]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso15693.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Adding a 'recoverpw' command for T55xx to try to recover corrupt password written...
[proxmark3-svn] / armsrc / iso15693.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 // Modified by Greg Jones, Jan 2009
4 // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 15693. This includes both the reader software and
11 // the `fake tag' modes, but at the moment I've implemented only the reader
12 // stuff, and that barely.
13 // Modified to perform modulation onboard in arm rather than on PC
14 // Also added additional reader commands (SELECT, READ etc.)
15 //-----------------------------------------------------------------------------
16 // The ISO 15693 describes two transmission modes from reader to tag, and 4
17 // transmission modes from tag to reader. As of Mar 2010 this code only
18 // supports one of each: "1of4" mode from reader to tag, and the highspeed
19 // variant with one subcarrier from card to reader.
20 // As long, as the card fully support ISO 15693 this is no problem, since the
21 // reader chooses both data rates, but some non-standard tags do not. Further for
22 // the simulation to work, we will need to support all data rates.
23 //
24 // VCD (reader) -> VICC (tag)
25 // 1 out of 256:
26 // data rate: 1,66 kbit/s (fc/8192)
27 // used for long range
28 // 1 out of 4:
29 // data rate: 26,48 kbit/s (fc/512)
30 // used for short range, high speed
31 //
32 // VICC (tag) -> VCD (reader)
33 // Modulation:
34 // ASK / one subcarrier (423,75 khz)
35 // FSK / two subcarriers (423,75 khz && 484,28 khz)
36 // Data Rates / Modes:
37 // low ASK: 6,62 kbit/s
38 // low FSK: 6.67 kbit/s
39 // high ASK: 26,48 kbit/s
40 // high FSK: 26,69 kbit/s
41 //-----------------------------------------------------------------------------
42 // added "1 out of 256" mode (for VCD->PICC) - atrox 20100911
43
44
45 // Random Remarks:
46 // *) UID is always used "transmission order" (LSB), which is reverse to display order
47
48 // TODO / BUGS / ISSUES:
49 // *) writing to tags takes longer: we miss the answer from the tag in most cases
50 // -> tweak the read-timeout times
51 // *) signal decoding from the card is still a bit shaky.
52 // *) signal decoding is unable to detect collissions.
53 // *) add anti-collission support for inventory-commands
54 // *) read security status of a block
55 // *) sniffing and simulation do only support one transmission mode. need to support
56 // all 8 transmission combinations
57 // *) remove or refactor code under "depricated"
58 // *) document all the functions
59
60
61 #include "proxmark3.h"
62 #include "util.h"
63 #include "apps.h"
64 #include "string.h"
65 #include "iso15693tools.h"
66 #include "cmd.h"
67
68 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
69
70 ///////////////////////////////////////////////////////////////////////
71 // ISO 15693 Part 2 - Air Interface
72 // This section basicly contains transmission and receiving of bits
73 ///////////////////////////////////////////////////////////////////////
74
75 #define FrameSOF Iso15693FrameSOF
76 #define Logic0 Iso15693Logic0
77 #define Logic1 Iso15693Logic1
78 #define FrameEOF Iso15693FrameEOF
79
80 #define Crc(data,datalen) Iso15693Crc(data,datalen)
81 #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
82 #define sprintUID(target,uid) Iso15693sprintUID(target,uid)
83
84 int DEBUG=0;
85
86
87 // ---------------------------
88 // Signal Processing
89 // ---------------------------
90
91 // prepare data using "1 out of 4" code for later transmission
92 // resulting data rate is 26,48 kbit/s (fc/512)
93 // cmd ... data
94 // n ... length of data
95 static void CodeIso15693AsReader(uint8_t *cmd, int n)
96 {
97 int i, j;
98
99 ToSendReset();
100
101 // Give it a bit of slack at the beginning
102 for(i = 0; i < 24; i++) {
103 ToSendStuffBit(1);
104 }
105
106 // SOF for 1of4
107 ToSendStuffBit(0);
108 ToSendStuffBit(1);
109 ToSendStuffBit(1);
110 ToSendStuffBit(1);
111 ToSendStuffBit(1);
112 ToSendStuffBit(0);
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 for(i = 0; i < n; i++) {
116 for(j = 0; j < 8; j += 2) {
117 int these = (cmd[i] >> j) & 3;
118 switch(these) {
119 case 0:
120 ToSendStuffBit(1);
121 ToSendStuffBit(0);
122 ToSendStuffBit(1);
123 ToSendStuffBit(1);
124 ToSendStuffBit(1);
125 ToSendStuffBit(1);
126 ToSendStuffBit(1);
127 ToSendStuffBit(1);
128 break;
129 case 1:
130 ToSendStuffBit(1);
131 ToSendStuffBit(1);
132 ToSendStuffBit(1);
133 ToSendStuffBit(0);
134 ToSendStuffBit(1);
135 ToSendStuffBit(1);
136 ToSendStuffBit(1);
137 ToSendStuffBit(1);
138 break;
139 case 2:
140 ToSendStuffBit(1);
141 ToSendStuffBit(1);
142 ToSendStuffBit(1);
143 ToSendStuffBit(1);
144 ToSendStuffBit(1);
145 ToSendStuffBit(0);
146 ToSendStuffBit(1);
147 ToSendStuffBit(1);
148 break;
149 case 3:
150 ToSendStuffBit(1);
151 ToSendStuffBit(1);
152 ToSendStuffBit(1);
153 ToSendStuffBit(1);
154 ToSendStuffBit(1);
155 ToSendStuffBit(1);
156 ToSendStuffBit(1);
157 ToSendStuffBit(0);
158 break;
159 }
160 }
161 }
162 // EOF
163 ToSendStuffBit(1);
164 ToSendStuffBit(1);
165 ToSendStuffBit(0);
166 ToSendStuffBit(1);
167
168 // And slack at the end, too.
169 for(i = 0; i < 24; i++) {
170 ToSendStuffBit(1);
171 }
172 }
173
174 // encode data using "1 out of 256" sheme
175 // data rate is 1,66 kbit/s (fc/8192)
176 // is designed for more robust communication over longer distances
177 static void CodeIso15693AsReader256(uint8_t *cmd, int n)
178 {
179 int i, j;
180
181 ToSendReset();
182
183 // Give it a bit of slack at the beginning
184 for(i = 0; i < 24; i++) {
185 ToSendStuffBit(1);
186 }
187
188 // SOF for 1of256
189 ToSendStuffBit(0);
190 ToSendStuffBit(1);
191 ToSendStuffBit(1);
192 ToSendStuffBit(1);
193 ToSendStuffBit(1);
194 ToSendStuffBit(1);
195 ToSendStuffBit(1);
196 ToSendStuffBit(0);
197
198 for(i = 0; i < n; i++) {
199 for (j = 0; j<=255; j++) {
200 if (cmd[i]==j) {
201 ToSendStuffBit(1);
202 ToSendStuffBit(0);
203 } else {
204 ToSendStuffBit(1);
205 ToSendStuffBit(1);
206 }
207 }
208 }
209 // EOF
210 ToSendStuffBit(1);
211 ToSendStuffBit(1);
212 ToSendStuffBit(0);
213 ToSendStuffBit(1);
214
215 // And slack at the end, too.
216 for(i = 0; i < 24; i++) {
217 ToSendStuffBit(1);
218 }
219 }
220
221
222 // Transmit the command (to the tag) that was placed in ToSend[].
223 static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
224 {
225 int c;
226 volatile uint32_t r;
227 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
228 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
229 if(*wait < 10) { *wait = 10; }
230
231 // for(c = 0; c < *wait;) {
232 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
233 // AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
234 // ++c;
235 // }
236 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
237 // r = AT91C_BASE_SSC->SSC_RHR;
238 // (void)r;
239 // }
240 // WDT_HIT();
241 // }
242
243 c = 0;
244 for(;;) {
245 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
246 AT91C_BASE_SSC->SSC_THR = cmd[c];
247 if( ++c >= len) break;
248 }
249 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
250 r = AT91C_BASE_SSC->SSC_RHR;
251 (void)r;
252 }
253 WDT_HIT();
254 }
255 *samples = (c + *wait) << 3;
256 }
257
258 //-----------------------------------------------------------------------------
259 // Transmit the command (to the reader) that was placed in ToSend[].
260 //-----------------------------------------------------------------------------
261 static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
262 {
263 int c = 0;
264 volatile uint32_t r;
265 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
266 if(*wait < 10) { *wait = 10; }
267
268 for(;;) {
269 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
270 AT91C_BASE_SSC->SSC_THR = cmd[c];
271 if( ++c >= len) break;
272 }
273 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
274 r = AT91C_BASE_SSC->SSC_RHR;
275 (void)r;
276 }
277 WDT_HIT();
278 }
279 *samples = (c + *wait) << 3;
280 }
281
282
283 // Read from Tag
284 // Parameters:
285 // receivedResponse
286 // maxLen
287 // samples
288 // elapsed
289 // returns:
290 // number of decoded bytes
291 static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
292 {
293 uint8_t *dest = BigBuf_get_addr();
294
295 int c = 0;
296 int getNext = FALSE;
297 int8_t prev = 0;
298
299 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
300 SpinDelay(100); // greg - experiment to get rid of some of the 0 byte/failed reads
301
302 for(;;) {
303 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
304 AT91C_BASE_SSC->SSC_THR = 0x43;
305
306 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
307 int8_t b;
308 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
309
310 // The samples are correlations against I and Q versions of the
311 // tone that the tag AM-modulates, so every other sample is I,
312 // every other is Q. We just want power, so abs(I) + abs(Q) is
313 // close to what we want.
314 if(getNext) {
315 int8_t r = ABS(b) + ABS(prev);
316
317 dest[c++] = (uint8_t)r;
318
319 if(c >= 2000) {
320 break;
321 }
322 } else {
323 prev = b;
324 }
325
326 getNext = !getNext;
327 }
328 }
329
330 //////////////////////////////////////////
331 /////////// DEMODULATE ///////////////////
332 //////////////////////////////////////////
333
334 int i, j;
335 int max = 0, maxPos=0;
336
337 int skip = 4;
338
339 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
340
341 // First, correlate for SOF
342 for(i = 0; i < 100; i++) {
343 int corr = 0;
344 for(j = 0; j < arraylen(FrameSOF); j += skip) {
345 corr += FrameSOF[j]*dest[i+(j/skip)];
346 }
347 if(corr > max) {
348 max = corr;
349 maxPos = i;
350 }
351 }
352 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
353
354 int k = 0; // this will be our return value
355
356 // greg - If correlation is less than 1 then there's little point in continuing
357 if ((max/(arraylen(FrameSOF)/skip)) >= 1)
358 {
359
360 i = maxPos + arraylen(FrameSOF)/skip;
361
362 uint8_t outBuf[20];
363 memset(outBuf, 0, sizeof(outBuf));
364 uint8_t mask = 0x01;
365 for(;;) {
366 int corr0 = 0, corr1 = 0, corrEOF = 0;
367 for(j = 0; j < arraylen(Logic0); j += skip) {
368 corr0 += Logic0[j]*dest[i+(j/skip)];
369 }
370 for(j = 0; j < arraylen(Logic1); j += skip) {
371 corr1 += Logic1[j]*dest[i+(j/skip)];
372 }
373 for(j = 0; j < arraylen(FrameEOF); j += skip) {
374 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
375 }
376 // Even things out by the length of the target waveform.
377 corr0 *= 4;
378 corr1 *= 4;
379
380 if(corrEOF > corr1 && corrEOF > corr0) {
381 // DbpString("EOF at %d", i);
382 break;
383 } else if(corr1 > corr0) {
384 i += arraylen(Logic1)/skip;
385 outBuf[k] |= mask;
386 } else {
387 i += arraylen(Logic0)/skip;
388 }
389 mask <<= 1;
390 if(mask == 0) {
391 k++;
392 mask = 0x01;
393 }
394 if((i+(int)arraylen(FrameEOF)) >= 2000) {
395 DbpString("ran off end!");
396 break;
397 }
398 }
399 if(mask != 0x01) { // this happens, when we miss the EOF
400 // TODO: for some reason this happens quite often
401 if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
402 if (mask<0x08) k--; // discard the last uneven octet;
403 // 0x08 is an assumption - but works quite often
404 }
405 // uint8_t str1 [8];
406 // itoa(k,str1);
407 // strncat(str1," octets read",8);
408
409 // DbpString( str1); // DbpString("%d octets", k);
410
411 // for(i = 0; i < k; i+=3) {
412 // //DbpString("# %2d: %02x ", i, outBuf[i]);
413 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
414 // }
415
416 for(i = 0; i < k; i++) {
417 receivedResponse[i] = outBuf[i];
418 }
419 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
420 return k; // return the number of bytes demodulated
421
422 // DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
423 }
424
425
426 // Now the GetISO15693 message from sniffing command
427 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
428 {
429 uint8_t *dest = BigBuf_get_addr();
430
431 int c = 0;
432 int getNext = FALSE;
433 int8_t prev = 0;
434
435 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
436 SpinDelay(100); // greg - experiment to get rid of some of the 0 byte/failed reads
437
438 for(;;) {
439 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
440 AT91C_BASE_SSC->SSC_THR = 0x43;
441
442 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
443 int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
444
445 // The samples are correlations against I and Q versions of the
446 // tone that the tag AM-modulates, so every other sample is I,
447 // every other is Q. We just want power, so abs(I) + abs(Q) is
448 // close to what we want.
449 if(getNext) {
450 int8_t r = ABS(b) + ABS(prev);
451
452 dest[c++] = (uint8_t)r;
453
454 if(c >= 20000) {
455 break;
456 }
457 } else {
458 prev = b;
459 }
460
461 getNext = !getNext;
462 }
463 }
464
465 //////////////////////////////////////////
466 /////////// DEMODULATE ///////////////////
467 //////////////////////////////////////////
468
469 int i, j;
470 int max = 0, maxPos=0;
471
472 int skip = 4;
473
474 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
475
476 // First, correlate for SOF
477 for(i = 0; i < 19000; i++) {
478 int corr = 0;
479 for(j = 0; j < arraylen(FrameSOF); j += skip) {
480 corr += FrameSOF[j]*dest[i+(j/skip)];
481 }
482 if(corr > max) {
483 max = corr;
484 maxPos = i;
485 }
486 }
487 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
488
489 int k = 0; // this will be our return value
490
491 // greg - If correlation is less than 1 then there's little point in continuing
492 if ((max/(arraylen(FrameSOF)/skip)) >= 1) // THIS SHOULD BE 1
493 {
494
495 i = maxPos + arraylen(FrameSOF)/skip;
496
497 uint8_t outBuf[20];
498 memset(outBuf, 0, sizeof(outBuf));
499 uint8_t mask = 0x01;
500 for(;;) {
501 int corr0 = 0, corr1 = 0, corrEOF = 0;
502 for(j = 0; j < arraylen(Logic0); j += skip) {
503 corr0 += Logic0[j]*dest[i+(j/skip)];
504 }
505 for(j = 0; j < arraylen(Logic1); j += skip) {
506 corr1 += Logic1[j]*dest[i+(j/skip)];
507 }
508 for(j = 0; j < arraylen(FrameEOF); j += skip) {
509 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
510 }
511 // Even things out by the length of the target waveform.
512 corr0 *= 4;
513 corr1 *= 4;
514
515 if(corrEOF > corr1 && corrEOF > corr0) {
516 // DbpString("EOF at %d", i);
517 break;
518 } else if(corr1 > corr0) {
519 i += arraylen(Logic1)/skip;
520 outBuf[k] |= mask;
521 } else {
522 i += arraylen(Logic0)/skip;
523 }
524 mask <<= 1;
525 if(mask == 0) {
526 k++;
527 mask = 0x01;
528 }
529 if((i+(int)arraylen(FrameEOF)) >= 2000) {
530 DbpString("ran off end!");
531 break;
532 }
533 }
534 if(mask != 0x01) {
535 DbpString("sniff: error, uneven octet! (discard extra bits!)");
536 /// DbpString(" mask=%02x", mask);
537 }
538 // uint8_t str1 [8];
539 // itoa(k,str1);
540 // strncat(str1," octets read",8);
541
542 // DbpString( str1); // DbpString("%d octets", k);
543
544 // for(i = 0; i < k; i+=3) {
545 // //DbpString("# %2d: %02x ", i, outBuf[i]);
546 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
547 // }
548
549 for(i = 0; i < k; i++) {
550 receivedResponse[i] = outBuf[i];
551 }
552 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
553 return k; // return the number of bytes demodulated
554
555 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
556 }
557
558
559 static void BuildIdentifyRequest(void);
560 //-----------------------------------------------------------------------------
561 // Start to read an ISO 15693 tag. We send an identify request, then wait
562 // for the response. The response is not demodulated, just left in the buffer
563 // so that it can be downloaded to a PC and processed there.
564 //-----------------------------------------------------------------------------
565 void AcquireRawAdcSamplesIso15693(void)
566 {
567 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
568
569 int c = 0;
570 int getNext = 0;
571 int8_t prev = 0;
572 volatile uint32_t r;
573
574 uint8_t *dest = BigBuf_get_addr();
575 BuildIdentifyRequest();
576
577 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
578
579 // Give the tags time to energize
580 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
581 SpinDelay(100);
582
583 // Now send the command
584 FpgaSetupSsc();
585 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
586
587 c = 0;
588 for(;;) {
589 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
590 AT91C_BASE_SSC->SSC_THR = ToSend[c];
591 if( ++c == ToSendMax+3) break;
592 }
593 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
594 r = AT91C_BASE_SSC->SSC_RHR;
595 (void)r;
596 }
597 WDT_HIT();
598 }
599
600 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
601
602 c = 0;
603 getNext = FALSE;
604 for(;;) {
605 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
606 AT91C_BASE_SSC->SSC_THR = 0x43;
607
608 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
609 int8_t b;
610 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
611
612 // The samples are correlations against I and Q versions of the
613 // tone that the tag AM-modulates, so every other sample is I,
614 // every other is Q. We just want power, so abs(I) + abs(Q) is
615 // close to what we want.
616 if(getNext) {
617
618 dest[c++] = (uint8_t)(ABS(b) + ABS(prev));
619
620 if(c >= 2000) break;
621
622 } else {
623 prev = b;
624 }
625
626 getNext = !getNext;
627 }
628 }
629 }
630
631
632 void RecordRawAdcSamplesIso15693(void)
633 {
634 uint8_t *dest = BigBuf_get_addr();
635
636 int c = 0;
637 int getNext = 0;
638 int8_t prev = 0;
639
640 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
641 // Setup SSC
642 FpgaSetupSsc();
643
644 // Start from off (no field generated)
645 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
646 SpinDelay(200);
647
648 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
649
650 SpinDelay(100);
651
652 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
653
654 c = 0;
655 getNext = FALSE;
656 for(;;) {
657 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
658 AT91C_BASE_SSC->SSC_THR = 0x43;
659 }
660 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
661 int8_t b;
662 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
663
664 // The samples are correlations against I and Q versions of the
665 // tone that the tag AM-modulates, so every other sample is I,
666 // every other is Q. We just want power, so abs(I) + abs(Q) is
667 // close to what we want.
668 if(getNext) {
669 int8_t r = ABS(b) + ABS(prev);
670
671 dest[c++] = (uint8_t)r;
672
673 if(c >= 7000) {
674 break;
675 }
676 } else {
677 prev = b;
678 }
679
680 getNext = !getNext;
681 WDT_HIT();
682 }
683 }
684 Dbprintf("fin record");
685 }
686
687
688 // Initialize the proxmark as iso15k reader
689 // (this might produces glitches that confuse some tags
690 void Iso15693InitReader() {
691 LED_A_ON();
692 LED_B_ON();
693 LED_C_OFF();
694 LED_D_OFF();
695
696 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
697 // Setup SSC
698 // FpgaSetupSsc();
699
700 // Start from off (no field generated)
701 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
702 SpinDelay(10);
703
704 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
705 FpgaSetupSsc();
706
707 // Give the tags time to energize
708 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
709 SpinDelay(250);
710
711 LED_A_ON();
712 LED_B_OFF();
713 LED_C_OFF();
714 LED_D_OFF();
715 }
716
717 ///////////////////////////////////////////////////////////////////////
718 // ISO 15693 Part 3 - Air Interface
719 // This section basicly contains transmission and receiving of bits
720 ///////////////////////////////////////////////////////////////////////
721
722 // Encode (into the ToSend buffers) an identify request, which is the first
723 // thing that you must send to a tag to get a response.
724 static void BuildIdentifyRequest(void)
725 {
726 uint8_t cmd[5];
727
728 uint16_t crc;
729 // one sub-carrier, inventory, 1 slot, fast rate
730 // AFI is at bit 5 (1<<4) when doing an INVENTORY
731 cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
732 // inventory command code
733 cmd[1] = 0x01;
734 // no mask
735 cmd[2] = 0x00;
736 //Now the CRC
737 crc = Crc(cmd, 3);
738 cmd[3] = crc & 0xff;
739 cmd[4] = crc >> 8;
740
741 CodeIso15693AsReader(cmd, sizeof(cmd));
742 }
743
744 // uid is in transmission order (which is reverse of display order)
745 static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
746 {
747 uint8_t cmd[13];
748
749 uint16_t crc;
750 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
751 // followed by teh block data
752 // one sub-carrier, inventory, 1 slot, fast rate
753 cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit, ADDR bit, OPTION bit
754 // READ BLOCK command code
755 cmd[1] = 0x20;
756 // UID may be optionally specified here
757 // 64-bit UID
758 cmd[2] = uid[0];
759 cmd[3] = uid[1];
760 cmd[4] = uid[2];
761 cmd[5] = uid[3];
762 cmd[6] = uid[4];
763 cmd[7] = uid[5];
764 cmd[8] = uid[6];
765 cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique)
766 // Block number to read
767 cmd[10] = blockNumber;//0x00;
768 //Now the CRC
769 crc = Crc(cmd, 11); // the crc needs to be calculated over 12 bytes
770 cmd[11] = crc & 0xff;
771 cmd[12] = crc >> 8;
772
773 CodeIso15693AsReader(cmd, sizeof(cmd));
774 }
775
776 // Now the VICC>VCD responses when we are simulating a tag
777 static void BuildInventoryResponse( uint8_t *uid)
778 {
779 uint8_t cmd[12];
780
781 uint16_t crc;
782 // one sub-carrier, inventory, 1 slot, fast rate
783 // AFI is at bit 5 (1<<4) when doing an INVENTORY
784 //(1 << 2) | (1 << 5) | (1 << 1);
785 cmd[0] = 0; //
786 cmd[1] = 0; // DSFID (data storage format identifier). 0x00 = not supported
787 // 64-bit UID
788 cmd[2] = uid[7]; //0x32;
789 cmd[3] = uid[6]; //0x4b;
790 cmd[4] = uid[5]; //0x03;
791 cmd[5] = uid[4]; //0x01;
792 cmd[6] = uid[3]; //0x00;
793 cmd[7] = uid[2]; //0x10;
794 cmd[8] = uid[1]; //0x05;
795 cmd[9] = uid[0]; //0xe0;
796 //Now the CRC
797 crc = Crc(cmd, 10);
798 cmd[10] = crc & 0xff;
799 cmd[11] = crc >> 8;
800
801 CodeIso15693AsReader(cmd, sizeof(cmd));
802 }
803
804 // Universal Method for sending to and recv bytes from a tag
805 // init ... should we initialize the reader?
806 // speed ... 0 low speed, 1 hi speed
807 // **recv will return you a pointer to the received data
808 // If you do not need the answer use NULL for *recv[]
809 // return: lenght of received data
810 int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) {
811
812 int samples = 0;
813 int tsamples = 0;
814 int wait = 0;
815 int elapsed = 0;
816
817 LED_A_ON();
818 LED_B_ON();
819 LED_C_OFF();
820 LED_D_OFF();
821
822 if (init) Iso15693InitReader();
823
824 int answerLen=0;
825 uint8_t *answer = BigBuf_get_addr() + 3660;
826 if (recv != NULL) memset(answer, 0, 100);
827
828 if (!speed) {
829 // low speed (1 out of 256)
830 CodeIso15693AsReader256(send, sendlen);
831 } else {
832 // high speed (1 out of 4)
833 CodeIso15693AsReader(send, sendlen);
834 }
835
836 LED_A_ON();
837 LED_B_OFF();
838
839 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
840 // Now wait for a response
841 if (recv!=NULL) {
842 LED_A_OFF();
843 LED_B_ON();
844 answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ;
845 *recv=answer;
846 }
847
848 LEDsoff();
849
850 return answerLen;
851 }
852
853
854 // --------------------------------------------------------------------
855 // Debug Functions
856 // --------------------------------------------------------------------
857
858 // Decodes a message from a tag and displays its metadata and content
859 #define DBD15STATLEN 48
860 void DbdecodeIso15693Answer(int len, uint8_t *d) {
861 char status[DBD15STATLEN+1]={0};
862 uint16_t crc;
863
864 if (len>3) {
865 if (d[0]&(1<<3))
866 strncat(status,"ProtExt ",DBD15STATLEN);
867 if (d[0]&1) {
868 // error
869 strncat(status,"Error ",DBD15STATLEN);
870 switch (d[1]) {
871 case 0x01:
872 strncat(status,"01:notSupp",DBD15STATLEN);
873 break;
874 case 0x02:
875 strncat(status,"02:notRecog",DBD15STATLEN);
876 break;
877 case 0x03:
878 strncat(status,"03:optNotSupp",DBD15STATLEN);
879 break;
880 case 0x0f:
881 strncat(status,"0f:noInfo",DBD15STATLEN);
882 break;
883 case 0x10:
884 strncat(status,"10:dontExist",DBD15STATLEN);
885 break;
886 case 0x11:
887 strncat(status,"11:lockAgain",DBD15STATLEN);
888 break;
889 case 0x12:
890 strncat(status,"12:locked",DBD15STATLEN);
891 break;
892 case 0x13:
893 strncat(status,"13:progErr",DBD15STATLEN);
894 break;
895 case 0x14:
896 strncat(status,"14:lockErr",DBD15STATLEN);
897 break;
898 default:
899 strncat(status,"unknownErr",DBD15STATLEN);
900 }
901 strncat(status," ",DBD15STATLEN);
902 } else {
903 strncat(status,"NoErr ",DBD15STATLEN);
904 }
905
906 crc=Crc(d,len-2);
907 if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) )
908 strncat(status,"CrcOK",DBD15STATLEN);
909 else
910 strncat(status,"CrcFail!",DBD15STATLEN);
911
912 Dbprintf("%s",status);
913 }
914 }
915
916
917
918 ///////////////////////////////////////////////////////////////////////
919 // Functions called via USB/Client
920 ///////////////////////////////////////////////////////////////////////
921
922 void SetDebugIso15693(uint32_t debug) {
923 DEBUG=debug;
924 Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off");
925 return;
926 }
927
928
929
930 //-----------------------------------------------------------------------------
931 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
932 // all demodulation performed in arm rather than host. - greg
933 //-----------------------------------------------------------------------------
934 void ReaderIso15693(uint32_t parameter)
935 {
936 LED_A_ON();
937 LED_B_ON();
938 LED_C_OFF();
939 LED_D_OFF();
940
941 int answerLen1 = 0;
942 int answerLen2 = 0;
943 int answerLen3 = 0;
944 int i = 0;
945 int samples = 0;
946 int tsamples = 0;
947 int wait = 0;
948 int elapsed = 0;
949 uint8_t TagUID[8] = {0x00};
950
951 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
952
953 uint8_t *answer1 = BigBuf_get_addr() + 3660;
954 uint8_t *answer2 = BigBuf_get_addr() + 3760;
955 uint8_t *answer3 = BigBuf_get_addr() + 3860;
956 // Blank arrays
957 memset(answer1, 0x00, 300);
958
959 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
960 // Setup SSC
961 FpgaSetupSsc();
962
963 // Start from off (no field generated)
964 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
965 SpinDelay(200);
966
967 // Give the tags time to energize
968 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
969 SpinDelay(200);
970
971 LED_A_ON();
972 LED_B_OFF();
973 LED_C_OFF();
974 LED_D_OFF();
975
976 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
977 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
978
979 // Now send the IDENTIFY command
980 BuildIdentifyRequest();
981
982 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
983
984 // Now wait for a response
985 answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
986
987 if (answerLen1 >=12) // we should do a better check than this
988 {
989 TagUID[0] = answer1[2];
990 TagUID[1] = answer1[3];
991 TagUID[2] = answer1[4];
992 TagUID[3] = answer1[5];
993 TagUID[4] = answer1[6];
994 TagUID[5] = answer1[7];
995 TagUID[6] = answer1[8]; // IC Manufacturer code
996 TagUID[7] = answer1[9]; // always E0
997
998 }
999
1000 Dbprintf("%d octets read from IDENTIFY request:", answerLen1);
1001 DbdecodeIso15693Answer(answerLen1,answer1);
1002 Dbhexdump(answerLen1,answer1,true);
1003
1004 // UID is reverse
1005 if (answerLen1>=12)
1006 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1007 TagUID[7],TagUID[6],TagUID[5],TagUID[4],
1008 TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
1009
1010
1011 Dbprintf("%d octets read from SELECT request:", answerLen2);
1012 DbdecodeIso15693Answer(answerLen2,answer2);
1013 Dbhexdump(answerLen2,answer2,true);
1014
1015 Dbprintf("%d octets read from XXX request:", answerLen3);
1016 DbdecodeIso15693Answer(answerLen3,answer3);
1017 Dbhexdump(answerLen3,answer3,true);
1018
1019 // read all pages
1020 if (answerLen1>=12 && DEBUG) {
1021 i=0;
1022 while (i<32) { // sanity check, assume max 32 pages
1023 BuildReadBlockRequest(TagUID,i);
1024 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
1025 answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
1026 if (answerLen2>0) {
1027 Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
1028 DbdecodeIso15693Answer(answerLen2,answer2);
1029 Dbhexdump(answerLen2,answer2,true);
1030 if ( *((uint32_t*) answer2) == 0x07160101 ) break; // exit on NoPageErr
1031 }
1032 i++;
1033 }
1034 }
1035
1036 LED_A_OFF();
1037 LED_B_OFF();
1038 LED_C_OFF();
1039 LED_D_OFF();
1040 }
1041
1042 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1043 // all demodulation performed in arm rather than host. - greg
1044 void SimTagIso15693(uint32_t parameter, uint8_t *uid)
1045 {
1046 LED_A_ON();
1047 LED_B_ON();
1048 LED_C_OFF();
1049 LED_D_OFF();
1050
1051 int answerLen1 = 0;
1052 int samples = 0;
1053 int tsamples = 0;
1054 int wait = 0;
1055 int elapsed = 0;
1056
1057 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1058
1059 uint8_t *buf = BigBuf_get_addr() + 3660;
1060 memset(buf, 0x00, 100);
1061
1062 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1063 FpgaSetupSsc();
1064
1065 // Start from off (no field generated)
1066 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1067 SpinDelay(200);
1068
1069 LED_A_OFF();
1070 LED_B_OFF();
1071 LED_C_ON();
1072 LED_D_OFF();
1073
1074 // Listen to reader
1075 answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
1076
1077 if (answerLen1 >=1) // we should do a better check than this
1078 {
1079 // Build a suitable reponse to the reader INVENTORY cocmmand
1080 // not so obsvious, but in the call to BuildInventoryResponse, the command is copied to the global ToSend buffer used below.
1081
1082 BuildInventoryResponse(uid);
1083
1084 TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
1085 }
1086
1087 Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
1088 buf[0], buf[1], buf[2], buf[3],
1089 buf[4], buf[5], buf[6], buf[7], buf[8]);
1090
1091 Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x",
1092 uid[0], uid[1], uid[2], uid[3],
1093 uid[4], uid[5], uid[6], uid[7]);
1094
1095 LED_A_OFF();
1096 LED_B_OFF();
1097 LED_C_OFF();
1098 LED_D_OFF();
1099 }
1100
1101
1102 // Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1103 // (some manufactures offer a way to read the AFI, though)
1104 void BruteforceIso15693Afi(uint32_t speed)
1105 {
1106 uint8_t data[20];
1107 uint8_t *recv=data;
1108 int datalen=0, recvlen=0;
1109
1110 Iso15693InitReader();
1111
1112 // first without AFI
1113 // Tags should respond wihtout AFI and with AFI=0 even when AFI is active
1114
1115 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1116 ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
1117 data[1]=ISO15_CMD_INVENTORY;
1118 data[2]=0; // mask length
1119 datalen=AddCrc(data,3);
1120 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1121 WDT_HIT();
1122 if (recvlen>=12) {
1123 Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
1124 }
1125
1126 // now with AFI
1127
1128 data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1129 ISO15_REQ_INVENTORY | ISO15_REQINV_AFI | ISO15_REQINV_SLOT1;
1130 data[1]=ISO15_CMD_INVENTORY;
1131 data[2]=0; // AFI
1132 data[3]=0; // mask length
1133
1134 for (int i=0;i<256;i++) {
1135 data[2]=i & 0xFF;
1136 datalen=AddCrc(data,4);
1137 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1138 WDT_HIT();
1139 if (recvlen>=12) {
1140 Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
1141 }
1142 }
1143 Dbprintf("AFI Bruteforcing done.");
1144
1145 }
1146
1147 // Allows to directly send commands to the tag via the client
1148 void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
1149
1150 int recvlen=0;
1151 uint8_t *recvbuf = BigBuf_get_addr();
1152 // UsbCommand n;
1153
1154 if (DEBUG) {
1155 Dbprintf("SEND");
1156 Dbhexdump(datalen,data,true);
1157 }
1158
1159 recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
1160
1161 if (recv) {
1162 LED_B_ON();
1163 cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
1164 LED_B_OFF();
1165
1166 if (DEBUG) {
1167 Dbprintf("RECV");
1168 DbdecodeIso15693Answer(recvlen,recvbuf);
1169 Dbhexdump(recvlen,recvbuf,true);
1170 }
1171 }
1172
1173 }
1174
1175
1176
1177
1178 // --------------------------------------------------------------------
1179 // -- Misc & deprecated functions
1180 // --------------------------------------------------------------------
1181
1182 /*
1183
1184 // do not use; has a fix UID
1185 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1186 {
1187 uint8_t cmd[12];
1188
1189 uint16_t crc;
1190 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1191 // followed by teh block data
1192 // one sub-carrier, inventory, 1 slot, fast rate
1193 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1194 // System Information command code
1195 cmd[1] = 0x2B;
1196 // UID may be optionally specified here
1197 // 64-bit UID
1198 cmd[2] = 0x32;
1199 cmd[3]= 0x4b;
1200 cmd[4] = 0x03;
1201 cmd[5] = 0x01;
1202 cmd[6] = 0x00;
1203 cmd[7] = 0x10;
1204 cmd[8] = 0x05;
1205 cmd[9]= 0xe0; // always e0 (not exactly unique)
1206 //Now the CRC
1207 crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1208 cmd[10] = crc & 0xff;
1209 cmd[11] = crc >> 8;
1210
1211 CodeIso15693AsReader(cmd, sizeof(cmd));
1212 }
1213
1214
1215 // do not use; has a fix UID
1216 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1217 {
1218 uint8_t cmd[14];
1219
1220 uint16_t crc;
1221 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1222 // followed by teh block data
1223 // one sub-carrier, inventory, 1 slot, fast rate
1224 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1225 // READ Multi BLOCK command code
1226 cmd[1] = 0x23;
1227 // UID may be optionally specified here
1228 // 64-bit UID
1229 cmd[2] = 0x32;
1230 cmd[3]= 0x4b;
1231 cmd[4] = 0x03;
1232 cmd[5] = 0x01;
1233 cmd[6] = 0x00;
1234 cmd[7] = 0x10;
1235 cmd[8] = 0x05;
1236 cmd[9]= 0xe0; // always e0 (not exactly unique)
1237 // First Block number to read
1238 cmd[10] = 0x00;
1239 // Number of Blocks to read
1240 cmd[11] = 0x2f; // read quite a few
1241 //Now the CRC
1242 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1243 cmd[12] = crc & 0xff;
1244 cmd[13] = crc >> 8;
1245
1246 CodeIso15693AsReader(cmd, sizeof(cmd));
1247 }
1248
1249 // do not use; has a fix UID
1250 static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1251 {
1252 uint8_t cmd[14];
1253
1254 uint16_t crc;
1255 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1256 // followed by teh block data
1257 // one sub-carrier, inventory, 1 slot, fast rate
1258 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1259 // READ BLOCK command code
1260 cmd[1] = CmdCode;
1261 // UID may be optionally specified here
1262 // 64-bit UID
1263 cmd[2] = 0x32;
1264 cmd[3]= 0x4b;
1265 cmd[4] = 0x03;
1266 cmd[5] = 0x01;
1267 cmd[6] = 0x00;
1268 cmd[7] = 0x10;
1269 cmd[8] = 0x05;
1270 cmd[9]= 0xe0; // always e0 (not exactly unique)
1271 // Parameter
1272 cmd[10] = 0x00;
1273 cmd[11] = 0x0a;
1274
1275 // cmd[12] = 0x00;
1276 // cmd[13] = 0x00; //Now the CRC
1277 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1278 cmd[12] = crc & 0xff;
1279 cmd[13] = crc >> 8;
1280
1281 CodeIso15693AsReader(cmd, sizeof(cmd));
1282 }
1283
1284 // do not use; has a fix UID
1285 static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1286 {
1287 uint8_t cmd[14];
1288
1289 uint16_t crc;
1290 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1291 // followed by teh block data
1292 // one sub-carrier, inventory, 1 slot, fast rate
1293 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
1294 // READ BLOCK command code
1295 cmd[1] = CmdCode;
1296 // UID may be optionally specified here
1297 // 64-bit UID
1298 cmd[2] = 0x32;
1299 cmd[3]= 0x4b;
1300 cmd[4] = 0x03;
1301 cmd[5] = 0x01;
1302 cmd[6] = 0x00;
1303 cmd[7] = 0x10;
1304 cmd[8] = 0x05;
1305 cmd[9]= 0xe0; // always e0 (not exactly unique)
1306 // Parameter
1307 cmd[10] = 0x05; // for custom codes this must be manufcturer code
1308 cmd[11] = 0x00;
1309
1310 // cmd[12] = 0x00;
1311 // cmd[13] = 0x00; //Now the CRC
1312 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1313 cmd[12] = crc & 0xff;
1314 cmd[13] = crc >> 8;
1315
1316 CodeIso15693AsReader(cmd, sizeof(cmd));
1317 }
1318
1319
1320
1321
1322 */
1323
1324
Proxmark3 GIT tracking
Impressum, Datenschutz