]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/legicrf.c
a804ded252cbf4da41fc5bd56bfa49271302192b
[proxmark3-svn] / armsrc / legicrf.c
1 /*
2 * LEGIC RF simulation code
3 *
4 * (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
5 */
6
7 #include <proxmark3.h>
8
9 #include "apps.h"
10 #include "legicrf.h"
11 #include <stdint.h>
12
13 #include "legic_prng.h"
14 #include "crc.h"
15
16 static struct legic_frame {
17 int bits;
18 uint32_t data;
19 } current_frame;
20
21 static crc_t legic_crc;
22
23 AT91PS_TC timer;
24
25 static void setup_timer(void)
26 {
27 /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
28 * this it won't be terribly accurate but should be good enough.
29 */
30 AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
31 timer = AT91C_BASE_TC1;
32 timer->TC_CCR = AT91C_TC_CLKDIS;
33 timer->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3;
34 timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
35
36 /* At TIMER_CLOCK3 (MCK/32) */
37 #define RWD_TIME_1 150 /* RWD_TIME_PAUSE off, 80us on = 100us */
38 #define RWD_TIME_0 90 /* RWD_TIME_PAUSE off, 40us on = 60us */
39 #define RWD_TIME_PAUSE 30 /* 20us */
40 #define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */
41 #define TAG_TIME_BIT 150 /* 100us for every bit */
42 #define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */
43
44 }
45
46 #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz)))
47
48 /* Send a frame in reader mode, the FPGA must have been set up by
49 * LegicRfReader
50 */
51 static void frame_send_rwd(uint32_t data, int bits)
52 {
53 /* Start clock */
54 timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
55 while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
56
57 int i;
58 for(i=0; i<bits; i++) {
59 int starttime = timer->TC_CV;
60 int pause_end = starttime + RWD_TIME_PAUSE, bit_end;
61 int bit = data & 1;
62 data = data >> 1;
63
64 if(bit ^ legic_prng_get_bit()) {
65 bit_end = starttime + RWD_TIME_1;
66 } else {
67 bit_end = starttime + RWD_TIME_0;
68 }
69
70 /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is
71 * RWD_TIME_x, where x is the bit to be transmitted */
72 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
73 while(timer->TC_CV < pause_end) ;
74 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
75 legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */
76
77 while(timer->TC_CV < bit_end) ;
78 }
79
80 {
81 /* One final pause to mark the end of the frame */
82 int pause_end = timer->TC_CV + RWD_TIME_PAUSE;
83 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
84 while(timer->TC_CV < pause_end) ;
85 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
86 }
87
88 /* Reset the timer, to measure time until the start of the tag frame */
89 timer->TC_CCR = AT91C_TC_SWTRG;
90 while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
91 }
92
93 /* Receive a frame from the card in reader emulation mode, the FPGA and
94 * timer must have been set up by LegicRfReader and frame_send_rwd.
95 *
96 * The LEGIC RF protocol from card to reader does not include explicit
97 * frame start/stop information or length information. The reader must
98 * know beforehand how many bits it wants to receive. (Notably: a card
99 * sending a stream of 0-bits is indistinguishable from no card present.)
100 *
101 * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but
102 * I'm not smart enough to use it. Instead I have patched hi_read_tx to output
103 * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look
104 * for edges. Count the edges in each bit interval. If they are approximately
105 * 0 this was a 0-bit, if they are approximately equal to the number of edges
106 * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the
107 * timer that's still running from frame_send_rwd in order to get a synchronization
108 * with the frame that we just sent.
109 *
110 * FIXME: Because we're relying on the hysteresis to just do the right thing
111 * the range is severely reduced (and you'll probably also need a good antenna).
112 * So this should be fixed some time in the future for a proper receiver.
113 */
114 static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt)
115 {
116 uint32_t the_bit = 1; /* Use a bitmask to save on shifts */
117 uint32_t data=0;
118 int i, old_level=0, edges=0;
119 int next_bit_at = TAG_TIME_WAIT;
120
121
122 if(bits > 16)
123 bits = 16;
124
125 AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
126 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
127
128 /* we have some time now, precompute the cipher
129 * since we cannot compute it on the fly while reading */
130 legic_prng_forward(2);
131
132 if(crypt)
133 {
134 for(i=0; i<bits; i++) {
135 data |= legic_prng_get_bit() << i;
136 legic_prng_forward(1);
137 }
138 }
139
140 while(timer->TC_CV < next_bit_at) ;
141
142 next_bit_at += TAG_TIME_BIT;
143
144 for(i=0; i<bits; i++) {
145 edges = 0;
146
147 while(timer->TC_CV < next_bit_at) {
148 int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
149 if(level != old_level)
150 edges++;
151 old_level = level;
152 }
153 next_bit_at += TAG_TIME_BIT;
154
155 if(edges > 20 && edges < 60) { /* expected are 42 edges */
156 data ^= the_bit;
157 }
158
159 the_bit <<= 1;
160 }
161
162 f->data = data;
163 f->bits = bits;
164
165 /* Reset the timer, to synchronize the next frame */
166 timer->TC_CCR = AT91C_TC_SWTRG;
167 while(timer->TC_CV > 1) ; /* Wait till the clock has reset */
168 }
169
170 static void frame_clean(struct legic_frame * const f)
171 {
172 f->data = 0;
173 f->bits = 0;
174 }
175
176 static uint32_t perform_setup_phase_rwd(int iv)
177 {
178
179 /* Switch on carrier and let the tag charge for 1ms */
180 AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
181 SpinDelay(1);
182
183 legic_prng_init(0); /* no keystream yet */
184 frame_send_rwd(iv, 7);
185 legic_prng_init(iv);
186
187 frame_clean(&current_frame);
188 frame_receive_rwd(&current_frame, 6, 1);
189 legic_prng_forward(1); /* we wait anyways */
190 while(timer->TC_CV < 387) ; /* ~ 258us */
191 frame_send_rwd(0x19, 6);
192
193 return current_frame.data;
194 }
195
196 static void LegicCommonInit(void) {
197 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
198 FpgaSetupSsc();
199 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
200
201 /* Bitbang the transmitter */
202 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
203 AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
204 AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
205
206 setup_timer();
207
208 crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0);
209 }
210
211 static void switch_off_tag_rwd(void)
212 {
213 /* Switch off carrier, make sure tag is reset */
214 AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
215 SpinDelay(10);
216
217 WDT_HIT();
218 }
219 /* calculate crc for a legic command */
220 static int LegicCRC(int byte_index, int value, int cmd_sz) {
221 crc_clear(&legic_crc);
222 crc_update(&legic_crc, 1, 1); /* CMD_READ */
223 crc_update(&legic_crc, byte_index, cmd_sz-1);
224 crc_update(&legic_crc, value, 8);
225 return crc_finish(&legic_crc);
226 }
227
228 int legic_read_byte(int byte_index, int cmd_sz) {
229 int byte;
230
231 legic_prng_forward(4); /* we wait anyways */
232 while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */
233
234 frame_send_rwd(1 | (byte_index << 1), cmd_sz);
235 frame_clean(&current_frame);
236
237 frame_receive_rwd(&current_frame, 12, 1);
238
239 byte = current_frame.data & 0xff;
240 if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) {
241 Dbprintf("!!! crc mismatch: expected %x but got %x !!!", LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz), current_frame.data >> 8);
242 return -1;
243 }
244
245 return byte;
246 }
247
248 /* legic_write_byte() is not included, however it's trivial to implement
249 * and here are some hints on what remains to be done:
250 *
251 * * assemble a write_cmd_frame with crc and send it
252 * * wait until the tag sends back an ACK ('1' bit unencrypted)
253 * * forward the prng based on the timing
254 */
255
256
257 void LegicRfReader(int offset, int bytes) {
258 int byte_index=0, cmd_sz=0, card_sz=0;
259
260 LegicCommonInit();
261
262 memset(BigBuf, 0, 1024);
263
264 DbpString("setting up legic card");
265 uint32_t tag_type = perform_setup_phase_rwd(0x55);
266 switch(tag_type) {
267 case 0x1d:
268 DbpString("MIM 256 card found, reading card ...");
269 cmd_sz = 9;
270 card_sz = 256;
271 break;
272 case 0x3d:
273 DbpString("MIM 1024 card found, reading card ...");
274 cmd_sz = 11;
275 card_sz = 1024;
276 break;
277 default:
278 Dbprintf("Unknown card format: %x",tag_type);
279 switch_off_tag_rwd();
280 return;
281 }
282 if(bytes == -1) {
283 bytes = card_sz;
284 }
285 if(bytes+offset >= card_sz) {
286 bytes = card_sz-offset;
287 }
288
289 switch_off_tag_rwd(); //we lost to mutch time with dprintf
290 perform_setup_phase_rwd(0x55);
291
292 while(byte_index < bytes) {
293 int r = legic_read_byte(byte_index+offset, cmd_sz);
294 if(r == -1) {
295 Dbprintf("aborting");
296 switch_off_tag_rwd();
297 return;
298 }
299 ((uint8_t*)BigBuf)[byte_index] = r;
300 byte_index++;
301 }
302 switch_off_tag_rwd();
303 Dbprintf("Card read, use 'hf legic decode' or 'data hexsamples %d' to view results", (bytes+7) & ~7);
304 }
305
Impressum, Datenschutz