mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-07-07 13:41:18 -07:00
iso14443b: trying to approach iClass
* decode and handle SOF only responses in Handle14443bSamplesDemod() * allow 1 byte commands with 'hf 14b raw'
This commit is contained in:
pwpiwi
parent
a334de73d2
commit
a3bef9863b
2 changed files with 66 additions and 48 deletions
|
|
@ -586,9 +586,10 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
|
|||
Demod.state = DEMOD_UNSYNCD;
|
||||
} else {
|
||||
LED_C_ON(); // Got SOF
|
||||
Demod.state = DEMOD_AWAITING_START_BIT;
|
||||
Demod.posCount = 0;
|
||||
Demod.bitCount = 0;
|
||||
Demod.len = 0;
|
||||
Demod.state = DEMOD_AWAITING_START_BIT;
|
||||
/* this had been used to add RSSI (Received Signal Strength Indication) to traces. Currently not implemented.
|
||||
Demod.metricN = 0;
|
||||
Demod.metric = 0;
|
||||
|
|
@ -607,11 +608,14 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
|
|||
MAKE_SOFT_DECISION();
|
||||
if (v > 0) {
|
||||
if (Demod.posCount > 3*2) { // max 19us between characters = 16 1/fs, max 3 etu after low phase of SOF = 24 1/fs
|
||||
Demod.state = DEMOD_UNSYNCD;
|
||||
LED_C_OFF();
|
||||
if (Demod.bitCount == 0 && Demod.len == 0) { // received SOF only, this is valid for iClass/Picopass
|
||||
return true;
|
||||
} else {
|
||||
Demod.state = DEMOD_UNSYNCD;
|
||||
}
|
||||
}
|
||||
} else { // start bit detected
|
||||
Demod.bitCount = 0;
|
||||
Demod.posCount = 1; // this was the first half
|
||||
Demod.thisBit = v;
|
||||
Demod.shiftReg = 0;
|
||||
|
|
@ -648,6 +652,7 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
|
|||
uint8_t b = (s >> 1);
|
||||
Demod.output[Demod.len] = b;
|
||||
Demod.len++;
|
||||
Demod.bitCount = 0;
|
||||
Demod.state = DEMOD_AWAITING_START_BIT;
|
||||
} else {
|
||||
Demod.state = DEMOD_UNSYNCD;
|
||||
|
|
@ -693,8 +698,8 @@ static void DemodInit(uint8_t *data)
|
|||
* Demodulate the samples we received from the tag, also log to tracebuffer
|
||||
* quiet: set to 'true' to disable debug output
|
||||
*/
|
||||
static void GetSamplesFor14443bDemod(int timeout, bool quiet)
|
||||
{
|
||||
static int GetSamplesFor14443bDemod(int timeout, bool quiet) {
|
||||
int ret = 0;
|
||||
int maxBehindBy = 0;
|
||||
bool gotFrame = false;
|
||||
int lastRxCounter, samples = 0;
|
||||
|
|
@ -751,11 +756,13 @@ static void GetSamplesFor14443bDemod(int timeout, bool quiet)
|
|||
samples++;
|
||||
|
||||
if (Handle14443bSamplesDemod(ci, cq)) {
|
||||
ret = Demod.len;
|
||||
gotFrame = true;
|
||||
break;
|
||||
}
|
||||
|
||||
if(samples > timeout && Demod.state < DEMOD_PHASE_REF_TRAINING) {
|
||||
ret = -1;
|
||||
LED_C_OFF();
|
||||
break;
|
||||
}
|
||||
|
|
@ -764,10 +771,14 @@ static void GetSamplesFor14443bDemod(int timeout, bool quiet)
|
|||
FpgaDisableSscDma();
|
||||
|
||||
if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", maxBehindBy, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
|
||||
//Tracing
|
||||
if (Demod.len > 0) {
|
||||
LogTrace(Demod.output, Demod.len, 0, 0, NULL, false);
|
||||
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
//Tracing
|
||||
LogTrace(Demod.output, Demod.len, 0, 0, NULL, false);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -858,8 +869,7 @@ static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
|
|||
/* Sends an APDU to the tag
|
||||
* TODO: check CRC and preamble
|
||||
*/
|
||||
int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response)
|
||||
{
|
||||
int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *response) {
|
||||
LED_A_ON();
|
||||
uint8_t message_frame[message_length + 4];
|
||||
// PCB
|
||||
|
|
@ -874,21 +884,19 @@ int iso14443b_apdu(uint8_t const *message, size_t message_length, uint8_t *respo
|
|||
// send
|
||||
CodeAndTransmit14443bAsReader(message_frame, message_length + 4);
|
||||
// get response
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
FpgaDisableTracing();
|
||||
if(Demod.len < 3)
|
||||
{
|
||||
if (ret < 3) {
|
||||
LED_A_OFF();
|
||||
return 0;
|
||||
}
|
||||
// TODO: Check CRC
|
||||
// copy response contents
|
||||
if(response != NULL)
|
||||
{
|
||||
if (response != NULL) {
|
||||
memcpy(response, Demod.output, Demod.len);
|
||||
}
|
||||
LED_A_OFF();
|
||||
return Demod.len;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* Perform the ISO 14443 B Card Selection procedure
|
||||
|
|
@ -907,10 +915,9 @@ int iso14443b_select_card()
|
|||
|
||||
// first, wake up the tag
|
||||
CodeAndTransmit14443bAsReader(wupb, sizeof(wupb));
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
// ATQB too short?
|
||||
if (Demod.len < 14)
|
||||
{
|
||||
if (ret < 14) {
|
||||
return 2;
|
||||
}
|
||||
|
||||
|
|
@ -922,10 +929,9 @@ int iso14443b_select_card()
|
|||
attrib[7] = Demod.output[10] & 0x0F;
|
||||
ComputeCrc14443(CRC_14443_B, attrib, 9, attrib + 9, attrib + 10);
|
||||
CodeAndTransmit14443bAsReader(attrib, sizeof(attrib));
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
// Answer to ATTRIB too short?
|
||||
if(Demod.len < 3)
|
||||
{
|
||||
if (ret < 3) {
|
||||
return 2;
|
||||
}
|
||||
// reset PCB block number
|
||||
|
|
@ -985,9 +991,9 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
// First command: wake up the tag using the INITIATE command
|
||||
uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
|
||||
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
int ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
|
||||
if (Demod.len == 0) {
|
||||
if (ret < 0) {
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
DbpString("No response from tag");
|
||||
LEDsoff();
|
||||
|
|
@ -1003,7 +1009,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
cmd1[1] = Demod.output[0];
|
||||
ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
|
||||
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
if (Demod.len != 3) {
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
|
||||
|
|
@ -1031,8 +1037,8 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
cmd1[0] = 0x0B;
|
||||
ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
|
||||
CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
if (Demod.len != 10) {
|
||||
ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
if (ret != 10) {
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
|
||||
LEDsoff();
|
||||
|
|
@ -1062,8 +1068,8 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
cmd1[1] = i;
|
||||
ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
|
||||
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
if (Demod.len != 6) { // Check if we got an answer from the tag
|
||||
ret = GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
if (ret != 6) { // Check if we got an answer from the tag
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
DbpString("Expected 6 bytes from tag, got less...");
|
||||
LEDsoff();
|
||||
|
|
@ -1214,7 +1220,7 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
}
|
||||
|
||||
if (!ReaderIsActive && triggered) { // no need to try decoding tag data if the reader is sending or not yet triggered
|
||||
if(Handle14443bSamplesDemod(ci/2, cq/2)) {
|
||||
if (Handle14443bSamplesDemod(ci/2, cq/2) >= 0) {
|
||||
//Use samples as a time measurement
|
||||
LogTrace(Demod.output, Demod.len, samples, samples, NULL, false);
|
||||
// And ready to receive another response.
|
||||
|
|
@ -1266,10 +1272,10 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u
|
|||
CodeAndTransmit14443bAsReader(data, datalen);
|
||||
|
||||
if (recv) {
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
int ret = GetSamplesFor14443bDemod(5*RECEIVE_SAMPLES_TIMEOUT, true);
|
||||
FpgaDisableTracing();
|
||||
uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
|
||||
cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
|
||||
cmd_send(CMD_ACK, ret, 0, 0, Demod.output, iLen);
|
||||
}
|
||||
|
||||
FpgaDisableTracing();
|
||||
|
|
|
|||
|
|
@ -108,9 +108,21 @@ int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datal
|
|||
if (verbose) PrintAndLog("timeout while waiting for reply.");
|
||||
return 0;
|
||||
}
|
||||
*datalen = resp.arg[0];
|
||||
if (verbose) PrintAndLog("received %u octets", *datalen);
|
||||
if (*datalen < 2) return 0;
|
||||
|
||||
int ret = resp.arg[0];
|
||||
if (verbose) {
|
||||
if (ret < 0) {
|
||||
PrintAndLog("tag didn't respond");
|
||||
} else if (ret == 0) {
|
||||
PrintAndLog("received SOF only (maybe iCLASS/Picopass)");
|
||||
} else {
|
||||
PrintAndLog("received %u octets", ret);
|
||||
}
|
||||
}
|
||||
|
||||
*datalen = ret;
|
||||
|
||||
if (ret < 2) return 0;
|
||||
|
||||
memcpy(data, resp.d.asBytes, *datalen);
|
||||
if (verbose) PrintAndLog("%s", sprint_hex(data, *datalen));
|
||||
|
|
@ -139,7 +151,7 @@ static int CmdHF14BCmdRaw (const char *Cmd) {
|
|||
uint8_t datalen = 0;
|
||||
unsigned int temp;
|
||||
int i = 0;
|
||||
if (strlen(Cmd) < 3) {
|
||||
if (strlen(Cmd) < 2) {
|
||||
PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
|
||||
PrintAndLog(" -r do not read response");
|
||||
PrintAndLog(" -c calculate and append CRC");
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue