]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso15693.c
projects / proxmark3-svn / blob
? search:


c286d6344859d242e45d41fca52c05e0bb2824f2
[proxmark3-svn] / armsrc / iso15693.c
1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
3 // Modified by Greg Jones, Jan 2009
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // Routines to support ISO 15693. This includes both the reader software and
10 // the `fake tag' modes, but at the moment I've implemented only the reader
11 // stuff, and that barely.
12 // Modified to perform modulation onboard in arm rather than on PC
13 // Also added additional reader commands (SELECT, READ etc.)
14 //-----------------------------------------------------------------------------
15
16 #include "proxmark3.h"
17 #include "util.h"
18 #include "apps.h"
19 #include "string.h"
20
21 // FROM winsrc\prox.h //////////////////////////////////
22 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
23
24 //-----------------------------------------------------------------------------
25 // Map a sequence of octets (~layer 2 command) into the set of bits to feed
26 // to the FPGA, to transmit that command to the tag.
27 //-----------------------------------------------------------------------------
28
29 // The sampling rate is 106.353 ksps/s, for T = 18.8 us
30
31 // SOF defined as
32 // 1) Unmodulated time of 56.64us
33 // 2) 24 pulses of 423.75khz
34 // 3) logic '1' (unmodulated for 18.88us followed by 8 pulses of 423.75khz)
35
36 static const int FrameSOF[] = {
37 -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
38 -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
39 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
40 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
41 -1, -1, -1, -1,
42 -1, -1, -1, -1,
43 1, 1, 1, 1,
44 1, 1, 1, 1
45 };
46 static const int Logic0[] = {
47 1, 1, 1, 1,
48 1, 1, 1, 1,
49 -1, -1, -1, -1,
50 -1, -1, -1, -1
51 };
52 static const int Logic1[] = {
53 -1, -1, -1, -1,
54 -1, -1, -1, -1,
55 1, 1, 1, 1,
56 1, 1, 1, 1
57 };
58
59 // EOF defined as
60 // 1) logic '0' (8 pulses of 423.75khz followed by unmodulated for 18.88us)
61 // 2) 24 pulses of 423.75khz
62 // 3) Unmodulated time of 56.64us
63
64 static const int FrameEOF[] = {
65 1, 1, 1, 1,
66 1, 1, 1, 1,
67 -1, -1, -1, -1,
68 -1, -1, -1, -1,
69 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
70 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
71 -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
72 -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
73 };
74
75 static void CodeIso15693AsReader(uint8_t *cmd, int n)
76 {
77 int i, j;
78
79 ToSendReset();
80
81 // Give it a bit of slack at the beginning
82 for(i = 0; i < 24; i++) {
83 ToSendStuffBit(1);
84 }
85
86 ToSendStuffBit(0);
87 ToSendStuffBit(1);
88 ToSendStuffBit(1);
89 ToSendStuffBit(1);
90 ToSendStuffBit(1);
91 ToSendStuffBit(0);
92 ToSendStuffBit(1);
93 ToSendStuffBit(1);
94 for(i = 0; i < n; i++) {
95 for(j = 0; j < 8; j += 2) {
96 int these = (cmd[i] >> j) & 3;
97 switch(these) {
98 case 0:
99 ToSendStuffBit(1);
100 ToSendStuffBit(0);
101 ToSendStuffBit(1);
102 ToSendStuffBit(1);
103 ToSendStuffBit(1);
104 ToSendStuffBit(1);
105 ToSendStuffBit(1);
106 ToSendStuffBit(1);
107 break;
108 case 1:
109 ToSendStuffBit(1);
110 ToSendStuffBit(1);
111 ToSendStuffBit(1);
112 ToSendStuffBit(0);
113 ToSendStuffBit(1);
114 ToSendStuffBit(1);
115 ToSendStuffBit(1);
116 ToSendStuffBit(1);
117 break;
118 case 2:
119 ToSendStuffBit(1);
120 ToSendStuffBit(1);
121 ToSendStuffBit(1);
122 ToSendStuffBit(1);
123 ToSendStuffBit(1);
124 ToSendStuffBit(0);
125 ToSendStuffBit(1);
126 ToSendStuffBit(1);
127 break;
128 case 3:
129 ToSendStuffBit(1);
130 ToSendStuffBit(1);
131 ToSendStuffBit(1);
132 ToSendStuffBit(1);
133 ToSendStuffBit(1);
134 ToSendStuffBit(1);
135 ToSendStuffBit(1);
136 ToSendStuffBit(0);
137 break;
138 }
139 }
140 }
141 ToSendStuffBit(1);
142 ToSendStuffBit(1);
143 ToSendStuffBit(0);
144 ToSendStuffBit(1);
145
146 // And slack at the end, too.
147 for(i = 0; i < 24; i++) {
148 ToSendStuffBit(1);
149 }
150 }
151
152 //-----------------------------------------------------------------------------
153 // The CRC used by ISO 15693.
154 //-----------------------------------------------------------------------------
155 static uint16_t Crc(uint8_t *v, int n)
156 {
157 uint32_t reg;
158 int i, j;
159
160 reg = 0xffff;
161 for(i = 0; i < n; i++) {
162 reg = reg ^ ((uint32_t)v[i]);
163 for (j = 0; j < 8; j++) {
164 if (reg & 0x0001) {
165 reg = (reg >> 1) ^ 0x8408;
166 } else {
167 reg = (reg >> 1);
168 }
169 }
170 }
171
172 return ~reg;
173 }
174
175 char *strcat(char *dest, const char *src)
176 {
177 size_t dest_len = strlen(dest);
178 size_t i;
179
180 for (i = 0 ; src[i] != '\0' ; i++)
181 dest[dest_len + i] = src[i];
182 dest[dest_len + i] = '\0';
183
184 return dest;
185 }
186
187 ////////////////////////////////////////// code to do 'itoa'
188
189 /* reverse: reverse string s in place */
190 void reverse(char s[])
191 {
192 int c, i, j;
193
194 for (i = 0, j = strlen(s)-1; i<j; i++, j--) {
195 c = s[i];
196 s[i] = s[j];
197 s[j] = c;
198 }
199 }
200
201 /* itoa: convert n to characters in s */
202 void itoa(int n, char s[])
203 {
204 int i, sign;
205
206 if ((sign = n) < 0) /* record sign */
207 n = -n; /* make n positive */
208 i = 0;
209 do { /* generate digits in reverse order */
210 s[i++] = n % 10 + '0'; /* get next digit */
211 } while ((n /= 10) > 0); /* delete it */
212 if (sign < 0)
213 s[i++] = '-';
214 s[i] = '\0';
215 reverse(s);
216 }
217
218 //////////////////////////////////////// END 'itoa' CODE
219
220 //-----------------------------------------------------------------------------
221 // Encode (into the ToSend buffers) an identify request, which is the first
222 // thing that you must send to a tag to get a response.
223 //-----------------------------------------------------------------------------
224 static void BuildIdentifyRequest(void)
225 {
226 uint8_t cmd[5];
227
228 uint16_t crc;
229 // one sub-carrier, inventory, 1 slot, fast rate
230 // AFI is at bit 5 (1<<4) when doing an INVENTORY
231 cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
232 // inventory command code
233 cmd[1] = 0x01;
234 // no mask
235 cmd[2] = 0x00;
236 //Now the CRC
237 crc = Crc(cmd, 3);
238 cmd[3] = crc & 0xff;
239 cmd[4] = crc >> 8;
240
241 CodeIso15693AsReader(cmd, sizeof(cmd));
242 }
243
244 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
245 {
246 uint8_t cmd[12];
247
248 uint16_t crc;
249 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
250 // followed by teh block data
251 // one sub-carrier, inventory, 1 slot, fast rate
252 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
253 // System Information command code
254 cmd[1] = 0x2B;
255 // UID may be optionally specified here
256 // 64-bit UID
257 cmd[2] = 0x32;
258 cmd[3]= 0x4b;
259 cmd[4] = 0x03;
260 cmd[5] = 0x01;
261 cmd[6] = 0x00;
262 cmd[7] = 0x10;
263 cmd[8] = 0x05;
264 cmd[9]= 0xe0; // always e0 (not exactly unique)
265 //Now the CRC
266 crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
267 cmd[10] = crc & 0xff;
268 cmd[11] = crc >> 8;
269
270 CodeIso15693AsReader(cmd, sizeof(cmd));
271 }
272
273 static void BuildSelectRequest( uint8_t uid[])
274 {
275
276 // uid[6]=0x31; // this is getting ignored - the uid array is not happening...
277 uint8_t cmd[12];
278
279 uint16_t crc;
280 // one sub-carrier, inventory, 1 slot, fast rate
281 //cmd[0] = (1 << 2) | (1 << 5) | (1 << 1); // INVENTROY FLAGS
282 cmd[0] = (1 << 4) | (1 << 5) | (1 << 1); // Select and addressed FLAGS
283 // SELECT command code
284 cmd[1] = 0x25;
285 // 64-bit UID
286 // cmd[2] = uid[0];//0x32;
287 // cmd[3]= uid[1];//0x4b;
288 // cmd[4] = uid[2];//0x03;
289 // cmd[5] = uid[3];//0x01;
290 // cmd[6] = uid[4];//0x00;
291 // cmd[7] = uid[5];//0x10;
292 // cmd[8] = uid[6];//0x05;
293 cmd[2] = 0x32;//
294 cmd[3] = 0x4b;
295 cmd[4] = 0x03;
296 cmd[5] = 0x01;
297 cmd[6] = 0x00;
298 cmd[7] = 0x10;
299 cmd[8] = 0x05; // infineon?
300
301 cmd[9]= 0xe0; // always e0 (not exactly unique)
302
303 // DbpIntegers(cmd[8],cmd[7],cmd[6]);
304 // Now the CRC
305 crc = Crc(cmd, 10); // the crc needs to be calculated over 10 bytes
306 cmd[10] = crc & 0xff;
307 cmd[11] = crc >> 8;
308
309 CodeIso15693AsReader(cmd, sizeof(cmd));
310 }
311
312 static void __attribute__((unused)) BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
313 {
314 uint8_t cmd[13];
315
316 uint16_t crc;
317 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
318 // followed by teh block data
319 // one sub-carrier, inventory, 1 slot, fast rate
320 cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit
321 // READ BLOCK command code
322 cmd[1] = 0x20;
323 // UID may be optionally specified here
324 // 64-bit UID
325 cmd[2] = 0x32;
326 cmd[3]= 0x4b;
327 cmd[4] = 0x03;
328 cmd[5] = 0x01;
329 cmd[6] = 0x00;
330 cmd[7] = 0x10;
331 cmd[8] = 0x05;
332 cmd[9]= 0xe0; // always e0 (not exactly unique)
333 // Block number to read
334 cmd[10] = blockNumber;//0x00;
335 //Now the CRC
336 crc = Crc(cmd, 11); // the crc needs to be calculated over 2 bytes
337 cmd[11] = crc & 0xff;
338 cmd[12] = crc >> 8;
339
340 CodeIso15693AsReader(cmd, sizeof(cmd));
341 }
342
343 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
344 {
345 uint8_t cmd[14];
346
347 uint16_t crc;
348 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
349 // followed by teh block data
350 // one sub-carrier, inventory, 1 slot, fast rate
351 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
352 // READ Multi BLOCK command code
353 cmd[1] = 0x23;
354 // UID may be optionally specified here
355 // 64-bit UID
356 cmd[2] = 0x32;
357 cmd[3]= 0x4b;
358 cmd[4] = 0x03;
359 cmd[5] = 0x01;
360 cmd[6] = 0x00;
361 cmd[7] = 0x10;
362 cmd[8] = 0x05;
363 cmd[9]= 0xe0; // always e0 (not exactly unique)
364 // First Block number to read
365 cmd[10] = 0x00;
366 // Number of Blocks to read
367 cmd[11] = 0x2f; // read quite a few
368 //Now the CRC
369 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
370 cmd[12] = crc & 0xff;
371 cmd[13] = crc >> 8;
372
373 CodeIso15693AsReader(cmd, sizeof(cmd));
374 }
375
376 static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
377 {
378 uint8_t cmd[14];
379
380 uint16_t crc;
381 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
382 // followed by teh block data
383 // one sub-carrier, inventory, 1 slot, fast rate
384 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
385 // READ BLOCK command code
386 cmd[1] = CmdCode;
387 // UID may be optionally specified here
388 // 64-bit UID
389 cmd[2] = 0x32;
390 cmd[3]= 0x4b;
391 cmd[4] = 0x03;
392 cmd[5] = 0x01;
393 cmd[6] = 0x00;
394 cmd[7] = 0x10;
395 cmd[8] = 0x05;
396 cmd[9]= 0xe0; // always e0 (not exactly unique)
397 // Parameter
398 cmd[10] = 0x00;
399 cmd[11] = 0x0a;
400
401 // cmd[12] = 0x00;
402 // cmd[13] = 0x00; //Now the CRC
403 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
404 cmd[12] = crc & 0xff;
405 cmd[13] = crc >> 8;
406
407 CodeIso15693AsReader(cmd, sizeof(cmd));
408 }
409
410 static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
411 {
412 uint8_t cmd[14];
413
414 uint16_t crc;
415 // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
416 // followed by teh block data
417 // one sub-carrier, inventory, 1 slot, fast rate
418 cmd[0] = (1 << 5) | (1 << 1); // no SELECT bit
419 // READ BLOCK command code
420 cmd[1] = CmdCode;
421 // UID may be optionally specified here
422 // 64-bit UID
423 cmd[2] = 0x32;
424 cmd[3]= 0x4b;
425 cmd[4] = 0x03;
426 cmd[5] = 0x01;
427 cmd[6] = 0x00;
428 cmd[7] = 0x10;
429 cmd[8] = 0x05;
430 cmd[9]= 0xe0; // always e0 (not exactly unique)
431 // Parameter
432 cmd[10] = 0x05; // for custom codes this must be manufcturer code
433 cmd[11] = 0x00;
434
435 // cmd[12] = 0x00;
436 // cmd[13] = 0x00; //Now the CRC
437 crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
438 cmd[12] = crc & 0xff;
439 cmd[13] = crc >> 8;
440
441 CodeIso15693AsReader(cmd, sizeof(cmd));
442 }
443
444 /////////////////////////////////////////////////////////////////////////
445 // Now the VICC>VCD responses when we are simulating a tag
446 ////////////////////////////////////////////////////////////////////
447
448 static void BuildInventoryResponse(void)
449 {
450 uint8_t cmd[12];
451
452 uint16_t crc;
453 // one sub-carrier, inventory, 1 slot, fast rate
454 // AFI is at bit 5 (1<<4) when doing an INVENTORY
455 cmd[0] = 0; //(1 << 2) | (1 << 5) | (1 << 1);
456 cmd[1] = 0;
457 // 64-bit UID
458 cmd[2] = 0x32;
459 cmd[3]= 0x4b;
460 cmd[4] = 0x03;
461 cmd[5] = 0x01;
462 cmd[6] = 0x00;
463 cmd[7] = 0x10;
464 cmd[8] = 0x05;
465 cmd[9]= 0xe0;
466 //Now the CRC
467 crc = Crc(cmd, 10);
468 cmd[10] = crc & 0xff;
469 cmd[11] = crc >> 8;
470
471 CodeIso15693AsReader(cmd, sizeof(cmd));
472 }
473
474 //-----------------------------------------------------------------------------
475 // Transmit the command (to the tag) that was placed in ToSend[].
476 //-----------------------------------------------------------------------------
477 static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
478 {
479 int c;
480
481 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
482 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
483 if(*wait < 10) { *wait = 10; }
484
485 // for(c = 0; c < *wait;) {
486 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
487 // AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
488 // c++;
489 // }
490 // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
491 // volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
492 // (void)r;
493 // }
494 // WDT_HIT();
495 // }
496
497 c = 0;
498 for(;;) {
499 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
500 AT91C_BASE_SSC->SSC_THR = cmd[c];
501 c++;
502 if(c >= len) {
503 break;
504 }
505 }
506 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
507 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
508 (void)r;
509 }
510 WDT_HIT();
511 }
512 *samples = (c + *wait) << 3;
513 }
514
515 //-----------------------------------------------------------------------------
516 // Transmit the command (to the reader) that was placed in ToSend[].
517 //-----------------------------------------------------------------------------
518 static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
519 {
520 int c;
521
522 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
523 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR); // No requirement to energise my coils
524 if(*wait < 10) { *wait = 10; }
525
526 c = 0;
527 for(;;) {
528 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
529 AT91C_BASE_SSC->SSC_THR = cmd[c];
530 c++;
531 if(c >= len) {
532 break;
533 }
534 }
535 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
536 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
537 (void)r;
538 }
539 WDT_HIT();
540 }
541 *samples = (c + *wait) << 3;
542 }
543
544 static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
545 {
546 int c = 0;
547 uint8_t *dest = (uint8_t *)BigBuf;
548 int getNext = 0;
549
550 int8_t prev = 0;
551
552 // NOW READ RESPONSE
553 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
554 //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
555 c = 0;
556 getNext = FALSE;
557 for(;;) {
558 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
559 AT91C_BASE_SSC->SSC_THR = 0x43;
560 }
561 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
562 int8_t b;
563 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
564
565 // The samples are correlations against I and Q versions of the
566 // tone that the tag AM-modulates, so every other sample is I,
567 // every other is Q. We just want power, so abs(I) + abs(Q) is
568 // close to what we want.
569 if(getNext) {
570 int8_t r;
571
572 if(b < 0) {
573 r = -b;
574 } else {
575 r = b;
576 }
577 if(prev < 0) {
578 r -= prev;
579 } else {
580 r += prev;
581 }
582
583 dest[c++] = (uint8_t)r;
584
585 if(c >= 2000) {
586 break;
587 }
588 } else {
589 prev = b;
590 }
591
592 getNext = !getNext;
593 }
594 }
595
596 //////////////////////////////////////////
597 /////////// DEMODULATE ///////////////////
598 //////////////////////////////////////////
599
600 int i, j;
601 int max = 0, maxPos=0;
602
603 int skip = 4;
604
605 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
606
607 // First, correlate for SOF
608 for(i = 0; i < 100; i++) {
609 int corr = 0;
610 for(j = 0; j < arraylen(FrameSOF); j += skip) {
611 corr += FrameSOF[j]*dest[i+(j/skip)];
612 }
613 if(corr > max) {
614 max = corr;
615 maxPos = i;
616 }
617 }
618 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
619
620 int k = 0; // this will be our return value
621
622 // greg - If correlation is less than 1 then there's little point in continuing
623 if ((max/(arraylen(FrameSOF)/skip)) >= 1)
624 {
625
626 i = maxPos + arraylen(FrameSOF)/skip;
627
628 uint8_t outBuf[20];
629 memset(outBuf, 0, sizeof(outBuf));
630 uint8_t mask = 0x01;
631 for(;;) {
632 int corr0 = 0, corr1 = 0, corrEOF = 0;
633 for(j = 0; j < arraylen(Logic0); j += skip) {
634 corr0 += Logic0[j]*dest[i+(j/skip)];
635 }
636 for(j = 0; j < arraylen(Logic1); j += skip) {
637 corr1 += Logic1[j]*dest[i+(j/skip)];
638 }
639 for(j = 0; j < arraylen(FrameEOF); j += skip) {
640 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
641 }
642 // Even things out by the length of the target waveform.
643 corr0 *= 4;
644 corr1 *= 4;
645
646 if(corrEOF > corr1 && corrEOF > corr0) {
647 // DbpString("EOF at %d", i);
648 break;
649 } else if(corr1 > corr0) {
650 i += arraylen(Logic1)/skip;
651 outBuf[k] |= mask;
652 } else {
653 i += arraylen(Logic0)/skip;
654 }
655 mask <<= 1;
656 if(mask == 0) {
657 k++;
658 mask = 0x01;
659 }
660 if((i+(int)arraylen(FrameEOF)) >= 2000) {
661 DbpString("ran off end!");
662 break;
663 }
664 }
665 if(mask != 0x01) {
666 DbpString("error, uneven octet! (discard extra bits!)");
667 /// DbpString(" mask=%02x", mask);
668 }
669 // uint8_t str1 [8];
670 // itoa(k,str1);
671 // strcat(str1," octets read");
672
673 // DbpString( str1); // DbpString("%d octets", k);
674
675 // for(i = 0; i < k; i+=3) {
676 // //DbpString("# %2d: %02x ", i, outBuf[i]);
677 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
678 // }
679
680 for(i = 0; i < k; i++) {
681 receivedResponse[i] = outBuf[i];
682 }
683 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
684 return k; // return the number of bytes demodulated
685
686 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
687
688 }
689
690 // Now the GetISO15693 message from sniffing command
691 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
692 {
693 int c = 0;
694 uint8_t *dest = (uint8_t *)BigBuf;
695 int getNext = 0;
696
697 int8_t prev = 0;
698
699 // NOW READ RESPONSE
700 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
701 //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
702 c = 0;
703 getNext = FALSE;
704 for(;;) {
705 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
706 AT91C_BASE_SSC->SSC_THR = 0x43;
707 }
708 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
709 int8_t b;
710 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
711
712 // The samples are correlations against I and Q versions of the
713 // tone that the tag AM-modulates, so every other sample is I,
714 // every other is Q. We just want power, so abs(I) + abs(Q) is
715 // close to what we want.
716 if(getNext) {
717 int8_t r;
718
719 if(b < 0) {
720 r = -b;
721 } else {
722 r = b;
723 }
724 if(prev < 0) {
725 r -= prev;
726 } else {
727 r += prev;
728 }
729
730 dest[c++] = (uint8_t)r;
731
732 if(c >= 20000) {
733 break;
734 }
735 } else {
736 prev = b;
737 }
738
739 getNext = !getNext;
740 }
741 }
742
743 //////////////////////////////////////////
744 /////////// DEMODULATE ///////////////////
745 //////////////////////////////////////////
746
747 int i, j;
748 int max = 0, maxPos=0;
749
750 int skip = 4;
751
752 // if(GraphTraceLen < 1000) return; // THIS CHECKS FOR A BUFFER TO SMALL
753
754 // First, correlate for SOF
755 for(i = 0; i < 19000; i++) {
756 int corr = 0;
757 for(j = 0; j < arraylen(FrameSOF); j += skip) {
758 corr += FrameSOF[j]*dest[i+(j/skip)];
759 }
760 if(corr > max) {
761 max = corr;
762 maxPos = i;
763 }
764 }
765 // DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
766
767 int k = 0; // this will be our return value
768
769 // greg - If correlation is less than 1 then there's little point in continuing
770 if ((max/(arraylen(FrameSOF)/skip)) >= 1) // THIS SHOULD BE 1
771 {
772
773 i = maxPos + arraylen(FrameSOF)/skip;
774
775 uint8_t outBuf[20];
776 memset(outBuf, 0, sizeof(outBuf));
777 uint8_t mask = 0x01;
778 for(;;) {
779 int corr0 = 0, corr1 = 0, corrEOF = 0;
780 for(j = 0; j < arraylen(Logic0); j += skip) {
781 corr0 += Logic0[j]*dest[i+(j/skip)];
782 }
783 for(j = 0; j < arraylen(Logic1); j += skip) {
784 corr1 += Logic1[j]*dest[i+(j/skip)];
785 }
786 for(j = 0; j < arraylen(FrameEOF); j += skip) {
787 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
788 }
789 // Even things out by the length of the target waveform.
790 corr0 *= 4;
791 corr1 *= 4;
792
793 if(corrEOF > corr1 && corrEOF > corr0) {
794 // DbpString("EOF at %d", i);
795 break;
796 } else if(corr1 > corr0) {
797 i += arraylen(Logic1)/skip;
798 outBuf[k] |= mask;
799 } else {
800 i += arraylen(Logic0)/skip;
801 }
802 mask <<= 1;
803 if(mask == 0) {
804 k++;
805 mask = 0x01;
806 }
807 if((i+(int)arraylen(FrameEOF)) >= 2000) {
808 DbpString("ran off end!");
809 break;
810 }
811 }
812 if(mask != 0x01) {
813 DbpString("error, uneven octet! (discard extra bits!)");
814 /// DbpString(" mask=%02x", mask);
815 }
816 // uint8_t str1 [8];
817 // itoa(k,str1);
818 // strcat(str1," octets read");
819
820 // DbpString( str1); // DbpString("%d octets", k);
821
822 // for(i = 0; i < k; i+=3) {
823 // //DbpString("# %2d: %02x ", i, outBuf[i]);
824 // DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
825 // }
826
827 for(i = 0; i < k; i++) {
828 receivedResponse[i] = outBuf[i];
829 }
830 } // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
831 return k; // return the number of bytes demodulated
832
833 /// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
834 }
835
836 //-----------------------------------------------------------------------------
837 // Start to read an ISO 15693 tag. We send an identify request, then wait
838 // for the response. The response is not demodulated, just left in the buffer
839 // so that it can be downloaded to a PC and processed there.
840 //-----------------------------------------------------------------------------
841 void AcquireRawAdcSamplesIso15693(void)
842 {
843 int c = 0;
844 uint8_t *dest = (uint8_t *)BigBuf;
845 int getNext = 0;
846
847 int8_t prev = 0;
848
849 BuildIdentifyRequest();
850
851 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
852
853 // Give the tags time to energize
854 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
855 SpinDelay(100);
856
857 // Now send the command
858 FpgaSetupSsc();
859 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
860
861 c = 0;
862 for(;;) {
863 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
864 AT91C_BASE_SSC->SSC_THR = ToSend[c];
865 c++;
866 if(c == ToSendMax+3) {
867 break;
868 }
869 }
870 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
871 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
872 (void)r;
873 }
874 WDT_HIT();
875 }
876
877 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
878
879 c = 0;
880 getNext = FALSE;
881 for(;;) {
882 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
883 AT91C_BASE_SSC->SSC_THR = 0x43;
884 }
885 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
886 int8_t b;
887 b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
888
889 // The samples are correlations against I and Q versions of the
890 // tone that the tag AM-modulates, so every other sample is I,
891 // every other is Q. We just want power, so abs(I) + abs(Q) is
892 // close to what we want.
893 if(getNext) {
894 int8_t r;
895
896 if(b < 0) {
897 r = -b;
898 } else {
899 r = b;
900 }
901 if(prev < 0) {
902 r -= prev;
903 } else {
904 r += prev;
905 }
906
907 dest[c++] = (uint8_t)r;
908
909 if(c >= 2000) {
910 break;
911 }
912 } else {
913 prev = b;
914 }
915
916 getNext = !getNext;
917 }
918 }
919 }
920
921 //-----------------------------------------------------------------------------
922 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
923 // all demodulation performed in arm rather than host. - greg
924 //-----------------------------------------------------------------------------
925 void ReaderIso15693(uint32_t parameter)
926 {
927 LED_A_ON();
928 LED_B_ON();
929 LED_C_OFF();
930 LED_D_OFF();
931
932 //DbpString(parameter);
933
934 //uint8_t *answer0 = (((uint8_t *)BigBuf) + 3560); // allow 100 bytes per reponse (way too much)
935 uint8_t *answer1 = (((uint8_t *)BigBuf) + 3660); //
936 uint8_t *answer2 = (((uint8_t *)BigBuf) + 3760);
937 uint8_t *answer3 = (((uint8_t *)BigBuf) + 3860);
938 //uint8_t *TagUID= (((uint8_t *)BigBuf) + 3960); // where we hold the uid for hi15reader
939 // int answerLen0 = 0;
940 int answerLen1 = 0;
941 int answerLen2 = 0;
942 int answerLen3 = 0;
943
944 // Blank arrays
945 memset(BigBuf + 3660, 0, 300);
946
947 // Setup SSC
948 FpgaSetupSsc();
949
950 // Start from off (no field generated)
951 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
952 SpinDelay(200);
953
954 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
955 FpgaSetupSsc();
956
957 // Give the tags time to energize
958 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
959 SpinDelay(200);
960
961 LED_A_ON();
962 LED_B_OFF();
963 LED_C_OFF();
964 LED_D_OFF();
965
966 int samples = 0;
967 int tsamples = 0;
968 int wait = 0;
969 int elapsed = 0;
970
971 // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
972 // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
973 uint8_t TagUID[7]; // where we hold the uid for hi15reader
974
975 // BuildIdentifyRequest();
976 // //TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
977 // TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
978 // // Now wait for a response
979 // responseLen0 = GetIso15693AnswerFromTag(receivedAnswer0, 100, &samples, &elapsed) ;
980 // if (responseLen0 >=12) // we should do a better check than this
981 // {
982 // // really we should check it is a valid mesg
983 // // but for now just grab what we think is the uid
984 // TagUID[0] = receivedAnswer0[2];
985 // TagUID[1] = receivedAnswer0[3];
986 // TagUID[2] = receivedAnswer0[4];
987 // TagUID[3] = receivedAnswer0[5];
988 // TagUID[4] = receivedAnswer0[6];
989 // TagUID[5] = receivedAnswer0[7];
990 // TagUID[6] = receivedAnswer0[8]; // IC Manufacturer code
991 // DbpIntegers(TagUID[6],TagUID[5],TagUID[4]);
992 //}
993
994 // Now send the IDENTIFY command
995 BuildIdentifyRequest();
996 //TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
997 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
998 // Now wait for a response
999 answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
1000
1001 if (answerLen1 >=12) // we should do a better check than this
1002 {
1003
1004 TagUID[0] = answer1[2];
1005 TagUID[1] = answer1[3];
1006 TagUID[2] = answer1[4];
1007 TagUID[3] = answer1[5];
1008 TagUID[4] = answer1[6];
1009 TagUID[5] = answer1[7];
1010 TagUID[6] = answer1[8]; // IC Manufacturer code
1011
1012 // Now send the SELECT command
1013 BuildSelectRequest(TagUID);
1014 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
1015 // Now wait for a response
1016 answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
1017
1018 // Now send the MULTI READ command
1019 // BuildArbitraryRequest(*TagUID,parameter);
1020 BuildArbitraryCustomRequest(TagUID,parameter);
1021 // BuildReadBlockRequest(*TagUID,parameter);
1022 // BuildSysInfoRequest(*TagUID);
1023 //TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
1024 TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); // No longer ToSendMax+3
1025 // Now wait for a response
1026 answerLen3 = GetIso15693AnswerFromTag(answer3, 100, &samples, &elapsed) ;
1027
1028 }
1029
1030 Dbprintf("%d octets read from IDENTIFY request: %x %x %x %x %x %x %x %x %x", answerLen1,
1031 answer1[0], answer1[1], answer1[2],
1032 answer1[3], answer1[4], answer1[5],
1033 answer1[6], answer1[7], answer1[8]);
1034
1035 Dbprintf("%d octets read from SELECT request: %x %x %x %x %x %x %x %x %x", answerLen2,
1036 answer2[0], answer2[1], answer2[2],
1037 answer2[3], answer2[4], answer2[5],
1038 answer2[6], answer2[7], answer2[8]);
1039
1040 Dbprintf("%d octets read from XXX request: %x %x %x %x %x %x %x %x %x", answerLen3,
1041 answer3[0], answer3[1], answer3[2],
1042 answer3[3], answer3[4], answer3[5],
1043 answer3[6], answer3[7], answer3[8]);
1044
1045
1046 // str2[0]=0;
1047 // for(i = 0; i < responseLen3; i++) {
1048 // itoa(str1,receivedAnswer3[i]);
1049 // strcat(str2,str1);
1050 // }
1051 // DbpString(str2);
1052
1053 LED_A_OFF();
1054 LED_B_OFF();
1055 LED_C_OFF();
1056 LED_D_OFF();
1057 }
1058
1059 //-----------------------------------------------------------------------------
1060 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1061 // all demodulation performed in arm rather than host. - greg
1062 //-----------------------------------------------------------------------------
1063 void SimTagIso15693(uint32_t parameter)
1064 {
1065 LED_A_ON();
1066 LED_B_ON();
1067 LED_C_OFF();
1068 LED_D_OFF();
1069
1070 uint8_t *answer1 = (((uint8_t *)BigBuf) + 3660); //
1071 int answerLen1 = 0;
1072
1073 // Blank arrays
1074 memset(answer1, 0, 100);
1075
1076 // Setup SSC
1077 FpgaSetupSsc();
1078
1079 // Start from off (no field generated)
1080 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1081 SpinDelay(200);
1082
1083 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1084 FpgaSetupSsc();
1085
1086 // Give the tags time to energize
1087 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); // NO GOOD FOR SIM TAG!!!!
1088 SpinDelay(200);
1089
1090 LED_A_OFF();
1091 LED_B_OFF();
1092 LED_C_ON();
1093 LED_D_OFF();
1094
1095 int samples = 0;
1096 int tsamples = 0;
1097 int wait = 0;
1098 int elapsed = 0;
1099
1100 answerLen1 = GetIso15693AnswerFromSniff(answer1, 100, &samples, &elapsed) ;
1101
1102 if (answerLen1 >=1) // we should do a better check than this
1103 {
1104 // Build a suitable reponse to the reader INVENTORY cocmmand
1105 BuildInventoryResponse();
1106 TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
1107 }
1108
1109 Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
1110 answer1[0], answer1[1], answer1[2],
1111 answer1[3], answer1[4], answer1[5],
1112 answer1[6], answer1[7], answer1[8]);
1113
1114 LED_A_OFF();
1115 LED_B_OFF();
1116 LED_C_OFF();
1117 LED_D_OFF();
1118 }
Proxmark3 GIT tracking
Impressum, Datenschutz