1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Nov 2006
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Routines to support ISO 14443B. This includes both the reader software and
9 // the `fake tag' modes.
10 //-----------------------------------------------------------------------------
12 #include "proxmark3.h"
16 #include "iso14443crc.h"
18 #define RECEIVE_SAMPLES_TIMEOUT 600000
19 #define ISO14443B_DMA_BUFFER_SIZE 256
22 // PCB Block number for APDUs
23 static uint8_t pcb_blocknum
= 0;
25 //=============================================================================
26 // An ISO 14443 Type B tag. We listen for commands from the reader, using
27 // a UART kind of thing that's implemented in software. When we get a
28 // frame (i.e., a group of bytes between SOF and EOF), we check the CRC.
29 // If it's good, then we can do something appropriate with it, and send
31 //=============================================================================
33 //-----------------------------------------------------------------------------
34 // Code up a string of octets at layer 2 (including CRC, we don't generate
35 // that here) so that they can be transmitted to the reader. Doesn't transmit
36 // them yet, just leaves them ready to send in ToSend[].
37 //-----------------------------------------------------------------------------
38 static void CodeIso14443bAsTag(const uint8_t *cmd
, int len
)
44 // Transmit a burst of ones, as the initial thing that lets the
45 // reader get phase sync. This (TR1) must be > 80/fs, per spec,
46 // but tag that I've tried (a Paypass) exceeds that by a fair bit,
48 for(i
= 0; i
< 20; i
++) {
56 for(i
= 0; i
< 10; i
++) {
62 for(i
= 0; i
< 2; i
++) {
69 for(i
= 0; i
< len
; i
++) {
80 for(j
= 0; j
< 8; j
++) {
103 for(i
= 0; i
< 10; i
++) {
109 for(i
= 0; i
< 2; i
++) {
116 // Convert from last byte pos to length
120 //-----------------------------------------------------------------------------
121 // The software UART that receives commands from the reader, and its state
123 //-----------------------------------------------------------------------------
127 STATE_GOT_FALLING_EDGE_OF_SOF
,
128 STATE_AWAITING_START_BIT
,
139 /* Receive & handle a bit coming from the reader.
141 * This function is called 4 times per bit (every 2 subcarrier cycles).
142 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 2,36us
145 * LED A -> ON once we have received the SOF and are expecting the rest.
146 * LED A -> OFF once we have received EOF or are in error state or unsynced
148 * Returns: true if we received a EOF
149 * false if we are still waiting for some more
151 static RAMFUNC
int Handle14443bUartBit(uint8_t bit
)
156 // we went low, so this could be the beginning
158 Uart
.state
= STATE_GOT_FALLING_EDGE_OF_SOF
;
164 case STATE_GOT_FALLING_EDGE_OF_SOF
:
166 if(Uart
.posCnt
== 2) { // sample every 4 1/fs in the middle of a bit
168 if(Uart
.bitCnt
> 9) {
169 // we've seen enough consecutive
170 // zeros that it's a valid SOF
173 Uart
.state
= STATE_AWAITING_START_BIT
;
174 LED_A_ON(); // Indicate we got a valid SOF
176 // didn't stay down long enough
177 // before going high, error
178 Uart
.state
= STATE_UNSYNCD
;
181 // do nothing, keep waiting
185 if(Uart
.posCnt
>= 4) Uart
.posCnt
= 0;
186 if(Uart
.bitCnt
> 12) {
187 // Give up if we see too many zeros without
190 Uart
.state
= STATE_UNSYNCD
;
194 case STATE_AWAITING_START_BIT
:
197 if(Uart
.posCnt
> 50/2) { // max 57us between characters = 49 1/fs, max 3 etus after low phase of SOF = 24 1/fs
198 // stayed high for too long between
200 Uart
.state
= STATE_UNSYNCD
;
203 // falling edge, this starts the data byte
207 Uart
.state
= STATE_RECEIVING_DATA
;
211 case STATE_RECEIVING_DATA
:
213 if(Uart
.posCnt
== 2) {
214 // time to sample a bit
217 Uart
.shiftReg
|= 0x200;
221 if(Uart
.posCnt
>= 4) {
224 if(Uart
.bitCnt
== 10) {
225 if((Uart
.shiftReg
& 0x200) && !(Uart
.shiftReg
& 0x001))
227 // this is a data byte, with correct
228 // start and stop bits
229 Uart
.output
[Uart
.byteCnt
] = (Uart
.shiftReg
>> 1) & 0xff;
232 if(Uart
.byteCnt
>= Uart
.byteCntMax
) {
233 // Buffer overflowed, give up
235 Uart
.state
= STATE_UNSYNCD
;
237 // so get the next byte now
239 Uart
.state
= STATE_AWAITING_START_BIT
;
241 } else if (Uart
.shiftReg
== 0x000) {
242 // this is an EOF byte
243 LED_A_OFF(); // Finished receiving
244 Uart
.state
= STATE_UNSYNCD
;
245 if (Uart
.byteCnt
!= 0) {
251 Uart
.state
= STATE_UNSYNCD
;
258 Uart
.state
= STATE_UNSYNCD
;
266 static void UartReset()
268 Uart
.byteCntMax
= MAX_FRAME_SIZE
;
269 Uart
.state
= STATE_UNSYNCD
;
273 memset(Uart
.output
, 0x00, MAX_FRAME_SIZE
);
277 static void UartInit(uint8_t *data
)
284 //-----------------------------------------------------------------------------
285 // Receive a command (from the reader to us, where we are the simulated tag),
286 // and store it in the given buffer, up to the given maximum length. Keeps
287 // spinning, waiting for a well-framed command, until either we get one
288 // (returns TRUE) or someone presses the pushbutton on the board (FALSE).
290 // Assume that we're called with the SSC (to the FPGA) and ADC path set
292 //-----------------------------------------------------------------------------
293 static int GetIso14443bCommandFromReader(uint8_t *received
, uint16_t *len
)
295 // Set FPGA mode to "simulated ISO 14443B tag", no modulation (listen
296 // only, since we are receiving, not transmitting).
297 // Signal field is off with the appropriate LED
299 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
| FPGA_HF_SIMULATOR_NO_MODULATION
);
301 // Now run a `software UART' on the stream of incoming samples.
307 if(BUTTON_PRESS()) return FALSE
;
309 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
310 uint8_t b
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
311 for(uint8_t mask
= 0x80; mask
!= 0x00; mask
>>= 1) {
312 if(Handle14443bUartBit(b
& mask
)) {
323 //-----------------------------------------------------------------------------
324 // Main loop of simulated tag: receive commands from reader, decide what
325 // response to send, and send it.
326 //-----------------------------------------------------------------------------
327 void SimulateIso14443bTag(void)
329 // the only commands we understand is WUPB, AFI=0, Select All, N=1:
330 static const uint8_t cmd1
[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB
331 // ... and REQB, AFI=0, Normal Request, N=1:
332 static const uint8_t cmd2
[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB
334 static const uint8_t cmd3
[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB
336 static const uint8_t cmd4
[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB
338 // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
339 // supports only 106kBit/s in both directions, max frame size = 32Bytes,
340 // supports ISO14443-4, FWI=8 (77ms), NAD supported, CID not supported:
341 static const uint8_t response1
[] = {
342 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
343 0x00, 0x21, 0x85, 0x5e, 0xd7
345 // response to HLTB and ATTRIB
346 static const uint8_t response2
[] = {0x00, 0x78, 0xF0};
348 uint8_t parity
[MAX_PARITY_SIZE
];
350 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
357 uint16_t respLen
, respCodeLen
;
359 // allocate command receive buffer
361 uint8_t *receivedCmd
= BigBuf_malloc(MAX_FRAME_SIZE
);
364 uint16_t cmdsRecvd
= 0;
366 // prepare the (only one) tag answer:
367 CodeIso14443bAsTag(response1
, sizeof(response1
));
368 uint8_t *resp1Code
= BigBuf_malloc(ToSendMax
);
369 memcpy(resp1Code
, ToSend
, ToSendMax
);
370 uint16_t resp1CodeLen
= ToSendMax
;
372 // prepare the (other) tag answer:
373 CodeIso14443bAsTag(response2
, sizeof(response2
));
374 uint8_t *resp2Code
= BigBuf_malloc(ToSendMax
);
375 memcpy(resp2Code
, ToSend
, ToSendMax
);
376 uint16_t resp2CodeLen
= ToSendMax
;
378 // We need to listen to the high-frequency, peak-detected path.
379 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
386 if(!GetIso14443bCommandFromReader(receivedCmd
, &len
)) {
387 Dbprintf("button pressed, received %d commands", cmdsRecvd
);
392 LogTrace(receivedCmd
, len
, 0, 0, parity
, TRUE
);
395 // Good, look at the command now.
396 if ( (len
== sizeof(cmd1
) && memcmp(receivedCmd
, cmd1
, len
) == 0)
397 || (len
== sizeof(cmd2
) && memcmp(receivedCmd
, cmd2
, len
) == 0) ) {
399 respLen
= sizeof(response1
);
400 respCode
= resp1Code
;
401 respCodeLen
= resp1CodeLen
;
402 } else if ( (len
== sizeof(cmd3
) && receivedCmd
[0] == cmd3
[0])
403 || (len
== sizeof(cmd4
) && receivedCmd
[0] == cmd4
[0]) ) {
405 respLen
= sizeof(response2
);
406 respCode
= resp2Code
;
407 respCodeLen
= resp2CodeLen
;
409 Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len
, cmdsRecvd
);
410 // And print whether the CRC fails, just for good measure
412 if (len
>= 3){ // if crc exists
413 ComputeCrc14443(CRC_14443_B
, receivedCmd
, len
-2, &b1
, &b2
);
414 if(b1
!= receivedCmd
[len
-2] || b2
!= receivedCmd
[len
-1]) {
415 // Not so good, try again.
416 DbpString("+++CRC fail");
419 DbpString("CRC passes");
422 //get rid of compiler warning
426 respCode
= resp1Code
;
427 //don't crash at new command just wait and see if reader will send other new cmds.
433 if(cmdsRecvd
> 0x30) {
434 DbpString("many commands later...");
438 if(respCodeLen
<= 0) continue;
441 // Signal field is off with the appropriate LED
443 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR
| FPGA_HF_SIMULATOR_MODULATE_BPSK
);
444 AT91C_BASE_SSC
->SSC_THR
= 0xff;
448 // clear receiving shift register and holding register
449 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
450 c
= AT91C_BASE_SSC
->SSC_RHR
; (void) c
;
451 while(!(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
));
452 c
= AT91C_BASE_SSC
->SSC_RHR
; (void) c
;
455 AT91C_BASE_SSC
->SSC_THR
= 0x00;
457 // Transmit the response.
458 uint16_t FpgaSendQueueDelay
= 0;
460 for(;i
< respCodeLen
; ) {
461 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
462 AT91C_BASE_SSC
->SSC_THR
= respCode
[i
++];
463 FpgaSendQueueDelay
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
465 if(BUTTON_PRESS()) break;
468 // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
469 uint8_t fpga_queued_bits
= FpgaSendQueueDelay
>> 3;
470 for (i
= 0; i
<= fpga_queued_bits
/8 + 1; ) {
471 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
472 AT91C_BASE_SSC
->SSC_THR
= 0x00;
473 FpgaSendQueueDelay
= (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
478 // trace the response:
479 if (tracing
) LogTrace(resp
, respLen
, 0, 0, parity
, FALSE
);
484 //=============================================================================
485 // An ISO 14443 Type B reader. We take layer two commands, code them
486 // appropriately, and then send them to the tag. We then listen for the
487 // tag's response, which we leave in the buffer to be demodulated on the
489 //=============================================================================
494 DEMOD_PHASE_REF_TRAINING
,
495 DEMOD_AWAITING_FALLING_EDGE_OF_SOF
,
496 DEMOD_GOT_FALLING_EDGE_OF_SOF
,
497 DEMOD_AWAITING_START_BIT
,
503 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
515 * Handles reception of a bit from the tag
517 * This function is called 2 times per bit (every 4 subcarrier cycles).
518 * Subcarrier frequency fs is 848kHz, 1/fs = 1,18us, i.e. function is called every 4,72us
521 * LED C -> ON once we have received the SOF and are expecting the rest.
522 * LED C -> OFF once we have received EOF or are unsynced
524 * Returns: true if we received a EOF
525 * false if we are still waiting for some more
528 static RAMFUNC
int Handle14443bSamplesDemod(int ci
, int cq
)
533 int halfci
= (ai
>> 1);
534 int halfcq
= (aq
>> 1);
536 // The soft decision on the bit uses an estimate of just the
537 // quadrant of the reference angle, not the exact angle.
538 #define MAKE_SOFT_DECISION() { \
539 if(Demod.sumI > 0) { \
544 if(Demod.sumQ > 0) { \
551 #define SUBCARRIER_DETECT_THRESHOLD 8
553 // Subcarrier amplitude v = sqrt(ci^2 + cq^2), approximated here by max(abs(ci),abs(cq)) + 1/2*min(abs(ci),abs(cq)))
554 #define CHECK_FOR_SUBCARRIER() { \
555 v = MAX(ai, aq) + MIN(halfci, halfcq); \
559 switch(Demod
.state
) {
561 CHECK_FOR_SUBCARRIER();
562 if(v
> SUBCARRIER_DETECT_THRESHOLD
) { // subcarrier detected
563 Demod
.state
= DEMOD_PHASE_REF_TRAINING
;
570 case DEMOD_PHASE_REF_TRAINING
:
571 if(Demod
.posCount
< 8) {
572 //if(Demod.posCount < 10*2) {
573 CHECK_FOR_SUBCARRIER();
574 if (v
> SUBCARRIER_DETECT_THRESHOLD
) {
575 // set the reference phase (will code a logic '1') by averaging over 32 1/fs.
576 // note: synchronization time > 80 1/fs
580 } else { // subcarrier lost
581 Demod
.state
= DEMOD_UNSYNCD
;
584 Demod
.state
= DEMOD_AWAITING_FALLING_EDGE_OF_SOF
;
588 case DEMOD_AWAITING_FALLING_EDGE_OF_SOF
:
589 MAKE_SOFT_DECISION();
590 //Dbprintf("ICE: %d %d %d %d %d", v, Demod.sumI, Demod.sumQ, ci, cq );
591 if(v
<= 0) { // logic '0' detected
592 Demod
.state
= DEMOD_GOT_FALLING_EDGE_OF_SOF
;
593 Demod
.posCount
= 0; // start of SOF sequence
595 if(Demod
.posCount
> 25*2) { // maximum length of TR1 = 200 1/fs
596 Demod
.state
= DEMOD_UNSYNCD
;
602 case DEMOD_GOT_FALLING_EDGE_OF_SOF
:
604 MAKE_SOFT_DECISION();
606 if(Demod
.posCount
< 10*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
607 Demod
.state
= DEMOD_UNSYNCD
;
609 LED_C_ON(); // Got SOF
610 Demod
.state
= DEMOD_AWAITING_START_BIT
;
613 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
619 if(Demod
.posCount
> 13*2) { // low phase of SOF too long (> 12 etu)
620 Demod
.state
= DEMOD_UNSYNCD
;
626 case DEMOD_AWAITING_START_BIT
:
628 MAKE_SOFT_DECISION();
630 if(Demod
.posCount
> 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
631 Demod
.state
= DEMOD_UNSYNCD
;
634 } else { // start bit detected
636 Demod
.posCount
= 1; // this was the first half
639 Demod
.state
= DEMOD_RECEIVING_DATA
;
643 case DEMOD_RECEIVING_DATA
:
644 MAKE_SOFT_DECISION();
645 if(Demod
.posCount
== 0) { // first half of bit
648 } else { // second half of bit
651 /* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
652 if(Demod.thisBit > 0) {
653 Demod.metric += Demod.thisBit;
655 Demod.metric -= Demod.thisBit;
660 Demod
.shiftReg
>>= 1;
661 if(Demod
.thisBit
> 0) { // logic '1'
662 Demod
.shiftReg
|= 0x200;
666 if(Demod
.bitCount
== 10) {
667 uint16_t s
= Demod
.shiftReg
;
668 if((s
& 0x200) && !(s
& 0x001)) { // stop bit == '1', start bit == '0'
669 uint8_t b
= (s
>> 1);
670 Demod
.output
[Demod
.len
] = b
;
672 Demod
.state
= DEMOD_AWAITING_START_BIT
;
674 Demod
.state
= DEMOD_UNSYNCD
;
677 // This is EOF (start, stop and all data bits == '0'
687 Demod
.state
= DEMOD_UNSYNCD
;
695 static void DemodReset()
697 // Clear out the state of the "UART" that receives from the tag.
699 Demod
.state
= DEMOD_UNSYNCD
;
706 memset(Demod
.output
, 0x00, MAX_FRAME_SIZE
);
710 static void DemodInit(uint8_t *data
)
718 * Demodulate the samples we received from the tag, also log to tracebuffer
719 * quiet: set to 'TRUE' to disable debug output
721 static void GetSamplesFor14443bDemod(int n
, bool quiet
)
724 bool gotFrame
= FALSE
;
725 int lastRxCounter
, ci
, cq
, samples
= 0;
727 // Allocate memory from BigBuf for some buffers
728 // free all previous allocations first
731 // And put the FPGA in the appropriate mode
732 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
);
734 // The response (tag -> reader) that we're receiving.
735 // Set up the demodulator for tag -> reader responses.
736 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE
));
738 // The DMA buffer, used to stream samples from the FPGA
739 int8_t *dmaBuf
= (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE
);
741 // Setup and start DMA.
742 FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO14443B_DMA_BUFFER_SIZE
);
744 int8_t *upTo
= dmaBuf
;
745 lastRxCounter
= ISO14443B_DMA_BUFFER_SIZE
;
747 // Signal field is ON with the appropriate LED:
750 int behindBy
= lastRxCounter
- AT91C_BASE_PDC_SSC
->PDC_RCR
;
751 if(behindBy
> max
) max
= behindBy
;
753 while(((lastRxCounter
-AT91C_BASE_PDC_SSC
->PDC_RCR
) & (ISO14443B_DMA_BUFFER_SIZE
-1)) > 2) {
757 if(upTo
>= dmaBuf
+ ISO14443B_DMA_BUFFER_SIZE
) {
759 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) upTo
;
760 AT91C_BASE_PDC_SSC
->PDC_RNCR
= ISO14443B_DMA_BUFFER_SIZE
;
763 if(lastRxCounter
<= 0) {
764 lastRxCounter
= ISO14443B_DMA_BUFFER_SIZE
;
770 gotFrame
= Handle14443bSamplesDemod(ci
, cq
);
775 if(samples
> n
|| gotFrame
) {
780 AT91C_BASE_PDC_SSC
->PDC_PTCR
= AT91C_PDC_RXTDIS
;
782 if (!quiet
&& Demod
.len
== 0) {
783 Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d",
794 if (tracing
&& Demod
.len
> 0) {
795 uint8_t parity
[MAX_PARITY_SIZE
];
796 LogTrace(Demod
.output
, Demod
.len
, 0, 0, parity
, FALSE
);
801 //-----------------------------------------------------------------------------
802 // Transmit the command (to the tag) that was placed in ToSend[].
803 //-----------------------------------------------------------------------------
804 static void TransmitFor14443b(void)
810 while(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
811 AT91C_BASE_SSC
->SSC_THR
= 0xff;
814 // Signal field is ON with the appropriate Red LED
816 // Signal we are transmitting with the Green LED
818 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX
| FPGA_HF_READER_TX_SHALLOW_MOD
);
820 for(c
= 0; c
< 10;) {
821 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
822 AT91C_BASE_SSC
->SSC_THR
= 0xff;
825 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
826 volatile uint32_t r
= AT91C_BASE_SSC
->SSC_RHR
;
834 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
835 AT91C_BASE_SSC
->SSC_THR
= ToSend
[c
];
841 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
842 volatile uint32_t r
= AT91C_BASE_SSC
->SSC_RHR
;
847 LED_B_OFF(); // Finished sending
851 //-----------------------------------------------------------------------------
852 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
853 // so that it is ready to transmit to the tag using TransmitFor14443b().
854 //-----------------------------------------------------------------------------
855 static void CodeIso14443bAsReader(const uint8_t *cmd
, int len
)
862 // Establish initial reference level
863 for(i
= 0; i
< 40; i
++) {
867 for(i
= 0; i
< 11; i
++) {
871 for(i
= 0; i
< len
; i
++) {
879 for(j
= 0; j
< 8; j
++) {
890 for(i
= 0; i
< 11; i
++) {
893 for(i
= 0; i
< 8; i
++) {
897 // And then a little more, to make sure that the last character makes
898 // it out before we switch to rx mode.
899 for(i
= 0; i
< 10; i
++) {
903 // Convert from last character reference to length
909 Convenience function to encode, transmit and trace iso 14443b comms
911 static void CodeAndTransmit14443bAsReader(const uint8_t *cmd
, int len
)
913 CodeIso14443bAsReader(cmd
, len
);
916 uint8_t parity
[MAX_PARITY_SIZE
];
917 LogTrace(cmd
,len
, 0, 0, parity
, TRUE
);
921 /* Sends an APDU to the tag
922 * TODO: check CRC and preamble
924 int iso14443b_apdu(uint8_t const *message
, size_t message_length
, uint8_t *response
)
926 uint8_t message_frame
[message_length
+ 4];
928 message_frame
[0] = 0x0A | pcb_blocknum
;
931 message_frame
[1] = 0;
933 memcpy(message_frame
+ 2, message
, message_length
);
935 ComputeCrc14443(CRC_14443_B
, message_frame
, message_length
+ 2, &message_frame
[message_length
+ 2], &message_frame
[message_length
+ 3]);
937 CodeAndTransmit14443bAsReader(message_frame
, message_length
+ 4);
939 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT
*100, TRUE
);
945 // copy response contents
948 memcpy(response
, Demod
.output
, Demod
.len
);
953 /* Perform the ISO 14443 B Card Selection procedure
954 * Currently does NOT do any collision handling.
955 * It expects 0-1 cards in the device's range.
956 * TODO: Support multiple cards (perform anticollision)
957 * TODO: Verify CRC checksums
959 int iso14443b_select_card()
961 // WUPB command (including CRC)
962 // Note: WUPB wakes up all tags, REQB doesn't wake up tags in HALT state
963 static const uint8_t wupb
[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
964 // ATTRIB command (with space for CRC)
965 uint8_t attrib
[] = { 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00};
967 // first, wake up the tag
968 CodeAndTransmit14443bAsReader(wupb
, sizeof(wupb
));
969 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT
, TRUE
);
977 // copy the PUPI to ATTRIB
978 memcpy(attrib
+ 1, Demod
.output
+ 1, 4);
979 /* copy the protocol info from ATQB (Protocol Info -> Protocol_Type) into
981 attrib
[7] = Demod
.output
[10] & 0x0F;
982 ComputeCrc14443(CRC_14443_B
, attrib
, 9, attrib
+ 9, attrib
+ 10);
983 CodeAndTransmit14443bAsReader(attrib
, sizeof(attrib
));
984 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT
, TRUE
);
985 // Answer to ATTRIB too short?
990 // reset PCB block number
995 // Set up ISO 14443 Type B communication (similar to iso14443a_setup)
996 void iso14443b_setup() {
998 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1001 // Set up the synchronous serial port
1003 // connect Demodulated Signal to ADC:
1004 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1006 // Signal field is on with the appropriate LED
1008 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX
| FPGA_HF_READER_TX_SHALLOW_MOD
);
1013 //StartCountSspClk();
1019 //-----------------------------------------------------------------------------
1020 // Read a SRI512 ISO 14443B tag.
1022 // SRI512 tags are just simple memory tags, here we're looking at making a dump
1023 // of the contents of the memory. No anticollision algorithm is done, we assume
1024 // we have a single tag in the field.
1026 // I tried to be systematic and check every answer of the tag, every CRC, etc...
1027 //-----------------------------------------------------------------------------
1028 void ReadSTMemoryIso14443b(uint32_t dwLast
)
1030 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1038 // Make sure that we start from off, since the tags are stateful;
1039 // confusing things will happen if we don't reset them between reads.
1041 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1044 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1047 // Now give it time to spin up.
1048 // Signal field is on with the appropriate LED
1050 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
);
1053 // First command: wake up the tag using the INITIATE command
1054 uint8_t cmd1
[] = {0x06, 0x00, 0x97, 0x5b};
1055 CodeAndTransmit14443bAsReader(cmd1
, sizeof(cmd1
));
1056 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT
, TRUE
);
1058 if (Demod
.len
== 0) {
1059 DbpString("No response from tag");
1062 Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
1063 Demod
.output
[0], Demod
.output
[1], Demod
.output
[2]);
1066 // There is a response, SELECT the uid
1067 DbpString("Now SELECT tag:");
1068 cmd1
[0] = 0x0E; // 0x0E is SELECT
1069 cmd1
[1] = Demod
.output
[0];
1070 ComputeCrc14443(CRC_14443_B
, cmd1
, 2, &cmd1
[2], &cmd1
[3]);
1071 CodeAndTransmit14443bAsReader(cmd1
, sizeof(cmd1
));
1072 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT
, TRUE
);
1073 if (Demod
.len
!= 3) {
1074 Dbprintf("Expected 3 bytes from tag, got %d", Demod
.len
);
1077 // Check the CRC of the answer:
1078 ComputeCrc14443(CRC_14443_B
, Demod
.output
, 1 , &cmd1
[2], &cmd1
[3]);
1079 if(cmd1
[2] != Demod
.output
[1] || cmd1
[3] != Demod
.output
[2]) {
1080 DbpString("CRC Error reading select response.");
1083 // Check response from the tag: should be the same UID as the command we just sent:
1084 if (cmd1
[1] != Demod
.output
[0]) {
1085 Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1
[1], Demod
.output
[0]);
1089 // Tag is now selected,
1090 // First get the tag's UID:
1092 ComputeCrc14443(CRC_14443_B
, cmd1
, 1 , &cmd1
[1], &cmd1
[2]);
1093 CodeAndTransmit14443bAsReader(cmd1
, 3); // Only first three bytes for this one
1094 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT
, TRUE
);
1095 if (Demod
.len
!= 10) {
1096 Dbprintf("Expected 10 bytes from tag, got %d", Demod
.len
);
1099 // The check the CRC of the answer (use cmd1 as temporary variable):
1100 ComputeCrc14443(CRC_14443_B
, Demod
.output
, 8, &cmd1
[2], &cmd1
[3]);
1101 if(cmd1
[2] != Demod
.output
[8] || cmd1
[3] != Demod
.output
[9]) {
1102 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1103 (cmd1
[2]<<8)+cmd1
[3], (Demod
.output
[8]<<8)+Demod
.output
[9]);
1104 // Do not return;, let's go on... (we should retry, maybe ?)
1106 Dbprintf("Tag UID (64 bits): %08x %08x",
1107 (Demod
.output
[7]<<24) + (Demod
.output
[6]<<16) + (Demod
.output
[5]<<8) + Demod
.output
[4],
1108 (Demod
.output
[3]<<24) + (Demod
.output
[2]<<16) + (Demod
.output
[1]<<8) + Demod
.output
[0]);
1110 // Now loop to read all 16 blocks, address from 0 to last block
1111 Dbprintf("Tag memory dump, block 0 to %d", dwLast
);
1117 DbpString("System area block (0xff):");
1121 ComputeCrc14443(CRC_14443_B
, cmd1
, 2, &cmd1
[2], &cmd1
[3]);
1122 CodeAndTransmit14443bAsReader(cmd1
, sizeof(cmd1
));
1123 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT
, TRUE
);
1124 if (Demod
.len
!= 6) { // Check if we got an answer from the tag
1125 DbpString("Expected 6 bytes from tag, got less...");
1128 // The check the CRC of the answer (use cmd1 as temporary variable):
1129 ComputeCrc14443(CRC_14443_B
, Demod
.output
, 4, &cmd1
[2], &cmd1
[3]);
1130 if(cmd1
[2] != Demod
.output
[4] || cmd1
[3] != Demod
.output
[5]) {
1131 Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
1132 (cmd1
[2]<<8)+cmd1
[3], (Demod
.output
[4]<<8)+Demod
.output
[5]);
1133 // Do not return;, let's go on... (we should retry, maybe ?)
1135 // Now print out the memory location:
1136 Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i
,
1137 (Demod
.output
[3]<<24) + (Demod
.output
[2]<<16) + (Demod
.output
[1]<<8) + Demod
.output
[0],
1138 (Demod
.output
[4]<<8)+Demod
.output
[5]);
1147 //=============================================================================
1148 // Finally, the `sniffer' combines elements from both the reader and
1149 // simulated tag, to show both sides of the conversation.
1150 //=============================================================================
1152 //-----------------------------------------------------------------------------
1153 // Record the sequence of commands sent by the reader to the tag, with
1154 // triggering so that we start recording at the point that the tag is moved
1156 //-----------------------------------------------------------------------------
1158 * Memory usage for this function, (within BigBuf)
1159 * Last Received command (reader->tag) - MAX_FRAME_SIZE
1160 * Last Received command (tag->reader) - MAX_FRAME_SIZE
1161 * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
1162 * Demodulated samples received - all the rest
1164 void RAMFUNC
SnoopIso14443b(void)
1166 // We won't start recording the frames that we acquire until we trigger;
1167 // a good trigger condition to get started is probably when we see a
1168 // response from the tag.
1169 int triggered
= TRUE
; // TODO: set and evaluate trigger condition
1171 FpgaDownloadAndGo(FPGA_BITSTREAM_HF
);
1177 // The DMA buffer, used to stream samples from the FPGA
1178 int8_t *dmaBuf
= (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE
);
1182 int maxBehindBy
= 0;
1184 // Count of samples received so far, so that we can include timing
1185 // information in the trace buffer.
1188 DemodInit(BigBuf_malloc(MAX_FRAME_SIZE
));
1189 UartInit(BigBuf_malloc(MAX_FRAME_SIZE
));
1191 // Print some debug information about the buffer sizes
1192 Dbprintf("Snooping buffers initialized:");
1193 Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
1194 Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE
);
1195 Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE
);
1196 Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE
);
1198 // Signal field is off, no reader signal, no tag signal
1201 // And put the FPGA in the appropriate mode
1202 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
| FPGA_HF_READER_RX_XCORR_SNOOP
);
1203 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
1205 // Setup for the DMA.
1208 lastRxCounter
= ISO14443B_DMA_BUFFER_SIZE
;
1209 FpgaSetupSscDma((uint8_t*) dmaBuf
, ISO14443B_DMA_BUFFER_SIZE
);
1210 uint8_t parity
[MAX_PARITY_SIZE
];
1212 bool TagIsActive
= FALSE
;
1213 bool ReaderIsActive
= FALSE
;
1215 // And now we loop, receiving samples.
1217 int behindBy
= (lastRxCounter
- AT91C_BASE_PDC_SSC
->PDC_RCR
) &
1218 (ISO14443B_DMA_BUFFER_SIZE
-1);
1219 if(behindBy
> maxBehindBy
) {
1220 maxBehindBy
= behindBy
;
1223 if(behindBy
< 2) continue;
1229 if(upTo
>= dmaBuf
+ ISO14443B_DMA_BUFFER_SIZE
) {
1231 lastRxCounter
+= ISO14443B_DMA_BUFFER_SIZE
;
1232 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) dmaBuf
;
1233 AT91C_BASE_PDC_SSC
->PDC_RNCR
= ISO14443B_DMA_BUFFER_SIZE
;
1235 if(behindBy
> (9*ISO14443B_DMA_BUFFER_SIZE
/10)) { // TODO: understand whether we can increase/decrease as we want or not?
1236 Dbprintf("blew circular buffer! behindBy=%d", behindBy
);
1240 DbpString("Reached trace limit");
1243 if(BUTTON_PRESS()) {
1244 DbpString("cancelled");
1251 if (!TagIsActive
) { // no need to try decoding reader data if the tag is sending
1252 if(Handle14443bUartBit(ci
& 0x01)) {
1253 if(triggered
&& tracing
) {
1254 LogTrace(Uart
.output
, Uart
.byteCnt
, samples
, samples
, parity
, TRUE
);
1256 /* And ready to receive another command. */
1258 /* And also reset the demod code, which might have been */
1259 /* false-triggered by the commands from the reader. */
1262 if(Handle14443bUartBit(cq
& 0x01)) {
1263 if(triggered
&& tracing
) {
1264 LogTrace(Uart
.output
, Uart
.byteCnt
, samples
, samples
, parity
, TRUE
);
1266 /* And ready to receive another command. */
1268 /* And also reset the demod code, which might have been */
1269 /* false-triggered by the commands from the reader. */
1272 ReaderIsActive
= (Uart
.state
> STATE_GOT_FALLING_EDGE_OF_SOF
);
1275 if(!ReaderIsActive
) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
1276 // is this | 0x01 the error? & 0xfe in https://github.com/Proxmark/proxmark3/issues/103
1277 if(Handle14443bSamplesDemod(ci
| 0x01, cq
| 0x01)) {
1279 //Use samples as a time measurement
1282 //uint8_t parity[MAX_PARITY_SIZE];
1283 LogTrace(Demod
.output
, Demod
.len
, samples
, samples
, parity
, FALSE
);
1287 // And ready to receive another response.
1290 TagIsActive
= (Demod
.state
> DEMOD_GOT_FALLING_EDGE_OF_SOF
);
1295 FpgaDisableSscDma();
1297 AT91C_BASE_PDC_SSC
->PDC_PTCR
= AT91C_PDC_RXTDIS
;
1298 DbpString("Snoop statistics:");
1299 Dbprintf(" Max behind by: %i", maxBehindBy
);
1300 Dbprintf(" Uart State: %x", Uart
.state
);
1301 Dbprintf(" Uart ByteCnt: %i", Uart
.byteCnt
);
1302 Dbprintf(" Uart ByteCntMax: %i", Uart
.byteCntMax
);
1303 Dbprintf(" Trace length: %i", BigBuf_get_traceLen());
1308 * Send raw command to tag ISO14443B
1310 * datalen len of buffer data
1311 * recv bool when true wait for data from tag and send to client
1312 * powerfield bool leave the field on when true
1313 * data buffer with byte to send
1319 void SendRawCommand14443B(uint32_t datalen
, uint32_t recv
, uint8_t powerfield
, uint8_t data
[])
1323 if ( datalen
== 0 && recv
== 0 && powerfield
== 0){
1327 CodeAndTransmit14443bAsReader(data
, datalen
);
1331 GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT
, FALSE
);
1332 uint16_t iLen
= MIN(Demod
.len
, USB_CMD_DATA_SIZE
);
1333 cmd_send(CMD_ACK
, iLen
, 0, 0, Demod
.output
, iLen
);
1337 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1338 FpgaDisableSscDma();