1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 // Modified by Greg Jones, Jan 2009
4 // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
5 // Modified by piwi, Oct 2018
7 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
8 // at your option, any later version. See the LICENSE.txt file for the text of
10 //-----------------------------------------------------------------------------
11 // Routines to support ISO 15693. This includes both the reader software and
12 // the `fake tag' modes.
13 //-----------------------------------------------------------------------------
15 // The ISO 15693 describes two transmission modes from reader to tag, and four
16 // transmission modes from tag to reader. As of Oct 2018 this code supports
17 // both reader modes and the high speed variant with one subcarrier from card to reader.
18 // As long as the card fully support ISO 15693 this is no problem, since the
19 // reader chooses both data rates, but some non-standard tags do not.
20 // For card simulation, the code supports both high and low speed modes with one subcarrier.
22 // VCD (reader) -> VICC (tag)
24 // data rate: 1,66 kbit/s (fc/8192)
25 // used for long range
27 // data rate: 26,48 kbit/s (fc/512)
28 // used for short range, high speed
30 // VICC (tag) -> VCD (reader)
32 // ASK / one subcarrier (423,75 khz)
33 // FSK / two subcarriers (423,75 khz && 484,28 khz)
34 // Data Rates / Modes:
35 // low ASK: 6,62 kbit/s
36 // low FSK: 6.67 kbit/s
37 // high ASK: 26,48 kbit/s
38 // high FSK: 26,69 kbit/s
39 //-----------------------------------------------------------------------------
43 // *) UID is always used "transmission order" (LSB), which is reverse to display order
45 // TODO / BUGS / ISSUES:
46 // *) signal decoding is unable to detect collisions.
47 // *) add anti-collision support for inventory-commands
48 // *) read security status of a block
49 // *) sniffing and simulation do not support two subcarrier modes.
50 // *) remove or refactor code under "deprecated"
51 // *) document all the functions
55 #include "proxmark3.h"
59 #include "iso15693tools.h"
60 #include "protocols.h"
63 #include "fpgaloader.h"
65 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
69 ///////////////////////////////////////////////////////////////////////
70 // ISO 15693 Part 2 - Air Interface
71 // This section basically contains transmission and receiving of bits
72 ///////////////////////////////////////////////////////////////////////
75 #define ISO15693_DMA_BUFFER_SIZE 2048 // must be a power of 2
76 #define ISO15693_MAX_RESPONSE_LENGTH 36 // allows read single block with the maximum block size of 256bits. Read multiple blocks not supported yet
77 #define ISO15693_MAX_COMMAND_LENGTH 45 // allows write single block with the maximum block size of 256bits. Write multiple blocks not supported yet
79 // ---------------------------
81 // ---------------------------
83 // prepare data using "1 out of 4" code for later transmission
84 // resulting data rate is 26.48 kbit/s (fc/512)
86 // n ... length of data
87 static void CodeIso15693AsReader(uint8_t *cmd
, int n
)
93 // Give it a bit of slack at the beginning
94 for(i
= 0; i
< 24; i
++) {
107 for(i
= 0; i
< n
; i
++) {
108 for(j
= 0; j
< 8; j
+= 2) {
109 int these
= (cmd
[i
] >> j
) & 3;
160 // Fill remainder of last byte with 1
161 for(i
= 0; i
< 4; i
++) {
168 // encode data using "1 out of 256" scheme
169 // data rate is 1,66 kbit/s (fc/8192)
170 // is designed for more robust communication over longer distances
171 static void CodeIso15693AsReader256(uint8_t *cmd
, int n
)
177 // Give it a bit of slack at the beginning
178 for(i
= 0; i
< 24; i
++) {
192 for(i
= 0; i
< n
; i
++) {
193 for (j
= 0; j
<=255; j
++) {
209 // Fill remainder of last byte with 1
210 for(i
= 0; i
< 4; i
++) {
218 // static uint8_t encode4Bits(const uint8_t b) {
219 // uint8_t c = b & 0xF;
220 // // OTA, the least significant bits first
221 // // The columns are
222 // // 1 - Bit value to send
223 // // 2 - Reversed (big-endian)
224 // // 3 - Manchester Encoded
229 // case 15: return 0x55; // 1111 -> 1111 -> 01010101 -> 0x55
230 // case 14: return 0x95; // 1110 -> 0111 -> 10010101 -> 0x95
231 // case 13: return 0x65; // 1101 -> 1011 -> 01100101 -> 0x65
232 // case 12: return 0xa5; // 1100 -> 0011 -> 10100101 -> 0xa5
233 // case 11: return 0x59; // 1011 -> 1101 -> 01011001 -> 0x59
234 // case 10: return 0x99; // 1010 -> 0101 -> 10011001 -> 0x99
235 // case 9: return 0x69; // 1001 -> 1001 -> 01101001 -> 0x69
236 // case 8: return 0xa9; // 1000 -> 0001 -> 10101001 -> 0xa9
237 // case 7: return 0x56; // 0111 -> 1110 -> 01010110 -> 0x56
238 // case 6: return 0x96; // 0110 -> 0110 -> 10010110 -> 0x96
239 // case 5: return 0x66; // 0101 -> 1010 -> 01100110 -> 0x66
240 // case 4: return 0xa6; // 0100 -> 0010 -> 10100110 -> 0xa6
241 // case 3: return 0x5a; // 0011 -> 1100 -> 01011010 -> 0x5a
242 // case 2: return 0x9a; // 0010 -> 0100 -> 10011010 -> 0x9a
243 // case 1: return 0x6a; // 0001 -> 1000 -> 01101010 -> 0x6a
244 // default: return 0xaa; // 0000 -> 0000 -> 10101010 -> 0xaa
249 void CodeIso15693AsTag(uint8_t *cmd
, size_t len
) {
251 * SOF comprises 3 parts;
252 * * An unmodulated time of 56.64 us
253 * * 24 pulses of 423.75 kHz (fc/32)
254 * * A logic 1, which starts with an unmodulated time of 18.88us
255 * followed by 8 pulses of 423.75kHz (fc/32)
257 * EOF comprises 3 parts:
258 * - A logic 0 (which starts with 8 pulses of fc/32 followed by an unmodulated
260 * - 24 pulses of fc/32
261 * - An unmodulated time of 56.64 us
263 * A logic 0 starts with 8 pulses of fc/32
264 * followed by an unmodulated time of 256/fc (~18,88us).
266 * A logic 0 starts with unmodulated time of 256/fc (~18,88us) followed by
267 * 8 pulses of fc/32 (also 18.88us)
269 * A bit here becomes 8 pulses of fc/32. Therefore:
270 * The SOF can be written as 00011101 = 0x1D
271 * The EOF can be written as 10111000 = 0xb8
280 ToSend
[++ToSendMax
] = 0x1D; // 00011101
283 for(int i
= 0; i
< len
; i
++) {
284 for(int j
= 0; j
< 8; j
++) {
285 if ((cmd
[i
] >> j
) & 0x01) {
296 ToSend
[++ToSendMax
] = 0xB8; // 10111000
302 // Transmit the command (to the tag) that was placed in cmd[].
303 static void TransmitTo15693Tag(const uint8_t *cmd
, int len
, uint32_t start_time
)
305 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER
| FPGA_HF_READER_MODE_SEND_FULL_MOD
);
306 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER
);
308 while (GetCountSspClk() < start_time
) ;
311 for(int c
= 0; c
< len
; c
++) {
312 uint8_t data
= cmd
[c
];
313 for (int i
= 0; i
< 8; i
++) {
314 uint16_t send_word
= (data
& 0x80) ? 0x0000 : 0xffff;
315 while (!(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
))) ;
316 AT91C_BASE_SSC
->SSC_THR
= send_word
;
317 while (!(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
))) ;
318 AT91C_BASE_SSC
->SSC_THR
= send_word
;
327 //-----------------------------------------------------------------------------
328 // Transmit the tag response (to the reader) that was placed in cmd[].
329 //-----------------------------------------------------------------------------
330 void TransmitTo15693Reader(const uint8_t *cmd
, size_t len
, uint32_t start_time
, bool slow
) {
331 // don't use the FPGA_HF_SIMULATOR_MODULATE_424K_8BIT minor mode. It would spoil GetCountSspClk()
332 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
| FPGA_HF_SIMULATOR_MODULATE_424K
);
334 uint8_t shift_delay
= start_time
& 0x00000007;
336 while (GetCountSspClk() < (start_time
& 0xfffffff8)) ;
339 uint8_t bits_to_shift
= 0x00;
340 uint8_t bits_to_send
= 0x00;
341 for(size_t c
= 0; c
< len
; c
++) {
342 for (int i
= 7; i
>= 0; i
--) {
343 uint8_t cmd_bits
= ((cmd
[c
] >> i
) & 0x01) ? 0xff : 0x00;
344 for (int j
= 0; j
< (slow
?4:1); ) {
345 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXRDY
) {
346 bits_to_send
= bits_to_shift
<< (8 - shift_delay
) | cmd_bits
>> shift_delay
;
347 AT91C_BASE_SSC
->SSC_THR
= bits_to_send
;
348 bits_to_shift
= cmd_bits
;
355 // send the remaining bits, padded with 0:
356 bits_to_send
= bits_to_shift
<< (8 - shift_delay
);
358 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXRDY
) {
359 AT91C_BASE_SSC
->SSC_THR
= bits_to_send
;
368 //=============================================================================
369 // An ISO 15693 decoder for tag responses (one subcarrier only).
370 // Uses cross correlation to identify each bit and EOF.
371 // This function is called 8 times per bit (every 2 subcarrier cycles).
372 // Subcarrier frequency fs is 424kHz, 1/fs = 2,36us,
373 // i.e. function is called every 4,72us
375 // LED C -> ON once we have received the SOF and are expecting the rest.
376 // LED C -> OFF once we have received EOF or are unsynced
378 // Returns: true if we received a EOF
379 // false if we are still waiting for some more
380 //=============================================================================
382 #define NOISE_THRESHOLD 160 // don't try to correlate noise
384 typedef struct DecodeTag
{
388 STATE_TAG_SOF_HIGH_END
,
389 STATE_TAG_RECEIVING_DATA
,
408 static int inline __attribute__((always_inline
)) Handle15693SamplesFromTag(uint16_t amplitude
, DecodeTag_t
*DecodeTag
)
410 switch(DecodeTag
->state
) {
411 case STATE_TAG_SOF_LOW
:
412 // waiting for 12 times low (11 times low is accepted as well)
413 if (amplitude
< NOISE_THRESHOLD
) {
414 DecodeTag
->posCount
++;
416 if (DecodeTag
->posCount
> 10) {
417 DecodeTag
->posCount
= 1;
419 DecodeTag
->state
= STATE_TAG_SOF_HIGH
;
421 DecodeTag
->posCount
= 0;
426 case STATE_TAG_SOF_HIGH
:
427 // waiting for 10 times high. Take average over the last 8
428 if (amplitude
> NOISE_THRESHOLD
) {
429 DecodeTag
->posCount
++;
430 if (DecodeTag
->posCount
> 2) {
431 DecodeTag
->sum1
+= amplitude
; // keep track of average high value
433 if (DecodeTag
->posCount
== 10) {
434 DecodeTag
->sum1
>>= 4; // calculate half of average high value (8 samples)
435 DecodeTag
->state
= STATE_TAG_SOF_HIGH_END
;
437 } else { // high phase was too short
438 DecodeTag
->posCount
= 1;
439 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
443 case STATE_TAG_SOF_HIGH_END
:
444 // waiting for a falling edge
445 if (amplitude
< DecodeTag
->sum1
) { // signal drops below 50% average high: a falling edge
446 DecodeTag
->lastBit
= SOF_PART1
; // detected 1st part of SOF (12 samples low and 12 samples high)
447 DecodeTag
->shiftReg
= 0;
448 DecodeTag
->bitCount
= 0;
450 DecodeTag
->sum1
= amplitude
;
452 DecodeTag
->posCount
= 2;
453 DecodeTag
->state
= STATE_TAG_RECEIVING_DATA
;
456 DecodeTag
->posCount
++;
457 if (DecodeTag
->posCount
> 13) { // high phase too long
458 DecodeTag
->posCount
= 0;
459 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
465 case STATE_TAG_RECEIVING_DATA
:
466 if (DecodeTag
->posCount
== 1) {
470 if (DecodeTag
->posCount
<= 4) {
471 DecodeTag
->sum1
+= amplitude
;
473 DecodeTag
->sum2
+= amplitude
;
475 if (DecodeTag
->posCount
== 8) {
476 int32_t corr_1
= DecodeTag
->sum2
- DecodeTag
->sum1
;
477 int32_t corr_0
= -corr_1
;
478 int32_t corr_EOF
= (DecodeTag
->sum1
+ DecodeTag
->sum2
) / 2;
479 if (corr_EOF
> corr_0
&& corr_EOF
> corr_1
) {
480 if (DecodeTag
->lastBit
== LOGIC0
) { // this was already part of EOF
481 DecodeTag
->state
= STATE_TAG_EOF
;
483 DecodeTag
->posCount
= 0;
484 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
487 } else if (corr_1
> corr_0
) {
489 if (DecodeTag
->lastBit
== SOF_PART1
) { // still part of SOF
490 DecodeTag
->lastBit
= SOF_PART2
; // SOF completed
492 DecodeTag
->lastBit
= LOGIC1
;
493 DecodeTag
->shiftReg
>>= 1;
494 DecodeTag
->shiftReg
|= 0x80;
495 DecodeTag
->bitCount
++;
496 if (DecodeTag
->bitCount
== 8) {
497 DecodeTag
->output
[DecodeTag
->len
] = DecodeTag
->shiftReg
;
499 if (DecodeTag
->len
> DecodeTag
->max_len
) {
500 // buffer overflow, give up
501 DecodeTag
->posCount
= 0;
502 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
505 DecodeTag
->bitCount
= 0;
506 DecodeTag
->shiftReg
= 0;
511 if (DecodeTag
->lastBit
== SOF_PART1
) { // incomplete SOF
512 DecodeTag
->posCount
= 0;
513 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
516 DecodeTag
->lastBit
= LOGIC0
;
517 DecodeTag
->shiftReg
>>= 1;
518 DecodeTag
->bitCount
++;
519 if (DecodeTag
->bitCount
== 8) {
520 DecodeTag
->output
[DecodeTag
->len
] = DecodeTag
->shiftReg
;
522 if (DecodeTag
->len
> DecodeTag
->max_len
) {
523 // buffer overflow, give up
524 DecodeTag
->posCount
= 0;
525 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
528 DecodeTag
->bitCount
= 0;
529 DecodeTag
->shiftReg
= 0;
533 DecodeTag
->posCount
= 0;
535 DecodeTag
->posCount
++;
539 if (DecodeTag
->posCount
== 1) {
543 if (DecodeTag
->posCount
<= 4) {
544 DecodeTag
->sum1
+= amplitude
;
546 DecodeTag
->sum2
+= amplitude
;
548 if (DecodeTag
->posCount
== 8) {
549 int32_t corr_1
= DecodeTag
->sum2
- DecodeTag
->sum1
;
550 int32_t corr_0
= -corr_1
;
551 int32_t corr_EOF
= (DecodeTag
->sum1
+ DecodeTag
->sum2
) / 2;
552 if (corr_EOF
> corr_0
|| corr_1
> corr_0
) {
553 DecodeTag
->posCount
= 0;
554 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
561 DecodeTag
->posCount
++;
570 static void DecodeTagInit(DecodeTag_t
*DecodeTag
, uint8_t *data
, uint16_t max_len
)
572 DecodeTag
->posCount
= 0;
573 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
574 DecodeTag
->output
= data
;
575 DecodeTag
->max_len
= max_len
;
579 static void DecodeTagReset(DecodeTag_t
*DecodeTag
)
581 DecodeTag
->posCount
= 0;
582 DecodeTag
->state
= STATE_TAG_SOF_LOW
;
587 * Receive and decode the tag response, also log to tracebuffer
589 static int GetIso15693AnswerFromTag(uint8_t* response
, uint16_t max_len
, int timeout
)
592 bool gotFrame
= false;
594 uint16_t *dmaBuf
= (uint16_t*)BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE
*sizeof(uint16_t));
596 // the Decoder data structure
597 DecodeTag_t DecodeTag
= { 0 };
598 DecodeTagInit(&DecodeTag
, response
, max_len
);
600 // wait for last transfer to complete
601 while (!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXEMPTY
));
603 // And put the FPGA in the appropriate mode
604 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER
| FPGA_HF_READER_SUBCARRIER_424_KHZ
| FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE
);
606 // Setup and start DMA.
607 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER
);
608 FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO15693_DMA_BUFFER_SIZE
);
609 uint16_t *upTo
= dmaBuf
;
612 uint16_t behindBy
= ((uint16_t*)AT91C_BASE_PDC_SSC
->PDC_RPR
- upTo
) & (ISO15693_DMA_BUFFER_SIZE
-1);
614 if (behindBy
== 0) continue;
616 uint16_t tagdata
= *upTo
++;
618 if(upTo
>= dmaBuf
+ ISO15693_DMA_BUFFER_SIZE
) { // we have read all of the DMA buffer content.
619 upTo
= dmaBuf
; // start reading the circular buffer from the beginning
620 if(behindBy
> (9*ISO15693_DMA_BUFFER_SIZE
/10)) {
621 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy
);
625 if (AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_ENDRX
)) { // DMA Counter Register had reached 0, already rotated.
626 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
; // refresh the DMA Next Buffer and
627 AT91C_BASE_PDC_SSC
->PDC_RNCR
= ISO15693_DMA_BUFFER_SIZE
; // DMA Next Counter registers
632 if (Handle15693SamplesFromTag(tagdata
, &DecodeTag
)) {
637 if (samples
> timeout
&& DecodeTag
.state
< STATE_TAG_RECEIVING_DATA
) {
647 if (DEBUG
) Dbprintf("samples = %d, gotFrame = %d, Decoder: state = %d, len = %d, bitCount = %d, posCount = %d",
648 samples
, gotFrame
, DecodeTag
.state
, DecodeTag
.len
, DecodeTag
.bitCount
, DecodeTag
.posCount
);
650 if (DecodeTag
.len
> 0) {
651 LogTrace(DecodeTag
.output
, DecodeTag
.len
, 0, 0, NULL
, false);
654 return DecodeTag
.len
;
658 //=============================================================================
659 // An ISO15693 decoder for reader commands.
661 // This function is called 4 times per bit (every 2 subcarrier cycles).
662 // Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
664 // LED B -> ON once we have received the SOF and are expecting the rest.
665 // LED B -> OFF once we have received EOF or are in error state or unsynced
667 // Returns: true if we received a EOF
668 // false if we are still waiting for some more
669 //=============================================================================
671 typedef struct DecodeReader
{
673 STATE_READER_UNSYNCD
,
674 STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF
,
675 STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF
,
676 STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF
,
677 STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF
,
678 STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4
,
679 STATE_READER_RECEIVE_DATA_1_OUT_OF_4
,
680 STATE_READER_RECEIVE_DATA_1_OUT_OF_256
696 static void DecodeReaderInit(DecodeReader_t
* DecodeReader
, uint8_t *data
, uint16_t max_len
)
698 DecodeReader
->output
= data
;
699 DecodeReader
->byteCountMax
= max_len
;
700 DecodeReader
->state
= STATE_READER_UNSYNCD
;
701 DecodeReader
->byteCount
= 0;
702 DecodeReader
->bitCount
= 0;
703 DecodeReader
->posCount
= 1;
704 DecodeReader
->shiftReg
= 0;
708 static void DecodeReaderReset(DecodeReader_t
* DecodeReader
)
710 DecodeReader
->state
= STATE_READER_UNSYNCD
;
714 static int inline __attribute__((always_inline
)) Handle15693SampleFromReader(uint8_t bit
, DecodeReader_t
*restrict DecodeReader
)
716 switch (DecodeReader
->state
) {
717 case STATE_READER_UNSYNCD
:
718 // wait for unmodulated carrier
720 DecodeReader
->state
= STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF
;
724 case STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF
:
726 // we went low, so this could be the beginning of a SOF
727 DecodeReader
->posCount
= 1;
728 DecodeReader
->state
= STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF
;
732 case STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF
:
733 DecodeReader
->posCount
++;
734 if (bit
) { // detected rising edge
735 if (DecodeReader
->posCount
< 4) { // rising edge too early (nominally expected at 5)
736 DecodeReader
->state
= STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF
;
738 DecodeReader
->state
= STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF
;
741 if (DecodeReader
->posCount
> 5) { // stayed low for too long
742 DecodeReaderReset(DecodeReader
);
744 // do nothing, keep waiting
749 case STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF
:
750 DecodeReader
->posCount
++;
751 if (!bit
) { // detected a falling edge
752 if (DecodeReader
->posCount
< 20) { // falling edge too early (nominally expected at 21 earliest)
753 DecodeReaderReset(DecodeReader
);
754 } else if (DecodeReader
->posCount
< 23) { // SOF for 1 out of 4 coding
755 DecodeReader
->Coding
= CODING_1_OUT_OF_4
;
756 DecodeReader
->state
= STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF
;
757 } else if (DecodeReader
->posCount
< 28) { // falling edge too early (nominally expected at 29 latest)
758 DecodeReaderReset(DecodeReader
);
759 } else { // SOF for 1 out of 256 coding
760 DecodeReader
->Coding
= CODING_1_OUT_OF_256
;
761 DecodeReader
->state
= STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF
;
764 if (DecodeReader
->posCount
> 29) { // stayed high for too long
765 DecodeReader
->state
= STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF
;
767 // do nothing, keep waiting
772 case STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF
:
773 DecodeReader
->posCount
++;
774 if (bit
) { // detected rising edge
775 if (DecodeReader
->Coding
== CODING_1_OUT_OF_256
) {
776 if (DecodeReader
->posCount
< 32) { // rising edge too early (nominally expected at 33)
777 DecodeReader
->state
= STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF
;
779 DecodeReader
->posCount
= 1;
780 DecodeReader
->bitCount
= 0;
781 DecodeReader
->byteCount
= 0;
782 DecodeReader
->sum1
= 1;
783 DecodeReader
->state
= STATE_READER_RECEIVE_DATA_1_OUT_OF_256
;
786 } else { // CODING_1_OUT_OF_4
787 if (DecodeReader
->posCount
< 24) { // rising edge too early (nominally expected at 25)
788 DecodeReader
->state
= STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF
;
790 DecodeReader
->posCount
= 1;
791 DecodeReader
->state
= STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4
;
795 if (DecodeReader
->Coding
== CODING_1_OUT_OF_256
) {
796 if (DecodeReader
->posCount
> 34) { // signal stayed low for too long
797 DecodeReaderReset(DecodeReader
);
799 // do nothing, keep waiting
801 } else { // CODING_1_OUT_OF_4
802 if (DecodeReader
->posCount
> 26) { // signal stayed low for too long
803 DecodeReaderReset(DecodeReader
);
805 // do nothing, keep waiting
811 case STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4
:
812 DecodeReader
->posCount
++;
814 if (DecodeReader
->posCount
== 9) {
815 DecodeReader
->posCount
= 1;
816 DecodeReader
->bitCount
= 0;
817 DecodeReader
->byteCount
= 0;
818 DecodeReader
->sum1
= 1;
819 DecodeReader
->state
= STATE_READER_RECEIVE_DATA_1_OUT_OF_4
;
822 // do nothing, keep waiting
824 } else { // unexpected falling edge
825 DecodeReaderReset(DecodeReader
);
829 case STATE_READER_RECEIVE_DATA_1_OUT_OF_4
:
831 DecodeReader
->posCount
++;
832 if (DecodeReader
->posCount
== 1) {
833 DecodeReader
->sum1
= bit
;
834 } else if (DecodeReader
->posCount
<= 4) {
835 DecodeReader
->sum1
+= bit
;
836 } else if (DecodeReader
->posCount
== 5) {
837 DecodeReader
->sum2
= bit
;
839 DecodeReader
->sum2
+= bit
;
841 if (DecodeReader
->posCount
== 8) {
842 DecodeReader
->posCount
= 0;
843 if (DecodeReader
->sum1
<= 1 && DecodeReader
->sum2
>= 3) { // EOF
844 LED_B_OFF(); // Finished receiving
845 DecodeReaderReset(DecodeReader
);
846 if (DecodeReader
->byteCount
!= 0) {
850 if (DecodeReader
->sum1
>= 3 && DecodeReader
->sum2
<= 1) { // detected a 2bit position
851 DecodeReader
->shiftReg
>>= 2;
852 DecodeReader
->shiftReg
|= (DecodeReader
->bitCount
<< 6);
854 if (DecodeReader
->bitCount
== 15) { // we have a full byte
855 DecodeReader
->output
[DecodeReader
->byteCount
++] = DecodeReader
->shiftReg
;
856 if (DecodeReader
->byteCount
> DecodeReader
->byteCountMax
) {
857 // buffer overflow, give up
859 DecodeReaderReset(DecodeReader
);
861 DecodeReader
->bitCount
= 0;
862 DecodeReader
->shiftReg
= 0;
864 DecodeReader
->bitCount
++;
869 case STATE_READER_RECEIVE_DATA_1_OUT_OF_256
:
871 DecodeReader
->posCount
++;
872 if (DecodeReader
->posCount
== 1) {
873 DecodeReader
->sum1
= bit
;
874 } else if (DecodeReader
->posCount
<= 4) {
875 DecodeReader
->sum1
+= bit
;
876 } else if (DecodeReader
->posCount
== 5) {
877 DecodeReader
->sum2
= bit
;
879 DecodeReader
->sum2
+= bit
;
881 if (DecodeReader
->posCount
== 8) {
882 DecodeReader
->posCount
= 0;
883 if (DecodeReader
->sum1
<= 1 && DecodeReader
->sum2
>= 3) { // EOF
884 LED_B_OFF(); // Finished receiving
885 DecodeReaderReset(DecodeReader
);
886 if (DecodeReader
->byteCount
!= 0) {
890 if (DecodeReader
->sum1
>= 3 && DecodeReader
->sum2
<= 1) { // detected the bit position
891 DecodeReader
->shiftReg
= DecodeReader
->bitCount
;
893 if (DecodeReader
->bitCount
== 255) { // we have a full byte
894 DecodeReader
->output
[DecodeReader
->byteCount
++] = DecodeReader
->shiftReg
;
895 if (DecodeReader
->byteCount
> DecodeReader
->byteCountMax
) {
896 // buffer overflow, give up
898 DecodeReaderReset(DecodeReader
);
901 DecodeReader
->bitCount
++;
907 DecodeReaderReset(DecodeReader
);
915 //-----------------------------------------------------------------------------
916 // Receive a command (from the reader to us, where we are the simulated tag),
917 // and store it in the given buffer, up to the given maximum length. Keeps
918 // spinning, waiting for a well-framed command, until either we get one
919 // (returns len) or someone presses the pushbutton on the board (returns -1).
921 // Assume that we're called with the SSC (to the FPGA) and ADC path set
923 //-----------------------------------------------------------------------------
925 int GetIso15693CommandFromReader(uint8_t *received
, size_t max_len
, uint32_t *eof_time
) {
927 bool gotFrame
= false;
930 uint8_t dmaBuf
[ISO15693_DMA_BUFFER_SIZE
];
932 // the decoder data structure
933 DecodeReader_t DecodeReader
= {0};
934 DecodeReaderInit(&DecodeReader
, received
, max_len
);
936 // wait for last transfer to complete
937 while (!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXEMPTY
));
940 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
| FPGA_HF_SIMULATOR_NO_MODULATION
);
942 // clear receive register and wait for next transfer
943 uint32_t temp
= AT91C_BASE_SSC
->SSC_RHR
;
945 while (!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
)) ;
947 uint32_t dma_start_time
= GetCountSspClk() & 0xfffffff8;
949 // Setup and start DMA.
950 FpgaSetupSscDma(dmaBuf
, ISO15693_DMA_BUFFER_SIZE
);
951 uint8_t *upTo
= dmaBuf
;
954 uint16_t behindBy
= ((uint8_t*)AT91C_BASE_PDC_SSC
->PDC_RPR
- upTo
) & (ISO15693_DMA_BUFFER_SIZE
-1);
956 if (behindBy
== 0) continue;
959 if (upTo
>= dmaBuf
+ ISO15693_DMA_BUFFER_SIZE
) { // we have read all of the DMA buffer content.
960 upTo
= dmaBuf
; // start reading the circular buffer from the beginning
961 if (behindBy
> (9*ISO15693_DMA_BUFFER_SIZE
/10)) {
962 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy
);
966 if (AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_ENDRX
)) { // DMA Counter Register had reached 0, already rotated.
967 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
; // refresh the DMA Next Buffer and
968 AT91C_BASE_PDC_SSC
->PDC_RNCR
= ISO15693_DMA_BUFFER_SIZE
; // DMA Next Counter registers
971 for (int i
= 7; i
>= 0; i
--) {
972 if (Handle15693SampleFromReader((b
>> i
) & 0x01, &DecodeReader
)) {
973 *eof_time
= dma_start_time
+ samples
- DELAY_READER_TO_ARM_SIM
; // end of EOF
984 if (BUTTON_PRESS()) {
985 DecodeReader
.byteCount
= -1;
994 if (DEBUG
) Dbprintf("samples = %d, gotFrame = %d, Decoder: state = %d, len = %d, bitCount = %d, posCount = %d",
995 samples
, gotFrame
, DecodeReader
.state
, DecodeReader
.byteCount
, DecodeReader
.bitCount
, DecodeReader
.posCount
);
997 if (DecodeReader
.byteCount
> 0) {
998 uint32_t sof_time
= *eof_time
999 - DecodeReader
.byteCount
* (DecodeReader
.Coding
==CODING_1_OUT_OF_4
?128:2048) // time for byte transfers
1000 - 32 // time for SOF transfer
1001 - 16; // time for EOF transfer
1002 LogTrace(DecodeReader
.output
, DecodeReader
.byteCount
, sof_time
, *eof_time
, NULL
, true);
1005 return DecodeReader
.byteCount
;
1009 // Encode (into the ToSend buffers) an identify request, which is the first
1010 // thing that you must send to a tag to get a response.
1011 static void BuildIdentifyRequest(void)
1016 // one sub-carrier, inventory, 1 slot, fast rate
1017 // AFI is at bit 5 (1<<4) when doing an INVENTORY
1018 cmd
[0] = (1 << 2) | (1 << 5) | (1 << 1);
1019 // inventory command code
1024 crc
= Iso15693Crc(cmd
, 3);
1025 cmd
[3] = crc
& 0xff;
1028 CodeIso15693AsReader(cmd
, sizeof(cmd
));
1032 //-----------------------------------------------------------------------------
1033 // Start to read an ISO 15693 tag. We send an identify request, then wait
1034 // for the response. The response is not demodulated, just left in the buffer
1035 // so that it can be downloaded to a PC and processed there.
1036 //-----------------------------------------------------------------------------
1037 void AcquireRawAdcSamplesIso15693(void)
1042 uint8_t *dest
= BigBuf_get_addr();
1044 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1045 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER
);
1046 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER
);
1047 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1049 BuildIdentifyRequest();
1051 // Give the tags time to energize
1055 // Now send the command
1056 TransmitTo15693Tag(ToSend
, ToSendMax
, 0);
1058 // wait for last transfer to complete
1059 while (!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXEMPTY
)) ;
1061 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER
| FPGA_HF_READER_SUBCARRIER_424_KHZ
| FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE
);
1063 for(int c
= 0; c
< 4000; ) {
1064 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1065 uint16_t r
= AT91C_BASE_SSC
->SSC_RHR
;
1070 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1075 void SnoopIso15693(void)
1078 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1084 // The DMA buffer, used to stream samples from the FPGA
1085 uint16_t* dmaBuf
= (uint16_t*)BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE
*sizeof(uint16_t));
1088 // Count of samples received so far, so that we can include timing
1089 // information in the trace buffer.
1092 DecodeTag_t DecodeTag
= {0};
1093 uint8_t response
[ISO15693_MAX_RESPONSE_LENGTH
];
1094 DecodeTagInit(&DecodeTag
, response
, sizeof(response
));
1096 DecodeReader_t DecodeReader
= {0};;
1097 uint8_t cmd
[ISO15693_MAX_COMMAND_LENGTH
];
1098 DecodeReaderInit(&DecodeReader
, cmd
, sizeof(cmd
));
1100 // Print some debug information about the buffer sizes
1102 Dbprintf("Snooping buffers initialized:");
1103 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1104 Dbprintf(" Reader -> tag: %i bytes", ISO15693_MAX_COMMAND_LENGTH
);
1105 Dbprintf(" tag -> Reader: %i bytes", ISO15693_MAX_RESPONSE_LENGTH
);
1106 Dbprintf(" DMA: %i bytes", ISO15693_DMA_BUFFER_SIZE
* sizeof(uint16_t));
1108 Dbprintf("Snoop started. Press PM3 Button to stop.");
1110 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER
| FPGA_HF_READER_MODE_SNOOP_AMPLITUDE
);
1111 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1113 // Setup for the DMA.
1114 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER
);
1116 FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO15693_DMA_BUFFER_SIZE
);
1118 bool TagIsActive
= false;
1119 bool ReaderIsActive
= false;
1120 bool ExpectTagAnswer
= false;
1122 // And now we loop, receiving samples.
1124 uint16_t behindBy
= ((uint16_t*)AT91C_BASE_PDC_SSC
->PDC_RPR
- upTo
) & (ISO15693_DMA_BUFFER_SIZE
-1);
1126 if (behindBy
== 0) continue;
1128 uint16_t snoopdata
= *upTo
++;
1130 if(upTo
>= dmaBuf
+ ISO15693_DMA_BUFFER_SIZE
) { // we have read all of the DMA buffer content.
1131 upTo
= dmaBuf
; // start reading the circular buffer from the beginning
1132 if(behindBy
> (9*ISO15693_DMA_BUFFER_SIZE
/10)) {
1133 Dbprintf("About to blow circular buffer - aborted! behindBy=%d, samples=%d", behindBy
, samples
);
1136 if (AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_ENDRX
)) { // DMA Counter Register had reached 0, already rotated.
1137 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
; // refresh the DMA Next Buffer and
1138 AT91C_BASE_PDC_SSC
->PDC_RNCR
= ISO15693_DMA_BUFFER_SIZE
; // DMA Next Counter registers
1140 if(BUTTON_PRESS()) {
1141 DbpString("Snoop stopped.");
1148 if (!TagIsActive
) { // no need to try decoding reader data if the tag is sending
1149 if (Handle15693SampleFromReader(snoopdata
& 0x02, &DecodeReader
)) {
1150 FpgaDisableSscDma();
1151 ExpectTagAnswer
= true;
1152 LogTrace(DecodeReader
.output
, DecodeReader
.byteCount
, samples
, samples
, NULL
, true);
1153 /* And ready to receive another command. */
1154 DecodeReaderReset(&DecodeReader
);
1155 /* And also reset the demod code, which might have been */
1156 /* false-triggered by the commands from the reader. */
1157 DecodeTagReset(&DecodeTag
);
1159 FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO15693_DMA_BUFFER_SIZE
);
1161 if (Handle15693SampleFromReader(snoopdata
& 0x01, &DecodeReader
)) {
1162 FpgaDisableSscDma();
1163 ExpectTagAnswer
= true;
1164 LogTrace(DecodeReader
.output
, DecodeReader
.byteCount
, samples
, samples
, NULL
, true);
1165 /* And ready to receive another command. */
1166 DecodeReaderReset(&DecodeReader
);
1167 /* And also reset the demod code, which might have been */
1168 /* false-triggered by the commands from the reader. */
1169 DecodeTagReset(&DecodeTag
);
1171 FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO15693_DMA_BUFFER_SIZE
);
1173 ReaderIsActive
= (DecodeReader
.state
>= STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF
);
1176 if (!ReaderIsActive
&& ExpectTagAnswer
) { // no need to try decoding tag data if the reader is currently sending or no answer expected yet
1177 if (Handle15693SamplesFromTag(snoopdata
>> 2, &DecodeTag
)) {
1178 FpgaDisableSscDma();
1179 //Use samples as a time measurement
1180 LogTrace(DecodeTag
.output
, DecodeTag
.len
, samples
, samples
, NULL
, false);
1181 // And ready to receive another response.
1182 DecodeTagReset(&DecodeTag
);
1183 DecodeReaderReset(&DecodeReader
);
1184 ExpectTagAnswer
= false;
1186 FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO15693_DMA_BUFFER_SIZE
);
1188 TagIsActive
= (DecodeTag
.state
>= STATE_TAG_RECEIVING_DATA
);
1193 FpgaDisableSscDma();
1198 DbpString("Snoop statistics:");
1199 Dbprintf(" ExpectTagAnswer: %d", ExpectTagAnswer
);
1200 Dbprintf(" DecodeTag State: %d", DecodeTag
.state
);
1201 Dbprintf(" DecodeTag byteCnt: %d", DecodeTag
.len
);
1202 Dbprintf(" DecodeReader State: %d", DecodeReader
.state
);
1203 Dbprintf(" DecodeReader byteCnt: %d", DecodeReader
.byteCount
);
1204 Dbprintf(" Trace length: %d", BigBuf_get_traceLen());
1208 // Initialize the proxmark as iso15k reader
1209 static void Iso15693InitReader() {
1210 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1214 // Start from off (no field generated)
1216 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1219 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1220 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER
);
1222 // Give the tags time to energize
1224 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER
);
1228 ///////////////////////////////////////////////////////////////////////
1229 // ISO 15693 Part 3 - Air Interface
1230 // This section basically contains transmission and receiving of bits
1231 ///////////////////////////////////////////////////////////////////////
1234 // uid is in transmission order (which is reverse of display order)
1235 static void BuildReadBlockRequest(uint8_t *uid
, uint8_t blockNumber
)
1240 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1241 // followed by the block data
1242 cmd
[0] = ISO15693_REQ_OPTION
| ISO15693_REQ_ADDRESS
| ISO15693_REQ_DATARATE_HIGH
;
1243 // READ BLOCK command code
1244 cmd
[1] = ISO15693_READBLOCK
;
1245 // UID may be optionally specified here
1254 cmd
[9] = uid
[7]; // 0xe0; // always e0 (not exactly unique)
1255 // Block number to read
1256 cmd
[10] = blockNumber
;
1258 crc
= Iso15693Crc(cmd
, 11); // the crc needs to be calculated over 11 bytes
1259 cmd
[11] = crc
& 0xff;
1262 CodeIso15693AsReader(cmd
, sizeof(cmd
));
1266 // Now the VICC>VCD responses when we are simulating a tag
1267 static void BuildInventoryResponse(uint8_t *uid
)
1273 cmd
[0] = 0; // No error, no protocol format extension
1274 cmd
[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported
1276 cmd
[2] = uid
[7]; //0x32;
1277 cmd
[3] = uid
[6]; //0x4b;
1278 cmd
[4] = uid
[5]; //0x03;
1279 cmd
[5] = uid
[4]; //0x01;
1280 cmd
[6] = uid
[3]; //0x00;
1281 cmd
[7] = uid
[2]; //0x10;
1282 cmd
[8] = uid
[1]; //0x05;
1283 cmd
[9] = uid
[0]; //0xe0;
1285 crc
= Iso15693Crc(cmd
, 10);
1286 cmd
[10] = crc
& 0xff;
1289 CodeIso15693AsTag(cmd
, sizeof(cmd
));
1292 // Universal Method for sending to and recv bytes from a tag
1293 // init ... should we initialize the reader?
1294 // speed ... 0 low speed, 1 hi speed
1295 // *recv will contain the tag's answer
1296 // return: lenght of received data
1297 int SendDataTag(uint8_t *send
, int sendlen
, bool init
, int speed
, uint8_t *recv
, uint16_t max_recv_len
, uint32_t start_time
) {
1303 if (init
) Iso15693InitReader();
1308 // low speed (1 out of 256)
1309 CodeIso15693AsReader256(send
, sendlen
);
1311 // high speed (1 out of 4)
1312 CodeIso15693AsReader(send
, sendlen
);
1315 TransmitTo15693Tag(ToSend
, ToSendMax
, start_time
);
1317 // Now wait for a response
1319 answerLen
= GetIso15693AnswerFromTag(recv
, max_recv_len
, DELAY_ISO15693_VCD_TO_VICC_READER
* 2);
1328 // --------------------------------------------------------------------
1330 // --------------------------------------------------------------------
1332 // Decodes a message from a tag and displays its metadata and content
1333 #define DBD15STATLEN 48
1334 void DbdecodeIso15693Answer(int len
, uint8_t *d
) {
1335 char status
[DBD15STATLEN
+1]={0};
1339 if (d
[0] & ISO15693_RES_EXT
)
1340 strncat(status
,"ProtExt ", DBD15STATLEN
);
1341 if (d
[0] & ISO15693_RES_ERROR
) {
1343 strncat(status
,"Error ", DBD15STATLEN
);
1346 strncat(status
,"01:notSupp", DBD15STATLEN
);
1349 strncat(status
,"02:notRecog", DBD15STATLEN
);
1352 strncat(status
,"03:optNotSupp", DBD15STATLEN
);
1355 strncat(status
,"0f:noInfo", DBD15STATLEN
);
1358 strncat(status
,"10:doesn'tExist", DBD15STATLEN
);
1361 strncat(status
,"11:lockAgain", DBD15STATLEN
);
1364 strncat(status
,"12:locked", DBD15STATLEN
);
1367 strncat(status
,"13:progErr", DBD15STATLEN
);
1370 strncat(status
,"14:lockErr", DBD15STATLEN
);
1373 strncat(status
,"unknownErr", DBD15STATLEN
);
1375 strncat(status
," ", DBD15STATLEN
);
1377 strncat(status
,"NoErr ", DBD15STATLEN
);
1380 crc
=Iso15693Crc(d
,len
-2);
1381 if ( (( crc
& 0xff ) == d
[len
-2]) && (( crc
>> 8 ) == d
[len
-1]) )
1382 strncat(status
,"CrcOK",DBD15STATLEN
);
1384 strncat(status
,"CrcFail!",DBD15STATLEN
);
1386 Dbprintf("%s",status
);
1392 ///////////////////////////////////////////////////////////////////////
1393 // Functions called via USB/Client
1394 ///////////////////////////////////////////////////////////////////////
1396 void SetDebugIso15693(uint32_t debug
) {
1398 Dbprintf("Iso15693 Debug is now %s",DEBUG
?"on":"off");
1403 //---------------------------------------------------------------------------------------
1404 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector.
1405 // all demodulation performed in arm rather than host. - greg
1406 //---------------------------------------------------------------------------------------
1407 void ReaderIso15693(uint32_t parameter
)
1415 uint8_t TagUID
[8] = {0x00};
1417 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1419 uint8_t answer
[ISO15693_MAX_RESPONSE_LENGTH
];
1421 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1423 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER
);
1425 // Start from off (no field generated)
1426 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1429 // Give the tags time to energize
1431 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER
);
1436 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
1437 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
1439 // Now send the IDENTIFY command
1440 BuildIdentifyRequest();
1441 TransmitTo15693Tag(ToSend
, ToSendMax
, 0);
1443 // Now wait for a response
1444 answerLen
= GetIso15693AnswerFromTag(answer
, sizeof(answer
), DELAY_ISO15693_VCD_TO_VICC_READER
* 2) ;
1445 uint32_t start_time
= GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER
;
1447 if (answerLen
>=12) // we should do a better check than this
1449 TagUID
[0] = answer
[2];
1450 TagUID
[1] = answer
[3];
1451 TagUID
[2] = answer
[4];
1452 TagUID
[3] = answer
[5];
1453 TagUID
[4] = answer
[6];
1454 TagUID
[5] = answer
[7];
1455 TagUID
[6] = answer
[8]; // IC Manufacturer code
1456 TagUID
[7] = answer
[9]; // always E0
1460 Dbprintf("%d octets read from IDENTIFY request:", answerLen
);
1461 DbdecodeIso15693Answer(answerLen
, answer
);
1462 Dbhexdump(answerLen
, answer
, false);
1465 if (answerLen
>= 12)
1466 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1467 TagUID
[7],TagUID
[6],TagUID
[5],TagUID
[4],
1468 TagUID
[3],TagUID
[2],TagUID
[1],TagUID
[0]);
1471 // Dbprintf("%d octets read from SELECT request:", answerLen2);
1472 // DbdecodeIso15693Answer(answerLen2,answer2);
1473 // Dbhexdump(answerLen2,answer2,true);
1475 // Dbprintf("%d octets read from XXX request:", answerLen3);
1476 // DbdecodeIso15693Answer(answerLen3,answer3);
1477 // Dbhexdump(answerLen3,answer3,true);
1480 if (answerLen
>= 12 && DEBUG
) {
1481 for (int i
= 0; i
< 32; i
++) { // sanity check, assume max 32 pages
1482 BuildReadBlockRequest(TagUID
, i
);
1483 TransmitTo15693Tag(ToSend
, ToSendMax
, start_time
);
1484 int answerLen
= GetIso15693AnswerFromTag(answer
, sizeof(answer
), DELAY_ISO15693_VCD_TO_VICC_READER
* 2);
1485 start_time
= GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER
;
1486 if (answerLen
> 0) {
1487 Dbprintf("READ SINGLE BLOCK %d returned %d octets:", i
, answerLen
);
1488 DbdecodeIso15693Answer(answerLen
, answer
);
1489 Dbhexdump(answerLen
, answer
, false);
1490 if ( *((uint32_t*) answer
) == 0x07160101 ) break; // exit on NoPageErr
1495 // for the time being, switch field off to protect rdv4.0
1496 // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
1497 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1504 // Simulate an ISO15693 TAG.
1505 // For Inventory command: print command and send Inventory Response with given UID
1506 // TODO: interpret other reader commands and send appropriate response
1507 void SimTagIso15693(uint32_t parameter
, uint8_t *uid
)
1512 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1513 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1514 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
| FPGA_HF_SIMULATOR_NO_MODULATION
);
1515 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR
);
1519 uint8_t cmd
[ISO15693_MAX_COMMAND_LENGTH
];
1521 // Build a suitable response to the reader INVENTORY command
1522 BuildInventoryResponse(uid
);
1525 while (!BUTTON_PRESS()) {
1526 uint32_t eof_time
= 0, start_time
= 0;
1527 int cmd_len
= GetIso15693CommandFromReader(cmd
, sizeof(cmd
), &eof_time
);
1529 if ((cmd_len
>= 5) && (cmd
[0] & ISO15693_REQ_INVENTORY
) && (cmd
[1] == ISO15693_INVENTORY
)) { // TODO: check more flags
1530 bool slow
= !(cmd
[0] & ISO15693_REQ_DATARATE_HIGH
);
1531 start_time
= eof_time
+ DELAY_ISO15693_VCD_TO_VICC_SIM
- DELAY_ARM_TO_READER_SIM
;
1532 TransmitTo15693Reader(ToSend
, ToSendMax
, start_time
, slow
);
1535 Dbprintf("%d bytes read from reader:", cmd_len
);
1536 Dbhexdump(cmd_len
, cmd
, false);
1539 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1544 // Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1545 // (some manufactures offer a way to read the AFI, though)
1546 void BruteforceIso15693Afi(uint32_t speed
)
1552 uint8_t recv
[ISO15693_MAX_RESPONSE_LENGTH
];
1554 int datalen
=0, recvlen
=0;
1556 Iso15693InitReader();
1559 // first without AFI
1560 // Tags should respond without AFI and with AFI=0 even when AFI is active
1562 data
[0] = ISO15693_REQ_DATARATE_HIGH
| ISO15693_REQ_INVENTORY
| ISO15693_REQINV_SLOT1
;
1563 data
[1] = ISO15693_INVENTORY
;
1564 data
[2] = 0; // mask length
1565 datalen
= Iso15693AddCrc(data
,3);
1566 recvlen
= SendDataTag(data
, datalen
, false, speed
, recv
, sizeof(recv
), 0);
1567 uint32_t start_time
= GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER
;
1570 Dbprintf("NoAFI UID=%s", Iso15693sprintUID(NULL
, &recv
[2]));
1575 data
[0] = ISO15693_REQ_DATARATE_HIGH
| ISO15693_REQ_INVENTORY
| ISO15693_REQINV_AFI
| ISO15693_REQINV_SLOT1
;
1576 data
[1] = ISO15693_INVENTORY
;
1578 data
[3] = 0; // mask length
1580 for (int i
= 0; i
< 256; i
++) {
1582 datalen
= Iso15693AddCrc(data
,4);
1583 recvlen
= SendDataTag(data
, datalen
, false, speed
, recv
, sizeof(recv
), start_time
);
1584 start_time
= GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER
;
1586 if (recvlen
>= 12) {
1587 Dbprintf("AFI=%i UID=%s", i
, Iso15693sprintUID(NULL
, &recv
[2]));
1590 Dbprintf("AFI Bruteforcing done.");
1592 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1596 // Allows to directly send commands to the tag via the client
1597 void DirectTag15693Command(uint32_t datalen
, uint32_t speed
, uint32_t recv
, uint8_t data
[]) {
1600 uint8_t recvbuf
[ISO15693_MAX_RESPONSE_LENGTH
];
1606 Dbhexdump(datalen
, data
, false);
1609 recvlen
= SendDataTag(data
, datalen
, true, speed
, (recv
?recvbuf
:NULL
), sizeof(recvbuf
), 0);
1614 Dbhexdump(recvlen
, recvbuf
, false);
1615 DbdecodeIso15693Answer(recvlen
, recvbuf
);
1618 cmd_send(CMD_ACK
, recvlen
>ISO15693_MAX_RESPONSE_LENGTH
?ISO15693_MAX_RESPONSE_LENGTH
:recvlen
, 0, 0, recvbuf
, ISO15693_MAX_RESPONSE_LENGTH
);
1622 // for the time being, switch field off to protect rdv4.0
1623 // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
1624 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1630 //-----------------------------------------------------------------------------
1631 // Work with "magic Chinese" card.
1633 //-----------------------------------------------------------------------------
1635 // Set the UID to the tag (based on Iceman work).
1636 void SetTag15693Uid(uint8_t *uid
)
1638 uint8_t cmd
[4][9] = {0x00};
1643 uint8_t recvbuf
[ISO15693_MAX_RESPONSE_LENGTH
];
1647 // Command 1 : 02213E00000000
1656 // Command 2 : 02213F69960000
1665 // Command 3 : 022138u8u7u6u5 (where uX = uid byte X)
1674 // Command 4 : 022139u4u3u2u1 (where uX = uid byte X)
1683 for (int i
=0; i
<4; i
++) {
1685 crc
= Iso15693Crc(cmd
[i
], 7);
1686 cmd
[i
][7] = crc
& 0xff;
1687 cmd
[i
][8] = crc
>> 8;
1691 Dbhexdump(sizeof(cmd
[i
]), cmd
[i
], false);
1694 recvlen
= SendDataTag(cmd
[i
], sizeof(cmd
[i
]), true, 1, recvbuf
, sizeof(recvbuf
), 0);
1698 Dbhexdump(recvlen
, recvbuf
, false);
1699 DbdecodeIso15693Answer(recvlen
, recvbuf
);
1702 cmd_send(CMD_ACK
, recvlen
>ISO15693_MAX_RESPONSE_LENGTH
?ISO15693_MAX_RESPONSE_LENGTH
:recvlen
, 0, 0, recvbuf
, ISO15693_MAX_RESPONSE_LENGTH
);
1712 // --------------------------------------------------------------------
1713 // -- Misc & deprecated functions
1714 // --------------------------------------------------------------------
1718 // do not use; has a fix UID
1719 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1724 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1725 // followed by the block data
1726 // one sub-carrier, inventory, 1 slot, fast rate
1727 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1728 // System Information command code
1730 // UID may be optionally specified here
1739 cmd[9]= 0xe0; // always e0 (not exactly unique)
1741 crc = Iso15693Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1742 cmd[10] = crc & 0xff;
1745 CodeIso15693AsReader(cmd, sizeof(cmd));
1749 // do not use; has a fix UID
1750 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1755 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1756 // followed by the block data
1757 // one sub-carrier, inventory, 1 slot, fast rate
1758 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1759 // READ Multi BLOCK command code
1761 // UID may be optionally specified here
1770 cmd[9]= 0xe0; // always e0 (not exactly unique)
1771 // First Block number to read
1773 // Number of Blocks to read
1774 cmd[11] = 0x2f; // read quite a few
1776 crc = Iso15693Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1777 cmd[12] = crc & 0xff;
1780 CodeIso15693AsReader(cmd, sizeof(cmd));
1783 // do not use; has a fix UID
1784 static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1789 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1790 // followed by the block data
1791 // one sub-carrier, inventory, 1 slot, fast rate
1792 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1793 // READ BLOCK command code
1795 // UID may be optionally specified here
1804 cmd[9]= 0xe0; // always e0 (not exactly unique)
1810 // cmd[13] = 0x00; //Now the CRC
1811 crc = Iso15693Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1812 cmd[12] = crc & 0xff;
1815 CodeIso15693AsReader(cmd, sizeof(cmd));
1818 // do not use; has a fix UID
1819 static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1824 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block
1825 // followed by the block data
1826 // one sub-carrier, inventory, 1 slot, fast rate
1827 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1828 // READ BLOCK command code
1830 // UID may be optionally specified here
1839 cmd[9]= 0xe0; // always e0 (not exactly unique)
1841 cmd[10] = 0x05; // for custom codes this must be manufacturer code
1845 // cmd[13] = 0x00; //Now the CRC
1846 crc = Iso15693Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1847 cmd[12] = crc & 0xff;
1850 CodeIso15693AsReader(cmd, sizeof(cmd));