]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // (c) 2009 Henryk Plötz <henryk@ploetzli.ch> | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // LEGIC RF simulation code | |
9 | //----------------------------------------------------------------------------- | |
10 | ||
11 | #include "proxmark3.h" | |
12 | #include "apps.h" | |
13 | #include "util.h" | |
14 | #include "string.h" | |
15 | ||
16 | #include "legicrf.h" | |
17 | #include "legic_prng.h" | |
18 | #include "crc.h" | |
19 | ||
20 | static struct legic_frame { | |
21 | int bits; | |
22 | uint32_t data; | |
23 | } current_frame; | |
24 | ||
25 | static enum { | |
26 | STATE_DISCON, | |
27 | STATE_IV, | |
28 | STATE_CON, | |
29 | } legic_state; | |
30 | ||
31 | static crc_t legic_crc; | |
32 | static int legic_read_count; | |
33 | static uint32_t legic_prng_bc; | |
34 | static uint32_t legic_prng_iv; | |
35 | ||
36 | static int legic_phase_drift; | |
37 | static int legic_frame_drift; | |
38 | static int legic_reqresp_drift; | |
39 | ||
40 | AT91PS_TC timer; | |
41 | AT91PS_TC prng_timer; | |
42 | ||
43 | static void setup_timer(void) | |
44 | { | |
45 | /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging | |
46 | * this it won't be terribly accurate but should be good enough. | |
47 | */ | |
48 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); | |
49 | timer = AT91C_BASE_TC1; | |
50 | timer->TC_CCR = AT91C_TC_CLKDIS; | |
51 | timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK; | |
52 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
53 | ||
54 | /* | |
55 | * Set up Timer 2 to use for measuring time between frames in | |
56 | * tag simulation mode. Runs 4x faster as Timer 1 | |
57 | */ | |
58 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC2); | |
59 | prng_timer = AT91C_BASE_TC2; | |
60 | prng_timer->TC_CCR = AT91C_TC_CLKDIS; | |
61 | prng_timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV2_CLOCK; | |
62 | prng_timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
63 | } | |
64 | ||
65 | /* At TIMER_CLOCK3 (MCK/32) */ | |
66 | #define RWD_TIME_1 150 /* RWD_TIME_PAUSE off, 80us on = 100us */ | |
67 | #define RWD_TIME_0 90 /* RWD_TIME_PAUSE off, 40us on = 60us */ | |
68 | #define RWD_TIME_PAUSE 30 /* 20us */ | |
69 | #define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */ | |
70 | #define TAG_TIME_BIT 150 /* 100us for every bit */ | |
71 | #define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */ | |
72 | ||
73 | #define SIM_DIVISOR 586 /* prng_time/SIM_DIVISOR count prng needs to be forwared */ | |
74 | #define SIM_SHIFT 900 /* prng_time+SIM_SHIFT shift of delayed start */ | |
75 | ||
76 | #define SESSION_IV 0x55 | |
77 | #define OFFSET_LOG 1024 | |
78 | ||
79 | #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz))) | |
80 | ||
81 | /* Generate Keystream */ | |
82 | static uint32_t get_key_stream(int skip, int count) | |
83 | { | |
84 | uint32_t key=0; int i; | |
85 | ||
86 | /* Use int to enlarge timer tc to 32bit */ | |
87 | legic_prng_bc += prng_timer->TC_CV; | |
88 | prng_timer->TC_CCR = AT91C_TC_SWTRG; | |
89 | ||
90 | /* If skip == -1, forward prng time based */ | |
91 | if(skip == -1) { | |
92 | i = (legic_prng_bc+SIM_SHIFT)/SIM_DIVISOR; /* Calculate Cycles based on timer */ | |
93 | i -= legic_prng_count(); /* substract cycles of finished frames */ | |
94 | i -= count; /* substract current frame length, rewidn to bedinning */ | |
95 | legic_prng_forward(i); | |
96 | } else { | |
97 | legic_prng_forward(skip); | |
98 | } | |
99 | ||
100 | /* Write Time Data into LOG */ | |
101 | if(count == 6) { i = -1; } else { i = legic_read_count; } | |
102 | ((uint8_t*)BigBuf)[OFFSET_LOG+128+i] = legic_prng_count(); | |
103 | ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4] = (legic_prng_bc >> 0) & 0xff; | |
104 | ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff; | |
105 | ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff; | |
106 | ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff; | |
107 | ((uint8_t*)BigBuf)[OFFSET_LOG+384+i] = count; | |
108 | ||
109 | /* Generate KeyStream */ | |
110 | for(i=0; i<count; i++) { | |
111 | key |= legic_prng_get_bit() << i; | |
112 | legic_prng_forward(1); | |
113 | } | |
114 | return key; | |
115 | } | |
116 | ||
117 | /* Send a frame in tag mode, the FPGA must have been set up by | |
118 | * LegicRfSimulate | |
119 | */ | |
120 | static void frame_send_tag(uint16_t response, int bits, int crypt) | |
121 | { | |
122 | /* Bitbang the response */ | |
123 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
124 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
125 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
126 | ||
127 | /* Use time to crypt frame */ | |
128 | if(crypt) { | |
129 | legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */ | |
130 | int i; int key = 0; | |
131 | for(i=0; i<bits; i++) { | |
132 | key |= legic_prng_get_bit() << i; | |
133 | legic_prng_forward(1); | |
134 | } | |
135 | //Dbprintf("key = 0x%x", key); | |
136 | response = response ^ key; | |
137 | } | |
138 | ||
139 | /* Wait for the frame start */ | |
140 | while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ; | |
141 | ||
142 | int i; | |
143 | for(i=0; i<bits; i++) { | |
144 | int nextbit = timer->TC_CV + TAG_TIME_BIT; | |
145 | int bit = response & 1; | |
146 | response = response >> 1; | |
147 | if(bit) { | |
148 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
149 | } else { | |
150 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
151 | } | |
152 | while(timer->TC_CV < nextbit) ; | |
153 | } | |
154 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
155 | } | |
156 | ||
157 | /* Send a frame in reader mode, the FPGA must have been set up by | |
158 | * LegicRfReader | |
159 | */ | |
160 | static void frame_send_rwd(uint32_t data, int bits) | |
161 | { | |
162 | /* Start clock */ | |
163 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
164 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
165 | ||
166 | int i; | |
167 | for(i=0; i<bits; i++) { | |
168 | int starttime = timer->TC_CV; | |
169 | int pause_end = starttime + RWD_TIME_PAUSE, bit_end; | |
170 | int bit = data & 1; | |
171 | data = data >> 1; | |
172 | ||
173 | if(bit ^ legic_prng_get_bit()) { | |
174 | bit_end = starttime + RWD_TIME_1; | |
175 | } else { | |
176 | bit_end = starttime + RWD_TIME_0; | |
177 | } | |
178 | ||
179 | /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is | |
180 | * RWD_TIME_x, where x is the bit to be transmitted */ | |
181 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
182 | while(timer->TC_CV < pause_end) ; | |
183 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
184 | legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */ | |
185 | ||
186 | while(timer->TC_CV < bit_end) ; | |
187 | } | |
188 | ||
189 | { | |
190 | /* One final pause to mark the end of the frame */ | |
191 | int pause_end = timer->TC_CV + RWD_TIME_PAUSE; | |
192 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
193 | while(timer->TC_CV < pause_end) ; | |
194 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
195 | } | |
196 | ||
197 | /* Reset the timer, to measure time until the start of the tag frame */ | |
198 | timer->TC_CCR = AT91C_TC_SWTRG; | |
199 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
200 | } | |
201 | ||
202 | /* Receive a frame from the card in reader emulation mode, the FPGA and | |
203 | * timer must have been set up by LegicRfReader and frame_send_rwd. | |
204 | * | |
205 | * The LEGIC RF protocol from card to reader does not include explicit | |
206 | * frame start/stop information or length information. The reader must | |
207 | * know beforehand how many bits it wants to receive. (Notably: a card | |
208 | * sending a stream of 0-bits is indistinguishable from no card present.) | |
209 | * | |
210 | * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but | |
211 | * I'm not smart enough to use it. Instead I have patched hi_read_tx to output | |
212 | * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look | |
213 | * for edges. Count the edges in each bit interval. If they are approximately | |
214 | * 0 this was a 0-bit, if they are approximately equal to the number of edges | |
215 | * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the | |
216 | * timer that's still running from frame_send_rwd in order to get a synchronization | |
217 | * with the frame that we just sent. | |
218 | * | |
219 | * FIXME: Because we're relying on the hysteresis to just do the right thing | |
220 | * the range is severely reduced (and you'll probably also need a good antenna). | |
221 | * So this should be fixed some time in the future for a proper receiver. | |
222 | */ | |
223 | static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt) | |
224 | { | |
225 | uint32_t the_bit = 1; /* Use a bitmask to save on shifts */ | |
226 | uint32_t data=0; | |
227 | int i, old_level=0, edges=0; | |
228 | int next_bit_at = TAG_TIME_WAIT; | |
229 | ||
230 | if(bits > 32) { | |
231 | bits = 32; | |
232 | } | |
233 | ||
234 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
235 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
236 | ||
237 | /* we have some time now, precompute the cipher | |
238 | * since we cannot compute it on the fly while reading */ | |
239 | legic_prng_forward(2); | |
240 | ||
241 | if(crypt) | |
242 | { | |
243 | for(i=0; i<bits; i++) { | |
244 | data |= legic_prng_get_bit() << i; | |
245 | legic_prng_forward(1); | |
246 | } | |
247 | } | |
248 | ||
249 | while(timer->TC_CV < next_bit_at) ; | |
250 | ||
251 | next_bit_at += TAG_TIME_BIT; | |
252 | ||
253 | for(i=0; i<bits; i++) { | |
254 | edges = 0; | |
255 | while(timer->TC_CV < next_bit_at) { | |
256 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
257 | if(level != old_level) | |
258 | edges++; | |
259 | old_level = level; | |
260 | } | |
261 | next_bit_at += TAG_TIME_BIT; | |
262 | ||
263 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ | |
264 | data ^= the_bit; | |
265 | } | |
266 | the_bit <<= 1; | |
267 | } | |
268 | ||
269 | f->data = data; | |
270 | f->bits = bits; | |
271 | ||
272 | /* Reset the timer, to synchronize the next frame */ | |
273 | timer->TC_CCR = AT91C_TC_SWTRG; | |
274 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
275 | } | |
276 | ||
277 | static void frame_append_bit(struct legic_frame * const f, int bit) | |
278 | { | |
279 | if(f->bits >= 31) { | |
280 | return; /* Overflow, won't happen */ | |
281 | } | |
282 | f->data |= (bit<<f->bits); | |
283 | f->bits++; | |
284 | } | |
285 | ||
286 | static void frame_clean(struct legic_frame * const f) | |
287 | { | |
288 | f->data = 0; | |
289 | f->bits = 0; | |
290 | } | |
291 | ||
292 | static uint32_t perform_setup_phase_rwd(int iv) | |
293 | { | |
294 | ||
295 | /* Switch on carrier and let the tag charge for 1ms */ | |
296 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
297 | SpinDelay(1); | |
298 | ||
299 | legic_prng_init(0); /* no keystream yet */ | |
300 | frame_send_rwd(iv, 7); | |
301 | legic_prng_init(iv); | |
302 | ||
303 | frame_clean(¤t_frame); | |
304 | frame_receive_rwd(¤t_frame, 6, 1); | |
305 | legic_prng_forward(1); /* we wait anyways */ | |
306 | while(timer->TC_CV < 387) ; /* ~ 258us */ | |
307 | frame_send_rwd(0x19, 6); | |
308 | ||
309 | return current_frame.data; | |
310 | } | |
311 | ||
312 | static void LegicCommonInit(void) { | |
313 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
314 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
315 | FpgaSetupSsc(); | |
316 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); | |
317 | ||
318 | /* Bitbang the transmitter */ | |
319 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
320 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
321 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
322 | ||
323 | setup_timer(); | |
324 | ||
325 | crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0); | |
326 | } | |
327 | ||
328 | static void switch_off_tag_rwd(void) | |
329 | { | |
330 | /* Switch off carrier, make sure tag is reset */ | |
331 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
332 | SpinDelay(10); | |
333 | ||
334 | WDT_HIT(); | |
335 | } | |
336 | /* calculate crc for a legic command */ | |
337 | static int LegicCRC(int byte_index, int value, int cmd_sz) { | |
338 | crc_clear(&legic_crc); | |
339 | crc_update(&legic_crc, 1, 1); /* CMD_READ */ | |
340 | crc_update(&legic_crc, byte_index, cmd_sz-1); | |
341 | crc_update(&legic_crc, value, 8); | |
342 | return crc_finish(&legic_crc); | |
343 | } | |
344 | ||
345 | int legic_read_byte(int byte_index, int cmd_sz) { | |
346 | int byte; | |
347 | ||
348 | legic_prng_forward(4); /* we wait anyways */ | |
349 | while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */ | |
350 | ||
351 | frame_send_rwd(1 | (byte_index << 1), cmd_sz); | |
352 | frame_clean(¤t_frame); | |
353 | ||
354 | frame_receive_rwd(¤t_frame, 12, 1); | |
355 | ||
356 | byte = current_frame.data & 0xff; | |
357 | if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) { | |
358 | Dbprintf("!!! crc mismatch: expected %x but got %x !!!", | |
359 | LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz), current_frame.data >> 8); | |
360 | return -1; | |
361 | } | |
362 | ||
363 | return byte; | |
364 | } | |
365 | ||
366 | /* legic_write_byte() is not included, however it's trivial to implement | |
367 | * and here are some hints on what remains to be done: | |
368 | * | |
369 | * * assemble a write_cmd_frame with crc and send it | |
370 | * * wait until the tag sends back an ACK ('1' bit unencrypted) | |
371 | * * forward the prng based on the timing | |
372 | */ | |
373 | int legic_write_byte(int byte, int addr, int addr_sz) { | |
374 | //do not write UID, CRC, DCF | |
375 | if(addr <= 0x06) { | |
376 | return 0; | |
377 | } | |
378 | ||
379 | //== send write command ============================== | |
380 | crc_clear(&legic_crc); | |
381 | crc_update(&legic_crc, 0, 1); /* CMD_WRITE */ | |
382 | crc_update(&legic_crc, addr, addr_sz); | |
383 | crc_update(&legic_crc, byte, 8); | |
384 | ||
385 | uint32_t crc = crc_finish(&legic_crc); | |
386 | uint32_t cmd = ((crc <<(addr_sz+1+8)) //CRC | |
387 | |(byte <<(addr_sz+1)) //Data | |
388 | |(addr <<1) //Address | |
389 | |(0x00 <<0)); //CMD = W | |
390 | uint32_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd | |
391 | ||
392 | legic_prng_forward(2); /* we wait anyways */ | |
393 | while(timer->TC_CV < 387) ; /* ~ 258us */ | |
394 | frame_send_rwd(cmd, cmd_sz); | |
395 | ||
396 | //== wait for ack ==================================== | |
397 | int t, old_level=0, edges=0; | |
398 | int next_bit_at =0; | |
399 | while(timer->TC_CV < 387) ; /* ~ 258us */ | |
400 | for(t=0; t<80; t++) { | |
401 | edges = 0; | |
402 | next_bit_at += TAG_TIME_BIT; | |
403 | while(timer->TC_CV < next_bit_at) { | |
404 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
405 | if(level != old_level) { | |
406 | edges++; | |
407 | } | |
408 | old_level = level; | |
409 | } | |
410 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ | |
411 | int t = timer->TC_CV; | |
412 | int c = t/TAG_TIME_BIT; | |
413 | timer->TC_CCR = AT91C_TC_SWTRG; | |
414 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
415 | legic_prng_forward(c); | |
416 | return 0; | |
417 | } | |
418 | } | |
419 | timer->TC_CCR = AT91C_TC_SWTRG; | |
420 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ | |
421 | return -1; | |
422 | } | |
423 | ||
424 | int LegicRfReader(int offset, int bytes) { | |
425 | int byte_index=0, cmd_sz=0, card_sz=0; | |
426 | ||
427 | LegicCommonInit(); | |
428 | ||
429 | memset(BigBuf, 0, 1024); | |
430 | ||
431 | DbpString("setting up legic card"); | |
432 | uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV); | |
433 | switch_off_tag_rwd(); //we lose to mutch time with dprintf | |
434 | switch(tag_type) { | |
435 | case 0x1d: | |
436 | DbpString("MIM 256 card found, reading card ..."); | |
437 | cmd_sz = 9; | |
438 | card_sz = 256; | |
439 | break; | |
440 | case 0x3d: | |
441 | DbpString("MIM 1024 card found, reading card ..."); | |
442 | cmd_sz = 11; | |
443 | card_sz = 1024; | |
444 | break; | |
445 | default: | |
446 | Dbprintf("Unknown card format: %x",tag_type); | |
447 | return -1; | |
448 | } | |
449 | if(bytes == -1) { | |
450 | bytes = card_sz; | |
451 | } | |
452 | if(bytes+offset >= card_sz) { | |
453 | bytes = card_sz-offset; | |
454 | } | |
455 | ||
456 | perform_setup_phase_rwd(SESSION_IV); | |
457 | ||
458 | LED_B_ON(); | |
459 | while(byte_index < bytes) { | |
460 | int r = legic_read_byte(byte_index+offset, cmd_sz); | |
461 | if(r == -1 ||BUTTON_PRESS()) { | |
462 | DbpString("operation aborted"); | |
463 | switch_off_tag_rwd(); | |
464 | LED_B_OFF(); | |
465 | LED_C_OFF(); | |
466 | return -1; | |
467 | } | |
468 | ((uint8_t*)BigBuf)[byte_index] = r; | |
469 | WDT_HIT(); | |
470 | byte_index++; | |
471 | if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF(); | |
472 | } | |
473 | LED_B_OFF(); | |
474 | LED_C_OFF(); | |
475 | switch_off_tag_rwd(); | |
476 | Dbprintf("Card read, use 'hf legic decode' or"); | |
477 | Dbprintf("'data hexsamples %d' to view results", (bytes+7) & ~7); | |
478 | return 0; | |
479 | } | |
480 | ||
481 | void LegicRfWriter(int bytes, int offset) { | |
482 | int byte_index=0, addr_sz=0; | |
483 | ||
484 | LegicCommonInit(); | |
485 | ||
486 | DbpString("setting up legic card"); | |
487 | uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV); | |
488 | switch_off_tag_rwd(); | |
489 | switch(tag_type) { | |
490 | case 0x1d: | |
491 | if(offset+bytes > 0x100) { | |
492 | Dbprintf("Error: can not write to 0x%03.3x on MIM 256", offset+bytes); | |
493 | return; | |
494 | } | |
495 | addr_sz = 8; | |
496 | Dbprintf("MIM 256 card found, writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes); | |
497 | break; | |
498 | case 0x3d: | |
499 | if(offset+bytes > 0x400) { | |
500 | Dbprintf("Error: can not write to 0x%03.3x on MIM 1024", offset+bytes); | |
501 | return; | |
502 | } | |
503 | addr_sz = 10; | |
504 | Dbprintf("MIM 1024 card found, writing 0x%03.3x - 0x%03.3x ...", offset, offset+bytes); | |
505 | break; | |
506 | default: | |
507 | Dbprintf("No or unknown card found, aborting"); | |
508 | return; | |
509 | } | |
510 | ||
511 | LED_B_ON(); | |
512 | perform_setup_phase_rwd(SESSION_IV); | |
513 | legic_prng_forward(2); | |
514 | while(byte_index < bytes) { | |
515 | int r = legic_write_byte(((uint8_t*)BigBuf)[byte_index+offset], byte_index+offset, addr_sz); | |
516 | if((r != 0) || BUTTON_PRESS()) { | |
517 | Dbprintf("operation aborted @ 0x%03.3x", byte_index); | |
518 | switch_off_tag_rwd(); | |
519 | LED_B_OFF(); | |
520 | LED_C_OFF(); | |
521 | return; | |
522 | } | |
523 | WDT_HIT(); | |
524 | byte_index++; | |
525 | if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF(); | |
526 | } | |
527 | LED_B_OFF(); | |
528 | LED_C_OFF(); | |
529 | DbpString("write successful"); | |
530 | } | |
531 | ||
532 | int timestamp; | |
533 | ||
534 | /* Handle (whether to respond) a frame in tag mode */ | |
535 | static void frame_handle_tag(struct legic_frame const * const f) | |
536 | { | |
537 | /* First Part of Handshake (IV) */ | |
538 | if(f->bits == 7) { | |
539 | if(f->data == SESSION_IV) { | |
540 | LED_C_ON(); | |
541 | prng_timer->TC_CCR = AT91C_TC_SWTRG; | |
542 | legic_prng_init(f->data); | |
543 | frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1b */ | |
544 | legic_state = STATE_IV; | |
545 | legic_read_count = 0; | |
546 | legic_prng_bc = 0; | |
547 | legic_prng_iv = f->data; | |
548 | ||
549 | /* TIMEOUT */ | |
550 | timer->TC_CCR = AT91C_TC_SWTRG; | |
551 | while(timer->TC_CV > 1); | |
552 | while(timer->TC_CV < 280); | |
553 | return; | |
554 | } else if((prng_timer->TC_CV % 50) > 40) { | |
555 | legic_prng_init(f->data); | |
556 | frame_send_tag(0x3d, 6, 1); | |
557 | SpinDelay(20); | |
558 | return; | |
559 | } | |
560 | } | |
561 | ||
562 | /* 0x19==??? */ | |
563 | if(legic_state == STATE_IV) { | |
564 | if((f->bits == 6) && (f->data == (0x19 ^ get_key_stream(1, 6)))) { | |
565 | legic_state = STATE_CON; | |
566 | ||
567 | /* TIMEOUT */ | |
568 | timer->TC_CCR = AT91C_TC_SWTRG; | |
569 | while(timer->TC_CV > 1); | |
570 | while(timer->TC_CV < 200); | |
571 | return; | |
572 | } else { | |
573 | legic_state = STATE_DISCON; | |
574 | LED_C_OFF(); | |
575 | Dbprintf("0x19 - Frame: %03.3x", f->data); | |
576 | return; | |
577 | } | |
578 | } | |
579 | ||
580 | /* Read */ | |
581 | if(f->bits == 11) { | |
582 | if(legic_state == STATE_CON) { | |
583 | int key = get_key_stream(-1, 11); //legic_phase_drift, 11); | |
584 | int addr = f->data ^ key; addr = addr >> 1; | |
585 | int data = ((uint8_t*)BigBuf)[addr]; | |
586 | int hash = LegicCRC(addr, data, 11) << 8; | |
587 | ((uint8_t*)BigBuf)[OFFSET_LOG+legic_read_count] = (uint8_t)addr; | |
588 | legic_read_count++; | |
589 | ||
590 | //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c); | |
591 | legic_prng_forward(legic_reqresp_drift); | |
592 | ||
593 | frame_send_tag(hash | data, 12, 1); | |
594 | ||
595 | /* SHORT TIMEOUT */ | |
596 | timer->TC_CCR = AT91C_TC_SWTRG; | |
597 | while(timer->TC_CV > 1); | |
598 | legic_prng_forward(legic_frame_drift); | |
599 | while(timer->TC_CV < 180); | |
600 | return; | |
601 | } | |
602 | } | |
603 | ||
604 | /* Write */ | |
605 | if(f->bits == 23) { | |
606 | int key = get_key_stream(-1, 23); //legic_frame_drift, 23); | |
607 | int addr = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff; | |
608 | int data = f->data ^ key; data = data >> 11; data = data & 0xff; | |
609 | ||
610 | /* write command */ | |
611 | legic_state = STATE_DISCON; | |
612 | LED_C_OFF(); | |
613 | Dbprintf("write - addr: %x, data: %x", addr, data); | |
614 | return; | |
615 | } | |
616 | ||
617 | if(legic_state != STATE_DISCON) { | |
618 | Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count); | |
619 | int i; | |
620 | Dbprintf("IV: %03.3x", legic_prng_iv); | |
621 | for(i = 0; i<legic_read_count; i++) { | |
622 | Dbprintf("Read Nb: %u, Addr: %u", i, ((uint8_t*)BigBuf)[OFFSET_LOG+i]); | |
623 | } | |
624 | ||
625 | for(i = -1; i<legic_read_count; i++) { | |
626 | uint32_t t; | |
627 | t = ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4]; | |
628 | t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+1] << 8; | |
629 | t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+2] <<16; | |
630 | t |= ((uint8_t*)BigBuf)[OFFSET_LOG+256+i*4+3] <<24; | |
631 | ||
632 | Dbprintf("Cycles: %u, Frame Length: %u, Time: %u", | |
633 | ((uint8_t*)BigBuf)[OFFSET_LOG+128+i], | |
634 | ((uint8_t*)BigBuf)[OFFSET_LOG+384+i], | |
635 | t); | |
636 | } | |
637 | } | |
638 | legic_state = STATE_DISCON; | |
639 | legic_read_count = 0; | |
640 | SpinDelay(10); | |
641 | LED_C_OFF(); | |
642 | return; | |
643 | } | |
644 | ||
645 | /* Read bit by bit untill full frame is received | |
646 | * Call to process frame end answer | |
647 | */ | |
648 | static void emit(int bit) | |
649 | { | |
650 | if(bit == -1) { | |
651 | if(current_frame.bits <= 4) { | |
652 | frame_clean(¤t_frame); | |
653 | } else { | |
654 | frame_handle_tag(¤t_frame); | |
655 | frame_clean(¤t_frame); | |
656 | } | |
657 | WDT_HIT(); | |
658 | } else if(bit == 0) { | |
659 | frame_append_bit(¤t_frame, 0); | |
660 | } else if(bit == 1) { | |
661 | frame_append_bit(¤t_frame, 1); | |
662 | } | |
663 | } | |
664 | ||
665 | void LegicRfSimulate(int phase, int frame, int reqresp) | |
666 | { | |
667 | /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode, | |
668 | * modulation mode set to 212kHz subcarrier. We are getting the incoming raw | |
669 | * envelope waveform on DIN and should send our response on DOUT. | |
670 | * | |
671 | * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll | |
672 | * measure the time between two rising edges on DIN, and no encoding on the | |
673 | * subcarrier from card to reader, so we'll just shift out our verbatim data | |
674 | * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear, | |
675 | * seems to be 300us-ish. | |
676 | */ | |
677 | ||
678 | if(phase < 0) { | |
679 | int i; | |
680 | for(i=0; i<=reqresp; i++) { | |
681 | legic_prng_init(SESSION_IV); | |
682 | Dbprintf("i=%u, key 0x%3.3x", i, get_key_stream(i, frame)); | |
683 | } | |
684 | return; | |
685 | } | |
686 | ||
687 | legic_phase_drift = phase; | |
688 | legic_frame_drift = frame; | |
689 | legic_reqresp_drift = reqresp; | |
690 | ||
691 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); | |
692 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
693 | FpgaSetupSsc(); | |
694 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K); | |
695 | ||
696 | /* Bitbang the receiver */ | |
697 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
698 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
699 | ||
700 | setup_timer(); | |
701 | crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0); | |
702 | ||
703 | int old_level = 0; | |
704 | int active = 0; | |
705 | legic_state = STATE_DISCON; | |
706 | ||
707 | LED_B_ON(); | |
708 | DbpString("Starting Legic emulator, press button to end"); | |
709 | while(!BUTTON_PRESS()) { | |
710 | int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
711 | int time = timer->TC_CV; | |
712 | ||
713 | if(level != old_level) { | |
714 | if(level == 1) { | |
715 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
716 | if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) { | |
717 | /* 1 bit */ | |
718 | emit(1); | |
719 | active = 1; | |
720 | LED_A_ON(); | |
721 | } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) { | |
722 | /* 0 bit */ | |
723 | emit(0); | |
724 | active = 1; | |
725 | LED_A_ON(); | |
726 | } else if(active) { | |
727 | /* invalid */ | |
728 | emit(-1); | |
729 | active = 0; | |
730 | LED_A_OFF(); | |
731 | } | |
732 | } | |
733 | } | |
734 | ||
735 | if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) { | |
736 | /* Frame end */ | |
737 | emit(-1); | |
738 | active = 0; | |
739 | LED_A_OFF(); | |
740 | } | |
741 | ||
742 | if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) { | |
743 | timer->TC_CCR = AT91C_TC_CLKDIS; | |
744 | } | |
745 | ||
746 | old_level = level; | |
747 | WDT_HIT(); | |
748 | } | |
749 | DbpString("Stopped"); | |
750 | LED_B_OFF(); | |
751 | LED_A_OFF(); | |
752 | LED_C_OFF(); | |
753 | } | |
754 |