]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443a.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Fix and generify legic response code
[proxmark3-svn] / armsrc / iso14443a.c
1 //-----------------------------------------------------------------------------
2 // Routines to support ISO 14443 type A.
3 //
4 // Gerhard de Koning Gans - May 2008
5 //-----------------------------------------------------------------------------
6 #include <proxmark3.h>
7 #include "apps.h"
8 #include "../common/iso14443_crc.c"
9
10 typedef enum {
11 SEC_D = 1,
12 SEC_E = 2,
13 SEC_F = 3,
14 SEC_X = 4,
15 SEC_Y = 5,
16 SEC_Z = 6
17 } SecType;
18
19 //-----------------------------------------------------------------------------
20 // The software UART that receives commands from the reader, and its state
21 // variables.
22 //-----------------------------------------------------------------------------
23 static struct {
24 enum {
25 STATE_UNSYNCD,
26 STATE_START_OF_COMMUNICATION,
27 STATE_MILLER_X,
28 STATE_MILLER_Y,
29 STATE_MILLER_Z,
30 STATE_ERROR_WAIT
31 } state;
32 WORD shiftReg;
33 int bitCnt;
34 int byteCnt;
35 int byteCntMax;
36 int posCnt;
37 int syncBit;
38 int parityBits;
39 int samples;
40 int highCnt;
41 int bitBuffer;
42 enum {
43 DROP_NONE,
44 DROP_FIRST_HALF,
45 DROP_SECOND_HALF
46 } drop;
47 BYTE *output;
48 } Uart;
49
50 static BOOL MillerDecoding(int bit)
51 {
52 int error = 0;
53 int bitright;
54
55 if(!Uart.bitBuffer) {
56 Uart.bitBuffer = bit ^ 0xFF0;
57 return FALSE;
58 }
59 else {
60 Uart.bitBuffer <<= 4;
61 Uart.bitBuffer ^= bit;
62 }
63
64 BOOL EOC = FALSE;
65
66 if(Uart.state != STATE_UNSYNCD) {
67 Uart.posCnt++;
68
69 if((Uart.bitBuffer & Uart.syncBit) ^ Uart.syncBit) {
70 bit = 0x00;
71 }
72 else {
73 bit = 0x01;
74 }
75 if(((Uart.bitBuffer << 1) & Uart.syncBit) ^ Uart.syncBit) {
76 bitright = 0x00;
77 }
78 else {
79 bitright = 0x01;
80 }
81 if(bit != bitright) { bit = bitright; }
82
83 if(Uart.posCnt == 1) {
84 // measurement first half bitperiod
85 if(!bit) {
86 Uart.drop = DROP_FIRST_HALF;
87 }
88 }
89 else {
90 // measurement second half bitperiod
91 if(!bit & (Uart.drop == DROP_NONE)) {
92 Uart.drop = DROP_SECOND_HALF;
93 }
94 else if(!bit) {
95 // measured a drop in first and second half
96 // which should not be possible
97 Uart.state = STATE_ERROR_WAIT;
98 error = 0x01;
99 }
100
101 Uart.posCnt = 0;
102
103 switch(Uart.state) {
104 case STATE_START_OF_COMMUNICATION:
105 Uart.shiftReg = 0;
106 if(Uart.drop == DROP_SECOND_HALF) {
107 // error, should not happen in SOC
108 Uart.state = STATE_ERROR_WAIT;
109 error = 0x02;
110 }
111 else {
112 // correct SOC
113 Uart.state = STATE_MILLER_Z;
114 }
115 break;
116
117 case STATE_MILLER_Z:
118 Uart.bitCnt++;
119 Uart.shiftReg >>= 1;
120 if(Uart.drop == DROP_NONE) {
121 // logic '0' followed by sequence Y
122 // end of communication
123 Uart.state = STATE_UNSYNCD;
124 EOC = TRUE;
125 }
126 // if(Uart.drop == DROP_FIRST_HALF) {
127 // Uart.state = STATE_MILLER_Z; stay the same
128 // we see a logic '0' }
129 if(Uart.drop == DROP_SECOND_HALF) {
130 // we see a logic '1'
131 Uart.shiftReg |= 0x100;
132 Uart.state = STATE_MILLER_X;
133 }
134 break;
135
136 case STATE_MILLER_X:
137 Uart.shiftReg >>= 1;
138 if(Uart.drop == DROP_NONE) {
139 // sequence Y, we see a '0'
140 Uart.state = STATE_MILLER_Y;
141 Uart.bitCnt++;
142 }
143 if(Uart.drop == DROP_FIRST_HALF) {
144 // Would be STATE_MILLER_Z
145 // but Z does not follow X, so error
146 Uart.state = STATE_ERROR_WAIT;
147 error = 0x03;
148 }
149 if(Uart.drop == DROP_SECOND_HALF) {
150 // We see a '1' and stay in state X
151 Uart.shiftReg |= 0x100;
152 Uart.bitCnt++;
153 }
154 break;
155
156 case STATE_MILLER_Y:
157 Uart.bitCnt++;
158 Uart.shiftReg >>= 1;
159 if(Uart.drop == DROP_NONE) {
160 // logic '0' followed by sequence Y
161 // end of communication
162 Uart.state = STATE_UNSYNCD;
163 EOC = TRUE;
164 }
165 if(Uart.drop == DROP_FIRST_HALF) {
166 // we see a '0'
167 Uart.state = STATE_MILLER_Z;
168 }
169 if(Uart.drop == DROP_SECOND_HALF) {
170 // We see a '1' and go to state X
171 Uart.shiftReg |= 0x100;
172 Uart.state = STATE_MILLER_X;
173 }
174 break;
175
176 case STATE_ERROR_WAIT:
177 // That went wrong. Now wait for at least two bit periods
178 // and try to sync again
179 if(Uart.drop == DROP_NONE) {
180 Uart.highCnt = 6;
181 Uart.state = STATE_UNSYNCD;
182 }
183 break;
184
185 default:
186 Uart.state = STATE_UNSYNCD;
187 Uart.highCnt = 0;
188 break;
189 }
190
191 Uart.drop = DROP_NONE;
192
193 // should have received at least one whole byte...
194 if((Uart.bitCnt == 2) && EOC && (Uart.byteCnt > 0)) {
195 return TRUE;
196 }
197
198 if(Uart.bitCnt == 9) {
199 Uart.output[Uart.byteCnt] = (Uart.shiftReg & 0xff);
200 Uart.byteCnt++;
201
202 Uart.parityBits <<= 1;
203 Uart.parityBits ^= ((Uart.shiftReg >> 8) & 0x01);
204
205 if(EOC) {
206 // when End of Communication received and
207 // all data bits processed..
208 return TRUE;
209 }
210 Uart.bitCnt = 0;
211 }
212
213 /*if(error) {
214 Uart.output[Uart.byteCnt] = 0xAA;
215 Uart.byteCnt++;
216 Uart.output[Uart.byteCnt] = error & 0xFF;
217 Uart.byteCnt++;
218 Uart.output[Uart.byteCnt] = 0xAA;
219 Uart.byteCnt++;
220 Uart.output[Uart.byteCnt] = (Uart.bitBuffer >> 8) & 0xFF;
221 Uart.byteCnt++;
222 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
223 Uart.byteCnt++;
224 Uart.output[Uart.byteCnt] = (Uart.syncBit >> 3) & 0xFF;
225 Uart.byteCnt++;
226 Uart.output[Uart.byteCnt] = 0xAA;
227 Uart.byteCnt++;
228 return TRUE;
229 }*/
230 }
231
232 }
233 else {
234 bit = Uart.bitBuffer & 0xf0;
235 bit >>= 4;
236 bit ^= 0x0F;
237 if(bit) {
238 // should have been high or at least (4 * 128) / fc
239 // according to ISO this should be at least (9 * 128 + 20) / fc
240 if(Uart.highCnt == 8) {
241 // we went low, so this could be start of communication
242 // it turns out to be safer to choose a less significant
243 // syncbit... so we check whether the neighbour also represents the drop
244 Uart.posCnt = 1; // apparently we are busy with our first half bit period
245 Uart.syncBit = bit & 8;
246 Uart.samples = 3;
247 if(!Uart.syncBit) { Uart.syncBit = bit & 4; Uart.samples = 2; }
248 else if(bit & 4) { Uart.syncBit = bit & 4; Uart.samples = 2; bit <<= 2; }
249 if(!Uart.syncBit) { Uart.syncBit = bit & 2; Uart.samples = 1; }
250 else if(bit & 2) { Uart.syncBit = bit & 2; Uart.samples = 1; bit <<= 1; }
251 if(!Uart.syncBit) { Uart.syncBit = bit & 1; Uart.samples = 0;
252 if(Uart.syncBit & (Uart.bitBuffer & 8)) {
253 Uart.syncBit = 8;
254
255 // the first half bit period is expected in next sample
256 Uart.posCnt = 0;
257 Uart.samples = 3;
258 }
259 }
260 else if(bit & 1) { Uart.syncBit = bit & 1; Uart.samples = 0; }
261
262 Uart.syncBit <<= 4;
263 Uart.state = STATE_START_OF_COMMUNICATION;
264 Uart.drop = DROP_FIRST_HALF;
265 Uart.bitCnt = 0;
266 Uart.byteCnt = 0;
267 Uart.parityBits = 0;
268 error = 0;
269 }
270 else {
271 Uart.highCnt = 0;
272 }
273 }
274 else {
275 if(Uart.highCnt < 8) {
276 Uart.highCnt++;
277 }
278 }
279 }
280
281 return FALSE;
282 }
283
284 //=============================================================================
285 // ISO 14443 Type A - Manchester
286 //=============================================================================
287
288 static struct {
289 enum {
290 DEMOD_UNSYNCD,
291 DEMOD_START_OF_COMMUNICATION,
292 DEMOD_MANCHESTER_D,
293 DEMOD_MANCHESTER_E,
294 DEMOD_MANCHESTER_F,
295 DEMOD_ERROR_WAIT
296 } state;
297 int bitCount;
298 int posCount;
299 int syncBit;
300 int parityBits;
301 WORD shiftReg;
302 int buffer;
303 int buff;
304 int samples;
305 int len;
306 enum {
307 SUB_NONE,
308 SUB_FIRST_HALF,
309 SUB_SECOND_HALF
310 } sub;
311 BYTE *output;
312 } Demod;
313
314 static BOOL ManchesterDecoding(int v)
315 {
316 int bit;
317 int modulation;
318 int error = 0;
319
320 if(!Demod.buff) {
321 Demod.buff = 1;
322 Demod.buffer = v;
323 return FALSE;
324 }
325 else {
326 bit = Demod.buffer;
327 Demod.buffer = v;
328 }
329
330 if(Demod.state==DEMOD_UNSYNCD) {
331 Demod.output[Demod.len] = 0xfa;
332 Demod.syncBit = 0;
333 //Demod.samples = 0;
334 Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part
335 if(bit & 0x08) { Demod.syncBit = 0x08; }
336 if(!Demod.syncBit) {
337 if(bit & 0x04) { Demod.syncBit = 0x04; }
338 }
339 else if(bit & 0x04) { Demod.syncBit = 0x04; bit <<= 4; }
340 if(!Demod.syncBit) {
341 if(bit & 0x02) { Demod.syncBit = 0x02; }
342 }
343 else if(bit & 0x02) { Demod.syncBit = 0x02; bit <<= 4; }
344 if(!Demod.syncBit) {
345 if(bit & 0x01) { Demod.syncBit = 0x01; }
346
347 if(Demod.syncBit & (Demod.buffer & 0x08)) {
348 Demod.syncBit = 0x08;
349
350 // The first half bitperiod is expected in next sample
351 Demod.posCount = 0;
352 Demod.output[Demod.len] = 0xfb;
353 }
354 }
355 else if(bit & 0x01) { Demod.syncBit = 0x01; }
356
357 if(Demod.syncBit) {
358 Demod.len = 0;
359 Demod.state = DEMOD_START_OF_COMMUNICATION;
360 Demod.sub = SUB_FIRST_HALF;
361 Demod.bitCount = 0;
362 Demod.shiftReg = 0;
363 Demod.parityBits = 0;
364 Demod.samples = 0;
365 if(Demod.posCount) {
366 switch(Demod.syncBit) {
367 case 0x08: Demod.samples = 3; break;
368 case 0x04: Demod.samples = 2; break;
369 case 0x02: Demod.samples = 1; break;
370 case 0x01: Demod.samples = 0; break;
371 }
372 }
373 error = 0;
374 }
375 }
376 else {
377 //modulation = bit & Demod.syncBit;
378 modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
379
380 Demod.samples += 4;
381
382 if(Demod.posCount==0) {
383 Demod.posCount = 1;
384 if(modulation) {
385 Demod.sub = SUB_FIRST_HALF;
386 }
387 else {
388 Demod.sub = SUB_NONE;
389 }
390 }
391 else {
392 Demod.posCount = 0;
393 if(modulation && (Demod.sub == SUB_FIRST_HALF)) {
394 if(Demod.state!=DEMOD_ERROR_WAIT) {
395 Demod.state = DEMOD_ERROR_WAIT;
396 Demod.output[Demod.len] = 0xaa;
397 error = 0x01;
398 }
399 }
400 else if(modulation) {
401 Demod.sub = SUB_SECOND_HALF;
402 }
403
404 switch(Demod.state) {
405 case DEMOD_START_OF_COMMUNICATION:
406 if(Demod.sub == SUB_FIRST_HALF) {
407 Demod.state = DEMOD_MANCHESTER_D;
408 }
409 else {
410 Demod.output[Demod.len] = 0xab;
411 Demod.state = DEMOD_ERROR_WAIT;
412 error = 0x02;
413 }
414 break;
415
416 case DEMOD_MANCHESTER_D:
417 case DEMOD_MANCHESTER_E:
418 if(Demod.sub == SUB_FIRST_HALF) {
419 Demod.bitCount++;
420 Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100;
421 Demod.state = DEMOD_MANCHESTER_D;
422 }
423 else if(Demod.sub == SUB_SECOND_HALF) {
424 Demod.bitCount++;
425 Demod.shiftReg >>= 1;
426 Demod.state = DEMOD_MANCHESTER_E;
427 }
428 else {
429 Demod.state = DEMOD_MANCHESTER_F;
430 }
431 break;
432
433 case DEMOD_MANCHESTER_F:
434 // Tag response does not need to be a complete byte!
435 if(Demod.len > 0 || Demod.bitCount > 0) {
436 if(Demod.bitCount > 0) {
437 Demod.shiftReg >>= (9 - Demod.bitCount);
438 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
439 Demod.len++;
440 // No parity bit, so just shift a 0
441 Demod.parityBits <<= 1;
442 }
443
444 Demod.state = DEMOD_UNSYNCD;
445 return TRUE;
446 }
447 else {
448 Demod.output[Demod.len] = 0xad;
449 Demod.state = DEMOD_ERROR_WAIT;
450 error = 0x03;
451 }
452 break;
453
454 case DEMOD_ERROR_WAIT:
455 Demod.state = DEMOD_UNSYNCD;
456 break;
457
458 default:
459 Demod.output[Demod.len] = 0xdd;
460 Demod.state = DEMOD_UNSYNCD;
461 break;
462 }
463
464 if(Demod.bitCount>=9) {
465 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
466 Demod.len++;
467
468 Demod.parityBits <<= 1;
469 Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);
470
471 Demod.bitCount = 0;
472 Demod.shiftReg = 0;
473 }
474
475 /*if(error) {
476 Demod.output[Demod.len] = 0xBB;
477 Demod.len++;
478 Demod.output[Demod.len] = error & 0xFF;
479 Demod.len++;
480 Demod.output[Demod.len] = 0xBB;
481 Demod.len++;
482 Demod.output[Demod.len] = bit & 0xFF;
483 Demod.len++;
484 Demod.output[Demod.len] = Demod.buffer & 0xFF;
485 Demod.len++;
486 Demod.output[Demod.len] = Demod.syncBit & 0xFF;
487 Demod.len++;
488 Demod.output[Demod.len] = 0xBB;
489 Demod.len++;
490 return TRUE;
491 }*/
492
493 }
494
495 } // end (state != UNSYNCED)
496
497 return FALSE;
498 }
499
500 //=============================================================================
501 // Finally, a `sniffer' for ISO 14443 Type A
502 // Both sides of communication!
503 //=============================================================================
504
505 //-----------------------------------------------------------------------------
506 // Record the sequence of commands sent by the reader to the tag, with
507 // triggering so that we start recording at the point that the tag is moved
508 // near the reader.
509 //-----------------------------------------------------------------------------
510 void SnoopIso14443a(void)
511 {
512
513 // BIG CHANGE - UNDERSTAND THIS BEFORE WE COMMIT
514
515 #define RECV_CMD_OFFSET 3032
516 #define RECV_RES_OFFSET 3096
517 #define DMA_BUFFER_OFFSET 3160
518 #define DMA_BUFFER_SIZE 4096
519 #define TRACE_LENGTH 3000
520
521 // #define RECV_CMD_OFFSET 2032 // original (working as of 21/2/09) values
522 // #define RECV_RES_OFFSET 2096 // original (working as of 21/2/09) values
523 // #define DMA_BUFFER_OFFSET 2160 // original (working as of 21/2/09) values
524 // #define DMA_BUFFER_SIZE 4096 // original (working as of 21/2/09) values
525 // #define TRACE_LENGTH 2000 // original (working as of 21/2/09) values
526
527 // We won't start recording the frames that we acquire until we trigger;
528 // a good trigger condition to get started is probably when we see a
529 // response from the tag.
530 BOOL triggered = TRUE; // FALSE to wait first for card
531
532 // The command (reader -> tag) that we're receiving.
533 // The length of a received command will in most cases be no more than 18 bytes.
534 // So 32 should be enough!
535 BYTE *receivedCmd = (((BYTE *)BigBuf) + RECV_CMD_OFFSET);
536 // The response (tag -> reader) that we're receiving.
537 BYTE *receivedResponse = (((BYTE *)BigBuf) + RECV_RES_OFFSET);
538
539 // As we receive stuff, we copy it from receivedCmd or receivedResponse
540 // into trace, along with its length and other annotations.
541 BYTE *trace = (BYTE *)BigBuf;
542 int traceLen = 0;
543
544 // The DMA buffer, used to stream samples from the FPGA
545 SBYTE *dmaBuf = ((SBYTE *)BigBuf) + DMA_BUFFER_OFFSET;
546 int lastRxCounter;
547 SBYTE *upTo;
548 int smpl;
549 int maxBehindBy = 0;
550
551 // Count of samples received so far, so that we can include timing
552 // information in the trace buffer.
553 int samples = 0;
554 int rsamples = 0;
555
556 memset(trace, 0x44, RECV_CMD_OFFSET);
557
558 // Set up the demodulator for tag -> reader responses.
559 Demod.output = receivedResponse;
560 Demod.len = 0;
561 Demod.state = DEMOD_UNSYNCD;
562
563 // And the reader -> tag commands
564 memset(&Uart, 0, sizeof(Uart));
565 Uart.output = receivedCmd;
566 Uart.byteCntMax = 32; // was 100 (greg)////////////////////////////////////////////////////////////////////////
567 Uart.state = STATE_UNSYNCD;
568
569 // And put the FPGA in the appropriate mode
570 // Signal field is off with the appropriate LED
571 LED_D_OFF();
572 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER);
573 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
574
575 // Setup for the DMA.
576 FpgaSetupSsc();
577 upTo = dmaBuf;
578 lastRxCounter = DMA_BUFFER_SIZE;
579 FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
580
581 LED_A_ON();
582
583 // And now we loop, receiving samples.
584 for(;;) {
585 WDT_HIT();
586 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
587 (DMA_BUFFER_SIZE-1);
588 if(behindBy > maxBehindBy) {
589 maxBehindBy = behindBy;
590 if(behindBy > 400) {
591 DbpString("blew circular buffer!");
592 goto done;
593 }
594 }
595 if(behindBy < 1) continue;
596
597 smpl = upTo[0];
598 upTo++;
599 lastRxCounter -= 1;
600 if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
601 upTo -= DMA_BUFFER_SIZE;
602 lastRxCounter += DMA_BUFFER_SIZE;
603 AT91C_BASE_PDC_SSC->PDC_RNPR = (DWORD)upTo;
604 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
605 }
606
607 samples += 4;
608 #define HANDLE_BIT_IF_BODY \
609 LED_C_ON(); \
610 if(triggered) { \
611 trace[traceLen++] = ((rsamples >> 0) & 0xff); \
612 trace[traceLen++] = ((rsamples >> 8) & 0xff); \
613 trace[traceLen++] = ((rsamples >> 16) & 0xff); \
614 trace[traceLen++] = ((rsamples >> 24) & 0xff); \
615 trace[traceLen++] = ((Uart.parityBits >> 0) & 0xff); \
616 trace[traceLen++] = ((Uart.parityBits >> 8) & 0xff); \
617 trace[traceLen++] = ((Uart.parityBits >> 16) & 0xff); \
618 trace[traceLen++] = ((Uart.parityBits >> 24) & 0xff); \
619 trace[traceLen++] = Uart.byteCnt; \
620 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
621 traceLen += Uart.byteCnt; \
622 if(traceLen > TRACE_LENGTH) break; \
623 } \
624 /* And ready to receive another command. */ \
625 Uart.state = STATE_UNSYNCD; \
626 /* And also reset the demod code, which might have been */ \
627 /* false-triggered by the commands from the reader. */ \
628 Demod.state = DEMOD_UNSYNCD; \
629 LED_B_OFF(); \
630
631 if(MillerDecoding((smpl & 0xF0) >> 4)) {
632 rsamples = samples - Uart.samples;
633 HANDLE_BIT_IF_BODY
634 }
635 if(ManchesterDecoding(smpl & 0x0F)) {
636 rsamples = samples - Demod.samples;
637 LED_B_ON();
638
639 // timestamp, as a count of samples
640 trace[traceLen++] = ((rsamples >> 0) & 0xff);
641 trace[traceLen++] = ((rsamples >> 8) & 0xff);
642 trace[traceLen++] = ((rsamples >> 16) & 0xff);
643 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
644 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
645 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
646 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
647 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
648 // length
649 trace[traceLen++] = Demod.len;
650 memcpy(trace+traceLen, receivedResponse, Demod.len);
651 traceLen += Demod.len;
652 if(traceLen > TRACE_LENGTH) break;
653
654 triggered = TRUE;
655
656 // And ready to receive another response.
657 memset(&Demod, 0, sizeof(Demod));
658 Demod.output = receivedResponse;
659 Demod.state = DEMOD_UNSYNCD;
660 LED_C_OFF();
661 }
662
663 if(BUTTON_PRESS()) {
664 DbpString("cancelled_a");
665 goto done;
666 }
667 }
668
669 DbpString("COMMAND FINISHED");
670
671 DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
672 DbpIntegers(Uart.byteCntMax, traceLen, (int)Uart.output[0]);
673
674 done:
675 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
676 DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
677 DbpIntegers(Uart.byteCntMax, traceLen, (int)Uart.output[0]);
678 LED_A_OFF();
679 LED_B_OFF();
680 LED_C_OFF();
681 LED_D_OFF();
682 }
683
684 // Prepare communication bits to send to FPGA
685 void Sequence(SecType seq)
686 {
687 ToSendMax++;
688 switch(seq) {
689 // CARD TO READER
690 case SEC_D:
691 // Sequence D: 11110000
692 // modulation with subcarrier during first half
693 ToSend[ToSendMax] = 0xf0;
694 break;
695 case SEC_E:
696 // Sequence E: 00001111
697 // modulation with subcarrier during second half
698 ToSend[ToSendMax] = 0x0f;
699 break;
700 case SEC_F:
701 // Sequence F: 00000000
702 // no modulation with subcarrier
703 ToSend[ToSendMax] = 0x00;
704 break;
705 // READER TO CARD
706 case SEC_X:
707 // Sequence X: 00001100
708 // drop after half a period
709 ToSend[ToSendMax] = 0x0c;
710 break;
711 case SEC_Y:
712 default:
713 // Sequence Y: 00000000
714 // no drop
715 ToSend[ToSendMax] = 0x00;
716 break;
717 case SEC_Z:
718 // Sequence Z: 11000000
719 // drop at start
720 ToSend[ToSendMax] = 0xc0;
721 break;
722 }
723 }
724
725 //-----------------------------------------------------------------------------
726 // Prepare tag messages
727 //-----------------------------------------------------------------------------
728 static void CodeIso14443aAsTag(const BYTE *cmd, int len)
729 {
730 int i;
731 int oddparity;
732
733 ToSendReset();
734
735 // Correction bit, might be removed when not needed
736 ToSendStuffBit(0);
737 ToSendStuffBit(0);
738 ToSendStuffBit(0);
739 ToSendStuffBit(0);
740 ToSendStuffBit(1); // 1
741 ToSendStuffBit(0);
742 ToSendStuffBit(0);
743 ToSendStuffBit(0);
744
745 // Send startbit
746 Sequence(SEC_D);
747
748 for(i = 0; i < len; i++) {
749 int j;
750 BYTE b = cmd[i];
751
752 // Data bits
753 oddparity = 0x01;
754 for(j = 0; j < 8; j++) {
755 oddparity ^= (b & 1);
756 if(b & 1) {
757 Sequence(SEC_D);
758 } else {
759 Sequence(SEC_E);
760 }
761 b >>= 1;
762 }
763
764 // Parity bit
765 if(oddparity) {
766 Sequence(SEC_D);
767 } else {
768 Sequence(SEC_E);
769 }
770 }
771
772 // Send stopbit
773 Sequence(SEC_F);
774
775 // Flush the buffer in FPGA!!
776 for(i = 0; i < 5; i++) {
777 Sequence(SEC_F);
778 }
779
780 // Convert from last byte pos to length
781 ToSendMax++;
782
783 // Add a few more for slop
784 ToSend[ToSendMax++] = 0x00;
785 ToSend[ToSendMax++] = 0x00;
786 //ToSendMax += 2;
787 }
788
789 //-----------------------------------------------------------------------------
790 // This is to send a NACK kind of answer, its only 3 bits, I know it should be 4
791 //-----------------------------------------------------------------------------
792 static void CodeStrangeAnswer()
793 {
794 int i;
795
796 ToSendReset();
797
798 // Correction bit, might be removed when not needed
799 ToSendStuffBit(0);
800 ToSendStuffBit(0);
801 ToSendStuffBit(0);
802 ToSendStuffBit(0);
803 ToSendStuffBit(1); // 1
804 ToSendStuffBit(0);
805 ToSendStuffBit(0);
806 ToSendStuffBit(0);
807
808 // Send startbit
809 Sequence(SEC_D);
810
811 // 0
812 Sequence(SEC_E);
813
814 // 0
815 Sequence(SEC_E);
816
817 // 1
818 Sequence(SEC_D);
819
820 // Send stopbit
821 Sequence(SEC_F);
822
823 // Flush the buffer in FPGA!!
824 for(i = 0; i < 5; i++) {
825 Sequence(SEC_F);
826 }
827
828 // Convert from last byte pos to length
829 ToSendMax++;
830
831 // Add a few more for slop
832 ToSend[ToSendMax++] = 0x00;
833 ToSend[ToSendMax++] = 0x00;
834 //ToSendMax += 2;
835 }
836
837 //-----------------------------------------------------------------------------
838 // Wait for commands from reader
839 // Stop when button is pressed
840 // Or return TRUE when command is captured
841 //-----------------------------------------------------------------------------
842 static BOOL GetIso14443aCommandFromReader(BYTE *received, int *len, int maxLen)
843 {
844 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
845 // only, since we are receiving, not transmitting).
846 // Signal field is off with the appropriate LED
847 LED_D_OFF();
848 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
849
850 // Now run a `software UART' on the stream of incoming samples.
851 Uart.output = received;
852 Uart.byteCntMax = maxLen;
853 Uart.state = STATE_UNSYNCD;
854
855 for(;;) {
856 WDT_HIT();
857
858 if(BUTTON_PRESS()) return FALSE;
859
860 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
861 AT91C_BASE_SSC->SSC_THR = 0x00;
862 }
863 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
864 BYTE b = (BYTE)AT91C_BASE_SSC->SSC_RHR;
865 if(MillerDecoding((b & 0xf0) >> 4)) {
866 *len = Uart.byteCnt;
867 return TRUE;
868 }
869 if(MillerDecoding(b & 0x0f)) {
870 *len = Uart.byteCnt;
871 return TRUE;
872 }
873 }
874 }
875 }
876
877 //-----------------------------------------------------------------------------
878 // Main loop of simulated tag: receive commands from reader, decide what
879 // response to send, and send it.
880 //-----------------------------------------------------------------------------
881 void SimulateIso14443aTag(int tagType, int TagUid)
882 {
883 // This function contains the tag emulation
884
885 // Prepare protocol messages
886 // static const BYTE cmd1[] = { 0x26 };
887 // static const BYTE response1[] = { 0x02, 0x00 }; // Says: I am Mifare 4k - original line - greg
888 //
889 static const BYTE response1[] = { 0x44, 0x03 }; // Says: I am a DESFire Tag, ph33r me
890 // static const BYTE response1[] = { 0x44, 0x00 }; // Says: I am a ULTRALITE Tag, 0wn me
891
892 // UID response
893 // static const BYTE cmd2[] = { 0x93, 0x20 };
894 //static const BYTE response2[] = { 0x9a, 0xe5, 0xe4, 0x43, 0xd8 }; // original value - greg
895
896
897
898 // my desfire
899 static const BYTE response2[] = { 0x88, 0x04, 0x21, 0x3f, 0x4d }; // known uid - note cascade (0x88), 2nd byte (0x04) = NXP/Phillips
900
901
902 // When reader selects us during cascade1 it will send cmd3
903 //BYTE response3[] = { 0x04, 0x00, 0x00 }; // SAK Select (cascade1) successful response (ULTRALITE)
904 BYTE response3[] = { 0x24, 0x00, 0x00 }; // SAK Select (cascade1) successful response (DESFire)
905 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
906
907 // send cascade2 2nd half of UID
908 static const BYTE response2a[] = { 0x51, 0x48, 0x1d, 0x80, 0x84 }; // uid - cascade2 - 2nd half (4 bytes) of UID+ BCCheck
909 // NOTE : THE CRC on the above may be wrong as I have obfuscated the actual UID
910
911
912 // When reader selects us during cascade2 it will send cmd3a
913 //BYTE response3a[] = { 0x00, 0x00, 0x00 }; // SAK Select (cascade2) successful response (ULTRALITE)
914 BYTE response3a[] = { 0x20, 0x00, 0x00 }; // SAK Select (cascade2) successful response (DESFire)
915 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
916
917 static const BYTE response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
918
919 BYTE *resp;
920 int respLen;
921
922 // Longest possible response will be 16 bytes + 2 CRC = 18 bytes
923 // This will need
924 // 144 data bits (18 * 8)
925 // 18 parity bits
926 // 2 Start and stop
927 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
928 // 1 just for the case
929 // ----------- +
930 // 166
931 //
932 // 166 bytes, since every bit that needs to be send costs us a byte
933 //
934
935
936 // Respond with card type
937 BYTE *resp1 = (((BYTE *)BigBuf) + 800);
938 int resp1Len;
939
940 // Anticollision cascade1 - respond with uid
941 BYTE *resp2 = (((BYTE *)BigBuf) + 970);
942 int resp2Len;
943
944 // Anticollision cascade2 - respond with 2nd half of uid if asked
945 // we're only going to be asked if we set the 1st byte of the UID (during cascade1) to 0x88
946 BYTE *resp2a = (((BYTE *)BigBuf) + 1140);
947 int resp2aLen;
948
949 // Acknowledge select - cascade 1
950 BYTE *resp3 = (((BYTE *)BigBuf) + 1310);
951 int resp3Len;
952
953 // Acknowledge select - cascade 2
954 BYTE *resp3a = (((BYTE *)BigBuf) + 1480);
955 int resp3aLen;
956
957 // Response to a read request - not implemented atm
958 BYTE *resp4 = (((BYTE *)BigBuf) + 1550);
959 int resp4Len;
960
961 // Authenticate response - nonce
962 BYTE *resp5 = (((BYTE *)BigBuf) + 1720);
963 int resp5Len;
964
965 BYTE *receivedCmd = (BYTE *)BigBuf;
966 int len;
967
968 int i;
969 int u;
970 BYTE b;
971
972 // To control where we are in the protocol
973 int order = 0;
974 int lastorder;
975
976 // Just to allow some checks
977 int happened = 0;
978 int happened2 = 0;
979
980 int cmdsRecvd = 0;
981
982 BOOL fdt_indicator;
983
984 memset(receivedCmd, 0x44, 400);
985
986 // Prepare the responses of the anticollision phase
987 // there will be not enough time to do this at the moment the reader sends it REQA
988
989 // Answer to request
990 CodeIso14443aAsTag(response1, sizeof(response1));
991 memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
992
993 // Send our UID (cascade 1)
994 CodeIso14443aAsTag(response2, sizeof(response2));
995 memcpy(resp2, ToSend, ToSendMax); resp2Len = ToSendMax;
996
997 // Answer to select (cascade1)
998 CodeIso14443aAsTag(response3, sizeof(response3));
999 memcpy(resp3, ToSend, ToSendMax); resp3Len = ToSendMax;
1000
1001 // Send the cascade 2 2nd part of the uid
1002 CodeIso14443aAsTag(response2a, sizeof(response2a));
1003 memcpy(resp2a, ToSend, ToSendMax); resp2aLen = ToSendMax;
1004
1005 // Answer to select (cascade 2)
1006 CodeIso14443aAsTag(response3a, sizeof(response3a));
1007 memcpy(resp3a, ToSend, ToSendMax); resp3aLen = ToSendMax;
1008
1009 // Strange answer is an example of rare message size (3 bits)
1010 CodeStrangeAnswer();
1011 memcpy(resp4, ToSend, ToSendMax); resp4Len = ToSendMax;
1012
1013 // Authentication answer (random nonce)
1014 CodeIso14443aAsTag(response5, sizeof(response5));
1015 memcpy(resp5, ToSend, ToSendMax); resp5Len = ToSendMax;
1016
1017 // We need to listen to the high-frequency, peak-detected path.
1018 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1019 FpgaSetupSsc();
1020
1021 cmdsRecvd = 0;
1022
1023 LED_A_ON();
1024 for(;;) {
1025
1026 if(!GetIso14443aCommandFromReader(receivedCmd, &len, 100)) {
1027 DbpString("button press");
1028 break;
1029 }
1030 // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
1031 // Okay, look at the command now.
1032 lastorder = order;
1033 i = 1; // first byte transmitted
1034 if(receivedCmd[0] == 0x26) {
1035 // Received a REQUEST
1036 resp = resp1; respLen = resp1Len; order = 1;
1037 //DbpString("Hello request from reader:");
1038 } else if(receivedCmd[0] == 0x52) {
1039 // Received a WAKEUP
1040 resp = resp1; respLen = resp1Len; order = 6;
1041 // //DbpString("Wakeup request from reader:");
1042
1043 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // greg - cascade 1 anti-collision
1044 // Received request for UID (cascade 1)
1045 resp = resp2; respLen = resp2Len; order = 2;
1046 // DbpString("UID (cascade 1) request from reader:");
1047 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1048
1049
1050 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] ==0x95) { // greg - cascade 2 anti-collision
1051 // Received request for UID (cascade 2)
1052 resp = resp2a; respLen = resp2aLen; order = 20;
1053 // DbpString("UID (cascade 2) request from reader:");
1054 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1055
1056
1057 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] ==0x93) { // greg - cascade 1 select
1058 // Received a SELECT
1059 resp = resp3; respLen = resp3Len; order = 3;
1060 // DbpString("Select (cascade 1) request from reader:");
1061 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1062
1063
1064 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] ==0x95) { // greg - cascade 2 select
1065 // Received a SELECT
1066 resp = resp3a; respLen = resp3aLen; order = 30;
1067 // DbpString("Select (cascade 2) request from reader:");
1068 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1069
1070
1071 } else if(receivedCmd[0] == 0x30) {
1072 // Received a READ
1073 resp = resp4; respLen = resp4Len; order = 4; // Do nothing
1074 DbpString("Read request from reader:");
1075 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1076
1077
1078 } else if(receivedCmd[0] == 0x50) {
1079 // Received a HALT
1080 resp = resp1; respLen = 0; order = 5; // Do nothing
1081 DbpString("Reader requested we HALT!:");
1082
1083 } else if(receivedCmd[0] == 0x60) {
1084 // Received an authentication request
1085 resp = resp5; respLen = resp5Len; order = 7;
1086 DbpString("Authenticate request from reader:");
1087 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1088
1089 } else if(receivedCmd[0] == 0xE0) {
1090 // Received a RATS request
1091 resp = resp1; respLen = 0;order = 70;
1092 DbpString("RATS request from reader:");
1093 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1094 } else {
1095 // Never seen this command before
1096 DbpString("Unknown command received from reader:");
1097 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1098 DbpIntegers(receivedCmd[3], receivedCmd[4], receivedCmd[5]);
1099 DbpIntegers(receivedCmd[6], receivedCmd[7], receivedCmd[8]);
1100
1101 // Do not respond
1102 resp = resp1; respLen = 0; order = 0;
1103 }
1104
1105 // Count number of wakeups received after a halt
1106 if(order == 6 && lastorder == 5) { happened++; }
1107
1108 // Count number of other messages after a halt
1109 if(order != 6 && lastorder == 5) { happened2++; }
1110
1111 // Look at last parity bit to determine timing of answer
1112 if((Uart.parityBits & 0x01) || receivedCmd[0] == 0x52) {
1113 // 1236, so correction bit needed
1114 i = 0;
1115 }
1116
1117 memset(receivedCmd, 0x44, 32);
1118
1119 if(cmdsRecvd > 999) {
1120 DbpString("1000 commands later...");
1121 break;
1122 }
1123 else {
1124 cmdsRecvd++;
1125 }
1126
1127 if(respLen <= 0) continue;
1128
1129 // Modulate Manchester
1130 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1131 AT91C_BASE_SSC->SSC_THR = 0x00;
1132 FpgaSetupSsc();
1133
1134 // ### Transmit the response ###
1135 u = 0;
1136 b = 0x00;
1137 fdt_indicator = FALSE;
1138 for(;;) {
1139 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1140 volatile BYTE b = (BYTE)AT91C_BASE_SSC->SSC_RHR;
1141 (void)b;
1142 }
1143 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1144 if(i > respLen) {
1145 b = 0x00;
1146 u++;
1147 } else {
1148 b = resp[i];
1149 i++;
1150 }
1151 AT91C_BASE_SSC->SSC_THR = b;
1152
1153 if(u > 4) {
1154 break;
1155 }
1156 }
1157 if(BUTTON_PRESS()) {
1158 break;
1159 }
1160 }
1161
1162 }
1163
1164 DbpIntegers(happened, happened2, cmdsRecvd);
1165 LED_A_OFF();
1166 }
1167
1168 //-----------------------------------------------------------------------------
1169 // Transmit the command (to the tag) that was placed in ToSend[].
1170 //-----------------------------------------------------------------------------
1171 static void TransmitFor14443a(const BYTE *cmd, int len, int *samples, int *wait)
1172 {
1173 int c;
1174
1175 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1176
1177 if(*wait < 10) { *wait = 10; }
1178
1179 for(c = 0; c < *wait;) {
1180 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1181 AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
1182 c++;
1183 }
1184 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1185 volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;
1186 (void)r;
1187 }
1188 WDT_HIT();
1189 }
1190
1191 c = 0;
1192 for(;;) {
1193 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1194 AT91C_BASE_SSC->SSC_THR = cmd[c];
1195 c++;
1196 if(c >= len) {
1197 break;
1198 }
1199 }
1200 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1201 volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;
1202 (void)r;
1203 }
1204 WDT_HIT();
1205 }
1206 *samples = (c + *wait) << 3;
1207 }
1208
1209 //-----------------------------------------------------------------------------
1210 // To generate an arbitrary stream from reader
1211 //
1212 //-----------------------------------------------------------------------------
1213 void ArbitraryFromReader(const BYTE *cmd, int parity, int len)
1214 {
1215 int i;
1216 int j;
1217 int last;
1218 BYTE b;
1219
1220 ToSendReset();
1221
1222 // Start of Communication (Seq. Z)
1223 Sequence(SEC_Z);
1224 last = 0;
1225
1226 for(i = 0; i < len; i++) {
1227 // Data bits
1228 b = cmd[i];
1229 for(j = 0; j < 8; j++) {
1230 if(b & 1) {
1231 // Sequence X
1232 Sequence(SEC_X);
1233 last = 1;
1234 } else {
1235 if(last == 0) {
1236 // Sequence Z
1237 Sequence(SEC_Z);
1238 }
1239 else {
1240 // Sequence Y
1241 Sequence(SEC_Y);
1242 last = 0;
1243 }
1244 }
1245 b >>= 1;
1246
1247 }
1248
1249 // Predefined parity bit, the flipper flips when needed, because of flips in byte sent
1250 if(((parity >> (len - i - 1)) & 1)) {
1251 // Sequence X
1252 Sequence(SEC_X);
1253 last = 1;
1254 } else {
1255 if(last == 0) {
1256 // Sequence Z
1257 Sequence(SEC_Z);
1258 }
1259 else {
1260 // Sequence Y
1261 Sequence(SEC_Y);
1262 last = 0;
1263 }
1264 }
1265 }
1266
1267 // End of Communication
1268 if(last == 0) {
1269 // Sequence Z
1270 Sequence(SEC_Z);
1271 }
1272 else {
1273 // Sequence Y
1274 Sequence(SEC_Y);
1275 last = 0;
1276 }
1277 // Sequence Y
1278 Sequence(SEC_Y);
1279
1280 // Just to be sure!
1281 Sequence(SEC_Y);
1282 Sequence(SEC_Y);
1283 Sequence(SEC_Y);
1284
1285 // Convert from last character reference to length
1286 ToSendMax++;
1287 }
1288
1289 //-----------------------------------------------------------------------------
1290 // Code a 7-bit command without parity bit
1291 // This is especially for 0x26 and 0x52 (REQA and WUPA)
1292 //-----------------------------------------------------------------------------
1293 void ShortFrameFromReader(const BYTE *cmd)
1294 {
1295 int j;
1296 int last;
1297 BYTE b;
1298
1299 ToSendReset();
1300
1301 // Start of Communication (Seq. Z)
1302 Sequence(SEC_Z);
1303 last = 0;
1304
1305 b = cmd[0];
1306 for(j = 0; j < 7; j++) {
1307 if(b & 1) {
1308 // Sequence X
1309 Sequence(SEC_X);
1310 last = 1;
1311 } else {
1312 if(last == 0) {
1313 // Sequence Z
1314 Sequence(SEC_Z);
1315 }
1316 else {
1317 // Sequence Y
1318 Sequence(SEC_Y);
1319 last = 0;
1320 }
1321 }
1322 b >>= 1;
1323 }
1324
1325 // End of Communication
1326 if(last == 0) {
1327 // Sequence Z
1328 Sequence(SEC_Z);
1329 }
1330 else {
1331 // Sequence Y
1332 Sequence(SEC_Y);
1333 last = 0;
1334 }
1335 // Sequence Y
1336 Sequence(SEC_Y);
1337
1338 // Just to be sure!
1339 Sequence(SEC_Y);
1340 Sequence(SEC_Y);
1341 Sequence(SEC_Y);
1342
1343 // Convert from last character reference to length
1344 ToSendMax++;
1345 }
1346
1347 //-----------------------------------------------------------------------------
1348 // Prepare reader command to send to FPGA
1349 //
1350 //-----------------------------------------------------------------------------
1351 void CodeIso14443aAsReader(const BYTE *cmd, int len)
1352 {
1353 int i, j;
1354 int last;
1355 int oddparity;
1356 BYTE b;
1357
1358 ToSendReset();
1359
1360 // Start of Communication (Seq. Z)
1361 Sequence(SEC_Z);
1362 last = 0;
1363
1364 for(i = 0; i < len; i++) {
1365 // Data bits
1366 b = cmd[i];
1367 oddparity = 0x01;
1368 for(j = 0; j < 8; j++) {
1369 oddparity ^= (b & 1);
1370 if(b & 1) {
1371 // Sequence X
1372 Sequence(SEC_X);
1373 last = 1;
1374 } else {
1375 if(last == 0) {
1376 // Sequence Z
1377 Sequence(SEC_Z);
1378 }
1379 else {
1380 // Sequence Y
1381 Sequence(SEC_Y);
1382 last = 0;
1383 }
1384 }
1385 b >>= 1;
1386 }
1387
1388 // Parity bit
1389 if(oddparity) {
1390 // Sequence X
1391 Sequence(SEC_X);
1392 last = 1;
1393 } else {
1394 if(last == 0) {
1395 // Sequence Z
1396 Sequence(SEC_Z);
1397 }
1398 else {
1399 // Sequence Y
1400 Sequence(SEC_Y);
1401 last = 0;
1402 }
1403 }
1404 }
1405
1406 // End of Communication
1407 if(last == 0) {
1408 // Sequence Z
1409 Sequence(SEC_Z);
1410 }
1411 else {
1412 // Sequence Y
1413 Sequence(SEC_Y);
1414 last = 0;
1415 }
1416 // Sequence Y
1417 Sequence(SEC_Y);
1418
1419 // Just to be sure!
1420 Sequence(SEC_Y);
1421 Sequence(SEC_Y);
1422 Sequence(SEC_Y);
1423
1424 // Convert from last character reference to length
1425 ToSendMax++;
1426 }
1427
1428
1429 //-----------------------------------------------------------------------------
1430 // Wait a certain time for tag response
1431 // If a response is captured return TRUE
1432 // If it takes to long return FALSE
1433 //-----------------------------------------------------------------------------
1434 static BOOL GetIso14443aAnswerFromTag(BYTE *receivedResponse, int maxLen, int *samples, int *elapsed) //BYTE *buffer
1435 {
1436 // buffer needs to be 512 bytes
1437 int c;
1438
1439 // Set FPGA mode to "reader listen mode", no modulation (listen
1440 // only, since we are receiving, not transmitting).
1441 // Signal field is on with the appropriate LED
1442 LED_D_ON();
1443 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1444
1445 // Now get the answer from the card
1446 Demod.output = receivedResponse;
1447 Demod.len = 0;
1448 Demod.state = DEMOD_UNSYNCD;
1449
1450 BYTE b;
1451 *elapsed = 0;
1452
1453 c = 0;
1454 for(;;) {
1455 WDT_HIT();
1456
1457 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1458 AT91C_BASE_SSC->SSC_THR = 0x00; // To make use of exact timing of next command from reader!!
1459 (*elapsed)++;
1460 }
1461 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1462 if(c < 512) { c++; } else { return FALSE; }
1463 b = (BYTE)AT91C_BASE_SSC->SSC_RHR;
1464 if(ManchesterDecoding((b & 0xf0) >> 4)) {
1465 *samples = ((c - 1) << 3) + 4;
1466 return TRUE;
1467 }
1468 if(ManchesterDecoding(b & 0x0f)) {
1469 *samples = c << 3;
1470 return TRUE;
1471 }
1472 }
1473 }
1474 }
1475
1476 //-----------------------------------------------------------------------------
1477 // Read an ISO 14443a tag. Send out commands and store answers.
1478 //
1479 //-----------------------------------------------------------------------------
1480 void ReaderIso14443a(DWORD parameter)
1481 {
1482 // Anticollision
1483 static const BYTE cmd1[] = { 0x52 }; // or 0x26
1484 static const BYTE cmd2[] = { 0x93,0x20 };
1485 // UID = 0x2a,0x69,0x8d,0x43,0x8d, last two bytes are CRC bytes
1486 BYTE cmd3[] = { 0x93,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1487
1488 // For Ultralight add an extra anticollission layer -> 95 20 and then 95 70
1489
1490 // greg - here we will add our cascade level 2 anticolission and select functions to deal with ultralight // and 7-byte UIDs in generall...
1491 BYTE cmd4[] = {0x95,0x20}; // ask for cascade 2 select
1492 // 95 20
1493 //BYTE cmd3a[] = { 0x95,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1494 // 95 70
1495
1496 // cascade 2 select
1497 BYTE cmd5[] = { 0x95,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1498
1499
1500 // RATS (request for answer to select)
1501 //BYTE cmd6[] = { 0xe0,0x50,0xbc,0xa5 }; // original RATS
1502 BYTE cmd6[] = { 0xe0,0x21,0xb2,0xc7 }; // Desfire RATS
1503
1504 // Mifare AUTH
1505 BYTE cmd7[] = { 0x60, 0x00, 0x00, 0x00 };
1506
1507 int reqaddr = 2024; // was 2024 - tied to other size changes
1508 int reqsize = 60;
1509
1510 BYTE *req1 = (((BYTE *)BigBuf) + reqaddr);
1511 int req1Len;
1512
1513 BYTE *req2 = (((BYTE *)BigBuf) + reqaddr + reqsize);
1514 int req2Len;
1515
1516 BYTE *req3 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 2));
1517 int req3Len;
1518
1519 // greg added req 4 & 5 to deal with cascade 2 section
1520 BYTE *req4 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 3));
1521 int req4Len;
1522
1523 BYTE *req5 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 4));
1524 int req5Len;
1525
1526 BYTE *req6 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 5));
1527 int req6Len;
1528
1529 BYTE *req7 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 6));
1530 int req7Len;
1531
1532 BYTE *receivedAnswer = (((BYTE *)BigBuf) + 3560); // was 3560 - tied to other size changes
1533
1534 BYTE *trace = (BYTE *)BigBuf;
1535 int traceLen = 0;
1536 int rsamples = 0;
1537
1538 memset(trace, 0x44, 2000); // was 2000 - tied to oter size chnages
1539 // setting it to 3000 causes no tag responses to be detected (2900 is ok)
1540 // setting it to 1000 causes no tag responses to be detected
1541
1542 // Prepare some commands!
1543 ShortFrameFromReader(cmd1);
1544 memcpy(req1, ToSend, ToSendMax); req1Len = ToSendMax;
1545
1546 CodeIso14443aAsReader(cmd2, sizeof(cmd2));
1547 memcpy(req2, ToSend, ToSendMax); req2Len = ToSendMax;
1548
1549 CodeIso14443aAsReader(cmd3, sizeof(cmd3));
1550 memcpy(req3, ToSend, ToSendMax); req3Len = ToSendMax;
1551
1552
1553 CodeIso14443aAsReader(cmd4, sizeof(cmd4)); // 4 is cascade 2 request
1554 memcpy(req4, ToSend, ToSendMax); req4Len = ToSendMax;
1555
1556
1557 CodeIso14443aAsReader(cmd5, sizeof(cmd5)); // 5 is cascade 2 select
1558 memcpy(req5, ToSend, ToSendMax); req5Len = ToSendMax;
1559
1560
1561 CodeIso14443aAsReader(cmd6, sizeof(cmd6));
1562 memcpy(req6, ToSend, ToSendMax); req6Len = ToSendMax;
1563
1564 // Setup SSC
1565 FpgaSetupSsc();
1566
1567 // Start from off (no field generated)
1568 // Signal field is off with the appropriate LED
1569 LED_D_OFF();
1570 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1571 SpinDelay(200);
1572
1573 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1574 FpgaSetupSsc();
1575
1576 // Now give it time to spin up.
1577 // Signal field is on with the appropriate LED
1578 LED_D_ON();
1579 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1580 SpinDelay(200);
1581
1582 LED_A_ON();
1583 LED_B_OFF();
1584 LED_C_OFF();
1585
1586 int samples = 0;
1587 int tsamples = 0;
1588 int wait = 0;
1589 int elapsed = 0;
1590
1591 for(;;) {
1592 // Send WUPA (or REQA)
1593 TransmitFor14443a(req1, req1Len, &tsamples, &wait);
1594 // Store answer in buffer
1595 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1596 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1597 trace[traceLen++] = 1;
1598 memcpy(trace+traceLen, cmd1, 1);
1599 traceLen += 1;
1600 if(traceLen > TRACE_LENGTH) goto done;
1601
1602 while(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1603 if(BUTTON_PRESS()) goto done;
1604
1605 // No answer, just continue polling
1606 TransmitFor14443a(req1, req1Len, &tsamples, &wait);
1607 // Store answer in buffer
1608 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1609 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1610 trace[traceLen++] = 1;
1611 memcpy(trace+traceLen, cmd1, 1);
1612 traceLen += 1;
1613 if(traceLen > TRACE_LENGTH) goto done;
1614 }
1615
1616 // Store answer in buffer
1617 rsamples = rsamples + (samples - Demod.samples);
1618 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1619 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1620 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1621 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1622 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1623 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1624 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1625 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1626 trace[traceLen++] = Demod.len;
1627 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1628 traceLen += Demod.len;
1629 if(traceLen > TRACE_LENGTH) goto done;
1630
1631 // Ask for card UID
1632 TransmitFor14443a(req2, req2Len, &tsamples, &wait);
1633 // Store answer in buffer
1634 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1635 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1636 trace[traceLen++] = 2;
1637 memcpy(trace+traceLen, cmd2, 2);
1638 traceLen += 2;
1639 if(traceLen > TRACE_LENGTH) goto done;
1640
1641 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1642 continue;
1643 }
1644
1645 // Store answer in buffer
1646 rsamples = rsamples + (samples - Demod.samples);
1647 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1648 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1649 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1650 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1651 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1652 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1653 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1654 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1655 trace[traceLen++] = Demod.len;
1656 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1657 traceLen += Demod.len;
1658 if(traceLen > TRACE_LENGTH) goto done;
1659
1660 // Construct SELECT UID command
1661 // First copy the 5 bytes (Mifare Classic) after the 93 70
1662 memcpy(cmd3+2,receivedAnswer,5);
1663 // Secondly compute the two CRC bytes at the end
1664 ComputeCrc14443(CRC_14443_A, cmd3, 7, &cmd3[7], &cmd3[8]);
1665 // Prepare the bit sequence to modulate the subcarrier
1666 // Store answer in buffer
1667 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1668 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1669 trace[traceLen++] = 9;
1670 memcpy(trace+traceLen, cmd3, 9);
1671 traceLen += 9;
1672 if(traceLen > TRACE_LENGTH) goto done;
1673 CodeIso14443aAsReader(cmd3, sizeof(cmd3));
1674 memcpy(req3, ToSend, ToSendMax); req3Len = ToSendMax;
1675
1676 // Select the card
1677 TransmitFor14443a(req3, req3Len, &samples, &wait);
1678 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1679 continue;
1680 }
1681
1682 // Store answer in buffer
1683 rsamples = rsamples + (samples - Demod.samples);
1684 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1685 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1686 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1687 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1688 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1689 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1690 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1691 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1692 trace[traceLen++] = Demod.len;
1693 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1694 traceLen += Demod.len;
1695 if(traceLen > TRACE_LENGTH) goto done;
1696
1697 // OK we have selected at least at cascade 1, lets see if first byte of UID was 0x88 in
1698 // which case we need to make a cascade 2 request and select - this is a long UID
1699 if (receivedAnswer[0] == 0x88)
1700 {
1701 // Do cascade level 2 stuff
1702 ///////////////////////////////////////////////////////////////////
1703 // First issue a '95 20' identify request
1704 // Ask for card UID (part 2)
1705 TransmitFor14443a(req4, req4Len, &tsamples, &wait);
1706 // Store answer in buffer
1707 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1708 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1709 trace[traceLen++] = 2;
1710 memcpy(trace+traceLen, cmd4, 2);
1711 traceLen += 2;
1712 if(traceLen > TRACE_LENGTH) {
1713 DbpString("Bugging out, just popped tracelength");
1714 goto done;}
1715
1716 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1717 continue;
1718 }
1719 // Store answer in buffer
1720 rsamples = rsamples + (samples - Demod.samples);
1721 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1722 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1723 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1724 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1725 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1726 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1727 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1728 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1729 trace[traceLen++] = Demod.len;
1730 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1731 traceLen += Demod.len;
1732 if(traceLen > TRACE_LENGTH) goto done;
1733 //////////////////////////////////////////////////////////////////
1734 // Then Construct SELECT UID (cascasde 2) command
1735 DbpString("Just about to copy the UID out of the cascade 2 id req");
1736 // First copy the 5 bytes (Mifare Classic) after the 95 70
1737 memcpy(cmd5+2,receivedAnswer,5);
1738 // Secondly compute the two CRC bytes at the end
1739 ComputeCrc14443(CRC_14443_A, cmd4, 7, &cmd5[7], &cmd5[8]);
1740 // Prepare the bit sequence to modulate the subcarrier
1741 // Store answer in buffer
1742 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1743 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1744 trace[traceLen++] = 9;
1745 memcpy(trace+traceLen, cmd5, 9);
1746 traceLen += 9;
1747 if(traceLen > TRACE_LENGTH) goto done;
1748 CodeIso14443aAsReader(cmd5, sizeof(cmd5));
1749 memcpy(req5, ToSend, ToSendMax); req5Len = ToSendMax;
1750
1751 // Select the card
1752 TransmitFor14443a(req4, req4Len, &samples, &wait);
1753 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1754 continue;
1755 }
1756
1757 // Store answer in buffer
1758 rsamples = rsamples + (samples - Demod.samples);
1759 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1760 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1761 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1762 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1763 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1764 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1765 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1766 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1767 trace[traceLen++] = Demod.len;
1768 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1769 traceLen += Demod.len;
1770 if(traceLen > TRACE_LENGTH) goto done;
1771
1772 }
1773
1774 // Secondly compute the two CRC bytes at the end
1775 ComputeCrc14443(CRC_14443_A, cmd7, 2, &cmd7[2], &cmd7[3]);
1776 CodeIso14443aAsReader(cmd7, sizeof(cmd7));
1777 memcpy(req7, ToSend, ToSendMax); req7Len = ToSendMax;
1778 // Send authentication request (Mifare Classic)
1779 TransmitFor14443a(req7, req7Len, &samples, &wait);
1780 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1781 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1782 trace[traceLen++] = 4;
1783 memcpy(trace+traceLen, cmd7, 4);
1784 traceLen += 4;
1785 if(traceLen > TRACE_LENGTH) goto done;
1786 if(GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1787 rsamples++;
1788 // We received probably a random, continue and trace!
1789 }
1790 else {
1791 // Received nothing
1792 continue;
1793 }
1794
1795 // Trace the random, i'm curious
1796 rsamples = rsamples + (samples - Demod.samples);
1797 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1798 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1799 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1800 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1801 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1802 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1803 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1804 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1805 trace[traceLen++] = Demod.len;
1806 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1807 traceLen += Demod.len;
1808 if(traceLen > TRACE_LENGTH) goto done;
1809
1810 // Thats it...
1811 }
1812
1813 done:
1814 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1815 LEDsoff();
1816 DbpIntegers(rsamples, 0xCC, 0xCC);
1817 DbpString("ready..");
1818 }
Proxmark3 GIT tracking
Impressum, Datenschutz