armsrc/iso15693.c

   1 //-----------------------------------------------------------------------------
   2 // Jonathan Westhues, split Nov 2006
   3 // Modified by Greg Jones, Jan 2009
   4 // Modified by Adrian Dabrowski "atrox", Mar-Sept 2010,Oct 2011
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // Routines to support ISO 15693. This includes both the reader software and
  11 // the `fake tag' modes, but at the moment I've implemented only the reader
  12 // stuff, and that barely.
  13 // Modified to perform modulation onboard in arm rather than on PC
  14 // Also added additional reader commands (SELECT, READ etc.)
  15 //-----------------------------------------------------------------------------
  16 // The ISO 15693 describes two transmission modes from reader to tag, and 4
  17 // transmission modes from tag to reader. As of Mar 2010 this code only
  18 // supports one of each: "1of4" mode from reader to tag, and the highspeed
  19 // variant with one subcarrier from card to reader.
  20 // As long, as the card fully support ISO 15693 this is no problem, since the
  21 // reader chooses both data rates, but some non-standard tags do not. Further for
  22 // the simulation to work, we will need to support all data rates.
  23 //
  24 // VCD (reader) -> VICC (tag)
  25 // 1 out of 256:
  26 //      data rate: 1,66 kbit/s (fc/8192)
  27 //      used for long range
  28 // 1 out of 4:
  29 //      data rate: 26,48 kbit/s (fc/512)
  30 //      used for short range, high speed
  31 //
  32 // VICC (tag) -> VCD (reader)
  33 // Modulation:
  34 //              ASK / one subcarrier (423,75 khz)
  35 //              FSK / two subcarriers (423,75 khz && 484,28 khz)
  36 // Data Rates / Modes:
  37 //      low ASK: 6,62 kbit/s
  38 //      low FSK: 6.67 kbit/s
  39 //      high ASK: 26,48 kbit/s
  40 //      high FSK: 26,69 kbit/s
  41 //-----------------------------------------------------------------------------
  42 // added "1 out of 256" mode (for VCD->PICC) - atrox 20100911
  43
  44
  45 // Random Remarks:
  46 // *) UID is always used "transmission order" (LSB), which is reverse to display order
  47
  48 // TODO / BUGS / ISSUES:
  49 // *) writing to tags takes longer: we miss the answer from the tag in most cases
  50 //    -> tweak the read-timeout times
  51 // *) signal decoding from the card is still a bit shaky.
  52 // *) signal decoding is unable to detect collissions.
  53 // *) add anti-collission support for inventory-commands
  54 // *) read security status of a block
  55 // *) sniffing and simulation do only support one transmission mode. need to support
  56 //              all 8 transmission combinations
  57 //      *) remove or refactor code under "depricated"
  58 // *) document all the functions
  59
  60
  61 #include "proxmark3.h"
  62 #include "util.h"
  63 #include "apps.h"
  64 #include "string.h"
  65 #include "iso15693tools.h"
  66 #include "cmd.h"
  67
  68 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
  69
  70 ///////////////////////////////////////////////////////////////////////
  71 // ISO 15693 Part 2 - Air Interface
  72 // This section basicly contains transmission and receiving of bits
  73 ///////////////////////////////////////////////////////////////////////
  74
  75 #define FrameSOF              Iso15693FrameSOF
  76 #define Logic0                Iso15693Logic0
  77 #define Logic1                Iso15693Logic1
  78 #define FrameEOF              Iso15693FrameEOF
  79
  80 #define Crc(data,datalen)     Iso15693Crc(data,datalen)
  81 #define AddCrc(data,datalen)  Iso15693AddCrc(data,datalen)
  82 #define sprintUID(target,uid)   Iso15693sprintUID(target,uid)
  83
  84 int DEBUG=0;
  85
  86
  87 // ---------------------------
  88 // Signal Processing
  89 // ---------------------------
  90
  91 // prepare data using "1 out of 4" code for later transmission
  92 // resulting data rate is 26,48 kbit/s (fc/512)
  93 // cmd ... data
  94 // n ... length of data
  95 static void CodeIso15693AsReader(uint8_t *cmd, int n)
  96 {
  97         int i, j;
  98
  99         ToSendReset();
 100
 101         // Give it a bit of slack at the beginning
 102         for(i = 0; i < 24; i++) {
 103                 ToSendStuffBit(1);
 104         }
 105
 106         // SOF for 1of4
 107         ToSendStuffBit(0);
 108         ToSendStuffBit(1);
 109         ToSendStuffBit(1);
 110         ToSendStuffBit(1);
 111         ToSendStuffBit(1);
 112         ToSendStuffBit(0);
 113         ToSendStuffBit(1);
 114         ToSendStuffBit(1);
 115         for(i = 0; i < n; i++) {
 116                 for(j = 0; j < 8; j += 2) {
 117                         int these = (cmd[i] >> j) & 3;
 118                         switch(these) {
 119                                 case 0:
 120                                         ToSendStuffBit(1);
 121                                         ToSendStuffBit(0);
 122                                         ToSendStuffBit(1);
 123                                         ToSendStuffBit(1);
 124                                         ToSendStuffBit(1);
 125                                         ToSendStuffBit(1);
 126                                         ToSendStuffBit(1);
 127                                         ToSendStuffBit(1);
 128                                         break;
 129                                 case 1:
 130                                         ToSendStuffBit(1);
 131                                         ToSendStuffBit(1);
 132                                         ToSendStuffBit(1);
 133                                         ToSendStuffBit(0);
 134                                         ToSendStuffBit(1);
 135                                         ToSendStuffBit(1);
 136                                         ToSendStuffBit(1);
 137                                         ToSendStuffBit(1);
 138                                         break;
 139                                 case 2:
 140                                         ToSendStuffBit(1);
 141                                         ToSendStuffBit(1);
 142                                         ToSendStuffBit(1);
 143                                         ToSendStuffBit(1);
 144                                         ToSendStuffBit(1);
 145                                         ToSendStuffBit(0);
 146                                         ToSendStuffBit(1);
 147                                         ToSendStuffBit(1);
 148                                         break;
 149                                 case 3:
 150                                         ToSendStuffBit(1);
 151                                         ToSendStuffBit(1);
 152                                         ToSendStuffBit(1);
 153                                         ToSendStuffBit(1);
 154                                         ToSendStuffBit(1);
 155                                         ToSendStuffBit(1);
 156                                         ToSendStuffBit(1);
 157                                         ToSendStuffBit(0);
 158                                         break;
 159                         }
 160                 }
 161         }
 162         // EOF
 163         ToSendStuffBit(1);
 164         ToSendStuffBit(1);
 165         ToSendStuffBit(0);
 166         ToSendStuffBit(1);
 167
 168         // And slack at the end, too.
 169         for(i = 0; i < 24; i++) {
 170                 ToSendStuffBit(1);
 171         }
 172 }
 173
 174 // encode data using "1 out of 256" sheme
 175 // data rate is 1,66 kbit/s (fc/8192)
 176 // is designed for more robust communication over longer distances
 177 static void CodeIso15693AsReader256(uint8_t *cmd, int n)
 178 {
 179         int i, j;
 180
 181         ToSendReset();
 182
 183         // Give it a bit of slack at the beginning
 184         for(i = 0; i < 24; i++) {
 185                 ToSendStuffBit(1);
 186         }
 187
 188         // SOF for 1of256
 189         ToSendStuffBit(0);
 190         ToSendStuffBit(1);
 191         ToSendStuffBit(1);
 192         ToSendStuffBit(1);
 193         ToSendStuffBit(1);
 194         ToSendStuffBit(1);
 195         ToSendStuffBit(1);
 196         ToSendStuffBit(0);
 197
 198         for(i = 0; i < n; i++) {
 199                 for (j = 0; j<=255; j++) {
 200                         if (cmd[i]==j) {
 201                                 ToSendStuffBit(1);
 202                                 ToSendStuffBit(0);
 203                         } else {
 204                                 ToSendStuffBit(1);
 205                                 ToSendStuffBit(1);
 206                         }
 207                 }
 208         }
 209         // EOF
 210         ToSendStuffBit(1);
 211         ToSendStuffBit(1);
 212         ToSendStuffBit(0);
 213         ToSendStuffBit(1);
 214
 215         // And slack at the end, too.
 216         for(i = 0; i < 24; i++) {
 217                 ToSendStuffBit(1);
 218         }
 219 }
 220
 221
 222 // Transmit the command (to the tag) that was placed in ToSend[].
 223 static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
 224 {
 225     int c;
 226
 227 //    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
 228         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 229         if(*wait < 10) { *wait = 10; }
 230
 231 //    for(c = 0; c < *wait;) {
 232 //        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 233 //            AT91C_BASE_SSC->SSC_THR = 0x00;           // For exact timing!
 234 //            c++;
 235 //        }
 236 //        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 237 //            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
 238 //            (void)r;
 239 //        }
 240 //        WDT_HIT();
 241 //    }
 242
 243     c = 0;
 244     for(;;) {
 245         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 246             AT91C_BASE_SSC->SSC_THR = cmd[c];
 247             c++;
 248             if(c >= len) {
 249                 break;
 250             }
 251         }
 252         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 253             volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
 254             (void)r;
 255         }
 256         WDT_HIT();
 257     }
 258         *samples = (c + *wait) << 3;
 259 }
 260
 261 //-----------------------------------------------------------------------------
 262 // Transmit the command (to the reader) that was placed in ToSend[].
 263 //-----------------------------------------------------------------------------
 264 static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
 265 {
 266     int c = 0;
 267         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
 268         if(*wait < 10) { *wait = 10; }
 269
 270     for(;;) {
 271         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 272             AT91C_BASE_SSC->SSC_THR = cmd[c];
 273             c++;
 274             if(c >= len) {
 275                 break;
 276             }
 277         }
 278         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 279             volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
 280             (void)r;
 281         }
 282         WDT_HIT();
 283     }
 284         *samples = (c + *wait) << 3;
 285 }
 286
 287
 288 // Read from Tag
 289 // Parameters:
 290 //              receivedResponse
 291 //              maxLen
 292 //              samples
 293 //              elapsed
 294 // returns:
 295 //              number of decoded bytes
 296 static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 297 {
 298         int c = 0;
 299         uint8_t *dest = BigBuf_get_addr();
 300         int getNext = 0;
 301
 302         int8_t prev = 0;
 303
 304 // NOW READ RESPONSE
 305         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 306         //spindelay(60);        // greg - experiment to get rid of some of the 0 byte/failed reads
 307         c = 0;
 308         getNext = FALSE;
 309         for(;;) {
 310                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 311                         AT91C_BASE_SSC->SSC_THR = 0x43;
 312                 }
 313                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 314                         int8_t b;
 315                         b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
 316
 317                         // The samples are correlations against I and Q versions of the
 318                         // tone that the tag AM-modulates, so every other sample is I,
 319                         // every other is Q. We just want power, so abs(I) + abs(Q) is
 320                         // close to what we want.
 321                         if(getNext) {
 322                                 int8_t r;
 323
 324                                 if(b < 0) {
 325                                         r = -b;
 326                                 } else {
 327                                         r = b;
 328                                 }
 329                                 if(prev < 0) {
 330                                         r -= prev;
 331                                 } else {
 332                                         r += prev;
 333                                 }
 334
 335                                 dest[c++] = (uint8_t)r;
 336
 337                                 if(c >= 2000) {
 338                                         break;
 339                                 }
 340                         } else {
 341                                 prev = b;
 342                         }
 343
 344                         getNext = !getNext;
 345                 }
 346         }
 347
 348         //////////////////////////////////////////
 349         /////////// DEMODULATE ///////////////////
 350         //////////////////////////////////////////
 351
 352         int i, j;
 353         int max = 0, maxPos=0;
 354
 355         int skip = 4;
 356
 357         //      if(GraphTraceLen < 1000) return;        // THIS CHECKS FOR A BUFFER TO SMALL
 358
 359         // First, correlate for SOF
 360         for(i = 0; i < 100; i++) {
 361                 int corr = 0;
 362                 for(j = 0; j < arraylen(FrameSOF); j += skip) {
 363                         corr += FrameSOF[j]*dest[i+(j/skip)];
 364                 }
 365                 if(corr > max) {
 366                         max = corr;
 367                         maxPos = i;
 368                 }
 369         }
 370         //      DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
 371
 372         int k = 0; // this will be our return value
 373
 374         // greg - If correlation is less than 1 then there's little point in continuing
 375         if ((max/(arraylen(FrameSOF)/skip)) >= 1)
 376         {
 377
 378                 i = maxPos + arraylen(FrameSOF)/skip;
 379
 380                 uint8_t outBuf[20];
 381                 memset(outBuf, 0, sizeof(outBuf));
 382                 uint8_t mask = 0x01;
 383                 for(;;) {
 384                         int corr0 = 0, corr1 = 0, corrEOF = 0;
 385                         for(j = 0; j < arraylen(Logic0); j += skip) {
 386                                 corr0 += Logic0[j]*dest[i+(j/skip)];
 387                         }
 388                         for(j = 0; j < arraylen(Logic1); j += skip) {
 389                                 corr1 += Logic1[j]*dest[i+(j/skip)];
 390                         }
 391                         for(j = 0; j < arraylen(FrameEOF); j += skip) {
 392                                 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
 393                         }
 394                         // Even things out by the length of the target waveform.
 395                         corr0 *= 4;
 396                         corr1 *= 4;
 397
 398                         if(corrEOF > corr1 && corrEOF > corr0) {
 399         //                      DbpString("EOF at %d", i);
 400                                 break;
 401                         } else if(corr1 > corr0) {
 402                                 i += arraylen(Logic1)/skip;
 403                                 outBuf[k] |= mask;
 404                         } else {
 405                                 i += arraylen(Logic0)/skip;
 406                         }
 407                         mask <<= 1;
 408                         if(mask == 0) {
 409                                 k++;
 410                                 mask = 0x01;
 411                         }
 412                         if((i+(int)arraylen(FrameEOF)) >= 2000) {
 413                                 DbpString("ran off end!");
 414                                 break;
 415                         }
 416                 }
 417                 if(mask != 0x01) { // this happens, when we miss the EOF
 418                         // TODO: for some reason this happens quite often
 419                         if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
 420                         if (mask<0x08) k--; // discard the last uneven octet;
 421                         // 0x08 is an assumption - but works quite often
 422                 }
 423         //      uint8_t str1 [8];
 424         //      itoa(k,str1);
 425         //      strncat(str1," octets read",8);
 426
 427         //      DbpString(  str1);    // DbpString("%d octets", k);
 428
 429         //      for(i = 0; i < k; i+=3) {
 430         //              //DbpString("# %2d: %02x ", i, outBuf[i]);
 431         //              DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
 432         //      }
 433
 434                 for(i = 0; i < k; i++) {
 435                         receivedResponse[i] = outBuf[i];
 436                 }
 437         } // "end if correlation > 0"   (max/(arraylen(FrameSOF)/skip))
 438         return k; // return the number of bytes demodulated
 439
 440 ///     DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
 441
 442 }
 443
 444
 445 // Now the GetISO15693 message from sniffing command
 446 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 447 {
 448         int c = 0;
 449         uint8_t *dest = BigBuf_get_addr();
 450         int getNext = 0;
 451
 452         int8_t prev = 0;
 453
 454 // NOW READ RESPONSE
 455         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 456         //spindelay(60);        // greg - experiment to get rid of some of the 0 byte/failed reads
 457         c = 0;
 458         getNext = FALSE;
 459         for(;;) {
 460                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 461                         AT91C_BASE_SSC->SSC_THR = 0x43;
 462                 }
 463                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 464                         int8_t b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
 465
 466                         // The samples are correlations against I and Q versions of the
 467                         // tone that the tag AM-modulates, so every other sample is I,
 468                         // every other is Q. We just want power, so abs(I) + abs(Q) is
 469                         // close to what we want.
 470                         if(getNext) {
 471                                 int8_t r;
 472
 473                                 if(b < 0) {
 474                                         r = -b;
 475                                 } else {
 476                                         r = b;
 477                                 }
 478                                 if(prev < 0) {
 479                                         r -= prev;
 480                                 } else {
 481                                         r += prev;
 482                                 }
 483
 484                                 dest[c++] = (uint8_t)r;
 485
 486                                 if(c >= 20000) {
 487                                         break;
 488                                 }
 489                         } else {
 490                                 prev = b;
 491                         }
 492
 493                         getNext = !getNext;
 494                 }
 495         }
 496
 497         //////////////////////////////////////////
 498         /////////// DEMODULATE ///////////////////
 499         //////////////////////////////////////////
 500
 501         int i, j;
 502         int max = 0, maxPos=0;
 503
 504         int skip = 4;
 505
 506 //      if(GraphTraceLen < 1000) return;        // THIS CHECKS FOR A BUFFER TO SMALL
 507
 508         // First, correlate for SOF
 509         for(i = 0; i < 19000; i++) {
 510                 int corr = 0;
 511                 for(j = 0; j < arraylen(FrameSOF); j += skip) {
 512                         corr += FrameSOF[j]*dest[i+(j/skip)];
 513                 }
 514                 if(corr > max) {
 515                         max = corr;
 516                         maxPos = i;
 517                 }
 518         }
 519 //      DbpString("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
 520
 521         int k = 0; // this will be our return value
 522
 523         // greg - If correlation is less than 1 then there's little point in continuing
 524         if ((max/(arraylen(FrameSOF)/skip)) >= 1)       // THIS SHOULD BE 1
 525         {
 526
 527                 i = maxPos + arraylen(FrameSOF)/skip;
 528
 529                 uint8_t outBuf[20];
 530                 memset(outBuf, 0, sizeof(outBuf));
 531                 uint8_t mask = 0x01;
 532                 for(;;) {
 533                         int corr0 = 0, corr1 = 0, corrEOF = 0;
 534                         for(j = 0; j < arraylen(Logic0); j += skip) {
 535                                 corr0 += Logic0[j]*dest[i+(j/skip)];
 536                         }
 537                         for(j = 0; j < arraylen(Logic1); j += skip) {
 538                                 corr1 += Logic1[j]*dest[i+(j/skip)];
 539                         }
 540                         for(j = 0; j < arraylen(FrameEOF); j += skip) {
 541                                 corrEOF += FrameEOF[j]*dest[i+(j/skip)];
 542                         }
 543                         // Even things out by the length of the target waveform.
 544                         corr0 *= 4;
 545                         corr1 *= 4;
 546
 547                         if(corrEOF > corr1 && corrEOF > corr0) {
 548         //                      DbpString("EOF at %d", i);
 549                                 break;
 550                         } else if(corr1 > corr0) {
 551                                 i += arraylen(Logic1)/skip;
 552                                 outBuf[k] |= mask;
 553                         } else {
 554                                 i += arraylen(Logic0)/skip;
 555                         }
 556                         mask <<= 1;
 557                         if(mask == 0) {
 558                                 k++;
 559                                 mask = 0x01;
 560                         }
 561                         if((i+(int)arraylen(FrameEOF)) >= 2000) {
 562                                 DbpString("ran off end!");
 563                                 break;
 564                         }
 565                 }
 566                 if(mask != 0x01) {
 567                         DbpString("sniff: error, uneven octet! (discard extra bits!)");
 568         ///             DbpString("   mask=%02x", mask);
 569                 }
 570         //      uint8_t str1 [8];
 571         //      itoa(k,str1);
 572         //      strncat(str1," octets read",8);
 573
 574         //      DbpString(  str1);    // DbpString("%d octets", k);
 575
 576         //      for(i = 0; i < k; i+=3) {
 577         //              //DbpString("# %2d: %02x ", i, outBuf[i]);
 578         //              DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
 579         //      }
 580
 581                 for(i = 0; i < k; i++) {
 582                         receivedResponse[i] = outBuf[i];
 583                 }
 584         } // "end if correlation > 0"   (max/(arraylen(FrameSOF)/skip))
 585         return k; // return the number of bytes demodulated
 586
 587 ///     DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
 588 }
 589
 590
 591 static void BuildIdentifyRequest(void);
 592 //-----------------------------------------------------------------------------
 593 // Start to read an ISO 15693 tag. We send an identify request, then wait
 594 // for the response. The response is not demodulated, just left in the buffer
 595 // so that it can be downloaded to a PC and processed there.
 596 //-----------------------------------------------------------------------------
 597 void AcquireRawAdcSamplesIso15693(void)
 598 {
 599         uint8_t *dest = BigBuf_get_addr();
 600
 601         int c = 0;
 602         int getNext = 0;
 603         int8_t prev = 0;
 604
 605         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 606         BuildIdentifyRequest();
 607
 608         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 609
 610         // Give the tags time to energize
 611         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 612         SpinDelay(100);
 613
 614         // Now send the command
 615         FpgaSetupSsc();
 616         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 617
 618         c = 0;
 619         for(;;) {
 620                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 621                         AT91C_BASE_SSC->SSC_THR = ToSend[c];
 622                         c++;
 623                         if(c == ToSendMax+3) {
 624                                 break;
 625                         }
 626                 }
 627                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 628                         volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
 629                         (void)r;
 630                 }
 631                 WDT_HIT();
 632         }
 633
 634         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 635
 636         c = 0;
 637         getNext = FALSE;
 638         for(;;) {
 639                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 640                         AT91C_BASE_SSC->SSC_THR = 0x43;
 641                 }
 642                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 643                         int8_t b;
 644                         b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
 645
 646                         // The samples are correlations against I and Q versions of the
 647                         // tone that the tag AM-modulates, so every other sample is I,
 648                         // every other is Q. We just want power, so abs(I) + abs(Q) is
 649                         // close to what we want.
 650                         if(getNext) {
 651                                 int8_t r;
 652
 653                                 if(b < 0) {
 654                                         r = -b;
 655                                 } else {
 656                                         r = b;
 657                                 }
 658                                 if(prev < 0) {
 659                                         r -= prev;
 660                                 } else {
 661                                         r += prev;
 662                                 }
 663
 664                                 dest[c++] = (uint8_t)r;
 665
 666                                 if(c >= 2000) {
 667                                         break;
 668                                 }
 669                         } else {
 670                                 prev = b;
 671                         }
 672
 673                         getNext = !getNext;
 674                 }
 675         }
 676 }
 677
 678
 679 void RecordRawAdcSamplesIso15693(void)
 680 {
 681         uint8_t *dest = BigBuf_get_addr();
 682
 683         int c = 0;
 684         int getNext = 0;
 685         int8_t prev = 0;
 686
 687         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 688         // Setup SSC
 689         FpgaSetupSsc();
 690
 691         // Start from off (no field generated)
 692         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 693         SpinDelay(200);
 694
 695         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 696
 697         SpinDelay(100);
 698
 699         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 700
 701         c = 0;
 702         getNext = FALSE;
 703         for(;;) {
 704                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 705                         AT91C_BASE_SSC->SSC_THR = 0x43;
 706                 }
 707                 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 708                         int8_t b;
 709                         b = (int8_t)AT91C_BASE_SSC->SSC_RHR;
 710
 711                         // The samples are correlations against I and Q versions of the
 712                         // tone that the tag AM-modulates, so every other sample is I,
 713                         // every other is Q. We just want power, so abs(I) + abs(Q) is
 714                         // close to what we want.
 715                         if(getNext) {
 716                                 int8_t r;
 717
 718                                 if(b < 0) {
 719                                         r = -b;
 720                                 } else {
 721                                         r = b;
 722                                 }
 723                                 if(prev < 0) {
 724                                         r -= prev;
 725                                 } else {
 726                                         r += prev;
 727                                 }
 728
 729                                 dest[c++] = (uint8_t)r;
 730
 731                                 if(c >= 7000) {
 732                                         break;
 733                                 }
 734                         } else {
 735                                 prev = b;
 736                         }
 737
 738                         getNext = !getNext;
 739                         WDT_HIT();
 740                 }
 741         }
 742         Dbprintf("fin record");
 743 }
 744
 745
 746 // Initialize the proxmark as iso15k reader
 747 // (this might produces glitches that confuse some tags
 748 void Iso15693InitReader() {
 749         LED_A_ON();
 750         LED_B_ON();
 751         LED_C_OFF();
 752         LED_D_OFF();
 753
 754         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 755         // Setup SSC
 756         // FpgaSetupSsc();
 757
 758         // Start from off (no field generated)
 759         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 760         SpinDelay(10);
 761
 762         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 763         FpgaSetupSsc();
 764
 765         // Give the tags time to energize
 766         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 767         SpinDelay(250);
 768
 769         LED_A_ON();
 770         LED_B_OFF();
 771         LED_C_OFF();
 772         LED_D_OFF();
 773 }
 774
 775 ///////////////////////////////////////////////////////////////////////
 776 // ISO 15693 Part 3 - Air Interface
 777 // This section basicly contains transmission and receiving of bits
 778 ///////////////////////////////////////////////////////////////////////
 779
 780 // Encode (into the ToSend buffers) an identify request, which is the first
 781 // thing that you must send to a tag to get a response.
 782 static void BuildIdentifyRequest(void)
 783 {
 784         uint8_t cmd[5];
 785
 786         uint16_t crc;
 787         // one sub-carrier, inventory, 1 slot, fast rate
 788         // AFI is at bit 5 (1<<4) when doing an INVENTORY
 789         cmd[0] = (1 << 2) | (1 << 5) | (1 << 1);
 790         // inventory command code
 791         cmd[1] = 0x01;
 792         // no mask
 793         cmd[2] = 0x00;
 794         //Now the CRC
 795         crc = Crc(cmd, 3);
 796         cmd[3] = crc & 0xff;
 797         cmd[4] = crc >> 8;
 798
 799         CodeIso15693AsReader(cmd, sizeof(cmd));
 800 }
 801
 802 // uid is in transmission order (which is reverse of display order)
 803 static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
 804 {
 805         uint8_t cmd[13];
 806
 807         uint16_t crc;
 808         // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
 809         // followed by teh block data
 810         // one sub-carrier, inventory, 1 slot, fast rate
 811         cmd[0] = (1 << 6)| (1 << 5) | (1 << 1); // no SELECT bit, ADDR bit, OPTION bit
 812         // READ BLOCK command code
 813         cmd[1] = 0x20;
 814         // UID may be optionally specified here
 815         // 64-bit UID
 816         cmd[2] = uid[0];
 817         cmd[3] = uid[1];
 818         cmd[4] = uid[2];
 819         cmd[5] = uid[3];
 820         cmd[6] = uid[4];
 821         cmd[7] = uid[5];
 822         cmd[8] = uid[6];
 823         cmd[9] = uid[7]; // 0xe0; // always e0 (not exactly unique)
 824         // Block number to read
 825         cmd[10] = blockNumber;//0x00;
 826         //Now the CRC
 827         crc = Crc(cmd, 11); // the crc needs to be calculated over 12 bytes
 828         cmd[11] = crc & 0xff;
 829         cmd[12] = crc >> 8;
 830
 831         CodeIso15693AsReader(cmd, sizeof(cmd));
 832 }
 833
 834 // Now the VICC>VCD responses when we are simulating a tag
 835  static void BuildInventoryResponse( uint8_t *uid)
 836 {
 837         uint8_t cmd[12];
 838
 839         uint16_t crc;
 840         // one sub-carrier, inventory, 1 slot, fast rate
 841         // AFI is at bit 5 (1<<4) when doing an INVENTORY
 842     //(1 << 2) | (1 << 5) | (1 << 1);
 843         cmd[0] = 0; //
 844         cmd[1] = 0; // DSFID (data storage format identifier).  0x00 = not supported
 845         // 64-bit UID
 846         cmd[2] = uid[7]; //0x32;
 847         cmd[3] = uid[6]; //0x4b;
 848         cmd[4] = uid[5]; //0x03;
 849         cmd[5] = uid[4]; //0x01;
 850         cmd[6] = uid[3]; //0x00;
 851         cmd[7] = uid[2]; //0x10;
 852         cmd[8] = uid[1]; //0x05;
 853         cmd[9] = uid[0]; //0xe0;
 854         //Now the CRC
 855         crc = Crc(cmd, 10);
 856         cmd[10] = crc & 0xff;
 857         cmd[11] = crc >> 8;
 858
 859         CodeIso15693AsReader(cmd, sizeof(cmd));
 860 }
 861
 862 // Universal Method for sending to and recv bytes from a tag
 863 //      init ... should we initialize the reader?
 864 //      speed ... 0 low speed, 1 hi speed
 865 //      **recv will return you a pointer to the received data
 866 //      If you do not need the answer use NULL for *recv[]
 867 //      return: lenght of received data
 868 int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) {
 869
 870         int samples = 0;
 871         int tsamples = 0;
 872         int wait = 0;
 873         int elapsed = 0;
 874
 875         LED_A_ON();
 876         LED_B_ON();
 877         LED_C_OFF();
 878         LED_D_OFF();
 879
 880         if (init) Iso15693InitReader();
 881
 882         int answerLen=0;
 883         uint8_t *answer = BigBuf_get_addr() + 3660;
 884         if (recv != NULL) memset(answer, 0, 100);
 885
 886         if (!speed) {
 887                 // low speed (1 out of 256)
 888                 CodeIso15693AsReader256(send, sendlen);
 889         } else {
 890                 // high speed (1 out of 4)
 891                 CodeIso15693AsReader(send, sendlen);
 892         }
 893
 894         LED_A_ON();
 895         LED_B_OFF();
 896
 897         TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
 898         // Now wait for a response
 899         if (recv!=NULL) {
 900                 LED_A_OFF();
 901                 LED_B_ON();
 902                 answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ;
 903                 *recv=answer;
 904         }
 905
 906         LED_A_OFF();
 907         LED_B_OFF();
 908         LED_C_OFF();
 909         LED_D_OFF();
 910
 911         return answerLen;
 912 }
 913
 914
 915 // --------------------------------------------------------------------
 916 // Debug Functions
 917 // --------------------------------------------------------------------
 918
 919 // Decodes a message from a tag and displays its metadata and content
 920 #define DBD15STATLEN 48
 921 void DbdecodeIso15693Answer(int len, uint8_t *d) {
 922         char status[DBD15STATLEN+1]={0};
 923         uint16_t crc;
 924
 925         if (len>3) {
 926                 if (d[0]&(1<<3))
 927                         strncat(status,"ProtExt ",DBD15STATLEN);
 928                 if (d[0]&1) {
 929                         // error
 930                         strncat(status,"Error ",DBD15STATLEN);
 931                         switch (d[1]) {
 932                                 case 0x01:
 933                                         strncat(status,"01:notSupp",DBD15STATLEN);
 934                                         break;
 935                                 case 0x02:
 936                                         strncat(status,"02:notRecog",DBD15STATLEN);
 937                                         break;
 938                                 case 0x03:
 939                                         strncat(status,"03:optNotSupp",DBD15STATLEN);
 940                                         break;
 941                                 case 0x0f:
 942                                         strncat(status,"0f:noInfo",DBD15STATLEN);
 943                                         break;
 944                                 case 0x10:
 945                                         strncat(status,"10:dontExist",DBD15STATLEN);
 946                                         break;
 947                                 case 0x11:
 948                                         strncat(status,"11:lockAgain",DBD15STATLEN);
 949                                         break;
 950                                 case 0x12:
 951                                         strncat(status,"12:locked",DBD15STATLEN);
 952                                         break;
 953                                 case 0x13:
 954                                         strncat(status,"13:progErr",DBD15STATLEN);
 955                                         break;
 956                                 case 0x14:
 957                                         strncat(status,"14:lockErr",DBD15STATLEN);
 958                                         break;
 959                                 default:
 960                                         strncat(status,"unknownErr",DBD15STATLEN);
 961                         }
 962                         strncat(status," ",DBD15STATLEN);
 963                 } else {
 964                         strncat(status,"NoErr ",DBD15STATLEN);
 965                 }
 966
 967                 crc=Crc(d,len-2);
 968                 if ( (( crc & 0xff ) == d[len-2]) && (( crc >> 8 ) == d[len-1]) )
 969                         strncat(status,"CrcOK",DBD15STATLEN);
 970                 else
 971                         strncat(status,"CrcFail!",DBD15STATLEN);
 972
 973                 Dbprintf("%s",status);
 974         }
 975 }
 976
 977
 978
 979 ///////////////////////////////////////////////////////////////////////
 980 // Functions called via USB/Client
 981 ///////////////////////////////////////////////////////////////////////
 982
 983 void SetDebugIso15693(uint32_t debug) {
 984         DEBUG=debug;
 985         Dbprintf("Iso15693 Debug is now %s",DEBUG?"on":"off");
 986         return;
 987 }
 988
 989
 990
 991 //-----------------------------------------------------------------------------
 992 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
 993 // all demodulation performed in arm rather than host. - greg
 994 //-----------------------------------------------------------------------------
 995 void ReaderIso15693(uint32_t parameter)
 996 {
 997         LED_A_ON();
 998         LED_B_ON();
 999         LED_C_OFF();
1000         LED_D_OFF();
1001
1002         int answerLen1 = 0;
1003         int answerLen2 = 0;
1004         int answerLen3 = 0;
1005         int i = 0;
1006         int samples = 0;
1007         int tsamples = 0;
1008         int wait = 0;
1009         int elapsed = 0;
1010         uint8_t TagUID[8] = {0x00};
1011
1012         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1013
1014         uint8_t *answer1 = BigBuf_get_addr() + 3660;
1015         uint8_t *answer2 = BigBuf_get_addr() + 3760;
1016         uint8_t *answer3 = BigBuf_get_addr() + 3860;
1017         // Blank arrays
1018         memset(answer1, 0x00, 300);
1019
1020         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1021         // Setup SSC
1022         FpgaSetupSsc();
1023
1024         // Start from off (no field generated)
1025         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1026         SpinDelay(200);
1027
1028         // Give the tags time to energize
1029         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
1030         SpinDelay(200);
1031
1032         LED_A_ON();
1033         LED_B_OFF();
1034         LED_C_OFF();
1035         LED_D_OFF();
1036
1037         // FIRST WE RUN AN INVENTORY TO GET THE TAG UID
1038         // THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
1039
1040         // Now send the IDENTIFY command
1041         BuildIdentifyRequest();
1042
1043         TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
1044
1045         // Now wait for a response
1046         answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
1047
1048         if (answerLen1 >=12) // we should do a better check than this
1049         {
1050                 TagUID[0] = answer1[2];
1051                 TagUID[1] = answer1[3];
1052                 TagUID[2] = answer1[4];
1053                 TagUID[3] = answer1[5];
1054                 TagUID[4] = answer1[6];
1055                 TagUID[5] = answer1[7];
1056                 TagUID[6] = answer1[8]; // IC Manufacturer code
1057                 TagUID[7] = answer1[9]; // always E0
1058
1059         }
1060
1061         Dbprintf("%d octets read from IDENTIFY request:", answerLen1);
1062         DbdecodeIso15693Answer(answerLen1,answer1);
1063         Dbhexdump(answerLen1,answer1,true);
1064
1065         // UID is reverse
1066         if (answerLen1>=12)
1067                 Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
1068                         TagUID[7],TagUID[6],TagUID[5],TagUID[4],
1069                         TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
1070
1071
1072         Dbprintf("%d octets read from SELECT request:", answerLen2);
1073         DbdecodeIso15693Answer(answerLen2,answer2);
1074         Dbhexdump(answerLen2,answer2,true);
1075
1076         Dbprintf("%d octets read from XXX request:", answerLen3);
1077         DbdecodeIso15693Answer(answerLen3,answer3);
1078         Dbhexdump(answerLen3,answer3,true);
1079
1080         // read all pages
1081         if (answerLen1>=12 && DEBUG) {
1082                 i=0;
1083                 while (i<32) {  // sanity check, assume max 32 pages
1084                         BuildReadBlockRequest(TagUID,i);
1085               TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
1086          answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
1087                         if (answerLen2>0) {
1088                                 Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
1089                                 DbdecodeIso15693Answer(answerLen2,answer2);
1090                                 Dbhexdump(answerLen2,answer2,true);
1091                                 if ( *((uint32_t*) answer2) == 0x07160101 ) break; // exit on NoPageErr
1092                         }
1093                         i++;
1094                 }
1095         }
1096
1097         LED_A_OFF();
1098         LED_B_OFF();
1099         LED_C_OFF();
1100         LED_D_OFF();
1101 }
1102
1103 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
1104 // all demodulation performed in arm rather than host. - greg
1105 void SimTagIso15693(uint32_t parameter, uint8_t *uid)
1106 {
1107         LED_A_ON();
1108         LED_B_ON();
1109         LED_C_OFF();
1110         LED_D_OFF();
1111
1112         int answerLen1 = 0;
1113         int samples = 0;
1114         int tsamples = 0;
1115         int wait = 0;
1116         int elapsed = 0;
1117
1118         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1119
1120         uint8_t *buf = BigBuf_get_addr() + 3660;
1121         memset(buf, 0x00, 100);
1122
1123         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1124         FpgaSetupSsc();
1125
1126         // Start from off (no field generated)
1127         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1128         SpinDelay(200);
1129
1130         LED_A_OFF();
1131         LED_B_OFF();
1132         LED_C_ON();
1133         LED_D_OFF();
1134
1135         // Listen to reader
1136         answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
1137
1138         if (answerLen1 >=1) // we should do a better check than this
1139         {
1140                 // Build a suitable reponse to the reader INVENTORY cocmmand
1141                 // not so obsvious, but in the call to BuildInventoryResponse,  the command is copied to the global ToSend buffer used below.
1142
1143                 BuildInventoryResponse(uid);
1144
1145                 TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
1146         }
1147
1148         Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
1149                 buf[0], buf[1], buf[2], buf[3],
1150                 buf[4], buf[5], buf[6], buf[7], buf[8]);
1151
1152         Dbprintf("Simulationg uid: %x %x %x %x %x %x %x %x",
1153                 uid[0], uid[1], uid[2], uid[3],
1154                 uid[4], uid[5], uid[6], uid[7]);
1155
1156         LED_A_OFF();
1157         LED_B_OFF();
1158         LED_C_OFF();
1159         LED_D_OFF();
1160 }
1161
1162
1163 // Since there is no standardized way of reading the AFI out of a tag, we will brute force it
1164 // (some manufactures offer a way to read the AFI, though)
1165 void BruteforceIso15693Afi(uint32_t speed)
1166 {
1167         uint8_t data[20];
1168         uint8_t *recv=data;
1169         int datalen=0, recvlen=0;
1170
1171         Iso15693InitReader();
1172
1173         // first without AFI
1174         // Tags should respond wihtout AFI and with AFI=0 even when AFI is active
1175
1176         data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1177                 ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
1178         data[1]=ISO15_CMD_INVENTORY;
1179         data[2]=0; // mask length
1180         datalen=AddCrc(data,3);
1181         recvlen=SendDataTag(data,datalen,0,speed,&recv);
1182         WDT_HIT();
1183         if (recvlen>=12) {
1184                 Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
1185         }
1186
1187         // now with AFI
1188
1189         data[0]=ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
1190                 ISO15_REQ_INVENTORY | ISO15_REQINV_AFI | ISO15_REQINV_SLOT1;
1191         data[1]=ISO15_CMD_INVENTORY;
1192         data[2]=0; // AFI
1193         data[3]=0; // mask length
1194
1195         for (int i=0;i<256;i++) {
1196                 data[2]=i & 0xFF;
1197                 datalen=AddCrc(data,4);
1198                 recvlen=SendDataTag(data,datalen,0,speed,&recv);
1199                 WDT_HIT();
1200                 if (recvlen>=12) {
1201                         Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
1202                 }
1203         }
1204         Dbprintf("AFI Bruteforcing done.");
1205
1206 }
1207
1208 // Allows to directly send commands to the tag via the client
1209 void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
1210
1211         int recvlen=0;
1212         uint8_t *recvbuf = BigBuf_get_addr();
1213 //      UsbCommand n;
1214
1215         if (DEBUG) {
1216                 Dbprintf("SEND");
1217                 Dbhexdump(datalen,data,true);
1218         }
1219
1220         recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
1221
1222         if (recv) {
1223                 LED_B_ON();
1224     cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
1225                 LED_B_OFF();
1226
1227                 if (DEBUG) {
1228                         Dbprintf("RECV");
1229                         DbdecodeIso15693Answer(recvlen,recvbuf);
1230                         Dbhexdump(recvlen,recvbuf,true);
1231                 }
1232         }
1233
1234 }
1235
1236
1237
1238
1239 // --------------------------------------------------------------------
1240 // -- Misc & deprecated functions
1241 // --------------------------------------------------------------------
1242
1243 /*
1244
1245 // do not use; has a fix UID
1246 static void __attribute__((unused)) BuildSysInfoRequest(uint8_t *uid)
1247 {
1248         uint8_t cmd[12];
1249
1250         uint16_t crc;
1251         // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1252         // followed by teh block data
1253         // one sub-carrier, inventory, 1 slot, fast rate
1254         cmd[0] =  (1 << 5) | (1 << 1); // no SELECT bit
1255         // System Information command code
1256         cmd[1] = 0x2B;
1257         // UID may be optionally specified here
1258         // 64-bit UID
1259         cmd[2] = 0x32;
1260         cmd[3]= 0x4b;
1261         cmd[4] = 0x03;
1262         cmd[5] = 0x01;
1263         cmd[6] = 0x00;
1264         cmd[7] = 0x10;
1265         cmd[8] = 0x05;
1266         cmd[9]= 0xe0; // always e0 (not exactly unique)
1267         //Now the CRC
1268         crc = Crc(cmd, 10); // the crc needs to be calculated over 2 bytes
1269         cmd[10] = crc & 0xff;
1270         cmd[11] = crc >> 8;
1271
1272         CodeIso15693AsReader(cmd, sizeof(cmd));
1273 }
1274
1275
1276 // do not use; has a fix UID
1277 static void __attribute__((unused)) BuildReadMultiBlockRequest(uint8_t *uid)
1278 {
1279         uint8_t cmd[14];
1280
1281         uint16_t crc;
1282         // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1283         // followed by teh block data
1284         // one sub-carrier, inventory, 1 slot, fast rate
1285         cmd[0] =  (1 << 5) | (1 << 1); // no SELECT bit
1286         // READ Multi BLOCK command code
1287         cmd[1] = 0x23;
1288         // UID may be optionally specified here
1289         // 64-bit UID
1290         cmd[2] = 0x32;
1291         cmd[3]= 0x4b;
1292         cmd[4] = 0x03;
1293         cmd[5] = 0x01;
1294         cmd[6] = 0x00;
1295         cmd[7] = 0x10;
1296         cmd[8] = 0x05;
1297         cmd[9]= 0xe0; // always e0 (not exactly unique)
1298         // First Block number to read
1299         cmd[10] = 0x00;
1300         // Number of Blocks to read
1301         cmd[11] = 0x2f; // read quite a few
1302         //Now the CRC
1303         crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1304         cmd[12] = crc & 0xff;
1305         cmd[13] = crc >> 8;
1306
1307         CodeIso15693AsReader(cmd, sizeof(cmd));
1308 }
1309
1310 // do not use; has a fix UID
1311 static void __attribute__((unused)) BuildArbitraryRequest(uint8_t *uid,uint8_t CmdCode)
1312 {
1313         uint8_t cmd[14];
1314
1315         uint16_t crc;
1316         // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1317         // followed by teh block data
1318         // one sub-carrier, inventory, 1 slot, fast rate
1319         cmd[0] =   (1 << 5) | (1 << 1); // no SELECT bit
1320         // READ BLOCK command code
1321         cmd[1] = CmdCode;
1322         // UID may be optionally specified here
1323         // 64-bit UID
1324         cmd[2] = 0x32;
1325         cmd[3]= 0x4b;
1326         cmd[4] = 0x03;
1327         cmd[5] = 0x01;
1328         cmd[6] = 0x00;
1329         cmd[7] = 0x10;
1330         cmd[8] = 0x05;
1331         cmd[9]= 0xe0; // always e0 (not exactly unique)
1332         // Parameter
1333         cmd[10] = 0x00;
1334         cmd[11] = 0x0a;
1335
1336 //      cmd[12] = 0x00;
1337 //      cmd[13] = 0x00; //Now the CRC
1338         crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1339         cmd[12] = crc & 0xff;
1340         cmd[13] = crc >> 8;
1341
1342         CodeIso15693AsReader(cmd, sizeof(cmd));
1343 }
1344
1345 // do not use; has a fix UID
1346 static void __attribute__((unused)) BuildArbitraryCustomRequest(uint8_t uid[], uint8_t CmdCode)
1347 {
1348         uint8_t cmd[14];
1349
1350         uint16_t crc;
1351         // If we set the Option_Flag in this request, the VICC will respond with the secuirty status of the block
1352         // followed by teh block data
1353         // one sub-carrier, inventory, 1 slot, fast rate
1354         cmd[0] =   (1 << 5) | (1 << 1); // no SELECT bit
1355         // READ BLOCK command code
1356         cmd[1] = CmdCode;
1357         // UID may be optionally specified here
1358         // 64-bit UID
1359         cmd[2] = 0x32;
1360         cmd[3]= 0x4b;
1361         cmd[4] = 0x03;
1362         cmd[5] = 0x01;
1363         cmd[6] = 0x00;
1364         cmd[7] = 0x10;
1365         cmd[8] = 0x05;
1366         cmd[9]= 0xe0; // always e0 (not exactly unique)
1367         // Parameter
1368         cmd[10] = 0x05; // for custom codes this must be manufcturer code
1369         cmd[11] = 0x00;
1370
1371 //      cmd[12] = 0x00;
1372 //      cmd[13] = 0x00; //Now the CRC
1373         crc = Crc(cmd, 12); // the crc needs to be calculated over 2 bytes
1374         cmd[12] = crc & 0xff;
1375         cmd[13] = crc >> 8;
1376
1377         CodeIso15693AsReader(cmd, sizeof(cmd));
1378 }
1379
1380
1381
1382
1383 */
1384
1385