Rfidler: An open-source software that defines RFID read, write, and emulator

Many technologies, such as RFID, seem mysterious, and in fact he relies on many physics principles, such as the principle of electromagnetic induction. Yes, the various signals produced by these phenomena are enough to be maddening, and after reading these analog signals, I suddenly find out how clean and beautiful binary information is.

So I've been looking for a tool that can turn these analog worlds into friendly data, and RFID is the main object. In recent years, more and more RFID/NFC products have appeared, and there may be several such things in your pocket-for example, your car keys, door keys, credit cards and so on. Of course, they have their own RFID reader can read their information, but I am concerned that there is no RFID reader can read all the information on the RFID, and this reader is very small and very cheap.

By heart, it seems that a lot of readers can meet my requirements, you can buy a very simple RFID USB reader, probably only need 10-15 pounds. But then you will find that these cheap readers can only read a standard RFID, you need a lot of such RFID reader. There are also such as PROXMARK3 can read all RFID, but the price is not cheap ah. Of course PM3 is really worth a look, it is called the "RFID industry's Swiss Army knife." It can read many versions of the signal, whether it is high frequency or low frequency, we will use it later to give an example.

RFID tags

So, before we start, we can't help but ask, what RFID tags are used to do?

Basically he has two functions:

1. Basically all RFID tags are unique and can be used to identify themselves

2. Some labels have data storage function

Around these two basic functions, you can expand a lot--is the tag blind to show ID or data content? Or, in other words, do you have some security measures in building them? These stores are brief information, so if you want to write longer and more information, does the tag have space to write? In this article, my goal is to discuss some of the basic communication processes in the simulation world, and to display them as much as possible.

rfid& Induction Phenomenon

These technologies are largely dependent on "inductive phenomena". Simply put, the RFID/NFC relies on you to motivate a coil, while another coil is close to it, and the second coil acquires part of the energy from the first coil by sensing that the two coils are magically coupled (or electromagnetic). At the same time, the second coil is likely to affect the voltage of the first coil, such as near the first coil, the voltage of the first coil is reduced, we call this phenomenon "damping phenomenon". This is how RFID works, in summary, the communication between the coils is by sending energy (from the reader), or causing the energy change of another coil (from the RFID tag).

In this article, in order to get more details we will be using the simplest way to tag RFID tags--directly identified by an ID, and we will first build the following environment: the reader through the repeated excitation coil to the coil energy. As a standard low-frequency system, its frequency will be 125,000 times per second, that is, 125KHz, these are called "carrier signal." When the RFID tag coil is placed in a certain area, it will generate some energy, become an inductance-coupled coil and enter the active state. If the reader wants to send a "wake (or other)" command, you can switch the power off the carrier signal for a short period of time. Even if the label loses power, it can still rely on the stored energy to continue to work for a period of time, we can easily change the gap between the carrier signal can represent 0 and 12 kinds of signals, based on this feature, the reader can send binary information.

In other words, they are using the amplitude shift keying (ASK) to carry the information, adjust the amplitude of the signal to represent different data. One way to be more precise is to open the key control (OOK). The information sent to the label from the reader is designed to be on and off two carriers, and the returned signal responds with both damping and non-damping.

Signal analysis

Said all these, we seem to face the appearance of a confused force, in fact, I translated a bit of a crazy force =. = To make it easier to understand, let's use the diagram to illustrate. is a 125KHz carrier observed under the oscilloscope:

Next is a signal that the reader sends to the label:

In this case, a long pulse is used to represent ' 1 ' with a short pulse for ' 0 ', so the signal here means ' 11000 ', or if you use the HITAG2 algorithm, it means ' start_auth '

As we mentioned, the label also returns information to the reader by shorting its coil to make the reader's coil appear damped. Results such as:

This looks as if the reader itself sent a message. Note, however, that the wave amplitude that the reader sends is always changing, but it cannot be reduced to No. Instead, it is either a resistive Nebo or a non-resistive nebo. This is because the effect is not directly controlled by the voltage on the reader coil, but only by sensing the waveform. But it can still be read. At this point, if we take the damping action as "1" and the non-damping function as "0", we can get ' 1010101010010110011010 ', which is the way Manchester encodes it.

So, what is the Manchester code thing to do? Well, it's starting to get interesting at this point-if you look closely at these different specifications, you'll find that they mention a number of modulation schemes, such as "Manchester (Manchester)", "Dual phase (Bi-phase)", "Frequency shift keying (FSK)", "Phase shift keying (PSK)", ' NRZI ', ' ASK ' ...

The equipment we prepare can only do ask, that fsk/psk/manchester malarky What are the options?

This is where I've been in a lot of confusion. If you want to make a product that is not the same as the RFID of the existing supplier, congratulations, you dropped the hole, because the various debugging schemes are conflicting. It's even harder to find a reader that will be able to demodulation all the scenarios-if you want to find a reader that can access all the encoded data, that's not possible. If the reader wants to further demodulation the sent signal. They need to determine in what way the signals are encoded, and for this purpose, the reader needs to know in which way the tags they are about to accept are encoded in the first place.

In fact all I need is just the simplest RFID reader, so I just need to be able to get some of the lowest level of data available, but strangely enough, there is no ready-made one. Each debug method is a different circuit, and these circuits on the web seem to show off, like this 200-page document

Http://ww1.microchip.com/downloads/en/devicedoc/51115f.pdf

After a messy search, we found a simpler design: The world's simplest RFID reader (link: http://forums.parallax.com/showthread.php/105889-World-s-simplest-RFID-reader). This has an improved version of "dit an FSK RFID reader" (Link: http://playground.arduino.cc/Main/DIYRFIDReader). In fact, these are not exactly what we expected.

We use PM3 to read raw data from different types of labels, PM3 will act as the reader's coil, and filter out the carrier, leaving the effect of damping.

Here is the Ask debug signal:

As we thought, a simple square wave is generated by the damping and non-damping effects of the carrier.

Below is the FSK label:

Notice the shape of two different pulses, one is thin, the other is fat. So we can see pulses of different frequencies.

The next is PSK:

Well, I'm going crazy too, what the hell is this???

First, the Green Line in the figure represents the voltage on the reader coil under the damping/non-damping effect of the label. We do not need to know what the specific representative, only need to know the screen to the point of 0V voltage, or full damping, and the top of the screen is a certain voltage value, or the state of the unobstructed. The circuit generates a 125KHZ carrier and can increase or decrease the output. As for how he specifically works, I don't give a damn, it's a chip thing.

Now that we know the meaning of each line, the question is why the lines are so shaped. The first example is simple: Ask/ook modulation is not on or off, so we get a line at the top of the screen when the light is off, and in the case of damping, we get a line at the point.

For example, the label in the damping reader coil where I marked out in red:

Next, let's analyze the following FSK:

Now, instead of simply using 0 and 1 to represent damping, we re-represent the damped and non-damped carriers with different cycles of each wave. As above, red marks a cycle of a wave. The width and number of pulses carry the content of the wave to be expressed.

Well, then, what's the craziest PSK??

In the phase shift keying the damping of the coil and the frequency of the carrier. In this case, it just happens to be half the speed, so it just blocks half the carrier pulses, and most of the time the signal is not strong enough to reach the top of the screen, and it's not too low to reach the bottom of the screen, but just in the middle. However, as long as there is a change in the phase, as long as a half bit change means that the damping and non-damping in a carrier cycle has changed, so we can see a small jump, or jump. The pink portion of the color, which indicates the damping time of 50%, the normal phase shift is the red and black parts.

We can see the peak value of the low peak and non-damping times of the fully damped part. This is hard to read with the naked eye, but the basic phase change (as long as the direction of the phase changes), the bit value changes, which can be easily observed. If the phase is not changed, the bit value remains unchanged. The bit number depends on the time it remains, so as long as you add a grid paper to the diagram, you will know the carrier's cycle, and with this change, you can draw a bit stream.

Suppose we start with "0", then we can get the following bit streams:

01101010001111100111000100010110000111010011100101101100001

Well, it's a little hard to understand.

But it seems like the circuit we're looking for can do the job.

However, it turns out that the following two questions are not available:

1. It is unable to deal with phase-shift keying for the under-phases peak problem.

2. When we first play, we ignore the problem of function, we want to do more things.

First of all, why is there only one reader, can we still have a writer? Unlike other technologies, RFID reading and writing are two things that are almost no different. In the process of sending a signal to a tag, the reader can send both "write" and "data" commands, which are as simple as reading a label.

Then, why is there only one writer, can we still have an emulator? All of the questions are just the motivational and motivating relationships between the reader/writer and the tag.

Based on the solution of the above problems, Rfidler was born, and now it is active on the Kickstarter:

Http://www.kickstarter.com/projects/1708444109/rfidler-a-software-defined-rfid-reader-writer-emul

All the engineering details are in the link at the end of the article, a low-frequency RFID study with less than £ 30 and a lite version that can be embedded into its own hardware project, which is less than £ 20.

I have started a firmware project based on PIC32, it runs on the above UBW32 Bitwhacker, OK, finally add the port to the other platform.

The project address is as follows:

Https://github.com/ApertureLabsLtd/RFIDler

* Reference source : Adamsblog.aperturelabs

Rfidler: An open-source software that defines RFID read, write, and emulator