mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-09-20 15:26:13 +08:00
Merge branch 'master' of https://github.com/Proxmark/proxmark3
Conflicts: armsrc/Makefile armsrc/iso14443b.c armsrc/lfops.c client/cmdhf14b.c client/cmdhfmfu.c fpga/fpga_hf.bit fpga/hi_read_rx_xcorr.v
This commit is contained in:
iceman1001
commit
f53020e729
28
armsrc/epa.c
28
armsrc/epa.c
|
|
@ -127,7 +127,7 @@ size_t EPA_Parse_CardAccess(uint8_t *data,
|
|||
pace_version_info_t *pace_info)
|
||||
{
|
||||
size_t index = 0;
|
||||
|
||||
|
||||
while (index <= length - 2) {
|
||||
// determine type of element
|
||||
// SET or SEQUENCE
|
||||
|
|
@ -184,7 +184,7 @@ size_t EPA_Parse_CardAccess(uint8_t *data,
|
|||
index += 2 + data[index + 1];
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// TODO: We should check whether we reached the end in error, but for that
|
||||
// we need a better parser (e.g. with states like IN_SET or IN_PACE_INFO)
|
||||
return 0;
|
||||
|
|
@ -202,7 +202,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
|
|||
// we reserve 262 bytes here just to be safe (256-byte APDU + SW + ISO frame)
|
||||
uint8_t response_apdu[262];
|
||||
int rapdu_length = 0;
|
||||
|
||||
|
||||
// select the file EF.CardAccess
|
||||
rapdu_length = iso14_apdu((uint8_t *)apdu_select_binary_cardaccess,
|
||||
sizeof(apdu_select_binary_cardaccess),
|
||||
|
|
@ -214,7 +214,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
|
|||
Dbprintf("epa - no select cardaccess");
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
// read the file
|
||||
rapdu_length = iso14_apdu((uint8_t *)apdu_read_binary,
|
||||
sizeof(apdu_read_binary),
|
||||
|
|
@ -226,7 +226,7 @@ int EPA_Read_CardAccess(uint8_t *buffer, size_t max_length)
|
|||
Dbprintf("epa - no read cardaccess");
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
// copy the content into the buffer
|
||||
// length of data available: apdu_length - 4 (ISO frame) - 2 (SW)
|
||||
size_t to_copy = rapdu_length - 6;
|
||||
|
|
@ -243,7 +243,7 @@ static void EPA_PACE_Collect_Nonce_Abort(uint8_t step, int func_return)
|
|||
{
|
||||
// power down the field
|
||||
EPA_Finish();
|
||||
|
||||
|
||||
// send the USB packet
|
||||
cmd_send(CMD_ACK,step,func_return,0,0,0);
|
||||
}
|
||||
|
|
@ -294,11 +294,11 @@ void EPA_PACE_Collect_Nonce(UsbCommand *c)
|
|||
EPA_PACE_Collect_Nonce_Abort(3, func_return);
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
// initiate the PACE protocol
|
||||
// use the CAN for the password since that doesn't change
|
||||
func_return = EPA_PACE_MSE_Set_AT(pace_version_info, 2);
|
||||
|
||||
|
||||
// now get the nonce
|
||||
uint8_t nonce[256] = {0};
|
||||
uint8_t requested_size = (uint8_t)c->arg[0];
|
||||
|
|
@ -309,10 +309,10 @@ void EPA_PACE_Collect_Nonce(UsbCommand *c)
|
|||
EPA_PACE_Collect_Nonce_Abort(4, func_return);
|
||||
return;
|
||||
}
|
||||
|
||||
// all done, return
|
||||
|
||||
// all done, return
|
||||
EPA_Finish();
|
||||
|
||||
|
||||
// save received information
|
||||
cmd_send(CMD_ACK,0,func_return,0,nonce,func_return);
|
||||
}
|
||||
|
|
@ -335,7 +335,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
|
|||
sizeof(apdu_general_authenticate_pace_get_nonce));
|
||||
// append Le (requested length + 2 due to tag/length taking 2 bytes) in RAPDU
|
||||
apdu[sizeof(apdu_general_authenticate_pace_get_nonce)] = requested_length + 4;
|
||||
|
||||
|
||||
// send it
|
||||
uint8_t response_apdu[262];
|
||||
int send_return = iso14_apdu(apdu,
|
||||
|
|
@ -348,7 +348,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
|
|||
{
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
// if there is no nonce in the RAPDU, return here
|
||||
if (send_return < 10)
|
||||
{
|
||||
|
|
@ -363,7 +363,7 @@ int EPA_PACE_Get_Nonce(uint8_t requested_length, uint8_t *nonce)
|
|||
}
|
||||
// copy the nonce
|
||||
memcpy(nonce, response_apdu + 6, nonce_length);
|
||||
|
||||
|
||||
return nonce_length;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@
|
|||
#include "iso14443crc.h"
|
||||
|
||||
#define RECEIVE_SAMPLES_TIMEOUT 2000
|
||||
#define ISO14443B_DMA_BUFFER_SIZE 256
|
||||
|
||||
//=============================================================================
|
||||
// An ISO 14443 Type B tag. We listen for commands from the reader, using
|
||||
|
|
@ -234,7 +235,7 @@ static RAMFUNC int Handle14443bUartBit(uint8_t bit)
|
|||
Uart.posCnt = 0;
|
||||
Uart.state = STATE_AWAITING_START_BIT;
|
||||
}
|
||||
} else if(Uart.shiftReg == 0x000) {
|
||||
} else if (Uart.shiftReg == 0x000) {
|
||||
// this is an EOF byte
|
||||
LED_A_OFF(); // Finished receiving
|
||||
Uart.state = STATE_UNSYNCD;
|
||||
|
|
@ -244,7 +245,7 @@ static RAMFUNC int Handle14443bUartBit(uint8_t bit)
|
|||
} else {
|
||||
// this is an error
|
||||
LED_A_OFF();
|
||||
Uart.state = STATE_UNSYNCD;
|
||||
Uart.state = STATE_UNSYNCD;
|
||||
}
|
||||
}
|
||||
break;
|
||||
|
|
@ -486,8 +487,8 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
|
|||
{
|
||||
int v;
|
||||
|
||||
// The soft decision on the bit uses an estimate of just the
|
||||
// quadrant of the reference angle, not the exact angle.
|
||||
// The soft decision on the bit uses an estimate of just the
|
||||
// quadrant of the reference angle, not the exact angle.
|
||||
#define MAKE_SOFT_DECISION() { \
|
||||
if(Demod.sumI > 0) { \
|
||||
v = ci; \
|
||||
|
|
@ -717,16 +718,16 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
|
|||
uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
|
||||
|
||||
// The DMA buffer, used to stream samples from the FPGA
|
||||
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
|
||||
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
|
||||
|
||||
// Set up the demodulator for tag -> reader responses.
|
||||
DemodInit(receivedResponse);
|
||||
|
||||
// Setup and start DMA.
|
||||
FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
|
||||
FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
|
||||
|
||||
int8_t *upTo = dmaBuf;
|
||||
lastRxCounter = DMA_BUFFER_SIZE;
|
||||
lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
|
||||
|
||||
// Signal field is ON with the appropriate LED:
|
||||
LED_D_ON();
|
||||
|
|
@ -737,25 +738,25 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
|
|||
int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
|
||||
if(behindBy > max) max = behindBy;
|
||||
|
||||
while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1)) > 2) {
|
||||
while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
|
||||
ci = upTo[0];
|
||||
cq = upTo[1];
|
||||
upTo += 2;
|
||||
if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
|
||||
if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
|
||||
upTo = dmaBuf;
|
||||
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
|
||||
AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
|
||||
AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
|
||||
}
|
||||
lastRxCounter -= 2;
|
||||
if(lastRxCounter <= 0) {
|
||||
lastRxCounter += DMA_BUFFER_SIZE;
|
||||
lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
|
||||
}
|
||||
|
||||
samples += 2;
|
||||
|
||||
if(Handle14443bSamplesDemod(ci, cq)) {
|
||||
gotFrame = TRUE;
|
||||
break;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -770,7 +771,6 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
|
|||
//Tracing
|
||||
if (tracing && Demod.len > 0) {
|
||||
uint8_t parity[MAX_PARITY_SIZE];
|
||||
//GetParity(Demod.output, Demod.len, parity);
|
||||
LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
|
||||
}
|
||||
}
|
||||
|
|
@ -892,7 +892,6 @@ static void CodeAndTransmit14443bAsReader(const uint8_t *cmd, int len)
|
|||
TransmitFor14443b();
|
||||
if (tracing) {
|
||||
uint8_t parity[MAX_PARITY_SIZE];
|
||||
GetParity(cmd, len, parity);
|
||||
LogTrace(cmd,len, 0, 0, parity, TRUE);
|
||||
}
|
||||
}
|
||||
|
|
@ -931,30 +930,25 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
SpinDelay(200);
|
||||
|
||||
// First command: wake up the tag using the INITIATE command
|
||||
uint8_t cmd1[] = { 0x06, 0x00, 0x97, 0x5b};
|
||||
|
||||
uint8_t cmd1[] = {0x06, 0x00, 0x97, 0x5b};
|
||||
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
|
||||
// LED_A_ON();
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
|
||||
// LED_A_OFF();
|
||||
|
||||
if (Demod.len == 0) {
|
||||
DbpString("No response from tag");
|
||||
return;
|
||||
} else {
|
||||
Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %02x %02x %02x",
|
||||
Demod.output[0], Demod.output[1],Demod.output[2]);
|
||||
Dbprintf("Randomly generated Chip ID (+ 2 byte CRC): %02x %02x %02x",
|
||||
Demod.output[0], Demod.output[1], Demod.output[2]);
|
||||
}
|
||||
|
||||
// There is a response, SELECT the uid
|
||||
DbpString("Now SELECT tag:");
|
||||
cmd1[0] = 0x0E; // 0x0E is SELECT
|
||||
cmd1[1] = Demod.output[0];
|
||||
ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
|
||||
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
|
||||
|
||||
// LED_A_ON();
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
|
||||
// LED_A_OFF();
|
||||
if (Demod.len != 3) {
|
||||
Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
|
||||
return;
|
||||
|
|
@ -970,34 +964,30 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
|
||||
return;
|
||||
}
|
||||
|
||||
// Tag is now selected,
|
||||
// First get the tag's UID:
|
||||
cmd1[0] = 0x0B;
|
||||
ComputeCrc14443(CRC_14443_B, cmd1, 1 , &cmd1[1], &cmd1[2]);
|
||||
CodeAndTransmit14443bAsReader(cmd1, 3); // Only first three bytes for this one
|
||||
|
||||
// LED_A_ON();
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
|
||||
// LED_A_OFF();
|
||||
if (Demod.len != 10) {
|
||||
Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
|
||||
return;
|
||||
}
|
||||
// The check the CRC of the answer (use cmd1 as temporary variable):
|
||||
ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
|
||||
if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
|
||||
if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
|
||||
Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
|
||||
(cmd1[2]<<8)+cmd1[3],
|
||||
(Demod.output[8]<<8)+Demod.output[9]
|
||||
);
|
||||
(cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
|
||||
// Do not return;, let's go on... (we should retry, maybe ?)
|
||||
}
|
||||
Dbprintf("Tag UID (64 bits): %08x %08x",
|
||||
(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
|
||||
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
|
||||
(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
|
||||
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
|
||||
|
||||
// Now loop to read all 16 blocks, address from 0 to last block
|
||||
Dbprintf("Tag memory dump, block 0 to %d",dwLast);
|
||||
Dbprintf("Tag memory dump, block 0 to %d", dwLast);
|
||||
cmd1[0] = 0x08;
|
||||
i = 0x00;
|
||||
dwLast++;
|
||||
|
|
@ -1009,10 +999,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
cmd1[1] = i;
|
||||
ComputeCrc14443(CRC_14443_B, cmd1, 2, &cmd1[2], &cmd1[3]);
|
||||
CodeAndTransmit14443bAsReader(cmd1, sizeof(cmd1));
|
||||
|
||||
// LED_A_ON();
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
|
||||
// LED_A_OFF();
|
||||
if (Demod.len != 6) { // Check if we got an answer from the tag
|
||||
DbpString("Expected 6 bytes from tag, got less...");
|
||||
return;
|
||||
|
|
@ -1020,15 +1007,13 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
// The check the CRC of the answer (use cmd1 as temporary variable):
|
||||
ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
|
||||
if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
|
||||
Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
|
||||
(cmd1[2]<<8)+cmd1[3],
|
||||
(Demod.output[4]<<8)+Demod.output[5]
|
||||
);
|
||||
Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
|
||||
(cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
|
||||
// Do not return;, let's go on... (we should retry, maybe ?)
|
||||
}
|
||||
// Now print out the memory location:
|
||||
Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
|
||||
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
|
||||
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
|
||||
(Demod.output[4]<<8)+Demod.output[5]
|
||||
);
|
||||
if (i == 0xff) break;
|
||||
|
|
@ -1051,7 +1036,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
|
|||
* Memory usage for this function, (within BigBuf)
|
||||
* Last Received command (reader->tag) - MAX_FRAME_SIZE
|
||||
* Last Received command (tag->reader) - MAX_FRAME_SIZE
|
||||
* DMA Buffer - DMA_BUFFER_SIZE
|
||||
* DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
|
||||
* Demodulated samples received - all the rest
|
||||
*/
|
||||
void RAMFUNC SnoopIso14443b(void)
|
||||
|
|
@ -1068,7 +1053,7 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
set_tracing(TRUE);
|
||||
|
||||
// The DMA buffer, used to stream samples from the FPGA
|
||||
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
|
||||
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
|
||||
int lastRxCounter;
|
||||
int8_t *upTo;
|
||||
int ci, cq;
|
||||
|
|
@ -1086,7 +1071,7 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
|
||||
Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
|
||||
Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
|
||||
Dbprintf(" DMA: %i bytes", DMA_BUFFER_SIZE);
|
||||
Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
|
||||
|
||||
// Signal field is off, no reader signal, no tag signal
|
||||
LEDsoff();
|
||||
|
|
@ -1098,9 +1083,12 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
// Setup for the DMA.
|
||||
FpgaSetupSsc();
|
||||
upTo = dmaBuf;
|
||||
lastRxCounter = DMA_BUFFER_SIZE;
|
||||
FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
|
||||
lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
|
||||
FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
|
||||
uint8_t parity[MAX_PARITY_SIZE];
|
||||
|
||||
bool TagIsActive = FALSE;
|
||||
bool ReaderIsActive = FALSE;
|
||||
|
||||
bool TagIsActive = FALSE;
|
||||
bool ReaderIsActive = FALSE;
|
||||
|
|
@ -1108,7 +1096,7 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
// And now we loop, receiving samples.
|
||||
for(;;) {
|
||||
int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
|
||||
(DMA_BUFFER_SIZE-1);
|
||||
(ISO14443B_DMA_BUFFER_SIZE-1);
|
||||
if(behindBy > maxBehindBy) {
|
||||
maxBehindBy = behindBy;
|
||||
}
|
||||
|
|
@ -1119,11 +1107,15 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
cq = upTo[1];
|
||||
upTo += 2;
|
||||
lastRxCounter -= 2;
|
||||
if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
|
||||
if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
|
||||
upTo = dmaBuf;
|
||||
lastRxCounter += DMA_BUFFER_SIZE;
|
||||
lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
|
||||
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
|
||||
AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
|
||||
AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
|
||||
WDT_HIT();
|
||||
if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
|
||||
Dbprintf("blew circular buffer! behindBy=%d", behindBy);
|
||||
break;
|
||||
WDT_HIT();
|
||||
if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
|
||||
Dbprintf("blew circular buffer! behindBy=%d", behindBy);
|
||||
|
|
@ -1144,8 +1136,7 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
|
||||
if(Handle14443bUartBit(ci & 0x01)) {
|
||||
if(triggered && tracing) {
|
||||
//GetParity(Uart.output, Uart.byteCnt, parity);
|
||||
LogTrace(Uart.output,Uart.byteCnt,samples, samples,parity,TRUE);
|
||||
LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
|
||||
}
|
||||
/* And ready to receive another command. */
|
||||
UartReset();
|
||||
|
|
@ -1155,8 +1146,7 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
}
|
||||
if(Handle14443bUartBit(cq & 0x01)) {
|
||||
if(triggered && tracing) {
|
||||
//GetParity(Uart.output, Uart.byteCnt, parity);
|
||||
LogTrace(Uart.output,Uart.byteCnt,samples, samples, parity, TRUE);
|
||||
LogTrace(Uart.output, Uart.byteCnt, samples, samples, parity, TRUE);
|
||||
}
|
||||
/* And ready to receive another command. */
|
||||
UartReset();
|
||||
|
|
@ -1174,8 +1164,7 @@ void RAMFUNC SnoopIso14443b(void)
|
|||
if(tracing)
|
||||
{
|
||||
uint8_t parity[MAX_PARITY_SIZE];
|
||||
//GetParity(Demod.output, Demod.len, parity);
|
||||
LogTrace(Demod.output, Demod.len,samples, samples, parity, FALSE);
|
||||
LogTrace(Demod.output, Demod.len, samples, samples, parity, FALSE);
|
||||
}
|
||||
triggered = TRUE;
|
||||
|
||||
|
|
@ -1217,30 +1206,14 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u
|
|||
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
|
||||
FpgaSetupSsc();
|
||||
|
||||
set_tracing(TRUE);
|
||||
set_tracing(TRUE);
|
||||
|
||||
/* if(!powerfield) {
|
||||
// Make sure that we start from off, since the tags are stateful;
|
||||
// confusing things will happen if we don't reset them between reads.
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LED_D_OFF();
|
||||
SpinDelay(200);
|
||||
}
|
||||
*/
|
||||
|
||||
// if(!GETBIT(GPIO_LED_D)) { // if field is off
|
||||
// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
|
||||
// // Signal field is on with the appropriate LED
|
||||
// LED_D_ON();
|
||||
// SpinDelay(200);
|
||||
// }
|
||||
|
||||
CodeAndTransmit14443bAsReader(data, datalen);
|
||||
|
||||
if(recv) {
|
||||
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
|
||||
uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);
|
||||
cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);
|
||||
uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
|
||||
cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
|
||||
}
|
||||
|
||||
if(!powerfield) {
|
||||
|
|
|
|||
|
|
@ -1043,10 +1043,10 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
|
|||
* To compensate antenna falling times shorten the write times
|
||||
* and enlarge the gap ones.
|
||||
*/
|
||||
#define START_GAP 31*8 // was 250 // SPEC: 8 - 50fc [15fc]
|
||||
#define WRITE_GAP 20*8 // was 160 // SPEC: 8 - 20fc [10fc]
|
||||
#define WRITE_0 18*8 // was 144 // SPEC: 16 - 32fc [24fc] 192
|
||||
#define WRITE_1 50*8 // was 400 // SPEC: 48 - 64fc [56fc] 432 for T55x7; 448 for E5550
|
||||
#define START_GAP 31*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc)
|
||||
#define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc)
|
||||
#define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
|
||||
#define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550
|
||||
|
||||
// VALUES TAKEN FROM EM4x function: SendForward
|
||||
// START_GAP = 440; (55*8) cycles at 125Khz (8us = 1cycle)
|
||||
|
|
|
|||
|
|
@ -1561,7 +1561,7 @@ int PSKDemod(const char *Cmd, bool verbose)
|
|||
}
|
||||
uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
|
||||
size_t BitLen = getFromGraphBuf(BitStream);
|
||||
if (BitLen==0) return -1;
|
||||
if (BitLen==0) return 0;
|
||||
uint8_t carrier=countFC(BitStream, BitLen, 0);
|
||||
if (carrier!=2 && carrier!=4 && carrier!=8){
|
||||
//invalid carrier
|
||||
|
|
|
|||
|
|
@ -35,16 +35,14 @@ int CmdHF14BList(const char *Cmd)
|
|||
|
||||
int CmdHF14BSim(const char *Cmd)
|
||||
{
|
||||
UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
|
||||
clearCommandBuffer();
|
||||
UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
|
||||
SendCommand(&c);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int CmdHF14BSnoop(const char *Cmd)
|
||||
{
|
||||
UsbCommand c = {CMD_SNOOP_ISO_14443B};
|
||||
clearCommandBuffer();
|
||||
UsbCommand c = {CMD_SNOOP_ISO_14443B};
|
||||
SendCommand(&c);
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -246,109 +244,38 @@ char *get_ST_Chip_Model(uint8_t data){
|
|||
case 0xC: sprintf(retStr, "SRT512"); break;
|
||||
default: sprintf(retStr, "Unknown"); break;
|
||||
}
|
||||
return retStr;
|
||||
}
|
||||
|
||||
static void print_st_info(uint8_t *data){
|
||||
//uid = first 8 bytes in data
|
||||
PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
|
||||
PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
|
||||
PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
|
||||
return;
|
||||
}
|
||||
|
||||
int HF14BStdReader(uint8_t *data, uint8_t *datalen){
|
||||
|
||||
//05 00 00 = find one tag in field
|
||||
//1d xx xx xx xx 20 00 08 01 00 = attrib xx=crc
|
||||
//a3 = ? (resp 03 e2 c2)
|
||||
//02 = ? (resp 02 6a d3)
|
||||
// 022b (resp 02 67 00 [29 5b])
|
||||
// 0200a40400 (resp 02 67 00 [29 5b])
|
||||
// 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
|
||||
// 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
|
||||
// 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
|
||||
// 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
|
||||
// 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
|
||||
// 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
|
||||
// 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
|
||||
//03 = ? (resp 03 [e3 c2])
|
||||
//c2 = ? (resp c2 [66 15])
|
||||
//b2 = ? (resp a3 [e9 67])
|
||||
bool crc = true;
|
||||
*datalen = 3;
|
||||
//std read cmd
|
||||
data[0] = 0x05;
|
||||
data[1] = 0x00;
|
||||
data[2] = 0x00;
|
||||
|
||||
if (HF14BCmdRaw(true, &crc, false, data, datalen, false)==0) return 0;
|
||||
|
||||
if (data[0] != 0x50 || *datalen != 14 || !crc) return 0;
|
||||
|
||||
PrintAndLog ("\n14443-3b tag found:");
|
||||
print_atqb_resp(data);
|
||||
|
||||
return 1;
|
||||
|
||||
c.arg[0] = datalen;
|
||||
c.arg[1] = reply;
|
||||
c.arg[2] = power;
|
||||
memcpy(c.d.asBytes,data,datalen);
|
||||
|
||||
SendCommand(&c);
|
||||
|
||||
if (reply) {
|
||||
if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
|
||||
recv = resp.d.asBytes;
|
||||
PrintAndLog("received %i octets",resp.arg[0]);
|
||||
if(resp.arg[0] == 0)
|
||||
return 0;
|
||||
hexout = (char *)malloc(resp.arg[0] * 3 + 1);
|
||||
if (hexout != NULL) {
|
||||
uint8_t first, second;
|
||||
for (int i = 0; i < resp.arg[0]; i++) { // data in hex
|
||||
sprintf(&hexout[i * 3], "%02X ", recv[i]);
|
||||
}
|
||||
|
||||
int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){
|
||||
bool crc = true;
|
||||
*datalen = 2;
|
||||
//wake cmd
|
||||
data[0] = 0x06;
|
||||
data[1] = 0x00;
|
||||
|
||||
//leave power on
|
||||
// verbose on for now for testing - turn off when functional
|
||||
if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
|
||||
|
||||
if (*datalen != 3 || !crc) return rawClose();
|
||||
|
||||
uint8_t chipID = data[0];
|
||||
// select
|
||||
data[0] = 0x0E;
|
||||
data[1] = chipID;
|
||||
*datalen = 2;
|
||||
|
||||
//leave power on
|
||||
// verbose on for now for testing - turn off when functional
|
||||
if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
|
||||
|
||||
if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
|
||||
|
||||
// get uid
|
||||
data[0] = 0x0B;
|
||||
*datalen = 1;
|
||||
|
||||
//power off
|
||||
// verbose on for now for testing - turn off when functional
|
||||
if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0;
|
||||
rawClose();
|
||||
if (*datalen != 10 || !crc) return 0;
|
||||
|
||||
PrintAndLog("\n14443-3b ST tag found:");
|
||||
print_st_info(data);
|
||||
return 1;
|
||||
}
|
||||
|
||||
// test for other 14b type tags (mimic another reader - don't have tags to identify)
|
||||
int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
|
||||
bool crc = true;
|
||||
*datalen = 4;
|
||||
//std read cmd
|
||||
data[0] = 0x00;
|
||||
data[1] = 0x0b;
|
||||
data[2] = 0x3f;
|
||||
data[3] = 0x80;
|
||||
|
||||
if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
|
||||
if (*datalen > 2 || !crc) {
|
||||
PrintAndLog ("\n14443-3b tag found:");
|
||||
PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
|
||||
PrintAndLog ("%s",sprint_hex(data,*datalen));
|
||||
return 1;
|
||||
}
|
||||
PrintAndLog("%s", hexout);
|
||||
free(hexout);
|
||||
if (resp.arg[0] > 2) {
|
||||
ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);
|
||||
if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {
|
||||
PrintAndLog("CRC OK");
|
||||
} else {
|
||||
PrintAndLog("CRC failed");
|
||||
}
|
||||
}
|
||||
} else {
|
||||
PrintAndLog("malloc failed your client has low memory?");
|
||||
}
|
||||
|
||||
crc = false;
|
||||
|
|
@ -474,10 +401,8 @@ static command_t CommandTable[] =
|
|||
{
|
||||
{"help", CmdHelp, 1, "This help"},
|
||||
{"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443b history"},
|
||||
{"reader", CmdHF14BReader, 0, "Find 14b tag (HF ISO 14443b)"},
|
||||
{"sim", CmdHF14BSim, 0, "Fake ISO 14443B tag"},
|
||||
|
||||
{"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443B"},
|
||||
{"sim", CmdHF14BSim, 0, "Fake ISO 14443B tag"},
|
||||
{"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443B"},
|
||||
{"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"},
|
||||
{"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"},
|
||||
{"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
|
||||
|
|
|
|||
|
|
@ -29,9 +29,9 @@ int CmdHFEPACollectPACENonces(const char *Cmd)
|
|||
unsigned int n = 0;
|
||||
// delay between requests
|
||||
unsigned int d = 0;
|
||||
|
||||
|
||||
sscanf(Cmd, "%u %u %u", &m, &n, &d);
|
||||
|
||||
|
||||
// values are expected to be > 0
|
||||
m = m > 0 ? m : 1;
|
||||
n = n > 0 ? n : 1;
|
||||
|
|
@ -44,7 +44,7 @@ int CmdHFEPACollectPACENonces(const char *Cmd)
|
|||
UsbCommand c = {CMD_EPA_PACE_COLLECT_NONCE, {(int)m, 0, 0}};
|
||||
SendCommand(&c);
|
||||
UsbCommand resp;
|
||||
|
||||
|
||||
WaitForResponse(CMD_ACK,&resp);
|
||||
|
||||
// check if command failed
|
||||
|
|
@ -178,7 +178,7 @@ int CmdHFEPAPACEReplay(const char *Cmd)
|
|||
|
||||
// UI-related stuff
|
||||
|
||||
static const command_t CommandTable[] =
|
||||
static const command_t CommandTable[] =
|
||||
{
|
||||
{"help", CmdHelp, 1, "This help"},
|
||||
{"cnonces", CmdHFEPACollectPACENonces, 0,
|
||||
|
|
|
|||
|
|
@ -272,7 +272,7 @@ static int ulev1_readSignature( uint8_t *response, uint16_t responseLength ){
|
|||
// send 300000 + crc (read with extra byte(s))
|
||||
// UL responds with read of page 0, fudan doesn't respond.
|
||||
//
|
||||
//make sure field is off before calling this function
|
||||
// make sure field is off before calling this function
|
||||
static int ul_fudan_check( void ){
|
||||
iso14a_card_select_t card;
|
||||
if ( !ul_select(&card) )
|
||||
|
|
@ -892,7 +892,7 @@ int CmdHF14AMfUWrBl(const char *Cmd){
|
|||
uint8_t data[16] = {0x00};
|
||||
uint8_t authenticationkey[16] = {0x00};
|
||||
uint8_t *authKeyPtr = authenticationkey;
|
||||
|
||||
|
||||
while(param_getchar(Cmd, cmdp) != 0x00)
|
||||
{
|
||||
switch(param_getchar(Cmd, cmdp))
|
||||
|
|
@ -967,7 +967,7 @@ int CmdHF14AMfUWrBl(const char *Cmd){
|
|||
PrintAndLog("block number too large. Max block is %u/0x%02X \n", maxblockno,maxblockno);
|
||||
return usage_hf_mfu_wrbl();
|
||||
}
|
||||
|
||||
|
||||
// Swap endianness
|
||||
if (swapEndian && hasAuthKey) authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
|
||||
if (swapEndian && hasPwdKey) authKeyPtr = SwapEndian64(authenticationkey, 4, 4);
|
||||
|
|
@ -1083,7 +1083,7 @@ int CmdHF14AMfURdBl(const char *Cmd){
|
|||
PrintAndLog("block number to large. Max block is %u/0x%02X \n", maxblockno,maxblockno);
|
||||
return usage_hf_mfu_rdbl();
|
||||
}
|
||||
|
||||
|
||||
// Swap endianness
|
||||
if (swapEndian && hasAuthKey) authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
|
||||
if (swapEndian && hasPwdKey) authKeyPtr = SwapEndian64(authenticationkey, 4, 4);
|
||||
|
|
|
|||
|
|
@ -89,7 +89,6 @@ typedef struct {
|
|||
|
||||
// For the 13.56 MHz tags
|
||||
#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693 0x0300
|
||||
#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443 0x0301
|
||||
#define CMD_READ_SRI512_TAG 0x0303
|
||||
#define CMD_READ_SRIX4K_TAG 0x0304
|
||||
#define CMD_READER_ISO_15693 0x0310
|
||||
|
|
@ -105,9 +104,8 @@ typedef struct {
|
|||
#define CMD_SIMULATE_HITAG 0x0371
|
||||
#define CMD_READER_HITAG 0x0372
|
||||
|
||||
#define CMD_SIMULATE_TAG_HF_LISTEN 0x0380
|
||||
#define CMD_SIMULATE_TAG_ISO_14443 0x0381
|
||||
#define CMD_SNOOP_ISO_14443 0x0382
|
||||
#define CMD_SIMULATE_TAG_ISO_14443B 0x0381
|
||||
#define CMD_SNOOP_ISO_14443B 0x0382
|
||||
#define CMD_SNOOP_ISO_14443a 0x0383
|
||||
#define CMD_SIMULATE_TAG_ISO_14443a 0x0384
|
||||
#define CMD_READER_ISO_14443a 0x0385
|
||||
|
|
|
|||
BIN
fpga/fpga_hf.bit
BIN
fpga/fpga_hf.bit
Binary file not shown.
|
|
@ -88,7 +88,7 @@ begin
|
|||
// These are the correlators: we correlate against in-phase and quadrature
|
||||
// versions of our reference signal, and keep the (signed) result to
|
||||
// send out later over the SSP.
|
||||
if(corr_i_cnt == 7'd0)
|
||||
if(corr_i_cnt == 6'd0)
|
||||
begin
|
||||
if(snoop)
|
||||
begin
|
||||
|
|
@ -123,7 +123,7 @@ begin
|
|||
|
||||
// The logic in hi_simulate.v reports 4 samples per bit. We report two
|
||||
// (I, Q) pairs per bit, so we should do 2 samples per pair.
|
||||
if(corr_i_cnt == 6'd31)
|
||||
if(corr_i_cnt == 6'd32)
|
||||
after_hysteresis_prev <= after_hysteresis;
|
||||
|
||||
// Then the result from last time is serialized and send out to the ARM.
|
||||
|
|
|
|||
Loading…
Reference in a new issue