cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443.c

   1 //-----------------------------------------------------------------------------
   2 // Routines to support ISO 14443. This includes both the reader software and
   3 // the `fake tag' modes. At the moment only the Type B modulation is
   4 // supported.
   5 // Jonathan Westhues, split Nov 2006
   6 //-----------------------------------------------------------------------------
   7 #include <proxmark3.h>
   8 #include "apps.h"
   9 #include "../common/iso14443_crc.c"
  10
  11
  12 //static void GetSamplesFor14443(BOOL weTx, int n);
  13
  14 #define DMA_BUFFER_SIZE 256
  15
  16 //=============================================================================
  17 // An ISO 14443 Type B tag. We listen for commands from the reader, using
  18 // a UART kind of thing that's implemented in software. When we get a
  19 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
  20 // If it's good, then we can do something appropriate with it, and send
  21 // a response.
  22 //=============================================================================
  23
  24 //-----------------------------------------------------------------------------
  25 // Code up a string of octets at layer 2 (including CRC, we don't generate
  26 // that here) so that they can be transmitted to the reader. Doesn't transmit
  27 // them yet, just leaves them ready to send in ToSend[].
  28 //-----------------------------------------------------------------------------
  29 static void CodeIso14443bAsTag(const BYTE *cmd, int len)
  30 {
  31     int i;
  32
  33     ToSendReset();
  34
  35     // Transmit a burst of ones, as the initial thing that lets the
  36     // reader get phase sync. This (TR1) must be > 80/fs, per spec,
  37     // but tag that I've tried (a Paypass) exceeds that by a fair bit,
  38     // so I will too.
  39     for(i = 0; i < 20; i++) {
  40         ToSendStuffBit(1);
  41         ToSendStuffBit(1);
  42         ToSendStuffBit(1);
  43         ToSendStuffBit(1);
  44     }
  45
  46     // Send SOF.
  47     for(i = 0; i < 10; i++) {
  48         ToSendStuffBit(0);
  49         ToSendStuffBit(0);
  50         ToSendStuffBit(0);
  51         ToSendStuffBit(0);
  52     }
  53     for(i = 0; i < 2; i++) {
  54         ToSendStuffBit(1);
  55         ToSendStuffBit(1);
  56         ToSendStuffBit(1);
  57         ToSendStuffBit(1);
  58     }
  59
  60     for(i = 0; i < len; i++) {
  61         int j;
  62         BYTE b = cmd[i];
  63
  64         // Start bit
  65         ToSendStuffBit(0);
  66         ToSendStuffBit(0);
  67         ToSendStuffBit(0);
  68         ToSendStuffBit(0);
  69
  70         // Data bits
  71         for(j = 0; j < 8; j++) {
  72             if(b & 1) {
  73                 ToSendStuffBit(1);
  74                 ToSendStuffBit(1);
  75                 ToSendStuffBit(1);
  76                 ToSendStuffBit(1);
  77             } else {
  78                 ToSendStuffBit(0);
  79                 ToSendStuffBit(0);
  80                 ToSendStuffBit(0);
  81                 ToSendStuffBit(0);
  82             }
  83             b >>= 1;
  84         }
  85
  86         // Stop bit
  87         ToSendStuffBit(1);
  88         ToSendStuffBit(1);
  89         ToSendStuffBit(1);
  90         ToSendStuffBit(1);
  91     }
  92
  93     // Send SOF.
  94     for(i = 0; i < 10; i++) {
  95         ToSendStuffBit(0);
  96         ToSendStuffBit(0);
  97         ToSendStuffBit(0);
  98         ToSendStuffBit(0);
  99     }
 100     for(i = 0; i < 10; i++) {
 101         ToSendStuffBit(1);
 102         ToSendStuffBit(1);
 103         ToSendStuffBit(1);
 104         ToSendStuffBit(1);
 105     }
 106
 107     // Convert from last byte pos to length
 108     ToSendMax++;
 109
 110     // Add a few more for slop
 111     ToSendMax += 2;
 112 }
 113
 114 //-----------------------------------------------------------------------------
 115 // The software UART that receives commands from the reader, and its state
 116 // variables.
 117 //-----------------------------------------------------------------------------
 118 static struct {
 119     enum {
 120         STATE_UNSYNCD,
 121         STATE_GOT_FALLING_EDGE_OF_SOF,
 122         STATE_AWAITING_START_BIT,
 123         STATE_RECEIVING_DATA,
 124         STATE_ERROR_WAIT
 125     }       state;
 126     WORD    shiftReg;
 127     int     bitCnt;
 128     int     byteCnt;
 129     int     byteCntMax;
 130     int     posCnt;
 131     BYTE   *output;
 132 } Uart;
 133
 134 /* Receive & handle a bit coming from the reader.
 135  *
 136  * LED handling:
 137  * LED A -> ON once we have received the SOF and are expecting the rest.
 138  * LED A -> OFF once we have received EOF or are in error state or unsynced
 139  *
 140  * Returns: true if we received a EOF
 141  *          false if we are still waiting for some more
 142  */
 143 static BOOL Handle14443UartBit(int bit)
 144 {
 145     switch(Uart.state) {
 146         case STATE_UNSYNCD:
 147                 LED_A_OFF();
 148             if(!bit) {
 149                 // we went low, so this could be the beginning
 150                 // of an SOF
 151                 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
 152                 Uart.posCnt = 0;
 153                 Uart.bitCnt = 0;
 154             }
 155             break;
 156
 157         case STATE_GOT_FALLING_EDGE_OF_SOF:
 158             Uart.posCnt++;
 159             if(Uart.posCnt == 2) {
 160                 if(bit) {
 161                     if(Uart.bitCnt >= 10) {
 162                         // we've seen enough consecutive
 163                         // zeros that it's a valid SOF
 164                         Uart.posCnt = 0;
 165                         Uart.byteCnt = 0;
 166                         Uart.state = STATE_AWAITING_START_BIT;
 167                         LED_A_ON(); // Indicate we got a valid SOF
 168                     } else {
 169                         // didn't stay down long enough
 170                         // before going high, error
 171                         Uart.state = STATE_ERROR_WAIT;
 172                     }
 173                 } else {
 174                     // do nothing, keep waiting
 175                 }
 176                 Uart.bitCnt++;
 177             }
 178             if(Uart.posCnt >= 4) Uart.posCnt = 0;
 179             if(Uart.bitCnt > 14) {
 180                 // Give up if we see too many zeros without
 181                 // a one, too.
 182                 Uart.state = STATE_ERROR_WAIT;
 183             }
 184             break;
 185
 186         case STATE_AWAITING_START_BIT:
 187             Uart.posCnt++;
 188             if(bit) {
 189                 if(Uart.posCnt > 25) {
 190                     // stayed high for too long between
 191                     // characters, error
 192                     Uart.state = STATE_ERROR_WAIT;
 193                 }
 194             } else {
 195                 // falling edge, this starts the data byte
 196                 Uart.posCnt = 0;
 197                 Uart.bitCnt = 0;
 198                 Uart.shiftReg = 0;
 199                 Uart.state = STATE_RECEIVING_DATA;
 200                 LED_A_ON(); // Indicate we're receiving
 201             }
 202             break;
 203
 204         case STATE_RECEIVING_DATA:
 205             Uart.posCnt++;
 206             if(Uart.posCnt == 2) {
 207                 // time to sample a bit
 208                 Uart.shiftReg >>= 1;
 209                 if(bit) {
 210                     Uart.shiftReg |= 0x200;
 211                 }
 212                 Uart.bitCnt++;
 213             }
 214             if(Uart.posCnt >= 4) {
 215                 Uart.posCnt = 0;
 216             }
 217             if(Uart.bitCnt == 10) {
 218                 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
 219                 {
 220                     // this is a data byte, with correct
 221                     // start and stop bits
 222                     Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
 223                     Uart.byteCnt++;
 224
 225                     if(Uart.byteCnt >= Uart.byteCntMax) {
 226                         // Buffer overflowed, give up
 227                         Uart.posCnt = 0;
 228                         Uart.state = STATE_ERROR_WAIT;
 229                     } else {
 230                         // so get the next byte now
 231                         Uart.posCnt = 0;
 232                         Uart.state = STATE_AWAITING_START_BIT;
 233                     }
 234                 } else if(Uart.shiftReg == 0x000) {
 235                     // this is an EOF byte
 236                         LED_A_OFF(); // Finished receiving
 237                     return TRUE;
 238                 } else {
 239                     // this is an error
 240                     Uart.posCnt = 0;
 241                     Uart.state = STATE_ERROR_WAIT;
 242                 }
 243             }
 244             break;
 245
 246         case STATE_ERROR_WAIT:
 247             // We're all screwed up, so wait a little while
 248             // for whatever went wrong to finish, and then
 249             // start over.
 250             Uart.posCnt++;
 251             if(Uart.posCnt > 10) {
 252                 Uart.state = STATE_UNSYNCD;
 253             }
 254             break;
 255
 256         default:
 257             Uart.state = STATE_UNSYNCD;
 258             break;
 259     }
 260
 261     if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error
 262
 263     return FALSE;
 264 }
 265
 266 //-----------------------------------------------------------------------------
 267 // Receive a command (from the reader to us, where we are the simulated tag),
 268 // and store it in the given buffer, up to the given maximum length. Keeps
 269 // spinning, waiting for a well-framed command, until either we get one
 270 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
 271 //
 272 // Assume that we're called with the SSC (to the FPGA) and ADC path set
 273 // correctly.
 274 //-----------------------------------------------------------------------------
 275 static BOOL GetIso14443CommandFromReader(BYTE *received, int *len, int maxLen)
 276 {
 277     BYTE mask;
 278     int i, bit;
 279
 280     // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
 281     // only, since we are receiving, not transmitting).
 282     // Signal field is off with the appropriate LED
 283     LED_D_OFF();
 284     FpgaWriteConfWord(
 285         FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
 286
 287
 288     // Now run a `software UART' on the stream of incoming samples.
 289     Uart.output = received;
 290     Uart.byteCntMax = maxLen;
 291     Uart.state = STATE_UNSYNCD;
 292
 293     for(;;) {
 294         WDT_HIT();
 295
 296         if(BUTTON_PRESS()) return FALSE;
 297
 298         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 299             AT91C_BASE_SSC->SSC_THR = 0x00;
 300         }
 301         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 302             BYTE b = (BYTE)AT91C_BASE_SSC->SSC_RHR;
 303
 304             mask = 0x80;
 305             for(i = 0; i < 8; i++, mask >>= 1) {
 306                 bit = (b & mask);
 307                 if(Handle14443UartBit(bit)) {
 308                     *len = Uart.byteCnt;
 309                     return TRUE;
 310                 }
 311             }
 312         }
 313     }
 314 }
 315
 316 //-----------------------------------------------------------------------------
 317 // Main loop of simulated tag: receive commands from reader, decide what
 318 // response to send, and send it.
 319 //-----------------------------------------------------------------------------
 320 void SimulateIso14443Tag(void)
 321 {
 322     static const BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 323     static const BYTE response1[] = {
 324         0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
 325         0x00, 0x21, 0x85, 0x5e, 0xd7
 326     };
 327
 328     BYTE *resp;
 329     int respLen;
 330
 331     BYTE *resp1 = (((BYTE *)BigBuf) + 800);
 332     int resp1Len;
 333
 334     BYTE *receivedCmd = (BYTE *)BigBuf;
 335     int len;
 336
 337     int i;
 338
 339     int cmdsRecvd = 0;
 340
 341     memset(receivedCmd, 0x44, 400);
 342
 343     CodeIso14443bAsTag(response1, sizeof(response1));
 344     memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
 345
 346     // We need to listen to the high-frequency, peak-detected path.
 347     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 348     FpgaSetupSsc();
 349
 350     cmdsRecvd = 0;
 351
 352     for(;;) {
 353         BYTE b1, b2;
 354
 355         if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {
 356                 Dbprintf("button pressed, received %d commands", cmdsRecvd);
 357                 break;
 358         }
 359
 360         // Good, look at the command now.
 361
 362         if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
 363             resp = resp1; respLen = resp1Len;
 364         } else {
 365             Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
 366             // And print whether the CRC fails, just for good measure
 367             ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
 368             if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
 369                 // Not so good, try again.
 370                 DbpString("+++CRC fail");
 371             } else {
 372                 DbpString("CRC passes");
 373             }
 374             break;
 375         }
 376
 377         memset(receivedCmd, 0x44, 32);
 378
 379         cmdsRecvd++;
 380
 381         if(cmdsRecvd > 0x30) {
 382             DbpString("many commands later...");
 383             break;
 384         }
 385
 386         if(respLen <= 0) continue;
 387
 388         // Modulate BPSK
 389         // Signal field is off with the appropriate LED
 390         LED_D_OFF();
 391         FpgaWriteConfWord(
 392                 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
 393         AT91C_BASE_SSC->SSC_THR = 0xff;
 394         FpgaSetupSsc();
 395
 396         // Transmit the response.
 397         i = 0;
 398         for(;;) {
 399             if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 400                 BYTE b = resp[i];
 401
 402                 AT91C_BASE_SSC->SSC_THR = b;
 403
 404                 i++;
 405                 if(i > respLen) {
 406                     break;
 407                 }
 408             }
 409             if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 410                 volatile BYTE b = (BYTE)AT91C_BASE_SSC->SSC_RHR;
 411                 (void)b;
 412             }
 413         }
 414     }
 415 }
 416
 417 //=============================================================================
 418 // An ISO 14443 Type B reader. We take layer two commands, code them
 419 // appropriately, and then send them to the tag. We then listen for the
 420 // tag's response, which we leave in the buffer to be demodulated on the
 421 // PC side.
 422 //=============================================================================
 423
 424 static struct {
 425     enum {
 426         DEMOD_UNSYNCD,
 427         DEMOD_PHASE_REF_TRAINING,
 428         DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
 429         DEMOD_GOT_FALLING_EDGE_OF_SOF,
 430         DEMOD_AWAITING_START_BIT,
 431         DEMOD_RECEIVING_DATA,
 432         DEMOD_ERROR_WAIT
 433     }       state;
 434     int     bitCount;
 435     int     posCount;
 436     int     thisBit;
 437     int     metric;
 438     int     metricN;
 439     WORD    shiftReg;
 440     BYTE   *output;
 441     int     len;
 442     int     sumI;
 443     int     sumQ;
 444 } Demod;
 445
 446 /*
 447  * Handles reception of a bit from the tag
 448  *
 449  * LED handling:
 450  * LED C -> ON once we have received the SOF and are expecting the rest.
 451  * LED C -> OFF once we have received EOF or are unsynced
 452  *
 453  * Returns: true if we received a EOF
 454  *          false if we are still waiting for some more
 455  *
 456  */
 457 static BOOL Handle14443SamplesDemod(int ci, int cq)
 458 {
 459     int v;
 460
 461     // The soft decision on the bit uses an estimate of just the
 462     // quadrant of the reference angle, not the exact angle.
 463 #define MAKE_SOFT_DECISION() { \
 464         if(Demod.sumI > 0) { \
 465             v = ci; \
 466         } else { \
 467             v = -ci; \
 468         } \
 469         if(Demod.sumQ > 0) { \
 470             v += cq; \
 471         } else { \
 472             v -= cq; \
 473         } \
 474     }
 475
 476     switch(Demod.state) {
 477         case DEMOD_UNSYNCD:
 478             v = ci;
 479             if(v < 0) v = -v;
 480             if(cq > 0) {
 481                 v += cq;
 482             } else {
 483                 v -= cq;
 484             }
 485             if(v > 40) {
 486                 Demod.posCount = 0;
 487                 Demod.state = DEMOD_PHASE_REF_TRAINING;
 488                 Demod.sumI = 0;
 489                 Demod.sumQ = 0;
 490             }
 491             break;
 492
 493         case DEMOD_PHASE_REF_TRAINING:
 494             if(Demod.posCount < 8) {
 495                 Demod.sumI += ci;
 496                 Demod.sumQ += cq;
 497             } else if(Demod.posCount > 100) {
 498                 // error, waited too long
 499                 Demod.state = DEMOD_UNSYNCD;
 500             } else {
 501                 MAKE_SOFT_DECISION();
 502                 if(v < 0) {
 503                     Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
 504                     Demod.posCount = 0;
 505                 }
 506             }
 507             Demod.posCount++;
 508             break;
 509
 510         case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
 511             MAKE_SOFT_DECISION();
 512             if(v < 0) {
 513                 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
 514                 Demod.posCount = 0;
 515             } else {
 516                 if(Demod.posCount > 100) {
 517                     Demod.state = DEMOD_UNSYNCD;
 518                 }
 519             }
 520             Demod.posCount++;
 521             break;
 522
 523         case DEMOD_GOT_FALLING_EDGE_OF_SOF:
 524             MAKE_SOFT_DECISION();
 525             if(v > 0) {
 526                 if(Demod.posCount < 12) {
 527                     Demod.state = DEMOD_UNSYNCD;
 528                 } else {
 529                         LED_C_ON(); // Got SOF
 530                     Demod.state = DEMOD_AWAITING_START_BIT;
 531                     Demod.posCount = 0;
 532                     Demod.len = 0;
 533                     Demod.metricN = 0;
 534                     Demod.metric = 0;
 535                 }
 536             } else {
 537                 if(Demod.posCount > 100) {
 538                     Demod.state = DEMOD_UNSYNCD;
 539                 }
 540             }
 541             Demod.posCount++;
 542             break;
 543
 544         case DEMOD_AWAITING_START_BIT:
 545             MAKE_SOFT_DECISION();
 546             if(v > 0) {
 547                 if(Demod.posCount > 10) {
 548                     Demod.state = DEMOD_UNSYNCD;
 549                 }
 550             } else {
 551                 Demod.bitCount = 0;
 552                 Demod.posCount = 1;
 553                 Demod.thisBit = v;
 554                 Demod.shiftReg = 0;
 555                 Demod.state = DEMOD_RECEIVING_DATA;
 556             }
 557             break;
 558
 559         case DEMOD_RECEIVING_DATA:
 560             MAKE_SOFT_DECISION();
 561             if(Demod.posCount == 0) {
 562                 Demod.thisBit = v;
 563                 Demod.posCount = 1;
 564             } else {
 565                 Demod.thisBit += v;
 566
 567                 if(Demod.thisBit > 0) {
 568                     Demod.metric += Demod.thisBit;
 569                 } else {
 570                     Demod.metric -= Demod.thisBit;
 571                 }
 572                 (Demod.metricN)++;
 573
 574                 Demod.shiftReg >>= 1;
 575                 if(Demod.thisBit > 0) {
 576                     Demod.shiftReg |= 0x200;
 577                 }
 578
 579                 Demod.bitCount++;
 580                 if(Demod.bitCount == 10) {
 581                     WORD s = Demod.shiftReg;
 582                     if((s & 0x200) && !(s & 0x001)) {
 583                         BYTE b = (s >> 1);
 584                         Demod.output[Demod.len] = b;
 585                         Demod.len++;
 586                         Demod.state = DEMOD_AWAITING_START_BIT;
 587                     } else if(s == 0x000) {
 588                         // This is EOF
 589                         LED_C_OFF();
 590                         return TRUE;
 591                         Demod.state = DEMOD_UNSYNCD;
 592                     } else {
 593                         Demod.state = DEMOD_UNSYNCD;
 594                     }
 595                 }
 596                 Demod.posCount = 0;
 597             }
 598             break;
 599
 600         default:
 601             Demod.state = DEMOD_UNSYNCD;
 602             break;
 603     }
 604
 605     if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...
 606     return FALSE;
 607 }
 608
 609 /*
 610  *  Demodulate the samples we received from the tag
 611  *  weTx: set to 'TRUE' if we behave like a reader
 612  *        set to 'FALSE' if we behave like a snooper
 613  *  quiet: set to 'TRUE' to disable debug output
 614  */
 615 static void GetSamplesFor14443Demod(BOOL weTx, int n, BOOL quiet)
 616 {
 617     int max = 0;
 618     BOOL gotFrame = FALSE;
 619
 620 //#   define DMA_BUFFER_SIZE 8
 621     SBYTE *dmaBuf;
 622
 623     int lastRxCounter;
 624     SBYTE *upTo;
 625
 626     int ci, cq;
 627
 628     int samples = 0;
 629
 630     // Clear out the state of the "UART" that receives from the tag.
 631     memset(BigBuf, 0x44, 400);
 632     Demod.output = (BYTE *)BigBuf;
 633     Demod.len = 0;
 634     Demod.state = DEMOD_UNSYNCD;
 635
 636     // And the UART that receives from the reader
 637     Uart.output = (((BYTE *)BigBuf) + 1024);
 638     Uart.byteCntMax = 100;
 639     Uart.state = STATE_UNSYNCD;
 640
 641     // Setup for the DMA.
 642     dmaBuf = (SBYTE *)(BigBuf + 32);
 643     upTo = dmaBuf;
 644     lastRxCounter = DMA_BUFFER_SIZE;
 645     FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
 646
 647     // Signal field is ON with the appropriate LED:
 648         if (weTx) LED_D_ON(); else LED_D_OFF();
 649     // And put the FPGA in the appropriate mode
 650     FpgaWriteConfWord(
 651         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
 652         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
 653
 654     for(;;) {
 655         int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
 656         if(behindBy > max) max = behindBy;
 657
 658         while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1))
 659                     > 2)
 660         {
 661             ci = upTo[0];
 662             cq = upTo[1];
 663             upTo += 2;
 664             if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
 665                 upTo -= DMA_BUFFER_SIZE;
 666                 AT91C_BASE_PDC_SSC->PDC_RNPR = (DWORD)upTo;
 667                 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
 668             }
 669             lastRxCounter -= 2;
 670             if(lastRxCounter <= 0) {
 671                 lastRxCounter += DMA_BUFFER_SIZE;
 672             }
 673
 674             samples += 2;
 675
 676             Handle14443UartBit(1);
 677             Handle14443UartBit(1);
 678
 679             if(Handle14443SamplesDemod(ci, cq)) {
 680                 gotFrame = 1;
 681             }
 682         }
 683
 684         if(samples > 2000) {
 685             break;
 686         }
 687     }
 688     AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
 689     if (!quiet) Dbprintf("%x %x %x", max, gotFrame, Demod.len);
 690 }
 691
 692 //-----------------------------------------------------------------------------
 693 // Read the tag's response. We just receive a stream of slightly-processed
 694 // samples from the FPGA, which we will later do some signal processing on,
 695 // to get the bits.
 696 //-----------------------------------------------------------------------------
 697 /*static void GetSamplesFor14443(BOOL weTx, int n)
 698 {
 699     BYTE *dest = (BYTE *)BigBuf;
 700     int c;
 701
 702     FpgaWriteConfWord(
 703         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
 704         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
 705
 706     c = 0;
 707     for(;;) {
 708         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 709             AT91C_BASE_SSC->SSC_THR = 0x43;
 710         }
 711         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 712             SBYTE b;
 713             b = (SBYTE)AT91C_BASE_SSC->SSC_RHR;
 714
 715             dest[c++] = (BYTE)b;
 716
 717             if(c >= n) {
 718                 break;
 719             }
 720         }
 721     }
 722 }*/
 723
 724 //-----------------------------------------------------------------------------
 725 // Transmit the command (to the tag) that was placed in ToSend[].
 726 //-----------------------------------------------------------------------------
 727 static void TransmitFor14443(void)
 728 {
 729     int c;
 730
 731     FpgaSetupSsc();
 732
 733     while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 734         AT91C_BASE_SSC->SSC_THR = 0xff;
 735     }
 736
 737     // Signal field is ON with the appropriate Red LED
 738         LED_D_ON();
 739         // Signal we are transmitting with the Green LED
 740         LED_B_ON();
 741         FpgaWriteConfWord(
 742         FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
 743
 744     for(c = 0; c < 10;) {
 745         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 746             AT91C_BASE_SSC->SSC_THR = 0xff;
 747             c++;
 748         }
 749         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 750             volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;
 751             (void)r;
 752         }
 753         WDT_HIT();
 754     }
 755
 756     c = 0;
 757     for(;;) {
 758         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 759             AT91C_BASE_SSC->SSC_THR = ToSend[c];
 760             c++;
 761             if(c >= ToSendMax) {
 762                 break;
 763             }
 764         }
 765         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 766             volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;
 767             (void)r;
 768         }
 769         WDT_HIT();
 770     }
 771     LED_B_OFF(); // Finished sending
 772 }
 773
 774 //-----------------------------------------------------------------------------
 775 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
 776 // so that it is ready to transmit to the tag using TransmitFor14443().
 777 //-----------------------------------------------------------------------------
 778 void CodeIso14443bAsReader(const BYTE *cmd, int len)
 779 {
 780     int i, j;
 781     BYTE b;
 782
 783     ToSendReset();
 784
 785     // Establish initial reference level
 786     for(i = 0; i < 40; i++) {
 787         ToSendStuffBit(1);
 788     }
 789     // Send SOF
 790     for(i = 0; i < 10; i++) {
 791         ToSendStuffBit(0);
 792     }
 793
 794     for(i = 0; i < len; i++) {
 795         // Stop bits/EGT
 796         ToSendStuffBit(1);
 797         ToSendStuffBit(1);
 798         // Start bit
 799         ToSendStuffBit(0);
 800         // Data bits
 801         b = cmd[i];
 802         for(j = 0; j < 8; j++) {
 803             if(b & 1) {
 804                 ToSendStuffBit(1);
 805             } else {
 806                 ToSendStuffBit(0);
 807             }
 808             b >>= 1;
 809         }
 810     }
 811     // Send EOF
 812     ToSendStuffBit(1);
 813     for(i = 0; i < 10; i++) {
 814         ToSendStuffBit(0);
 815     }
 816     for(i = 0; i < 8; i++) {
 817         ToSendStuffBit(1);
 818     }
 819
 820     // And then a little more, to make sure that the last character makes
 821     // it out before we switch to rx mode.
 822     for(i = 0; i < 24; i++) {
 823         ToSendStuffBit(1);
 824     }
 825
 826     // Convert from last character reference to length
 827     ToSendMax++;
 828 }
 829
 830 //-----------------------------------------------------------------------------
 831 // Read an ISO 14443 tag. We send it some set of commands, and record the
 832 // responses.
 833 // The command name is misleading, it actually decodes the reponse in HEX
 834 // into the output buffer (read the result using hexsamples, not hisamples)
 835 //-----------------------------------------------------------------------------
 836 void AcquireRawAdcSamplesIso14443(DWORD parameter)
 837 {
 838     BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 839
 840     // Make sure that we start from off, since the tags are stateful;
 841     // confusing things will happen if we don't reset them between reads.
 842     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 843     LED_D_OFF();
 844     SpinDelay(200);
 845
 846     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 847     FpgaSetupSsc();
 848
 849     // Now give it time to spin up.
 850     // Signal field is on with the appropriate LED
 851     LED_D_ON();
 852     FpgaWriteConfWord(
 853         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 854     SpinDelay(200);
 855
 856     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 857     TransmitFor14443();
 858 //    LED_A_ON();
 859     GetSamplesFor14443Demod(TRUE, 2000, FALSE);
 860 //    LED_A_OFF();
 861 }
 862
 863 //-----------------------------------------------------------------------------
 864 // Read a SRI512 ISO 14443 tag.
 865 //
 866 // SRI512 tags are just simple memory tags, here we're looking at making a dump
 867 // of the contents of the memory. No anticollision algorithm is done, we assume
 868 // we have a single tag in the field.
 869 //
 870 // I tried to be systematic and check every answer of the tag, every CRC, etc...
 871 //-----------------------------------------------------------------------------
 872 void ReadSRI512Iso14443(DWORD parameter)
 873 {
 874      ReadSTMemoryIso14443(parameter,0x0F);
 875 }
 876 void ReadSRIX4KIso14443(DWORD parameter)
 877 {
 878      ReadSTMemoryIso14443(parameter,0x7F);
 879 }
 880
 881 void ReadSTMemoryIso14443(DWORD parameter,DWORD dwLast)
 882 {
 883     BYTE i = 0x00;
 884
 885     // Make sure that we start from off, since the tags are stateful;
 886     // confusing things will happen if we don't reset them between reads.
 887     LED_D_OFF();
 888     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 889     SpinDelay(200);
 890
 891     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 892     FpgaSetupSsc();
 893
 894     // Now give it time to spin up.
 895     // Signal field is on with the appropriate LED
 896     LED_D_ON();
 897     FpgaWriteConfWord(
 898         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 899     SpinDelay(200);
 900
 901     // First command: wake up the tag using the INITIATE command
 902     BYTE cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
 903     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 904     TransmitFor14443();
 905 //    LED_A_ON();
 906     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 907 //    LED_A_OFF();
 908
 909     if (Demod.len == 0) {
 910         DbpString("No response from tag");
 911         return;
 912     } else {
 913         Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",
 914                 Demod.output[0], Demod.output[1],Demod.output[2]);
 915     }
 916     // There is a response, SELECT the uid
 917     DbpString("Now SELECT tag:");
 918     cmd1[0] = 0x0E; // 0x0E is SELECT
 919     cmd1[1] = Demod.output[0];
 920     ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 921     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 922     TransmitFor14443();
 923 //    LED_A_ON();
 924     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 925 //    LED_A_OFF();
 926     if (Demod.len != 3) {
 927         Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
 928         return;
 929     }
 930     // Check the CRC of the answer:
 931     ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
 932     if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
 933         DbpString("CRC Error reading select response.");
 934         return;
 935     }
 936     // Check response from the tag: should be the same UID as the command we just sent:
 937     if (cmd1[1] != Demod.output[0]) {
 938         Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);
 939         return;
 940     }
 941     // Tag is now selected,
 942     // First get the tag's UID:
 943     cmd1[0] = 0x0B;
 944     ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
 945     CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one
 946     TransmitFor14443();
 947 //    LED_A_ON();
 948     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 949 //    LED_A_OFF();
 950     if (Demod.len != 10) {
 951         Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
 952         return;
 953     }
 954     // The check the CRC of the answer (use cmd1 as temporary variable):
 955     ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
 956            if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
 957         Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
 958                 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
 959         // Do not return;, let's go on... (we should retry, maybe ?)
 960     }
 961     Dbprintf("Tag UID (64 bits): %08x %08x",
 962         (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
 963         (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
 964
 965     // Now loop to read all 16 blocks, address from 0 to 15
 966     DbpString("Tag memory dump, block 0 to 15");
 967     cmd1[0] = 0x08;
 968     i = 0x00;
 969     dwLast++;
 970     for (;;) {
 971            if (i == dwLast) {
 972                     DbpString("System area block (0xff):");
 973                     i = 0xff;
 974             }
 975             cmd1[1] = i;
 976             ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 977             CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 978             TransmitFor14443();
 979 //          LED_A_ON();
 980             GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 981 //          LED_A_OFF();
 982             if (Demod.len != 6) { // Check if we got an answer from the tag
 983                 DbpString("Expected 6 bytes from tag, got less...");
 984                 return;
 985             }
 986             // The check the CRC of the answer (use cmd1 as temporary variable):
 987             ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
 988             if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
 989                 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
 990                         (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
 991                 // Do not return;, let's go on... (we should retry, maybe ?)
 992             }
 993             // Now print out the memory location:
 994             Dbprintf("Address=%x, Contents=%x, CRC=%x", i,
 995                 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
 996                 (Demod.output[4]<<8)+Demod.output[5]);
 997             if (i == 0xff) {
 998                 break;
 999             }
1000             i++;
1001     }
1002 }
1003
1004
1005 //=============================================================================
1006 // Finally, the `sniffer' combines elements from both the reader and
1007 // simulated tag, to show both sides of the conversation.
1008 //=============================================================================
1009
1010 //-----------------------------------------------------------------------------
1011 // Record the sequence of commands sent by the reader to the tag, with
1012 // triggering so that we start recording at the point that the tag is moved
1013 // near the reader.
1014 //-----------------------------------------------------------------------------
1015 /*
1016  * Memory usage for this function, (within BigBuf)
1017  * 0-1023 : Demodulated samples receive (1024 bytes)
1018  * 1024-1535 : Last Received command, 512 bytes (reader->tag)
1019  * 1536-2047 : Last Received command, 512 bytes(tag->reader)
1020  * 2048-2304 : DMA Buffer, 256 bytes (samples)
1021  */
1022 void SnoopIso14443(void)
1023 {
1024     // We won't start recording the frames that we acquire until we trigger;
1025     // a good trigger condition to get started is probably when we see a
1026     // response from the tag.
1027     BOOL triggered = FALSE;
1028
1029     // The command (reader -> tag) that we're working on receiving.
1030     BYTE *receivedCmd = (BYTE *)(BigBuf) + 1024;
1031     // The response (tag -> reader) that we're working on receiving.
1032     BYTE *receivedResponse = (BYTE *)(BigBuf) + 1536;
1033
1034     // As we receive stuff, we copy it from receivedCmd or receivedResponse
1035     // into trace, along with its length and other annotations.
1036     BYTE *trace = (BYTE *)BigBuf;
1037     int traceLen = 0;
1038
1039     // The DMA buffer, used to stream samples from the FPGA.
1040     SBYTE *dmaBuf = (SBYTE *)(BigBuf) + 2048;
1041     int lastRxCounter;
1042     SBYTE *upTo;
1043     int ci, cq;
1044     int maxBehindBy = 0;
1045
1046     // Count of samples received so far, so that we can include timing
1047     // information in the trace buffer.
1048     int samples = 0;
1049
1050     // Initialize the trace buffer
1051     memset(trace, 0x44, 1024);
1052
1053     // Set up the demodulator for tag -> reader responses.
1054     Demod.output = receivedResponse;
1055     Demod.len = 0;
1056     Demod.state = DEMOD_UNSYNCD;
1057
1058     // And the reader -> tag commands
1059     memset(&Uart, 0, sizeof(Uart));
1060     Uart.output = receivedCmd;
1061     Uart.byteCntMax = 100;
1062     Uart.state = STATE_UNSYNCD;
1063
1064     // And put the FPGA in the appropriate mode
1065     // Signal field is off with the appropriate LED
1066     LED_D_OFF();
1067     FpgaWriteConfWord(
1068         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
1069         FPGA_HF_READER_RX_XCORR_SNOOP);
1070     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1071
1072     // Setup for the DMA.
1073     FpgaSetupSsc();
1074     upTo = dmaBuf;
1075     lastRxCounter = DMA_BUFFER_SIZE;
1076     FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
1077     // And now we loop, receiving samples.
1078     for(;;) {
1079         int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
1080                                 (DMA_BUFFER_SIZE-1);
1081         if(behindBy > maxBehindBy) {
1082             maxBehindBy = behindBy;
1083             if(behindBy > (DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?
1084                 Dbprintf("blew circular buffer! behindBy=%x", behindBy);
1085                 goto done;
1086             }
1087         }
1088         if(behindBy < 2) continue;
1089
1090         ci = upTo[0];
1091         cq = upTo[1];
1092         upTo += 2;
1093         lastRxCounter -= 2;
1094         if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
1095             upTo -= DMA_BUFFER_SIZE;
1096             lastRxCounter += DMA_BUFFER_SIZE;
1097             AT91C_BASE_PDC_SSC->PDC_RNPR = (DWORD) upTo;
1098             AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
1099         }
1100
1101         samples += 2;
1102
1103 #define HANDLE_BIT_IF_BODY \
1104             if(triggered) { \
1105                 trace[traceLen++] = ((samples >>  0) & 0xff); \
1106                 trace[traceLen++] = ((samples >>  8) & 0xff); \
1107                 trace[traceLen++] = ((samples >> 16) & 0xff); \
1108                 trace[traceLen++] = ((samples >> 24) & 0xff); \
1109                 trace[traceLen++] = 0; \
1110                 trace[traceLen++] = 0; \
1111                 trace[traceLen++] = 0; \
1112                 trace[traceLen++] = 0; \
1113                 trace[traceLen++] = Uart.byteCnt; \
1114                 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
1115                 traceLen += Uart.byteCnt; \
1116                 if(traceLen > 1000) break; \
1117             } \
1118             /* And ready to receive another command. */ \
1119             memset(&Uart, 0, sizeof(Uart)); \
1120             Uart.output = receivedCmd; \
1121             Uart.byteCntMax = 100; \
1122             Uart.state = STATE_UNSYNCD; \
1123             /* And also reset the demod code, which might have been */ \
1124             /* false-triggered by the commands from the reader. */ \
1125             memset(&Demod, 0, sizeof(Demod)); \
1126             Demod.output = receivedResponse; \
1127             Demod.state = DEMOD_UNSYNCD; \
1128
1129         if(Handle14443UartBit(ci & 1)) {
1130             HANDLE_BIT_IF_BODY
1131         }
1132         if(Handle14443UartBit(cq & 1)) {
1133             HANDLE_BIT_IF_BODY
1134         }
1135
1136         if(Handle14443SamplesDemod(ci, cq)) {
1137             // timestamp, as a count of samples
1138             trace[traceLen++] = ((samples >>  0) & 0xff);
1139             trace[traceLen++] = ((samples >>  8) & 0xff);
1140             trace[traceLen++] = ((samples >> 16) & 0xff);
1141             trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);
1142             // correlation metric (~signal strength estimate)
1143             if(Demod.metricN != 0) {
1144                 Demod.metric /= Demod.metricN;
1145             }
1146             trace[traceLen++] = ((Demod.metric >>  0) & 0xff);
1147             trace[traceLen++] = ((Demod.metric >>  8) & 0xff);
1148             trace[traceLen++] = ((Demod.metric >> 16) & 0xff);
1149             trace[traceLen++] = ((Demod.metric >> 24) & 0xff);
1150             // length
1151             trace[traceLen++] = Demod.len;
1152             memcpy(trace+traceLen, receivedResponse, Demod.len);
1153             traceLen += Demod.len;
1154             if(traceLen > 1000) break;
1155
1156             triggered = TRUE;
1157
1158             // And ready to receive another response.
1159             memset(&Demod, 0, sizeof(Demod));
1160             Demod.output = receivedResponse;
1161             Demod.state = DEMOD_UNSYNCD;
1162         }
1163                 WDT_HIT();
1164
1165         if(BUTTON_PRESS()) {
1166             DbpString("cancelled");
1167             goto done;
1168         }
1169     }
1170
1171     DbpString("in done pt");
1172     Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);
1173     Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, 0x23);
1174
1175 done:
1176         LED_D_OFF();
1177     AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
1178 }