git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

2 // Jonathan Westhues, split Nov 2006

3 // Modified by Greg Jones, Jan 2009

4 // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011

5 // Modified by piwi, Oct 2018

6 //

7 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

8 // at your option, any later version. See the LICENSE.txt file for the text of

9 // the license.

10 //-----------------------------------------------------------------------------

11 // Routines to support ISO 15693. This includes both the reader software and

12 // the `fake tag' modes.

13 //-----------------------------------------------------------------------------

15 // The ISO 15693 describes two transmission modes from reader to tag, and four

16 // transmission modes from tag to reader. As of Oct 2018 this code supports

17 // both reader modes and the high speed variant with one subcarrier from card to reader.

18 // As long as the card fully support ISO 15693 this is no problem, since the

19 // reader chooses both data rates, but some non-standard tags do not.

20 // For card simulation, the code supports both high and low speed modes with one subcarrier.

21 //

22 // VCD (reader) -> VICC (tag)

23 // 1 out of 256:

24 // data rate: 1,66 kbit/s (fc/8192)

25 // used for long range

26 // 1 out of 4:

27 // data rate: 26,48 kbit/s (fc/512)

28 // used for short range, high speed

29 //

30 // VICC (tag) -> VCD (reader)

31 // Modulation:

32 // ASK / one subcarrier (423,75 khz)

33 // FSK / two subcarriers (423,75 khz && 484,28 khz)

34 // Data Rates / Modes:

35 // low ASK: 6,62 kbit/s

36 // low FSK: 6.67 kbit/s

37 // high ASK: 26,48 kbit/s

38 // high FSK: 26,69 kbit/s

39 //-----------------------------------------------------------------------------

42 // Random Remarks:

43 // *) UID is always used "transmission order" (LSB), which is reverse to display order

45 // TODO / BUGS / ISSUES:

46 // *) signal decoding is unable to detect collisions.

47 // *) add anti-collision support for inventory-commands

48 // *) read security status of a block

49 // *) sniffing and simulation do not support two subcarrier modes.

50 // *) remove or refactor code under "deprecated"

51 // *) document all the functions

53 #include "iso15693.h"

55 #include "proxmark3.h"

56 #include "util.h"

57 #include "apps.h"

58 #include "string.h"

59 #include "iso15693tools.h"

60 #include "protocols.h"

61 #include "cmd.h"

62 #include "BigBuf.h"

63 #include "fpgaloader.h"

65 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))

67 static int DEBUG = 0;

69 ///////////////////////////////////////////////////////////////////////

70 // ISO 15693 Part 2 - Air Interface

71 // This section basically contains transmission and receiving of bits

72 ///////////////////////////////////////////////////////////////////////

74 // buffers

75 #define ISO15693_DMA_BUFFER_SIZE 2048 // must be a power of 2

76 #define ISO15693_MAX_RESPONSE_LENGTH 36 // allows read single block with the maximum block size of 256bits. Read multiple blocks not supported yet

77 #define ISO15693_MAX_COMMAND_LENGTH 45 // allows write single block with the maximum block size of 256bits. Write multiple blocks not supported yet

79 // ---------------------------

80 // Signal Processing

81 // ---------------------------

83 // prepare data using "1 out of 4" code for later transmission

84 // resulting data rate is 26.48 kbit/s (fc/512)

85 // cmd ... data

86 // n ... length of data

 static void CodeIso15693AsReader(uint8_t *cmd, int n)

88 {

89 int i, j;

91 ToSendReset();

93 // Give it a bit of slack at the beginning

         for(i = 0; i < 24; i++) {

95 ToSendStuffBit(1);

96 }

98 // SOF for 1of4

99 ToSendStuffBit(0);

100 ToSendStuffBit(1);

101 ToSendStuffBit(1);

102 ToSendStuffBit(1);

103 ToSendStuffBit(1);

104 ToSendStuffBit(0);

105 ToSendStuffBit(1);

106 ToSendStuffBit(1);

         for(i = 0; i < n; i++) {

                 for(j = 0; j < 8; j += 2) {

                         int these = (cmd[i] >> j) & 3;

110 switch(these) {

111 case 0:

112 ToSendStuffBit(1);

113 ToSendStuffBit(0);

114 ToSendStuffBit(1);

115 ToSendStuffBit(1);

116 ToSendStuffBit(1);

117 ToSendStuffBit(1);

118 ToSendStuffBit(1);

119 ToSendStuffBit(1);

120 break;

121 case 1:

122 ToSendStuffBit(1);

123 ToSendStuffBit(1);

124 ToSendStuffBit(1);

125 ToSendStuffBit(0);

126 ToSendStuffBit(1);

127 ToSendStuffBit(1);

128 ToSendStuffBit(1);

129 ToSendStuffBit(1);

130 break;

131 case 2:

132 ToSendStuffBit(1);

133 ToSendStuffBit(1);

134 ToSendStuffBit(1);

135 ToSendStuffBit(1);

136 ToSendStuffBit(1);

137 ToSendStuffBit(0);

138 ToSendStuffBit(1);

139 ToSendStuffBit(1);

140 break;

141 case 3:

142 ToSendStuffBit(1);

143 ToSendStuffBit(1);

144 ToSendStuffBit(1);

145 ToSendStuffBit(1);

146 ToSendStuffBit(1);

147 ToSendStuffBit(1);

148 ToSendStuffBit(1);

149 ToSendStuffBit(0);

150 break;

151 }

152 }

153 }

154 // EOF

155 ToSendStuffBit(1);

156 ToSendStuffBit(1);

157 ToSendStuffBit(0);

158 ToSendStuffBit(1);

159

160 // Fill remainder of last byte with 1

         for(i = 0; i < 4; i++) {

162 ToSendStuffBit(1);

163 }

164

165 ToSendMax++;

166 }

167

168 // encode data using "1 out of 256" scheme

169 // data rate is 1,66 kbit/s (fc/8192)

170 // is designed for more robust communication over longer distances

 static void CodeIso15693AsReader256(uint8_t *cmd, int n)

172 {

173 int i, j;

174

175 ToSendReset();

176

177 // Give it a bit of slack at the beginning

         for(i = 0; i < 24; i++) {

179 ToSendStuffBit(1);

180 }

181

182 // SOF for 1of256

183 ToSendStuffBit(0);

184 ToSendStuffBit(1);

185 ToSendStuffBit(1);

186 ToSendStuffBit(1);

187 ToSendStuffBit(1);

188 ToSendStuffBit(1);

189 ToSendStuffBit(1);

190 ToSendStuffBit(0);

191

         for(i = 0; i < n; i++) {

                 for (j = 0; j<=255; j++) {

                         if (cmd[i]==j) {

195 ToSendStuffBit(1);

196 ToSendStuffBit(0);

197 } else {

198 ToSendStuffBit(1);

199 ToSendStuffBit(1);

200 }

201 }

202 }

203 // EOF

204 ToSendStuffBit(1);

205 ToSendStuffBit(1);

206 ToSendStuffBit(0);

207 ToSendStuffBit(1);

208

209 // Fill remainder of last byte with 1

         for(i = 0; i < 4; i++) {

211 ToSendStuffBit(1);

212 }

213

214 ToSendMax++;

215 }

216

217

218 // static uint8_t encode4Bits(const uint8_t b) {

219 // uint8_t c = b & 0xF;

220 // // OTA, the least significant bits first

221 // // The columns are

222 // // 1 - Bit value to send

223 // // 2 - Reversed (big-endian)

224 // // 3 - Manchester Encoded

225 // // 4 - Hex values

226

227 // switch(c){

228 // // 1 2 3 4

229 // case 15: return 0x55; // 1111 -> 1111 -> 01010101 -> 0x55

230 // case 14: return 0x95; // 1110 -> 0111 -> 10010101 -> 0x95

231 // case 13: return 0x65; // 1101 -> 1011 -> 01100101 -> 0x65

232 // case 12: return 0xa5; // 1100 -> 0011 -> 10100101 -> 0xa5

233 // case 11: return 0x59; // 1011 -> 1101 -> 01011001 -> 0x59

234 // case 10: return 0x99; // 1010 -> 0101 -> 10011001 -> 0x99

235 // case 9: return 0x69; // 1001 -> 1001 -> 01101001 -> 0x69

236 // case 8: return 0xa9; // 1000 -> 0001 -> 10101001 -> 0xa9

237 // case 7: return 0x56; // 0111 -> 1110 -> 01010110 -> 0x56

238 // case 6: return 0x96; // 0110 -> 0110 -> 10010110 -> 0x96

239 // case 5: return 0x66; // 0101 -> 1010 -> 01100110 -> 0x66

240 // case 4: return 0xa6; // 0100 -> 0010 -> 10100110 -> 0xa6

241 // case 3: return 0x5a; // 0011 -> 1100 -> 01011010 -> 0x5a

242 // case 2: return 0x9a; // 0010 -> 0100 -> 10011010 -> 0x9a

243 // case 1: return 0x6a; // 0001 -> 1000 -> 01101010 -> 0x6a

244 // default: return 0xaa; // 0000 -> 0000 -> 10101010 -> 0xaa

245

246 // }

247 // }

248

 static const uint8_t encode_4bits[16] = { 0xaa, 0x6a, 0x9a, 0x5a, 0xa6, 0x66, 0x96, 0x56, 0xa9, 0x69, 0x99, 0x59, 0xa5, 0x65, 0x95, 0x55 };

250

 void CodeIso15693AsTag(uint8_t *cmd, size_t len) {

252 /*

253 * SOF comprises 3 parts;

254 * * An unmodulated time of 56.64 us

255 * * 24 pulses of 423.75 kHz (fc/32)

256 * * A logic 1, which starts with an unmodulated time of 18.88us

257 * followed by 8 pulses of 423.75kHz (fc/32)

258 *

259 * EOF comprises 3 parts:

260 * - A logic 0 (which starts with 8 pulses of fc/32 followed by an unmodulated

261 * time of 18.88us.

262 * - 24 pulses of fc/32

263 * - An unmodulated time of 56.64 us

264 *

265 * A logic 0 starts with 8 pulses of fc/32

266 * followed by an unmodulated time of 256/fc (~18,88us).

267 *

268 * A logic 0 starts with unmodulated time of 256/fc (~18,88us) followed by

269 * 8 pulses of fc/32 (also 18.88us)

270 *

271 * A bit here becomes 8 pulses of fc/32. Therefore:

272 * The SOF can be written as 00011101 = 0x1D

273 * The EOF can be written as 10111000 = 0xb8

274 * A logic 1 is 01

275 * A logic 0 is 10

276 *

277 * */

278

279 ToSendReset();

280

281 // SOF

         ToSend[++ToSendMax] = 0x1D;  // 00011101

283

284 // data

         for (int i = 0; i < len; i++) {

                 ToSend[++ToSendMax] = encode_4bits[cmd[i] & 0xF];

                 ToSend[++ToSendMax] = encode_4bits[cmd[i] >> 4];

288 }

289

290 // EOF

         ToSend[++ToSendMax] = 0xB8; // 10111000

292

293 ToSendMax++;

294 }

295

296

297 // Transmit the command (to the tag) that was placed in cmd[].

 static void TransmitTo15693Tag(const uint8_t *cmd, int len, uint32_t start_time)

299 {

300 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_FULL_MOD);

301 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

302

         while (GetCountSspClk() < start_time) ;

304

305 LED_B_ON();

         for(int c = 0; c < len; c++) {

307 uint8_t data = cmd[c];

                 for (int i = 0; i < 8; i++) {

                         uint16_t send_word = (data & 0x80) ? 0x0000 : 0xffff;

                         while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;

311 AT91C_BASE_SSC->SSC_THR = send_word;

                         while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;

313 AT91C_BASE_SSC->SSC_THR = send_word;

314 data <<= 1;

315 }

316 WDT_HIT();

317 }

318 LED_B_OFF();

319 }

320

321

322 //-----------------------------------------------------------------------------

323 // Transmit the tag response (to the reader) that was placed in cmd[].

324 //-----------------------------------------------------------------------------

 void TransmitTo15693Reader(const uint8_t *cmd, size_t len, uint32_t *start_time, uint32_t slot_time, bool slow) {

326 // don't use the FPGA_HF_SIMULATOR_MODULATE_424K_8BIT minor mode. It would spoil GetCountSspClk()

327 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_424K);

328

         uint32_t modulation_start_time = *start_time + 3 * 8;  // no need to transfer the unmodulated start of SOF

330

         while (GetCountSspClk() > (modulation_start_time & 0xfffffff8) + 3) { // we will miss the intended time

332 if (slot_time) {

333 modulation_start_time += slot_time; // use next available slot

334 } else {

                         modulation_start_time = (modulation_start_time & 0xfffffff8) + 8; // next possible time

336 }

337 }

338

         while (GetCountSspClk() < (modulation_start_time & 0xfffffff8)) 

340 /* wait */ ;

341

         uint8_t shift_delay = modulation_start_time & 0x00000007;

343

         *start_time = modulation_start_time - 3 * 8;

345

346 LED_C_ON();

347 uint8_t bits_to_shift = 0x00;

348 uint8_t bits_to_send = 0x00;

         for (size_t c = 0; c < len; c++) {

                 for (int i = (c==0?4:7); i >= 0; i--) {

                         uint8_t cmd_bits = ((cmd[c] >> i) & 0x01) ? 0xff : 0x00;

                         for (int j = 0; j < (slow?4:1); ) {

                                 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {

                                         bits_to_send = bits_to_shift << (8 - shift_delay) | cmd_bits >> shift_delay;

355 AT91C_BASE_SSC->SSC_THR = bits_to_send;

356 bits_to_shift = cmd_bits;

357 j++;

358 }

359 }

360 }

361 WDT_HIT();

362 }

363 // send the remaining bits, padded with 0:

         bits_to_send = bits_to_shift << (8 - shift_delay);

365 for ( ; ; ) {

                 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {

367 AT91C_BASE_SSC->SSC_THR = bits_to_send;

368 break;

369 }

370 }

371 LED_C_OFF();

372 }

373

374

375 //=============================================================================

376 // An ISO 15693 decoder for tag responses (one subcarrier only).

377 // Uses cross correlation to identify each bit and EOF.

378 // This function is called 8 times per bit (every 2 subcarrier cycles).

379 // Subcarrier frequency fs is 424kHz, 1/fs = 2,36us,

380 // i.e. function is called every 4,72us

381 // LED handling:

382 // LED C -> ON once we have received the SOF and are expecting the rest.

383 // LED C -> OFF once we have received EOF or are unsynced

384 //

385 // Returns: true if we received a EOF

386 // false if we are still waiting for some more

387 //=============================================================================

388

389 #define NOISE_THRESHOLD 160 // don't try to correlate noise

390

391 typedef struct DecodeTag {

392 enum {

393 STATE_TAG_SOF_LOW,

394 STATE_TAG_SOF_HIGH,

395 STATE_TAG_SOF_HIGH_END,

396 STATE_TAG_RECEIVING_DATA,

397 STATE_TAG_EOF

398 } state;

399 int bitCount;

400 int posCount;

401 enum {

402 LOGIC0,

403 LOGIC1,

404 SOF_PART1,

405 SOF_PART2

406 } lastBit;

407 uint16_t shiftReg;

408 uint16_t max_len;

409 uint8_t *output;

410 int len;

411 int sum1, sum2;

412 } DecodeTag_t;

413

414

 static int inline __attribute__((always_inline)) Handle15693SamplesFromTag(uint16_t amplitude, DecodeTag_t *DecodeTag)

416 {

417 switch(DecodeTag->state) {

418 case STATE_TAG_SOF_LOW:

419 // waiting for 12 times low (11 times low is accepted as well)

420 if (amplitude < NOISE_THRESHOLD) {

421 DecodeTag->posCount++;

422 } else {

                                 if (DecodeTag->posCount > 10) {

424 DecodeTag->posCount = 1;

425 DecodeTag->sum1 = 0;

426 DecodeTag->state = STATE_TAG_SOF_HIGH;

427 } else {

428 DecodeTag->posCount = 0;

429 }

430 }

431 break;

432

433 case STATE_TAG_SOF_HIGH:

434 // waiting for 10 times high. Take average over the last 8

435 if (amplitude > NOISE_THRESHOLD) {

436 DecodeTag->posCount++;

                                 if (DecodeTag->posCount > 2) {

438 DecodeTag->sum1 += amplitude; // keep track of average high value

439 }

                                 if (DecodeTag->posCount == 10) {

                                         DecodeTag->sum1 >>= 4;        // calculate half of average high value (8 samples)

442 DecodeTag->state = STATE_TAG_SOF_HIGH_END;

443 }

444 } else { // high phase was too short

445 DecodeTag->posCount = 1;

446 DecodeTag->state = STATE_TAG_SOF_LOW;

447 }

448 break;

449

450 case STATE_TAG_SOF_HIGH_END:

451 // waiting for a falling edge

                         if (amplitude < DecodeTag->sum1) {   // signal drops below 50% average high: a falling edge

453 DecodeTag->lastBit = SOF_PART1; // detected 1st part of SOF (12 samples low and 12 samples high)

454 DecodeTag->shiftReg = 0;

455 DecodeTag->bitCount = 0;

456 DecodeTag->len = 0;

457 DecodeTag->sum1 = amplitude;

458 DecodeTag->sum2 = 0;

459 DecodeTag->posCount = 2;

460 DecodeTag->state = STATE_TAG_RECEIVING_DATA;

461 LED_C_ON();

462 } else {

463 DecodeTag->posCount++;

                                 if (DecodeTag->posCount > 13) { // high phase too long

465 DecodeTag->posCount = 0;

466 DecodeTag->state = STATE_TAG_SOF_LOW;

467 LED_C_OFF();

468 }

469 }

470 break;

471

472 case STATE_TAG_RECEIVING_DATA:

                         if (DecodeTag->posCount == 1) {

474 DecodeTag->sum1 = 0;

475 DecodeTag->sum2 = 0;

476 }

                         if (DecodeTag->posCount <= 4) {

478 DecodeTag->sum1 += amplitude;

479 } else {

480 DecodeTag->sum2 += amplitude;

481 }

                         if (DecodeTag->posCount == 8) {

                                 int32_t corr_1 = DecodeTag->sum2 - DecodeTag->sum1;

484 int32_t corr_0 = -corr_1;

                                 int32_t corr_EOF = (DecodeTag->sum1 + DecodeTag->sum2) / 2;

                                 if (corr_EOF > corr_0 && corr_EOF > corr_1) {

                                         if (DecodeTag->lastBit == LOGIC0) {  // this was already part of EOF

488 DecodeTag->state = STATE_TAG_EOF;

489 } else {

490 DecodeTag->posCount = 0;

491 DecodeTag->state = STATE_TAG_SOF_LOW;

492 LED_C_OFF();

493 }

                                 } else if (corr_1 > corr_0) {

495 // logic 1

                                         if (DecodeTag->lastBit == SOF_PART1) { // still part of SOF

497 DecodeTag->lastBit = SOF_PART2; // SOF completed

498 } else {

499 DecodeTag->lastBit = LOGIC1;

500 DecodeTag->shiftReg >>= 1;

501 DecodeTag->shiftReg |= 0x80;

502 DecodeTag->bitCount++;

                                                 if (DecodeTag->bitCount == 8) {

                                                         DecodeTag->output[DecodeTag->len] = DecodeTag->shiftReg;

505 DecodeTag->len++;

                                                         if (DecodeTag->len > DecodeTag->max_len) {

507 // buffer overflow, give up

508 DecodeTag->posCount = 0;

509 DecodeTag->state = STATE_TAG_SOF_LOW;

510 LED_C_OFF();

511 }

512 DecodeTag->bitCount = 0;

513 DecodeTag->shiftReg = 0;

514 }

515 }

516 } else {

517 // logic 0

                                         if (DecodeTag->lastBit == SOF_PART1) { // incomplete SOF

519 DecodeTag->posCount = 0;

520 DecodeTag->state = STATE_TAG_SOF_LOW;

521 LED_C_OFF();

522 } else {

523 DecodeTag->lastBit = LOGIC0;

524 DecodeTag->shiftReg >>= 1;

525 DecodeTag->bitCount++;

                                                 if (DecodeTag->bitCount == 8) {

                                                         DecodeTag->output[DecodeTag->len] = DecodeTag->shiftReg;

528 DecodeTag->len++;

                                                         if (DecodeTag->len > DecodeTag->max_len) {

530 // buffer overflow, give up

531 DecodeTag->posCount = 0;

532 DecodeTag->state = STATE_TAG_SOF_LOW;

533 LED_C_OFF();

534 }

535 DecodeTag->bitCount = 0;

536 DecodeTag->shiftReg = 0;

537 }

538 }

539 }

540 DecodeTag->posCount = 0;

541 }

542 DecodeTag->posCount++;

543 break;

544

545 case STATE_TAG_EOF:

                         if (DecodeTag->posCount == 1) {

547 DecodeTag->sum1 = 0;

548 DecodeTag->sum2 = 0;

549 }

                         if (DecodeTag->posCount <= 4) {

551 DecodeTag->sum1 += amplitude;

552 } else {

553 DecodeTag->sum2 += amplitude;

554 }

                         if (DecodeTag->posCount == 8) {

                                 int32_t corr_1 = DecodeTag->sum2 - DecodeTag->sum1;

557 int32_t corr_0 = -corr_1;

                                 int32_t corr_EOF = (DecodeTag->sum1 + DecodeTag->sum2) / 2;

                                 if (corr_EOF > corr_0 || corr_1 > corr_0) {

560 DecodeTag->posCount = 0;

561 DecodeTag->state = STATE_TAG_SOF_LOW;

562 LED_C_OFF();

563 } else {

564 LED_C_OFF();

565 return true;

566 }

567 }

568 DecodeTag->posCount++;

569 break;

570

571 }

572

573 return false;

574 }

575

576

 static void DecodeTagInit(DecodeTag_t *DecodeTag, uint8_t *data, uint16_t max_len)

578 {

579 DecodeTag->posCount = 0;

580 DecodeTag->state = STATE_TAG_SOF_LOW;

581 DecodeTag->output = data;

582 DecodeTag->max_len = max_len;

583 }

584

585

 static void DecodeTagReset(DecodeTag_t *DecodeTag)

587 {

588 DecodeTag->posCount = 0;

589 DecodeTag->state = STATE_TAG_SOF_LOW;

590 }

591

592

593 /*

594 * Receive and decode the tag response, also log to tracebuffer

595 */

 static int GetIso15693AnswerFromTag(uint8_t* response, uint16_t max_len, int timeout)

597 {

598 int samples = 0;

599 bool gotFrame = false;

600

         uint16_t *dmaBuf = (uint16_t*)BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE*sizeof(uint16_t));

602

603 // the Decoder data structure

604 DecodeTag_t DecodeTag = { 0 };

         DecodeTagInit(&DecodeTag, response, max_len);

606

607 // wait for last transfer to complete

         while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));

609

610 // And put the FPGA in the appropriate mode

         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_424_KHZ | FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE);

612

613 // Setup and start DMA.

614 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

         FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);

616 uint16_t *upTo = dmaBuf;

617

618 for(;;) {

                 uint16_t behindBy = ((uint16_t*)AT91C_BASE_PDC_SSC->PDC_RPR - upTo) & (ISO15693_DMA_BUFFER_SIZE-1);

620

                 if (behindBy == 0) continue;

622

623 uint16_t tagdata = *upTo++;

624

                 if(upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) {                // we have read all of the DMA buffer content.

626 upTo = dmaBuf; // start reading the circular buffer from the beginning

                         if(behindBy > (9*ISO15693_DMA_BUFFER_SIZE/10)) {

                                 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);

629 break;

630 }

631 }

                 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.

                         AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and

634 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE; // DMA Next Counter registers

635 }

636

637 samples++;

638

                 if (Handle15693SamplesFromTag(tagdata, &DecodeTag)) {

640 gotFrame = true;

641 break;

642 }

643

                 if (samples > timeout && DecodeTag.state < STATE_TAG_RECEIVING_DATA) {

645 DecodeTag.len = 0;

646 break;

647 }

648

649 }

650

651 FpgaDisableSscDma();

652 BigBuf_free();

653

         if (DEBUG) Dbprintf("samples = %d, gotFrame = %d, Decoder: state = %d, len = %d, bitCount = %d, posCount = %d",

                                                 samples, gotFrame, DecodeTag.state, DecodeTag.len, DecodeTag.bitCount, DecodeTag.posCount);

656

         if (DecodeTag.len > 0) {

                 LogTrace(DecodeTag.output, DecodeTag.len, 0, 0, NULL, false);

659 }

660

661 return DecodeTag.len;

662 }

663

664

665 //=============================================================================

666 // An ISO15693 decoder for reader commands.

667 //

668 // This function is called 4 times per bit (every 2 subcarrier cycles).

669 // Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us

670 // LED handling:

671 // LED B -> ON once we have received the SOF and are expecting the rest.

672 // LED B -> OFF once we have received EOF or are in error state or unsynced

673 //

674 // Returns: true if we received a EOF

675 // false if we are still waiting for some more

676 //=============================================================================

677

678 typedef struct DecodeReader {

679 enum {

680 STATE_READER_UNSYNCD,

681 STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF,

682 STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF,

683 STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF,

684 STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF,

685 STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4,

686 STATE_READER_RECEIVE_DATA_1_OUT_OF_4,

687 STATE_READER_RECEIVE_DATA_1_OUT_OF_256

688 } state;

689 enum {

690 CODING_1_OUT_OF_4,

691 CODING_1_OUT_OF_256

692 } Coding;

693 uint8_t shiftReg;

694 uint8_t bitCount;

695 int byteCount;

696 int byteCountMax;

697 int posCount;

698 int sum1, sum2;

699 uint8_t *output;

700 } DecodeReader_t;

701

702

 static void DecodeReaderInit(DecodeReader_t* DecodeReader, uint8_t *data, uint16_t max_len)

704 {

705 DecodeReader->output = data;

706 DecodeReader->byteCountMax = max_len;

707 DecodeReader->state = STATE_READER_UNSYNCD;

708 DecodeReader->byteCount = 0;

709 DecodeReader->bitCount = 0;

710 DecodeReader->posCount = 1;

711 DecodeReader->shiftReg = 0;

712 }

713

714

 static void DecodeReaderReset(DecodeReader_t* DecodeReader)

716 {

717 DecodeReader->state = STATE_READER_UNSYNCD;

718 }

719

720

 static int inline __attribute__((always_inline)) Handle15693SampleFromReader(uint8_t bit, DecodeReader_t *restrict DecodeReader)

722 {

723 switch (DecodeReader->state) {

724 case STATE_READER_UNSYNCD:

725 // wait for unmodulated carrier

726 if (bit) {

727 DecodeReader->state = STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF;

728 }

729 break;

730

731 case STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF:

732 if (!bit) {

733 // we went low, so this could be the beginning of a SOF

734 DecodeReader->posCount = 1;

735 DecodeReader->state = STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF;

736 }

737 break;

738

739 case STATE_READER_AWAIT_1ST_RISING_EDGE_OF_SOF:

740 DecodeReader->posCount++;

741 if (bit) { // detected rising edge

                                 if (DecodeReader->posCount < 4) { // rising edge too early (nominally expected at 5)

743 DecodeReader->state = STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF;

744 } else { // SOF

745 DecodeReader->state = STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF;

746 }

747 } else {

                                 if (DecodeReader->posCount > 5) { // stayed low for too long

749 DecodeReaderReset(DecodeReader);

750 } else {

751 // do nothing, keep waiting

752 }

753 }

754 break;

755

756 case STATE_READER_AWAIT_2ND_FALLING_EDGE_OF_SOF:

757 DecodeReader->posCount++;

758 if (!bit) { // detected a falling edge

                                 if (DecodeReader->posCount < 20) {         // falling edge too early (nominally expected at 21 earliest)

760 DecodeReaderReset(DecodeReader);

                                 } else if (DecodeReader->posCount < 23) {  // SOF for 1 out of 4 coding

762 DecodeReader->Coding = CODING_1_OUT_OF_4;

763 DecodeReader->state = STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF;

                                 } else if (DecodeReader->posCount < 28) {  // falling edge too early (nominally expected at 29 latest)

765 DecodeReaderReset(DecodeReader);

766 } else { // SOF for 1 out of 256 coding

767 DecodeReader->Coding = CODING_1_OUT_OF_256;

768 DecodeReader->state = STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF;

769 }

770 } else {

                                 if (DecodeReader->posCount > 29) { // stayed high for too long

772 DecodeReader->state = STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF;

773 } else {

774 // do nothing, keep waiting

775 }

776 }

777 break;

778

779 case STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF:

780 DecodeReader->posCount++;

781 if (bit) { // detected rising edge

                                 if (DecodeReader->Coding == CODING_1_OUT_OF_256) {

                                         if (DecodeReader->posCount < 32) { // rising edge too early (nominally expected at 33)

784 DecodeReader->state = STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF;

785 } else {

786 DecodeReader->posCount = 1;

787 DecodeReader->bitCount = 0;

788 DecodeReader->byteCount = 0;

789 DecodeReader->sum1 = 1;

790 DecodeReader->state = STATE_READER_RECEIVE_DATA_1_OUT_OF_256;

791 LED_B_ON();

792 }

793 } else { // CODING_1_OUT_OF_4

                                         if (DecodeReader->posCount < 24) { // rising edge too early (nominally expected at 25)

795 DecodeReader->state = STATE_READER_AWAIT_1ST_FALLING_EDGE_OF_SOF;

796 } else {

797 DecodeReader->posCount = 1;

798 DecodeReader->state = STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4;

799 }

800 }

801 } else {

                                 if (DecodeReader->Coding == CODING_1_OUT_OF_256) {

                                         if (DecodeReader->posCount > 34) { // signal stayed low for too long

804 DecodeReaderReset(DecodeReader);

805 } else {

806 // do nothing, keep waiting

807 }

808 } else { // CODING_1_OUT_OF_4

                                         if (DecodeReader->posCount > 26) { // signal stayed low for too long

810 DecodeReaderReset(DecodeReader);

811 } else {

812 // do nothing, keep waiting

813 }

814 }

815 }

816 break;

817

818 case STATE_READER_AWAIT_END_OF_SOF_1_OUT_OF_4:

819 DecodeReader->posCount++;

820 if (bit) {

                                 if (DecodeReader->posCount == 9) {

822 DecodeReader->posCount = 1;

823 DecodeReader->bitCount = 0;

824 DecodeReader->byteCount = 0;

825 DecodeReader->sum1 = 1;

826 DecodeReader->state = STATE_READER_RECEIVE_DATA_1_OUT_OF_4;

827 LED_B_ON();

828 } else {

829 // do nothing, keep waiting

830 }

831 } else { // unexpected falling edge

832 DecodeReaderReset(DecodeReader);

833 }

834 break;

835

836 case STATE_READER_RECEIVE_DATA_1_OUT_OF_4:

837 bit = !!bit;

838 DecodeReader->posCount++;

                         if (DecodeReader->posCount == 1) {

840 DecodeReader->sum1 = bit;

                         } else if (DecodeReader->posCount <= 4) {

842 DecodeReader->sum1 += bit;

                         } else if (DecodeReader->posCount == 5) {

844 DecodeReader->sum2 = bit;

845 } else {

846 DecodeReader->sum2 += bit;

847 }

                         if (DecodeReader->posCount == 8) {

849 DecodeReader->posCount = 0;

                                 if (DecodeReader->sum1 <= 1 && DecodeReader->sum2 >= 3) { // EOF

851 LED_B_OFF(); // Finished receiving

852 DecodeReaderReset(DecodeReader);

                                         if (DecodeReader->byteCount != 0) {

854 return true;

855 }

856 }

                                 if (DecodeReader->sum1 >= 3 && DecodeReader->sum2 <= 1) { // detected a 2bit position

858 DecodeReader->shiftReg >>= 2;

                                         DecodeReader->shiftReg |= (DecodeReader->bitCount << 6);

860 }

                                 if (DecodeReader->bitCount == 15) { // we have a full byte

                                         DecodeReader->output[DecodeReader->byteCount++] = DecodeReader->shiftReg;

                                         if (DecodeReader->byteCount > DecodeReader->byteCountMax) {

864 // buffer overflow, give up

865 LED_B_OFF();

866 DecodeReaderReset(DecodeReader);

867 }

868 DecodeReader->bitCount = 0;

869 DecodeReader->shiftReg = 0;

870 } else {

871 DecodeReader->bitCount++;

872 }

873 }

874 break;

875

876 case STATE_READER_RECEIVE_DATA_1_OUT_OF_256:

877 bit = !!bit;

878 DecodeReader->posCount++;

                         if (DecodeReader->posCount == 1) {

880 DecodeReader->sum1 = bit;

                         } else if (DecodeReader->posCount <= 4) {

882 DecodeReader->sum1 += bit;

                         } else if (DecodeReader->posCount == 5) {

884 DecodeReader->sum2 = bit;

885 } else {

886 DecodeReader->sum2 += bit;

887 }

                         if (DecodeReader->posCount == 8) {

889 DecodeReader->posCount = 0;

                                 if (DecodeReader->sum1 <= 1 && DecodeReader->sum2 >= 3) { // EOF

891 LED_B_OFF(); // Finished receiving

892 DecodeReaderReset(DecodeReader);

                                         if (DecodeReader->byteCount != 0) {

894 return true;

895 }

896 }

                                 if (DecodeReader->sum1 >= 3 && DecodeReader->sum2 <= 1) { // detected the bit position

898 DecodeReader->shiftReg = DecodeReader->bitCount;

899 }

                                 if (DecodeReader->bitCount == 255) { // we have a full byte

                                         DecodeReader->output[DecodeReader->byteCount++] = DecodeReader->shiftReg;

                                         if (DecodeReader->byteCount > DecodeReader->byteCountMax) {

903 // buffer overflow, give up

904 LED_B_OFF();

905 DecodeReaderReset(DecodeReader);

906 }

907 }

908 DecodeReader->bitCount++;

909 }

910 break;

911

912 default:

913 LED_B_OFF();

914 DecodeReaderReset(DecodeReader);

915 break;

916 }

917

918 return false;

919 }

920

921

922 //-----------------------------------------------------------------------------

923 // Receive a command (from the reader to us, where we are the simulated tag),

924 // and store it in the given buffer, up to the given maximum length. Keeps

925 // spinning, waiting for a well-framed command, until either we get one

926 // (returns len) or someone presses the pushbutton on the board (returns -1).

927 //

928 // Assume that we're called with the SSC (to the FPGA) and ADC path set

929 // correctly.

930 //-----------------------------------------------------------------------------

931

 int GetIso15693CommandFromReader(uint8_t *received, size_t max_len, uint32_t *eof_time) {

933 int samples = 0;

934 bool gotFrame = false;

935 uint8_t b;

936

937 uint8_t dmaBuf[ISO15693_DMA_BUFFER_SIZE];

938

939 // the decoder data structure

940 DecodeReader_t DecodeReader = {0};

         DecodeReaderInit(&DecodeReader, received, max_len);

942

943 // wait for last transfer to complete

         while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));

945

946 LED_D_OFF();

947 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);

948

949 // clear receive register and wait for next transfer

950 uint32_t temp = AT91C_BASE_SSC->SSC_RHR;

951 (void) temp;

         while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)) ;

953

         uint32_t dma_start_time = GetCountSspClk() & 0xfffffff8;

955

956 // Setup and start DMA.

957 FpgaSetupSscDma(dmaBuf, ISO15693_DMA_BUFFER_SIZE);

958 uint8_t *upTo = dmaBuf;

959

960 for (;;) {

                 uint16_t behindBy = ((uint8_t*)AT91C_BASE_PDC_SSC->PDC_RPR - upTo) & (ISO15693_DMA_BUFFER_SIZE-1);

962

                 if (behindBy == 0) continue;

964

965 b = *upTo++;

                 if (upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) {               // we have read all of the DMA buffer content.

967 upTo = dmaBuf; // start reading the circular buffer from the beginning

                         if (behindBy > (9*ISO15693_DMA_BUFFER_SIZE/10)) {

                                 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);

970 break;

971 }

972 }

                 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.

                         AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and

975 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE; // DMA Next Counter registers

976 }

977

                 for (int i = 7; i >= 0; i--) {

                         if (Handle15693SampleFromReader((b >> i) & 0x01, &DecodeReader)) {

                                 *eof_time = dma_start_time + samples - DELAY_READER_TO_ARM_SIM; // end of EOF

981 gotFrame = true;

982 break;

983 }

984 samples++;

985 }

986

987 if (gotFrame) {

988 break;

989 }

990

991 if (BUTTON_PRESS()) {

992 DecodeReader.byteCount = -1;

993 break;

994 }

995

996 WDT_HIT();

997 }

998

999 FpgaDisableSscDma();

1000

         if (DEBUG) Dbprintf("samples = %d, gotFrame = %d, Decoder: state = %d, len = %d, bitCount = %d, posCount = %d",

                                                 samples, gotFrame, DecodeReader.state, DecodeReader.byteCount, DecodeReader.bitCount, DecodeReader.posCount);

1003

         if (DecodeReader.byteCount > 0) {

1005 uint32_t sof_time = *eof_time

                                                 - DecodeReader.byteCount * (DecodeReader.Coding==CODING_1_OUT_OF_4?128:2048) // time for byte transfers

1007 - 32 // time for SOF transfer

1008 - 16; // time for EOF transfer

                 LogTrace(DecodeReader.output, DecodeReader.byteCount, sof_time, *eof_time, NULL, true);

1010 }

1011

1012 return DecodeReader.byteCount;

1013 }

1014

1015

1016 // Encode (into the ToSend buffers) an identify request, which is the first

1017 // thing that you must send to a tag to get a response.

 static void BuildIdentifyRequest(void)

1019 {

1020 uint8_t cmd[5];

1021

1022 uint16_t crc;

1023 // one sub-carrier, inventory, 1 slot, fast rate

1024 // AFI is at bit 5 (1<<4) when doing an INVENTORY

         cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);

1026 // inventory command code

         cmd[1] = 0x01;

1028 // no mask

         cmd[2] = 0x00;

1030 //Now the CRC

         crc = Iso15693Crc(cmd, 3);

         cmd[3] = crc & 0xff;

         cmd[4] = crc >> 8;

1034

         CodeIso15693AsReader(cmd, sizeof(cmd));

1036 }

1037

1038

1039 //-----------------------------------------------------------------------------

1040 // Start to read an ISO 15693 tag. We send an identify request, then wait

1041 // for the response. The response is not demodulated, just left in the buffer

1042 // so that it can be downloaded to a PC and processed there.

1043 //-----------------------------------------------------------------------------

 void AcquireRawAdcSamplesIso15693(void)

1045 {

1046 LEDsoff();

1047 LED_A_ON();

1048

         uint8_t *dest = BigBuf_get_addr();

1050

1051 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1052 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);

1053 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

1054 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1055

1056 BuildIdentifyRequest();

1057

1058 // Give the tags time to energize

1059 LED_D_ON();

1060 SpinDelay(100);

1061

1062 // Now send the command

         TransmitTo15693Tag(ToSend, ToSendMax, 0);

1064

1065 // wait for last transfer to complete

         while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY)) ;

1067

         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_424_KHZ | FPGA_HF_READER_MODE_RECEIVE_AMPLITUDE);

1069

         for(int c = 0; c < 4000; ) {

                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

1072 uint16_t r = AT91C_BASE_SSC->SSC_RHR;

                         dest[c++] = r >> 5;

1074 }

1075 }

1076

1077 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1078 LEDsoff();

1079 }

1080

1081

 void SnoopIso15693(void)

1083 {

1084 LED_A_ON();

1085 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1086 BigBuf_free();

1087

1088 clear_trace();

1089 set_tracing(true);

1090

1091 // The DMA buffer, used to stream samples from the FPGA

         uint16_t* dmaBuf = (uint16_t*)BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE*sizeof(uint16_t));

1093 uint16_t *upTo;

1094

1095 // Count of samples received so far, so that we can include timing

1096 // information in the trace buffer.

1097 int samples = 0;

1098

1099 DecodeTag_t DecodeTag = {0};

1100 uint8_t response[ISO15693_MAX_RESPONSE_LENGTH];

         DecodeTagInit(&DecodeTag, response, sizeof(response));

1102

1103 DecodeReader_t DecodeReader = {0};;

1104 uint8_t cmd[ISO15693_MAX_COMMAND_LENGTH];

         DecodeReaderInit(&DecodeReader, cmd, sizeof(cmd));

1106

1107 // Print some debug information about the buffer sizes

1108 if (DEBUG) {

1109 Dbprintf("Snooping buffers initialized:");

                 Dbprintf("  Trace:         %i bytes", BigBuf_max_traceLen());

                 Dbprintf("  Reader -> tag: %i bytes", ISO15693_MAX_COMMAND_LENGTH);

                 Dbprintf("  tag -> Reader: %i bytes", ISO15693_MAX_RESPONSE_LENGTH);

                 Dbprintf("  DMA:           %i bytes", ISO15693_DMA_BUFFER_SIZE * sizeof(uint16_t));

1114 }

1115 Dbprintf("Snoop started. Press PM3 Button to stop.");

1116

1117 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SNOOP_AMPLITUDE);

1118 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1119

1120 // Setup for the DMA.

1121 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

1122 upTo = dmaBuf;

         FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);

1124

1125 bool TagIsActive = false;

1126 bool ReaderIsActive = false;

1127 bool ExpectTagAnswer = false;

1128

1129 // And now we loop, receiving samples.

1130 for(;;) {

                 uint16_t behindBy = ((uint16_t*)AT91C_BASE_PDC_SSC->PDC_RPR - upTo) & (ISO15693_DMA_BUFFER_SIZE-1);

1132

                 if (behindBy == 0) continue;

1134

1135 uint16_t snoopdata = *upTo++;

1136

                 if(upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) {                    // we have read all of the DMA buffer content.

1138 upTo = dmaBuf; // start reading the circular buffer from the beginning

                         if(behindBy > (9*ISO15693_DMA_BUFFER_SIZE/10)) {

                                 Dbprintf("About to blow circular buffer - aborted! behindBy=%d, samples=%d", behindBy, samples);

1141 break;

1142 }

                         if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.

                                 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and

1145 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE; // DMA Next Counter registers

1146 WDT_HIT();

1147 if(BUTTON_PRESS()) {

1148 DbpString("Snoop stopped.");

1149 break;

1150 }

1151 }

1152 }

1153 samples++;

1154

1155 if (!TagIsActive) { // no need to try decoding reader data if the tag is sending

                         if (Handle15693SampleFromReader(snoopdata & 0x02, &DecodeReader)) {

1157 FpgaDisableSscDma();

1158 ExpectTagAnswer = true;

                                 LogTrace(DecodeReader.output, DecodeReader.byteCount, samples, samples, NULL, true);

1160 /* And ready to receive another command. */

1161 DecodeReaderReset(&DecodeReader);

1162 /* And also reset the demod code, which might have been */

1163 /* false-triggered by the commands from the reader. */

1164 DecodeTagReset(&DecodeTag);

1165 upTo = dmaBuf;

                                 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);

1167 }

                         if (Handle15693SampleFromReader(snoopdata & 0x01, &DecodeReader)) {

1169 FpgaDisableSscDma();

1170 ExpectTagAnswer = true;

                                 LogTrace(DecodeReader.output, DecodeReader.byteCount, samples, samples, NULL, true);

1172 /* And ready to receive another command. */

1173 DecodeReaderReset(&DecodeReader);

1174 /* And also reset the demod code, which might have been */

1175 /* false-triggered by the commands from the reader. */

1176 DecodeTagReset(&DecodeTag);

1177 upTo = dmaBuf;

                                 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);

1179 }

1180 ReaderIsActive = (DecodeReader.state >= STATE_READER_AWAIT_2ND_RISING_EDGE_OF_SOF);

1181 }

1182

                 if (!ReaderIsActive && ExpectTagAnswer) {                       // no need to try decoding tag data if the reader is currently sending or no answer expected yet

                         if (Handle15693SamplesFromTag(snoopdata >> 2, &DecodeTag)) {

1185 FpgaDisableSscDma();

1186 //Use samples as a time measurement

                                 LogTrace(DecodeTag.output, DecodeTag.len, samples, samples, NULL, false);

1188 // And ready to receive another response.

1189 DecodeTagReset(&DecodeTag);

1190 DecodeReaderReset(&DecodeReader);

1191 ExpectTagAnswer = false;

1192 upTo = dmaBuf;

                                 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);

1194 }

1195 TagIsActive = (DecodeTag.state >= STATE_TAG_RECEIVING_DATA);

1196 }

1197

1198 }

1199

1200 FpgaDisableSscDma();

1201 BigBuf_free();

1202

1203 LEDsoff();

1204

1205 DbpString("Snoop statistics:");

         Dbprintf("  ExpectTagAnswer: %d", ExpectTagAnswer);

         Dbprintf("  DecodeTag State: %d", DecodeTag.state);

         Dbprintf("  DecodeTag byteCnt: %d", DecodeTag.len);

         Dbprintf("  DecodeReader State: %d", DecodeReader.state);

         Dbprintf("  DecodeReader byteCnt: %d", DecodeReader.byteCount);

         Dbprintf("  Trace length: %d", BigBuf_get_traceLen());

1212 }

1213

1214

1215 // Initialize the proxmark as iso15k reader

1216 static void Iso15693InitReader() {

1217 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1218 // Setup SSC

1219 // FpgaSetupSsc();

1220

1221 // Start from off (no field generated)

1222 LED_D_OFF();

1223 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1224 SpinDelay(10);

1225

1226 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1227 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

1228

1229 // Give the tags time to energize

1230 LED_D_ON();

1231 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);

1232 SpinDelay(250);

1233 }

1234

1235 ///////////////////////////////////////////////////////////////////////

1236 // ISO 15693 Part 3 - Air Interface

1237 // This section basically contains transmission and receiving of bits

1238 ///////////////////////////////////////////////////////////////////////

1239

1240

1241 // uid is in transmission order (which is reverse of display order)

 static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )

1243 {

1244 uint8_t cmd[13];

1245

1246 uint16_t crc;

1247 // If we set the Option_Flag in this request, the VICC will respond with the security status of the block

1248 // followed by the block data

         cmd[0] = ISO15693_REQ_OPTION | ISO15693_REQ_ADDRESS | ISO15693_REQ_DATARATE_HIGH;

1250 // READ BLOCK command code

1251 cmd[1] = ISO15693_READBLOCK;

1252 // UID may be optionally specified here

1253 // 64-bit UID

         cmd[2] = uid[0];

         cmd[3] = uid[1];

         cmd[4] = uid[2];

         cmd[5] = uid[3];

         cmd[6] = uid[4];

         cmd[7] = uid[5];

         cmd[8] = uid[6];

         cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique)

1262 // Block number to read

1263 cmd[10] = blockNumber;

1264 //Now the CRC

         crc = Iso15693Crc(cmd, 11); // the crc needs to be calculated over 11 bytes

         cmd[11] = crc & 0xff;

         cmd[12] = crc >> 8;

1268

         CodeIso15693AsReader(cmd, sizeof(cmd));

1270 }

1271

1272

1273 // Now the VICC>VCD responses when we are simulating a tag

 static void BuildInventoryResponse(uint8_t *uid)

1275 {

1276 uint8_t cmd[12];

1277

1278 uint16_t crc;

1279

         cmd[0] = 0; // No error, no protocol format extension

         cmd[1] = 0; // DSFID (data storage format identifier).  0x00 = not supported

1282 // 64-bit UID

         cmd[2] = uid[7]; //0x32;

         cmd[3] = uid[6]; //0x4b;

         cmd[4] = uid[5]; //0x03;

         cmd[5] = uid[4]; //0x01;

         cmd[6] = uid[3]; //0x00;

         cmd[7] = uid[2]; //0x10;

         cmd[8] = uid[1]; //0x05;

         cmd[9] = uid[0]; //0xe0;

1291 //Now the CRC

         crc = Iso15693Crc(cmd, 10);

         cmd[10] = crc & 0xff;

         cmd[11] = crc >> 8;

1295

         CodeIso15693AsTag(cmd, sizeof(cmd));

1297 }

1298

1299 // Universal Method for sending to and recv bytes from a tag

1300 // init ... should we initialize the reader?

1301 // speed ... 0 low speed, 1 hi speed

1302 // *recv will contain the tag's answer

1303 // return: lenght of received data

 int SendDataTag(uint8_t *send, int sendlen, bool init, int speed, uint8_t *recv, uint16_t max_recv_len, uint32_t start_time) {

1305

1306 LED_A_ON();

1307 LED_B_OFF();

1308 LED_C_OFF();

1309

         if (init) Iso15693InitReader();

1311

1312 int answerLen=0;

1313

1314 if (!speed) {

1315 // low speed (1 out of 256)

1316 CodeIso15693AsReader256(send, sendlen);

1317 } else {

1318 // high speed (1 out of 4)

1319 CodeIso15693AsReader(send, sendlen);

1320 }

1321

         TransmitTo15693Tag(ToSend, ToSendMax, start_time);

1323

1324 // Now wait for a response

1325 if (recv != NULL) {

                 answerLen = GetIso15693AnswerFromTag(recv, max_recv_len, DELAY_ISO15693_VCD_TO_VICC_READER * 2);

1327 }

1328

1329 LED_A_OFF();

1330

1331 return answerLen;

1332 }

1333

1334

1335 // --------------------------------------------------------------------

1336 // Debug Functions

1337 // --------------------------------------------------------------------

1338

1339 // Decodes a message from a tag and displays its metadata and content

1340 #define DBD15STATLEN 48

 void DbdecodeIso15693Answer(int len, uint8_t *d) {

         char status[DBD15STATLEN+1]={0};

1343 uint16_t crc;

1344

         if (len > 3) {

                 if (d[0] & ISO15693_RES_EXT)

                         strncat(status,"ProtExt ", DBD15STATLEN);

                 if (d[0] & ISO15693_RES_ERROR) {

1349 // error

                         strncat(status,"Error ", DBD15STATLEN);

                         switch (d[1]) {

1352 case 0x01:

                                         strncat(status,"01:notSupp", DBD15STATLEN);

1354 break;

1355 case 0x02:

                                         strncat(status,"02:notRecog", DBD15STATLEN);

1357 break;

1358 case 0x03:

                                         strncat(status,"03:optNotSupp", DBD15STATLEN);

1360 break;

1361 case 0x0f:

                                         strncat(status,"0f:noInfo", DBD15STATLEN);

1363 break;

1364 case 0x10:

                                         strncat(status,"10:doesn'tExist", DBD15STATLEN);

1366 break;

1367 case 0x11:

                                         strncat(status,"11:lockAgain", DBD15STATLEN);

1369 break;

1370 case 0x12:

                                         strncat(status,"12:locked", DBD15STATLEN);

1372 break;

1373 case 0x13:

                                         strncat(status,"13:progErr", DBD15STATLEN);

1375 break;

1376 case 0x14:

                                         strncat(status,"14:lockErr", DBD15STATLEN);

1378 break;

1379 default:

                                         strncat(status,"unknownErr", DBD15STATLEN);

1381 }

                         strncat(status," ", DBD15STATLEN);

1383 } else {

                         strncat(status,"NoErr ", DBD15STATLEN);

1385 }

1386

                 crc=Iso15693Crc(d,len-2);

                 if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) )

                         strncat(status,"CrcOK",DBD15STATLEN);

1390 else

                         strncat(status,"CrcFail!",DBD15STATLEN);

1392

                 Dbprintf("%s",status);

1394 }

1395 }

1396

1397

1398

1399 ///////////////////////////////////////////////////////////////////////

1400 // Functions called via USB/Client

1401 ///////////////////////////////////////////////////////////////////////

1402

 void SetDebugIso15693(uint32_t debug) {

1404 DEBUG=debug;

         Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off");

1406 return;

1407 }

1408

1409

1410 //---------------------------------------------------------------------------------------

1411 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector.

1412 // all demodulation performed in arm rather than host. - greg

1413 //---------------------------------------------------------------------------------------

 void ReaderIso15693(uint32_t parameter)

1415 {

1416 LEDsoff();

1417 LED_A_ON();

1418

1419 set_tracing(true);

1420

1421 int answerLen = 0;

         uint8_t TagUID[8] = {0x00};

1423

1424 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1425

1426 uint8_t answer[ISO15693_MAX_RESPONSE_LENGTH];

1427

1428 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1429 // Setup SSC

1430 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

1431

1432 // Start from off (no field generated)

1433 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1434 SpinDelay(200);

1435

1436 // Give the tags time to energize

1437 LED_D_ON();

1438 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER);

1439 SpinDelay(200);

1440 StartCountSspClk();

1441

1442

1443 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID

1444 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME

1445

1446 // Now send the IDENTIFY command

1447 BuildIdentifyRequest();

         TransmitTo15693Tag(ToSend, ToSendMax, 0);

1449

1450 // Now wait for a response

         answerLen = GetIso15693AnswerFromTag(answer, sizeof(answer), DELAY_ISO15693_VCD_TO_VICC_READER * 2) ;

         uint32_t start_time = GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER;

1453

         if (answerLen >=12) // we should do a better check than this

1455 {

                 TagUID[0] = answer[2];

                 TagUID[1] = answer[3];

                 TagUID[2] = answer[4];

                 TagUID[3] = answer[5];

                 TagUID[4] = answer[6];

                 TagUID[5] = answer[7];

                 TagUID[6] = answer[8]; // IC Manufacturer code

                 TagUID[7] = answer[9]; // always E0

1464

1465 }

1466

         Dbprintf("%d octets read from IDENTIFY request:", answerLen);

1468 DbdecodeIso15693Answer(answerLen, answer);

         Dbhexdump(answerLen, answer, false);

1470

1471 // UID is reverse

         if (answerLen >= 12)

1473 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",

                         TagUID[7],TagUID[6],TagUID[5],TagUID[4],

                         TagUID[3],TagUID[2],TagUID[1],TagUID[0]);

1476

1477

1478 // Dbprintf("%d octets read from SELECT request:", answerLen2);

1479 // DbdecodeIso15693Answer(answerLen2,answer2);

1480 // Dbhexdump(answerLen2,answer2,true);

1481

1482 // Dbprintf("%d octets read from XXX request:", answerLen3);

1483 // DbdecodeIso15693Answer(answerLen3,answer3);

1484 // Dbhexdump(answerLen3,answer3,true);

1485

1486 // read all pages

         if (answerLen >= 12 && DEBUG) {

                 for (int i = 0; i < 32; i++) {  // sanity check, assume max 32 pages

1489 BuildReadBlockRequest(TagUID, i);

                         TransmitTo15693Tag(ToSend, ToSendMax, start_time);

                         int answerLen = GetIso15693AnswerFromTag(answer, sizeof(answer), DELAY_ISO15693_VCD_TO_VICC_READER * 2);

1492 start_time = GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER;

                         if (answerLen > 0) {

                                 Dbprintf("READ SINGLE BLOCK %d returned %d octets:", i, answerLen);

1495 DbdecodeIso15693Answer(answerLen, answer);

                                 Dbhexdump(answerLen, answer, false);

                                 if ( *((uint32_t*) answer) == 0x07160101 ) break; // exit on NoPageErr

1498 }

1499 }

1500 }

1501

1502 // for the time being, switch field off to protect rdv4.0

1503 // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway

1504 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1505 LED_D_OFF();

1506

1507 LED_A_OFF();

1508 }

1509

1510

1511 // Simulate an ISO15693 TAG.

1512 // For Inventory command: print command and send Inventory Response with given UID

1513 // TODO: interpret other reader commands and send appropriate response

 void SimTagIso15693(uint32_t parameter, uint8_t *uid)

1515 {

1516 LEDsoff();

1517 LED_A_ON();

1518

1519 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

1520 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

1521 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);

1522 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);

1523

1524 StartCountSspClk();

1525

1526 uint8_t cmd[ISO15693_MAX_COMMAND_LENGTH];

1527

1528 // Build a suitable response to the reader INVENTORY command

1529 BuildInventoryResponse(uid);

1530

1531 // Listen to reader

1532 while (!BUTTON_PRESS()) {

                 uint32_t eof_time = 0, start_time = 0;

                 int cmd_len = GetIso15693CommandFromReader(cmd, sizeof(cmd), &eof_time);

1535

                 if ((cmd_len >= 5) && (cmd[0] & ISO15693_REQ_INVENTORY) && (cmd[1] == ISO15693_INVENTORY)) { // TODO: check more flags

                         bool slow = !(cmd[0] & ISO15693_REQ_DATARATE_HIGH);

1538 start_time = eof_time + DELAY_ISO15693_VCD_TO_VICC_SIM - DELAY_ARM_TO_READER_SIM;

                         TransmitTo15693Reader(ToSend, ToSendMax, &start_time, 0, slow);

1540 }

1541

                 Dbprintf("%d bytes read from reader:", cmd_len);

                 Dbhexdump(cmd_len, cmd, false);

1544 }

1545

1546 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1547 LEDsoff();

1548 }

1549

1550

1551 // Since there is no standardized way of reading the AFI out of a tag, we will brute force it

1552 // (some manufactures offer a way to read the AFI, though)

 void BruteforceIso15693Afi(uint32_t speed)

1554 {

1555 LEDsoff();

1556 LED_A_ON();

1557

1558 uint8_t data[6];

1559 uint8_t recv[ISO15693_MAX_RESPONSE_LENGTH];

1560

         int datalen=0, recvlen=0;

1562

1563 Iso15693InitReader();

1564 StartCountSspClk();

1565

1566 // first without AFI

1567 // Tags should respond without AFI and with AFI=0 even when AFI is active

1568

         data[0] = ISO15693_REQ_DATARATE_HIGH | ISO15693_REQ_INVENTORY | ISO15693_REQINV_SLOT1;

1570 data[1] = ISO15693_INVENTORY;

         data[2] = 0; // mask length

         datalen = Iso15693AddCrc(data,3);

         recvlen = SendDataTag(data, datalen, false, speed, recv, sizeof(recv), 0);

         uint32_t start_time = GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER;

1575 WDT_HIT();

         if (recvlen>=12) {

                 Dbprintf("NoAFI UID=%s", Iso15693sprintUID(NULL, &recv[2]));

1578 }

1579

1580 // now with AFI

1581

         data[0] = ISO15693_REQ_DATARATE_HIGH | ISO15693_REQ_INVENTORY | ISO15693_REQINV_AFI | ISO15693_REQINV_SLOT1;

1583 data[1] = ISO15693_INVENTORY;

         data[2] = 0; // AFI

         data[3] = 0; // mask length

1586

         for (int i = 0; i < 256; i++) {

                 data[2] = i & 0xFF;

                 datalen = Iso15693AddCrc(data,4);

                 recvlen = SendDataTag(data, datalen, false, speed, recv, sizeof(recv), start_time);

1591 start_time = GetCountSspClk() + DELAY_ISO15693_VICC_TO_VCD_READER;

1592 WDT_HIT();

                 if (recvlen >= 12) {

                         Dbprintf("AFI=%i UID=%s", i, Iso15693sprintUID(NULL, &recv[2]));

1595 }

1596 }

1597 Dbprintf("AFI Bruteforcing done.");

1598

1599 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1600 LEDsoff();

1601 }

1602

1603 // Allows to directly send commands to the tag via the client

 void DirectTag15693Command(uint32_t datalen, uint32_t speed, uint32_t recv, uint8_t data[]) {

1605

1606 int recvlen = 0;

1607 uint8_t recvbuf[ISO15693_MAX_RESPONSE_LENGTH];

1608

1609 LED_A_ON();

1610

1611 if (DEBUG) {

1612 Dbprintf("SEND:");

                 Dbhexdump(datalen, data, false);

1614 }

1615

         recvlen = SendDataTag(data, datalen, true, speed, (recv?recvbuf:NULL), sizeof(recvbuf), 0);

1617

1618 if (recv) {

1619 if (DEBUG) {

1620 Dbprintf("RECV:");

                         Dbhexdump(recvlen, recvbuf, false);

1622 DbdecodeIso15693Answer(recvlen, recvbuf);

1623 }

1624

                 cmd_send(CMD_ACK, recvlen>ISO15693_MAX_RESPONSE_LENGTH?ISO15693_MAX_RESPONSE_LENGTH:recvlen, 0, 0, recvbuf, ISO15693_MAX_RESPONSE_LENGTH);

1626

1627 }

1628

1629 // for the time being, switch field off to protect rdv4.0

1630 // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway

1631 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

1632 LED_D_OFF();

1633

1634 LED_A_OFF();

1635 }

1636

1637 //-----------------------------------------------------------------------------

1638 // Work with "magic Chinese" card.

1639 //

1640 //-----------------------------------------------------------------------------

1641

1642 // Set the UID to the tag (based on Iceman work).

 void SetTag15693Uid(uint8_t *uid)

1644 {

         uint8_t cmd[4][9] = {0x00};

1646

1647 uint16_t crc;

1648

1649 int recvlen = 0;

1650 uint8_t recvbuf[ISO15693_MAX_RESPONSE_LENGTH];

1651

1652 LED_A_ON();

1653

1654 // Command 1 : 02213E00000000

         cmd[0][0] = 0x02;

         cmd[0][1] = 0x21;

         cmd[0][2] = 0x3e;

         cmd[0][3] = 0x00;

         cmd[0][4] = 0x00;

         cmd[0][5] = 0x00;

         cmd[0][6] = 0x00;

1662

1663 // Command 2 : 02213F69960000

         cmd[1][0] = 0x02;

         cmd[1][1] = 0x21;

         cmd[1][2] = 0x3f;

         cmd[1][3] = 0x69;

         cmd[1][4] = 0x96;

         cmd[1][5] = 0x00;

         cmd[1][6] = 0x00;

1671

1672 // Command 3 : 022138u8u7u6u5 (where uX = uid byte X)

         cmd[2][0] = 0x02;

         cmd[2][1] = 0x21;

         cmd[2][2] = 0x38;

         cmd[2][3] = uid[7];

         cmd[2][4] = uid[6];

         cmd[2][5] = uid[5];

         cmd[2][6] = uid[4];

1680

1681 // Command 4 : 022139u4u3u2u1 (where uX = uid byte X)

         cmd[3][0] = 0x02;

         cmd[3][1] = 0x21;

         cmd[3][2] = 0x39;

         cmd[3][3] = uid[3];

         cmd[3][4] = uid[2];

         cmd[3][5] = uid[1];

         cmd[3][6] = uid[0];

1689

         for (int i=0; i<4; i++) {

1691 // Add the CRC

                 crc = Iso15693Crc(cmd[i], 7);

                 cmd[i][7] = crc & 0xff;

                 cmd[i][8] = crc >> 8;

1695

1696 if (DEBUG) {

1697 Dbprintf("SEND:");

                         Dbhexdump(sizeof(cmd[i]), cmd[i], false);

1699 }

1700

                 recvlen = SendDataTag(cmd[i], sizeof(cmd[i]), true, 1, recvbuf, sizeof(recvbuf), 0);

1702

1703 if (DEBUG) {

1704 Dbprintf("RECV:");

                         Dbhexdump(recvlen, recvbuf, false);

1706 DbdecodeIso15693Answer(recvlen, recvbuf);

1707 }

1708

                 cmd_send(CMD_ACK, recvlen>ISO15693_MAX_RESPONSE_LENGTH?ISO15693_MAX_RESPONSE_LENGTH:recvlen, 0, 0, recvbuf, ISO15693_MAX_RESPONSE_LENGTH);