From 6e6f4658411cb7f387bb6868c9586aac1cd4cb26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=90=D0=BD=D1=82=D0=BE=D0=BD=20=D0=A2=D1=80=D0=BE=D1=88?= =?UTF-8?q?=D0=B8=D0=BD?= Date: Tue, 20 Oct 2026 19:02:20 +0300 Subject: [PATCH] v1.9.7: spec fixes, T=1/parity, EOF guards, dead code + rate scaling The audit's P2 items: - ODD_INS: add 0x73 MANAGE SECURE CHANNEL and 0x75 TRANSACT DATA (TS 102 221 Table 10.5); the tools/vs_reader.py mirror and the pinned test are updated. - 9E/9F are SW1: ISO 7816-3 10.3.3 Table 11 makes every 9X value SW1. Remove the fabricated "extended-length procedure byte" that consumed SW2 as a length and lost the status word. - T=1: EOF-guard every block read, bound the M-bit chain with T1_CHAIN_MAX, and drop the caller's duplicate chain loop -- it read the next block after every I-block (usually the peer's R-block) and merged the following I-block's INF into the packet. R/S blocks emit nothing; the (possibly chained) I-block INF is the APDU payload. - Parity: a packet containing a parity-error byte is emitted with GSMTAP_FLAG_BAD_FCS (the CHKSUM annotation was invisible downstream), with a log note when the exchange is otherwise clean. - EOF guards: handle_atr (TA/TB/TC/TD, historical, TCK), handle_pps (request/response fields incl. PPS1-3) and the T=1 block parser return cleanly on a truncated capture instead of raising on None. - Dead code: _edge_read was initialized True and never cleared, so the ATR-based T=0 procedure loop (58 lines) and the 1.5-ETU guard branch were unreachable. Remove the flag, both dead paths and the branch; dedent the live loop (behavior unchanged). - Samplerate scaling: _samples_for_us() replaces the hard-coded 16 MHz thresholds -- start-bit deglitch (0.125 us), min_high floor (0.25 us) and the ETU glitch floor (0.75 us). At 16 MHz the values are unchanged. Validation: 130/130 unit tests (13 new: 9E/9F SW1, parity BAD_FCS, T=1 I/R/S blocks + M chain + truncations + one-block-per-step, PPS truncations, truncated ATR TA, samplerate/ETU-floor vectors); the 10-trace suite is unchanged from v1.9.6 (identical APDU/CHKSUM/CONCAT/ BAD_FCS counts, RESULT: OK); compare_baseline.sh reports IDENTICAL. VERSION -> 1.9.7. --- AGENTS.md | 110 +++++--- README.md | 12 +- README_RUS.md | 13 +- pd.py | 606 +++++++++++++++++++++---------------------- tests/baseline.txt | 37 ++- tests/test_gsmtap.py | 172 +++++++++++- tools/vs_reader.py | 2 +- 7 files changed, 593 insertions(+), 359 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 4fc128e..f841850 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -142,10 +142,10 @@ the reader log for all reader exchanges: Both traces show 0 garbage APDUs, 0 payload mismatches, and RESULT: OK. -**Root cause:** `_edge_read` is initialized to `True` and never set to -`False`, so the edge-read T=0 procedure loop (lines 1808–1895) always -executes — the ATR-based procedure loop (lines 1898–1941) is dead code. -The edge-read path had two bugs: +**Root cause:** `_edge_read` was initialized to `True` and never set to +`False`, so the edge-read T=0 procedure loop always executed and the +ATR-based procedure loop was dead code. **FIXED (v1.9.7):** the flag and +the dead loop are removed. The edge-read path had two bugs: 1. **NULLs treated as command data (FIXED).** The first post-header byte was checked for ACK; if it was NULL (0x60), it entered the case-3/4 @@ -333,6 +333,54 @@ Known limitation: no on-disk fixture reproduces the exact live failure (all real captures contain a 372 ATR), so end-to-end proof needs a re-captured `.sr` from the failing phone; the unit tests cover the loop-escape logic. +### v1.9.7: spec fixes, T=1/parity, EOF guards, dead code + rate scaling + +The audit's P2 items: + +- **Odd INS set completed.** `0x73` MANAGE SECURE CHANNEL and `0x75` + TRANSACT DATA (TS 102 221 Table 10.5) join `ODD_INS`; the mirrored set in + `tools/vs_reader.py` and the pinned test are updated. +- **9E/9F are SW1.** ISO 7816-3 §10.3.3 Table 11: every `9X` value is + SW1. The fabricated "extended-length procedure byte" (it consumed the + next byte as a length, eating SW2 and losing the status word) is gone. + The second copy lived in the dead ATR-based loop removed below. +- **T=1 blocks.** `t1_parse_block()` EOF-guards every read (a truncated + block returns no half INF instead of raising) and bounds the M-bit chain + with `T1_CHAIN_MAX` instead of unbounded recursion. The caller's + duplicate "chain follow-up" loop -- it read the *next* block after every + I-block, usually the peer's R-block, and merged the following I-block's + INF into the packet -- is gone. R/S blocks emit nothing; the (possibly + chained) I-block INF is emitted as the APDU payload. No T=1 trace + exists in the corpus, so this is unit-tested only. +- **Parity flag.** A packet containing a parity-error byte is now emitted + with `GSMTAP_FLAG_BAD_FCS` (the CHKSUM annotation alone was invisible to + downstream tooling), with a log note when the exchange is otherwise + clean. +- **EOF guards.** `handle_atr()` (TA/TB/TC/TD, historical bytes, TCK) and + `handle_pps()` (request and response fields, including the optional + PPS1-3) return cleanly on a truncated capture instead of raising on a + None byte; the T=1 block parser likewise. +- **Dead code removed.** `_edge_read` was initialized `True` and never + cleared, so the "ATR-based" T=0 procedure loop (58 lines) never ran and + the 1.5-ETU guard branch was unreachable. The flag and both dead paths + are removed; the edge reader is the only T=0 framing reader (the + CLK-sync reader is selected by `_clock_skip_confident`). The live loop + was dedented, not rewritten -- the trace metrics are unchanged. +- **Samplerate scaling.** `_samples_for_us()` replaces the hard-coded + 16 MHz thresholds: the start-bit deglitch (`_min_pulse_samples`; `None` + = 2 samples @ 16 MHz), the `min_high` floor (0.25 us) and the ETU glitch + floor in `_etu_candidate` (0.75 us). At 16 MHz the values are + unchanged; another capture rate now scales instead of breaking the + filters. + +Validation: 130/130 unit tests (13 new: 9E/9F SW1 for both values, the +parity BAD_FCS flag, T=1 I/R/S blocks + M chain + two truncation cases ++ a one-block-per-step caller test + two PPS truncations, the truncated +ATR TA, the samplerate/ETU-floor vectors); the 10-trace suite is +unchanged from v1.9.6 (identical +APDU/CHKSUM/CONCAT/BAD_FCS counts, `RESULT: OK` everywhere); +`compare_baseline.sh` reports IDENTICAL. VERSION -> 1.9.7. + ### v1.9.6: ETU lock validation, hunt recovery, resync + ATR acceptance The audit's P1 findings. The validation helpers are unit-tested; the trace @@ -838,13 +886,11 @@ The 2-sample advance in `wait_data_falling` shifts `_start_fall` by 2 samples, but at Samsung's 16 CLK/ETU (~72 samples) this is negligible (<3% of a bit period) and does not affect downstream byte reading. -**Design note: magic number.** `_min_pulse_samples = 2` is tuned for the -primary 16 MHz sample rate (2 samples ≈ 125 ns, well within the FX2LP -pull-up rise time of 200–500 ns). At other sample rates the value would -need adjustment — but since all current traces are 16 MHz, this is left -as a hardcoded constant rather than a decoder option. If 12 MHz or -24 MHz traces are added later, consider making it configurable or -scaling it from the sample rate. +**Design note: pulse threshold.** `_min_pulse_samples` used to be a +hard-coded 2 samples, tuned for the 16 MHz corpus (≈125 ns, within the +FX2LP pull-up rise time of 200–500 ns). Since v1.9.7 it is `None` by +default and scales from `samplerate` (`_samples_for_us(0.125)` → 2 at +16 MHz); a test or option may still override it (0 disables the check). **Logging.** Each rejected start-bit glitch is logged with a running count (`start-bit glitch rejected (#N)`) visible in the session log. @@ -868,8 +914,7 @@ window may be filtering real start bits. | ACK (== INS or == ~INS) | Full data match: card acknowledges and expects all P3 data bytes | | INS^0x01 or ~INS^0x01 | Single-byte match: card validates syntax but processes data one byte at a time | | 0x60 | NULL: card busy, wait for next procedure byte (never an SW1) | -| 0x9E / 0x9F | Extended-length: next byte L = number of response data bytes, then SW | -| SW1 (`0x61`–`0x6F` / `0x9X`) | Status word: exchange complete | +| SW1 (`0x61`–`0x6F` / `0x90`–`0x9F`) | Status word: exchange complete. ISO 7816-3 §10.3.3 Table 11 has no exception for `9X`: `9E`/`9F` are SW1 too (the v1.9.7 fix) | ##### CLA (Class) Byte — Coding and Logical Channels @@ -971,7 +1016,7 @@ append the measured CLK frequency when known ### Versioning -The decoder version is defined in `pd.py` as `VERSION = '1.9.6'`. +The decoder version is defined in `pd.py` as `VERSION = '1.9.7'`. The version is printed to the log on decoder startup. ### Testing after decoder changes @@ -1166,7 +1211,8 @@ framing classifies the first post-header byte in this order (v1.9.5): the following exchanges could be merged silently). - **~INS** → byte-by-byte transfer: one data byte per ACK, read until SW. - Otherwise → case 3/4: the byte is terminal command data; read `P3` - command-data bytes, then the card's procedure byte (ACK/SW/`9E`/`9F`). + command-data bytes, then the card's procedure byte (ACK/SW; `9E`/`9F` + are SW1, not an extended length). On ACK, append any inline response data until SW (ISO 7816-3 §12.2 maps case 4 to a separate GET RESPONSE, so conforming cards send SW/61XY here; the append is a permissive extension). @@ -1213,15 +1259,19 @@ discarded ideas. "Proven" = kept in `pd.py`; "Rejected" = do not re-add. `clock_skip=369` before this fix). Logs "RST low at start: expecting cold-boot ATR". Decodes the full cold-boot ATR on `xiaomi_mi_a1_coldboot_sample.sr` / `4gmodem_coldboot_sample.sr` (0 GARBAGE). -- **1.5-ETU start-bit guard.** Rejects the phantom `0x00` an idle glitch - inserts before an ATR. Reliable. +- **Half-ETU start-bit guard (edge reader).** Rejects the phantom `0x00` + an idle glitch inserts before an ATR while still accepting the ~1-ETU + inter-byte gap on fast ETUs (v1.9.7 removed the unreachable 1.5-ETU + CLK-sync branch). Reliable. - **VCC/RST 10 ms level-stability hysteresis.** Reports a level only after ≥10 ms stable. Reliable; symmetric power-up/down, kills spurious events from a ringing/floating sense line. - **PPS speed-switch follow (`clock_skip = F/D`).** After an accepted PPS the native skip becomes F/D CLK cycles/bit. Reliable (verified live). -- **T=1 block-chain follow-up bound.** Caps chained I-blocks so garbage - cannot loop forever. Reliable. +- **T=1 block decode (v1.9.7).** NAD/PCB/LEN/INF/LRC with the M-bit chain + followed inside `t1_parse_block()` (bounded by `T1_CHAIN_MAX`) and every + read EOF-guarded; R/S blocks carry no INF and are not emitted. Unit + tested only (no T=1 capture in the corpus). Reliable by construction. - **Hunt give-up (no synthetic ATR).** After `ATR_HUNT_FAIL_LIMIT` failed hunts the decoder resumes DATA without fabricating an ATR (v1.6.0 removed the old `[0x3B, 0x00]` fallback); the mid-session ETU estimator then @@ -1235,7 +1285,8 @@ discarded ideas. "Proven" = kept in `pd.py`; "Rejected" = do not re-add. v1.9.6); a rate that fails parity is invalidated and re-measured. - **Edge-list bit reader (`_read_byte_edges`).** Per-byte edge reconstruction from the DATA edge list (re-anchors the next byte via `_next_start_fall`). - Drift-immune. Reliable for mid-session/edge mode; gated by `_edge_read`. + Drift-immune. The T=0 framing reader; the CLK-sync reader is selected + when `_clock_skip_confident` is set (`_edge_read` removed in v1.9.7). - **`decode_step` unified dispatch.** One state machine handles ATR/PPS/DATA + mid-session. Reliable; current architecture. - **`hasT0`/`hasT1` guards + init.** Prevents `AttributeError` and skips byte @@ -1246,10 +1297,11 @@ discarded ideas. "Proven" = kept in `pd.py`; "Rejected" = do not re-add. else command data (case 3/4). Reliable for consolidating STK envelope commands. P3-bounded reads avoid FCP tag misidentification (v1.1.1 reverted read-until-SW from v1.1.0). -- **1.5-ETU start-bit guard in `wait_data_falling`.** `min_high = 1.5 * - bit_samples` distinguishes genuine inter-byte idle gaps (≥2 ETU per ISO - 7816-3) from intra-byte HIGH periods (≤1 ETU). Prevents byte misalignment - after `_measure_etu()` consumption (v1.1.1 fix for post-ATR desync). +- **Half-ETU start-bit guard in `wait_data_falling` (v1.9.7).** `min_high + = 0.5 * bit_samples` (with a rate-scaled floor) rejects intra-byte glitch + falls while accepting the ~1-ETU inter-byte gap; the next byte's start is + queued by the edge reader (`_next_start_fall`), so no 1.5-ETU guard is + needed on this path. - **Inverse-convention support (TS=0x3F, v1.9.6).** The hunt already read `0x3F`; the DATA state now accepts it too, the start bit stays a falling edge from an idle-HIGH line (ISO 7816-3 7.1), and `get_bytes()` assembles @@ -1288,11 +1340,11 @@ discarded ideas. "Proven" = kept in `pd.py`; "Rejected" = do not re-add. `P3`) with P3-bounded reads for all paths (v1.1.1 reverted the read-until-SW experiment from v1.1.0 which mis-identified FCP `0x62` as SW1). -- **0.5-ETU start-bit guard in `wait_data_falling` (for `_edge_read`).** - `min_high = 0.5 * bit_samples` was too small for slow ETUs — it accepted - intra-byte HIGH periods (data bit transitions) as start bits, causing byte - misalignment after `_measure_etu()` consumption. Replaced by 1.5-ETU guard - in v1.1.1. +- **0.5-ETU start-bit guard for the ATR-based CLK-sync loop.** It was + rejected in v1.1.1 for that path (it accepted intra-byte HIGH periods on + slow ETUs). The path was dead (`_edge_read` never False) and is removed + in v1.9.7; the surviving edge reader uses the 0.5 guard because its next + start bit is queued by `_next_start_fall` (no re-hunt mid-burst). ### Open residual limitations diff --git a/README.md b/README.md index 596dc68..212526c 100644 --- a/README.md +++ b/README.md @@ -55,10 +55,13 @@ this decoder's `pcap_file=` option). | RST tracking (optional) | `rst_detect=true`: emits reset assert/deassert events (sub_type 0x10) | | VCC tracking (optional) | `vcc_detect=true`: emits power on/off events (sub_type 0x11) | | Direct PCAP file | `pcap_file=` writes PCAP without shell redirection | -| Start-bit deglitch | 2-sample deglitch in the start-bit detector eliminates sub-ETU LOW glitches from FX2LP pull-up artifacts, preventing byte misalignment on fast phone traces | +| Start-bit deglitch | Deglitch in the start-bit detector (2 samples at 16 MHz, scaled from the sample rate since v1.9.7) eliminates sub-ETU LOW glitches from FX2LP pull-up artifacts, preventing byte misalignment on fast phone traces | | Mid-session ETU lock | The DATA-edge ETU estimator rejects guard-only (all-zero) and single-spacing bursts and invalidates a rate that fails parity, so a capture at a non-default F/D locks safely | | ATR / resync guards | A DATA-state `0x3B`/`0x3F` is an ATR candidate only before the first APDU; parity-dirty or bare (TS+T0) frames are ignored, and `resync_idle` really waits for the idle level | | Inverse convention | TS=0x3F ATRs follow ISO 7816-3 7.1: inverted data, msb first, start bit still LOW from an idle-HIGH line | +| T=1 blocks | NAD/PCB/LEN/INF/LRC decode with M-bit chaining; the I-block INF is emitted as the APDU, R/S blocks are not; a truncated capture ends cleanly | +| Parity flag | A packet containing a parity-error byte is emitted with the GSMTAP BAD_FCS flag (not just an annotation) | +| Rate-aware thresholds | Start-bit deglitch, guard floors and the ETU glitch floor scale from the capture sample rate instead of assuming 16 MHz | ## Decoder options @@ -158,7 +161,8 @@ shift the whole ATR parse off-by-one). The decoder now: - never lets a decode exception kill the capture — errors are logged, annotated, and the state machine resyncs (end-of-stream still exits cleanly); -- bounds T=1 block-chain follow-up so garbage cannot loop forever. +- decodes T=1 blocks (NAD/PCB/LEN/INF/LRC) and bounds the M-bit chain so garbage + cannot loop forever. After an accepted PPS the decoder **follows the speed switch**: in native CLK mode `clock_skip` becomes F/D CLK cycles per bit (e.g. @@ -170,7 +174,7 @@ answer with a fresh ATR at the default 372 cycles/bit. The decoder **re-arms the ATR hunt on RST deassert**: state back to `FIND START`, native skip reset to 372, hunt count cleared — so the re-ATR parses as an ATR instead of being mis-read as TPDU traffic at the PPS-negotiated -rate. A **1.5-ETU start-bit guard** additionally rejects the phantom +rate. A **half-ETU start-bit guard** (edge reader) additionally rejects the phantom `0x00` an idle glitch can insert before that ATR. Requires `rst_detect=true` (the `rst` channel assigned); without it a mid-session reset is still mis-read. @@ -186,7 +190,7 @@ mis-read as a "premature abort", but there was never a device fault. Most of the early "noise" seen in captures (parity errors, mis-framed garbage, a bouncing VCC line) was a badly-decoded state machine, not the hardware: re-seating the tap did nothing, while the decoder rewrite fixed -it completely (warm-reset re-arm, 1.5-ETU start-bit guard, 10 ms VCC +it completely (warm-reset re-arm, half-ETU start-bit guard, 10 ms VCC debounce, T=0 exchange reassembly). A clean capture now decodes to zero garbage — see the `vs_reader.py` validation below. diff --git a/README_RUS.md b/README_RUS.md index ed6a43e..1177274 100644 --- a/README_RUS.md +++ b/README_RUS.md @@ -58,10 +58,13 @@ GSMTAP pcap-файлы (включая PCAP, который этот декод | Отслеживание RST (опционально) | `rst_detect=true`: события assert/deassert сброса (sub_type 0x10) | | Отслеживание VCC (опционально) | `vcc_detect=true`: события включения/выключения питания (sub_type 0x11) | | PCAP сразу в файл | `pcap_file=` пишет PCAP без перенаправления вывода оболочки | -| Деглитч стартового бита | Деглитч в 2 отсчёта в детекторе стартового бита убирает LOW-глитчи короче ETU от артефактов подтяжки FX2LP и предотвращает смещение байтов на быстрых телефонных трассах | +| Деглитч стартового бита | Деглитч в детекторе стартового бита (2 отсчёта при 16 МГц, с v1.9.7 масштабируется от частоты дискретизации) убирает LOW-глитчи короче ETU от артефактов подтяжки FX2LP и предотвращает смещение байтов на быстрых телефонных трассах | | Захват ETU в середине сессии | Оценщик ETU по фронтам DATA отбрасывает пачки только со сторожевым интервалом (нулевые данные) и одиночные интервалы, а также сбрасывает скорость, не прошедшую проверку чётности, поэтому трасса с нестандартным F/D захватывается надёжно | | Защита ATR / ресинхронизации | `0x3B`/`0x3F` в состоянии DATA считается кандидатом в ATR только до первого APDU; кадры с ошибкой чётности или голый TS+T0 игнорируются, а `resync_idle` действительно ждёт уровень простоя | | Инверсная конвенция | ATR с TS=0x3F разбирается по ISO 7816-3 7.1: инверсные данные, msb первым, стартовый бит по-прежнему LOW при простое линии HIGH | +| Блоки T=1 | Разбор NAD/PCB/LEN/INF/LRC с цепочкой по биту M; INF I-блока выдаётся как APDU, R/S-блоки не выдаются; обрезанная запись завершается чисто | +| Флаг чётности | Пакет с байтом с ошибкой чётности выдаётся с флагом GSMTAP BAD_FCS (не только аннотацией) | +| Пороги от частоты | Деглитч стартового бита, пороги защиты и порог глитча ETU масштабируются от частоты дискретизации, а не считаются от 16 МГц | ## Опции декодера @@ -163,8 +166,8 @@ flags) USB-протокола simtrace2 и не является частью с - никогда не даёт исключению при декодировании убить запись — ошибки логируются, аннотируются, а конечный автомат ресинхронизируется (конец потока по-прежнему завершается чисто); -- ограничивает продолжение цепочки T=1-блоков, чтобы мусор не мог - зациклиться навсегда. +- разбирает блоки T=1 (NAD/PCB/LEN/INF/LRC) и ограничивает цепочку по биту M, + чтобы мусор не мог зациклиться навсегда. После принятого PPS декодер **следует переключению скорости**: в режиме native CLK `clock_skip` становится равным F/D тактов CLK на бит (например, @@ -178,7 +181,7 @@ native CLK `clock_skip` становится равным F/D тактов CLK `FIND START`, native-пропуск сбрасывается в 372, счётчик охоты очищается — поэтому повторный ATR разбирается как ATR, а не ошибочно читается как TPDU-трафик на скорости, согласованной PPS. **Защита стартового бита в -1.5 ETU** дополнительно отбрасывает фантомный `0x00`, который глитч на +0.5 ETU** (edge-ридер) дополнительно отбрасывает фантомный `0x00`, который глитч на холостом ходу может вставить перед этим ATR. Требуется `rst_detect=true` (назначенный канал `rst`); без него сброс в середине сессии всё равно будет прочитан неверно. @@ -196,7 +199,7 @@ TPDU-трафик на скорости, согласованной PPS. **За неверного кадрирования, дребезг линии VCC) была следствием плохо декодированного конечного автомата, а не железа: переподключение съёма ничего не давало, а переписанный декодер полностью это вылечил (re-arm по -тёплому сбросу, защита стартового бита 1.5 ETU, антидребезг VCC 10 мс, +тёплому сбросу, защита стартового бита 0.5 ETU, антидребезг VCC 10 мс, сборка обмена T=0). Чистая запись теперь декодируется с нулём мусора — см. проверку `vs_reader.py` ниже. diff --git a/pd.py b/pd.py index 295f2af..7263c08 100644 --- a/pd.py +++ b/pd.py @@ -28,7 +28,7 @@ from .gsmtap_stream import (GsmtapStreamSender, GSMTAP_SIM_RST_EVENT, GSMTAP_SIM_VCC_EVENT, GSMTAP_FLAG_BAD_FCS) -VERSION = '1.9.6' +VERSION = '1.9.7' @@ -170,7 +170,7 @@ def plausible_cla(cla): # lands on a data byte -- the text run "I M" (0x49 0x4D) started a bogus # frame on xiaomi_phone_sample when every odd INS was accepted. ODD_INS = frozenset(( - 0x0F, 0x21, 0x87, 0x89, 0xA1, 0xB1, 0xB3, + 0x0F, 0x21, 0x73, 0x75, 0x87, 0x89, 0xA1, 0xB1, 0xB3, 0xC3, 0xCB, 0xDB, 0xD1, 0xD7, 0xDD, )) @@ -382,6 +382,7 @@ MAX_RESYNC_ATTEMPTS = 1024 # bail out if no idle gap found in that many tries # idle 0xFF forever at the wrong rate and can never reach the DATA state, # where the live ETU is measured -- a deadlock. These cap the retries. ATR_HUNT_ETU_ATTEMPTS = 3 # live-ETU recovery attempts before resuming DATA +T1_CHAIN_MAX = 32 # T=1 I-block M-bit chain depth bound ATR_HUNT_IDLE_RESETS = 3 # all-0xFF hunt resets before resuming DATA ATR_HUNT_FAIL_LIMIT = 12 # total failed hunt rounds before resuming DATA @@ -569,7 +570,6 @@ class Decoder(srd.Decoder): # uses bit_samples) is the safe fallback. self._clock_skip_confident = False self._start_fall = None - self._edge_read = True self._last_sn = -1 # Bounded allowance for steps that consume only queued bytes # (_replay / peeked_byte) and therefore do not advance the sample @@ -577,7 +577,7 @@ class Decoder(srd.Decoder): # would mistake a re-frame step for end-of-capture. self._no_advance = 0 self._eof = False - self._min_pulse_samples = 2 # tuned for 16 MHz sample rate + self._min_pulse_samples = None # None = scale with samplerate (2 @ 16 MHz) self._glitch_rejects = 0 self._prev_wait_sn = None self._stall = 0 @@ -798,6 +798,18 @@ class Decoder(srd.Decoder): return (cand, cand_sn, cand, lvl, now) return (None, 0, confirmed, lvl, now) + def _samples_for_us(self, us): + '''Return the sample count for a duration in microseconds, scaled + to the capture samplerate. + + The glitch/pulse thresholds used to be hard-coded for 16 MHz + (`_min_pulse_samples = 2`, `min_high = 4`, `MIN_ETU = 12`); at + another rate those become far too large or too small. The examples + are 16 MHz, which is also the fallback when the framework has not + reported a rate (unit tests, older sigrok-cli).''' + sr = getattr(self, 'samplerate', None) or 16000000 + return max(1, int(round(float(sr) * us / 1000000.0))) + def _clk_hz(self): '''Return the measured CLK frequency in Hz, or None when unknown. @@ -1066,7 +1078,9 @@ class Decoder(srd.Decoder): has a smaller spacing somewhere, so the guard pattern is distinguishable when every non-minimum spacing is at least 2x the minimum.''' - MIN_ETU = 12 + # ~0.75 us: 12 samples at 16 MHz. A real ETU is far longer, but a + # glitch can be shorter; scale with the capture rate. + MIN_ETU = self._samples_for_us(0.75) valid = [p for p in pairs if p[0] >= MIN_ETU] if len(valid) >= 2: med = sorted(p[0] for p in valid)[len(valid) // 2] @@ -1148,7 +1162,6 @@ class Decoder(srd.Decoder): # (immune to the drift of fixed sample-skip timing) for every byte. # The CLK-sync reader is used once _derive_clock_skip_from_etu() # has a real measurement; a parity failure invalidates it. - self._edge_read = True if self._etu_measured: self.log("etu recovered (samples):", self.bit_samples) @@ -1577,20 +1590,13 @@ class Decoder(srd.Decoder): The bit period is measured directly from the DATA line in SAMPLES (not by counting CLK edges), so a frozen CLK during Clock Stop Mode cannot desync the decoder. A start bit is accepted only after DATA - has been HIGH for >= 1.5 bit periods (inter-character guard, rejects - intra-byte edges / idle glitches).''' - min_high = 4 + has been HIGH for >= half an ETU: this rejects intra-byte glitch + falls yet still accepts the legitimate inter-byte gap (the ~1-etu + stop bit), which a 1.5-etu guard would wrongly reject on fast ETUs + (e.g. a phone SIM at ~53 samples/etu).''' + min_high = self._samples_for_us(0.25) if self.bit_samples: - if self._edge_read: - # DATA must be HIGH (idle) for at least half an etu before a - # fall is accepted as a start bit. This rejects intra-byte - # glitch falls yet still accepts the legitimate inter-byte gap - # (the ~1-etu stop bit), which a 1.5-etu guard would wrongly - # reject on fast ETUs (e.g. a phone SIM at ~53 samples/etu), - # causing bytes to be skipped / 0x00 inserted. - min_high = max(int(0.5 * self.bit_samples), 4) - else: - min_high = max(int(1.5 * self.bit_samples), 4) + min_high = max(int(0.5 * self.bit_samples), min_high) while True: # Wait for DATA idle, servicing RST/VCC. # ISO 7816-3 7.1: the line idles HIGH and the start bit is @@ -1630,8 +1636,11 @@ class Decoder(srd.Decoder): break if (self.samplenum - hi_start) < min_high: continue - if self._min_pulse_samples > 0: - pins = self.wait({'skip': self._min_pulse_samples}) + pulse = self._min_pulse_samples + if pulse is None: + pulse = self._samples_for_us(0.125) # 2 samples @ 16 MHz + if pulse > 0: + pins = self.wait({'skip': pulse}) if pins is not None: bit = pins[self.DATA_IDX] idle_val = 1 # line HIGH is idle in both conventions @@ -1674,10 +1683,9 @@ class Decoder(srd.Decoder): self.peeked_byte = None self.peeked_samplenum = -1 return byte; - # In edge-read (mid-session, gated-CLK) mode the next start bit is - # already queued by _read_byte_edges, so re-hunting would wrongly - # reject the short inter-byte gap. Otherwise re-hunt normally. - if not (self._edge_read and self._start_fall is not None): + # The next start bit is already queued by _read_byte_edges, so + # re-hunting would wrongly reject the short inter-byte gap. + if self._start_fall is None: self.wait_data_falling() if self._eof: return None @@ -1688,7 +1696,7 @@ class Decoder(srd.Decoder): return self._replay[0] if (self.peeked_byte != None): return self.peeked_byte - if not (self._edge_read and self._start_fall is not None): + if self._start_fall is None: self.wait_data_falling() if self._eof: return None @@ -1967,18 +1975,26 @@ class Decoder(srd.Decoder): return if (firstT0 & 0b00010000): byte = self.read_byte() + if byte is None: + return tA.append(byte) self.ATR.append(byte) if (firstT0 & 0b00100000): byte = self.read_byte() + if byte is None: + return tB.append(byte) self.ATR.append(byte) if (firstT0 & 0b01000000): byte = self.read_byte() + if byte is None: + return tC.append(byte) self.ATR.append(byte) if (firstT0 & 0b10000000): byte = self.read_byte() + if byte is None: + return if ((byte & 0x0F) == 0): self.hasT0 = True elif ((byte & 0x0F) == 1): @@ -1997,6 +2013,8 @@ class Decoder(srd.Decoder): for _ in range(0, t0 & 0x0F): byte = self.read_byte() + if byte is None: + return self.ATR.append(byte) if (self.hasT1 == False and self.hasT0 == False): @@ -2004,6 +2022,8 @@ class Decoder(srd.Decoder): if (self.hasT1 == True or self.hasT15): byte = self.read_byte() + if byte is None: + return self.ATR.append(byte) xor = 0 for i in range(1, len(self.ATR)): xor = xor ^ self.ATR[i] @@ -2068,19 +2088,31 @@ class Decoder(srd.Decoder): self.hasT0 = False self.hasT1 = True - def t1_parse_block(self, es): + def t1_parse_block(self, es, depth=0): + '''Parse one T=1 block (NAD, PCB, LEN, INF, LRC) and return + (is_i_block, inf_bytes). + + An I-block with the M bit set is followed by the chain of further + I-blocks in the same direction; their INF fields are concatenated + (the T=1 application APDU may span them). Every read is + EOF-guarded -- a truncated capture returns no half block instead of + raising -- and the chain is bounded by T1_CHAIN_MAX so a garbage + M bit cannot recurse without limit.''' packet = [] - lrc = 0; nad = self.read_byte() - lrc = lrc ^ nad + if nad is None: + return (False, packet) + lrc = nad self.put(es, self.samplenum, self.out_ann, [1, "NAD:" + hex(nad)]) sad = nad & 0x70 dad = nad & 0x07 self.log("T=1 NAD=", hex(nad), "SAD=", hex(sad), "DAD=", hex(dad)) - + pcb = self.read_byte() + if pcb is None: + return (False, packet) lrc = lrc ^ pcb - + isSBlock = False isRBlock = False isIBlock = False @@ -2101,15 +2133,23 @@ class Decoder(srd.Decoder): self.log("PCB I-Block", hex(pcb)) bLen = self.read_byte() + if bLen is None: + return (False, packet) lrc = lrc ^ bLen if (bLen > 0): - for _ in range(bLen): + for _ in range(bLen): byte = self.read_byte() + if byte is None: + self.log("T=1 block truncated in INF at EOF") + return (False, []) lrc = lrc ^ byte if (isIBlock): packet.append(byte) - - # CRC to implement - bLrc = self.read_byte() + + # CRC to implement (TC1 b0); LRC only for now. + bLrc = self.read_byte() + if bLrc is None: + self.log("T=1 block truncated before the LRC at EOF") + return (False, []) lrc = lrc ^ bLrc if (lrc != 0): @@ -2125,17 +2165,14 @@ class Decoder(srd.Decoder): if (isSBlock): self.put(es, self.samplenum, self.out_ann, [8, ["S-Block", "S-Block flag={flag:02x}".format(flag=pcb & 0b00111111)]]) - if (isIBlock and pcb & 0b00100000): # m-flag + if (isIBlock and pcb & 0b00100000 and depth < T1_CHAIN_MAX): self.log("T=1 Multiblock flag", hex(pcb)) - for _ in range(32): # bounded: garbage must not loop forever - isIBlock2,packet2 = self.t1_parse_block(self.samplenum) - if (isIBlock2): - packet = packet + packet2 - break - + next_is_i, packet2 = self.t1_parse_block(self.samplenum, depth + 1) + if next_is_i: + packet = packet + packet2 + + return isIBlock, packet - return isIBlock,packet; - def handle_pps(self): # Mark PPS attempted so idle 0xFF bytes after a failed/no-PPS # scenario do not loop back into PPS detection indefinitely. @@ -2143,8 +2180,12 @@ class Decoder(srd.Decoder): lrc = 0 ss = self.peeked_samplenum pps = self.read_byte() + if pps is None: + return pps_req = [pps] pps0 = self.read_byte() + if pps0 is None: + return pps_req.append(pps0) # An idle I/O line idles HIGH (repeated 0xFF). A genuine PPS0 always # has its reserved bits clear (bit7 and bits 0..3 == 0), so the value @@ -2159,17 +2200,25 @@ class Decoder(srd.Decoder): pps1 = 0; pps2 = 0; pps3 = 0 if (pps0 & 0b00010000): pps1 = self.read_byte() + if pps1 is None: + return pps_req.append(pps1) lrc = lrc ^ pps1 if (pps0 & 0b00100000): pps2 = self.read_byte() + if pps2 is None: + return pps_req.append(pps2) lrc = lrc ^ pps2 if (pps0 & 0b01000000): pps3 = self.read_byte() + if pps3 is None: + return pps_req.append(pps3) lrc = lrc ^ pps3 pck = self.read_byte() + if pck is None: + return pps_req.append(pck) lrc = lrc ^ pps ^ pps0 ^ pck if (lrc != 0): @@ -2182,26 +2231,38 @@ class Decoder(srd.Decoder): r_lrc = 0 r_pps = self.read_byte() + if r_pps is None: + return pps_rsp = [r_pps] r_pps1 = 0; r_pps2 = 0; r_pps3 = 0 if (r_pps != 0xFF): self.put(ss, self.samplenum, self.out_ann, [0, ["PPS Request not confirmed"]]) self.log("PPS Request not confirmed", r_pps) r_pps0 = self.read_byte() + if r_pps0 is None: + return pps_rsp.append(r_pps0) if (r_pps0 & 0b00010000): r_pps1 = self.read_byte() + if r_pps1 is None: + return pps_rsp.append(r_pps1) r_lrc = r_lrc ^ r_pps1 if (r_pps0 & 0b00100000): r_pps2 = self.read_byte() + if r_pps2 is None: + return pps_rsp.append(r_pps2) r_lrc = r_lrc ^ r_pps2 if (r_pps0 & 0b01000000): r_pps3 = self.read_byte() + if r_pps3 is None: + return pps_rsp.append(r_pps3) r_lrc = r_lrc ^ r_pps3 r_pck = self.read_byte() + if r_pck is None: + return pps_rsp.append(r_pck) r_lrc = r_lrc ^ r_pps ^ r_pps0 ^ r_pck if (r_lrc != 0): @@ -2423,6 +2484,10 @@ class Decoder(srd.Decoder): elif self.state == 'DATA': packet = []; forced_bad = False + # A parity error on any byte of this exchange flags the emitted + # packet BAD_FCS (the annotation/log alone is not visible to + # downstream tooling). + parity_before = self._parity_errors # Mid-session capture with an explicit protocol: there is no ATR to # derive the bit period from, so recover it once from the live line @@ -2585,284 +2650,210 @@ class Decoder(srd.Decoder): # event. Procedure bytes (ACK == INS, NULL 0x60, 9E/9F) are # framing and omitted. got_sw = False - if self._edge_read: - # Mid-session (gated-CLK) path. - # - # T=0 case 3/4 commands carry Lc (= P3) command-data bytes - # on the wire IMMEDIATELY after the 5-byte header, BEFORE - # the card's first procedure byte. The original loop (which - # treats the first post-header byte as a procedure byte) - # therefore mis-frames them. We distinguish the cases by - # the card's first procedure byte: - # * ACK (== INS or ~INS) right after the header -> case 2/4, the - # terminal sent no command data and the card is - # acknowledging; read P3 response bytes (+SW), or, for - # Le == 0 (GET RESPONSE), read until the SW. - # * any other byte -> case 3/4, it - # is terminal command data; read P3 command-data bytes, - # then the card's procedure byte (ACK/SW/9x). + # Mid-session (gated-CLK) path. + # + # T=0 case 3/4 commands carry Lc (= P3) command-data bytes + # on the wire IMMEDIATELY after the 5-byte header, BEFORE + # the card's first procedure byte. The original loop (which + # treats the first post-header byte as a procedure byte) + # therefore mis-frames them. We distinguish the cases by + # the card's first procedure byte: + # * ACK (== INS or ~INS) right after the header -> case 2/4, the + # terminal sent no command data and the card is + # acknowledging; read P3 response bytes (+SW), or, for + # Le == 0 (GET RESPONSE), read until the SW. + # * any other byte -> case 3/4, it + # is terminal command data; read P3 command-data bytes, + # then the card's procedure byte (ACK/SW/9x). + pb0 = self.read_byte() + if pb0 is None: + return True + # Skip NULL (0x60) procedure bytes and turnaround idle + # bytes (0xFF): the card may send NULLs while processing + # before the ACK, or the bus may idle at xFF during + # turnaround on the bidirectional DATA line. Without + # this the NULLs / idle bytes are mis-identified as + # case-3/4 command data. + for _ in range(MAX_TPDU_LEN): + if pb0 != 0x60 and pb0 != 0xFF: + break + self._note_discard(pb0, + 'idle/NULL byte before procedure byte', + idle=True) pb0 = self.read_byte() if pb0 is None: return True - # Skip NULL (0x60) procedure bytes and turnaround idle - # bytes (0xFF): the card may send NULLs while processing - # before the ACK, or the bus may idle at xFF during - # turnaround on the bidirectional DATA line. Without - # this the NULLs / idle bytes are mis-identified as - # case-3/4 command data. - for _ in range(MAX_TPDU_LEN): - if pb0 != 0x60 and pb0 != 0xFF: - break - self._note_discard(pb0, - 'idle/NULL byte before procedure byte', - idle=True) - pb0 = self.read_byte() - if pb0 is None: - return True - if plausible_sw(pb0): - # Immediate status word: ISO 7816-3 §10.3.3 lets the - # card finish the command at the first procedure - # byte; a case-2 rejection ('6A82', '6CXX', ...) - # carries no ACK and must not be read as data. - sw2 = self.read_byte() - if sw2 is None: - return True - packet.append(pb0) - packet.append(sw2) - got_sw = True - elif pb0 == bIns: - if (p3 == 0): - # P3=0 in an outgoing command is Le=256 - # (ISO 7816-3 §10.3.2): the card ACKs and sends - # response data until the status word. - if self._t0_read_data_until_sw(packet): - got_sw = True - else: - # ACK: read the P3 response bytes, then the SW. - # The card may return FEWER bytes than Le - # (6282 end-of-file; Lr <= Le, TS 102 221 - # §10.1.6): if the byte after the read is not - # SW1, split the buffer at the first plausible - # SW1 followed by a plausible CLA and replay the - # tail (flagged BAD_FCS). - resp = [] - eof = False - for _ in range(p3): - b = self.read_byte() - if b is None: - eof = True - break - resp.append(b) - s1 = None if eof else self.read_byte() + if plausible_sw(pb0): + # Immediate status word: ISO 7816-3 §10.3.3 lets the + # card finish the command at the first procedure + # byte; a case-2 rejection ('6A82', '6CXX', ...) + # carries no ACK and must not be read as data. + sw2 = self.read_byte() + if sw2 is None: + return True + packet.append(pb0) + packet.append(sw2) + got_sw = True + elif pb0 == bIns: + if (p3 == 0): + # P3=0 in an outgoing command is Le=256 + # (ISO 7816-3 §10.3.2): the card ACKs and sends + # response data until the status word. + if self._t0_read_data_until_sw(packet): + got_sw = True + else: + # ACK: read the P3 response bytes, then the SW. + # The card may return FEWER bytes than Le + # (6282 end-of-file; Lr <= Le, TS 102 221 + # §10.1.6): if the byte after the read is not + # SW1, split the buffer at the first plausible + # SW1 followed by a plausible CLA and replay the + # tail (flagged BAD_FCS). + resp = [] + eof = False + for _ in range(p3): + b = self.read_byte() + if b is None: + eof = True + break + resp.append(b) + s1 = None if eof else self.read_byte() + if s1 is None: + eof = True + while s1 in (0x60, 0xFF): + s1 = self.read_byte() if s1 is None: eof = True - while s1 in (0x60, 0xFF): - s1 = self.read_byte() - if s1 is None: - eof = True + break + if s1 is not None and plausible_sw(s1): + sw2 = self.read_byte() + if sw2 is None: + return True + packet.extend(resp) + packet.extend((s1, sw2)) + got_sw = True + else: + buf = resp + ([s1] if s1 is not None else []) + split = None + for j in range(len(buf) - 1): + if not plausible_sw(buf[j]): + continue + k = j + 2 + if k >= len(buf) or plausible_cla(buf[k]): + split = j break - if s1 is not None and plausible_sw(s1): + if split is not None: + packet.extend(buf[:split]) + packet.extend(buf[split:split + 2]) + for t in reversed(buf[split + 2:]): + self._replay.appendleft(t) + got_sw = True + forced_bad = True + self.log( + "SHORT RESPONSE: split %d data byte(s) " + "before SW1 0x%02x (Le %d)" + % (split, buf[split], p3)) + else: + packet.extend(buf) + forced_bad = True + self._resync = True + self.log( + "SHORT RESPONSE: no status word in " + "%d byte(s) read for Le %d" + % (len(buf), p3)) + elif pb0 == (bIns ^ 0xFF): + # ~INS ACK: one data byte at a time. Read data + # until the SW, consuming the procedure bytes in + # between (ISO 7816-3 Table 11). + if self._t0_read_response_data(packet, bIns): + got_sw = True + else: + # Case 3/4: the first post-header byte is command + # data (P3 = Lc). + packet.append(pb0) + if (p3 == 0): + # P3=0 and no procedure byte: treat the byte as + # response data (Le=256, permissive) and read + # until the status word. + if self._t0_read_data_until_sw(packet): + got_sw = True + else: + # Case 3/4: P3 command-data bytes, then + # procedure byte. + for _ in range(max(p3 - 1, 0)): + b = self.read_byte() + if b is None: + return True + packet.append(b) + for _proc in range(32): + pb = self.read_byte() + if pb is None: + return True + if (pb == bIns or pb == (bIns ^ 0xFF)): + # ACK: case-4 response data follows. + # Append it until the status word (it + # used to be discarded). INS means all + # remaining data; ~INS is per byte. + if pb == bIns: + if self._t0_read_data_until_sw(packet): + got_sw = True + elif self._t0_read_response_data(packet, bIns): + got_sw = True + break + elif (pb == (bIns ^ 0x01) + or pb == ((bIns ^ 0xFF) ^ 0x01)): + # Single-byte match (INS^0x01 / ~INS^0x01): + # read 1 byte, continue handshake. + b = self.read_byte() + if b is None: + return True + packet.append(b) + continue + elif (pb == 0x60 or pb == 0xFF): + # NULL (0x60): card busy. Turnaround + # idle (0xFF): bidirectional bus turnaround + # between terminal command data and the + # card's procedure byte. Both: consume and + # wait for next procedure byte. + continue + elif plausible_sw(pb): + # SW1: case 3, no response data. sw2 = self.read_byte() if sw2 is None: return True - packet.extend(resp) - packet.extend((s1, sw2)) + packet.append(pb) + packet.append(sw2) got_sw = True + break else: - buf = resp + ([s1] if s1 is not None else []) - split = None - for j in range(len(buf) - 1): - if not plausible_sw(buf[j]): - continue - k = j + 2 - if k >= len(buf) or plausible_cla(buf[k]): - split = j - break - if split is not None: - packet.extend(buf[:split]) - packet.extend(buf[split:split + 2]) - for t in reversed(buf[split + 2:]): - self._replay.appendleft(t) - got_sw = True - forced_bad = True - self.log( - "SHORT RESPONSE: split %d data byte(s) " - "before SW1 0x%02x (Le %d)" - % (split, buf[split], p3)) - else: - packet.extend(buf) - forced_bad = True - self._resync = True - self.log( - "SHORT RESPONSE: no status word in " - "%d byte(s) read for Le %d" - % (len(buf), p3)) - elif pb0 == (bIns ^ 0xFF): - # ~INS ACK: one data byte at a time. Read data - # until the SW, consuming the procedure bytes in - # between (ISO 7816-3 Table 11). - if self._t0_read_response_data(packet, bIns): - got_sw = True - else: - # Case 3/4: the first post-header byte is command - # data (P3 = Lc). - packet.append(pb0) - if (p3 == 0): - # P3=0 and no procedure byte: treat the byte as - # response data (Le=256, permissive) and read - # until the status word. - if self._t0_read_data_until_sw(packet): - got_sw = True - else: - # Case 3/4: P3 command-data bytes, then - # procedure byte. - for _ in range(max(p3 - 1, 0)): - b = self.read_byte() - if b is None: - return True - packet.append(b) - for _proc in range(32): - pb = self.read_byte() - if pb is None: - return True - if (pb == bIns or pb == (bIns ^ 0xFF)): - # ACK: case-4 response data follows. - # Append it until the status word (it - # used to be discarded). INS means all - # remaining data; ~INS is per byte. - if pb == bIns: - if self._t0_read_data_until_sw(packet): - got_sw = True - elif self._t0_read_response_data(packet, bIns): + # Unexpected byte: scan for SW, + # skip non-SW bytes (e.g. 0xFF + # turnaround artifacts). + for _ in range(MAX_TPDU_LEN): + if plausible_sw(pb): + sw2 = self.read_byte() + if sw2 is None: + return True + packet.append(pb) + packet.append(sw2) got_sw = True - break - elif (pb == (bIns ^ 0x01) - or pb == ((bIns ^ 0xFF) ^ 0x01)): - # Single-byte match (INS^0x01 / ~INS^0x01): - # read 1 byte, continue handshake. - b = self.read_byte() - if b is None: + break + self._note_pre_sw(pb, + 'non-SW byte during ' + 'unexpected-byte scan') + pb = self.read_byte() + if pb is None: return True - packet.append(b) - continue - elif (pb == 0x60 or pb == 0xFF): - # NULL (0x60): card busy. Turnaround - # idle (0xFF): bidirectional bus turnaround - # between terminal command data and the - # card's procedure byte. Both: consume and - # wait for next procedure byte. - continue - elif (pb == 0x9e or pb == 0x9f): - # Extended-length procedure byte: L - # response data bytes follow, then SW. - L = self.read_byte() - if L is None: - return True - for _ in range(L): - b = self.read_byte() - if b is None: - return True - packet.append(b) - continue - elif plausible_sw(pb): - # SW1: case 3, no response data. - sw2 = self.read_byte() - if sw2 is None: - return True - packet.append(pb) - packet.append(sw2) - got_sw = True - break - else: - # Unexpected byte: scan for SW, - # skip non-SW bytes (e.g. 0xFF - # turnaround artifacts). - for _ in range(MAX_TPDU_LEN): - if plausible_sw(pb): - sw2 = self.read_byte() - if sw2 is None: - return True - packet.append(pb) - packet.append(sw2) - got_sw = True - break - self._note_pre_sw(pb, - 'non-SW byte during ' - 'unexpected-byte scan') - pb = self.read_byte() - if pb is None: - return True - break - else: - # ATR-based captures (test_8 / test_7): keep the original - # procedure loop unchanged. - data_read = False - for _proc in range(8): - pb = self.read_byte() - if pb is None: - break - if (pb == bIns or pb == (bIns ^ 0xFF)) and not data_read: - # ACK (full match / ~INS): the P3 bytes follow on - # the wire (Lc command data for case 3, Le response - # data for case 2). - data_read = True - for _ in range(p3): - b = self.read_byte() - if b is None: - break - packet.append(b) - elif (pb == (bIns ^ 0x01) - or pb == ((bIns ^ 0xFF) ^ 0x01)): - # Single-byte match (INS^0x01 / ~INS^0x01): - # read 1 byte, continue handshake. - b = self.read_byte() - if b is None: break - packet.append(b) - elif (pb == 0x60): - # NULL: card busy; wait for the next procedure byte. - pass - elif (pb == 0x9e or pb == 0x9f): - # T=0 extended-length procedure byte: the next byte - # L is the number of response data bytes the card - # now sends, followed by the status word. - L = self.read_byte() - if L is None: - break - for _ in range(L): - b = self.read_byte() - if b is None: - break - packet.append(b) - elif plausible_sw(pb): - # SW1: append SW2; the exchange is complete. - sw2 = self.read_byte() - if sw2 is None: - break - packet.append(pb) - packet.append(sw2) - got_sw = True - break - else: - # Mis-framed procedure byte: stop reading. The - # partial packet is flagged desynced downstream and - # the decoder re-aligns on the next idle gap. - self.put(es, self.samplenum, self.out_ann, - [0, ["INVALID Procedure Byte"]]) - self.log("INVALID Procedure Byte", hex(pb)) - self._resync = True - break self.put(es, self.samplenum, self.out_ann, [4, ["T=0"]]) if (got_sw and len(packet) >= 7): self.put(es, self.samplenum, self.out_ann, [9, ["APDU", "APDU cls={cls:02x} ins={ins:02x}".format(cls=bClass,ins=bIns), "APDU cls={cls:02x} ins={ins:02x} p1={p1:02x} p2={p2:02x} p3={p3:02x} len={len} status={sw1:02x}{sw2:02x}".format(cls=bClass,ins=bIns,p1=p1,p2=p2,p3=p3,len=p3,sw1=packet[-2],sw2=packet[-1])]]) elif (self.hasT1): - isIBlock,packet = self.t1_parse_block(es) - if (isIBlock): - for _ in range(32): # bounded chain follow-up - isIBlock,packet2 = self.t1_parse_block(es) - if (isIBlock): - packet = packet + packet2 - break + # One block per step (the M-bit chain is followed inside + # t1_parse_block); the old extra chain loop read the next + # block -- usually the other side's R-block -- and merged + # the following I-block into this packet. + isIBlock, packet = self.t1_parse_block(es) self.put(es, self.samplenum, self.out_ann, [4, ["T=1", "T=1 (reassembled)"]]) if (len(packet) >= 8): self.put(es, self.samplenum, self.out_ann, [9, ["APDU", "APDU cls={cls:02x} ins={ins:02x}".format(cls=packet[0],ins=packet[1]), "APDU cls={cls:02x} ins={ins:02x} p1={p1:02x} p2={p2:02x} p3={p3:02x} len={len} status={sw1:02x}{sw2:02x}".format(cls=packet[0],ins=packet[1],p1=packet[2],p2=packet[3],p3=packet[4],len=len(packet) - 7,sw1=packet[-2],sw2=packet[-1])]]) @@ -2912,9 +2903,14 @@ class Decoder(srd.Decoder): flags=GSMTAP_FLAG_BAD_FCS) else: self._idle_low = 0 + parity_bad = (self._parity_errors != parity_before) + if parity_bad and not forced_bad: + self.log("APDU flagged BAD_FCS: parity error " + "in the exchange") self.emit_packet(GSMTAP_SIM_APDU, bytes(packet), es, self.samplenum, - flags=GSMTAP_FLAG_BAD_FCS if forced_bad else 0) + flags=GSMTAP_FLAG_BAD_FCS + if (forced_bad or parity_bad) else 0) self.log("PACKETEND", codecs.encode(bytes(packet), 'hex')) else: diff --git a/tests/baseline.txt b/tests/baseline.txt index c8ff114..ba3e0bd 100644 --- a/tests/baseline.txt +++ b/tests/baseline.txt @@ -1,7 +1,7 @@ -=== Baseline captured 2026-10-20T17:56:26+03:00 === +=== Baseline captured 2026-10-20T18:55:32+03:00 === === test_8 === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('etu recovered (samples):', 1237) iso7816-1: RST deasserted ('RST deasserted',) @@ -36,7 +36,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === test_7 === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('etu recovered (samples):', 1236) iso7816-1: RST deasserted ('RST deasserted',) @@ -77,7 +77,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === xiaomi_phone_sample === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('etu recovered (samples):', 53) (11674007, 'CHKSUM ERROR: ', 0, 'bits: ', [0, 0, 0, 1, 0, 0, 1, 1, 1, 1]) iso7816-1: CHKSUM ERROR bits=[0, 0, 0, 1, 0, 0, 1, 1, 1, 1] @@ -102,7 +102,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === xiaomi_mi_a1_coldboot === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('RST low at start: expecting cold-boot ATR',) iso7816-1: RST deasserted ('RST deasserted',) @@ -129,7 +129,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === 4gmodem_coldboot === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('RST low at start: expecting cold-boot ATR',) iso7816-1: RST deasserted ('RST deasserted',) @@ -156,7 +156,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === alcor_reader_sample === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('RST low at start: expecting cold-boot ATR',) iso7816-1: RST deasserted ('RST deasserted',) @@ -189,7 +189,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === samsung_A55_coldboot_new_cable === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('RST low at start: expecting cold-boot ATR',) iso7816-1: RST deasserted ('RST deasserted',) @@ -216,7 +216,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === samsung_A55_coldboot_new_cable_sim2 === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('RST low at start: expecting cold-boot ATR',) iso7816-1: RST deasserted ('RST deasserted',) @@ -243,7 +243,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === samsung_S21p_coldboot_new_cable === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('RST low at start: expecting cold-boot ATR',) iso7816-1: RST deasserted ('RST deasserted',) @@ -270,7 +270,7 @@ Degradation metrics: RESULT: OK - capture fully explained (reader + CAT + valid retries) === samsung_S21p_coldboot_new_cable_sim2 === -('=== iso7816 decoder v1.9.6 ===',) +('=== iso7816 decoder v1.9.7 ===',) ('RST low at start: expecting cold-boot ATR',) iso7816-1: RST deasserted ('RST deasserted',) @@ -350,6 +350,7 @@ test_handoff_on_odd_ins_89 (__main__.TestAtrHuntDetect.test_handoff_on_odd_ins_8 test_inverse_ts_pattern_is_parsed (__main__.TestAtrHuntDetect.test_inverse_ts_pattern_is_parsed) ... ok test_no_handoff_on_basic_channel_cla (__main__.TestAtrHuntDetect.test_no_handoff_on_basic_channel_cla) ... ok test_no_handoff_on_invalid_ins (__main__.TestAtrHuntDetect.test_no_handoff_on_invalid_ins) ... ok +test_truncated_atr_ta_is_clean (__main__.TestAtrHuntDetect.test_truncated_atr_ta_is_clean) ... ok test_all_ff_idle_loop_is_bounded (__main__.TestAtrHuntEscape.test_all_ff_idle_loop_is_bounded) ... ok test_idle_ff_retries_before_cap (__main__.TestAtrHuntEscape.test_idle_ff_retries_before_cap) ... ok test_idle_resets_capped_then_resume (__main__.TestAtrHuntEscape.test_idle_resets_capped_then_resume) ... ok @@ -360,6 +361,7 @@ test_recover_etu_in_hunt_runs_measurement (__main__.TestAtrHuntEscape.test_recov test_recovery_attempts_capped_then_hard_limit (__main__.TestAtrHuntEscape.test_recovery_attempts_capped_then_hard_limit) ... ok test_retry_then_recover_after_two_failures (__main__.TestAtrHuntEscape.test_retry_then_recover_after_two_failures) ... ok test_seeded_bit_samples_does_not_block_recovery (__main__.TestAtrHuntEscape.test_seeded_bit_samples_does_not_block_recovery) ... ok +test_9e_9f_are_status_words (__main__.TestDecodeStep.test_9e_9f_are_status_words) ... ok test_bit_dense_valid_cla_is_not_idle_noise (__main__.TestDecodeStep.test_bit_dense_valid_cla_is_not_idle_noise) ... ok test_data_0x3b_before_traffic_is_atr_candidate (__main__.TestDecodeStep.test_data_0x3b_before_traffic_is_atr_candidate) ... ok test_data_0x3b_is_not_an_atr_after_traffic (__main__.TestDecodeStep.test_data_0x3b_is_not_an_atr_after_traffic) ... ok @@ -371,6 +373,7 @@ test_immediate_sw_rejection_frames (__main__.TestDecodeStep.test_immediate_sw_re test_invalid_ins_re_frame_recovers_command (__main__.TestDecodeStep.test_invalid_ins_re_frame_recovers_command) ... ok test_inverse_ts_raw_pattern_is_an_atr_candidate (__main__.TestDecodeStep.test_inverse_ts_raw_pattern_is_an_atr_candidate) ... ok test_le_256_response_data_is_kept (__main__.TestDecodeStep.test_le_256_response_data_is_kept) ... ok +test_parity_error_flags_bad_fcs (__main__.TestDecodeStep.test_parity_error_flags_bad_fcs) ... ok test_short_response_is_split_and_flagged (__main__.TestDecodeStep.test_short_response_is_split_and_flagged) ... ok test_short_response_replays_following_exchange (__main__.TestDecodeStep.test_short_response_replays_following_exchange) ... ok test_text_byte_boundary_is_discarded_not_framed (__main__.TestDecodeStep.test_text_byte_boundary_is_discarded_not_framed) ... ok @@ -430,11 +433,21 @@ test_finds_fall_exactly_at_threshold (__main__.TestNextStartFall.test_finds_fall Regression test for Samsung 16 CLK/ETU concatenation. ... ok test_rejects_phantom_sub_etu_fall (__main__.TestNextStartFall.test_rejects_phantom_sub_etu_fall) ... ok test_returns_none_when_no_fall (__main__.TestNextStartFall.test_returns_none_when_no_fall) ... ok +test_etu_glitch_floor_scales (__main__.TestSamplerateScaling.test_etu_glitch_floor_scales) ... ok +test_samples_for_us (__main__.TestSamplerateScaling.test_samples_for_us) ... ok test_advancing_sample_is_not_stall (__main__.TestStallCheck.test_advancing_sample_is_not_stall) ... ok test_none_pins_is_eof (__main__.TestStallCheck.test_none_pins_is_eof) ... ok test_repeated_same_sample_is_bounded_stall (__main__.TestStallCheck.test_repeated_same_sample_is_bounded_stall) ... ok test_untracked_level_wait_never_stalls (__main__.TestStallCheck.test_untracked_level_wait_never_stalls) ... ok test_untracked_resets_stall_window (__main__.TestStallCheck.test_untracked_resets_stall_window) ... ok +test_decode_step_reads_exactly_one_block (__main__.TestT1Blocks.test_decode_step_reads_exactly_one_block) ... ok +test_handle_pps_truncated_is_clean (__main__.TestT1Blocks.test_handle_pps_truncated_is_clean) ... ok +test_handle_pps_truncated_optional_is_clean (__main__.TestT1Blocks.test_handle_pps_truncated_optional_is_clean) ... ok +test_i_block (__main__.TestT1Blocks.test_i_block) ... ok +test_m_chain_concatenates_inf (__main__.TestT1Blocks.test_m_chain_concatenates_inf) ... ok +test_r_and_s_blocks_have_no_inf (__main__.TestT1Blocks.test_r_and_s_blocks_have_no_inf) ... ok +test_truncated_block_before_lrc_is_clean (__main__.TestT1Blocks.test_truncated_block_before_lrc_is_clean) ... ok +test_truncated_inf_is_clean (__main__.TestT1Blocks.test_truncated_inf_is_clean) ... ok test_invalid_cla (__main__.TestValidateT0Apdu.test_invalid_cla) ... ok test_invalid_cla_reserved_and_unseen (__main__.TestValidateT0Apdu.test_invalid_cla_reserved_and_unseen) ... ok test_invalid_cla_untraced_variants (__main__.TestValidateT0Apdu.test_invalid_cla_untraced_variants) ... ok @@ -457,6 +470,6 @@ test_valid_ins_odd_variants (__main__.TestValidateT0Apdu.test_valid_ins_odd_vari test_vs_reader_mirror (__main__.TestValidateT0Apdu.test_vs_reader_mirror) ... ok ---------------------------------------------------------------------- -Ran 117 tests in 0.026s +Ran 130 tests in 0.029s OK diff --git a/tests/test_gsmtap.py b/tests/test_gsmtap.py index 96b36af..974d2f4 100644 --- a/tests/test_gsmtap.py +++ b/tests/test_gsmtap.py @@ -266,7 +266,6 @@ class TestInverseConvention(unittest.TestCase): def test_wait_data_falling_uses_high_idle_and_falling_start(self): self.inst._inverse_convention = True self.inst.bit_samples = 100 - self.inst._edge_read = True self.inst._min_pulse_samples = 0 self.inst.samplenum = 0 conds = [] @@ -284,6 +283,130 @@ class TestInverseConvention(unittest.TestCase): self.assertEqual(self.inst._start_fall, self.inst.samplenum) +class TestT1Blocks(unittest.TestCase): + """T=1 block parsing: NAD/PCB/LEN/INF/LRC, the M-bit chain, and the + EOF guards (a truncated block never raises or emits a half INF).""" + + @classmethod + def setUpClass(cls): + cls.gs, cls.pd = _load_iso7816() + + def _make(self, byte_seq): + inst = object.__new__(self.pd.Decoder) + inst.reset() + inst.samplenum = 0 + inst.out_ann = 0 + inst.log = lambda *a, **k: None + inst.put = lambda *a, **k: None + inst.wait = lambda cond=None: [1] * 8 + inst._bytes = collections.deque(byte_seq) + inst.read_byte = lambda: (inst._bytes.popleft() + if inst._bytes else None) + return inst + + def _block(self, nad, pcb, inf): + body = [nad, pcb, len(inf)] + list(inf) + lrc = 0 + for b in body: + lrc ^= b + return body + [lrc] + + def test_i_block(self): + inst = self._make(self._block(0x00, 0x00, [0x6f, 0x00])) + self.assertEqual(inst.t1_parse_block(0), (True, [0x6f, 0x00])) + + def test_r_and_s_blocks_have_no_inf(self): + inst = self._make(self._block(0x00, 0x80, [])) + self.assertEqual(inst.t1_parse_block(0), (False, [])) + inst = self._make(self._block(0x00, 0xc0, [])) + self.assertEqual(inst.t1_parse_block(0), (False, [])) + + def test_m_chain_concatenates_inf(self): + seq = (self._block(0x00, 0x20, [0x01]) + + self._block(0x00, 0x00, [0x02])) + inst = self._make(seq) + self.assertEqual(inst.t1_parse_block(0), (True, [0x01, 0x02])) + + def test_truncated_block_before_lrc_is_clean(self): + seq = self._block(0x00, 0x00, [0x6f, 0x00])[:5] # no LRC + inst = self._make(seq) + self.assertEqual(inst.t1_parse_block(0), (False, [])) + + def test_truncated_inf_is_clean(self): + inst = self._make([0x00, 0x00, 0x05, 0x01, 0x02]) + self.assertEqual(inst.t1_parse_block(0), (False, [])) + + def test_decode_step_reads_exactly_one_block(self): + # The T=1 caller used to run an extra chain loop after every + # I-block: it consumed the peer's R-block and merged the following + # I-block's INF into this packet. One step must parse one block. + apdu = [0x00, 0xa4, 0x00, 0x00, 0x00] + rblock = self._block(0x00, 0x80, []) + inst = self._make(self._block(0x00, 0x00, apdu) + rblock) + inst.state = 'DATA' + inst.hasT0 = False + inst.hasT1 = True + inst.bit_samples = 100 + inst._pps_speed_changed = False + inst._resync = False + inst._at_eof = lambda: False + inst.out_ann = 0 + inst.emitted = [] + inst.emit_packet = lambda st, pl, ss, es, flags=0: \ + inst.emitted.append((bytes(pl), flags)) + inst._note_discard = lambda *a, **k: None + inst._note_pre_sw = lambda *a, **k: None + inst._consume_first = lambda: (inst._bytes.popleft() + if inst._bytes else None) + inst.peek_byte = lambda: inst._bytes[0] if inst._bytes else None + self.assertTrue(inst.decode_step()) + self.assertEqual(len(inst.emitted), 1) + self.assertEqual(inst.emitted[0][0], bytes(apdu)) + # The peer's R-block is left for the next step. + self.assertEqual(list(inst._bytes), rblock) + + def test_handle_pps_truncated_is_clean(self): + inst = self._make([0x55]) + inst.peeked_samplenum = 0 + inst.handle_pps() # pps0 missing: must not raise + + def test_handle_pps_truncated_optional_is_clean(self): + inst = self._make([0x55, 0x70]) # PPS0 asks for PPS1..3, then EOF + inst.peeked_samplenum = 0 + inst.handle_pps() # PPS1 missing: must not raise + + +class TestSamplerateScaling(unittest.TestCase): + """The pulse/glitch thresholds scale with the capture rate instead of + assuming 16 MHz.""" + + @classmethod + def setUpClass(cls): + cls.gs, cls.pd = _load_iso7816() + + def test_samples_for_us(self): + inst = object.__new__(self.pd.Decoder) + inst.samplerate = 16000000 + self.assertEqual(inst._samples_for_us(0.125), 2) + self.assertEqual(inst._samples_for_us(0.25), 4) + self.assertEqual(inst._samples_for_us(0.75), 12) + inst.samplerate = 96000000 + self.assertEqual(inst._samples_for_us(0.125), 12) + self.assertEqual(inst._samples_for_us(0.75), 72) + inst.samplerate = None + self.assertEqual(inst._samples_for_us(0.75), 12) # 16 MHz fallback + + def test_etu_glitch_floor_scales(self): + inst = object.__new__(self.pd.Decoder) + inst.samplerate = 96000000 + # 12-sample spacings are sub-ETU glitches at 96 MHz (floor 72). + self.assertEqual(inst._etu_candidate([(12, 0), (12, 1)]), + (None, False)) + inst.samplerate = 16000000 + self.assertEqual(inst._etu_candidate([(12, 0), (12, 1)]), + (12, True)) + + class TestValidateT0Apdu(unittest.TestCase): @classmethod def setUpClass(cls): @@ -386,10 +509,15 @@ class TestValidateT0Apdu(unittest.TestCase): # Table 4 pairs (0F ERASE BINARY, 21 VERIFY, 87 GENERAL # AUTHENTICATE, A1 SEARCH BINARY, B1 READ BINARY, B3 READ RECORD, # C3 ENVELOPE, CB GET DATA, D1 WRITE BINARY, D7 UPDATE BINARY, - # DB PUT DATA, DD UPDATE RECORD) plus TS 102 221 AUTHENTICATE 89. + # DB PUT DATA, DD UPDATE RECORD), TS 102 221 AUTHENTICATE 89, and + # TS 102 221 Table 10.5 MANAGE SECURE CHANNEL 73 / TRANSACT DATA 75 + # (the v1.9.6 audit found these two missing). self.assertEqual(self.pd.ODD_INS, frozenset(( - 0x0F, 0x21, 0x87, 0x89, 0xA1, 0xB1, 0xB3, + 0x0F, 0x21, 0x73, 0x75, 0x87, 0x89, 0xA1, 0xB1, 0xB3, 0xC3, 0xCB, 0xDB, 0xD1, 0xD7, 0xDD))) + for ins in (0x73, 0x75): + with self.subTest(ins=ins): + self.assertTrue(self.pd.plausible_ins(ins)) def test_vs_reader_mirror(self): # tools/vs_reader.py duplicates the acceptance predicates for its @@ -968,6 +1096,36 @@ class TestDecodeStep(unittest.TestCase): inst.wait = lambda cond=None: [1] * 8 return inst + def test_9e_9f_are_status_words(self): + # ISO 7816-3 10.3.3 Table 11: '9X' is SW1. The old code treated + # 9E/9F as an "extended-length" procedure byte and consumed SW2 as + # a bogus length, losing the status word. + for sw1 in (0x9e, 0x9f): + with self.subTest(sw1=sw1): + inst = self._make(bytes.fromhex('00a40000023f00') + + bytes([sw1, 0x00])) + self.assertTrue(inst.decode_step()) + self.assertEqual( + inst.emitted, + [(bytes.fromhex('00a40000023f00') + bytes([sw1, 0x00]), 0)]) + + def test_parity_error_flags_bad_fcs(self): + # A parity error is annotated and must also reach downstream as + # GSMTAP_FLAG_BAD_FCS on the emitted packet. + inst = self._make(bytes.fromhex('00a40000023f009000')) + orig = inst.read_byte + + def read(): + b = orig() + if b == 0x3f: + inst._parity_errors += 1 + return b + + inst.read_byte = read + self.assertTrue(inst.decode_step()) + self.assertEqual(len(inst.emitted), 1) + self.assertTrue(inst.emitted[0][1] & self.pd.GSMTAP_FLAG_BAD_FCS) + def test_extended_channel_exchange_frames(self): # 'CX' STATUS on channel 4 (v1.9.3): the whole exchange must be # read and emitted clean. @@ -1222,6 +1380,14 @@ class TestAtrHuntDetect(unittest.TestCase): self.assertEqual(inst.emitted, []) self.assertEqual(inst.state, 'DATA') + def test_truncated_atr_ta_is_clean(self): + # T0 says TA1 present but the capture ends: the parse must return + # without committing an ATR (or raising on the None byte). + inst = self._make([0x3B, 0x10]) + inst.handle_atr(None) + self.assertFalse(inst._atr_parsed) + self.assertEqual(inst.emitted, []) + def test_inverse_ts_pattern_is_parsed(self): # 0x03 + the raw inverse TS pattern must be committed as 0x3F and # switch the readers to the inverse convention. diff --git a/tools/vs_reader.py b/tools/vs_reader.py index fe1b2fb..a55b647 100644 --- a/tools/vs_reader.py +++ b/tools/vs_reader.py @@ -146,7 +146,7 @@ def _plausible_sw(sw1): # values stay rejected (no command uses them; mis-framed boundary data # bytes with odd INS started bogus frames on the phone traces). ODD_INS = frozenset(( - 0x0F, 0x21, 0x87, 0x89, 0xA1, 0xB1, 0xB3, + 0x0F, 0x21, 0x73, 0x75, 0x87, 0x89, 0xA1, 0xB1, 0xB3, 0xC3, 0xCB, 0xDB, 0xD1, 0xD7, 0xDD, ))