]>
Commit | Line | Data |
---|---|---|
15c4dc5a | 1 | //----------------------------------------------------------------------------- |
2 | // Miscellaneous routines for low frequency tag operations. | |
3 | // Tags supported here so far are Texas Instruments (TI), HID | |
4 | // Also routines for raw mode reading/simulating of LF waveform | |
5 | // | |
6 | //----------------------------------------------------------------------------- | |
e30c654b | 7 | #include "proxmark3.h" |
15c4dc5a | 8 | #include "apps.h" |
9 | #include "hitag2.h" | |
10 | #include "crc16.h" | |
11 | ||
12 | void AcquireRawAdcSamples125k(BOOL at134khz) | |
13 | { | |
14 | if (at134khz) | |
15 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
16 | else | |
17 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
18 | ||
19 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
20 | ||
21 | // Connect the A/D to the peak-detected low-frequency path. | |
22 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); | |
23 | ||
24 | // Give it a bit of time for the resonant antenna to settle. | |
25 | SpinDelay(50); | |
26 | ||
27 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
28 | FpgaSetupSsc(); | |
29 | ||
30 | // Now call the acquisition routine | |
31 | DoAcquisition125k(); | |
32 | } | |
33 | ||
34 | // split into two routines so we can avoid timing issues after sending commands // | |
35 | void DoAcquisition125k(void) | |
36 | { | |
37 | BYTE *dest = (BYTE *)BigBuf; | |
38 | int n = sizeof(BigBuf); | |
39 | int i; | |
e30c654b | 40 | |
15c4dc5a | 41 | memset(dest, 0, n); |
42 | i = 0; | |
43 | for(;;) { | |
44 | if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) { | |
45 | AT91C_BASE_SSC->SSC_THR = 0x43; | |
46 | LED_D_ON(); | |
47 | } | |
48 | if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) { | |
49 | dest[i] = (BYTE)AT91C_BASE_SSC->SSC_RHR; | |
50 | i++; | |
51 | LED_D_OFF(); | |
52 | if (i >= n) break; | |
53 | } | |
54 | } | |
55 | Dbprintf("buffer samples: %02x %02x %02x %02x %02x %02x %02x %02x ...", | |
56 | dest[0], dest[1], dest[2], dest[3], dest[4], dest[5], dest[6], dest[7]); | |
57 | } | |
58 | ||
59 | void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, BYTE *command) | |
60 | { | |
61 | BOOL at134khz; | |
62 | ||
63 | /* Make sure the tag is reset */ | |
64 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
65 | SpinDelay(2500); | |
e30c654b | 66 | |
15c4dc5a | 67 | // see if 'h' was specified |
68 | if (command[strlen((char *) command) - 1] == 'h') | |
69 | at134khz = TRUE; | |
70 | else | |
71 | at134khz = FALSE; | |
72 | ||
73 | if (at134khz) | |
74 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
75 | else | |
76 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
77 | ||
78 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
79 | ||
80 | // Give it a bit of time for the resonant antenna to settle. | |
81 | SpinDelay(50); | |
82 | // And a little more time for the tag to fully power up | |
83 | SpinDelay(2000); | |
84 | ||
85 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
86 | FpgaSetupSsc(); | |
87 | ||
88 | // now modulate the reader field | |
89 | while(*command != '\0' && *command != ' ') { | |
90 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
91 | LED_D_OFF(); | |
92 | SpinDelayUs(delay_off); | |
93 | if (at134khz) | |
94 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
95 | else | |
96 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
97 | ||
98 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
99 | LED_D_ON(); | |
100 | if(*(command++) == '0') | |
101 | SpinDelayUs(period_0); | |
102 | else | |
103 | SpinDelayUs(period_1); | |
104 | } | |
105 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
106 | LED_D_OFF(); | |
107 | SpinDelayUs(delay_off); | |
108 | if (at134khz) | |
109 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
110 | else | |
111 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
112 | ||
113 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
114 | ||
115 | // now do the read | |
116 | DoAcquisition125k(); | |
117 | } | |
118 | ||
119 | /* blank r/w tag data stream | |
120 | ...0000000000000000 01111111 | |
121 | 1010101010101010101010101010101010101010101010101010101010101010 | |
122 | 0011010010100001 | |
123 | 01111111 | |
124 | 101010101010101[0]000... | |
125 | ||
126 | [5555fe852c5555555555555555fe0000] | |
127 | */ | |
128 | void ReadTItag(void) | |
129 | { | |
130 | // some hardcoded initial params | |
131 | // when we read a TI tag we sample the zerocross line at 2Mhz | |
132 | // TI tags modulate a 1 as 16 cycles of 123.2Khz | |
133 | // TI tags modulate a 0 as 16 cycles of 134.2Khz | |
134 | #define FSAMPLE 2000000 | |
135 | #define FREQLO 123200 | |
136 | #define FREQHI 134200 | |
137 | ||
138 | signed char *dest = (signed char *)BigBuf; | |
139 | int n = sizeof(BigBuf); | |
140 | // int *dest = GraphBuffer; | |
141 | // int n = GraphTraceLen; | |
142 | ||
143 | // 128 bit shift register [shift3:shift2:shift1:shift0] | |
144 | DWORD shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0; | |
145 | ||
146 | int i, cycles=0, samples=0; | |
147 | // how many sample points fit in 16 cycles of each frequency | |
148 | DWORD sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI; | |
149 | // when to tell if we're close enough to one freq or another | |
150 | DWORD threshold = (sampleslo - sampleshi + 1)>>1; | |
151 | ||
152 | // TI tags charge at 134.2Khz | |
153 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
154 | ||
155 | // Place FPGA in passthrough mode, in this mode the CROSS_LO line | |
156 | // connects to SSP_DIN and the SSP_DOUT logic level controls | |
157 | // whether we're modulating the antenna (high) | |
158 | // or listening to the antenna (low) | |
159 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU); | |
160 | ||
161 | // get TI tag data into the buffer | |
162 | AcquireTiType(); | |
163 | ||
164 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
165 | ||
166 | for (i=0; i<n-1; i++) { | |
167 | // count cycles by looking for lo to hi zero crossings | |
168 | if ( (dest[i]<0) && (dest[i+1]>0) ) { | |
169 | cycles++; | |
170 | // after 16 cycles, measure the frequency | |
171 | if (cycles>15) { | |
172 | cycles=0; | |
173 | samples=i-samples; // number of samples in these 16 cycles | |
174 | ||
175 | // TI bits are coming to us lsb first so shift them | |
176 | // right through our 128 bit right shift register | |
177 | shift0 = (shift0>>1) | (shift1 << 31); | |
178 | shift1 = (shift1>>1) | (shift2 << 31); | |
179 | shift2 = (shift2>>1) | (shift3 << 31); | |
180 | shift3 >>= 1; | |
181 | ||
182 | // check if the cycles fall close to the number | |
183 | // expected for either the low or high frequency | |
184 | if ( (samples>(sampleslo-threshold)) && (samples<(sampleslo+threshold)) ) { | |
185 | // low frequency represents a 1 | |
186 | shift3 |= (1<<31); | |
187 | } else if ( (samples>(sampleshi-threshold)) && (samples<(sampleshi+threshold)) ) { | |
188 | // high frequency represents a 0 | |
189 | } else { | |
190 | // probably detected a gay waveform or noise | |
191 | // use this as gaydar or discard shift register and start again | |
192 | shift3 = shift2 = shift1 = shift0 = 0; | |
193 | } | |
194 | samples = i; | |
195 | ||
196 | // for each bit we receive, test if we've detected a valid tag | |
197 | ||
198 | // if we see 17 zeroes followed by 6 ones, we might have a tag | |
199 | // remember the bits are backwards | |
200 | if ( ((shift0 & 0x7fffff) == 0x7e0000) ) { | |
201 | // if start and end bytes match, we have a tag so break out of the loop | |
202 | if ( ((shift0>>16)&0xff) == ((shift3>>8)&0xff) ) { | |
203 | cycles = 0xF0B; //use this as a flag (ugly but whatever) | |
204 | break; | |
205 | } | |
206 | } | |
207 | } | |
208 | } | |
209 | } | |
210 | ||
211 | // if flag is set we have a tag | |
212 | if (cycles!=0xF0B) { | |
213 | DbpString("Info: No valid tag detected."); | |
214 | } else { | |
215 | // put 64 bit data into shift1 and shift0 | |
216 | shift0 = (shift0>>24) | (shift1 << 8); | |
217 | shift1 = (shift1>>24) | (shift2 << 8); | |
218 | ||
219 | // align 16 bit crc into lower half of shift2 | |
220 | shift2 = ((shift2>>24) | (shift3 << 8)) & 0x0ffff; | |
221 | ||
222 | // if r/w tag, check ident match | |
223 | if ( shift3&(1<<15) ) { | |
224 | DbpString("Info: TI tag is rewriteable"); | |
225 | // only 15 bits compare, last bit of ident is not valid | |
226 | if ( ((shift3>>16)^shift0)&0x7fff ) { | |
227 | DbpString("Error: Ident mismatch!"); | |
228 | } else { | |
229 | DbpString("Info: TI tag ident is valid"); | |
230 | } | |
231 | } else { | |
232 | DbpString("Info: TI tag is readonly"); | |
233 | } | |
234 | ||
235 | // WARNING the order of the bytes in which we calc crc below needs checking | |
236 | // i'm 99% sure the crc algorithm is correct, but it may need to eat the | |
237 | // bytes in reverse or something | |
238 | // calculate CRC | |
239 | DWORD crc=0; | |
240 | ||
241 | crc = update_crc16(crc, (shift0)&0xff); | |
242 | crc = update_crc16(crc, (shift0>>8)&0xff); | |
243 | crc = update_crc16(crc, (shift0>>16)&0xff); | |
244 | crc = update_crc16(crc, (shift0>>24)&0xff); | |
245 | crc = update_crc16(crc, (shift1)&0xff); | |
246 | crc = update_crc16(crc, (shift1>>8)&0xff); | |
247 | crc = update_crc16(crc, (shift1>>16)&0xff); | |
248 | crc = update_crc16(crc, (shift1>>24)&0xff); | |
249 | ||
250 | Dbprintf("Info: Tag data: %x%08x, crc=%x", | |
251 | (unsigned int)shift1, (unsigned int)shift0, (unsigned int)shift2 & 0xFFFF); | |
252 | if (crc != (shift2&0xffff)) { | |
253 | Dbprintf("Error: CRC mismatch, expected %x", (unsigned int)crc); | |
254 | } else { | |
255 | DbpString("Info: CRC is good"); | |
256 | } | |
257 | } | |
258 | } | |
259 | ||
260 | void WriteTIbyte(BYTE b) | |
261 | { | |
262 | int i = 0; | |
263 | ||
264 | // modulate 8 bits out to the antenna | |
265 | for (i=0; i<8; i++) | |
266 | { | |
267 | if (b&(1<<i)) { | |
268 | // stop modulating antenna | |
269 | LOW(GPIO_SSC_DOUT); | |
270 | SpinDelayUs(1000); | |
271 | // modulate antenna | |
272 | HIGH(GPIO_SSC_DOUT); | |
273 | SpinDelayUs(1000); | |
274 | } else { | |
275 | // stop modulating antenna | |
276 | LOW(GPIO_SSC_DOUT); | |
277 | SpinDelayUs(300); | |
278 | // modulate antenna | |
279 | HIGH(GPIO_SSC_DOUT); | |
280 | SpinDelayUs(1700); | |
281 | } | |
282 | } | |
283 | } | |
284 | ||
285 | void AcquireTiType(void) | |
286 | { | |
287 | int i, j, n; | |
288 | // tag transmission is <20ms, sampling at 2M gives us 40K samples max | |
289 | // each sample is 1 bit stuffed into a DWORD so we need 1250 DWORDS | |
290 | #define TIBUFLEN 1250 | |
291 | ||
292 | // clear buffer | |
293 | memset(BigBuf,0,sizeof(BigBuf)); | |
294 | ||
295 | // Set up the synchronous serial port | |
296 | AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DIN; | |
297 | AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN; | |
298 | ||
299 | // steal this pin from the SSP and use it to control the modulation | |
300 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
301 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
302 | ||
303 | AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST; | |
304 | AT91C_BASE_SSC->SSC_CR = AT91C_SSC_RXEN | AT91C_SSC_TXEN; | |
305 | ||
306 | // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long | |
307 | // 48/2 = 24 MHz clock must be divided by 12 | |
308 | AT91C_BASE_SSC->SSC_CMR = 12; | |
309 | ||
310 | AT91C_BASE_SSC->SSC_RCMR = SSC_CLOCK_MODE_SELECT(0); | |
311 | AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(32) | AT91C_SSC_MSBF; | |
312 | AT91C_BASE_SSC->SSC_TCMR = 0; | |
313 | AT91C_BASE_SSC->SSC_TFMR = 0; | |
314 | ||
315 | LED_D_ON(); | |
316 | ||
317 | // modulate antenna | |
318 | HIGH(GPIO_SSC_DOUT); | |
319 | ||
320 | // Charge TI tag for 50ms. | |
321 | SpinDelay(50); | |
322 | ||
323 | // stop modulating antenna and listen | |
324 | LOW(GPIO_SSC_DOUT); | |
325 | ||
326 | LED_D_OFF(); | |
327 | ||
328 | i = 0; | |
329 | for(;;) { | |
330 | if(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) { | |
331 | BigBuf[i] = AT91C_BASE_SSC->SSC_RHR; // store 32 bit values in buffer | |
332 | i++; if(i >= TIBUFLEN) break; | |
333 | } | |
334 | WDT_HIT(); | |
335 | } | |
336 | ||
337 | // return stolen pin to SSP | |
338 | AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DOUT; | |
339 | AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN | GPIO_SSC_DOUT; | |
340 | ||
341 | char *dest = (char *)BigBuf; | |
342 | n = TIBUFLEN*32; | |
343 | // unpack buffer | |
344 | for (i=TIBUFLEN-1; i>=0; i--) { | |
345 | for (j=0; j<32; j++) { | |
346 | if(BigBuf[i] & (1 << j)) { | |
347 | dest[--n] = 1; | |
348 | } else { | |
349 | dest[--n] = -1; | |
350 | } | |
351 | } | |
352 | } | |
353 | } | |
354 | ||
355 | // arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc | |
356 | // if crc provided, it will be written with the data verbatim (even if bogus) | |
357 | // if not provided a valid crc will be computed from the data and written. | |
358 | void WriteTItag(DWORD idhi, DWORD idlo, WORD crc) | |
359 | { | |
360 | if(crc == 0) { | |
361 | crc = update_crc16(crc, (idlo)&0xff); | |
362 | crc = update_crc16(crc, (idlo>>8)&0xff); | |
363 | crc = update_crc16(crc, (idlo>>16)&0xff); | |
364 | crc = update_crc16(crc, (idlo>>24)&0xff); | |
365 | crc = update_crc16(crc, (idhi)&0xff); | |
366 | crc = update_crc16(crc, (idhi>>8)&0xff); | |
367 | crc = update_crc16(crc, (idhi>>16)&0xff); | |
368 | crc = update_crc16(crc, (idhi>>24)&0xff); | |
369 | } | |
370 | Dbprintf("Writing to tag: %x%08x, crc=%x", | |
371 | (unsigned int) idhi, (unsigned int) idlo, crc); | |
372 | ||
373 | // TI tags charge at 134.2Khz | |
374 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
375 | // Place FPGA in passthrough mode, in this mode the CROSS_LO line | |
376 | // connects to SSP_DIN and the SSP_DOUT logic level controls | |
377 | // whether we're modulating the antenna (high) | |
378 | // or listening to the antenna (low) | |
379 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU); | |
380 | LED_A_ON(); | |
381 | ||
382 | // steal this pin from the SSP and use it to control the modulation | |
383 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
384 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
385 | ||
386 | // writing algorithm: | |
387 | // a high bit consists of a field off for 1ms and field on for 1ms | |
388 | // a low bit consists of a field off for 0.3ms and field on for 1.7ms | |
389 | // initiate a charge time of 50ms (field on) then immediately start writing bits | |
390 | // start by writing 0xBB (keyword) and 0xEB (password) | |
391 | // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer) | |
392 | // finally end with 0x0300 (write frame) | |
393 | // all data is sent lsb firts | |
394 | // finish with 15ms programming time | |
395 | ||
396 | // modulate antenna | |
397 | HIGH(GPIO_SSC_DOUT); | |
398 | SpinDelay(50); // charge time | |
399 | ||
400 | WriteTIbyte(0xbb); // keyword | |
401 | WriteTIbyte(0xeb); // password | |
402 | WriteTIbyte( (idlo )&0xff ); | |
403 | WriteTIbyte( (idlo>>8 )&0xff ); | |
404 | WriteTIbyte( (idlo>>16)&0xff ); | |
405 | WriteTIbyte( (idlo>>24)&0xff ); | |
406 | WriteTIbyte( (idhi )&0xff ); | |
407 | WriteTIbyte( (idhi>>8 )&0xff ); | |
408 | WriteTIbyte( (idhi>>16)&0xff ); | |
409 | WriteTIbyte( (idhi>>24)&0xff ); // data hi to lo | |
410 | WriteTIbyte( (crc )&0xff ); // crc lo | |
411 | WriteTIbyte( (crc>>8 )&0xff ); // crc hi | |
412 | WriteTIbyte(0x00); // write frame lo | |
413 | WriteTIbyte(0x03); // write frame hi | |
414 | HIGH(GPIO_SSC_DOUT); | |
415 | SpinDelay(50); // programming time | |
416 | ||
417 | LED_A_OFF(); | |
418 | ||
419 | // get TI tag data into the buffer | |
420 | AcquireTiType(); | |
421 | ||
422 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
423 | DbpString("Now use tiread to check"); | |
424 | } | |
425 | ||
426 | void SimulateTagLowFrequency(int period, int gap, int ledcontrol) | |
427 | { | |
428 | int i; | |
429 | BYTE *tab = (BYTE *)BigBuf; | |
430 | ||
431 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR); | |
432 | ||
433 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK; | |
434 | ||
435 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
436 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK; | |
437 | ||
438 | #define SHORT_COIL() LOW(GPIO_SSC_DOUT) | |
439 | #define OPEN_COIL() HIGH(GPIO_SSC_DOUT) | |
440 | ||
441 | i = 0; | |
442 | for(;;) { | |
443 | while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) { | |
444 | if(BUTTON_PRESS()) { | |
445 | DbpString("Stopped"); | |
446 | return; | |
447 | } | |
448 | WDT_HIT(); | |
449 | } | |
450 | ||
451 | if (ledcontrol) | |
452 | LED_D_ON(); | |
453 | ||
454 | if(tab[i]) | |
455 | OPEN_COIL(); | |
456 | else | |
457 | SHORT_COIL(); | |
458 | ||
459 | if (ledcontrol) | |
460 | LED_D_OFF(); | |
461 | ||
462 | while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) { | |
463 | if(BUTTON_PRESS()) { | |
464 | DbpString("Stopped"); | |
465 | return; | |
466 | } | |
467 | WDT_HIT(); | |
468 | } | |
469 | ||
470 | i++; | |
471 | if(i == period) { | |
472 | i = 0; | |
e30c654b | 473 | if (gap) { |
15c4dc5a | 474 | SHORT_COIL(); |
475 | SpinDelayUs(gap); | |
476 | } | |
477 | } | |
478 | } | |
479 | } | |
480 | ||
481 | /* Provides a framework for bidirectional LF tag communication | |
482 | * Encoding is currently Hitag2, but the general idea can probably | |
483 | * be transferred to other encodings. | |
e30c654b | 484 | * |
15c4dc5a | 485 | * The new FPGA code will, for the LF simulator mode, give on SSC_FRAME |
486 | * (PA15) a thresholded version of the signal from the ADC. Setting the | |
487 | * ADC path to the low frequency peak detection signal, will enable a | |
488 | * somewhat reasonable receiver for modulation on the carrier signal | |
489 | * that is generated by the reader. The signal is low when the reader | |
490 | * field is switched off, and high when the reader field is active. Due | |
491 | * to the way that the signal looks like, mostly only the rising edge is | |
492 | * useful, your mileage may vary. | |
e30c654b | 493 | * |
15c4dc5a | 494 | * Neat perk: PA15 can not only be used as a bit-banging GPIO, but is also |
495 | * TIOA1, which can be used as the capture input for timer 1. This should | |
496 | * make it possible to measure the exact edge-to-edge time, without processor | |
497 | * intervention. | |
e30c654b | 498 | * |
15c4dc5a | 499 | * Arguments: divisor is the divisor to be sent to the FPGA (e.g. 95 for 125kHz) |
500 | * t0 is the carrier frequency cycle duration in terms of MCK (384 for 125kHz) | |
e30c654b | 501 | * |
502 | * The following defines are in carrier periods: | |
15c4dc5a | 503 | */ |
e30c654b | 504 | #define HITAG_T_0_MIN 15 /* T[0] should be 18..22 */ |
15c4dc5a | 505 | #define HITAG_T_1_MIN 24 /* T[1] should be 26..30 */ |
506 | #define HITAG_T_EOF 40 /* T_EOF should be > 36 */ | |
507 | #define HITAG_T_WRESP 208 /* T_wresp should be 204..212 */ | |
508 | ||
509 | static void hitag_handle_frame(int t0, int frame_len, char *frame); | |
510 | //#define DEBUG_RA_VALUES 1 | |
511 | #define DEBUG_FRAME_CONTENTS 1 | |
512 | void SimulateTagLowFrequencyBidir(int divisor, int t0) | |
513 | { | |
514 | #if DEBUG_RA_VALUES || DEBUG_FRAME_CONTENTS | |
515 | int i = 0; | |
516 | #endif | |
517 | char frame[10]; | |
518 | int frame_pos=0; | |
e30c654b | 519 | |
15c4dc5a | 520 | DbpString("Starting Hitag2 emulator, press button to end"); |
521 | hitag2_init(); | |
e30c654b | 522 | |
15c4dc5a | 523 | /* Set up simulator mode, frequency divisor which will drive the FPGA |
524 | * and analog mux selection. | |
525 | */ | |
526 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR); | |
527 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor); | |
528 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); | |
529 | RELAY_OFF(); | |
e30c654b | 530 | |
15c4dc5a | 531 | /* Set up Timer 1: |
532 | * Capture mode, timer source MCK/2 (TIMER_CLOCK1), TIOA is external trigger, | |
533 | * external trigger rising edge, load RA on rising edge of TIOA, load RB on rising | |
534 | * edge of TIOA. Assign PA15 to TIOA1 (peripheral B) | |
535 | */ | |
e30c654b | 536 | |
15c4dc5a | 537 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); |
538 | AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME; | |
539 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; | |
540 | AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK1 | | |
541 | AT91C_TC_ETRGEDG_RISING | | |
542 | AT91C_TC_ABETRG | | |
543 | AT91C_TC_LDRA_RISING | | |
544 | AT91C_TC_LDRB_RISING; | |
545 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | | |
546 | AT91C_TC_SWTRG; | |
e30c654b | 547 | |
15c4dc5a | 548 | /* calculate the new value for the carrier period in terms of TC1 values */ |
549 | t0 = t0/2; | |
e30c654b | 550 | |
15c4dc5a | 551 | int overflow = 0; |
552 | while(!BUTTON_PRESS()) { | |
553 | WDT_HIT(); | |
554 | if(AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) { | |
555 | int ra = AT91C_BASE_TC1->TC_RA; | |
556 | if((ra > t0*HITAG_T_EOF) | overflow) ra = t0*HITAG_T_EOF+1; | |
557 | #if DEBUG_RA_VALUES | |
558 | if(ra > 255 || overflow) ra = 255; | |
559 | ((char*)BigBuf)[i] = ra; | |
560 | i = (i+1) % 8000; | |
561 | #endif | |
e30c654b | 562 | |
15c4dc5a | 563 | if(overflow || (ra > t0*HITAG_T_EOF) || (ra < t0*HITAG_T_0_MIN)) { |
564 | /* Ignore */ | |
565 | } else if(ra >= t0*HITAG_T_1_MIN ) { | |
566 | /* '1' bit */ | |
567 | if(frame_pos < 8*sizeof(frame)) { | |
568 | frame[frame_pos / 8] |= 1<<( 7-(frame_pos%8) ); | |
569 | frame_pos++; | |
570 | } | |
571 | } else if(ra >= t0*HITAG_T_0_MIN) { | |
572 | /* '0' bit */ | |
573 | if(frame_pos < 8*sizeof(frame)) { | |
574 | frame[frame_pos / 8] |= 0<<( 7-(frame_pos%8) ); | |
575 | frame_pos++; | |
576 | } | |
577 | } | |
e30c654b | 578 | |
15c4dc5a | 579 | overflow = 0; |
580 | LED_D_ON(); | |
581 | } else { | |
582 | if(AT91C_BASE_TC1->TC_CV > t0*HITAG_T_EOF) { | |
583 | /* Minor nuisance: In Capture mode, the timer can not be | |
584 | * stopped by a Compare C. There's no way to stop the clock | |
585 | * in software, so we'll just have to note the fact that an | |
586 | * overflow happened and the next loaded timer value might | |
587 | * have wrapped. Also, this marks the end of frame, and the | |
588 | * still running counter can be used to determine the correct | |
589 | * time for the start of the reply. | |
e30c654b | 590 | */ |
15c4dc5a | 591 | overflow = 1; |
e30c654b | 592 | |
15c4dc5a | 593 | if(frame_pos > 0) { |
594 | /* Have a frame, do something with it */ | |
595 | #if DEBUG_FRAME_CONTENTS | |
596 | ((char*)BigBuf)[i++] = frame_pos; | |
597 | memcpy( ((char*)BigBuf)+i, frame, 7); | |
598 | i+=7; | |
599 | i = i % sizeof(BigBuf); | |
600 | #endif | |
601 | hitag_handle_frame(t0, frame_pos, frame); | |
602 | memset(frame, 0, sizeof(frame)); | |
603 | } | |
604 | frame_pos = 0; | |
605 | ||
606 | } | |
607 | LED_D_OFF(); | |
608 | } | |
609 | } | |
610 | DbpString("All done"); | |
611 | } | |
612 | ||
613 | static void hitag_send_bit(int t0, int bit) { | |
614 | if(bit == 1) { | |
615 | /* Manchester: Loaded, then unloaded */ | |
616 | LED_A_ON(); | |
617 | SHORT_COIL(); | |
618 | while(AT91C_BASE_TC1->TC_CV < t0*15); | |
619 | OPEN_COIL(); | |
620 | while(AT91C_BASE_TC1->TC_CV < t0*31); | |
621 | LED_A_OFF(); | |
622 | } else if(bit == 0) { | |
623 | /* Manchester: Unloaded, then loaded */ | |
624 | LED_B_ON(); | |
625 | OPEN_COIL(); | |
626 | while(AT91C_BASE_TC1->TC_CV < t0*15); | |
627 | SHORT_COIL(); | |
628 | while(AT91C_BASE_TC1->TC_CV < t0*31); | |
629 | LED_B_OFF(); | |
630 | } | |
631 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; /* Reset clock for the next bit */ | |
e30c654b | 632 | |
15c4dc5a | 633 | } |
634 | static void hitag_send_frame(int t0, int frame_len, const char const * frame, int fdt) | |
635 | { | |
636 | OPEN_COIL(); | |
637 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
e30c654b | 638 | |
15c4dc5a | 639 | /* Wait for HITAG_T_WRESP carrier periods after the last reader bit, |
640 | * not that since the clock counts since the rising edge, but T_wresp is | |
641 | * with respect to the falling edge, we need to wait actually (T_wresp - T_g) | |
642 | * periods. The gap time T_g varies (4..10). | |
643 | */ | |
644 | while(AT91C_BASE_TC1->TC_CV < t0*(fdt-8)); | |
645 | ||
646 | int saved_cmr = AT91C_BASE_TC1->TC_CMR; | |
647 | AT91C_BASE_TC1->TC_CMR &= ~AT91C_TC_ETRGEDG; /* Disable external trigger for the clock */ | |
648 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; /* Reset the clock and use it for response timing */ | |
e30c654b | 649 | |
15c4dc5a | 650 | int i; |
651 | for(i=0; i<5; i++) | |
652 | hitag_send_bit(t0, 1); /* Start of frame */ | |
e30c654b | 653 | |
15c4dc5a | 654 | for(i=0; i<frame_len; i++) { |
655 | hitag_send_bit(t0, !!(frame[i/ 8] & (1<<( 7-(i%8) ))) ); | |
656 | } | |
e30c654b | 657 | |
15c4dc5a | 658 | OPEN_COIL(); |
659 | AT91C_BASE_TC1->TC_CMR = saved_cmr; | |
660 | } | |
661 | ||
662 | /* Callback structure to cleanly separate tag emulation code from the radio layer. */ | |
663 | static int hitag_cb(const char* response_data, const int response_length, const int fdt, void *cb_cookie) | |
664 | { | |
665 | hitag_send_frame(*(int*)cb_cookie, response_length, response_data, fdt); | |
666 | return 0; | |
667 | } | |
668 | /* Frame length in bits, frame contents in MSBit first format */ | |
669 | static void hitag_handle_frame(int t0, int frame_len, char *frame) | |
670 | { | |
671 | hitag2_handle_command(frame, frame_len, hitag_cb, &t0); | |
672 | } | |
673 | ||
674 | // compose fc/8 fc/10 waveform | |
675 | static void fc(int c, int *n) { | |
676 | BYTE *dest = (BYTE *)BigBuf; | |
677 | int idx; | |
678 | ||
679 | // for when we want an fc8 pattern every 4 logical bits | |
680 | if(c==0) { | |
681 | dest[((*n)++)]=1; | |
682 | dest[((*n)++)]=1; | |
683 | dest[((*n)++)]=0; | |
684 | dest[((*n)++)]=0; | |
685 | dest[((*n)++)]=0; | |
686 | dest[((*n)++)]=0; | |
687 | dest[((*n)++)]=0; | |
688 | dest[((*n)++)]=0; | |
689 | } | |
690 | // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples | |
691 | if(c==8) { | |
692 | for (idx=0; idx<6; idx++) { | |
693 | dest[((*n)++)]=1; | |
694 | dest[((*n)++)]=1; | |
695 | dest[((*n)++)]=0; | |
696 | dest[((*n)++)]=0; | |
697 | dest[((*n)++)]=0; | |
698 | dest[((*n)++)]=0; | |
699 | dest[((*n)++)]=0; | |
700 | dest[((*n)++)]=0; | |
701 | } | |
702 | } | |
703 | ||
704 | // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples | |
705 | if(c==10) { | |
706 | for (idx=0; idx<5; idx++) { | |
707 | dest[((*n)++)]=1; | |
708 | dest[((*n)++)]=1; | |
709 | dest[((*n)++)]=1; | |
710 | dest[((*n)++)]=0; | |
711 | dest[((*n)++)]=0; | |
712 | dest[((*n)++)]=0; | |
713 | dest[((*n)++)]=0; | |
714 | dest[((*n)++)]=0; | |
715 | dest[((*n)++)]=0; | |
716 | dest[((*n)++)]=0; | |
717 | } | |
718 | } | |
719 | } | |
720 | ||
721 | // prepare a waveform pattern in the buffer based on the ID given then | |
722 | // simulate a HID tag until the button is pressed | |
723 | void CmdHIDsimTAG(int hi, int lo, int ledcontrol) | |
724 | { | |
725 | int n=0, i=0; | |
726 | /* | |
727 | HID tag bitstream format | |
728 | The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits | |
729 | A 1 bit is represented as 6 fc8 and 5 fc10 patterns | |
730 | A 0 bit is represented as 5 fc10 and 6 fc8 patterns | |
731 | A fc8 is inserted before every 4 bits | |
732 | A special start of frame pattern is used consisting a0b0 where a and b are neither 0 | |
733 | nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10) | |
734 | */ | |
735 | ||
736 | if (hi>0xFFF) { | |
737 | DbpString("Tags can only have 44 bits."); | |
738 | return; | |
739 | } | |
740 | fc(0,&n); | |
741 | // special start of frame marker containing invalid bit sequences | |
742 | fc(8, &n); fc(8, &n); // invalid | |
743 | fc(8, &n); fc(10, &n); // logical 0 | |
744 | fc(10, &n); fc(10, &n); // invalid | |
745 | fc(8, &n); fc(10, &n); // logical 0 | |
746 | ||
747 | WDT_HIT(); | |
748 | // manchester encode bits 43 to 32 | |
749 | for (i=11; i>=0; i--) { | |
750 | if ((i%4)==3) fc(0,&n); | |
751 | if ((hi>>i)&1) { | |
752 | fc(10, &n); fc(8, &n); // low-high transition | |
753 | } else { | |
754 | fc(8, &n); fc(10, &n); // high-low transition | |
755 | } | |
756 | } | |
757 | ||
758 | WDT_HIT(); | |
759 | // manchester encode bits 31 to 0 | |
760 | for (i=31; i>=0; i--) { | |
761 | if ((i%4)==3) fc(0,&n); | |
762 | if ((lo>>i)&1) { | |
763 | fc(10, &n); fc(8, &n); // low-high transition | |
764 | } else { | |
765 | fc(8, &n); fc(10, &n); // high-low transition | |
766 | } | |
767 | } | |
768 | ||
769 | if (ledcontrol) | |
770 | LED_A_ON(); | |
771 | SimulateTagLowFrequency(n, 0, ledcontrol); | |
772 | ||
773 | if (ledcontrol) | |
774 | LED_A_OFF(); | |
775 | } | |
776 | ||
777 | ||
778 | // loop to capture raw HID waveform then FSK demodulate the TAG ID from it | |
779 | void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol) | |
780 | { | |
781 | BYTE *dest = (BYTE *)BigBuf; | |
782 | int m=0, n=0, i=0, idx=0, found=0, lastval=0; | |
783 | DWORD hi=0, lo=0; | |
784 | ||
785 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
786 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
787 | ||
788 | // Connect the A/D to the peak-detected low-frequency path. | |
789 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); | |
790 | ||
791 | // Give it a bit of time for the resonant antenna to settle. | |
792 | SpinDelay(50); | |
793 | ||
794 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
795 | FpgaSetupSsc(); | |
796 | ||
797 | for(;;) { | |
798 | WDT_HIT(); | |
799 | if (ledcontrol) | |
800 | LED_A_ON(); | |
801 | if(BUTTON_PRESS()) { | |
802 | DbpString("Stopped"); | |
803 | if (ledcontrol) | |
804 | LED_A_OFF(); | |
805 | return; | |
806 | } | |
807 | ||
808 | i = 0; | |
809 | m = sizeof(BigBuf); | |
810 | memset(dest,128,m); | |
811 | for(;;) { | |
812 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { | |
813 | AT91C_BASE_SSC->SSC_THR = 0x43; | |
814 | if (ledcontrol) | |
815 | LED_D_ON(); | |
816 | } | |
817 | if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { | |
818 | dest[i] = (BYTE)AT91C_BASE_SSC->SSC_RHR; | |
819 | // we don't care about actual value, only if it's more or less than a | |
820 | // threshold essentially we capture zero crossings for later analysis | |
821 | if(dest[i] < 127) dest[i] = 0; else dest[i] = 1; | |
822 | i++; | |
823 | if (ledcontrol) | |
824 | LED_D_OFF(); | |
825 | if(i >= m) { | |
826 | break; | |
827 | } | |
828 | } | |
829 | } | |
830 | ||
831 | // FSK demodulator | |
832 | ||
833 | // sync to first lo-hi transition | |
834 | for( idx=1; idx<m; idx++) { | |
835 | if (dest[idx-1]<dest[idx]) | |
836 | lastval=idx; | |
837 | break; | |
838 | } | |
839 | WDT_HIT(); | |
840 | ||
841 | // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8) | |
842 | // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere | |
843 | // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10 | |
844 | for( i=0; idx<m; idx++) { | |
845 | if (dest[idx-1]<dest[idx]) { | |
846 | dest[i]=idx-lastval; | |
847 | if (dest[i] <= 8) { | |
848 | dest[i]=1; | |
849 | } else { | |
850 | dest[i]=0; | |
851 | } | |
852 | ||
853 | lastval=idx; | |
854 | i++; | |
855 | } | |
856 | } | |
857 | m=i; | |
858 | WDT_HIT(); | |
859 | ||
860 | // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns | |
861 | lastval=dest[0]; | |
862 | idx=0; | |
863 | i=0; | |
864 | n=0; | |
865 | for( idx=0; idx<m; idx++) { | |
866 | if (dest[idx]==lastval) { | |
867 | n++; | |
868 | } else { | |
869 | // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents, | |
870 | // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets | |
871 | // swallowed up by rounding | |
872 | // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding | |
873 | // special start of frame markers use invalid manchester states (no transitions) by using sequences | |
874 | // like 111000 | |
875 | if (dest[idx-1]) { | |
876 | n=(n+1)/6; // fc/8 in sets of 6 | |
877 | } else { | |
878 | n=(n+1)/5; // fc/10 in sets of 5 | |
879 | } | |
880 | switch (n) { // stuff appropriate bits in buffer | |
881 | case 0: | |
882 | case 1: // one bit | |
883 | dest[i++]=dest[idx-1]; | |
884 | break; | |
885 | case 2: // two bits | |
886 | dest[i++]=dest[idx-1]; | |
887 | dest[i++]=dest[idx-1]; | |
888 | break; | |
889 | case 3: // 3 bit start of frame markers | |
890 | dest[i++]=dest[idx-1]; | |
891 | dest[i++]=dest[idx-1]; | |
892 | dest[i++]=dest[idx-1]; | |
893 | break; | |
894 | // When a logic 0 is immediately followed by the start of the next transmisson | |
895 | // (special pattern) a pattern of 4 bit duration lengths is created. | |
896 | case 4: | |
897 | dest[i++]=dest[idx-1]; | |
898 | dest[i++]=dest[idx-1]; | |
899 | dest[i++]=dest[idx-1]; | |
900 | dest[i++]=dest[idx-1]; | |
901 | break; | |
902 | default: // this shouldn't happen, don't stuff any bits | |
903 | break; | |
904 | } | |
905 | n=0; | |
906 | lastval=dest[idx]; | |
907 | } | |
908 | } | |
909 | m=i; | |
910 | WDT_HIT(); | |
911 | ||
912 | // final loop, go over previously decoded manchester data and decode into usable tag ID | |
913 | // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0 | |
914 | for( idx=0; idx<m-6; idx++) { | |
915 | // search for a start of frame marker | |
916 | if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) ) | |
917 | { | |
918 | found=1; | |
919 | idx+=6; | |
920 | if (found && (hi|lo)) { | |
921 | Dbprintf("TAG ID: %x%08x (%d)", | |
922 | (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); | |
923 | /* if we're only looking for one tag */ | |
924 | if (findone) | |
925 | { | |
926 | *high = hi; | |
927 | *low = lo; | |
928 | return; | |
929 | } | |
930 | hi=0; | |
931 | lo=0; | |
932 | found=0; | |
933 | } | |
934 | } | |
935 | if (found) { | |
936 | if (dest[idx] && (!dest[idx+1]) ) { | |
937 | hi=(hi<<1)|(lo>>31); | |
938 | lo=(lo<<1)|0; | |
939 | } else if ( (!dest[idx]) && dest[idx+1]) { | |
940 | hi=(hi<<1)|(lo>>31); | |
941 | lo=(lo<<1)|1; | |
942 | } else { | |
943 | found=0; | |
944 | hi=0; | |
945 | lo=0; | |
946 | } | |
947 | idx++; | |
948 | } | |
949 | if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) ) | |
950 | { | |
951 | found=1; | |
952 | idx+=6; | |
953 | if (found && (hi|lo)) { | |
954 | Dbprintf("TAG ID: %x%08x (%d)", | |
955 | (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); | |
956 | /* if we're only looking for one tag */ | |
957 | if (findone) | |
958 | { | |
959 | *high = hi; | |
960 | *low = lo; | |
961 | return; | |
962 | } | |
963 | hi=0; | |
964 | lo=0; | |
965 | found=0; | |
966 | } | |
967 | } | |
968 | } | |
969 | WDT_HIT(); | |
970 | } | |
971 | } |