rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-05-12 11:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

ADD: @marshmellow42 fudan detection in hf mfu

Browse Source 
ADD: @marshmellow42 14b reader changes.
ADD: @pwpiwi 14b fixes
This commit is contained in:
iceman1001
2015-06-21 11:07:05 +02:00
parent 569009f3f7
commit 22e2470051
14 changed files with 349 additions and 515 deletions
Download Patch File Download Diff File Expand all files Collapse all files
armsrc/appmain.c
+4 -63
View File
@@ -18,12 +18,13 @@
#include "util.h"
#include "printf.h"
#include "string.h"
#include <stdarg.h>
#include "legicrf.h"
#include <hitag2.h>
#include "lfsampling.h"
#include "BigBuf.h"
#ifdef WITH_LCD
#include "LCD.h"
#endif
@@ -249,55 +250,6 @@ void MeasureAntennaTuningHf(void)
}
void SimulateTagHfListen(void)
{
// ToDo: historically this used the free buffer, which was 2744 Bytes long.
// There might be a better size to be defined:
#define HF_14B_SNOOP_BUFFER_SIZE 2744
uint8_t *dest = BigBuf_malloc(HF_14B_SNOOP_BUFFER_SIZE);
uint8_t v = 0;
int i;
int p = 0;
// We're using this mode just so that I can test it out; the simulated
// tag mode would work just as well and be simpler.
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
// We need to listen to the high-frequency, peak-detected path.
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
FpgaSetupSsc();
i = 0;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = 0xff;
}
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
uint8_t r = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
v <<= 1;
if(r & 1) {
v |= 1;
}
p++;
if(p >= 8) {
dest[i] = v;
v = 0;
p = 0;
i++;
if(i >= HF_14B_SNOOP_BUFFER_SIZE) {
break;
}
}
}
}
DbpString("simulate tag (now type bitsamples)");
}
void ReadMem(int addr)
{
const uint8_t *data = ((uint8_t *)addr);
@@ -781,19 +733,16 @@ void UsbPacketReceived(uint8_t *packet, int len)
#endif
#ifdef WITH_ISO14443b
case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443:
AcquireRawAdcSamplesIso14443b(c->arg[0]);
break;
case CMD_READ_SRI512_TAG:
ReadSTMemoryIso14443b(0x0F);
break;
case CMD_READ_SRIX4K_TAG:
ReadSTMemoryIso14443b(0x7F);
break;
case CMD_SNOOP_ISO_14443:
case CMD_SNOOP_ISO_14443B:
SnoopIso14443b();
break;
case CMD_SIMULATE_TAG_ISO_14443:
case CMD_SIMULATE_TAG_ISO_14443B:
SimulateIso14443bTag();
break;
case CMD_ISO_14443B_COMMAND:
@@ -816,10 +765,6 @@ void UsbPacketReceived(uint8_t *packet, int len)
EPA_PACE_Collect_Nonce(c);
break;
// case CMD_EPA_:
// EpaFoo(c);
// break;
case CMD_READER_MIFARE:
ReaderMifare(c->arg[0]);
break;
@@ -936,10 +881,6 @@ void UsbPacketReceived(uint8_t *packet, int len)
break;
#endif
case CMD_SIMULATE_TAG_HF_LISTEN:
SimulateTagHfListen();
break;
case CMD_BUFF_CLEAR:
BigBuf_Clear();
break;
armsrc/iso14443b.c
+59 -72
View File
@@ -17,7 +17,6 @@
#include "iso14443crc.h"
#define RECEIVE_SAMPLES_TIMEOUT 2000
#define ISO14443B_DMA_BUFFER_SIZE 512
//=============================================================================
// An ISO 14443 Type B tag. We listen for commands from the reader, using
@@ -238,7 +237,11 @@ static int Handle14443bUartBit(int bit)
} else if(Uart.shiftReg == 0x000) {
// this is an EOF byte
LED_A_OFF(); // Finished receiving
if (Uart.byteCnt != 0) {
return TRUE;
}
Uart.posCnt = 0;
Uart.state = STATE_ERROR_WAIT;
} else {
// this is an error
Uart.posCnt = 0;
@@ -715,38 +718,38 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
uint8_t *receivedResponse = BigBuf_malloc(MAX_FRAME_SIZE);
// The DMA buffer, used to stream samples from the FPGA
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
// Set up the demodulator for tag -> reader responses.
DemodInit(receivedResponse);
// Setup and start DMA.
FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
int8_t *upTo = dmaBuf;
lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
lastRxCounter = DMA_BUFFER_SIZE;
// Signal field is ON with the appropriate LED:
LED_D_ON();
// And put the FPGA in the appropriate mode
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
for(;;) {
int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
if(behindBy > max) max = behindBy;
while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO14443B_DMA_BUFFER_SIZE-1)) > 2) {
while(((lastRxCounter-AT91C_BASE_PDC_SSC->PDC_RCR) & (DMA_BUFFER_SIZE-1)) > 2) {
ci = upTo[0];
cq = upTo[1];
upTo += 2;
if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
upTo = dmaBuf;
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
}
lastRxCounter -= 2;
if(lastRxCounter <= 0) {
lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
lastRxCounter += DMA_BUFFER_SIZE;
}
samples += 2;
@@ -768,7 +771,7 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
//Tracing
if (tracing && Demod.len > 0) {
uint8_t parity[MAX_PARITY_SIZE];
GetParity(Demod.output, Demod.len, parity);
//GetParity(Demod.output, Demod.len, parity);
LogTrace(Demod.output, Demod.len, 0, 0, parity, FALSE);
}
}
@@ -881,22 +884,6 @@ static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
}
//-----------------------------------------------------------------------------
// Read an ISO 14443B tag. We send it some set of commands, and record the
// responses.
// The command name is misleading, it actually decodes the reponse in HEX
// into the output buffer (read the result using hexsamples, not hisamples)
//
// obsolete function only for test
//-----------------------------------------------------------------------------
void AcquireRawAdcSamplesIso14443b(uint32_t parameter)
{
uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // REQB with AFI=0, Request All, N=0
SendRawCommand14443B(sizeof(cmd1),1,1,cmd1);
}
/**
Convenience function to encode, transmit and trace iso 14443b comms
**/
@@ -941,8 +928,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
// Now give it time to spin up.
// Signal field is on with the appropriate LED
LED_D_ON();
FpgaWriteConfWord(
FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
SpinDelay(200);
// First command: wake up the tag using the INITIATE command
@@ -954,10 +940,10 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
// LED_A_OFF();
if (Demod.len == 0) {
DbpString("No response from tag");
return;
DbpString("No response from tag");
return;
} else {
Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %x %x %x",
Dbprintf("Randomly generated UID from tag (+ 2 byte CRC): %02x %02x %02x",
Demod.output[0], Demod.output[1],Demod.output[2]);
}
// There is a response, SELECT the uid
@@ -971,19 +957,19 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
// LED_A_OFF();
if (Demod.len != 3) {
Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
return;
Dbprintf("Expected 3 bytes from tag, got %d", Demod.len);
return;
}
// Check the CRC of the answer:
ComputeCrc14443(CRC_14443_B, Demod.output, 1 , &cmd1[2], &cmd1[3]);
if(cmd1[2] != Demod.output[1] || cmd1[3] != Demod.output[2]) {
DbpString("CRC Error reading select response.");
return;
DbpString("CRC Error reading select response.");
return;
}
// Check response from the tag: should be the same UID as the command we just sent:
if (cmd1[1] != Demod.output[0]) {
Dbprintf("Bad response to SELECT from Tag, aborting: %x %x", cmd1[1], Demod.output[0]);
return;
Dbprintf("Bad response to SELECT from Tag, aborting: %02x %02x", cmd1[1], Demod.output[0]);
return;
}
// Tag is now selected,
// First get the tag's UID:
@@ -995,19 +981,21 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
// LED_A_OFF();
if (Demod.len != 10) {
Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
return;
Dbprintf("Expected 10 bytes from tag, got %d", Demod.len);
return;
}
// The check the CRC of the answer (use cmd1 as temporary variable):
ComputeCrc14443(CRC_14443_B, Demod.output, 8, &cmd1[2], &cmd1[3]);
if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
(cmd1[2]<<8)+cmd1[3], (Demod.output[8]<<8)+Demod.output[9]);
if(cmd1[2] != Demod.output[8] || cmd1[3] != Demod.output[9]) {
Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
(cmd1[2]<<8)+cmd1[3],
(Demod.output[8]<<8)+Demod.output[9]
);
// Do not return;, let's go on... (we should retry, maybe ?)
}
Dbprintf("Tag UID (64 bits): %08x %08x",
(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
// Now loop to read all 16 blocks, address from 0 to last block
Dbprintf("Tag memory dump, block 0 to %d",dwLast);
@@ -1033,17 +1021,18 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
// The check the CRC of the answer (use cmd1 as temporary variable):
ComputeCrc14443(CRC_14443_B, Demod.output, 4, &cmd1[2], &cmd1[3]);
if(cmd1[2] != Demod.output[4] || cmd1[3] != Demod.output[5]) {
Dbprintf("CRC Error reading block! - Below: expected, got %x %x",
(cmd1[2]<<8)+cmd1[3], (Demod.output[4]<<8)+Demod.output[5]);
Dbprintf("CRC Error reading block! Expected: %04x got: %04x",
(cmd1[2]<<8)+cmd1[3],
(Demod.output[4]<<8)+Demod.output[5]
);
// Do not return;, let's go on... (we should retry, maybe ?)
}
// Now print out the memory location:
Dbprintf("Address=%x, Contents=%x, CRC=%x", i,
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
(Demod.output[4]<<8)+Demod.output[5]);
if (i == 0xff) {
break;
}
Dbprintf("Address=%02x, Contents=%08x, CRC=%04x", i,
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0],
(Demod.output[4]<<8)+Demod.output[5]
);
if (i == 0xff) break;
i++;
}
}
@@ -1063,7 +1052,7 @@ void ReadSTMemoryIso14443b(uint32_t dwLast)
* Memory usage for this function, (within BigBuf)
* Last Received command (reader->tag) - MAX_FRAME_SIZE
* Last Received command (tag->reader) - MAX_FRAME_SIZE
* DMA Buffer - ISO14443B_DMA_BUFFER_SIZE
* DMA Buffer - DMA_BUFFER_SIZE
* Demodulated samples received - all the rest
*/
void RAMFUNC SnoopIso14443b(void)
@@ -1080,7 +1069,7 @@ void RAMFUNC SnoopIso14443b(void)
set_tracing(TRUE);
// The DMA buffer, used to stream samples from the FPGA
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
int8_t *dmaBuf = (int8_t*) BigBuf_malloc(DMA_BUFFER_SIZE);
int lastRxCounter;
int8_t *upTo;
int ci, cq;
@@ -1098,22 +1087,20 @@ void RAMFUNC SnoopIso14443b(void)
Dbprintf(" Trace: %i bytes", BigBuf_max_traceLen());
Dbprintf(" Reader -> tag: %i bytes", MAX_FRAME_SIZE);
Dbprintf(" tag -> Reader: %i bytes", MAX_FRAME_SIZE);
Dbprintf(" DMA: %i bytes", ISO14443B_DMA_BUFFER_SIZE);
Dbprintf(" DMA: %i bytes", DMA_BUFFER_SIZE);
// Signal field is off, no reader signal, no tag signal
LEDsoff();
// And put the FPGA in the appropriate mode
FpgaWriteConfWord(
FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
FPGA_HF_READER_RX_XCORR_SNOOP);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
// Setup for the DMA.
FpgaSetupSsc();
upTo = dmaBuf;
lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
lastRxCounter = DMA_BUFFER_SIZE;
FpgaSetupSscDma((uint8_t*) dmaBuf, DMA_BUFFER_SIZE);
uint8_t parity[MAX_PARITY_SIZE];
bool TagIsActive = FALSE;
@@ -1122,7 +1109,7 @@ void RAMFUNC SnoopIso14443b(void)
// And now we loop, receiving samples.
for(;;) {
int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
(ISO14443B_DMA_BUFFER_SIZE-1);
(DMA_BUFFER_SIZE-1);
if(behindBy > maxBehindBy) {
maxBehindBy = behindBy;
}
@@ -1133,14 +1120,14 @@ void RAMFUNC SnoopIso14443b(void)
cq = upTo[1];
upTo += 2;
lastRxCounter -= 2;
if(upTo >= dmaBuf + ISO14443B_DMA_BUFFER_SIZE) {
if(upTo >= dmaBuf + DMA_BUFFER_SIZE) {
upTo = dmaBuf;
lastRxCounter += ISO14443B_DMA_BUFFER_SIZE;
lastRxCounter += DMA_BUFFER_SIZE;
AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;
AT91C_BASE_PDC_SSC->PDC_RNCR = ISO14443B_DMA_BUFFER_SIZE;
AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
WDT_HIT();
if(behindBy > (9*ISO14443B_DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
if(behindBy > (9*DMA_BUFFER_SIZE/10)) { // TODO: understand whether we can increase/decrease as we want or not?
Dbprintf("blew circular buffer! behindBy=%d", behindBy);
break;
}
if(!tracing) {
@@ -1158,7 +1145,7 @@ void RAMFUNC SnoopIso14443b(void)
if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
if(Handle14443bUartBit(ci & 0x01)) {
if(triggered && tracing) {
GetParity(Uart.output, Uart.byteCnt, parity);
//GetParity(Uart.output, Uart.byteCnt, parity);
LogTrace(Uart.output,Uart.byteCnt,samples, samples,parity,TRUE);
}
/* And ready to receive another command. */
@@ -1169,7 +1156,7 @@ void RAMFUNC SnoopIso14443b(void)
}
if(Handle14443bUartBit(cq & 0x01)) {
if(triggered && tracing) {
GetParity(Uart.output, Uart.byteCnt, parity);
//GetParity(Uart.output, Uart.byteCnt, parity);
LogTrace(Uart.output,Uart.byteCnt,samples, samples, parity, TRUE);
}
/* And ready to receive another command. */
@@ -1182,13 +1169,13 @@ void RAMFUNC SnoopIso14443b(void)
}
if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending - and we cannot afford the time
if(Handle14443bSamplesDemod(ci & 0xFE, cq & 0xFE)) {
if(Handle14443bSamplesDemod(ci, cq)) {
//Use samples as a time measurement
if(tracing)
{
uint8_t parity[MAX_PARITY_SIZE];
GetParity(Demod.output, Demod.len, parity);
//GetParity(Demod.output, Demod.len, parity);
LogTrace(Demod.output, Demod.len,samples, samples, parity, FALSE);
}
triggered = TRUE;
@@ -1196,7 +1183,7 @@ void RAMFUNC SnoopIso14443b(void)
// And ready to receive another response.
DemodReset();
}
TagIsActive = (Demod.state > DEMOD_PHASE_REF_TRAINING);
TagIsActive = (Demod.state > DEMOD_GOT_FALLING_EDGE_OF_SOF);
}
}
@@ -1243,7 +1230,7 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u
*/
// if(!GETBIT(GPIO_LED_D)) { // if field is off
// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
// FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
// // Signal field is on with the appropriate LED
// LED_D_ON();
// SpinDelay(200);
client/cmdhf.c
+11 -9
View File
@@ -36,6 +36,7 @@ int CmdHFTune(const char *Cmd)
return 0;
}
void annotateIso14443a(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize)
{
switch(cmd[0])
@@ -92,7 +93,6 @@ void annotateIso14443a(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize)
else
snprintf(exp,size,"PWD-AUTH");
break;
case MIFARE_ULEV1_FASTREAD : {
if ( cmdsize >=3 && cmd[2] <= 0xE6)
snprintf(exp,size,"READ RANGE (%d-%d)",cmd[1],cmd[2]);
@@ -483,11 +483,13 @@ uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, ui
oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
}
uint8_t parityBits = parityBytes[j>>3];
if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
if (protocol != ISO_14443B && isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
snprintf(line[j/16]+(( j % 16) * 4),110, "%02x! ", frame[j]);
} else {
snprintf(line[j/16]+(( j % 16) * 4),110, "%02x ", frame[j]);
}
}
if (markCRCBytes) {
@@ -663,6 +665,11 @@ int CmdHFSearch(const char *Cmd){
PrintAndLog("\nValid ISO14443A Tag Found - Quiting Search\n");
return ans;
}
ans = HF14BReader(false);
if (ans) {
PrintAndLog("\nValid ISO14443B Tag Found - Quiting Search\n");
return ans;
}
ans = HFiClassReader("", false, false);
if (ans) {
PrintAndLog("\nValid iClass Tag (or PicoPass Tag) Found - Quiting Search\n");
@@ -673,12 +680,7 @@ int CmdHFSearch(const char *Cmd){
PrintAndLog("\nValid ISO15693 Tag Found - Quiting Search\n");
return ans;
}
//14b has issues currently...
//ans = CmdHF14BRead(Cmd);
//if (ans > 0) return ans;
PrintAndLog("\nno known/supported 13.56 MHz tags found\n");
return 0;
}
@@ -697,7 +699,7 @@ static command_t CommandTable[] =
{"topaz", CmdHFTopaz, 1, "{ TOPAZ (NFC Type 1) RFIDs... }"},
{"tune", CmdHFTune, 0, "Continuously measure HF antenna tuning"},
{"list", CmdHFList, 1, "List protocol data in trace buffer"},
{"search", CmdHFSearch, 1, "Search for known HF tags [preliminary]"},
{"search", CmdHFSearch, 1, "Search for known HF tags"},
{NULL, NULL, 0, NULL}
};
client/cmdhf14b.c
+204 -291
View File
File diff suppressed because it is too large Load Diff
client/cmdhf14b.h
+2 -5
View File
@@ -12,16 +12,13 @@
#define CMDHF14B_H__
int CmdHF14B(const char *Cmd);
int CmdHF14BDemod(const char *Cmd);
int CmdHF14BList(const char *Cmd);
int CmdHF14BReader(const char *Cmd);
int HF14BReader(bool verbose);
int CmdHF14Sim(const char *Cmd);
int CmdHFSimlisten(const char *Cmd);
int CmdHF14BSim(const char *Cmd);
int CmdHF14BSnoop(const char *Cmd);
int CmdSri512Read(const char *Cmd);
int CmdSrix4kRead(const char *Cmd);
int CmdHF14BWrite( const char *cmd);
int HF14BReader(bool verbose);
#endif
client/cmdhfmfu.c
+33 -8
View File
@@ -57,13 +57,13 @@ uint8_t default_pwd_pack[KEYS_PWD_COUNT][4] = {
{0x32,0x0C,0x16,0x17}, // PACK 0x80,0x80 -- AMiiboo (sniffed)
};
#define MAX_UL_TYPES 17
uint16_t UL_TYPES_ARRAY[MAX_UL_TYPES] = {UNKNOWN, UL, UL_C, UL_EV1_48, UL_EV1_128, NTAG, NTAG_203,
NTAG_210, NTAG_212, NTAG_213, NTAG_215, NTAG_216, MY_D, MY_D_NFC, MY_D_MOVE, MY_D_MOVE_NFC, MY_D_MOVE_LEAN};
#define MAX_UL_TYPES 18
uint32_t UL_TYPES_ARRAY[MAX_UL_TYPES] = {UNKNOWN, UL, UL_C, UL_EV1_48, UL_EV1_128, NTAG, NTAG_203,
NTAG_210, NTAG_212, NTAG_213, NTAG_215, NTAG_216, MY_D, MY_D_NFC, MY_D_MOVE, MY_D_MOVE_NFC, MY_D_MOVE_LEAN, FUDAN_UL};
uint8_t UL_MEMORY_ARRAY[MAX_UL_TYPES] = {MAX_UL_BLOCKS, MAX_UL_BLOCKS, MAX_ULC_BLOCKS, MAX_ULEV1a_BLOCKS,
MAX_ULEV1b_BLOCKS, MAX_NTAG_203, MAX_NTAG_203, MAX_NTAG_210, MAX_NTAG_212, MAX_NTAG_213,
MAX_NTAG_215, MAX_NTAG_216, MAX_UL_BLOCKS, MAX_MY_D_NFC, MAX_MY_D_MOVE, MAX_MY_D_MOVE, MAX_MY_D_MOVE_LEAN};
MAX_NTAG_215, MAX_NTAG_216, MAX_UL_BLOCKS, MAX_MY_D_NFC, MAX_MY_D_MOVE, MAX_MY_D_MOVE, MAX_MY_D_MOVE_LEAN, MAX_UL_BLOCKS};
static int CmdHelp(const char *Cmd);
@@ -259,6 +259,25 @@ static int ulev1_readSignature( uint8_t *response, uint16_t responseLength ){
return len;
}
//make sure field is off before calling this function
static int ul_fudan_check( void ){
iso14a_card_select_t card;
if ( !ul_select(&card) )
return UL_ERROR;
UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_NO_DISCONNECT, 4, 0}};
uint8_t cmd[4] = {0x30,0x00,0x02,0xa7}; //wrong crc on purpose should be 0xa8
memcpy(c.d.asBytes, cmd, 4);
clearCommandBuffer();
SendCommand(&c);
UsbCommand resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) return UL_ERROR;
if (resp.arg[0] != 1) return UL_ERROR;
return (!resp.d.asBytes[0]) ? FUDAN_UL : UL; //if response == 0x00 then Fudan, else Genuine NXP
}
static int ul_print_default( uint8_t *data){
uint8_t uid[7];
@@ -365,15 +384,17 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces){
else if ( tagtype & NTAG_I2C_2K )
PrintAndLog("%sTYPE : NTAG I%sC 1904bytes (NT3H1201FHK)", spacer, "\xFD");
else if ( tagtype & MY_D )
PrintAndLog("%sTYPE : INFINEON my-d\0153 (SLE 66RxxS)", spacer);
PrintAndLog("%sTYPE : INFINEON my-d\x99 (SLE 66RxxS)", spacer);
else if ( tagtype & MY_D_NFC )
PrintAndLog("%sTYPE : INFINEON my-d\0153 NFC (SLE 66RxxP)", spacer);
PrintAndLog("%sTYPE : INFINEON my-d\x99 NFC (SLE 66RxxP)", spacer);
else if ( tagtype & MY_D_MOVE )
PrintAndLog("%sTYPE : INFINEON my-d\0153 move (SLE 66R01P)", spacer);
PrintAndLog("%sTYPE : INFINEON my-d\x99 move (SLE 66R01P)", spacer);
else if ( tagtype & MY_D_MOVE_NFC )
PrintAndLog("%sTYPE : INFINEON my-d\0153 move NFC (SLE 66R01P)", spacer);
PrintAndLog("%sTYPE : INFINEON my-d\x99 move NFC (SLE 66R01P)", spacer);
else if ( tagtype & MY_D_MOVE_LEAN )
PrintAndLog("%sTYPE : INFINEON my-d\x99 move lean (SLE 66R01L)", spacer);
else if ( tagtype & FUDAN_UL )
PrintAndLog("%sTYPE : FUDAN Ultralight Compatible (or other compatible) %s", spacer, (tagtype & MAGIC) ? "<magic>" : "" );
else
PrintAndLog("%sTYPE : Unknown %06x", spacer, tagtype);
return 0;
@@ -607,6 +628,10 @@ uint32_t GetHF14AMfU_Type(void){
ul_switch_off_field();
}
}
if (tagtype & UL) {
tagtype = ul_fudan_check();
ul_switch_off_field();
}
} else {
ul_switch_off_field();
// Infinition MY-D tests Exam high nibble
client/cmdhfmfu.h
+2 -1
View File
@@ -45,7 +45,8 @@ typedef enum TAGTYPE_UL {
MY_D_MOVE_LEAN= 0x008000,
NTAG_I2C_1K = 0x010000,
NTAG_I2C_2K = 0x020000,
MAGIC = 0x040000,
FUDAN_UL = 0x040000,
MAGIC = 0x080000,
UL_MAGIC = UL | MAGIC,
UL_C_MAGIC = UL_C | MAGIC,
UL_ERROR = 0xFFFFFF,
client/lualibs/commands.lua
+2 -4
View File
@@ -59,7 +59,6 @@ local _commands = {
--// For the 13.56 MHz tags
CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693 = 0x0300,
CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443 = 0x0301,
CMD_READ_SRI512_TAG = 0x0303,
CMD_READ_SRIX4K_TAG = 0x0304,
CMD_READER_ISO_15693 = 0x0310,
@@ -76,9 +75,8 @@ local _commands = {
CMD_SIMULATE_HITAG = 0x0371,
CMD_READER_HITAG = 0x0372,
CMD_SIMULATE_TAG_HF_LISTEN = 0x0380,
CMD_SIMULATE_TAG_ISO_14443 = 0x0381,
CMD_SNOOP_ISO_14443 = 0x0382,
CMD_SIMULATE_TAG_ISO_14443B = 0x0381,
CMD_SNOOP_ISO_14443B = 0x0382,
CMD_SNOOP_ISO_14443a = 0x0383,
CMD_SIMULATE_TAG_ISO_14443a = 0x0384,
CMD_READER_ISO_14443a = 0x0385,
cp2tau
-4
View File
@@ -1,4 +0,0 @@
cp armsrc/obj/*.elf /z
cp armsrc/obj/*.s19 /z
cp bootrom/obj/*.elf /z
cp bootrom/obj/*.s19 /z
fpga/fpga_hf.bit
BIN
View File
Binary file not shown.
fpga/fpga_hf.v
+1 -4
View File
@@ -73,9 +73,6 @@ wire hi_read_rx_xcorr_848 = conf_word[0];
// and whether to drive the coil (reader) or just short it (snooper)
wire hi_read_rx_xcorr_snoop = conf_word[1];
// Divide the expected subcarrier frequency for hi_read_rx_xcorr by 4
wire hi_read_rx_xcorr_quarter = conf_word[2];
// For the high-frequency simulated tag: what kind of modulation to use.
wire [2:0] hi_simulate_mod_type = conf_word[2:0];
@@ -102,7 +99,7 @@ hi_read_rx_xcorr hrxc(
hrxc_ssp_frame, hrxc_ssp_din, ssp_dout, hrxc_ssp_clk,
cross_hi, cross_lo,
hrxc_dbg,
hi_read_rx_xcorr_848, hi_read_rx_xcorr_snoop, hi_read_rx_xcorr_quarter
hi_read_rx_xcorr_848, hi_read_rx_xcorr_snoop
);
hi_simulate hs(
fpga/hi_read_rx_xcorr.v
+28 -48
View File
@@ -10,7 +10,7 @@ module hi_read_rx_xcorr(
ssp_frame, ssp_din, ssp_dout, ssp_clk,
cross_hi, cross_lo,
dbg,
xcorr_is_848, snoop, xcorr_quarter_freq
xcorr_is_848, snoop
);
input pck0, ck_1356meg, ck_1356megb;
output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4;
@@ -20,58 +20,34 @@ module hi_read_rx_xcorr(
output ssp_frame, ssp_din, ssp_clk;
input cross_hi, cross_lo;
output dbg;
input xcorr_is_848, snoop, xcorr_quarter_freq;
input xcorr_is_848, snoop;
// Carrier is steady on through this, unless we're snooping.
assign pwr_hi = ck_1356megb & (~snoop);
assign pwr_oe1 = 1'b0;
assign pwr_oe2 = 1'b0;
assign pwr_oe3 = 1'b0;
assign pwr_oe4 = 1'b0;
reg ssp_clk;
reg ssp_frame;
(* clock_signal = "yes" *) reg fc_div_2;
always @(negedge ck_1356megb)
fc_div_2 <= fc_div_2 + 1;
reg fc_div_2;
always @(posedge ck_1356meg)
fc_div_2 = ~fc_div_2;
reg fc_div_4;
always @(posedge fc_div_2)
fc_div_4 = ~fc_div_4;
reg fc_div_8;
always @(posedge fc_div_4)
fc_div_8 = ~fc_div_8;
reg adc_clk;
always @(xcorr_is_848 or xcorr_quarter_freq or ck_1356meg)
if(~xcorr_quarter_freq)
begin
(* clock_signal = "yes" *) reg adc_clk;
always @(xcorr_is_848, ck_1356megb, fc_div_2)
if(xcorr_is_848)
// The subcarrier frequency is fc/16; we will sample at fc, so that
// means the subcarrier is 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 1 1 ...
adc_clk <= ck_1356meg;
adc_clk <= ck_1356megb;
else
// The subcarrier frequency is fc/32; we will sample at fc/2, and
// the subcarrier will look identical.
adc_clk <= fc_div_2;
end
else
begin
if(xcorr_is_848)
// The subcarrier frequency is fc/64
adc_clk <= fc_div_4;
else
// The subcarrier frequency is fc/128
adc_clk <= fc_div_8;
end
// When we're a reader, we just need to do the BPSK demod; but when we're an
// eavesdropper, we also need to pick out the commands sent by the reader,
// using AM. Do this the same way that we do it for the simulated tag.
reg after_hysteresis, after_hysteresis_prev;
reg after_hysteresis, after_hysteresis_prev, after_hysteresis_prev_prev;
reg [11:0] has_been_low_for;
always @(negedge adc_clk)
begin
@@ -97,7 +73,6 @@ end
// Let us report a correlation every 4 subcarrier cycles, or 4*16 samples,
// so we need a 6-bit counter.
reg [5:0] corr_i_cnt;
reg [5:0] corr_q_cnt;
// And a couple of registers in which to accumulate the correlations.
// we would add at most 32 times adc_d, the result can be held in 13 bits.
// Need one additional bit because it can be negative as well
@@ -105,32 +80,38 @@ reg signed [13:0] corr_i_accum;
reg signed [13:0] corr_q_accum;
reg signed [7:0] corr_i_out;
reg signed [7:0] corr_q_out;
// clock and frame signal for communication to ARM
reg ssp_clk;
reg ssp_frame;
// ADC data appears on the rising edge, so sample it on the falling edge
always @(negedge adc_clk)
begin
corr_i_cnt <= corr_i_cnt + 1;
// These are the correlators: we correlate against in-phase and quadrature
// versions of our reference signal, and keep the (signed) result to
// send out later over the SSP.
if(corr_i_cnt == 7'd63)
if(corr_i_cnt == 7'd0)
begin
if(snoop)
begin
// highest 7 significant bits of tag signal (signed), 1 bit reader signal:
corr_i_out <= {corr_i_accum[13:7], after_hysteresis_prev};
corr_q_out <= {corr_q_accum[13:7], after_hysteresis};
// 7 most significant bits of tag signal (signed), 1 bit reader signal:
corr_i_out <= {corr_i_accum[13:7], after_hysteresis_prev_prev};
corr_q_out <= {corr_q_accum[13:7], after_hysteresis_prev};
after_hysteresis_prev_prev <= after_hysteresis;
end
else
begin
// highest 8 significant bits of tag signal
// 8 most significant bits of tag signal
corr_i_out <= corr_i_accum[13:6];
corr_q_out <= corr_q_accum[13:6];
end
corr_i_accum <= adc_d;
corr_q_accum <= adc_d;
corr_q_cnt <= 4;
corr_i_cnt <= 0;
end
else
begin
@@ -139,13 +120,11 @@ begin
else
corr_i_accum <= corr_i_accum + adc_d;
if(corr_q_cnt[3])
corr_q_accum <= corr_q_accum - adc_d;
else
if(corr_i_cnt[3] == corr_i_cnt[2]) // phase shifted by pi/2
corr_q_accum <= corr_q_accum + adc_d;
else
corr_q_accum <= corr_q_accum - adc_d;
corr_i_cnt <= corr_i_cnt + 1;
corr_q_cnt <= corr_q_cnt + 1;
end
// The logic in hi_simulate.v reports 4 samples per bit. We report two
@@ -172,7 +151,7 @@ begin
end
// set ssp_frame signal for corr_i_cnt = 0..3 and corr_i_cnt = 32..35
// (two frames with 8 Bits each)
// (send two frames with 8 Bits each)
if(corr_i_cnt[5:2] == 4'b0000 || corr_i_cnt[5:2] == 4'b1000)
ssp_frame = 1'b1;
else
@@ -186,5 +165,6 @@ assign dbg = corr_i_cnt[3];
// Unused.
assign pwr_lo = 1'b0;
assign pwr_oe2 = 1'b0;
endmodule
include/mifare.h
+1 -1
View File
@@ -11,7 +11,7 @@
#ifndef _MIFARE_H_
#define _MIFARE_H_
#include "../include/common.h"
#include "common.h"
//-----------------------------------------------------------------------------
// ISO 14443A
include/usb_cmd.h
+2 -5
View File
@@ -100,7 +100,6 @@ typedef struct{
// For the 13.56 MHz tags
#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693 0x0300
#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443 0x0301
#define CMD_READ_SRI512_TAG 0x0303
#define CMD_READ_SRIX4K_TAG 0x0304
#define CMD_ISO_14443B_COMMAND 0x0305
@@ -118,9 +117,8 @@ typedef struct{
#define CMD_SIMULATE_HITAG 0x0371
#define CMD_READER_HITAG 0x0372
#define CMD_SIMULATE_TAG_HF_LISTEN 0x0380
#define CMD_SIMULATE_TAG_ISO_14443 0x0381
#define CMD_SNOOP_ISO_14443 0x0382
#define CMD_SIMULATE_TAG_ISO_14443B 0x0381
#define CMD_SNOOP_ISO_14443B 0x0382
#define CMD_SNOOP_ISO_14443a 0x0383
#define CMD_SIMULATE_TAG_ISO_14443a 0x0384
#define CMD_READER_ISO_14443a 0x0385
@@ -128,7 +126,6 @@ typedef struct{
#define CMD_READER_LEGIC_RF 0x0388
#define CMD_WRITER_LEGIC_RF 0x0389
#define CMD_EPA_PACE_COLLECT_NONCE 0x038A
//#define CMD_EPA_ 0x038B
#define CMD_SNOOP_ICLASS 0x0392
#define CMD_SIMULATE_TAG_ICLASS 0x0393