github/proxmark3
1
0
Fork 0
mirror of https://github.com/Proxmark/proxmark3.git synced 2025-03-12 04:35:36 -07:00
Code Issues Packages Projects Releases Wiki Activity

- improved reader sensitivity for 14443a cards (FPGA change!)

Browse Source 
- implemented ISO 14443A anticollision loop
See http://www.proxmark.org/forum/viewtopic.php?id=1797 further details
This commit is contained in:
micki.held@gmx.de 2013-11-19 18:52:40 +00:00
parent 6cacefa48d
commit e691fc45bc
9 changed files with 428 additions and 388 deletions

440
armsrc/iso14443a.c

@ -96,9 +96,9 @@ uint32_t GetParity(const uint8_t * pbtCmd, int iLen)
int i;
uint32_t dwPar = 0;
// Generate the encrypted data
// Generate the parity bits
for (i = 0; i < iLen; i++) {
// Save the encrypted parity bit
// and save them to a 32Bit word
dwPar |= ((OddByteParity[pbtCmd[i]]) << i);
}
return dwPar;
@ -375,196 +375,176 @@ static RAMFUNC int MillerDecoding(int bit)
}
//=============================================================================
// ISO 14443 Type A - Manchester
// ISO 14443 Type A - Manchester decoder
//=============================================================================
// Basics:
// The tag will modulate the reader field by asserting different loads to it. As a consequence, the voltage
// at the reader antenna will be modulated as well. The FPGA detects the modulation for us and would deliver e.g. the following:
// ........ 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .......
// The Manchester decoder needs to identify the following sequences:
// 4 ticks modulated followed by 4 ticks unmodulated: Sequence D = 1 (also used as "start of communication")
// 4 ticks unmodulated followed by 4 ticks modulated: Sequence E = 0
// 8 ticks unmodulated: Sequence F = end of communication
// 8 ticks modulated: A collision. Save the collision position and treat as Sequence D
// Note 1: the bitstream may start at any time (either in first or second nibble within the parameter bit). We therefore need to sync.
// Note 2: parameter offset is used to determine the position of the parity bits (required for the anticollision command only)
static tDemod Demod;
static RAMFUNC int ManchesterDecoding(int v)
inline RAMFUNC bool IsModulation(byte_t b)
{
int bit;
int modulation;
//int error = 0;
if (b >= 5 || b == 3) // majority decision: 2 or more bits are set
return true;
else
return false;
}
if(!Demod.buff) {
Demod.buff = 1;
Demod.buffer = v;
return FALSE;
}
else {
bit = Demod.buffer;
Demod.buffer = v;
}
inline RAMFUNC bool IsModulationNibble1(byte_t b)
{
return IsModulation((b & 0xE0) >> 5);
}
if(Demod.state==DEMOD_UNSYNCD) {
Demod.output[Demod.len] = 0xfa;
Demod.syncBit = 0;
//Demod.samples = 0;
Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part
inline RAMFUNC bool IsModulationNibble2(byte_t b)
{
return IsModulation((b & 0x0E) >> 1);
}
if(bit & 0x08) {
Demod.syncBit = 0x08;
}
static RAMFUNC int ManchesterDecoding(int bit, uint16_t offset)
{
switch (Demod.state) {
if(bit & 0x04) {
if(Demod.syncBit) {
bit <<= 4;
}
Demod.syncBit = 0x04;
}
if(bit & 0x02) {
if(Demod.syncBit) {
bit <<= 2;
}
Demod.syncBit = 0x02;
}
if(bit & 0x01 && Demod.syncBit) {
Demod.syncBit = 0x01;
}
if(Demod.syncBit) {
Demod.len = 0;
Demod.state = DEMOD_START_OF_COMMUNICATION;
Demod.sub = SUB_FIRST_HALF;
Demod.bitCount = 0;
Demod.shiftReg = 0;
Demod.parityBits = 0;
Demod.samples = 0;
if(Demod.posCount) {
case DEMOD_UNSYNCD: // not yet synced
Demod.len = 0; // initialize number of decoded data bytes
Demod.bitCount = offset; // initialize number of decoded data bits
Demod.shiftReg = 0; // initialize shiftreg to hold decoded data bits
Demod.parityBits = 0; // initialize parity bits
Demod.collisionPos = 0; // Position of collision bit
if (IsModulationNibble1(bit)
&& !IsModulationNibble2(bit)) { // this is the start bit
Demod.samples = 8;
if(trigger) LED_A_OFF();
switch(Demod.syncBit) {
case 0x08: Demod.samples = 3; break;
case 0x04: Demod.samples = 2; break;
case 0x02: Demod.samples = 1; break;
case 0x01: Demod.samples = 0; break;
Demod.state = DEMOD_MANCHESTER_DATA;
} else if (!IsModulationNibble1(bit) && IsModulationNibble2(bit)) { // this may be the first half of the start bit
Demod.samples = 4;
Demod.state = DEMOD_HALF_SYNCD;
}
break;
case DEMOD_HALF_SYNCD:
Demod.samples += 8;
if (IsModulationNibble1(bit)) { // error: this was not a start bit.
Demod.state = DEMOD_UNSYNCD;
} else {
if (IsModulationNibble2(bit)) { // modulation in first half
Demod.state = DEMOD_MOD_FIRST_HALF;
} else { // no modulation in first half
Demod.state = DEMOD_NOMOD_FIRST_HALF;
}
}
//error = 0;
}
}
else {
//modulation = bit & Demod.syncBit;
modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
Demod.samples += 4;
if(Demod.posCount==0) {
Demod.posCount = 1;
if(modulation) {
Demod.sub = SUB_FIRST_HALF;
}
else {
Demod.sub = SUB_NONE;
}
}
else {
Demod.posCount = 0;
if(modulation && (Demod.sub == SUB_FIRST_HALF)) {
if(Demod.state!=DEMOD_ERROR_WAIT) {
Demod.state = DEMOD_ERROR_WAIT;
Demod.output[Demod.len] = 0xaa;
//error = 0x01;
break;
case DEMOD_MOD_FIRST_HALF:
Demod.samples += 8;
Demod.bitCount++;
if (IsModulationNibble1(bit)) { // modulation in both halfs - collision
if (!Demod.collisionPos) {
Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
}
}
else if(modulation) {
Demod.sub = SUB_SECOND_HALF;
}
switch(Demod.state) {
case DEMOD_START_OF_COMMUNICATION:
if(Demod.sub == SUB_FIRST_HALF) {
Demod.state = DEMOD_MANCHESTER_D;
}
else {
Demod.output[Demod.len] = 0xab;
Demod.state = DEMOD_ERROR_WAIT;
//error = 0x02;
}
break;
case DEMOD_MANCHESTER_D:
case DEMOD_MANCHESTER_E:
if(Demod.sub == SUB_FIRST_HALF) {
Demod.bitCount++;
Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100;
Demod.state = DEMOD_MANCHESTER_D;
}
else if(Demod.sub == SUB_SECOND_HALF) {
Demod.bitCount++;
Demod.shiftReg >>= 1;
Demod.state = DEMOD_MANCHESTER_E;
}
else {
Demod.state = DEMOD_MANCHESTER_F;
}
break;
case DEMOD_MANCHESTER_F:
// Tag response does not need to be a complete byte!
if(Demod.len > 0 || Demod.bitCount > 0) {
if(Demod.bitCount > 0) {
Demod.shiftReg >>= (9 - Demod.bitCount);
Demod.output[Demod.len] = Demod.shiftReg & 0xff;
Demod.len++;
// No parity bit, so just shift a 0
Demod.parityBits <<= 1;
}
Demod.state = DEMOD_UNSYNCD;
return TRUE;
}
else {
Demod.output[Demod.len] = 0xad;
Demod.state = DEMOD_ERROR_WAIT;
//error = 0x03;
}
break;
case DEMOD_ERROR_WAIT:
Demod.state = DEMOD_UNSYNCD;
break;
default:
Demod.output[Demod.len] = 0xdd;
Demod.state = DEMOD_UNSYNCD;
break;
}
if(Demod.bitCount>=9) {
Demod.output[Demod.len] = Demod.shiftReg & 0xff;
Demod.len++;
Demod.parityBits <<= 1;
Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);
} // modulation in first half only - Sequence D = 1
Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // add a 1 to the shiftreg
if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
Demod.parityBits <<= 1; // make room for the parity bit
Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
Demod.bitCount = 0;
Demod.shiftReg = 0;
}
if (IsModulationNibble2(bit)) { // modulation in first half
Demod.state = DEMOD_MOD_FIRST_HALF;
} else { // no modulation in first half
Demod.state = DEMOD_NOMOD_FIRST_HALF;
}
break;
/*if(error) {
Demod.output[Demod.len] = 0xBB;
Demod.len++;
Demod.output[Demod.len] = error & 0xFF;
Demod.len++;
Demod.output[Demod.len] = 0xBB;
Demod.len++;
Demod.output[Demod.len] = bit & 0xFF;
Demod.len++;
Demod.output[Demod.len] = Demod.buffer & 0xFF;
Demod.len++;
Demod.output[Demod.len] = Demod.syncBit & 0xFF;
Demod.len++;
Demod.output[Demod.len] = 0xBB;
Demod.len++;
return TRUE;
}*/
}
case DEMOD_NOMOD_FIRST_HALF:
if (IsModulationNibble1(bit)) { // modulation in second half only - Sequence E = 0
Demod.bitCount++;
Demod.samples += 8;
Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
Demod.parityBits <<= 1; // make room for the new parity bit
Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
Demod.bitCount = 0;
Demod.shiftReg = 0;
}
} else { // no modulation in both halves - End of communication
Demod.samples += 4;
if(Demod.bitCount > 0) { // if we decoded bits
Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
// No parity bit, so just shift a 0
Demod.parityBits <<= 1;
}
Demod.state = DEMOD_UNSYNCD; // start from the beginning
return TRUE; // we are finished with decoding the raw data sequence
}
if (IsModulationNibble2(bit)) { // modulation in first half
Demod.state = DEMOD_MOD_FIRST_HALF;
} else { // no modulation in first half
Demod.state = DEMOD_NOMOD_FIRST_HALF;
}
break;
} // end (state != UNSYNCED)
case DEMOD_MANCHESTER_DATA:
Demod.samples += 8;
if (IsModulationNibble1(bit)) { // modulation in first half
if (IsModulationNibble2(bit) & 0x0f) { // ... and in second half = collision
if (!Demod.collisionPos) {
Demod.collisionPos = (Demod.len << 3) + Demod.bitCount;
}
} // modulation in first half only - Sequence D = 1
Demod.bitCount++;
Demod.shiftReg = (Demod.shiftReg >> 1) | 0x100; // in both cases, add a 1 to the shiftreg
if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
Demod.parityBits <<= 1; // make room for the parity bit
Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
Demod.bitCount = 0;
Demod.shiftReg = 0;
}
} else { // no modulation in first half
if (IsModulationNibble2(bit)) { // and modulation in second half = Sequence E = 0
Demod.bitCount++;
Demod.shiftReg = (Demod.shiftReg >> 1); // add a 0 to the shiftreg
if(Demod.bitCount >= 9) { // if we decoded a full byte (including parity)
Demod.parityBits <<= 1; // make room for the new parity bit
Demod.output[Demod.len++] = (Demod.shiftReg & 0xff);
Demod.parityBits |= ((Demod.shiftReg >> 8) & 0x01); // store parity bit
Demod.bitCount = 0;
Demod.shiftReg = 0;
}
} else { // no modulation in both halves - End of communication
if(Demod.bitCount > 0) { // if we decoded bits
Demod.shiftReg >>= (9 - Demod.bitCount); // add the remaining decoded bits to the output
Demod.output[Demod.len++] = Demod.shiftReg & 0xff;
// No parity bit, so just shift a 0
Demod.parityBits <<= 1;
}
Demod.state = DEMOD_UNSYNCD; // start from the beginning
return TRUE; // we are finished with decoding the raw data sequence
}
}
}
return FALSE;
return FALSE; // not finished yet, need more data
}
//=============================================================================
@ -691,7 +671,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
LED_B_OFF();
}
if(ManchesterDecoding(data[0] & 0x0F)) {
if(ManchesterDecoding(data[0], 0)) {
LED_B_ON();
if (!LogTrace(receivedResponse, Demod.len, 0 - Demod.samples, Demod.parityBits, FALSE)) break;
@ -1296,7 +1276,7 @@ static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing)
while(GetCountMifare() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
}
for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission)
for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission?)
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = 0x00;
c++;
@ -1558,13 +1538,12 @@ int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
//-----------------------------------------------------------------------------
// Wait a certain time for tag response
// If a response is captured return TRUE
// If it takes to long return FALSE
// If it takes too long return FALSE
//-----------------------------------------------------------------------------
static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer
static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint16_t offset, int maxLen, int *samples)
{
// buffer needs to be 512 bytes
int c;
// Set FPGA mode to "reader listen mode", no modulation (listen
// only, since we are receiving, not transmitting).
// Signal field is on with the appropriate LED
@ -1577,7 +1556,6 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int
Demod.state = DEMOD_UNSYNCD;
uint8_t b;
if (elapsed) *elapsed = 0;
c = 0;
for(;;) {
@ -1590,12 +1568,8 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
if(c < iso14a_timeout) { c++; } else { return FALSE; }
b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if(ManchesterDecoding((b>>4) & 0xf)) {
*samples = ((c - 1) << 3) + 4;
return TRUE;
}
if(ManchesterDecoding(b & 0x0f)) {
*samples = c << 3;
if(ManchesterDecoding(b, offset)) {
*samples = Demod.samples;
return TRUE;
}
}
@ -1607,12 +1581,12 @@ void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *tim
CodeIso14443aBitsAsReaderPar(frame,bits,par);
// Select the card
// Send command to tag
TransmitFor14443a(ToSend, ToSendMax, timing);
if(trigger)
LED_A_ON();
// Store reader command in buffer
// Log reader command in trace buffer
if (tracing) LogTrace(frame,nbytes(bits),0,par,TRUE);
}
@ -1621,38 +1595,49 @@ void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing)
ReaderTransmitBitsPar(frame,len*8,par, timing);
}
void ReaderTransmitBits(uint8_t* frame, int len, uint32_t *timing)
{
// Generate parity and redirect
ReaderTransmitBitsPar(frame,len,GetParity(frame,len/8), timing);
}
void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing)
{
// Generate parity and redirect
ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing);
}
int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset)
{
int samples = 0;
if (!GetIso14443aAnswerFromTag(receivedAnswer,offset,160,&samples)) return FALSE;
if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
if(samples == 0) return FALSE;
return Demod.len;
}
int ReaderReceive(uint8_t* receivedAnswer)
{
int samples = 0;
if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE;
if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
if(samples == 0) return FALSE;
return Demod.len;
return ReaderReceiveOffset(receivedAnswer, 0);
}
int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr)
int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr)
{
int samples = 0;
if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE;
if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
int samples = 0;
if (!GetIso14443aAnswerFromTag(receivedAnswer,0,160,&samples)) return FALSE;
if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
*parptr = Demod.parityBits;
if(samples == 0) return FALSE;
return Demod.len;
if(samples == 0) return FALSE;
return Demod.len;
}
/* performs iso14443a anticolision procedure
/* performs iso14443a anticollision procedure
* fills the uid pointer unless NULL
* fills resp_data unless NULL */
int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, uint32_t* cuid_ptr) {
uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
uint8_t sel_all[] = { 0x93,0x20 };
uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0
uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes
byte_t uid_resp[4];
@ -1666,7 +1651,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
ReaderTransmitBitsPar(wupa,7,0, NULL);
// Receive the ATQA
if(!ReaderReceive(resp)) return 0;
// Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
// Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
if(p_hi14a_card) {
memcpy(p_hi14a_card->atqa, resp, 2);
@ -1690,19 +1675,50 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
ReaderTransmit(sel_all,sizeof(sel_all), NULL);
if (!ReaderReceive(resp)) return 0;
// First backup the current uid
memcpy(uid_resp,resp,4);
uid_resp_len = 4;
if (Demod.collisionPos) { // we had a collision and need to construct the UID bit by bit
memset(uid_resp, 0, 4);
uint16_t uid_resp_bits = 0;
uint16_t collision_answer_offset = 0;
// anti-collision-loop:
while (Demod.collisionPos) {
Dbprintf("Multiple tags detected. Collision after Bit %d", Demod.collisionPos);
for (uint16_t i = collision_answer_offset; i < Demod.collisionPos; i++, uid_resp_bits++) { // add valid UID bits before collision point
uint16_t UIDbit = (resp[i/8] >> (i % 8)) & 0x01;
uid_resp[uid_resp_bits & 0xf8] |= UIDbit << (uid_resp_bits % 8);
}
uid_resp[uid_resp_bits/8] |= 1 << (uid_resp_bits % 8); // next time select the card(s) with a 1 in the collision position
uid_resp_bits++;
// construct anticollosion command:
sel_uid[1] = ((2 + uid_resp_bits/8) << 4) | (uid_resp_bits & 0x07); // length of data in bytes and bits
for (uint16_t i = 0; i <= uid_resp_bits/8; i++) {
sel_uid[2+i] = uid_resp[i];
}
collision_answer_offset = uid_resp_bits%8;
ReaderTransmitBits(sel_uid, 16 + uid_resp_bits, NULL);
if (!ReaderReceiveOffset(resp, collision_answer_offset)) return 0;
}
// finally, add the last bits and BCC of the UID
for (uint16_t i = collision_answer_offset; i < (Demod.len-1)*8; i++, uid_resp_bits++) {
uint16_t UIDbit = (resp[i/8] >> (i%8)) & 0x01;
uid_resp[uid_resp_bits/8] |= UIDbit << (uid_resp_bits % 8);
}
} else { // no collision, use the response to SELECT_ALL as current uid
memcpy(uid_resp,resp,4);
}
uid_resp_len = 4;
// Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]);
// calculate crypto UID. Always use last 4 Bytes.
// calculate crypto UID. Always use last 4 Bytes.
if(cuid_ptr) {
*cuid_ptr = bytes_to_num(uid_resp, 4);
}
// Construct SELECT UID command
memcpy(sel_uid+2,resp,5);
AppendCrc14443a(sel_uid,7);
sel_uid[1] = 0x70; // transmitting a full UID (1 Byte cmd, 1 Byte NVB, 4 Byte UID, 1 Byte BCC, 2 Bytes CRC)
memcpy(sel_uid+2,uid_resp,4); // the UID
sel_uid[6] = sel_uid[2] ^ sel_uid[3] ^ sel_uid[4] ^ sel_uid[5]; // calculate and add BCC
AppendCrc14443a(sel_uid,7); // calculate and add CRC
ReaderTransmit(sel_uid,sizeof(sel_uid), NULL);
// Receive the SAK
@ -1710,7 +1726,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
sak = resp[0];
// Test if more parts of the uid are comming
if ((sak & 0x04) && uid_resp[0] == 0x88) {
if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
// Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
// http://www.nxp.com/documents/application_note/AN10927.pdf
memcpy(uid_resp, uid_resp + 1, 3);
@ -1769,6 +1785,7 @@ void iso14443a_setup() {
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
SpinDelay(7); // iso14443-3 specifies 5ms max.
Demod.state = DEMOD_UNSYNCD;
iso14a_timeout = 2048; //default
}
@ -1815,6 +1832,7 @@ void ReaderIso14443a(UsbCommand * c)
if(param & ISO14A_CONNECT) {
iso14a_clear_trace();
}
iso14a_set_tracing(true);
if(param & ISO14A_REQUEST_TRIGGER) {
@ -1976,8 +1994,6 @@ void ReaderMifare(bool first_try)
//keep the card active
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
// CodeIso14443aBitsAsReaderPar(mf_auth, sizeof(mf_auth)*8, GetParity(mf_auth, sizeof(mf_auth)*8));
sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
catch_up_cycles = 0;
@ -2645,7 +2661,7 @@ void RAMFUNC SniffMifare(uint8_t param) {
Demod.state = DEMOD_UNSYNCD;
}
if(ManchesterDecoding(data[0] & 0x0F)) {
if(ManchesterDecoding(data[0], 0)) {
LED_C_INV();
if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break;

54
armsrc/iso14443a.h

@ -22,32 +22,22 @@
#define CARD_MEMORY 6000
#define CARD_MEMORY_LEN 4096
typedef struct nestedVector { uint32_t nt, ks1; } nestedVector;
typedef struct {
enum {
DEMOD_UNSYNCD,
DEMOD_START_OF_COMMUNICATION,
DEMOD_MANCHESTER_D,
DEMOD_MANCHESTER_E,
DEMOD_MANCHESTER_F,
DEMOD_ERROR_WAIT
} state;
int bitCount;
int posCount;
int syncBit;
int parityBits;
uint16_t shiftReg;
int buffer;
int buff;
int samples;
int len;
enum {
SUB_NONE,
SUB_FIRST_HALF,
SUB_SECOND_HALF
} sub;
uint8_t *output;
DEMOD_HALF_SYNCD,
DEMOD_MOD_FIRST_HALF,
DEMOD_NOMOD_FIRST_HALF,
DEMOD_MANCHESTER_DATA
} state;
uint16_t bitCount;
uint16_t collisionPos;
uint16_t syncBit;
uint16_t parityBits;
uint16_t shiftReg;
uint16_t samples;
uint16_t len;
uint8_t *output;
} tDemod;
typedef struct {
@ -79,18 +69,18 @@ typedef struct {
extern byte_t oddparity (const byte_t bt);
extern uint32_t GetParity(const uint8_t * pbtCmd, int iLen);
extern void AppendCrc14443a(uint8_t* data, int len);
extern uint32_t GetParity(const uint8_t *pbtCmd, int iLen);
extern void AppendCrc14443a(uint8_t *data, int len);
extern void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing);
extern void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing);
extern void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing);
extern int ReaderReceive(uint8_t* receivedAnswer);
extern int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr);
extern void ReaderTransmit(uint8_t *frame, int len, uint32_t *timing);
extern void ReaderTransmitBitsPar(uint8_t *frame, int bits, uint32_t par, uint32_t *timing);
extern void ReaderTransmitPar(uint8_t *frame, int len, uint32_t par, uint32_t *timing);
extern int ReaderReceive(uint8_t *receivedAnswer);
extern int ReaderReceivePar(uint8_t *receivedAnswer, uint32_t *parptr);
extern void iso14443a_setup();
extern int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data);
extern int iso14443a_select_card(uint8_t * uid_ptr, iso14a_card_select_t * resp_data, uint32_t * cuid_ptr);
extern int iso14_apdu(uint8_t *cmd, size_t cmd_len, void *data);
extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr);
extern void iso14a_set_trigger(bool enable);
extern void iso14a_set_timeout(uint32_t timeout);

18
client/cmdhf14a.c

@ -101,7 +101,7 @@ int CmdHF14AList(const char *Cmd)
char *crc;
crc = "";
if (len > 2) {
uint8_t b1, b2;
uint8_t b1, b2;
for (j = 0; j < (len - 1); j++) {
// gives problems... search for the reason..
/*if(frame[j] == 0xAA) {
@ -132,8 +132,8 @@ int CmdHF14AList(const char *Cmd)
crc = (isResponse & (len < 6)) ? "" : " !crc";
} else {
crc = "";
}
}
}
}
} else {
crc = ""; // SHORT
}
@ -148,7 +148,7 @@ int CmdHF14AList(const char *Cmd)
PrintAndLog(" +%7d: %s: %s %s %s",
(prev < 0 ? 0 : (timestamp - prev)),
metricString,
(isResponse ? "TAG" : " "), line, crc);
(isResponse ? "TAG " : " "), line, crc);
prev = timestamp;
i += (len + 9);
@ -184,12 +184,12 @@ int CmdHF14AReader(const char *Cmd)
case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k"); break;
case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k"); break;
case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k"); break;
case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k"); break;
case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k | JCOP 31/41"); break;
case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;

4
fpga/Makefile

@ -12,11 +12,11 @@ fpga.ngc: fpga.v fpga.ucf xst.scr util.v lo_edge_detect.v lo_read.v lo_passthru.
fpga.ngd: fpga.ngc
$(DELETE) fpga.ngd
$(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-6vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd
$(XILINX_TOOLS_PREFIX)ngdbuild -aul -p xc2s30-5-vq100 -nt timestamp -uc fpga.ucf fpga.ngc fpga.ngd
fpga.ncd: fpga.ngd
$(DELETE) fpga.ncd
$(XILINX_TOOLS_PREFIX)map -p xc2s30-6vq100 fpga.ngd
$(XILINX_TOOLS_PREFIX)map -p xc2s30-5-vq100 fpga.ngd
fpga-placed.ncd: fpga.ncd
$(DELETE) fpga-placed.ncd

BIN
fpga/fpga.bit

Binary file not shown.

13
fpga/fpga.ucf

@ -39,3 +39,16 @@ NET "ssp_frame" LOC = "P31" ;
#PACE: Start of PACE Prohibit Constraints
#PACE: End of Constraints generated by PACE
# definition of Clock nets:
NET "ck_1356meg" TNM_NET = "clk_net_1356" ;
NET "ck_1356megb" TNM_NET = "clk_net_1356b" ;
NET "pck0" TNM_NET = "clk_net_pck0" ;
NET "spck" TNM_NET = "clk_net_spck" ;
# Timing specs of clock nets:
TIMEGRP "clk_net_1356_all" = "clk_net_1356" "clk_net_1356b" ;
TIMESPEC "TS_1356MHz" = PERIOD "clk_net_1356_all" 74 ns HIGH 37 ns ;
TIMESPEC "TS_24MHz" = PERIOD "clk_net_pck0" 42 ns HIGH 21 ns ;
TIMESPEC "TS_4MHz" = PERIOD "clk_net_spck" 250 ns HIGH 125 ns ;

34
fpga/fpga.v

@ -22,17 +22,17 @@
`include "util.v"
module fpga(
spcki, miso, mosi, ncs,
pck0i, ck_1356meg, ck_1356megb,
spck, miso, mosi, ncs,
pck0, ck_1356meg, ck_1356megb,
pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4,
adc_d, adc_clk, adc_noe,
ssp_frame, ssp_din, ssp_dout, ssp_clk,
cross_hi, cross_lo,
dbg
);
input spcki, mosi, ncs;
input spck, mosi, ncs;
output miso;
input pck0i, ck_1356meg, ck_1356megb;
input pck0, ck_1356meg, ck_1356megb;
output pwr_lo, pwr_hi, pwr_oe1, pwr_oe2, pwr_oe3, pwr_oe4;
input [7:0] adc_d;
output adc_clk, adc_noe;
@ -42,15 +42,17 @@ module fpga(
output dbg;
//assign pck0 = pck0i;
IBUFG #(.IOSTANDARD("DEFAULT") ) pck0b(
.O(pck0),
.I(pck0i)
);
// IBUFG #(.IOSTANDARD("DEFAULT") ) pck0b(
// .O(pck0),
// .I(pck0i)
// );
//assign spck = spcki;
IBUFG #(.IOSTANDARD("DEFAULT") ) spckb(
.O(spck),
.I(spcki)
);
// IBUFG #(.IOSTANDARD("DEFAULT") ) spckb(
// .O(spck),
// .I(spcki)
// );
//-----------------------------------------------------------------------------
// The SPI receiver. This sets up the configuration word, which the rest of
// the logic looks at to determine how to connect the A/D and the coil
@ -68,8 +70,8 @@ reg [7:0] conf_word;
always @(posedge ncs)
begin
case(shift_reg[15:12])
4'b0001: conf_word <= shift_reg[7:0];
4'b0010: divisor <= shift_reg[7:0];
4'b0001: conf_word <= shift_reg[7:0]; // FPGA_CMD_SET_CONFREG
4'b0010: divisor <= shift_reg[7:0]; // FPGA_CMD_SET_DIVISOR
endcase
end
@ -202,7 +204,7 @@ hi_iso14443a hisn(
mux8 mux_ssp_clk (major_mode, ssp_clk, lr_ssp_clk, ls_ssp_clk, ht_ssp_clk, hrxc_ssp_clk, hs_ssp_clk, hisn_ssp_clk, lp_ssp_clk, 1'b0);
mux8 mux_ssp_din (major_mode, ssp_din, lr_ssp_din, ls_ssp_din, ht_ssp_din, hrxc_ssp_din, hs_ssp_din, hisn_ssp_din, lp_ssp_din, 1'b0);
mux8 mux_ssp_frame (major_mode, ssp_frame, lr_ssp_frame, ls_ssp_frame, ht_ssp_frame, hrxc_ssp_frame, hs_ssp_frame, hisn_ssp_frame, lp_ssp_frame, 1'b0);
mux8 mux_ssp_frame (major_mode, ssp_frame, lr_ssp_frame, ls_ssp_frame, ht_ssp_frame, hrxc_ssp_frame, hs_ssp_frame, hisn_ssp_frame, lp_ssp_frame, 1'b0);
mux8 mux_pwr_oe1 (major_mode, pwr_oe1, lr_pwr_oe1, ls_pwr_oe1, ht_pwr_oe1, hrxc_pwr_oe1, hs_pwr_oe1, hisn_pwr_oe1, lp_pwr_oe1, 1'b0);
mux8 mux_pwr_oe2 (major_mode, pwr_oe2, lr_pwr_oe2, ls_pwr_oe2, ht_pwr_oe2, hrxc_pwr_oe2, hs_pwr_oe2, hisn_pwr_oe2, lp_pwr_oe2, 1'b0);
mux8 mux_pwr_oe3 (major_mode, pwr_oe3, lr_pwr_oe3, ls_pwr_oe3, ht_pwr_oe3, hrxc_pwr_oe3, hs_pwr_oe3, hisn_pwr_oe3, lp_pwr_oe3, 1'b0);
@ -210,7 +212,7 @@ mux8 mux_pwr_oe4 (major_mode, pwr_oe4, lr_pwr_oe4, ls_pwr_oe4, ht_pwr_oe4
mux8 mux_pwr_lo (major_mode, pwr_lo, lr_pwr_lo, ls_pwr_lo, ht_pwr_lo, hrxc_pwr_lo, hs_pwr_lo, hisn_pwr_lo, lp_pwr_lo, 1'b0);
mux8 mux_pwr_hi (major_mode, pwr_hi, lr_pwr_hi, ls_pwr_hi, ht_pwr_hi, hrxc_pwr_hi, hs_pwr_hi, hisn_pwr_hi, lp_pwr_hi, 1'b0);
mux8 mux_adc_clk (major_mode, adc_clk, lr_adc_clk, ls_adc_clk, ht_adc_clk, hrxc_adc_clk, hs_adc_clk, hisn_adc_clk, lp_adc_clk, 1'b0);
mux8 mux_dbg (major_mode, dbg, lr_dbg, ls_dbg, ht_dbg, hrxc_dbg, hs_dbg, hisn_dbg, lp_dbg, 1'b0);
mux8 mux_dbg (major_mode, dbg, lr_dbg, ls_dbg, ht_dbg, hrxc_dbg, hs_dbg, hisn_dbg, lp_dbg, 1'b0);
// In all modes, let the ADC's outputs be enabled.
assign adc_noe = 1'b0;

251
fpga/hi_iso14443a.v

@ -39,8 +39,8 @@ reg [2:0] deep_counter;
reg deep_modulation;
always @(negedge adc_clk)
begin
if(& adc_d[7:6]) after_hysteresis <= 1'b1;
else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0;
if(& adc_d[7:6]) after_hysteresis <= 1'b1; // if adc_d >= 196
else if(~(| adc_d[7:4])) after_hysteresis <= 1'b0; // if adc_d <= 15
if(~(| adc_d[7:0]))
begin
@ -83,20 +83,34 @@ reg [5:0] negedge_cnt;
reg bit1, bit2, bit3;
reg [3:0] count_ones;
reg [3:0] count_zeros;
wire [7:0] avg;
reg [7:0] lavg;
reg signed [12:0] step1;
reg signed [12:0] step2;
reg [7:0] stepsize;
// wire [7:0] avg;
// reg [7:0] lavg;
// reg signed [12:0] step1;
// reg signed [12:0] step2;
// reg [7:0] stepsize;
reg [7:0] rx_mod_edge_threshold;
reg curbit;
reg [12:0] average;
wire signed [9:0] dif;
// reg [12:0] average;
// wire signed [9:0] dif;
// storage for two previous samples:
reg [7:0] adc_d_1;
reg [7:0] adc_d_2;
reg [7:0] adc_d_3;
reg [7:0] adc_d_4;
// the filtered signal (filter performs noise reduction and edge detection)
// (gaussian derivative)
wire signed [10:0] adc_d_filtered;
assign adc_d_filtered = (adc_d_4 << 1) + adc_d_3 - adc_d_1 - (adc_d << 1);
// Registers to store steepest edges detected:
reg [7:0] rx_mod_falling_edge_max;
reg [7:0] rx_mod_rising_edge_max;
// A register to send the results to the arm
reg signed [7:0] to_arm;
assign avg[7:0] = average[11:4];
assign dif = lavg - avg;
reg bit_to_arm;
reg fdt_indicator, fdt_elapsed;
@ -115,36 +129,67 @@ reg [2:0] ssp_frame_counter;
// ADC data appears on the rising edge, so sample it on the falling edge
always @(negedge adc_clk)
begin
// last bit = 0 then fdt = 1172, in case of 0x26 (7-bit command, LSB first!)
// last bit = 1 then fdt = 1236, in case of 0x52 (7-bit command, LSB first!)
if(fdt_counter == 11'd740) fdt_indicator = 1'b1;
// ------------------------------------------------------------------------------------------------------------------------------------------------------------------
// relevant for TAGSIM_MOD only. Timing of Tag's answer to a command received from a reader
// ISO14443-3 specifies:
// fdt = 1172, if last bit was 0.
// fdt = 1236, if last bit was 1.
// the FPGA takes care for the 1172 delay. To achieve the additional 1236-1172=64 ticks delay, the ARM must send an additional correction bit (before the start bit).
// The correction bit will be coded as 00010000, i.e. it adds 4 bits to the transmission stream, causing the required delay.
if(fdt_counter == 11'd740) fdt_indicator = 1'b1; // fdt_indicator is true for 740 <= fdt_counter <= 1148. Ready to buffer data. (?)
// Shouldn' this be 1236 - 720 = 516? (The mod_sig_buf can buffer 46 data bits,
// i.e. a maximum delay of 46 * 16 = 720 adc_clk ticks)
if(fdt_counter == 11'd1148)
if(fdt_counter == 11'd1148) // additional 16 (+ eventual n*128) adc_clk_ticks delay will be added by the mod_sig_buf below
// the remaining 8 ticks delay comes from the 8 ticks timing difference between reseting fdt_counter and the mod_sig_buf clock.
begin
if(fdt_elapsed)
begin
if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig;
if(negedge_cnt[3:0] == mod_sig_flip[3:0]) mod_sig_coil <= mod_sig; // start modulating (if mod_sig is already set)
end
else
begin
mod_sig_flip[3:0] <= negedge_cnt[3:0];
mod_sig_coil <= mod_sig;
mod_sig_flip[3:0] <= negedge_cnt[3:0]; // exact timing of modulation
mod_sig_coil <= mod_sig; // modulate (if mod_sig is already set)
fdt_elapsed = 1'b1;
fdt_indicator = 1'b0;
if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001;
else temp_buffer_reset = 1'b1; // fix position of the buffer pointer
if(~(| mod_sig_ptr[5:0])) mod_sig_ptr <= 6'b001001; // didn't receive a 1 yet. Delay next 1 by n*128 ticks.
else temp_buffer_reset = 1'b1; // else fix the buffer size at current position
end
end
else
begin
fdt_counter <= fdt_counter + 1;
fdt_counter <= fdt_counter + 1; // Count until 1148
end
if(& negedge_cnt[3:0])
//-------------------------------------------------------------------------------------------------------------------------------------------
// Relevant for READER_LISTEN only
// look for steepest falling and rising edges:
if (adc_d_filtered > 0)
begin
if (adc_d_filtered > rx_mod_falling_edge_max)
rx_mod_falling_edge_max <= adc_d_filtered;
end
else
begin
if (-adc_d_filtered > rx_mod_rising_edge_max)
rx_mod_rising_edge_max <= -adc_d_filtered;
end
// store previous samples for filtering and edge detection:
adc_d_4 <= adc_d_3;
adc_d_3 <= adc_d_2;
adc_d_2 <= adc_d_1;
adc_d_1 <= adc_d;
if(& negedge_cnt[3:0]) // == 0xf == 15
begin
// When there is a dip in the signal and not in reader mode
// Relevant for TAGSIM_MOD only (timing Tag's answer. See above)
// When there is a dip in the signal and not in (READER_MOD, READER_LISTEN, TAGSIM_MOD)
if(~after_hysteresis && mod_sig_buf_empty && ~((mod_type == 3'b100) || (mod_type == 3'b011) || (mod_type == 3'b010))) // last condition to prevent reset
begin
fdt_counter <= 11'd0;
@ -154,74 +199,33 @@ begin
mod_sig_ptr <= 6'b000000;
end
lavg <= avg;
if(stepsize<16) stepsize = 8'd16;
if(dif>0)
begin
step1 = dif*3;
step2 = stepsize*2; // 3:2
if(step1>step2)
begin
curbit = 1'b0;
stepsize = dif;
end
end
else
begin
step1 = dif*3;
step1 = -step1;
step2 = stepsize*2;
if(step1>step2)
begin
curbit = 1'b1;
stepsize = -dif;
end
end
if(curbit)
begin
count_zeros <= 4'd0;
if(& count_ones[3:2])
begin
curbit = 1'b0; // suppressed signal
stepsize = 8'd24; // just a fine number
end
// Relevant for READER_LISTEN only
// detect modulation signal: if modulating, there must be a falling and a rising edge ... and vice versa
if (rx_mod_falling_edge_max > 6 && rx_mod_rising_edge_max > 6)
curbit = 1'b1; // modulation
else
begin
count_ones <= count_ones + 1;
end
end
else
begin
count_ones <= 4'd0;
if(& count_zeros[3:0])
begin
stepsize = 8'd24;
end
else
begin
count_zeros <= count_zeros + 1;
end
end
curbit = 1'b0; // no modulation
// prepare next edge detection:
rx_mod_rising_edge_max <= 0;
rx_mod_falling_edge_max <= 0;
// What do we communicate to the ARM
if(mod_type == 3'b001) sendbit = after_hysteresis;
else if(mod_type == 3'b010)
if(mod_type == 3'b001) sendbit = after_hysteresis; // TAGSIM_LISTEN
else if(mod_type == 3'b010) // TAGSIM_MOD
begin
if(fdt_counter > 11'd772) sendbit = mod_sig_coil;
else sendbit = fdt_indicator;
end
else if(mod_type == 3'b011) sendbit = curbit;
else sendbit = 1'b0;
else if(mod_type == 3'b011) sendbit = curbit; // READER_LISTEN
else sendbit = 1'b0; // READER_MOD, SNIFFER
end
if(~(| negedge_cnt[3:0])) average <= adc_d;
else average <= average + adc_d;
if(negedge_cnt == 7'd63)
//------------------------------------------------------------------------------------------------------------------------------------------
// Relevant for SNIFFER mode only. Prepare communication to ARM.
if(negedge_cnt == 7'd63)
begin
if(deep_modulation)
begin
@ -234,7 +238,7 @@ begin
negedge_cnt <= 0;
end
end
else
begin
negedge_cnt <= negedge_cnt + 1;
@ -256,35 +260,48 @@ begin
bit3 <= curbit;
end
if(mod_type != 3'b000)
//--------------------------------------------------------------------------------------------------------------------------------------------------------------
// Relevant in TAGSIM_MOD only. Delay-Line to buffer data and send it at the correct time
// Note: Data in READER_MOD is fed through this delay line as well.
if(mod_type != 3'b000) // != SNIFFER
begin
if(negedge_cnt[3:0] == 4'b1000)
if(negedge_cnt[3:0] == 4'b1000) // == 0x8
begin
// The modulation signal of the tag
mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0};
if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed)
if(mod_sig_ptr == 6'b101110)
// The modulation signal of the tag. The delay line is only relevant for TAGSIM_MOD, but used in other modes as well.
// Note: this means that even in READER_MOD, there will be an arbitrary delay depending on the time of a previous reset of fdt_counter and the time and
// content of the next bit to be transmitted.
mod_sig_buf[47:0] <= {mod_sig_buf[46:1], ssp_dout, 1'b0}; // shift in new data starting at mod_sig_buf[1]. mod_sig_buf[0] = 0 always.
if((ssp_dout || (| mod_sig_ptr[5:0])) && ~fdt_elapsed) // buffer a 1 (and all subsequent data) until fdt_counter = 1148 adc_clk ticks.
if(mod_sig_ptr == 6'b101110) // buffer overflow at 46 - this would mean data loss
begin
mod_sig_ptr <= 6'b000000;
end
else mod_sig_ptr <= mod_sig_ptr + 1;
else if(fdt_elapsed && ~temp_buffer_reset)
else mod_sig_ptr <= mod_sig_ptr + 1; // increase buffer (= increase delay by 16 adc_clk ticks). ptr always points to first 1.
else if(fdt_elapsed && ~temp_buffer_reset)
// fdt_elapsed. If we didn't receive a 1 yet, ptr will be at 9 and not yet fixed. Otherwise temp_buffer_reset will be 1 already.
begin
if(ssp_dout) temp_buffer_reset = 1'b1;
if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001;
else mod_sig_ptr <= mod_sig_ptr - 1;
// wait for the next 1 after fdt_elapsed before fixing the delay and starting modulation. This ensures that the response can only happen
// at intervals of 8 * 16 = 128 adc_clk ticks intervals (as defined in ISO14443-3)
if(ssp_dout) temp_buffer_reset = 1'b1;
if(mod_sig_ptr == 6'b000010) mod_sig_ptr <= 6'b001001; // still nothing received, need to go for the next interval
else mod_sig_ptr <= mod_sig_ptr - 1; // decrease buffer.
end
else
// mod_sig_ptr and therefore the delay is now fixed until fdt_counter is reset (this can happen in SNIFFER and TAGSIM_LISTEN mode only. Note that SNIFFER
// mode (3'b000) is the default and is active in FPGA_MAJOR_MODE_OFF if no other minor mode is explicitly requested.
begin
// side effect: when ptr = 1 it will cancel the first 1 of every block of ones
// don't modulate with the correction bit (which is sent as 00010000, all other bits will come with at least 2 consecutive 1s)
// side effect: when ptr = 1 it will cancel the first 1 of every block of ones. Note: this would only be the case if we received a 1 just before fdt_elapsed.
if(~mod_sig_buf[mod_sig_ptr-1] && ~mod_sig_buf[mod_sig_ptr+1]) mod_sig = 1'b0;
else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed; // & fdt_elapsed was for direct relay to oe4
// finally, do the modulation:
else mod_sig = mod_sig_buf[mod_sig_ptr] & fdt_elapsed;
end
end
end
// SSP Clock and data
//-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
// Communication to ARM (SSP Clock and data)
// SNIFFER mode (ssp_clk = adc_clk / 8, ssp_frame clock = adc_clk / 64)):
if(mod_type == 3'b000)
begin
if(negedge_cnt[2:0] == 3'b100)
@ -308,6 +325,9 @@ begin
bit_to_arm = to_arm[7];
end
else
//-----------------------------------------------------------------------------------------------------------------------------------------------------------------------
// Communication to ARM (SSP Clock and data)
// all other modes (ssp_clk = adc_clk / 16, ssp_frame clock = adc_clk / 128):
begin
if(negedge_cnt[3:0] == 4'b1000) ssp_clk <= 1'b0;
@ -331,30 +351,29 @@ end
assign ssp_din = bit_to_arm;
// Modulating carrier frequency is fc/16
// Modulating carrier (adc_clk/16, for TAGSIM_MOD only). Will be 0 for other modes.
wire modulating_carrier;
assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010));
assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011)));
assign modulating_carrier = (mod_sig_coil & negedge_cnt[3] & (mod_type == 3'b010)); // in TAGSIM_MOD only. Otherwise always 0.
// This one is all LF, so doesn't matter
//assign pwr_oe2 = modulating_carrier;
assign pwr_oe2 = 1'b0;
// for READER_MOD only: drop carrier for mod_sig_coil==1 (pause), READER_LISTEN: carrier always on, others: carrier always off
assign pwr_hi = (ck_1356megb & (((mod_type == 3'b100) & ~mod_sig_coil) || (mod_type == 3'b011)));
// Toggle only one of these, since we are already producing much deeper
// modulation than a real tag would.
//assign pwr_oe1 = modulating_carrier;
// Enable HF antenna drivers:
assign pwr_oe1 = 1'b0;
assign pwr_oe4 = modulating_carrier;
//assign pwr_oe4 = 1'b0;
// This one is always on, so that we can watch the carrier.
//assign pwr_oe3 = modulating_carrier;
assign pwr_oe3 = 1'b0;
// TAGSIM_MOD: short circuit antenna with different resistances (modulated by modulating_carrier)
// for pwr_oe4 = 1 (tristate): antenna load = 10k || 33 = 32,9 Ohms
// for pwr_oe4 = 0 (active): antenna load = 10k || 33 || 33 = 16,5 Ohms
assign pwr_oe4 = modulating_carrier;
// This is all LF, so doesn't matter.
assign pwr_oe2 = 1'b0;
assign pwr_lo = 1'b0;
assign dbg = negedge_cnt[3];
// Unused.
assign pwr_lo = 1'b0;
endmodule

2
fpga/xst.scr

@ -1 +1 @@
run -ifn fpga.v -ifmt Verilog -ofn fpga.ngc -ofmt NGC -p xc2s30-6vq100 -opt_mode Speed -opt_level 1 -ent fpga
run -ifn fpga.v -ifmt Verilog -ofn fpga.ngc -ofmt NGC -p xc2s30-5-vq100 -opt_mode Speed -opt_level 1 -ent fpga