]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443b.c
projects / proxmark3-svn / blob
? search:


80f93678fb7840fae0927cefe943f8363e066cd7
[proxmark3-svn] / armsrc / iso14443b.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Routines to support ISO 14443B. This includes both the reader software and
9 // the `fake tag' modes.
10 //-----------------------------------------------------------------------------
11
12 #include "proxmark3.h"
13 #include "apps.h"
14 #include "util.h"
15 #include "string.h"
16
17 #include "iso14443crc.h"
18
19 #define RECEIVE_SAMPLES_TIMEOUT 2000
20
21 //=============================================================================
22 // An ISO 14443 Type B tag. We listen for commands from the reader, using
23 // a UART kind of thing that's implemented in software. When we get a
24 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
25 // If it's good, then we can do something appropriate with it, and send
26 // a response.
27 //=============================================================================
28
29 //-----------------------------------------------------------------------------
30 // Code up a string of octets at layer 2 (including CRC, we don't generate
31 // that here) so that they can be transmitted to the reader. Doesn't transmit
32 // them yet, just leaves them ready to send in ToSend[].
33 //-----------------------------------------------------------------------------
34 static void CodeIso14443bAsTag(const uint8_t *cmd, int len)
35 {
36 int i;
37
38 ToSendReset();
39
40 // Transmit a burst of ones, as the initial thing that lets the
41 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
42 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
43 // so I will too.
44 for(i = 0; i < 20; i++) {
45 ToSendStuffBit(1);
46 ToSendStuffBit(1);
47 ToSendStuffBit(1);
48 ToSendStuffBit(1);
49 }
50
51 // Send SOF.
52 for(i = 0; i < 10; i++) {
53 ToSendStuffBit(0);
54 ToSendStuffBit(0);
55 ToSendStuffBit(0);
56 ToSendStuffBit(0);
57 }
58 for(i = 0; i < 2; i++) {
59 ToSendStuffBit(1);
60 ToSendStuffBit(1);
61 ToSendStuffBit(1);
62 ToSendStuffBit(1);
63 }
64
65 for(i = 0; i < len; i++) {
66 int j;
67 uint8_t b = cmd[i];
68
69 // Start bit
70 ToSendStuffBit(0);
71 ToSendStuffBit(0);
72 ToSendStuffBit(0);
73 ToSendStuffBit(0);
74
75 // Data bits
76 for(j = 0; j < 8; j++) {
77 if(b & 1) {
78 ToSendStuffBit(1);
79 ToSendStuffBit(1);
80 ToSendStuffBit(1);
81 ToSendStuffBit(1);
82 } else {
83 ToSendStuffBit(0);
84 ToSendStuffBit(0);
85 ToSendStuffBit(0);
86 ToSendStuffBit(0);
87 }
88 b >>= 1;
89 }
90
91 // Stop bit
92 ToSendStuffBit(1);
93 ToSendStuffBit(1);
94 ToSendStuffBit(1);
95 ToSendStuffBit(1);
96 }
97
98 // Send EOF.
99 for(i = 0; i < 10; i++) {
100 ToSendStuffBit(0);
101 ToSendStuffBit(0);
102 ToSendStuffBit(0);
103 ToSendStuffBit(0);
104 }
105 for(i = 0; i < 2; i++) {
106 ToSendStuffBit(1);
107 ToSendStuffBit(1);
108 ToSendStuffBit(1);
109 ToSendStuffBit(1);
110 }
111
112 // Convert from last byte pos to length
113 ToSendMax++;
114 }
115
116 //-----------------------------------------------------------------------------
117 // The software UART that receives commands from the reader, and its state
118 // variables.
119 //-----------------------------------------------------------------------------
120 static struct {
121 enum {
122 STATE_UNSYNCD,
123 STATE_GOT_FALLING_EDGE_OF_SOF,
124 STATE_AWAITING_START_BIT,
125 STATE_RECEIVING_DATA,
126 STATE_ERROR_WAIT
127 } state;
128 uint16_t shiftReg;
129 int bitCnt;
130 int byteCnt;
131 int byteCntMax;
132 int posCnt;
133 uint8_t *output;
134 } Uart;
135
136 /* Receive & handle a bit coming from the reader.
137 *
138 * This function is called 4 times per bit (every 2 subcarrier cycles).
139 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
140 *
141 * LED handling:
142 * LED A -> ON once we have received the SOF and are expecting the rest.
143 * LED A -> OFF once we have received EOF or are in error state or unsynced
144 *
145 * Returns: true if we received a EOF
146 * false if we are still waiting for some more
147 */
148 static int Handle14443bUartBit(int bit)
149 {
150 switch(Uart.state) {
151 case STATE_UNSYNCD:
152 if(!bit) {
153 // we went low, so this could be the beginning
154 // of an SOF
155 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
156 Uart.posCnt = 0;
157 Uart.bitCnt = 0;
158 }
159 break;
160
161 case STATE_GOT_FALLING_EDGE_OF_SOF:
162 Uart.posCnt++;
163 if(Uart.posCnt == 2) { // sample every 4 1/fs in the middle of a bit
164 if(bit) {
165 if(Uart.bitCnt > 9) {
166 // we've seen enough consecutive
167 // zeros that it's a valid SOF
168 Uart.posCnt = 0;
169 Uart.byteCnt = 0;
170 Uart.state = STATE_AWAITING_START_BIT;
171 LED_A_ON(); // Indicate we got a valid SOF
172 } else {
173 // didn't stay down long enough
174 // before going high, error
175 Uart.state = STATE_ERROR_WAIT;
176 }
177 } else {
178 // do nothing, keep waiting
179 }
180 Uart.bitCnt++;
181 }
182 if(Uart.posCnt >= 4) Uart.posCnt = 0;
183 if(Uart.bitCnt > 12) {
184 // Give up if we see too many zeros without
185 // a one, too.
186 Uart.state = STATE_ERROR_WAIT;
187 }
188 break;
189
190 case STATE_AWAITING_START_BIT:
191 Uart.posCnt++;
192 if(bit) {
193 if(Uart.posCnt > 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
194 // stayed high for too long between
195 // characters, error
196 Uart.state = STATE_ERROR_WAIT;
197 }
198 } else {
199 // falling edge, this starts the data byte
200 Uart.posCnt = 0;
201 Uart.bitCnt = 0;
202 Uart.shiftReg = 0;
203 Uart.state = STATE_RECEIVING_DATA;
204 }
205 break;
206
207 case STATE_RECEIVING_DATA:
208 Uart.posCnt++;
209 if(Uart.posCnt == 2) {
210 // time to sample a bit
211 Uart.shiftReg >>= 1;
212 if(bit) {
213 Uart.shiftReg |= 0x200;
214 }
215 Uart.bitCnt++;
216 }
217 if(Uart.posCnt >= 4) {
218 Uart.posCnt = 0;
219 }
220 if(Uart.bitCnt == 10) {
221 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
222 {
223 // this is a data byte, with correct
224 // start and stop bits
225 Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
226 Uart.byteCnt++;
227
228 if(Uart.byteCnt >= Uart.byteCntMax) {
229 // Buffer overflowed, give up
230 Uart.posCnt = 0;
231 Uart.state = STATE_ERROR_WAIT;
232 } else {
233 // so get the next byte now
234 Uart.posCnt = 0;
235 Uart.state = STATE_AWAITING_START_BIT;
236 }
237 } else if(Uart.shiftReg == 0x000) {
238 // this is an EOF byte
239 LED_A_OFF(); // Finished receiving
240 if (Uart.byteCnt != 0) {
241 return TRUE;
242 }
243 Uart.posCnt = 0;
244 Uart.state = STATE_ERROR_WAIT;
245 } else {
246 // this is an error
247 Uart.posCnt = 0;
248 Uart.state = STATE_ERROR_WAIT;
249 }
250 }
251 break;
252
253 case STATE_ERROR_WAIT:
254 // We're all screwed up, so wait a little while
255 // for whatever went wrong to finish, and then
256 // start over.
257 Uart.posCnt++;
258 if(Uart.posCnt > 10) {
259 Uart.state = STATE_UNSYNCD;
260 LED_A_OFF();
261 }
262 break;
263
264 default:
265 Uart.state = STATE_UNSYNCD;
266 break;
267 }
268
269 return FALSE;
270 }
271
272 //-----------------------------------------------------------------------------
273 // Receive a command (from the reader to us, where we are the simulated tag),
274 // and store it in the given buffer, up to the given maximum length. Keeps
275 // spinning, waiting for a well-framed command, until either we get one
276 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
277 //
278 // Assume that we're called with the SSC (to the FPGA) and ADC path set
279 // correctly.
280 //-----------------------------------------------------------------------------
281 static int GetIso14443bCommandFromReader(uint8_t *received, int *len, int maxLen)
282 {
283 uint8_t mask;
284 int i, bit;
285
286 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
287 // only, since we are receiving, not transmitting).
288 // Signal field is off with the appropriate LED
289 LED_D_OFF();
290 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
291
292
293 // Now run a `software UART' on the stream of incoming samples.
294 Uart.output = received;
295 Uart.byteCntMax = maxLen;
296 Uart.state = STATE_UNSYNCD;
297
298 for(;;) {
299 WDT_HIT();
300
301 if(BUTTON_PRESS()) return FALSE;
302
303 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
304 AT91C_BASE_SSC->SSC_THR = 0x00;
305 }
306 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
307 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
308
309 mask = 0x80;
310 for(i = 0; i < 8; i++, mask >>= 1) {
311 bit = (b & mask);
312 if(Handle14443bUartBit(bit)) {
313 *len = Uart.byteCnt;
314 return TRUE;
315 }
316 }
317 }
318 }
319 }
320
321 //-----------------------------------------------------------------------------
322 // Main loop of simulated tag: receive commands from reader, decide what
323 // response to send, and send it.
324 //-----------------------------------------------------------------------------
325 void SimulateIso14443bTag(void)
326 {
327 // the only command we understand is REQB, AFI=0, Select All, N=0:
328 static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
329 // ... and we respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
330 // supports only 106kBit/s in both directions, max frame size = 32Bytes,
331 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
332 static const uint8_t response1[] = {
333 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
334 0x00, 0x21, 0x85, 0x5e, 0xd7
335 };
336
337 uint8_t *resp;
338 int respLen;
339
340 // allocate command receive buffer
341 BigBuf_free();
342 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
343 int len;
344
345 int i;
346
347 int cmdsRecvd = 0;
348
349 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
350
351 // prepare the (only one) tag answer:
352 CodeIso14443bAsTag(response1, sizeof(response1));
353 uint8_t *resp1 = BigBuf_malloc(ToSendMax);
354 memcpy(resp1, ToSend, ToSendMax);
355 uint16_t resp1Len = ToSendMax;
356
357 // We need to listen to the high-frequency, peak-detected path.
358 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
359 FpgaSetupSsc();
360
361 cmdsRecvd = 0;
362
363 for(;;) {
364 uint8_t b1, b2;
365
366 if(!GetIso14443bCommandFromReader(receivedCmd, &len, 100)) {
367 Dbprintf("button pressed, received %d commands", cmdsRecvd);
368 break;
369 }
370
371 // Good, look at the command now.
372
373 if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len) == 0) {
374 resp = resp1; respLen = resp1Len;
375 } else {
376 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
377 // And print whether the CRC fails, just for good measure
378 ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
379 if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
380 // Not so good, try again.
381 DbpString("+++CRC fail");
382 } else {
383 DbpString("CRC passes");
384 }
385 break;
386 }
387
388 cmdsRecvd++;
389
390 if(cmdsRecvd > 0x30) {
391 DbpString("many commands later...");
392 break;
393 }
394
395 if(respLen <= 0) continue;
396
397 // Modulate BPSK
398 // Signal field is off with the appropriate LED
399 LED_D_OFF();
400 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
401 AT91C_BASE_SSC->SSC_THR = 0xff;
402 FpgaSetupSsc();
403
404 // Transmit the response.
405 i = 0;
406 for(;;) {
407 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
408 uint8_t b = resp[i];
409
410 AT91C_BASE_SSC->SSC_THR = b;
411
412 i++;
413 if(i > respLen) {
414 break;
415 }
416 }
417 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
418 volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
419 (void)b;
420 }
421 }
422 }
423 }
424
425 //=============================================================================
426 // An ISO 14443 Type B reader. We take layer two commands, code them
427 // appropriately, and then send them to the tag. We then listen for the
428 // tag's response, which we leave in the buffer to be demodulated on the
429 // PC side.
430 //=============================================================================
431
432 static struct {
433 enum {
434 DEMOD_UNSYNCD,
435 DEMOD_PHASE_REF_TRAINING,
436 DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
437 DEMOD_GOT_FALLING_EDGE_OF_SOF,
438 DEMOD_AWAITING_START_BIT,
439 DEMOD_RECEIVING_DATA,
440 DEMOD_ERROR_WAIT
441 } state;
442 int bitCount;
443 int posCount;
444 int thisBit;
445 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
446 int metric;
447 int metricN;
448 */
449 uint16_t shiftReg;
450 uint8_t *output;
451 int len;
452 int sumI;
453 int sumQ;
454 } Demod;
455
456 /*
457 * Handles reception of a bit from the tag
458 *
459 * This function is called 2 times per bit (every 4 subcarrier cycles).
460 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
461 *
462 * LED handling:
463 * LED C -> ON once we have received the SOF and are expecting the rest.
464 * LED C -> OFF once we have received EOF or are unsynced
465 *
466 * Returns: true if we received a EOF
467 * false if we are still waiting for some more
468 *
469 */
470 static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
471 {
472 int v;
473
474 // The soft decision on the bit uses an estimate of just the
475 // quadrant of the reference angle, not the exact angle.
476 #define MAKE_SOFT_DECISION() { \
477 if(Demod.sumI > 0) { \
478 v = ci; \
479 } else { \
480 v = -ci; \
481 } \
482 if(Demod.sumQ > 0) { \
483 v += cq; \
484 } else { \
485 v -= cq; \
486 } \
487 }
488
489 #define SUBCARRIER_DETECT_THRESHOLD 8
490
491 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq)
492 /* #define CHECK_FOR_SUBCARRIER() { \
493 v = ci; \
494 if(v < 0) v = -v; \
495 if(cq > 0) { \
496 v += cq; \
497 } else { \
498 v -= cq; \
499 } \
500 }
501 */
502 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
503 #define CHECK_FOR_SUBCARRIER() { \
504 if(ci < 0) { \
505 if(cq < 0) { /* ci < 0, cq < 0 */ \
506 if (cq < ci) { \
507 v = -cq - (ci >> 1); \
508 } else { \
509 v = -ci - (cq >> 1); \
510 } \
511 } else { /* ci < 0, cq >= 0 */ \
512 if (cq < -ci) { \
513 v = -ci + (cq >> 1); \
514 } else { \
515 v = cq - (ci >> 1); \
516 } \
517 } \
518 } else { \
519 if(cq < 0) { /* ci >= 0, cq < 0 */ \
520 if (-cq < ci) { \
521 v = ci - (cq >> 1); \
522 } else { \
523 v = -cq + (ci >> 1); \
524 } \
525 } else { /* ci >= 0, cq >= 0 */ \
526 if (cq < ci) { \
527 v = ci + (cq >> 1); \
528 } else { \
529 v = cq + (ci >> 1); \
530 } \
531 } \
532 } \
533 }
534
535 switch(Demod.state) {
536 case DEMOD_UNSYNCD:
537 CHECK_FOR_SUBCARRIER();
538 if(v > SUBCARRIER_DETECT_THRESHOLD) { // subcarrier detected
539 Demod.state = DEMOD_PHASE_REF_TRAINING;
540 Demod.sumI = ci;
541 Demod.sumQ = cq;
542 Demod.posCount = 1;
543 }
544 break;
545
546 case DEMOD_PHASE_REF_TRAINING:
547 if(Demod.posCount < 8) {
548 CHECK_FOR_SUBCARRIER();
549 if (v > SUBCARRIER_DETECT_THRESHOLD) {
550 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
551 // note: synchronization time > 80 1/fs
552 Demod.sumI += ci;
553 Demod.sumQ += cq;
554 Demod.posCount++;
555 } else { // subcarrier lost
556 Demod.state = DEMOD_UNSYNCD;
557 }
558 } else {
559 Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
560 }
561 break;
562
563 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
564 MAKE_SOFT_DECISION();
565 if(v < 0) { // logic '0' detected
566 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
567 Demod.posCount = 0; // start of SOF sequence
568 } else {
569 if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs
570 Demod.state = DEMOD_UNSYNCD;
571 }
572 }
573 Demod.posCount++;
574 break;
575
576 case DEMOD_GOT_FALLING_EDGE_OF_SOF:
577 Demod.posCount++;
578 MAKE_SOFT_DECISION();
579 if(v > 0) {
580 if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
581 Demod.state = DEMOD_UNSYNCD;
582 } else {
583 LED_C_ON(); // Got SOF
584 Demod.state = DEMOD_AWAITING_START_BIT;
585 Demod.posCount = 0;
586 Demod.len = 0;
587 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
588 Demod.metricN = 0;
589 Demod.metric = 0;
590 */
591 }
592 } else {
593 if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu)
594 Demod.state = DEMOD_UNSYNCD;
595 LED_C_OFF();
596 }
597 }
598 break;
599
600 case DEMOD_AWAITING_START_BIT:
601 Demod.posCount++;
602 MAKE_SOFT_DECISION();
603 if(v > 0) {
604 if(Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
605 Demod.state = DEMOD_UNSYNCD;
606 LED_C_OFF();
607 }
608 } else { // start bit detected
609 Demod.bitCount = 0;
610 Demod.posCount = 1; // this was the first half
611 Demod.thisBit = v;
612 Demod.shiftReg = 0;
613 Demod.state = DEMOD_RECEIVING_DATA;
614 }
615 break;
616
617 case DEMOD_RECEIVING_DATA:
618 MAKE_SOFT_DECISION();
619 if(Demod.posCount == 0) { // first half of bit
620 Demod.thisBit = v;
621 Demod.posCount = 1;
622 } else { // second half of bit
623 Demod.thisBit += v;
624
625 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
626 if(Demod.thisBit > 0) {
627 Demod.metric += Demod.thisBit;
628 } else {
629 Demod.metric -= Demod.thisBit;
630 }
631 (Demod.metricN)++;
632 */
633
634 Demod.shiftReg >>= 1;
635 if(Demod.thisBit > 0) { // logic '1'
636 Demod.shiftReg |= 0x200;
637 }
638
639 Demod.bitCount++;
640 if(Demod.bitCount == 10) {
641 uint16_t s = Demod.shiftReg;
642 if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'
643 uint8_t b = (s >> 1);
644 Demod.output[Demod.len] = b;
645 Demod.len++;
646 Demod.state = DEMOD_AWAITING_START_BIT;
647 } else {
648 Demod.state = DEMOD_UNSYNCD;
649 LED_C_OFF();
650 if(s == 0x000) {
651 // This is EOF (start, stop and all data bits == '0'
652 return TRUE;
653 }
654 }
655 }
656 Demod.posCount = 0;
657 }
658 break;
659
660 default:
661 Demod.state = DEMOD_UNSYNCD;
662 LED_C_OFF();
663 break;
664 }
665
666 return FALSE;
667 }
668
669
670 static void DemodReset()
671 {
672 // Clear out the state of the "UART" that receives from the tag.
673 Demod.len = 0;
674 Demod.state = DEMOD_UNSYNCD;
675 Demod.posCount = 0;
676 memset(Demod.output, 0x00, MAX_FRAME_SIZE);
677 }
678
679
680 static void DemodInit(uint8_t *data)
681 {
682 Demod.output = data;
683 DemodReset();
684 }
685
686
687 static void UartReset()
688 {
689 Uart.byteCntMax = MAX_FRAME_SIZE;
690 Uart.state = STATE_UNSYNCD;
691 Uart.byteCnt = 0;
692 Uart.bitCnt = 0;
693 }
694
695
696 static void UartInit(uint8_t *data)
697 {
698 Uart.output = data;
699 UartReset();
700 }
701
702
703 /*
704 * Demodulate the samples we received from the tag, also log to tracebuffer
705 * quiet: set to 'TRUE' to disable debug output
706 */
707 static void GetSamplesFor14443bDemod(int n, bool quiet)
708 {
709 int max = 0;
710 bool gotFrame = FALSE;
711 int lastRxCounter, ci, cq, samples = 0;
712
713 // Allocate memory from BigBuf for some buffers
714 // free all previous allocations first
715 BigBuf_free();
716
717 // The response (tag -> reader) that we're receiving.
718 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
719
720 // The DMA buffer, used to stream samples from the FPGA
721 int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
722
723 // Set up the demodulator for tag -> reader responses.
724 DemodInit(receivedResponse);
725
726 // Setup and start DMA.
727 FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
728
729 int8_t *upTo = dmaBuf;
730 lastRxCounter = DMA_BUFFER_SIZE;
731
732 // Signal field is ON with the appropriate LED:
733 LED_D_ON();
734 // And put the FPGA in the appropriate mode
735 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
736
737 for(;;) {
738 int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
739 if(behindBy > max) max = behindBy;
740
741 while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1)) > 2) {
742 ci = upTo[0];
743 cq = upTo[1];
744 upTo += 2;
745 if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
746 upTo = dmaBuf;
747 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
748 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
749 }
750 lastRxCounter -= 2;
751 if(lastRxCounter <= 0) {
752 lastRxCounter += DMA_BUFFER_SIZE;
753 }
754
755 samples += 2;
756
757 if(Handle14443bSamplesDemod(ci, cq)) {
758 gotFrame = TRUE;
759 break;
760 }
761 }
762
763 if(samples > n || gotFrame) {
764 break;
765 }
766 }
767
768 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
769
770 if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", max, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
771 //Tracing
772 if (tracing && Demod.len > 0) {
773 uint8_t parity[MAX_PARITY_SIZE];
774 //GetParity(Demod.output, Demod.len, parity);
775 LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
776 }
777 }
778
779
780 //-----------------------------------------------------------------------------
781 // Transmit the command (to the tag) that was placed in ToSend[].
782 //-----------------------------------------------------------------------------
783 static void TransmitFor14443b(void)
784 {
785 int c;
786
787 FpgaSetupSsc();
788
789 while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
790 AT91C_BASE_SSC->SSC_THR = 0xff;
791 }
792
793 // Signal field is ON with the appropriate Red LED
794 LED_D_ON();
795 // Signal we are transmitting with the Green LED
796 LED_B_ON();
797 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
798
799 for(c = 0; c < 10;) {
800 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
801 AT91C_BASE_SSC->SSC_THR = 0xff;
802 c++;
803 }
804 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
805 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
806 (void)r;
807 }
808 WDT_HIT();
809 }
810
811 c = 0;
812 for(;;) {
813 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
814 AT91C_BASE_SSC->SSC_THR = ToSend[c];
815 c++;
816 if(c >= ToSendMax) {
817 break;
818 }
819 }
820 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
821 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
822 (void)r;
823 }
824 WDT_HIT();
825 }
826 LED_B_OFF(); // Finished sending
827 }
828
829
830 //-----------------------------------------------------------------------------
831 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
832 // so that it is ready to transmit to the tag using TransmitFor14443b().
833 //-----------------------------------------------------------------------------
834 static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
835 {
836 int i, j;
837 uint8_t b;
838
839 ToSendReset();
840
841 // Establish initial reference level
842 for(i = 0; i < 40; i++) {
843 ToSendStuffBit(1);
844 }
845 // Send SOF
846 for(i = 0; i < 10; i++) {
847 ToSendStuffBit(0);
848 }
849
850 for(i = 0; i < len; i++) {
851 // Stop bits/EGT
852 ToSendStuffBit(1);
853 ToSendStuffBit(1);
854 // Start bit
855 ToSendStuffBit(0);
856 // Data bits
857 b = cmd[i];
858 for(j = 0; j < 8; j++) {
859 if(b & 1) {
860 ToSendStuffBit(1);
861 } else {
862 ToSendStuffBit(0);
863 }
864 b >>= 1;
865 }
866 }
867 // Send EOF
868 ToSendStuffBit(1);
869 for(i = 0; i < 10; i++) {
870 ToSendStuffBit(0);
871 }
872 for(i = 0; i < 8; i++) {
873 ToSendStuffBit(1);
874 }
875
876 // And then a little more, to make sure that the last character makes
877 // it out before we switch to rx mode.
878 for(i = 0; i < 24; i++) {
879 ToSendStuffBit(1);
880 }
881
882 // Convert from last character reference to length
883 ToSendMax++;
884 }
885
886
887 /**
888 Convenience function to encode, transmit and trace iso 14443b comms
889 **/
890 static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
891 {
892 CodeIso14443bAsReader(cmd, len);
893 TransmitFor14443b();
894 if (tracing) {
895 uint8_t parity[MAX_PARITY_SIZE];
896 GetParity(cmd, len, parity);
897 LogTrace(cmd,len, 0, 0, parity, TRUE);
898 }
899 }
900
901
902 //-----------------------------------------------------------------------------
903 // Read a SRI512 ISO 14443B tag.
904 //
905 // SRI512 tags are just simple memory tags, here we're looking at making a dump
906 // of the contents of the memory. No anticollision algorithm is done, we assume
907 // we have a single tag in the field.
908 //
909 // I tried to be systematic and check every answer of the tag, every CRC, etc...
910 //-----------------------------------------------------------------------------
911 void ReadSTMemoryIso14443b(uint32_t dwLast)
912 {
913 clear_trace();
914 set_tracing(TRUE);
915
916 uint8_t i = 0x00;
917
918 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
919 // Make sure that we start from off, since the tags are stateful;
920 // confusing things will happen if we don't reset them between reads.
921 LED_D_OFF();
922 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
923 SpinDelay(200);
924
925 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
926 FpgaSetupSsc();
927
928 // Now give it time to spin up.
929 // Signal field is on with the appropriate LED
930 LED_D_ON();
931 FpgaWriteConfWord(
932 FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
933 SpinDelay(200);
934
935 // First command: wake up the tag using the INITIATE command
936 uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
937
938 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
939 // LED_A_ON();
940 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
941 // LED_A_OFF();
942
943 if (Demod.len == 0) {
944 DbpString("No response from tag");
945 return;
946 } else {
947 Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %02x %02x %02x",
948 Demod.output[0], Demod.output[1], Demod.output[2]);
949 }
950 // There is a response, SELECT the uid
951 DbpString("Now SELECT tag:");
952 cmd1[0] = 0x0E; // 0x0E is SELECT
953 cmd1[1] = Demod.output[0];
954 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
955 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
956
957 // LED_A_ON();
958 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
959 // LED_A_OFF();
960 if (Demod.len != 3) {
961 Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
962 return;
963 }
964 // Check the CRC of the answer:
965 ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
966 if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
967 DbpString("CRC Error reading select response.");
968 return;
969 }
970 // Check response from the tag: should be the same UID as the command we just sent:
971 if (cmd1[1] != Demod.output[0]) {
972 Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
973 return;
974 }
975 // Tag is now selected,
976 // First get the tag's UID:
977 cmd1[0] = 0x0B;
978 ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
979 CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
980
981 // LED_A_ON();
982 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
983 // LED_A_OFF();
984 if (Demod.len != 10) {
985 Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
986 return;
987 }
988 // The check the CRC of the answer (use cmd1 as temporary variable):
989 ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
990 if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
991 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
992 (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
993 // Do not return;, let's go on... (we should retry, maybe ?)
994 }
995 Dbprintf("Tag UID (64 bits): %08x %08x",
996 (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
997 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
998
999 // Now loop to read all 16 blocks, address from 0 to last block
1000 Dbprintf("Tag memory dump, block 0 to %d", dwLast);
1001 cmd1[0] = 0x08;
1002 i = 0x00;
1003 dwLast++;
1004 for (;;) {
1005 if (i == dwLast) {
1006 DbpString("System area block (0xff):");
1007 i = 0xff;
1008 }
1009 cmd1[1] = i;
1010 ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
1011 CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
1012
1013 // LED_A_ON();
1014 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
1015 // LED_A_OFF();
1016 if (Demod.len != 6) { // Check if we got an answer from the tag
1017 DbpString("Expected 6 bytes from tag, got less...");
1018 return;
1019 }
1020 // The check the CRC of the answer (use cmd1 as temporary variable):
1021 ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
1022 if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
1023 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1024 (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
1025 // Do not return;, let's go on... (we should retry, maybe ?)
1026 }
1027 // Now print out the memory location:
1028 Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
1029 (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
1030 (Demod.output[4]<<8)+Demod.output[5]);
1031 if (i == 0xff) {
1032 break;
1033 }
1034 i++;
1035 }
1036 }
1037
1038
1039 //=============================================================================
1040 // Finally, the `sniffer' combines elements from both the reader and
1041 // simulated tag, to show both sides of the conversation.
1042 //=============================================================================
1043
1044 //-----------------------------------------------------------------------------
1045 // Record the sequence of commands sent by the reader to the tag, with
1046 // triggering so that we start recording at the point that the tag is moved
1047 // near the reader.
1048 //-----------------------------------------------------------------------------
1049 /*
1050 * Memory usage for this function, (within BigBuf)
1051 * Last Received command (reader->tag) - MAX_FRAME_SIZE
1052 * Last Received command (tag->reader) - MAX_FRAME_SIZE
1053 * DMA Buffer - DMA_BUFFER_SIZE
1054 * Demodulated samples received - all the rest
1055 */
1056 void RAMFUNC SnoopIso14443b(void)
1057 {
1058 // We won't start recording the frames that we acquire until we trigger;
1059 // a good trigger condition to get started is probably when we see a
1060 // response from the tag.
1061 int triggered = TRUE; // TODO: set and evaluate trigger condition
1062
1063 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1064 BigBuf_free();
1065
1066 clear_trace();
1067 set_tracing(TRUE);
1068
1069 // The DMA buffer, used to stream samples from the FPGA
1070 int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
1071 int lastRxCounter;
1072 int8_t *upTo;
1073 int ci, cq;
1074 int maxBehindBy = 0;
1075
1076 // Count of samples received so far, so that we can include timing
1077 // information in the trace buffer.
1078 int samples = 0;
1079
1080 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE));
1081 UartInit(BigBuf_malloc(MAX_FRAME_SIZE));
1082
1083 // Print some debug information about the buffer sizes
1084 Dbprintf("Snooping buffers initialized:");
1085 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1086 Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
1087 Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
1088 Dbprintf(" DMA: %i bytes", DMA_BUFFER_SIZE);
1089
1090 // Signal field is off, no reader signal, no tag signal
1091 LEDsoff();
1092
1093 // And put the FPGA in the appropriate mode
1094 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_SNOOP);
1095 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1096
1097 // Setup for the DMA.
1098 FpgaSetupSsc();
1099 upTo = dmaBuf;
1100 lastRxCounter = DMA_BUFFER_SIZE;
1101 FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
1102 uint8_t parity[MAX_PARITY_SIZE];
1103
1104 bool TagIsActive = FALSE;
1105 bool ReaderIsActive = FALSE;
1106
1107 // And now we loop, receiving samples.
1108 for(;;) {
1109 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
1110 (DMA_BUFFER_SIZE-1);
1111 if(behindBy > maxBehindBy) {
1112 maxBehindBy = behindBy;
1113 }
1114
1115 if(behindBy < 2) continue;
1116
1117 ci = upTo[0];
1118 cq = upTo[1];
1119 upTo += 2;
1120 lastRxCounter -= 2;
1121 if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
1122 upTo = dmaBuf;
1123 lastRxCounter += DMA_BUFFER_SIZE;
1124 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
1125 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
1126 WDT_HIT();
1127 if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
1128 Dbprintf("blew circular buffer! behindBy=%d", behindBy);
1129 break;
1130 }
1131 if(!tracing) {
1132 DbpString("Reached trace limit");
1133 break;
1134 }
1135 if(BUTTON_PRESS()) {
1136 DbpString("cancelled");
1137 break;
1138 }
1139 }
1140
1141 samples += 2;
1142
1143 if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
1144 if(Handle14443bUartBit(ci & 0x01)) {
1145 if(triggered && tracing) {
1146 //GetParity(Uart.output, Uart.byteCnt, parity);
1147 LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
1148 }
1149 /* And ready to receive another command. */
1150 UartReset();
1151 /* And also reset the demod code, which might have been */
1152 /* false-triggered by the commands from the reader. */
1153 DemodReset();
1154 }
1155 if(Handle14443bUartBit(cq & 0x01)) {
1156 if(triggered && tracing) {
1157 //GetParity(Uart.output, Uart.byteCnt, parity);
1158 LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
1159 }
1160 /* And ready to receive another command. */
1161 UartReset();
1162 /* And also reset the demod code, which might have been */
1163 /* false-triggered by the commands from the reader. */
1164 DemodReset();
1165 }
1166 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
1167 }
1168
1169 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
1170 if(Handle14443bSamplesDemod(ci & 0xFE, cq & 0xFE)) {
1171
1172 //Use samples as a time measurement
1173 if(tracing)
1174 {
1175 uint8_t parity[MAX_PARITY_SIZE];
1176 //GetParity(Demod.output, Demod.len, parity);
1177 LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE);
1178 }
1179 triggered = TRUE;
1180
1181 // And ready to receive another response.
1182 DemodReset();
1183 }
1184 TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF);
1185 }
1186
1187 }
1188
1189 FpgaDisableSscDma();
1190 LEDsoff();
1191 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
1192 DbpString("Snoop statistics:");
1193 Dbprintf(" Max behind by: %i", maxBehindBy);
1194 Dbprintf(" Uart State: %x", Uart.state);
1195 Dbprintf(" Uart ByteCnt: %i", Uart.byteCnt);
1196 Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);
1197 Dbprintf(" Trace length: %i", BigBuf_get_traceLen());
1198 }
1199
1200
1201 /*
1202 * Send raw command to tag ISO14443B
1203 * @Input
1204 * datalen len of buffer data
1205 * recv bool when true wait for data from tag and send to client
1206 * powerfield bool leave the field on when true
1207 * data buffer with byte to send
1208 *
1209 * @Output
1210 * none
1211 *
1212 */
1213 void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, uint8_t data[])
1214 {
1215 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1216 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1217 FpgaSetupSsc();
1218
1219 set_tracing(TRUE);
1220
1221 /* if(!powerfield) {
1222 // Make sure that we start from off, since the tags are stateful;
1223 // confusing things will happen if we don't reset them between reads.
1224 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1225 LED_D_OFF();
1226 SpinDelay(200);
1227 }
1228 */
1229
1230 // if(!GETBIT(GPIO_LED_D)) { // if field is off
1231 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
1232 // // Signal field is on with the appropriate LED
1233 // LED_D_ON();
1234 // SpinDelay(200);
1235 // }
1236
1237 CodeAndTransmit14443bAsReader(data, datalen);
1238
1239 if(recv) {
1240 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
1241 uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
1242 cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
1243 }
1244
1245 if(!powerfield) {
1246 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1247 LED_D_OFF();
1248 }
1249 }
1250
Proxmark3 GIT tracking
Impressum, Datenschutz