1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
13 #include "iso14443a.h"
19 #include "proxmark3.h"
23 #include "iso14443crc.h"
24 #include "crapto1/crapto1.h"
25 #include "mifareutil.h"
26 #include "mifaresniff.h"
28 #include "protocols.h"
30 #include "fpgaloader.h"
36 // DEMOD_MOD_FIRST_HALF,
37 // DEMOD_NOMOD_FIRST_HALF,
43 uint16_t collisionPos
;
50 uint32_t startTime
, endTime
;
65 STATE_START_OF_COMMUNICATION
,
81 uint32_t startTime
, endTime
;
86 static uint32_t iso14a_timeout
;
87 #define MAX_ISO14A_TIMEOUT 524288
91 // the block number for the ISO14443-4 PCB
92 static uint8_t iso14_pcb_blocknum
= 0;
97 // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
98 #define REQUEST_GUARD_TIME (7000/16 + 1)
99 // minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
100 #define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
101 // bool LastCommandWasRequest = false;
104 // Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
106 // When the PM acts as reader and is receiving tag data, it takes
107 // 3 ticks delay in the AD converter
108 // 16 ticks until the modulation detector completes and sets curbit
109 // 8 ticks until bit_to_arm is assigned from curbit
110 // 8*16 ticks for the transfer from FPGA to ARM
111 // 4*16 ticks until we measure the time
112 // - 8*16 ticks because we measure the time of the previous transfer
113 #define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
115 // When the PM acts as a reader and is sending, it takes
116 // 4*16 ticks until we can write data to the sending hold register
117 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
118 // 8 ticks until the first transfer starts
119 // 8 ticks later the FPGA samples the data
120 // 1 tick to assign mod_sig_coil
121 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
123 // When the PM acts as tag and is receiving it takes
124 // 2 ticks delay in the RF part (for the first falling edge),
125 // 3 ticks for the A/D conversion,
126 // 8 ticks on average until the start of the SSC transfer,
127 // 8 ticks until the SSC samples the first data
128 // 7*16 ticks to complete the transfer from FPGA to ARM
129 // 8 ticks until the next ssp_clk rising edge
130 // 4*16 ticks until we measure the time
131 // - 8*16 ticks because we measure the time of the previous transfer
132 #define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
134 // The FPGA will report its internal sending delay in
135 uint16_t FpgaSendQueueDelay
;
136 // the 5 first bits are the number of bits buffered in mod_sig_buf
137 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
138 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
140 // When the PM acts as tag and is sending, it takes
141 // 4*16 + 8 ticks until we can write data to the sending hold register
142 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
143 // 8 ticks later the FPGA samples the first data
144 // + 16 ticks until assigned to mod_sig
145 // + 1 tick to assign mod_sig_coil
146 // + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
147 #define DELAY_ARM2AIR_AS_TAG (4*16 + 8 + 8*16 + 8 + 16 + 1 + DELAY_FPGA_QUEUE)
149 // When the PM acts as sniffer and is receiving tag data, it takes
150 // 3 ticks A/D conversion
151 // 14 ticks to complete the modulation detection
152 // 8 ticks (on average) until the result is stored in to_arm
153 // + the delays in transferring data - which is the same for
154 // sniffing reader and tag data and therefore not relevant
155 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
157 // When the PM acts as sniffer and is receiving reader data, it takes
158 // 2 ticks delay in analogue RF receiver (for the falling edge of the
159 // start bit, which marks the start of the communication)
160 // 3 ticks A/D conversion
161 // 8 ticks on average until the data is stored in to_arm.
162 // + the delays in transferring data - which is the same for
163 // sniffing reader and tag data and therefore not relevant
164 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
166 //variables used for timing purposes:
167 //these are in ssp_clk cycles:
168 static uint32_t NextTransferTime
;
169 static uint32_t LastTimeProxToAirStart
;
170 static uint32_t LastProxToAirDuration
;
174 // CARD TO READER - manchester
175 // Sequence D: 11110000 modulation with subcarrier during first half
176 // Sequence E: 00001111 modulation with subcarrier during second half
177 // Sequence F: 00000000 no modulation with subcarrier
178 // READER TO CARD - miller
179 // Sequence X: 00001100 drop after half a period
180 // Sequence Y: 00000000 no drop
181 // Sequence Z: 11000000 drop at start
189 void iso14a_set_trigger(bool enable
) {
194 void iso14a_set_timeout(uint32_t timeout
) {
195 // adjust timeout by FPGA delays and 2 additional ssp_frames to detect SOF
196 iso14a_timeout
= timeout
+ (DELAY_AIR2ARM_AS_READER
+ DELAY_ARM2AIR_AS_READER
)/(16*8) + 2;
197 if (MF_DBGLEVEL
>= 3) Dbprintf("ISO14443A Timeout set to %" PRIu32
" (%dms)", timeout
, timeout
/ 106);
201 uint32_t iso14a_get_timeout(void) {
202 return iso14a_timeout
- (DELAY_AIR2ARM_AS_READER
+ DELAY_ARM2AIR_AS_READER
)/(16*8) - 2;
205 //-----------------------------------------------------------------------------
206 // Generate the parity value for a byte sequence
208 //-----------------------------------------------------------------------------
209 void GetParity(const uint8_t *pbtCmd
, uint16_t iLen
, uint8_t *par
)
211 uint16_t paritybit_cnt
= 0;
212 uint16_t paritybyte_cnt
= 0;
213 uint8_t parityBits
= 0;
215 for (uint16_t i
= 0; i
< iLen
; i
++) {
216 // Generate the parity bits
217 parityBits
|= ((oddparity8(pbtCmd
[i
])) << (7-paritybit_cnt
));
218 if (paritybit_cnt
== 7) {
219 par
[paritybyte_cnt
] = parityBits
; // save 8 Bits parity
220 parityBits
= 0; // and advance to next Parity Byte
228 // save remaining parity bits
229 par
[paritybyte_cnt
] = parityBits
;
233 void AppendCrc14443a(uint8_t* data
, int len
)
235 ComputeCrc14443(CRC_14443_A
,data
,len
,data
+len
,data
+len
+1);
238 static void AppendCrc14443b(uint8_t* data
, int len
)
240 ComputeCrc14443(CRC_14443_B
,data
,len
,data
+len
,data
+len
+1);
244 //=============================================================================
245 // ISO 14443 Type A - Miller decoder
246 //=============================================================================
248 // This decoder is used when the PM3 acts as a tag.
249 // The reader will generate "pauses" by temporarily switching of the field.
250 // At the PM3 antenna we will therefore measure a modulated antenna voltage.
251 // The FPGA does a comparison with a threshold and would deliver e.g.:
252 // ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
253 // The Miller decoder needs to identify the following sequences:
254 // 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
255 // 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
256 // 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
257 // Note 1: the bitstream may start at any time. We therefore need to sync.
258 // Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
259 //-----------------------------------------------------------------------------
262 // Lookup-Table to decide if 4 raw bits are a modulation.
263 // We accept the following:
264 // 0001 - a 3 tick wide pause
265 // 0011 - a 2 tick wide pause, or a three tick wide pause shifted left
266 // 0111 - a 2 tick wide pause shifted left
267 // 1001 - a 2 tick wide pause shifted right
268 const bool Mod_Miller_LUT
[] = {
269 false, true, false, true, false, false, false, true,
270 false, true, false, false, false, false, false, false
272 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
273 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
275 static void UartReset() {
276 Uart
.state
= STATE_UNSYNCD
;
278 Uart
.len
= 0; // number of decoded data bytes
279 Uart
.parityLen
= 0; // number of decoded parity bytes
280 Uart
.shiftReg
= 0; // shiftreg to hold decoded data bits
281 Uart
.parityBits
= 0; // holds 8 parity bits
284 static void UartInit(uint8_t *data
, uint8_t *parity
) {
286 Uart
.parity
= parity
;
287 Uart
.fourBits
= 0x00000000; // clear the buffer for 4 Bits
293 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
294 static RAMFUNC
bool MillerDecoding(uint8_t bit
, uint32_t non_real_time
) {
296 Uart
.fourBits
= (Uart
.fourBits
<< 8) | bit
;
298 if (Uart
.state
== STATE_UNSYNCD
) { // not yet synced
300 Uart
.syncBit
= 9999; // not set
301 // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
302 // Sequence X followed by Sequence Y followed by Sequence Z (111100x1 11111111 00x11111)
303 // we therefore look for a ...xx11111111111100x11111xxxxxx... pattern
304 // (12 '1's followed by 2 '0's, eventually followed by another '0', followed by 5 '1's)
305 #define ISO14443A_STARTBIT_MASK 0x07FFEF80 // mask is 00000111 11111111 11101111 10000000
306 #define ISO14443A_STARTBIT_PATTERN 0x07FF8F80 // pattern is 00000111 11111111 10001111 10000000
307 if ((Uart
.fourBits
& (ISO14443A_STARTBIT_MASK
>> 0)) == ISO14443A_STARTBIT_PATTERN
>> 0) Uart
.syncBit
= 7;
308 else if ((Uart
.fourBits
& (ISO14443A_STARTBIT_MASK
>> 1)) == ISO14443A_STARTBIT_PATTERN
>> 1) Uart
.syncBit
= 6;
309 else if ((Uart
.fourBits
& (ISO14443A_STARTBIT_MASK
>> 2)) == ISO14443A_STARTBIT_PATTERN
>> 2) Uart
.syncBit
= 5;
310 else if ((Uart
.fourBits
& (ISO14443A_STARTBIT_MASK
>> 3)) == ISO14443A_STARTBIT_PATTERN
>> 3) Uart
.syncBit
= 4;
311 else if ((Uart
.fourBits
& (ISO14443A_STARTBIT_MASK
>> 4)) == ISO14443A_STARTBIT_PATTERN
>> 4) Uart
.syncBit
= 3;
312 else if ((Uart
.fourBits
& (ISO14443A_STARTBIT_MASK
>> 5)) == ISO14443A_STARTBIT_PATTERN
>> 5) Uart
.syncBit
= 2;
313 else if ((Uart
.fourBits
& (ISO14443A_STARTBIT_MASK
>> 6)) == ISO14443A_STARTBIT_PATTERN
>> 6) Uart
.syncBit
= 1;
314 else if ((Uart
.fourBits
& (ISO14443A_STARTBIT_MASK
>> 7)) == ISO14443A_STARTBIT_PATTERN
>> 7) Uart
.syncBit
= 0;
316 if (Uart
.syncBit
!= 9999) { // found a sync bit
317 Uart
.startTime
= non_real_time
?non_real_time
:(GetCountSspClk() & 0xfffffff8);
318 Uart
.startTime
-= Uart
.syncBit
;
319 Uart
.endTime
= Uart
.startTime
;
320 Uart
.state
= STATE_START_OF_COMMUNICATION
;
326 if (IsMillerModulationNibble1(Uart
.fourBits
>> Uart
.syncBit
)) {
327 if (IsMillerModulationNibble2(Uart
.fourBits
>> Uart
.syncBit
)) { // Modulation in both halves - error
330 } else { // Modulation in first half = Sequence Z = logic "0"
331 if (Uart
.state
== STATE_MILLER_X
) { // error - must not follow after X
336 Uart
.shiftReg
= (Uart
.shiftReg
>> 1); // add a 0 to the shiftreg
337 Uart
.state
= STATE_MILLER_Z
;
338 Uart
.endTime
= Uart
.startTime
+ 8*(9*Uart
.len
+ Uart
.bitCount
+ 1) - 6;
339 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
340 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
341 Uart
.parityBits
<<= 1; // make room for the parity bit
342 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
345 if((Uart
.len
&0x0007) == 0) { // every 8 data bytes
346 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
353 if (IsMillerModulationNibble2(Uart
.fourBits
>> Uart
.syncBit
)) { // Modulation second half = Sequence X = logic "1"
355 Uart
.shiftReg
= (Uart
.shiftReg
>> 1) | 0x100; // add a 1 to the shiftreg
356 Uart
.state
= STATE_MILLER_X
;
357 Uart
.endTime
= Uart
.startTime
+ 8*(9*Uart
.len
+ Uart
.bitCount
+ 1) - 2;
358 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
359 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
360 Uart
.parityBits
<<= 1; // make room for the new parity bit
361 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
364 if ((Uart
.len
&0x0007) == 0) { // every 8 data bytes
365 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
369 } else { // no modulation in both halves - Sequence Y
370 if (Uart
.state
== STATE_MILLER_Z
|| Uart
.state
== STATE_MILLER_Y
) { // Y after logic "0" - End of Communication
372 Uart
.state
= STATE_UNSYNCD
;
373 Uart
.bitCount
--; // last "0" was part of EOC sequence
374 Uart
.shiftReg
<<= 1; // drop it
375 if(Uart
.bitCount
> 0) { // if we decoded some bits
376 Uart
.shiftReg
>>= (9 - Uart
.bitCount
); // right align them
377 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff); // add last byte to the output
378 Uart
.parityBits
<<= 1; // add a (void) parity bit
379 Uart
.parityBits
<<= (8 - (Uart
.len
&0x0007)); // left align parity bits
380 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // and store it
382 } else if (Uart
.len
& 0x0007) { // there are some parity bits to store
383 Uart
.parityBits
<<= (8 - (Uart
.len
&0x0007)); // left align remaining parity bits
384 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // and store them
387 return true; // we are finished with decoding the raw data sequence
389 UartReset(); // Nothing received - start over
392 if (Uart
.state
== STATE_START_OF_COMMUNICATION
) { // error - must not follow directly after SOC
395 } else { // a logic "0"
397 Uart
.shiftReg
= (Uart
.shiftReg
>> 1); // add a 0 to the shiftreg
398 Uart
.state
= STATE_MILLER_Y
;
399 if(Uart
.bitCount
>= 9) { // if we decoded a full byte (including parity)
400 Uart
.output
[Uart
.len
++] = (Uart
.shiftReg
& 0xff);
401 Uart
.parityBits
<<= 1; // make room for the parity bit
402 Uart
.parityBits
|= ((Uart
.shiftReg
>> 8) & 0x01); // store parity bit
405 if ((Uart
.len
&0x0007) == 0) { // every 8 data bytes
406 Uart
.parity
[Uart
.parityLen
++] = Uart
.parityBits
; // store 8 parity bits
416 return false; // not finished yet, need more data
421 //=============================================================================
422 // ISO 14443 Type A - Manchester decoder
423 //=============================================================================
425 // This decoder is used when the PM3 acts as a reader.
426 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
427 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
428 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
429 // The Manchester decoder needs to identify the following sequences:
430 // 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
431 // 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
432 // 8 ticks unmodulated: Sequence F = end of communication
433 // 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
434 // Note 1: the bitstream may start at any time. We therefore need to sync.
435 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
438 // Lookup-Table to decide if 4 raw bits are a modulation.
439 // We accept three or four "1" in any position
440 const bool Mod_Manchester_LUT
[] = {
441 false, false, false, false, false, false, false, true,
442 false, false, false, true, false, true, true, true
445 #define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
446 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
449 static void DemodReset() {
450 Demod
.state
= DEMOD_UNSYNCD
;
451 Demod
.len
= 0; // number of decoded data bytes
453 Demod
.shiftReg
= 0; // shiftreg to hold decoded data bits
454 Demod
.parityBits
= 0; //
455 Demod
.collisionPos
= 0; // Position of collision bit
456 Demod
.twoBits
= 0xffff; // buffer for 2 Bits
462 static void DemodInit(uint8_t *data
, uint8_t *parity
) {
464 Demod
.parity
= parity
;
468 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
469 static RAMFUNC
int ManchesterDecoding(uint8_t bit
, uint16_t offset
, uint32_t non_real_time
) {
471 Demod
.twoBits
= (Demod
.twoBits
<< 8) | bit
;
473 if (Demod
.state
== DEMOD_UNSYNCD
) {
475 if (Demod
.highCnt
< 2) { // wait for a stable unmodulated signal
476 if (Demod
.twoBits
== 0x0000) {
482 Demod
.syncBit
= 0xFFFF; // not set
483 if ((Demod
.twoBits
& 0x7700) == 0x7000) Demod
.syncBit
= 7;
484 else if ((Demod
.twoBits
& 0x3B80) == 0x3800) Demod
.syncBit
= 6;
485 else if ((Demod
.twoBits
& 0x1DC0) == 0x1C00) Demod
.syncBit
= 5;
486 else if ((Demod
.twoBits
& 0x0EE0) == 0x0E00) Demod
.syncBit
= 4;
487 else if ((Demod
.twoBits
& 0x0770) == 0x0700) Demod
.syncBit
= 3;
488 else if ((Demod
.twoBits
& 0x03B8) == 0x0380) Demod
.syncBit
= 2;
489 else if ((Demod
.twoBits
& 0x01DC) == 0x01C0) Demod
.syncBit
= 1;
490 else if ((Demod
.twoBits
& 0x00EE) == 0x00E0) Demod
.syncBit
= 0;
491 if (Demod
.syncBit
!= 0xFFFF) {
492 Demod
.startTime
= non_real_time
?non_real_time
:(GetCountSspClk() & 0xfffffff8);
493 Demod
.startTime
-= Demod
.syncBit
;
494 Demod
.bitCount
= offset
; // number of decoded data bits
495 Demod
.state
= DEMOD_MANCHESTER_DATA
;
502 if (IsManchesterModulationNibble1(Demod
.twoBits
>> Demod
.syncBit
)) { // modulation in first half
503 if (IsManchesterModulationNibble2(Demod
.twoBits
>> Demod
.syncBit
)) { // ... and in second half = collision
504 if (!Demod
.collisionPos
) {
505 Demod
.collisionPos
= (Demod
.len
<< 3) + Demod
.bitCount
;
507 } // modulation in first half only - Sequence D = 1
509 Demod
.shiftReg
= (Demod
.shiftReg
>> 1) | 0x100; // in both cases, add a 1 to the shiftreg
510 if(Demod
.bitCount
== 9) { // if we decoded a full byte (including parity)
511 Demod
.output
[Demod
.len
++] = (Demod
.shiftReg
& 0xff);
512 Demod
.parityBits
<<= 1; // make room for the parity bit
513 Demod
.parityBits
|= ((Demod
.shiftReg
>> 8) & 0x01); // store parity bit
516 if((Demod
.len
&0x0007) == 0) { // every 8 data bytes
517 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // store 8 parity bits
518 Demod
.parityBits
= 0;
521 Demod
.endTime
= Demod
.startTime
+ 8*(9*Demod
.len
+ Demod
.bitCount
+ 1) - 4;
522 } else { // no modulation in first half
523 if (IsManchesterModulationNibble2(Demod
.twoBits
>> Demod
.syncBit
)) { // and modulation in second half = Sequence E = 0
525 Demod
.shiftReg
= (Demod
.shiftReg
>> 1); // add a 0 to the shiftreg
526 if(Demod
.bitCount
>= 9) { // if we decoded a full byte (including parity)
527 Demod
.output
[Demod
.len
++] = (Demod
.shiftReg
& 0xff);
528 Demod
.parityBits
<<= 1; // make room for the new parity bit
529 Demod
.parityBits
|= ((Demod
.shiftReg
>> 8) & 0x01); // store parity bit
532 if ((Demod
.len
&0x0007) == 0) { // every 8 data bytes
533 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // store 8 parity bits1
534 Demod
.parityBits
= 0;
537 Demod
.endTime
= Demod
.startTime
+ 8*(9*Demod
.len
+ Demod
.bitCount
+ 1);
538 } else { // no modulation in both halves - End of communication
540 if(Demod
.bitCount
> 0) { // there are some remaining data bits
541 Demod
.shiftReg
>>= (9 - Demod
.bitCount
); // right align the decoded bits
542 Demod
.output
[Demod
.len
++] = Demod
.shiftReg
& 0xff; // and add them to the output
543 Demod
.parityBits
<<= 1; // add a (void) parity bit
544 Demod
.parityBits
<<= (8 - (Demod
.len
&0x0007)); // left align remaining parity bits
545 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // and store them
547 } else if (Demod
.len
& 0x0007) { // there are some parity bits to store
548 Demod
.parityBits
<<= (8 - (Demod
.len
&0x0007)); // left align remaining parity bits
549 Demod
.parity
[Demod
.parityLen
++] = Demod
.parityBits
; // and store them
552 return true; // we are finished with decoding the raw data sequence
553 } else { // nothing received. Start over
561 return false; // not finished yet, need more data
564 //=============================================================================
565 // Finally, a `sniffer' for ISO 14443 Type A
566 // Both sides of communication!
567 //=============================================================================
569 //-----------------------------------------------------------------------------
570 // Record the sequence of commands sent by the reader to the tag, with
571 // triggering so that we start recording at the point that the tag is moved
573 //-----------------------------------------------------------------------------
574 void RAMFUNC
SnoopIso14443a(uint8_t param
) {
576 // bit 0 - trigger from first card answer
577 // bit 1 - trigger from first reader 7-bit request
582 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER
);
584 // Allocate memory from BigBuf for some buffers
585 // free all previous allocations first
588 // The command (reader -> tag) that we're receiving.
589 uint8_t *receivedCmd
= BigBuf_malloc(MAX_FRAME_SIZE
);
590 uint8_t *receivedCmdPar
= BigBuf_malloc(MAX_PARITY_SIZE
);
592 // The response (tag -> reader) that we're receiving.
593 uint8_t *receivedResponse
= BigBuf_malloc(MAX_FRAME_SIZE
);
594 uint8_t *receivedResponsePar
= BigBuf_malloc(MAX_PARITY_SIZE
);
596 // The DMA buffer, used to stream samples from the FPGA
597 uint8_t *dmaBuf
= BigBuf_malloc(DMA_BUFFER_SIZE
);
603 uint8_t *data
= dmaBuf
;
604 uint8_t previous_data
= 0;
607 bool TagIsActive
= false;
608 bool ReaderIsActive
= false;
610 // Set up the demodulator for tag -> reader responses.
611 DemodInit(receivedResponse
, receivedResponsePar
);
613 // Set up the demodulator for the reader -> tag commands
614 UartInit(receivedCmd
, receivedCmdPar
);
616 // Setup and start DMA.
617 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
);
619 // We won't start recording the frames that we acquire until we trigger;
620 // a good trigger condition to get started is probably when we see a
621 // response from the tag.
622 // triggered == false -- to wait first for card
623 bool triggered
= !(param
& 0x03);
625 // And now we loop, receiving samples.
626 for (uint32_t rsamples
= 0; true; ) {
628 if (BUTTON_PRESS()) {
629 DbpString("cancelled by button");
635 int register readBufDataP
= data
- dmaBuf
;
636 int register dmaBufDataP
= DMA_BUFFER_SIZE
- AT91C_BASE_PDC_SSC
->PDC_RCR
;
637 if (readBufDataP
<= dmaBufDataP
){
638 dataLen
= dmaBufDataP
- readBufDataP
;
640 dataLen
= DMA_BUFFER_SIZE
- readBufDataP
+ dmaBufDataP
;
642 // test for length of buffer
643 if(dataLen
> maxDataLen
) {
644 maxDataLen
= dataLen
;
645 if(dataLen
> (9 * DMA_BUFFER_SIZE
/ 10)) {
646 Dbprintf("blew circular buffer! dataLen=%d", dataLen
);
650 if(dataLen
< 1) continue;
652 // primary buffer was stopped( <-- we lost data!
653 if (!AT91C_BASE_PDC_SSC
->PDC_RCR
) {
654 AT91C_BASE_PDC_SSC
->PDC_RPR
= (uint32_t) dmaBuf
;
655 AT91C_BASE_PDC_SSC
->PDC_RCR
= DMA_BUFFER_SIZE
;
656 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen
); // temporary
658 // secondary buffer sets as primary, secondary buffer was stopped
659 if (!AT91C_BASE_PDC_SSC
->PDC_RNCR
) {
660 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
;
661 AT91C_BASE_PDC_SSC
->PDC_RNCR
= DMA_BUFFER_SIZE
;
664 if (rsamples
& 0x01) { // Need two samples to feed Miller and Manchester-Decoder
666 if(!TagIsActive
) { // no need to try decoding reader data if the tag is sending
667 uint8_t readerdata
= (previous_data
& 0xF0) | (*data
>> 4);
668 if (MillerDecoding(readerdata
, (rsamples
-1)*4)) {
669 // check - if there is a short 7bit request from reader
670 if ((!triggered
) && (param
& 0x02) && (Uart
.len
== 1) && (Uart
.bitCount
== 7)) {
674 if (!LogTrace(receivedCmd
,
676 Uart
.startTime
*16 - DELAY_READER_AIR2ARM_AS_SNIFFER
,
677 Uart
.endTime
*16 - DELAY_READER_AIR2ARM_AS_SNIFFER
,
681 /* And ready to receive another command. */
683 /* And also reset the demod code, which might have been */
684 /* false-triggered by the commands from the reader. */
687 ReaderIsActive
= (Uart
.state
!= STATE_UNSYNCD
);
690 if (!ReaderIsActive
) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
691 uint8_t tagdata
= (previous_data
<< 4) | (*data
& 0x0F);
692 if (ManchesterDecoding(tagdata
, 0, (rsamples
-1)*4)) {
693 if (!LogTrace(receivedResponse
,
695 Demod
.startTime
*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER
,
696 Demod
.endTime
*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER
,
699 if ((!triggered
) && (param
& 0x01)) triggered
= true;
700 // And ready to receive another response.
702 // And reset the Miller decoder including itS (now outdated) input buffer
703 UartInit(receivedCmd
, receivedCmdPar
);
705 TagIsActive
= (Demod
.state
!= DEMOD_UNSYNCD
);
709 previous_data
= *data
;
712 if(data
== dmaBuf
+ DMA_BUFFER_SIZE
) {
720 DbpString("COMMAND FINISHED");
721 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen
, Uart
.state
, Uart
.len
);
722 Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart
.output
[0]);
725 //-----------------------------------------------------------------------------
726 // Prepare tag messages
727 //-----------------------------------------------------------------------------
728 static void CodeIso14443aAsTagPar(const uint8_t *cmd
, uint16_t len
, uint8_t *parity
) {
731 // Correction bit, might be removed when not needed
736 ToSendStuffBit(1); // 1
742 ToSend
[++ToSendMax
] = SEC_D
;
743 LastProxToAirDuration
= 8 * ToSendMax
- 4;
745 for (uint16_t i
= 0; i
< len
; i
++) {
749 for (uint16_t j
= 0; j
< 8; j
++) {
751 ToSend
[++ToSendMax
] = SEC_D
;
753 ToSend
[++ToSendMax
] = SEC_E
;
758 // Get the parity bit
759 if (parity
[i
>>3] & (0x80>>(i
&0x0007))) {
760 ToSend
[++ToSendMax
] = SEC_D
;
761 LastProxToAirDuration
= 8 * ToSendMax
- 4;
763 ToSend
[++ToSendMax
] = SEC_E
;
764 LastProxToAirDuration
= 8 * ToSendMax
;
769 ToSend
[++ToSendMax
] = SEC_F
;
771 // Convert from last byte pos to length
776 static void Code4bitAnswerAsTag(uint8_t cmd
) {
781 // Correction bit, might be removed when not needed
786 ToSendStuffBit(1); // 1
792 ToSend
[++ToSendMax
] = SEC_D
;
795 for (i
= 0; i
< 4; i
++) {
797 ToSend
[++ToSendMax
] = SEC_D
;
798 LastProxToAirDuration
= 8 * ToSendMax
- 4;
800 ToSend
[++ToSendMax
] = SEC_E
;
801 LastProxToAirDuration
= 8 * ToSendMax
;
807 ToSend
[++ToSendMax
] = SEC_F
;
809 // Convert from last byte pos to length
814 static uint8_t *LastReaderTraceTime
= NULL
;
816 static void EmLogTraceReader(void) {
817 // remember last reader trace start to fix timing info later
818 LastReaderTraceTime
= BigBuf_get_addr() + BigBuf_get_traceLen();
819 LogTrace(Uart
.output
, Uart
.len
, Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
, Uart
.parity
, true);
823 static void FixLastReaderTraceTime(uint32_t tag_StartTime
) {
824 uint32_t reader_EndTime
= Uart
.endTime
*16 - DELAY_AIR2ARM_AS_TAG
;
825 uint32_t reader_StartTime
= Uart
.startTime
*16 - DELAY_AIR2ARM_AS_TAG
;
826 uint16_t reader_modlen
= reader_EndTime
- reader_StartTime
;
827 uint16_t approx_fdt
= tag_StartTime
- reader_EndTime
;
828 uint16_t exact_fdt
= (approx_fdt
- 20 + 32)/64 * 64 + 20;
829 reader_StartTime
= tag_StartTime
- exact_fdt
- reader_modlen
;
830 LastReaderTraceTime
[0] = (reader_StartTime
>> 0) & 0xff;
831 LastReaderTraceTime
[1] = (reader_StartTime
>> 8) & 0xff;
832 LastReaderTraceTime
[2] = (reader_StartTime
>> 16) & 0xff;
833 LastReaderTraceTime
[3] = (reader_StartTime
>> 24) & 0xff;
837 static void EmLogTraceTag(uint8_t *tag_data
, uint16_t tag_len
, uint8_t *tag_Parity
, uint32_t ProxToAirDuration
) {
838 uint32_t tag_StartTime
= LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_TAG
;
839 uint32_t tag_EndTime
= (LastTimeProxToAirStart
+ ProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_TAG
;
840 LogTrace(tag_data
, tag_len
, tag_StartTime
, tag_EndTime
, tag_Parity
, false);
841 FixLastReaderTraceTime(tag_StartTime
);
845 //-----------------------------------------------------------------------------
846 // Wait for commands from reader
847 // Stop when button is pressed
848 // Or return true when command is captured
849 //-----------------------------------------------------------------------------
850 static int GetIso14443aCommandFromReader(uint8_t *received
, uint8_t *parity
, int *len
) {
851 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
852 // only, since we are receiving, not transmitting).
853 // Signal field is off with the appropriate LED
855 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
857 // Now run a `software UART' on the stream of incoming samples.
858 UartInit(received
, parity
);
861 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
866 if(BUTTON_PRESS()) return false;
868 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
869 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
870 if(MillerDecoding(b
, 0)) {
880 int EmSend4bit(uint8_t resp
);
881 static int EmSendCmdExPar(uint8_t *resp
, uint16_t respLen
, uint8_t *par
);
882 int EmSendCmd(uint8_t *resp
, uint16_t respLen
);
883 int EmSendPrecompiledCmd(tag_response_info_t
*response_info
);
886 static bool prepare_tag_modulation(tag_response_info_t
* response_info
, size_t max_buffer_size
) {
887 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
888 // This will need the following byte array for a modulation sequence
889 // 144 data bits (18 * 8)
892 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
893 // 1 just for the case
895 // 166 bytes, since every bit that needs to be send costs us a byte
899 // Prepare the tag modulation bits from the message
900 GetParity(response_info
->response
, response_info
->response_n
, &(response_info
->par
));
901 CodeIso14443aAsTagPar(response_info
->response
,response_info
->response_n
, &(response_info
->par
));
903 // Make sure we do not exceed the free buffer space
904 if (ToSendMax
> max_buffer_size
) {
905 Dbprintf("Out of memory, when modulating bits for tag answer:");
906 Dbhexdump(response_info
->response_n
, response_info
->response
, false);
910 // Copy the byte array, used for this modulation to the buffer position
911 memcpy(response_info
->modulation
, ToSend
, ToSendMax
);
913 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
914 response_info
->modulation_n
= ToSendMax
;
915 response_info
->ProxToAirDuration
= LastProxToAirDuration
;
921 // "precompile" responses. There are 7 predefined responses with a total of 28 bytes data to transmit.
922 // Coded responses need one byte per bit to transfer (data, parity, start, stop, correction)
923 // 28 * 8 data bits, 28 * 1 parity bits, 7 start bits, 7 stop bits, 7 correction bits for the modulation
924 // -> need 273 bytes buffer
925 #define ALLOCATED_TAG_MODULATION_BUFFER_SIZE 273
927 bool prepare_allocated_tag_modulation(tag_response_info_t
* response_info
, uint8_t **buffer
, size_t *max_buffer_size
) {
929 // Retrieve and store the current buffer index
930 response_info
->modulation
= *buffer
;
932 // Forward the prepare tag modulation function to the inner function
933 if (prepare_tag_modulation(response_info
, *max_buffer_size
)) {
934 // Update the free buffer offset and the remaining buffer size
935 *buffer
+= ToSendMax
;
936 *max_buffer_size
-= ToSendMax
;
943 //-----------------------------------------------------------------------------
944 // Main loop of simulated tag: receive commands from reader, decide what
945 // response to send, and send it.
946 //-----------------------------------------------------------------------------
947 void SimulateIso14443aTag(int tagType
, int uid_1st
, int uid_2nd
, uint8_t* data
) {
951 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
952 uint8_t response1
[2];
955 case 1: { // MIFARE Classic
956 // Says: I am Mifare 1k - original line
961 case 2: { // MIFARE Ultralight
962 // Says: I am a stupid memory tag, no crypto
967 case 3: { // MIFARE DESFire
968 // Says: I am a DESFire tag, ph33r me
973 case 4: { // ISO/IEC 14443-4
974 // Says: I am a javacard (JCOP)
979 case 5: { // MIFARE TNP3XXX
986 Dbprintf("Error: unkown tagtype (%d)",tagType
);
991 // The second response contains the (mandatory) first 24 bits of the UID
992 uint8_t response2
[5] = {0x00};
994 // Check if the uid uses the (optional) part
995 uint8_t response2a
[5] = {0x00};
999 num_to_bytes(uid_1st
,3,response2
+1);
1000 num_to_bytes(uid_2nd
,4,response2a
);
1001 response2a
[4] = response2a
[0] ^ response2a
[1] ^ response2a
[2] ^ response2a
[3];
1003 // Configure the ATQA and SAK accordingly
1004 response1
[0] |= 0x40;
1007 num_to_bytes(uid_1st
,4,response2
);
1008 // Configure the ATQA and SAK accordingly
1009 response1
[0] &= 0xBF;
1013 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1014 response2
[4] = response2
[0] ^ response2
[1] ^ response2
[2] ^ response2
[3];
1016 // Prepare the mandatory SAK (for 4 and 7 byte UID)
1017 uint8_t response3
[3] = {0x00};
1019 ComputeCrc14443(CRC_14443_A
, response3
, 1, &response3
[1], &response3
[2]);
1021 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
1022 uint8_t response3a
[3] = {0x00};
1023 response3a
[0] = sak
& 0xFB;
1024 ComputeCrc14443(CRC_14443_A
, response3a
, 1, &response3a
[1], &response3a
[2]);
1026 uint8_t response5
[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
1027 uint8_t response6
[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1028 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1029 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1030 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1031 // TC(1) = 0x02: CID supported, NAD not supported
1032 ComputeCrc14443(CRC_14443_A
, response6
, 4, &response6
[4], &response6
[5]);
1034 #define TAG_RESPONSE_COUNT 7
1035 tag_response_info_t responses
[TAG_RESPONSE_COUNT
] = {
1036 { .response
= response1
, .response_n
= sizeof(response1
) }, // Answer to request - respond with card type
1037 { .response
= response2
, .response_n
= sizeof(response2
) }, // Anticollision cascade1 - respond with uid
1038 { .response
= response2a
, .response_n
= sizeof(response2a
) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1039 { .response
= response3
, .response_n
= sizeof(response3
) }, // Acknowledge select - cascade 1
1040 { .response
= response3a
, .response_n
= sizeof(response3a
) }, // Acknowledge select - cascade 2
1041 { .response
= response5
, .response_n
= sizeof(response5
) }, // Authentication answer (random nonce)
1042 { .response
= response6
, .response_n
= sizeof(response6
) }, // dummy ATS (pseudo-ATR), answer to RATS
1045 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1046 // Such a response is less time critical, so we can prepare them on the fly
1047 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1048 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1049 uint8_t dynamic_response_buffer
[DYNAMIC_RESPONSE_BUFFER_SIZE
];
1050 uint8_t dynamic_modulation_buffer
[DYNAMIC_MODULATION_BUFFER_SIZE
];
1051 tag_response_info_t dynamic_response_info
= {
1052 .response
= dynamic_response_buffer
,
1054 .modulation
= dynamic_modulation_buffer
,
1058 // We need to listen to the high-frequency, peak-detected path.
1059 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
1061 BigBuf_free_keep_EM();
1063 // allocate buffers:
1064 uint8_t *receivedCmd
= BigBuf_malloc(MAX_FRAME_SIZE
);
1065 uint8_t *receivedCmdPar
= BigBuf_malloc(MAX_PARITY_SIZE
);
1066 uint8_t *free_buffer_pointer
= BigBuf_malloc(ALLOCATED_TAG_MODULATION_BUFFER_SIZE
);
1067 size_t free_buffer_size
= ALLOCATED_TAG_MODULATION_BUFFER_SIZE
;
1072 // Prepare the responses of the anticollision phase
1073 // there will be not enough time to do this at the moment the reader sends it REQA
1074 for (size_t i
=0; i
<TAG_RESPONSE_COUNT
; i
++) {
1075 prepare_allocated_tag_modulation(&responses
[i
], &free_buffer_pointer
, &free_buffer_size
);
1080 // To control where we are in the protocol
1084 // Just to allow some checks
1090 tag_response_info_t
* p_response
;
1094 // Clean receive command buffer
1095 if(!GetIso14443aCommandFromReader(receivedCmd
, receivedCmdPar
, &len
)) {
1096 DbpString("Button press");
1102 // Okay, look at the command now.
1104 if(receivedCmd
[0] == 0x26) { // Received a REQUEST
1105 p_response
= &responses
[0]; order
= 1;
1106 } else if(receivedCmd
[0] == 0x52) { // Received a WAKEUP
1107 p_response
= &responses
[0]; order
= 6;
1108 } else if(receivedCmd
[1] == 0x20 && receivedCmd
[0] == 0x93) { // Received request for UID (cascade 1)
1109 p_response
= &responses
[1]; order
= 2;
1110 } else if(receivedCmd
[1] == 0x20 && receivedCmd
[0] == 0x95) { // Received request for UID (cascade 2)
1111 p_response
= &responses
[2]; order
= 20;
1112 } else if(receivedCmd
[1] == 0x70 && receivedCmd
[0] == 0x93) { // Received a SELECT (cascade 1)
1113 p_response
= &responses
[3]; order
= 3;
1114 } else if(receivedCmd
[1] == 0x70 && receivedCmd
[0] == 0x95) { // Received a SELECT (cascade 2)
1115 p_response
= &responses
[4]; order
= 30;
1116 } else if(receivedCmd
[0] == 0x30) { // Received a (plain) READ
1117 EmSendCmd(data
+(4*receivedCmd
[1]),16);
1118 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1119 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1121 } else if(receivedCmd
[0] == 0x50) { // Received a HALT
1123 } else if(receivedCmd
[0] == 0x60 || receivedCmd
[0] == 0x61) { // Received an authentication request
1124 p_response
= &responses
[5]; order
= 7;
1125 } else if(receivedCmd
[0] == 0xE0) { // Received a RATS request
1126 if (tagType
== 1 || tagType
== 2) { // RATS not supported
1127 EmSend4bit(CARD_NACK_NA
);
1130 p_response
= &responses
[6]; order
= 70;
1132 } else if (order
== 7 && len
== 8) { // Received {nr] and {ar} (part of authentication)
1133 uint32_t nr
= bytes_to_num(receivedCmd
,4);
1134 uint32_t ar
= bytes_to_num(receivedCmd
+4,4);
1135 Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr
,ar
);
1137 // Check for ISO 14443A-4 compliant commands, look at left nibble
1138 switch (receivedCmd
[0]) {
1141 case 0x0A: { // IBlock (command)
1142 dynamic_response_info
.response
[0] = receivedCmd
[0];
1143 dynamic_response_info
.response
[1] = 0x00;
1144 dynamic_response_info
.response
[2] = 0x90;
1145 dynamic_response_info
.response
[3] = 0x00;
1146 dynamic_response_info
.response_n
= 4;
1150 case 0x1B: { // Chaining command
1151 dynamic_response_info
.response
[0] = 0xaa | ((receivedCmd
[0]) & 1);
1152 dynamic_response_info
.response_n
= 2;
1157 dynamic_response_info
.response
[0] = receivedCmd
[0] ^ 0x11;
1158 dynamic_response_info
.response_n
= 2;
1162 memcpy(dynamic_response_info
.response
,"\xAB\x00",2);
1163 dynamic_response_info
.response_n
= 2;
1167 case 0xC2: { // Readers sends deselect command
1168 memcpy(dynamic_response_info
.response
,"\xCA\x00",2);
1169 dynamic_response_info
.response_n
= 2;
1173 // Never seen this command before
1174 Dbprintf("Received unknown command (len=%d):",len
);
1175 Dbhexdump(len
,receivedCmd
,false);
1177 dynamic_response_info
.response_n
= 0;
1181 if (dynamic_response_info
.response_n
> 0) {
1182 // Copy the CID from the reader query
1183 dynamic_response_info
.response
[1] = receivedCmd
[1];
1185 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1186 AppendCrc14443a(dynamic_response_info
.response
,dynamic_response_info
.response_n
);
1187 dynamic_response_info
.response_n
+= 2;
1189 if (prepare_tag_modulation(&dynamic_response_info
,DYNAMIC_MODULATION_BUFFER_SIZE
) == false) {
1190 Dbprintf("Error preparing tag response");
1193 p_response
= &dynamic_response_info
;
1197 // Count number of wakeups received after a halt
1198 if(order
== 6 && lastorder
== 5) { happened
++; }
1200 // Count number of other messages after a halt
1201 if(order
!= 6 && lastorder
== 5) { happened2
++; }
1203 if(cmdsRecvd
> 999) {
1204 DbpString("1000 commands later...");
1209 if (p_response
!= NULL
) {
1210 EmSendPrecompiledCmd(p_response
);
1213 if (!get_tracing()) {
1214 Dbprintf("Trace Full. Simulation stopped.");
1219 Dbprintf("%x %x %x", happened
, happened2
, cmdsRecvd
);
1221 BigBuf_free_keep_EM();
1225 // prepare a delayed transfer. This simply shifts ToSend[] by a number
1226 // of bits specified in the delay parameter.
1227 static void PrepareDelayedTransfer(uint16_t delay
) {
1228 uint8_t bitmask
= 0;
1229 uint8_t bits_to_shift
= 0;
1230 uint8_t bits_shifted
= 0;
1234 for (uint16_t i
= 0; i
< delay
; i
++) {
1235 bitmask
|= (0x01 << i
);
1237 ToSend
[ToSendMax
++] = 0x00;
1238 for (uint16_t i
= 0; i
< ToSendMax
; i
++) {
1239 bits_to_shift
= ToSend
[i
] & bitmask
;
1240 ToSend
[i
] = ToSend
[i
] >> delay
;
1241 ToSend
[i
] = ToSend
[i
] | (bits_shifted
<< (8 - delay
));
1242 bits_shifted
= bits_to_shift
;
1248 //-------------------------------------------------------------------------------------
1249 // Transmit the command (to the tag) that was placed in ToSend[].
1250 // Parameter timing:
1251 // if NULL: transfer at next possible time, taking into account
1252 // request guard time, startup frame guard time and frame delay time
1253 // if == 0: transfer immediately and return time of transfer
1254 // if != 0: delay transfer until time specified
1255 //-------------------------------------------------------------------------------------
1256 static void TransmitFor14443a(const uint8_t *cmd
, uint16_t len
, uint32_t *timing
) {
1259 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_MOD
);
1261 uint32_t ThisTransferTime
= 0;
1264 if (*timing
== 0) { // Measure time
1265 *timing
= (GetCountSspClk() + 8) & 0xfffffff8;
1267 PrepareDelayedTransfer(*timing
& 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1269 if (MF_DBGLEVEL
>= 4 && GetCountSspClk() >= (*timing
& 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1270 while (GetCountSspClk() < (*timing
& 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1271 LastTimeProxToAirStart
= *timing
;
1273 ThisTransferTime
= ((MAX(NextTransferTime
, GetCountSspClk()) & 0xfffffff8) + 8);
1274 while (GetCountSspClk() < ThisTransferTime
);
1275 LastTimeProxToAirStart
= ThisTransferTime
;
1280 if (AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1281 AT91C_BASE_SSC
->SSC_THR
= cmd
[c
];
1289 NextTransferTime
= MAX(NextTransferTime
, LastTimeProxToAirStart
+ REQUEST_GUARD_TIME
);
1294 //-----------------------------------------------------------------------------
1295 // Prepare reader command (in bits, support short frames) to send to FPGA
1296 //-----------------------------------------------------------------------------
1297 static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd
, uint16_t bits
, const uint8_t *parity
) {
1304 // Start of Communication (Seq. Z)
1305 ToSend
[++ToSendMax
] = SEC_Z
;
1306 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1309 size_t bytecount
= nbytes(bits
);
1310 // Generate send structure for the data bits
1311 for (i
= 0; i
< bytecount
; i
++) {
1312 // Get the current byte to send
1314 size_t bitsleft
= MIN((bits
-(i
*8)),8);
1316 for (j
= 0; j
< bitsleft
; j
++) {
1319 ToSend
[++ToSendMax
] = SEC_X
;
1320 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 2;
1325 ToSend
[++ToSendMax
] = SEC_Z
;
1326 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1329 ToSend
[++ToSendMax
] = SEC_Y
;
1336 // Only transmit parity bit if we transmitted a complete byte
1337 if (j
== 8 && parity
!= NULL
) {
1338 // Get the parity bit
1339 if (parity
[i
>>3] & (0x80 >> (i
&0x0007))) {
1341 ToSend
[++ToSendMax
] = SEC_X
;
1342 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 2;
1347 ToSend
[++ToSendMax
] = SEC_Z
;
1348 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1351 ToSend
[++ToSendMax
] = SEC_Y
;
1358 // End of Communication: Logic 0 followed by Sequence Y
1361 ToSend
[++ToSendMax
] = SEC_Z
;
1362 LastProxToAirDuration
= 8 * (ToSendMax
+1) - 6;
1365 ToSend
[++ToSendMax
] = SEC_Y
;
1368 ToSend
[++ToSendMax
] = SEC_Y
;
1370 // Convert to length of command:
1375 //-----------------------------------------------------------------------------
1376 // Wait for commands from reader
1377 // Stop when button is pressed (return 1) or field was gone (return 2)
1378 // Or return 0 when command is captured
1379 //-----------------------------------------------------------------------------
1380 int EmGetCmd(uint8_t *received
, uint16_t *len
, uint8_t *parity
) {
1381 uint32_t field_off_time
= -1;
1382 uint32_t samples
= 0;
1385 uint8_t dmaBuf
[DMA_BUFFER_SIZE
];
1386 uint8_t *upTo
= dmaBuf
;
1390 // Run a 'software UART' on the stream of incoming samples.
1391 UartInit(received
, parity
);
1394 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
;
1396 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN
1397 while (GetCountSspClk() < LastTimeProxToAirStart
+ LastProxToAirDuration
+ (FpgaSendQueueDelay
>>3) - 8 - 3) /* wait */ ;
1399 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1400 // only, since we are receiving, not transmitting).
1401 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_LISTEN
);
1403 // clear receive register, measure time of next transfer
1404 uint32_t temp
= AT91C_BASE_SSC
->SSC_RHR
; (void) temp
;
1405 while (!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
)) ;
1406 uint32_t start_time
= GetCountSspClk() & 0xfffffff8;
1408 // Setup and start DMA.
1409 FpgaSetupSscDma(dmaBuf
, DMA_BUFFER_SIZE
);
1412 uint16_t behindBy
= ((uint8_t*)AT91C_BASE_PDC_SSC
->PDC_RPR
- upTo
) & (DMA_BUFFER_SIZE
-1);
1414 if (behindBy
== 0) continue;
1418 if(upTo
>= dmaBuf
+ DMA_BUFFER_SIZE
) { // we have read all of the DMA buffer content.
1419 upTo
= dmaBuf
; // start reading the circular buffer from the beginning
1420 if(behindBy
> (9*DMA_BUFFER_SIZE
/10)) {
1421 Dbprintf("About to blow circular buffer - aborted! behindBy=%d", behindBy
);
1426 if (AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_ENDRX
)) { // DMA Counter Register had reached 0, already rotated.
1427 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
; // refresh the DMA Next Buffer and
1428 AT91C_BASE_PDC_SSC
->PDC_RNCR
= DMA_BUFFER_SIZE
; // DMA Next Counter registers
1431 if (BUTTON_PRESS()) {
1436 // check reader's HF field
1437 if (AT91C_BASE_ADC
->ADC_SR
& ADC_END_OF_CONVERSION(ADC_CHAN_HF_LOW
)) {
1438 if ((MAX_ADC_HF_VOLTAGE_LOW
* AT91C_BASE_ADC
->ADC_CDR
[ADC_CHAN_HF_LOW
]) >> 10 < MF_MINFIELDV
) {
1439 if (GetTickCount() - field_off_time
> 50) {
1440 ret
= 2; // reader has switched off HF field for more than 50ms. Timeout
1444 field_off_time
= GetTickCount(); // HF field is still there. Reset timer
1446 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_START
; // restart ADC
1449 if (MillerDecoding(b
, start_time
+ samples
*8)) {
1459 FpgaDisableSscDma();
1464 static int EmSendCmd14443aRaw(uint8_t *resp
, uint16_t respLen
) {
1469 bool correctionNeeded
;
1471 // Modulate Manchester
1472 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_TAGSIM_MOD
);
1474 // include correction bit if necessary
1475 if (Uart
.bitCount
== 7)
1477 // Short tags (7 bits) don't have parity, determine the correct value from MSB
1478 correctionNeeded
= Uart
.output
[0] & 0x40;
1482 // Look at the last parity bit
1483 correctionNeeded
= Uart
.parity
[(Uart
.len
-1)/8] & (0x80 >> ((Uart
.len
-1) & 7));
1486 if (correctionNeeded
) {
1487 // 1236, so correction bit needed
1493 // clear receiving shift register and holding register
1494 b
= AT91C_BASE_SSC
->SSC_RHR
; (void) b
;
1495 while (!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
1496 b
= AT91C_BASE_SSC
->SSC_RHR
; (void) b
;
1498 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1499 for (uint16_t j
= 0; j
< 5; j
++) { // allow timeout - better late than never
1500 while (!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
1501 if (AT91C_BASE_SSC
->SSC_RHR
) break;
1504 LastTimeProxToAirStart
= (GetCountSspClk() & 0xfffffff8) + (correctionNeeded
?8:0);
1507 for (; i
< respLen
; ) {
1508 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1509 AT91C_BASE_SSC
->SSC_THR
= resp
[i
++];
1510 FpgaSendQueueDelay
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1513 if(BUTTON_PRESS()) {
1523 int EmSend4bit(uint8_t resp
){
1524 Code4bitAnswerAsTag(resp
);
1525 int res
= EmSendCmd14443aRaw(ToSend
, ToSendMax
);
1526 // Log this tag answer and fix timing of previous reader command:
1527 EmLogTraceTag(&resp
, 1, NULL
, LastProxToAirDuration
);
1532 static int EmSendCmdExPar(uint8_t *resp
, uint16_t respLen
, uint8_t *par
){
1533 CodeIso14443aAsTagPar(resp
, respLen
, par
);
1534 int res
= EmSendCmd14443aRaw(ToSend
, ToSendMax
);
1535 // Log this tag answer and fix timing of previous reader command:
1536 EmLogTraceTag(resp
, respLen
, par
, LastProxToAirDuration
);
1541 int EmSendCmd(uint8_t *resp
, uint16_t respLen
){
1542 uint8_t par
[MAX_PARITY_SIZE
];
1543 GetParity(resp
, respLen
, par
);
1544 return EmSendCmdExPar(resp
, respLen
, par
);
1548 int EmSendCmdPar(uint8_t *resp
, uint16_t respLen
, uint8_t *par
){
1549 return EmSendCmdExPar(resp
, respLen
, par
);
1553 int EmSendPrecompiledCmd(tag_response_info_t
*response_info
) {
1554 int ret
= EmSendCmd14443aRaw(response_info
->modulation
, response_info
->modulation_n
);
1555 // Log this tag answer and fix timing of previous reader command:
1556 EmLogTraceTag(response_info
->response
, response_info
->response_n
, &(response_info
->par
), response_info
->ProxToAirDuration
);
1561 //-----------------------------------------------------------------------------
1562 // Wait a certain time for tag response
1563 // If a response is captured return true
1564 // If it takes too long return false
1565 //-----------------------------------------------------------------------------
1566 static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse
, uint8_t *receivedResponsePar
, uint16_t offset
) {
1569 // Set FPGA mode to "reader listen mode", no modulation (listen
1570 // only, since we are receiving, not transmitting).
1571 // Signal field is on with the appropriate LED
1573 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_LISTEN
);
1575 // Now get the answer from the card
1576 DemodInit(receivedResponse
, receivedResponsePar
);
1579 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1585 if (AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1586 b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1587 if (ManchesterDecoding(b
, offset
, 0)) {
1588 NextTransferTime
= MAX(NextTransferTime
, Demod
.endTime
- (DELAY_AIR2ARM_AS_READER
+ DELAY_ARM2AIR_AS_READER
)/16 + FRAME_DELAY_TIME_PICC_TO_PCD
);
1590 } else if (c
++ > iso14a_timeout
&& Demod
.state
== DEMOD_UNSYNCD
) {
1598 void ReaderTransmitBitsPar(uint8_t* frame
, uint16_t bits
, uint8_t *par
, uint32_t *timing
) {
1600 CodeIso14443aBitsAsReaderPar(frame
, bits
, par
);
1602 // Send command to tag
1603 TransmitFor14443a(ToSend
, ToSendMax
, timing
);
1607 // Log reader command in trace buffer
1608 LogTrace(frame
, nbytes(bits
), LastTimeProxToAirStart
*16 + DELAY_ARM2AIR_AS_READER
, (LastTimeProxToAirStart
+ LastProxToAirDuration
)*16 + DELAY_ARM2AIR_AS_READER
, par
, true);
1612 void ReaderTransmitPar(uint8_t* frame
, uint16_t len
, uint8_t *par
, uint32_t *timing
) {
1613 ReaderTransmitBitsPar(frame
, len
*8, par
, timing
);
1617 static void ReaderTransmitBits(uint8_t* frame
, uint16_t len
, uint32_t *timing
) {
1618 // Generate parity and redirect
1619 uint8_t par
[MAX_PARITY_SIZE
];
1620 GetParity(frame
, len
/8, par
);
1621 ReaderTransmitBitsPar(frame
, len
, par
, timing
);
1625 void ReaderTransmit(uint8_t* frame
, uint16_t len
, uint32_t *timing
) {
1626 // Generate parity and redirect
1627 uint8_t par
[MAX_PARITY_SIZE
];
1628 GetParity(frame
, len
, par
);
1629 ReaderTransmitBitsPar(frame
, len
*8, par
, timing
);
1633 static int ReaderReceiveOffset(uint8_t* receivedAnswer
, uint16_t offset
, uint8_t *parity
) {
1634 if (!GetIso14443aAnswerFromTag(receivedAnswer
, parity
, offset
)) return false;
1635 LogTrace(receivedAnswer
, Demod
.len
, Demod
.startTime
*16 - DELAY_AIR2ARM_AS_READER
, Demod
.endTime
*16 - DELAY_AIR2ARM_AS_READER
, parity
, false);
1640 int ReaderReceive(uint8_t *receivedAnswer
, uint8_t *parity
) {
1641 if (!GetIso14443aAnswerFromTag(receivedAnswer
, parity
, 0)) return false;
1643 LogTrace(receivedAnswer
, Demod
.len
, Demod
.startTime
*16 - DELAY_AIR2ARM_AS_READER
, Demod
.endTime
*16 - DELAY_AIR2ARM_AS_READER
, parity
, false);
1648 static void iso14a_set_ATS_times(uint8_t *ats
) {
1654 if (ats
[0] > 1) { // there is a format byte T0
1655 if ((ats
[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
1656 if ((ats
[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
1661 fwi
= (tb1
& 0xf0) >> 4; // frame waiting time integer (FWI)
1663 fwt
= 256 * 16 * (1 << fwi
); // frame waiting time (FWT) in 1/fc
1664 iso14a_set_timeout(fwt
/(8*16));
1666 sfgi
= tb1
& 0x0f; // startup frame guard time integer (SFGI)
1667 if (sfgi
!= 0 && sfgi
!= 15) {
1668 sfgt
= 256 * 16 * (1 << sfgi
); // startup frame guard time (SFGT) in 1/fc
1669 NextTransferTime
= MAX(NextTransferTime
, Demod
.endTime
+ (sfgt
- DELAY_AIR2ARM_AS_READER
- DELAY_ARM2AIR_AS_READER
)/16);
1676 static int GetATQA(uint8_t *resp
, uint8_t *resp_par
) {
1678 #define WUPA_RETRY_TIMEOUT 10 // 10ms
1679 uint8_t wupa
[] = {ISO14443A_CMD_WUPA
}; // 0x26 - REQA 0x52 - WAKE-UP
1681 uint32_t save_iso14a_timeout
= iso14a_get_timeout();
1682 iso14a_set_timeout(1236/(16*8)+1); // response to WUPA is expected at exactly 1236/fc. No need to wait longer.
1684 uint32_t start_time
= GetTickCount();
1687 // we may need several tries if we did send an unknown command or a wrong authentication before...
1689 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1690 ReaderTransmitBitsPar(wupa
, 7, NULL
, NULL
);
1692 len
= ReaderReceive(resp
, resp_par
);
1693 } while (len
== 0 && GetTickCount() <= start_time
+ WUPA_RETRY_TIMEOUT
);
1695 iso14a_set_timeout(save_iso14a_timeout
);
1700 // performs iso14443a anticollision (optional) and card select procedure
1701 // fills the uid and cuid pointer unless NULL
1702 // fills the card info record unless NULL
1703 // if anticollision is false, then the UID must be provided in uid_ptr[]
1704 // and num_cascades must be set (1: 4 Byte UID, 2: 7 Byte UID, 3: 10 Byte UID)
1705 // requests ATS unless no_rats is true
1706 int iso14443a_select_card(uint8_t *uid_ptr
, iso14a_card_select_t
*p_hi14a_card
, uint32_t *cuid_ptr
, bool anticollision
, uint8_t num_cascades
, bool no_rats
) {
1707 uint8_t sel_all
[] = { 0x93,0x20 };
1708 uint8_t sel_uid
[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1709 uint8_t rats
[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1710 uint8_t resp
[MAX_FRAME_SIZE
]; // theoretically. A usual RATS will be much smaller
1711 uint8_t resp_par
[MAX_PARITY_SIZE
];
1712 uint8_t uid_resp
[4];
1713 size_t uid_resp_len
;
1715 uint8_t sak
= 0x04; // cascade uid
1716 int cascade_level
= 0;
1721 p_hi14a_card
->uidlen
= 0;
1722 memset(p_hi14a_card
->uid
, 0, 10);
1723 p_hi14a_card
->ats_len
= 0;
1726 if (!GetATQA(resp
, resp_par
)) {
1731 memcpy(p_hi14a_card
->atqa
, resp
, 2);
1734 if (anticollision
) {
1737 memset(uid_ptr
,0,10);
1741 // check for proprietary anticollision:
1742 if ((resp
[0] & 0x1F) == 0) {
1746 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1747 // which case we need to make a cascade 2 request and select - this is a long UID
1748 // While the UID is not complete, the 3rd bit (from the right) is set in the SAK.
1749 for (; sak
& 0x04; cascade_level
++) {
1750 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1751 sel_uid
[0] = sel_all
[0] = 0x93 + cascade_level
* 2;
1753 if (anticollision
) {
1755 ReaderTransmit(sel_all
, sizeof(sel_all
), NULL
);
1756 if (!ReaderReceive(resp
, resp_par
)) {
1760 if (Demod
.collisionPos
) { // we had a collision and need to construct the UID bit by bit
1761 memset(uid_resp
, 0, 4);
1762 uint16_t uid_resp_bits
= 0;
1763 uint16_t collision_answer_offset
= 0;
1764 // anti-collision-loop:
1765 while (Demod
.collisionPos
) {
1766 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod
.collisionPos
);
1767 for (uint16_t i
= collision_answer_offset
; i
< Demod
.collisionPos
; i
++, uid_resp_bits
++) { // add valid UID bits before collision point
1768 uint16_t UIDbit
= (resp
[i
/8] >> (i
% 8)) & 0x01;
1769 uid_resp
[uid_resp_bits
/ 8] |= UIDbit
<< (uid_resp_bits
% 8);
1771 uid_resp
[uid_resp_bits
/8] |= 1 << (uid_resp_bits
% 8); // next time select the card(s) with a 1 in the collision position
1773 // construct anticollosion command:
1774 sel_uid
[1] = ((2 + uid_resp_bits
/8) << 4) | (uid_resp_bits
& 0x07); // length of data in bytes and bits
1775 for (uint16_t i
= 0; i
<= uid_resp_bits
/8; i
++) {
1776 sel_uid
[2+i
] = uid_resp
[i
];
1778 collision_answer_offset
= uid_resp_bits
%8;
1779 ReaderTransmitBits(sel_uid
, 16 + uid_resp_bits
, NULL
);
1780 if (!ReaderReceiveOffset(resp
, collision_answer_offset
, resp_par
)) {
1784 // finally, add the last bits and BCC of the UID
1785 for (uint16_t i
= collision_answer_offset
; i
< (Demod
.len
-1)*8; i
++, uid_resp_bits
++) {
1786 uint16_t UIDbit
= (resp
[i
/8] >> (i
%8)) & 0x01;
1787 uid_resp
[uid_resp_bits
/8] |= UIDbit
<< (uid_resp_bits
% 8);
1790 } else { // no collision, use the response to SELECT_ALL as current uid
1791 memcpy(uid_resp
, resp
, 4);
1794 if (cascade_level
< num_cascades
- 1) {
1796 memcpy(uid_resp
+1, uid_ptr
+cascade_level
*3, 3);
1798 memcpy(uid_resp
, uid_ptr
+cascade_level
*3, 4);
1803 // calculate crypto UID. Always use last 4 Bytes.
1805 *cuid_ptr
= bytes_to_num(uid_resp
, 4);
1808 // Construct SELECT UID command
1809 sel_uid
[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1810 memcpy(sel_uid
+2, uid_resp
, 4); // the UID received during anticollision, or the provided UID
1811 sel_uid
[6] = sel_uid
[2] ^ sel_uid
[3] ^ sel_uid
[4] ^ sel_uid
[5]; // calculate and add BCC
1812 AppendCrc14443a(sel_uid
, 7); // calculate and add CRC
1813 ReaderTransmit(sel_uid
, sizeof(sel_uid
), NULL
);
1816 if (!ReaderReceive(resp
, resp_par
)) {
1821 // Test if more parts of the uid are coming
1822 if ((sak
& 0x04) /* && uid_resp[0] == 0x88 */) {
1823 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1824 // http://www.nxp.com/documents/application_note/AN10927.pdf
1825 uid_resp
[0] = uid_resp
[1];
1826 uid_resp
[1] = uid_resp
[2];
1827 uid_resp
[2] = uid_resp
[3];
1831 if(uid_ptr
&& anticollision
) {
1832 memcpy(uid_ptr
+ (cascade_level
*3), uid_resp
, uid_resp_len
);
1836 memcpy(p_hi14a_card
->uid
+ (cascade_level
*3), uid_resp
, uid_resp_len
);
1837 p_hi14a_card
->uidlen
+= uid_resp_len
;
1842 p_hi14a_card
->sak
= sak
;
1845 // PICC compilant with iso14443a-4 ---> (SAK & 0x20 != 0)
1846 if( (sak
& 0x20) == 0) return 2;
1849 // Request for answer to select
1850 AppendCrc14443a(rats
, 2);
1851 ReaderTransmit(rats
, sizeof(rats
), NULL
);
1853 if (!(len
= ReaderReceive(resp
, resp_par
))) {
1858 memcpy(p_hi14a_card
->ats
, resp
, len
);
1859 p_hi14a_card
->ats_len
= len
;
1862 // reset the PCB block number
1863 iso14_pcb_blocknum
= 0;
1865 // set default timeout and delay next transfer based on ATS
1866 iso14a_set_ATS_times(resp
);
1873 void iso14443a_setup(uint8_t fpga_minor_mode
) {
1874 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1875 // Set up the synchronous serial port
1876 FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A
);
1877 // connect Demodulated Signal to ADC:
1878 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1880 // Signal field is on with the appropriate LED
1881 if (fpga_minor_mode
== FPGA_HF_ISO14443A_READER_MOD
1882 || fpga_minor_mode
== FPGA_HF_ISO14443A_READER_LISTEN
) {
1887 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| fpga_minor_mode
);
1889 // Set ADC to read field strength
1890 AT91C_BASE_ADC
->ADC_CR
= AT91C_ADC_SWRST
;
1891 AT91C_BASE_ADC
->ADC_MR
=
1892 ADC_MODE_PRESCALE(63) |
1893 ADC_MODE_STARTUP_TIME(1) |
1894 ADC_MODE_SAMPLE_HOLD_TIME(15);
1895 AT91C_BASE_ADC
->ADC_CHER
= ADC_CHANNEL(ADC_CHAN_HF_LOW
);
1902 LastTimeProxToAirStart
= 0;
1903 FpgaSendQueueDelay
= 0;
1904 LastProxToAirDuration
= 20; // arbitrary small value. Avoid lock in EmGetCmd()
1905 NextTransferTime
= 2*DELAY_ARM2AIR_AS_READER
;
1906 iso14a_set_timeout(1060); // 10ms default
1909 /* Peter Fillmore 2015
1910 Added card id field to the function
1911 info from ISO14443A standard
1914 b3 = depends on block
1915 b4 = Card ID following if set to 1
1916 b5 = depends on block type
1917 b6 = depends on block type
1920 b8 b7 b6 b5 b4 b3 b2 b1
1924 b8 b7 b6 b5 b4 b3 b2 b1
1928 b8 b7 b6 b5 b4 b3 b2 b1
1930 b5,b6 = 00 - DESELECT
1933 int iso14_apdu(uint8_t *cmd
, uint16_t cmd_len
, bool send_chaining
, void *data
, uint8_t *res
) {
1934 uint8_t parity
[MAX_PARITY_SIZE
];
1935 uint8_t real_cmd
[cmd_len
+ 4];
1938 // ISO 14443 APDU frame: PCB [CID] [NAD] APDU CRC PCB=0x02
1939 real_cmd
[0] = 0x02; // bnr,nad,cid,chn=0; i-block(0x00)
1940 if (send_chaining
) {
1941 real_cmd
[0] |= 0x10;
1943 // put block number into the PCB
1944 real_cmd
[0] |= iso14_pcb_blocknum
;
1945 memcpy(real_cmd
+ 1, cmd
, cmd_len
);
1948 real_cmd
[0] = 0xA2; // r-block + ACK
1949 real_cmd
[0] |= iso14_pcb_blocknum
;
1951 AppendCrc14443a(real_cmd
, cmd_len
+ 1);
1953 ReaderTransmit(real_cmd
, cmd_len
+ 3, NULL
);
1955 size_t len
= ReaderReceive(data
, parity
);
1956 uint8_t *data_bytes
= (uint8_t *) data
;
1959 return 0; //DATA LINK ERROR
1962 while (len
&& ((data_bytes
[0] & 0xF2) == 0xF2)) {
1963 uint32_t save_iso14a_timeout
= iso14a_get_timeout();
1964 // temporarily increase timeout
1965 iso14a_set_timeout(MAX((data_bytes
[1] & 0x3f) * save_iso14a_timeout
, MAX_ISO14A_TIMEOUT
));
1966 // Transmit WTX back
1967 // byte1 - WTXM [1..59]. command FWT=FWT*WTXM
1968 data_bytes
[1] = data_bytes
[1] & 0x3f; // 2 high bits mandatory set to 0b
1969 // now need to fix CRC.
1970 AppendCrc14443a(data_bytes
, len
- 2);
1972 ReaderTransmit(data_bytes
, len
, NULL
);
1973 // retrieve the result again (with increased timeout)
1974 len
= ReaderReceive(data
, parity
);
1977 iso14a_set_timeout(save_iso14a_timeout
);
1980 // if we received an I- or R(ACK)-Block with a block number equal to the
1981 // current block number, toggle the current block number
1982 if (len
>= 3 // PCB+CRC = 3 bytes
1983 && ((data_bytes
[0] & 0xC0) == 0 // I-Block
1984 || (data_bytes
[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
1985 && (data_bytes
[0] & 0x01) == iso14_pcb_blocknum
) // equal block numbers
1987 iso14_pcb_blocknum
^= 1;
1990 // if we received I-block with chaining we need to send ACK and receive another block of data
1992 *res
= data_bytes
[0];
1995 if (len
>= 3 && !CheckCrc14443(CRC_14443_A
, data_bytes
, len
)) {
2004 // memmove(data_bytes, data_bytes + 1, len);
2005 for (int i
= 0; i
< len
; i
++)
2006 data_bytes
[i
] = data_bytes
[i
+ 1];
2013 //-----------------------------------------------------------------------------
2014 // Read an ISO 14443a tag. Send out commands and store answers.
2016 //-----------------------------------------------------------------------------
2017 void ReaderIso14443a(UsbCommand
*c
) {
2019 iso14a_command_t param
= c
->arg
[0];
2020 uint8_t *cmd
= c
->d
.asBytes
;
2021 size_t len
= c
->arg
[1] & 0xffff;
2022 size_t lenbits
= c
->arg
[1] >> 16;
2023 uint32_t timeout
= c
->arg
[2];
2025 uint8_t buf
[USB_CMD_DATA_SIZE
] = {0};
2026 uint8_t par
[MAX_PARITY_SIZE
];
2027 bool cantSELECT
= false;
2031 if (param
& ISO14A_CLEAR_TRACE
) {
2035 if (param
& ISO14A_REQUEST_TRIGGER
) {
2036 iso14a_set_trigger(true);
2039 if (param
& ISO14A_CONNECT
) {
2041 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
2042 if(!(param
& ISO14A_NO_SELECT
)) {
2043 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)buf
;
2044 arg0
= iso14443a_select_card(NULL
, card
, NULL
, true, 0, param
& ISO14A_NO_RATS
);
2046 // if we cant select then we cant send data
2047 if (arg0
!= 1 && arg0
!= 2) {
2048 // 1 - all is OK with ATS, 2 - without ATS
2051 FpgaDisableTracing();
2053 cmd_send(CMD_NACK
,arg0
,card
->uidlen
,0,buf
,sizeof(iso14a_card_select_t
));
2058 if (param
& ISO14A_SET_TIMEOUT
) {
2059 iso14a_set_timeout(timeout
);
2062 if (param
& ISO14A_APDU
&& !cantSELECT
) {
2064 arg0
= iso14_apdu(cmd
, len
, (param
& ISO14A_SEND_CHAINING
), buf
, &res
);
2065 FpgaDisableTracing();
2067 cmd_send(CMD_ACK
, arg0
, res
, 0, buf
, sizeof(buf
));
2071 if (param
& ISO14A_RAW
&& !cantSELECT
) {
2072 if (param
& ISO14A_APPEND_CRC
) {
2073 if(param
& ISO14A_TOPAZMODE
) {
2074 AppendCrc14443b(cmd
,len
);
2076 AppendCrc14443a(cmd
,len
);
2079 if (lenbits
) lenbits
+= 16;
2081 if (lenbits
> 0) { // want to send a specific number of bits (e.g. short commands)
2082 if (param
& ISO14A_TOPAZMODE
) {
2083 int bits_to_send
= lenbits
;
2085 ReaderTransmitBitsPar(&cmd
[i
++], MIN(bits_to_send
, 7), NULL
, NULL
); // first byte is always short (7bits) and no parity
2087 while (bits_to_send
> 0) {
2088 ReaderTransmitBitsPar(&cmd
[i
++], MIN(bits_to_send
, 8), NULL
, NULL
); // following bytes are 8 bit and no parity
2092 GetParity(cmd
, lenbits
/8, par
);
2093 ReaderTransmitBitsPar(cmd
, lenbits
, par
, NULL
); // bytes are 8 bit with odd parity
2095 } else { // want to send complete bytes only
2096 if (param
& ISO14A_TOPAZMODE
) {
2098 ReaderTransmitBitsPar(&cmd
[i
++], 7, NULL
, NULL
); // first byte: 7 bits, no paritiy
2100 ReaderTransmitBitsPar(&cmd
[i
++], 8, NULL
, NULL
); // following bytes: 8 bits, no paritiy
2103 ReaderTransmit(cmd
,len
, NULL
); // 8 bits, odd parity
2106 arg0
= ReaderReceive(buf
, par
);
2107 FpgaDisableTracing();
2110 cmd_send(CMD_ACK
, arg0
, 0, 0, buf
, sizeof(buf
));
2114 if (param
& ISO14A_REQUEST_TRIGGER
) {
2115 iso14a_set_trigger(false);
2118 if (param
& ISO14A_NO_DISCONNECT
) {
2122 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
2127 // Determine the distance between two nonces.
2128 // Assume that the difference is small, but we don't know which is first.
2129 // Therefore try in alternating directions.
2130 static int32_t dist_nt(uint32_t nt1
, uint32_t nt2
) {
2133 uint32_t nttmp1
, nttmp2
;
2135 if (nt1
== nt2
) return 0;
2140 for (i
= 1; i
< 32768; i
++) {
2141 nttmp1
= prng_successor(nttmp1
, 1);
2142 if (nttmp1
== nt2
) return i
;
2143 nttmp2
= prng_successor(nttmp2
, 1);
2144 if (nttmp2
== nt1
) return -i
;
2147 return(-99999); // either nt1 or nt2 are invalid nonces
2151 //-----------------------------------------------------------------------------
2152 // Recover several bits of the cypher stream. This implements (first stages of)
2153 // the algorithm described in "The Dark Side of Security by Obscurity and
2154 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2155 // (article by Nicolas T. Courtois, 2009)
2156 //-----------------------------------------------------------------------------
2157 void ReaderMifare(bool first_try
)
2160 uint8_t mf_auth
[] = { 0x60,0x00,0xf5,0x7b };
2161 uint8_t mf_nr_ar
[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
2162 static uint8_t mf_nr_ar3
;
2164 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
2165 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
2167 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD
);
2169 // free eventually allocated BigBuf memory. We want all for tracing.
2175 uint8_t nt_diff
= 0;
2176 uint8_t par
[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
2177 static uint8_t par_low
= 0;
2179 uint8_t uid
[10] ={0};
2183 uint32_t previous_nt
= 0;
2184 static uint32_t nt_attacked
= 0;
2185 uint8_t par_list
[8] = {0x00};
2186 uint8_t ks_list
[8] = {0x00};
2188 #define PRNG_SEQUENCE_LENGTH (1 << 16);
2189 uint32_t sync_time
= GetCountSspClk() & 0xfffffff8;
2190 static int32_t sync_cycles
;
2191 int catch_up_cycles
= 0;
2192 int last_catch_up
= 0;
2193 uint16_t elapsed_prng_sequences
;
2194 uint16_t consecutive_resyncs
= 0;
2199 par
[0] = par_low
= 0;
2200 sync_cycles
= PRNG_SEQUENCE_LENGTH
; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the tag nonces).
2204 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
2206 mf_nr_ar
[3] = mf_nr_ar3
;
2215 #define MAX_UNEXPECTED_RANDOM 4 // maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
2216 #define MAX_SYNC_TRIES 32
2217 #define SYNC_TIME_BUFFER 16 // if there is only SYNC_TIME_BUFFER left before next planned sync, wait for next PRNG cycle
2218 #define NUM_DEBUG_INFOS 8 // per strategy
2219 #define MAX_STRATEGY 3
2220 uint16_t unexpected_random
= 0;
2221 uint16_t sync_tries
= 0;
2222 int16_t debug_info_nr
= -1;
2223 uint16_t strategy
= 0;
2224 int32_t debug_info
[MAX_STRATEGY
][NUM_DEBUG_INFOS
];
2225 uint32_t select_time
;
2228 for (uint16_t i
= 0; true; i
++) {
2233 // Test if the action was cancelled
2234 if(BUTTON_PRESS()) {
2239 if (strategy
== 2) {
2240 // test with additional hlt command
2242 int len
= mifare_sendcmd_short(NULL
, false, 0x50, 0x00, receivedAnswer
, receivedAnswerPar
, &halt_time
);
2243 if (len
&& MF_DBGLEVEL
>= 3) {
2244 Dbprintf("Unexpected response of %d bytes to hlt command (additional debugging).", len
);
2248 if (strategy
== 3) {
2249 // test with FPGA power off/on
2250 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
2252 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD
);
2256 if(!iso14443a_select_card(uid
, NULL
, &cuid
, true, 0, true)) {
2257 if (MF_DBGLEVEL
>= 1) Dbprintf("Mifare: Can't select card");
2260 select_time
= GetCountSspClk();
2262 elapsed_prng_sequences
= 1;
2263 if (debug_info_nr
== -1) {
2264 sync_time
= (sync_time
& 0xfffffff8) + sync_cycles
+ catch_up_cycles
;
2265 catch_up_cycles
= 0;
2267 // if we missed the sync time already or are about to miss it, advance to the next nonce repeat
2268 while(sync_time
< GetCountSspClk() + SYNC_TIME_BUFFER
) {
2269 elapsed_prng_sequences
++;
2270 sync_time
= (sync_time
& 0xfffffff8) + sync_cycles
;
2273 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2274 ReaderTransmit(mf_auth
, sizeof(mf_auth
), &sync_time
);
2276 // collect some information on tag nonces for debugging:
2277 #define DEBUG_FIXED_SYNC_CYCLES PRNG_SEQUENCE_LENGTH
2278 if (strategy
== 0) {
2279 // nonce distances at fixed time after card select:
2280 sync_time
= select_time
+ DEBUG_FIXED_SYNC_CYCLES
;
2281 } else if (strategy
== 1) {
2282 // nonce distances at fixed time between authentications:
2283 sync_time
= sync_time
+ DEBUG_FIXED_SYNC_CYCLES
;
2284 } else if (strategy
== 2) {
2285 // nonce distances at fixed time after halt:
2286 sync_time
= halt_time
+ DEBUG_FIXED_SYNC_CYCLES
;
2288 // nonce_distances at fixed time after power on
2289 sync_time
= DEBUG_FIXED_SYNC_CYCLES
;
2291 ReaderTransmit(mf_auth
, sizeof(mf_auth
), &sync_time
);
2294 // Receive the (4 Byte) "random" nonce
2295 if (!ReaderReceive(receivedAnswer
, receivedAnswerPar
)) {
2296 if (MF_DBGLEVEL
>= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2301 nt
= bytes_to_num(receivedAnswer
, 4);
2303 // Transmit reader nonce with fake par
2304 ReaderTransmitPar(mf_nr_ar
, sizeof(mf_nr_ar
), par
, NULL
);
2306 if (first_try
&& previous_nt
&& !nt_attacked
) { // we didn't calibrate our clock yet
2307 int nt_distance
= dist_nt(previous_nt
, nt
);
2308 if (nt_distance
== 0) {
2311 if (nt_distance
== -99999) { // invalid nonce received
2312 unexpected_random
++;
2313 if (unexpected_random
> MAX_UNEXPECTED_RANDOM
) {
2314 isOK
= -3; // Card has an unpredictable PRNG. Give up
2317 continue; // continue trying...
2320 if (++sync_tries
> MAX_SYNC_TRIES
) {
2321 if (strategy
> MAX_STRATEGY
|| MF_DBGLEVEL
< 3) {
2322 isOK
= -4; // Card's PRNG runs at an unexpected frequency or resets unexpectedly
2324 } else { // continue for a while, just to collect some debug info
2325 debug_info
[strategy
][debug_info_nr
] = nt_distance
;
2327 if (debug_info_nr
== NUM_DEBUG_INFOS
) {
2334 sync_cycles
= (sync_cycles
- nt_distance
/elapsed_prng_sequences
);
2335 if (sync_cycles
<= 0) {
2336 sync_cycles
+= PRNG_SEQUENCE_LENGTH
;
2338 if (MF_DBGLEVEL
>= 3) {
2339 Dbprintf("calibrating in cycle %d. nt_distance=%d, elapsed_prng_sequences=%d, new sync_cycles: %d\n", i
, nt_distance
, elapsed_prng_sequences
, sync_cycles
);
2345 if ((nt
!= nt_attacked
) && nt_attacked
) { // we somehow lost sync. Try to catch up again...
2346 catch_up_cycles
= -dist_nt(nt_attacked
, nt
);
2347 if (catch_up_cycles
== 99999) { // invalid nonce received. Don't resync on that one.
2348 catch_up_cycles
= 0;
2351 catch_up_cycles
/= elapsed_prng_sequences
;
2352 if (catch_up_cycles
== last_catch_up
) {
2353 consecutive_resyncs
++;
2356 last_catch_up
= catch_up_cycles
;
2357 consecutive_resyncs
= 0;
2359 if (consecutive_resyncs
< 3) {
2360 if (MF_DBGLEVEL
>= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i
, -catch_up_cycles
, consecutive_resyncs
);
2363 sync_cycles
= sync_cycles
+ catch_up_cycles
;
2364 if (MF_DBGLEVEL
>= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i
, -catch_up_cycles
, sync_cycles
);
2366 catch_up_cycles
= 0;
2367 consecutive_resyncs
= 0;
2372 consecutive_resyncs
= 0;
2374 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2375 if (ReaderReceive(receivedAnswer
, receivedAnswerPar
)) {
2376 catch_up_cycles
= 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2379 par_low
= par
[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2383 if(led_on
) LED_B_ON(); else LED_B_OFF();
2385 par_list
[nt_diff
] = SwapBits(par
[0], 8);
2386 ks_list
[nt_diff
] = receivedAnswer
[0] ^ 0x05;
2388 // Test if the information is complete
2389 if (nt_diff
== 0x07) {
2394 nt_diff
= (nt_diff
+ 1) & 0x07;
2395 mf_nr_ar
[3] = (mf_nr_ar
[3] & 0x1F) | (nt_diff
<< 5);
2398 if (nt_diff
== 0 && first_try
)
2401 if (par
[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
2406 par
[0] = ((par
[0] & 0x1F) + 1) | par_low
;
2412 mf_nr_ar
[3] &= 0x1F;
2415 if (MF_DBGLEVEL
>= 3) {
2416 for (uint16_t i
= 0; i
<= MAX_STRATEGY
; i
++) {
2417 for (uint16_t j
= 0; j
< NUM_DEBUG_INFOS
; j
++) {
2418 Dbprintf("collected debug info[%d][%d] = %d", i
, j
, debug_info
[i
][j
]);
2424 FpgaDisableTracing();
2427 memcpy(buf
+ 0, uid
, 4);
2428 num_to_bytes(nt
, 4, buf
+ 4);
2429 memcpy(buf
+ 8, par_list
, 8);
2430 memcpy(buf
+ 16, ks_list
, 8);
2431 memcpy(buf
+ 24, mf_nr_ar
, 8);
2433 cmd_send(CMD_ACK
, isOK
, 0, 0, buf
, 32);
2436 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
2443 //-----------------------------------------------------------------------------
2446 //-----------------------------------------------------------------------------
2447 void RAMFUNC
SniffMifare(uint8_t param
) {
2449 // bit 0 - trigger from first card answer
2450 // bit 1 - trigger from first reader 7-bit request
2452 // C(red) A(yellow) B(green)
2456 // init trace buffer
2460 // The command (reader -> tag) that we're receiving.
2461 // The length of a received command will in most cases be no more than 18 bytes.
2462 // So 32 should be enough!
2463 uint8_t receivedCmd
[MAX_MIFARE_FRAME_SIZE
];
2464 uint8_t receivedCmdPar
[MAX_MIFARE_PARITY_SIZE
];
2465 // The response (tag -> reader) that we're receiving.
2466 uint8_t receivedResponse
[MAX_MIFARE_FRAME_SIZE
];
2467 uint8_t receivedResponsePar
[MAX_MIFARE_PARITY_SIZE
];
2469 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER
);
2471 // free eventually allocated BigBuf memory
2473 // allocate the DMA buffer, used to stream samples from the FPGA
2474 uint8_t *dmaBuf
= BigBuf_malloc(DMA_BUFFER_SIZE
);
2475 uint8_t *data
= dmaBuf
;
2476 uint8_t previous_data
= 0;
2479 bool ReaderIsActive
= false;
2480 bool TagIsActive
= false;
2482 // Set up the demodulator for tag -> reader responses.
2483 DemodInit(receivedResponse
, receivedResponsePar
);
2485 // Set up the demodulator for the reader -> tag commands
2486 UartInit(receivedCmd
, receivedCmdPar
);
2488 // Setup for the DMA.
2489 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
); // set transfer address and number of bytes. Start transfer.
2494 // And now we loop, receiving samples.
2495 for (uint32_t sniffCounter
= 0; true; ) {
2497 if(BUTTON_PRESS()) {
2498 DbpString("Canceled by button.");
2504 if ((sniffCounter
& 0x0000FFFF) == 0) { // from time to time
2505 // check if a transaction is completed (timeout after 2000ms).
2506 // if yes, stop the DMA transfer and send what we have so far to the client
2507 if (MfSniffSend(2000)) {
2508 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
2512 ReaderIsActive
= false;
2513 TagIsActive
= false;
2514 FpgaSetupSscDma((uint8_t *)dmaBuf
, DMA_BUFFER_SIZE
); // set transfer address and number of bytes. Start transfer.
2518 int register readBufDataP
= data
- dmaBuf
; // number of bytes we have processed so far
2519 int register dmaBufDataP
= DMA_BUFFER_SIZE
- AT91C_BASE_PDC_SSC
->PDC_RCR
; // number of bytes already transferred
2520 if (readBufDataP
<= dmaBufDataP
){ // we are processing the same block of data which is currently being transferred
2521 dataLen
= dmaBufDataP
- readBufDataP
; // number of bytes still to be processed
2523 dataLen
= DMA_BUFFER_SIZE
- readBufDataP
+ dmaBufDataP
; // number of bytes still to be processed
2525 // test for length of buffer
2526 if(dataLen
> maxDataLen
) { // we are more behind than ever...
2527 maxDataLen
= dataLen
;
2528 if(dataLen
> (9 * DMA_BUFFER_SIZE
/ 10)) {
2529 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen
);
2533 if(dataLen
< 1) continue;
2535 // primary buffer was stopped ( <-- we lost data!
2536 if (!AT91C_BASE_PDC_SSC
->PDC_RCR
) {
2537 AT91C_BASE_PDC_SSC
->PDC_RPR
= (uint32_t) dmaBuf
;
2538 AT91C_BASE_PDC_SSC
->PDC_RCR
= DMA_BUFFER_SIZE
;
2539 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen
); // temporary
2541 // secondary buffer sets as primary, secondary buffer was stopped
2542 if (!AT91C_BASE_PDC_SSC
->PDC_RNCR
) {
2543 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
;
2544 AT91C_BASE_PDC_SSC
->PDC_RNCR
= DMA_BUFFER_SIZE
;
2547 if (sniffCounter
& 0x01) {
2549 if(!TagIsActive
) { // no need to try decoding tag data if the reader is sending
2550 uint8_t readerdata
= (previous_data
& 0xF0) | (*data
>> 4);
2551 if(MillerDecoding(readerdata
, (sniffCounter
-1)*4)) {
2553 if (MfSniffLogic(receivedCmd
, Uart
.len
, Uart
.parity
, Uart
.bitCount
, true)) break;
2555 /* And ready to receive another command. */
2556 UartInit(receivedCmd
, receivedCmdPar
);
2558 /* And also reset the demod code */
2561 ReaderIsActive
= (Uart
.state
!= STATE_UNSYNCD
);
2564 if(!ReaderIsActive
) { // no need to try decoding tag data if the reader is sending
2565 uint8_t tagdata
= (previous_data
<< 4) | (*data
& 0x0F);
2566 if(ManchesterDecoding(tagdata
, 0, (sniffCounter
-1)*4)) {
2568 if (MfSniffLogic(receivedResponse
, Demod
.len
, Demod
.parity
, Demod
.bitCount
, false)) break;
2570 // And ready to receive another response.
2572 // And reset the Miller decoder including its (now outdated) input buffer
2573 UartInit(receivedCmd
, receivedCmdPar
);
2575 TagIsActive
= (Demod
.state
!= DEMOD_UNSYNCD
);
2579 previous_data
= *data
;
2582 if(data
== dmaBuf
+ DMA_BUFFER_SIZE
) {
2588 FpgaDisableTracing();
2589 FpgaDisableSscDma();
2592 DbpString("COMMAND FINISHED.");
2596 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen
, Uart
.state
, Uart
.len
);