]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso15693.c
projects / proxmark3-svn / blob
? search:


e65e7958e6598ec1410d028feb03dab689cb03c7
[proxmark3-svn] / armsrc / iso15693.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 // Modified by Greg Jones, Jan 2009
4 // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 15693. This includes both the reader software and
11 // the `fake tag' modes, but at the moment I've implemented only the reader
12 // stuff, and that barely.
13 // Modified to perform modulation onboard in arm rather than on PC
14 // Also added additional reader commands (SELECT, READ etc.)
15 //-----------------------------------------------------------------------------
16 // The ISO 15693 describes two transmission modes from reader to tag, and 4
17 // transmission modes from tag to reader. As of Mar 2010 this code only
18 // supports one of each: "1of4" mode from reader to tag, and the highspeed
19 // variant with one subcarrier from card to reader.
20 // As long, as the card fully support ISO 15693 this is no problem, since the
21 // reader chooses both data rates, but some non-standard tags do not. Further for
22 // the simulation to work, we will need to support all data rates.
23 //
24 // VCD (reader) -> VICC (tag)
25 // 1 out of 256:
26 // data rate: 1,66 kbit/s (fc/8192)
27 // used for long range
28 // 1 out of 4:
29 // data rate: 26,48 kbit/s (fc/512)
30 // used for short range, high speed
31 //
32 // VICC (tag) -> VCD (reader)
33 // Modulation:
34 // ASK / one subcarrier (423,75 khz)
35 // FSK / two subcarriers (423,75 khz && 484,28 khz)
36 // Data Rates / Modes:
37 // low ASK: 6,62 kbit/s
38 // low FSK: 6.67 kbit/s
39 // high ASK: 26,48 kbit/s
40 // high FSK: 26,69 kbit/s
41 //-----------------------------------------------------------------------------
42 // added "1 out of 256" mode (for VCD->PICC) - atrox 20100911
43
44
45 // Random Remarks:
46 // *) UID is always used "transmission order" (LSB), which is reverse to display order
47
48 // TODO / BUGS / ISSUES:
49 // *) writing to tags takes longer: we miss the answer from the tag in most cases
50 // -> tweak the read-timeout times
51 // *) signal decoding from the card is still a bit shaky.
52 // *) signal decoding is unable to detect collissions.
53 // *) add anti-collission support for inventory-commands
54 // *) read security status of a block
55 // *) sniffing and simulation do only support one transmission mode. need to support
56 // all 8 transmission combinations
57 // *) remove or refactor code under "depricated"
58 // *) document all the functions
59
60
61 #include "proxmark3.h"
62 #include "util.h"
63 #include "apps.h"
64 #include "string.h"
65 #include "iso15693tools.h"
66 #include "cmd.h"
67
68 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
69
70 ///////////////////////////////////////////////////////////////////////
71 // ISO 15693 Part 2 - Air Interface
72 // This section basicly contains transmission and receiving of bits
73 ///////////////////////////////////////////////////////////////////////
74
75 #define FrameSOF Iso15693FrameSOF
76 #define Logic0 Iso15693Logic0
77 #define Logic1 Iso15693Logic1
78 #define FrameEOF Iso15693FrameEOF
79
80 #define Crc(data,datalen) Iso15693Crc(data,datalen)
81 #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
82 #define sprintUID(target,uid) Iso15693sprintUID(target,uid)
83
84 int DEBUG=0;
85
86
87 // ---------------------------
88 // Signal Processing
89 // ---------------------------
90
91 // prepare data using "1 out of 4" code for later transmission
92 // resulting data rate is 26,48 kbit/s (fc/512)
93 // cmd ... data
94 // n ... length of data
95 static void CodeIso15693AsReader(uint8_t *cmd, int n)
96 {
97 int i, j;
98
99 ToSendReset();
100
101 // Give it a bit of slack at the beginning
102 for(i = 0; i < 24; i++) {
103 ToSendStuffBit(1);
104 }
105
106 // SOF for 1of4
107 ToSendStuffBit(0);
108 ToSendStuffBit(1);
109 ToSendStuffBit(1);
110 ToSendStuffBit(1);
111 ToSendStuffBit(1);
112 ToSendStuffBit(0);
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 for(i = 0; i < n; i++) {
116 for(j = 0; j < 8; j += 2) {
117 int these = (cmd[i] >> j) & 3;
118 switch(these) {
119 case 0:
120 ToSendStuffBit(1);
121 ToSendStuffBit(0);
122 ToSendStuffBit(1);
123 ToSendStuffBit(1);
124 ToSendStuffBit(1);
125 ToSendStuffBit(1);
126 ToSendStuffBit(1);
127 ToSendStuffBit(1);
128 break;
129 case 1:
130 ToSendStuffBit(1);
131 ToSendStuffBit(1);
132 ToSendStuffBit(1);
133 ToSendStuffBit(0);
134 ToSendStuffBit(1);
135 ToSendStuffBit(1);
136 ToSendStuffBit(1);
137 ToSendStuffBit(1);
138 break;
139 case 2:
140 ToSendStuffBit(1);
141 ToSendStuffBit(1);
142 ToSendStuffBit(1);
143 ToSendStuffBit(1);
144 ToSendStuffBit(1);
145 ToSendStuffBit(0);
146 ToSendStuffBit(1);
147 ToSendStuffBit(1);
148 break;
149 case 3:
150 ToSendStuffBit(1);
151 ToSendStuffBit(1);
152 ToSendStuffBit(1);
153 ToSendStuffBit(1);
154 ToSendStuffBit(1);
155 ToSendStuffBit(1);
156 ToSendStuffBit(1);
157 ToSendStuffBit(0);
158 break;
159 }
160 }
161 }
162 // EOF
163 ToSendStuffBit(1);
164 ToSendStuffBit(1);
165 ToSendStuffBit(0);
166 ToSendStuffBit(1);
167
168 // And slack at the end, too.
169 for(i = 0; i < 24; i++) {
170 ToSendStuffBit(1);
171 }
172 }
173
174 // encode data using "1 out of 256" sheme
175 // data rate is 1,66 kbit/s (fc/8192)
176 // is designed for more robust communication over longer distances
177 static void CodeIso15693AsReader256(uint8_t *cmd, int n)
178 {
179 int i, j;
180
181 ToSendReset();
182
183 // Give it a bit of slack at the beginning
184 for(i = 0; i < 24; i++) {
185 ToSendStuffBit(1);
186 }
187
188 // SOF for 1of256
189 ToSendStuffBit(0);
190 ToSendStuffBit(1);
191 ToSendStuffBit(1);
192 ToSendStuffBit(1);
193 ToSendStuffBit(1);
194 ToSendStuffBit(1);
195 ToSendStuffBit(1);
196 ToSendStuffBit(0);
197
198 for(i = 0; i < n; i++) {
199 for (j = 0; j<=255; j++) {
200 if (cmd[i]==j) {
201 ToSendStuffBit(1);
202 ToSendStuffBit(0);
203 } else {
204 ToSendStuffBit(1);
205 ToSendStuffBit(1);
206 }
207 }
208 }
209 // EOF
210 ToSendStuffBit(1);
211 ToSendStuffBit(1);
212 ToSendStuffBit(0);
213 ToSendStuffBit(1);
214
215 // And slack at the end, too.
216 for(i = 0; i < 24; i++) {
217 ToSendStuffBit(1);
218 }
219 }
220
221
222 // Transmit the command (to the tag) that was placed in ToSend[].
223 static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
224 {
225 int c;
226
227 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
228 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
229 if(*wait < 10) { *wait = 10; }
230
231 // for(c = 0; c < *wait;) {
232 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
233 // AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
234 // c++;
235 // }
236 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
237 // volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
238 // (void)r;
239 // }
240 // WDT_HIT();
241 // }
242
243 c = 0;
244 for(;;) {
245 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
246 AT91C_BASE_SSC->SSC_THR = cmd[c];
247 c++;
248 if(c >= len) {
249 break;
250 }
251 }
252 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
253 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
254 (void)r;
255 }
256 WDT_HIT();
257 }
258 *samples = (c + *wait) << 3;
259 }
260
261 //-----------------------------------------------------------------------------
262 // Transmit the command (to the reader) that was placed in ToSend[].
263 //-----------------------------------------------------------------------------
264 static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
265 {
266 int c = 0;
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
268 if(*wait < 10) { *wait = 10; }
269
270 for(;;) {
271 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
272 AT91C_BASE_SSC->SSC_THR = cmd[c];
273 c++;
274 if(c >= len) {
275 break;
276 }
277 }
278 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
279 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
280 (void)r;
281 }
282 WDT_HIT();
283 }
284 *samples = (c + *wait) << 3;
285 }
286
287
288 // Read from Tag
289 // Parameters:
290 // receivedResponse
291 // maxLen
292 // samples
293 // elapsed
294 // returns:
295 // number of decoded bytes
296 static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
297 {
298 uint8_t *dest = BigBuf_get_addr();
299
300 int c = 0;
301 int getNext = FALSE;
302 int8_t prev = 0;
303
304 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
305 SpinDelay(100); // greg - experiment to get rid of some of the 0 byte/failed reads
306
307 for(;;) {
308 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
309 AT91C_BASE_SSC->SSC_THR = 0x43;
310
311 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
312 int8_t b;
313 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
314
315 // The samples are correlations against I and Q versions of the
316 // tone that the tag AM-modulates, so every other sample is I,
317 // every other is Q. We just want power, so abs(I) + abs(Q) is
318 // close to what we want.
319 if(getNext) {
320 int8_t r = ABS(b) + ABS(prev);
321
322 dest[c++] = (uint8_t)r;
323
324 if(c >= 2000) {
325 break;
326 }
327 } else {
328 prev = b;
329 }
330
331 getNext = !getNext;
332 }
333 }
334
335 //////////////////////////////////////////
336 /////////// DEMODULATE ///////////////////
337 //////////////////////////////////////////
338
339 int i, j;
340 int max = 0, maxPos=0;
341
342 int skip = 4;
343
344 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
345
346 // First, correlate for SOF
347 for(i = 0; i < 100; i++) {
348 int corr = 0;
349 for(j = 0; j < arraylen(FrameSOF); j += skip) {
350 corr += FrameSOF[j]*dest[i+(j/skip)];
351 }
352 if(corr > max) {
353 max = corr;
354 maxPos = i;
355 }
356 }
357 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
358
359 int k = 0; // this will be our return value
360
361 // greg - If correlation is less than 1 then there's little point in continuing
362 if ((max/(arraylen(FrameSOF)/skip)) >= 1)
363 {
364
365 i = maxPos + arraylen(FrameSOF)/skip;
366
367 uint8_t outBuf[20];
368 memset(outBuf, 0, sizeof(outBuf));
369 uint8_t mask = 0x01;
370 for(;;) {
371 int corr0 = 0, corr1 = 0, corrEOF = 0;
372 for(j = 0; j < arraylen(Logic0); j += skip) {
373 corr0 += Logic0[j]*dest[i+(j/skip)];
374 }
375 for(j = 0; j < arraylen(Logic1); j += skip) {
376 corr1 += Logic1[j]*dest[i+(j/skip)];
377 }
378 for(j = 0; j < arraylen(FrameEOF); j += skip) {
379 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
380 }
381 // Even things out by the length of the target waveform.
382 corr0 *= 4;
383 corr1 *= 4;
384
385 if(corrEOF > corr1 && corrEOF > corr0) {
386 // DbpString("EOF at %d", i);
387 break;
388 } else if(corr1 > corr0) {
389 i += arraylen(Logic1)/skip;
390 outBuf[k] |= mask;
391 } else {
392 i += arraylen(Logic0)/skip;
393 }
394 mask <<= 1;
395 if(mask == 0) {
396 k++;
397 mask = 0x01;
398 }
399 if((i+(int)arraylen(FrameEOF)) >= 2000) {
400 DbpString("ran off end!");
401 break;
402 }
403 }
404 if(mask != 0x01) { // this happens, when we miss the EOF
405 // TODO: for some reason this happens quite often
406 if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
407 if (mask<0x08) k--; // discard the last uneven octet;
408 // 0x08 is an assumption - but works quite often
409 }
410 // uint8_t str1 [8];
411 // itoa(k,str1);
412 // strncat(str1," octets read",8);
413
414 // DbpString( str1); // DbpString("%d octets", k);
415
416 // for(i = 0; i < k; i+=3) {
417 // //DbpString("# %2d: %02x ", i, outBuf[i]);
418 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
419 // }
420
421 for(i = 0; i < k; i++) {
422 receivedResponse[i] = outBuf[i];
423 }
424 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
425 return k; // return the number of bytes demodulated
426
427 // DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
428 }
429
430
431 // Now the GetISO15693 message from sniffing command
432 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
433 {
434 uint8_t *dest = BigBuf_get_addr();
435
436 int c = 0;
437 int getNext = FALSE;
438 int8_t prev = 0;
439
440 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
441 SpinDelay(100); // greg - experiment to get rid of some of the 0 byte/failed reads
442
443 for(;;) {
444 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
445 AT91C_BASE_SSC->SSC_THR = 0x43;
446
447 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
448 int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
449
450 // The samples are correlations against I and Q versions of the
451 // tone that the tag AM-modulates, so every other sample is I,
452 // every other is Q. We just want power, so abs(I) + abs(Q) is
453 // close to what we want.
454 if(getNext) {
455 int8_t r = ABS(b) + ABS(prev);
456
457 dest[c++] = (uint8_t)r;
458
459 if(c >= 20000) {
460 break;
461 }
462 } else {
463 prev = b;
464 }
465
466 getNext = !getNext;
467 }
468 }
469
470 //////////////////////////////////////////
471 /////////// DEMODULATE ///////////////////
472 //////////////////////////////////////////
473
474 int i, j;
475 int max = 0, maxPos=0;
476
477 int skip = 4;
478
479 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
480
481 // First, correlate for SOF
482 for(i = 0; i < 19000; i++) {
483 int corr = 0;
484 for(j = 0; j < arraylen(FrameSOF); j += skip) {
485 corr += FrameSOF[j]*dest[i+(j/skip)];
486 }
487 if(corr > max) {
488 max = corr;
489 maxPos = i;
490 }
491 }
492 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
493
494 int k = 0; // this will be our return value
495
496 // greg - If correlation is less than 1 then there's little point in continuing
497 if ((max/(arraylen(FrameSOF)/skip)) >= 1) // THIS SHOULD BE 1
498 {
499
500 i = maxPos + arraylen(FrameSOF)/skip;
501
502 uint8_t outBuf[20];
503 memset(outBuf, 0, sizeof(outBuf));
504 uint8_t mask = 0x01;
505 for(;;) {
506 int corr0 = 0, corr1 = 0, corrEOF = 0;
507 for(j = 0; j < arraylen(Logic0); j += skip) {
508 corr0 += Logic0[j]*dest[i+(j/skip)];
509 }
510 for(j = 0; j < arraylen(Logic1); j += skip) {
511 corr1 += Logic1[j]*dest[i+(j/skip)];
512 }
513 for(j = 0; j < arraylen(FrameEOF); j += skip) {
514 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
515 }
516 // Even things out by the length of the target waveform.
517 corr0 *= 4;
518 corr1 *= 4;
519
520 if(corrEOF > corr1 && corrEOF > corr0) {
521 // DbpString("EOF at %d", i);
522 break;
523 } else if(corr1 > corr0) {
524 i += arraylen(Logic1)/skip;
525 outBuf[k] |= mask;
526 } else {
527 i += arraylen(Logic0)/skip;
528 }
529 mask <<= 1;
530 if(mask == 0) {
531 k++;
532 mask = 0x01;
533 }
534 if((i+(int)arraylen(FrameEOF)) >= 2000) {
535 DbpString("ran off end!");
536 break;
537 }
538 }
539 if(mask != 0x01) {
540 DbpString("sniff: error, uneven octet! (discard extra bits!)");
541 /// DbpString(" mask=%02x", mask);
542 }
543 // uint8_t str1 [8];
544 // itoa(k,str1);
545 // strncat(str1," octets read",8);
546
547 // DbpString( str1); // DbpString("%d octets", k);
548
549 // for(i = 0; i < k; i+=3) {
550 // //DbpString("# %2d: %02x ", i, outBuf[i]);
551 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
552 // }
553
554 for(i = 0; i < k; i++) {
555 receivedResponse[i] = outBuf[i];
556 }
557 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
558 return k; // return the number of bytes demodulated
559
560 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
561 }
562
563
564 static void BuildIdentifyRequest(void);
565 //-----------------------------------------------------------------------------
566 // Start to read an ISO 15693 tag. We send an identify request, then wait
567 // for the response. The response is not demodulated, just left in the buffer
568 // so that it can be downloaded to a PC and processed there.
569 //-----------------------------------------------------------------------------
570 void AcquireRawAdcSamplesIso15693(void)
571 {
572 uint8_t *dest = BigBuf_get_addr();
573
574 int c = 0;
575 int getNext = 0;
576 int8_t prev = 0;
577
578 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
579 BuildIdentifyRequest();
580
581 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
582
583 // Give the tags time to energize
584 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
585 SpinDelay(100);
586
587 // Now send the command
588 FpgaSetupSsc();
589 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
590
591 c = 0;
592 for(;;) {
593 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
594 AT91C_BASE_SSC->SSC_THR = ToSend[c];
595 c++;
596 if(c == ToSendMax+3) {
597 break;
598 }
599 }
600 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
601 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
602 (void)r;
603 }
604 WDT_HIT();
605 }
606
607 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
608
609 c = 0;
610 getNext = FALSE;
611 for(;;) {
612 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
613 AT91C_BASE_SSC->SSC_THR = 0x43;
614 }
615 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
616 int8_t b;
617 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
618
619 // The samples are correlations against I and Q versions of the
620 // tone that the tag AM-modulates, so every other sample is I,
621 // every other is Q. We just want power, so abs(I) + abs(Q) is
622 // close to what we want.
623 if(getNext) {
624 int8_t r = ABS(b) + ABS(prev);
625
626 dest[c++] = (uint8_t)r;
627
628 if(c >= 2000) {
629 break;
630 }
631 } else {
632 prev = b;
633 }
634
635 getNext = !getNext;
636 }
637 }
638 }
639
640
641 void RecordRawAdcSamplesIso15693(void)
642 {
643 uint8_t *dest = BigBuf_get_addr();
644
645 int c = 0;
646 int getNext = 0;
647 int8_t prev = 0;
648
649 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
650 // Setup SSC
651 FpgaSetupSsc();
652
653 // Start from off (no field generated)
654 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
655 SpinDelay(200);
656
657 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
658
659 SpinDelay(100);
660
661 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
662
663 c = 0;
664 getNext = FALSE;
665 for(;;) {
666 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
667 AT91C_BASE_SSC->SSC_THR = 0x43;
668 }
669 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
670 int8_t b;
671 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
672
673 // The samples are correlations against I and Q versions of the
674 // tone that the tag AM-modulates, so every other sample is I,
675 // every other is Q. We just want power, so abs(I) + abs(Q) is
676 // close to what we want.
677 if(getNext) {
678 int8_t r = ABS(b) + ABS(prev);
679
680 dest[c++] = (uint8_t)r;
681
682 if(c >= 7000) {
683 break;
684 }
685 } else {
686 prev = b;
687 }
688
689 getNext = !getNext;
690 WDT_HIT();
691 }
692 }
693 Dbprintf("fin record");
694 }
695
696
697 // Initialize the proxmark as iso15k reader
698 // (this might produces glitches that confuse some tags
699 void Iso15693InitReader() {
700 LED_A_ON();
701 LED_B_ON();
702 LED_C_OFF();
703 LED_D_OFF();
704
705 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
706 // Setup SSC
707 // FpgaSetupSsc();
708
709 // Start from off (no field generated)
710 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
711 SpinDelay(10);
712
713 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
714 FpgaSetupSsc();
715
716 // Give the tags time to energize
717 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
718 SpinDelay(250);
719
720 LED_A_ON();
721 LED_B_OFF();
722 LED_C_OFF();
723 LED_D_OFF();
724 }
725
726 ///////////////////////////////////////////////////////////////////////
727 // ISO 15693 Part 3 - Air Interface
728 // This section basicly contains transmission and receiving of bits
729 ///////////////////////////////////////////////////////////////////////
730
731 // Encode (into the ToSend buffers) an identify request, which is the first
732 // thing that you must send to a tag to get a response.
733 static void BuildIdentifyRequest(void)
734 {
735 uint8_t cmd[5];
736
737 uint16_t crc;
738 // one sub-carrier, inventory, 1 slot, fast rate
739 // AFI is at bit 5 (1<<4) when doing an INVENTORY
740 cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
741 // inventory command code
742 cmd[1] = 0x01;
743 // no mask
744 cmd[2] = 0x00;
745 //Now the CRC
746 crc = Crc(cmd, 3);
747 cmd[3] = crc & 0xff;
748 cmd[4] = crc >> 8;
749
750 CodeIso15693AsReader(cmd, sizeof(cmd));
751 }
752
753 // uid is in transmission order (which is reverse of display order)
754 static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
755 {
756 uint8_t cmd[13];
757
758 uint16_t crc;
759 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
760 // followed by teh block data
761 // one sub-carrier, inventory, 1 slot, fast rate
762 cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit, ADDR bit, OPTION bit
763 // READ BLOCK command code
764 cmd[1] = 0x20;
765 // UID may be optionally specified here
766 // 64-bit UID
767 cmd[2] = uid[0];
768 cmd[3] = uid[1];
769 cmd[4] = uid[2];
770 cmd[5] = uid[3];
771 cmd[6] = uid[4];
772 cmd[7] = uid[5];
773 cmd[8] = uid[6];
774 cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique)
775 // Block number to read
776 cmd[10] = blockNumber;//0x00;
777 //Now the CRC
778 crc = Crc(cmd, 11); // the crc needs to be calculated over 12 bytes
779 cmd[11] = crc & 0xff;
780 cmd[12] = crc >> 8;
781
782 CodeIso15693AsReader(cmd, sizeof(cmd));
783 }
784
785 // Now the VICC>VCD responses when we are simulating a tag
786 static void BuildInventoryResponse( uint8_t *uid)
787 {
788 uint8_t cmd[12];
789
790 uint16_t crc;
791 // one sub-carrier, inventory, 1 slot, fast rate
792 // AFI is at bit 5 (1<<4) when doing an INVENTORY
793 //(1 << 2) | (1 << 5) | (1 << 1);
794 cmd[0] = 0; //
795 cmd[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported
796 // 64-bit UID
797 cmd[2] = uid[7]; //0x32;
798 cmd[3] = uid[6]; //0x4b;
799 cmd[4] = uid[5]; //0x03;
800 cmd[5] = uid[4]; //0x01;
801 cmd[6] = uid[3]; //0x00;
802 cmd[7] = uid[2]; //0x10;
803 cmd[8] = uid[1]; //0x05;
804 cmd[9] = uid[0]; //0xe0;
805 //Now the CRC
806 crc = Crc(cmd, 10);
807 cmd[10] = crc & 0xff;
808 cmd[11] = crc >> 8;
809
810 CodeIso15693AsReader(cmd, sizeof(cmd));
811 }
812
813 // Universal Method for sending to and recv bytes from a tag
814 // init ... should we initialize the reader?
815 // speed ... 0 low speed, 1 hi speed
816 // **recv will return you a pointer to the received data
817 // If you do not need the answer use NULL for *recv[]
818 // return: lenght of received data
819 int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) {
820
821 int samples = 0;
822 int tsamples = 0;
823 int wait = 0;
824 int elapsed = 0;
825
826 LED_A_ON();
827 LED_B_ON();
828 LED_C_OFF();
829 LED_D_OFF();
830
831 if (init) Iso15693InitReader();
832
833 int answerLen=0;
834 uint8_t *answer = BigBuf_get_addr() + 3660;
835 if (recv != NULL) memset(answer, 0, 100);
836
837 if (!speed) {
838 // low speed (1 out of 256)
839 CodeIso15693AsReader256(send, sendlen);
840 } else {
841 // high speed (1 out of 4)
842 CodeIso15693AsReader(send, sendlen);
843 }
844
845 LED_A_ON();
846 LED_B_OFF();
847
848 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
849 // Now wait for a response
850 if (recv!=NULL) {
851 LED_A_OFF();
852 LED_B_ON();
853 answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ;
854 *recv=answer;
855 }
856
857 LEDsoff();
858
859 return answerLen;
860 }
861
862
863 // --------------------------------------------------------------------
864 // Debug Functions
865 // --------------------------------------------------------------------
866
867 // Decodes a message from a tag and displays its metadata and content
868 #define DBD15STATLEN 48
869 void DbdecodeIso15693Answer(int len, uint8_t *d) {
870 char status[DBD15STATLEN+1]={0};
871 uint16_t crc;
872
873 if (len>3) {
874 if (d[0]&(1<<3))
875 strncat(status,"ProtExt ",DBD15STATLEN);
876 if (d[0]&1) {
877 // error
878 strncat(status,"Error ",DBD15STATLEN);
879 switch (d[1]) {
880 case 0x01:
881 strncat(status,"01:notSupp",DBD15STATLEN);
882 break;
883 case 0x02:
884 strncat(status,"02:notRecog",DBD15STATLEN);
885 break;
886 case 0x03:
887 strncat(status,"03:optNotSupp",DBD15STATLEN);
888 break;
889 case 0x0f:
890 strncat(status,"0f:noInfo",DBD15STATLEN);
891 break;
892 case 0x10:
893 strncat(status,"10:dontExist",DBD15STATLEN);
894 break;
895 case 0x11:
896 strncat(status,"11:lockAgain",DBD15STATLEN);
897 break;
898 case 0x12:
899 strncat(status,"12:locked",DBD15STATLEN);
900 break;
901 case 0x13:
902 strncat(status,"13:progErr",DBD15STATLEN);
903 break;
904 case 0x14:
905 strncat(status,"14:lockErr",DBD15STATLEN);
906 break;
907 default:
908 strncat(status,"unknownErr",DBD15STATLEN);
909 }
910 strncat(status," ",DBD15STATLEN);
911 } else {
912 strncat(status,"NoErr ",DBD15STATLEN);
913 }
914
915 crc=Crc(d,len-2);
916 if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) )
917 strncat(status,"CrcOK",DBD15STATLEN);
918 else
919 strncat(status,"CrcFail!",DBD15STATLEN);
920
921 Dbprintf("%s",status);
922 }
923 }
924
925
926
927 ///////////////////////////////////////////////////////////////////////
928 // Functions called via USB/Client
929 ///////////////////////////////////////////////////////////////////////
930
931 void SetDebugIso15693(uint32_t debug) {
932 DEBUG=debug;
933 Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off");
934 return;
935 }
936
937
938
939 //-----------------------------------------------------------------------------
940 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
941 // all demodulation performed in arm rather than host. - greg
942 //-----------------------------------------------------------------------------
943 void ReaderIso15693(uint32_t parameter)
944 {
945 LED_A_ON();
946 LED_B_ON();
947 LED_C_OFF();
948 LED_D_OFF();
949
950 int answerLen1 = 0;
951 int answerLen2 = 0;
952 int answerLen3 = 0;
953 int i = 0;
954 int samples = 0;
955 int tsamples = 0;
956 int wait = 0;
957 int elapsed = 0;
958 uint8_t TagUID[8] = {0x00};
959
960 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
961
962 uint8_t *answer1 = BigBuf_get_addr() + 3660;
963 uint8_t *answer2 = BigBuf_get_addr() + 3760;
964 uint8_t *answer3 = BigBuf_get_addr() + 3860;
965 // Blank arrays
966 memset(answer1, 0x00, 300);
967
968 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
969 // Setup SSC
970 FpgaSetupSsc();
971
972 // Start from off (no field generated)
973 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
974 SpinDelay(200);
975
976 // Give the tags time to energize
977 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
978 SpinDelay(200);
979
980 LED_A_ON();
981 LED_B_OFF();
982 LED_C_OFF();
983 LED_D_OFF();
984
985 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
986 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
987
988 // Now send the IDENTIFY command
989 BuildIdentifyRequest();
990
991 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
992
993 // Now wait for a response
994 answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
995
996 if (answerLen1 >=12) // we should do a better check than this
997 {
998 TagUID[0] = answer1[2];
999 TagUID[1] = answer1[3];
1000 TagUID[2] = answer1[4];
1001 TagUID[3] = answer1[5];
1002 TagUID[4] = answer1[6];
1003 TagUID[5] = answer1[7];
1004 TagUID[6] = answer1[8]; // IC Manufacturer code
1005 TagUID[7] = answer1[9]; // always E0
1006
1007 }
1008
1009 Dbprintf("%d octets read from IDENTIFY request:", answerLen1);
1010 DbdecodeIso15693Answer(answerLen1,answer1);
1011 Dbhexdump(answerLen1,answer1,true);
1012
1013 // UID is reverse
1014 if (answerLen1>=12)
1015 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1016 TagUID[7],TagUID[6],TagUID[5],TagUID[4],
1017 TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
1018
1019
1020 Dbprintf("%d octets read from SELECT request:", answerLen2);
1021 DbdecodeIso15693Answer(answerLen2,answer2);
1022 Dbhexdump(answerLen2,answer2,true);
1023
1024 Dbprintf("%d octets read from XXX request:", answerLen3);
1025 DbdecodeIso15693Answer(answerLen3,answer3);
1026 Dbhexdump(answerLen3,answer3,true);
1027
1028 // read all pages
1029 if (answerLen1>=12 && DEBUG) {
1030 i=0;
1031 while (i<32) { // sanity check, assume max 32 pages
1032 BuildReadBlockRequest(TagUID,i);
1033 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
1034 answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
1035 if (answerLen2>0) {
1036 Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
1037 DbdecodeIso15693Answer(answerLen2,answer2);
1038 Dbhexdump(answerLen2,answer2,true);
1039 if ( *((uint32_t*) answer2) == 0x07160101 ) break; // exit on NoPageErr
1040 }
1041 i++;
1042 }
1043 }
1044
1045 LED_A_OFF();
1046 LED_B_OFF();
1047 LED_C_OFF();
1048 LED_D_OFF();
1049 }
1050
1051 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1052 // all demodulation performed in arm rather than host. - greg
1053 void SimTagIso15693(uint32_t parameter, uint8_t *uid)
1054 {
1055 LED_A_ON();
1056 LED_B_ON();
1057 LED_C_OFF();
1058 LED_D_OFF();
1059
1060 int answerLen1 = 0;
1061 int samples = 0;
1062 int tsamples = 0;
1063 int wait = 0;
1064 int elapsed = 0;
1065
1066 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1067
1068 uint8_t *buf = BigBuf_get_addr() + 3660;
1069 memset(buf, 0x00, 100);
1070
1071 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1072 FpgaSetupSsc();
1073
1074 // Start from off (no field generated)
1075 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1076 SpinDelay(200);
1077
1078 LED_A_OFF();
1079 LED_B_OFF();
1080 LED_C_ON();
1081 LED_D_OFF();
1082
1083 // Listen to reader
1084 answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
1085
1086 if (answerLen1 >=1) // we should do a better check than this
1087 {
1088 // Build a suitable reponse to the reader INVENTORY cocmmand
1089 // not so obsvious, but in the call to BuildInventoryResponse, the command is copied to the global ToSend buffer used below.
1090
1091 BuildInventoryResponse(uid);
1092
1093 TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
1094 }
1095
1096 Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
1097 buf[0], buf[1], buf[2], buf[3],
1098 buf[4], buf[5], buf[6], buf[7], buf[8]);
1099
1100 Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x",
1101 uid[0], uid[1], uid[2], uid[3],
1102 uid[4], uid[5], uid[6], uid[7]);
1103
1104 LED_A_OFF();
1105 LED_B_OFF();
1106 LED_C_OFF();
1107 LED_D_OFF();
1108 }
1109
1110
1111 // Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1112 // (some manufactures offer a way to read the AFI, though)
1113 void BruteforceIso15693Afi(uint32_t speed)
1114 {
1115 uint8_t data[20];
1116 uint8_t *recv=data;
1117 int datalen=0, recvlen=0;
1118
1119 Iso15693InitReader();
1120
1121 // first without AFI
1122 // Tags should respond wihtout AFI and with AFI=0 even when AFI is active
1123
1124 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1125 ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
1126 data[1]=ISO15_CMD_INVENTORY;
1127 data[2]=0; // mask length
1128 datalen=AddCrc(data,3);
1129 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1130 WDT_HIT();
1131 if (recvlen>=12) {
1132 Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
1133 }
1134
1135 // now with AFI
1136
1137 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1138 ISO15_REQ_INVENTORY | ISO15_REQINV_AFI | ISO15_REQINV_SLOT1;
1139 data[1]=ISO15_CMD_INVENTORY;
1140 data[2]=0; // AFI
1141 data[3]=0; // mask length
1142
1143 for (int i=0;i<256;i++) {
1144 data[2]=i & 0xFF;
1145 datalen=AddCrc(data,4);
1146 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1147 WDT_HIT();
1148 if (recvlen>=12) {
1149 Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
1150 }
1151 }
1152 Dbprintf("AFI Bruteforcing done.");
1153
1154 }
1155
1156 // Allows to directly send commands to the tag via the client
1157 void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
1158
1159 int recvlen=0;
1160 uint8_t *recvbuf = BigBuf_get_addr();
1161 // UsbCommand n;
1162
1163 if (DEBUG) {
1164 Dbprintf("SEND");
1165 Dbhexdump(datalen,data,true);
1166 }
1167
1168 recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
1169
1170 if (recv) {
1171 LED_B_ON();
1172 cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
1173 LED_B_OFF();
1174
1175 if (DEBUG) {
1176 Dbprintf("RECV");
1177 DbdecodeIso15693Answer(recvlen,recvbuf);
1178 Dbhexdump(recvlen,recvbuf,true);
1179 }
1180 }
1181
1182 }
1183
1184
1185
1186
1187 // --------------------------------------------------------------------
1188 // -- Misc & deprecated functions
1189 // --------------------------------------------------------------------
1190
1191 /*
1192
1193 // do not use; has a fix UID
1194 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1195 {
1196 uint8_t cmd[12];
1197
1198 uint16_t crc;
1199 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1200 // followed by teh block data
1201 // one sub-carrier, inventory, 1 slot, fast rate
1202 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1203 // System Information command code
1204 cmd[1] = 0x2B;
1205 // UID may be optionally specified here
1206 // 64-bit UID
1207 cmd[2] = 0x32;
1208 cmd[3]= 0x4b;
1209 cmd[4] = 0x03;
1210 cmd[5] = 0x01;
1211 cmd[6] = 0x00;
1212 cmd[7] = 0x10;
1213 cmd[8] = 0x05;
1214 cmd[9]= 0xe0; // always e0 (not exactly unique)
1215 //Now the CRC
1216 crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1217 cmd[10] = crc & 0xff;
1218 cmd[11] = crc >> 8;
1219
1220 CodeIso15693AsReader(cmd, sizeof(cmd));
1221 }
1222
1223
1224 // do not use; has a fix UID
1225 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1226 {
1227 uint8_t cmd[14];
1228
1229 uint16_t crc;
1230 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1231 // followed by teh block data
1232 // one sub-carrier, inventory, 1 slot, fast rate
1233 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1234 // READ Multi BLOCK command code
1235 cmd[1] = 0x23;
1236 // UID may be optionally specified here
1237 // 64-bit UID
1238 cmd[2] = 0x32;
1239 cmd[3]= 0x4b;
1240 cmd[4] = 0x03;
1241 cmd[5] = 0x01;
1242 cmd[6] = 0x00;
1243 cmd[7] = 0x10;
1244 cmd[8] = 0x05;
1245 cmd[9]= 0xe0; // always e0 (not exactly unique)
1246 // First Block number to read
1247 cmd[10] = 0x00;
1248 // Number of Blocks to read
1249 cmd[11] = 0x2f; // read quite a few
1250 //Now the CRC
1251 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1252 cmd[12] = crc & 0xff;
1253 cmd[13] = crc >> 8;
1254
1255 CodeIso15693AsReader(cmd, sizeof(cmd));
1256 }
1257
1258 // do not use; has a fix UID
1259 static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1260 {
1261 uint8_t cmd[14];
1262
1263 uint16_t crc;
1264 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1265 // followed by teh block data
1266 // one sub-carrier, inventory, 1 slot, fast rate
1267 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1268 // READ BLOCK command code
1269 cmd[1] = CmdCode;
1270 // UID may be optionally specified here
1271 // 64-bit UID
1272 cmd[2] = 0x32;
1273 cmd[3]= 0x4b;
1274 cmd[4] = 0x03;
1275 cmd[5] = 0x01;
1276 cmd[6] = 0x00;
1277 cmd[7] = 0x10;
1278 cmd[8] = 0x05;
1279 cmd[9]= 0xe0; // always e0 (not exactly unique)
1280 // Parameter
1281 cmd[10] = 0x00;
1282 cmd[11] = 0x0a;
1283
1284 // cmd[12] = 0x00;
1285 // cmd[13] = 0x00; //Now the CRC
1286 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1287 cmd[12] = crc & 0xff;
1288 cmd[13] = crc >> 8;
1289
1290 CodeIso15693AsReader(cmd, sizeof(cmd));
1291 }
1292
1293 // do not use; has a fix UID
1294 static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1295 {
1296 uint8_t cmd[14];
1297
1298 uint16_t crc;
1299 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1300 // followed by teh block data
1301 // one sub-carrier, inventory, 1 slot, fast rate
1302 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1303 // READ BLOCK command code
1304 cmd[1] = CmdCode;
1305 // UID may be optionally specified here
1306 // 64-bit UID
1307 cmd[2] = 0x32;
1308 cmd[3]= 0x4b;
1309 cmd[4] = 0x03;
1310 cmd[5] = 0x01;
1311 cmd[6] = 0x00;
1312 cmd[7] = 0x10;
1313 cmd[8] = 0x05;
1314 cmd[9]= 0xe0; // always e0 (not exactly unique)
1315 // Parameter
1316 cmd[10] = 0x05; // for custom codes this must be manufcturer code
1317 cmd[11] = 0x00;
1318
1319 // cmd[12] = 0x00;
1320 // cmd[13] = 0x00; //Now the CRC
1321 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1322 cmd[12] = crc & 0xff;
1323 cmd[13] = crc >> 8;
1324
1325 CodeIso15693AsReader(cmd, sizeof(cmd));
1326 }
1327
1328
1329
1330
1331 */
1332
1333
Proxmark3 GIT tracking
Impressum, Datenschutz