git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/legicrf.c

   1 /*
   2  * LEGIC RF simulation code
   3  *
   4  * (c) 2009 Henryk Plötz <henryk@ploetzli.ch>
   5  */
   6
   7 #include <proxmark3.h>
   8
   9 #include "apps.h"
  10 #include "legicrf.h"
  11 #include "unistd.h"
  12 #include "stdint.h"
  13
  14 static struct legic_frame {
  15         int bits;
  16         uint16_t data;
  17 } current_frame;
  18
  19 static struct legic_frame queries[] = {
  20                 {7, 0x55}, /* 1010 101 */
  21 };
  22
  23 static struct legic_frame responses[] = {
  24                 {6, 0x3b}, /* 1101 11 */
  25 };
  26
  27 static void frame_send(uint16_t response, int bits)
  28 {
  29 #if 0
  30         /* Use the SSC to send a response. 8-bit transfers, LSBit first, 100us per bit */
  31 #else
  32         /* Bitbang the response */
  33         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
  34         AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
  35         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
  36
  37         /* Wait for the frame start */
  38         while(AT91C_BASE_TC1->TC_CV < 490) ;
  39
  40         int i;
  41         for(i=0; i<bits; i++) {
  42                 int nextbit = AT91C_BASE_TC1->TC_CV + 150;
  43                 int bit = response & 1;
  44                 response = response >> 1;
  45                 if(bit)
  46                         AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT;
  47                 else
  48                         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
  49                 while(AT91C_BASE_TC1->TC_CV < nextbit) ;
  50         }
  51         AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT;
  52 #endif
  53 }
  54
  55 static void frame_respond(struct legic_frame const * const f)
  56 {
  57         LED_D_ON();
  58         int i;
  59         struct legic_frame *r = NULL;
  60
  61         for(i=0; i<sizeof(queries)/sizeof(queries[0]); i++) {
  62                 if(f->bits == queries[i].bits && f->data == queries[i].data) {
  63                         r = &responses[i];
  64                         break;
  65                 }
  66         }
  67
  68         if(r != NULL) {
  69                 frame_send(r->data, r->bits);
  70                 LED_A_ON();
  71         } else {
  72                 LED_A_OFF();
  73         }
  74
  75         LED_D_OFF();
  76 }
  77
  78 static void frame_append_bit(struct legic_frame * const f, int bit)
  79 {
  80         if(f->bits >= 15)
  81                 return; /* Overflow, won't happen */
  82         f->data |= (bit<<f->bits);
  83         f->bits++;
  84 }
  85
  86 static int frame_is_empty(struct legic_frame const * const f)
  87 {
  88         return( f->bits <= 4 );
  89 }
  90
  91 static void frame_handle(struct legic_frame const * const f)
  92 {
  93         if(f->bits == 6) {
  94                 /* Short path */
  95                 return;
  96         }
  97         if( !frame_is_empty(f) ) {
  98                 frame_respond(f);
  99         }
 100 }
 101
 102 static void frame_clean(struct legic_frame * const f)
 103 {
 104         f->data = 0;
 105         f->bits = 0;
 106 }
 107
 108 static void emit(int bit)
 109 {
 110         if(bit == -1) {
 111                 frame_handle(&current_frame);
 112                 frame_clean(&current_frame);
 113         } else if(bit == 0) {
 114                 frame_append_bit(&current_frame, 0);
 115         } else if(bit == 1) {
 116                 frame_append_bit(&current_frame, 1);
 117         }
 118 }
 119
 120 void LegicRfSimulate(void)
 121 {
 122         /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode,
 123          * modulation mode set to 212kHz subcarrier. We are getting the incoming raw
 124          * envelope waveform on DIN and should send our response on DOUT.
 125          *
 126          * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll
 127          * measure the time between two rising edges on DIN, and no encoding on the
 128          * subcarrier from card to reader, so we'll just shift out our verbatim data
 129          * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear,
 130          * seems to be 300us-ish.
 131          */
 132         SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 133         FpgaSetupSsc();
 134         FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K);
 135
 136         /* Bitbang the receiver */
 137         AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN;
 138         AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN;
 139
 140         /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging
 141          * this it won't be terribly accurate but should be good enough.
 142          */
 143         AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
 144         AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
 145         AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3;
 146         AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 147         int old_level = 0;
 148
 149 /* At TIMER_CLOCK3 (MCK/32) */
 150 #define BIT_TIME_1 150
 151 #define BIT_TIME_0 90
 152 #define BIT_TIME_FUZZ 20
 153
 154         int active = 0;
 155         while(!BUTTON_PRESS()) {
 156                 int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN);
 157                 int time = AT91C_BASE_TC1->TC_CV;
 158
 159                 if(level != old_level) {
 160                         if(level == 1) {
 161                                 AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 162                                 if(time > (BIT_TIME_1-BIT_TIME_FUZZ) && time < (BIT_TIME_1+BIT_TIME_FUZZ)) {
 163                                         /* 1 bit */
 164                                         emit(1);
 165                                         active = 1;
 166                                         LED_B_ON();
 167                                 } else if(time > (BIT_TIME_0-BIT_TIME_FUZZ) && time < (BIT_TIME_0+BIT_TIME_FUZZ)) {
 168                                         /* 0 bit */
 169                                         emit(0);
 170                                         active = 1;
 171                                         LED_B_ON();
 172                                 } else if(active) {
 173                                         /* invalid */
 174                                         emit(-1);
 175                                         active = 0;
 176                                         LED_B_OFF();
 177                                 }
 178                         }
 179                 }
 180
 181                 if(time >= (BIT_TIME_1+BIT_TIME_FUZZ) && active) {
 182                         /* Frame end */
 183                         emit(-1);
 184                         active = 0;
 185                         LED_B_OFF();
 186                 }
 187
 188                 if(time >= (20*BIT_TIME_1) && (AT91C_BASE_TC1->TC_SR & AT91C_TC_CLKSTA)) {
 189                         AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
 190                 }
 191
 192
 193                 old_level = level;
 194                 WDT_HIT();
 195         }
 196 }