fix 'hf iclass sim'

* fix tag response timing. iClass differs from ISO15693 in this respect.
* speedup CodeIso15693AsTag()
* TransmitTo15693Tag(): don't send unmodulated start of SOF
* reduce modulation depth in hi_simulate.v
* calculate CRC for configuration block when simulating
* Show real response time instead of planned response time in 'hf list iclass'

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index d8f68c789fdc75c0d3a8779ff5a8157b7b6f5a4d..0e42fb06c4fc55cdd1a9c8580007aa2c530cb786 100644 (file)
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -59,6 +59,13 @@
 
 static int timeout = 4096;
 
 
 static int timeout = 4096;
 

+// iCLASS has a slightly different timing compared to ISO15693. According to the picopass data sheet the tag response is expected 330us after
+// the reader command. This is measured from end of reader EOF to first modulation of the tag's SOF which starts with a 56,64us unmodulated period.
+// 330us = 140 ssp_clk cycles @ 423,75kHz when simulating.
+// 56,64us = 24 ssp_clk_cycles
+#define DELAY_ICLASS_VCD_TO_VICC_SIM 140
+#define TAG_SOF_UNMODULATED          24
+

 //-----------------------------------------------------------------------------
 // The software UART that receives commands from the reader, and its state
 // variables.
 //-----------------------------------------------------------------------------
 // The software UART that receives commands from the reader, and its state
 // variables.


@@ -783,7 +790,7 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
        State cipher_state_KC[8];
        State cipher_state_KD[8];
        State *cipher_state = &cipher_state_KD[0];
        State cipher_state_KC[8];
        State cipher_state_KD[8];
        State *cipher_state = &cipher_state_KD[0];

-       
+

        uint8_t *emulator = BigBuf_get_EM_addr();
        uint8_t *csn = emulator;
 
        uint8_t *emulator = BigBuf_get_EM_addr();
        uint8_t *csn = emulator;
 


@@ -800,13 +807,12 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
        AppendCrc(anticoll_data, 8);
        AppendCrc(csn_data, 8);
 
        AppendCrc(anticoll_data, 8);
        AppendCrc(csn_data, 8);
 

-       uint8_t diversified_key_d[8];
-       uint8_t diversified_key_c[8];
+       uint8_t diversified_key_d[8] = { 0x00 };
+       uint8_t diversified_key_c[8] = { 0x00 };

        uint8_t *diversified_key = diversified_key_d;
        uint8_t *diversified_key = diversified_key_d;

-       
+

        // configuration block
        uint8_t conf_block[10] = {0x12, 0xFF, 0xFF, 0xFF, 0x7F, 0x1F, 0xFF, 0x3C, 0x00, 0x00};
        // configuration block
        uint8_t conf_block[10] = {0x12, 0xFF, 0xFF, 0xFF, 0x7F, 0x1F, 0xFF, 0x3C, 0x00, 0x00};

-       AppendCrc(conf_block, 8);

 
        // e-Purse
        uint8_t card_challenge_data[8] = { 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
        // e-Purse
        uint8_t card_challenge_data[8] = { 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };


@@ -819,6 +825,8 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                memcpy(diversified_key_c, emulator + 8 * 4, 8);   // Kc
        }
 
                memcpy(diversified_key_c, emulator + 8 * 4, 8);   // Kc
        }
 

+       AppendCrc(conf_block, 8);
+

        // save card challenge for sim2,4 attack
        if (reader_mac_buf != NULL) {
                memcpy(reader_mac_buf, card_challenge_data, 8);
        // save card challenge for sim2,4 attack
        if (reader_mac_buf != NULL) {
                memcpy(reader_mac_buf, card_challenge_data, 8);


@@ -836,7 +844,7 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
 
        // chip memory may be divided in 8 pages
        uint8_t max_page = conf_block[4] & 0x10 ? 0 : 7;
 
        // chip memory may be divided in 8 pages
        uint8_t max_page = conf_block[4] & 0x10 ? 0 : 7;

-       
+

        // Precalculate the cipher states, feeding it the CC
        cipher_state_KD[0] = opt_doTagMAC_1(card_challenge_data, diversified_key_d);
        cipher_state_KC[0] = opt_doTagMAC_1(card_challenge_data, diversified_key_c);
        // Precalculate the cipher states, feeding it the CC
        cipher_state_KD[0] = opt_doTagMAC_1(card_challenge_data, diversified_key_d);
        cipher_state_KC[0] = opt_doTagMAC_1(card_challenge_data, diversified_key_c);


@@ -849,7 +857,7 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                        cipher_state_KC[i] = opt_doTagMAC_1(epurse, Kc);
                }
        }
                        cipher_state_KC[i] = opt_doTagMAC_1(epurse, Kc);
                }
        }

-                       
+

        int exitLoop = 0;
        // Reader 0a
        // Tag    0f
        int exitLoop = 0;
        // Reader 0a
        // Tag    0f


@@ -1073,7 +1081,7 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                                        cipher_state = &cipher_state_KD[current_page];
                                        diversified_key = diversified_key_d;
                                } else {
                                        cipher_state = &cipher_state_KD[current_page];
                                        diversified_key = diversified_key_d;
                                } else {

-                                       cipher_state = &cipher_state_KC[current_page];                  
+                                       cipher_state = &cipher_state_KC[current_page];

                                        diversified_key = diversified_key_c;
                                }
                                modulated_response = resp_cc;
                                        diversified_key = diversified_key_c;
                                }
                                modulated_response = resp_cc;


@@ -1082,7 +1090,7 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                                trace_data_size = sizeof(card_challenge_data);
                        }
 
                                trace_data_size = sizeof(card_challenge_data);
                        }
 

-               } else if ((receivedCmd[0] == ICLASS_CMD_CHECK_KC 
+               } else if ((receivedCmd[0] == ICLASS_CMD_CHECK_KC

                                        || receivedCmd[0] == ICLASS_CMD_CHECK_KD) && len == 9) {
                        // Reader random and reader MAC!!!
                        if (chip_state == SELECTED) {
                                        || receivedCmd[0] == ICLASS_CMD_CHECK_KD) && len == 9) {
                        // Reader random and reader MAC!!!
                        if (chip_state == SELECTED) {


@@ -1148,22 +1156,22 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                                } else if (blockNo == 3) { // update Kd
                                        for (int i = 0; i < 8; i++) {
                                                if (personalization_mode) {
                                } else if (blockNo == 3) { // update Kd
                                        for (int i = 0; i < 8; i++) {
                                                if (personalization_mode) {

-                                                       diversified_key_d[i] = receivedCmd[2 + i];      
+                                                       diversified_key_d[i] = receivedCmd[2 + i];

                                                } else {
                                                        diversified_key_d[i] ^= receivedCmd[2 + i];
                                                } else {
                                                        diversified_key_d[i] ^= receivedCmd[2 + i];

-                                               }                                               
+                                               }

                                        }
                                        }

-                                       cipher_state_KD[current_page] = opt_doTagMAC_1(card_challenge_data, diversified_key_d);                         
+                                       cipher_state_KD[current_page] = opt_doTagMAC_1(card_challenge_data, diversified_key_d);

                                        if (simulationMode == ICLASS_SIM_MODE_FULL) {
                                                memcpy(emulator + current_page*page_size + 8*3, diversified_key_d, 8);
                                        }
                                        if (simulationMode == ICLASS_SIM_MODE_FULL) {
                                                memcpy(emulator + current_page*page_size + 8*3, diversified_key_d, 8);
                                        }

-                               } else if (blockNo == 4) { // update Kc                                 
+                               } else if (blockNo == 4) { // update Kc

                                        for (int i = 0; i < 8; i++) {
                                                if (personalization_mode) {
                                        for (int i = 0; i < 8; i++) {
                                                if (personalization_mode) {

-                                                       diversified_key_c[i] = receivedCmd[2 + i];      
+                                                       diversified_key_c[i] = receivedCmd[2 + i];

                                                } else {
                                                        diversified_key_c[i] ^= receivedCmd[2 + i];
                                                } else {
                                                        diversified_key_c[i] ^= receivedCmd[2 + i];

-                                               }                                               
+                                               }

                                        }
                                        cipher_state_KC[current_page] = opt_doTagMAC_1(card_challenge_data, diversified_key_c);
                                        if (simulationMode == ICLASS_SIM_MODE_FULL) {
                                        }
                                        cipher_state_KC[current_page] = opt_doTagMAC_1(card_challenge_data, diversified_key_c);
                                        if (simulationMode == ICLASS_SIM_MODE_FULL) {


@@ -1171,7 +1179,7 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                                        }
                                } else if (simulationMode == ICLASS_SIM_MODE_FULL) { // update any other data block
                                                memcpy(emulator + current_page*page_size + 8*blockNo, receivedCmd+2, 8);
                                        }
                                } else if (simulationMode == ICLASS_SIM_MODE_FULL) { // update any other data block
                                                memcpy(emulator + current_page*page_size + 8*blockNo, receivedCmd+2, 8);

-                               }                                       
+                               }

                                memcpy(data_generic_trace, receivedCmd + 2, 8);
                                AppendCrc(data_generic_trace, 8);
                                trace_data = data_generic_trace;
                                memcpy(data_generic_trace, receivedCmd + 2, 8);
                                AppendCrc(data_generic_trace, 8);
                                trace_data = data_generic_trace;


@@ -1185,20 +1193,20 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                } else if (receivedCmd[0] == ICLASS_CMD_PAGESEL && len == 4) {
                        // Pagesel
                        // Chips with a single page will not answer to this command
                } else if (receivedCmd[0] == ICLASS_CMD_PAGESEL && len == 4) {
                        // Pagesel
                        // Chips with a single page will not answer to this command

-                       // Otherwise, we should answer 8bytes (block) + 2bytes CRC
+                       // Otherwise, we should answer 8bytes (conf block 1) + 2bytes CRC

                        if (chip_state == SELECTED) {
                                if (simulationMode == ICLASS_SIM_MODE_FULL && max_page > 0) {
                                        current_page = receivedCmd[1];
                                        memcpy(data_generic_trace, emulator + current_page*page_size + 8*1, 8);
                                        memcpy(diversified_key_d, emulator + current_page*page_size + 8*3, 8);
                        if (chip_state == SELECTED) {
                                if (simulationMode == ICLASS_SIM_MODE_FULL && max_page > 0) {
                                        current_page = receivedCmd[1];
                                        memcpy(data_generic_trace, emulator + current_page*page_size + 8*1, 8);
                                        memcpy(diversified_key_d, emulator + current_page*page_size + 8*3, 8);

-                                       memcpy(diversified_key_c, emulator + current_page*page_size + 8*4, 8);                                                                                          
+                                       memcpy(diversified_key_c, emulator + current_page*page_size + 8*4, 8);

                                        cipher_state = &cipher_state_KD[current_page];
                                        personalization_mode = data_generic_trace[7] & 0x80;
                                        AppendCrc(data_generic_trace, 8);
                                        trace_data = data_generic_trace;
                                        trace_data_size = 10;
                                        CodeIso15693AsTag(trace_data, trace_data_size);
                                        cipher_state = &cipher_state_KD[current_page];
                                        personalization_mode = data_generic_trace[7] & 0x80;
                                        AppendCrc(data_generic_trace, 8);
                                        trace_data = data_generic_trace;
                                        trace_data_size = 10;
                                        CodeIso15693AsTag(trace_data, trace_data_size);

-                                       memcpy(data_response, ToSend, ToSendMax);               
+                                       memcpy(data_response, ToSend, ToSendMax);

                                        modulated_response = data_response;
                                        modulated_response_size = ToSendMax;
                                }
                                        modulated_response = data_response;
                                        modulated_response_size = ToSendMax;
                                }


@@ -1219,11 +1227,11 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                }
 
                /**
                }
 
                /**

-               A legit tag has about 311,5us delay between reader EOT and tag SOF.
+               A legit tag has about 273,4us delay between reader EOT and tag SOF.

                **/
                if (modulated_response_size > 0) {
                **/
                if (modulated_response_size > 0) {

-                       uint32_t response_time = reader_eof_time + DELAY_ISO15693_VCD_TO_VICC_SIM - DELAY_ARM_TO_READER_SIM;
-                       TransmitTo15693Reader(modulated_response, modulated_response_size, response_time, false);
+                       uint32_t response_time = reader_eof_time + DELAY_ICLASS_VCD_TO_VICC_SIM - TAG_SOF_UNMODULATED - DELAY_ARM_TO_READER_SIM;
+                       TransmitTo15693Reader(modulated_response, modulated_response_size, &response_time, 0, false);

                        LogTrace(trace_data, trace_data_size, response_time + DELAY_ARM_TO_READER_SIM, response_time + (modulated_response_size << 6) + DELAY_ARM_TO_READER_SIM, NULL, false);
                }
 
                        LogTrace(trace_data, trace_data_size, response_time + DELAY_ARM_TO_READER_SIM, response_time + (modulated_response_size << 6) + DELAY_ARM_TO_READER_SIM, NULL, false);
                }
 


@@ -1249,9 +1257,9 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
  * @param datain
  */
 void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain) {
  * @param datain
  */
 void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain) {

-       
+

        LED_A_ON();
        LED_A_ON();

-       
+

        uint32_t simType = arg0;
        uint32_t numberOfCSNS = arg1;
 
        uint32_t simType = arg0;
        uint32_t numberOfCSNS = arg1;
 


@@ -1559,6 +1567,7 @@ static uint8_t handshakeIclassTag_ext(uint8_t *card_data, bool use_credit_key) {
        ReaderTransmitIClass(act_all, 1);
        // Card present?
        if (!ReaderReceiveIClass(resp)) return read_status;//Fail
        ReaderTransmitIClass(act_all, 1);
        // Card present?
        if (!ReaderReceiveIClass(resp)) return read_status;//Fail

+

        //Send Identify
        ReaderTransmitIClass(identify, 1);
        //We expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC
        //Send Identify
        ReaderTransmitIClass(identify, 1);
        //We expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC

diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c
index dbc1ca4c4a48101331282c9f504e91e6a4dc1a4a..85af0859ec8721a89d2a0d83d8784a0e12552d74 100644 (file)
--- a/armsrc/iso15693.c
+++ b/armsrc/iso15693.c
@@ -246,6 +246,8 @@ static void CodeIso15693AsReader256(uint8_t *cmd, int n)
        // }
 // }
 
        // }
 // }
 

+static const uint8_t encode_4bits[16] = { 0xaa, 0x6a, 0x9a, 0x5a, 0xa6, 0x66, 0x96, 0x56, 0xa9, 0x69, 0x99, 0x59, 0xa5, 0x65, 0x95, 0x55 };
+

 void CodeIso15693AsTag(uint8_t *cmd, size_t len) {
        /*
         * SOF comprises 3 parts;
 void CodeIso15693AsTag(uint8_t *cmd, size_t len) {
        /*
         * SOF comprises 3 parts;


@@ -280,16 +282,9 @@ void CodeIso15693AsTag(uint8_t *cmd, size_t len) {
        ToSend[++ToSendMax] = 0x1D;  // 00011101
 
        // data
        ToSend[++ToSendMax] = 0x1D;  // 00011101
 
        // data

-       for(int i = 0; i < len; i++) {
-               for(int j = 0; j < 8; j++) {
-                       if ((cmd[i] >> j) & 0x01) {
-                                       ToSendStuffBit(0);
-                                       ToSendStuffBit(1);
-                       } else {
-                                       ToSendStuffBit(1);
-                                       ToSendStuffBit(0);
-                       }
-               }
+       for (int i = 0; i < len; i++) {
+               ToSend[++ToSendMax] = encode_4bits[cmd[i] & 0xF];
+               ToSend[++ToSendMax] = encode_4bits[cmd[i] >> 4];

        }
 
        // EOF
        }
 
        // EOF


@@ -327,19 +322,32 @@ static void TransmitTo15693Tag(const uint8_t *cmd, int len, uint32_t start_time)
 //-----------------------------------------------------------------------------
 // Transmit the tag response (to the reader) that was placed in cmd[].
 //-----------------------------------------------------------------------------
 //-----------------------------------------------------------------------------
 // Transmit the tag response (to the reader) that was placed in cmd[].
 //-----------------------------------------------------------------------------

-void TransmitTo15693Reader(const uint8_t *cmd, size_t len, uint32_t start_time, bool slow) {
+void TransmitTo15693Reader(const uint8_t *cmd, size_t len, uint32_t *start_time, uint32_t slot_time, bool slow) {

        // don't use the FPGA_HF_SIMULATOR_MODULATE_424K_8BIT minor mode. It would spoil GetCountSspClk()
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_424K);
 
        // don't use the FPGA_HF_SIMULATOR_MODULATE_424K_8BIT minor mode. It would spoil GetCountSspClk()
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_424K);
 

-       uint8_t shift_delay = start_time & 0x00000007;
+       uint32_t modulation_start_time = *start_time + 3 * 8;  // no need to transfer the unmodulated start of SOF
+       
+       while (GetCountSspClk() > (modulation_start_time & 0xfffffff8) + 3) { // we will miss the intended time
+               if (slot_time) {
+                       modulation_start_time += slot_time; // use next available slot
+               } else {
+                       modulation_start_time = (modulation_start_time & 0xfffffff8) + 8; // next possible time
+               }
+       }
+
+       while (GetCountSspClk() < (modulation_start_time & 0xfffffff8)) 
+               /* wait */ ;

 
 

-       while (GetCountSspClk() < (start_time & 0xfffffff8)) ;
+       uint8_t shift_delay = modulation_start_time & 0x00000007;
+
+       *start_time = modulation_start_time - 3 * 8;

 
        LED_C_ON();
        uint8_t bits_to_shift = 0x00;
        uint8_t bits_to_send = 0x00;
 
        LED_C_ON();
        uint8_t bits_to_shift = 0x00;
        uint8_t bits_to_send = 0x00;

-       for(size_t c = 0; c < len; c++) {
-               for (int i = 7; i >= 0; i--) {
+       for (size_t c = 0; c < len; c++) {
+               for (int i = (c==0?4:7); i >= 0; i--) {

                        uint8_t cmd_bits = ((cmd[c] >> i) & 0x01) ? 0xff : 0x00;
                        for (int j = 0; j < (slow?4:1); ) {
                                if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
                        uint8_t cmd_bits = ((cmd[c] >> i) & 0x01) ? 0xff : 0x00;
                        for (int j = 0; j < (slow?4:1); ) {
                                if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {


@@ -361,7 +369,6 @@ void TransmitTo15693Reader(const uint8_t *cmd, size_t len, uint32_t start_time,
                }
        }
        LED_C_OFF();
                }
        }
        LED_C_OFF();

-

 }
 
 
 }
 
 


@@ -1529,7 +1536,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
                if ((cmd_len >= 5) && (cmd[0] & ISO15693_REQ_INVENTORY) && (cmd[1] == ISO15693_INVENTORY)) { // TODO: check more flags
                        bool slow = !(cmd[0] & ISO15693_REQ_DATARATE_HIGH);
                        start_time = eof_time + DELAY_ISO15693_VCD_TO_VICC_SIM - DELAY_ARM_TO_READER_SIM;
                if ((cmd_len >= 5) && (cmd[0] & ISO15693_REQ_INVENTORY) && (cmd[1] == ISO15693_INVENTORY)) { // TODO: check more flags
                        bool slow = !(cmd[0] & ISO15693_REQ_DATARATE_HIGH);
                        start_time = eof_time + DELAY_ISO15693_VCD_TO_VICC_SIM - DELAY_ARM_TO_READER_SIM;

-                       TransmitTo15693Reader(ToSend, ToSendMax, start_time, slow);
+                       TransmitTo15693Reader(ToSend, ToSendMax, &start_time, 0, slow);

                }
 
                Dbprintf("%d bytes read from reader:", cmd_len);
                }
 
                Dbprintf("%d bytes read from reader:", cmd_len);

diff --git a/armsrc/iso15693.h b/armsrc/iso15693.h
index 7964d79ede187cc02b4cd62c5194de5996e5a611..7d2e7598c8b295f667d6b7e205645974c4cb00da 100644 (file)
--- a/armsrc/iso15693.h
+++ b/armsrc/iso15693.h
@@ -26,7 +26,7 @@
 
 void CodeIso15693AsTag(uint8_t *cmd, size_t len);
 int GetIso15693CommandFromReader(uint8_t *received, size_t max_len, uint32_t *eof_time);
 
 void CodeIso15693AsTag(uint8_t *cmd, size_t len);
 int GetIso15693CommandFromReader(uint8_t *received, size_t max_len, uint32_t *eof_time);

-void TransmitTo15693Reader(const uint8_t *cmd, size_t len, uint32_t start_time, bool slow);
+void TransmitTo15693Reader(const uint8_t *cmd, size_t len, uint32_t *start_time, uint32_t slot_time, bool slow);

 void SnoopIso15693(void);
 void AcquireRawAdcSamplesIso15693(void);
 void ReaderIso15693(uint32_t parameter);
 void SnoopIso15693(void);
 void AcquireRawAdcSamplesIso15693(void);
 void ReaderIso15693(uint32_t parameter);

diff --git a/fpga/fpga_hf.bit b/fpga/fpga_hf.bit
index 1bd3c416fe728c26ee204ede9bc882c8f87486c8..44b2428040ab74e66878d78bf7cc7a79ee3c7266 100644 (file)
Binary files a/fpga/fpga_hf.bit and b/fpga/fpga_hf.bit differ

diff --git a/fpga/hi_simulate.v b/fpga/hi_simulate.v
index 097b8a084a3e5daadca9d6e31d4f8ea64ee8527f..5fc2e11354807d5ef96164e319303492b035047e 100644 (file)
--- a/fpga/hi_simulate.v
+++ b/fpga/hi_simulate.v
@@ -132,7 +132,7 @@ always @(*)
 // modulation than a real tag would.
 assign pwr_hi = 1'b0;                   // HF antenna connected to GND
 assign pwr_oe3 = 1'b0;                  // 10k Load
 // modulation than a real tag would.
 assign pwr_hi = 1'b0;                   // HF antenna connected to GND
 assign pwr_oe3 = 1'b0;                  // 10k Load

-assign pwr_oe1 = modulating_carrier;    // 33 Ohms Load
+assign pwr_oe1 = 1'b0;                  // 33 Ohms Load

 assign pwr_oe4 = modulating_carrier;    // 33 Ohms Load
 
 // This is all LF and doesn't matter
 assign pwr_oe4 = modulating_carrier;    // 33 Ohms Load
 
 // This is all LF and doesn't matter