X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/9455b51c2a0554ea2bd55a28dee5a5c2a6707fc6..a8ee668770c99f651346266a506b79192e944ab3:/armsrc/iso15693.c?ds=sidebyside

diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c
index 7f4cbf8a..a6ad58ae 100644
--- a/armsrc/iso15693.c
+++ b/armsrc/iso15693.c
@@ -1,7 +1,7 @@
 //-----------------------------------------------------------------------------
 // Jonathan Westhues, split Nov 2006
 // Modified by Greg Jones, Jan 2009
-// Modified by Adrian Dabrowski "atrox", Mar-Sept 2010
+// Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
@@ -51,6 +51,7 @@
 // *) signal decoding from the card is still a bit shaky. 
 // *) signal decoding is unable to detect collissions.
 // *) add anti-collission support for inventory-commands 
+// *) read security status of a block
 // *) sniffing and simulation do only support one transmission mode. need to support 
 //		all 8 transmission combinations
 //	*) remove or refactor code under "depricated"
@@ -62,7 +63,7 @@
 #include "apps.h"
 #include "string.h"
 #include "iso15693tools.h"
-
+#include "cmd.h"
 
 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
 
@@ -222,7 +223,7 @@ static void CodeIso15693AsReader256(uint8_t *cmd, int n)
 static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
 {
     int c;
-
+	volatile uint32_t r;
 //    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 	if(*wait < 10) { *wait = 10; }
@@ -230,10 +231,10 @@ static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *w
 //    for(c = 0; c < *wait;) {
 //        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 //            AT91C_BASE_SSC->SSC_THR = 0x00;		// For exact timing!
-//            c++;
+//            ++c;
 //        }
 //        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-//            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
+//            r = AT91C_BASE_SSC->SSC_RHR;
 //            (void)r;
 //        }
 //        WDT_HIT();
@@ -243,13 +244,10 @@ static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *w
     for(;;) {
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
             AT91C_BASE_SSC->SSC_THR = cmd[c];
-            c++;
-            if(c >= len) {
-                break;
-            }
+            if( ++c >= len) break;
         }
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
+            r = AT91C_BASE_SSC->SSC_RHR;
             (void)r;
         }
         WDT_HIT();
@@ -262,23 +260,18 @@ static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *w
 //-----------------------------------------------------------------------------
 static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
 {
-    int c;
-
-//	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR);	// No requirement to energise my coils
+    int c = 0;
+	volatile uint32_t r;
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
 	if(*wait < 10) { *wait = 10; }
 
-    c = 0;
     for(;;) {
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
             AT91C_BASE_SSC->SSC_THR = cmd[c];
-            c++;
-            if(c >= len) {
-                break;
-            }
+            if( ++c >= len) break;
         }
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
+            r = AT91C_BASE_SSC->SSC_RHR;
             (void)r;
         }
         WDT_HIT();
@@ -297,21 +290,19 @@ static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int
 //		number of decoded bytes
 static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 {
-	int c = 0;
-	uint8_t *dest = (uint8_t *)BigBuf;
-	int getNext = 0;
+	uint8_t *dest = BigBuf_get_addr();
 
+	int c = 0;
+	int getNext = FALSE;
 	int8_t prev = 0;
 
-// NOW READ RESPONSE
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
-	//spindelay(60);	// greg - experiment to get rid of some of the 0 byte/failed reads
-	c = 0;
-	getNext = FALSE;
+	SpinDelay(100);	// greg - experiment to get rid of some of the 0 byte/failed reads
+
 	for(;;) {
-		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
 			AT91C_BASE_SSC->SSC_THR = 0x43;
-		}
+
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 			int8_t b;
 			b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
@@ -321,18 +312,7 @@ static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *
 			// every other is Q. We just want power, so abs(I) + abs(Q) is
 			// close to what we want.
 			if(getNext) {
-				int8_t r;
-
-				if(b < 0) {
-					r = -b;
-				} else {
-					r = b;
-				}
-				if(prev < 0) {
-					r -= prev;
-				} else {
-					r += prev;
-				}
+				int8_t r = ABS(b) + ABS(prev);
 
 				dest[c++] = (uint8_t)r;
 
@@ -439,50 +419,35 @@ static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *
 	} // "end if correlation > 0" 	(max/(arraylen(FrameSOF)/skip))
 	return k; // return the number of bytes demodulated
 
-///	DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
-
+//	DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
 }
 
 
 // Now the GetISO15693 message from sniffing command
 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 {
-	int c = 0;
-	uint8_t *dest = (uint8_t *)BigBuf;
-	int getNext = 0;
+	uint8_t *dest = BigBuf_get_addr();
 
+	int c = 0;
+	int getNext = FALSE;
 	int8_t prev = 0;
 
-// NOW READ RESPONSE
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
-	//spindelay(60);	// greg - experiment to get rid of some of the 0 byte/failed reads
-	c = 0;
-	getNext = FALSE;
+	SpinDelay(100);	// greg - experiment to get rid of some of the 0 byte/failed reads
+
 	for(;;) {
-		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
 			AT91C_BASE_SSC->SSC_THR = 0x43;
-		}
+
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-			int8_t b;
-			b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
+			int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
 
 			// The samples are correlations against I and Q versions of the
 			// tone that the tag AM-modulates, so every other sample is I,
 			// every other is Q. We just want power, so abs(I) + abs(Q) is
 			// close to what we want.
 			if(getNext) {
-				int8_t r;
-
-				if(b < 0) {
-					r = -b;
-				} else {
-					r = b;
-				}
-				if(prev < 0) {
-					r -= prev;
-				} else {
-					r += prev;
-				}
+				int8_t r = ABS(b) + ABS(prev);
 
 				dest[c++] = (uint8_t)r;
 
@@ -599,12 +564,14 @@ static void BuildIdentifyRequest(void);
 //-----------------------------------------------------------------------------
 void AcquireRawAdcSamplesIso15693(void)
 {
+	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+
 	int c = 0;
-	uint8_t *dest = (uint8_t *)BigBuf;
 	int getNext = 0;
-
 	int8_t prev = 0;
+	volatile uint32_t r;
 
+	uint8_t *dest = BigBuf_get_addr();
 	BuildIdentifyRequest();
 
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
@@ -621,13 +588,10 @@ void AcquireRawAdcSamplesIso15693(void)
 	for(;;) {
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 			AT91C_BASE_SSC->SSC_THR = ToSend[c];
-			c++;
-			if(c == ToSendMax+3) {
-				break;
-			}
+			if( ++c == ToSendMax+3) break;
 		}
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-			volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
+			r = AT91C_BASE_SSC->SSC_RHR;
 			(void)r;
 		}
 		WDT_HIT();
@@ -638,9 +602,9 @@ void AcquireRawAdcSamplesIso15693(void)
 	c = 0;
 	getNext = FALSE;
 	for(;;) {
-		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY))
 			AT91C_BASE_SSC->SSC_THR = 0x43;
-		}
+		
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 			int8_t b;
 			b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
@@ -650,24 +614,11 @@ void AcquireRawAdcSamplesIso15693(void)
 			// every other is Q. We just want power, so abs(I) + abs(Q) is
 			// close to what we want.
 			if(getNext) {
-				int8_t r;
+				
+				dest[c++] = (uint8_t)(ABS(b) + ABS(prev));
 
-				if(b < 0) {
-					r = -b;
-				} else {
-					r = b;
-				}
-				if(prev < 0) {
-					r -= prev;
-				} else {
-					r += prev;
-				}
-
-				dest[c++] = (uint8_t)r;
-
-				if(c >= 2000) {
-					break;
-				}
+				if(c >= 2000) break;
+				
 			} else {
 				prev = b;
 			}
@@ -680,18 +631,19 @@ void AcquireRawAdcSamplesIso15693(void)
 
 void RecordRawAdcSamplesIso15693(void)
 {
+	uint8_t *dest = BigBuf_get_addr();
+
 	int c = 0;
-	uint8_t *dest = (uint8_t *)BigBuf;
 	int getNext = 0;
-
 	int8_t prev = 0;
 
+	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 	// Setup SSC
 	FpgaSetupSsc();
 
 	// Start from off (no field generated)
-    	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    	SpinDelay(200);
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	SpinDelay(200);
 
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
@@ -714,18 +666,7 @@ void RecordRawAdcSamplesIso15693(void)
 			// every other is Q. We just want power, so abs(I) + abs(Q) is
 			// close to what we want.
 			if(getNext) {
-				int8_t r;
-
-				if(b < 0) {
-					r = -b;
-				} else {
-					r = b;
-				}
-				if(prev < 0) {
-					r -= prev;
-				} else {
-					r += prev;
-				}
+				int8_t r = ABS(b) + ABS(prev);
 
 				dest[c++] = (uint8_t)r;
 
@@ -745,25 +686,27 @@ void RecordRawAdcSamplesIso15693(void)
 
 
 // Initialize the proxmark as iso15k reader 
+// (this might produces glitches that confuse some tags
 void Iso15693InitReader() {
 	LED_A_ON();
 	LED_B_ON();
 	LED_C_OFF();
 	LED_D_OFF();
 	
+	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 	// Setup SSC
-	FpgaSetupSsc();
+	// FpgaSetupSsc();
 
 	// Start from off (no field generated)
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-	SpinDelay(200);
+	SpinDelay(10);
 
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 	FpgaSetupSsc();
 
 	// Give the tags time to energize
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
-	SpinDelay(200);
+	SpinDelay(250);
 
 	LED_A_ON();
 	LED_B_OFF();
@@ -831,24 +774,25 @@ static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
 }
 
 // Now the VICC>VCD responses when we are simulating a tag
- static void BuildInventoryResponse(void)
+ static void BuildInventoryResponse( uint8_t *uid)
 {
 	uint8_t cmd[12];
 
 	uint16_t crc;
 	// one sub-carrier, inventory, 1 slot, fast rate
 	// AFI is at bit 5 (1<<4) when doing an INVENTORY
-	cmd[0] = 0; //(1 << 2) | (1 << 5) | (1 << 1);
-	cmd[1] = 0;
+    //(1 << 2) | (1 << 5) | (1 << 1);
+	cmd[0] = 0; // 
+	cmd[1] = 0; // DSFID (data storage format identifier).  0x00 = not supported
 	// 64-bit UID
-	cmd[2] = 0x32;
-	cmd[3]= 0x4b;
-	cmd[4] = 0x03;
-	cmd[5] = 0x01;
-	cmd[6] = 0x00;
-	cmd[7] = 0x10;
-	cmd[8] = 0x05;
-	cmd[9]= 0xe0;
+	cmd[2] = uid[7]; //0x32;
+	cmd[3] = uid[6]; //0x4b;
+	cmd[4] = uid[5]; //0x03;
+	cmd[5] = uid[4]; //0x01;
+	cmd[6] = uid[3]; //0x00;
+	cmd[7] = uid[2]; //0x10;
+	cmd[8] = uid[1]; //0x05;
+	cmd[9] = uid[0]; //0xe0;
 	//Now the CRC
 	crc = Crc(cmd, 10);
 	cmd[10] = crc & 0xff;
@@ -857,7 +801,7 @@ static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
 	CodeIso15693AsReader(cmd, sizeof(cmd));
 }
 
-// Universal Method for sending to and recv from a tag
+// Universal Method for sending to and recv bytes from a tag
 // 	init ... should we initialize the reader?
 // 	speed ... 0 low speed, 1 hi speed 
 // 	**recv will return you a pointer to the received data
@@ -875,12 +819,12 @@ int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv)
 	LED_C_OFF();
 	LED_D_OFF();
 	
+	if (init) Iso15693InitReader();
+
 	int answerLen=0;
-	uint8_t *answer = (((uint8_t *)BigBuf) + 3660);
-	if (recv!=NULL) memset(BigBuf + 3660, 0, 100);
+	uint8_t *answer = BigBuf_get_addr() + 3660;
+	if (recv != NULL) memset(answer, 0, 100);
 
-	if (init) Iso15693InitReader();
-	
 	if (!speed) {
 		// low speed (1 out of 256)
 		CodeIso15693AsReader256(send, sendlen);
@@ -901,10 +845,7 @@ int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv)
 		*recv=answer;
 	}
 
-	LED_A_OFF();
-	LED_B_OFF();
-	LED_C_OFF();
-	LED_D_OFF();
+	LEDsoff();
 	
 	return answerLen;
 }
@@ -997,31 +938,31 @@ void ReaderIso15693(uint32_t parameter)
 	LED_C_OFF();
 	LED_D_OFF();
 
-//DbpString(parameter);
-
-	//uint8_t *answer0 = (((uint8_t *)BigBuf) + 3560); // allow 100 bytes per reponse (way too much)
-	uint8_t *answer1 = (((uint8_t *)BigBuf) + 3660); //
-	uint8_t *answer2 = (((uint8_t *)BigBuf) + 3760);
-	uint8_t *answer3 = (((uint8_t *)BigBuf) + 3860);
-	//uint8_t *TagUID= (((uint8_t *)BigBuf) + 3960);		// where we hold the uid for hi15reader
-//	int answerLen0 = 0;
 	int answerLen1 = 0;
 	int answerLen2 = 0;
 	int answerLen3 = 0;
-	int i=0; // counter
+	int i = 0;
+	int samples = 0;
+	int tsamples = 0;
+	int wait = 0;
+	int elapsed = 0;
+	uint8_t TagUID[8] = {0x00};
 
+	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
+
+	uint8_t *answer1 = BigBuf_get_addr() + 3660;
+	uint8_t *answer2 = BigBuf_get_addr() + 3760;
+	uint8_t *answer3 = BigBuf_get_addr() + 3860;
 	// Blank arrays
-	memset(BigBuf + 3660, 0, 300);
+	memset(answer1, 0x00, 300);
 
+	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 	// Setup SSC
 	FpgaSetupSsc();
 
 	// Start from off (no field generated)
-    	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    	SpinDelay(200);
-
-	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
-	FpgaSetupSsc();
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	SpinDelay(200);
 
 	// Give the tags time to energize
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
@@ -1032,44 +973,19 @@ void ReaderIso15693(uint32_t parameter)
 	LED_C_OFF();
 	LED_D_OFF();
 
-	int samples = 0;
-	int tsamples = 0;
-	int wait = 0;
-	int elapsed = 0;
-
 	// FIRST WE RUN AN INVENTORY TO GET THE TAG UID
 	// THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
-	 uint8_t TagUID[8];		// where we hold the uid for hi15reader
-
-//	BuildIdentifyRequest();
-//	//TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
-//	TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);	// No longer ToSendMax+3
-//	// Now wait for a response
-//	responseLen0 = GetIso15693AnswerFromTag(receivedAnswer0, 100, &samples, &elapsed) ;
-//	if (responseLen0 >=12) // we should do a better check than this
-//	{
-//		// really we should check it is a valid mesg
-//		// but for now just grab what we think is the uid
-//		TagUID[0] = receivedAnswer0[2];
-//		TagUID[1] = receivedAnswer0[3];
-//		TagUID[2] = receivedAnswer0[4];
-//		TagUID[3] = receivedAnswer0[5];
-//		TagUID[4] = receivedAnswer0[6];
-//		TagUID[5] = receivedAnswer0[7];
-//		TagUID[6] = receivedAnswer0[8]; // IC Manufacturer code
-//	DbpIntegers(TagUID[6],TagUID[5],TagUID[4]);
-//}
 
 	// Now send the IDENTIFY command
 	BuildIdentifyRequest();
-	//TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
-	TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);	// No longer ToSendMax+3
+	
+	TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
+	
 	// Now wait for a response
 	answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
 
 	if (answerLen1 >=12) // we should do a better check than this
 	{
-
 		TagUID[0] = answer1[2];
 		TagUID[1] = answer1[3];
 		TagUID[2] = answer1[4];
@@ -1079,45 +995,27 @@ void ReaderIso15693(uint32_t parameter)
 		TagUID[6] = answer1[8]; // IC Manufacturer code
 		TagUID[7] = answer1[9]; // always E0
 
-		// Now send the SELECT command
-		// since the SELECT command is optional, we should not rely on it.
-////				BuildSelectRequest(TagUID);
-//		TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);	// No longer ToSendMax+3
-		// Now wait for a response
-///		answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
-
-		// Now send the MULTI READ command
-//		BuildArbitraryRequest(*TagUID,parameter);
-///		BuildArbitraryCustomRequest(TagUID,parameter);
-//		BuildReadBlockRequest(*TagUID,parameter);
-//		BuildSysInfoRequest(*TagUID);
-		//TransmitTo15693Tag(ToSend,ToSendMax+3,&tsamples, &wait);
-///		TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);	// No longer ToSendMax+3
-		// Now wait for a response
-///		answerLen3 = GetIso15693AnswerFromTag(answer3, 100, &samples, &elapsed) ;
-
 	}
 
 	Dbprintf("%d octets read from IDENTIFY request:", answerLen1);
 	DbdecodeIso15693Answer(answerLen1,answer1);
-	Dbhexdump(answerLen1,answer1);
+	Dbhexdump(answerLen1,answer1,true);
 
 	// UID is reverse
 	if (answerLen1>=12) 
-		//Dbprintf("UID = %*D",8,TagUID," ");
-		Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",TagUID[7],TagUID[6],TagUID[5],
-			TagUID[4],TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
+		Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
+			TagUID[7],TagUID[6],TagUID[5],TagUID[4],
+			TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
 
 
 	Dbprintf("%d octets read from SELECT request:", answerLen2);
 	DbdecodeIso15693Answer(answerLen2,answer2);
-	Dbhexdump(answerLen2,answer2);
+	Dbhexdump(answerLen2,answer2,true);
 
 	Dbprintf("%d octets read from XXX request:", answerLen3);
 	DbdecodeIso15693Answer(answerLen3,answer3);
-	Dbhexdump(answerLen3,answer3);
+	Dbhexdump(answerLen3,answer3,true);
 
- 
 	// read all pages
 	if (answerLen1>=12 && DEBUG) {
 		i=0;			
@@ -1128,20 +1026,13 @@ void ReaderIso15693(uint32_t parameter)
 			if (answerLen2>0) {
 				Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
 				DbdecodeIso15693Answer(answerLen2,answer2);
-				Dbhexdump(answerLen2,answer2);
+				Dbhexdump(answerLen2,answer2,true);
 				if ( *((uint32_t*) answer2) == 0x07160101 ) break; // exit on NoPageErr 
 			} 
 			i++;
 		} 
 	}
 
-//	str2[0]=0;
-//	for(i = 0; i < responseLen3; i++) {
-//		itoa(str1,receivedAnswer3[i]);
-//		strncat(str2,str1,8);
-//	}
-//	DbpString(str2);
-
 	LED_A_OFF();
 	LED_B_OFF();
 	LED_C_OFF();
@@ -1150,31 +1041,29 @@ void ReaderIso15693(uint32_t parameter)
 
 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
 // all demodulation performed in arm rather than host. - greg
-void SimTagIso15693(uint32_t parameter)
+void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 {
 	LED_A_ON();
 	LED_B_ON();
 	LED_C_OFF();
 	LED_D_OFF();
 
-	uint8_t *answer1 = (((uint8_t *)BigBuf) + 3660); //
 	int answerLen1 = 0;
+	int samples = 0;
+	int tsamples = 0;
+	int wait = 0;
+	int elapsed = 0;
 
-	// Blank arrays
-	memset(answer1, 0, 100);
-
-	// Setup SSC
-	FpgaSetupSsc();
+	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 
-	// Start from off (no field generated)
-    	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    	SpinDelay(200);
+	uint8_t *buf = BigBuf_get_addr() + 3660;
+	memset(buf, 0x00, 100);
 
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 	FpgaSetupSsc();
 
-	// Give the tags time to energize
-//	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);	// NO GOOD FOR SIM TAG!!!!
+	// Start from off (no field generated)
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	SpinDelay(200);
 
 	LED_A_OFF();
@@ -1182,24 +1071,26 @@ void SimTagIso15693(uint32_t parameter)
 	LED_C_ON();
 	LED_D_OFF();
 
-	int samples = 0;
-	int tsamples = 0;
-	int wait = 0;
-	int elapsed = 0;
-
-	answerLen1 = GetIso15693AnswerFromSniff(answer1, 100, &samples, &elapsed) ;
+	// Listen to reader
+	answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
 
 	if (answerLen1 >=1) // we should do a better check than this
 	{
 		// Build a suitable reponse to the reader INVENTORY cocmmand
-		BuildInventoryResponse();
+		// not so obsvious, but in the call to BuildInventoryResponse,  the command is copied to the global ToSend buffer used below.
+		
+		BuildInventoryResponse(uid);
+	
 		TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
 	}
 
 	Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
-		answer1[0], answer1[1], answer1[2],
-		answer1[3], answer1[4], answer1[5],
-		answer1[6], answer1[7], answer1[8]);
+		buf[0], buf[1], buf[2],	buf[3],
+		buf[4], buf[5],	buf[6], buf[7], buf[8]);
+
+	Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x",
+		uid[0], uid[1], uid[2],	uid[3],
+		uid[4], uid[5],	uid[6], uid[7]);
 
 	LED_A_OFF();
 	LED_B_OFF();
@@ -1257,28 +1148,25 @@ void BruteforceIso15693Afi(uint32_t speed)
 void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
 
 	int recvlen=0;
-	uint8_t *recvbuf=(uint8_t *)BigBuf;
-	UsbCommand n;
+	uint8_t *recvbuf = BigBuf_get_addr();
+//	UsbCommand n;
 	
 	if (DEBUG) {
 		Dbprintf("SEND");
-		Dbhexdump(datalen,data);	
+		Dbhexdump(datalen,data,true);
 	}
 	
 	recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
 
 	if (recv) { 
-		n.cmd=/* CMD_ISO_15693_COMMAND_DONE */ CMD_ACK;
-		n.arg[0]=recvlen>48?48:recvlen;
-		memcpy(n.d.asBytes, recvbuf, 48);
 		LED_B_ON();
-		UsbSendPacket((uint8_t *)&n, sizeof(n));
+    cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
 		LED_B_OFF();	
 		
 		if (DEBUG) {
 			Dbprintf("RECV");
 			DbdecodeIso15693Answer(recvlen,recvbuf); 
-			Dbhexdump(recvlen,recvbuf); 
+			Dbhexdump(recvlen,recvbuf,true);
 		}
 	}
 
@@ -1291,6 +1179,7 @@ void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8
 // -- Misc & deprecated functions
 // --------------------------------------------------------------------
 
+/*
 
 // do not use; has a fix UID
 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
@@ -1322,47 +1211,6 @@ static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
 	CodeIso15693AsReader(cmd, sizeof(cmd));
 }
 
-// do not use; has a fix UID
-static void __attribute__((unused)) BuildSelectRequest( uint8_t uid[])
-{
-
-//	uid[6]=0x31;  // this is getting ignored - the uid array is not happening...
-	uint8_t cmd[12];
-
-	uint16_t crc;
-	// one sub-carrier, inventory, 1 slot, fast rate
-	//cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);	// INVENTROY FLAGS
-	cmd[0] = (1 << 4) | (1 << 5) | (1 << 1);	// Select and addressed FLAGS
-	// SELECT command code
-	cmd[1] = 0x25;
-	// 64-bit UID
-//	cmd[2] = uid[0];//0x32;
-//	cmd[3]= uid[1];//0x4b;
-//	cmd[4] = uid[2];//0x03;
-//	cmd[5] = uid[3];//0x01;
-//	cmd[6] = uid[4];//0x00;
-//	cmd[7] = uid[5];//0x10;
-//	cmd[8] = uid[6];//0x05;
-	cmd[2] = 0x32;//
-	cmd[3] = 0x4b;
-	cmd[4] = 0x03;
-	cmd[5] = 0x01;
-	cmd[6] = 0x00;
-	cmd[7] = 0x10;
-	cmd[8] = 0x05; // infineon?
-
-	cmd[9]= 0xe0; // always e0 (not exactly unique)
-
-//	DbpIntegers(cmd[8],cmd[7],cmd[6]);
-	// Now the CRC
-	crc = Crc(cmd, 10); // the crc needs to be calculated over 10 bytes
-	cmd[10] = crc & 0xff;
-	cmd[11] = crc >> 8;
-
-	CodeIso15693AsReader(cmd, sizeof(cmd));
-}
-
-
 
 // do not use; has a fix UID
 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
@@ -1471,6 +1319,6 @@ static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], u
 
 
 
-
+*/