From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Jun 2015 21:02:29 +0000 (+0200)
Subject: Merge branch 'master' of https://github.com/Proxmark/proxmark3
X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/f53020e729d583f7975095ca7b4b467741d99edb?hp=62f0edfb8ea6f6c6a087bb54769dc717b0eeaecb

Merge branch 'master' of https://github.com/Proxmark/proxmark3

Conflicts:
	armsrc/Makefile
	armsrc/iso14443b.c
	armsrc/lfops.c
	client/cmdhf14b.c
	client/cmdhfmfu.c
	fpga/fpga_hf.bit
	fpga/hi_read_rx_xcorr.v
---

diff --git a/armsrc/epa.c b/armsrc/epa.c
index 68061512..8cc0e4b2 100644
--- a/armsrc/epa.c
+++ b/armsrc/epa.c
@@ -127,7 +127,7 @@ size_t EPA_Parse_CardAccess(uint8_t *data,
                             pace_version_info_t *pace_info)
 {
 	size_t index = 0;
-	
+
 	while (index <= length - 2) {
 		// determine type of element
 		// SET or SEQUENCE
@@ -184,7 +184,7 @@ size_t EPA_Parse_CardAccess(uint8_t *data,
 			index += 2 + data[index + 1];
 		}
 	}
-	
+
 	// TODO: We should check whether we reached the end in error, but for that
 	//       we need a better parser (e.g. with states like IN_SET or IN_PACE_INFO)
 	return 0;
@@ -202,7 +202,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
 	// we reserve 262 bytes here just to be safe (256-byte APDU + SW + ISO frame)
 	uint8_t response_apdu[262];
 	int rapdu_length = 0;
-	
+
 	// select the file EF.CardAccess
 	rapdu_length = iso14_apdu((uint8_t *)apdu_select_binary_cardaccess,
 	                          sizeof(apdu_select_binary_cardaccess),
@@ -214,7 +214,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
 		Dbprintf("epa - no select cardaccess");
 		return -1;
 	}
-	
+
 	// read the file
 	rapdu_length = iso14_apdu((uint8_t *)apdu_read_binary,
 	                          sizeof(apdu_read_binary),
@@ -226,7 +226,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
 		Dbprintf("epa - no read cardaccess");
 		return -1;
 	}
-	
+
 	// copy the content into the buffer
 	// length of data available: apdu_length - 4 (ISO frame) - 2 (SW)
 	size_t to_copy = rapdu_length - 6;
@@ -243,7 +243,7 @@ static void EPA_PACE_Collect_Nonce_Abort(uint8_t step, int func_return)
 {
 	// power down the field
 	EPA_Finish();
-	
+
 	// send the USB packet
 	cmd_send(CMD_ACK,step,func_return,0,0,0);
 }
@@ -294,11 +294,11 @@ void EPA_PACE_Collect_Nonce(UsbCommand *c)
 		EPA_PACE_Collect_Nonce_Abort(3, func_return);
 		return;
 	}
-	
+
 	// initiate the PACE protocol
 	// use the CAN for the password since that doesn't change
 	func_return = EPA_PACE_MSE_Set_AT(pace_version_info, 2);
-	
+
 	// now get the nonce
 	uint8_t nonce[256] = {0};
 	uint8_t requested_size = (uint8_t)c->arg[0];
@@ -309,10 +309,10 @@ void EPA_PACE_Collect_Nonce(UsbCommand *c)
 		EPA_PACE_Collect_Nonce_Abort(4, func_return);
 		return;
 	}
-  
-  // all done, return
+
+	// all done, return
 	EPA_Finish();
-	
+
 	// save received information
 	cmd_send(CMD_ACK,0,func_return,0,nonce,func_return);
 }
@@ -335,7 +335,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
 	       sizeof(apdu_general_authenticate_pace_get_nonce));
 	// append Le (requested length + 2 due to tag/length taking 2 bytes) in RAPDU
 	apdu[sizeof(apdu_general_authenticate_pace_get_nonce)] = requested_length + 4;
-	
+
 	// send it
 	uint8_t response_apdu[262];
 	int send_return = iso14_apdu(apdu,
@@ -348,7 +348,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
 	{
 		return -1;
 	}
-	
+
 	// if there is no nonce in the RAPDU, return here
 	if (send_return < 10)
 	{
@@ -363,7 +363,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
 	}
 	// copy the nonce
 	memcpy(nonce, response_apdu + 6, nonce_length);
-	
+
 	return nonce_length;
 }
 
diff --git a/armsrc/iso14443b.c b/armsrc/iso14443b.c
index db2c5479..67e4ccdd 100644
--- a/armsrc/iso14443b.c
+++ b/armsrc/iso14443b.c
@@ -17,6 +17,7 @@
 #include "iso14443crc.h"
 
 #define RECEIVE_SAMPLES_TIMEOUT 2000
+#define ISO14443B_DMA_BUFFER_SIZE 256
 
 //=============================================================================
 // An ISO 14443 Type B tag. We listen for commands from the reader, using
@@ -234,7 +235,7 @@ static RAMFUNC int Handle14443bUartBit(uint8_t bit)
 						Uart.posCnt = 0;
 						Uart.state = STATE_AWAITING_START_BIT;
 					}
-				} else if(Uart.shiftReg == 0x000) {
+				} else if (Uart.shiftReg == 0x000) {
 					// this is an EOF byte
 					LED_A_OFF(); // Finished receiving
 					Uart.state = STATE_UNSYNCD;
@@ -244,7 +245,7 @@ static RAMFUNC int Handle14443bUartBit(uint8_t bit)
 				} else {
 					// this is an error
 					LED_A_OFF();
-				Uart.state = STATE_UNSYNCD;
+					Uart.state = STATE_UNSYNCD;
 				}
 			}
 			break;
@@ -486,8 +487,8 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 {
 	int v;
 
-	// The soft decision on the bit uses an estimate of just the
-	// quadrant of the reference angle, not the exact angle.
+// The soft decision on the bit uses an estimate of just the
+// quadrant of the reference angle, not the exact angle.
 #define MAKE_SOFT_DECISION() { \
 		if(Demod.sumI > 0) { \
 			v = ci; \
@@ -717,16 +718,16 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
 	uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
 	
 	// The DMA buffer, used to stream samples from the FPGA
-	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
+	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
 
 	// Set up the demodulator for tag -> reader responses.
 	DemodInit(receivedResponse);
 
 	// Setup and start DMA.
-	FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
+	FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
 
 	int8_t *upTo = dmaBuf;
-	lastRxCounter = DMA_BUFFER_SIZE;
+	lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
 
 	// Signal field is ON with the appropriate LED:
 	LED_D_ON();
@@ -737,25 +738,25 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
 		int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
 		if(behindBy > max) max = behindBy;
 
-		while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1)) > 2) {
+		while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
 			ci = upTo[0];
 			cq = upTo[1];
 			upTo += 2;
-			if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
+			if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
 				upTo = dmaBuf;
 				AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
-				AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
+				AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
 			}
 			lastRxCounter -= 2;
 			if(lastRxCounter <= 0) {
-				lastRxCounter += DMA_BUFFER_SIZE;
+				lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
 			}
 
 			samples += 2;
 
 			if(Handle14443bSamplesDemod(ci, cq)) {
 				gotFrame = TRUE;
-			break;
+				break;
 		}
 	}
 
@@ -770,7 +771,6 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
 	//Tracing
 	if (tracing && Demod.len > 0) {
 		uint8_t parity[MAX_PARITY_SIZE];
-		//GetParity(Demod.output, Demod.len, parity);
 		LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
 	}
 }
@@ -892,7 +892,6 @@ static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
 	TransmitFor14443b();
 	if (tracing) {
 		uint8_t parity[MAX_PARITY_SIZE];
-		GetParity(cmd, len, parity);
 		LogTrace(cmd,len, 0, 0, parity, TRUE);
 	}
 }
@@ -931,30 +930,25 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 	SpinDelay(200);
 
 	// First command: wake up the tag using the INITIATE command
-	uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
-
+	uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
 	CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-//    LED_A_ON();
 	GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-//    LED_A_OFF();
 
 	if (Demod.len == 0) {
 		DbpString("No response from tag");
 		return;
 	} else {
-		Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %02x %02x %02x",
-		Demod.output[0], Demod.output[1],Demod.output[2]);
+		Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
+				Demod.output[0], Demod.output[1], Demod.output[2]);
 	}
+
 	// There is a response, SELECT the uid
 	DbpString("Now SELECT tag:");
 	cmd1[0] = 0x0E; // 0x0E is SELECT
 	cmd1[1] = Demod.output[0];
 	ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 	CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-
-//    LED_A_ON();
 	GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-//    LED_A_OFF();
 	if (Demod.len != 3) {
 		Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
 		return;
@@ -970,34 +964,30 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 		Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
 		return;
 	}
+
 	// Tag is now selected,
 	// First get the tag's UID:
 	cmd1[0] = 0x0B;
 	ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
 	CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
-
-//    LED_A_ON();
 	GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-//    LED_A_OFF();
 	if (Demod.len != 10) {
 		Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
 		return;
 	}
 	// The check the CRC of the answer (use cmd1 as temporary variable):
 	ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
-   if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
+	if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
 		Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
-		(cmd1[2]<<8)+cmd1[3],
-		(Demod.output[8]<<8)+Demod.output[9]
-		);
+				(cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
 	// Do not return;, let's go on... (we should retry, maybe ?)
 	}
 	Dbprintf("Tag UID (64 bits): %08x %08x",
-		(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
-		(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
+			(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
+			(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
 
 	// Now loop to read all 16 blocks, address from 0 to last block
-	Dbprintf("Tag memory dump, block 0 to %d",dwLast);
+	Dbprintf("Tag memory dump, block 0 to %d", dwLast);
 	cmd1[0] = 0x08;
 	i = 0x00;
 	dwLast++;
@@ -1009,10 +999,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 		cmd1[1] = i;
 		ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 		CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
-
-//	    LED_A_ON();
 		GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-//	    LED_A_OFF();
 		if (Demod.len != 6) { // Check if we got an answer from the tag
 		DbpString("Expected 6 bytes from tag, got less...");
 		return;
@@ -1020,15 +1007,13 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
 		// The check the CRC of the answer (use cmd1 as temporary variable):
 		ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
 			if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
-				Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
-					(cmd1[2]<<8)+cmd1[3],
-					(Demod.output[4]<<8)+Demod.output[5]
-				);
+			Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
+					(cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
 		// Do not return;, let's go on... (we should retry, maybe ?)
 		}
 		// Now print out the memory location:
 		Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
-			(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
+				(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
 			(Demod.output[4]<<8)+Demod.output[5]
 		);
 		if (i == 0xff) break;
@@ -1051,7 +1036,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
  * Memory usage for this function, (within BigBuf)
  * Last Received command (reader->tag) - MAX_FRAME_SIZE
  * Last Received command (tag->reader) - MAX_FRAME_SIZE
- * DMA Buffer - DMA_BUFFER_SIZE
+ * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
  * Demodulated samples received - all the rest
  */
 void RAMFUNC SnoopIso14443b(void)
@@ -1068,7 +1053,7 @@ void RAMFUNC SnoopIso14443b(void)
 	set_tracing(TRUE);
 
 	// The DMA buffer, used to stream samples from the FPGA
-	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
+	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
 	int lastRxCounter;
 	int8_t *upTo;
 	int ci, cq;
@@ -1086,7 +1071,7 @@ void RAMFUNC SnoopIso14443b(void)
 	Dbprintf("  Trace: %i bytes", BigBuf_max_traceLen());
 	Dbprintf("  Reader -> tag: %i bytes", MAX_FRAME_SIZE);
 	Dbprintf("  tag -> Reader: %i bytes", MAX_FRAME_SIZE);
-	Dbprintf("  DMA: %i bytes", DMA_BUFFER_SIZE);
+	Dbprintf("  DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
 
 	// Signal field is off, no reader signal, no tag signal
 	LEDsoff();
@@ -1098,9 +1083,12 @@ void RAMFUNC SnoopIso14443b(void)
 	// Setup for the DMA.
 	FpgaSetupSsc();
 	upTo = dmaBuf;
-	lastRxCounter = DMA_BUFFER_SIZE;
-	FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
+	lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
+	FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
 	uint8_t parity[MAX_PARITY_SIZE];
+
+	bool TagIsActive = FALSE;
+	bool ReaderIsActive = FALSE;
 		
 	bool TagIsActive = FALSE;
 	bool ReaderIsActive = FALSE;
@@ -1108,7 +1096,7 @@ void RAMFUNC SnoopIso14443b(void)
 	// And now we loop, receiving samples.
 	for(;;) {
 		int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
-								(DMA_BUFFER_SIZE-1);
+								(ISO14443B_DMA_BUFFER_SIZE-1);
 		if(behindBy > maxBehindBy) {
 			maxBehindBy = behindBy;
 		}
@@ -1119,11 +1107,15 @@ void RAMFUNC SnoopIso14443b(void)
 		cq = upTo[1];
 		upTo += 2;
 		lastRxCounter -= 2;
-		if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
+		if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
 			upTo = dmaBuf;
-			lastRxCounter += DMA_BUFFER_SIZE;
+			lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
 			AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
-			AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
+			AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
+			WDT_HIT();
+			if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
+				Dbprintf("blew circular buffer! behindBy=%d", behindBy);
+				break;
 			WDT_HIT();
 			if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
 				Dbprintf("blew circular buffer! behindBy=%d", behindBy);
@@ -1144,8 +1136,7 @@ void RAMFUNC SnoopIso14443b(void)
 		if (!TagIsActive) {							// no need to try decoding reader data if the tag is sending
 			if(Handle14443bUartBit(ci & 0x01)) {
 			if(triggered && tracing) {
-					//GetParity(Uart.output, Uart.byteCnt, parity);
-				LogTrace(Uart.output,Uart.byteCnt,samples, samples,parity,TRUE);
+					LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
 			}
 			/* And ready to receive another command. */
 			UartReset();
@@ -1155,8 +1146,7 @@ void RAMFUNC SnoopIso14443b(void)
 		}
 			if(Handle14443bUartBit(cq & 0x01)) {
 			if(triggered && tracing) {
-					//GetParity(Uart.output, Uart.byteCnt, parity);
-				LogTrace(Uart.output,Uart.byteCnt,samples, samples, parity, TRUE);
+					LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
 			}
 			/* And ready to receive another command. */
 			UartReset();
@@ -1174,8 +1164,7 @@ void RAMFUNC SnoopIso14443b(void)
 			if(tracing)
 			{
 				uint8_t parity[MAX_PARITY_SIZE];
-					//GetParity(Demod.output, Demod.len, parity);
-				LogTrace(Demod.output, Demod.len,samples, samples, parity, FALSE);
+					LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE);
 			}
 			triggered = TRUE;
 
@@ -1217,30 +1206,14 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 	FpgaSetupSsc();
 
-		set_tracing(TRUE);
+	set_tracing(TRUE);
 	
-/* 	if(!powerfield) {
-		// Make sure that we start from off, since the tags are stateful;
-		// confusing things will happen if we don't reset them between reads.
-		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-		LED_D_OFF();
-		SpinDelay(200);
-	}
- */
-
-	// if(!GETBIT(GPIO_LED_D))	{	// if field is off
-		// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
-		// // Signal field is on with the appropriate LED
-		// LED_D_ON();
-		// SpinDelay(200);
-	// }
-
 	CodeAndTransmit14443bAsReader(data, datalen);
 
 	if(recv) {
 		GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
-		uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);
-		cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);
+		uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
+		cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
 	}
 	
 	if(!powerfield) {
diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index c26d063b..1b3e8e30 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -1043,10 +1043,10 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
  * To compensate antenna falling times shorten the write times
  * and enlarge the gap ones.
  */
-#define START_GAP 31*8 // was 250 // SPEC:   8 - 50fc [15fc]
-#define WRITE_GAP 20*8 // was 160 // SPEC:   8 - 20fc [10fc]
-#define WRITE_0   18*8 // was 144 // SPEC:  16 - 32fc [24fc]  192
-#define WRITE_1   50*8 // was 400 // SPEC:  48 - 64fc [56fc]  432 for T55x7; 448 for E5550
+#define START_GAP 31*8 // was 250 // SPEC:  1*8 to 50*8 - typ 15*8 (or 15fc)
+#define WRITE_GAP 20*8 // was 160 // SPEC:  1*8 to 20*8 - typ 10*8 (or 10fc)
+#define WRITE_0   18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
+#define WRITE_1   50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc)  432 for T55x7; 448 for E5550
 
 //  VALUES TAKEN FROM EM4x function: SendForward
 //  START_GAP = 440;       (55*8) cycles at 125Khz (8us = 1cycle)
diff --git a/client/cmddata.c b/client/cmddata.c
index bc88d883..4eca030d 100644
--- a/client/cmddata.c
+++ b/client/cmddata.c
@@ -1561,7 +1561,7 @@ int PSKDemod(const char *Cmd, bool verbose)
 	}
 	uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
 	size_t BitLen = getFromGraphBuf(BitStream);
-	if (BitLen==0) return -1;
+	if (BitLen==0) return 0;
 	uint8_t carrier=countFC(BitStream, BitLen, 0);
 	if (carrier!=2 && carrier!=4 && carrier!=8){
 		//invalid carrier
diff --git a/client/cmdhf14b.c b/client/cmdhf14b.c
index 0144111e..f9b1313b 100644
--- a/client/cmdhf14b.c
+++ b/client/cmdhf14b.c
@@ -35,16 +35,14 @@ int CmdHF14BList(const char *Cmd)
 
 int CmdHF14BSim(const char *Cmd)
 {
-	UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
-	clearCommandBuffer();
+  UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
 	SendCommand(&c);
 	return 0;
 }
 
 int CmdHF14BSnoop(const char *Cmd)
 {
-	UsbCommand c = {CMD_SNOOP_ISO_14443B};
-	clearCommandBuffer();
+  UsbCommand c = {CMD_SNOOP_ISO_14443B};
 	SendCommand(&c);
 	return 0;
 }
@@ -246,109 +244,38 @@ char *get_ST_Chip_Model(uint8_t data){
 		case 0xC: sprintf(retStr, "SRT512"); break;
 		default: sprintf(retStr, "Unknown"); break;
 	}
-	return retStr;
-}
-
-static void print_st_info(uint8_t *data){
-	//uid = first 8 bytes in data
-	PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
-	PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
-	PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
-	return;
-}
-
-int HF14BStdReader(uint8_t *data, uint8_t *datalen){
-
-	//05 00 00 = find one tag in field
-	//1d xx xx xx xx 20 00 08 01 00 = attrib xx=crc
-	//a3 = ?  (resp 03 e2 c2)
-	//02 = ?  (resp 02 6a d3)
-	// 022b (resp 02 67 00 [29  5b])
-	// 0200a40400 (resp 02 67 00 [29 5b])
-	// 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
-	// 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
-	// 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
-	// 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
-	// 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
-	// 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
-	// 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
-	//03 = ?  (resp 03 [e3 c2])
-	//c2 = ?  (resp c2 [66 15])
-	//b2 = ?  (resp a3 [e9 67])
-	bool crc = true;
-	*datalen = 3;
-	//std read cmd
-	data[0] = 0x05;
-	data[1] = 0x00;
-	data[2] = 0x00;
-
-	if (HF14BCmdRaw(true, &crc, false, data, datalen, false)==0) return 0;
-
-	if (data[0] != 0x50  || *datalen != 14 || !crc) return 0;
-
-	PrintAndLog ("\n14443-3b tag found:");
-	print_atqb_resp(data);
-
-	return 1;
+    
+    c.arg[0] = datalen;
+    c.arg[1] = reply;
+    c.arg[2] = power;
+    memcpy(c.d.asBytes,data,datalen);
+    
+    SendCommand(&c);
+    
+    if (reply) {
+        if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
+            recv = resp.d.asBytes;
+            PrintAndLog("received %i octets",resp.arg[0]);
+            if(resp.arg[0] == 0)
+                return 0;
+            hexout = (char *)malloc(resp.arg[0] * 3 + 1);
+            if (hexout != NULL) {
+                uint8_t first, second;
+                for (int i = 0; i < resp.arg[0]; i++) { // data in hex
+                    sprintf(&hexout[i * 3], "%02X ", recv[i]);
 	}
-
-int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){
-	bool crc = true;
-	*datalen = 2;
-	//wake cmd
-	data[0] = 0x06;
-	data[1] = 0x00;
-
-	//leave power on
-	// verbose on for now for testing - turn off when functional
-	if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
-
-	if (*datalen != 3 || !crc) return rawClose();
-
-	uint8_t chipID = data[0];
-	// select
-	data[0] = 0x0E;
-	data[1] = chipID;
-	*datalen = 2;
-
-	//leave power on
-	// verbose on for now for testing - turn off when functional
-	if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
-
-	if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
-
-	// get uid
-	data[0] = 0x0B;
-	*datalen = 1;
-
-	//power off
-	// verbose on for now for testing - turn off when functional
-	if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0;
-	rawClose();
-	if (*datalen != 10 || !crc) return 0;
-
-	PrintAndLog("\n14443-3b ST tag found:");
-	print_st_info(data);
-	return 1;
-}
-
-// test for other 14b type tags (mimic another reader - don't have tags to identify)
-int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
-	bool crc = true;
-	*datalen = 4;
-	//std read cmd
-	data[0] = 0x00;
-	data[1] = 0x0b;
-	data[2] = 0x3f;
-	data[3] = 0x80;
-
-	if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
-		if (*datalen > 2 || !crc) {
-			PrintAndLog ("\n14443-3b tag found:");
-			PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
-			PrintAndLog ("%s",sprint_hex(data,*datalen));
-			return 1;
-		}
+                PrintAndLog("%s", hexout);
+                free(hexout);
+				if (resp.arg[0] > 2) {
+					ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);
+					if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {
+						PrintAndLog("CRC OK");
+					} else {
+						PrintAndLog("CRC failed");
+					}
+                }
+            } else {
+                PrintAndLog("malloc failed your client has low memory?");
 	}
 
 	crc = false;
@@ -474,10 +401,8 @@ static command_t CommandTable[] =
 {
 	{"help",        CmdHelp,        1, "This help"},
 	{"list",        CmdHF14BList,   0, "[Deprecated] List ISO 14443b history"},
-	{"reader",      CmdHF14BReader, 0, "Find 14b tag (HF ISO 14443b)"},
-	{"sim",         CmdHF14BSim,     0, "Fake ISO 14443B tag"},
-
-	{"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
+  {"sim",         CmdHF14BSim,    0, "Fake ISO 14443B tag"},
+  {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
 	{"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 	{"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 	{"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
diff --git a/client/cmdhfepa.c b/client/cmdhfepa.c
index 44a539c8..e9c63f20 100644
--- a/client/cmdhfepa.c
+++ b/client/cmdhfepa.c
@@ -29,9 +29,9 @@ int CmdHFEPACollectPACENonces(const char *Cmd)
 	unsigned int n = 0;
 	// delay between requests
 	unsigned int d = 0;
-	
+
 	sscanf(Cmd, "%u %u %u", &m, &n, &d);
-	
+
 	// values are expected to be > 0
 	m = m > 0 ? m : 1;
 	n = n > 0 ? n : 1;
@@ -44,7 +44,7 @@ int CmdHFEPACollectPACENonces(const char *Cmd)
 		UsbCommand c = {CMD_EPA_PACE_COLLECT_NONCE, {(int)m, 0, 0}};
 		SendCommand(&c);
 		UsbCommand resp;
-    
+
 		WaitForResponse(CMD_ACK,&resp);
 
 		// check if command failed
@@ -178,7 +178,7 @@ int CmdHFEPAPACEReplay(const char *Cmd)
 
 // UI-related stuff
 
-static const command_t CommandTable[] = 
+static const command_t CommandTable[] =
 {
   {"help",    CmdHelp,                   1, "This help"},
   {"cnonces", CmdHFEPACollectPACENonces, 0,
diff --git a/client/cmdhfmfu.c b/client/cmdhfmfu.c
index cf21a9bf..3b577061 100644
--- a/client/cmdhfmfu.c
+++ b/client/cmdhfmfu.c
@@ -272,7 +272,7 @@ static int ulev1_readSignature( uint8_t *response, uint16_t responseLength ){
 //  send 300000 + crc (read with extra byte(s))
 //  UL responds with read of page 0, fudan doesn't respond.
 //
-//make sure field is off before calling this function
+// make sure field is off before calling this function
 static int ul_fudan_check( void ){
 	iso14a_card_select_t card;
 	if ( !ul_select(&card) ) 
@@ -892,7 +892,7 @@ int CmdHF14AMfUWrBl(const char *Cmd){
 	uint8_t data[16] = {0x00};
 	uint8_t authenticationkey[16] = {0x00};
 	uint8_t *authKeyPtr = authenticationkey;
-	
+
 	while(param_getchar(Cmd, cmdp) != 0x00)
 	{
 		switch(param_getchar(Cmd, cmdp))
@@ -967,7 +967,7 @@ int CmdHF14AMfUWrBl(const char *Cmd){
 		PrintAndLog("block number too large. Max block is %u/0x%02X \n", maxblockno,maxblockno);
 		return usage_hf_mfu_wrbl();
 	}
-	
+
 	// Swap endianness 
 	if (swapEndian && hasAuthKey) authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
 	if (swapEndian && hasPwdKey)  authKeyPtr = SwapEndian64(authenticationkey, 4, 4);
@@ -1083,7 +1083,7 @@ int CmdHF14AMfURdBl(const char *Cmd){
 		PrintAndLog("block number to large. Max block is %u/0x%02X \n", maxblockno,maxblockno);
 		return usage_hf_mfu_rdbl();
 	}
-	
+
 	// Swap endianness 
 	if (swapEndian && hasAuthKey) authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
 	if (swapEndian && hasPwdKey)  authKeyPtr = SwapEndian64(authenticationkey, 4, 4);
diff --git a/client/hid-flasher/usb_cmd.h b/client/hid-flasher/usb_cmd.h
index 1881b561..19aa28c2 100644
--- a/client/hid-flasher/usb_cmd.h
+++ b/client/hid-flasher/usb_cmd.h
@@ -89,7 +89,6 @@ typedef struct {
 
 // For the 13.56 MHz tags
 #define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693                             0x0300
-#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443                             0x0301
 #define CMD_READ_SRI512_TAG                                               0x0303
 #define CMD_READ_SRIX4K_TAG                                               0x0304
 #define CMD_READER_ISO_15693                                              0x0310
@@ -105,9 +104,8 @@ typedef struct {
 #define CMD_SIMULATE_HITAG                                                0x0371
 #define CMD_READER_HITAG                                                  0x0372
 
-#define CMD_SIMULATE_TAG_HF_LISTEN                                        0x0380
-#define CMD_SIMULATE_TAG_ISO_14443                                        0x0381
-#define CMD_SNOOP_ISO_14443                                               0x0382
+#define CMD_SIMULATE_TAG_ISO_14443B                                       0x0381
+#define CMD_SNOOP_ISO_14443B                                              0x0382
 #define CMD_SNOOP_ISO_14443a                                              0x0383
 #define CMD_SIMULATE_TAG_ISO_14443a                                       0x0384
 #define CMD_READER_ISO_14443a                                             0x0385
diff --git a/fpga/fpga_hf.bit b/fpga/fpga_hf.bit
index a4d72e37..50c7eef9 100644
Binary files a/fpga/fpga_hf.bit and b/fpga/fpga_hf.bit differ
diff --git a/fpga/hi_read_rx_xcorr.v b/fpga/hi_read_rx_xcorr.v
index f816199e..afaf7cb6 100644
--- a/fpga/hi_read_rx_xcorr.v
+++ b/fpga/hi_read_rx_xcorr.v
@@ -88,7 +88,7 @@ begin
     // These are the correlators: we correlate against in-phase and quadrature
     // versions of our reference signal, and keep the (signed) result to
     // send out later over the SSP.
-    if(corr_i_cnt == 7'd0)
+    if(corr_i_cnt == 6'd0)
     begin
         if(snoop)
         begin
@@ -123,7 +123,7 @@ begin
 
     // The logic in hi_simulate.v reports 4 samples per bit. We report two
     // (I, Q) pairs per bit, so we should do 2 samples per pair.
-    if(corr_i_cnt == 6'd31)
+    if(corr_i_cnt == 6'd32)
         after_hysteresis_prev <= after_hysteresis;
 
     // Then the result from last time is serialized and send out to the ARM.