github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-20 13:23:51 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Merge branch 'master' of https://github.com/Proxmark/proxmark3

Browse source 
Conflicts:
	armsrc/Makefile
	armsrc/iso14443b.c
	armsrc/lfops.c
	client/cmdhf14b.c
	client/cmdhfmfu.c
	fpga/fpga_hf.bit
	fpga/hi_read_rx_xcorr.v
This commit is contained in:
iceman1001 2015-06-23 23:02:29 +02:00
commit f53020e729
10 changed files with 114 additions and 218 deletions
Download patch file Download diff file Expand all files Collapse all files

85
armsrc/iso14443b.c
View file

@ -17,6 +17,7 @@
#include "iso14443crc.h" #include "iso14443crc.h"
#define RECEIVE_SAMPLES_TIMEOUT 2000 #define RECEIVE_SAMPLES_TIMEOUT 2000
#define ISO14443B_DMA_BUFFER_SIZE 256
//============================================================================= //=============================================================================
// An ISO 14443 Type B tag. We listen for commands from the reader, using // An ISO 14443 Type B tag. We listen for commands from the reader, using
@ -717,16 +718,16 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE); uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
// The DMA buffer, used to stream samples from the FPGA // The DMA buffer, used to stream samples from the FPGA
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE); int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
// Set up the demodulator for tag -> reader responses. // Set up the demodulator for tag -> reader responses.
DemodInit(receivedResponse); DemodInit(receivedResponse);
// Setup and start DMA. // Setup and start DMA.
FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE); FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
int8_t *upTo = dmaBuf; int8_t *upTo = dmaBuf;
lastRxCounter = DMA_BUFFER_SIZE; lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
// Signal field is ON with the appropriate LED: // Signal field is ON with the appropriate LED:
LED_D_ON(); LED_D_ON();
@ -737,18 +738,18 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR; int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
if(behindBy > max) max = behindBy; if(behindBy > max) max = behindBy;
while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1)) > 2) { while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
ci = upTo[0]; ci = upTo[0];
cq = upTo[1]; cq = upTo[1];
upTo += 2; upTo += 2;
if(upTo >= dmaBuf + DMA_BUFFER_SIZE) { if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
upTo = dmaBuf; upTo = dmaBuf;
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo; AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE; AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
} }
lastRxCounter -= 2; lastRxCounter -= 2;
if(lastRxCounter <= 0) { if(lastRxCounter <= 0) {
lastRxCounter += DMA_BUFFER_SIZE; lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
} }
samples += 2; samples += 2;
@ -770,7 +771,6 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
//Tracing //Tracing
if (tracing && Demod.len > 0) { if (tracing && Demod.len > 0) {
uint8_t parity[MAX_PARITY_SIZE]; uint8_t parity[MAX_PARITY_SIZE];
//GetParity(Demod.output, Demod.len, parity);
LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE); LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
} }
} }
@ -892,7 +892,6 @@ static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
TransmitFor14443b(); TransmitFor14443b();
if (tracing) { if (tracing) {
uint8_t parity[MAX_PARITY_SIZE]; uint8_t parity[MAX_PARITY_SIZE];
GetParity(cmd, len, parity);
LogTrace(cmd,len, 0, 0, parity, TRUE); LogTrace(cmd,len, 0, 0, parity, TRUE);
} }
} }
@ -932,29 +931,24 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
// First command: wake up the tag using the INITIATE command // First command: wake up the tag using the INITIATE command
uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b}; uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
// LED_A_ON();
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
// LED_A_OFF();
if (Demod.len == 0) { if (Demod.len == 0) {
DbpString("No response from tag"); DbpString("No response from tag");
return; return;
} else { } else {
Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %02x %02x %02x", Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
Demod.output[0], Demod.output[1], Demod.output[2]); Demod.output[0], Demod.output[1], Demod.output[2]);
} }
// There is a response, SELECT the uid // There is a response, SELECT the uid
DbpString("Now SELECT tag:"); DbpString("Now SELECT tag:");
cmd1[0] = 0x0E; // 0x0E is SELECT cmd1[0] = 0x0E; // 0x0E is SELECT
cmd1[1] = Demod.output[0]; cmd1[1] = Demod.output[0];
ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
// LED_A_ON();
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
// LED_A_OFF();
if (Demod.len != 3) { if (Demod.len != 3) {
Dbprintf("Expected 3 bytes from tag, got %d", Demod.len); Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
return; return;
@ -970,15 +964,13 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]); Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
return; return;
} }
// Tag is now selected, // Tag is now selected,
// First get the tag's UID: // First get the tag's UID:
cmd1[0] = 0x0B; cmd1[0] = 0x0B;
ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]); ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
// LED_A_ON();
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
// LED_A_OFF();
if (Demod.len != 10) { if (Demod.len != 10) {
Dbprintf("Expected 10 bytes from tag, got %d", Demod.len); Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
return; return;
@ -987,9 +979,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]); ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) { if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
Dbprintf("CRC Error reading block! Expected: %04x got: %04x", Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
(cmd1[2]<<8)+cmd1[3], (cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
(Demod.output[8]<<8)+Demod.output[9]
);
// Do not return;, let's go on... (we should retry, maybe ?) // Do not return;, let's go on... (we should retry, maybe ?)
} }
Dbprintf("Tag UID (64 bits): %08x %08x", Dbprintf("Tag UID (64 bits): %08x %08x",
@ -1009,10 +999,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
cmd1[1] = i; cmd1[1] = i;
ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]); ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1)); CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
// LED_A_ON();
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
// LED_A_OFF();
if (Demod.len != 6) { // Check if we got an answer from the tag if (Demod.len != 6) { // Check if we got an answer from the tag
DbpString("Expected 6 bytes from tag, got less..."); DbpString("Expected 6 bytes from tag, got less...");
return; return;
@ -1021,9 +1008,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]); ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) { if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
Dbprintf("CRC Error reading block! Expected: %04x got: %04x", Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
(cmd1[2]<<8)+cmd1[3], (cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
(Demod.output[4]<<8)+Demod.output[5]
);
// Do not return;, let's go on... (we should retry, maybe ?) // Do not return;, let's go on... (we should retry, maybe ?)
} }
// Now print out the memory location: // Now print out the memory location:
@ -1051,7 +1036,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
* Memory usage for this function, (within BigBuf) * Memory usage for this function, (within BigBuf)
* Last Received command (reader->tag) - MAX_FRAME_SIZE * Last Received command (reader->tag) - MAX_FRAME_SIZE
* Last Received command (tag->reader) - MAX_FRAME_SIZE * Last Received command (tag->reader) - MAX_FRAME_SIZE
* DMA Buffer - DMA_BUFFER_SIZE * DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
* Demodulated samples received - all the rest * Demodulated samples received - all the rest
*/ */
void RAMFUNC SnoopIso14443b(void) void RAMFUNC SnoopIso14443b(void)
@ -1068,7 +1053,7 @@ void RAMFUNC SnoopIso14443b(void)
set_tracing(TRUE); set_tracing(TRUE);
// The DMA buffer, used to stream samples from the FPGA // The DMA buffer, used to stream samples from the FPGA
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE); int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
int lastRxCounter; int lastRxCounter;
int8_t *upTo; int8_t *upTo;
int ci, cq; int ci, cq;
@ -1086,7 +1071,7 @@ void RAMFUNC SnoopIso14443b(void)
Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen()); Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE); Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE); Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
Dbprintf(" DMA: %i bytes", DMA_BUFFER_SIZE); Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
// Signal field is off, no reader signal, no tag signal // Signal field is off, no reader signal, no tag signal
LEDsoff(); LEDsoff();
@ -1098,17 +1083,20 @@ void RAMFUNC SnoopIso14443b(void)
// Setup for the DMA. // Setup for the DMA.
FpgaSetupSsc(); FpgaSetupSsc();
upTo = dmaBuf; upTo = dmaBuf;
lastRxCounter = DMA_BUFFER_SIZE; lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE); FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
uint8_t parity[MAX_PARITY_SIZE]; uint8_t parity[MAX_PARITY_SIZE];
bool TagIsActive = FALSE; bool TagIsActive = FALSE;
bool ReaderIsActive = FALSE; bool ReaderIsActive = FALSE;
bool TagIsActive = FALSE;
bool ReaderIsActive = FALSE;
// And now we loop, receiving samples. // And now we loop, receiving samples.
for(;;) { for(;;) {
int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
(DMA_BUFFER_SIZE-1); (ISO14443B_DMA_BUFFER_SIZE-1);
if(behindBy > maxBehindBy) { if(behindBy > maxBehindBy) {
maxBehindBy = behindBy; maxBehindBy = behindBy;
} }
@ -1119,11 +1107,15 @@ void RAMFUNC SnoopIso14443b(void)
cq = upTo[1]; cq = upTo[1];
upTo += 2; upTo += 2;
lastRxCounter -= 2; lastRxCounter -= 2;
if(upTo >= dmaBuf + DMA_BUFFER_SIZE) { if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
upTo = dmaBuf; upTo = dmaBuf;
lastRxCounter += DMA_BUFFER_SIZE; lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE; AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
WDT_HIT();
if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
Dbprintf("blew circular buffer! behindBy=%d", behindBy);
break;
WDT_HIT(); WDT_HIT();
if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not? if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
Dbprintf("blew circular buffer! behindBy=%d", behindBy); Dbprintf("blew circular buffer! behindBy=%d", behindBy);
@ -1144,7 +1136,6 @@ void RAMFUNC SnoopIso14443b(void)
if (!TagIsActive) { // no need to try decoding reader data if the tag is sending if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
if(Handle14443bUartBit(ci & 0x01)) { if(Handle14443bUartBit(ci & 0x01)) {
if(triggered && tracing) { if(triggered && tracing) {
//GetParity(Uart.output, Uart.byteCnt, parity);
LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE); LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
} }
/* And ready to receive another command. */ /* And ready to receive another command. */
@ -1155,7 +1146,6 @@ void RAMFUNC SnoopIso14443b(void)
} }
if(Handle14443bUartBit(cq & 0x01)) { if(Handle14443bUartBit(cq & 0x01)) {
if(triggered && tracing) { if(triggered && tracing) {
//GetParity(Uart.output, Uart.byteCnt, parity);
LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE); LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
} }
/* And ready to receive another command. */ /* And ready to receive another command. */
@ -1174,7 +1164,6 @@ void RAMFUNC SnoopIso14443b(void)
if(tracing) if(tracing)
{ {
uint8_t parity[MAX_PARITY_SIZE]; uint8_t parity[MAX_PARITY_SIZE];
//GetParity(Demod.output, Demod.len, parity);
LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE); LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE);
} }
triggered = TRUE; triggered = TRUE;
@ -1219,22 +1208,6 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u
set_tracing(TRUE); set_tracing(TRUE);
/* if(!powerfield) {
// Make sure that we start from off, since the tags are stateful;
// confusing things will happen if we don't reset them between reads.
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
SpinDelay(200);
}
*/
// if(!GETBIT(GPIO_LED_D)) { // if field is off
// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
// // Signal field is on with the appropriate LED
// LED_D_ON();
// SpinDelay(200);
// }
CodeAndTransmit14443bAsReader(data, datalen); CodeAndTransmit14443bAsReader(data, datalen);
if(recv) { if(recv) {

8
armsrc/lfops.c
View file

@ -1043,10 +1043,10 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
* To compensate antenna falling times shorten the write times * To compensate antenna falling times shorten the write times
* and enlarge the gap ones. * and enlarge the gap ones.
*/ */
#define START_GAP 31*8 // was 250 // SPEC: 8 - 50fc [15fc] #define START_GAP 31*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc)
#define WRITE_GAP 20*8 // was 160 // SPEC: 8 - 20fc [10fc] #define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc)
#define WRITE_0 18*8 // was 144 // SPEC: 16 - 32fc [24fc] 192 #define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
#define WRITE_1 50*8 // was 400 // SPEC: 48 - 64fc [56fc] 432 for T55x7; 448 for E5550 #define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550
// VALUES TAKEN FROM EM4x function: SendForward // VALUES TAKEN FROM EM4x function: SendForward
// START_GAP = 440; (55*8) cycles at 125Khz (8us = 1cycle) // START_GAP = 440; (55*8) cycles at 125Khz (8us = 1cycle)

2
client/cmddata.c
View file

@ -1561,7 +1561,7 @@ int PSKDemod(const char *Cmd, bool verbose)
} }
uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0}; uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
size_t BitLen = getFromGraphBuf(BitStream); size_t BitLen = getFromGraphBuf(BitStream);
if (BitLen==0) return -1; if (BitLen==0) return 0;
uint8_t carrier=countFC(BitStream, BitLen, 0); uint8_t carrier=countFC(BitStream, BitLen, 0);
if (carrier!=2 && carrier!=4 && carrier!=8){ if (carrier!=2 && carrier!=4 && carrier!=8){
//invalid carrier //invalid carrier

133
client/cmdhf14b.c
View file

@ -36,7 +36,6 @@ int CmdHF14BList(const char *Cmd)
int CmdHF14BSim(const char *Cmd) int CmdHF14BSim(const char *Cmd)
{ {
UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B}; UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
return 0; return 0;
} }
@ -44,7 +43,6 @@ int CmdHF14BSim(const char *Cmd)
int CmdHF14BSnoop(const char *Cmd) int CmdHF14BSnoop(const char *Cmd)
{ {
UsbCommand c = {CMD_SNOOP_ISO_14443B}; UsbCommand c = {CMD_SNOOP_ISO_14443B};
clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
return 0; return 0;
} }
@ -246,109 +244,38 @@ char *get_ST_Chip_Model(uint8_t data){
case 0xC: sprintf(retStr, "SRT512"); break; case 0xC: sprintf(retStr, "SRT512"); break;
default: sprintf(retStr, "Unknown"); break; default: sprintf(retStr, "Unknown"); break;
} }
return retStr;
c.arg[0] = datalen;
c.arg[1] = reply;
c.arg[2] = power;
memcpy(c.d.asBytes,data,datalen);
SendCommand(&c);
if (reply) {
if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
recv = resp.d.asBytes;
PrintAndLog("received %i octets",resp.arg[0]);
if(resp.arg[0] == 0)
return 0;
hexout = (char *)malloc(resp.arg[0] * 3 + 1);
if (hexout != NULL) {
uint8_t first, second;
for (int i = 0; i < resp.arg[0]; i++) { // data in hex
sprintf(&hexout[i * 3], "%02X ", recv[i]);
} }
PrintAndLog("%s", hexout);
static void print_st_info(uint8_t *data){ free(hexout);
//uid = first 8 bytes in data if (resp.arg[0] > 2) {
PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8)); ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);
PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6])); if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {
PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2)); PrintAndLog("CRC OK");
return; } else {
PrintAndLog("CRC failed");
} }
int HF14BStdReader(uint8_t *data, uint8_t *datalen){
//05 00 00 = find one tag in field
//1d xx xx xx xx 20 00 08 01 00 = attrib xx=crc
//a3 = ? (resp 03 e2 c2)
//02 = ? (resp 02 6a d3)
// 022b (resp 02 67 00 [29 5b])
// 0200a40400 (resp 02 67 00 [29 5b])
// 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
// 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
// 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
// 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
// 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
// 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
// 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
//03 = ? (resp 03 [e3 c2])
//c2 = ? (resp c2 [66 15])
//b2 = ? (resp a3 [e9 67])
bool crc = true;
*datalen = 3;
//std read cmd
data[0] = 0x05;
data[1] = 0x00;
data[2] = 0x00;
if (HF14BCmdRaw(true, &crc, false, data, datalen, false)==0) return 0;
if (data[0] != 0x50 || *datalen != 14 || !crc) return 0;
PrintAndLog ("\n14443-3b tag found:");
print_atqb_resp(data);
return 1;
}
int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){
bool crc = true;
*datalen = 2;
//wake cmd
data[0] = 0x06;
data[1] = 0x00;
//leave power on
// verbose on for now for testing - turn off when functional
if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
if (*datalen != 3 || !crc) return rawClose();
uint8_t chipID = data[0];
// select
data[0] = 0x0E;
data[1] = chipID;
*datalen = 2;
//leave power on
// verbose on for now for testing - turn off when functional
if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
// get uid
data[0] = 0x0B;
*datalen = 1;
//power off
// verbose on for now for testing - turn off when functional
if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0;
rawClose();
if (*datalen != 10 || !crc) return 0;
PrintAndLog("\n14443-3b ST tag found:");
print_st_info(data);
return 1;
}
// test for other 14b type tags (mimic another reader - don't have tags to identify)
int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
bool crc = true;
*datalen = 4;
//std read cmd
data[0] = 0x00;
data[1] = 0x0b;
data[2] = 0x3f;
data[3] = 0x80;
if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
if (*datalen > 2 || !crc) {
PrintAndLog ("\n14443-3b tag found:");
PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
PrintAndLog ("%s",sprint_hex(data,*datalen));
return 1;
} }
} else {
PrintAndLog("malloc failed your client has low memory?");
} }
crc = false; crc = false;
@ -474,9 +401,7 @@ static command_t CommandTable[] =
{ {
{"help", CmdHelp, 1, "This help"}, {"help", CmdHelp, 1, "This help"},
{"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443b history"}, {"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443b history"},
{"reader", CmdHF14BReader, 0, "Find 14b tag (HF ISO 14443b)"},
{"sim", CmdHF14BSim, 0, "Fake ISO 14443B tag"}, {"sim", CmdHF14BSim, 0, "Fake ISO 14443B tag"},
{"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443B"}, {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443B"},
{"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"}, {"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"},
{"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"}, {"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"},

6
client/hid-flasher/usb_cmd.h
View file

@ -89,7 +89,6 @@ typedef struct {
// For the 13.56 MHz tags // For the 13.56 MHz tags
#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693 0x0300 #define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693 0x0300
#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443 0x0301
#define CMD_READ_SRI512_TAG 0x0303 #define CMD_READ_SRI512_TAG 0x0303
#define CMD_READ_SRIX4K_TAG 0x0304 #define CMD_READ_SRIX4K_TAG 0x0304
#define CMD_READER_ISO_15693 0x0310 #define CMD_READER_ISO_15693 0x0310
@ -105,9 +104,8 @@ typedef struct {
#define CMD_SIMULATE_HITAG 0x0371 #define CMD_SIMULATE_HITAG 0x0371
#define CMD_READER_HITAG 0x0372 #define CMD_READER_HITAG 0x0372
#define CMD_SIMULATE_TAG_HF_LISTEN 0x0380 #define CMD_SIMULATE_TAG_ISO_14443B 0x0381
#define CMD_SIMULATE_TAG_ISO_14443 0x0381 #define CMD_SNOOP_ISO_14443B 0x0382
#define CMD_SNOOP_ISO_14443 0x0382
#define CMD_SNOOP_ISO_14443a 0x0383 #define CMD_SNOOP_ISO_14443a 0x0383
#define CMD_SIMULATE_TAG_ISO_14443a 0x0384 #define CMD_SIMULATE_TAG_ISO_14443a 0x0384
#define CMD_READER_ISO_14443a 0x0385 #define CMD_READER_ISO_14443a 0x0385

BIN
fpga/fpga_hf.bit
View file

Binary file not shown.

4
fpga/hi_read_rx_xcorr.v
View file

@ -88,7 +88,7 @@ begin
// These are the correlators: we correlate against in-phase and quadrature // These are the correlators: we correlate against in-phase and quadrature
// versions of our reference signal, and keep the (signed) result to // versions of our reference signal, and keep the (signed) result to
// send out later over the SSP. // send out later over the SSP.
if(corr_i_cnt == 7'd0) if(corr_i_cnt == 6'd0)
begin begin
if(snoop) if(snoop)
begin begin
@ -123,7 +123,7 @@ begin
// The logic in hi_simulate.v reports 4 samples per bit. We report two // The logic in hi_simulate.v reports 4 samples per bit. We report two
// (I, Q) pairs per bit, so we should do 2 samples per pair. // (I, Q) pairs per bit, so we should do 2 samples per pair.
if(corr_i_cnt == 6'd31) if(corr_i_cnt == 6'd32)
after_hysteresis_prev <= after_hysteresis; after_hysteresis_prev <= after_hysteresis;
// Then the result from last time is serialized and send out to the ARM. // Then the result from last time is serialized and send out to the ARM.