]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443b.c
projects / proxmark3-svn / blob
? search:


e45402bc41171c90711bffbb8fa8b214c0d210a6
[proxmark3-svn] / armsrc / iso14443b.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Routines to support ISO 14443B. This includes both the reader software and
9 // the `fake tag' modes.
10 //-----------------------------------------------------------------------------
11 #include "iso14443b.h"
12
13 #define RECEIVE_SAMPLES_TIMEOUT 50000
14 #define ISO14443B_DMA_BUFFER_SIZE 256
15
16 // Guard Time (per 14443-2)
17 #define TR0 0
18 // Synchronization time (per 14443-2)
19 #define TR1 0
20 // Frame Delay Time PICC to PCD (per 14443-3 Amendment 1)
21 #define TR2 0
22 static void switch_off(void);
23
24 // the block number for the ISO14443-4 PCB (used with APDUs)
25 static uint8_t pcb_blocknum = 0;
26
27 static uint32_t iso14b_timeout = RECEIVE_SAMPLES_TIMEOUT;
28 // param timeout is in ftw_
29 void iso14b_set_timeout(uint32_t timeout) {
30 // 9.4395us = 1etu.
31 // clock is about 1.5 us
32 iso14b_timeout = timeout;
33 if(MF_DBGLEVEL >= 2) Dbprintf("ISO14443B Timeout set to %ld fwt", iso14b_timeout);
34 }
35
36 static void switch_off(void){
37 if (MF_DBGLEVEL > 3) Dbprintf("switch_off");
38 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
39 SpinDelay(100);
40 FpgaDisableSscDma();
41 set_tracing(FALSE);
42 LEDsoff();
43 }
44
45 //=============================================================================
46 // An ISO 14443 Type B tag. We listen for commands from the reader, using
47 // a UART kind of thing that's implemented in software. When we get a
48 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
49 // If it's good, then we can do something appropriate with it, and send
50 // a response.
51 //=============================================================================
52
53
54 //-----------------------------------------------------------------------------
55 // The software UART that receives commands from the reader, and its state variables.
56 //-----------------------------------------------------------------------------
57 static struct {
58 enum {
59 STATE_UNSYNCD,
60 STATE_GOT_FALLING_EDGE_OF_SOF,
61 STATE_AWAITING_START_BIT,
62 STATE_RECEIVING_DATA
63 } state;
64 uint16_t shiftReg;
65 int bitCnt;
66 int byteCnt;
67 int byteCntMax;
68 int posCnt;
69 uint8_t *output;
70 } Uart;
71
72 static void UartReset() {
73 Uart.state = STATE_UNSYNCD;
74 Uart.shiftReg = 0;
75 Uart.bitCnt = 0;
76 Uart.byteCnt = 0;
77 Uart.byteCntMax = MAX_FRAME_SIZE;
78 Uart.posCnt = 0;
79 }
80
81 static void UartInit(uint8_t *data) {
82 Uart.output = data;
83 UartReset();
84 // memset(Uart.output, 0x00, MAX_FRAME_SIZE);
85 }
86
87 //-----------------------------------------------------------------------------
88 // The software Demod that receives commands from the tag, and its state variables.
89 //-----------------------------------------------------------------------------
90 static struct {
91 enum {
92 DEMOD_UNSYNCD,
93 DEMOD_PHASE_REF_TRAINING,
94 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
95 DEMOD_GOT_FALLING_EDGE_OF_SOF,
96 DEMOD_AWAITING_START_BIT,
97 DEMOD_RECEIVING_DATA
98 } state;
99 uint16_t bitCount;
100 int posCount;
101 int thisBit;
102 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
103 int metric;
104 int metricN;
105 */
106 uint16_t shiftReg;
107 uint8_t *output;
108 uint16_t len;
109 int sumI;
110 int sumQ;
111 uint32_t startTime, endTime;
112 } Demod;
113
114 // Clear out the state of the "UART" that receives from the tag.
115 static void DemodReset() {
116 Demod.state = DEMOD_UNSYNCD;
117 Demod.bitCount = 0;
118 Demod.posCount = 0;
119 Demod.thisBit = 0;
120 Demod.shiftReg = 0;
121 Demod.len = 0;
122 Demod.sumI = 0;
123 Demod.sumQ = 0;
124 Demod.startTime = 0;
125 Demod.endTime = 0;
126 }
127
128 static void DemodInit(uint8_t *data) {
129 Demod.output = data;
130 DemodReset();
131 // memset(Demod.output, 0x00, MAX_FRAME_SIZE);
132 }
133
134 void AppendCrc14443b(uint8_t* data, int len) {
135 ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
136 }
137
138 //-----------------------------------------------------------------------------
139 // Code up a string of octets at layer 2 (including CRC, we don't generate
140 // that here) so that they can be transmitted to the reader. Doesn't transmit
141 // them yet, just leaves them ready to send in ToSend[].
142 //-----------------------------------------------------------------------------
143 static void CodeIso14443bAsTag(const uint8_t *cmd, int len) {
144 /* ISO 14443 B
145 *
146 * Reader to card | ASK - Amplitude Shift Keying Modulation (PCD to PICC for Type B) (NRZ-L encodig)
147 * Card to reader | BPSK - Binary Phase Shift Keying Modulation, (PICC to PCD for Type B)
148 *
149 * fc - carrier frequency 13.56mHz
150 * TR0 - Guard Time per 14443-2
151 * TR1 - Synchronization Time per 14443-2
152 * TR2 - PICC to PCD Frame Delay Time (per 14443-3 Amendment 1)
153 *
154 * Elementary Time Unit (ETU) is
155 * - 128 Carrier Cycles (9.4395 µS) = 8 Subcarrier Units
156 * - 1 ETU = 1 bit
157 * - 10 ETU = 1 startbit, 8 databits, 1 stopbit (10bits length)
158 * - startbit is a 0
159 * - stopbit is a 1
160 *
161 * Start of frame (SOF) is
162 * - [10-11] ETU of ZEROS, unmodulated time
163 * - [2-3] ETU of ONES,
164 *
165 * End of frame (EOF) is
166 * - [10-11] ETU of ZEROS, unmodulated time
167 *
168 * -TO VERIFY THIS BELOW-
169 * The mode FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK which we use to simulate tag
170 * works like this:
171 * - A 1-bit input to the FPGA becomes 8 pulses at 847.5kHz (9.44µS)
172 * - A 0-bit input to the FPGA becomes an unmodulated time of 9.44µS
173 *
174 *
175 *
176 * Card sends data ub 847.e kHz subcarrier
177 * 848k = 9.44µS = 128 fc
178 * 424k = 18.88µS = 256 fc
179 * 212k = 37.76µS = 512 fc
180 * 106k = 75.52µS = 1024 fc
181 *
182 * Reader data transmission:
183 * - no modulation ONES
184 * - SOF
185 * - Command, data and CRC_B
186 * - EOF
187 * - no modulation ONES
188 *
189 * Card data transmission
190 * - TR1
191 * - SOF
192 * - data (each bytes is: 1startbit,8bits, 1stopbit)
193 * - CRC_B
194 * - EOF
195 *
196 * FPGA implementation :
197 * At this point only Type A is implemented. This means that we are using a
198 * bit rate of 106 kbit/s, or fc/128. Oversample by 4, which ought to make
199 * things practical for the ARM (fc/32, 423.8 kbits/s, ~50 kbytes/s)
200 *
201 */
202
203 // ToSendStuffBit, 40 calls
204 // 1 ETU = 1startbit, 1stopbit, 8databits == 10bits.
205 // 1 ETU = 10 * 4 == 40 stuffbits ( ETU_TAG_BIT )
206 int i,j;
207 uint8_t b;
208
209 ToSendReset();
210
211 // Transmit a burst of ones, as the initial thing that lets the
212 // reader get phase sync.
213 // This loop is TR1, per specification
214 // TR1 minimum must be > 80/fs
215 // TR1 maximum 200/fs
216 // 80/fs < TR1 < 200/fs
217 // 10 ETU < TR1 < 24 ETU
218
219 // Send SOF.
220 // 10-11 ETU * 4times samples ZEROS
221 for(i = 0; i < 10; i++) {
222 ToSendStuffBit(0);
223 ToSendStuffBit(0);
224 ToSendStuffBit(0);
225 ToSendStuffBit(0);
226 }
227
228 // 2-3 ETU * 4times samples ONES
229 for(i = 0; i < 3; i++) {
230 ToSendStuffBit(1);
231 ToSendStuffBit(1);
232 ToSendStuffBit(1);
233 ToSendStuffBit(1);
234 }
235
236 // data
237 for(i = 0; i < len; ++i) {
238
239 // Start bit
240 ToSendStuffBit(0);
241 ToSendStuffBit(0);
242 ToSendStuffBit(0);
243 ToSendStuffBit(0);
244
245 // Data bits
246 b = cmd[i];
247 for(j = 0; j < 8; ++j) {
248 if(b & 1) {
249 ToSendStuffBit(1);
250 ToSendStuffBit(1);
251 ToSendStuffBit(1);
252 ToSendStuffBit(1);
253 } else {
254 ToSendStuffBit(0);
255 ToSendStuffBit(0);
256 ToSendStuffBit(0);
257 ToSendStuffBit(0);
258 }
259 b >>= 1;
260 }
261
262 // Stop bit
263 ToSendStuffBit(1);
264 ToSendStuffBit(1);
265 ToSendStuffBit(1);
266 ToSendStuffBit(1);
267
268 // Extra Guard bit
269 // For PICC it ranges 0-18us (1etu = 9us)
270 ToSendStuffBit(1);
271 ToSendStuffBit(1);
272 ToSendStuffBit(1);
273 ToSendStuffBit(1);
274
275 ToSendStuffBit(1);
276 ToSendStuffBit(1);
277 }
278
279 // Send EOF.
280 // 10-11 ETU * 4 sample rate = ZEROS
281 for(i = 0; i < 10; i++) {
282 ToSendStuffBit(0);
283 ToSendStuffBit(0);
284 ToSendStuffBit(0);
285 ToSendStuffBit(0);
286 }
287
288 // why this?
289 for(i = 0; i < 40; i++) {
290 ToSendStuffBit(1);
291 ToSendStuffBit(1);
292 ToSendStuffBit(1);
293 ToSendStuffBit(1);
294 }
295
296 // Convert from last byte pos to length
297 ++ToSendMax;
298 }
299
300
301 /* Receive & handle a bit coming from the reader.
302 *
303 * This function is called 4 times per bit (every 2 subcarrier cycles).
304 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
305 *
306 * LED handling:
307 * LED A -> ON once we have received the SOF and are expecting the rest.
308 * LED A -> OFF once we have received EOF or are in error state or unsynced
309 *
310 * Returns: true if we received a EOF
311 * false if we are still waiting for some more
312 */
313 static RAMFUNC int Handle14443bReaderUartBit(uint8_t bit) {
314 switch(Uart.state) {
315 case STATE_UNSYNCD:
316 if(!bit) {
317 // we went low, so this could be the beginning
318 // of an SOF
319 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
320 Uart.posCnt = 0;
321 Uart.bitCnt = 0;
322 }
323 break;
324
325 case STATE_GOT_FALLING_EDGE_OF_SOF:
326 Uart.posCnt++;
327 if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit
328 if(bit) {
329 if(Uart.bitCnt > 9) {
330 // we've seen enough consecutive
331 // zeros that it's a valid SOF
332 Uart.posCnt = 0;
333 Uart.byteCnt = 0;
334 Uart.state = STATE_AWAITING_START_BIT;
335 LED_A_ON(); // Indicate we got a valid SOF
336 } else {
337 // didn't stay down long enough
338 // before going high, error
339 Uart.state = STATE_UNSYNCD;
340 }
341 } else {
342 // do nothing, keep waiting
343 }
344 Uart.bitCnt++;
345 }
346 if(Uart.posCnt >= 4) Uart.posCnt = 0;
347 if(Uart.bitCnt > 12) {
348 // Give up if we see too many zeros without
349 // a one, too.
350 LED_A_OFF();
351 Uart.state = STATE_UNSYNCD;
352 }
353 break;
354
355 case STATE_AWAITING_START_BIT:
356 Uart.posCnt++;
357 if(bit) {
358 if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
359 // stayed high for too long between
360 // characters, error
361 Uart.state = STATE_UNSYNCD;
362 }
363 } else {
364 // falling edge, this starts the data byte
365 Uart.posCnt = 0;
366 Uart.bitCnt = 0;
367 Uart.shiftReg = 0;
368 Uart.state = STATE_RECEIVING_DATA;
369 }
370 break;
371
372 case STATE_RECEIVING_DATA:
373 Uart.posCnt++;
374 if(Uart.posCnt == 2) {
375 // time to sample a bit
376 Uart.shiftReg >>= 1;
377 if(bit) {
378 Uart.shiftReg |= 0x200;
379 }
380 Uart.bitCnt++;
381 }
382 if(Uart.posCnt >= 4) {
383 Uart.posCnt = 0;
384 }
385 if(Uart.bitCnt == 10) {
386 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
387 {
388 // this is a data byte, with correct
389 // start and stop bits
390 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
391 Uart.byteCnt++;
392
393 if(Uart.byteCnt >= Uart.byteCntMax) {
394 // Buffer overflowed, give up
395 LED_A_OFF();
396 Uart.state = STATE_UNSYNCD;
397 } else {
398 // so get the next byte now
399 Uart.posCnt = 0;
400 Uart.state = STATE_AWAITING_START_BIT;
401 }
402 } else if (Uart.shiftReg == 0x000) {
403 // this is an EOF byte
404 LED_A_OFF(); // Finished receiving
405 Uart.state = STATE_UNSYNCD;
406 if (Uart.byteCnt != 0) {
407 return TRUE;
408 }
409 } else {
410 // this is an error
411 LED_A_OFF();
412 Uart.state = STATE_UNSYNCD;
413 }
414 }
415 break;
416
417 default:
418 LED_A_OFF();
419 Uart.state = STATE_UNSYNCD;
420 break;
421 }
422
423 return FALSE;
424 }
425
426 //-----------------------------------------------------------------------------
427 // Receive a command (from the reader to us, where we are the simulated tag),
428 // and store it in the given buffer, up to the given maximum length. Keeps
429 // spinning, waiting for a well-framed command, until either we get one
430 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
431 //
432 // Assume that we're called with the SSC (to the FPGA) and ADC path set
433 // correctly.
434 //-----------------------------------------------------------------------------
435 static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len) {
436 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
437 // only, since we are receiving, not transmitting).
438 // Signal field is off with the appropriate LED
439 LED_D_OFF();
440 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
441
442 StartCountSspClk();
443
444 // Now run a `software UART' on the stream of incoming samples.
445 UartInit(received);
446 uint8_t b = 0;
447 for(;;) {
448 WDT_HIT();
449
450 if(BUTTON_PRESS()) return FALSE;
451
452 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
453 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
454 for(uint8_t mask = 0x80; mask != 0x00; mask >>= 1) {
455 if(Handle14443bReaderUartBit(b & mask)) {
456 *len = Uart.byteCnt;
457 return TRUE;
458 }
459 }
460 }
461 }
462 return FALSE;
463 }
464
465 //-----------------------------------------------------------------------------
466 // Main loop of simulated tag: receive commands from reader, decide what
467 // response to send, and send it.
468 //-----------------------------------------------------------------------------
469 void SimulateIso14443bTag(void) {
470 // the only commands we understand is WUPB, AFI=0, Select All, N=1:
471 static const uint8_t cmd1[] = { ISO14443B_REQB, 0x00, 0x08, 0x39, 0x73 }; // WUPB
472 // ... and REQB, AFI=0, Normal Request, N=1:
473 static const uint8_t cmd2[] = { ISO14443B_REQB, 0x00, 0x00, 0x71, 0xFF }; // REQB
474 // ... and HLTB
475 static const uint8_t cmd3[] = { ISO14443B_HALT, 0xff, 0xff, 0xff, 0xff }; // HLTB
476 // ... and ATTRIB
477 static const uint8_t cmd4[] = { ISO14443B_ATTRIB, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB
478
479 // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
480 // supports only 106kBit/s in both directions, max frame size = 32Bytes,
481 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
482 static const uint8_t response1[] = {
483 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
484 0x00, 0x21, 0x85, 0x5e, 0xd7
485 };
486 // response to HLTB and ATTRIB
487 static const uint8_t response2[] = {0x00, 0x78, 0xF0};
488
489 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
490
491 // allocate command receive buffer
492 BigBuf_free();
493 BigBuf_Clear_ext(false);
494 clear_trace(); //sim
495 set_tracing(TRUE);
496
497 const uint8_t *resp;
498 uint8_t *respCode;
499 uint16_t respLen, respCodeLen, len, cmdsRecvd = 0;
500 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
501
502 // prepare the (only one) tag answer:
503 CodeIso14443bAsTag(response1, sizeof(response1));
504 uint8_t *resp1Code = BigBuf_malloc(ToSendMax);
505 memcpy(resp1Code, ToSend, ToSendMax);
506 uint16_t resp1CodeLen = ToSendMax;
507 PrintToSendBuffer();
508 DbpString("Printing Resp1Code:");
509 Dbhexdump(resp1CodeLen, resp1Code, 0);
510
511 // prepare the (other) tag answer:
512 CodeIso14443bAsTag(response2, sizeof(response2));
513 uint8_t *resp2Code = BigBuf_malloc(ToSendMax);
514 memcpy(resp2Code, ToSend, ToSendMax);
515 uint16_t resp2CodeLen = ToSendMax;
516 PrintToSendBuffer();
517
518 // We need to listen to the high-frequency, peak-detected path.
519 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
520 FpgaSetupSsc();
521
522 uint32_t time_0 =0;
523 uint32_t t2r_time =0;
524 uint32_t r2t_time =0;
525 cmdsRecvd = 0;
526
527 for(;;) {
528
529 if (!GetIso14443bCommandFromReader(receivedCmd, &len)) {
530 Dbprintf("button pressed, received %d commands", cmdsRecvd);
531 break;
532 }
533 r2t_time = GetCountSspClk();
534
535 if (tracing)
536 LogTrace(receivedCmd, len, (r2t_time - time_0), (r2t_time - time_0), NULL, TRUE);
537
538
539 // Good, look at the command now.
540 if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0)
541 || (len == sizeof(cmd2) && memcmp(receivedCmd, cmd2, len) == 0) ) {
542 resp = response1;
543 respLen = sizeof(response1);
544 respCode = resp1Code;
545 respCodeLen = resp1CodeLen;
546 } else if ( (len == sizeof(cmd3) && receivedCmd[0] == cmd3[0])
547 || (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) ) {
548 resp = response2;
549 respLen = sizeof(response2);
550 respCode = resp2Code;
551 respCodeLen = resp2CodeLen;
552 } else {
553 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
554
555 // And print whether the CRC fails, just for good measure
556 uint8_t b1, b2;
557 if (len >= 3){ // if crc exists
558 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
559 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1])
560 DbpString("+++CRC fail");
561 else
562 DbpString("CRC passes");
563 }
564 //get rid of compiler warning
565 respCodeLen = 0;
566 resp = response1;
567 respLen = 0;
568 respCode = resp1Code;
569 //don't crash at new command just wait and see if reader will send other new cmds.
570 //break;
571 }
572
573 ++cmdsRecvd;
574
575 if(cmdsRecvd > 1000) {
576 DbpString("1000 commands later...");
577 break;
578 }
579
580 if(respCodeLen <= 0) continue;
581
582 // Modulate BPSK
583 // Signal field is off with the appropriate LED
584 LED_D_OFF();
585 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
586
587 AT91C_BASE_SSC->SSC_THR = 0xff;
588
589 FpgaSetupSsc();
590
591 // Transmit the response.
592 uint16_t i = 0;
593 volatile uint8_t b;
594 for(;;) {
595 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
596
597 AT91C_BASE_SSC->SSC_THR = respCode[i];
598 i++;
599 if(i > respCodeLen)
600 break;
601 }
602
603 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
604 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
605 (void)b;
606 }
607 }
608
609 t2r_time = GetCountSspClk();
610
611 if (tracing)
612 LogTrace(resp, respLen, (t2r_time-time_0), (t2r_time-time_0), NULL, FALSE);
613 }
614
615 switch_off(); //simulate
616 }
617
618 //=============================================================================
619 // An ISO 14443 Type B reader. We take layer two commands, code them
620 // appropriately, and then send them to the tag. We then listen for the
621 // tag's response, which we leave in the buffer to be demodulated on the
622 // PC side.
623 //=============================================================================
624
625 /*
626 * Handles reception of a bit from the tag
627 *
628 * This function is called 2 times per bit (every 4 subcarrier cycles).
629 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
630 *
631 * LED handling:
632 * LED C -> ON once we have received the SOF and are expecting the rest.
633 * LED C -> OFF once we have received EOF or are unsynced
634 *
635 * Returns: true if we received a EOF
636 * false if we are still waiting for some more
637 *
638 */
639 #ifndef SUBCARRIER_DETECT_THRESHOLD
640 # define SUBCARRIER_DETECT_THRESHOLD 8
641 #endif
642
643 static RAMFUNC int Handle14443bTagSamplesDemod(int ci, int cq) {
644 int v=0;// , myI, myQ = 0;
645 // The soft decision on the bit uses an estimate of just the
646 // quadrant of the reference angle, not the exact angle.
647 #define MAKE_SOFT_DECISION() { \
648 if(Demod.sumI > 0) { \
649 v = ci; \
650 } else { \
651 v = -ci; \
652 } \
653 if(Demod.sumQ > 0) { \
654 v += cq; \
655 } else { \
656 v -= cq; \
657 } \
658 }
659
660 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq)
661 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
662 #define CHECK_FOR_SUBCARRIER() { \
663 if(ci < 0) { \
664 if(cq < 0) { /* ci < 0, cq < 0 */ \
665 if (cq < ci) { \
666 v = -cq - (ci >> 1); \
667 } else { \
668 v = -ci - (cq >> 1); \
669 } \
670 } else { /* ci < 0, cq >= 0 */ \
671 if (cq < -ci) { \
672 v = -ci + (cq >> 1); \
673 } else { \
674 v = cq - (ci >> 1); \
675 } \
676 } \
677 } else { \
678 if(cq < 0) { /* ci >= 0, cq < 0 */ \
679 if (-cq < ci) { \
680 v = ci - (cq >> 1); \
681 } else { \
682 v = -cq + (ci >> 1); \
683 } \
684 } else { /* ci >= 0, cq >= 0 */ \
685 if (cq < ci) { \
686 v = ci + (cq >> 1); \
687 } else { \
688 v = cq + (ci >> 1); \
689 } \
690 } \
691 } \
692 }
693
694 //note: couldn't we just use MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2) from common.h - marshmellow
695 #define CHECK_FOR_SUBCARRIER_un() { \
696 myI = ABS(ci); \
697 myQ = ABS(cq); \
698 v = MAX(myI,myQ) + (MIN(myI,myQ) >> 1); \
699 }
700
701 switch(Demod.state) {
702 case DEMOD_UNSYNCD:
703
704 CHECK_FOR_SUBCARRIER();
705
706 // subcarrier detected
707 if(v > SUBCARRIER_DETECT_THRESHOLD) {
708 Demod.state = DEMOD_PHASE_REF_TRAINING;
709 Demod.sumI = ci;
710 Demod.sumQ = cq;
711 Demod.posCount = 1;
712 }
713 break;
714
715 case DEMOD_PHASE_REF_TRAINING:
716 if(Demod.posCount < 8) {
717
718 CHECK_FOR_SUBCARRIER();
719
720 if (v > SUBCARRIER_DETECT_THRESHOLD) {
721 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
722 // note: synchronization time > 80 1/fs
723 Demod.sumI += ci;
724 Demod.sumQ += cq;
725 ++Demod.posCount;
726 } else {
727 // subcarrier lost
728 Demod.state = DEMOD_UNSYNCD;
729 }
730 } else {
731 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
732 }
733 break;
734
735 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
736
737 MAKE_SOFT_DECISION();
738
739 if(v < 0) { // logic '0' detected
740 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
741 Demod.posCount = 0; // start of SOF sequence
742 } else {
743 // maximum length of TR1 = 200 1/fs
744 if(Demod.posCount > 25*2) Demod.state = DEMOD_UNSYNCD;
745 }
746 ++Demod.posCount;
747 break;
748
749 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
750 ++Demod.posCount;
751
752 MAKE_SOFT_DECISION();
753
754 if(v > 0) {
755 // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
756 if(Demod.posCount < 9*2) {
757 Demod.state = DEMOD_UNSYNCD;
758 } else {
759 LED_C_ON(); // Got SOF
760 Demod.startTime = GetCountSspClk();
761 Demod.state = DEMOD_AWAITING_START_BIT;
762 Demod.posCount = 0;
763 Demod.len = 0;
764 }
765 } else {
766 // low phase of SOF too long (> 12 etu)
767 if (Demod.posCount > 12*2) {
768 Demod.state = DEMOD_UNSYNCD;
769 LED_C_OFF();
770 }
771 }
772 break;
773
774 case DEMOD_AWAITING_START_BIT:
775 ++Demod.posCount;
776
777 MAKE_SOFT_DECISION();
778
779 if (v > 0) {
780 if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
781 Demod.state = DEMOD_UNSYNCD;
782 LED_C_OFF();
783 }
784 } else { // start bit detected
785 Demod.bitCount = 0;
786 Demod.posCount = 1; // this was the first half
787 Demod.thisBit = v;
788 Demod.shiftReg = 0;
789 Demod.state = DEMOD_RECEIVING_DATA;
790 }
791 break;
792
793 case DEMOD_RECEIVING_DATA:
794
795 MAKE_SOFT_DECISION();
796
797 if (Demod.posCount == 0) {
798 // first half of bit
799 Demod.thisBit = v;
800 Demod.posCount = 1;
801 } else {
802 // second half of bit
803 Demod.thisBit += v;
804 Demod.shiftReg >>= 1;
805
806 // logic '1'
807 if(Demod.thisBit > 0) Demod.shiftReg |= 0x200;
808
809 ++Demod.bitCount;
810
811 if(Demod.bitCount == 10) {
812
813 uint16_t s = Demod.shiftReg;
814
815 // stop bit == '1', start bit == '0'
816 if((s & 0x200) && !(s & 0x001)) {
817 uint8_t b = (s >> 1);
818 Demod.output[Demod.len] = b;
819 ++Demod.len;
820 Demod.state = DEMOD_AWAITING_START_BIT;
821 } else {
822 Demod.state = DEMOD_UNSYNCD;
823 Demod.endTime = GetCountSspClk();
824 LED_C_OFF();
825
826 // This is EOF (start, stop and all data bits == '0'
827 if(s == 0) return TRUE;
828 }
829 }
830 Demod.posCount = 0;
831 }
832 break;
833
834 default:
835 Demod.state = DEMOD_UNSYNCD;
836 LED_C_OFF();
837 break;
838 }
839 return FALSE;
840 }
841
842
843 /*
844 * Demodulate the samples we received from the tag, also log to tracebuffer
845 * quiet: set to 'TRUE' to disable debug output
846 */
847 static void GetTagSamplesFor14443bDemod(bool quiet) {
848 bool gotFrame = FALSE;
849 int lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
850 int max = 0, ci = 0, cq = 0, samples = 0;
851 uint32_t time_0 = 0, time_stop = 0;
852
853 BigBuf_free();
854
855 // Set up the demodulator for tag -> reader responses.
856 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
857
858 // The DMA buffer, used to stream samples from the FPGA
859 int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
860 int8_t *upTo = dmaBuf;
861
862 // Setup and start DMA.
863 if ( !FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE) ){
864 if (MF_DBGLEVEL > 1) Dbprintf("FpgaSetupSscDma failed. Exiting");
865 return;
866 }
867
868 time_0 = GetCountSspClk();
869
870 // And put the FPGA in the appropriate mode
871 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
872
873 while( !BUTTON_PRESS() ) {
874 WDT_HIT();
875
876 int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
877 if(behindBy > max) max = behindBy;
878
879 // rx counter - dma counter? (how much?) & (mod) dma buff / 2. (since 2bytes at the time is read)
880 while(((lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
881
882 ci = upTo[0];
883 cq = upTo[1];
884 upTo += 2;
885 samples += 2;
886
887 // restart DMA buffer to receive again.
888 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
889 upTo = dmaBuf;
890 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
891 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
892 }
893
894 lastRxCounter -= 2;
895 if(lastRxCounter <= 0)
896 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
897
898 // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103
899 //gotFrame = Handle14443bTagSamplesDemod(ci & 0xfe, cq & 0xfe);
900 gotFrame = Handle14443bTagSamplesDemod(ci, cq);
901 if ( gotFrame ) break;
902 LED_A_INV();
903 }
904
905 time_stop = GetCountSspClk() - time_0;
906
907 if(time_stop > iso14b_timeout || gotFrame) break;
908 }
909
910 FpgaDisableSscDma();
911
912 if (!quiet) {
913 Dbprintf("max behindby = %d, samples = %d, gotFrame = %s, Demod.state = %d, Demod.len = %u",
914 max,
915 samples,
916 (gotFrame) ? "true" : "false",
917 Demod.state,
918 Demod.len
919 );
920 }
921 if ( Demod.len > 0 )
922 LogTrace(Demod.output, Demod.len, Demod.startTime, Demod.endTime, NULL, FALSE);
923
924 // free mem refs.
925 // if ( dmaBuf ) dmaBuf = NULL;
926 // if ( upTo ) upTo = NULL;
927 }
928
929
930 //-----------------------------------------------------------------------------
931 // Transmit the command (to the tag) that was placed in ToSend[].
932 //-----------------------------------------------------------------------------
933 static void TransmitFor14443b_AsReader(void) {
934
935 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
936 SpinDelay(20);
937
938 int c;
939 // we could been in following mode:
940 // FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ
941 // if its second call or more
942
943 // What does this loop do? Is it TR1?
944 for(c = 0; c < 10;) {
945 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
946 AT91C_BASE_SSC->SSC_THR = 0xFF;
947 ++c;
948 }
949 }
950
951 // Send frame loop
952 for(c = 0; c < ToSendMax;) {
953 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
954 AT91C_BASE_SSC->SSC_THR = ToSend[c];
955 ++c;
956 }
957 }
958 WDT_HIT();
959 }
960
961 //-----------------------------------------------------------------------------
962 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
963 // so that it is ready to transmit to the tag using TransmitFor14443b().
964 //-----------------------------------------------------------------------------
965 static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
966 {
967 /*
968 * Reader data transmission:
969 * - no modulation ONES
970 * - SOF
971 * - Command, data and CRC_B
972 * - EOF
973 * - no modulation ONES
974 *
975 * 1 ETU == 1 BIT!
976 * TR0 - 8 ETUS minimum.
977 */
978 int i;
979 uint8_t b;
980
981 ToSendReset();
982
983 // Send SOF
984 // 10-11 ETUs of ZERO
985 for(i = 0; i < 10; ++i) ToSendStuffBit(0);
986
987 // 2-3 ETUs of ONE
988 ToSendStuffBit(1);
989 ToSendStuffBit(1);
990 ToSendStuffBit(1);
991
992 // Sending cmd, LSB
993 // from here we add BITS
994 for(i = 0; i < len; ++i) {
995 // Start bit
996 ToSendStuffBit(0);
997 // Data bits
998 b = cmd[i];
999 if ( b & 1 ) ToSendStuffBit(1); else ToSendStuffBit(0);
1000 if ( (b>>1) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1001 if ( (b>>2) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1002 if ( (b>>3) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1003 if ( (b>>4) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1004 if ( (b>>5) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1005 if ( (b>>6) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1006 if ( (b>>7) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1007 // Stop bit
1008 ToSendStuffBit(1);
1009 // EGT extra guard time
1010 // For PCD it ranges 0-57us (1etu = 9us)
1011 ToSendStuffBit(1);
1012 ToSendStuffBit(1);
1013 ToSendStuffBit(1);
1014 }
1015
1016 // Send EOF
1017 // 10-11 ETUs of ZERO
1018 for(i = 0; i < 10; ++i) ToSendStuffBit(0);
1019
1020 // Transition time. TR0 - guard time
1021 // 8ETUS minum?
1022 // Per specification, Subcarrier must be stopped no later than 2 ETUs after EOF.
1023 for(i = 0; i < 40 ; ++i) ToSendStuffBit(1);
1024
1025 // TR1 - Synchronization time
1026 // Convert from last character reference to length
1027 ++ToSendMax;
1028 }
1029
1030
1031 /**
1032 Convenience function to encode, transmit and trace iso 14443b comms
1033 **/
1034 static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len) {
1035
1036 CodeIso14443bAsReader(cmd, len);
1037
1038 uint32_t time_start = GetCountSspClk();
1039
1040 TransmitFor14443b_AsReader();
1041
1042 if(trigger) LED_A_ON();
1043
1044 if (tracing) LogTrace(cmd, len, time_start, GetCountSspClk()-time_start, NULL, TRUE);
1045 }
1046
1047 /* Sends an APDU to the tag
1048 * TODO: check CRC and preamble
1049 */
1050 uint8_t iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response)
1051 {
1052 uint8_t crc[2] = {0x00, 0x00};
1053 uint8_t message_frame[message_length + 4];
1054 // PCB
1055 message_frame[0] = 0x0A | pcb_blocknum;
1056 pcb_blocknum ^= 1;
1057 // CID
1058 message_frame[1] = 0;
1059 // INF
1060 memcpy(message_frame + 2, message, message_length);
1061 // EDC (CRC)
1062 ComputeCrc14443(CRC_14443_B, message_frame, message_length + 2, &message_frame[message_length + 2], &message_frame[message_length + 3]);
1063 // send
1064 CodeAndTransmit14443bAsReader(message_frame, message_length + 4); //no
1065 // get response
1066 GetTagSamplesFor14443bDemod(TRUE); //no
1067 if(Demod.len < 3)
1068 return 0;
1069
1070 // VALIDATE CRC
1071 ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]);
1072 if ( crc[0] != Demod.output[Demod.len-2] || crc[1] != Demod.output[Demod.len-1] )
1073 return 0;
1074
1075 // copy response contents
1076 if(response != NULL)
1077 memcpy(response, Demod.output, Demod.len);
1078
1079 return Demod.len;
1080 }
1081
1082 /**
1083 * SRx Initialise.
1084 */
1085 uint8_t iso14443b_select_srx_card(iso14b_card_select_t *card )
1086 {
1087 // INITIATE command: wake up the tag using the INITIATE
1088 static const uint8_t init_srx[] = { ISO14443B_INITIATE, 0x00, 0x97, 0x5b };
1089 // SELECT command (with space for CRC)
1090 uint8_t select_srx[] = { ISO14443B_SELECT, 0x00, 0x00, 0x00};
1091 // temp to calc crc.
1092 uint8_t crc[2] = {0x00, 0x00};
1093
1094 CodeAndTransmit14443bAsReader(init_srx, sizeof(init_srx));
1095 GetTagSamplesFor14443bDemod(TRUE); //no
1096
1097 if (Demod.len == 0) return 2;
1098
1099 // Randomly generated Chip ID
1100 if (card) card->chipid = Demod.output[0];
1101
1102 select_srx[1] = Demod.output[0];
1103
1104 ComputeCrc14443(CRC_14443_B, select_srx, 2, &select_srx[2], &select_srx[3]);
1105 CodeAndTransmit14443bAsReader(select_srx, sizeof(select_srx));
1106 GetTagSamplesFor14443bDemod(TRUE); //no
1107
1108 if (Demod.len != 3) return 2;
1109
1110 // Check the CRC of the answer:
1111 ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2 , &crc[0], &crc[1]);
1112 if(crc[0] != Demod.output[1] || crc[1] != Demod.output[2]) return 3;
1113
1114 // Check response from the tag: should be the same UID as the command we just sent:
1115 if (select_srx[1] != Demod.output[0]) return 1;
1116
1117 // First get the tag's UID:
1118 select_srx[0] = ISO14443B_GET_UID;
1119
1120 ComputeCrc14443(CRC_14443_B, select_srx, 1 , &select_srx[1], &select_srx[2]);
1121 CodeAndTransmit14443bAsReader(select_srx, 3); // Only first three bytes for this one
1122 GetTagSamplesFor14443bDemod(TRUE); //no
1123
1124 if (Demod.len != 10) return 2;
1125
1126 // The check the CRC of the answer
1127 ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]);
1128 if(crc[0] != Demod.output[8] || crc[1] != Demod.output[9]) return 3;
1129
1130 if (card) {
1131 card->uidlen = 8;
1132 memcpy(card->uid, Demod.output, 8);
1133 }
1134
1135 return 0;
1136 }
1137 /* Perform the ISO 14443 B Card Selection procedure
1138 * Currently does NOT do any collision handling.
1139 * It expects 0-1 cards in the device's range.
1140 * TODO: Support multiple cards (perform anticollision)
1141 * TODO: Verify CRC checksums
1142 */
1143 uint8_t iso14443b_select_card(iso14b_card_select_t *card )
1144 {
1145 // WUPB command (including CRC)
1146 // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state
1147 static const uint8_t wupb[] = { ISO14443B_REQB, 0x00, 0x08, 0x39, 0x73 };
1148 // ATTRIB command (with space for CRC)
1149 uint8_t attrib[] = { ISO14443B_ATTRIB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00};
1150
1151 // temp to calc crc.
1152 uint8_t crc[2] = {0x00, 0x00};
1153
1154 // first, wake up the tag
1155 CodeAndTransmit14443bAsReader(wupb, sizeof(wupb));
1156 GetTagSamplesFor14443bDemod(TRUE); //select_card
1157
1158 // ATQB too short?
1159 if (Demod.len < 14) return 2;
1160
1161 // VALIDATE CRC
1162 ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]);
1163 if ( crc[0] != Demod.output[12] || crc[1] != Demod.output[13] )
1164 return 3;
1165
1166 if (card) {
1167 card->uidlen = 4;
1168 memcpy(card->uid, Demod.output+1, 4);
1169 memcpy(card->atqb, Demod.output+5, 7);
1170 }
1171
1172 // copy the PUPI to ATTRIB ( PUPI == UID )
1173 memcpy(attrib + 1, Demod.output + 1, 4);
1174
1175 // copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into ATTRIB (Param 3)
1176 attrib[7] = Demod.output[10] & 0x0F;
1177 ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10);
1178
1179 CodeAndTransmit14443bAsReader(attrib, sizeof(attrib));
1180 GetTagSamplesFor14443bDemod(TRUE);//select_card
1181
1182 // Answer to ATTRIB too short?
1183 if(Demod.len < 3) return 2;
1184
1185 // VALIDATE CRC
1186 ComputeCrc14443(CRC_14443_B, Demod.output, Demod.len-2, &crc[0], &crc[1]);
1187 if ( crc[0] != Demod.output[1] || crc[1] != Demod.output[2] )
1188 return 3;
1189
1190 // CID
1191 if (card) card->cid = Demod.output[0];
1192
1193 uint8_t fwt = card->atqb[6]>>4;
1194 if ( fwt < 16 ){
1195 uint32_t fwt_time = (302 << fwt);
1196 iso14b_set_timeout( fwt_time);
1197 }
1198 // reset PCB block number
1199 pcb_blocknum = 0;
1200 return 0;
1201 }
1202
1203 // Set up ISO 14443 Type B communication (similar to iso14443a_setup)
1204 // field is setup for "Sending as Reader"
1205 void iso14443b_setup() {
1206 if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup Enter");
1207 LEDsoff();
1208 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1209 //BigBuf_free();
1210 //BigBuf_Clear_ext(false);
1211
1212 // Initialize Demod and Uart structs
1213 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
1214 UartInit(BigBuf_malloc(MAX_FRAME_SIZE));
1215
1216 // connect Demodulated Signal to ADC:
1217 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1218
1219 // Set up the synchronous serial port
1220 FpgaSetupSsc();
1221
1222 // Signal field is on with the appropriate LED
1223 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
1224 SpinDelay(100);
1225
1226 // Start the timer
1227 StartCountSspClk();
1228
1229 LED_D_ON();
1230 if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup Exit");
1231 }
1232
1233 //-----------------------------------------------------------------------------
1234 // Read a SRI512 ISO 14443B tag.
1235 //
1236 // SRI512 tags are just simple memory tags, here we're looking at making a dump
1237 // of the contents of the memory. No anticollision algorithm is done, we assume
1238 // we have a single tag in the field.
1239 //
1240 // I tried to be systematic and check every answer of the tag, every CRC, etc...
1241 //-----------------------------------------------------------------------------
1242 void ReadSTMemoryIso14443b(uint8_t numofblocks)
1243 {
1244 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1245
1246 // Make sure that we start from off, since the tags are stateful;
1247 // confusing things will happen if we don't reset them between reads.
1248 switch_off(); // before ReadStMemory
1249
1250 set_tracing(TRUE);
1251
1252 uint8_t i = 0x00;
1253
1254 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1255 FpgaSetupSsc();
1256
1257 // Now give it time to spin up.
1258 // Signal field is on with the appropriate LED
1259 LED_D_ON();
1260 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
1261 SpinDelay(20);
1262
1263 // First command: wake up the tag using the INITIATE command
1264 uint8_t cmd1[] = {ISO14443B_INITIATE, 0x00, 0x97, 0x5b};
1265 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no
1266 GetTagSamplesFor14443bDemod(TRUE); // no
1267
1268 if (Demod.len == 0) {
1269 DbpString("No response from tag");
1270 set_tracing(FALSE);
1271 return;
1272 } else {
1273 Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
1274 Demod.output[0], Demod.output[1], Demod.output[2]);
1275 }
1276
1277 // There is a response, SELECT the uid
1278 DbpString("Now SELECT tag:");
1279 cmd1[0] = ISO14443B_SELECT; // 0x0E is SELECT
1280 cmd1[1] = Demod.output[0];
1281 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1282 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no
1283 GetTagSamplesFor14443bDemod(TRUE); //no
1284 if (Demod.len != 3) {
1285 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
1286 set_tracing(FALSE);
1287 return;
1288 }
1289 // Check the CRC of the answer:
1290 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
1291 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
1292 DbpString("CRC Error reading select response.");
1293 set_tracing(FALSE);
1294 return;
1295 }
1296 // Check response from the tag: should be the same UID as the command we just sent:
1297 if (cmd1[1] != Demod.output[0]) {
1298 Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
1299 set_tracing(FALSE);
1300 return;
1301 }
1302
1303 // Tag is now selected,
1304 // First get the tag's UID:
1305 cmd1[0] = ISO14443B_GET_UID;
1306 ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
1307 CodeAndTransmit14443bAsReader(cmd1, 3); // no -- Only first three bytes for this one
1308 GetTagSamplesFor14443bDemod(TRUE); //no
1309 if (Demod.len != 10) {
1310 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
1311 set_tracing(FALSE);
1312 return;
1313 }
1314 // The check the CRC of the answer (use cmd1 as temporary variable):
1315 ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
1316 if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
1317 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1318 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
1319 // Do not return;, let's go on... (we should retry, maybe ?)
1320 }
1321 Dbprintf("Tag UID (64 bits): %08x %08x",
1322 (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
1323 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
1324
1325 // Now loop to read all 16 blocks, address from 0 to last block
1326 Dbprintf("Tag memory dump, block 0 to %d", numofblocks);
1327 cmd1[0] = 0x08;
1328 i = 0x00;
1329 ++numofblocks;
1330
1331 for (;;) {
1332 if (i == numofblocks) {
1333 DbpString("System area block (0xff):");
1334 i = 0xff;
1335 }
1336 cmd1[1] = i;
1337 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1338 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); //no
1339 GetTagSamplesFor14443bDemod(TRUE); //no
1340
1341 if (Demod.len != 6) { // Check if we got an answer from the tag
1342 DbpString("Expected 6 bytes from tag, got less...");
1343 return;
1344 }
1345 // The check the CRC of the answer (use cmd1 as temporary variable):
1346 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
1347 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
1348 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1349 (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
1350 // Do not return;, let's go on... (we should retry, maybe ?)
1351 }
1352 // Now print out the memory location:
1353 Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
1354 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1355 (Demod.output[4]<<8)+Demod.output[5]);
1356
1357 if (i == 0xff) break;
1358 ++i;
1359 }
1360
1361 set_tracing(FALSE);
1362 }
1363
1364
1365 static void iso1444b_setup_snoop(void){
1366 if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup_snoop Enter");
1367 LEDsoff();
1368 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1369 BigBuf_free();
1370 BigBuf_Clear_ext(false);
1371 clear_trace();//setup snoop
1372 set_tracing(TRUE);
1373
1374 // Initialize Demod and Uart structs
1375 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
1376 UartInit(BigBuf_malloc(MAX_FRAME_SIZE));
1377
1378 if (MF_DBGLEVEL > 1) {
1379 // Print debug information about the buffer sizes
1380 Dbprintf("Snooping buffers initialized:");
1381 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1382 Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
1383 Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
1384 Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
1385 }
1386
1387 // connect Demodulated Signal to ADC:
1388 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1389
1390 // Setup for the DMA.
1391 FpgaSetupSsc();
1392
1393 // Set FPGA in the appropriate mode
1394 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
1395 SpinDelay(20);
1396
1397 // Start the SSP timer
1398 StartCountSspClk();
1399 if (MF_DBGLEVEL > 3) Dbprintf("iso1443b_setup_snoop Exit");
1400 }
1401
1402 //=============================================================================
1403 // Finally, the `sniffer' combines elements from both the reader and
1404 // simulated tag, to show both sides of the conversation.
1405 //=============================================================================
1406
1407 //-----------------------------------------------------------------------------
1408 // Record the sequence of commands sent by the reader to the tag, with
1409 // triggering so that we start recording at the point that the tag is moved
1410 // near the reader.
1411 //-----------------------------------------------------------------------------
1412 /*
1413 * Memory usage for this function, (within BigBuf)
1414 * Last Received command (reader->tag) - MAX_FRAME_SIZE
1415 * Last Received command (tag->reader) - MAX_FRAME_SIZE
1416 * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
1417 * Demodulated samples received - all the rest
1418 */
1419 void RAMFUNC SnoopIso14443b(void) {
1420
1421 uint32_t time_0 = 0, time_start = 0, time_stop = 0;
1422
1423 // We won't start recording the frames that we acquire until we trigger;
1424 // a good trigger condition to get started is probably when we see a
1425 // response from the tag.
1426 int triggered = TRUE; // TODO: set and evaluate trigger condition
1427 int ci, cq;
1428 int maxBehindBy = 0;
1429 //int behindBy = 0;
1430 int lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
1431
1432 bool TagIsActive = FALSE;
1433 bool ReaderIsActive = FALSE;
1434
1435 iso1444b_setup_snoop();
1436
1437 // The DMA buffer, used to stream samples from the FPGA
1438 int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
1439 int8_t *upTo = dmaBuf;
1440
1441 // Setup and start DMA.
1442 if ( !FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE) ){
1443 if (MF_DBGLEVEL > 1) Dbprintf("FpgaSetupSscDma failed. Exiting");
1444 BigBuf_free();
1445 return;
1446 }
1447
1448 time_0 = GetCountSspClk();
1449
1450 // And now we loop, receiving samples.
1451 for(;;) {
1452
1453 WDT_HIT();
1454
1455 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
1456
1457 if ( behindBy > maxBehindBy )
1458 maxBehindBy = behindBy;
1459
1460 if ( behindBy < 2 ) continue;
1461
1462 ci = upTo[0];
1463 cq = upTo[1];
1464 upTo += 2;
1465
1466 lastRxCounter -= 2;
1467
1468 if (upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
1469 upTo = dmaBuf;
1470 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
1471 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
1472 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
1473 WDT_HIT();
1474
1475 // TODO: understand whether we can increase/decrease as we want or not?
1476 if ( behindBy > ( 9 * ISO14443B_DMA_BUFFER_SIZE/10) ) {
1477 Dbprintf("blew circular buffer! behindBy=%d", behindBy);
1478 break;
1479 }
1480
1481 if(!tracing) {
1482 DbpString("Trace full");
1483 break;
1484 }
1485
1486 if(BUTTON_PRESS()) {
1487 DbpString("cancelled");
1488 break;
1489 }
1490 }
1491
1492 if (!TagIsActive) {
1493
1494 LED_A_ON();
1495
1496 // no need to try decoding reader data if the tag is sending
1497 if (Handle14443bReaderUartBit(ci & 0x01)) {
1498
1499 time_stop = (GetCountSspClk()-time_0);
1500
1501 if (triggered)
1502 LogTrace(Uart.output, Uart.byteCnt, time_start, time_stop, NULL, TRUE);
1503
1504 /* And ready to receive another command. */
1505 UartReset();
1506 /* And also reset the demod code, which might have been */
1507 /* false-triggered by the commands from the reader. */
1508 DemodReset();
1509 } else {
1510 time_start = (GetCountSspClk()-time_0);
1511 }
1512
1513 if (Handle14443bReaderUartBit(cq & 0x01)) {
1514
1515 time_stop = (GetCountSspClk()-time_0);
1516
1517 if (triggered)
1518 LogTrace(Uart.output, Uart.byteCnt, time_start, time_stop, NULL, TRUE);
1519
1520 /* And ready to receive another command. */
1521 UartReset();
1522 /* And also reset the demod code, which might have been */
1523 /* false-triggered by the commands from the reader. */
1524 DemodReset();
1525 } else {
1526 time_start = (GetCountSspClk()-time_0);
1527 }
1528 ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);
1529 LED_A_OFF();
1530 }
1531
1532 if(!ReaderIsActive) {
1533 // no need to try decoding tag data if the reader is sending - and we cannot afford the time
1534 // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103
1535 if(Handle14443bTagSamplesDemod(ci & 0xFE, cq & 0xFE)) {
1536
1537 time_stop = (GetCountSspClk()-time_0);
1538
1539 LogTrace(Demod.output, Demod.len, time_start, time_stop, NULL, FALSE);
1540
1541 triggered = TRUE;
1542
1543 // And ready to receive another response.
1544 DemodReset();
1545 } else {
1546 time_start = (GetCountSspClk()-time_0);
1547 }
1548 TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF);
1549 }
1550 }
1551
1552 switch_off(); // Snoop
1553
1554 DbpString("Snoop statistics:");
1555 Dbprintf(" Max behind by: %i", maxBehindBy);
1556 Dbprintf(" Uart State: %x ByteCount: %i ByteCountMax: %i", Uart.state, Uart.byteCnt, Uart.byteCntMax);
1557 Dbprintf(" Trace length: %i", BigBuf_get_traceLen());
1558
1559 // free mem refs.
1560 if ( dmaBuf ) dmaBuf = NULL;
1561 if ( upTo ) upTo = NULL;
1562 // Uart.byteCntMax should be set with ATQB value..
1563 }
1564
1565 void iso14b_set_trigger(bool enable) {
1566 trigger = enable;
1567 }
1568
1569 /*
1570 * Send raw command to tag ISO14443B
1571 * @Input
1572 * param flags enum ISO14B_COMMAND. (mifare.h)
1573 * len len of buffer data
1574 * data buffer with bytes to send
1575 *
1576 * @Output
1577 * none
1578 *
1579 */
1580 void SendRawCommand14443B_Ex(UsbCommand *c)
1581 {
1582 iso14b_command_t param = c->arg[0];
1583 size_t len = c->arg[1] & 0xffff;
1584 uint8_t *cmd = c->d.asBytes;
1585 uint8_t status = 0;
1586 uint32_t sendlen = sizeof(iso14b_card_select_t);
1587 uint8_t buf[USB_CMD_DATA_SIZE] = {0x00};
1588
1589 if (MF_DBGLEVEL > 3) Dbprintf("14b raw: param, %04x", param );
1590
1591 // turn on trigger (LED_A)
1592 if ((param & ISO14B_REQUEST_TRIGGER) == ISO14B_REQUEST_TRIGGER)
1593 iso14b_set_trigger(TRUE);
1594
1595 if ((param & ISO14B_CONNECT) == ISO14B_CONNECT) {
1596 // Make sure that we start from off, since the tags are stateful;
1597 // confusing things will happen if we don't reset them between reads.
1598 //switch_off(); // before connect in raw
1599 iso14443b_setup();
1600 }
1601
1602 set_tracing(TRUE);
1603
1604 if ((param & ISO14B_SELECT_STD) == ISO14B_SELECT_STD) {
1605 iso14b_card_select_t *card = (iso14b_card_select_t*)buf;
1606 status = iso14443b_select_card(card);
1607 cmd_send(CMD_ACK, status, sendlen, 0, buf, sendlen);
1608 // 0: OK 2: attrib fail, 3:crc fail,
1609 if ( status > 0 ) return;
1610 }
1611
1612 if ((param & ISO14B_SELECT_SR) == ISO14B_SELECT_SR) {
1613 iso14b_card_select_t *card = (iso14b_card_select_t*)buf;
1614 status = iso14443b_select_srx_card(card);
1615 cmd_send(CMD_ACK, status, sendlen, 0, buf, sendlen);
1616 // 0: OK 2: attrib fail, 3:crc fail,
1617 if ( status > 0 ) return;
1618 }
1619
1620 if ((param & ISO14B_APDU) == ISO14B_APDU) {
1621 status = iso14443b_apdu(cmd, len, buf);
1622 cmd_send(CMD_ACK, status, status, 0, buf, status);
1623 }
1624
1625 if ((param & ISO14B_RAW) == ISO14B_RAW) {
1626 if((param & ISO14B_APPEND_CRC) == ISO14B_APPEND_CRC) {
1627 AppendCrc14443b(cmd, len);
1628 len += 2;
1629 }
1630
1631 CodeAndTransmit14443bAsReader(cmd, len); // raw
1632 GetTagSamplesFor14443bDemod(TRUE); // raw
1633
1634 sendlen = MIN(Demod.len, USB_CMD_DATA_SIZE);
1635 status = (Demod.len > 0) ? 0 : 1;
1636 cmd_send(CMD_ACK, status, sendlen, 0, Demod.output, sendlen);
1637 }
1638
1639 // turn off trigger (LED_A)
1640 if ((param & ISO14B_REQUEST_TRIGGER) == ISO14B_REQUEST_TRIGGER)
1641 iso14b_set_trigger(FALSE);
1642
1643 // turn off antenna et al
1644 // we don't send a HALT command.
1645 if ((param & ISO14B_DISCONNECT) == ISO14B_DISCONNECT) {
1646 if (MF_DBGLEVEL > 3) Dbprintf("disconnect");
1647 switch_off(); // disconnect raw
1648 } else {
1649 //FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
1650 }
1651
1652 }
Proxmark3 GIT tracking
Impressum, Datenschutz