| 1 | //----------------------------------------------------------------------------- |
| 2 | // Gerhard de Koning Gans - May 2008 |
| 3 | // Hagen Fritsch - June 2010 |
| 4 | // Gerhard de Koning Gans - May 2011 |
| 5 | // Gerhard de Koning Gans - June 2012 - Added iClass card and reader emulation |
| 6 | // |
| 7 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| 8 | // at your option, any later version. See the LICENSE.txt file for the text of |
| 9 | // the license. |
| 10 | //----------------------------------------------------------------------------- |
| 11 | // Routines to support iClass. |
| 12 | //----------------------------------------------------------------------------- |
| 13 | // Based on ISO14443a implementation. Still in experimental phase. |
| 14 | // Contribution made during a security research at Radboud University Nijmegen |
| 15 | // |
| 16 | // Please feel free to contribute and extend iClass support!! |
| 17 | //----------------------------------------------------------------------------- |
| 18 | // |
| 19 | // FIX: |
| 20 | // ==== |
| 21 | // We still have sometimes a demodulation error when snooping iClass communication. |
| 22 | // The resulting trace of a read-block-03 command may look something like this: |
| 23 | // |
| 24 | // + 22279: : 0c 03 e8 01 |
| 25 | // |
| 26 | // ...with an incorrect answer... |
| 27 | // |
| 28 | // + 85: 0: TAG ff! ff! ff! ff! ff! ff! ff! ff! bb 33 bb 00 01! 0e! 04! bb !crc |
| 29 | // |
| 30 | // We still left the error signalling bytes in the traces like 0xbb |
| 31 | // |
| 32 | // A correct trace should look like this: |
| 33 | // |
| 34 | // + 21112: : 0c 03 e8 01 |
| 35 | // + 85: 0: TAG ff ff ff ff ff ff ff ff ea f5 |
| 36 | // |
| 37 | //----------------------------------------------------------------------------- |
| 38 | |
| 39 | #include "proxmark3.h" |
| 40 | #include "apps.h" |
| 41 | #include "util.h" |
| 42 | #include "string.h" |
| 43 | #include "common.h" |
| 44 | // Needed for CRC in emulation mode; |
| 45 | // same construction as in ISO 14443; |
| 46 | // different initial value (CRC_ICLASS) |
| 47 | #include "iso14443crc.h" |
| 48 | |
| 49 | static int timeout = 4096; |
| 50 | |
| 51 | // CARD TO READER |
| 52 | // Sequence D: 11110000 modulation with subcarrier during first half |
| 53 | // Sequence E: 00001111 modulation with subcarrier during second half |
| 54 | // Sequence F: 00000000 no modulation with subcarrier |
| 55 | // READER TO CARD |
| 56 | // Sequence X: 00001100 drop after half a period |
| 57 | // Sequence Y: 00000000 no drop |
| 58 | // Sequence Z: 11000000 drop at start |
| 59 | #define SEC_X 0x0c |
| 60 | #define SEC_Y 0x00 |
| 61 | #define SEC_Z 0xc0 |
| 62 | |
| 63 | static int SendIClassAnswer(uint8_t *resp, int respLen, int delay); |
| 64 | |
| 65 | //----------------------------------------------------------------------------- |
| 66 | // The software UART that receives commands from the reader, and its state |
| 67 | // variables. |
| 68 | //----------------------------------------------------------------------------- |
| 69 | static struct { |
| 70 | enum { |
| 71 | STATE_UNSYNCD, |
| 72 | STATE_START_OF_COMMUNICATION, |
| 73 | STATE_RECEIVING |
| 74 | } state; |
| 75 | uint16_t shiftReg; |
| 76 | int bitCnt; |
| 77 | int byteCnt; |
| 78 | int byteCntMax; |
| 79 | int posCnt; |
| 80 | int nOutOfCnt; |
| 81 | int OutOfCnt; |
| 82 | int syncBit; |
| 83 | int parityBits; |
| 84 | int samples; |
| 85 | int highCnt; |
| 86 | int swapper; |
| 87 | int counter; |
| 88 | int bitBuffer; |
| 89 | int dropPosition; |
| 90 | uint8_t *output; |
| 91 | } Uart; |
| 92 | |
| 93 | static RAMFUNC int OutOfNDecoding(int bit) |
| 94 | { |
| 95 | //int error = 0; |
| 96 | int bitright; |
| 97 | |
| 98 | if(!Uart.bitBuffer) { |
| 99 | Uart.bitBuffer = bit ^ 0xFF0; |
| 100 | return FALSE; |
| 101 | } |
| 102 | else { |
| 103 | Uart.bitBuffer <<= 4; |
| 104 | Uart.bitBuffer ^= bit; |
| 105 | } |
| 106 | |
| 107 | /*if(Uart.swapper) { |
| 108 | Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF; |
| 109 | Uart.byteCnt++; |
| 110 | Uart.swapper = 0; |
| 111 | if(Uart.byteCnt > 15) { return TRUE; } |
| 112 | } |
| 113 | else { |
| 114 | Uart.swapper = 1; |
| 115 | }*/ |
| 116 | |
| 117 | if(Uart.state != STATE_UNSYNCD) { |
| 118 | Uart.posCnt++; |
| 119 | |
| 120 | if((Uart.bitBuffer & Uart.syncBit) ^ Uart.syncBit) { |
| 121 | bit = 0x00; |
| 122 | } |
| 123 | else { |
| 124 | bit = 0x01; |
| 125 | } |
| 126 | if(((Uart.bitBuffer << 1) & Uart.syncBit) ^ Uart.syncBit) { |
| 127 | bitright = 0x00; |
| 128 | } |
| 129 | else { |
| 130 | bitright = 0x01; |
| 131 | } |
| 132 | if(bit != bitright) { bit = bitright; } |
| 133 | |
| 134 | |
| 135 | // So, now we only have to deal with *bit*, lets see... |
| 136 | if(Uart.posCnt == 1) { |
| 137 | // measurement first half bitperiod |
| 138 | if(!bit) { |
| 139 | // Drop in first half means that we are either seeing |
| 140 | // an SOF or an EOF. |
| 141 | |
| 142 | if(Uart.nOutOfCnt == 1) { |
| 143 | // End of Communication |
| 144 | Uart.state = STATE_UNSYNCD; |
| 145 | Uart.highCnt = 0; |
| 146 | if(Uart.byteCnt == 0) { |
| 147 | // Its not straightforward to show single EOFs |
| 148 | // So just leave it and do not return TRUE |
| 149 | Uart.output[Uart.byteCnt] = 0xf0; |
| 150 | Uart.byteCnt++; |
| 151 | |
| 152 | // Calculate the parity bit for the client... |
| 153 | Uart.parityBits = 1; |
| 154 | } |
| 155 | else { |
| 156 | return TRUE; |
| 157 | } |
| 158 | } |
| 159 | else if(Uart.state != STATE_START_OF_COMMUNICATION) { |
| 160 | // When not part of SOF or EOF, it is an error |
| 161 | Uart.state = STATE_UNSYNCD; |
| 162 | Uart.highCnt = 0; |
| 163 | //error = 4; |
| 164 | } |
| 165 | } |
| 166 | } |
| 167 | else { |
| 168 | // measurement second half bitperiod |
| 169 | // Count the bitslot we are in... (ISO 15693) |
| 170 | Uart.nOutOfCnt++; |
| 171 | |
| 172 | if(!bit) { |
| 173 | if(Uart.dropPosition) { |
| 174 | if(Uart.state == STATE_START_OF_COMMUNICATION) { |
| 175 | //error = 1; |
| 176 | } |
| 177 | else { |
| 178 | //error = 7; |
| 179 | } |
| 180 | // It is an error if we already have seen a drop in current frame |
| 181 | Uart.state = STATE_UNSYNCD; |
| 182 | Uart.highCnt = 0; |
| 183 | } |
| 184 | else { |
| 185 | Uart.dropPosition = Uart.nOutOfCnt; |
| 186 | } |
| 187 | } |
| 188 | |
| 189 | Uart.posCnt = 0; |
| 190 | |
| 191 | |
| 192 | if(Uart.nOutOfCnt == Uart.OutOfCnt && Uart.OutOfCnt == 4) { |
| 193 | Uart.nOutOfCnt = 0; |
| 194 | |
| 195 | if(Uart.state == STATE_START_OF_COMMUNICATION) { |
| 196 | if(Uart.dropPosition == 4) { |
| 197 | Uart.state = STATE_RECEIVING; |
| 198 | Uart.OutOfCnt = 256; |
| 199 | } |
| 200 | else if(Uart.dropPosition == 3) { |
| 201 | Uart.state = STATE_RECEIVING; |
| 202 | Uart.OutOfCnt = 4; |
| 203 | //Uart.output[Uart.byteCnt] = 0xdd; |
| 204 | //Uart.byteCnt++; |
| 205 | } |
| 206 | else { |
| 207 | Uart.state = STATE_UNSYNCD; |
| 208 | Uart.highCnt = 0; |
| 209 | } |
| 210 | Uart.dropPosition = 0; |
| 211 | } |
| 212 | else { |
| 213 | // RECEIVING DATA |
| 214 | // 1 out of 4 |
| 215 | if(!Uart.dropPosition) { |
| 216 | Uart.state = STATE_UNSYNCD; |
| 217 | Uart.highCnt = 0; |
| 218 | //error = 9; |
| 219 | } |
| 220 | else { |
| 221 | Uart.shiftReg >>= 2; |
| 222 | |
| 223 | // Swap bit order |
| 224 | Uart.dropPosition--; |
| 225 | //if(Uart.dropPosition == 1) { Uart.dropPosition = 2; } |
| 226 | //else if(Uart.dropPosition == 2) { Uart.dropPosition = 1; } |
| 227 | |
| 228 | Uart.shiftReg ^= ((Uart.dropPosition & 0x03) << 6); |
| 229 | Uart.bitCnt += 2; |
| 230 | Uart.dropPosition = 0; |
| 231 | |
| 232 | if(Uart.bitCnt == 8) { |
| 233 | Uart.output[Uart.byteCnt] = (Uart.shiftReg & 0xff); |
| 234 | Uart.byteCnt++; |
| 235 | |
| 236 | // Calculate the parity bit for the client... |
| 237 | Uart.parityBits <<= 1; |
| 238 | Uart.parityBits ^= OddByteParity[(Uart.shiftReg & 0xff)]; |
| 239 | |
| 240 | Uart.bitCnt = 0; |
| 241 | Uart.shiftReg = 0; |
| 242 | } |
| 243 | } |
| 244 | } |
| 245 | } |
| 246 | else if(Uart.nOutOfCnt == Uart.OutOfCnt) { |
| 247 | // RECEIVING DATA |
| 248 | // 1 out of 256 |
| 249 | if(!Uart.dropPosition) { |
| 250 | Uart.state = STATE_UNSYNCD; |
| 251 | Uart.highCnt = 0; |
| 252 | //error = 3; |
| 253 | } |
| 254 | else { |
| 255 | Uart.dropPosition--; |
| 256 | Uart.output[Uart.byteCnt] = (Uart.dropPosition & 0xff); |
| 257 | Uart.byteCnt++; |
| 258 | |
| 259 | // Calculate the parity bit for the client... |
| 260 | Uart.parityBits <<= 1; |
| 261 | Uart.parityBits ^= OddByteParity[(Uart.dropPosition & 0xff)]; |
| 262 | |
| 263 | Uart.bitCnt = 0; |
| 264 | Uart.shiftReg = 0; |
| 265 | Uart.nOutOfCnt = 0; |
| 266 | Uart.dropPosition = 0; |
| 267 | } |
| 268 | } |
| 269 | |
| 270 | /*if(error) { |
| 271 | Uart.output[Uart.byteCnt] = 0xAA; |
| 272 | Uart.byteCnt++; |
| 273 | Uart.output[Uart.byteCnt] = error & 0xFF; |
| 274 | Uart.byteCnt++; |
| 275 | Uart.output[Uart.byteCnt] = 0xAA; |
| 276 | Uart.byteCnt++; |
| 277 | Uart.output[Uart.byteCnt] = (Uart.bitBuffer >> 8) & 0xFF; |
| 278 | Uart.byteCnt++; |
| 279 | Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF; |
| 280 | Uart.byteCnt++; |
| 281 | Uart.output[Uart.byteCnt] = (Uart.syncBit >> 3) & 0xFF; |
| 282 | Uart.byteCnt++; |
| 283 | Uart.output[Uart.byteCnt] = 0xAA; |
| 284 | Uart.byteCnt++; |
| 285 | return TRUE; |
| 286 | }*/ |
| 287 | } |
| 288 | |
| 289 | } |
| 290 | else { |
| 291 | bit = Uart.bitBuffer & 0xf0; |
| 292 | bit >>= 4; |
| 293 | bit ^= 0x0F; // drops become 1s ;-) |
| 294 | if(bit) { |
| 295 | // should have been high or at least (4 * 128) / fc |
| 296 | // according to ISO this should be at least (9 * 128 + 20) / fc |
| 297 | if(Uart.highCnt == 8) { |
| 298 | // we went low, so this could be start of communication |
| 299 | // it turns out to be safer to choose a less significant |
| 300 | // syncbit... so we check whether the neighbour also represents the drop |
| 301 | Uart.posCnt = 1; // apparently we are busy with our first half bit period |
| 302 | Uart.syncBit = bit & 8; |
| 303 | Uart.samples = 3; |
| 304 | if(!Uart.syncBit) { Uart.syncBit = bit & 4; Uart.samples = 2; } |
| 305 | else if(bit & 4) { Uart.syncBit = bit & 4; Uart.samples = 2; bit <<= 2; } |
| 306 | if(!Uart.syncBit) { Uart.syncBit = bit & 2; Uart.samples = 1; } |
| 307 | else if(bit & 2) { Uart.syncBit = bit & 2; Uart.samples = 1; bit <<= 1; } |
| 308 | if(!Uart.syncBit) { Uart.syncBit = bit & 1; Uart.samples = 0; |
| 309 | if(Uart.syncBit && (Uart.bitBuffer & 8)) { |
| 310 | Uart.syncBit = 8; |
| 311 | |
| 312 | // the first half bit period is expected in next sample |
| 313 | Uart.posCnt = 0; |
| 314 | Uart.samples = 3; |
| 315 | } |
| 316 | } |
| 317 | else if(bit & 1) { Uart.syncBit = bit & 1; Uart.samples = 0; } |
| 318 | |
| 319 | Uart.syncBit <<= 4; |
| 320 | Uart.state = STATE_START_OF_COMMUNICATION; |
| 321 | Uart.bitCnt = 0; |
| 322 | Uart.byteCnt = 0; |
| 323 | Uart.parityBits = 0; |
| 324 | Uart.nOutOfCnt = 0; |
| 325 | Uart.OutOfCnt = 4; // Start at 1/4, could switch to 1/256 |
| 326 | Uart.dropPosition = 0; |
| 327 | Uart.shiftReg = 0; |
| 328 | //error = 0; |
| 329 | } |
| 330 | else { |
| 331 | Uart.highCnt = 0; |
| 332 | } |
| 333 | } |
| 334 | else { |
| 335 | if(Uart.highCnt < 8) { |
| 336 | Uart.highCnt++; |
| 337 | } |
| 338 | } |
| 339 | } |
| 340 | |
| 341 | return FALSE; |
| 342 | } |
| 343 | |
| 344 | //============================================================================= |
| 345 | // Manchester |
| 346 | //============================================================================= |
| 347 | |
| 348 | static struct { |
| 349 | enum { |
| 350 | DEMOD_UNSYNCD, |
| 351 | DEMOD_START_OF_COMMUNICATION, |
| 352 | DEMOD_START_OF_COMMUNICATION2, |
| 353 | DEMOD_START_OF_COMMUNICATION3, |
| 354 | DEMOD_SOF_COMPLETE, |
| 355 | DEMOD_MANCHESTER_D, |
| 356 | DEMOD_MANCHESTER_E, |
| 357 | DEMOD_END_OF_COMMUNICATION, |
| 358 | DEMOD_END_OF_COMMUNICATION2, |
| 359 | DEMOD_MANCHESTER_F, |
| 360 | DEMOD_ERROR_WAIT |
| 361 | } state; |
| 362 | int bitCount; |
| 363 | int posCount; |
| 364 | int syncBit; |
| 365 | int parityBits; |
| 366 | uint16_t shiftReg; |
| 367 | int buffer; |
| 368 | int buffer2; |
| 369 | int buffer3; |
| 370 | int buff; |
| 371 | int samples; |
| 372 | int len; |
| 373 | enum { |
| 374 | SUB_NONE, |
| 375 | SUB_FIRST_HALF, |
| 376 | SUB_SECOND_HALF, |
| 377 | SUB_BOTH |
| 378 | } sub; |
| 379 | uint8_t *output; |
| 380 | } Demod; |
| 381 | |
| 382 | static RAMFUNC int ManchesterDecoding(int v) |
| 383 | { |
| 384 | int bit; |
| 385 | int modulation; |
| 386 | int error = 0; |
| 387 | |
| 388 | bit = Demod.buffer; |
| 389 | Demod.buffer = Demod.buffer2; |
| 390 | Demod.buffer2 = Demod.buffer3; |
| 391 | Demod.buffer3 = v; |
| 392 | |
| 393 | if(Demod.buff < 3) { |
| 394 | Demod.buff++; |
| 395 | return FALSE; |
| 396 | } |
| 397 | |
| 398 | if(Demod.state==DEMOD_UNSYNCD) { |
| 399 | Demod.output[Demod.len] = 0xfa; |
| 400 | Demod.syncBit = 0; |
| 401 | //Demod.samples = 0; |
| 402 | Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part |
| 403 | |
| 404 | if(bit & 0x08) { |
| 405 | Demod.syncBit = 0x08; |
| 406 | } |
| 407 | |
| 408 | if(bit & 0x04) { |
| 409 | if(Demod.syncBit) { |
| 410 | bit <<= 4; |
| 411 | } |
| 412 | Demod.syncBit = 0x04; |
| 413 | } |
| 414 | |
| 415 | if(bit & 0x02) { |
| 416 | if(Demod.syncBit) { |
| 417 | bit <<= 2; |
| 418 | } |
| 419 | Demod.syncBit = 0x02; |
| 420 | } |
| 421 | |
| 422 | if(bit & 0x01 && Demod.syncBit) { |
| 423 | Demod.syncBit = 0x01; |
| 424 | } |
| 425 | |
| 426 | if(Demod.syncBit) { |
| 427 | Demod.len = 0; |
| 428 | Demod.state = DEMOD_START_OF_COMMUNICATION; |
| 429 | Demod.sub = SUB_FIRST_HALF; |
| 430 | Demod.bitCount = 0; |
| 431 | Demod.shiftReg = 0; |
| 432 | Demod.parityBits = 0; |
| 433 | Demod.samples = 0; |
| 434 | if(Demod.posCount) { |
| 435 | //if(trigger) LED_A_OFF(); // Not useful in this case... |
| 436 | switch(Demod.syncBit) { |
| 437 | case 0x08: Demod.samples = 3; break; |
| 438 | case 0x04: Demod.samples = 2; break; |
| 439 | case 0x02: Demod.samples = 1; break; |
| 440 | case 0x01: Demod.samples = 0; break; |
| 441 | } |
| 442 | // SOF must be long burst... otherwise stay unsynced!!! |
| 443 | if(!(Demod.buffer & Demod.syncBit) || !(Demod.buffer2 & Demod.syncBit)) { |
| 444 | Demod.state = DEMOD_UNSYNCD; |
| 445 | } |
| 446 | } |
| 447 | else { |
| 448 | // SOF must be long burst... otherwise stay unsynced!!! |
| 449 | if(!(Demod.buffer2 & Demod.syncBit) || !(Demod.buffer3 & Demod.syncBit)) { |
| 450 | Demod.state = DEMOD_UNSYNCD; |
| 451 | error = 0x88; |
| 452 | } |
| 453 | |
| 454 | } |
| 455 | error = 0; |
| 456 | |
| 457 | } |
| 458 | } |
| 459 | else { |
| 460 | modulation = bit & Demod.syncBit; |
| 461 | modulation |= ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit; |
| 462 | //modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit; |
| 463 | |
| 464 | Demod.samples += 4; |
| 465 | |
| 466 | if(Demod.posCount==0) { |
| 467 | Demod.posCount = 1; |
| 468 | if(modulation) { |
| 469 | Demod.sub = SUB_FIRST_HALF; |
| 470 | } |
| 471 | else { |
| 472 | Demod.sub = SUB_NONE; |
| 473 | } |
| 474 | } |
| 475 | else { |
| 476 | Demod.posCount = 0; |
| 477 | /*(modulation && (Demod.sub == SUB_FIRST_HALF)) { |
| 478 | if(Demod.state!=DEMOD_ERROR_WAIT) { |
| 479 | Demod.state = DEMOD_ERROR_WAIT; |
| 480 | Demod.output[Demod.len] = 0xaa; |
| 481 | error = 0x01; |
| 482 | } |
| 483 | }*/ |
| 484 | //else if(modulation) { |
| 485 | if(modulation) { |
| 486 | if(Demod.sub == SUB_FIRST_HALF) { |
| 487 | Demod.sub = SUB_BOTH; |
| 488 | } |
| 489 | else { |
| 490 | Demod.sub = SUB_SECOND_HALF; |
| 491 | } |
| 492 | } |
| 493 | else if(Demod.sub == SUB_NONE) { |
| 494 | if(Demod.state == DEMOD_SOF_COMPLETE) { |
| 495 | Demod.output[Demod.len] = 0x0f; |
| 496 | Demod.len++; |
| 497 | Demod.parityBits <<= 1; |
| 498 | Demod.parityBits ^= OddByteParity[0x0f]; |
| 499 | Demod.state = DEMOD_UNSYNCD; |
| 500 | // error = 0x0f; |
| 501 | return TRUE; |
| 502 | } |
| 503 | else { |
| 504 | Demod.state = DEMOD_ERROR_WAIT; |
| 505 | error = 0x33; |
| 506 | } |
| 507 | /*if(Demod.state!=DEMOD_ERROR_WAIT) { |
| 508 | Demod.state = DEMOD_ERROR_WAIT; |
| 509 | Demod.output[Demod.len] = 0xaa; |
| 510 | error = 0x01; |
| 511 | }*/ |
| 512 | } |
| 513 | |
| 514 | switch(Demod.state) { |
| 515 | case DEMOD_START_OF_COMMUNICATION: |
| 516 | if(Demod.sub == SUB_BOTH) { |
| 517 | //Demod.state = DEMOD_MANCHESTER_D; |
| 518 | Demod.state = DEMOD_START_OF_COMMUNICATION2; |
| 519 | Demod.posCount = 1; |
| 520 | Demod.sub = SUB_NONE; |
| 521 | } |
| 522 | else { |
| 523 | Demod.output[Demod.len] = 0xab; |
| 524 | Demod.state = DEMOD_ERROR_WAIT; |
| 525 | error = 0xd2; |
| 526 | } |
| 527 | break; |
| 528 | case DEMOD_START_OF_COMMUNICATION2: |
| 529 | if(Demod.sub == SUB_SECOND_HALF) { |
| 530 | Demod.state = DEMOD_START_OF_COMMUNICATION3; |
| 531 | } |
| 532 | else { |
| 533 | Demod.output[Demod.len] = 0xab; |
| 534 | Demod.state = DEMOD_ERROR_WAIT; |
| 535 | error = 0xd3; |
| 536 | } |
| 537 | break; |
| 538 | case DEMOD_START_OF_COMMUNICATION3: |
| 539 | if(Demod.sub == SUB_SECOND_HALF) { |
| 540 | // Demod.state = DEMOD_MANCHESTER_D; |
| 541 | Demod.state = DEMOD_SOF_COMPLETE; |
| 542 | //Demod.output[Demod.len] = Demod.syncBit & 0xFF; |
| 543 | //Demod.len++; |
| 544 | } |
| 545 | else { |
| 546 | Demod.output[Demod.len] = 0xab; |
| 547 | Demod.state = DEMOD_ERROR_WAIT; |
| 548 | error = 0xd4; |
| 549 | } |
| 550 | break; |
| 551 | case DEMOD_SOF_COMPLETE: |
| 552 | case DEMOD_MANCHESTER_D: |
| 553 | case DEMOD_MANCHESTER_E: |
| 554 | // OPPOSITE FROM ISO14443 - 11110000 = 0 (1 in 14443) |
| 555 | // 00001111 = 1 (0 in 14443) |
| 556 | if(Demod.sub == SUB_SECOND_HALF) { // SUB_FIRST_HALF |
| 557 | Demod.bitCount++; |
| 558 | Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100; |
| 559 | Demod.state = DEMOD_MANCHESTER_D; |
| 560 | } |
| 561 | else if(Demod.sub == SUB_FIRST_HALF) { // SUB_SECOND_HALF |
| 562 | Demod.bitCount++; |
| 563 | Demod.shiftReg >>= 1; |
| 564 | Demod.state = DEMOD_MANCHESTER_E; |
| 565 | } |
| 566 | else if(Demod.sub == SUB_BOTH) { |
| 567 | Demod.state = DEMOD_MANCHESTER_F; |
| 568 | } |
| 569 | else { |
| 570 | Demod.state = DEMOD_ERROR_WAIT; |
| 571 | error = 0x55; |
| 572 | } |
| 573 | break; |
| 574 | |
| 575 | case DEMOD_MANCHESTER_F: |
| 576 | // Tag response does not need to be a complete byte! |
| 577 | if(Demod.len > 0 || Demod.bitCount > 0) { |
| 578 | if(Demod.bitCount > 1) { // was > 0, do not interpret last closing bit, is part of EOF |
| 579 | Demod.shiftReg >>= (9 - Demod.bitCount); |
| 580 | Demod.output[Demod.len] = Demod.shiftReg & 0xff; |
| 581 | Demod.len++; |
| 582 | // No parity bit, so just shift a 0 |
| 583 | Demod.parityBits <<= 1; |
| 584 | } |
| 585 | |
| 586 | Demod.state = DEMOD_UNSYNCD; |
| 587 | return TRUE; |
| 588 | } |
| 589 | else { |
| 590 | Demod.output[Demod.len] = 0xad; |
| 591 | Demod.state = DEMOD_ERROR_WAIT; |
| 592 | error = 0x03; |
| 593 | } |
| 594 | break; |
| 595 | |
| 596 | case DEMOD_ERROR_WAIT: |
| 597 | Demod.state = DEMOD_UNSYNCD; |
| 598 | break; |
| 599 | |
| 600 | default: |
| 601 | Demod.output[Demod.len] = 0xdd; |
| 602 | Demod.state = DEMOD_UNSYNCD; |
| 603 | break; |
| 604 | } |
| 605 | |
| 606 | /*if(Demod.bitCount>=9) { |
| 607 | Demod.output[Demod.len] = Demod.shiftReg & 0xff; |
| 608 | Demod.len++; |
| 609 | |
| 610 | Demod.parityBits <<= 1; |
| 611 | Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01); |
| 612 | |
| 613 | Demod.bitCount = 0; |
| 614 | Demod.shiftReg = 0; |
| 615 | }*/ |
| 616 | if(Demod.bitCount>=8) { |
| 617 | Demod.shiftReg >>= 1; |
| 618 | Demod.output[Demod.len] = (Demod.shiftReg & 0xff); |
| 619 | Demod.len++; |
| 620 | |
| 621 | // FOR ISO15639 PARITY NOT SEND OTA, JUST CALCULATE IT FOR THE CLIENT |
| 622 | Demod.parityBits <<= 1; |
| 623 | Demod.parityBits ^= OddByteParity[(Demod.shiftReg & 0xff)]; |
| 624 | |
| 625 | Demod.bitCount = 0; |
| 626 | Demod.shiftReg = 0; |
| 627 | } |
| 628 | |
| 629 | if(error) { |
| 630 | Demod.output[Demod.len] = 0xBB; |
| 631 | Demod.len++; |
| 632 | Demod.output[Demod.len] = error & 0xFF; |
| 633 | Demod.len++; |
| 634 | Demod.output[Demod.len] = 0xBB; |
| 635 | Demod.len++; |
| 636 | Demod.output[Demod.len] = bit & 0xFF; |
| 637 | Demod.len++; |
| 638 | Demod.output[Demod.len] = Demod.buffer & 0xFF; |
| 639 | Demod.len++; |
| 640 | // Look harder ;-) |
| 641 | Demod.output[Demod.len] = Demod.buffer2 & 0xFF; |
| 642 | Demod.len++; |
| 643 | Demod.output[Demod.len] = Demod.syncBit & 0xFF; |
| 644 | Demod.len++; |
| 645 | Demod.output[Demod.len] = 0xBB; |
| 646 | Demod.len++; |
| 647 | return TRUE; |
| 648 | } |
| 649 | |
| 650 | } |
| 651 | |
| 652 | } // end (state != UNSYNCED) |
| 653 | |
| 654 | return FALSE; |
| 655 | } |
| 656 | |
| 657 | //============================================================================= |
| 658 | // Finally, a `sniffer' for iClass communication |
| 659 | // Both sides of communication! |
| 660 | //============================================================================= |
| 661 | |
| 662 | //----------------------------------------------------------------------------- |
| 663 | // Record the sequence of commands sent by the reader to the tag, with |
| 664 | // triggering so that we start recording at the point that the tag is moved |
| 665 | // near the reader. |
| 666 | //----------------------------------------------------------------------------- |
| 667 | void RAMFUNC SnoopIClass(void) |
| 668 | { |
| 669 | // DEFINED ABOVE |
| 670 | // #define RECV_CMD_OFFSET 3032 |
| 671 | // #define RECV_RES_OFFSET 3096 |
| 672 | // #define DMA_BUFFER_OFFSET 3160 |
| 673 | // #define DMA_BUFFER_SIZE 4096 |
| 674 | // #define TRACE_SIZE 3000 |
| 675 | |
| 676 | // We won't start recording the frames that we acquire until we trigger; |
| 677 | // a good trigger condition to get started is probably when we see a |
| 678 | // response from the tag. |
| 679 | //int triggered = FALSE; // FALSE to wait first for card |
| 680 | |
| 681 | // The command (reader -> tag) that we're receiving. |
| 682 | // The length of a received command will in most cases be no more than 18 bytes. |
| 683 | // So 32 should be enough! |
| 684 | uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET); |
| 685 | // The response (tag -> reader) that we're receiving. |
| 686 | uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET); |
| 687 | |
| 688 | // As we receive stuff, we copy it from receivedCmd or receivedResponse |
| 689 | // into trace, along with its length and other annotations. |
| 690 | //uint8_t *trace = (uint8_t *)BigBuf; |
| 691 | |
| 692 | // reset traceLen to 0 |
| 693 | iso14a_set_tracing(TRUE); |
| 694 | iso14a_clear_tracelen(); |
| 695 | iso14a_set_trigger(FALSE); |
| 696 | |
| 697 | // The DMA buffer, used to stream samples from the FPGA |
| 698 | int8_t *dmaBuf = ((int8_t *)BigBuf) + DMA_BUFFER_OFFSET; |
| 699 | int lastRxCounter; |
| 700 | int8_t *upTo; |
| 701 | int smpl; |
| 702 | int maxBehindBy = 0; |
| 703 | |
| 704 | // Count of samples received so far, so that we can include timing |
| 705 | // information in the trace buffer. |
| 706 | int samples = 0; |
| 707 | rsamples = 0; |
| 708 | |
| 709 | memset(trace, 0x44, RECV_CMD_OFFSET); |
| 710 | |
| 711 | // Set up the demodulator for tag -> reader responses. |
| 712 | Demod.output = receivedResponse; |
| 713 | Demod.len = 0; |
| 714 | Demod.state = DEMOD_UNSYNCD; |
| 715 | |
| 716 | // Setup for the DMA. |
| 717 | FpgaSetupSsc(); |
| 718 | upTo = dmaBuf; |
| 719 | lastRxCounter = DMA_BUFFER_SIZE; |
| 720 | FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); |
| 721 | |
| 722 | // And the reader -> tag commands |
| 723 | memset(&Uart, 0, sizeof(Uart)); |
| 724 | Uart.output = receivedCmd; |
| 725 | Uart.byteCntMax = 32; // was 100 (greg)//////////////////////////////////////////////////////////////////////// |
| 726 | Uart.state = STATE_UNSYNCD; |
| 727 | |
| 728 | // And put the FPGA in the appropriate mode |
| 729 | // Signal field is off with the appropriate LED |
| 730 | LED_D_OFF(); |
| 731 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER); |
| 732 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 733 | |
| 734 | int div = 0; |
| 735 | //int div2 = 0; |
| 736 | int decbyte = 0; |
| 737 | int decbyter = 0; |
| 738 | |
| 739 | // And now we loop, receiving samples. |
| 740 | for(;;) { |
| 741 | LED_A_ON(); |
| 742 | WDT_HIT(); |
| 743 | int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & |
| 744 | (DMA_BUFFER_SIZE-1); |
| 745 | if(behindBy > maxBehindBy) { |
| 746 | maxBehindBy = behindBy; |
| 747 | if(behindBy > 400) { |
| 748 | Dbprintf("blew circular buffer! behindBy=0x%x", behindBy); |
| 749 | goto done; |
| 750 | } |
| 751 | } |
| 752 | if(behindBy < 1) continue; |
| 753 | |
| 754 | LED_A_OFF(); |
| 755 | smpl = upTo[0]; |
| 756 | upTo++; |
| 757 | lastRxCounter -= 1; |
| 758 | if(upTo - dmaBuf > DMA_BUFFER_SIZE) { |
| 759 | upTo -= DMA_BUFFER_SIZE; |
| 760 | lastRxCounter += DMA_BUFFER_SIZE; |
| 761 | AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo; |
| 762 | AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE; |
| 763 | } |
| 764 | |
| 765 | //samples += 4; |
| 766 | samples += 1; |
| 767 | //div2++; |
| 768 | |
| 769 | //if(div2 > 3) { |
| 770 | //div2 = 0; |
| 771 | //decbyte ^= ((smpl & 0x01) << (3 - div)); |
| 772 | //decbyte ^= (((smpl & 0x01) | ((smpl & 0x02) >> 1)) << (3 - div)); // better already... |
| 773 | //decbyte ^= (((smpl & 0x01) | ((smpl & 0x02) >> 1) | ((smpl & 0x04) >> 2)) << (3 - div)); // even better... |
| 774 | if(smpl & 0xF) { |
| 775 | decbyte ^= (1 << (3 - div)); |
| 776 | } |
| 777 | //decbyte ^= (MajorityNibble[(smpl & 0x0F)] << (3 - div)); |
| 778 | |
| 779 | // FOR READER SIDE COMMUMICATION... |
| 780 | //decbyte ^= ((smpl & 0x10) << (3 - div)); |
| 781 | decbyter <<= 2; |
| 782 | decbyter ^= (smpl & 0x30); |
| 783 | |
| 784 | div++; |
| 785 | |
| 786 | if((div + 1) % 2 == 0) { |
| 787 | smpl = decbyter; |
| 788 | if(OutOfNDecoding((smpl & 0xF0) >> 4)) { |
| 789 | rsamples = samples - Uart.samples; |
| 790 | LED_C_ON(); |
| 791 | //if(triggered) { |
| 792 | trace[traceLen++] = ((rsamples >> 0) & 0xff); |
| 793 | trace[traceLen++] = ((rsamples >> 8) & 0xff); |
| 794 | trace[traceLen++] = ((rsamples >> 16) & 0xff); |
| 795 | trace[traceLen++] = ((rsamples >> 24) & 0xff); |
| 796 | trace[traceLen++] = ((Uart.parityBits >> 0) & 0xff); |
| 797 | trace[traceLen++] = ((Uart.parityBits >> 8) & 0xff); |
| 798 | trace[traceLen++] = ((Uart.parityBits >> 16) & 0xff); |
| 799 | trace[traceLen++] = ((Uart.parityBits >> 24) & 0xff); |
| 800 | trace[traceLen++] = Uart.byteCnt; |
| 801 | memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); |
| 802 | traceLen += Uart.byteCnt; |
| 803 | if(traceLen > TRACE_SIZE) break; |
| 804 | //} |
| 805 | /* And ready to receive another command. */ |
| 806 | Uart.state = STATE_UNSYNCD; |
| 807 | /* And also reset the demod code, which might have been */ |
| 808 | /* false-triggered by the commands from the reader. */ |
| 809 | Demod.state = DEMOD_UNSYNCD; |
| 810 | LED_B_OFF(); |
| 811 | Uart.byteCnt = 0; |
| 812 | } |
| 813 | decbyter = 0; |
| 814 | } |
| 815 | |
| 816 | if(div > 3) { |
| 817 | smpl = decbyte; |
| 818 | if(ManchesterDecoding(smpl & 0x0F)) { |
| 819 | rsamples = samples - Demod.samples; |
| 820 | LED_B_ON(); |
| 821 | |
| 822 | // timestamp, as a count of samples |
| 823 | trace[traceLen++] = ((rsamples >> 0) & 0xff); |
| 824 | trace[traceLen++] = ((rsamples >> 8) & 0xff); |
| 825 | trace[traceLen++] = ((rsamples >> 16) & 0xff); |
| 826 | trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff); |
| 827 | trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff); |
| 828 | trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff); |
| 829 | trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff); |
| 830 | trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff); |
| 831 | // length |
| 832 | trace[traceLen++] = Demod.len; |
| 833 | memcpy(trace+traceLen, receivedResponse, Demod.len); |
| 834 | traceLen += Demod.len; |
| 835 | if(traceLen > TRACE_SIZE) break; |
| 836 | |
| 837 | //triggered = TRUE; |
| 838 | |
| 839 | // And ready to receive another response. |
| 840 | memset(&Demod, 0, sizeof(Demod)); |
| 841 | Demod.output = receivedResponse; |
| 842 | Demod.state = DEMOD_UNSYNCD; |
| 843 | LED_C_OFF(); |
| 844 | } |
| 845 | |
| 846 | div = 0; |
| 847 | decbyte = 0x00; |
| 848 | } |
| 849 | //} |
| 850 | |
| 851 | if(BUTTON_PRESS()) { |
| 852 | DbpString("cancelled_a"); |
| 853 | goto done; |
| 854 | } |
| 855 | } |
| 856 | |
| 857 | DbpString("COMMAND FINISHED"); |
| 858 | |
| 859 | Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt); |
| 860 | Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]); |
| 861 | |
| 862 | done: |
| 863 | AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; |
| 864 | Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt); |
| 865 | Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]); |
| 866 | LED_A_OFF(); |
| 867 | LED_B_OFF(); |
| 868 | LED_C_OFF(); |
| 869 | LED_D_OFF(); |
| 870 | } |
| 871 | |
| 872 | void rotateCSN(uint8_t* originalCSN, uint8_t* rotatedCSN) { |
| 873 | int i; |
| 874 | for(i = 0; i < 8; i++) { |
| 875 | rotatedCSN[i] = (originalCSN[i] >> 3) | (originalCSN[(i+1)%8] << 5); |
| 876 | } |
| 877 | } |
| 878 | |
| 879 | //----------------------------------------------------------------------------- |
| 880 | // Wait for commands from reader |
| 881 | // Stop when button is pressed |
| 882 | // Or return TRUE when command is captured |
| 883 | //----------------------------------------------------------------------------- |
| 884 | static int GetIClassCommandFromReader(uint8_t *received, int *len, int maxLen) |
| 885 | { |
| 886 | // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen |
| 887 | // only, since we are receiving, not transmitting). |
| 888 | // Signal field is off with the appropriate LED |
| 889 | LED_D_OFF(); |
| 890 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN); |
| 891 | |
| 892 | // Now run a `software UART' on the stream of incoming samples. |
| 893 | Uart.output = received; |
| 894 | Uart.byteCntMax = maxLen; |
| 895 | Uart.state = STATE_UNSYNCD; |
| 896 | |
| 897 | for(;;) { |
| 898 | WDT_HIT(); |
| 899 | |
| 900 | if(BUTTON_PRESS()) return FALSE; |
| 901 | |
| 902 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 903 | AT91C_BASE_SSC->SSC_THR = 0x00; |
| 904 | } |
| 905 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 906 | uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; |
| 907 | /*if(OutOfNDecoding((b & 0xf0) >> 4)) { |
| 908 | *len = Uart.byteCnt; |
| 909 | return TRUE; |
| 910 | }*/ |
| 911 | if(OutOfNDecoding(b & 0x0f)) { |
| 912 | *len = Uart.byteCnt; |
| 913 | return TRUE; |
| 914 | } |
| 915 | } |
| 916 | } |
| 917 | } |
| 918 | |
| 919 | |
| 920 | //----------------------------------------------------------------------------- |
| 921 | // Prepare tag messages |
| 922 | //----------------------------------------------------------------------------- |
| 923 | static void CodeIClassTagAnswer(const uint8_t *cmd, int len) |
| 924 | { |
| 925 | int i; |
| 926 | |
| 927 | ToSendReset(); |
| 928 | |
| 929 | // Send SOF |
| 930 | ToSend[++ToSendMax] = 0x00; |
| 931 | ToSend[++ToSendMax] = 0x00; |
| 932 | ToSend[++ToSendMax] = 0x00; |
| 933 | ToSend[++ToSendMax] = 0xff; |
| 934 | ToSend[++ToSendMax] = 0xff; |
| 935 | ToSend[++ToSendMax] = 0xff; |
| 936 | ToSend[++ToSendMax] = 0x00; |
| 937 | ToSend[++ToSendMax] = 0xff; |
| 938 | |
| 939 | for(i = 0; i < len; i++) { |
| 940 | int j; |
| 941 | uint8_t b = cmd[i]; |
| 942 | |
| 943 | // Data bits |
| 944 | for(j = 0; j < 8; j++) { |
| 945 | if(b & 1) { |
| 946 | ToSend[++ToSendMax] = 0x00; |
| 947 | ToSend[++ToSendMax] = 0xff; |
| 948 | } else { |
| 949 | ToSend[++ToSendMax] = 0xff; |
| 950 | ToSend[++ToSendMax] = 0x00; |
| 951 | } |
| 952 | b >>= 1; |
| 953 | } |
| 954 | } |
| 955 | |
| 956 | // Send EOF |
| 957 | ToSend[++ToSendMax] = 0xff; |
| 958 | ToSend[++ToSendMax] = 0x00; |
| 959 | ToSend[++ToSendMax] = 0xff; |
| 960 | ToSend[++ToSendMax] = 0xff; |
| 961 | ToSend[++ToSendMax] = 0xff; |
| 962 | ToSend[++ToSendMax] = 0x00; |
| 963 | ToSend[++ToSendMax] = 0x00; |
| 964 | ToSend[++ToSendMax] = 0x00; |
| 965 | |
| 966 | // Convert from last byte pos to length |
| 967 | ToSendMax++; |
| 968 | } |
| 969 | |
| 970 | // Only SOF |
| 971 | static void CodeIClassTagSOF() |
| 972 | { |
| 973 | ToSendReset(); |
| 974 | |
| 975 | // Send SOF |
| 976 | ToSend[++ToSendMax] = 0x00; |
| 977 | ToSend[++ToSendMax] = 0x00; |
| 978 | ToSend[++ToSendMax] = 0x00; |
| 979 | ToSend[++ToSendMax] = 0xff; |
| 980 | ToSend[++ToSendMax] = 0xff; |
| 981 | ToSend[++ToSendMax] = 0xff; |
| 982 | ToSend[++ToSendMax] = 0x00; |
| 983 | ToSend[++ToSendMax] = 0xff; |
| 984 | |
| 985 | // Convert from last byte pos to length |
| 986 | ToSendMax++; |
| 987 | } |
| 988 | |
| 989 | //----------------------------------------------------------------------------- |
| 990 | // Simulate iClass Card |
| 991 | // Only CSN (Card Serial Number) |
| 992 | // |
| 993 | //----------------------------------------------------------------------------- |
| 994 | void SimulateIClass(uint8_t arg0, uint8_t *datain) |
| 995 | { |
| 996 | uint8_t simType = arg0; |
| 997 | |
| 998 | // Enable and clear the trace |
| 999 | tracing = TRUE; |
| 1000 | traceLen = 0; |
| 1001 | memset(trace, 0x44, TRACE_SIZE); |
| 1002 | |
| 1003 | // CSN followed by two CRC bytes |
| 1004 | uint8_t response2[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; |
| 1005 | uint8_t response3[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 }; |
| 1006 | |
| 1007 | // e-Purse |
| 1008 | uint8_t response4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; |
| 1009 | |
| 1010 | if(simType == 0) { |
| 1011 | // Use the CSN from commandline |
| 1012 | memcpy(response3, datain, 8); |
| 1013 | } |
| 1014 | |
| 1015 | // Construct anticollision-CSN |
| 1016 | rotateCSN(response3,response2); |
| 1017 | |
| 1018 | // Compute CRC on both CSNs |
| 1019 | ComputeCrc14443(CRC_ICLASS, response2, 8, &response2[8], &response2[9]); |
| 1020 | ComputeCrc14443(CRC_ICLASS, response3, 8, &response3[8], &response3[9]); |
| 1021 | |
| 1022 | // Reader 0a |
| 1023 | // Tag 0f |
| 1024 | // Reader 0c |
| 1025 | // Tag anticoll. CSN |
| 1026 | // Reader 81 anticoll. CSN |
| 1027 | // Tag CSN |
| 1028 | |
| 1029 | uint8_t *resp; |
| 1030 | int respLen; |
| 1031 | uint8_t* respdata = NULL; |
| 1032 | int respsize = 0; |
| 1033 | uint8_t sof = 0x0f; |
| 1034 | |
| 1035 | // Respond SOF -- takes 8 bytes |
| 1036 | uint8_t *resp1 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); |
| 1037 | int resp1Len; |
| 1038 | |
| 1039 | // Anticollision CSN (rotated CSN) |
| 1040 | // 176: Takes 16 bytes for SOF/EOF and 10 * 16 = 160 bytes (2 bytes/bit) |
| 1041 | uint8_t *resp2 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 10); |
| 1042 | int resp2Len; |
| 1043 | |
| 1044 | // CSN |
| 1045 | // 176: Takes 16 bytes for SOF/EOF and 10 * 16 = 160 bytes (2 bytes/bit) |
| 1046 | uint8_t *resp3 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 190); |
| 1047 | int resp3Len; |
| 1048 | |
| 1049 | // e-Purse |
| 1050 | // 144: Takes 16 bytes for SOF/EOF and 8 * 16 = 128 bytes (2 bytes/bit) |
| 1051 | uint8_t *resp4 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 370); |
| 1052 | int resp4Len; |
| 1053 | |
| 1054 | // + 1720.. |
| 1055 | uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET); |
| 1056 | memset(receivedCmd, 0x44, RECV_CMD_SIZE); |
| 1057 | int len; |
| 1058 | |
| 1059 | // Prepare card messages |
| 1060 | ToSendMax = 0; |
| 1061 | |
| 1062 | // First card answer: SOF |
| 1063 | CodeIClassTagSOF(); |
| 1064 | memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax; |
| 1065 | |
| 1066 | // Anticollision CSN |
| 1067 | CodeIClassTagAnswer(response2, sizeof(response2)); |
| 1068 | memcpy(resp2, ToSend, ToSendMax); resp2Len = ToSendMax; |
| 1069 | |
| 1070 | // CSN |
| 1071 | CodeIClassTagAnswer(response3, sizeof(response3)); |
| 1072 | memcpy(resp3, ToSend, ToSendMax); resp3Len = ToSendMax; |
| 1073 | |
| 1074 | // e-Purse |
| 1075 | CodeIClassTagAnswer(response4, sizeof(response4)); |
| 1076 | memcpy(resp4, ToSend, ToSendMax); resp4Len = ToSendMax; |
| 1077 | |
| 1078 | // We need to listen to the high-frequency, peak-detected path. |
| 1079 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 1080 | FpgaSetupSsc(); |
| 1081 | |
| 1082 | // To control where we are in the protocol |
| 1083 | int cmdsRecvd = 0; |
| 1084 | |
| 1085 | LED_A_ON(); |
| 1086 | for(;;) { |
| 1087 | LED_B_OFF(); |
| 1088 | if(!GetIClassCommandFromReader(receivedCmd, &len, 100)) { |
| 1089 | DbpString("button press"); |
| 1090 | break; |
| 1091 | } |
| 1092 | |
| 1093 | // Okay, look at the command now. |
| 1094 | if(receivedCmd[0] == 0x0a) { |
| 1095 | // Reader in anticollission phase |
| 1096 | resp = resp1; respLen = resp1Len; //order = 1; |
| 1097 | respdata = &sof; |
| 1098 | respsize = sizeof(sof); |
| 1099 | //resp = resp2; respLen = resp2Len; order = 2; |
| 1100 | //DbpString("Hello request from reader:"); |
| 1101 | } else if(receivedCmd[0] == 0x0c) { |
| 1102 | // Reader asks for anticollission CSN |
| 1103 | resp = resp2; respLen = resp2Len; //order = 2; |
| 1104 | respdata = response2; |
| 1105 | respsize = sizeof(response2); |
| 1106 | //DbpString("Reader requests anticollission CSN:"); |
| 1107 | } else if(receivedCmd[0] == 0x81) { |
| 1108 | // Reader selects anticollission CSN. |
| 1109 | // Tag sends the corresponding real CSN |
| 1110 | resp = resp3; respLen = resp3Len; //order = 3; |
| 1111 | respdata = response3; |
| 1112 | respsize = sizeof(response3); |
| 1113 | //DbpString("Reader selects anticollission CSN:"); |
| 1114 | } else if(receivedCmd[0] == 0x88) { |
| 1115 | // Read e-purse (88 02) |
| 1116 | resp = resp4; respLen = resp4Len; //order = 4; |
| 1117 | respdata = response4; |
| 1118 | respsize = sizeof(response4); |
| 1119 | LED_B_ON(); |
| 1120 | } else if(receivedCmd[0] == 0x05) { |
| 1121 | // Reader random and reader MAC!!! |
| 1122 | // Lets store this ;-) |
| 1123 | /* |
| 1124 | Dbprintf(" CSN: %02x %02x %02x %02x %02x %02x %02x %02x", |
| 1125 | response3[0], response3[1], response3[2], |
| 1126 | response3[3], response3[4], response3[5], |
| 1127 | response3[6], response3[7]); |
| 1128 | */ |
| 1129 | Dbprintf("READER AUTH (len=%02d): %02x %02x %02x %02x %02x %02x %02x %02x %02x", |
| 1130 | len, |
| 1131 | receivedCmd[0], receivedCmd[1], receivedCmd[2], |
| 1132 | receivedCmd[3], receivedCmd[4], receivedCmd[5], |
| 1133 | receivedCmd[6], receivedCmd[7], receivedCmd[8]); |
| 1134 | |
| 1135 | // Do not respond |
| 1136 | // We do not know what to answer, so lets keep quit |
| 1137 | resp = resp1; respLen = 0; //order = 5; |
| 1138 | respdata = NULL; |
| 1139 | respsize = 0; |
| 1140 | } else if(receivedCmd[0] == 0x00 && len == 1) { |
| 1141 | // Reader ends the session |
| 1142 | resp = resp1; respLen = 0; //order = 0; |
| 1143 | respdata = NULL; |
| 1144 | respsize = 0; |
| 1145 | } else { |
| 1146 | // Never seen this command before |
| 1147 | Dbprintf("Unknown command received from reader (len=%d): %x %x %x %x %x %x %x %x %x", |
| 1148 | len, |
| 1149 | receivedCmd[0], receivedCmd[1], receivedCmd[2], |
| 1150 | receivedCmd[3], receivedCmd[4], receivedCmd[5], |
| 1151 | receivedCmd[6], receivedCmd[7], receivedCmd[8]); |
| 1152 | // Do not respond |
| 1153 | resp = resp1; respLen = 0; //order = 0; |
| 1154 | respdata = NULL; |
| 1155 | respsize = 0; |
| 1156 | } |
| 1157 | |
| 1158 | if(cmdsRecvd > 999) { |
| 1159 | DbpString("1000 commands later..."); |
| 1160 | break; |
| 1161 | } |
| 1162 | else { |
| 1163 | cmdsRecvd++; |
| 1164 | } |
| 1165 | |
| 1166 | if(respLen > 0) { |
| 1167 | SendIClassAnswer(resp, respLen, 21); |
| 1168 | } |
| 1169 | |
| 1170 | if (tracing) { |
| 1171 | LogTrace(receivedCmd,len, 0, Uart.parityBits, TRUE); |
| 1172 | if (respdata != NULL) { |
| 1173 | LogTrace(respdata,respsize, 0, SwapBits(GetParity(respdata,respsize),respsize), FALSE); |
| 1174 | } |
| 1175 | if(traceLen > TRACE_SIZE) { |
| 1176 | DbpString("Trace full"); |
| 1177 | break; |
| 1178 | } |
| 1179 | } |
| 1180 | |
| 1181 | memset(receivedCmd, 0x44, RECV_CMD_SIZE); |
| 1182 | } |
| 1183 | |
| 1184 | Dbprintf("%x", cmdsRecvd); |
| 1185 | LED_A_OFF(); |
| 1186 | LED_B_OFF(); |
| 1187 | } |
| 1188 | |
| 1189 | static int SendIClassAnswer(uint8_t *resp, int respLen, int delay) |
| 1190 | { |
| 1191 | int i = 0, u = 0, d = 0; |
| 1192 | uint8_t b = 0; |
| 1193 | // return 0; |
| 1194 | // Modulate Manchester |
| 1195 | // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD424); |
| 1196 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD); |
| 1197 | AT91C_BASE_SSC->SSC_THR = 0x00; |
| 1198 | FpgaSetupSsc(); |
| 1199 | |
| 1200 | // send cycle |
| 1201 | for(;;) { |
| 1202 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 1203 | volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; |
| 1204 | (void)b; |
| 1205 | } |
| 1206 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 1207 | if(d < delay) { |
| 1208 | b = 0x00; |
| 1209 | d++; |
| 1210 | } |
| 1211 | else if(i >= respLen) { |
| 1212 | b = 0x00; |
| 1213 | u++; |
| 1214 | } else { |
| 1215 | b = resp[i]; |
| 1216 | u++; |
| 1217 | if(u > 1) { i++; u = 0; } |
| 1218 | } |
| 1219 | AT91C_BASE_SSC->SSC_THR = b; |
| 1220 | |
| 1221 | if(u > 4) break; |
| 1222 | } |
| 1223 | if(BUTTON_PRESS()) { |
| 1224 | break; |
| 1225 | } |
| 1226 | } |
| 1227 | |
| 1228 | return 0; |
| 1229 | } |
| 1230 | |
| 1231 | /// THE READER CODE |
| 1232 | |
| 1233 | //----------------------------------------------------------------------------- |
| 1234 | // Transmit the command (to the tag) that was placed in ToSend[]. |
| 1235 | //----------------------------------------------------------------------------- |
| 1236 | static void TransmitIClassCommand(const uint8_t *cmd, int len, int *samples, int *wait) |
| 1237 | { |
| 1238 | int c; |
| 1239 | |
| 1240 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); |
| 1241 | AT91C_BASE_SSC->SSC_THR = 0x00; |
| 1242 | FpgaSetupSsc(); |
| 1243 | |
| 1244 | if (wait) |
| 1245 | if(*wait < 10) |
| 1246 | *wait = 10; |
| 1247 | |
| 1248 | for(c = 0; c < *wait;) { |
| 1249 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 1250 | AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing! |
| 1251 | c++; |
| 1252 | } |
| 1253 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 1254 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; |
| 1255 | (void)r; |
| 1256 | } |
| 1257 | WDT_HIT(); |
| 1258 | } |
| 1259 | |
| 1260 | uint8_t sendbyte; |
| 1261 | bool firstpart = TRUE; |
| 1262 | c = 0; |
| 1263 | for(;;) { |
| 1264 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 1265 | |
| 1266 | // DOUBLE THE SAMPLES! |
| 1267 | if(firstpart) { |
| 1268 | sendbyte = (cmd[c] & 0xf0) | (cmd[c] >> 4); |
| 1269 | } |
| 1270 | else { |
| 1271 | sendbyte = (cmd[c] & 0x0f) | (cmd[c] << 4); |
| 1272 | c++; |
| 1273 | } |
| 1274 | if(sendbyte == 0xff) { |
| 1275 | sendbyte = 0xfe; |
| 1276 | } |
| 1277 | AT91C_BASE_SSC->SSC_THR = sendbyte; |
| 1278 | firstpart = !firstpart; |
| 1279 | |
| 1280 | if(c >= len) { |
| 1281 | break; |
| 1282 | } |
| 1283 | } |
| 1284 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 1285 | volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; |
| 1286 | (void)r; |
| 1287 | } |
| 1288 | WDT_HIT(); |
| 1289 | } |
| 1290 | if (samples) *samples = (c + *wait) << 3; |
| 1291 | } |
| 1292 | |
| 1293 | |
| 1294 | //----------------------------------------------------------------------------- |
| 1295 | // Prepare iClass reader command to send to FPGA |
| 1296 | //----------------------------------------------------------------------------- |
| 1297 | void CodeIClassCommand(const uint8_t * cmd, int len) |
| 1298 | { |
| 1299 | int i, j, k; |
| 1300 | uint8_t b; |
| 1301 | |
| 1302 | ToSendReset(); |
| 1303 | |
| 1304 | // Start of Communication: 1 out of 4 |
| 1305 | ToSend[++ToSendMax] = 0xf0; |
| 1306 | ToSend[++ToSendMax] = 0x00; |
| 1307 | ToSend[++ToSendMax] = 0x0f; |
| 1308 | ToSend[++ToSendMax] = 0x00; |
| 1309 | |
| 1310 | // Modulate the bytes |
| 1311 | for (i = 0; i < len; i++) { |
| 1312 | b = cmd[i]; |
| 1313 | for(j = 0; j < 4; j++) { |
| 1314 | for(k = 0; k < 4; k++) { |
| 1315 | if(k == (b & 3)) { |
| 1316 | ToSend[++ToSendMax] = 0x0f; |
| 1317 | } |
| 1318 | else { |
| 1319 | ToSend[++ToSendMax] = 0x00; |
| 1320 | } |
| 1321 | } |
| 1322 | b >>= 2; |
| 1323 | } |
| 1324 | } |
| 1325 | |
| 1326 | // End of Communication |
| 1327 | ToSend[++ToSendMax] = 0x00; |
| 1328 | ToSend[++ToSendMax] = 0x00; |
| 1329 | ToSend[++ToSendMax] = 0xf0; |
| 1330 | ToSend[++ToSendMax] = 0x00; |
| 1331 | |
| 1332 | // Convert from last character reference to length |
| 1333 | ToSendMax++; |
| 1334 | } |
| 1335 | |
| 1336 | void ReaderTransmitIClass(uint8_t* frame, int len) |
| 1337 | { |
| 1338 | int wait = 0; |
| 1339 | int samples = 0; |
| 1340 | int par = 0; |
| 1341 | |
| 1342 | // This is tied to other size changes |
| 1343 | // uint8_t* frame_addr = ((uint8_t*)BigBuf) + 2024; |
| 1344 | CodeIClassCommand(frame,len); |
| 1345 | |
| 1346 | // Select the card |
| 1347 | TransmitIClassCommand(ToSend, ToSendMax, &samples, &wait); |
| 1348 | if(trigger) |
| 1349 | LED_A_ON(); |
| 1350 | |
| 1351 | // Store reader command in buffer |
| 1352 | if (tracing) LogTrace(frame,len,0,par,TRUE); |
| 1353 | } |
| 1354 | |
| 1355 | //----------------------------------------------------------------------------- |
| 1356 | // Wait a certain time for tag response |
| 1357 | // If a response is captured return TRUE |
| 1358 | // If it takes too long return FALSE |
| 1359 | //----------------------------------------------------------------------------- |
| 1360 | static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer |
| 1361 | { |
| 1362 | // buffer needs to be 512 bytes |
| 1363 | int c; |
| 1364 | |
| 1365 | // Set FPGA mode to "reader listen mode", no modulation (listen |
| 1366 | // only, since we are receiving, not transmitting). |
| 1367 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN); |
| 1368 | |
| 1369 | // Now get the answer from the card |
| 1370 | Demod.output = receivedResponse; |
| 1371 | Demod.len = 0; |
| 1372 | Demod.state = DEMOD_UNSYNCD; |
| 1373 | |
| 1374 | uint8_t b; |
| 1375 | if (elapsed) *elapsed = 0; |
| 1376 | |
| 1377 | bool skip = FALSE; |
| 1378 | |
| 1379 | c = 0; |
| 1380 | for(;;) { |
| 1381 | WDT_HIT(); |
| 1382 | |
| 1383 | if(BUTTON_PRESS()) return FALSE; |
| 1384 | |
| 1385 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { |
| 1386 | AT91C_BASE_SSC->SSC_THR = 0x00; // To make use of exact timing of next command from reader!! |
| 1387 | if (elapsed) (*elapsed)++; |
| 1388 | } |
| 1389 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { |
| 1390 | if(c < timeout) { c++; } else { return FALSE; } |
| 1391 | b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; |
| 1392 | skip = !skip; |
| 1393 | if(skip) continue; |
| 1394 | /*if(ManchesterDecoding((b>>4) & 0xf)) { |
| 1395 | *samples = ((c - 1) << 3) + 4; |
| 1396 | return TRUE; |
| 1397 | }*/ |
| 1398 | if(ManchesterDecoding(b & 0x0f)) { |
| 1399 | *samples = c << 3; |
| 1400 | return TRUE; |
| 1401 | } |
| 1402 | } |
| 1403 | } |
| 1404 | } |
| 1405 | |
| 1406 | int ReaderReceiveIClass(uint8_t* receivedAnswer) |
| 1407 | { |
| 1408 | int samples = 0; |
| 1409 | if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return FALSE; |
| 1410 | if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE); |
| 1411 | if(samples == 0) return FALSE; |
| 1412 | return Demod.len; |
| 1413 | } |
| 1414 | |
| 1415 | // Reader iClass Anticollission |
| 1416 | void ReaderIClass(uint8_t arg0) { |
| 1417 | uint8_t act_all[] = { 0x0a }; |
| 1418 | uint8_t identify[] = { 0x0c }; |
| 1419 | uint8_t select[] = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; |
| 1420 | |
| 1421 | uint8_t* resp = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes |
| 1422 | |
| 1423 | // Reset trace buffer |
| 1424 | memset(trace, 0x44, RECV_CMD_OFFSET); |
| 1425 | traceLen = 0; |
| 1426 | |
| 1427 | // Setup SSC |
| 1428 | FpgaSetupSsc(); |
| 1429 | // Start from off (no field generated) |
| 1430 | // Signal field is off with the appropriate LED |
| 1431 | LED_D_OFF(); |
| 1432 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); |
| 1433 | SpinDelay(200); |
| 1434 | |
| 1435 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
| 1436 | |
| 1437 | // Now give it time to spin up. |
| 1438 | // Signal field is on with the appropriate LED |
| 1439 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); |
| 1440 | SpinDelay(200); |
| 1441 | |
| 1442 | LED_A_ON(); |
| 1443 | |
| 1444 | for(;;) { |
| 1445 | |
| 1446 | if(traceLen > TRACE_SIZE) { |
| 1447 | DbpString("Trace full"); |
| 1448 | break; |
| 1449 | } |
| 1450 | |
| 1451 | if (BUTTON_PRESS()) break; |
| 1452 | |
| 1453 | // Send act_all |
| 1454 | ReaderTransmitIClass(act_all, 1); |
| 1455 | // Card present? |
| 1456 | if(ReaderReceiveIClass(resp)) { |
| 1457 | ReaderTransmitIClass(identify, 1); |
| 1458 | if(ReaderReceiveIClass(resp) == 10) { |
| 1459 | // Select card |
| 1460 | memcpy(&select[1],resp,8); |
| 1461 | ReaderTransmitIClass(select, sizeof(select)); |
| 1462 | |
| 1463 | if(ReaderReceiveIClass(resp) == 10) { |
| 1464 | Dbprintf(" Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x", |
| 1465 | resp[0], resp[1], resp[2], |
| 1466 | resp[3], resp[4], resp[5], |
| 1467 | resp[6], resp[7]); |
| 1468 | } |
| 1469 | // Card selected, whats next... ;-) |
| 1470 | } |
| 1471 | } |
| 1472 | WDT_HIT(); |
| 1473 | } |
| 1474 | |
| 1475 | LED_A_OFF(); |
| 1476 | } |
| 1477 | |
| 1478 | |