]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/lfops.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: marshmellows new lf command and DetectClock. (works great!)
[proxmark3-svn] / armsrc / lfops.c
1 //-----------------------------------------------------------------------------
2 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
3 // at your option, any later version. See the LICENSE.txt file for the text of
4 // the license.
5 //-----------------------------------------------------------------------------
6 // Miscellaneous routines for low frequency tag operations.
7 // Tags supported here so far are Texas Instruments (TI), HID
8 // Also routines for raw mode reading/simulating of LF waveform
9 //-----------------------------------------------------------------------------
10
11 #include "../include/proxmark3.h"
12 #include "apps.h"
13 #include "util.h"
14 #include "../include/hitag2.h"
15 #include "../common/crc16.h"
16 #include "string.h"
17 #include "crapto1.h"
18 #include "mifareutil.h"
19
20 // Sam7s has several timers, we will use the source TIMER_CLOCK1 (aka AT91C_TC_CLKS_TIMER_DIV1_CLOCK)
21 // TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz
22 // Hitag units (T0) have duration of 8 microseconds (us), which is 1/125000 per second (carrier)
23 // T0 = TIMER_CLOCK1 / 125000 = 192
24 #define T0 192
25
26 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
27 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
28
29 void LFSetupFPGAForADC(int divisor, bool lf_field)
30 {
31 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
32 if ( (divisor == 1) || (divisor < 0) || (divisor > 255) )
33 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
34 else if (divisor == 0)
35 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
36 else
37 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor);
38
39 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | (lf_field ? FPGA_LF_ADC_READER_FIELD : 0));
40
41 // Connect the A/D to the peak-detected low-frequency path.
42 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
43
44 // Give it a bit of time for the resonant antenna to settle.
45 SpinDelay(150);
46
47 // Now set up the SSC to get the ADC samples that are now streaming at us.
48 FpgaSetupSsc();
49 }
50
51 void AcquireRawAdcSamples125k(int divisor)
52 {
53 LFSetupFPGAForADC(divisor, true);
54 DoAcquisition125k();
55 }
56
57 void SnoopLFRawAdcSamples(int divisor, int trigger_threshold)
58 {
59 LFSetupFPGAForADC(divisor, false);
60 DoAcquisition125k_threshold(trigger_threshold);
61 }
62
63 // split into two routines so we can avoid timing issues after sending commands //
64 void DoAcquisition125k_internal(int trigger_threshold, bool silent)
65 {
66 uint8_t *dest = get_bigbufptr_recvrespbuf();
67 uint16_t i = 0;
68 memset(dest, 0x00, FREE_BUFFER_SIZE);
69
70 for(;;) {
71 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
72 AT91C_BASE_SSC->SSC_THR = 0x43;
73 LED_D_ON();
74 }
75 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
76 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
77 LED_D_OFF();
78 if (trigger_threshold != -1 && dest[i] < trigger_threshold)
79 continue;
80 else
81 trigger_threshold = -1;
82 if (++i >= FREE_BUFFER_SIZE) break;
83 }
84 }
85 if (!silent){
86 Dbprintf("buffer samples: %02x %02x %02x %02x %02x %02x %02x %02x ...",
87 dest[0], dest[1], dest[2], dest[3], dest[4], dest[5], dest[6], dest[7]);
88 }
89 }
90 void DoAcquisition125k_threshold(int trigger_threshold) {
91 DoAcquisition125k_internal(trigger_threshold, true);
92 }
93 void DoAcquisition125k() {
94 DoAcquisition125k_internal(-1, true);
95 }
96
97 void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, uint8_t *command)
98 {
99 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
100
101 /* Make sure the tag is reset */
102 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
103 SpinDelay(2500);
104
105 int divisor = 95; // 125 KHz
106 // see if 'h' was specified
107 if (command[strlen((char *) command) - 1] == 'h')
108 divisor = 88; // 134.8 KHz
109
110 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor);
111 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
112 // Give it a bit of time for the resonant antenna to settle.
113 SpinDelay(2000);
114
115 // Now set up the SSC to get the ADC samples that are now streaming at us.
116 FpgaSetupSsc();
117
118 // now modulate the reader field
119 while(*command != '\0' && *command != ' ') {
120 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
121 LED_D_OFF();
122 SpinDelayUs(delay_off);
123 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor);
124
125 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
126 LED_D_ON();
127 if(*(command++) == '0')
128 SpinDelayUs(period_0);
129 else
130 SpinDelayUs(period_1);
131 }
132 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
133 LED_D_OFF();
134 SpinDelayUs(delay_off);
135 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor);
136 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
137
138 // now do the read
139 DoAcquisition125k(-1);
140 }
141
142 /* blank r/w tag data stream
143 ...0000000000000000 01111111
144 1010101010101010101010101010101010101010101010101010101010101010
145 0011010010100001
146 01111111
147 101010101010101[0]000...
148
149 [5555fe852c5555555555555555fe0000]
150 */
151 void ReadTItag(void)
152 {
153 // some hardcoded initial params
154 // when we read a TI tag we sample the zerocross line at 2Mhz
155 // TI tags modulate a 1 as 16 cycles of 123.2Khz
156 // TI tags modulate a 0 as 16 cycles of 134.2Khz
157 #define FSAMPLE 2000000
158 #define FREQLO 123200
159 #define FREQHI 134200
160
161 signed char *dest = (signed char *)BigBuf;
162 int n = sizeof(BigBuf);
163 // int *dest = GraphBuffer;
164 // int n = GraphTraceLen;
165
166 // 128 bit shift register [shift3:shift2:shift1:shift0]
167 uint32_t shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0;
168
169 int i, cycles=0, samples=0;
170 // how many sample points fit in 16 cycles of each frequency
171 uint32_t sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI;
172 // when to tell if we're close enough to one freq or another
173 uint32_t threshold = (sampleslo - sampleshi + 1)>>1;
174
175 // TI tags charge at 134.2Khz
176 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
177 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
178
179 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
180 // connects to SSP_DIN and the SSP_DOUT logic level controls
181 // whether we're modulating the antenna (high)
182 // or listening to the antenna (low)
183 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
184
185 // get TI tag data into the buffer
186 AcquireTiType();
187
188 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
189
190 for (i=0; i<n-1; i++) {
191 // count cycles by looking for lo to hi zero crossings
192 if ( (dest[i]<0) && (dest[i+1]>0) ) {
193 cycles++;
194 // after 16 cycles, measure the frequency
195 if (cycles>15) {
196 cycles=0;
197 samples=i-samples; // number of samples in these 16 cycles
198
199 // TI bits are coming to us lsb first so shift them
200 // right through our 128 bit right shift register
201 shift0 = (shift0>>1) | (shift1 << 31);
202 shift1 = (shift1>>1) | (shift2 << 31);
203 shift2 = (shift2>>1) | (shift3 << 31);
204 shift3 >>= 1;
205
206 // check if the cycles fall close to the number
207 // expected for either the low or high frequency
208 if ( (samples>(sampleslo-threshold)) && (samples<(sampleslo+threshold)) ) {
209 // low frequency represents a 1
210 shift3 |= (1<<31);
211 } else if ( (samples>(sampleshi-threshold)) && (samples<(sampleshi+threshold)) ) {
212 // high frequency represents a 0
213 } else {
214 // probably detected a gay waveform or noise
215 // use this as gaydar or discard shift register and start again
216 shift3 = shift2 = shift1 = shift0 = 0;
217 }
218 samples = i;
219
220 // for each bit we receive, test if we've detected a valid tag
221
222 // if we see 17 zeroes followed by 6 ones, we might have a tag
223 // remember the bits are backwards
224 if ( ((shift0 & 0x7fffff) == 0x7e0000) ) {
225 // if start and end bytes match, we have a tag so break out of the loop
226 if ( ((shift0>>16)&0xff) == ((shift3>>8)&0xff) ) {
227 cycles = 0xF0B; //use this as a flag (ugly but whatever)
228 break;
229 }
230 }
231 }
232 }
233 }
234
235 // if flag is set we have a tag
236 if (cycles!=0xF0B) {
237 DbpString("Info: No valid tag detected.");
238 } else {
239 // put 64 bit data into shift1 and shift0
240 shift0 = (shift0>>24) | (shift1 << 8);
241 shift1 = (shift1>>24) | (shift2 << 8);
242
243 // align 16 bit crc into lower half of shift2
244 shift2 = ((shift2>>24) | (shift3 << 8)) & 0x0ffff;
245
246 // if r/w tag, check ident match
247 if ( shift3&(1<<15) ) {
248 DbpString("Info: TI tag is rewriteable");
249 // only 15 bits compare, last bit of ident is not valid
250 if ( ((shift3>>16)^shift0)&0x7fff ) {
251 DbpString("Error: Ident mismatch!");
252 } else {
253 DbpString("Info: TI tag ident is valid");
254 }
255 } else {
256 DbpString("Info: TI tag is readonly");
257 }
258
259 // WARNING the order of the bytes in which we calc crc below needs checking
260 // i'm 99% sure the crc algorithm is correct, but it may need to eat the
261 // bytes in reverse or something
262 // calculate CRC
263 uint32_t crc=0;
264
265 crc = update_crc16(crc, (shift0)&0xff);
266 crc = update_crc16(crc, (shift0>>8)&0xff);
267 crc = update_crc16(crc, (shift0>>16)&0xff);
268 crc = update_crc16(crc, (shift0>>24)&0xff);
269 crc = update_crc16(crc, (shift1)&0xff);
270 crc = update_crc16(crc, (shift1>>8)&0xff);
271 crc = update_crc16(crc, (shift1>>16)&0xff);
272 crc = update_crc16(crc, (shift1>>24)&0xff);
273
274 Dbprintf("Info: Tag data: %x%08x, crc=%x",
275 (unsigned int)shift1, (unsigned int)shift0, (unsigned int)shift2 & 0xFFFF);
276 if (crc != (shift2&0xffff)) {
277 Dbprintf("Error: CRC mismatch, expected %x", (unsigned int)crc);
278 } else {
279 DbpString("Info: CRC is good");
280 }
281 }
282 }
283
284 void WriteTIbyte(uint8_t b)
285 {
286 int i = 0;
287
288 // modulate 8 bits out to the antenna
289 for (i=0; i<8; i++)
290 {
291 if (b&(1<<i)) {
292 // stop modulating antenna
293 SHORT_COIL();
294 SpinDelayUs(1000);
295 // modulate antenna
296 OPEN_COIL();
297 SpinDelayUs(1000);
298 } else {
299 // stop modulating antenna
300 SHORT_COIL();
301 SpinDelayUs(300);
302 // modulate antenna
303 OPEN_COIL();
304 SpinDelayUs(1700);
305 }
306 }
307 }
308
309 void AcquireTiType(void)
310 {
311 int i, j, n;
312 // tag transmission is <20ms, sampling at 2M gives us 40K samples max
313 // each sample is 1 bit stuffed into a uint32_t so we need 1250 uint32_t
314 #define TIBUFLEN 1250
315
316 // clear buffer
317 memset(BigBuf,0,sizeof(BigBuf));
318
319 // Set up the synchronous serial port
320 AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DIN;
321 AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN;
322
323 // steal this pin from the SSP and use it to control the modulation
324 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
325 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
326
327 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
328 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_RXEN | AT91C_SSC_TXEN;
329
330 // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long
331 // 48/2 = 24 MHz clock must be divided by 12
332 AT91C_BASE_SSC->SSC_CMR = 12;
333
334 AT91C_BASE_SSC->SSC_RCMR = SSC_CLOCK_MODE_SELECT(0);
335 AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(32) | AT91C_SSC_MSBF;
336 AT91C_BASE_SSC->SSC_TCMR = 0;
337 AT91C_BASE_SSC->SSC_TFMR = 0;
338
339 LED_D_ON();
340
341 // modulate antenna
342 HIGH(GPIO_SSC_DOUT);
343
344 // Charge TI tag for 50ms.
345 SpinDelay(50);
346
347 // stop modulating antenna and listen
348 LOW(GPIO_SSC_DOUT);
349
350 LED_D_OFF();
351
352 i = 0;
353 for(;;) {
354 if(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
355 BigBuf[i] = AT91C_BASE_SSC->SSC_RHR; // store 32 bit values in buffer
356 i++; if(i >= TIBUFLEN) break;
357 }
358 WDT_HIT();
359 }
360
361 // return stolen pin to SSP
362 AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DOUT;
363 AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN | GPIO_SSC_DOUT;
364
365 char *dest = (char *)BigBuf;
366 n = TIBUFLEN*32;
367 // unpack buffer
368 for (i=TIBUFLEN-1; i>=0; i--) {
369 for (j=0; j<32; j++) {
370 if(BigBuf[i] & (1 << j)) {
371 dest[--n] = 1;
372 } else {
373 dest[--n] = -1;
374 }
375 }
376 }
377 }
378
379 // arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc
380 // if crc provided, it will be written with the data verbatim (even if bogus)
381 // if not provided a valid crc will be computed from the data and written.
382 void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
383 {
384 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
385 if(crc == 0) {
386 crc = update_crc16(crc, (idlo)&0xff);
387 crc = update_crc16(crc, (idlo>>8)&0xff);
388 crc = update_crc16(crc, (idlo>>16)&0xff);
389 crc = update_crc16(crc, (idlo>>24)&0xff);
390 crc = update_crc16(crc, (idhi)&0xff);
391 crc = update_crc16(crc, (idhi>>8)&0xff);
392 crc = update_crc16(crc, (idhi>>16)&0xff);
393 crc = update_crc16(crc, (idhi>>24)&0xff);
394 }
395 Dbprintf("Writing to tag: %x%08x, crc=%x",
396 (unsigned int) idhi, (unsigned int) idlo, crc);
397
398 // TI tags charge at 134.2Khz
399 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
400 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
401 // connects to SSP_DIN and the SSP_DOUT logic level controls
402 // whether we're modulating the antenna (high)
403 // or listening to the antenna (low)
404 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
405 LED_A_ON();
406
407 // steal this pin from the SSP and use it to control the modulation
408 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
409 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
410
411 // writing algorithm:
412 // a high bit consists of a field off for 1ms and field on for 1ms
413 // a low bit consists of a field off for 0.3ms and field on for 1.7ms
414 // initiate a charge time of 50ms (field on) then immediately start writing bits
415 // start by writing 0xBB (keyword) and 0xEB (password)
416 // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer)
417 // finally end with 0x0300 (write frame)
418 // all data is sent lsb firts
419 // finish with 15ms programming time
420
421 // modulate antenna
422 HIGH(GPIO_SSC_DOUT);
423 SpinDelay(50); // charge time
424
425 WriteTIbyte(0xbb); // keyword
426 WriteTIbyte(0xeb); // password
427 WriteTIbyte( (idlo )&0xff );
428 WriteTIbyte( (idlo>>8 )&0xff );
429 WriteTIbyte( (idlo>>16)&0xff );
430 WriteTIbyte( (idlo>>24)&0xff );
431 WriteTIbyte( (idhi )&0xff );
432 WriteTIbyte( (idhi>>8 )&0xff );
433 WriteTIbyte( (idhi>>16)&0xff );
434 WriteTIbyte( (idhi>>24)&0xff ); // data hi to lo
435 WriteTIbyte( (crc )&0xff ); // crc lo
436 WriteTIbyte( (crc>>8 )&0xff ); // crc hi
437 WriteTIbyte(0x00); // write frame lo
438 WriteTIbyte(0x03); // write frame hi
439 HIGH(GPIO_SSC_DOUT);
440 SpinDelay(50); // programming time
441
442 LED_A_OFF();
443
444 // get TI tag data into the buffer
445 AcquireTiType();
446
447 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
448 DbpString("Now use tiread to check");
449 }
450
451
452
453 // PIO_CODR = Clear Output Data Register
454 // PIO_SODR = Set Output Data Register
455 //#define LOW(x) AT91C_BASE_PIOA->PIO_CODR = (x)
456 //#define HIGH(x) AT91C_BASE_PIOA->PIO_SODR = (x)
457 void SimulateTagLowFrequency( uint16_t period, uint32_t gap, uint8_t ledcontrol)
458 {
459 LED_D_ON();
460
461 uint16_t i = 0;
462 uint8_t send = 0;
463
464 //int overflow = 0;
465 uint8_t *buf = (uint8_t *)BigBuf;
466
467 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
468 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_READER_FIELD);
469 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
470 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
471 RELAY_OFF();
472
473 // Configure output pin that is connected to the FPGA (for modulating)
474 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
475 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
476
477 SHORT_COIL();
478
479 // Enable Peripheral Clock for TIMER_CLOCK0, used to measure exact timing before answering
480 AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0);
481
482 // Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the reader frames
483 AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
484 AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
485
486 // Disable timer during configuration
487 AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
488
489 // Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
490 // external trigger rising edge, load RA on rising edge of TIOA.
491 AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_RISING | AT91C_TC_ABETRG | AT91C_TC_LDRA_RISING;
492
493 // Enable and reset counter
494 //AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
495 AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
496
497 while(!BUTTON_PRESS()) {
498 WDT_HIT();
499
500 // Receive frame, watch for at most T0*EOF periods
501 while (AT91C_BASE_TC1->TC_CV < T0 * 55) {
502
503 // Check if rising edge in modulation is detected
504 if(AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) {
505 // Retrieve the new timing values
506 //int ra = (AT91C_BASE_TC1->TC_RA/T0) + overflow;
507 //Dbprintf("Timing value - %d %d", ra, overflow);
508 //overflow = 0;
509
510 // Reset timer every frame, we have to capture the last edge for timing
511 AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
512 send = 1;
513
514 LED_B_ON();
515 }
516 }
517
518 if ( send ) {
519 // Disable timer 1 with external trigger to avoid triggers during our own modulation
520 AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
521
522 // Wait for HITAG_T_WAIT_1 carrier periods after the last reader bit,
523 // not that since the clock counts since the rising edge, but T_Wait1 is
524 // with respect to the falling edge, we need to wait actually (T_Wait1 - T_Low)
525 // periods. The gap time T_Low varies (4..10). All timer values are in
526 // terms of T0 units
527 while(AT91C_BASE_TC0->TC_CV < T0 * 16 );
528
529 // datat kommer in som 1 bit för varje position i arrayn
530 for(i = 0; i < period; ++i) {
531
532 // Reset clock for the next bit
533 AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
534
535 if ( buf[i] > 0 )
536 HIGH(GPIO_SSC_DOUT);
537 else
538 LOW(GPIO_SSC_DOUT);
539
540 while(AT91C_BASE_TC0->TC_CV < T0 * 1 );
541 }
542 // Drop modulation
543 LOW(GPIO_SSC_DOUT);
544
545 // Enable and reset external trigger in timer for capturing future frames
546 AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
547 LED_B_OFF();
548 }
549
550 send = 0;
551
552 // Save the timer overflow, will be 0 when frame was received
553 //overflow += (AT91C_BASE_TC1->TC_CV/T0);
554
555 // Reset the timer to restart while-loop that receives frames
556 AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
557 }
558
559 LED_B_OFF();
560 LED_D_OFF();
561 AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
562 AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
563 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
564
565 DbpString("Sim Stopped");
566 }
567
568
569 void SimulateTagLowFrequencyA(int len, int gap)
570 {
571 //Dbprintf("LEN %d || Gap %d",len, gap);
572
573 uint8_t *buf = (uint8_t *)BigBuf;
574
575 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
576 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
577 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE); // new izsh toggle mode!
578
579 // Connect the A/D to the peak-detected low-frequency path.
580 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
581
582 // Now set up the SSC to get the ADC samples that are now streaming at us.
583 FpgaSetupSsc();
584 SpinDelay(5);
585
586 AT91C_BASE_SSC->SSC_THR = 0x00;
587
588 int i = 0;
589 while(!BUTTON_PRESS()) {
590 WDT_HIT();
591 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
592
593 if ( buf[i] > 0 )
594 AT91C_BASE_SSC->SSC_THR = 0x43;
595 else
596 AT91C_BASE_SSC->SSC_THR = 0x00;
597
598 ++i;
599 LED_A_ON();
600 if (i >= len){
601 i = 0;
602 }
603 }
604
605 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
606 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
607 (void)r;
608 LED_A_OFF();
609 }
610 }
611 DbpString("lf simulate stopped");
612 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
613 }
614
615 #define DEBUG_FRAME_CONTENTS 1
616 void SimulateTagLowFrequencyBidir(int divisor, int t0)
617 {
618 }
619
620 // compose fc/8 fc/10 waveform
621 static void fc(int c, uint16_t *n) {
622 uint8_t *dest = (uint8_t *)BigBuf;
623 int idx;
624
625 // for when we want an fc8 pattern every 4 logical bits
626 if(c==0) {
627 dest[((*n)++)]=1;
628 dest[((*n)++)]=1;
629 dest[((*n)++)]=0;
630 dest[((*n)++)]=0;
631 dest[((*n)++)]=0;
632 dest[((*n)++)]=0;
633 dest[((*n)++)]=0;
634 dest[((*n)++)]=0;
635 }
636 // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
637 if(c==8) {
638 for (idx=0; idx<6; idx++) {
639 dest[((*n)++)]=1;
640 dest[((*n)++)]=1;
641 dest[((*n)++)]=0;
642 dest[((*n)++)]=0;
643 dest[((*n)++)]=0;
644 dest[((*n)++)]=0;
645 dest[((*n)++)]=0;
646 dest[((*n)++)]=0;
647 }
648 }
649
650 // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
651 if(c==10) {
652 for (idx=0; idx<5; idx++) {
653 dest[((*n)++)]=1;
654 dest[((*n)++)]=1;
655 dest[((*n)++)]=1;
656 dest[((*n)++)]=0;
657 dest[((*n)++)]=0;
658 dest[((*n)++)]=0;
659 dest[((*n)++)]=0;
660 dest[((*n)++)]=0;
661 dest[((*n)++)]=0;
662 dest[((*n)++)]=0;
663 }
664 }
665 }
666
667 // prepare a waveform pattern in the buffer based on the ID given then
668 // simulate a HID tag until the button is pressed
669 void CmdHIDsimTAG(int hi, int lo, uint8_t ledcontrol)
670 {
671 uint16_t n=0, i=0;
672 /*
673 HID tag bitstream format
674 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
675 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
676 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
677 A fc8 is inserted before every 4 bits
678 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
679 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
680 */
681
682 if (hi>0xFFF) {
683 DbpString("Tags can only have 44 bits.");
684 return;
685 }
686 fc(0,&n);
687 // special start of frame marker containing invalid bit sequences
688 fc(8, &n); fc(8, &n); // invalid
689 fc(8, &n); fc(10, &n); // logical 0
690 fc(10, &n); fc(10, &n); // invalid
691 fc(8, &n); fc(10, &n); // logical 0
692
693 WDT_HIT();
694 // manchester encode bits 43 to 32
695 for (i=11; i>=0; i--) {
696 if ((i%4)==3) fc(0,&n);
697 if ((hi>>i)&1) {
698 fc(10, &n); fc(8, &n); // low-high transition
699 } else {
700 fc(8, &n); fc(10, &n); // high-low transition
701 }
702 }
703
704 WDT_HIT();
705 // manchester encode bits 31 to 0
706 for (i=31; i>=0; i--) {
707 if ((i%4)==3) fc(0,&n);
708 if ((lo>>i)&1) {
709 fc(10, &n); fc(8, &n); // low-high transition
710 } else {
711 fc(8, &n); fc(10, &n); // high-low transition
712 }
713 }
714
715 if (ledcontrol)
716 LED_A_ON();
717
718 SimulateTagLowFrequency(n, 0, ledcontrol);
719
720 if (ledcontrol)
721 LED_A_OFF();
722 }
723
724 //translate wave to 11111100000 (1 for each short wave 0 for each long wave)
725 size_t fsk_demod(uint8_t * dest, size_t size)
726 {
727 uint32_t last_transition = 0;
728 uint32_t idx = 1;
729 uint32_t maxVal=0;
730 // // we don't care about actual value, only if it's more or less than a
731 // // threshold essentially we capture zero crossings for later analysis
732
733 // we do care about the actual value as sometimes near the center of the
734 // wave we may get static that changes direction of wave for one value
735 // if our value is too low it might affect the read. and if our tag or
736 // antenna is weak a setting too high might not see anything. [marshmellow]
737 if (size<100) return size;
738 for(idx=1; idx<100; idx++){
739 if(maxVal<dest[idx]) maxVal = dest[idx];
740 }
741 // set close to the top of the wave threshold with 13% margin for error
742 // less likely to get a false transition up there.
743 // (but have to be careful not to go too high and miss some short waves)
744 uint32_t threshold_value = (uint32_t)(maxVal*.87); idx=1;
745 //uint8_t threshold_value = 127;
746
747 // sync to first lo-hi transition, and threshold
748
749 //Need to threshold first sample
750 dest[0] = (dest[0] < threshold_value) ? 0 : 1;
751
752 size_t numBits = 0;
753 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
754 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
755 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
756 for(idx = 1; idx < size; idx++) {
757 // threshold current value
758 dest[idx] = (dest[idx] < threshold_value) ? 0 : 1;
759
760 // Check for 0->1 transition
761 if (dest[idx-1] < dest[idx]) { // 0 -> 1 transition
762
763 dest[numBits] = (idx-last_transition < 9) ? 1 : 0;
764 last_transition = idx;
765 numBits++;
766 }
767 }
768 return numBits; //Actually, it returns the number of bytes, but each byte represents a bit: 1 or 0
769 }
770
771 uint32_t myround(float f)
772 {
773 if (f >= 2000) return 2000;//something bad happened
774 return (uint32_t) (f + (float)0.5);
775 }
776
777 //translate 11111100000 to 10
778 size_t aggregate_bits(uint8_t *dest,size_t size, uint8_t rfLen, uint8_t maxConsequtiveBits, uint8_t invert )// uint8_t h2l_crossing_value,uint8_t l2h_crossing_value,
779 {
780 uint8_t lastval=dest[0];
781 uint32_t idx=0;
782 size_t numBits=0;
783 uint32_t n=1;
784
785 for( idx=1; idx < size; idx++) {
786
787 if (dest[idx]==lastval) {
788 n++;
789 continue;
790 }
791 //if lastval was 1, we have a 1->0 crossing
792 if ( dest[idx-1]==1 ) {
793 n=myround((float)(n+1)/((float)(rfLen)/(float)8));
794 //n=(n+1) / h2l_crossing_value;
795 } else {// 0->1 crossing
796 n=myround((float)(n+1)/((float)(rfLen-2)/(float)10));
797 //n=(n+1) / l2h_crossing_value;
798 }
799 if (n == 0) n = 1;
800
801 if(n < maxConsequtiveBits)
802 {
803 if ( invert==0)
804 memset(dest+numBits, dest[idx-1] , n);
805 else
806 memset(dest+numBits, dest[idx-1]^1 , n);
807
808 numBits += n;
809 }
810 n=0;
811 lastval=dest[idx];
812 }//end for
813
814 return numBits;
815
816 }
817 // loop to get raw HID waveform then FSK demodulate the TAG ID from it
818 void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
819 {
820 uint8_t *dest = get_bigbufptr_recvrespbuf();
821
822 size_t size=0,idx=0; //, found=0;
823 uint32_t hi2=0, hi=0, lo=0;
824
825 // Configure to go in 125Khz listen mode
826 LFSetupFPGAForADC(0, true);
827
828 while(!BUTTON_PRESS()) {
829
830 WDT_HIT();
831 if (ledcontrol) LED_A_ON();
832
833 DoAcquisition125k_internal(-1,true);
834
835 // FSK demodulator
836 size = fsk_demod(dest, FREE_BUFFER_SIZE);
837
838 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
839 // 1->0 : fc/8 in sets of 6 (RF/50 / 8 = 6.25)
840 // 0->1 : fc/10 in sets of 5 (RF/50 / 10= 5)
841 // do not invert
842 size = aggregate_bits(dest,size, 50,5,0); //6,5,5,0
843
844 WDT_HIT();
845
846 // final loop, go over previously decoded manchester data and decode into usable tag ID
847 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
848 uint8_t frame_marker_mask[] = {1,1,1,0,0,0};
849 int numshifts = 0;
850 idx = 0;
851 //one scan
852 uint8_t sameCardCount =0;
853 while( idx + sizeof(frame_marker_mask) < size) {
854 // search for a start of frame marker
855 if (sameCardCount>2) break; //only up to 2 valid sets of data for the same read of looping card data
856 if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0)
857 { // frame marker found
858 idx+=sizeof(frame_marker_mask);
859
860 while(dest[idx] != dest[idx+1] && idx < size-2)
861 {
862 // Keep going until next frame marker (or error)
863 // Shift in a bit. Start by shifting high registers
864 hi2=(hi2<<1)|(hi>>31);
865 hi=(hi<<1)|(lo>>31);
866 //Then, shift in a 0 or one into low
867 if (dest[idx] && !dest[idx+1]) // 1 0
868 lo=(lo<<1)|0;
869 else // 0 1
870 lo=(lo<<1)|
871 1;
872 numshifts ++;
873 idx += 2;
874 }
875 //Dbprintf("Num shifts: %d ", numshifts);
876 // Hopefully, we read a tag and hit upon the next frame marker
877 if(idx + sizeof(frame_marker_mask) < size)
878 {
879 if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0)
880 {
881 if (hi2 != 0){ //extra large HID tags
882 Dbprintf("TAG ID: %x%08x%08x (%d)",
883 (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
884 }
885 else { //standard HID tags <38 bits
886 //Dbprintf("TAG ID: %x%08x (%d)",(unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); //old print cmd
887 uint8_t bitlen = 0;
888 uint32_t fc = 0;
889 uint32_t cardnum = 0;
890 if (((hi>>5)&1)==1){//if bit 38 is set then < 37 bit format is used
891 uint32_t lo2=0;
892 lo2=(((hi & 31) << 12) | (lo>>20)); //get bits 21-37 to check for format len bit
893 uint8_t idx3 = 1;
894 while(lo2>1){ //find last bit set to 1 (format len bit)
895 lo2=lo2>>1;
896 idx3++;
897 }
898 bitlen =idx3+19;
899 fc =0;
900 cardnum=0;
901 if(bitlen==26){
902 cardnum = (lo>>1)&0xFFFF;
903 fc = (lo>>17)&0xFF;
904 }
905 if(bitlen==37){
906 cardnum = (lo>>1)&0x7FFFF;
907 fc = ((hi&0xF)<<12)|(lo>>20);
908 }
909 if(bitlen==34){
910 cardnum = (lo>>1)&0xFFFF;
911 fc= ((hi&1)<<15)|(lo>>17);
912 }
913 if(bitlen==35){
914 cardnum = (lo>>1)&0xFFFFF;
915 fc = ((hi&1)<<11)|(lo>>21);
916 }
917 }
918 else { //if bit 38 is not set then 37 bit format is used
919 bitlen= 37;
920 fc =0;
921 cardnum=0;
922 if(bitlen==37){
923 cardnum = (lo>>1)&0x7FFFF;
924 fc = ((hi&0xF)<<12)|(lo>>20);
925 }
926 }
927 //Dbprintf("TAG ID: %x%08x (%d)",
928 // (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
929 Dbprintf("TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d",
930 (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF,
931 (unsigned int) bitlen, (unsigned int) fc, (unsigned int) cardnum);
932 }
933 sameCardCount++;
934 if (findone){
935 if (ledcontrol) LED_A_OFF();
936 return;
937 }
938 }
939 }
940 // reset
941 hi2 = hi = lo = 0;
942 numshifts = 0;
943 } else {
944 idx++;
945 }
946 }
947 WDT_HIT();
948
949 }
950 DbpString("Stopped");
951 if (ledcontrol) LED_A_OFF();
952 }
953
954 uint32_t bytebits_to_byte(uint8_t* src, int numbits)
955 {
956 uint32_t num = 0;
957 for(int i = 0 ; i < numbits ; i++)
958 {
959 num = (num << 1) | (*src);
960 src++;
961 }
962 return num;
963 }
964
965
966 void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
967 {
968 uint8_t *dest = (uint8_t *)BigBuf;
969 size_t size=0, idx=0;
970 uint32_t code=0, code2=0;
971 uint8_t isFinish = 0;
972
973 // Configure to go in 125Khz listen mode
974 LFSetupFPGAForADC(0, true);
975
976 while(!BUTTON_PRESS() & !isFinish) {
977
978 WDT_HIT();
979
980 if (ledcontrol) LED_A_ON();
981
982 DoAcquisition125k_internal(-1,true);
983 size = sizeof(BigBuf);
984 //make sure buffer has data
985 if (size < 64) return;
986 //test samples are not just noise
987 uint8_t testMax=0;
988 for(idx=0;idx<64;idx++){
989 if (testMax<dest[idx]) testMax=dest[idx];
990 }
991 idx=0;
992 //if not just noise
993 if (testMax>170){
994 //Dbprintf("testMax: %d",testMax);
995 // FSK demodulator
996 size = fsk_demod(dest, size);
997 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
998 // 1->0 : fc/8 in sets of 7 (RF/64 / 8 = 8)
999 // 0->1 : fc/10 in sets of 6 (RF/64 / 10 = 6.4)
1000 size = aggregate_bits(dest, size, 64, 13, 1); //13 max Consecutive should be ok as most 0s in row should be 10 for init seq - invert bits
1001 WDT_HIT();
1002 //Index map
1003 //0 10 20 30 40 50 60
1004 //| | | | | | |
1005 //01234567 8 90123456 7 89012345 6 78901234 5 67890123 4 56789012 3 45678901 23
1006 //-----------------------------------------------------------------------------
1007 //00000000 0 11110000 1 facility 1 version* 1 code*one 1 code*two 1 ???????? 11
1008 //
1009 //XSF(version)facility:codeone+codetwo
1010 //Handle the data
1011 uint8_t sameCardCount=0;
1012 uint8_t mask[] = {0,0,0,0,0,0,0,0,0,1};
1013 for( idx=0; idx < (size - 74); idx++) {
1014 if (sameCardCount>2) break;
1015 if ( memcmp(dest + idx, mask, sizeof(mask))==0) {
1016 //frame marker found
1017 if (!dest[idx+8] && dest[idx+17]==1 && dest[idx+26]==1 && dest[idx+35]==1 && dest[idx+44]==1 && dest[idx+53]==1){
1018 //confirmed proper separator bits found
1019 if(findone){ //only print binary if we are doing one
1020 Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7],dest[idx+8]);
1021 Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15],dest[idx+16],dest[idx+17]);
1022 Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23],dest[idx+24],dest[idx+25],dest[idx+26]);
1023 Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+27],dest[idx+28],dest[idx+29],dest[idx+30],dest[idx+31],dest[idx+32],dest[idx+33],dest[idx+34],dest[idx+35]);
1024 Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+36],dest[idx+37],dest[idx+38],dest[idx+39],dest[idx+40],dest[idx+41],dest[idx+42],dest[idx+43],dest[idx+44]);
1025 Dbprintf("%d%d%d%d%d%d%d%d %d",dest[idx+45],dest[idx+46],dest[idx+47],dest[idx+48],dest[idx+49],dest[idx+50],dest[idx+51],dest[idx+52],dest[idx+53]);
1026 Dbprintf("%d%d%d%d%d%d%d%d %d%d",dest[idx+54],dest[idx+55],dest[idx+56],dest[idx+57],dest[idx+58],dest[idx+59],dest[idx+60],dest[idx+61],dest[idx+62],dest[idx+63]);
1027 }
1028 code = bytebits_to_byte(dest+idx,32);
1029 code2 = bytebits_to_byte(dest+idx+32,32);
1030 short version = bytebits_to_byte(dest+idx+27,8); //14,4
1031 uint8_t facilitycode = bytebits_to_byte(dest+idx+19,8) ;
1032 uint16_t number = (bytebits_to_byte(dest+idx+36,8)<<8)|(bytebits_to_byte(dest+idx+45,8)); //36,9
1033
1034 Dbprintf("XSF(%02d)%02x:%d (%08x%08x)",version,facilitycode,number,code,code2);
1035
1036 // if we're only looking for one tag
1037 if (findone){
1038 if (ledcontrol) LED_A_OFF();
1039 isFinish = 1;
1040 break;
1041 }
1042 sameCardCount++;
1043 }
1044 }
1045 }
1046 }
1047 WDT_HIT();
1048 }
1049 DbpString("Stopped");
1050 if (ledcontrol) LED_A_OFF();
1051 }
1052
1053 /*------------------------------
1054 * T5555/T5557/T5567 routines
1055 *------------------------------
1056 */
1057
1058 /* T55x7 configuration register definitions */
1059 #define T55x7_POR_DELAY 0x00000001
1060 #define T55x7_ST_TERMINATOR 0x00000008
1061 #define T55x7_PWD 0x00000010
1062 #define T55x7_MAXBLOCK_SHIFT 5
1063 #define T55x7_AOR 0x00000200
1064 #define T55x7_PSKCF_RF_2 0
1065 #define T55x7_PSKCF_RF_4 0x00000400
1066 #define T55x7_PSKCF_RF_8 0x00000800
1067 #define T55x7_MODULATION_DIRECT 0
1068 #define T55x7_MODULATION_PSK1 0x00001000
1069 #define T55x7_MODULATION_PSK2 0x00002000
1070 #define T55x7_MODULATION_PSK3 0x00003000
1071 #define T55x7_MODULATION_FSK1 0x00004000
1072 #define T55x7_MODULATION_FSK2 0x00005000
1073 #define T55x7_MODULATION_FSK1a 0x00006000
1074 #define T55x7_MODULATION_FSK2a 0x00007000
1075 #define T55x7_MODULATION_MANCHESTER 0x00008000
1076 #define T55x7_MODULATION_BIPHASE 0x00010000
1077 #define T55x7_BITRATE_RF_8 0
1078 #define T55x7_BITRATE_RF_16 0x00040000
1079 #define T55x7_BITRATE_RF_32 0x00080000
1080 #define T55x7_BITRATE_RF_40 0x000C0000
1081 #define T55x7_BITRATE_RF_50 0x00100000
1082 #define T55x7_BITRATE_RF_64 0x00140000
1083 #define T55x7_BITRATE_RF_100 0x00180000
1084 #define T55x7_BITRATE_RF_128 0x001C0000
1085
1086 /* T5555 (Q5) configuration register definitions */
1087 #define T5555_ST_TERMINATOR 0x00000001
1088 #define T5555_MAXBLOCK_SHIFT 0x00000001
1089 #define T5555_MODULATION_MANCHESTER 0
1090 #define T5555_MODULATION_PSK1 0x00000010
1091 #define T5555_MODULATION_PSK2 0x00000020
1092 #define T5555_MODULATION_PSK3 0x00000030
1093 #define T5555_MODULATION_FSK1 0x00000040
1094 #define T5555_MODULATION_FSK2 0x00000050
1095 #define T5555_MODULATION_BIPHASE 0x00000060
1096 #define T5555_MODULATION_DIRECT 0x00000070
1097 #define T5555_INVERT_OUTPUT 0x00000080
1098 #define T5555_PSK_RF_2 0
1099 #define T5555_PSK_RF_4 0x00000100
1100 #define T5555_PSK_RF_8 0x00000200
1101 #define T5555_USE_PWD 0x00000400
1102 #define T5555_USE_AOR 0x00000800
1103 #define T5555_BITRATE_SHIFT 12
1104 #define T5555_FAST_WRITE 0x00004000
1105 #define T5555_PAGE_SELECT 0x00008000
1106
1107 /*
1108 * Relevant times in microsecond
1109 * To compensate antenna falling times shorten the write times
1110 * and enlarge the gap ones.
1111 */
1112 #define START_GAP 30*8 // 10 - 50fc 250
1113 #define WRITE_GAP 20*8 // 8 - 30fc
1114 #define WRITE_0 24*8 // 16 - 31fc 24fc 192
1115 #define WRITE_1 54*8 // 48 - 63fc 54fc 432 for T55x7; 448 for E5550
1116
1117 // VALUES TAKEN FROM EM4x function: SendForward
1118 // START_GAP = 440; (55*8) cycles at 125Khz (8us = 1cycle)
1119 // WRITE_GAP = 128; (16*8)
1120 // WRITE_1 = 256 32*8; (32*8)
1121
1122 // These timings work for 4469/4269/4305 (with the 55*8 above)
1123 // WRITE_0 = 23*8 , 9*8 SpinDelayUs(23*8);
1124
1125 #define T55xx_SAMPLES_SIZE 12000 // 32 x 32 x 10 (32 bit times numofblock (7), times clock skip..)
1126
1127 // Write one bit to card
1128 void T55xxWriteBit(int bit)
1129 {
1130 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1131 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1132 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
1133 if (!bit)
1134 SpinDelayUs(WRITE_0);
1135 else
1136 SpinDelayUs(WRITE_1);
1137 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1138 SpinDelayUs(WRITE_GAP);
1139 }
1140
1141 // Write one card block in page 0, no lock
1142 void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
1143 {
1144 uint32_t i = 0;
1145
1146 // Set up FPGA, 125kHz
1147 // Wait for config.. (192+8190xPOW)x8 == 67ms
1148 LFSetupFPGAForADC(0, true);
1149
1150 // Now start writting
1151 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1152 SpinDelayUs(START_GAP);
1153
1154 // Opcode
1155 T55xxWriteBit(1);
1156 T55xxWriteBit(0); //Page 0
1157 if (PwdMode == 1){
1158 // Pwd
1159 for (i = 0x80000000; i != 0; i >>= 1)
1160 T55xxWriteBit(Pwd & i);
1161 }
1162 // Lock bit
1163 T55xxWriteBit(0);
1164
1165 // Data
1166 for (i = 0x80000000; i != 0; i >>= 1)
1167 T55xxWriteBit(Data & i);
1168
1169 // Block
1170 for (i = 0x04; i != 0; i >>= 1)
1171 T55xxWriteBit(Block & i);
1172
1173 // Now perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
1174 // so wait a little more)
1175 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1176 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
1177 SpinDelay(20);
1178 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1179 }
1180
1181 // Read one card block in page 0
1182 void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
1183 {
1184 uint8_t *dest = get_bigbufptr_recvrespbuf();
1185 uint16_t bufferlength = T55xx_SAMPLES_SIZE;
1186 uint32_t i = 0;
1187
1188 // Clear destination buffer before sending the command 0x80 = average.
1189 memset(dest, 0x80, bufferlength);
1190
1191 // Set up FPGA, 125kHz
1192 // Wait for config.. (192+8190xPOW)x8 == 67ms
1193 LFSetupFPGAForADC(0, true);
1194
1195 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1196 SpinDelayUs(START_GAP);
1197
1198 // Opcode
1199 T55xxWriteBit(1);
1200 T55xxWriteBit(0); //Page 0
1201 if (PwdMode == 1){
1202 // Pwd
1203 for (i = 0x80000000; i != 0; i >>= 1)
1204 T55xxWriteBit(Pwd & i);
1205 }
1206 // Lock bit
1207 T55xxWriteBit(0);
1208 // Block
1209 for (i = 0x04; i != 0; i >>= 1)
1210 T55xxWriteBit(Block & i);
1211
1212 // Turn field on to read the response
1213 TurnReadLFOn();
1214
1215 // Now do the acquisition
1216 i = 0;
1217 for(;;) {
1218 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
1219 AT91C_BASE_SSC->SSC_THR = 0x43;
1220 //AT91C_BASE_SSC->SSC_THR = 0xff;
1221 LED_D_ON();
1222 }
1223 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
1224 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1225 ++i;
1226 LED_D_OFF();
1227 if (i >= bufferlength) break;
1228 }
1229 }
1230
1231 cmd_send(CMD_ACK,0,0,0,0,0);
1232 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1233 LED_D_OFF();
1234 }
1235
1236 // Read card traceability data (page 1)
1237 void T55xxReadTrace(void){
1238 uint8_t *dest = get_bigbufptr_recvrespbuf();
1239 uint16_t bufferlength = T55xx_SAMPLES_SIZE;
1240 uint32_t i = 0;
1241
1242 // Clear destination buffer before sending the command 0x80 = average
1243 memset(dest, 0x80, bufferlength);
1244
1245 LFSetupFPGAForADC(0, true);
1246
1247 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1248 SpinDelayUs(START_GAP);
1249
1250 // Opcode
1251 T55xxWriteBit(1);
1252 T55xxWriteBit(1); //Page 1
1253
1254 // Turn field on to read the response
1255 TurnReadLFOn();
1256
1257 // Now do the acquisition
1258 for(;;) {
1259 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
1260 AT91C_BASE_SSC->SSC_THR = 0x43;
1261 LED_D_ON();
1262 }
1263 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
1264 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1265 ++i;
1266 LED_D_OFF();
1267
1268 if (i >= bufferlength) break;
1269 }
1270 }
1271
1272 cmd_send(CMD_ACK,0,0,0,0,0);
1273 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1274 LED_D_OFF();
1275 }
1276
1277 void TurnReadLFOn(){
1278 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1279 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
1280 // Give it a bit of time for the resonant antenna to settle.
1281 //SpinDelay(30);
1282 SpinDelayUs(8*150);
1283 }
1284
1285 /*-------------- Cloning routines -----------*/
1286 // Copy HID id to card and setup block 0 config
1287 void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT)
1288 {
1289 int data1=0, data2=0, data3=0, data4=0, data5=0, data6=0; //up to six blocks for long format
1290 int last_block = 0;
1291
1292 if (longFMT){
1293 // Ensure no more than 84 bits supplied
1294 if (hi2>0xFFFFF) {
1295 DbpString("Tags can only have 84 bits.");
1296 return;
1297 }
1298 // Build the 6 data blocks for supplied 84bit ID
1299 last_block = 6;
1300 data1 = 0x1D96A900; // load preamble (1D) & long format identifier (9E manchester encoded)
1301 for (int i=0;i<4;i++) {
1302 if (hi2 & (1<<(19-i)))
1303 data1 |= (1<<(((3-i)*2)+1)); // 1 -> 10
1304 else
1305 data1 |= (1<<((3-i)*2)); // 0 -> 01
1306 }
1307
1308 data2 = 0;
1309 for (int i=0;i<16;i++) {
1310 if (hi2 & (1<<(15-i)))
1311 data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1312 else
1313 data2 |= (1<<((15-i)*2)); // 0 -> 01
1314 }
1315
1316 data3 = 0;
1317 for (int i=0;i<16;i++) {
1318 if (hi & (1<<(31-i)))
1319 data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1320 else
1321 data3 |= (1<<((15-i)*2)); // 0 -> 01
1322 }
1323
1324 data4 = 0;
1325 for (int i=0;i<16;i++) {
1326 if (hi & (1<<(15-i)))
1327 data4 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1328 else
1329 data4 |= (1<<((15-i)*2)); // 0 -> 01
1330 }
1331
1332 data5 = 0;
1333 for (int i=0;i<16;i++) {
1334 if (lo & (1<<(31-i)))
1335 data5 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1336 else
1337 data5 |= (1<<((15-i)*2)); // 0 -> 01
1338 }
1339
1340 data6 = 0;
1341 for (int i=0;i<16;i++) {
1342 if (lo & (1<<(15-i)))
1343 data6 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1344 else
1345 data6 |= (1<<((15-i)*2)); // 0 -> 01
1346 }
1347 }
1348 else {
1349 // Ensure no more than 44 bits supplied
1350 if (hi>0xFFF) {
1351 DbpString("Tags can only have 44 bits.");
1352 return;
1353 }
1354
1355 // Build the 3 data blocks for supplied 44bit ID
1356 last_block = 3;
1357
1358 data1 = 0x1D000000; // load preamble
1359
1360 for (int i=0;i<12;i++) {
1361 if (hi & (1<<(11-i)))
1362 data1 |= (1<<(((11-i)*2)+1)); // 1 -> 10
1363 else
1364 data1 |= (1<<((11-i)*2)); // 0 -> 01
1365 }
1366
1367 data2 = 0;
1368 for (int i=0;i<16;i++) {
1369 if (lo & (1<<(31-i)))
1370 data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1371 else
1372 data2 |= (1<<((15-i)*2)); // 0 -> 01
1373 }
1374
1375 data3 = 0;
1376 for (int i=0;i<16;i++) {
1377 if (lo & (1<<(15-i)))
1378 data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1379 else
1380 data3 |= (1<<((15-i)*2)); // 0 -> 01
1381 }
1382 }
1383
1384 LED_D_ON();
1385 // Program the data blocks for supplied ID
1386 // and the block 0 for HID format
1387 T55xxWriteBlock(data1,1,0,0);
1388 T55xxWriteBlock(data2,2,0,0);
1389 T55xxWriteBlock(data3,3,0,0);
1390
1391 if (longFMT) { // if long format there are 6 blocks
1392 T55xxWriteBlock(data4,4,0,0);
1393 T55xxWriteBlock(data5,5,0,0);
1394 T55xxWriteBlock(data6,6,0,0);
1395 }
1396
1397 // Config for HID (RF/50, FSK2a, Maxblock=3 for short/6 for long)
1398 T55xxWriteBlock(T55x7_BITRATE_RF_50 |
1399 T55x7_MODULATION_FSK2a |
1400 last_block << T55x7_MAXBLOCK_SHIFT,
1401 0,0,0);
1402
1403 LED_D_OFF();
1404
1405 DbpString("DONE!");
1406 }
1407
1408 void CopyIOtoT55x7(uint32_t hi, uint32_t lo, uint8_t longFMT)
1409 {
1410 int data1=0, data2=0; //up to six blocks for long format
1411
1412 data1 = hi; // load preamble
1413 data2 = lo;
1414
1415 LED_D_ON();
1416 // Program the data blocks for supplied ID
1417 // and the block 0 for HID format
1418 T55xxWriteBlock(data1,1,0,0);
1419 T55xxWriteBlock(data2,2,0,0);
1420
1421 //Config Block
1422 T55xxWriteBlock(0x00147040,0,0,0);
1423 LED_D_OFF();
1424
1425 DbpString("DONE!");
1426 }
1427
1428 // Define 9bit header for EM410x tags
1429 #define EM410X_HEADER 0x1FF
1430 #define EM410X_ID_LENGTH 40
1431
1432 void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
1433 {
1434 int i, id_bit;
1435 uint64_t id = EM410X_HEADER;
1436 uint64_t rev_id = 0; // reversed ID
1437 int c_parity[4]; // column parity
1438 int r_parity = 0; // row parity
1439 uint32_t clock = 0;
1440
1441 // Reverse ID bits given as parameter (for simpler operations)
1442 for (i = 0; i < EM410X_ID_LENGTH; ++i) {
1443 if (i < 32) {
1444 rev_id = (rev_id << 1) | (id_lo & 1);
1445 id_lo >>= 1;
1446 } else {
1447 rev_id = (rev_id << 1) | (id_hi & 1);
1448 id_hi >>= 1;
1449 }
1450 }
1451
1452 for (i = 0; i < EM410X_ID_LENGTH; ++i) {
1453 id_bit = rev_id & 1;
1454
1455 if (i % 4 == 0) {
1456 // Don't write row parity bit at start of parsing
1457 if (i)
1458 id = (id << 1) | r_parity;
1459 // Start counting parity for new row
1460 r_parity = id_bit;
1461 } else {
1462 // Count row parity
1463 r_parity ^= id_bit;
1464 }
1465
1466 // First elements in column?
1467 if (i < 4)
1468 // Fill out first elements
1469 c_parity[i] = id_bit;
1470 else
1471 // Count column parity
1472 c_parity[i % 4] ^= id_bit;
1473
1474 // Insert ID bit
1475 id = (id << 1) | id_bit;
1476 rev_id >>= 1;
1477 }
1478
1479 // Insert parity bit of last row
1480 id = (id << 1) | r_parity;
1481
1482 // Fill out column parity at the end of tag
1483 for (i = 0; i < 4; ++i)
1484 id = (id << 1) | c_parity[i];
1485
1486 // Add stop bit
1487 id <<= 1;
1488
1489 Dbprintf("Started writing %s tag ...", card ? "T55x7":"T5555");
1490 LED_D_ON();
1491
1492 // Write EM410x ID
1493 T55xxWriteBlock((uint32_t)(id >> 32), 1, 0, 0);
1494 T55xxWriteBlock((uint32_t)id, 2, 0, 0);
1495
1496 // Config for EM410x (RF/64, Manchester, Maxblock=2)
1497 if (card) {
1498 // Clock rate is stored in bits 8-15 of the card value
1499 clock = (card & 0xFF00) >> 8;
1500 Dbprintf("Clock rate: %d", clock);
1501 switch (clock)
1502 {
1503 case 32:
1504 clock = T55x7_BITRATE_RF_32;
1505 break;
1506 case 16:
1507 clock = T55x7_BITRATE_RF_16;
1508 break;
1509 case 0:
1510 // A value of 0 is assumed to be 64 for backwards-compatibility
1511 // Fall through...
1512 case 64:
1513 clock = T55x7_BITRATE_RF_64;
1514 break;
1515 default:
1516 Dbprintf("Invalid clock rate: %d", clock);
1517 return;
1518 }
1519
1520 // Writing configuration for T55x7 tag
1521 T55xxWriteBlock(clock |
1522 T55x7_MODULATION_MANCHESTER |
1523 2 << T55x7_MAXBLOCK_SHIFT,
1524 0, 0, 0);
1525 }
1526 else
1527 // Writing configuration for T5555(Q5) tag
1528 T55xxWriteBlock(0x1F << T5555_BITRATE_SHIFT |
1529 T5555_MODULATION_MANCHESTER |
1530 2 << T5555_MAXBLOCK_SHIFT,
1531 0, 0, 0);
1532
1533 LED_D_OFF();
1534 Dbprintf("Tag %s written with 0x%08x%08x\n", card ? "T55x7":"T5555",
1535 (uint32_t)(id >> 32), (uint32_t)id);
1536 }
1537
1538 // Clone Indala 64-bit tag by UID to T55x7
1539 void CopyIndala64toT55x7(int hi, int lo)
1540 {
1541 //Program the 2 data blocks for supplied 64bit UID
1542 // and the block 0 for Indala64 format
1543 T55xxWriteBlock(hi,1,0,0);
1544 T55xxWriteBlock(lo,2,0,0);
1545 //Config for Indala (RF/32;PSK1 with RF/2;Maxblock=2)
1546 T55xxWriteBlock(T55x7_BITRATE_RF_32 |
1547 T55x7_MODULATION_PSK1 |
1548 2 << T55x7_MAXBLOCK_SHIFT,
1549 0, 0, 0);
1550 //Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
1551 // T5567WriteBlock(0x603E1042,0);
1552
1553 DbpString("DONE!");
1554 }
1555
1556 void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int uid6, int uid7)
1557 {
1558 //Program the 7 data blocks for supplied 224bit UID
1559 // and the block 0 for Indala224 format
1560 T55xxWriteBlock(uid1,1,0,0);
1561 T55xxWriteBlock(uid2,2,0,0);
1562 T55xxWriteBlock(uid3,3,0,0);
1563 T55xxWriteBlock(uid4,4,0,0);
1564 T55xxWriteBlock(uid5,5,0,0);
1565 T55xxWriteBlock(uid6,6,0,0);
1566 T55xxWriteBlock(uid7,7,0,0);
1567 //Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
1568 T55xxWriteBlock(T55x7_BITRATE_RF_32 |
1569 T55x7_MODULATION_PSK1 |
1570 7 << T55x7_MAXBLOCK_SHIFT,
1571 0,0,0);
1572 //Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
1573 // T5567WriteBlock(0x603E10E2,0);
1574
1575 DbpString("DONE!");
1576 }
1577
1578
1579 #define abs(x) ( ((x)<0) ? -(x) : (x) )
1580 #define max(x,y) ( x<y ? y:x)
1581
1582 int DemodPCF7931(uint8_t **outBlocks) {
1583 uint8_t BitStream[256];
1584 uint8_t Blocks[8][16];
1585 uint8_t *GraphBuffer = (uint8_t *)BigBuf;
1586 int GraphTraceLen = sizeof(BigBuf);
1587 int i, j, lastval, bitidx, half_switch;
1588 int clock = 64;
1589 int tolerance = clock / 8;
1590 int pmc, block_done;
1591 int lc, warnings = 0;
1592 int num_blocks = 0;
1593 int lmin=128, lmax=128;
1594 uint8_t dir;
1595
1596 AcquireRawAdcSamples125k(0);
1597
1598 lmin = 64;
1599 lmax = 192;
1600
1601 i = 2;
1602
1603 /* Find first local max/min */
1604 if(GraphBuffer[1] > GraphBuffer[0]) {
1605 while(i < GraphTraceLen) {
1606 if( !(GraphBuffer[i] > GraphBuffer[i-1]) && GraphBuffer[i] > lmax)
1607 break;
1608 i++;
1609 }
1610 dir = 0;
1611 }
1612 else {
1613 while(i < GraphTraceLen) {
1614 if( !(GraphBuffer[i] < GraphBuffer[i-1]) && GraphBuffer[i] < lmin)
1615 break;
1616 i++;
1617 }
1618 dir = 1;
1619 }
1620
1621 lastval = i++;
1622 half_switch = 0;
1623 pmc = 0;
1624 block_done = 0;
1625
1626 for (bitidx = 0; i < GraphTraceLen; i++)
1627 {
1628 if ( (GraphBuffer[i-1] > GraphBuffer[i] && dir == 1 && GraphBuffer[i] > lmax) || (GraphBuffer[i-1] < GraphBuffer[i] && dir == 0 && GraphBuffer[i] < lmin))
1629 {
1630 lc = i - lastval;
1631 lastval = i;
1632
1633 // Switch depending on lc length:
1634 // Tolerance is 1/8 of clock rate (arbitrary)
1635 if (abs(lc-clock/4) < tolerance) {
1636 // 16T0
1637 if((i - pmc) == lc) { /* 16T0 was previous one */
1638 /* It's a PMC ! */
1639 i += (128+127+16+32+33+16)-1;
1640 lastval = i;
1641 pmc = 0;
1642 block_done = 1;
1643 }
1644 else {
1645 pmc = i;
1646 }
1647 } else if (abs(lc-clock/2) < tolerance) {
1648 // 32TO
1649 if((i - pmc) == lc) { /* 16T0 was previous one */
1650 /* It's a PMC ! */
1651 i += (128+127+16+32+33)-1;
1652 lastval = i;
1653 pmc = 0;
1654 block_done = 1;
1655 }
1656 else if(half_switch == 1) {
1657 BitStream[bitidx++] = 0;
1658 half_switch = 0;
1659 }
1660 else
1661 half_switch++;
1662 } else if (abs(lc-clock) < tolerance) {
1663 // 64TO
1664 BitStream[bitidx++] = 1;
1665 } else {
1666 // Error
1667 warnings++;
1668 if (warnings > 10)
1669 {
1670 Dbprintf("Error: too many detection errors, aborting.");
1671 return 0;
1672 }
1673 }
1674
1675 if(block_done == 1) {
1676 if(bitidx == 128) {
1677 for(j=0; j<16; j++) {
1678 Blocks[num_blocks][j] = 128*BitStream[j*8+7]+
1679 64*BitStream[j*8+6]+
1680 32*BitStream[j*8+5]+
1681 16*BitStream[j*8+4]+
1682 8*BitStream[j*8+3]+
1683 4*BitStream[j*8+2]+
1684 2*BitStream[j*8+1]+
1685 BitStream[j*8];
1686 }
1687 num_blocks++;
1688 }
1689 bitidx = 0;
1690 block_done = 0;
1691 half_switch = 0;
1692 }
1693 if(i < GraphTraceLen)
1694 {
1695 if (GraphBuffer[i-1] > GraphBuffer[i]) dir=0;
1696 else dir = 1;
1697 }
1698 }
1699 if(bitidx==255)
1700 bitidx=0;
1701 warnings = 0;
1702 if(num_blocks == 4) break;
1703 }
1704 memcpy(outBlocks, Blocks, 16*num_blocks);
1705 return num_blocks;
1706 }
1707
1708 int IsBlock0PCF7931(uint8_t *Block) {
1709 // Assume RFU means 0 :)
1710 if((memcmp(Block, "\x00\x00\x00\x00\x00\x00\x00\x01", 8) == 0) && memcmp(Block+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) // PAC enabled
1711 return 1;
1712 if((memcmp(Block+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) && Block[7] == 0) // PAC disabled, can it *really* happen ?
1713 return 1;
1714 return 0;
1715 }
1716
1717 int IsBlock1PCF7931(uint8_t *Block) {
1718 // Assume RFU means 0 :)
1719 if(Block[10] == 0 && Block[11] == 0 && Block[12] == 0 && Block[13] == 0)
1720 if((Block[14] & 0x7f) <= 9 && Block[15] <= 9)
1721 return 1;
1722
1723 return 0;
1724 }
1725 #define ALLOC 16
1726
1727 void ReadPCF7931() {
1728 uint8_t Blocks[8][17];
1729 uint8_t tmpBlocks[4][16];
1730 int i, j, ind, ind2, n;
1731 int num_blocks = 0;
1732 int max_blocks = 8;
1733 int ident = 0;
1734 int error = 0;
1735 int tries = 0;
1736
1737 memset(Blocks, 0, 8*17*sizeof(uint8_t));
1738
1739 do {
1740 memset(tmpBlocks, 0, 4*16*sizeof(uint8_t));
1741 n = DemodPCF7931((uint8_t**)tmpBlocks);
1742 if(!n)
1743 error++;
1744 if(error==10 && num_blocks == 0) {
1745 Dbprintf("Error, no tag or bad tag");
1746 return;
1747 }
1748 else if (tries==20 || error==10) {
1749 Dbprintf("Error reading the tag");
1750 Dbprintf("Here is the partial content");
1751 goto end;
1752 }
1753
1754 for(i=0; i<n; i++)
1755 Dbprintf("(dbg) %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
1756 tmpBlocks[i][0], tmpBlocks[i][1], tmpBlocks[i][2], tmpBlocks[i][3], tmpBlocks[i][4], tmpBlocks[i][5], tmpBlocks[i][6], tmpBlocks[i][7],
1757 tmpBlocks[i][8], tmpBlocks[i][9], tmpBlocks[i][10], tmpBlocks[i][11], tmpBlocks[i][12], tmpBlocks[i][13], tmpBlocks[i][14], tmpBlocks[i][15]);
1758 if(!ident) {
1759 for(i=0; i<n; i++) {
1760 if(IsBlock0PCF7931(tmpBlocks[i])) {
1761 // Found block 0 ?
1762 if(i < n-1 && IsBlock1PCF7931(tmpBlocks[i+1])) {
1763 // Found block 1!
1764 // \o/
1765 ident = 1;
1766 memcpy(Blocks[0], tmpBlocks[i], 16);
1767 Blocks[0][ALLOC] = 1;
1768 memcpy(Blocks[1], tmpBlocks[i+1], 16);
1769 Blocks[1][ALLOC] = 1;
1770 max_blocks = max((Blocks[1][14] & 0x7f), Blocks[1][15]) + 1;
1771 // Debug print
1772 Dbprintf("(dbg) Max blocks: %d", max_blocks);
1773 num_blocks = 2;
1774 // Handle following blocks
1775 for(j=i+2, ind2=2; j!=i; j++, ind2++, num_blocks++) {
1776 if(j==n) j=0;
1777 if(j==i) break;
1778 memcpy(Blocks[ind2], tmpBlocks[j], 16);
1779 Blocks[ind2][ALLOC] = 1;
1780 }
1781 break;
1782 }
1783 }
1784 }
1785 }
1786 else {
1787 for(i=0; i<n; i++) { // Look for identical block in known blocks
1788 if(memcmp(tmpBlocks[i], "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16)) { // Block is not full of 00
1789 for(j=0; j<max_blocks; j++) {
1790 if(Blocks[j][ALLOC] == 1 && !memcmp(tmpBlocks[i], Blocks[j], 16)) {
1791 // Found an identical block
1792 for(ind=i-1,ind2=j-1; ind >= 0; ind--,ind2--) {
1793 if(ind2 < 0)
1794 ind2 = max_blocks;
1795 if(!Blocks[ind2][ALLOC]) { // Block ind2 not already found
1796 // Dbprintf("Tmp %d -> Block %d", ind, ind2);
1797 memcpy(Blocks[ind2], tmpBlocks[ind], 16);
1798 Blocks[ind2][ALLOC] = 1;
1799 num_blocks++;
1800 if(num_blocks == max_blocks) goto end;
1801 }
1802 }
1803 for(ind=i+1,ind2=j+1; ind < n; ind++,ind2++) {
1804 if(ind2 > max_blocks)
1805 ind2 = 0;
1806 if(!Blocks[ind2][ALLOC]) { // Block ind2 not already found
1807 // Dbprintf("Tmp %d -> Block %d", ind, ind2);
1808 memcpy(Blocks[ind2], tmpBlocks[ind], 16);
1809 Blocks[ind2][ALLOC] = 1;
1810 num_blocks++;
1811 if(num_blocks == max_blocks) goto end;
1812 }
1813 }
1814 }
1815 }
1816 }
1817 }
1818 }
1819 tries++;
1820 if (BUTTON_PRESS()) return;
1821 } while (num_blocks != max_blocks);
1822 end:
1823 Dbprintf("-----------------------------------------");
1824 Dbprintf("Memory content:");
1825 Dbprintf("-----------------------------------------");
1826 for(i=0; i<max_blocks; i++) {
1827 if(Blocks[i][ALLOC]==1)
1828 Dbprintf("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
1829 Blocks[i][0], Blocks[i][1], Blocks[i][2], Blocks[i][3], Blocks[i][4], Blocks[i][5], Blocks[i][6], Blocks[i][7],
1830 Blocks[i][8], Blocks[i][9], Blocks[i][10], Blocks[i][11], Blocks[i][12], Blocks[i][13], Blocks[i][14], Blocks[i][15]);
1831 else
1832 Dbprintf("<missing block %d>", i);
1833 }
1834 Dbprintf("-----------------------------------------");
1835
1836 return ;
1837 }
1838
1839
1840 //-----------------------------------
1841 // EM4469 / EM4305 routines
1842 //-----------------------------------
1843 #define FWD_CMD_LOGIN 0xC //including the even parity, binary mirrored
1844 #define FWD_CMD_WRITE 0xA
1845 #define FWD_CMD_READ 0x9
1846 #define FWD_CMD_DISABLE 0x5
1847
1848
1849 uint8_t forwardLink_data[64]; //array of forwarded bits
1850 uint8_t * forward_ptr; //ptr for forward message preparation
1851 uint8_t fwd_bit_sz; //forwardlink bit counter
1852 uint8_t * fwd_write_ptr; //forwardlink bit pointer
1853
1854 //====================================================================
1855 // prepares command bits
1856 // see EM4469 spec
1857 //====================================================================
1858 //--------------------------------------------------------------------
1859 uint8_t Prepare_Cmd( uint8_t cmd ) {
1860 //--------------------------------------------------------------------
1861
1862 *forward_ptr++ = 0; //start bit
1863 *forward_ptr++ = 0; //second pause for 4050 code
1864
1865 *forward_ptr++ = cmd;
1866 cmd >>= 1;
1867 *forward_ptr++ = cmd;
1868 cmd >>= 1;
1869 *forward_ptr++ = cmd;
1870 cmd >>= 1;
1871 *forward_ptr++ = cmd;
1872
1873 return 6; //return number of emited bits
1874 }
1875
1876 //====================================================================
1877 // prepares address bits
1878 // see EM4469 spec
1879 //====================================================================
1880
1881 //--------------------------------------------------------------------
1882 uint8_t Prepare_Addr( uint8_t addr ) {
1883 //--------------------------------------------------------------------
1884
1885 register uint8_t line_parity;
1886
1887 uint8_t i;
1888 line_parity = 0;
1889 for(i=0;i<6;i++) {
1890 *forward_ptr++ = addr;
1891 line_parity ^= addr;
1892 addr >>= 1;
1893 }
1894
1895 *forward_ptr++ = (line_parity & 1);
1896
1897 return 7; //return number of emited bits
1898 }
1899
1900 //====================================================================
1901 // prepares data bits intreleaved with parity bits
1902 // see EM4469 spec
1903 //====================================================================
1904
1905 //--------------------------------------------------------------------
1906 uint8_t Prepare_Data( uint16_t data_low, uint16_t data_hi) {
1907 //--------------------------------------------------------------------
1908
1909 register uint8_t line_parity;
1910 register uint8_t column_parity;
1911 register uint8_t i, j;
1912 register uint16_t data;
1913
1914 data = data_low;
1915 column_parity = 0;
1916
1917 for(i=0; i<4; i++) {
1918 line_parity = 0;
1919 for(j=0; j<8; j++) {
1920 line_parity ^= data;
1921 column_parity ^= (data & 1) << j;
1922 *forward_ptr++ = data;
1923 data >>= 1;
1924 }
1925 *forward_ptr++ = line_parity;
1926 if(i == 1)
1927 data = data_hi;
1928 }
1929
1930 for(j=0; j<8; j++) {
1931 *forward_ptr++ = column_parity;
1932 column_parity >>= 1;
1933 }
1934 *forward_ptr = 0;
1935
1936 return 45; //return number of emited bits
1937 }
1938
1939 //====================================================================
1940 // Forward Link send function
1941 // Requires: forwarLink_data filled with valid bits (1 bit per byte)
1942 // fwd_bit_count set with number of bits to be sent
1943 //====================================================================
1944 void SendForward(uint8_t fwd_bit_count) {
1945
1946 fwd_write_ptr = forwardLink_data;
1947 fwd_bit_sz = fwd_bit_count;
1948
1949 LED_D_ON();
1950
1951 //Field on
1952 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1953 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1954 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
1955
1956 // Give it a bit of time for the resonant antenna to settle.
1957 // And for the tag to fully power up
1958 SpinDelay(150);
1959
1960 // force 1st mod pulse (start gap must be longer for 4305)
1961 fwd_bit_sz--; //prepare next bit modulation
1962 fwd_write_ptr++;
1963 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1964 SpinDelayUs(55*8); //55 cycles off (8us each)for 4305
1965 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1966 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on
1967 SpinDelayUs(16*8); //16 cycles on (8us each)
1968
1969 // now start writting
1970 while(fwd_bit_sz-- > 0) { //prepare next bit modulation
1971 if(((*fwd_write_ptr++) & 1) == 1)
1972 SpinDelayUs(32*8); //32 cycles at 125Khz (8us each)
1973 else {
1974 //These timings work for 4469/4269/4305 (with the 55*8 above)
1975 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1976 SpinDelayUs(23*8); //16-4 cycles off (8us each)
1977 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1978 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);//field on
1979 SpinDelayUs(9*8); //16 cycles on (8us each)
1980 }
1981 }
1982 }
1983
1984
1985 void EM4xLogin(uint32_t Password) {
1986
1987 uint8_t fwd_bit_count;
1988
1989 forward_ptr = forwardLink_data;
1990 fwd_bit_count = Prepare_Cmd( FWD_CMD_LOGIN );
1991 fwd_bit_count += Prepare_Data( Password&0xFFFF, Password>>16 );
1992
1993 SendForward(fwd_bit_count);
1994
1995 //Wait for command to complete
1996 SpinDelay(20);
1997
1998 }
1999
2000 void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
2001
2002 uint8_t *dest = get_bigbufptr_recvrespbuf();
2003 uint16_t bufferlength = 12000;
2004 uint32_t i = 0;
2005
2006 // Clear destination buffer before sending the command 0x80 = average.
2007 memset(dest, 0x80, bufferlength);
2008
2009 uint8_t fwd_bit_count;
2010
2011 //If password mode do login
2012 if (PwdMode == 1) EM4xLogin(Pwd);
2013
2014 forward_ptr = forwardLink_data;
2015 fwd_bit_count = Prepare_Cmd( FWD_CMD_READ );
2016 fwd_bit_count += Prepare_Addr( Address );
2017
2018 // Connect the A/D to the peak-detected low-frequency path.
2019 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
2020 // Now set up the SSC to get the ADC samples that are now streaming at us.
2021 FpgaSetupSsc();
2022
2023 SendForward(fwd_bit_count);
2024
2025 // // Turn field on to read the response
2026 // TurnReadLFOn();
2027
2028 // Now do the acquisition
2029 i = 0;
2030 for(;;) {
2031 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
2032 AT91C_BASE_SSC->SSC_THR = 0x43;
2033 }
2034 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
2035 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
2036 ++i;
2037 if (i >= bufferlength) break;
2038 }
2039 }
2040
2041 cmd_send(CMD_ACK,0,0,0,0,0);
2042 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
2043 LED_D_OFF();
2044 }
2045
2046 void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
2047
2048 uint8_t fwd_bit_count;
2049
2050 //If password mode do login
2051 if (PwdMode == 1) EM4xLogin(Pwd);
2052
2053 forward_ptr = forwardLink_data;
2054 fwd_bit_count = Prepare_Cmd( FWD_CMD_WRITE );
2055 fwd_bit_count += Prepare_Addr( Address );
2056 fwd_bit_count += Prepare_Data( Data&0xFFFF, Data>>16 );
2057
2058 SendForward(fwd_bit_count);
2059
2060 //Wait for write to complete
2061 SpinDelay(20);
2062 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
2063 LED_D_OFF();
2064 }
Proxmark3 GIT tracking
Impressum, Datenschutz