]>
Commit | Line | Data |
---|---|---|
1 | //-----------------------------------------------------------------------------\r | |
2 | // Routines to support ISO 14443. This includes both the reader software and\r | |
3 | // the `fake tag' modes. At the moment only the Type B modulation is\r | |
4 | // supported.\r | |
5 | // Jonathan Westhues, split Nov 2006\r | |
6 | //-----------------------------------------------------------------------------\r | |
7 | #include <proxmark3.h>\r | |
8 | #include "apps.h"\r | |
9 | #include "../common/iso14443_crc.c"\r | |
10 | \r | |
11 | \r | |
12 | //static void GetSamplesFor14443(BOOL weTx, int n);\r | |
13 | \r | |
14 | #define DMA_BUFFER_SIZE 256\r | |
15 | \r | |
16 | //=============================================================================\r | |
17 | // An ISO 14443 Type B tag. We listen for commands from the reader, using\r | |
18 | // a UART kind of thing that's implemented in software. When we get a\r | |
19 | // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.\r | |
20 | // If it's good, then we can do something appropriate with it, and send\r | |
21 | // a response.\r | |
22 | //=============================================================================\r | |
23 | \r | |
24 | //-----------------------------------------------------------------------------\r | |
25 | // Code up a string of octets at layer 2 (including CRC, we don't generate\r | |
26 | // that here) so that they can be transmitted to the reader. Doesn't transmit\r | |
27 | // them yet, just leaves them ready to send in ToSend[].\r | |
28 | //-----------------------------------------------------------------------------\r | |
29 | static void CodeIso14443bAsTag(const BYTE *cmd, int len)\r | |
30 | {\r | |
31 | int i;\r | |
32 | \r | |
33 | ToSendReset();\r | |
34 | \r | |
35 | // Transmit a burst of ones, as the initial thing that lets the\r | |
36 | // reader get phase sync. This (TR1) must be > 80/fs, per spec,\r | |
37 | // but tag that I've tried (a Paypass) exceeds that by a fair bit,\r | |
38 | // so I will too.\r | |
39 | for(i = 0; i < 20; i++) {\r | |
40 | ToSendStuffBit(1);\r | |
41 | ToSendStuffBit(1);\r | |
42 | ToSendStuffBit(1);\r | |
43 | ToSendStuffBit(1);\r | |
44 | }\r | |
45 | \r | |
46 | // Send SOF.\r | |
47 | for(i = 0; i < 10; i++) {\r | |
48 | ToSendStuffBit(0);\r | |
49 | ToSendStuffBit(0);\r | |
50 | ToSendStuffBit(0);\r | |
51 | ToSendStuffBit(0);\r | |
52 | }\r | |
53 | for(i = 0; i < 2; i++) {\r | |
54 | ToSendStuffBit(1);\r | |
55 | ToSendStuffBit(1);\r | |
56 | ToSendStuffBit(1);\r | |
57 | ToSendStuffBit(1);\r | |
58 | }\r | |
59 | \r | |
60 | for(i = 0; i < len; i++) {\r | |
61 | int j;\r | |
62 | BYTE b = cmd[i];\r | |
63 | \r | |
64 | // Start bit\r | |
65 | ToSendStuffBit(0);\r | |
66 | ToSendStuffBit(0);\r | |
67 | ToSendStuffBit(0);\r | |
68 | ToSendStuffBit(0);\r | |
69 | \r | |
70 | // Data bits\r | |
71 | for(j = 0; j < 8; j++) {\r | |
72 | if(b & 1) {\r | |
73 | ToSendStuffBit(1);\r | |
74 | ToSendStuffBit(1);\r | |
75 | ToSendStuffBit(1);\r | |
76 | ToSendStuffBit(1);\r | |
77 | } else {\r | |
78 | ToSendStuffBit(0);\r | |
79 | ToSendStuffBit(0);\r | |
80 | ToSendStuffBit(0);\r | |
81 | ToSendStuffBit(0);\r | |
82 | }\r | |
83 | b >>= 1;\r | |
84 | }\r | |
85 | \r | |
86 | // Stop bit\r | |
87 | ToSendStuffBit(1);\r | |
88 | ToSendStuffBit(1);\r | |
89 | ToSendStuffBit(1);\r | |
90 | ToSendStuffBit(1);\r | |
91 | }\r | |
92 | \r | |
93 | // Send SOF.\r | |
94 | for(i = 0; i < 10; i++) {\r | |
95 | ToSendStuffBit(0);\r | |
96 | ToSendStuffBit(0);\r | |
97 | ToSendStuffBit(0);\r | |
98 | ToSendStuffBit(0);\r | |
99 | }\r | |
100 | for(i = 0; i < 10; i++) {\r | |
101 | ToSendStuffBit(1);\r | |
102 | ToSendStuffBit(1);\r | |
103 | ToSendStuffBit(1);\r | |
104 | ToSendStuffBit(1);\r | |
105 | }\r | |
106 | \r | |
107 | // Convert from last byte pos to length\r | |
108 | ToSendMax++;\r | |
109 | \r | |
110 | // Add a few more for slop\r | |
111 | ToSendMax += 2;\r | |
112 | }\r | |
113 | \r | |
114 | //-----------------------------------------------------------------------------\r | |
115 | // The software UART that receives commands from the reader, and its state\r | |
116 | // variables.\r | |
117 | //-----------------------------------------------------------------------------\r | |
118 | static struct {\r | |
119 | enum {\r | |
120 | STATE_UNSYNCD,\r | |
121 | STATE_GOT_FALLING_EDGE_OF_SOF,\r | |
122 | STATE_AWAITING_START_BIT,\r | |
123 | STATE_RECEIVING_DATA,\r | |
124 | STATE_ERROR_WAIT\r | |
125 | } state;\r | |
126 | WORD shiftReg;\r | |
127 | int bitCnt;\r | |
128 | int byteCnt;\r | |
129 | int byteCntMax;\r | |
130 | int posCnt;\r | |
131 | BYTE *output;\r | |
132 | } Uart;\r | |
133 | \r | |
134 | /* Receive & handle a bit coming from the reader.\r | |
135 | *\r | |
136 | * LED handling:\r | |
137 | * LED A -> ON once we have received the SOF and are expecting the rest.\r | |
138 | * LED A -> OFF once we have received EOF or are in error state or unsynced\r | |
139 | *\r | |
140 | * Returns: true if we received a EOF\r | |
141 | * false if we are still waiting for some more\r | |
142 | */\r | |
143 | static BOOL Handle14443UartBit(int bit)\r | |
144 | {\r | |
145 | switch(Uart.state) {\r | |
146 | case STATE_UNSYNCD:\r | |
147 | LED_A_OFF();\r | |
148 | if(!bit) {\r | |
149 | // we went low, so this could be the beginning\r | |
150 | // of an SOF\r | |
151 | Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;\r | |
152 | Uart.posCnt = 0;\r | |
153 | Uart.bitCnt = 0;\r | |
154 | }\r | |
155 | break;\r | |
156 | \r | |
157 | case STATE_GOT_FALLING_EDGE_OF_SOF:\r | |
158 | Uart.posCnt++;\r | |
159 | if(Uart.posCnt == 2) {\r | |
160 | if(bit) {\r | |
161 | if(Uart.bitCnt >= 10) {\r | |
162 | // we've seen enough consecutive\r | |
163 | // zeros that it's a valid SOF\r | |
164 | Uart.posCnt = 0;\r | |
165 | Uart.byteCnt = 0;\r | |
166 | Uart.state = STATE_AWAITING_START_BIT;\r | |
167 | LED_A_ON(); // Indicate we got a valid SOF\r | |
168 | } else {\r | |
169 | // didn't stay down long enough\r | |
170 | // before going high, error\r | |
171 | Uart.state = STATE_ERROR_WAIT;\r | |
172 | }\r | |
173 | } else {\r | |
174 | // do nothing, keep waiting\r | |
175 | }\r | |
176 | Uart.bitCnt++;\r | |
177 | }\r | |
178 | if(Uart.posCnt >= 4) Uart.posCnt = 0;\r | |
179 | if(Uart.bitCnt > 14) {\r | |
180 | // Give up if we see too many zeros without\r | |
181 | // a one, too.\r | |
182 | Uart.state = STATE_ERROR_WAIT;\r | |
183 | }\r | |
184 | break;\r | |
185 | \r | |
186 | case STATE_AWAITING_START_BIT:\r | |
187 | Uart.posCnt++;\r | |
188 | if(bit) {\r | |
189 | if(Uart.posCnt > 25) {\r | |
190 | // stayed high for too long between\r | |
191 | // characters, error\r | |
192 | Uart.state = STATE_ERROR_WAIT;\r | |
193 | }\r | |
194 | } else {\r | |
195 | // falling edge, this starts the data byte\r | |
196 | Uart.posCnt = 0;\r | |
197 | Uart.bitCnt = 0;\r | |
198 | Uart.shiftReg = 0;\r | |
199 | Uart.state = STATE_RECEIVING_DATA;\r | |
200 | LED_A_ON(); // Indicate we're receiving\r | |
201 | }\r | |
202 | break;\r | |
203 | \r | |
204 | case STATE_RECEIVING_DATA:\r | |
205 | Uart.posCnt++;\r | |
206 | if(Uart.posCnt == 2) {\r | |
207 | // time to sample a bit\r | |
208 | Uart.shiftReg >>= 1;\r | |
209 | if(bit) {\r | |
210 | Uart.shiftReg |= 0x200;\r | |
211 | }\r | |
212 | Uart.bitCnt++;\r | |
213 | }\r | |
214 | if(Uart.posCnt >= 4) {\r | |
215 | Uart.posCnt = 0;\r | |
216 | }\r | |
217 | if(Uart.bitCnt == 10) {\r | |
218 | if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))\r | |
219 | {\r | |
220 | // this is a data byte, with correct\r | |
221 | // start and stop bits\r | |
222 | Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;\r | |
223 | Uart.byteCnt++;\r | |
224 | \r | |
225 | if(Uart.byteCnt >= Uart.byteCntMax) {\r | |
226 | // Buffer overflowed, give up\r | |
227 | Uart.posCnt = 0;\r | |
228 | Uart.state = STATE_ERROR_WAIT;\r | |
229 | } else {\r | |
230 | // so get the next byte now\r | |
231 | Uart.posCnt = 0;\r | |
232 | Uart.state = STATE_AWAITING_START_BIT;\r | |
233 | }\r | |
234 | } else if(Uart.shiftReg == 0x000) {\r | |
235 | // this is an EOF byte\r | |
236 | LED_A_OFF(); // Finished receiving\r | |
237 | return TRUE;\r | |
238 | } else {\r | |
239 | // this is an error\r | |
240 | Uart.posCnt = 0;\r | |
241 | Uart.state = STATE_ERROR_WAIT;\r | |
242 | }\r | |
243 | }\r | |
244 | break;\r | |
245 | \r | |
246 | case STATE_ERROR_WAIT:\r | |
247 | // We're all screwed up, so wait a little while\r | |
248 | // for whatever went wrong to finish, and then\r | |
249 | // start over.\r | |
250 | Uart.posCnt++;\r | |
251 | if(Uart.posCnt > 10) {\r | |
252 | Uart.state = STATE_UNSYNCD;\r | |
253 | }\r | |
254 | break;\r | |
255 | \r | |
256 | default:\r | |
257 | Uart.state = STATE_UNSYNCD;\r | |
258 | break;\r | |
259 | }\r | |
260 | \r | |
261 | if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error\r | |
262 | \r | |
263 | return FALSE;\r | |
264 | }\r | |
265 | \r | |
266 | //-----------------------------------------------------------------------------\r | |
267 | // Receive a command (from the reader to us, where we are the simulated tag),\r | |
268 | // and store it in the given buffer, up to the given maximum length. Keeps\r | |
269 | // spinning, waiting for a well-framed command, until either we get one\r | |
270 | // (returns TRUE) or someone presses the pushbutton on the board (FALSE).\r | |
271 | //\r | |
272 | // Assume that we're called with the SSC (to the FPGA) and ADC path set\r | |
273 | // correctly.\r | |
274 | //-----------------------------------------------------------------------------\r | |
275 | static BOOL GetIso14443CommandFromReader(BYTE *received, int *len, int maxLen)\r | |
276 | {\r | |
277 | BYTE mask;\r | |
278 | int i, bit;\r | |
279 | \r | |
280 | // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen\r | |
281 | // only, since we are receiving, not transmitting).\r | |
282 | // Signal field is off with the appropriate LED\r | |
283 | LED_D_OFF();\r | |
284 | FpgaWriteConfWord(\r | |
285 | FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);\r | |
286 | \r | |
287 | \r | |
288 | // Now run a `software UART' on the stream of incoming samples.\r | |
289 | Uart.output = received;\r | |
290 | Uart.byteCntMax = maxLen;\r | |
291 | Uart.state = STATE_UNSYNCD;\r | |
292 | \r | |
293 | for(;;) {\r | |
294 | WDT_HIT();\r | |
295 | \r | |
296 | if(BUTTON_PRESS()) return FALSE;\r | |
297 | \r | |
298 | if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r | |
299 | SSC_TRANSMIT_HOLDING = 0x00;\r | |
300 | }\r | |
301 | if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r | |
302 | BYTE b = (BYTE)SSC_RECEIVE_HOLDING;\r | |
303 | \r | |
304 | mask = 0x80;\r | |
305 | for(i = 0; i < 8; i++, mask >>= 1) {\r | |
306 | bit = (b & mask);\r | |
307 | if(Handle14443UartBit(bit)) {\r | |
308 | *len = Uart.byteCnt;\r | |
309 | return TRUE;\r | |
310 | }\r | |
311 | }\r | |
312 | }\r | |
313 | }\r | |
314 | }\r | |
315 | \r | |
316 | //-----------------------------------------------------------------------------\r | |
317 | // Main loop of simulated tag: receive commands from reader, decide what\r | |
318 | // response to send, and send it.\r | |
319 | //-----------------------------------------------------------------------------\r | |
320 | void SimulateIso14443Tag(void)\r | |
321 | {\r | |
322 | static const BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };\r | |
323 | static const BYTE response1[] = {\r | |
324 | 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,\r | |
325 | 0x00, 0x21, 0x85, 0x5e, 0xd7\r | |
326 | };\r | |
327 | \r | |
328 | BYTE *resp;\r | |
329 | int respLen;\r | |
330 | \r | |
331 | BYTE *resp1 = (((BYTE *)BigBuf) + 800);\r | |
332 | int resp1Len;\r | |
333 | \r | |
334 | BYTE *receivedCmd = (BYTE *)BigBuf;\r | |
335 | int len;\r | |
336 | \r | |
337 | int i;\r | |
338 | \r | |
339 | int cmdsRecvd = 0;\r | |
340 | \r | |
341 | memset(receivedCmd, 0x44, 400);\r | |
342 | \r | |
343 | CodeIso14443bAsTag(response1, sizeof(response1));\r | |
344 | memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;\r | |
345 | \r | |
346 | // We need to listen to the high-frequency, peak-detected path.\r | |
347 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r | |
348 | FpgaSetupSsc();\r | |
349 | \r | |
350 | cmdsRecvd = 0;\r | |
351 | \r | |
352 | for(;;) {\r | |
353 | BYTE b1, b2;\r | |
354 | \r | |
355 | if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {\r | |
356 | DbpIntegers(cmdsRecvd, 0, 0);\r | |
357 | DbpString("button press");\r | |
358 | break;\r | |
359 | }\r | |
360 | \r | |
361 | // Good, look at the command now.\r | |
362 | \r | |
363 | if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {\r | |
364 | resp = resp1; respLen = resp1Len;\r | |
365 | } else {\r | |
366 | DbpString("new cmd from reader:");\r | |
367 | DbpIntegers(len, 0x1234, cmdsRecvd);\r | |
368 | // And print whether the CRC fails, just for good measure\r | |
369 | ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);\r | |
370 | if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {\r | |
371 | // Not so good, try again.\r | |
372 | DbpString("+++CRC fail");\r | |
373 | } else {\r | |
374 | DbpString("CRC passes");\r | |
375 | }\r | |
376 | break;\r | |
377 | }\r | |
378 | \r | |
379 | memset(receivedCmd, 0x44, 32);\r | |
380 | \r | |
381 | cmdsRecvd++;\r | |
382 | \r | |
383 | if(cmdsRecvd > 0x30) {\r | |
384 | DbpString("many commands later...");\r | |
385 | break;\r | |
386 | }\r | |
387 | \r | |
388 | if(respLen <= 0) continue;\r | |
389 | \r | |
390 | // Modulate BPSK\r | |
391 | // Signal field is off with the appropriate LED\r | |
392 | LED_D_OFF();\r | |
393 | FpgaWriteConfWord(\r | |
394 | FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);\r | |
395 | SSC_TRANSMIT_HOLDING = 0xff;\r | |
396 | FpgaSetupSsc();\r | |
397 | \r | |
398 | // Transmit the response.\r | |
399 | i = 0;\r | |
400 | for(;;) {\r | |
401 | if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r | |
402 | BYTE b = resp[i];\r | |
403 | \r | |
404 | SSC_TRANSMIT_HOLDING = b;\r | |
405 | \r | |
406 | i++;\r | |
407 | if(i > respLen) {\r | |
408 | break;\r | |
409 | }\r | |
410 | }\r | |
411 | if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r | |
412 | volatile BYTE b = (BYTE)SSC_RECEIVE_HOLDING;\r | |
413 | (void)b;\r | |
414 | }\r | |
415 | }\r | |
416 | }\r | |
417 | }\r | |
418 | \r | |
419 | //=============================================================================\r | |
420 | // An ISO 14443 Type B reader. We take layer two commands, code them\r | |
421 | // appropriately, and then send them to the tag. We then listen for the\r | |
422 | // tag's response, which we leave in the buffer to be demodulated on the\r | |
423 | // PC side.\r | |
424 | //=============================================================================\r | |
425 | \r | |
426 | static struct {\r | |
427 | enum {\r | |
428 | DEMOD_UNSYNCD,\r | |
429 | DEMOD_PHASE_REF_TRAINING,\r | |
430 | DEMOD_AWAITING_FALLING_EDGE_OF_SOF,\r | |
431 | DEMOD_GOT_FALLING_EDGE_OF_SOF,\r | |
432 | DEMOD_AWAITING_START_BIT,\r | |
433 | DEMOD_RECEIVING_DATA,\r | |
434 | DEMOD_ERROR_WAIT\r | |
435 | } state;\r | |
436 | int bitCount;\r | |
437 | int posCount;\r | |
438 | int thisBit;\r | |
439 | int metric;\r | |
440 | int metricN;\r | |
441 | WORD shiftReg;\r | |
442 | BYTE *output;\r | |
443 | int len;\r | |
444 | int sumI;\r | |
445 | int sumQ;\r | |
446 | } Demod;\r | |
447 | \r | |
448 | /*\r | |
449 | * Handles reception of a bit from the tag\r | |
450 | *\r | |
451 | * LED handling:\r | |
452 | * LED C -> ON once we have received the SOF and are expecting the rest.\r | |
453 | * LED C -> OFF once we have received EOF or are unsynced\r | |
454 | *\r | |
455 | * Returns: true if we received a EOF\r | |
456 | * false if we are still waiting for some more\r | |
457 | * | |
458 | */\r | |
459 | static BOOL Handle14443SamplesDemod(int ci, int cq)\r | |
460 | {\r | |
461 | int v;\r | |
462 | \r | |
463 | // The soft decision on the bit uses an estimate of just the\r | |
464 | // quadrant of the reference angle, not the exact angle.\r | |
465 | #define MAKE_SOFT_DECISION() { \\r | |
466 | if(Demod.sumI > 0) { \\r | |
467 | v = ci; \\r | |
468 | } else { \\r | |
469 | v = -ci; \\r | |
470 | } \\r | |
471 | if(Demod.sumQ > 0) { \\r | |
472 | v += cq; \\r | |
473 | } else { \\r | |
474 | v -= cq; \\r | |
475 | } \\r | |
476 | }\r | |
477 | \r | |
478 | switch(Demod.state) {\r | |
479 | case DEMOD_UNSYNCD:\r | |
480 | v = ci;\r | |
481 | if(v < 0) v = -v;\r | |
482 | if(cq > 0) {\r | |
483 | v += cq;\r | |
484 | } else {\r | |
485 | v -= cq;\r | |
486 | }\r | |
487 | if(v > 40) {\r | |
488 | Demod.posCount = 0;\r | |
489 | Demod.state = DEMOD_PHASE_REF_TRAINING;\r | |
490 | Demod.sumI = 0;\r | |
491 | Demod.sumQ = 0;\r | |
492 | }\r | |
493 | break;\r | |
494 | \r | |
495 | case DEMOD_PHASE_REF_TRAINING:\r | |
496 | if(Demod.posCount < 8) {\r | |
497 | Demod.sumI += ci;\r | |
498 | Demod.sumQ += cq;\r | |
499 | } else if(Demod.posCount > 100) {\r | |
500 | // error, waited too long\r | |
501 | Demod.state = DEMOD_UNSYNCD;\r | |
502 | } else {\r | |
503 | MAKE_SOFT_DECISION();\r | |
504 | if(v < 0) {\r | |
505 | Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;\r | |
506 | Demod.posCount = 0;\r | |
507 | }\r | |
508 | }\r | |
509 | Demod.posCount++;\r | |
510 | break;\r | |
511 | \r | |
512 | case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:\r | |
513 | MAKE_SOFT_DECISION();\r | |
514 | if(v < 0) {\r | |
515 | Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;\r | |
516 | Demod.posCount = 0;\r | |
517 | } else {\r | |
518 | if(Demod.posCount > 100) {\r | |
519 | Demod.state = DEMOD_UNSYNCD;\r | |
520 | }\r | |
521 | }\r | |
522 | Demod.posCount++;\r | |
523 | break;\r | |
524 | \r | |
525 | case DEMOD_GOT_FALLING_EDGE_OF_SOF:\r | |
526 | MAKE_SOFT_DECISION();\r | |
527 | if(v > 0) {\r | |
528 | if(Demod.posCount < 12) {\r | |
529 | Demod.state = DEMOD_UNSYNCD;\r | |
530 | } else {\r | |
531 | LED_C_ON(); // Got SOF\r | |
532 | Demod.state = DEMOD_AWAITING_START_BIT;\r | |
533 | Demod.posCount = 0;\r | |
534 | Demod.len = 0;\r | |
535 | Demod.metricN = 0;\r | |
536 | Demod.metric = 0;\r | |
537 | }\r | |
538 | } else {\r | |
539 | if(Demod.posCount > 100) {\r | |
540 | Demod.state = DEMOD_UNSYNCD;\r | |
541 | }\r | |
542 | }\r | |
543 | Demod.posCount++;\r | |
544 | break;\r | |
545 | \r | |
546 | case DEMOD_AWAITING_START_BIT:\r | |
547 | MAKE_SOFT_DECISION();\r | |
548 | if(v > 0) {\r | |
549 | if(Demod.posCount > 10) {\r | |
550 | Demod.state = DEMOD_UNSYNCD;\r | |
551 | }\r | |
552 | } else {\r | |
553 | Demod.bitCount = 0;\r | |
554 | Demod.posCount = 1;\r | |
555 | Demod.thisBit = v;\r | |
556 | Demod.shiftReg = 0;\r | |
557 | Demod.state = DEMOD_RECEIVING_DATA;\r | |
558 | }\r | |
559 | break;\r | |
560 | \r | |
561 | case DEMOD_RECEIVING_DATA:\r | |
562 | MAKE_SOFT_DECISION();\r | |
563 | if(Demod.posCount == 0) {\r | |
564 | Demod.thisBit = v;\r | |
565 | Demod.posCount = 1;\r | |
566 | } else {\r | |
567 | Demod.thisBit += v;\r | |
568 | \r | |
569 | if(Demod.thisBit > 0) {\r | |
570 | Demod.metric += Demod.thisBit;\r | |
571 | } else {\r | |
572 | Demod.metric -= Demod.thisBit;\r | |
573 | }\r | |
574 | (Demod.metricN)++;\r | |
575 | \r | |
576 | Demod.shiftReg >>= 1;\r | |
577 | if(Demod.thisBit > 0) {\r | |
578 | Demod.shiftReg |= 0x200;\r | |
579 | }\r | |
580 | \r | |
581 | Demod.bitCount++;\r | |
582 | if(Demod.bitCount == 10) {\r | |
583 | WORD s = Demod.shiftReg;\r | |
584 | if((s & 0x200) && !(s & 0x001)) {\r | |
585 | BYTE b = (s >> 1);\r | |
586 | Demod.output[Demod.len] = b;\r | |
587 | Demod.len++;\r | |
588 | Demod.state = DEMOD_AWAITING_START_BIT;\r | |
589 | } else if(s == 0x000) {\r | |
590 | // This is EOF\r | |
591 | LED_C_OFF();\r | |
592 | return TRUE;\r | |
593 | Demod.state = DEMOD_UNSYNCD;\r | |
594 | } else {\r | |
595 | Demod.state = DEMOD_UNSYNCD;\r | |
596 | }\r | |
597 | }\r | |
598 | Demod.posCount = 0;\r | |
599 | }\r | |
600 | break;\r | |
601 | \r | |
602 | default:\r | |
603 | Demod.state = DEMOD_UNSYNCD;\r | |
604 | break;\r | |
605 | }\r | |
606 | \r | |
607 | if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...\r | |
608 | return FALSE;\r | |
609 | }\r | |
610 | \r | |
611 | /*\r | |
612 | * Demodulate the samples we received from the tag\r | |
613 | * weTx: set to 'TRUE' if we behave like a reader\r | |
614 | * set to 'FALSE' if we behave like a snooper\r | |
615 | * quiet: set to 'TRUE' to disable debug output | |
616 | */\r | |
617 | static void GetSamplesFor14443Demod(BOOL weTx, int n, BOOL quiet)\r | |
618 | {\r | |
619 | int max = 0;\r | |
620 | BOOL gotFrame = FALSE;\r | |
621 | \r | |
622 | //# define DMA_BUFFER_SIZE 8\r | |
623 | SBYTE *dmaBuf;\r | |
624 | \r | |
625 | int lastRxCounter;\r | |
626 | SBYTE *upTo;\r | |
627 | \r | |
628 | int ci, cq;\r | |
629 | \r | |
630 | int samples = 0;\r | |
631 | \r | |
632 | // Clear out the state of the "UART" that receives from the tag.\r | |
633 | memset(BigBuf, 0x44, 400);\r | |
634 | Demod.output = (BYTE *)BigBuf;\r | |
635 | Demod.len = 0;\r | |
636 | Demod.state = DEMOD_UNSYNCD;\r | |
637 | \r | |
638 | // And the UART that receives from the reader\r | |
639 | Uart.output = (((BYTE *)BigBuf) + 1024);\r | |
640 | Uart.byteCntMax = 100;\r | |
641 | Uart.state = STATE_UNSYNCD;\r | |
642 | \r | |
643 | // Setup for the DMA.\r | |
644 | dmaBuf = (SBYTE *)(BigBuf + 32);\r | |
645 | upTo = dmaBuf;\r | |
646 | lastRxCounter = DMA_BUFFER_SIZE;\r | |
647 | FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);\r | |
648 | \r | |
649 | // Signal field is ON with the appropriate LED:\r | |
650 | if (weTx) LED_D_ON(); else LED_D_OFF();\r | |
651 | // And put the FPGA in the appropriate mode\r | |
652 | FpgaWriteConfWord(\r | |
653 | FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r | |
654 | (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));\r | |
655 | \r | |
656 | for(;;) {\r | |
657 | int behindBy = lastRxCounter - PDC_RX_COUNTER(SSC_BASE);\r | |
658 | if(behindBy > max) max = behindBy;\r | |
659 | \r | |
660 | while(((lastRxCounter-PDC_RX_COUNTER(SSC_BASE)) & (DMA_BUFFER_SIZE-1))\r | |
661 | > 2)\r | |
662 | {\r | |
663 | ci = upTo[0];\r | |
664 | cq = upTo[1];\r | |
665 | upTo += 2;\r | |
666 | if(upTo - dmaBuf > DMA_BUFFER_SIZE) {\r | |
667 | upTo -= DMA_BUFFER_SIZE;\r | |
668 | PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;\r | |
669 | PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;\r | |
670 | }\r | |
671 | lastRxCounter -= 2;\r | |
672 | if(lastRxCounter <= 0) {\r | |
673 | lastRxCounter += DMA_BUFFER_SIZE;\r | |
674 | }\r | |
675 | \r | |
676 | samples += 2;\r | |
677 | \r | |
678 | Handle14443UartBit(1);\r | |
679 | Handle14443UartBit(1);\r | |
680 | \r | |
681 | if(Handle14443SamplesDemod(ci, cq)) {\r | |
682 | gotFrame = 1;\r | |
683 | }\r | |
684 | }\r | |
685 | \r | |
686 | if(samples > 2000) {\r | |
687 | break;\r | |
688 | }\r | |
689 | }\r | |
690 | PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;\r | |
691 | if (!quiet) DbpIntegers(max, gotFrame, Demod.len);\r | |
692 | }\r | |
693 | \r | |
694 | //-----------------------------------------------------------------------------\r | |
695 | // Read the tag's response. We just receive a stream of slightly-processed\r | |
696 | // samples from the FPGA, which we will later do some signal processing on,\r | |
697 | // to get the bits.\r | |
698 | //-----------------------------------------------------------------------------\r | |
699 | /*static void GetSamplesFor14443(BOOL weTx, int n)\r | |
700 | {\r | |
701 | BYTE *dest = (BYTE *)BigBuf;\r | |
702 | int c;\r | |
703 | \r | |
704 | FpgaWriteConfWord(\r | |
705 | FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r | |
706 | (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));\r | |
707 | \r | |
708 | c = 0;\r | |
709 | for(;;) {\r | |
710 | if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r | |
711 | SSC_TRANSMIT_HOLDING = 0x43;\r | |
712 | }\r | |
713 | if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r | |
714 | SBYTE b;\r | |
715 | b = (SBYTE)SSC_RECEIVE_HOLDING;\r | |
716 | \r | |
717 | dest[c++] = (BYTE)b;\r | |
718 | \r | |
719 | if(c >= n) {\r | |
720 | break;\r | |
721 | }\r | |
722 | }\r | |
723 | }\r | |
724 | }*/\r | |
725 | \r | |
726 | //-----------------------------------------------------------------------------\r | |
727 | // Transmit the command (to the tag) that was placed in ToSend[].\r | |
728 | //-----------------------------------------------------------------------------\r | |
729 | static void TransmitFor14443(void)\r | |
730 | {\r | |
731 | int c;\r | |
732 | \r | |
733 | FpgaSetupSsc();\r | |
734 | \r | |
735 | while(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r | |
736 | SSC_TRANSMIT_HOLDING = 0xff;\r | |
737 | }\r | |
738 | \r | |
739 | // Signal field is ON with the appropriate Red LED\r | |
740 | LED_D_ON();\r | |
741 | // Signal we are transmitting with the Green LED\r | |
742 | LED_B_ON();\r | |
743 | FpgaWriteConfWord(\r | |
744 | FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);\r | |
745 | \r | |
746 | for(c = 0; c < 10;) {\r | |
747 | if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r | |
748 | SSC_TRANSMIT_HOLDING = 0xff;\r | |
749 | c++;\r | |
750 | }\r | |
751 | if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r | |
752 | volatile DWORD r = SSC_RECEIVE_HOLDING;\r | |
753 | (void)r;\r | |
754 | }\r | |
755 | WDT_HIT();\r | |
756 | }\r | |
757 | \r | |
758 | c = 0;\r | |
759 | for(;;) {\r | |
760 | if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r | |
761 | SSC_TRANSMIT_HOLDING = ToSend[c];\r | |
762 | c++;\r | |
763 | if(c >= ToSendMax) {\r | |
764 | break;\r | |
765 | }\r | |
766 | }\r | |
767 | if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r | |
768 | volatile DWORD r = SSC_RECEIVE_HOLDING;\r | |
769 | (void)r;\r | |
770 | }\r | |
771 | WDT_HIT();\r | |
772 | }\r | |
773 | LED_B_OFF(); // Finished sending\r | |
774 | }\r | |
775 | \r | |
776 | //-----------------------------------------------------------------------------\r | |
777 | // Code a layer 2 command (string of octets, including CRC) into ToSend[],\r | |
778 | // so that it is ready to transmit to the tag using TransmitFor14443().\r | |
779 | //-----------------------------------------------------------------------------\r | |
780 | void CodeIso14443bAsReader(const BYTE *cmd, int len)\r | |
781 | {\r | |
782 | int i, j;\r | |
783 | BYTE b;\r | |
784 | \r | |
785 | ToSendReset();\r | |
786 | \r | |
787 | // Establish initial reference level\r | |
788 | for(i = 0; i < 40; i++) {\r | |
789 | ToSendStuffBit(1);\r | |
790 | }\r | |
791 | // Send SOF\r | |
792 | for(i = 0; i < 10; i++) {\r | |
793 | ToSendStuffBit(0);\r | |
794 | }\r | |
795 | \r | |
796 | for(i = 0; i < len; i++) {\r | |
797 | // Stop bits/EGT\r | |
798 | ToSendStuffBit(1);\r | |
799 | ToSendStuffBit(1);\r | |
800 | // Start bit\r | |
801 | ToSendStuffBit(0);\r | |
802 | // Data bits\r | |
803 | b = cmd[i];\r | |
804 | for(j = 0; j < 8; j++) {\r | |
805 | if(b & 1) {\r | |
806 | ToSendStuffBit(1);\r | |
807 | } else {\r | |
808 | ToSendStuffBit(0);\r | |
809 | }\r | |
810 | b >>= 1;\r | |
811 | }\r | |
812 | }\r | |
813 | // Send EOF\r | |
814 | ToSendStuffBit(1);\r | |
815 | for(i = 0; i < 10; i++) {\r | |
816 | ToSendStuffBit(0);\r | |
817 | }\r | |
818 | for(i = 0; i < 8; i++) {\r | |
819 | ToSendStuffBit(1);\r | |
820 | }\r | |
821 | \r | |
822 | // And then a little more, to make sure that the last character makes\r | |
823 | // it out before we switch to rx mode.\r | |
824 | for(i = 0; i < 24; i++) {\r | |
825 | ToSendStuffBit(1);\r | |
826 | }\r | |
827 | \r | |
828 | // Convert from last character reference to length\r | |
829 | ToSendMax++;\r | |
830 | }\r | |
831 | \r | |
832 | //-----------------------------------------------------------------------------\r | |
833 | // Read an ISO 14443 tag. We send it some set of commands, and record the\r | |
834 | // responses. | |
835 | // The command name is misleading, it actually decodes the reponse in HEX | |
836 | // into the output buffer (read the result using hexsamples, not hisamples)\r | |
837 | //-----------------------------------------------------------------------------\r | |
838 | void AcquireRawAdcSamplesIso14443(DWORD parameter)\r | |
839 | {\r | |
840 | BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };\r | |
841 | \r | |
842 | // Make sure that we start from off, since the tags are stateful;\r | |
843 | // confusing things will happen if we don't reset them between reads.\r | |
844 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
845 | LED_D_OFF();\r | |
846 | SpinDelay(200);\r | |
847 | \r | |
848 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r | |
849 | FpgaSetupSsc();\r | |
850 | \r | |
851 | // Now give it time to spin up.\r | |
852 | // Signal field is on with the appropriate LED\r | |
853 | LED_D_ON();\r | |
854 | FpgaWriteConfWord(\r | |
855 | FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);\r | |
856 | SpinDelay(200);\r | |
857 | \r | |
858 | CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r | |
859 | TransmitFor14443();\r | |
860 | // LED_A_ON();\r | |
861 | GetSamplesFor14443Demod(TRUE, 2000, FALSE);\r | |
862 | // LED_A_OFF();\r | |
863 | }\r | |
864 | ||
865 | //-----------------------------------------------------------------------------\r | |
866 | // Read a SRI512 ISO 14443 tag.\r | |
867 | // | |
868 | // SRI512 tags are just simple memory tags, here we're looking at making a dump | |
869 | // of the contents of the memory. No anticollision algorithm is done, we assume | |
870 | // we have a single tag in the field. | |
871 | // | |
872 | // I tried to be systematic and check every answer of the tag, every CRC, etc...\r | |
873 | //-----------------------------------------------------------------------------\r | |
874 | void ReadSRI512Iso14443(DWORD parameter)\r | |
875 | {\r | |
876 | BYTE i = 0x00; | |
877 | \r | |
878 | // Make sure that we start from off, since the tags are stateful;\r | |
879 | // confusing things will happen if we don't reset them between reads.\r | |
880 | LED_D_OFF();\r | |
881 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
882 | SpinDelay(200);\r | |
883 | \r | |
884 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r | |
885 | FpgaSetupSsc();\r | |
886 | \r | |
887 | // Now give it time to spin up.\r | |
888 | // Signal field is on with the appropriate LED\r | |
889 | LED_D_ON();\r | |
890 | FpgaWriteConfWord(\r | |
891 | FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);\r | |
892 | SpinDelay(200);\r | |
893 | ||
894 | // First command: wake up the tag using the INITIATE command\r | |
895 | BYTE cmd1[] = { 0x06, 0x00, 0x97, 0x5b};\r | |
896 | CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r | |
897 | TransmitFor14443();\r | |
898 | // LED_A_ON();\r | |
899 | GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r | |
900 | // LED_A_OFF();\r | |
901 | ||
902 | if (Demod.len == 0) { | |
903 | DbpString("No response from tag"); | |
904 | return; | |
905 | } else { | |
906 | DbpString("Randomly generated UID from tag (+ 2 byte CRC):"); | |
907 | DbpIntegers(Demod.output[0], Demod.output[1],Demod.output[2]); | |
908 | } | |
909 | // There is a response, SELECT the uid | |
910 | DbpString("Now SELECT tag:"); | |
911 | cmd1[0] = 0x0E; // 0x0E is SELECT | |
912 | cmd1[1] = Demod.output[0]; | |
913 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);\r | |
914 | CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r | |
915 | TransmitFor14443();\r | |
916 | // LED_A_ON();\r | |
917 | GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r | |
918 | // LED_A_OFF();\r | |
919 | if (Demod.len != 3) { | |
920 | DbpString("Expected 3 bytes from tag, got:"); | |
921 | DbpIntegers(Demod.len,0x0,0x0); | |
922 | return; | |
923 | } | |
924 | // Check the CRC of the answer: | |
925 | ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);\r | |
926 | if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {\r | |
927 | DbpString("CRC Error reading select response."); | |
928 | return; | |
929 | } | |
930 | // Check response from the tag: should be the same UID as the command we just sent: | |
931 | if (cmd1[1] != Demod.output[0]) { | |
932 | DbpString("Bad response to SELECT from Tag, aborting:"); | |
933 | DbpIntegers(cmd1[1],Demod.output[0],0x0); | |
934 | return; | |
935 | } | |
936 | // Tag is now selected, | |
937 | // First get the tag's UID: | |
938 | cmd1[0] = 0x0B; | |
939 | ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]); | |
940 | CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one\r | |
941 | TransmitFor14443();\r | |
942 | // LED_A_ON();\r | |
943 | GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r | |
944 | // LED_A_OFF();\r | |
945 | if (Demod.len != 10) { | |
946 | DbpString("Expected 10 bytes from tag, got:"); | |
947 | DbpIntegers(Demod.len,0x0,0x0); | |
948 | return; | |
949 | } | |
950 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
951 | ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);\r | |
952 | if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {\r | |
953 | DbpString("CRC Error reading block! - Below: expected, got"); | |
954 | DbpIntegers( (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9],0); | |
955 | // Do not return;, let's go on... (we should retry, maybe ?) | |
956 | } | |
957 | DbpString("Tag UID (64 bits):"); | |
958 | DbpIntegers((Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], 0); | |
959 | ||
960 | // Now loop to read all 16 blocks, address from 0 to 15 | |
961 | DbpString("Tag memory dump, block 0 to 15"); | |
962 | cmd1[0] = 0x08; | |
963 | i = 0x00; | |
964 | for (;;) { | |
965 | if (i == 0x10) { | |
966 | DbpString("System area block (0xff):"); | |
967 | i = 0xff; | |
968 | } | |
969 | cmd1[1] = i; | |
970 | ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);\r | |
971 | CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r | |
972 | TransmitFor14443();\r | |
973 | // LED_A_ON();\r | |
974 | GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r | |
975 | // LED_A_OFF(); | |
976 | if (Demod.len != 6) { // Check if we got an answer from the tag | |
977 | DbpString("Expected 6 bytes from tag, got less..."); | |
978 | return; | |
979 | } | |
980 | // The check the CRC of the answer (use cmd1 as temporary variable): | |
981 | ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);\r | |
982 | if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {\r | |
983 | DbpString("CRC Error reading block! - Below: expected, got"); | |
984 | DbpIntegers( (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5],0); | |
985 | // Do not return;, let's go on... (we should retry, maybe ?) | |
986 | } | |
987 | // Now print out the memory location: | |
988 | DbpString("Address , Contents, CRC"); | |
989 | DbpIntegers(i, (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], (Demod.output[4]<<8)+Demod.output[5]); | |
990 | if (i == 0xff) { | |
991 | break; | |
992 | } | |
993 | i++; | |
994 | } | |
995 | }\r | |
996 | ||
997 | \r | |
998 | //=============================================================================\r | |
999 | // Finally, the `sniffer' combines elements from both the reader and\r | |
1000 | // simulated tag, to show both sides of the conversation.\r | |
1001 | //=============================================================================\r | |
1002 | \r | |
1003 | //-----------------------------------------------------------------------------\r | |
1004 | // Record the sequence of commands sent by the reader to the tag, with\r | |
1005 | // triggering so that we start recording at the point that the tag is moved\r | |
1006 | // near the reader.\r | |
1007 | //-----------------------------------------------------------------------------\r | |
1008 | /*\r | |
1009 | * Memory usage for this function, (within BigBuf)\r | |
1010 | * 0-1023 : Demodulated samples receive (1024 bytes)\r | |
1011 | * 1024-1535 : Last Received command, 512 bytes (reader->tag)\r | |
1012 | * 1536-2047 : Last Received command, 512 bytes(tag->reader)\r | |
1013 | * 2048-2304 : DMA Buffer, 256 bytes (samples) | |
1014 | */\r | |
1015 | void SnoopIso14443(void)\r | |
1016 | {\r | |
1017 | // We won't start recording the frames that we acquire until we trigger;\r | |
1018 | // a good trigger condition to get started is probably when we see a\r | |
1019 | // response from the tag.\r | |
1020 | BOOL triggered = FALSE;\r | |
1021 | \r | |
1022 | // The command (reader -> tag) that we're working on receiving.\r | |
1023 | BYTE *receivedCmd = (BYTE *)(BigBuf) + 1024;\r | |
1024 | // The response (tag -> reader) that we're working on receiving.\r | |
1025 | BYTE *receivedResponse = (BYTE *)(BigBuf) + 1536;\r | |
1026 | \r | |
1027 | // As we receive stuff, we copy it from receivedCmd or receivedResponse\r | |
1028 | // into trace, along with its length and other annotations.\r | |
1029 | BYTE *trace = (BYTE *)BigBuf;\r | |
1030 | int traceLen = 0;\r | |
1031 | \r | |
1032 | // The DMA buffer, used to stream samples from the FPGA.\r | |
1033 | SBYTE *dmaBuf = (SBYTE *)(BigBuf) + 2048;\r | |
1034 | int lastRxCounter;\r | |
1035 | SBYTE *upTo;\r | |
1036 | int ci, cq;\r | |
1037 | int maxBehindBy = 0;\r | |
1038 | \r | |
1039 | // Count of samples received so far, so that we can include timing\r | |
1040 | // information in the trace buffer.\r | |
1041 | int samples = 0;\r | |
1042 | \r | |
1043 | // Initialize the trace buffer\r | |
1044 | memset(trace, 0x44, 1024);\r | |
1045 | \r | |
1046 | // Set up the demodulator for tag -> reader responses.\r | |
1047 | Demod.output = receivedResponse;\r | |
1048 | Demod.len = 0;\r | |
1049 | Demod.state = DEMOD_UNSYNCD;\r | |
1050 | \r | |
1051 | // And the reader -> tag commands\r | |
1052 | memset(&Uart, 0, sizeof(Uart));\r | |
1053 | Uart.output = receivedCmd;\r | |
1054 | Uart.byteCntMax = 100;\r | |
1055 | Uart.state = STATE_UNSYNCD;\r | |
1056 | \r | |
1057 | // And put the FPGA in the appropriate mode\r | |
1058 | // Signal field is off with the appropriate LED\r | |
1059 | LED_D_OFF();\r | |
1060 | FpgaWriteConfWord(\r | |
1061 | FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r | |
1062 | FPGA_HF_READER_RX_XCORR_SNOOP);\r | |
1063 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r | |
1064 | \r | |
1065 | // Setup for the DMA.\r | |
1066 | FpgaSetupSsc();\r | |
1067 | upTo = dmaBuf;\r | |
1068 | lastRxCounter = DMA_BUFFER_SIZE;\r | |
1069 | FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);\r | |
1070 | // And now we loop, receiving samples.\r | |
1071 | for(;;) {\r | |
1072 | int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &\r | |
1073 | (DMA_BUFFER_SIZE-1);\r | |
1074 | if(behindBy > maxBehindBy) {\r | |
1075 | maxBehindBy = behindBy;\r | |
1076 | if(behindBy > (DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?\r | |
1077 | DbpString("blew circular buffer!");\r | |
1078 | DbpIntegers(behindBy,0,0);\r | |
1079 | goto done;\r | |
1080 | }\r | |
1081 | }\r | |
1082 | if(behindBy < 2) continue;\r | |
1083 | \r | |
1084 | ci = upTo[0];\r | |
1085 | cq = upTo[1];\r | |
1086 | upTo += 2;\r | |
1087 | lastRxCounter -= 2;\r | |
1088 | if(upTo - dmaBuf > DMA_BUFFER_SIZE) {\r | |
1089 | upTo -= DMA_BUFFER_SIZE;\r | |
1090 | lastRxCounter += DMA_BUFFER_SIZE;\r | |
1091 | PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD) upTo;\r | |
1092 | PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;\r | |
1093 | }\r | |
1094 | \r | |
1095 | samples += 2;\r | |
1096 | \r | |
1097 | #define HANDLE_BIT_IF_BODY \\r | |
1098 | if(triggered) { \\r | |
1099 | trace[traceLen++] = ((samples >> 0) & 0xff); \\r | |
1100 | trace[traceLen++] = ((samples >> 8) & 0xff); \\r | |
1101 | trace[traceLen++] = ((samples >> 16) & 0xff); \\r | |
1102 | trace[traceLen++] = ((samples >> 24) & 0xff); \\r | |
1103 | trace[traceLen++] = 0; \\r | |
1104 | trace[traceLen++] = 0; \\r | |
1105 | trace[traceLen++] = 0; \\r | |
1106 | trace[traceLen++] = 0; \\r | |
1107 | trace[traceLen++] = Uart.byteCnt; \\r | |
1108 | memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \\r | |
1109 | traceLen += Uart.byteCnt; \\r | |
1110 | if(traceLen > 1000) break; \\r | |
1111 | } \\r | |
1112 | /* And ready to receive another command. */ \\r | |
1113 | memset(&Uart, 0, sizeof(Uart)); \\r | |
1114 | Uart.output = receivedCmd; \\r | |
1115 | Uart.byteCntMax = 100; \\r | |
1116 | Uart.state = STATE_UNSYNCD; \\r | |
1117 | /* And also reset the demod code, which might have been */ \\r | |
1118 | /* false-triggered by the commands from the reader. */ \\r | |
1119 | memset(&Demod, 0, sizeof(Demod)); \\r | |
1120 | Demod.output = receivedResponse; \\r | |
1121 | Demod.state = DEMOD_UNSYNCD; \\r | |
1122 | \r | |
1123 | if(Handle14443UartBit(ci & 1)) {\r | |
1124 | HANDLE_BIT_IF_BODY\r | |
1125 | }\r | |
1126 | if(Handle14443UartBit(cq & 1)) {\r | |
1127 | HANDLE_BIT_IF_BODY\r | |
1128 | }\r | |
1129 | \r | |
1130 | if(Handle14443SamplesDemod(ci, cq)) {\r | |
1131 | // timestamp, as a count of samples\r | |
1132 | trace[traceLen++] = ((samples >> 0) & 0xff);\r | |
1133 | trace[traceLen++] = ((samples >> 8) & 0xff);\r | |
1134 | trace[traceLen++] = ((samples >> 16) & 0xff);\r | |
1135 | trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);\r | |
1136 | // correlation metric (~signal strength estimate)\r | |
1137 | if(Demod.metricN != 0) {\r | |
1138 | Demod.metric /= Demod.metricN;\r | |
1139 | }\r | |
1140 | trace[traceLen++] = ((Demod.metric >> 0) & 0xff);\r | |
1141 | trace[traceLen++] = ((Demod.metric >> 8) & 0xff);\r | |
1142 | trace[traceLen++] = ((Demod.metric >> 16) & 0xff);\r | |
1143 | trace[traceLen++] = ((Demod.metric >> 24) & 0xff);\r | |
1144 | // length\r | |
1145 | trace[traceLen++] = Demod.len;\r | |
1146 | memcpy(trace+traceLen, receivedResponse, Demod.len);\r | |
1147 | traceLen += Demod.len;\r | |
1148 | if(traceLen > 1000) break;\r | |
1149 | \r | |
1150 | triggered = TRUE;\r | |
1151 | \r | |
1152 | // And ready to receive another response.\r | |
1153 | memset(&Demod, 0, sizeof(Demod));\r | |
1154 | Demod.output = receivedResponse;\r | |
1155 | Demod.state = DEMOD_UNSYNCD;\r | |
1156 | }\r | |
1157 | WDT_HIT();\r | |
1158 | \r | |
1159 | if(BUTTON_PRESS()) {\r | |
1160 | DbpString("cancelled");\r | |
1161 | goto done;\r | |
1162 | }\r | |
1163 | }\r | |
1164 | \r | |
1165 | DbpString("in done pt");\r | |
1166 | \r | |
1167 | DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);\r | |
1168 | DbpIntegers(Uart.byteCntMax, traceLen, 0x23);\r | |
1169 | \r | |
1170 | done:\r | |
1171 | LED_D_OFF();\r | |
1172 | PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;\r | |
1173 | }\r |