github/proxmark3
1
0
Fork 0
mirror of https://github.com/Proxmark/proxmark3.git synced 2025-08-22 14:13:42 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

start fixing hf 15:

Browse source 
* implement a real time Decoder (will be required for sniffing)
* switch off field after each command (protect rdv40)
* correctly signal field status with LED D
This commit is contained in:
pwpiwi 2018-09-28 13:54:41 +02:00
commit 22c00adf68
2 changed files with 386 additions and 289 deletions
Download patch file Download diff file Expand all files Collapse all files

644
armsrc/iso15693.c
View file

@ -67,6 +67,8 @@
#define arraylen(x) (sizeof(x)/sizeof((x)[0])) #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
static int DEBUG = 0;
/////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////
// ISO 15693 Part 2 - Air Interface // ISO 15693 Part 2 - Air Interface
// This section basicly contains transmission and receiving of bits // This section basicly contains transmission and receiving of bits
@ -82,10 +84,10 @@
#define sprintUID(target,uid) Iso15693sprintUID(target,uid) #define sprintUID(target,uid) Iso15693sprintUID(target,uid)
// approximate amplitude=sqrt(ci^2+cq^2) // approximate amplitude=sqrt(ci^2+cq^2)
#define AMPLITUDE(ci, cq) (MAX(ABS(ci), ABS(cq)) + (MIN(ABS(ci), ABS(cq))>>1)) #define AMPLITUDE(ci, cq) (MAX(ABS(ci), ABS(cq)) + MIN(ABS(ci), ABS(cq))/2)
static int DEBUG = 0;
// DMA buffer
#define ISO15693_DMA_BUFFER_SIZE 128
// --------------------------- // ---------------------------
// Signal Processing // Signal Processing
@ -168,13 +170,15 @@ static void CodeIso15693AsReader(uint8_t *cmd, int n)
ToSendStuffBit(0); ToSendStuffBit(0);
ToSendStuffBit(1); ToSendStuffBit(1);
// And slack at the end, too. // Fill remainder of last byte with 1
for(i = 0; i < 24; i++) { for(i = 0; i < 4; i++) {
ToSendStuffBit(1); ToSendStuffBit(1);
} }
ToSendMax++;
} }
// encode data using "1 out of 256" sheme // encode data using "1 out of 256" scheme
// data rate is 1,66 kbit/s (fc/8192) // data rate is 1,66 kbit/s (fc/8192)
// is designed for more robust communication over longer distances // is designed for more robust communication over longer distances
static void CodeIso15693AsReader256(uint8_t *cmd, int n) static void CodeIso15693AsReader256(uint8_t *cmd, int n)
@ -222,224 +226,349 @@ static void CodeIso15693AsReader256(uint8_t *cmd, int n)
} }
// Transmit the command (to the tag) that was placed in ToSend[]. // Transmit the command (to the tag) that was placed in cmd[].
static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait) static void TransmitTo15693Tag(const uint8_t *cmd, int len)
{ {
int c;
FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX); FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
if(*wait < 10) { *wait = 10; }
c = 0; LED_B_ON();
for(;;) { for(int c = 0; c < len; ) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = ~cmd[c]; AT91C_BASE_SSC->SSC_THR = ~cmd[c];
c++; c++;
if(c >= len) {
break;
}
}
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
(void)r;
} }
WDT_HIT(); WDT_HIT();
} }
*samples = (c + *wait) << 3; LED_B_OFF();
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Transmit the command (to the reader) that was placed in ToSend[]. // Transmit the command (to the reader) that was placed in cmd[].
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait) static void TransmitTo15693Reader(const uint8_t *cmd, int len)
{ {
int c = 0;
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_424K); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_424K);
if(*wait < 10) { *wait = 10; }
for(;;) { LED_C_ON();
for(int c = 0; c < len; ) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = cmd[c]; AT91C_BASE_SSC->SSC_THR = cmd[c];
c++; c++;
if(c >= len) {
break;
}
}
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
(void)r;
} }
WDT_HIT(); WDT_HIT();
} }
*samples = (c + *wait) << 3; LED_C_OFF();
} }
// Read from Tag //=============================================================================
// Parameters: // An ISO 15693 demodulator (one subcarrier only). Uses cross correlation to
// receivedResponse // identify the SOF, each bit, and EOF.
// maxLen // This function is called 8 times per bit (every 2 subcarrier cycles).
// samples // Subcarrier frequency fs is 424kHz, 1/fs = 2,36us,
// elapsed // i.e. function is called every 4,72us
// returns: // LED handling:
// number of decoded bytes // LED C -> ON once we have received the SOF and are expecting the rest.
static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) // LED C -> OFF once we have received EOF or are unsynced
//
// Returns: true if we received a EOF
// false if we are still waiting for some more
//=============================================================================
#define SUBCARRIER_DETECT_THRESHOLD 2
#define SOF_CORRELATOR_LEN (1<<5)
typedef struct Demod {
enum {
DEMOD_UNSYNCD,
DEMOD_AWAIT_SOF_1,
DEMOD_AWAIT_SOF_2,
DEMOD_RECEIVING_DATA,
DEMOD_AWAIT_EOF
} state;
int bitCount;
int posCount;
enum {
LOGIC0,
LOGIC1,
SOF_PART1,
SOF_PART2
} lastBit;
uint16_t shiftReg;
uint8_t *output;
int len;
int sum1, sum2;
uint8_t SOF_low;
uint8_t SOF_high;
uint8_t SOF_last;
int32_t SOF_corr;
int32_t SOF_corr_prev;
uint8_t SOF_correlator[SOF_CORRELATOR_LEN];
} Demod_t;
static RAMFUNC int Handle15693SamplesDemod(int8_t ci, int8_t cq, Demod_t *Demod)
{ {
int c = 0; switch(Demod->state) {
uint8_t *dest = BigBuf_get_addr(); case DEMOD_UNSYNCD:
// initialize SOF correlator. We are looking for 12 samples low and 12 samples high.
// NOW READ RESPONSE Demod->SOF_low = 0;
FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); Demod->SOF_high = 12;
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); Demod->SOF_last = 23;
c = 0; memset(Demod->SOF_correlator, 0x00, Demod->SOF_last + 1);
for(;;) { Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { Demod->SOF_corr = Demod->SOF_correlator[Demod->SOF_last];
uint16_t iq = AT91C_BASE_SSC->SSC_RHR; Demod->SOF_corr_prev = Demod->SOF_corr;
// The samples are correlations against I and Q versions of the // initialize Demodulator
// tone that the tag AM-modulates. We just want power. Demod->posCount = 0;
int8_t i = iq >> 8; Demod->bitCount = 0;
int8_t q = iq; Demod->len = 0;
uint8_t r = AMPLITUDE(i, q); Demod->state = DEMOD_AWAIT_SOF_1;
dest[c++] = r;
if(c >= 4000) {
break; break;
}
}
}
////////////////////////////////////////// case DEMOD_AWAIT_SOF_1:
/////////// DEMODULATE /////////////////// // calculate the correlation in real time. Look at differences only.
////////////////////////////////////////// Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_low++];
Demod->SOF_corr -= 2*Demod->SOF_correlator[Demod->SOF_high++];
Demod->SOF_last++;
Demod->SOF_low &= (SOF_CORRELATOR_LEN-1);
Demod->SOF_high &= (SOF_CORRELATOR_LEN-1);
Demod->SOF_last &= (SOF_CORRELATOR_LEN-1);
Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_last];
int i, j; // if correlation increases for 10 consecutive samples, we are close to maximum correlation
int max = 0, maxPos=0; if (Demod->SOF_corr > Demod->SOF_corr_prev + SUBCARRIER_DETECT_THRESHOLD) {
Demod->posCount++;
int skip = 2;
// First, correlate for SOF
for(i = 0; i < 200; i++) { // usually, SOF is found around i = 60
int corr = 0;
for(j = 0; j < arraylen(FrameSOF); j += skip) {
corr += FrameSOF[j]*dest[i+(j/skip)];
}
if(corr > max) {
max = corr;
maxPos = i;
}
}
if (DEBUG) Dbprintf("SOF at %d, correlation %d", maxPos, max/(arraylen(FrameSOF)/skip));
int k = 0; // this will be our return value
// greg - If correlation is less than 1 then there's little point in continuing
if ((max/(arraylen(FrameSOF)/skip)) >= 1)
{
i = maxPos + arraylen(FrameSOF)/skip;
uint8_t outBuf[20];
memset(outBuf, 0, sizeof(outBuf));
uint8_t mask = 0x01;
for(;;) {
int corr0 = 0, corr00 = 0, corr01 = 0, corr1 = 0, corrEOF = 0;
for(j = 0; j < arraylen(Logic0); j += skip) {
corr0 += Logic0[j]*dest[i+(j/skip)];
}
corr01 = corr00 = corr0;
for(j = 0; j < arraylen(Logic0); j += skip) {
corr00 += Logic0[j]*dest[i+arraylen(Logic0)/skip+(j/skip)];
corr01 += Logic1[j]*dest[i+arraylen(Logic0)/skip+(j/skip)];
}
for(j = 0; j < arraylen(Logic1); j += skip) {
corr1 += Logic1[j]*dest[i+(j/skip)];
}
for(j = 0; j < arraylen(FrameEOF); j += skip) {
corrEOF += FrameEOF[j]*dest[i+(j/skip)];
}
// Even things out by the length of the target waveform.
corr00 *= 2;
corr01 *= 2;
corr0 *= 4;
corr1 *= 4;
if(corrEOF > corr1 && corrEOF > corr00 && corrEOF > corr01) {
if (DEBUG) Dbprintf("EOF at %d, correlation %d (corr01: %d, corr00: %d, corr1: %d, corr0: %d)",
i, corrEOF, corr01, corr00, corr1, corr0);
break;
} else if(corr1 > corr0) {
i += arraylen(Logic1)/skip;
outBuf[k] |= mask;
} else { } else {
i += arraylen(Logic0)/skip; Demod->posCount = 0;
} }
mask <<= 1;
if(mask == 0) { if (Demod->posCount == 10) { // correlation increased 10 times
k++; Demod->state = DEMOD_AWAIT_SOF_2;
mask = 0x01;
} }
if((i+(int)arraylen(FrameEOF)/skip) >= 4000) {
DbpString("ran off end!"); Demod->SOF_corr_prev = Demod->SOF_corr;
break;
case DEMOD_AWAIT_SOF_2:
// calculate the correlation in real time. Look at differences only.
Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_low++];
Demod->SOF_corr -= 2*Demod->SOF_correlator[Demod->SOF_high++];
Demod->SOF_last++;
Demod->SOF_low &= (SOF_CORRELATOR_LEN-1);
Demod->SOF_high &= (SOF_CORRELATOR_LEN-1);
Demod->SOF_last &= (SOF_CORRELATOR_LEN-1);
Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_last];
if (Demod->SOF_corr >= Demod->SOF_corr_prev) { // we are looking for the maximum correlation
Demod->SOF_corr_prev = Demod->SOF_corr;
} else {
Demod->lastBit = SOF_PART1; // detected 1st part of SOF
Demod->sum1 = Demod->SOF_correlator[Demod->SOF_last];
Demod->sum2 = 0;
Demod->posCount = 2;
Demod->state = DEMOD_RECEIVING_DATA;
LED_C_ON();
}
break;
case DEMOD_RECEIVING_DATA:
if (Demod->posCount == 1) {
Demod->sum1 = 0;
Demod->sum2 = 0;
}
if (Demod->posCount <= 4) {
Demod->sum1 += AMPLITUDE(ci, cq);
} else {
Demod->sum2 += AMPLITUDE(ci, cq);
}
if (Demod->posCount == 8) {
int16_t corr_1 = (Demod->sum2 - Demod->sum1) / 4;
int16_t corr_0 = (Demod->sum1 - Demod->sum2) / 4;
int16_t corr_EOF = (Demod->sum1 + Demod->sum2) / 8;
if (corr_EOF > corr_0 && corr_EOF > corr_1) {
Demod->state = DEMOD_AWAIT_EOF;
} else if (corr_1 > corr_0) {
// logic 1
if (Demod->lastBit == SOF_PART1) { // still part of SOF
Demod->lastBit = SOF_PART2;
} else {
Demod->lastBit = LOGIC1;
Demod->shiftReg >>= 1;
Demod->shiftReg |= 0x80;
Demod->bitCount++;
if (Demod->bitCount == 8) {
Demod->output[Demod->len] = Demod->shiftReg;
Demod->len++;
Demod->bitCount = 0;
Demod->shiftReg = 0;
}
}
} else {
// logic 0
if (Demod->lastBit == SOF_PART1) { // incomplete SOF
Demod->state = DEMOD_UNSYNCD;
LED_C_OFF();
} else {
Demod->lastBit = LOGIC0;
Demod->shiftReg >>= 1;
Demod->bitCount++;
if (Demod->bitCount == 8) {
Demod->output[Demod->len] = Demod->shiftReg;
Demod->len++;
Demod->bitCount = 0;
Demod->shiftReg = 0;
}
}
}
Demod->posCount = 0;
}
Demod->posCount++;
break;
case DEMOD_AWAIT_EOF:
if (Demod->lastBit == LOGIC0) { // this was already part of EOF
LED_C_OFF();
return true;
} else {
Demod->state = DEMOD_UNSYNCD;
LED_C_OFF();
}
break;
default:
Demod->state = DEMOD_UNSYNCD;
LED_C_OFF();
break;
}
return false;
}
static void DemodInit(Demod_t* Demod, uint8_t* data)
{
Demod->output = data;
Demod->state = DEMOD_UNSYNCD;
}
/*
* Demodulate the samples we received from the tag, also log to tracebuffer
*/
static int GetIso15693AnswerFromTag(uint8_t* response, int timeout)
{
int maxBehindBy = 0;
int lastRxCounter, samples = 0;
int8_t ci, cq;
bool gotFrame = false;
// Allocate memory from BigBuf for some buffers
// free all previous allocations first
BigBuf_free();
// The DMA buffer, used to stream samples from the FPGA
uint16_t* dmaBuf = (uint16_t*) BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE * sizeof(uint16_t));
// the Demodulatur data structure
Demod_t* Demod = (Demod_t*) BigBuf_malloc(sizeof(Demod_t));
// Set up the demodulator for tag -> reader responses.
DemodInit(Demod, response);
// wait for last transfer to complete
while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));
// And put the FPGA in the appropriate mode
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// Setup and start DMA.
FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);
uint16_t *upTo = dmaBuf;
lastRxCounter = ISO15693_DMA_BUFFER_SIZE;
for(;;) {
int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO15693_DMA_BUFFER_SIZE-1);
if(behindBy > maxBehindBy) {
maxBehindBy = behindBy;
}
if (behindBy < 1) continue;
ci = (int8_t)(*upTo >> 8);
cq = (int8_t)(*upTo & 0xff);
upTo++;
lastRxCounter--;
if(upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) { // we have read all of the DMA buffer content.
upTo = dmaBuf; // start reading the circular buffer from the beginning
lastRxCounter += ISO15693_DMA_BUFFER_SIZE;
}
if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) { // DMA Counter Register had reached 0, already rotated.
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf; // refresh the DMA Next Buffer and
AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE; // DMA Next Counter registers
}
samples++;
if (Handle15693SamplesDemod(ci, cq, Demod)) {
gotFrame = true;
break;
}
if(samples > timeout && Demod->state < DEMOD_RECEIVING_DATA) {
Demod->len = 0;
break; break;
} }
} }
if(mask != 0x01) { // this happens, when we miss the EOF
// TODO: for some reason this happens quite often FpgaDisableSscDma();
if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
if (mask<0x08) k--; // discard the last uneven octet; if (DEBUG) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.state = %d, Demod.len = %d, Demod.bitCount = %d, Demod.posCount = %d",
// 0x08 is an assumption - but works quite often maxBehindBy, samples, gotFrame, Demod->state, Demod->len, Demod->bitCount, Demod->posCount);
if (tracing && Demod->len > 0) {
uint8_t parity[MAX_PARITY_SIZE];
LogTrace(Demod->output, Demod->len, 0, 0, parity, false);
} }
// uint8_t str1 [8];
// itoa(k,str1);
// strncat(str1," octets read",8);
// DbpString( str1); // DbpString("%d octets", k);
// for(i = 0; i < k; i+=3) {
// //DbpString("# %2d: %02x ", i, outBuf[i]);
// DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
// }
for(i = 0; i < k; i++) {
receivedResponse[i] = outBuf[i];
}
} // "end if correlation > 0" (max/(arraylen(FrameSOF)/skip))
return k; // return the number of bytes demodulated
/// DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
return Demod->len;
} }
// Now the GetISO15693 message from sniffing command // Now the GetISO15693 message from sniffing command
// TODO: fix it. This cannot work for several reasons:
// 1. Carrier is switched on during sniffing?
// 2. We most probable miss the next reader command when demodulating
static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
{ {
int c = 0;
uint8_t *dest = BigBuf_get_addr(); uint8_t *dest = BigBuf_get_addr();
// NOW READ RESPONSE // NOW READ RESPONSE
LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
//spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads //spindelay(60); // greg - experiment to get rid of some of the 0 byte/failed reads
c = 0; for(int c = 0; c < BIGBUF_SIZE; ) {
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
uint16_t iq = AT91C_BASE_SSC->SSC_RHR; uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
// The samples are correlations against I and Q versions of the // The samples are correlations against I and Q versions of the
// tone that the tag AM-modulates. We just want power, // tone that the tag AM-modulates. We just want power,
// so abs(I) + abs(Q) is close to what we want. // so abs(I) + abs(Q) is close to what we want.
int8_t i = iq >> 8; int8_t i = (int8_t)(iq >> 8);
int8_t q = iq; int8_t q = (int8_t)(iq & 0xff);
uint8_t r = AMPLITUDE(i, q); uint8_t r = AMPLITUDE(i, q);
dest[c++] = r; dest[c++] = r;
if(c >= BIGBUF_SIZE) {
break;
}
} }
} }
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
////////////////////////////////////////// //////////////////////////////////////////
/////////// DEMODULATE /////////////////// /////////// DEMODULATE ///////////////////
@ -461,6 +590,7 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
maxPos = i; maxPos = i;
} }
} }
if (DEBUG) Dbprintf("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip)); if (DEBUG) Dbprintf("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
int k = 0; // this will be our return value int k = 0; // this will be our return value
@ -549,9 +679,10 @@ static void BuildIdentifyRequest(void);
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void AcquireRawAdcSamplesIso15693(void) void AcquireRawAdcSamplesIso15693(void)
{ {
uint8_t *dest = BigBuf_get_addr(); LEDsoff();
LED_A_ON();
int c = 0; uint8_t *dest = BigBuf_get_addr();
FpgaDownloadAndGo(FPGA_BITSTREAM_HF); FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
BuildIdentifyRequest(); BuildIdentifyRequest();
@ -559,6 +690,7 @@ void AcquireRawAdcSamplesIso15693(void)
SetAdcMuxFor(GPIO_MUXSEL_HIPKD); SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
// Give the tags time to energize // Give the tags time to energize
LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
SpinDelay(100); SpinDelay(100);
@ -566,47 +698,50 @@ void AcquireRawAdcSamplesIso15693(void)
FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX); FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
c = 0; LED_B_ON();
for(;;) { for(int c = 0; c < ToSendMax; ) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = ~ToSend[c]; AT91C_BASE_SSC->SSC_THR = ~ToSend[c];
c++; c++;
if(c == ToSendMax+3) {
break;
}
} }
WDT_HIT(); WDT_HIT();
} }
LED_B_OFF();
// wait for last transfer to complete
while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));
FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
c = 0; for(int c = 0; c < 4000; ) {
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
uint16_t iq = AT91C_BASE_SSC->SSC_RHR; uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
// The samples are correlations against I and Q versions of the // The samples are correlations against I and Q versions of the
// tone that the tag AM-modulates. We just want power, // tone that the tag AM-modulates. We just want power,
// so abs(I) + abs(Q) is close to what we want. // so abs(I) + abs(Q) is close to what we want.
int8_t i = iq >> 8; int8_t i = (int8_t)(iq >> 8);
int8_t q = iq; int8_t q = (int8_t)(iq & 0xff);
uint8_t r = AMPLITUDE(i, q); uint8_t r = AMPLITUDE(i, q);
dest[c++] = r; dest[c++] = r;
if(c >= 4000) {
break;
}
}
} }
} }
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
}
// TODO: there is no trigger condition. The 14000 samples represent a time frame of 66ms.
// It is unlikely that we get something meaningful.
// TODO: Currently we only record tag answers. Add tracing of reader commands.
// TODO: would we get something at all? The carrier is switched on...
void RecordRawAdcSamplesIso15693(void) void RecordRawAdcSamplesIso15693(void)
{ {
uint8_t *dest = BigBuf_get_addr(); LEDsoff();
LED_A_ON();
int c = 0; uint8_t *dest = BigBuf_get_addr();
FpgaDownloadAndGo(FPGA_BITSTREAM_HF); FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
// Setup SSC // Setup SSC
@ -620,43 +755,38 @@ void RecordRawAdcSamplesIso15693(void)
SpinDelay(100); SpinDelay(100);
LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
c = 0; for(int c = 0; c < 14000;) {
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
uint16_t iq = AT91C_BASE_SSC->SSC_RHR; uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
// The samples are correlations against I and Q versions of the // The samples are correlations against I and Q versions of the
// tone that the tag AM-modulates. We just want power, // tone that the tag AM-modulates. We just want power,
// so abs(I) + abs(Q) is close to what we want. // so abs(I) + abs(Q) is close to what we want.
int8_t i = iq >> 8; int8_t i = (int8_t)(iq >> 8);
int8_t q = iq; int8_t q = (int8_t)(iq & 0xff);
uint8_t r = AMPLITUDE(i, q); uint8_t r = AMPLITUDE(i, q);
dest[c++] = r; dest[c++] = r;
}
}
if(c >= 14000) { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
break; LED_D_OFF();
}
}
}
Dbprintf("finished recording"); Dbprintf("finished recording");
LED_A_OFF();
} }
// Initialize the proxmark as iso15k reader // Initialize the proxmark as iso15k reader
// (this might produces glitches that confuse some tags // (this might produces glitches that confuse some tags
void Iso15693InitReader() { static void Iso15693InitReader() {
LED_A_ON();
LED_B_ON();
LED_C_OFF();
LED_D_OFF();
FpgaDownloadAndGo(FPGA_BITSTREAM_HF); FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
// Setup SSC // Setup SSC
// FpgaSetupSsc(); // FpgaSetupSsc();
// Start from off (no field generated) // Start from off (no field generated)
LED_D_OFF();
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
SpinDelay(10); SpinDelay(10);
@ -664,18 +794,14 @@ void Iso15693InitReader() {
FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// Give the tags time to energize // Give the tags time to energize
LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
SpinDelay(250); SpinDelay(250);
LED_A_ON();
LED_B_OFF();
LED_C_OFF();
LED_D_OFF();
} }
/////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////
// ISO 15693 Part 3 - Air Interface // ISO 15693 Part 3 - Air Interface
// This section basicly contains transmission and receiving of bits // This section basically contains transmission and receiving of bits
/////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////
// Encode (into the ToSend buffers) an identify request, which is the first // Encode (into the ToSend buffers) an identify request, which is the first
@ -732,6 +858,7 @@ static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
CodeIso15693AsReader(cmd, sizeof(cmd)); CodeIso15693AsReader(cmd, sizeof(cmd));
} }
// Now the VICC>VCD responses when we are simulating a tag // Now the VICC>VCD responses when we are simulating a tag
static void BuildInventoryResponse( uint8_t *uid) static void BuildInventoryResponse( uint8_t *uid)
{ {
@ -766,17 +893,11 @@ static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
// **recv will return you a pointer to the received data // **recv will return you a pointer to the received data
// If you do not need the answer use NULL for *recv[] // If you do not need the answer use NULL for *recv[]
// return: lenght of received data // return: lenght of received data
int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) { int SendDataTag(uint8_t *send, int sendlen, bool init, int speed, uint8_t **recv) {
int samples = 0;
int tsamples = 0;
int wait = 0;
int elapsed = 0;
LED_A_ON(); LED_A_ON();
LED_B_ON(); LED_B_OFF();
LED_C_OFF(); LED_C_OFF();
LED_D_OFF();
if (init) Iso15693InitReader(); if (init) Iso15693InitReader();
@ -792,22 +913,14 @@ int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv)
CodeIso15693AsReader(send, sendlen); CodeIso15693AsReader(send, sendlen);
} }
LED_A_ON(); TransmitTo15693Tag(ToSend,ToSendMax);
LED_B_OFF();
TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
// Now wait for a response // Now wait for a response
if (recv!=NULL) { if (recv!=NULL) {
LED_A_OFF(); answerLen = GetIso15693AnswerFromTag(answer, 100);
LED_B_ON();
answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ;
*recv=answer; *recv=answer;
} }
LED_A_OFF(); LED_A_OFF();
LED_B_OFF();
LED_C_OFF();
LED_D_OFF();
return answerLen; return answerLen;
} }
@ -887,35 +1000,21 @@ void SetDebugIso15693(uint32_t debug) {
return; return;
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
// all demodulation performed in arm rather than host. - greg // all demodulation performed in arm rather than host. - greg
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void ReaderIso15693(uint32_t parameter) void ReaderIso15693(uint32_t parameter)
{ {
LEDsoff();
LED_A_ON(); LED_A_ON();
LED_B_ON();
LED_C_OFF();
LED_D_OFF();
int answerLen1 = 0; int answerLen1 = 0;
int answerLen2 = 0;
// int answerLen3 = 0;
int i = 0;
int samples = 0;
int tsamples = 0;
int wait = 0;
int elapsed = 0;
uint8_t TagUID[8] = {0x00}; uint8_t TagUID[8] = {0x00};
FpgaDownloadAndGo(FPGA_BITSTREAM_HF); FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
uint8_t *answer1 = BigBuf_get_addr() + 4000; uint8_t *answer1 = BigBuf_get_addr() + 4000;
uint8_t *answer2 = BigBuf_get_addr() + 4100;
// uint8_t *answer3 = BigBuf_get_addr() + 4200;
// Blank arrays
memset(answer1, 0x00, 200); memset(answer1, 0x00, 200);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD); SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
@ -927,24 +1026,20 @@ void ReaderIso15693(uint32_t parameter)
SpinDelay(200); SpinDelay(200);
// Give the tags time to energize // Give the tags time to energize
LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
SpinDelay(200); SpinDelay(200);
LED_A_ON();
LED_B_OFF();
LED_C_OFF();
LED_D_OFF();
// FIRST WE RUN AN INVENTORY TO GET THE TAG UID // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
// THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
// Now send the IDENTIFY command // Now send the IDENTIFY command
BuildIdentifyRequest(); BuildIdentifyRequest();
TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); TransmitTo15693Tag(ToSend,ToSendMax);
// Now wait for a response // Now wait for a response
answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ; answerLen1 = GetIso15693AnswerFromTag(answer1, 100) ;
if (answerLen1 >=12) // we should do a better check than this if (answerLen1 >=12) // we should do a better check than this
{ {
@ -980,11 +1075,12 @@ void ReaderIso15693(uint32_t parameter)
// read all pages // read all pages
if (answerLen1 >= 12 && DEBUG) { if (answerLen1 >= 12 && DEBUG) {
i=0; uint8_t *answer2 = BigBuf_get_addr() + 4100;
int i=0;
while (i<32) { // sanity check, assume max 32 pages while (i<32) { // sanity check, assume max 32 pages
BuildReadBlockRequest(TagUID,i); BuildReadBlockRequest(TagUID,i);
TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait); TransmitTo15693Tag(ToSend,ToSendMax);
answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed); int answerLen2 = GetIso15693AnswerFromTag(answer2, 100);
if (answerLen2>0) { if (answerLen2>0) {
Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2); Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
DbdecodeIso15693Answer(answerLen2,answer2); DbdecodeIso15693Answer(answerLen2,answer2);
@ -995,25 +1091,23 @@ void ReaderIso15693(uint32_t parameter)
} }
} }
LED_A_OFF(); // for the time being, switch field off to protect rdv4.0
LED_B_OFF(); // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
LED_C_OFF(); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF(); LED_D_OFF();
LED_A_OFF();
} }
// Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
// all demodulation performed in arm rather than host. - greg // all demodulation performed in arm rather than host. - greg
void SimTagIso15693(uint32_t parameter, uint8_t *uid) void SimTagIso15693(uint32_t parameter, uint8_t *uid)
{ {
LEDsoff();
LED_A_ON(); LED_A_ON();
LED_B_ON();
LED_C_OFF();
LED_D_OFF();
int answerLen1 = 0; int answerLen1 = 0;
int samples = 0; int samples = 0;
int tsamples = 0;
int wait = 0;
int elapsed = 0; int elapsed = 0;
FpgaDownloadAndGo(FPGA_BITSTREAM_HF); FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
@ -1028,11 +1122,6 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
SpinDelay(200); SpinDelay(200);
LED_A_OFF();
LED_B_OFF();
LED_C_ON();
LED_D_OFF();
// Listen to reader // Listen to reader
answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ; answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
@ -1043,7 +1132,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
BuildInventoryResponse(uid); BuildInventoryResponse(uid);
TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait); TransmitTo15693Reader(ToSend,ToSendMax);
} }
Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1, Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
@ -1054,10 +1143,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
uid[0], uid[1], uid[2], uid[3], uid[0], uid[1], uid[2], uid[3],
uid[4], uid[5], uid[6], uid[7]); uid[4], uid[5], uid[6], uid[7]);
LED_A_OFF(); LEDsoff();
LED_B_OFF();
LED_C_OFF();
LED_D_OFF();
} }
@ -1065,6 +1151,9 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
// (some manufactures offer a way to read the AFI, though) // (some manufactures offer a way to read the AFI, though)
void BruteforceIso15693Afi(uint32_t speed) void BruteforceIso15693Afi(uint32_t speed)
{ {
LEDsoff();
LED_A_ON();
uint8_t data[20]; uint8_t data[20];
uint8_t *recv=data; uint8_t *recv=data;
int datalen=0, recvlen=0; int datalen=0, recvlen=0;
@ -1079,7 +1168,7 @@ void BruteforceIso15693Afi(uint32_t speed)
data[1]=ISO15_CMD_INVENTORY; data[1]=ISO15_CMD_INVENTORY;
data[2]=0; // mask length data[2]=0; // mask length
datalen=AddCrc(data,3); datalen=AddCrc(data,3);
recvlen=SendDataTag(data,datalen,0,speed,&recv); recvlen=SendDataTag(data, datalen, false, speed, &recv);
WDT_HIT(); WDT_HIT();
if (recvlen>=12) { if (recvlen>=12) {
Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2])); Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
@ -1096,7 +1185,7 @@ void BruteforceIso15693Afi(uint32_t speed)
for (int i=0;i<256;i++) { for (int i=0;i<256;i++) {
data[2]=i & 0xFF; data[2]=i & 0xFF;
datalen=AddCrc(data,4); datalen=AddCrc(data,4);
recvlen=SendDataTag(data,datalen,0,speed,&recv); recvlen=SendDataTag(data, datalen, false, speed, &recv);
WDT_HIT(); WDT_HIT();
if (recvlen>=12) { if (recvlen>=12) {
Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2])); Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
@ -1104,6 +1193,8 @@ void BruteforceIso15693Afi(uint32_t speed)
} }
Dbprintf("AFI Bruteforcing done."); Dbprintf("AFI Bruteforcing done.");
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
} }
// Allows to directly send commands to the tag via the client // Allows to directly send commands to the tag via the client
@ -1111,19 +1202,18 @@ void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8
int recvlen=0; int recvlen=0;
uint8_t *recvbuf = BigBuf_get_addr(); uint8_t *recvbuf = BigBuf_get_addr();
// UsbCommand n;
LED_A_ON();
if (DEBUG) { if (DEBUG) {
Dbprintf("SEND"); Dbprintf("SEND");
Dbhexdump(datalen,data,true); Dbhexdump(datalen,data,true);
} }
recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL)); recvlen = SendDataTag(data, datalen, true, speed, (recv?&recvbuf:NULL));
if (recv) { if (recv) {
LED_B_ON();
cmd_send(CMD_ACK, recvlen>48?48:recvlen, 0, 0, recvbuf, 48); cmd_send(CMD_ACK, recvlen>48?48:recvlen, 0, 0, recvbuf, 48);
LED_B_OFF();
if (DEBUG) { if (DEBUG) {
Dbprintf("RECV"); Dbprintf("RECV");
@ -1132,6 +1222,12 @@ void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8
} }
} }
// for the time being, switch field off to protect rdv4.0
// note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
LED_A_OFF();
} }

5
client/cmdhf15.c
View file

@ -373,7 +373,8 @@ int CmdHF15Read(const char *Cmd)
return 0; return 0;
} }
// Record Activity without enabeling carrier // Record Activity without enabling carrier
// TODO: currently it DOES enable the carrier
int CmdHF15Record(const char *Cmd) int CmdHF15Record(const char *Cmd)
{ {
UsbCommand c = {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693}; UsbCommand c = {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693};
@ -574,7 +575,7 @@ int CmdHF15CmdInquiry(const char *Cmd)
int CmdHF15CmdDebug( const char *cmd) { int CmdHF15CmdDebug( const char *cmd) {
int debug = atoi(cmd); int debug = atoi(cmd);
if (strlen(cmd) < 1) { if (strlen(cmd) < 1) {
PrintAndLog("Usage: hf 15 cmd debug <0|1>"); PrintAndLog("Usage: hf 15 debug <0|1>");
PrintAndLog(" 0 no debugging"); PrintAndLog(" 0 no debugging");
PrintAndLog(" 1 turn debugging on"); PrintAndLog(" 1 turn debugging on");
return 0; return 0;