1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Routines to support ISO 14443B. This includes both the reader software and
9 // the `fake tag' modes.
10 //-----------------------------------------------------------------------------
11 #include "iso14443b.h"
13 #ifndef FWT_TIMEOUT_14B
15 # define FWT_TIMEOUT_14B 35312
17 #ifndef ISO14443B_DMA_BUFFER_SIZE
18 # define ISO14443B_DMA_BUFFER_SIZE 256
21 # define RECEIVE_MASK (ISO14443B_DMA_BUFFER_SIZE-1)
24 // Guard Time (per 14443-2)
29 // Synchronization time (per 14443-2)
33 // Frame Delay Time PICC to PCD (per 14443-3 Amendment 1)
39 #define SEND4STUFFBIT(x) ToSendStuffBit(x);ToSendStuffBit(x);ToSendStuffBit(x);ToSendStuffBit(x);
40 //#define SEND4STUFFBIT(x) ToSendStuffBit(x);
41 // iceman, this threshold value, what makes 8 a good amplituted for this IQ values?
42 #ifndef SUBCARRIER_DETECT_THRESHOLD
43 # define SUBCARRIER_DETECT_THRESHOLD 8
46 static void iso14b_set_timeout(uint32_t timeout
);
47 static void iso14b_set_maxframesize(uint16_t size
);
48 static void switch_off(void);
50 // the block number for the ISO14443-4 PCB (used with APDUs)
51 static uint8_t pcb_blocknum
= 0;
52 static uint32_t iso14b_timeout
= FWT_TIMEOUT_14B
;
55 //=============================================================================
56 // An ISO 14443 Type B tag. We listen for commands from the reader, using
57 // a UART kind of thing that's implemented in software. When we get a
58 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
59 // If it's good, then we can do something appropriate with it, and send
61 //=============================================================================
64 //-----------------------------------------------------------------------------
65 // The software UART that receives commands from the reader, and its state variables.
66 //-----------------------------------------------------------------------------
70 STATE_GOT_FALLING_EDGE_OF_SOF
,
71 STATE_AWAITING_START_BIT
,
82 static void UartReset() {
83 Uart
.state
= STATE_UNSYNCD
;
87 Uart
.byteCntMax
= MAX_FRAME_SIZE
;
91 static void UartInit(uint8_t *data
) {
94 // memset(Uart.output, 0x00, MAX_FRAME_SIZE);
97 //-----------------------------------------------------------------------------
98 // The software Demod that receives commands from the tag, and its state variables.
99 //-----------------------------------------------------------------------------
103 DEMOD_PHASE_REF_TRAINING
,
104 DEMOD_AWAITING_FALLING_EDGE_OF_SOF
,
105 DEMOD_GOT_FALLING_EDGE_OF_SOF
,
106 DEMOD_AWAITING_START_BIT
,
112 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
121 uint32_t startTime
, endTime
;
124 // Clear out the state of the "UART" that receives from the tag.
125 static void DemodReset() {
126 Demod
.state
= DEMOD_UNSYNCD
;
138 static void DemodInit(uint8_t *data
) {
141 // memset(Demod.output, 0x00, MAX_FRAME_SIZE);
146 * 9.4395 us = 1 ETU and clock is about 1.5 us
149 * timeout in ETUs (time to transfer 1 bit, 9.4395 us)
151 * Formula to calculate FWT (in ETUs) by timeout (in ms):
152 * fwt = 13560000 * 1000 / (8*16) * timeout;
153 * Sample: 3sec == 3000ms
154 * 13560000 * 1000 / (8*16) * 3000 ==
155 * 13560000000 / 384000 = 35312 FWT
156 * @param timeout is in frame wait time, fwt, measured in ETUs
158 static void iso14b_set_timeout(uint32_t timeout
) {
159 #define MAX_TIMEOUT 40542464 // 13560000Hz * 1000ms / (2^32-1) * (8*16)
160 if(timeout
> MAX_TIMEOUT
)
161 timeout
= MAX_TIMEOUT
;
163 iso14b_timeout
= timeout
;
164 if(MF_DBGLEVEL
>= 3) Dbprintf("ISO14443B Timeout set to %ld fwt", iso14b_timeout
);
166 static void iso14b_set_maxframesize(uint16_t size
) {
168 size
= MAX_FRAME_SIZE
;
170 Uart
.byteCntMax
= size
;
171 if(MF_DBGLEVEL
>= 3) Dbprintf("ISO14443B Max frame size set to %d bytes", Uart
.byteCntMax
);
173 static void switch_off(void){
174 if (MF_DBGLEVEL
> 3) Dbprintf("switch_off");
175 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
182 void AppendCrc14443b(uint8_t* data
, int len
) {
183 ComputeCrc14443(CRC_14443_B
, data
, len
, data
+len
, data
+len
+1);
186 //-----------------------------------------------------------------------------
187 // Code up a string of octets at layer 2 (including CRC, we don't generate
188 // that here) so that they can be transmitted to the reader. Doesn't transmit
189 // them yet, just leaves them ready to send in ToSend[].
190 //-----------------------------------------------------------------------------
191 static void CodeIso14443bAsTag(const uint8_t *cmd
, int len
) {
194 * Reader to card | ASK - Amplitude Shift Keying Modulation (PCD to PICC for Type B) (NRZ-L encodig)
195 * Card to reader | BPSK - Binary Phase Shift Keying Modulation, (PICC to PCD for Type B)
197 * fc - carrier frequency 13.56mHz
198 * TR0 - Guard Time per 14443-2
199 * TR1 - Synchronization Time per 14443-2
200 * TR2 - PICC to PCD Frame Delay Time (per 14443-3 Amendment 1)
202 * Elementary Time Unit (ETU) is
203 * - 128 Carrier Cycles (9.4395 µS) = 8 Subcarrier Units
205 * - 10 ETU = 1 startbit, 8 databits, 1 stopbit (10bits length)
209 * Start of frame (SOF) is
210 * - [10-11] ETU of ZEROS, unmodulated time
211 * - [2-3] ETU of ONES,
213 * End of frame (EOF) is
214 * - [10-11] ETU of ZEROS, unmodulated time
216 * -TO VERIFY THIS BELOW-
217 * The mode FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK which we use to simulate tag
219 * - A 1-bit input to the FPGA becomes 8 pulses at 847.5kHz (1.18µS / pulse) == 9.44us
220 * - A 0-bit input to the FPGA becomes an unmodulated time of 1.18µS or does it become 8 nonpulses for 9.44us
222 * FPGA doesn't seem to work with ETU. It seems to work with pulse / duration instead.
224 * Card sends data ub 847.e kHz subcarrier
225 * subcar |duration| FC division
226 * -------+--------+------------
227 * 106kHz | 9.44µS | FC/128
228 * 212kHz | 4.72µS | FC/64
229 * 424kHz | 2.36µS | FC/32
230 * 848kHz | 1.18µS | FC/16
231 * -------+--------+------------
233 * Reader data transmission:
234 * - no modulation ONES
236 * - Command, data and CRC_B
238 * - no modulation ONES
240 * Card data transmission
243 * - data (each bytes is: 1startbit, 8bits, 1stopbit)
247 * FPGA implementation :
248 * At this point only Type A is implemented. This means that we are using a
249 * bit rate of 106 kbit/s, or fc/128. Oversample by 4, which ought to make
250 * things practical for the ARM (fc/32, 423.8 kbits/s, ~50 kbytes/s)
259 // Transmit a burst of ones, as the initial thing that lets the
260 // reader get phase sync.
261 // This loop is TR1, per specification
262 // TR1 minimum must be > 80/fs
263 // TR1 maximum 200/fs
264 // 80/fs < TR1 < 200/fs
265 // 10 ETU < TR1 < 24 ETU
268 // 10-11 ETU * 4times samples ZEROS
269 for(i
= 0; i
< 10; i
++) { SEND4STUFFBIT(0); }
270 //for(i = 0; i < 10; i++) { ToSendStuffBit(0); }
272 // 2-3 ETU * 4times samples ONES
273 for(i
= 0; i
< 3; i
++) { SEND4STUFFBIT(1); }
274 //for(i = 0; i < 3; i++) { ToSendStuffBit(1); }
277 for(i
= 0; i
< len
; ++i
) {
285 for(j
= 0; j
< 8; ++j
) {
288 // //ToSendStuffBit(1);
291 // //ToSendStuffBit(0);
293 SEND4STUFFBIT( b
& 1 );
302 // For PICC it ranges 0-18us (1etu = 9us)
308 // 10-11 ETU * 4 sample rate = ZEROS
309 for(i
= 0; i
< 10; i
++) { SEND4STUFFBIT(0); }
310 //for(i = 0; i < 10; i++) { ToSendStuffBit(0); }
313 for(i
= 0; i
< 40; i
++) { SEND4STUFFBIT(1); }
314 //for(i = 0; i < 40; i++) { ToSendStuffBit(1); }
316 // Convert from last byte pos to length
321 /* Receive & handle a bit coming from the reader.
323 * This function is called 4 times per bit (every 2 subcarrier cycles).
324 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
327 * LED A -> ON once we have received the SOF and are expecting the rest.
328 * LED A -> OFF once we have received EOF or are in error state or unsynced
330 * Returns: true if we received a EOF
331 * false if we are still waiting for some more
333 static RAMFUNC
int Handle14443bReaderUartBit(uint8_t bit
) {
334 switch (Uart
.state
) {
337 // we went low, so this could be the beginning of an SOF
338 Uart
.state
= STATE_GOT_FALLING_EDGE_OF_SOF
;
344 case STATE_GOT_FALLING_EDGE_OF_SOF
:
346 if (Uart
.posCnt
== 2) { // sample every 4 1/fs in the middle of a bit
348 if (Uart
.bitCnt
> 9) {
349 // we've seen enough consecutive
350 // zeros that it's a valid SOF
353 Uart
.state
= STATE_AWAITING_START_BIT
;
354 LED_A_ON(); // Indicate we got a valid SOF
356 // didn't stay down long enough before going high, error
357 Uart
.state
= STATE_UNSYNCD
;
360 // do nothing, keep waiting
364 if (Uart
.posCnt
>= 4) Uart
.posCnt
= 0;
365 if (Uart
.bitCnt
> 12) {
366 // Give up if we see too many zeros without a one, too.
368 Uart
.state
= STATE_UNSYNCD
;
372 case STATE_AWAITING_START_BIT
:
375 if (Uart
.posCnt
> 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
376 // stayed high for too long between characters, error
377 Uart
.state
= STATE_UNSYNCD
;
380 // falling edge, this starts the data byte
384 Uart
.state
= STATE_RECEIVING_DATA
;
388 case STATE_RECEIVING_DATA
:
390 if (Uart
.posCnt
== 2) {
391 // time to sample a bit
394 Uart
.shiftReg
|= 0x200;
398 if (Uart
.posCnt
>= 4) {
401 if (Uart
.bitCnt
== 10) {
402 if ((Uart
.shiftReg
& 0x200) && !(Uart
.shiftReg
& 0x001))
404 // this is a data byte, with correct
405 // start and stop bits
406 Uart
.output
[Uart
.byteCnt
] = (Uart
.shiftReg
>> 1) & 0xff;
409 if (Uart
.byteCnt
>= Uart
.byteCntMax
) {
410 // Buffer overflowed, give up
412 Uart
.state
= STATE_UNSYNCD
;
414 // so get the next byte now
416 Uart
.state
= STATE_AWAITING_START_BIT
;
418 } else if (Uart
.shiftReg
== 0x000) {
419 // this is an EOF byte
420 LED_A_OFF(); // Finished receiving
421 Uart
.state
= STATE_UNSYNCD
;
422 if (Uart
.byteCnt
!= 0)
428 Uart
.state
= STATE_UNSYNCD
;
435 Uart
.state
= STATE_UNSYNCD
;
441 //-----------------------------------------------------------------------------
442 // Receive a command (from the reader to us, where we are the simulated tag),
443 // and store it in the given buffer, up to the given maximum length. Keeps
444 // spinning, waiting for a well-framed command, until either we get one
445 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
447 // Assume that we're called with the SSC (to the FPGA) and ADC path set
449 //-----------------------------------------------------------------------------
450 static int GetIso14443bCommandFromReader(uint8_t *received
, uint16_t *len
) {
451 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
452 // only, since we are receiving, not transmitting).
453 // Signal field is off with the appropriate LED
455 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
| FPGA_HF_SIMULATOR_NO_MODULATION
);
459 volatile uint8_t b
= 0;
461 // clear receiving shift register and holding register
462 // What does this loop do? Is it TR1?
463 for(uint8_t c
= 0; c
< 10;) {
464 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
465 AT91C_BASE_SSC
->SSC_THR
= 0xFF;
470 // Now run a `software UART' on the stream of incoming samples.
474 while( !BUTTON_PRESS() ) {
477 if ( AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
) {
478 b
= (uint8_t) AT91C_BASE_SSC
->SSC_RHR
;
479 for ( mask
= 0x80; mask
!= 0; mask
>>= 1) {
480 if ( Handle14443bReaderUartBit(b
& mask
)) {
490 void ClearFpgaShiftingRegisters(void){
494 // clear receiving shift register and holding register
495 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
)) {};
497 b
= AT91C_BASE_SSC
->SSC_RHR
; (void) b
;
499 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
)) {};
501 b
= AT91C_BASE_SSC
->SSC_RHR
; (void) b
;
503 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
504 for (uint8_t j
= 0; j
< 5; j
++) { // allow timeout - better late than never
505 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
506 if (AT91C_BASE_SSC
->SSC_RHR
) break;
510 //AT91C_BASE_SSC->SSC_THR = 0xFF;
513 void WaitForFpgaDelayQueueIsEmpty( uint16_t delay
){
514 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
515 uint8_t fpga_queued_bits
= delay
>> 3; // twich /8 ?? >>3,
516 for (uint8_t i
= 0; i
<= fpga_queued_bits
/8 + 1; ) {
517 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
518 AT91C_BASE_SSC
->SSC_THR
= 0xFF;
524 static void TransmitFor14443b_AsTag( uint8_t *response
, uint16_t len
) {
528 // Signal field is off with the appropriate LED
530 //uint16_t fpgasendQueueDelay = 0;
533 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
| FPGA_HF_SIMULATOR_MODULATE_BPSK
);
536 ClearFpgaShiftingRegisters();
540 // Transmit the response.
541 for(uint16_t i
= 0; i
< len
;) {
542 if(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXRDY
) {
543 AT91C_BASE_SSC
->SSC_THR
= response
[++i
];
545 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
546 b
= AT91C_BASE_SSC
->SSC_RHR
;
551 //WaitForFpgaDelayQueueIsEmpty(fpgasendQueueDelay);
552 AT91C_BASE_SSC
->SSC_THR
= 0xFF;
554 //-----------------------------------------------------------------------------
555 // Main loop of simulated tag: receive commands from reader, decide what
556 // response to send, and send it.
557 //-----------------------------------------------------------------------------
558 void SimulateIso14443bTag(uint32_t pupi
) {
560 ///////////// setup device.
561 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
563 // allocate command receive buffer
565 BigBuf_Clear_ext(false);
569 // connect Demodulated Signal to ADC:
570 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
572 // Set up the synchronous serial port
576 uint16_t len
, cmdsReceived
= 0;
577 int cardSTATE
= SIM_NOFIELD
;
578 int vHf
= 0; // in mV
579 // uint32_t time_0 = 0;
580 // uint32_t t2r_time = 0;
581 // uint32_t r2t_time = 0;
582 uint8_t *receivedCmd
= BigBuf_malloc(MAX_FRAME_SIZE
);
584 // the only commands we understand is WUPB, AFI=0, Select All, N=1:
585 // static const uint8_t cmdWUPB[] = { ISO14443B_REQB, 0x00, 0x08, 0x39, 0x73 }; // WUPB
586 // ... and REQB, AFI=0, Normal Request, N=1:
587 // static const uint8_t cmdREQB[] = { ISO14443B_REQB, 0x00, 0x00, 0x71, 0xFF }; // REQB
589 // static const uint8_t cmdATTRIB[] = { ISO14443B_ATTRIB, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB
591 // ... if not PUPI/UID is supplied we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
592 // supports only 106kBit/s in both directions, max frame size = 32Bytes,
593 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
594 uint8_t respATQB
[] = { 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19,
595 0x22, 0x00, 0x21, 0x85, 0x5e, 0xd7 };
597 // response to HLTB and ATTRIB
598 static const uint8_t respOK
[] = {0x00, 0x78, 0xF0};
600 // ...PUPI/UID supplied from user. Adjust ATQB response accordingly
602 uint8_t len
= sizeof(respATQB
);
603 num_to_bytes(pupi
, 4, respATQB
+1);
604 ComputeCrc14443(CRC_14443_B
, respATQB
, 12, &respATQB
[len
-2], &respATQB
[len
-1]);
607 // prepare "ATQB" tag answer (encoded):
608 CodeIso14443bAsTag(respATQB
, sizeof(respATQB
));
609 uint8_t *encodedATQB
= BigBuf_malloc(ToSendMax
);
610 uint16_t encodedATQBLen
= ToSendMax
;
611 memcpy(encodedATQB
, ToSend
, ToSendMax
);
614 // prepare "OK" tag answer (encoded):
615 CodeIso14443bAsTag(respOK
, sizeof(respOK
));
616 uint8_t *encodedOK
= BigBuf_malloc(ToSendMax
);
617 uint16_t encodedOKLen
= ToSendMax
;
618 memcpy(encodedOK
, ToSend
, ToSendMax
);
621 while (!BUTTON_PRESS() && !usb_poll_validate_length()) {
625 if (cardSTATE
== SIM_NOFIELD
) {
626 vHf
= (MAX_ADC_HF_VOLTAGE
* AvgAdc(ADC_CHAN_HF
)) >> 10;
627 if ( vHf
> MF_MINFIELDV
) {
628 cardSTATE
= SIM_IDLE
;
632 if (cardSTATE
== SIM_NOFIELD
) continue;
634 // Get reader command
635 if (!GetIso14443bCommandFromReader(receivedCmd
, &len
)) {
636 Dbprintf("button pressed, received %d commands", cmdsReceived
);
640 // ISO14443-B protocol states:
641 // REQ or WUP request in ANY state
642 // WUP in HALTED state
644 if ( (receivedCmd
[0] == ISO14443B_REQB
&& (receivedCmd
[2] & 0x8)== 0x8 && cardSTATE
== SIM_HALTED
) ||
645 receivedCmd
[0] == ISO14443B_REQB
){
646 LogTrace(receivedCmd
, len
, 0, 0, NULL
, TRUE
);
647 cardSTATE
= SIM_SELECTING
;
652 * How should this flow go?
654 * send response ( waiting for Attrib)
656 * send response ( waiting for commands 7816)
658 send halt response ( waiting for wupb )
665 LogTrace(receivedCmd
, len
, 0, 0, NULL
, TRUE
);
668 case SIM_SELECTING
: {
669 TransmitFor14443b_AsTag( encodedATQB
, encodedATQBLen
);
670 LogTrace(respATQB
, sizeof(respATQB
), 0, 0, NULL
, FALSE
);
671 cardSTATE
= SIM_WORK
;
675 TransmitFor14443b_AsTag( encodedOK
, encodedOKLen
);
676 LogTrace(respOK
, sizeof(respOK
), 0, 0, NULL
, FALSE
);
677 cardSTATE
= SIM_HALTED
;
680 case SIM_ACKNOWLEDGE
: {
681 TransmitFor14443b_AsTag( encodedOK
, encodedOKLen
);
682 LogTrace(respOK
, sizeof(respOK
), 0, 0, NULL
, FALSE
);
683 cardSTATE
= SIM_IDLE
;
687 if ( len
== 7 && receivedCmd
[0] == ISO14443B_HALT
) {
688 cardSTATE
= SIM_HALTED
;
689 } else if ( len
== 11 && receivedCmd
[0] == ISO14443B_ATTRIB
) {
690 cardSTATE
= SIM_ACKNOWLEDGE
;
695 // - emulate with a memory dump
696 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len
, cmdsReceived
);
700 if (len
>= 3){ // if crc exists
701 ComputeCrc14443(CRC_14443_B
, receivedCmd
, len
-2, &b1
, &b2
);
702 if(b1
!= receivedCmd
[len
-2] || b2
!= receivedCmd
[len
-1])
703 DbpString("+++CRC fail");
705 DbpString("CRC passes");
707 cardSTATE
= SIM_IDLE
;
715 // iceman, could add a switch to turn this on/off (if off, no logging?)
716 if(cmdsReceived
> 1000) {
717 DbpString("14B Simulate, 1000 commands later...");
721 if (MF_DBGLEVEL
>= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing
, BigBuf_get_traceLen());
722 switch_off(); //simulate
725 //=============================================================================
726 // An ISO 14443 Type B reader. We take layer two commands, code them
727 // appropriately, and then send them to the tag. We then listen for the
728 // tag's response, which we leave in the buffer to be demodulated on the
730 //=============================================================================
733 * Handles reception of a bit from the tag
735 * This function is called 2 times per bit (every 4 subcarrier cycles).
736 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
739 * LED C -> ON once we have received the SOF and are expecting the rest.
740 * LED C -> OFF once we have received EOF or are unsynced
742 * Returns: true if we received a EOF
743 * false if we are still waiting for some more
746 static RAMFUNC
int Handle14443bTagSamplesDemod(int ci
, int cq
) {
747 int v
= 0, myI
= ABS(ci
), myQ
= ABS(cq
);
749 // The soft decision on the bit uses an estimate of just the
750 // quadrant of the reference angle, not the exact angle.
751 #define MAKE_SOFT_DECISION() { \
752 if(Demod.sumI > 0) { \
757 if(Demod.sumQ > 0) { \
764 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by abs(ci) + abs(cq)
765 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
766 #define CHECK_FOR_SUBCARRIER_old() { \
768 if(cq < 0) { /* ci < 0, cq < 0 */ \
770 v = -cq - (ci >> 1); \
772 v = -ci - (cq >> 1); \
774 } else { /* ci < 0, cq >= 0 */ \
776 v = -ci + (cq >> 1); \
778 v = cq - (ci >> 1); \
782 if(cq < 0) { /* ci >= 0, cq < 0 */ \
784 v = ci - (cq >> 1); \
786 v = -cq + (ci >> 1); \
788 } else { /* ci >= 0, cq >= 0 */ \
790 v = ci + (cq >> 1); \
792 v = cq + (ci >> 1); \
798 //note: couldn't we just use MAX(ABS(ci),ABS(cq)) + (MIN(ABS(ci),ABS(cq))/2) from common.h - marshmellow
799 #define CHECK_FOR_SUBCARRIER() { \
800 v = MAX(myI, myQ) + (MIN(myI, myQ) >> 1); \
803 switch(Demod
.state
) {
806 CHECK_FOR_SUBCARRIER();
808 // subcarrier detected
809 if (v
> SUBCARRIER_DETECT_THRESHOLD
) {
810 Demod
.state
= DEMOD_PHASE_REF_TRAINING
;
817 case DEMOD_PHASE_REF_TRAINING
:
818 if (Demod
.posCount
< 8) {
820 CHECK_FOR_SUBCARRIER();
822 if (v
> SUBCARRIER_DETECT_THRESHOLD
) {
823 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
824 // note: synchronization time > 80 1/fs
830 Demod
.state
= DEMOD_UNSYNCD
;
833 Demod
.state
= DEMOD_AWAITING_FALLING_EDGE_OF_SOF
;
837 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF
:
839 MAKE_SOFT_DECISION();
841 if (v
< 0) { // logic '0' detected
842 Demod
.state
= DEMOD_GOT_FALLING_EDGE_OF_SOF
;
843 Demod
.posCount
= 0; // start of SOF sequence
845 // maximum length of TR1 = 200 1/fs
846 if(Demod
.posCount
> 26*2) Demod
.state
= DEMOD_UNSYNCD
;
851 case DEMOD_GOT_FALLING_EDGE_OF_SOF
:
854 MAKE_SOFT_DECISION();
857 // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
858 if (Demod
.posCount
< 8*2) {
859 Demod
.state
= DEMOD_UNSYNCD
;
861 LED_C_ON(); // Got SOF
862 //Demod.startTime = GetCountSspClk();
863 Demod
.state
= DEMOD_AWAITING_START_BIT
;
868 // low phase of SOF too long (> 12 etu)
869 if (Demod
.posCount
> 14*2) {
870 Demod
.state
= DEMOD_UNSYNCD
;
876 case DEMOD_AWAITING_START_BIT
:
879 MAKE_SOFT_DECISION();
882 if(Demod
.posCount
> 2*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
883 Demod
.state
= DEMOD_UNSYNCD
;
886 } else { // start bit detected
888 Demod
.posCount
= 1; // this was the first half
891 Demod
.state
= DEMOD_RECEIVING_DATA
;
895 case DEMOD_RECEIVING_DATA
:
897 MAKE_SOFT_DECISION();
899 if (Demod
.posCount
== 0) {
904 // second half of bit
906 Demod
.shiftReg
>>= 1;
909 if (Demod
.thisBit
> 0) Demod
.shiftReg
|= 0x200;
913 // 1 start 8 data 1 stop = 10
914 if (Demod
.bitCount
== 10) {
916 uint16_t s
= Demod
.shiftReg
;
918 // stop bit == '1', start bit == '0'
919 if ((s
& 0x200) && (s
& 0x001) == 0 ) {
920 // left shift to drop the startbit
921 Demod
.output
[Demod
.len
] = (s
>> 1) & 0xFF;
923 Demod
.state
= DEMOD_AWAITING_START_BIT
;
925 // this one is a bit hard, either its a correc byte or its unsynced.
926 Demod
.state
= DEMOD_UNSYNCD
;
927 //Demod.endTime = GetCountSspClk();
930 // This is EOF (start, stop and all data bits == '0'
931 if (s
== 0) return TRUE
;
939 Demod
.state
= DEMOD_UNSYNCD
;
948 * Demodulate the samples we received from the tag, also log to tracebuffer
949 * quiet: set to 'TRUE' to disable debug output
951 static void GetTagSamplesFor14443bDemod() {
952 bool gotFrame
= FALSE
, finished
= FALSE
;
953 int lastRxCounter
= ISO14443B_DMA_BUFFER_SIZE
;
955 uint32_t time_0
= 0, time_stop
= 0;
959 // Set up the demodulator for tag -> reader responses.
960 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE
));
962 // The DMA buffer, used to stream samples from the FPGA
963 int8_t *dmaBuf
= (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE
);
964 int8_t *upTo
= dmaBuf
;
966 // Setup and start DMA.
967 if ( !FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO14443B_DMA_BUFFER_SIZE
) ){
968 if (MF_DBGLEVEL
> 1) Dbprintf("FpgaSetupSscDma failed. Exiting");
972 // And put the FPGA in the appropriate mode
973 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
);
976 time_0
= GetCountSspClk();
978 // rx counter - dma counter? (how much?) & (mod) mask > 2. (since 2bytes at the time is read)
979 while ( !finished
) {
984 // LSB is a fpga signal bit.
990 // restart DMA buffer to receive again.
991 if(upTo
>= dmaBuf
+ ISO14443B_DMA_BUFFER_SIZE
) {
993 lastRxCounter
= ISO14443B_DMA_BUFFER_SIZE
;
994 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) upTo
;
995 AT91C_BASE_PDC_SSC
->PDC_RNCR
= ISO14443B_DMA_BUFFER_SIZE
;
998 // https://github.com/Proxmark/proxmark3/issues/103
999 gotFrame
= Handle14443bTagSamplesDemod(ci
, cq
);
1000 time_stop
= GetCountSspClk() - time_0
;
1002 finished
= (time_stop
> iso14b_timeout
|| gotFrame
);
1005 FpgaDisableSscDma();
1007 if ( upTo
) upTo
= NULL
;
1009 if (MF_DBGLEVEL
>= 3) {
1010 Dbprintf("Demod.state = %d, Demod.len = %u, PDC_RCR = %u",
1013 AT91C_BASE_PDC_SSC
->PDC_RCR
1017 // print the last batch of IQ values from FPGA
1018 if (MF_DBGLEVEL
== 4)
1019 Dbhexdump(ISO14443B_DMA_BUFFER_SIZE
, (uint8_t *)dmaBuf
, FALSE
);
1021 if ( Demod
.len
> 0 )
1022 LogTrace(Demod
.output
, Demod
.len
, time_0
, time_stop
, NULL
, FALSE
);
1026 //-----------------------------------------------------------------------------
1027 // Transmit the command (to the tag) that was placed in ToSend[].
1028 //-----------------------------------------------------------------------------
1029 static void TransmitFor14443b_AsReader(void) {
1031 // we could been in following mode:
1032 // FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ
1033 // if its second call or more
1035 // while(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1036 // AT91C_BASE_SSC->SSC_THR = 0XFF;
1039 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX
| FPGA_HF_READER_TX_SHALLOW_MOD
);
1043 volatile uint32_t b
;
1045 // What does this loop do? Is it TR1?
1046 // 0xFF = 8 bits of 1. 1 bit == 1Etu,..
1047 // loop 10 * 8 = 80 ETU of delay, with a non modulated signal. why?
1049 for(c
= 0; c
< 50;) {
1050 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1051 AT91C_BASE_SSC
->SSC_THR
= 0xFF;
1054 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1055 b
= AT91C_BASE_SSC
->SSC_RHR
;
1061 for(c
= 0; c
< ToSendMax
;) {
1062 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
1063 AT91C_BASE_SSC
->SSC_THR
= ToSend
[c
++];
1065 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
1066 b
= AT91C_BASE_SSC
->SSC_RHR
;
1070 //WaitForFpgaDelayQueueIsEmpty(delay);
1071 // We should wait here for the FPGA to send all bits.
1075 //-----------------------------------------------------------------------------
1076 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
1077 // so that it is ready to transmit to the tag using TransmitFor14443b().
1078 //-----------------------------------------------------------------------------
1079 static void CodeIso14443bAsReader(const uint8_t *cmd
, int len
) {
1081 * Reader data transmission:
1082 * - no modulation ONES
1084 * - Command, data and CRC_B
1086 * - no modulation ONES
1089 * TR0 - 8 ETUS minimum.
1091 * QUESTION: how long is a 1 or 0 in pulses in the xcorr_848 mode?
1092 * 1 "stuffbit" = 1ETU (9us)
1100 // 10-11 ETUs of ZERO
1101 for(i
= 0; i
< 10; ++i
) ToSendStuffBit(0);
1109 // from here we add BITS
1110 for(i
= 0; i
< len
; ++i
) {
1115 // if ( b & 1 ) ToSendStuffBit(1); else ToSendStuffBit(0);
1116 // if ( (b>>1) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1117 // if ( (b>>2) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1118 // if ( (b>>3) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1119 // if ( (b>>4) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1120 // if ( (b>>5) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1121 // if ( (b>>6) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1122 // if ( (b>>7) & 1) ToSendStuffBit(1); else ToSendStuffBit(0);
1124 ToSendStuffBit( b
& 1);
1125 ToSendStuffBit( (b
>>1) & 1);
1126 ToSendStuffBit( (b
>>2) & 1);
1127 ToSendStuffBit( (b
>>3) & 1);
1128 ToSendStuffBit( (b
>>4) & 1);
1129 ToSendStuffBit( (b
>>5) & 1);
1130 ToSendStuffBit( (b
>>6) & 1);
1131 ToSendStuffBit( (b
>>7) & 1);
1135 // EGT extra guard time
1136 // For PCD it ranges 0-57us (1etu = 9us)
1143 // 10-11 ETUs of ZERO
1144 for(i
= 0; i
< 10; ++i
) ToSendStuffBit(0);
1146 // Transition time. TR0 - guard time
1148 // Per specification, Subcarrier must be stopped no later than 2 ETUs after EOF.
1149 // I'm guessing this is for the FPGA to be able to send all bits before we switch to listening mode
1150 for(i
= 0; i
< 32 ; ++i
) ToSendStuffBit(1);
1152 // TR1 - Synchronization time
1153 // Convert from last character reference to length
1159 * Convenience function to encode, transmit and trace iso 14443b comms
1161 static void CodeAndTransmit14443bAsReader(const uint8_t *cmd
, int len
) {
1163 uint32_t time_start
= GetCountSspClk();
1165 CodeIso14443bAsReader(cmd
, len
);
1167 TransmitFor14443b_AsReader();
1169 if(trigger
) LED_A_ON();
1171 LogTrace(cmd
, len
, time_start
, GetCountSspClk()-time_start
, NULL
, TRUE
);
1174 /* Sends an APDU to the tag
1175 * TODO: check CRC and preamble
1177 uint8_t iso14443b_apdu(uint8_t const *message
, size_t message_length
, uint8_t *response
)
1179 uint8_t crc
[2] = {0x00, 0x00};
1180 uint8_t message_frame
[message_length
+ 4];
1182 message_frame
[0] = 0x0A | pcb_blocknum
;
1185 message_frame
[1] = 0;
1187 memcpy(message_frame
+ 2, message
, message_length
);
1189 ComputeCrc14443(CRC_14443_B
, message_frame
, message_length
+ 2, &message_frame
[message_length
+ 2], &message_frame
[message_length
+ 3]);
1191 CodeAndTransmit14443bAsReader(message_frame
, message_length
+ 4); //no
1193 GetTagSamplesFor14443bDemod(); //no
1198 ComputeCrc14443(CRC_14443_B
, Demod
.output
, Demod
.len
-2, &crc
[0], &crc
[1]);
1199 if ( crc
[0] != Demod
.output
[Demod
.len
-2] || crc
[1] != Demod
.output
[Demod
.len
-1] )
1202 // copy response contents
1203 if(response
!= NULL
)
1204 memcpy(response
, Demod
.output
, Demod
.len
);
1212 uint8_t iso14443b_select_srx_card(iso14b_card_select_t
*card
)
1214 // INITIATE command: wake up the tag using the INITIATE
1215 static const uint8_t init_srx
[] = { ISO14443B_INITIATE
, 0x00, 0x97, 0x5b };
1216 // SELECT command (with space for CRC)
1217 uint8_t select_srx
[] = { ISO14443B_SELECT
, 0x00, 0x00, 0x00};
1218 // temp to calc crc.
1219 uint8_t crc
[2] = {0x00, 0x00};
1221 CodeAndTransmit14443bAsReader(init_srx
, sizeof(init_srx
));
1222 GetTagSamplesFor14443bDemod(); //no
1224 if (Demod
.len
== 0) return 2;
1226 // Randomly generated Chip ID
1227 if (card
) card
->chipid
= Demod
.output
[0];
1229 select_srx
[1] = Demod
.output
[0];
1231 ComputeCrc14443(CRC_14443_B
, select_srx
, 2, &select_srx
[2], &select_srx
[3]);
1232 CodeAndTransmit14443bAsReader(select_srx
, sizeof(select_srx
));
1233 GetTagSamplesFor14443bDemod(); //no
1235 if (Demod
.len
!= 3) return 2;
1237 // Check the CRC of the answer:
1238 ComputeCrc14443(CRC_14443_B
, Demod
.output
, Demod
.len
-2 , &crc
[0], &crc
[1]);
1239 if(crc
[0] != Demod
.output
[1] || crc
[1] != Demod
.output
[2]) return 3;
1241 // Check response from the tag: should be the same UID as the command we just sent:
1242 if (select_srx
[1] != Demod
.output
[0]) return 1;
1244 // First get the tag's UID:
1245 select_srx
[0] = ISO14443B_GET_UID
;
1247 ComputeCrc14443(CRC_14443_B
, select_srx
, 1 , &select_srx
[1], &select_srx
[2]);
1248 CodeAndTransmit14443bAsReader(select_srx
, 3); // Only first three bytes for this one
1249 GetTagSamplesFor14443bDemod(); //no
1251 if (Demod
.len
!= 10) return 2;
1253 // The check the CRC of the answer
1254 ComputeCrc14443(CRC_14443_B
, Demod
.output
, Demod
.len
-2, &crc
[0], &crc
[1]);
1255 if(crc
[0] != Demod
.output
[8] || crc
[1] != Demod
.output
[9]) return 3;
1259 memcpy(card
->uid
, Demod
.output
, 8);
1264 /* Perform the ISO 14443 B Card Selection procedure
1265 * Currently does NOT do any collision handling.
1266 * It expects 0-1 cards in the device's range.
1267 * TODO: Support multiple cards (perform anticollision)
1268 * TODO: Verify CRC checksums
1270 uint8_t iso14443b_select_card(iso14b_card_select_t
*card
)
1272 // WUPB command (including CRC)
1273 // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state
1274 static const uint8_t wupb
[] = { ISO14443B_REQB
, 0x00, 0x08, 0x39, 0x73 };
1275 // ATTRIB command (with space for CRC)
1276 uint8_t attrib
[] = { ISO14443B_ATTRIB
, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00};
1278 // temp to calc crc.
1279 uint8_t crc
[2] = {0x00, 0x00};
1281 // first, wake up the tag
1282 CodeAndTransmit14443bAsReader(wupb
, sizeof(wupb
));
1283 GetTagSamplesFor14443bDemod(); //select_card
1286 if (Demod
.len
< 14) return 2;
1289 ComputeCrc14443(CRC_14443_B
, Demod
.output
, Demod
.len
-2, &crc
[0], &crc
[1]);
1290 if ( crc
[0] != Demod
.output
[12] || crc
[1] != Demod
.output
[13] )
1295 memcpy(card
->uid
, Demod
.output
+1, 4);
1296 memcpy(card
->atqb
, Demod
.output
+5, 7);
1299 // copy the PUPI to ATTRIB ( PUPI == UID )
1300 memcpy(attrib
+ 1, Demod
.output
+ 1, 4);
1302 // copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into ATTRIB (Param 3)
1303 attrib
[7] = Demod
.output
[10] & 0x0F;
1304 ComputeCrc14443(CRC_14443_B
, attrib
, 9, attrib
+ 9, attrib
+ 10);
1306 CodeAndTransmit14443bAsReader(attrib
, sizeof(attrib
));
1307 GetTagSamplesFor14443bDemod();//select_card
1309 // Answer to ATTRIB too short?
1310 if(Demod
.len
< 3) return 2;
1313 ComputeCrc14443(CRC_14443_B
, Demod
.output
, Demod
.len
-2, &crc
[0], &crc
[1]);
1314 if ( crc
[0] != Demod
.output
[1] || crc
[1] != Demod
.output
[2] )
1320 card
->cid
= Demod
.output
[0];
1323 uint16_t maxFrame
= card
->atqb
[5] >> 4;
1324 if (maxFrame
< 5) maxFrame
= 8 * maxFrame
+ 16;
1325 else if (maxFrame
== 5) maxFrame
= 64;
1326 else if (maxFrame
== 6) maxFrame
= 96;
1327 else if (maxFrame
== 7) maxFrame
= 128;
1328 else if (maxFrame
== 8) maxFrame
= 256;
1329 else maxFrame
= 257;
1330 iso14b_set_maxframesize(maxFrame
);
1333 uint8_t fwt
= card
->atqb
[6] >> 4;
1335 uint32_t fwt_time
= (302 << fwt
);
1336 iso14b_set_timeout( fwt_time
);
1339 // reset PCB block number
1344 // Set up ISO 14443 Type B communication (similar to iso14443a_setup)
1345 // field is setup for "Sending as Reader"
1346 void iso14443b_setup() {
1347 if (MF_DBGLEVEL
> 3) Dbprintf("iso1443b_setup Enter");
1349 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1351 //BigBuf_Clear_ext(false);
1353 // Initialize Demod and Uart structs
1354 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE
));
1355 UartInit(BigBuf_malloc(MAX_FRAME_SIZE
));
1357 // connect Demodulated Signal to ADC:
1358 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1360 // Set up the synchronous serial port
1363 // Signal field is on with the appropriate LED
1364 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX
| FPGA_HF_READER_TX_SHALLOW_MOD
);
1371 if (MF_DBGLEVEL
> 3) Dbprintf("iso1443b_setup Exit");
1374 //-----------------------------------------------------------------------------
1375 // Read a SRI512 ISO 14443B tag.
1377 // SRI512 tags are just simple memory tags, here we're looking at making a dump
1378 // of the contents of the memory. No anticollision algorithm is done, we assume
1379 // we have a single tag in the field.
1381 // I tried to be systematic and check every answer of the tag, every CRC, etc...
1382 //-----------------------------------------------------------------------------
1383 void ReadSTMemoryIso14443b(uint8_t numofblocks
)
1385 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1387 // Make sure that we start from off, since the tags are stateful;
1388 // confusing things will happen if we don't reset them between reads.
1389 switch_off(); // before ReadStMemory
1395 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1398 // Now give it time to spin up.
1399 // Signal field is on with the appropriate LED
1401 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
);
1404 // First command: wake up the tag using the INITIATE command
1405 uint8_t cmd1
[] = {ISO14443B_INITIATE
, 0x00, 0x97, 0x5b};
1406 CodeAndTransmit14443bAsReader(cmd1
, sizeof(cmd1
)); //no
1407 GetTagSamplesFor14443bDemod(); // no
1409 if (Demod
.len
== 0) {
1410 DbpString("No response from tag");
1414 Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
1415 Demod
.output
[0], Demod
.output
[1], Demod
.output
[2]);
1418 // There is a response, SELECT the uid
1419 DbpString("Now SELECT tag:");
1420 cmd1
[0] = ISO14443B_SELECT
; // 0x0E is SELECT
1421 cmd1
[1] = Demod
.output
[0];
1422 ComputeCrc14443(CRC_14443_B
, cmd1
, 2, &cmd1
[2], &cmd1
[3]);
1423 CodeAndTransmit14443bAsReader(cmd1
, sizeof(cmd1
)); //no
1424 GetTagSamplesFor14443bDemod(); //no
1425 if (Demod
.len
!= 3) {
1426 Dbprintf("Expected 3 bytes from tag, got %d", Demod
.len
);
1430 // Check the CRC of the answer:
1431 ComputeCrc14443(CRC_14443_B
, Demod
.output
, 1 , &cmd1
[2], &cmd1
[3]);
1432 if(cmd1
[2] != Demod
.output
[1] || cmd1
[3] != Demod
.output
[2]) {
1433 DbpString("CRC Error reading select response.");
1437 // Check response from the tag: should be the same UID as the command we just sent:
1438 if (cmd1
[1] != Demod
.output
[0]) {
1439 Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1
[1], Demod
.output
[0]);
1444 // Tag is now selected,
1445 // First get the tag's UID:
1446 cmd1
[0] = ISO14443B_GET_UID
;
1447 ComputeCrc14443(CRC_14443_B
, cmd1
, 1 , &cmd1
[1], &cmd1
[2]);
1448 CodeAndTransmit14443bAsReader(cmd1
, 3); // no -- Only first three bytes for this one
1449 GetTagSamplesFor14443bDemod(); //no
1450 if (Demod
.len
!= 10) {
1451 Dbprintf("Expected 10 bytes from tag, got %d", Demod
.len
);
1455 // The check the CRC of the answer (use cmd1 as temporary variable):
1456 ComputeCrc14443(CRC_14443_B
, Demod
.output
, 8, &cmd1
[2], &cmd1
[3]);
1457 if(cmd1
[2] != Demod
.output
[8] || cmd1
[3] != Demod
.output
[9]) {
1458 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1459 (cmd1
[2]<<8)+cmd1
[3], (Demod
.output
[8]<<8)+Demod
.output
[9]);
1460 // Do not return;, let's go on... (we should retry, maybe ?)
1462 Dbprintf("Tag UID (64 bits): %08x %08x",
1463 (Demod
.output
[7]<<24) + (Demod
.output
[6]<<16) + (Demod
.output
[5]<<8) + Demod
.output
[4],
1464 (Demod
.output
[3]<<24) + (Demod
.output
[2]<<16) + (Demod
.output
[1]<<8) + Demod
.output
[0]);
1466 // Now loop to read all 16 blocks, address from 0 to last block
1467 Dbprintf("Tag memory dump, block 0 to %d", numofblocks
);
1473 if (i
== numofblocks
) {
1474 DbpString("System area block (0xff):");
1478 ComputeCrc14443(CRC_14443_B
, cmd1
, 2, &cmd1
[2], &cmd1
[3]);
1479 CodeAndTransmit14443bAsReader(cmd1
, sizeof(cmd1
)); //no
1480 GetTagSamplesFor14443bDemod(); //no
1482 if (Demod
.len
!= 6) { // Check if we got an answer from the tag
1483 DbpString("Expected 6 bytes from tag, got less...");
1486 // The check the CRC of the answer (use cmd1 as temporary variable):
1487 ComputeCrc14443(CRC_14443_B
, Demod
.output
, 4, &cmd1
[2], &cmd1
[3]);
1488 if(cmd1
[2] != Demod
.output
[4] || cmd1
[3] != Demod
.output
[5]) {
1489 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1490 (cmd1
[2]<<8)+cmd1
[3], (Demod
.output
[4]<<8)+Demod
.output
[5]);
1491 // Do not return;, let's go on... (we should retry, maybe ?)
1493 // Now print out the memory location:
1494 Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i
,
1495 (Demod
.output
[3]<<24) + (Demod
.output
[2]<<16) + (Demod
.output
[1]<<8) + Demod
.output
[0],
1496 (Demod
.output
[4]<<8)+Demod
.output
[5]);
1498 if (i
== 0xff) break;
1506 static void iso1444b_setup_snoop(void){
1507 if (MF_DBGLEVEL
> 3) Dbprintf("iso1443b_setup_snoop Enter");
1509 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1511 BigBuf_Clear_ext(false);
1512 clear_trace();//setup snoop
1515 // Initialize Demod and Uart structs
1516 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE
));
1517 UartInit(BigBuf_malloc(MAX_FRAME_SIZE
));
1519 if (MF_DBGLEVEL
> 1) {
1520 // Print debug information about the buffer sizes
1521 Dbprintf("Snooping buffers initialized:");
1522 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1523 Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE
);
1524 Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE
);
1525 Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE
);
1528 // connect Demodulated Signal to ADC:
1529 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1531 // Setup for the DMA.
1534 // Set FPGA in the appropriate mode
1535 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
| FPGA_HF_READER_RX_XCORR_SNOOP
);
1538 // Start the SSP timer
1540 if (MF_DBGLEVEL
> 3) Dbprintf("iso1443b_setup_snoop Exit");
1543 //=============================================================================
1544 // Finally, the `sniffer' combines elements from both the reader and
1545 // simulated tag, to show both sides of the conversation.
1546 //=============================================================================
1548 //-----------------------------------------------------------------------------
1549 // Record the sequence of commands sent by the reader to the tag, with
1550 // triggering so that we start recording at the point that the tag is moved
1552 //-----------------------------------------------------------------------------
1554 * Memory usage for this function, (within BigBuf)
1555 * Last Received command (reader->tag) - MAX_FRAME_SIZE
1556 * Last Received command (tag->reader) - MAX_FRAME_SIZE
1557 * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
1558 * Demodulated samples received - all the rest
1560 void RAMFUNC
SnoopIso14443b(void) {
1562 uint32_t time_0
= 0, time_start
= 0, time_stop
= 0;
1564 int lastRxCounter
= ISO14443B_DMA_BUFFER_SIZE
;
1566 // We won't start recording the frames that we acquire until we trigger;
1567 // a good trigger condition to get started is probably when we see a
1568 // response from the tag.
1569 bool triggered
= TRUE
; // TODO: set and evaluate trigger condition
1570 bool TagIsActive
= FALSE
;
1571 bool ReaderIsActive
= FALSE
;
1573 iso1444b_setup_snoop();
1575 // The DMA buffer, used to stream samples from the FPGA
1576 int8_t *dmaBuf
= (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE
);
1577 int8_t *upTo
= dmaBuf
;
1579 // Setup and start DMA.
1580 if ( !FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO14443B_DMA_BUFFER_SIZE
) ){
1581 if (MF_DBGLEVEL
> 1) Dbprintf("FpgaSetupSscDma failed. Exiting");
1586 time_0
= GetCountSspClk();
1588 // And now we loop, receiving samples.
1598 if (upTo
>= dmaBuf
+ ISO14443B_DMA_BUFFER_SIZE
) {
1600 lastRxCounter
= ISO14443B_DMA_BUFFER_SIZE
;
1601 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
;
1602 AT91C_BASE_PDC_SSC
->PDC_RNCR
= ISO14443B_DMA_BUFFER_SIZE
;
1605 if (MF_DBGLEVEL
>= 2) DbpString("Trace full");
1609 if (BUTTON_PRESS()) {
1610 if (MF_DBGLEVEL
>= 2) DbpString("cancelled");
1619 // no need to try decoding reader data if the tag is sending
1620 if (Handle14443bReaderUartBit(ci
& 0x01)) {
1622 time_stop
= GetCountSspClk() - time_0
;
1625 LogTrace(Uart
.output
, Uart
.byteCnt
, time_start
, time_stop
, NULL
, TRUE
);
1627 /* And ready to receive another command. */
1629 /* And also reset the demod code, which might have been */
1630 /* false-triggered by the commands from the reader. */
1633 time_start
= GetCountSspClk() - time_0
;
1636 if (Handle14443bReaderUartBit(cq
& 0x01)) {
1638 time_stop
= GetCountSspClk() - time_0
;
1641 LogTrace(Uart
.output
, Uart
.byteCnt
, time_start
, time_stop
, NULL
, TRUE
);
1643 /* And ready to receive another command. */
1645 /* And also reset the demod code, which might have been */
1646 /* false-triggered by the commands from the reader. */
1649 time_start
= GetCountSspClk() - time_0
;
1651 ReaderIsActive
= (Uart
.state
> STATE_GOT_FALLING_EDGE_OF_SOF
);
1655 if (!ReaderIsActive
) {
1656 // no need to try decoding tag data if the reader is sending - and we cannot afford the time
1657 // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103
1658 // LSB is a fpga signal bit.
1659 if (Handle14443bTagSamplesDemod(ci
>> 1, cq
>> 1)) {
1661 time_stop
= GetCountSspClk() - time_0
;
1663 LogTrace(Demod
.output
, Demod
.len
, time_start
, time_stop
, NULL
, FALSE
);
1667 // And ready to receive another response.
1670 time_start
= GetCountSspClk() - time_0
;
1672 TagIsActive
= (Demod
.state
> DEMOD_GOT_FALLING_EDGE_OF_SOF
);
1676 switch_off(); // Snoop
1678 DbpString("Snoop statistics:");
1679 Dbprintf(" Uart State: %x ByteCount: %i ByteCountMax: %i", Uart
.state
, Uart
.byteCnt
, Uart
.byteCntMax
);
1680 Dbprintf(" Trace length: %i", BigBuf_get_traceLen());
1683 if ( upTo
) upTo
= NULL
;
1685 // Uart.byteCntMax should be set with ATQB value..
1688 void iso14b_set_trigger(bool enable
) {
1693 * Send raw command to tag ISO14443B
1695 * param flags enum ISO14B_COMMAND. (mifare.h)
1696 * len len of buffer data
1697 * data buffer with bytes to send
1703 void SendRawCommand14443B_Ex(UsbCommand
*c
)
1705 iso14b_command_t param
= c
->arg
[0];
1706 size_t len
= c
->arg
[1] & 0xffff;
1707 uint8_t *cmd
= c
->d
.asBytes
;
1709 uint32_t sendlen
= sizeof(iso14b_card_select_t
);
1710 uint8_t buf
[USB_CMD_DATA_SIZE
] = {0x00};
1712 if (MF_DBGLEVEL
> 3) Dbprintf("14b raw: param, %04x", param
);
1714 // turn on trigger (LED_A)
1715 if ((param
& ISO14B_REQUEST_TRIGGER
) == ISO14B_REQUEST_TRIGGER
)
1716 iso14b_set_trigger(TRUE
);
1718 if ((param
& ISO14B_CONNECT
) == ISO14B_CONNECT
) {
1719 // Make sure that we start from off, since the tags are stateful;
1720 // confusing things will happen if we don't reset them between reads.
1721 //switch_off(); // before connect in raw
1727 if ((param
& ISO14B_SELECT_STD
) == ISO14B_SELECT_STD
) {
1728 iso14b_card_select_t
*card
= (iso14b_card_select_t
*)buf
;
1729 status
= iso14443b_select_card(card
);
1730 cmd_send(CMD_ACK
, status
, sendlen
, 0, buf
, sendlen
);
1731 // 0: OK 2: attrib fail, 3:crc fail,
1732 if ( status
> 0 ) return;
1735 if ((param
& ISO14B_SELECT_SR
) == ISO14B_SELECT_SR
) {
1736 iso14b_card_select_t
*card
= (iso14b_card_select_t
*)buf
;
1737 status
= iso14443b_select_srx_card(card
);
1738 cmd_send(CMD_ACK
, status
, sendlen
, 0, buf
, sendlen
);
1739 // 0: OK 2: attrib fail, 3:crc fail,
1740 if ( status
> 0 ) return;
1743 if ((param
& ISO14B_APDU
) == ISO14B_APDU
) {
1744 status
= iso14443b_apdu(cmd
, len
, buf
);
1745 cmd_send(CMD_ACK
, status
, status
, 0, buf
, status
);
1748 if ((param
& ISO14B_RAW
) == ISO14B_RAW
) {
1749 if((param
& ISO14B_APPEND_CRC
) == ISO14B_APPEND_CRC
) {
1750 AppendCrc14443b(cmd
, len
);
1754 CodeAndTransmit14443bAsReader(cmd
, len
); // raw
1755 GetTagSamplesFor14443bDemod(); // raw
1757 sendlen
= MIN(Demod
.len
, USB_CMD_DATA_SIZE
);
1758 status
= (Demod
.len
> 0) ? 0 : 1;
1759 cmd_send(CMD_ACK
, status
, sendlen
, 0, Demod
.output
, sendlen
);
1762 // turn off trigger (LED_A)
1763 if ((param
& ISO14B_REQUEST_TRIGGER
) == ISO14B_REQUEST_TRIGGER
)
1764 iso14b_set_trigger(FALSE
);
1766 // turn off antenna et al
1767 // we don't send a HALT command.
1768 if ((param
& ISO14B_DISCONNECT
) == ISO14B_DISCONNECT
) {
1769 if (MF_DBGLEVEL
> 3) Dbprintf("disconnect");
1770 switch_off(); // disconnect raw
1772 //FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);