586 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1587 // only, since we are receiving, not transmitting).
1588 // Signal field is off with the appropriate LED
1589 LED_D_OFF();
1590 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1591
1592 // Set ADC to read field strength
1593 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1594 AT91C_BASE_ADC->ADC_MR =
1595 ADC_MODE_PRESCALE(63) |
1596 ADC_MODE_STARTUP_TIME(1) |
1597 ADC_MODE_SAMPLE_HOLD_TIME(15);
1598 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1599 // start ADC
1600 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1601
1602 // Now run a 'software UART' on the stream of incoming samples.
1603 UartInit(received, parity);
1604
1605 // Clear RXRDY:
1606 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1607
1608 for(;;) {
1609 WDT_HIT();
1610
1611 if (BUTTON_PRESS()) return 1;
1612
1613 // test if the field exists
1614 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1615 analogCnt++;
1616 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1617 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1618 if (analogCnt >= 32) {
1619 if ((MAX_ADC_HF_VOLTAGE * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1620 vtime = GetTickCount();
1621 if (!timer) timer = vtime;
1622 // 50ms no field --> card to idle state
1623 if (vtime - timer > 50) return 2;
1624 } else
1625 if (timer) timer = 0;
1626 analogCnt = 0;
1627 analogAVG = 0;
1628 }
1629 }
1630
1631 // receive and test the miller decoding
1632 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1633 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1634 if(MillerDecoding(b, 0)) {
1635 *len = Uart.len;
1636 return 0;
1637 }
1638 }
1639
1640 }
1641 }
1642
1643
1644 static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded)
1645 {
1646 uint8_t b;
1647 uint16_t i = 0;
1648 uint32_t ThisTransferTime;
1649
1650 // Modulate Manchester
1651 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1652
1653 // include correction bit if necessary
1654 if (Uart.parityBits & 0x01) {
1655 correctionNeeded = TRUE;
1656 }
1657 if(correctionNeeded) {
1658 // 1236, so correction bit needed
1659 i = 0;
1660 } else {
1661 i = 1;
1662 }
1663
1664 // clear receiving shift register and holding register
1665 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1666 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1667 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1668 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1669
1670 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1671 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1672 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1673 if (AT91C_BASE_SSC->SSC_RHR) break;
1674 }
1675
1676 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1677
1678 // Clear TXRDY:
1679 AT91C_BASE_SSC->SSC_THR = SEC_F;
1680
1681 // send cycle
1682 for(; i < respLen; ) {
1683 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1684 AT91C_BASE_SSC->SSC_THR = resp[i++];
1685 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1686 }
1687
1688 if(BUTTON_PRESS()) break;
1689 }
1690
1691 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1692 uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3;
1693 for (i = 0; i <= fpga_queued_bits/8 + 1; ) {
1694 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1695 AT91C_BASE_SSC->SSC_THR = SEC_F;
1696 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1697 i++;
1698 }
1699 }
1700
1701 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1702
1703 return 0;
1704 }
1705
1706 int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1707 Code4bitAnswerAsTag(resp);
1708 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1709 // do the tracing for the previous reader request and this tag answer:
1710 uint8_t par[1];
1711 GetParity(&resp, 1, par);
1712 EmLogTrace(Uart.output,
1713 Uart.len,
1714 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1715 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1716 Uart.parity,
1717 &resp,
1718 1,
1719 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1720 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1721 par);
1722 return res;
1723 }
1724
1725 int EmSend4bit(uint8_t resp){
1726 return EmSend4bitEx(resp, false);
1727 }
1728
1729 int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par){
1730 CodeIso14443aAsTagPar(resp, respLen, par);
1731 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1732 // do the tracing for the previous reader request and this tag answer:
1733 EmLogTrace(Uart.output,
1734 Uart.len,
1735 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1736 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1737 Uart.parity,
1738 resp,
1739 respLen,
1740 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1741 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1742 par);
1743 return res;
1744 }
1745
1746 int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
1747 uint8_t par[MAX_PARITY_SIZE];
1748 GetParity(resp, respLen, par);
1749 return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
1750 }
1751
1752 int EmSendCmd(uint8_t *resp, uint16_t respLen){
1753 uint8_t par[MAX_PARITY_SIZE];
1754 GetParity(resp, respLen, par);
1755 return EmSendCmdExPar(resp, respLen, false, par);
1756 }
1757
1758 int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par){
1759 return EmSendCmdExPar(resp, respLen, false, par);
1760 }
1761
1762 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
1763 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity)
1764 {
1765 if (tracing) {
1766 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1767 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1768 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1769 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1770 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1771 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1772 reader_EndTime = tag_StartTime - exact_fdt;
1773 reader_StartTime = reader_EndTime - reader_modlen;
1774 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
1775 return FALSE;
1776 } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
1777 } else {
1778 return TRUE;
1779 }
1780 }
1781
1782 //-----------------------------------------------------------------------------
1783 // Wait a certain time for tag response
1784 // If a response is captured return TRUE
1785 // If it takes too long return FALSE
1786 //-----------------------------------------------------------------------------
1787 static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
1788 {
1789 uint32_t c = 0x00;
1790
1791 // Set FPGA mode to "reader listen mode", no modulation (listen
1792 // only, since we are receiving, not transmitting).
1793 // Signal field is on with the appropriate LED
1794 LED_D_ON();
1795 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1796
1797 // Now get the answer from the card
1798 DemodInit(receivedResponse, receivedResponsePar);
1799
1800 // clear RXRDY:
1801 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1802
1803 for(;;) {
1804 WDT_HIT();
1805
1806 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1807 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1808 if(ManchesterDecoding(b, offset, 0)) {
1809 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
1810 return TRUE;
1811 } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
1812 return FALSE;
1813 }
1814 }
1815 }
1816 }
1817
1818
1819 void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
1820 {
1821 CodeIso14443aBitsAsReaderPar(frame, bits, par);
1822
1823 // Send command to tag
1824 TransmitFor14443a(ToSend, ToSendMax, timing);
1825 if(trigger)
1826 LED_A_ON();
1827
1828 // Log reader command in trace buffer
1829 if (tracing) {
1830 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1831 }
1832 }
1833
1834
1835 void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
1836 {
1837 ReaderTransmitBitsPar(frame, len*8, par, timing);
1838 }
1839
1840
1841 void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
1842 {
1843 // Generate parity and redirect
1844 uint8_t par[MAX_PARITY_SIZE];
1845 GetParity(frame, len/8, par);
1846 ReaderTransmitBitsPar(frame, len, par, timing);
1847 }
1848
1849
1850 void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
1851 {
1852 // Generate parity and redirect
1853 uint8_t par[MAX_PARITY_SIZE];
1854 GetParity(frame, len, par);
1855 ReaderTransmitBitsPar(frame, len*8, par, timing);
1856 }
1857
1858 int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
1859 {
1860 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE;
1861 if (tracing) {
1862 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1863 }
1864 return Demod.len;
1865 }
1866
1867 int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
1868 {
1869 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
1870 if (tracing) {
1871 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1872 }
1873 return Demod.len;
1874 }
1875
1876 /* performs iso14443a anticollision procedure
1877 * fills the uid pointer unless NULL
1878 * fills resp_data unless NULL */
1879 int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, uint32_t *cuid_ptr) {
1880 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1881 uint8_t sel_all[] = { 0x93,0x20 };
1882 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1883 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1884 uint8_t resp[MAX_FRAME_SIZE]; // theoretically. A usual RATS will be much smaller
1885 uint8_t resp_par[MAX_PARITY_SIZE];
1886 byte_t uid_resp[4];
1887 size_t uid_resp_len;
1888
1889 uint8_t sak = 0x04; // cascade uid
1890 int cascade_level = 0;
1891 int len;
1892
1893 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1894 ReaderTransmitBitsPar(wupa,7,0, NULL);
1895
1896 // Receive the ATQA
1897 if(!ReaderReceive(resp, resp_par)) return 0;
1898
1899 if(p_hi14a_card) {
1900 memcpy(p_hi14a_card->atqa, resp, 2);
1901 p_hi14a_card->uidlen = 0;
1902 memset(p_hi14a_card->uid,0,10);
1903 }
1904
1905 // clear uid
1906 if (uid_ptr) {
1907 memset(uid_ptr,0,10);
1908 }
1909
1910 // check for proprietary anticollision:
1911 if ((resp[0] & 0x1F) == 0) {
1912 return 3;
1913 }
1914
1915 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1916 // which case we need to make a cascade 2 request and select - this is a long UID
1917 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1918 for(; sak & 0x04; cascade_level++) {
1919 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1920 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1921
1922 // SELECT_ALL
1923 ReaderTransmit(sel_all, sizeof(sel_all), NULL);
1924 if (!ReaderReceive(resp, resp_par)) return 0;
1925
1926 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1927 memset(uid_resp, 0, 4);
1928 uint16_t uid_resp_bits = 0;
1929 uint16_t collision_answer_offset = 0;
1930 // anti-collision-loop:
1931 while (Demod.collisionPos) {
1932 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1933 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1934 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1935 uid_resp[uid_resp_bits / 8] |= UIDbit << (uid_resp_bits % 8);
1936 }
1937 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1938 uid_resp_bits++;
1939 // construct anticollosion command:
1940 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1941 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1942 sel_uid[2+i] = uid_resp[i];
1943 }
1944 collision_answer_offset = uid_resp_bits%8;
1945 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1946 if (!ReaderReceiveOffset(resp, collision_answer_offset, resp_par)) return 0;
1947 }
1948 // finally, add the last bits and BCC of the UID
1949 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1950 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1951 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1952 }
1953
1954 } else { // no collision, use the response to SELECT_ALL as current uid
1955 memcpy(uid_resp, resp, 4);
1956 }
1957 uid_resp_len = 4;
1958
1959 // calculate crypto UID. Always use last 4 Bytes.
1960 if(cuid_ptr) {
1961 *cuid_ptr = bytes_to_num(uid_resp, 4);
1962 }
1963
1964 // Construct SELECT UID command
1965 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1966 memcpy(sel_uid+2, uid_resp, 4); // the UID
1967 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1968 AppendCrc14443a(sel_uid, 7); // calculate and add CRC
1969 ReaderTransmit(sel_uid, sizeof(sel_uid), NULL);
1970
1971 // Receive the SAK
1972 if (!ReaderReceive(resp, resp_par)) return 0;
1973 sak = resp[0];
1974
1975 // Test if more parts of the uid are coming
1976 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
1977 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1978 // http://www.nxp.com/documents/application_note/AN10927.pdf
1979 uid_resp[0] = uid_resp[1];
1980 uid_resp[1] = uid_resp[2];
1981 uid_resp[2] = uid_resp[3];
1982
1983 uid_resp_len = 3;
1984 }
1985
1986 if(uid_ptr) {
1987 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
1988 }
1989
1990 if(p_hi14a_card) {
1991 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
1992 p_hi14a_card->uidlen += uid_resp_len;
1993 }
1994 }
1995
1996 if(p_hi14a_card) {
1997 p_hi14a_card->sak = sak;
1998 p_hi14a_card->ats_len = 0;
1999 }
2000
2001 // non iso14443a compliant tag
2002 if( (sak & 0x20) == 0) return 2;
2003
2004 // Request for answer to select
2005 AppendCrc14443a(rats, 2);
2006 ReaderTransmit(rats, sizeof(rats), NULL);
2007
2008 if (!(len = ReaderReceive(resp, resp_par))) return 0;
2009
2010
2011 if(p_hi14a_card) {
2012 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
2013 p_hi14a_card->ats_len = len;
2014 }
2015
2016 // reset the PCB block number
2017 iso14_pcb_blocknum = 0;
2018
2019 // set default timeout based on ATS
2020 iso14a_set_ATS_timeout(resp);
2021
2022 return 1;
2023 }
2024
2025 void iso14443a_setup(uint8_t fpga_minor_mode) {
2026 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
2027 // Set up the synchronous serial port
2028 FpgaSetupSsc();
2029 // connect Demodulated Signal to ADC:
2030 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
2031
2032 // Signal field is on with the appropriate LED
2033 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
2034 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
2035 LED_D_ON();
2036 } else {
2037 LED_D_OFF();
2038 }
2039 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
2040
2041 // Start the timer
2042 StartCountSspClk();
2043
2044 DemodReset();
2045 UartReset();
2046 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
2047 iso14a_set_timeout(10*106); // 10ms default
2048 }
2049
2050 int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
2051 uint8_t parity[MAX_PARITY_SIZE];
2052 uint8_t real_cmd[cmd_len+4];
2053 real_cmd[0] = 0x0a; //I-Block
2054 // put block number into the PCB
2055 real_cmd[0] |= iso14_pcb_blocknum;
2056 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
2057 memcpy(real_cmd+2, cmd, cmd_len);
2058 AppendCrc14443a(real_cmd,cmd_len+2);
2059
2060 ReaderTransmit(real_cmd, cmd_len+4, NULL);
2061 size_t len = ReaderReceive(data, parity);
2062 uint8_t *data_bytes = (uint8_t *) data;
2063 if (!len)
2064 return 0; //DATA LINK ERROR
2065 // if we received an I- or R(ACK)-Block with a block number equal to the
2066 // current block number, toggle the current block number
2067 else if (len >= 4 // PCB+CID+CRC = 4 bytes
2068 && ((data_bytes[0] & 0xC0) == 0 // I-Block
2069 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
2070 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
2071 {
2072 iso14_pcb_blocknum ^= 1;
2073 }
2074
2075 return len;
2076 }
2077
2078 //-----------------------------------------------------------------------------
2079 // Read an ISO 14443a tag. Send out commands and store answers.
2080 //
2081 //-----------------------------------------------------------------------------
2082 void ReaderIso14443a(UsbCommand *c)
2083 {
2084 iso14a_command_t param = c->arg[0];
2085 uint8_t *cmd = c->d.asBytes;
2086 size_t len = c->arg[1] & 0xffff;
2087 size_t lenbits = c->arg[1] >> 16;
2088 uint32_t timeout = c->arg[2];
2089 uint32_t arg0 = 0;
2090 byte_t buf[USB_CMD_DATA_SIZE];
2091 uint8_t par[MAX_PARITY_SIZE];
2092
2093 if(param & ISO14A_CONNECT) {
2094 clear_trace();
2095 }
2096
2097 set_tracing(TRUE);
2098
2099 if(param & ISO14A_REQUEST_TRIGGER) {
2100 iso14a_set_trigger(TRUE);
2101 }
2102
2103 if(param & ISO14A_CONNECT) {
2104 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
2105 if(!(param & ISO14A_NO_SELECT)) {
2106 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
2107 arg0 = iso14443a_select_card(NULL,card,NULL);
2108 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
2109 }
2110 }
2111
2112 if(param & ISO14A_SET_TIMEOUT) {
2113 iso14a_set_timeout(timeout);
2114 }
2115
2116 if(param & ISO14A_APDU) {
2117 arg0 = iso14_apdu(cmd, len, buf);
2118 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
2119 }
2120
2121 if(param & ISO14A_RAW) {
2122 if(param & ISO14A_APPEND_CRC) {
2123 if(param & ISO14A_TOPAZMODE) {
2124 AppendCrc14443b(cmd,len);
2125 } else {
2126 AppendCrc14443a(cmd,len);
2127 }
2128 len += 2;
2129 if (lenbits) lenbits += 16;
2130 }
2131 if(lenbits>0) { // want to send a specific number of bits (e.g. short commands)
2132 if(param & ISO14A_TOPAZMODE) {
2133 int bits_to_send = lenbits;
2134 uint16_t i = 0;
2135 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 7), NULL, NULL); // first byte is always short (7bits) and no parity
2136 bits_to_send -= 7;
2137 while (bits_to_send > 0) {
2138 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 8), NULL, NULL); // following bytes are 8 bit and no parity
2139 bits_to_send -= 8;
2140 }
2141 } else {
2142 GetParity(cmd, lenbits/8, par);
2143 ReaderTransmitBitsPar(cmd, lenbits, par, NULL); // bytes are 8 bit with odd parity
2144 }
2145 } else { // want to send complete bytes only
2146 if(param & ISO14A_TOPAZMODE) {
2147 uint16_t i = 0;
2148 ReaderTransmitBitsPar(&cmd[i++], 7, NULL, NULL); // first byte: 7 bits, no paritiy
2149 while (i < len) {
2150 ReaderTransmitBitsPar(&cmd[i++], 8, NULL, NULL); // following bytes: 8 bits, no paritiy
2151 }
2152 } else {
2153 ReaderTransmit(cmd,len, NULL); // 8 bits, odd parity
2154 }
2155 }
2156 arg0 = ReaderReceive(buf, par);
2157 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
2158 }
2159
2160 if(param & ISO14A_REQUEST_TRIGGER) {
2161 iso14a_set_trigger(FALSE);
2162 }
2163
2164 if(param & ISO14A_NO_DISCONNECT) {
2165 return;
2166 }
2167
2168 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2169 LEDsoff();
2170 }
2171
2172
2173 // Determine the distance between two nonces.
2174 // Assume that the difference is small, but we don't know which is first.
2175 // Therefore try in alternating directions.
2176 int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
2177
2178 uint16_t i;
2179 uint32_t nttmp1, nttmp2;
2180
2181 if (nt1 == nt2) return 0;
2182
2183 nttmp1 = nt1;
2184 nttmp2 = nt2;
2185
2186 for (i = 1; i < 32768; i++) {
2187 nttmp1 = prng_successor(nttmp1, 1);
2188 if (nttmp1 == nt2) return i;
2189 nttmp2 = prng_successor(nttmp2, 1);
2190 if (nttmp2 == nt1) return -i;
2191 }
2192
2193 return(-99999); // either nt1 or nt2 are invalid nonces
2194 }
2195
2196
2197 //-----------------------------------------------------------------------------
2198 // Recover several bits of the cypher stream. This implements (first stages of)
2199 // the algorithm described in "The Dark Side of Security by Obscurity and
2200 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2201 // (article by Nicolas T. Courtois, 2009)
2202 //-----------------------------------------------------------------------------
2203 void ReaderMifare(bool first_try)
2204 {
2205 // Mifare AUTH
2206 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
2207 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
2208 static uint8_t mf_nr_ar3;
2209
2210 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
2211 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
2212
2213 if (first_try) {
2214 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2215 }
2216
2217 // free eventually allocated BigBuf memory. We want all for tracing.
2218 BigBuf_free();
2219
2220 clear_trace();
2221 set_tracing(TRUE);
2222
2223 byte_t nt_diff = 0;
2224 uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
2225 static byte_t par_low = 0;
2226 bool led_on = TRUE;
2227 uint8_t uid[10] ={0};
2228 uint32_t cuid;
2229
2230 uint32_t nt = 0;
2231 uint32_t previous_nt = 0;
2232 static uint32_t nt_attacked = 0;
2233 byte_t par_list[8] = {0x00};
2234 byte_t ks_list[8] = {0x00};
2235
2236 static uint32_t sync_time = 0;
2237 static uint32_t sync_cycles = 0;
2238 int catch_up_cycles = 0;
2239 int last_catch_up = 0;
2240 uint16_t consecutive_resyncs = 0;
2241 int isOK = 0;
2242
2243 if (first_try) {
2244 mf_nr_ar3 = 0;
2245 sync_time = GetCountSspClk() & 0xfffffff8;
2246 sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
2247 nt_attacked = 0;
2248 nt = 0;
2249 par[0] = 0;
2250 }
2251 else {
2252 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
2253 mf_nr_ar3++;
2254 mf_nr_ar[3] = mf_nr_ar3;
2255 par[0] = par_low;
2256 }
2257
2258 LED_A_ON();
2259 LED_B_OFF();
2260 LED_C_OFF();
2261
2262
2263 #define DARKSIDE_MAX_TRIES 32 // number of tries to sync on PRNG cycle. Then give up.
2264 uint16_t unsuccessfull_tries = 0;
2265
2266 for(uint16_t i = 0; TRUE; i++) {
2267
2268 LED_C_ON();
2269 WDT_HIT();
2270
2271 // Test if the action was cancelled
2272 if(BUTTON_PRESS()) {
2273 isOK = -1;
2274 break;
2275 }
2276
2277 if(!iso14443a_select_card(uid, NULL, &cuid)) {
2278 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
2279 continue;
2280 }
2281
2282 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
2283 catch_up_cycles = 0;
2284
2285 // if we missed the sync time already, advance to the next nonce repeat
2286 while(GetCountSspClk() > sync_time) {
2287 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
2288 }
2289
2290 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2291 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2292
2293 // Receive the (4 Byte) "random" nonce
2294 if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
2295 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2296 continue;
2297 }
2298
2299 previous_nt = nt;
2300 nt = bytes_to_num(receivedAnswer, 4);
2301
2302 // Transmit reader nonce with fake par
2303 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
2304
2305 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2306 int nt_distance = dist_nt(previous_nt, nt);
2307 if (nt_distance == 0) {
2308 nt_attacked = nt;
2309 }
2310 else {
2311 if (nt_distance == -99999) { // invalid nonce received
2312 unsuccessfull_tries++;
2313 if (!nt_attacked && unsuccessfull_tries > DARKSIDE_MAX_TRIES) {
2314 isOK = -3; // Card has an unpredictable PRNG. Give up
2315 break;
2316 } else {
2317 continue; // continue trying...
2318 }
2319 }
2320 sync_cycles = (sync_cycles - nt_distance);
2321 if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
2322 continue;
2323 }
2324 }
2325
2326 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2327 catch_up_cycles = -dist_nt(nt_attacked, nt);
2328 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2329 catch_up_cycles = 0;
2330 continue;
2331 }
2332 if (catch_up_cycles == last_catch_up) {
2333 consecutive_resyncs++;
2334 }
2335 else {
2336 last_catch_up = catch_up_cycles;
2337 consecutive_resyncs = 0;
2338 }
2339 if (consecutive_resyncs < 3) {
2340 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
2341 }
2342 else {
2343 sync_cycles = sync_cycles + catch_up_cycles;
2344 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
2345 }
2346 continue;
2347 }
2348
2349 consecutive_resyncs = 0;
2350
2351 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2352 if (ReaderReceive(receivedAnswer, receivedAnswerPar))
2353 {
2354 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2355
2356 if (nt_diff == 0)
2357 {
2358 par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2359 }
2360
2361 led_on = !led_on;
2362 if(led_on) LED_B_ON(); else LED_B_OFF();
2363
2364 par_list[nt_diff] = SwapBits(par[0], 8);
2365 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2366
2367 // Test if the information is complete
2368 if (nt_diff == 0x07) {
2369 isOK = 1;
2370 break;
2371 }
2372
2373 nt_diff = (nt_diff + 1) & 0x07;
2374 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2375 par[0] = par_low;
2376 } else {
2377 if (nt_diff == 0 && first_try)
2378 {
2379 par[0]++;
2380 if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
2381 isOK = -2;
2382 break;
2383 }
2384 } else {
2385 par[0] = ((par[0] & 0x1F) + 1) | par_low;
2386 }
2387 }
2388 }
2389
2390
2391 mf_nr_ar[3] &= 0x1F;
2392
2393 byte_t buf[28] = {0x00};
2394
2395 memcpy(buf + 0, uid, 4);
2396 num_to_bytes(nt, 4, buf + 4);
2397 memcpy(buf + 8, par_list, 8);
2398 memcpy(buf + 16, ks_list, 8);
2399 memcpy(buf + 24, mf_nr_ar, 4);
2400
2401 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2402
2403 // Thats it...
2404 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2405 LEDsoff();
2406
2407 set_tracing(FALSE);
2408 }
2409
2410
2411 /*
2412 *MIFARE 1K simulate.
2413 *
2414 *@param flags :
2415 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2416 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2417 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2418 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2419 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2420 */
2421 void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
2422 {
2423 int cardSTATE = MFEMUL_NOFIELD;
2424 int _7BUID = 0;
2425 int vHf = 0; // in mV
2426 int res;
2427 uint32_t selTimer = 0;
2428 uint32_t authTimer = 0;
2429 uint16_t len = 0;
2430 uint8_t cardWRBL = 0;
2431 uint8_t cardAUTHSC = 0;
2432 uint8_t cardAUTHKEY = 0xff; // no authentication
2433 // uint32_t cardRr = 0;
2434 uint32_t cuid = 0;
2435 //uint32_t rn_enc = 0;
2436 uint32_t ans = 0;
2437 uint32_t cardINTREG = 0;
2438 uint8_t cardINTBLOCK = 0;
2439 struct Crypto1State mpcs = {0, 0};
2440 struct Crypto1State *pcs;
2441 pcs = &mpcs;
2442 uint32_t numReads = 0;//Counts numer of times reader read a block
2443 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2444 uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE];
2445 uint8_t response[MAX_MIFARE_FRAME_SIZE];
2446 uint8_t response_par[MAX_MIFARE_PARITY_SIZE];
2447
2448 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2449 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2450 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2451 //uint8_t rSAK[] = {0x08, 0xb6, 0xdd}; // Mifare Classic
2452 uint8_t rSAK[] = {0x09, 0x3f, 0xcc }; // Mifare Mini
2453 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
2454
2455 uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
2456 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
2457
2458 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2459 // This can be used in a reader-only attack.
2460 // (it can also be retrieved via 'hf 14a list', but hey...
2461 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
2462 uint8_t ar_nr_collected = 0;
2463
2464 // Authenticate response - nonce
2465 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
2466
2467 //-- Determine the UID
2468 // Can be set from emulator memory, incoming data
2469 // and can be 7 or 4 bytes long
2470 if (flags & FLAG_4B_UID_IN_DATA)
2471 {
2472 // 4B uid comes from data-portion of packet
2473 memcpy(rUIDBCC1,datain,4);
2474 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2475
2476 } else if (flags & FLAG_7B_UID_IN_DATA) {
2477 // 7B uid comes from data-portion of packet
2478 memcpy(&rUIDBCC1[1],datain,3);
2479 memcpy(rUIDBCC2, datain+3, 4);
2480 _7BUID = true;
2481 } else {
2482 // get UID from emul memory
2483 emlGetMemBt(receivedCmd, 7, 1);
2484 _7BUID = !(receivedCmd[0] == 0x00);
2485 if (!_7BUID) { // ---------- 4BUID
2486 emlGetMemBt(rUIDBCC1, 0, 4);
2487 } else { // ---------- 7BUID
2488 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2489 emlGetMemBt(rUIDBCC2, 3, 4);
2490 }
2491 }
2492
2493 // save uid.
2494 ar_nr_responses[0*5] = bytes_to_num(rUIDBCC1+1, 3);
2495 if ( _7BUID )
2496 ar_nr_responses[0*5+1] = bytes_to_num(rUIDBCC2, 4);
2497
2498 /*
2499 * Regardless of what method was used to set the UID, set fifth byte and modify
2500 * the ATQA for 4 or 7-byte UID
2501 */
2502 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2503 if (_7BUID) {
2504 rATQA[0] = 0x44;
2505 rUIDBCC1[0] = 0x88;
2506 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2507 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2508 }
2509
2510 if (MF_DBGLEVEL >= 1) {
2511 if (!_7BUID) {
2512 Dbprintf("4B UID: %02x%02x%02x%02x",
2513 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
2514 } else {
2515 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2516 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
2517 rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
2518 }
2519 }
2520
2521 // We need to listen to the high-frequency, peak-detected path.
2522 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
2523
2524 // free eventually allocated BigBuf memory but keep Emulator Memory
2525 BigBuf_free_keep_EM();
2526
2527 // clear trace
2528 clear_trace();
2529 set_tracing(TRUE);
2530
2531
2532 bool finished = FALSE;
2533 while (!BUTTON_PRESS() && !finished) {
2534 WDT_HIT();
2535
2536 // find reader field
2537 if (cardSTATE == MFEMUL_NOFIELD) {
2538 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
2539 if (vHf > MF_MINFIELDV) {
2540 cardSTATE_TO_IDLE();
2541 LED_A_ON();
2542 }
2543 }
2544 if(cardSTATE == MFEMUL_NOFIELD) continue;
2545
2546 //Now, get data
2547 res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
2548 if (res == 2) { //Field is off!
2549 cardSTATE = MFEMUL_NOFIELD;
2550 LEDsoff();
2551 continue;
2552 } else if (res == 1) {
2553 break; //return value 1 means button press
2554 }
2555
2556 // REQ or WUP request in ANY state and WUP in HALTED state
2557 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2558 selTimer = GetTickCount();
2559 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2560 cardSTATE = MFEMUL_SELECT1;
2561
2562 // init crypto block
2563 LED_B_OFF();
2564 LED_C_OFF();
2565 crypto1_destroy(pcs);
2566 cardAUTHKEY = 0xff;
2567 continue;
2568 }
2569
2570 switch (cardSTATE) {
2571 case MFEMUL_NOFIELD:
2572 case MFEMUL_HALTED:
2573 case MFEMUL_IDLE:{
2574 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2575 break;
2576 }
2577 case MFEMUL_SELECT1:{
2578 // select all
2579 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
2580 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
2581 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
2582 break;
2583 }
2584
2585 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2586 {
2587 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2588 }
2589 // select card
2590 if (len == 9 &&
2591 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
2592 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
2593 cuid = bytes_to_num(rUIDBCC1, 4);
2594 if (!_7BUID) {
2595 cardSTATE = MFEMUL_WORK;
2596 LED_B_ON();
2597 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2598 break;
2599 } else {
2600 cardSTATE = MFEMUL_SELECT2;
2601 }
2602 }
2603 break;
2604 }
2605 case MFEMUL_AUTH1:{
2606 if( len != 8)
2607 {
2608 cardSTATE_TO_IDLE();
2609 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2610 break;
2611 }
2612
2613 uint32_t ar = bytes_to_num(receivedCmd, 4);
2614 uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
2615
2616 //Collect AR/NR
2617 //if(ar_nr_collected < 2 && cardAUTHSC == 2){
2618 if(ar_nr_collected < 2){
2619 if(ar_nr_responses[2] != ar)
2620 {// Avoid duplicates... probably not necessary, ar should vary.
2621 //ar_nr_responses[ar_nr_collected*5] = 0;
2622 //ar_nr_responses[ar_nr_collected*5+1] = 0;
2623 ar_nr_responses[ar_nr_collected*5+2] = nonce;
2624 ar_nr_responses[ar_nr_collected*5+3] = nr;
2625 ar_nr_responses[ar_nr_collected*5+4] = ar;
2626 ar_nr_collected++;
2627 }
2628 // Interactive mode flag, means we need to send ACK
2629 if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
2630 {
2631 finished = true;
2632 }
2633 }
2634
2635 // --- crypto
2636 //crypto1_word(pcs, ar , 1);
2637 //cardRr = nr ^ crypto1_word(pcs, 0, 0);
2638
2639 //test if auth OK
2640 //if (cardRr != prng_successor(nonce, 64)){
2641
2642 //if (MF_DBGLEVEL >= 4) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2643 // cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2644 // cardRr, prng_successor(nonce, 64));
2645 // Shouldn't we respond anything here?
2646 // Right now, we don't nack or anything, which causes the
2647 // reader to do a WUPA after a while. /Martin
2648 // -- which is the correct response. /piwi
2649 //cardSTATE_TO_IDLE();
2650 //LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2651 //break;
2652 //}
2653
2654 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2655
2656 num_to_bytes(ans, 4, rAUTH_AT);
2657 // --- crypto
2658 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2659 LED_C_ON();
2660 cardSTATE = MFEMUL_WORK;
2661 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2662 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2663 GetTickCount() - authTimer);
2664 break;
2665 }
2666 case MFEMUL_SELECT2:{
2667 if (!len) {
2668 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2669 break;
2670 }
2671 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
2672 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
2673 break;
2674 }
2675
2676 // select 2 card
2677 if (len == 9 &&
2678 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2679 EmSendCmd(rSAK, sizeof(rSAK));
2680 cuid = bytes_to_num(rUIDBCC2, 4);
2681 cardSTATE = MFEMUL_WORK;
2682 LED_B_ON();
2683 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
2684 break;
2685 }
2686
2687 // i guess there is a command). go into the work state.
2688 if (len != 4) {
2689 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2690 break;
2691 }
2692 cardSTATE = MFEMUL_WORK;
2693 //goto lbWORK;
2694 //intentional fall-through to the next case-stmt
2695 }
2696
2697 case MFEMUL_WORK:{
2698 if (len == 0) {
2699 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2700 break;
2701 }
2702
2703 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2704
2705 if(encrypted_data) {
2706 // decrypt seqence
2707 mf_crypto1_decrypt(pcs, receivedCmd, len);
2708 }
2709
2710 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2711 authTimer = GetTickCount();
2712 cardAUTHSC = receivedCmd[1] / 4; // received block num
2713 cardAUTHKEY = receivedCmd[0] - 0x60;
2714 crypto1_destroy(pcs);//Added by martin
2715 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
2716
2717 if (!encrypted_data) { // first authentication
2718 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2719
2720 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2721 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
2722 } else { // nested authentication
2723 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2724 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
2725 num_to_bytes(ans, 4, rAUTH_AT);
2726 }
2727
2728 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2729 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2730 cardSTATE = MFEMUL_AUTH1;
2731 break;
2732 }
2733
2734 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2735 // BUT... ACK --> NACK
2736 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2737 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2738 break;
2739 }
2740
2741 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2742 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2743 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2744 break;
2745 }
2746
2747 if(len != 4) {
2748 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2749 break;
2750 }
2751
2752 if(receivedCmd[0] == 0x30 // read block
2753 || receivedCmd[0] == 0xA0 // write block
2754 || receivedCmd[0] == 0xC0 // inc
2755 || receivedCmd[0] == 0xC1 // dec
2756 || receivedCmd[0] == 0xC2 // restore
2757 || receivedCmd[0] == 0xB0) { // transfer
2758 if (receivedCmd[1] >= 16 * 4) {
2759 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2760 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2761 break;
2762 }
2763
2764 if (receivedCmd[1] / 4 != cardAUTHSC) {
2765 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2766 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
2767 break;
2768 }
2769 }
2770 // read block
2771 if (receivedCmd[0] == 0x30) {
2772 if (MF_DBGLEVEL >= 4) {
2773 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2774 }
2775 emlGetMem(response, receivedCmd[1], 1);
2776 AppendCrc14443a(response, 16);
2777 mf_crypto1_encrypt(pcs, response, 18, response_par);
2778 EmSendCmdPar(response, 18, response_par);
2779 numReads++;
2780 if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
2781 Dbprintf("%d reads done, exiting", numReads);
2782 finished = true;
2783 }
2784 break;
2785 }
2786 // write block
2787 if (receivedCmd[0] == 0xA0) {
2788 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
2789 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2790 cardSTATE = MFEMUL_WRITEBL2;
2791 cardWRBL = receivedCmd[1];
2792 break;
2793 }
2794 // increment, decrement, restore
2795 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
2796 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2797 if (emlCheckValBl(receivedCmd[1])) {
2798 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
2799 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2800 break;
2801 }
2802 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2803 if (receivedCmd[0] == 0xC1)
2804 cardSTATE = MFEMUL_INTREG_INC;
2805 if (receivedCmd[0] == 0xC0)
2806 cardSTATE = MFEMUL_INTREG_DEC;
2807 if (receivedCmd[0] == 0xC2)
2808 cardSTATE = MFEMUL_INTREG_REST;
2809 cardWRBL = receivedCmd[1];
2810 break;
2811 }
2812 // transfer
2813 if (receivedCmd[0] == 0xB0) {
2814 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2815 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2816 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2817 else
2818 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2819 break;
2820 }
2821 // halt
2822 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
2823 LED_B_OFF();
2824 LED_C_OFF();
2825 cardSTATE = MFEMUL_HALTED;
2826 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
2827 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2828 break;
2829 }
2830 // RATS
2831 if (receivedCmd[0] == 0xe0) {//RATS
2832 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2833 break;
2834 }
2835 // command not allowed
2836 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2837 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2838 break;
2839 }
2840 case MFEMUL_WRITEBL2:{
2841 if (len == 18){
2842 mf_crypto1_decrypt(pcs, receivedCmd, len);
2843 emlSetMem(receivedCmd, cardWRBL, 1);
2844 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2845 cardSTATE = MFEMUL_WORK;
2846 } else {
2847 cardSTATE_TO_IDLE();
2848 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2849 }
2850 break;
2851 }
2852
2853 case MFEMUL_INTREG_INC:{
2854 mf_crypto1_decrypt(pcs, receivedCmd, len);
2855 memcpy(&ans, receivedCmd, 4);
2856 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2857 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2858 cardSTATE_TO_IDLE();
2859 break;
2860 }
2861 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2862 cardINTREG = cardINTREG + ans;
2863 cardSTATE = MFEMUL_WORK;
2864 break;
2865 }
2866 case MFEMUL_INTREG_DEC:{
2867 mf_crypto1_decrypt(pcs, receivedCmd, len);
2868 memcpy(&ans, receivedCmd, 4);
2869 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2870 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2871 cardSTATE_TO_IDLE();
2872 break;
2873 }
2874 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2875 cardINTREG = cardINTREG - ans;
2876 cardSTATE = MFEMUL_WORK;
2877 break;
2878 }
2879 case MFEMUL_INTREG_REST:{
2880 mf_crypto1_decrypt(pcs, receivedCmd, len);
2881 memcpy(&ans, receivedCmd, 4);
2882 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2883 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2884 cardSTATE_TO_IDLE();
2885 break;
2886 }
2887 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2888 cardSTATE = MFEMUL_WORK;
2889 break;
2890 }
2891 }
2892 }
2893
2894 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2895 LEDsoff();
2896
2897 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2898 {
2899 //May just aswell send the collected ar_nr in the response aswell
2900 uint8_t len = ar_nr_collected*5*4;
2901 cmd_send(CMD_ACK, CMD_SIMULATE_MIFARE_CARD, len, 0, &ar_nr_responses, len);
2902 }
2903
2904 if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
2905 {
2906 if(ar_nr_collected > 1 ) {
2907 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
2908 Dbprintf("../tools/mfkey/mfkey32 %06x%08x %08x %08x %08x %08x %08x",
2909 ar_nr_responses[0], // UID1
2910 ar_nr_responses[1], // UID2
2911 ar_nr_responses[2], // NT
2912 ar_nr_responses[3], // AR1
2913 ar_nr_responses[4], // NR1
2914 ar_nr_responses[8], // AR2
2915 ar_nr_responses[9] // NR2
2916 );
2917 } else {
2918 Dbprintf("Failed to obtain two AR/NR pairs!");
2919 if(ar_nr_collected > 0 ) {
2920 Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
2921 ar_nr_responses[0], // UID1
2922 ar_nr_responses[1], // UID2
2923 ar_nr_responses[2], // NT
2924 ar_nr_responses[3], // AR1
2925 ar_nr_responses[4] // NR1
2926 );
2927 }
2928 }
2929 }
2930 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen());
2931 }
2932
2933
2934 //-----------------------------------------------------------------------------
2935 // MIFARE sniffer.
2936 //
2937 //-----------------------------------------------------------------------------
2938 void RAMFUNC SniffMifare(uint8_t param) {
2939 // param:
2940 // bit 0 - trigger from first card answer
2941 // bit 1 - trigger from first reader 7-bit request
2942
2943 // C(red) A(yellow) B(green)
2944 LEDsoff();
2945 // init trace buffer
2946 clear_trace();
2947 set_tracing(TRUE);
2948
2949 // The command (reader -> tag) that we're receiving.
2950 // The length of a received command will in most cases be no more than 18 bytes.
2951 // So 32 should be enough!
2952 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2953 uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
2954 // The response (tag -> reader) that we're receiving.
2955 uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
2956 uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
2957
2958 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
2959
2960 // free eventually allocated BigBuf memory
2961 BigBuf_free();
2962 // allocate the DMA buffer, used to stream samples from the FPGA
2963 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
2964 uint8_t *data = dmaBuf;
2965 uint8_t previous_data = 0;
2966 int maxDataLen = 0;
2967 int dataLen = 0;
2968 bool ReaderIsActive = FALSE;
2969 bool TagIsActive = FALSE;
2970
2971 // Set up the demodulator for tag -> reader responses.
2972 DemodInit(receivedResponse, receivedResponsePar);
2973
2974 // Set up the demodulator for the reader -> tag commands
2975 UartInit(receivedCmd, receivedCmdPar);
2976
2977 // Setup for the DMA.
2978 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
2979
2980 LED_D_OFF();
2981
2982 // init sniffer
2983 MfSniffInit();
2984
2985 // And now we loop, receiving samples.
2986 for(uint32_t sniffCounter = 0; TRUE; ) {
2987
2988 if(BUTTON_PRESS()) {
2989 DbpString("cancelled by button");
2990 break;
2991 }
2992
2993 LED_A_ON();
2994 WDT_HIT();
2995
2996 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
2997 // check if a transaction is completed (timeout after 2000ms).
2998 // if yes, stop the DMA transfer and send what we have so far to the client
2999 if (MfSniffSend(2000)) {
3000 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
3001 sniffCounter = 0;
3002 data = dmaBuf;
3003 maxDataLen = 0;
3004 ReaderIsActive = FALSE;
3005 TagIsActive = FALSE;
3006 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
3007 }
3008 }
3009
3010 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
3011 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
3012 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
3013 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
3014 } else {
3015 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
3016 }
3017 // test for length of buffer
3018 if(dataLen > maxDataLen) { // we are more behind than ever...
3019 maxDataLen = dataLen;
3020 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
3021 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
3022 break;
3023 }
3024 }
3025 if(dataLen < 1) continue;
3026
3027 // primary buffer was stopped ( <-- we lost data!
3028 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
3029 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
3030 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
3031 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
3032 }
3033 // secondary buffer sets as primary, secondary buffer was stopped
3034 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
3035 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
3036 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
3037 }
3038
3039 LED_A_OFF();
3040
3041 if (sniffCounter & 0x01) {
3042
3043 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
3044 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
3045 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
3046 LED_C_INV();
3047 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
3048
3049 /* And ready to receive another command. */
3050 UartReset();
3051
3052 /* And also reset the demod code */
3053 DemodReset();
3054 }
3055 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
3056 }
3057
3058 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
3059 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
3060 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
3061 LED_C_INV();
3062
3063 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, FALSE)) break;
3064
3065 // And ready to receive another response.
3066 DemodReset();
3067
3068 // And reset the Miller decoder including its (now outdated) input buffer
3069 UartInit(receivedCmd, receivedCmdPar);
3070 }
3071 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
3072 }
3073 }
3074
3075 previous_data = *data;
3076 sniffCounter++;
3077 data++;
3078 if(data == dmaBuf + DMA_BUFFER_SIZE) {
3079 data = dmaBuf;
3080 }
3081
3082 } // main cycle
3083
3084 DbpString("COMMAND FINISHED");
3085
3086 FpgaDisableSscDma();
3087 MfSniffEnd();
3088
3089 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
3090 LEDsoff();
3091 }
Proxmark3 GIT tracking
Impressum, Datenschutz