]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/iso14443a.c
projects / proxmark3-svn / blob
? search:


d7a86a0990f3dc27de105411add47973e4f3b78c
[proxmark3-svn] / armsrc / iso14443a.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "proxmark3.h"
14 #include "apps.h"
15 #include "util.h"
16 #include "string.h"
17 #include "cmd.h"
18 #include "iso14443crc.h"
19 #include "iso14443a.h"
20 #include "crapto1.h"
21 #include "mifareutil.h"
22 #include "BigBuf.h"
23 static uint32_t iso14a_timeout;
24 int rsamples = 0;
25 uint8_t trigger = 0;
26 // the block number for the ISO14443-4 PCB
27 static uint8_t iso14_pcb_blocknum = 0;
28
29 //
30 // ISO14443 timing:
31 //
32 // minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
33 #define REQUEST_GUARD_TIME (7000/16 + 1)
34 // minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles
35 #define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1)
36 // bool LastCommandWasRequest = FALSE;
37
38 //
39 // Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
40 //
41 // When the PM acts as reader and is receiving tag data, it takes
42 // 3 ticks delay in the AD converter
43 // 16 ticks until the modulation detector completes and sets curbit
44 // 8 ticks until bit_to_arm is assigned from curbit
45 // 8*16 ticks for the transfer from FPGA to ARM
46 // 4*16 ticks until we measure the time
47 // - 8*16 ticks because we measure the time of the previous transfer
48 #define DELAY_AIR2ARM_AS_READER (3 + 16 + 8 + 8*16 + 4*16 - 8*16)
49
50 // When the PM acts as a reader and is sending, it takes
51 // 4*16 ticks until we can write data to the sending hold register
52 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
53 // 8 ticks until the first transfer starts
54 // 8 ticks later the FPGA samples the data
55 // 1 tick to assign mod_sig_coil
56 #define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
57
58 // When the PM acts as tag and is receiving it takes
59 // 2 ticks delay in the RF part (for the first falling edge),
60 // 3 ticks for the A/D conversion,
61 // 8 ticks on average until the start of the SSC transfer,
62 // 8 ticks until the SSC samples the first data
63 // 7*16 ticks to complete the transfer from FPGA to ARM
64 // 8 ticks until the next ssp_clk rising edge
65 // 4*16 ticks until we measure the time
66 // - 8*16 ticks because we measure the time of the previous transfer
67 #define DELAY_AIR2ARM_AS_TAG (2 + 3 + 8 + 8 + 7*16 + 8 + 4*16 - 8*16)
68
69 // The FPGA will report its internal sending delay in
70 uint16_t FpgaSendQueueDelay;
71 // the 5 first bits are the number of bits buffered in mod_sig_buf
72 // the last three bits are the remaining ticks/2 after the mod_sig_buf shift
73 #define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
74
75 // When the PM acts as tag and is sending, it takes
76 // 4*16 ticks until we can write data to the sending hold register
77 // 8*16 ticks until the SHR is transferred to the Sending Shift Register
78 // 8 ticks until the first transfer starts
79 // 8 ticks later the FPGA samples the data
80 // + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
81 // + 1 tick to assign mod_sig_coil
82 #define DELAY_ARM2AIR_AS_TAG (4*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
83
84 // When the PM acts as sniffer and is receiving tag data, it takes
85 // 3 ticks A/D conversion
86 // 14 ticks to complete the modulation detection
87 // 8 ticks (on average) until the result is stored in to_arm
88 // + the delays in transferring data - which is the same for
89 // sniffing reader and tag data and therefore not relevant
90 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
91
92 // When the PM acts as sniffer and is receiving reader data, it takes
93 // 2 ticks delay in analogue RF receiver (for the falling edge of the
94 // start bit, which marks the start of the communication)
95 // 3 ticks A/D conversion
96 // 8 ticks on average until the data is stored in to_arm.
97 // + the delays in transferring data - which is the same for
98 // sniffing reader and tag data and therefore not relevant
99 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
100
101 //variables used for timing purposes:
102 //these are in ssp_clk cycles:
103 static uint32_t NextTransferTime;
104 static uint32_t LastTimeProxToAirStart;
105 static uint32_t LastProxToAirDuration;
106
107
108
109 // CARD TO READER - manchester
110 // Sequence D: 11110000 modulation with subcarrier during first half
111 // Sequence E: 00001111 modulation with subcarrier during second half
112 // Sequence F: 00000000 no modulation with subcarrier
113 // READER TO CARD - miller
114 // Sequence X: 00001100 drop after half a period
115 // Sequence Y: 00000000 no drop
116 // Sequence Z: 11000000 drop at start
117 #define SEC_D 0xf0
118 #define SEC_E 0x0f
119 #define SEC_F 0x00
120 #define SEC_X 0x0c
121 #define SEC_Y 0x00
122 #define SEC_Z 0xc0
123
124 const uint8_t OddByteParity[256] = {
125 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
126 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
127 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
128 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
129 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
130 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
131 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
132 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
133 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
134 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
135 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
136 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
137 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
138 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
139 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
140 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
141 };
142
143
144 void iso14a_set_trigger(bool enable) {
145 trigger = enable;
146 }
147
148
149 void iso14a_set_timeout(uint32_t timeout) {
150 iso14a_timeout = timeout;
151 if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);
152 }
153
154
155 void iso14a_set_ATS_timeout(uint8_t *ats) {
156
157 uint8_t tb1;
158 uint8_t fwi;
159 uint32_t fwt;
160
161 if (ats[0] > 1) { // there is a format byte T0
162 if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)
163 if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)
164 tb1 = ats[3];
165 } else {
166 tb1 = ats[2];
167 }
168 fwi = (tb1 & 0xf0) >> 4; // frame waiting indicator (FWI)
169 fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc
170
171 iso14a_set_timeout(fwt/(8*16));
172 }
173 }
174 }
175
176
177 //-----------------------------------------------------------------------------
178 // Generate the parity value for a byte sequence
179 //
180 //-----------------------------------------------------------------------------
181 byte_t oddparity (const byte_t bt)
182 {
183 return OddByteParity[bt];
184 }
185
186 void GetParity(const uint8_t *pbtCmd, uint16_t iLen, uint8_t *par)
187 {
188 uint16_t paritybit_cnt = 0;
189 uint16_t paritybyte_cnt = 0;
190 uint8_t parityBits = 0;
191
192 for (uint16_t i = 0; i < iLen; i++) {
193 // Generate the parity bits
194 parityBits |= ((OddByteParity[pbtCmd[i]]) << (7-paritybit_cnt));
195 if (paritybit_cnt == 7) {
196 par[paritybyte_cnt] = parityBits; // save 8 Bits parity
197 parityBits = 0; // and advance to next Parity Byte
198 paritybyte_cnt++;
199 paritybit_cnt = 0;
200 } else {
201 paritybit_cnt++;
202 }
203 }
204
205 // save remaining parity bits
206 par[paritybyte_cnt] = parityBits;
207
208 }
209
210 void AppendCrc14443a(uint8_t* data, int len)
211 {
212 ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
213 }
214
215 void AppendCrc14443b(uint8_t* data, int len)
216 {
217 ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
218 }
219
220
221 //=============================================================================
222 // ISO 14443 Type A - Miller decoder
223 //=============================================================================
224 // Basics:
225 // This decoder is used when the PM3 acts as a tag.
226 // The reader will generate "pauses" by temporarily switching of the field.
227 // At the PM3 antenna we will therefore measure a modulated antenna voltage.
228 // The FPGA does a comparison with a threshold and would deliver e.g.:
229 // ........ 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 .......
230 // The Miller decoder needs to identify the following sequences:
231 // 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated: pause at beginning - Sequence Z ("start of communication" or a "0")
232 // 8 ticks without a modulation: no pause - Sequence Y (a "0" or "end of communication" or "no information")
233 // 4 ticks unmodulated followed by 2 (or 3) ticks pause: pause in second half - Sequence X (a "1")
234 // Note 1: the bitstream may start at any time. We therefore need to sync.
235 // Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
236 //-----------------------------------------------------------------------------
237 static tUart Uart;
238
239 // Lookup-Table to decide if 4 raw bits are a modulation.
240 // We accept the following:
241 // 0001 - a 3 tick wide pause
242 // 0011 - a 2 tick wide pause, or a three tick wide pause shifted left
243 // 0111 - a 2 tick wide pause shifted left
244 // 1001 - a 2 tick wide pause shifted right
245 const bool Mod_Miller_LUT[] = {
246 FALSE, TRUE, FALSE, TRUE, FALSE, FALSE, FALSE, TRUE,
247 FALSE, TRUE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE
248 };
249 #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
250 #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
251
252 void UartReset()
253 {
254 Uart.state = STATE_UNSYNCD;
255 Uart.bitCount = 0;
256 Uart.len = 0; // number of decoded data bytes
257 Uart.parityLen = 0; // number of decoded parity bytes
258 Uart.shiftReg = 0; // shiftreg to hold decoded data bits
259 Uart.parityBits = 0; // holds 8 parity bits
260 Uart.startTime = 0;
261 Uart.endTime = 0;
262
263 Uart.byteCntMax = 0;
264 Uart.posCnt = 0;
265 Uart.syncBit = 9999;
266 }
267
268 void UartInit(uint8_t *data, uint8_t *parity)
269 {
270 Uart.output = data;
271 Uart.parity = parity;
272 Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
273 UartReset();
274 }
275
276 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
277 static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
278 {
279
280 Uart.fourBits = (Uart.fourBits << 8) | bit;
281
282 if (Uart.state == STATE_UNSYNCD) { // not yet synced
283
284 Uart.syncBit = 9999; // not set
285
286 // 00x11111 2|3 ticks pause followed by 6|5 ticks unmodulated Sequence Z (a "0" or "start of communication")
287 // 11111111 8 ticks unmodulation Sequence Y (a "0" or "end of communication" or "no information")
288 // 111100x1 4 ticks unmodulated followed by 2|3 ticks pause Sequence X (a "1")
289
290 // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
291 // Sequence X followed by Sequence Y followed by Sequence Z (111100x1 11111111 00x11111)
292 // we therefore look for a ...xx1111 11111111 00x11111xxxxxx... pattern
293 // (12 '1's followed by 2 '0's, eventually followed by another '0', followed by 5 '1's)
294 //
295 #define ISO14443A_STARTBIT_MASK 0x07FFEF80 // mask is 00001111 11111111 1110 1111 10000000
296 #define ISO14443A_STARTBIT_PATTERN 0x07FF8F80 // pattern is 00001111 11111111 1000 1111 10000000
297
298 if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 0)) == ISO14443A_STARTBIT_PATTERN >> 0) Uart.syncBit = 7;
299 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 1)) == ISO14443A_STARTBIT_PATTERN >> 1) Uart.syncBit = 6;
300 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 2)) == ISO14443A_STARTBIT_PATTERN >> 2) Uart.syncBit = 5;
301 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 3)) == ISO14443A_STARTBIT_PATTERN >> 3) Uart.syncBit = 4;
302 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 4)) == ISO14443A_STARTBIT_PATTERN >> 4) Uart.syncBit = 3;
303 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 5)) == ISO14443A_STARTBIT_PATTERN >> 5) Uart.syncBit = 2;
304 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 6)) == ISO14443A_STARTBIT_PATTERN >> 6) Uart.syncBit = 1;
305 else if ((Uart.fourBits & (ISO14443A_STARTBIT_MASK >> 7)) == ISO14443A_STARTBIT_PATTERN >> 7) Uart.syncBit = 0;
306
307 if (Uart.syncBit != 9999) { // found a sync bit
308 Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
309 Uart.startTime -= Uart.syncBit;
310 Uart.endTime = Uart.startTime;
311 Uart.state = STATE_START_OF_COMMUNICATION;
312 }
313
314 } else {
315
316 if (IsMillerModulationNibble1(Uart.fourBits >> Uart.syncBit)) {
317 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation in both halves - error
318 UartReset();
319 } else { // Modulation in first half = Sequence Z = logic "0"
320 if (Uart.state == STATE_MILLER_X) { // error - must not follow after X
321 UartReset();
322 } else {
323 Uart.bitCount++;
324 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
325 Uart.state = STATE_MILLER_Z;
326 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
327 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
328 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
329 Uart.parityBits <<= 1; // make room for the parity bit
330 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
331 Uart.bitCount = 0;
332 Uart.shiftReg = 0;
333 if((Uart.len&0x0007) == 0) { // every 8 data bytes
334 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
335 Uart.parityBits = 0;
336 }
337 }
338 }
339 }
340 } else {
341 if (IsMillerModulationNibble2(Uart.fourBits >> Uart.syncBit)) { // Modulation second half = Sequence X = logic "1"
342 Uart.bitCount++;
343 Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
344 Uart.state = STATE_MILLER_X;
345 Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
346 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
347 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
348 Uart.parityBits <<= 1; // make room for the new parity bit
349 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
350 Uart.bitCount = 0;
351 Uart.shiftReg = 0;
352 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
353 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
354 Uart.parityBits = 0;
355 }
356 }
357 } else { // no modulation in both halves - Sequence Y
358 if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) { // Y after logic "0" - End of Communication
359 Uart.state = STATE_UNSYNCD;
360 Uart.bitCount--; // last "0" was part of EOC sequence
361 Uart.shiftReg <<= 1; // drop it
362 if(Uart.bitCount > 0) { // if we decoded some bits
363 Uart.shiftReg >>= (9 - Uart.bitCount); // right align them
364 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff); // add last byte to the output
365 Uart.parityBits <<= 1; // add a (void) parity bit
366 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align parity bits
367 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store it
368 return TRUE;
369 } else if (Uart.len & 0x0007) { // there are some parity bits to store
370 Uart.parityBits <<= (8 - (Uart.len&0x0007)); // left align remaining parity bits
371 Uart.parity[Uart.parityLen++] = Uart.parityBits; // and store them
372 }
373 if (Uart.len) {
374 return TRUE; // we are finished with decoding the raw data sequence
375 } else {
376 UartReset(); // Nothing received - start over
377 }
378 }
379 if (Uart.state == STATE_START_OF_COMMUNICATION) { // error - must not follow directly after SOC
380 UartReset();
381 } else { // a logic "0"
382 Uart.bitCount++;
383 Uart.shiftReg = (Uart.shiftReg >> 1); // add a 0 to the shiftreg
384 Uart.state = STATE_MILLER_Y;
385 if(Uart.bitCount >= 9) { // if we decoded a full byte (including parity)
386 Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
387 Uart.parityBits <<= 1; // make room for the parity bit
388 Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01); // store parity bit
389 Uart.bitCount = 0;
390 Uart.shiftReg = 0;
391 if ((Uart.len&0x0007) == 0) { // every 8 data bytes
392 Uart.parity[Uart.parityLen++] = Uart.parityBits; // store 8 parity bits
393 Uart.parityBits = 0;
394 }
395 }
396 }
397 }
398 }
399
400 }
401
402 return FALSE; // not finished yet, need more data
403 }
404
405
406
407 //=============================================================================
408 // ISO 14443 Type A - Manchester decoder
409 //=============================================================================
410 // Basics:
411 // This decoder is used when the PM3 acts as a reader.
412 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
413 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
414 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
415 // The Manchester decoder needs to identify the following sequences:
416 // 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
417 // 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
418 // 8 ticks unmodulated: Sequence F = end of communication
419 // 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
420 // Note 1: the bitstream may start at any time. We therefore need to sync.
421 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
422 static tDemod Demod;
423
424 // Lookup-Table to decide if 4 raw bits are a modulation.
425 // We accept three or four "1" in any position
426 const bool Mod_Manchester_LUT[] = {
427 FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE,
428 FALSE, FALSE, FALSE, TRUE, FALSE, TRUE, TRUE, TRUE
429 };
430
431 #define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
432 #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
433
434
435 void DemodReset()
436 {
437 Demod.state = DEMOD_UNSYNCD;
438 Demod.len = 0; // number of decoded data bytes
439 Demod.parityLen = 0;
440 Demod.shiftReg = 0; // shiftreg to hold decoded data bits
441 Demod.parityBits = 0; //
442 Demod.collisionPos = 0; // Position of collision bit
443 Demod.twoBits = 0xffff; // buffer for 2 Bits
444 Demod.highCnt = 0;
445 Demod.startTime = 0;
446 Demod.endTime = 0;
447
448 //
449 Demod.bitCount = 0;
450 Demod.syncBit = 0xFFFF;
451 Demod.samples = 0;
452 }
453
454 void DemodInit(uint8_t *data, uint8_t *parity)
455 {
456 Demod.output = data;
457 Demod.parity = parity;
458 DemodReset();
459 }
460
461 // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
462 static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
463 {
464
465 Demod.twoBits = (Demod.twoBits << 8) | bit;
466
467 if (Demod.state == DEMOD_UNSYNCD) {
468
469 if (Demod.highCnt < 2) { // wait for a stable unmodulated signal
470 if (Demod.twoBits == 0x0000) {
471 Demod.highCnt++;
472 } else {
473 Demod.highCnt = 0;
474 }
475 } else {
476 Demod.syncBit = 0xFFFF; // not set
477 if ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7;
478 else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
479 else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
480 else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
481 else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
482 else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
483 else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
484 else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
485 if (Demod.syncBit != 0xFFFF) {
486 Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
487 Demod.startTime -= Demod.syncBit;
488 Demod.bitCount = offset; // number of decoded data bits
489 Demod.state = DEMOD_MANCHESTER_DATA;
490 }
491 }
492
493 } else {
494
495 if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) { // modulation in first half
496 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // ... and in second half = collision
497 if (!Demod.collisionPos) {
498 Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
499 }
500 } // modulation in first half only - Sequence D = 1
501 Demod.bitCount++;
502 Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
503 if(Demod.bitCount == 9) { // if we decoded a full byte (including parity)
504 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
505 Demod.parityBits <<= 1; // make room for the parity bit
506 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
507 Demod.bitCount = 0;
508 Demod.shiftReg = 0;
509 if((Demod.len&0x0007) == 0) { // every 8 data bytes
510 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits
511 Demod.parityBits = 0;
512 }
513 }
514 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
515 } else { // no modulation in first half
516 if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) { // and modulation in second half = Sequence E = 0
517 Demod.bitCount++;
518 Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
519 if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
520 Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
521 Demod.parityBits <<= 1; // make room for the new parity bit
522 Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
523 Demod.bitCount = 0;
524 Demod.shiftReg = 0;
525 if ((Demod.len&0x0007) == 0) { // every 8 data bytes
526 Demod.parity[Demod.parityLen++] = Demod.parityBits; // store 8 parity bits1
527 Demod.parityBits = 0;
528 }
529 }
530 Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
531 } else { // no modulation in both halves - End of communication
532 if(Demod.bitCount > 0) { // there are some remaining data bits
533 Demod.shiftReg >>= (9 - Demod.bitCount); // right align the decoded bits
534 Demod.output[Demod.len++] = Demod.shiftReg & 0xff; // and add them to the output
535 Demod.parityBits <<= 1; // add a (void) parity bit
536 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
537 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
538 return TRUE;
539 } else if (Demod.len & 0x0007) { // there are some parity bits to store
540 Demod.parityBits <<= (8 - (Demod.len&0x0007)); // left align remaining parity bits
541 Demod.parity[Demod.parityLen++] = Demod.parityBits; // and store them
542 }
543 if (Demod.len) {
544 return TRUE; // we are finished with decoding the raw data sequence
545 } else { // nothing received. Start over
546 DemodReset();
547 }
548 }
549 }
550 }
551 return FALSE; // not finished yet, need more data
552 }
553
554 //=============================================================================
555 // Finally, a `sniffer' for ISO 14443 Type A
556 // Both sides of communication!
557 //=============================================================================
558
559 //-----------------------------------------------------------------------------
560 // Record the sequence of commands sent by the reader to the tag, with
561 // triggering so that we start recording at the point that the tag is moved
562 // near the reader.
563 //-----------------------------------------------------------------------------
564 void RAMFUNC SniffIso14443a(uint8_t param) {
565 // param:
566 // bit 0 - trigger from first card answer
567 // bit 1 - trigger from first reader 7-bit request
568 LEDsoff();
569
570 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
571
572 // Allocate memory from BigBuf for some buffers
573 // free all previous allocations first
574 BigBuf_free();
575
576 // init trace buffer
577 clear_trace();
578 set_tracing(TRUE);
579
580 // The command (reader -> tag) that we're receiving.
581 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
582 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
583
584 // The response (tag -> reader) that we're receiving.
585 uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
586 uint8_t *receivedResponsePar = BigBuf_malloc(MAX_PARITY_SIZE);
587
588 // The DMA buffer, used to stream samples from the FPGA
589 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
590
591 uint8_t *data = dmaBuf;
592 uint8_t previous_data = 0;
593 int maxDataLen = 0;
594 int dataLen = 0;
595 bool TagIsActive = FALSE;
596 bool ReaderIsActive = FALSE;
597
598 // Set up the demodulator for tag -> reader responses.
599 DemodInit(receivedResponse, receivedResponsePar);
600
601 // Set up the demodulator for the reader -> tag commands
602 UartInit(receivedCmd, receivedCmdPar);
603
604 // Setup and start DMA.
605 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
606
607 // We won't start recording the frames that we acquire until we trigger;
608 // a good trigger condition to get started is probably when we see a
609 // response from the tag.
610 // triggered == FALSE -- to wait first for card
611 bool triggered = !(param & 0x03);
612
613 // And now we loop, receiving samples.
614 for(uint32_t rsamples = 0; TRUE; ) {
615
616 if(BUTTON_PRESS()) {
617 DbpString("cancelled by button");
618 break;
619 }
620
621 LED_A_ON();
622 WDT_HIT();
623
624 int register readBufDataP = data - dmaBuf;
625 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
626 if (readBufDataP <= dmaBufDataP){
627 dataLen = dmaBufDataP - readBufDataP;
628 } else {
629 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
630 }
631 // test for length of buffer
632 if(dataLen > maxDataLen) {
633 maxDataLen = dataLen;
634 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
635 Dbprintf("blew circular buffer! dataLen=%d", dataLen);
636 break;
637 }
638 }
639 if(dataLen < 1) continue;
640
641 // primary buffer was stopped( <-- we lost data!
642 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
643 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
644 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
645 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
646 }
647 // secondary buffer sets as primary, secondary buffer was stopped
648 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
649 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
650 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
651 }
652
653 LED_A_OFF();
654
655 if (rsamples & 0x01) { // Need two samples to feed Miller and Manchester-Decoder
656
657 if(!TagIsActive) { // no need to try decoding reader data if the tag is sending
658 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
659 if (MillerDecoding(readerdata, (rsamples-1)*4)) {
660 LED_C_ON();
661
662 // check - if there is a short 7bit request from reader
663 if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
664
665 if(triggered) {
666 if (!LogTrace(receivedCmd,
667 Uart.len,
668 Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
669 Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
670 Uart.parity,
671 TRUE)) break;
672 }
673 /* And ready to receive another command. */
674 UartReset();
675 /* And also reset the demod code, which might have been */
676 /* false-triggered by the commands from the reader. */
677 DemodReset();
678 LED_B_OFF();
679 }
680 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
681 }
682
683 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
684 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
685 if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
686 LED_B_ON();
687
688 if (!LogTrace(receivedResponse,
689 Demod.len,
690 Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
691 Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
692 Demod.parity,
693 FALSE)) break;
694
695 if ((!triggered) && (param & 0x01)) triggered = TRUE;
696
697 // And ready to receive another response.
698 DemodReset();
699 // And reset the Miller decoder including itS (now outdated) input buffer
700 UartInit(receivedCmd, receivedCmdPar);
701
702 LED_C_OFF();
703 }
704 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
705 }
706 }
707
708 previous_data = *data;
709 rsamples++;
710 data++;
711 if(data == dmaBuf + DMA_BUFFER_SIZE) {
712 data = dmaBuf;
713 }
714 } // main cycle
715
716 FpgaDisableSscDma();
717 LEDsoff();
718
719 Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
720 Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);
721
722 set_tracing(FALSE);
723 }
724
725 //-----------------------------------------------------------------------------
726 // Prepare tag messages
727 //-----------------------------------------------------------------------------
728 static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
729 {
730 ToSendReset();
731
732 // Correction bit, might be removed when not needed
733 ToSendStuffBit(0);
734 ToSendStuffBit(0);
735 ToSendStuffBit(0);
736 ToSendStuffBit(0);
737 ToSendStuffBit(1); // 1
738 ToSendStuffBit(0);
739 ToSendStuffBit(0);
740 ToSendStuffBit(0);
741
742 // Send startbit
743 ToSend[++ToSendMax] = SEC_D;
744 LastProxToAirDuration = 8 * ToSendMax - 4;
745
746 for(uint16_t i = 0; i < len; i++) {
747 uint8_t b = cmd[i];
748
749 // Data bits
750 for(uint16_t j = 0; j < 8; j++) {
751 if(b & 1) {
752 ToSend[++ToSendMax] = SEC_D;
753 } else {
754 ToSend[++ToSendMax] = SEC_E;
755 }
756 b >>= 1;
757 }
758
759 // Get the parity bit
760 if (parity[i>>3] & (0x80>>(i&0x0007))) {
761 ToSend[++ToSendMax] = SEC_D;
762 LastProxToAirDuration = 8 * ToSendMax - 4;
763 } else {
764 ToSend[++ToSendMax] = SEC_E;
765 LastProxToAirDuration = 8 * ToSendMax;
766 }
767 }
768
769 // Send stopbit
770 ToSend[++ToSendMax] = SEC_F;
771
772 // Convert from last byte pos to length
773 ToSendMax++;
774 }
775
776 static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
777 {
778 uint8_t par[MAX_PARITY_SIZE];
779
780 GetParity(cmd, len, par);
781 CodeIso14443aAsTagPar(cmd, len, par);
782 }
783
784
785 static void Code4bitAnswerAsTag(uint8_t cmd)
786 {
787 int i;
788
789 ToSendReset();
790
791 // Correction bit, might be removed when not needed
792 ToSendStuffBit(0);
793 ToSendStuffBit(0);
794 ToSendStuffBit(0);
795 ToSendStuffBit(0);
796 ToSendStuffBit(1); // 1
797 ToSendStuffBit(0);
798 ToSendStuffBit(0);
799 ToSendStuffBit(0);
800
801 // Send startbit
802 ToSend[++ToSendMax] = SEC_D;
803
804 uint8_t b = cmd;
805 for(i = 0; i < 4; i++) {
806 if(b & 1) {
807 ToSend[++ToSendMax] = SEC_D;
808 LastProxToAirDuration = 8 * ToSendMax - 4;
809 } else {
810 ToSend[++ToSendMax] = SEC_E;
811 LastProxToAirDuration = 8 * ToSendMax;
812 }
813 b >>= 1;
814 }
815
816 // Send stopbit
817 ToSend[++ToSendMax] = SEC_F;
818
819 // Convert from last byte pos to length
820 ToSendMax++;
821 }
822
823 //-----------------------------------------------------------------------------
824 // Wait for commands from reader
825 // Stop when button is pressed
826 // Or return TRUE when command is captured
827 //-----------------------------------------------------------------------------
828 static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
829 {
830 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
831 // only, since we are receiving, not transmitting).
832 // Signal field is off with the appropriate LED
833 LED_D_OFF();
834 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
835
836 // Now run a `software UART' on the stream of incoming samples.
837 UartInit(received, parity);
838
839 // clear RXRDY:
840 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
841
842 for(;;) {
843 WDT_HIT();
844
845 if(BUTTON_PRESS()) return FALSE;
846
847 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
848 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
849 if(MillerDecoding(b, 0)) {
850 *len = Uart.len;
851 return TRUE;
852 }
853 }
854 }
855 }
856
857 static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
858 int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
859 int EmSend4bit(uint8_t resp);
860 int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
861 int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
862 int EmSendCmd(uint8_t *resp, uint16_t respLen);
863 int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
864 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
865 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
866
867 static uint8_t* free_buffer_pointer;
868
869 typedef struct {
870 uint8_t* response;
871 size_t response_n;
872 uint8_t* modulation;
873 size_t modulation_n;
874 uint32_t ProxToAirDuration;
875 } tag_response_info_t;
876
877 bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
878 // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
879 // This will need the following byte array for a modulation sequence
880 // 144 data bits (18 * 8)
881 // 18 parity bits
882 // 2 Start and stop
883 // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA)
884 // 1 just for the case
885 // ----------- +
886 // 166 bytes, since every bit that needs to be send costs us a byte
887 //
888
889
890 // Prepare the tag modulation bits from the message
891 CodeIso14443aAsTag(response_info->response,response_info->response_n);
892
893 // Make sure we do not exceed the free buffer space
894 if (ToSendMax > max_buffer_size) {
895 Dbprintf("Out of memory, when modulating bits for tag answer:");
896 Dbhexdump(response_info->response_n,response_info->response,false);
897 return false;
898 }
899
900 // Copy the byte array, used for this modulation to the buffer position
901 memcpy(response_info->modulation,ToSend,ToSendMax);
902
903 // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
904 response_info->modulation_n = ToSendMax;
905 response_info->ProxToAirDuration = LastProxToAirDuration;
906
907 return true;
908 }
909
910
911 // "precompile" responses. There are 7 predefined responses with a total of 28 bytes data to transmit.
912 // Coded responses need one byte per bit to transfer (data, parity, start, stop, correction)
913 // 28 * 8 data bits, 28 * 1 parity bits, 7 start bits, 7 stop bits, 7 correction bits
914 // -> need 273 bytes buffer
915 // 44 * 8 data bits, 44 * 1 parity bits, 9 start bits, 9 stop bits, 9 correction bits --370
916 // 47 * 8 data bits, 47 * 1 parity bits, 10 start bits, 10 stop bits, 10 correction bits
917 #define ALLOCATED_TAG_MODULATION_BUFFER_SIZE 453
918
919 bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
920 // Retrieve and store the current buffer index
921 response_info->modulation = free_buffer_pointer;
922
923 // Determine the maximum size we can use from our buffer
924 size_t max_buffer_size = ALLOCATED_TAG_MODULATION_BUFFER_SIZE;
925
926 // Forward the prepare tag modulation function to the inner function
927 if (prepare_tag_modulation(response_info, max_buffer_size)) {
928 // Update the free buffer offset
929 free_buffer_pointer += ToSendMax;
930 return true;
931 } else {
932 return false;
933 }
934 }
935
936 //-----------------------------------------------------------------------------
937 // Main loop of simulated tag: receive commands from reader, decide what
938 // response to send, and send it.
939 //-----------------------------------------------------------------------------
940 void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
941 {
942 uint32_t counters[] = {0,0,0};
943 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
944 // This can be used in a reader-only attack.
945 // (it can also be retrieved via 'hf 14a list', but hey...
946 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
947 uint8_t ar_nr_collected = 0;
948
949 uint8_t sak;
950
951 // PACK response to PWD AUTH for EV1/NTAG
952 uint8_t response8[4] = {0,0,0,0};
953
954 // The first response contains the ATQA (note: bytes are transmitted in reverse order).
955 uint8_t response1[2] = {0,0};
956
957 switch (tagType) {
958 case 1: { // MIFARE Classic
959 // Says: I am Mifare 1k - original line
960 response1[0] = 0x04;
961 response1[1] = 0x00;
962 sak = 0x08;
963 } break;
964 case 2: { // MIFARE Ultralight
965 // Says: I am a stupid memory tag, no crypto
966 response1[0] = 0x44;
967 response1[1] = 0x00;
968 sak = 0x00;
969 } break;
970 case 3: { // MIFARE DESFire
971 // Says: I am a DESFire tag, ph33r me
972 response1[0] = 0x04;
973 response1[1] = 0x03;
974 sak = 0x20;
975 } break;
976 case 4: { // ISO/IEC 14443-4
977 // Says: I am a javacard (JCOP)
978 response1[0] = 0x04;
979 response1[1] = 0x00;
980 sak = 0x28;
981 } break;
982 case 5: { // MIFARE TNP3XXX
983 // Says: I am a toy
984 response1[0] = 0x01;
985 response1[1] = 0x0f;
986 sak = 0x01;
987 } break;
988 case 6: { // MIFARE Mini
989 // Says: I am a Mifare Mini, 320b
990 response1[0] = 0x44;
991 response1[1] = 0x00;
992 sak = 0x09;
993 } break;
994 case 7: { // NTAG?
995 // Says: I am a NTAG,
996 response1[0] = 0x44;
997 response1[1] = 0x00;
998 sak = 0x00;
999 // PACK
1000 response8[0] = 0x80;
1001 response8[1] = 0x80;
1002 ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);
1003 } break;
1004 default: {
1005 Dbprintf("Error: unkown tagtype (%d)",tagType);
1006 return;
1007 } break;
1008 }
1009
1010 // The second response contains the (mandatory) first 24 bits of the UID
1011 uint8_t response2[5] = {0x00};
1012
1013 // Check if the uid uses the (optional) part
1014 uint8_t response2a[5] = {0x00};
1015
1016 if (flags & FLAG_7B_UID_IN_DATA) {
1017 response2[0] = 0x88;
1018 response2[1] = data[0];
1019 response2[2] = data[1];
1020 response2[3] = data[2];
1021
1022 response2a[0] = data[3];
1023 response2a[1] = data[4];
1024 response2a[2] = data[5];
1025 response2a[3] = data[6]; //??
1026 response2a[4] = response2a[0] ^ response2a[1] ^ response2a[2] ^ response2a[3];
1027
1028 // Configure the ATQA and SAK accordingly
1029 response1[0] |= 0x40;
1030 sak |= 0x04;
1031 } else {
1032 memcpy(response2, data, 4);
1033 //num_to_bytes(uid_1st,4,response2);
1034 // Configure the ATQA and SAK accordingly
1035 response1[0] &= 0xBF;
1036 sak &= 0xFB;
1037 }
1038
1039 // Calculate the BitCountCheck (BCC) for the first 4 bytes of the UID.
1040 response2[4] = response2[0] ^ response2[1] ^ response2[2] ^ response2[3];
1041
1042 // Prepare the mandatory SAK (for 4 and 7 byte UID)
1043 uint8_t response3[3] = {0x00};
1044 response3[0] = sak;
1045 ComputeCrc14443(CRC_14443_A, response3, 1, &response3[1], &response3[2]);
1046
1047 // Prepare the optional second SAK (for 7 byte UID), drop the cascade bit
1048 uint8_t response3a[3] = {0x00};
1049 response3a[0] = sak & 0xFB;
1050 ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
1051
1052 uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce
1053 uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS:
1054 // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present,
1055 // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
1056 // TB(1) = not present. Defaults: FWI = 4 (FWT = 256 * 16 * 2^4 * 1/fc = 4833us), SFGI = 0 (SFG = 256 * 16 * 2^0 * 1/fc = 302us)
1057 // TC(1) = 0x02: CID supported, NAD not supported
1058 ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
1059
1060 // Prepare GET_VERSION (different for EV-1 / NTAG)
1061 //uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7}; //EV1 48bytes VERSION.
1062 uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
1063
1064 // Prepare CHK_TEARING
1065 uint8_t response9[] = {0xBD,0x90,0x3f};
1066
1067 #define TAG_RESPONSE_COUNT 10
1068 tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
1069 { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type
1070 { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid
1071 { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked
1072 { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1
1073 { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
1074 { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
1075 { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
1076 { .response = response7_NTAG, .response_n = sizeof(response7_NTAG) }, // EV1/NTAG GET_VERSION response
1077 { .response = response8, .response_n = sizeof(response8) }, // EV1/NTAG PACK response
1078 { .response = response9, .response_n = sizeof(response9) } // EV1/NTAG CHK_TEAR response
1079 };
1080
1081 // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
1082 // Such a response is less time critical, so we can prepare them on the fly
1083 #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
1084 #define DYNAMIC_MODULATION_BUFFER_SIZE 512
1085 uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
1086 uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
1087 tag_response_info_t dynamic_response_info = {
1088 .response = dynamic_response_buffer,
1089 .response_n = 0,
1090 .modulation = dynamic_modulation_buffer,
1091 .modulation_n = 0
1092 };
1093
1094 // We need to listen to the high-frequency, peak-detected path.
1095 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1096
1097 BigBuf_free_keep_EM();
1098
1099 // allocate buffers:
1100 uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
1101 uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
1102 free_buffer_pointer = BigBuf_malloc(ALLOCATED_TAG_MODULATION_BUFFER_SIZE);
1103
1104 // clear trace
1105 clear_trace();
1106 set_tracing(TRUE);
1107
1108 // Prepare the responses of the anticollision phase
1109 // there will be not enough time to do this at the moment the reader sends it REQA
1110 for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
1111 prepare_allocated_tag_modulation(&responses[i]);
1112 }
1113
1114 int len = 0;
1115
1116 // To control where we are in the protocol
1117 int order = 0;
1118 int lastorder;
1119
1120 // Just to allow some checks
1121 int happened = 0;
1122 int happened2 = 0;
1123 int cmdsRecvd = 0;
1124
1125 cmdsRecvd = 0;
1126 tag_response_info_t* p_response;
1127
1128 LED_A_ON();
1129 for(;;) {
1130 // Clean receive command buffer
1131
1132 if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
1133 DbpString("Button press");
1134 break;
1135 }
1136
1137 p_response = NULL;
1138
1139 // Okay, look at the command now.
1140 lastorder = order;
1141 if(receivedCmd[0] == 0x26) { // Received a REQUEST
1142 p_response = &responses[0]; order = 1;
1143 } else if(receivedCmd[0] == 0x52) { // Received a WAKEUP
1144 p_response = &responses[0]; order = 6;
1145 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x93) { // Received request for UID (cascade 1)
1146 p_response = &responses[1]; order = 2;
1147 } else if(receivedCmd[1] == 0x20 && receivedCmd[0] == 0x95) { // Received request for UID (cascade 2)
1148 p_response = &responses[2]; order = 20;
1149 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x93) { // Received a SELECT (cascade 1)
1150 p_response = &responses[3]; order = 3;
1151 } else if(receivedCmd[1] == 0x70 && receivedCmd[0] == 0x95) { // Received a SELECT (cascade 2)
1152 p_response = &responses[4]; order = 30;
1153 } else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
1154 uint8_t block = receivedCmd[1];
1155 if ( tagType == 7 ) {
1156 uint16_t start = 4 * block;
1157
1158 /*if ( block < 4 ) {
1159 //NTAG 215
1160 uint8_t blockdata[50] = {
1161 data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
1162 data[3],data[4],data[5],data[6],
1163 data[3] ^ data[4] ^ data[5] ^ data[6],0x48,0x0f,0xe0,
1164 0xe1,0x10,0x12,0x00,
1165 0x03,0x00,0xfe,0x00,
1166 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1167 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
1168 0x00,0x00,0x00,0x00,
1169 0x00,0x00};
1170 AppendCrc14443a(blockdata+start, 16);
1171 EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
1172 } else {*/
1173 uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
1174 emlGetMemBt( emdata, start, 16);
1175 AppendCrc14443a(emdata, 16);
1176 EmSendCmdEx(emdata, sizeof(emdata), false);
1177 //}
1178 p_response = NULL;
1179
1180 } else {
1181 EmSendCmdEx(data+(4*block),16,false);
1182 // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
1183 // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
1184 p_response = NULL;
1185 }
1186 } else if(receivedCmd[0] == 0x3A) { // Received a FAST READ (ranged read)
1187
1188 uint8_t emdata[MAX_FRAME_SIZE];
1189 int start = receivedCmd[1] * 4;
1190 int len = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
1191 emlGetMemBt( emdata, start, len);
1192 AppendCrc14443a(emdata, len);
1193 EmSendCmdEx(emdata, len+2, false);
1194 p_response = NULL;
1195
1196 } else if(receivedCmd[0] == 0x3C && tagType == 7) { // Received a READ SIGNATURE --
1197 // ECC data, taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
1198 uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
1199 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
1200 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
1201 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
1202 0x00,0x00};
1203 AppendCrc14443a(data, sizeof(data)-2);
1204 EmSendCmdEx(data,sizeof(data),false);
1205 p_response = NULL;
1206 } else if (receivedCmd[0] == 0x39 && tagType == 7) { // Received a READ COUNTER --
1207 uint8_t counter = receivedCmd[1];
1208 uint32_t value = counters[counter];
1209 uint8_t data[] = {0x00,0x00,0x00,0x14,0xa5};
1210 AppendCrc14443a(data, sizeof(data)-2);
1211 EmSendCmdEx(data,sizeof(data),false);
1212 p_response = NULL;
1213 } else if (receivedCmd[0] == 0xA5 && tagType == 7) { // Received a INC COUNTER --
1214 // number of counter
1215 uint8_t counter = receivedCmd[1];
1216 uint32_t val = bytes_to_num(receivedCmd+2,4);
1217 counters[counter] = val;
1218
1219 // send ACK
1220 uint8_t ack[] = {0x0a};
1221 EmSendCmdEx(ack,sizeof(ack),false);
1222 p_response = NULL;
1223
1224 } else if(receivedCmd[0] == 0x3E && tagType == 7) { // Received a CHECK_TEARING_EVENT --
1225 p_response = &responses[9];
1226 } else if(receivedCmd[0] == 0x50) { // Received a HALT
1227
1228 if (tracing) {
1229 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1230 }
1231 p_response = NULL;
1232 } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
1233
1234 if ( tagType == 7 ) { // IF NTAG /EV1 0x60 == GET_VERSION, not a authentication request.
1235 p_response = &responses[7];
1236 } else {
1237 p_response = &responses[5]; order = 7;
1238 }
1239 } else if(receivedCmd[0] == 0xE0) { // Received a RATS request
1240 if (tagType == 1 || tagType == 2) { // RATS not supported
1241 EmSend4bit(CARD_NACK_NA);
1242 p_response = NULL;
1243 } else {
1244 p_response = &responses[6]; order = 70;
1245 }
1246 } else if (order == 7 && len == 8) { // Received {nr] and {ar} (part of authentication)
1247 if (tracing) {
1248 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1249 }
1250 uint32_t nonce = bytes_to_num(response5,4);
1251 uint32_t nr = bytes_to_num(receivedCmd,4);
1252 uint32_t ar = bytes_to_num(receivedCmd+4,4);
1253 //Dbprintf("Auth attempt {nonce}{nr}{ar}: %08x %08x %08x", nonce, nr, ar);
1254
1255 if(flags & FLAG_NR_AR_ATTACK )
1256 {
1257 if(ar_nr_collected < 2){
1258 // Avoid duplicates... probably not necessary, nr should vary.
1259 //if(ar_nr_responses[3] != nr){
1260 ar_nr_responses[ar_nr_collected*5] = 0;
1261 ar_nr_responses[ar_nr_collected*5+1] = 0;
1262 ar_nr_responses[ar_nr_collected*5+2] = nonce;
1263 ar_nr_responses[ar_nr_collected*5+3] = nr;
1264 ar_nr_responses[ar_nr_collected*5+4] = ar;
1265 ar_nr_collected++;
1266 //}
1267 }
1268
1269 if(ar_nr_collected > 1 ) {
1270
1271 if (MF_DBGLEVEL >= 2) {
1272 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
1273 Dbprintf("../tools/mfkey/mfkey32 %07x%08x %08x %08x %08x %08x %08x",
1274 ar_nr_responses[0], // UID1
1275 ar_nr_responses[1], // UID2
1276 ar_nr_responses[2], // NT
1277 ar_nr_responses[3], // AR1
1278 ar_nr_responses[4], // NR1
1279 ar_nr_responses[8], // AR2
1280 ar_nr_responses[9] // NR2
1281 );
1282 Dbprintf("../tools/mfkey/mfkey32v2 %06x%08x %08x %08x %08x %08x %08x %08x",
1283 ar_nr_responses[0], // UID1
1284 ar_nr_responses[1], // UID2
1285 ar_nr_responses[2], // NT1
1286 ar_nr_responses[3], // AR1
1287 ar_nr_responses[4], // NR1
1288 ar_nr_responses[7], // NT2
1289 ar_nr_responses[8], // AR2
1290 ar_nr_responses[9] // NR2
1291 );
1292 }
1293 uint8_t len = ar_nr_collected*5*4;
1294 cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,len,0,&ar_nr_responses,len);
1295 ar_nr_collected = 0;
1296 memset(ar_nr_responses, 0x00, len);
1297 }
1298 }
1299 } else if (receivedCmd[0] == 0x1a ) // ULC authentication
1300 {
1301
1302 }
1303 else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
1304 {
1305 if ( tagType == 7 ) {
1306 p_response = &responses[8]; // PACK response
1307 uint32_t pwd = bytes_to_num(receivedCmd+1,4);
1308
1309 if ( MF_DBGLEVEL >= 3) Dbprintf("Auth attempt: %08x", pwd);
1310 }
1311 }
1312 else {
1313 // Check for ISO 14443A-4 compliant commands, look at left nibble
1314 switch (receivedCmd[0]) {
1315 case 0x02:
1316 case 0x03: { // IBlock (command no CID)
1317 dynamic_response_info.response[0] = receivedCmd[0];
1318 dynamic_response_info.response[1] = 0x90;
1319 dynamic_response_info.response[2] = 0x00;
1320 dynamic_response_info.response_n = 3;
1321 } break;
1322 case 0x0B:
1323 case 0x0A: { // IBlock (command CID)
1324 dynamic_response_info.response[0] = receivedCmd[0];
1325 dynamic_response_info.response[1] = 0x00;
1326 dynamic_response_info.response[2] = 0x90;
1327 dynamic_response_info.response[3] = 0x00;
1328 dynamic_response_info.response_n = 4;
1329 } break;
1330
1331 case 0x1A:
1332 case 0x1B: { // Chaining command
1333 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
1334 dynamic_response_info.response_n = 2;
1335 } break;
1336
1337 case 0xaa:
1338 case 0xbb: {
1339 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
1340 dynamic_response_info.response_n = 2;
1341 } break;
1342
1343 case 0xBA: { // ping / pong
1344 dynamic_response_info.response[0] = 0xAB;
1345 dynamic_response_info.response[1] = 0x00;
1346 dynamic_response_info.response_n = 2;
1347 } break;
1348
1349 case 0xCA:
1350 case 0xC2: { // Readers sends deselect command
1351 dynamic_response_info.response[0] = 0xCA;
1352 dynamic_response_info.response[1] = 0x00;
1353 dynamic_response_info.response_n = 2;
1354 } break;
1355
1356 default: {
1357 // Never seen this command before
1358 if (tracing) {
1359 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1360 }
1361 Dbprintf("Received unknown command (len=%d):",len);
1362 Dbhexdump(len,receivedCmd,false);
1363 // Do not respond
1364 dynamic_response_info.response_n = 0;
1365 } break;
1366 }
1367
1368 if (dynamic_response_info.response_n > 0) {
1369 // Copy the CID from the reader query
1370 dynamic_response_info.response[1] = receivedCmd[1];
1371
1372 // Add CRC bytes, always used in ISO 14443A-4 compliant cards
1373 AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
1374 dynamic_response_info.response_n += 2;
1375
1376 if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
1377 Dbprintf("Error preparing tag response");
1378 if (tracing) {
1379 LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
1380 }
1381 break;
1382 }
1383 p_response = &dynamic_response_info;
1384 }
1385 }
1386
1387 // Count number of wakeups received after a halt
1388 if(order == 6 && lastorder == 5) { happened++; }
1389
1390 // Count number of other messages after a halt
1391 if(order != 6 && lastorder == 5) { happened2++; }
1392
1393 if(cmdsRecvd > 999) {
1394 DbpString("1000 commands later...");
1395 break;
1396 }
1397 cmdsRecvd++;
1398
1399 if (p_response != NULL) {
1400 EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
1401 // do the tracing for the previous reader request and this tag answer:
1402 uint8_t par[MAX_PARITY_SIZE];
1403 GetParity(p_response->response, p_response->response_n, par);
1404
1405 EmLogTrace(Uart.output,
1406 Uart.len,
1407 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1408 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1409 Uart.parity,
1410 p_response->response,
1411 p_response->response_n,
1412 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1413 (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1414 par);
1415 }
1416
1417 if (!tracing) {
1418 Dbprintf("Trace Full. Simulation stopped.");
1419 break;
1420 }
1421 }
1422
1423 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1424 set_tracing(FALSE);
1425 BigBuf_free_keep_EM();
1426 LED_A_OFF();
1427
1428 if (MF_DBGLEVEL >= 4){
1429 Dbprintf("-[ Wake ups after halt [%d]", happened);
1430 Dbprintf("-[ Messages after halt [%d]", happened2);
1431 Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
1432 }
1433 }
1434
1435
1436 // prepare a delayed transfer. This simply shifts ToSend[] by a number
1437 // of bits specified in the delay parameter.
1438 void PrepareDelayedTransfer(uint16_t delay)
1439 {
1440 uint8_t bitmask = 0;
1441 uint8_t bits_to_shift = 0;
1442 uint8_t bits_shifted = 0;
1443
1444 delay &= 0x07;
1445 if (delay) {
1446 for (uint16_t i = 0; i < delay; i++) {
1447 bitmask |= (0x01 << i);
1448 }
1449 ToSend[ToSendMax++] = 0x00;
1450 for (uint16_t i = 0; i < ToSendMax; i++) {
1451 bits_to_shift = ToSend[i] & bitmask;
1452 ToSend[i] = ToSend[i] >> delay;
1453 ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
1454 bits_shifted = bits_to_shift;
1455 }
1456 }
1457 }
1458
1459
1460 //-------------------------------------------------------------------------------------
1461 // Transmit the command (to the tag) that was placed in ToSend[].
1462 // Parameter timing:
1463 // if NULL: transfer at next possible time, taking into account
1464 // request guard time and frame delay time
1465 // if == 0: transfer immediately and return time of transfer
1466 // if != 0: delay transfer until time specified
1467 //-------------------------------------------------------------------------------------
1468 static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
1469 {
1470
1471 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1472
1473 uint32_t ThisTransferTime = 0;
1474
1475 if (timing) {
1476 if(*timing == 0) { // Measure time
1477 *timing = (GetCountSspClk() + 8) & 0xfffffff8;
1478 } else {
1479 PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
1480 }
1481 if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
1482 while(GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
1483 LastTimeProxToAirStart = *timing;
1484 } else {
1485 ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
1486 while(GetCountSspClk() < ThisTransferTime);
1487 LastTimeProxToAirStart = ThisTransferTime;
1488 }
1489
1490 // clear TXRDY
1491 AT91C_BASE_SSC->SSC_THR = SEC_Y;
1492
1493 uint16_t c = 0;
1494 for(;;) {
1495 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1496 AT91C_BASE_SSC->SSC_THR = cmd[c];
1497 c++;
1498 if(c >= len) {
1499 break;
1500 }
1501 }
1502 }
1503
1504 NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
1505 }
1506
1507
1508 //-----------------------------------------------------------------------------
1509 // Prepare reader command (in bits, support short frames) to send to FPGA
1510 //-----------------------------------------------------------------------------
1511 void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
1512 {
1513 int i, j;
1514 int last;
1515 uint8_t b;
1516
1517 ToSendReset();
1518
1519 // Start of Communication (Seq. Z)
1520 ToSend[++ToSendMax] = SEC_Z;
1521 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1522 last = 0;
1523
1524 size_t bytecount = nbytes(bits);
1525 // Generate send structure for the data bits
1526 for (i = 0; i < bytecount; i++) {
1527 // Get the current byte to send
1528 b = cmd[i];
1529 size_t bitsleft = MIN((bits-(i*8)),8);
1530
1531 for (j = 0; j < bitsleft; j++) {
1532 if (b & 1) {
1533 // Sequence X
1534 ToSend[++ToSendMax] = SEC_X;
1535 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1536 last = 1;
1537 } else {
1538 if (last == 0) {
1539 // Sequence Z
1540 ToSend[++ToSendMax] = SEC_Z;
1541 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1542 } else {
1543 // Sequence Y
1544 ToSend[++ToSendMax] = SEC_Y;
1545 last = 0;
1546 }
1547 }
1548 b >>= 1;
1549 }
1550
1551 // Only transmit parity bit if we transmitted a complete byte
1552 if (j == 8 && parity != NULL) {
1553 // Get the parity bit
1554 if (parity[i>>3] & (0x80 >> (i&0x0007))) {
1555 // Sequence X
1556 ToSend[++ToSendMax] = SEC_X;
1557 LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
1558 last = 1;
1559 } else {
1560 if (last == 0) {
1561 // Sequence Z
1562 ToSend[++ToSendMax] = SEC_Z;
1563 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1564 } else {
1565 // Sequence Y
1566 ToSend[++ToSendMax] = SEC_Y;
1567 last = 0;
1568 }
1569 }
1570 }
1571 }
1572
1573 // End of Communication: Logic 0 followed by Sequence Y
1574 if (last == 0) {
1575 // Sequence Z
1576 ToSend[++ToSendMax] = SEC_Z;
1577 LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
1578 } else {
1579 // Sequence Y
1580 ToSend[++ToSendMax] = SEC_Y;
1581 last = 0;
1582 }
1583 ToSend[++ToSendMax] = SEC_Y;
1584
1585 // Convert to length of command:
1586 ToSendMax++;
1587 }
1588
1589 //-----------------------------------------------------------------------------
1590 // Prepare reader command to send to FPGA
1591 //-----------------------------------------------------------------------------
1592 void CodeIso14443aAsReaderPar(const uint8_t *cmd, uint16_t len, const uint8_t *parity)
1593 {
1594 CodeIso14443aBitsAsReaderPar(cmd, len*8, parity);
1595 }
1596
1597
1598 //-----------------------------------------------------------------------------
1599 // Wait for commands from reader
1600 // Stop when button is pressed (return 1) or field was gone (return 2)
1601 // Or return 0 when command is captured
1602 //-----------------------------------------------------------------------------
1603 static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
1604 {
1605 *len = 0;
1606
1607 uint32_t timer = 0, vtime = 0;
1608 int analogCnt = 0;
1609 int analogAVG = 0;
1610
1611 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
1612 // only, since we are receiving, not transmitting).
1613 // Signal field is off with the appropriate LED
1614 LED_D_OFF();
1615 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1616
1617 // Set ADC to read field strength
1618 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
1619 AT91C_BASE_ADC->ADC_MR =
1620 ADC_MODE_PRESCALE(63) |
1621 ADC_MODE_STARTUP_TIME(1) |
1622 ADC_MODE_SAMPLE_HOLD_TIME(15);
1623 AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
1624 // start ADC
1625 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1626
1627 // Now run a 'software UART' on the stream of incoming samples.
1628 UartInit(received, parity);
1629
1630 // Clear RXRDY:
1631 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1632
1633 for(;;) {
1634 WDT_HIT();
1635
1636 if (BUTTON_PRESS()) return 1;
1637
1638 // test if the field exists
1639 if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
1640 analogCnt++;
1641 analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
1642 AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
1643 if (analogCnt >= 32) {
1644 if ((MAX_ADC_HF_VOLTAGE * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
1645 vtime = GetTickCount();
1646 if (!timer) timer = vtime;
1647 // 50ms no field --> card to idle state
1648 if (vtime - timer > 50) return 2;
1649 } else
1650 if (timer) timer = 0;
1651 analogCnt = 0;
1652 analogAVG = 0;
1653 }
1654 }
1655
1656 // receive and test the miller decoding
1657 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1658 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1659 if(MillerDecoding(b, 0)) {
1660 *len = Uart.len;
1661 return 0;
1662 }
1663 }
1664
1665 }
1666 }
1667
1668
1669 static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNeeded)
1670 {
1671 uint8_t b;
1672 uint16_t i = 0;
1673 uint32_t ThisTransferTime;
1674
1675 // Modulate Manchester
1676 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
1677
1678 // include correction bit if necessary
1679 if (Uart.parityBits & 0x01) {
1680 correctionNeeded = TRUE;
1681 }
1682 if(correctionNeeded) {
1683 // 1236, so correction bit needed
1684 i = 0;
1685 } else {
1686 i = 1;
1687 }
1688
1689 // clear receiving shift register and holding register
1690 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1691 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1692 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1693 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1694
1695 // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
1696 for (uint16_t j = 0; j < 5; j++) { // allow timeout - better late than never
1697 while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
1698 if (AT91C_BASE_SSC->SSC_RHR) break;
1699 }
1700
1701 while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
1702
1703 // Clear TXRDY:
1704 AT91C_BASE_SSC->SSC_THR = SEC_F;
1705
1706 // send cycle
1707 for(; i < respLen; ) {
1708 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1709 AT91C_BASE_SSC->SSC_THR = resp[i++];
1710 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1711 }
1712
1713 if(BUTTON_PRESS()) break;
1714 }
1715
1716 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
1717 uint8_t fpga_queued_bits = FpgaSendQueueDelay >> 3;
1718 for (i = 0; i <= fpga_queued_bits/8 + 1; ) {
1719 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1720 AT91C_BASE_SSC->SSC_THR = SEC_F;
1721 FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1722 i++;
1723 }
1724 }
1725
1726 LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
1727
1728 return 0;
1729 }
1730
1731 int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
1732 Code4bitAnswerAsTag(resp);
1733 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1734 // do the tracing for the previous reader request and this tag answer:
1735 uint8_t par[1];
1736 GetParity(&resp, 1, par);
1737 EmLogTrace(Uart.output,
1738 Uart.len,
1739 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1740 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1741 Uart.parity,
1742 &resp,
1743 1,
1744 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1745 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1746 par);
1747 return res;
1748 }
1749
1750 int EmSend4bit(uint8_t resp){
1751 return EmSend4bitEx(resp, false);
1752 }
1753
1754 int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par){
1755 CodeIso14443aAsTagPar(resp, respLen, par);
1756 int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
1757 // do the tracing for the previous reader request and this tag answer:
1758 EmLogTrace(Uart.output,
1759 Uart.len,
1760 Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG,
1761 Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG,
1762 Uart.parity,
1763 resp,
1764 respLen,
1765 LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
1766 (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG,
1767 par);
1768 return res;
1769 }
1770
1771 int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded){
1772 uint8_t par[MAX_PARITY_SIZE];
1773 GetParity(resp, respLen, par);
1774 return EmSendCmdExPar(resp, respLen, correctionNeeded, par);
1775 }
1776
1777 int EmSendCmd(uint8_t *resp, uint16_t respLen){
1778 uint8_t par[MAX_PARITY_SIZE];
1779 GetParity(resp, respLen, par);
1780 return EmSendCmdExPar(resp, respLen, false, par);
1781 }
1782
1783 int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par){
1784 return EmSendCmdExPar(resp, respLen, false, par);
1785 }
1786
1787 bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
1788 uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity)
1789 {
1790 if (tracing) {
1791 // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
1792 // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
1793 // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
1794 uint16_t reader_modlen = reader_EndTime - reader_StartTime;
1795 uint16_t approx_fdt = tag_StartTime - reader_EndTime;
1796 uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
1797 reader_EndTime = tag_StartTime - exact_fdt;
1798 reader_StartTime = reader_EndTime - reader_modlen;
1799 if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_EndTime, reader_Parity, TRUE)) {
1800 return FALSE;
1801 } else return(!LogTrace(tag_data, tag_len, tag_StartTime, tag_EndTime, tag_Parity, FALSE));
1802 } else {
1803 return TRUE;
1804 }
1805 }
1806
1807 //-----------------------------------------------------------------------------
1808 // Wait a certain time for tag response
1809 // If a response is captured return TRUE
1810 // If it takes too long return FALSE
1811 //-----------------------------------------------------------------------------
1812 static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
1813 {
1814 uint32_t c = 0x00;
1815
1816 // Set FPGA mode to "reader listen mode", no modulation (listen
1817 // only, since we are receiving, not transmitting).
1818 // Signal field is on with the appropriate LED
1819 LED_D_ON();
1820 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1821
1822 // Now get the answer from the card
1823 DemodInit(receivedResponse, receivedResponsePar);
1824
1825 // clear RXRDY:
1826 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1827
1828 for(;;) {
1829 WDT_HIT();
1830
1831 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1832 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1833 if(ManchesterDecoding(b, offset, 0)) {
1834 NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
1835 return TRUE;
1836 } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
1837 return FALSE;
1838 }
1839 }
1840 }
1841 }
1842
1843 void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
1844 {
1845 CodeIso14443aBitsAsReaderPar(frame, bits, par);
1846
1847 // Send command to tag
1848 TransmitFor14443a(ToSend, ToSendMax, timing);
1849 if(trigger)
1850 LED_A_ON();
1851
1852 // Log reader command in trace buffer
1853 if (tracing) {
1854 LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
1855 }
1856 }
1857
1858 void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
1859 {
1860 ReaderTransmitBitsPar(frame, len*8, par, timing);
1861 }
1862
1863 void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
1864 {
1865 // Generate parity and redirect
1866 uint8_t par[MAX_PARITY_SIZE];
1867 GetParity(frame, len/8, par);
1868 ReaderTransmitBitsPar(frame, len, par, timing);
1869 }
1870
1871 void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
1872 {
1873 // Generate parity and redirect
1874 uint8_t par[MAX_PARITY_SIZE];
1875 GetParity(frame, len, par);
1876 ReaderTransmitBitsPar(frame, len*8, par, timing);
1877 }
1878
1879 int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
1880 {
1881 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return FALSE;
1882 if (tracing) {
1883 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1884 }
1885 return Demod.len;
1886 }
1887
1888 int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
1889 {
1890 if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return FALSE;
1891 if (tracing) {
1892 LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, FALSE);
1893 }
1894 return Demod.len;
1895 }
1896
1897 /* performs iso14443a anticollision procedure
1898 * fills the uid pointer unless NULL
1899 * fills resp_data unless NULL */
1900 int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, uint32_t *cuid_ptr) {
1901 uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
1902 uint8_t sel_all[] = { 0x93,0x20 };
1903 uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
1904 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
1905 uint8_t resp[MAX_FRAME_SIZE]; // theoretically. A usual RATS will be much smaller
1906 uint8_t resp_par[MAX_PARITY_SIZE];
1907 byte_t uid_resp[4];
1908 size_t uid_resp_len;
1909
1910 uint8_t sak = 0x04; // cascade uid
1911 int cascade_level = 0;
1912 int len;
1913
1914 // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
1915 ReaderTransmitBitsPar(wupa,7,0, NULL);
1916
1917 // Receive the ATQA
1918 if(!ReaderReceive(resp, resp_par)) return 0;
1919
1920 if(p_hi14a_card) {
1921 memcpy(p_hi14a_card->atqa, resp, 2);
1922 p_hi14a_card->uidlen = 0;
1923 memset(p_hi14a_card->uid,0,10);
1924 }
1925
1926 // clear uid
1927 if (uid_ptr) {
1928 memset(uid_ptr,0,10);
1929 }
1930
1931 // check for proprietary anticollision:
1932 if ((resp[0] & 0x1F) == 0) {
1933 return 3;
1934 }
1935
1936 // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
1937 // which case we need to make a cascade 2 request and select - this is a long UID
1938 // While the UID is not complete, the 3nd bit (from the right) is set in the SAK.
1939 for(; sak & 0x04; cascade_level++) {
1940 // SELECT_* (L1: 0x93, L2: 0x95, L3: 0x97)
1941 sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2;
1942
1943 // SELECT_ALL
1944 ReaderTransmit(sel_all, sizeof(sel_all), NULL);
1945 if (!ReaderReceive(resp, resp_par)) return 0;
1946
1947 if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
1948 memset(uid_resp, 0, 4);
1949 uint16_t uid_resp_bits = 0;
1950 uint16_t collision_answer_offset = 0;
1951 // anti-collision-loop:
1952 while (Demod.collisionPos) {
1953 Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
1954 for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
1955 uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
1956 uid_resp[uid_resp_bits / 8] |= UIDbit << (uid_resp_bits % 8);
1957 }
1958 uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
1959 uid_resp_bits++;
1960 // construct anticollosion command:
1961 sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
1962 for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
1963 sel_uid[2+i] = uid_resp[i];
1964 }
1965 collision_answer_offset = uid_resp_bits%8;
1966 ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
1967 if (!ReaderReceiveOffset(resp, collision_answer_offset, resp_par)) return 0;
1968 }
1969 // finally, add the last bits and BCC of the UID
1970 for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
1971 uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
1972 uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
1973 }
1974
1975 } else { // no collision, use the response to SELECT_ALL as current uid
1976 memcpy(uid_resp, resp, 4);
1977 }
1978 uid_resp_len = 4;
1979
1980 // calculate crypto UID. Always use last 4 Bytes.
1981 if(cuid_ptr) {
1982 *cuid_ptr = bytes_to_num(uid_resp, 4);
1983 }
1984
1985 // Construct SELECT UID command
1986 sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
1987 memcpy(sel_uid+2, uid_resp, 4); // the UID
1988 sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
1989 AppendCrc14443a(sel_uid, 7); // calculate and add CRC
1990 ReaderTransmit(sel_uid, sizeof(sel_uid), NULL);
1991
1992 // Receive the SAK
1993 if (!ReaderReceive(resp, resp_par)) return 0;
1994 sak = resp[0];
1995
1996 // Test if more parts of the uid are coming
1997 if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
1998 // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
1999 // http://www.nxp.com/documents/application_note/AN10927.pdf
2000 uid_resp[0] = uid_resp[1];
2001 uid_resp[1] = uid_resp[2];
2002 uid_resp[2] = uid_resp[3];
2003
2004 uid_resp_len = 3;
2005 }
2006
2007 if(uid_ptr) {
2008 memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len);
2009 }
2010
2011 if(p_hi14a_card) {
2012 memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len);
2013 p_hi14a_card->uidlen += uid_resp_len;
2014 }
2015 }
2016
2017 if(p_hi14a_card) {
2018 p_hi14a_card->sak = sak;
2019 p_hi14a_card->ats_len = 0;
2020 }
2021
2022 // non iso14443a compliant tag
2023 if( (sak & 0x20) == 0) return 2;
2024
2025 // Request for answer to select
2026 AppendCrc14443a(rats, 2);
2027 ReaderTransmit(rats, sizeof(rats), NULL);
2028
2029 if (!(len = ReaderReceive(resp, resp_par))) return 0;
2030
2031
2032 if(p_hi14a_card) {
2033 memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats));
2034 p_hi14a_card->ats_len = len;
2035 }
2036
2037 // reset the PCB block number
2038 iso14_pcb_blocknum = 0;
2039
2040 // set default timeout based on ATS
2041 iso14a_set_ATS_timeout(resp);
2042
2043 return 1;
2044 }
2045
2046 void iso14443a_setup(uint8_t fpga_minor_mode) {
2047 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
2048 // Set up the synchronous serial port
2049 FpgaSetupSsc();
2050 // connect Demodulated Signal to ADC:
2051 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
2052
2053 // Signal field is on with the appropriate LED
2054 if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
2055 || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
2056 LED_D_ON();
2057 } else {
2058 LED_D_OFF();
2059 }
2060 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
2061
2062 // Start the timer
2063 StartCountSspClk();
2064
2065 DemodReset();
2066 UartReset();
2067 NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
2068 iso14a_set_timeout(10*106); // 10ms default
2069 }
2070
2071 int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
2072 uint8_t parity[MAX_PARITY_SIZE];
2073 uint8_t real_cmd[cmd_len+4];
2074 real_cmd[0] = 0x0a; //I-Block
2075 // put block number into the PCB
2076 real_cmd[0] |= iso14_pcb_blocknum;
2077 real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards
2078 memcpy(real_cmd+2, cmd, cmd_len);
2079 AppendCrc14443a(real_cmd,cmd_len+2);
2080
2081 ReaderTransmit(real_cmd, cmd_len+4, NULL);
2082 size_t len = ReaderReceive(data, parity);
2083 uint8_t *data_bytes = (uint8_t *) data;
2084 if (!len)
2085 return 0; //DATA LINK ERROR
2086 // if we received an I- or R(ACK)-Block with a block number equal to the
2087 // current block number, toggle the current block number
2088 else if (len >= 4 // PCB+CID+CRC = 4 bytes
2089 && ((data_bytes[0] & 0xC0) == 0 // I-Block
2090 || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
2091 && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers
2092 {
2093 iso14_pcb_blocknum ^= 1;
2094 }
2095
2096 return len;
2097 }
2098
2099 //-----------------------------------------------------------------------------
2100 // Read an ISO 14443a tag. Send out commands and store answers.
2101 //
2102 //-----------------------------------------------------------------------------
2103 void ReaderIso14443a(UsbCommand *c)
2104 {
2105 iso14a_command_t param = c->arg[0];
2106 uint8_t *cmd = c->d.asBytes;
2107 size_t len = c->arg[1] & 0xffff;
2108 size_t lenbits = c->arg[1] >> 16;
2109 uint32_t timeout = c->arg[2];
2110 uint32_t arg0 = 0;
2111 byte_t buf[USB_CMD_DATA_SIZE];
2112 uint8_t par[MAX_PARITY_SIZE];
2113
2114 if(param & ISO14A_CONNECT) {
2115 clear_trace();
2116 }
2117
2118 set_tracing(TRUE);
2119
2120 if(param & ISO14A_REQUEST_TRIGGER) {
2121 iso14a_set_trigger(TRUE);
2122 }
2123
2124 if(param & ISO14A_CONNECT) {
2125 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
2126 if(!(param & ISO14A_NO_SELECT)) {
2127 iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
2128 arg0 = iso14443a_select_card(NULL,card,NULL);
2129 cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
2130 }
2131 }
2132
2133 if(param & ISO14A_SET_TIMEOUT) {
2134 iso14a_set_timeout(timeout);
2135 }
2136
2137 if(param & ISO14A_APDU) {
2138 arg0 = iso14_apdu(cmd, len, buf);
2139 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
2140 }
2141
2142 if(param & ISO14A_RAW) {
2143 if(param & ISO14A_APPEND_CRC) {
2144 if(param & ISO14A_TOPAZMODE) {
2145 AppendCrc14443b(cmd,len);
2146 } else {
2147 AppendCrc14443a(cmd,len);
2148 }
2149 len += 2;
2150 if (lenbits) lenbits += 16;
2151 }
2152 if(lenbits>0) { // want to send a specific number of bits (e.g. short commands)
2153 if(param & ISO14A_TOPAZMODE) {
2154 int bits_to_send = lenbits;
2155 uint16_t i = 0;
2156 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 7), NULL, NULL); // first byte is always short (7bits) and no parity
2157 bits_to_send -= 7;
2158 while (bits_to_send > 0) {
2159 ReaderTransmitBitsPar(&cmd[i++], MIN(bits_to_send, 8), NULL, NULL); // following bytes are 8 bit and no parity
2160 bits_to_send -= 8;
2161 }
2162 } else {
2163 GetParity(cmd, lenbits/8, par);
2164 ReaderTransmitBitsPar(cmd, lenbits, par, NULL); // bytes are 8 bit with odd parity
2165 }
2166 } else { // want to send complete bytes only
2167 if(param & ISO14A_TOPAZMODE) {
2168 uint16_t i = 0;
2169 ReaderTransmitBitsPar(&cmd[i++], 7, NULL, NULL); // first byte: 7 bits, no paritiy
2170 while (i < len) {
2171 ReaderTransmitBitsPar(&cmd[i++], 8, NULL, NULL); // following bytes: 8 bits, no paritiy
2172 }
2173 } else {
2174 ReaderTransmit(cmd,len, NULL); // 8 bits, odd parity
2175 }
2176 }
2177 arg0 = ReaderReceive(buf, par);
2178 cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
2179 }
2180
2181 if(param & ISO14A_REQUEST_TRIGGER) {
2182 iso14a_set_trigger(FALSE);
2183 }
2184
2185 if(param & ISO14A_NO_DISCONNECT) {
2186 return;
2187 }
2188
2189 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2190 set_tracing(FALSE);
2191 LEDsoff();
2192 }
2193
2194
2195 // Determine the distance between two nonces.
2196 // Assume that the difference is small, but we don't know which is first.
2197 // Therefore try in alternating directions.
2198 int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
2199
2200 uint16_t i;
2201 uint32_t nttmp1, nttmp2;
2202
2203 if (nt1 == nt2) return 0;
2204
2205 nttmp1 = nt1;
2206 nttmp2 = nt2;
2207
2208 for (i = 1; i < 0xFFFF; i++) {
2209 nttmp1 = prng_successor(nttmp1, 1);
2210 if (nttmp1 == nt2) return i;
2211 nttmp2 = prng_successor(nttmp2, 1);
2212 if (nttmp2 == nt1) return -i;
2213 }
2214
2215 return(-99999); // either nt1 or nt2 are invalid nonces
2216 }
2217
2218
2219 //-----------------------------------------------------------------------------
2220 // Recover several bits of the cypher stream. This implements (first stages of)
2221 // the algorithm described in "The Dark Side of Security by Obscurity and
2222 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
2223 // (article by Nicolas T. Courtois, 2009)
2224 //-----------------------------------------------------------------------------
2225 void ReaderMifare(bool first_try)
2226 {
2227 // Mifare AUTH
2228 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
2229 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
2230 static uint8_t mf_nr_ar3;
2231
2232 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
2233 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
2234
2235 if (first_try) {
2236 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2237 }
2238
2239 // free eventually allocated BigBuf memory. We want all for tracing.
2240 BigBuf_free();
2241
2242 clear_trace();
2243 set_tracing(TRUE);
2244
2245 byte_t nt_diff = 0;
2246 uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
2247 static byte_t par_low = 0;
2248 bool led_on = TRUE;
2249 uint8_t uid[10] ={0};
2250 uint32_t cuid;
2251
2252 uint32_t nt = 0;
2253 uint32_t previous_nt = 0;
2254 static uint32_t nt_attacked = 0;
2255 byte_t par_list[8] = {0x00};
2256 byte_t ks_list[8] = {0x00};
2257
2258 #define PRNG_SEQUENCE_LENGTH (1 << 16);
2259 static uint32_t sync_time = 0;
2260 static int32_t sync_cycles = 0;
2261 int catch_up_cycles = 0;
2262 int last_catch_up = 0;
2263 uint16_t elapsed_prng_sequences;
2264 uint16_t consecutive_resyncs = 0;
2265 int isOK = 0;
2266
2267 if (first_try) {
2268 mf_nr_ar3 = 0;
2269 sync_time = GetCountSspClk() & 0xfffffff8;
2270 sync_cycles = PRNG_SEQUENCE_LENGTH; //65536; //0x10000 // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
2271 nt_attacked = 0;
2272 par[0] = 0;
2273 }
2274 else {
2275 // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
2276 mf_nr_ar3++;
2277 mf_nr_ar[3] = mf_nr_ar3;
2278 par[0] = par_low;
2279 }
2280
2281 LED_A_ON();
2282 LED_B_OFF();
2283 LED_C_OFF();
2284
2285
2286 #define MAX_UNEXPECTED_RANDOM 4 // maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
2287 #define MAX_SYNC_TRIES 32
2288 #define NUM_DEBUG_INFOS 8 // per strategy
2289 #define MAX_STRATEGY 3
2290 uint16_t unexpected_random = 0;
2291 uint16_t sync_tries = 0;
2292 int16_t debug_info_nr = -1;
2293 uint16_t strategy = 0;
2294 int32_t debug_info[MAX_STRATEGY][NUM_DEBUG_INFOS];
2295 uint32_t select_time;
2296 uint32_t halt_time;
2297
2298 for(uint16_t i = 0; TRUE; i++) {
2299
2300 LED_C_ON();
2301 WDT_HIT();
2302
2303 // Test if the action was cancelled
2304 if(BUTTON_PRESS()) {
2305 isOK = -1;
2306 break;
2307 }
2308
2309 if (strategy == 2) {
2310 // test with additional hlt command
2311 halt_time = 0;
2312 int len = mifare_sendcmd_short(NULL, false, 0x50, 0x00, receivedAnswer, receivedAnswerPar, &halt_time);
2313 if (len && MF_DBGLEVEL >= 3) {
2314 Dbprintf("Unexpected response of %d bytes to hlt command (additional debugging).", len);
2315 }
2316 }
2317
2318 if (strategy == 3) {
2319 // test with FPGA power off/on
2320 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2321 SpinDelay(200);
2322 iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
2323 SpinDelay(100);
2324 }
2325
2326 if(!iso14443a_select_card(uid, NULL, &cuid)) {
2327 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
2328 continue;
2329 }
2330 select_time = GetCountSspClk();
2331
2332 elapsed_prng_sequences = 1;
2333 if (debug_info_nr == -1) {
2334 sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
2335 catch_up_cycles = 0;
2336
2337 // if we missed the sync time already, advance to the next nonce repeat
2338 while(GetCountSspClk() > sync_time) {
2339 elapsed_prng_sequences++;
2340 sync_time = (sync_time & 0xfffffff8) + sync_cycles;
2341 }
2342
2343 // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked)
2344 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2345 } else {
2346 // collect some information on tag nonces for debugging:
2347 #define DEBUG_FIXED_SYNC_CYCLES PRNG_SEQUENCE_LENGTH
2348 if (strategy == 0) {
2349 // nonce distances at fixed time after card select:
2350 sync_time = select_time + DEBUG_FIXED_SYNC_CYCLES;
2351 } else if (strategy == 1) {
2352 // nonce distances at fixed time between authentications:
2353 sync_time = sync_time + DEBUG_FIXED_SYNC_CYCLES;
2354 } else if (strategy == 2) {
2355 // nonce distances at fixed time after halt:
2356 sync_time = halt_time + DEBUG_FIXED_SYNC_CYCLES;
2357 } else {
2358 // nonce_distances at fixed time after power on
2359 sync_time = DEBUG_FIXED_SYNC_CYCLES;
2360 }
2361 ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
2362 }
2363
2364 // Receive the (4 Byte) "random" nonce
2365 if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
2366 if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce");
2367 continue;
2368 }
2369
2370 previous_nt = nt;
2371 nt = bytes_to_num(receivedAnswer, 4);
2372
2373 // Transmit reader nonce with fake par
2374 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
2375
2376 if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
2377 int nt_distance = dist_nt(previous_nt, nt);
2378 if (nt_distance == 0) {
2379 nt_attacked = nt;
2380 } else {
2381 if (nt_distance == -99999) { // invalid nonce received
2382 unexpected_random++;
2383 if (unexpected_random > MAX_UNEXPECTED_RANDOM) {
2384 isOK = -3; // Card has an unpredictable PRNG. Give up
2385 break;
2386 } else {
2387 continue; // continue trying...
2388 }
2389 }
2390 if (++sync_tries > MAX_SYNC_TRIES) {
2391 if (strategy > MAX_STRATEGY || MF_DBGLEVEL < 3) {
2392 isOK = -4; // Card's PRNG runs at an unexpected frequency or resets unexpectedly
2393 break;
2394 } else { // continue for a while, just to collect some debug info
2395 debug_info[strategy][debug_info_nr] = nt_distance;
2396 debug_info_nr++;
2397 if (debug_info_nr == NUM_DEBUG_INFOS) {
2398 strategy++;
2399 debug_info_nr = 0;
2400 }
2401 continue;
2402 }
2403 }
2404 sync_cycles = (sync_cycles - nt_distance/elapsed_prng_sequences);
2405 if (sync_cycles <= 0) {
2406 sync_cycles += PRNG_SEQUENCE_LENGTH;
2407 }
2408 if (MF_DBGLEVEL >= 3) {
2409 Dbprintf("calibrating in cycle %d. nt_distance=%d, elapsed_prng_sequences=%d, new sync_cycles: %d\n", i, nt_distance, elapsed_prng_sequences, sync_cycles);
2410 }
2411 continue;
2412 }
2413 }
2414
2415 if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
2416 catch_up_cycles = -dist_nt(nt_attacked, nt);
2417 if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
2418 catch_up_cycles = 0;
2419 continue;
2420 }
2421 catch_up_cycles /= elapsed_prng_sequences;
2422 if (catch_up_cycles == last_catch_up) {
2423 consecutive_resyncs++;
2424 }
2425 else {
2426 last_catch_up = catch_up_cycles;
2427 consecutive_resyncs = 0;
2428 }
2429 if (consecutive_resyncs < 3) {
2430 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
2431 }
2432 else {
2433 sync_cycles = sync_cycles + catch_up_cycles;
2434 if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
2435 last_catch_up = 0;
2436 catch_up_cycles = 0;
2437 consecutive_resyncs = 0;
2438 }
2439 continue;
2440 }
2441
2442 consecutive_resyncs = 0;
2443
2444 // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
2445 if (ReaderReceive(receivedAnswer, receivedAnswerPar)) {
2446 catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
2447
2448 if (nt_diff == 0) {
2449 par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
2450 }
2451
2452 led_on = !led_on;
2453 if(led_on) LED_B_ON(); else LED_B_OFF();
2454
2455 par_list[nt_diff] = SwapBits(par[0], 8);
2456 ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
2457
2458 // Test if the information is complete
2459 if (nt_diff == 0x07) {
2460 isOK = 1;
2461 break;
2462 }
2463
2464 nt_diff = (nt_diff + 1) & 0x07;
2465 mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
2466 par[0] = par_low;
2467 } else {
2468 if (nt_diff == 0 && first_try)
2469 {
2470 par[0]++;
2471 if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
2472 isOK = -2;
2473 break;
2474 }
2475 } else {
2476 par[0] = ((par[0] & 0x1F) + 1) | par_low;
2477 }
2478 }
2479 }
2480
2481
2482 mf_nr_ar[3] &= 0x1F;
2483
2484 if (isOK == -4) {
2485 if (MF_DBGLEVEL >= 3) {
2486 for (uint16_t i = 0; i <= MAX_STRATEGY; i++) {
2487 for(uint16_t j = 0; j < NUM_DEBUG_INFOS; j++) {
2488 Dbprintf("collected debug info[%d][%d] = %d", i, j, debug_info[i][j]);
2489 }
2490 }
2491 }
2492 }
2493
2494 byte_t buf[28];
2495 memcpy(buf + 0, uid, 4);
2496 num_to_bytes(nt, 4, buf + 4);
2497 memcpy(buf + 8, par_list, 8);
2498 memcpy(buf + 16, ks_list, 8);
2499 memcpy(buf + 24, mf_nr_ar, 4);
2500
2501 cmd_send(CMD_ACK,isOK,0,0,buf,28);
2502
2503 // Thats it...
2504 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2505 LEDsoff();
2506
2507 set_tracing(FALSE);
2508 }
2509
2510 /**
2511 *MIFARE 1K simulate.
2512 *
2513 *@param flags :
2514 * FLAG_INTERACTIVE - In interactive mode, we are expected to finish the operation with an ACK
2515 * 4B_FLAG_UID_IN_DATA - means that there is a 4-byte UID in the data-section, we're expected to use that
2516 * 7B_FLAG_UID_IN_DATA - means that there is a 7-byte UID in the data-section, we're expected to use that
2517 * FLAG_NR_AR_ATTACK - means we should collect NR_AR responses for bruteforcing later
2518 *@param exitAfterNReads, exit simulation after n blocks have been read, 0 is inifite
2519 */
2520 void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *datain)
2521 {
2522 int cardSTATE = MFEMUL_NOFIELD;
2523 int _7BUID = 0;
2524 int vHf = 0; // in mV
2525 int res;
2526 uint32_t selTimer = 0;
2527 uint32_t authTimer = 0;
2528 uint16_t len = 0;
2529 uint8_t cardWRBL = 0;
2530 uint8_t cardAUTHSC = 0;
2531 uint8_t cardAUTHKEY = 0xff; // no authentication
2532 // uint32_t cardRr = 0;
2533 uint32_t cuid = 0;
2534 //uint32_t rn_enc = 0;
2535 uint32_t ans = 0;
2536 uint32_t cardINTREG = 0;
2537 uint8_t cardINTBLOCK = 0;
2538 struct Crypto1State mpcs = {0, 0};
2539 struct Crypto1State *pcs;
2540 pcs = &mpcs;
2541 uint32_t numReads = 0;//Counts numer of times reader read a block
2542 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
2543 uint8_t receivedCmd_par[MAX_MIFARE_PARITY_SIZE];
2544 uint8_t response[MAX_MIFARE_FRAME_SIZE];
2545 uint8_t response_par[MAX_MIFARE_PARITY_SIZE];
2546
2547 uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k 4BUID
2548 uint8_t rUIDBCC1[] = {0xde, 0xad, 0xbe, 0xaf, 0x62};
2549 uint8_t rUIDBCC2[] = {0xde, 0xad, 0xbe, 0xaf, 0x62}; // !!!
2550 uint8_t rSAK[] = {0x08, 0xb6, 0xdd}; // Mifare Classic
2551 //uint8_t rSAK[] = {0x09, 0x3f, 0xcc }; // Mifare Mini
2552 uint8_t rSAK1[] = {0x04, 0xda, 0x17};
2553
2554 uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
2555 uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
2556
2557 //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
2558 // This can be used in a reader-only attack.
2559 // (it can also be retrieved via 'hf 14a list', but hey...
2560 uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
2561 uint8_t ar_nr_collected = 0;
2562
2563 // Authenticate response - nonce
2564 uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
2565
2566 //-- Determine the UID
2567 // Can be set from emulator memory, incoming data
2568 // and can be 7 or 4 bytes long
2569 if (flags & FLAG_4B_UID_IN_DATA)
2570 {
2571 // 4B uid comes from data-portion of packet
2572 memcpy(rUIDBCC1,datain,4);
2573 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2574
2575 } else if (flags & FLAG_7B_UID_IN_DATA) {
2576 // 7B uid comes from data-portion of packet
2577 memcpy(&rUIDBCC1[1],datain,3);
2578 memcpy(rUIDBCC2, datain+3, 4);
2579 _7BUID = true;
2580 } else {
2581 // get UID from emul memory
2582 emlGetMemBt(receivedCmd, 7, 1);
2583 _7BUID = !(receivedCmd[0] == 0x00);
2584 if (!_7BUID) { // ---------- 4BUID
2585 emlGetMemBt(rUIDBCC1, 0, 4);
2586 } else { // ---------- 7BUID
2587 emlGetMemBt(&rUIDBCC1[1], 0, 3);
2588 emlGetMemBt(rUIDBCC2, 3, 4);
2589 }
2590 }
2591
2592 // save uid.
2593 ar_nr_responses[0*5] = bytes_to_num(rUIDBCC1+1, 3);
2594 if ( _7BUID )
2595 ar_nr_responses[0*5+1] = bytes_to_num(rUIDBCC2, 4);
2596
2597 /*
2598 * Regardless of what method was used to set the UID, set fifth byte and modify
2599 * the ATQA for 4 or 7-byte UID
2600 */
2601 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2602 if (_7BUID) {
2603 rATQA[0] = 0x44;
2604 rUIDBCC1[0] = 0x88;
2605 rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
2606 rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
2607 }
2608
2609 if (MF_DBGLEVEL >= 1) {
2610 if (!_7BUID) {
2611 Dbprintf("4B UID: %02x%02x%02x%02x",
2612 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
2613 } else {
2614 Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
2615 rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
2616 rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
2617 }
2618 }
2619
2620 // We need to listen to the high-frequency, peak-detected path.
2621 iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
2622
2623 // free eventually allocated BigBuf memory but keep Emulator Memory
2624 BigBuf_free_keep_EM();
2625
2626 // clear trace
2627 clear_trace();
2628 set_tracing(TRUE);
2629
2630
2631 bool finished = FALSE;
2632 while (!BUTTON_PRESS() && !finished) {
2633 WDT_HIT();
2634
2635 // find reader field
2636 if (cardSTATE == MFEMUL_NOFIELD) {
2637 vHf = (MAX_ADC_HF_VOLTAGE * AvgAdc(ADC_CHAN_HF)) >> 10;
2638 if (vHf > MF_MINFIELDV) {
2639 cardSTATE_TO_IDLE();
2640 LED_A_ON();
2641 }
2642 }
2643 if(cardSTATE == MFEMUL_NOFIELD) continue;
2644
2645 //Now, get data
2646 res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
2647 if (res == 2) { //Field is off!
2648 cardSTATE = MFEMUL_NOFIELD;
2649 LEDsoff();
2650 continue;
2651 } else if (res == 1) {
2652 break; //return value 1 means button press
2653 }
2654
2655 // REQ or WUP request in ANY state and WUP in HALTED state
2656 if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
2657 selTimer = GetTickCount();
2658 EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
2659 cardSTATE = MFEMUL_SELECT1;
2660
2661 // init crypto block
2662 LED_B_OFF();
2663 LED_C_OFF();
2664 crypto1_destroy(pcs);
2665 cardAUTHKEY = 0xff;
2666 continue;
2667 }
2668
2669 switch (cardSTATE) {
2670 case MFEMUL_NOFIELD:
2671 case MFEMUL_HALTED:
2672 case MFEMUL_IDLE:{
2673 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2674 break;
2675 }
2676 case MFEMUL_SELECT1:{
2677 // select all
2678 if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
2679 if (MF_DBGLEVEL >= 4) Dbprintf("SELECT ALL received");
2680 EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
2681 break;
2682 }
2683
2684 if (MF_DBGLEVEL >= 4 && len == 9 && receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 )
2685 {
2686 Dbprintf("SELECT %02x%02x%02x%02x received",receivedCmd[2],receivedCmd[3],receivedCmd[4],receivedCmd[5]);
2687 }
2688 // select card
2689 if (len == 9 &&
2690 (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
2691 EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
2692 cuid = bytes_to_num(rUIDBCC1, 4);
2693 if (!_7BUID) {
2694 cardSTATE = MFEMUL_WORK;
2695 LED_B_ON();
2696 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
2697 break;
2698 } else {
2699 cardSTATE = MFEMUL_SELECT2;
2700 }
2701 }
2702 break;
2703 }
2704 case MFEMUL_AUTH1:{
2705 if( len != 8)
2706 {
2707 cardSTATE_TO_IDLE();
2708 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2709 break;
2710 }
2711
2712 uint32_t ar = bytes_to_num(receivedCmd, 4);
2713 uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
2714
2715 //Collect AR/NR
2716 //if(ar_nr_collected < 2 && cardAUTHSC == 2){
2717 if(ar_nr_collected < 2){
2718 if(ar_nr_responses[2] != ar)
2719 {// Avoid duplicates... probably not necessary, ar should vary.
2720 //ar_nr_responses[ar_nr_collected*5] = 0;
2721 //ar_nr_responses[ar_nr_collected*5+1] = 0;
2722 ar_nr_responses[ar_nr_collected*5+2] = nonce;
2723 ar_nr_responses[ar_nr_collected*5+3] = nr;
2724 ar_nr_responses[ar_nr_collected*5+4] = ar;
2725 ar_nr_collected++;
2726 }
2727 // Interactive mode flag, means we need to send ACK
2728 if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
2729 {
2730 finished = true;
2731 }
2732 }
2733
2734 // --- crypto
2735 //crypto1_word(pcs, ar , 1);
2736 //cardRr = nr ^ crypto1_word(pcs, 0, 0);
2737
2738 //test if auth OK
2739 //if (cardRr != prng_successor(nonce, 64)){
2740
2741 //if (MF_DBGLEVEL >= 4) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
2742 // cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2743 // cardRr, prng_successor(nonce, 64));
2744 // Shouldn't we respond anything here?
2745 // Right now, we don't nack or anything, which causes the
2746 // reader to do a WUPA after a while. /Martin
2747 // -- which is the correct response. /piwi
2748 //cardSTATE_TO_IDLE();
2749 //LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2750 //break;
2751 //}
2752
2753 ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
2754
2755 num_to_bytes(ans, 4, rAUTH_AT);
2756 // --- crypto
2757 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2758 LED_C_ON();
2759 cardSTATE = MFEMUL_WORK;
2760 if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
2761 cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
2762 GetTickCount() - authTimer);
2763 break;
2764 }
2765 case MFEMUL_SELECT2:{
2766 if (!len) {
2767 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2768 break;
2769 }
2770 if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
2771 EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
2772 break;
2773 }
2774
2775 // select 2 card
2776 if (len == 9 &&
2777 (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
2778 EmSendCmd(rSAK, sizeof(rSAK));
2779 cuid = bytes_to_num(rUIDBCC2, 4);
2780 cardSTATE = MFEMUL_WORK;
2781 LED_B_ON();
2782 if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
2783 break;
2784 }
2785
2786 // i guess there is a command). go into the work state.
2787 if (len != 4) {
2788 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2789 break;
2790 }
2791 cardSTATE = MFEMUL_WORK;
2792 //goto lbWORK;
2793 //intentional fall-through to the next case-stmt
2794 }
2795
2796 case MFEMUL_WORK:{
2797 if (len == 0) {
2798 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2799 break;
2800 }
2801
2802 bool encrypted_data = (cardAUTHKEY != 0xFF) ;
2803
2804 if(encrypted_data) {
2805 // decrypt seqence
2806 mf_crypto1_decrypt(pcs, receivedCmd, len);
2807 }
2808
2809 if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
2810 authTimer = GetTickCount();
2811 cardAUTHSC = receivedCmd[1] / 4; // received block num
2812 cardAUTHKEY = receivedCmd[0] - 0x60;
2813 crypto1_destroy(pcs);//Added by martin
2814 crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
2815
2816 if (!encrypted_data) { // first authentication
2817 if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2818
2819 crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
2820 num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
2821 } else { // nested authentication
2822 if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
2823 ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
2824 num_to_bytes(ans, 4, rAUTH_AT);
2825 }
2826
2827 EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
2828 //Dbprintf("Sending rAUTH %02x%02x%02x%02x", rAUTH_AT[0],rAUTH_AT[1],rAUTH_AT[2],rAUTH_AT[3]);
2829 cardSTATE = MFEMUL_AUTH1;
2830 break;
2831 }
2832
2833 // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
2834 // BUT... ACK --> NACK
2835 if (len == 1 && receivedCmd[0] == CARD_ACK) {
2836 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2837 break;
2838 }
2839
2840 // rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
2841 if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
2842 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2843 break;
2844 }
2845
2846 if(len != 4) {
2847 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2848 break;
2849 }
2850
2851 if(receivedCmd[0] == 0x30 // read block
2852 || receivedCmd[0] == 0xA0 // write block
2853 || receivedCmd[0] == 0xC0 // inc
2854 || receivedCmd[0] == 0xC1 // dec
2855 || receivedCmd[0] == 0xC2 // restore
2856 || receivedCmd[0] == 0xB0) { // transfer
2857 if (receivedCmd[1] >= 16 * 4) {
2858 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2859 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2860 break;
2861 }
2862
2863 if (receivedCmd[1] / 4 != cardAUTHSC) {
2864 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2865 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
2866 break;
2867 }
2868 }
2869 // read block
2870 if (receivedCmd[0] == 0x30) {
2871 if (MF_DBGLEVEL >= 4) {
2872 Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
2873 }
2874 emlGetMem(response, receivedCmd[1], 1);
2875 AppendCrc14443a(response, 16);
2876 mf_crypto1_encrypt(pcs, response, 18, response_par);
2877 EmSendCmdPar(response, 18, response_par);
2878 numReads++;
2879 if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
2880 Dbprintf("%d reads done, exiting", numReads);
2881 finished = true;
2882 }
2883 break;
2884 }
2885 // write block
2886 if (receivedCmd[0] == 0xA0) {
2887 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
2888 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2889 cardSTATE = MFEMUL_WRITEBL2;
2890 cardWRBL = receivedCmd[1];
2891 break;
2892 }
2893 // increment, decrement, restore
2894 if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
2895 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2896 if (emlCheckValBl(receivedCmd[1])) {
2897 if (MF_DBGLEVEL >= 4) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
2898 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2899 break;
2900 }
2901 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2902 if (receivedCmd[0] == 0xC1)
2903 cardSTATE = MFEMUL_INTREG_INC;
2904 if (receivedCmd[0] == 0xC0)
2905 cardSTATE = MFEMUL_INTREG_DEC;
2906 if (receivedCmd[0] == 0xC2)
2907 cardSTATE = MFEMUL_INTREG_REST;
2908 cardWRBL = receivedCmd[1];
2909 break;
2910 }
2911 // transfer
2912 if (receivedCmd[0] == 0xB0) {
2913 if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
2914 if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
2915 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2916 else
2917 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2918 break;
2919 }
2920 // halt
2921 if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
2922 LED_B_OFF();
2923 LED_C_OFF();
2924 cardSTATE = MFEMUL_HALTED;
2925 if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer);
2926 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2927 break;
2928 }
2929 // RATS
2930 if (receivedCmd[0] == 0xe0) {//RATS
2931 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2932 break;
2933 }
2934 // command not allowed
2935 if (MF_DBGLEVEL >= 4) Dbprintf("Received command not allowed, nacking");
2936 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2937 break;
2938 }
2939 case MFEMUL_WRITEBL2:{
2940 if (len == 18){
2941 mf_crypto1_decrypt(pcs, receivedCmd, len);
2942 emlSetMem(receivedCmd, cardWRBL, 1);
2943 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
2944 cardSTATE = MFEMUL_WORK;
2945 } else {
2946 cardSTATE_TO_IDLE();
2947 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2948 }
2949 break;
2950 }
2951
2952 case MFEMUL_INTREG_INC:{
2953 mf_crypto1_decrypt(pcs, receivedCmd, len);
2954 memcpy(&ans, receivedCmd, 4);
2955 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2956 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2957 cardSTATE_TO_IDLE();
2958 break;
2959 }
2960 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2961 cardINTREG = cardINTREG + ans;
2962 cardSTATE = MFEMUL_WORK;
2963 break;
2964 }
2965 case MFEMUL_INTREG_DEC:{
2966 mf_crypto1_decrypt(pcs, receivedCmd, len);
2967 memcpy(&ans, receivedCmd, 4);
2968 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2969 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2970 cardSTATE_TO_IDLE();
2971 break;
2972 }
2973 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2974 cardINTREG = cardINTREG - ans;
2975 cardSTATE = MFEMUL_WORK;
2976 break;
2977 }
2978 case MFEMUL_INTREG_REST:{
2979 mf_crypto1_decrypt(pcs, receivedCmd, len);
2980 memcpy(&ans, receivedCmd, 4);
2981 if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
2982 EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
2983 cardSTATE_TO_IDLE();
2984 break;
2985 }
2986 LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
2987 cardSTATE = MFEMUL_WORK;
2988 break;
2989 }
2990 }
2991 }
2992
2993 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
2994 LEDsoff();
2995
2996 if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
2997 {
2998 //May just aswell send the collected ar_nr in the response aswell
2999 uint8_t len = ar_nr_collected*5*4;
3000 cmd_send(CMD_ACK, CMD_SIMULATE_MIFARE_CARD, len, 0, &ar_nr_responses, len);
3001 }
3002
3003 if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
3004 {
3005 if(ar_nr_collected > 1 ) {
3006 Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
3007 Dbprintf("../tools/mfkey/mfkey32 %06x%08x %08x %08x %08x %08x %08x",
3008 ar_nr_responses[0], // UID1
3009 ar_nr_responses[1], // UID2
3010 ar_nr_responses[2], // NT
3011 ar_nr_responses[3], // AR1
3012 ar_nr_responses[4], // NR1
3013 ar_nr_responses[8], // AR2
3014 ar_nr_responses[9] // NR2
3015 );
3016 Dbprintf("../tools/mfkey/mfkey32v2 %06x%08x %08x %08x %08x %08x %08x %08x",
3017 ar_nr_responses[0], // UID1
3018 ar_nr_responses[1], // UID2
3019 ar_nr_responses[2], // NT1
3020 ar_nr_responses[3], // AR1
3021 ar_nr_responses[4], // NR1
3022 ar_nr_responses[7], // NT2
3023 ar_nr_responses[8], // AR2
3024 ar_nr_responses[9] // NR2
3025 );
3026 } else {
3027 Dbprintf("Failed to obtain two AR/NR pairs!");
3028 if(ar_nr_collected > 0 ) {
3029 Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
3030 ar_nr_responses[0], // UID1
3031 ar_nr_responses[1], // UID2
3032 ar_nr_responses[2], // NT
3033 ar_nr_responses[3], // AR1
3034 ar_nr_responses[4] // NR1
3035 );
3036 }
3037 }
3038 }
3039 if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, BigBuf_get_traceLen());
3040
3041 set_tracing(FALSE);
3042 }
3043
3044
3045 //-----------------------------------------------------------------------------
3046 // MIFARE sniffer.
3047 //
3048 //-----------------------------------------------------------------------------
3049 void RAMFUNC SniffMifare(uint8_t param) {
3050 // param:
3051 // bit 0 - trigger from first card answer
3052 // bit 1 - trigger from first reader 7-bit request
3053
3054 // C(red) A(yellow) B(green)
3055 LEDsoff();
3056 // init trace buffer
3057 clear_trace();
3058 set_tracing(TRUE);
3059
3060 // The command (reader -> tag) that we're receiving.
3061 // The length of a received command will in most cases be no more than 18 bytes.
3062 // So 32 should be enough!
3063 uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
3064 uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
3065 // The response (tag -> reader) that we're receiving.
3066 uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
3067 uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
3068
3069 iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
3070
3071 // free eventually allocated BigBuf memory
3072 BigBuf_free();
3073 // allocate the DMA buffer, used to stream samples from the FPGA
3074 uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
3075 uint8_t *data = dmaBuf;
3076 uint8_t previous_data = 0;
3077 int maxDataLen = 0;
3078 int dataLen = 0;
3079 bool ReaderIsActive = FALSE;
3080 bool TagIsActive = FALSE;
3081
3082 // Set up the demodulator for tag -> reader responses.
3083 DemodInit(receivedResponse, receivedResponsePar);
3084
3085 // Set up the demodulator for the reader -> tag commands
3086 UartInit(receivedCmd, receivedCmdPar);
3087
3088 // Setup for the DMA.
3089 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
3090
3091 LED_D_OFF();
3092
3093 // init sniffer
3094 MfSniffInit();
3095
3096 // And now we loop, receiving samples.
3097 for(uint32_t sniffCounter = 0; TRUE; ) {
3098
3099 if(BUTTON_PRESS()) {
3100 DbpString("cancelled by button");
3101 break;
3102 }
3103
3104 LED_A_ON();
3105 WDT_HIT();
3106
3107 if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
3108 // check if a transaction is completed (timeout after 2000ms).
3109 // if yes, stop the DMA transfer and send what we have so far to the client
3110 if (MfSniffSend(2000)) {
3111 // Reset everything - we missed some sniffed data anyway while the DMA was stopped
3112 sniffCounter = 0;
3113 data = dmaBuf;
3114 maxDataLen = 0;
3115 ReaderIsActive = FALSE;
3116 TagIsActive = FALSE;
3117 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
3118 }
3119 }
3120
3121 int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
3122 int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
3123 if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
3124 dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
3125 } else {
3126 dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
3127 }
3128 // test for length of buffer
3129 if(dataLen > maxDataLen) { // we are more behind than ever...
3130 maxDataLen = dataLen;
3131 if(dataLen > (9 * DMA_BUFFER_SIZE / 10)) {
3132 Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
3133 break;
3134 }
3135 }
3136 if(dataLen < 1) continue;
3137
3138 // primary buffer was stopped ( <-- we lost data!
3139 if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
3140 AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
3141 AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
3142 Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
3143 }
3144 // secondary buffer sets as primary, secondary buffer was stopped
3145 if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
3146 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
3147 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
3148 }
3149
3150 LED_A_OFF();
3151
3152 if (sniffCounter & 0x01) {
3153
3154 if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
3155 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
3156 if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
3157 LED_C_INV();
3158 if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
3159
3160 /* And ready to receive another command. */
3161 UartReset();
3162
3163 /* And also reset the demod code */
3164 DemodReset();
3165 }
3166 ReaderIsActive = (Uart.state != STATE_UNSYNCD);
3167 }
3168
3169 if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
3170 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
3171 if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
3172 LED_C_INV();
3173
3174 if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, FALSE)) break;
3175
3176 // And ready to receive another response.
3177 DemodReset();
3178
3179 // And reset the Miller decoder including its (now outdated) input buffer
3180 UartInit(receivedCmd, receivedCmdPar);
3181 // why not UartReset?
3182 }
3183 TagIsActive = (Demod.state != DEMOD_UNSYNCD);
3184 }
3185 }
3186
3187 previous_data = *data;
3188 sniffCounter++;
3189 data++;
3190 if(data == dmaBuf + DMA_BUFFER_SIZE) {
3191 data = dmaBuf;
3192 }
3193
3194 } // main cycle
3195
3196 FpgaDisableSscDma();
3197 MfSniffEnd();
3198 LEDsoff();
3199 Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
3200 set_tracing(FALSE);
3201 }
Proxmark3 GIT tracking
Impressum, Datenschutz