]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * LEGIC RF simulation code | |
3 | * | |
4 | * (c) 2009 Henryk Plötz <henryk@ploetzli.ch> | |
5 | */ | |
6 | ||
7 | #include <proxmark3.h> | |
8 | ||
9 | #include "apps.h" | |
10 | #include "legicrf.h" | |
11 | #include "unistd.h" | |
12 | #include "stdint.h" | |
13 | ||
14 | static struct legic_frame { | |
15 | int bits; | |
16 | uint16_t data; | |
17 | } current_frame; | |
18 | AT91PS_TC timer; | |
19 | ||
20 | static void setup_timer(void) | |
21 | { | |
22 | /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging | |
23 | * this it won't be terribly accurate but should be good enough. | |
24 | */ | |
25 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); | |
26 | timer = AT91C_BASE_TC1; | |
27 | timer->TC_CCR = AT91C_TC_CLKDIS; | |
28 | timer->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3; | |
29 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
30 | ||
31 | /* At TIMER_CLOCK3 (MCK/32) */ | |
32 | #define RWD_TIME_1 150 /* RWD_TIME_PAUSE off, 80us on = 100us */ | |
33 | #define RWD_TIME_0 90 /* RWD_TIME_PAUSE off, 40us on = 60us */ | |
34 | #define RWD_TIME_PAUSE 30 /* 20us */ | |
35 | #define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */ | |
36 | #define TAG_TIME_BIT 150 /* 100us for every bit */ | |
37 | #define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */ | |
38 | ||
39 | } | |
40 | ||
41 | #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz))) | |
42 | ||
43 | static const struct legic_frame queries[] = { | |
44 | {7, 0x55}, /* 1010 101 */ | |
45 | }; | |
46 | ||
47 | static const struct legic_frame responses[] = { | |
48 | {6, 0x3b}, /* 1101 11 */ | |
49 | }; | |
50 | ||
51 | /* Send a frame in tag mode, the FPGA must have been set up by | |
52 | * LegicRfSimulate | |
53 | */ | |
54 | static void frame_send_tag(uint16_t response, int bits) | |
55 | { | |
56 | #if 0 | |
57 | /* Use the SSC to send a response. 8-bit transfers, LSBit first, 100us per bit */ | |
58 | #else | |
59 | /* Bitbang the response */ | |
60 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
61 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
62 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
63 | ||
64 | /* Wait for the frame start */ | |
65 | while(timer->TC_CV < TAG_TIME_WAIT) ; | |
66 | ||
67 | int i; | |
68 | for(i=0; i<bits; i++) { | |
69 | int nextbit = timer->TC_CV + TAG_TIME_BIT; | |
70 | int bit = response & 1; | |
71 | response = response >> 1; | |
72 | if(bit) | |
73 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
74 | else | |
75 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
76 | while(timer->TC_CV < nextbit) ; | |
77 | } | |
78 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
79 | #endif | |
80 | } | |
81 | ||
82 | /* Figure out a response to a frame in tag mode */ | |
83 | static void frame_respond_tag(struct legic_frame const * const f) | |
84 | { | |
85 | LED_D_ON(); | |
86 | int i, r_size; | |
87 | uint16_t r_data; | |
88 | ||
89 | for(i=0; i<sizeof(queries)/sizeof(queries[0]); i++) { | |
90 | if(f->bits == queries[i].bits && f->data == queries[i].data) { | |
91 | r_data = responses[i].data; | |
92 | r_size = responses[i].bits; | |
93 | break; | |
94 | } | |
95 | } | |
96 | ||
97 | if(r_size != 0) { | |
98 | frame_send_tag(r_data, r_size); | |
99 | LED_A_ON(); | |
100 | } else { | |
101 | LED_A_OFF(); | |
102 | } | |
103 | ||
104 | LED_D_OFF(); | |
105 | } | |
106 | ||
107 | static void frame_append_bit(struct legic_frame * const f, int bit) | |
108 | { | |
109 | if(f->bits >= 15) | |
110 | return; /* Overflow, won't happen */ | |
111 | f->data |= (bit<<f->bits); | |
112 | f->bits++; | |
113 | } | |
114 | ||
115 | static int frame_is_empty(struct legic_frame const * const f) | |
116 | { | |
117 | return( f->bits <= 4 ); | |
118 | } | |
119 | ||
120 | /* Handle (whether to respond) a frame in tag mode */ | |
121 | static void frame_handle_tag(struct legic_frame const * const f) | |
122 | { | |
123 | if(f->bits == 6) { | |
124 | /* Short path */ | |
125 | return; | |
126 | } | |
127 | if( !frame_is_empty(f) ) { | |
128 | frame_respond_tag(f); | |
129 | } | |
130 | } | |
131 | ||
132 | static void frame_clean(struct legic_frame * const f) | |
133 | { | |
134 | f->data = 0; | |
135 | f->bits = 0; | |
136 | } | |
137 | ||
138 | enum emit_mode { | |
139 | EMIT_RWD, /* Emit in tag simulation mode, e.g. the source is the RWD */ | |
140 | EMIT_TAG /* Emit in reader simulation mode, e.g. the source is the TAG */ | |
141 | }; | |
142 | static void emit(enum emit_mode mode, int bit) | |
143 | { | |
144 | if(bit == -1) { | |
145 | if(mode == EMIT_RWD) { | |
146 | frame_handle_tag(¤t_frame); | |
147 | } | |
148 | frame_clean(¤t_frame); | |
149 | } else if(bit == 0) { | |
150 | frame_append_bit(¤t_frame, 0); | |
151 | } else if(bit == 1) { | |
152 | frame_append_bit(¤t_frame, 1); | |
153 | } | |
154 | } | |
155 | ||
156 | void LegicRfSimulate(void) | |
157 | { | |
158 | /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode, | |
159 | * modulation mode set to 212kHz subcarrier. We are getting the incoming raw | |
160 | * envelope waveform on DIN and should send our response on DOUT. | |
161 | * | |
162 | * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll | |
163 | * measure the time between two rising edges on DIN, and no encoding on the | |
164 | * subcarrier from card to reader, so we'll just shift out our verbatim data | |
165 | * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear, | |
166 | * seems to be 300us-ish. | |
167 | */ | |
168 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
169 | FpgaSetupSsc(); | |
170 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K); | |
171 | ||
172 | /* Bitbang the receiver */ | |
173 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
174 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
175 | ||
176 | setup_timer(); | |
177 | ||
178 | int old_level = 0; | |
179 | int active = 0; | |
180 | ||
181 | while(!BUTTON_PRESS()) { | |
182 | int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
183 | int time = timer->TC_CV; | |
184 | ||
185 | if(level != old_level) { | |
186 | if(level == 1) { | |
187 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
188 | if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) { | |
189 | /* 1 bit */ | |
190 | emit(EMIT_RWD, 1); | |
191 | active = 1; | |
192 | LED_B_ON(); | |
193 | } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) { | |
194 | /* 0 bit */ | |
195 | emit(EMIT_RWD, 0); | |
196 | active = 1; | |
197 | LED_B_ON(); | |
198 | } else if(active) { | |
199 | /* invalid */ | |
200 | emit(EMIT_RWD, -1); | |
201 | active = 0; | |
202 | LED_B_OFF(); | |
203 | } | |
204 | } | |
205 | } | |
206 | ||
207 | if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) { | |
208 | /* Frame end */ | |
209 | emit(EMIT_RWD, -1); | |
210 | active = 0; | |
211 | LED_B_OFF(); | |
212 | } | |
213 | ||
214 | if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) { | |
215 | timer->TC_CCR = AT91C_TC_CLKDIS; | |
216 | } | |
217 | ||
218 | ||
219 | old_level = level; | |
220 | WDT_HIT(); | |
221 | } | |
222 | } |