git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

2 // Gerhard de Koning Gans - May 2008

3 // Hagen Fritsch - June 2010

4 // Gerhard de Koning Gans - May 2011

5 // Gerhard de Koning Gans - June 2012 - Added iClass card and reader emulation

6 //

7 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

8 // at your option, any later version. See the LICENSE.txt file for the text of

9 // the license.

10 //-----------------------------------------------------------------------------

11 // Routines to support iClass.

12 //-----------------------------------------------------------------------------

13 // Based on ISO14443a implementation. Still in experimental phase.

14 // Contribution made during a security research at Radboud University Nijmegen

15 //

16 // Please feel free to contribute and extend iClass support!!

17 //-----------------------------------------------------------------------------

18 //

19 // FIX:

20 // ====

21 // We still have sometimes a demodulation error when snooping iClass communication.

22 // The resulting trace of a read-block-03 command may look something like this:

23 //

24 // + 22279: : 0c 03 e8 01

25 //

26 // ...with an incorrect answer...

27 //

28 // + 85: 0: TAG ff! ff! ff! ff! ff! ff! ff! ff! bb 33 bb 00 01! 0e! 04! bb !crc

29 //

30 // We still left the error signalling bytes in the traces like 0xbb

31 //

32 // A correct trace should look like this:

33 //

34 // + 21112: : 0c 03 e8 01

35 // + 85: 0: TAG ff ff ff ff ff ff ff ff ea f5

36 //

37 //-----------------------------------------------------------------------------

39 #include "proxmark3.h"

40 #include "apps.h"

41 #include "util.h"

42 #include "string.h"

43 #include "common.h"

44 #include "cmd.h"

45 #include "iso14443a.h"

46 // Needed for CRC in emulation mode;

47 // same construction as in ISO 14443;

48 // different initial value (CRC_ICLASS)

49 #include "iso14443crc.h"

50 #include "iso15693tools.h"

51 #include "protocols.h"

52 #include "optimized_cipher.h"

53 #include "usb_cdc.h" // for usb_poll_validate_length

54 #include "fpgaloader.h"

56 static int timeout = 4096;

 static int SendIClassAnswer(uint8_t *resp, int respLen, int delay);

61 //-----------------------------------------------------------------------------

62 // The software UART that receives commands from the reader, and its state

63 // variables.

64 //-----------------------------------------------------------------------------

65 static struct {

66 enum {

67 STATE_UNSYNCD,

68 STATE_START_OF_COMMUNICATION,

69 STATE_RECEIVING

70 } state;

71 uint16_t shiftReg;

72 int bitCnt;

73 int byteCnt;

74 int byteCntMax;

75 int posCnt;

76 int nOutOfCnt;

77 int OutOfCnt;

78 int syncBit;

79 int samples;

80 int highCnt;

81 int swapper;

82 int counter;

83 int bitBuffer;

84 int dropPosition;

85 uint8_t *output;

86 } Uart;

 static RAMFUNC int OutOfNDecoding(int bit)

89 {

90 //int error = 0;

91 int bitright;

93 if(!Uart.bitBuffer) {

                 Uart.bitBuffer = bit ^ 0xFF0;

95 return false;

96 }

97 else {

98 Uart.bitBuffer <<= 4;

99 Uart.bitBuffer ^= bit;

100 }

101

102 /*if(Uart.swapper) {

103 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;

104 Uart.byteCnt++;

105 Uart.swapper = 0;

106 if(Uart.byteCnt > 15) { return true; }

107 }

108 else {

109 Uart.swapper = 1;

110 }*/

111

         if(Uart.state != STATE_UNSYNCD) {

113 Uart.posCnt++;

114

                 if((Uart.bitBuffer & Uart.syncBit) ^ Uart.syncBit) {

116 bit = 0x00;

117 }

118 else {

119 bit = 0x01;

120 }

                 if(((Uart.bitBuffer << 1) & Uart.syncBit) ^ Uart.syncBit) {

122 bitright = 0x00;

123 }

124 else {

125 bitright = 0x01;

126 }

                 if(bit != bitright) { bit = bitright; }

128

129

130 // So, now we only have to deal with *bit*, lets see...

                 if(Uart.posCnt == 1) {

132 // measurement first half bitperiod

133 if(!bit) {

134 // Drop in first half means that we are either seeing

135 // an SOF or an EOF.

136

                                 if(Uart.nOutOfCnt == 1) {

138 // End of Communication

139 Uart.state = STATE_UNSYNCD;

140 Uart.highCnt = 0;

                                         if(Uart.byteCnt == 0) {

142 // Its not straightforward to show single EOFs

143 // So just leave it and do not return true

                                                 Uart.output[0] = 0xf0;

145 Uart.byteCnt++;

146 }

147 else {

148 return true;

149 }

150 }

                                 else if(Uart.state != STATE_START_OF_COMMUNICATION) {

152 // When not part of SOF or EOF, it is an error

153 Uart.state = STATE_UNSYNCD;

154 Uart.highCnt = 0;

155 //error = 4;

156 }

157 }

158 }

159 else {

160 // measurement second half bitperiod

161 // Count the bitslot we are in... (ISO 15693)

162 Uart.nOutOfCnt++;

163

164 if(!bit) {

165 if(Uart.dropPosition) {

                                         if(Uart.state == STATE_START_OF_COMMUNICATION) {

167 //error = 1;

168 }

169 else {

170 //error = 7;

171 }

172 // It is an error if we already have seen a drop in current frame

173 Uart.state = STATE_UNSYNCD;

174 Uart.highCnt = 0;

175 }

176 else {

177 Uart.dropPosition = Uart.nOutOfCnt;

178 }

179 }

180

181 Uart.posCnt = 0;

182

183

                         if(Uart.nOutOfCnt == Uart.OutOfCnt && Uart.OutOfCnt == 4) {

185 Uart.nOutOfCnt = 0;

186

                                 if(Uart.state == STATE_START_OF_COMMUNICATION) {

                                         if(Uart.dropPosition == 4) {

189 Uart.state = STATE_RECEIVING;

190 Uart.OutOfCnt = 256;

191 }

                                         else if(Uart.dropPosition == 3) {

193 Uart.state = STATE_RECEIVING;

194 Uart.OutOfCnt = 4;

195 //Uart.output[Uart.byteCnt] = 0xdd;

196 //Uart.byteCnt++;

197 }

198 else {

199 Uart.state = STATE_UNSYNCD;

200 Uart.highCnt = 0;

201 }

202 Uart.dropPosition = 0;

203 }

204 else {

205 // RECEIVING DATA

206 // 1 out of 4

207 if(!Uart.dropPosition) {

208 Uart.state = STATE_UNSYNCD;

209 Uart.highCnt = 0;

210 //error = 9;

211 }

212 else {

213 Uart.shiftReg >>= 2;

214

215 // Swap bit order

216 Uart.dropPosition--;

217 //if(Uart.dropPosition == 1) { Uart.dropPosition = 2; }

218 //else if(Uart.dropPosition == 2) { Uart.dropPosition = 1; }

219

                                                 Uart.shiftReg ^= ((Uart.dropPosition & 0x03) << 6);

221 Uart.bitCnt += 2;

222 Uart.dropPosition = 0;

223

                                                 if(Uart.bitCnt == 8) {

                                                         Uart.output[Uart.byteCnt] = (Uart.shiftReg & 0xff);

226 Uart.byteCnt++;

227 Uart.bitCnt = 0;

228 Uart.shiftReg = 0;

229 }

230 }

231 }

232 }

                         else if(Uart.nOutOfCnt == Uart.OutOfCnt) {

234 // RECEIVING DATA

235 // 1 out of 256

236 if(!Uart.dropPosition) {

237 Uart.state = STATE_UNSYNCD;

238 Uart.highCnt = 0;

239 //error = 3;

240 }

241 else {

242 Uart.dropPosition--;

                                         Uart.output[Uart.byteCnt] = (Uart.dropPosition & 0xff);

244 Uart.byteCnt++;

245 Uart.bitCnt = 0;

246 Uart.shiftReg = 0;

247 Uart.nOutOfCnt = 0;

248 Uart.dropPosition = 0;

249 }

250 }

251

252 /*if(error) {

253 Uart.output[Uart.byteCnt] = 0xAA;

254 Uart.byteCnt++;

255 Uart.output[Uart.byteCnt] = error & 0xFF;

256 Uart.byteCnt++;

257 Uart.output[Uart.byteCnt] = 0xAA;

258 Uart.byteCnt++;

259 Uart.output[Uart.byteCnt] = (Uart.bitBuffer >> 8) & 0xFF;

260 Uart.byteCnt++;

261 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;

262 Uart.byteCnt++;

263 Uart.output[Uart.byteCnt] = (Uart.syncBit >> 3) & 0xFF;

264 Uart.byteCnt++;

265 Uart.output[Uart.byteCnt] = 0xAA;

266 Uart.byteCnt++;

267 return true;

268 }*/

269 }

270

271 }

272 else {

                 bit = Uart.bitBuffer & 0xf0;

274 bit >>= 4;

275 bit ^= 0x0F; // drops become 1s ;-)

276 if(bit) {

277 // should have been high or at least (4 * 128) / fc

278 // according to ISO this should be at least (9 * 128 + 20) / fc

                         if(Uart.highCnt == 8) {

280 // we went low, so this could be start of communication

281 // it turns out to be safer to choose a less significant

282 // syncbit... so we check whether the neighbour also represents the drop

                                 Uart.posCnt = 1;   // apparently we are busy with our first half bit period

                                 Uart.syncBit = bit & 8;

285 Uart.samples = 3;

                                 if(!Uart.syncBit)       { Uart.syncBit = bit & 4; Uart.samples = 2; }

                                 else if(bit & 4)        { Uart.syncBit = bit & 4; Uart.samples = 2; bit <<= 2; }

                                 if(!Uart.syncBit)       { Uart.syncBit = bit & 2; Uart.samples = 1; }

                                 else if(bit & 2)        { Uart.syncBit = bit & 2; Uart.samples = 1; bit <<= 1; }

                                 if(!Uart.syncBit)       { Uart.syncBit = bit & 1; Uart.samples = 0;

                                         if(Uart.syncBit && (Uart.bitBuffer & 8)) {

292 Uart.syncBit = 8;

293

294 // the first half bit period is expected in next sample

295 Uart.posCnt = 0;

296 Uart.samples = 3;

297 }

298 }

                                 else if(bit & 1)        { Uart.syncBit = bit & 1; Uart.samples = 0; }

300

301 Uart.syncBit <<= 4;

302 Uart.state = STATE_START_OF_COMMUNICATION;

303 Uart.bitCnt = 0;

304 Uart.byteCnt = 0;

305 Uart.nOutOfCnt = 0;

                                 Uart.OutOfCnt = 4; // Start at 1/4, could switch to 1/256

307 Uart.dropPosition = 0;

308 Uart.shiftReg = 0;

309 //error = 0;

310 }

311 else {

312 Uart.highCnt = 0;

313 }

314 }

315 else {

                         if(Uart.highCnt < 8) {

317 Uart.highCnt++;

318 }

319 }

320 }

321

322 return false;

323 }

324

325 //=============================================================================

326 // Manchester

327 //=============================================================================

328

329 static struct {

330 enum {

331 DEMOD_UNSYNCD,

332 DEMOD_START_OF_COMMUNICATION,

333 DEMOD_START_OF_COMMUNICATION2,

334 DEMOD_START_OF_COMMUNICATION3,

335 DEMOD_SOF_COMPLETE,

336 DEMOD_MANCHESTER_D,

337 DEMOD_MANCHESTER_E,

338 DEMOD_END_OF_COMMUNICATION,

339 DEMOD_END_OF_COMMUNICATION2,

340 DEMOD_MANCHESTER_F,

341 DEMOD_ERROR_WAIT

342 } state;

343 int bitCount;

344 int posCount;

345 int syncBit;

346 uint16_t shiftReg;

347 int buffer;

348 int buffer2;

349 int buffer3;

350 int buff;

351 int samples;

352 int len;

353 enum {

354 SUB_NONE,

355 SUB_FIRST_HALF,

356 SUB_SECOND_HALF,

357 SUB_BOTH

358 } sub;

359 uint8_t *output;

360 } Demod;

361

 static RAMFUNC int ManchesterDecoding(int v)

363 {

364 int bit;

365 int modulation;

366 int error = 0;

367

368 bit = Demod.buffer;

369 Demod.buffer = Demod.buffer2;

370 Demod.buffer2 = Demod.buffer3;

371 Demod.buffer3 = v;

372

         if(Demod.buff < 3) {

374 Demod.buff++;

375 return false;

376 }

377

         if(Demod.state==DEMOD_UNSYNCD) {

                 Demod.output[Demod.len] = 0xfa;

380 Demod.syncBit = 0;

381 //Demod.samples = 0;

                 Demod.posCount = 1;             // This is the first half bit period, so after syncing handle the second part

383

                 if(bit & 0x08) {

385 Demod.syncBit = 0x08;

386 }

387

                 if(bit & 0x04) {

389 if(Demod.syncBit) {

390 bit <<= 4;

391 }

392 Demod.syncBit = 0x04;

393 }

394

                 if(bit & 0x02) {

396 if(Demod.syncBit) {

397 bit <<= 2;

398 }

399 Demod.syncBit = 0x02;

400 }

401

                 if(bit & 0x01 && Demod.syncBit) {

403 Demod.syncBit = 0x01;

404 }

405

406 if(Demod.syncBit) {

407 Demod.len = 0;

408 Demod.state = DEMOD_START_OF_COMMUNICATION;

409 Demod.sub = SUB_FIRST_HALF;

410 Demod.bitCount = 0;

411 Demod.shiftReg = 0;

412 Demod.samples = 0;

413 if(Demod.posCount) {

414 //if(trigger) LED_A_OFF(); // Not useful in this case...

415 switch(Demod.syncBit) {

                                         case 0x08: Demod.samples = 3; break;

                                         case 0x04: Demod.samples = 2; break;

                                         case 0x02: Demod.samples = 1; break;

                                         case 0x01: Demod.samples = 0; break;

420 }

421 // SOF must be long burst... otherwise stay unsynced!!!

                                 if(!(Demod.buffer & Demod.syncBit) || !(Demod.buffer2 & Demod.syncBit)) {

423 Demod.state = DEMOD_UNSYNCD;

424 }

425 }

426 else {

427 // SOF must be long burst... otherwise stay unsynced!!!

                                 if(!(Demod.buffer2 & Demod.syncBit) || !(Demod.buffer3 & Demod.syncBit)) {

429 Demod.state = DEMOD_UNSYNCD;

430 error = 0x88;

431 }

432

433 }

434 error = 0;

435

436 }

437 }

438 else {

439 modulation = bit & Demod.syncBit;

                 modulation |= ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;

441

442 Demod.samples += 4;

443

                 if(Demod.posCount==0) {

445 Demod.posCount = 1;

446 if(modulation) {

447 Demod.sub = SUB_FIRST_HALF;

448 }

449 else {

450 Demod.sub = SUB_NONE;

451 }

452 }

453 else {

454 Demod.posCount = 0;

455 /*(modulation && (Demod.sub == SUB_FIRST_HALF)) {

456 if(Demod.state!=DEMOD_ERROR_WAIT) {

457 Demod.state = DEMOD_ERROR_WAIT;

458 Demod.output[Demod.len] = 0xaa;

459 error = 0x01;

460 }

461 }*/

462 //else if(modulation) {

463 if(modulation) {

                                 if(Demod.sub == SUB_FIRST_HALF) {

465 Demod.sub = SUB_BOTH;

466 }

467 else {

468 Demod.sub = SUB_SECOND_HALF;

469 }

470 }

                         else if(Demod.sub == SUB_NONE) {

                                 if(Demod.state == DEMOD_SOF_COMPLETE) {

                                         Demod.output[Demod.len] = 0x0f;

474 Demod.len++;

475 Demod.state = DEMOD_UNSYNCD;

476 // error = 0x0f;

477 return true;

478 }

479 else {

480 Demod.state = DEMOD_ERROR_WAIT;

481 error = 0x33;

482 }

483 /*if(Demod.state!=DEMOD_ERROR_WAIT) {

484 Demod.state = DEMOD_ERROR_WAIT;

485 Demod.output[Demod.len] = 0xaa;

486 error = 0x01;

487 }*/

488 }

489

490 switch(Demod.state) {

491 case DEMOD_START_OF_COMMUNICATION:

                                         if(Demod.sub == SUB_BOTH) {

493 //Demod.state = DEMOD_MANCHESTER_D;

494 Demod.state = DEMOD_START_OF_COMMUNICATION2;

495 Demod.posCount = 1;

496 Demod.sub = SUB_NONE;

497 }

498 else {

                                                 Demod.output[Demod.len] = 0xab;

500 Demod.state = DEMOD_ERROR_WAIT;

501 error = 0xd2;

502 }

503 break;

504 case DEMOD_START_OF_COMMUNICATION2:

                                         if(Demod.sub == SUB_SECOND_HALF) {

506 Demod.state = DEMOD_START_OF_COMMUNICATION3;

507 }

508 else {

                                                 Demod.output[Demod.len] = 0xab;

510 Demod.state = DEMOD_ERROR_WAIT;

511 error = 0xd3;

512 }

513 break;

514 case DEMOD_START_OF_COMMUNICATION3:

                                         if(Demod.sub == SUB_SECOND_HALF) {

516 // Demod.state = DEMOD_MANCHESTER_D;

517 Demod.state = DEMOD_SOF_COMPLETE;

518 //Demod.output[Demod.len] = Demod.syncBit & 0xFF;

519 //Demod.len++;

520 }

521 else {

                                                 Demod.output[Demod.len] = 0xab;

523 Demod.state = DEMOD_ERROR_WAIT;

524 error = 0xd4;

525 }

526 break;

527 case DEMOD_SOF_COMPLETE:

528 case DEMOD_MANCHESTER_D:

529 case DEMOD_MANCHESTER_E:

530 // OPPOSITE FROM ISO14443 - 11110000 = 0 (1 in 14443)

531 // 00001111 = 1 (0 in 14443)

                                         if(Demod.sub == SUB_SECOND_HALF) { // SUB_FIRST_HALF

533 Demod.bitCount++;

                                                 Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100;

535 Demod.state = DEMOD_MANCHESTER_D;

536 }

                                         else if(Demod.sub == SUB_FIRST_HALF) { // SUB_SECOND_HALF

538 Demod.bitCount++;

539 Demod.shiftReg >>= 1;

540 Demod.state = DEMOD_MANCHESTER_E;

541 }

                                         else if(Demod.sub == SUB_BOTH) {

543 Demod.state = DEMOD_MANCHESTER_F;

544 }

545 else {

546 Demod.state = DEMOD_ERROR_WAIT;

547 error = 0x55;

548 }

549 break;

550

551 case DEMOD_MANCHESTER_F:

552 // Tag response does not need to be a complete byte!

                                         if(Demod.len > 0 || Demod.bitCount > 0) {

                                                 if(Demod.bitCount > 1) {  // was > 0, do not interpret last closing bit, is part of EOF

                                                         Demod.shiftReg >>= (9 - Demod.bitCount);        // right align data

                                                         Demod.output[Demod.len] = Demod.shiftReg & 0xff;

557 Demod.len++;

558 }

559

560 Demod.state = DEMOD_UNSYNCD;

561 return true;

562 }

563 else {

                                                 Demod.output[Demod.len] = 0xad;

565 Demod.state = DEMOD_ERROR_WAIT;

566 error = 0x03;

567 }

568 break;

569

570 case DEMOD_ERROR_WAIT:

571 Demod.state = DEMOD_UNSYNCD;

572 break;

573

574 default:

                                         Demod.output[Demod.len] = 0xdd;

576 Demod.state = DEMOD_UNSYNCD;

577 break;

578 }

579

580 /*if(Demod.bitCount>=9) {

581 Demod.output[Demod.len] = Demod.shiftReg & 0xff;

582 Demod.len++;

583

584 Demod.parityBits <<= 1;

585 Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);

586

587 Demod.bitCount = 0;

588 Demod.shiftReg = 0;

589 }*/

                         if(Demod.bitCount>=8) {

591 Demod.shiftReg >>= 1;

                                 Demod.output[Demod.len] = (Demod.shiftReg & 0xff);

593 Demod.len++;

594 Demod.bitCount = 0;

595 Demod.shiftReg = 0;

596 }

597

598 if(error) {

                                 Demod.output[Demod.len] = 0xBB;

600 Demod.len++;

                                 Demod.output[Demod.len] = error & 0xFF;

602 Demod.len++;

                                 Demod.output[Demod.len] = 0xBB;

604 Demod.len++;

                                 Demod.output[Demod.len] = bit & 0xFF;

606 Demod.len++;

                                 Demod.output[Demod.len] = Demod.buffer & 0xFF;

608 Demod.len++;

609 // Look harder ;-)

                                 Demod.output[Demod.len] = Demod.buffer2 & 0xFF;

611 Demod.len++;

                                 Demod.output[Demod.len] = Demod.syncBit & 0xFF;

613 Demod.len++;

                                 Demod.output[Demod.len] = 0xBB;

615 Demod.len++;

616 return true;

617 }

618

619 }

620

621 } // end (state != UNSYNCED)

622

623 return false;

624 }

625

626 //=============================================================================

627 // Finally, a `sniffer' for iClass communication

628 // Both sides of communication!

629 //=============================================================================

630

631 //-----------------------------------------------------------------------------

632 // Record the sequence of commands sent by the reader to the tag, with

633 // triggering so that we start recording at the point that the tag is moved

634 // near the reader.

635 //-----------------------------------------------------------------------------

 void RAMFUNC SnoopIClass(void)

637 {

638

639

640 // We won't start recording the frames that we acquire until we trigger;

641 // a good trigger condition to get started is probably when we see a

642 // response from the tag.

643 //int triggered = false; // false to wait first for card

644

645 // The command (reader -> tag) that we're receiving.

646 // The length of a received command will in most cases be no more than 18 bytes.

647 // So 32 should be enough!

648 #define ICLASS_BUFFER_SIZE 32

649 uint8_t readerToTagCmd[ICLASS_BUFFER_SIZE];

650 // The response (tag -> reader) that we're receiving.

651 uint8_t tagToReaderResponse[ICLASS_BUFFER_SIZE];

652

653 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

654

655 // free all BigBuf memory

656 BigBuf_free();

657 // The DMA buffer, used to stream samples from the FPGA

     uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);

659

660 set_tracing(true);

661 clear_trace();

662 iso14a_set_trigger(false);

663

664 int lastRxCounter;

665 uint8_t *upTo;

666 int smpl;

667 int maxBehindBy = 0;

668

669 // Count of samples received so far, so that we can include timing

670 // information in the trace buffer.

671 int samples = 0;

672 rsamples = 0;

673

674 // Set up the demodulator for tag -> reader responses.

675 Demod.output = tagToReaderResponse;

676 Demod.len = 0;

677 Demod.state = DEMOD_UNSYNCD;

678

679 // Setup for the DMA.

680 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);

681 upTo = dmaBuf;

682 lastRxCounter = DMA_BUFFER_SIZE;

     FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);

684

685 // And the reader -> tag commands

     memset(&Uart, 0, sizeof(Uart));

687 Uart.output = readerToTagCmd;

     Uart.byteCntMax = 32; // was 100 (greg)////////////////////////////////////////////////////////////////////////

689 Uart.state = STATE_UNSYNCD;

690

691 // And put the FPGA in the appropriate mode

692 // Signal field is off with the appropriate LED

693 LED_D_OFF();

694 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER);

695 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

696

697 uint32_t time_0 = GetCountSspClk();

698 uint32_t time_start = 0;

699 uint32_t time_stop = 0;

700

701 int div = 0;

702 //int div2 = 0;

703 int decbyte = 0;

704 int decbyter = 0;

705

706 // And now we loop, receiving samples.

707 for(;;) {

708 LED_A_ON();

709 WDT_HIT();

         int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &

711 (DMA_BUFFER_SIZE-1);

712 if(behindBy > maxBehindBy) {

713 maxBehindBy = behindBy;

             if(behindBy > (9 * DMA_BUFFER_SIZE / 10)) {

                 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);

716 goto done;

717 }

718 }

         if(behindBy < 1) continue;

720

721 LED_A_OFF();

722 smpl = upTo[0];

723 upTo++;

724 lastRxCounter -= 1;

         if(upTo - dmaBuf > DMA_BUFFER_SIZE) {

726 upTo -= DMA_BUFFER_SIZE;

727 lastRxCounter += DMA_BUFFER_SIZE;

             AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;

729 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;

730 }

731

732 //samples += 4;

733 samples += 1;

734

         if(smpl & 0xF) {

                 decbyte ^= (1 << (3 - div));

737 }

738

739 // FOR READER SIDE COMMUMICATION...

740

741 decbyter <<= 2;

742 decbyter ^= (smpl & 0x30);

743

744 div++;

745

         if((div + 1) % 2 == 0) {

747 smpl = decbyter;

                 if(OutOfNDecoding((smpl & 0xF0) >> 4)) {

749 rsamples = samples - Uart.samples;

                         time_stop = (GetCountSspClk()-time_0) << 4;

751 LED_C_ON();

752

753 //if(!LogTrace(Uart.output,Uart.byteCnt, rsamples, Uart.parityBits,true)) break;

754 //if(!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, true)) break;

755 uint8_t parity[MAX_PARITY_SIZE];

                         GetParity(Uart.output, Uart.byteCnt, parity);

                         LogTrace(Uart.output,Uart.byteCnt, time_start, time_stop, parity, true);

758

759 /* And ready to receive another command. */

760 Uart.state = STATE_UNSYNCD;

761 /* And also reset the demod code, which might have been */

762 /* false-triggered by the commands from the reader. */

763 Demod.state = DEMOD_UNSYNCD;

764 LED_B_OFF();

765 Uart.byteCnt = 0;

766 }else{

                         time_start = (GetCountSspClk()-time_0) << 4;

768 }

769 decbyter = 0;

770 }

771

         if(div > 3) {

773 smpl = decbyte;

                 if(ManchesterDecoding(smpl & 0x0F)) {

                         time_stop = (GetCountSspClk()-time_0) << 4;

776

777 rsamples = samples - Demod.samples;

778 LED_B_ON();

779

780 uint8_t parity[MAX_PARITY_SIZE];

                         GetParity(Demod.output, Demod.len, parity);

                         LogTrace(Demod.output, Demod.len, time_start, time_stop, parity, false);

783

784 // And ready to receive another response.

                     memset(&Demod, 0, sizeof(Demod));

786 Demod.output = tagToReaderResponse;

787 Demod.state = DEMOD_UNSYNCD;

788 LED_C_OFF();

789 }else{

                         time_start = (GetCountSspClk()-time_0) << 4;

791 }

792

793 div = 0;

794 decbyte = 0x00;

795 }

796 //}

797

798 if(BUTTON_PRESS()) {

799 DbpString("cancelled_a");

800 goto done;

801 }

802 }

803

804 DbpString("COMMAND FINISHED");

805

     Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);

         Dbprintf("%x %x %x", Uart.byteCntMax, BigBuf_get_traceLen(), (int)Uart.output[0]);

808

809 done:

810 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;

     Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);

         Dbprintf("%x %x %x", Uart.byteCntMax, BigBuf_get_traceLen(), (int)Uart.output[0]);

813 LEDsoff();

814 }

815

 void rotateCSN(uint8_t* originalCSN, uint8_t* rotatedCSN) {

817 int i;

         for(i = 0; i < 8; i++) {

                 rotatedCSN[i] = (originalCSN[i] >> 3) | (originalCSN[(i+1)%8] << 5);

820 }

821 }

822

823 //-----------------------------------------------------------------------------

824 // Wait for commands from reader

825 // Stop when button is pressed

826 // Or return true when command is captured

827 //-----------------------------------------------------------------------------

 static int GetIClassCommandFromReader(uint8_t *received, int *len, int maxLen)

829 {

830 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen

831 // only, since we are receiving, not transmitting).

832 // Signal field is off with the appropriate LED

833 LED_D_OFF();

834 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);

835

836 // Now run a `software UART' on the stream of incoming samples.

837 Uart.output = received;

838 Uart.byteCntMax = maxLen;

839 Uart.state = STATE_UNSYNCD;

840

841 for(;;) {

842 WDT_HIT();

843

         if(BUTTON_PRESS()) return false;

845

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

847 AT91C_BASE_SSC->SSC_THR = 0x00;

848 }

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

             uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;

851

                         if(OutOfNDecoding(b & 0x0f)) {

853 *len = Uart.byteCnt;

854 return true;

855 }

856 }

857 }

858 }

859

 static uint8_t encode4Bits(const uint8_t b)

861 {

         uint8_t c = b & 0xF;

863 // OTA, the least significant bits first

864 // The columns are

865 // 1 - Bit value to send

866 // 2 - Reversed (big-endian)

867 // 3 - Encoded

868 // 4 - Hex values

869

870 switch(c){

871 // 1 2 3 4

           case 15: return 0x55; // 1111 -> 1111 -> 01010101 -> 0x55

           case 14: return 0x95; // 1110 -> 0111 -> 10010101 -> 0x95

           case 13: return 0x65; // 1101 -> 1011 -> 01100101 -> 0x65

           case 12: return 0xa5; // 1100 -> 0011 -> 10100101 -> 0xa5

           case 11: return 0x59; // 1011 -> 1101 -> 01011001 -> 0x59

           case 10: return 0x99; // 1010 -> 0101 -> 10011001 -> 0x99

           case 9:  return 0x69; // 1001 -> 1001 -> 01101001 -> 0x69

           case 8:  return 0xa9; // 1000 -> 0001 -> 10101001 -> 0xa9

           case 7:  return 0x56; // 0111 -> 1110 -> 01010110 -> 0x56

           case 6:  return 0x96; // 0110 -> 0110 -> 10010110 -> 0x96

           case 5:  return 0x66; // 0101 -> 1010 -> 01100110 -> 0x66

           case 4:  return 0xa6; // 0100 -> 0010 -> 10100110 -> 0xa6

           case 3:  return 0x5a; // 0011 -> 1100 -> 01011010 -> 0x5a

           case 2:  return 0x9a; // 0010 -> 0100 -> 10011010 -> 0x9a

           case 1:  return 0x6a; // 0001 -> 1000 -> 01101010 -> 0x6a

           default: return 0xaa; // 0000 -> 0000 -> 10101010 -> 0xaa

888

889 }

890 }

891

892 //-----------------------------------------------------------------------------

893 // Prepare tag messages

894 //-----------------------------------------------------------------------------

 static void CodeIClassTagAnswer(const uint8_t *cmd, int len)

896 {

897

898 /*

899 * SOF comprises 3 parts;

900 * * An unmodulated time of 56.64 us

901 * * 24 pulses of 423.75 KHz (fc/32)

902 * * A logic 1, which starts with an unmodulated time of 18.88us

903 * followed by 8 pulses of 423.75kHz (fc/32)

904 *

905 *

906 * EOF comprises 3 parts:

907 * - A logic 0 (which starts with 8 pulses of fc/32 followed by an unmodulated

908 * time of 18.88us.

909 * - 24 pulses of fc/32

910 * - An unmodulated time of 56.64 us

911 *

912 *

913 * A logic 0 starts with 8 pulses of fc/32

914 * followed by an unmodulated time of 256/fc (~18,88us).

915 *

916 * A logic 0 starts with unmodulated time of 256/fc (~18,88us) followed by

917 * 8 pulses of fc/32 (also 18.88us)

918 *

919 * The mode FPGA_HF_SIMULATOR_MODULATE_424K_8BIT which we use to simulate tag,

920 * works like this.

921 * - A 1-bit input to the FPGA becomes 8 pulses on 423.5kHz (fc/32) (18.88us).

922 * - A 0-bit inptu to the FPGA becomes an unmodulated time of 18.88us

923 *

924 * In this mode the SOF can be written as 00011101 = 0x1D

925 * The EOF can be written as 10111000 = 0xb8

926 * A logic 1 is 01

927 * A logic 0 is 10

928 *

929 * */

930

931 int i;

932

933 ToSendReset();

934

935 // Send SOF

936 ToSend[++ToSendMax] = 0x1D;

937

         for(i = 0; i < len; i++) {

939 uint8_t b = cmd[i];

                 ToSend[++ToSendMax] = encode4Bits(b & 0xF); //Least significant half

                 ToSend[++ToSendMax] = encode4Bits((b >>4) & 0xF);//Most significant half

942 }

943

944 // Send EOF

945 ToSend[++ToSendMax] = 0xB8;

946 //lastProxToAirDuration = 8*ToSendMax - 3*8 - 3*8;//Not counting zeroes in the beginning or end

947 // Convert from last byte pos to length

948 ToSendMax++;

949 }

950

951 // Only SOF

952 static void CodeIClassTagSOF()

953 {

954 //So far a dummy implementation, not used

955 //int lastProxToAirDuration =0;

956

957 ToSendReset();

958 // Send SOF

959 ToSend[++ToSendMax] = 0x1D;

960 // lastProxToAirDuration = 8*ToSendMax - 3*8;//Not counting zeroes in the beginning

961

962 // Convert from last byte pos to length

963 ToSendMax++;

964 }

965 #define MODE_SIM_CSN 0

966 #define MODE_EXIT_AFTER_MAC 1

967 #define MODE_FULLSIM 2

968

 int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf);

970 /**

971 * @brief SimulateIClass simulates an iClass card.

972 * @param arg0 type of simulation

973 * - 0 uses the first 8 bytes in usb data as CSN

974 * - 2 "dismantling iclass"-attack. This mode iterates through all CSN's specified

975 * in the usb data. This mode collects MAC from the reader, in order to do an offline

976 * attack on the keys. For more info, see "dismantling iclass" and proxclone.com.

977 * - Other : Uses the default CSN (031fec8af7ff12e0)

978 * @param arg1 - number of CSN's contained in datain (applicable for mode 2 only)

979 * @param arg2

980 * @param datain

981 */

 void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)

983 {

984 uint32_t simType = arg0;

985 uint32_t numberOfCSNS = arg1;

986 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

987

988 // Enable and clear the trace

989 set_tracing(true);

990 clear_trace();

991 //Use the emulator memory for SIM

         uint8_t *emulator = BigBuf_get_EM_addr();

993

         if(simType == 0) {

995 // Use the CSN from commandline

                 memcpy(emulator, datain, 8);

997 doIClassSimulation(MODE_SIM_CSN,NULL);

         }else if(simType == 1)

999 {

1000 //Default CSN

                 uint8_t csn_crc[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 };

1002 // Use the CSN from commandline

                 memcpy(emulator, csn_crc, 8);

1004 doIClassSimulation(MODE_SIM_CSN,NULL);

1005 }

         else if(simType == 2)

1007 {

1008

                 uint8_t mac_responses[USB_CMD_DATA_SIZE] = { 0 };

                 Dbprintf("Going into attack mode, %d CSNS sent", numberOfCSNS);

1011 // In this mode, a number of csns are within datain. We'll simulate each one, one at a time

1012 // in order to collect MAC's from the reader. This can later be used in an offlne-attack

1013 // in order to obtain the keys, as in the "dismantling iclass"-paper.

1014 int i = 0;

                 for( ; i < numberOfCSNS && i*8+8 < USB_CMD_DATA_SIZE; i++)

1016 {

1017 // The usb data is 512 bytes, fitting 65 8-byte CSNs in there.

1018

                         memcpy(emulator, datain+(i*8), 8);

                         if(doIClassSimulation(MODE_EXIT_AFTER_MAC,mac_responses+i*8))

1021 {

                                 cmd_send(CMD_ACK,CMD_SIMULATE_TAG_ICLASS,i,0,mac_responses,i*8);

1023 return; // Button pressed

1024 }

1025 }

                 cmd_send(CMD_ACK,CMD_SIMULATE_TAG_ICLASS,i,0,mac_responses,i*8);

1027

         }else if(simType == 3){

1029 //This is 'full sim' mode, where we use the emulator storage for data.

1030 doIClassSimulation(MODE_FULLSIM, NULL);

1031 }

1032 else{

1033 // We may want a mode here where we hardcode the csns to use (from proxclone).

1034 // That will speed things up a little, but not required just yet.

1035 Dbprintf("The mode is not implemented, reserved for future use");

1036 }

1037 Dbprintf("Done...");

1038

1039 }

 void AppendCrc(uint8_t* data, int len)

1041 {

         ComputeCrc14443(CRC_ICLASS,data,len,data+len,data+len+1);

1043 }

1044

1045 /**

1046 * @brief Does the actual simulation

1047 * @param csn - csn to use

1048 * @param breakAfterMacReceived if true, returns after reader MAC has been received.

1049 */

 int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)

1051 {

1052 // free eventually allocated BigBuf memory

1053 BigBuf_free_keep_EM();

1054

1055 State cipher_state;

1056 // State cipher_state_reserve;

         uint8_t *csn = BigBuf_get_EM_addr();

1058 uint8_t *emulator = csn;

1059 uint8_t sof_data[] = { 0x0F} ;

1060 // CSN followed by two CRC bytes

         uint8_t anticoll_data[10] = { 0 };

         uint8_t csn_data[10] = { 0 };

         memcpy(csn_data,csn,sizeof(csn_data));

         Dbprintf("Simulating CSN %02x%02x%02x%02x%02x%02x%02x%02x",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);

1065

1066 // Construct anticollision-CSN

1067 rotateCSN(csn_data,anticoll_data);

1068

1069 // Compute CRC on both CSNs

         ComputeCrc14443(CRC_ICLASS, anticoll_data, 8, &anticoll_data[8], &anticoll_data[9]);

         ComputeCrc14443(CRC_ICLASS, csn_data, 8, &csn_data[8], &csn_data[9]);

1072

         uint8_t diversified_key[8] = { 0 };

1074 // e-Purse

         uint8_t card_challenge_data[8] = { 0x00 };

1076 if(simulationMode == MODE_FULLSIM)

1077 {

1078 //The diversified key should be stored on block 3

1079 //Get the diversified key from emulator memory

                 memcpy(diversified_key, emulator+(8*3),8);

1081

1082 //Card challenge, a.k.a e-purse is on block 2

                 memcpy(card_challenge_data,emulator + (8 * 2) , 8);

1084 //Precalculate the cipher state, feeding it the CC

                 cipher_state = opt_doTagMAC_1(card_challenge_data,diversified_key);

1086

1087 }

1088

1089 int exitLoop = 0;

1090 // Reader 0a

1091 // Tag 0f

1092 // Reader 0c

1093 // Tag anticoll. CSN

1094 // Reader 81 anticoll. CSN

1095 // Tag CSN

1096

1097 uint8_t *modulated_response;

1098 int modulated_response_size = 0;

1099 uint8_t* trace_data = NULL;

1100 int trace_data_size = 0;

1101

1102

1103 // Respond SOF -- takes 1 bytes

         uint8_t *resp_sof = BigBuf_malloc(2);

1105 int resp_sof_Len;

1106

1107 // Anticollision CSN (rotated CSN)

1108 // 22: Takes 2 bytes for SOF/EOF and 10 * 2 = 20 bytes (2 bytes/byte)

         uint8_t *resp_anticoll = BigBuf_malloc(28);

1110 int resp_anticoll_len;

1111

1112 // CSN

1113 // 22: Takes 2 bytes for SOF/EOF and 10 * 2 = 20 bytes (2 bytes/byte)

         uint8_t *resp_csn = BigBuf_malloc(30);

1115 int resp_csn_len;

1116

1117 // e-Purse

1118 // 18: Takes 2 bytes for SOF/EOF and 8 * 2 = 16 bytes (2 bytes/bit)

         uint8_t *resp_cc = BigBuf_malloc(20);

1120 int resp_cc_len;

1121

         uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);

1123 int len;

1124

1125 // Prepare card messages

1126 ToSendMax = 0;

1127

1128 // First card answer: SOF

1129 CodeIClassTagSOF();

         memcpy(resp_sof, ToSend, ToSendMax); resp_sof_Len = ToSendMax;

1131

1132 // Anticollision CSN

         CodeIClassTagAnswer(anticoll_data, sizeof(anticoll_data));

         memcpy(resp_anticoll, ToSend, ToSendMax); resp_anticoll_len = ToSendMax;

1135

1136 // CSN

         CodeIClassTagAnswer(csn_data, sizeof(csn_data));

         memcpy(resp_csn, ToSend, ToSendMax); resp_csn_len = ToSendMax;

1139

1140 // e-Purse

         CodeIClassTagAnswer(card_challenge_data, sizeof(card_challenge_data));

         memcpy(resp_cc, ToSend, ToSendMax); resp_cc_len = ToSendMax;

1143

1144 //This is used for responding to READ-block commands or other data which is dynamically generated

1145 //First the 'trace'-data, not encoded for FPGA

         uint8_t *data_generic_trace = BigBuf_malloc(8 + 2);//8 bytes data + 2byte CRC is max tag answer

1147 //Then storage for the modulated data

1148 //Each bit is doubled when modulated for FPGA, and we also have SOF and EOF (2 bytes)

         uint8_t *data_response = BigBuf_malloc( (8+2) * 2 + 2);

1150

1151 // Start from off (no field generated)

1152 //FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1153 //SpinDelay(200);

1154 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);

1155 SpinDelay(100);

1156 StartCountSspClk();

1157 // We need to listen to the high-frequency, peak-detected path.

1158 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1159 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);

1160

1161 // To control where we are in the protocol

1162 int cmdsRecvd = 0;

1163 uint32_t time_0 = GetCountSspClk();

1164 uint32_t t2r_time =0;

1165 uint32_t r2t_time =0;

1166

1167 LED_A_ON();

1168 bool buttonPressed = false;

1169 uint8_t response_delay = 1;

1170 while(!exitLoop) {

1171 response_delay = 1;

1172 LED_B_OFF();

1173 //Signal tracer

1174 // Can be used to get a trigger for an oscilloscope..

1175 LED_C_OFF();

1176

                 if(!GetIClassCommandFromReader(receivedCmd, &len, 100)) {

1178 buttonPressed = true;

1179 break;

1180 }

1181 r2t_time = GetCountSspClk();

1182 //Signal tracer

1183 LED_C_ON();

1184

1185 // Okay, look at the command now.

                 if(receivedCmd[0] == ICLASS_CMD_ACTALL ) {

1187 // Reader in anticollission phase

                         modulated_response = resp_sof; modulated_response_size = resp_sof_Len; //order = 1;

1189 trace_data = sof_data;

1190 trace_data_size = sizeof(sof_data);

                 } else if(receivedCmd[0] == ICLASS_CMD_READ_OR_IDENTIFY && len == 1) {

1192 // Reader asks for anticollission CSN

                         modulated_response = resp_anticoll; modulated_response_size = resp_anticoll_len; //order = 2;

1194 trace_data = anticoll_data;

1195 trace_data_size = sizeof(anticoll_data);

1196 //DbpString("Reader requests anticollission CSN:");

                 } else if(receivedCmd[0] == ICLASS_CMD_SELECT) {

1198 // Reader selects anticollission CSN.

1199 // Tag sends the corresponding real CSN

                         modulated_response = resp_csn; modulated_response_size = resp_csn_len; //order = 3;

1201 trace_data = csn_data;

1202 trace_data_size = sizeof(csn_data);

1203 //DbpString("Reader selects anticollission CSN:");

                 } else if(receivedCmd[0] == ICLASS_CMD_READCHECK_KD) {

1205 // Read e-purse (88 02)

                         modulated_response = resp_cc; modulated_response_size = resp_cc_len; //order = 4;

1207 trace_data = card_challenge_data;

1208 trace_data_size = sizeof(card_challenge_data);

1209 LED_B_ON();

                 } else if(receivedCmd[0] == ICLASS_CMD_CHECK) {

1211 // Reader random and reader MAC!!!

1212 if(simulationMode == MODE_FULLSIM)

1213 {

1214 //NR, from reader, is in receivedCmd +1

                                 opt_doTagMAC_2(cipher_state,receivedCmd+1,data_generic_trace,diversified_key);

1216

1217 trace_data = data_generic_trace;

1218 trace_data_size = 4;

1219 CodeIClassTagAnswer(trace_data , trace_data_size);

                                 memcpy(data_response, ToSend, ToSendMax);

1221 modulated_response = data_response;

1222 modulated_response_size = ToSendMax;

1223 response_delay = 0;//We need to hurry here...

1224 //exitLoop = true;

1225 }else

1226 { //Not fullsim, we don't respond

1227 // We do not know what to answer, so lets keep quiet

                                 modulated_response = resp_sof; modulated_response_size = 0;

1229 trace_data = NULL;

1230 trace_data_size = 0;

1231 if (simulationMode == MODE_EXIT_AFTER_MAC){

1232 // dbprintf:ing ...

1233 Dbprintf("CSN: %02x %02x %02x %02x %02x %02x %02x %02x"

                                                            ,csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);

                                         Dbprintf("RDR:  (len=%02d): %02x %02x %02x %02x %02x %02x %02x %02x %02x",len,

                                                         receivedCmd[0], receivedCmd[1], receivedCmd[2],

                                                         receivedCmd[3], receivedCmd[4], receivedCmd[5],

                                                         receivedCmd[6], receivedCmd[7], receivedCmd[8]);

1239 if (reader_mac_buf != NULL)

1240 {

                                                 memcpy(reader_mac_buf,receivedCmd+1,8);

1242 }

1243 exitLoop = true;

1244 }

1245 }

1246

                 } else if(receivedCmd[0] == ICLASS_CMD_HALT && len == 1) {

1248 // Reader ends the session

                         modulated_response = resp_sof; modulated_response_size = 0; //order = 0;

1250 trace_data = NULL;

1251 trace_data_size = 0;

                 } else if(simulationMode == MODE_FULLSIM && receivedCmd[0] == ICLASS_CMD_READ_OR_IDENTIFY && len == 4){

1253 //Read block

                         uint16_t blk = receivedCmd[1];

1255 //Take the data...

                         memcpy(data_generic_trace, emulator+(blk << 3),8);

1257 //Add crc

                         AppendCrc(data_generic_trace, 8);

1259 trace_data = data_generic_trace;

1260 trace_data_size = 10;

1261 CodeIClassTagAnswer(trace_data , trace_data_size);

                         memcpy(data_response, ToSend, ToSendMax);

1263 modulated_response = data_response;

1264 modulated_response_size = ToSendMax;

                 }else if(receivedCmd[0] == ICLASS_CMD_UPDATE && simulationMode == MODE_FULLSIM)

1266 {//Probably the reader wants to update the nonce. Let's just ignore that for now.

1267 // OBS! If this is implemented, don't forget to regenerate the cipher_state

1268 //We're expected to respond with the data+crc, exactly what's already in the receivedcmd

1269 //receivedcmd is now UPDATE 1b | ADDRESS 1b| DATA 8b| Signature 4b or CRC 2b|

1270

1271 //Take the data...

                         memcpy(data_generic_trace, receivedCmd+2,8);

1273 //Add crc

                         AppendCrc(data_generic_trace, 8);

1275 trace_data = data_generic_trace;

1276 trace_data_size = 10;

1277 CodeIClassTagAnswer(trace_data , trace_data_size);

                         memcpy(data_response, ToSend, ToSendMax);

1279 modulated_response = data_response;

1280 modulated_response_size = ToSendMax;

1281 }

                 else if(receivedCmd[0] == ICLASS_CMD_PAGESEL)

1283 {//Pagesel

1284 //Pagesel enables to select a page in the selected chip memory and return its configuration block

1285 //Chips with a single page will not answer to this command

1286 // It appears we're fine ignoring this.

1287 //Otherwise, we should answer 8bytes (block) + 2bytes CRC

1288 }

1289 else {

1290 //#db# Unknown command received from reader (len=5): 26 1 0 f6 a 44 44 44 44

1291 // Never seen this command before

1292 Dbprintf("Unknown command received from reader (len=%d): %x %x %x %x %x %x %x %x %x",

1293 len,

                         receivedCmd[0], receivedCmd[1], receivedCmd[2],

                         receivedCmd[3], receivedCmd[4], receivedCmd[5],

                         receivedCmd[6], receivedCmd[7], receivedCmd[8]);

1297 // Do not respond

                         modulated_response = resp_sof; modulated_response_size = 0; //order = 0;

1299 trace_data = NULL;

1300 trace_data_size = 0;

1301 }

1302

                 if(cmdsRecvd >  100) {

1304 //DbpString("100 commands later...");

1305 //break;

1306 }

1307 else {

1308 cmdsRecvd++;

1309 }

1310 /**

1311 A legit tag has about 380us delay between reader EOT and tag SOF.

1312 **/

                 if(modulated_response_size > 0) {

                         SendIClassAnswer(modulated_response, modulated_response_size, response_delay);

1315 t2r_time = GetCountSspClk();

1316 }

1317

1318 uint8_t parity[MAX_PARITY_SIZE];

                 GetParity(receivedCmd, len, parity);

                 LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, (r2t_time-time_0) << 4, parity, true);

1321

1322 if (trace_data != NULL) {

                         GetParity(trace_data, trace_data_size, parity);

                         LogTrace(trace_data, trace_data_size, (t2r_time-time_0) << 4, (t2r_time-time_0) << 4, parity, false);

1325 }

1326 if(!get_tracing()) {

1327 DbpString("Trace full");

1328 //break;

1329 }

1330 }

1331

1332 //Dbprintf("%x", cmdsRecvd);

1333 LED_A_OFF();

1334 LED_B_OFF();

1335 LED_C_OFF();

1336

1337 if(buttonPressed)

1338 {

1339 DbpString("Button pressed");

1340 }

1341 return buttonPressed;

1342 }

1343

 static int SendIClassAnswer(uint8_t *resp, int respLen, int delay)

1345 {

         int i = 0, d=0;//, u = 0, d = 0;

1347 uint8_t b = 0;

1348

1349 //FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);

1350 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K_8BIT);

1351

1352 AT91C_BASE_SSC->SSC_THR = 0x00;

1353 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);

1354 while(!BUTTON_PRESS()) {

                 if((AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)){

                         b = AT91C_BASE_SSC->SSC_RHR; (void) b;

1357 }

                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)){

1359 b = 0x00;

1360 if(d < delay) {

1361 d++;

1362 }

1363 else {

1364 if( i < respLen){

1365 b = resp[i];

1366 //Hack

1367 //b = 0xAC;

1368 }

1369 i++;

1370 }

1371 AT91C_BASE_SSC->SSC_THR = b;

1372 }

1373

1374 // if (i > respLen +4) break;

                 if (i > respLen +1) break;

1376 }

1377

1378 return 0;

1379 }

1380

1381 /// THE READER CODE

1382

1383 //-----------------------------------------------------------------------------

1384 // Transmit the command (to the tag) that was placed in ToSend[].

1385 //-----------------------------------------------------------------------------

 static void TransmitIClassCommand(const uint8_t *cmd, int len, int *samples, int *wait)

1387 {

1388 int c;

1389 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);

1390 AT91C_BASE_SSC->SSC_THR = 0x00;

1391 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);

1392

1393 if (wait)

1394 {

      if(*wait < 10) *wait = 10;

1396

      for(c = 0; c < *wait;) {

        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

          AT91C_BASE_SSC->SSC_THR = 0x00;                // For exact timing!

1400 c++;

1401 }

        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

          volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;

1404 (void)r;

1405 }

1406 WDT_HIT();

1407 }

1408

1409 }

1410

1411

1412 uint8_t sendbyte;

1413 bool firstpart = true;

1414 c = 0;

1415 for(;;) {

     if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

1417

1418 // DOUBLE THE SAMPLES!

1419 if(firstpart) {

         sendbyte = (cmd[c] & 0xf0) | (cmd[c] >> 4); 

1421 }

1422 else {

         sendbyte = (cmd[c] & 0x0f) | (cmd[c] << 4);

1424 c++;

1425 }

       if(sendbyte == 0xff) {

1427 sendbyte = 0xfe;

1428 }

1429 AT91C_BASE_SSC->SSC_THR = sendbyte;

1430 firstpart = !firstpart;

1431

1432 if(c >= len) {

1433 break;

1434 }

1435 }

     if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

       volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;

1438 (void)r;

1439 }

1440 WDT_HIT();

1441 }

   if (samples && wait) *samples = (c + *wait) << 3;

1443 }

1444

1445

1446 //-----------------------------------------------------------------------------

1447 // Prepare iClass reader command to send to FPGA

1448 //-----------------------------------------------------------------------------

 void CodeIClassCommand(const uint8_t * cmd, int len)

1450 {

1451 int i, j, k;

1452 uint8_t b;

1453

1454 ToSendReset();

1455

1456 // Start of Communication: 1 out of 4

1457 ToSend[++ToSendMax] = 0xf0;

1458 ToSend[++ToSendMax] = 0x00;

1459 ToSend[++ToSendMax] = 0x0f;

1460 ToSend[++ToSendMax] = 0x00;

1461

1462 // Modulate the bytes

   for (i = 0; i < len; i++) {

1464 b = cmd[i];

     for(j = 0; j < 4; j++) {

       for(k = 0; k < 4; k++) {

                         if(k == (b & 3)) {

1468 ToSend[++ToSendMax] = 0xf0;

1469 }

1470 else {

1471 ToSend[++ToSendMax] = 0x00;

1472 }

1473 }

1474 b >>= 2;

1475 }

1476 }

1477

1478 // End of Communication

1479 ToSend[++ToSendMax] = 0x00;

1480 ToSend[++ToSendMax] = 0x00;

1481 ToSend[++ToSendMax] = 0xf0;

1482 ToSend[++ToSendMax] = 0x00;

1483

1484 // Convert from last character reference to length

1485 ToSendMax++;

1486 }

1487

 void ReaderTransmitIClass(uint8_t* frame, int len)

1489 {

1490 int wait = 0;

1491 int samples = 0;

1492

1493 // This is tied to other size changes

1494 CodeIClassCommand(frame,len);

1495

1496 // Select the card

         TransmitIClassCommand(ToSend, ToSendMax, &samples, &wait);

1498 if(trigger)

1499 LED_A_ON();

1500

1501 // Store reader command in buffer

1502 uint8_t par[MAX_PARITY_SIZE];

         GetParity(frame, len, par);

         LogTrace(frame, len, rsamples, rsamples, par, true);

1505 }

1506

1507 //-----------------------------------------------------------------------------

1508 // Wait a certain time for tag response

1509 // If a response is captured return true

1510 // If it takes too long return false

1511 //-----------------------------------------------------------------------------

 static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer

1513 {

1514 // buffer needs to be 512 bytes

1515 int c;

1516

1517 // Set FPGA mode to "reader listen mode", no modulation (listen

1518 // only, since we are receiving, not transmitting).

1519 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);

1520

1521 // Now get the answer from the card

1522 Demod.output = receivedResponse;

1523 Demod.len = 0;

1524 Demod.state = DEMOD_UNSYNCD;

1525

1526 uint8_t b;

         if (elapsed) *elapsed = 0;

1528

1529 bool skip = false;

1530

1531 c = 0;

1532 for(;;) {

1533 WDT_HIT();

1534

                 if(BUTTON_PRESS()) return false;

1536

                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

                         AT91C_BASE_SSC->SSC_THR = 0x00;  // To make use of exact timing of next command from reader!!

1539 if (elapsed) (*elapsed)++;

1540 }

                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

                         if(c < timeout) { c++; } else { return false; }

                         b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;

1544 skip = !skip;

                         if(skip) continue;

1546

                         if(ManchesterDecoding(b & 0x0f)) {

                                 *samples = c << 3;

1549 return true;

1550 }

1551 }

1552 }

1553 }

1554

 int ReaderReceiveIClass(uint8_t* receivedAnswer)

1556 {

1557 int samples = 0;

   if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return false;

1559 rsamples += samples;

1560 uint8_t parity[MAX_PARITY_SIZE];

   GetParity(receivedAnswer, Demod.len, parity);

   LogTrace(receivedAnswer,Demod.len,rsamples,rsamples,parity,false);

   if(samples == 0) return false;

1564 return Demod.len;

1565 }

1566

1567 void setupIclassReader()

1568 {

1569 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1570 // Reset trace buffer

1571 set_tracing(true);

1572 clear_trace();

1573

1574 // Setup SSC

1575 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);

1576 // Start from off (no field generated)

1577 // Signal field is off with the appropriate LED

1578 LED_D_OFF();

1579 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1580 SpinDelay(200);

1581

1582 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1583

1584 // Now give it time to spin up.

1585 // Signal field is on with the appropriate LED

1586 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);

1587 SpinDelay(200);

1588 LED_A_ON();

1589

1590 }

1591

 bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, uint8_t expected_size, uint8_t retries)

1593 {

         while(retries-- > 0)

1595 {

1596 ReaderTransmitIClass(command, cmdsize);

                 if(expected_size == ReaderReceiveIClass(resp)){

1598 return true;

1599 }

1600 }

1601 return false;//Error

1602 }

1603

1604 /**

1605 * @brief Talks to an iclass tag, sends the commands to get CSN and CC.

1606 * @param card_data where the CSN and CC are stored for return

1607 * @return 0 = fail

1608 * 1 = Got CSN

1609 * 2 = Got CSN and CC

1610 */

 uint8_t handshakeIclassTag_ext(uint8_t *card_data, bool use_credit_key)

1612 {

1613 static uint8_t act_all[] = { 0x0a };

1614 //static uint8_t identify[] = { 0x0c };

         static uint8_t identify[]    = { 0x0c, 0x00, 0x73, 0x33 };

         static uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

         static uint8_t readcheck_cc[]= { 0x88, 0x02 };

1618 if (use_credit_key)

                 readcheck_cc[0] = 0x18;

1620 else

                 readcheck_cc[0] = 0x88;

1622

1623 uint8_t resp[ICLASS_BUFFER_SIZE];

1624

1625 uint8_t read_status = 0;

1626

1627 // Send act_all

         ReaderTransmitIClass(act_all, 1);

1629 // Card present?

         if(!ReaderReceiveIClass(resp)) return read_status;//Fail

1631 //Send Identify

         ReaderTransmitIClass(identify, 1);

1633 //We expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC

         uint8_t len  = ReaderReceiveIClass(resp);

         if(len != 10) return read_status;//Fail

1636

1637 //Copy the Anti-collision CSN to our select-packet

         memcpy(&select[1],resp,8);

1639 //Select the card

         ReaderTransmitIClass(select, sizeof(select));

1641 //We expect a 10-byte response here, 8 byte CSN and 2 byte CRC

1642 len = ReaderReceiveIClass(resp);

         if(len != 10) return read_status;//Fail

1644

1645 //Success - level 1, we got CSN

1646 //Save CSN in response data

         memcpy(card_data,resp,8);

1648

1649 //Flag that we got to at least stage 1, read CSN

1650 read_status = 1;

1651

1652 // Card selected, now read e-purse (cc) (only 8 bytes no CRC)

         ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));

         if(ReaderReceiveIClass(resp) == 8) {

1655 //Save CC (e-purse) in response data

                 memcpy(card_data+8,resp,8);

1657 read_status++;

1658 }

1659

1660 return read_status;

1661 }

 uint8_t handshakeIclassTag(uint8_t *card_data) {

         return handshakeIclassTag_ext(card_data, false);

1664 }

1665

1666

1667 // Reader iClass Anticollission

 void ReaderIClass(uint8_t arg0) {

1669

         uint8_t card_data[6 * 8]={0};

         memset(card_data, 0xFF, sizeof(card_data));

         uint8_t last_csn[8]={0,0,0,0,0,0,0,0};

1673 uint8_t resp[ICLASS_BUFFER_SIZE];

         memset(resp, 0xFF, sizeof(resp));

1675 //Read conf block CRC(0x01) => 0xfa 0x22

         uint8_t readConf[] = { ICLASS_CMD_READ_OR_IDENTIFY,0x01, 0xfa, 0x22};

1677 //Read App Issuer Area block CRC(0x05) => 0xde 0x64

         uint8_t readAA[] = { ICLASS_CMD_READ_OR_IDENTIFY,0x05, 0xde, 0x64};

1679

1680 int read_status= 0;

1681 uint8_t result_status = 0;

1682 // flag to read until one tag is found successfully

1683 bool abort_after_read = arg0 & FLAG_ICLASS_READER_ONLY_ONCE;

1684 // flag to only try 5 times to find one tag then return

1685 bool try_once = arg0 & FLAG_ICLASS_READER_ONE_TRY;

1686 // if neither abort_after_read nor try_once then continue reading until button pressed.

1687

1688 bool use_credit_key = arg0 & FLAG_ICLASS_READER_CEDITKEY;

1689 // test flags for what blocks to be sure to read

1690 uint8_t flagReadConfig = arg0 & FLAG_ICLASS_READER_CONF;

1691 uint8_t flagReadCC = arg0 & FLAG_ICLASS_READER_CC;

1692 uint8_t flagReadAA = arg0 & FLAG_ICLASS_READER_AA;

1693

1694 set_tracing(true);

1695 setupIclassReader();

1696

1697 uint16_t tryCnt=0;

         bool userCancelled = BUTTON_PRESS() || usb_poll_validate_length();

1699 while(!userCancelled)

1700 {

1701 // if only looking for one card try 2 times if we missed it the first time

                 if (try_once && tryCnt > 2) break; 

1703 tryCnt++;

1704 if(!get_tracing()) {

1705 DbpString("Trace full");

1706 break;

1707 }

1708 WDT_HIT();

1709

                 read_status = handshakeIclassTag_ext(card_data, use_credit_key);

1711

                 if(read_status == 0) continue;

                 if(read_status == 1) result_status = FLAG_ICLASS_READER_CSN;

                 if(read_status == 2) result_status = FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CC;

1715

1716 // handshakeIclass returns CSN|CC, but the actual block

1717 // layout is CSN|CONFIG|CC, so here we reorder the data,

1718 // moving CC forward 8 bytes

                 memcpy(card_data+16,card_data+8, 8);

1720 //Read block 1, config

1721 if(flagReadConfig) {

                         if(sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, 10, 10))

1723 {

1724 result_status |= FLAG_ICLASS_READER_CONF;

                                 memcpy(card_data+8, resp, 8);

1726 } else {

1727 Dbprintf("Failed to dump config block");

1728 }

1729 }

1730

1731 //Read block 5, AA

1732 if(flagReadAA) {

                         if(sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, 10, 10))

1734 {

1735 result_status |= FLAG_ICLASS_READER_AA;

                                 memcpy(card_data+(8*5), resp, 8);

1737 } else {

1738 //Dbprintf("Failed to dump AA block");

1739 }

1740 }

1741

1742 // 0 : CSN

1743 // 1 : Configuration

1744 // 2 : e-purse

1745 // (3,4 write-only, kc and kd)

1746 // 5 Application issuer area

1747 //

1748 //Then we can 'ship' back the 8 * 6 bytes of data,

1749 // with 0xFF:s in block 3 and 4.

1750

1751 LED_B_ON();

1752 //Send back to client, but don't bother if we already sent this -

1753 // only useful if looping in arm (not try_once && not abort_after_read)

                 if(memcmp(last_csn, card_data, 8) != 0)

1755 {

1756 // If caller requires that we get Conf, CC, AA, continue until we got it

                         if( (result_status ^ FLAG_ICLASS_READER_CSN ^ flagReadConfig ^ flagReadCC ^ flagReadAA) == 0) {

                                 cmd_send(CMD_ACK,result_status,0,0,card_data,sizeof(card_data));

1759 if(abort_after_read) {

1760 LED_A_OFF();

1761 LED_B_OFF();

1762 return;

1763 }

1764 //Save that we already sent this....

                                 memcpy(last_csn, card_data, 8);

1766 }

1767

1768 }

1769 LED_B_OFF();

                 userCancelled = BUTTON_PRESS() || usb_poll_validate_length();

1771 }

1772 if (userCancelled) {

                 cmd_send(CMD_ACK,0xFF,0,0,card_data, 0);

1774 } else {

                 cmd_send(CMD_ACK,0,0,0,card_data, 0);

1776 }

1777 LED_A_OFF();

1778 }

1779

 void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {

1781

         uint8_t card_data[USB_CMD_DATA_SIZE]={0};

         uint16_t block_crc_LUT[255] = {0};

1784

1785 {//Generate a lookup table for block crc

                 for(int block = 0; block < 255; block++){

1787 char bl = block;

                         block_crc_LUT[block] = iclass_crc16(&bl ,1);

1789 }

1790 }

1791 //Dbprintf("Lookup table: %02x %02x %02x" ,block_crc_LUT[0],block_crc_LUT[1],block_crc_LUT[2]);

1792

         uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

         uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };

1795

1796 uint16_t crc = 0;

1797 uint8_t cardsize=0;

1798 uint8_t mem=0;

1799

1800 static struct memory_t{

1801 int k16;

1802 int book;

1803 int k2;

1804 int lockauth;

1805 int keyaccess;

1806 } memory;

1807

1808 uint8_t resp[ICLASS_BUFFER_SIZE];

1809

1810 setupIclassReader();

1811 set_tracing(true);

1812

1813 while(!BUTTON_PRESS()) {

1814

1815 WDT_HIT();

1816

1817 if(!get_tracing()) {

1818 DbpString("Trace full");

1819 break;

1820 }

1821

                 uint8_t read_status = handshakeIclassTag(card_data);

                 if(read_status < 2) continue;

1824

1825 //for now replay captured auth (as cc not updated)

                 memcpy(check+5,MAC,4);

1827

                 if(!sendCmdGetResponseWithRetries(check, sizeof(check),resp, 4, 5))

1829 {

1830 Dbprintf("Error: Authentication Fail!");

1831 continue;

1832 }

1833

1834 //first get configuration block (block 1)

1835 crc = block_crc_LUT[1];

                 read[1]=1;

                 read[2] = crc >> 8;

                 read[3] = crc & 0xff;

1839

                 if(!sendCmdGetResponseWithRetries(read, sizeof(read),resp, 10, 10))

1841 {

1842 Dbprintf("Dump config (block 1) failed");

1843 continue;

1844 }

1845

1846 mem=resp[5];

                 memory.k16= (mem & 0x80);

                 memory.book= (mem & 0x20);

                 memory.k2= (mem & 0x8);

                 memory.lockauth= (mem & 0x2);

                 memory.keyaccess= (mem & 0x1);

1852

                 cardsize = memory.k16 ? 255 : 32;

1854 WDT_HIT();

1855 //Set card_data to all zeroes, we'll fill it with data

                 memset(card_data,0x0,USB_CMD_DATA_SIZE);

1857 uint8_t failedRead =0;

1858 uint32_t stored_data_length =0;

1859 //then loop around remaining blocks

                 for(int block=0; block < cardsize; block++){

1861

1862 read[1]= block;

1863 crc = block_crc_LUT[block];

                         read[2] = crc >> 8;

                         read[3] = crc & 0xff;

1866

                         if(sendCmdGetResponseWithRetries(read, sizeof(read), resp, 10, 10))

1868 {

1869 Dbprintf(" %02x: %02x %02x %02x %02x %02x %02x %02x %02x",

                                                  block, resp[0], resp[1], resp[2],

                                                 resp[3], resp[4], resp[5],

                                                 resp[6], resp[7]);

1873

1874 //Fill up the buffer

                                 memcpy(card_data+stored_data_length,resp,8);

1876 stored_data_length += 8;

                                 if(stored_data_length +8 > USB_CMD_DATA_SIZE)

1878 {//Time to send this off and start afresh

1879 cmd_send(CMD_ACK,

1880 stored_data_length,//data length

1881 failedRead,//Failed blocks?

1882 0,//Not used ATM

1883 card_data, stored_data_length);

1884 //reset

1885 stored_data_length = 0;

1886 failedRead = 0;

1887 }

1888

1889 }else{

1890 failedRead = 1;

1891 stored_data_length +=8;//Otherwise, data becomes misaligned

                                 Dbprintf("Failed to dump block %d", block);

1893 }

1894 }

1895

1896 //Send off any remaining data

                 if(stored_data_length > 0)

1898 {

1899 cmd_send(CMD_ACK,

1900 stored_data_length,//data length

1901 failedRead,//Failed blocks?

1902 0,//Not used ATM

1903 card_data, stored_data_length);

1904 }

1905 //If we got here, let's break

1906 break;

1907 }

1908 //Signal end of transmission

1909 cmd_send(CMD_ACK,

1910 0,//data length

1911 0,//Failed blocks?

1912 0,//Not used ATM

1913 card_data, 0);

1914

1915 LED_A_OFF();

1916 }

1917

 void iClass_ReadCheck(uint8_t   blockNo, uint8_t keyType) {

1919 uint8_t readcheck[] = { keyType, blockNo };

         uint8_t resp[] = {0,0,0,0,0,0,0,0};

1921 size_t isOK = 0;

         isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 6);

         cmd_send(CMD_ACK,isOK,0,0,0,0);

1924 }

1925

 void iClass_Authentication(uint8_t *MAC) {

         uint8_t check[] = { ICLASS_CMD_CHECK, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

1928 uint8_t resp[ICLASS_BUFFER_SIZE];

         memcpy(check+5,MAC,4);

1930 bool isOK;

         isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, 4, 6);

         cmd_send(CMD_ACK,isOK,0,0,0,0);

1933 }

 bool iClass_ReadBlock(uint8_t blockNo, uint8_t *readdata) {

         uint8_t readcmd[] = {ICLASS_CMD_READ_OR_IDENTIFY, blockNo, 0x00, 0x00}; //0x88, 0x00 // can i use 0C?

1936 char bl = blockNo;

         uint16_t rdCrc = iclass_crc16(&bl, 1);

         readcmd[2] = rdCrc >> 8;

         readcmd[3] = rdCrc & 0xff;

         uint8_t resp[] = {0,0,0,0,0,0,0,0,0,0};

1941 bool isOK = false;

1942

1943 //readcmd[1] = blockNo;

         isOK = sendCmdGetResponseWithRetries(readcmd, sizeof(readcmd), resp, 10, 10);

         memcpy(readdata, resp, sizeof(resp));

1946

1947 return isOK;

1948 }

1949

 void iClass_ReadBlk(uint8_t blockno) {

         uint8_t readblockdata[] = {0,0,0,0,0,0,0,0,0,0};

1952 bool isOK = false;

         isOK = iClass_ReadBlock(blockno, readblockdata);

         cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8);

1955 }

1956

 void iClass_Dump(uint8_t blockno, uint8_t numblks) {

         uint8_t readblockdata[] = {0,0,0,0,0,0,0,0,0,0};

1959 bool isOK = false;

1960 uint8_t blkCnt = 0;

1961

1962 BigBuf_free();

         uint8_t *dataout = BigBuf_malloc(255*8);

1964 if (dataout == NULL){

1965 Dbprintf("out of memory");

1966 OnError(1);

1967 return;

1968 }

         memset(dataout,0xFF,255*8);

1970

         for (;blkCnt < numblks; blkCnt++) {

                 isOK = iClass_ReadBlock(blockno+blkCnt, readblockdata);

                 if (!isOK || (readblockdata[0] == 0xBB || readblockdata[7] == 0xBB || readblockdata[2] == 0xBB)) { //try again

                         isOK = iClass_ReadBlock(blockno+blkCnt, readblockdata);

1975 if (!isOK) {

                                 Dbprintf("Block %02X failed to read", blkCnt+blockno);

1977 break;

1978 }

1979 }

                 memcpy(dataout+(blkCnt*8),readblockdata,8);

1981 }

1982 //return pointer to dump memory in arg3

         cmd_send(CMD_ACK,isOK,blkCnt,BigBuf_max_traceLen(),0,0);

1984 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1985 LEDsoff();

1986 BigBuf_free();

1987 }

1988

 bool iClass_WriteBlock_ext(uint8_t blockNo, uint8_t *data) {

         uint8_t write[] = { ICLASS_CMD_UPDATE, blockNo, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

1991 //uint8_t readblockdata[10];

1992 //write[1] = blockNo;

         memcpy(write+2, data, 12); // data + mac

         char *wrCmd = (char *)(write+1); 

         uint16_t wrCrc = iclass_crc16(wrCmd, 13);

         write[14] = wrCrc >> 8;

         write[15] = wrCrc & 0xff;

         uint8_t resp[] = {0,0,0,0,0,0,0,0,0,0};

1999 bool isOK = false;

2000

         isOK = sendCmdGetResponseWithRetries(write,sizeof(write),resp,sizeof(resp),10);

2002 if (isOK) { //if reader responded correctly

2003 //Dbprintf("WriteResp: %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X",resp[0],resp[1],resp[2],resp[3],resp[4],resp[5],resp[6],resp[7],resp[8],resp[9]);

                 if (memcmp(write+2,resp,8)) {  //if response is not equal to write values

                         if (blockNo != 3 && blockNo != 4) { //if not programming key areas (note key blocks don't get programmed with actual key data it is xor data)

2006 //error try again

                                 isOK = sendCmdGetResponseWithRetries(write,sizeof(write),resp,sizeof(resp),10);

2008 }

2009

2010 }

2011 }

2012 return isOK;

2013 }

2014

 void iClass_WriteBlock(uint8_t blockNo, uint8_t *data) {

         bool isOK = iClass_WriteBlock_ext(blockNo, data);

2017 if (isOK){

                 Dbprintf("Write block [%02x] successful",blockNo);

2019 } else {

                 Dbprintf("Write block [%02x] failed",blockNo);          

2021 }

         cmd_send(CMD_ACK,isOK,0,0,0,0); 

2023 }

2024

 void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {

2026 int i;

2027 int written = 0;

         int total_block = (endblock - startblock) + 1;

         for (i = 0; i < total_block;i++){

2030 // block number

                 if (iClass_WriteBlock_ext(i+startblock, data+(i*12))){

                         Dbprintf("Write block [%02x] successful",i + startblock);

2033 written++;

2034 } else {

                         if (iClass_WriteBlock_ext(i+startblock, data+(i*12))){

                                 Dbprintf("Write block [%02x] successful",i + startblock);

2037 written++;

2038 } else {

                                 Dbprintf("Write block [%02x] failed",i + startblock);

2040 }

2041 }

2042 }

2043 if (written == total_block)

2044 Dbprintf("Clone complete");

2045 else

2046 Dbprintf("Clone incomplete");

2047

         cmd_send(CMD_ACK,1,0,0,0,0);

2049 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

2050 LEDsoff();

2051 }