#include "iso14443crc.h"
#define RECEIVE_SAMPLES_TIMEOUT 2000
+#define ISO14443B_DMA_BUFFER_SIZE 256
//=============================================================================
// An ISO 14443 Type B tag. We listen for commands from the reader, using
LED_A_OFF(); // Finished receiving
Uart.state = STATE_UNSYNCD;
if (Uart.byteCnt != 0) {
- return TRUE;
+ return TRUE;
}
} else {
// this is an error
0x00, 0x21, 0x85, 0x5e, 0xd7
};
+ uint8_t parity[MAX_PARITY_SIZE];
+
+ FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+
clear_trace();
set_tracing(TRUE);
uint16_t len;
uint16_t cmdsRecvd = 0;
- FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
-
// prepare the (only one) tag answer:
CodeIso14443bAsTag(response1, sizeof(response1));
uint8_t *resp1Code = BigBuf_malloc(ToSendMax);
for(;;) {
if(!GetIso14443bCommandFromReader(receivedCmd, &len)) {
- Dbprintf("button pressed, received %d commands", cmdsRecvd);
- break;
+ Dbprintf("button pressed, received %d commands", cmdsRecvd);
+ break;
}
if (tracing) {
- uint8_t parity[MAX_PARITY_SIZE];
LogTrace(receivedCmd, len, 0, 0, parity, TRUE);
}
AT91C_BASE_SSC->SSC_THR = 0xff;
FpgaSetupSsc();
+ uint8_t c;
+ // clear receiving shift register and holding register
+ while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
+ c = AT91C_BASE_SSC->SSC_RHR; (void) c;
+ while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
+ c = AT91C_BASE_SSC->SSC_RHR; (void) c;
+
+ // Clear TXRDY:
+ AT91C_BASE_SSC->SSC_THR = 0x00;
+
// Transmit the response.
+ uint16_t FpgaSendQueueDelay = 0;
uint16_t i = 0;
- for(;;) {
+ for(;i < respCodeLen; ) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
- uint8_t b = respCode[i];
-
- AT91C_BASE_SSC->SSC_THR = b;
-
- i++;
- if(i > respCodeLen) {
- break;
- }
+ AT91C_BASE_SSC->SSC_THR = respCode[i++];
+ FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
}
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
- (void)b;
+ if(BUTTON_PRESS()) break;
+ }
+
+ // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
+ uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3;
+ for (i = 0; i <= fpga_queued_bits/8 + 1; ) {
+ if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+ AT91C_BASE_SSC->SSC_THR = 0x00;
+ FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+ i++;
}
}
// trace the response:
- if (tracing) {
- uint8_t parity[MAX_PARITY_SIZE];
- LogTrace(resp, respLen, 0, 0, parity, FALSE);
- }
-
+ if (tracing) LogTrace(resp, respLen, 0, 0, parity, FALSE);
}
+ //FpgaDisableSscDma();
}
//=============================================================================
Demod.sumI = ci;
Demod.sumQ = cq;
Demod.posCount = 1;
- }
+ }
break;
case DEMOD_PHASE_REF_TRAINING:
if (v > SUBCARRIER_DETECT_THRESHOLD) {
// set the reference phase (will code a logic '1') by averaging over 32 1/fs.
// note: synchronization time > 80 1/fs
- Demod.sumI += ci;
- Demod.sumQ += cq;
+ Demod.sumI += ci;
+ Demod.sumQ += cq;
Demod.posCount++;
} else { // subcarrier lost
- Demod.state = DEMOD_UNSYNCD;
+ Demod.state = DEMOD_UNSYNCD;
}
} else {
- Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
+ Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
}
break;
LED_C_OFF();
if(s == 0x000) {
// This is EOF (start, stop and all data bits == '0'
- return TRUE;
+ return TRUE;
}
}
}
BigBuf_free();
// The response (tag -> reader) that we're receiving.
- uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
+ uint8_t *resp = BigBuf_malloc(MAX_FRAME_SIZE);
// The DMA buffer, used to stream samples from the FPGA
- int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
+ int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
// Set up the demodulator for tag -> reader responses.
- DemodInit(receivedResponse);
+ DemodInit(resp);
// Setup and start DMA.
- FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
+ FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
int8_t *upTo = dmaBuf;
- lastRxCounter = DMA_BUFFER_SIZE;
+ lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
// Signal field is ON with the appropriate LED:
LED_D_ON();
// And put the FPGA in the appropriate mode
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
+ SpinDelayUs(151); // T0 time between reader send, tag answer. 151us.
for(;;) {
int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
if(behindBy > max) max = behindBy;
- while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1)) > 2) {
+ while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
ci = upTo[0];
cq = upTo[1];
upTo += 2;
- if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
+ if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
upTo = dmaBuf;
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
- AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
+ AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
}
lastRxCounter -= 2;
if(lastRxCounter <= 0) {
- lastRxCounter += DMA_BUFFER_SIZE;
+ lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
}
samples += 2;
if(Handle14443bSamplesDemod(ci, cq)) {
gotFrame = TRUE;
break;
- }
}
+ }
if(samples > n || gotFrame) {
break;
//Tracing
if (tracing && Demod.len > 0) {
uint8_t parity[MAX_PARITY_SIZE];
- //GetParity(Demod.output, Demod.len, parity);
LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
}
}
TransmitFor14443b();
if (tracing) {
uint8_t parity[MAX_PARITY_SIZE];
- GetParity(cmd, len, parity);
LogTrace(cmd,len, 0, 0, parity, TRUE);
}
}
//-----------------------------------------------------------------------------
void ReadSTMemoryIso14443b(uint32_t dwLast)
{
+ FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+ BigBuf_free();
+
clear_trace();
set_tracing(TRUE);
uint8_t i = 0x00;
- FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
// Make sure that we start from off, since the tags are stateful;
// confusing things will happen if we don't reset them between reads.
LED_D_OFF();
// Now give it time to spin up.
// Signal field is on with the appropriate LED
LED_D_ON();
- FpgaWriteConfWord(
- FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
SpinDelay(200);
// First command: wake up the tag using the INITIATE command
uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
-
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-// LED_A_ON();
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-// LED_A_OFF();
if (Demod.len == 0) {
- DbpString("No response from tag");
- return;
+ DbpString("No response from tag");
+ return;
} else {
- Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %02x %02x %02x",
- Demod.output[0], Demod.output[1], Demod.output[2]);
+ Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
+ Demod.output[0], Demod.output[1], Demod.output[2]);
}
+
// There is a response, SELECT the uid
DbpString("Now SELECT tag:");
cmd1[0] = 0x0E; // 0x0E is SELECT
cmd1[1] = Demod.output[0];
ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-
-// LED_A_ON();
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-// LED_A_OFF();
if (Demod.len != 3) {
Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
return;
Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
return;
}
+
// Tag is now selected,
// First get the tag's UID:
cmd1[0] = 0x0B;
ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
-
-// LED_A_ON();
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-// LED_A_OFF();
if (Demod.len != 10) {
Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
return;
ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
- (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
- // Do not return;, let's go on... (we should retry, maybe ?)
+ (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
+ // Do not return;, let's go on... (we should retry, maybe ?)
}
Dbprintf("Tag UID (64 bits): %08x %08x",
- (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
- (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
+ (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
+ (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
// Now loop to read all 16 blocks, address from 0 to last block
Dbprintf("Tag memory dump, block 0 to %d", dwLast);
i = 0x00;
dwLast++;
for (;;) {
- if (i == dwLast) {
+ if (i == dwLast) {
DbpString("System area block (0xff):");
i = 0xff;
}
cmd1[1] = i;
ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-
-// LED_A_ON();
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-// LED_A_OFF();
if (Demod.len != 6) { // Check if we got an answer from the tag
- DbpString("Expected 6 bytes from tag, got less...");
- return;
+ DbpString("Expected 6 bytes from tag, got less...");
+ return;
}
// The check the CRC of the answer (use cmd1 as temporary variable):
ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
- if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
+ if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
- (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
- // Do not return;, let's go on... (we should retry, maybe ?)
+ (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
+ // Do not return;, let's go on... (we should retry, maybe ?)
}
// Now print out the memory location:
Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
- (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
- (Demod.output[4]<<8)+Demod.output[5]);
+ (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
+ (Demod.output[4]<<8)+Demod.output[5]);
if (i == 0xff) {
break;
}
* Memory usage for this function, (within BigBuf)
* Last Received command (reader->tag) - MAX_FRAME_SIZE
* Last Received command (tag->reader) - MAX_FRAME_SIZE
- * DMA Buffer - DMA_BUFFER_SIZE
+ * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
* Demodulated samples received - all the rest
*/
void RAMFUNC SnoopIso14443b(void)
set_tracing(TRUE);
// The DMA buffer, used to stream samples from the FPGA
- int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
+ int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
int lastRxCounter;
int8_t *upTo;
int ci, cq;
Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
- Dbprintf(" DMA: %i bytes", DMA_BUFFER_SIZE);
+ Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
// Signal field is off, no reader signal, no tag signal
LEDsoff();
// Setup for the DMA.
FpgaSetupSsc();
upTo = dmaBuf;
- lastRxCounter = DMA_BUFFER_SIZE;
- FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
+ lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
+ FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
uint8_t parity[MAX_PARITY_SIZE];
bool TagIsActive = FALSE;
bool ReaderIsActive = FALSE;
-
+
// And now we loop, receiving samples.
for(;;) {
int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
- (DMA_BUFFER_SIZE-1);
+ (ISO14443B_DMA_BUFFER_SIZE-1);
if(behindBy > maxBehindBy) {
maxBehindBy = behindBy;
}
cq = upTo[1];
upTo += 2;
lastRxCounter -= 2;
- if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
+ if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
upTo = dmaBuf;
- lastRxCounter += DMA_BUFFER_SIZE;
+ lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
- AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
+ AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
WDT_HIT();
- if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
+ if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
Dbprintf("blew circular buffer! behindBy=%d", behindBy);
break;
}
if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
if(Handle14443bUartBit(ci & 0x01)) {
- if(triggered && tracing) {
- //GetParity(Uart.output, Uart.byteCnt, parity);
+ if(triggered && tracing) {
LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
- }
- /* And ready to receive another command. */
- UartReset();
- /* And also reset the demod code, which might have been */
- /* false-triggered by the commands from the reader. */
- DemodReset();
}
+ /* And ready to receive another command. */
+ UartReset();
+ /* And also reset the demod code, which might have been */
+ /* false-triggered by the commands from the reader. */
+ DemodReset();
+ }
if(Handle14443bUartBit(cq & 0x01)) {
- if(triggered && tracing) {
- //GetParity(Uart.output, Uart.byteCnt, parity);
+ if(triggered && tracing) {
LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
- }
- /* And ready to receive another command. */
- UartReset();
- /* And also reset the demod code, which might have been */
- /* false-triggered by the commands from the reader. */
- DemodReset();
}
+ /* And ready to receive another command. */
+ UartReset();
+ /* And also reset the demod code, which might have been */
+ /* false-triggered by the commands from the reader. */
+ DemodReset();
+ }
ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);
}
if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
if(Handle14443bSamplesDemod(ci | 0x01, cq | 0x01)) {
- //Use samples as a time measurement
- if(tracing)
- {
- uint8_t parity[MAX_PARITY_SIZE];
- //GetParity(Demod.output, Demod.len, parity);
- LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE);
- }
- triggered = TRUE;
-
- // And ready to receive another response.
- DemodReset();
+ //Use samples as a time measurement
+ if(tracing)
+ {
+ //uint8_t parity[MAX_PARITY_SIZE];
+ LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE);
}
+ triggered = TRUE;
+
+ // And ready to receive another response.
+ DemodReset();
+ }
TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF);
}
void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])
{
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+ BigBuf_free();
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
FpgaSetupSsc();
- set_tracing(TRUE);
-
-/* if(!powerfield) {
- // Make sure that we start from off, since the tags are stateful;
- // confusing things will happen if we don't reset them between reads.
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
- LED_D_OFF();
- SpinDelay(200);
+ if ( datalen == 0 && recv == 0 && powerfield == 0){
+ clear_trace();
+ } else {
+ set_tracing(TRUE);
+ CodeAndTransmit14443bAsReader(data, datalen);
}
- */
-
- // if(!GETBIT(GPIO_LED_D)) { // if field is off
- // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
- // // Signal field is on with the appropriate LED
- // LED_D_ON();
- // SpinDelay(200);
- // }
-
- CodeAndTransmit14443bAsReader(data, datalen);
if(recv) {
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
}
+
+ FpgaDisableSscDma();
}
projects / proxmark3-svn / blobdiff