]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443a.c
projects / proxmark3-svn / blob
? search:


c5557d394ef1cb2e9f2c6fd00fd3004b1dd1e438
[proxmark3-svn] / armsrc / iso14443a.c
1 //-----------------------------------------------------------------------------
2 // Routines to support ISO 14443 type A.
3 //
4 // Gerhard de Koning Gans - May 2008
5 //-----------------------------------------------------------------------------
6 #include <proxmark3.h>
7 #include "apps.h"
8 #include "../common/iso14443_crc.c"
9
10 typedef enum {
11 SEC_D = 1,
12 SEC_E = 2,
13 SEC_F = 3,
14 SEC_X = 4,
15 SEC_Y = 5,
16 SEC_Z = 6
17 } SecType;
18
19 //-----------------------------------------------------------------------------
20 // The software UART that receives commands from the reader, and its state
21 // variables.
22 //-----------------------------------------------------------------------------
23 static struct {
24 enum {
25 STATE_UNSYNCD,
26 STATE_START_OF_COMMUNICATION,
27 STATE_MILLER_X,
28 STATE_MILLER_Y,
29 STATE_MILLER_Z,
30 STATE_ERROR_WAIT
31 } state;
32 WORD shiftReg;
33 int bitCnt;
34 int byteCnt;
35 int byteCntMax;
36 int posCnt;
37 int syncBit;
38 int parityBits;
39 int samples;
40 int highCnt;
41 int bitBuffer;
42 enum {
43 DROP_NONE,
44 DROP_FIRST_HALF,
45 DROP_SECOND_HALF
46 } drop;
47 BYTE *output;
48 } Uart;
49
50 static BOOL MillerDecoding(int bit)
51 {
52 int error = 0;
53 int bitright;
54
55 if(!Uart.bitBuffer) {
56 Uart.bitBuffer = bit ^ 0xFF0;
57 return FALSE;
58 }
59 else {
60 Uart.bitBuffer <<= 4;
61 Uart.bitBuffer ^= bit;
62 }
63
64 BOOL EOC = FALSE;
65
66 if(Uart.state != STATE_UNSYNCD) {
67 Uart.posCnt++;
68
69 if((Uart.bitBuffer & Uart.syncBit) ^ Uart.syncBit) {
70 bit = 0x00;
71 }
72 else {
73 bit = 0x01;
74 }
75 if(((Uart.bitBuffer << 1) & Uart.syncBit) ^ Uart.syncBit) {
76 bitright = 0x00;
77 }
78 else {
79 bitright = 0x01;
80 }
81 if(bit != bitright) { bit = bitright; }
82
83 if(Uart.posCnt == 1) {
84 // measurement first half bitperiod
85 if(!bit) {
86 Uart.drop = DROP_FIRST_HALF;
87 }
88 }
89 else {
90 // measurement second half bitperiod
91 if(!bit & (Uart.drop == DROP_NONE)) {
92 Uart.drop = DROP_SECOND_HALF;
93 }
94 else if(!bit) {
95 // measured a drop in first and second half
96 // which should not be possible
97 Uart.state = STATE_ERROR_WAIT;
98 error = 0x01;
99 }
100
101 Uart.posCnt = 0;
102
103 switch(Uart.state) {
104 case STATE_START_OF_COMMUNICATION:
105 Uart.shiftReg = 0;
106 if(Uart.drop == DROP_SECOND_HALF) {
107 // error, should not happen in SOC
108 Uart.state = STATE_ERROR_WAIT;
109 error = 0x02;
110 }
111 else {
112 // correct SOC
113 Uart.state = STATE_MILLER_Z;
114 }
115 break;
116
117 case STATE_MILLER_Z:
118 Uart.bitCnt++;
119 Uart.shiftReg >>= 1;
120 if(Uart.drop == DROP_NONE) {
121 // logic '0' followed by sequence Y
122 // end of communication
123 Uart.state = STATE_UNSYNCD;
124 EOC = TRUE;
125 }
126 // if(Uart.drop == DROP_FIRST_HALF) {
127 // Uart.state = STATE_MILLER_Z; stay the same
128 // we see a logic '0' }
129 if(Uart.drop == DROP_SECOND_HALF) {
130 // we see a logic '1'
131 Uart.shiftReg |= 0x100;
132 Uart.state = STATE_MILLER_X;
133 }
134 break;
135
136 case STATE_MILLER_X:
137 Uart.shiftReg >>= 1;
138 if(Uart.drop == DROP_NONE) {
139 // sequence Y, we see a '0'
140 Uart.state = STATE_MILLER_Y;
141 Uart.bitCnt++;
142 }
143 if(Uart.drop == DROP_FIRST_HALF) {
144 // Would be STATE_MILLER_Z
145 // but Z does not follow X, so error
146 Uart.state = STATE_ERROR_WAIT;
147 error = 0x03;
148 }
149 if(Uart.drop == DROP_SECOND_HALF) {
150 // We see a '1' and stay in state X
151 Uart.shiftReg |= 0x100;
152 Uart.bitCnt++;
153 }
154 break;
155
156 case STATE_MILLER_Y:
157 Uart.bitCnt++;
158 Uart.shiftReg >>= 1;
159 if(Uart.drop == DROP_NONE) {
160 // logic '0' followed by sequence Y
161 // end of communication
162 Uart.state = STATE_UNSYNCD;
163 EOC = TRUE;
164 }
165 if(Uart.drop == DROP_FIRST_HALF) {
166 // we see a '0'
167 Uart.state = STATE_MILLER_Z;
168 }
169 if(Uart.drop == DROP_SECOND_HALF) {
170 // We see a '1' and go to state X
171 Uart.shiftReg |= 0x100;
172 Uart.state = STATE_MILLER_X;
173 }
174 break;
175
176 case STATE_ERROR_WAIT:
177 // That went wrong. Now wait for at least two bit periods
178 // and try to sync again
179 if(Uart.drop == DROP_NONE) {
180 Uart.highCnt = 6;
181 Uart.state = STATE_UNSYNCD;
182 }
183 break;
184
185 default:
186 Uart.state = STATE_UNSYNCD;
187 Uart.highCnt = 0;
188 break;
189 }
190
191 Uart.drop = DROP_NONE;
192
193 // should have received at least one whole byte...
194 if((Uart.bitCnt == 2) && EOC && (Uart.byteCnt > 0)) {
195 return TRUE;
196 }
197
198 if(Uart.bitCnt == 9) {
199 Uart.output[Uart.byteCnt] = (Uart.shiftReg & 0xff);
200 Uart.byteCnt++;
201
202 Uart.parityBits <<= 1;
203 Uart.parityBits ^= ((Uart.shiftReg >> 8) & 0x01);
204
205 if(EOC) {
206 // when End of Communication received and
207 // all data bits processed..
208 return TRUE;
209 }
210 Uart.bitCnt = 0;
211 }
212
213 /*if(error) {
214 Uart.output[Uart.byteCnt] = 0xAA;
215 Uart.byteCnt++;
216 Uart.output[Uart.byteCnt] = error & 0xFF;
217 Uart.byteCnt++;
218 Uart.output[Uart.byteCnt] = 0xAA;
219 Uart.byteCnt++;
220 Uart.output[Uart.byteCnt] = (Uart.bitBuffer >> 8) & 0xFF;
221 Uart.byteCnt++;
222 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
223 Uart.byteCnt++;
224 Uart.output[Uart.byteCnt] = (Uart.syncBit >> 3) & 0xFF;
225 Uart.byteCnt++;
226 Uart.output[Uart.byteCnt] = 0xAA;
227 Uart.byteCnt++;
228 return TRUE;
229 }*/
230 }
231
232 }
233 else {
234 bit = Uart.bitBuffer & 0xf0;
235 bit >>= 4;
236 bit ^= 0x0F;
237 if(bit) {
238 // should have been high or at least (4 * 128) / fc
239 // according to ISO this should be at least (9 * 128 + 20) / fc
240 if(Uart.highCnt == 8) {
241 // we went low, so this could be start of communication
242 // it turns out to be safer to choose a less significant
243 // syncbit... so we check whether the neighbour also represents the drop
244 Uart.posCnt = 1; // apparently we are busy with our first half bit period
245 Uart.syncBit = bit & 8;
246 Uart.samples = 3;
247 if(!Uart.syncBit) { Uart.syncBit = bit & 4; Uart.samples = 2; }
248 else if(bit & 4) { Uart.syncBit = bit & 4; Uart.samples = 2; bit <<= 2; }
249 if(!Uart.syncBit) { Uart.syncBit = bit & 2; Uart.samples = 1; }
250 else if(bit & 2) { Uart.syncBit = bit & 2; Uart.samples = 1; bit <<= 1; }
251 if(!Uart.syncBit) { Uart.syncBit = bit & 1; Uart.samples = 0;
252 if(Uart.syncBit & (Uart.bitBuffer & 8)) {
253 Uart.syncBit = 8;
254
255 // the first half bit period is expected in next sample
256 Uart.posCnt = 0;
257 Uart.samples = 3;
258 }
259 }
260 else if(bit & 1) { Uart.syncBit = bit & 1; Uart.samples = 0; }
261
262 Uart.syncBit <<= 4;
263 Uart.state = STATE_START_OF_COMMUNICATION;
264 Uart.drop = DROP_FIRST_HALF;
265 Uart.bitCnt = 0;
266 Uart.byteCnt = 0;
267 Uart.parityBits = 0;
268 error = 0;
269 }
270 else {
271 Uart.highCnt = 0;
272 }
273 }
274 else {
275 if(Uart.highCnt < 8) {
276 Uart.highCnt++;
277 }
278 }
279 }
280
281 return FALSE;
282 }
283
284 //=============================================================================
285 // ISO 14443 Type A - Manchester
286 //=============================================================================
287
288 static struct {
289 enum {
290 DEMOD_UNSYNCD,
291 DEMOD_START_OF_COMMUNICATION,
292 DEMOD_MANCHESTER_D,
293 DEMOD_MANCHESTER_E,
294 DEMOD_MANCHESTER_F,
295 DEMOD_ERROR_WAIT
296 } state;
297 int bitCount;
298 int posCount;
299 int syncBit;
300 int parityBits;
301 WORD shiftReg;
302 int buffer;
303 int buff;
304 int samples;
305 int len;
306 enum {
307 SUB_NONE,
308 SUB_FIRST_HALF,
309 SUB_SECOND_HALF
310 } sub;
311 BYTE *output;
312 } Demod;
313
314 static BOOL ManchesterDecoding(int v)
315 {
316 int bit;
317 int modulation;
318 int error = 0;
319
320 if(!Demod.buff) {
321 Demod.buff = 1;
322 Demod.buffer = v;
323 return FALSE;
324 }
325 else {
326 bit = Demod.buffer;
327 Demod.buffer = v;
328 }
329
330 if(Demod.state==DEMOD_UNSYNCD) {
331 Demod.output[Demod.len] = 0xfa;
332 Demod.syncBit = 0;
333 //Demod.samples = 0;
334 Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part
335 if(bit & 0x08) { Demod.syncBit = 0x08; }
336 if(!Demod.syncBit) {
337 if(bit & 0x04) { Demod.syncBit = 0x04; }
338 }
339 else if(bit & 0x04) { Demod.syncBit = 0x04; bit <<= 4; }
340 if(!Demod.syncBit) {
341 if(bit & 0x02) { Demod.syncBit = 0x02; }
342 }
343 else if(bit & 0x02) { Demod.syncBit = 0x02; bit <<= 4; }
344 if(!Demod.syncBit) {
345 if(bit & 0x01) { Demod.syncBit = 0x01; }
346
347 if(Demod.syncBit & (Demod.buffer & 0x08)) {
348 Demod.syncBit = 0x08;
349
350 // The first half bitperiod is expected in next sample
351 Demod.posCount = 0;
352 Demod.output[Demod.len] = 0xfb;
353 }
354 }
355 else if(bit & 0x01) { Demod.syncBit = 0x01; }
356
357 if(Demod.syncBit) {
358 Demod.len = 0;
359 Demod.state = DEMOD_START_OF_COMMUNICATION;
360 Demod.sub = SUB_FIRST_HALF;
361 Demod.bitCount = 0;
362 Demod.shiftReg = 0;
363 Demod.parityBits = 0;
364 Demod.samples = 0;
365 if(Demod.posCount) {
366 switch(Demod.syncBit) {
367 case 0x08: Demod.samples = 3; break;
368 case 0x04: Demod.samples = 2; break;
369 case 0x02: Demod.samples = 1; break;
370 case 0x01: Demod.samples = 0; break;
371 }
372 }
373 error = 0;
374 }
375 }
376 else {
377 //modulation = bit & Demod.syncBit;
378 modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
379
380 Demod.samples += 4;
381
382 if(Demod.posCount==0) {
383 Demod.posCount = 1;
384 if(modulation) {
385 Demod.sub = SUB_FIRST_HALF;
386 }
387 else {
388 Demod.sub = SUB_NONE;
389 }
390 }
391 else {
392 Demod.posCount = 0;
393 if(modulation && (Demod.sub == SUB_FIRST_HALF)) {
394 if(Demod.state!=DEMOD_ERROR_WAIT) {
395 Demod.state = DEMOD_ERROR_WAIT;
396 Demod.output[Demod.len] = 0xaa;
397 error = 0x01;
398 }
399 }
400 else if(modulation) {
401 Demod.sub = SUB_SECOND_HALF;
402 }
403
404 switch(Demod.state) {
405 case DEMOD_START_OF_COMMUNICATION:
406 if(Demod.sub == SUB_FIRST_HALF) {
407 Demod.state = DEMOD_MANCHESTER_D;
408 }
409 else {
410 Demod.output[Demod.len] = 0xab;
411 Demod.state = DEMOD_ERROR_WAIT;
412 error = 0x02;
413 }
414 break;
415
416 case DEMOD_MANCHESTER_D:
417 case DEMOD_MANCHESTER_E:
418 if(Demod.sub == SUB_FIRST_HALF) {
419 Demod.bitCount++;
420 Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100;
421 Demod.state = DEMOD_MANCHESTER_D;
422 }
423 else if(Demod.sub == SUB_SECOND_HALF) {
424 Demod.bitCount++;
425 Demod.shiftReg >>= 1;
426 Demod.state = DEMOD_MANCHESTER_E;
427 }
428 else {
429 Demod.state = DEMOD_MANCHESTER_F;
430 }
431 break;
432
433 case DEMOD_MANCHESTER_F:
434 // Tag response does not need to be a complete byte!
435 if(Demod.len > 0 || Demod.bitCount > 0) {
436 if(Demod.bitCount > 0) {
437 Demod.shiftReg >>= (9 - Demod.bitCount);
438 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
439 Demod.len++;
440 // No parity bit, so just shift a 0
441 Demod.parityBits <<= 1;
442 }
443
444 Demod.state = DEMOD_UNSYNCD;
445 return TRUE;
446 }
447 else {
448 Demod.output[Demod.len] = 0xad;
449 Demod.state = DEMOD_ERROR_WAIT;
450 error = 0x03;
451 }
452 break;
453
454 case DEMOD_ERROR_WAIT:
455 Demod.state = DEMOD_UNSYNCD;
456 break;
457
458 default:
459 Demod.output[Demod.len] = 0xdd;
460 Demod.state = DEMOD_UNSYNCD;
461 break;
462 }
463
464 if(Demod.bitCount>=9) {
465 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
466 Demod.len++;
467
468 Demod.parityBits <<= 1;
469 Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);
470
471 Demod.bitCount = 0;
472 Demod.shiftReg = 0;
473 }
474
475 /*if(error) {
476 Demod.output[Demod.len] = 0xBB;
477 Demod.len++;
478 Demod.output[Demod.len] = error & 0xFF;
479 Demod.len++;
480 Demod.output[Demod.len] = 0xBB;
481 Demod.len++;
482 Demod.output[Demod.len] = bit & 0xFF;
483 Demod.len++;
484 Demod.output[Demod.len] = Demod.buffer & 0xFF;
485 Demod.len++;
486 Demod.output[Demod.len] = Demod.syncBit & 0xFF;
487 Demod.len++;
488 Demod.output[Demod.len] = 0xBB;
489 Demod.len++;
490 return TRUE;
491 }*/
492
493 }
494
495 } // end (state != UNSYNCED)
496
497 return FALSE;
498 }
499
500 //=============================================================================
501 // Finally, a `sniffer' for ISO 14443 Type A
502 // Both sides of communication!
503 //=============================================================================
504
505 //-----------------------------------------------------------------------------
506 // Record the sequence of commands sent by the reader to the tag, with
507 // triggering so that we start recording at the point that the tag is moved
508 // near the reader.
509 //-----------------------------------------------------------------------------
510 void SnoopIso14443a(void)
511 {
512
513 // BIG CHANGE - UNDERSTAND THIS BEFORE WE COMMIT
514
515 #define RECV_CMD_OFFSET 3032
516 #define RECV_RES_OFFSET 3096
517 #define DMA_BUFFER_OFFSET 3160
518 #define DMA_BUFFER_SIZE 4096
519 #define TRACE_LENGTH 3000
520
521 // #define RECV_CMD_OFFSET 2032 // original (working as of 21/2/09) values
522 // #define RECV_RES_OFFSET 2096 // original (working as of 21/2/09) values
523 // #define DMA_BUFFER_OFFSET 2160 // original (working as of 21/2/09) values
524 // #define DMA_BUFFER_SIZE 4096 // original (working as of 21/2/09) values
525 // #define TRACE_LENGTH 2000 // original (working as of 21/2/09) values
526
527 // We won't start recording the frames that we acquire until we trigger;
528 // a good trigger condition to get started is probably when we see a
529 // response from the tag.
530 BOOL triggered = TRUE; // FALSE to wait first for card
531
532 // The command (reader -> tag) that we're receiving.
533 // The length of a received command will in most cases be no more than 18 bytes.
534 // So 32 should be enough!
535 BYTE *receivedCmd = (((BYTE *)BigBuf) + RECV_CMD_OFFSET);
536 // The response (tag -> reader) that we're receiving.
537 BYTE *receivedResponse = (((BYTE *)BigBuf) + RECV_RES_OFFSET);
538
539 // As we receive stuff, we copy it from receivedCmd or receivedResponse
540 // into trace, along with its length and other annotations.
541 BYTE *trace = (BYTE *)BigBuf;
542 int traceLen = 0;
543
544 // The DMA buffer, used to stream samples from the FPGA
545 SBYTE *dmaBuf = ((SBYTE *)BigBuf) + DMA_BUFFER_OFFSET;
546 int lastRxCounter;
547 SBYTE *upTo;
548 int smpl;
549 int maxBehindBy = 0;
550
551 // Count of samples received so far, so that we can include timing
552 // information in the trace buffer.
553 int samples = 0;
554 int rsamples = 0;
555
556 memset(trace, 0x44, RECV_CMD_OFFSET);
557
558 // Set up the demodulator for tag -> reader responses.
559 Demod.output = receivedResponse;
560 Demod.len = 0;
561 Demod.state = DEMOD_UNSYNCD;
562
563 // And the reader -> tag commands
564 memset(&Uart, 0, sizeof(Uart));
565 Uart.output = receivedCmd;
566 Uart.byteCntMax = 32; // was 100 (greg)////////////////////////////////////////////////////////////////////////
567 Uart.state = STATE_UNSYNCD;
568
569 // And put the FPGA in the appropriate mode
570 // Signal field is off with the appropriate LED
571 LED_D_OFF();
572 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER);
573 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
574
575 // Setup for the DMA.
576 FpgaSetupSsc();
577 upTo = dmaBuf;
578 lastRxCounter = DMA_BUFFER_SIZE;
579 FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);
580
581 LED_A_ON();
582
583 // And now we loop, receiving samples.
584 for(;;) {
585 WDT_HIT();
586 int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &
587 (DMA_BUFFER_SIZE-1);
588 if(behindBy > maxBehindBy) {
589 maxBehindBy = behindBy;
590 if(behindBy > 400) {
591 DbpString("blew circular buffer!");
592 goto done;
593 }
594 }
595 if(behindBy < 1) continue;
596
597 smpl = upTo[0];
598 upTo++;
599 lastRxCounter -= 1;
600 if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
601 upTo -= DMA_BUFFER_SIZE;
602 lastRxCounter += DMA_BUFFER_SIZE;
603 PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;
604 PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;
605 }
606
607 samples += 4;
608 #define HANDLE_BIT_IF_BODY \
609 LED_C_ON(); \
610 if(triggered) { \
611 trace[traceLen++] = ((rsamples >> 0) & 0xff); \
612 trace[traceLen++] = ((rsamples >> 8) & 0xff); \
613 trace[traceLen++] = ((rsamples >> 16) & 0xff); \
614 trace[traceLen++] = ((rsamples >> 24) & 0xff); \
615 trace[traceLen++] = ((Uart.parityBits >> 0) & 0xff); \
616 trace[traceLen++] = ((Uart.parityBits >> 8) & 0xff); \
617 trace[traceLen++] = ((Uart.parityBits >> 16) & 0xff); \
618 trace[traceLen++] = ((Uart.parityBits >> 24) & 0xff); \
619 trace[traceLen++] = Uart.byteCnt; \
620 memcpy(trace+traceLen, receivedCmd, Uart.byteCnt); \
621 traceLen += Uart.byteCnt; \
622 if(traceLen > TRACE_LENGTH) break; \
623 } \
624 /* And ready to receive another command. */ \
625 Uart.state = STATE_UNSYNCD; \
626 /* And also reset the demod code, which might have been */ \
627 /* false-triggered by the commands from the reader. */ \
628 Demod.state = DEMOD_UNSYNCD; \
629 LED_B_OFF(); \
630
631 if(MillerDecoding((smpl & 0xF0) >> 4)) {
632 rsamples = samples - Uart.samples;
633 HANDLE_BIT_IF_BODY
634 }
635 if(ManchesterDecoding(smpl & 0x0F)) {
636 rsamples = samples - Demod.samples;
637 LED_B_ON();
638
639 // timestamp, as a count of samples
640 trace[traceLen++] = ((rsamples >> 0) & 0xff);
641 trace[traceLen++] = ((rsamples >> 8) & 0xff);
642 trace[traceLen++] = ((rsamples >> 16) & 0xff);
643 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
644 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
645 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
646 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
647 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
648 // length
649 trace[traceLen++] = Demod.len;
650 memcpy(trace+traceLen, receivedResponse, Demod.len);
651 traceLen += Demod.len;
652 if(traceLen > TRACE_LENGTH) break;
653
654 triggered = TRUE;
655
656 // And ready to receive another response.
657 memset(&Demod, 0, sizeof(Demod));
658 Demod.output = receivedResponse;
659 Demod.state = DEMOD_UNSYNCD;
660 LED_C_OFF();
661 }
662
663 if(BUTTON_PRESS()) {
664 DbpString("cancelled_a");
665 goto done;
666 }
667 }
668
669 DbpString("COMMAND FINISHED");
670
671 DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
672 DbpIntegers(Uart.byteCntMax, traceLen, (int)Uart.output[0]);
673
674 done:
675 PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;
676 DbpIntegers(maxBehindBy, Uart.state, Uart.byteCnt);
677 DbpIntegers(Uart.byteCntMax, traceLen, (int)Uart.output[0]);
678 LED_A_OFF();
679 LED_B_OFF();
680 LED_C_OFF();
681 LED_D_OFF();
682 }
683
684 // Prepare communication bits to send to FPGA
685 void Sequence(SecType seq)
686 {
687 ToSendMax++;
688 switch(seq) {
689 // CARD TO READER
690 case SEC_D:
691 // Sequence D: 11110000
692 // modulation with subcarrier during first half
693 ToSend[ToSendMax] = 0xf0;
694 break;
695 case SEC_E:
696 // Sequence E: 00001111
697 // modulation with subcarrier during second half
698 ToSend[ToSendMax] = 0x0f;
699 break;
700 case SEC_F:
701 // Sequence F: 00000000
702 // no modulation with subcarrier
703 ToSend[ToSendMax] = 0x00;
704 break;
705 // READER TO CARD
706 case SEC_X:
707 // Sequence X: 00001100
708 // drop after half a period
709 ToSend[ToSendMax] = 0x0c;
710 break;
711 case SEC_Y:
712 default:
713 // Sequence Y: 00000000
714 // no drop
715 ToSend[ToSendMax] = 0x00;
716 break;
717 case SEC_Z:
718 // Sequence Z: 11000000
719 // drop at start
720 ToSend[ToSendMax] = 0xc0;
721 break;
722 }
723 }
724
725 //-----------------------------------------------------------------------------
726 // Prepare tag messages
727 //-----------------------------------------------------------------------------
728 static void CodeIso14443aAsTag(const BYTE *cmd, int len)
729 {
730 int i;
731 int oddparity;
732
733 ToSendReset();
734
735 // Correction bit, might be removed when not needed
736 ToSendStuffBit(0);
737 ToSendStuffBit(0);
738 ToSendStuffBit(0);
739 ToSendStuffBit(0);
740 ToSendStuffBit(1); // 1
741 ToSendStuffBit(0);
742 ToSendStuffBit(0);
743 ToSendStuffBit(0);
744
745 // Send startbit
746 Sequence(SEC_D);
747
748 for(i = 0; i < len; i++) {
749 int j;
750 BYTE b = cmd[i];
751
752 // Data bits
753 oddparity = 0x01;
754 for(j = 0; j < 8; j++) {
755 oddparity ^= (b & 1);
756 if(b & 1) {
757 Sequence(SEC_D);
758 } else {
759 Sequence(SEC_E);
760 }
761 b >>= 1;
762 }
763
764 // Parity bit
765 if(oddparity) {
766 Sequence(SEC_D);
767 } else {
768 Sequence(SEC_E);
769 }
770 }
771
772 // Send stopbit
773 Sequence(SEC_F);
774
775 // Flush the buffer in FPGA!!
776 for(i = 0; i < 5; i++) {
777 Sequence(SEC_F);
778 }
779
780 // Convert from last byte pos to length
781 ToSendMax++;
782
783 // Add a few more for slop
784 ToSend[ToSendMax++] = 0x00;
785 ToSend[ToSendMax++] = 0x00;
786 //ToSendMax += 2;
787 }
788
789 //-----------------------------------------------------------------------------
790 // This is to send a NACK kind of answer, its only 3 bits, I know it should be 4
791 //-----------------------------------------------------------------------------
792 static void CodeStrangeAnswer()
793 {
794 int i;
795
796 ToSendReset();
797
798 // Correction bit, might be removed when not needed
799 ToSendStuffBit(0);
800 ToSendStuffBit(0);
801 ToSendStuffBit(0);
802 ToSendStuffBit(0);
803 ToSendStuffBit(1); // 1
804 ToSendStuffBit(0);
805 ToSendStuffBit(0);
806 ToSendStuffBit(0);
807
808 // Send startbit
809 Sequence(SEC_D);
810
811 // 0
812 Sequence(SEC_E);
813
814 // 0
815 Sequence(SEC_E);
816
817 // 1
818 Sequence(SEC_D);
819
820 // Send stopbit
821 Sequence(SEC_F);
822
823 // Flush the buffer in FPGA!!
824 for(i = 0; i < 5; i++) {
825 Sequence(SEC_F);
826 }
827
828 // Convert from last byte pos to length
829 ToSendMax++;
830
831 // Add a few more for slop
832 ToSend[ToSendMax++] = 0x00;
833 ToSend[ToSendMax++] = 0x00;
834 //ToSendMax += 2;
835 }
836
837 //-----------------------------------------------------------------------------
838 // Wait for commands from reader
839 // Stop when button is pressed
840 // Or return TRUE when command is captured
841 //-----------------------------------------------------------------------------
842 static BOOL GetIso14443aCommandFromReader(BYTE *received, int *len, int maxLen)
843 {
844 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
845 // only, since we are receiving, not transmitting).
846 // Signal field is off with the appropriate LED
847 LED_D_OFF();
848 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
849
850 // Now run a `software UART' on the stream of incoming samples.
851 Uart.output = received;
852 Uart.byteCntMax = maxLen;
853 Uart.state = STATE_UNSYNCD;
854
855 for(;;) {
856 WDT_HIT();
857
858 if(BUTTON_PRESS()) return FALSE;
859
860 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
861 SSC_TRANSMIT_HOLDING = 0x00;
862 }
863 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
864 BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
865 if(MillerDecoding((b & 0xf0) >> 4)) {
866 *len = Uart.byteCnt;
867 return TRUE;
868 }
869 if(MillerDecoding(b & 0x0f)) {
870 *len = Uart.byteCnt;
871 return TRUE;
872 }
873 }
874 }
875 }
876
877 //-----------------------------------------------------------------------------
878 // Main loop of simulated tag: receive commands from reader, decide what
879 // response to send, and send it.
880 //-----------------------------------------------------------------------------
881 void SimulateIso14443aTag(int tagType, int TagUid)
882 {
883 // This function contains the tag emulation
884
885 // Prepare protocol messages
886 // static const BYTE cmd1[] = { 0x26 };
887 // static const BYTE response1[] = { 0x02, 0x00 }; // Says: I am Mifare 4k - original line - greg
888 //
889 static const BYTE response1[] = { 0x44, 0x03 }; // Says: I am a DESFire Tag, ph33r me
890 // static const BYTE response1[] = { 0x44, 0x00 }; // Says: I am a ULTRALITE Tag, 0wn me
891
892 // UID response
893 // static const BYTE cmd2[] = { 0x93, 0x20 };
894 //static const BYTE response2[] = { 0x9a, 0xe5, 0xe4, 0x43, 0xd8 }; // original value - greg
895
896
897
898 // my desfire
899 static const BYTE response2[] = { 0x88, 0x04, 0x21, 0x3f, 0x4d }; // known uid - note cascade (0x88), 2nd byte (0x04) = NXP/Phillips
900
901
902 // When reader selects us during cascade1 it will send cmd3
903 //BYTE response3[] = { 0x04, 0x00, 0x00 }; // SAK Select (cascade1) successful response (ULTRALITE)
904 BYTE response3[] = { 0x24, 0x00, 0x00 }; // SAK Select (cascade1) successful response (DESFire)
905 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
906
907 // send cascade2 2nd half of UID
908 static const BYTE response2a[] = { 0x51, 0x48, 0x1d, 0x80, 0x84 }; // uid - cascade2 - 2nd half (4 bytes) of UID+ BCCheck
909 // NOTE : THE CRC on the above may be wrong as I have obfuscated the actual UID
910
911
912 // When reader selects us during cascade2 it will send cmd3a
913 //BYTE response3a[] = { 0x00, 0x00, 0x00 }; // SAK Select (cascade2) successful response (ULTRALITE)
914 BYTE response3a[] = { 0x20, 0x00, 0x00 }; // SAK Select (cascade2) successful response (DESFire)
915 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
916
917 // When reader tries to authenticate
918 // static const BYTE cmd5[] = { 0x60, 0x00, 0xf5, 0x7b };
919 static const BYTE response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
920
921 BYTE *resp;
922 int respLen;
923
924 // Longest possible response will be 16 bytes + 2 CRC = 18 bytes
925 // This will need
926 // 144 data bits (18 * 8)
927 // 18 parity bits
928 // 2 Start and stop
929 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
930 // 1 just for the case
931 // ----------- +
932 // 166
933 //
934 // 166 bytes, since every bit that needs to be send costs us a byte
935 //
936
937
938 // Respond with card type
939 BYTE *resp1 = (((BYTE *)BigBuf) + 800);
940 int resp1Len;
941
942 // Anticollision cascade1 - respond with uid
943 BYTE *resp2 = (((BYTE *)BigBuf) + 970);
944 int resp2Len;
945
946 // Anticollision cascade2 - respond with 2nd half of uid if asked
947 // we're only going to be asked if we set the 1st byte of the UID (during cascade1) to 0x88
948 BYTE *resp2a = (((BYTE *)BigBuf) + 1140);
949 int resp2aLen;
950
951 // Acknowledge select - cascade 1
952 BYTE *resp3 = (((BYTE *)BigBuf) + 1310);
953 int resp3Len;
954
955 // Acknowledge select - cascade 2
956 BYTE *resp3a = (((BYTE *)BigBuf) + 1480);
957 int resp3aLen;
958
959 // Response to a read request - not implemented atm
960 BYTE *resp4 = (((BYTE *)BigBuf) + 1550);
961 int resp4Len;
962
963 // Authenticate response - nonce
964 BYTE *resp5 = (((BYTE *)BigBuf) + 1720);
965 int resp5Len;
966
967 BYTE *receivedCmd = (BYTE *)BigBuf;
968 int len;
969
970 int i;
971 int u;
972 BYTE b;
973
974 // To control where we are in the protocol
975 int order = 0;
976 int lastorder;
977
978 // Just to allow some checks
979 int happened = 0;
980 int happened2 = 0;
981
982 int cmdsRecvd = 0;
983
984 BOOL fdt_indicator;
985
986 memset(receivedCmd, 0x44, 400);
987
988 // Prepare the responses of the anticollision phase
989 // there will be not enough time to do this at the moment the reader sends it REQA
990
991 // Answer to request
992 CodeIso14443aAsTag(response1, sizeof(response1));
993 memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
994
995 // Send our UID (cascade 1)
996 CodeIso14443aAsTag(response2, sizeof(response2));
997 memcpy(resp2, ToSend, ToSendMax); resp2Len = ToSendMax;
998
999 // Answer to select (cascade1)
1000 CodeIso14443aAsTag(response3, sizeof(response3));
1001 memcpy(resp3, ToSend, ToSendMax); resp3Len = ToSendMax;
1002
1003 // Send the cascade 2 2nd part of the uid
1004 CodeIso14443aAsTag(response2a, sizeof(response2a));
1005 memcpy(resp2a, ToSend, ToSendMax); resp2aLen = ToSendMax;
1006
1007 // Answer to select (cascade 2)
1008 CodeIso14443aAsTag(response3a, sizeof(response3a));
1009 memcpy(resp3a, ToSend, ToSendMax); resp3aLen = ToSendMax;
1010
1011 // Strange answer is an example of rare message size (3 bits)
1012 CodeStrangeAnswer();
1013 memcpy(resp4, ToSend, ToSendMax); resp4Len = ToSendMax;
1014
1015 // Authentication answer (random nonce)
1016 CodeIso14443aAsTag(response5, sizeof(response5));
1017 memcpy(resp5, ToSend, ToSendMax); resp5Len = ToSendMax;
1018
1019 // We need to listen to the high-frequency, peak-detected path.
1020 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1021 FpgaSetupSsc();
1022
1023 cmdsRecvd = 0;
1024
1025 LED_A_ON();
1026 for(;;) {
1027
1028 if(!GetIso14443aCommandFromReader(receivedCmd, &len, 100)) {
1029 DbpString("button press");
1030 break;
1031 }
1032 // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
1033 // Okay, look at the command now.
1034 lastorder = order;
1035 i = 1; // first byte transmitted
1036 if(receivedCmd[0] == 0x26) {
1037 // Received a REQUEST
1038 resp = resp1; respLen = resp1Len; order = 1;
1039 //DbpString("Hello request from reader:");
1040 } else if(receivedCmd[0] == 0x52) {
1041 // Received a WAKEUP
1042 resp = resp1; respLen = resp1Len; order = 6;
1043 // //DbpString("Wakeup request from reader:");
1044
1045 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // greg - cascade 1 anti-collision
1046 // Received request for UID (cascade 1)
1047 resp = resp2; respLen = resp2Len; order = 2;
1048 // DbpString("UID (cascade 1) request from reader:");
1049 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1050
1051
1052 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] ==0x95) { // greg - cascade 2 anti-collision
1053 // Received request for UID (cascade 2)
1054 resp = resp2a; respLen = resp2aLen; order = 20;
1055 // DbpString("UID (cascade 2) request from reader:");
1056 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1057
1058
1059 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] ==0x93) { // greg - cascade 1 select
1060 // Received a SELECT
1061 resp = resp3; respLen = resp3Len; order = 3;
1062 // DbpString("Select (cascade 1) request from reader:");
1063 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1064
1065
1066 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] ==0x95) { // greg - cascade 2 select
1067 // Received a SELECT
1068 resp = resp3a; respLen = resp3aLen; order = 30;
1069 // DbpString("Select (cascade 2) request from reader:");
1070 // DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1071
1072
1073 } else if(receivedCmd[0] == 0x30) {
1074 // Received a READ
1075 resp = resp4; respLen = resp4Len; order = 4; // Do nothing
1076 DbpString("Read request from reader:");
1077 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1078
1079
1080 } else if(receivedCmd[0] == 0x50) {
1081 // Received a HALT
1082 resp = resp1; respLen = 0; order = 5; // Do nothing
1083 DbpString("Reader requested we HALT!:");
1084
1085 } else if(receivedCmd[0] == 0x60) {
1086 // Received an authentication request
1087 resp = resp5; respLen = resp5Len; order = 7;
1088 DbpString("Authenticate request from reader:");
1089 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1090
1091 } else if(receivedCmd[0] == 0xE0) {
1092 // Received a RATS request
1093 resp = resp1; respLen = 0;order = 70;
1094 DbpString("RATS request from reader:");
1095 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1096 } else {
1097 // Never seen this command before
1098 DbpString("Unknown command received from reader:");
1099 DbpIntegers(receivedCmd[0], receivedCmd[1], receivedCmd[2]);
1100 DbpIntegers(receivedCmd[3], receivedCmd[4], receivedCmd[5]);
1101 DbpIntegers(receivedCmd[6], receivedCmd[7], receivedCmd[8]);
1102
1103 // Do not respond
1104 resp = resp1; respLen = 0; order = 0;
1105 }
1106
1107 // Count number of wakeups received after a halt
1108 if(order == 6 && lastorder == 5) { happened++; }
1109
1110 // Count number of other messages after a halt
1111 if(order != 6 && lastorder == 5) { happened2++; }
1112
1113 // Look at last parity bit to determine timing of answer
1114 if((Uart.parityBits & 0x01) || receivedCmd[0] == 0x52) {
1115 // 1236, so correction bit needed
1116 i = 0;
1117 }
1118
1119 memset(receivedCmd, 0x44, 32);
1120
1121 if(cmdsRecvd > 999) {
1122 DbpString("1000 commands later...");
1123 break;
1124 }
1125 else {
1126 cmdsRecvd++;
1127 }
1128
1129 if(respLen <= 0) continue;
1130
1131 // Modulate Manchester
1132 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1133 SSC_TRANSMIT_HOLDING = 0x00;
1134 FpgaSetupSsc();
1135
1136 // ### Transmit the response ###
1137 u = 0;
1138 b = 0x00;
1139 fdt_indicator = FALSE;
1140 for(;;) {
1141 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
1142 volatile BYTE b = (BYTE)SSC_RECEIVE_HOLDING;
1143 (void)b;
1144 }
1145 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
1146 if(i > respLen) {
1147 b = 0x00;
1148 u++;
1149 } else {
1150 b = resp[i];
1151 i++;
1152 }
1153 SSC_TRANSMIT_HOLDING = b;
1154
1155 if(u > 4) {
1156 break;
1157 }
1158 }
1159 if(BUTTON_PRESS()) {
1160 break;
1161 }
1162 }
1163
1164 }
1165
1166 DbpIntegers(happened, happened2, cmdsRecvd);
1167 LED_A_OFF();
1168 }
1169
1170 //-----------------------------------------------------------------------------
1171 // Transmit the command (to the tag) that was placed in ToSend[].
1172 //-----------------------------------------------------------------------------
1173 static void TransmitFor14443a(const BYTE *cmd, int len, int *samples, int *wait)
1174 {
1175 int c;
1176
1177 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1178
1179 if(*wait < 10) { *wait = 10; }
1180
1181 for(c = 0; c < *wait;) {
1182 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
1183 SSC_TRANSMIT_HOLDING = 0x00; // For exact timing!
1184 c++;
1185 }
1186 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
1187 volatile DWORD r = SSC_RECEIVE_HOLDING;
1188 (void)r;
1189 }
1190 WDT_HIT();
1191 }
1192
1193 c = 0;
1194 for(;;) {
1195 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
1196 SSC_TRANSMIT_HOLDING = cmd[c];
1197 c++;
1198 if(c >= len) {
1199 break;
1200 }
1201 }
1202 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
1203 volatile DWORD r = SSC_RECEIVE_HOLDING;
1204 (void)r;
1205 }
1206 WDT_HIT();
1207 }
1208 *samples = (c + *wait) << 3;
1209 }
1210
1211 //-----------------------------------------------------------------------------
1212 // To generate an arbitrary stream from reader
1213 //
1214 //-----------------------------------------------------------------------------
1215 void ArbitraryFromReader(const BYTE *cmd, int parity, int len)
1216 {
1217 int i;
1218 int j;
1219 int last;
1220 BYTE b;
1221
1222 ToSendReset();
1223
1224 // Start of Communication (Seq. Z)
1225 Sequence(SEC_Z);
1226 last = 0;
1227
1228 for(i = 0; i < len; i++) {
1229 // Data bits
1230 b = cmd[i];
1231 for(j = 0; j < 8; j++) {
1232 if(b & 1) {
1233 // Sequence X
1234 Sequence(SEC_X);
1235 last = 1;
1236 } else {
1237 if(last == 0) {
1238 // Sequence Z
1239 Sequence(SEC_Z);
1240 }
1241 else {
1242 // Sequence Y
1243 Sequence(SEC_Y);
1244 last = 0;
1245 }
1246 }
1247 b >>= 1;
1248
1249 }
1250
1251 // Predefined parity bit, the flipper flips when needed, because of flips in byte sent
1252 if(((parity >> (len - i - 1)) & 1)) {
1253 // Sequence X
1254 Sequence(SEC_X);
1255 last = 1;
1256 } else {
1257 if(last == 0) {
1258 // Sequence Z
1259 Sequence(SEC_Z);
1260 }
1261 else {
1262 // Sequence Y
1263 Sequence(SEC_Y);
1264 last = 0;
1265 }
1266 }
1267 }
1268
1269 // End of Communication
1270 if(last == 0) {
1271 // Sequence Z
1272 Sequence(SEC_Z);
1273 }
1274 else {
1275 // Sequence Y
1276 Sequence(SEC_Y);
1277 last = 0;
1278 }
1279 // Sequence Y
1280 Sequence(SEC_Y);
1281
1282 // Just to be sure!
1283 Sequence(SEC_Y);
1284 Sequence(SEC_Y);
1285 Sequence(SEC_Y);
1286
1287 // Convert from last character reference to length
1288 ToSendMax++;
1289 }
1290
1291 //-----------------------------------------------------------------------------
1292 // Code a 7-bit command without parity bit
1293 // This is especially for 0x26 and 0x52 (REQA and WUPA)
1294 //-----------------------------------------------------------------------------
1295 void ShortFrameFromReader(const BYTE *cmd)
1296 {
1297 int j;
1298 int last;
1299 BYTE b;
1300
1301 ToSendReset();
1302
1303 // Start of Communication (Seq. Z)
1304 Sequence(SEC_Z);
1305 last = 0;
1306
1307 b = cmd[0];
1308 for(j = 0; j < 7; j++) {
1309 if(b & 1) {
1310 // Sequence X
1311 Sequence(SEC_X);
1312 last = 1;
1313 } else {
1314 if(last == 0) {
1315 // Sequence Z
1316 Sequence(SEC_Z);
1317 }
1318 else {
1319 // Sequence Y
1320 Sequence(SEC_Y);
1321 last = 0;
1322 }
1323 }
1324 b >>= 1;
1325 }
1326
1327 // End of Communication
1328 if(last == 0) {
1329 // Sequence Z
1330 Sequence(SEC_Z);
1331 }
1332 else {
1333 // Sequence Y
1334 Sequence(SEC_Y);
1335 last = 0;
1336 }
1337 // Sequence Y
1338 Sequence(SEC_Y);
1339
1340 // Just to be sure!
1341 Sequence(SEC_Y);
1342 Sequence(SEC_Y);
1343 Sequence(SEC_Y);
1344
1345 // Convert from last character reference to length
1346 ToSendMax++;
1347 }
1348
1349 //-----------------------------------------------------------------------------
1350 // Prepare reader command to send to FPGA
1351 //
1352 //-----------------------------------------------------------------------------
1353 void CodeIso14443aAsReader(const BYTE *cmd, int len)
1354 {
1355 int i, j;
1356 int last;
1357 int oddparity;
1358 BYTE b;
1359
1360 ToSendReset();
1361
1362 // Start of Communication (Seq. Z)
1363 Sequence(SEC_Z);
1364 last = 0;
1365
1366 for(i = 0; i < len; i++) {
1367 // Data bits
1368 b = cmd[i];
1369 oddparity = 0x01;
1370 for(j = 0; j < 8; j++) {
1371 oddparity ^= (b & 1);
1372 if(b & 1) {
1373 // Sequence X
1374 Sequence(SEC_X);
1375 last = 1;
1376 } else {
1377 if(last == 0) {
1378 // Sequence Z
1379 Sequence(SEC_Z);
1380 }
1381 else {
1382 // Sequence Y
1383 Sequence(SEC_Y);
1384 last = 0;
1385 }
1386 }
1387 b >>= 1;
1388 }
1389
1390 // Parity bit
1391 if(oddparity) {
1392 // Sequence X
1393 Sequence(SEC_X);
1394 last = 1;
1395 } else {
1396 if(last == 0) {
1397 // Sequence Z
1398 Sequence(SEC_Z);
1399 }
1400 else {
1401 // Sequence Y
1402 Sequence(SEC_Y);
1403 last = 0;
1404 }
1405 }
1406 }
1407
1408 // End of Communication
1409 if(last == 0) {
1410 // Sequence Z
1411 Sequence(SEC_Z);
1412 }
1413 else {
1414 // Sequence Y
1415 Sequence(SEC_Y);
1416 last = 0;
1417 }
1418 // Sequence Y
1419 Sequence(SEC_Y);
1420
1421 // Just to be sure!
1422 Sequence(SEC_Y);
1423 Sequence(SEC_Y);
1424 Sequence(SEC_Y);
1425
1426 // Convert from last character reference to length
1427 ToSendMax++;
1428 }
1429
1430
1431 //-----------------------------------------------------------------------------
1432 // Wait a certain time for tag response
1433 // If a response is captured return TRUE
1434 // If it takes to long return FALSE
1435 //-----------------------------------------------------------------------------
1436 static BOOL GetIso14443aAnswerFromTag(BYTE *receivedResponse, int maxLen, int *samples, int *elapsed) //BYTE *buffer
1437 {
1438 // buffer needs to be 512 bytes
1439 int c;
1440
1441 // Set FPGA mode to "reader listen mode", no modulation (listen
1442 // only, since we are receiving, not transmitting).
1443 // Signal field is on with the appropriate LED
1444 LED_D_ON();
1445 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1446
1447 // Now get the answer from the card
1448 Demod.output = receivedResponse;
1449 Demod.len = 0;
1450 Demod.state = DEMOD_UNSYNCD;
1451
1452 BYTE b;
1453 *elapsed = 0;
1454
1455 c = 0;
1456 for(;;) {
1457 WDT_HIT();
1458
1459 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
1460 SSC_TRANSMIT_HOLDING = 0x00; // To make use of exact timing of next command from reader!!
1461 (*elapsed)++;
1462 }
1463 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
1464 if(c < 512) { c++; } else { return FALSE; }
1465 b = (BYTE)SSC_RECEIVE_HOLDING;
1466 if(ManchesterDecoding((b & 0xf0) >> 4)) {
1467 *samples = ((c - 1) << 3) + 4;
1468 return TRUE;
1469 }
1470 if(ManchesterDecoding(b & 0x0f)) {
1471 *samples = c << 3;
1472 return TRUE;
1473 }
1474 }
1475 }
1476 }
1477
1478 //-----------------------------------------------------------------------------
1479 // Read an ISO 14443a tag. Send out commands and store answers.
1480 //
1481 //-----------------------------------------------------------------------------
1482 void ReaderIso14443a(DWORD parameter)
1483 {
1484 // Anticollision
1485 static const BYTE cmd1[] = { 0x52 }; // or 0x26
1486 static const BYTE cmd2[] = { 0x93,0x20 };
1487 // UID = 0x2a,0x69,0x8d,0x43,0x8d, last two bytes are CRC bytes
1488 BYTE cmd3[] = { 0x93,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1489
1490 // For Ultralight add an extra anticollission layer -> 95 20 and then 95 70
1491
1492 // greg - here we will add our cascade level 2 anticolission and select functions to deal with ultralight // and 7-byte UIDs in generall...
1493 BYTE cmd4[] = {0x95,0x20}; // ask for cascade 2 select
1494 // 95 20
1495 //BYTE cmd3a[] = { 0x95,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1496 // 95 70
1497
1498 // cascade 2 select
1499 BYTE cmd5[] = { 0x95,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };
1500
1501
1502 // RATS (request for answer to select)
1503 //BYTE cmd6[] = { 0xe0,0x50,0xbc,0xa5 }; // original RATS
1504 BYTE cmd6[] = { 0xe0,0x21,0xb2,0xc7 }; // Desfire RATS
1505
1506 int reqaddr = 2024; // was 2024 - tied to other size changes
1507 int reqsize = 60;
1508
1509 BYTE *req1 = (((BYTE *)BigBuf) + reqaddr);
1510 int req1Len;
1511
1512 BYTE *req2 = (((BYTE *)BigBuf) + reqaddr + reqsize);
1513 int req2Len;
1514
1515 BYTE *req3 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 2));
1516 int req3Len;
1517
1518 // greg added req 4 & 5 to deal with cascade 2 section
1519 BYTE *req4 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 3));
1520 int req4Len;
1521
1522 BYTE *req5 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 4));
1523 int req5Len;
1524
1525 BYTE *req6 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 5));
1526 int req6Len;
1527
1528 //BYTE *req7 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 6));
1529 //int req7Len;
1530
1531 BYTE *receivedAnswer = (((BYTE *)BigBuf) + 3560); // was 3560 - tied to other size changes
1532
1533 BYTE *trace = (BYTE *)BigBuf;
1534 int traceLen = 0;
1535 int rsamples = 0;
1536
1537 memset(trace, 0x44, 2000); // was 2000 - tied to oter size chnages
1538 // setting it to 3000 causes no tag responses to be detected (2900 is ok)
1539 // setting it to 1000 causes no tag responses to be detected
1540
1541 // Prepare some commands!
1542 ShortFrameFromReader(cmd1);
1543 memcpy(req1, ToSend, ToSendMax); req1Len = ToSendMax;
1544
1545 CodeIso14443aAsReader(cmd2, sizeof(cmd2));
1546 memcpy(req2, ToSend, ToSendMax); req2Len = ToSendMax;
1547
1548 CodeIso14443aAsReader(cmd3, sizeof(cmd3));
1549 memcpy(req3, ToSend, ToSendMax); req3Len = ToSendMax;
1550
1551
1552 CodeIso14443aAsReader(cmd4, sizeof(cmd4)); // 4 is cascade 2 request
1553 memcpy(req4, ToSend, ToSendMax); req4Len = ToSendMax;
1554
1555
1556 CodeIso14443aAsReader(cmd5, sizeof(cmd5)); // 5 is cascade 2 select
1557 memcpy(req5, ToSend, ToSendMax); req5Len = ToSendMax;
1558
1559
1560 CodeIso14443aAsReader(cmd6, sizeof(cmd6));
1561 memcpy(req6, ToSend, ToSendMax); req6Len = ToSendMax;
1562
1563 // Setup SSC
1564 FpgaSetupSsc();
1565
1566 // Start from off (no field generated)
1567 // Signal field is off with the appropriate LED
1568 LED_D_OFF();
1569 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1570 SpinDelay(200);
1571
1572 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1573 FpgaSetupSsc();
1574
1575 // Now give it time to spin up.
1576 // Signal field is on with the appropriate LED
1577 LED_D_ON();
1578 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1579 SpinDelay(200);
1580
1581 LED_A_ON();
1582 LED_B_OFF();
1583 LED_C_OFF();
1584
1585 int samples = 0;
1586 int tsamples = 0;
1587 int wait = 0;
1588 int elapsed = 0;
1589
1590 for(;;) {
1591 // Send WUPA (or REQA)
1592 TransmitFor14443a(req1, req1Len, &tsamples, &wait);
1593 // Store answer in buffer
1594 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1595 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1596 trace[traceLen++] = 1;
1597 memcpy(trace+traceLen, cmd1, 1);
1598 traceLen += 1;
1599 if(traceLen > TRACE_LENGTH) goto done;
1600
1601 while(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1602 if(BUTTON_PRESS()) goto done;
1603
1604 // No answer, just continue polling
1605 TransmitFor14443a(req1, req1Len, &tsamples, &wait);
1606 // Store answer in buffer
1607 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1608 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1609 trace[traceLen++] = 1;
1610 memcpy(trace+traceLen, cmd1, 1);
1611 traceLen += 1;
1612 if(traceLen > TRACE_LENGTH) goto done;
1613 }
1614
1615 // Store answer in buffer
1616 rsamples = rsamples + (samples - Demod.samples);
1617 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1618 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1619 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1620 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1621 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1622 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1623 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1624 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1625 trace[traceLen++] = Demod.len;
1626 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1627 traceLen += Demod.len;
1628 if(traceLen > TRACE_LENGTH) goto done;
1629
1630 // Ask for card UID
1631 TransmitFor14443a(req2, req2Len, &tsamples, &wait);
1632 // Store answer in buffer
1633 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1634 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1635 trace[traceLen++] = 2;
1636 memcpy(trace+traceLen, cmd2, 2);
1637 traceLen += 2;
1638 if(traceLen > TRACE_LENGTH) goto done;
1639
1640 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1641 continue;
1642 }
1643
1644 // Store answer in buffer
1645 rsamples = rsamples + (samples - Demod.samples);
1646 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1647 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1648 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1649 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1650 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1651 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1652 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1653 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1654 trace[traceLen++] = Demod.len;
1655 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1656 traceLen += Demod.len;
1657 if(traceLen > TRACE_LENGTH) goto done;
1658
1659 // Construct SELECT UID command
1660 // First copy the 5 bytes (Mifare Classic) after the 93 70
1661 memcpy(cmd3+2,receivedAnswer,5);
1662 // Secondly compute the two CRC bytes at the end
1663 ComputeCrc14443(CRC_14443_A, cmd3, 7, &cmd3[7], &cmd3[8]);
1664 // Prepare the bit sequence to modulate the subcarrier
1665 // Store answer in buffer
1666 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1667 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1668 trace[traceLen++] = 9;
1669 memcpy(trace+traceLen, cmd3, 9);
1670 traceLen += 9;
1671 if(traceLen > TRACE_LENGTH) goto done;
1672 CodeIso14443aAsReader(cmd3, sizeof(cmd3));
1673 memcpy(req3, ToSend, ToSendMax); req3Len = ToSendMax;
1674
1675 // Select the card
1676 TransmitFor14443a(req3, req3Len, &samples, &wait);
1677 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1678 continue;
1679 }
1680
1681 // Store answer in buffer
1682 rsamples = rsamples + (samples - Demod.samples);
1683 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1684 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1685 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1686 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1687 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1688 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1689 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1690 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1691 trace[traceLen++] = Demod.len;
1692 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1693 traceLen += Demod.len;
1694 if(traceLen > TRACE_LENGTH) goto done;
1695
1696 // OK we have selected at least at cascade 1, lets see if first byte of UID was 0x88 in
1697 // which case we need to make a cascade 2 request and select - this is a long UID
1698 if (receivedAnswer[0] == 0x88)
1699 {
1700 // Do cascade level 2 stuff
1701 ///////////////////////////////////////////////////////////////////
1702 // First issue a '95 20' identify request
1703 // Ask for card UID (part 2)
1704 TransmitFor14443a(req4, req4Len, &tsamples, &wait);
1705 // Store answer in buffer
1706 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1707 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1708 trace[traceLen++] = 2;
1709 memcpy(trace+traceLen, cmd4, 2);
1710 traceLen += 2;
1711 if(traceLen > TRACE_LENGTH) {
1712 DbpString("Bugging out, just popped tracelength");
1713 goto done;}
1714
1715 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1716 continue;
1717 }
1718 // Store answer in buffer
1719 rsamples = rsamples + (samples - Demod.samples);
1720 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1721 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1722 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1723 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1724 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1725 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1726 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1727 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1728 trace[traceLen++] = Demod.len;
1729 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1730 traceLen += Demod.len;
1731 if(traceLen > TRACE_LENGTH) goto done;
1732 //////////////////////////////////////////////////////////////////
1733 // Then Construct SELECT UID (cascasde 2) command
1734 DbpString("Just about to copy the UID out of the cascade 2 id req");
1735 // First copy the 5 bytes (Mifare Classic) after the 95 70
1736 memcpy(cmd5+2,receivedAnswer,5);
1737 // Secondly compute the two CRC bytes at the end
1738 ComputeCrc14443(CRC_14443_A, cmd4, 7, &cmd5[7], &cmd5[8]);
1739 // Prepare the bit sequence to modulate the subcarrier
1740 // Store answer in buffer
1741 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1742 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1743 trace[traceLen++] = 9;
1744 memcpy(trace+traceLen, cmd5, 9);
1745 traceLen += 9;
1746 if(traceLen > TRACE_LENGTH) goto done;
1747 CodeIso14443aAsReader(cmd5, sizeof(cmd5));
1748 memcpy(req5, ToSend, ToSendMax); req5Len = ToSendMax;
1749
1750 // Select the card
1751 TransmitFor14443a(req4, req4Len, &samples, &wait);
1752 if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1753 continue;
1754 }
1755
1756 // Store answer in buffer
1757 rsamples = rsamples + (samples - Demod.samples);
1758 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1759 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1760 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1761 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1762 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1763 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1764 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1765 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1766 trace[traceLen++] = Demod.len;
1767 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1768 traceLen += Demod.len;
1769 if(traceLen > TRACE_LENGTH) goto done;
1770
1771 }
1772
1773 // Secondly compute the two CRC bytes at the end
1774 ComputeCrc14443(CRC_14443_A, cmd5, 2, &cmd5[2], &cmd5[3]);
1775 // Send authentication request (Mifare Classic)
1776 TransmitFor14443a(req5, req5Len, &samples, &wait);
1777 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1778 trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0; trace[traceLen++] = 0;
1779 trace[traceLen++] = 4;
1780 memcpy(trace+traceLen, cmd5, 4);
1781 traceLen += 4;
1782 if(traceLen > TRACE_LENGTH) goto done;
1783 if(GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) {
1784 rsamples++;
1785 // We received probably a random, continue and trace!
1786 }
1787 else {
1788 // Received nothing
1789 continue;
1790 }
1791
1792 // Trace the random, i'm curious
1793 rsamples = rsamples + (samples - Demod.samples);
1794 trace[traceLen++] = ((rsamples >> 0) & 0xff);
1795 trace[traceLen++] = ((rsamples >> 8) & 0xff);
1796 trace[traceLen++] = ((rsamples >> 16) & 0xff);
1797 trace[traceLen++] = 0x80 | ((rsamples >> 24) & 0xff);
1798 trace[traceLen++] = ((Demod.parityBits >> 0) & 0xff);
1799 trace[traceLen++] = ((Demod.parityBits >> 8) & 0xff);
1800 trace[traceLen++] = ((Demod.parityBits >> 16) & 0xff);
1801 trace[traceLen++] = ((Demod.parityBits >> 24) & 0xff);
1802 trace[traceLen++] = Demod.len;
1803 memcpy(trace+traceLen, receivedAnswer, Demod.len);
1804 traceLen += Demod.len;
1805 if(traceLen > TRACE_LENGTH) goto done;
1806
1807 // Thats it...
1808 }
1809
1810 done:
1811 LED_A_OFF();
1812 LED_B_OFF();
1813 LED_C_OFF();
1814 DbpIntegers(rsamples, 0xCC, 0xCC);
1815 DbpString("ready..");
1816 }
Proxmark3 GIT tracking
Impressum, Datenschutz