github/proxmark3
1
0
Fork 0
mirror of https://github.com/Proxmark/proxmark3.git synced 2025-07-29 19:18:35 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

- improved reader sensitivity for 14443a cards (FPGA change!)

Browse source 
- implemented ISO 14443A anticollision loop
See http://www.proxmark.org/forum/viewtopic.php?id=1797 further details
This commit is contained in:
micki.held@gmx.de 2013-11-19 18:52:40 +00:00
parent 6cacefa48d
commit e691fc45bc
9 changed files with 428 additions and 388 deletions
Download patch file Download diff file Expand all files Collapse all files

440
armsrc/iso14443a.c
View file

@ -96,9 +96,9 @@ uint32_t GetParity(const uint8_t * pbtCmd, int iLen)
int i; int i;
uint32_t dwPar = 0; uint32_t dwPar = 0;
// Generate the encrypted data // Generate the parity bits
for (i = 0; i < iLen; i++) { for (i = 0; i < iLen; i++) {
// Save the encrypted parity bit // and save them to a 32Bit word
dwPar |= ((OddByteParity[pbtCmd[i]]) << i); dwPar |= ((OddByteParity[pbtCmd[i]]) << i);
} }
return dwPar; return dwPar;
@ -375,196 +375,176 @@ static RAMFUNC int MillerDecoding(int bit)
} }
//============================================================================= //=============================================================================
// ISO 14443 Type A - Manchester // ISO 14443 Type A - Manchester decoder
//============================================================================= //=============================================================================
// Basics:
// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
// The Manchester decoder needs to identify the following sequences:
// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
// 8 ticks unmodulated: Sequence F = end of communication
// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
// Note 1: the bitstream may start at any time (either in first or second nibble within the parameter bit). We therefore need to sync.
// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
static tDemod Demod; static tDemod Demod;
static RAMFUNC int ManchesterDecoding(int v) inline RAMFUNC bool IsModulation(byte_t b)
{ {
int bit; if (b >= 5 || b == 3) // majority decision: 2 or more bits are set
int modulation; return true;
//int error = 0; else
return false;
}
if(!Demod.buff) { inline RAMFUNC bool IsModulationNibble1(byte_t b)
Demod.buff = 1; {
Demod.buffer = v; return IsModulation((b & 0xE0) >> 5);
return FALSE; }
}
else {
bit = Demod.buffer;
Demod.buffer = v;
}
if(Demod.state==DEMOD_UNSYNCD) { inline RAMFUNC bool IsModulationNibble2(byte_t b)
Demod.output[Demod.len] = 0xfa; {
Demod.syncBit = 0; return IsModulation((b & 0x0E) >> 1);
//Demod.samples = 0; }
Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part
if(bit & 0x08) { static RAMFUNC int ManchesterDecoding(int bit, uint16_t offset)
Demod.syncBit = 0x08; {
}
switch (Demod.state) {
if(bit & 0x04) { case DEMOD_UNSYNCD: // not yet synced
if(Demod.syncBit) { Demod.len = 0; // initialize number of decoded data bytes
bit <<= 4; Demod.bitCount = offset; // initialize number of decoded data bits
} Demod.shiftReg = 0; // initialize shiftreg to hold decoded data bits
Demod.syncBit = 0x04; Demod.parityBits = 0; // initialize parity bits
} Demod.collisionPos = 0; // Position of collision bit
if(bit & 0x02) { if (IsModulationNibble1(bit)
if(Demod.syncBit) { && !IsModulationNibble2(bit)) { // this is the start bit
bit <<= 2; Demod.samples = 8;
}
Demod.syncBit = 0x02;
}
if(bit & 0x01 && Demod.syncBit) {
Demod.syncBit = 0x01;
}
if(Demod.syncBit) {
Demod.len = 0;
Demod.state = DEMOD_START_OF_COMMUNICATION;
Demod.sub = SUB_FIRST_HALF;
Demod.bitCount = 0;
Demod.shiftReg = 0;
Demod.parityBits = 0;
Demod.samples = 0;
if(Demod.posCount) {
if(trigger) LED_A_OFF(); if(trigger) LED_A_OFF();
switch(Demod.syncBit) { Demod.state = DEMOD_MANCHESTER_DATA;
case 0x08: Demod.samples = 3; break; } else if (!IsModulationNibble1(bit) && IsModulationNibble2(bit)) { // this may be the first half of the start bit
case 0x04: Demod.samples = 2; break; Demod.samples = 4;
case 0x02: Demod.samples = 1; break; Demod.state = DEMOD_HALF_SYNCD;
case 0x01: Demod.samples = 0; break; }
break;
case DEMOD_HALF_SYNCD:
Demod.samples += 8;
if (IsModulationNibble1(bit)) { // error: this was not a start bit.
Demod.state = DEMOD_UNSYNCD;
} else {
if (IsModulationNibble2(bit)) { // modulation in first half
Demod.state = DEMOD_MOD_FIRST_HALF;
} else { // no modulation in first half
Demod.state = DEMOD_NOMOD_FIRST_HALF;
} }
} }
//error = 0; break;
}
}
else { case DEMOD_MOD_FIRST_HALF:
//modulation = bit & Demod.syncBit; Demod.samples += 8;
modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit; Demod.bitCount++;
if (IsModulationNibble1(bit)) { // modulation in both halfs - collision
Demod.samples += 4; if (!Demod.collisionPos) {
Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
if(Demod.posCount==0) {
Demod.posCount = 1;
if(modulation) {
Demod.sub = SUB_FIRST_HALF;
}
else {
Demod.sub = SUB_NONE;
}
}
else {
Demod.posCount = 0;
if(modulation && (Demod.sub == SUB_FIRST_HALF)) {
if(Demod.state!=DEMOD_ERROR_WAIT) {
Demod.state = DEMOD_ERROR_WAIT;
Demod.output[Demod.len] = 0xaa;
//error = 0x01;
} }
} } // modulation in first half only - Sequence D = 1
else if(modulation) { Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
Demod.sub = SUB_SECOND_HALF; if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
} Demod.parityBits <<= 1; // make room for the parity bit
Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
switch(Demod.state) { Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
case DEMOD_START_OF_COMMUNICATION:
if(Demod.sub == SUB_FIRST_HALF) {
Demod.state = DEMOD_MANCHESTER_D;
}
else {
Demod.output[Demod.len] = 0xab;
Demod.state = DEMOD_ERROR_WAIT;
//error = 0x02;
}
break;
case DEMOD_MANCHESTER_D:
case DEMOD_MANCHESTER_E:
if(Demod.sub == SUB_FIRST_HALF) {
Demod.bitCount++;
Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100;
Demod.state = DEMOD_MANCHESTER_D;
}
else if(Demod.sub == SUB_SECOND_HALF) {
Demod.bitCount++;
Demod.shiftReg >>= 1;
Demod.state = DEMOD_MANCHESTER_E;
}
else {
Demod.state = DEMOD_MANCHESTER_F;
}
break;
case DEMOD_MANCHESTER_F:
// Tag response does not need to be a complete byte!
if(Demod.len > 0 || Demod.bitCount > 0) {
if(Demod.bitCount > 0) {
Demod.shiftReg >>= (9 - Demod.bitCount);
Demod.output[Demod.len] = Demod.shiftReg & 0xff;
Demod.len++;
// No parity bit, so just shift a 0
Demod.parityBits <<= 1;
}
Demod.state = DEMOD_UNSYNCD;
return TRUE;
}
else {
Demod.output[Demod.len] = 0xad;
Demod.state = DEMOD_ERROR_WAIT;
//error = 0x03;
}
break;
case DEMOD_ERROR_WAIT:
Demod.state = DEMOD_UNSYNCD;
break;
default:
Demod.output[Demod.len] = 0xdd;
Demod.state = DEMOD_UNSYNCD;
break;
}
if(Demod.bitCount>=9) {
Demod.output[Demod.len] = Demod.shiftReg & 0xff;
Demod.len++;
Demod.parityBits <<= 1;
Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);
Demod.bitCount = 0; Demod.bitCount = 0;
Demod.shiftReg = 0; Demod.shiftReg = 0;
} }
if (IsModulationNibble2(bit)) { // modulation in first half
Demod.state = DEMOD_MOD_FIRST_HALF;
} else { // no modulation in first half
Demod.state = DEMOD_NOMOD_FIRST_HALF;
}
break;
/*if(error) {
Demod.output[Demod.len] = 0xBB;
Demod.len++;
Demod.output[Demod.len] = error & 0xFF;
Demod.len++;
Demod.output[Demod.len] = 0xBB;
Demod.len++;
Demod.output[Demod.len] = bit & 0xFF;
Demod.len++;
Demod.output[Demod.len] = Demod.buffer & 0xFF;
Demod.len++;
Demod.output[Demod.len] = Demod.syncBit & 0xFF;
Demod.len++;
Demod.output[Demod.len] = 0xBB;
Demod.len++;
return TRUE;
}*/
} case DEMOD_NOMOD_FIRST_HALF:
if (IsModulationNibble1(bit)) { // modulation in second half only - Sequence E = 0
Demod.bitCount++;
Demod.samples += 8;
Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
Demod.parityBits <<= 1; // make room for the new parity bit
Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
Demod.bitCount = 0;
Demod.shiftReg = 0;
}
} else { // no modulation in both halves - End of communication
Demod.samples += 4;
if(Demod.bitCount > 0) { // if we decoded bits
Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
// No parity bit, so just shift a 0
Demod.parityBits <<= 1;
}
Demod.state = DEMOD_UNSYNCD; // start from the beginning
return TRUE; // we are finished with decoding the raw data sequence
}
if (IsModulationNibble2(bit)) { // modulation in first half
Demod.state = DEMOD_MOD_FIRST_HALF;
} else { // no modulation in first half
Demod.state = DEMOD_NOMOD_FIRST_HALF;
}
break;
} // end (state != UNSYNCED) case DEMOD_MANCHESTER_DATA:
Demod.samples += 8;
if (IsModulationNibble1(bit)) { // modulation in first half
if (IsModulationNibble2(bit) & 0x0f) { // ... and in second half = collision
if (!Demod.collisionPos) {
Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
}
} // modulation in first half only - Sequence D = 1
Demod.bitCount++;
Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
Demod.parityBits <<= 1; // make room for the parity bit
Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
Demod.bitCount = 0;
Demod.shiftReg = 0;
}
} else { // no modulation in first half
if (IsModulationNibble2(bit)) { // and modulation in second half = Sequence E = 0
Demod.bitCount++;
Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
Demod.parityBits <<= 1; // make room for the new parity bit
Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
Demod.bitCount = 0;
Demod.shiftReg = 0;
}
} else { // no modulation in both halves - End of communication
if(Demod.bitCount > 0) { // if we decoded bits
Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
// No parity bit, so just shift a 0
Demod.parityBits <<= 1;
}
Demod.state = DEMOD_UNSYNCD; // start from the beginning
return TRUE; // we are finished with decoding the raw data sequence
}
}
}
return FALSE; return FALSE; // not finished yet, need more data
} }
//============================================================================= //=============================================================================
@ -691,7 +671,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
LED_B_OFF(); LED_B_OFF();
} }
if(ManchesterDecoding(data[0] & 0x0F)) { if(ManchesterDecoding(data[0], 0)) {
LED_B_ON(); LED_B_ON();
if (!LogTrace(receivedResponse, Demod.len, 0 - Demod.samples, Demod.parityBits, FALSE)) break; if (!LogTrace(receivedResponse, Demod.len, 0 - Demod.samples, Demod.parityBits, FALSE)) break;
@ -1296,7 +1276,7 @@ static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
while(GetCountMifare() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks) while(GetCountMifare() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
} }
for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission) for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission?)
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = 0x00; AT91C_BASE_SSC->SSC_THR = 0x00;
c++; c++;
@ -1558,13 +1538,12 @@ int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Wait a certain time for tag response // Wait a certain time for tag response
// If a response is captured return TRUE // If a response is captured return TRUE
// If it takes to long return FALSE // If it takes too long return FALSE
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen, int *samples)
{ {
// buffer needs to be 512 bytes
int c; int c;
// Set FPGA mode to "reader listen mode", no modulation (listen // Set FPGA mode to "reader listen mode", no modulation (listen
// only, since we are receiving, not transmitting). // only, since we are receiving, not transmitting).
// Signal field is on with the appropriate LED // Signal field is on with the appropriate LED
@ -1577,7 +1556,6 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int
Demod.state = DEMOD_UNSYNCD; Demod.state = DEMOD_UNSYNCD;
uint8_t b; uint8_t b;
if (elapsed) *elapsed = 0;
c = 0; c = 0;
for(;;) { for(;;) {
@ -1590,12 +1568,8 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
if(c < iso14a_timeout) { c++; } else { return FALSE; } if(c < iso14a_timeout) { c++; } else { return FALSE; }
b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if(ManchesterDecoding((b>>4) & 0xf)) { if(ManchesterDecoding(b, offset)) {
*samples = ((c - 1) << 3) + 4; *samples = Demod.samples;
return TRUE;
}
if(ManchesterDecoding(b & 0x0f)) {
*samples = c << 3;
return TRUE; return TRUE;
} }
} }
@ -1607,12 +1581,12 @@ void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *tim
CodeIso14443aBitsAsReaderPar(frame,bits,par); CodeIso14443aBitsAsReaderPar(frame,bits,par);
// Select the card // Send command to tag
TransmitFor14443a(ToSend, ToSendMax, timing); TransmitFor14443a(ToSend, ToSendMax, timing);
if(trigger) if(trigger)
LED_A_ON(); LED_A_ON();
// Store reader command in buffer // Log reader command in trace buffer
if (tracing) LogTrace(frame,nbytes(bits),0,par,TRUE); if (tracing) LogTrace(frame,nbytes(bits),0,par,TRUE);
} }
@ -1621,38 +1595,49 @@ void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing)
ReaderTransmitBitsPar(frame,len*8,par, timing); ReaderTransmitBitsPar(frame,len*8,par, timing);
} }
void ReaderTransmitBits(uint8_t* frame, int len, uint32_t *timing)
{
// Generate parity and redirect
ReaderTransmitBitsPar(frame,len,GetParity(frame,len/8), timing);
}
void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing) void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing)
{ {
// Generate parity and redirect // Generate parity and redirect
ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing); ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing);
} }
int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
{
int samples = 0;
if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160,&samples)) return FALSE;
if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
if(samples == 0) return FALSE;
return Demod.len;
}
int ReaderReceive(uint8_t* receivedAnswer) int ReaderReceive(uint8_t* receivedAnswer)
{ {
int samples = 0; return ReaderReceiveOffset(receivedAnswer, 0);
if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE;
if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
if(samples == 0) return FALSE;
return Demod.len;
} }
int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr) int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
{ {
int samples = 0; int samples = 0;
if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE; if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160,&samples)) return FALSE;
if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE); if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
*parptr = Demod.parityBits; *parptr = Demod.parityBits;
if(samples == 0) return FALSE; if(samples == 0) return FALSE;
return Demod.len; return Demod.len;
} }
/* performs iso14443a anticolision procedure /* performs iso14443a anticollision procedure
* fills the uid pointer unless NULL * fills the uid pointer unless NULL
* fills resp_data unless NULL */ * fills resp_data unless NULL */
int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) { int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) {
uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
uint8_t sel_all[] = { 0x93,0x20 }; uint8_t sel_all[] = { 0x93,0x20 };
uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0 uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes
byte_t uid_resp[4]; byte_t uid_resp[4];
@ -1666,7 +1651,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
ReaderTransmitBitsPar(wupa,7,0, NULL); ReaderTransmitBitsPar(wupa,7,0, NULL);
// Receive the ATQA // Receive the ATQA
if(!ReaderReceive(resp)) return 0; if(!ReaderReceive(resp)) return 0;
// Dbprintf("atqa: %02x %02x",resp[0],resp[1]); // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
if(p_hi14a_card) { if(p_hi14a_card) {
memcpy(p_hi14a_card->atqa, resp, 2); memcpy(p_hi14a_card->atqa, resp, 2);
@ -1690,19 +1675,50 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
ReaderTransmit(sel_all,sizeof(sel_all), NULL); ReaderTransmit(sel_all,sizeof(sel_all), NULL);
if (!ReaderReceive(resp)) return 0; if (!ReaderReceive(resp)) return 0;
// First backup the current uid if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
memcpy(uid_resp,resp,4); memset(uid_resp, 0, 4);
uid_resp_len = 4; uint16_t uid_resp_bits = 0;
uint16_t collision_answer_offset = 0;
// anti-collision-loop:
while (Demod.collisionPos) {
Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8);
}
uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
uid_resp_bits++;
// construct anticollosion command:
sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
sel_uid[2+i] = uid_resp[i];
}
collision_answer_offset = uid_resp_bits%8;
ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
if (!ReaderReceiveOffset(resp, collision_answer_offset)) return 0;
}
// finally, add the last bits and BCC of the UID
for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
}
} else { // no collision, use the response to SELECT_ALL as current uid
memcpy(uid_resp,resp,4);
}
uid_resp_len = 4;
// Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]); // Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
// calculate crypto UID. Always use last 4 Bytes. // calculate crypto UID. Always use last 4 Bytes.
if(cuid_ptr) { if(cuid_ptr) {
*cuid_ptr = bytes_to_num(uid_resp, 4); *cuid_ptr = bytes_to_num(uid_resp, 4);
} }
// Construct SELECT UID command // Construct SELECT UID command
memcpy(sel_uid+2,resp,5); sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
AppendCrc14443a(sel_uid,7); memcpy(sel_uid+2,uid_resp,4); // the UID
sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
AppendCrc14443a(sel_uid,7); // calculate and add CRC
ReaderTransmit(sel_uid,sizeof(sel_uid), NULL); ReaderTransmit(sel_uid,sizeof(sel_uid), NULL);
// Receive the SAK // Receive the SAK
@ -1710,7 +1726,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
sak = resp[0]; sak = resp[0];
// Test if more parts of the uid are comming // Test if more parts of the uid are comming
if ((sak & 0x04) && uid_resp[0] == 0x88) { if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
// Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of: // Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
// http://www.nxp.com/documents/application_note/AN10927.pdf // http://www.nxp.com/documents/application_note/AN10927.pdf
memcpy(uid_resp, uid_resp + 1, 3); memcpy(uid_resp, uid_resp + 1, 3);
@ -1769,6 +1785,7 @@ void iso14443a_setup() {
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
SpinDelay(7); // iso14443-3 specifies 5ms max. SpinDelay(7); // iso14443-3 specifies 5ms max.
Demod.state = DEMOD_UNSYNCD;
iso14a_timeout = 2048; //default iso14a_timeout = 2048; //default
} }
@ -1815,6 +1832,7 @@ void ReaderIso14443a(UsbCommand * c)
if(param & ISO14A_CONNECT) { if(param & ISO14A_CONNECT) {
iso14a_clear_trace(); iso14a_clear_trace();
} }
iso14a_set_tracing(true); iso14a_set_tracing(true);
if(param & ISO14A_REQUEST_TRIGGER) { if(param & ISO14A_REQUEST_TRIGGER) {
@ -1976,8 +1994,6 @@ void ReaderMifare(bool first_try)
//keep the card active //keep the card active
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
// CodeIso14443aBitsAsReaderPar(mf_auth, sizeof(mf_auth)*8, GetParity(mf_auth, sizeof(mf_auth)*8));
sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles; sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
catch_up_cycles = 0; catch_up_cycles = 0;
@ -2645,7 +2661,7 @@ void RAMFUNC SniffMifare(uint8_t param) {
Demod.state = DEMOD_UNSYNCD; Demod.state = DEMOD_UNSYNCD;
} }
if(ManchesterDecoding(data[0] & 0x0F)) { if(ManchesterDecoding(data[0], 0)) {
LED_C_INV(); LED_C_INV();
if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break; if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;

54
armsrc/iso14443a.h
View file

@ -22,32 +22,22 @@
#define CARD_MEMORY 6000 #define CARD_MEMORY 6000
#define CARD_MEMORY_LEN 4096 #define CARD_MEMORY_LEN 4096
typedef struct nestedVector { uint32_t nt, ks1; } nestedVector;
typedef struct { typedef struct {
enum { enum {
DEMOD_UNSYNCD, DEMOD_UNSYNCD,
DEMOD_START_OF_COMMUNICATION, DEMOD_HALF_SYNCD,
DEMOD_MANCHESTER_D, DEMOD_MOD_FIRST_HALF,
DEMOD_MANCHESTER_E, DEMOD_NOMOD_FIRST_HALF,
DEMOD_MANCHESTER_F, DEMOD_MANCHESTER_DATA
DEMOD_ERROR_WAIT } state;
} state; uint16_t bitCount;
int bitCount; uint16_t collisionPos;
int posCount; uint16_t syncBit;
int syncBit; uint16_t parityBits;
int parityBits; uint16_t shiftReg;
uint16_t shiftReg; uint16_t samples;
int buffer; uint16_t len;
int buff; uint8_t *output;
int samples;
int len;
enum {
SUB_NONE,
SUB_FIRST_HALF,
SUB_SECOND_HALF
} sub;
uint8_t *output;
} tDemod; } tDemod;
typedef struct { typedef struct {
@ -79,18 +69,18 @@ typedef struct {
extern byte_t oddparity (const byte_t bt); extern byte_t oddparity (const byte_t bt);
extern uint32_t GetParity(const uint8_t * pbtCmd, int iLen); extern uint32_t GetParity(const uint8_t *pbtCmd, int iLen);
extern void AppendCrc14443a(uint8_t* data, int len); extern void AppendCrc14443a(uint8_t *data, int len);
extern void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing); extern void ReaderTransmit(uint8_t *frame, int len, uint32_t *timing);
extern void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing); extern void ReaderTransmitBitsPar(uint8_t *frame, int bits, uint32_t par, uint32_t *timing);
extern void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing); extern void ReaderTransmitPar(uint8_t *frame, int len, uint32_t par, uint32_t *timing);
extern int ReaderReceive(uint8_t* receivedAnswer); extern int ReaderReceive(uint8_t *receivedAnswer);
extern int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr); extern int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr);
extern void iso14443a_setup(); extern void iso14443a_setup();
extern int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data); extern int iso14_apdu(uint8_t *cmd, size_t cmd_len, void *data);
extern int iso14443a_select_card(uint8_t * uid_ptr, iso14a_card_select_t * resp_data, uint32_t * cuid_ptr); extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr);
extern void iso14a_set_trigger(bool enable); extern void iso14a_set_trigger(bool enable);
extern void iso14a_set_timeout(uint32_t timeout); extern void iso14a_set_timeout(uint32_t timeout);

18
client/cmdhf14a.c
View file

@ -101,7 +101,7 @@ int CmdHF14AList(const char *Cmd)
char *crc; char *crc;
crc = ""; crc = "";
if (len > 2) { if (len > 2) {
uint8_t b1, b2; uint8_t b1, b2;
for (j = 0; j < (len - 1); j++) { for (j = 0; j < (len - 1); j++) {
// gives problems... search for the reason.. // gives problems... search for the reason..
/*if(frame[j] == 0xAA) { /*if(frame[j] == 0xAA) {
@ -132,8 +132,8 @@ int CmdHF14AList(const char *Cmd)
crc = (isResponse & (len < 6)) ? "" : " !crc"; crc = (isResponse & (len < 6)) ? "" : " !crc";
} else { } else {
crc = ""; crc = "";
} }
} }
} else { } else {
crc = ""; // SHORT crc = ""; // SHORT
} }
@ -148,7 +148,7 @@ int CmdHF14AList(const char *Cmd)
PrintAndLog(" +%7d: %s: %s %s %s", PrintAndLog(" +%7d: %s: %s %s %s",
(prev < 0 ? 0 : (timestamp - prev)), (prev < 0 ? 0 : (timestamp - prev)),
metricString, metricString,
(isResponse ? "TAG" : " "), line, crc); (isResponse ? "TAG " : " "), line, crc);
prev = timestamp; prev = timestamp;
i += (len + 9); i += (len + 9);
@ -184,12 +184,12 @@ int CmdHF14AReader(const char *Cmd)
case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break; case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break; case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k"); break; case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break; case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k"); break; case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k"); break; case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k"); break; case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k | JCOP 31/41"); break; case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break; case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break; case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break; case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;

4
fpga/Makefile
View file

@ -12,11 +12,11 @@ fpga.ngc: fpga.v fpga.ucf xst.scr util.v lo_edge_detect.v lo_read.v lo_passthru.
fpga.ngd: fpga.ngc fpga.ngd: fpga.ngc
$(DELETE) fpga.ngd $(DELETE) fpga.ngd
$(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-6vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd $(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-5-vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd
fpga.ncd: fpga.ngd fpga.ncd: fpga.ngd
$(DELETE) fpga.ncd $(DELETE) fpga.ncd
$(XILINX_TOOLS_PREFIX)map -p xc2s30-6vq100 fpga.ngd $(XILINX_TOOLS_PREFIX)map -p xc2s30-5-vq100 fpga.ngd
fpga-placed.ncd: fpga.ncd fpga-placed.ncd: fpga.ncd
$(DELETE) fpga-placed.ncd $(DELETE) fpga-placed.ncd

BIN
fpga/fpga.bit
View file

Binary file not shown.

13
fpga/fpga.ucf
View file

@ -39,3 +39,16 @@ NET "ssp_frame" LOC = "P31" ;
#PACE: Start of PACE Prohibit Constraints #PACE: Start of PACE Prohibit Constraints
#PACE: End of Constraints generated by PACE #PACE: End of Constraints generated by PACE
# definition of Clock nets:
NET "ck_1356meg" TNM_NET = "clk_net_1356" ;
NET "ck_1356megb" TNM_NET = "clk_net_1356b" ;
NET "pck0" TNM_NET = "clk_net_pck0" ;
NET "spck" TNM_NET = "clk_net_spck" ;
# Timing specs of clock nets:
TIMEGRP "clk_net_1356_all" = "clk_net_1356" "clk_net_1356b" ;
TIMESPEC "TS_1356MHz" = PERIOD "clk_net_1356_all" 74 ns HIGH 37 ns ;
TIMESPEC "TS_24MHz" = PERIOD "clk_net_pck0" 42 ns HIGH 21 ns ;
TIMESPEC "TS_4MHz" = PERIOD "clk_net_spck" 250 ns HIGH 125 ns ;

34
fpga/fpga.v
View file

@ -22,17 +22,17 @@
`include "util.v" `include "util.v"
module fpga( module fpga(
spcki, miso, mosi, ncs, spck, miso, mosi, ncs,
pck0i, ck_1356meg, ck_1356megb, pck0, ck_1356meg, ck_1356megb,
pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4, pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,
adc_d, adc_clk, adc_noe, adc_d, adc_clk, adc_noe,
ssp_frame, ssp_din, ssp_dout, ssp_clk, ssp_frame, ssp_din, ssp_dout, ssp_clk,
cross_hi, cross_lo, cross_hi, cross_lo,
dbg dbg
); );
input spcki, mosi, ncs; input spck, mosi, ncs;
output miso; output miso;
input pck0i, ck_1356meg, ck_1356megb; input pck0, ck_1356meg, ck_1356megb;
output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4; output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4;
input [7:0] adc_d; input [7:0] adc_d;
output adc_clk, adc_noe; output adc_clk, adc_noe;
@ -42,15 +42,17 @@ module fpga(
output dbg; output dbg;
//assign pck0 = pck0i; //assign pck0 = pck0i;
IBUFG #(.IOSTANDARD("DEFAULT") ) pck0b( // IBUFG #(.IOSTANDARD("DEFAULT") ) pck0b(
.O(pck0), // .O(pck0),
.I(pck0i) // .I(pck0i)
); // );
//assign spck = spcki; //assign spck = spcki;
IBUFG #(.IOSTANDARD("DEFAULT") ) spckb( // IBUFG #(.IOSTANDARD("DEFAULT") ) spckb(
.O(spck), // .O(spck),
.I(spcki) // .I(spcki)
); // );
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// The SPI receiver. This sets up the configuration word, which the rest of // The SPI receiver. This sets up the configuration word, which the rest of
// the logic looks at to determine how to connect the A/D and the coil // the logic looks at to determine how to connect the A/D and the coil
@ -68,8 +70,8 @@ reg [7:0] conf_word;
always @(posedge ncs) always @(posedge ncs)
begin begin
case(shift_reg[15:12]) case(shift_reg[15:12])
4'b0001: conf_word <= shift_reg[7:0]; 4'b0001: conf_word <= shift_reg[7:0]; // FPGA_CMD_SET_CONFREG
4'b0010: divisor <= shift_reg[7:0]; 4'b0010: divisor <= shift_reg[7:0]; // FPGA_CMD_SET_DIVISOR
endcase endcase
end end
@ -202,7 +204,7 @@ hi_iso14443a hisn(
mux8 mux_ssp_clk (major_mode, ssp_clk, lr_ssp_clk, ls_ssp_clk, ht_ssp_clk, hrxc_ssp_clk, hs_ssp_clk, hisn_ssp_clk, lp_ssp_clk, 1'b0); mux8 mux_ssp_clk (major_mode, ssp_clk, lr_ssp_clk, ls_ssp_clk, ht_ssp_clk, hrxc_ssp_clk, hs_ssp_clk, hisn_ssp_clk, lp_ssp_clk, 1'b0);
mux8 mux_ssp_din (major_mode, ssp_din, lr_ssp_din, ls_ssp_din, ht_ssp_din, hrxc_ssp_din, hs_ssp_din, hisn_ssp_din, lp_ssp_din, 1'b0); mux8 mux_ssp_din (major_mode, ssp_din, lr_ssp_din, ls_ssp_din, ht_ssp_din, hrxc_ssp_din, hs_ssp_din, hisn_ssp_din, lp_ssp_din, 1'b0);
mux8 mux_ssp_frame (major_mode, ssp_frame, lr_ssp_frame, ls_ssp_frame, ht_ssp_frame, hrxc_ssp_frame, hs_ssp_frame, hisn_ssp_frame, lp_ssp_frame, 1'b0); mux8 mux_ssp_frame (major_mode, ssp_frame, lr_ssp_frame, ls_ssp_frame, ht_ssp_frame, hrxc_ssp_frame, hs_ssp_frame, hisn_ssp_frame, lp_ssp_frame, 1'b0);
mux8 mux_pwr_oe1 (major_mode, pwr_oe1, lr_pwr_oe1, ls_pwr_oe1, ht_pwr_oe1, hrxc_pwr_oe1, hs_pwr_oe1, hisn_pwr_oe1, lp_pwr_oe1, 1'b0); mux8 mux_pwr_oe1 (major_mode, pwr_oe1, lr_pwr_oe1, ls_pwr_oe1, ht_pwr_oe1, hrxc_pwr_oe1, hs_pwr_oe1, hisn_pwr_oe1, lp_pwr_oe1, 1'b0);
mux8 mux_pwr_oe2 (major_mode, pwr_oe2, lr_pwr_oe2, ls_pwr_oe2, ht_pwr_oe2, hrxc_pwr_oe2, hs_pwr_oe2, hisn_pwr_oe2, lp_pwr_oe2, 1'b0); mux8 mux_pwr_oe2 (major_mode, pwr_oe2, lr_pwr_oe2, ls_pwr_oe2, ht_pwr_oe2, hrxc_pwr_oe2, hs_pwr_oe2, hisn_pwr_oe2, lp_pwr_oe2, 1'b0);
mux8 mux_pwr_oe3 (major_mode, pwr_oe3, lr_pwr_oe3, ls_pwr_oe3, ht_pwr_oe3, hrxc_pwr_oe3, hs_pwr_oe3, hisn_pwr_oe3, lp_pwr_oe3, 1'b0); mux8 mux_pwr_oe3 (major_mode, pwr_oe3, lr_pwr_oe3, ls_pwr_oe3, ht_pwr_oe3, hrxc_pwr_oe3, hs_pwr_oe3, hisn_pwr_oe3, lp_pwr_oe3, 1'b0);
@ -210,7 +212,7 @@ mux8 mux_pwr_oe4 (major_mode, pwr_oe4, lr_pwr_oe4, ls_pwr_oe4, ht_pwr_oe4
mux8 mux_pwr_lo (major_mode, pwr_lo, lr_pwr_lo, ls_pwr_lo, ht_pwr_lo, hrxc_pwr_lo, hs_pwr_lo, hisn_pwr_lo, lp_pwr_lo, 1'b0); mux8 mux_pwr_lo (major_mode, pwr_lo, lr_pwr_lo, ls_pwr_lo, ht_pwr_lo, hrxc_pwr_lo, hs_pwr_lo, hisn_pwr_lo, lp_pwr_lo, 1'b0);
mux8 mux_pwr_hi (major_mode, pwr_hi, lr_pwr_hi, ls_pwr_hi, ht_pwr_hi, hrxc_pwr_hi, hs_pwr_hi, hisn_pwr_hi, lp_pwr_hi, 1'b0); mux8 mux_pwr_hi (major_mode, pwr_hi, lr_pwr_hi, ls_pwr_hi, ht_pwr_hi, hrxc_pwr_hi, hs_pwr_hi, hisn_pwr_hi, lp_pwr_hi, 1'b0);
mux8 mux_adc_clk (major_mode, adc_clk, lr_adc_clk, ls_adc_clk, ht_adc_clk, hrxc_adc_clk, hs_adc_clk, hisn_adc_clk, lp_adc_clk, 1'b0); mux8 mux_adc_clk (major_mode, adc_clk, lr_adc_clk, ls_adc_clk, ht_adc_clk, hrxc_adc_clk, hs_adc_clk, hisn_adc_clk, lp_adc_clk, 1'b0);
mux8 mux_dbg (major_mode, dbg, lr_dbg, ls_dbg, ht_dbg, hrxc_dbg, hs_dbg, hisn_dbg, lp_dbg, 1'b0); mux8 mux_dbg (major_mode, dbg, lr_dbg, ls_dbg, ht_dbg, hrxc_dbg, hs_dbg, hisn_dbg, lp_dbg, 1'b0);
// In all modes, let the ADC's outputs be enabled. // In all modes, let the ADC's outputs be enabled.
assign adc_noe = 1'b0; assign adc_noe = 1'b0;

251
fpga/hi_iso14443a.v
View file

@ -39,8 +39,8 @@ reg [2:0] deep_counter;
reg deep_modulation; reg deep_modulation;
always @(negedge adc_clk) always @(negedge adc_clk)
begin begin
if(& adc_d[7:6]) after_hysteresis <= 1'b1; if(& adc_d[7:6]) after_hysteresis <= 1'b1; // if adc_d >= 196
else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0; else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0; // if adc_d <= 15
if(~(| adc_d[7:0])) if(~(| adc_d[7:0]))
begin begin
@ -83,20 +83,34 @@ reg [5:0] negedge_cnt;
reg bit1, bit2, bit3; reg bit1, bit2, bit3;
reg [3:0] count_ones; reg [3:0] count_ones;
reg [3:0] count_zeros; reg [3:0] count_zeros;
wire [7:0] avg; // wire [7:0] avg;
reg [7:0] lavg; // reg [7:0] lavg;
reg signed [12:0] step1; // reg signed [12:0] step1;
reg signed [12:0] step2; // reg signed [12:0] step2;
reg [7:0] stepsize; // reg [7:0] stepsize;
reg [7:0] rx_mod_edge_threshold;
reg curbit; reg curbit;
reg [12:0] average; // reg [12:0] average;
wire signed [9:0] dif; // wire signed [9:0] dif;
// storage for two previous samples:
reg [7:0] adc_d_1;
reg [7:0] adc_d_2;
reg [7:0] adc_d_3;
reg [7:0] adc_d_4;
// the filtered signal (filter performs noise reduction and edge detection)
// (gaussian derivative)
wire signed [10:0] adc_d_filtered;
assign adc_d_filtered = (adc_d_4 << 1) + adc_d_3 - adc_d_1 - (adc_d << 1);
// Registers to store steepest edges detected:
reg [7:0] rx_mod_falling_edge_max;
reg [7:0] rx_mod_rising_edge_max;
// A register to send the results to the arm // A register to send the results to the arm
reg signed [7:0] to_arm; reg signed [7:0] to_arm;
assign avg[7:0] = average[11:4];
assign dif = lavg - avg;
reg bit_to_arm; reg bit_to_arm;
reg fdt_indicator, fdt_elapsed; reg fdt_indicator, fdt_elapsed;
@ -115,36 +129,67 @@ reg [2:0] ssp_frame_counter;
// ADC data appears on the rising edge, so sample it on the falling edge // ADC data appears on the rising edge, so sample it on the falling edge
always @(negedge adc_clk) always @(negedge adc_clk)
begin begin
// ------------------------------------------------------------------------------------------------------------------------------------------------------------------
// last bit = 0 then fdt = 1172, in case of 0x26 (7-bit command, LSB first!) // relevant for TAGSIM_MOD only. Timing of Tag's answer to a command received from a reader
// last bit = 1 then fdt = 1236, in case of 0x52 (7-bit command, LSB first!) // ISO14443-3 specifies:
if(fdt_counter == 11'd740) fdt_indicator = 1'b1; // fdt = 1172, if last bit was 0.
// fdt = 1236, if last bit was 1.
// the FPGA takes care for the 1172 delay. To achieve the additional 1236-1172=64 ticks delay, the ARM must send an additional correction bit (before the start bit).
// The correction bit will be coded as 00010000, i.e. it adds 4 bits to the transmission stream, causing the required delay.
if(fdt_counter == 11'd740) fdt_indicator = 1'b1; // fdt_indicator is true for 740 <= fdt_counter <= 1148. Ready to buffer data. (?)
// Shouldn' this be 1236 - 720 = 516? (The mod_sig_buf can buffer 46 data bits,
// i.e. a maximum delay of 46 * 16 = 720 adc_clk ticks)
if(fdt_counter == 11'd1148) if(fdt_counter == 11'd1148) // additional 16 (+ eventual n*128) adc_clk_ticks delay will be added by the mod_sig_buf below
// the remaining 8 ticks delay comes from the 8 ticks timing difference between reseting fdt_counter and the mod_sig_buf clock.
begin begin
if(fdt_elapsed) if(fdt_elapsed)
begin begin
if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig; if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig; // start modulating (if mod_sig is already set)
end end
else else
begin begin
mod_sig_flip[3:0] <= negedge_cnt[3:0]; mod_sig_flip[3:0] <= negedge_cnt[3:0]; // exact timing of modulation
mod_sig_coil <= mod_sig; mod_sig_coil <= mod_sig; // modulate (if mod_sig is already set)
fdt_elapsed = 1'b1; fdt_elapsed = 1'b1;
fdt_indicator = 1'b0; fdt_indicator = 1'b0;
if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001; if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001; // didn't receive a 1 yet. Delay next 1 by n*128 ticks.
else temp_buffer_reset = 1'b1; // fix position of the buffer pointer else temp_buffer_reset = 1'b1; // else fix the buffer size at current position
end end
end end
else else
begin begin
fdt_counter <= fdt_counter + 1; fdt_counter <= fdt_counter + 1; // Count until 1148
end end
if(& negedge_cnt[3:0])
//-------------------------------------------------------------------------------------------------------------------------------------------
// Relevant for READER_LISTEN only
// look for steepest falling and rising edges:
if (adc_d_filtered > 0)
begin
if (adc_d_filtered > rx_mod_falling_edge_max)
rx_mod_falling_edge_max <= adc_d_filtered;
end
else
begin
if (-adc_d_filtered > rx_mod_rising_edge_max)
rx_mod_rising_edge_max <= -adc_d_filtered;
end
// store previous samples for filtering and edge detection:
adc_d_4 <= adc_d_3;
adc_d_3 <= adc_d_2;
adc_d_2 <= adc_d_1;
adc_d_1 <= adc_d;
if(& negedge_cnt[3:0]) // == 0xf == 15
begin begin
// When there is a dip in the signal and not in reader mode // Relevant for TAGSIM_MOD only (timing Tag's answer. See above)
// When there is a dip in the signal and not in (READER_MOD, READER_LISTEN, TAGSIM_MOD)
if(~after_hysteresis && mod_sig_buf_empty && ~((mod_type == 3'b100) || (mod_type == 3'b011) || (mod_type == 3'b010))) // last condition to prevent reset if(~after_hysteresis && mod_sig_buf_empty && ~((mod_type == 3'b100) || (mod_type == 3'b011) || (mod_type == 3'b010))) // last condition to prevent reset
begin begin
fdt_counter <= 11'd0; fdt_counter <= 11'd0;
@ -154,74 +199,33 @@ begin
mod_sig_ptr <= 6'b000000; mod_sig_ptr <= 6'b000000;
end end
lavg <= avg; // Relevant for READER_LISTEN only
// detect modulation signal: if modulating, there must be a falling and a rising edge ... and vice versa
if(stepsize<16) stepsize = 8'd16; if (rx_mod_falling_edge_max > 6 && rx_mod_rising_edge_max > 6)
curbit = 1'b1; // modulation
if(dif>0)
begin
step1 = dif*3;
step2 = stepsize*2; // 3:2
if(step1>step2)
begin
curbit = 1'b0;
stepsize = dif;
end
end
else
begin
step1 = dif*3;
step1 = -step1;
step2 = stepsize*2;
if(step1>step2)
begin
curbit = 1'b1;
stepsize = -dif;
end
end
if(curbit)
begin
count_zeros <= 4'd0;
if(& count_ones[3:2])
begin
curbit = 1'b0; // suppressed signal
stepsize = 8'd24; // just a fine number
end
else else
begin curbit = 1'b0; // no modulation
count_ones <= count_ones + 1;
end // prepare next edge detection:
end rx_mod_rising_edge_max <= 0;
else rx_mod_falling_edge_max <= 0;
begin
count_ones <= 4'd0;
if(& count_zeros[3:0])
begin
stepsize = 8'd24;
end
else
begin
count_zeros <= count_zeros + 1;
end
end
// What do we communicate to the ARM // What do we communicate to the ARM
if(mod_type == 3'b001) sendbit = after_hysteresis; if(mod_type == 3'b001) sendbit = after_hysteresis; // TAGSIM_LISTEN
else if(mod_type == 3'b010) else if(mod_type == 3'b010) // TAGSIM_MOD
begin begin
if(fdt_counter > 11'd772) sendbit = mod_sig_coil; if(fdt_counter > 11'd772) sendbit = mod_sig_coil;
else sendbit = fdt_indicator; else sendbit = fdt_indicator;
end end
else if(mod_type == 3'b011) sendbit = curbit; else if(mod_type == 3'b011) sendbit = curbit; // READER_LISTEN
else sendbit = 1'b0; else sendbit = 1'b0; // READER_MOD, SNIFFER
end end
if(~(| negedge_cnt[3:0])) average <= adc_d; //------------------------------------------------------------------------------------------------------------------------------------------
else average <= average + adc_d; // Relevant for SNIFFER mode only. Prepare communication to ARM.
if(negedge_cnt == 7'd63)
if(negedge_cnt == 7'd63)
begin begin
if(deep_modulation) if(deep_modulation)
begin begin
@ -234,7 +238,7 @@ begin
negedge_cnt <= 0; negedge_cnt <= 0;
end end
else else
begin begin
negedge_cnt <= negedge_cnt + 1; negedge_cnt <= negedge_cnt + 1;
@ -256,35 +260,48 @@ begin
bit3 <= curbit; bit3 <= curbit;
end end
//--------------------------------------------------------------------------------------------------------------------------------------------------------------
if(mod_type != 3'b000) // Relevant in TAGSIM_MOD only. Delay-Line to buffer data and send it at the correct time
// Note: Data in READER_MOD is fed through this delay line as well.
if(mod_type != 3'b000) // != SNIFFER
begin begin
if(negedge_cnt[3:0] == 4'b1000) if(negedge_cnt[3:0] == 4'b1000) // == 0x8
begin begin
// The modulation signal of the tag // The modulation signal of the tag. The delay line is only relevant for TAGSIM_MOD, but used in other modes as well.
mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0}; // Note: this means that even in READER_MOD, there will be an arbitrary delay depending on the time of a previous reset of fdt_counter and the time and
if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed) // content of the next bit to be transmitted.
if(mod_sig_ptr == 6'b101110) mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0}; // shift in new data starting at mod_sig_buf[1]. mod_sig_buf[0] = 0 always.
if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed) // buffer a 1 (and all subsequent data) until fdt_counter = 1148 adc_clk ticks.
if(mod_sig_ptr == 6'b101110) // buffer overflow at 46 - this would mean data loss
begin begin
mod_sig_ptr <= 6'b000000; mod_sig_ptr <= 6'b000000;
end end
else mod_sig_ptr <= mod_sig_ptr + 1; else mod_sig_ptr <= mod_sig_ptr + 1; // increase buffer (= increase delay by 16 adc_clk ticks). ptr always points to first 1.
else if(fdt_elapsed && ~temp_buffer_reset) else if(fdt_elapsed && ~temp_buffer_reset)
// fdt_elapsed. If we didn't receive a 1 yet, ptr will be at 9 and not yet fixed. Otherwise temp_buffer_reset will be 1 already.
begin begin
if(ssp_dout) temp_buffer_reset = 1'b1; // wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen
if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001; // at intervals of 8 * 16 = 128 adc_clk ticks intervals (as defined in ISO14443-3)
else mod_sig_ptr <= mod_sig_ptr - 1; if(ssp_dout) temp_buffer_reset = 1'b1;
if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001; // still nothing received, need to go for the next interval
else mod_sig_ptr <= mod_sig_ptr - 1; // decrease buffer.
end end
else else
// mod_sig_ptr and therefore the delay is now fixed until fdt_counter is reset (this can happen in SNIFFER and TAGSIM_LISTEN mode only. Note that SNIFFER
// mode (3'b000) is the default and is active in FPGA_MAJOR_MODE_OFF if no other minor mode is explicitly requested.
begin begin
// side effect: when ptr = 1 it will cancel the first 1 of every block of ones // don't modulate with the correction bit (which is sent as 00010000, all other bits will come with at least 2 consecutive 1s)
// side effect: when ptr = 1 it will cancel the first 1 of every block of ones. Note: this would only be the case if we received a 1 just before fdt_elapsed.
if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0; if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0;
else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed; // & fdt_elapsed was for direct relay to oe4 // finally, do the modulation:
else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed;
end end
end end
end end
// SSP Clock and data //-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
// Communication to ARM (SSP Clock and data)
// SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)):
if(mod_type == 3'b000) if(mod_type == 3'b000)
begin begin
if(negedge_cnt[2:0] == 3'b100) if(negedge_cnt[2:0] == 3'b100)
@ -308,6 +325,9 @@ begin
bit_to_arm = to_arm[7]; bit_to_arm = to_arm[7];
end end
else else
//-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
// Communication to ARM (SSP Clock and data)
// all other modes (ssp_clk = adc_clk / 16, ssp_frame clock = adc_clk / 128):
begin begin
if(negedge_cnt[3:0] == 4'b1000) ssp_clk <= 1'b0; if(negedge_cnt[3:0] == 4'b1000) ssp_clk <= 1'b0;
@ -331,30 +351,29 @@ end
assign ssp_din = bit_to_arm; assign ssp_din = bit_to_arm;
// Modulating carrier frequency is fc/16
// Modulating carrier (adc_clk/16, for TAGSIM_MOD only). Will be 0 for other modes.
wire modulating_carrier; wire modulating_carrier;
assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010)); assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010)); // in TAGSIM_MOD only. Otherwise always 0.
assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011)));
// This one is all LF, so doesn't matter // for READER_MOD only: drop carrier for mod_sig_coil==1 (pause), READER_LISTEN: carrier always on, others: carrier always off
//assign pwr_oe2 = modulating_carrier; assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011)));
assign pwr_oe2 = 1'b0;
// Toggle only one of these, since we are already producing much deeper
// modulation than a real tag would. // Enable HF antenna drivers:
//assign pwr_oe1 = modulating_carrier;
assign pwr_oe1 = 1'b0; assign pwr_oe1 = 1'b0;
assign pwr_oe4 = modulating_carrier;
//assign pwr_oe4 = 1'b0;
// This one is always on, so that we can watch the carrier.
//assign pwr_oe3 = modulating_carrier;
assign pwr_oe3 = 1'b0; assign pwr_oe3 = 1'b0;
// TAGSIM_MOD: short circuit antenna with different resistances (modulated by modulating_carrier)
// for pwr_oe4 = 1 (tristate): antenna load = 10k || 33 = 32,9 Ohms
// for pwr_oe4 = 0 (active): antenna load = 10k || 33 || 33 = 16,5 Ohms
assign pwr_oe4 = modulating_carrier;
// This is all LF, so doesn't matter.
assign pwr_oe2 = 1'b0;
assign pwr_lo = 1'b0;
assign dbg = negedge_cnt[3]; assign dbg = negedge_cnt[3];
// Unused.
assign pwr_lo = 1'b0;
endmodule endmodule

2
fpga/xst.scr
View file

@ -1 +1 @@
run -ifn fpga.v -ifmt Verilog -ofn fpga.ngc -ofmt NGC -p xc2s30-6vq100 -opt_mode Speed -opt_level 1 -ent fpga run -ifn fpga.v -ifmt Verilog -ofn fpga.ngc -ofmt NGC -p xc2s30-5-vq100 -opt_mode Speed -opt_level 1 -ent fpga