]>
Commit | Line | Data |
---|---|---|
a7247d85 | 1 | /* |
2 | * LEGIC RF simulation code | |
3 | * | |
4 | * (c) 2009 Henryk Plötz <henryk@ploetzli.ch> | |
5 | */ | |
6 | ||
7 | #include <proxmark3.h> | |
8 | ||
9 | #include "apps.h" | |
10 | #include "legicrf.h" | |
ccedd6ae | 11 | #include "unistd.h" |
12 | #include "stdint.h" | |
a7247d85 | 13 | |
14 | static struct legic_frame { | |
ccedd6ae | 15 | int bits; |
16 | uint16_t data; | |
a7247d85 | 17 | } current_frame; |
aac23b24 | 18 | |
4014b814 | 19 | static const struct legic_frame queries[] = { |
aac23b24 | 20 | {7, 0x55}, /* 1010 101 */ |
21 | }; | |
ccedd6ae | 22 | |
4014b814 | 23 | static const struct legic_frame responses[] = { |
aac23b24 | 24 | {6, 0x3b}, /* 1101 11 */ |
25 | }; | |
a7247d85 | 26 | |
ccedd6ae | 27 | static void frame_send(uint16_t response, int bits) |
a7247d85 | 28 | { |
29 | #if 0 | |
30 | /* Use the SSC to send a response. 8-bit transfers, LSBit first, 100us per bit */ | |
31 | #else | |
32 | /* Bitbang the response */ | |
33 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
34 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
35 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
36 | ||
37 | /* Wait for the frame start */ | |
38 | while(AT91C_BASE_TC1->TC_CV < 490) ; | |
39 | ||
40 | int i; | |
ccedd6ae | 41 | for(i=0; i<bits; i++) { |
a7247d85 | 42 | int nextbit = AT91C_BASE_TC1->TC_CV + 150; |
ccedd6ae | 43 | int bit = response & 1; |
44 | response = response >> 1; | |
a7247d85 | 45 | if(bit) |
46 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
47 | else | |
48 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
49 | while(AT91C_BASE_TC1->TC_CV < nextbit) ; | |
50 | } | |
51 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
52 | #endif | |
53 | } | |
54 | ||
ccedd6ae | 55 | static void frame_respond(struct legic_frame const * const f) |
a7247d85 | 56 | { |
57 | LED_D_ON(); | |
4014b814 | 58 | int i, r_size; |
59 | uint16_t r_data; | |
ccedd6ae | 60 | |
aac23b24 | 61 | for(i=0; i<sizeof(queries)/sizeof(queries[0]); i++) { |
ccedd6ae | 62 | if(f->bits == queries[i].bits && f->data == queries[i].data) { |
4014b814 | 63 | r_data = responses[i].data; |
64 | r_size = responses[i].bits; | |
aac23b24 | 65 | break; |
66 | } | |
67 | } | |
68 | ||
4014b814 | 69 | if(r_size != 0) { |
70 | frame_send(r_data, r_size); | |
aac23b24 | 71 | LED_A_ON(); |
72 | } else { | |
73 | LED_A_OFF(); | |
a7247d85 | 74 | } |
aac23b24 | 75 | |
a7247d85 | 76 | LED_D_OFF(); |
77 | } | |
78 | ||
ccedd6ae | 79 | static void frame_append_bit(struct legic_frame * const f, int bit) |
a7247d85 | 80 | { |
ccedd6ae | 81 | if(f->bits >= 15) |
a7247d85 | 82 | return; /* Overflow, won't happen */ |
ccedd6ae | 83 | f->data |= (bit<<f->bits); |
84 | f->bits++; | |
a7247d85 | 85 | } |
86 | ||
ccedd6ae | 87 | static int frame_is_empty(struct legic_frame const * const f) |
a7247d85 | 88 | { |
ccedd6ae | 89 | return( f->bits <= 4 ); |
a7247d85 | 90 | } |
91 | ||
ccedd6ae | 92 | static void frame_handle(struct legic_frame const * const f) |
a7247d85 | 93 | { |
ccedd6ae | 94 | if(f->bits == 6) { |
aac23b24 | 95 | /* Short path */ |
96 | return; | |
97 | } | |
a7247d85 | 98 | if( !frame_is_empty(f) ) { |
99 | frame_respond(f); | |
100 | } | |
101 | } | |
102 | ||
ccedd6ae | 103 | static void frame_clean(struct legic_frame * const f) |
a7247d85 | 104 | { |
ccedd6ae | 105 | f->data = 0; |
106 | f->bits = 0; | |
a7247d85 | 107 | } |
108 | ||
109 | static void emit(int bit) | |
110 | { | |
111 | if(bit == -1) { | |
112 | frame_handle(¤t_frame); | |
113 | frame_clean(¤t_frame); | |
114 | } else if(bit == 0) { | |
115 | frame_append_bit(¤t_frame, 0); | |
116 | } else if(bit == 1) { | |
117 | frame_append_bit(¤t_frame, 1); | |
118 | } | |
119 | } | |
120 | ||
121 | void LegicRfSimulate(void) | |
122 | { | |
123 | /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode, | |
124 | * modulation mode set to 212kHz subcarrier. We are getting the incoming raw | |
125 | * envelope waveform on DIN and should send our response on DOUT. | |
126 | * | |
127 | * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll | |
128 | * measure the time between two rising edges on DIN, and no encoding on the | |
129 | * subcarrier from card to reader, so we'll just shift out our verbatim data | |
130 | * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear, | |
131 | * seems to be 300us-ish. | |
132 | */ | |
133 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
134 | FpgaSetupSsc(); | |
135 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K); | |
136 | ||
137 | /* Bitbang the receiver */ | |
138 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
139 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
140 | ||
141 | /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging | |
142 | * this it won't be terribly accurate but should be good enough. | |
143 | */ | |
144 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); | |
145 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; | |
146 | AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3; | |
147 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
148 | int old_level = 0; | |
149 | ||
150 | /* At TIMER_CLOCK3 (MCK/32) */ | |
151 | #define BIT_TIME_1 150 | |
152 | #define BIT_TIME_0 90 | |
153 | #define BIT_TIME_FUZZ 20 | |
154 | ||
155 | int active = 0; | |
156 | while(!BUTTON_PRESS()) { | |
157 | int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
158 | int time = AT91C_BASE_TC1->TC_CV; | |
159 | ||
160 | if(level != old_level) { | |
161 | if(level == 1) { | |
162 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
163 | if(time > (BIT_TIME_1-BIT_TIME_FUZZ) && time < (BIT_TIME_1+BIT_TIME_FUZZ)) { | |
164 | /* 1 bit */ | |
165 | emit(1); | |
166 | active = 1; | |
aac23b24 | 167 | LED_B_ON(); |
a7247d85 | 168 | } else if(time > (BIT_TIME_0-BIT_TIME_FUZZ) && time < (BIT_TIME_0+BIT_TIME_FUZZ)) { |
169 | /* 0 bit */ | |
170 | emit(0); | |
aac23b24 | 171 | active = 1; |
172 | LED_B_ON(); | |
173 | } else if(active) { | |
a7247d85 | 174 | /* invalid */ |
175 | emit(-1); | |
176 | active = 0; | |
aac23b24 | 177 | LED_B_OFF(); |
a7247d85 | 178 | } |
179 | } | |
180 | } | |
181 | ||
aac23b24 | 182 | if(time >= (BIT_TIME_1+BIT_TIME_FUZZ) && active) { |
a7247d85 | 183 | /* Frame end */ |
184 | emit(-1); | |
185 | active = 0; | |
aac23b24 | 186 | LED_B_OFF(); |
a7247d85 | 187 | } |
188 | ||
189 | if(time >= (20*BIT_TIME_1) && (AT91C_BASE_TC1->TC_SR & AT91C_TC_CLKSTA)) { | |
190 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; | |
191 | } | |
192 | ||
193 | ||
194 | old_level = level; | |
195 | WDT_HIT(); | |
196 | } | |
197 | } |