cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443b.c

   1 //-----------------------------------------------------------------------------
   2 // Jonathan Westhues, split Nov 2006
   3 // piwi 2018
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // Routines to support ISO 14443B. This includes both the reader software and
  10 // the `fake tag' modes.
  11 //-----------------------------------------------------------------------------
  12
  13 #include "iso14443b.h"
  14
  15 #include "proxmark3.h"
  16 #include "apps.h"
  17 #include "util.h"
  18 #include "string.h"
  19 #include "iso14443crc.h"
  20 #include "fpgaloader.h"
  21
  22 #define RECEIVE_SAMPLES_TIMEOUT 1000 // TR0 max is 256/fs = 256/(848kHz) = 302us or 64 samples from FPGA. 1000 seems to be much too high?
  23 #define ISO14443B_DMA_BUFFER_SIZE 128
  24
  25 // PCB Block number for APDUs
  26 static uint8_t pcb_blocknum = 0;
  27
  28 //=============================================================================
  29 // An ISO 14443 Type B tag. We listen for commands from the reader, using
  30 // a UART kind of thing that's implemented in software. When we get a
  31 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
  32 // If it's good, then we can do something appropriate with it, and send
  33 // a response.
  34 //=============================================================================
  35
  36 //-----------------------------------------------------------------------------
  37 // Code up a string of octets at layer 2 (including CRC, we don't generate
  38 // that here) so that they can be transmitted to the reader. Doesn't transmit
  39 // them yet, just leaves them ready to send in ToSend[].
  40 //-----------------------------------------------------------------------------
  41 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
  42 {
  43         int i;
  44
  45         ToSendReset();
  46
  47         // Transmit a burst of ones, as the initial thing that lets the
  48         // reader get phase sync. This (TR1) must be > 80/fs, per spec,
  49         // but tag that I've tried (a Paypass) exceeds that by a fair bit,
  50         // so I will too.
  51         for(i = 0; i < 20; i++) {
  52                 ToSendStuffBit(1);
  53                 ToSendStuffBit(1);
  54                 ToSendStuffBit(1);
  55                 ToSendStuffBit(1);
  56         }
  57
  58         // Send SOF.
  59         for(i = 0; i < 10; i++) {
  60                 ToSendStuffBit(0);
  61                 ToSendStuffBit(0);
  62                 ToSendStuffBit(0);
  63                 ToSendStuffBit(0);
  64         }
  65         for(i = 0; i < 2; i++) {
  66                 ToSendStuffBit(1);
  67                 ToSendStuffBit(1);
  68                 ToSendStuffBit(1);
  69                 ToSendStuffBit(1);
  70         }
  71
  72         for(i = 0; i < len; i++) {
  73                 int j;
  74                 uint8_t b = cmd[i];
  75
  76                 // Start bit
  77                 ToSendStuffBit(0);
  78                 ToSendStuffBit(0);
  79                 ToSendStuffBit(0);
  80                 ToSendStuffBit(0);
  81
  82                 // Data bits
  83                 for(j = 0; j < 8; j++) {
  84                         if(b & 1) {
  85                                 ToSendStuffBit(1);
  86                                 ToSendStuffBit(1);
  87                                 ToSendStuffBit(1);
  88                                 ToSendStuffBit(1);
  89                         } else {
  90                                 ToSendStuffBit(0);
  91                                 ToSendStuffBit(0);
  92                                 ToSendStuffBit(0);
  93                                 ToSendStuffBit(0);
  94                         }
  95                         b >>= 1;
  96                 }
  97
  98                 // Stop bit
  99                 ToSendStuffBit(1);
 100                 ToSendStuffBit(1);
 101                 ToSendStuffBit(1);
 102                 ToSendStuffBit(1);
 103         }
 104
 105         // Send EOF.
 106         for(i = 0; i < 10; i++) {
 107                 ToSendStuffBit(0);
 108                 ToSendStuffBit(0);
 109                 ToSendStuffBit(0);
 110                 ToSendStuffBit(0);
 111         }
 112         for(i = 0; i < 2; i++) {
 113                 ToSendStuffBit(1);
 114                 ToSendStuffBit(1);
 115                 ToSendStuffBit(1);
 116                 ToSendStuffBit(1);
 117         }
 118
 119         // Convert from last byte pos to length
 120         ToSendMax++;
 121 }
 122
 123 //-----------------------------------------------------------------------------
 124 // The software UART that receives commands from the reader, and its state
 125 // variables.
 126 //-----------------------------------------------------------------------------
 127 static struct {
 128         enum {
 129                 STATE_UNSYNCD,
 130                 STATE_GOT_FALLING_EDGE_OF_SOF,
 131                 STATE_AWAITING_START_BIT,
 132                 STATE_RECEIVING_DATA
 133         }       state;
 134         uint16_t    shiftReg;
 135         int     bitCnt;
 136         int     byteCnt;
 137         int     byteCntMax;
 138         int     posCnt;
 139         uint8_t   *output;
 140 } Uart;
 141
 142 /* Receive & handle a bit coming from the reader.
 143  *
 144  * This function is called 4 times per bit (every 2 subcarrier cycles).
 145  * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
 146  *
 147  * LED handling:
 148  * LED A -> ON once we have received the SOF and are expecting the rest.
 149  * LED A -> OFF once we have received EOF or are in error state or unsynced
 150  *
 151  * Returns: true if we received a EOF
 152  *          false if we are still waiting for some more
 153  */
 154 static RAMFUNC int Handle14443bUartBit(uint8_t bit)
 155 {
 156         switch(Uart.state) {
 157                 case STATE_UNSYNCD:
 158                         if(!bit) {
 159                                 // we went low, so this could be the beginning
 160                                 // of an SOF
 161                                 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
 162                                 Uart.posCnt = 0;
 163                                 Uart.bitCnt = 0;
 164                         }
 165                         break;
 166
 167                 case STATE_GOT_FALLING_EDGE_OF_SOF:
 168                         Uart.posCnt++;
 169                         if(Uart.posCnt == 2) {  // sample every 4 1/fs in the middle of a bit
 170                                 if(bit) {
 171                                         if(Uart.bitCnt > 9) {
 172                                                 // we've seen enough consecutive
 173                                                 // zeros that it's a valid SOF
 174                                                 Uart.posCnt = 0;
 175                                                 Uart.byteCnt = 0;
 176                                                 Uart.state = STATE_AWAITING_START_BIT;
 177                                                 LED_A_ON(); // Indicate we got a valid SOF
 178                                         } else {
 179                                                 // didn't stay down long enough
 180                                                 // before going high, error
 181                                                 Uart.state = STATE_UNSYNCD;
 182                                         }
 183                                 } else {
 184                                         // do nothing, keep waiting
 185                                 }
 186                                 Uart.bitCnt++;
 187                         }
 188                         if(Uart.posCnt >= 4) Uart.posCnt = 0;
 189                         if(Uart.bitCnt > 12) {
 190                                 // Give up if we see too many zeros without
 191                                 // a one, too.
 192                                 LED_A_OFF();
 193                                 Uart.state = STATE_UNSYNCD;
 194                         }
 195                         break;
 196
 197                 case STATE_AWAITING_START_BIT:
 198                         Uart.posCnt++;
 199                         if(bit) {
 200                                 if(Uart.posCnt > 50/2) {        // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
 201                                         // stayed high for too long between
 202                                         // characters, error
 203                                         Uart.state = STATE_UNSYNCD;
 204                                 }
 205                         } else {
 206                                 // falling edge, this starts the data byte
 207                                 Uart.posCnt = 0;
 208                                 Uart.bitCnt = 0;
 209                                 Uart.shiftReg = 0;
 210                                 Uart.state = STATE_RECEIVING_DATA;
 211                         }
 212                         break;
 213
 214                 case STATE_RECEIVING_DATA:
 215                         Uart.posCnt++;
 216                         if(Uart.posCnt == 2) {
 217                                 // time to sample a bit
 218                                 Uart.shiftReg >>= 1;
 219                                 if(bit) {
 220                                         Uart.shiftReg |= 0x200;
 221                                 }
 222                                 Uart.bitCnt++;
 223                         }
 224                         if(Uart.posCnt >= 4) {
 225                                 Uart.posCnt = 0;
 226                         }
 227                         if(Uart.bitCnt == 10) {
 228                                 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
 229                                 {
 230                                         // this is a data byte, with correct
 231                                         // start and stop bits
 232                                         Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
 233                                         Uart.byteCnt++;
 234
 235                                         if(Uart.byteCnt >= Uart.byteCntMax) {
 236                                                 // Buffer overflowed, give up
 237                                                 LED_A_OFF();
 238                                                 Uart.state = STATE_UNSYNCD;
 239                                         } else {
 240                                                 // so get the next byte now
 241                                                 Uart.posCnt = 0;
 242                                                 Uart.state = STATE_AWAITING_START_BIT;
 243                                         }
 244                                 } else if (Uart.shiftReg == 0x000) {
 245                                         // this is an EOF byte
 246                                         LED_A_OFF(); // Finished receiving
 247                                         Uart.state = STATE_UNSYNCD;
 248                                         if (Uart.byteCnt != 0) {
 249                                                 return true;
 250                                         }
 251                                 } else {
 252                                         // this is an error
 253                                         LED_A_OFF();
 254                                         Uart.state = STATE_UNSYNCD;
 255                                 }
 256                         }
 257                         break;
 258
 259                 default:
 260                         LED_A_OFF();
 261                         Uart.state = STATE_UNSYNCD;
 262                         break;
 263         }
 264
 265         return false;
 266 }
 267
 268
 269 static void UartReset()
 270 {
 271         Uart.byteCntMax = MAX_FRAME_SIZE;
 272         Uart.state = STATE_UNSYNCD;
 273         Uart.byteCnt = 0;
 274         Uart.bitCnt = 0;
 275 }
 276
 277
 278 static void UartInit(uint8_t *data)
 279 {
 280         Uart.output = data;
 281         UartReset();
 282 }
 283
 284
 285 //-----------------------------------------------------------------------------
 286 // Receive a command (from the reader to us, where we are the simulated tag),
 287 // and store it in the given buffer, up to the given maximum length. Keeps
 288 // spinning, waiting for a well-framed command, until either we get one
 289 // (returns true) or someone presses the pushbutton on the board (false).
 290 //
 291 // Assume that we're called with the SSC (to the FPGA) and ADC path set
 292 // correctly.
 293 //-----------------------------------------------------------------------------
 294 static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len)
 295 {
 296         // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
 297         // only, since we are receiving, not transmitting).
 298         // Signal field is off with the appropriate LED
 299         LED_D_OFF();
 300         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
 301
 302         // Now run a `software UART' on the stream of incoming samples.
 303         UartInit(received);
 304
 305         for(;;) {
 306                 WDT_HIT();
 307
 308                 if(BUTTON_PRESS()) return false;
 309
 310                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 311                         uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 312                         for(uint8_t mask = 0x80; mask != 0x00; mask >>= 1) {
 313                                 if(Handle14443bUartBit(b & mask)) {
 314                                         *len = Uart.byteCnt;
 315                                         return true;
 316                                 }
 317                         }
 318                 }
 319         }
 320
 321         return false;
 322 }
 323
 324 //-----------------------------------------------------------------------------
 325 // Main loop of simulated tag: receive commands from reader, decide what
 326 // response to send, and send it.
 327 //-----------------------------------------------------------------------------
 328 void SimulateIso14443bTag(void)
 329 {
 330         // the only commands we understand is WUPB, AFI=0, Select All, N=1:
 331         static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB
 332         // ... and REQB, AFI=0, Normal Request, N=1:
 333         static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB
 334         // ... and HLTB
 335         static const uint8_t cmd3[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB
 336         // ... and ATTRIB
 337         static const uint8_t cmd4[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB
 338
 339         // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
 340         // supports only 106kBit/s in both directions, max frame size = 32Bytes,
 341         // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
 342         static const uint8_t response1[] = {
 343                 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
 344                 0x00, 0x21, 0x85, 0x5e, 0xd7
 345         };
 346         // response to HLTB and ATTRIB
 347         static const uint8_t response2[] = {0x00, 0x78, 0xF0};
 348
 349
 350         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 351
 352         clear_trace();
 353         set_tracing(true);
 354
 355         const uint8_t *resp;
 356         uint8_t *respCode;
 357         uint16_t respLen, respCodeLen;
 358
 359         // allocate command receive buffer
 360         BigBuf_free();
 361         uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
 362
 363         uint16_t len;
 364         uint16_t cmdsRecvd = 0;
 365
 366         // prepare the (only one) tag answer:
 367         CodeIso14443bAsTag(response1, sizeof(response1));
 368         uint8_t *resp1Code = BigBuf_malloc(ToSendMax);
 369         memcpy(resp1Code, ToSend, ToSendMax);
 370         uint16_t resp1CodeLen = ToSendMax;
 371
 372         // prepare the (other) tag answer:
 373         CodeIso14443bAsTag(response2, sizeof(response2));
 374         uint8_t *resp2Code = BigBuf_malloc(ToSendMax);
 375         memcpy(resp2Code, ToSend, ToSendMax);
 376         uint16_t resp2CodeLen = ToSendMax;
 377
 378         // We need to listen to the high-frequency, peak-detected path.
 379         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 380         FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
 381
 382         cmdsRecvd = 0;
 383
 384         for(;;) {
 385
 386                 if(!GetIso14443bCommandFromReader(receivedCmd, &len)) {
 387                         Dbprintf("button pressed, received %d commands", cmdsRecvd);
 388                         break;
 389                 }
 390
 391                 LogTrace(receivedCmd, len, 0, 0, NULL, true);
 392
 393                 // Good, look at the command now.
 394                 if ( (len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0)
 395                         || (len == sizeof(cmd2) && memcmp(receivedCmd, cmd2, len) == 0) ) {
 396                         resp = response1;
 397                         respLen = sizeof(response1);
 398                         respCode = resp1Code;
 399                         respCodeLen = resp1CodeLen;
 400                 } else if ( (len == sizeof(cmd3) && receivedCmd[0] == cmd3[0])
 401                         || (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) ) {
 402                         resp = response2;
 403                         respLen = sizeof(response2);
 404                         respCode = resp2Code;
 405                         respCodeLen = resp2CodeLen;
 406                 } else {
 407                         Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
 408                         // And print whether the CRC fails, just for good measure
 409                         uint8_t b1, b2;
 410                         if (len >= 3){ // if crc exists
 411                                 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
 412                                 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
 413                                         // Not so good, try again.
 414                                         DbpString("+++CRC fail");
 415
 416                                 } else {
 417                                         DbpString("CRC passes");
 418                                 }
 419                         }
 420                         //get rid of compiler warning
 421                         respCodeLen = 0;
 422                         resp = response1;
 423                         respLen = 0;
 424                         respCode = resp1Code;
 425                         //don't crash at new command just wait and see if reader will send other new cmds.
 426                         //break;
 427                 }
 428
 429                 cmdsRecvd++;
 430
 431                 if(cmdsRecvd > 0x30) {
 432                         DbpString("many commands later...");
 433                         break;
 434                 }
 435
 436                 if(respCodeLen <= 0) continue;
 437
 438                 // Modulate BPSK
 439                 // Signal field is off with the appropriate LED
 440                 LED_D_OFF();
 441                 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
 442                 AT91C_BASE_SSC->SSC_THR = 0xff;
 443                 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
 444
 445                 // Transmit the response.
 446                 uint16_t i = 0;
 447                 for(;;) {
 448                         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 449                                 uint8_t b = respCode[i];
 450
 451                                 AT91C_BASE_SSC->SSC_THR = b;
 452
 453                                 i++;
 454                                 if(i > respCodeLen) {
 455                                         break;
 456                                 }
 457                         }
 458                         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 459                                 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 460                                 (void)b;
 461                         }
 462                 }
 463
 464                 // trace the response:
 465                 LogTrace(resp, respLen, 0, 0, NULL, false);
 466
 467         }
 468 }
 469
 470 //=============================================================================
 471 // An ISO 14443 Type B reader. We take layer two commands, code them
 472 // appropriately, and then send them to the tag. We then listen for the
 473 // tag's response, which we leave in the buffer to be demodulated on the
 474 // PC side.
 475 //=============================================================================
 476
 477 static struct {
 478         enum {
 479                 DEMOD_UNSYNCD,
 480                 DEMOD_PHASE_REF_TRAINING,
 481                 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
 482                 DEMOD_GOT_FALLING_EDGE_OF_SOF,
 483                 DEMOD_AWAITING_START_BIT,
 484                 DEMOD_RECEIVING_DATA
 485         }       state;
 486         int     bitCount;
 487         int     posCount;
 488         int     thisBit;
 489 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
 490         int     metric;
 491         int     metricN;
 492 */
 493         uint16_t    shiftReg;
 494         uint8_t   *output;
 495         int     len;
 496         int     sumI;
 497         int     sumQ;
 498 } Demod;
 499
 500 /*
 501  * Handles reception of a bit from the tag
 502  *
 503  * This function is called 2 times per bit (every 4 subcarrier cycles).
 504  * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
 505  *
 506  * LED handling:
 507  * LED C -> ON once we have received the SOF and are expecting the rest.
 508  * LED C -> OFF once we have received EOF or are unsynced
 509  *
 510  * Returns: true if we received a EOF
 511  *          false if we are still waiting for some more
 512  *
 513  */
 514 static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 515 {
 516         int v;
 517
 518 // The soft decision on the bit uses an estimate of just the
 519 // quadrant of the reference angle, not the exact angle.
 520 #define MAKE_SOFT_DECISION() { \
 521                 if(Demod.sumI > 0) { \
 522                         v = ci; \
 523                 } else { \
 524                         v = -ci; \
 525                 } \
 526                 if(Demod.sumQ > 0) { \
 527                         v += cq; \
 528                 } else { \
 529                         v -= cq; \
 530                 } \
 531         }
 532
 533 #define SUBCARRIER_DETECT_THRESHOLD     8
 534
 535 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
 536 #define AMPLITUDE(ci,cq) (MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2))
 537         switch(Demod.state) {
 538                 case DEMOD_UNSYNCD:
 539                         if(AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) {    // subcarrier detected
 540                                 Demod.state = DEMOD_PHASE_REF_TRAINING;
 541                                 Demod.sumI = ci;
 542                                 Demod.sumQ = cq;
 543                                 Demod.posCount = 1;
 544                                 }
 545                         break;
 546
 547                 case DEMOD_PHASE_REF_TRAINING:
 548                         if(Demod.posCount < 8) {
 549                                 if (AMPLITUDE(ci,cq) > SUBCARRIER_DETECT_THRESHOLD) {
 550                                         // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
 551                                         // note: synchronization time > 80 1/fs
 552                                         Demod.sumI += ci;
 553                                         Demod.sumQ += cq;
 554                                         Demod.posCount++;
 555                                 } else {                // subcarrier lost
 556                                         Demod.state = DEMOD_UNSYNCD;
 557                                 }
 558                         } else {
 559                                 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
 560                         }
 561                         break;
 562
 563                 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
 564                         MAKE_SOFT_DECISION();
 565                         if(v < 0) {     // logic '0' detected
 566                                 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
 567                                 Demod.posCount = 0;     // start of SOF sequence
 568                         } else {
 569                                 if(Demod.posCount > 200/4) {    // maximum length of TR1 = 200 1/fs
 570                                         Demod.state = DEMOD_UNSYNCD;
 571                                 }
 572                         }
 573                         Demod.posCount++;
 574                         break;
 575
 576                 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
 577                         Demod.posCount++;
 578                         MAKE_SOFT_DECISION();
 579                         if(v > 0) {
 580                                 if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
 581                                         Demod.state = DEMOD_UNSYNCD;
 582                                 } else {
 583                                         LED_C_ON(); // Got SOF
 584                                         Demod.state = DEMOD_AWAITING_START_BIT;
 585                                         Demod.posCount = 0;
 586                                         Demod.len = 0;
 587 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
 588                                         Demod.metricN = 0;
 589                                         Demod.metric = 0;
 590 */
 591                                 }
 592                         } else {
 593                                 if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu)
 594                                         Demod.state = DEMOD_UNSYNCD;
 595                                         LED_C_OFF();
 596                                 }
 597                         }
 598                         break;
 599
 600                 case DEMOD_AWAITING_START_BIT:
 601                         Demod.posCount++;
 602                         MAKE_SOFT_DECISION();
 603                         if(v > 0) {
 604                                 if(Demod.posCount > 3*2) {              // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
 605                                         Demod.state = DEMOD_UNSYNCD;
 606                                         LED_C_OFF();
 607                                 }
 608                         } else {                                                        // start bit detected
 609                                 Demod.bitCount = 0;
 610                                 Demod.posCount = 1;                             // this was the first half
 611                                 Demod.thisBit = v;
 612                                 Demod.shiftReg = 0;
 613                                 Demod.state = DEMOD_RECEIVING_DATA;
 614                         }
 615                         break;
 616
 617                 case DEMOD_RECEIVING_DATA:
 618                         MAKE_SOFT_DECISION();
 619                         if(Demod.posCount == 0) {                       // first half of bit
 620                                 Demod.thisBit = v;
 621                                 Demod.posCount = 1;
 622                         } else {                                                        // second half of bit
 623                                 Demod.thisBit += v;
 624
 625 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
 626                                 if(Demod.thisBit > 0) {
 627                                         Demod.metric += Demod.thisBit;
 628                                 } else {
 629                                         Demod.metric -= Demod.thisBit;
 630                                 }
 631                                 (Demod.metricN)++;
 632 */
 633
 634                                 Demod.shiftReg >>= 1;
 635                                 if(Demod.thisBit > 0) { // logic '1'
 636                                         Demod.shiftReg |= 0x200;
 637                                 }
 638
 639                                 Demod.bitCount++;
 640                                 if(Demod.bitCount == 10) {
 641                                         uint16_t s = Demod.shiftReg;
 642                                         if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'
 643                                                 uint8_t b = (s >> 1);
 644                                                 Demod.output[Demod.len] = b;
 645                                                 Demod.len++;
 646                                                 Demod.state = DEMOD_AWAITING_START_BIT;
 647                                         } else {
 648                                                 Demod.state = DEMOD_UNSYNCD;
 649                                                 LED_C_OFF();
 650                                                 if(s == 0x000) {
 651                                                         // This is EOF (start, stop and all data bits == '0'
 652                                                         return true;
 653                                                 }
 654                                         }
 655                                 }
 656                                 Demod.posCount = 0;
 657                         }
 658                         break;
 659
 660                 default:
 661                         Demod.state = DEMOD_UNSYNCD;
 662                         LED_C_OFF();
 663                         break;
 664         }
 665
 666         return false;
 667 }
 668
 669
 670 static void DemodReset()
 671 {
 672         // Clear out the state of the "UART" that receives from the tag.
 673         Demod.len = 0;
 674         Demod.state = DEMOD_UNSYNCD;
 675         Demod.posCount = 0;
 676         memset(Demod.output, 0x00, MAX_FRAME_SIZE);
 677 }
 678
 679
 680 static void DemodInit(uint8_t *data)
 681 {
 682         Demod.output = data;
 683         DemodReset();
 684 }
 685
 686
 687 /*
 688  *  Demodulate the samples we received from the tag, also log to tracebuffer
 689  *  quiet: set to 'true' to disable debug output
 690  */
 691 static void GetSamplesFor14443bDemod(int n, bool quiet)
 692 {
 693         int maxBehindBy = 0;
 694         bool gotFrame = false;
 695         int lastRxCounter, samples = 0;
 696         int8_t ci, cq;
 697
 698         // Allocate memory from BigBuf for some buffers
 699         // free all previous allocations first
 700         BigBuf_free();
 701
 702         // The response (tag -> reader) that we're receiving.
 703         uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
 704
 705         // The DMA buffer, used to stream samples from the FPGA
 706         uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));
 707
 708         // Set up the demodulator for tag -> reader responses.
 709         DemodInit(receivedResponse);
 710
 711         // wait for last transfer to complete
 712         while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY))
 713
 714         // Setup and start DMA.
 715         FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 716         FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
 717
 718         uint16_t *upTo = dmaBuf;
 719         lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
 720
 721         // Signal field is ON with the appropriate LED:
 722         LED_D_ON();
 723         // And put the FPGA in the appropriate mode
 724         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 725
 726         for(;;) {
 727                 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
 728                 if(behindBy > maxBehindBy) {
 729                         maxBehindBy = behindBy;
 730                 }
 731
 732                 if(behindBy < 1) continue;
 733
 734                 ci = *upTo >> 8;
 735                 cq = *upTo;
 736                 upTo++;
 737                 lastRxCounter--;
 738                 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {               // we have read all of the DMA buffer content.
 739                         upTo = dmaBuf;                                             // start reading the circular buffer from the beginning
 740                         lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
 741                 }
 742                 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.
 743                         AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and
 744                         AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;  // DMA Next Counter registers
 745                 }
 746                 samples++;
 747
 748                 if(Handle14443bSamplesDemod(ci, cq)) {
 749                         gotFrame = true;
 750                         break;
 751                 }
 752
 753                 if(samples > n) {
 754                         break;
 755                 }
 756         }
 757
 758         FpgaDisableSscDma();
 759
 760         if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", maxBehindBy, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
 761         //Tracing
 762         if (Demod.len > 0) {
 763                 LogTrace(Demod.output, Demod.len, 0, 0, NULL, false);
 764         }
 765 }
 766
 767
 768 //-----------------------------------------------------------------------------
 769 // Transmit the command (to the tag) that was placed in ToSend[].
 770 //-----------------------------------------------------------------------------
 771 static void TransmitFor14443b(void)
 772 {
 773         int c;
 774
 775         FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
 776
 777         // Signal field is ON with the appropriate Red LED
 778         LED_D_ON();
 779         // Signal we are transmitting with the Green LED
 780         LED_B_ON();
 781         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
 782
 783         c = 0;
 784         for(;;) {
 785                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 786                         AT91C_BASE_SSC->SSC_THR = ~ToSend[c];
 787                         c++;
 788                         if(c >= ToSendMax) {
 789                                 break;
 790                         }
 791                 }
 792                 WDT_HIT();
 793         }
 794         LED_B_OFF(); // Finished sending
 795 }
 796
 797
 798 //-----------------------------------------------------------------------------
 799 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
 800 // so that it is ready to transmit to the tag using TransmitFor14443b().
 801 //-----------------------------------------------------------------------------
 802 static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
 803 {
 804         int i, j;
 805         uint8_t b;
 806
 807         ToSendReset();
 808
 809         // Send SOF
 810         for(i = 0; i < 10; i++) {
 811                 ToSendStuffBit(0);
 812         }
 813         ToSendStuffBit(1);
 814         ToSendStuffBit(1);
 815
 816         for(i = 0; i < len; i++) {
 817                 // Start bit
 818                 ToSendStuffBit(0);
 819                 // Data bits
 820                 b = cmd[i];
 821                 for(j = 0; j < 8; j++) {
 822                         if(b & 1) {
 823                                 ToSendStuffBit(1);
 824                         } else {
 825                                 ToSendStuffBit(0);
 826                         }
 827                         b >>= 1;
 828                 }
 829                 // Stop bit
 830                 ToSendStuffBit(1);
 831         }
 832
 833         // Send EOF
 834         for(i = 0; i < 10; i++) {
 835                 ToSendStuffBit(0);
 836         }
 837         ToSendStuffBit(1);
 838
 839         // ensure that last byte is filled up
 840         for(i = 0; i < 8; i++) {
 841                 ToSendStuffBit(1);
 842         }
 843
 844         // Convert from last character reference to length
 845         ToSendMax++;
 846 }
 847
 848
 849 /**
 850   Convenience function to encode, transmit and trace iso 14443b comms
 851   **/
 852 static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
 853 {
 854         CodeIso14443bAsReader(cmd, len);
 855         TransmitFor14443b();
 856         LogTrace(cmd,len, 0, 0, NULL, true);
 857 }
 858
 859 /* Sends an APDU to the tag
 860  * TODO: check CRC and preamble
 861  */
 862 int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response)
 863 {
 864         uint8_t message_frame[message_length + 4];
 865         // PCB
 866         message_frame[0] = 0x0A | pcb_blocknum;
 867         pcb_blocknum ^= 1;
 868         // CID
 869         message_frame[1] = 0;
 870         // INF
 871         memcpy(message_frame + 2, message, message_length);
 872         // EDC (CRC)
 873         ComputeCrc14443(CRC_14443_B, message_frame, message_length + 2, &message_frame[message_length + 2], &message_frame[message_length + 3]);
 874         // send
 875         CodeAndTransmit14443bAsReader(message_frame, message_length + 4);
 876         // get response
 877         GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
 878         if(Demod.len < 3)
 879         {
 880                 return 0;
 881         }
 882         // TODO: Check CRC
 883         // copy response contents
 884         if(response != NULL)
 885         {
 886                 memcpy(response, Demod.output, Demod.len);
 887         }
 888         return Demod.len;
 889 }
 890
 891 /* Perform the ISO 14443 B Card Selection procedure
 892  * Currently does NOT do any collision handling.
 893  * It expects 0-1 cards in the device's range.
 894  * TODO: Support multiple cards (perform anticollision)
 895  * TODO: Verify CRC checksums
 896  */
 897 int iso14443b_select_card()
 898 {
 899         // WUPB command (including CRC)
 900         // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state
 901         static const uint8_t wupb[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 902         // ATTRIB command (with space for CRC)
 903         uint8_t attrib[] = { 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00};
 904
 905         // first, wake up the tag
 906         CodeAndTransmit14443bAsReader(wupb, sizeof(wupb));
 907         GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
 908         // ATQB too short?
 909         if (Demod.len < 14)
 910         {
 911                 return 2;
 912         }
 913
 914     // select the tag
 915     // copy the PUPI to ATTRIB
 916     memcpy(attrib + 1, Demod.output + 1, 4);
 917     /* copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into
 918     ATTRIB (Param 3) */
 919     attrib[7] = Demod.output[10] & 0x0F;
 920     ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10);
 921     CodeAndTransmit14443bAsReader(attrib, sizeof(attrib));
 922     GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
 923     // Answer to ATTRIB too short?
 924     if(Demod.len < 3)
 925         {
 926                 return 2;
 927         }
 928         // reset PCB block number
 929         pcb_blocknum = 0;
 930         return 1;
 931 }
 932
 933 // Set up ISO 14443 Type B communication (similar to iso14443a_setup)
 934 void iso14443b_setup() {
 935         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 936         // Set up the synchronous serial port
 937         FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
 938         // connect Demodulated Signal to ADC:
 939         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 940
 941         // Signal field is on with the appropriate LED
 942     LED_D_ON();
 943         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
 944
 945         DemodReset();
 946         UartReset();
 947 }
 948
 949 //-----------------------------------------------------------------------------
 950 // Read a SRI512 ISO 14443B tag.
 951 //
 952 // SRI512 tags are just simple memory tags, here we're looking at making a dump
 953 // of the contents of the memory. No anticollision algorithm is done, we assume
 954 // we have a single tag in the field.
 955 //
 956 // I tried to be systematic and check every answer of the tag, every CRC, etc...
 957 //-----------------------------------------------------------------------------
 958 void ReadSTMemoryIso14443b(uint32_t dwLast)
 959 {
 960         uint8_t i = 0x00;
 961
 962         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 963         // Make sure that we start from off, since the tags are stateful;
 964         // confusing things will happen if we don't reset them between reads.
 965         LED_D_OFF();
 966         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 967         SpinDelay(200);
 968
 969         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 970         FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 971
 972         // Now give it time to spin up.
 973         // Signal field is on with the appropriate LED
 974         LED_D_ON();
 975         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 976         SpinDelay(200);
 977
 978         clear_trace();
 979         set_tracing(true);
 980
 981         // First command: wake up the tag using the INITIATE command
 982         uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
 983         CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
 984         GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
 985
 986         if (Demod.len == 0) {
 987                 DbpString("No response from tag");
 988                 LED_D_OFF();
 989                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 990                 return;
 991         } else {
 992                 Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
 993                                 Demod.output[0], Demod.output[1], Demod.output[2]);
 994         }
 995
 996         // There is a response, SELECT the uid
 997         DbpString("Now SELECT tag:");
 998         cmd1[0] = 0x0E; // 0x0E is SELECT
 999         cmd1[1] = Demod.output[0];
1000         ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1001         CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
1002         GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
1003         if (Demod.len != 3) {
1004                 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
1005                 LED_D_OFF();
1006                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1007                 return;
1008         }
1009         // Check the CRC of the answer:
1010         ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
1011         if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
1012                 DbpString("CRC Error reading select response.");
1013                 LED_D_OFF();
1014                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1015                 return;
1016         }
1017         // Check response from the tag: should be the same UID as the command we just sent:
1018         if (cmd1[1] != Demod.output[0]) {
1019                 Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
1020                 LED_D_OFF();
1021                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1022                 return;
1023         }
1024
1025         // Tag is now selected,
1026         // First get the tag's UID:
1027         cmd1[0] = 0x0B;
1028         ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
1029         CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
1030         GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
1031         if (Demod.len != 10) {
1032                 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
1033                 LED_D_OFF();
1034                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1035                 return;
1036         }
1037         // The check the CRC of the answer (use cmd1 as temporary variable):
1038         ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
1039         if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
1040                 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1041                                 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
1042                 // Do not return;, let's go on... (we should retry, maybe ?)
1043         }
1044         Dbprintf("Tag UID (64 bits): %08x %08x",
1045                         (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
1046                         (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
1047
1048         // Now loop to read all 16 blocks, address from 0 to last block
1049         Dbprintf("Tag memory dump, block 0 to %d", dwLast);
1050         cmd1[0] = 0x08;
1051         i = 0x00;
1052         dwLast++;
1053         for (;;) {
1054                 if (i == dwLast) {
1055                         DbpString("System area block (0xff):");
1056                         i = 0xff;
1057                 }
1058                 cmd1[1] = i;
1059                 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1060                 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
1061                 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
1062                 if (Demod.len != 6) { // Check if we got an answer from the tag
1063                         DbpString("Expected 6 bytes from tag, got less...");
1064                         LED_D_OFF();
1065                         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1066                         return;
1067                 }
1068                 // The check the CRC of the answer (use cmd1 as temporary variable):
1069                 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
1070                 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
1071                         Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1072                                         (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
1073                         // Do not return;, let's go on... (we should retry, maybe ?)
1074                 }
1075                 // Now print out the memory location:
1076                 Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
1077                                 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1078                                 (Demod.output[4]<<8)+Demod.output[5]);
1079                 if (i == 0xff) {
1080                         break;
1081                 }
1082                 i++;
1083         }
1084
1085         LED_D_OFF();
1086         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1087 }
1088
1089
1090 //=============================================================================
1091 // Finally, the `sniffer' combines elements from both the reader and
1092 // simulated tag, to show both sides of the conversation.
1093 //=============================================================================
1094
1095 //-----------------------------------------------------------------------------
1096 // Record the sequence of commands sent by the reader to the tag, with
1097 // triggering so that we start recording at the point that the tag is moved
1098 // near the reader.
1099 //-----------------------------------------------------------------------------
1100 /*
1101  * Memory usage for this function, (within BigBuf)
1102  * Last Received command (reader->tag) - MAX_FRAME_SIZE
1103  * Last Received command (tag->reader) - MAX_FRAME_SIZE
1104  * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
1105  * Demodulated samples received - all the rest
1106  */
1107 void RAMFUNC SnoopIso14443b(void)
1108 {
1109         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1110         BigBuf_free();
1111
1112         clear_trace();
1113         set_tracing(true);
1114
1115         // The DMA buffer, used to stream samples from the FPGA
1116         uint16_t *dmaBuf = (uint16_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE * sizeof(uint16_t));
1117         int lastRxCounter;
1118         uint16_t *upTo;
1119         int8_t ci, cq;
1120         int maxBehindBy = 0;
1121
1122         // Count of samples received so far, so that we can include timing
1123         // information in the trace buffer.
1124         int samples = 0;
1125
1126         DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
1127         UartInit(BigBuf_malloc(MAX_FRAME_SIZE));
1128
1129         // Print some debug information about the buffer sizes
1130         Dbprintf("Snooping buffers initialized:");
1131         Dbprintf("  Trace: %i bytes", BigBuf_max_traceLen());
1132         Dbprintf("  Reader -> tag: %i bytes", MAX_FRAME_SIZE);
1133         Dbprintf("  tag -> Reader: %i bytes", MAX_FRAME_SIZE);
1134         Dbprintf("  DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
1135
1136         // Signal field is off, no reader signal, no tag signal
1137         LEDsoff();
1138
1139         // And put the FPGA in the appropriate mode
1140         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
1141         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1142
1143         // Setup for the DMA.
1144         FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
1145         upTo = dmaBuf;
1146         lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
1147         FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
1148
1149         bool TagIsActive = false;
1150         bool ReaderIsActive = false;
1151         // We won't start recording the frames that we acquire until we trigger.
1152         // A good trigger condition to get started is probably when we see a
1153         // reader command
1154         bool triggered = false;
1155
1156         // And now we loop, receiving samples.
1157         for(;;) {
1158                 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1);
1159                 if(behindBy > maxBehindBy) {
1160                         maxBehindBy = behindBy;
1161                 }
1162
1163                 if(behindBy < 1) continue;
1164
1165                 ci = *upTo>>8;
1166                 cq = *upTo;
1167                 upTo++;
1168                 lastRxCounter--;
1169                 if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {               // we have read all of the DMA buffer content.
1170                         upTo = dmaBuf;                                             // start reading the circular buffer from the beginning again
1171                         lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
1172                         if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) {
1173                                 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy);
1174                                 break;
1175                         }
1176                 }
1177                 if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.
1178                         AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and
1179                         AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;  // DMA Next Counter registers
1180                         WDT_HIT();
1181                         if(BUTTON_PRESS()) {
1182                                 DbpString("cancelled");
1183                                 break;
1184                         }
1185                 }
1186
1187                 samples++;
1188
1189                 if (!TagIsActive) {                                                     // no need to try decoding reader data if the tag is sending
1190                         if(Handle14443bUartBit(ci & 0x01)) {
1191                                 triggered = true;
1192                                 LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);
1193                                 /* And ready to receive another command. */
1194                                 UartReset();
1195                                 /* And also reset the demod code, which might have been */
1196                                 /* false-triggered by the commands from the reader. */
1197                                 DemodReset();
1198                         }
1199                         if(Handle14443bUartBit(cq & 0x01)) {
1200                                 triggered = true;
1201                                 LogTrace(Uart.output, Uart.byteCnt, samples, samples, NULL, true);
1202                                 /* And ready to receive another command. */
1203                                 UartReset();
1204                                 /* And also reset the demod code, which might have been */
1205                                 /* false-triggered by the commands from the reader. */
1206                                 DemodReset();
1207                         }
1208                         ReaderIsActive = (Uart.state > STATE_GOT_FALLING_EDGE_OF_SOF);
1209                 }
1210
1211                 if(!ReaderIsActive && triggered) {                                              // no need to try decoding tag data if the reader is sending or not yet triggered
1212                         if(Handle14443bSamplesDemod(ci/2, cq/2)) {
1213                                 //Use samples as a time measurement
1214                                 LogTrace(Demod.output, Demod.len, samples, samples, NULL, false);
1215                                 // And ready to receive another response.
1216                                 DemodReset();
1217                         }
1218                         TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF);
1219                 }
1220
1221         }
1222
1223         FpgaDisableSscDma();
1224         LEDsoff();
1225         DbpString("Snoop statistics:");
1226         Dbprintf("  Max behind by: %i", maxBehindBy);
1227         Dbprintf("  Uart State: %x", Uart.state);
1228         Dbprintf("  Uart ByteCnt: %i", Uart.byteCnt);
1229         Dbprintf("  Uart ByteCntMax: %i", Uart.byteCntMax);
1230         Dbprintf("  Trace length: %i", BigBuf_get_traceLen());
1231 }
1232
1233
1234 /*
1235  * Send raw command to tag ISO14443B
1236  * @Input
1237  * datalen     len of buffer data
1238  * recv        bool when true wait for data from tag and send to client
1239  * powerfield  bool leave the field on when true
1240  * data        buffer with byte to send
1241  *
1242  * @Output
1243  * none
1244  *
1245  */
1246 void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])
1247 {
1248         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1249         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1250
1251         // switch field on and give tag some time to power up
1252         LED_D_ON();
1253         FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
1254         SpinDelay(10);
1255
1256         if (datalen){
1257                 set_tracing(true);
1258
1259                 CodeAndTransmit14443bAsReader(data, datalen);
1260
1261                 if(recv) {
1262                         GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
1263                         uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
1264                         cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
1265                 }
1266         }
1267
1268         if(!powerfield) {
1269                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1270                 LED_D_OFF();
1271         }
1272 }
1273