git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

2 // Jonathan Westhues, split Nov 2006

3 //

4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

5 // at your option, any later version. See the LICENSE.txt file for the text of

6 // the license.

7 //-----------------------------------------------------------------------------

8 // Routines to support ISO 14443. This includes both the reader software and

9 // the `fake tag' modes. At the moment only the Type B modulation is

10 // supported.

11 //-----------------------------------------------------------------------------

13 #include "proxmark3.h"

14 #include "apps.h"

15 #include "util.h"

16 #include "string.h"

18 #include "iso14443crc.h"

20 //static void GetSamplesFor14443(int weTx, int n);

22 #define DEMOD_TRACE_SIZE 4096

23 #define READER_TAG_BUFFER_SIZE 2048

24 #define TAG_READER_BUFFER_SIZE 2048

25 #define DEMOD_DMA_BUFFER_SIZE 1024

27 //=============================================================================

28 // An ISO 14443 Type B tag. We listen for commands from the reader, using

29 // a UART kind of thing that's implemented in software. When we get a

30 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.

31 // If it's good, then we can do something appropriate with it, and send

32 // a response.

33 //=============================================================================

35 //-----------------------------------------------------------------------------

36 // Code up a string of octets at layer 2 (including CRC, we don't generate

37 // that here) so that they can be transmitted to the reader. Doesn't transmit

38 // them yet, just leaves them ready to send in ToSend[].

39 //-----------------------------------------------------------------------------

 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)

41 {

42 int i;

44 ToSendReset();

46 // Transmit a burst of ones, as the initial thing that lets the

47 // reader get phase sync. This (TR1) must be > 80/fs, per spec,

48 // but tag that I've tried (a Paypass) exceeds that by a fair bit,

49 // so I will too.

     for(i = 0; i < 20; i++) {

51 ToSendStuffBit(1);

52 ToSendStuffBit(1);

53 ToSendStuffBit(1);

54 ToSendStuffBit(1);

55 }

57 // Send SOF.

     for(i = 0; i < 10; i++) {

59 ToSendStuffBit(0);

60 ToSendStuffBit(0);

61 ToSendStuffBit(0);

62 ToSendStuffBit(0);

63 }

     for(i = 0; i < 2; i++) {

65 ToSendStuffBit(1);

66 ToSendStuffBit(1);

67 ToSendStuffBit(1);

68 ToSendStuffBit(1);

69 }

     for(i = 0; i < len; i++) {

72 int j;

73 uint8_t b = cmd[i];

75 // Start bit

76 ToSendStuffBit(0);

77 ToSendStuffBit(0);

78 ToSendStuffBit(0);

79 ToSendStuffBit(0);

81 // Data bits

         for(j = 0; j < 8; j++) {

             if(b & 1) {

84 ToSendStuffBit(1);

85 ToSendStuffBit(1);

86 ToSendStuffBit(1);

87 ToSendStuffBit(1);

88 } else {

89 ToSendStuffBit(0);

90 ToSendStuffBit(0);

91 ToSendStuffBit(0);

92 ToSendStuffBit(0);

93 }

94 b >>= 1;

95 }

97 // Stop bit

98 ToSendStuffBit(1);

99 ToSendStuffBit(1);

100 ToSendStuffBit(1);

101 ToSendStuffBit(1);

102 }

103

104 // Send SOF.

     for(i = 0; i < 10; i++) {

106 ToSendStuffBit(0);

107 ToSendStuffBit(0);

108 ToSendStuffBit(0);

109 ToSendStuffBit(0);

110 }

     for(i = 0; i < 10; i++) {

112 ToSendStuffBit(1);

113 ToSendStuffBit(1);

114 ToSendStuffBit(1);

115 ToSendStuffBit(1);

116 }

117

118 // Convert from last byte pos to length

119 ToSendMax++;

120

121 // Add a few more for slop

122 ToSendMax += 2;

123 }

124

125 //-----------------------------------------------------------------------------

126 // The software UART that receives commands from the reader, and its state

127 // variables.

128 //-----------------------------------------------------------------------------

129 static struct {

130 enum {

131 STATE_UNSYNCD,

132 STATE_GOT_FALLING_EDGE_OF_SOF,

133 STATE_AWAITING_START_BIT,

134 STATE_RECEIVING_DATA,

135 STATE_ERROR_WAIT

136 } state;

137 uint16_t shiftReg;

138 int bitCnt;

139 int byteCnt;

140 int byteCntMax;

141 int posCnt;

142 uint8_t *output;

143 } Uart;

144

145 /* Receive & handle a bit coming from the reader.

146 *

147 * LED handling:

148 * LED A -> ON once we have received the SOF and are expecting the rest.

149 * LED A -> OFF once we have received EOF or are in error state or unsynced

150 *

151 * Returns: true if we received a EOF

152 * false if we are still waiting for some more

153 */

 static int Handle14443UartBit(int bit)

155 {

156 switch(Uart.state) {

157 case STATE_UNSYNCD:

158 LED_A_OFF();

159 if(!bit) {

160 // we went low, so this could be the beginning

161 // of an SOF

162 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;

163 Uart.posCnt = 0;

164 Uart.bitCnt = 0;

165 }

166 break;

167

168 case STATE_GOT_FALLING_EDGE_OF_SOF:

169 Uart.posCnt++;

             if(Uart.posCnt == 2) {

171 if(bit) {

                     if(Uart.bitCnt >= 10) {

173 // we've seen enough consecutive

174 // zeros that it's a valid SOF

175 Uart.posCnt = 0;

176 Uart.byteCnt = 0;

177 Uart.state = STATE_AWAITING_START_BIT;

178 LED_A_ON(); // Indicate we got a valid SOF

179 } else {

180 // didn't stay down long enough

181 // before going high, error

182 Uart.state = STATE_ERROR_WAIT;

183 }

184 } else {

185 // do nothing, keep waiting

186 }

187 Uart.bitCnt++;

188 }

             if(Uart.posCnt >= 4) Uart.posCnt = 0;

             if(Uart.bitCnt > 14) {

191 // Give up if we see too many zeros without

192 // a one, too.

193 Uart.state = STATE_ERROR_WAIT;

194 }

195 break;

196

197 case STATE_AWAITING_START_BIT:

198 Uart.posCnt++;

199 if(bit) {

                 if(Uart.posCnt > 25) {

201 // stayed high for too long between

202 // characters, error

203 Uart.state = STATE_ERROR_WAIT;

204 }

205 } else {

206 // falling edge, this starts the data byte

207 Uart.posCnt = 0;

208 Uart.bitCnt = 0;

209 Uart.shiftReg = 0;

210 Uart.state = STATE_RECEIVING_DATA;

211 LED_A_ON(); // Indicate we're receiving

212 }

213 break;

214

215 case STATE_RECEIVING_DATA:

216 Uart.posCnt++;

             if(Uart.posCnt == 2) {

218 // time to sample a bit

219 Uart.shiftReg >>= 1;

220 if(bit) {

221 Uart.shiftReg |= 0x200;

222 }

223 Uart.bitCnt++;

224 }

             if(Uart.posCnt >= 4) {

226 Uart.posCnt = 0;

227 }

             if(Uart.bitCnt == 10) {

                 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))

230 {

231 // this is a data byte, with correct

232 // start and stop bits

                     Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;

234 Uart.byteCnt++;

235

                     if(Uart.byteCnt >= Uart.byteCntMax) {

237 // Buffer overflowed, give up

238 Uart.posCnt = 0;

239 Uart.state = STATE_ERROR_WAIT;

240 } else {

241 // so get the next byte now

242 Uart.posCnt = 0;

243 Uart.state = STATE_AWAITING_START_BIT;

244 }

                 } else if(Uart.shiftReg == 0x000) {

246 // this is an EOF byte

247 LED_A_OFF(); // Finished receiving

248 return TRUE;

249 } else {

250 // this is an error

251 Uart.posCnt = 0;

252 Uart.state = STATE_ERROR_WAIT;

253 }

254 }

255 break;

256

257 case STATE_ERROR_WAIT:

258 // We're all screwed up, so wait a little while

259 // for whatever went wrong to finish, and then

260 // start over.

261 Uart.posCnt++;

             if(Uart.posCnt > 10) {

263 Uart.state = STATE_UNSYNCD;

264 }

265 break;

266

267 default:

268 Uart.state = STATE_UNSYNCD;

269 break;

270 }

271

272 // This row make the error blew circular buffer in hf 14b snoop

273 //if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error

274

275 return FALSE;

276 }

277

278 //-----------------------------------------------------------------------------

279 // Receive a command (from the reader to us, where we are the simulated tag),

280 // and store it in the given buffer, up to the given maximum length. Keeps

281 // spinning, waiting for a well-framed command, until either we get one

282 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).

283 //

284 // Assume that we're called with the SSC (to the FPGA) and ADC path set

285 // correctly.

286 //-----------------------------------------------------------------------------

 static int GetIso14443CommandFromReader(uint8_t *received, int *len, int maxLen)

288 {

289 uint8_t mask;

290 int i, bit;

291

292 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen

293 // only, since we are receiving, not transmitting).

294 // Signal field is off with the appropriate LED

295 LED_D_OFF();

296 FpgaWriteConfWord(

297 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);

298

299

300 // Now run a `software UART' on the stream of incoming samples.

301 Uart.output = received;

302 Uart.byteCntMax = maxLen;

303 Uart.state = STATE_UNSYNCD;

304

305 for(;;) {

306 WDT_HIT();

307

         if(BUTTON_PRESS()) return FALSE;

309

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

311 AT91C_BASE_SSC->SSC_THR = 0x00;

312 }

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

             uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;

315

316 mask = 0x80;

             for(i = 0; i < 8; i++, mask >>= 1) {

318 bit = (b & mask);

                 if(Handle14443UartBit(bit)) {

320 *len = Uart.byteCnt;

321 return TRUE;

322 }

323 }

324 }

325 }

326 }

327

328 //-----------------------------------------------------------------------------

329 // Main loop of simulated tag: receive commands from reader, decide what

330 // response to send, and send it.

331 //-----------------------------------------------------------------------------

 void SimulateIso14443Tag(void)

333 {

     static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };

335 static const uint8_t response1[] = {

         0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,

         0x00, 0x21, 0x85, 0x5e, 0xd7

338 };

339

340 uint8_t *resp;

341 int respLen;

342

     uint8_t *resp1 = (((uint8_t *)BigBuf) + 800);

344 int resp1Len;

345

     uint8_t *receivedCmd = (uint8_t *)BigBuf;

347 int len;

348

349 int i;

350

351 int cmdsRecvd = 0;

352

     memset(receivedCmd, 0x44, 400);

354

     CodeIso14443bAsTag(response1, sizeof(response1));

     memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;

357

358 // We need to listen to the high-frequency, peak-detected path.

359 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

360 FpgaSetupSsc();

361

362 cmdsRecvd = 0;

363

364 for(;;) {

365 uint8_t b1, b2;

366

         if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {

                 Dbprintf("button pressed, received %d commands", cmdsRecvd);

369 break;

370 }

371

372 // Good, look at the command now.

373

         if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {

375 resp = resp1; respLen = resp1Len;

376 } else {

             Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);

378 // And print whether the CRC fails, just for good measure

             ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);

             if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {

381 // Not so good, try again.

382 DbpString("+++CRC fail");

383 } else {

384 DbpString("CRC passes");

385 }

386 break;

387 }

388

         memset(receivedCmd, 0x44, 32);

390

391 cmdsRecvd++;

392

         if(cmdsRecvd > 0x30) {

394 DbpString("many commands later...");

395 break;

396 }

397

         if(respLen <= 0) continue;

399

400 // Modulate BPSK

401 // Signal field is off with the appropriate LED

402 LED_D_OFF();

403 FpgaWriteConfWord(

404 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);

405 AT91C_BASE_SSC->SSC_THR = 0xff;

406 FpgaSetupSsc();

407

408 // Transmit the response.

409 i = 0;

410 for(;;) {

             if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

412 uint8_t b = resp[i];

413

414 AT91C_BASE_SSC->SSC_THR = b;

415

416 i++;

417 if(i > respLen) {

418 break;

419 }

420 }

             if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

                 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;

423 (void)b;

424 }

425 }

426 }

427 }

428

429 //=============================================================================

430 // An ISO 14443 Type B reader. We take layer two commands, code them

431 // appropriately, and then send them to the tag. We then listen for the

432 // tag's response, which we leave in the buffer to be demodulated on the

433 // PC side.

434 //=============================================================================

435

436 static struct {

437 enum {

438 DEMOD_UNSYNCD,

439 DEMOD_PHASE_REF_TRAINING,

440 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,

441 DEMOD_GOT_FALLING_EDGE_OF_SOF,

442 DEMOD_AWAITING_START_BIT,

443 DEMOD_RECEIVING_DATA,

444 DEMOD_ERROR_WAIT

445 } state;

446 int bitCount;

447 int posCount;

448 int thisBit;

449 int metric;

450 int metricN;

451 uint16_t shiftReg;

452 uint8_t *output;

453 int len;

454 int sumI;

455 int sumQ;

456 } Demod;

457

458 /*

459 * Handles reception of a bit from the tag

460 *

461 * LED handling:

462 * LED C -> ON once we have received the SOF and are expecting the rest.

463 * LED C -> OFF once we have received EOF or are unsynced

464 *

465 * Returns: true if we received a EOF

466 * false if we are still waiting for some more

467 *

468 */

 static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)

470 {

471 int v;

472

473 // The soft decision on the bit uses an estimate of just the

474 // quadrant of the reference angle, not the exact angle.

475 #define MAKE_SOFT_DECISION() { \

476 if(Demod.sumI > 0) { \

477 v = ci; \

478 } else { \

479 v = -ci; \

480 } \

481 if(Demod.sumQ > 0) { \

482 v += cq; \

483 } else { \

484 v -= cq; \

485 } \

486 }

487

488 switch(Demod.state) {

489 case DEMOD_UNSYNCD:

490 v = ci;

             if(v < 0) v = -v;

             if(cq > 0) {

493 v += cq;

494 } else {

495 v -= cq;

496 }

             if(v > 40) {

498 Demod.posCount = 0;

499 Demod.state = DEMOD_PHASE_REF_TRAINING;

500 Demod.sumI = 0;

501 Demod.sumQ = 0;

502 }

503 break;

504

505 case DEMOD_PHASE_REF_TRAINING:

             if(Demod.posCount < 8) {

507 Demod.sumI += ci;

508 Demod.sumQ += cq;

             } else if(Demod.posCount > 100) {

510 // error, waited too long

511 Demod.state = DEMOD_UNSYNCD;

512 } else {

513 MAKE_SOFT_DECISION();

                 if(v < 0) {

515 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;

516 Demod.posCount = 0;

517 }

518 }

519 Demod.posCount++;

520 break;

521

522 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:

523 MAKE_SOFT_DECISION();

             if(v < 0) {

525 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;

526 Demod.posCount = 0;

527 } else {

                 if(Demod.posCount > 100) {

529 Demod.state = DEMOD_UNSYNCD;

530 }

531 }

532 Demod.posCount++;

533 break;

534

535 case DEMOD_GOT_FALLING_EDGE_OF_SOF:

536 MAKE_SOFT_DECISION();

             if(v > 0) {

                 if(Demod.posCount < 12) {

539 Demod.state = DEMOD_UNSYNCD;

540 } else {

541 LED_C_ON(); // Got SOF

542 Demod.state = DEMOD_AWAITING_START_BIT;

543 Demod.posCount = 0;

544 Demod.len = 0;

545 Demod.metricN = 0;

546 Demod.metric = 0;

547 }

548 } else {

                 if(Demod.posCount > 100) {

550 Demod.state = DEMOD_UNSYNCD;

551 }

552 }

553 Demod.posCount++;

554 break;

555

556 case DEMOD_AWAITING_START_BIT:

557 MAKE_SOFT_DECISION();

             if(v > 0) {

                 if(Demod.posCount > 10) {

560 Demod.state = DEMOD_UNSYNCD;

561 }

562 } else {

563 Demod.bitCount = 0;

564 Demod.posCount = 1;

565 Demod.thisBit = v;

566 Demod.shiftReg = 0;

567 Demod.state = DEMOD_RECEIVING_DATA;

568 }

569 break;

570

571 case DEMOD_RECEIVING_DATA:

572 MAKE_SOFT_DECISION();

             if(Demod.posCount == 0) {

574 Demod.thisBit = v;

575 Demod.posCount = 1;

576 } else {

577 Demod.thisBit += v;

578

                 if(Demod.thisBit > 0) {

580 Demod.metric += Demod.thisBit;

581 } else {

582 Demod.metric -= Demod.thisBit;

583 }

584 (Demod.metricN)++;

585

586 Demod.shiftReg >>= 1;

                 if(Demod.thisBit > 0) {

588 Demod.shiftReg |= 0x200;

589 }

590

591 Demod.bitCount++;

                 if(Demod.bitCount == 10) {

593 uint16_t s = Demod.shiftReg;

                     if((s & 0x200) && !(s & 0x001)) {

                         uint8_t b = (s >> 1);

                         Demod.output[Demod.len] = b;

597 Demod.len++;

598 Demod.state = DEMOD_AWAITING_START_BIT;

                     } else if(s == 0x000) {

600 // This is EOF

601 LED_C_OFF();

602 Demod.state = DEMOD_UNSYNCD;

603 return TRUE;

604 } else {

605 Demod.state = DEMOD_UNSYNCD;

606 }

607 }

608 Demod.posCount = 0;

609 }

610 break;

611

612 default:

613 Demod.state = DEMOD_UNSYNCD;

614 break;

615 }

616

     if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...

618 return FALSE;

619 }

620

621 /*

622 * Demodulate the samples we received from the tag

623 * weTx: set to 'TRUE' if we behave like a reader

624 * set to 'FALSE' if we behave like a snooper

625 * quiet: set to 'TRUE' to disable debug output

626 */

 static void GetSamplesFor14443Demod(int weTx, int n, int quiet)

628 {

629 int max = 0;

630 int gotFrame = FALSE;

631

632 //# define DMA_BUFFER_SIZE 8

633 int8_t *dmaBuf;

634

635 int lastRxCounter;

636 int8_t *upTo;

637

638 int ci, cq;

639

640 int samples = 0;

641

642 // Clear out the state of the "UART" that receives from the tag.

     memset(BigBuf, 0x00, 400);

     Demod.output = (uint8_t *)BigBuf;

645 Demod.len = 0;

646 Demod.state = DEMOD_UNSYNCD;

647

648 // And the UART that receives from the reader

     Uart.output = (((uint8_t *)BigBuf) + 1024);

650 Uart.byteCntMax = 100;

651 Uart.state = STATE_UNSYNCD;

652

653 // Setup for the DMA.

     dmaBuf = (int8_t *)(BigBuf + 32);

655 upTo = dmaBuf;

656 lastRxCounter = DEMOD_DMA_BUFFER_SIZE;

     FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);

658

659 // Signal field is ON with the appropriate LED:

     if (weTx) LED_D_ON(); else LED_D_OFF();

661 // And put the FPGA in the appropriate mode

662 FpgaWriteConfWord(

663 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |

         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));

665

666 for(;;) {

         int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;

         if(behindBy > max) max = behindBy;

669

         while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DEMOD_DMA_BUFFER_SIZE-1))

671 > 2)

672 {

673 ci = upTo[0];

674 cq = upTo[1];

675 upTo += 2;

             if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {

677 upTo -= DEMOD_DMA_BUFFER_SIZE;

                 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;

679 AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;

680 }

681 lastRxCounter -= 2;

             if(lastRxCounter <= 0) {

683 lastRxCounter += DEMOD_DMA_BUFFER_SIZE;

684 }

685

686 samples += 2;

687

688 Handle14443UartBit(1);

689 Handle14443UartBit(1);

690

             if(Handle14443SamplesDemod(ci, cq)) {

692 gotFrame = 1;

693 }

694 }

695

         if(samples > 2000) {

697 break;

698 }

699 }

700 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;

     if (!quiet) Dbprintf("%x %x %x", max, gotFrame, Demod.len);

702 }

703

704 //-----------------------------------------------------------------------------

705 // Read the tag's response. We just receive a stream of slightly-processed

706 // samples from the FPGA, which we will later do some signal processing on,

707 // to get the bits.

708 //-----------------------------------------------------------------------------

709 /*static void GetSamplesFor14443(int weTx, int n)

710 {

711 uint8_t *dest = (uint8_t *)BigBuf;

712 int c;

713

714 FpgaWriteConfWord(

715 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |

716 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));

717

718 c = 0;

719 for(;;) {

720 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

721 AT91C_BASE_SSC->SSC_THR = 0x43;

722 }

723 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

724 int8_t b;

725 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;

726

727 dest[c++] = (uint8_t)b;

728

729 if(c >= n) {

730 break;

731 }

732 }

733 }

734 }*/

735

736 //-----------------------------------------------------------------------------

737 // Transmit the command (to the tag) that was placed in ToSend[].

738 //-----------------------------------------------------------------------------

 static void TransmitFor14443(void)

740 {

741 int c;

742

743 FpgaSetupSsc();

744

     while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

746 AT91C_BASE_SSC->SSC_THR = 0xff;

747 }

748

749 // Signal field is ON with the appropriate Red LED

750 LED_D_ON();

751 // Signal we are transmitting with the Green LED

752 LED_B_ON();

753 FpgaWriteConfWord(

754 FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);

755

     for(c = 0; c < 10;) {

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

758 AT91C_BASE_SSC->SSC_THR = 0xff;

759 c++;

760 }

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

             volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;

763 (void)r;

764 }

765 WDT_HIT();

766 }

767

768 c = 0;

769 for(;;) {

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

771 AT91C_BASE_SSC->SSC_THR = ToSend[c];

772 c++;

773 if(c >= ToSendMax) {

774 break;

775 }

776 }

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

             volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;

779 (void)r;

780 }

781 WDT_HIT();

782 }

783 LED_B_OFF(); // Finished sending

784 }

785

786 //-----------------------------------------------------------------------------

787 // Code a layer 2 command (string of octets, including CRC) into ToSend[],

788 // so that it is ready to transmit to the tag using TransmitFor14443().

789 //-----------------------------------------------------------------------------

 static void CodeIso14443bAsReader(const uint8_t *cmd, int len)

791 {

792 int i, j;

793 uint8_t b;

794

795 ToSendReset();

796

797 // Establish initial reference level

     for(i = 0; i < 40; i++) {

799 ToSendStuffBit(1);

800 }

801 // Send SOF

     for(i = 0; i < 10; i++) {

803 ToSendStuffBit(0);

804 }

805

     for(i = 0; i < len; i++) {

807 // Stop bits/EGT

808 ToSendStuffBit(1);

809 ToSendStuffBit(1);

810 // Start bit

811 ToSendStuffBit(0);

812 // Data bits

813 b = cmd[i];

         for(j = 0; j < 8; j++) {

             if(b & 1) {

816 ToSendStuffBit(1);

817 } else {

818 ToSendStuffBit(0);

819 }

820 b >>= 1;

821 }

822 }

823 // Send EOF

824 ToSendStuffBit(1);

     for(i = 0; i < 10; i++) {

826 ToSendStuffBit(0);

827 }

     for(i = 0; i < 8; i++) {

829 ToSendStuffBit(1);

830 }

831

832 // And then a little more, to make sure that the last character makes

833 // it out before we switch to rx mode.

     for(i = 0; i < 24; i++) {

835 ToSendStuffBit(1);

836 }

837

838 // Convert from last character reference to length

839 ToSendMax++;

840 }

841

842 //-----------------------------------------------------------------------------

843 // Read an ISO 14443 tag. We send it some set of commands, and record the

844 // responses.

845 // The command name is misleading, it actually decodes the reponse in HEX

846 // into the output buffer (read the result using hexsamples, not hisamples)

847 //

848 // obsolete function only for test

849 //-----------------------------------------------------------------------------

 void AcquireRawAdcSamplesIso14443(uint32_t parameter)

851 {

     uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };

853

     SendRawCommand14443B(sizeof(cmd1),1,1,cmd1);

855 }

856

857 //-----------------------------------------------------------------------------

858 // Read a SRI512 ISO 14443 tag.

859 //

860 // SRI512 tags are just simple memory tags, here we're looking at making a dump

861 // of the contents of the memory. No anticollision algorithm is done, we assume

862 // we have a single tag in the field.

863 //

864 // I tried to be systematic and check every answer of the tag, every CRC, etc...

865 //-----------------------------------------------------------------------------

 void ReadSTMemoryIso14443(uint32_t dwLast)

867 {

868 uint8_t i = 0x00;

869

870 // Make sure that we start from off, since the tags are stateful;

871 // confusing things will happen if we don't reset them between reads.

872 LED_D_OFF();

873 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

874 SpinDelay(200);

875

876 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

877 FpgaSetupSsc();

878

879 // Now give it time to spin up.

880 // Signal field is on with the appropriate LED

881 LED_D_ON();

882 FpgaWriteConfWord(

883 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);

884 SpinDelay(200);

885

886 // First command: wake up the tag using the INITIATE command

     uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};

     CodeIso14443bAsReader(cmd1, sizeof(cmd1));

889 TransmitFor14443();

890 // LED_A_ON();

     GetSamplesFor14443Demod(TRUE, 2000,TRUE);

892 // LED_A_OFF();

893

     if (Demod.len == 0) {

895 DbpString("No response from tag");

896 return;

897 } else {

898 Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",

                 Demod.output[0], Demod.output[1],Demod.output[2]);

900 }

901 // There is a response, SELECT the uid

902 DbpString("Now SELECT tag:");

     cmd1[0] = 0x0E; // 0x0E is SELECT

     cmd1[1] = Demod.output[0];

     ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);

     CodeIso14443bAsReader(cmd1, sizeof(cmd1));

907 TransmitFor14443();

908 // LED_A_ON();

     GetSamplesFor14443Demod(TRUE, 2000,TRUE);

910 // LED_A_OFF();

     if (Demod.len != 3) {

         Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);

913 return;

914 }

915 // Check the CRC of the answer:

     ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);

     if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {

918 DbpString("CRC Error reading select response.");

919 return;

920 }

921 // Check response from the tag: should be the same UID as the command we just sent:

     if (cmd1[1] != Demod.output[0]) {

         Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);

924 return;

925 }

926 // Tag is now selected,

927 // First get the tag's UID:

     cmd1[0] = 0x0B;

     ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);

     CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one

931 TransmitFor14443();

932 // LED_A_ON();

     GetSamplesFor14443Demod(TRUE, 2000,TRUE);

934 // LED_A_OFF();

     if (Demod.len != 10) {

         Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);

937 return;

938 }

939 // The check the CRC of the answer (use cmd1 as temporary variable):

     ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);

            if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {

942 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",

                 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);

944 // Do not return;, let's go on... (we should retry, maybe ?)

945 }

946 Dbprintf("Tag UID (64 bits): %08x %08x",

         (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],

         (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);

949

950 // Now loop to read all 16 blocks, address from 0 to last block

     Dbprintf("Tag memory dump, block 0 to %d",dwLast);

     cmd1[0] = 0x08;

953 i = 0x00;

954 dwLast++;

955 for (;;) {

956 if (i == dwLast) {

957 DbpString("System area block (0xff):");

958 i = 0xff;

959 }

960 cmd1[1] = i;

             ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);

             CodeIso14443bAsReader(cmd1, sizeof(cmd1));

963 TransmitFor14443();

964 // LED_A_ON();

             GetSamplesFor14443Demod(TRUE, 2000,TRUE);

966 // LED_A_OFF();

             if (Demod.len != 6) { // Check if we got an answer from the tag

968 DbpString("Expected 6 bytes from tag, got less...");

969 return;

970 }

971 // The check the CRC of the answer (use cmd1 as temporary variable):

             ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);

             if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {

974 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",

                         (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);

976 // Do not return;, let's go on... (we should retry, maybe ?)

977 }

978 // Now print out the memory location:

             Dbprintf("Address=%x, Contents=%x, CRC=%x", i,

                 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],

                 (Demod.output[4]<<8)+Demod.output[5]);

             if (i == 0xff) {

983 break;

984 }

985 i++;

986 }

987 }

988

989

990 //=============================================================================

991 // Finally, the `sniffer' combines elements from both the reader and

992 // simulated tag, to show both sides of the conversation.

993 //=============================================================================

994

995 //-----------------------------------------------------------------------------

996 // Record the sequence of commands sent by the reader to the tag, with

997 // triggering so that we start recording at the point that the tag is moved

998 // near the reader.

999 //-----------------------------------------------------------------------------

1000 /*

1001 * Memory usage for this function, (within BigBuf)

1002 * 0-4095 : Demodulated samples receive (4096 bytes) - DEMOD_TRACE_SIZE

1003 * 4096-6143 : Last Received command, 2048 bytes (reader->tag) - READER_TAG_BUFFER_SIZE

1004 * 6144-8191 : Last Received command, 2048 bytes(tag->reader) - TAG_READER_BUFFER_SIZE

1005 * 8192-9215 : DMA Buffer, 1024 bytes (samples) - DEMOD_DMA_BUFFER_SIZE

1006 */

 void RAMFUNC SnoopIso14443(void)

1008 {

1009 // We won't start recording the frames that we acquire until we trigger;

1010 // a good trigger condition to get started is probably when we see a

1011 // response from the tag.

1012 int triggered = TRUE;

1013

1014 // The command (reader -> tag) that we're working on receiving.

     uint8_t *receivedCmd = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE;

1016 // The response (tag -> reader) that we're working on receiving.

     uint8_t *receivedResponse = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE;

1018

1019 // As we receive stuff, we copy it from receivedCmd or receivedResponse

1020 // into trace, along with its length and other annotations.

     uint8_t *trace = (uint8_t *)BigBuf;

1022 int traceLen = 0;

1023

1024 // The DMA buffer, used to stream samples from the FPGA.

     int8_t *dmaBuf = (int8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE + TAG_READER_BUFFER_SIZE;

1026 int lastRxCounter;

1027 int8_t *upTo;

1028 int ci, cq;

1029 int maxBehindBy = 0;

1030

1031 // Count of samples received so far, so that we can include timing

1032 // information in the trace buffer.

1033 int samples = 0;

1034

1035 // Initialize the trace buffer

     memset(trace, 0x44, DEMOD_TRACE_SIZE);

1037

1038 // Set up the demodulator for tag -> reader responses.

1039 Demod.output = receivedResponse;

1040 Demod.len = 0;

1041 Demod.state = DEMOD_UNSYNCD;

1042

1043 // And the reader -> tag commands

     memset(&Uart, 0, sizeof(Uart));

1045 Uart.output = receivedCmd;

1046 Uart.byteCntMax = 100;

1047 Uart.state = STATE_UNSYNCD;

1048

1049 // Print some debug information about the buffer sizes

1050 Dbprintf("Snooping buffers initialized:");

     Dbprintf("  Trace: %i bytes", DEMOD_TRACE_SIZE);

     Dbprintf("  Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);

     Dbprintf("  tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);

     Dbprintf("  DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);

1055

1056 // And put the FPGA in the appropriate mode

1057 // Signal field is off with the appropriate LED

1058 LED_D_OFF();

1059 FpgaWriteConfWord(

1060 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |

1061 FPGA_HF_READER_RX_XCORR_SNOOP);

1062 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1063

1064 // Setup for the DMA.

1065 FpgaSetupSsc();

1066 upTo = dmaBuf;

1067 lastRxCounter = DEMOD_DMA_BUFFER_SIZE;

     FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);

1069

1070 LED_A_ON();

1071

1072 // And now we loop, receiving samples.

1073 for(;;) {

         int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &

1075 (DEMOD_DMA_BUFFER_SIZE-1);

1076 if(behindBy > maxBehindBy) {

1077 maxBehindBy = behindBy;

             if(behindBy > (DEMOD_DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?

                 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);

1080 goto done;

1081 }

1082 }

         if(behindBy < 2) continue;

1084

1085 ci = upTo[0];

1086 cq = upTo[1];

1087 upTo += 2;

1088 lastRxCounter -= 2;

         if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {

1090 upTo -= DEMOD_DMA_BUFFER_SIZE;

1091 lastRxCounter += DEMOD_DMA_BUFFER_SIZE;

             AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;

1093 AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;

1094 }

1095

1096 samples += 2;

1097

1098 #define HANDLE_BIT_IF_BODY \

1099 if(triggered) { \

1100 trace[traceLen++] = ((samples >> 0) & 0xff); \

1101 trace[traceLen++] = ((samples >> 8) & 0xff); \

1102 trace[traceLen++] = ((samples >> 16) & 0xff); \

1103 trace[traceLen++] = ((samples >> 24) & 0xff); \

1104 trace[traceLen++] = 0; \

1105 trace[traceLen++] = 0; \

1106 trace[traceLen++] = 0; \

1107 trace[traceLen++] = 0; \

1108 trace[traceLen++] = Uart.byteCnt; \

1109 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \

1110 traceLen += Uart.byteCnt; \

1111 if(traceLen > 1000) break; \

1112 } \

1113 /* And ready to receive another command. */ \

1114 memset(&Uart, 0, sizeof(Uart)); \

1115 Uart.output = receivedCmd; \

1116 Uart.byteCntMax = 100; \

1117 Uart.state = STATE_UNSYNCD; \

1118 /* And also reset the demod code, which might have been */ \

1119 /* false-triggered by the commands from the reader. */ \

1120 memset(&Demod, 0, sizeof(Demod)); \

1121 Demod.output = receivedResponse; \

1122 Demod.state = DEMOD_UNSYNCD; \

1123

1124 if(Handle14443UartBit(ci & 1)) {

1125 HANDLE_BIT_IF_BODY

1126 }

         if(Handle14443UartBit(cq & 1)) {

1128 HANDLE_BIT_IF_BODY

1129 }

1130

         if(Handle14443SamplesDemod(ci, cq)) {

1132 // timestamp, as a count of samples

             trace[traceLen++] = ((samples >>  0) & 0xff);

             trace[traceLen++] = ((samples >>  8) & 0xff);

             trace[traceLen++] = ((samples >> 16) & 0xff);

             trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);

1137 // correlation metric (~signal strength estimate)

             if(Demod.metricN != 0) {

1139 Demod.metric /= Demod.metricN;

1140 }

             trace[traceLen++] = ((Demod.metric >>  0) & 0xff);

             trace[traceLen++] = ((Demod.metric >>  8) & 0xff);

             trace[traceLen++] = ((Demod.metric >> 16) & 0xff);

             trace[traceLen++] = ((Demod.metric >> 24) & 0xff);

1145 // length

1146 trace[traceLen++] = Demod.len;

             memcpy(trace+traceLen, receivedResponse, Demod.len);

1148 traceLen += Demod.len;

1149 if(traceLen > DEMOD_TRACE_SIZE) {

1150 DbpString("Reached trace limit");

1151 goto done;

1152 }

1153

1154 triggered = TRUE;

1155 LED_A_OFF();

1156 LED_B_ON();

1157

1158 // And ready to receive another response.

             memset(&Demod, 0, sizeof(Demod));

1160 Demod.output = receivedResponse;

1161 Demod.state = DEMOD_UNSYNCD;

1162 }

1163 WDT_HIT();

1164

1165 if(BUTTON_PRESS()) {

1166 DbpString("cancelled");

1167 goto done;

1168 }

1169 }

1170

1171 done:

1172 LED_A_OFF();

1173 LED_B_OFF();

1174 LED_C_OFF();

1175 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;

1176 DbpString("Snoop statistics:");

   Dbprintf("  Max behind by: %i", maxBehindBy);

         Dbprintf("  Uart State: %x", Uart.state);

         Dbprintf("  Uart ByteCnt: %i", Uart.byteCnt);

         Dbprintf("  Uart ByteCntMax: %i", Uart.byteCntMax);

         Dbprintf("  Trace length: %i", traceLen);

1182 }

1183

1184 /*

1185 * Send raw command to tag ISO14443B

1186 * @Input

1187 * datalen len of buffer data

1188 * recv bool when true wait for data from tag and send to client

1189 * powerfield bool leave the field on when true

1190 * data buffer with byte to send

1191 *

1192 * @Output

1193 * none

1194 *

1195 */

1196

 void SendRawCommand14443B(uint32_t datalen, uint32_t recv,uint8_t powerfield, uint8_t data[])

1198 {

1199 if(!powerfield)

1200 {

1201 // Make sure that we start from off, since the tags are stateful;

1202 // confusing things will happen if we don't reset them between reads.

1203 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1204 LED_D_OFF();

1205 SpinDelay(200);

1206 }

1207

     if(!GETBIT(GPIO_LED_D))

1209 {

1210 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1211 FpgaSetupSsc();

1212

1213 // Now give it time to spin up.

1214 // Signal field is on with the appropriate LED

1215 LED_D_ON();

1216 FpgaWriteConfWord(

1217 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);

1218 SpinDelay(200);

1219 }

1220

1221 CodeIso14443bAsReader(data, datalen);

1222 TransmitFor14443();

1223 if(recv)

1224 {

         uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);

         GetSamplesFor14443Demod(TRUE, 2000, TRUE);

         cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);

1228 }

1229 if(!powerfield)

1230 {

1231 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1232 LED_D_OFF();

1233 }

1234 }

1235