]> cvs.zerfleddert.de Git - proxmark3-svn/commitdiff
- fixed iso1443a ManchesterDecoder in order to fix broken Snoop/Sniff
authormicki.held@gmx.de <micki.held@gmx.de@ef4ab9da-24cd-11de-8aaa-f3a34680c41f>
Wed, 19 Feb 2014 20:35:04 +0000 (20:35 +0000)
committermicki.held@gmx.de <micki.held@gmx.de@ef4ab9da-24cd-11de-8aaa-f3a34680c41f>
Wed, 19 Feb 2014 20:35:04 +0000 (20:35 +0000)
- enhanced tracing: hf 14a list now shows meaningful timing information. With new option f it also shows the frame delay times (fdt)
- small fix for hf 14b list - it used to run into the trace trailer
- hf 14a sim now obeys iso14443 timing (fdt of 1172 or 1234 resp.)
Note: you need to flash FPGA as well.
More details in http://www.proxmark.org/forum/viewtopic.php?pid=9721#p9721

16 files changed:
armsrc/apps.h
armsrc/epa.c
armsrc/fpgaloader.c
armsrc/iclass.c
armsrc/iso14443a.c
armsrc/iso14443a.h
armsrc/mifarecmd.c
armsrc/mifaresniff.c
armsrc/mifaresniff.h
armsrc/util.c
armsrc/util.h
client/cmdhf14a.c
client/cmdhf14b.c
client/cmdhfmf.c
fpga/fpga.bit
fpga/hi_iso14443a.v

index 4e99b1aa58561c2f6c37d33b43a9e7545d1d2ce8..497692be119cacd0fefbd83dddf5b2001e746f63 100644 (file)
@@ -144,7 +144,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param);
 void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data);
 void ReaderIso14443a(UsbCommand * c);
 // Also used in iclass.c
 void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data);
 void ReaderIso14443a(UsbCommand * c);
 // Also used in iclass.c
-int RAMFUNC LogTrace(const uint8_t * btBytes, int iLen, int iSamples, uint32_t dwParity, int bReader);
+bool RAMFUNC LogTrace(const uint8_t * btBytes, uint8_t iLen, uint32_t iSamples, uint32_t dwParity, bool bReader);
 uint32_t GetParity(const uint8_t * pbtCmd, int iLen);
 void iso14a_set_trigger(bool enable);
 void iso14a_clear_trace();
 uint32_t GetParity(const uint8_t * pbtCmd, int iLen);
 void iso14a_set_trigger(bool enable);
 void iso14a_clear_trace();
index 1300b5157da59a519e37f963f1f92ddb2b0ee2a8..b0ae5e0d02eb8fb4d1875ce03b329f492b523f84 100644 (file)
@@ -423,7 +423,7 @@ int EPA_Setup()
        // card select information
        iso14a_card_select_t card_select_info;
        // power up the field
        // card select information
        iso14a_card_select_t card_select_info;
        // power up the field
-       iso14443a_setup();
+       iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
 
        // select the card
        return_code = iso14443a_select_card(uid, &card_select_info, NULL);
 
        // select the card
        return_code = iso14443a_select_card(uid, &card_select_info, NULL);
index e3784bf5b4bade1a8b1d68e34868ada4c6c9660a..1e728e11884be4bbb438756266293be95325c757 100644 (file)
@@ -119,7 +119,7 @@ void FpgaSetupSsc(void)
        AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(8) |     AT91C_SSC_MSBF | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
 
        // clock comes from TK pin, no clock output, outputs change on falling
        AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(8) |     AT91C_SSC_MSBF | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
 
        // clock comes from TK pin, no clock output, outputs change on falling
-       // edge of TK, start on rising edge of TF
+       // edge of TK, sample on rising edge of TK
        AT91C_BASE_SSC->SSC_TCMR = SSC_CLOCK_MODE_SELECT(2) |   SSC_CLOCK_MODE_START(5);
 
        // tx framing is the same as the rx framing
        AT91C_BASE_SSC->SSC_TCMR = SSC_CLOCK_MODE_SELECT(2) |   SSC_CLOCK_MODE_START(5);
 
        // tx framing is the same as the rx framing
@@ -140,12 +140,12 @@ bool FpgaSetupSscDma(uint8_t *buf, int len)
         return false;
     }
 
         return false;
     }
 
-       AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
-       AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) buf;
-       AT91C_BASE_PDC_SSC->PDC_RCR = len;
-       AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) buf;
-       AT91C_BASE_PDC_SSC->PDC_RNCR = len;
-       AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTEN;
+       AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;        // Disable DMA Transfer
+       AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) buf;           // transfer to this memory address
+       AT91C_BASE_PDC_SSC->PDC_RCR = len;                                      // transfer this many bytes
+       AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) buf;          // next transfer to same memory address
+       AT91C_BASE_PDC_SSC->PDC_RNCR = len;                                     // ... with same number of bytes
+       AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTEN;         // go!
     
     return true;
 }
     
     return true;
 }
index c673bb54aacf63417adeafcbf5b2b885b89de4e0..e876132e74fa68d103de8d76dace64194a5d7d65 100644 (file)
@@ -1168,9 +1168,9 @@ void SimulateIClass(uint8_t arg0, uint8_t *datain)
                }
                
                if (tracing) {
                }
                
                if (tracing) {
-                       LogTrace(receivedCmd,len, 0, Uart.parityBits, TRUE);
+                       LogTrace(receivedCmd,len, rsamples, Uart.parityBits, TRUE);
                        if (respdata != NULL) {
                        if (respdata != NULL) {
-                               LogTrace(respdata,respsize, 0, SwapBits(GetParity(respdata,respsize),respsize), FALSE);
+                               LogTrace(respdata,respsize, rsamples, SwapBits(GetParity(respdata,respsize),respsize), FALSE);
                        }
                        if(traceLen > TRACE_SIZE) {
                                DbpString("Trace full");
                        }
                        if(traceLen > TRACE_SIZE) {
                                DbpString("Trace full");
@@ -1349,7 +1349,7 @@ void ReaderTransmitIClass(uint8_t* frame, int len)
        LED_A_ON();
 
   // Store reader command in buffer
        LED_A_ON();
 
   // Store reader command in buffer
-  if (tracing) LogTrace(frame,len,0,par,TRUE);
+  if (tracing) LogTrace(frame,len,rsamples,par,TRUE);
 }
 
 //-----------------------------------------------------------------------------
 }
 
 //-----------------------------------------------------------------------------
@@ -1407,7 +1407,8 @@ int ReaderReceiveIClass(uint8_t* receivedAnswer)
 {
   int samples = 0;
   if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return FALSE;
 {
   int samples = 0;
   if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return FALSE;
-  if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
+  rsamples += samples;
+  if (tracing) LogTrace(receivedAnswer,Demod.len,rsamples,Demod.parityBits,FALSE);
   if(samples == 0) return FALSE;
   return Demod.len;
 }
   if(samples == 0) return FALSE;
   return Demod.len;
 }
index 3f775de5a30af6453431a937bb66e41ce1c6242c..ca888295a7c04c02ff5091d8a0bf98462f3d24df 100644 (file)
 
 static uint32_t iso14a_timeout;
 uint8_t *trace = (uint8_t *) BigBuf+TRACE_OFFSET;
 
 static uint32_t iso14a_timeout;
 uint8_t *trace = (uint8_t *) BigBuf+TRACE_OFFSET;
-int traceLen = 0;
 int rsamples = 0;
 int rsamples = 0;
+int traceLen = 0;
 int tracing = TRUE;
 uint8_t trigger = 0;
 // the block number for the ISO14443-4 PCB
 static uint8_t iso14_pcb_blocknum = 0;
 
 int tracing = TRUE;
 uint8_t trigger = 0;
 // the block number for the ISO14443-4 PCB
 static uint8_t iso14_pcb_blocknum = 0;
 
+//
+// ISO14443 timing:
+//
+// minimum time between the start bits of consecutive transfers from reader to tag: 7000 carrier (13.56Mhz) cycles
+#define REQUEST_GUARD_TIME (7000/16 + 1)
+// minimum time between last modulation of tag and next start bit from reader to tag: 1172 carrier cycles 
+#define FRAME_DELAY_TIME_PICC_TO_PCD (1172/16 + 1) 
+// bool LastCommandWasRequest = FALSE;
+
+//
+// Total delays including SSC-Transfers between ARM and FPGA. These are in carrier clock cycles (1/13,56MHz)
+//
+// When the PM acts as reader and is receiving, it takes 
+// 3 ticks for the A/D conversion
+// 10 ticks ( 16 on average) delay in the modulation detector.
+// 6 ticks until the SSC samples the first data
+// 7*16 ticks to complete the transfer from FPGA to ARM
+// 8 ticks to the next ssp_clk rising edge
+// 4*16 ticks until we measure the time
+// - 8*16 ticks because we measure the time of the previous transfer 
+#define DELAY_AIR2ARM_AS_READER (3 + 10 + 6 + 7*16 + 8 + 4*16 - 8*16) 
+
+// When the PM acts as a reader and is sending, it takes
+// 4*16 ticks until we can write data to the sending hold register
+// 8*16 ticks until the SHR is transferred to the Sending Shift Register
+// 8 ticks until the first transfer starts
+// 8 ticks later the FPGA samples the data
+// 1 tick to assign mod_sig_coil
+#define DELAY_ARM2AIR_AS_READER (4*16 + 8*16 + 8 + 8 + 1)
+
+// When the PM acts as tag and is receiving it takes
+// 12 ticks delay in the RF part,
+// 3 ticks for the A/D conversion,
+// 8 ticks on average until the start of the SSC transfer,
+// 8 ticks until the SSC samples the first data
+// 7*16 ticks to complete the transfer from FPGA to ARM
+// 8 ticks until the next ssp_clk rising edge
+// 3*16 ticks until we measure the time 
+// - 8*16 ticks because we measure the time of the previous transfer 
+#define DELAY_AIR2ARM_AS_TAG (12 + 3 + 8 + 8 + 7*16 + 8 + 3*16 - 8*16)
+// The FPGA will report its internal sending delay in
+uint16_t FpgaSendQueueDelay;
+// the 5 first bits are the number of bits buffered in mod_sig_buf
+// the last three bits are the remaining ticks/2 after the mod_sig_buf shift
+#define DELAY_FPGA_QUEUE (FpgaSendQueueDelay<<1)
+
+// When the PM acts as tag and is sending, it takes
+// 5*16 ticks until we can write data to the sending hold register
+// 8*16 ticks until the SHR is transferred to the Sending Shift Register
+// 8 ticks until the first transfer starts
+// 8 ticks later the FPGA samples the data
+// + a varying number of ticks in the FPGA Delay Queue (mod_sig_buf)
+// + 1 tick to assign mod_sig_coil
+#define DELAY_ARM2AIR_AS_TAG (5*16 + 8*16 + 8 + 8 + DELAY_FPGA_QUEUE + 1)
+
+// When the PM acts as sniffer and is receiving tag data, it takes
+// 3 ticks A/D conversion
+// 16 ticks delay in the modulation detector (on average).
+// + 16 ticks until it's result is sampled.
+// + the delays in transferring data - which is the same for
+// sniffing reader and tag data and therefore not relevant
+#define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 16 + 16) 
+// When the PM acts as sniffer and is receiving tag data, it takes
+// 12 ticks delay in analogue RF receiver
+// 3 ticks A/D conversion
+// 8 ticks on average until we sample the data.
+// + the delays in transferring data - which is the same for
+// sniffing reader and tag data and therefore not relevant
+#define DELAY_READER_AIR2ARM_AS_SNIFFER (12 + 3 + 8) 
+
+//variables used for timing purposes:
+//these are in ssp_clk cycles:
+uint32_t NextTransferTime;
+uint32_t LastTimeProxToAirStart;
+uint32_t LastProxToAirDuration;
+
+
+
 // CARD TO READER - manchester
 // Sequence D: 11110000 modulation with subcarrier during first half
 // Sequence E: 00001111 modulation with subcarrier during second half
 // CARD TO READER - manchester
 // Sequence D: 11110000 modulation with subcarrier during first half
 // Sequence E: 00001111 modulation with subcarrier during second half
@@ -70,7 +150,7 @@ void iso14a_set_trigger(bool enable) {
 }
 
 void iso14a_clear_trace() {
 }
 
 void iso14a_clear_trace() {
-  memset(trace, 0x44, TRACE_SIZE);
+       memset(trace, 0x44, TRACE_SIZE);
        traceLen = 0;
 }
 
        traceLen = 0;
 }
 
@@ -110,274 +190,192 @@ void AppendCrc14443a(uint8_t* data, int len)
 }
 
 // The function LogTrace() is also used by the iClass implementation in iClass.c
 }
 
 // The function LogTrace() is also used by the iClass implementation in iClass.c
-int RAMFUNC LogTrace(const uint8_t * btBytes, int iLen, int iSamples, uint32_t dwParity, int bReader)
+bool RAMFUNC LogTrace(const uint8_t * btBytes, uint8_t iLen, uint32_t timestamp, uint32_t dwParity, bool bReader)
 {
 {
-  // Return when trace is full
-  if (traceLen >= TRACE_SIZE) return FALSE;
-
-  // Trace the random, i'm curious
-  rsamples += iSamples;
-  trace[traceLen++] = ((rsamples >> 0) & 0xff);
-  trace[traceLen++] = ((rsamples >> 8) & 0xff);
-  trace[traceLen++] = ((rsamples >> 16) & 0xff);
-  trace[traceLen++] = ((rsamples >> 24) & 0xff);
-  if (!bReader) {
-    trace[traceLen - 1] |= 0x80;
-  }
-  trace[traceLen++] = ((dwParity >> 0) & 0xff);
-  trace[traceLen++] = ((dwParity >> 8) & 0xff);
-  trace[traceLen++] = ((dwParity >> 16) & 0xff);
-  trace[traceLen++] = ((dwParity >> 24) & 0xff);
-  trace[traceLen++] = iLen;
-  memcpy(trace + traceLen, btBytes, iLen);
-  traceLen += iLen;
-  return TRUE;
+       // Return when trace is full
+       if (traceLen + sizeof(timestamp) + sizeof(dwParity) + iLen >= TRACE_SIZE) {
+               tracing = FALSE;        // don't trace any more
+               return FALSE;
+       }
+       
+       // Trace the random, i'm curious
+       trace[traceLen++] = ((timestamp >> 0) & 0xff);
+       trace[traceLen++] = ((timestamp >> 8) & 0xff);
+       trace[traceLen++] = ((timestamp >> 16) & 0xff);
+       trace[traceLen++] = ((timestamp >> 24) & 0xff);
+       if (!bReader) {
+               trace[traceLen - 1] |= 0x80;
+       }
+       trace[traceLen++] = ((dwParity >> 0) & 0xff);
+       trace[traceLen++] = ((dwParity >> 8) & 0xff);
+       trace[traceLen++] = ((dwParity >> 16) & 0xff);
+       trace[traceLen++] = ((dwParity >> 24) & 0xff);
+       trace[traceLen++] = iLen;
+       if (btBytes != NULL && iLen != 0) {
+               memcpy(trace + traceLen, btBytes, iLen);
+       }
+       traceLen += iLen;
+       return TRUE;
 }
 
 }
 
-//-----------------------------------------------------------------------------
-// The software UART that receives commands from the reader, and its state
-// variables.
+//=============================================================================
+// ISO 14443 Type A - Miller decoder
+//=============================================================================
+// Basics:
+// This decoder is used when the PM3 acts as a tag.
+// The reader will generate "pauses" by temporarily switching of the field. 
+// At the PM3 antenna we will therefore measure a modulated antenna voltage. 
+// The FPGA does a comparison with a threshold and would deliver e.g.:
+// ........  1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 1  .......
+// The Miller decoder needs to identify the following sequences:
+// 2 (or 3) ticks pause followed by 6 (or 5) ticks unmodulated:        pause at beginning - Sequence Z ("start of communication" or a "0")
+// 8 ticks without a modulation:                                                                       no pause - Sequence Y (a "0" or "end of communication" or "no information")
+// 4 ticks unmodulated followed by 2 (or 3) ticks pause:                       pause in second half - Sequence X (a "1")
+// Note 1: the bitstream may start at any time. We therefore need to sync.
+// Note 2: the interpretation of Sequence Y and Z depends on the preceding sequence.
 //-----------------------------------------------------------------------------
 static tUart Uart;
 
 //-----------------------------------------------------------------------------
 static tUart Uart;
 
-static RAMFUNC int MillerDecoding(int bit)
+void UartReset()
 {
 {
-       //int error = 0;
-       int bitright;
+       Uart.state = STATE_UNSYNCD;
+       Uart.bitCount = 0;
+       Uart.len = 0;                                           // number of decoded data bytes
+       Uart.shiftReg = 0;                                      // shiftreg to hold decoded data bits
+       Uart.parityBits = 0;                            // 
+       Uart.twoBits = 0x0000;                          // buffer for 2 Bits
+       Uart.highCnt = 0;
+       Uart.startTime = 0;
+       Uart.endTime = 0;
+}
 
 
-       if(!Uart.bitBuffer) {
-               Uart.bitBuffer = bit ^ 0xFF0;
-               return FALSE;
-       }
-       else {
-               Uart.bitBuffer <<= 4;
-               Uart.bitBuffer ^= bit;
+inline RAMFUNC Modulation_t MillerModulation(uint8_t b)
+{
+       // switch (b & 0x88) {
+               // case 0x00:   return MILLER_MOD_BOTH_HALVES;
+               // case 0x08:   return MILLER_MOD_FIRST_HALF;
+               // case 0x80:   return MILLER_MOD_SECOND_HALF;
+               // case 0x88:   return MILLER_MOD_NOMOD;
+       // }
+       // test the second cycle for a pause. For whatever reason the startbit tends to appear earlier than the rest.
+       switch (b & 0x44) {
+               case 0x00:      return MOD_BOTH_HALVES;
+               case 0x04:      return MOD_FIRST_HALF;
+               case 0x40:      return MOD_SECOND_HALF;
+               default:        return MOD_NOMOD;
        }
        }
+}
 
 
-       int EOC = FALSE;
-
-       if(Uart.state != STATE_UNSYNCD) {
-               Uart.posCnt++;
-
-               if((Uart.bitBuffer & Uart.syncBit) ^ Uart.syncBit) {
-                       bit = 0x00;
-               }
-               else {
-                       bit = 0x01;
-               }
-               if(((Uart.bitBuffer << 1) & Uart.syncBit) ^ Uart.syncBit) {
-                       bitright = 0x00;
-               }
-               else {
-                       bitright = 0x01;
-               }
-               if(bit != bitright) { bit = bitright; }
+// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
+static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
+{
 
 
-               if(Uart.posCnt == 1) {
-                       // measurement first half bitperiod
-                       if(!bit) {
-                               Uart.drop = DROP_FIRST_HALF;
-                       }
-               }
-               else {
-                       // measurement second half bitperiod
-                       if(!bit & (Uart.drop == DROP_NONE)) {
-                               Uart.drop = DROP_SECOND_HALF;
+       Uart.twoBits = (Uart.twoBits << 8) | bit;
+       
+       if (Uart.state == STATE_UNSYNCD) {                                                                                              // not yet synced
+               if (Uart.highCnt < 7) {                                                                                                 // wait for a stable unmodulated signal
+                       if (Uart.twoBits == 0xffff) {
+                               Uart.highCnt++;
+                       } else {
+                               Uart.highCnt = 0;
                        }
                        }
-                       else if(!bit) {
-                               // measured a drop in first and second half
-                               // which should not be possible
-                               Uart.state = STATE_ERROR_WAIT;
-                               //error = 0x01;
+               } else {        
+                       Uart.syncBit = 0xFFFF; // not set
+                       // look for 00xx1111 (the start bit)
+                       if              ((Uart.twoBits & 0x6780) == 0x0780) Uart.syncBit = 7; 
+                       else if ((Uart.twoBits & 0x33C0) == 0x03C0) Uart.syncBit = 6;
+                       else if ((Uart.twoBits & 0x19E0) == 0x01E0) Uart.syncBit = 5;
+                       else if ((Uart.twoBits & 0x0CF0) == 0x00F0) Uart.syncBit = 4;
+                       else if ((Uart.twoBits & 0x0678) == 0x0078) Uart.syncBit = 3;
+                       else if ((Uart.twoBits & 0x033C) == 0x003C) Uart.syncBit = 2;
+                       else if ((Uart.twoBits & 0x019E) == 0x001E) Uart.syncBit = 1;
+                       else if ((Uart.twoBits & 0x00CF) == 0x000F) Uart.syncBit = 0;
+                       if (Uart.syncBit != 0xFFFF) {
+                               Uart.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
+                               Uart.startTime -= Uart.syncBit;
+                               Uart.state = STATE_START_OF_COMMUNICATION;
                        }
                        }
+               }
 
 
-                       Uart.posCnt = 0;
-
-                       switch(Uart.state) {
-                               case STATE_START_OF_COMMUNICATION:
-                                       Uart.shiftReg = 0;
-                                       if(Uart.drop == DROP_SECOND_HALF) {
-                                               // error, should not happen in SOC
-                                               Uart.state = STATE_ERROR_WAIT;
-                                               //error = 0x02;
-                                       }
-                                       else {
-                                               // correct SOC
-                                               Uart.state = STATE_MILLER_Z;
-                                       }
-                                       break;
-
-                               case STATE_MILLER_Z:
-                                       Uart.bitCnt++;
-                                       Uart.shiftReg >>= 1;
-                                       if(Uart.drop == DROP_NONE) {
-                                               // logic '0' followed by sequence Y
-                                               // end of communication
-                                               Uart.state = STATE_UNSYNCD;
-                                               EOC = TRUE;
-                                       }
-                                       // if(Uart.drop == DROP_FIRST_HALF) {
-                                       //      Uart.state = STATE_MILLER_Z; stay the same
-                                       //      we see a logic '0' }
-                                       if(Uart.drop == DROP_SECOND_HALF) {
-                                               // we see a logic '1'
-                                               Uart.shiftReg |= 0x100;
-                                               Uart.state = STATE_MILLER_X;
-                                       }
-                                       break;
-
-                               case STATE_MILLER_X:
-                                       Uart.shiftReg >>= 1;
-                                       if(Uart.drop == DROP_NONE) {
-                                               // sequence Y, we see a '0'
-                                               Uart.state = STATE_MILLER_Y;
-                                               Uart.bitCnt++;
-                                       }
-                                       if(Uart.drop == DROP_FIRST_HALF) {
-                                               // Would be STATE_MILLER_Z
-                                               // but Z does not follow X, so error
-                                               Uart.state = STATE_ERROR_WAIT;
-                                               //error = 0x03;
-                                       }
-                                       if(Uart.drop == DROP_SECOND_HALF) {
-                                               // We see a '1' and stay in state X
-                                               Uart.shiftReg |= 0x100;
-                                               Uart.bitCnt++;
-                                       }
-                                       break;
-
-                               case STATE_MILLER_Y:
-                                       Uart.bitCnt++;
-                                       Uart.shiftReg >>= 1;
-                                       if(Uart.drop == DROP_NONE) {
-                                               // logic '0' followed by sequence Y
-                                               // end of communication
-                                               Uart.state = STATE_UNSYNCD;
-                                               EOC = TRUE;
-                                       }
-                                       if(Uart.drop == DROP_FIRST_HALF) {
-                                               // we see a '0'
-                                               Uart.state = STATE_MILLER_Z;
-                                       }
-                                       if(Uart.drop == DROP_SECOND_HALF) {
-                                               // We see a '1' and go to state X
-                                               Uart.shiftReg |= 0x100;
-                                               Uart.state = STATE_MILLER_X;
-                                       }
-                                       break;
+       } else {
 
 
-                               case STATE_ERROR_WAIT:
-                                       // That went wrong. Now wait for at least two bit periods
-                                       // and try to sync again
-                                       if(Uart.drop == DROP_NONE) {
-                                               Uart.highCnt = 6;
-                                               Uart.state = STATE_UNSYNCD;
+               switch (MillerModulation(Uart.twoBits >> Uart.syncBit)) {
+                       case MOD_FIRST_HALF:                                                                                            // Sequence Z = 0
+                               if (Uart.state == STATE_MILLER_X) {                                                             // error - must not follow after X
+                                       UartReset();
+                                       Uart.highCnt = 6;
+                               } else {
+                                       Uart.bitCount++;
+                                       Uart.shiftReg = (Uart.shiftReg >> 1);                                           // add a 0 to the shiftreg
+                                       Uart.state = STATE_MILLER_Z;
+                                       Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 6;
+                                       if(Uart.bitCount >= 9) {                                                                        // if we decoded a full byte (including parity)
+                                               Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
+                                               Uart.parityBits <<= 1;                                                                  // make room for the parity bit
+                                               Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01);               // store parity bit
+                                               Uart.bitCount = 0;
+                                               Uart.shiftReg = 0;
                                        }
                                        }
-                                       break;
-
-                               default:
+                               }
+                               break;
+                       case MOD_SECOND_HALF:                                                                                           // Sequence X = 1
+                               Uart.bitCount++;
+                               Uart.shiftReg = (Uart.shiftReg >> 1) | 0x100;                                   // add a 1 to the shiftreg
+                               Uart.state = STATE_MILLER_X;
+                               Uart.endTime = Uart.startTime + 8*(9*Uart.len + Uart.bitCount + 1) - 2;
+                               if(Uart.bitCount >= 9) {                                                                                // if we decoded a full byte (including parity)
+                                       Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
+                                       Uart.parityBits <<= 1;                                                                          // make room for the new parity bit
+                                       Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01);                       // store parity bit
+                                       Uart.bitCount = 0;
+                                       Uart.shiftReg = 0;
+                               }
+                               break;
+                       case MOD_NOMOD:                                                                                                         // no modulation in both halves - Sequence Y
+                               if (Uart.state == STATE_MILLER_Z || Uart.state == STATE_MILLER_Y) {     // Y after logic "0" - End of Communication
                                        Uart.state = STATE_UNSYNCD;
                                        Uart.state = STATE_UNSYNCD;
-                                       Uart.highCnt = 0;
-                                       break;
-                       }
-
-                       Uart.drop = DROP_NONE;
-
-                       // should have received at least one whole byte...
-                       if((Uart.bitCnt == 2) && EOC && (Uart.byteCnt > 0)) {
-                               return TRUE;
-                       }
-
-                       if(Uart.bitCnt == 9) {
-                               Uart.output[Uart.byteCnt] = (Uart.shiftReg & 0xff);
-                               Uart.byteCnt++;
-
-                               Uart.parityBits <<= 1;
-                               Uart.parityBits ^= ((Uart.shiftReg >> 8) & 0x01);
-
-                               if(EOC) {
-                                       // when End of Communication received and
-                                       // all data bits processed..
+                                       if(Uart.len == 0 && Uart.bitCount > 0) {                                                                                // if we decoded some bits
+                                               Uart.shiftReg >>= (9 - Uart.bitCount);                                  // add them to the output
+                                               Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
+                                               Uart.parityBits <<= 1;                                                                  // no parity bit - add "0"
+                                               Uart.bitCount--;                                                                                        // last "0" was part of the EOC sequence
+                                       }
                                        return TRUE;
                                }
                                        return TRUE;
                                }
-                               Uart.bitCnt = 0;
-                       }
-
-                       /*if(error) {
-                               Uart.output[Uart.byteCnt] = 0xAA;
-                               Uart.byteCnt++;
-                               Uart.output[Uart.byteCnt] = error & 0xFF;
-                               Uart.byteCnt++;
-                               Uart.output[Uart.byteCnt] = 0xAA;
-                               Uart.byteCnt++;
-                               Uart.output[Uart.byteCnt] = (Uart.bitBuffer >> 8) & 0xFF;
-                               Uart.byteCnt++;
-                               Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
-                               Uart.byteCnt++;
-                               Uart.output[Uart.byteCnt] = (Uart.syncBit >> 3) & 0xFF;
-                               Uart.byteCnt++;
-                               Uart.output[Uart.byteCnt] = 0xAA;
-                               Uart.byteCnt++;
-                               return TRUE;
-                       }*/
-               }
-
-       }
-       else {
-               bit = Uart.bitBuffer & 0xf0;
-               bit >>= 4;
-               bit ^= 0x0F;
-               if(bit) {
-                       // should have been high or at least (4 * 128) / fc
-                       // according to ISO this should be at least (9 * 128 + 20) / fc
-                       if(Uart.highCnt == 8) {
-                               // we went low, so this could be start of communication
-                               // it turns out to be safer to choose a less significant
-                               // syncbit... so we check whether the neighbour also represents the drop
-                               Uart.posCnt = 1;   // apparently we are busy with our first half bit period
-                               Uart.syncBit = bit & 8;
-                               Uart.samples = 3;
-                               if(!Uart.syncBit)       { Uart.syncBit = bit & 4; Uart.samples = 2; }
-                               else if(bit & 4)        { Uart.syncBit = bit & 4; Uart.samples = 2; bit <<= 2; }
-                               if(!Uart.syncBit)       { Uart.syncBit = bit & 2; Uart.samples = 1; }
-                               else if(bit & 2)        { Uart.syncBit = bit & 2; Uart.samples = 1; bit <<= 1; }
-                               if(!Uart.syncBit)       { Uart.syncBit = bit & 1; Uart.samples = 0;
-                                       if(Uart.syncBit && (Uart.bitBuffer & 8)) {
-                                               Uart.syncBit = 8;
-
-                                               // the first half bit period is expected in next sample
-                                               Uart.posCnt = 0;
-                                               Uart.samples = 3;
+                               if (Uart.state == STATE_START_OF_COMMUNICATION) {                               // error - must not follow directly after SOC
+                                       UartReset();
+                                       Uart.highCnt = 6;
+                               } else {                                                                                                                // a logic "0"
+                                       Uart.bitCount++;
+                                       Uart.shiftReg = (Uart.shiftReg >> 1);                                           // add a 0 to the shiftreg
+                                       Uart.state = STATE_MILLER_Y;
+                                       if(Uart.bitCount >= 9) {                                                                        // if we decoded a full byte (including parity)
+                                               Uart.output[Uart.len++] = (Uart.shiftReg & 0xff);
+                                               Uart.parityBits <<= 1;                                                                  // make room for the parity bit
+                                               Uart.parityBits |= ((Uart.shiftReg >> 8) & 0x01);               // store parity bit
+                                               Uart.bitCount = 0;
+                                               Uart.shiftReg = 0;
                                        }
                                }
                                        }
                                }
-                               else if(bit & 1)        { Uart.syncBit = bit & 1; Uart.samples = 0; }
-
-                               Uart.syncBit <<= 4;
-                               Uart.state = STATE_START_OF_COMMUNICATION;
-                               Uart.drop = DROP_FIRST_HALF;
-                               Uart.bitCnt = 0;
-                               Uart.byteCnt = 0;
-                               Uart.parityBits = 0;
-                               //error = 0;
-                       }
-                       else {
-                               Uart.highCnt = 0;
-                       }
-               }
-               else {
-                       if(Uart.highCnt < 8) {
-                               Uart.highCnt++;
-                       }
+                               break;
+                       case MOD_BOTH_HALVES:                                                                                           // Error
+                               UartReset();
+                               Uart.highCnt = 6;
+                               return FALSE;
                }
                }
-       }
+                       
+       } 
 
 
-    return FALSE;
+    return FALSE;      // not finished yet, need more data
 }
 
 }
 
+
+
 //=============================================================================
 // ISO 14443 Type A - Manchester decoder
 //=============================================================================
 // Basics:
 //=============================================================================
 // ISO 14443 Type A - Manchester decoder
 //=============================================================================
 // Basics:
+// This decoder is used when the PM3 acts as a reader.
 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
 // The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
 // at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
 // ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
@@ -386,105 +384,95 @@ static RAMFUNC int MillerDecoding(int bit)
 // 4 ticks unmodulated followed by 4 ticks modulated:  Sequence E = 0
 // 8 ticks unmodulated:                                                                        Sequence F = end of communication
 // 8 ticks modulated:                                                                  A collision. Save the collision position and treat as Sequence D
 // 4 ticks unmodulated followed by 4 ticks modulated:  Sequence E = 0
 // 8 ticks unmodulated:                                                                        Sequence F = end of communication
 // 8 ticks modulated:                                                                  A collision. Save the collision position and treat as Sequence D
-// Note 1: the bitstream may start at any time (either in first or second nibble within the parameter bit). We therefore need to sync.
+// Note 1: the bitstream may start at any time. We therefore need to sync.
 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
 static tDemod Demod;
 
 // Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
 static tDemod Demod;
 
-inline RAMFUNC bool IsModulation(byte_t b)
-{
-       if (b >= 5 || b == 3)           // majority decision: 2 or more bits are set
-               return true;
-       else
-               return false;
-       
-}
+const bool Mod_Manchester_LUT[] = {
+       FALSE, FALSE, FALSE, FALSE, FALSE, FALSE, TRUE, TRUE,
+       FALSE, FALSE, TRUE, TRUE, TRUE, TRUE, TRUE, TRUE
+};
+
+#define IsManchesterModulationNibble1(b) (Mod_Manchester_LUT[(b & 0x00F0) >> 4])
+#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
 
 
-inline RAMFUNC bool IsModulationNibble1(byte_t b)
-{
-       return IsModulation((b & 0xE0) >> 5);
-}
 
 
-inline RAMFUNC bool IsModulationNibble2(byte_t b)
+void DemodReset()
 {
 {
-       return IsModulation((b & 0x0E) >> 1);
+       Demod.state = DEMOD_UNSYNCD;
+       Demod.len = 0;                                          // number of decoded data bytes
+       Demod.shiftReg = 0;                                     // shiftreg to hold decoded data bits
+       Demod.parityBits = 0;                           // 
+       Demod.collisionPos = 0;                         // Position of collision bit
+       Demod.twoBits = 0xffff;                         // buffer for 2 Bits
+       Demod.highCnt = 0;
+       Demod.startTime = 0;
+       Demod.endTime = 0;
 }
 
 }
 
-static RAMFUNC int ManchesterDecoding(int bit, uint16_t offset)
+// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
+static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
 {
 {
+
+       Demod.twoBits = (Demod.twoBits << 8) | bit;
        
        
-       switch (Demod.state) {
-
-               case DEMOD_UNSYNCD:                                             // not yet synced
-                       Demod.len = 0;                                          // initialize number of decoded data bytes
-                       Demod.bitCount = offset;                        // initialize number of decoded data bits
-                       Demod.shiftReg = 0;                                     // initialize shiftreg to hold decoded data bits
-                       Demod.parityBits = 0;                           // initialize parity bits
-                       Demod.collisionPos = 0;                         // Position of collision bit
-                       
-                       if (IsModulationNibble1(bit) 
-                               && !IsModulationNibble2(bit)) {                                                         // this is the start bit
-                               Demod.samples = 8;
-                               if(trigger) LED_A_OFF();
+       if (Demod.state == DEMOD_UNSYNCD) {
+
+               if (Demod.highCnt < 2) {                                                                                        // wait for a stable unmodulated signal
+                       if (Demod.twoBits == 0x0000) {
+                               Demod.highCnt++;
+                       } else {
+                               Demod.highCnt = 0;
+                       }
+               } else {
+                       Demod.syncBit = 0xFFFF;                 // not set
+                       if              ((Demod.twoBits & 0x7700) == 0x7000) Demod.syncBit = 7; 
+                       else if ((Demod.twoBits & 0x3B80) == 0x3800) Demod.syncBit = 6;
+                       else if ((Demod.twoBits & 0x1DC0) == 0x1C00) Demod.syncBit = 5;
+                       else if ((Demod.twoBits & 0x0EE0) == 0x0E00) Demod.syncBit = 4;
+                       else if ((Demod.twoBits & 0x0770) == 0x0700) Demod.syncBit = 3;
+                       else if ((Demod.twoBits & 0x03B8) == 0x0380) Demod.syncBit = 2;
+                       else if ((Demod.twoBits & 0x01DC) == 0x01C0) Demod.syncBit = 1;
+                       else if ((Demod.twoBits & 0x00EE) == 0x00E0) Demod.syncBit = 0;
+                       if (Demod.syncBit < 8) {
+                               Demod.startTime = non_real_time?non_real_time:(GetCountSspClk() & 0xfffffff8);
+                               Demod.startTime -= Demod.syncBit;
+                               Demod.bitCount = offset;                        // number of decoded data bits
                                Demod.state = DEMOD_MANCHESTER_DATA;
                                Demod.state = DEMOD_MANCHESTER_DATA;
-                       } else if (!IsModulationNibble1(bit) && IsModulationNibble2(bit)) { // this may be the first half of the start bit
-                                       Demod.samples = 4;
-                                       Demod.state = DEMOD_HALF_SYNCD;
                        }
                        }
-                       break;
+               }
 
 
+       } else {
 
 
-               case DEMOD_HALF_SYNCD:
-                       Demod.samples += 8;
-                       if (IsModulationNibble1(bit)) {                                                         // error: this was not a start bit.
-                               Demod.state = DEMOD_UNSYNCD;
-                       } else {
-                               if (IsModulationNibble2(bit)) {                                                 // modulation in first half
-                                       Demod.state = DEMOD_MOD_FIRST_HALF;
-                               } else {                                                                                                // no modulation in first half
-                                       Demod.state = DEMOD_NOMOD_FIRST_HALF;
-                               }
-                       }
-                       break;
-                       
-                       
-               case DEMOD_MOD_FIRST_HALF:
-                       Demod.samples += 8;
-                       Demod.bitCount++;
-                       if (IsModulationNibble1(bit)) {                                                         // modulation in both halfs - collision
+               if (IsManchesterModulationNibble1(Demod.twoBits >> Demod.syncBit)) {            // modulation in first half
+                       if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) {    // ... and in second half = collision
                                if (!Demod.collisionPos) {
                                        Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
                                }
                        }                                                                                                                       // modulation in first half only - Sequence D = 1
                                if (!Demod.collisionPos) {
                                        Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
                                }
                        }                                                                                                                       // modulation in first half only - Sequence D = 1
-                       Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100;                         // add a 1 to the shiftreg
-                       if(Demod.bitCount >= 9) {                                                                       // if we decoded a full byte (including parity)
-                               Demod.parityBits <<= 1;                                                                 // make room for the parity bit
+                       Demod.bitCount++;
+                       Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100;                         // in both cases, add a 1 to the shiftreg
+                       if(Demod.bitCount == 9) {                                                                       // if we decoded a full byte (including parity)
                                Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
                                Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
+                               Demod.parityBits <<= 1;                                                                 // make room for the parity bit
                                Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01);     // store parity bit
                                Demod.bitCount = 0;
                                Demod.shiftReg = 0;
                        }
                                Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01);     // store parity bit
                                Demod.bitCount = 0;
                                Demod.shiftReg = 0;
                        }
-                       if (IsModulationNibble2(bit)) {                                                         // modulation in first half
-                               Demod.state = DEMOD_MOD_FIRST_HALF;
-                       } else {                                                                                                        // no modulation in first half
-                               Demod.state = DEMOD_NOMOD_FIRST_HALF;
-                       }
-                       break;
-
-
-               case DEMOD_NOMOD_FIRST_HALF:
-                       if (IsModulationNibble1(bit)) {                                                         // modulation in second half only - Sequence E = 0
+                       Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1) - 4;
+               } else {                                                                                                                // no modulation in first half
+                       if (IsManchesterModulationNibble2(Demod.twoBits >> Demod.syncBit)) {    // and modulation in second half = Sequence E = 0
                                Demod.bitCount++;
                                Demod.bitCount++;
-                               Demod.samples += 8;
-                               Demod.shiftReg = (Demod.shiftReg >> 1);                                 // add a 0 to the shiftreg
+                               Demod.shiftReg = (Demod.shiftReg >> 1);                                 // add a 0 to the shiftreg
                                if(Demod.bitCount >= 9) {                                                               // if we decoded a full byte (including parity)
                                if(Demod.bitCount >= 9) {                                                               // if we decoded a full byte (including parity)
-                                       Demod.parityBits <<= 1;                                                         // make room for the new parity bit
                                        Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
                                        Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
+                                       Demod.parityBits <<= 1;                                                         // make room for the new parity bit
                                        Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
                                        Demod.bitCount = 0;
                                        Demod.shiftReg = 0;
                                }
                                        Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
                                        Demod.bitCount = 0;
                                        Demod.shiftReg = 0;
                                }
+                               Demod.endTime = Demod.startTime + 8*(9*Demod.len + Demod.bitCount + 1);
                        } else {                                                                                                        // no modulation in both halves - End of communication
                        } else {                                                                                                        // no modulation in both halves - End of communication
-                               Demod.samples += 4;
                                if(Demod.bitCount > 0) {                                                                // if we decoded bits
                                        Demod.shiftReg >>= (9 - Demod.bitCount);                        // add the remaining decoded bits to the output
                                        Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
                                if(Demod.bitCount > 0) {                                                                // if we decoded bits
                                        Demod.shiftReg >>= (9 - Demod.bitCount);                        // add the remaining decoded bits to the output
                                        Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
@@ -492,55 +480,10 @@ static RAMFUNC int ManchesterDecoding(int bit, uint16_t offset)
                                        Demod.parityBits <<= 1;
                                }
                                Demod.state = DEMOD_UNSYNCD;                                                    // start from the beginning
                                        Demod.parityBits <<= 1;
                                }
                                Demod.state = DEMOD_UNSYNCD;                                                    // start from the beginning
+                               Demod.twoBits = 0;
                                return TRUE;                                                                                    // we are finished with decoding the raw data sequence
                        }
                                return TRUE;                                                                                    // we are finished with decoding the raw data sequence
                        }
-                       if (IsModulationNibble2(bit)) {                                                         // modulation in first half
-                               Demod.state = DEMOD_MOD_FIRST_HALF;
-                       } else {                                                                                                        // no modulation in first half
-                               Demod.state = DEMOD_NOMOD_FIRST_HALF;
-                       }
-                       break;
-                       
-
-               case DEMOD_MANCHESTER_DATA:
-                       Demod.samples += 8;
-                       if (IsModulationNibble1(bit)) {                                                                 // modulation in first half
-                               if (IsModulationNibble2(bit) & 0x0f) {                                          // ... and in second half = collision
-                                       if (!Demod.collisionPos) {
-                                               Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
-                                       }
-                               }                                                                                                               // modulation in first half only - Sequence D = 1
-                               Demod.bitCount++;
-                               Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100;                 // in both cases, add a 1 to the shiftreg
-                               if(Demod.bitCount >= 9) {                                                               // if we decoded a full byte (including parity)
-                                       Demod.parityBits <<= 1;                                                         // make room for the parity bit
-                                       Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
-                                       Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
-                                       Demod.bitCount = 0;
-                                       Demod.shiftReg = 0;
-                               }
-                       } else {                                                                                                        // no modulation in first half
-                               if (IsModulationNibble2(bit)) {                                                 // and modulation in second half = Sequence E = 0
-                                       Demod.bitCount++;
-                                       Demod.shiftReg = (Demod.shiftReg >> 1);                         // add a 0 to the shiftreg
-                                       if(Demod.bitCount >= 9) {                                                       // if we decoded a full byte (including parity)
-                                               Demod.parityBits <<= 1;                                                 // make room for the new parity bit
-                                               Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
-                                               Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
-                                               Demod.bitCount = 0;
-                                               Demod.shiftReg = 0;
-                                       }
-                               } else {                                                                                                // no modulation in both halves - End of communication
-                                       if(Demod.bitCount > 0) {                                                        // if we decoded bits
-                                               Demod.shiftReg >>= (9 - Demod.bitCount);                // add the remaining decoded bits to the output
-                                               Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
-                                               // No parity bit, so just shift a 0
-                                               Demod.parityBits <<= 1;
-                                       }
-                                       Demod.state = DEMOD_UNSYNCD;                                            // start from the beginning
-                                       return TRUE;                                                                            // we are finished with decoding the raw data sequence
-                               }
-                       }
+               }
                        
        } 
 
                        
        } 
 
@@ -570,8 +513,8 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
        // a good trigger condition to get started is probably when we see a
        // response from the tag.
        // triggered == FALSE -- to wait first for card
        // a good trigger condition to get started is probably when we see a
        // response from the tag.
        // triggered == FALSE -- to wait first for card
-       int triggered = !(param & 0x03); 
-
+       bool triggered = !(param & 0x03); 
+       
        // The command (reader -> tag) that we're receiving.
        // The length of a received command will in most cases be no more than 18 bytes.
        // So 32 should be enough!
        // The command (reader -> tag) that we're receiving.
        // The length of a received command will in most cases be no more than 18 bytes.
        // So 32 should be enough!
@@ -584,40 +527,31 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
        //uint8_t *trace = (uint8_t *)BigBuf;
        
        // The DMA buffer, used to stream samples from the FPGA
        //uint8_t *trace = (uint8_t *)BigBuf;
        
        // The DMA buffer, used to stream samples from the FPGA
-       int8_t *dmaBuf = ((int8_t *)BigBuf) + DMA_BUFFER_OFFSET;
-       int8_t *data = dmaBuf;
+       uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
+       uint8_t *data = dmaBuf;
+       uint8_t previous_data = 0;
        int maxDataLen = 0;
        int dataLen = 0;
        int maxDataLen = 0;
        int dataLen = 0;
+       bool TagIsActive = FALSE;
+       bool ReaderIsActive = FALSE;
+       
+       iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
 
        // Set up the demodulator for tag -> reader responses.
        Demod.output = receivedResponse;
 
        // Set up the demodulator for tag -> reader responses.
        Demod.output = receivedResponse;
-       Demod.len = 0;
-       Demod.state = DEMOD_UNSYNCD;
 
        // Set up the demodulator for the reader -> tag commands
 
        // Set up the demodulator for the reader -> tag commands
-       memset(&Uart, 0, sizeof(Uart));
        Uart.output = receivedCmd;
        Uart.output = receivedCmd;
-       Uart.byteCntMax = 32;                        // was 100 (greg)//////////////////
-       Uart.state = STATE_UNSYNCD;
 
 
-       // Setup for the DMA.
-       FpgaSetupSsc();
+       // Setup and start DMA.
        FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
        FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
-
-       // And put the FPGA in the appropriate mode
-       // Signal field is off with the appropriate LED
-       LED_D_OFF();
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER);
-       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
-
-       // Count of samples received so far, so that we can include timing
-       // information in the trace buffer.
-       rsamples = 0;
+       
        // And now we loop, receiving samples.
        // And now we loop, receiving samples.
-       while(true) {
+       for(uint32_t rsamples = 0; TRUE; ) {
+
                if(BUTTON_PRESS()) {
                        DbpString("cancelled by button");
                if(BUTTON_PRESS()) {
                        DbpString("cancelled by button");
-                       goto done;
+                       break;
                }
 
                LED_A_ON();
                }
 
                LED_A_ON();
@@ -628,14 +562,14 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
                if (readBufDataP <= dmaBufDataP){
                        dataLen = dmaBufDataP - readBufDataP;
                } else {
                if (readBufDataP <= dmaBufDataP){
                        dataLen = dmaBufDataP - readBufDataP;
                } else {
-                       dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP + 1;
+                       dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
                }
                // test for length of buffer
                if(dataLen > maxDataLen) {
                        maxDataLen = dataLen;
                        if(dataLen > 400) {
                }
                // test for length of buffer
                if(dataLen > maxDataLen) {
                        maxDataLen = dataLen;
                        if(dataLen > 400) {
-                               Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
-                               goto done;
+                               Dbprintf("blew circular buffer! dataLen=%d", dataLen);
+                               break;
                        }
                }
                if(dataLen < 1) continue;
                        }
                }
                if(dataLen < 1) continue;
@@ -644,6 +578,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
                if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
                        AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
                        AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
                if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
                        AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
                        AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
+                       Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary
                }
                // secondary buffer sets as primary, secondary buffer was stopped
                if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
                }
                // secondary buffer sets as primary, secondary buffer was stopped
                if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
@@ -652,39 +587,51 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
                }
 
                LED_A_OFF();
                }
 
                LED_A_OFF();
+               
+               if (rsamples & 0x01) {                          // Need two samples to feed Miller and Manchester-Decoder
 
 
-               rsamples += 4;
-               if(MillerDecoding((data[0] & 0xF0) >> 4)) {
-                       LED_C_ON();
+                       if(!TagIsActive) {              // no need to try decoding reader data if the tag is sending
+                               uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
+                               if (MillerDecoding(readerdata, (rsamples-1)*4)) {
+                                       LED_C_ON();
 
 
-                       // check - if there is a short 7bit request from reader
-                       if ((!triggered) && (param & 0x02) && (Uart.byteCnt == 1) && (Uart.bitCnt = 9)) triggered = TRUE;
+                                       // check - if there is a short 7bit request from reader
+                                       if ((!triggered) && (param & 0x02) && (Uart.len == 1) && (Uart.bitCount == 7)) triggered = TRUE;
 
 
-                       if(triggered) {
-                               if (!LogTrace(receivedCmd, Uart.byteCnt, 0 - Uart.samples, Uart.parityBits, TRUE)) break;
+                                       if(triggered) {
+                                               if (!LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, Uart.parityBits, TRUE)) break;
+                                               if (!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
+                                       }
+                                       /* And ready to receive another command. */
+                                       UartReset();
+                                       /* And also reset the demod code, which might have been */
+                                       /* false-triggered by the commands from the reader. */
+                                       DemodReset();
+                                       LED_B_OFF();
+                               }
+                               ReaderIsActive = (Uart.state != STATE_UNSYNCD);
                        }
                        }
-                       /* And ready to receive another command. */
-                       Uart.state = STATE_UNSYNCD;
-                       /* And also reset the demod code, which might have been */
-                       /* false-triggered by the commands from the reader. */
-                       Demod.state = DEMOD_UNSYNCD;
-                       LED_B_OFF();
-               }
 
 
-               if(ManchesterDecoding(data[0], 0)) {
-                       LED_B_ON();
+                       if(!ReaderIsActive) {           // no need to try decoding tag data if the reader is sending - and we cannot afford the time
+                               uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
+                               if(ManchesterDecoding(tagdata, 0, (rsamples-1)*4)) {
+                                       LED_B_ON();
 
 
-                       if (!LogTrace(receivedResponse, Demod.len, 0 - Demod.samples, Demod.parityBits, FALSE)) break;
+                                       if (!LogTrace(receivedResponse, Demod.len, Demod.startTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, Demod.parityBits, FALSE)) break;
+                                       if (!LogTrace(NULL, 0, Demod.endTime*16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, 0, FALSE)) break;
 
 
-                       if ((!triggered) && (param & 0x01)) triggered = TRUE;
+                                       if ((!triggered) && (param & 0x01)) triggered = TRUE;
 
 
-                       // And ready to receive another response.
-                       memset(&Demod, 0, sizeof(Demod));
-                       Demod.output = receivedResponse;
-                       Demod.state = DEMOD_UNSYNCD;
-                       LED_C_OFF();
+                                       // And ready to receive another response.
+                                       DemodReset();
+                                       LED_C_OFF();
+                               } 
+                               TagIsActive = (Demod.state != DEMOD_UNSYNCD);
+                       }
                }
 
                }
 
+               previous_data = *data;
+               rsamples++;
                data++;
                if(data > dmaBuf + DMA_BUFFER_SIZE) {
                        data = dmaBuf;
                data++;
                if(data > dmaBuf + DMA_BUFFER_SIZE) {
                        data = dmaBuf;
@@ -693,10 +640,9 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
 
        DbpString("COMMAND FINISHED");
 
 
        DbpString("COMMAND FINISHED");
 
-done:
-       AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
-       Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.byteCnt=%x", maxDataLen, Uart.state, Uart.byteCnt);
-       Dbprintf("Uart.byteCntMax=%x, traceLen=%x, Uart.output[0]=%08x", Uart.byteCntMax, traceLen, (int)Uart.output[0]);
+       FpgaDisableSscDma();
+       Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
+       Dbprintf("traceLen=%d, Uart.output[0]=%08x", traceLen, (uint32_t)Uart.output[0]);
        LEDsoff();
 }
 
        LEDsoff();
 }
 
@@ -721,6 +667,7 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity
        
        // Send startbit
        ToSend[++ToSendMax] = SEC_D;
        
        // Send startbit
        ToSend[++ToSendMax] = SEC_D;
+       LastProxToAirDuration = 8 * ToSendMax - 4;
 
        for(i = 0; i < len; i++) {
                int j;
 
        for(i = 0; i < len; i++) {
                int j;
@@ -739,8 +686,10 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity
                // Get the parity bit
                if ((dwParity >> i) & 0x01) {
                        ToSend[++ToSendMax] = SEC_D;
                // Get the parity bit
                if ((dwParity >> i) & 0x01) {
                        ToSend[++ToSendMax] = SEC_D;
+                       LastProxToAirDuration = 8 * ToSendMax - 4;
                } else {
                        ToSend[++ToSendMax] = SEC_E;
                } else {
                        ToSend[++ToSendMax] = SEC_E;
+                       LastProxToAirDuration = 8 * ToSendMax;
                }
        }
 
                }
        }
 
@@ -755,48 +704,6 @@ static void CodeIso14443aAsTag(const uint8_t *cmd, int len){
        CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len));
 }
 
        CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len));
 }
 
-////-----------------------------------------------------------------------------
-//// This is to send a NACK kind of answer, its only 3 bits, I know it should be 4
-////-----------------------------------------------------------------------------
-//static void CodeStrangeAnswerAsTag()
-//{
-//     int i;
-//
-//     ToSendReset();
-//
-//     // Correction bit, might be removed when not needed
-//     ToSendStuffBit(0);
-//     ToSendStuffBit(0);
-//     ToSendStuffBit(0);
-//     ToSendStuffBit(0);
-//     ToSendStuffBit(1);  // 1
-//     ToSendStuffBit(0);
-//     ToSendStuffBit(0);
-//     ToSendStuffBit(0);
-//
-//     // Send startbit
-//     ToSend[++ToSendMax] = SEC_D;
-//
-//     // 0
-//     ToSend[++ToSendMax] = SEC_E;
-//
-//     // 0
-//     ToSend[++ToSendMax] = SEC_E;
-//
-//     // 1
-//     ToSend[++ToSendMax] = SEC_D;
-//
-//     // Send stopbit
-//     ToSend[++ToSendMax] = SEC_F;
-//
-//     // Flush the buffer in FPGA!!
-//     for(i = 0; i < 5; i++) {
-//             ToSend[++ToSendMax] = SEC_F;
-//     }
-//
-//     // Convert from last byte pos to length
-//     ToSendMax++;
-//}
 
 static void Code4bitAnswerAsTag(uint8_t cmd)
 {
 
 static void Code4bitAnswerAsTag(uint8_t cmd)
 {
@@ -821,8 +728,10 @@ static void Code4bitAnswerAsTag(uint8_t cmd)
        for(i = 0; i < 4; i++) {
                if(b & 1) {
                        ToSend[++ToSendMax] = SEC_D;
        for(i = 0; i < 4; i++) {
                if(b & 1) {
                        ToSend[++ToSendMax] = SEC_D;
+                       LastProxToAirDuration = 8 * ToSendMax - 4;
                } else {
                        ToSend[++ToSendMax] = SEC_E;
                } else {
                        ToSend[++ToSendMax] = SEC_E;
+                       LastProxToAirDuration = 8 * ToSendMax;
                }
                b >>= 1;
        }
                }
                b >>= 1;
        }
@@ -830,11 +739,6 @@ static void Code4bitAnswerAsTag(uint8_t cmd)
        // Send stopbit
        ToSend[++ToSendMax] = SEC_F;
 
        // Send stopbit
        ToSend[++ToSendMax] = SEC_F;
 
-       // Flush the buffer in FPGA!!
-       for(i = 0; i < 5; i++) {
-               ToSend[++ToSendMax] = SEC_F;
-       }
-
        // Convert from last byte pos to length
        ToSendMax++;
 }
        // Convert from last byte pos to length
        ToSendMax++;
 }
@@ -853,40 +757,37 @@ static int GetIso14443aCommandFromReader(uint8_t *received, int *len, int maxLen
     FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
 
     // Now run a `software UART' on the stream of incoming samples.
     FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
 
     // Now run a `software UART' on the stream of incoming samples.
+       UartReset();
     Uart.output = received;
     Uart.output = received;
-    Uart.byteCntMax = maxLen;
-    Uart.state = STATE_UNSYNCD;
+
+       // clear RXRDY:
+    uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
     for(;;) {
         WDT_HIT();
 
         if(BUTTON_PRESS()) return FALSE;
 
     for(;;) {
         WDT_HIT();
 
         if(BUTTON_PRESS()) return FALSE;
-
-        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-            AT91C_BASE_SSC->SSC_THR = 0x00;
-        }
+               
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-            uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-                       if(MillerDecoding((b & 0xf0) >> 4)) {
-                               *len = Uart.byteCnt;
-                               return TRUE;
-                       }
-                       if(MillerDecoding(b & 0x0f)) {
-                               *len = Uart.byteCnt;
+            b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+                       if(MillerDecoding(b, 0)) {
+                               *len = Uart.len;
                                return TRUE;
                        }
                                return TRUE;
                        }
-        }
+               }
     }
 }
 
     }
 }
 
-static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, int correctionNeeded);
-int EmSend4bitEx(uint8_t resp, int correctionNeeded);
+static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded);
+int EmSend4bitEx(uint8_t resp, bool correctionNeeded);
 int EmSend4bit(uint8_t resp);
 int EmSend4bit(uint8_t resp);
-int EmSendCmdExPar(uint8_t *resp, int respLen, int correctionNeeded, uint32_t par);
-int EmSendCmdExPar(uint8_t *resp, int respLen, int correctionNeeded, uint32_t par);
-int EmSendCmdEx(uint8_t *resp, int respLen, int correctionNeeded);
+int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
+int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par);
+int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded);
 int EmSendCmd(uint8_t *resp, int respLen);
 int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par);
 int EmSendCmd(uint8_t *resp, int respLen);
 int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par);
+bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
+                                uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity);
 
 static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
 
 
 static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
 
@@ -895,6 +796,7 @@ typedef struct {
   size_t   response_n;
   uint8_t* modulation;
   size_t   modulation_n;
   size_t   response_n;
   uint8_t* modulation;
   size_t   modulation_n;
+  uint32_t ProxToAirDuration;
 } tag_response_info_t;
 
 void reset_free_buffer() {
 } tag_response_info_t;
 
 void reset_free_buffer() {
@@ -902,7 +804,7 @@ void reset_free_buffer() {
 }
 
 bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
 }
 
 bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) {
-       // Exmaple response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
+       // Example response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes
        // This will need the following byte array for a modulation sequence
        //    144        data bits (18 * 8)
        //     18        parity bits
        // This will need the following byte array for a modulation sequence
        //    144        data bits (18 * 8)
        //     18        parity bits
@@ -926,8 +828,9 @@ bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffe
   // Copy the byte array, used for this modulation to the buffer position
   memcpy(response_info->modulation,ToSend,ToSendMax);
   
   // Copy the byte array, used for this modulation to the buffer position
   memcpy(response_info->modulation,ToSend,ToSendMax);
   
-  // Store the number of bytes that were used for encoding/modulation
+  // Store the number of bytes that were used for encoding/modulation and the time needed to transfer them
   response_info->modulation_n = ToSendMax;
   response_info->modulation_n = ToSendMax;
+  response_info->ProxToAirDuration = LastProxToAirDuration;
   
   return true;
 }
   
   return true;
 }
@@ -956,10 +859,9 @@ bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
 void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
 {
        // Enable and clear the trace
 void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
 {
        // Enable and clear the trace
-       tracing = TRUE;
        iso14a_clear_trace();
        iso14a_clear_trace();
+       iso14a_set_tracing(TRUE);
 
 
-       // This function contains the tag emulation
        uint8_t sak;
 
        // The first response contains the ATQA (note: bytes are transmitted in reverse order).
        uint8_t sak;
 
        // The first response contains the ATQA (note: bytes are transmitted in reverse order).
@@ -1034,41 +936,41 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
        uint8_t response6[] = { 0x04, 0x58, 0x00, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS
        ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
 
        uint8_t response6[] = { 0x04, 0x58, 0x00, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS
        ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
 
-  #define TAG_RESPONSE_COUNT 7
-  tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
-    { .response = response1,  .response_n = sizeof(response1)  },  // Answer to request - respond with card type
-    { .response = response2,  .response_n = sizeof(response2)  },  // Anticollision cascade1 - respond with uid
-    { .response = response2a, .response_n = sizeof(response2a) },  // Anticollision cascade2 - respond with 2nd half of uid if asked
-    { .response = response3,  .response_n = sizeof(response3)  },  // Acknowledge select - cascade 1
-    { .response = response3a, .response_n = sizeof(response3a) },  // Acknowledge select - cascade 2
-    { .response = response5,  .response_n = sizeof(response5)  },  // Authentication answer (random nonce)
-    { .response = response6,  .response_n = sizeof(response6)  },  // dummy ATS (pseudo-ATR), answer to RATS
-  };
-
-  // Allocate 512 bytes for the dynamic modulation, created when the reader querries for it
-  // Such a response is less time critical, so we can prepare them on the fly
-  #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
-  #define DYNAMIC_MODULATION_BUFFER_SIZE 512
-  uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
-  uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
-  tag_response_info_t dynamic_response_info = {
-    .response = dynamic_response_buffer,
-    .response_n = 0,
-    .modulation = dynamic_modulation_buffer,
-    .modulation_n = 0
-  };
+       #define TAG_RESPONSE_COUNT 7
+       tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
+               { .response = response1,  .response_n = sizeof(response1)  },  // Answer to request - respond with card type
+               { .response = response2,  .response_n = sizeof(response2)  },  // Anticollision cascade1 - respond with uid
+               { .response = response2a, .response_n = sizeof(response2a) },  // Anticollision cascade2 - respond with 2nd half of uid if asked
+               { .response = response3,  .response_n = sizeof(response3)  },  // Acknowledge select - cascade 1
+               { .response = response3a, .response_n = sizeof(response3a) },  // Acknowledge select - cascade 2
+               { .response = response5,  .response_n = sizeof(response5)  },  // Authentication answer (random nonce)
+               { .response = response6,  .response_n = sizeof(response6)  },  // dummy ATS (pseudo-ATR), answer to RATS
+       };
+
+       // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
+       // Such a response is less time critical, so we can prepare them on the fly
+       #define DYNAMIC_RESPONSE_BUFFER_SIZE 64
+       #define DYNAMIC_MODULATION_BUFFER_SIZE 512
+       uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE];
+       uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE];
+       tag_response_info_t dynamic_response_info = {
+               .response = dynamic_response_buffer,
+               .response_n = 0,
+               .modulation = dynamic_modulation_buffer,
+               .modulation_n = 0
+       };
   
   
-  // Reset the offset pointer of the free buffer
-  reset_free_buffer();
+       // Reset the offset pointer of the free buffer
+       reset_free_buffer();
   
   
-  // Prepare the responses of the anticollision phase
+       // Prepare the responses of the anticollision phase
        // there will be not enough time to do this at the moment the reader sends it REQA
        // there will be not enough time to do this at the moment the reader sends it REQA
-  for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
-    prepare_allocated_tag_modulation(&responses[i]);
-  }
+       for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
+               prepare_allocated_tag_modulation(&responses[i]);
+       }
 
        uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
 
        uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
-       int len;
+       int len = 0;
 
        // To control where we are in the protocol
        int order = 0;
 
        // To control where we are in the protocol
        int order = 0;
@@ -1080,28 +982,22 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
        int cmdsRecvd = 0;
 
        // We need to listen to the high-frequency, peak-detected path.
        int cmdsRecvd = 0;
 
        // We need to listen to the high-frequency, peak-detected path.
-       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
-       FpgaSetupSsc();
+       iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
 
        cmdsRecvd = 0;
 
        cmdsRecvd = 0;
-  tag_response_info_t* p_response;
+       tag_response_info_t* p_response;
 
        LED_A_ON();
        for(;;) {
 
        LED_A_ON();
        for(;;) {
-    // Clean receive command buffer
-    memset(receivedCmd, 0x44, RECV_CMD_SIZE);
-       
+               // Clean receive command buffer
+               
                if(!GetIso14443aCommandFromReader(receivedCmd, &len, RECV_CMD_SIZE)) {
                        DbpString("Button press");
                        break;
                }
                if(!GetIso14443aCommandFromReader(receivedCmd, &len, RECV_CMD_SIZE)) {
                        DbpString("Button press");
                        break;
                }
-    
-               if (tracing) {
-                       LogTrace(receivedCmd,len, 0, Uart.parityBits, TRUE);
-               }
-    
-    p_response = NULL;
-    
+
+               p_response = NULL;
+               
                // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
                // Okay, look at the command now.
                lastorder = order;
                // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
                // Okay, look at the command now.
                lastorder = order;
@@ -1119,79 +1015,100 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
                        p_response = &responses[4]; order = 30;
                } else if(receivedCmd[0] == 0x30) {     // Received a (plain) READ
                        EmSendCmdEx(data+(4*receivedCmd[0]),16,false);
                        p_response = &responses[4]; order = 30;
                } else if(receivedCmd[0] == 0x30) {     // Received a (plain) READ
                        EmSendCmdEx(data+(4*receivedCmd[0]),16,false);
-                       Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
+                       // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
                        // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
                        // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
-      p_response = NULL;
+                       p_response = NULL;
                } else if(receivedCmd[0] == 0x50) {     // Received a HALT
 //                     DbpString("Reader requested we HALT!:");
                } else if(receivedCmd[0] == 0x50) {     // Received a HALT
 //                     DbpString("Reader requested we HALT!:");
-      p_response = NULL;
+                       if (tracing) {
+                               LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                               LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
+                       }
+                       p_response = NULL;
                } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) {   // Received an authentication request
                        p_response = &responses[5]; order = 7;
                } else if(receivedCmd[0] == 0xE0) {     // Received a RATS request
                } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) {   // Received an authentication request
                        p_response = &responses[5]; order = 7;
                } else if(receivedCmd[0] == 0xE0) {     // Received a RATS request
-                       p_response = &responses[6]; order = 70;
-               } else if (order == 7 && len ==8) { // Received authentication request
-      uint32_t nr = bytes_to_num(receivedCmd,4);
-      uint32_t ar = bytes_to_num(receivedCmd+4,4);
-      Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr,ar);
-    } else {
-      // Check for ISO 14443A-4 compliant commands, look at left nibble
-      switch (receivedCmd[0]) {
-
-        case 0x0B:
-        case 0x0A: { // IBlock (command)
-          dynamic_response_info.response[0] = receivedCmd[0];
-          dynamic_response_info.response[1] = 0x00;
-          dynamic_response_info.response[2] = 0x90;
-          dynamic_response_info.response[3] = 0x00;
-          dynamic_response_info.response_n = 4;
-        } break;
-
-        case 0x1A:
-        case 0x1B: { // Chaining command
-          dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
-          dynamic_response_info.response_n = 2;
-        } break;
-
-        case 0xaa:
-        case 0xbb: {
-          dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
-          dynamic_response_info.response_n = 2;
-        } break;
-          
-        case 0xBA: { //
-          memcpy(dynamic_response_info.response,"\xAB\x00",2);
-          dynamic_response_info.response_n = 2;
-        } break;
-
-        case 0xCA:
-        case 0xC2: { // Readers sends deselect command
-          memcpy(dynamic_response_info.response,"\xCA\x00",2);
-          dynamic_response_info.response_n = 2;
-        } break;
-
-        default: {
-          // Never seen this command before
-          Dbprintf("Received unknown command (len=%d):",len);
-          Dbhexdump(len,receivedCmd,false);
-          // Do not respond
-          dynamic_response_info.response_n = 0;
-        } break;
-      }
+                       if (tagType == 1 || tagType == 2) {     // RATS not supported
+                               EmSend4bit(CARD_NACK_NA);
+                               p_response = NULL;
+                       } else {
+                               p_response = &responses[6]; order = 70;
+                       }
+               } else if (order == 7 && len == 8) { // Received authentication request
+                       if (tracing) {
+                               LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                               LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
+                       }
+                       uint32_t nr = bytes_to_num(receivedCmd,4);
+                       uint32_t ar = bytes_to_num(receivedCmd+4,4);
+                       Dbprintf("Auth attempt {nr}{ar}: %08x %08x",nr,ar);
+               } else {
+                       // Check for ISO 14443A-4 compliant commands, look at left nibble
+                       switch (receivedCmd[0]) {
+
+                               case 0x0B:
+                               case 0x0A: { // IBlock (command)
+                                 dynamic_response_info.response[0] = receivedCmd[0];
+                                 dynamic_response_info.response[1] = 0x00;
+                                 dynamic_response_info.response[2] = 0x90;
+                                 dynamic_response_info.response[3] = 0x00;
+                                 dynamic_response_info.response_n = 4;
+                               } break;
+
+                               case 0x1A:
+                               case 0x1B: { // Chaining command
+                                 dynamic_response_info.response[0] = 0xaa | ((receivedCmd[0]) & 1);
+                                 dynamic_response_info.response_n = 2;
+                               } break;
+
+                               case 0xaa:
+                               case 0xbb: {
+                                 dynamic_response_info.response[0] = receivedCmd[0] ^ 0x11;
+                                 dynamic_response_info.response_n = 2;
+                               } break;
+                                 
+                               case 0xBA: { //
+                                 memcpy(dynamic_response_info.response,"\xAB\x00",2);
+                                 dynamic_response_info.response_n = 2;
+                               } break;
+
+                               case 0xCA:
+                               case 0xC2: { // Readers sends deselect command
+                                 memcpy(dynamic_response_info.response,"\xCA\x00",2);
+                                 dynamic_response_info.response_n = 2;
+                               } break;
+
+                               default: {
+                                       // Never seen this command before
+                                       if (tracing) {
+                                               LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                               LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
+                                       }
+                                       Dbprintf("Received unknown command (len=%d):",len);
+                                       Dbhexdump(len,receivedCmd,false);
+                                       // Do not respond
+                                       dynamic_response_info.response_n = 0;
+                               } break;
+                       }
       
       
-      if (dynamic_response_info.response_n > 0) {
-        // Copy the CID from the reader query
-        dynamic_response_info.response[1] = receivedCmd[1];
+                       if (dynamic_response_info.response_n > 0) {
+                               // Copy the CID from the reader query
+                               dynamic_response_info.response[1] = receivedCmd[1];
 
 
-        // Add CRC bytes, always used in ISO 14443A-4 compliant cards
-        AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
-        dynamic_response_info.response_n += 2;
+                               // Add CRC bytes, always used in ISO 14443A-4 compliant cards
+                               AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n);
+                               dynamic_response_info.response_n += 2;
         
         
-        if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
-          Dbprintf("Error preparing tag response");
-          break;
-        }
-        p_response = &dynamic_response_info;
-      }
+                               if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) {
+                                       Dbprintf("Error preparing tag response");
+                                       if (tracing) {
+                                               LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                               LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
+                                       }
+                                       break;
+                               }
+                               p_response = &dynamic_response_info;
+                       }
                }
 
                // Count number of wakeups received after a halt
                }
 
                // Count number of wakeups received after a halt
@@ -1200,12 +1117,6 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
                // Count number of other messages after a halt
                if(order != 6 && lastorder == 5) { happened2++; }
 
                // Count number of other messages after a halt
                if(order != 6 && lastorder == 5) { happened2++; }
 
-               // Look at last parity bit to determine timing of answer
-               if((Uart.parityBits & 0x01) || receivedCmd[0] == 0x52) {
-                       // 1236, so correction bit needed
-                       //i = 0;
-               }
-
                if(cmdsRecvd > 999) {
                        DbpString("1000 commands later...");
                        break;
                if(cmdsRecvd > 999) {
                        DbpString("1000 commands later...");
                        break;
@@ -1213,16 +1124,25 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
                cmdsRecvd++;
 
                if (p_response != NULL) {
                cmdsRecvd++;
 
                if (p_response != NULL) {
-      EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
-      if (tracing) {
-        LogTrace(p_response->response,p_response->response_n,0,SwapBits(GetParity(p_response->response,p_response->response_n),p_response->response_n),FALSE);
-        if(traceLen > TRACE_SIZE) {
-          DbpString("Trace full");
-//          break;
-        }
-      }
-    }
-  }
+                       EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52);
+                       // do the tracing for the previous reader request and this tag answer:
+                       EmLogTrace(Uart.output, 
+                                               Uart.len, 
+                                               Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, 
+                                               Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 
+                                               Uart.parityBits,
+                                               p_response->response, 
+                                               p_response->response_n,
+                                               LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
+                                               (LastTimeProxToAirStart + p_response->ProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG, 
+                                               SwapBits(GetParity(p_response->response, p_response->response_n), p_response->response_n));
+               }
+               
+               if (!tracing) {
+                       Dbprintf("Trace Full. Simulation stopped.");
+                       break;
+               }
+       }
 
        Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
        LED_A_OFF();
 
        Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
        LED_A_OFF();
@@ -1242,7 +1162,7 @@ void PrepareDelayedTransfer(uint16_t delay)
                for (uint16_t i = 0; i < delay; i++) {
                        bitmask |= (0x01 << i);
                }
                for (uint16_t i = 0; i < delay; i++) {
                        bitmask |= (0x01 << i);
                }
-               ToSend[++ToSendMax] = 0x00;
+               ToSend[ToSendMax++] = 0x00;
                for (uint16_t i = 0; i < ToSendMax; i++) {
                        bits_to_shift = ToSend[i] & bitmask;
                        ToSend[i] = ToSend[i] >> delay;
                for (uint16_t i = 0; i < ToSendMax; i++) {
                        bits_to_shift = ToSend[i] & bitmask;
                        ToSend[i] = ToSend[i] >> delay;
@@ -1252,38 +1172,48 @@ void PrepareDelayedTransfer(uint16_t delay)
        }
 }
 
        }
 }
 
-//-----------------------------------------------------------------------------
+
+//-------------------------------------------------------------------------------------
 // Transmit the command (to the tag) that was placed in ToSend[].
 // Parameter timing:
 // Transmit the command (to the tag) that was placed in ToSend[].
 // Parameter timing:
-// if NULL: ignored
-// if == 0:    return time of transfer
+// if NULL: transfer at next possible time, taking into account
+//                     request guard time and frame delay time
+// if == 0:    transfer immediately and return time of transfer
 // if != 0: delay transfer until time specified
 // if != 0: delay transfer until time specified
-//-----------------------------------------------------------------------------
+//-------------------------------------------------------------------------------------
 static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
 {
 static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
 {
-       int c;
-
+       
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
 
+       uint32_t ThisTransferTime = 0;
 
        if (timing) {
                if(*timing == 0) {                                                                              // Measure time
 
        if (timing) {
                if(*timing == 0) {                                                                              // Measure time
-                       *timing = (GetCountMifare() + 8) & 0xfffffff8;
+                       *timing = (GetCountSspClk() + 8) & 0xfffffff8;
                } else {
                        PrepareDelayedTransfer(*timing & 0x00000007);           // Delay transfer (fine tuning - up to 7 MF clock ticks)
                }
                } else {
                        PrepareDelayedTransfer(*timing & 0x00000007);           // Delay transfer (fine tuning - up to 7 MF clock ticks)
                }
-               if(MF_DBGLEVEL >= 4 && GetCountMifare() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
-               while(GetCountMifare() < (*timing & 0xfffffff8));               // Delay transfer (multiple of 8 MF clock ticks)
-       }
-
-       for(c = 0; c < 10;) {   // standard delay for each transfer (allow tag to be ready after last transmission?)
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-                       AT91C_BASE_SSC->SSC_THR = 0x00; 
-                       c++;
-               }
+               if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
+               while(GetCountSspClk() < (*timing & 0xfffffff8));               // Delay transfer (multiple of 8 MF clock ticks)
+               LastTimeProxToAirStart = *timing;
+       } else {
+               ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
+               while(GetCountSspClk() < ThisTransferTime);
+               LastTimeProxToAirStart = ThisTransferTime;
        }
        
        }
        
-       c = 0;
+       // clear TXRDY
+       AT91C_BASE_SSC->SSC_THR = SEC_Y;
+
+       // for(uint16_t c = 0; c < 10;) {       // standard delay for each transfer (allow tag to be ready after last transmission)
+               // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+                       // AT91C_BASE_SSC->SSC_THR = SEC_Y;     
+                       // c++;
+               // }
+       // }
+
+       uint16_t c = 0;
        for(;;) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
                        AT91C_BASE_SSC->SSC_THR = cmd[c];
        for(;;) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
                        AT91C_BASE_SSC->SSC_THR = cmd[c];
@@ -1293,88 +1223,91 @@ static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
                        }
                }
        }
                        }
                }
        }
-
+       
+       NextTransferTime = MAX(NextTransferTime, LastTimeProxToAirStart + REQUEST_GUARD_TIME);
+       
 }
 
 }
 
+
 //-----------------------------------------------------------------------------
 // Prepare reader command (in bits, support short frames) to send to FPGA
 //-----------------------------------------------------------------------------
 void CodeIso14443aBitsAsReaderPar(const uint8_t * cmd, int bits, uint32_t dwParity)
 {
 //-----------------------------------------------------------------------------
 // Prepare reader command (in bits, support short frames) to send to FPGA
 //-----------------------------------------------------------------------------
 void CodeIso14443aBitsAsReaderPar(const uint8_t * cmd, int bits, uint32_t dwParity)
 {
-  int i, j;
-  int last;
-  uint8_t b;
-
-  ToSendReset();
-
-  // Start of Communication (Seq. Z)
-  ToSend[++ToSendMax] = SEC_Z;
-  last = 0;
-
-  size_t bytecount = nbytes(bits);
-  // Generate send structure for the data bits
-  for (i = 0; i < bytecount; i++) {
-    // Get the current byte to send
-    b = cmd[i];
-    size_t bitsleft = MIN((bits-(i*8)),8);
-
-    for (j = 0; j < bitsleft; j++) {
-      if (b & 1) {
-        // Sequence X
-         ToSend[++ToSendMax] = SEC_X;
-        last = 1;
-      } else {
-        if (last == 0) {
-          // Sequence Z
-               ToSend[++ToSendMax] = SEC_Z;
-        } else {
-          // Sequence Y
-               ToSend[++ToSendMax] = SEC_Y;
-          last = 0;
-        }
-      }
-      b >>= 1;
-    }
+       int i, j;
+       int last;
+       uint8_t b;
 
 
-    // Only transmit (last) parity bit if we transmitted a complete byte
-    if (j == 8) {
-      // Get the parity bit
-      if ((dwParity >> i) & 0x01) {
-        // Sequence X
-        ToSend[++ToSendMax] = SEC_X;
-        last = 1;
-      } else {
-        if (last == 0) {
-          // Sequence Z
-          ToSend[++ToSendMax] = SEC_Z;
-        } else {
-          // Sequence Y
-          ToSend[++ToSendMax] = SEC_Y;
-          last = 0;
-        }
-      }
-    }
-  }
+       ToSendReset();
 
 
-  // End of Communication
-  if (last == 0) {
-    // Sequence Z
-         ToSend[++ToSendMax] = SEC_Z;
-  } else {
-    // Sequence Y
-         ToSend[++ToSendMax] = SEC_Y;
-    last = 0;
-  }
-  // Sequence Y
-  ToSend[++ToSendMax] = SEC_Y;
+       // Start of Communication (Seq. Z)
+       ToSend[++ToSendMax] = SEC_Z;
+       LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
+       last = 0;
+
+       size_t bytecount = nbytes(bits);
+       // Generate send structure for the data bits
+       for (i = 0; i < bytecount; i++) {
+               // Get the current byte to send
+               b = cmd[i];
+               size_t bitsleft = MIN((bits-(i*8)),8);
+
+               for (j = 0; j < bitsleft; j++) {
+                       if (b & 1) {
+                               // Sequence X
+                               ToSend[++ToSendMax] = SEC_X;
+                               LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
+                               last = 1;
+                       } else {
+                               if (last == 0) {
+                               // Sequence Z
+                               ToSend[++ToSendMax] = SEC_Z;
+                               LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
+                               } else {
+                                       // Sequence Y
+                                       ToSend[++ToSendMax] = SEC_Y;
+                                       last = 0;
+                               }
+                       }
+                       b >>= 1;
+               }
+
+               // Only transmit (last) parity bit if we transmitted a complete byte
+               if (j == 8) {
+                       // Get the parity bit
+                       if ((dwParity >> i) & 0x01) {
+                               // Sequence X
+                               ToSend[++ToSendMax] = SEC_X;
+                               LastProxToAirDuration = 8 * (ToSendMax+1) - 2;
+                               last = 1;
+                       } else {
+                               if (last == 0) {
+                                       // Sequence Z
+                                       ToSend[++ToSendMax] = SEC_Z;
+                                       LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
+                               } else {
+                                       // Sequence Y
+                                       ToSend[++ToSendMax] = SEC_Y;
+                                       last = 0;
+                               }
+                       }
+               }
+       }
 
 
-  // Just to be sure!
-  ToSend[++ToSendMax] = SEC_Y;
-  ToSend[++ToSendMax] = SEC_Y;
-  ToSend[++ToSendMax] = SEC_Y;
+       // End of Communication: Logic 0 followed by Sequence Y
+       if (last == 0) {
+               // Sequence Z
+               ToSend[++ToSendMax] = SEC_Z;
+               LastProxToAirDuration = 8 * (ToSendMax+1) - 6;
+       } else {
+               // Sequence Y
+               ToSend[++ToSendMax] = SEC_Y;
+               last = 0;
+       }
+       ToSend[++ToSendMax] = SEC_Y;
 
 
-  // Convert from last character reference to length
-  ToSendMax++;
+       // Convert to length of command:
+       ToSendMax++;
 }
 
 //-----------------------------------------------------------------------------
 }
 
 //-----------------------------------------------------------------------------
@@ -1390,7 +1323,7 @@ void CodeIso14443aAsReaderPar(const uint8_t * cmd, int len, uint32_t dwParity)
 // Stop when button is pressed (return 1) or field was gone (return 2)
 // Or return 0 when command is captured
 //-----------------------------------------------------------------------------
 // Stop when button is pressed (return 1) or field was gone (return 2)
 // Or return 0 when command is captured
 //-----------------------------------------------------------------------------
-static int EmGetCmd(uint8_t *received, int *len, int maxLen)
+static int EmGetCmd(uint8_t *received, int *len)
 {
        *len = 0;
 
 {
        *len = 0;
 
@@ -1415,9 +1348,11 @@ static int EmGetCmd(uint8_t *received, int *len, int maxLen)
        AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
        
        // Now run a 'software UART' on the stream of incoming samples.
        AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
        
        // Now run a 'software UART' on the stream of incoming samples.
+       UartReset();
        Uart.output = received;
        Uart.output = received;
-       Uart.byteCntMax = maxLen;
-       Uart.state = STATE_UNSYNCD;
+
+       // Clear RXRDY:
+    uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
        for(;;) {
                WDT_HIT();
 
        for(;;) {
                WDT_HIT();
@@ -1441,98 +1376,157 @@ static int EmGetCmd(uint8_t *received, int *len, int maxLen)
                                analogAVG = 0;
                        }
                }
                                analogAVG = 0;
                        }
                }
-               // transmit none
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-                       AT91C_BASE_SSC->SSC_THR = 0x00;
-               }
+
                // receive and test the miller decoding
                // receive and test the miller decoding
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-                       volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-                       if(MillerDecoding((b & 0xf0) >> 4)) {
-                               *len = Uart.byteCnt;
-                               if (tracing) LogTrace(received, *len, GetDeltaCountUS(), Uart.parityBits, TRUE);
-                               return 0;
-                       }
-                       if(MillerDecoding(b & 0x0f)) {
-                               *len = Uart.byteCnt;
-                               if (tracing) LogTrace(received, *len, GetDeltaCountUS(), Uart.parityBits, TRUE);
+        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
+            b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+                       if(MillerDecoding(b, 0)) {
+                               *len = Uart.len;
                                return 0;
                        }
                                return 0;
                        }
-               }
+        }
+
        }
 }
 
        }
 }
 
-static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, int correctionNeeded)
-{
-       int i, u = 0;
-       uint8_t b = 0;
 
 
+static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, bool correctionNeeded)
+{
+       uint8_t b;
+       uint16_t i = 0;
+       uint32_t ThisTransferTime;
+       
        // Modulate Manchester
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
        // Modulate Manchester
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
-       AT91C_BASE_SSC->SSC_THR = 0x00;
-       FpgaSetupSsc();
-       
-       // include correction bit
-       i = 1;
-       if((Uart.parityBits & 0x01) || correctionNeeded) {
+
+       // include correction bit if necessary
+       if (Uart.parityBits & 0x01) {
+               correctionNeeded = TRUE;
+       }
+       if(correctionNeeded) {
                // 1236, so correction bit needed
                i = 0;
                // 1236, so correction bit needed
                i = 0;
+       } else {
+               i = 1;
        }
        }
+
+       // clear receiving shift register and holding register
+       while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
+       b = AT91C_BASE_SSC->SSC_RHR; (void) b;
+       while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
+       b = AT91C_BASE_SSC->SSC_RHR; (void) b;
        
        
+       // wait for the FPGA to signal fdt_indicator == 1 (the FPGA is ready to queue new data in its delay line)
+       for (uint16_t j = 0; j < 5; j++) {      // allow timeout - better late than never
+               while(!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY));
+               if (AT91C_BASE_SSC->SSC_RHR) break;
+       }
+
+       while ((ThisTransferTime = GetCountSspClk()) & 0x00000007);
+
+       // Clear TXRDY:
+       AT91C_BASE_SSC->SSC_THR = SEC_F;
+
        // send cycle
        // send cycle
-       for(;;) {
-               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-                       volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-                       (void)b;
-               }
+       for(; i <= respLen; ) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-                       if(i > respLen) {
-                               b = 0xff; // was 0x00
-                               u++;
-                       } else {
-                               b = resp[i];
-                               i++;
-                       }
-                       AT91C_BASE_SSC->SSC_THR = b;
-
-                       if(u > 4) break;
+                       AT91C_BASE_SSC->SSC_THR = resp[i++];
+                       FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
                }
                }
+       
                if(BUTTON_PRESS()) {
                        break;
                }
        }
 
                if(BUTTON_PRESS()) {
                        break;
                }
        }
 
+       // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
+       for (i = 0; i < 2 ; ) {
+               if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+                       AT91C_BASE_SSC->SSC_THR = SEC_F;
+                       FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+                       i++;
+               }
+       }
+       
+       LastTimeProxToAirStart = ThisTransferTime + (correctionNeeded?8:0);
+
        return 0;
 }
 
        return 0;
 }
 
-int EmSend4bitEx(uint8_t resp, int correctionNeeded){
-  Code4bitAnswerAsTag(resp);
+int EmSend4bitEx(uint8_t resp, bool correctionNeeded){
+       Code4bitAnswerAsTag(resp);
        int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
        int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
-  if (tracing) LogTrace(&resp, 1, GetDeltaCountUS(), GetParity(&resp, 1), FALSE);
+       // do the tracing for the previous reader request and this tag answer:
+       EmLogTrace(Uart.output, 
+                               Uart.len, 
+                               Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, 
+                               Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 
+                               Uart.parityBits,
+                               &resp, 
+                               1, 
+                               LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
+                               (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG, 
+                               SwapBits(GetParity(&resp, 1), 1));
        return res;
 }
 
 int EmSend4bit(uint8_t resp){
        return res;
 }
 
 int EmSend4bit(uint8_t resp){
-       return EmSend4bitEx(resp, 0);
+       return EmSend4bitEx(resp, false);
 }
 
 }
 
-int EmSendCmdExPar(uint8_t *resp, int respLen, int correctionNeeded, uint32_t par){
-  CodeIso14443aAsTagPar(resp, respLen, par);
+int EmSendCmdExPar(uint8_t *resp, int respLen, bool correctionNeeded, uint32_t par){
+       CodeIso14443aAsTagPar(resp, respLen, par);
        int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
        int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
-  if (tracing) LogTrace(resp, respLen, GetDeltaCountUS(), par, FALSE);
+       // do the tracing for the previous reader request and this tag answer:
+       EmLogTrace(Uart.output, 
+                               Uart.len, 
+                               Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, 
+                               Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 
+                               Uart.parityBits,
+                               resp, 
+                               respLen, 
+                               LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_TAG,
+                               (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_TAG, 
+                               SwapBits(GetParity(resp, respLen), respLen));
        return res;
 }
 
        return res;
 }
 
-int EmSendCmdEx(uint8_t *resp, int respLen, int correctionNeeded){
+int EmSendCmdEx(uint8_t *resp, int respLen, bool correctionNeeded){
        return EmSendCmdExPar(resp, respLen, correctionNeeded, GetParity(resp, respLen));
 }
 
 int EmSendCmd(uint8_t *resp, int respLen){
        return EmSendCmdExPar(resp, respLen, correctionNeeded, GetParity(resp, respLen));
 }
 
 int EmSendCmd(uint8_t *resp, int respLen){
-       return EmSendCmdExPar(resp, respLen, 0, GetParity(resp, respLen));
+       return EmSendCmdExPar(resp, respLen, false, GetParity(resp, respLen));
 }
 
 int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
 }
 
 int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
-       return EmSendCmdExPar(resp, respLen, 0, par);
+       return EmSendCmdExPar(resp, respLen, false, par);
+}
+
+bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint32_t reader_Parity,
+                                uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint32_t tag_Parity)
+{
+       if (tracing) {
+               // we cannot exactly measure the end and start of a received command from reader. However we know that the delay from
+               // end of the received command to start of the tag's (simulated by us) answer is n*128+20 or n*128+84 resp.
+               // with n >= 9. The start of the tags answer can be measured and therefore the end of the received command be calculated:
+               uint16_t reader_modlen = reader_EndTime - reader_StartTime;
+               uint16_t approx_fdt = tag_StartTime - reader_EndTime;
+               uint16_t exact_fdt = (approx_fdt - 20 + 32)/64 * 64 + 20;
+               reader_EndTime = tag_StartTime - exact_fdt;
+               reader_StartTime = reader_EndTime - reader_modlen;
+               if (!LogTrace(reader_data, reader_len, reader_StartTime, reader_Parity, TRUE)) {
+                       return FALSE;
+               } else if (!LogTrace(NULL, 0, reader_EndTime, 0, TRUE)) {
+                       return FALSE;
+               } else if (!LogTrace(tag_data, tag_len, tag_StartTime, tag_Parity, FALSE)) {
+                       return FALSE;
+               } else {
+                       return (!LogTrace(NULL, 0, tag_EndTime, 0, FALSE));
+               }
+       } else {
+               return TRUE;
+       }
 }
 
 //-----------------------------------------------------------------------------
 }
 
 //-----------------------------------------------------------------------------
@@ -1540,9 +1534,9 @@ int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
 //  If a response is captured return TRUE
 //  If it takes too long return FALSE
 //-----------------------------------------------------------------------------
 //  If a response is captured return TRUE
 //  If it takes too long return FALSE
 //-----------------------------------------------------------------------------
-static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen, int *samples)
+static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen)
 {
 {
-       int c;
+       uint16_t c;
        
        // Set FPGA mode to "reader listen mode", no modulation (listen
        // only, since we are receiving, not transmitting).
        
        // Set FPGA mode to "reader listen mode", no modulation (listen
        // only, since we are receiving, not transmitting).
@@ -1551,26 +1545,23 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset,
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
        
        // Now get the answer from the card
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
        
        // Now get the answer from the card
+       DemodReset();
        Demod.output = receivedResponse;
        Demod.output = receivedResponse;
-       Demod.len = 0;
-       Demod.state = DEMOD_UNSYNCD;
-
-       uint8_t b;
 
 
+       // clear RXRDY:
+    uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+       
        c = 0;
        for(;;) {
                WDT_HIT();
 
        c = 0;
        for(;;) {
                WDT_HIT();
 
-               // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
-                       // AT91C_BASE_SSC->SSC_THR = 0x00;  // To make use of exact timing of next command from reader!!
-                       // if (elapsed) (*elapsed)++;
-               // }
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-                       if(c < iso14a_timeout) { c++; } else { return FALSE; }
                        b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
                        b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-                       if(ManchesterDecoding(b, offset)) {
-                               *samples = Demod.samples;
+                       if(ManchesterDecoding(b, offset, 0)) {
+                               NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
                                return TRUE;
                                return TRUE;
+                       } else if(c++ > iso14a_timeout) {
+                               return FALSE; 
                        }
                }
        }
                        }
                }
        }
@@ -1579,15 +1570,18 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset,
 void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing)
 {
 
 void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing)
 {
 
-  CodeIso14443aBitsAsReaderPar(frame,bits,par);
+       CodeIso14443aBitsAsReaderPar(frame,bits,par);
   
   
-  // Send command to tag
-  TransmitFor14443a(ToSend, ToSendMax, timing);
-  if(trigger)
-       LED_A_ON();
+       // Send command to tag
+       TransmitFor14443a(ToSend, ToSendMax, timing);
+       if(trigger)
+               LED_A_ON();
   
   
-  // Log reader command in trace buffer
-  if (tracing) LogTrace(frame,nbytes(bits),0,par,TRUE);
+       // Log reader command in trace buffer
+       if (tracing) {
+               LogTrace(frame, nbytes(bits), LastTimeProxToAirStart*16 + DELAY_ARM2AIR_AS_READER, par, TRUE);
+               LogTrace(NULL, 0, (LastTimeProxToAirStart + LastProxToAirDuration)*16 + DELAY_ARM2AIR_AS_READER, 0, TRUE);
+       }
 }
 
 void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing)
 }
 
 void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing)
@@ -1609,10 +1603,11 @@ void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing)
 
 int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
 {
 
 int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
 {
-       int samples = 0;
-       if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160,&samples)) return FALSE;
-       if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
-       if(samples == 0) return FALSE;
+       if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160)) return FALSE;
+       if (tracing) {
+               LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
+               LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
+       }
        return Demod.len;
 }
 
        return Demod.len;
 }
 
@@ -1623,11 +1618,12 @@ int ReaderReceive(uint8_t* receivedAnswer)
 
 int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
 {
 
 int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
 {
-       int samples = 0;
-       if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160,&samples)) return FALSE;
-       if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
+       if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160)) return FALSE;
+       if (tracing) {
+               LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.parityBits, FALSE);
+               LogTrace(NULL, 0, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, 0, FALSE);
+       }
        *parptr = Demod.parityBits;
        *parptr = Demod.parityBits;
-       if(samples == 0) return FALSE;
        return Demod.len;
 }
 
        return Demod.len;
 }
 
@@ -1649,6 +1645,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
         
   // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
     ReaderTransmitBitsPar(wupa,7,0, NULL);
         
   // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
     ReaderTransmitBitsPar(wupa,7,0, NULL);
+       
   // Receive the ATQA
   if(!ReaderReceive(resp)) return 0;
   // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
   // Receive the ATQA
   if(!ReaderReceive(resp)) return 0;
   // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
@@ -1707,7 +1704,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
                memcpy(uid_resp,resp,4);
        }
        uid_resp_len = 4;
                memcpy(uid_resp,resp,4);
        }
        uid_resp_len = 4;
-    //    Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
+       // Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
 
     // calculate crypto UID. Always use last 4 Bytes.
     if(cuid_ptr) {
 
     // calculate crypto UID. Always use last 4 Bytes.
     if(cuid_ptr) {
@@ -1768,25 +1765,28 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
   return 1;
 }
 
   return 1;
 }
 
-void iso14443a_setup() {
+void iso14443a_setup(uint8_t fpga_minor_mode) {
        // Set up the synchronous serial port
        FpgaSetupSsc();
        // Set up the synchronous serial port
        FpgaSetupSsc();
-       // Start from off (no field generated)
-       // Signal field is off with the appropriate LED
-//     LED_D_OFF();
-//     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-       // SpinDelay(50);
-
+       // connect Demodulated Signal to ADC:
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
-       // Now give it time to spin up.
        // Signal field is on with the appropriate LED
        // Signal field is on with the appropriate LED
-       LED_D_ON();
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
-       SpinDelay(7); // iso14443-3 specifies 5ms max.
+       if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
+               || fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
+               LED_D_ON();
+       } else {
+               LED_D_OFF();
+       }
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
 
 
-       Demod.state = DEMOD_UNSYNCD;
-       iso14a_timeout = 2048; //default
+       // Start the timer
+       StartCountSspClk();
+       
+       DemodReset();
+       UartReset();
+       NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
+       iso14a_set_timeout(1050); // 10ms default
 }
 
 int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) {
 }
 
 int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) {
@@ -1820,10 +1820,10 @@ int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) {
 // Read an ISO 14443a tag. Send out commands and store answers.
 //
 //-----------------------------------------------------------------------------
 // Read an ISO 14443a tag. Send out commands and store answers.
 //
 //-----------------------------------------------------------------------------
-void ReaderIso14443a(UsbCommand * c)
+void ReaderIso14443a(UsbCommand *c)
 {
        iso14a_command_t param = c->arg[0];
 {
        iso14a_command_t param = c->arg[0];
-       uint8_t * cmd = c->d.asBytes;
+       uint8_t *cmd = c->d.asBytes;
        size_t len = c->arg[1];
        size_t lenbits = c->arg[2];
        uint32_t arg0 = 0;
        size_t len = c->arg[1];
        size_t lenbits = c->arg[2];
        uint32_t arg0 = 0;
@@ -1833,14 +1833,14 @@ void ReaderIso14443a(UsbCommand * c)
                iso14a_clear_trace();
        }
 
                iso14a_clear_trace();
        }
 
-       iso14a_set_tracing(true);
+       iso14a_set_tracing(TRUE);
 
        if(param & ISO14A_REQUEST_TRIGGER) {
 
        if(param & ISO14A_REQUEST_TRIGGER) {
-               iso14a_set_trigger(1);
+               iso14a_set_trigger(TRUE);
        }
 
        if(param & ISO14A_CONNECT) {
        }
 
        if(param & ISO14A_CONNECT) {
-               iso14443a_setup();
+               iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
                if(!(param & ISO14A_NO_SELECT)) {
                        iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
                        arg0 = iso14443a_select_card(NULL,card,NULL);
                if(!(param & ISO14A_NO_SELECT)) {
                        iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
                        arg0 = iso14443a_select_card(NULL,card,NULL);
@@ -1852,10 +1852,6 @@ void ReaderIso14443a(UsbCommand * c)
                iso14a_timeout = c->arg[2];
        }
 
                iso14a_timeout = c->arg[2];
        }
 
-       if(param & ISO14A_SET_TIMEOUT) {
-               iso14a_timeout = c->arg[2];
-       }
-
        if(param & ISO14A_APDU) {
                arg0 = iso14_apdu(cmd, len, buf);
                cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
        if(param & ISO14A_APDU) {
                arg0 = iso14_apdu(cmd, len, buf);
                cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf));
@@ -1876,7 +1872,7 @@ void ReaderIso14443a(UsbCommand * c)
        }
 
        if(param & ISO14A_REQUEST_TRIGGER) {
        }
 
        if(param & ISO14A_REQUEST_TRIGGER) {
-               iso14a_set_trigger(0);
+               iso14a_set_trigger(FALSE);
        }
 
        if(param & ISO14A_NO_DISCONNECT) {
        }
 
        if(param & ISO14A_NO_DISCONNECT) {
@@ -1926,8 +1922,9 @@ void ReaderMifare(bool first_try)
        static uint8_t mf_nr_ar3;
 
        uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
        static uint8_t mf_nr_ar3;
 
        uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
+
        iso14a_clear_trace();
        iso14a_clear_trace();
-       tracing = false;
+       iso14a_set_tracing(TRUE);
 
        byte_t nt_diff = 0;
        byte_t par = 0;
 
        byte_t nt_diff = 0;
        byte_t par = 0;
@@ -1952,11 +1949,9 @@ void ReaderMifare(bool first_try)
 
 
        if (first_try) { 
 
 
        if (first_try) { 
-               StartCountMifare();
                mf_nr_ar3 = 0;
                mf_nr_ar3 = 0;
-               iso14443a_setup();
-               while((GetCountMifare() & 0xffff0000) != 0x10000);              // wait for counter to reset and "warm up" 
-               sync_time = GetCountMifare() & 0xfffffff8;
+               iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
+               sync_time = GetCountSspClk() & 0xfffffff8;
                sync_cycles = 65536;                                                                    // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
                nt_attacked = 0;
                nt = 0;
                sync_cycles = 65536;                                                                    // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
                nt_attacked = 0;
                nt = 0;
@@ -1974,7 +1969,7 @@ void ReaderMifare(bool first_try)
        LED_B_OFF();
        LED_C_OFF();
        
        LED_B_OFF();
        LED_C_OFF();
        
-
+  
        for(uint16_t i = 0; TRUE; i++) {
                
                WDT_HIT();
        for(uint16_t i = 0; TRUE; i++) {
                
                WDT_HIT();
@@ -1991,14 +1986,11 @@ void ReaderMifare(bool first_try)
                        continue;
                }
 
                        continue;
                }
 
-               //keep the card active
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
-
                sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
                catch_up_cycles = 0;
 
                // if we missed the sync time already, advance to the next nonce repeat
                sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
                catch_up_cycles = 0;
 
                // if we missed the sync time already, advance to the next nonce repeat
-               while(GetCountMifare() > sync_time) {
+               while(GetCountSspClk() > sync_time) {
                        sync_time = (sync_time & 0xfffffff8) + sync_cycles;
                }
 
                        sync_time = (sync_time & 0xfffffff8) + sync_cycles;
                }
 
@@ -2092,9 +2084,6 @@ void ReaderMifare(bool first_try)
                }
        }
 
                }
        }
 
-       LogTrace((const uint8_t *)&nt, 4, 0, GetParity((const uint8_t *)&nt, 4), TRUE);
-       LogTrace(par_list, 8, 0, GetParity(par_list, 8), TRUE);
-       LogTrace(ks_list, 8, 0, GetParity(ks_list, 8), TRUE);
 
        mf_nr_ar[3] &= 0x1F;
        
 
        mf_nr_ar[3] &= 0x1F;
        
@@ -2110,7 +2099,8 @@ void ReaderMifare(bool first_try)
        // Thats it...
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LEDsoff();
        // Thats it...
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LEDsoff();
-       tracing = TRUE;
+
+       iso14a_set_tracing(FALSE);
 }
 
 /**
 }
 
 /**
@@ -2157,7 +2147,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
        uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
        uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
 
        uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
        uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
-
+               
        //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
        // This can be used in a reader-only attack.
        // (it can also be retrieved via 'hf 14a list', but hey...
        //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
        // This can be used in a reader-only attack.
        // (it can also be retrieved via 'hf 14a list', but hey...
@@ -2165,31 +2155,27 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
        uint8_t ar_nr_collected = 0;
 
        // clear trace
        uint8_t ar_nr_collected = 0;
 
        // clear trace
-       iso14a_clear_trace();
-
-       tracing = true;
+    iso14a_clear_trace();
+       iso14a_set_tracing(TRUE);
 
 
-  // Authenticate response - nonce
+       // Authenticate response - nonce
        uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
        uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
-
+       
        //-- Determine the UID
        // Can be set from emulator memory, incoming data
        // and can be 7 or 4 bytes long
        //-- Determine the UID
        // Can be set from emulator memory, incoming data
        // and can be 7 or 4 bytes long
-       if(flags & FLAG_4B_UID_IN_DATA)
+       if (flags & FLAG_4B_UID_IN_DATA)
        {
                // 4B uid comes from data-portion of packet
                memcpy(rUIDBCC1,datain,4);
                rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
 
        {
                // 4B uid comes from data-portion of packet
                memcpy(rUIDBCC1,datain,4);
                rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
 
-       }else if(flags & FLAG_7B_UID_IN_DATA)
-       {
+       } else if (flags & FLAG_7B_UID_IN_DATA) {
                // 7B uid comes from data-portion of packet
                memcpy(&rUIDBCC1[1],datain,3);
                memcpy(rUIDBCC2, datain+3, 4);
                _7BUID = true;
                // 7B uid comes from data-portion of packet
                memcpy(&rUIDBCC1[1],datain,3);
                memcpy(rUIDBCC2, datain+3, 4);
                _7BUID = true;
-       }
-       else
-       {
+       } else {
                // get UID from emul memory
                emlGetMemBt(receivedCmd, 7, 1);
                _7BUID = !(receivedCmd[0] == 0x00);
                // get UID from emul memory
                emlGetMemBt(receivedCmd, 7, 1);
                _7BUID = !(receivedCmd[0] == 0x00);
@@ -2200,40 +2186,31 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                        emlGetMemBt(rUIDBCC2, 3, 4);
                }
        }
                        emlGetMemBt(rUIDBCC2, 3, 4);
                }
        }
+
        /*
         * Regardless of what method was used to set the UID, set fifth byte and modify
         * the ATQA for 4 or 7-byte UID
         */
        /*
         * Regardless of what method was used to set the UID, set fifth byte and modify
         * the ATQA for 4 or 7-byte UID
         */
-
        rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
        rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
-       if(_7BUID)
-       {
+       if (_7BUID) {
                rATQA[0] = 0x44;
                rUIDBCC1[0] = 0x88;
                rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
        }
 
                rATQA[0] = 0x44;
                rUIDBCC1[0] = 0x88;
                rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
        }
 
-       // start mkseconds counter
-       StartCountUS();
-
        // We need to listen to the high-frequency, peak-detected path.
        // We need to listen to the high-frequency, peak-detected path.
-       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
-       FpgaSetupSsc();
+       iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
 
 
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
-       SpinDelay(200);
 
        if (MF_DBGLEVEL >= 1)   {
                if (!_7BUID) {
                        Dbprintf("4B UID: %02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3]);
 
        if (MF_DBGLEVEL >= 1)   {
                if (!_7BUID) {
                        Dbprintf("4B UID: %02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3]);
-               }else
-               {
+               } else {
                        Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3],rUIDBCC2[0],rUIDBCC2[1] ,rUIDBCC2[2] , rUIDBCC2[3]);
                }
        }
                        Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3],rUIDBCC2[0],rUIDBCC2[1] ,rUIDBCC2[2] , rUIDBCC2[3]);
                }
        }
-       // calibrate mkseconds counter
-       GetDeltaCountUS();
-       bool finished = false;
+
+       bool finished = FALSE;
        while (!BUTTON_PRESS() && !finished) {
                WDT_HIT();
 
        while (!BUTTON_PRESS() && !finished) {
                WDT_HIT();
 
@@ -2251,14 +2228,15 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
                //Now, get data
 
 
                //Now, get data
 
-               res = EmGetCmd(receivedCmd, &len, RECV_CMD_SIZE); // (+ nextCycleTimeout)
+               res = EmGetCmd(receivedCmd, &len);
                if (res == 2) { //Field is off!
                        cardSTATE = MFEMUL_NOFIELD;
                        LEDsoff();
                        continue;
                if (res == 2) { //Field is off!
                        cardSTATE = MFEMUL_NOFIELD;
                        LEDsoff();
                        continue;
-               }else if(res == 1) break;//return value 1 means button press
-
-
+               } else if (res == 1) {
+                       break;  //return value 1 means button press
+               }
+                       
                // REQ or WUP request in ANY state and WUP in HALTED state
                if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
                        selTimer = GetTickCount();
                // REQ or WUP request in ANY state and WUP in HALTED state
                if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
                        selTimer = GetTickCount();
@@ -2272,11 +2250,13 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                        cardAUTHKEY = 0xff;
                        continue;
                }
                        cardAUTHKEY = 0xff;
                        continue;
                }
-
+               
                switch (cardSTATE) {
                        case MFEMUL_NOFIELD:
                        case MFEMUL_HALTED:
                        case MFEMUL_IDLE:{
                switch (cardSTATE) {
                        case MFEMUL_NOFIELD:
                        case MFEMUL_HALTED:
                        case MFEMUL_IDLE:{
+                               LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                               LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
                                break;
                        }
                        case MFEMUL_SELECT1:{
                                break;
                        }
                        case MFEMUL_SELECT1:{
@@ -2294,12 +2274,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                // select card
                                if (len == 9 && 
                                                (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
                                // select card
                                if (len == 9 && 
                                                (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
-
-                                       if (!_7BUID) 
-                                               EmSendCmd(rSAK, sizeof(rSAK));
-                                       else
-                                               EmSendCmd(rSAK1, sizeof(rSAK1));
-
+                                       EmSendCmd(_7BUID?rSAK1:rSAK, sizeof(_7BUID?rSAK1:rSAK));
                                        cuid = bytes_to_num(rUIDBCC1, 4);
                                        if (!_7BUID) {
                                                cardSTATE = MFEMUL_WORK;
                                        cuid = bytes_to_num(rUIDBCC1, 4);
                                        if (!_7BUID) {
                                                cardSTATE = MFEMUL_WORK;
@@ -2308,16 +2283,16 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                                break;
                                        } else {
                                                cardSTATE = MFEMUL_SELECT2;
                                                break;
                                        } else {
                                                cardSTATE = MFEMUL_SELECT2;
-                                               break;
                                        }
                                }
                                        }
                                }
-                               
                                break;
                        }
                        case MFEMUL_AUTH1:{
                                if( len != 8)
                                {
                                        cardSTATE_TO_IDLE();
                                break;
                        }
                        case MFEMUL_AUTH1:{
                                if( len != 8)
                                {
                                        cardSTATE_TO_IDLE();
+                                       LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                       LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
                                        break;
                                }
                                uint32_t ar = bytes_to_num(receivedCmd, 4);
                                        break;
                                }
                                uint32_t ar = bytes_to_num(receivedCmd, 4);
@@ -2342,10 +2317,12 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                // test if auth OK
                                if (cardRr != prng_successor(nonce, 64)){
                                        if (MF_DBGLEVEL >= 2)   Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x",cardRr, prng_successor(nonce, 64));
                                // test if auth OK
                                if (cardRr != prng_successor(nonce, 64)){
                                        if (MF_DBGLEVEL >= 2)   Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x",cardRr, prng_successor(nonce, 64));
-                                       //Shouldn't we respond anything here?
+                                       // Shouldn't we respond anything here?
                                        // Right now, we don't nack or anything, which causes the
                                        // reader to do a WUPA after a while. /Martin
                                        cardSTATE_TO_IDLE();
                                        // Right now, we don't nack or anything, which causes the
                                        // reader to do a WUPA after a while. /Martin
                                        cardSTATE_TO_IDLE();
+                                       LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                       LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
                                        break;
                                }
 
                                        break;
                                }
 
@@ -2360,8 +2337,11 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                break;
                        }
                        case MFEMUL_SELECT2:{
                                break;
                        }
                        case MFEMUL_SELECT2:{
-                               if (!len) break;
-                       
+                               if (!len) { 
+                                       LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                       LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
+                                       break;
+                               }
                                if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
                                        EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
                                        break;
                                if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
                                        EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
                                        break;
@@ -2371,7 +2351,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                if (len == 9 && 
                                                (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
                                        EmSendCmd(rSAK, sizeof(rSAK));
                                if (len == 9 && 
                                                (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
                                        EmSendCmd(rSAK, sizeof(rSAK));
-
                                        cuid = bytes_to_num(rUIDBCC2, 4);
                                        cardSTATE = MFEMUL_WORK;
                                        LED_B_ON();
                                        cuid = bytes_to_num(rUIDBCC2, 4);
                                        cardSTATE = MFEMUL_WORK;
                                        LED_B_ON();
@@ -2380,22 +2359,30 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                }
                                
                                // i guess there is a command). go into the work state.
                                }
                                
                                // i guess there is a command). go into the work state.
-                               if (len != 4) break;
+                               if (len != 4) {
+                                       LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                       LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
+                                       break;
+                               }
                                cardSTATE = MFEMUL_WORK;
                                //goto lbWORK;
                                //intentional fall-through to the next case-stmt
                        }
                                cardSTATE = MFEMUL_WORK;
                                //goto lbWORK;
                                //intentional fall-through to the next case-stmt
                        }
-                       case MFEMUL_WORK:{
-                               if (len == 0) break;
 
 
+                       case MFEMUL_WORK:{
+                               if (len == 0) {
+                                       LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                       LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
+                                       break;
+                               }
+                               
                                bool encrypted_data = (cardAUTHKEY != 0xFF) ;
 
                                bool encrypted_data = (cardAUTHKEY != 0xFF) ;
 
-                               if(encrypted_data)
-                               {
+                               if(encrypted_data) {
                                        // decrypt seqence
                                        mf_crypto1_decrypt(pcs, receivedCmd, len);
                                }
                                        // decrypt seqence
                                        mf_crypto1_decrypt(pcs, receivedCmd, len);
                                }
-
+                               
                                if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
                                        authTimer = GetTickCount();
                                        cardAUTHSC = receivedCmd[1] / 4;  // received block num
                                if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
                                        authTimer = GetTickCount();
                                        cardAUTHSC = receivedCmd[1] / 4;  // received block num
@@ -2408,10 +2395,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
                                                crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
                                                num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
 
                                                crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
                                                num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
-                                       }
-                                       else{ // nested authentication
+                                       } else { // nested authentication
                                                if (MF_DBGLEVEL >= 2) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
                                                if (MF_DBGLEVEL >= 2) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
-                                               ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0);
+                                               ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0); 
                                                num_to_bytes(ans, 4, rAUTH_AT);
                                        }
                                        EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
                                                num_to_bytes(ans, 4, rAUTH_AT);
                                        }
                                        EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
@@ -2419,7 +2405,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        cardSTATE = MFEMUL_AUTH1;
                                        break;
                                }
                                        cardSTATE = MFEMUL_AUTH1;
                                        break;
                                }
-
+                               
                                // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
                                // BUT... ACK --> NACK
                                if (len == 1 && receivedCmd[0] == CARD_ACK) {
                                // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
                                // BUT... ACK --> NACK
                                if (len == 1 && receivedCmd[0] == CARD_ACK) {
@@ -2433,25 +2419,25 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        break;
                                }
                                
                                        break;
                                }
                                
-                               if(len != 4) break;
+                               if(len != 4) {
+                                       LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                       LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
+                                       break;
+                               }
 
                                if(receivedCmd[0] == 0x30 // read block
                                                || receivedCmd[0] == 0xA0 // write block
                                                || receivedCmd[0] == 0xC0
                                                || receivedCmd[0] == 0xC1
                                                || receivedCmd[0] == 0xC2 // inc dec restore
 
                                if(receivedCmd[0] == 0x30 // read block
                                                || receivedCmd[0] == 0xA0 // write block
                                                || receivedCmd[0] == 0xC0
                                                || receivedCmd[0] == 0xC1
                                                || receivedCmd[0] == 0xC2 // inc dec restore
-                                               || receivedCmd[0] == 0xB0) // transfer
-                               {
-                                       if (receivedCmd[1] >= 16 * 4)
-                                       {
-
+                                               || receivedCmd[0] == 0xB0) { // transfer
+                                       if (receivedCmd[1] >= 16 * 4) {
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                                if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
                                                break;
                                        }
 
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                                if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
                                                break;
                                        }
 
-                                       if (receivedCmd[1] / 4 != cardAUTHSC)
-                                       {
+                                       if (receivedCmd[1] / 4 != cardAUTHSC) {
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                                if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
                                                break;
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                                if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
                                                break;
@@ -2467,8 +2453,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        mf_crypto1_encrypt(pcs, response, 18, &par);
                                        EmSendCmdPar(response, 18, par);
                                        numReads++;
                                        mf_crypto1_encrypt(pcs, response, 18, &par);
                                        EmSendCmdPar(response, 18, par);
                                        numReads++;
-                                       if(exitAfterNReads > 0 && numReads == exitAfterNReads)
-                                       {
+                                       if(exitAfterNReads > 0 && numReads == exitAfterNReads) {
                                                Dbprintf("%d reads done, exiting", numReads);
                                                finished = true;
                                        }
                                                Dbprintf("%d reads done, exiting", numReads);
                                                finished = true;
                                        }
@@ -2477,17 +2462,14 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                // write block
                                if (receivedCmd[0] == 0xA0) {
                                        if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
                                // write block
                                if (receivedCmd[0] == 0xA0) {
                                        if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
-
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
-                                       //nextCycleTimeout = 50;
                                        cardSTATE = MFEMUL_WRITEBL2;
                                        cardWRBL = receivedCmd[1];
                                        break;
                                        cardSTATE = MFEMUL_WRITEBL2;
                                        cardWRBL = receivedCmd[1];
                                        break;
-                               }                               
+                               }
                                // increment, decrement, restore
                                if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
                                        if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
                                // increment, decrement, restore
                                if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
                                        if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
-
                                        if (emlCheckValBl(receivedCmd[1])) {
                                                if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                        if (emlCheckValBl(receivedCmd[1])) {
                                                if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
@@ -2501,28 +2483,25 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        if (receivedCmd[0] == 0xC2)
                                                cardSTATE = MFEMUL_INTREG_REST;
                                        cardWRBL = receivedCmd[1];
                                        if (receivedCmd[0] == 0xC2)
                                                cardSTATE = MFEMUL_INTREG_REST;
                                        cardWRBL = receivedCmd[1];
-
                                        break;
                                }
                                        break;
                                }
-                               
                                // transfer
                                if (receivedCmd[0] == 0xB0) {
                                        if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
                                // transfer
                                if (receivedCmd[0] == 0xB0) {
                                        if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
-                                       
                                        if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                        else
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
                                        if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                        else
                                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
-                                               
                                        break;
                                }
                                        break;
                                }
-
                                // halt
                                if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
                                        LED_B_OFF();
                                        LED_C_OFF();
                                        cardSTATE = MFEMUL_HALTED;
                                        if (MF_DBGLEVEL >= 4)   Dbprintf("--> HALTED. Selected time: %d ms",  GetTickCount() - selTimer);
                                // halt
                                if (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00) {
                                        LED_B_OFF();
                                        LED_C_OFF();
                                        cardSTATE = MFEMUL_HALTED;
                                        if (MF_DBGLEVEL >= 4)   Dbprintf("--> HALTED. Selected time: %d ms",  GetTickCount() - selTimer);
+                                       LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                       LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
                                        break;
                                }
                                // RATS
                                        break;
                                }
                                // RATS
@@ -2530,12 +2509,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                        break;
                                }
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                        break;
                                }
-
                                // command not allowed
                                if (MF_DBGLEVEL >= 4)   Dbprintf("Received command not allowed, nacking");
                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                // command not allowed
                                if (MF_DBGLEVEL >= 4)   Dbprintf("Received command not allowed, nacking");
                                EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
-
-                               // case break
                                break;
                        }
                        case MFEMUL_WRITEBL2:{
                                break;
                        }
                        case MFEMUL_WRITEBL2:{
@@ -2544,10 +2520,10 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        emlSetMem(receivedCmd, cardWRBL, 1);
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
                                        cardSTATE = MFEMUL_WORK;
                                        emlSetMem(receivedCmd, cardWRBL, 1);
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
                                        cardSTATE = MFEMUL_WORK;
-                                       break;
                                } else {
                                        cardSTATE_TO_IDLE();
                                } else {
                                        cardSTATE_TO_IDLE();
-                                       break;
+                                       LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                                       LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
                                }
                                break;
                        }
                                }
                                break;
                        }
@@ -2559,7 +2535,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                        cardSTATE_TO_IDLE();
                                        break;
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
                                        cardSTATE_TO_IDLE();
                                        break;
-                               }
+                               } 
+                               LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                               LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
                                cardINTREG = cardINTREG + ans;
                                cardSTATE = MFEMUL_WORK;
                                break;
                                cardINTREG = cardINTREG + ans;
                                cardSTATE = MFEMUL_WORK;
                                break;
@@ -2572,6 +2550,8 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        cardSTATE_TO_IDLE();
                                        break;
                                }
                                        cardSTATE_TO_IDLE();
                                        break;
                                }
+                               LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                               LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
                                cardINTREG = cardINTREG - ans;
                                cardSTATE = MFEMUL_WORK;
                                break;
                                cardINTREG = cardINTREG - ans;
                                cardSTATE = MFEMUL_WORK;
                                break;
@@ -2584,6 +2564,8 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        cardSTATE_TO_IDLE();
                                        break;
                                }
                                        cardSTATE_TO_IDLE();
                                        break;
                                }
+                               LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
+                               LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
                                cardSTATE = MFEMUL_WORK;
                                break;
                        }
                                cardSTATE = MFEMUL_WORK;
                                break;
                        }
@@ -2593,9 +2575,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LEDsoff();
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LEDsoff();
 
-       // add trace trailer
-       memset(rAUTH_NT, 0x44, 4);
-       LogTrace(rAUTH_NT, 4, 0, 0, TRUE);
        if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
        {
                //May just aswell send the collected ar_nr in the response aswell
        if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
        {
                //May just aswell send the collected ar_nr in the response aswell
@@ -2603,8 +2582,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
        }
        if(flags & FLAG_NR_AR_ATTACK)
        {
        }
        if(flags & FLAG_NR_AR_ATTACK)
        {
-               if(ar_nr_collected > 1)
-               {
+               if(ar_nr_collected > 1) {
                        Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
                        Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x",
                                         ar_nr_responses[0], // UID
                        Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
                        Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x",
                                         ar_nr_responses[0], // UID
@@ -2614,11 +2592,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        ar_nr_responses[6], //AR2
                                        ar_nr_responses[7] //NR2
                                        );
                                        ar_nr_responses[6], //AR2
                                        ar_nr_responses[7] //NR2
                                        );
-               }else
-               {
+               } else {
                        Dbprintf("Failed to obtain two AR/NR pairs!");
                        Dbprintf("Failed to obtain two AR/NR pairs!");
-                       if(ar_nr_collected >0)
-                       {
+                       if(ar_nr_collected >0) {
                                Dbprintf("Only got these: UID=%08d, nonce=%08d, AR1=%08d, NR1=%08d",
                                                ar_nr_responses[0], // UID
                                                ar_nr_responses[1], //NT
                                Dbprintf("Only got these: UID=%08d, nonce=%08d, AR1=%08d, NR1=%08d",
                                                ar_nr_responses[0], // UID
                                                ar_nr_responses[1], //NT
@@ -2659,71 +2635,73 @@ void RAMFUNC SniffMifare(uint8_t param) {
        //uint8_t *trace = (uint8_t *)BigBuf;
        
        // The DMA buffer, used to stream samples from the FPGA
        //uint8_t *trace = (uint8_t *)BigBuf;
        
        // The DMA buffer, used to stream samples from the FPGA
-       int8_t *dmaBuf = ((int8_t *)BigBuf) + DMA_BUFFER_OFFSET;
-       int8_t *data = dmaBuf;
+       uint8_t *dmaBuf = ((uint8_t *)BigBuf) + DMA_BUFFER_OFFSET;
+       uint8_t *data = dmaBuf;
+       uint8_t previous_data = 0;
        int maxDataLen = 0;
        int dataLen = 0;
        int maxDataLen = 0;
        int dataLen = 0;
+       bool ReaderIsActive = FALSE;
+       bool TagIsActive = FALSE;
+
+       iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
 
        // Set up the demodulator for tag -> reader responses.
        Demod.output = receivedResponse;
 
        // Set up the demodulator for tag -> reader responses.
        Demod.output = receivedResponse;
-       Demod.len = 0;
-       Demod.state = DEMOD_UNSYNCD;
 
        // Set up the demodulator for the reader -> tag commands
 
        // Set up the demodulator for the reader -> tag commands
-       memset(&Uart, 0, sizeof(Uart));
        Uart.output = receivedCmd;
        Uart.output = receivedCmd;
-       Uart.byteCntMax = 32; // was 100 (greg)//////////////////
-       Uart.state = STATE_UNSYNCD;
 
        // Setup for the DMA.
 
        // Setup for the DMA.
-       FpgaSetupSsc();
-       FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
+       FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
 
 
-       // And put the FPGA in the appropriate mode
-       // Signal field is off with the appropriate LED
        LED_D_OFF();
        LED_D_OFF();
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER);
-       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
        
        // init sniffer
        MfSniffInit();
        
        // init sniffer
        MfSniffInit();
-       int sniffCounter = 0;
 
        // And now we loop, receiving samples.
 
        // And now we loop, receiving samples.
-       while(true) {
+       for(uint32_t sniffCounter = 0; TRUE; ) {
+       
                if(BUTTON_PRESS()) {
                        DbpString("cancelled by button");
                if(BUTTON_PRESS()) {
                        DbpString("cancelled by button");
-                       goto done;
+                       break;
                }
 
                LED_A_ON();
                WDT_HIT();
                
                }
 
                LED_A_ON();
                WDT_HIT();
                
-               if (++sniffCounter > 65) {
-                       if (MfSniffSend(2000)) {
-                               FpgaEnableSscDma();
+               if ((sniffCounter & 0x0000FFFF) == 0) { // from time to time
+                       // check if a transaction is completed (timeout after 2000ms).
+                       // if yes, stop the DMA transfer and send what we have so far to the client
+                       if (MfSniffSend(2000)) {                        
+                               // Reset everything - we missed some sniffed data anyway while the DMA was stopped
+                               sniffCounter = 0;
+                               data = dmaBuf;
+                               maxDataLen = 0;
+                               ReaderIsActive = FALSE;
+                               TagIsActive = FALSE;
+                               FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE); // set transfer address and number of bytes. Start transfer.
                        }
                        }
-                       sniffCounter = 0;
                }
                }
-
-               int register readBufDataP = data - dmaBuf;
-               int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
-               if (readBufDataP <= dmaBufDataP){
-                       dataLen = dmaBufDataP - readBufDataP;
-               } else {
-                       dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP + 1;
+               
+               int register readBufDataP = data - dmaBuf;      // number of bytes we have processed so far
+               int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
+               if (readBufDataP <= dmaBufDataP){                       // we are processing the same block of data which is currently being transferred
+                       dataLen = dmaBufDataP - readBufDataP;   // number of bytes still to be processed
+               } else {                                                                        
+                       dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
                }
                // test for length of buffer
                }
                // test for length of buffer
-               if(dataLen > maxDataLen) {
-                       maxDataLen = dataLen;
+               if(dataLen > maxDataLen) {                                      // we are more behind than ever...
+                       maxDataLen = dataLen;                                   
                        if(dataLen > 400) {
                                Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
                        if(dataLen > 400) {
                                Dbprintf("blew circular buffer! dataLen=0x%x", dataLen);
-                               goto done;
+                               break;
                        }
                }
                if(dataLen < 1) continue;
 
                        }
                }
                if(dataLen < 1) continue;
 
-               // primary buffer was stopped( <-- we lost data!
+               // primary buffer was stopped ( <-- we lost data!
                if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
                        AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
                        AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
                if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
                        AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf;
                        AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
@@ -2737,44 +2715,51 @@ void RAMFUNC SniffMifare(uint8_t param) {
 
                LED_A_OFF();
                
 
                LED_A_OFF();
                
-               if(MillerDecoding((data[0] & 0xF0) >> 4)) {
-                       LED_C_INV();
-                       // check - if there is a short 7bit request from reader
-                       if (MfSniffLogic(receivedCmd, Uart.byteCnt, Uart.parityBits, Uart.bitCnt, TRUE)) break;
-
-                       /* And ready to receive another command. */
-                       Uart.state = STATE_UNSYNCD;
-                       
-                       /* And also reset the demod code */
-                       Demod.state = DEMOD_UNSYNCD;
-               }
+               if (sniffCounter & 0x01) {
 
 
-               if(ManchesterDecoding(data[0], 0)) {
-                       LED_C_INV();
+                       if(!TagIsActive) {              // no need to try decoding tag data if the reader is sending
+                               uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
+                               if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
+                                       LED_C_INV();
+                                       if (MfSniffLogic(receivedCmd, Uart.len, Uart.parityBits, Uart.bitCount, TRUE)) break;
 
 
-                       if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;
+                                       /* And ready to receive another command. */
+                                       UartReset();
+                                       
+                                       /* And also reset the demod code */
+                                       DemodReset();
+                               }
+                               ReaderIsActive = (Uart.state != STATE_UNSYNCD);
+                       }
+                       
+                       if(!ReaderIsActive) {           // no need to try decoding tag data if the reader is sending
+                               uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
+                               if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
+                                       LED_C_INV();
 
 
-                       // And ready to receive another response.
-                       memset(&Demod, 0, sizeof(Demod));
-                       Demod.output = receivedResponse;
-                       Demod.state = DEMOD_UNSYNCD;
+                                       if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;
 
 
-                       /* And also reset the uart code */
-                       Uart.state = STATE_UNSYNCD;
+                                       // And ready to receive another response.
+                                       DemodReset();
+                               }
+                               TagIsActive = (Demod.state != DEMOD_UNSYNCD);
+                       }
                }
 
                }
 
+               previous_data = *data;
+               sniffCounter++;
                data++;
                if(data > dmaBuf + DMA_BUFFER_SIZE) {
                        data = dmaBuf;
                }
                data++;
                if(data > dmaBuf + DMA_BUFFER_SIZE) {
                        data = dmaBuf;
                }
+
        } // main cycle
 
        DbpString("COMMAND FINISHED");
 
        } // main cycle
 
        DbpString("COMMAND FINISHED");
 
-done:
        FpgaDisableSscDma();
        MfSniffEnd();
        
        FpgaDisableSscDma();
        MfSniffEnd();
        
-       Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.byteCnt=%x Uart.byteCntMax=%x", maxDataLen, Uart.state, Uart.byteCnt, Uart.byteCntMax);
+       Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
        LEDsoff();
 }
        LEDsoff();
 }
index 2a2b3403b7d0e0f038537c531faced10da147a9c..6d18515fc80a6281f6a1de710a0d86a99599d576 100644 (file)
 typedef struct {
        enum {
                DEMOD_UNSYNCD,
 typedef struct {
        enum {
                DEMOD_UNSYNCD,
-               DEMOD_HALF_SYNCD,
-               DEMOD_MOD_FIRST_HALF,
-               DEMOD_NOMOD_FIRST_HALF,
+               // DEMOD_HALF_SYNCD,
+               // DEMOD_MOD_FIRST_HALF,
+               // DEMOD_NOMOD_FIRST_HALF,
                DEMOD_MANCHESTER_DATA
        } state;
                DEMOD_MANCHESTER_DATA
        } state;
+       uint16_t twoBits;
+       uint16_t highCnt;
        uint16_t bitCount;
        uint16_t collisionPos;
        uint16_t syncBit;
        uint16_t bitCount;
        uint16_t collisionPos;
        uint16_t syncBit;
-       uint16_t parityBits;
+       uint32_t parityBits;
        uint16_t shiftReg;
        uint16_t samples;
        uint16_t len;
        uint16_t shiftReg;
        uint16_t samples;
        uint16_t len;
+       uint32_t startTime, endTime;
        uint8_t  *output;
 } tDemod;
 
        uint8_t  *output;
 } tDemod;
 
+typedef enum {
+       MOD_NOMOD = 0,
+       MOD_SECOND_HALF,
+       MOD_FIRST_HALF,
+       MOD_BOTH_HALVES
+       } Modulation_t;
+
 typedef struct {
        enum {
                STATE_UNSYNCD,
 typedef struct {
        enum {
                STATE_UNSYNCD,
@@ -47,27 +57,24 @@ typedef struct {
                STATE_MILLER_X,
                STATE_MILLER_Y,
                STATE_MILLER_Z,
                STATE_MILLER_X,
                STATE_MILLER_Y,
                STATE_MILLER_Z,
-               STATE_ERROR_WAIT
-               }               state;
-               uint16_t    shiftReg;
-               int     bitCnt;
-               int     byteCnt;
-               int     byteCntMax;
-               int     posCnt;
-               int     syncBit;
-               int     parityBits;
-               int     samples;
-               int     highCnt;
-               int     bitBuffer;
-       enum {
-               DROP_NONE,
-               DROP_FIRST_HALF,
-               DROP_SECOND_HALF
-       }               drop;
-    uint8_t   *output;
+               // DROP_NONE,
+               // DROP_FIRST_HALF,
+               } state;
+       uint16_t shiftReg;
+       uint16_t bitCount;
+       uint16_t len;
+       uint16_t byteCntMax;
+       uint16_t posCnt;
+       uint16_t syncBit;
+       uint32_t parityBits;
+       uint16_t highCnt;
+       uint16_t twoBits;
+       uint32_t startTime, endTime;
+    uint8_t *output;
 } tUart;
 
 
 } tUart;
 
 
+
 extern byte_t oddparity (const byte_t bt);
 extern uint32_t GetParity(const uint8_t *pbtCmd, int iLen);
 extern void AppendCrc14443a(uint8_t *data, int len);
 extern byte_t oddparity (const byte_t bt);
 extern uint32_t GetParity(const uint8_t *pbtCmd, int iLen);
 extern void AppendCrc14443a(uint8_t *data, int len);
@@ -78,7 +85,7 @@ extern void ReaderTransmitPar(uint8_t *frame, int len, uint32_t par, uint32_t *t
 extern int ReaderReceive(uint8_t *receivedAnswer);
 extern int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr);
 
 extern int ReaderReceive(uint8_t *receivedAnswer);
 extern int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr);
 
-extern void iso14443a_setup();
+extern void iso14443a_setup(uint8_t fpga_minor_mode);
 extern int iso14_apdu(uint8_t *cmd, size_t cmd_len, void *data);
 extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr);
 extern void iso14a_set_trigger(bool enable);
 extern int iso14_apdu(uint8_t *cmd, size_t cmd_len, void *data);
 extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr);
 extern void iso14a_set_trigger(bool enable);
index cbad7a905b890cda71c5df2f7afca34570121b02..c934a28024c415c7f48df17c290d500029c3db53 100644 (file)
@@ -38,7 +38,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        iso14a_clear_trace();\r
 //     iso14a_set_tracing(false);\r
 \r
        iso14a_clear_trace();\r
 //     iso14a_set_tracing(false);\r
 \r
-       iso14443a_setup();\r
+       iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
@@ -107,7 +107,7 @@ void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
     
        // clear trace
        iso14a_clear_trace();
     
        // clear trace
        iso14a_clear_trace();
-       iso14443a_setup();
+       iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
     
        LED_A_ON();
        LED_B_OFF();
     
        LED_A_ON();
        LED_B_OFF();
@@ -173,7 +173,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        iso14a_clear_trace();\r
 //     iso14a_set_tracing(false);\r
 \r
        iso14a_clear_trace();\r
 //     iso14a_set_tracing(false);\r
 \r
-       iso14443a_setup();\r
+       iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
@@ -260,7 +260,7 @@ void MifareUReadCard(uint8_t arg0, uint8_t *datain)
         iso14a_clear_trace();
 //      iso14a_set_tracing(false);
 
         iso14a_clear_trace();
 //      iso14a_set_tracing(false);
 
-        iso14443a_setup();
+               iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 
         LED_A_ON();
         LED_B_OFF();
 
         LED_A_ON();
         LED_B_OFF();
@@ -293,7 +293,7 @@ void MifareUReadCard(uint8_t arg0, uint8_t *datain)
         LogTrace(uid, 4, 0, 0, TRUE);
         
         LED_B_ON();
         LogTrace(uid, 4, 0, 0, TRUE);
         
         LED_B_ON();
-  cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);
+               cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);
   //cmd_send(CMD_ACK,isOK,0,0,dataoutbuf+32, 32);
         LED_B_OFF();
 
   //cmd_send(CMD_ACK,isOK,0,0,dataoutbuf+32, 32);
         LED_B_OFF();
 
@@ -332,7 +332,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        iso14a_clear_trace();\r
 //  iso14a_set_tracing(false);\r
 \r
        iso14a_clear_trace();\r
 //  iso14a_set_tracing(false);\r
 \r
-       iso14443a_setup();\r
+       iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
@@ -405,7 +405,7 @@ void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
         iso14a_clear_trace();
        //  iso14a_set_tracing(false);
 
         iso14a_clear_trace();
        //  iso14a_set_tracing(false);
 
-        iso14443a_setup();
+               iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 
         LED_A_ON();
         LED_B_OFF();
 
         LED_A_ON();
         LED_B_OFF();
@@ -467,7 +467,7 @@ void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
         iso14a_clear_trace();
         //  iso14a_set_tracing(false);
 
         iso14a_clear_trace();
         //  iso14a_set_tracing(false);
 
-        iso14443a_setup();
+               iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 
         LED_A_ON();
         LED_B_OFF();
 
         LED_A_ON();
         LED_B_OFF();
@@ -554,20 +554,16 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
        uint32_t auth1_time, auth2_time;\r
        static uint16_t delta_time;\r
 \r
        uint32_t auth1_time, auth2_time;\r
        static uint16_t delta_time;\r
 \r
-       StartCountMifare();\r
-\r
        // clear trace\r
        iso14a_clear_trace();\r
        iso14a_set_tracing(false);\r
        \r
        // clear trace\r
        iso14a_clear_trace();\r
        iso14a_set_tracing(false);\r
        \r
-       iso14443a_setup();\r
+       iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
        LED_A_ON();\r
        LED_C_OFF();\r
 \r
 \r
 \r
        LED_A_ON();\r
        LED_C_OFF();\r
 \r
 \r
-       while((GetCountMifare() & 0xffff0000) != 0x00010000);           // wait for counter to reset and "warm up" \r
-\r
        // statistics on nonce distance\r
        if (calibrate) {        // for first call only. Otherwise reuse previous calibration\r
                LED_B_ON();\r
        // statistics on nonce distance\r
        if (calibrate) {        // for first call only. Otherwise reuse previous calibration\r
                LED_B_ON();\r
@@ -767,7 +763,7 @@ void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        iso14a_clear_trace();\r
        iso14a_set_tracing(TRUE);\r
 \r
        iso14a_clear_trace();\r
        iso14a_set_tracing(TRUE);\r
 \r
-       iso14443a_setup();\r
+       iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
@@ -874,7 +870,7 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
        iso14a_clear_trace();\r
        iso14a_set_tracing(false);\r
        \r
        iso14a_clear_trace();\r
        iso14a_set_tracing(false);\r
        \r
-       iso14443a_setup();\r
+       iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
 \r
        LED_A_ON();\r
        LED_B_OFF();\r
@@ -992,7 +988,7 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
                iso14a_clear_trace();\r
                iso14a_set_tracing(TRUE);\r
 \r
                iso14a_clear_trace();\r
                iso14a_set_tracing(TRUE);\r
 \r
-               iso14443a_setup();\r
+               iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
                LED_A_ON();\r
                LED_B_OFF();\r
 \r
                LED_A_ON();\r
                LED_B_OFF();\r
@@ -1130,7 +1126,7 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
                iso14a_clear_trace();\r
                iso14a_set_tracing(TRUE);\r
 \r
                iso14a_clear_trace();\r
                iso14a_set_tracing(TRUE);\r
 \r
-               iso14443a_setup();\r
+               iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
                LED_A_ON();\r
                LED_B_OFF();\r
 \r
                LED_A_ON();\r
                LED_B_OFF();\r
@@ -1144,7 +1140,7 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 \r
        while (true) {\r
                if (workFlags & 0x02) {\r
 \r
        while (true) {\r
                if (workFlags & 0x02) {\r
-      ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
+                       ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
                        if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {\r
                                if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");\r
                                break;\r
                        if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {\r
                                if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");\r
                                break;\r
index f95ca3dfc5e0f919a325be7bcc2e4adde3bf2d24..bd9840e8cb4a8467e9b3c6b3719f0aede40a9d18 100644 (file)
@@ -17,104 +17,95 @@ static uint8_t sniffUID[8];
 static uint8_t sniffATQA[2];\r
 static uint8_t sniffSAK;\r
 static uint8_t sniffBuf[16];\r
 static uint8_t sniffATQA[2];\r
 static uint8_t sniffSAK;\r
 static uint8_t sniffBuf[16];\r
-static int timerData = 0;\r
+static uint32_t timerData = 0;\r
 \r
 \r
 \r
 \r
-int MfSniffInit(void){\r
-       rsamples = 0;\r
+bool MfSniffInit(void){\r
        memset(sniffUID, 0x00, 8);\r
        memset(sniffATQA, 0x00, 2);\r
        sniffSAK = 0;\r
        sniffUIDType = SNF_UID_4;\r
 \r
        memset(sniffUID, 0x00, 8);\r
        memset(sniffATQA, 0x00, 2);\r
        sniffSAK = 0;\r
        sniffUIDType = SNF_UID_4;\r
 \r
-       return 0;\r
+       return FALSE;\r
 }\r
 \r
 }\r
 \r
-int MfSniffEnd(void){\r
-//     UsbCommand ack = {CMD_ACK, {0, 0, 0}};\r
-\r
+bool MfSniffEnd(void){\r
        LED_B_ON();\r
        LED_B_ON();\r
-  cmd_send(CMD_ACK,0,0,0,0,0);\r
-//     UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));\r
+       cmd_send(CMD_ACK,0,0,0,0,0);\r
        LED_B_OFF();\r
 \r
        LED_B_OFF();\r
 \r
-       return 0;\r
+       return FALSE;\r
 }\r
 \r
 }\r
 \r
-int RAMFUNC MfSniffLogic(const uint8_t * data, int len, uint32_t parity, int bitCnt, int reader) {\r
+bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint32_t parity, uint16_t bitCnt, bool reader) {\r
 \r
 \r
-       if ((len == 1) && (bitCnt = 9) && (data[0] > 0x0F)) { \r
+       if (reader && (len == 1) && (bitCnt == 7)) {            // reset on 7-Bit commands from reader\r
                sniffState = SNF_INIT;\r
        }\r
 \r
        switch (sniffState) {\r
                case SNF_INIT:{\r
                sniffState = SNF_INIT;\r
        }\r
 \r
        switch (sniffState) {\r
                case SNF_INIT:{\r
-                       if ((reader) && (len == 1) && (bitCnt == 9) && ((data[0] == 0x26) || (data[0] == 0x52))) { \r
+                       if ((len == 1) && (reader) && (bitCnt == 7) ) {  // REQA or WUPA from reader\r
                                sniffUIDType = SNF_UID_4;\r
                                memset(sniffUID, 0x00, 8);\r
                                memset(sniffATQA, 0x00, 2);\r
                                sniffSAK = 0;\r
                                sniffUIDType = SNF_UID_4;\r
                                memset(sniffUID, 0x00, 8);\r
                                memset(sniffATQA, 0x00, 2);\r
                                sniffSAK = 0;\r
-\r
                                sniffState = SNF_WUPREQ;\r
                        }\r
                        break;\r
                }\r
                case SNF_WUPREQ:{\r
                                sniffState = SNF_WUPREQ;\r
                        }\r
                        break;\r
                }\r
                case SNF_WUPREQ:{\r
-                       if ((!reader) && (len == 2)) { \r
+                       if ((!reader) && (len == 2)) {          // ATQA from tag\r
                                memcpy(sniffATQA, data, 2);\r
                                memcpy(sniffATQA, data, 2);\r
-\r
                                sniffState = SNF_ATQA;\r
                        }\r
                        break;\r
                }\r
                case SNF_ATQA:{\r
                                sniffState = SNF_ATQA;\r
                        }\r
                        break;\r
                }\r
                case SNF_ATQA:{\r
-                       if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { \r
+                       if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r
                                sniffState = SNF_ANTICOL1;\r
                        }\r
                        break;\r
                }\r
                case SNF_ANTICOL1:{\r
                                sniffState = SNF_ANTICOL1;\r
                        }\r
                        break;\r
                }\r
                case SNF_ANTICOL1:{\r
-                       if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { \r
+                       if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {  // UID from tag (CL1) \r
                                memcpy(sniffUID + 3, data, 4);\r
                                memcpy(sniffUID + 3, data, 4);\r
-                       \r
                                sniffState = SNF_UID1;\r
                        }\r
                        break;\r
                }\r
                case SNF_UID1:{\r
                                sniffState = SNF_UID1;\r
                        }\r
                        break;\r
                }\r
                case SNF_UID1:{\r
-                       if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { \r
+                       if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {   // Select 4 Byte UID from reader\r
                                sniffState = SNF_SAK;\r
                        }\r
                        break;\r
                }\r
                case SNF_SAK:{\r
                                sniffState = SNF_SAK;\r
                        }\r
                        break;\r
                }\r
                case SNF_SAK:{\r
-                       if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { \r
+                       if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
                                sniffSAK = data[0];\r
                                sniffSAK = data[0];\r
-                               if (sniffUID[3] == 0x88) {\r
+                               if (sniffUID[3] == 0x88) {                      // CL2 UID part to be expected\r
                                        sniffState = SNF_ANTICOL2;\r
                                        sniffState = SNF_ANTICOL2;\r
-                               } else {\r
+                               } else {                                                        // select completed\r
                                        sniffState = SNF_CARD_IDLE;\r
                                }\r
                        }\r
                        break;\r
                }\r
                case SNF_ANTICOL2:{\r
                                        sniffState = SNF_CARD_IDLE;\r
                                }\r
                        }\r
                        break;\r
                }\r
                case SNF_ANTICOL2:{\r
-                       if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { \r
+                       if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r
                                memcpy(sniffUID, data, 4);\r
                                sniffUIDType = SNF_UID_7;\r
                                memcpy(sniffUID, data, 4);\r
                                sniffUIDType = SNF_UID_7;\r
-                       \r
                                sniffState = SNF_UID2;\r
                                sniffState = SNF_UID2;\r
-               }\r
+                       }\r
                        break;\r
                }\r
                case SNF_UID2:{\r
                        break;\r
                }\r
                case SNF_UID2:{\r
-                       if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { \r
+                       if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {        // Select 2nd part of 7 Byte UID\r
                                sniffState = SNF_SAK;\r
                                sniffState = SNF_SAK;\r
-       Dbprintf("SNF_SAK");                            \r
                        }\r
                        break;\r
                }\r
                        }\r
                        break;\r
                }\r
-               case SNF_CARD_IDLE:{\r
+               case SNF_CARD_IDLE:{    // trace the card select sequence\r
                        sniffBuf[0] = 0xFF;\r
                        sniffBuf[1] = 0xFF;\r
                        memcpy(sniffBuf + 2, sniffUID, 7);\r
                        sniffBuf[0] = 0xFF;\r
                        sniffBuf[1] = 0xFF;\r
                        memcpy(sniffBuf + 2, sniffUID, 7);\r
@@ -123,18 +114,15 @@ int RAMFUNC MfSniffLogic(const uint8_t * data, int len, uint32_t parity, int bit
                        sniffBuf[12] = 0xFF;\r
                        sniffBuf[13] = 0xFF;\r
                        LogTrace(sniffBuf, 14, 0, parity, true);\r
                        sniffBuf[12] = 0xFF;\r
                        sniffBuf[13] = 0xFF;\r
                        LogTrace(sniffBuf, 14, 0, parity, true);\r
-                       timerData = GetTickCount();\r
-               }\r
-               case SNF_CARD_CMD:{\r
+               }       // intentionally no break;\r
+               case SNF_CARD_CMD:{             \r
                        LogTrace(data, len, 0, parity, true);\r
                        LogTrace(data, len, 0, parity, true);\r
-\r
                        sniffState = SNF_CARD_RESP;\r
                        timerData = GetTickCount();\r
                        break;\r
                }\r
                case SNF_CARD_RESP:{\r
                        LogTrace(data, len, 0, parity, false);\r
                        sniffState = SNF_CARD_RESP;\r
                        timerData = GetTickCount();\r
                        break;\r
                }\r
                case SNF_CARD_RESP:{\r
                        LogTrace(data, len, 0, parity, false);\r
-\r
                        sniffState = SNF_CARD_CMD;\r
                        timerData = GetTickCount();\r
                        break;\r
                        sniffState = SNF_CARD_CMD;\r
                        timerData = GetTickCount();\r
                        break;\r
@@ -145,51 +133,40 @@ int RAMFUNC MfSniffLogic(const uint8_t * data, int len, uint32_t parity, int bit
                break;\r
        }\r
 \r
                break;\r
        }\r
 \r
-       return 0;\r
+\r
+       return FALSE;\r
 }\r
 \r
 }\r
 \r
-int RAMFUNC MfSniffSend(int maxTimeoutMs) {\r
-       if (traceLen && (timerData + maxTimeoutMs < GetTickCount())) {\r
+bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
+       if (traceLen && (GetTickCount() > timerData + maxTimeoutMs)) {\r
                return intMfSniffSend();\r
        }\r
                return intMfSniffSend();\r
        }\r
-       return 0;\r
+       return FALSE;\r
 }\r
 \r
 }\r
 \r
-// internal seding function. not a RAMFUNC.\r
-int intMfSniffSend() {\r
-       \r
+// internal sending function. not a RAMFUNC.\r
+bool intMfSniffSend() {\r
+\r
        int pckSize = 0;\r
        int pckLen = traceLen;\r
        int pckNum = 0;\r
        int pckSize = 0;\r
        int pckLen = traceLen;\r
        int pckNum = 0;\r
-       \r
-       if (!traceLen) return 0;\r
 \r
        FpgaDisableSscDma();\r
 \r
        FpgaDisableSscDma();\r
-\r
        while (pckLen > 0) {\r
        while (pckLen > 0) {\r
-               pckSize = MIN(32, pckLen);\r
-//             UsbCommand ack = {CMD_ACK, {1, pckSize, pckNum}};\r
-//             memcpy(ack.d.asBytes, trace + traceLen - pckLen, pckSize);\r
-       \r
+               pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
                LED_B_ON();\r
                LED_B_ON();\r
-    cmd_send(CMD_ACK,1,pckSize,pckNum,trace + traceLen - pckLen,pckSize);\r
-//             UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));\r
-//             SpinDelay(20);\r
+               cmd_send(CMD_ACK, 1, pckSize, pckNum, trace + traceLen - pckLen, pckSize);\r
                LED_B_OFF();\r
 \r
                pckLen -= pckSize;\r
                pckNum++;\r
        }\r
 \r
                LED_B_OFF();\r
 \r
                pckLen -= pckSize;\r
                pckNum++;\r
        }\r
 \r
-//     UsbCommand ack = {CMD_ACK, {2, 0, 0}};\r
-\r
        LED_B_ON();\r
        LED_B_ON();\r
-  cmd_send(CMD_ACK,2,0,0,0,0);\r
-//     UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));\r
+       cmd_send(CMD_ACK,2,0,0,0,0);\r
        LED_B_OFF();\r
 \r
        LED_B_OFF();\r
 \r
-       traceLen = 0;\r
-       memset(trace, 0x44, TRACE_SIZE);\r
+       iso14a_clear_trace();\r
        \r
        \r
-       return 1;\r
+       return TRUE;\r
 }\r
 }\r
index db5af9a850305ddafab2f7c25237ac46a2ee5d97..1065fa618910a86fd5e355da07280c8cef063ef0 100644 (file)
 #define SNF_UID_4                              0\r
 #define SNF_UID_7                              0\r
 \r
 #define SNF_UID_4                              0\r
 #define SNF_UID_7                              0\r
 \r
-int MfSniffInit(void);\r
-int RAMFUNC MfSniffLogic(const uint8_t * data, int len, uint32_t parity, int bitCnt, int reader);\r
-int RAMFUNC MfSniffSend(int maxTimeoutMs);\r
-int intMfSniffSend();\r
-int MfSniffEnd(void);\r
+bool MfSniffInit(void);\r
+bool RAMFUNC MfSniffLogic(const uint8_t * data, uint16_t len, uint32_t parity, uint16_t bitCnt, bool reader);\r
+bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs);\r
+bool intMfSniffSend();\r
+bool MfSniffEnd(void);\r
 \r
 #endif
\ No newline at end of file
 \r
 #endif
\ No newline at end of file
index dc18e5e385247ac727a259c6095bd8e008c0b60f..6d34ae5e80f0f3cad520bdf480f75e9396956638 100644 (file)
@@ -316,9 +316,9 @@ uint32_t RAMFUNC GetDeltaCountUS(){
 
 
 //  -------------------------------------------------------------------------
 
 
 //  -------------------------------------------------------------------------
-//  Mifare timer. Uses ssp_clk from FPGA 
+//  Timer for iso14443 commands. Uses ssp_clk from FPGA 
 //  -------------------------------------------------------------------------
 //  -------------------------------------------------------------------------
-void StartCountMifare()
+void StartCountSspClk()
 {
        AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1) | (1 << AT91C_ID_TC2);  // Enable Clock to all timers
        AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_TIOA1               // XC0 Clock = TIOA1
 {
        AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1) | (1 << AT91C_ID_TC2);  // Enable Clock to all timers
        AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_TIOA1               // XC0 Clock = TIOA1
@@ -330,7 +330,7 @@ void StartCountMifare()
        AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK // TC1 Clock = MCK(48MHz)/2 = 24MHz
                                                        | AT91C_TC_CPCSTOP                              // Stop clock on RC compare
                                                        | AT91C_TC_EEVTEDG_RISING               // Trigger on rising edge of Event
        AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK // TC1 Clock = MCK(48MHz)/2 = 24MHz
                                                        | AT91C_TC_CPCSTOP                              // Stop clock on RC compare
                                                        | AT91C_TC_EEVTEDG_RISING               // Trigger on rising edge of Event
-                                                       | AT91C_TC_EEVT_TIOB                    // Event-Source: TIOB1 (= ssc_clk from FPGA = 13,56MHz / 16)
+                                                       | AT91C_TC_EEVT_TIOB                    // Event-Source: TIOB1 (= ssp_clk from FPGA = 13,56MHz/16)
                                                        | AT91C_TC_ENETRG                               // Enable external trigger event
                                                        | AT91C_TC_WAVESEL_UP                   // Upmode without automatic trigger on RC compare
                                                        | AT91C_TC_WAVE                                 // Waveform Mode
                                                        | AT91C_TC_ENETRG                               // Enable external trigger event
                                                        | AT91C_TC_WAVESEL_UP                   // Upmode without automatic trigger on RC compare
                                                        | AT91C_TC_WAVE                                 // Waveform Mode
@@ -339,7 +339,7 @@ void StartCountMifare()
        AT91C_BASE_TC1->TC_RC = 0x04;                                                   // RC Compare value = 0x04
 
        // use TC0 to count TIOA1 pulses
        AT91C_BASE_TC1->TC_RC = 0x04;                                                   // RC Compare value = 0x04
 
        // use TC0 to count TIOA1 pulses
-       AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;                               // disable TC0  
+       AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;                               // disable TC0
        AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_XC0                              // TC0 clock = XC0 clock = TIOA1
                                                        | AT91C_TC_WAVE                                 // Waveform Mode
                                                        | AT91C_TC_WAVESEL_UP                   // just count
        AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_XC0                              // TC0 clock = XC0 clock = TIOA1
                                                        | AT91C_TC_WAVE                                 // Waveform Mode
                                                        | AT91C_TC_WAVESEL_UP                   // just count
@@ -354,29 +354,40 @@ void StartCountMifare()
                                                        | AT91C_TC_WAVE                                 // Waveform Mode
                                                        | AT91C_TC_WAVESEL_UP;                  // just count
        
                                                        | AT91C_TC_WAVE                                 // Waveform Mode
                                                        | AT91C_TC_WAVESEL_UP;                  // just count
        
-       
        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN;                                // enable TC0
        AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN;                                // enable TC1
        AT91C_BASE_TC2->TC_CCR = AT91C_TC_CLKEN;                                // enable TC2
 
        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN;                                // enable TC0
        AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN;                                // enable TC1
        AT91C_BASE_TC2->TC_CCR = AT91C_TC_CLKEN;                                // enable TC2
 
-       // activate the ISO14443 part of the FPGA. We need the clock and frame signals.
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
-
-       // synchronize the counter with the ssp_frame signal.
+       //
+       // synchronize the counter with the ssp_frame signal. Note: FPGA must be in any iso14446 mode, otherwise the frame signal would not be present 
+       //
+       while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME));   // wait for ssp_frame to go high (start of frame)
        while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME);              // wait for ssp_frame to be low
        while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME);              // wait for ssp_frame to be low
-       while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME));   // sync on rising edge of ssp_frame (= start of transfer)
-
+       // after the falling edge of ssp_frame, there is delay of 1/13,56MHz (73ns) until the next rising edge of ssp_clk. This are only a few
+       // processor cycles. We therefore may or may not be able to sync on this edge. Therefore better make sure that we miss it:
+       while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));     // wait for ssp_clk to go high
+       // note: up to now two ssp_clk rising edges have passed since the rising edge of ssp_frame
+       // it is now safe to assert a sync signal. This sets all timers to 0 on next active clock edge
        AT91C_BASE_TCB->TCB_BCR = 1;                                                    // assert Sync (set all timers to 0 on next active clock edge)
        AT91C_BASE_TCB->TCB_BCR = 1;                                                    // assert Sync (set all timers to 0 on next active clock edge)
+       // at the next (3rd) ssp_clk rising edge, TC1 will be reset (and not generate a clock signal to TC0)
+       // at the next (4th) ssp_clk rising edge, TC0 (the low word of our counter) will be reset. From now on,
+       // whenever the last three bits of our counter go 0, we can be sure to be in the middle of a frame transfer.
+       // (just started with the transfer of the 4th Bit).
+       // The high word of the counter (TC2) will not reset until the low word (TC0) overflows. Therefore need to wait quite some time before
+       // we can use the counter.
+       while (AT91C_BASE_TC0->TC_CV < 0xFFF0);
 }
 
 
 }
 
 
-uint32_t RAMFUNC GetCountMifare(){
+uint32_t RAMFUNC GetCountSspClk(){
        uint32_t tmp_count;
        tmp_count = (AT91C_BASE_TC2->TC_CV << 16) | AT91C_BASE_TC0->TC_CV;
        uint32_t tmp_count;
        tmp_count = (AT91C_BASE_TC2->TC_CV << 16) | AT91C_BASE_TC0->TC_CV;
-       if ((tmp_count & 0xffff) == 0) { //small chance that we may have missed an increment in TC2
+       if ((tmp_count & 0x0000ffff) == 0) { //small chance that we may have missed an increment in TC2
                return (AT91C_BASE_TC2->TC_CV << 16);
        } 
        else {
                return tmp_count;
        }
 }
                return (AT91C_BASE_TC2->TC_CV << 16);
        } 
        else {
                return tmp_count;
        }
 }
+
+
index 9c4b4c58e75a81e09661a829695960bb4e53cf46..e8b9cdffbc8dd2ebf3a537ae9592a9207fba8ae0 100644 (file)
@@ -47,7 +47,7 @@ void StartCountUS();
 uint32_t RAMFUNC GetCountUS();
 uint32_t RAMFUNC GetDeltaCountUS();
 
 uint32_t RAMFUNC GetCountUS();
 uint32_t RAMFUNC GetDeltaCountUS();
 
-void StartCountMifare();
-uint32_t RAMFUNC GetCountMifare();
+void StartCountSspClk();
+uint32_t RAMFUNC GetCountSspClk();
 
 #endif
 
 #endif
index 2c5fd1c02a2624871944383e95b8b0345c5fff16..d16d71ff09ae34a09a35511b9a0a6b22f639d7e7 100644 (file)
@@ -16,7 +16,6 @@
 #include "util.h"
 #include "iso14443crc.h"
 #include "data.h"
 #include "util.h"
 #include "iso14443crc.h"
 #include "data.h"
-//#include "proxusb.h"
 #include "proxmark3.h"
 #include "ui.h"
 #include "cmdparser.h"
 #include "proxmark3.h"
 #include "ui.h"
 #include "cmdparser.h"
@@ -30,129 +29,150 @@ static void waitCmd(uint8_t iLen);
 
 int CmdHF14AList(const char *Cmd)
 {
 
 int CmdHF14AList(const char *Cmd)
 {
-  uint8_t got[1920];
-  GetFromBigBuf(got,sizeof(got),0);
-  WaitForResponse(CMD_ACK,NULL);
-
-  PrintAndLog("recorded activity:");
-  PrintAndLog(" ETU     :rssi: who bytes");
-  PrintAndLog("---------+----+----+-----------");
-
-  int i = 0;
-  int prev = -1;
+       bool ShowWaitCycles = false;
+       char param = param_getchar(Cmd, 0);
+       
+       if (param == 'h' || (param != 0 && param != 'f')) {
+               PrintAndLog("List data in trace buffer.");
+               PrintAndLog("Usage:  hf 14a list [f]");
+               PrintAndLog("f - show frame delay times as well");
+               PrintAndLog("sample: hf 14a list f");
+               return 0;
+       }       
 
 
-  for (;;) {
-    if(i >= 1900) {
-      break;
-    }
+       if (param == 'f') {
+               ShowWaitCycles = true;
+       }
+               
+       uint8_t got[1920];
+       GetFromBigBuf(got,sizeof(got),0);
+       WaitForResponse(CMD_ACK,NULL);
+
+       PrintAndLog("Recorded Activity");
+       PrintAndLog("");
+       PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
+       PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
+       PrintAndLog("");
+       PrintAndLog("     Start |       End | Src | Data");
+       PrintAndLog("-----------|-----------|-----|--------");
+
+       int i = 0;
+       uint32_t first_timestamp = 0;
+       uint32_t timestamp;
+       uint32_t EndOfTransmissionTimestamp = 0;
+       
+       for (;;) {
+               if(i >= 1900) {
+                       break;
+               }
 
 
-    bool isResponse;
-    int timestamp = *((uint32_t *)(got+i));
-    if (timestamp & 0x80000000) {
-      timestamp &= 0x7fffffff;
-      isResponse = 1;
-    } else {
-      isResponse = 0;
-    }
+               bool isResponse;
+               timestamp = *((uint32_t *)(got+i));
+               if (timestamp & 0x80000000) {
+                 timestamp &= 0x7fffffff;
+                 isResponse = true;
+               } else {
+                 isResponse = false;
+               }
 
 
-    int metric = 0;
-    int parityBits = *((uint32_t *)(got+i+4));
-    // 4 bytes of additional information...
-    // maximum of 32 additional parity bit information
-    //
-    // TODO:
-    // at each quarter bit period we can send power level (16 levels)
-    // or each half bit period in 256 levels.
+               if(i==0) {
+                       first_timestamp = timestamp;
+               }
+               
+               int parityBits = *((uint32_t *)(got+i+4));
 
 
+               int len = got[i+8];
 
 
-    int len = got[i+8];
+               if (len > 100) {
+                       break;
+               }
+               if (i + len >= 1900) {
+                       break;
+               }
 
 
-    if (len > 100) {
-      break;
-    }
-    if (i + len >= 1900) {
-      break;
-    }
+               uint8_t *frame = (got+i+9);
 
 
-    uint8_t *frame = (got+i+9);
+               // Break and stick with current result if buffer was not completely full
+               if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break; 
 
 
-    // Break and stick with current result if buffer was not completely full
-    if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
+               char line[1000] = "";
+               int j;
+               if (len) {
+                       for (j = 0; j < len; j++) {
+                               int oddparity = 0x01;
+                               int k;
 
 
-    char line[1000] = "";
-    int j;
-    for (j = 0; j < len; j++) {
-      int oddparity = 0x01;
-      int k;
+                               for (k=0;k<8;k++) {
+                                       oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
+                               }
 
 
-      for (k=0;k<8;k++) {
-        oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
-      }
+                               //if((parityBits >> (len - j - 1)) & 0x01) {
+                               if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
+                                       sprintf(line+(j*4), "%02x!  ", frame[j]);
+                               } else {
+                                       sprintf(line+(j*4), "%02x   ", frame[j]);
+                               }
+                       }
+               } else {
+                       if (ShowWaitCycles) {
+                               uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
+                               sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
+                       }
+               }
 
 
-      //if((parityBits >> (len - j - 1)) & 0x01) {
-      if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
-        sprintf(line+(j*4), "%02x!  ", frame[j]);
-      }
-      else {
-        sprintf(line+(j*4), "%02x   ", frame[j]);
-      }
-    }
+               char *crc;
+               crc = "";
+               if (len > 2) {
+                       uint8_t b1, b2;
+                       for (j = 0; j < (len - 1); j++) {
+                               // gives problems... search for the reason..
+                               /*if(frame[j] == 0xAA) {
+                                       switch(frame[j+1]) {
+                                               case 0x01:
+                                                       crc = "[1] Two drops close after each other";
+                                                       break;
+                                               case 0x02:
+                                                       crc = "[2] Potential SOC with a drop in second half of bitperiod";
+                                                       break;
+                                               case 0x03:
+                                                       crc = "[3] Segment Z after segment X is not possible";
+                                                       break;
+                                               case 0x04:
+                                                       crc = "[4] Parity bit of a fully received byte was wrong";
+                                                       break;
+                                               default:
+                                                       crc = "[?] Unknown error";
+                                                       break;
+                                       }
+                                       break;
+                               }*/
+                       }
 
 
-    char *crc;
-    crc = "";
-    if (len > 2) {
-               uint8_t b1, b2;
-      for (j = 0; j < (len - 1); j++) {
-        // gives problems... search for the reason..
-        /*if(frame[j] == 0xAA) {
-          switch(frame[j+1]) {
-            case 0x01:
-              crc = "[1] Two drops close after each other";
-            break;
-            case 0x02:
-              crc = "[2] Potential SOC with a drop in second half of bitperiod";
-              break;
-            case 0x03:
-              crc = "[3] Segment Z after segment X is not possible";
-              break;
-            case 0x04:
-              crc = "[4] Parity bit of a fully received byte was wrong";
-              break;
-            default:
-              crc = "[?] Unknown error";
-              break;
-          }
-          break;
-        }*/
-      }
-
-      if (strlen(crc)==0) {
-        ComputeCrc14443(CRC_14443_A, frame, len-2, &b1, &b2);
-        if (b1 != frame[len-2] || b2 != frame[len-1]) {
-          crc = (isResponse & (len < 6)) ? "" : " !crc";
-        } else {
-          crc = "";
+                       if (strlen(crc)==0) {
+                               ComputeCrc14443(CRC_14443_A, frame, len-2, &b1, &b2);
+                               if (b1 != frame[len-2] || b2 != frame[len-1]) {
+                                       crc = (isResponse & (len < 6)) ? "" : " !crc";
+                               } else {
+                                       crc = "";
+                               }
+                       }
+               } else {
+                       crc = ""; // SHORT
                }
                }
-    }
-    } else {
-      crc = ""; // SHORT
-    }
 
 
-    char metricString[100];
-    if (isResponse) {
-      sprintf(metricString, "%3d", metric);
-    } else {
-      strcpy(metricString, "   ");
-    }
+               i += (len + 9);
 
 
-    PrintAndLog(" +%7d: %s: %s %s %s",
-      (prev < 0 ? 0 : (timestamp - prev)),
-      metricString,
-      (isResponse ? "TAG " : "    "), line, crc);
+               EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
+               
+               if (!ShowWaitCycles) i += 9;
+               
+               PrintAndLog(" %9d | %9d | %s | %s %s",
+                       (timestamp - first_timestamp),
+                       (EndOfTransmissionTimestamp - first_timestamp),
+                       (len?(isResponse ? "Tag" : "Rdr"):"   "),
+                       line, crc);
 
 
-    prev = timestamp;
-    i += (len + 9);
-  }
+       }
        return 0;
 }
 
        return 0;
 }
 
@@ -167,7 +187,7 @@ int CmdHF14AReader(const char *Cmd)
        SendCommand(&c);
 
        UsbCommand resp;
        SendCommand(&c);
 
        UsbCommand resp;
-  WaitForResponse(CMD_ACK,&resp);
+       WaitForResponse(CMD_ACK,&resp);
        
        iso14a_card_select_t *card = (iso14a_card_select_t *)resp.d.asBytes;
 
        
        iso14a_card_select_t *card = (iso14a_card_select_t *)resp.d.asBytes;
 
index 6696ac0947f2fab7a1d62566ab40b09ca0707ee9..c42d54c585888e37aa0b6e2104464de3d67a18f4 100644 (file)
@@ -182,6 +182,9 @@ int CmdHF14BList(const char *Cmd)
 
     uint8_t *frame = (got+i+9);
 
 
     uint8_t *frame = (got+i+9);
 
+       // Break and stick with current result if buffer was not completely full
+       if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break; 
+       
     char line[1000] = "";
     int j;
     for(j = 0; j < len; j++) {
     char line[1000] = "";
     int j;
     for(j = 0; j < len; j++) {
index 637ef4a1f97a9db98e7a32730e75235096c2ac3b..8d78b0e6f8665daa2fa2625ea5772001427428e4 100644 (file)
@@ -1144,7 +1144,7 @@ int CmdHF14AMfChk(const char *Cmd)
 \r
 int CmdHF14AMf1kSim(const char *Cmd)\r
 {\r
 \r
 int CmdHF14AMf1kSim(const char *Cmd)\r
 {\r
-       uint8_t uid[7] = {0, 0, 0, 0,0,0,0};\r
+       uint8_t uid[7] = {0, 0, 0, 0, 0, 0, 0};\r
        uint8_t exitAfterNReads = 0;\r
        uint8_t flags = 0;\r
 \r
        uint8_t exitAfterNReads = 0;\r
        uint8_t flags = 0;\r
 \r
@@ -1196,7 +1196,7 @@ int CmdHF14AMf1kSim(const char *Cmd)
   memcpy(c.d.asBytes, uid, sizeof(uid));\r
   SendCommand(&c);\r
 \r
   memcpy(c.d.asBytes, uid, sizeof(uid));\r
   SendCommand(&c);\r
 \r
-  if(flags & 1)\r
+  if(flags & FLAG_INTERACTIVE)\r
   {\r
          UsbCommand resp;\r
          PrintAndLog("Press pm3-button to abort simulation");\r
   {\r
          UsbCommand resp;\r
          PrintAndLog("Press pm3-button to abort simulation");\r
@@ -1879,7 +1879,7 @@ int CmdHF14AMfSniff(const char *Cmd){
                                PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);\r
                                num = 0;\r
                                while (bufPtr - buf + 9 < blockLen) {\r
                                PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);\r
                                num = 0;\r
                                while (bufPtr - buf + 9 < blockLen) {\r
-                                 isTag = bufPtr[3] & 0x80 ? true:false;\r
+                                       isTag = bufPtr[3] & 0x80 ? true:false;\r
                                        bufPtr += 4;\r
                                        parity = *((uint32_t *)(bufPtr));\r
                                        bufPtr += 4;\r
                                        bufPtr += 4;\r
                                        parity = *((uint32_t *)(bufPtr));\r
                                        bufPtr += 4;\r
@@ -1923,7 +1923,7 @@ static command_t CommandTable[] =
   {"restore",  CmdHF14AMfRestore,      0, "Restore MIFARE classic binary file to BLANK tag"},\r
   {"wrbl",             CmdHF14AMfWrBl,                 0, "Write MIFARE classic block"},\r
   {"chk",                      CmdHF14AMfChk,                  0, "Test block keys"},\r
   {"restore",  CmdHF14AMfRestore,      0, "Restore MIFARE classic binary file to BLANK tag"},\r
   {"wrbl",             CmdHF14AMfWrBl,                 0, "Write MIFARE classic block"},\r
   {"chk",                      CmdHF14AMfChk,                  0, "Test block keys"},\r
-  {"mifare",   CmdHF14AMifare,                 0, "Read parity error messages. param - <used card nonce>"},\r
+  {"mifare",   CmdHF14AMifare,                 0, "Read parity error messages."},\r
   {"nested",   CmdHF14AMfNested,               0, "Test nested authentication"},\r
   {"sniff",            CmdHF14AMfSniff,                0, "Sniff card-reader communication"},\r
   {"sim",                      CmdHF14AMf1kSim,                0, "Simulate MIFARE card"},\r
   {"nested",   CmdHF14AMfNested,               0, "Test nested authentication"},\r
   {"sniff",            CmdHF14AMfSniff,                0, "Sniff card-reader communication"},\r
   {"sim",                      CmdHF14AMf1kSim,                0, "Simulate MIFARE card"},\r
index e7d6270779a2e87db920d2fd16bbd18ddaca0b66..97cdd23362dfe38359dd9066c57ad5b893fb225a 100644 (file)
Binary files a/fpga/fpga.bit and b/fpga/fpga.bit differ
index 1009c4365e5e6adb9fb9901523c7f47593063b8e..0f7325b681a920baba0f54f40dd30b7f408d7bc6 100644 (file)
@@ -3,6 +3,13 @@
 // Gerhard de Koning Gans, April 2008
 //-----------------------------------------------------------------------------
 
 // Gerhard de Koning Gans, April 2008
 //-----------------------------------------------------------------------------
 
+// constants for the different modes:
+`define SNIFFER                        3'b000
+`define TAGSIM_LISTEN  3'b001
+`define TAGSIM_MOD             3'b010
+`define READER_LISTEN  3'b011
+`define READER_MOD             3'b100
+
 module hi_iso14443a(
     pck0, ck_1356meg, ck_1356megb,
     pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,
 module hi_iso14443a(
     pck0, ck_1356meg, ck_1356megb,
     pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,
@@ -25,26 +32,23 @@ module hi_iso14443a(
 reg ssp_clk;
 reg ssp_frame;
 
 reg ssp_clk;
 reg ssp_frame;
 
-reg fc_div_2;
-always @(posedge ck_1356meg)
-    fc_div_2 = ~fc_div_2;
-
 wire adc_clk;
 assign adc_clk = ck_1356meg;
 
 wire adc_clk;
 assign adc_clk = ck_1356meg;
 
-reg after_hysteresis, after_hysteresis_prev1, after_hysteresis_prev2, after_hysteresis_prev3;
+reg after_hysteresis, after_hysteresis_prev1, after_hysteresis_prev2, after_hysteresis_prev3, after_hysteresis_prev4;
 reg [11:0] has_been_low_for;
 reg [8:0] saw_deep_modulation;
 reg [2:0] deep_counter;
 reg deep_modulation;
 reg [11:0] has_been_low_for;
 reg [8:0] saw_deep_modulation;
 reg [2:0] deep_counter;
 reg deep_modulation;
+
 always @(negedge adc_clk)
 begin
 always @(negedge adc_clk)
 begin
-       if(& adc_d[7:6]) after_hysteresis <= 1'b1;                      // if adc_d >= 196 
-    else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0;  // if adc_d <= 15
+       if(& adc_d[7:6]) after_hysteresis <= 1'b1;                      // adc_d >= 196 (U >= 3,28V) -> after_hysteris = 1
+    else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0;  // if adc_d <= 15 (U <= 1,13V) -> after_hysteresis = 0
        
        
-       if(~(| adc_d[7:0]))
+       if(~(| adc_d[7:0]))                                                                     // if adc_d == 0 (U <= 0,94V)
        begin
        begin
-               if(deep_counter == 3'd7)
+               if(deep_counter == 3'd7)                                                // adc_d == 0 for 7 adc_clk ticks -> deep_modulation (by reader)
                begin
                        deep_modulation <= 1'b1;
                        saw_deep_modulation <= 8'd0;
                begin
                        deep_modulation <= 1'b1;
                        saw_deep_modulation <= 8'd0;
@@ -52,10 +56,10 @@ begin
                else
                        deep_counter <= deep_counter + 1;
        end
                else
                        deep_counter <= deep_counter + 1;
        end
-       else
+       else                                                    
        begin
                deep_counter <= 3'd0;
        begin
                deep_counter <= 3'd0;
-               if(saw_deep_modulation == 8'd255)
+               if(saw_deep_modulation == 8'd255)                               // adc_d != 0 for 255 adc_clk ticks -> deep_modulation is over, now waiting for tag's response
                        deep_modulation <= 1'b0;
                else
                        saw_deep_modulation <= saw_deep_modulation + 1;
                        deep_modulation <= 1'b0;
                else
                        saw_deep_modulation <= saw_deep_modulation + 1;
@@ -63,37 +67,31 @@ begin
        
        if(after_hysteresis)
     begin
        
        if(after_hysteresis)
     begin
-        has_been_low_for <= 7'b0;
+        has_been_low_for <= 12'd0;
     end
     else
     begin
         if(has_been_low_for == 12'd4095)
         begin
             has_been_low_for <= 12'd0;
     end
     else
     begin
         if(has_been_low_for == 12'd4095)
         begin
             has_been_low_for <= 12'd0;
-            after_hysteresis <= 1'b1;
+            after_hysteresis <= 1'b1;                                  // reset after_hysteresis to 1 if it had been 0 for 4096 cycles (no field)
         end
         else
         end
         else
+               begin
             has_been_low_for <= has_been_low_for + 1;
             has_been_low_for <= has_been_low_for + 1;
+               end     
     end
 end
 
     end
 end
 
+
+
 // Report every 4 subcarrier cycles
 // Report every 4 subcarrier cycles
-// 64 periods of carrier frequency => 6-bit counter [negedge_cnt]
-reg [5:0] negedge_cnt;
-reg bit1, bit2, bit3;
-reg [3:0] count_ones;
-reg [3:0] count_zeros;
-// wire [7:0] avg;
-// reg [7:0] lavg;
-// reg signed [12:0] step1;
-// reg signed [12:0] step2;
-// reg [7:0] stepsize;
-reg [7:0] rx_mod_edge_threshold;
+// 128 periods of carrier frequency => 7-bit counter [negedge_cnt]
+reg [6:0] negedge_cnt;
+reg bit1, bit2, bit3, bit4;
 reg curbit;
 reg curbit;
-// reg [12:0] average;
-// wire signed [9:0] dif;
 
 
-// storage for two previous samples:
+// storage for four previous samples:
 reg [7:0] adc_d_1;
 reg [7:0] adc_d_2;
 reg [7:0] adc_d_3;
 reg [7:0] adc_d_1;
 reg [7:0] adc_d_2;
 reg [7:0] adc_d_3;
@@ -108,201 +106,244 @@ assign adc_d_filtered = (adc_d_4 << 1) + adc_d_3 - adc_d_1 - (adc_d << 1);
 reg [7:0] rx_mod_falling_edge_max;
 reg [7:0] rx_mod_rising_edge_max;
 
 reg [7:0] rx_mod_falling_edge_max;
 reg [7:0] rx_mod_rising_edge_max;
 
-// A register to send the results to the arm
-reg signed [7:0] to_arm;
+// A register to send 8 Bit results to the arm
+reg [7:0] to_arm;
 
 
 reg bit_to_arm;
 reg fdt_indicator, fdt_elapsed;
 reg [10:0] fdt_counter;
 
 
 reg bit_to_arm;
 reg fdt_indicator, fdt_elapsed;
 reg [10:0] fdt_counter;
-reg [47:0] mod_sig_buf;
-wire mod_sig_buf_empty;
-reg [5:0] mod_sig_ptr;
+//reg [47:0] mod_sig_buf;
+reg [31:0] mod_sig_buf;
+//reg [5:0] mod_sig_ptr;
+reg [4:0] mod_sig_ptr;
 reg [3:0] mod_sig_flip;
 reg mod_sig, mod_sig_coil;
 reg temp_buffer_reset;
 reg sendbit;
 reg [3:0] mod_sig_flip;
 reg mod_sig, mod_sig_coil;
 reg temp_buffer_reset;
 reg sendbit;
-
-assign mod_sig_buf_empty = ~(|mod_sig_buf[47:0]);
-reg [2:0] ssp_frame_counter;
+reg [3:0] sub_carrier_cnt;
 
 // ADC data appears on the rising edge, so sample it on the falling edge
 always @(negedge adc_clk)
 begin
        // ------------------------------------------------------------------------------------------------------------------------------------------------------------------
 
 // ADC data appears on the rising edge, so sample it on the falling edge
 always @(negedge adc_clk)
 begin
        // ------------------------------------------------------------------------------------------------------------------------------------------------------------------
-       // relevant for TAGSIM_MOD only. Timing of Tag's answer to a command received from a reader
+       // relevant for TAGSIM_MOD only. Timing of Tag's answer relative to a command received from a reader
        // ISO14443-3 specifies:
        // fdt = 1172, if last bit was 0.
        // fdt = 1236, if last bit was 1.
        // the FPGA takes care for the 1172 delay. To achieve the additional 1236-1172=64 ticks delay, the ARM must send an additional correction bit (before the start bit).
        // The correction bit will be coded as 00010000, i.e. it adds 4 bits to the transmission stream, causing the required delay.
        // ISO14443-3 specifies:
        // fdt = 1172, if last bit was 0.
        // fdt = 1236, if last bit was 1.
        // the FPGA takes care for the 1172 delay. To achieve the additional 1236-1172=64 ticks delay, the ARM must send an additional correction bit (before the start bit).
        // The correction bit will be coded as 00010000, i.e. it adds 4 bits to the transmission stream, causing the required delay.
-       if(fdt_counter == 11'd740) fdt_indicator = 1'b1;        // fdt_indicator is true for 740 <= fdt_counter <= 1148. Ready to buffer data. (?) 
-                                                                                                               // Shouldn' this be 1236 - 720 = 516? (The mod_sig_buf can buffer 46 data bits, 
-                                                                                                               // i.e. a maximum delay of 46 * 16 = 720 adc_clk ticks)
+       if(fdt_counter == 11'd547) fdt_indicator <= 1'b1;       // The ARM must not send earlier to prevent mod_sig_buf overflow.
+                                                                                                               // The mod_sig_buf can buffer 29 excess data bits, i.e. a maximum delay of 29 * 16 = 464 adc_clk ticks. fdt_indicator
+                                                                                                               // could appear at ssp_din after 1 tick, 16 ticks for the transfer, 128 ticks until response is sended.
+                                                                                                               // 1148 - 464 - 1 - 128 - 8 = 547
        
        
-       if(fdt_counter == 11'd1148) // additional 16 (+ eventual n*128) adc_clk_ticks delay will be added by the mod_sig_buf below
-                                                               // the remaining 8 ticks delay comes from the 8 ticks timing difference between reseting fdt_counter and the mod_sig_buf clock.
+       if ((mod_type == `TAGSIM_MOD) || (mod_type == `TAGSIM_LISTEN))
        begin
        begin
-               if(fdt_elapsed)
+               if(fdt_counter == 11'd1148) // the RF part delays the rising edge by approx 5 adc_clk_ticks, the ADC needs 3 clk_ticks for A/D conversion,
+                                                                       // 16 ticks delay by mod_sig_buf
+                                                                       // 1172 - 5 - 3 - 16 = 1148.
                begin
                begin
-                       if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig; // start modulating (if mod_sig is already set) 
+                       if(fdt_elapsed)
+                       begin
+                               if(negedge_cnt[3:0] == mod_sig_flip) mod_sig_coil <= mod_sig; // start modulating (if mod_sig is already set)
+                               sub_carrier_cnt[3:0] <= sub_carrier_cnt[3:0] + 1;
+                       end
+                       else
+                       begin
+                               mod_sig_flip <= negedge_cnt[3:0];                       // start modulation at this time
+                               sub_carrier_cnt[3:0] <= 0;                                      // subcarrier phase in sync with start of modulation
+                               mod_sig_coil <= mod_sig;                                        // assign signal to coil
+                               fdt_elapsed = 1'b1;
+                               if(~(| mod_sig_ptr[4:0])) mod_sig_ptr <= 5'd9;  // if mod_sig_ptr == 0 -> didn't receive a 1 yet. Delay next 1 by n*128 ticks.
+                               else temp_buffer_reset = 1'b1;                                  // else fix the buffer size at current position
+                       end
                end
                else
                begin
                end
                else
                begin
-                       mod_sig_flip[3:0] <= negedge_cnt[3:0];          // exact timing of modulation
-                       mod_sig_coil <= mod_sig;                                        // modulate (if mod_sig is already set)
-                       fdt_elapsed = 1'b1;
-                       fdt_indicator = 1'b0;
-
-                       if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001;     // didn't receive a 1 yet. Delay next 1 by n*128 ticks.
-                       else temp_buffer_reset = 1'b1;                                                  // else fix the buffer size at current position
+                       fdt_counter <= fdt_counter + 1; // Count until 1155
                end
        end
                end
        end
-       else
+       else // other modes: don't use the delay line.
        begin
        begin
-               fdt_counter <= fdt_counter + 1; // Count until 1148
-       end
+               mod_sig_coil <= ssp_dout;
+       end     
        
        
        //-------------------------------------------------------------------------------------------------------------------------------------------
        // Relevant for READER_LISTEN only
        // look for steepest falling and rising edges:
        
        
        //-------------------------------------------------------------------------------------------------------------------------------------------
        // Relevant for READER_LISTEN only
        // look for steepest falling and rising edges:
-       if (adc_d_filtered > 0)
+
+       if(negedge_cnt[3:0] == 4'd1)                                    // reset modulation detector. Save current edge.
+       begin
+               if (adc_d_filtered > 0)
                begin
                begin
-               if (adc_d_filtered > rx_mod_falling_edge_max)
                        rx_mod_falling_edge_max <= adc_d_filtered;
                        rx_mod_falling_edge_max <= adc_d_filtered;
-               end
-       else
+                       rx_mod_rising_edge_max <= 0;
+               end     
+               else
                begin
                begin
-               if (-adc_d_filtered > rx_mod_rising_edge_max)
+                       rx_mod_falling_edge_max <= 0;
                        rx_mod_rising_edge_max <= -adc_d_filtered;
                end
                        rx_mod_rising_edge_max <= -adc_d_filtered;
                end
-               
+       end
+       else                                                                                    // detect modulation
+       begin
+               if (adc_d_filtered > 0)
+               begin
+                       if (adc_d_filtered > rx_mod_falling_edge_max)
+                               rx_mod_falling_edge_max <= adc_d_filtered;
+               end
+               else
+               begin
+                       if (-adc_d_filtered > rx_mod_rising_edge_max)
+                               rx_mod_rising_edge_max <= -adc_d_filtered;
+               end
+       end
+
+       // detect modulation signal: if modulating, there must be a falling and a rising edge
+       if (rx_mod_falling_edge_max > 6 && rx_mod_rising_edge_max > 6)
+                       curbit <= 1'b1; // modulation
+               else
+                       curbit <= 1'b0; // no modulation
+                       
+       
        // store previous samples for filtering and edge detection:
        adc_d_4 <= adc_d_3;
        adc_d_3 <= adc_d_2;
        adc_d_2 <= adc_d_1;
        adc_d_1 <= adc_d;
 
        // store previous samples for filtering and edge detection:
        adc_d_4 <= adc_d_3;
        adc_d_3 <= adc_d_2;
        adc_d_2 <= adc_d_1;
        adc_d_1 <= adc_d;
 
-               
 
 
-       if(& negedge_cnt[3:0])  // == 0xf == 15
+       // Relevant for TAGSIM_MOD only (timing the Tag's answer. See above)
+       // When we see end of a modulation and we are emulating a Tag, start fdt_counter.
+       // Reset fdt_counter when modulation is detected.
+       if(~after_hysteresis /* && mod_sig_buf_empty */ && mod_type == `TAGSIM_LISTEN)
        begin
        begin
-               // Relevant for TAGSIM_MOD only (timing Tag's answer. See above)
-               // When there is a dip in the signal and not in (READER_MOD, READER_LISTEN, TAGSIM_MOD)
-               if(~after_hysteresis && mod_sig_buf_empty && ~((mod_type == 3'b100) || (mod_type == 3'b011) || (mod_type == 3'b010))) // last condition to prevent reset
+               fdt_counter <= 11'd0;
+               fdt_elapsed = 1'b0;
+               fdt_indicator <= 1'b0;
+               temp_buffer_reset = 1'b0;
+               mod_sig_ptr <= 5'b00000;
+               mod_sig = 1'b0;
+       end     
+
+
+       if(negedge_cnt[3:0] == 4'd1)
+       begin
+               // What do we communicate to the ARM
+               if(mod_type == `TAGSIM_LISTEN) 
+                       sendbit = after_hysteresis;
+               else if(mod_type == `TAGSIM_MOD)
+                       /* if(fdt_counter > 11'd772) sendbit = mod_sig_coil; // huh?
+                       else */ 
+                       sendbit = fdt_indicator;
+               else if (mod_type == `READER_LISTEN)
+                       sendbit = curbit;
+               else
+                       sendbit = 1'b0;
+       end
+
+       //------------------------------------------------------------------------------------------------------------------------------------------
+       // Prepare 8 Bits to communicate to ARM
+
+       // in SNIFFER mode: 4 Bits data sniffed as Tag, 4 Bits data sniffed as Reader
+       if(mod_type == `SNIFFER)
+       begin
+               if (negedge_cnt == 7'd63)
                begin
                begin
-                       fdt_counter <= 11'd0;
-                       fdt_elapsed = 1'b0;
-                       fdt_indicator = 1'b0;
-                       temp_buffer_reset = 1'b0;
-                       mod_sig_ptr <= 6'b000000;
-               end
-               
-               // Relevant for READER_LISTEN only
-               // detect modulation signal: if modulating, there must be a falling and a rising edge ... and vice versa
-               if (rx_mod_falling_edge_max > 6 && rx_mod_rising_edge_max > 6)
-                               curbit = 1'b1;  // modulation
+                       if(deep_modulation) // a reader is sending (or there's no field at all)
+                       begin
+                               to_arm <= {after_hysteresis_prev1,after_hysteresis_prev2,after_hysteresis_prev3,after_hysteresis_prev4,1'b0,1'b0,1'b0,1'b0};
+                       end
                        else
                        else
-                               curbit = 1'b0;  // no modulation
-                               
-               // prepare next edge detection:
-               rx_mod_rising_edge_max <= 0;
-               rx_mod_falling_edge_max <= 0;
-       
-       
-               // What do we communicate to the ARM
-               if(mod_type == 3'b001) sendbit = after_hysteresis;              // TAGSIM_LISTEN
-               else if(mod_type == 3'b010)                                                             // TAGSIM_MOD
+                       begin
+                               to_arm <= {after_hysteresis_prev1,after_hysteresis_prev2,after_hysteresis_prev3,after_hysteresis_prev4,bit1,bit2,bit3,bit4};
+                       end
+                       negedge_cnt <= 0;
+               end
+               else
                begin
                begin
-                       if(fdt_counter > 11'd772) sendbit = mod_sig_coil;
-                       else sendbit = fdt_indicator;
+                       negedge_cnt <= negedge_cnt + 1;
                end
                end
-               else if(mod_type == 3'b011) sendbit = curbit;                   // READER_LISTEN
-               else sendbit = 1'b0;                                                                    // READER_MOD, SNIFFER
-
        end
        end
-
-       //------------------------------------------------------------------------------------------------------------------------------------------
-       // Relevant for SNIFFER mode only. Prepare communication to ARM.
-               if(negedge_cnt == 7'd63)
-    begin
-               if(deep_modulation)
+       else
+       // other modes: 8 Bits info on queue delay
+       begin
+               if(negedge_cnt == 7'd127)
                begin
                begin
-                       to_arm <= {after_hysteresis_prev1,after_hysteresis_prev2,after_hysteresis_prev3,after_hysteresis,1'b0,1'b0,1'b0,1'b0};
+                       if (mod_type == `TAGSIM_MOD)
+                       begin
+                               to_arm[7:0] <= {mod_sig_ptr[4:0], mod_sig_flip[3:1]};
+                       end
+                       else
+                       begin
+                               to_arm[7:0] <= 8'd0;
+                       end
+                       negedge_cnt <= 0;
                end
                else
                begin
                end
                else
                begin
-                       to_arm <= {after_hysteresis_prev1,after_hysteresis_prev2,after_hysteresis_prev3,after_hysteresis,bit1,bit2,bit3,curbit};
+                               negedge_cnt <= negedge_cnt + 1;
                end
                end
-
-        negedge_cnt <= 0;
-       
        end
        end
-    else
-    begin
-        negedge_cnt <= negedge_cnt + 1;
-    end
-
-    if(negedge_cnt == 6'd15)
+       
+    if(negedge_cnt == 7'd1)
        begin
         after_hysteresis_prev1 <= after_hysteresis;
                bit1 <= curbit;
        end
        begin
         after_hysteresis_prev1 <= after_hysteresis;
                bit1 <= curbit;
        end
-    if(negedge_cnt == 6'd31)
+    if(negedge_cnt == 7'd17)
        begin
         after_hysteresis_prev2 <= after_hysteresis;
                bit2 <= curbit;
        end
        begin
         after_hysteresis_prev2 <= after_hysteresis;
                bit2 <= curbit;
        end
-    if(negedge_cnt == 6'd47)
+    if(negedge_cnt == 7'd33)
        begin
         after_hysteresis_prev3 <= after_hysteresis;
                bit3 <= curbit;
        end
        begin
         after_hysteresis_prev3 <= after_hysteresis;
                bit3 <= curbit;
        end
+    if(negedge_cnt == 7'd47)
+       begin
+        after_hysteresis_prev4 <= after_hysteresis;
+               bit4 <= curbit;
+       end
        
        //--------------------------------------------------------------------------------------------------------------------------------------------------------------
        // Relevant in TAGSIM_MOD only. Delay-Line to buffer data and send it at the correct time
        
        //--------------------------------------------------------------------------------------------------------------------------------------------------------------
        // Relevant in TAGSIM_MOD only. Delay-Line to buffer data and send it at the correct time
-       // Note: Data in READER_MOD is fed through this delay line as well.
-       if(mod_type != 3'b000)                  // != SNIFFER
+       if(negedge_cnt[3:0] == 4'd0)    // at rising edge of ssp_clk - ssp_dout changes at the falling edge.
        begin
        begin
-               if(negedge_cnt[3:0] == 4'b1000) // == 0x8
+               mod_sig_buf[31:0] <= {mod_sig_buf[30:1], ssp_dout, 1'b0};                       // shift in new data starting at mod_sig_buf[1]. mod_sig_buf[0] = 0 always.
+               // asign the delayed signal to mod_sig, but don't modulate with the correction bit (which is sent as 00010000, all other bits will come with at least 2 consecutive 1s)
+               // side effect: when ptr = 1 it will cancel the first 1 of every block of ones. Note: this would only be the case if we received a 1 just before fdt_elapsed.
+               if((ssp_dout || (| mod_sig_ptr[4:0])) && ~fdt_elapsed)                          // buffer a 1 (and all subsequent data) until fdt_counter = 1148 adc_clk ticks.
+                       //if(mod_sig_ptr == 6'b101110)                                                                  // buffer overflow at 46 - this would mean data loss
+                       //begin
+                       //      mod_sig_ptr <= 6'b000000;
+                       //end
+                       if (mod_sig_ptr == 5'd30) mod_sig_ptr <= 5'd0;
+                       else mod_sig_ptr <= mod_sig_ptr + 1;                                                    // increase buffer (= increase delay by 16 adc_clk ticks). ptr always points to first 1.
+               else if(fdt_elapsed && ~temp_buffer_reset)                                                      
+               // fdt_elapsed. If we didn't receive a 1 yet, ptr will be at 9 and not yet fixed. Otherwise temp_buffer_reset will be 1 already.
                begin
                begin
-                       // The modulation signal of the tag. The delay line is only relevant for TAGSIM_MOD, but used in other modes as well.
-                       // Note: this means that even in READER_MOD, there will be an arbitrary delay depending on the time of a previous reset of fdt_counter and the time and
-                       // content of the next bit to be transmitted.
-                       mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0};                       // shift in new data starting at mod_sig_buf[1]. mod_sig_buf[0] = 0 always.
-                       if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed)                          // buffer a 1 (and all subsequent data) until fdt_counter = 1148 adc_clk ticks.
-                               if(mod_sig_ptr == 6'b101110)                                                                    // buffer overflow at 46 - this would mean data loss
-                               begin
-                                       mod_sig_ptr <= 6'b000000;
-                               end
-                               else mod_sig_ptr <= mod_sig_ptr + 1;                                                    // increase buffer (= increase delay by 16 adc_clk ticks). ptr always points to first 1.
-                       else if(fdt_elapsed && ~temp_buffer_reset)                                                      
-                       // fdt_elapsed. If we didn't receive a 1 yet, ptr will be at 9 and not yet fixed. Otherwise temp_buffer_reset will be 1 already.
-                       begin
-                               // wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen
-                               // at intervals of 8 * 16 = 128 adc_clk ticks intervals (as defined in ISO14443-3)
-                               if(ssp_dout) temp_buffer_reset = 1'b1;                                                  
-                               if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001;                  // still nothing received, need to go for the next interval
-                               else mod_sig_ptr <= mod_sig_ptr - 1;                                                    // decrease buffer.
-                       end
-                       else
-                       // mod_sig_ptr and therefore the delay is now fixed until fdt_counter is reset (this can happen in SNIFFER and TAGSIM_LISTEN mode only. Note that SNIFFER
-                       // mode (3'b000) is the default and is active in FPGA_MAJOR_MODE_OFF if no other minor mode is explicitly requested.
-                       begin
-                               // don't modulate with the correction bit (which is sent as 00010000, all other bits will come with at least 2 consecutive 1s)
-                               // side effect: when ptr = 1 it will cancel the first 1 of every block of ones. Note: this would only be the case if we received a 1 just before fdt_elapsed.
-                               if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0;
-                               // finally, do the modulation:
-                               else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed;
-                       end
+                       // wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen
+                       // at intervals of 8 * 16 = 128 adc_clk ticks intervals (as defined in ISO14443-3)
+                       if(ssp_dout) temp_buffer_reset = 1'b1;                                                  
+                       if(mod_sig_ptr == 5'd2) mod_sig_ptr <= 5'd9;                                    // still nothing received, need to go for the next interval
+                       else mod_sig_ptr <= mod_sig_ptr - 1;                                                    // decrease buffer.
+               end
+               else
+               begin
+                       if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0;
+                       // finally, assign the delayed signal:
+                       else mod_sig = mod_sig_buf[mod_sig_ptr];
                end
        end
        
        //-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
        // Communication to ARM (SSP Clock and data)
        // SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)):
                end
        end
        
        //-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
        // Communication to ARM (SSP Clock and data)
        // SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)):
-       if(mod_type == 3'b000)
+       if(mod_type == `SNIFFER)
        begin
                if(negedge_cnt[2:0] == 3'b100)
                        ssp_clk <= 1'b0;
        begin
                if(negedge_cnt[2:0] == 3'b100)
                        ssp_clk <= 1'b0;
@@ -311,7 +352,7 @@ begin
                begin
                        ssp_clk <= 1'b1;
                        // Don't shift if we just loaded new data, obviously.
                begin
                        ssp_clk <= 1'b1;
                        // Don't shift if we just loaded new data, obviously.
-                       if(negedge_cnt != 7'd0)
+                       if(negedge_cnt[5:0] != 6'd0)
                        begin
                                to_arm[7:1] <= to_arm[6:0];
                        end
                        begin
                                to_arm[7:1] <= to_arm[6:0];
                        end
@@ -333,41 +374,52 @@ begin
 
                if(negedge_cnt[3:0] == 4'b0111)
                begin
 
                if(negedge_cnt[3:0] == 4'b0111)
                begin
-                       if(ssp_frame_counter == 3'd7) ssp_frame_counter <= 3'd0;
-                       else ssp_frame_counter <= ssp_frame_counter + 1;
+                       // if(ssp_frame_counter == 3'd7) ssp_frame_counter <= 3'd0;
+                       // else ssp_frame_counter <= ssp_frame_counter + 1;
+                       if (negedge_cnt[6:4] == 3'b000) ssp_frame = 1'b1;
+                       else ssp_frame = 1'b0;
                end
                end
+               // ssp_frame = (ssp_frame_counter == 3'd7);
 
                if(negedge_cnt[3:0] == 4'b0000)
                begin
                        ssp_clk <= 1'b1;
 
                if(negedge_cnt[3:0] == 4'b0000)
                begin
                        ssp_clk <= 1'b1;
+                       // Don't shift if we just loaded new data, obviously.
+                       if(negedge_cnt[6:0] != 7'd0)
+                       begin
+                               to_arm[7:1] <= to_arm[6:0];
+                       end
                end
                
                end
                
-               ssp_frame = (ssp_frame_counter == 3'd7);
-       
-               bit_to_arm = sendbit;
-       end
+               if (mod_type == `TAGSIM_MOD && fdt_elapsed && temp_buffer_reset)
+                       // transmit timing information
+                       bit_to_arm = to_arm[7];
+               else
+                       // transmit data or fdt_indicator
+                       bit_to_arm = sendbit;
+               end
        
        
-end
+end    //always @(negedge adc_clk)
 
 assign ssp_din = bit_to_arm;
 
 
 
 assign ssp_din = bit_to_arm;
 
 
-// Modulating carrier (adc_clk/16, for TAGSIM_MOD only). Will be 0 for other modes.
-wire modulating_carrier;
-assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010));                                    // in TAGSIM_MOD only. Otherwise always 0.
+// Subcarrier (adc_clk/16, for TAGSIM_MOD only).
+wire sub_carrier;
+assign sub_carrier = ~sub_carrier_cnt[3];
 
 
-// for READER_MOD only: drop carrier for mod_sig_coil==1 (pause), READER_LISTEN: carrier always on, others: carrier always off
-assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011)));      
+// in READER_MOD: drop carrier for mod_sig_coil==1 (pause); in READER_LISTEN: carrier always on; in other modes: carrier always off
+assign pwr_hi = (ck_1356megb & (((mod_type == `READER_MOD) & ~mod_sig_coil) || (mod_type == `READER_LISTEN))); 
 
 
 // Enable HF antenna drivers:
 assign pwr_oe1 = 1'b0;
 assign pwr_oe3 = 1'b0;
 
 
 
 // Enable HF antenna drivers:
 assign pwr_oe1 = 1'b0;
 assign pwr_oe3 = 1'b0;
 
-// TAGSIM_MOD: short circuit antenna with different resistances (modulated by modulating_carrier)
+// TAGSIM_MOD: short circuit antenna with different resistances (modulated by sub_carrier modulated by mod_sig_coil)
 // for pwr_oe4 = 1 (tristate): antenna load = 10k || 33                        = 32,9 Ohms
 // for pwr_oe4 = 0 (active):   antenna load = 10k || 33 || 33          = 16,5 Ohms
 // for pwr_oe4 = 1 (tristate): antenna load = 10k || 33                        = 32,9 Ohms
 // for pwr_oe4 = 0 (active):   antenna load = 10k || 33 || 33          = 16,5 Ohms
-assign pwr_oe4 = modulating_carrier;
+assign pwr_oe4 = ~(mod_sig_coil & sub_carrier & (mod_type == `TAGSIM_MOD));
 
 // This is all LF, so doesn't matter.
 assign pwr_oe2 = 1'b0;
 
 // This is all LF, so doesn't matter.
 assign pwr_oe2 = 1'b0;
Impressum, Datenschutz