From 22e2470051913380bbfa50b0ef9b7ad999364cdc Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sun, 21 Jun 2015 11:07:05 +0200 Subject: [PATCH] ADD: @marshmellow42 fudan detection in hf mfu ADD: @marshmellow42 14b reader changes. ADD: @pwpiwi 14b fixes --- armsrc/appmain.c | 67 +---- armsrc/iso14443b.c | 131 +++++----- client/cmdhf.c | 20 +- client/cmdhf14b.c | 509 +++++++++++++++--------------------- client/cmdhf14b.h | 7 +- client/cmdhfmfu.c | 41 ++- client/cmdhfmfu.h | 3 +- client/lualibs/commands.lua | 6 +- cp2tau | 4 - fpga/fpga_hf.bit | Bin 42175 -> 42175 bytes fpga/fpga_hf.v | 5 +- fpga/hi_read_rx_xcorr.v | 76 ++---- include/mifare.h | 2 +- include/usb_cmd.h | 7 +- 14 files changed, 356 insertions(+), 522 deletions(-) delete mode 100644 cp2tau diff --git a/armsrc/appmain.c b/armsrc/appmain.c index c7061aab..9db69f0c 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -18,12 +18,13 @@ #include "util.h" #include "printf.h" #include "string.h" + #include + #include "legicrf.h" #include #include "lfsampling.h" #include "BigBuf.h" - #ifdef WITH_LCD #include "LCD.h" #endif @@ -249,55 +250,6 @@ void MeasureAntennaTuningHf(void) } -void SimulateTagHfListen(void) -{ - // ToDo: historically this used the free buffer, which was 2744 Bytes long. - // There might be a better size to be defined: - #define HF_14B_SNOOP_BUFFER_SIZE 2744 - uint8_t *dest = BigBuf_malloc(HF_14B_SNOOP_BUFFER_SIZE); - uint8_t v = 0; - int i; - int p = 0; - - // We're using this mode just so that I can test it out; the simulated - // tag mode would work just as well and be simpler. - FpgaDownloadAndGo(FPGA_BITSTREAM_HF); - FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP); - - // We need to listen to the high-frequency, peak-detected path. - SetAdcMuxFor(GPIO_MUXSEL_HIPKD); - - FpgaSetupSsc(); - - i = 0; - for(;;) { - if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { - AT91C_BASE_SSC->SSC_THR = 0xff; - } - if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { - uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR; - - v <<= 1; - if(r & 1) { - v |= 1; - } - p++; - - if(p >= 8) { - dest[i] = v; - v = 0; - p = 0; - i++; - - if(i >= HF_14B_SNOOP_BUFFER_SIZE) { - break; - } - } - } - } - DbpString("simulate tag (now type bitsamples)"); -} - void ReadMem(int addr) { const uint8_t *data = ((uint8_t *)addr); @@ -781,19 +733,16 @@ void UsbPacketReceived(uint8_t *packet, int len) #endif #ifdef WITH_ISO14443b - case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443: - AcquireRawAdcSamplesIso14443b(c->arg[0]); - break; case CMD_READ_SRI512_TAG: ReadSTMemoryIso14443b(0x0F); break; case CMD_READ_SRIX4K_TAG: ReadSTMemoryIso14443b(0x7F); break; - case CMD_SNOOP_ISO_14443: + case CMD_SNOOP_ISO_14443B: SnoopIso14443b(); break; - case CMD_SIMULATE_TAG_ISO_14443: + case CMD_SIMULATE_TAG_ISO_14443B: SimulateIso14443bTag(); break; case CMD_ISO_14443B_COMMAND: @@ -816,10 +765,6 @@ void UsbPacketReceived(uint8_t *packet, int len) EPA_PACE_Collect_Nonce(c); break; - // case CMD_EPA_: - // EpaFoo(c); - // break; - case CMD_READER_MIFARE: ReaderMifare(c->arg[0]); break; @@ -936,10 +881,6 @@ void UsbPacketReceived(uint8_t *packet, int len) break; #endif - case CMD_SIMULATE_TAG_HF_LISTEN: - SimulateTagHfListen(); - break; - case CMD_BUFF_CLEAR: BigBuf_Clear(); break; diff --git a/armsrc/iso14443b.c b/armsrc/iso14443b.c index 160ec1ec..53f7e74d 100644 --- a/armsrc/iso14443b.c +++ b/armsrc/iso14443b.c @@ -17,7 +17,6 @@ #include "iso14443crc.h" #define RECEIVE_SAMPLES_TIMEOUT 2000 -#define ISO14443B_DMA_BUFFER_SIZE 512 //============================================================================= // An ISO 14443 Type B tag. We listen for commands from the reader, using @@ -238,7 +237,11 @@ static int Handle14443bUartBit(int bit) } else if(Uart.shiftReg == 0x000) { // this is an EOF byte LED_A_OFF(); // Finished receiving + if (Uart.byteCnt != 0) { return TRUE; + } + Uart.posCnt = 0; + Uart.state = STATE_ERROR_WAIT; } else { // this is an error Uart.posCnt = 0; @@ -715,38 +718,38 @@ static void GetSamplesFor14443bDemod(int n, bool quiet) uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE); // The DMA buffer, used to stream samples from the FPGA - int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); + int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE); // Set up the demodulator for tag -> reader responses. DemodInit(receivedResponse); // Setup and start DMA. - FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE); + FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE); int8_t *upTo = dmaBuf; - lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; + lastRxCounter = DMA_BUFFER_SIZE; // Signal field is ON with the appropriate LED: LED_D_ON(); // And put the FPGA in the appropriate mode - FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); for(;;) { int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR; if(behindBy > max) max = behindBy; - while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) { + while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1)) > 2) { ci = upTo[0]; cq = upTo[1]; upTo += 2; - if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { + if(upTo >= dmaBuf + DMA_BUFFER_SIZE) { upTo = dmaBuf; AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo; - AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; + AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE; } lastRxCounter -= 2; if(lastRxCounter <= 0) { - lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; + lastRxCounter += DMA_BUFFER_SIZE; } samples += 2; @@ -768,7 +771,7 @@ static void GetSamplesFor14443bDemod(int n, bool quiet) //Tracing if (tracing && Demod.len > 0) { uint8_t parity[MAX_PARITY_SIZE]; - GetParity(Demod.output, Demod.len, parity); + //GetParity(Demod.output, Demod.len, parity); LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE); } } @@ -881,22 +884,6 @@ static void CodeIso14443bAsReader(const uint8_t *cmd, int len) } -//----------------------------------------------------------------------------- -// Read an ISO 14443B tag. We send it some set of commands, and record the -// responses. -// The command name is misleading, it actually decodes the reponse in HEX -// into the output buffer (read the result using hexsamples, not hisamples) -// -// obsolete function only for test -//----------------------------------------------------------------------------- -void AcquireRawAdcSamplesIso14443b(uint32_t parameter) -{ - uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // REQB with AFI=0, Request All, N=0 - - SendRawCommand14443B(sizeof(cmd1),1,1,cmd1); -} - - /** Convenience function to encode, transmit and trace iso 14443b comms **/ @@ -941,8 +928,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast) // Now give it time to spin up. // Signal field is on with the appropriate LED LED_D_ON(); - FpgaWriteConfWord( - FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); SpinDelay(200); // First command: wake up the tag using the INITIATE command @@ -954,10 +940,10 @@ void ReadSTMemoryIso14443b(uint32_t dwLast) // LED_A_OFF(); if (Demod.len == 0) { - DbpString("No response from tag"); - return; + DbpString("No response from tag"); + return; } else { - Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x", + Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %02x %02x %02x", Demod.output[0], Demod.output[1],Demod.output[2]); } // There is a response, SELECT the uid @@ -971,19 +957,19 @@ void ReadSTMemoryIso14443b(uint32_t dwLast) GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); // LED_A_OFF(); if (Demod.len != 3) { - Dbprintf("Expected 3 bytes from tag, got %d", Demod.len); - return; + Dbprintf("Expected 3 bytes from tag, got %d", Demod.len); + return; } // Check the CRC of the answer: ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]); if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) { - DbpString("CRC Error reading select response."); - return; + DbpString("CRC Error reading select response."); + return; } // Check response from the tag: should be the same UID as the command we just sent: if (cmd1[1] != Demod.output[0]) { - Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]); - return; + Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]); + return; } // Tag is now selected, // First get the tag's UID: @@ -995,19 +981,21 @@ void ReadSTMemoryIso14443b(uint32_t dwLast) GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); // LED_A_OFF(); if (Demod.len != 10) { - Dbprintf("Expected 10 bytes from tag, got %d", Demod.len); - return; + Dbprintf("Expected 10 bytes from tag, got %d", Demod.len); + return; } // The check the CRC of the answer (use cmd1 as temporary variable): ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]); - if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) { - Dbprintf("CRC Error reading block! - Below: expected, got %x %x", - (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]); + if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) { + Dbprintf("CRC Error reading block! Expected: %04x got: %04x", + (cmd1[2]<<8)+cmd1[3], + (Demod.output[8]<<8)+Demod.output[9] + ); // Do not return;, let's go on... (we should retry, maybe ?) } Dbprintf("Tag UID (64 bits): %08x %08x", - (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], - (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]); + (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], + (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]); // Now loop to read all 16 blocks, address from 0 to last block Dbprintf("Tag memory dump, block 0 to %d",dwLast); @@ -1033,17 +1021,18 @@ void ReadSTMemoryIso14443b(uint32_t dwLast) // The check the CRC of the answer (use cmd1 as temporary variable): ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]); if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) { - Dbprintf("CRC Error reading block! - Below: expected, got %x %x", - (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]); + Dbprintf("CRC Error reading block! Expected: %04x got: %04x", + (cmd1[2]<<8)+cmd1[3], + (Demod.output[4]<<8)+Demod.output[5] + ); // Do not return;, let's go on... (we should retry, maybe ?) } // Now print out the memory location: - Dbprintf("Address=%x, Contents=%x, CRC=%x", i, - (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], - (Demod.output[4]<<8)+Demod.output[5]); - if (i == 0xff) { - break; - } + Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i, + (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], + (Demod.output[4]<<8)+Demod.output[5] + ); + if (i == 0xff) break; i++; } } @@ -1063,7 +1052,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast) * Memory usage for this function, (within BigBuf) * Last Received command (reader->tag) - MAX_FRAME_SIZE * Last Received command (tag->reader) - MAX_FRAME_SIZE - * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE + * DMA Buffer - DMA_BUFFER_SIZE * Demodulated samples received - all the rest */ void RAMFUNC SnoopIso14443b(void) @@ -1080,7 +1069,7 @@ void RAMFUNC SnoopIso14443b(void) set_tracing(TRUE); // The DMA buffer, used to stream samples from the FPGA - int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); + int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE); int lastRxCounter; int8_t *upTo; int ci, cq; @@ -1098,22 +1087,20 @@ void RAMFUNC SnoopIso14443b(void) Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen()); Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE); Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE); - Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE); + Dbprintf(" DMA: %i bytes", DMA_BUFFER_SIZE); // Signal field is off, no reader signal, no tag signal LEDsoff(); // And put the FPGA in the appropriate mode - FpgaWriteConfWord( - FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | - FPGA_HF_READER_RX_XCORR_SNOOP); + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP); SetAdcMuxFor(GPIO_MUXSEL_HIPKD); // Setup for the DMA. FpgaSetupSsc(); upTo = dmaBuf; - lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; - FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE); + lastRxCounter = DMA_BUFFER_SIZE; + FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE); uint8_t parity[MAX_PARITY_SIZE]; bool TagIsActive = FALSE; @@ -1122,7 +1109,7 @@ void RAMFUNC SnoopIso14443b(void) // And now we loop, receiving samples. for(;;) { int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & - (ISO14443B_DMA_BUFFER_SIZE-1); + (DMA_BUFFER_SIZE-1); if(behindBy > maxBehindBy) { maxBehindBy = behindBy; } @@ -1133,14 +1120,14 @@ void RAMFUNC SnoopIso14443b(void) cq = upTo[1]; upTo += 2; lastRxCounter -= 2; - if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { + if(upTo >= dmaBuf + DMA_BUFFER_SIZE) { upTo = dmaBuf; - lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; + lastRxCounter += DMA_BUFFER_SIZE; AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; - AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; + AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE; WDT_HIT(); - if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not? - Dbprintf("blew circular buffer! behindBy=0x%x", behindBy); + if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not? + Dbprintf("blew circular buffer! behindBy=%d", behindBy); break; } if(!tracing) { @@ -1158,7 +1145,7 @@ void RAMFUNC SnoopIso14443b(void) if (!TagIsActive) { // no need to try decoding reader data if the tag is sending if(Handle14443bUartBit(ci & 0x01)) { if(triggered && tracing) { - GetParity(Uart.output, Uart.byteCnt, parity); + //GetParity(Uart.output, Uart.byteCnt, parity); LogTrace(Uart.output,Uart.byteCnt,samples, samples,parity,TRUE); } /* And ready to receive another command. */ @@ -1169,7 +1156,7 @@ void RAMFUNC SnoopIso14443b(void) } if(Handle14443bUartBit(cq & 0x01)) { if(triggered && tracing) { - GetParity(Uart.output, Uart.byteCnt, parity); + //GetParity(Uart.output, Uart.byteCnt, parity); LogTrace(Uart.output,Uart.byteCnt,samples, samples, parity, TRUE); } /* And ready to receive another command. */ @@ -1182,13 +1169,13 @@ void RAMFUNC SnoopIso14443b(void) } if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time - if(Handle14443bSamplesDemod(ci & 0xFE, cq & 0xFE)) { + if(Handle14443bSamplesDemod(ci, cq)) { //Use samples as a time measurement if(tracing) { uint8_t parity[MAX_PARITY_SIZE]; - GetParity(Demod.output, Demod.len, parity); + //GetParity(Demod.output, Demod.len, parity); LogTrace(Demod.output, Demod.len,samples, samples, parity, FALSE); } triggered = TRUE; @@ -1196,7 +1183,7 @@ void RAMFUNC SnoopIso14443b(void) // And ready to receive another response. DemodReset(); } - TagIsActive = (Demod.state > DEMOD_PHASE_REF_TRAINING); + TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF); } } @@ -1243,7 +1230,7 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u */ // if(!GETBIT(GPIO_LED_D)) { // if field is off - // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); + // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); // // Signal field is on with the appropriate LED // LED_D_ON(); // SpinDelay(200); diff --git a/client/cmdhf.c b/client/cmdhf.c index 614dcdc4..4efa55bf 100644 --- a/client/cmdhf.c +++ b/client/cmdhf.c @@ -36,6 +36,7 @@ int CmdHFTune(const char *Cmd) return 0; } + void annotateIso14443a(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize) { switch(cmd[0]) @@ -92,7 +93,6 @@ void annotateIso14443a(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize) else snprintf(exp,size,"PWD-AUTH"); break; - case MIFARE_ULEV1_FASTREAD : { if ( cmdsize >=3 && cmd[2] <= 0xE6) snprintf(exp,size,"READ RANGE (%d-%d)",cmd[1],cmd[2]); @@ -483,11 +483,13 @@ uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, ui oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01); } uint8_t parityBits = parityBytes[j>>3]; - if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) { + if (protocol != ISO_14443B && isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) { snprintf(line[j/16]+(( j % 16) * 4),110, "%02x! ", frame[j]); + } else { snprintf(line[j/16]+(( j % 16) * 4),110, "%02x ", frame[j]); } + } if (markCRCBytes) { @@ -663,6 +665,11 @@ int CmdHFSearch(const char *Cmd){ PrintAndLog("\nValid ISO14443A Tag Found - Quiting Search\n"); return ans; } + ans = HF14BReader(false); + if (ans) { + PrintAndLog("\nValid ISO14443B Tag Found - Quiting Search\n"); + return ans; + } ans = HFiClassReader("", false, false); if (ans) { PrintAndLog("\nValid iClass Tag (or PicoPass Tag) Found - Quiting Search\n"); @@ -673,12 +680,7 @@ int CmdHFSearch(const char *Cmd){ PrintAndLog("\nValid ISO15693 Tag Found - Quiting Search\n"); return ans; } - - - //14b has issues currently... - //ans = CmdHF14BRead(Cmd); - //if (ans > 0) return ans; - + PrintAndLog("\nno known/supported 13.56 MHz tags found\n"); return 0; } @@ -697,7 +699,7 @@ static command_t CommandTable[] = {"topaz", CmdHFTopaz, 1, "{ TOPAZ (NFC Type 1) RFIDs... }"}, {"tune", CmdHFTune, 0, "Continuously measure HF antenna tuning"}, {"list", CmdHFList, 1, "List protocol data in trace buffer"}, - {"search", CmdHFSearch, 1, "Search for known HF tags [preliminary]"}, + {"search", CmdHFSearch, 1, "Search for known HF tags"}, {NULL, NULL, 0, NULL} }; diff --git a/client/cmdhf14b.c b/client/cmdhf14b.c index 52888bfd..0144111e 100644 --- a/client/cmdhf14b.c +++ b/client/cmdhf14b.c @@ -23,129 +23,9 @@ #include "cmdhf14b.h" #include "cmdmain.h" #include "cmdhf14a.h" -//#include "sleep.h" -#include "cmddata.h" static int CmdHelp(const char *Cmd); -int CmdHF14BDemod(const char *Cmd) -{ - int i, j, iold; - int isum, qsum; - int outOfWeakAt; - bool negateI, negateQ; - - uint8_t data[256]; - int dataLen = 0; - - // As received, the samples are pairs, correlations against I and Q - // square waves. So estimate angle of initial carrier (or just - // quadrant, actually), and then do the demod. - - // First, estimate where the tag starts modulating. - for (i = 0; i < GraphTraceLen; i += 2) { - if (abs(GraphBuffer[i]) + abs(GraphBuffer[i + 1]) > 40) { - break; - } - } - if (i >= GraphTraceLen) { - PrintAndLog("too weak to sync"); - return 0; - } - PrintAndLog("out of weak at %d", i); - outOfWeakAt = i; - - // Now, estimate the phase in the initial modulation of the tag - isum = 0; - qsum = 0; - for (; i < (outOfWeakAt + 16); i += 2) { - isum += GraphBuffer[i + 0]; - qsum += GraphBuffer[i + 1]; - } - negateI = (isum < 0); - negateQ = (qsum < 0); - - // Turn the correlation pairs into soft decisions on the bit. - j = 0; - for (i = 0; i < GraphTraceLen / 2; i++) { - int si = GraphBuffer[j]; - int sq = GraphBuffer[j + 1]; - if (negateI) si = -si; - if (negateQ) sq = -sq; - GraphBuffer[i] = si + sq; - j += 2; - } - GraphTraceLen = i; - - i = outOfWeakAt / 2; - while (GraphBuffer[i] > 0 && i < GraphTraceLen) - i++; - if (i >= GraphTraceLen) goto demodError; - - iold = i; - while (GraphBuffer[i] < 0 && i < GraphTraceLen) - i++; - if (i >= GraphTraceLen) goto demodError; - if ((i - iold) > 23) goto demodError; - - PrintAndLog("make it to demod loop"); - - for (;;) { - iold = i; - while (GraphBuffer[i] >= 0 && i < GraphTraceLen) - i++; - if (i >= GraphTraceLen) goto demodError; - if ((i - iold) > 6) goto demodError; - - uint16_t shiftReg = 0; - if (i + 20 >= GraphTraceLen) goto demodError; - - for (j = 0; j < 10; j++) { - int soft = GraphBuffer[i] + GraphBuffer[i + 1]; - - if (abs(soft) < (abs(isum) + abs(qsum)) / 20) { - PrintAndLog("weak bit"); - } - - shiftReg >>= 1; - if(GraphBuffer[i] + GraphBuffer[i+1] >= 0) { - shiftReg |= 0x200; - } - - i+= 2; - } - - if ((shiftReg & 0x200) && !(shiftReg & 0x001)) - { - // valid data byte, start and stop bits okay - PrintAndLog(" %02x", (shiftReg >> 1) & 0xff); - data[dataLen++] = (shiftReg >> 1) & 0xff; - if (dataLen >= sizeof(data)) { - return 0; - } - } else if (shiftReg == 0x000) { - // this is EOF - break; - } else { - goto demodError; - } - } - - uint8_t first, second; - ComputeCrc14443(CRC_14443_B, data, dataLen-2, &first, &second); - PrintAndLog("CRC: %02x %02x (%s)\n", first, second, - (first == data[dataLen-2] && second == data[dataLen-1]) ? - "ok" : "****FAIL****"); - - RepaintGraphWindow(); - return 0; - -demodError: - PrintAndLog("demod error"); - RepaintGraphWindow(); - return 0; -} - int CmdHF14BList(const char *Cmd) { PrintAndLog("Deprecated command, use 'hf list 14b' instead"); @@ -153,28 +33,20 @@ int CmdHF14BList(const char *Cmd) return 0; } -int CmdHF14Sim(const char *Cmd) -{ - UsbCommand c={CMD_SIMULATE_TAG_ISO_14443}; - clearCommandBuffer(); - SendCommand(&c); - return 0; -} - -int CmdHFSimlisten(const char *Cmd) +int CmdHF14BSim(const char *Cmd) { - UsbCommand c = {CMD_SIMULATE_TAG_HF_LISTEN}; + UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B}; clearCommandBuffer(); - SendCommand(&c); - return 0; + SendCommand(&c); + return 0; } int CmdHF14BSnoop(const char *Cmd) { - UsbCommand c = {CMD_SNOOP_ISO_14443}; + UsbCommand c = {CMD_SNOOP_ISO_14443B}; clearCommandBuffer(); - SendCommand(&c); - return 0; + SendCommand(&c); + return 0; } /* New command to read the contents of a SRI512 tag @@ -183,10 +55,10 @@ int CmdHF14BSnoop(const char *Cmd) */ int CmdSri512Read(const char *Cmd) { - UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}}; + UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}}; clearCommandBuffer(); - SendCommand(&c); - return 0; + SendCommand(&c); + return 0; } /* New command to read the contents of a SRIX4K tag @@ -195,14 +67,14 @@ int CmdSri512Read(const char *Cmd) */ int CmdSrix4kRead(const char *Cmd) { - UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}}; + UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}}; clearCommandBuffer(); - SendCommand(&c); - return 0; + SendCommand(&c); + return 0; } int rawClose(void){ - UsbCommand resp; + UsbCommand resp; UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; clearCommandBuffer(); SendCommand(&c); @@ -212,54 +84,54 @@ int rawClose(void){ return 0; } -int HF14BCmdRaw(bool reply, bool *crc, uint8_t power_trace, uint8_t *data, uint8_t *datalen, bool verbose){ +int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){ UsbCommand resp; - UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power/trace - if(*crc) - { - uint8_t first, second; - ComputeCrc14443(CRC_14443_B, data, *datalen, &first, &second); - data[*datalen] = first; - data[*datalen + 1] = second; - *datalen += 2; - } - - c.arg[0] = *datalen; - c.arg[1] = reply; - c.arg[2] = power_trace; - memcpy(c.d.asBytes,data,*datalen); + UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power + if(*crc) + { + uint8_t first, second; + ComputeCrc14443(CRC_14443_B, data, *datalen, &first, &second); + data[*datalen] = first; + data[*datalen + 1] = second; + *datalen += 2; + } + + c.arg[0] = *datalen; + c.arg[1] = reply; + c.arg[2] = power; + memcpy(c.d.asBytes,data,*datalen); clearCommandBuffer(); - SendCommand(&c); - - if (!reply) return 1; - - if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) { - if (verbose) PrintAndLog("timeout while waiting for reply."); - return 0; - } - *datalen = resp.arg[0]; - if (verbose) PrintAndLog("received %u octets", *datalen); - if(*datalen<2) return 0; - - memcpy(data, resp.d.asBytes, *datalen); - if (verbose) PrintAndLog("%s", sprint_hex(data, *datalen)); - - uint8_t first, second; - ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second); - if(data[*datalen-2] == first && data[*datalen-1] == second) { - if (verbose) PrintAndLog("CRC OK"); - *crc = true; - } else { - if (verbose) PrintAndLog("CRC failed"); - *crc = false; - } - return 1; + SendCommand(&c); + + if (!reply) return 1; + + if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) { + if (verbose) PrintAndLog("timeout while waiting for reply."); + return 0; + } + *datalen = resp.arg[0]; + if (verbose) PrintAndLog("received %u octets", *datalen); + if(*datalen<2) return 0; + + memcpy(data, resp.d.asBytes, *datalen); + if (verbose) PrintAndLog("%s", sprint_hex(data, *datalen)); + + uint8_t first, second; + ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second); + if(data[*datalen-2] == first && data[*datalen-1] == second) { + if (verbose) PrintAndLog("CRC OK"); + *crc = true; + } else { + if (verbose) PrintAndLog("CRC failed"); + *crc = false; + } + return 1; } int CmdHF14BCmdRaw (const char *Cmd) { bool reply = true; bool crc = false; - uint8_t power_trace = 0; + bool power = false; char buf[5]=""; uint8_t data[100] = {0x00}; uint8_t datalen = 0; @@ -290,7 +162,7 @@ int CmdHF14BCmdRaw (const char *Cmd) { break; case 'p': case 'P': - power_trace |= 1; + power = true; break; default: PrintAndLog("Invalid option"); @@ -322,55 +194,41 @@ int CmdHF14BCmdRaw (const char *Cmd) { return 0; } - return HF14BCmdRaw(reply, &crc, power_trace, data, &datalen, true); + return HF14BCmdRaw(reply, &crc, power, data, &datalen, true); } static void print_atqb_resp(uint8_t *data){ - PrintAndLog (" UID: %s", sprint_hex(data+1,4)); - PrintAndLog (" App Data: %s", sprint_hex(data+5,4)); - PrintAndLog (" Protocol: %s", sprint_hex(data+9,3)); - uint8_t BitRate = data[9]; - if (!BitRate) - PrintAndLog (" Bit Rate: 106 kbit/s only PICC <-> PCD"); - if (BitRate & 0x10) - PrintAndLog (" Bit Rate: 212 kbit/s PICC -> PCD supported"); - if (BitRate & 0x20) - PrintAndLog (" Bit Rate: 424 kbit/s PICC -> PCD supported"); - if (BitRate & 0x40) - PrintAndLog (" Bit Rate: 847 kbit/s PICC -> PCD supported"); - if (BitRate & 0x01) - PrintAndLog (" Bit Rate: 212 kbit/s PICC <- PCD supported"); - if (BitRate & 0x02) - PrintAndLog (" Bit Rate: 424 kbit/s PICC <- PCD supported"); - if (BitRate & 0x04) - PrintAndLog (" Bit Rate: 847 kbit/s PICC <- PCD supported"); - if (BitRate & 0x80) - PrintAndLog (" Same bit rate <-> required"); - - uint16_t maxFrame = data[10]>>4; - if (maxFrame < 5) - maxFrame = 8*maxFrame + 16; - else if (maxFrame == 5) - maxFrame = 64; - else if (maxFrame == 6) - maxFrame = 96; - else if (maxFrame == 7) - maxFrame = 128; - else if (maxFrame == 8) - maxFrame = 256; - else - maxFrame = 257; - - PrintAndLog ("Max Frame Size: %d%s",maxFrame, (maxFrame == 257) ? "+ RFU" : ""); - - uint8_t protocolT = data[10] & 0xF; - PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " ); - PrintAndLog ("Frame Wait Int: %d", data[11]>>4); - PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary"); - PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not "); - PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not "); - - return; + PrintAndLog (" UID: %s", sprint_hex(data+1,4)); + PrintAndLog (" App Data: %s", sprint_hex(data+5,4)); + PrintAndLog (" Protocol: %s", sprint_hex(data+9,3)); + uint8_t BitRate = data[9]; + if (!BitRate) PrintAndLog (" Bit Rate: 106 kbit/s only PICC <-> PCD"); + if (BitRate & 0x10) PrintAndLog (" Bit Rate: 212 kbit/s PICC -> PCD supported"); + if (BitRate & 0x20) PrintAndLog (" Bit Rate: 424 kbit/s PICC -> PCD supported"); + if (BitRate & 0x40) PrintAndLog (" Bit Rate: 847 kbit/s PICC -> PCD supported"); + if (BitRate & 0x01) PrintAndLog (" Bit Rate: 212 kbit/s PICC <- PCD supported"); + if (BitRate & 0x02) PrintAndLog (" Bit Rate: 424 kbit/s PICC <- PCD supported"); + if (BitRate & 0x04) PrintAndLog (" Bit Rate: 847 kbit/s PICC <- PCD supported"); + if (BitRate & 0x80) PrintAndLog (" Same bit rate <-> required"); + + uint16_t maxFrame = data[10]>>4; + if (maxFrame < 5) maxFrame = 8 * maxFrame + 16; + else if (maxFrame == 5) maxFrame = 64; + else if (maxFrame == 6) maxFrame = 96; + else if (maxFrame == 7) maxFrame = 128; + else if (maxFrame == 8) maxFrame = 256; + else maxFrame = 257; + + PrintAndLog ("Max Frame Size: %d%s", maxFrame, (maxFrame == 257) ? "+ RFU" : ""); + + uint8_t protocolT = data[10] & 0xF; + PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " ); + PrintAndLog ("Frame Wait Int: %d", data[11]>>4); + PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary"); + PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not "); + PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not "); + + return; } char *get_ST_Chip_Model(uint8_t data){ @@ -393,79 +251,149 @@ char *get_ST_Chip_Model(uint8_t data){ static void print_st_info(uint8_t *data){ //uid = first 8 bytes in data - PrintAndLog(" UID: %s", sprint_hex(data,8)); - PrintAndLog(" MFG: %02X, %s", data[1], getTagInfo(data[1])); - PrintAndLog("Chip: %02X, %s", data[2]>>2, get_ST_Chip_Model(data[2]>>2)); + PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8)); + PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6])); + PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2)); return; } -int HF14BStdRead(uint8_t *data, uint8_t *datalen){ - bool crc = true; - *datalen = 3; - //std read cmd - data[0] = 0x05; - data[1] = 0x00; - data[2] = 0x08; - - if (HF14BCmdRaw(true, &crc, 0, data, datalen, false)==0) return 0; +int HF14BStdReader(uint8_t *data, uint8_t *datalen){ + + //05 00 00 = find one tag in field + //1d xx xx xx xx 20 00 08 01 00 = attrib xx=crc + //a3 = ? (resp 03 e2 c2) + //02 = ? (resp 02 6a d3) + // 022b (resp 02 67 00 [29 5b]) + // 0200a40400 (resp 02 67 00 [29 5b]) + // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b]) + // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b]) + // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c]) + // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b]) + // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c]) + // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c]) + // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c]) + //03 = ? (resp 03 [e3 c2]) + //c2 = ? (resp c2 [66 15]) + //b2 = ? (resp a3 [e9 67]) + bool crc = true; + *datalen = 3; + //std read cmd + data[0] = 0x05; + data[1] = 0x00; + data[2] = 0x00; + + if (HF14BCmdRaw(true, &crc, false, data, datalen, false)==0) return 0; if (data[0] != 0x50 || *datalen != 14 || !crc) return 0; - PrintAndLog ("\n14443-3b tag found:"); - print_atqb_resp(data); + PrintAndLog ("\n14443-3b tag found:"); + print_atqb_resp(data); - return 1; -} + return 1; + } -int HF14B_ST_Read(uint8_t *data, uint8_t *datalen){ - bool crc = true; - *datalen = 2; +int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){ + bool crc = true; + *datalen = 2; //wake cmd - data[0] = 0x06; - data[1] = 0x00; + data[0] = 0x06; + data[1] = 0x00; //leave power on // verbose on for now for testing - turn off when functional - if (HF14BCmdRaw(true, &crc, 1, data, datalen, true)==0) return rawClose(); + if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose(); if (*datalen != 3 || !crc) return rawClose(); - uint8_t chipID = data[0]; + uint8_t chipID = data[0]; // select - data[0] = 0x0E; - data[1] = chipID; - *datalen = 2; + data[0] = 0x0E; + data[1] = chipID; + *datalen = 2; //leave power on // verbose on for now for testing - turn off when functional - if (HF14BCmdRaw(true, &crc, 1, data, datalen, true)==0) return rawClose(); + if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose(); if (*datalen != 3 || !crc || data[0] != chipID) return rawClose(); // get uid - data[0] = 0x0B; - *datalen = 1; + data[0] = 0x0B; + *datalen = 1; //power off // verbose on for now for testing - turn off when functional - if (HF14BCmdRaw(true, &crc, 1, data, datalen, true)==0) return 0; + if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0; rawClose(); if (*datalen != 10 || !crc) return 0; PrintAndLog("\n14443-3b ST tag found:"); print_st_info(data); - return 1; + return 1; +} + +// test for other 14b type tags (mimic another reader - don't have tags to identify) +int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){ + bool crc = true; + *datalen = 4; + //std read cmd + data[0] = 0x00; + data[1] = 0x0b; + data[2] = 0x3f; + data[3] = 0x80; + + if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) { + if (*datalen > 2 || !crc) { + PrintAndLog ("\n14443-3b tag found:"); + PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:"); + PrintAndLog ("%s",sprint_hex(data,*datalen)); + return 1; + } + } + + crc = false; + *datalen = 1; + data[0] = 0x0a; + + if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) { + if (*datalen > 0) { + PrintAndLog ("\n14443-3b tag found:"); + PrintAndLog ("Unknown tag type answered to a 0x0A command ans:"); + PrintAndLog ("%s",sprint_hex(data,*datalen)); + return 1; + } + } + + crc = false; + *datalen = 1; + data[0] = 0x0c; + + if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) { + if (*datalen > 0) { + PrintAndLog ("\n14443-3b tag found:"); + PrintAndLog ("Unknown tag type answered to a 0x0C command ans:"); + PrintAndLog ("%s",sprint_hex(data,*datalen)); + return 1; + } + } + + return 0; + } int HF14BReader(bool verbose){ - uint8_t data[100]; - uint8_t datalen = 5; - - // try std 14b (atqb) - if (HF14BStdRead(data, &datalen)) return 1; + uint8_t data[100]; + uint8_t datalen = 5; + + // try std 14b (atqb) + if (HF14BStdReader(data, &datalen)) return 1; + + // try st 14b + if (HF14B_ST_Reader(data, &datalen)) return 1; - // try st 14b - if (HF14B_ST_Read(data, &datalen)) return 1; + // try unknown 14b read commands (to be identified later) + // could be read of calypso, CEPAS, moneo, or pico pass. + if (HF14B_Other_Reader(data, &datalen)) return 1; if (verbose) PrintAndLog("no 14443B tag found"); return 0; @@ -475,19 +403,6 @@ int CmdHF14BReader(const char *Cmd){ return HF14BReader(true); } -int CmdHFRawSamples(const char *Cmd){ - UsbCommand resp; - UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443, {strtol(Cmd,NULL,0), 0, 0}}; - SendCommand(&c); - - if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) { - PrintAndLog("timeout while waiting for reply."); - return 0; - } - getSamples("39999", true); - return 1; -} - int CmdHF14BWrite( const char *Cmd){ /* * For SRIX4K blocks 00 - 7F @@ -557,29 +472,27 @@ int CmdHF14BWrite( const char *Cmd){ static command_t CommandTable[] = { - {"help", CmdHelp, 1, "This help"}, - {"demod", CmdHF14BDemod, 1, "Demodulate ISO14443 Type B from tag"}, - {"getsamples", CmdHFRawSamples,0, "[atqb=0 or ST=1] Send wake cmd and Get raw HF samples to GraphBuffer"}, - {"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443b history"}, - {"reader", CmdHF14BReader, 0, "Find 14b tag (HF ISO 14443b)"}, - {"sim", CmdHF14Sim, 0, "Fake ISO 14443 tag"}, - {"simlisten", CmdHFSimlisten, 0, "Get HF samples as fake tag"}, - {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443"}, - {"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"}, - {"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"}, - {"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"}, - {"write", CmdHF14BWrite, 0, "Write data to a SRI512 | SRIX4K tag"}, - {NULL, NULL, 0, NULL} + {"help", CmdHelp, 1, "This help"}, + {"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443b history"}, + {"reader", CmdHF14BReader, 0, "Find 14b tag (HF ISO 14443b)"}, + {"sim", CmdHF14BSim, 0, "Fake ISO 14443B tag"}, + + {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443B"}, + {"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"}, + {"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"}, + {"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"}, + {"write", CmdHF14BWrite, 0, "Write data to a SRI512 | SRIX4K tag"}, + {NULL, NULL, 0, NULL} }; int CmdHF14B(const char *Cmd) { - CmdsParse(CommandTable, Cmd); - return 0; + CmdsParse(CommandTable, Cmd); + return 0; } int CmdHelp(const char *Cmd) { - CmdsHelp(CommandTable); - return 0; + CmdsHelp(CommandTable); + return 0; } diff --git a/client/cmdhf14b.h b/client/cmdhf14b.h index 66fd430f..ef79317a 100644 --- a/client/cmdhf14b.h +++ b/client/cmdhf14b.h @@ -12,16 +12,13 @@ #define CMDHF14B_H__ int CmdHF14B(const char *Cmd); - -int CmdHF14BDemod(const char *Cmd); int CmdHF14BList(const char *Cmd); int CmdHF14BReader(const char *Cmd); -int HF14BReader(bool verbose); -int CmdHF14Sim(const char *Cmd); -int CmdHFSimlisten(const char *Cmd); +int CmdHF14BSim(const char *Cmd); int CmdHF14BSnoop(const char *Cmd); int CmdSri512Read(const char *Cmd); int CmdSrix4kRead(const char *Cmd); int CmdHF14BWrite( const char *cmd); +int HF14BReader(bool verbose); #endif diff --git a/client/cmdhfmfu.c b/client/cmdhfmfu.c index 8b5dca82..e10c6519 100644 --- a/client/cmdhfmfu.c +++ b/client/cmdhfmfu.c @@ -57,13 +57,13 @@ uint8_t default_pwd_pack[KEYS_PWD_COUNT][4] = { {0x32,0x0C,0x16,0x17}, // PACK 0x80,0x80 -- AMiiboo (sniffed) }; -#define MAX_UL_TYPES 17 -uint16_t UL_TYPES_ARRAY[MAX_UL_TYPES] = {UNKNOWN, UL, UL_C, UL_EV1_48, UL_EV1_128, NTAG, NTAG_203, - NTAG_210, NTAG_212, NTAG_213, NTAG_215, NTAG_216, MY_D, MY_D_NFC, MY_D_MOVE, MY_D_MOVE_NFC, MY_D_MOVE_LEAN}; +#define MAX_UL_TYPES 18 +uint32_t UL_TYPES_ARRAY[MAX_UL_TYPES] = {UNKNOWN, UL, UL_C, UL_EV1_48, UL_EV1_128, NTAG, NTAG_203, + NTAG_210, NTAG_212, NTAG_213, NTAG_215, NTAG_216, MY_D, MY_D_NFC, MY_D_MOVE, MY_D_MOVE_NFC, MY_D_MOVE_LEAN, FUDAN_UL}; uint8_t UL_MEMORY_ARRAY[MAX_UL_TYPES] = {MAX_UL_BLOCKS, MAX_UL_BLOCKS, MAX_ULC_BLOCKS, MAX_ULEV1a_BLOCKS, MAX_ULEV1b_BLOCKS, MAX_NTAG_203, MAX_NTAG_203, MAX_NTAG_210, MAX_NTAG_212, MAX_NTAG_213, - MAX_NTAG_215, MAX_NTAG_216, MAX_UL_BLOCKS, MAX_MY_D_NFC, MAX_MY_D_MOVE, MAX_MY_D_MOVE, MAX_MY_D_MOVE_LEAN}; + MAX_NTAG_215, MAX_NTAG_216, MAX_UL_BLOCKS, MAX_MY_D_NFC, MAX_MY_D_MOVE, MAX_MY_D_MOVE, MAX_MY_D_MOVE_LEAN, MAX_UL_BLOCKS}; static int CmdHelp(const char *Cmd); @@ -259,6 +259,25 @@ static int ulev1_readSignature( uint8_t *response, uint16_t responseLength ){ return len; } +//make sure field is off before calling this function +static int ul_fudan_check( void ){ + iso14a_card_select_t card; + if ( !ul_select(&card) ) + return UL_ERROR; + + UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_NO_DISCONNECT, 4, 0}}; + + uint8_t cmd[4] = {0x30,0x00,0x02,0xa7}; //wrong crc on purpose should be 0xa8 + memcpy(c.d.asBytes, cmd, 4); + clearCommandBuffer(); + SendCommand(&c); + UsbCommand resp; + if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) return UL_ERROR; + if (resp.arg[0] != 1) return UL_ERROR; + + return (!resp.d.asBytes[0]) ? FUDAN_UL : UL; //if response == 0x00 then Fudan, else Genuine NXP +} + static int ul_print_default( uint8_t *data){ uint8_t uid[7]; @@ -365,15 +384,17 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces){ else if ( tagtype & NTAG_I2C_2K ) PrintAndLog("%sTYPE : NTAG I%sC 1904bytes (NT3H1201FHK)", spacer, "\xFD"); else if ( tagtype & MY_D ) - PrintAndLog("%sTYPE : INFINEON my-d\0153 (SLE 66RxxS)", spacer); + PrintAndLog("%sTYPE : INFINEON my-d\x99 (SLE 66RxxS)", spacer); else if ( tagtype & MY_D_NFC ) - PrintAndLog("%sTYPE : INFINEON my-d\0153 NFC (SLE 66RxxP)", spacer); + PrintAndLog("%sTYPE : INFINEON my-d\x99 NFC (SLE 66RxxP)", spacer); else if ( tagtype & MY_D_MOVE ) - PrintAndLog("%sTYPE : INFINEON my-d\0153 move (SLE 66R01P)", spacer); + PrintAndLog("%sTYPE : INFINEON my-d\x99 move (SLE 66R01P)", spacer); else if ( tagtype & MY_D_MOVE_NFC ) - PrintAndLog("%sTYPE : INFINEON my-d\0153 move NFC (SLE 66R01P)", spacer); + PrintAndLog("%sTYPE : INFINEON my-d\x99 move NFC (SLE 66R01P)", spacer); else if ( tagtype & MY_D_MOVE_LEAN ) PrintAndLog("%sTYPE : INFINEON my-d\x99 move lean (SLE 66R01L)", spacer); + else if ( tagtype & FUDAN_UL ) + PrintAndLog("%sTYPE : FUDAN Ultralight Compatible (or other compatible) %s", spacer, (tagtype & MAGIC) ? "" : "" ); else PrintAndLog("%sTYPE : Unknown %06x", spacer, tagtype); return 0; @@ -607,6 +628,10 @@ uint32_t GetHF14AMfU_Type(void){ ul_switch_off_field(); } } + if (tagtype & UL) { + tagtype = ul_fudan_check(); + ul_switch_off_field(); + } } else { ul_switch_off_field(); // Infinition MY-D tests Exam high nibble diff --git a/client/cmdhfmfu.h b/client/cmdhfmfu.h index 132e4f90..6c9e3ea1 100644 --- a/client/cmdhfmfu.h +++ b/client/cmdhfmfu.h @@ -45,7 +45,8 @@ typedef enum TAGTYPE_UL { MY_D_MOVE_LEAN= 0x008000, NTAG_I2C_1K = 0x010000, NTAG_I2C_2K = 0x020000, - MAGIC = 0x040000, + FUDAN_UL = 0x040000, + MAGIC = 0x080000, UL_MAGIC = UL | MAGIC, UL_C_MAGIC = UL_C | MAGIC, UL_ERROR = 0xFFFFFF, diff --git a/client/lualibs/commands.lua b/client/lualibs/commands.lua index bedb8367..fd186fb7 100644 --- a/client/lualibs/commands.lua +++ b/client/lualibs/commands.lua @@ -59,7 +59,6 @@ local _commands = { --// For the 13.56 MHz tags CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693 = 0x0300, - CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443 = 0x0301, CMD_READ_SRI512_TAG = 0x0303, CMD_READ_SRIX4K_TAG = 0x0304, CMD_READER_ISO_15693 = 0x0310, @@ -76,9 +75,8 @@ local _commands = { CMD_SIMULATE_HITAG = 0x0371, CMD_READER_HITAG = 0x0372, - CMD_SIMULATE_TAG_HF_LISTEN = 0x0380, - CMD_SIMULATE_TAG_ISO_14443 = 0x0381, - CMD_SNOOP_ISO_14443 = 0x0382, + CMD_SIMULATE_TAG_ISO_14443B = 0x0381, + CMD_SNOOP_ISO_14443B = 0x0382, CMD_SNOOP_ISO_14443a = 0x0383, CMD_SIMULATE_TAG_ISO_14443a = 0x0384, CMD_READER_ISO_14443a = 0x0385, diff --git a/cp2tau b/cp2tau deleted file mode 100644 index 8b6ee4b4..00000000 --- a/cp2tau +++ /dev/null @@ -1,4 +0,0 @@ -cp armsrc/obj/*.elf /z -cp armsrc/obj/*.s19 /z -cp bootrom/obj/*.elf /z -cp bootrom/obj/*.s19 /z diff --git a/fpga/fpga_hf.bit b/fpga/fpga_hf.bit index 53078a782422c09596f006d95c85ae45da20072d..49bec2242cb7720524289f3eba1397bbc2a22867 100644 GIT binary patch literal 42175 zcmeIb4RjpUl`gvLR7;e*Tkf)KGXe}LwPeybZMiKO;}}^wmIV>P2}*_}zVldf8$$9t zxlFDg_sw%=ax+IiVEG5!fak`!!{j!`nQ;xgC~CcXb7GH#{WU+ntd zZ~gaczqqjLj$1$fh1(mx{Q2AIHi|ZWr781QcP`Fk=<^h7%q+foQD*6)#mne+nz8um z<&D=YZ)&115bfwXhoA3$^D|$}kTQtqqKuK{|5_QtF-Wy8%#h3foBZF;$PoHV|J%rr zq)w{;JXPD={d;~QO8?@I7-N{f=Mi4F_Z;y@jH&)ZV|9Sua7t!7C z*_5Rksw6}C4aysL(2XP%mT*`<$E`R==j^5#RnokIeon20#FY6}=jZurxG_mx{2*md zs6AcD9kf$iNt;wdA+}dsrv68E0XGVf43FurI7~y>n;CZH9rPfj-B{-O4&%X^dNjmw zLqErz`zQ@jlB}H<*V86yaAN}^Mc<Kj(h)5FR+_ zJ;&i!jZ~!RS(Qv#mS|90FrS%Q#c8pHl02UiI6(L*RIH|cmdN|{7W52I}|OMXG8o`1Hp>J{@9Iwf25oarYSG;-!ID!ceOH5FrYkeXzo(_DfE zel=>og9Zf5na_LswahM1KlCD|go8!{Hwwz{dC8OAsu;#p^O#|j=bYlH4vTK`=j^>} zZlBm-K;&(r9_!P<%Q774_GS0>B0pyb9W;{vXX3wNoe$D-nfM2jXQ<~h?&(*GcF=FA zrR|7~EjUG2V5&xePSGQzdrSY90R_96xS>dmF+cFd~mjSPu9+}I59l6b^BV~2|R#m6{ZusVfJ zd+0CSXqPxl->_@>JdgX&v0B9X{uPB(N9+Omomx>ybeKO^zgABa66?%2J^ivS|9;{0 zN*qxIk6}7it=U3H_BXLTbiMuB3H{nl3p--B z30v;5p z%3gBN5F_5c@0|NIR=#CC5s4)oo^vc`rs;@h$NYCGf=ys?RBxdu*I`&uEmwguycdQ& zEsm%a9k;;V(C?_p#W_4nFVMAYGu?JQraN*6ZKN+A@93{g(o<{(cborR8(}C>LE8Kr zh5hQUZBYH2+v*}u(QRxhC#cuZHoV~Ng+*~v5XT}xFdzjMXS47?p{QSEeGPAKa8oMk zV9wfnO+&8byeY1yU-`?YY1+7kUap`K^b3fl zH$@~3?_IMVrNMOa25TS*{jwIgn|49=r#v9bc>6AaU#B8XD(=P_#o^ASZepA1?@q?F zOZatGJ=^^sC(V;`O2NDzHGLps{F1!Rj9)L*G`oO_e*1V9%fkEaAKFn*zZkzZs0O!V z0Q!EkW2qY(Y+LC1^9kXXa?|PtXdUI%IOK}XEXq~FFL96hj|FRnh{|uMFBD?82q2nT zcpiQ|N6qTq+S&c$I4v7a*k;`N4K;`H>vC^*KK!~lWuIf%>SVdh1n<|Vr(cX;Q@2&B z$TstKI^|$}Z1d5gTp|1#oZ~1fQ$0^SVga@~#XL`m%JHk`3k7S9_@vmQ<`-gX1S6WB za|yp_=vJq&cA1FNBNDJ>qv7vq7{5lA=Hide{tG&7Kdu0*Kr|1?Lihy}SD)zabscT% z`pf{x0{j}od0s9Xa;wHX{K`e^B{WxFRE}T5>9lg<7qHLUJwyG3XQ)f~Mcp>=Yf?> zZZ+SqPRSMtn}AKhoJ06!jG?D_ZN;|dzDNi2dJKAm9`n4X7mQzf0b5p|a5^>%55IH| zfGmVxm|^FPPH{8cZR@EX4(9CHsG7Nu)M{wAj*1q#S2f5Rf!%gdb|1gy;_YtBnyPIk z=A&BVP1|71{W%x$%h&-QsU^F`jxl~=st=hHbNn%3{BoOVbB{?dpUVMTvD=F4Q^c9enCFa#RwBN(877r8( zVf=ccqd{G^t*w@R0^1Uc!?FKYw$J$hzl=2PRbSqBnZj1W#d2fY+R{?nOpNjID-x$c zO1qcQ$F0bNELSdy%|#FP)b|gm>T7&jR7{x;jWB)%_BkKm*Cm*91ak&{MKn)w&13Xy z`jDF_1o(yh0$SC^r_6V0ST$wiN6qCxo@*#RY6keF(aN#dm4$QbS{ZNh&b`}23BR!N z4KkGx>?k_k7=_7Oc7R{tUr*7O3D0rG_tbV54J?9{bT{OBLilxtnvM7XT=at@jbrg$ zF^fhzms0%iVj=v3IQ6jVlk_vtu0>Pu`KMGfEvhNwU#xmKt8hg$zNctJHV((P;yDiM z1>+Z1p4huU1AC$8L&-uSCmOxI(EN+i)ljQpm_Z&Bo#AYvJoP)#WuAU%{-qWsp;rG) zKgiXN#lBj3X?DGOxIVU4Sl)A(fB9%N4E5BsE7ivQEAE)pf~P}LMC&Obj z|Dt9EZA#I5vTfWV95(J0HLgWNc<*BV#nw2rRlGqPT&Ghvuqj=S=FF_mzasT|jHSoOWT$RCL3M4` zsHpVz!iq#-`5UA)2YU*zlQ^QoD<5-eB@nI6V6kZLjI5q>oXpqT71kr(ZMrn&G+JqQ zQ-i7P>bA>yhOIL3fH~H4mRj2qpEggbQ{&IHpO0UyEY5t|M~$8F`^^X)luZ))Rq5?l z5x=T7Mw31LYA}`Rk2Y@a&nH!t68CwsGyh_QwLaZ5hwe_*c3`S=6f-hRUKm|GXN_Nw zYlbZ_rgJ`vGlvyc&d7;-yuHXXeo@O^m`}X}+LeuOGnt5Gy3mvI`IoVS$8p<$GWMNnB1_X#S}6pTsf;frU04Y@dJaw60*<Ua+$G@P1QcSMgY}Jt^d;XdEmxNs8=@;V{WG}!= zaY;#sKv;&Mr`XdLVR`$$6E+k2{?C}qt#fvFnbw*tVsa^nmxNQX;Qn^W$-WSDN2uy6vQ$R%sLgzwl#|_=61H& zPLY3Uo9S9`FWF|w8*{=zJSwTj6!pvVa&a;v7?YR4F9&iVij~1x<)cbebqAd>TEGlo z$EIMu66$01JRcb!h>@pX%)fltn#7z}5P<9?_sA_J{ssJ+rXeRW+50XXF`5jF$*_PF zA1(2(x1l?YGWL)-9@(UlPOL{Hfx=103gZ_rx8B{90mkuEWAM0W01Ze{xcX{}g8Ah~lSTc|ykQi6{?IjBMbty*SN8^``upxLQZ__Y4y9=JVFnHs^di>McTVM7B<$)xMfT+zyV7O+>xp5&%{N88^TY@MC@1QBuwS=! zt;6io*~-r=@-Wjr_>;A z?l+ytRKCTD_d}0I)S$C@B#0j}ehs(Yn%EjU=^6Zo=nXn0VfnX)ewdqmGWufw z@-NLiYA)@0G2g_7vC_i}jbA&r6MMPTFO#;_m(3&Md=p0c& z-H-w(T*5DFmz}(s^^3kqSSSuGY#_l4RY_SsV;aA*jS@5brTPgimosx_MdSt=l<8b7 z<=N+y0sciTD-#2=$8xVzvrK3rCb&_CU$PpoRaXFhA*|YC)(SY%ytz@RJ$_OZz^|j* zcUn8dPv|};sba^)wW^1b{or3wPcJxrxXX2J-B~GKa`9l{e-Q z+^~YxE>1c<1`amk@;^xg7P3G_$?szPdPg;74|kYH=|JD&LSk8LCjAS?4^y!Po_<-E zKT4-8nD=`gJZ!VGqyhS;v~(YUEX==DYhmVyd7Azf4H%g#=-1pBH$(Bm#}PKPR(|@& z>UoYIeo9;}*E>2$7~)@#(IPi0#Zl-We$~Zuj_5IA{$-_q0@!*HK0oLQ2efsdz9AXJ z4}o7+OXtkZ=0xOgM9V&4Q<^mYO7({L*SVD~?oE%t&3HjVuC3-9+BiV25PnUl*3S5t zxy<=3^RG#B9vyL7M-l~5!Y_InKGMee{okV}T=?n_A)cTUM)@-Qs%dchbCt;%PxK>f zxEEWXlRb zdHc@sL%LkTN=y>`Ll^GuNp47h@7l^P-gnmk|8kqM2=g||A9~xgf{x^O<>QDS8r~S> zzn*fEhs-=|f+vpob@zYtCG*j};9m|uXQbkAe#mh~FvEIp3!G?N_1Z}V$F(=v}e39=!{wp~U9S|k{WuKws7*_tn&cPhSL81q8WpXh1<^0Qq6xz;n;~4e} zOf$%Tb#nd-t5KCV(+YkjmZg`UGdKVXIa-{v_9gbgElgkwz?XL*@Uk9?mJ0G;;}xqF zd=httBQC-jt9Ng7lAH|U=$!E5hXV#j3l|lv@dXzUNS6h*rWc3v7boYBu|aEilV@?D6woM4bNu|MKI99TmfLw^iF_b@njr((%J~?8TK5{^5R4ziQ_86;XID zU`yw}B4}LMF$1y({7dkBEM8}wkIR|2qh~kI$B!Sb1%6=*ZcpUu#+1Jo1$u{;vs`8T zORq)-_@!aXvC*)wKB4&GlLQOk@h{+40lxZ1qi*|x0=Sjr^UU})q;SSSyZC6iv3@aA zvVKA10{(>*lB{LgbqQ@zz^`^O55$KFLYRNOr-qnzA&{tc6=GAdE4Cj{yYf|`_+b#) zo+z64w_NZPHS>J@$|5Dfw5zp{7%^Muf2wQp@eqD(1D-CFfUQxv-d;EyTWQ`R*VDsP zl@%fULXJ#;f4vLZrSWSXeFJlbRtESrLIZ^Oj}kwG$lAQG=0zBQ>|y+ZUc?4wzez8s z7IzEq3yJT{1JJJkzt}~GsRZrnIb)--!#vDAsvN)GgN2;OwCf0C!D+JrvAEWrc%c|S zRFQRBOKS?E*@L8p>PP9P-3^1_%Y_pELJVYODksR+HasWN@_SB09=lxd_SA}4UaY`| zUE`X87>Uh@+oTmNiLYObU#wP^nq4nm5SVk$Y!-~muxzf`$!8;f`4sT06_hIW3j6bn zU$BQlTgdTB51TlC=v?c>C(WhSv}%2QCX*VEf0?29;j_If`FD*0%Cdfi`4=Uf{(;IzX<5In-zYeHEjWq+|03kS&d@Tl3!mBkMs*W~Qogu~`0 zCVx0B-=b@W%lX$CIj9nk>-;<9;-CTWT_JE6iXRSHsNcA&XCD2y61sDjI1Ih0A;Nc=7cQJk~spjW6u6~Zj6fb_*luP7iFQB&-ROZ{} zxHzN+6^K|Ueh9RxP7v^Gjm84g#p!LPL>d1=w2&?2d^*^#@oS9sm%Lsr}HvG?O&1TIq(t&eoexCE(rrD*y0SFq}! zegjaeV3xtZ1ZrG>Uzj`_>a<(NzuK`)Tg_MKtkQFSL!4Ua@h|VJa{b0xTI|MO<#Q;s zfMfI`4axX<@k2yuRJEhS5in?l2=Gfq&*NW7nVr+tXYGPoX(IM8rC7g8{0p$o+7#W< zxr=T?+(wKEjvq$BzXJRMHf3boz6c<-W>DV5LBe0rUw5K%CKYj5cCO!eC&J?Newoc6 zZ_2QJ%JTV_HwN_^Q?%TwQf8K>WNCfubP2yA;9qLdHme{~@h7_)RBUI@I8{=TZQUWf z2tS&CQOdnx9>rGet; z=hR{+{x`8!`JQST1OIBFbA3$(#1BV9@x#c~w)H8V&r0Cw&E_rk9;$UQpAde5Gm`b` zu6fRG{OYnvaf@UkhA}>VWp(_pUSS83FtQwX(-HwRhm(x>;Ze_L^WulvPiU~t6b4z} z?}(hHXWaC%F#m#^VJGa_6LU_t!6xkJMHPX(ln00S7d(8C{*l?-|DMz2{x>+ukrOm9 z5)a1@QPq%k;MX0j`RVaRV2R-F9^kGarJ!vG}8@YbtDUdageTOve zc>D`!Wq&-505W_MyYjFNPuQJNiXU2O-U|ioPJ_KSx-t0S=xKC0ekgqWnr6185~HgS zhJrmbyBNQ;VKm1tD&d!EEhJ8uU&qF^s`&o8uhFrZCMM34-hL_Duhw`x+5iC?ejD8& z((Z;ra^$@FLv|r%ZDjJOV^*sj%y~bo-*KPEY5s*{49Er%YZ!@c>q#^Jf_G7@Ka?83 zumy)>TEG)lv&l%U6IkW-hr@|(U4Ph8fKNM3Kg+Sf562I&K5iniNk3;aK8W?fF7uv_ zdV1>Tzf{b{G@dfjg{oZJG<`Ipf%SxkJAVGljafKjkZTx+Z30FHk_PtCt4 z0Bgf?Ar1+Dto<}QFaiJK`a`WLe}?))UuFCZLcqVg{MVwab%~xc$m2S3h2r2Rz_*Nl z;XKdvWM2m-+1p&m9_C;0;^6mkvSY>e_}gf_hm#4%qr83t5YP)yh_uim^&lD^D1`Xe zDT7TVa2eaw8L##l=qbZ5rWH2g0B{1c)_)-{+l3Pq#xEYjp)*dF=|DXjxP6W?ei)zqXm)It5mn5FYy#{dCnjH2E~6R|I0&H?}8 zUm+a&XIh+A`H4{mG7l6&^@m))QMIv$@e6V6yhtk4Ik0D5R=)vpX8UuVVYl@;K6%{l z>6gxb84dCVP)?S;9pU{QdJ$N5AHQbl`TSMf_NLK^LXI89`Go2>FvD!(n_8~sEaHc^ z)2W;WvNHbFV&9}T>GiSWeZ5%#nI>Xo{41?u1#>OVMk4=-XZa8pGBro_4Xn4X|v!7Yr#KZHHZl=H8K;q-v1 zC!b00OoBkkA+7J;p8EMO$Q8YV1#}=61ms9*8GfBJ*h0pdEi@=`+&l)qx7CeL7Wo&~ zAL>esTcX-NXRuAvOvLs9n?n3ck9oke;TgoNCNx>&F`muz@r$jx-cv$Qj{RN@3L*aG z??syDjMITRbNmpJ2K;N0s?!V6GW_B!RTYb~Pogk#aqr>C8Eep;d4BwG zSiC!Xx)OV#H;(aZe^m&--d2eJ>;vkhpyaVf?z+xjS<8K4{ZC`x~BG9b?5G zK~JfEUfietvT)l@25gP$ zviTrN6W|xB4P|9bOvPTOW%e_a=!0A6JMCfoavujTsH+DZfT`SO{z5S$gNIh)Uy&y$ z)v@s(#QgqW(Q+C477{&ANM;-Xei=xO(HG@5Bx%;a3Hu_>#QTZi^TX z%ajCc4bv{^NGpV2Tuq0v1h0O+g>GX0b($LIfnOBy>yls6Z;|5w{~C+Dnj6es~ zvKoyLe(l4vh7Dp-5-4G#EM2)~#~)!3EocwBML z7AiV;&e|7c{Ngc}uz&c3wSXZTvIEhgCH$H@CieXq^Dp!E$f?dJ{W&wj2Jyp`v6)X4 zel>f-IYmn)j@DQNRg^q9gkNBzHOLV#Y{C9ueH>=2A^uf?vW;8oavvW@ibR(k<^{)* zbwn}1uTN5M!O6{7QXQAqLcidAzaSA&bW8jzZ&cBJqKrDY>#r*60YUyFRAsN!8ZtQPNxOqs2+H8(Vd_~CoT&(z<#W%$KNG_UF|F|YGkPBgcRW5(moU$TA$ z{3}PBscwHqXJw7CN6dFO@thHL9LAUsej%EXnPCeHd7^sg7i*gzT?QVn`)ht zOL?k?QPU3N0DrZJU(m1p&-5pjfLESzmb=g|5KK?5fPbB)Y1Pyp-winSA>gbRNSrj> z_6)C2cO-lJz$MN=%>c~%vuqFd!XCb+7O|lY@Jm-LC`8QCN}GaRV$9(xZXQ#_FQTU+ zj>5@|FfQ|+4pUBPxdQx>(62!}2X;&Y*?>7=a|Qu&1^6|IQh(-Ob$*@*K*kY87l;<% z*J*i7wK~|Q6WF-c0s_BWztLLg4dE9MRy8neO*m-0j+)7<G<#^5r zkP^Oba4##vFNF6ct0(U8cYv3+!A2*19>QrIXZb>j-OGdAZQfitH4LqGo&@GlM9KS4h zdd&*BGeL@)UHG(-$O*g4O=Rj`_VkPMUs!pGsM@5^XAFGVIw$^?_iMB=%X8NC^K9PP zoNBoS%;P-=jg|uZmY{xq8>5wirW~U_==+Ub;;3^EKAf?__(guTygz3yp1iwzVPRW{ ze;s7mEgV0W)Cgq13i{QHb68V`U(gi956uxeQ~>Q7Gso$rHHZv^_}8R@T%_f~MlpW< z3zHgx6k+^AwIM#!8}sury>A1**oubm%i?N79Gfv1YE7x$DDsOC|9TA7hOtp`lJ51! zFn%?(hxylB`T;#GW1Zs12pfWSWyJ9N@h?NO2^T`^sUA{O`DUJT5x+S9<;~DXjj`X zbt_E148Ojk7G+~U!uJI}`aj^(pZ$8?cpwi#|nMNRM)SZYi|KdWD+)KQGf%reRKTxw;8s6G&xbwVn@_ya&{TShK=z&r)Kz*Lu+W6G=3s|)aJ zf=;hNYHX`H?&$p2L*@ZG(~pQ^8UON95{OXg{MTgfG8hn?!^trJ!hX52$FWU1x3x{w za)ZM7l~x!t5>wS95k2NxiTBZOZs(9&118gC%r26H-K{skkx8{bvpUkzE5L1wW#huxo2I*(}-=n1Fp6*L0= zwHg*1btxHffaU5-EfcG0APfJnxhI5QTe@E#19N##enTzHBNq26T@Cy~!;jA+|0SR6 z$he8c<}m#WfDG|NB*J7D%N4?}-`Ur?iAm!awn-Cbzwo9Ezo2o2_(0t-7OFW9x!zKz zS*~T_{1?<}e~R%7pPVQ(jygjiVpdl;|Mj?9$TLKKSuM)XVElTV3+dNIyU5`qhWdFM z=WsuE@Sxt)85yyUh6+hHl@Xuz_MP)z@3}1loAc%==MX+BuNpH)Bns&nzy7+ydk%qZ z&1#v$n5)?6&Ai7zj|U15kUl?_4O1Bfoy?iv#@kxjz`rKwM@9anpM&}h8})TvK%xVr z&9Vn%$xdXGL-+-Z8^M@w^O$VxejLbe>iUh!Ab!YY8%}4;7H>rST8J^~Ca2wEEMU>~ z_sdh1QCk#B{k470!(lj@&nM$y{6bjczh^P$cVXw*k6MLnm#wiN#J`wD!q3#O#i1$& zg{HOfQL`+5m~=Xn2wUb2{Qz2G3IguJ>Hy){L6mA&f{HeW6Fmu z#%|cdF#kd&Mq_(AXa0iMStkCA$>2LE(G%bo?0lr90J$_SckrB*uE!4ZF9*>=3v3I^ z!duzh%X`}BV0}vXMNjr66~dvX730^9JH$9WDeLkGrUm@#6EvV4u9kn(d64C@D)Cis z-YFoe7T{M6JuT~cae9w3Y)OxQ>HJqufL~Y0ll_a|0NXl^a*GvN@UPcsQlX-wqr|_y zqb9RY=OB*$&Q~V>5oZi>Hie!L|C&}q9EN(0ey&=xRTHyYtaDCNHeA2)O+rfRd3^Tu zWBE_^!glMrUJh*55oQ?R*H(HO8V6{brf<+9IRn9v>>e8#v8)LA*9i0rrP{FS4s1&n z6}hVkRd5ok5yCI5>Lh09IzOf6yFRhiTu8`(^L_>R^#)eHwVJny;kW}E2f282cSBOG zU;6tm(K?o33km#^akqEcIp?mR_-F~gzCe5X7CEtj>R;0LjD}$pj!w{1Sp>8POZ*F! z=XS#=Y^Jv1(i*6qutCHMQ8u2Eb;pWm=E8CT3nDs1fS46PVP^=xvTOld%z1+GOTv!n zIV&^*{FLD)zYy=OZ5oN6c%-@iuyKvp?3%Vh0qXuZSb)s( zd|cEYKAWq1qkmeoN_?AbTX!cvEKx{536S#F2la=}km>B}$N;vw=hVBFU1@=lIWErO z@oq;yN9Vtih^AJj?S2CUlMq<=dwl-|yqNUz-CVzM4&|Nk$+~8gD=&58J7W&&ZP2sP zbiFYJ<7o@K<0iU5InU%;Iu>oMdsm{C#!b9h#IKuCe~5V9Vc7Y&h3{_M%^=|N1^)i4 zJHRg^Om=}I26zG0%aka6b+A^fs?v-!#XOf)WfghQCK#79Gr%Mm_)O&T0F z#J^gG_+g)_bx;C|+q!8vZNtrYU2j~gy9M}lQI^N(`a`GXXyWm@x9N~*R3FMG-xM#Xuee}9e%-RJ zKeXT$qHM$AusqTP?61}qQ2ALMarim9{%~MnA@EGpf0#{~WJ=0~R2UvJI|MM49oF^HKzX#DW>B-|*3@U{4`8 zo#^X5PE*!1{Pj>7|7yv`bF*RIU4#uET6HDtDwMIh?E5c{nCY;X+AdQMMNxR8K*YA< z0~5W@H5K(tJ-Fg-jLo}*!LOH3*qW?W7WIqqtHHfWLqN*;xYgJb$wR+nthz_c)v|l_ z^DRzQzj>S{^NlGl{{@FC@m(|c{tM<^wswA!%azaWZ2eN=)!vhcC^mE^M$O~iS>0AK z)^>0^zGB;EUa1iHZI9gk}&r#1m+{^cGMBvvA)WN(fZSa4E#YAJX`LEs? zL;lM;BU?rp3uww{ri5j_p-xE%__SG|Ea6At`{ftCvUwCmh*lSNK0`>p5G38#uJ=6` z`5M8WKMrh~Ae0M}H7OQ4Pj-NjZRiQ&hiTDmC5QDGeMC9Y>;(-(fjaqJ%)ju3EPqR- zKe2aH6tx(?U`fRO2oE8J`a`G#uRP|Ay@1=3F7A%&?U(-kE27a#=f4=XxV8{;c8k82 zTQOZY($`u@oHEbR5x42~&8N&Y0BF5~lSTe@R&8<+KZIOpI3w1emFh>Nog<2q-a7OB z8@(20*qA&_n~da$)hH~7Yt=C46Gj)$nd|2@-zFPf+Pp2cj`rDu+!Nr}=3*8P{7b>SzXB3^3JnNY;$PMaj{lr9veAw2MqR-{ zN3YnZr>7$oEzTy1-QoQj#54e-AEgbF=aYQbvvpj*(JS@JvkQ@TXAC4$)GhNY*J*FR zIDV+ZhF=x0&DqmeJ9gESxK=Wvfssvn&jJ4uxPQY%{O~ZgDKlK<#H?HQAtQ#KfPeh} z*zN5XF7;|1o_VJ^^{0N%Xl0hyXJ^G*%(7j4zs$$GivkT!Ba_rJQ=Bu7POxfGD+0lE-Wtp%)D5Q5Ttlwzh zYK?K)NJ$W}wiMlm26_ViwHi*3K4UMzbxg7oi0>=+Ieh8@{)PA<`(s^gKcn@FREP}NG#>Q`j@fpz}I5@;v*W=bOrqDoPBPzwZL0x zy{LxxGrbHULd88L{PJRhcZ!qRm#FF#Hr+i3xve{k_(hbX-2!vYicvx$jDWcp!-r%k za1I?ltInJe94yH0!162CSu!I6Ea3P&WcTrFC*m6c=04Y-8AbvtMThz!#en&?x2Fmh z)|{5QXF~X88{^^(E#)x*|3V6hQ|cUxdx@Gss5Xta-x+7nx=crn&&^Be? zM~^5_#b(%Nwvb6bzM(1>@EtGcfq%%!*8UudX1}S&Knlsv@%a}^F|5Z}xoQ&kdzK`K zA7=R$8r}=9tQQvr)O!gd%-Pg9n7>@370-DREBynyh`(RfJSD`xUZb~Zv52?L&ZuE) zmxzCQ74KI$e!Wc_Ujf_V??E>WFPO9*6iEXAV*K)DXZ-puCAoA8N!tj{s@)TTt<&eQ zRKF3$F?Kt0R3F(u3uFiCH!#M>uPn>X{0sAmr`tdS4?9hA^ET|)b4ue^kpFrb6>iVE ziOK(Mn)5_z(NAJy-tL6)iw@D?ocNB|RfNxJT@>tDSp*V!PXqjls~!oJ`G%OkzuR%< zS-Us-AEt%kho2NZ1jx2UA9Z&)G~>yr;9wf>j?cfc#uc*1t#hn#@ua*@)fHy^J5dcR zSjgy5iXYN`%8aBlvo{O=>}%m-GvXqUScYFLS1WH*C%YMPCh8BRS2a}1f4xm_MgYe) z+aJovd5m9Y=<6(3fL{+$58TvLHd;gX(05d{Gdd^27so+&O7$D`j|x$mDbXUfV9u#^ z)tAy9SI;?Af7oN>se^DKr!rFbh(O#|^rJ%fbsXZP^O(kd(qY48u5TQI`VG)7$hAen z0^mD(E72!7dT<3}K^gyQL{!9Jxdx@jQ(!a8?~g*YM%LOEy;5-5e5yKHulz($IDQzf z%UVap<8-e=gUN_LCcv)LxpIV_t`QEoOJym9K|qx zfu6Lr0RF^v^bS5--tuSQU#QIp;nz0fB>gI%@%dLC_g!?FON5_q3dIjmEsxKZ1?D2_ zIBe(;=f7qs@k!6NFn)bs*0!hcsdeOT+vvoBj2PWUT3*JO>tQACXJgvcaa1g|wd~u( zmBt2ePq5MJOZfFGpjBG)FRXJK2gyPHbR{r1z^@&Et!HGy?j1(3u^Hk(zW`(`S1A8= zm=;qUdO*-q{_HESe3o70U&bX8Un{Hl4%{*Ns$80@n!pEKaN5i8s~u-Gi>lvBMT$~n zEss`lCf&U;0|oZ%m@yCD7qUx};vxL1-kl-wVThl23gK6;+Lga|ZR|dJUVSv*z7~ZX z2qc!_*Jik!kis@$Jh`Ea3A)y^2?75)L2q|2c2=*!wFw8*;_T{i*3d0;1_Jmnj7L`rONNi z*Q7|yl)ZMEZHpg2%){q@lWe*0p4e?_B#St}Uhov(!w=$zDBBP%eKQAoAGLqOWrsUg z`QI-G_{IE-(_Zl`f=-NI2=6x+z2%^O;}e81Z#DQk;UMjnRjIZsNf&7hl;Vf!PK*J^ zuXJdGk(5@ySQLyY;#XYsVwYmx{`3`-fDY;;i%{p&_Osdxme4GTgC%KzAK&bcY+vVSXIT4(w zFVh3}=k4#>9HZu_nj@BZ`sLMc)H*<`KNtAE(pm7e%8TV5RaLlbTv*Qsc)2WdaH3>@Pqmd@XBY~aqY&_;%}+7uj(ChO6vV8!~*_>^~pCrka*He z8_#uT49N9m?>y(j__e3Awm-I{rx_{({pyP5Z0-AH!}zr)Z*a~IUn5W^8<;?a;)fdy z9WCUvS3@?HyFTuZ5tT*#0^4fWDWn6`4P~_EReE1E1BryEUmQPl`+!y)KRk-_vAW+x z#gB(yrTC#ZwGT7IT^8^T;mRKSh`xwJB7RuLzqAzB&|AO@#27ukgN>^U^REVGTS>rH z(ui#oj=}sZ9Ab!aARE#9LMKp`iTEM&uSB=$ zz$XC_bIoYP;q#oTfGdlzA;%BZMhCQO%v=lnVj?D@-d^zcUpQKP#&p=w-Sm%bo59H7 zS*0+hlb@3}u28sHn!T@EB!>}j?cp)fUo_tiZ&~sfzW?w!Rm<_i7KQJZZ$}*aTL=Jx zh)tF5-}rw1jC_XkUpoZSd7Rg~!y{rr{1El?&XJL(Nubqx^y|K+Y+?=Y3-QA&D%=A6 zdI*qID>0vw^kcpjd!?8s^%u=S{E!eoWQ@a@W2oh;y*}nfZy|iqOo-3>_~jtJ0S|u; zWXGKo+Ul1WUO$LMEvYgfFmU>SSM3OxaS-GTWe)rtlf8qHX zA^eK-7@=cUsKHa#&VSzN-La`k{436TDrc}hwHbx%psa{UCp z1n_hx&JQ#$SIU1OykmP@mu)wiwfpC4P?--5PrR@z_yNJn{drnA->z;p1^`)ugG#W1r(ev!^rvb$=3fAXe!}29-9hE}^(1X~Z&Ypd zeH$W4>ewOp`>%!`tVRgGU=Q8IpmsA*II2vc#&az;ZWRgP7gm0MqJXlEY1!HZfS!~; z;~Npf_~o4L$8!eiK(~=6iZ6NOxHHn(ax*I2Mm_x+saVKi!xNZcgu45k+pN7kuTyNa z;bbhF|Dr*O)DOE5;Al5kHjZBp+i)uKFUGHD)We0?n&_o;k9v4VYMpqE?#V4g4>nHg z7vt9njut9htOb2&5C9!Bng5_L!s$DH#D-&}{jU*`Ia*f@}SvjTZ!AiKNo zFS6DxB0~T==xd`q{*~mcP=H_B8^@qXR4GQN9uy#>A_{~PjO zw)V%o_~9bLov0S6y#9j-9{;*5$bVTCuMjNcN?5jt@Gj!uKw|g8>}6{L{ssKvY!}AV z1DC<&Ub%D$-Rmssh`n4MKWqWC#pc@wJGRU8HpFcXx-DHXRIi2b%hH&uY1c{s^st9$ zx!!<(4bV8JXqEXoBH~SS)9|W{{2IQHy~&+j1^DO{7tue8vm*J7 zr7Aio@20z9!zbA2?TbD3k8v8ZaEwCn!xmscP*3|X#Uy+!U;$FdrTUF1{Zg&SC;qef znpzJ(9AU#t>9?AH^#<|7N7=mN+kf+|JT{k=ag6bcX7&~HUsQ3L5DLySemQ6qkVji; z;70oTa{SsO7v>n7Y=$I@?-#}HFk1PTLKLb222~_W3e4F6e#tO?AuFU}ndA|PJ0FfC zc3LHeSul<-T(4<+Vv)}G3?jK=qVua2hN76+bH3BTwJ=zn6U4%g{ZOJtD(*qs@{ zt-pJrXc=B-0}+sOk=B)o$yLo3>)@6F^JM-#r!|$>AI7hzWW#4RaainGTI9xDF|MA- zHcZ8Km-ttTp5kmW`?PzrpfC!-VQ3sKs}}`tPyO$|cnr3Z;h2F8mW0CiwU+lnCh$EP zV5^xAk_KNFh{o|J{P_1DVhq>m>5tcn2E;Al*R*p)HaS=y{2>)%*TY+mn=SK>WDqcU zxx~MwX-lWbB3d{>k1a{&V~<34s4W@XAN9{YCH!)FL47dQ!>Y-009!r%POk&7n^odp zn{m_rc3WdNio~4Q-i4cyjS0GD}<_Nb5KQMQ3tci+QFq=G{H z>p5D&^@oS$JCvETdSH`-LJrNyO8g6dKLxlvxoVpJcC?iiy>6bA=wU`y!Y}ngwj~9A z%AeQ|^1grHdBJH!_O>^;f8!tI`c&1h)zt==vN89pyrF#0=8bG zU8**N%P77@@N$`vh48Caq{mPVbr|1wJI8TsKvltOoa^oqDlml58>BA`ubYz4z3W)H_AlrvNQ~Sqg+*n zUmNJl1@MbE6z*q(5#IC#CK@h!O8g6dLj?N8^&9+Y80rtNbUZRr!Y|FX*v=m?c1ccz zEx3-5)8vd;fM0Di(%pdNoeii}gLI^yFXB**NRGz>{Q4!Gayh(a{({cBIFQqIsOWGJ zi#rzPUyy>Ma{xQlC_lEQ?lCPFdP4jQ?w*1vK-pnoI}%}tOXT4wq9??^x(%J}LfK&l z8W;EUsczCeCH^J44PF+=zDwW|lH7uC>%Sdi&I;eZf$(gno(~dXU5Tx;cL?;Xxrp!I z(0H0M`ZzbyhA}u}5#+yeo5m1GgtggL&cC2d%0x|R63cS8zNkd^l<}|aYDQlC3JxCB zYFsRHHq!RJK(uoHHOY2^hFpiuV1whIv4DTgb9a| z7IU=lHD?-WubbAvAxFC-jBJ6&iG2PgF~g&VzJH@DI>+%D8Ii;G z*+KmVs^v3~oo|qI3i#CM$|PjJJ@(P4<@tx;U*d={nDnNaAAA`lh5GNOz^a@6yZHNM zRH1nFhv1bifD92uXk09aA9DR6_*V-5>LmE`(EdbcU9&`;LsufRirO{C@%PKH#`srl z1$q=}wP~tu9rx709y-$IIjf2^tY2~zJtGn|3~p?fSZLv!YqptA3BMqPf?UH!9_|Uu zU_09lphMKxFTQ{N2qh)t()lkqt;xlC2JYHI0A8mFFS+LQnH3?0h{gRBRkUgD<{dMrOWJ#ILlD7Fv$@h#H_|#yWv~ z<+FGf_Tq$(Ux;sLxd^un58z|NWzVovA+%h6{YJs?uHCSH0@&KqU0bO6D!7dPqa@+_ z4ZI!KWe`enCaEzR&&1;PZ|o&*xPF6ix#i_WZ0m3!3l~AZ*Gugmo}jEghx9GXaN(QQc$E3qBaZdg(V6c0 z{6a?If~Q}){*cm>9n0`>5{@7CG|79K<~=QoAGT6_fw_RZ{FlK*3^pNDzX1qBT z6<7Ccp-0-I7wa)!W~=^uQNJP_&9GxPN5Q}3!=1rJ95K6XzroAn*UvXQm?6in_y+1Xj7}co-#?#8)BwNUQO{%(53SPo_i99|?9yW@G)K!OMopxZ!BY@k^ZpRn zhZyzrnBx8OKq~>ga2(_mJpP3qzkZ(U5B&@s67AR@#AFZ<;FwIfeuGz|&Ho!=j;oh;2GWi1#X7rtR-VP`{Dq9kjvvoupU4u?hH2 zjmAZ4RfvCawhPh1CfZ1KWF6MQnWbuGdHn|4jf_ahUdm5eE41AJkcIe{&UQ_tx}tpT zVeRuZU6sHuHQxm~jC*^E`+Fn5>u&v3{B+M1?w0)GH`6V3SBU47MznJNHHtgEVPtH? z*>;X-yWPu>hZg zDBu_DGwQ>OHvAb7mQ4n@)j(0dfM1@?#25!awjYBrhWXb(Wud5Fu#kFBai-B<@m*HD}VrvXcAaZhF^MyN#GZUYY<5E=lr&(UmkvGR)T8} zais?0Y&zfuDe5lFe|a!*6Kc_ma)s(Q{0d|Tc3vmKK*YR;k6+>ZS0wcPm&ULCW%(~i z5v{j2c(Q|pdJFZw_$4uUc9wi>3dawbZRLWnp*be~F+u!L;}`E>L5y_h`e%Q0%fJ7k z20wn7)j)>tzr3D9o?httdnpaOfiu?YY9I^jMyP&6pWeH~F@}JGg>PMo=edMmz?~J$ zzg|M!MROqyB3A4v$1l&k>x<~2L`6Fv@GsN@u=ShnZ6Vapvl;YzLiHPrO@OUQsFfe6 z59Z@z3iB^tn>GzCyKAZpdQ()`Zd`WG-UMkMH z48QcRCM>9)HV(xx1y8@2fB6;?4QsIrKxCexu^^QH@~tuIvGckfJMCkWDAmsgHk_WY zQHRuiUwnVBwpx?e0>l9rzk<4y^7tX6RdDS_Acc=# zbYLa!!#-wT6RFy#8-IdEMb}E*<1Xgu5FKc*xYM{re$JjdtQ()!4VuS2?&3~8MhU}F z9r){&k)8`0%F#oBYep6qxL!=xDZf#HhH(peDvDzcbX44B+@e0`%pEB;8jaQ5Q+(F} z2@+BEhoub_^c3gZ5lI@BYIE%VVnan7uSXTfe7vHqyEA`tYHqaH5EY&3=7F2jbEzm- z-1t-aj5{||vD#~Nq47DA?yO8i26B;v`yU~LNJeaGC&NMmQD>r+{+I(ITQ|h!n>hxZeDfdL?^xO;xzj{SfyQ-*w>niaWb+$$qY;;(5O@_xX#w z9-LKgeXhISyi*;^ez>OUdEK}MgAMMvrl!iBRU8xi^PmyAQ(4(nHFJymMWRftYPF(e zpmBdx{IhXg z8)Z>FR%sb14Mam9*lag%oS}+yZi_hRY2!L$Zs?73u!HC+jj52`o%nMFa|JgtpNY?H zGvvOTxrh9Bk!f_gH)rO?D^`UX>SkxIRU!R3gKV~ut<{$sP_$XlFZ5J8P<-#_x;8;d zfxB8Du}bBg6gRqcPw`!lJ!`Dd+7vV{D)#tt9gybv`o%WN(=Y#BL=hBD(JHdtQlksA zaN*y+7ED}bM~Cbfr`b{A!pf<;5l^_YjNS%XE)D% ziXJQ{oIILZ+xo1Jv*zW4?U&lT-Q14 z=E!G^xiVFYeoXtKW#2q%l4Bf$v{V#?a!9Q`( zMlj~uuYdCA5AGRz>l8O0xMu9$Q`fHRcz*V-v5Bt+V+_$HAF@9jG4}b58Gd8l47WHa z;^T6Khsyy#GcFg$h%&no0_d8EDvqH5J>RF{53(Y68S~V~oLM6mG~EAt&p98LeSpr| zs`#7*k&ky*=i7JAy0GC7vD`Rm)0Ht+U(k@6$}qA~36}$a=7uypw~j2gs5azji;ish zic}gC@o?r68lgCu5} zQMmWtLd5g@hO37VzpD&S17Jl%dA3&?=izeLLs8yyI*mW{oZ`D=q|=x~*U_vC8*SdZ zI;fIXDmxpgF)nO)kD(4=-1)d1^!Q^W@brCf*+XjSV~TNo(AM^ zUfii30xr*Z{(^=-rt`WYzRxY;dl8`b`)ha}E{F7saasRJ$bPG;$>Ju#doF1BW9YhU zWF6x8A5*gm7c`1z1N&8m%Nn2^52=gq!hV(EvMd5LdYM5NfL;13AV zLq)kv>U8I1D&oef3mVdY&Uv^T05mteA^ff~Tn+%58^w1S@^3R*1Vo#q@ma6w~#@m;GT*?l#c>*KR}FK8%# z4Gl?U=0p_jif-r!Nuz_|m{C~ca#=$a-zD2SXU&ORXUuw^MsdGFzF6Rtd5z*;Pzi+t zI1U=#tFT|6F#lA(GJ5rrstX&kC|Ab?5DpzGXj;o8fT-I1w9PRrMS5Tr>zh^Y(*& z^O3QiUILG!kTR#`0JK;}{{mmIaw4PEZq)xLvuq197RF zy7@$!uh&U)(^n$_@(=Mq+{8`Xtg&$tg}Ckbry#(EV8 zAME?=_nbL1vPo9f`qo|du2s~v%Ffa2bKbwbpZ)B;-&Zs{TJ-*pNV}Ql-rD!)H~*ij zZ(Y#0=H}1+*{aqrd~OxpLe*`5-JblL+ZH90^f?N*B^O=2Fu8bPvW-^J?6$V0ZHt#) z-9~>#w4?7Fe(w8+Pu`j&sS(kvq?YFYT1m~(NOmnqlFR>_{NK+`5}ud;x0WP9z0~qK zsG_%pVNmXVy-o! z$8!Tt%nj%3Can#GCpq0QliX$~G_G%_7S~GZJmy3w3r zn+~@b3w4<53#}>Z&CC>CE6^XQM`#1Jy5Svq8#WMr3ZakE-7?`=9lD@B0^>^RCJpEb zH@sb6f-Qz0N1G=G<${8>w(6(i0ohbA*6NGt&i)03@RV+O?@3t^nxGChk~CJ(8Om zHJp0}Ch2j^561Pfw_d5*yXX#T8VvX8_0FBNzzwJCp0PJk69oNfZ=PNHuG~0y^Y-wU z_0Jl2%F7GkRMjt>JLQ#y@M^tC4u30EKW=6+u{?$x!Fna!k5qNPmK>1tN3pn1d+R>c zFicP8>IU)k)pUgB$xYjhlXN7vG>5e~<$Wtfg}N#6h>ayE&@^=t3;HxIX5ne5Fn%oi zR(W`CXCd-!BSD9qP7%o)Ei{|jL?mk*@V+JKgS2i{>ssp)V->9%Ywfi*>zC6y5o4i1 zHovDa)S|7U*3s%LmT4U&dae447U9A<)!MLit^;%*V2zo(bd5c3M)EbYk zua4p{FEpqic=&;uI@f)*Y?oX?TY#C^w!={?&VNbu}G-#iUKa!5x#w4A# zIz@CV1nxYP@xz{e#qC@prbWkWcxxING#vdX&yQu|octZBkprN{mESo7$|vdghj%YQ+?m0h{SRQMwLh1`=%Oo!)t`ej|ZgHBVYyippj z^qz`$N^IIGI)x|DrURaSiO{ojqioMb4ln;ZdQx_!qbrTSfj#U>N5-%L)S3?0{yp6e z{jzS>&(IxWfe823T}8K>3j}&N-?wA5mF}>ethEe%M&~K)>b=e&E!3@*=#9gBBV9kL z52PJwk^Ty0sFlLHu92h!v_ZGLbsuinNE`H6GET;sZr1lrdyOyXkLNlI2`B7-OVSH; z%I(ZW2aQ+hwCHqi++`eZ!AM;Uu;A&JX1}HXWU!s0Zn%S$*JazldFIjy2PTQ^A$ zQcPG_(X6|V8sG+;|aQ%0xxHnry# z6paACUZqVFt%aHq{ZhgJo$zq;7wAEWeVDJrFPJ!C#q||(9o8qD(>Kx{-mA$9{IVGx zW)Cw=$nAKKew-fWHu(~MiH30=PESM_YiPf0|6!wzhU55b^toRq3Lm+gR?x0n;u2Q9j9=z}Y${q`*5`>k0c3!HdGxQc zDHmQ_iC>RV-i_FRt^F3mma#&Y(F}`?cyamoI&1Wz^}$Vu>rePek5OA=jj*Y*UQwFi2%RM zCnwso(ZawK9g$dzoUycoU(cHgwuTgJJrapZ{rM7*1^6{dC$L`8y=>=YhX9bhxbmd4 zSisKf-nS%N+Xvz5e`?P4rQ>K~rFR$X-UM(e}BqPGdcgfR{Qc7AgizuwdtzarBZ*Avv~fx^k*&fe&EjYHmgF@6m} zN#gz04h^v#lYrw9(dvXZ>Q8!O2Y#9TrX#E+dc=aF^#aJyXLLSX3(Qq|0sI1FV>U+g z7FuVu3IN%pngj@keEe#dq{FnkC$iOO(GQExRCJ4hQAmYNQ$BuaJDd~Lkp^0g)5&b- zf#`0uIh|8&js*Bc3aw-~Mq{Fros%Y-wmNBr443dL^j_d{^XBR_P-eZ>nhocSAC-VC zz%TfRl#`a)W0aT(lm1a>Pd4GgZut0>(=MSqtDD^Q;yv}2^2erP|48=}dyFOg8U}v- zhiocDETj74KbF@OHmz*_ECX2~F>M6+wGmdLqd%HkUSJ?Q5WRok6*`rMoe%Jf*dEI3 zo{y~T?o9n%_Oe1W6~5Md!tE-+v3I@s8Lr(*x7!Qck1o5X-hF^Bcf+gn_lo}o^9ucX z*~38sesNcUXpND7 z3yHijQNphgI<0}86qla?kafA6`YxVkfCh6Z^RJ!GX{K-G_k=&MGmne#dmLW(vCsl~ zG{-alp4WuxPcgF;JY}(4lh5_l=9(rJZQvqnj z6lOu;J8NT0Qv>pSle5=i9}50f$|8EhNxIRbJ}w5ZA*1sxdu^qu=m%o)RLtN*nB&Ro+iun7VGdcsju8hyrwbli)R)k7wp6kuBd z{&k;zMB6Q~{n(XlV__{l2?2;!=3jP+c43P?QsQ4q2=MDwY-8Y8mdzOdqBF@_%-9t0uLSLqs?Ce4&Bb;#j5*K>Z36xkGIxobfLa}- zT_zyF)?4&`YMH^mZejdFSMg@<{Ec@GG!@3a(pDe2z0AK}vrf9os=r8I=00bQH|tNb zLxrG0m4_)I9*!E<4iDN!jXv>`_oM>9@}&E)#rUP`QVzk$0muUU8V6bda|76_(|c%_ zrk+&b*Ub6J>O1ti6(genzg|Rtc5@H?dCtyVWqMDV1N_>VeZw2hac?aMZv0E$lQMqE zF$B&4TLtMat^=aFn_!WSc={C&0k+(jgewdFMXfR{GY)}iGXFZ_=|vpzjRDtT{dxj> zOc{_?^7IRBdRZ@W+C{(uY-4XfD+stGhj>E4`Xb&exXrLNr~Ai4y9&{@%|8WfT~~;H zwRv9V$8u3I@-^dSPrs~7w@EgYunDiozhz->_!ak!-p+}I75McQy~bv6+Biq&Awx!I! z#7Iin!xshc3x=_-RsXrUm@Rg|zv9d|_{kJwoO^K|WbH@#O#HI24|2SwuD_;mfWJX4 zcv2nUR|@#m#_v(S1b3rDe~o~r`7-}vwxz6}-)9&`FCJBaU#Dn1+wLSz8p+%lY9|16 zk;b8e@LK}>8ncHeHrtZ1AJ7Q+7X)~WvXwo(0Kdj_QggbkHkkL_*uNH4xs;_f0=6!| zubox08vdcwbM`}4j4YWcI9sgNZmd@cziQ#Vi`{1A9>bwCqP-_^&^XckT<>)^Dcn&u zp`eY>S?Y2Y7UrIzH|dcyoa6&ECE?sw;ujrR)+rWdXC>&AND9O^n&2q5^;Y6nl-7@Z z;Y+CtY4P;76f2HfM1|pcB>oBWh@)VCq8(l_cgm~2gVifuQBkiHkpv&W;!fE#72x(06p-c0>8G0CXgDryM_|AGl40cnVbUTk>*tW#Q#|eGc%8-3)NgU5Eql_M4r=UPa(n zR^k`b(v`)^SfnO%w2$Eij_G5v z-GO}$;)gGqC;L0obG8_NMkfU*)i;eFu<(^i{Q3CF469^5Gn1;d`5eK{%Qi-80a7o*Xk?d*E~8T zo1U-v3j?$((@{u##dwSUOD1!PwPpO;$z2uE!MVp_JlVV>@9=Y~j2|-pdSb9W*LpPk zweF{~*A*hu10C|5Y|k5eu+WaHdrmH zKWg4df3?3csW+nYs!f1jV+6Y@u-sqQ*ysNf`19;2j==H<_%#ge-tErW7hVHp1Ys!} z2_VR>?XdF!e!+FTp)(u(zEK)i^Ed;Uti-SB%v02!UQtB+@Epw=gGsr{eB9}hc%j>q z2oQ;YwGJ4)vVw+0By95MD1x>%&_G!VUdZv;Tp=W<}RH!zp8oh zLk*ZKqQ%b@wO0tSoeKO?wCj1;%(HY(!tqEMNqH{Yg@rSUK5w#*gLcg+Y}iuwDm^SQ zu6trX?0Z;m_4t>=eI5&WTsUm&?5o3%vhOfCzTu+J$22uRF2`~SkS$f%5cs}D|Golo zjJ;?IevfESwCibDHh(R)z&;~J?P6R3|Jq0Aw64kMM2V+Npz&EpA$1TxWZu2_Xz-rP z?lE@2@^_BG&QAbe@#BUP+@E52(C^R1TQXPBdNVOmQ-NPAV6hX$U|btER*!ZMm}*=; zevN4JINOyAe@1bc1%;3NO#iF^5u3rk5}fTi5Ve={{B*eCq%kU9L>AbvPd+NFdTy0+ih;=Ks{qYEpH7P38ht6v47Y; ze~qE`nDi52CH#6XbD8S|tU7mosX(ser#Zw1`N<6a)g>YmsttZMpnteFXu>)1`t0c`#}5JP>Dd84&Fd|4o!u(% zB;a3ap40FTCv7#)->$xV@UVl#T!3GzwH>?!u0JmH`P<(Zb^I7(i8t9fu&quLITwF% zd7}LJ3GfU23sx)4UW?*i$Mg^2$$}a9rSyx!vrBtypI*Zn$95yYuX*xLME1kMeoiCK zcBiwzt;Da+48n#E%opdsz`v#pWW);B6)N%TpK`G3br_egJGtmOO+=eXklrnzpBlP)oXm^4IH`;H+8y}vXrX&{Ql zjVt(<7t*=xRLN$###P8WAR|^R;g>YmFlZ8zY_agF&` zct~%$X#?Go<2EJyitunWjKa4Yq^Gc^P61C2DD@($`6_zYx-6Xc`yA%|1EePO*)?o# zmAh2+nS1DUKI%44&}$0FjHy|D+{O*PMWg*)&c-q0EgON~0{B-S_?L><2mI?*8X8>M zgqSBx0r0CD(RzJI!V|9GUz5GoBLY_2H$1h z7>sNt|N197>@0Q=&O+#(VQbK6aUZukX7I0wy>2juC=Dj%VMRn~#J{XxBv8?jOI7l(^nSXEqAkX# zgCM*cS!95b5$t>g|JrJw;c>Yd%29Y+C$MmDpU1xt($PC|EAD81u@3W7z{ZZ#0cy*Y z@hgS+`~xPeggEew7lcp3ue*bN+5o>?`nL10=%KZu>ZimpPw+3G@Ok{}2x4)GXX4g@ zQEWeDQX-rUlvvXset3$`T3tILxmhpAk5DIID;!7t#%{Tj`IlO+6m4_-5R;eoT4=)P z6-)ff;eBY?lk(&c;##|~UdpbbyrKVaPDS2I_+{QIcijwa+EO6Iq9$+L;R4jpjWTgk&zehQY!ctqVcpz z8m^@}pPS3csXYv2CHz8u`E3)+l!vRY=*ec|1?waeu^IRU4@9i6k%~IZsy6|<@e1o# zC4O0qUvb7SKmQen!QYMmMG3#SegpWmjPc9vM_2=$SECSk62uSxi5{%O?!8+d%`&WW z5)g<655J6G_1~kDf7Y=KUw=_YURa>3m(xk1c7?}$!@Z%eCt4_Qr zuS-YP4qW5_ztYjQ#*_MEauFhm#t~h83-LqtNd(e)Q$w%`0t;7i0!#QMLZ|fc{;tBt zwZ>BWQMmEZKLLA*viGO8jP+O2n^%*NYZ0ZG&c@fSs{~CeDEf9@GU9}P6zADBz z)n}i7rR$GSW=BHAlQ8cXyTFhc&7EloN6jR6dbnY`JYaR2(C*Jm)#n`a{c*}4L+1nh zf(yaBZWqIr2Ej27T4>BWGl(C)C7#Q+rz5X(Y=^qi(dk)nddz8eBgGPa^_$nzFy&Uo zNAzD45#>m}`1>Cx4(F?6-WzcO(#A{RT>7Cq<9GwKg%j~yQiCo|)q z|IELzY4V(zrHc9uOpA(?9%rCu{uLh{v96HN)4a#KnSY(5`8@N-nJ&4AUBu{2Z@Wko zXVh=#if#G0JP|%cMTr3>EAn5Mmapws@A)~uCkuR^){-vbTDGUBW1$2+%H4o3;q~Vp z;|mCo-sjHG8DAu|76s_n!!qF->`Q!u$2Cu{(%Q}3dxz|b`V9qJelBT2A-s}4n|>hs z!2OTr%jmG3)gp4{&6@J8}`*@jLUM63d3oCCwIv71% zjvqqfdR6|*pP#JpJzn=^*a;Q&8;EAO(C+7;Uo|f3qn;DkKLYr5k2lY#Kcqdm%L}T{ zKakvK{k!G^^5#NyLNC{EU|JBz&SUJ@hgh%JQxJ0Qdd7&rU<-SLTX{RS+*a8L(Q%@6?n zs;}zF-yXmG!&iPh)2*qs@ai{Wu*PtS8C)>Hm>kP3jc+_+RMu~}@S0Q!1lz--#-SaG zh|R>WVHL0AaiPt`=ia3M%(bN>M~x~^zqo#5L~Nfwv_9i~D=h1#tRbXOANKTu@e9LoVd8j?McfUSX2zDa7oDT9b?d2@zs2<% zpfF?MFRJ~l;t59)i*wxSK7F-}oQe4r`7iv+Lo~n5NOwZO zCt-|pytS}Q9**MvdlJ#v(V;_rcP*j0Bt!)R|Y*ZG8dy5)48ao!r)ip*QwqPhKXVEYoX$+Yy1sRiXSq5JtP;p;s1&C8o&~SM`He> zJfa8ruN9PU;vDPzaoUywwO^#je#8y8mGfWo(t8I10jNb6w+}TjD9qECh+SO4ziO!H zpg&2&1ukF3!V2s<^`s*I<>f2GBj*EI8NZ%Dbzj>vD~d)M^vwq{Z0tg0Nd+2#Qm*CaJJe>vO3tr9kZrW3cnPP*$W4a0KZMZ4J2qN?iK<@jL_t?roFT7PR#}73wy#oiim3}B<0{Erc zi16kL{-yN`l-6_Ee7|r+7^KFtqLuv1atURJ!^SO$et}lxO5j_;zb32Smgr%<@ozAC z3JbW;9Ri?G5kEXEfL1HRi{%ppfJPy`7r2`Ma46hi{L08!+`1hWz$>K3;xcGf)^8l* zXvW9U=Mb$kRiAzEt>9lf^nT3|DL{7hI$O=pDxM#ns33kg%6SKou#GEdKWG=a+QRe9 zLXiLZ7uFPhGK!pCFfQc;mhnqWTZ?Ih4BsrK(`~%CzH?IMU!k~-w6cu9f-1pBs2NQ& zK9CiFg90WK{HvSxxXN67493fm;e@`C_t<+t#De&tP4`<(qt=)7dKToxX%EQg;)?uN zo%n6`s;S6Yy1lP;@9hRF4N_1>@((xC+J!kecc0vK^RZB$H%W*Xdf+ft-YD=(+}PGGQ2mV>~jtt zY{0)9@o+CJ0O!9pY($%E$@%B#fm&1MUwO{3*!m#-h~oaZJTE24f33#2P!E~M_8X(6 z5}VDp^Z9cAE2!Ui6M-p}_6iU!z^^m%Y^KXWxELHw@1nbeQ8eL!xX}vydQChuh_u(R zep);_(Rz=yPM=&26n+yGiH@np&irdP_s|B2V*9O_O;u7p2DxyI!D&H*RMSKftdu1nYMc=7Kq6XR>C;z`b;05dEpZubnu#&~+fnrP^q-Bl>*% zuh4nu*Ub72(e?~$CC4FCFsErc>~X8wMB7 z%zw#&F{gmC!^df0EMZ%X8H)ze2sT#KZ_Lv-NCg4U5@K;VYo$If#X-3bRp1v+ds#_0 zYU6DKRtFmptNXFquZ~v65BGVnHDR0-=T>%^7|uxVxlq@B2oqIl?laDRv2Ag&GpFR^ zup9X2^Xca%b}!-yo_?ij|4}O1)u;bV-sw25l}5fBiRJrMobPR{r z{z&D&HdNFfjzi-Tqr9dF8^((9tMt2&nZ+ts#1Fy0s57V5>j>?U)~^tF`2}?_kd^BX znRYo*7Zw0cdmY=l7FE$9=LY!2cGWYLCJGFCA~xH3kGTZ#!&Pvflr?^V{iwA7sVivL zQ0%W^vCH^H>-rap@I>9DgEkyGYY~W{eF#ED{1BDQX^eeT?>C(fTXpxDIj-)5#s%@i zTcB2eTGu#cj>+Be#Cq_rY1-{1WOEQdd_jlh=b8Tvom_@vUlYwg&7ppNM*Q%_+~F!U zE|jC>_#oKwH?6m6PZ~Qjz^~`Y4;wyD8@po&*R)JXpg-7YxzsjG^_ zUI;<_a0lIGE=+~FWMvb^zF{*0{-_q4fnSrln&-baAn0wYqS@syfMm6a8=)yB{xwJ^ z`Pdip$`h!M+O+v*&h)hk^f|z?EZsH{I!X|Eh?0t)GoZQ4E^ zxkD_J2qXshm4Xe&StdecNlFLh1(`8DlSVO~gEqaq=N11l745*D|a~%9*Loy;%wJ~o^W3VixNU&PE<`4fM28NkB=$n5o?@_ z^}-o3dw~ou%S@Pv>T{n1{2JF$e`w+~rK=;AX=4%|qg?{}<&^VZJ9!@_qdQRhgoSfA zY&HJNM%Aku%{2%3r9yCHn-~I4b$70gk}*an3pfatGb;EOYTg7&n%|@+2;-Xg#?s^y zIXo$p@#`-L-j0OVg!K}w>F`i&zJSK9{Yb8iUx?3hn{C}wIGEPDIXqP75ZV+Bv?<}2 z#aJM)Gbc%!3BtIj4g=(I1^5-P303eQv27glu!&ulYjzE9-7lTyJ;pjXL1$DUM>7iP z`AMP7zs_?0f+FtRBuzT)0yNp@U#qb*)p~LK@S**vhPq2{`qGda>#H8okK4cI$Q$}> zCVBsO_!YM;yN=}cdK{%m0(=2v+~;FHe%0=zhpbkDC2?qdMDMQ7V}L(W@98epA0mEu zR(!yX6vB(?xR^TuxcL{ZrE#&xD(W|o?Q$15bKeqYn8Fkd>@g-{73Y_CGJ_sPdEOPy zv%PKno`3Qz|BUz{^s6ZH`sLQsBIefQp$;I<`@`QWpZ{9HqxgVTrC+JvJrpO5O93?N z*Ah>^aDJH{kbmV^sj7?U@B6QGX0O$s#ghevndg^Lw!xb;PXF#Kp~Ry1N%IZ*sv9kz zU*`Csjn$cGn#ORhX^9p;cw(71u8Q-^bXq3eh%*b}HI??7^(({=)%*nbh4WwR`yqGC zhlZrpr%!m=RC#_GJ#1qBH3yj6l!Jg|8TWa$UasH3dz>@Y2N2&tSbhhN47lFm2&X&9 ze=&aTM%kfpCG3qVJDkdJA}pGoiC-Orw3j=`WrsHczZlU7n>N5NW-h3LL)pB(Un*XJ zOsI!wGvbFhw!9_wzMgfDDYFb96A09A#>pw0_hDnG1^Tscr8SYcn(m4>v*~`qZ=+Y0 z^oyCx0uk@6ZZL1BZLDYqi5VF@D_!H)sQSZc+36(s{MVS=_ z_R?P7D54XU{Ocr6G$UGg4LvcWU<)U(Ocha_5kG9T<2$-z2ph)gVL;rvA#*#$-Re1> zetGdjRBP0Oe_<`S&!gJ+kh22|D8&zJcd%^%WY@LKUgxO!8C~YLsq$h?ITb$y&)pox zJd>K|NqPzR70J$wA9e_Y?!mvTM+9JNQq?F{;#UqU2={3)?8L@c;5Ai3`TTN-=ZS5EWr^P;k4H)^tkEi z`^@;^oU8Dw*Qtuf<$1X?@#`G5Pb3OPXV0tDzCQw2-vOe@nqnEh*1-B9a=TSuVx5wU zIV6a3VQQ5X{7d5q)h+uGf@^VxH>$AVaryvzm9mUq5w;s{W3t+!JbAG=j&BI|Qat@4 zb^Z%cP_9dvGF94ZO4)>(Y{0+X%WUi4Txio#cmXQT<|Eof8NbfxPsu%nnrY(<;rthX z46udzc}BgWNV6`x_Cb5YKrDSRV2d_r2|HD<&Q~|Zt`>_O1!dFl9 zSQ?gTJ1Ouz*6*nIG~{RlZ5No0Cn3yPY2AZZ?vLU)1eebgJ>QQSPKYDaHWA)C_c%&l zI_=1y{ye=TJGVzSmg_ejVq6x{Gw3tSyMw&LDftWbnqDr)54Y*4Kb+XKxB0mKxQzqR zav&s5+MPE=|Gvb(T+NdG6#J7oc^=n9>t1Ulvrs%d(fVfi-*i8II297r1I~`8!<}$< z2e6cuqgyuEu>dan^@qh}7tto!l&)Tz`GuzV*V+$Xgi`Vas2kSDJiD5*G-OM!ngEMD zPJHb~qy_n}6XsW8CG@AOczTfk8lm4(SI-D{$F7wZ$XV;9p}o2zvx&76;XsM z8VWQtg!3u)WeO^O_z|~MzmWwr#=6$vEh5>It`Hh z6R2lD;mE)VsQtg$I7INY{$hY%`r&TOGh;3$JQdjt{|DgPhbMmhhF5>cu+@wjMg5Ug z3qi!>$=UFYvj7FP?wtP`)fUsNQNx9~*hP_1q#Jy1xm16s&8PKxEHfvkPwNPD+>dnL zmGsb1>vlW|>NnP4C$=;`4iwa|$K2thUL%#?%k>+|C&|@bO`G&>ZgpB8lN+gtEK9eY zy}*KMk@59wn7DraYEFAS+cL=bwbFPGXT+T7>VYG=dXLp`d$sa}0b2qB!6o*A?3*S2 zB|^WYC$sI7h)12Wekt1>#1GqOobl_ZF;U`Qh-M@KTj{!^=5zH;qgc301lZPKnSa^z zP5QdlVtB|nEn(0K(VfQoX}#>s!yf+H+hdYYqGkip54UdPth@_=uj{QB*B`FkwOfPu=2Os#D9{3lv7XZ-7690N$R!dYH<}n{&gIBiu`iE96vlk2V~xz^HBI& zdDywfg}&olwzGST^LpNT6*Q@XGctZnr`~oIE}sE*cNL<2W&HY~cEoKHHJgpg+0Jv> zJZCvo!pJrq?(9J&|$t(0W~L6V|om*K<@ zI7_+yaGZ*Sh+?v$egoHGUDp#mG5ZW6K-Y|dSE>s}+~}JF6IE$`&v1y{u+B8XhKa_* zA8vE!@VJnXcO!et`L99Z+9%)_ANjx6h436qOp|G~RkwL|jO#b<7+R3FruB<-#xGUK z;WM(dXQNW}uTiD|pFh9-{muqA#*X4~+LMVn@x1 zZNk|?+XxuhSG;fG{wT+1TLpZN%jOLT)*}W;%{`>{59$xuoC;XTTlL2^loPPezn|({ z2xa`Db?Ny%pj0g_>jvk42}FL9HzZd>Rq!uHE0o@?O08>(iAJx@{BE?Vz^{IaqiloC zMNfPpZtJ6Tw-xV++okiBz%QNI#Emk13nsjcHljX3A1jR5k#!aL1+=@+ld1Yv^z}*@_{_8FG3HpGzakH^F^Mq*cos%_i0;>msj;wKor(a9#$0W`H5lWGp z^XvOj7A5s#v_2QptRV{c*FnjB{>VMCD$!3lQEk_a*7j?NdDdm>JpBTG;o6N@8Z5F! z&K~?eh#2m0Tj!{ZSirwt)c4a;^asbjo)Ei5E6?*`agRt;@-KPv9-tL!?5q9M*dz}S zzE=2I&mJ;<@%-E+4Fp=7+F+PrDp7xE!4Oq@`V|kw>FadO*0`gO(AU$=IVk=VtOOWY znSW_(^ntWfT$j|>=s%)ceyaA^Hz;0&q6Pe`p6;ag<*_V@x2`C93(8{r2e!g9M^wMi}}d`Prvy57rzH) z5P*35o}6b7`xm7l1o*X?{sU>{8r;u@*dT_({Xw=%@cCtLeh4GyYC}N4RcTVHh%kT_PkNHK4>=_S9e7oHsPFh ze=qFws{#LV;9V4=`GFUPaFJ9N!(sll^p7C~@x$K`s^wk$t9meucB(1jJ$N!dT14PZ z>0rP4Ra#eYist$QV_{HAf zoIc~t68~by{!tfwo~rUNMLUbr+l#D7w^6)j+*wqO0d~^4e)ydg=a*ll^%Jq8wXgd% z+OQcy5oDjwe5kI`oj15|~dO-}C3<}i|a}TX?;a!yChp44tjKl5)-|^NfK@S^W za4~j2e#rInptmAYFrG7?qFr($6HNA+p2|1Rh#x*GqZ3Bap00XSEL3Y+t$?iJ{1>i+ zaOdp8Kj&$Q@VWJ0(^vLK`8^KL&sZozyM+_6;MfYea`7cKuj>oMhM`vOPf)*sv@$t% zHC0Olt8-*^;(W@zGBJ*E`TQ%bUFJOEHWwPFtG@2sDc{HVHP5*-i&)%@{MT;E56!U+ zDP2km08oVfiBJhAZ=5bcbv%#FtcmjW$8BzM_AZ)cuER^>X~MD#Jsz z^lp;Uaj*|}V&R5)O)KJuN3`VTo%b1kdEiKK_i!Q?9)`j1kZ^8i0 z!%!E3_@REc)ts(AsxLP0lFjMVH}%WuhfYkaugHH@0rfyndgs&w-?t$sS8dwRFJV>W zztVJcu+5p{#Sh!DOALn!u-E|KApeE%+OiJB59b~;}))dGW(GMyplk zPiS{HgdKFUszZD|3;v~S0_qQ)leABu;2l(P_CA4p$}0Fsonk>n{tNtz+O5ceSzK{^ zZDT}ki0M;Kr;ar(@vqPl)^~}J#cX@Mh-GWWX{qz|!nMQ5l?3^(j}i8m4fhUCxj=mW zIs~-8(Vt-NImmxqhTY3`aa9qR(`I*eADp0XRdG-bfGAj(8NUYPqFiEi^+h0JAK1nK zr2mJ!ju}}{zk!?rbu2S%ZL*G!18mCoAE)=jwm^4${1V{HZ^?Gl+kn0ulnh$~OX-1EfC|Qahj=*NVPRS&W|KR!s%G;5=QV`YWApi9WTgXGv5#v?o zv;>gtg^zSns5U-+G5s1QqQH_*Vsfoym>Lt}%8q ztY7vc1UGHGDSf04_}3Y^PA)v6$_}^4)*N8#E!t#Z6ela{H*)CVI8r2jojEX94A=^M zV?~`Ci2a8iGS@x z2E4BdYxzDKIkO-@C zIuGM=)cLPhoYM{r{_f=ger)e1t*{=4^;>kmh91rtKSN?7Ksz!TlmFYqrK(~$q-KKtYm!B5%N zhKyKHKaVI4S4g7Irhkwbg&b~I8nL*5e<8aB%df_T(hi0;@E!KhaKNp^zY4_l8$hdq z>6abylNg@V1^jE2wgIiYK2svC`rPkfZYlrOFbG^mn=DP5oCs56_xNddz`wlyBoG^< zlaA`oi|Ehp-b6NBSwHWc!k&y^fUD8x(TqC(WtZzWn16YpV8pC&Cf%E;HeTfbzv8ss zX_bg9O`!_J7alTWIXnsQYXuFs%CaG>k@E#)PY{ko8_$kumq_38KWF0FLpRL(`2j~I zo&x-ulfn7rqAEMYK`@4`U(g%5UFjM4l|E&us`BG}rjKC@N^}z@A;2%@Ur3{PVW>B= ziiqKfs|4w-*KqAV!cDxMTJ2?$h5qQc&q~x()E{ouxqgFxB_6To*#9NZ212@q`va;RFvkLEmvO z8+%LqOEioUS0f;s(<=N$Swqhb0nz%6fPd{}*m7^2xH!P&Gwf8js){nreHQi(hOMzk z&WO`t(MB-%t#r7z)7=>4zs5o>@DrMgKu-j9`(n>o=elc<2uqAvLH>*J3%3v#Ej})q z!PY|Khy$cP00-FTUtax2Qz1U4FQvP(&5rc}eIDH*7Zfbce+ll7I{!t<1E5_Y#0viPTV}^;<2eL=p@Y2HR3faBe_>pm)0m%0=r?%fE@KT%o8aBD96waK z;{#T&ew6tI#s37u(&!hvp-`H&(wLmV5;Fh=XD*`@;iWE=#RvNucosCh4h8;{k;Vf=0f`) z?sBXb*AXdO2Ok=j2?Y41&`Kb5@AEIda7o?hTbcg?B&o6l_=kX`Vefn{GOF3i{1Zs_5L%-@W0e+=1tH~U?ipkOz(F&{C zq3Im#b4C8^P2krfebFrjE^i#}{CxDg1CuZgu!j?6{2FC*K^t*3BK9G8x4K9QZEl>& zzo^xT1HW`!3oy)=qtb{8MGNv@e*Fe1{KB}pvACPDUZ_Z137=N!Db9aMz}7M=+dXNo zGn>=agua*ljTQ>b#-S4b;z~l`DXur6!*Vx>Sa=687k%dZmwFHQ7q`(le#rOt@}jKr z!0w)bp#Ct2`+KpC`PyC_BeL0Ch%-)?9(8Bn7c~?7a7D!Kw{obKcqlbTqLTTDEqIS{ z{RS*{aVR;*(vckJu;Do8zY5`wGJbW!8{BpPo>ik9!5{WPin-+`= zHZwee#z~%M+~12^6Y-uRJbZ8&HwqV1{? z^&KwN=F$%3Yr%%6AMQmgZg&~K5 zVA)(ON`PO_d3L_fm^M`+EZ|>m5I+QdowM2<)Kw;P3co- z*gNX}C_eu+BH#bB>Y*9um*Wlrwk+aX6als4KnLd#yvl%o?S%J!OA6O&;Shnsud3r{ zGvBQqtUSMb8ue^AqtRR%&T+G7!%#DCQu@XB&z~khE#G_Kn|C-B7RLTe1^+^uw)$wY z`O4rugy?|_OFLmYJcWGz>rukEiZKQ<-`{xHfoCQ4Ab!aB)zXIHR6+3l!@R)i%*3zk z_gX-^E@Dt%{`CvGA3}U}-36%F$r+YdeyyH0slh%VXA4&`eNoehn2|pR})WL|Ffcgo*u|G zPg-9_S5?^|_jxb+3?M7V4|xR(Fey(+-jHfd_XzCpYbxW1h|>-Owq62$bxMQ{RZd(+ zcFv3+KH@A?uoXD%PA65K|AMJx?<%7Ov%J_v}F`C04E06sE#*VXZCHyMQbNGr>d7cF-KhMXnTLD`$)}n(Kr2@aW{_sW_ z2CN73BRUEEw1R)(7Ln~>Tk|FSRgZ{0BwMA0OP{^9@ahjyHm_WxV2?q-t}F8|;=iYW zZG4Fb6CgF#{bIowxJ(6p{Z=kI7F}Y@6YBmbb^dGUx@klLE8>Tz1B&QE<*D z!Zw%Uhs?jujkV_xEj(*6kRcw0C;eb#XN;hJek*6YdX!rIhp%7Oq{qmD`g!&t)oq94 zrHgz$jH^yp;un~vz}TOVfo;h-3AZ|4iC_5Z8wf+qeO1NTl)j&YO=umiz%OL>I~(~| z;^LA`c**T_wQZI7h4^6~Y|B}Rb5bxV@QoSBA`^21{8|Hj$3EmRRA3KBmO0o45NxvAs&cWS9HU|{A)Mwm8=Wdi`{8HXK zp{xFVM5R9CBB>Jp(x!0*E&%6%ag{vCuvIkP(s|+V_rHAp#RqOjCY-CRjonwEOcMUa zw0_*#Fo+AFa^Ou$zs5p`DbFst)@_=;uYOz^JEai|3j=P zP_M;6{f5;x3ctm>umYC0)^r#PP`_b5tU1%E?fNVPF|L8Lgb7z3$oKFEyacxa|FZMa zsf%A!Jv)Ol&aXqQMp5j6HFe-s_Nq48JlZ=1+V!XUMb0MK0tkqCpkPfQ`mNrRqDZz# z`7u<}SrP}q#t_ClPXDE0T;=-t|6?bc0ykP`yiB+U#*OaM{Kd_c>*rtP*&qyOJ_|=9 z`vyF}1><_zo1d}Tjqv?o{rK9bAJBql5TA$QYry5S{<@y#K1~erO7OqdPs>H7)h@Cc@vvLVc~4UV{OQYRn%|ba`F0v`w5PLbfRnnfB%akiYsQ+&#!l4Iq)w& zwv2i<=H~0ERYuD78{l69Qc?RS9N0SMUlD?{g!*|ssNa}}{oEv(c4>QQVG)J&U&E6H z6SG&9>o?}mkEN4?)j~X6UN@Zpkl_iK)KvNJf9=#yr=eC^Sam4c5g7cl%6QJnmGDb2 zez{#~(5_SBYxw6Ler54w%$O*}4;40<=+84k{cRNBDbQ+R4~UqLUp8@@D+wBRRD&za z;EOiMuUn}Seys-oV*EmE=MdqdHWxtlB%WYDQ>lJ~^IxdMaIt$4tOljxK0Bu|hY94n zy)~7@R${4g9bKrNi`)c1>B=Gz=JPMke*q?B^ux&OebiBb#17PfTq_er!;hg!V*Fw^ z-k5JbD-&!)+4)Bs z-#H;G@DC;M3;iKbMMqt*k3?8PJ%L|WFqD3k>Nldr@IH{oE_WgD3l+cMj1x2XSFlWh z(2u;{jQWj-W#S0ZUct2+EG&FsX8lG0wdV`RO8B+24C~%Rl|kIcFV24jaD1MyJcu9e zWBhWJ3sDkE1(xOfmwFHE{CO|LlM4RD-H6ZhCE!Ql$qfFbOm~GZ!2?95Z$|uZ0W%lY z9iM+afSNo!nZdt0M!_P-0jwbVB>{zq74gH;a4r~NCI8|rdj7bkct3mkrS3nZlFC#F zT(4Eme^qw1+~?yn`PcbN=}iJQWJUc3qg6n=0s(kBqkco}Rb@AL(*{BXewFC}XcvqO zGX*8g;9n(51vQ5faT_Jf;9uvr@ySRf{{n0Q0vHt52wza7rjma_zrqz=Reg5Q`AYsp zo}DjsRb`iY(fJwtOR>mcIGzAKt*qaG1>pE0!xld33+MB%a{jB_XJr%m6m~c40Gf0D z%ZGI}KOVl%vlr+Nw5howei($IW(YvE3jTF| zH@uFahco!s%&u}9oc8L|UGIDf#}C=OW2EPe{mP(z!#n>4TX(*`yEW(G*E`q*cTT?9 z$1jc_vTca~0!p?eu%a{gmx83@GY$2I{7nA!PHk|9QW?K6u6MGT7^#0hws-!E^Iv8A zywkV*%Y*n~(A5hCpMTN8Wk#QP&c4R1*{_5@f}r&++iL$`W{tau)q?0?Pv|!7Gvd>B zLrM7LXy`WD%1_)y3M)zKnj=$Aon>Y&5Tv7CLz1*Kt)%x*NY<8wP?|nNpTZNr&B0XY zi`r-8r=5neN?`>*DShjpfMZ|rho!4XlX!wZ*#e=|=ah;1V_f8IqZ-l^r0Hml{3K}e z;ZS#fZ|!1jwwLigZTrTnF#vzCXIct@c!jp!e z&%!`u94)3A=?j+*h0=!iq%`(!Gua<;mRmL~zY-cD$c_A@G>4KvYH;@=r@{iE&Geo$ zk@~@!Cgloeu4Nu536E(g;pHc;W2-g?yF=;zmCmQEhKv$EZ8Z#p()&NdPh@Fa-RF0%GR|xVZr@;ydzt7O@ zZn9Z@l>kMnwU9ouWt9WP_kOPL)=AaKS~?3k2eB%h`laJoR_R+9JDVN0HogG;N^AV2 zq15Mt!Z=UAYFHV^l*akrA~KU&gqD--mW4j_lAi=^Sgk~*eoasd+NdXfqmZ^ptmvIv zZypSU&>~8STH6fX(;Qm8|4);j+SqXK1%fPp%OS8qf`x@3b%(O*Tk475$m+SJwo%^D zR6E3id4mQaUE4T_C*}8C-&=cA&nLA8(F4I`VOdEieaqt9YX(d02@NFyPfAUwTGOS- z*>UqiA!rjZK0(j8S0`&$D8WfaAcRKwi6}L)dse>N-Ysc=2Pe zLh#SqJ61e3_l?o<6G~{W6oNL_e(htw{Kf;5ubgDzo@*xWI(hBd)SX7K**?1k+}W>Tn+%* z_U*ht(*TYy6x53ZI+&CZ$FS(Y1%j)ZsBc|}r~VV^*gjr_y-?`(zLlaXS|;tZ*{EG8c(0)pFs_8l7YKeE0X%&NT=tM!_?V*IVBXe$N&170 zwTCVcT))rS4f<_zYx;eSvk&RF^_K+iiQlI8op8AX&p-p$t z&HW|8dm_F5(Di9^tu~K7C~FJmS{!Ef1n)^{Z(zM<;Bo-ajLY78u%;Eb49E@unsM20 zgMBFaZKnr^g-jt!g7<_<<1(n%txtv`+VTqo;lIbj<^B>b2LR22*M#@s3|wY7Rsdar z%R&H9>&mvN@S)VAP9*rf`{2SmE*vL6*M7 za9nR*uhqVT;D5`Uxzw48T~JyJdM8}2^^uxL@YlrkA2mK9o|(A%su~tzEFCPO|z2PIQ=!~k1t%}LLfZ3LWXWoAgz0;`p zAW+5p;AK3@nG>LTSQ}cf6p)f-}+V8xpU`S ze))w$@W~5*6+HR>ZJP^KICv8D`47>-ci3aW?hRh_2iS!3by+WKrT?0l8}Py{$<6+E zbXo24l77()6&|0V)Ipoyqsu{?-!ng@HZxV2m0Ibt5`Ld9m*&}j&pYaJNq2*#cn4h$ zrqXZpPP!cY`*(HuolL?1xB4C|&hHdZ*01q4NmBQRerKb1fAQ`NygLK$&cM4f@a_z} zI|J{|z<=WzQ2r7eCiqL@zwtD@JM?#F;N2N`cLv^_fp=%%-5L0AIs?e^Bd@UOACn~U fUqV!0%>F~B!fzi+QjY%}R~_KL`^#x5|0VwqAA(}7 diff --git a/fpga/fpga_hf.v b/fpga/fpga_hf.v index a2100df6..8a465e75 100644 --- a/fpga/fpga_hf.v +++ b/fpga/fpga_hf.v @@ -73,9 +73,6 @@ wire hi_read_rx_xcorr_848 = conf_word[0]; // and whether to drive the coil (reader) or just short it (snooper) wire hi_read_rx_xcorr_snoop = conf_word[1]; -// Divide the expected subcarrier frequency for hi_read_rx_xcorr by 4 -wire hi_read_rx_xcorr_quarter = conf_word[2]; - // For the high-frequency simulated tag: what kind of modulation to use. wire [2:0] hi_simulate_mod_type = conf_word[2:0]; @@ -102,7 +99,7 @@ hi_read_rx_xcorr hrxc( hrxc_ssp_frame, hrxc_ssp_din, ssp_dout, hrxc_ssp_clk, cross_hi, cross_lo, hrxc_dbg, - hi_read_rx_xcorr_848, hi_read_rx_xcorr_snoop, hi_read_rx_xcorr_quarter + hi_read_rx_xcorr_848, hi_read_rx_xcorr_snoop ); hi_simulate hs( diff --git a/fpga/hi_read_rx_xcorr.v b/fpga/hi_read_rx_xcorr.v index 06142637..bb151554 100644 --- a/fpga/hi_read_rx_xcorr.v +++ b/fpga/hi_read_rx_xcorr.v @@ -10,7 +10,7 @@ module hi_read_rx_xcorr( ssp_frame, ssp_din, ssp_dout, ssp_clk, cross_hi, cross_lo, dbg, - xcorr_is_848, snoop, xcorr_quarter_freq + xcorr_is_848, snoop ); input pck0, ck_1356meg, ck_1356megb; output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4; @@ -20,58 +20,34 @@ module hi_read_rx_xcorr( output ssp_frame, ssp_din, ssp_clk; input cross_hi, cross_lo; output dbg; - input xcorr_is_848, snoop, xcorr_quarter_freq; + input xcorr_is_848, snoop; // Carrier is steady on through this, unless we're snooping. assign pwr_hi = ck_1356megb & (~snoop); assign pwr_oe1 = 1'b0; -assign pwr_oe2 = 1'b0; assign pwr_oe3 = 1'b0; assign pwr_oe4 = 1'b0; -reg ssp_clk; -reg ssp_frame; - -reg fc_div_2; -always @(posedge ck_1356meg) - fc_div_2 = ~fc_div_2; - -reg fc_div_4; -always @(posedge fc_div_2) - fc_div_4 = ~fc_div_4; - -reg fc_div_8; -always @(posedge fc_div_4) - fc_div_8 = ~fc_div_8; +(* clock_signal = "yes" *) reg fc_div_2; +always @(negedge ck_1356megb) + fc_div_2 <= fc_div_2 + 1; -reg adc_clk; - -always @(xcorr_is_848 or xcorr_quarter_freq or ck_1356meg) - if(~xcorr_quarter_freq) - begin +(* clock_signal = "yes" *) reg adc_clk; +always @(xcorr_is_848, ck_1356megb, fc_div_2) if(xcorr_is_848) // The subcarrier frequency is fc/16; we will sample at fc, so that // means the subcarrier is 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 1 1 ... - adc_clk <= ck_1356meg; + adc_clk <= ck_1356megb; else // The subcarrier frequency is fc/32; we will sample at fc/2, and // the subcarrier will look identical. adc_clk <= fc_div_2; - end - else - begin - if(xcorr_is_848) - // The subcarrier frequency is fc/64 - adc_clk <= fc_div_4; - else - // The subcarrier frequency is fc/128 - adc_clk <= fc_div_8; - end + // When we're a reader, we just need to do the BPSK demod; but when we're an // eavesdropper, we also need to pick out the commands sent by the reader, // using AM. Do this the same way that we do it for the simulated tag. -reg after_hysteresis, after_hysteresis_prev; +reg after_hysteresis, after_hysteresis_prev, after_hysteresis_prev_prev; reg [11:0] has_been_low_for; always @(negedge adc_clk) begin @@ -97,7 +73,6 @@ end // Let us report a correlation every 4 subcarrier cycles, or 4*16 samples, // so we need a 6-bit counter. reg [5:0] corr_i_cnt; -reg [5:0] corr_q_cnt; // And a couple of registers in which to accumulate the correlations. // we would add at most 32 times adc_d, the result can be held in 13 bits. // Need one additional bit because it can be negative as well @@ -105,32 +80,38 @@ reg signed [13:0] corr_i_accum; reg signed [13:0] corr_q_accum; reg signed [7:0] corr_i_out; reg signed [7:0] corr_q_out; +// clock and frame signal for communication to ARM +reg ssp_clk; +reg ssp_frame; + + // ADC data appears on the rising edge, so sample it on the falling edge always @(negedge adc_clk) begin + corr_i_cnt <= corr_i_cnt + 1; + // These are the correlators: we correlate against in-phase and quadrature // versions of our reference signal, and keep the (signed) result to // send out later over the SSP. - if(corr_i_cnt == 7'd63) + if(corr_i_cnt == 7'd0) begin if(snoop) begin - // highest 7 significant bits of tag signal (signed), 1 bit reader signal: - corr_i_out <= {corr_i_accum[13:7], after_hysteresis_prev}; - corr_q_out <= {corr_q_accum[13:7], after_hysteresis}; + // 7 most significant bits of tag signal (signed), 1 bit reader signal: + corr_i_out <= {corr_i_accum[13:7], after_hysteresis_prev_prev}; + corr_q_out <= {corr_q_accum[13:7], after_hysteresis_prev}; + after_hysteresis_prev_prev <= after_hysteresis; end else begin - // highest 8 significant bits of tag signal + // 8 most significant bits of tag signal corr_i_out <= corr_i_accum[13:6]; corr_q_out <= corr_q_accum[13:6]; end corr_i_accum <= adc_d; corr_q_accum <= adc_d; - corr_q_cnt <= 4; - corr_i_cnt <= 0; end else begin @@ -139,13 +120,11 @@ begin else corr_i_accum <= corr_i_accum + adc_d; - if(corr_q_cnt[3]) - corr_q_accum <= corr_q_accum - adc_d; - else + if(corr_i_cnt[3] == corr_i_cnt[2]) // phase shifted by pi/2 corr_q_accum <= corr_q_accum + adc_d; + else + corr_q_accum <= corr_q_accum - adc_d; - corr_i_cnt <= corr_i_cnt + 1; - corr_q_cnt <= corr_q_cnt + 1; end // The logic in hi_simulate.v reports 4 samples per bit. We report two @@ -172,7 +151,7 @@ begin end // set ssp_frame signal for corr_i_cnt = 0..3 and corr_i_cnt = 32..35 - // (two frames with 8 Bits each) + // (send two frames with 8 Bits each) if(corr_i_cnt[5:2] == 4'b0000 || corr_i_cnt[5:2] == 4'b1000) ssp_frame = 1'b1; else @@ -186,5 +165,6 @@ assign dbg = corr_i_cnt[3]; // Unused. assign pwr_lo = 1'b0; +assign pwr_oe2 = 1'b0; endmodule diff --git a/include/mifare.h b/include/mifare.h index 89ff758e..ad86886d 100644 --- a/include/mifare.h +++ b/include/mifare.h @@ -11,7 +11,7 @@ #ifndef _MIFARE_H_ #define _MIFARE_H_ -#include "../include/common.h" +#include "common.h" //----------------------------------------------------------------------------- // ISO 14443A diff --git a/include/usb_cmd.h b/include/usb_cmd.h index 345793ec..2080f2de 100644 --- a/include/usb_cmd.h +++ b/include/usb_cmd.h @@ -100,7 +100,6 @@ typedef struct{ // For the 13.56 MHz tags #define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693 0x0300 -#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443 0x0301 #define CMD_READ_SRI512_TAG 0x0303 #define CMD_READ_SRIX4K_TAG 0x0304 #define CMD_ISO_14443B_COMMAND 0x0305 @@ -118,9 +117,8 @@ typedef struct{ #define CMD_SIMULATE_HITAG 0x0371 #define CMD_READER_HITAG 0x0372 -#define CMD_SIMULATE_TAG_HF_LISTEN 0x0380 -#define CMD_SIMULATE_TAG_ISO_14443 0x0381 -#define CMD_SNOOP_ISO_14443 0x0382 +#define CMD_SIMULATE_TAG_ISO_14443B 0x0381 +#define CMD_SNOOP_ISO_14443B 0x0382 #define CMD_SNOOP_ISO_14443a 0x0383 #define CMD_SIMULATE_TAG_ISO_14443a 0x0384 #define CMD_READER_ISO_14443a 0x0385 @@ -128,7 +126,6 @@ typedef struct{ #define CMD_READER_LEGIC_RF 0x0388 #define CMD_WRITER_LEGIC_RF 0x0389 #define CMD_EPA_PACE_COLLECT_NONCE 0x038A -//#define CMD_EPA_ 0x038B #define CMD_SNOOP_ICLASS 0x0392 #define CMD_SIMULATE_TAG_ICLASS 0x0393 -- 2.39.2