You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+98-43Lines changed: 98 additions & 43 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
# SDR nfc-laboratory v2.0
2
2
3
-
NFC signal sniffer and protocol decoder using SDR receiver, capable of demodulate in real-time the comunication
4
-
with contacless cards up to 424Kpbs.
3
+
NFC signal sniffer and protocol decoder using SDR receiver, for demodulator and decoder NFC-A, NFC-B, NFC-F and NFC-V
4
+
signals in real-time up to 424 Kbps.
5
5
6
6
## Description
7
7
@@ -10,10 +10,10 @@ reader.
10
10
11
11
Currently, detection and decoding is implemented for:
12
12
13
-
- NFC-A (ISO14443A): 106kbps ASK modulation, 212kbps and 424kbps with ASK / BPSK modulation.
13
+
- NFC-A (ISO14443A): 106kbps, 212kbps and 424kbps with ASK / BPSK modulation.
14
14
- NFC-B (ISO14443B): 106kbps, 212kbps and 424kbps with ASK / BPSK modulation.
15
-
- NFC-V (ISO15693): 26kbps and 53kbps, 1 of 4 code and 1 of 256 code PPM modulation.
16
-
- NFC-F (Felica): Preliminary, 212kbps and 424kbps, manchester modulation.
15
+
- NFC-V (ISO15693): 26kbps and 53kbps, 1 of 4 code and 1 of 256 code PPM / BPSK modulation (pending FSK).
16
+
- NFC-F (ISO18092): Preliminary support to 212kbps and 424kbps with manchester modulation.
17
17
18
18
## Application screenshots
19
19
@@ -35,7 +35,7 @@ Protocol detail view.
35
35
36
36
## Recommended settings
37
37
38
-
The configuration is found in the file`conf/nfc-lab.conf` and consists of the following sections:
38
+
The configuration file is found in `conf/nfc-lab.conf` and consists of the following sections:
39
39
40
40
```
41
41
[settings]
@@ -58,7 +58,7 @@ Stores the status of the window and controls, nothing very interesting.
58
58
powerLevelThreshold=0.01
59
59
```
60
60
61
-
Minimum absolute signal strength to start decoding.
61
+
Indicates the absolute minimum signal strength to start decoding, 0.5 is the maximum peak.
62
62
63
63
```
64
64
[decoder.nfca]
@@ -83,7 +83,7 @@ maximumModulationThreshold=1.00
83
83
```
84
84
85
85
Each of the sections controls the parameters for the indicated technology. It allows activating or not its detection
86
-
and the minimum and maximum modulation depths to detect the signal. The values that appear here are recommended.
86
+
and the minimum and maximum modulation depths in percentage to detect the signal. The values that appear here are recommended.
87
87
88
88
```
89
89
[device.airspy]
@@ -95,7 +95,7 @@ centerFreq=40680000
95
95
sampleRate=10000000
96
96
```
97
97
98
-
Configuration parameters for the Airspy receiver, the best performance is obtained by tuning in second harmonic
98
+
Configuration parameters for the Airspy receiver, the best performance is obtained by tuning in 3rd harmonic
99
99
at 40.68Mhz.
100
100
101
101
```
@@ -108,7 +108,7 @@ centerFreq=40680000
108
108
sampleRate=2400000
109
109
```
110
110
111
-
Configuration parameters for the RTL-SDR receiver, the best performance is obtained by tuning to the first harmonic
111
+
Configuration parameters for the RTL-SDR receiver, the best performance is obtained by tuning to the 2nd harmonic
112
112
at 27.12Mhz.
113
113
114
114
Decoding with this device is quite limited due to its low sampling frequency and 8-bit resolution,
@@ -142,11 +142,12 @@ Mifare classic card.
142
142
I have tried several receivers obtaining the best results with AirSpy Mini, I do not have more devices, but surely it
143
143
works with others.
144
144
145
-
- AirSpy Mini or R2: Better results, tuning the third harmonic 40.68Mhz, with a sampling frequency of 10 Mbps, with these
146
-
parameters it is possible to capture the communication up to 424 Kbps.
145
+
- AirSpy Mini or R2: Better results, tuning the third harmonic at 40.68Mhz, with a sampling frequency of 10 Mbps,
146
+
with these parameters it is possible to capture the communication up to 424 Kbps.
147
147
148
-
- RTL SDR: It works by tuning the second harmonic 27.12Mhz, due to the limitation in the maximum sampling frequency
149
-
of 3Mbps and its 8 bits of precision only allows you to capture the commands up to 106Kbps and some responses in very clean signals.
148
+
- RTL SDR: It works by tuning the second harmonic at 27.12Mhz, due to the limitation in the maximum sampling frequency
149
+
of 3Mbps and its 8 bits of resolution only allows you to capture the commands up to 106Kbps and some responses in
150
+
very clean signals.
150
151
151
152
Receivers tested:
152
153
@@ -169,9 +170,51 @@ frequency of 13.56Mhz, although I have not tried this combination.
169
170
170
171
The demodulator is designed to run in real time, so it requires a recent computer with a lot of processing capacity.
171
172
172
-
During development, I have opted for a mixed approach where some optimizations are sacrificed in favor of maintaining clarity in the code and facilitating its monitoring and debugging.
173
+
During development, I have opted for a mixed approach where some optimizations are sacrificed in favor of maintaining
174
+
clarity in the code and facilitating its monitoring and debugging.
173
175
174
-
For this reason it is possible that certain parts can be improved in performance, but I have done it as a didactic exercise rather than a production application.
176
+
For this reason it is possible that certain parts can be improved in performance, but I have done it as a didactic
177
+
exercise rather than a production application.
178
+
179
+
## Input / Output file formats
180
+
181
+
The application allows you to read and write files in two different formats:
182
+
183
+
- WAV: Reading signals in standard WAV format with 1 or 2 channels is supported. In the first case, it should contain
184
+
the sample of the signal in absolute real values. If 2 channels are used they should contain the sampling of
185
+
the I / Q components.
186
+
187
+
- JSON: The analyzed signal can be stored in a simple JSON text file or read back from one of them.
188
+
189
+
## Testing files
190
+
191
+
In the "wav" folder you can find a series of samples of different captures for the NFC-A, NFC-B, NFC-F and NFC-V
192
+
modulations with their corresponding analysis inside the "json" files.
193
+
194
+
These files can be opened directly from the NFC-LAB application through the toolbar to see their analysis, but the
195
+
main objective is to pass the unit tests and check the correct operation of the decoder.
196
+
197
+
To run the unit tests, the "nfc-test" artifact must be compiled and launched using the path to the "wav" folder
198
+
as an argument, for example:
199
+
200
+
```
201
+
nfc-test.exe ../wav/
202
+
TEST FILE "test_NFC-A_106kbps_001.wav": PASS
203
+
TEST FILE "test_NFC-A_106kbps_002.wav": PASS
204
+
TEST FILE "test_NFC-A_106kbps_003.wav": PASS
205
+
TEST FILE "test_NFC-A_106kbps_004.wav": PASS
206
+
TEST FILE "test_NFC-A_212kbps_001.wav": PASS
207
+
TEST FILE "test_NFC-A_424kbps_001.wav": PASS
208
+
TEST FILE "test_NFC-A_424kbps_002.wav": PASS
209
+
TEST FILE "test_NFC-B_106kbps_001.wav": PASS
210
+
TEST FILE "test_NFC-B_106kbps_002.wav": PASS
211
+
TEST FILE "test_NFC-F_212kbps_001.wav": PASS
212
+
TEST FILE "test_NFC-F_212kbps_002.wav": PASS
213
+
TEST FILE "test_NFC-V_26kbps_001.wav": PASS
214
+
TEST FILE "test_NFC-V_26kbps_002.wav": PASS
215
+
TEST FILE "test_POLL_ABF_001.wav": PASS
216
+
TEST FILE "test_POLL_AB_001.wav": PASS
217
+
```
175
218
176
219
## Build instructions
177
220
@@ -180,7 +223,7 @@ This project has two main components and is based on Qt5 and MinGW-W64:
180
223
- /src/nfc-app: Application interface based on Qt Widgets
181
224
- /src/nfc-lib: A core library without dependencies of Qt (for other uses)
182
225
183
-
And can be build with mingw-g64
226
+
And it can be compiled with mingw-g64, a minimum version is required to support C++17, recommended 9.0 or higher.
184
227
185
228
### Prerequisites
186
229
@@ -371,7 +414,7 @@ Precompiled installer for x86 64 bit can be found in repository
371
414
## Basic notions of the signals to be analyzed
372
415
373
416
Normal NFC cards work on the 13.56 Mhz frequency, therefore the first step is receive this signal and demodulate to get
374
-
the baseband ASK stream. For this purpose any SDR device capable of tuning this frequency can be used, i have the
417
+
the baseband stream. For this purpose any SDR device capable of tuning this frequency can be used, i have the
375
418
fantastic and cheap AirSpy Mini capable of tuning from 24Mhz to 1700Mhz. (https://airspy.com/airspy-mini/)
376
419
377
420
However, it is not possible to tune 13.56Mhz with this receiver, instead I use the second harmonic at 27.12Mhz or third
@@ -386,29 +429,34 @@ of the signal received in baseband (after I/Q to magnitude transform) for the RE
386
429
387
430

388
431
389
-
As can be seen, it is a signal modulated in 100% ASK that corresponds to the NFC-A REQA 26h command of the NFC specifications,
390
-
the response of the card uses something called load modulation that manifests as a series of pulses on the main signal
391
-
after the command. This is the most basic modulation, but each of the NFC-A / B / F / V standards has its own characteristics.
432
+
As can be seen, it is a signal modulated in 100% ASK that corresponds to the NFC-A REQA 26h command of the NFC
433
+
specifications, the response of the card uses something called load modulation that manifests as a series of pulses on
434
+
the main signal after the command. This is the most basic modulation, but each of the NFC-A / B / F / V standards has
435
+
its own characteristics.
392
436
393
437
### NFC-A modulation
394
438
395
-
The standard corresponds to the ISO14443A specifications which describe the way it is modulated as well as the applicable timings.
439
+
The standard corresponds to the ISO14443A specifications which describe the way it is modulated as well as the
440
+
applicable timings.
396
441
397
-
Reader frames are encoded using 100% ASK using modified miller encoding.
442
+
Reader frames are encoded using 100% ASK with modified miller encoding.
Card responses are encoded with manchester OOK with 848 subcarrier as of NFC-A.
500
+
Card responses are encoded using manchester OOK with 848 subcarrier as of NFC-A.
449
501
450
-
Depending on the code used, the possible speeds are 26Kbps and 53Kbps, however these cards can be read from greater distances.
502
+
Depending on the encoding, the possible speeds are 26Kbps and 53Kbps, however these cards can be read from greater
503
+
distances.
451
504
452
505
## Signal processing
453
506
@@ -458,16 +511,18 @@ Now we are going to see how to decode this.
458
511
Before starting to decode each of these modulations, it is necessary to start with a series of basic signals that will
459
512
help us in the rest of the process.
460
513
461
-
The concepts that I am going to explain next are very well described on Sam Koblenski's page (https://sam-koblenski.blogspot.com/2015/08/everyday-dsp-for-programmers-basic.html) which
462
-
I recommend you read to fully understand all the processes related to the analysis that we are going to carry out.
514
+
The concepts that I am going to explain next are very well described on Sam Koblenski's page
515
+
(https://sam-koblenski.blogspot.com/2015/08/everyday-dsp-for-programmers-basic.html) which I recommend you read to
516
+
fully understand all the processes related to the analysis that we are going to carry out.
463
517
464
-
Remember that the sample received from the SDR receiver is made up of the I / Q values, therefore the first step is to obtain the real signal.
518
+
Remember that the sample received from the SDR receiver is made up of the I / Q values, therefore the first step is to
519
+
obtain the real signal.
465
520
466
-
Once we have the real signal, it is necessary to eliminate the continuous component (DC) that will greatly facilitate the
467
-
subsequent analysis process. For this we will use a simple IIR filter.
521
+
Once we have the real signal, it is necessary to eliminate the continuous component (DC) that will greatly facilitate
522
+
the subsequent analysis process. For this we will use a simple IIR filter.
468
523
469
-
To calculate the modulation depth we need to know the envelope of the signal as if it were not modulated by the pulses or sub-carrier,
470
-
for this we will use a simple slow exponential average.
524
+
To calculate the modulation depth we need to know the envelope of the signal as if it were not modulated by the pulses
525
+
or sub-carrier, for this we will use a simple slow exponential average.
471
526
472
527
Finally we will obtain the standard deviation or variance of the signal that will help us to calculate the appropriate detection thresholds
473
528
based on the background noise.
@@ -490,8 +545,8 @@ in detail.
490
545
### Basic notions of signal correlation
491
546
492
547
The correlation operation is a measure of how much one signal resembles another that serves as a reference. It is used
493
-
intensively in digital signal analysis. With analog signals, the correlation of each sample x(t) requires N multiplications, therefore a symbol needs N^2
494
-
multiplications, being a costly process.
548
+
intensively in digital signal analysis. With analog signals, the correlation of each sample x(t) requires N
549
+
multiplications, therefore a symbol needs N^2 multiplications, being a costly process.
495
550
496
551
But since the reference signal is digital, it only has two possible values 0 or 1, which greatly simplifies the
497
552
calculation by eliminating all the multiplications, allowing the correlation to be carried out by process a simple
0 commit comments