]>
Commit | Line | Data |
---|---|---|
bd20f8f4 | 1 | //----------------------------------------------------------------------------- |
2 | // (c) 2009 Henryk Plötz <henryk@ploetzli.ch> | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // LEGIC RF simulation code | |
9 | //----------------------------------------------------------------------------- | |
a7247d85 | 10 | |
e30c654b | 11 | #include "proxmark3.h" |
a7247d85 | 12 | #include "apps.h" |
f7e3ed82 | 13 | #include "util.h" |
9ab7a6c7 | 14 | #include "string.h" |
a7247d85 | 15 | |
f7e3ed82 | 16 | #include "legicrf.h" |
8e220a91 | 17 | #include "legic_prng.h" |
18 | #include "crc.h" | |
19 | ||
a7247d85 | 20 | static struct legic_frame { |
ccedd6ae | 21 | int bits; |
a2b1414f | 22 | uint32_t data; |
a7247d85 | 23 | } current_frame; |
8e220a91 | 24 | |
3612a8a8 | 25 | static enum { |
26 | STATE_DISCON, | |
27 | STATE_IV, | |
28 | STATE_CON, | |
29 | } legic_state; | |
30 | ||
31 | static crc_t legic_crc; | |
32 | static int legic_read_count; | |
33 | static uint32_t legic_prng_bc; | |
34 | static uint32_t legic_prng_iv; | |
35 | ||
36 | static int legic_phase_drift; | |
37 | static int legic_frame_drift; | |
38 | static int legic_reqresp_drift; | |
8e220a91 | 39 | |
add16a62 | 40 | AT91PS_TC timer; |
3612a8a8 | 41 | AT91PS_TC prng_timer; |
add16a62 | 42 | |
43 | static void setup_timer(void) | |
44 | { | |
45 | /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging | |
46 | * this it won't be terribly accurate but should be good enough. | |
47 | */ | |
48 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); | |
49 | timer = AT91C_BASE_TC1; | |
50 | timer->TC_CCR = AT91C_TC_CLKDIS; | |
0aa4cfc2 | 51 | timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK; |
add16a62 | 52 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
53 | ||
3612a8a8 | 54 | /* |
55 | * Set up Timer 2 to use for measuring time between frames in | |
56 | * tag simulation mode. Runs 4x faster as Timer 1 | |
57 | */ | |
58 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC2); | |
59 | prng_timer = AT91C_BASE_TC2; | |
60 | prng_timer->TC_CCR = AT91C_TC_CLKDIS; | |
61 | prng_timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV2_CLOCK; | |
62 | prng_timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
63 | } | |
64 | ||
add16a62 | 65 | /* At TIMER_CLOCK3 (MCK/32) */ |
66 | #define RWD_TIME_1 150 /* RWD_TIME_PAUSE off, 80us on = 100us */ | |
67 | #define RWD_TIME_0 90 /* RWD_TIME_PAUSE off, 40us on = 60us */ | |
68 | #define RWD_TIME_PAUSE 30 /* 20us */ | |
69 | #define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */ | |
70 | #define TAG_TIME_BIT 150 /* 100us for every bit */ | |
71 | #define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */ | |
72 | ||
3612a8a8 | 73 | #define SIM_DIVISOR 586 /* prng_time/SIM_DIVISOR count prng needs to be forwared */ |
74 | #define SIM_SHIFT 900 /* prng_time+SIM_SHIFT shift of delayed start */ | |
75 | ||
76 | #define SESSION_IV 0x55 | |
77 | #define OFFSET_LOG 1024 | |
add16a62 | 78 | |
79 | #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz))) | |
aac23b24 | 80 | |
3612a8a8 | 81 | /* Generate Keystream */ |
82 | static uint32_t get_key_stream(int skip, int count) | |
83 | { | |
84 | uint32_t key=0; int i; | |
85 | ||
86 | /* Use int to enlarge timer tc to 32bit */ | |
87 | legic_prng_bc += prng_timer->TC_CV; | |
88 | prng_timer->TC_CCR = AT91C_TC_SWTRG; | |
89 | ||
90 | /* If skip == -1, forward prng time based */ | |
91 | if(skip == -1) { | |
92 | i = (legic_prng_bc+SIM_SHIFT)/SIM_DIVISOR; /* Calculate Cycles based on timer */ | |
93 | i -= legic_prng_count(); /* substract cycles of finished frames */ | |
94 | i -= count; /* substract current frame length, rewidn to bedinning */ | |
95 | legic_prng_forward(i); | |
96 | } else { | |
97 | legic_prng_forward(skip); | |
98 | } | |
99 | ||
100 | /* Write Time Data into LOG */ | |
117d9ec2 | 101 | uint8_t *BigBuf = BigBuf_get_addr(); |
3612a8a8 | 102 | if(count == 6) { i = -1; } else { i = legic_read_count; } |
117d9ec2 | 103 | BigBuf[OFFSET_LOG+128+i] = legic_prng_count(); |
104 | BigBuf[OFFSET_LOG+256+i*4] = (legic_prng_bc >> 0) & 0xff; | |
105 | BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff; | |
106 | BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff; | |
107 | BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff; | |
108 | BigBuf[OFFSET_LOG+384+i] = count; | |
3612a8a8 | 109 | |
110 | /* Generate KeyStream */ | |
111 | for(i=0; i<count; i++) { | |
112 | key |= legic_prng_get_bit() << i; | |
113 | legic_prng_forward(1); | |
114 | } | |
115 | return key; | |
116 | } | |
117 | ||
118 | /* Send a frame in tag mode, the FPGA must have been set up by | |
119 | * LegicRfSimulate | |
120 | */ | |
121 | static void frame_send_tag(uint16_t response, int bits, int crypt) | |
122 | { | |
123 | /* Bitbang the response */ | |
124 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
125 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
126 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
127 | ||
128 | /* Use time to crypt frame */ | |
129 | if(crypt) { | |
130 | legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */ | |
131 | int i; int key = 0; | |
132 | for(i=0; i<bits; i++) { | |
133 | key |= legic_prng_get_bit() << i; | |
134 | legic_prng_forward(1); | |
135 | } | |
136 | //Dbprintf("key = 0x%x", key); | |
137 | response = response ^ key; | |
138 | } | |
139 | ||
140 | /* Wait for the frame start */ | |
141 | while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ; | |
142 | ||
143 | int i; | |
144 | for(i=0; i<bits; i++) { | |
145 | int nextbit = timer->TC_CV + TAG_TIME_BIT; | |
146 | int bit = response & 1; | |
147 | response = response >> 1; | |
148 | if(bit) { | |
149 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
150 | } else { | |
151 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
152 | } | |
153 | while(timer->TC_CV < nextbit) ; | |
154 | } | |
155 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
156 | } | |
157 | ||
dcc10e5e | 158 | /* Send a frame in reader mode, the FPGA must have been set up by |
159 | * LegicRfReader | |
160 | */ | |
8e220a91 | 161 | static void frame_send_rwd(uint32_t data, int bits) |
dcc10e5e | 162 | { |
163 | /* Start clock */ | |
164 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
165 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
e30c654b | 166 | |
dcc10e5e | 167 | int i; |
168 | for(i=0; i<bits; i++) { | |
169 | int starttime = timer->TC_CV; | |
170 | int pause_end = starttime + RWD_TIME_PAUSE, bit_end; | |
171 | int bit = data & 1; | |
172 | data = data >> 1; | |
8e220a91 | 173 | |
174 | if(bit ^ legic_prng_get_bit()) { | |
dcc10e5e | 175 | bit_end = starttime + RWD_TIME_1; |
176 | } else { | |
177 | bit_end = starttime + RWD_TIME_0; | |
178 | } | |
e30c654b | 179 | |
dcc10e5e | 180 | /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is |
181 | * RWD_TIME_x, where x is the bit to be transmitted */ | |
182 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
183 | while(timer->TC_CV < pause_end) ; | |
184 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
8e220a91 | 185 | legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */ |
e30c654b | 186 | |
dcc10e5e | 187 | while(timer->TC_CV < bit_end) ; |
188 | } | |
e30c654b | 189 | |
dcc10e5e | 190 | { |
191 | /* One final pause to mark the end of the frame */ | |
192 | int pause_end = timer->TC_CV + RWD_TIME_PAUSE; | |
193 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
194 | while(timer->TC_CV < pause_end) ; | |
195 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
196 | } | |
e30c654b | 197 | |
dcc10e5e | 198 | /* Reset the timer, to measure time until the start of the tag frame */ |
199 | timer->TC_CCR = AT91C_TC_SWTRG; | |
2561caa2 | 200 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
dcc10e5e | 201 | } |
202 | ||
203 | /* Receive a frame from the card in reader emulation mode, the FPGA and | |
204 | * timer must have been set up by LegicRfReader and frame_send_rwd. | |
e30c654b | 205 | * |
dcc10e5e | 206 | * The LEGIC RF protocol from card to reader does not include explicit |
207 | * frame start/stop information or length information. The reader must | |
208 | * know beforehand how many bits it wants to receive. (Notably: a card | |
209 | * sending a stream of 0-bits is indistinguishable from no card present.) | |
e30c654b | 210 | * |
dcc10e5e | 211 | * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but |
212 | * I'm not smart enough to use it. Instead I have patched hi_read_tx to output | |
213 | * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look | |
214 | * for edges. Count the edges in each bit interval. If they are approximately | |
215 | * 0 this was a 0-bit, if they are approximately equal to the number of edges | |
216 | * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the | |
217 | * timer that's still running from frame_send_rwd in order to get a synchronization | |
218 | * with the frame that we just sent. | |
e30c654b | 219 | * |
220 | * FIXME: Because we're relying on the hysteresis to just do the right thing | |
dcc10e5e | 221 | * the range is severely reduced (and you'll probably also need a good antenna). |
e30c654b | 222 | * So this should be fixed some time in the future for a proper receiver. |
dcc10e5e | 223 | */ |
8e220a91 | 224 | static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt) |
dcc10e5e | 225 | { |
a2b1414f | 226 | uint32_t the_bit = 1; /* Use a bitmask to save on shifts */ |
227 | uint32_t data=0; | |
dcc10e5e | 228 | int i, old_level=0, edges=0; |
229 | int next_bit_at = TAG_TIME_WAIT; | |
3612a8a8 | 230 | |
231 | if(bits > 32) { | |
232 | bits = 32; | |
233 | } | |
dcc10e5e | 234 | |
235 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
236 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
237 | ||
8e220a91 | 238 | /* we have some time now, precompute the cipher |
3612a8a8 | 239 | * since we cannot compute it on the fly while reading */ |
8e220a91 | 240 | legic_prng_forward(2); |
241 | ||
242 | if(crypt) | |
243 | { | |
244 | for(i=0; i<bits; i++) { | |
245 | data |= legic_prng_get_bit() << i; | |
246 | legic_prng_forward(1); | |
247 | } | |
248 | } | |
249 | ||
dcc10e5e | 250 | while(timer->TC_CV < next_bit_at) ; |
8e220a91 | 251 | |
dcc10e5e | 252 | next_bit_at += TAG_TIME_BIT; |
e30c654b | 253 | |
dcc10e5e | 254 | for(i=0; i<bits; i++) { |
255 | edges = 0; | |
256 | while(timer->TC_CV < next_bit_at) { | |
257 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
258 | if(level != old_level) | |
259 | edges++; | |
260 | old_level = level; | |
261 | } | |
262 | next_bit_at += TAG_TIME_BIT; | |
3612a8a8 | 263 | |
dcc10e5e | 264 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ |
8e220a91 | 265 | data ^= the_bit; |
dcc10e5e | 266 | } |
dcc10e5e | 267 | the_bit <<= 1; |
268 | } | |
e30c654b | 269 | |
dcc10e5e | 270 | f->data = data; |
271 | f->bits = bits; | |
e30c654b | 272 | |
2561caa2 | 273 | /* Reset the timer, to synchronize the next frame */ |
274 | timer->TC_CCR = AT91C_TC_SWTRG; | |
275 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
dcc10e5e | 276 | } |
277 | ||
3612a8a8 | 278 | static void frame_append_bit(struct legic_frame * const f, int bit) |
279 | { | |
280 | if(f->bits >= 31) { | |
281 | return; /* Overflow, won't happen */ | |
282 | } | |
283 | f->data |= (bit<<f->bits); | |
284 | f->bits++; | |
285 | } | |
286 | ||
ccedd6ae | 287 | static void frame_clean(struct legic_frame * const f) |
a7247d85 | 288 | { |
ccedd6ae | 289 | f->data = 0; |
290 | f->bits = 0; | |
a7247d85 | 291 | } |
292 | ||
a2b1414f | 293 | static uint32_t perform_setup_phase_rwd(int iv) |
2561caa2 | 294 | { |
e30c654b | 295 | |
2561caa2 | 296 | /* Switch on carrier and let the tag charge for 1ms */ |
297 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
298 | SpinDelay(1); | |
e30c654b | 299 | |
8e220a91 | 300 | legic_prng_init(0); /* no keystream yet */ |
301 | frame_send_rwd(iv, 7); | |
3612a8a8 | 302 | legic_prng_init(iv); |
e30c654b | 303 | |
2561caa2 | 304 | frame_clean(¤t_frame); |
8e220a91 | 305 | frame_receive_rwd(¤t_frame, 6, 1); |
306 | legic_prng_forward(1); /* we wait anyways */ | |
2561caa2 | 307 | while(timer->TC_CV < 387) ; /* ~ 258us */ |
8e220a91 | 308 | frame_send_rwd(0x19, 6); |
2561caa2 | 309 | |
8e220a91 | 310 | return current_frame.data; |
2561caa2 | 311 | } |
312 | ||
8e220a91 | 313 | static void LegicCommonInit(void) { |
7cc204bf | 314 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
dcc10e5e | 315 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
316 | FpgaSetupSsc(); | |
317 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); | |
e30c654b | 318 | |
dcc10e5e | 319 | /* Bitbang the transmitter */ |
320 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
321 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
322 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
e30c654b | 323 | |
dcc10e5e | 324 | setup_timer(); |
e30c654b | 325 | |
8e220a91 | 326 | crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0); |
327 | } | |
328 | ||
329 | static void switch_off_tag_rwd(void) | |
330 | { | |
331 | /* Switch off carrier, make sure tag is reset */ | |
332 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
333 | SpinDelay(10); | |
e30c654b | 334 | |
8e220a91 | 335 | WDT_HIT(); |
336 | } | |
337 | /* calculate crc for a legic command */ | |
a2b1414f | 338 | static int LegicCRC(int byte_index, int value, int cmd_sz) { |
8e220a91 | 339 | crc_clear(&legic_crc); |
340 | crc_update(&legic_crc, 1, 1); /* CMD_READ */ | |
a2b1414f | 341 | crc_update(&legic_crc, byte_index, cmd_sz-1); |
8e220a91 | 342 | crc_update(&legic_crc, value, 8); |
343 | return crc_finish(&legic_crc); | |
344 | } | |
345 | ||
a2b1414f | 346 | int legic_read_byte(int byte_index, int cmd_sz) { |
8e220a91 | 347 | int byte; |
348 | ||
349 | legic_prng_forward(4); /* we wait anyways */ | |
3612a8a8 | 350 | while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */ |
8e220a91 | 351 | |
a2b1414f | 352 | frame_send_rwd(1 | (byte_index << 1), cmd_sz); |
8e220a91 | 353 | frame_clean(¤t_frame); |
354 | ||
355 | frame_receive_rwd(¤t_frame, 12, 1); | |
356 | ||
357 | byte = current_frame.data & 0xff; | |
a2b1414f | 358 | if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) { |
3612a8a8 | 359 | Dbprintf("!!! crc mismatch: expected %x but got %x !!!", |
360 | LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz), current_frame.data >> 8); | |
a2b1414f | 361 | return -1; |
362 | } | |
8e220a91 | 363 | |
364 | return byte; | |
365 | } | |
366 | ||
367 | /* legic_write_byte() is not included, however it's trivial to implement | |
368 | * and here are some hints on what remains to be done: | |
369 | * | |
370 | * * assemble a write_cmd_frame with crc and send it | |
371 | * * wait until the tag sends back an ACK ('1' bit unencrypted) | |
372 | * * forward the prng based on the timing | |
373 | */ | |
3612a8a8 | 374 | int legic_write_byte(int byte, int addr, int addr_sz) { |
375 | //do not write UID, CRC, DCF | |
376 | if(addr <= 0x06) { | |
377 | return 0; | |
378 | } | |
8e220a91 | 379 | |
3612a8a8 | 380 | //== send write command ============================== |
381 | crc_clear(&legic_crc); | |
382 | crc_update(&legic_crc, 0, 1); /* CMD_WRITE */ | |
383 | crc_update(&legic_crc, addr, addr_sz); | |
384 | crc_update(&legic_crc, byte, 8); | |
385 | ||
386 | uint32_t crc = crc_finish(&legic_crc); | |
387 | uint32_t cmd = ((crc <<(addr_sz+1+8)) //CRC | |
388 | |(byte <<(addr_sz+1)) //Data | |
389 | |(addr <<1) //Address | |
390 | |(0x00 <<0)); //CMD = W | |
391 | uint32_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd | |
392 | ||
393 | legic_prng_forward(2); /* we wait anyways */ | |
29435274 | 394 | while(timer->TC_CV < 387) {}; /* ~ 258us */ |
3612a8a8 | 395 | frame_send_rwd(cmd, cmd_sz); |
396 | ||
397 | //== wait for ack ==================================== | |
398 | int t, old_level=0, edges=0; | |
399 | int next_bit_at =0; | |
400 | while(timer->TC_CV < 387) ; /* ~ 258us */ | |
401 | for(t=0; t<80; t++) { | |
402 | edges = 0; | |
403 | next_bit_at += TAG_TIME_BIT; | |
404 | while(timer->TC_CV < next_bit_at) { | |
405 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
406 | if(level != old_level) { | |
407 | edges++; | |
408 | } | |
409 | old_level = level; | |
410 | } | |
411 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ | |
412 | int t = timer->TC_CV; | |
413 | int c = t/TAG_TIME_BIT; | |
414 | timer->TC_CCR = AT91C_TC_SWTRG; | |
415 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
416 | legic_prng_forward(c); | |
417 | return 0; | |
418 | } | |
419 | } | |
420 | timer->TC_CCR = AT91C_TC_SWTRG; | |
29435274 | 421 | while(timer->TC_CV > 1) {}; /* Wait till the clock has reset */ |
3612a8a8 | 422 | return -1; |
423 | } | |
8e220a91 | 424 | |
3612a8a8 | 425 | int LegicRfReader(int offset, int bytes) { |
a2b1414f | 426 | int byte_index=0, cmd_sz=0, card_sz=0; |
e30c654b | 427 | |
8e220a91 | 428 | LegicCommonInit(); |
429 | ||
117d9ec2 | 430 | uint8_t *BigBuf = BigBuf_get_addr(); |
a2b1414f | 431 | memset(BigBuf, 0, 1024); |
e30c654b | 432 | |
8e220a91 | 433 | DbpString("setting up legic card"); |
3612a8a8 | 434 | uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV); |
435 | switch_off_tag_rwd(); //we lose to mutch time with dprintf | |
a2b1414f | 436 | switch(tag_type) { |
437 | case 0x1d: | |
438 | DbpString("MIM 256 card found, reading card ..."); | |
3612a8a8 | 439 | cmd_sz = 9; |
a2b1414f | 440 | card_sz = 256; |
441 | break; | |
442 | case 0x3d: | |
443 | DbpString("MIM 1024 card found, reading card ..."); | |
3612a8a8 | 444 | cmd_sz = 11; |
a2b1414f | 445 | card_sz = 1024; |
446 | break; | |
447 | default: | |
b279e3ef | 448 | Dbprintf("Unknown card format: %x",tag_type); |
3612a8a8 | 449 | return -1; |
a2b1414f | 450 | } |
451 | if(bytes == -1) { | |
452 | bytes = card_sz; | |
453 | } | |
3612a8a8 | 454 | if(bytes+offset >= card_sz) { |
a2b1414f | 455 | bytes = card_sz-offset; |
3612a8a8 | 456 | } |
a2b1414f | 457 | |
3612a8a8 | 458 | perform_setup_phase_rwd(SESSION_IV); |
8e220a91 | 459 | |
3612a8a8 | 460 | LED_B_ON(); |
8e220a91 | 461 | while(byte_index < bytes) { |
3612a8a8 | 462 | int r = legic_read_byte(byte_index+offset, cmd_sz); |
463 | if(r == -1 ||BUTTON_PRESS()) { | |
464 | DbpString("operation aborted"); | |
a2b1414f | 465 | switch_off_tag_rwd(); |
3612a8a8 | 466 | LED_B_OFF(); |
467 | LED_C_OFF(); | |
468 | return -1; | |
a2b1414f | 469 | } |
117d9ec2 | 470 | BigBuf[byte_index] = r; |
3612a8a8 | 471 | WDT_HIT(); |
2561caa2 | 472 | byte_index++; |
3612a8a8 | 473 | if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF(); |
2561caa2 | 474 | } |
3612a8a8 | 475 | LED_B_OFF(); |
476 | LED_C_OFF(); | |
477 | switch_off_tag_rwd(); | |
478 | Dbprintf("Card read, use 'hf legic decode' or"); | |
479 | Dbprintf("'data hexsamples %d' to view results", (bytes+7) & ~7); | |
480 | return 0; | |
481 | } | |
482 | ||
483 | void LegicRfWriter(int bytes, int offset) { | |
484 | int byte_index=0, addr_sz=0; | |
117d9ec2 | 485 | uint8_t *BigBuf = BigBuf_get_addr(); |
486 | ||
3612a8a8 | 487 | LegicCommonInit(); |
488 | ||
489 | DbpString("setting up legic card"); | |
490 | uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV); | |
8e220a91 | 491 | switch_off_tag_rwd(); |
3612a8a8 | 492 | switch(tag_type) { |
493 | case 0x1d: | |
494 | if(offset+bytes > 0x100) { | |
495 | Dbprintf("Error: can not write to 0x%03.3x on MIM 256", offset+bytes); | |
496 | return; | |
497 | } | |
498 | addr_sz = 8; | |
499 | Dbprintf("MIM 256 card found, writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes); | |
500 | break; | |
501 | case 0x3d: | |
502 | if(offset+bytes > 0x400) { | |
503 | Dbprintf("Error: can not write to 0x%03.3x on MIM 1024", offset+bytes); | |
504 | return; | |
505 | } | |
506 | addr_sz = 10; | |
507 | Dbprintf("MIM 1024 card found, writing 0x%03.3x - 0x%03.3x ...", offset, offset+bytes); | |
508 | break; | |
509 | default: | |
510 | Dbprintf("No or unknown card found, aborting"); | |
511 | return; | |
512 | } | |
513 | ||
514 | LED_B_ON(); | |
515 | perform_setup_phase_rwd(SESSION_IV); | |
516 | legic_prng_forward(2); | |
517 | while(byte_index < bytes) { | |
117d9ec2 | 518 | int r = legic_write_byte(BigBuf[byte_index+offset], byte_index+offset, addr_sz); |
3612a8a8 | 519 | if((r != 0) || BUTTON_PRESS()) { |
520 | Dbprintf("operation aborted @ 0x%03.3x", byte_index); | |
521 | switch_off_tag_rwd(); | |
522 | LED_B_OFF(); | |
523 | LED_C_OFF(); | |
524 | return; | |
525 | } | |
526 | WDT_HIT(); | |
527 | byte_index++; | |
528 | if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF(); | |
529 | } | |
530 | LED_B_OFF(); | |
531 | LED_C_OFF(); | |
532 | DbpString("write successful"); | |
533 | } | |
534 | ||
535 | int timestamp; | |
536 | ||
537 | /* Handle (whether to respond) a frame in tag mode */ | |
538 | static void frame_handle_tag(struct legic_frame const * const f) | |
539 | { | |
117d9ec2 | 540 | uint8_t *BigBuf = BigBuf_get_addr(); |
541 | ||
3612a8a8 | 542 | /* First Part of Handshake (IV) */ |
543 | if(f->bits == 7) { | |
544 | if(f->data == SESSION_IV) { | |
545 | LED_C_ON(); | |
546 | prng_timer->TC_CCR = AT91C_TC_SWTRG; | |
547 | legic_prng_init(f->data); | |
548 | frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1b */ | |
549 | legic_state = STATE_IV; | |
550 | legic_read_count = 0; | |
551 | legic_prng_bc = 0; | |
552 | legic_prng_iv = f->data; | |
553 | ||
554 | /* TIMEOUT */ | |
555 | timer->TC_CCR = AT91C_TC_SWTRG; | |
556 | while(timer->TC_CV > 1); | |
557 | while(timer->TC_CV < 280); | |
558 | return; | |
559 | } else if((prng_timer->TC_CV % 50) > 40) { | |
560 | legic_prng_init(f->data); | |
561 | frame_send_tag(0x3d, 6, 1); | |
562 | SpinDelay(20); | |
563 | return; | |
564 | } | |
565 | } | |
566 | ||
567 | /* 0x19==??? */ | |
568 | if(legic_state == STATE_IV) { | |
569 | if((f->bits == 6) && (f->data == (0x19 ^ get_key_stream(1, 6)))) { | |
570 | legic_state = STATE_CON; | |
571 | ||
572 | /* TIMEOUT */ | |
573 | timer->TC_CCR = AT91C_TC_SWTRG; | |
574 | while(timer->TC_CV > 1); | |
575 | while(timer->TC_CV < 200); | |
576 | return; | |
577 | } else { | |
578 | legic_state = STATE_DISCON; | |
579 | LED_C_OFF(); | |
580 | Dbprintf("0x19 - Frame: %03.3x", f->data); | |
581 | return; | |
582 | } | |
583 | } | |
584 | ||
585 | /* Read */ | |
586 | if(f->bits == 11) { | |
587 | if(legic_state == STATE_CON) { | |
588 | int key = get_key_stream(-1, 11); //legic_phase_drift, 11); | |
589 | int addr = f->data ^ key; addr = addr >> 1; | |
117d9ec2 | 590 | int data = BigBuf[addr]; |
3612a8a8 | 591 | int hash = LegicCRC(addr, data, 11) << 8; |
117d9ec2 | 592 | BigBuf[OFFSET_LOG+legic_read_count] = (uint8_t)addr; |
3612a8a8 | 593 | legic_read_count++; |
594 | ||
595 | //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c); | |
596 | legic_prng_forward(legic_reqresp_drift); | |
597 | ||
598 | frame_send_tag(hash | data, 12, 1); | |
599 | ||
600 | /* SHORT TIMEOUT */ | |
601 | timer->TC_CCR = AT91C_TC_SWTRG; | |
602 | while(timer->TC_CV > 1); | |
603 | legic_prng_forward(legic_frame_drift); | |
604 | while(timer->TC_CV < 180); | |
605 | return; | |
606 | } | |
607 | } | |
608 | ||
609 | /* Write */ | |
610 | if(f->bits == 23) { | |
611 | int key = get_key_stream(-1, 23); //legic_frame_drift, 23); | |
612 | int addr = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff; | |
613 | int data = f->data ^ key; data = data >> 11; data = data & 0xff; | |
614 | ||
615 | /* write command */ | |
616 | legic_state = STATE_DISCON; | |
617 | LED_C_OFF(); | |
618 | Dbprintf("write - addr: %x, data: %x", addr, data); | |
619 | return; | |
620 | } | |
621 | ||
622 | if(legic_state != STATE_DISCON) { | |
623 | Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count); | |
624 | int i; | |
625 | Dbprintf("IV: %03.3x", legic_prng_iv); | |
626 | for(i = 0; i<legic_read_count; i++) { | |
117d9ec2 | 627 | Dbprintf("Read Nb: %u, Addr: %u", i, BigBuf[OFFSET_LOG+i]); |
3612a8a8 | 628 | } |
629 | ||
630 | for(i = -1; i<legic_read_count; i++) { | |
631 | uint32_t t; | |
117d9ec2 | 632 | t = BigBuf[OFFSET_LOG+256+i*4]; |
633 | t |= BigBuf[OFFSET_LOG+256+i*4+1] << 8; | |
634 | t |= BigBuf[OFFSET_LOG+256+i*4+2] <<16; | |
635 | t |= BigBuf[OFFSET_LOG+256+i*4+3] <<24; | |
3612a8a8 | 636 | |
637 | Dbprintf("Cycles: %u, Frame Length: %u, Time: %u", | |
117d9ec2 | 638 | BigBuf[OFFSET_LOG+128+i], |
639 | BigBuf[OFFSET_LOG+384+i], | |
3612a8a8 | 640 | t); |
641 | } | |
642 | } | |
643 | legic_state = STATE_DISCON; | |
644 | legic_read_count = 0; | |
645 | SpinDelay(10); | |
646 | LED_C_OFF(); | |
647 | return; | |
648 | } | |
649 | ||
650 | /* Read bit by bit untill full frame is received | |
651 | * Call to process frame end answer | |
652 | */ | |
653 | static void emit(int bit) | |
654 | { | |
655 | if(bit == -1) { | |
656 | if(current_frame.bits <= 4) { | |
657 | frame_clean(¤t_frame); | |
658 | } else { | |
659 | frame_handle_tag(¤t_frame); | |
660 | frame_clean(¤t_frame); | |
661 | } | |
662 | WDT_HIT(); | |
663 | } else if(bit == 0) { | |
664 | frame_append_bit(¤t_frame, 0); | |
665 | } else if(bit == 1) { | |
666 | frame_append_bit(¤t_frame, 1); | |
667 | } | |
668 | } | |
669 | ||
670 | void LegicRfSimulate(int phase, int frame, int reqresp) | |
671 | { | |
672 | /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode, | |
673 | * modulation mode set to 212kHz subcarrier. We are getting the incoming raw | |
674 | * envelope waveform on DIN and should send our response on DOUT. | |
675 | * | |
676 | * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll | |
677 | * measure the time between two rising edges on DIN, and no encoding on the | |
678 | * subcarrier from card to reader, so we'll just shift out our verbatim data | |
679 | * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear, | |
680 | * seems to be 300us-ish. | |
681 | */ | |
682 | ||
683 | if(phase < 0) { | |
684 | int i; | |
685 | for(i=0; i<=reqresp; i++) { | |
686 | legic_prng_init(SESSION_IV); | |
687 | Dbprintf("i=%u, key 0x%3.3x", i, get_key_stream(i, frame)); | |
688 | } | |
689 | return; | |
690 | } | |
691 | ||
692 | legic_phase_drift = phase; | |
693 | legic_frame_drift = frame; | |
694 | legic_reqresp_drift = reqresp; | |
695 | ||
7cc204bf | 696 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
3612a8a8 | 697 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
698 | FpgaSetupSsc(); | |
699 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K); | |
700 | ||
701 | /* Bitbang the receiver */ | |
702 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
703 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
704 | ||
705 | setup_timer(); | |
706 | crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0); | |
707 | ||
708 | int old_level = 0; | |
709 | int active = 0; | |
710 | legic_state = STATE_DISCON; | |
711 | ||
712 | LED_B_ON(); | |
713 | DbpString("Starting Legic emulator, press button to end"); | |
714 | while(!BUTTON_PRESS()) { | |
715 | int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
716 | int time = timer->TC_CV; | |
717 | ||
718 | if(level != old_level) { | |
719 | if(level == 1) { | |
720 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
721 | if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) { | |
722 | /* 1 bit */ | |
723 | emit(1); | |
724 | active = 1; | |
725 | LED_A_ON(); | |
726 | } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) { | |
727 | /* 0 bit */ | |
728 | emit(0); | |
729 | active = 1; | |
730 | LED_A_ON(); | |
731 | } else if(active) { | |
732 | /* invalid */ | |
733 | emit(-1); | |
734 | active = 0; | |
735 | LED_A_OFF(); | |
736 | } | |
737 | } | |
738 | } | |
739 | ||
740 | if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) { | |
741 | /* Frame end */ | |
742 | emit(-1); | |
743 | active = 0; | |
744 | LED_A_OFF(); | |
745 | } | |
746 | ||
747 | if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) { | |
748 | timer->TC_CCR = AT91C_TC_CLKDIS; | |
749 | } | |
750 | ||
751 | old_level = level; | |
752 | WDT_HIT(); | |
753 | } | |
754 | DbpString("Stopped"); | |
755 | LED_B_OFF(); | |
756 | LED_A_OFF(); | |
757 | LED_C_OFF(); | |
dcc10e5e | 758 | } |
a2b1414f | 759 |