git.zerfleddert.de Git - proxmark3-svn/blobdiff

//-----------------------------------------------------------------------------

// Jonathan Westhues, split Nov 2006

//-----------------------------------------------------------------------------

// Jonathan Westhues, split Nov 2006

+// piwi 2018

//

// This code is licensed to you under the terms of the GNU GPL, version 2 or,

// at your option, any later version. See the LICENSE.txt file for the text of

//

// This code is licensed to you under the terms of the GNU GPL, version 2 or,

// at your option, any later version. See the LICENSE.txt file for the text of

// the `fake tag' modes.

//-----------------------------------------------------------------------------

// the `fake tag' modes.

//-----------------------------------------------------------------------------

+#include "iso14443b.h"

+

#include "proxmark3.h"

#include "apps.h"

#include "proxmark3.h"

#include "apps.h"

+#include "usb_cdc.h"

#include "util.h"

#include "string.h"

#include "util.h"

#include "string.h"

-

#include "iso14443crc.h"

+#include "fpgaloader.h"

+#include "BigBuf.h"

-#define RECEIVE_SAMPLES_TIMEOUT 2000

-#define ISO14443B_DMA_BUFFER_SIZE 256

+#define RECEIVE_SAMPLES_TIMEOUT 64 // TR0 max is 256/fs = 256/(848kHz) = 302us or 64 samples from FPGA

+#define ISO14443B_DMA_BUFFER_SIZE 128

// PCB Block number for APDUs

static uint8_t pcb_blocknum = 0;

// PCB Block number for APDUs

static uint8_t pcb_blocknum = 0;

//-----------------------------------------------------------------------------

void SimulateIso14443bTag(void)

{

//-----------------------------------------------------------------------------

void SimulateIso14443bTag(void)

{

+ LED_A_ON();

// the only commands we understand is WUPB, AFI=0, Select All, N=1:

static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB

// ... and REQB, AFI=0, Normal Request, N=1:

// the only commands we understand is WUPB, AFI=0, Select All, N=1:

static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB

// ... and REQB, AFI=0, Normal Request, N=1:

// We need to listen to the high-frequency, peak-detected path.

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

// We need to listen to the high-frequency, peak-detected path.

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

- FpgaSetupSsc();

+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);

cmdsRecvd = 0;

break;

}

break;

}

- if (tracing) {

- uint8_t parity[MAX_PARITY_SIZE];

- LogTrace(receivedCmd, len, 0, 0, parity, true);

- }

+ LogTrace(receivedCmd, len, 0, 0, NULL, true);

// Good, look at the command now.

if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0)

// Good, look at the command now.

if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0)

LED_D_OFF();

FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);

AT91C_BASE_SSC->SSC_THR = 0xff;

LED_D_OFF();

FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);

AT91C_BASE_SSC->SSC_THR = 0xff;

- FpgaSetupSsc();

+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);

// Transmit the response.

uint16_t i = 0;

// Transmit the response.

uint16_t i = 0;

}

// trace the response:

}

// trace the response:

- if (tracing) {

- uint8_t parity[MAX_PARITY_SIZE];

- LogTrace(resp, respLen, 0, 0, parity, false);

- }

+ LogTrace(resp, respLen, 0, 0, NULL, false);

}

+

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

+ LED_A_OFF();

}

//=============================================================================

}

//=============================================================================

#define SUBCARRIER_DETECT_THRESHOLD 8

-// Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq)

-/* #define CHECK_FOR_SUBCARRIER() { \

- v = ci; \

- if(v < 0) v = -v; \

- if(cq > 0) { \

- v += cq; \

- } else { \

- v -= cq; \

- } \

- }

- */

// Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))

-

- //note: couldn't we just use MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2) from common.h - marshmellow

-#define CHECK_FOR_SUBCARRIER() { \

- v = MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2); \

- }

- /*

- if(ci < 0) { \

- if(cq < 0) { \ // ci < 0, cq < 0

- if (cq < ci) { \

- v = -cq - (ci >> 1); \

- } else { \

- v = -ci - (cq >> 1); \

- } \

- } else { \ // ci < 0, cq >= 0

- if (cq < -ci) { \

- v = -ci + (cq >> 1); \

- } else { \

- v = cq - (ci >> 1); \

- } \

- } else { \

- if(cq < 0) { \ // ci >= 0, cq < 0

- if (-cq < ci) { \

- v = ci - (cq >> 1); \

- } else { \

- v = -cq + (ci >> 1); \

- } \

- } else { \ // ci >= 0, cq >= 0

- if (cq < ci) { \

- v = ci + (cq >> 1); \

- } else { \

- v = cq + (ci >> 1); \

- } \

- }

- */

-

+#define AMPLITUDE(ci,cq) (MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2))

switch(Demod.state) {

case DEMOD_UNSYNCD:

switch(Demod.state) {

case DEMOD_UNSYNCD:

- CHECK_FOR_SUBCARRIER();

- if(v > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected

+ if(AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected

Demod.state = DEMOD_PHASE_REF_TRAINING;

Demod.sumI = ci;

Demod.sumQ = cq;

Demod.state = DEMOD_PHASE_REF_TRAINING;

Demod.sumI = ci;

Demod.sumQ = cq;

case DEMOD_PHASE_REF_TRAINING:

if(Demod.posCount < 8) {

case DEMOD_PHASE_REF_TRAINING:

if(Demod.posCount < 8) {

- CHECK_FOR_SUBCARRIER();

- if (v > SUBCARRIER_DETECT_THRESHOLD) {

+ if (AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) {

// set the reference phase (will code a logic '1') by averaging over 32 1/fs.

// note: synchronization time > 80 1/fs

Demod.sumI += ci;

// set the reference phase (will code a logic '1') by averaging over 32 1/fs.

// note: synchronization time > 80 1/fs

Demod.sumI += ci;

Demod.state = DEMOD_UNSYNCD;

} else {

LED_C_ON(); // Got SOF

Demod.state = DEMOD_UNSYNCD;

} else {

LED_C_ON(); // Got SOF

- Demod.state = DEMOD_AWAITING_START_BIT;

Demod.posCount = 0;

+ Demod.bitCount = 0;

Demod.len = 0;

+ Demod.state = DEMOD_AWAITING_START_BIT;

/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.

Demod.metricN = 0;

Demod.metric = 0;

/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.

Demod.metricN = 0;

Demod.metric = 0;

case DEMOD_AWAITING_START_BIT:

Demod.posCount++;

MAKE_SOFT_DECISION();

case DEMOD_AWAITING_START_BIT:

Demod.posCount++;

MAKE_SOFT_DECISION();

- if(v > 0) {

- if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs

- Demod.state = DEMOD_UNSYNCD;

+ if (v > 0) {

+ if (Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs

LED_C_OFF();

+ if (Demod.bitCount == 0 && Demod.len == 0) { // received SOF only, this is valid for iClass/Picopass

+ return true;

+ } else {

+ Demod.state = DEMOD_UNSYNCD;

+ }

}

} else { // start bit detected

}

} else { // start bit detected

- Demod.bitCount = 0;

Demod.posCount = 1; // this was the first half

Demod.thisBit = v;

Demod.shiftReg = 0;

Demod.posCount = 1; // this was the first half

Demod.thisBit = v;

Demod.shiftReg = 0;

case DEMOD_RECEIVING_DATA:

MAKE_SOFT_DECISION();

case DEMOD_RECEIVING_DATA:

MAKE_SOFT_DECISION();

- if(Demod.posCount == 0) { // first half of bit

+ if (Demod.posCount == 0) { // first half of bit

Demod.thisBit = v;

Demod.posCount = 1;

} else { // second half of bit

Demod.thisBit = v;

Demod.posCount = 1;

} else { // second half of bit

*/

Demod.shiftReg >>= 1;

*/

Demod.shiftReg >>= 1;

- if(Demod.thisBit > 0) { // logic '1'

+ if (Demod.thisBit > 0) { // logic '1'

Demod.shiftReg |= 0x200;

}

Demod.bitCount++;

Demod.shiftReg |= 0x200;

}

Demod.bitCount++;

- if(Demod.bitCount == 10) {

+ if (Demod.bitCount == 10) {

uint16_t s = Demod.shiftReg;

- if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'

+ if ((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'

uint8_t b = (s >> 1);

Demod.output[Demod.len] = b;

Demod.len++;

uint8_t b = (s >> 1);

Demod.output[Demod.len] = b;

Demod.len++;

+ Demod.bitCount = 0;

Demod.state = DEMOD_AWAITING_START_BIT;

} else {

Demod.state = DEMOD_UNSYNCD;

LED_C_OFF();

Demod.state = DEMOD_AWAITING_START_BIT;

} else {

Demod.state = DEMOD_UNSYNCD;

LED_C_OFF();

- if(s == 0x000) {

+ if (s == 0x000) {

// This is EOF (start, stop and all data bits == '0'

return true;

}

// This is EOF (start, stop and all data bits == '0'

return true;

}

* Demodulate the samples we received from the tag, also log to tracebuffer

* quiet: set to 'true' to disable debug output

*/

* Demodulate the samples we received from the tag, also log to tracebuffer

* quiet: set to 'true' to disable debug output

*/

-static void GetSamplesFor14443bDemod(int n, bool quiet)

-{

- int max = 0;

+static int GetSamplesFor14443bDemod(int timeout, bool quiet) {

+ int ret = 0;

+ int maxBehindBy = 0;

bool gotFrame = false;

- int lastRxCounter, ci, cq, samples = 0;

-

+ int lastRxCounter, samples = 0;

+ int8_t ci, cq;

+

// Allocate memory from BigBuf for some buffers

// free all previous allocations first

BigBuf_free();

// Allocate memory from BigBuf for some buffers

// free all previous allocations first

BigBuf_free();

uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);

// The DMA buffer, used to stream samples from the FPGA

uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);

// The DMA buffer, used to stream samples from the FPGA

- int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);

+ uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));

// Set up the demodulator for tag -> reader responses.

DemodInit(receivedResponse);

// Set up the demodulator for tag -> reader responses.

DemodInit(receivedResponse);

+ // wait for last transfer to complete

+ while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY))

+

// Setup and start DMA.

+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);

- int8_t *upTo = dmaBuf;

+ uint16_t *upTo = dmaBuf;

lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;

// Signal field is ON with the appropriate LED:

LED_D_ON();

// And put the FPGA in the appropriate mode

lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;

// Signal field is ON with the appropriate LED:

LED_D_ON();

// And put the FPGA in the appropriate mode

- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_848_KHZ | FPGA_HF_READER_MODE_RECEIVE_IQ);

for(;;) {

- int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;

- if(behindBy > max) max = behindBy;

-

- while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {

- ci = upTo[0];

- cq = upTo[1];

- upTo += 2;

- if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {

- upTo = dmaBuf;

- AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;

- AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;

- }

- lastRxCounter -= 2;

- if(lastRxCounter <= 0) {

- lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;

- }

+ int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);

+ if(behindBy > maxBehindBy) {

+ maxBehindBy = behindBy;

+ }

- samples += 2;

+ if(behindBy < 1) continue;

- if(Handle14443bSamplesDemod(ci, cq)) {

- gotFrame = true;

- break;

- }

+ ci = *upTo >> 8;

+ cq = *upTo;

+ upTo++;

+ lastRxCounter--;

+ if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.

+ upTo = dmaBuf; // start reading the circular buffer from the beginning

+ lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;

+ }

+ if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.

+ AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and

+ AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers

}

+ samples++;

- if(samples > n || gotFrame) {

+ if (Handle14443bSamplesDemod(ci, cq)) {

+ ret = Demod.len;

+ gotFrame = true;

+ break;

+ }

+

+ if(samples > timeout && Demod.state < DEMOD_PHASE_REF_TRAINING) {

+ ret = -1;

+ LED_C_OFF();

break;

}

break;

}

- AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;

+ FpgaDisableSscDma();

- if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", max, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);

- //Tracing

- if (tracing && Demod.len > 0) {

- uint8_t parity[MAX_PARITY_SIZE];

- LogTrace(Demod.output, Demod.len, 0, 0, parity, false);

+ if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", maxBehindBy, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);

+

+ if (ret < 0) {

+ return ret;

}

+ //Tracing

+ LogTrace(Demod.output, Demod.len, 0, 0, NULL, false);

+

+ return ret;

}

//-----------------------------------------------------------------------------

static void TransmitFor14443b(void)

{

//-----------------------------------------------------------------------------

static void TransmitFor14443b(void)

{

- int c;

-

- FpgaSetupSsc();

-

- while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

- AT91C_BASE_SSC->SSC_THR = 0xff;

- }

-

- // Signal field is ON with the appropriate Red LED

- LED_D_ON();

- // Signal we are transmitting with the Green LED

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);

LED_B_ON();

- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);

-

- for(c = 0; c < 10;) {

- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

- AT91C_BASE_SSC->SSC_THR = 0xff;

- c++;

- }

- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

- volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;

- (void)r;

+ for(int c = 0; c < ToSendMax; c++) {

+ uint8_t data = ToSend[c];

+ for (int i = 0; i < 8; i++) {

+ uint16_t send_word = (data & 0x80) ? 0x0000 : 0xffff;

+ while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;

+ AT91C_BASE_SSC->SSC_THR = send_word;

+ while (!(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))) ;

+ AT91C_BASE_SSC->SSC_THR = send_word;

+ data <<= 1;

}

WDT_HIT();

}

WDT_HIT();

}

-

- c = 0;

- for(;;) {

- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

- AT91C_BASE_SSC->SSC_THR = ToSend[c];

- c++;

- if(c >= ToSendMax) {

- break;

- }

- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

- volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;

- (void)r;

- }

- WDT_HIT();

- }

- LED_B_OFF(); // Finished sending

+ LED_B_OFF();

}

ToSendReset();

- // Establish initial reference level

- for(i = 0; i < 40; i++) {

- ToSendStuffBit(1);

- }

// Send SOF

for(i = 0; i < 10; i++) {

ToSendStuffBit(0);

}

// Send SOF

for(i = 0; i < 10; i++) {

ToSendStuffBit(0);

}

+ ToSendStuffBit(1);

for(i = 0; i < len; i++) {

- // Stop bits/EGT

- ToSendStuffBit(1);

// Start bit

ToSendStuffBit(0);

// Data bits

// Start bit

ToSendStuffBit(0);

// Data bits

}

b >>= 1;

}

b >>= 1;

}

+ // Stop bit

+ ToSendStuffBit(1);

}

+

// Send EOF

- ToSendStuffBit(1);

for(i = 0; i < 10; i++) {

ToSendStuffBit(0);

}

for(i = 0; i < 10; i++) {

ToSendStuffBit(0);

}

- for(i = 0; i < 8; i++) {

- ToSendStuffBit(1);

- }

+ ToSendStuffBit(1);

- // And then a little more, to make sure that the last character makes

- // it out before we switch to rx mode.

- for(i = 0; i < 24; i++) {

+ // ensure that last byte is filled up

+ for(i = 0; i < 8; i++) {

ToSendStuffBit(1);

}

ToSendStuffBit(1);

}

{

CodeIso14443bAsReader(cmd, len);

TransmitFor14443b();

{

CodeIso14443bAsReader(cmd, len);

TransmitFor14443b();

- if (tracing) {

- uint8_t parity[MAX_PARITY_SIZE];

- LogTrace(cmd,len, 0, 0, parity, true);

- }

+ LogTrace(cmd,len, 0, 0, NULL, true);

}

/* Sends an APDU to the tag

* TODO: check CRC and preamble

*/

}

/* Sends an APDU to the tag

* TODO: check CRC and preamble

*/

-int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response)

-{

+int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response) {

+ LED_A_ON();

uint8_t message_frame[message_length + 4];

// PCB

message_frame[0] = 0x0A | pcb_blocknum;

uint8_t message_frame[message_length + 4];

// PCB

message_frame[0] = 0x0A | pcb_blocknum;

// send

CodeAndTransmit14443bAsReader(message_frame, message_length + 4);

// get response

// send

CodeAndTransmit14443bAsReader(message_frame, message_length + 4);

// get response

- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT*100, true);

- if(Demod.len < 3)

- {

+ int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

+ FpgaDisableTracing();

+ if (ret < 3) {

+ LED_A_OFF();

return 0;

}

// TODO: Check CRC

// copy response contents

return 0;

}

// TODO: Check CRC

// copy response contents

- if(response != NULL)

- {

+ if (response != NULL) {

memcpy(response, Demod.output, Demod.len);

}

memcpy(response, Demod.output, Demod.len);

}

- return Demod.len;

+ LED_A_OFF();

+ return ret;

}

/* Perform the ISO 14443 B Card Selection procedure

}

/* Perform the ISO 14443 B Card Selection procedure

// first, wake up the tag

CodeAndTransmit14443bAsReader(wupb, sizeof(wupb));

// first, wake up the tag

CodeAndTransmit14443bAsReader(wupb, sizeof(wupb));

- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

+ int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

// ATQB too short?

- if (Demod.len < 14)

- {

+ if (ret < 14) {

return 2;

}

return 2;

}

attrib[7] = Demod.output[10] & 0x0F;

ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10);

CodeAndTransmit14443bAsReader(attrib, sizeof(attrib));

attrib[7] = Demod.output[10] & 0x0F;

ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10);

CodeAndTransmit14443bAsReader(attrib, sizeof(attrib));

- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

+ ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

// Answer to ATTRIB too short?

- if(Demod.len < 3)

- {

+ if (ret < 3) {

return 2;

}

// reset PCB block number

return 2;

}

// reset PCB block number

void iso14443b_setup() {

FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

// Set up the synchronous serial port

void iso14443b_setup() {

FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

// Set up the synchronous serial port

- FpgaSetupSsc();

+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

// connect Demodulated Signal to ADC:

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

// Signal field is on with the appropriate LED

LED_D_ON();

// connect Demodulated Signal to ADC:

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

// Signal field is on with the appropriate LED

LED_D_ON();

- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);

-

- // Start the timer

- StartCountSspClk();

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);

DemodReset();

UartReset();

DemodReset();

UartReset();

//-----------------------------------------------------------------------------

void ReadSTMemoryIso14443b(uint32_t dwLast)

{

//-----------------------------------------------------------------------------

void ReadSTMemoryIso14443b(uint32_t dwLast)

{

+ LED_A_ON();

uint8_t i = 0x00;

FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

uint8_t i = 0x00;

FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

SpinDelay(200);

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

SpinDelay(200);

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

- FpgaSetupSsc();

+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

// Now give it time to spin up.

// Signal field is on with the appropriate LED

LED_D_ON();

// Now give it time to spin up.

// Signal field is on with the appropriate LED

LED_D_ON();

- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);

SpinDelay(200);

clear_trace();

SpinDelay(200);

clear_trace();

// First command: wake up the tag using the INITIATE command

uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};

CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

// First command: wake up the tag using the INITIATE command

uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};

CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

+ int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

- if (Demod.len == 0) {

+ if (ret < 0) {

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

DbpString("No response from tag");

+ LEDsoff();

return;

} else {

Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",

return;

} else {

Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",

cmd1[1] = Demod.output[0];

ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);

CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

cmd1[1] = Demod.output[0];

ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);

CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

+ ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

if (Demod.len != 3) {

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);

+ LEDsoff();

return;

}

// Check the CRC of the answer:

ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);

if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {

return;

}

// Check the CRC of the answer:

ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);

if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

DbpString("CRC Error reading select response.");

+ LEDsoff();

return;

}

// Check response from the tag: should be the same UID as the command we just sent:

if (cmd1[1] != Demod.output[0]) {

return;

}

// Check response from the tag: should be the same UID as the command we just sent:

if (cmd1[1] != Demod.output[0]) {

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);

+ LEDsoff();

return;

}

return;

}

cmd1[0] = 0x0B;

ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);

CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one

cmd1[0] = 0x0B;

ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);

CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one

- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

- if (Demod.len != 10) {

+ ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

+ if (ret != 10) {

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);

+ LEDsoff();

return;

}

// The check the CRC of the answer (use cmd1 as temporary variable):

return;

}

// The check the CRC of the answer (use cmd1 as temporary variable):

cmd1[1] = i;

ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);

CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

cmd1[1] = i;

ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);

CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));

- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

- if (Demod.len != 6) { // Check if we got an answer from the tag

+ ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

+ if (ret != 6) { // Check if we got an answer from the tag

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

DbpString("Expected 6 bytes from tag, got less...");

+ LEDsoff();

return;

}

// The check the CRC of the answer (use cmd1 as temporary variable):

ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);

return;

}

// The check the CRC of the answer (use cmd1 as temporary variable):

ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);

- if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {

+ if (cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {

Dbprintf("CRC Error reading block! Expected: %04x got: %04x",

(cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);

// Do not return;, let's go on... (we should retry, maybe ?)

Dbprintf("CRC Error reading block! Expected: %04x got: %04x",

(cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);

// Do not return;, let's go on... (we should retry, maybe ?)

}

i++;

}

i++;

}

+

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

+ LEDsoff();

}

*/

void RAMFUNC SnoopIso14443b(void)

{

*/

void RAMFUNC SnoopIso14443b(void)

{

- // We won't start recording the frames that we acquire until we trigger;

- // a good trigger condition to get started is probably when we see a

- // response from the tag.

- int triggered = true; // TODO: set and evaluate trigger condition

-

+ LED_A_ON();

FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

BigBuf_free();

FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

BigBuf_free();

set_tracing(true);

// The DMA buffer, used to stream samples from the FPGA

set_tracing(true);

// The DMA buffer, used to stream samples from the FPGA

- int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);

+ uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));

int lastRxCounter;

- int8_t *upTo;

- int ci, cq;

+ uint16_t *upTo;

+ int8_t ci, cq;

int maxBehindBy = 0;

// Count of samples received so far, so that we can include timing

int maxBehindBy = 0;

// Count of samples received so far, so that we can include timing

Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);

Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);

Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);

Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);

- // Signal field is off, no reader signal, no tag signal

- LEDsoff();

+ // Signal field is off

+ LED_D_OFF();

// And put the FPGA in the appropriate mode

- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_SUBCARRIER_848_KHZ | FPGA_HF_READER_MODE_SNOOP_IQ);

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

// Setup for the DMA.

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

// Setup for the DMA.

- FpgaSetupSsc();

+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

upTo = dmaBuf;

lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;

FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);

upTo = dmaBuf;

lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;

FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);

- uint8_t parity[MAX_PARITY_SIZE];

bool TagIsActive = false;

bool ReaderIsActive = false;

bool TagIsActive = false;

bool ReaderIsActive = false;

+ // We won't start recording the frames that we acquire until we trigger.

+ // A good trigger condition to get started is probably when we see a

+ // reader command

+ bool triggered = false;

// And now we loop, receiving samples.

for(;;) {

// And now we loop, receiving samples.

for(;;) {

- int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &

- (ISO14443B_DMA_BUFFER_SIZE-1);

+ int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);

if(behindBy > maxBehindBy) {

maxBehindBy = behindBy;

}

if(behindBy > maxBehindBy) {

maxBehindBy = behindBy;

}

- if(behindBy < 2) continue;

+ if(behindBy < 1) continue;

- ci = upTo[0];

- cq = upTo[1];

- upTo += 2;

- lastRxCounter -= 2;

- if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {

- upTo = dmaBuf;

+ ci = *upTo>>8;

+ cq = *upTo;

+ upTo++;

+ lastRxCounter--;

+ if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.

+ upTo = dmaBuf; // start reading the circular buffer from the beginning again

lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;

- AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;

- AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;

- WDT_HIT();

- if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?

- Dbprintf("blew circular buffer! behindBy=%d", behindBy);

- break;

- }

- if(!tracing) {

- DbpString("Reached trace limit");

+ if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) {

+ Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);

break;

}

break;

}

+ }

+ if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.

+ AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and

+ AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers

+ WDT_HIT();

if(BUTTON_PRESS()) {

DbpString("cancelled");

break;

}

if(BUTTON_PRESS()) {

DbpString("cancelled");

break;

}

- samples += 2;

+ samples++;

if (!TagIsActive) { // no need to try decoding reader data if the tag is sending

if(Handle14443bUartBit(ci & 0x01)) {

if (!TagIsActive) { // no need to try decoding reader data if the tag is sending

if(Handle14443bUartBit(ci & 0x01)) {

- if(triggered && tracing) {

- LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, true);

- }

+ triggered = true;

+ LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);

/* And ready to receive another command. */

UartReset();

/* And also reset the demod code, which might have been */

/* And ready to receive another command. */

UartReset();

/* And also reset the demod code, which might have been */

DemodReset();

}

if(Handle14443bUartBit(cq & 0x01)) {

DemodReset();

}

if(Handle14443bUartBit(cq & 0x01)) {

- if(triggered && tracing) {

- LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, true);

- }

+ triggered = true;

+ LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);

/* And ready to receive another command. */

UartReset();

/* And also reset the demod code, which might have been */

/* And ready to receive another command. */

UartReset();

/* And also reset the demod code, which might have been */

ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);

}

ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);

}

- if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time

- if(Handle14443bSamplesDemod(ci | 0x01, cq | 0x01)) {

-

+ if (!ReaderIsActive && triggered) { // no need to try decoding tag data if the reader is sending or not yet triggered

+ if (Handle14443bSamplesDemod(ci/2, cq/2) >= 0) {

//Use samples as a time measurement

- if(tracing)

- {

- uint8_t parity[MAX_PARITY_SIZE];

- LogTrace(Demod.output, Demod.len, samples, samples, parity, false);

- }

- triggered = true;

-

+ LogTrace(Demod.output, Demod.len, samples, samples, NULL, false);

// And ready to receive another response.

DemodReset();

}

// And ready to receive another response.

DemodReset();

}

FpgaDisableSscDma();

}

FpgaDisableSscDma();

- LEDsoff();

- AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;

DbpString("Snoop statistics:");

Dbprintf(" Max behind by: %i", maxBehindBy);

Dbprintf(" Uart State: %x", Uart.state);

Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);

Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);

Dbprintf(" Trace length: %i", BigBuf_get_traceLen());

DbpString("Snoop statistics:");

Dbprintf(" Max behind by: %i", maxBehindBy);

Dbprintf(" Uart State: %x", Uart.state);

Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);

Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);

Dbprintf(" Trace length: %i", BigBuf_get_traceLen());

+ LEDsoff();

}

*/

void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])

{

*/

void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])

{

+ LED_A_ON();

FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

FpgaDownloadAndGo(FPGA_BITSTREAM_HF);

SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

- FpgaSetupSsc();

+

+ // switch field on and give tag some time to power up

+ LED_D_ON();

+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER | FPGA_HF_READER_MODE_SEND_SHALLOW_MOD);

+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER);

+ SpinDelay(10);

if (datalen){

set_tracing(true);

CodeAndTransmit14443bAsReader(data, datalen);

if (datalen){

set_tracing(true);

CodeAndTransmit14443bAsReader(data, datalen);

- if(recv) {

- GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);

+ if (recv) {

+ int ret = GetSamplesFor14443bDemod(5*RECEIVE_SAMPLES_TIMEOUT, true);

+ FpgaDisableTracing();

uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);

- cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);

+ cmd_send(CMD_ACK, ret, 0, 0, Demod.output, iLen);

}

+

+ FpgaDisableTracing();

}

- if(!powerfield) {

+ if (!powerfield) {

FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

LED_D_OFF();

}

FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

LED_D_OFF();

}

+

+ LED_A_OFF();

}