]>
Commit | Line | Data |
---|---|---|
489ef36c | 1 | //----------------------------------------------------------------------------- |
2 | // Jonathan Westhues, split Nov 2006 | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
abb21530 | 8 | // Routines to support ISO 14443B. This includes both the reader software and |
9 | // the `fake tag' modes. | |
489ef36c | 10 | //----------------------------------------------------------------------------- |
11 | ||
12 | #include "proxmark3.h" | |
13 | #include "apps.h" | |
14 | #include "util.h" | |
15 | #include "string.h" | |
16 | ||
17 | #include "iso14443crc.h" | |
18 | ||
d8af608f | 19 | #define RECEIVE_SAMPLES_TIMEOUT 0x0004FFFF |
a62bf3af | 20 | #define ISO14443B_DMA_BUFFER_SIZE 256 |
489ef36c | 21 | |
b10a759f | 22 | uint8_t PowerOn = TRUE; |
a62bf3af | 23 | // PCB Block number for APDUs |
24 | static uint8_t pcb_blocknum = 0; | |
25 | ||
489ef36c | 26 | //============================================================================= |
27 | // An ISO 14443 Type B tag. We listen for commands from the reader, using | |
28 | // a UART kind of thing that's implemented in software. When we get a | |
29 | // frame (i.e., a group of bytes between SOF and EOF), we check the CRC. | |
30 | // If it's good, then we can do something appropriate with it, and send | |
31 | // a response. | |
32 | //============================================================================= | |
33 | ||
34 | //----------------------------------------------------------------------------- | |
35 | // Code up a string of octets at layer 2 (including CRC, we don't generate | |
36 | // that here) so that they can be transmitted to the reader. Doesn't transmit | |
37 | // them yet, just leaves them ready to send in ToSend[]. | |
38 | //----------------------------------------------------------------------------- | |
39 | static void CodeIso14443bAsTag(const uint8_t *cmd, int len) | |
40 | { | |
41 | int i; | |
42 | ||
43 | ToSendReset(); | |
44 | ||
45 | // Transmit a burst of ones, as the initial thing that lets the | |
46 | // reader get phase sync. This (TR1) must be > 80/fs, per spec, | |
47 | // but tag that I've tried (a Paypass) exceeds that by a fair bit, | |
48 | // so I will too. | |
49 | for(i = 0; i < 20; i++) { | |
50 | ToSendStuffBit(1); | |
51 | ToSendStuffBit(1); | |
52 | ToSendStuffBit(1); | |
53 | ToSendStuffBit(1); | |
54 | } | |
55 | ||
56 | // Send SOF. | |
57 | for(i = 0; i < 10; i++) { | |
58 | ToSendStuffBit(0); | |
59 | ToSendStuffBit(0); | |
60 | ToSendStuffBit(0); | |
61 | ToSendStuffBit(0); | |
62 | } | |
63 | for(i = 0; i < 2; i++) { | |
64 | ToSendStuffBit(1); | |
65 | ToSendStuffBit(1); | |
66 | ToSendStuffBit(1); | |
67 | ToSendStuffBit(1); | |
68 | } | |
69 | ||
70 | for(i = 0; i < len; i++) { | |
71 | int j; | |
72 | uint8_t b = cmd[i]; | |
73 | ||
74 | // Start bit | |
75 | ToSendStuffBit(0); | |
76 | ToSendStuffBit(0); | |
77 | ToSendStuffBit(0); | |
78 | ToSendStuffBit(0); | |
79 | ||
80 | // Data bits | |
81 | for(j = 0; j < 8; j++) { | |
82 | if(b & 1) { | |
83 | ToSendStuffBit(1); | |
84 | ToSendStuffBit(1); | |
85 | ToSendStuffBit(1); | |
86 | ToSendStuffBit(1); | |
87 | } else { | |
88 | ToSendStuffBit(0); | |
89 | ToSendStuffBit(0); | |
90 | ToSendStuffBit(0); | |
91 | ToSendStuffBit(0); | |
92 | } | |
93 | b >>= 1; | |
94 | } | |
95 | ||
96 | // Stop bit | |
97 | ToSendStuffBit(1); | |
98 | ToSendStuffBit(1); | |
99 | ToSendStuffBit(1); | |
100 | ToSendStuffBit(1); | |
101 | } | |
102 | ||
abb21530 | 103 | // Send EOF. |
489ef36c | 104 | for(i = 0; i < 10; i++) { |
105 | ToSendStuffBit(0); | |
106 | ToSendStuffBit(0); | |
107 | ToSendStuffBit(0); | |
108 | ToSendStuffBit(0); | |
109 | } | |
abb21530 | 110 | for(i = 0; i < 2; i++) { |
489ef36c | 111 | ToSendStuffBit(1); |
112 | ToSendStuffBit(1); | |
113 | ToSendStuffBit(1); | |
114 | ToSendStuffBit(1); | |
115 | } | |
116 | ||
117 | // Convert from last byte pos to length | |
118 | ToSendMax++; | |
489ef36c | 119 | } |
120 | ||
121 | //----------------------------------------------------------------------------- | |
122 | // The software UART that receives commands from the reader, and its state | |
123 | // variables. | |
124 | //----------------------------------------------------------------------------- | |
125 | static struct { | |
126 | enum { | |
127 | STATE_UNSYNCD, | |
128 | STATE_GOT_FALLING_EDGE_OF_SOF, | |
129 | STATE_AWAITING_START_BIT, | |
36f84d47 | 130 | STATE_RECEIVING_DATA |
489ef36c | 131 | } state; |
132 | uint16_t shiftReg; | |
133 | int bitCnt; | |
134 | int byteCnt; | |
135 | int byteCntMax; | |
136 | int posCnt; | |
137 | uint8_t *output; | |
138 | } Uart; | |
139 | ||
140 | /* Receive & handle a bit coming from the reader. | |
abb21530 | 141 | * |
142 | * This function is called 4 times per bit (every 2 subcarrier cycles). | |
143 | * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us | |
489ef36c | 144 | * |
145 | * LED handling: | |
146 | * LED A -> ON once we have received the SOF and are expecting the rest. | |
147 | * LED A -> OFF once we have received EOF or are in error state or unsynced | |
148 | * | |
149 | * Returns: true if we received a EOF | |
150 | * false if we are still waiting for some more | |
151 | */ | |
36f84d47 | 152 | static RAMFUNC int Handle14443bUartBit(uint8_t bit) |
489ef36c | 153 | { |
154 | switch(Uart.state) { | |
155 | case STATE_UNSYNCD: | |
489ef36c | 156 | if(!bit) { |
157 | // we went low, so this could be the beginning | |
158 | // of an SOF | |
159 | Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF; | |
160 | Uart.posCnt = 0; | |
161 | Uart.bitCnt = 0; | |
162 | } | |
163 | break; | |
164 | ||
165 | case STATE_GOT_FALLING_EDGE_OF_SOF: | |
166 | Uart.posCnt++; | |
abb21530 | 167 | if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit |
489ef36c | 168 | if(bit) { |
abb21530 | 169 | if(Uart.bitCnt > 9) { |
489ef36c | 170 | // we've seen enough consecutive |
171 | // zeros that it's a valid SOF | |
172 | Uart.posCnt = 0; | |
173 | Uart.byteCnt = 0; | |
174 | Uart.state = STATE_AWAITING_START_BIT; | |
175 | LED_A_ON(); // Indicate we got a valid SOF | |
176 | } else { | |
177 | // didn't stay down long enough | |
178 | // before going high, error | |
36f84d47 | 179 | Uart.state = STATE_UNSYNCD; |
489ef36c | 180 | } |
181 | } else { | |
182 | // do nothing, keep waiting | |
183 | } | |
184 | Uart.bitCnt++; | |
185 | } | |
186 | if(Uart.posCnt >= 4) Uart.posCnt = 0; | |
abb21530 | 187 | if(Uart.bitCnt > 12) { |
489ef36c | 188 | // Give up if we see too many zeros without |
189 | // a one, too. | |
36f84d47 | 190 | LED_A_OFF(); |
191 | Uart.state = STATE_UNSYNCD; | |
489ef36c | 192 | } |
193 | break; | |
194 | ||
195 | case STATE_AWAITING_START_BIT: | |
196 | Uart.posCnt++; | |
197 | if(bit) { | |
abb21530 | 198 | if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs |
489ef36c | 199 | // stayed high for too long between |
200 | // characters, error | |
36f84d47 | 201 | Uart.state = STATE_UNSYNCD; |
489ef36c | 202 | } |
203 | } else { | |
204 | // falling edge, this starts the data byte | |
205 | Uart.posCnt = 0; | |
206 | Uart.bitCnt = 0; | |
207 | Uart.shiftReg = 0; | |
208 | Uart.state = STATE_RECEIVING_DATA; | |
489ef36c | 209 | } |
210 | break; | |
211 | ||
212 | case STATE_RECEIVING_DATA: | |
213 | Uart.posCnt++; | |
214 | if(Uart.posCnt == 2) { | |
215 | // time to sample a bit | |
216 | Uart.shiftReg >>= 1; | |
217 | if(bit) { | |
218 | Uart.shiftReg |= 0x200; | |
219 | } | |
220 | Uart.bitCnt++; | |
221 | } | |
222 | if(Uart.posCnt >= 4) { | |
223 | Uart.posCnt = 0; | |
224 | } | |
225 | if(Uart.bitCnt == 10) { | |
226 | if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001)) | |
227 | { | |
228 | // this is a data byte, with correct | |
229 | // start and stop bits | |
230 | Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff; | |
231 | Uart.byteCnt++; | |
232 | ||
233 | if(Uart.byteCnt >= Uart.byteCntMax) { | |
234 | // Buffer overflowed, give up | |
36f84d47 | 235 | LED_A_OFF(); |
236 | Uart.state = STATE_UNSYNCD; | |
489ef36c | 237 | } else { |
238 | // so get the next byte now | |
239 | Uart.posCnt = 0; | |
240 | Uart.state = STATE_AWAITING_START_BIT; | |
241 | } | |
46734099 | 242 | } else if (Uart.shiftReg == 0x000) { |
489ef36c | 243 | // this is an EOF byte |
244 | LED_A_OFF(); // Finished receiving | |
36f84d47 | 245 | Uart.state = STATE_UNSYNCD; |
22e24700 | 246 | if (Uart.byteCnt != 0) { |
489ef36c | 247 | return TRUE; |
22e24700 | 248 | } |
489ef36c | 249 | } else { |
250 | // this is an error | |
36f84d47 | 251 | LED_A_OFF(); |
46734099 | 252 | Uart.state = STATE_UNSYNCD; |
36f84d47 | 253 | } |
489ef36c | 254 | } |
255 | break; | |
256 | ||
257 | default: | |
36f84d47 | 258 | LED_A_OFF(); |
489ef36c | 259 | Uart.state = STATE_UNSYNCD; |
260 | break; | |
261 | } | |
262 | ||
489ef36c | 263 | return FALSE; |
264 | } | |
265 | ||
36f84d47 | 266 | |
267 | static void UartReset() | |
268 | { | |
269 | Uart.byteCntMax = MAX_FRAME_SIZE; | |
270 | Uart.state = STATE_UNSYNCD; | |
271 | Uart.byteCnt = 0; | |
272 | Uart.bitCnt = 0; | |
b10a759f | 273 | memset(Uart.output, 0x00, MAX_FRAME_SIZE); |
36f84d47 | 274 | } |
275 | ||
276 | ||
277 | static void UartInit(uint8_t *data) | |
278 | { | |
279 | Uart.output = data; | |
280 | UartReset(); | |
281 | } | |
282 | ||
283 | ||
489ef36c | 284 | //----------------------------------------------------------------------------- |
285 | // Receive a command (from the reader to us, where we are the simulated tag), | |
286 | // and store it in the given buffer, up to the given maximum length. Keeps | |
287 | // spinning, waiting for a well-framed command, until either we get one | |
288 | // (returns TRUE) or someone presses the pushbutton on the board (FALSE). | |
289 | // | |
290 | // Assume that we're called with the SSC (to the FPGA) and ADC path set | |
291 | // correctly. | |
292 | //----------------------------------------------------------------------------- | |
36f84d47 | 293 | static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len) |
489ef36c | 294 | { |
abb21530 | 295 | // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen |
489ef36c | 296 | // only, since we are receiving, not transmitting). |
297 | // Signal field is off with the appropriate LED | |
298 | LED_D_OFF(); | |
299 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION); | |
300 | ||
489ef36c | 301 | // Now run a `software UART' on the stream of incoming samples. |
36f84d47 | 302 | UartInit(received); |
489ef36c | 303 | |
304 | for(;;) { | |
305 | WDT_HIT(); | |
306 | ||
307 | if(BUTTON_PRESS()) return FALSE; | |
308 | ||
489ef36c | 309 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
310 | uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; | |
36f84d47 | 311 | for(uint8_t mask = 0x80; mask != 0x00; mask >>= 1) { |
312 | if(Handle14443bUartBit(b & mask)) { | |
489ef36c | 313 | *len = Uart.byteCnt; |
314 | return TRUE; | |
315 | } | |
316 | } | |
317 | } | |
318 | } | |
36f84d47 | 319 | |
320 | return FALSE; | |
489ef36c | 321 | } |
322 | ||
323 | //----------------------------------------------------------------------------- | |
324 | // Main loop of simulated tag: receive commands from reader, decide what | |
325 | // response to send, and send it. | |
326 | //----------------------------------------------------------------------------- | |
abb21530 | 327 | void SimulateIso14443bTag(void) |
489ef36c | 328 | { |
b10a759f | 329 | // the only commands we understand is WUPB, AFI=0, Select All, N=1: |
330 | static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB | |
331 | // ... and REQB, AFI=0, Normal Request, N=1: | |
332 | static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB | |
333 | // ... and HLTB | |
334 | static const uint8_t cmd3[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB | |
335 | // ... and ATTRIB | |
336 | static const uint8_t cmd4[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB | |
36f84d47 | 337 | |
338 | // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922, | |
abb21530 | 339 | // supports only 106kBit/s in both directions, max frame size = 32Bytes, |
340 | // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported: | |
489ef36c | 341 | static const uint8_t response1[] = { |
342 | 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22, | |
343 | 0x00, 0x21, 0x85, 0x5e, 0xd7 | |
344 | }; | |
b10a759f | 345 | // response to HLTB and ATTRIB |
346 | static const uint8_t response2[] = {0x00, 0x78, 0xF0}; | |
489ef36c | 347 | |
99cf19d9 | 348 | uint8_t parity[MAX_PARITY_SIZE]; |
349 | ||
350 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
351 | ||
36f84d47 | 352 | clear_trace(); |
353 | set_tracing(TRUE); | |
354 | ||
355 | const uint8_t *resp; | |
356 | uint8_t *respCode; | |
357 | uint16_t respLen, respCodeLen; | |
17ad0e09 | 358 | |
359 | // allocate command receive buffer | |
99cf19d9 | 360 | BigBuf_free(); |
17ad0e09 | 361 | uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE); |
489ef36c | 362 | |
99cf19d9 | 363 | uint16_t len; |
364 | uint16_t cmdsRecvd = 0; | |
365 | ||
abb21530 | 366 | // prepare the (only one) tag answer: |
489ef36c | 367 | CodeIso14443bAsTag(response1, sizeof(response1)); |
36f84d47 | 368 | uint8_t *resp1Code = BigBuf_malloc(ToSendMax); |
369 | memcpy(resp1Code, ToSend, ToSendMax); | |
370 | uint16_t resp1CodeLen = ToSendMax; | |
489ef36c | 371 | |
b10a759f | 372 | // prepare the (other) tag answer: |
373 | CodeIso14443bAsTag(response2, sizeof(response2)); | |
374 | uint8_t *resp2Code = BigBuf_malloc(ToSendMax); | |
375 | memcpy(resp2Code, ToSend, ToSendMax); | |
376 | uint16_t resp2CodeLen = ToSendMax; | |
377 | ||
489ef36c | 378 | // We need to listen to the high-frequency, peak-detected path. |
379 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
380 | FpgaSetupSsc(); | |
381 | ||
382 | cmdsRecvd = 0; | |
383 | ||
384 | for(;;) { | |
489ef36c | 385 | |
36f84d47 | 386 | if(!GetIso14443bCommandFromReader(receivedCmd, &len)) { |
489ef36c | 387 | Dbprintf("button pressed, received %d commands", cmdsRecvd); |
388 | break; | |
389 | } | |
390 | ||
36f84d47 | 391 | if (tracing) { |
36f84d47 | 392 | LogTrace(receivedCmd, len, 0, 0, parity, TRUE); |
393 | } | |
489ef36c | 394 | |
36f84d47 | 395 | // Good, look at the command now. |
396 | if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0) | |
397 | || (len == sizeof(cmd2) && memcmp(receivedCmd, cmd2, len) == 0) ) { | |
398 | resp = response1; | |
399 | respLen = sizeof(response1); | |
400 | respCode = resp1Code; | |
401 | respCodeLen = resp1CodeLen; | |
b10a759f | 402 | } else if ( (len == sizeof(cmd3) && receivedCmd[0] == cmd3[0]) |
403 | || (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) ) { | |
404 | resp = response2; | |
405 | respLen = sizeof(response2); | |
406 | respCode = resp2Code; | |
407 | respCodeLen = resp2CodeLen; | |
489ef36c | 408 | } else { |
409 | Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd); | |
410 | // And print whether the CRC fails, just for good measure | |
36f84d47 | 411 | uint8_t b1, b2; |
b10a759f | 412 | if (len >= 3){ // if crc exists |
489ef36c | 413 | ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2); |
414 | if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) { | |
415 | // Not so good, try again. | |
416 | DbpString("+++CRC fail"); | |
b10a759f | 417 | |
489ef36c | 418 | } else { |
419 | DbpString("CRC passes"); | |
420 | } | |
b10a759f | 421 | } |
422 | //get rid of compiler warning | |
423 | respCodeLen = 0; | |
424 | resp = response1; | |
425 | respLen = 0; | |
426 | respCode = resp1Code; | |
427 | //don't crash at new command just wait and see if reader will send other new cmds. | |
428 | //break; | |
489ef36c | 429 | } |
430 | ||
489ef36c | 431 | cmdsRecvd++; |
432 | ||
433 | if(cmdsRecvd > 0x30) { | |
434 | DbpString("many commands later..."); | |
435 | break; | |
436 | } | |
437 | ||
36f84d47 | 438 | if(respCodeLen <= 0) continue; |
489ef36c | 439 | |
440 | // Modulate BPSK | |
441 | // Signal field is off with the appropriate LED | |
442 | LED_D_OFF(); | |
443 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK); | |
444 | AT91C_BASE_SSC->SSC_THR = 0xff; | |
445 | FpgaSetupSsc(); | |
446 | ||
17ad0e09 | 447 | uint8_t c; |
448 | // clear receiving shift register and holding register | |
449 | while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)); | |
450 | c = AT91C_BASE_SSC->SSC_RHR; (void) c; | |
451 | while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)); | |
452 | c = AT91C_BASE_SSC->SSC_RHR; (void) c; | |
453 | ||
454 | // Clear TXRDY: | |
455 | AT91C_BASE_SSC->SSC_THR = 0x00; | |
456 | ||
489ef36c | 457 | // Transmit the response. |
17ad0e09 | 458 | uint16_t FpgaSendQueueDelay = 0; |
36f84d47 | 459 | uint16_t i = 0; |
17ad0e09 | 460 | for(;i < respCodeLen; ) { |
489ef36c | 461 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
17ad0e09 | 462 | AT91C_BASE_SSC->SSC_THR = respCode[i++]; |
463 | FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR; | |
489ef36c | 464 | } |
17ad0e09 | 465 | if(BUTTON_PRESS()) break; |
466 | } | |
467 | ||
468 | // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again: | |
469 | uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3; | |
470 | for (i = 0; i <= fpga_queued_bits/8 + 1; ) { | |
471 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
472 | AT91C_BASE_SSC->SSC_THR = 0x00; | |
473 | FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR; | |
474 | i++; | |
489ef36c | 475 | } |
476 | } | |
36f84d47 | 477 | |
478 | // trace the response: | |
99cf19d9 | 479 | if (tracing) LogTrace(resp, respLen, 0, 0, parity, FALSE); |
489ef36c | 480 | } |
b10a759f | 481 | FpgaDisableSscDma(); |
489ef36c | 482 | } |
483 | ||
484 | //============================================================================= | |
485 | // An ISO 14443 Type B reader. We take layer two commands, code them | |
486 | // appropriately, and then send them to the tag. We then listen for the | |
487 | // tag's response, which we leave in the buffer to be demodulated on the | |
488 | // PC side. | |
489 | //============================================================================= | |
490 | ||
491 | static struct { | |
492 | enum { | |
493 | DEMOD_UNSYNCD, | |
494 | DEMOD_PHASE_REF_TRAINING, | |
495 | DEMOD_AWAITING_FALLING_EDGE_OF_SOF, | |
496 | DEMOD_GOT_FALLING_EDGE_OF_SOF, | |
497 | DEMOD_AWAITING_START_BIT, | |
36f84d47 | 498 | DEMOD_RECEIVING_DATA |
489ef36c | 499 | } state; |
500 | int bitCount; | |
501 | int posCount; | |
502 | int thisBit; | |
abb21530 | 503 | /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented. |
489ef36c | 504 | int metric; |
505 | int metricN; | |
abb21530 | 506 | */ |
489ef36c | 507 | uint16_t shiftReg; |
508 | uint8_t *output; | |
509 | int len; | |
510 | int sumI; | |
511 | int sumQ; | |
512 | } Demod; | |
513 | ||
514 | /* | |
515 | * Handles reception of a bit from the tag | |
516 | * | |
abb21530 | 517 | * This function is called 2 times per bit (every 4 subcarrier cycles). |
518 | * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us | |
519 | * | |
489ef36c | 520 | * LED handling: |
521 | * LED C -> ON once we have received the SOF and are expecting the rest. | |
522 | * LED C -> OFF once we have received EOF or are unsynced | |
523 | * | |
524 | * Returns: true if we received a EOF | |
525 | * false if we are still waiting for some more | |
526 | * | |
527 | */ | |
abb21530 | 528 | static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) |
489ef36c | 529 | { |
530 | int v; | |
531 | ||
51d4f6f1 | 532 | // The soft decision on the bit uses an estimate of just the |
533 | // quadrant of the reference angle, not the exact angle. | |
489ef36c | 534 | #define MAKE_SOFT_DECISION() { \ |
535 | if(Demod.sumI > 0) { \ | |
536 | v = ci; \ | |
537 | } else { \ | |
538 | v = -ci; \ | |
539 | } \ | |
540 | if(Demod.sumQ > 0) { \ | |
541 | v += cq; \ | |
542 | } else { \ | |
543 | v -= cq; \ | |
544 | } \ | |
545 | } | |
546 | ||
abb21530 | 547 | #define SUBCARRIER_DETECT_THRESHOLD 8 |
548 | ||
549 | // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq) | |
550 | /* #define CHECK_FOR_SUBCARRIER() { \ | |
551 | v = ci; \ | |
552 | if(v < 0) v = -v; \ | |
553 | if(cq > 0) { \ | |
554 | v += cq; \ | |
555 | } else { \ | |
556 | v -= cq; \ | |
557 | } \ | |
558 | } | |
559 | */ | |
560 | // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq))) | |
561 | #define CHECK_FOR_SUBCARRIER() { \ | |
562 | if(ci < 0) { \ | |
563 | if(cq < 0) { /* ci < 0, cq < 0 */ \ | |
564 | if (cq < ci) { \ | |
565 | v = -cq - (ci >> 1); \ | |
566 | } else { \ | |
567 | v = -ci - (cq >> 1); \ | |
568 | } \ | |
569 | } else { /* ci < 0, cq >= 0 */ \ | |
570 | if (cq < -ci) { \ | |
571 | v = -ci + (cq >> 1); \ | |
572 | } else { \ | |
573 | v = cq - (ci >> 1); \ | |
574 | } \ | |
575 | } \ | |
576 | } else { \ | |
577 | if(cq < 0) { /* ci >= 0, cq < 0 */ \ | |
578 | if (-cq < ci) { \ | |
579 | v = ci - (cq >> 1); \ | |
580 | } else { \ | |
581 | v = -cq + (ci >> 1); \ | |
582 | } \ | |
583 | } else { /* ci >= 0, cq >= 0 */ \ | |
584 | if (cq < ci) { \ | |
585 | v = ci + (cq >> 1); \ | |
586 | } else { \ | |
587 | v = cq + (ci >> 1); \ | |
588 | } \ | |
589 | } \ | |
590 | } \ | |
591 | } | |
592 | ||
489ef36c | 593 | switch(Demod.state) { |
594 | case DEMOD_UNSYNCD: | |
abb21530 | 595 | CHECK_FOR_SUBCARRIER(); |
596 | if(v > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected | |
489ef36c | 597 | Demod.state = DEMOD_PHASE_REF_TRAINING; |
abb21530 | 598 | Demod.sumI = ci; |
599 | Demod.sumQ = cq; | |
600 | Demod.posCount = 1; | |
489ef36c | 601 | } |
602 | break; | |
603 | ||
604 | case DEMOD_PHASE_REF_TRAINING: | |
b10a759f | 605 | if(Demod.posCount < 10*2) { |
abb21530 | 606 | CHECK_FOR_SUBCARRIER(); |
607 | if (v > SUBCARRIER_DETECT_THRESHOLD) { | |
608 | // set the reference phase (will code a logic '1') by averaging over 32 1/fs. | |
609 | // note: synchronization time > 80 1/fs | |
b10a759f | 610 | Demod.sumI += ci; |
611 | Demod.sumQ += cq; | |
abb21530 | 612 | Demod.posCount++; |
613 | } else { // subcarrier lost | |
b10a759f | 614 | Demod.state = DEMOD_UNSYNCD; |
abb21530 | 615 | } |
489ef36c | 616 | } else { |
b10a759f | 617 | Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF; |
489ef36c | 618 | } |
489ef36c | 619 | break; |
620 | ||
621 | case DEMOD_AWAITING_FALLING_EDGE_OF_SOF: | |
622 | MAKE_SOFT_DECISION(); | |
abb21530 | 623 | if(v < 0) { // logic '0' detected |
489ef36c | 624 | Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF; |
abb21530 | 625 | Demod.posCount = 0; // start of SOF sequence |
489ef36c | 626 | } else { |
b10a759f | 627 | //if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs |
628 | if(Demod.posCount > 25*2) { // maximum length of TR1 = 200 1/fs | |
489ef36c | 629 | Demod.state = DEMOD_UNSYNCD; |
630 | } | |
631 | } | |
632 | Demod.posCount++; | |
633 | break; | |
634 | ||
635 | case DEMOD_GOT_FALLING_EDGE_OF_SOF: | |
abb21530 | 636 | Demod.posCount++; |
489ef36c | 637 | MAKE_SOFT_DECISION(); |
638 | if(v > 0) { | |
b10a759f | 639 | if(Demod.posCount < 10*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges |
489ef36c | 640 | Demod.state = DEMOD_UNSYNCD; |
641 | } else { | |
a62bf3af | 642 | LED_C_ON(); // Got SOF |
489ef36c | 643 | Demod.state = DEMOD_AWAITING_START_BIT; |
644 | Demod.posCount = 0; | |
645 | Demod.len = 0; | |
abb21530 | 646 | /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented. |
489ef36c | 647 | Demod.metricN = 0; |
648 | Demod.metric = 0; | |
abb21530 | 649 | */ |
489ef36c | 650 | } |
651 | } else { | |
b10a759f | 652 | if(Demod.posCount > 13*2) { // low phase of SOF too long (> 12 etu) |
489ef36c | 653 | Demod.state = DEMOD_UNSYNCD; |
47286d89 | 654 | LED_C_OFF(); |
489ef36c | 655 | } |
656 | } | |
489ef36c | 657 | break; |
658 | ||
659 | case DEMOD_AWAITING_START_BIT: | |
abb21530 | 660 | Demod.posCount++; |
489ef36c | 661 | MAKE_SOFT_DECISION(); |
662 | if(v > 0) { | |
abb21530 | 663 | if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs |
489ef36c | 664 | Demod.state = DEMOD_UNSYNCD; |
47286d89 | 665 | LED_C_OFF(); |
489ef36c | 666 | } |
abb21530 | 667 | } else { // start bit detected |
489ef36c | 668 | Demod.bitCount = 0; |
abb21530 | 669 | Demod.posCount = 1; // this was the first half |
489ef36c | 670 | Demod.thisBit = v; |
671 | Demod.shiftReg = 0; | |
672 | Demod.state = DEMOD_RECEIVING_DATA; | |
673 | } | |
674 | break; | |
675 | ||
676 | case DEMOD_RECEIVING_DATA: | |
677 | MAKE_SOFT_DECISION(); | |
abb21530 | 678 | if(Demod.posCount == 0) { // first half of bit |
489ef36c | 679 | Demod.thisBit = v; |
680 | Demod.posCount = 1; | |
abb21530 | 681 | } else { // second half of bit |
489ef36c | 682 | Demod.thisBit += v; |
683 | ||
abb21530 | 684 | /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented. |
489ef36c | 685 | if(Demod.thisBit > 0) { |
686 | Demod.metric += Demod.thisBit; | |
687 | } else { | |
688 | Demod.metric -= Demod.thisBit; | |
689 | } | |
690 | (Demod.metricN)++; | |
abb21530 | 691 | */ |
489ef36c | 692 | |
693 | Demod.shiftReg >>= 1; | |
abb21530 | 694 | if(Demod.thisBit > 0) { // logic '1' |
489ef36c | 695 | Demod.shiftReg |= 0x200; |
696 | } | |
697 | ||
698 | Demod.bitCount++; | |
699 | if(Demod.bitCount == 10) { | |
700 | uint16_t s = Demod.shiftReg; | |
abb21530 | 701 | if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0' |
489ef36c | 702 | uint8_t b = (s >> 1); |
703 | Demod.output[Demod.len] = b; | |
704 | Demod.len++; | |
705 | Demod.state = DEMOD_AWAITING_START_BIT; | |
489ef36c | 706 | } else { |
707 | Demod.state = DEMOD_UNSYNCD; | |
47286d89 | 708 | LED_C_OFF(); |
709 | if(s == 0x000) { | |
abb21530 | 710 | // This is EOF (start, stop and all data bits == '0' |
b10a759f | 711 | return TRUE; |
47286d89 | 712 | } |
489ef36c | 713 | } |
714 | } | |
715 | Demod.posCount = 0; | |
716 | } | |
717 | break; | |
718 | ||
719 | default: | |
720 | Demod.state = DEMOD_UNSYNCD; | |
47286d89 | 721 | LED_C_OFF(); |
489ef36c | 722 | break; |
723 | } | |
489ef36c | 724 | return FALSE; |
725 | } | |
726 | ||
727 | ||
728 | static void DemodReset() | |
729 | { | |
730 | // Clear out the state of the "UART" that receives from the tag. | |
731 | Demod.len = 0; | |
732 | Demod.state = DEMOD_UNSYNCD; | |
abb21530 | 733 | Demod.posCount = 0; |
489ef36c | 734 | memset(Demod.output, 0x00, MAX_FRAME_SIZE); |
735 | } | |
736 | ||
737 | ||
738 | static void DemodInit(uint8_t *data) | |
739 | { | |
740 | Demod.output = data; | |
741 | DemodReset(); | |
742 | } | |
743 | ||
744 | ||
489ef36c | 745 | /* |
746 | * Demodulate the samples we received from the tag, also log to tracebuffer | |
489ef36c | 747 | * quiet: set to 'TRUE' to disable debug output |
748 | */ | |
abb21530 | 749 | static void GetSamplesFor14443bDemod(int n, bool quiet) |
489ef36c | 750 | { |
751 | int max = 0; | |
abb21530 | 752 | bool gotFrame = FALSE; |
489ef36c | 753 | int lastRxCounter, ci, cq, samples = 0; |
754 | ||
755 | // Allocate memory from BigBuf for some buffers | |
756 | // free all previous allocations first | |
757 | BigBuf_free(); | |
b10a759f | 758 | |
759 | // And put the FPGA in the appropriate mode | |
760 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); | |
761 | ||
489ef36c | 762 | // The response (tag -> reader) that we're receiving. |
99cf19d9 | 763 | uint8_t *resp = BigBuf_malloc(MAX_FRAME_SIZE); |
489ef36c | 764 | |
765 | // Set up the demodulator for tag -> reader responses. | |
99cf19d9 | 766 | DemodInit(resp); |
b10a759f | 767 | |
768 | // The DMA buffer, used to stream samples from the FPGA | |
769 | int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); | |
489ef36c | 770 | |
489ef36c | 771 | |
772 | int8_t *upTo = dmaBuf; | |
705bfa10 | 773 | lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; |
489ef36c | 774 | |
775 | // Signal field is ON with the appropriate LED: | |
abb21530 | 776 | LED_D_ON(); |
489ef36c | 777 | |
b10a759f | 778 | // Setup and start DMA. |
779 | FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE); | |
780 | ||
781 | ||
489ef36c | 782 | for(;;) { |
783 | int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR; | |
784 | if(behindBy > max) max = behindBy; | |
785 | ||
705bfa10 | 786 | while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) { |
489ef36c | 787 | ci = upTo[0]; |
788 | cq = upTo[1]; | |
789 | upTo += 2; | |
705bfa10 | 790 | if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { |
489ef36c | 791 | upTo = dmaBuf; |
792 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo; | |
705bfa10 | 793 | AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; |
489ef36c | 794 | } |
795 | lastRxCounter -= 2; | |
796 | if(lastRxCounter <= 0) { | |
705bfa10 | 797 | lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; |
489ef36c | 798 | } |
799 | ||
800 | samples += 2; | |
801 | ||
d8af608f | 802 | if(Handle14443bSamplesDemod(ci | 0x01 , cq | 0x01)) { |
abb21530 | 803 | gotFrame = TRUE; |
51d4f6f1 | 804 | break; |
489ef36c | 805 | } |
abb21530 | 806 | } |
489ef36c | 807 | |
abb21530 | 808 | if(samples > n || gotFrame) { |
489ef36c | 809 | break; |
810 | } | |
811 | } | |
abb21530 | 812 | |
489ef36c | 813 | AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; |
abb21530 | 814 | |
a62bf3af | 815 | if (!quiet && Demod.len == 0) { |
b10a759f | 816 | Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", |
817 | max, | |
818 | samples, | |
819 | gotFrame, | |
820 | Demod.len, | |
821 | Demod.sumI, | |
822 | Demod.sumQ | |
823 | ); | |
824 | } | |
825 | ||
489ef36c | 826 | //Tracing |
827 | if (tracing && Demod.len > 0) { | |
828 | uint8_t parity[MAX_PARITY_SIZE]; | |
489ef36c | 829 | LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE); |
830 | } | |
831 | } | |
832 | ||
833 | ||
489ef36c | 834 | //----------------------------------------------------------------------------- |
835 | // Transmit the command (to the tag) that was placed in ToSend[]. | |
836 | //----------------------------------------------------------------------------- | |
abb21530 | 837 | static void TransmitFor14443b(void) |
489ef36c | 838 | { |
839 | int c; | |
840 | ||
841 | FpgaSetupSsc(); | |
842 | ||
a62bf3af | 843 | // Start the timer |
844 | StartCountSspClk(); | |
845 | ||
489ef36c | 846 | while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
847 | AT91C_BASE_SSC->SSC_THR = 0xff; | |
848 | } | |
849 | ||
850 | // Signal field is ON with the appropriate Red LED | |
851 | LED_D_ON(); | |
852 | // Signal we are transmitting with the Green LED | |
853 | LED_B_ON(); | |
abb21530 | 854 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); |
b10a759f | 855 | if ( !PowerOn ) |
856 | SpinDelay(200); | |
857 | ||
489ef36c | 858 | for(c = 0; c < 10;) { |
859 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
860 | AT91C_BASE_SSC->SSC_THR = 0xff; | |
861 | c++; | |
862 | } | |
863 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { | |
864 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; | |
865 | (void)r; | |
866 | } | |
867 | WDT_HIT(); | |
868 | } | |
869 | ||
870 | c = 0; | |
871 | for(;;) { | |
872 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
873 | AT91C_BASE_SSC->SSC_THR = ToSend[c]; | |
874 | c++; | |
875 | if(c >= ToSendMax) { | |
876 | break; | |
877 | } | |
878 | } | |
879 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { | |
880 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; | |
881 | (void)r; | |
882 | } | |
883 | WDT_HIT(); | |
884 | } | |
885 | LED_B_OFF(); // Finished sending | |
886 | } | |
887 | ||
888 | ||
889 | //----------------------------------------------------------------------------- | |
890 | // Code a layer 2 command (string of octets, including CRC) into ToSend[], | |
abb21530 | 891 | // so that it is ready to transmit to the tag using TransmitFor14443b(). |
489ef36c | 892 | //----------------------------------------------------------------------------- |
893 | static void CodeIso14443bAsReader(const uint8_t *cmd, int len) | |
894 | { | |
895 | int i, j; | |
896 | uint8_t b; | |
897 | ||
898 | ToSendReset(); | |
899 | ||
900 | // Establish initial reference level | |
b10a759f | 901 | for(i = 0; i < 80; i++) { |
489ef36c | 902 | ToSendStuffBit(1); |
903 | } | |
904 | // Send SOF | |
b10a759f | 905 | for(i = 0; i < 11; i++) { |
489ef36c | 906 | ToSendStuffBit(0); |
907 | } | |
908 | ||
909 | for(i = 0; i < len; i++) { | |
910 | // Stop bits/EGT | |
911 | ToSendStuffBit(1); | |
912 | ToSendStuffBit(1); | |
913 | // Start bit | |
914 | ToSendStuffBit(0); | |
915 | // Data bits | |
916 | b = cmd[i]; | |
917 | for(j = 0; j < 8; j++) { | |
918 | if(b & 1) { | |
919 | ToSendStuffBit(1); | |
920 | } else { | |
921 | ToSendStuffBit(0); | |
922 | } | |
923 | b >>= 1; | |
924 | } | |
925 | } | |
926 | // Send EOF | |
927 | ToSendStuffBit(1); | |
b10a759f | 928 | for(i = 0; i < 11; i++) { |
489ef36c | 929 | ToSendStuffBit(0); |
930 | } | |
931 | for(i = 0; i < 8; i++) { | |
932 | ToSendStuffBit(1); | |
933 | } | |
934 | ||
935 | // And then a little more, to make sure that the last character makes | |
936 | // it out before we switch to rx mode. | |
b10a759f | 937 | for(i = 0; i < 10; i++) { |
489ef36c | 938 | ToSendStuffBit(1); |
939 | } | |
940 | ||
941 | // Convert from last character reference to length | |
942 | ToSendMax++; | |
943 | } | |
944 | ||
945 | ||
489ef36c | 946 | /** |
947 | Convenience function to encode, transmit and trace iso 14443b comms | |
948 | **/ | |
949 | static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len) | |
950 | { | |
951 | CodeIso14443bAsReader(cmd, len); | |
abb21530 | 952 | TransmitFor14443b(); |
489ef36c | 953 | if (tracing) { |
954 | uint8_t parity[MAX_PARITY_SIZE]; | |
489ef36c | 955 | LogTrace(cmd,len, 0, 0, parity, TRUE); |
956 | } | |
957 | } | |
958 | ||
a62bf3af | 959 | /* Sends an APDU to the tag |
960 | * TODO: check CRC and preamble | |
961 | */ | |
962 | int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response) | |
963 | { | |
964 | uint8_t message_frame[message_length + 4]; | |
965 | // PCB | |
966 | message_frame[0] = 0x0A | pcb_blocknum; | |
967 | pcb_blocknum ^= 1; | |
968 | // CID | |
969 | message_frame[1] = 0; | |
970 | // INF | |
971 | memcpy(message_frame + 2, message, message_length); | |
972 | // EDC (CRC) | |
973 | ComputeCrc14443(CRC_14443_B, message_frame, message_length + 2, &message_frame[message_length + 2], &message_frame[message_length + 3]); | |
974 | // send | |
975 | CodeAndTransmit14443bAsReader(message_frame, message_length + 4); | |
976 | // get response | |
977 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT*100, TRUE); | |
978 | if(Demod.len < 3) | |
979 | { | |
980 | return 0; | |
981 | } | |
982 | // TODO: Check CRC | |
983 | // copy response contents | |
984 | if(response != NULL) | |
985 | { | |
986 | memcpy(response, Demod.output, Demod.len); | |
987 | } | |
988 | return Demod.len; | |
989 | } | |
990 | ||
991 | /* Perform the ISO 14443 B Card Selection procedure | |
992 | * Currently does NOT do any collision handling. | |
993 | * It expects 0-1 cards in the device's range. | |
994 | * TODO: Support multiple cards (perform anticollision) | |
995 | * TODO: Verify CRC checksums | |
996 | */ | |
997 | int iso14443b_select_card() | |
998 | { | |
999 | // WUPB command (including CRC) | |
1000 | // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state | |
1001 | static const uint8_t wupb[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; | |
1002 | // ATTRIB command (with space for CRC) | |
1003 | uint8_t attrib[] = { 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00}; | |
1004 | ||
1005 | // first, wake up the tag | |
1006 | CodeAndTransmit14443bAsReader(wupb, sizeof(wupb)); | |
1007 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); | |
1008 | // ATQB too short? | |
1009 | if (Demod.len < 14) | |
1010 | { | |
1011 | return 2; | |
1012 | } | |
1013 | ||
1014 | // select the tag | |
1015 | // copy the PUPI to ATTRIB | |
1016 | memcpy(attrib + 1, Demod.output + 1, 4); | |
1017 | /* copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into | |
1018 | ATTRIB (Param 3) */ | |
1019 | attrib[7] = Demod.output[10] & 0x0F; | |
1020 | ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10); | |
1021 | CodeAndTransmit14443bAsReader(attrib, sizeof(attrib)); | |
1022 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); | |
1023 | // Answer to ATTRIB too short? | |
1024 | if(Demod.len < 3) | |
1025 | { | |
1026 | return 2; | |
1027 | } | |
1028 | // reset PCB block number | |
1029 | pcb_blocknum = 0; | |
1030 | return 1; | |
1031 | } | |
1032 | ||
1033 | // Set up ISO 14443 Type B communication (similar to iso14443a_setup) | |
1034 | void iso14443b_setup() { | |
1035 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
1036 | BigBuf_free(); | |
1037 | // Set up the synchronous serial port | |
1038 | FpgaSetupSsc(); | |
1039 | // connect Demodulated Signal to ADC: | |
1040 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
1041 | ||
1042 | // Signal field is on with the appropriate LED | |
1043 | LED_D_ON(); | |
1044 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); | |
1045 | ||
1046 | // Start the timer | |
1047 | StartCountSspClk(); | |
1048 | ||
1049 | DemodReset(); | |
1050 | UartReset(); | |
1051 | } | |
489ef36c | 1052 | |
1053 | //----------------------------------------------------------------------------- | |
abb21530 | 1054 | // Read a SRI512 ISO 14443B tag. |
489ef36c | 1055 | // |
1056 | // SRI512 tags are just simple memory tags, here we're looking at making a dump | |
1057 | // of the contents of the memory. No anticollision algorithm is done, we assume | |
1058 | // we have a single tag in the field. | |
1059 | // | |
1060 | // I tried to be systematic and check every answer of the tag, every CRC, etc... | |
1061 | //----------------------------------------------------------------------------- | |
abb21530 | 1062 | void ReadSTMemoryIso14443b(uint32_t dwLast) |
489ef36c | 1063 | { |
17ad0e09 | 1064 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
99cf19d9 | 1065 | BigBuf_free(); |
1066 | ||
489ef36c | 1067 | clear_trace(); |
1068 | set_tracing(TRUE); | |
1069 | ||
1070 | uint8_t i = 0x00; | |
1071 | ||
489ef36c | 1072 | // Make sure that we start from off, since the tags are stateful; |
1073 | // confusing things will happen if we don't reset them between reads. | |
1074 | LED_D_OFF(); | |
1075 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
99cf19d9 | 1076 | SpinDelay(200); |
1077 | ||
489ef36c | 1078 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
1079 | FpgaSetupSsc(); | |
1080 | ||
1081 | // Now give it time to spin up. | |
1082 | // Signal field is on with the appropriate LED | |
1083 | LED_D_ON(); | |
22e24700 | 1084 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); |
489ef36c | 1085 | SpinDelay(200); |
1086 | ||
1087 | // First command: wake up the tag using the INITIATE command | |
51d4f6f1 | 1088 | uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b}; |
489ef36c | 1089 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); |
abb21530 | 1090 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); |
489ef36c | 1091 | |
1092 | if (Demod.len == 0) { | |
22e24700 | 1093 | DbpString("No response from tag"); |
1094 | return; | |
489ef36c | 1095 | } else { |
705bfa10 | 1096 | Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x", |
1097 | Demod.output[0], Demod.output[1], Demod.output[2]); | |
489ef36c | 1098 | } |
705bfa10 | 1099 | |
489ef36c | 1100 | // There is a response, SELECT the uid |
1101 | DbpString("Now SELECT tag:"); | |
1102 | cmd1[0] = 0x0E; // 0x0E is SELECT | |
1103 | cmd1[1] = Demod.output[0]; | |
1104 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); | |
1105 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); | |
abb21530 | 1106 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); |
489ef36c | 1107 | if (Demod.len != 3) { |
22e24700 | 1108 | Dbprintf("Expected 3 bytes from tag, got %d", Demod.len); |
1109 | return; | |
489ef36c | 1110 | } |
1111 | // Check the CRC of the answer: | |
1112 | ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]); | |
1113 | if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) { | |
22e24700 | 1114 | DbpString("CRC Error reading select response."); |
1115 | return; | |
489ef36c | 1116 | } |
1117 | // Check response from the tag: should be the same UID as the command we just sent: | |
1118 | if (cmd1[1] != Demod.output[0]) { | |
22e24700 | 1119 | Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]); |
1120 | return; | |
489ef36c | 1121 | } |
705bfa10 | 1122 | |
489ef36c | 1123 | // Tag is now selected, |
1124 | // First get the tag's UID: | |
1125 | cmd1[0] = 0x0B; | |
1126 | ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]); | |
1127 | CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one | |
abb21530 | 1128 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); |
489ef36c | 1129 | if (Demod.len != 10) { |
22e24700 | 1130 | Dbprintf("Expected 10 bytes from tag, got %d", Demod.len); |
1131 | return; | |
489ef36c | 1132 | } |
1133 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
1134 | ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]); | |
51d4f6f1 | 1135 | if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) { |
22e24700 | 1136 | Dbprintf("CRC Error reading block! Expected: %04x got: %04x", |
705bfa10 | 1137 | (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]); |
489ef36c | 1138 | // Do not return;, let's go on... (we should retry, maybe ?) |
1139 | } | |
1140 | Dbprintf("Tag UID (64 bits): %08x %08x", | |
705bfa10 | 1141 | (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], |
1142 | (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]); | |
489ef36c | 1143 | |
1144 | // Now loop to read all 16 blocks, address from 0 to last block | |
132a0217 | 1145 | Dbprintf("Tag memory dump, block 0 to %d", dwLast); |
489ef36c | 1146 | cmd1[0] = 0x08; |
1147 | i = 0x00; | |
1148 | dwLast++; | |
1149 | for (;;) { | |
1150 | if (i == dwLast) { | |
1151 | DbpString("System area block (0xff):"); | |
1152 | i = 0xff; | |
1153 | } | |
1154 | cmd1[1] = i; | |
1155 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); | |
1156 | CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); | |
abb21530 | 1157 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); |
489ef36c | 1158 | if (Demod.len != 6) { // Check if we got an answer from the tag |
1159 | DbpString("Expected 6 bytes from tag, got less..."); | |
1160 | return; | |
1161 | } | |
1162 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
1163 | ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]); | |
1164 | if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) { | |
132a0217 | 1165 | Dbprintf("CRC Error reading block! Expected: %04x got: %04x", |
705bfa10 | 1166 | (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]); |
489ef36c | 1167 | // Do not return;, let's go on... (we should retry, maybe ?) |
1168 | } | |
1169 | // Now print out the memory location: | |
22e24700 | 1170 | Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i, |
705bfa10 | 1171 | (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], |
17ad0e09 | 1172 | (Demod.output[4]<<8)+Demod.output[5]); |
1173 | if (i == 0xff) { | |
1174 | break; | |
1175 | } | |
489ef36c | 1176 | i++; |
1177 | } | |
1178 | } | |
1179 | ||
1180 | ||
1181 | //============================================================================= | |
1182 | // Finally, the `sniffer' combines elements from both the reader and | |
1183 | // simulated tag, to show both sides of the conversation. | |
1184 | //============================================================================= | |
1185 | ||
1186 | //----------------------------------------------------------------------------- | |
1187 | // Record the sequence of commands sent by the reader to the tag, with | |
1188 | // triggering so that we start recording at the point that the tag is moved | |
1189 | // near the reader. | |
1190 | //----------------------------------------------------------------------------- | |
1191 | /* | |
1192 | * Memory usage for this function, (within BigBuf) | |
47286d89 | 1193 | * Last Received command (reader->tag) - MAX_FRAME_SIZE |
1194 | * Last Received command (tag->reader) - MAX_FRAME_SIZE | |
705bfa10 | 1195 | * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE |
47286d89 | 1196 | * Demodulated samples received - all the rest |
489ef36c | 1197 | */ |
abb21530 | 1198 | void RAMFUNC SnoopIso14443b(void) |
489ef36c | 1199 | { |
1200 | // We won't start recording the frames that we acquire until we trigger; | |
1201 | // a good trigger condition to get started is probably when we see a | |
1202 | // response from the tag. | |
47286d89 | 1203 | int triggered = TRUE; // TODO: set and evaluate trigger condition |
489ef36c | 1204 | |
1205 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
1206 | BigBuf_free(); | |
1207 | ||
1208 | clear_trace(); | |
1209 | set_tracing(TRUE); | |
1210 | ||
1211 | // The DMA buffer, used to stream samples from the FPGA | |
705bfa10 | 1212 | int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); |
489ef36c | 1213 | int lastRxCounter; |
1214 | int8_t *upTo; | |
1215 | int ci, cq; | |
1216 | int maxBehindBy = 0; | |
1217 | ||
1218 | // Count of samples received so far, so that we can include timing | |
1219 | // information in the trace buffer. | |
1220 | int samples = 0; | |
1221 | ||
1222 | DemodInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1223 | UartInit(BigBuf_malloc(MAX_FRAME_SIZE)); | |
1224 | ||
1225 | // Print some debug information about the buffer sizes | |
1226 | Dbprintf("Snooping buffers initialized:"); | |
1227 | Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen()); | |
1228 | Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE); | |
1229 | Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE); | |
705bfa10 | 1230 | Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE); |
489ef36c | 1231 | |
abb21530 | 1232 | // Signal field is off, no reader signal, no tag signal |
1233 | LEDsoff(); | |
489ef36c | 1234 | |
1235 | // And put the FPGA in the appropriate mode | |
22e24700 | 1236 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP); |
489ef36c | 1237 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
1238 | ||
1239 | // Setup for the DMA. | |
1240 | FpgaSetupSsc(); | |
1241 | upTo = dmaBuf; | |
705bfa10 | 1242 | lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; |
1243 | FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE); | |
489ef36c | 1244 | uint8_t parity[MAX_PARITY_SIZE]; |
5b95953d | 1245 | |
f53020e7 | 1246 | bool TagIsActive = FALSE; |
1247 | bool ReaderIsActive = FALSE; | |
489ef36c | 1248 | |
1249 | // And now we loop, receiving samples. | |
1250 | for(;;) { | |
1251 | int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & | |
705bfa10 | 1252 | (ISO14443B_DMA_BUFFER_SIZE-1); |
489ef36c | 1253 | if(behindBy > maxBehindBy) { |
1254 | maxBehindBy = behindBy; | |
489ef36c | 1255 | } |
abb21530 | 1256 | |
489ef36c | 1257 | if(behindBy < 2) continue; |
1258 | ||
1259 | ci = upTo[0]; | |
1260 | cq = upTo[1]; | |
1261 | upTo += 2; | |
1262 | lastRxCounter -= 2; | |
705bfa10 | 1263 | if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) { |
489ef36c | 1264 | upTo = dmaBuf; |
705bfa10 | 1265 | lastRxCounter += ISO14443B_DMA_BUFFER_SIZE; |
489ef36c | 1266 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; |
705bfa10 | 1267 | AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE; |
51d4f6f1 | 1268 | WDT_HIT(); |
705bfa10 | 1269 | if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not? |
132a0217 | 1270 | Dbprintf("blew circular buffer! behindBy=%d", behindBy); |
51d4f6f1 | 1271 | break; |
abb21530 | 1272 | } |
1273 | if(!tracing) { | |
1274 | DbpString("Reached trace limit"); | |
1275 | break; | |
1276 | } | |
1277 | if(BUTTON_PRESS()) { | |
1278 | DbpString("cancelled"); | |
1279 | break; | |
1280 | } | |
489ef36c | 1281 | } |
1282 | ||
1283 | samples += 2; | |
1284 | ||
47286d89 | 1285 | if (!TagIsActive) { // no need to try decoding reader data if the tag is sending |
abb21530 | 1286 | if(Handle14443bUartBit(ci & 0x01)) { |
489ef36c | 1287 | if(triggered && tracing) { |
51d4f6f1 | 1288 | LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE); |
489ef36c | 1289 | } |
489ef36c | 1290 | /* And ready to receive another command. */ |
1291 | UartReset(); | |
1292 | /* And also reset the demod code, which might have been */ | |
1293 | /* false-triggered by the commands from the reader. */ | |
1294 | DemodReset(); | |
1295 | } | |
abb21530 | 1296 | if(Handle14443bUartBit(cq & 0x01)) { |
489ef36c | 1297 | if(triggered && tracing) { |
51d4f6f1 | 1298 | LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE); |
489ef36c | 1299 | } |
489ef36c | 1300 | /* And ready to receive another command. */ |
1301 | UartReset(); | |
1302 | /* And also reset the demod code, which might have been */ | |
1303 | /* false-triggered by the commands from the reader. */ | |
1304 | DemodReset(); | |
1305 | } | |
36f84d47 | 1306 | ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF); |
47286d89 | 1307 | } |
489ef36c | 1308 | |
47286d89 | 1309 | if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time |
d8af608f | 1310 | // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103 |
36f84d47 | 1311 | if(Handle14443bSamplesDemod(ci | 0x01, cq | 0x01)) { |
489ef36c | 1312 | |
1313 | //Use samples as a time measurement | |
1314 | if(tracing) | |
1315 | { | |
99cf19d9 | 1316 | //uint8_t parity[MAX_PARITY_SIZE]; |
1317 | LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE); | |
489ef36c | 1318 | } |
1319 | triggered = TRUE; | |
489ef36c | 1320 | |
1321 | // And ready to receive another response. | |
1322 | DemodReset(); | |
1323 | } | |
22e24700 | 1324 | TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF); |
47286d89 | 1325 | } |
1326 | ||
489ef36c | 1327 | } |
abb21530 | 1328 | |
489ef36c | 1329 | FpgaDisableSscDma(); |
abb21530 | 1330 | LEDsoff(); |
489ef36c | 1331 | AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; |
1332 | DbpString("Snoop statistics:"); | |
1333 | Dbprintf(" Max behind by: %i", maxBehindBy); | |
1334 | Dbprintf(" Uart State: %x", Uart.state); | |
1335 | Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt); | |
1336 | Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax); | |
1337 | Dbprintf(" Trace length: %i", BigBuf_get_traceLen()); | |
1338 | } | |
1339 | ||
1340 | ||
1341 | /* | |
1342 | * Send raw command to tag ISO14443B | |
1343 | * @Input | |
1344 | * datalen len of buffer data | |
1345 | * recv bool when true wait for data from tag and send to client | |
1346 | * powerfield bool leave the field on when true | |
1347 | * data buffer with byte to send | |
1348 | * | |
1349 | * @Output | |
1350 | * none | |
1351 | * | |
1352 | */ | |
abb21530 | 1353 | void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[]) |
489ef36c | 1354 | { |
a62bf3af | 1355 | iso14443b_setup(); |
489ef36c | 1356 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
17ad0e09 | 1357 | BigBuf_free(); |
b10a759f | 1358 | if ( !PowerOn ){ |
1359 | FpgaSetupSsc(); | |
1360 | } | |
a62bf3af | 1361 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
1362 | ||
1363 | // Start the timer | |
1364 | StartCountSspClk(); | |
1365 | ||
1366 | DemodReset(); | |
1367 | UartReset(); | |
b10a759f | 1368 | |
99cf19d9 | 1369 | if ( datalen == 0 && recv == 0 && powerfield == 0){ |
1370 | clear_trace(); | |
1371 | } else { | |
1372 | set_tracing(TRUE); | |
1373 | CodeAndTransmit14443bAsReader(data, datalen); | |
1374 | } | |
489ef36c | 1375 | |
abb21530 | 1376 | if(recv) { |
b10a759f | 1377 | GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, FALSE); |
51d4f6f1 | 1378 | uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE); |
1379 | cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen); | |
489ef36c | 1380 | } |
abb21530 | 1381 | |
1382 | if(!powerfield) { | |
489ef36c | 1383 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
b10a759f | 1384 | FpgaDisableSscDma(); |
489ef36c | 1385 | LED_D_OFF(); |
b10a759f | 1386 | PowerOn = 0; |
489ef36c | 1387 | } |
1388 | } | |
1389 |