static BYTE *trace = (BYTE *) BigBuf;\r
static int traceLen = 0;\r
static int rsamples = 0;\r
+static BOOL tracing = TRUE;\r
\r
typedef enum {\r
SEC_D = 1,\r
1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1\r
};\r
\r
+// BIG CHANGE - UNDERSTAND THIS BEFORE WE COMMIT\r
+#define RECV_CMD_OFFSET 3032\r
+#define RECV_RES_OFFSET 3096\r
+#define DMA_BUFFER_OFFSET 3160\r
+#define DMA_BUFFER_SIZE 4096\r
+#define TRACE_LENGTH 3000\r
+\r
//-----------------------------------------------------------------------------\r
// Generate the parity value for a byte sequence\r
// \r
return dwPar;\r
}\r
\r
+static void AppendCrc14443a(BYTE* data, int len)\r
+{\r
+ ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);\r
+}\r
+\r
+BOOL LogTrace(const BYTE * btBytes, int iLen, int iSamples, DWORD dwParity, BOOL bReader)\r
+{\r
+ // Return when trace is full\r
+ if (traceLen >= TRACE_LENGTH) return FALSE;\r
+ \r
+ // Trace the random, i'm curious\r
+ rsamples += iSamples;\r
+ trace[traceLen++] = ((rsamples >> 0) & 0xff);\r
+ trace[traceLen++] = ((rsamples >> 8) & 0xff);\r
+ trace[traceLen++] = ((rsamples >> 16) & 0xff);\r
+ trace[traceLen++] = ((rsamples >> 24) & 0xff);\r
+ if (!bReader) {\r
+ trace[traceLen - 1] |= 0x80;\r
+ }\r
+ trace[traceLen++] = ((dwParity >> 0) & 0xff);\r
+ trace[traceLen++] = ((dwParity >> 8) & 0xff);\r
+ trace[traceLen++] = ((dwParity >> 16) & 0xff);\r
+ trace[traceLen++] = ((dwParity >> 24) & 0xff);\r
+ trace[traceLen++] = iLen;\r
+ memcpy(trace + traceLen, btBytes, iLen);\r
+ traceLen += iLen;\r
+ return TRUE;\r
+}\r
+\r
+BOOL LogTraceInfo(byte_t* data, size_t len)\r
+{\r
+ return LogTrace(data,len,0,GetParity(data,len),TRUE);\r
+}\r
+\r
//-----------------------------------------------------------------------------\r
// The software UART that receives commands from the reader, and its state\r
// variables.\r
//-----------------------------------------------------------------------------\r
void SnoopIso14443a(void)\r
{\r
-\r
- // BIG CHANGE - UNDERSTAND THIS BEFORE WE COMMIT\r
-\r
- #define RECV_CMD_OFFSET 3032\r
- #define RECV_RES_OFFSET 3096\r
- #define DMA_BUFFER_OFFSET 3160\r
- #define DMA_BUFFER_SIZE 4096\r
- #define TRACE_LENGTH 3000\r
-\r
// #define RECV_CMD_OFFSET 2032 // original (working as of 21/2/09) values\r
// #define RECV_RES_OFFSET 2096 // original (working as of 21/2/09) values\r
// #define DMA_BUFFER_OFFSET 2160 // original (working as of 21/2/09) values\r
//ToSendMax += 2;\r
}\r
\r
-int LogTrace(const BYTE * btBytes, int iLen, int iSamples, DWORD dwParity, BOOL bReader)\r
-{\r
- // Trace the random, i'm curious\r
- rsamples += iSamples;\r
- trace[traceLen++] = ((rsamples >> 0) & 0xff);\r
- trace[traceLen++] = ((rsamples >> 8) & 0xff);\r
- trace[traceLen++] = ((rsamples >> 16) & 0xff);\r
- trace[traceLen++] = ((rsamples >> 24) & 0xff);\r
- if (!bReader) {\r
- trace[traceLen - 1] |= 0x80;\r
- }\r
- trace[traceLen++] = ((dwParity >> 0) & 0xff);\r
- trace[traceLen++] = ((dwParity >> 8) & 0xff);\r
- trace[traceLen++] = ((dwParity >> 16) & 0xff);\r
- trace[traceLen++] = ((dwParity >> 24) & 0xff);\r
- trace[traceLen++] = iLen;\r
- memcpy(trace + traceLen, btBytes, iLen);\r
- traceLen += iLen;\r
- return (traceLen < TRACE_LENGTH);\r
-}\r
-\r
//-----------------------------------------------------------------------------\r
// Wait for commands from reader\r
// Stop when button is pressed\r
//-----------------------------------------------------------------------------\r
static void TransmitFor14443a(const BYTE *cmd, int len, int *samples, int *wait)\r
{\r
- int c;\r
-\r
- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);\r
-\r
- if(*wait < 10) { *wait = 10; }\r
-\r
- for(c = 0; c < *wait;) {\r
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
- AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!\r
- c++;\r
- }\r
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
- volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;\r
- (void)r;\r
- }\r
- WDT_HIT();\r
+ int c;\r
+ \r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);\r
+ \r
+ if (wait)\r
+ if(*wait < 10)\r
+ *wait = 10;\r
+ \r
+ for(c = 0; c < *wait;) {\r
+ if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
+ AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!\r
+ c++;\r
}\r
-\r
- c = 0;\r
- for(;;) {\r
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
- AT91C_BASE_SSC->SSC_THR = cmd[c];\r
- c++;\r
- if(c >= len) {\r
- break;\r
- }\r
- }\r
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
- volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;\r
- (void)r;\r
- }\r
- WDT_HIT();\r
+ if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
+ volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;\r
+ (void)r;\r
}\r
- *samples = (c + *wait) << 3;\r
+ WDT_HIT();\r
+ }\r
+ \r
+ c = 0;\r
+ for(;;) {\r
+ if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
+ AT91C_BASE_SSC->SSC_THR = cmd[c];\r
+ c++;\r
+ if(c >= len) {\r
+ break;\r
+ }\r
+ }\r
+ if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
+ volatile DWORD r = AT91C_BASE_SSC->SSC_RHR;\r
+ (void)r;\r
+ }\r
+ WDT_HIT();\r
+ }\r
+ if (samples) *samples = (c + *wait) << 3;\r
}\r
\r
//-----------------------------------------------------------------------------\r
// Code a 7-bit command without parity bit\r
// This is especially for 0x26 and 0x52 (REQA and WUPA)\r
//-----------------------------------------------------------------------------\r
-void ShortFrameFromReader(const BYTE *cmd)\r
+void ShortFrameFromReader(const BYTE bt)\r
{\r
int j;\r
int last;\r
- BYTE b;\r
+ BYTE b;\r
\r
ToSendReset();\r
\r
Sequence(SEC_Z);\r
last = 0;\r
\r
- b = cmd[0];\r
+ b = bt;\r
for(j = 0; j < 7; j++) {\r
if(b & 1) {\r
// Sequence X\r
\r
//-----------------------------------------------------------------------------\r
// Prepare reader command to send to FPGA\r
-//\r
+// \r
//-----------------------------------------------------------------------------\r
-void CodeIso14443aAsReader(const BYTE *cmd, int len)\r
+void CodeIso14443aAsReaderPar(const BYTE * cmd, int len, DWORD dwParity)\r
{\r
- int i, j;\r
- int last;\r
- int oddparity;\r
- BYTE b;\r
-\r
- ToSendReset();\r
-\r
- // Start of Communication (Seq. Z)\r
- Sequence(SEC_Z);\r
- last = 0;\r
-\r
- for(i = 0; i < len; i++) {\r
- // Data bits\r
- b = cmd[i];\r
- oddparity = 0x01;\r
- for(j = 0; j < 8; j++) {\r
- oddparity ^= (b & 1);\r
- if(b & 1) {\r
- // Sequence X\r
- Sequence(SEC_X);\r
- last = 1;\r
- } else {\r
- if(last == 0) {\r
- // Sequence Z\r
- Sequence(SEC_Z);\r
- }\r
- else {\r
- // Sequence Y\r
- Sequence(SEC_Y);\r
- last = 0;\r
- }\r
- }\r
- b >>= 1;\r
+ int i, j;\r
+ int last;\r
+ BYTE b;\r
+ \r
+ ToSendReset();\r
+ \r
+ // Start of Communication (Seq. Z)\r
+ Sequence(SEC_Z);\r
+ last = 0;\r
+ \r
+ // Generate send structure for the data bits\r
+ for (i = 0; i < len; i++) {\r
+ // Get the current byte to send\r
+ b = cmd[i];\r
+ \r
+ for (j = 0; j < 8; j++) {\r
+ if (b & 1) {\r
+ // Sequence X\r
+ Sequence(SEC_X);\r
+ last = 1;\r
+ } else {\r
+ if (last == 0) {\r
+ // Sequence Z\r
+ Sequence(SEC_Z);\r
+ } else {\r
+ // Sequence Y\r
+ Sequence(SEC_Y);\r
+ last = 0;\r
}\r
-\r
- // Parity bit\r
- if(oddparity) {\r
- // Sequence X\r
- Sequence(SEC_X);\r
- last = 1;\r
- } else {\r
- if(last == 0) {\r
- // Sequence Z\r
- Sequence(SEC_Z);\r
- }\r
- else {\r
- // Sequence Y\r
- Sequence(SEC_Y);\r
- last = 0;\r
- }\r
- }\r
+ }\r
+ b >>= 1;\r
}\r
-\r
- // End of Communication\r
- if(last == 0) {\r
- // Sequence Z\r
- Sequence(SEC_Z);\r
- }\r
- else {\r
- // Sequence Y\r
- Sequence(SEC_Y);\r
- last = 0;\r
- }\r
- // Sequence Y\r
- Sequence(SEC_Y);\r
-\r
- // Just to be sure!\r
- Sequence(SEC_Y);\r
- Sequence(SEC_Y);\r
- Sequence(SEC_Y);\r
-\r
- // Convert from last character reference to length\r
- ToSendMax++;\r
+ \r
+ // Get the parity bit\r
+ if ((dwParity >> i) & 0x01) {\r
+ // Sequence X\r
+ Sequence(SEC_X);\r
+ last = 1;\r
+ } else {\r
+ if (last == 0) {\r
+ // Sequence Z\r
+ Sequence(SEC_Z);\r
+ } else {\r
+ // Sequence Y\r
+ Sequence(SEC_Y);\r
+ last = 0;\r
+ }\r
+ }\r
+ }\r
+ \r
+ // End of Communication\r
+ if (last == 0) {\r
+ // Sequence Z\r
+ Sequence(SEC_Z);\r
+ } else {\r
+ // Sequence Y\r
+ Sequence(SEC_Y);\r
+ last = 0;\r
+ }\r
+ // Sequence Y\r
+ Sequence(SEC_Y);\r
+ \r
+ // Just to be sure!\r
+ Sequence(SEC_Y);\r
+ Sequence(SEC_Y);\r
+ Sequence(SEC_Y);\r
+ \r
+ // Convert from last character reference to length\r
+ ToSendMax++;\r
}\r
\r
-\r
//-----------------------------------------------------------------------------\r
// Wait a certain time for tag response\r
// If a response is captured return TRUE\r
Demod.state = DEMOD_UNSYNCD;\r
\r
BYTE b;\r
- *elapsed = 0;\r
+ if (elapsed) *elapsed = 0;\r
\r
c = 0;\r
for(;;) {\r
\r
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {\r
AT91C_BASE_SSC->SSC_THR = 0x00; // To make use of exact timing of next command from reader!!\r
- (*elapsed)++;\r
+ if (elapsed) (*elapsed)++;\r
}\r
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {\r
if(c < 512) { c++; } else { return FALSE; }\r
}\r
}\r
\r
+void ReaderTransmitShort(const BYTE* bt)\r
+{\r
+ int wait = 0;\r
+ int samples = 0;\r
+\r
+ ShortFrameFromReader(*bt);\r
+ \r
+ // Select the card\r
+ TransmitFor14443a(ToSend, ToSendMax, &samples, &wait); \r
+ \r
+ // Store reader command in buffer\r
+ if (tracing) LogTrace(bt,1,0,GetParity(bt,1),TRUE);\r
+}\r
+\r
+void ReaderTransmitPar(BYTE* frame, int len, DWORD par)\r
+{\r
+ int wait = 0;\r
+ int samples = 0;\r
+ \r
+ // This is tied to other size changes\r
+ // BYTE* frame_addr = ((BYTE*)BigBuf) + 2024; \r
+ CodeIso14443aAsReaderPar(frame,len,par);\r
+ \r
+ // Select the card\r
+ TransmitFor14443a(ToSend, ToSendMax, &samples, &wait); \r
+ \r
+ // Store reader command in buffer\r
+ if (tracing) LogTrace(frame,len,0,par,TRUE);\r
+}\r
\r
\r
+void ReaderTransmit(BYTE* frame, int len)\r
+{\r
+ // Generate parity and redirect\r
+ ReaderTransmitPar(frame,len,GetParity(frame,len));\r
+}\r
+\r
+BOOL ReaderReceive(BYTE* receivedAnswer)\r
+{\r
+ int samples = 0;\r
+ if (!GetIso14443aAnswerFromTag(receivedAnswer,100,&samples,0)) return FALSE;\r
+ if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);\r
+ return TRUE;\r
+}\r
+\r
//-----------------------------------------------------------------------------\r
// Read an ISO 14443a tag. Send out commands and store answers.\r
//\r
void ReaderIso14443a(DWORD parameter)\r
{\r
// Anticollision\r
- static const BYTE cmd1[] = { 0x52 }; // or 0x26\r
- static const BYTE cmd2[] = { 0x93,0x20 };\r
- // UID = 0x2a,0x69,0x8d,0x43,0x8d, last two bytes are CRC bytes\r
- BYTE cmd3[] = { 0x93,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };\r
-\r
- // For Ultralight add an extra anticollission layer -> 95 20 and then 95 70\r
-\r
- // greg - here we will add our cascade level 2 anticolission and select functions to deal with ultralight // and 7-byte UIDs in generall...\r
- BYTE cmd4[] = {0x95,0x20}; // ask for cascade 2 select\r
- // 95 20\r
- //BYTE cmd3a[] = { 0x95,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };\r
- // 95 70\r
-\r
- // cascade 2 select\r
- BYTE cmd5[] = { 0x95,0x70,0x2a,0x69,0x8d,0x43,0x8d,0x52,0x55 };\r
-\r
-\r
- // RATS (request for answer to select)\r
- //BYTE cmd6[] = { 0xe0,0x50,0xbc,0xa5 }; // original RATS\r
- BYTE cmd6[] = { 0xe0,0x21,0xb2,0xc7 }; // Desfire RATS\r
+ BYTE wupa[] = { 0x52 };\r
+ BYTE sel_all[] = { 0x93,0x20 };\r
+ BYTE sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };\r
+ BYTE sel_all_c2[] = { 0x95,0x20 };\r
+ BYTE sel_uid_c2[] = { 0x95,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };\r
\r
// Mifare AUTH\r
- BYTE cmd7[] = { 0x60, 0x00, 0x00, 0x00 };\r
-\r
- int reqaddr = 2024; // was 2024 - tied to other size changes\r
- int reqsize = 60;\r
-\r
- BYTE *req1 = (((BYTE *)BigBuf) + reqaddr);\r
- int req1Len;\r
-\r
- BYTE *req2 = (((BYTE *)BigBuf) + reqaddr + reqsize);\r
- int req2Len;\r
-\r
- BYTE *req3 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 2));\r
- int req3Len;\r
-\r
-// greg added req 4 & 5 to deal with cascade 2 section\r
- BYTE *req4 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 3));\r
- int req4Len;\r
-\r
- BYTE *req5 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 4));\r
- int req5Len;\r
-\r
- BYTE *req6 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 5));\r
- int req6Len;\r
-\r
- BYTE *req7 = (((BYTE *)BigBuf) + reqaddr + (reqsize * 6));\r
- int req7Len;\r
-\r
- BYTE *receivedAnswer = (((BYTE *)BigBuf) + 3560); // was 3560 - tied to other size changes\r
-\r
- //BYTE *trace = (BYTE *)BigBuf;\r
- //int traceLen = 0;\r
- //int rsamples = 0;\r
+ BYTE mf_auth[] = { 0x60,0x00,0xf5,0x7b };\r
+// BYTE mf_nr_ar[] = { 0x00,0x00,0x00,0x00 };\r
+ \r
+ BYTE* receivedAnswer = (((BYTE *)BigBuf) + 3560); // was 3560 - tied to other size changes\r
traceLen = 0;\r
\r
- memset(trace, 0x44, 2000); // was 2000 - tied to oter size chnages\r
- // setting it to 3000 causes no tag responses to be detected (2900 is ok)\r
- // setting it to 1000 causes no tag responses to be detected\r
-\r
- // Prepare some commands!\r
- ShortFrameFromReader(cmd1);\r
- memcpy(req1, ToSend, ToSendMax); req1Len = ToSendMax;\r
-\r
- CodeIso14443aAsReader(cmd2, sizeof(cmd2));\r
- memcpy(req2, ToSend, ToSendMax); req2Len = ToSendMax;\r
-\r
- CodeIso14443aAsReader(cmd3, sizeof(cmd3));\r
- memcpy(req3, ToSend, ToSendMax); req3Len = ToSendMax;\r
-\r
-\r
- CodeIso14443aAsReader(cmd4, sizeof(cmd4)); // 4 is cascade 2 request\r
- memcpy(req4, ToSend, ToSendMax); req4Len = ToSendMax;\r
-\r
-\r
- CodeIso14443aAsReader(cmd5, sizeof(cmd5)); // 5 is cascade 2 select\r
- memcpy(req5, ToSend, ToSendMax); req5Len = ToSendMax;\r
-\r
-\r
- CodeIso14443aAsReader(cmd6, sizeof(cmd6));\r
- memcpy(req6, ToSend, ToSendMax); req6Len = ToSendMax;\r
-\r
// Setup SSC\r
FpgaSetupSsc();\r
\r
// Start from off (no field generated)\r
- // Signal field is off with the appropriate LED\r
- LED_D_OFF();\r
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
- SpinDelay(200);\r
+ // Signal field is off with the appropriate LED\r
+ LED_D_OFF();\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ SpinDelay(200);\r
\r
- SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r
- FpgaSetupSsc();\r
+ SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r
+ FpgaSetupSsc();\r
\r
// Now give it time to spin up.\r
- // Signal field is on with the appropriate LED\r
- LED_D_ON();\r
- FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);\r
+ // Signal field is on with the appropriate LED\r
+ LED_D_ON();\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);\r
SpinDelay(200);\r
\r
LED_A_ON();\r
LED_B_OFF();\r
LED_C_OFF();\r
\r
- int samples = 0;\r
- int tsamples = 0;\r
- int wait = 0;\r
- int elapsed = 0;\r
-\r
- while(1) {\r
- // Send WUPA (or REQA)\r
- TransmitFor14443a(req1, req1Len, &tsamples, &wait);\r
-\r
- // Store reader command in buffer\r
- if (!LogTrace(cmd1,1,0,GetParity(cmd1,1),TRUE)) break;\r
+ while(traceLen < TRACE_LENGTH)\r
+ {\r
+ // Broadcast for a card, WUPA (0x52) will force response from all cards in the field\r
+ ReaderTransmitShort(wupa);\r
\r
// Test if the action was cancelled\r
if(BUTTON_PRESS()) {\r
break;\r
}\r
\r
- if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) continue;\r
- \r
- // Log the ATQA\r
- if (!LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE)) break;\r
-\r
- // Store reader command in buffer\r
- if (!LogTrace(cmd2,2,0,GetParity(cmd2,2),TRUE)) break;\r
- TransmitFor14443a(req2, req2Len, &samples, &wait);\r
+ // Receive the ATQA\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
\r
- if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) continue;\r
+ // Transmit SELECT_ALL\r
+ ReaderTransmit(sel_all,sizeof(sel_all));\r
\r
- // Log the uid\r
- if (!LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE)) break;\r
+ // Receive the UID\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
\r
// Construct SELECT UID command\r
// First copy the 5 bytes (Mifare Classic) after the 93 70\r
- memcpy(cmd3+2,receivedAnswer,5);\r
+ memcpy(sel_uid+2,receivedAnswer,5);\r
// Secondly compute the two CRC bytes at the end\r
- ComputeCrc14443(CRC_14443_A, cmd3, 7, &cmd3[7], &cmd3[8]);\r
-\r
- // Store reader command in buffer\r
- if (!LogTrace(cmd3,9,0,GetParity(cmd5,9),TRUE)) break;\r
- \r
- CodeIso14443aAsReader(cmd3, sizeof(cmd3));\r
- memcpy(req3, ToSend, ToSendMax); req3Len = ToSendMax;\r
-\r
- // Select the card\r
- TransmitFor14443a(req3, req3Len, &samples, &wait);\r
- if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) continue;\r
+ AppendCrc14443a(sel_uid,7);\r
\r
- // Log the SAK\r
- if (!LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE)) break;\r
+ // Transmit SELECT_UID\r
+ ReaderTransmit(sel_uid,sizeof(sel_uid));\r
+ \r
+ // Receive the SAK\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
\r
// OK we have selected at least at cascade 1, lets see if first byte of UID was 0x88 in\r
// which case we need to make a cascade 2 request and select - this is a long UID\r
- if (receivedAnswer[0] == 0x88)\r
+ // When the UID is not complete, the 3nd bit (from the right) is set in the SAK. \r
+ if (receivedAnswer[0] &= 0x04)\r
{\r
- // Do cascade level 2 stuff\r
- ///////////////////////////////////////////////////////////////////\r
- // First issue a '95 20' identify request\r
- // Ask for card UID (part 2)\r
- TransmitFor14443a(req4, req4Len, &tsamples, &wait);\r
-\r
- // Store reader command in buffer\r
- if (!LogTrace(cmd4,2,0,GetParity(cmd4,2),TRUE)) break;\r
-\r
- if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) continue;\r
-\r
- //////////////////////////////////////////////////////////////////\r
- // Then Construct SELECT UID (cascasde 2) command\r
- DbpString("Just about to copy the UID out of the cascade 2 id req");\r
- // First copy the 5 bytes (Mifare Classic) after the 95 70\r
- memcpy(cmd5+2,receivedAnswer,5);\r
+ // Transmit SELECT_ALL\r
+ ReaderTransmit(sel_all_c2,sizeof(sel_all_c2));\r
+ \r
+ // Receive the UID\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
+ \r
+ // Construct SELECT UID command\r
+ memcpy(sel_uid_c2+2,receivedAnswer,5);\r
// Secondly compute the two CRC bytes at the end\r
- ComputeCrc14443(CRC_14443_A, cmd4, 7, &cmd5[7], &cmd5[8]);\r
-\r
- // Store reader command in buffer\r
- if (!LogTrace(cmd5,9,0,GetParity(cmd5,9),TRUE)) break;\r
-\r
- CodeIso14443aAsReader(cmd5, sizeof(cmd5));\r
- memcpy(req5, ToSend, ToSendMax); req5Len = ToSendMax;\r
+ AppendCrc14443a(sel_uid_c2,7);\r
\r
- // Select the card\r
- TransmitFor14443a(req4, req4Len, &samples, &wait);\r
- if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) continue;\r
+ // Transmit SELECT_UID\r
+ ReaderTransmit(sel_uid_c2,sizeof(sel_uid_c2));\r
\r
- // Log the SAK\r
- if (!LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE)) break;\r
+ // Receive the SAK\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
}\r
\r
- // Secondly compute the two CRC bytes at the end\r
- ComputeCrc14443(CRC_14443_A, cmd7, 2, &cmd7[2], &cmd7[3]);\r
- CodeIso14443aAsReader(cmd7, sizeof(cmd7));\r
- memcpy(req7, ToSend, ToSendMax); req7Len = ToSendMax;\r
-\r
- // Send authentication request (Mifare Classic)\r
- TransmitFor14443a(req7, req7Len, &samples, &wait);\r
- // Store reader command in buffer\r
- if (!LogTrace(cmd7,4,0,GetParity(cmd7,4),TRUE)) break;\r
+ // Transmit MIFARE_CLASSIC_AUTH\r
+ ReaderTransmit(mf_auth,sizeof(mf_auth));\r
\r
- if(!GetIso14443aAnswerFromTag(receivedAnswer, 100, &samples, &elapsed)) continue;\r
-\r
- // We received probably a random, continue and trace!\r
- if (!LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE)) break;\r
+ // Receive the (16 bit) "random" nonce\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
}\r
\r
// Thats it...\r
DbpIntegers(rsamples, 0xCC, 0xCC);\r
DbpString("ready..");\r
}\r
+\r
+//-----------------------------------------------------------------------------\r
+// Read an ISO 14443a tag. Send out commands and store answers.\r
+//\r
+//-----------------------------------------------------------------------------\r
+void ReaderMifare(DWORD parameter)\r
+{\r
+ \r
+ // Anticollision\r
+ BYTE wupa[] = { 0x52 };\r
+ BYTE sel_all[] = { 0x93,0x20 };\r
+ BYTE sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };\r
+ \r
+ // Mifare AUTH\r
+ BYTE mf_auth[] = { 0x60,0x00,0xf5,0x7b };\r
+ BYTE mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };\r
+ \r
+ BYTE* receivedAnswer = (((BYTE *)BigBuf) + 3560); // was 3560 - tied to other size changes\r
+ traceLen = 0;\r
+ tracing = false;\r
+ \r
+ // Setup SSC\r
+ FpgaSetupSsc();\r
+ \r
+ // Start from off (no field generated)\r
+ // Signal field is off with the appropriate LED\r
+ LED_D_OFF();\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ SpinDelay(200);\r
+ \r
+ SetAdcMuxFor(GPIO_MUXSEL_HIPKD);\r
+ FpgaSetupSsc();\r
+ \r
+ // Now give it time to spin up.\r
+ // Signal field is on with the appropriate LED\r
+ LED_D_ON();\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);\r
+ SpinDelay(200);\r
+ \r
+ LED_A_ON();\r
+ LED_B_OFF();\r
+ LED_C_OFF();\r
+ \r
+ // Broadcast for a card, WUPA (0x52) will force response from all cards in the field\r
+ ReaderTransmitShort(wupa);\r
+ // Receive the ATQA\r
+ ReaderReceive(receivedAnswer);\r
+ // Transmit SELECT_ALL\r
+ ReaderTransmit(sel_all,sizeof(sel_all));\r
+ // Receive the UID\r
+ ReaderReceive(receivedAnswer);\r
+ // Construct SELECT UID command\r
+ // First copy the 5 bytes (Mifare Classic) after the 93 70\r
+ memcpy(sel_uid+2,receivedAnswer,5);\r
+ // Secondly compute the two CRC bytes at the end\r
+ AppendCrc14443a(sel_uid,7);\r
+ \r
+ byte_t nt_diff = 0;\r
+ LED_A_OFF();\r
+ byte_t par = 0;\r
+ byte_t par_mask = 0xff;\r
+ byte_t par_low = 0;\r
+ BOOL led_on = TRUE;\r
+ \r
+ tracing = FALSE;\r
+ byte_t nt[4];\r
+ byte_t nt_attacked[4];\r
+ byte_t par_list[8];\r
+ byte_t ks_list[8];\r
+ num_to_bytes(parameter,4,nt_attacked);\r
+\r
+ while(TRUE)\r
+ {\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ SpinDelay(200);\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);\r
+ \r
+ // Broadcast for a card, WUPA (0x52) will force response from all cards in the field\r
+ ReaderTransmitShort(wupa);\r
+ \r
+ // Test if the action was cancelled\r
+ if(BUTTON_PRESS()) {\r
+ break;\r
+ }\r
+ \r
+ // Receive the ATQA\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
+ \r
+ // Transmit SELECT_ALL\r
+ ReaderTransmit(sel_all,sizeof(sel_all));\r
+ \r
+ // Receive the UID\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
+ \r
+ // Transmit SELECT_UID\r
+ ReaderTransmit(sel_uid,sizeof(sel_uid));\r
+ \r
+ // Receive the SAK\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
+ \r
+ // Transmit MIFARE_CLASSIC_AUTH\r
+ ReaderTransmit(mf_auth,sizeof(mf_auth));\r
+ \r
+ // Receive the (16 bit) "random" nonce\r
+ if (!ReaderReceive(receivedAnswer)) continue;\r
+ memcpy(nt,receivedAnswer,4);\r
+\r
+ // Transmit reader nonce and reader answer\r
+ ReaderTransmitPar(mf_nr_ar,sizeof(mf_nr_ar),par);\r
+ \r
+ // Receive 4 bit answer\r
+ if (ReaderReceive(receivedAnswer))\r
+ {\r
+ if (nt_diff == 0) \r
+ {\r
+ LED_A_ON();\r
+ memcpy(nt_attacked,nt,4);\r
+ par_mask = 0xf8;\r
+ par_low = par & 0x07;\r
+ }\r
+\r
+ if (memcmp(nt,nt_attacked,4) != 0) continue;\r
+\r
+ led_on = !led_on;\r
+ if(led_on) LED_B_ON(); else LED_B_OFF();\r
+ par_list[nt_diff] = par;\r
+ ks_list[nt_diff] = receivedAnswer[0]^0x05;\r
+ \r
+ // Test if the information is complete\r
+ if (nt_diff == 0x07) break;\r
+ \r
+ nt_diff = (nt_diff+1) & 0x07;\r
+ mf_nr_ar[3] = nt_diff << 5;\r
+ par = par_low;\r
+ } else {\r
+ if (nt_diff == 0)\r
+ {\r
+ par++;\r
+ } else {\r
+ par = (((par>>3)+1) << 3) | par_low;\r
+ }\r
+ }\r
+ }\r
+ \r
+ LogTraceInfo(sel_uid+2,4);\r
+ LogTraceInfo(nt,4);\r
+ LogTraceInfo(par_list,8);\r
+ LogTraceInfo(ks_list,8);\r
+ \r
+ // Thats it...\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ LEDsoff();\r
+ tracing = TRUE;\r
+}\r
projects / proxmark3-svn / blobdiff