hf 14a: if the tag supports it, set default timeout according to ATS

[proxmark3-svn] / armsrc / iclass.c

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index 329e17655e0f6182911d0c68f9665c254483e13b..41c9b8b51e6b700771e17ff1bd31de5c077e3c4d 100644 (file)
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -640,21 +640,24 @@ void RAMFUNC SnoopIClass(void)
     // The command (reader -> tag) that we're receiving.
        // The length of a received command will in most cases be no more than 18 bytes.
        // So 32 should be enough!
     // The command (reader -> tag) that we're receiving.
        // The length of a received command will in most cases be no more than 18 bytes.
        // So 32 should be enough!

-       uint8_t *readerToTagCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
+       #define ICLASS_BUFFER_SIZE 32
+       uint8_t readerToTagCmd[ICLASS_BUFFER_SIZE];

     // The response (tag -> reader) that we're receiving.
     // The response (tag -> reader) that we're receiving.

-       uint8_t *tagToReaderResponse = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
+       uint8_t tagToReaderResponse[ICLASS_BUFFER_SIZE];

        
     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
  
        
     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
  

-    // reset traceLen to 0
-    iso14a_set_tracing(TRUE);
-    iso14a_clear_trace();
+       // free all BigBuf memory
+       BigBuf_free();
+    // The DMA buffer, used to stream samples from the FPGA
+    uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
+ 
+       set_tracing(TRUE);
+       clear_trace();

     iso14a_set_trigger(FALSE);
 
     iso14a_set_trigger(FALSE);
 

-    // The DMA buffer, used to stream samples from the FPGA
-    int8_t *dmaBuf = ((int8_t *)BigBuf) + DMA_BUFFER_OFFSET;
-    int lastRxCounter;
-    int8_t *upTo;
+       int lastRxCounter;
+    uint8_t *upTo;

     int smpl;
     int maxBehindBy = 0;
 
     int smpl;
     int maxBehindBy = 0;
 


@@ -703,7 +706,7 @@ void RAMFUNC SnoopIClass(void)
                                 (DMA_BUFFER_SIZE-1);
         if(behindBy > maxBehindBy) {
             maxBehindBy = behindBy;
                                 (DMA_BUFFER_SIZE-1);
         if(behindBy > maxBehindBy) {
             maxBehindBy = behindBy;

-            if(behindBy > 400) {
+            if(behindBy > (9 * DMA_BUFFER_SIZE / 10)) {

                 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
                 goto done;
             }
                 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
                 goto done;
             }


@@ -801,12 +804,12 @@ void RAMFUNC SnoopIClass(void)
     DbpString("COMMAND FINISHED");
 
     Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);
     DbpString("COMMAND FINISHED");
 
     Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);

-    Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]);
+       Dbprintf("%x %x %x", Uart.byteCntMax, BigBuf_get_traceLen(), (int)Uart.output[0]);

 
 done:
     AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
     Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);
 
 done:
     AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
     Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);

-    Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]);
+       Dbprintf("%x %x %x", Uart.byteCntMax, BigBuf_get_traceLen(), (int)Uart.output[0]);

     LED_A_OFF();
     LED_B_OFF();
     LED_C_OFF();
     LED_A_OFF();
     LED_B_OFF();
     LED_C_OFF();


@@ -921,7 +924,7 @@ static void CodeIClassTagAnswer(const uint8_t *cmd, int len)
         * - A 1-bit input to the FPGA becomes 8 pulses on 423.5kHz (fc/32) (18.88us).
         * - A 0-bit inptu to the FPGA becomes an unmodulated time of 18.88us
         *
         * - A 1-bit input to the FPGA becomes 8 pulses on 423.5kHz (fc/32) (18.88us).
         * - A 0-bit inptu to the FPGA becomes an unmodulated time of 18.88us
         *

-        * In thist mode the SOF can be written as 00011101 = 0x1D
+        * In this mode the SOF can be written as 00011101 = 0x1D

         * The EOF can be written as 10111000 = 0xb8
         * A logic 1 is 01
         * A logic 0 is 10
         * The EOF can be written as 10111000 = 0xb8
         * A logic 1 is 01
         * A logic 0 is 10


@@ -983,8 +986,8 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 
        // Enable and clear the trace
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 
        // Enable and clear the trace

-       iso14a_set_tracing(TRUE);
-       iso14a_clear_trace();
+       set_tracing(TRUE);
+       clear_trace();

 
        uint8_t csn_crc[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 };
        if(simType == 0) {
 
        uint8_t csn_crc[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 };
        if(simType == 0) {


@@ -998,7 +1001,7 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
        else if(simType == 2)
        {
 
        else if(simType == 2)
        {
 

-               uint8_t mac_responses[64] = { 0 };
+               uint8_t mac_responses[USB_CMD_DATA_SIZE] = { 0 };

                Dbprintf("Going into attack mode, %d CSNS sent", numberOfCSNS);
                // In this mode, a number of csns are within datain. We'll simulate each one, one at a time
                // in order to collect MAC's from the reader. This can later be used in an offlne-attack
                Dbprintf("Going into attack mode, %d CSNS sent", numberOfCSNS);
                // In this mode, a number of csns are within datain. We'll simulate each one, one at a time
                // in order to collect MAC's from the reader. This can later be used in an offlne-attack


@@ -1064,27 +1067,28 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
        int trace_data_size = 0;
        //uint8_t sof = 0x0f;
 
        int trace_data_size = 0;
        //uint8_t sof = 0x0f;
 

+       // free eventually allocated BigBuf memory
+       BigBuf_free();

        // Respond SOF -- takes 1 bytes
        // Respond SOF -- takes 1 bytes

-       uint8_t *resp1 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
+       uint8_t *resp1 = BigBuf_malloc(2);

        int resp1Len;
 
        // Anticollision CSN (rotated CSN)
        // 22: Takes 2 bytes for SOF/EOF and 10 * 2 = 20 bytes (2 bytes/byte)
        int resp1Len;
 
        // Anticollision CSN (rotated CSN)
        // 22: Takes 2 bytes for SOF/EOF and 10 * 2 = 20 bytes (2 bytes/byte)

-       uint8_t *resp2 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 2);
+       uint8_t *resp2 = BigBuf_malloc(28);

        int resp2Len;
 
        // CSN
        // 22: Takes 2 bytes for SOF/EOF and 10 * 2 = 20 bytes (2 bytes/byte)
        int resp2Len;
 
        // CSN
        // 22: Takes 2 bytes for SOF/EOF and 10 * 2 = 20 bytes (2 bytes/byte)

-       uint8_t *resp3 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 30);
+       uint8_t *resp3 = BigBuf_malloc(30);

        int resp3Len;
 
        // e-Purse
        int resp3Len;
 
        // e-Purse

-       // 18: Takes 2 bytes for SOF/EOF and 8 * 2 = 16 bytes (2 bytes/byte)
-       uint8_t *resp4 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 60);
+       // 18: Takes 2 bytes for SOF/EOF and 8 * 2 = 16 bytes (2 bytes/bit)
+       uint8_t *resp4 = BigBuf_malloc(20);

        int resp4Len;
 
        int resp4Len;
 

-       // + 1720..
-       uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
+       uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);

        memset(receivedCmd, 0x44, MAX_FRAME_SIZE);
        int len;
 
        memset(receivedCmd, 0x44, MAX_FRAME_SIZE);
        int len;
 


@@ -1215,12 +1219,7 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
                        cmdsRecvd++;
                }
                /**
                        cmdsRecvd++;
                }
                /**

-               After changes to parity calculation
-               Time between reader EOT and pm3 SOF
-               delay   21 -> 480uS
-               delay   10 -> 220us
-               delay   16 -> 388us
-               A legit tag has about 380us.
+               A legit tag has about 380us delay between reader EOT and tag SOF.

                **/
                if(modulated_response_size > 0) {
                        SendIClassAnswer(modulated_response, modulated_response_size, 1);
                **/
                if(modulated_response_size > 0) {
                        SendIClassAnswer(modulated_response, modulated_response_size, 1);


@@ -1248,6 +1247,8 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
        //Dbprintf("%x", cmdsRecvd);
        LED_A_OFF();
        LED_B_OFF();
        //Dbprintf("%x", cmdsRecvd);
        LED_A_OFF();
        LED_B_OFF();

+       LED_C_OFF();
+

        if(buttonPressed)
        {
                DbpString("Button pressed");
        if(buttonPressed)
        {
                DbpString("Button pressed");


@@ -1486,8 +1487,8 @@ void setupIclassReader()
 {
     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
     // Reset trace buffer
 {
     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
     // Reset trace buffer

-    iso14a_set_tracing(TRUE);
-    iso14a_clear_trace();
+       set_tracing(TRUE);
+       clear_trace();

 
     // Setup SSC
     FpgaSetupSsc();
 
     // Setup SSC
     FpgaSetupSsc();


@@ -1532,7 +1533,7 @@ uint8_t handshakeIclassTag(uint8_t *card_data)
        static uint8_t identify[]    = { 0x0c };
        static uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
        static uint8_t readcheck_cc[]= { 0x88, 0x02 };
        static uint8_t identify[]    = { 0x0c };
        static uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
        static uint8_t readcheck_cc[]= { 0x88, 0x02 };

-       uint8_t *resp = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
+       uint8_t resp[ICLASS_BUFFER_SIZE];

 
        uint8_t read_status = 0;
 
 
        uint8_t read_status = 0;
 


@@ -1583,14 +1584,14 @@ void ReaderIClass(uint8_t arg0) {
     int read_status= 0;
     bool abort_after_read = arg0 & FLAG_ICLASS_READER_ONLY_ONCE;
        bool get_cc = arg0 & FLAG_ICLASS_READER_GET_CC;
     int read_status= 0;
     bool abort_after_read = arg0 & FLAG_ICLASS_READER_ONLY_ONCE;
        bool get_cc = arg0 & FLAG_ICLASS_READER_GET_CC;

-
+       set_tracing(TRUE);

     setupIclassReader();
 
     size_t datasize = 0;
     while(!BUTTON_PRESS())
     {
 
     setupIclassReader();
 
     size_t datasize = 0;
     while(!BUTTON_PRESS())
     {
 

-               if(traceLen > TRACE_SIZE) {
+               if(!tracing) {

                        DbpString("Trace full");
                        break;
                }
                        DbpString("Trace full");
                        break;
                }


@@ -1653,16 +1654,16 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
          int keyaccess;
        } memory;
        
          int keyaccess;
        } memory;
        

-       uint8_t* resp = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
+       uint8_t resp[ICLASS_BUFFER_SIZE];

        
     setupIclassReader();
        
     setupIclassReader();

-
+       set_tracing(TRUE);

 
        while(!BUTTON_PRESS()) {
        
                WDT_HIT();
 
 
        while(!BUTTON_PRESS()) {
        
                WDT_HIT();
 

-               if(traceLen > TRACE_SIZE) {
+               if(!tracing) {

                        DbpString("Trace full");
                        break;
                }
                        DbpString("Trace full");
                        break;
                }