]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/iso15693.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
coverity fixes for my latest changes.
[proxmark3-svn] / armsrc / iso15693.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
bd20f8f4 2// Jonathan Westhues, split Nov 2006
3// Modified by Greg Jones, Jan 2009
e6304bca 4// Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
bd20f8f4 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
15c4dc5a 10// Routines to support ISO 15693. This includes both the reader software and
11// the `fake tag' modes, but at the moment I've implemented only the reader
12// stuff, and that barely.
bd20f8f4 13// Modified to perform modulation onboard in arm rather than on PC
15c4dc5a 14// Also added additional reader commands (SELECT, READ etc.)
15c4dc5a 15//-----------------------------------------------------------------------------
9455b51c 16// The ISO 15693 describes two transmission modes from reader to tag, and 4
17// transmission modes from tag to reader. As of Mar 2010 this code only
18// supports one of each: "1of4" mode from reader to tag, and the highspeed
19// variant with one subcarrier from card to reader.
20// As long, as the card fully support ISO 15693 this is no problem, since the
21// reader chooses both data rates, but some non-standard tags do not. Further for
22// the simulation to work, we will need to support all data rates.
23//
24// VCD (reader) -> VICC (tag)
25// 1 out of 256:
26// data rate: 1,66 kbit/s (fc/8192)
27// used for long range
28// 1 out of 4:
29// data rate: 26,48 kbit/s (fc/512)
30// used for short range, high speed
31//
32// VICC (tag) -> VCD (reader)
33// Modulation:
34// ASK / one subcarrier (423,75 khz)
35// FSK / two subcarriers (423,75 khz && 484,28 khz)
36// Data Rates / Modes:
37// low ASK: 6,62 kbit/s
38// low FSK: 6.67 kbit/s
39// high ASK: 26,48 kbit/s
40// high FSK: 26,69 kbit/s
41//-----------------------------------------------------------------------------
42// added "1 out of 256" mode (for VCD->PICC) - atrox 20100911
43
44
45// Random Remarks:
46// *) UID is always used "transmission order" (LSB), which is reverse to display order
47
48// TODO / BUGS / ISSUES:
49// *) writing to tags takes longer: we miss the answer from the tag in most cases
50// -> tweak the read-timeout times
51// *) signal decoding from the card is still a bit shaky.
52// *) signal decoding is unable to detect collissions.
53// *) add anti-collission support for inventory-commands
e6304bca 54// *) read security status of a block
9455b51c 55// *) sniffing and simulation do only support one transmission mode. need to support
56// all 8 transmission combinations
57// *) remove or refactor code under "depricated"
58// *) document all the functions
59
bd20f8f4 60
e30c654b 61#include "proxmark3.h"
f7e3ed82 62#include "util.h"
15c4dc5a 63#include "apps.h"
9ab7a6c7 64#include "string.h"
9455b51c 65#include "iso15693tools.h"
902cb3c0 66#include "cmd.h"
15c4dc5a 67
15c4dc5a 68#define arraylen(x) (sizeof(x)/sizeof((x)[0]))
69
9455b51c 70///////////////////////////////////////////////////////////////////////
71// ISO 15693 Part 2 - Air Interface
72// This section basicly contains transmission and receiving of bits
73///////////////////////////////////////////////////////////////////////
74
75#define FrameSOF Iso15693FrameSOF
76#define Logic0 Iso15693Logic0
77#define Logic1 Iso15693Logic1
78#define FrameEOF Iso15693FrameEOF
15c4dc5a 79
9455b51c 80#define Crc(data,datalen) Iso15693Crc(data,datalen)
81#define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
82#define sprintUID(target,uid) Iso15693sprintUID(target,uid)
15c4dc5a 83
9455b51c 84int DEBUG=0;
85
86
87// ---------------------------
88// Signal Processing
89// ---------------------------
90
91// prepare data using "1 out of 4" code for later transmission
92// resulting data rate is 26,48 kbit/s (fc/512)
93// cmd ... data
94// n ... length of data
f7e3ed82 95static void CodeIso15693AsReader(uint8_t *cmd, int n)
15c4dc5a 96{
97 int i, j;
98
99 ToSendReset();
100
101 // Give it a bit of slack at the beginning
102 for(i = 0; i < 24; i++) {
103 ToSendStuffBit(1);
104 }
105
9455b51c 106 // SOF for 1of4
15c4dc5a 107 ToSendStuffBit(0);
108 ToSendStuffBit(1);
109 ToSendStuffBit(1);
110 ToSendStuffBit(1);
111 ToSendStuffBit(1);
112 ToSendStuffBit(0);
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 for(i = 0; i < n; i++) {
116 for(j = 0; j < 8; j += 2) {
117 int these = (cmd[i] >> j) & 3;
118 switch(these) {
119 case 0:
120 ToSendStuffBit(1);
121 ToSendStuffBit(0);
122 ToSendStuffBit(1);
123 ToSendStuffBit(1);
124 ToSendStuffBit(1);
125 ToSendStuffBit(1);
126 ToSendStuffBit(1);
127 ToSendStuffBit(1);
128 break;
129 case 1:
130 ToSendStuffBit(1);
131 ToSendStuffBit(1);
132 ToSendStuffBit(1);
133 ToSendStuffBit(0);
134 ToSendStuffBit(1);
135 ToSendStuffBit(1);
136 ToSendStuffBit(1);
137 ToSendStuffBit(1);
138 break;
139 case 2:
140 ToSendStuffBit(1);
141 ToSendStuffBit(1);
142 ToSendStuffBit(1);
143 ToSendStuffBit(1);
144 ToSendStuffBit(1);
145 ToSendStuffBit(0);
146 ToSendStuffBit(1);
147 ToSendStuffBit(1);
148 break;
149 case 3:
150 ToSendStuffBit(1);
151 ToSendStuffBit(1);
152 ToSendStuffBit(1);
153 ToSendStuffBit(1);
154 ToSendStuffBit(1);
155 ToSendStuffBit(1);
156 ToSendStuffBit(1);
157 ToSendStuffBit(0);
158 break;
159 }
160 }
161 }
9455b51c 162 // EOF
15c4dc5a 163 ToSendStuffBit(1);
164 ToSendStuffBit(1);
165 ToSendStuffBit(0);
166 ToSendStuffBit(1);
167
168 // And slack at the end, too.
169 for(i = 0; i < 24; i++) {
170 ToSendStuffBit(1);
171 }
172}
173
9455b51c 174// encode data using "1 out of 256" sheme
175// data rate is 1,66 kbit/s (fc/8192)
176// is designed for more robust communication over longer distances
177static void CodeIso15693AsReader256(uint8_t *cmd, int n)
15c4dc5a 178{
15c4dc5a 179 int i, j;
180
9455b51c 181 ToSendReset();
182
183 // Give it a bit of slack at the beginning
184 for(i = 0; i < 24; i++) {
185 ToSendStuffBit(1);
186 }
187
188 // SOF for 1of256
189 ToSendStuffBit(0);
190 ToSendStuffBit(1);
191 ToSendStuffBit(1);
192 ToSendStuffBit(1);
193 ToSendStuffBit(1);
194 ToSendStuffBit(1);
195 ToSendStuffBit(1);
196 ToSendStuffBit(0);
197
15c4dc5a 198 for(i = 0; i < n; i++) {
9455b51c 199 for (j = 0; j<=255; j++) {
200 if (cmd[i]==j) {
201 ToSendStuffBit(1);
202 ToSendStuffBit(0);
15c4dc5a 203 } else {
9455b51c 204 ToSendStuffBit(1);
205 ToSendStuffBit(1);
206 }
207 }
15c4dc5a 208 }
9455b51c 209 // EOF
210 ToSendStuffBit(1);
211 ToSendStuffBit(1);
212 ToSendStuffBit(0);
213 ToSendStuffBit(1);
15c4dc5a 214
9455b51c 215 // And slack at the end, too.
216 for(i = 0; i < 24; i++) {
217 ToSendStuffBit(1);
218 }
15c4dc5a 219}
220
9455b51c 221
15c4dc5a 222// Transmit the command (to the tag) that was placed in ToSend[].
f7e3ed82 223static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
15c4dc5a 224{
225 int c;
226
227// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
228 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
229 if(*wait < 10) { *wait = 10; }
230
231// for(c = 0; c < *wait;) {
232// if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
233// AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
234// c++;
235// }
236// if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 237// volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 238// (void)r;
239// }
240// WDT_HIT();
241// }
242
243 c = 0;
244 for(;;) {
245 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
246 AT91C_BASE_SSC->SSC_THR = cmd[c];
247 c++;
248 if(c >= len) {
249 break;
250 }
251 }
252 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 253 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 254 (void)r;
255 }
256 WDT_HIT();
257 }
258 *samples = (c + *wait) << 3;
259}
260
261//-----------------------------------------------------------------------------
262// Transmit the command (to the reader) that was placed in ToSend[].
263//-----------------------------------------------------------------------------
f7e3ed82 264static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
15c4dc5a 265{
3fe4ff4f 266 int c = 0;
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
15c4dc5a 268 if(*wait < 10) { *wait = 10; }
269
15c4dc5a 270 for(;;) {
271 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
272 AT91C_BASE_SSC->SSC_THR = cmd[c];
273 c++;
274 if(c >= len) {
275 break;
276 }
277 }
278 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 279 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 280 (void)r;
281 }
282 WDT_HIT();
283 }
284 *samples = (c + *wait) << 3;
285}
286
9455b51c 287
288// Read from Tag
289// Parameters:
290// receivedResponse
291// maxLen
292// samples
293// elapsed
294// returns:
295// number of decoded bytes
f7e3ed82 296static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
15c4dc5a 297{
117d9ec2 298 uint8_t *dest = BigBuf_get_addr();
15c4dc5a 299
f2c2b174 300 int c = 0;
301 int getNext = FALSE;
f7e3ed82 302 int8_t prev = 0;
15c4dc5a 303
15c4dc5a 304 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
f2c2b174 305 SpinDelay(100); // greg - experiment to get rid of some of the 0 byte/failed reads
306
15c4dc5a 307 for(;;) {
f2c2b174 308 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
15c4dc5a 309 AT91C_BASE_SSC->SSC_THR = 0x43;
f2c2b174 310
15c4dc5a 311 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 312 int8_t b;
313 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 314
315 // The samples are correlations against I and Q versions of the
316 // tone that the tag AM-modulates, so every other sample is I,
317 // every other is Q. We just want power, so abs(I) + abs(Q) is
318 // close to what we want.
319 if(getNext) {
6fc68747 320 int8_t r = ABS(b) + ABS(prev);
15c4dc5a 321
f7e3ed82 322 dest[c++] = (uint8_t)r;
15c4dc5a 323
324 if(c >= 2000) {
325 break;
326 }
327 } else {
328 prev = b;
329 }
330
331 getNext = !getNext;
332 }
333 }
334
9455b51c 335 //////////////////////////////////////////
336 /////////// DEMODULATE ///////////////////
337 //////////////////////////////////////////
15c4dc5a 338
339 int i, j;
340 int max = 0, maxPos=0;
341
342 int skip = 4;
343
9455b51c 344 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
15c4dc5a 345
346 // First, correlate for SOF
347 for(i = 0; i < 100; i++) {
348 int corr = 0;
349 for(j = 0; j < arraylen(FrameSOF); j += skip) {
350 corr += FrameSOF[j]*dest[i+(j/skip)];
351 }
352 if(corr > max) {
353 max = corr;
354 maxPos = i;
355 }
356 }
9455b51c 357 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
15c4dc5a 358
359 int k = 0; // this will be our return value
360
361 // greg - If correlation is less than 1 then there's little point in continuing
362 if ((max/(arraylen(FrameSOF)/skip)) >= 1)
363 {
364
9455b51c 365 i = maxPos + arraylen(FrameSOF)/skip;
366
367 uint8_t outBuf[20];
368 memset(outBuf, 0, sizeof(outBuf));
369 uint8_t mask = 0x01;
370 for(;;) {
371 int corr0 = 0, corr1 = 0, corrEOF = 0;
372 for(j = 0; j < arraylen(Logic0); j += skip) {
373 corr0 += Logic0[j]*dest[i+(j/skip)];
374 }
375 for(j = 0; j < arraylen(Logic1); j += skip) {
376 corr1 += Logic1[j]*dest[i+(j/skip)];
377 }
378 for(j = 0; j < arraylen(FrameEOF); j += skip) {
379 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
380 }
381 // Even things out by the length of the target waveform.
382 corr0 *= 4;
383 corr1 *= 4;
384
385 if(corrEOF > corr1 && corrEOF > corr0) {
386 // DbpString("EOF at %d", i);
387 break;
388 } else if(corr1 > corr0) {
389 i += arraylen(Logic1)/skip;
390 outBuf[k] |= mask;
391 } else {
392 i += arraylen(Logic0)/skip;
393 }
394 mask <<= 1;
395 if(mask == 0) {
396 k++;
397 mask = 0x01;
398 }
399 if((i+(int)arraylen(FrameEOF)) >= 2000) {
400 DbpString("ran off end!");
401 break;
402 }
15c4dc5a 403 }
9455b51c 404 if(mask != 0x01) { // this happens, when we miss the EOF
405 // TODO: for some reason this happens quite often
406 if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
407 if (mask<0x08) k--; // discard the last uneven octet;
408 // 0x08 is an assumption - but works quite often
15c4dc5a 409 }
9455b51c 410 // uint8_t str1 [8];
411 // itoa(k,str1);
412 // strncat(str1," octets read",8);
413
414 // DbpString( str1); // DbpString("%d octets", k);
415
416 // for(i = 0; i < k; i+=3) {
417 // //DbpString("# %2d: %02x ", i, outBuf[i]);
418 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
419 // }
420
421 for(i = 0; i < k; i++) {
422 receivedResponse[i] = outBuf[i];
15c4dc5a 423 }
15c4dc5a 424 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
425 return k; // return the number of bytes demodulated
426
f2c2b174 427// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
15c4dc5a 428}
429
9455b51c 430
15c4dc5a 431// Now the GetISO15693 message from sniffing command
f7e3ed82 432static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
15c4dc5a 433{
117d9ec2 434 uint8_t *dest = BigBuf_get_addr();
15c4dc5a 435
f2c2b174 436 int c = 0;
437 int getNext = FALSE;
f7e3ed82 438 int8_t prev = 0;
15c4dc5a 439
15c4dc5a 440 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
f2c2b174 441 SpinDelay(100); // greg - experiment to get rid of some of the 0 byte/failed reads
442
15c4dc5a 443 for(;;) {
f2c2b174 444 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
15c4dc5a 445 AT91C_BASE_SSC->SSC_THR = 0x43;
f2c2b174 446
15c4dc5a 447 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
3fe4ff4f 448 int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 449
450 // The samples are correlations against I and Q versions of the
451 // tone that the tag AM-modulates, so every other sample is I,
452 // every other is Q. We just want power, so abs(I) + abs(Q) is
453 // close to what we want.
454 if(getNext) {
6fc68747 455 int8_t r = ABS(b) + ABS(prev);
15c4dc5a 456
f7e3ed82 457 dest[c++] = (uint8_t)r;
15c4dc5a 458
459 if(c >= 20000) {
460 break;
461 }
462 } else {
463 prev = b;
464 }
465
466 getNext = !getNext;
467 }
468 }
469
9455b51c 470 //////////////////////////////////////////
471 /////////// DEMODULATE ///////////////////
472 //////////////////////////////////////////
15c4dc5a 473
474 int i, j;
475 int max = 0, maxPos=0;
476
477 int skip = 4;
478
479// if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
480
481 // First, correlate for SOF
482 for(i = 0; i < 19000; i++) {
483 int corr = 0;
484 for(j = 0; j < arraylen(FrameSOF); j += skip) {
485 corr += FrameSOF[j]*dest[i+(j/skip)];
486 }
487 if(corr > max) {
488 max = corr;
489 maxPos = i;
490 }
491 }
492// DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
493
494 int k = 0; // this will be our return value
495
496 // greg - If correlation is less than 1 then there's little point in continuing
497 if ((max/(arraylen(FrameSOF)/skip)) >= 1) // THIS SHOULD BE 1
498 {
9455b51c 499
500 i = maxPos + arraylen(FrameSOF)/skip;
501
502 uint8_t outBuf[20];
503 memset(outBuf, 0, sizeof(outBuf));
504 uint8_t mask = 0x01;
505 for(;;) {
506 int corr0 = 0, corr1 = 0, corrEOF = 0;
507 for(j = 0; j < arraylen(Logic0); j += skip) {
508 corr0 += Logic0[j]*dest[i+(j/skip)];
509 }
510 for(j = 0; j < arraylen(Logic1); j += skip) {
511 corr1 += Logic1[j]*dest[i+(j/skip)];
512 }
513 for(j = 0; j < arraylen(FrameEOF); j += skip) {
514 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
515 }
516 // Even things out by the length of the target waveform.
517 corr0 *= 4;
518 corr1 *= 4;
519
520 if(corrEOF > corr1 && corrEOF > corr0) {
521 // DbpString("EOF at %d", i);
522 break;
523 } else if(corr1 > corr0) {
524 i += arraylen(Logic1)/skip;
525 outBuf[k] |= mask;
526 } else {
527 i += arraylen(Logic0)/skip;
528 }
529 mask <<= 1;
530 if(mask == 0) {
531 k++;
532 mask = 0x01;
533 }
534 if((i+(int)arraylen(FrameEOF)) >= 2000) {
535 DbpString("ran off end!");
536 break;
537 }
15c4dc5a 538 }
9455b51c 539 if(mask != 0x01) {
540 DbpString("sniff: error, uneven octet! (discard extra bits!)");
541 /// DbpString(" mask=%02x", mask);
15c4dc5a 542 }
9455b51c 543 // uint8_t str1 [8];
544 // itoa(k,str1);
545 // strncat(str1," octets read",8);
546
547 // DbpString( str1); // DbpString("%d octets", k);
548
549 // for(i = 0; i < k; i+=3) {
550 // //DbpString("# %2d: %02x ", i, outBuf[i]);
551 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
552 // }
553
554 for(i = 0; i < k; i++) {
555 receivedResponse[i] = outBuf[i];
15c4dc5a 556 }
15c4dc5a 557 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
558 return k; // return the number of bytes demodulated
559
560/// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
561}
562
9455b51c 563
564static void BuildIdentifyRequest(void);
15c4dc5a 565//-----------------------------------------------------------------------------
566// Start to read an ISO 15693 tag. We send an identify request, then wait
567// for the response. The response is not demodulated, just left in the buffer
568// so that it can be downloaded to a PC and processed there.
569//-----------------------------------------------------------------------------
570void AcquireRawAdcSamplesIso15693(void)
571{
117d9ec2 572 uint8_t *dest = BigBuf_get_addr();
15c4dc5a 573
3fe4ff4f 574 int c = 0;
575 int getNext = 0;
f7e3ed82 576 int8_t prev = 0;
15c4dc5a 577
7cc204bf 578 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 579 BuildIdentifyRequest();
580
581 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
582
583 // Give the tags time to energize
584 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
585 SpinDelay(100);
586
587 // Now send the command
588 FpgaSetupSsc();
589 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
590
591 c = 0;
592 for(;;) {
593 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
594 AT91C_BASE_SSC->SSC_THR = ToSend[c];
595 c++;
596 if(c == ToSendMax+3) {
597 break;
598 }
599 }
600 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 601 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 602 (void)r;
603 }
604 WDT_HIT();
605 }
606
607 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
608
609 c = 0;
610 getNext = FALSE;
611 for(;;) {
612 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
613 AT91C_BASE_SSC->SSC_THR = 0x43;
614 }
615 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
f7e3ed82 616 int8_t b;
617 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
15c4dc5a 618
9455b51c 619 // The samples are correlations against I and Q versions of the
620 // tone that the tag AM-modulates, so every other sample is I,
621 // every other is Q. We just want power, so abs(I) + abs(Q) is
622 // close to what we want.
623 if(getNext) {
6fc68747 624 int8_t r = ABS(b) + ABS(prev);
9455b51c 625
626 dest[c++] = (uint8_t)r;
627
628 if(c >= 2000) {
629 break;
630 }
631 } else {
632 prev = b;
633 }
634
635 getNext = !getNext;
636 }
637 }
638}
639
640
641void RecordRawAdcSamplesIso15693(void)
642{
117d9ec2 643 uint8_t *dest = BigBuf_get_addr();
3fe4ff4f 644
9455b51c 645 int c = 0;
9455b51c 646 int getNext = 0;
9455b51c 647 int8_t prev = 0;
648
7cc204bf 649 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9455b51c 650 // Setup SSC
651 FpgaSetupSsc();
652
653 // Start from off (no field generated)
5ee53a0e 654 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
655 SpinDelay(200);
9455b51c 656
657 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
658
659 SpinDelay(100);
660
661 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
662
663 c = 0;
664 getNext = FALSE;
665 for(;;) {
666 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
667 AT91C_BASE_SSC->SSC_THR = 0x43;
668 }
669 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
670 int8_t b;
671 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
672
673 // The samples are correlations against I and Q versions of the
674 // tone that the tag AM-modulates, so every other sample is I,
675 // every other is Q. We just want power, so abs(I) + abs(Q) is
676 // close to what we want.
677 if(getNext) {
6fc68747 678 int8_t r = ABS(b) + ABS(prev);
9455b51c 679
680 dest[c++] = (uint8_t)r;
681
682 if(c >= 7000) {
683 break;
684 }
685 } else {
686 prev = b;
687 }
688
689 getNext = !getNext;
690 WDT_HIT();
691 }
692 }
693 Dbprintf("fin record");
694}
695
696
697// Initialize the proxmark as iso15k reader
e6304bca 698// (this might produces glitches that confuse some tags
9455b51c 699void Iso15693InitReader() {
700 LED_A_ON();
701 LED_B_ON();
702 LED_C_OFF();
703 LED_D_OFF();
704
7cc204bf 705 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
9455b51c 706 // Setup SSC
e6304bca 707 // FpgaSetupSsc();
9455b51c 708
709 // Start from off (no field generated)
710 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
e6304bca 711 SpinDelay(10);
9455b51c 712
713 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
714 FpgaSetupSsc();
715
716 // Give the tags time to energize
717 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
e6304bca 718 SpinDelay(250);
9455b51c 719
720 LED_A_ON();
721 LED_B_OFF();
722 LED_C_OFF();
723 LED_D_OFF();
724}
725
726///////////////////////////////////////////////////////////////////////
727// ISO 15693 Part 3 - Air Interface
728// This section basicly contains transmission and receiving of bits
729///////////////////////////////////////////////////////////////////////
730
731// Encode (into the ToSend buffers) an identify request, which is the first
732// thing that you must send to a tag to get a response.
733static void BuildIdentifyRequest(void)
734{
735 uint8_t cmd[5];
736
737 uint16_t crc;
738 // one sub-carrier, inventory, 1 slot, fast rate
739 // AFI is at bit 5 (1<<4) when doing an INVENTORY
740 cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
741 // inventory command code
742 cmd[1] = 0x01;
743 // no mask
744 cmd[2] = 0x00;
745 //Now the CRC
746 crc = Crc(cmd, 3);
747 cmd[3] = crc & 0xff;
748 cmd[4] = crc >> 8;
749
750 CodeIso15693AsReader(cmd, sizeof(cmd));
751}
752
753// uid is in transmission order (which is reverse of display order)
754static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
755{
756 uint8_t cmd[13];
757
758 uint16_t crc;
759 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
760 // followed by teh block data
761 // one sub-carrier, inventory, 1 slot, fast rate
762 cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit, ADDR bit, OPTION bit
763 // READ BLOCK command code
764 cmd[1] = 0x20;
765 // UID may be optionally specified here
766 // 64-bit UID
767 cmd[2] = uid[0];
768 cmd[3] = uid[1];
769 cmd[4] = uid[2];
770 cmd[5] = uid[3];
771 cmd[6] = uid[4];
772 cmd[7] = uid[5];
773 cmd[8] = uid[6];
774 cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique)
775 // Block number to read
776 cmd[10] = blockNumber;//0x00;
777 //Now the CRC
778 crc = Crc(cmd, 11); // the crc needs to be calculated over 12 bytes
779 cmd[11] = crc & 0xff;
780 cmd[12] = crc >> 8;
781
782 CodeIso15693AsReader(cmd, sizeof(cmd));
783}
784
785// Now the VICC>VCD responses when we are simulating a tag
3fe4ff4f 786 static void BuildInventoryResponse( uint8_t *uid)
9455b51c 787{
788 uint8_t cmd[12];
789
790 uint16_t crc;
791 // one sub-carrier, inventory, 1 slot, fast rate
792 // AFI is at bit 5 (1<<4) when doing an INVENTORY
3fe4ff4f 793 //(1 << 2) | (1 << 5) | (1 << 1);
794 cmd[0] = 0; //
795 cmd[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported
9455b51c 796 // 64-bit UID
3fe4ff4f 797 cmd[2] = uid[7]; //0x32;
798 cmd[3] = uid[6]; //0x4b;
799 cmd[4] = uid[5]; //0x03;
800 cmd[5] = uid[4]; //0x01;
801 cmd[6] = uid[3]; //0x00;
802 cmd[7] = uid[2]; //0x10;
803 cmd[8] = uid[1]; //0x05;
804 cmd[9] = uid[0]; //0xe0;
9455b51c 805 //Now the CRC
806 crc = Crc(cmd, 10);
807 cmd[10] = crc & 0xff;
808 cmd[11] = crc >> 8;
809
810 CodeIso15693AsReader(cmd, sizeof(cmd));
811}
812
e6304bca 813// Universal Method for sending to and recv bytes from a tag
9455b51c 814// init ... should we initialize the reader?
815// speed ... 0 low speed, 1 hi speed
816// **recv will return you a pointer to the received data
817// If you do not need the answer use NULL for *recv[]
818// return: lenght of received data
819int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) {
820
821 int samples = 0;
822 int tsamples = 0;
823 int wait = 0;
824 int elapsed = 0;
825
826 LED_A_ON();
827 LED_B_ON();
828 LED_C_OFF();
829 LED_D_OFF();
830
99cf19d9 831 if (init) Iso15693InitReader();
832
9455b51c 833 int answerLen=0;
117d9ec2 834 uint8_t *answer = BigBuf_get_addr() + 3660;
835 if (recv != NULL) memset(answer, 0, 100);
9455b51c 836
9455b51c 837 if (!speed) {
838 // low speed (1 out of 256)
839 CodeIso15693AsReader256(send, sendlen);
840 } else {
841 // high speed (1 out of 4)
842 CodeIso15693AsReader(send, sendlen);
843 }
844
845 LED_A_ON();
846 LED_B_OFF();
847
848 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
849 // Now wait for a response
850 if (recv!=NULL) {
851 LED_A_OFF();
852 LED_B_ON();
853 answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ;
854 *recv=answer;
855 }
856
4a71da5a 857 LEDsoff();
9455b51c 858
859 return answerLen;
860}
15c4dc5a 861
15c4dc5a 862
9455b51c 863// --------------------------------------------------------------------
864// Debug Functions
865// --------------------------------------------------------------------
15c4dc5a 866
9455b51c 867// Decodes a message from a tag and displays its metadata and content
868#define DBD15STATLEN 48
869void DbdecodeIso15693Answer(int len, uint8_t *d) {
870 char status[DBD15STATLEN+1]={0};
871 uint16_t crc;
872
873 if (len>3) {
874 if (d[0]&(1<<3))
875 strncat(status,"ProtExt ",DBD15STATLEN);
876 if (d[0]&1) {
877 // error
878 strncat(status,"Error ",DBD15STATLEN);
879 switch (d[1]) {
880 case 0x01:
881 strncat(status,"01:notSupp",DBD15STATLEN);
15c4dc5a 882 break;
9455b51c 883 case 0x02:
884 strncat(status,"02:notRecog",DBD15STATLEN);
885 break;
886 case 0x03:
887 strncat(status,"03:optNotSupp",DBD15STATLEN);
888 break;
889 case 0x0f:
890 strncat(status,"0f:noInfo",DBD15STATLEN);
891 break;
892 case 0x10:
893 strncat(status,"10:dontExist",DBD15STATLEN);
894 break;
895 case 0x11:
896 strncat(status,"11:lockAgain",DBD15STATLEN);
897 break;
898 case 0x12:
899 strncat(status,"12:locked",DBD15STATLEN);
900 break;
901 case 0x13:
902 strncat(status,"13:progErr",DBD15STATLEN);
903 break;
904 case 0x14:
905 strncat(status,"14:lockErr",DBD15STATLEN);
906 break;
907 default:
908 strncat(status,"unknownErr",DBD15STATLEN);
15c4dc5a 909 }
9455b51c 910 strncat(status," ",DBD15STATLEN);
911 } else {
912 strncat(status,"NoErr ",DBD15STATLEN);
15c4dc5a 913 }
9455b51c 914
915 crc=Crc(d,len-2);
916 if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) )
917 strncat(status,"CrcOK",DBD15STATLEN);
918 else
919 strncat(status,"CrcFail!",DBD15STATLEN);
920
921 Dbprintf("%s",status);
15c4dc5a 922 }
923}
924
9455b51c 925
926
927///////////////////////////////////////////////////////////////////////
928// Functions called via USB/Client
929///////////////////////////////////////////////////////////////////////
930
931void SetDebugIso15693(uint32_t debug) {
932 DEBUG=debug;
933 Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off");
934 return;
935}
936
937
938
15c4dc5a 939//-----------------------------------------------------------------------------
940// Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
941// all demodulation performed in arm rather than host. - greg
942//-----------------------------------------------------------------------------
f7e3ed82 943void ReaderIso15693(uint32_t parameter)
15c4dc5a 944{
945 LED_A_ON();
946 LED_B_ON();
947 LED_C_OFF();
948 LED_D_OFF();
949
15c4dc5a 950 int answerLen1 = 0;
951 int answerLen2 = 0;
952 int answerLen3 = 0;
3fe4ff4f 953 int i = 0;
954 int samples = 0;
955 int tsamples = 0;
956 int wait = 0;
957 int elapsed = 0;
958 uint8_t TagUID[8] = {0x00};
959
99cf19d9 960 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 961
99cf19d9 962 uint8_t *answer1 = BigBuf_get_addr() + 3660;
963 uint8_t *answer2 = BigBuf_get_addr() + 3760;
964 uint8_t *answer3 = BigBuf_get_addr() + 3860;
15c4dc5a 965 // Blank arrays
117d9ec2 966 memset(answer1, 0x00, 300);
15c4dc5a 967
3fe4ff4f 968 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
15c4dc5a 969 // Setup SSC
970 FpgaSetupSsc();
971
972 // Start from off (no field generated)
5ee53a0e 973 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
974 SpinDelay(200);
15c4dc5a 975
15c4dc5a 976 // Give the tags time to energize
977 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
978 SpinDelay(200);
979
980 LED_A_ON();
981 LED_B_OFF();
982 LED_C_OFF();
983 LED_D_OFF();
984
15c4dc5a 985 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
986 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
15c4dc5a 987
988 // Now send the IDENTIFY command
989 BuildIdentifyRequest();
3fe4ff4f 990
991 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
992
15c4dc5a 993 // Now wait for a response
994 answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
995
996 if (answerLen1 >=12) // we should do a better check than this
997 {
15c4dc5a 998 TagUID[0] = answer1[2];
999 TagUID[1] = answer1[3];
1000 TagUID[2] = answer1[4];
1001 TagUID[3] = answer1[5];
1002 TagUID[4] = answer1[6];
1003 TagUID[5] = answer1[7];
1004 TagUID[6] = answer1[8]; // IC Manufacturer code
9455b51c 1005 TagUID[7] = answer1[9]; // always E0
15c4dc5a 1006
15c4dc5a 1007 }
1008
9455b51c 1009 Dbprintf("%d octets read from IDENTIFY request:", answerLen1);
1010 DbdecodeIso15693Answer(answerLen1,answer1);
d19929cb 1011 Dbhexdump(answerLen1,answer1,true);
9455b51c 1012
1013 // UID is reverse
1014 if (answerLen1>=12)
3fe4ff4f 1015 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1016 TagUID[7],TagUID[6],TagUID[5],TagUID[4],
1017 TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
9455b51c 1018
1019
1020 Dbprintf("%d octets read from SELECT request:", answerLen2);
1021 DbdecodeIso15693Answer(answerLen2,answer2);
d19929cb 1022 Dbhexdump(answerLen2,answer2,true);
9455b51c 1023
1024 Dbprintf("%d octets read from XXX request:", answerLen3);
1025 DbdecodeIso15693Answer(answerLen3,answer3);
d19929cb 1026 Dbhexdump(answerLen3,answer3,true);
9455b51c 1027
9455b51c 1028 // read all pages
1029 if (answerLen1>=12 && DEBUG) {
1030 i=0;
1031 while (i<32) { // sanity check, assume max 32 pages
1032 BuildReadBlockRequest(TagUID,i);
1033 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
1034 answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
1035 if (answerLen2>0) {
1036 Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
1037 DbdecodeIso15693Answer(answerLen2,answer2);
d19929cb 1038 Dbhexdump(answerLen2,answer2,true);
9455b51c 1039 if ( *((uint32_t*) answer2) == 0x07160101 ) break; // exit on NoPageErr
1040 }
1041 i++;
1042 }
1043 }
15c4dc5a 1044
15c4dc5a 1045 LED_A_OFF();
1046 LED_B_OFF();
1047 LED_C_OFF();
1048 LED_D_OFF();
1049}
1050
15c4dc5a 1051// Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1052// all demodulation performed in arm rather than host. - greg
3fe4ff4f 1053void SimTagIso15693(uint32_t parameter, uint8_t *uid)
15c4dc5a 1054{
1055 LED_A_ON();
1056 LED_B_ON();
1057 LED_C_OFF();
1058 LED_D_OFF();
1059
15c4dc5a 1060 int answerLen1 = 0;
3fe4ff4f 1061 int samples = 0;
1062 int tsamples = 0;
1063 int wait = 0;
1064 int elapsed = 0;
15c4dc5a 1065
7cc204bf 1066 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
15c4dc5a 1067
99cf19d9 1068 uint8_t *buf = BigBuf_get_addr() + 3660;
1069 memset(buf, 0x00, 100);
3fe4ff4f 1070
99cf19d9 1071 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
15c4dc5a 1072 FpgaSetupSsc();
1073
3fe4ff4f 1074 // Start from off (no field generated)
5ee53a0e 1075 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 1076 SpinDelay(200);
1077
1078 LED_A_OFF();
1079 LED_B_OFF();
1080 LED_C_ON();
1081 LED_D_OFF();
1082
3fe4ff4f 1083 // Listen to reader
1084 answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
15c4dc5a 1085
1086 if (answerLen1 >=1) // we should do a better check than this
1087 {
1088 // Build a suitable reponse to the reader INVENTORY cocmmand
3fe4ff4f 1089 // not so obsvious, but in the call to BuildInventoryResponse, the command is copied to the global ToSend buffer used below.
1090
1091 BuildInventoryResponse(uid);
1092
15c4dc5a 1093 TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
1094 }
1095
1096 Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
3fe4ff4f 1097 buf[0], buf[1], buf[2], buf[3],
1098 buf[4], buf[5], buf[6], buf[7], buf[8]);
1099
1100 Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x",
1101 uid[0], uid[1], uid[2], uid[3],
1102 uid[4], uid[5], uid[6], uid[7]);
15c4dc5a 1103
1104 LED_A_OFF();
1105 LED_B_OFF();
1106 LED_C_OFF();
1107 LED_D_OFF();
1108}
9455b51c 1109
1110
1111// Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1112// (some manufactures offer a way to read the AFI, though)
1113void BruteforceIso15693Afi(uint32_t speed)
1114{
1115 uint8_t data[20];
1116 uint8_t *recv=data;
1117 int datalen=0, recvlen=0;
1118
1119 Iso15693InitReader();
1120
1121 // first without AFI
1122 // Tags should respond wihtout AFI and with AFI=0 even when AFI is active
1123
1124 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1125 ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
1126 data[1]=ISO15_CMD_INVENTORY;
1127 data[2]=0; // mask length
1128 datalen=AddCrc(data,3);
1129 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1130 WDT_HIT();
1131 if (recvlen>=12) {
1132 Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
1133 }
1134
1135 // now with AFI
1136
1137 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1138 ISO15_REQ_INVENTORY | ISO15_REQINV_AFI | ISO15_REQINV_SLOT1;
1139 data[1]=ISO15_CMD_INVENTORY;
1140 data[2]=0; // AFI
1141 data[3]=0; // mask length
1142
1143 for (int i=0;i<256;i++) {
1144 data[2]=i & 0xFF;
1145 datalen=AddCrc(data,4);
1146 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1147 WDT_HIT();
1148 if (recvlen>=12) {
1149 Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
1150 }
1151 }
1152 Dbprintf("AFI Bruteforcing done.");
1153
1154}
1155
1156// Allows to directly send commands to the tag via the client
1157void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
1158
1159 int recvlen=0;
117d9ec2 1160 uint8_t *recvbuf = BigBuf_get_addr();
902cb3c0 1161// UsbCommand n;
9455b51c 1162
1163 if (DEBUG) {
1164 Dbprintf("SEND");
d19929cb 1165 Dbhexdump(datalen,data,true);
9455b51c 1166 }
1167
1168 recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
1169
1170 if (recv) {
9455b51c 1171 LED_B_ON();
902cb3c0 1172 cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
9455b51c 1173 LED_B_OFF();
1174
1175 if (DEBUG) {
1176 Dbprintf("RECV");
1177 DbdecodeIso15693Answer(recvlen,recvbuf);
d19929cb 1178 Dbhexdump(recvlen,recvbuf,true);
9455b51c 1179 }
1180 }
1181
1182}
1183
1184
1185
1186
1187// --------------------------------------------------------------------
1188// -- Misc & deprecated functions
1189// --------------------------------------------------------------------
1190
e6304bca 1191/*
9455b51c 1192
1193// do not use; has a fix UID
1194static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1195{
1196 uint8_t cmd[12];
1197
1198 uint16_t crc;
1199 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1200 // followed by teh block data
1201 // one sub-carrier, inventory, 1 slot, fast rate
1202 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1203 // System Information command code
1204 cmd[1] = 0x2B;
1205 // UID may be optionally specified here
1206 // 64-bit UID
1207 cmd[2] = 0x32;
1208 cmd[3]= 0x4b;
1209 cmd[4] = 0x03;
1210 cmd[5] = 0x01;
1211 cmd[6] = 0x00;
1212 cmd[7] = 0x10;
1213 cmd[8] = 0x05;
1214 cmd[9]= 0xe0; // always e0 (not exactly unique)
1215 //Now the CRC
1216 crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1217 cmd[10] = crc & 0xff;
1218 cmd[11] = crc >> 8;
1219
1220 CodeIso15693AsReader(cmd, sizeof(cmd));
1221}
1222
9455b51c 1223
1224// do not use; has a fix UID
1225static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1226{
1227 uint8_t cmd[14];
1228
1229 uint16_t crc;
1230 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1231 // followed by teh block data
1232 // one sub-carrier, inventory, 1 slot, fast rate
1233 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1234 // READ Multi BLOCK command code
1235 cmd[1] = 0x23;
1236 // UID may be optionally specified here
1237 // 64-bit UID
1238 cmd[2] = 0x32;
1239 cmd[3]= 0x4b;
1240 cmd[4] = 0x03;
1241 cmd[5] = 0x01;
1242 cmd[6] = 0x00;
1243 cmd[7] = 0x10;
1244 cmd[8] = 0x05;
1245 cmd[9]= 0xe0; // always e0 (not exactly unique)
1246 // First Block number to read
1247 cmd[10] = 0x00;
1248 // Number of Blocks to read
1249 cmd[11] = 0x2f; // read quite a few
1250 //Now the CRC
1251 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1252 cmd[12] = crc & 0xff;
1253 cmd[13] = crc >> 8;
1254
1255 CodeIso15693AsReader(cmd, sizeof(cmd));
1256}
1257
1258// do not use; has a fix UID
1259static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1260{
1261 uint8_t cmd[14];
1262
1263 uint16_t crc;
1264 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1265 // followed by teh block data
1266 // one sub-carrier, inventory, 1 slot, fast rate
1267 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1268 // READ BLOCK command code
1269 cmd[1] = CmdCode;
1270 // UID may be optionally specified here
1271 // 64-bit UID
1272 cmd[2] = 0x32;
1273 cmd[3]= 0x4b;
1274 cmd[4] = 0x03;
1275 cmd[5] = 0x01;
1276 cmd[6] = 0x00;
1277 cmd[7] = 0x10;
1278 cmd[8] = 0x05;
1279 cmd[9]= 0xe0; // always e0 (not exactly unique)
1280 // Parameter
1281 cmd[10] = 0x00;
1282 cmd[11] = 0x0a;
1283
1284// cmd[12] = 0x00;
1285// cmd[13] = 0x00; //Now the CRC
1286 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1287 cmd[12] = crc & 0xff;
1288 cmd[13] = crc >> 8;
1289
1290 CodeIso15693AsReader(cmd, sizeof(cmd));
1291}
1292
1293// do not use; has a fix UID
1294static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1295{
1296 uint8_t cmd[14];
1297
1298 uint16_t crc;
1299 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1300 // followed by teh block data
1301 // one sub-carrier, inventory, 1 slot, fast rate
1302 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1303 // READ BLOCK command code
1304 cmd[1] = CmdCode;
1305 // UID may be optionally specified here
1306 // 64-bit UID
1307 cmd[2] = 0x32;
1308 cmd[3]= 0x4b;
1309 cmd[4] = 0x03;
1310 cmd[5] = 0x01;
1311 cmd[6] = 0x00;
1312 cmd[7] = 0x10;
1313 cmd[8] = 0x05;
1314 cmd[9]= 0xe0; // always e0 (not exactly unique)
1315 // Parameter
1316 cmd[10] = 0x05; // for custom codes this must be manufcturer code
1317 cmd[11] = 0x00;
1318
1319// cmd[12] = 0x00;
1320// cmd[13] = 0x00; //Now the CRC
1321 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1322 cmd[12] = crc & 0xff;
1323 cmd[13] = crc >> 8;
1324
1325 CodeIso15693AsReader(cmd, sizeof(cmd));
1326}
1327
1328
1329
1330
e6304bca 1331*/
9455b51c 1332
1333
Proxmark3 GIT tracking
Impressum, Datenschutz