cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443.c

   1 //-----------------------------------------------------------------------------
   2 // Routines to support ISO 14443. This includes both the reader software and
   3 // the `fake tag' modes. At the moment only the Type B modulation is
   4 // supported.
   5 // Jonathan Westhues, split Nov 2006
   6 //-----------------------------------------------------------------------------
   7 #include <proxmark3.h>
   8 #include "apps.h"
   9 #include "../common/iso14443_crc.c"
  10
  11
  12 //static void GetSamplesFor14443(BOOL weTx, int n);
  13
  14 #define DMA_BUFFER_SIZE 256
  15
  16 //=============================================================================
  17 // An ISO 14443 Type B tag. We listen for commands from the reader, using
  18 // a UART kind of thing that's implemented in software. When we get a
  19 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
  20 // If it's good, then we can do something appropriate with it, and send
  21 // a response.
  22 //=============================================================================
  23
  24 //-----------------------------------------------------------------------------
  25 // Code up a string of octets at layer 2 (including CRC, we don't generate
  26 // that here) so that they can be transmitted to the reader. Doesn't transmit
  27 // them yet, just leaves them ready to send in ToSend[].
  28 //-----------------------------------------------------------------------------
  29 static void CodeIso14443bAsTag(const BYTE *cmd, int len)
  30 {
  31     int i;
  32
  33     ToSendReset();
  34
  35     // Transmit a burst of ones, as the initial thing that lets the
  36     // reader get phase sync. This (TR1) must be > 80/fs, per spec,
  37     // but tag that I've tried (a Paypass) exceeds that by a fair bit,
  38     // so I will too.
  39     for(i = 0; i < 20; i++) {
  40         ToSendStuffBit(1);
  41         ToSendStuffBit(1);
  42         ToSendStuffBit(1);
  43         ToSendStuffBit(1);
  44     }
  45
  46     // Send SOF.
  47     for(i = 0; i < 10; i++) {
  48         ToSendStuffBit(0);
  49         ToSendStuffBit(0);
  50         ToSendStuffBit(0);
  51         ToSendStuffBit(0);
  52     }
  53     for(i = 0; i < 2; i++) {
  54         ToSendStuffBit(1);
  55         ToSendStuffBit(1);
  56         ToSendStuffBit(1);
  57         ToSendStuffBit(1);
  58     }
  59
  60     for(i = 0; i < len; i++) {
  61         int j;
  62         BYTE b = cmd[i];
  63
  64         // Start bit
  65         ToSendStuffBit(0);
  66         ToSendStuffBit(0);
  67         ToSendStuffBit(0);
  68         ToSendStuffBit(0);
  69
  70         // Data bits
  71         for(j = 0; j < 8; j++) {
  72             if(b & 1) {
  73                 ToSendStuffBit(1);
  74                 ToSendStuffBit(1);
  75                 ToSendStuffBit(1);
  76                 ToSendStuffBit(1);
  77             } else {
  78                 ToSendStuffBit(0);
  79                 ToSendStuffBit(0);
  80                 ToSendStuffBit(0);
  81                 ToSendStuffBit(0);
  82             }
  83             b >>= 1;
  84         }
  85
  86         // Stop bit
  87         ToSendStuffBit(1);
  88         ToSendStuffBit(1);
  89         ToSendStuffBit(1);
  90         ToSendStuffBit(1);
  91     }
  92
  93     // Send SOF.
  94     for(i = 0; i < 10; i++) {
  95         ToSendStuffBit(0);
  96         ToSendStuffBit(0);
  97         ToSendStuffBit(0);
  98         ToSendStuffBit(0);
  99     }
 100     for(i = 0; i < 10; i++) {
 101         ToSendStuffBit(1);
 102         ToSendStuffBit(1);
 103         ToSendStuffBit(1);
 104         ToSendStuffBit(1);
 105     }
 106
 107     // Convert from last byte pos to length
 108     ToSendMax++;
 109
 110     // Add a few more for slop
 111     ToSendMax += 2;
 112 }
 113
 114 //-----------------------------------------------------------------------------
 115 // The software UART that receives commands from the reader, and its state
 116 // variables.
 117 //-----------------------------------------------------------------------------
 118 static struct {
 119     enum {
 120         STATE_UNSYNCD,
 121         STATE_GOT_FALLING_EDGE_OF_SOF,
 122         STATE_AWAITING_START_BIT,
 123         STATE_RECEIVING_DATA,
 124         STATE_ERROR_WAIT
 125     }       state;
 126     WORD    shiftReg;
 127     int     bitCnt;
 128     int     byteCnt;
 129     int     byteCntMax;
 130     int     posCnt;
 131     BYTE   *output;
 132 } Uart;
 133
 134 static BOOL Handle14443UartBit(int bit)
 135 {
 136     switch(Uart.state) {
 137         case STATE_UNSYNCD:
 138             if(!bit) {
 139                 // we went low, so this could be the beginning
 140                 // of an SOF
 141                 Uart.state = STATE_GOT_FALLING_EDGE_OF_SOF;
 142                 Uart.posCnt = 0;
 143                 Uart.bitCnt = 0;
 144             }
 145             break;
 146
 147         case STATE_GOT_FALLING_EDGE_OF_SOF:
 148             Uart.posCnt++;
 149             if(Uart.posCnt == 2) {
 150                 if(bit) {
 151                     if(Uart.bitCnt >= 10) {
 152                         // we've seen enough consecutive
 153                         // zeros that it's a valid SOF
 154                         Uart.posCnt = 0;
 155                         Uart.byteCnt = 0;
 156                         Uart.state = STATE_AWAITING_START_BIT;
 157                     } else {
 158                         // didn't stay down long enough
 159                         // before going high, error
 160                         Uart.state = STATE_ERROR_WAIT;
 161                     }
 162                 } else {
 163                     // do nothing, keep waiting
 164                 }
 165                 Uart.bitCnt++;
 166             }
 167             if(Uart.posCnt >= 4) Uart.posCnt = 0;
 168             if(Uart.bitCnt > 14) {
 169                 // Give up if we see too many zeros without
 170                 // a one, too.
 171                 Uart.state = STATE_ERROR_WAIT;
 172             }
 173             break;
 174
 175         case STATE_AWAITING_START_BIT:
 176             Uart.posCnt++;
 177             if(bit) {
 178                 if(Uart.posCnt > 25) {
 179                     // stayed high for too long between
 180                     // characters, error
 181                     Uart.state = STATE_ERROR_WAIT;
 182                 }
 183             } else {
 184                 // falling edge, this starts the data byte
 185                 Uart.posCnt = 0;
 186                 Uart.bitCnt = 0;
 187                 Uart.shiftReg = 0;
 188                 Uart.state = STATE_RECEIVING_DATA;
 189             }
 190             break;
 191
 192         case STATE_RECEIVING_DATA:
 193             Uart.posCnt++;
 194             if(Uart.posCnt == 2) {
 195                 // time to sample a bit
 196                 Uart.shiftReg >>= 1;
 197                 if(bit) {
 198                     Uart.shiftReg |= 0x200;
 199                 }
 200                 Uart.bitCnt++;
 201             }
 202             if(Uart.posCnt >= 4) {
 203                 Uart.posCnt = 0;
 204             }
 205             if(Uart.bitCnt == 10) {
 206                 if((Uart.shiftReg & 0x200) && !(Uart.shiftReg & 0x001))
 207                 {
 208                     // this is a data byte, with correct
 209                     // start and stop bits
 210                     Uart.output[Uart.byteCnt] = (Uart.shiftReg >> 1) & 0xff;
 211                     Uart.byteCnt++;
 212
 213                     if(Uart.byteCnt >= Uart.byteCntMax) {
 214                         // Buffer overflowed, give up
 215                         Uart.posCnt = 0;
 216                         Uart.state = STATE_ERROR_WAIT;
 217                     } else {
 218                         // so get the next byte now
 219                         Uart.posCnt = 0;
 220                         Uart.state = STATE_AWAITING_START_BIT;
 221                     }
 222                 } else if(Uart.shiftReg == 0x000) {
 223                     // this is an EOF byte
 224                     return TRUE;
 225                 } else {
 226                     // this is an error
 227                     Uart.posCnt = 0;
 228                     Uart.state = STATE_ERROR_WAIT;
 229                 }
 230             }
 231             break;
 232
 233         case STATE_ERROR_WAIT:
 234             // We're all screwed up, so wait a little while
 235             // for whatever went wrong to finish, and then
 236             // start over.
 237             Uart.posCnt++;
 238             if(Uart.posCnt > 10) {
 239                 Uart.state = STATE_UNSYNCD;
 240             }
 241             break;
 242
 243         default:
 244             Uart.state = STATE_UNSYNCD;
 245             break;
 246     }
 247
 248     return FALSE;
 249 }
 250
 251 //-----------------------------------------------------------------------------
 252 // Receive a command (from the reader to us, where we are the simulated tag),
 253 // and store it in the given buffer, up to the given maximum length. Keeps
 254 // spinning, waiting for a well-framed command, until either we get one
 255 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
 256 //
 257 // Assume that we're called with the SSC (to the FPGA) and ADC path set
 258 // correctly.
 259 //-----------------------------------------------------------------------------
 260 static BOOL GetIso14443CommandFromReader(BYTE *received, int *len, int maxLen)
 261 {
 262     BYTE mask;
 263     int i, bit;
 264
 265     // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
 266     // only, since we are receiving, not transmitting).
 267     FpgaWriteConfWord(
 268         FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
 269
 270
 271     // Now run a `software UART' on the stream of incoming samples.
 272     Uart.output = received;
 273     Uart.byteCntMax = maxLen;
 274     Uart.state = STATE_UNSYNCD;
 275
 276     for(;;) {
 277         WDT_HIT();
 278
 279         if(BUTTON_PRESS()) return FALSE;
 280
 281         if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
 282             SSC_TRANSMIT_HOLDING = 0x00;
 283         }
 284         if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
 285             BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
 286
 287             mask = 0x80;
 288             for(i = 0; i < 8; i++, mask >>= 1) {
 289                 bit = (b & mask);
 290                 if(Handle14443UartBit(bit)) {
 291                     *len = Uart.byteCnt;
 292                     return TRUE;
 293                 }
 294             }
 295         }
 296     }
 297 }
 298
 299 //-----------------------------------------------------------------------------
 300 // Main loop of simulated tag: receive commands from reader, decide what
 301 // response to send, and send it.
 302 //-----------------------------------------------------------------------------
 303 void SimulateIso14443Tag(void)
 304 {
 305     static const BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 306     static const BYTE response1[] = {
 307         0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
 308         0x00, 0x21, 0x85, 0x5e, 0xd7
 309     };
 310
 311     BYTE *resp;
 312     int respLen;
 313
 314     BYTE *resp1 = (((BYTE *)BigBuf) + 800);
 315     int resp1Len;
 316
 317     BYTE *receivedCmd = (BYTE *)BigBuf;
 318     int len;
 319
 320     int i;
 321
 322     int cmdsRecvd = 0;
 323
 324     memset(receivedCmd, 0x44, 400);
 325
 326     CodeIso14443bAsTag(response1, sizeof(response1));
 327     memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
 328
 329     // We need to listen to the high-frequency, peak-detected path.
 330     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 331     FpgaSetupSsc();
 332
 333     cmdsRecvd = 0;
 334
 335     for(;;) {
 336         BYTE b1, b2;
 337
 338         if(!GetIso14443CommandFromReader(receivedCmd, &len, 100)) {
 339             DbpIntegers(cmdsRecvd, 0, 0);
 340             DbpString("button press");
 341             break;
 342         }
 343
 344         // Good, look at the command now.
 345
 346         if(len == sizeof(cmd1) && memcmp(receivedCmd, cmd1, len)==0) {
 347             resp = resp1; respLen = resp1Len;
 348         } else {
 349             DbpString("new cmd from reader:");
 350             DbpIntegers(len, 0x1234, cmdsRecvd);
 351             // And print whether the CRC fails, just for good measure
 352             ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
 353             if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
 354                 // Not so good, try again.
 355                 DbpString("+++CRC fail");
 356             } else {
 357                 DbpString("CRC passes");
 358             }
 359             break;
 360         }
 361
 362         memset(receivedCmd, 0x44, 32);
 363
 364         cmdsRecvd++;
 365
 366         if(cmdsRecvd > 0x30) {
 367             DbpString("many commands later...");
 368             break;
 369         }
 370
 371         if(respLen <= 0) continue;
 372
 373         // Modulate BPSK
 374         FpgaWriteConfWord(
 375                 FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);
 376         SSC_TRANSMIT_HOLDING = 0xff;
 377         FpgaSetupSsc();
 378
 379         // Transmit the response.
 380         i = 0;
 381         for(;;) {
 382             if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
 383                 BYTE b = resp[i];
 384
 385                 SSC_TRANSMIT_HOLDING = b;
 386
 387                 i++;
 388                 if(i > respLen) {
 389                     break;
 390                 }
 391             }
 392             if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
 393                 volatile BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
 394                 (void)b;
 395             }
 396         }
 397     }
 398 }
 399
 400 //=============================================================================
 401 // An ISO 14443 Type B reader. We take layer two commands, code them
 402 // appropriately, and then send them to the tag. We then listen for the
 403 // tag's response, which we leave in the buffer to be demodulated on the
 404 // PC side.
 405 //=============================================================================
 406
 407 static struct {
 408     enum {
 409         DEMOD_UNSYNCD,
 410         DEMOD_PHASE_REF_TRAINING,
 411         DEMOD_AWAITING_FALLING_EDGE_OF_SOF,
 412         DEMOD_GOT_FALLING_EDGE_OF_SOF,
 413         DEMOD_AWAITING_START_BIT,
 414         DEMOD_RECEIVING_DATA,
 415         DEMOD_ERROR_WAIT
 416     }       state;
 417     int     bitCount;
 418     int     posCount;
 419     int     thisBit;
 420     int     metric;
 421     int     metricN;
 422     WORD    shiftReg;
 423     BYTE   *output;
 424     int     len;
 425     int     sumI;
 426     int     sumQ;
 427 } Demod;
 428
 429 static BOOL Handle14443SamplesDemod(int ci, int cq)
 430 {
 431     int v;
 432
 433     // The soft decision on the bit uses an estimate of just the
 434     // quadrant of the reference angle, not the exact angle.
 435 #define MAKE_SOFT_DECISION() { \
 436         if(Demod.sumI > 0) { \
 437             v = ci; \
 438         } else { \
 439             v = -ci; \
 440         } \
 441         if(Demod.sumQ > 0) { \
 442             v += cq; \
 443         } else { \
 444             v -= cq; \
 445         } \
 446     }
 447
 448     switch(Demod.state) {
 449         case DEMOD_UNSYNCD:
 450             v = ci;
 451             if(v < 0) v = -v;
 452             if(cq > 0) {
 453                 v += cq;
 454             } else {
 455                 v -= cq;
 456             }
 457             if(v > 40) {
 458                 Demod.posCount = 0;
 459                 Demod.state = DEMOD_PHASE_REF_TRAINING;
 460                 Demod.sumI = 0;
 461                 Demod.sumQ = 0;
 462             }
 463             break;
 464
 465         case DEMOD_PHASE_REF_TRAINING:
 466             if(Demod.posCount < 8) {
 467                 Demod.sumI += ci;
 468                 Demod.sumQ += cq;
 469             } else if(Demod.posCount > 100) {
 470                 // error, waited too long
 471                 Demod.state = DEMOD_UNSYNCD;
 472             } else {
 473                 MAKE_SOFT_DECISION();
 474                 if(v < 0) {
 475                     Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF;
 476                     Demod.posCount = 0;
 477                 }
 478             }
 479             Demod.posCount++;
 480             break;
 481
 482         case DEMOD_AWAITING_FALLING_EDGE_OF_SOF:
 483             MAKE_SOFT_DECISION();
 484             if(v < 0) {
 485                 Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
 486                 Demod.posCount = 0;
 487             } else {
 488                 if(Demod.posCount > 100) {
 489                     Demod.state = DEMOD_UNSYNCD;
 490                 }
 491             }
 492             Demod.posCount++;
 493             break;
 494
 495         case DEMOD_GOT_FALLING_EDGE_OF_SOF:
 496             MAKE_SOFT_DECISION();
 497             if(v > 0) {
 498                 if(Demod.posCount < 12) {
 499                     Demod.state = DEMOD_UNSYNCD;
 500                 } else {
 501                     Demod.state = DEMOD_AWAITING_START_BIT;
 502                     Demod.posCount = 0;
 503                     Demod.len = 0;
 504                     Demod.metricN = 0;
 505                     Demod.metric = 0;
 506                 }
 507             } else {
 508                 if(Demod.posCount > 100) {
 509                     Demod.state = DEMOD_UNSYNCD;
 510                 }
 511             }
 512             Demod.posCount++;
 513             break;
 514
 515         case DEMOD_AWAITING_START_BIT:
 516             MAKE_SOFT_DECISION();
 517             if(v > 0) {
 518                 if(Demod.posCount > 10) {
 519                     Demod.state = DEMOD_UNSYNCD;
 520                 }
 521             } else {
 522                 Demod.bitCount = 0;
 523                 Demod.posCount = 1;
 524                 Demod.thisBit = v;
 525                 Demod.shiftReg = 0;
 526                 Demod.state = DEMOD_RECEIVING_DATA;
 527             }
 528             break;
 529
 530         case DEMOD_RECEIVING_DATA:
 531             MAKE_SOFT_DECISION();
 532             if(Demod.posCount == 0) {
 533                 Demod.thisBit = v;
 534                 Demod.posCount = 1;
 535             } else {
 536                 Demod.thisBit += v;
 537
 538                 if(Demod.thisBit > 0) {
 539                     Demod.metric += Demod.thisBit;
 540                 } else {
 541                     Demod.metric -= Demod.thisBit;
 542                 }
 543                 (Demod.metricN)++;
 544
 545                 Demod.shiftReg >>= 1;
 546                 if(Demod.thisBit > 0) {
 547                     Demod.shiftReg |= 0x200;
 548                 }
 549
 550                 Demod.bitCount++;
 551                 if(Demod.bitCount == 10) {
 552                     WORD s = Demod.shiftReg;
 553                     if((s & 0x200) && !(s & 0x001)) {
 554                         BYTE b = (s >> 1);
 555                         Demod.output[Demod.len] = b;
 556                         Demod.len++;
 557                         Demod.state = DEMOD_AWAITING_START_BIT;
 558                     } else if(s == 0x000) {
 559                         // This is EOF
 560                         return TRUE;
 561                         Demod.state = DEMOD_UNSYNCD;
 562                     } else {
 563                         Demod.state = DEMOD_UNSYNCD;
 564                     }
 565                 }
 566                 Demod.posCount = 0;
 567             }
 568             break;
 569
 570         default:
 571             Demod.state = DEMOD_UNSYNCD;
 572             break;
 573     }
 574
 575     return FALSE;
 576 }
 577
 578 static void GetSamplesFor14443Demod(BOOL weTx, int n, BOOL quiet)
 579 {
 580     int max = 0;
 581     BOOL gotFrame = FALSE;
 582
 583 //#   define DMA_BUFFER_SIZE 8
 584     SBYTE *dmaBuf;
 585
 586     int lastRxCounter;
 587     SBYTE *upTo;
 588
 589     int ci, cq;
 590
 591     int samples = 0;
 592
 593     // Clear out the state of the "UART" that receives from the tag.
 594     memset(BigBuf, 0x44, 400);
 595     Demod.output = (BYTE *)BigBuf;
 596     Demod.len = 0;
 597     Demod.state = DEMOD_UNSYNCD;
 598
 599     // And the UART that receives from the reader
 600     Uart.output = (((BYTE *)BigBuf) + 1024);
 601     Uart.byteCntMax = 100;
 602     Uart.state = STATE_UNSYNCD;
 603
 604     // Setup for the DMA.
 605     dmaBuf = (SBYTE *)(BigBuf + 32);
 606     upTo = dmaBuf;
 607     lastRxCounter = DMA_BUFFER_SIZE;
 608     FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
 609
 610     // And put the FPGA in the appropriate mode
 611     FpgaWriteConfWord(
 612         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
 613         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
 614
 615     for(;;) {
 616         int behindBy = lastRxCounter - PDC_RX_COUNTER(SSC_BASE);
 617         if(behindBy > max) max = behindBy;
 618
 619         LED_D_ON();
 620         while(((lastRxCounter-PDC_RX_COUNTER(SSC_BASE)) & (DMA_BUFFER_SIZE-1))
 621                     > 2)
 622         {
 623             ci = upTo[0];
 624             cq = upTo[1];
 625             upTo += 2;
 626             if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
 627                 upTo -= DMA_BUFFER_SIZE;
 628                 PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;
 629                 PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;
 630             }
 631             lastRxCounter -= 2;
 632             if(lastRxCounter <= 0) {
 633                 lastRxCounter += DMA_BUFFER_SIZE;
 634             }
 635
 636             samples += 2;
 637
 638             Handle14443UartBit(1);
 639             Handle14443UartBit(1);
 640
 641             if(Handle14443SamplesDemod(ci, cq)) {
 642                 gotFrame = 1;
 643             }
 644         }
 645         LED_D_OFF();
 646
 647         if(samples > 2000) {
 648             break;
 649         }
 650     }
 651     PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;
 652     if (!quiet) DbpIntegers(max, gotFrame, Demod.len);
 653 }
 654
 655 //-----------------------------------------------------------------------------
 656 // Read the tag's response. We just receive a stream of slightly-processed
 657 // samples from the FPGA, which we will later do some signal processing on,
 658 // to get the bits.
 659 //-----------------------------------------------------------------------------
 660 /*static void GetSamplesFor14443(BOOL weTx, int n)
 661 {
 662     BYTE *dest = (BYTE *)BigBuf;
 663     int c;
 664
 665     FpgaWriteConfWord(
 666         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
 667         (weTx ? 0 : FPGA_HF_READER_RX_XCORR_SNOOP));
 668
 669     c = 0;
 670     for(;;) {
 671         if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
 672             SSC_TRANSMIT_HOLDING = 0x43;
 673         }
 674         if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
 675             SBYTE b;
 676             b = (SBYTE)SSC_RECEIVE_HOLDING;
 677
 678             dest[c++] = (BYTE)b;
 679
 680             if(c >= n) {
 681                 break;
 682             }
 683         }
 684     }
 685 }*/
 686
 687 //-----------------------------------------------------------------------------
 688 // Transmit the command (to the tag) that was placed in ToSend[].
 689 //-----------------------------------------------------------------------------
 690 static void TransmitFor14443(void)
 691 {
 692     int c;
 693
 694     FpgaSetupSsc();
 695
 696     while(SSC_STATUS & (SSC_STATUS_TX_READY)) {
 697         SSC_TRANSMIT_HOLDING = 0xff;
 698     }
 699
 700     FpgaWriteConfWord(
 701         FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
 702
 703     for(c = 0; c < 10;) {
 704         if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
 705             SSC_TRANSMIT_HOLDING = 0xff;
 706             c++;
 707         }
 708         if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
 709             volatile DWORD r = SSC_RECEIVE_HOLDING;
 710             (void)r;
 711         }
 712         WDT_HIT();
 713     }
 714
 715     c = 0;
 716     for(;;) {
 717         if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
 718             SSC_TRANSMIT_HOLDING = ToSend[c];
 719             c++;
 720             if(c >= ToSendMax) {
 721                 break;
 722             }
 723         }
 724         if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
 725             volatile DWORD r = SSC_RECEIVE_HOLDING;
 726             (void)r;
 727         }
 728         WDT_HIT();
 729     }
 730 }
 731
 732 //-----------------------------------------------------------------------------
 733 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
 734 // so that it is ready to transmit to the tag using TransmitFor14443().
 735 //-----------------------------------------------------------------------------
 736 void CodeIso14443bAsReader(const BYTE *cmd, int len)
 737 {
 738     int i, j;
 739     BYTE b;
 740
 741     ToSendReset();
 742
 743     // Establish initial reference level
 744     for(i = 0; i < 40; i++) {
 745         ToSendStuffBit(1);
 746     }
 747     // Send SOF
 748     for(i = 0; i < 10; i++) {
 749         ToSendStuffBit(0);
 750     }
 751
 752     for(i = 0; i < len; i++) {
 753         // Stop bits/EGT
 754         ToSendStuffBit(1);
 755         ToSendStuffBit(1);
 756         // Start bit
 757         ToSendStuffBit(0);
 758         // Data bits
 759         b = cmd[i];
 760         for(j = 0; j < 8; j++) {
 761             if(b & 1) {
 762                 ToSendStuffBit(1);
 763             } else {
 764                 ToSendStuffBit(0);
 765             }
 766             b >>= 1;
 767         }
 768     }
 769     // Send EOF
 770     ToSendStuffBit(1);
 771     for(i = 0; i < 10; i++) {
 772         ToSendStuffBit(0);
 773     }
 774     for(i = 0; i < 8; i++) {
 775         ToSendStuffBit(1);
 776     }
 777
 778     // And then a little more, to make sure that the last character makes
 779     // it out before we switch to rx mode.
 780     for(i = 0; i < 24; i++) {
 781         ToSendStuffBit(1);
 782     }
 783
 784     // Convert from last character reference to length
 785     ToSendMax++;
 786 }
 787
 788 //-----------------------------------------------------------------------------
 789 // Read an ISO 14443 tag. We send it some set of commands, and record the
 790 // responses.
 791 // The command name is misleading, it actually decodes the reponse in HEX
 792 // into the output buffer (read the result using hexsamples, not hisamples)
 793 //-----------------------------------------------------------------------------
 794 void AcquireRawAdcSamplesIso14443(DWORD parameter)
 795 {
 796     BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 797
 798     // Make sure that we start from off, since the tags are stateful;
 799     // confusing things will happen if we don't reset them between reads.
 800     LED_D_OFF();
 801     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 802     SpinDelay(200);
 803
 804     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 805     FpgaSetupSsc();
 806
 807     // Now give it time to spin up.
 808     FpgaWriteConfWord(
 809         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 810     SpinDelay(200);
 811
 812     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 813     TransmitFor14443();
 814     LED_A_ON();
 815     GetSamplesFor14443Demod(TRUE, 2000, FALSE);
 816     LED_A_OFF();
 817 }
 818
 819 //-----------------------------------------------------------------------------
 820 // Read a SRI512 ISO 14443 tag.
 821 //
 822 // SRI512 tags are just simple memory tags, here we're looking at making a dump
 823 // of the contents of the memory. No anticollision algorithm is done, we assume
 824 // we have a single tag in the field.
 825 //
 826 // I tried to be systematic and check every answer of the tag, every CRC, etc...
 827 //-----------------------------------------------------------------------------
 828 void ReadSRI512Iso14443(DWORD parameter)
 829 {
 830     BYTE i = 0x00;
 831
 832     // Make sure that we start from off, since the tags are stateful;
 833     // confusing things will happen if we don't reset them between reads.
 834     LED_D_OFF();
 835     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 836     SpinDelay(200);
 837
 838     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 839     FpgaSetupSsc();
 840
 841     // Now give it time to spin up.
 842     FpgaWriteConfWord(
 843         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
 844     SpinDelay(200);
 845
 846     // First command: wake up the tag using the INITIATE command
 847     BYTE cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
 848     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 849     TransmitFor14443();
 850     LED_A_ON();
 851     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 852     LED_A_OFF();
 853
 854     if (Demod.len == 0) {
 855         DbpString("No response from tag");
 856         return;
 857     } else {
 858         DbpString("Randomly generated UID from tag (+ 2 byte CRC):");
 859         DbpIntegers(Demod.output[0], Demod.output[1],Demod.output[2]);
 860     }
 861     // There is a response, SELECT the uid
 862     DbpString("Now SELECT tag:");
 863     cmd1[0] = 0x0E; // 0x0E is SELECT
 864     cmd1[1] = Demod.output[0];
 865     ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 866     CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 867     TransmitFor14443();
 868     LED_A_ON();
 869     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 870     LED_A_OFF();
 871     if (Demod.len != 3) {
 872         DbpString("Expected 3 bytes from tag, got:");
 873         DbpIntegers(Demod.len,0x0,0x0);
 874         return;
 875     }
 876     // Check the CRC of the answer:
 877     ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
 878     if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
 879         DbpString("CRC Error reading select response.");
 880         return;
 881     }
 882     // Check response from the tag: should be the same UID as the command we just sent:
 883     if (cmd1[1] != Demod.output[0]) {
 884         DbpString("Bad response to SELECT from Tag, aborting:");
 885         DbpIntegers(cmd1[1],Demod.output[0],0x0);
 886         return;
 887     }
 888     // Tag is now selected,
 889     // First get the tag's UID:
 890     cmd1[0] = 0x0B;
 891     ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
 892     CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one
 893     TransmitFor14443();
 894     LED_A_ON();
 895     GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 896     LED_A_OFF();
 897     if (Demod.len != 10) {
 898         DbpString("Expected 10 bytes from tag, got:");
 899         DbpIntegers(Demod.len,0x0,0x0);
 900         return;
 901     }
 902     // The check the CRC of the answer (use cmd1 as temporary variable):
 903     ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
 904            if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
 905         DbpString("CRC Error reading block! - Below: expected, got");
 906         DbpIntegers( (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9],0);
 907         // Do not return;, let's go on... (we should retry, maybe ?)
 908     }
 909     DbpString("Tag UID (64 bits):");
 910     DbpIntegers((Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], 0);
 911
 912     // Now loop to read all 16 blocks, address from 0 to 15
 913     DbpString("Tag memory dump, block 0 to 15");
 914     cmd1[0] = 0x08;
 915     i = 0x00;
 916     for (;;) {
 917             if (i == 0x10) {
 918                     DbpString("System area block (0xff):");
 919                     i = 0xff;
 920             }
 921             cmd1[1] = i;
 922             ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
 923             CodeIso14443bAsReader(cmd1, sizeof(cmd1));
 924             TransmitFor14443();
 925             LED_A_ON();
 926             GetSamplesFor14443Demod(TRUE, 2000,TRUE);
 927             LED_A_OFF();
 928             if (Demod.len != 6) { // Check if we got an answer from the tag
 929                 DbpString("Expected 6 bytes from tag, got less...");
 930                 return;
 931             }
 932             // The check the CRC of the answer (use cmd1 as temporary variable):
 933             ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
 934             if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
 935                 DbpString("CRC Error reading block! - Below: expected, got");
 936                 DbpIntegers( (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5],0);
 937                 // Do not return;, let's go on... (we should retry, maybe ?)
 938             }
 939             // Now print out the memory location:
 940             DbpString("Address , Contents, CRC");
 941             DbpIntegers(i, (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], (Demod.output[4]<<8)+Demod.output[5]);
 942             if (i == 0xff) {
 943                 break;
 944             }
 945             i++;
 946     }
 947 }
 948
 949
 950 //=============================================================================
 951 // Finally, the `sniffer' combines elements from both the reader and
 952 // simulated tag, to show both sides of the conversation.
 953 //=============================================================================
 954
 955 //-----------------------------------------------------------------------------
 956 // Record the sequence of commands sent by the reader to the tag, with
 957 // triggering so that we start recording at the point that the tag is moved
 958 // near the reader.
 959 //-----------------------------------------------------------------------------
 960 void SnoopIso14443(void)
 961 {
 962     // We won't start recording the frames that we acquire until we trigger;
 963     // a good trigger condition to get started is probably when we see a
 964     // response from the tag.
 965     BOOL triggered = FALSE;
 966
 967     // The command (reader -> tag) that we're working on receiving.
 968     BYTE *receivedCmd = (((BYTE *)BigBuf) + 1024);
 969     // The response (tag -> reader) that we're working on receiving.
 970     BYTE *receivedResponse = (((BYTE *)BigBuf) + 1536);
 971
 972     // As we receive stuff, we copy it from receivedCmd or receivedResponse
 973     // into trace, along with its length and other annotations.
 974     BYTE *trace = (BYTE *)BigBuf;
 975     int traceLen = 0;
 976
 977     // The DMA buffer, used to stream samples from the FPGA.
 978 //#   define DMA_BUFFER_SIZE 256
 979     SBYTE *dmaBuf = ((SBYTE *)BigBuf) + 2048;
 980     int lastRxCounter;
 981     SBYTE *upTo;
 982     int ci, cq;
 983     int maxBehindBy = 0;
 984
 985     // Count of samples received so far, so that we can include timing
 986     // information in the trace buffer.
 987     int samples = 0;
 988
 989     memset(trace, 0x44, 1000);
 990
 991     // Set up the demodulator for tag -> reader responses.
 992     Demod.output = receivedResponse;
 993     Demod.len = 0;
 994     Demod.state = DEMOD_UNSYNCD;
 995
 996     // And the reader -> tag commands
 997     memset(&Uart, 0, sizeof(Uart));
 998     Uart.output = receivedCmd;
 999     Uart.byteCntMax = 100;
1000     Uart.state = STATE_UNSYNCD;
1001
1002     // And put the FPGA in the appropriate mode
1003     FpgaWriteConfWord(
1004         FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
1005         FPGA_HF_READER_RX_XCORR_SNOOP);
1006     SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1007
1008     // Setup for the DMA.
1009     FpgaSetupSsc();
1010     upTo = dmaBuf;
1011     lastRxCounter = DMA_BUFFER_SIZE;
1012     FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
1013
1014     LED_A_ON();
1015
1016     // And now we loop, receiving samples.
1017     for(;;) {
1018         int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &
1019                                 (DMA_BUFFER_SIZE-1);
1020         if(behindBy > maxBehindBy) {
1021             maxBehindBy = behindBy;
1022             if(behindBy > 100) {
1023                 DbpString("blew circular buffer!");
1024                 goto done;
1025             }
1026         }
1027         if(behindBy < 2) continue;
1028
1029         ci = upTo[0];
1030         cq = upTo[1];
1031         upTo += 2;
1032         lastRxCounter -= 2;
1033         if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
1034             upTo -= DMA_BUFFER_SIZE;
1035             lastRxCounter += DMA_BUFFER_SIZE;
1036             PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;
1037             PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;
1038         }
1039
1040         samples += 2;
1041
1042 #define HANDLE_BIT_IF_BODY \
1043             if(triggered) { \
1044                 trace[traceLen++] = ((samples >>  0) & 0xff); \
1045                 trace[traceLen++] = ((samples >>  8) & 0xff); \
1046                 trace[traceLen++] = ((samples >> 16) & 0xff); \
1047                 trace[traceLen++] = ((samples >> 24) & 0xff); \
1048                 trace[traceLen++] = 0; \
1049                 trace[traceLen++] = 0; \
1050                 trace[traceLen++] = 0; \
1051                 trace[traceLen++] = 0; \
1052                 trace[traceLen++] = Uart.byteCnt; \
1053                 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
1054                 traceLen += Uart.byteCnt; \
1055                 if(traceLen > 1000) break; \
1056             } \
1057             /* And ready to receive another command. */ \
1058             memset(&Uart, 0, sizeof(Uart)); \
1059             Uart.output = receivedCmd; \
1060             Uart.byteCntMax = 100; \
1061             Uart.state = STATE_UNSYNCD; \
1062             /* And also reset the demod code, which might have been */ \
1063             /* false-triggered by the commands from the reader. */ \
1064             memset(&Demod, 0, sizeof(Demod)); \
1065             Demod.output = receivedResponse; \
1066             Demod.state = DEMOD_UNSYNCD; \
1067
1068         if(Handle14443UartBit(ci & 1)) {
1069             HANDLE_BIT_IF_BODY
1070         }
1071         if(Handle14443UartBit(cq & 1)) {
1072             HANDLE_BIT_IF_BODY
1073         }
1074
1075         if(Handle14443SamplesDemod(ci, cq)) {
1076             // timestamp, as a count of samples
1077             trace[traceLen++] = ((samples >>  0) & 0xff);
1078             trace[traceLen++] = ((samples >>  8) & 0xff);
1079             trace[traceLen++] = ((samples >> 16) & 0xff);
1080             trace[traceLen++] = 0x80 | ((samples >> 24) & 0xff);
1081             // correlation metric (~signal strength estimate)
1082             if(Demod.metricN != 0) {
1083                 Demod.metric /= Demod.metricN;
1084             }
1085             trace[traceLen++] = ((Demod.metric >>  0) & 0xff);
1086             trace[traceLen++] = ((Demod.metric >>  8) & 0xff);
1087             trace[traceLen++] = ((Demod.metric >> 16) & 0xff);
1088             trace[traceLen++] = ((Demod.metric >> 24) & 0xff);
1089             // length
1090             trace[traceLen++] = Demod.len;
1091             memcpy(trace+traceLen, receivedResponse, Demod.len);
1092             traceLen += Demod.len;
1093             if(traceLen > 1000) break;
1094
1095             triggered = TRUE;
1096             LED_A_OFF();
1097             LED_B_ON();
1098
1099             // And ready to receive another response.
1100             memset(&Demod, 0, sizeof(Demod));
1101             Demod.output = receivedResponse;
1102             Demod.state = DEMOD_UNSYNCD;
1103         }
1104
1105         if(BUTTON_PRESS()) {
1106             DbpString("cancelled");
1107             goto done;
1108         }
1109     }
1110
1111     DbpString("in done pt");
1112
1113     DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
1114     DbpIntegers(Uart.byteCntMax, traceLen, 0x23);
1115
1116 done:
1117     PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;
1118     LED_A_OFF();
1119     LED_B_OFF();
1120 }