1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
13 #include "proxmark3.h"
19 #include "iso14443crc.h"
20 #include "iso14443a.h"
22 #include "mifareutil.h"
24 static uint32_t iso14a_timeout
;
27 // the block number for the ISO14443-4 PCB
28 static uint8_t iso14_pcb_blocknum
= 0;
33 // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
34 #define REQUEST_GUARD_TIME (7000/16 + 1)
35 // minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
36 #define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
37 // bool LastCommandWasRequest = FALSE;
40 // Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
42 // When the PM acts as reader and is receiving tag data, it takes
43 // 3 ticks delay in the AD converter
44 // 16 ticks until the modulation detector completes and sets curbit
45 // 8 ticks until bit_to_arm is assigned from curbit
46 // 8*16 ticks for the transfer from FPGA to ARM
47 // 4*16 ticks until we measure the time
48 // - 8*16 ticks because we measure the time of the previous transfer
49 #define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
51 // When the PM acts as a reader and is sending, it takes
52 // 4*16 ticks until we can write data to the sending hold register
53 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
54 // 8 ticks until the first transfer starts
55 // 8 ticks later the FPGA samples the data
56 // 1 tick to assign mod_sig_coil
57 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
59 // When the PM acts as tag and is receiving it takes
60 // 2 ticks delay in the RF part (for the first falling edge),
61 // 3 ticks for the A/D conversion,
62 // 8 ticks on average until the start of the SSC transfer,
63 // 8 ticks until the SSC samples the first data
64 // 7*16 ticks to complete the transfer from FPGA to ARM
65 // 8 ticks until the next ssp_clk rising edge
66 // 4*16 ticks until we measure the time
67 // - 8*16 ticks because we measure the time of the previous transfer
68 #define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
70 // The FPGA will report its internal sending delay in
71 uint16_t FpgaSendQueueDelay
;
72 // the 5 first bits are the number of bits buffered in mod_sig_buf
73 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
74 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
76 // When the PM acts as tag and is sending, it takes
77 // 4*16 ticks until we can write data to the sending hold register
78 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
79 // 8 ticks until the first transfer starts
80 // 8 ticks later the FPGA samples the data
81 // + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
82 // + 1 tick to assign mod_sig_coil
83 #define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
85 // When the PM acts as sniffer and is receiving tag data, it takes
86 // 3 ticks A/D conversion
87 // 14 ticks to complete the modulation detection
88 // 8 ticks (on average) until the result is stored in to_arm
89 // + the delays in transferring data - which is the same for
90 // sniffing reader and tag data and therefore not relevant
91 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
93 // When the PM acts as sniffer and is receiving reader data, it takes
94 // 2 ticks delay in analogue RF receiver (for the falling edge of the
95 // start bit, which marks the start of the communication)
96 // 3 ticks A/D conversion
97 // 8 ticks on average until the data is stored in to_arm.
98 // + the delays in transferring data - which is the same for
99 // sniffing reader and tag data and therefore not relevant
100 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
102 //variables used for timing purposes:
103 //these are in ssp_clk cycles:
104 static uint32_t NextTransferTime
;
105 static uint32_t LastTimeProxToAirStart
;
106 static uint32_t LastProxToAirDuration
;
110 // CARD TO READER - manchester
111 // Sequence D: 11110000 modulation with subcarrier during first half
112 // Sequence E: 00001111 modulation with subcarrier during second half
113 // Sequence F: 00000000 no modulation with subcarrier
114 // READER TO CARD - miller
115 // Sequence X: 00001100 drop after half a period
116 // Sequence Y: 00000000 no drop
117 // Sequence Z: 11000000 drop at start
125 const uint8_t OddByteParity
[256] = {
126 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
127 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
128 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
129 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
130 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
137 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
138 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
141 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
144 void iso14a_set_trigger(bool enable
) {
149 void iso14a_set_timeout(uint32_t timeout
) {
150 iso14a_timeout
= timeout
;
153 //-----------------------------------------------------------------------------
154 // Generate the parity value for a byte sequence
156 //-----------------------------------------------------------------------------
157 byte_t
oddparity (const byte_t bt
)
159 return OddByteParity
[bt
];
162 void GetParity(const uint8_t *pbtCmd
, uint16_t iLen
, uint8_t *par
)
164 uint16_t paritybit_cnt
= 0;
165 uint16_t paritybyte_cnt
= 0;
166 uint8_t parityBits
= 0;
168 for (uint16_t i
= 0; i
< iLen
; i
++) {
169 // Generate the parity bits
170 parityBits
|= ((OddByteParity
[pbtCmd
[i
]]) << (7-paritybit_cnt
));
171 if (paritybit_cnt
== 7) {
172 par
[paritybyte_cnt
] = parityBits
; // save 8 Bits parity
173 parityBits
= 0; // and advance to next Parity Byte
181 // save remaining parity bits
182 par
[paritybyte_cnt
] = parityBits
;
186 void AppendCrc14443a(uint8_t* data
, int len
)
188 ComputeCrc14443(CRC_14443_A
,data
,len
,data
+len
,data
+len
+1);
192 //=============================================================================
193 // ISO 14443 Type A - Miller decoder
194 //=============================================================================
196 // This decoder is used when the PM3 acts as a tag.
197 // The reader will generate "pauses" by temporarily switching of the field.
198 // At the PM3 antenna we will therefore measure a modulated antenna voltage.
199 // The FPGA does a comparison with a threshold and would deliver e.g.:
200 // ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
201 // The Miller decoder needs to identify the following sequences:
202 // 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
203 // 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
204 // 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
205 // Note 1: the bitstream may start at any time. We therefore need to sync.
206 // Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
207 //-----------------------------------------------------------------------------
210 // Lookup-Table to decide if 4 raw bits are a modulation.
211 // We accept two or three consecutive "0" in any position with the rest "1"
212 const bool Mod_Miller_LUT
[] = {
213 TRUE
, TRUE
, FALSE
, TRUE
, FALSE
, FALSE
, FALSE
, FALSE
,
214 TRUE
, TRUE
, FALSE
, FALSE
, TRUE
, FALSE
, FALSE
, FALSE
216 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x00F0) >> 4])
217 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x000F)])
221 Uart
.state
= STATE_UNSYNCD
;
223 Uart
.len
= 0; // number of decoded data bytes
224 Uart
.parityLen
= 0; // number of decoded parity bytes
225 Uart
.shiftReg
= 0; // shiftreg to hold decoded data bits
226 Uart
.parityBits
= 0; // holds 8 parity bits
227 Uart
.twoBits
= 0x0000; // buffer for 2 Bits
233 void UartInit(uint8_t *data
, uint8_t *parity
)
236 Uart
.parity
= parity
;
240 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
241 static RAMFUNC
bool MillerDecoding(uint8_t bit
, uint32_t non_real_time
)
244 Uart
.twoBits
= (Uart
.twoBits
<< 8) | bit
;
246 if (Uart
.state
== STATE_UNSYNCD
) { // not yet synced
248 if (Uart
.highCnt
< 7) { // wait for a stable unmodulated signal
249 if (Uart
.twoBits
== 0xffff) {
255 Uart
.syncBit
= 0xFFFF; // not set
256 // look for 00xx1111 (the start bit)
257 if ((Uart
.twoBits
& 0x6780) == 0x0780) Uart
.syncBit
= 7;
258 else if ((Uart
.twoBits
& 0x33C0) == 0x03C0) Uart
.syncBit
= 6;
259 else if ((Uart
.twoBits
& 0x19E0) == 0x01E0) Uart
.syncBit
= 5;
260 else if ((Uart
.twoBits
& 0x0CF0) == 0x00F0) Uart
.syncBit
= 4;
261 else if ((Uart
.twoBits
& 0x0678) == 0x0078) Uart
.syncBit
= 3;
262 else if ((Uart
.twoBits
& 0x033C) == 0x003C) Uart
.syncBit
= 2;
263 else if ((Uart
.twoBits
& 0x019E) == 0x001E) Uart
.syncBit
= 1;
264 else if ((Uart
.twoBits
& 0x00CF) == 0x000F) Uart
.syncBit
= 0;
265 if (Uart
.syncBit
!= 0xFFFF) {
266 Uart
.startTime
= non_real_time
?non_real_time
:(GetCountSspClk() & 0xfffffff8);
267 Uart
.startTime
-= Uart
.syncBit
;
268 Uart
.endTime
= Uart
.startTime
;
269 Uart
.state
= STATE_START_OF_COMMUNICATION
;
275 if (IsMillerModulationNibble1(Uart
.twoBits
>> Uart
.syncBit
)) {
276 if (IsMillerModulationNibble2(Uart
.twoBits
>> Uart
.syncBit
)) { // Modulation in both halves - error
279 } else { // Modulation in first half = Sequence Z = logic "0"
280 if (Uart
.state
== STATE_MILLER_X
) { // error - must not follow after X
285 Uart
.shiftReg
= (Uart
.shiftReg
>> 1); // add a 0 to the shiftreg
286 Uart
.state
= STATE_MILLER_Z
;
287 Uart
.endTime
= Uart
.startTime
+ 8*(9*Uart
.len
+ Uart
.bitCount
+ 1) - 6;
288 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
289 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
290 Uart
.parityBits
<<= 1; // make room for the parity bit
291 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
294 if((Uart
.len
&0x0007) == 0) { // every 8 data bytes
295 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
302 if (IsMillerModulationNibble2(Uart
.twoBits
>> Uart
.syncBit
)) { // Modulation second half = Sequence X = logic "1"
304 Uart
.shiftReg
= (Uart
.shiftReg
>> 1) | 0x100; // add a 1 to the shiftreg
305 Uart
.state
= STATE_MILLER_X
;
306 Uart
.endTime
= Uart
.startTime
+ 8*(9*Uart
.len
+ Uart
.bitCount
+ 1) - 2;
307 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
308 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
309 Uart
.parityBits
<<= 1; // make room for the new parity bit
310 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
313 if ((Uart
.len
&0x0007) == 0) { // every 8 data bytes
314 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
318 } else { // no modulation in both halves - Sequence Y
319 if (Uart
.state
== STATE_MILLER_Z
|| Uart
.state
== STATE_MILLER_Y
) { // Y after logic "0" - End of Communication
320 Uart
.state
= STATE_UNSYNCD
;
321 Uart
.bitCount
--; // last "0" was part of EOC sequence
322 Uart
.shiftReg
<<= 1; // drop it
323 if(Uart
.bitCount
> 0) { // if we decoded some bits
324 Uart
.shiftReg
>>= (9 - Uart
.bitCount
); // right align them
325 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff); // add last byte to the output
326 Uart
.parityBits
<<= 1; // add a (void) parity bit
327 Uart
.parityBits
<<= (8 - (Uart
.len
&0x0007)); // left align parity bits
328 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // and store it
330 } else if (Uart
.len
& 0x0007) { // there are some parity bits to store
331 Uart
.parityBits
<<= (8 - (Uart
.len
&0x0007)); // left align remaining parity bits
332 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // and store them
335 return TRUE
; // we are finished with decoding the raw data sequence
337 UartReset(); // Nothing receiver - start over
340 if (Uart
.state
== STATE_START_OF_COMMUNICATION
) { // error - must not follow directly after SOC
343 } else { // a logic "0"
345 Uart
.shiftReg
= (Uart
.shiftReg
>> 1); // add a 0 to the shiftreg
346 Uart
.state
= STATE_MILLER_Y
;
347 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
348 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
349 Uart
.parityBits
<<= 1; // make room for the parity bit
350 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
353 if ((Uart
.len
&0x0007) == 0) { // every 8 data bytes
354 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
364 return FALSE
; // not finished yet, need more data
369 //=============================================================================
370 // ISO 14443 Type A - Manchester decoder
371 //=============================================================================
373 // This decoder is used when the PM3 acts as a reader.
374 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
375 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
376 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
377 // The Manchester decoder needs to identify the following sequences:
378 // 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
379 // 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
380 // 8 ticks unmodulated: Sequence F = end of communication
381 // 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
382 // Note 1: the bitstream may start at any time. We therefore need to sync.
383 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
386 // Lookup-Table to decide if 4 raw bits are a modulation.
387 // We accept three or four "1" in any position
388 const bool Mod_Manchester_LUT
[] = {
389 FALSE
, FALSE
, FALSE
, FALSE
, FALSE
, FALSE
, FALSE
, TRUE
,
390 FALSE
, FALSE
, FALSE
, TRUE
, FALSE
, TRUE
, TRUE
, TRUE
393 #define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
394 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
399 Demod
.state
= DEMOD_UNSYNCD
;
400 Demod
.len
= 0; // number of decoded data bytes
402 Demod
.shiftReg
= 0; // shiftreg to hold decoded data bits
403 Demod
.parityBits
= 0; //
404 Demod
.collisionPos
= 0; // Position of collision bit
405 Demod
.twoBits
= 0xffff; // buffer for 2 Bits
411 void DemodInit(uint8_t *data
, uint8_t *parity
)
414 Demod
.parity
= parity
;
418 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
419 static RAMFUNC
int ManchesterDecoding(uint8_t bit
, uint16_t offset
, uint32_t non_real_time
)
422 Demod
.twoBits
= (Demod
.twoBits
<< 8) | bit
;
424 if (Demod
.state
== DEMOD_UNSYNCD
) {
426 if (Demod
.highCnt
< 2) { // wait for a stable unmodulated signal
427 if (Demod
.twoBits
== 0x0000) {
433 Demod
.syncBit
= 0xFFFF; // not set
434 if ((Demod
.twoBits
& 0x7700) == 0x7000) Demod
.syncBit
= 7;
435 else if ((Demod
.twoBits
& 0x3B80) == 0x3800) Demod
.syncBit
= 6;
436 else if ((Demod
.twoBits
& 0x1DC0) == 0x1C00) Demod
.syncBit
= 5;
437 else if ((Demod
.twoBits
& 0x0EE0) == 0x0E00) Demod
.syncBit
= 4;
438 else if ((Demod
.twoBits
& 0x0770) == 0x0700) Demod
.syncBit
= 3;
439 else if ((Demod
.twoBits
& 0x03B8) == 0x0380) Demod
.syncBit
= 2;
440 else if ((Demod
.twoBits
& 0x01DC) == 0x01C0) Demod
.syncBit
= 1;
441 else if ((Demod
.twoBits
& 0x00EE) == 0x00E0) Demod
.syncBit
= 0;
442 if (Demod
.syncBit
!= 0xFFFF) {
443 Demod
.startTime
= non_real_time
?non_real_time
:(GetCountSspClk() & 0xfffffff8);
444 Demod
.startTime
-= Demod
.syncBit
;
445 Demod
.bitCount
= offset
; // number of decoded data bits
446 Demod
.state
= DEMOD_MANCHESTER_DATA
;
452 if (IsManchesterModulationNibble1(Demod
.twoBits
>> Demod
.syncBit
)) { // modulation in first half
453 if (IsManchesterModulationNibble2(Demod
.twoBits
>> Demod
.syncBit
)) { // ... and in second half = collision
454 if (!Demod
.collisionPos
) {
455 Demod
.collisionPos
= (Demod
.len
<< 3) + Demod
.bitCount
;
457 } // modulation in first half only - Sequence D = 1
459 Demod
.shiftReg
= (Demod
.shiftReg
>> 1) | 0x100; // in both cases, add a 1 to the shiftreg
460 if(Demod
.bitCount
== 9) { // if we decoded a full byte (including parity)
461 Demod
.output
[Demod
.len
++] = (Demod
.shiftReg
& 0xff);
462 Demod
.parityBits
<<= 1; // make room for the parity bit
463 Demod
.parityBits
|= ((Demod
.shiftReg
>> 8) & 0x01); // store parity bit
466 if((Demod
.len
&0x0007) == 0) { // every 8 data bytes
467 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // store 8 parity bits
468 Demod
.parityBits
= 0;
471 Demod
.endTime
= Demod
.startTime
+ 8*(9*Demod
.len
+ Demod
.bitCount
+ 1) - 4;
472 } else { // no modulation in first half
473 if (IsManchesterModulationNibble2(Demod
.twoBits
>> Demod
.syncBit
)) { // and modulation in second half = Sequence E = 0
475 Demod
.shiftReg
= (Demod
.shiftReg
>> 1); // add a 0 to the shiftreg
476 if(Demod
.bitCount
>= 9) { // if we decoded a full byte (including parity)
477 Demod
.output
[Demod
.len
++] = (Demod
.shiftReg
& 0xff);
478 Demod
.parityBits
<<= 1; // make room for the new parity bit
479 Demod
.parityBits
|= ((Demod
.shiftReg
>> 8) & 0x01); // store parity bit
482 if ((Demod
.len
&0x0007) == 0) { // every 8 data bytes
483 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // store 8 parity bits1
484 Demod
.parityBits
= 0;
487 Demod
.endTime
= Demod
.startTime
+ 8*(9*Demod
.len
+ Demod
.bitCount
+ 1);
488 } else { // no modulation in both halves - End of communication
489 if(Demod
.bitCount
> 0) { // there are some remaining data bits
490 Demod
.shiftReg
>>= (9 - Demod
.bitCount
); // right align the decoded bits
491 Demod
.output
[Demod
.len
++] = Demod
.shiftReg
& 0xff; // and add them to the output
492 Demod
.parityBits
<<= 1; // add a (void) parity bit
493 Demod
.parityBits
<<= (8 - (Demod
.len
&0x0007)); // left align remaining parity bits
494 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // and store them
496 } else if (Demod
.len
& 0x0007) { // there are some parity bits to store
497 Demod
.parityBits
<<= (8 - (Demod
.len
&0x0007)); // left align remaining parity bits
498 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // and store them
501 return TRUE
; // we are finished with decoding the raw data sequence
502 } else { // nothing received. Start over
510 return FALSE
; // not finished yet, need more data
513 //=============================================================================
514 // Finally, a `sniffer' for ISO 14443 Type A
515 // Both sides of communication!
516 //=============================================================================
518 //-----------------------------------------------------------------------------
519 // Record the sequence of commands sent by the reader to the tag, with
520 // triggering so that we start recording at the point that the tag is moved
522 //-----------------------------------------------------------------------------
523 void RAMFUNC
SnoopIso14443a(uint8_t param
) {
525 // bit 0 - trigger from first card answer
526 // bit 1 - trigger from first reader 7-bit request
530 iso14a_clear_trace();
531 iso14a_set_tracing(TRUE
);
533 // We won't start recording the frames that we acquire until we trigger;
534 // a good trigger condition to get started is probably when we see a
535 // response from the tag.
536 // triggered == FALSE -- to wait first for card
537 bool triggered
= !(param
& 0x03);
539 // The command (reader -> tag) that we're receiving.
540 // The length of a received command will in most cases be no more than 18 bytes.
541 // So 32 should be enough!
542 uint8_t *receivedCmd
= ((uint8_t *)BigBuf
) + RECV_CMD_OFFSET
;
543 uint8_t *receivedCmdPar
= ((uint8_t *)BigBuf
) + RECV_CMD_PAR_OFFSET
;
545 // The response (tag -> reader) that we're receiving.
546 uint8_t *receivedResponse
= ((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
;
547 uint8_t *receivedResponsePar
= ((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
;
549 // As we receive stuff, we copy it from receivedCmd or receivedResponse
550 // into trace, along with its length and other annotations.
551 //uint8_t *trace = (uint8_t *)BigBuf;
553 // The DMA buffer, used to stream samples from the FPGA
554 uint8_t *dmaBuf
= ((uint8_t *)BigBuf
) + DMA_BUFFER_OFFSET
;
555 uint8_t *data
= dmaBuf
;
556 uint8_t previous_data
= 0;
559 bool TagIsActive
= FALSE
;
560 bool ReaderIsActive
= FALSE
;
562 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER
);
564 // Set up the demodulator for tag -> reader responses.
565 DemodInit(receivedResponse
, receivedResponsePar
);
567 // Set up the demodulator for the reader -> tag commands
568 UartInit(receivedCmd
, receivedCmdPar
);
570 // Setup and start DMA.
571 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
);
573 // And now we loop, receiving samples.
574 for(uint32_t rsamples
= 0; TRUE
; ) {
577 DbpString("cancelled by button");
584 int register readBufDataP
= data
- dmaBuf
;
585 int register dmaBufDataP
= DMA_BUFFER_SIZE
- AT91C_BASE_PDC_SSC
->PDC_RCR
;
586 if (readBufDataP
<= dmaBufDataP
){
587 dataLen
= dmaBufDataP
- readBufDataP
;
589 dataLen
= DMA_BUFFER_SIZE
- readBufDataP
+ dmaBufDataP
;
591 // test for length of buffer
592 if(dataLen
> maxDataLen
) {
593 maxDataLen
= dataLen
;
595 Dbprintf("blew circular buffer! dataLen=%d", dataLen
);
599 if(dataLen
< 1) continue;
601 // primary buffer was stopped( <-- we lost data!
602 if (!AT91C_BASE_PDC_SSC
->PDC_RCR
) {
603 AT91C_BASE_PDC_SSC
->PDC_RPR
= (uint32_t) dmaBuf
;
604 AT91C_BASE_PDC_SSC
->PDC_RCR
= DMA_BUFFER_SIZE
;
605 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen
); // temporary
607 // secondary buffer sets as primary, secondary buffer was stopped
608 if (!AT91C_BASE_PDC_SSC
->PDC_RNCR
) {
609 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
;
610 AT91C_BASE_PDC_SSC
->PDC_RNCR
= DMA_BUFFER_SIZE
;
615 if (rsamples
& 0x01) { // Need two samples to feed Miller and Manchester-Decoder
617 if(!TagIsActive
) { // no need to try decoding reader data if the tag is sending
618 uint8_t readerdata
= (previous_data
& 0xF0) | (*data
>> 4);
619 if (MillerDecoding(readerdata
, (rsamples
-1)*4)) {
622 // check - if there is a short 7bit request from reader
623 if ((!triggered
) && (param
& 0x02) && (Uart
.len
== 1) && (Uart
.bitCount
== 7)) triggered
= TRUE
;
626 if (!LogTrace(receivedCmd
,
628 Uart
.startTime
*16 - DELAY_READER_AIR2ARM_AS_SNIFFER
,
629 Uart
.endTime
*16 - DELAY_READER_AIR2ARM_AS_SNIFFER
,
633 /* And ready to receive another command. */
635 /* And also reset the demod code, which might have been */
636 /* false-triggered by the commands from the reader. */
640 ReaderIsActive
= (Uart
.state
!= STATE_UNSYNCD
);
643 if(!ReaderIsActive
) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
644 uint8_t tagdata
= (previous_data
<< 4) | (*data
& 0x0F);
645 if(ManchesterDecoding(tagdata
, 0, (rsamples
-1)*4)) {
648 if (!LogTrace(receivedResponse
,
650 Demod
.startTime
*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER
,
651 Demod
.endTime
*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER
,
655 if ((!triggered
) && (param
& 0x01)) triggered
= TRUE
;
657 // And ready to receive another response.
661 TagIsActive
= (Demod
.state
!= DEMOD_UNSYNCD
);
665 previous_data
= *data
;
668 if(data
== dmaBuf
+ DMA_BUFFER_SIZE
) {
673 DbpString("COMMAND FINISHED");
676 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen
, Uart
.state
, Uart
.len
);
677 Dbprintf("traceLen=%d, Uart.output[0]=%08x", traceLen
, (uint32_t)Uart
.output
[0]);
681 //-----------------------------------------------------------------------------
682 // Prepare tag messages
683 //-----------------------------------------------------------------------------
684 static void CodeIso14443aAsTagPar(const uint8_t *cmd
, uint16_t len
, uint8_t *parity
)
688 // Correction bit, might be removed when not needed
693 ToSendStuffBit(1); // 1
699 ToSend
[++ToSendMax
] = SEC_D
;
700 LastProxToAirDuration
= 8 * ToSendMax
- 4;
702 for(uint16_t i
= 0; i
< len
; i
++) {
706 for(uint16_t j
= 0; j
< 8; j
++) {
708 ToSend
[++ToSendMax
] = SEC_D
;
710 ToSend
[++ToSendMax
] = SEC_E
;
715 // Get the parity bit
716 if (parity
[i
>>3] & (0x80>>(i
&0x0007))) {
717 ToSend
[++ToSendMax
] = SEC_D
;
718 LastProxToAirDuration
= 8 * ToSendMax
- 4;
720 ToSend
[++ToSendMax
] = SEC_E
;
721 LastProxToAirDuration
= 8 * ToSendMax
;
726 ToSend
[++ToSendMax
] = SEC_F
;
728 // Convert from last byte pos to length
732 static void CodeIso14443aAsTag(const uint8_t *cmd
, uint16_t len
)
734 uint8_t par
[MAX_PARITY_SIZE
];
736 GetParity(cmd
, len
, par
);
737 CodeIso14443aAsTagPar(cmd
, len
, par
);
741 static void Code4bitAnswerAsTag(uint8_t cmd
)
747 // Correction bit, might be removed when not needed
752 ToSendStuffBit(1); // 1
758 ToSend
[++ToSendMax
] = SEC_D
;
761 for(i
= 0; i
< 4; i
++) {
763 ToSend
[++ToSendMax
] = SEC_D
;
764 LastProxToAirDuration
= 8 * ToSendMax
- 4;
766 ToSend
[++ToSendMax
] = SEC_E
;
767 LastProxToAirDuration
= 8 * ToSendMax
;
773 ToSend
[++ToSendMax
] = SEC_F
;
775 // Convert from last byte pos to length
779 //-----------------------------------------------------------------------------
780 // Wait for commands from reader
781 // Stop when button is pressed
782 // Or return TRUE when command is captured
783 //-----------------------------------------------------------------------------
784 static int GetIso14443aCommandFromReader(uint8_t *received
, uint8_t *parity
, int *len
)
786 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
787 // only, since we are receiving, not transmitting).
788 // Signal field is off with the appropriate LED
790 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
792 // Now run a `software UART' on the stream of incoming samples.
793 UartInit(received
, parity
);
796 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
801 if(BUTTON_PRESS()) return FALSE
;
803 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
804 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
805 if(MillerDecoding(b
, 0)) {
813 static int EmSendCmd14443aRaw(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
);
814 int EmSend4bitEx(uint8_t resp
, bool correctionNeeded
);
815 int EmSend4bit(uint8_t resp
);
816 int EmSendCmdExPar(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
, uint8_t *par
);
817 int EmSendCmdEx(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
);
818 int EmSendCmd(uint8_t *resp
, uint16_t respLen
);
819 int EmSendCmdPar(uint8_t *resp
, uint16_t respLen
, uint8_t *par
);
820 bool EmLogTrace(uint8_t *reader_data
, uint16_t reader_len
, uint32_t reader_StartTime
, uint32_t reader_EndTime
, uint8_t *reader_Parity
,
821 uint8_t *tag_data
, uint16_t tag_len
, uint32_t tag_StartTime
, uint32_t tag_EndTime
, uint8_t *tag_Parity
);
823 static uint8_t* free_buffer_pointer
= (((uint8_t *)BigBuf
) + FREE_BUFFER_OFFSET
);
830 uint32_t ProxToAirDuration
;
831 } tag_response_info_t
;
833 void reset_free_buffer() {
834 free_buffer_pointer
= (((uint8_t *)BigBuf
) + FREE_BUFFER_OFFSET
);
837 bool prepare_tag_modulation(tag_response_info_t
* response_info
, size_t max_buffer_size
) {
838 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
839 // This will need the following byte array for a modulation sequence
840 // 144 data bits (18 * 8)
843 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
844 // 1 just for the case
846 // 166 bytes, since every bit that needs to be send costs us a byte
849 // Prepare the tag modulation bits from the message
850 CodeIso14443aAsTag(response_info
->response
,response_info
->response_n
);
852 // Make sure we do not exceed the free buffer space
853 if (ToSendMax
> max_buffer_size
) {
854 Dbprintf("Out of memory, when modulating bits for tag answer:");
855 Dbhexdump(response_info
->response_n
,response_info
->response
,false);
859 // Copy the byte array, used for this modulation to the buffer position
860 memcpy(response_info
->modulation
,ToSend
,ToSendMax
);
862 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
863 response_info
->modulation_n
= ToSendMax
;
864 response_info
->ProxToAirDuration
= LastProxToAirDuration
;
869 bool prepare_allocated_tag_modulation(tag_response_info_t
* response_info
) {
870 // Retrieve and store the current buffer index
871 response_info
->modulation
= free_buffer_pointer
;
873 // Determine the maximum size we can use from our buffer
874 size_t max_buffer_size
= (((uint8_t *)BigBuf
) + FREE_BUFFER_OFFSET
+ FREE_BUFFER_SIZE
) - free_buffer_pointer
;
876 // Forward the prepare tag modulation function to the inner function
877 if (prepare_tag_modulation(response_info
,max_buffer_size
)) {
878 // Update the free buffer offset
879 free_buffer_pointer
+= ToSendMax
;
886 //-----------------------------------------------------------------------------
887 // Main loop of simulated tag: receive commands from reader, decide what
888 // response to send, and send it.
889 //-----------------------------------------------------------------------------
890 void SimulateIso14443aTag(int tagType
, int uid_1st
, int uid_2nd
, byte_t
* data
)
892 // Enable and clear the trace
893 iso14a_clear_trace();
894 iso14a_set_tracing(TRUE
);
898 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
899 uint8_t response1
[2];
902 case 1: { // MIFARE Classic
903 // Says: I am Mifare 1k - original line
908 case 2: { // MIFARE Ultralight
909 // Says: I am a stupid memory tag, no crypto
914 case 3: { // MIFARE DESFire
915 // Says: I am a DESFire tag, ph33r me
920 case 4: { // ISO/IEC 14443-4
921 // Says: I am a javacard (JCOP)
926 case 5: { // MIFARE TNP3XXX
933 Dbprintf("Error: unkown tagtype (%d)",tagType
);
938 // The second response contains the (mandatory) first 24 bits of the UID
939 uint8_t response2
[5];
941 // Check if the uid uses the (optional) part
942 uint8_t response2a
[5];
945 num_to_bytes(uid_1st
,3,response2
+1);
946 num_to_bytes(uid_2nd
,4,response2a
);
947 response2a
[4] = response2a
[0] ^ response2a
[1] ^ response2a
[2] ^ response2a
[3];
949 // Configure the ATQA and SAK accordingly
950 response1
[0] |= 0x40;
953 num_to_bytes(uid_1st
,4,response2
);
954 // Configure the ATQA and SAK accordingly
955 response1
[0] &= 0xBF;
959 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
960 response2
[4] = response2
[0] ^ response2
[1] ^ response2
[2] ^ response2
[3];
962 // Prepare the mandatory SAK (for 4 and 7 byte UID)
963 uint8_t response3
[3];
965 ComputeCrc14443(CRC_14443_A
, response3
, 1, &response3
[1], &response3
[2]);
967 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
968 uint8_t response3a
[3];
969 response3a
[0] = sak
& 0xFB;
970 ComputeCrc14443(CRC_14443_A
, response3a
, 1, &response3a
[1], &response3a
[2]);
972 uint8_t response5
[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
973 uint8_t response6
[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
974 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
975 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
976 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
977 // TC(1) = 0x02: CID supported, NAD not supported
978 ComputeCrc14443(CRC_14443_A
, response6
, 4, &response6
[4], &response6
[5]);
980 #define TAG_RESPONSE_COUNT 7
981 tag_response_info_t responses
[TAG_RESPONSE_COUNT
] = {
982 { .response
= response1
, .response_n
= sizeof(response1
) }, // Answer to request - respond with card type
983 { .response
= response2
, .response_n
= sizeof(response2
) }, // Anticollision cascade1 - respond with uid
984 { .response
= response2a
, .response_n
= sizeof(response2a
) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
985 { .response
= response3
, .response_n
= sizeof(response3
) }, // Acknowledge select - cascade 1
986 { .response
= response3a
, .response_n
= sizeof(response3a
) }, // Acknowledge select - cascade 2
987 { .response
= response5
, .response_n
= sizeof(response5
) }, // Authentication answer (random nonce)
988 { .response
= response6
, .response_n
= sizeof(response6
) }, // dummy ATS (pseudo-ATR), answer to RATS
991 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
992 // Such a response is less time critical, so we can prepare them on the fly
993 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
994 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
995 uint8_t dynamic_response_buffer
[DYNAMIC_RESPONSE_BUFFER_SIZE
];
996 uint8_t dynamic_modulation_buffer
[DYNAMIC_MODULATION_BUFFER_SIZE
];
997 tag_response_info_t dynamic_response_info
= {
998 .response
= dynamic_response_buffer
,
1000 .modulation
= dynamic_modulation_buffer
,
1004 // Reset the offset pointer of the free buffer
1005 reset_free_buffer();
1007 // Prepare the responses of the anticollision phase
1008 // there will be not enough time to do this at the moment the reader sends it REQA
1009 for (size_t i
=0; i
<TAG_RESPONSE_COUNT
; i
++) {
1010 prepare_allocated_tag_modulation(&responses
[i
]);
1015 // To control where we are in the protocol
1019 // Just to allow some checks
1024 // We need to listen to the high-frequency, peak-detected path.
1025 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
1027 // buffers used on software Uart:
1028 uint8_t *receivedCmd
= ((uint8_t *)BigBuf
) + RECV_CMD_OFFSET
;
1029 uint8_t *receivedCmdPar
= ((uint8_t *)BigBuf
) + RECV_CMD_PAR_OFFSET
;
1032 tag_response_info_t
* p_response
;
1036 // Clean receive command buffer
1038 if(!GetIso14443aCommandFromReader(receivedCmd
, receivedCmdPar
, &len
)) {
1039 DbpString("Button press");
1045 // Okay, look at the command now.
1047 if(receivedCmd
[0] == 0x26) { // Received a REQUEST
1048 p_response
= &responses
[0]; order
= 1;
1049 } else if(receivedCmd
[0] == 0x52) { // Received a WAKEUP
1050 p_response
= &responses
[0]; order
= 6;
1051 } else if(receivedCmd
[1] == 0x20 && receivedCmd
[0] == 0x93) { // Received request for UID (cascade 1)
1052 p_response
= &responses
[1]; order
= 2;
1053 } else if(receivedCmd
[1] == 0x20 && receivedCmd
[0] == 0x95) { // Received request for UID (cascade 2)
1054 p_response
= &responses
[2]; order
= 20;
1055 } else if(receivedCmd
[1] == 0x70 && receivedCmd
[0] == 0x93) { // Received a SELECT (cascade 1)
1056 p_response
= &responses
[3]; order
= 3;
1057 } else if(receivedCmd
[1] == 0x70 && receivedCmd
[0] == 0x95) { // Received a SELECT (cascade 2)
1058 p_response
= &responses
[4]; order
= 30;
1059 } else if(receivedCmd
[0] == 0x30) { // Received a (plain) READ
1060 EmSendCmdEx(data
+(4*receivedCmd
[1]),16,false);
1061 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1062 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1064 } else if(receivedCmd
[0] == 0x50) { // Received a HALT
1067 LogTrace(receivedCmd
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
1070 } else if(receivedCmd
[0] == 0x60 || receivedCmd
[0] == 0x61) { // Received an authentication request
1071 p_response
= &responses
[5]; order
= 7;
1072 } else if(receivedCmd
[0] == 0xE0) { // Received a RATS request
1073 if (tagType
== 1 || tagType
== 2) { // RATS not supported
1074 EmSend4bit(CARD_NACK_NA
);
1077 p_response
= &responses
[6]; order
= 70;
1079 } else if (order
== 7 && len
== 8) { // Received {nr] and {ar} (part of authentication)
1081 LogTrace(receivedCmd
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
1083 uint32_t nr
= bytes_to_num(receivedCmd
,4);
1084 uint32_t ar
= bytes_to_num(receivedCmd
+4,4);
1085 Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr
,ar
);
1087 // Check for ISO 14443A-4 compliant commands, look at left nibble
1088 switch (receivedCmd
[0]) {
1091 case 0x0A: { // IBlock (command)
1092 dynamic_response_info
.response
[0] = receivedCmd
[0];
1093 dynamic_response_info
.response
[1] = 0x00;
1094 dynamic_response_info
.response
[2] = 0x90;
1095 dynamic_response_info
.response
[3] = 0x00;
1096 dynamic_response_info
.response_n
= 4;
1100 case 0x1B: { // Chaining command
1101 dynamic_response_info
.response
[0] = 0xaa | ((receivedCmd
[0]) & 1);
1102 dynamic_response_info
.response_n
= 2;
1107 dynamic_response_info
.response
[0] = receivedCmd
[0] ^ 0x11;
1108 dynamic_response_info
.response_n
= 2;
1112 memcpy(dynamic_response_info
.response
,"\xAB\x00",2);
1113 dynamic_response_info
.response_n
= 2;
1117 case 0xC2: { // Readers sends deselect command
1118 memcpy(dynamic_response_info
.response
,"\xCA\x00",2);
1119 dynamic_response_info
.response_n
= 2;
1123 // Never seen this command before
1125 LogTrace(receivedCmd
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
1127 Dbprintf("Received unknown command (len=%d):",len
);
1128 Dbhexdump(len
,receivedCmd
,false);
1130 dynamic_response_info
.response_n
= 0;
1134 if (dynamic_response_info
.response_n
> 0) {
1135 // Copy the CID from the reader query
1136 dynamic_response_info
.response
[1] = receivedCmd
[1];
1138 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1139 AppendCrc14443a(dynamic_response_info
.response
,dynamic_response_info
.response_n
);
1140 dynamic_response_info
.response_n
+= 2;
1142 if (prepare_tag_modulation(&dynamic_response_info
,DYNAMIC_MODULATION_BUFFER_SIZE
) == false) {
1143 Dbprintf("Error preparing tag response");
1145 LogTrace(receivedCmd
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
1149 p_response
= &dynamic_response_info
;
1153 // Count number of wakeups received after a halt
1154 if(order
== 6 && lastorder
== 5) { happened
++; }
1156 // Count number of other messages after a halt
1157 if(order
!= 6 && lastorder
== 5) { happened2
++; }
1159 if(cmdsRecvd
> 999) {
1160 DbpString("1000 commands later...");
1165 if (p_response
!= NULL
) {
1166 EmSendCmd14443aRaw(p_response
->modulation
, p_response
->modulation_n
, receivedCmd
[0] == 0x52);
1167 // do the tracing for the previous reader request and this tag answer:
1168 uint8_t par
[MAX_PARITY_SIZE
];
1169 GetParity(p_response
->response
, p_response
->response_n
, par
);
1171 EmLogTrace(Uart
.output
,
1173 Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1174 Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1176 p_response
->response
,
1177 p_response
->response_n
,
1178 LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_TAG
,
1179 (LastTimeProxToAirStart
+ p_response
->ProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_TAG
,
1184 Dbprintf("Trace Full. Simulation stopped.");
1189 Dbprintf("%x %x %x", happened
, happened2
, cmdsRecvd
);
1194 // prepare a delayed transfer. This simply shifts ToSend[] by a number
1195 // of bits specified in the delay parameter.
1196 void PrepareDelayedTransfer(uint16_t delay
)
1198 uint8_t bitmask
= 0;
1199 uint8_t bits_to_shift
= 0;
1200 uint8_t bits_shifted
= 0;
1204 for (uint16_t i
= 0; i
< delay
; i
++) {
1205 bitmask
|= (0x01 << i
);
1207 ToSend
[ToSendMax
++] = 0x00;
1208 for (uint16_t i
= 0; i
< ToSendMax
; i
++) {
1209 bits_to_shift
= ToSend
[i
] & bitmask
;
1210 ToSend
[i
] = ToSend
[i
] >> delay
;
1211 ToSend
[i
] = ToSend
[i
] | (bits_shifted
<< (8 - delay
));
1212 bits_shifted
= bits_to_shift
;
1218 //-------------------------------------------------------------------------------------
1219 // Transmit the command (to the tag) that was placed in ToSend[].
1220 // Parameter timing:
1221 // if NULL: transfer at next possible time, taking into account
1222 // request guard time and frame delay time
1223 // if == 0: transfer immediately and return time of transfer
1224 // if != 0: delay transfer until time specified
1225 //-------------------------------------------------------------------------------------
1226 static void TransmitFor14443a(const uint8_t *cmd
, uint16_t len
, uint32_t *timing
)
1229 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_MOD
);
1231 uint32_t ThisTransferTime
= 0;
1234 if(*timing
== 0) { // Measure time
1235 *timing
= (GetCountSspClk() + 8) & 0xfffffff8;
1237 PrepareDelayedTransfer(*timing
& 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1239 if(MF_DBGLEVEL
>= 4 && GetCountSspClk() >= (*timing
& 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1240 while(GetCountSspClk() < (*timing
& 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1241 LastTimeProxToAirStart
= *timing
;
1243 ThisTransferTime
= ((MAX(NextTransferTime
, GetCountSspClk()) & 0xfffffff8) + 8);
1244 while(GetCountSspClk() < ThisTransferTime
);
1245 LastTimeProxToAirStart
= ThisTransferTime
;
1249 AT91C_BASE_SSC
->SSC_THR
= SEC_Y
;
1253 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1254 AT91C_BASE_SSC
->SSC_THR
= cmd
[c
];
1262 NextTransferTime
= MAX(NextTransferTime
, LastTimeProxToAirStart
+ REQUEST_GUARD_TIME
);
1266 //-----------------------------------------------------------------------------
1267 // Prepare reader command (in bits, support short frames) to send to FPGA
1268 //-----------------------------------------------------------------------------
1269 void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd
, uint16_t bits
, const uint8_t *parity
)
1277 // Start of Communication (Seq. Z)
1278 ToSend
[++ToSendMax
] = SEC_Z
;
1279 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1282 size_t bytecount
= nbytes(bits
);
1283 // Generate send structure for the data bits
1284 for (i
= 0; i
< bytecount
; i
++) {
1285 // Get the current byte to send
1287 size_t bitsleft
= MIN((bits
-(i
*8)),8);
1289 for (j
= 0; j
< bitsleft
; j
++) {
1292 ToSend
[++ToSendMax
] = SEC_X
;
1293 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 2;
1298 ToSend
[++ToSendMax
] = SEC_Z
;
1299 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1302 ToSend
[++ToSendMax
] = SEC_Y
;
1309 // Only transmit parity bit if we transmitted a complete byte
1311 // Get the parity bit
1312 if (parity
[i
>>3] & (0x80 >> (i
&0x0007))) {
1314 ToSend
[++ToSendMax
] = SEC_X
;
1315 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 2;
1320 ToSend
[++ToSendMax
] = SEC_Z
;
1321 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1324 ToSend
[++ToSendMax
] = SEC_Y
;
1331 // End of Communication: Logic 0 followed by Sequence Y
1334 ToSend
[++ToSendMax
] = SEC_Z
;
1335 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1338 ToSend
[++ToSendMax
] = SEC_Y
;
1341 ToSend
[++ToSendMax
] = SEC_Y
;
1343 // Convert to length of command:
1347 //-----------------------------------------------------------------------------
1348 // Prepare reader command to send to FPGA
1349 //-----------------------------------------------------------------------------
1350 void CodeIso14443aAsReaderPar(const uint8_t *cmd
, uint16_t len
, const uint8_t *parity
)
1352 CodeIso14443aBitsAsReaderPar(cmd
, len
*8, parity
);
1355 //-----------------------------------------------------------------------------
1356 // Wait for commands from reader
1357 // Stop when button is pressed (return 1) or field was gone (return 2)
1358 // Or return 0 when command is captured
1359 //-----------------------------------------------------------------------------
1360 static int EmGetCmd(uint8_t *received
, uint16_t *len
, uint8_t *parity
)
1364 uint32_t timer
= 0, vtime
= 0;
1368 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1369 // only, since we are receiving, not transmitting).
1370 // Signal field is off with the appropriate LED
1372 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
1374 // Set ADC to read field strength
1375 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_SWRST
;
1376 AT91C_BASE_ADC
->ADC_MR
=
1377 ADC_MODE_PRESCALE(32) |
1378 ADC_MODE_STARTUP_TIME(16) |
1379 ADC_MODE_SAMPLE_HOLD_TIME(8);
1380 AT91C_BASE_ADC
->ADC_CHER
= ADC_CHANNEL(ADC_CHAN_HF
);
1382 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
;
1384 // Now run a 'software UART' on the stream of incoming samples.
1385 UartInit(received
, parity
);
1388 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1393 if (BUTTON_PRESS()) return 1;
1395 // test if the field exists
1396 if (AT91C_BASE_ADC
->ADC_SR
& ADC_END_OF_CONVERSION(ADC_CHAN_HF
)) {
1398 analogAVG
+= AT91C_BASE_ADC
->ADC_CDR
[ADC_CHAN_HF
];
1399 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
;
1400 if (analogCnt
>= 32) {
1401 if ((33000 * (analogAVG
/ analogCnt
) >> 10) < MF_MINFIELDV
) {
1402 vtime
= GetTickCount();
1403 if (!timer
) timer
= vtime
;
1404 // 50ms no field --> card to idle state
1405 if (vtime
- timer
> 50) return 2;
1407 if (timer
) timer
= 0;
1413 // receive and test the miller decoding
1414 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1415 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1416 if(MillerDecoding(b
, 0)) {
1426 static int EmSendCmd14443aRaw(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
)
1430 uint32_t ThisTransferTime
;
1432 // Modulate Manchester
1433 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_MOD
);
1435 // include correction bit if necessary
1436 if (Uart
.parityBits
& 0x01) {
1437 correctionNeeded
= TRUE
;
1439 if(correctionNeeded
) {
1440 // 1236, so correction bit needed
1446 // clear receiving shift register and holding register
1447 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
1448 b
= AT91C_BASE_SSC
->SSC_RHR
; (void) b
;
1449 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
1450 b
= AT91C_BASE_SSC
->SSC_RHR
; (void) b
;
1452 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1453 for (uint16_t j
= 0; j
< 5; j
++) { // allow timeout - better late than never
1454 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
1455 if (AT91C_BASE_SSC
->SSC_RHR
) break;
1458 while ((ThisTransferTime
= GetCountSspClk()) & 0x00000007);
1461 AT91C_BASE_SSC
->SSC_THR
= SEC_F
;
1464 for(; i
<= respLen
; ) {
1465 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1466 AT91C_BASE_SSC
->SSC_THR
= resp
[i
++];
1467 FpgaSendQueueDelay
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1470 if(BUTTON_PRESS()) {
1475 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1476 for (i
= 0; i
< 2 ; ) {
1477 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1478 AT91C_BASE_SSC
->SSC_THR
= SEC_F
;
1479 FpgaSendQueueDelay
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1484 LastTimeProxToAirStart
= ThisTransferTime
+ (correctionNeeded
?8:0);
1489 int EmSend4bitEx(uint8_t resp
, bool correctionNeeded
){
1490 Code4bitAnswerAsTag(resp
);
1491 int res
= EmSendCmd14443aRaw(ToSend
, ToSendMax
, correctionNeeded
);
1492 // do the tracing for the previous reader request and this tag answer:
1494 GetParity(&resp
, 1, par
);
1495 EmLogTrace(Uart
.output
,
1497 Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1498 Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1502 LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_TAG
,
1503 (LastTimeProxToAirStart
+ LastProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_TAG
,
1508 int EmSend4bit(uint8_t resp
){
1509 return EmSend4bitEx(resp
, false);
1512 int EmSendCmdExPar(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
, uint8_t *par
){
1513 CodeIso14443aAsTagPar(resp
, respLen
, par
);
1514 int res
= EmSendCmd14443aRaw(ToSend
, ToSendMax
, correctionNeeded
);
1515 // do the tracing for the previous reader request and this tag answer:
1516 EmLogTrace(Uart
.output
,
1518 Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1519 Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
,
1523 LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_TAG
,
1524 (LastTimeProxToAirStart
+ LastProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_TAG
,
1529 int EmSendCmdEx(uint8_t *resp
, uint16_t respLen
, bool correctionNeeded
){
1530 uint8_t par
[MAX_PARITY_SIZE
];
1531 GetParity(resp
, respLen
, par
);
1532 return EmSendCmdExPar(resp
, respLen
, correctionNeeded
, par
);
1535 int EmSendCmd(uint8_t *resp
, uint16_t respLen
){
1536 uint8_t par
[MAX_PARITY_SIZE
];
1537 GetParity(resp
, respLen
, par
);
1538 return EmSendCmdExPar(resp
, respLen
, false, par
);
1541 int EmSendCmdPar(uint8_t *resp
, uint16_t respLen
, uint8_t *par
){
1542 return EmSendCmdExPar(resp
, respLen
, false, par
);
1545 bool EmLogTrace(uint8_t *reader_data
, uint16_t reader_len
, uint32_t reader_StartTime
, uint32_t reader_EndTime
, uint8_t *reader_Parity
,
1546 uint8_t *tag_data
, uint16_t tag_len
, uint32_t tag_StartTime
, uint32_t tag_EndTime
, uint8_t *tag_Parity
)
1549 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1550 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1551 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1552 uint16_t reader_modlen
= reader_EndTime
- reader_StartTime
;
1553 uint16_t approx_fdt
= tag_StartTime
- reader_EndTime
;
1554 uint16_t exact_fdt
= (approx_fdt
- 20 + 32)/64 * 64 + 20;
1555 reader_EndTime
= tag_StartTime
- exact_fdt
;
1556 reader_StartTime
= reader_EndTime
- reader_modlen
;
1557 if (!LogTrace(reader_data
, reader_len
, reader_StartTime
, reader_EndTime
, reader_Parity
, TRUE
)) {
1559 } else return(!LogTrace(tag_data
, tag_len
, tag_StartTime
, tag_EndTime
, tag_Parity
, FALSE
));
1565 //-----------------------------------------------------------------------------
1566 // Wait a certain time for tag response
1567 // If a response is captured return TRUE
1568 // If it takes too long return FALSE
1569 //-----------------------------------------------------------------------------
1570 static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse
, uint8_t *receivedResponsePar
, uint16_t offset
)
1574 // Set FPGA mode to "reader listen mode", no modulation (listen
1575 // only, since we are receiving, not transmitting).
1576 // Signal field is on with the appropriate LED
1578 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_LISTEN
);
1580 // Now get the answer from the card
1581 DemodInit(receivedResponse
, receivedResponsePar
);
1584 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1590 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1591 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1592 if(ManchesterDecoding(b
, offset
, 0)) {
1593 NextTransferTime
= MAX(NextTransferTime
, Demod
.endTime
- (DELAY_AIR2ARM_AS_READER
+ DELAY_ARM2AIR_AS_READER
)/16 + FRAME_DELAY_TIME_PICC_TO_PCD
);
1595 } else if (c
++ > iso14a_timeout
) {
1602 void ReaderTransmitBitsPar(uint8_t* frame
, uint16_t bits
, uint8_t *par
, uint32_t *timing
)
1604 CodeIso14443aBitsAsReaderPar(frame
, bits
, par
);
1606 // Send command to tag
1607 TransmitFor14443a(ToSend
, ToSendMax
, timing
);
1611 // Log reader command in trace buffer
1613 LogTrace(frame
, nbytes(bits
), LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_READER
, (LastTimeProxToAirStart
+ LastProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_READER
, par
, TRUE
);
1617 void ReaderTransmitPar(uint8_t* frame
, uint16_t len
, uint8_t *par
, uint32_t *timing
)
1619 ReaderTransmitBitsPar(frame
, len
*8, par
, timing
);
1622 void ReaderTransmitBits(uint8_t* frame
, uint16_t len
, uint32_t *timing
)
1624 // Generate parity and redirect
1625 uint8_t par
[MAX_PARITY_SIZE
];
1626 GetParity(frame
, len
/8, par
);
1627 ReaderTransmitBitsPar(frame
, len
, par
, timing
);
1630 void ReaderTransmit(uint8_t* frame
, uint16_t len
, uint32_t *timing
)
1632 // Generate parity and redirect
1633 uint8_t par
[MAX_PARITY_SIZE
];
1634 GetParity(frame
, len
, par
);
1635 ReaderTransmitBitsPar(frame
, len
*8, par
, timing
);
1638 int ReaderReceiveOffset(uint8_t* receivedAnswer
, uint16_t offset
, uint8_t *parity
)
1640 if (!GetIso14443aAnswerFromTag(receivedAnswer
, parity
, offset
)) return FALSE
;
1642 LogTrace(receivedAnswer
, Demod
.len
, Demod
.startTime
*16 - DELAY_AIR2ARM_AS_READER
, Demod
.endTime
*16 - DELAY_AIR2ARM_AS_READER
, parity
, FALSE
);
1647 int ReaderReceive(uint8_t *receivedAnswer
, uint8_t *parity
)
1649 if (!GetIso14443aAnswerFromTag(receivedAnswer
, parity
, 0)) return FALSE
;
1651 LogTrace(receivedAnswer
, Demod
.len
, Demod
.startTime
*16 - DELAY_AIR2ARM_AS_READER
, Demod
.endTime
*16 - DELAY_AIR2ARM_AS_READER
, parity
, FALSE
);
1656 /* performs iso14443a anticollision procedure
1657 * fills the uid pointer unless NULL
1658 * fills resp_data unless NULL */
1659 int iso14443a_select_card(byte_t
*uid_ptr
, iso14a_card_select_t
*p_hi14a_card
, uint32_t *cuid_ptr
) {
1660 uint8_t wupa
[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1661 uint8_t sel_all
[] = { 0x93,0x20 };
1662 uint8_t sel_uid
[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1663 uint8_t rats
[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1664 uint8_t *resp
= ((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
;
1665 uint8_t *resp_par
= ((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
;
1667 size_t uid_resp_len
;
1669 uint8_t sak
= 0x04; // cascade uid
1670 int cascade_level
= 0;
1673 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1674 ReaderTransmitBitsPar(wupa
,7,0, NULL
);
1677 if(!ReaderReceive(resp
, resp_par
)) return 0;
1680 memcpy(p_hi14a_card
->atqa
, resp
, 2);
1681 p_hi14a_card
->uidlen
= 0;
1682 memset(p_hi14a_card
->uid
,0,10);
1687 memset(uid_ptr
,0,10);
1690 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1691 // which case we need to make a cascade 2 request and select - this is a long UID
1692 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1693 for(; sak
& 0x04; cascade_level
++) {
1694 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1695 sel_uid
[0] = sel_all
[0] = 0x93 + cascade_level
* 2;
1698 ReaderTransmit(sel_all
, sizeof(sel_all
), NULL
);
1699 if (!ReaderReceive(resp
, resp_par
)) return 0;
1701 if (Demod
.collisionPos
) { // we had a collision and need to construct the UID bit by bit
1702 memset(uid_resp
, 0, 4);
1703 uint16_t uid_resp_bits
= 0;
1704 uint16_t collision_answer_offset
= 0;
1705 // anti-collision-loop:
1706 while (Demod
.collisionPos
) {
1707 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod
.collisionPos
);
1708 for (uint16_t i
= collision_answer_offset
; i
< Demod
.collisionPos
; i
++, uid_resp_bits
++) { // add valid UID bits before collision point
1709 uint16_t UIDbit
= (resp
[i
/8] >> (i
% 8)) & 0x01;
1710 uid_resp
[uid_resp_bits
/ 8] |= UIDbit
<< (uid_resp_bits
% 8);
1712 uid_resp
[uid_resp_bits
/8] |= 1 << (uid_resp_bits
% 8); // next time select the card(s) with a 1 in the collision position
1714 // construct anticollosion command:
1715 sel_uid
[1] = ((2 + uid_resp_bits
/8) << 4) | (uid_resp_bits
& 0x07); // length of data in bytes and bits
1716 for (uint16_t i
= 0; i
<= uid_resp_bits
/8; i
++) {
1717 sel_uid
[2+i
] = uid_resp
[i
];
1719 collision_answer_offset
= uid_resp_bits
%8;
1720 ReaderTransmitBits(sel_uid
, 16 + uid_resp_bits
, NULL
);
1721 if (!ReaderReceiveOffset(resp
, collision_answer_offset
, resp_par
)) return 0;
1723 // finally, add the last bits and BCC of the UID
1724 for (uint16_t i
= collision_answer_offset
; i
< (Demod
.len
-1)*8; i
++, uid_resp_bits
++) {
1725 uint16_t UIDbit
= (resp
[i
/8] >> (i
%8)) & 0x01;
1726 uid_resp
[uid_resp_bits
/8] |= UIDbit
<< (uid_resp_bits
% 8);
1729 } else { // no collision, use the response to SELECT_ALL as current uid
1730 memcpy(uid_resp
, resp
, 4);
1734 // calculate crypto UID. Always use last 4 Bytes.
1736 *cuid_ptr
= bytes_to_num(uid_resp
, 4);
1739 // Construct SELECT UID command
1740 sel_uid
[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1741 memcpy(sel_uid
+2, uid_resp
, 4); // the UID
1742 sel_uid
[6] = sel_uid
[2] ^ sel_uid
[3] ^ sel_uid
[4] ^ sel_uid
[5]; // calculate and add BCC
1743 AppendCrc14443a(sel_uid
, 7); // calculate and add CRC
1744 ReaderTransmit(sel_uid
, sizeof(sel_uid
), NULL
);
1747 if (!ReaderReceive(resp
, resp_par
)) return 0;
1750 // Test if more parts of the uid are coming
1751 if ((sak
& 0x04) /* && uid_resp[0] == 0x88 */) {
1752 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1753 // http://www.nxp.com/documents/application_note/AN10927.pdf
1754 uid_resp
[0] = uid_resp
[1];
1755 uid_resp
[1] = uid_resp
[2];
1756 uid_resp
[2] = uid_resp
[3];
1762 memcpy(uid_ptr
+ (cascade_level
*3), uid_resp
, uid_resp_len
);
1766 memcpy(p_hi14a_card
->uid
+ (cascade_level
*3), uid_resp
, uid_resp_len
);
1767 p_hi14a_card
->uidlen
+= uid_resp_len
;
1772 p_hi14a_card
->sak
= sak
;
1773 p_hi14a_card
->ats_len
= 0;
1776 // non iso14443a compliant tag
1777 if( (sak
& 0x20) == 0) return 2;
1779 // Request for answer to select
1780 AppendCrc14443a(rats
, 2);
1781 ReaderTransmit(rats
, sizeof(rats
), NULL
);
1783 if (!(len
= ReaderReceive(resp
, resp_par
))) return 0;
1787 memcpy(p_hi14a_card
->ats
, resp
, sizeof(p_hi14a_card
->ats
));
1788 p_hi14a_card
->ats_len
= len
;
1791 // reset the PCB block number
1792 iso14_pcb_blocknum
= 0;
1796 void iso14443a_setup(uint8_t fpga_minor_mode
) {
1797 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1798 // Set up the synchronous serial port
1800 // connect Demodulated Signal to ADC:
1801 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1803 // Signal field is on with the appropriate LED
1804 if (fpga_minor_mode
== FPGA_HF_ISO14443A_READER_MOD
1805 || fpga_minor_mode
== FPGA_HF_ISO14443A_READER_LISTEN
) {
1810 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| fpga_minor_mode
);
1817 NextTransferTime
= 2*DELAY_ARM2AIR_AS_READER
;
1818 iso14a_set_timeout(1050); // 10ms default
1821 int iso14_apdu(uint8_t *cmd
, uint16_t cmd_len
, void *data
) {
1822 uint8_t parity
[MAX_PARITY_SIZE
];
1823 uint8_t real_cmd
[cmd_len
+4];
1824 real_cmd
[0] = 0x0a; //I-Block
1825 // put block number into the PCB
1826 real_cmd
[0] |= iso14_pcb_blocknum
;
1827 real_cmd
[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
1828 memcpy(real_cmd
+2, cmd
, cmd_len
);
1829 AppendCrc14443a(real_cmd
,cmd_len
+2);
1831 ReaderTransmit(real_cmd
, cmd_len
+4, NULL
);
1832 size_t len
= ReaderReceive(data
, parity
);
1833 uint8_t *data_bytes
= (uint8_t *) data
;
1835 return 0; //DATA LINK ERROR
1836 // if we received an I- or R(ACK)-Block with a block number equal to the
1837 // current block number, toggle the current block number
1838 else if (len
>= 4 // PCB+CID+CRC = 4 bytes
1839 && ((data_bytes
[0] & 0xC0) == 0 // I-Block
1840 || (data_bytes
[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1841 && (data_bytes
[0] & 0x01) == iso14_pcb_blocknum
) // equal block numbers
1843 iso14_pcb_blocknum
^= 1;
1849 //-----------------------------------------------------------------------------
1850 // Read an ISO 14443a tag. Send out commands and store answers.
1852 //-----------------------------------------------------------------------------
1853 void ReaderIso14443a(UsbCommand
*c
)
1855 iso14a_command_t param
= c
->arg
[0];
1856 uint8_t *cmd
= c
->d
.asBytes
;
1857 size_t len
= c
->arg
[1];
1858 size_t lenbits
= c
->arg
[2];
1860 byte_t buf
[USB_CMD_DATA_SIZE
];
1861 uint8_t par
[MAX_PARITY_SIZE
];
1863 if(param
& ISO14A_CONNECT
) {
1864 iso14a_clear_trace();
1867 iso14a_set_tracing(TRUE
);
1869 if(param
& ISO14A_REQUEST_TRIGGER
) {
1870 iso14a_set_trigger(TRUE
);
1873 if(param
& ISO14A_CONNECT
) {
1874 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1875 if(!(param
& ISO14A_NO_SELECT
)) {
1876 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)buf
;
1877 arg0
= iso14443a_select_card(NULL
,card
,NULL
);
1878 cmd_send(CMD_ACK
,arg0
,card
->uidlen
,0,buf
,sizeof(iso14a_card_select_t
));
1882 if(param
& ISO14A_SET_TIMEOUT
) {
1883 iso14a_set_timeout(c
->arg
[2]);
1886 if(param
& ISO14A_APDU
) {
1887 arg0
= iso14_apdu(cmd
, len
, buf
);
1888 cmd_send(CMD_ACK
,arg0
,0,0,buf
,sizeof(buf
));
1891 if(param
& ISO14A_RAW
) {
1892 if(param
& ISO14A_APPEND_CRC
) {
1893 AppendCrc14443a(cmd
,len
);
1895 if (lenbits
) lenbits
+= 16;
1898 GetParity(cmd
, lenbits
/8, par
);
1899 ReaderTransmitBitsPar(cmd
, lenbits
, par
, NULL
);
1901 ReaderTransmit(cmd
,len
, NULL
);
1903 arg0
= ReaderReceive(buf
, par
);
1904 cmd_send(CMD_ACK
,arg0
,0,0,buf
,sizeof(buf
));
1907 if(param
& ISO14A_REQUEST_TRIGGER
) {
1908 iso14a_set_trigger(FALSE
);
1911 if(param
& ISO14A_NO_DISCONNECT
) {
1915 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1920 // Determine the distance between two nonces.
1921 // Assume that the difference is small, but we don't know which is first.
1922 // Therefore try in alternating directions.
1923 int32_t dist_nt(uint32_t nt1
, uint32_t nt2
) {
1926 uint32_t nttmp1
, nttmp2
;
1928 if (nt1
== nt2
) return 0;
1933 for (i
= 1; i
< 32768; i
++) {
1934 nttmp1
= prng_successor(nttmp1
, 1);
1935 if (nttmp1
== nt2
) return i
;
1936 nttmp2
= prng_successor(nttmp2
, 1);
1937 if (nttmp2
== nt1
) return -i
;
1940 return(-99999); // either nt1 or nt2 are invalid nonces
1944 //-----------------------------------------------------------------------------
1945 // Recover several bits of the cypher stream. This implements (first stages of)
1946 // the algorithm described in "The Dark Side of Security by Obscurity and
1947 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
1948 // (article by Nicolas T. Courtois, 2009)
1949 //-----------------------------------------------------------------------------
1950 void ReaderMifare(bool first_try
)
1953 uint8_t mf_auth
[] = { 0x60,0x00,0xf5,0x7b };
1954 uint8_t mf_nr_ar
[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
1955 static uint8_t mf_nr_ar3
;
1957 uint8_t* receivedAnswer
= (((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
);
1958 uint8_t* receivedAnswerPar
= (((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
);
1960 iso14a_clear_trace();
1961 iso14a_set_tracing(TRUE
);
1964 uint8_t par
[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
1965 static byte_t par_low
= 0;
1967 uint8_t uid
[10] ={0};
1971 uint32_t previous_nt
= 0;
1972 static uint32_t nt_attacked
= 0;
1973 byte_t par_list
[8] = {0x00};
1974 byte_t ks_list
[8] = {0x00};
1976 static uint32_t sync_time
;
1977 static uint32_t sync_cycles
;
1978 int catch_up_cycles
= 0;
1979 int last_catch_up
= 0;
1980 uint16_t consecutive_resyncs
= 0;
1985 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD
);
1986 sync_time
= GetCountSspClk() & 0xfffffff8;
1987 sync_cycles
= 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
1993 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
1995 mf_nr_ar
[3] = mf_nr_ar3
;
2004 for(uint16_t i
= 0; TRUE
; i
++) {
2008 // Test if the action was cancelled
2009 if(BUTTON_PRESS()) {
2015 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
2016 if (MF_DBGLEVEL
>= 1) Dbprintf("Mifare: Can't select card");
2020 sync_time
= (sync_time
& 0xfffffff8) + sync_cycles
+ catch_up_cycles
;
2021 catch_up_cycles
= 0;
2023 // if we missed the sync time already, advance to the next nonce repeat
2024 while(GetCountSspClk() > sync_time
) {
2025 sync_time
= (sync_time
& 0xfffffff8) + sync_cycles
;
2028 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2029 ReaderTransmit(mf_auth
, sizeof(mf_auth
), &sync_time
);
2031 // Receive the (4 Byte) "random" nonce
2032 if (!ReaderReceive(receivedAnswer
, receivedAnswerPar
)) {
2033 if (MF_DBGLEVEL
>= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2038 nt
= bytes_to_num(receivedAnswer
, 4);
2040 // Transmit reader nonce with fake par
2041 ReaderTransmitPar(mf_nr_ar
, sizeof(mf_nr_ar
), par
, NULL
);
2043 if (first_try
&& previous_nt
&& !nt_attacked
) { // we didn't calibrate our clock yet
2044 int nt_distance
= dist_nt(previous_nt
, nt
);
2045 if (nt_distance
== 0) {
2049 if (nt_distance
== -99999) { // invalid nonce received, try again
2052 sync_cycles
= (sync_cycles
- nt_distance
);
2053 if (MF_DBGLEVEL
>= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i
, nt_distance
, sync_cycles
);
2058 if ((nt
!= nt_attacked
) && nt_attacked
) { // we somehow lost sync. Try to catch up again...
2059 catch_up_cycles
= -dist_nt(nt_attacked
, nt
);
2060 if (catch_up_cycles
== 99999) { // invalid nonce received. Don't resync on that one.
2061 catch_up_cycles
= 0;
2064 if (catch_up_cycles
== last_catch_up
) {
2065 consecutive_resyncs
++;
2068 last_catch_up
= catch_up_cycles
;
2069 consecutive_resyncs
= 0;
2071 if (consecutive_resyncs
< 3) {
2072 if (MF_DBGLEVEL
>= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i
, -catch_up_cycles
, consecutive_resyncs
);
2075 sync_cycles
= sync_cycles
+ catch_up_cycles
;
2076 if (MF_DBGLEVEL
>= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i
, -catch_up_cycles
, sync_cycles
);
2081 consecutive_resyncs
= 0;
2083 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2084 if (ReaderReceive(receivedAnswer
, receivedAnswerPar
))
2086 catch_up_cycles
= 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2090 par_low
= par
[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2094 if(led_on
) LED_B_ON(); else LED_B_OFF();
2096 par_list
[nt_diff
] = SwapBits(par
[0], 8);
2097 ks_list
[nt_diff
] = receivedAnswer
[0] ^ 0x05;
2099 // Test if the information is complete
2100 if (nt_diff
== 0x07) {
2105 nt_diff
= (nt_diff
+ 1) & 0x07;
2106 mf_nr_ar
[3] = (mf_nr_ar
[3] & 0x1F) | (nt_diff
<< 5);
2109 if (nt_diff
== 0 && first_try
)
2113 par
[0] = ((par
[0] & 0x1F) + 1) | par_low
;
2119 mf_nr_ar
[3] &= 0x1F;
2122 memcpy(buf
+ 0, uid
, 4);
2123 num_to_bytes(nt
, 4, buf
+ 4);
2124 memcpy(buf
+ 8, par_list
, 8);
2125 memcpy(buf
+ 16, ks_list
, 8);
2126 memcpy(buf
+ 24, mf_nr_ar
, 4);
2128 cmd_send(CMD_ACK
,isOK
,0,0,buf
,28);
2131 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
2134 iso14a_set_tracing(FALSE
);
2138 *MIFARE 1K simulate.
2141 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2142 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2143 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2144 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2145 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2147 void Mifare1ksim(uint8_t flags
, uint8_t exitAfterNReads
, uint8_t arg2
, uint8_t *datain
)
2149 int cardSTATE
= MFEMUL_NOFIELD
;
2151 int vHf
= 0; // in mV
2153 uint32_t selTimer
= 0;
2154 uint32_t authTimer
= 0;
2156 uint8_t cardWRBL
= 0;
2157 uint8_t cardAUTHSC
= 0;
2158 uint8_t cardAUTHKEY
= 0xff; // no authentication
2159 uint32_t cardRr
= 0;
2161 //uint32_t rn_enc = 0;
2163 uint32_t cardINTREG
= 0;
2164 uint8_t cardINTBLOCK
= 0;
2165 struct Crypto1State mpcs
= {0, 0};
2166 struct Crypto1State
*pcs
;
2168 uint32_t numReads
= 0;//Counts numer of times reader read a block
2169 uint8_t* receivedCmd
= get_bigbufptr_recvcmdbuf();
2170 uint8_t* receivedCmd_par
= receivedCmd
+ MAX_FRAME_SIZE
;
2171 uint8_t* response
= get_bigbufptr_recvrespbuf();
2172 uint8_t* response_par
= response
+ MAX_FRAME_SIZE
;
2174 uint8_t rATQA
[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2175 uint8_t rUIDBCC1
[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2176 uint8_t rUIDBCC2
[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2177 uint8_t rSAK
[] = {0x08, 0xb6, 0xdd};
2178 uint8_t rSAK1
[] = {0x04, 0xda, 0x17};
2180 uint8_t rAUTH_NT
[] = {0x01, 0x02, 0x03, 0x04};
2181 uint8_t rAUTH_AT
[] = {0x00, 0x00, 0x00, 0x00};
2183 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2184 // This can be used in a reader-only attack.
2185 // (it can also be retrieved via 'hf 14a list', but hey...
2186 uint32_t ar_nr_responses
[] = {0,0,0,0,0,0,0,0};
2187 uint8_t ar_nr_collected
= 0;
2190 iso14a_clear_trace();
2191 iso14a_set_tracing(TRUE
);
2193 // Authenticate response - nonce
2194 uint32_t nonce
= bytes_to_num(rAUTH_NT
, 4);
2196 //-- Determine the UID
2197 // Can be set from emulator memory, incoming data
2198 // and can be 7 or 4 bytes long
2199 if (flags
& FLAG_4B_UID_IN_DATA
)
2201 // 4B uid comes from data-portion of packet
2202 memcpy(rUIDBCC1
,datain
,4);
2203 rUIDBCC1
[4] = rUIDBCC1
[0] ^ rUIDBCC1
[1] ^ rUIDBCC1
[2] ^ rUIDBCC1
[3];
2205 } else if (flags
& FLAG_7B_UID_IN_DATA
) {
2206 // 7B uid comes from data-portion of packet
2207 memcpy(&rUIDBCC1
[1],datain
,3);
2208 memcpy(rUIDBCC2
, datain
+3, 4);
2211 // get UID from emul memory
2212 emlGetMemBt(receivedCmd
, 7, 1);
2213 _7BUID
= !(receivedCmd
[0] == 0x00);
2214 if (!_7BUID
) { // ---------- 4BUID
2215 emlGetMemBt(rUIDBCC1
, 0, 4);
2216 } else { // ---------- 7BUID
2217 emlGetMemBt(&rUIDBCC1
[1], 0, 3);
2218 emlGetMemBt(rUIDBCC2
, 3, 4);
2223 * Regardless of what method was used to set the UID, set fifth byte and modify
2224 * the ATQA for 4 or 7-byte UID
2226 rUIDBCC1
[4] = rUIDBCC1
[0] ^ rUIDBCC1
[1] ^ rUIDBCC1
[2] ^ rUIDBCC1
[3];
2230 rUIDBCC2
[4] = rUIDBCC2
[0] ^ rUIDBCC2
[1] ^ rUIDBCC2
[2] ^ rUIDBCC2
[3];
2233 // We need to listen to the high-frequency, peak-detected path.
2234 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
2237 if (MF_DBGLEVEL
>= 1) {
2239 Dbprintf("4B UID: %02x%02x%02x%02x",
2240 rUIDBCC1
[0], rUIDBCC1
[1], rUIDBCC1
[2], rUIDBCC1
[3]);
2242 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2243 rUIDBCC1
[0], rUIDBCC1
[1], rUIDBCC1
[2], rUIDBCC1
[3],
2244 rUIDBCC2
[0], rUIDBCC2
[1] ,rUIDBCC2
[2], rUIDBCC2
[3]);
2248 bool finished
= FALSE
;
2249 while (!BUTTON_PRESS() && !finished
) {
2252 // find reader field
2253 // Vref = 3300mV, and an 10:1 voltage divider on the input
2254 // can measure voltages up to 33000 mV
2255 if (cardSTATE
== MFEMUL_NOFIELD
) {
2256 vHf
= (33000 * AvgAdc(ADC_CHAN_HF
)) >> 10;
2257 if (vHf
> MF_MINFIELDV
) {
2258 cardSTATE_TO_IDLE();
2262 if(cardSTATE
== MFEMUL_NOFIELD
) continue;
2266 res
= EmGetCmd(receivedCmd
, &len
, receivedCmd_par
);
2267 if (res
== 2) { //Field is off!
2268 cardSTATE
= MFEMUL_NOFIELD
;
2271 } else if (res
== 1) {
2272 break; //return value 1 means button press
2275 // REQ or WUP request in ANY state and WUP in HALTED state
2276 if (len
== 1 && ((receivedCmd
[0] == 0x26 && cardSTATE
!= MFEMUL_HALTED
) || receivedCmd
[0] == 0x52)) {
2277 selTimer
= GetTickCount();
2278 EmSendCmdEx(rATQA
, sizeof(rATQA
), (receivedCmd
[0] == 0x52));
2279 cardSTATE
= MFEMUL_SELECT1
;
2281 // init crypto block
2284 crypto1_destroy(pcs
);
2289 switch (cardSTATE
) {
2290 case MFEMUL_NOFIELD
:
2293 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2296 case MFEMUL_SELECT1
:{
2298 if (len
== 2 && (receivedCmd
[0] == 0x93 && receivedCmd
[1] == 0x20)) {
2299 if (MF_DBGLEVEL
>= 4) Dbprintf("SELECT ALL received");
2300 EmSendCmd(rUIDBCC1
, sizeof(rUIDBCC1
));
2304 if (MF_DBGLEVEL
>= 4 && len
== 9 && receivedCmd
[0] == 0x93 && receivedCmd
[1] == 0x70 )
2306 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd
[2],receivedCmd
[3],receivedCmd
[4],receivedCmd
[5]);
2310 (receivedCmd
[0] == 0x93 && receivedCmd
[1] == 0x70 && memcmp(&receivedCmd
[2], rUIDBCC1
, 4) == 0)) {
2311 EmSendCmd(_7BUID
?rSAK1
:rSAK
, _7BUID
?sizeof(rSAK1
):sizeof(rSAK
));
2312 cuid
= bytes_to_num(rUIDBCC1
, 4);
2314 cardSTATE
= MFEMUL_WORK
;
2316 if (MF_DBGLEVEL
>= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer
);
2319 cardSTATE
= MFEMUL_SELECT2
;
2327 cardSTATE_TO_IDLE();
2328 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2331 uint32_t ar
= bytes_to_num(receivedCmd
, 4);
2332 uint32_t nr
= bytes_to_num(&receivedCmd
[4], 4);
2335 if(ar_nr_collected
< 2){
2336 if(ar_nr_responses
[2] != ar
)
2337 {// Avoid duplicates... probably not necessary, ar should vary.
2338 ar_nr_responses
[ar_nr_collected
*4] = cuid
;
2339 ar_nr_responses
[ar_nr_collected
*4+1] = nonce
;
2340 ar_nr_responses
[ar_nr_collected
*4+2] = ar
;
2341 ar_nr_responses
[ar_nr_collected
*4+3] = nr
;
2347 crypto1_word(pcs
, ar
, 1);
2348 cardRr
= nr
^ crypto1_word(pcs
, 0, 0);
2351 if (cardRr
!= prng_successor(nonce
, 64)){
2352 if (MF_DBGLEVEL
>= 2) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2353 cardAUTHSC
, cardAUTHKEY
== 0 ? 'A' : 'B',
2354 cardRr
, prng_successor(nonce
, 64));
2355 // Shouldn't we respond anything here?
2356 // Right now, we don't nack or anything, which causes the
2357 // reader to do a WUPA after a while. /Martin
2358 // -- which is the correct response. /piwi
2359 cardSTATE_TO_IDLE();
2360 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2364 ans
= prng_successor(nonce
, 96) ^ crypto1_word(pcs
, 0, 0);
2366 num_to_bytes(ans
, 4, rAUTH_AT
);
2368 EmSendCmd(rAUTH_AT
, sizeof(rAUTH_AT
));
2370 cardSTATE
= MFEMUL_WORK
;
2371 if (MF_DBGLEVEL
>= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2372 cardAUTHSC
, cardAUTHKEY
== 0 ? 'A' : 'B',
2373 GetTickCount() - authTimer
);
2376 case MFEMUL_SELECT2
:{
2378 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2381 if (len
== 2 && (receivedCmd
[0] == 0x95 && receivedCmd
[1] == 0x20)) {
2382 EmSendCmd(rUIDBCC2
, sizeof(rUIDBCC2
));
2388 (receivedCmd
[0] == 0x95 && receivedCmd
[1] == 0x70 && memcmp(&receivedCmd
[2], rUIDBCC2
, 4) == 0)) {
2389 EmSendCmd(rSAK
, sizeof(rSAK
));
2390 cuid
= bytes_to_num(rUIDBCC2
, 4);
2391 cardSTATE
= MFEMUL_WORK
;
2393 if (MF_DBGLEVEL
>= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer
);
2397 // i guess there is a command). go into the work state.
2399 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2402 cardSTATE
= MFEMUL_WORK
;
2404 //intentional fall-through to the next case-stmt
2409 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2413 bool encrypted_data
= (cardAUTHKEY
!= 0xFF) ;
2415 if(encrypted_data
) {
2417 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2420 if (len
== 4 && (receivedCmd
[0] == 0x60 || receivedCmd
[0] == 0x61)) {
2421 authTimer
= GetTickCount();
2422 cardAUTHSC
= receivedCmd
[1] / 4; // received block num
2423 cardAUTHKEY
= receivedCmd
[0] - 0x60;
2424 crypto1_destroy(pcs
);//Added by martin
2425 crypto1_create(pcs
, emlGetKey(cardAUTHSC
, cardAUTHKEY
));
2427 if (!encrypted_data
) { // first authentication
2428 if (MF_DBGLEVEL
>= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd
[1] ,receivedCmd
[1],cardAUTHKEY
);
2430 crypto1_word(pcs
, cuid
^ nonce
, 0);//Update crypto state
2431 num_to_bytes(nonce
, 4, rAUTH_AT
); // Send nonce
2432 } else { // nested authentication
2433 if (MF_DBGLEVEL
>= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd
[1] ,receivedCmd
[1],cardAUTHKEY
);
2434 ans
= nonce
^ crypto1_word(pcs
, cuid
^ nonce
, 0);
2435 num_to_bytes(ans
, 4, rAUTH_AT
);
2437 EmSendCmd(rAUTH_AT
, sizeof(rAUTH_AT
));
2438 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2439 cardSTATE
= MFEMUL_AUTH1
;
2443 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2444 // BUT... ACK --> NACK
2445 if (len
== 1 && receivedCmd
[0] == CARD_ACK
) {
2446 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2450 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2451 if (len
== 1 && receivedCmd
[0] == CARD_NACK_NA
) {
2452 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2457 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2461 if(receivedCmd
[0] == 0x30 // read block
2462 || receivedCmd
[0] == 0xA0 // write block
2463 || receivedCmd
[0] == 0xC0 // inc
2464 || receivedCmd
[0] == 0xC1 // dec
2465 || receivedCmd
[0] == 0xC2 // restore
2466 || receivedCmd
[0] == 0xB0) { // transfer
2467 if (receivedCmd
[1] >= 16 * 4) {
2468 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2469 if (MF_DBGLEVEL
>= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd
[0],receivedCmd
[1],receivedCmd
[1]);
2473 if (receivedCmd
[1] / 4 != cardAUTHSC
) {
2474 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2475 if (MF_DBGLEVEL
>= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd
[0],receivedCmd
[1],cardAUTHSC
);
2480 if (receivedCmd
[0] == 0x30) {
2481 if (MF_DBGLEVEL
>= 4) {
2482 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd
[1],receivedCmd
[1]);
2484 emlGetMem(response
, receivedCmd
[1], 1);
2485 AppendCrc14443a(response
, 16);
2486 mf_crypto1_encrypt(pcs
, response
, 18, response_par
);
2487 EmSendCmdPar(response
, 18, response_par
);
2489 if(exitAfterNReads
> 0 && numReads
== exitAfterNReads
) {
2490 Dbprintf("%d reads done, exiting", numReads
);
2496 if (receivedCmd
[0] == 0xA0) {
2497 if (MF_DBGLEVEL
>= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd
[1],receivedCmd
[1]);
2498 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2499 cardSTATE
= MFEMUL_WRITEBL2
;
2500 cardWRBL
= receivedCmd
[1];
2503 // increment, decrement, restore
2504 if (receivedCmd
[0] == 0xC0 || receivedCmd
[0] == 0xC1 || receivedCmd
[0] == 0xC2) {
2505 if (MF_DBGLEVEL
>= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd
[0],receivedCmd
[1],receivedCmd
[1]);
2506 if (emlCheckValBl(receivedCmd
[1])) {
2507 if (MF_DBGLEVEL
>= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
2508 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2511 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2512 if (receivedCmd
[0] == 0xC1)
2513 cardSTATE
= MFEMUL_INTREG_INC
;
2514 if (receivedCmd
[0] == 0xC0)
2515 cardSTATE
= MFEMUL_INTREG_DEC
;
2516 if (receivedCmd
[0] == 0xC2)
2517 cardSTATE
= MFEMUL_INTREG_REST
;
2518 cardWRBL
= receivedCmd
[1];
2522 if (receivedCmd
[0] == 0xB0) {
2523 if (MF_DBGLEVEL
>= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd
[0],receivedCmd
[1],receivedCmd
[1]);
2524 if (emlSetValBl(cardINTREG
, cardINTBLOCK
, receivedCmd
[1]))
2525 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2527 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2531 if (receivedCmd
[0] == 0x50 && receivedCmd
[1] == 0x00) {
2534 cardSTATE
= MFEMUL_HALTED
;
2535 if (MF_DBGLEVEL
>= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer
);
2536 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2540 if (receivedCmd
[0] == 0xe0) {//RATS
2541 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2544 // command not allowed
2545 if (MF_DBGLEVEL
>= 4) Dbprintf("Received command not allowed, nacking");
2546 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2549 case MFEMUL_WRITEBL2
:{
2551 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2552 emlSetMem(receivedCmd
, cardWRBL
, 1);
2553 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_ACK
));
2554 cardSTATE
= MFEMUL_WORK
;
2556 cardSTATE_TO_IDLE();
2557 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2562 case MFEMUL_INTREG_INC
:{
2563 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2564 memcpy(&ans
, receivedCmd
, 4);
2565 if (emlGetValBl(&cardINTREG
, &cardINTBLOCK
, cardWRBL
)) {
2566 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2567 cardSTATE_TO_IDLE();
2570 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2571 cardINTREG
= cardINTREG
+ ans
;
2572 cardSTATE
= MFEMUL_WORK
;
2575 case MFEMUL_INTREG_DEC
:{
2576 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2577 memcpy(&ans
, receivedCmd
, 4);
2578 if (emlGetValBl(&cardINTREG
, &cardINTBLOCK
, cardWRBL
)) {
2579 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2580 cardSTATE_TO_IDLE();
2583 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2584 cardINTREG
= cardINTREG
- ans
;
2585 cardSTATE
= MFEMUL_WORK
;
2588 case MFEMUL_INTREG_REST
:{
2589 mf_crypto1_decrypt(pcs
, receivedCmd
, len
);
2590 memcpy(&ans
, receivedCmd
, 4);
2591 if (emlGetValBl(&cardINTREG
, &cardINTBLOCK
, cardWRBL
)) {
2592 EmSend4bit(mf_crypto1_encrypt4bit(pcs
, CARD_NACK_NA
));
2593 cardSTATE_TO_IDLE();
2596 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, TRUE
);
2597 cardSTATE
= MFEMUL_WORK
;
2603 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
2606 if(flags
& FLAG_INTERACTIVE
)// Interactive mode flag, means we need to send ACK
2608 //May just aswell send the collected ar_nr in the response aswell
2609 cmd_send(CMD_ACK
,CMD_SIMULATE_MIFARE_CARD
,0,0,&ar_nr_responses
,ar_nr_collected
*4*4);
2612 if(flags
& FLAG_NR_AR_ATTACK
)
2614 if(ar_nr_collected
> 1) {
2615 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
2616 Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
2617 ar_nr_responses
[0], // UID
2618 ar_nr_responses
[1], //NT
2619 ar_nr_responses
[2], //AR1
2620 ar_nr_responses
[3], //NR1
2621 ar_nr_responses
[6], //AR2
2622 ar_nr_responses
[7] //NR2
2625 Dbprintf("Failed to obtain two AR/NR pairs!");
2626 if(ar_nr_collected
>0) {
2627 Dbprintf("Only got these: UID=%08x, nonce=%08x, AR1=%08x, NR1=%08x",
2628 ar_nr_responses
[0], // UID
2629 ar_nr_responses
[1], //NT
2630 ar_nr_responses
[2], //AR1
2631 ar_nr_responses
[3] //NR1
2636 if (MF_DBGLEVEL
>= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing
, traceLen
);
2641 //-----------------------------------------------------------------------------
2644 //-----------------------------------------------------------------------------
2645 void RAMFUNC
SniffMifare(uint8_t param
) {
2647 // bit 0 - trigger from first card answer
2648 // bit 1 - trigger from first reader 7-bit request
2650 // C(red) A(yellow) B(green)
2652 // init trace buffer
2653 iso14a_clear_trace();
2654 iso14a_set_tracing(TRUE
);
2656 // The command (reader -> tag) that we're receiving.
2657 // The length of a received command will in most cases be no more than 18 bytes.
2658 // So 32 should be enough!
2659 uint8_t *receivedCmd
= (((uint8_t *)BigBuf
) + RECV_CMD_OFFSET
);
2660 uint8_t *receivedCmdPar
= ((uint8_t *)BigBuf
) + RECV_CMD_PAR_OFFSET
;
2661 // The response (tag -> reader) that we're receiving.
2662 uint8_t *receivedResponse
= (((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
);
2663 uint8_t *receivedResponsePar
= ((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
;
2665 // As we receive stuff, we copy it from receivedCmd or receivedResponse
2666 // into trace, along with its length and other annotations.
2667 //uint8_t *trace = (uint8_t *)BigBuf;
2669 // The DMA buffer, used to stream samples from the FPGA
2670 uint8_t *dmaBuf
= ((uint8_t *)BigBuf
) + DMA_BUFFER_OFFSET
;
2671 uint8_t *data
= dmaBuf
;
2672 uint8_t previous_data
= 0;
2675 bool ReaderIsActive
= FALSE
;
2676 bool TagIsActive
= FALSE
;
2678 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER
);
2680 // Set up the demodulator for tag -> reader responses.
2681 DemodInit(receivedResponse
, receivedResponsePar
);
2683 // Set up the demodulator for the reader -> tag commands
2684 UartInit(receivedCmd
, receivedCmdPar
);
2686 // Setup for the DMA.
2687 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
); // set transfer address and number of bytes. Start transfer.
2694 // And now we loop, receiving samples.
2695 for(uint32_t sniffCounter
= 0; TRUE
; ) {
2697 if(BUTTON_PRESS()) {
2698 DbpString("cancelled by button");
2705 if ((sniffCounter
& 0x0000FFFF) == 0) { // from time to time
2706 // check if a transaction is completed (timeout after 2000ms).
2707 // if yes, stop the DMA transfer and send what we have so far to the client
2708 if (MfSniffSend(2000)) {
2709 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2713 ReaderIsActive
= FALSE
;
2714 TagIsActive
= FALSE
;
2715 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
); // set transfer address and number of bytes. Start transfer.
2719 int register readBufDataP
= data
- dmaBuf
; // number of bytes we have processed so far
2720 int register dmaBufDataP
= DMA_BUFFER_SIZE
- AT91C_BASE_PDC_SSC
->PDC_RCR
; // number of bytes already transferred
2721 if (readBufDataP
<= dmaBufDataP
){ // we are processing the same block of data which is currently being transferred
2722 dataLen
= dmaBufDataP
- readBufDataP
; // number of bytes still to be processed
2724 dataLen
= DMA_BUFFER_SIZE
- readBufDataP
+ dmaBufDataP
; // number of bytes still to be processed
2726 // test for length of buffer
2727 if(dataLen
> maxDataLen
) { // we are more behind than ever...
2728 maxDataLen
= dataLen
;
2730 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen
);
2734 if(dataLen
< 1) continue;
2736 // primary buffer was stopped ( <-- we lost data!
2737 if (!AT91C_BASE_PDC_SSC
->PDC_RCR
) {
2738 AT91C_BASE_PDC_SSC
->PDC_RPR
= (uint32_t) dmaBuf
;
2739 AT91C_BASE_PDC_SSC
->PDC_RCR
= DMA_BUFFER_SIZE
;
2740 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen
); // temporary
2742 // secondary buffer sets as primary, secondary buffer was stopped
2743 if (!AT91C_BASE_PDC_SSC
->PDC_RNCR
) {
2744 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
;
2745 AT91C_BASE_PDC_SSC
->PDC_RNCR
= DMA_BUFFER_SIZE
;
2750 if (sniffCounter
& 0x01) {
2752 if(!TagIsActive
) { // no need to try decoding tag data if the reader is sending
2753 uint8_t readerdata
= (previous_data
& 0xF0) | (*data
>> 4);
2754 if(MillerDecoding(readerdata
, (sniffCounter
-1)*4)) {
2756 if (MfSniffLogic(receivedCmd
, Uart
.len
, Uart
.parity
, Uart
.bitCount
, TRUE
)) break;
2758 /* And ready to receive another command. */
2761 /* And also reset the demod code */
2764 ReaderIsActive
= (Uart
.state
!= STATE_UNSYNCD
);
2767 if(!ReaderIsActive
) { // no need to try decoding tag data if the reader is sending
2768 uint8_t tagdata
= (previous_data
<< 4) | (*data
& 0x0F);
2769 if(ManchesterDecoding(tagdata
, 0, (sniffCounter
-1)*4)) {
2772 if (MfSniffLogic(receivedResponse
, Demod
.len
, Demod
.parity
, Demod
.bitCount
, FALSE
)) break;
2774 // And ready to receive another response.
2777 TagIsActive
= (Demod
.state
!= DEMOD_UNSYNCD
);
2781 previous_data
= *data
;
2784 if(data
== dmaBuf
+ DMA_BUFFER_SIZE
) {
2790 DbpString("COMMAND FINISHED");
2792 FpgaDisableSscDma();
2795 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen
, Uart
.state
, Uart
.len
);