]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * LEGIC RF simulation code | |
3 | * | |
4 | * (c) 2009 Henryk Plötz <henryk@ploetzli.ch> | |
5 | */ | |
6 | ||
7 | #include <proxmark3.h> | |
8 | ||
9 | #include "apps.h" | |
10 | #include "legicrf.h" | |
11 | ||
12 | static struct legic_frame { | |
13 | int num_bytes; | |
14 | int num_bits; | |
15 | char data[10]; | |
16 | } current_frame; | |
17 | static char response = 0x2b; /* 1101 01 */ | |
18 | ||
19 | static void frame_send(char *response, int num_bytes, int num_bits) | |
20 | { | |
21 | #if 0 | |
22 | /* Use the SSC to send a response. 8-bit transfers, LSBit first, 100us per bit */ | |
23 | #else | |
24 | /* Bitbang the response */ | |
25 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
26 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
27 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
28 | ||
29 | /* Wait for the frame start */ | |
30 | while(AT91C_BASE_TC1->TC_CV < 490) ; | |
31 | ||
32 | int i; | |
33 | for(i=0; i<(num_bytes*8+num_bits); i++) { | |
34 | int nextbit = AT91C_BASE_TC1->TC_CV + 150; | |
35 | int bit = response[i/8] & (1<<(i%8)); | |
36 | if(bit) | |
37 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; | |
38 | else | |
39 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
40 | while(AT91C_BASE_TC1->TC_CV < nextbit) ; | |
41 | } | |
42 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; | |
43 | #endif | |
44 | } | |
45 | ||
46 | static void frame_respond(struct legic_frame *f) | |
47 | { | |
48 | LED_D_ON(); | |
49 | if(f->num_bytes == 0 && f->num_bits == 7) { | |
50 | /* This seems to be the initial dialogue, just send 6 bits of static data */ | |
51 | frame_send(&response, 0, 6); | |
52 | } | |
53 | LED_D_OFF(); | |
54 | } | |
55 | ||
56 | static void frame_append_bit(struct legic_frame *f, int bit) | |
57 | { | |
58 | if(f->num_bytes >= (int)sizeof(f->data)) | |
59 | return; /* Overflow, won't happen */ | |
60 | f->data[f->num_bytes] |= (bit<<f->num_bits); | |
61 | f->num_bits++; | |
62 | if(f->num_bits > 7) { | |
63 | f->num_bits = 0; | |
64 | f->num_bytes++; | |
65 | } | |
66 | } | |
67 | ||
68 | static int frame_is_empty(struct legic_frame *f) | |
69 | { | |
70 | return( (f->num_bytes + f->num_bits) <= 4 ); | |
71 | } | |
72 | ||
73 | static void frame_handle(struct legic_frame *f) | |
74 | { | |
75 | if( !frame_is_empty(f) ) { | |
76 | frame_respond(f); | |
77 | } | |
78 | } | |
79 | ||
80 | static void frame_clean(struct legic_frame *f) | |
81 | { | |
82 | if(!frame_is_empty(f)) | |
83 | memset(f->data, 0, sizeof(f->data)); | |
84 | f->num_bits = 0; | |
85 | f->num_bytes = 0; | |
86 | } | |
87 | ||
88 | static void emit(int bit) | |
89 | { | |
90 | if(bit == -1) { | |
91 | frame_handle(¤t_frame); | |
92 | frame_clean(¤t_frame); | |
93 | } else if(bit == 0) { | |
94 | frame_append_bit(¤t_frame, 0); | |
95 | } else if(bit == 1) { | |
96 | frame_append_bit(¤t_frame, 1); | |
97 | } | |
98 | } | |
99 | ||
100 | void LegicRfSimulate(void) | |
101 | { | |
102 | /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode, | |
103 | * modulation mode set to 212kHz subcarrier. We are getting the incoming raw | |
104 | * envelope waveform on DIN and should send our response on DOUT. | |
105 | * | |
106 | * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll | |
107 | * measure the time between two rising edges on DIN, and no encoding on the | |
108 | * subcarrier from card to reader, so we'll just shift out our verbatim data | |
109 | * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear, | |
110 | * seems to be 300us-ish. | |
111 | */ | |
112 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
113 | FpgaSetupSsc(); | |
114 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K); | |
115 | ||
116 | /* Bitbang the receiver */ | |
117 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; | |
118 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; | |
119 | ||
120 | /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging | |
121 | * this it won't be terribly accurate but should be good enough. | |
122 | */ | |
123 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); | |
124 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; | |
125 | AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3; | |
126 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
127 | int old_level = 0; | |
128 | ||
129 | /* At TIMER_CLOCK3 (MCK/32) */ | |
130 | #define BIT_TIME_1 150 | |
131 | #define BIT_TIME_0 90 | |
132 | #define BIT_TIME_FUZZ 20 | |
133 | ||
134 | int active = 0; | |
135 | while(!BUTTON_PRESS()) { | |
136 | int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); | |
137 | int time = AT91C_BASE_TC1->TC_CV; | |
138 | ||
139 | if(level != old_level) { | |
140 | if(level == 1) { | |
141 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; | |
142 | if(time > (BIT_TIME_1-BIT_TIME_FUZZ) && time < (BIT_TIME_1+BIT_TIME_FUZZ)) { | |
143 | /* 1 bit */ | |
144 | emit(1); | |
145 | active = 1; | |
146 | } else if(time > (BIT_TIME_0-BIT_TIME_FUZZ) && time < (BIT_TIME_0+BIT_TIME_FUZZ)) { | |
147 | /* 0 bit */ | |
148 | emit(0); | |
149 | active = 0; | |
150 | } else { | |
151 | /* invalid */ | |
152 | emit(-1); | |
153 | active = 0; | |
154 | } | |
155 | } | |
156 | } | |
157 | ||
158 | if(time >= (BIT_TIME_1+2*BIT_TIME_FUZZ) && active) { | |
159 | /* Frame end */ | |
160 | emit(-1); | |
161 | active = 0; | |
162 | } | |
163 | ||
164 | if(time >= (20*BIT_TIME_1) && (AT91C_BASE_TC1->TC_SR & AT91C_TC_CLKSTA)) { | |
165 | AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; | |
166 | } | |
167 | ||
168 | ||
169 | old_level = level; | |
170 | WDT_HIT(); | |
171 | } | |
172 | } |