]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443a.c
269a00c5437c96f784d4262d88379d7fb5999902
[proxmark3-svn] / armsrc / iso14443a.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "../include/proxmark3.h"
14 #include "apps.h"
15 #include "util.h"
16 #include "string.h"
17 #include "../common/cmd.h"
18 #include "../common/iso14443crc.h"
19 #include "iso14443a.h"
20 #include "crapto1.h"
21 #include "mifareutil.h"
22
23 static uint32_t iso14a_timeout;
24 uint8_t *trace = (uint8_t *) BigBuf+TRACE_OFFSET;
25 int rsamples = 0;
26 int traceLen = 0;
27 int tracing = TRUE;
28 uint8_t trigger = 0;
29 // the block number for the ISO14443-4 PCB
30 static uint8_t iso14_pcb_blocknum = 0;
31
32 //
33 // ISO14443 timing:
34 //
35 // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
36 #define REQUEST_GUARD_TIME (7000/16 + 1)
37 // minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
38 #define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
39 // bool LastCommandWasRequest = FALSE;
40
41 //
42 // Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
43 //
44 // When the PM acts as reader and is receiving tag data, it takes
45 // 3 ticks delay in the AD converter
46 // 16 ticks until the modulation detector completes and sets curbit
47 // 8 ticks until bit_to_arm is assigned from curbit
48 // 8*16 ticks for the transfer from FPGA to ARM
49 // 4*16 ticks until we measure the time
50 // - 8*16 ticks because we measure the time of the previous transfer
51 #define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
52
53 // When the PM acts as a reader and is sending, it takes
54 // 4*16 ticks until we can write data to the sending hold register
55 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
56 // 8 ticks until the first transfer starts
57 // 8 ticks later the FPGA samples the data
58 // 1 tick to assign mod_sig_coil
59 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
60
61 // When the PM acts as tag and is receiving it takes
62 // 2 ticks delay in the RF part (for the first falling edge),
63 // 3 ticks for the A/D conversion,
64 // 8 ticks on average until the start of the SSC transfer,
65 // 8 ticks until the SSC samples the first data
66 // 7*16 ticks to complete the transfer from FPGA to ARM
67 // 8 ticks until the next ssp_clk rising edge
68 // 4*16 ticks until we measure the time
69 // - 8*16 ticks because we measure the time of the previous transfer
70 #define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
71
72 // The FPGA will report its internal sending delay in
73 uint16_t FpgaSendQueueDelay;
74 // the 5 first bits are the number of bits buffered in mod_sig_buf
75 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
76 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
77
78 // When the PM acts as tag and is sending, it takes
79 // 4*16 ticks until we can write data to the sending hold register
80 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
81 // 8 ticks until the first transfer starts
82 // 8 ticks later the FPGA samples the data
83 // + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
84 // + 1 tick to assign mod_sig_coil
85 #define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
86
87 // When the PM acts as sniffer and is receiving tag data, it takes
88 // 3 ticks A/D conversion
89 // 14 ticks to complete the modulation detection
90 // 8 ticks (on average) until the result is stored in to_arm
91 // + the delays in transferring data - which is the same for
92 // sniffing reader and tag data and therefore not relevant
93 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
94
95 // When the PM acts as sniffer and is receiving reader data, it takes
96 // 2 ticks delay in analogue RF receiver (for the falling edge of the
97 // start bit, which marks the start of the communication)
98 // 3 ticks A/D conversion
99 // 8 ticks on average until the data is stored in to_arm.
100 // + the delays in transferring data - which is the same for
101 // sniffing reader and tag data and therefore not relevant
102 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
103
104 //variables used for timing purposes:
105 //these are in ssp_clk cycles:
106 static uint32_t NextTransferTime;
107 static uint32_t LastTimeProxToAirStart;
108 static uint32_t LastProxToAirDuration;
109
110
111
112 // CARD TO READER - manchester
113 // Sequence D: 11110000 modulation with subcarrier during first half
114 // Sequence E: 00001111 modulation with subcarrier during second half
115 // Sequence F: 00000000 no modulation with subcarrier
116 // READER TO CARD - miller
117 // Sequence X: 00001100 drop after half a period
118 // Sequence Y: 00000000 no drop
119 // Sequence Z: 11000000 drop at start
120 #define SEC_D 0xf0
121 #define SEC_E 0x0f
122 #define SEC_F 0x00
123 #define SEC_X 0x0c
124 #define SEC_Y 0x00
125 #define SEC_Z 0xc0
126
127 const uint8_t OddByteParity[256] = {
128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
141 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
142 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
143 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
144 };
145
146 void iso14a_set_trigger(bool enable) {
147 trigger = enable;
148 }
149
150 void iso14a_clear_trace() {
151 memset(trace, 0x44, TRACE_SIZE);
152 traceLen = 0;
153 }
154
155 void iso14a_set_tracing(bool enable) {
156 tracing = enable;
157 }
158
159 void iso14a_set_timeout(uint32_t timeout) {
160 iso14a_timeout = timeout;
161 }
162
163 //-----------------------------------------------------------------------------
164 // Generate the parity value for a byte sequence
165 //
166 //-----------------------------------------------------------------------------
167 byte_t oddparity (const byte_t bt)
168 {
169 return OddByteParity[bt];
170 }
171
172 void GetParity(const uint8_t * pbtCmd, uint16_t iLen, uint8_t *par)
173 {
174 uint16_t paritybit_cnt = 0;
175 uint16_t paritybyte_cnt = 0;
176 uint8_t parityBits = 0;
177
178 for (uint16_t i = 0; i < iLen; i++) {
179 // Generate the parity bits
180 parityBits |= ((OddByteParity[pbtCmd[i]]) << (7-paritybit_cnt));
181 if (paritybit_cnt == 7) {
182 par[paritybyte_cnt] = parityBits; // save 8 Bits parity
183 parityBits = 0; // and advance to next Parity Byte
184 paritybyte_cnt++;
185 paritybit_cnt = 0;
186 } else {
187 paritybit_cnt++;
188 }
189 }
190
191 // save remaining parity bits
192 par[paritybyte_cnt] = parityBits;
193
194 }
195
196 void AppendCrc14443a(uint8_t* data, int len)
197 {
198 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
199 }
200
201 // The function LogTrace() is also used by the iClass implementation in iClass.c
202 bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag)
203 {
204 if (!tracing) return FALSE;
205
206 uint16_t num_paritybytes = (iLen-1)/8 + 1; // number of valid paritybytes in *parity
207 uint16_t duration = timestamp_end - timestamp_start;
208
209 // Return when trace is full
210 if (traceLen + sizeof(iLen) + sizeof(timestamp_start) + sizeof(duration) + num_paritybytes + iLen >= TRACE_SIZE) {
211 tracing = FALSE; // don't trace any more
212 return FALSE;
213 }
214
215 // Traceformat:
216 // 32 bits timestamp (little endian)
217 // 16 bits duration (little endian)
218 // 16 bits data length (little endian, Highest Bit used as readerToTag flag)
219 // y Bytes data
220 // x Bytes parity (one byte per 8 bytes data)
221
222 // timestamp (start)
223 trace[traceLen++] = ((timestamp_start >> 0) & 0xff);
224 trace[traceLen++] = ((timestamp_start >> 8) & 0xff);
225 trace[traceLen++] = ((timestamp_start >> 16) & 0xff);
226 trace[traceLen++] = ((timestamp_start >> 24) & 0xff);
227
228 // duration
229 trace[traceLen++] = ((duration >> 0) & 0xff);
230 trace[traceLen++] = ((duration >> 8) & 0xff);
231
232 // data length
233 trace[traceLen++] = ((iLen >> 0) & 0xff);
234 trace[traceLen++] = ((iLen >> 8) & 0xff);
235
236 // readerToTag flag
237 if (!readerToTag) {
238 trace[traceLen - 1] |= 0x80;
239 }
240
241 // data bytes
242 if (btBytes != NULL && iLen != 0) {
243 memcpy(trace + traceLen, btBytes, iLen);
244 }
245 traceLen += iLen;
246
247 // parity bytes
248 if (parity != NULL && iLen != 0) {
249 memcpy(trace + traceLen, parity, num_paritybytes);
250 }
251 traceLen += num_paritybytes;
252
253 return TRUE;
254 }
255
256 //=============================================================================
257 // ISO 14443 Type A - Miller decoder
258 //=============================================================================
259 // Basics:
260 // This decoder is used when the PM3 acts as a tag.
261 // The reader will generate "pauses" by temporarily switching of the field.
262 // At the PM3 antenna we will therefore measure a modulated antenna voltage.
263 // The FPGA does a comparison with a threshold and would deliver e.g.:
264 // ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
265 // The Miller decoder needs to identify the following sequences:
266 // 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
267 // 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
268 // 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
269 // Note 1: the bitstream may start at any time. We therefore need to sync.
270 // Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
271 //-----------------------------------------------------------------------------
272 static tUart Uart;
273
274 // Lookup-Table to decide if 4 raw bits are a modulation.
275 // We accept two or three consecutive "0" in any position with the rest "1"
276 const bool Mod_Miller_LUT[] = {
277 TRUE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, FALSE,
278 TRUE, TRUE, FALSE, FALSE, TRUE, FALSE, FALSE, FALSE
279 };
280 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x00F0) >> 4])
281 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x000F)])
282
283 void UartReset()
284 {
285 Uart.state = STATE_UNSYNCD;
286 Uart.bitCount = 0;
287 Uart.len = 0; // number of decoded data bytes
288 Uart.parityLen = 0; // number of decoded parity bytes
289 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
290 Uart.parityBits = 0; // holds 8 parity bits
291 Uart.twoBits = 0x0000; // buffer for 2 Bits
292 Uart.highCnt = 0;
293 Uart.startTime = 0;
294 Uart.endTime = 0;
295 }
296
297 void UartInit(uint8_t *data, uint8_t *parity)
298 {
299 Uart.output = data;
300 Uart.parity = parity;
301 UartReset();
302 }
303
304 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
305 static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
306 {
307
308 Uart.twoBits = (Uart.twoBits << 8) | bit;
309
310 if (Uart.state == STATE_UNSYNCD) { // not yet synced
311
312 if (Uart.highCnt < 7) { // wait for a stable unmodulated signal
313 if (Uart.twoBits == 0xffff) {
314 Uart.highCnt++;
315 } else {
316 Uart.highCnt = 0;
317 }
318 } else {
319 Uart.syncBit = 0xFFFF; // not set
320 // look for 00xx1111 (the start bit)
321 if ((Uart.twoBits & 0x6780) == 0x0780) Uart.syncBit = 7;
322 else if ((Uart.twoBits & 0x33C0) == 0x03C0) Uart.syncBit = 6;
323 else if ((Uart.twoBits & 0x19E0) == 0x01E0) Uart.syncBit = 5;
324 else if ((Uart.twoBits & 0x0CF0) == 0x00F0) Uart.syncBit = 4;
325 else if ((Uart.twoBits & 0x0678) == 0x0078) Uart.syncBit = 3;
326 else if ((Uart.twoBits & 0x033C) == 0x003C) Uart.syncBit = 2;
327 else if ((Uart.twoBits & 0x019E) == 0x001E) Uart.syncBit = 1;
328 else if ((Uart.twoBits & 0x00CF) == 0x000F) Uart.syncBit = 0;
329 if (Uart.syncBit != 0xFFFF) {
330 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
331 Uart.startTime -= Uart.syncBit;
332 Uart.endTime = Uart.startTime;
333 Uart.state = STATE_START_OF_COMMUNICATION;
334 }
335 }
336
337 } else {
338
339 if (IsMillerModulationNibble1(Uart.twoBits >> Uart.syncBit)) {
340 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation in both halves - error
341 UartReset();
342 Uart.highCnt = 6;
343 } else { // Modulation in first half = Sequence Z = logic "0"
344 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
345 UartReset();
346 Uart.highCnt = 6;
347 } else {
348 Uart.bitCount++;
349 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
350 Uart.state = STATE_MILLER_Z;
351 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
352 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
353 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
354 Uart.parityBits <<= 1; // make room for the parity bit
355 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
356 Uart.bitCount = 0;
357 Uart.shiftReg = 0;
358 if((Uart.len & 0x0007) == 0) { // every 8 data bytes
359 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
360 Uart.parityBits = 0;
361 }
362 }
363 }
364 }
365 } else {
366 if (IsMillerModulationNibble2(Uart.twoBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
367 Uart.bitCount++;
368 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
369 Uart.state = STATE_MILLER_X;
370 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
371 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
372 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
373 Uart.parityBits <<= 1; // make room for the new parity bit
374 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
375 Uart.bitCount = 0;
376 Uart.shiftReg = 0;
377 if ((Uart.len & 0x0007) == 0) { // every 8 data bytes
378 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
379 Uart.parityBits = 0;
380 }
381 }
382 } else { // no modulation in both halves - Sequence Y
383 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
384 Uart.state = STATE_UNSYNCD;
385 Uart.bitCount--; // last "0" was part of EOC sequence
386 Uart.shiftReg <<= 1; // drop it
387 if(Uart.bitCount > 0) { // if we decoded some bits
388 Uart.shiftReg >>= (9 - Uart.bitCount); // right align them
389 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff); // add last byte to the output
390 Uart.parityBits <<= 1; // add a (void) parity bit
391 Uart.parityBits <<= (8 - (Uart.len & 0x0007)); // left align parity bits
392 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store it
393 return TRUE;
394 } else if (Uart.len & 0x0007) { // there are some parity bits to store
395 Uart.parityBits <<= (8 - (Uart.len & 0x0007)); // left align remaining parity bits
396 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store them
397 return TRUE; // we are finished with decoding the raw data sequence
398 }
399 }
400 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
401 UartReset();
402 Uart.highCnt = 6;
403 } else { // a logic "0"
404 Uart.bitCount++;
405 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
406 Uart.state = STATE_MILLER_Y;
407 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
408 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
409 Uart.parityBits <<= 1; // make room for the parity bit
410 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
411 Uart.bitCount = 0;
412 Uart.shiftReg = 0;
413 if ((Uart.len & 0x0007) == 0) { // every 8 data bytes
414 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
415 Uart.parityBits = 0;
416 }
417 }
418 }
419 }
420 }
421
422 }
423
424 return FALSE; // not finished yet, need more data
425 }
426
427
428
429 //=============================================================================
430 // ISO 14443 Type A - Manchester decoder
431 //=============================================================================
432 // Basics:
433 // This decoder is used when the PM3 acts as a reader.
434 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
435 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
436 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
437 // The Manchester decoder needs to identify the following sequences:
438 // 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
439 // 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
440 // 8 ticks unmodulated: Sequence F = end of communication
441 // 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
442 // Note 1: the bitstream may start at any time. We therefore need to sync.
443 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
444 static tDemod Demod;
445
446 // Lookup-Table to decide if 4 raw bits are a modulation.
447 // We accept three or four "1" in any position
448 const bool Mod_Manchester_LUT[] = {
449 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
450 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
451 };
452
453 #define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
454 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
455
456
457 void DemodReset()
458 {
459 Demod.state = DEMOD_UNSYNCD;
460 Demod.len = 0; // number of decoded data bytes
461 Demod.parityLen = 0;
462 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
463 Demod.parityBits = 0; //
464 Demod.collisionPos = 0; // Position of collision bit
465 Demod.twoBits = 0xffff; // buffer for 2 Bits
466 Demod.highCnt = 0;
467 Demod.startTime = 0;
468 Demod.endTime = 0;
469 }
470
471 void DemodInit(uint8_t *data, uint8_t *parity)
472 {
473 Demod.output = data;
474 Demod.parity = parity;
475 DemodReset();
476 }
477
478 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
479 static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
480 {
481
482 Demod.twoBits = (Demod.twoBits << 8) | bit;
483
484 if (Demod.state == DEMOD_UNSYNCD) {
485
486 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
487 if (Demod.twoBits == 0x0000) {
488 Demod.highCnt++;
489 } else {
490 Demod.highCnt = 0;
491 }
492 } else {
493 Demod.syncBit = 0xFFFF; // not set
494 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
495 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
496 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
497 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
498 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
499 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
500 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
501 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
502 if (Demod.syncBit != 0xFFFF) {
503 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
504 Demod.startTime -= Demod.syncBit;
505 Demod.bitCount = offset; // number of decoded data bits
506 Demod.state = DEMOD_MANCHESTER_DATA;
507 }
508 }
509
510 } else {
511
512 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
513 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
514 if (!Demod.collisionPos) {
515 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
516 }
517 } // modulation in first half only - Sequence D = 1
518 Demod.bitCount++;
519 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
520 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
521 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
522 Demod.parityBits <<= 1; // make room for the parity bit
523 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
524 Demod.bitCount = 0;
525 Demod.shiftReg = 0;
526 if((Demod.len & 0x0007) == 0) { // every 8 data bytes
527 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits
528 Demod.parityBits = 0;
529 }
530 }
531 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
532 } else { // no modulation in first half
533 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
534 Demod.bitCount++;
535 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
536 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
537 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
538 Demod.parityBits <<= 1; // make room for the new parity bit
539 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
540 Demod.bitCount = 0;
541 Demod.shiftReg = 0;
542 if ((Demod.len & 0x0007) == 0) { // every 8 data bytes
543 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits1
544 Demod.parityBits = 0;
545 }
546 }
547 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
548 } else { // no modulation in both halves - End of communication
549 if(Demod.bitCount > 0) { // there are some remaining data bits
550 Demod.shiftReg >>= (9 - Demod.bitCount); // right align the decoded bits
551 Demod.output[Demod.len++] = Demod.shiftReg & 0xff; // and add them to the output
552 Demod.parityBits <<= 1; // add a (void) parity bit
553 Demod.parityBits <<= (8 - (Demod.len & 0x0007)); // left align remaining parity bits
554 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
555 return TRUE;
556 } else if (Demod.len & 0x0007) { // there are some parity bits to store
557 Demod.parityBits <<= (8 - (Demod.len & 0x0007)); // left align remaining parity bits
558 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
559 return TRUE; // we are finished with decoding the raw data sequence
560 } else { // nothing received. Start over
561 DemodReset();
562 }
563 }
564 }
565
566 }
567
568 return FALSE; // not finished yet, need more data
569 }
570
571 //=============================================================================
572 // Finally, a `sniffer' for ISO 14443 Type A
573 // Both sides of communication!
574 //=============================================================================
575
576 //-----------------------------------------------------------------------------
577 // Record the sequence of commands sent by the reader to the tag, with
578 // triggering so that we start recording at the point that the tag is moved
579 // near the reader.
580 //-----------------------------------------------------------------------------
581 void RAMFUNC SnoopIso14443a(uint8_t param) {
582 // param:
583 // bit 0 - trigger from first card answer
584 // bit 1 - trigger from first reader 7-bit request
585
586 LEDsoff();
587 // init trace buffer
588 iso14a_clear_trace();
589 iso14a_set_tracing(TRUE);
590
591 // We won't start recording the frames that we acquire until we trigger;
592 // a good trigger condition to get started is probably when we see a
593 // response from the tag.
594 // triggered == FALSE -- to wait first for card
595 bool triggered = !(param & 0x03);
596
597 // The command (reader -> tag) that we're receiving.
598 // The length of a received command will in most cases be no more than 18 bytes.
599 // So 32 should be enough!
600 uint8_t *receivedCmd = ((uint8_t *)BigBuf) + RECV_CMD_OFFSET;
601 uint8_t *receivedCmdPar = ((uint8_t *)BigBuf) + RECV_CMD_PAR_OFFSET;
602
603 // The response (tag -> reader) that we're receiving.
604 uint8_t *receivedResponse = ((uint8_t *)BigBuf) + RECV_RESP_OFFSET;
605 uint8_t *receivedResponsePar = ((uint8_t *)BigBuf) + RECV_RESP_PAR_OFFSET;
606
607 // As we receive stuff, we copy it from receivedCmd or receivedResponse
608 // into trace, along with its length and other annotations.
609 //uint8_t *trace = (uint8_t *)BigBuf;
610
611 // The DMA buffer, used to stream samples from the FPGA
612 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
613 uint8_t *data = dmaBuf;
614 uint8_t previous_data = 0;
615 int maxDataLen = 0;
616 int dataLen = 0;
617 bool TagIsActive = FALSE;
618 bool ReaderIsActive = FALSE;
619
620 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
621
622 // Set up the demodulator for tag -> reader responses.
623 DemodInit(receivedResponse, receivedResponsePar);
624
625 // Set up the demodulator for the reader -> tag commands
626 UartInit(receivedCmd, receivedCmdPar);
627
628 // Setup and start DMA.
629 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
630
631 // And now we loop, receiving samples.
632 for(uint32_t rsamples = 0; TRUE; ) {
633
634 if(BUTTON_PRESS()) {
635 DbpString("cancelled by button");
636 break;
637 }
638
639 LED_A_ON();
640 WDT_HIT();
641
642 int register readBufDataP = data - dmaBuf;
643 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
644 if (readBufDataP <= dmaBufDataP){
645 dataLen = dmaBufDataP - readBufDataP;
646 } else {
647 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
648 }
649 // test for length of buffer
650 if(dataLen > maxDataLen) {
651 maxDataLen = dataLen;
652 if(dataLen > 400) {
653 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
654 break;
655 }
656 }
657 if(dataLen < 1) continue;
658
659 // primary buffer was stopped( <-- we lost data!
660 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
661 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
662 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
663 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
664 }
665 // secondary buffer sets as primary, secondary buffer was stopped
666 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
667 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
668 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
669 }
670
671 LED_A_OFF();
672
673 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
674
675 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
676 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
677 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
678 LED_C_ON();
679
680 // check - if there is a short 7bit request from reader
681 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
682
683 if(triggered) {
684 if (!LogTrace(receivedCmd,
685 Uart.len,
686 Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
687 Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
688 Uart.parity,
689 TRUE)) break;
690 }
691 /* And ready to receive another command. */
692 UartReset();
693 /* And also reset the demod code, which might have been */
694 /* false-triggered by the commands from the reader. */
695 DemodReset();
696 LED_B_OFF();
697 }
698 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
699 }
700
701 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
702 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
703 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
704 LED_B_ON();
705
706 if (!LogTrace(receivedResponse,
707 Demod.len,
708 Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
709 Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
710 Demod.parity,
711 FALSE)) break;
712
713 if ((!triggered) && (param & 0x01)) triggered = TRUE;
714
715 // And ready to receive another response.
716 DemodReset();
717 LED_C_OFF();
718 }
719 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
720 }
721 }
722
723 previous_data = *data;
724 rsamples++;
725 data++;
726 if(data == dmaBuf + DMA_BUFFER_SIZE) {
727 data = dmaBuf;
728 }
729 } // main cycle
730
731 DbpString("COMMAND FINISHED");
732
733 FpgaDisableSscDma();
734 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
735 Dbprintf("traceLen=%d, Uart.output[0]=%08x", traceLen, (uint32_t)Uart.output[0]);
736 LEDsoff();
737 }
738
739 //-----------------------------------------------------------------------------
740 // Prepare tag messages
741 //-----------------------------------------------------------------------------
742 static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
743 {
744 ToSendReset();
745
746 // Correction bit, might be removed when not needed
747 ToSendStuffBit(0);
748 ToSendStuffBit(0);
749 ToSendStuffBit(0);
750 ToSendStuffBit(0);
751 ToSendStuffBit(1); // 1
752 ToSendStuffBit(0);
753 ToSendStuffBit(0);
754 ToSendStuffBit(0);
755
756 // Send startbit
757 ToSend[++ToSendMax] = SEC_D;
758 LastProxToAirDuration = 8 * ToSendMax - 4;
759
760 for( uint16_t i = 0; i < len; i++) {
761 uint8_t b = cmd[i];
762
763 // Data bits
764 for(uint16_t j = 0; j < 8; j++) {
765 if(b & 1) {
766 ToSend[++ToSendMax] = SEC_D;
767 } else {
768 ToSend[++ToSendMax] = SEC_E;
769 }
770 b >>= 1;
771 }
772
773 // Get the parity bit
774 if (parity[i>>3] & (0x80>>(i&0x0007))) {
775 ToSend[++ToSendMax] = SEC_D;
776 LastProxToAirDuration = 8 * ToSendMax - 4;
777 } else {
778 ToSend[++ToSendMax] = SEC_E;
779 LastProxToAirDuration = 8 * ToSendMax;
780 }
781 }
782
783 // Send stopbit
784 ToSend[++ToSendMax] = SEC_F;
785
786 // Convert from last byte pos to length
787 ToSendMax++;
788 }
789
790 static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
791 {
792 uint8_t par[MAX_PARITY_SIZE];
793
794 GetParity(cmd, len, par);
795 CodeIso14443aAsTagPar(cmd, len, par);
796 }
797
798
799 static void Code4bitAnswerAsTag(uint8_t cmd)
800 {
801 int i;
802
803 ToSendReset();
804
805 // Correction bit, might be removed when not needed
806 ToSendStuffBit(0);
807 ToSendStuffBit(0);
808 ToSendStuffBit(0);
809 ToSendStuffBit(0);
810 ToSendStuffBit(1); // 1
811 ToSendStuffBit(0);
812 ToSendStuffBit(0);
813 ToSendStuffBit(0);
814
815 // Send startbit
816 ToSend[++ToSendMax] = SEC_D;
817
818 uint8_t b = cmd;
819 for(i = 0; i < 4; i++) {
820 if(b & 1) {
821 ToSend[++ToSendMax] = SEC_D;
822 LastProxToAirDuration = 8 * ToSendMax - 4;
823 } else {
824 ToSend[++ToSendMax] = SEC_E;
825 LastProxToAirDuration = 8 * ToSendMax;
826 }
827 b >>= 1;
828 }
829
830 // Send stopbit
831 ToSend[++ToSendMax] = SEC_F;
832
833 // Convert from last byte pos to length
834 ToSendMax++;
835 }
836
837 //-----------------------------------------------------------------------------
838 // Wait for commands from reader
839 // Stop when button is pressed
840 // Or return TRUE when command is captured
841 //-----------------------------------------------------------------------------
842 static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
843 {
844 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
845 // only, since we are receiving, not transmitting).
846 // Signal field is off with the appropriate LED
847 LED_D_OFF();
848 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
849
850 // Now run a `software UART' on the stream of incoming samples.
851 UartInit(received, parity);
852
853 // clear RXRDY:
854 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
855
856 for(;;) {
857 WDT_HIT();
858
859 if(BUTTON_PRESS()) return FALSE;
860
861 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
862 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
863 if(MillerDecoding(b, 0)) {
864 *len = Uart.len;
865 return TRUE;
866 }
867 }
868 }
869 }
870
871 static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
872 int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
873 int EmSend4bit(uint8_t resp);
874 int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
875 int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
876 int EmSendCmd(uint8_t *resp, uint16_t respLen);
877 int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
878 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
879 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
880
881 static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
882
883 typedef struct {
884 uint8_t* response;
885 size_t response_n;
886 uint8_t* modulation;
887 size_t modulation_n;
888 uint32_t ProxToAirDuration;
889 } tag_response_info_t;
890
891 void reset_free_buffer() {
892 free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
893 }
894
895 bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
896 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
897 // This will need the following byte array for a modulation sequence
898 // 144 data bits (18 * 8)
899 // 18 parity bits
900 // 2 Start and stop
901 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
902 // 1 just for the case
903 // ----------- +
904 // 166 bytes, since every bit that needs to be send costs us a byte
905 //
906
907 // Prepare the tag modulation bits from the message
908 CodeIso14443aAsTag(response_info->response,response_info->response_n);
909
910 // Make sure we do not exceed the free buffer space
911 if (ToSendMax > max_buffer_size) {
912 Dbprintf("Out of memory, when modulating bits for tag answer:");
913 Dbhexdump(response_info->response_n,response_info->response,false);
914 return false;
915 }
916
917 // Copy the byte array, used for this modulation to the buffer position
918 memcpy(response_info->modulation,ToSend,ToSendMax);
919
920 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
921 response_info->modulation_n = ToSendMax;
922 response_info->ProxToAirDuration = LastProxToAirDuration;
923
924 return true;
925 }
926
927 bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
928 // Retrieve and store the current buffer index
929 response_info->modulation = free_buffer_pointer;
930
931 // Determine the maximum size we can use from our buffer
932 size_t max_buffer_size = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + FREE_BUFFER_SIZE) - free_buffer_pointer;
933
934 // Forward the prepare tag modulation function to the inner function
935 if (prepare_tag_modulation(response_info,max_buffer_size)) {
936 // Update the free buffer offset
937 free_buffer_pointer += ToSendMax;
938 return true;
939 } else {
940 return false;
941 }
942 }
943
944 //-----------------------------------------------------------------------------
945 // Main loop of simulated tag: receive commands from reader, decide what
946 // response to send, and send it.
947 //-----------------------------------------------------------------------------
948 void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
949 {
950 // Enable and clear the trace
951 iso14a_clear_trace();
952 iso14a_set_tracing(TRUE);
953
954 uint8_t sak;
955
956 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
957 uint8_t response1[2];
958
959 switch (tagType) {
960 case 1: { // MIFARE Classic
961 // Says: I am Mifare 1k - original line
962 response1[0] = 0x04;
963 response1[1] = 0x00;
964 sak = 0x08;
965 } break;
966 case 2: { // MIFARE Ultralight
967 // Says: I am a stupid memory tag, no crypto
968 response1[0] = 0x04;
969 response1[1] = 0x00;
970 sak = 0x00;
971 } break;
972 case 3: { // MIFARE DESFire
973 // Says: I am a DESFire tag, ph33r me
974 response1[0] = 0x04;
975 response1[1] = 0x03;
976 sak = 0x20;
977 } break;
978 case 4: { // ISO/IEC 14443-4
979 // Says: I am a javacard (JCOP)
980 response1[0] = 0x04;
981 response1[1] = 0x00;
982 sak = 0x28;
983 } break;
984 case 5: { // MIFARE TNP3XXX
985 // Says: I am a toy
986 response1[0] = 0x01;
987 response1[1] = 0x0f;
988 sak = 0x01;
989 } break;
990 default: {
991 Dbprintf("Error: unkown tagtype (%d)",tagType);
992 return;
993 } break;
994 }
995
996 // The second response contains the (mandatory) first 24 bits of the UID
997 uint8_t response2[5];
998
999 // Check if the uid uses the (optional) part
1000 uint8_t response2a[5];
1001 if (uid_2nd) {
1002 response2[0] = 0x88;
1003 num_to_bytes(uid_1st,3,response2+1);
1004 num_to_bytes(uid_2nd,4,response2a);
1005 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
1006
1007 // Configure the ATQA and SAK accordingly
1008 response1[0] |= 0x40;
1009 sak |= 0x04;
1010 } else {
1011 num_to_bytes(uid_1st,4,response2);
1012 // Configure the ATQA and SAK accordingly
1013 response1[0] &= 0xBF;
1014 sak &= 0xFB;
1015 }
1016
1017 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1018 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
1019
1020 // Prepare the mandatory SAK (for 4 and 7 byte UID)
1021 uint8_t response3[3];
1022 response3[0] = sak;
1023 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
1024
1025 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
1026 uint8_t response3a[3];
1027 response3a[0] = sak & 0xFB;
1028 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
1029
1030 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
1031 uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1032 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1033 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1034 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1035 // TC(1) = 0x02: CID supported, NAD not supported
1036 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
1037
1038 #define TAG_RESPONSE_COUNT 7
1039 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
1040 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
1041 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
1042 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1043 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
1044 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
1045 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
1046 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
1047 };
1048
1049 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1050 // Such a response is less time critical, so we can prepare them on the fly
1051 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1052 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1053 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
1054 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
1055 tag_response_info_t dynamic_response_info = {
1056 .response = dynamic_response_buffer,
1057 .response_n = 0,
1058 .modulation = dynamic_modulation_buffer,
1059 .modulation_n = 0
1060 };
1061
1062 // Reset the offset pointer of the free buffer
1063 reset_free_buffer();
1064
1065 // Prepare the responses of the anticollision phase
1066 // there will be not enough time to do this at the moment the reader sends it REQA
1067 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
1068 prepare_allocated_tag_modulation(&responses[i]);
1069 }
1070
1071 int len = 0;
1072
1073 // To control where we are in the protocol
1074 int order = 0;
1075 int lastorder;
1076
1077 // Just to allow some checks
1078 int happened = 0;
1079 int happened2 = 0;
1080 int cmdsRecvd = 0;
1081
1082 // We need to listen to the high-frequency, peak-detected path.
1083 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1084
1085 // buffers used on software Uart:
1086 uint8_t *receivedCmd = ((uint8_t *)BigBuf) + RECV_CMD_OFFSET;
1087 uint8_t *receivedCmdPar = ((uint8_t *)BigBuf) + RECV_CMD_PAR_OFFSET;
1088
1089 cmdsRecvd = 0;
1090 tag_response_info_t* p_response;
1091
1092 LED_A_ON();
1093 for(;;) {
1094 // Clean receive command buffer
1095
1096 if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
1097 DbpString("Button press");
1098 break;
1099 }
1100
1101 p_response = NULL;
1102
1103 // Okay, look at the command now.
1104 lastorder = order;
1105 if(receivedCmd[0] == 0x26) { // Received a REQUEST
1106 p_response = &responses[0]; order = 1;
1107 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
1108 p_response = &responses[0]; order = 6;
1109 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
1110 p_response = &responses[1]; order = 2;
1111 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
1112 p_response = &responses[2]; order = 20;
1113 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
1114 p_response = &responses[3]; order = 3;
1115 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
1116 p_response = &responses[4]; order = 30;
1117 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
1118 EmSendCmdEx(data+(4*receivedCmd[1]),16,false);
1119 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1120 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1121 p_response = NULL;
1122 } else if(receivedCmd[0] == 0x50) { // Received a HALT
1123
1124 if (tracing) {
1125 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1126 }
1127 p_response = NULL;
1128 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
1129 p_response = &responses[5]; order = 7;
1130 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
1131 if (tagType == 1 || tagType == 2) { // RATS not supported
1132 EmSend4bit(CARD_NACK_NA);
1133 p_response = NULL;
1134 } else {
1135 p_response = &responses[6]; order = 70;
1136 }
1137 } else if (order == 7 && len == 8) { // Received {nr] and {ar} (part of authentication)
1138 if (tracing) {
1139 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1140 }
1141 uint32_t nr = bytes_to_num(receivedCmd,4);
1142 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1143 Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr,ar);
1144 } else {
1145 // Check for ISO 14443A-4 compliant commands, look at left nibble
1146 switch (receivedCmd[0]) {
1147
1148 case 0x0B:
1149 case 0x0A: { // IBlock (command)
1150 dynamic_response_info.response[0] = receivedCmd[0];
1151 dynamic_response_info.response[1] = 0x00;
1152 dynamic_response_info.response[2] = 0x90;
1153 dynamic_response_info.response[3] = 0x00;
1154 dynamic_response_info.response_n = 4;
1155 } break;
1156
1157 case 0x1A:
1158 case 0x1B: { // Chaining command
1159 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1160 dynamic_response_info.response_n = 2;
1161 } break;
1162
1163 case 0xaa:
1164 case 0xbb: {
1165 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1166 dynamic_response_info.response_n = 2;
1167 } break;
1168
1169 case 0xBA: { //
1170 memcpy(dynamic_response_info.response,"\xAB\x00",2);
1171 dynamic_response_info.response_n = 2;
1172 } break;
1173
1174 case 0xCA:
1175 case 0xC2: { // Readers sends deselect command
1176 memcpy(dynamic_response_info.response,"\xCA\x00",2);
1177 dynamic_response_info.response_n = 2;
1178 } break;
1179
1180 default: {
1181 // Never seen this command before
1182 if (tracing) {
1183 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1184 }
1185 Dbprintf("Received unknown command (len=%d):",len);
1186 Dbhexdump(len,receivedCmd,false);
1187 // Do not respond
1188 dynamic_response_info.response_n = 0;
1189 } break;
1190 }
1191
1192 if (dynamic_response_info.response_n > 0) {
1193 // Copy the CID from the reader query
1194 dynamic_response_info.response[1] = receivedCmd[1];
1195
1196 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1197 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1198 dynamic_response_info.response_n += 2;
1199
1200 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1201 Dbprintf("Error preparing tag response");
1202 if (tracing) {
1203 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1204 }
1205 break;
1206 }
1207 p_response = &dynamic_response_info;
1208 }
1209 }
1210
1211 // Count number of wakeups received after a halt
1212 if(order == 6 && lastorder == 5) { happened++; }
1213
1214 // Count number of other messages after a halt
1215 if(order != 6 && lastorder == 5) { happened2++; }
1216
1217 if(cmdsRecvd > 999) {
1218 DbpString("1000 commands later...");
1219 break;
1220 }
1221 cmdsRecvd++;
1222
1223 if (p_response != NULL) {
1224 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1225 // do the tracing for the previous reader request and this tag answer:
1226 uint8_t par[MAX_PARITY_SIZE];
1227 GetParity(p_response->response, p_response->response_n, par);
1228
1229 EmLogTrace(Uart.output,
1230 Uart.len,
1231 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1232 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1233 Uart.parity,
1234 p_response->response,
1235 p_response->response_n,
1236 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1237 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1238 par);
1239 }
1240
1241 if (!tracing) {
1242 Dbprintf("Trace Full. Simulation stopped.");
1243 break;
1244 }
1245 }
1246
1247 Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
1248 LED_A_OFF();
1249 }
1250
1251
1252 // prepare a delayed transfer. This simply shifts ToSend[] by a number
1253 // of bits specified in the delay parameter.
1254 void PrepareDelayedTransfer(uint16_t delay)
1255 {
1256 uint8_t bitmask = 0;
1257 uint8_t bits_to_shift = 0;
1258 uint8_t bits_shifted = 0;
1259
1260 delay &= 0x07;
1261 if (delay) {
1262 for (uint16_t i = 0; i < delay; i++) {
1263 bitmask |= (0x01 << i);
1264 }
1265 ToSend[ToSendMax++] = 0x00;
1266 for (uint16_t i = 0; i < ToSendMax; i++) {
1267 bits_to_shift = ToSend[i] & bitmask;
1268 ToSend[i] = ToSend[i] >> delay;
1269 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1270 bits_shifted = bits_to_shift;
1271 }
1272 }
1273 }
1274
1275
1276 //-------------------------------------------------------------------------------------
1277 // Transmit the command (to the tag) that was placed in ToSend[].
1278 // Parameter timing:
1279 // if NULL: transfer at next possible time, taking into account
1280 // request guard time and frame delay time
1281 // if == 0: transfer immediately and return time of transfer
1282 // if != 0: delay transfer until time specified
1283 //-------------------------------------------------------------------------------------
1284 static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
1285 {
1286
1287 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1288
1289 uint32_t ThisTransferTime = 0;
1290
1291 if (timing) {
1292 if(*timing == 0) { // Measure time
1293 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
1294 } else {
1295 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1296 }
1297 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1298 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1299 LastTimeProxToAirStart = *timing;
1300 } else {
1301 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1302 while(GetCountSspClk() < ThisTransferTime);
1303 LastTimeProxToAirStart = ThisTransferTime;
1304 }
1305
1306 // clear TXRDY
1307 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1308
1309 uint16_t c = 0;
1310 for(;;) {
1311 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1312 AT91C_BASE_SSC->SSC_THR = cmd[c];
1313 c++;
1314 if(c >= len) {
1315 break;
1316 }
1317 }
1318 }
1319
1320 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
1321 }
1322
1323
1324 //-----------------------------------------------------------------------------
1325 // Prepare reader command (in bits, support short frames) to send to FPGA
1326 //-----------------------------------------------------------------------------
1327 void CodeIso14443aBitsAsReaderPar(const uint8_t * cmd, uint16_t bits, const uint8_t *parity)
1328 {
1329 int i, j;
1330 int last;
1331 uint8_t b;
1332
1333 ToSendReset();
1334
1335 // Start of Communication (Seq. Z)
1336 ToSend[++ToSendMax] = SEC_Z;
1337 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1338 last = 0;
1339
1340 size_t bytecount = nbytes(bits);
1341 // Generate send structure for the data bits
1342 for (i = 0; i < bytecount; i++) {
1343 // Get the current byte to send
1344 b = cmd[i];
1345 size_t bitsleft = MIN((bits-(i*8)),8);
1346
1347 for (j = 0; j < bitsleft; j++) {
1348 if (b & 1) {
1349 // Sequence X
1350 ToSend[++ToSendMax] = SEC_X;
1351 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1352 last = 1;
1353 } else {
1354 if (last == 0) {
1355 // Sequence Z
1356 ToSend[++ToSendMax] = SEC_Z;
1357 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1358 } else {
1359 // Sequence Y
1360 ToSend[++ToSendMax] = SEC_Y;
1361 last = 0;
1362 }
1363 }
1364 b >>= 1;
1365 }
1366
1367 // Only transmit parity bit if we transmitted a complete byte
1368 if (j == 8) {
1369 // Get the parity bit
1370 if (parity[i>>3] & (0x80 >> (i&0x0007))) {
1371 // Sequence X
1372 ToSend[++ToSendMax] = SEC_X;
1373 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1374 last = 1;
1375 } else {
1376 if (last == 0) {
1377 // Sequence Z
1378 ToSend[++ToSendMax] = SEC_Z;
1379 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1380 } else {
1381 // Sequence Y
1382 ToSend[++ToSendMax] = SEC_Y;
1383 last = 0;
1384 }
1385 }
1386 }
1387 }
1388
1389 // End of Communication: Logic 0 followed by Sequence Y
1390 if (last == 0) {
1391 // Sequence Z
1392 ToSend[++ToSendMax] = SEC_Z;
1393 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1394 } else {
1395 // Sequence Y
1396 ToSend[++ToSendMax] = SEC_Y;
1397 last = 0;
1398 }
1399 ToSend[++ToSendMax] = SEC_Y;
1400
1401 // Convert to length of command:
1402 ToSendMax++;
1403 }
1404
1405 //-----------------------------------------------------------------------------
1406 // Prepare reader command to send to FPGA
1407 //-----------------------------------------------------------------------------
1408 void CodeIso14443aAsReaderPar(const uint8_t * cmd, uint16_t len, const uint8_t *parity)
1409 {
1410 CodeIso14443aBitsAsReaderPar(cmd, len*8, parity);
1411 }
1412
1413 //-----------------------------------------------------------------------------
1414 // Wait for commands from reader
1415 // Stop when button is pressed (return 1) or field was gone (return 2)
1416 // Or return 0 when command is captured
1417 //-----------------------------------------------------------------------------
1418 static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
1419 {
1420 *len = 0;
1421
1422 uint32_t timer = 0, vtime = 0;
1423 int analogCnt = 0;
1424 int analogAVG = 0;
1425
1426 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1427 // only, since we are receiving, not transmitting).
1428 // Signal field is off with the appropriate LED
1429 LED_D_OFF();
1430 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1431
1432 // Set ADC to read field strength
1433 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1434 AT91C_BASE_ADC->ADC_MR =
1435 ADC_MODE_PRESCALE(32) |
1436 ADC_MODE_STARTUP_TIME(16) |
1437 ADC_MODE_SAMPLE_HOLD_TIME(8);
1438 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1439 // start ADC
1440 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1441
1442 // Now run a 'software UART' on the stream of incoming samples.
1443 UartInit(received, parity);
1444
1445 // Clear RXRDY:
1446 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1447
1448 for(;;) {
1449 WDT_HIT();
1450
1451 if (BUTTON_PRESS()) return 1;
1452
1453 // test if the field exists
1454 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1455 analogCnt++;
1456 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1457 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1458 if (analogCnt >= 32) {
1459 if ((33000 * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1460 vtime = GetTickCount();
1461 if (!timer) timer = vtime;
1462 // 50ms no field --> card to idle state
1463 if (vtime - timer > 50) return 2;
1464 } else
1465 if (timer) timer = 0;
1466 analogCnt = 0;
1467 analogAVG = 0;
1468 }
1469 }
1470
1471 // receive and test the miller decoding
1472 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1473 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1474 if(MillerDecoding(b, 0)) {
1475 *len = Uart.len;
1476 return 0;
1477 }
1478 }
1479
1480 }
1481 }
1482
1483
1484 static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded)
1485 {
1486 uint8_t b;
1487 uint16_t i = 0;
1488 uint32_t ThisTransferTime;
1489
1490 // Modulate Manchester
1491 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1492
1493 // include correction bit if necessary
1494 if (Uart.parityBits & 0x01) {
1495 correctionNeeded = TRUE;
1496 }
1497 if(correctionNeeded) {
1498 // 1236, so correction bit needed
1499 i = 0;
1500 } else {
1501 i = 1;
1502 }
1503
1504 // clear receiving shift register and holding register
1505 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1506 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1507 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1508 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1509
1510 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1511 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1512 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1513 if (AT91C_BASE_SSC->SSC_RHR) break;
1514 }
1515
1516 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1517
1518 // Clear TXRDY:
1519 AT91C_BASE_SSC->SSC_THR = SEC_F;
1520
1521 // send cycle
1522 for(; i <= respLen; ) {
1523 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1524 AT91C_BASE_SSC->SSC_THR = resp[i++];
1525 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1526 }
1527
1528 if(BUTTON_PRESS()) {
1529 break;
1530 }
1531 }
1532
1533 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1534 for (i = 0; i < 2 ; ) {
1535 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1536 AT91C_BASE_SSC->SSC_THR = SEC_F;
1537 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1538 i++;
1539 }
1540 }
1541
1542 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1543
1544 return 0;
1545 }
1546
1547 int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1548 Code4bitAnswerAsTag(resp);
1549 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1550 // do the tracing for the previous reader request and this tag answer:
1551 uint8_t par[1];
1552 GetParity(&resp, 1, par);
1553 EmLogTrace(Uart.output,
1554 Uart.len,
1555 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1556 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1557 Uart.parity,
1558 &resp,
1559 1,
1560 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1561 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1562 par);
1563 return res;
1564 }
1565
1566 int EmSend4bit(uint8_t resp){
1567 return EmSend4bitEx(resp, false);
1568 }
1569
1570 int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par){
1571 CodeIso14443aAsTagPar(resp, respLen, par);
1572 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1573 // do the tracing for the previous reader request and this tag answer:
1574 EmLogTrace(Uart.output,
1575 Uart.len,
1576 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1577 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1578 Uart.parity,
1579 resp,
1580 respLen,
1581 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1582 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1583 par);
1584 return res;
1585 }
1586
1587 int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
1588 uint8_t par[MAX_PARITY_SIZE];
1589 GetParity(resp, respLen, par);
1590 return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
1591 }
1592
1593 int EmSendCmd(uint8_t *resp, uint16_t respLen){
1594 uint8_t par[MAX_PARITY_SIZE];
1595 GetParity(resp, respLen, par);
1596 return EmSendCmdExPar(resp, respLen, false, par);
1597 }
1598
1599 int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par){
1600 return EmSendCmdExPar(resp, respLen, false, par);
1601 }
1602
1603 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
1604 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity)
1605 {
1606 if (tracing) {
1607 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1608 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1609 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1610 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1611 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1612 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1613 reader_EndTime = tag_StartTime - exact_fdt;
1614 reader_StartTime = reader_EndTime - reader_modlen;
1615 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
1616 return FALSE;
1617 } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
1618 } else {
1619 return TRUE;
1620 }
1621 }
1622
1623 //-----------------------------------------------------------------------------
1624 // Wait a certain time for tag response
1625 // If a response is captured return TRUE
1626 // If it takes too long return FALSE
1627 //-----------------------------------------------------------------------------
1628 static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
1629 {
1630 uint16_t c;
1631
1632 // Set FPGA mode to "reader listen mode", no modulation (listen
1633 // only, since we are receiving, not transmitting).
1634 // Signal field is on with the appropriate LED
1635 LED_D_ON();
1636 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1637
1638 // Now get the answer from the card
1639 DemodInit(receivedResponse, receivedResponsePar);
1640
1641 // clear RXRDY:
1642 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1643
1644 c = 0;
1645 for(;;) {
1646 WDT_HIT();
1647
1648 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1649 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1650 if(ManchesterDecoding(b, offset, 0)) {
1651 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
1652 return TRUE;
1653 } else if (c++ > iso14a_timeout) {
1654 return FALSE;
1655 }
1656 }
1657 }
1658 }
1659
1660 void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
1661 {
1662 CodeIso14443aBitsAsReaderPar(frame, bits, par);
1663
1664 // Send command to tag
1665 TransmitFor14443a(ToSend, ToSendMax, timing);
1666 if(trigger)
1667 LED_A_ON();
1668
1669 // Log reader command in trace buffer
1670 if (tracing) {
1671 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1672 }
1673 }
1674
1675 void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
1676 {
1677 ReaderTransmitBitsPar(frame, len*8, par, timing);
1678 }
1679
1680 void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
1681 {
1682 // Generate parity and redirect
1683 uint8_t par[MAX_PARITY_SIZE];
1684 GetParity(frame, len/8, par);
1685 ReaderTransmitBitsPar(frame, len, par, timing);
1686 }
1687
1688 void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
1689 {
1690 // Generate parity and redirect
1691 uint8_t par[MAX_PARITY_SIZE];
1692 GetParity(frame, len, par);
1693 ReaderTransmitBitsPar(frame, len*8, par, timing);
1694 }
1695
1696 int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
1697 {
1698 if (!GetIso14443aAnswerFromTag(receivedAnswer,parity,offset)) return FALSE;
1699 if (tracing) {
1700 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1701 }
1702 return Demod.len;
1703 }
1704
1705 int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
1706 {
1707 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
1708 if (tracing) {
1709 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1710 }
1711 return Demod.len;
1712 }
1713
1714 /* performs iso14443a anticollision procedure
1715 * fills the uid pointer unless NULL
1716 * fills resp_data unless NULL */
1717 int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) {
1718
1719 iso14a_set_timeout(10500); // 10ms default 10*105 =
1720
1721 //uint8_t deselect[] = {0xc2}; //DESELECT
1722 //uint8_t halt[] = { 0x50, 0x00, 0x57, 0xCD }; // HALT
1723 uint8_t wupa[] = { 0x52 }; // WAKE-UP
1724 //uint8_t reqa[] = { 0x26 }; // REQUEST A
1725 uint8_t sel_all[] = { 0x93,0x20 };
1726 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1727 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1728 uint8_t *resp = ((uint8_t *)BigBuf) + RECV_RESP_OFFSET;
1729 uint8_t *resp_par = ((uint8_t *)BigBuf) + RECV_RESP_PAR_OFFSET;
1730
1731 byte_t uid_resp[4];
1732 size_t uid_resp_len;
1733 uint8_t sak = 0x04; // cascade uid
1734 int cascade_level = 0;
1735 int len;
1736
1737 // test for the SKYLANDERS TOY.
1738 // ReaderTransmit(deselect,sizeof(deselect), NULL);
1739 // len = ReaderReceive(resp, resp_par);
1740
1741 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1742 ReaderTransmitBitsPar(wupa,7,0, NULL);
1743
1744 // Receive the ATQA
1745 if(!ReaderReceive(resp, resp_par)) return 0;
1746
1747 if(p_hi14a_card) {
1748 memcpy(p_hi14a_card->atqa, resp, 2);
1749 p_hi14a_card->uidlen = 0;
1750 memset(p_hi14a_card->uid,0,10);
1751 }
1752
1753 // clear uid
1754 if (uid_ptr) {
1755 memset(uid_ptr,0,10);
1756 }
1757
1758 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1759 // which case we need to make a cascade 2 request and select - this is a long UID
1760 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1761 for(; sak & 0x04; cascade_level++) {
1762 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1763 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1764
1765 // SELECT_ALL
1766 ReaderTransmit(sel_all,sizeof(sel_all), NULL);
1767 if (!ReaderReceive(resp, resp_par)) return 0;
1768
1769 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1770 memset(uid_resp, 0, 4);
1771 uint16_t uid_resp_bits = 0;
1772 uint16_t collision_answer_offset = 0;
1773 // anti-collision-loop:
1774 while (Demod.collisionPos) {
1775 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1776 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1777 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1778 uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8);
1779 }
1780 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1781 uid_resp_bits++;
1782 // construct anticollosion command:
1783 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1784 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1785 sel_uid[2+i] = uid_resp[i];
1786 }
1787 collision_answer_offset = uid_resp_bits%8;
1788 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1789 if (!ReaderReceiveOffset(resp, collision_answer_offset,resp_par)) return 0;
1790 }
1791 // finally, add the last bits and BCC of the UID
1792 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1793 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1794 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1795 }
1796
1797 } else { // no collision, use the response to SELECT_ALL as current uid
1798 memcpy(uid_resp,resp,4);
1799 }
1800 uid_resp_len = 4;
1801
1802 // calculate crypto UID. Always use last 4 Bytes.
1803 if(cuid_ptr) {
1804 *cuid_ptr = bytes_to_num(uid_resp, 4);
1805 }
1806
1807 // Construct SELECT UID command
1808 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1809 memcpy(sel_uid+2,uid_resp,4); // the UID
1810 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1811 AppendCrc14443a(sel_uid,7); // calculate and add CRC
1812 ReaderTransmit(sel_uid,sizeof(sel_uid), NULL);
1813
1814 // Receive the SAK
1815 if (!ReaderReceive(resp, resp_par)) return 0;
1816 sak = resp[0];
1817
1818 // Test if more parts of the uid are coming
1819 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
1820 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1821 // http://www.nxp.com/documents/application_note/AN10927.pdf
1822 uid_resp[0] = uid_resp[1];
1823 uid_resp[1] = uid_resp[2];
1824 uid_resp[2] = uid_resp[3];
1825
1826 uid_resp_len = 3;
1827 }
1828
1829 if(uid_ptr) {
1830 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
1831 }
1832
1833 if(p_hi14a_card) {
1834 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
1835 p_hi14a_card->uidlen += uid_resp_len;
1836 }
1837 }
1838
1839 if(p_hi14a_card) {
1840 p_hi14a_card->sak = sak;
1841 p_hi14a_card->ats_len = 0;
1842 }
1843
1844 if( (sak & 0x20) == 0) {
1845 return 2; // non iso14443a compliant tag
1846 }
1847
1848 // Request for answer to select
1849 AppendCrc14443a(rats, 2);
1850 ReaderTransmit(rats, sizeof(rats), NULL);
1851
1852
1853 len = ReaderReceive(resp, resp_par);
1854 Dbprintf("RATS Reponse: %d", len);
1855 if(!len) {
1856 Dbprintf("RATS: %02x %02x %02x", resp[0], resp[1], resp[2]);
1857 return 0;
1858 }
1859
1860 if(p_hi14a_card) {
1861 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
1862 p_hi14a_card->ats_len = len;
1863 }
1864
1865 // reset the PCB block number
1866 iso14_pcb_blocknum = 0;
1867 return 1;
1868 }
1869
1870 void iso14443a_setup(uint8_t fpga_minor_mode) {
1871 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1872 // Set up the synchronous serial port
1873 FpgaSetupSsc();
1874 // connect Demodulated Signal to ADC:
1875 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1876
1877 // Signal field is on with the appropriate LED
1878 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
1879 LED_D_ON();
1880 } else {
1881 LED_D_OFF();
1882 }
1883 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
1884
1885 // Start the timer
1886 StartCountSspClk();
1887
1888 DemodReset();
1889 UartReset();
1890 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
1891 iso14a_set_timeout(1050); // 10ms default 10*105 =
1892 }
1893
1894 int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
1895 uint8_t parity[MAX_PARITY_SIZE];
1896 uint8_t real_cmd[cmd_len+4];
1897 real_cmd[0] = 0x0a; //I-Block
1898 // put block number into the PCB
1899 real_cmd[0] |= iso14_pcb_blocknum;
1900 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
1901 memcpy(real_cmd+2, cmd, cmd_len);
1902 AppendCrc14443a(real_cmd,cmd_len+2);
1903
1904 ReaderTransmit(real_cmd, cmd_len+4, NULL);
1905 size_t len = ReaderReceive(data, parity);
1906 uint8_t * data_bytes = (uint8_t *) data;
1907 if (!len)
1908 return 0; //DATA LINK ERROR
1909 // if we received an I- or R(ACK)-Block with a block number equal to the
1910 // current block number, toggle the current block number
1911 else if (len >= 4 // PCB+CID+CRC = 4 bytes
1912 && ((data_bytes[0] & 0xC0) == 0 // I-Block
1913 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1914 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
1915 {
1916 iso14_pcb_blocknum ^= 1;
1917 }
1918
1919 return len;
1920 }
1921
1922 //-----------------------------------------------------------------------------
1923 // Read an ISO 14443a tag. Send out commands and store answers.
1924 //
1925 //-----------------------------------------------------------------------------
1926 void ReaderIso14443a(UsbCommand *c)
1927 {
1928 iso14a_command_t param = c->arg[0];
1929 uint8_t *cmd = c->d.asBytes;
1930 size_t len = c->arg[1];
1931 size_t lenbits = c->arg[2];
1932 uint32_t arg0 = 0;
1933 byte_t buf[USB_CMD_DATA_SIZE];
1934 uint8_t par[MAX_PARITY_SIZE];
1935
1936 if(param & ISO14A_CONNECT) {
1937 iso14a_clear_trace();
1938 }
1939
1940 iso14a_set_tracing(TRUE);
1941
1942 if(param & ISO14A_REQUEST_TRIGGER) {
1943 iso14a_set_trigger(TRUE);
1944 }
1945
1946 if(param & ISO14A_CONNECT) {
1947 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1948 if(!(param & ISO14A_NO_SELECT)) {
1949 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
1950 arg0 = iso14443a_select_card(NULL,card,NULL);
1951 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
1952 }
1953 }
1954
1955 if(param & ISO14A_SET_TIMEOUT) {
1956 iso14a_set_timeout(c->arg[2]);
1957 }
1958
1959 if(param & ISO14A_APDU) {
1960 arg0 = iso14_apdu(cmd, len, buf);
1961 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
1962 }
1963
1964 if(param & ISO14A_RAW) {
1965 if(param & ISO14A_APPEND_CRC) {
1966 AppendCrc14443a(cmd,len);
1967 len += 2;
1968 if (lenbits) lenbits += 16;
1969 }
1970 if(lenbits>0) {
1971 GetParity(cmd, lenbits/8, par);
1972 ReaderTransmitBitsPar(cmd, lenbits, par, NULL);
1973 } else {
1974 ReaderTransmit(cmd,len, NULL);
1975 }
1976 arg0 = ReaderReceive(buf, par);
1977 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
1978 }
1979
1980 if(param & ISO14A_REQUEST_TRIGGER) {
1981 iso14a_set_trigger(FALSE);
1982 }
1983
1984 if(param & ISO14A_NO_DISCONNECT) {
1985 return;
1986 }
1987
1988 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1989 LEDsoff();
1990 }
1991
1992
1993 // Determine the distance between two nonces.
1994 // Assume that the difference is small, but we don't know which is first.
1995 // Therefore try in alternating directions.
1996 int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
1997
1998 uint16_t i;
1999 uint32_t nttmp1, nttmp2;
2000
2001 if (nt1 == nt2) return 0;
2002
2003 nttmp1 = nt1;
2004 nttmp2 = nt2;
2005
2006 for (i = 1; i < 32768; i++) {
2007 nttmp1 = prng_successor(nttmp1, 1);
2008 if (nttmp1 == nt2) return i;
2009 nttmp2 = prng_successor(nttmp2, 1);
2010 if (nttmp2 == nt1) return -i;
2011 }
2012
2013 return(-99999); // either nt1 or nt2 are invalid nonces
2014 }
2015
2016
2017 //-----------------------------------------------------------------------------
2018 // Recover several bits of the cypher stream. This implements (first stages of)
2019 // the algorithm described in "The Dark Side of Security by Obscurity and
2020 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2021 // (article by Nicolas T. Courtois, 2009)
2022 //-----------------------------------------------------------------------------
2023 void ReaderMifare(bool first_try)
2024 {
2025 // Mifare AUTH
2026 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
2027 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
2028 static uint8_t mf_nr_ar3;
2029
2030 uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
2031 uint8_t* receivedAnswerPar = (((uint8_t *)BigBuf) + RECV_RESP_PAR_OFFSET);
2032
2033 iso14a_clear_trace();
2034 iso14a_set_tracing(TRUE);
2035
2036 byte_t nt_diff = 0;
2037 uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
2038 static byte_t par_low = 0;
2039 bool led_on = TRUE;
2040 uint8_t uid[10] ={0};
2041 uint32_t cuid;
2042
2043 uint32_t nt = 0;
2044 uint32_t previous_nt = 0;
2045 static uint32_t nt_attacked = 0;
2046 byte_t par_list[8] = {0x00};
2047 byte_t ks_list[8] = {0x00};
2048
2049 static uint32_t sync_time;
2050 static uint32_t sync_cycles;
2051 int catch_up_cycles = 0;
2052 int last_catch_up = 0;
2053 uint16_t consecutive_resyncs = 0;
2054 int isOK = 0;
2055
2056 if (first_try) {
2057 mf_nr_ar3 = 0;
2058 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2059 sync_time = GetCountSspClk() & 0xfffffff8;
2060 sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
2061 nt_attacked = 0;
2062 nt = 0;
2063 par[0] = 0;
2064 }
2065 else {
2066 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
2067 mf_nr_ar3++;
2068 mf_nr_ar[3] = mf_nr_ar3;
2069 par[0] = par_low;
2070 }
2071
2072 LED_A_ON();
2073 LED_B_OFF();
2074 LED_C_OFF();
2075
2076
2077 for(uint16_t i = 0; TRUE; i++) {
2078
2079 WDT_HIT();
2080
2081 // Test if the action was cancelled
2082 if(BUTTON_PRESS()) {
2083 break;
2084 }
2085
2086 LED_C_ON();
2087
2088 if(!iso14443a_select_card(uid, NULL, &cuid)) {
2089 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
2090 continue;
2091 }
2092
2093 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
2094 catch_up_cycles = 0;
2095
2096 // if we missed the sync time already, advance to the next nonce repeat
2097 while(GetCountSspClk() > sync_time) {
2098 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
2099 }
2100
2101 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2102 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2103
2104 // Receive the (4 Byte) "random" nonce
2105 if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
2106 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2107 continue;
2108 }
2109
2110 previous_nt = nt;
2111 nt = bytes_to_num(receivedAnswer, 4);
2112
2113 // Transmit reader nonce with fake par
2114 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
2115
2116 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2117 int nt_distance = dist_nt(previous_nt, nt);
2118 if (nt_distance == 0) {
2119 nt_attacked = nt;
2120 }
2121 else {
2122 if (nt_distance == -99999) { // invalid nonce received, try again
2123 continue;
2124 }
2125 sync_cycles = (sync_cycles - nt_distance);
2126 if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
2127 continue;
2128 }
2129 }
2130
2131 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2132 catch_up_cycles = -dist_nt(nt_attacked, nt);
2133 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2134 catch_up_cycles = 0;
2135 continue;
2136 }
2137 if (catch_up_cycles == last_catch_up) {
2138 consecutive_resyncs++;
2139 }
2140 else {
2141 last_catch_up = catch_up_cycles;
2142 consecutive_resyncs = 0;
2143 }
2144 if (consecutive_resyncs < 3) {
2145 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
2146 }
2147 else {
2148 sync_cycles = sync_cycles + catch_up_cycles;
2149 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
2150 }
2151 continue;
2152 }
2153
2154 consecutive_resyncs = 0;
2155
2156 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2157 if (ReaderReceive(receivedAnswer, receivedAnswerPar))
2158 {
2159 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2160
2161 if (nt_diff == 0)
2162 {
2163 par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2164 }
2165
2166 led_on = !led_on;
2167 if(led_on) LED_B_ON(); else LED_B_OFF();
2168
2169 par_list[nt_diff] = SwapBits(par[0], 8);
2170 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2171
2172 // Test if the information is complete
2173 if (nt_diff == 0x07) {
2174 isOK = 1;
2175 break;
2176 }
2177
2178 nt_diff = (nt_diff + 1) & 0x07;
2179 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2180 par[0] = par_low;
2181 } else {
2182 if (nt_diff == 0 && first_try)
2183 {
2184 par[0]++;
2185 } else {
2186 par[0] = ((par[0] & 0x1F) + 1) | par_low;
2187 }
2188 }
2189 }
2190
2191
2192 mf_nr_ar[3] &= 0x1F;
2193
2194 byte_t buf[28];
2195 memcpy(buf + 0, uid, 4);
2196 num_to_bytes(nt, 4, buf + 4);
2197 memcpy(buf + 8, par_list, 8);
2198 memcpy(buf + 16, ks_list, 8);
2199 memcpy(buf + 24, mf_nr_ar, 4);
2200
2201 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2202
2203 // Thats it...
2204 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2205 LEDsoff();
2206
2207 iso14a_set_tracing(FALSE);
2208 }
2209
2210 /**
2211 *MIFARE 1K simulate.
2212 *
2213 *@param flags :
2214 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2215 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2216 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2217 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2218 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2219 */
2220 void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
2221 {
2222 int cardSTATE = MFEMUL_NOFIELD;
2223 int _7BUID = 0;
2224 int vHf = 0; // in mV
2225 int res;
2226 uint32_t selTimer = 0;
2227 uint32_t authTimer = 0;
2228 uint16_t len = 0;
2229 uint8_t cardWRBL = 0;
2230 uint8_t cardAUTHSC = 0;
2231 uint8_t cardAUTHKEY = 0xff; // no authentication
2232 uint32_t cardRr = 0;
2233 uint32_t cuid = 0;
2234 //uint32_t rn_enc = 0;
2235 uint32_t ans = 0;
2236 uint32_t cardINTREG = 0;
2237 uint8_t cardINTBLOCK = 0;
2238 struct Crypto1State mpcs = {0, 0};
2239 struct Crypto1State *pcs;
2240 pcs = &mpcs;
2241 uint32_t numReads = 0;//Counts numer of times reader read a block
2242 uint8_t* receivedCmd = get_bigbufptr_recvcmdbuf();
2243 uint8_t* receivedCmd_par = receivedCmd + MAX_FRAME_SIZE;
2244 uint8_t* response = get_bigbufptr_recvrespbuf();
2245 uint8_t* response_par = response + MAX_FRAME_SIZE;
2246
2247 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2248 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2249 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2250 uint8_t rSAK[] = {0x08, 0xb6, 0xdd};
2251 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
2252
2253 uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
2254 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
2255
2256 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2257 // This can be used in a reader-only attack.
2258 // (it can also be retrieved via 'hf 14a list', but hey...
2259 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0};
2260 uint8_t ar_nr_collected = 0;
2261
2262 // clear trace
2263 iso14a_clear_trace();
2264 iso14a_set_tracing(TRUE);
2265
2266 // Authenticate response - nonce
2267 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
2268
2269 //-- Determine the UID
2270 // Can be set from emulator memory, incoming data
2271 // and can be 7 or 4 bytes long
2272 if (flags & FLAG_4B_UID_IN_DATA)
2273 {
2274 // 4B uid comes from data-portion of packet
2275 memcpy(rUIDBCC1,datain,4);
2276 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2277
2278 } else if (flags & FLAG_7B_UID_IN_DATA) {
2279 // 7B uid comes from data-portion of packet
2280 memcpy(&rUIDBCC1[1],datain,3);
2281 memcpy(rUIDBCC2, datain+3, 4);
2282 _7BUID = true;
2283 } else {
2284 // get UID from emul memory
2285 emlGetMemBt(receivedCmd, 7, 1);
2286 _7BUID = !(receivedCmd[0] == 0x00);
2287 if (!_7BUID) { // ---------- 4BUID
2288 emlGetMemBt(rUIDBCC1, 0, 4);
2289 } else { // ---------- 7BUID
2290 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2291 emlGetMemBt(rUIDBCC2, 3, 4);
2292 }
2293 }
2294
2295 /*
2296 * Regardless of what method was used to set the UID, set fifth byte and modify
2297 * the ATQA for 4 or 7-byte UID
2298 */
2299 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2300 if (_7BUID) {
2301 rATQA[0] = 0x44;
2302 rUIDBCC1[0] = 0x88;
2303 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2304 }
2305
2306 // We need to listen to the high-frequency, peak-detected path.
2307 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
2308
2309
2310 if (MF_DBGLEVEL >= 1) {
2311 if (!_7BUID) {
2312 Dbprintf("4B UID: %02x%02x%02x%02x",
2313 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
2314 } else {
2315 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2316 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
2317 rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
2318 }
2319 }
2320
2321 bool finished = FALSE;
2322 while (!BUTTON_PRESS() && !finished) {
2323 WDT_HIT();
2324
2325 // find reader field
2326 // Vref = 3300mV, and an 10:1 voltage divider on the input
2327 // can measure voltages up to 33000 mV
2328 if (cardSTATE == MFEMUL_NOFIELD) {
2329 vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
2330 if (vHf > MF_MINFIELDV) {
2331 cardSTATE_TO_IDLE();
2332 LED_A_ON();
2333 }
2334 }
2335 if(cardSTATE == MFEMUL_NOFIELD) continue;
2336
2337 //Now, get data
2338
2339 res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
2340 if (res == 2) { //Field is off!
2341 cardSTATE = MFEMUL_NOFIELD;
2342 LEDsoff();
2343 continue;
2344 } else if (res == 1) {
2345 break; //return value 1 means button press
2346 }
2347
2348 // REQ or WUP request in ANY state and WUP in HALTED state
2349 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2350 selTimer = GetTickCount();
2351 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2352 cardSTATE = MFEMUL_SELECT1;
2353
2354 // init crypto block
2355 LED_B_OFF();
2356 LED_C_OFF();
2357 crypto1_destroy(pcs);
2358 cardAUTHKEY = 0xff;
2359 continue;
2360 }
2361
2362 switch (cardSTATE) {
2363 case MFEMUL_NOFIELD:
2364 case MFEMUL_HALTED:
2365 case MFEMUL_IDLE:{
2366 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2367 break;
2368 }
2369 case MFEMUL_SELECT1:{
2370 // select all
2371 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
2372 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
2373 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
2374 break;
2375 }
2376
2377 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2378 {
2379 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2380 }
2381 // select card
2382 if (len == 9 &&
2383 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
2384 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
2385 cuid = bytes_to_num(rUIDBCC1, 4);
2386 if (!_7BUID) {
2387 cardSTATE = MFEMUL_WORK;
2388 LED_B_ON();
2389 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2390 break;
2391 } else {
2392 cardSTATE = MFEMUL_SELECT2;
2393 }
2394 }
2395 break;
2396 }
2397 case MFEMUL_AUTH1:{
2398 if( len != 8)
2399 {
2400 cardSTATE_TO_IDLE();
2401 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2402 break;
2403 }
2404 uint32_t ar = bytes_to_num(receivedCmd, 4);
2405 uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
2406
2407 //Collect AR/NR
2408 if(ar_nr_collected < 2){
2409 if(ar_nr_responses[2] != ar)
2410 {// Avoid duplicates... probably not necessary, ar should vary.
2411 ar_nr_responses[ar_nr_collected*4] = cuid;
2412 ar_nr_responses[ar_nr_collected*4+1] = nonce;
2413 ar_nr_responses[ar_nr_collected*4+2] = ar;
2414 ar_nr_responses[ar_nr_collected*4+3] = nr;
2415 ar_nr_collected++;
2416 }
2417 }
2418
2419 // --- crypto
2420 crypto1_word(pcs, ar , 1);
2421 cardRr = nr ^ crypto1_word(pcs, 0, 0);
2422
2423 // test if auth OK
2424 if (cardRr != prng_successor(nonce, 64)){
2425 if (MF_DBGLEVEL >= 2) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2426 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2427 cardRr, prng_successor(nonce, 64));
2428 // Shouldn't we respond anything here?
2429 // Right now, we don't nack or anything, which causes the
2430 // reader to do a WUPA after a while. /Martin
2431 // -- which is the correct response. /piwi
2432 cardSTATE_TO_IDLE();
2433 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2434 break;
2435 }
2436
2437 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2438
2439 num_to_bytes(ans, 4, rAUTH_AT);
2440 // --- crypto
2441 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2442 LED_C_ON();
2443 cardSTATE = MFEMUL_WORK;
2444 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2445 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2446 GetTickCount() - authTimer);
2447 break;
2448 }
2449 case MFEMUL_SELECT2:{
2450 if (!len) {
2451 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2452 break;
2453 }
2454 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
2455 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
2456 break;
2457 }
2458
2459 // select 2 card
2460 if (len == 9 &&
2461 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2462 EmSendCmd(rSAK, sizeof(rSAK));
2463 cuid = bytes_to_num(rUIDBCC2, 4);
2464 cardSTATE = MFEMUL_WORK;
2465 LED_B_ON();
2466 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
2467 break;
2468 }
2469
2470 // i guess there is a command). go into the work state.
2471 if (len != 4) {
2472 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2473 break;
2474 }
2475 cardSTATE = MFEMUL_WORK;
2476 //goto lbWORK;
2477 //intentional fall-through to the next case-stmt
2478 }
2479
2480 case MFEMUL_WORK:{
2481 if (len == 0) {
2482 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2483 break;
2484 }
2485
2486 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2487
2488 if(encrypted_data) {
2489 // decrypt seqence
2490 mf_crypto1_decrypt(pcs, receivedCmd, len);
2491 }
2492
2493 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2494 authTimer = GetTickCount();
2495 cardAUTHSC = receivedCmd[1] / 4; // received block num
2496 cardAUTHKEY = receivedCmd[0] - 0x60;
2497 crypto1_destroy(pcs);//Added by martin
2498 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
2499
2500 if (!encrypted_data) { // first authentication
2501 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2502
2503 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2504 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
2505 } else { // nested authentication
2506 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2507 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
2508 num_to_bytes(ans, 4, rAUTH_AT);
2509 }
2510 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2511 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2512 cardSTATE = MFEMUL_AUTH1;
2513 break;
2514 }
2515
2516 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2517 // BUT... ACK --> NACK
2518 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2519 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2520 break;
2521 }
2522
2523 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2524 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2525 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2526 break;
2527 }
2528
2529 if(len != 4) {
2530 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2531 break;
2532 }
2533
2534 if(receivedCmd[0] == 0x30 // read block
2535 || receivedCmd[0] == 0xA0 // write block
2536 || receivedCmd[0] == 0xC0 // inc
2537 || receivedCmd[0] == 0xC1 // dec
2538 || receivedCmd[0] == 0xC2 // restore
2539 || receivedCmd[0] == 0xB0) { // transfer
2540 if (receivedCmd[1] >= 16 * 4) {
2541 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2542 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2543 break;
2544 }
2545
2546 if (receivedCmd[1] / 4 != cardAUTHSC) {
2547 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2548 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
2549 break;
2550 }
2551 }
2552 // read block
2553 if (receivedCmd[0] == 0x30) {
2554 if (MF_DBGLEVEL >= 4) {
2555 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2556 }
2557 emlGetMem(response, receivedCmd[1], 1);
2558 AppendCrc14443a(response, 16);
2559 mf_crypto1_encrypt(pcs, response, 18, response_par);
2560 EmSendCmdPar(response, 18, response_par);
2561 numReads++;
2562 if(exitAfterNReads > 0 && numReads == exitAfterNReads) {
2563 Dbprintf("%d reads done, exiting", numReads);
2564 finished = true;
2565 }
2566 break;
2567 }
2568 // write block
2569 if (receivedCmd[0] == 0xA0) {
2570 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
2571 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2572 cardSTATE = MFEMUL_WRITEBL2;
2573 cardWRBL = receivedCmd[1];
2574 break;
2575 }
2576 // increment, decrement, restore
2577 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
2578 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2579 if (emlCheckValBl(receivedCmd[1])) {
2580 if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
2581 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2582 break;
2583 }
2584 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2585 if (receivedCmd[0] == 0xC1)
2586 cardSTATE = MFEMUL_INTREG_INC;
2587 if (receivedCmd[0] == 0xC0)
2588 cardSTATE = MFEMUL_INTREG_DEC;
2589 if (receivedCmd[0] == 0xC2)
2590 cardSTATE = MFEMUL_INTREG_REST;
2591 cardWRBL = receivedCmd[1];
2592 break;
2593 }
2594 // transfer
2595 if (receivedCmd[0] == 0xB0) {
2596 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2597 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2598 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2599 else
2600 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2601 break;
2602 }
2603 // halt
2604 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
2605 LED_B_OFF();
2606 LED_C_OFF();
2607 cardSTATE = MFEMUL_HALTED;
2608 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
2609 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2610 break;
2611 }
2612 // RATS
2613 if (receivedCmd[0] == 0xe0) {//RATS
2614 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2615 break;
2616 }
2617 // command not allowed
2618 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2619 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2620 break;
2621 }
2622 case MFEMUL_WRITEBL2:{
2623 if (len == 18){
2624 mf_crypto1_decrypt(pcs, receivedCmd, len);
2625 emlSetMem(receivedCmd, cardWRBL, 1);
2626 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2627 cardSTATE = MFEMUL_WORK;
2628 } else {
2629 cardSTATE_TO_IDLE();
2630 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2631 }
2632 break;
2633 }
2634
2635 case MFEMUL_INTREG_INC:{
2636 mf_crypto1_decrypt(pcs, receivedCmd, len);
2637 memcpy(&ans, receivedCmd, 4);
2638 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2639 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2640 cardSTATE_TO_IDLE();
2641 break;
2642 }
2643 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2644 cardINTREG = cardINTREG + ans;
2645 cardSTATE = MFEMUL_WORK;
2646 break;
2647 }
2648 case MFEMUL_INTREG_DEC:{
2649 mf_crypto1_decrypt(pcs, receivedCmd, len);
2650 memcpy(&ans, receivedCmd, 4);
2651 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2652 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2653 cardSTATE_TO_IDLE();
2654 break;
2655 }
2656 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2657 cardINTREG = cardINTREG - ans;
2658 cardSTATE = MFEMUL_WORK;
2659 break;
2660 }
2661 case MFEMUL_INTREG_REST:{
2662 mf_crypto1_decrypt(pcs, receivedCmd, len);
2663 memcpy(&ans, receivedCmd, 4);
2664 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2665 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2666 cardSTATE_TO_IDLE();
2667 break;
2668 }
2669 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2670 cardSTATE = MFEMUL_WORK;
2671 break;
2672 }
2673 }
2674 }
2675
2676 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2677 LEDsoff();
2678
2679 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2680 {
2681 //May just aswell send the collected ar_nr in the response aswell
2682 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,0,0,&ar_nr_responses,ar_nr_collected*4*4);
2683 }
2684
2685 if(flags & FLAG_NR_AR_ATTACK)
2686 {
2687 if(ar_nr_collected > 1) {
2688 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
2689 Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
2690 ar_nr_responses[0], // UID
2691 ar_nr_responses[1], //NT
2692 ar_nr_responses[2], //AR1
2693 ar_nr_responses[3], //NR1
2694 ar_nr_responses[6], //AR2
2695 ar_nr_responses[7] //NR2
2696 );
2697 } else {
2698 Dbprintf("Failed to obtain two AR/NR pairs!");
2699 if(ar_nr_collected >0) {
2700 Dbprintf("Only got these: UID=%08x, nonce=%08x, AR1=%08x, NR1=%08x",
2701 ar_nr_responses[0], // UID
2702 ar_nr_responses[1], //NT
2703 ar_nr_responses[2], //AR1
2704 ar_nr_responses[3] //NR1
2705 );
2706 }
2707 }
2708 }
2709 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, traceLen);
2710 }
2711
2712
2713
2714 //-----------------------------------------------------------------------------
2715 // MIFARE sniffer.
2716 //
2717 //-----------------------------------------------------------------------------
2718 void RAMFUNC SniffMifare(uint8_t param) {
2719 // param:
2720 // bit 0 - trigger from first card answer
2721 // bit 1 - trigger from first reader 7-bit request
2722
2723 // C(red) A(yellow) B(green)
2724 LEDsoff();
2725 // init trace buffer
2726 iso14a_clear_trace();
2727 iso14a_set_tracing(TRUE);
2728
2729 // The command (reader -> tag) that we're receiving.
2730 // The length of a received command will in most cases be no more than 18 bytes.
2731 // So 32 should be enough!
2732 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
2733 uint8_t *receivedCmdPar = ((uint8_t *)BigBuf) + RECV_CMD_PAR_OFFSET;
2734 // The response (tag -> reader) that we're receiving.
2735 uint8_t *receivedResponse = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
2736 uint8_t *receivedResponsePar = ((uint8_t *)BigBuf) + RECV_RESP_PAR_OFFSET;
2737
2738 // As we receive stuff, we copy it from receivedCmd or receivedResponse
2739 // into trace, along with its length and other annotations.
2740 //uint8_t *trace = (uint8_t *)BigBuf;
2741
2742 // The DMA buffer, used to stream samples from the FPGA
2743 uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
2744 uint8_t *data = dmaBuf;
2745 uint8_t previous_data = 0;
2746 int maxDataLen = 0;
2747 int dataLen = 0;
2748 bool ReaderIsActive = FALSE;
2749 bool TagIsActive = FALSE;
2750
2751 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
2752
2753 // Set up the demodulator for tag -> reader responses.
2754 DemodInit(receivedResponse, receivedResponsePar);
2755
2756 // Set up the demodulator for the reader -> tag commands
2757 UartInit(receivedCmd, receivedCmdPar);
2758
2759 // Setup for the DMA.
2760 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
2761
2762 LED_D_OFF();
2763
2764 // init sniffer
2765 MfSniffInit();
2766
2767 // And now we loop, receiving samples.
2768 for(uint32_t sniffCounter = 0; TRUE; ) {
2769
2770 if(BUTTON_PRESS()) {
2771 DbpString("cancelled by button");
2772 break;
2773 }
2774
2775 LED_A_ON();
2776 WDT_HIT();
2777
2778 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
2779 // check if a transaction is completed (timeout after 2000ms).
2780 // if yes, stop the DMA transfer and send what we have so far to the client
2781 if (MfSniffSend(2000)) {
2782 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2783 sniffCounter = 0;
2784 data = dmaBuf;
2785 maxDataLen = 0;
2786 ReaderIsActive = FALSE;
2787 TagIsActive = FALSE;
2788 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
2789 }
2790 }
2791
2792 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
2793 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
2794 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
2795 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
2796 } else {
2797 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
2798 }
2799 // test for length of buffer
2800 if(dataLen > maxDataLen) { // we are more behind than ever...
2801 maxDataLen = dataLen;
2802 if(dataLen > 400) {
2803 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
2804 break;
2805 }
2806 }
2807 if(dataLen < 1) continue;
2808
2809 // primary buffer was stopped ( <-- we lost data!
2810 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
2811 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
2812 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
2813 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
2814 }
2815 // secondary buffer sets as primary, secondary buffer was stopped
2816 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
2817 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
2818 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
2819 }
2820
2821 LED_A_OFF();
2822
2823 if (sniffCounter & 0x01) {
2824
2825 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
2826 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
2827 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
2828 LED_C_INV();
2829 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
2830
2831 /* And ready to receive another command. */
2832 UartReset();
2833
2834 /* And also reset the demod code */
2835 DemodReset();
2836 }
2837 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
2838 }
2839
2840 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
2841 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
2842 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
2843 LED_C_INV();
2844
2845 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, FALSE)) break;
2846
2847 // And ready to receive another response.
2848 DemodReset();
2849 }
2850 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
2851 }
2852 }
2853
2854 previous_data = *data;
2855 sniffCounter++;
2856 data++;
2857 if(data == dmaBuf + DMA_BUFFER_SIZE) {
2858 data = dmaBuf;
2859 }
2860
2861 } // main cycle
2862
2863 DbpString("COMMAND FINISHED");
2864
2865 FpgaDisableSscDma();
2866 MfSniffEnd();
2867
2868 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
2869 LEDsoff();
2870 }
Impressum, Datenschutz