deploy in msys2 and proxspace (#702)

[proxmark3-svn] / armsrc / iso15693.c

diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c
index 9a6ef9f01220a5d52fe441b7e16ae82e70affcb7..9b0ab29ecf4e93a43f9080a83bcc97047e8563f9 100644 (file)
--- a/armsrc/iso15693.c
+++ b/armsrc/iso15693.c
@@ -67,6 +67,8 @@
 
 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
 
 
 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
 

+static int DEBUG = 0;
+

 ///////////////////////////////////////////////////////////////////////
 // ISO 15693 Part 2 - Air Interface
 // This section basicly contains transmission and receiving of bits
 ///////////////////////////////////////////////////////////////////////
 // ISO 15693 Part 2 - Air Interface
 // This section basicly contains transmission and receiving of bits


@@ -81,8 +83,11 @@
 #define AddCrc(data,datalen)  Iso15693AddCrc(data,datalen)
 #define sprintUID(target,uid)  Iso15693sprintUID(target,uid)
 
 #define AddCrc(data,datalen)  Iso15693AddCrc(data,datalen)
 #define sprintUID(target,uid)  Iso15693sprintUID(target,uid)
 

-int DEBUG=0;
+// approximate amplitude=sqrt(ci^2+cq^2) 
+#define AMPLITUDE(ci, cq) (MAX(ABS(ci), ABS(cq)) + MIN(ABS(ci), ABS(cq))/2)

 
 

+// DMA buffer
+#define ISO15693_DMA_BUFFER_SIZE 128

 
 // ---------------------------
 // Signal Processing 
 
 // ---------------------------
 // Signal Processing 


@@ -165,13 +170,15 @@ static void CodeIso15693AsReader(uint8_t *cmd, int n)
        ToSendStuffBit(0);
        ToSendStuffBit(1);
 
        ToSendStuffBit(0);
        ToSendStuffBit(1);
 

-       // And slack at the end, too.
-       for(i = 0; i < 24; i++) {
+       // Fill remainder of last byte with 1
+       for(i = 0; i < 4; i++) {

                ToSendStuffBit(1);
        }
                ToSendStuffBit(1);
        }

+       
+       ToSendMax++;

 }
 
 }
 

-// encode data using "1 out of 256" sheme
+// encode data using "1 out of 256" scheme

 // data rate is 1,66 kbit/s (fc/8192) 
 // is designed for more robust communication over longer distances
 static void CodeIso15693AsReader256(uint8_t *cmd, int n)
 // data rate is 1,66 kbit/s (fc/8192) 
 // is designed for more robust communication over longer distances
 static void CodeIso15693AsReader256(uint8_t *cmd, int n)


@@ -219,258 +226,349 @@ static void CodeIso15693AsReader256(uint8_t *cmd, int n)
 }
 
 
 }
 
 

-// Transmit the command (to the tag) that was placed in ToSend[].
-static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
+// Transmit the command (to the tag) that was placed in cmd[].
+static void TransmitTo15693Tag(const uint8_t *cmd, int len)

 {
 {

-    int c;
-
-//    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);

        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);

-       if(*wait < 10) { *wait = 10; }
-
-//    for(c = 0; c < *wait;) {
-//        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-//            AT91C_BASE_SSC->SSC_THR = 0x00;          // For exact timing!
-//            c++;
-//        }
-//        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-//            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
-//            (void)r;
-//        }
-//        WDT_HIT();
-//    }
-
-    c = 0;
-    for(;;) {
+
+       LED_B_ON();
+    for(int c = 0; c < len; ) {

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

-            AT91C_BASE_SSC->SSC_THR = cmd[c];
+            AT91C_BASE_SSC->SSC_THR = ~cmd[c];

             c++;
             c++;

-            if(c >= len) {
-                break;
-            }
-        }
-        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
-            (void)r;

         }
         WDT_HIT();
     }
         }
         WDT_HIT();
     }

-       *samples = (c + *wait) << 3;
+       LED_B_OFF();

 }
 
 //-----------------------------------------------------------------------------
 }
 
 //-----------------------------------------------------------------------------

-// Transmit the command (to the reader) that was placed in ToSend[].
+// Transmit the command (to the reader) that was placed in cmd[].

 //-----------------------------------------------------------------------------
 //-----------------------------------------------------------------------------

-static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
+static void TransmitTo15693Reader(const uint8_t *cmd, int len)

 {
 {

-    int c = 0;
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
-       if(*wait < 10) { *wait = 10; }
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_424K);

 
 

-    for(;;) {
+       LED_C_ON();
+    for(int c = 0; c < len; ) {

         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
             AT91C_BASE_SSC->SSC_THR = cmd[c];
             c++;
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
             AT91C_BASE_SSC->SSC_THR = cmd[c];
             c++;

-            if(c >= len) {
-                break;
-            }
-        }
-        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
-            (void)r;

         }
         WDT_HIT();
     }
         }
         WDT_HIT();
     }

-       *samples = (c + *wait) << 3;
+       LED_C_OFF();

 }
 
 
 }
 
 

-// Read from Tag
-// Parameters:
-//             receivedResponse
-//             maxLen
-//             samples
-//             elapsed
-// returns: 
-//             number of decoded bytes
-static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
+//=============================================================================
+// An ISO 15693 demodulator (one subcarrier only). Uses cross correlation to 
+// identify the SOF, each bit, and EOF.
+// This function is called 8 times per bit (every 2 subcarrier cycles).
+// Subcarrier frequency fs is 424kHz, 1/fs = 2,36us, 
+// i.e. function is called every 4,72us
+// LED handling:
+//    LED C -> ON once we have received the SOF and are expecting the rest.
+//    LED C -> OFF once we have received EOF or are unsynced
+//
+// Returns: true if we received a EOF
+//          false if we are still waiting for some more
+//=============================================================================
+
+#define SUBCARRIER_DETECT_THRESHOLD    2
+#define SOF_CORRELATOR_LEN (1<<5)
+
+typedef struct Demod {
+       enum {
+               DEMOD_UNSYNCD,
+               DEMOD_AWAIT_SOF_1,
+               DEMOD_AWAIT_SOF_2,
+               DEMOD_RECEIVING_DATA,
+               DEMOD_AWAIT_EOF
+       }         state;
+       int       bitCount;
+       int       posCount;
+       enum {
+               LOGIC0,
+               LOGIC1,
+               SOF_PART1,
+               SOF_PART2
+       }         lastBit;
+       uint16_t  shiftReg;
+       uint8_t   *output;
+       int       len;
+       int       sum1, sum2;
+       uint8_t   SOF_low;
+       uint8_t   SOF_high;
+       uint8_t   SOF_last;
+       int32_t   SOF_corr;
+       int32_t   SOF_corr_prev;
+       uint8_t   SOF_correlator[SOF_CORRELATOR_LEN];
+} Demod_t;
+
+static RAMFUNC int Handle15693SamplesDemod(int8_t ci, int8_t cq, Demod_t *Demod)

 {
 {

-       int c = 0;
-       uint8_t *dest = BigBuf_get_addr();
-       int getNext = 0;
-
-       int8_t prev = 0;
+       switch(Demod->state) {
+               case DEMOD_UNSYNCD:
+                       // initialize SOF correlator. We are looking for 12 samples low and 12 samples high.
+                       Demod->SOF_low = 0;
+                       Demod->SOF_high = 12;
+                       Demod->SOF_last = 23;
+                       memset(Demod->SOF_correlator, 0x00, Demod->SOF_last + 1);
+                       Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
+                       Demod->SOF_corr = Demod->SOF_correlator[Demod->SOF_last];
+                       Demod->SOF_corr_prev = Demod->SOF_corr;
+                       // initialize Demodulator
+                       Demod->posCount = 0;
+                       Demod->bitCount = 0;
+                       Demod->len = 0;
+                       Demod->state = DEMOD_AWAIT_SOF_1;
+                       break;
+                       
+               case DEMOD_AWAIT_SOF_1:
+                       // calculate the correlation in real time. Look at differences only.
+                       Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_low++];
+                       Demod->SOF_corr -= 2*Demod->SOF_correlator[Demod->SOF_high++];
+                       Demod->SOF_last++;
+                       Demod->SOF_low &= (SOF_CORRELATOR_LEN-1);
+                       Demod->SOF_high &= (SOF_CORRELATOR_LEN-1);
+                       Demod->SOF_last &= (SOF_CORRELATOR_LEN-1);
+                       Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
+                       Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_last];
+
+                       // if correlation increases for 10 consecutive samples, we are close to maximum correlation
+                       if (Demod->SOF_corr > Demod->SOF_corr_prev + SUBCARRIER_DETECT_THRESHOLD) {
+                               Demod->posCount++;
+                       } else {
+                               Demod->posCount = 0;
+                       }

 
 

-// NOW READ RESPONSE
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
-       //spindelay(60);        // greg - experiment to get rid of some of the 0 byte/failed reads
-       c = 0;
-       getNext = FALSE;
-       for(;;) {
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-                       AT91C_BASE_SSC->SSC_THR = 0x43;
-               }
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-                       int8_t b;
-                       b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
+                       if (Demod->posCount == 10) {    // correlation increased 10 times
+                               Demod->state = DEMOD_AWAIT_SOF_2;
+                       }
+                               
+                       Demod->SOF_corr_prev = Demod->SOF_corr;
+                               
+                       break;
+
+               case DEMOD_AWAIT_SOF_2:
+                       // calculate the correlation in real time. Look at differences only.
+                       Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_low++];
+                       Demod->SOF_corr -= 2*Demod->SOF_correlator[Demod->SOF_high++];
+                       Demod->SOF_last++;
+                       Demod->SOF_low &= (SOF_CORRELATOR_LEN-1);
+                       Demod->SOF_high &= (SOF_CORRELATOR_LEN-1);
+                       Demod->SOF_last &= (SOF_CORRELATOR_LEN-1);
+                       Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
+                       Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_last];
+
+                       if (Demod->SOF_corr >= Demod->SOF_corr_prev) { // we are looking for the maximum correlation
+                               Demod->SOF_corr_prev = Demod->SOF_corr;
+                       } else {
+                               Demod->lastBit = SOF_PART1;  // detected 1st part of SOF
+                               Demod->sum1 = Demod->SOF_correlator[Demod->SOF_last];
+                               Demod->sum2 = 0;
+                               Demod->posCount = 2;
+                               Demod->state = DEMOD_RECEIVING_DATA;
+                               LED_C_ON();
+                       }
+                       
+                       break;

 
 

-                       // The samples are correlations against I and Q versions of the
-                       // tone that the tag AM-modulates, so every other sample is I,
-                       // every other is Q. We just want power, so abs(I) + abs(Q) is
-                       // close to what we want.
-                       if(getNext) {
-                               int8_t r = ABS(b) + ABS(prev);
+               case DEMOD_RECEIVING_DATA:
+                       if (Demod->posCount == 1) {
+                               Demod->sum1 = 0;
+                               Demod->sum2 = 0;
+                       }

 
 

-                               dest[c++] = (uint8_t)r;
+                       if (Demod->posCount <= 4) {
+                               Demod->sum1 += AMPLITUDE(ci, cq);
+                       } else {
+                               Demod->sum2 += AMPLITUDE(ci, cq);
+                       }

 
 

-                               if(c >= 2000) {
-                                       break;
+                       if (Demod->posCount == 8) {
+                               int16_t corr_1 = (Demod->sum2 - Demod->sum1) / 4;
+                               int16_t corr_0 = (Demod->sum1 - Demod->sum2) / 4;
+                               int16_t corr_EOF = (Demod->sum1 + Demod->sum2) / 8;
+                               if (corr_EOF > corr_0 && corr_EOF > corr_1) {
+                                       Demod->state = DEMOD_AWAIT_EOF;
+                               } else if (corr_1 > corr_0) {
+                                       // logic 1
+                                       if (Demod->lastBit == SOF_PART1) { // still part of SOF
+                                               Demod->lastBit = SOF_PART2;
+                                       } else {
+                                               Demod->lastBit = LOGIC1;
+                                               Demod->shiftReg >>= 1;
+                                               Demod->shiftReg |= 0x80;
+                                               Demod->bitCount++;
+                                               if (Demod->bitCount == 8) {
+                                                       Demod->output[Demod->len] = Demod->shiftReg;
+                                                       Demod->len++;
+                                                       Demod->bitCount = 0;
+                                                       Demod->shiftReg = 0;
+                                               }
+                                       }
+                               } else {
+                                       // logic 0
+                                       if (Demod->lastBit == SOF_PART1) { // incomplete SOF
+                                               Demod->state = DEMOD_UNSYNCD;
+                                               LED_C_OFF();
+                                       } else {
+                                               Demod->lastBit = LOGIC0;
+                                               Demod->shiftReg >>= 1;
+                                               Demod->bitCount++;
+                                               if (Demod->bitCount == 8) {
+                                                       Demod->output[Demod->len] = Demod->shiftReg;
+                                                       Demod->len++;
+                                                       Demod->bitCount = 0;
+                                                       Demod->shiftReg = 0;
+                                               }
+                                       }

                                }
                                }

+                               Demod->posCount = 0;
+                       }
+                       Demod->posCount++;
+                       break;
+               
+               case DEMOD_AWAIT_EOF:
+                       if (Demod->lastBit == LOGIC0) {  // this was already part of EOF 
+                               LED_C_OFF();
+                               return true;

                        } else {
                        } else {

-                               prev = b;
+                               Demod->state = DEMOD_UNSYNCD;
+                               LED_C_OFF();

                        }
                        }

+                       break;

 
 

-                       getNext = !getNext;
-               }
+               default:
+                       Demod->state = DEMOD_UNSYNCD;
+                       LED_C_OFF();
+                       break;

        }
 
        }
 

-       //////////////////////////////////////////
-       /////////// DEMODULATE ///////////////////
-       //////////////////////////////////////////
-
-       int i, j;
-       int max = 0, maxPos=0;
+       return false;
+}

 
 

-       int skip = 4;

 
 

-       //      if(GraphTraceLen < 1000) return;        // THIS CHECKS FOR A BUFFER TO SMALL
+static void DemodInit(Demod_t* Demod, uint8_t* data)
+{
+       Demod->output = data;
+       Demod->state = DEMOD_UNSYNCD;
+}

 
 

-       // First, correlate for SOF
-       for(i = 0; i < 100; i++) {
-               int corr = 0;
-               for(j = 0; j < arraylen(FrameSOF); j += skip) {
-                       corr += FrameSOF[j]*dest[i+(j/skip)];
-               }
-               if(corr > max) {
-                       max = corr;
-                       maxPos = i;
-               }
-       }
-       //      DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));

 
 

-       int k = 0; // this will be our return value
+/*
+ *  Demodulate the samples we received from the tag, also log to tracebuffer
+ */
+static int GetIso15693AnswerFromTag(uint8_t* response, int timeout)
+{
+       int maxBehindBy = 0;
+       int lastRxCounter, samples = 0;
+       int8_t ci, cq;
+       bool gotFrame = false;
+       
+       // Allocate memory from BigBuf for some buffers
+       // free all previous allocations first
+       BigBuf_free();

 
 

-       // greg - If correlation is less than 1 then there's little point in continuing
-       if ((max/(arraylen(FrameSOF)/skip)) >= 1)
-       {
+       // The DMA buffer, used to stream samples from the FPGA
+       uint16_t* dmaBuf = (uint16_t*) BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE * sizeof(uint16_t));

 
 

-               i = maxPos + arraylen(FrameSOF)/skip;
+       // the Demodulatur data structure
+       Demod_t* Demod = (Demod_t*) BigBuf_malloc(sizeof(Demod_t));

        
        

-               uint8_t outBuf[20];
-               memset(outBuf, 0, sizeof(outBuf));
-               uint8_t mask = 0x01;
-               for(;;) {
-                       int corr0 = 0, corr1 = 0, corrEOF = 0;
-                       for(j = 0; j < arraylen(Logic0); j += skip) {
-                               corr0 += Logic0[j]*dest[i+(j/skip)];
-                       }
-                       for(j = 0; j < arraylen(Logic1); j += skip) {
-                               corr1 += Logic1[j]*dest[i+(j/skip)];
-                       }
-                       for(j = 0; j < arraylen(FrameEOF); j += skip) {
-                               corrEOF += FrameEOF[j]*dest[i+(j/skip)];
-                       }
-                       // Even things out by the length of the target waveform.
-                       corr0 *= 4;
-                       corr1 *= 4;
-       
-                       if(corrEOF > corr1 && corrEOF > corr0) {
-       //                      DbpString("EOF at %d", i);
-                               break;
-                       } else if(corr1 > corr0) {
-                               i += arraylen(Logic1)/skip;
-                               outBuf[k] |= mask;
-                       } else {
-                               i += arraylen(Logic0)/skip;
-                       }
-                       mask <<= 1;
-                       if(mask == 0) {
-                               k++;
-                               mask = 0x01;
-                       }
-                       if((i+(int)arraylen(FrameEOF)) >= 2000) {
-                               DbpString("ran off end!");
-                               break;
-                       }
+       // Set up the demodulator for tag -> reader responses.
+       DemodInit(Demod, response);
+
+       // wait for last transfer to complete
+       while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));
+
+       // And put the FPGA in the appropriate mode
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
+
+       // Setup and start DMA.
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
+       FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);
+
+       uint16_t *upTo = dmaBuf;
+       lastRxCounter = ISO15693_DMA_BUFFER_SIZE;
+
+       for(;;) {
+               int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO15693_DMA_BUFFER_SIZE-1);
+               if(behindBy > maxBehindBy) {
+                       maxBehindBy = behindBy;

                }
                }

-               if(mask != 0x01) { // this happens, when we miss the EOF
-                       // TODO: for some reason this happens quite often
-                       if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
-                       if (mask<0x08) k--; // discard the last uneven octet;
-                       // 0x08 is an assumption - but works quite often
+
+               if (behindBy < 1) continue;
+               
+               ci = (int8_t)(*upTo >> 8);
+               cq = (int8_t)(*upTo & 0xff);
+
+               upTo++;
+               lastRxCounter--;
+               if(upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) {                // we have read all of the DMA buffer content.
+                       upTo = dmaBuf;                                             // start reading the circular buffer from the beginning
+                       lastRxCounter += ISO15693_DMA_BUFFER_SIZE;

                }
                }

-       //      uint8_t str1 [8];
-       //      itoa(k,str1);
-       //      strncat(str1," octets read",8);
-       
-       //      DbpString(  str1);    // DbpString("%d octets", k);
-       
-       //      for(i = 0; i < k; i+=3) {
-       //              //DbpString("# %2d: %02x ", i, outBuf[i]);
-       //              DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
-       //      }
-       
-               for(i = 0; i < k; i++) {
-                       receivedResponse[i] = outBuf[i];
+               if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.
+                       AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and
+                       AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE;   // DMA Next Counter registers

                }
                }

-       } // "end if correlation > 0"   (max/(arraylen(FrameSOF)/skip))
-       return k; // return the number of bytes demodulated
+               samples++;

 
 

-///    DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
+               if (Handle15693SamplesDemod(ci, cq, Demod)) {
+                       gotFrame = true;
+                       break;
+               }
+
+               if(samples > timeout && Demod->state < DEMOD_RECEIVING_DATA) {
+                       Demod->len = 0;
+                       break;
+               }
+       }
+
+       FpgaDisableSscDma();

 
 

+       if (DEBUG) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.state = %d, Demod.len = %d, Demod.bitCount = %d, Demod.posCount = %d", 
+                           maxBehindBy, samples, gotFrame, Demod->state, Demod->len, Demod->bitCount, Demod->posCount);
+
+       if (tracing && Demod->len > 0) {
+               uint8_t parity[MAX_PARITY_SIZE];
+               LogTrace(Demod->output, Demod->len, 0, 0, parity, false);
+       }
+
+       return Demod->len;

 }
 
 
 // Now the GetISO15693 message from sniffing command
 }
 
 
 // Now the GetISO15693 message from sniffing command

+// TODO: fix it. This cannot work for several reasons: 
+//   1. Carrier is switched on during sniffing?
+//   2. We most probable miss the next reader command when demodulating

 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 {
 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 {

-       int c = 0;

        uint8_t *dest = BigBuf_get_addr();
        uint8_t *dest = BigBuf_get_addr();

-       int getNext = 0;
-
-       int8_t prev = 0;

 
 // NOW READ RESPONSE
 
 // NOW READ RESPONSE

+       LED_D_ON();

        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
        //spindelay(60);        // greg - experiment to get rid of some of the 0 byte/failed reads
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
        //spindelay(60);        // greg - experiment to get rid of some of the 0 byte/failed reads

-       c = 0;
-       getNext = FALSE;
-       for(;;) {
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-                       AT91C_BASE_SSC->SSC_THR = 0x43;
-               }
+       for(int c = 0; c < BIGBUF_SIZE; ) {

                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

-                       int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
-
+                       uint16_t iq = AT91C_BASE_SSC->SSC_RHR;

                        // The samples are correlations against I and Q versions of the
                        // The samples are correlations against I and Q versions of the

-                       // tone that the tag AM-modulates, so every other sample is I,
-                       // every other is Q. We just want power, so abs(I) + abs(Q) is
-                       // close to what we want.
-                       if(getNext) {
-                               int8_t r = ABS(b) + ABS(prev);
-
-                               dest[c++] = (uint8_t)r;
-
-                               if(c >= 20000) {
-                                       break;
-                               }
-                       } else {
-                               prev = b;
-                       }
-
-                       getNext = !getNext;
+                       // tone that the tag AM-modulates. We just want power, 
+                       // so abs(I) + abs(Q) is close to what we want.
+                       int8_t i = (int8_t)(iq >> 8);
+                       int8_t q = (int8_t)(iq & 0xff);
+                       uint8_t r = AMPLITUDE(i, q);
+                       dest[c++] = r;

                }
        }
                }
        }

+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       LED_D_OFF();

 
        //////////////////////////////////////////
        /////////// DEMODULATE ///////////////////
 
        //////////////////////////////////////////
        /////////// DEMODULATE ///////////////////


@@ -479,12 +577,10 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
        int i, j;
        int max = 0, maxPos=0;
 
        int i, j;
        int max = 0, maxPos=0;
 

-       int skip = 4;
-
-//     if(GraphTraceLen < 1000) return;        // THIS CHECKS FOR A BUFFER TO SMALL
+       int skip = 2;

 
        // First, correlate for SOF
 
        // First, correlate for SOF

-       for(i = 0; i < 19000; i++) {
+       for(i = 0; i < 38000; i++) {

                int corr = 0;
                for(j = 0; j < arraylen(FrameSOF); j += skip) {
                        corr += FrameSOF[j]*dest[i+(j/skip)];
                int corr = 0;
                for(j = 0; j < arraylen(FrameSOF); j += skip) {
                        corr += FrameSOF[j]*dest[i+(j/skip)];


@@ -494,7 +590,8 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
                        maxPos = i;
                }
        }
                        maxPos = i;
                }
        }

-//     DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
+
+       if (DEBUG) Dbprintf("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));

 
        int k = 0; // this will be our return value
 
 
        int k = 0; // this will be our return value
 


@@ -508,10 +605,15 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
                memset(outBuf, 0, sizeof(outBuf));
                uint8_t mask = 0x01;
                for(;;) {
                memset(outBuf, 0, sizeof(outBuf));
                uint8_t mask = 0x01;
                for(;;) {

-                       int corr0 = 0, corr1 = 0, corrEOF = 0;
+                       int corr0 = 0, corr00 = 0, corr01 = 0, corr1 = 0, corrEOF = 0;

                        for(j = 0; j < arraylen(Logic0); j += skip) {
                                corr0 += Logic0[j]*dest[i+(j/skip)];
                        }
                        for(j = 0; j < arraylen(Logic0); j += skip) {
                                corr0 += Logic0[j]*dest[i+(j/skip)];
                        }

+                       corr01 = corr00 = corr0;
+                       for(j = 0; j < arraylen(Logic0); j += skip) {
+                               corr00 += Logic0[j]*dest[i+arraylen(Logic0)/skip+(j/skip)];
+                               corr01 += Logic1[j]*dest[i+arraylen(Logic0)/skip+(j/skip)];
+                       }

                        for(j = 0; j < arraylen(Logic1); j += skip) {
                                corr1 += Logic1[j]*dest[i+(j/skip)];
                        }
                        for(j = 0; j < arraylen(Logic1); j += skip) {
                                corr1 += Logic1[j]*dest[i+(j/skip)];
                        }


@@ -519,11 +621,14 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
                                corrEOF += FrameEOF[j]*dest[i+(j/skip)];
                        }
                        // Even things out by the length of the target waveform.
                                corrEOF += FrameEOF[j]*dest[i+(j/skip)];
                        }
                        // Even things out by the length of the target waveform.

+                       corr00 *= 2;
+                       corr01 *= 2;

                        corr0 *= 4;
                        corr1 *= 4;
        
                        corr0 *= 4;
                        corr1 *= 4;
        

-                       if(corrEOF > corr1 && corrEOF > corr0) {
-       //                      DbpString("EOF at %d", i);
+                       if(corrEOF > corr1 && corrEOF > corr00 && corrEOF > corr01) {
+                               if (DEBUG) Dbprintf("EOF at %d, correlation %d (corr01: %d, corr00: %d, corr1: %d, corr0: %d)", 
+                                        i, corrEOF, corr01, corr00, corr1, corr0);

                                break;
                        } else if(corr1 > corr0) {
                                i += arraylen(Logic1)/skip;
                                break;
                        } else if(corr1 > corr0) {
                                i += arraylen(Logic1)/skip;


@@ -536,7 +641,7 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
                                k++;
                                mask = 0x01;
                        }
                                k++;
                                mask = 0x01;
                        }

-                       if((i+(int)arraylen(FrameEOF)) >= 2000) {
+                       if((i+(int)arraylen(FrameEOF)/skip) >= BIGBUF_SIZE) {

                                DbpString("ran off end!");
                                break;
                        }
                                DbpString("ran off end!");
                                break;
                        }


@@ -574,163 +679,129 @@ static void BuildIdentifyRequest(void);
 //-----------------------------------------------------------------------------
 void AcquireRawAdcSamplesIso15693(void)
 {
 //-----------------------------------------------------------------------------
 void AcquireRawAdcSamplesIso15693(void)
 {

+       LEDsoff();
+       LED_A_ON();
+       

        uint8_t *dest = BigBuf_get_addr();
 
        uint8_t *dest = BigBuf_get_addr();
 

-       int c = 0;
-       int getNext = 0;
-       int8_t prev = 0;
-

        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
        BuildIdentifyRequest();
 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
        // Give the tags time to energize
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
        BuildIdentifyRequest();
 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
        // Give the tags time to energize

+       LED_D_ON();

        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
        SpinDelay(100);
 
        // Now send the command
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
        SpinDelay(100);
 
        // Now send the command

-       FpgaSetupSsc();
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);

        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 

-       c = 0;
-       for(;;) {
+       LED_B_ON();
+       for(int c = 0; c < ToSendMax; ) {

                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {

-                       AT91C_BASE_SSC->SSC_THR = ToSend[c];
+                       AT91C_BASE_SSC->SSC_THR = ~ToSend[c];

                        c++;
                        c++;

-                       if(c == ToSendMax+3) {
-                               break;
-                       }
-               }
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-                       volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
-                       (void)r;

                }
                WDT_HIT();
        }
                }
                WDT_HIT();
        }

+       LED_B_OFF();
+
+       // wait for last transfer to complete
+       while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));

 
 

+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);

        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 

-       c = 0;
-       getNext = FALSE;
-       for(;;) {
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-                       AT91C_BASE_SSC->SSC_THR = 0x43;
-               }
+       for(int c = 0; c < 4000; ) {

                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

-                       int8_t b;
-                       b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
-
+                       uint16_t iq = AT91C_BASE_SSC->SSC_RHR;

                        // The samples are correlations against I and Q versions of the
                        // The samples are correlations against I and Q versions of the

-                       // tone that the tag AM-modulates, so every other sample is I,
-                       // every other is Q. We just want power, so abs(I) + abs(Q) is
-                       // close to what we want.
-                       if(getNext) {
-                               int8_t r = ABS(b) + ABS(prev);
-
-                               dest[c++] = (uint8_t)r;
-
-                               if(c >= 2000) {
-                                       break;
-                               }
-                       } else {
-                               prev = b;
-                       }
-
-                       getNext = !getNext;
+                       // tone that the tag AM-modulates. We just want power, 
+                       // so abs(I) + abs(Q) is close to what we want.
+                       int8_t i = (int8_t)(iq >> 8);
+                       int8_t q = (int8_t)(iq & 0xff);
+                       uint8_t r = AMPLITUDE(i, q);
+                       dest[c++] = r;

                }
        }
                }
        }

+
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       LEDsoff();

 }
 
 
 }
 
 

+// TODO: there is no trigger condition. The 14000 samples represent a time frame of 66ms. 
+// It is unlikely that we get something meaningful.
+// TODO: Currently we only record tag answers. Add tracing of reader commands.
+// TODO: would we get something at all? The carrier is switched on...

 void RecordRawAdcSamplesIso15693(void)
 {
 void RecordRawAdcSamplesIso15693(void)
 {

+       LEDsoff();
+       LED_A_ON();
+       

        uint8_t *dest = BigBuf_get_addr();
 
        uint8_t *dest = BigBuf_get_addr();
 

-       int c = 0;
-       int getNext = 0;
-       int8_t prev = 0;
-

        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
        // Setup SSC
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
        // Setup SSC

-       FpgaSetupSsc();
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);

 
        // Start from off (no field generated)
 
        // Start from off (no field generated)

-       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-       SpinDelay(200);
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       SpinDelay(200);

 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
        SpinDelay(100);
 
 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
        SpinDelay(100);
 

+       LED_D_ON();

        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 

-       c = 0;
-       getNext = FALSE;
-       for(;;) {
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-                       AT91C_BASE_SSC->SSC_THR = 0x43;
-               }
+       for(int c = 0; c < 14000;) {

                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {

-                       int8_t b;
-                       b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
-
+                       uint16_t iq = AT91C_BASE_SSC->SSC_RHR;

                        // The samples are correlations against I and Q versions of the
                        // The samples are correlations against I and Q versions of the

-                       // tone that the tag AM-modulates, so every other sample is I,
-                       // every other is Q. We just want power, so abs(I) + abs(Q) is
-                       // close to what we want.
-                       if(getNext) {
-                               int8_t r = ABS(b) + ABS(prev);
-
-                               dest[c++] = (uint8_t)r;
-
-                               if(c >= 7000) {
-                                       break;
-                               }
-                       } else {
-                               prev = b;
-                       }
-
-                       getNext = !getNext;
-                       WDT_HIT();
+                       // tone that the tag AM-modulates. We just want power, 
+                       // so abs(I) + abs(Q) is close to what we want.
+                       int8_t i = (int8_t)(iq >> 8);
+                       int8_t q = (int8_t)(iq & 0xff);
+                       uint8_t r = AMPLITUDE(i, q);
+                       dest[c++] = r;

                }
        }
                }
        }

-       Dbprintf("fin record");
+
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       LED_D_OFF();
+       Dbprintf("finished recording");
+       LED_A_OFF();

 }
 
 
 // Initialize the proxmark as iso15k reader 
 // (this might produces glitches that confuse some tags
 }
 
 
 // Initialize the proxmark as iso15k reader 
 // (this might produces glitches that confuse some tags

-void Iso15693InitReader() {
-       LED_A_ON();
-       LED_B_ON();
-       LED_C_OFF();
-       LED_D_OFF();
-       
+static void Iso15693InitReader() {

        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
        // Setup SSC
        // FpgaSetupSsc();
 
        // Start from off (no field generated)
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
        // Setup SSC
        // FpgaSetupSsc();
 
        // Start from off (no field generated)

+       LED_D_OFF();

        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        SpinDelay(10);
 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        SpinDelay(10);
 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

-       FpgaSetupSsc();
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);

 
        // Give the tags time to energize
 
        // Give the tags time to energize

+       LED_D_ON();

        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
        SpinDelay(250);
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
        SpinDelay(250);

-
-       LED_A_ON();
-       LED_B_OFF();
-       LED_C_OFF();
-       LED_D_OFF();

 }
 
 ///////////////////////////////////////////////////////////////////////
 // ISO 15693 Part 3 - Air Interface
 }
 
 ///////////////////////////////////////////////////////////////////////
 // ISO 15693 Part 3 - Air Interface

-// This section basicly contains transmission and receiving of bits
+// This section basically contains transmission and receiving of bits

 ///////////////////////////////////////////////////////////////////////
 
 // Encode (into the ToSend buffers) an identify request, which is the first
 ///////////////////////////////////////////////////////////////////////
 
 // Encode (into the ToSend buffers) an identify request, which is the first


@@ -787,8 +858,9 @@ static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
        CodeIso15693AsReader(cmd, sizeof(cmd));
 }
 
        CodeIso15693AsReader(cmd, sizeof(cmd));
 }
 

+

 // Now the VICC>VCD responses when we are simulating a tag
 // Now the VICC>VCD responses when we are simulating a tag

- static void BuildInventoryResponse( uint8_t *uid)
+static void BuildInventoryResponse( uint8_t *uid)

 {
        uint8_t cmd[12];
 
 {
        uint8_t cmd[12];
 


@@ -821,22 +893,16 @@ static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
 //     **recv will return you a pointer to the received data
 //     If you do not need the answer use NULL for *recv[] 
 //     return: lenght of received data
 //     **recv will return you a pointer to the received data
 //     If you do not need the answer use NULL for *recv[] 
 //     return: lenght of received data

-int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) {
+int SendDataTag(uint8_t *send, int sendlen, bool init, int speed, uint8_t **recv) {

 
 

-       int samples = 0;
-       int tsamples = 0;
-       int wait = 0;
-       int elapsed = 0;
-       

        LED_A_ON();
        LED_A_ON();

-       LED_B_ON();
+       LED_B_OFF();

        LED_C_OFF();
        LED_C_OFF();

-       LED_D_OFF();

        
        if (init) Iso15693InitReader();
 
        int answerLen=0;
        
        if (init) Iso15693InitReader();
 
        int answerLen=0;

-       uint8_t *answer = BigBuf_get_addr() + 3660;
+       uint8_t *answer = BigBuf_get_addr() + 4000;

        if (recv != NULL) memset(answer, 0, 100);
 
        if (!speed) {
        if (recv != NULL) memset(answer, 0, 100);
 
        if (!speed) {


@@ -847,22 +913,14 @@ int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv)
                CodeIso15693AsReader(send, sendlen);
        }
        
                CodeIso15693AsReader(send, sendlen);
        }
        

-       LED_A_ON();
-       LED_B_OFF();
-       
-       TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);  
+       TransmitTo15693Tag(ToSend,ToSendMax);   

        // Now wait for a response
        if (recv!=NULL) {
        // Now wait for a response
        if (recv!=NULL) {

-               LED_A_OFF();
-               LED_B_ON();
-               answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ; 
+               answerLen = GetIso15693AnswerFromTag(answer, 100);      

                *recv=answer;
        }
 
        LED_A_OFF();
                *recv=answer;
        }
 
        LED_A_OFF();

-       LED_B_OFF();
-       LED_C_OFF();
-       LED_D_OFF();

        
        return answerLen;
 }
        
        return answerLen;
 }


@@ -942,64 +1000,46 @@ void SetDebugIso15693(uint32_t debug) {
        return;
 }
 
        return;
 }
 

-
-

 //-----------------------------------------------------------------------------
 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
 // all demodulation performed in arm rather than host. - greg
 //-----------------------------------------------------------------------------
 void ReaderIso15693(uint32_t parameter)
 {
 //-----------------------------------------------------------------------------
 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
 // all demodulation performed in arm rather than host. - greg
 //-----------------------------------------------------------------------------
 void ReaderIso15693(uint32_t parameter)
 {

+       LEDsoff();

        LED_A_ON();
        LED_A_ON();

-       LED_B_ON();
-       LED_C_OFF();
-       LED_D_OFF();

 
        int answerLen1 = 0;
 
        int answerLen1 = 0;

-       int answerLen2 = 0;
-       int answerLen3 = 0;
-       int i = 0;
-       int samples = 0;
-       int tsamples = 0;
-       int wait = 0;
-       int elapsed = 0;

        uint8_t TagUID[8] = {0x00};
 
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 
        uint8_t TagUID[8] = {0x00};
 
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 

-       uint8_t *answer1 = BigBuf_get_addr() + 3660;
-       uint8_t *answer2 = BigBuf_get_addr() + 3760;
-       uint8_t *answer3 = BigBuf_get_addr() + 3860;
-       // Blank arrays
-       memset(answer1, 0x00, 300);
+       uint8_t *answer1 = BigBuf_get_addr() + 4000;
+       memset(answer1, 0x00, 200);

 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
        // Setup SSC
 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
        // Setup SSC

-       FpgaSetupSsc();
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);

 
        // Start from off (no field generated)
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        SpinDelay(200);
 
        // Give the tags time to energize
 
        // Start from off (no field generated)
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        SpinDelay(200);
 
        // Give the tags time to energize

+       LED_D_ON();

        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
        SpinDelay(200);
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
        SpinDelay(200);
 

-       LED_A_ON();
-       LED_B_OFF();
-       LED_C_OFF();
-       LED_D_OFF();
-

        // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
        // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
 
        // Now send the IDENTIFY command
        BuildIdentifyRequest();
        
        // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
        // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
 
        // Now send the IDENTIFY command
        BuildIdentifyRequest();
        

-       TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
+       TransmitTo15693Tag(ToSend,ToSendMax);

        
        // Now wait for a response
        
        // Now wait for a response

-       answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
+       answerLen1 = GetIso15693AnswerFromTag(answer1, 100) ;

 
        if (answerLen1 >=12) // we should do a better check than this
        {
 
        if (answerLen1 >=12) // we should do a better check than this
        {


@@ -1019,27 +1059,28 @@ void ReaderIso15693(uint32_t parameter)
        Dbhexdump(answerLen1,answer1,true);
 
        // UID is reverse
        Dbhexdump(answerLen1,answer1,true);
 
        // UID is reverse

-       if (answerLen1>=12) 
+       if (answerLen1 >= 12) 

                Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
                        TagUID[7],TagUID[6],TagUID[5],TagUID[4],
                        TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
 
 
                Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
                        TagUID[7],TagUID[6],TagUID[5],TagUID[4],
                        TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
 
 

-       Dbprintf("%d octets read from SELECT request:", answerLen2);
-       DbdecodeIso15693Answer(answerLen2,answer2);
-       Dbhexdump(answerLen2,answer2,true);
+       // Dbprintf("%d octets read from SELECT request:", answerLen2);
+       // DbdecodeIso15693Answer(answerLen2,answer2);
+       // Dbhexdump(answerLen2,answer2,true);

 
 

-       Dbprintf("%d octets read from XXX request:", answerLen3);
-       DbdecodeIso15693Answer(answerLen3,answer3);
-       Dbhexdump(answerLen3,answer3,true);
+       // Dbprintf("%d octets read from XXX request:", answerLen3);
+       // DbdecodeIso15693Answer(answerLen3,answer3);
+       // Dbhexdump(answerLen3,answer3,true);

 
        // read all pages
 
        // read all pages

-       if (answerLen1>=12 && DEBUG) {
-               i=0;                    
+       if (answerLen1 >= 12 && DEBUG) {
+               uint8_t *answer2 = BigBuf_get_addr() + 4100;
+               int i=0;                        

                while (i<32) {  // sanity check, assume max 32 pages
                        BuildReadBlockRequest(TagUID,i);
                while (i<32) {  // sanity check, assume max 32 pages
                        BuildReadBlockRequest(TagUID,i);

-             TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);  
-         answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
+                       TransmitTo15693Tag(ToSend,ToSendMax);  
+                       int answerLen2 = GetIso15693AnswerFromTag(answer2, 100);

                        if (answerLen2>0) {
                                Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
                                DbdecodeIso15693Answer(answerLen2,answer2);
                        if (answerLen2>0) {
                                Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
                                DbdecodeIso15693Answer(answerLen2,answer2);


@@ -1050,44 +1091,37 @@ void ReaderIso15693(uint32_t parameter)
                } 
        }
 
                } 
        }
 

-       LED_A_OFF();
-       LED_B_OFF();
-       LED_C_OFF();
+       // for the time being, switch field off to protect rdv4.0 
+       // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

        LED_D_OFF();
        LED_D_OFF();

+       
+       LED_A_OFF();

 }
 
 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
 // all demodulation performed in arm rather than host. - greg
 void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 {
 }
 
 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
 // all demodulation performed in arm rather than host. - greg
 void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 {

+       LEDsoff();

        LED_A_ON();
        LED_A_ON();

-       LED_B_ON();
-       LED_C_OFF();
-       LED_D_OFF();

 
        int answerLen1 = 0;
        int samples = 0;
 
        int answerLen1 = 0;
        int samples = 0;

-       int tsamples = 0;
-       int wait = 0;

        int elapsed = 0;
 
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 
        int elapsed = 0;
 
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 

-       uint8_t *buf = BigBuf_get_addr() + 3660;
+       uint8_t *buf = BigBuf_get_addr() + 4000;

        memset(buf, 0x00, 100);
        
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
        memset(buf, 0x00, 100);
        
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);

-       FpgaSetupSsc();
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);

 
        // Start from off (no field generated)
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        SpinDelay(200);
 
 
        // Start from off (no field generated)
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        SpinDelay(200);
 

-       LED_A_OFF();
-       LED_B_OFF();
-       LED_C_ON();
-       LED_D_OFF();
-

        // Listen to reader
        answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
 
        // Listen to reader
        answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
 


@@ -1098,7 +1132,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
                
                BuildInventoryResponse(uid);
        
                
                BuildInventoryResponse(uid);
        

-               TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
+               TransmitTo15693Reader(ToSend,ToSendMax);

        }
 
        Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
        }
 
        Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,


@@ -1109,10 +1143,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
                uid[0], uid[1], uid[2], uid[3],
                uid[4], uid[5], uid[6], uid[7]);
 
                uid[0], uid[1], uid[2], uid[3],
                uid[4], uid[5], uid[6], uid[7]);
 

-       LED_A_OFF();
-       LED_B_OFF();
-       LED_C_OFF();
-       LED_D_OFF();
+       LEDsoff();

 }
 
 
 }
 
 


@@ -1120,6 +1151,9 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 // (some manufactures offer a way to read the AFI, though)
 void BruteforceIso15693Afi(uint32_t speed) 
 {      
 // (some manufactures offer a way to read the AFI, though)
 void BruteforceIso15693Afi(uint32_t speed) 
 {      

+       LEDsoff();
+       LED_A_ON();
+       

        uint8_t data[20];
        uint8_t *recv=data;
        int datalen=0, recvlen=0;
        uint8_t data[20];
        uint8_t *recv=data;
        int datalen=0, recvlen=0;


@@ -1134,7 +1168,7 @@ void BruteforceIso15693Afi(uint32_t speed)
        data[1]=ISO15_CMD_INVENTORY;
        data[2]=0; // mask length
        datalen=AddCrc(data,3);
        data[1]=ISO15_CMD_INVENTORY;
        data[2]=0; // mask length
        datalen=AddCrc(data,3);

-       recvlen=SendDataTag(data,datalen,0,speed,&recv);
+       recvlen=SendDataTag(data, datalen, false, speed, &recv);

        WDT_HIT();
        if (recvlen>=12) {
                Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
        WDT_HIT();
        if (recvlen>=12) {
                Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));


@@ -1151,7 +1185,7 @@ void BruteforceIso15693Afi(uint32_t speed)
        for (int i=0;i<256;i++) {
                data[2]=i & 0xFF;
                datalen=AddCrc(data,4);
        for (int i=0;i<256;i++) {
                data[2]=i & 0xFF;
                datalen=AddCrc(data,4);

-               recvlen=SendDataTag(data,datalen,0,speed,&recv);
+               recvlen=SendDataTag(data, datalen, false, speed, &recv);

                WDT_HIT();
                if (recvlen>=12) {
                        Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
                WDT_HIT();
                if (recvlen>=12) {
                        Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));


@@ -1159,26 +1193,27 @@ void BruteforceIso15693Afi(uint32_t speed)
        }       
        Dbprintf("AFI Bruteforcing done.");
        
        }       
        Dbprintf("AFI Bruteforcing done.");
        

+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       LEDsoff();

 }
 
 // Allows to directly send commands to the tag via the client
 }
 
 // Allows to directly send commands to the tag via the client

-void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
+void DirectTag15693Command(uint32_t datalen, uint32_t speed, uint32_t recv, uint8_t data[]) {

 
        int recvlen=0;
        uint8_t *recvbuf = BigBuf_get_addr();
 
        int recvlen=0;
        uint8_t *recvbuf = BigBuf_get_addr();

-//     UsbCommand n;
+       
+       LED_A_ON();

        
        if (DEBUG) {
                Dbprintf("SEND");
                Dbhexdump(datalen,data,true);
        }
        
        
        if (DEBUG) {
                Dbprintf("SEND");
                Dbhexdump(datalen,data,true);
        }
        

-       recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
+       recvlen = SendDataTag(data, datalen, true, speed, (recv?&recvbuf:NULL));

 
        if (recv) { 
 
        if (recv) { 

-               LED_B_ON();
-    cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
-               LED_B_OFF();    
+               cmd_send(CMD_ACK, recvlen>48?48:recvlen, 0, 0, recvbuf, 48);

                
                if (DEBUG) {
                        Dbprintf("RECV");
                
                if (DEBUG) {
                        Dbprintf("RECV");


@@ -1187,6 +1222,12 @@ void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8
                }
        }
 
                }
        }
 

+       // for the time being, switch field off to protect rdv4.0 
+       // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       LED_D_OFF();
+       
+       LED_A_OFF();

 }
 
 
 }