]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
fixed Mifare nested by activating commented SpinDelay()s
[proxmark3-svn] / armsrc / iso14443.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Routines to support ISO 14443. This includes both the reader software and
9 // the `fake tag' modes. At the moment only the Type B modulation is
10 // supported.
11 //-----------------------------------------------------------------------------
12
13 #include "proxmark3.h"
14 #include "apps.h"
15 #include "util.h"
16 #include "string.h"
17
18 #include "iso14443crc.h"
19
20 //static void GetSamplesFor14443(int weTx, int n);
21
22 #define DEMOD_TRACE_SIZE 4096
23 #define READER_TAG_BUFFER_SIZE 2048
24 #define TAG_READER_BUFFER_SIZE 2048
25 #define DEMOD_DMA_BUFFER_SIZE 1024
26
27 //=============================================================================
28 // An ISO 14443 Type B tag. We listen for commands from the reader, using
29 // a UART kind of thing that's implemented in software. When we get a
30 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
31 // If it's good, then we can do something appropriate with it, and send
32 // a response.
33 //=============================================================================
34
35 //-----------------------------------------------------------------------------
36 // Code up a string of octets at layer 2 (including CRC, we don't generate
37 // that here) so that they can be transmitted to the reader. Doesn't transmit
38 // them yet, just leaves them ready to send in ToSend[].
39 //-----------------------------------------------------------------------------
40 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
41 {
42 int i;
43
44 ToSendReset();
45
46 // Transmit a burst of ones, as the initial thing that lets the
47 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
48 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
49 // so I will too.
50 for(i = 0; i < 20; i++) {
51 ToSendStuffBit(1);
52 ToSendStuffBit(1);
53 ToSendStuffBit(1);
54 ToSendStuffBit(1);
55 }
56
57 // Send SOF.
58 for(i = 0; i < 10; i++) {
59 ToSendStuffBit(0);
60 ToSendStuffBit(0);
61 ToSendStuffBit(0);
62 ToSendStuffBit(0);
63 }
64 for(i = 0; i < 2; i++) {
65 ToSendStuffBit(1);
66 ToSendStuffBit(1);
67 ToSendStuffBit(1);
68 ToSendStuffBit(1);
69 }
70
71 for(i = 0; i < len; i++) {
72 int j;
73 uint8_t b = cmd[i];
74
75 // Start bit
76 ToSendStuffBit(0);
77 ToSendStuffBit(0);
78 ToSendStuffBit(0);
79 ToSendStuffBit(0);
80
81 // Data bits
82 for(j = 0; j < 8; j++) {
83 if(b & 1) {
84 ToSendStuffBit(1);
85 ToSendStuffBit(1);
86 ToSendStuffBit(1);
87 ToSendStuffBit(1);
88 } else {
89 ToSendStuffBit(0);
90 ToSendStuffBit(0);
91 ToSendStuffBit(0);
92 ToSendStuffBit(0);
93 }
94 b >>= 1;
95 }
96
97 // Stop bit
98 ToSendStuffBit(1);
99 ToSendStuffBit(1);
100 ToSendStuffBit(1);
101 ToSendStuffBit(1);
102 }
103
104 // Send SOF.
105 for(i = 0; i < 10; i++) {
106 ToSendStuffBit(0);
107 ToSendStuffBit(0);
108 ToSendStuffBit(0);
109 ToSendStuffBit(0);
110 }
111 for(i = 0; i < 10; i++) {
112 ToSendStuffBit(1);
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 ToSendStuffBit(1);
116 }
117
118 // Convert from last byte pos to length
119 ToSendMax++;
120
121 // Add a few more for slop
122 ToSendMax += 2;
123 }
124
125 //-----------------------------------------------------------------------------
126 // The software UART that receives commands from the reader, and its state
127 // variables.
128 //-----------------------------------------------------------------------------
129 static struct {
130 enum {
131 STATE_UNSYNCD,
132 STATE_GOT_FALLING_EDGE_OF_SOF,
133 STATE_AWAITING_START_BIT,
134 STATE_RECEIVING_DATA,
135 STATE_ERROR_WAIT
136 } state;
137 uint16_t shiftReg;
138 int bitCnt;
139 int byteCnt;
140 int byteCntMax;
141 int posCnt;
142 uint8_t *output;
143 } Uart;
144
145 /* Receive & handle a bit coming from the reader.
146 *
147 * LED handling:
148 * LED A -> ON once we have received the SOF and are expecting the rest.
149 * LED A -> OFF once we have received EOF or are in error state or unsynced
150 *
151 * Returns: true if we received a EOF
152 * false if we are still waiting for some more
153 */
154 static int Handle14443UartBit(int bit)
155 {
156 switch(Uart.state) {
157 case STATE_UNSYNCD:
158 LED_A_OFF();
159 if(!bit) {
160 // we went low, so this could be the beginning
161 // of an SOF
162 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
163 Uart.posCnt = 0;
164 Uart.bitCnt = 0;
165 }
166 break;
167
168 case STATE_GOT_FALLING_EDGE_OF_SOF:
169 Uart.posCnt++;
170 if(Uart.posCnt == 2) {
171 if(bit) {
172 if(Uart.bitCnt >= 10) {
173 // we've seen enough consecutive
174 // zeros that it's a valid SOF
175 Uart.posCnt = 0;
176 Uart.byteCnt = 0;
177 Uart.state = STATE_AWAITING_START_BIT;
178 LED_A_ON(); // Indicate we got a valid SOF
179 } else {
180 // didn't stay down long enough
181 // before going high, error
182 Uart.state = STATE_ERROR_WAIT;
183 }
184 } else {
185 // do nothing, keep waiting
186 }
187 Uart.bitCnt++;
188 }
189 if(Uart.posCnt >= 4) Uart.posCnt = 0;
190 if(Uart.bitCnt > 14) {
191 // Give up if we see too many zeros without
192 // a one, too.
193 Uart.state = STATE_ERROR_WAIT;
194 }
195 break;
196
197 case STATE_AWAITING_START_BIT:
198 Uart.posCnt++;
199 if(bit) {
200 if(Uart.posCnt > 25) {
201 // stayed high for too long between
202 // characters, error
203 Uart.state = STATE_ERROR_WAIT;
204 }
205 } else {
206 // falling edge, this starts the data byte
207 Uart.posCnt = 0;
208 Uart.bitCnt = 0;
209 Uart.shiftReg = 0;
210 Uart.state = STATE_RECEIVING_DATA;
211 LED_A_ON(); // Indicate we're receiving
212 }
213 break;
214
215 case STATE_RECEIVING_DATA:
216 Uart.posCnt++;
217 if(Uart.posCnt == 2) {
218 // time to sample a bit
219 Uart.shiftReg >>= 1;
220 if(bit) {
221 Uart.shiftReg |= 0x200;
222 }
223 Uart.bitCnt++;
224 }
225 if(Uart.posCnt >= 4) {
226 Uart.posCnt = 0;
227 }
228 if(Uart.bitCnt == 10) {
229 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
230 {
231 // this is a data byte, with correct
232 // start and stop bits
233 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
234 Uart.byteCnt++;
235
236 if(Uart.byteCnt >= Uart.byteCntMax) {
237 // Buffer overflowed, give up
238 Uart.posCnt = 0;
239 Uart.state = STATE_ERROR_WAIT;
240 } else {
241 // so get the next byte now
242 Uart.posCnt = 0;
243 Uart.state = STATE_AWAITING_START_BIT;
244 }
245 } else if(Uart.shiftReg == 0x000) {
246 // this is an EOF byte
247 LED_A_OFF(); // Finished receiving
248 return TRUE;
249 } else {
250 // this is an error
251 Uart.posCnt = 0;
252 Uart.state = STATE_ERROR_WAIT;
253 }
254 }
255 break;
256
257 case STATE_ERROR_WAIT:
258 // We're all screwed up, so wait a little while
259 // for whatever went wrong to finish, and then
260 // start over.
261 Uart.posCnt++;
262 if(Uart.posCnt > 10) {
263 Uart.state = STATE_UNSYNCD;
264 }
265 break;
266
267 default:
268 Uart.state = STATE_UNSYNCD;
269 break;
270 }
271
272 if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error
273
274 return FALSE;
275 }
276
277 //-----------------------------------------------------------------------------
278 // Receive a command (from the reader to us, where we are the simulated tag),
279 // and store it in the given buffer, up to the given maximum length. Keeps
280 // spinning, waiting for a well-framed command, until either we get one
281 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
282 //
283 // Assume that we're called with the SSC (to the FPGA) and ADC path set
284 // correctly.
285 //-----------------------------------------------------------------------------
286 static int GetIso14443CommandFromReader(uint8_t *received, int *len, int maxLen)
287 {
288 uint8_t mask;
289 int i, bit;
290
291 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
292 // only, since we are receiving, not transmitting).
293 // Signal field is off with the appropriate LED
294 LED_D_OFF();
295 FpgaWriteConfWord(
296 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
297
298
299 // Now run a `software UART' on the stream of incoming samples.
300 Uart.output = received;
301 Uart.byteCntMax = maxLen;
302 Uart.state = STATE_UNSYNCD;
303
304 for(;;) {
305 WDT_HIT();
306
307 if(BUTTON_PRESS()) return FALSE;
308
309 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
310 AT91C_BASE_SSC->SSC_THR = 0x00;
311 }
312 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
313 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
314
315 mask = 0x80;
316 for(i = 0; i < 8; i++, mask >>= 1) {
317 bit = (b & mask);
318 if(Handle14443UartBit(bit)) {
319 *len = Uart.byteCnt;
320 return TRUE;
321 }
322 }
323 }
324 }
325 }
326
327 //-----------------------------------------------------------------------------
328 // Main loop of simulated tag: receive commands from reader, decide what
329 // response to send, and send it.
330 //-----------------------------------------------------------------------------
331 void SimulateIso14443Tag(void)
332 {
333 static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
334 static const uint8_t response1[] = {
335 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
336 0x00, 0x21, 0x85, 0x5e, 0xd7
337 };
338
339 uint8_t *resp;
340 int respLen;
341
342 uint8_t *resp1 = (((uint8_t *)BigBuf) + 800);
343 int resp1Len;
344
345 uint8_t *receivedCmd = (uint8_t *)BigBuf;
346 int len;
347
348 int i;
349
350 int cmdsRecvd = 0;
351
352 memset(receivedCmd, 0x44, 400);
353
354 CodeIso14443bAsTag(response1, sizeof(response1));
355 memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
356
357 // We need to listen to the high-frequency, peak-detected path.
358 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
359 FpgaSetupSsc();
360
361 cmdsRecvd = 0;
362
363 for(;;) {
364 uint8_t b1, b2;
365
366 if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {
367 Dbprintf("button pressed, received %d commands", cmdsRecvd);
368 break;
369 }
370
371 // Good, look at the command now.
372
373 if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
374 resp = resp1; respLen = resp1Len;
375 } else {
376 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
377 // And print whether the CRC fails, just for good measure
378 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
379 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
380 // Not so good, try again.
381 DbpString("+++CRC fail");
382 } else {
383 DbpString("CRC passes");
384 }
385 break;
386 }
387
388 memset(receivedCmd, 0x44, 32);
389
390 cmdsRecvd++;
391
392 if(cmdsRecvd > 0x30) {
393 DbpString("many commands later...");
394 break;
395 }
396
397 if(respLen <= 0) continue;
398
399 // Modulate BPSK
400 // Signal field is off with the appropriate LED
401 LED_D_OFF();
402 FpgaWriteConfWord(
403 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
404 AT91C_BASE_SSC->SSC_THR = 0xff;
405 FpgaSetupSsc();
406
407 // Transmit the response.
408 i = 0;
409 for(;;) {
410 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
411 uint8_t b = resp[i];
412
413 AT91C_BASE_SSC->SSC_THR = b;
414
415 i++;
416 if(i > respLen) {
417 break;
418 }
419 }
420 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
421 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
422 (void)b;
423 }
424 }
425 }
426 }
427
428 //=============================================================================
429 // An ISO 14443 Type B reader. We take layer two commands, code them
430 // appropriately, and then send them to the tag. We then listen for the
431 // tag's response, which we leave in the buffer to be demodulated on the
432 // PC side.
433 //=============================================================================
434
435 static struct {
436 enum {
437 DEMOD_UNSYNCD,
438 DEMOD_PHASE_REF_TRAINING,
439 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
440 DEMOD_GOT_FALLING_EDGE_OF_SOF,
441 DEMOD_AWAITING_START_BIT,
442 DEMOD_RECEIVING_DATA,
443 DEMOD_ERROR_WAIT
444 } state;
445 int bitCount;
446 int posCount;
447 int thisBit;
448 int metric;
449 int metricN;
450 uint16_t shiftReg;
451 uint8_t *output;
452 int len;
453 int sumI;
454 int sumQ;
455 } Demod;
456
457 /*
458 * Handles reception of a bit from the tag
459 *
460 * LED handling:
461 * LED C -> ON once we have received the SOF and are expecting the rest.
462 * LED C -> OFF once we have received EOF or are unsynced
463 *
464 * Returns: true if we received a EOF
465 * false if we are still waiting for some more
466 *
467 */
468 static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)
469 {
470 int v;
471
472 // The soft decision on the bit uses an estimate of just the
473 // quadrant of the reference angle, not the exact angle.
474 #define MAKE_SOFT_DECISION() { \
475 if(Demod.sumI > 0) { \
476 v = ci; \
477 } else { \
478 v = -ci; \
479 } \
480 if(Demod.sumQ > 0) { \
481 v += cq; \
482 } else { \
483 v -= cq; \
484 } \
485 }
486
487 switch(Demod.state) {
488 case DEMOD_UNSYNCD:
489 v = ci;
490 if(v < 0) v = -v;
491 if(cq > 0) {
492 v += cq;
493 } else {
494 v -= cq;
495 }
496 if(v > 40) {
497 Demod.posCount = 0;
498 Demod.state = DEMOD_PHASE_REF_TRAINING;
499 Demod.sumI = 0;
500 Demod.sumQ = 0;
501 }
502 break;
503
504 case DEMOD_PHASE_REF_TRAINING:
505 if(Demod.posCount < 8) {
506 Demod.sumI += ci;
507 Demod.sumQ += cq;
508 } else if(Demod.posCount > 100) {
509 // error, waited too long
510 Demod.state = DEMOD_UNSYNCD;
511 } else {
512 MAKE_SOFT_DECISION();
513 if(v < 0) {
514 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
515 Demod.posCount = 0;
516 }
517 }
518 Demod.posCount++;
519 break;
520
521 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
522 MAKE_SOFT_DECISION();
523 if(v < 0) {
524 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
525 Demod.posCount = 0;
526 } else {
527 if(Demod.posCount > 100) {
528 Demod.state = DEMOD_UNSYNCD;
529 }
530 }
531 Demod.posCount++;
532 break;
533
534 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
535 MAKE_SOFT_DECISION();
536 if(v > 0) {
537 if(Demod.posCount < 12) {
538 Demod.state = DEMOD_UNSYNCD;
539 } else {
540 LED_C_ON(); // Got SOF
541 Demod.state = DEMOD_AWAITING_START_BIT;
542 Demod.posCount = 0;
543 Demod.len = 0;
544 Demod.metricN = 0;
545 Demod.metric = 0;
546 }
547 } else {
548 if(Demod.posCount > 100) {
549 Demod.state = DEMOD_UNSYNCD;
550 }
551 }
552 Demod.posCount++;
553 break;
554
555 case DEMOD_AWAITING_START_BIT:
556 MAKE_SOFT_DECISION();
557 if(v > 0) {
558 if(Demod.posCount > 10) {
559 Demod.state = DEMOD_UNSYNCD;
560 }
561 } else {
562 Demod.bitCount = 0;
563 Demod.posCount = 1;
564 Demod.thisBit = v;
565 Demod.shiftReg = 0;
566 Demod.state = DEMOD_RECEIVING_DATA;
567 }
568 break;
569
570 case DEMOD_RECEIVING_DATA:
571 MAKE_SOFT_DECISION();
572 if(Demod.posCount == 0) {
573 Demod.thisBit = v;
574 Demod.posCount = 1;
575 } else {
576 Demod.thisBit += v;
577
578 if(Demod.thisBit > 0) {
579 Demod.metric += Demod.thisBit;
580 } else {
581 Demod.metric -= Demod.thisBit;
582 }
583 (Demod.metricN)++;
584
585 Demod.shiftReg >>= 1;
586 if(Demod.thisBit > 0) {
587 Demod.shiftReg |= 0x200;
588 }
589
590 Demod.bitCount++;
591 if(Demod.bitCount == 10) {
592 uint16_t s = Demod.shiftReg;
593 if((s & 0x200) && !(s & 0x001)) {
594 uint8_t b = (s >> 1);
595 Demod.output[Demod.len] = b;
596 Demod.len++;
597 Demod.state = DEMOD_AWAITING_START_BIT;
598 } else if(s == 0x000) {
599 // This is EOF
600 LED_C_OFF();
601 return TRUE;
602 Demod.state = DEMOD_UNSYNCD;
603 } else {
604 Demod.state = DEMOD_UNSYNCD;
605 }
606 }
607 Demod.posCount = 0;
608 }
609 break;
610
611 default:
612 Demod.state = DEMOD_UNSYNCD;
613 break;
614 }
615
616 if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...
617 return FALSE;
618 }
619
620 /*
621 * Demodulate the samples we received from the tag
622 * weTx: set to 'TRUE' if we behave like a reader
623 * set to 'FALSE' if we behave like a snooper
624 * quiet: set to 'TRUE' to disable debug output
625 */
626 static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
627 {
628 int max = 0;
629 int gotFrame = FALSE;
630
631 //# define DMA_BUFFER_SIZE 8
632 int8_t *dmaBuf;
633
634 int lastRxCounter;
635 int8_t *upTo;
636
637 int ci, cq;
638
639 int samples = 0;
640
641 // Clear out the state of the "UART" that receives from the tag.
642 memset(BigBuf, 0x44, 400);
643 Demod.output = (uint8_t *)BigBuf;
644 Demod.len = 0;
645 Demod.state = DEMOD_UNSYNCD;
646
647 // And the UART that receives from the reader
648 Uart.output = (((uint8_t *)BigBuf) + 1024);
649 Uart.byteCntMax = 100;
650 Uart.state = STATE_UNSYNCD;
651
652 // Setup for the DMA.
653 dmaBuf = (int8_t *)(BigBuf + 32);
654 upTo = dmaBuf;
655 lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
656 FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
657
658 // Signal field is ON with the appropriate LED:
659 if (weTx) LED_D_ON(); else LED_D_OFF();
660 // And put the FPGA in the appropriate mode
661 FpgaWriteConfWord(
662 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
663 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
664
665 for(;;) {
666 int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
667 if(behindBy > max) max = behindBy;
668
669 while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DEMOD_DMA_BUFFER_SIZE-1))
670 > 2)
671 {
672 ci = upTo[0];
673 cq = upTo[1];
674 upTo += 2;
675 if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {
676 upTo -= DEMOD_DMA_BUFFER_SIZE;
677 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
678 AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;
679 }
680 lastRxCounter -= 2;
681 if(lastRxCounter <= 0) {
682 lastRxCounter += DEMOD_DMA_BUFFER_SIZE;
683 }
684
685 samples += 2;
686
687 Handle14443UartBit(1);
688 Handle14443UartBit(1);
689
690 if(Handle14443SamplesDemod(ci, cq)) {
691 gotFrame = 1;
692 }
693 }
694
695 if(samples > 2000) {
696 break;
697 }
698 }
699 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
700 if (!quiet) Dbprintf("%x %x %x", max, gotFrame, Demod.len);
701 }
702
703 //-----------------------------------------------------------------------------
704 // Read the tag's response. We just receive a stream of slightly-processed
705 // samples from the FPGA, which we will later do some signal processing on,
706 // to get the bits.
707 //-----------------------------------------------------------------------------
708 /*static void GetSamplesFor14443(int weTx, int n)
709 {
710 uint8_t *dest = (uint8_t *)BigBuf;
711 int c;
712
713 FpgaWriteConfWord(
714 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
715 (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
716
717 c = 0;
718 for(;;) {
719 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
720 AT91C_BASE_SSC->SSC_THR = 0x43;
721 }
722 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
723 int8_t b;
724 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
725
726 dest[c++] = (uint8_t)b;
727
728 if(c >= n) {
729 break;
730 }
731 }
732 }
733 }*/
734
735 //-----------------------------------------------------------------------------
736 // Transmit the command (to the tag) that was placed in ToSend[].
737 //-----------------------------------------------------------------------------
738 static void TransmitFor14443(void)
739 {
740 int c;
741
742 FpgaSetupSsc();
743
744 while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
745 AT91C_BASE_SSC->SSC_THR = 0xff;
746 }
747
748 // Signal field is ON with the appropriate Red LED
749 LED_D_ON();
750 // Signal we are transmitting with the Green LED
751 LED_B_ON();
752 FpgaWriteConfWord(
753 FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
754
755 for(c = 0; c < 10;) {
756 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
757 AT91C_BASE_SSC->SSC_THR = 0xff;
758 c++;
759 }
760 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
761 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
762 (void)r;
763 }
764 WDT_HIT();
765 }
766
767 c = 0;
768 for(;;) {
769 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
770 AT91C_BASE_SSC->SSC_THR = ToSend[c];
771 c++;
772 if(c >= ToSendMax) {
773 break;
774 }
775 }
776 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
777 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
778 (void)r;
779 }
780 WDT_HIT();
781 }
782 LED_B_OFF(); // Finished sending
783 }
784
785 //-----------------------------------------------------------------------------
786 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
787 // so that it is ready to transmit to the tag using TransmitFor14443().
788 //-----------------------------------------------------------------------------
789 void CodeIso14443bAsReader(const uint8_t *cmd, int len)
790 {
791 int i, j;
792 uint8_t b;
793
794 ToSendReset();
795
796 // Establish initial reference level
797 for(i = 0; i < 40; i++) {
798 ToSendStuffBit(1);
799 }
800 // Send SOF
801 for(i = 0; i < 10; i++) {
802 ToSendStuffBit(0);
803 }
804
805 for(i = 0; i < len; i++) {
806 // Stop bits/EGT
807 ToSendStuffBit(1);
808 ToSendStuffBit(1);
809 // Start bit
810 ToSendStuffBit(0);
811 // Data bits
812 b = cmd[i];
813 for(j = 0; j < 8; j++) {
814 if(b & 1) {
815 ToSendStuffBit(1);
816 } else {
817 ToSendStuffBit(0);
818 }
819 b >>= 1;
820 }
821 }
822 // Send EOF
823 ToSendStuffBit(1);
824 for(i = 0; i < 10; i++) {
825 ToSendStuffBit(0);
826 }
827 for(i = 0; i < 8; i++) {
828 ToSendStuffBit(1);
829 }
830
831 // And then a little more, to make sure that the last character makes
832 // it out before we switch to rx mode.
833 for(i = 0; i < 24; i++) {
834 ToSendStuffBit(1);
835 }
836
837 // Convert from last character reference to length
838 ToSendMax++;
839 }
840
841 //-----------------------------------------------------------------------------
842 // Read an ISO 14443 tag. We send it some set of commands, and record the
843 // responses.
844 // The command name is misleading, it actually decodes the reponse in HEX
845 // into the output buffer (read the result using hexsamples, not hisamples)
846 //-----------------------------------------------------------------------------
847 void AcquireRawAdcSamplesIso14443(uint32_t parameter)
848 {
849 uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
850
851 // Make sure that we start from off, since the tags are stateful;
852 // confusing things will happen if we don't reset them between reads.
853 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
854 LED_D_OFF();
855 SpinDelay(200);
856
857 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
858 FpgaSetupSsc();
859
860 // Now give it time to spin up.
861 // Signal field is on with the appropriate LED
862 LED_D_ON();
863 FpgaWriteConfWord(
864 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
865 SpinDelay(200);
866
867 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
868 TransmitFor14443();
869 // LED_A_ON();
870 GetSamplesFor14443Demod(TRUE, 2000, FALSE);
871 // LED_A_OFF();
872 }
873
874 //-----------------------------------------------------------------------------
875 // Read a SRI512 ISO 14443 tag.
876 //
877 // SRI512 tags are just simple memory tags, here we're looking at making a dump
878 // of the contents of the memory. No anticollision algorithm is done, we assume
879 // we have a single tag in the field.
880 //
881 // I tried to be systematic and check every answer of the tag, every CRC, etc...
882 //-----------------------------------------------------------------------------
883 void ReadSRI512Iso14443(uint32_t parameter)
884 {
885 ReadSTMemoryIso14443(parameter,0x0F);
886 }
887 void ReadSRIX4KIso14443(uint32_t parameter)
888 {
889 ReadSTMemoryIso14443(parameter,0x7F);
890 }
891
892 void ReadSTMemoryIso14443(uint32_t parameter,uint32_t dwLast)
893 {
894 uint8_t i = 0x00;
895
896 // Make sure that we start from off, since the tags are stateful;
897 // confusing things will happen if we don't reset them between reads.
898 LED_D_OFF();
899 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
900 SpinDelay(200);
901
902 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
903 FpgaSetupSsc();
904
905 // Now give it time to spin up.
906 // Signal field is on with the appropriate LED
907 LED_D_ON();
908 FpgaWriteConfWord(
909 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
910 SpinDelay(200);
911
912 // First command: wake up the tag using the INITIATE command
913 uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
914 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
915 TransmitFor14443();
916 // LED_A_ON();
917 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
918 // LED_A_OFF();
919
920 if (Demod.len == 0) {
921 DbpString("No response from tag");
922 return;
923 } else {
924 Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",
925 Demod.output[0], Demod.output[1],Demod.output[2]);
926 }
927 // There is a response, SELECT the uid
928 DbpString("Now SELECT tag:");
929 cmd1[0] = 0x0E; // 0x0E is SELECT
930 cmd1[1] = Demod.output[0];
931 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
932 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
933 TransmitFor14443();
934 // LED_A_ON();
935 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
936 // LED_A_OFF();
937 if (Demod.len != 3) {
938 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
939 return;
940 }
941 // Check the CRC of the answer:
942 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
943 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
944 DbpString("CRC Error reading select response.");
945 return;
946 }
947 // Check response from the tag: should be the same UID as the command we just sent:
948 if (cmd1[1] != Demod.output[0]) {
949 Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);
950 return;
951 }
952 // Tag is now selected,
953 // First get the tag's UID:
954 cmd1[0] = 0x0B;
955 ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
956 CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one
957 TransmitFor14443();
958 // LED_A_ON();
959 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
960 // LED_A_OFF();
961 if (Demod.len != 10) {
962 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
963 return;
964 }
965 // The check the CRC of the answer (use cmd1 as temporary variable):
966 ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
967 if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
968 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
969 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
970 // Do not return;, let's go on... (we should retry, maybe ?)
971 }
972 Dbprintf("Tag UID (64 bits): %08x %08x",
973 (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
974 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
975
976 // Now loop to read all 16 blocks, address from 0 to 15
977 DbpString("Tag memory dump, block 0 to 15");
978 cmd1[0] = 0x08;
979 i = 0x00;
980 dwLast++;
981 for (;;) {
982 if (i == dwLast) {
983 DbpString("System area block (0xff):");
984 i = 0xff;
985 }
986 cmd1[1] = i;
987 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
988 CodeIso14443bAsReader(cmd1, sizeof(cmd1));
989 TransmitFor14443();
990 // LED_A_ON();
991 GetSamplesFor14443Demod(TRUE, 2000,TRUE);
992 // LED_A_OFF();
993 if (Demod.len != 6) { // Check if we got an answer from the tag
994 DbpString("Expected 6 bytes from tag, got less...");
995 return;
996 }
997 // The check the CRC of the answer (use cmd1 as temporary variable):
998 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
999 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
1000 Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
1001 (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
1002 // Do not return;, let's go on... (we should retry, maybe ?)
1003 }
1004 // Now print out the memory location:
1005 Dbprintf("Address=%x, Contents=%x, CRC=%x", i,
1006 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1007 (Demod.output[4]<<8)+Demod.output[5]);
1008 if (i == 0xff) {
1009 break;
1010 }
1011 i++;
1012 }
1013 }
1014
1015
1016 //=============================================================================
1017 // Finally, the `sniffer' combines elements from both the reader and
1018 // simulated tag, to show both sides of the conversation.
1019 //=============================================================================
1020
1021 //-----------------------------------------------------------------------------
1022 // Record the sequence of commands sent by the reader to the tag, with
1023 // triggering so that we start recording at the point that the tag is moved
1024 // near the reader.
1025 //-----------------------------------------------------------------------------
1026 /*
1027 * Memory usage for this function, (within BigBuf)
1028 * 0-4095 : Demodulated samples receive (4096 bytes) - DEMOD_TRACE_SIZE
1029 * 4096-6143 : Last Received command, 2048 bytes (reader->tag) - READER_TAG_BUFFER_SIZE
1030 * 6144-8191 : Last Received command, 2048 bytes(tag->reader) - TAG_READER_BUFFER_SIZE
1031 * 8192-9215 : DMA Buffer, 1024 bytes (samples) - DEMOD_DMA_BUFFER_SIZE
1032 */
1033 void RAMFUNC SnoopIso14443(void)
1034 {
1035 // We won't start recording the frames that we acquire until we trigger;
1036 // a good trigger condition to get started is probably when we see a
1037 // response from the tag.
1038 int triggered = TRUE;
1039
1040 // The command (reader -> tag) that we're working on receiving.
1041 uint8_t *receivedCmd = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE;
1042 // The response (tag -> reader) that we're working on receiving.
1043 uint8_t *receivedResponse = (uint8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE;
1044
1045 // As we receive stuff, we copy it from receivedCmd or receivedResponse
1046 // into trace, along with its length and other annotations.
1047 uint8_t *trace = (uint8_t *)BigBuf;
1048 int traceLen = 0;
1049
1050 // The DMA buffer, used to stream samples from the FPGA.
1051 int8_t *dmaBuf = (int8_t *)(BigBuf) + DEMOD_TRACE_SIZE + READER_TAG_BUFFER_SIZE + TAG_READER_BUFFER_SIZE;
1052 int lastRxCounter;
1053 int8_t *upTo;
1054 int ci, cq;
1055 int maxBehindBy = 0;
1056
1057 // Count of samples received so far, so that we can include timing
1058 // information in the trace buffer.
1059 int samples = 0;
1060
1061 // Initialize the trace buffer
1062 memset(trace, 0x44, DEMOD_TRACE_SIZE);
1063
1064 // Set up the demodulator for tag -> reader responses.
1065 Demod.output = receivedResponse;
1066 Demod.len = 0;
1067 Demod.state = DEMOD_UNSYNCD;
1068
1069 // And the reader -> tag commands
1070 memset(&Uart, 0, sizeof(Uart));
1071 Uart.output = receivedCmd;
1072 Uart.byteCntMax = 100;
1073 Uart.state = STATE_UNSYNCD;
1074
1075 // Print some debug information about the buffer sizes
1076 Dbprintf("Snooping buffers initialized:");
1077 Dbprintf(" Trace: %i bytes", DEMOD_TRACE_SIZE);
1078 Dbprintf(" Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);
1079 Dbprintf(" tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);
1080 Dbprintf(" DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);
1081
1082
1083 // And put the FPGA in the appropriate mode
1084 // Signal field is off with the appropriate LED
1085 LED_D_OFF();
1086 FpgaWriteConfWord(
1087 FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
1088 FPGA_HF_READER_RX_XCORR_SNOOP);
1089 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1090
1091 // Setup for the DMA.
1092 FpgaSetupSsc();
1093 upTo = dmaBuf;
1094 lastRxCounter = DEMOD_DMA_BUFFER_SIZE;
1095 FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
1096
1097 LED_A_ON();
1098
1099 // And now we loop, receiving samples.
1100 for(;;) {
1101 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
1102 (DEMOD_DMA_BUFFER_SIZE-1);
1103 if(behindBy > maxBehindBy) {
1104 maxBehindBy = behindBy;
1105 if(behindBy > (DEMOD_DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?
1106 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
1107 goto done;
1108 }
1109 }
1110 if(behindBy < 2) continue;
1111
1112 ci = upTo[0];
1113 cq = upTo[1];
1114 upTo += 2;
1115 lastRxCounter -= 2;
1116 if(upTo - dmaBuf > DEMOD_DMA_BUFFER_SIZE) {
1117 upTo -= DEMOD_DMA_BUFFER_SIZE;
1118 lastRxCounter += DEMOD_DMA_BUFFER_SIZE;
1119 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
1120 AT91C_BASE_PDC_SSC->PDC_RNCR = DEMOD_DMA_BUFFER_SIZE;
1121 }
1122
1123 samples += 2;
1124
1125 #define HANDLE_BIT_IF_BODY \
1126 if(triggered) { \
1127 trace[traceLen++] = ((samples >> 0) & 0xff); \
1128 trace[traceLen++] = ((samples >> 8) & 0xff); \
1129 trace[traceLen++] = ((samples >> 16) & 0xff); \
1130 trace[traceLen++] = ((samples >> 24) & 0xff); \
1131 trace[traceLen++] = 0; \
1132 trace[traceLen++] = 0; \
1133 trace[traceLen++] = 0; \
1134 trace[traceLen++] = 0; \
1135 trace[traceLen++] = Uart.byteCnt; \
1136 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
1137 traceLen += Uart.byteCnt; \
1138 if(traceLen > 1000) break; \
1139 } \
1140 /* And ready to receive another command. */ \
1141 memset(&Uart, 0, sizeof(Uart)); \
1142 Uart.output = receivedCmd; \
1143 Uart.byteCntMax = 100; \
1144 Uart.state = STATE_UNSYNCD; \
1145 /* And also reset the demod code, which might have been */ \
1146 /* false-triggered by the commands from the reader. */ \
1147 memset(&Demod, 0, sizeof(Demod)); \
1148 Demod.output = receivedResponse; \
1149 Demod.state = DEMOD_UNSYNCD; \
1150
1151 if(Handle14443UartBit(ci & 1)) {
1152 HANDLE_BIT_IF_BODY
1153 }
1154 if(Handle14443UartBit(cq & 1)) {
1155 HANDLE_BIT_IF_BODY
1156 }
1157
1158 if(Handle14443SamplesDemod(ci, cq)) {
1159 // timestamp, as a count of samples
1160 trace[traceLen++] = ((samples >> 0) & 0xff);
1161 trace[traceLen++] = ((samples >> 8) & 0xff);
1162 trace[traceLen++] = ((samples >> 16) & 0xff);
1163 trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);
1164 // correlation metric (~signal strength estimate)
1165 if(Demod.metricN != 0) {
1166 Demod.metric /= Demod.metricN;
1167 }
1168 trace[traceLen++] = ((Demod.metric >> 0) & 0xff);
1169 trace[traceLen++] = ((Demod.metric >> 8) & 0xff);
1170 trace[traceLen++] = ((Demod.metric >> 16) & 0xff);
1171 trace[traceLen++] = ((Demod.metric >> 24) & 0xff);
1172 // length
1173 trace[traceLen++] = Demod.len;
1174 memcpy(trace+traceLen, receivedResponse, Demod.len);
1175 traceLen += Demod.len;
1176 if(traceLen > DEMOD_TRACE_SIZE) {
1177 DbpString("Reached trace limit");
1178 goto done;
1179 }
1180
1181 triggered = TRUE;
1182 LED_A_OFF();
1183 LED_B_ON();
1184
1185 // And ready to receive another response.
1186 memset(&Demod, 0, sizeof(Demod));
1187 Demod.output = receivedResponse;
1188 Demod.state = DEMOD_UNSYNCD;
1189 }
1190 WDT_HIT();
1191
1192 if(BUTTON_PRESS()) {
1193 DbpString("cancelled");
1194 goto done;
1195 }
1196 }
1197
1198 done:
1199 LED_A_OFF();
1200 LED_B_OFF();
1201 LED_C_OFF();
1202 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
1203 DbpString("Snoop statistics:");
1204 Dbprintf(" Max behind by: %i", maxBehindBy);
1205 Dbprintf(" Uart State: %x", Uart.state);
1206 Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);
1207 Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);
1208 Dbprintf(" Trace length: %i", traceLen);
1209 }
Proxmark3 GIT tracking
Impressum, Datenschutz