]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/lfops.c
a0fa870b62bf7e1e5e4a5dca76682406a8d83f1b
[proxmark3-svn] / armsrc / lfops.c
1 //-----------------------------------------------------------------------------
2 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
3 // at your option, any later version. See the LICENSE.txt file for the text of
4 // the license.
5 //-----------------------------------------------------------------------------
6 // Miscellaneous routines for low frequency tag operations.
7 // Tags supported here so far are Texas Instruments (TI), HID
8 // Also routines for raw mode reading/simulating of LF waveform
9 //-----------------------------------------------------------------------------
10
11 #include "proxmark3.h"
12 #include "apps.h"
13 #include "util.h"
14 #include "hitag2.h"
15 #include "crc16.h"
16 #include "string.h"
17
18 void AcquireRawAdcSamples125k(int divisor)
19 {
20 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
21 if ( (divisor == 1) || (divisor < 0) || (divisor > 255) )
22 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
23 else if (divisor == 0)
24 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
25 else
26 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor);
27
28 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
29
30 // Connect the A/D to the peak-detected low-frequency path.
31 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
32
33 // Give it a bit of time for the resonant antenna to settle.
34 SpinDelay(50);
35
36 // Now set up the SSC to get the ADC samples that are now streaming at us.
37 FpgaSetupSsc();
38
39 // Now call the acquisition routine
40 DoAcquisition125k();
41 }
42
43 // split into two routines so we can avoid timing issues after sending commands //
44 void DoAcquisition125k(void)
45 {
46 uint8_t *dest = (uint8_t *)BigBuf;
47 int n = sizeof(BigBuf);
48 int i;
49
50 memset(dest, 0, n);
51 i = 0;
52 for(;;) {
53 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
54 AT91C_BASE_SSC->SSC_THR = 0x43;
55 LED_D_ON();
56 }
57 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
58 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
59 i++;
60 LED_D_OFF();
61 if (i >= n) break;
62 }
63 }
64 Dbprintf("buffer samples: %02x %02x %02x %02x %02x %02x %02x %02x ...",
65 dest[0], dest[1], dest[2], dest[3], dest[4], dest[5], dest[6], dest[7]);
66 }
67
68 void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, uint8_t *command)
69 {
70 int at134khz;
71
72 /* Make sure the tag is reset */
73 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
74 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
75 SpinDelay(2500);
76
77 // see if 'h' was specified
78 if (command[strlen((char *) command) - 1] == 'h')
79 at134khz = TRUE;
80 else
81 at134khz = FALSE;
82
83 if (at134khz)
84 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
85 else
86 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
87
88 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
89
90 // Give it a bit of time for the resonant antenna to settle.
91 SpinDelay(50);
92 // And a little more time for the tag to fully power up
93 SpinDelay(2000);
94
95 // Now set up the SSC to get the ADC samples that are now streaming at us.
96 FpgaSetupSsc();
97
98 // now modulate the reader field
99 while(*command != '\0' && *command != ' ') {
100 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
101 LED_D_OFF();
102 SpinDelayUs(delay_off);
103 if (at134khz)
104 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
105 else
106 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
107
108 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
109 LED_D_ON();
110 if(*(command++) == '0')
111 SpinDelayUs(period_0);
112 else
113 SpinDelayUs(period_1);
114 }
115 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
116 LED_D_OFF();
117 SpinDelayUs(delay_off);
118 if (at134khz)
119 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
120 else
121 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
122
123 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
124
125 // now do the read
126 DoAcquisition125k();
127 }
128
129 /* blank r/w tag data stream
130 ...0000000000000000 01111111
131 1010101010101010101010101010101010101010101010101010101010101010
132 0011010010100001
133 01111111
134 101010101010101[0]000...
135
136 [5555fe852c5555555555555555fe0000]
137 */
138 void ReadTItag(void)
139 {
140 // some hardcoded initial params
141 // when we read a TI tag we sample the zerocross line at 2Mhz
142 // TI tags modulate a 1 as 16 cycles of 123.2Khz
143 // TI tags modulate a 0 as 16 cycles of 134.2Khz
144 #define FSAMPLE 2000000
145 #define FREQLO 123200
146 #define FREQHI 134200
147
148 signed char *dest = (signed char *)BigBuf;
149 int n = sizeof(BigBuf);
150 // int *dest = GraphBuffer;
151 // int n = GraphTraceLen;
152
153 // 128 bit shift register [shift3:shift2:shift1:shift0]
154 uint32_t shift3 = 0, shift2 = 0, shift1 = 0, shift0 = 0;
155
156 int i, cycles=0, samples=0;
157 // how many sample points fit in 16 cycles of each frequency
158 uint32_t sampleslo = (FSAMPLE<<4)/FREQLO, sampleshi = (FSAMPLE<<4)/FREQHI;
159 // when to tell if we're close enough to one freq or another
160 uint32_t threshold = (sampleslo - sampleshi + 1)>>1;
161
162 // TI tags charge at 134.2Khz
163 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
164 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
165
166 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
167 // connects to SSP_DIN and the SSP_DOUT logic level controls
168 // whether we're modulating the antenna (high)
169 // or listening to the antenna (low)
170 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
171
172 // get TI tag data into the buffer
173 AcquireTiType();
174
175 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
176
177 for (i=0; i<n-1; i++) {
178 // count cycles by looking for lo to hi zero crossings
179 if ( (dest[i]<0) && (dest[i+1]>0) ) {
180 cycles++;
181 // after 16 cycles, measure the frequency
182 if (cycles>15) {
183 cycles=0;
184 samples=i-samples; // number of samples in these 16 cycles
185
186 // TI bits are coming to us lsb first so shift them
187 // right through our 128 bit right shift register
188 shift0 = (shift0>>1) | (shift1 << 31);
189 shift1 = (shift1>>1) | (shift2 << 31);
190 shift2 = (shift2>>1) | (shift3 << 31);
191 shift3 >>= 1;
192
193 // check if the cycles fall close to the number
194 // expected for either the low or high frequency
195 if ( (samples>(sampleslo-threshold)) && (samples<(sampleslo+threshold)) ) {
196 // low frequency represents a 1
197 shift3 |= (1<<31);
198 } else if ( (samples>(sampleshi-threshold)) && (samples<(sampleshi+threshold)) ) {
199 // high frequency represents a 0
200 } else {
201 // probably detected a gay waveform or noise
202 // use this as gaydar or discard shift register and start again
203 shift3 = shift2 = shift1 = shift0 = 0;
204 }
205 samples = i;
206
207 // for each bit we receive, test if we've detected a valid tag
208
209 // if we see 17 zeroes followed by 6 ones, we might have a tag
210 // remember the bits are backwards
211 if ( ((shift0 & 0x7fffff) == 0x7e0000) ) {
212 // if start and end bytes match, we have a tag so break out of the loop
213 if ( ((shift0>>16)&0xff) == ((shift3>>8)&0xff) ) {
214 cycles = 0xF0B; //use this as a flag (ugly but whatever)
215 break;
216 }
217 }
218 }
219 }
220 }
221
222 // if flag is set we have a tag
223 if (cycles!=0xF0B) {
224 DbpString("Info: No valid tag detected.");
225 } else {
226 // put 64 bit data into shift1 and shift0
227 shift0 = (shift0>>24) | (shift1 << 8);
228 shift1 = (shift1>>24) | (shift2 << 8);
229
230 // align 16 bit crc into lower half of shift2
231 shift2 = ((shift2>>24) | (shift3 << 8)) & 0x0ffff;
232
233 // if r/w tag, check ident match
234 if ( shift3&(1<<15) ) {
235 DbpString("Info: TI tag is rewriteable");
236 // only 15 bits compare, last bit of ident is not valid
237 if ( ((shift3>>16)^shift0)&0x7fff ) {
238 DbpString("Error: Ident mismatch!");
239 } else {
240 DbpString("Info: TI tag ident is valid");
241 }
242 } else {
243 DbpString("Info: TI tag is readonly");
244 }
245
246 // WARNING the order of the bytes in which we calc crc below needs checking
247 // i'm 99% sure the crc algorithm is correct, but it may need to eat the
248 // bytes in reverse or something
249 // calculate CRC
250 uint32_t crc=0;
251
252 crc = update_crc16(crc, (shift0)&0xff);
253 crc = update_crc16(crc, (shift0>>8)&0xff);
254 crc = update_crc16(crc, (shift0>>16)&0xff);
255 crc = update_crc16(crc, (shift0>>24)&0xff);
256 crc = update_crc16(crc, (shift1)&0xff);
257 crc = update_crc16(crc, (shift1>>8)&0xff);
258 crc = update_crc16(crc, (shift1>>16)&0xff);
259 crc = update_crc16(crc, (shift1>>24)&0xff);
260
261 Dbprintf("Info: Tag data: %x%08x, crc=%x",
262 (unsigned int)shift1, (unsigned int)shift0, (unsigned int)shift2 & 0xFFFF);
263 if (crc != (shift2&0xffff)) {
264 Dbprintf("Error: CRC mismatch, expected %x", (unsigned int)crc);
265 } else {
266 DbpString("Info: CRC is good");
267 }
268 }
269 }
270
271 void WriteTIbyte(uint8_t b)
272 {
273 int i = 0;
274
275 // modulate 8 bits out to the antenna
276 for (i=0; i<8; i++)
277 {
278 if (b&(1<<i)) {
279 // stop modulating antenna
280 LOW(GPIO_SSC_DOUT);
281 SpinDelayUs(1000);
282 // modulate antenna
283 HIGH(GPIO_SSC_DOUT);
284 SpinDelayUs(1000);
285 } else {
286 // stop modulating antenna
287 LOW(GPIO_SSC_DOUT);
288 SpinDelayUs(300);
289 // modulate antenna
290 HIGH(GPIO_SSC_DOUT);
291 SpinDelayUs(1700);
292 }
293 }
294 }
295
296 void AcquireTiType(void)
297 {
298 int i, j, n;
299 // tag transmission is <20ms, sampling at 2M gives us 40K samples max
300 // each sample is 1 bit stuffed into a uint32_t so we need 1250 uint32_t
301 #define TIBUFLEN 1250
302
303 // clear buffer
304 memset(BigBuf,0,sizeof(BigBuf));
305
306 // Set up the synchronous serial port
307 AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DIN;
308 AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN;
309
310 // steal this pin from the SSP and use it to control the modulation
311 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
312 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
313
314 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_SWRST;
315 AT91C_BASE_SSC->SSC_CR = AT91C_SSC_RXEN | AT91C_SSC_TXEN;
316
317 // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long
318 // 48/2 = 24 MHz clock must be divided by 12
319 AT91C_BASE_SSC->SSC_CMR = 12;
320
321 AT91C_BASE_SSC->SSC_RCMR = SSC_CLOCK_MODE_SELECT(0);
322 AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(32) | AT91C_SSC_MSBF;
323 AT91C_BASE_SSC->SSC_TCMR = 0;
324 AT91C_BASE_SSC->SSC_TFMR = 0;
325
326 LED_D_ON();
327
328 // modulate antenna
329 HIGH(GPIO_SSC_DOUT);
330
331 // Charge TI tag for 50ms.
332 SpinDelay(50);
333
334 // stop modulating antenna and listen
335 LOW(GPIO_SSC_DOUT);
336
337 LED_D_OFF();
338
339 i = 0;
340 for(;;) {
341 if(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
342 BigBuf[i] = AT91C_BASE_SSC->SSC_RHR; // store 32 bit values in buffer
343 i++; if(i >= TIBUFLEN) break;
344 }
345 WDT_HIT();
346 }
347
348 // return stolen pin to SSP
349 AT91C_BASE_PIOA->PIO_PDR = GPIO_SSC_DOUT;
350 AT91C_BASE_PIOA->PIO_ASR = GPIO_SSC_DIN | GPIO_SSC_DOUT;
351
352 char *dest = (char *)BigBuf;
353 n = TIBUFLEN*32;
354 // unpack buffer
355 for (i=TIBUFLEN-1; i>=0; i--) {
356 for (j=0; j<32; j++) {
357 if(BigBuf[i] & (1 << j)) {
358 dest[--n] = 1;
359 } else {
360 dest[--n] = -1;
361 }
362 }
363 }
364 }
365
366 // arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc
367 // if crc provided, it will be written with the data verbatim (even if bogus)
368 // if not provided a valid crc will be computed from the data and written.
369 void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
370 {
371 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
372 if(crc == 0) {
373 crc = update_crc16(crc, (idlo)&0xff);
374 crc = update_crc16(crc, (idlo>>8)&0xff);
375 crc = update_crc16(crc, (idlo>>16)&0xff);
376 crc = update_crc16(crc, (idlo>>24)&0xff);
377 crc = update_crc16(crc, (idhi)&0xff);
378 crc = update_crc16(crc, (idhi>>8)&0xff);
379 crc = update_crc16(crc, (idhi>>16)&0xff);
380 crc = update_crc16(crc, (idhi>>24)&0xff);
381 }
382 Dbprintf("Writing to tag: %x%08x, crc=%x",
383 (unsigned int) idhi, (unsigned int) idlo, crc);
384
385 // TI tags charge at 134.2Khz
386 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
387 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
388 // connects to SSP_DIN and the SSP_DOUT logic level controls
389 // whether we're modulating the antenna (high)
390 // or listening to the antenna (low)
391 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
392 LED_A_ON();
393
394 // steal this pin from the SSP and use it to control the modulation
395 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
396 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
397
398 // writing algorithm:
399 // a high bit consists of a field off for 1ms and field on for 1ms
400 // a low bit consists of a field off for 0.3ms and field on for 1.7ms
401 // initiate a charge time of 50ms (field on) then immediately start writing bits
402 // start by writing 0xBB (keyword) and 0xEB (password)
403 // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer)
404 // finally end with 0x0300 (write frame)
405 // all data is sent lsb firts
406 // finish with 15ms programming time
407
408 // modulate antenna
409 HIGH(GPIO_SSC_DOUT);
410 SpinDelay(50); // charge time
411
412 WriteTIbyte(0xbb); // keyword
413 WriteTIbyte(0xeb); // password
414 WriteTIbyte( (idlo )&0xff );
415 WriteTIbyte( (idlo>>8 )&0xff );
416 WriteTIbyte( (idlo>>16)&0xff );
417 WriteTIbyte( (idlo>>24)&0xff );
418 WriteTIbyte( (idhi )&0xff );
419 WriteTIbyte( (idhi>>8 )&0xff );
420 WriteTIbyte( (idhi>>16)&0xff );
421 WriteTIbyte( (idhi>>24)&0xff ); // data hi to lo
422 WriteTIbyte( (crc )&0xff ); // crc lo
423 WriteTIbyte( (crc>>8 )&0xff ); // crc hi
424 WriteTIbyte(0x00); // write frame lo
425 WriteTIbyte(0x03); // write frame hi
426 HIGH(GPIO_SSC_DOUT);
427 SpinDelay(50); // programming time
428
429 LED_A_OFF();
430
431 // get TI tag data into the buffer
432 AcquireTiType();
433
434 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
435 DbpString("Now use tiread to check");
436 }
437
438 void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
439 {
440 int i;
441 uint8_t *tab = (uint8_t *)BigBuf;
442
443 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
444 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
445
446 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
447
448 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
449 AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
450
451 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
452 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
453
454 i = 0;
455 for(;;) {
456 while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
457 if(BUTTON_PRESS()) {
458 DbpString("Stopped");
459 return;
460 }
461 WDT_HIT();
462 }
463
464 if (ledcontrol)
465 LED_D_ON();
466
467 if(tab[i])
468 OPEN_COIL();
469 else
470 SHORT_COIL();
471
472 if (ledcontrol)
473 LED_D_OFF();
474
475 while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
476 if(BUTTON_PRESS()) {
477 DbpString("Stopped");
478 return;
479 }
480 WDT_HIT();
481 }
482
483 i++;
484 if(i == period) {
485 i = 0;
486 if (gap) {
487 SHORT_COIL();
488 SpinDelayUs(gap);
489 }
490 }
491 }
492 }
493
494 #define DEBUG_FRAME_CONTENTS 1
495 void SimulateTagLowFrequencyBidir(int divisor, int t0)
496 {
497 }
498
499 // compose fc/8 fc/10 waveform
500 static void fc(int c, int *n) {
501 uint8_t *dest = (uint8_t *)BigBuf;
502 int idx;
503
504 // for when we want an fc8 pattern every 4 logical bits
505 if(c==0) {
506 dest[((*n)++)]=1;
507 dest[((*n)++)]=1;
508 dest[((*n)++)]=0;
509 dest[((*n)++)]=0;
510 dest[((*n)++)]=0;
511 dest[((*n)++)]=0;
512 dest[((*n)++)]=0;
513 dest[((*n)++)]=0;
514 }
515 // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
516 if(c==8) {
517 for (idx=0; idx<6; idx++) {
518 dest[((*n)++)]=1;
519 dest[((*n)++)]=1;
520 dest[((*n)++)]=0;
521 dest[((*n)++)]=0;
522 dest[((*n)++)]=0;
523 dest[((*n)++)]=0;
524 dest[((*n)++)]=0;
525 dest[((*n)++)]=0;
526 }
527 }
528
529 // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
530 if(c==10) {
531 for (idx=0; idx<5; idx++) {
532 dest[((*n)++)]=1;
533 dest[((*n)++)]=1;
534 dest[((*n)++)]=1;
535 dest[((*n)++)]=0;
536 dest[((*n)++)]=0;
537 dest[((*n)++)]=0;
538 dest[((*n)++)]=0;
539 dest[((*n)++)]=0;
540 dest[((*n)++)]=0;
541 dest[((*n)++)]=0;
542 }
543 }
544 }
545
546 // prepare a waveform pattern in the buffer based on the ID given then
547 // simulate a HID tag until the button is pressed
548 void CmdHIDsimTAG(int hi, int lo, int ledcontrol)
549 {
550 int n=0, i=0;
551 /*
552 HID tag bitstream format
553 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
554 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
555 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
556 A fc8 is inserted before every 4 bits
557 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
558 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
559 */
560
561 if (hi>0xFFF) {
562 DbpString("Tags can only have 44 bits.");
563 return;
564 }
565 fc(0,&n);
566 // special start of frame marker containing invalid bit sequences
567 fc(8, &n); fc(8, &n); // invalid
568 fc(8, &n); fc(10, &n); // logical 0
569 fc(10, &n); fc(10, &n); // invalid
570 fc(8, &n); fc(10, &n); // logical 0
571
572 WDT_HIT();
573 // manchester encode bits 43 to 32
574 for (i=11; i>=0; i--) {
575 if ((i%4)==3) fc(0,&n);
576 if ((hi>>i)&1) {
577 fc(10, &n); fc(8, &n); // low-high transition
578 } else {
579 fc(8, &n); fc(10, &n); // high-low transition
580 }
581 }
582
583 WDT_HIT();
584 // manchester encode bits 31 to 0
585 for (i=31; i>=0; i--) {
586 if ((i%4)==3) fc(0,&n);
587 if ((lo>>i)&1) {
588 fc(10, &n); fc(8, &n); // low-high transition
589 } else {
590 fc(8, &n); fc(10, &n); // high-low transition
591 }
592 }
593
594 if (ledcontrol)
595 LED_A_ON();
596 SimulateTagLowFrequency(n, 0, ledcontrol);
597
598 if (ledcontrol)
599 LED_A_OFF();
600 }
601
602
603 // loop to capture raw HID waveform then FSK demodulate the TAG ID from it
604 void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
605 {
606 uint8_t *dest = (uint8_t *)BigBuf;
607 int m=0, n=0, i=0, idx=0, found=0, lastval=0;
608 uint32_t hi2=0, hi=0, lo=0;
609
610 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
611 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
612 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
613
614 // Connect the A/D to the peak-detected low-frequency path.
615 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
616
617 // Give it a bit of time for the resonant antenna to settle.
618 SpinDelay(50);
619
620 // Now set up the SSC to get the ADC samples that are now streaming at us.
621 FpgaSetupSsc();
622
623 for(;;) {
624 WDT_HIT();
625 if (ledcontrol)
626 LED_A_ON();
627 if(BUTTON_PRESS()) {
628 DbpString("Stopped");
629 if (ledcontrol)
630 LED_A_OFF();
631 return;
632 }
633
634 i = 0;
635 m = sizeof(BigBuf);
636 memset(dest,128,m);
637 for(;;) {
638 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
639 AT91C_BASE_SSC->SSC_THR = 0x43;
640 if (ledcontrol)
641 LED_D_ON();
642 }
643 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
644 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
645 // we don't care about actual value, only if it's more or less than a
646 // threshold essentially we capture zero crossings for later analysis
647 if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
648 i++;
649 if (ledcontrol)
650 LED_D_OFF();
651 if(i >= m) {
652 break;
653 }
654 }
655 }
656
657 // FSK demodulator
658
659 // sync to first lo-hi transition
660 for( idx=1; idx<m; idx++) {
661 if (dest[idx-1]<dest[idx])
662 lastval=idx;
663 break;
664 }
665 WDT_HIT();
666
667 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
668 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
669 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
670 for( i=0; idx<m; idx++) {
671 if (dest[idx-1]<dest[idx]) {
672 dest[i]=idx-lastval;
673 if (dest[i] <= 8) {
674 dest[i]=1;
675 } else {
676 dest[i]=0;
677 }
678
679 lastval=idx;
680 i++;
681 }
682 }
683 m=i;
684 WDT_HIT();
685
686 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
687 lastval=dest[0];
688 idx=0;
689 i=0;
690 n=0;
691 for( idx=0; idx<m; idx++) {
692 if (dest[idx]==lastval) {
693 n++;
694 } else {
695 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
696 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
697 // swallowed up by rounding
698 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
699 // special start of frame markers use invalid manchester states (no transitions) by using sequences
700 // like 111000
701 if (dest[idx-1]) {
702 n=(n+1)/6; // fc/8 in sets of 6
703 } else {
704 n=(n+1)/5; // fc/10 in sets of 5
705 }
706 switch (n) { // stuff appropriate bits in buffer
707 case 0:
708 case 1: // one bit
709 dest[i++]=dest[idx-1];
710 break;
711 case 2: // two bits
712 dest[i++]=dest[idx-1];
713 dest[i++]=dest[idx-1];
714 break;
715 case 3: // 3 bit start of frame markers
716 dest[i++]=dest[idx-1];
717 dest[i++]=dest[idx-1];
718 dest[i++]=dest[idx-1];
719 break;
720 // When a logic 0 is immediately followed by the start of the next transmisson
721 // (special pattern) a pattern of 4 bit duration lengths is created.
722 case 4:
723 dest[i++]=dest[idx-1];
724 dest[i++]=dest[idx-1];
725 dest[i++]=dest[idx-1];
726 dest[i++]=dest[idx-1];
727 break;
728 default: // this shouldn't happen, don't stuff any bits
729 break;
730 }
731 n=0;
732 lastval=dest[idx];
733 }
734 }
735 m=i;
736 WDT_HIT();
737
738 // final loop, go over previously decoded manchester data and decode into usable tag ID
739 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
740 for( idx=0; idx<m-6; idx++) {
741 // search for a start of frame marker
742 if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
743 {
744 found=1;
745 idx+=6;
746 if (found && (hi2|hi|lo)) {
747 if (hi2 != 0){
748 Dbprintf("TAG ID: %x%08x%08x (%d)",
749 (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
750 }
751 else {
752 Dbprintf("TAG ID: %x%08x (%d)",
753 (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
754 }
755 /* if we're only looking for one tag */
756 if (findone)
757 {
758 *high = hi;
759 *low = lo;
760 return;
761 }
762 hi2=0;
763 hi=0;
764 lo=0;
765 found=0;
766 }
767 }
768 if (found) {
769 if (dest[idx] && (!dest[idx+1]) ) {
770 hi2=(hi2<<1)|(hi>>31);
771 hi=(hi<<1)|(lo>>31);
772 lo=(lo<<1)|0;
773 } else if ( (!dest[idx]) && dest[idx+1]) {
774 hi2=(hi2<<1)|(hi>>31);
775 hi=(hi<<1)|(lo>>31);
776 lo=(lo<<1)|1;
777 } else {
778 found=0;
779 hi2=0;
780 hi=0;
781 lo=0;
782 }
783 idx++;
784 }
785 if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
786 {
787 found=1;
788 idx+=6;
789 if (found && (hi|lo)) {
790 if (hi2 != 0){
791 Dbprintf("TAG ID: %x%08x%08x (%d)",
792 (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
793 }
794 else {
795 Dbprintf("TAG ID: %x%08x (%d)",
796 (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
797 }
798 /* if we're only looking for one tag */
799 if (findone)
800 {
801 *high = hi;
802 *low = lo;
803 return;
804 }
805 hi2=0;
806 hi=0;
807 lo=0;
808 found=0;
809 }
810 }
811 }
812 WDT_HIT();
813 }
814 }
815
816 void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
817 {
818 uint8_t *dest = (uint8_t *)BigBuf;
819 int m=0, n=0, i=0, idx=0, lastval=0;
820 int found=0;
821 uint32_t code=0, code2=0;
822 //uint32_t hi2=0, hi=0, lo=0;
823
824 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
825 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
826 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
827
828 // Connect the A/D to the peak-detected low-frequency path.
829 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
830
831 // Give it a bit of time for the resonant antenna to settle.
832 SpinDelay(50);
833
834 // Now set up the SSC to get the ADC samples that are now streaming at us.
835 FpgaSetupSsc();
836
837 for(;;) {
838 WDT_HIT();
839 if (ledcontrol)
840 LED_A_ON();
841 if(BUTTON_PRESS()) {
842 DbpString("Stopped");
843 if (ledcontrol)
844 LED_A_OFF();
845 return;
846 }
847
848 i = 0;
849 m = sizeof(BigBuf);
850 memset(dest,128,m);
851 for(;;) {
852 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
853 AT91C_BASE_SSC->SSC_THR = 0x43;
854 if (ledcontrol)
855 LED_D_ON();
856 }
857 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
858 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
859 // we don't care about actual value, only if it's more or less than a
860 // threshold essentially we capture zero crossings for later analysis
861 if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
862 i++;
863 if (ledcontrol)
864 LED_D_OFF();
865 if(i >= m) {
866 break;
867 }
868 }
869 }
870
871 // FSK demodulator
872
873 // sync to first lo-hi transition
874 for( idx=1; idx<m; idx++) {
875 if (dest[idx-1]<dest[idx])
876 lastval=idx;
877 break;
878 }
879 WDT_HIT();
880
881 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
882 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
883 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
884 for( i=0; idx<m; idx++) {
885 if (dest[idx-1]<dest[idx]) {
886 dest[i]=idx-lastval;
887 if (dest[i] <= 8) {
888 dest[i]=1;
889 } else {
890 dest[i]=0;
891 }
892
893 lastval=idx;
894 i++;
895 }
896 }
897 m=i;
898 WDT_HIT();
899
900 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
901 lastval=dest[0];
902 idx=0;
903 i=0;
904 n=0;
905 for( idx=0; idx<m; idx++) {
906 if (dest[idx]==lastval) {
907 n++;
908 } else {
909 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
910 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
911 // swallowed up by rounding
912 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
913 // special start of frame markers use invalid manchester states (no transitions) by using sequences
914 // like 111000
915 if (dest[idx-1]) {
916 n=(n+1)/7; // fc/8 in sets of 7
917 } else {
918 n=(n+1)/6; // fc/10 in sets of 6
919 }
920 switch (n) { // stuff appropriate bits in buffer
921 case 0:
922 case 1: // one bit
923 dest[i++]=dest[idx-1]^1;
924 //Dbprintf("%d",dest[idx-1]);
925 break;
926 case 2: // two bits
927 dest[i++]=dest[idx-1]^1;
928 dest[i++]=dest[idx-1]^1;
929 //Dbprintf("%d",dest[idx-1]);
930 //Dbprintf("%d",dest[idx-1]);
931 break;
932 case 3: // 3 bit start of frame markers
933 for(int j=0; j<3; j++){
934 dest[i++]=dest[idx-1]^1;
935 // Dbprintf("%d",dest[idx-1]);
936 }
937 break;
938 case 4:
939 for(int j=0; j<4; j++){
940 dest[i++]=dest[idx-1]^1;
941 // Dbprintf("%d",dest[idx-1]);
942 }
943 break;
944 case 5:
945 for(int j=0; j<5; j++){
946 dest[i++]=dest[idx-1]^1;
947 // Dbprintf("%d",dest[idx-1]);
948 }
949 break;
950 case 6:
951 for(int j=0; j<6; j++){
952 dest[i++]=dest[idx-1]^1;
953 // Dbprintf("%d",dest[idx-1]);
954 }
955 break;
956 case 7:
957 for(int j=0; j<7; j++){
958 dest[i++]=dest[idx-1]^1;
959 // Dbprintf("%d",dest[idx-1]);
960 }
961 break;
962 case 8:
963 for(int j=0; j<8; j++){
964 dest[i++]=dest[idx-1]^1;
965 // Dbprintf("%d",dest[idx-1]);
966 }
967 break;
968 case 9:
969 for(int j=0; j<9; j++){
970 dest[i++]=dest[idx-1]^1;
971 // Dbprintf("%d",dest[idx-1]);
972 }
973 break;
974 case 10:
975 for(int j=0; j<10; j++){
976 dest[i++]=dest[idx-1]^1;
977 // Dbprintf("%d",dest[idx-1]);
978 }
979 break;
980 case 11:
981 for(int j=0; j<11; j++){
982 dest[i++]=dest[idx-1]^1;
983 // Dbprintf("%d",dest[idx-1]);
984 }
985 break;
986 case 12:
987 for(int j=0; j<12; j++){
988 dest[i++]=dest[idx-1]^1;
989 // Dbprintf("%d",dest[idx-1]);
990 }
991 break;
992 default: // this shouldn't happen, don't stuff any bits
993 //Dbprintf("%d",dest[idx-1]);
994 break;
995 }
996 n=0;
997 lastval=dest[idx];
998 }
999 }//end for
1000 /*for(int j=0; j<64;j+=8){
1001 Dbprintf("%d%d%d%d%d%d%d%d",dest[j],dest[j+1],dest[j+2],dest[j+3],dest[j+4],dest[j+5],dest[j+6],dest[j+7]);
1002 }
1003 Dbprintf("\n");*/
1004 m=i;
1005 WDT_HIT();
1006
1007 for( idx=0; idx<m-9; idx++) {
1008 if ( !(dest[idx]) && !(dest[idx+1]) && !(dest[idx+2]) && !(dest[idx+3]) && !(dest[idx+4]) && !(dest[idx+5]) && !(dest[idx+6]) && !(dest[idx+7]) && !(dest[idx+8])&& (dest[idx+9])){
1009 found=1;
1010 //idx+=9;
1011 if (found) {
1012 Dbprintf("%d%d%d%d%d%d%d%d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7]);
1013 Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+8], dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15]);
1014 Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+16],dest[idx+17],dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23]);
1015 Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+24],dest[idx+25],dest[idx+26],dest[idx+27],dest[idx+28],dest[idx+29],dest[idx+30],dest[idx+31]);
1016 Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+32],dest[idx+33],dest[idx+34],dest[idx+35],dest[idx+36],dest[idx+37],dest[idx+38],dest[idx+39]);
1017 Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+40],dest[idx+41],dest[idx+42],dest[idx+43],dest[idx+44],dest[idx+45],dest[idx+46],dest[idx+47]);
1018 Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+48],dest[idx+49],dest[idx+50],dest[idx+51],dest[idx+52],dest[idx+53],dest[idx+54],dest[idx+55]);
1019 Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+56],dest[idx+57],dest[idx+58],dest[idx+59],dest[idx+60],dest[idx+61],dest[idx+62],dest[idx+63]);
1020
1021 short version='\x00';
1022 char unknown='\x00';
1023 uint16_t number=0;
1024 for(int j=14;j<18;j++){
1025 //Dbprintf("%d",dest[idx+j]);
1026 version <<=1;
1027 if (dest[idx+j]) version |= 1;
1028 }
1029 for(int j=19;j<27;j++){
1030 //Dbprintf("%d",dest[idx+j]);
1031 unknown <<=1;
1032 if (dest[idx+j]) unknown |= 1;
1033 }
1034 for(int j=36;j<45;j++){
1035 //Dbprintf("%d",dest[idx+j]);
1036 number <<=1;
1037 if (dest[idx+j]) number |= 1;
1038 }
1039 for(int j=46;j<53;j++){
1040 //Dbprintf("%d",dest[idx+j]);
1041 number <<=1;
1042 if (dest[idx+j]) number |= 1;
1043 }
1044 for(int j=0; j<32; j++){
1045 code <<=1;
1046 if(dest[idx+j]) code |= 1;
1047 }
1048 for(int j=32; j<64; j++){
1049 code2 <<=1;
1050 if(dest[idx+j]) code2 |= 1;
1051 }
1052
1053 Dbprintf("XSF(%02d)%02x:%d (%08x%08x)",version,unknown,number,code,code2);
1054 if (ledcontrol)
1055 LED_D_OFF();
1056 }
1057 // if we're only looking for one tag
1058 if (findone){
1059 //*high = hi;
1060 //*low = lo;
1061 LED_A_OFF();
1062 return;
1063 }
1064
1065 //hi=0;
1066 //lo=0;
1067 found=0;
1068 }
1069
1070 }
1071 }
1072 WDT_HIT();
1073 }
1074
1075 /*------------------------------
1076 * T5555/T5557/T5567 routines
1077 *------------------------------
1078 */
1079
1080 /* T55x7 configuration register definitions */
1081 #define T55x7_POR_DELAY 0x00000001
1082 #define T55x7_ST_TERMINATOR 0x00000008
1083 #define T55x7_PWD 0x00000010
1084 #define T55x7_MAXBLOCK_SHIFT 5
1085 #define T55x7_AOR 0x00000200
1086 #define T55x7_PSKCF_RF_2 0
1087 #define T55x7_PSKCF_RF_4 0x00000400
1088 #define T55x7_PSKCF_RF_8 0x00000800
1089 #define T55x7_MODULATION_DIRECT 0
1090 #define T55x7_MODULATION_PSK1 0x00001000
1091 #define T55x7_MODULATION_PSK2 0x00002000
1092 #define T55x7_MODULATION_PSK3 0x00003000
1093 #define T55x7_MODULATION_FSK1 0x00004000
1094 #define T55x7_MODULATION_FSK2 0x00005000
1095 #define T55x7_MODULATION_FSK1a 0x00006000
1096 #define T55x7_MODULATION_FSK2a 0x00007000
1097 #define T55x7_MODULATION_MANCHESTER 0x00008000
1098 #define T55x7_MODULATION_BIPHASE 0x00010000
1099 #define T55x7_BITRATE_RF_8 0
1100 #define T55x7_BITRATE_RF_16 0x00040000
1101 #define T55x7_BITRATE_RF_32 0x00080000
1102 #define T55x7_BITRATE_RF_40 0x000C0000
1103 #define T55x7_BITRATE_RF_50 0x00100000
1104 #define T55x7_BITRATE_RF_64 0x00140000
1105 #define T55x7_BITRATE_RF_100 0x00180000
1106 #define T55x7_BITRATE_RF_128 0x001C0000
1107
1108 /* T5555 (Q5) configuration register definitions */
1109 #define T5555_ST_TERMINATOR 0x00000001
1110 #define T5555_MAXBLOCK_SHIFT 0x00000001
1111 #define T5555_MODULATION_MANCHESTER 0
1112 #define T5555_MODULATION_PSK1 0x00000010
1113 #define T5555_MODULATION_PSK2 0x00000020
1114 #define T5555_MODULATION_PSK3 0x00000030
1115 #define T5555_MODULATION_FSK1 0x00000040
1116 #define T5555_MODULATION_FSK2 0x00000050
1117 #define T5555_MODULATION_BIPHASE 0x00000060
1118 #define T5555_MODULATION_DIRECT 0x00000070
1119 #define T5555_INVERT_OUTPUT 0x00000080
1120 #define T5555_PSK_RF_2 0
1121 #define T5555_PSK_RF_4 0x00000100
1122 #define T5555_PSK_RF_8 0x00000200
1123 #define T5555_USE_PWD 0x00000400
1124 #define T5555_USE_AOR 0x00000800
1125 #define T5555_BITRATE_SHIFT 12
1126 #define T5555_FAST_WRITE 0x00004000
1127 #define T5555_PAGE_SELECT 0x00008000
1128
1129 /*
1130 * Relevant times in microsecond
1131 * To compensate antenna falling times shorten the write times
1132 * and enlarge the gap ones.
1133 */
1134 #define START_GAP 250
1135 #define WRITE_GAP 160
1136 #define WRITE_0 144 // 192
1137 #define WRITE_1 400 // 432 for T55x7; 448 for E5550
1138
1139 // Write one bit to card
1140 void T55xxWriteBit(int bit)
1141 {
1142 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1143 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1144 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
1145 if (bit == 0)
1146 SpinDelayUs(WRITE_0);
1147 else
1148 SpinDelayUs(WRITE_1);
1149 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1150 SpinDelayUs(WRITE_GAP);
1151 }
1152
1153 // Write one card block in page 0, no lock
1154 void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
1155 {
1156 unsigned int i;
1157
1158 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1159 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1160 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
1161
1162 // Give it a bit of time for the resonant antenna to settle.
1163 // And for the tag to fully power up
1164 SpinDelay(150);
1165
1166 // Now start writting
1167 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1168 SpinDelayUs(START_GAP);
1169
1170 // Opcode
1171 T55xxWriteBit(1);
1172 T55xxWriteBit(0); //Page 0
1173 if (PwdMode == 1){
1174 // Pwd
1175 for (i = 0x80000000; i != 0; i >>= 1)
1176 T55xxWriteBit(Pwd & i);
1177 }
1178 // Lock bit
1179 T55xxWriteBit(0);
1180
1181 // Data
1182 for (i = 0x80000000; i != 0; i >>= 1)
1183 T55xxWriteBit(Data & i);
1184
1185 // Block
1186 for (i = 0x04; i != 0; i >>= 1)
1187 T55xxWriteBit(Block & i);
1188
1189 // Now perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
1190 // so wait a little more)
1191 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1192 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
1193 SpinDelay(20);
1194 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1195 }
1196
1197 // Read one card block in page 0
1198 void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
1199 {
1200 uint8_t *dest = (uint8_t *)BigBuf;
1201 int m=0, i=0;
1202
1203 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1204 m = sizeof(BigBuf);
1205 // Clear destination buffer before sending the command
1206 memset(dest, 128, m);
1207 // Connect the A/D to the peak-detected low-frequency path.
1208 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
1209 // Now set up the SSC to get the ADC samples that are now streaming at us.
1210 FpgaSetupSsc();
1211
1212 LED_D_ON();
1213 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1214 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
1215
1216 // Give it a bit of time for the resonant antenna to settle.
1217 // And for the tag to fully power up
1218 SpinDelay(150);
1219
1220 // Now start writting
1221 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1222 SpinDelayUs(START_GAP);
1223
1224 // Opcode
1225 T55xxWriteBit(1);
1226 T55xxWriteBit(0); //Page 0
1227 if (PwdMode == 1){
1228 // Pwd
1229 for (i = 0x80000000; i != 0; i >>= 1)
1230 T55xxWriteBit(Pwd & i);
1231 }
1232 // Lock bit
1233 T55xxWriteBit(0);
1234 // Block
1235 for (i = 0x04; i != 0; i >>= 1)
1236 T55xxWriteBit(Block & i);
1237
1238 // Turn field on to read the response
1239 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1240 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
1241
1242 // Now do the acquisition
1243 i = 0;
1244 for(;;) {
1245 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
1246 AT91C_BASE_SSC->SSC_THR = 0x43;
1247 }
1248 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
1249 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1250 // we don't care about actual value, only if it's more or less than a
1251 // threshold essentially we capture zero crossings for later analysis
1252 // if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
1253 i++;
1254 if (i >= m) break;
1255 }
1256 }
1257
1258 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1259 LED_D_OFF();
1260 DbpString("DONE!");
1261 }
1262
1263 // Read card traceability data (page 1)
1264 void T55xxReadTrace(void){
1265 uint8_t *dest = (uint8_t *)BigBuf;
1266 int m=0, i=0;
1267
1268 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1269 m = sizeof(BigBuf);
1270 // Clear destination buffer before sending the command
1271 memset(dest, 128, m);
1272 // Connect the A/D to the peak-detected low-frequency path.
1273 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
1274 // Now set up the SSC to get the ADC samples that are now streaming at us.
1275 FpgaSetupSsc();
1276
1277 LED_D_ON();
1278 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1279 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
1280
1281 // Give it a bit of time for the resonant antenna to settle.
1282 // And for the tag to fully power up
1283 SpinDelay(150);
1284
1285 // Now start writting
1286 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1287 SpinDelayUs(START_GAP);
1288
1289 // Opcode
1290 T55xxWriteBit(1);
1291 T55xxWriteBit(1); //Page 1
1292
1293 // Turn field on to read the response
1294 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1295 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
1296
1297 // Now do the acquisition
1298 i = 0;
1299 for(;;) {
1300 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
1301 AT91C_BASE_SSC->SSC_THR = 0x43;
1302 }
1303 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
1304 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1305 i++;
1306 if (i >= m) break;
1307 }
1308 }
1309
1310 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1311 LED_D_OFF();
1312 DbpString("DONE!");
1313 }
1314
1315 /*-------------- Cloning routines -----------*/
1316 // Copy HID id to card and setup block 0 config
1317 void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT)
1318 {
1319 int data1=0, data2=0, data3=0, data4=0, data5=0, data6=0; //up to six blocks for long format
1320 int last_block = 0;
1321
1322 if (longFMT){
1323 // Ensure no more than 84 bits supplied
1324 if (hi2>0xFFFFF) {
1325 DbpString("Tags can only have 84 bits.");
1326 return;
1327 }
1328 // Build the 6 data blocks for supplied 84bit ID
1329 last_block = 6;
1330 data1 = 0x1D96A900; // load preamble (1D) & long format identifier (9E manchester encoded)
1331 for (int i=0;i<4;i++) {
1332 if (hi2 & (1<<(19-i)))
1333 data1 |= (1<<(((3-i)*2)+1)); // 1 -> 10
1334 else
1335 data1 |= (1<<((3-i)*2)); // 0 -> 01
1336 }
1337
1338 data2 = 0;
1339 for (int i=0;i<16;i++) {
1340 if (hi2 & (1<<(15-i)))
1341 data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1342 else
1343 data2 |= (1<<((15-i)*2)); // 0 -> 01
1344 }
1345
1346 data3 = 0;
1347 for (int i=0;i<16;i++) {
1348 if (hi & (1<<(31-i)))
1349 data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1350 else
1351 data3 |= (1<<((15-i)*2)); // 0 -> 01
1352 }
1353
1354 data4 = 0;
1355 for (int i=0;i<16;i++) {
1356 if (hi & (1<<(15-i)))
1357 data4 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1358 else
1359 data4 |= (1<<((15-i)*2)); // 0 -> 01
1360 }
1361
1362 data5 = 0;
1363 for (int i=0;i<16;i++) {
1364 if (lo & (1<<(31-i)))
1365 data5 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1366 else
1367 data5 |= (1<<((15-i)*2)); // 0 -> 01
1368 }
1369
1370 data6 = 0;
1371 for (int i=0;i<16;i++) {
1372 if (lo & (1<<(15-i)))
1373 data6 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1374 else
1375 data6 |= (1<<((15-i)*2)); // 0 -> 01
1376 }
1377 }
1378 else {
1379 // Ensure no more than 44 bits supplied
1380 if (hi>0xFFF) {
1381 DbpString("Tags can only have 44 bits.");
1382 return;
1383 }
1384
1385 // Build the 3 data blocks for supplied 44bit ID
1386 last_block = 3;
1387
1388 data1 = 0x1D000000; // load preamble
1389
1390 for (int i=0;i<12;i++) {
1391 if (hi & (1<<(11-i)))
1392 data1 |= (1<<(((11-i)*2)+1)); // 1 -> 10
1393 else
1394 data1 |= (1<<((11-i)*2)); // 0 -> 01
1395 }
1396
1397 data2 = 0;
1398 for (int i=0;i<16;i++) {
1399 if (lo & (1<<(31-i)))
1400 data2 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1401 else
1402 data2 |= (1<<((15-i)*2)); // 0 -> 01
1403 }
1404
1405 data3 = 0;
1406 for (int i=0;i<16;i++) {
1407 if (lo & (1<<(15-i)))
1408 data3 |= (1<<(((15-i)*2)+1)); // 1 -> 10
1409 else
1410 data3 |= (1<<((15-i)*2)); // 0 -> 01
1411 }
1412 }
1413
1414 LED_D_ON();
1415 // Program the data blocks for supplied ID
1416 // and the block 0 for HID format
1417 T55xxWriteBlock(data1,1,0,0);
1418 T55xxWriteBlock(data2,2,0,0);
1419 T55xxWriteBlock(data3,3,0,0);
1420
1421 if (longFMT) { // if long format there are 6 blocks
1422 T55xxWriteBlock(data4,4,0,0);
1423 T55xxWriteBlock(data5,5,0,0);
1424 T55xxWriteBlock(data6,6,0,0);
1425 }
1426
1427 // Config for HID (RF/50, FSK2a, Maxblock=3 for short/6 for long)
1428 T55xxWriteBlock(T55x7_BITRATE_RF_50 |
1429 T55x7_MODULATION_FSK2a |
1430 last_block << T55x7_MAXBLOCK_SHIFT,
1431 0,0,0);
1432
1433 LED_D_OFF();
1434
1435 DbpString("DONE!");
1436 }
1437
1438 void CopyIOtoT55x7(uint32_t hi, uint32_t lo, uint8_t longFMT)
1439 {
1440 int data1=0, data2=0; //up to six blocks for long format
1441
1442 data1 = hi; // load preamble
1443 data2 = lo;
1444
1445 LED_D_ON();
1446 // Program the data blocks for supplied ID
1447 // and the block 0 for HID format
1448 T55xxWriteBlock(data1,1,0,0);
1449 T55xxWriteBlock(data2,2,0,0);
1450
1451 //Config Block
1452 T55xxWriteBlock(0x00147040,0,0,0);
1453 LED_D_OFF();
1454
1455 DbpString("DONE!");
1456 }
1457
1458 // Define 9bit header for EM410x tags
1459 #define EM410X_HEADER 0x1FF
1460 #define EM410X_ID_LENGTH 40
1461
1462 void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo)
1463 {
1464 int i, id_bit;
1465 uint64_t id = EM410X_HEADER;
1466 uint64_t rev_id = 0; // reversed ID
1467 int c_parity[4]; // column parity
1468 int r_parity = 0; // row parity
1469 uint32_t clock = 0;
1470
1471 // Reverse ID bits given as parameter (for simpler operations)
1472 for (i = 0; i < EM410X_ID_LENGTH; ++i) {
1473 if (i < 32) {
1474 rev_id = (rev_id << 1) | (id_lo & 1);
1475 id_lo >>= 1;
1476 } else {
1477 rev_id = (rev_id << 1) | (id_hi & 1);
1478 id_hi >>= 1;
1479 }
1480 }
1481
1482 for (i = 0; i < EM410X_ID_LENGTH; ++i) {
1483 id_bit = rev_id & 1;
1484
1485 if (i % 4 == 0) {
1486 // Don't write row parity bit at start of parsing
1487 if (i)
1488 id = (id << 1) | r_parity;
1489 // Start counting parity for new row
1490 r_parity = id_bit;
1491 } else {
1492 // Count row parity
1493 r_parity ^= id_bit;
1494 }
1495
1496 // First elements in column?
1497 if (i < 4)
1498 // Fill out first elements
1499 c_parity[i] = id_bit;
1500 else
1501 // Count column parity
1502 c_parity[i % 4] ^= id_bit;
1503
1504 // Insert ID bit
1505 id = (id << 1) | id_bit;
1506 rev_id >>= 1;
1507 }
1508
1509 // Insert parity bit of last row
1510 id = (id << 1) | r_parity;
1511
1512 // Fill out column parity at the end of tag
1513 for (i = 0; i < 4; ++i)
1514 id = (id << 1) | c_parity[i];
1515
1516 // Add stop bit
1517 id <<= 1;
1518
1519 Dbprintf("Started writing %s tag ...", card ? "T55x7":"T5555");
1520 LED_D_ON();
1521
1522 // Write EM410x ID
1523 T55xxWriteBlock((uint32_t)(id >> 32), 1, 0, 0);
1524 T55xxWriteBlock((uint32_t)id, 2, 0, 0);
1525
1526 // Config for EM410x (RF/64, Manchester, Maxblock=2)
1527 if (card) {
1528 // Clock rate is stored in bits 8-15 of the card value
1529 clock = (card & 0xFF00) >> 8;
1530 Dbprintf("Clock rate: %d", clock);
1531 switch (clock)
1532 {
1533 case 32:
1534 clock = T55x7_BITRATE_RF_32;
1535 break;
1536 case 16:
1537 clock = T55x7_BITRATE_RF_16;
1538 break;
1539 case 0:
1540 // A value of 0 is assumed to be 64 for backwards-compatibility
1541 // Fall through...
1542 case 64:
1543 clock = T55x7_BITRATE_RF_64;
1544 break;
1545 default:
1546 Dbprintf("Invalid clock rate: %d", clock);
1547 return;
1548 }
1549
1550 // Writing configuration for T55x7 tag
1551 T55xxWriteBlock(clock |
1552 T55x7_MODULATION_MANCHESTER |
1553 2 << T55x7_MAXBLOCK_SHIFT,
1554 0, 0, 0);
1555 }
1556 else
1557 // Writing configuration for T5555(Q5) tag
1558 T55xxWriteBlock(0x1F << T5555_BITRATE_SHIFT |
1559 T5555_MODULATION_MANCHESTER |
1560 2 << T5555_MAXBLOCK_SHIFT,
1561 0, 0, 0);
1562
1563 LED_D_OFF();
1564 Dbprintf("Tag %s written with 0x%08x%08x\n", card ? "T55x7":"T5555",
1565 (uint32_t)(id >> 32), (uint32_t)id);
1566 }
1567
1568 // Clone Indala 64-bit tag by UID to T55x7
1569 void CopyIndala64toT55x7(int hi, int lo)
1570 {
1571
1572 //Program the 2 data blocks for supplied 64bit UID
1573 // and the block 0 for Indala64 format
1574 T55xxWriteBlock(hi,1,0,0);
1575 T55xxWriteBlock(lo,2,0,0);
1576 //Config for Indala (RF/32;PSK1 with RF/2;Maxblock=2)
1577 T55xxWriteBlock(T55x7_BITRATE_RF_32 |
1578 T55x7_MODULATION_PSK1 |
1579 2 << T55x7_MAXBLOCK_SHIFT,
1580 0, 0, 0);
1581 //Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
1582 // T5567WriteBlock(0x603E1042,0);
1583
1584 DbpString("DONE!");
1585
1586 }
1587
1588 void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int uid6, int uid7)
1589 {
1590
1591 //Program the 7 data blocks for supplied 224bit UID
1592 // and the block 0 for Indala224 format
1593 T55xxWriteBlock(uid1,1,0,0);
1594 T55xxWriteBlock(uid2,2,0,0);
1595 T55xxWriteBlock(uid3,3,0,0);
1596 T55xxWriteBlock(uid4,4,0,0);
1597 T55xxWriteBlock(uid5,5,0,0);
1598 T55xxWriteBlock(uid6,6,0,0);
1599 T55xxWriteBlock(uid7,7,0,0);
1600 //Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
1601 T55xxWriteBlock(T55x7_BITRATE_RF_32 |
1602 T55x7_MODULATION_PSK1 |
1603 7 << T55x7_MAXBLOCK_SHIFT,
1604 0,0,0);
1605 //Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
1606 // T5567WriteBlock(0x603E10E2,0);
1607
1608 DbpString("DONE!");
1609
1610 }
1611
1612
1613 #define abs(x) ( ((x)<0) ? -(x) : (x) )
1614 #define max(x,y) ( x<y ? y:x)
1615
1616 int DemodPCF7931(uint8_t **outBlocks) {
1617 uint8_t BitStream[256];
1618 uint8_t Blocks[8][16];
1619 uint8_t *GraphBuffer = (uint8_t *)BigBuf;
1620 int GraphTraceLen = sizeof(BigBuf);
1621 int i, j, lastval, bitidx, half_switch;
1622 int clock = 64;
1623 int tolerance = clock / 8;
1624 int pmc, block_done;
1625 int lc, warnings = 0;
1626 int num_blocks = 0;
1627 int lmin=128, lmax=128;
1628 uint8_t dir;
1629
1630 AcquireRawAdcSamples125k(0);
1631
1632 lmin = 64;
1633 lmax = 192;
1634
1635 i = 2;
1636
1637 /* Find first local max/min */
1638 if(GraphBuffer[1] > GraphBuffer[0]) {
1639 while(i < GraphTraceLen) {
1640 if( !(GraphBuffer[i] > GraphBuffer[i-1]) && GraphBuffer[i] > lmax)
1641 break;
1642 i++;
1643 }
1644 dir = 0;
1645 }
1646 else {
1647 while(i < GraphTraceLen) {
1648 if( !(GraphBuffer[i] < GraphBuffer[i-1]) && GraphBuffer[i] < lmin)
1649 break;
1650 i++;
1651 }
1652 dir = 1;
1653 }
1654
1655 lastval = i++;
1656 half_switch = 0;
1657 pmc = 0;
1658 block_done = 0;
1659
1660 for (bitidx = 0; i < GraphTraceLen; i++)
1661 {
1662 if ( (GraphBuffer[i-1] > GraphBuffer[i] && dir == 1 && GraphBuffer[i] > lmax) || (GraphBuffer[i-1] < GraphBuffer[i] && dir == 0 && GraphBuffer[i] < lmin))
1663 {
1664 lc = i - lastval;
1665 lastval = i;
1666
1667 // Switch depending on lc length:
1668 // Tolerance is 1/8 of clock rate (arbitrary)
1669 if (abs(lc-clock/4) < tolerance) {
1670 // 16T0
1671 if((i - pmc) == lc) { /* 16T0 was previous one */
1672 /* It's a PMC ! */
1673 i += (128+127+16+32+33+16)-1;
1674 lastval = i;
1675 pmc = 0;
1676 block_done = 1;
1677 }
1678 else {
1679 pmc = i;
1680 }
1681 } else if (abs(lc-clock/2) < tolerance) {
1682 // 32TO
1683 if((i - pmc) == lc) { /* 16T0 was previous one */
1684 /* It's a PMC ! */
1685 i += (128+127+16+32+33)-1;
1686 lastval = i;
1687 pmc = 0;
1688 block_done = 1;
1689 }
1690 else if(half_switch == 1) {
1691 BitStream[bitidx++] = 0;
1692 half_switch = 0;
1693 }
1694 else
1695 half_switch++;
1696 } else if (abs(lc-clock) < tolerance) {
1697 // 64TO
1698 BitStream[bitidx++] = 1;
1699 } else {
1700 // Error
1701 warnings++;
1702 if (warnings > 10)
1703 {
1704 Dbprintf("Error: too many detection errors, aborting.");
1705 return 0;
1706 }
1707 }
1708
1709 if(block_done == 1) {
1710 if(bitidx == 128) {
1711 for(j=0; j<16; j++) {
1712 Blocks[num_blocks][j] = 128*BitStream[j*8+7]+
1713 64*BitStream[j*8+6]+
1714 32*BitStream[j*8+5]+
1715 16*BitStream[j*8+4]+
1716 8*BitStream[j*8+3]+
1717 4*BitStream[j*8+2]+
1718 2*BitStream[j*8+1]+
1719 BitStream[j*8];
1720 }
1721 num_blocks++;
1722 }
1723 bitidx = 0;
1724 block_done = 0;
1725 half_switch = 0;
1726 }
1727 if (GraphBuffer[i-1] > GraphBuffer[i]) dir=0;
1728 else dir = 1;
1729 }
1730 if(bitidx==255)
1731 bitidx=0;
1732 warnings = 0;
1733 if(num_blocks == 4) break;
1734 }
1735 memcpy(outBlocks, Blocks, 16*num_blocks);
1736 return num_blocks;
1737 }
1738
1739 int IsBlock0PCF7931(uint8_t *Block) {
1740 // Assume RFU means 0 :)
1741 if((memcmp(Block, "\x00\x00\x00\x00\x00\x00\x00\x01", 8) == 0) && memcmp(Block+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) // PAC enabled
1742 return 1;
1743 if((memcmp(Block+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) && Block[7] == 0) // PAC disabled, can it *really* happen ?
1744 return 1;
1745 return 0;
1746 }
1747
1748 int IsBlock1PCF7931(uint8_t *Block) {
1749 // Assume RFU means 0 :)
1750 if(Block[10] == 0 && Block[11] == 0 && Block[12] == 0 && Block[13] == 0)
1751 if((Block[14] & 0x7f) <= 9 && Block[15] <= 9)
1752 return 1;
1753
1754 return 0;
1755 }
1756
1757 #define ALLOC 16
1758
1759 void ReadPCF7931() {
1760 uint8_t Blocks[8][17];
1761 uint8_t tmpBlocks[4][16];
1762 int i, j, ind, ind2, n;
1763 int num_blocks = 0;
1764 int max_blocks = 8;
1765 int ident = 0;
1766 int error = 0;
1767 int tries = 0;
1768
1769 memset(Blocks, 0, 8*17*sizeof(uint8_t));
1770
1771 do {
1772 memset(tmpBlocks, 0, 4*16*sizeof(uint8_t));
1773 n = DemodPCF7931((uint8_t**)tmpBlocks);
1774 if(!n)
1775 error++;
1776 if(error==10 && num_blocks == 0) {
1777 Dbprintf("Error, no tag or bad tag");
1778 return;
1779 }
1780 else if (tries==20 || error==10) {
1781 Dbprintf("Error reading the tag");
1782 Dbprintf("Here is the partial content");
1783 goto end;
1784 }
1785
1786 for(i=0; i<n; i++)
1787 Dbprintf("(dbg) %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
1788 tmpBlocks[i][0], tmpBlocks[i][1], tmpBlocks[i][2], tmpBlocks[i][3], tmpBlocks[i][4], tmpBlocks[i][5], tmpBlocks[i][6], tmpBlocks[i][7],
1789 tmpBlocks[i][8], tmpBlocks[i][9], tmpBlocks[i][10], tmpBlocks[i][11], tmpBlocks[i][12], tmpBlocks[i][13], tmpBlocks[i][14], tmpBlocks[i][15]);
1790 if(!ident) {
1791 for(i=0; i<n; i++) {
1792 if(IsBlock0PCF7931(tmpBlocks[i])) {
1793 // Found block 0 ?
1794 if(i < n-1 && IsBlock1PCF7931(tmpBlocks[i+1])) {
1795 // Found block 1!
1796 // \o/
1797 ident = 1;
1798 memcpy(Blocks[0], tmpBlocks[i], 16);
1799 Blocks[0][ALLOC] = 1;
1800 memcpy(Blocks[1], tmpBlocks[i+1], 16);
1801 Blocks[1][ALLOC] = 1;
1802 max_blocks = max((Blocks[1][14] & 0x7f), Blocks[1][15]) + 1;
1803 // Debug print
1804 Dbprintf("(dbg) Max blocks: %d", max_blocks);
1805 num_blocks = 2;
1806 // Handle following blocks
1807 for(j=i+2, ind2=2; j!=i; j++, ind2++, num_blocks++) {
1808 if(j==n) j=0;
1809 if(j==i) break;
1810 memcpy(Blocks[ind2], tmpBlocks[j], 16);
1811 Blocks[ind2][ALLOC] = 1;
1812 }
1813 break;
1814 }
1815 }
1816 }
1817 }
1818 else {
1819 for(i=0; i<n; i++) { // Look for identical block in known blocks
1820 if(memcmp(tmpBlocks[i], "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16)) { // Block is not full of 00
1821 for(j=0; j<max_blocks; j++) {
1822 if(Blocks[j][ALLOC] == 1 && !memcmp(tmpBlocks[i], Blocks[j], 16)) {
1823 // Found an identical block
1824 for(ind=i-1,ind2=j-1; ind >= 0; ind--,ind2--) {
1825 if(ind2 < 0)
1826 ind2 = max_blocks;
1827 if(!Blocks[ind2][ALLOC]) { // Block ind2 not already found
1828 // Dbprintf("Tmp %d -> Block %d", ind, ind2);
1829 memcpy(Blocks[ind2], tmpBlocks[ind], 16);
1830 Blocks[ind2][ALLOC] = 1;
1831 num_blocks++;
1832 if(num_blocks == max_blocks) goto end;
1833 }
1834 }
1835 for(ind=i+1,ind2=j+1; ind < n; ind++,ind2++) {
1836 if(ind2 > max_blocks)
1837 ind2 = 0;
1838 if(!Blocks[ind2][ALLOC]) { // Block ind2 not already found
1839 // Dbprintf("Tmp %d -> Block %d", ind, ind2);
1840 memcpy(Blocks[ind2], tmpBlocks[ind], 16);
1841 Blocks[ind2][ALLOC] = 1;
1842 num_blocks++;
1843 if(num_blocks == max_blocks) goto end;
1844 }
1845 }
1846 }
1847 }
1848 }
1849 }
1850 }
1851 tries++;
1852 if (BUTTON_PRESS()) return;
1853 } while (num_blocks != max_blocks);
1854 end:
1855 Dbprintf("-----------------------------------------");
1856 Dbprintf("Memory content:");
1857 Dbprintf("-----------------------------------------");
1858 for(i=0; i<max_blocks; i++) {
1859 if(Blocks[i][ALLOC]==1)
1860 Dbprintf("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
1861 Blocks[i][0], Blocks[i][1], Blocks[i][2], Blocks[i][3], Blocks[i][4], Blocks[i][5], Blocks[i][6], Blocks[i][7],
1862 Blocks[i][8], Blocks[i][9], Blocks[i][10], Blocks[i][11], Blocks[i][12], Blocks[i][13], Blocks[i][14], Blocks[i][15]);
1863 else
1864 Dbprintf("<missing block %d>", i);
1865 }
1866 Dbprintf("-----------------------------------------");
1867
1868 return ;
1869 }
1870
1871
1872 //-----------------------------------
1873 // EM4469 / EM4305 routines
1874 //-----------------------------------
1875 #define FWD_CMD_LOGIN 0xC //including the even parity, binary mirrored
1876 #define FWD_CMD_WRITE 0xA
1877 #define FWD_CMD_READ 0x9
1878 #define FWD_CMD_DISABLE 0x5
1879
1880
1881 uint8_t forwardLink_data[64]; //array of forwarded bits
1882 uint8_t * forward_ptr; //ptr for forward message preparation
1883 uint8_t fwd_bit_sz; //forwardlink bit counter
1884 uint8_t * fwd_write_ptr; //forwardlink bit pointer
1885
1886 //====================================================================
1887 // prepares command bits
1888 // see EM4469 spec
1889 //====================================================================
1890 //--------------------------------------------------------------------
1891 uint8_t Prepare_Cmd( uint8_t cmd ) {
1892 //--------------------------------------------------------------------
1893
1894 *forward_ptr++ = 0; //start bit
1895 *forward_ptr++ = 0; //second pause for 4050 code
1896
1897 *forward_ptr++ = cmd;
1898 cmd >>= 1;
1899 *forward_ptr++ = cmd;
1900 cmd >>= 1;
1901 *forward_ptr++ = cmd;
1902 cmd >>= 1;
1903 *forward_ptr++ = cmd;
1904
1905 return 6; //return number of emited bits
1906 }
1907
1908 //====================================================================
1909 // prepares address bits
1910 // see EM4469 spec
1911 //====================================================================
1912
1913 //--------------------------------------------------------------------
1914 uint8_t Prepare_Addr( uint8_t addr ) {
1915 //--------------------------------------------------------------------
1916
1917 register uint8_t line_parity;
1918
1919 uint8_t i;
1920 line_parity = 0;
1921 for(i=0;i<6;i++) {
1922 *forward_ptr++ = addr;
1923 line_parity ^= addr;
1924 addr >>= 1;
1925 }
1926
1927 *forward_ptr++ = (line_parity & 1);
1928
1929 return 7; //return number of emited bits
1930 }
1931
1932 //====================================================================
1933 // prepares data bits intreleaved with parity bits
1934 // see EM4469 spec
1935 //====================================================================
1936
1937 //--------------------------------------------------------------------
1938 uint8_t Prepare_Data( uint16_t data_low, uint16_t data_hi) {
1939 //--------------------------------------------------------------------
1940
1941 register uint8_t line_parity;
1942 register uint8_t column_parity;
1943 register uint8_t i, j;
1944 register uint16_t data;
1945
1946 data = data_low;
1947 column_parity = 0;
1948
1949 for(i=0; i<4; i++) {
1950 line_parity = 0;
1951 for(j=0; j<8; j++) {
1952 line_parity ^= data;
1953 column_parity ^= (data & 1) << j;
1954 *forward_ptr++ = data;
1955 data >>= 1;
1956 }
1957 *forward_ptr++ = line_parity;
1958 if(i == 1)
1959 data = data_hi;
1960 }
1961
1962 for(j=0; j<8; j++) {
1963 *forward_ptr++ = column_parity;
1964 column_parity >>= 1;
1965 }
1966 *forward_ptr = 0;
1967
1968 return 45; //return number of emited bits
1969 }
1970
1971 //====================================================================
1972 // Forward Link send function
1973 // Requires: forwarLink_data filled with valid bits (1 bit per byte)
1974 // fwd_bit_count set with number of bits to be sent
1975 //====================================================================
1976 void SendForward(uint8_t fwd_bit_count) {
1977
1978 fwd_write_ptr = forwardLink_data;
1979 fwd_bit_sz = fwd_bit_count;
1980
1981 LED_D_ON();
1982
1983 //Field on
1984 FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
1985 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1986 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
1987
1988 // Give it a bit of time for the resonant antenna to settle.
1989 // And for the tag to fully power up
1990 SpinDelay(150);
1991
1992 // force 1st mod pulse (start gap must be longer for 4305)
1993 fwd_bit_sz--; //prepare next bit modulation
1994 fwd_write_ptr++;
1995 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
1996 SpinDelayUs(55*8); //55 cycles off (8us each)for 4305
1997 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
1998 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);//field on
1999 SpinDelayUs(16*8); //16 cycles on (8us each)
2000
2001 // now start writting
2002 while(fwd_bit_sz-- > 0) { //prepare next bit modulation
2003 if(((*fwd_write_ptr++) & 1) == 1)
2004 SpinDelayUs(32*8); //32 cycles at 125Khz (8us each)
2005 else {
2006 //These timings work for 4469/4269/4305 (with the 55*8 above)
2007 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
2008 SpinDelayUs(23*8); //16-4 cycles off (8us each)
2009 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
2010 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);//field on
2011 SpinDelayUs(9*8); //16 cycles on (8us each)
2012 }
2013 }
2014 }
2015
2016 void EM4xLogin(uint32_t Password) {
2017
2018 uint8_t fwd_bit_count;
2019
2020 forward_ptr = forwardLink_data;
2021 fwd_bit_count = Prepare_Cmd( FWD_CMD_LOGIN );
2022 fwd_bit_count += Prepare_Data( Password&0xFFFF, Password>>16 );
2023
2024 SendForward(fwd_bit_count);
2025
2026 //Wait for command to complete
2027 SpinDelay(20);
2028
2029 }
2030
2031 void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
2032
2033 uint8_t fwd_bit_count;
2034 uint8_t *dest = (uint8_t *)BigBuf;
2035 int m=0, i=0;
2036
2037 //If password mode do login
2038 if (PwdMode == 1) EM4xLogin(Pwd);
2039
2040 forward_ptr = forwardLink_data;
2041 fwd_bit_count = Prepare_Cmd( FWD_CMD_READ );
2042 fwd_bit_count += Prepare_Addr( Address );
2043
2044 m = sizeof(BigBuf);
2045 // Clear destination buffer before sending the command
2046 memset(dest, 128, m);
2047 // Connect the A/D to the peak-detected low-frequency path.
2048 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
2049 // Now set up the SSC to get the ADC samples that are now streaming at us.
2050 FpgaSetupSsc();
2051
2052 SendForward(fwd_bit_count);
2053
2054 // Now do the acquisition
2055 i = 0;
2056 for(;;) {
2057 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
2058 AT91C_BASE_SSC->SSC_THR = 0x43;
2059 }
2060 if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
2061 dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
2062 i++;
2063 if (i >= m) break;
2064 }
2065 }
2066 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
2067 LED_D_OFF();
2068 }
2069
2070 void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
2071
2072 uint8_t fwd_bit_count;
2073
2074 //If password mode do login
2075 if (PwdMode == 1) EM4xLogin(Pwd);
2076
2077 forward_ptr = forwardLink_data;
2078 fwd_bit_count = Prepare_Cmd( FWD_CMD_WRITE );
2079 fwd_bit_count += Prepare_Addr( Address );
2080 fwd_bit_count += Prepare_Data( Data&0xFFFF, Data>>16 );
2081
2082 SendForward(fwd_bit_count);
2083
2084 //Wait for write to complete
2085 SpinDelay(20);
2086 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
2087 LED_D_OFF();
2088 }
Impressum, Datenschutz