//-----------------------------------------------------------------------------\r
#include <proxmark3.h>\r
#include "apps.h"\r
-#include "..\common\iso14443_crc.c"\r
+#include "../common/iso14443_crc.c"\r
\r
\r
//static void GetSamplesFor14443(BOOL weTx, int n);\r
BYTE *output;\r
} Uart;\r
\r
+/* Receive & handle a bit coming from the reader.\r
+ *\r
+ * LED handling:\r
+ * LED A -> ON once we have received the SOF and are expecting the rest.\r
+ * LED A -> OFF once we have received EOF or are in error state or unsynced\r
+ *\r
+ * Returns: true if we received a EOF\r
+ * false if we are still waiting for some more\r
+ */\r
static BOOL Handle14443UartBit(int bit)\r
{\r
switch(Uart.state) {\r
case STATE_UNSYNCD:\r
+ LED_A_OFF();\r
if(!bit) {\r
// we went low, so this could be the beginning\r
// of an SOF\r
Uart.posCnt = 0;\r
Uart.byteCnt = 0;\r
Uart.state = STATE_AWAITING_START_BIT;\r
+ LED_A_ON(); // Indicate we got a valid SOF\r
} else {\r
// didn't stay down long enough\r
// before going high, error\r
Uart.bitCnt = 0;\r
Uart.shiftReg = 0;\r
Uart.state = STATE_RECEIVING_DATA;\r
+ LED_A_ON(); // Indicate we're receiving\r
}\r
break;\r
\r
}\r
} else if(Uart.shiftReg == 0x000) {\r
// this is an EOF byte\r
+ LED_A_OFF(); // Finished receiving\r
return TRUE;\r
} else {\r
// this is an error\r
break;\r
}\r
\r
+ if (Uart.state == STATE_ERROR_WAIT) LED_A_OFF(); // Error\r
+\r
return FALSE;\r
}\r
\r
\r
// Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen\r
// only, since we are receiving, not transmitting).\r
+ // Signal field is off with the appropriate LED\r
+ LED_D_OFF();\r
FpgaWriteConfWord(\r
FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);\r
\r
if(respLen <= 0) continue;\r
\r
// Modulate BPSK\r
+ // Signal field is off with the appropriate LED\r
+ LED_D_OFF();\r
FpgaWriteConfWord(\r
FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_BPSK);\r
SSC_TRANSMIT_HOLDING = 0xff;\r
int sumQ;\r
} Demod;\r
\r
+/*\r
+ * Handles reception of a bit from the tag\r
+ *\r
+ * LED handling:\r
+ * LED C -> ON once we have received the SOF and are expecting the rest.\r
+ * LED C -> OFF once we have received EOF or are unsynced\r
+ *\r
+ * Returns: true if we received a EOF\r
+ * false if we are still waiting for some more\r
+ *
+ */\r
static BOOL Handle14443SamplesDemod(int ci, int cq)\r
{\r
int v;\r
if(Demod.posCount < 12) {\r
Demod.state = DEMOD_UNSYNCD;\r
} else {\r
+ LED_C_ON(); // Got SOF\r
Demod.state = DEMOD_AWAITING_START_BIT;\r
Demod.posCount = 0;\r
Demod.len = 0;\r
Demod.state = DEMOD_AWAITING_START_BIT;\r
} else if(s == 0x000) {\r
// This is EOF\r
+ LED_C_OFF();\r
return TRUE;\r
Demod.state = DEMOD_UNSYNCD;\r
} else {\r
break;\r
}\r
\r
+ if (Demod.state == DEMOD_UNSYNCD) LED_C_OFF(); // Not synchronized...\r
return FALSE;\r
}\r
\r
-static void GetSamplesFor14443Demod(BOOL weTx, int n)\r
+/*\r
+ * Demodulate the samples we received from the tag\r
+ * weTx: set to 'TRUE' if we behave like a reader\r
+ * set to 'FALSE' if we behave like a snooper\r
+ * quiet: set to 'TRUE' to disable debug output
+ */\r
+static void GetSamplesFor14443Demod(BOOL weTx, int n, BOOL quiet)\r
{\r
int max = 0;\r
BOOL gotFrame = FALSE;\r
lastRxCounter = DMA_BUFFER_SIZE;\r
FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);\r
\r
+ // Signal field is ON with the appropriate LED:\r
+ if (weTx) LED_D_ON(); else LED_D_OFF();\r
// And put the FPGA in the appropriate mode\r
FpgaWriteConfWord(\r
FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r
int behindBy = lastRxCounter - PDC_RX_COUNTER(SSC_BASE);\r
if(behindBy > max) max = behindBy;\r
\r
- LED_D_ON();\r
while(((lastRxCounter-PDC_RX_COUNTER(SSC_BASE)) & (DMA_BUFFER_SIZE-1))\r
> 2)\r
{\r
gotFrame = 1;\r
}\r
}\r
- LED_D_OFF();\r
\r
if(samples > 2000) {\r
break;\r
}\r
}\r
PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;\r
- DbpIntegers(max, gotFrame, -1);\r
+ if (!quiet) DbpIntegers(max, gotFrame, Demod.len);\r
}\r
\r
//-----------------------------------------------------------------------------\r
SSC_TRANSMIT_HOLDING = 0xff;\r
}\r
\r
- FpgaWriteConfWord(\r
+ // Signal field is ON with the appropriate Red LED\r
+ LED_D_ON();\r
+ // Signal we are transmitting with the Green LED\r
+ LED_B_ON();\r
+ FpgaWriteConfWord(\r
FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);\r
\r
for(c = 0; c < 10;) {\r
}\r
WDT_HIT();\r
}\r
+ LED_B_OFF(); // Finished sending\r
}\r
\r
//-----------------------------------------------------------------------------\r
\r
//-----------------------------------------------------------------------------\r
// Read an ISO 14443 tag. We send it some set of commands, and record the\r
-// responses.\r
+// responses.
+// The command name is misleading, it actually decodes the reponse in HEX
+// into the output buffer (read the result using hexsamples, not hisamples)\r
//-----------------------------------------------------------------------------\r
void AcquireRawAdcSamplesIso14443(DWORD parameter)\r
{\r
-// BYTE cmd1[] = { 0x05, 0x00, 0x00, 0x71, 0xff };\r
BYTE cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };\r
\r
// Make sure that we start from off, since the tags are stateful;\r
// confusing things will happen if we don't reset them between reads.\r
- LED_D_OFF();\r
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ LED_D_OFF();\r
SpinDelay(200);\r
\r
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r
FpgaSetupSsc();\r
\r
// Now give it time to spin up.\r
+ // Signal field is on with the appropriate LED\r
+ LED_D_ON();\r
FpgaWriteConfWord(\r
FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);\r
SpinDelay(200);\r
\r
CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
TransmitFor14443();\r
- LED_A_ON();\r
- GetSamplesFor14443Demod(TRUE, 2000);\r
- LED_A_OFF();\r
+// LED_A_ON();\r
+ GetSamplesFor14443Demod(TRUE, 2000, FALSE);\r
+// LED_A_OFF();\r
}\r
+
+//-----------------------------------------------------------------------------\r
+// Read a SRI512 ISO 14443 tag.\r
+//
+// SRI512 tags are just simple memory tags, here we're looking at making a dump
+// of the contents of the memory. No anticollision algorithm is done, we assume
+// we have a single tag in the field.
+//
+// I tried to be systematic and check every answer of the tag, every CRC, etc...\r
+//-----------------------------------------------------------------------------\r
+void ReadSRI512Iso14443(DWORD parameter)\r
+{\r
+ BYTE i = 0x00;
+\r
+ // Make sure that we start from off, since the tags are stateful;\r
+ // confusing things will happen if we don't reset them between reads.\r
+ LED_D_OFF();\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ SpinDelay(200);\r
+\r
+ SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r
+ FpgaSetupSsc();\r
+\r
+ // Now give it time to spin up.\r
+ // Signal field is on with the appropriate LED\r
+ LED_D_ON();\r
+ FpgaWriteConfWord(\r
+ FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);\r
+ SpinDelay(200);\r
+
+ // First command: wake up the tag using the INITIATE command\r
+ BYTE cmd1[] = { 0x06, 0x00, 0x97, 0x5b};\r
+ CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
+ TransmitFor14443();\r
+// LED_A_ON();\r
+ GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r
+// LED_A_OFF();\r
+
+ if (Demod.len == 0) {
+ DbpString("No response from tag");
+ return;
+ } else {
+ DbpString("Randomly generated UID from tag (+ 2 byte CRC):");
+ DbpIntegers(Demod.output[0], Demod.output[1],Demod.output[2]);
+ }
+ // There is a response, SELECT the uid
+ DbpString("Now SELECT tag:");
+ cmd1[0] = 0x0E; // 0x0E is SELECT
+ cmd1[1] = Demod.output[0];
+ ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);\r
+ CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
+ TransmitFor14443();\r
+// LED_A_ON();\r
+ GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r
+// LED_A_OFF();\r
+ if (Demod.len != 3) {
+ DbpString("Expected 3 bytes from tag, got:");
+ DbpIntegers(Demod.len,0x0,0x0);
+ return;
+ }
+ // Check the CRC of the answer:
+ ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);\r
+ if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {\r
+ DbpString("CRC Error reading select response.");
+ return;
+ }
+ // Check response from the tag: should be the same UID as the command we just sent:
+ if (cmd1[1] != Demod.output[0]) {
+ DbpString("Bad response to SELECT from Tag, aborting:");
+ DbpIntegers(cmd1[1],Demod.output[0],0x0);
+ return;
+ }
+ // Tag is now selected,
+ // First get the tag's UID:
+ cmd1[0] = 0x0B;
+ ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
+ CodeIso14443bAsReader(cmd1, 3); // Only first three bytes for this one\r
+ TransmitFor14443();\r
+// LED_A_ON();\r
+ GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r
+// LED_A_OFF();\r
+ if (Demod.len != 10) {
+ DbpString("Expected 10 bytes from tag, got:");
+ DbpIntegers(Demod.len,0x0,0x0);
+ return;
+ }
+ // The check the CRC of the answer (use cmd1 as temporary variable):
+ ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);\r
+ if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {\r
+ DbpString("CRC Error reading block! - Below: expected, got");
+ DbpIntegers( (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9],0);
+ // Do not return;, let's go on... (we should retry, maybe ?)
+ }
+ DbpString("Tag UID (64 bits):");
+ DbpIntegers((Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], 0);
+
+ // Now loop to read all 16 blocks, address from 0 to 15
+ DbpString("Tag memory dump, block 0 to 15");
+ cmd1[0] = 0x08;
+ i = 0x00;
+ for (;;) {
+ if (i == 0x10) {
+ DbpString("System area block (0xff):");
+ i = 0xff;
+ }
+ cmd1[1] = i;
+ ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);\r
+ CodeIso14443bAsReader(cmd1, sizeof(cmd1));\r
+ TransmitFor14443();\r
+// LED_A_ON();\r
+ GetSamplesFor14443Demod(TRUE, 2000,TRUE);\r
+// LED_A_OFF();
+ if (Demod.len != 6) { // Check if we got an answer from the tag
+ DbpString("Expected 6 bytes from tag, got less...");
+ return;
+ }
+ // The check the CRC of the answer (use cmd1 as temporary variable):
+ ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);\r
+ if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {\r
+ DbpString("CRC Error reading block! - Below: expected, got");
+ DbpIntegers( (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5],0);
+ // Do not return;, let's go on... (we should retry, maybe ?)
+ }
+ // Now print out the memory location:
+ DbpString("Address , Contents, CRC");
+ DbpIntegers(i, (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0], (Demod.output[4]<<8)+Demod.output[5]);
+ if (i == 0xff) {
+ break;
+ }
+ i++;
+ }
+}\r
+
\r
//=============================================================================\r
// Finally, the `sniffer' combines elements from both the reader and\r
// triggering so that we start recording at the point that the tag is moved\r
// near the reader.\r
//-----------------------------------------------------------------------------\r
+/*\r
+ * Memory usage for this function, (within BigBuf)\r
+ * 0-1023 : Demodulated samples receive (1024 bytes)\r
+ * 1024-1535 : Last Received command, 512 bytes (reader->tag)\r
+ * 1536-2047 : Last Received command, 512 bytes(tag->reader)\r
+ * 2048-2304 : DMA Buffer, 256 bytes (samples)
+ */\r
void SnoopIso14443(void)\r
{\r
// We won't start recording the frames that we acquire until we trigger;\r
BOOL triggered = FALSE;\r
\r
// The command (reader -> tag) that we're working on receiving.\r
- BYTE *receivedCmd = (((BYTE *)BigBuf) + 1024);\r
+ BYTE *receivedCmd = (BYTE *)(BigBuf) + 1024;\r
// The response (tag -> reader) that we're working on receiving.\r
- BYTE *receivedResponse = (((BYTE *)BigBuf) + 1536);\r
+ BYTE *receivedResponse = (BYTE *)(BigBuf) + 1536;\r
\r
// As we receive stuff, we copy it from receivedCmd or receivedResponse\r
// into trace, along with its length and other annotations.\r
int traceLen = 0;\r
\r
// The DMA buffer, used to stream samples from the FPGA.\r
-//# define DMA_BUFFER_SIZE 256\r
- SBYTE *dmaBuf = ((SBYTE *)BigBuf) + 2048;\r
+ SBYTE *dmaBuf = (SBYTE *)(BigBuf) + 2048;\r
int lastRxCounter;\r
SBYTE *upTo;\r
int ci, cq;\r
// information in the trace buffer.\r
int samples = 0;\r
\r
- memset(trace, 0x44, 1000);\r
+ // Initialize the trace buffer\r
+ memset(trace, 0x44, 1024);\r
\r
// Set up the demodulator for tag -> reader responses.\r
Demod.output = receivedResponse;\r
Uart.state = STATE_UNSYNCD;\r
\r
// And put the FPGA in the appropriate mode\r
+ // Signal field is off with the appropriate LED\r
+ LED_D_OFF();\r
FpgaWriteConfWord(\r
FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |\r
FPGA_HF_READER_RX_XCORR_SNOOP);\r
upTo = dmaBuf;\r
lastRxCounter = DMA_BUFFER_SIZE;\r
FpgaSetupSscDma((BYTE *)dmaBuf, DMA_BUFFER_SIZE);\r
-\r
- LED_A_ON();\r
-\r
// And now we loop, receiving samples.\r
for(;;) {\r
- int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &\r
+ int behindBy = (lastRxCounter - PDC_RX_COUNTER(SSC_BASE)) &\r
(DMA_BUFFER_SIZE-1);\r
if(behindBy > maxBehindBy) {\r
maxBehindBy = behindBy;\r
- if(behindBy > 100) {\r
+ if(behindBy > (DMA_BUFFER_SIZE-2)) { // TODO: understand whether we can increase/decrease as we want or not?\r
DbpString("blew circular buffer!");\r
+ DbpIntegers(behindBy,0,0);\r
goto done;\r
}\r
}\r
if(upTo - dmaBuf > DMA_BUFFER_SIZE) {\r
upTo -= DMA_BUFFER_SIZE;\r
lastRxCounter += DMA_BUFFER_SIZE;\r
- PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD)upTo;\r
+ PDC_RX_NEXT_POINTER(SSC_BASE) = (DWORD) upTo;\r
PDC_RX_NEXT_COUNTER(SSC_BASE) = DMA_BUFFER_SIZE;\r
}\r
\r
if(traceLen > 1000) break;\r
\r
triggered = TRUE;\r
- LED_A_OFF();\r
- LED_B_ON();\r
\r
// And ready to receive another response.\r
memset(&Demod, 0, sizeof(Demod));\r
Demod.output = receivedResponse;\r
Demod.state = DEMOD_UNSYNCD;\r
}\r
+ WDT_HIT();\r
\r
if(BUTTON_PRESS()) {\r
DbpString("cancelled");\r
DbpIntegers(Uart.byteCntMax, traceLen, 0x23);\r
\r
done:\r
+ LED_D_OFF();\r
PDC_CONTROL(SSC_BASE) = PDC_RX_DISABLE;\r
- LED_A_OFF();\r
- LED_B_OFF();\r
}\r
projects / proxmark3-svn / blobdiff