Skip to content

Commit 4c3a53f

Browse files
committed
update to fix typo errors and add some information
1 parent eff17b3 commit 4c3a53f

File tree

1 file changed

+98
-43
lines changed

1 file changed

+98
-43
lines changed

README.md

Lines changed: 98 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SDR nfc-laboratory v2.0
22

3-
NFC signal sniffer and protocol decoder using SDR receiver, capable of demodulate in real-time the comunication
4-
with contacless cards up to 424Kpbs.
3+
NFC signal sniffer and protocol decoder using SDR receiver, for demodulator and decoder NFC-A, NFC-B, NFC-F and NFC-V
4+
signals in real-time up to 424 Kbps.
55

66
## Description
77

@@ -10,10 +10,10 @@ reader.
1010

1111
Currently, detection and decoding is implemented for:
1212

13-
- NFC-A (ISO14443A): 106kbps ASK modulation, 212kbps and 424kbps with ASK / BPSK modulation.
13+
- NFC-A (ISO14443A): 106kbps, 212kbps and 424kbps with ASK / BPSK modulation.
1414
- NFC-B (ISO14443B): 106kbps, 212kbps and 424kbps with ASK / BPSK modulation.
15-
- NFC-V (ISO15693): 26kbps and 53kbps, 1 of 4 code and 1 of 256 code PPM modulation.
16-
- NFC-F (Felica): Preliminary, 212kbps and 424kbps, manchester modulation.
15+
- NFC-V (ISO15693): 26kbps and 53kbps, 1 of 4 code and 1 of 256 code PPM / BPSK modulation (pending FSK).
16+
- NFC-F (ISO18092): Preliminary support to 212kbps and 424kbps with manchester modulation.
1717

1818
## Application screenshots
1919

@@ -35,7 +35,7 @@ Protocol detail view.
3535

3636
## Recommended settings
3737

38-
The configuration is found in the file `conf/nfc-lab.conf` and consists of the following sections:
38+
The configuration file is found in `conf/nfc-lab.conf` and consists of the following sections:
3939

4040
```
4141
[settings]
@@ -58,7 +58,7 @@ Stores the status of the window and controls, nothing very interesting.
5858
powerLevelThreshold=0.01
5959
```
6060

61-
Minimum absolute signal strength to start decoding.
61+
Indicates the absolute minimum signal strength to start decoding, 0.5 is the maximum peak.
6262

6363
```
6464
[decoder.nfca]
@@ -83,7 +83,7 @@ maximumModulationThreshold=1.00
8383
```
8484

8585
Each of the sections controls the parameters for the indicated technology. It allows activating or not its detection
86-
and the minimum and maximum modulation depths to detect the signal. The values that appear here are recommended.
86+
and the minimum and maximum modulation depths in percentage to detect the signal. The values that appear here are recommended.
8787

8888
```
8989
[device.airspy]
@@ -95,7 +95,7 @@ centerFreq=40680000
9595
sampleRate=10000000
9696
```
9797

98-
Configuration parameters for the Airspy receiver, the best performance is obtained by tuning in second harmonic
98+
Configuration parameters for the Airspy receiver, the best performance is obtained by tuning in 3rd harmonic
9999
at 40.68Mhz.
100100

101101
```
@@ -108,7 +108,7 @@ centerFreq=40680000
108108
sampleRate=2400000
109109
```
110110

111-
Configuration parameters for the RTL-SDR receiver, the best performance is obtained by tuning to the first harmonic
111+
Configuration parameters for the RTL-SDR receiver, the best performance is obtained by tuning to the 2nd harmonic
112112
at 27.12Mhz.
113113

114114
Decoding with this device is quite limited due to its low sampling frequency and 8-bit resolution,
@@ -142,11 +142,12 @@ Mifare classic card.
142142
I have tried several receivers obtaining the best results with AirSpy Mini, I do not have more devices, but surely it
143143
works with others.
144144

145-
- AirSpy Mini or R2: Better results, tuning the third harmonic 40.68Mhz, with a sampling frequency of 10 Mbps, with these
146-
parameters it is possible to capture the communication up to 424 Kbps.
145+
- AirSpy Mini or R2: Better results, tuning the third harmonic at 40.68Mhz, with a sampling frequency of 10 Mbps,
146+
with these parameters it is possible to capture the communication up to 424 Kbps.
147147

148-
- RTL SDR: It works by tuning the second harmonic 27.12Mhz, due to the limitation in the maximum sampling frequency
149-
of 3Mbps and its 8 bits of precision only allows you to capture the commands up to 106Kbps and some responses in very clean signals.
148+
- RTL SDR: It works by tuning the second harmonic at 27.12Mhz, due to the limitation in the maximum sampling frequency
149+
of 3Mbps and its 8 bits of resolution only allows you to capture the commands up to 106Kbps and some responses in
150+
very clean signals.
150151

151152
Receivers tested:
152153

@@ -169,9 +170,51 @@ frequency of 13.56Mhz, although I have not tried this combination.
169170

170171
The demodulator is designed to run in real time, so it requires a recent computer with a lot of processing capacity.
171172

172-
During development, I have opted for a mixed approach where some optimizations are sacrificed in favor of maintaining clarity in the code and facilitating its monitoring and debugging.
173+
During development, I have opted for a mixed approach where some optimizations are sacrificed in favor of maintaining
174+
clarity in the code and facilitating its monitoring and debugging.
173175

174-
For this reason it is possible that certain parts can be improved in performance, but I have done it as a didactic exercise rather than a production application.
176+
For this reason it is possible that certain parts can be improved in performance, but I have done it as a didactic
177+
exercise rather than a production application.
178+
179+
## Input / Output file formats
180+
181+
The application allows you to read and write files in two different formats:
182+
183+
- WAV: Reading signals in standard WAV format with 1 or 2 channels is supported. In the first case, it should contain
184+
the sample of the signal in absolute real values. If 2 channels are used they should contain the sampling of
185+
the I / Q components.
186+
187+
- JSON: The analyzed signal can be stored in a simple JSON text file or read back from one of them.
188+
189+
## Testing files
190+
191+
In the "wav" folder you can find a series of samples of different captures for the NFC-A, NFC-B, NFC-F and NFC-V
192+
modulations with their corresponding analysis inside the "json" files.
193+
194+
These files can be opened directly from the NFC-LAB application through the toolbar to see their analysis, but the
195+
main objective is to pass the unit tests and check the correct operation of the decoder.
196+
197+
To run the unit tests, the "nfc-test" artifact must be compiled and launched using the path to the "wav" folder
198+
as an argument, for example:
199+
200+
```
201+
nfc-test.exe ../wav/
202+
TEST FILE "test_NFC-A_106kbps_001.wav": PASS
203+
TEST FILE "test_NFC-A_106kbps_002.wav": PASS
204+
TEST FILE "test_NFC-A_106kbps_003.wav": PASS
205+
TEST FILE "test_NFC-A_106kbps_004.wav": PASS
206+
TEST FILE "test_NFC-A_212kbps_001.wav": PASS
207+
TEST FILE "test_NFC-A_424kbps_001.wav": PASS
208+
TEST FILE "test_NFC-A_424kbps_002.wav": PASS
209+
TEST FILE "test_NFC-B_106kbps_001.wav": PASS
210+
TEST FILE "test_NFC-B_106kbps_002.wav": PASS
211+
TEST FILE "test_NFC-F_212kbps_001.wav": PASS
212+
TEST FILE "test_NFC-F_212kbps_002.wav": PASS
213+
TEST FILE "test_NFC-V_26kbps_001.wav": PASS
214+
TEST FILE "test_NFC-V_26kbps_002.wav": PASS
215+
TEST FILE "test_POLL_ABF_001.wav": PASS
216+
TEST FILE "test_POLL_AB_001.wav": PASS
217+
```
175218

176219
## Build instructions
177220

@@ -180,7 +223,7 @@ This project has two main components and is based on Qt5 and MinGW-W64:
180223
- /src/nfc-app: Application interface based on Qt Widgets
181224
- /src/nfc-lib: A core library without dependencies of Qt (for other uses)
182225

183-
And can be build with mingw-g64
226+
And it can be compiled with mingw-g64, a minimum version is required to support C++17, recommended 9.0 or higher.
184227

185228
### Prerequisites
186229

@@ -371,7 +414,7 @@ Precompiled installer for x86 64 bit can be found in repository
371414
## Basic notions of the signals to be analyzed
372415

373416
Normal NFC cards work on the 13.56 Mhz frequency, therefore the first step is receive this signal and demodulate to get
374-
the baseband ASK stream. For this purpose any SDR device capable of tuning this frequency can be used, i have the
417+
the baseband stream. For this purpose any SDR device capable of tuning this frequency can be used, i have the
375418
fantastic and cheap AirSpy Mini capable of tuning from 24Mhz to 1700Mhz. (https://airspy.com/airspy-mini/)
376419

377420
However, it is not possible to tune 13.56Mhz with this receiver, instead I use the second harmonic at 27.12Mhz or third
@@ -386,29 +429,34 @@ of the signal received in baseband (after I/Q to magnitude transform) for the RE
386429

387430
![REQA](doc/img/nfc-baseband-reqa.png?raw=true "REQA signal capture")
388431

389-
As can be seen, it is a signal modulated in 100% ASK that corresponds to the NFC-A REQA 26h command of the NFC specifications,
390-
the response of the card uses something called load modulation that manifests as a series of pulses on the main signal
391-
after the command. This is the most basic modulation, but each of the NFC-A / B / F / V standards has its own characteristics.
432+
As can be seen, it is a signal modulated in 100% ASK that corresponds to the NFC-A REQA 26h command of the NFC
433+
specifications, the response of the card uses something called load modulation that manifests as a series of pulses on
434+
the main signal after the command. This is the most basic modulation, but each of the NFC-A / B / F / V standards has
435+
its own characteristics.
392436

393437
### NFC-A modulation
394438

395-
The standard corresponds to the ISO14443A specifications which describe the way it is modulated as well as the applicable timings.
439+
The standard corresponds to the ISO14443A specifications which describe the way it is modulated as well as the
440+
applicable timings.
396441

397-
Reader frames are encoded using 100% ASK using modified miller encoding.
442+
Reader frames are encoded using 100% ASK with modified miller encoding.
398443

399444
![NFCA ASK](doc/img/nfca-ask-miller.png?raw=true "NFC-A ASK reader frame signal")
400445

401-
When the speed is 106 Kbps card responses are encoded using manchester scheme using OOK load modulation with subcarrier at 848 KHz.
446+
When the speed is 106 Kbps card responses are encoded using manchester scheme with OOK load modulation over a
447+
subcarrier at 848 KHz.
402448

403449
![NFCA OOK](doc/img/nfca-ask-ook.png?raw=true "NFC-A OOK card response signal")
404450

405-
For higher speeds, 212 kbps, 424 kbps and 848 kbps it uses a NRZ-L with binary phase change modulation, BPSK, over same subcarrier.
451+
For higher speeds, 212 kbps, 424 kbps and 848 kbps it uses a NRZ-L with binary phase change modulation, BPSK, over
452+
same subcarrier.
406453

407454
![NFCA BPSK](doc/img/nfca-bpsk.png?raw=true "NFC-A BPSK card response signal")
408455

409456
### NFC-B modulation
410457

411-
The standard corresponds to the ISO14443B specifications which describe the way it is modulated as well as the applicable timings.
458+
The standard corresponds to the ISO14443B specifications which describe the way it is modulated as well as the
459+
applicable timings.
412460

413461
Reader frames are encoded in 10% ASK using NRZ-L encoding.
414462

@@ -420,9 +468,11 @@ Responses from the card are encoded with binary phase change modulation, BPSK, u
420468

421469
### NFC-F modulation
422470

423-
The standard corresponds to the ISO18092 and JIS.X.6319 specifications which describe the way it is modulated as well as the applicable timings.
471+
The standard corresponds to the ISO18092 and JIS.X.6319 specifications which describe the way it is modulated as well
472+
as the applicable timings.
424473

425-
Supports speeds from 212 kbps to 848 kbps, both reader and card frames are encoded using either observed or inverted manchester.
474+
Support speeds from 212 kbps to 848 kbps, both reader and card frames are encoded using either observed or reversed
475+
manchester as see below.
426476

427477
![NFCF Manchester](doc/img/nfcf-manchester.png?raw=true "NFC-F manchester reader frame signal")
428478

@@ -436,18 +486,21 @@ Reversed manchester modulation.
436486

437487
### NFC-V modulation
438488

439-
The standard corresponds to the ISO15693 specifications which describe the way it is modulated as well as the applicable timings.
489+
The standard corresponds to the ISO15693 specifications which describe the way it is modulated as well as the
490+
applicable timings.
440491

441-
The coding is based on pulse position modulation (PPM) where the information is encoded by modifying the time when the pulse is
442-
located within each time slot.
492+
The coding is based on pulse position modulation (PPM) where the information is encoded by modifying the time when the
493+
pulse is located within each time slot.
443494

444-
There are two modes, 1 of 4 and 1 of 256, where each symbol encodes 2 and 8 bits respectively, this is the example for the first one.
495+
There are two modes, 1 of 4 and 1 of 256, where each symbol encodes 2 and 8 bits respectively, this is the example for
496+
the first one.
445497

446498
![NFCV PPM 2 bit](doc/img/nfcv-ppm2.png?raw=true "NFC-V PPM reader modulation")
447499

448-
Card responses are encoded with manchester OOK with 848 subcarrier as of NFC-A.
500+
Card responses are encoded using manchester OOK with 848 subcarrier as of NFC-A.
449501

450-
Depending on the code used, the possible speeds are 26Kbps and 53Kbps, however these cards can be read from greater distances.
502+
Depending on the encoding, the possible speeds are 26Kbps and 53Kbps, however these cards can be read from greater
503+
distances.
451504

452505
## Signal processing
453506

@@ -458,16 +511,18 @@ Now we are going to see how to decode this.
458511
Before starting to decode each of these modulations, it is necessary to start with a series of basic signals that will
459512
help us in the rest of the process.
460513

461-
The concepts that I am going to explain next are very well described on Sam Koblenski's page (https://sam-koblenski.blogspot.com/2015/08/everyday-dsp-for-programmers-basic.html) which
462-
I recommend you read to fully understand all the processes related to the analysis that we are going to carry out.
514+
The concepts that I am going to explain next are very well described on Sam Koblenski's page
515+
(https://sam-koblenski.blogspot.com/2015/08/everyday-dsp-for-programmers-basic.html) which I recommend you read to
516+
fully understand all the processes related to the analysis that we are going to carry out.
463517

464-
Remember that the sample received from the SDR receiver is made up of the I / Q values, therefore the first step is to obtain the real signal.
518+
Remember that the sample received from the SDR receiver is made up of the I / Q values, therefore the first step is to
519+
obtain the real signal.
465520

466-
Once we have the real signal, it is necessary to eliminate the continuous component (DC) that will greatly facilitate the
467-
subsequent analysis process. For this we will use a simple IIR filter.
521+
Once we have the real signal, it is necessary to eliminate the continuous component (DC) that will greatly facilitate
522+
the subsequent analysis process. For this we will use a simple IIR filter.
468523

469-
To calculate the modulation depth we need to know the envelope of the signal as if it were not modulated by the pulses or sub-carrier,
470-
for this we will use a simple slow exponential average.
524+
To calculate the modulation depth we need to know the envelope of the signal as if it were not modulated by the pulses
525+
or sub-carrier, for this we will use a simple slow exponential average.
471526

472527
Finally we will obtain the standard deviation or variance of the signal that will help us to calculate the appropriate detection thresholds
473528
based on the background noise.
@@ -490,8 +545,8 @@ in detail.
490545
### Basic notions of signal correlation
491546

492547
The correlation operation is a measure of how much one signal resembles another that serves as a reference. It is used
493-
intensively in digital signal analysis. With analog signals, the correlation of each sample x(t) requires N multiplications, therefore a symbol needs N^2
494-
multiplications, being a costly process.
548+
intensively in digital signal analysis. With analog signals, the correlation of each sample x(t) requires N
549+
multiplications, therefore a symbol needs N^2 multiplications, being a costly process.
495550

496551
But since the reference signal is digital, it only has two possible values 0 or 1, which greatly simplifies the
497552
calculation by eliminating all the multiplications, allowing the correlation to be carried out by process a simple

0 commit comments

Comments
 (0)