]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/iso14443b.c
add 14a apdu send framing (based on RRG repo PR86 by Merlokk) (#795)
[proxmark3-svn] / armsrc / iso14443b.c
CommitLineData
15c4dc5a 1//-----------------------------------------------------------------------------
bd20f8f4 2// Jonathan Westhues, split Nov 2006
6a5d4e17 3// piwi 2018
bd20f8f4 4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
51d4f6f1 9// Routines to support ISO 14443B. This includes both the reader software and
10// the `fake tag' modes.
15c4dc5a 11//-----------------------------------------------------------------------------
bd20f8f4 12
fc52fbd4 13#include "iso14443b.h"
14
e30c654b 15#include "proxmark3.h"
15c4dc5a 16#include "apps.h"
f7e3ed82 17#include "util.h"
9ab7a6c7 18#include "string.h"
f7e3ed82 19#include "iso14443crc.h"
fc52fbd4 20#include "fpgaloader.h"
15c4dc5a 21
6a5d4e17 22#define RECEIVE_SAMPLES_TIMEOUT 1000 // TR0 max is 256/fs = 256/(848kHz) = 302us or 64 samples from FPGA. 1000 seems to be much too high?
23#define ISO14443B_DMA_BUFFER_SIZE 128
0d9a86c7 24
4be27083
FM
25// PCB Block number for APDUs
26static uint8_t pcb_blocknum = 0;
27
15c4dc5a 28//=============================================================================
29// An ISO 14443 Type B tag. We listen for commands from the reader, using
30// a UART kind of thing that's implemented in software. When we get a
31// frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
32// If it's good, then we can do something appropriate with it, and send
33// a response.
34//=============================================================================
35
36//-----------------------------------------------------------------------------
37// Code up a string of octets at layer 2 (including CRC, we don't generate
38// that here) so that they can be transmitted to the reader. Doesn't transmit
39// them yet, just leaves them ready to send in ToSend[].
40//-----------------------------------------------------------------------------
f7e3ed82 41static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
15c4dc5a 42{
7d5ebac9
MHS
43 int i;
44
45 ToSendReset();
46
47 // Transmit a burst of ones, as the initial thing that lets the
48 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
49 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
50 // so I will too.
51 for(i = 0; i < 20; i++) {
52 ToSendStuffBit(1);
53 ToSendStuffBit(1);
54 ToSendStuffBit(1);
55 ToSendStuffBit(1);
56 }
57
58 // Send SOF.
59 for(i = 0; i < 10; i++) {
60 ToSendStuffBit(0);
61 ToSendStuffBit(0);
62 ToSendStuffBit(0);
63 ToSendStuffBit(0);
64 }
65 for(i = 0; i < 2; i++) {
66 ToSendStuffBit(1);
67 ToSendStuffBit(1);
68 ToSendStuffBit(1);
69 ToSendStuffBit(1);
70 }
71
72 for(i = 0; i < len; i++) {
73 int j;
74 uint8_t b = cmd[i];
75
76 // Start bit
77 ToSendStuffBit(0);
78 ToSendStuffBit(0);
79 ToSendStuffBit(0);
80 ToSendStuffBit(0);
81
82 // Data bits
83 for(j = 0; j < 8; j++) {
84 if(b & 1) {
85 ToSendStuffBit(1);
86 ToSendStuffBit(1);
87 ToSendStuffBit(1);
88 ToSendStuffBit(1);
89 } else {
90 ToSendStuffBit(0);
91 ToSendStuffBit(0);
92 ToSendStuffBit(0);
93 ToSendStuffBit(0);
94 }
95 b >>= 1;
96 }
97
98 // Stop bit
99 ToSendStuffBit(1);
100 ToSendStuffBit(1);
101 ToSendStuffBit(1);
102 ToSendStuffBit(1);
103 }
104
51d4f6f1 105 // Send EOF.
7d5ebac9
MHS
106 for(i = 0; i < 10; i++) {
107 ToSendStuffBit(0);
108 ToSendStuffBit(0);
109 ToSendStuffBit(0);
110 ToSendStuffBit(0);
111 }
51d4f6f1 112 for(i = 0; i < 2; i++) {
7d5ebac9
MHS
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 ToSendStuffBit(1);
116 ToSendStuffBit(1);
117 }
118
119 // Convert from last byte pos to length
120 ToSendMax++;
15c4dc5a 121}
122
123//-----------------------------------------------------------------------------
124// The software UART that receives commands from the reader, and its state
125// variables.
126//-----------------------------------------------------------------------------
127static struct {
7d5ebac9
MHS
128 enum {
129 STATE_UNSYNCD,
130 STATE_GOT_FALLING_EDGE_OF_SOF,
131 STATE_AWAITING_START_BIT,
46734099 132 STATE_RECEIVING_DATA
7d5ebac9
MHS
133 } state;
134 uint16_t shiftReg;
135 int bitCnt;
136 int byteCnt;
137 int byteCntMax;
138 int posCnt;
139 uint8_t *output;
15c4dc5a 140} Uart;
141
142/* Receive & handle a bit coming from the reader.
51d4f6f1 143 *
144 * This function is called 4 times per bit (every 2 subcarrier cycles).
145 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
15c4dc5a 146 *
147 * LED handling:
148 * LED A -> ON once we have received the SOF and are expecting the rest.
149 * LED A -> OFF once we have received EOF or are in error state or unsynced
150 *
151 * Returns: true if we received a EOF
152 * false if we are still waiting for some more
153 */
46734099 154static RAMFUNC int Handle14443bUartBit(uint8_t bit)
15c4dc5a 155{
7d5ebac9 156 switch(Uart.state) {
03dc1740 157 case STATE_UNSYNCD:
7d5ebac9
MHS
158 if(!bit) {
159 // we went low, so this could be the beginning
160 // of an SOF
161 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
162 Uart.posCnt = 0;
163 Uart.bitCnt = 0;
164 }
165 break;
166
167 case STATE_GOT_FALLING_EDGE_OF_SOF:
168 Uart.posCnt++;
51d4f6f1 169 if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit
7d5ebac9 170 if(bit) {
51d4f6f1 171 if(Uart.bitCnt > 9) {
7d5ebac9
MHS
172 // we've seen enough consecutive
173 // zeros that it's a valid SOF
174 Uart.posCnt = 0;
175 Uart.byteCnt = 0;
176 Uart.state = STATE_AWAITING_START_BIT;
177 LED_A_ON(); // Indicate we got a valid SOF
178 } else {
179 // didn't stay down long enough
180 // before going high, error
46734099 181 Uart.state = STATE_UNSYNCD;
7d5ebac9
MHS
182 }
183 } else {
184 // do nothing, keep waiting
185 }
186 Uart.bitCnt++;
187 }
188 if(Uart.posCnt >= 4) Uart.posCnt = 0;
51d4f6f1 189 if(Uart.bitCnt > 12) {
7d5ebac9
MHS
190 // Give up if we see too many zeros without
191 // a one, too.
46734099 192 LED_A_OFF();
193 Uart.state = STATE_UNSYNCD;
7d5ebac9
MHS
194 }
195 break;
196
197 case STATE_AWAITING_START_BIT:
198 Uart.posCnt++;
199 if(bit) {
51d4f6f1 200 if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
7d5ebac9
MHS
201 // stayed high for too long between
202 // characters, error
46734099 203 Uart.state = STATE_UNSYNCD;
7d5ebac9
MHS
204 }
205 } else {
206 // falling edge, this starts the data byte
207 Uart.posCnt = 0;
208 Uart.bitCnt = 0;
209 Uart.shiftReg = 0;
210 Uart.state = STATE_RECEIVING_DATA;
7d5ebac9
MHS
211 }
212 break;
213
214 case STATE_RECEIVING_DATA:
215 Uart.posCnt++;
216 if(Uart.posCnt == 2) {
217 // time to sample a bit
218 Uart.shiftReg >>= 1;
219 if(bit) {
220 Uart.shiftReg |= 0x200;
221 }
222 Uart.bitCnt++;
223 }
224 if(Uart.posCnt >= 4) {
225 Uart.posCnt = 0;
226 }
227 if(Uart.bitCnt == 10) {
228 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
229 {
230 // this is a data byte, with correct
231 // start and stop bits
232 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
233 Uart.byteCnt++;
234
235 if(Uart.byteCnt >= Uart.byteCntMax) {
236 // Buffer overflowed, give up
46734099 237 LED_A_OFF();
238 Uart.state = STATE_UNSYNCD;
7d5ebac9
MHS
239 } else {
240 // so get the next byte now
241 Uart.posCnt = 0;
242 Uart.state = STATE_AWAITING_START_BIT;
243 }
46734099 244 } else if (Uart.shiftReg == 0x000) {
7d5ebac9
MHS
245 // this is an EOF byte
246 LED_A_OFF(); // Finished receiving
46734099 247 Uart.state = STATE_UNSYNCD;
132a0217 248 if (Uart.byteCnt != 0) {
44964fd1 249 return true;
132a0217 250 }
7d5ebac9
MHS
251 } else {
252 // this is an error
46734099 253 LED_A_OFF();
254 Uart.state = STATE_UNSYNCD;
7d5ebac9
MHS
255 }
256 }
257 break;
258
7d5ebac9 259 default:
46734099 260 LED_A_OFF();
7d5ebac9
MHS
261 Uart.state = STATE_UNSYNCD;
262 break;
263 }
264
44964fd1 265 return false;
15c4dc5a 266}
267
46734099 268
269static void UartReset()
270{
271 Uart.byteCntMax = MAX_FRAME_SIZE;
272 Uart.state = STATE_UNSYNCD;
273 Uart.byteCnt = 0;
274 Uart.bitCnt = 0;
275}
276
277
278static void UartInit(uint8_t *data)
279{
280 Uart.output = data;
281 UartReset();
282}
283
284
15c4dc5a 285//-----------------------------------------------------------------------------
286// Receive a command (from the reader to us, where we are the simulated tag),
287// and store it in the given buffer, up to the given maximum length. Keeps
288// spinning, waiting for a well-framed command, until either we get one
44964fd1 289// (returns true) or someone presses the pushbutton on the board (false).
15c4dc5a 290//
291// Assume that we're called with the SSC (to the FPGA) and ADC path set
292// correctly.
293//-----------------------------------------------------------------------------
46734099 294static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len)
15c4dc5a 295{
51d4f6f1 296 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
7d5ebac9
MHS
297 // only, since we are receiving, not transmitting).
298 // Signal field is off with the appropriate LED
299 LED_D_OFF();
300 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
301
7d5ebac9 302 // Now run a `software UART' on the stream of incoming samples.
46734099 303 UartInit(received);
7d5ebac9
MHS
304
305 for(;;) {
306 WDT_HIT();
307
44964fd1 308 if(BUTTON_PRESS()) return false;
7d5ebac9 309
7d5ebac9
MHS
310 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
311 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
46734099 312 for(uint8_t mask = 0x80; mask != 0x00; mask >>= 1) {
313 if(Handle14443bUartBit(b & mask)) {
7d5ebac9 314 *len = Uart.byteCnt;
44964fd1 315 return true;
7d5ebac9
MHS
316 }
317 }
318 }
319 }
bee99bbf 320
44964fd1 321 return false;
15c4dc5a 322}
323
324//-----------------------------------------------------------------------------
325// Main loop of simulated tag: receive commands from reader, decide what
326// response to send, and send it.
327//-----------------------------------------------------------------------------
51d4f6f1 328void SimulateIso14443bTag(void)
15c4dc5a 329{
14660057 330 // the only commands we understand is WUPB, AFI=0, Select All, N=1:
331 static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB
332 // ... and REQB, AFI=0, Normal Request, N=1:
f3b83bee 333 static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB
f3b83bee 334 // ... and HLTB
14660057 335 static const uint8_t cmd3[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB
f3b83bee 336 // ... and ATTRIB
14660057 337 static const uint8_t cmd4[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB
46734099 338
339 // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
51d4f6f1 340 // supports only 106kBit/s in both directions, max frame size = 32Bytes,
341 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
7d5ebac9
MHS
342 static const uint8_t response1[] = {
343 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
344 0x00, 0x21, 0x85, 0x5e, 0xd7
345 };
f3b83bee 346 // response to HLTB and ATTRIB
347 static const uint8_t response2[] = {0x00, 0x78, 0xF0};
348
15c4dc5a 349
5f605b8f 350 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
351
46734099 352 clear_trace();
44964fd1 353 set_tracing(true);
46734099 354
355 const uint8_t *resp;
356 uint8_t *respCode;
357 uint16_t respLen, respCodeLen;
15c4dc5a 358
51d4f6f1 359 // allocate command receive buffer
360 BigBuf_free();
361 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
15c4dc5a 362
46734099 363 uint16_t len;
364 uint16_t cmdsRecvd = 0;
15c4dc5a 365
51d4f6f1 366 // prepare the (only one) tag answer:
7d5ebac9 367 CodeIso14443bAsTag(response1, sizeof(response1));
46734099 368 uint8_t *resp1Code = BigBuf_malloc(ToSendMax);
dd57061c 369 memcpy(resp1Code, ToSend, ToSendMax);
46734099 370 uint16_t resp1CodeLen = ToSendMax;
15c4dc5a 371
f3b83bee 372 // prepare the (other) tag answer:
373 CodeIso14443bAsTag(response2, sizeof(response2));
374 uint8_t *resp2Code = BigBuf_malloc(ToSendMax);
dd57061c 375 memcpy(resp2Code, ToSend, ToSendMax);
f3b83bee 376 uint16_t resp2CodeLen = ToSendMax;
377
7d5ebac9
MHS
378 // We need to listen to the high-frequency, peak-detected path.
379 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
6a5d4e17 380 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
15c4dc5a 381
7d5ebac9 382 cmdsRecvd = 0;
15c4dc5a 383
7d5ebac9 384 for(;;) {
15c4dc5a 385
46734099 386 if(!GetIso14443bCommandFromReader(receivedCmd, &len)) {
51d4f6f1 387 Dbprintf("button pressed, received %d commands", cmdsRecvd);
388 break;
46734099 389 }
7d5ebac9 390
d9de20fa 391 LogTrace(receivedCmd, len, 0, 0, NULL, true);
7d5ebac9 392
46734099 393 // Good, look at the command now.
394 if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0)
14660057 395 || (len == sizeof(cmd2) && memcmp(receivedCmd, cmd2, len) == 0) ) {
dd57061c 396 resp = response1;
46734099 397 respLen = sizeof(response1);
dd57061c 398 respCode = resp1Code;
46734099 399 respCodeLen = resp1CodeLen;
14660057 400 } else if ( (len == sizeof(cmd3) && receivedCmd[0] == cmd3[0])
401 || (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) ) {
dd57061c 402 resp = response2;
f3b83bee 403 respLen = sizeof(response2);
dd57061c 404 respCode = resp2Code;
f3b83bee 405 respCodeLen = resp2CodeLen;
7d5ebac9
MHS
406 } else {
407 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
408 // And print whether the CRC fails, just for good measure
46734099 409 uint8_t b1, b2;
f3b83bee 410 if (len >= 3){ // if crc exists
411 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
412 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
413 // Not so good, try again.
414 DbpString("+++CRC fail");
14660057 415
f3b83bee 416 } else {
417 DbpString("CRC passes");
418 }
7d5ebac9 419 }
f3b83bee 420 //get rid of compiler warning
421 respCodeLen = 0;
422 resp = response1;
423 respLen = 0;
424 respCode = resp1Code;
425 //don't crash at new command just wait and see if reader will send other new cmds.
426 //break;
7d5ebac9
MHS
427 }
428
7d5ebac9
MHS
429 cmdsRecvd++;
430
431 if(cmdsRecvd > 0x30) {
432 DbpString("many commands later...");
433 break;
434 }
435
46734099 436 if(respCodeLen <= 0) continue;
7d5ebac9
MHS
437
438 // Modulate BPSK
439 // Signal field is off with the appropriate LED
440 LED_D_OFF();
441 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
442 AT91C_BASE_SSC->SSC_THR = 0xff;
6a5d4e17 443 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
7d5ebac9
MHS
444
445 // Transmit the response.
46734099 446 uint16_t i = 0;
7d5ebac9
MHS
447 for(;;) {
448 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
46734099 449 uint8_t b = respCode[i];
7d5ebac9
MHS
450
451 AT91C_BASE_SSC->SSC_THR = b;
452
453 i++;
46734099 454 if(i > respCodeLen) {
7d5ebac9
MHS
455 break;
456 }
457 }
458 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
459 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
460 (void)b;
461 }
462 }
dd57061c 463
46734099 464 // trace the response:
d9de20fa 465 LogTrace(resp, respLen, 0, 0, NULL, false);
dd57061c 466
7d5ebac9 467 }
15c4dc5a 468}
469
470//=============================================================================
471// An ISO 14443 Type B reader. We take layer two commands, code them
472// appropriately, and then send them to the tag. We then listen for the
473// tag's response, which we leave in the buffer to be demodulated on the
474// PC side.
475//=============================================================================
476
477static struct {
7d5ebac9
MHS
478 enum {
479 DEMOD_UNSYNCD,
480 DEMOD_PHASE_REF_TRAINING,
481 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
482 DEMOD_GOT_FALLING_EDGE_OF_SOF,
483 DEMOD_AWAITING_START_BIT,
46734099 484 DEMOD_RECEIVING_DATA
7d5ebac9
MHS
485 } state;
486 int bitCount;
487 int posCount;
488 int thisBit;
51d4f6f1 489/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
7d5ebac9
MHS
490 int metric;
491 int metricN;
51d4f6f1 492*/
7d5ebac9
MHS
493 uint16_t shiftReg;
494 uint8_t *output;
495 int len;
496 int sumI;
497 int sumQ;
15c4dc5a 498} Demod;
499
500/*
501 * Handles reception of a bit from the tag
502 *
51d4f6f1 503 * This function is called 2 times per bit (every 4 subcarrier cycles).
504 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
505 *
15c4dc5a 506 * LED handling:
507 * LED C -> ON once we have received the SOF and are expecting the rest.
508 * LED C -> OFF once we have received EOF or are unsynced
509 *
510 * Returns: true if we received a EOF
511 * false if we are still waiting for some more
512 *
513 */
51d4f6f1 514static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
15c4dc5a 515{
7d5ebac9 516 int v;
15c4dc5a 517
51d4f6f1 518// The soft decision on the bit uses an estimate of just the
519// quadrant of the reference angle, not the exact angle.
15c4dc5a 520#define MAKE_SOFT_DECISION() { \
7d5ebac9
MHS
521 if(Demod.sumI > 0) { \
522 v = ci; \
523 } else { \
524 v = -ci; \
525 } \
526 if(Demod.sumQ > 0) { \
527 v += cq; \
528 } else { \
529 v -= cq; \
530 } \
531 }
15c4dc5a 532
51d4f6f1 533#define SUBCARRIER_DETECT_THRESHOLD 8
534
51d4f6f1 535// Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
6a5d4e17 536#define AMPLITUDE(ci,cq) (MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2))
7d5ebac9
MHS
537 switch(Demod.state) {
538 case DEMOD_UNSYNCD:
6a5d4e17 539 if(AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected
7d5ebac9 540 Demod.state = DEMOD_PHASE_REF_TRAINING;
51d4f6f1 541 Demod.sumI = ci;
542 Demod.sumQ = cq;
543 Demod.posCount = 1;
544 }
7d5ebac9
MHS
545 break;
546
547 case DEMOD_PHASE_REF_TRAINING:
548 if(Demod.posCount < 8) {
6a5d4e17 549 if (AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) {
51d4f6f1 550 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
551 // note: synchronization time > 80 1/fs
552 Demod.sumI += ci;
553 Demod.sumQ += cq;
554 Demod.posCount++;
555 } else { // subcarrier lost
556 Demod.state = DEMOD_UNSYNCD;
7d5ebac9 557 }
51d4f6f1 558 } else {
559 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
7d5ebac9 560 }
7d5ebac9
MHS
561 break;
562
563 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
564 MAKE_SOFT_DECISION();
51d4f6f1 565 if(v < 0) { // logic '0' detected
7d5ebac9 566 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
51d4f6f1 567 Demod.posCount = 0; // start of SOF sequence
7d5ebac9 568 } else {
51d4f6f1 569 if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs
7d5ebac9
MHS
570 Demod.state = DEMOD_UNSYNCD;
571 }
572 }
573 Demod.posCount++;
574 break;
575
576 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
51d4f6f1 577 Demod.posCount++;
7d5ebac9
MHS
578 MAKE_SOFT_DECISION();
579 if(v > 0) {
51d4f6f1 580 if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
7d5ebac9
MHS
581 Demod.state = DEMOD_UNSYNCD;
582 } else {
583 LED_C_ON(); // Got SOF
584 Demod.state = DEMOD_AWAITING_START_BIT;
585 Demod.posCount = 0;
586 Demod.len = 0;
51d4f6f1 587/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
7d5ebac9
MHS
588 Demod.metricN = 0;
589 Demod.metric = 0;
51d4f6f1 590*/
7d5ebac9
MHS
591 }
592 } else {
51d4f6f1 593 if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu)
7d5ebac9 594 Demod.state = DEMOD_UNSYNCD;
09c66f1f 595 LED_C_OFF();
7d5ebac9
MHS
596 }
597 }
7d5ebac9
MHS
598 break;
599
600 case DEMOD_AWAITING_START_BIT:
51d4f6f1 601 Demod.posCount++;
7d5ebac9
MHS
602 MAKE_SOFT_DECISION();
603 if(v > 0) {
51d4f6f1 604 if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
7d5ebac9 605 Demod.state = DEMOD_UNSYNCD;
09c66f1f 606 LED_C_OFF();
7d5ebac9 607 }
51d4f6f1 608 } else { // start bit detected
7d5ebac9 609 Demod.bitCount = 0;
51d4f6f1 610 Demod.posCount = 1; // this was the first half
7d5ebac9
MHS
611 Demod.thisBit = v;
612 Demod.shiftReg = 0;
613 Demod.state = DEMOD_RECEIVING_DATA;
614 }
615 break;
616
617 case DEMOD_RECEIVING_DATA:
618 MAKE_SOFT_DECISION();
51d4f6f1 619 if(Demod.posCount == 0) { // first half of bit
7d5ebac9
MHS
620 Demod.thisBit = v;
621 Demod.posCount = 1;
51d4f6f1 622 } else { // second half of bit
7d5ebac9
MHS
623 Demod.thisBit += v;
624
51d4f6f1 625/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
7d5ebac9
MHS
626 if(Demod.thisBit > 0) {
627 Demod.metric += Demod.thisBit;
628 } else {
629 Demod.metric -= Demod.thisBit;
630 }
631 (Demod.metricN)++;
dd57061c 632*/
7d5ebac9
MHS
633
634 Demod.shiftReg >>= 1;
51d4f6f1 635 if(Demod.thisBit > 0) { // logic '1'
7d5ebac9
MHS
636 Demod.shiftReg |= 0x200;
637 }
638
639 Demod.bitCount++;
640 if(Demod.bitCount == 10) {
641 uint16_t s = Demod.shiftReg;
51d4f6f1 642 if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'
7d5ebac9
MHS
643 uint8_t b = (s >> 1);
644 Demod.output[Demod.len] = b;
645 Demod.len++;
646 Demod.state = DEMOD_AWAITING_START_BIT;
7d5ebac9
MHS
647 } else {
648 Demod.state = DEMOD_UNSYNCD;
09c66f1f 649 LED_C_OFF();
650 if(s == 0x000) {
51d4f6f1 651 // This is EOF (start, stop and all data bits == '0'
44964fd1 652 return true;
09c66f1f 653 }
7d5ebac9
MHS
654 }
655 }
656 Demod.posCount = 0;
657 }
658 break;
659
660 default:
661 Demod.state = DEMOD_UNSYNCD;
09c66f1f 662 LED_C_OFF();
7d5ebac9
MHS
663 break;
664 }
665
44964fd1 666 return false;
7d5ebac9 667}
67ac4bf7 668
669
aeadbdb2
MHS
670static void DemodReset()
671{
672 // Clear out the state of the "UART" that receives from the tag.
aeadbdb2
MHS
673 Demod.len = 0;
674 Demod.state = DEMOD_UNSYNCD;
51d4f6f1 675 Demod.posCount = 0;
aeadbdb2 676 memset(Demod.output, 0x00, MAX_FRAME_SIZE);
7d5ebac9 677}
67ac4bf7 678
679
7d5ebac9
MHS
680static void DemodInit(uint8_t *data)
681{
682 Demod.output = data;
683 DemodReset();
aeadbdb2
MHS
684}
685
67ac4bf7 686
15c4dc5a 687/*
355c8b4a 688 * Demodulate the samples we received from the tag, also log to tracebuffer
44964fd1 689 * quiet: set to 'true' to disable debug output
15c4dc5a 690 */
51d4f6f1 691static void GetSamplesFor14443bDemod(int n, bool quiet)
15c4dc5a 692{
6a5d4e17 693 int maxBehindBy = 0;
44964fd1 694 bool gotFrame = false;
6a5d4e17 695 int lastRxCounter, samples = 0;
696 int8_t ci, cq;
697
7d5ebac9
MHS
698 // Allocate memory from BigBuf for some buffers
699 // free all previous allocations first
700 BigBuf_free();
dd57061c 701
7d5ebac9
MHS
702 // The response (tag -> reader) that we're receiving.
703 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
dd57061c 704
7d5ebac9 705 // The DMA buffer, used to stream samples from the FPGA
6a5d4e17 706 uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));
15c4dc5a 707
7d5ebac9
MHS
708 // Set up the demodulator for tag -> reader responses.
709 DemodInit(receivedResponse);
15c4dc5a 710
6a5d4e17 711 // wait for last transfer to complete
712 while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY))
713
7d5ebac9 714 // Setup and start DMA.
6a5d4e17 715 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
705bfa10 716 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
15c4dc5a 717
6a5d4e17 718 uint16_t *upTo = dmaBuf;
705bfa10 719 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
15c4dc5a 720
7d5ebac9 721 // Signal field is ON with the appropriate LED:
51d4f6f1 722 LED_D_ON();
7d5ebac9 723 // And put the FPGA in the appropriate mode
da586b17 724 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
15c4dc5a 725
7d5ebac9 726 for(;;) {
6a5d4e17 727 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
728 if(behindBy > maxBehindBy) {
729 maxBehindBy = behindBy;
730 }
15c4dc5a 731
6a5d4e17 732 if(behindBy < 1) continue;
15c4dc5a 733
6a5d4e17 734 ci = *upTo >> 8;
735 cq = *upTo;
736 upTo++;
737 lastRxCounter--;
738 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
739 upTo = dmaBuf; // start reading the circular buffer from the beginning
740 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
741 }
742 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
743 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
744 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers
745 }
746 samples++;
747
748 if(Handle14443bSamplesDemod(ci, cq)) {
749 gotFrame = true;
750 break;
7d5ebac9 751 }
15c4dc5a 752
6a5d4e17 753 if(samples > n) {
7d5ebac9
MHS
754 break;
755 }
756 }
51d4f6f1 757
6a5d4e17 758 FpgaDisableSscDma();
51d4f6f1 759
6a5d4e17 760 if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", maxBehindBy, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
355c8b4a 761 //Tracing
d9de20fa 762 if (Demod.len > 0) {
763 LogTrace(Demod.output, Demod.len, 0, 0, NULL, false);
355c8b4a 764 }
15c4dc5a 765}
766
67ac4bf7 767
15c4dc5a 768//-----------------------------------------------------------------------------
769// Transmit the command (to the tag) that was placed in ToSend[].
770//-----------------------------------------------------------------------------
51d4f6f1 771static void TransmitFor14443b(void)
15c4dc5a 772{
7d5ebac9 773 int c;
15c4dc5a 774
6a5d4e17 775 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
15c4dc5a 776
7d5ebac9 777 // Signal field is ON with the appropriate Red LED
15c4dc5a 778 LED_D_ON();
779 // Signal we are transmitting with the Green LED
780 LED_B_ON();
51d4f6f1 781 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
7d5ebac9 782
7d5ebac9
MHS
783 c = 0;
784 for(;;) {
785 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
6a5d4e17 786 AT91C_BASE_SSC->SSC_THR = ~ToSend[c];
7d5ebac9
MHS
787 c++;
788 if(c >= ToSendMax) {
789 break;
790 }
791 }
7d5ebac9
MHS
792 WDT_HIT();
793 }
794 LED_B_OFF(); // Finished sending
15c4dc5a 795}
796
67ac4bf7 797
15c4dc5a 798//-----------------------------------------------------------------------------
799// Code a layer 2 command (string of octets, including CRC) into ToSend[],
51d4f6f1 800// so that it is ready to transmit to the tag using TransmitFor14443b().
15c4dc5a 801//-----------------------------------------------------------------------------
7cf3ef20 802static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
15c4dc5a 803{
7d5ebac9
MHS
804 int i, j;
805 uint8_t b;
806
807 ToSendReset();
808
7d5ebac9
MHS
809 // Send SOF
810 for(i = 0; i < 10; i++) {
811 ToSendStuffBit(0);
812 }
6a5d4e17 813 ToSendStuffBit(1);
814 ToSendStuffBit(1);
7d5ebac9
MHS
815
816 for(i = 0; i < len; i++) {
7d5ebac9
MHS
817 // Start bit
818 ToSendStuffBit(0);
819 // Data bits
820 b = cmd[i];
821 for(j = 0; j < 8; j++) {
822 if(b & 1) {
823 ToSendStuffBit(1);
824 } else {
825 ToSendStuffBit(0);
826 }
827 b >>= 1;
828 }
6a5d4e17 829 // Stop bit
830 ToSendStuffBit(1);
7d5ebac9 831 }
6a5d4e17 832
7d5ebac9 833 // Send EOF
7d5ebac9
MHS
834 for(i = 0; i < 10; i++) {
835 ToSendStuffBit(0);
836 }
6a5d4e17 837 ToSendStuffBit(1);
7d5ebac9 838
6a5d4e17 839 // ensure that last byte is filled up
840 for(i = 0; i < 8; i++) {
7d5ebac9
MHS
841 ToSendStuffBit(1);
842 }
843
844 // Convert from last character reference to length
845 ToSendMax++;
15c4dc5a 846}
847
67ac4bf7 848
355c8b4a
MHS
849/**
850 Convenience function to encode, transmit and trace iso 14443b comms
851 **/
852static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
853{
854 CodeIso14443bAsReader(cmd, len);
51d4f6f1 855 TransmitFor14443b();
d9de20fa 856 LogTrace(cmd,len, 0, 0, NULL, true);
355c8b4a
MHS
857}
858
4be27083
FM
859/* Sends an APDU to the tag
860 * TODO: check CRC and preamble
861 */
862int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response)
863{
864 uint8_t message_frame[message_length + 4];
865 // PCB
866 message_frame[0] = 0x0A | pcb_blocknum;
867 pcb_blocknum ^= 1;
868 // CID
869 message_frame[1] = 0;
870 // INF
871 memcpy(message_frame + 2, message, message_length);
872 // EDC (CRC)
873 ComputeCrc14443(CRC_14443_B, message_frame, message_length + 2, &message_frame[message_length + 2], &message_frame[message_length + 3]);
874 // send
875 CodeAndTransmit14443bAsReader(message_frame, message_length + 4);
876 // get response
6a5d4e17 877 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
4be27083
FM
878 if(Demod.len < 3)
879 {
880 return 0;
881 }
882 // TODO: Check CRC
883 // copy response contents
884 if(response != NULL)
885 {
886 memcpy(response, Demod.output, Demod.len);
887 }
888 return Demod.len;
889}
890
891/* Perform the ISO 14443 B Card Selection procedure
892 * Currently does NOT do any collision handling.
893 * It expects 0-1 cards in the device's range.
894 * TODO: Support multiple cards (perform anticollision)
895 * TODO: Verify CRC checksums
896 */
897int iso14443b_select_card()
898{
899 // WUPB command (including CRC)
900 // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state
901 static const uint8_t wupb[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
902 // ATTRIB command (with space for CRC)
903 uint8_t attrib[] = { 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00};
904
905 // first, wake up the tag
906 CodeAndTransmit14443bAsReader(wupb, sizeof(wupb));
44964fd1 907 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
4be27083
FM
908 // ATQB too short?
909 if (Demod.len < 14)
910 {
911 return 2;
912 }
913
914 // select the tag
915 // copy the PUPI to ATTRIB
916 memcpy(attrib + 1, Demod.output + 1, 4);
917 /* copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into
918 ATTRIB (Param 3) */
919 attrib[7] = Demod.output[10] & 0x0F;
920 ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10);
921 CodeAndTransmit14443bAsReader(attrib, sizeof(attrib));
44964fd1 922 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
4be27083
FM
923 // Answer to ATTRIB too short?
924 if(Demod.len < 3)
925 {
926 return 2;
927 }
928 // reset PCB block number
929 pcb_blocknum = 0;
930 return 1;
931}
932
933// Set up ISO 14443 Type B communication (similar to iso14443a_setup)
934void iso14443b_setup() {
935 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
936 // Set up the synchronous serial port
6a5d4e17 937 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
4be27083
FM
938 // connect Demodulated Signal to ADC:
939 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
940
941 // Signal field is on with the appropriate LED
942 LED_D_ON();
943 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
944
4be27083
FM
945 DemodReset();
946 UartReset();
947}
67ac4bf7 948
15c4dc5a 949//-----------------------------------------------------------------------------
51d4f6f1 950// Read a SRI512 ISO 14443B tag.
15c4dc5a 951//
952// SRI512 tags are just simple memory tags, here we're looking at making a dump
953// of the contents of the memory. No anticollision algorithm is done, we assume
954// we have a single tag in the field.
955//
956// I tried to be systematic and check every answer of the tag, every CRC, etc...
957//-----------------------------------------------------------------------------
51d4f6f1 958void ReadSTMemoryIso14443b(uint32_t dwLast)
15c4dc5a 959{
7d5ebac9 960 uint8_t i = 0x00;
15c4dc5a 961
7d5ebac9
MHS
962 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
963 // Make sure that we start from off, since the tags are stateful;
964 // confusing things will happen if we don't reset them between reads.
965 LED_D_OFF();
966 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
967 SpinDelay(200);
15c4dc5a 968
7d5ebac9 969 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
6a5d4e17 970 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
15c4dc5a 971
7d5ebac9
MHS
972 // Now give it time to spin up.
973 // Signal field is on with the appropriate LED
974 LED_D_ON();
705bfa10 975 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
7d5ebac9 976 SpinDelay(200);
15c4dc5a 977
5f605b8f 978 clear_trace();
44964fd1 979 set_tracing(true);
5f605b8f 980
7d5ebac9 981 // First command: wake up the tag using the INITIATE command
51d4f6f1 982 uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
355c8b4a 983 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
44964fd1 984 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
15c4dc5a 985
7d5ebac9 986 if (Demod.len == 0) {
705bfa10 987 DbpString("No response from tag");
6a5d4e17 988 LED_D_OFF();
989 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
705bfa10 990 return;
7d5ebac9 991 } else {
705bfa10 992 Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
993 Demod.output[0], Demod.output[1], Demod.output[2]);
7d5ebac9 994 }
705bfa10 995
7d5ebac9
MHS
996 // There is a response, SELECT the uid
997 DbpString("Now SELECT tag:");
998 cmd1[0] = 0x0E; // 0x0E is SELECT
999 cmd1[1] = Demod.output[0];
1000 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
355c8b4a 1001 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
44964fd1 1002 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
7d5ebac9 1003 if (Demod.len != 3) {
51d4f6f1 1004 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
6a5d4e17 1005 LED_D_OFF();
1006 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
51d4f6f1 1007 return;
7d5ebac9
MHS
1008 }
1009 // Check the CRC of the answer:
1010 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
1011 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
51d4f6f1 1012 DbpString("CRC Error reading select response.");
6a5d4e17 1013 LED_D_OFF();
1014 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
51d4f6f1 1015 return;
7d5ebac9
MHS
1016 }
1017 // Check response from the tag: should be the same UID as the command we just sent:
1018 if (cmd1[1] != Demod.output[0]) {
132a0217 1019 Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
6a5d4e17 1020 LED_D_OFF();
1021 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
51d4f6f1 1022 return;
7d5ebac9 1023 }
705bfa10 1024
7d5ebac9
MHS
1025 // Tag is now selected,
1026 // First get the tag's UID:
1027 cmd1[0] = 0x0B;
1028 ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
355c8b4a 1029 CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
44964fd1 1030 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
7d5ebac9 1031 if (Demod.len != 10) {
51d4f6f1 1032 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
6a5d4e17 1033 LED_D_OFF();
1034 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
51d4f6f1 1035 return;
7d5ebac9
MHS
1036 }
1037 // The check the CRC of the answer (use cmd1 as temporary variable):
1038 ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
51d4f6f1 1039 if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
132a0217 1040 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
705bfa10 1041 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
51d4f6f1 1042 // Do not return;, let's go on... (we should retry, maybe ?)
7d5ebac9
MHS
1043 }
1044 Dbprintf("Tag UID (64 bits): %08x %08x",
705bfa10 1045 (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
1046 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
15c4dc5a 1047
7d5ebac9 1048 // Now loop to read all 16 blocks, address from 0 to last block
132a0217 1049 Dbprintf("Tag memory dump, block 0 to %d", dwLast);
7d5ebac9
MHS
1050 cmd1[0] = 0x08;
1051 i = 0x00;
1052 dwLast++;
1053 for (;;) {
51d4f6f1 1054 if (i == dwLast) {
7d5ebac9
MHS
1055 DbpString("System area block (0xff):");
1056 i = 0xff;
1057 }
1058 cmd1[1] = i;
1059 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
355c8b4a 1060 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
44964fd1 1061 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
7d5ebac9 1062 if (Demod.len != 6) { // Check if we got an answer from the tag
51d4f6f1 1063 DbpString("Expected 6 bytes from tag, got less...");
6a5d4e17 1064 LED_D_OFF();
1065 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
51d4f6f1 1066 return;
7d5ebac9
MHS
1067 }
1068 // The check the CRC of the answer (use cmd1 as temporary variable):
1069 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
51d4f6f1 1070 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
132a0217 1071 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
705bfa10 1072 (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
51d4f6f1 1073 // Do not return;, let's go on... (we should retry, maybe ?)
7d5ebac9
MHS
1074 }
1075 // Now print out the memory location:
132a0217 1076 Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
705bfa10 1077 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1078 (Demod.output[4]<<8)+Demod.output[5]);
7d5ebac9 1079 if (i == 0xff) {
51d4f6f1 1080 break;
7d5ebac9
MHS
1081 }
1082 i++;
1083 }
6a5d4e17 1084
1085 LED_D_OFF();
1086 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
15c4dc5a 1087}
1088
1089
1090//=============================================================================
1091// Finally, the `sniffer' combines elements from both the reader and
1092// simulated tag, to show both sides of the conversation.
1093//=============================================================================
1094
1095//-----------------------------------------------------------------------------
1096// Record the sequence of commands sent by the reader to the tag, with
1097// triggering so that we start recording at the point that the tag is moved
1098// near the reader.
1099//-----------------------------------------------------------------------------
1100/*
1101 * Memory usage for this function, (within BigBuf)
5b95953d 1102 * Last Received command (reader->tag) - MAX_FRAME_SIZE
1103 * Last Received command (tag->reader) - MAX_FRAME_SIZE
705bfa10 1104 * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
5b95953d 1105 * Demodulated samples received - all the rest
15c4dc5a 1106 */
51d4f6f1 1107void RAMFUNC SnoopIso14443b(void)
15c4dc5a 1108{
7d5ebac9 1109 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
f71f4deb 1110 BigBuf_free();
15c4dc5a 1111
aeadbdb2 1112 clear_trace();
44964fd1 1113 set_tracing(true);
aeadbdb2 1114
7d5ebac9 1115 // The DMA buffer, used to stream samples from the FPGA
6a5d4e17 1116 uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));
7d5ebac9 1117 int lastRxCounter;
6a5d4e17 1118 uint16_t *upTo;
1119 int8_t ci, cq;
7d5ebac9
MHS
1120 int maxBehindBy = 0;
1121
1122 // Count of samples received so far, so that we can include timing
1123 // information in the trace buffer.
1124 int samples = 0;
15c4dc5a 1125
7d5ebac9
MHS
1126 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
1127 UartInit(BigBuf_malloc(MAX_FRAME_SIZE));
15c4dc5a 1128
7d5ebac9
MHS
1129 // Print some debug information about the buffer sizes
1130 Dbprintf("Snooping buffers initialized:");
1131 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
aeadbdb2
MHS
1132 Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
1133 Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
705bfa10 1134 Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
e30c654b 1135
51d4f6f1 1136 // Signal field is off, no reader signal, no tag signal
1137 LEDsoff();
aeadbdb2
MHS
1138
1139 // And put the FPGA in the appropriate mode
da586b17 1140 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
7d5ebac9
MHS
1141 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1142
1143 // Setup for the DMA.
6a5d4e17 1144 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
7d5ebac9 1145 upTo = dmaBuf;
705bfa10 1146 lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
1147 FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
5b95953d 1148
44964fd1 1149 bool TagIsActive = false;
1150 bool ReaderIsActive = false;
6a5d4e17 1151 // We won't start recording the frames that we acquire until we trigger.
1152 // A good trigger condition to get started is probably when we see a
1153 // reader command
1154 bool triggered = false;
dd57061c 1155
7d5ebac9
MHS
1156 // And now we loop, receiving samples.
1157 for(;;) {
6a5d4e17 1158 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
7d5ebac9
MHS
1159 if(behindBy > maxBehindBy) {
1160 maxBehindBy = behindBy;
7d5ebac9 1161 }
51d4f6f1 1162
6a5d4e17 1163 if(behindBy < 1) continue;
7d5ebac9 1164
6a5d4e17 1165 ci = *upTo>>8;
1166 cq = *upTo;
1167 upTo++;
1168 lastRxCounter--;
1169 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
1170 upTo = dmaBuf; // start reading the circular buffer from the beginning again
705bfa10 1171 lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
6a5d4e17 1172 if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) {
1173 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);
51d4f6f1 1174 break;
1175 }
6a5d4e17 1176 }
1177 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
1178 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
1179 AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; // DMA Next Counter registers
1180 WDT_HIT();
51d4f6f1 1181 if(BUTTON_PRESS()) {
1182 DbpString("cancelled");
1183 break;
1184 }
7d5ebac9 1185 }
15c4dc5a 1186
6a5d4e17 1187 samples++;
15c4dc5a 1188
5b95953d 1189 if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
51d4f6f1 1190 if(Handle14443bUartBit(ci & 0x01)) {
6a5d4e17 1191 triggered = true;
d9de20fa 1192 LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);
5b95953d 1193 /* And ready to receive another command. */
1194 UartReset();
1195 /* And also reset the demod code, which might have been */
1196 /* false-triggered by the commands from the reader. */
1197 DemodReset();
aeadbdb2 1198 }
51d4f6f1 1199 if(Handle14443bUartBit(cq & 0x01)) {
6a5d4e17 1200 triggered = true;
d9de20fa 1201 LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);
5b95953d 1202 /* And ready to receive another command. */
1203 UartReset();
1204 /* And also reset the demod code, which might have been */
1205 /* false-triggered by the commands from the reader. */
1206 DemodReset();
1207 }
46734099 1208 ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);
aeadbdb2 1209 }
15c4dc5a 1210
6a5d4e17 1211 if(!ReaderIsActive && triggered) { // no need to try decoding tag data if the reader is sending or not yet triggered
1212 if(Handle14443bSamplesDemod(ci/2, cq/2)) {
5b95953d 1213 //Use samples as a time measurement
d9de20fa 1214 LogTrace(Demod.output, Demod.len, samples, samples, NULL, false);
5b95953d 1215 // And ready to receive another response.
1216 DemodReset();
1217 }
d5875804 1218 TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF);
aeadbdb2 1219 }
15c4dc5a 1220
7d5ebac9 1221 }
51d4f6f1 1222
aeadbdb2 1223 FpgaDisableSscDma();
51d4f6f1 1224 LEDsoff();
15c4dc5a 1225 DbpString("Snoop statistics:");
355c8b4a 1226 Dbprintf(" Max behind by: %i", maxBehindBy);
15c4dc5a 1227 Dbprintf(" Uart State: %x", Uart.state);
1228 Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);
1229 Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);
3000dc4e 1230 Dbprintf(" Trace length: %i", BigBuf_get_traceLen());
15c4dc5a 1231}
7cf3ef20 1232
67ac4bf7 1233
7cf3ef20 1234/*
1235 * Send raw command to tag ISO14443B
1236 * @Input
1237 * datalen len of buffer data
1238 * recv bool when true wait for data from tag and send to client
1239 * powerfield bool leave the field on when true
1240 * data buffer with byte to send
1241 *
1242 * @Output
1243 * none
1244 *
1245 */
67ac4bf7 1246void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])
7cf3ef20 1247{
7d5ebac9 1248 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
51d4f6f1 1249 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
6a5d4e17 1250
1251 // switch field on and give tag some time to power up
1252 LED_D_ON();
1253 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
1254 SpinDelay(10);
5f605b8f 1255
9d84e689 1256 if (datalen){
44964fd1 1257 set_tracing(true);
9d84e689 1258
1259 CodeAndTransmit14443bAsReader(data, datalen);
1260
1261 if(recv) {
44964fd1 1262 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
9d84e689 1263 uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
1264 cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
1265 }
dd57061c 1266 }
355c8b4a 1267
51d4f6f1 1268 if(!powerfield) {
7d5ebac9
MHS
1269 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1270 LED_D_OFF();
1271 }
7cf3ef20 1272}
1273
Impressum, Datenschutz