1 //-----------------------------------------------------------------------------
2 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
3 // at your option, any later version. See the LICENSE.txt file for the text of
5 //-----------------------------------------------------------------------------
6 // Miscellaneous routines for low frequency tag operations.
7 // Tags supported here so far are Texas Instruments (TI), HID
8 // Also routines for raw mode reading/simulating of LF waveform
9 //-----------------------------------------------------------------------------
11 #include "proxmark3.h"
18 void AcquireRawAdcSamples125k(int divisor
)
20 if ( (divisor
== 1) || (divisor
< 0) || (divisor
> 255) )
21 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
22 else if (divisor
== 0)
23 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
25 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, divisor
);
27 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
29 // Connect the A/D to the peak-detected low-frequency path.
30 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
32 // Give it a bit of time for the resonant antenna to settle.
35 // Now set up the SSC to get the ADC samples that are now streaming at us.
38 // Now call the acquisition routine
42 // split into two routines so we can avoid timing issues after sending commands //
43 void DoAcquisition125k(void)
45 uint8_t *dest
= (uint8_t *)BigBuf
;
46 int n
= sizeof(BigBuf
);
52 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXRDY
) {
53 AT91C_BASE_SSC
->SSC_THR
= 0x43;
56 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
) {
57 dest
[i
] = (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
63 Dbprintf("buffer samples: %02x %02x %02x %02x %02x %02x %02x %02x ...",
64 dest
[0], dest
[1], dest
[2], dest
[3], dest
[4], dest
[5], dest
[6], dest
[7]);
67 void ModThenAcquireRawAdcSamples125k(int delay_off
, int period_0
, int period_1
, uint8_t *command
)
71 /* Make sure the tag is reset */
72 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
75 // see if 'h' was specified
76 if (command
[strlen((char *) command
) - 1] == 'h')
82 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
84 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
86 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
88 // Give it a bit of time for the resonant antenna to settle.
90 // And a little more time for the tag to fully power up
93 // Now set up the SSC to get the ADC samples that are now streaming at us.
96 // now modulate the reader field
97 while(*command
!= '\0' && *command
!= ' ') {
98 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
100 SpinDelayUs(delay_off
);
102 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
104 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
106 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
108 if(*(command
++) == '0')
109 SpinDelayUs(period_0
);
111 SpinDelayUs(period_1
);
113 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
115 SpinDelayUs(delay_off
);
117 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
119 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
121 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
127 /* blank r/w tag data stream
128 ...0000000000000000 01111111
129 1010101010101010101010101010101010101010101010101010101010101010
132 101010101010101[0]000...
134 [5555fe852c5555555555555555fe0000]
138 // some hardcoded initial params
139 // when we read a TI tag we sample the zerocross line at 2Mhz
140 // TI tags modulate a 1 as 16 cycles of 123.2Khz
141 // TI tags modulate a 0 as 16 cycles of 134.2Khz
142 #define FSAMPLE 2000000
143 #define FREQLO 123200
144 #define FREQHI 134200
146 signed char *dest
= (signed char *)BigBuf
;
147 int n
= sizeof(BigBuf
);
148 // int *dest = GraphBuffer;
149 // int n = GraphTraceLen;
151 // 128 bit shift register [shift3:shift2:shift1:shift0]
152 uint32_t shift3
= 0, shift2
= 0, shift1
= 0, shift0
= 0;
154 int i
, cycles
=0, samples
=0;
155 // how many sample points fit in 16 cycles of each frequency
156 uint32_t sampleslo
= (FSAMPLE
<<4)/FREQLO
, sampleshi
= (FSAMPLE
<<4)/FREQHI
;
157 // when to tell if we're close enough to one freq or another
158 uint32_t threshold
= (sampleslo
- sampleshi
+ 1)>>1;
160 // TI tags charge at 134.2Khz
161 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
163 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
164 // connects to SSP_DIN and the SSP_DOUT logic level controls
165 // whether we're modulating the antenna (high)
166 // or listening to the antenna (low)
167 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU
);
169 // get TI tag data into the buffer
172 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
174 for (i
=0; i
<n
-1; i
++) {
175 // count cycles by looking for lo to hi zero crossings
176 if ( (dest
[i
]<0) && (dest
[i
+1]>0) ) {
178 // after 16 cycles, measure the frequency
181 samples
=i
-samples
; // number of samples in these 16 cycles
183 // TI bits are coming to us lsb first so shift them
184 // right through our 128 bit right shift register
185 shift0
= (shift0
>>1) | (shift1
<< 31);
186 shift1
= (shift1
>>1) | (shift2
<< 31);
187 shift2
= (shift2
>>1) | (shift3
<< 31);
190 // check if the cycles fall close to the number
191 // expected for either the low or high frequency
192 if ( (samples
>(sampleslo
-threshold
)) && (samples
<(sampleslo
+threshold
)) ) {
193 // low frequency represents a 1
195 } else if ( (samples
>(sampleshi
-threshold
)) && (samples
<(sampleshi
+threshold
)) ) {
196 // high frequency represents a 0
198 // probably detected a gay waveform or noise
199 // use this as gaydar or discard shift register and start again
200 shift3
= shift2
= shift1
= shift0
= 0;
204 // for each bit we receive, test if we've detected a valid tag
206 // if we see 17 zeroes followed by 6 ones, we might have a tag
207 // remember the bits are backwards
208 if ( ((shift0
& 0x7fffff) == 0x7e0000) ) {
209 // if start and end bytes match, we have a tag so break out of the loop
210 if ( ((shift0
>>16)&0xff) == ((shift3
>>8)&0xff) ) {
211 cycles
= 0xF0B; //use this as a flag (ugly but whatever)
219 // if flag is set we have a tag
221 DbpString("Info: No valid tag detected.");
223 // put 64 bit data into shift1 and shift0
224 shift0
= (shift0
>>24) | (shift1
<< 8);
225 shift1
= (shift1
>>24) | (shift2
<< 8);
227 // align 16 bit crc into lower half of shift2
228 shift2
= ((shift2
>>24) | (shift3
<< 8)) & 0x0ffff;
230 // if r/w tag, check ident match
231 if ( shift3
&(1<<15) ) {
232 DbpString("Info: TI tag is rewriteable");
233 // only 15 bits compare, last bit of ident is not valid
234 if ( ((shift3
>>16)^shift0
)&0x7fff ) {
235 DbpString("Error: Ident mismatch!");
237 DbpString("Info: TI tag ident is valid");
240 DbpString("Info: TI tag is readonly");
243 // WARNING the order of the bytes in which we calc crc below needs checking
244 // i'm 99% sure the crc algorithm is correct, but it may need to eat the
245 // bytes in reverse or something
249 crc
= update_crc16(crc
, (shift0
)&0xff);
250 crc
= update_crc16(crc
, (shift0
>>8)&0xff);
251 crc
= update_crc16(crc
, (shift0
>>16)&0xff);
252 crc
= update_crc16(crc
, (shift0
>>24)&0xff);
253 crc
= update_crc16(crc
, (shift1
)&0xff);
254 crc
= update_crc16(crc
, (shift1
>>8)&0xff);
255 crc
= update_crc16(crc
, (shift1
>>16)&0xff);
256 crc
= update_crc16(crc
, (shift1
>>24)&0xff);
258 Dbprintf("Info: Tag data: %x%08x, crc=%x",
259 (unsigned int)shift1
, (unsigned int)shift0
, (unsigned int)shift2
& 0xFFFF);
260 if (crc
!= (shift2
&0xffff)) {
261 Dbprintf("Error: CRC mismatch, expected %x", (unsigned int)crc
);
263 DbpString("Info: CRC is good");
268 void WriteTIbyte(uint8_t b
)
272 // modulate 8 bits out to the antenna
276 // stop modulating antenna
283 // stop modulating antenna
293 void AcquireTiType(void)
296 // tag transmission is <20ms, sampling at 2M gives us 40K samples max
297 // each sample is 1 bit stuffed into a uint32_t so we need 1250 uint32_t
298 #define TIBUFLEN 1250
301 memset(BigBuf
,0,sizeof(BigBuf
));
303 // Set up the synchronous serial port
304 AT91C_BASE_PIOA
->PIO_PDR
= GPIO_SSC_DIN
;
305 AT91C_BASE_PIOA
->PIO_ASR
= GPIO_SSC_DIN
;
307 // steal this pin from the SSP and use it to control the modulation
308 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DOUT
;
309 AT91C_BASE_PIOA
->PIO_OER
= GPIO_SSC_DOUT
;
311 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_SWRST
;
312 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_RXEN
| AT91C_SSC_TXEN
;
314 // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long
315 // 48/2 = 24 MHz clock must be divided by 12
316 AT91C_BASE_SSC
->SSC_CMR
= 12;
318 AT91C_BASE_SSC
->SSC_RCMR
= SSC_CLOCK_MODE_SELECT(0);
319 AT91C_BASE_SSC
->SSC_RFMR
= SSC_FRAME_MODE_BITS_IN_WORD(32) | AT91C_SSC_MSBF
;
320 AT91C_BASE_SSC
->SSC_TCMR
= 0;
321 AT91C_BASE_SSC
->SSC_TFMR
= 0;
328 // Charge TI tag for 50ms.
331 // stop modulating antenna and listen
338 if(AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
) {
339 BigBuf
[i
] = AT91C_BASE_SSC
->SSC_RHR
; // store 32 bit values in buffer
340 i
++; if(i
>= TIBUFLEN
) break;
345 // return stolen pin to SSP
346 AT91C_BASE_PIOA
->PIO_PDR
= GPIO_SSC_DOUT
;
347 AT91C_BASE_PIOA
->PIO_ASR
= GPIO_SSC_DIN
| GPIO_SSC_DOUT
;
349 char *dest
= (char *)BigBuf
;
352 for (i
=TIBUFLEN
-1; i
>=0; i
--) {
353 for (j
=0; j
<32; j
++) {
354 if(BigBuf
[i
] & (1 << j
)) {
363 // arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc
364 // if crc provided, it will be written with the data verbatim (even if bogus)
365 // if not provided a valid crc will be computed from the data and written.
366 void WriteTItag(uint32_t idhi
, uint32_t idlo
, uint16_t crc
)
369 crc
= update_crc16(crc
, (idlo
)&0xff);
370 crc
= update_crc16(crc
, (idlo
>>8)&0xff);
371 crc
= update_crc16(crc
, (idlo
>>16)&0xff);
372 crc
= update_crc16(crc
, (idlo
>>24)&0xff);
373 crc
= update_crc16(crc
, (idhi
)&0xff);
374 crc
= update_crc16(crc
, (idhi
>>8)&0xff);
375 crc
= update_crc16(crc
, (idhi
>>16)&0xff);
376 crc
= update_crc16(crc
, (idhi
>>24)&0xff);
378 Dbprintf("Writing to tag: %x%08x, crc=%x",
379 (unsigned int) idhi
, (unsigned int) idlo
, crc
);
381 // TI tags charge at 134.2Khz
382 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
383 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
384 // connects to SSP_DIN and the SSP_DOUT logic level controls
385 // whether we're modulating the antenna (high)
386 // or listening to the antenna (low)
387 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU
);
390 // steal this pin from the SSP and use it to control the modulation
391 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DOUT
;
392 AT91C_BASE_PIOA
->PIO_OER
= GPIO_SSC_DOUT
;
394 // writing algorithm:
395 // a high bit consists of a field off for 1ms and field on for 1ms
396 // a low bit consists of a field off for 0.3ms and field on for 1.7ms
397 // initiate a charge time of 50ms (field on) then immediately start writing bits
398 // start by writing 0xBB (keyword) and 0xEB (password)
399 // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer)
400 // finally end with 0x0300 (write frame)
401 // all data is sent lsb firts
402 // finish with 15ms programming time
406 SpinDelay(50); // charge time
408 WriteTIbyte(0xbb); // keyword
409 WriteTIbyte(0xeb); // password
410 WriteTIbyte( (idlo
)&0xff );
411 WriteTIbyte( (idlo
>>8 )&0xff );
412 WriteTIbyte( (idlo
>>16)&0xff );
413 WriteTIbyte( (idlo
>>24)&0xff );
414 WriteTIbyte( (idhi
)&0xff );
415 WriteTIbyte( (idhi
>>8 )&0xff );
416 WriteTIbyte( (idhi
>>16)&0xff );
417 WriteTIbyte( (idhi
>>24)&0xff ); // data hi to lo
418 WriteTIbyte( (crc
)&0xff ); // crc lo
419 WriteTIbyte( (crc
>>8 )&0xff ); // crc hi
420 WriteTIbyte(0x00); // write frame lo
421 WriteTIbyte(0x03); // write frame hi
423 SpinDelay(50); // programming time
427 // get TI tag data into the buffer
430 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
431 DbpString("Now use tiread to check");
434 void SimulateTagLowFrequency(int period
, int gap
, int ledcontrol
)
437 uint8_t *tab
= (uint8_t *)BigBuf
;
439 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT
);
441 AT91C_BASE_PIOA
->PIO_PER
= GPIO_SSC_DOUT
| GPIO_SSC_CLK
;
443 AT91C_BASE_PIOA
->PIO_OER
= GPIO_SSC_DOUT
;
444 AT91C_BASE_PIOA
->PIO_ODR
= GPIO_SSC_CLK
;
446 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
447 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
451 while(!(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
)) {
453 DbpString("Stopped");
470 while(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_SSC_CLK
) {
472 DbpString("Stopped");
489 #define DEBUG_FRAME_CONTENTS 1
490 void SimulateTagLowFrequencyBidir(int divisor
, int t0
)
494 // compose fc/8 fc/10 waveform
495 static void fc(int c
, int *n
) {
496 uint8_t *dest
= (uint8_t *)BigBuf
;
499 // for when we want an fc8 pattern every 4 logical bits
510 // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
512 for (idx
=0; idx
<6; idx
++) {
524 // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
526 for (idx
=0; idx
<5; idx
++) {
541 // prepare a waveform pattern in the buffer based on the ID given then
542 // simulate a HID tag until the button is pressed
543 void CmdHIDsimTAG(int hi
, int lo
, int ledcontrol
)
547 HID tag bitstream format
548 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
549 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
550 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
551 A fc8 is inserted before every 4 bits
552 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
553 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
557 DbpString("Tags can only have 44 bits.");
561 // special start of frame marker containing invalid bit sequences
562 fc(8, &n
); fc(8, &n
); // invalid
563 fc(8, &n
); fc(10, &n
); // logical 0
564 fc(10, &n
); fc(10, &n
); // invalid
565 fc(8, &n
); fc(10, &n
); // logical 0
568 // manchester encode bits 43 to 32
569 for (i
=11; i
>=0; i
--) {
570 if ((i
%4)==3) fc(0,&n
);
572 fc(10, &n
); fc(8, &n
); // low-high transition
574 fc(8, &n
); fc(10, &n
); // high-low transition
579 // manchester encode bits 31 to 0
580 for (i
=31; i
>=0; i
--) {
581 if ((i
%4)==3) fc(0,&n
);
583 fc(10, &n
); fc(8, &n
); // low-high transition
585 fc(8, &n
); fc(10, &n
); // high-low transition
591 SimulateTagLowFrequency(n
, 0, ledcontrol
);
598 // loop to capture raw HID waveform then FSK demodulate the TAG ID from it
599 void CmdHIDdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
)
601 uint8_t *dest
= (uint8_t *)BigBuf
;
602 int m
=0, n
=0, i
=0, idx
=0, found
=0, lastval
=0;
603 uint32_t hi2
=0, hi
=0, lo
=0;
605 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
606 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
608 // Connect the A/D to the peak-detected low-frequency path.
609 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
611 // Give it a bit of time for the resonant antenna to settle.
614 // Now set up the SSC to get the ADC samples that are now streaming at us.
622 DbpString("Stopped");
632 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
633 AT91C_BASE_SSC
->SSC_THR
= 0x43;
637 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
638 dest
[i
] = (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
639 // we don't care about actual value, only if it's more or less than a
640 // threshold essentially we capture zero crossings for later analysis
641 if(dest
[i
] < 127) dest
[i
] = 0; else dest
[i
] = 1;
653 // sync to first lo-hi transition
654 for( idx
=1; idx
<m
; idx
++) {
655 if (dest
[idx
-1]<dest
[idx
])
661 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
662 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
663 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
664 for( i
=0; idx
<m
; idx
++) {
665 if (dest
[idx
-1]<dest
[idx
]) {
680 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
685 for( idx
=0; idx
<m
; idx
++) {
686 if (dest
[idx
]==lastval
) {
689 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
690 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
691 // swallowed up by rounding
692 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
693 // special start of frame markers use invalid manchester states (no transitions) by using sequences
696 n
=(n
+1)/6; // fc/8 in sets of 6
698 n
=(n
+1)/5; // fc/10 in sets of 5
700 switch (n
) { // stuff appropriate bits in buffer
703 dest
[i
++]=dest
[idx
-1];
706 dest
[i
++]=dest
[idx
-1];
707 dest
[i
++]=dest
[idx
-1];
709 case 3: // 3 bit start of frame markers
710 dest
[i
++]=dest
[idx
-1];
711 dest
[i
++]=dest
[idx
-1];
712 dest
[i
++]=dest
[idx
-1];
714 // When a logic 0 is immediately followed by the start of the next transmisson
715 // (special pattern) a pattern of 4 bit duration lengths is created.
717 dest
[i
++]=dest
[idx
-1];
718 dest
[i
++]=dest
[idx
-1];
719 dest
[i
++]=dest
[idx
-1];
720 dest
[i
++]=dest
[idx
-1];
722 default: // this shouldn't happen, don't stuff any bits
732 // final loop, go over previously decoded manchester data and decode into usable tag ID
733 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
734 for( idx
=0; idx
<m
-6; idx
++) {
735 // search for a start of frame marker
736 if ( dest
[idx
] && dest
[idx
+1] && dest
[idx
+2] && (!dest
[idx
+3]) && (!dest
[idx
+4]) && (!dest
[idx
+5]) )
740 if (found
&& (hi2
|hi
|lo
)) {
742 Dbprintf("TAG ID: %x%08x%08x (%d)",
743 (unsigned int) hi2
, (unsigned int) hi
, (unsigned int) lo
, (unsigned int) (lo
>>1) & 0xFFFF);
746 Dbprintf("TAG ID: %x%08x (%d)",
747 (unsigned int) hi
, (unsigned int) lo
, (unsigned int) (lo
>>1) & 0xFFFF);
749 /* if we're only looking for one tag */
763 if (dest
[idx
] && (!dest
[idx
+1]) ) {
764 hi2
=(hi2
<<1)|(hi
>>31);
767 } else if ( (!dest
[idx
]) && dest
[idx
+1]) {
768 hi2
=(hi2
<<1)|(hi
>>31);
779 if ( dest
[idx
] && dest
[idx
+1] && dest
[idx
+2] && (!dest
[idx
+3]) && (!dest
[idx
+4]) && (!dest
[idx
+5]) )
783 if (found
&& (hi
|lo
)) {
785 Dbprintf("TAG ID: %x%08x%08x (%d)",
786 (unsigned int) hi2
, (unsigned int) hi
, (unsigned int) lo
, (unsigned int) (lo
>>1) & 0xFFFF);
789 Dbprintf("TAG ID: %x%08x (%d)",
790 (unsigned int) hi
, (unsigned int) lo
, (unsigned int) (lo
>>1) & 0xFFFF);
792 /* if we're only looking for one tag */
810 void CmdIOdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
)
812 uint8_t *dest
= (uint8_t *)BigBuf
;
813 int m
=0, n
=0, i
=0, idx
=0, lastval
=0;
815 uint32_t code
=0, code2
=0;
816 //uint32_t hi2=0, hi=0, lo=0;
818 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
819 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
821 // Connect the A/D to the peak-detected low-frequency path.
822 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
824 // Give it a bit of time for the resonant antenna to settle.
827 // Now set up the SSC to get the ADC samples that are now streaming at us.
835 DbpString("Stopped");
845 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_TXRDY
)) {
846 AT91C_BASE_SSC
->SSC_THR
= 0x43;
850 if(AT91C_BASE_SSC
->SSC_SR
& (AT91C_SSC_RXRDY
)) {
851 dest
[i
] = (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
852 // we don't care about actual value, only if it's more or less than a
853 // threshold essentially we capture zero crossings for later analysis
854 if(dest
[i
] < 127) dest
[i
] = 0; else dest
[i
] = 1;
866 // sync to first lo-hi transition
867 for( idx
=1; idx
<m
; idx
++) {
868 if (dest
[idx
-1]<dest
[idx
])
874 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
875 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
876 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
877 for( i
=0; idx
<m
; idx
++) {
878 if (dest
[idx
-1]<dest
[idx
]) {
893 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
898 for( idx
=0; idx
<m
; idx
++) {
899 if (dest
[idx
]==lastval
) {
902 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
903 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
904 // swallowed up by rounding
905 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
906 // special start of frame markers use invalid manchester states (no transitions) by using sequences
909 n
=(n
+1)/7; // fc/8 in sets of 7
911 n
=(n
+1)/6; // fc/10 in sets of 6
913 switch (n
) { // stuff appropriate bits in buffer
916 dest
[i
++]=dest
[idx
-1]^1;
917 //Dbprintf("%d",dest[idx-1]);
920 dest
[i
++]=dest
[idx
-1]^1;
921 dest
[i
++]=dest
[idx
-1]^1;
922 //Dbprintf("%d",dest[idx-1]);
923 //Dbprintf("%d",dest[idx-1]);
925 case 3: // 3 bit start of frame markers
926 for(int j
=0; j
<3; j
++){
927 dest
[i
++]=dest
[idx
-1]^1;
928 // Dbprintf("%d",dest[idx-1]);
932 for(int j
=0; j
<4; j
++){
933 dest
[i
++]=dest
[idx
-1]^1;
934 // Dbprintf("%d",dest[idx-1]);
938 for(int j
=0; j
<5; j
++){
939 dest
[i
++]=dest
[idx
-1]^1;
940 // Dbprintf("%d",dest[idx-1]);
944 for(int j
=0; j
<6; j
++){
945 dest
[i
++]=dest
[idx
-1]^1;
946 // Dbprintf("%d",dest[idx-1]);
950 for(int j
=0; j
<7; j
++){
951 dest
[i
++]=dest
[idx
-1]^1;
952 // Dbprintf("%d",dest[idx-1]);
956 for(int j
=0; j
<8; j
++){
957 dest
[i
++]=dest
[idx
-1]^1;
958 // Dbprintf("%d",dest[idx-1]);
962 for(int j
=0; j
<9; j
++){
963 dest
[i
++]=dest
[idx
-1]^1;
964 // Dbprintf("%d",dest[idx-1]);
968 for(int j
=0; j
<10; j
++){
969 dest
[i
++]=dest
[idx
-1]^1;
970 // Dbprintf("%d",dest[idx-1]);
974 for(int j
=0; j
<11; j
++){
975 dest
[i
++]=dest
[idx
-1]^1;
976 // Dbprintf("%d",dest[idx-1]);
980 for(int j
=0; j
<12; j
++){
981 dest
[i
++]=dest
[idx
-1]^1;
982 // Dbprintf("%d",dest[idx-1]);
985 default: // this shouldn't happen, don't stuff any bits
986 //Dbprintf("%d",dest[idx-1]);
993 /*for(int j=0; j<64;j+=8){
994 Dbprintf("%d%d%d%d%d%d%d%d",dest[j],dest[j+1],dest[j+2],dest[j+3],dest[j+4],dest[j+5],dest[j+6],dest[j+7]);
1000 for( idx
=0; idx
<m
-9; idx
++) {
1001 if ( !(dest
[idx
]) && !(dest
[idx
+1]) && !(dest
[idx
+2]) && !(dest
[idx
+3]) && !(dest
[idx
+4]) && !(dest
[idx
+5]) && !(dest
[idx
+6]) && !(dest
[idx
+7]) && !(dest
[idx
+8])&& (dest
[idx
+9])){
1005 Dbprintf("%d%d%d%d%d%d%d%d",dest
[idx
], dest
[idx
+1], dest
[idx
+2],dest
[idx
+3],dest
[idx
+4],dest
[idx
+5],dest
[idx
+6],dest
[idx
+7]);
1006 Dbprintf("%d%d%d%d%d%d%d%d",dest
[idx
+8], dest
[idx
+9], dest
[idx
+10],dest
[idx
+11],dest
[idx
+12],dest
[idx
+13],dest
[idx
+14],dest
[idx
+15]);
1007 Dbprintf("%d%d%d%d%d%d%d%d",dest
[idx
+16],dest
[idx
+17],dest
[idx
+18],dest
[idx
+19],dest
[idx
+20],dest
[idx
+21],dest
[idx
+22],dest
[idx
+23]);
1008 Dbprintf("%d%d%d%d%d%d%d%d",dest
[idx
+24],dest
[idx
+25],dest
[idx
+26],dest
[idx
+27],dest
[idx
+28],dest
[idx
+29],dest
[idx
+30],dest
[idx
+31]);
1009 Dbprintf("%d%d%d%d%d%d%d%d",dest
[idx
+32],dest
[idx
+33],dest
[idx
+34],dest
[idx
+35],dest
[idx
+36],dest
[idx
+37],dest
[idx
+38],dest
[idx
+39]);
1010 Dbprintf("%d%d%d%d%d%d%d%d",dest
[idx
+40],dest
[idx
+41],dest
[idx
+42],dest
[idx
+43],dest
[idx
+44],dest
[idx
+45],dest
[idx
+46],dest
[idx
+47]);
1011 Dbprintf("%d%d%d%d%d%d%d%d",dest
[idx
+48],dest
[idx
+49],dest
[idx
+50],dest
[idx
+51],dest
[idx
+52],dest
[idx
+53],dest
[idx
+54],dest
[idx
+55]);
1012 Dbprintf("%d%d%d%d%d%d%d%d",dest
[idx
+56],dest
[idx
+57],dest
[idx
+58],dest
[idx
+59],dest
[idx
+60],dest
[idx
+61],dest
[idx
+62],dest
[idx
+63]);
1014 short version
='\x00';
1015 char unknown
='\x00';
1017 for(int j
=14;j
<18;j
++){
1018 //Dbprintf("%d",dest[idx+j]);
1020 if (dest
[idx
+j
]) version
|= 1;
1022 for(int j
=19;j
<27;j
++){
1023 //Dbprintf("%d",dest[idx+j]);
1025 if (dest
[idx
+j
]) unknown
|= 1;
1027 for(int j
=36;j
<45;j
++){
1028 //Dbprintf("%d",dest[idx+j]);
1030 if (dest
[idx
+j
]) number
|= 1;
1032 for(int j
=46;j
<53;j
++){
1033 //Dbprintf("%d",dest[idx+j]);
1035 if (dest
[idx
+j
]) number
|= 1;
1037 for(int j
=0; j
<32; j
++){
1039 if(dest
[idx
+j
]) code
|= 1;
1041 for(int j
=32; j
<64; j
++){
1043 if(dest
[idx
+j
]) code2
|= 1;
1046 Dbprintf("XSF(%02d)%02x:%d (%08x%08x)",version
,unknown
,number
,code
,code2
);
1050 // if we're only looking for one tag
1068 /*------------------------------
1069 * T5555/T5557/T5567 routines
1070 *------------------------------
1073 /* T55x7 configuration register definitions */
1074 #define T55x7_POR_DELAY 0x00000001
1075 #define T55x7_ST_TERMINATOR 0x00000008
1076 #define T55x7_PWD 0x00000010
1077 #define T55x7_MAXBLOCK_SHIFT 5
1078 #define T55x7_AOR 0x00000200
1079 #define T55x7_PSKCF_RF_2 0
1080 #define T55x7_PSKCF_RF_4 0x00000400
1081 #define T55x7_PSKCF_RF_8 0x00000800
1082 #define T55x7_MODULATION_DIRECT 0
1083 #define T55x7_MODULATION_PSK1 0x00001000
1084 #define T55x7_MODULATION_PSK2 0x00002000
1085 #define T55x7_MODULATION_PSK3 0x00003000
1086 #define T55x7_MODULATION_FSK1 0x00004000
1087 #define T55x7_MODULATION_FSK2 0x00005000
1088 #define T55x7_MODULATION_FSK1a 0x00006000
1089 #define T55x7_MODULATION_FSK2a 0x00007000
1090 #define T55x7_MODULATION_MANCHESTER 0x00008000
1091 #define T55x7_MODULATION_BIPHASE 0x00010000
1092 #define T55x7_BITRATE_RF_8 0
1093 #define T55x7_BITRATE_RF_16 0x00040000
1094 #define T55x7_BITRATE_RF_32 0x00080000
1095 #define T55x7_BITRATE_RF_40 0x000C0000
1096 #define T55x7_BITRATE_RF_50 0x00100000
1097 #define T55x7_BITRATE_RF_64 0x00140000
1098 #define T55x7_BITRATE_RF_100 0x00180000
1099 #define T55x7_BITRATE_RF_128 0x001C0000
1101 /* T5555 (Q5) configuration register definitions */
1102 #define T5555_ST_TERMINATOR 0x00000001
1103 #define T5555_MAXBLOCK_SHIFT 0x00000001
1104 #define T5555_MODULATION_MANCHESTER 0
1105 #define T5555_MODULATION_PSK1 0x00000010
1106 #define T5555_MODULATION_PSK2 0x00000020
1107 #define T5555_MODULATION_PSK3 0x00000030
1108 #define T5555_MODULATION_FSK1 0x00000040
1109 #define T5555_MODULATION_FSK2 0x00000050
1110 #define T5555_MODULATION_BIPHASE 0x00000060
1111 #define T5555_MODULATION_DIRECT 0x00000070
1112 #define T5555_INVERT_OUTPUT 0x00000080
1113 #define T5555_PSK_RF_2 0
1114 #define T5555_PSK_RF_4 0x00000100
1115 #define T5555_PSK_RF_8 0x00000200
1116 #define T5555_USE_PWD 0x00000400
1117 #define T5555_USE_AOR 0x00000800
1118 #define T5555_BITRATE_SHIFT 12
1119 #define T5555_FAST_WRITE 0x00004000
1120 #define T5555_PAGE_SELECT 0x00008000
1123 * Relevant times in microsecond
1124 * To compensate antenna falling times shorten the write times
1125 * and enlarge the gap ones.
1127 #define START_GAP 250
1128 #define WRITE_GAP 160
1129 #define WRITE_0 144 // 192
1130 #define WRITE_1 400 // 432 for T55x7; 448 for E5550
1132 // Write one bit to card
1133 void T55xxWriteBit(int bit
)
1135 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1136 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
1138 SpinDelayUs(WRITE_0
);
1140 SpinDelayUs(WRITE_1
);
1141 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1142 SpinDelayUs(WRITE_GAP
);
1145 // Write one card block in page 0, no lock
1146 void T55xxWriteBlock(uint32_t Data
, uint32_t Block
, uint32_t Pwd
, uint8_t PwdMode
)
1150 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1151 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
1153 // Give it a bit of time for the resonant antenna to settle.
1154 // And for the tag to fully power up
1157 // Now start writting
1158 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1159 SpinDelayUs(START_GAP
);
1163 T55xxWriteBit(0); //Page 0
1166 for (i
= 0x80000000; i
!= 0; i
>>= 1)
1167 T55xxWriteBit(Pwd
& i
);
1173 for (i
= 0x80000000; i
!= 0; i
>>= 1)
1174 T55xxWriteBit(Data
& i
);
1177 for (i
= 0x04; i
!= 0; i
>>= 1)
1178 T55xxWriteBit(Block
& i
);
1180 // Now perform write (nominal is 5.6 ms for T55x7 and 18ms for E5550,
1181 // so wait a little more)
1182 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1183 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
1185 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1188 // Read one card block in page 0
1189 void T55xxReadBlock(uint32_t Block
, uint32_t Pwd
, uint8_t PwdMode
)
1191 uint8_t *dest
= (uint8_t *)BigBuf
;
1195 // Clear destination buffer before sending the command
1196 memset(dest
, 128, m
);
1197 // Connect the A/D to the peak-detected low-frequency path.
1198 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
1199 // Now set up the SSC to get the ADC samples that are now streaming at us.
1203 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1204 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
1206 // Give it a bit of time for the resonant antenna to settle.
1207 // And for the tag to fully power up
1210 // Now start writting
1211 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1212 SpinDelayUs(START_GAP
);
1216 T55xxWriteBit(0); //Page 0
1219 for (i
= 0x80000000; i
!= 0; i
>>= 1)
1220 T55xxWriteBit(Pwd
& i
);
1225 for (i
= 0x04; i
!= 0; i
>>= 1)
1226 T55xxWriteBit(Block
& i
);
1228 // Turn field on to read the response
1229 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1230 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
1232 // Now do the acquisition
1235 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXRDY
) {
1236 AT91C_BASE_SSC
->SSC_THR
= 0x43;
1238 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
) {
1239 dest
[i
] = (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1240 // we don't care about actual value, only if it's more or less than a
1241 // threshold essentially we capture zero crossings for later analysis
1242 // if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
1248 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
); // field off
1253 // Read card traceability data (page 1)
1254 void T55xxReadTrace(void){
1255 uint8_t *dest
= (uint8_t *)BigBuf
;
1259 // Clear destination buffer before sending the command
1260 memset(dest
, 128, m
);
1261 // Connect the A/D to the peak-detected low-frequency path.
1262 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
1263 // Now set up the SSC to get the ADC samples that are now streaming at us.
1267 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1268 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
1270 // Give it a bit of time for the resonant antenna to settle.
1271 // And for the tag to fully power up
1274 // Now start writting
1275 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1276 SpinDelayUs(START_GAP
);
1280 T55xxWriteBit(1); //Page 1
1282 // Turn field on to read the response
1283 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1284 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
1286 // Now do the acquisition
1289 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXRDY
) {
1290 AT91C_BASE_SSC
->SSC_THR
= 0x43;
1292 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
) {
1293 dest
[i
] = (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
1299 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
); // field off
1304 /*-------------- Cloning routines -----------*/
1305 // Copy HID id to card and setup block 0 config
1306 void CopyHIDtoT55x7(uint32_t hi2
, uint32_t hi
, uint32_t lo
, uint8_t longFMT
)
1308 int data1
=0, data2
=0, data3
=0, data4
=0, data5
=0, data6
=0; //up to six blocks for long format
1312 // Ensure no more than 84 bits supplied
1314 DbpString("Tags can only have 84 bits.");
1317 // Build the 6 data blocks for supplied 84bit ID
1319 data1
= 0x1D96A900; // load preamble (1D) & long format identifier (9E manchester encoded)
1320 for (int i
=0;i
<4;i
++) {
1321 if (hi2
& (1<<(19-i
)))
1322 data1
|= (1<<(((3-i
)*2)+1)); // 1 -> 10
1324 data1
|= (1<<((3-i
)*2)); // 0 -> 01
1328 for (int i
=0;i
<16;i
++) {
1329 if (hi2
& (1<<(15-i
)))
1330 data2
|= (1<<(((15-i
)*2)+1)); // 1 -> 10
1332 data2
|= (1<<((15-i
)*2)); // 0 -> 01
1336 for (int i
=0;i
<16;i
++) {
1337 if (hi
& (1<<(31-i
)))
1338 data3
|= (1<<(((15-i
)*2)+1)); // 1 -> 10
1340 data3
|= (1<<((15-i
)*2)); // 0 -> 01
1344 for (int i
=0;i
<16;i
++) {
1345 if (hi
& (1<<(15-i
)))
1346 data4
|= (1<<(((15-i
)*2)+1)); // 1 -> 10
1348 data4
|= (1<<((15-i
)*2)); // 0 -> 01
1352 for (int i
=0;i
<16;i
++) {
1353 if (lo
& (1<<(31-i
)))
1354 data5
|= (1<<(((15-i
)*2)+1)); // 1 -> 10
1356 data5
|= (1<<((15-i
)*2)); // 0 -> 01
1360 for (int i
=0;i
<16;i
++) {
1361 if (lo
& (1<<(15-i
)))
1362 data6
|= (1<<(((15-i
)*2)+1)); // 1 -> 10
1364 data6
|= (1<<((15-i
)*2)); // 0 -> 01
1368 // Ensure no more than 44 bits supplied
1370 DbpString("Tags can only have 44 bits.");
1374 // Build the 3 data blocks for supplied 44bit ID
1377 data1
= 0x1D000000; // load preamble
1379 for (int i
=0;i
<12;i
++) {
1380 if (hi
& (1<<(11-i
)))
1381 data1
|= (1<<(((11-i
)*2)+1)); // 1 -> 10
1383 data1
|= (1<<((11-i
)*2)); // 0 -> 01
1387 for (int i
=0;i
<16;i
++) {
1388 if (lo
& (1<<(31-i
)))
1389 data2
|= (1<<(((15-i
)*2)+1)); // 1 -> 10
1391 data2
|= (1<<((15-i
)*2)); // 0 -> 01
1395 for (int i
=0;i
<16;i
++) {
1396 if (lo
& (1<<(15-i
)))
1397 data3
|= (1<<(((15-i
)*2)+1)); // 1 -> 10
1399 data3
|= (1<<((15-i
)*2)); // 0 -> 01
1404 // Program the data blocks for supplied ID
1405 // and the block 0 for HID format
1406 T55xxWriteBlock(data1
,1,0,0);
1407 T55xxWriteBlock(data2
,2,0,0);
1408 T55xxWriteBlock(data3
,3,0,0);
1410 if (longFMT
) { // if long format there are 6 blocks
1411 T55xxWriteBlock(data4
,4,0,0);
1412 T55xxWriteBlock(data5
,5,0,0);
1413 T55xxWriteBlock(data6
,6,0,0);
1416 // Config for HID (RF/50, FSK2a, Maxblock=3 for short/6 for long)
1417 T55xxWriteBlock(T55x7_BITRATE_RF_50
|
1418 T55x7_MODULATION_FSK2a
|
1419 last_block
<< T55x7_MAXBLOCK_SHIFT
,
1427 void CopyIOtoT55x7(uint32_t hi
, uint32_t lo
, uint8_t longFMT
)
1429 int data1
=0, data2
=0; //up to six blocks for long format
1431 data1
= hi
; // load preamble
1435 // Program the data blocks for supplied ID
1436 // and the block 0 for HID format
1437 T55xxWriteBlock(data1
,1,0,0);
1438 T55xxWriteBlock(data2
,2,0,0);
1441 T55xxWriteBlock(0x00147040,0,0,0);
1447 // Define 9bit header for EM410x tags
1448 #define EM410X_HEADER 0x1FF
1449 #define EM410X_ID_LENGTH 40
1451 void WriteEM410x(uint32_t card
, uint32_t id_hi
, uint32_t id_lo
)
1454 uint64_t id
= EM410X_HEADER
;
1455 uint64_t rev_id
= 0; // reversed ID
1456 int c_parity
[4]; // column parity
1457 int r_parity
= 0; // row parity
1460 // Reverse ID bits given as parameter (for simpler operations)
1461 for (i
= 0; i
< EM410X_ID_LENGTH
; ++i
) {
1463 rev_id
= (rev_id
<< 1) | (id_lo
& 1);
1466 rev_id
= (rev_id
<< 1) | (id_hi
& 1);
1471 for (i
= 0; i
< EM410X_ID_LENGTH
; ++i
) {
1472 id_bit
= rev_id
& 1;
1475 // Don't write row parity bit at start of parsing
1477 id
= (id
<< 1) | r_parity
;
1478 // Start counting parity for new row
1485 // First elements in column?
1487 // Fill out first elements
1488 c_parity
[i
] = id_bit
;
1490 // Count column parity
1491 c_parity
[i
% 4] ^= id_bit
;
1494 id
= (id
<< 1) | id_bit
;
1498 // Insert parity bit of last row
1499 id
= (id
<< 1) | r_parity
;
1501 // Fill out column parity at the end of tag
1502 for (i
= 0; i
< 4; ++i
)
1503 id
= (id
<< 1) | c_parity
[i
];
1508 Dbprintf("Started writing %s tag ...", card
? "T55x7":"T5555");
1512 T55xxWriteBlock((uint32_t)(id
>> 32), 1, 0, 0);
1513 T55xxWriteBlock((uint32_t)id
, 2, 0, 0);
1515 // Config for EM410x (RF/64, Manchester, Maxblock=2)
1517 // Clock rate is stored in bits 8-15 of the card value
1518 clock
= (card
& 0xFF00) >> 8;
1519 Dbprintf("Clock rate: %d", clock
);
1523 clock
= T55x7_BITRATE_RF_32
;
1526 clock
= T55x7_BITRATE_RF_16
;
1529 // A value of 0 is assumed to be 64 for backwards-compatibility
1532 clock
= T55x7_BITRATE_RF_64
;
1535 Dbprintf("Invalid clock rate: %d", clock
);
1539 // Writing configuration for T55x7 tag
1540 T55xxWriteBlock(clock
|
1541 T55x7_MODULATION_MANCHESTER
|
1542 2 << T55x7_MAXBLOCK_SHIFT
,
1546 // Writing configuration for T5555(Q5) tag
1547 T55xxWriteBlock(0x1F << T5555_BITRATE_SHIFT
|
1548 T5555_MODULATION_MANCHESTER
|
1549 2 << T5555_MAXBLOCK_SHIFT
,
1553 Dbprintf("Tag %s written with 0x%08x%08x\n", card
? "T55x7":"T5555",
1554 (uint32_t)(id
>> 32), (uint32_t)id
);
1557 // Clone Indala 64-bit tag by UID to T55x7
1558 void CopyIndala64toT55x7(int hi
, int lo
)
1561 //Program the 2 data blocks for supplied 64bit UID
1562 // and the block 0 for Indala64 format
1563 T55xxWriteBlock(hi
,1,0,0);
1564 T55xxWriteBlock(lo
,2,0,0);
1565 //Config for Indala (RF/32;PSK1 with RF/2;Maxblock=2)
1566 T55xxWriteBlock(T55x7_BITRATE_RF_32
|
1567 T55x7_MODULATION_PSK1
|
1568 2 << T55x7_MAXBLOCK_SHIFT
,
1570 //Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data)
1571 // T5567WriteBlock(0x603E1042,0);
1577 void CopyIndala224toT55x7(int uid1
, int uid2
, int uid3
, int uid4
, int uid5
, int uid6
, int uid7
)
1580 //Program the 7 data blocks for supplied 224bit UID
1581 // and the block 0 for Indala224 format
1582 T55xxWriteBlock(uid1
,1,0,0);
1583 T55xxWriteBlock(uid2
,2,0,0);
1584 T55xxWriteBlock(uid3
,3,0,0);
1585 T55xxWriteBlock(uid4
,4,0,0);
1586 T55xxWriteBlock(uid5
,5,0,0);
1587 T55xxWriteBlock(uid6
,6,0,0);
1588 T55xxWriteBlock(uid7
,7,0,0);
1589 //Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7)
1590 T55xxWriteBlock(T55x7_BITRATE_RF_32
|
1591 T55x7_MODULATION_PSK1
|
1592 7 << T55x7_MAXBLOCK_SHIFT
,
1594 //Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data)
1595 // T5567WriteBlock(0x603E10E2,0);
1602 #define abs(x) ( ((x)<0) ? -(x) : (x) )
1603 #define max(x,y) ( x<y ? y:x)
1605 int DemodPCF7931(uint8_t **outBlocks
) {
1606 uint8_t BitStream
[256];
1607 uint8_t Blocks
[8][16];
1608 uint8_t *GraphBuffer
= (uint8_t *)BigBuf
;
1609 int GraphTraceLen
= sizeof(BigBuf
);
1610 int i
, j
, lastval
, bitidx
, half_switch
;
1612 int tolerance
= clock
/ 8;
1613 int pmc
, block_done
;
1614 int lc
, warnings
= 0;
1616 int lmin
=128, lmax
=128;
1619 AcquireRawAdcSamples125k(0);
1626 /* Find first local max/min */
1627 if(GraphBuffer
[1] > GraphBuffer
[0]) {
1628 while(i
< GraphTraceLen
) {
1629 if( !(GraphBuffer
[i
] > GraphBuffer
[i
-1]) && GraphBuffer
[i
] > lmax
)
1636 while(i
< GraphTraceLen
) {
1637 if( !(GraphBuffer
[i
] < GraphBuffer
[i
-1]) && GraphBuffer
[i
] < lmin
)
1649 for (bitidx
= 0; i
< GraphTraceLen
; i
++)
1651 if ( (GraphBuffer
[i
-1] > GraphBuffer
[i
] && dir
== 1 && GraphBuffer
[i
] > lmax
) || (GraphBuffer
[i
-1] < GraphBuffer
[i
] && dir
== 0 && GraphBuffer
[i
] < lmin
))
1656 // Switch depending on lc length:
1657 // Tolerance is 1/8 of clock rate (arbitrary)
1658 if (abs(lc
-clock
/4) < tolerance
) {
1660 if((i
- pmc
) == lc
) { /* 16T0 was previous one */
1662 i
+= (128+127+16+32+33+16)-1;
1670 } else if (abs(lc
-clock
/2) < tolerance
) {
1672 if((i
- pmc
) == lc
) { /* 16T0 was previous one */
1674 i
+= (128+127+16+32+33)-1;
1679 else if(half_switch
== 1) {
1680 BitStream
[bitidx
++] = 0;
1685 } else if (abs(lc
-clock
) < tolerance
) {
1687 BitStream
[bitidx
++] = 1;
1693 Dbprintf("Error: too many detection errors, aborting.");
1698 if(block_done
== 1) {
1700 for(j
=0; j
<16; j
++) {
1701 Blocks
[num_blocks
][j
] = 128*BitStream
[j
*8+7]+
1702 64*BitStream
[j
*8+6]+
1703 32*BitStream
[j
*8+5]+
1704 16*BitStream
[j
*8+4]+
1716 if (GraphBuffer
[i
-1] > GraphBuffer
[i
]) dir
=0;
1722 if(num_blocks
== 4) break;
1724 memcpy(outBlocks
, Blocks
, 16*num_blocks
);
1728 int IsBlock0PCF7931(uint8_t *Block
) {
1729 // Assume RFU means 0 :)
1730 if((memcmp(Block
, "\x00\x00\x00\x00\x00\x00\x00\x01", 8) == 0) && memcmp(Block
+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) // PAC enabled
1732 if((memcmp(Block
+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) && Block
[7] == 0) // PAC disabled, can it *really* happen ?
1737 int IsBlock1PCF7931(uint8_t *Block
) {
1738 // Assume RFU means 0 :)
1739 if(Block
[10] == 0 && Block
[11] == 0 && Block
[12] == 0 && Block
[13] == 0)
1740 if((Block
[14] & 0x7f) <= 9 && Block
[15] <= 9)
1748 void ReadPCF7931() {
1749 uint8_t Blocks
[8][17];
1750 uint8_t tmpBlocks
[4][16];
1751 int i
, j
, ind
, ind2
, n
;
1758 memset(Blocks
, 0, 8*17*sizeof(uint8_t));
1761 memset(tmpBlocks
, 0, 4*16*sizeof(uint8_t));
1762 n
= DemodPCF7931((uint8_t**)tmpBlocks
);
1765 if(error
==10 && num_blocks
== 0) {
1766 Dbprintf("Error, no tag or bad tag");
1769 else if (tries
==20 || error
==10) {
1770 Dbprintf("Error reading the tag");
1771 Dbprintf("Here is the partial content");
1776 Dbprintf("(dbg) %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
1777 tmpBlocks
[i
][0], tmpBlocks
[i
][1], tmpBlocks
[i
][2], tmpBlocks
[i
][3], tmpBlocks
[i
][4], tmpBlocks
[i
][5], tmpBlocks
[i
][6], tmpBlocks
[i
][7],
1778 tmpBlocks
[i
][8], tmpBlocks
[i
][9], tmpBlocks
[i
][10], tmpBlocks
[i
][11], tmpBlocks
[i
][12], tmpBlocks
[i
][13], tmpBlocks
[i
][14], tmpBlocks
[i
][15]);
1780 for(i
=0; i
<n
; i
++) {
1781 if(IsBlock0PCF7931(tmpBlocks
[i
])) {
1783 if(i
< n
-1 && IsBlock1PCF7931(tmpBlocks
[i
+1])) {
1787 memcpy(Blocks
[0], tmpBlocks
[i
], 16);
1788 Blocks
[0][ALLOC
] = 1;
1789 memcpy(Blocks
[1], tmpBlocks
[i
+1], 16);
1790 Blocks
[1][ALLOC
] = 1;
1791 max_blocks
= max((Blocks
[1][14] & 0x7f), Blocks
[1][15]) + 1;
1793 Dbprintf("(dbg) Max blocks: %d", max_blocks
);
1795 // Handle following blocks
1796 for(j
=i
+2, ind2
=2; j
!=i
; j
++, ind2
++, num_blocks
++) {
1799 memcpy(Blocks
[ind2
], tmpBlocks
[j
], 16);
1800 Blocks
[ind2
][ALLOC
] = 1;
1808 for(i
=0; i
<n
; i
++) { // Look for identical block in known blocks
1809 if(memcmp(tmpBlocks
[i
], "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16)) { // Block is not full of 00
1810 for(j
=0; j
<max_blocks
; j
++) {
1811 if(Blocks
[j
][ALLOC
] == 1 && !memcmp(tmpBlocks
[i
], Blocks
[j
], 16)) {
1812 // Found an identical block
1813 for(ind
=i
-1,ind2
=j
-1; ind
>= 0; ind
--,ind2
--) {
1816 if(!Blocks
[ind2
][ALLOC
]) { // Block ind2 not already found
1817 // Dbprintf("Tmp %d -> Block %d", ind, ind2);
1818 memcpy(Blocks
[ind2
], tmpBlocks
[ind
], 16);
1819 Blocks
[ind2
][ALLOC
] = 1;
1821 if(num_blocks
== max_blocks
) goto end
;
1824 for(ind
=i
+1,ind2
=j
+1; ind
< n
; ind
++,ind2
++) {
1825 if(ind2
> max_blocks
)
1827 if(!Blocks
[ind2
][ALLOC
]) { // Block ind2 not already found
1828 // Dbprintf("Tmp %d -> Block %d", ind, ind2);
1829 memcpy(Blocks
[ind2
], tmpBlocks
[ind
], 16);
1830 Blocks
[ind2
][ALLOC
] = 1;
1832 if(num_blocks
== max_blocks
) goto end
;
1841 if (BUTTON_PRESS()) return;
1842 } while (num_blocks
!= max_blocks
);
1844 Dbprintf("-----------------------------------------");
1845 Dbprintf("Memory content:");
1846 Dbprintf("-----------------------------------------");
1847 for(i
=0; i
<max_blocks
; i
++) {
1848 if(Blocks
[i
][ALLOC
]==1)
1849 Dbprintf("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
1850 Blocks
[i
][0], Blocks
[i
][1], Blocks
[i
][2], Blocks
[i
][3], Blocks
[i
][4], Blocks
[i
][5], Blocks
[i
][6], Blocks
[i
][7],
1851 Blocks
[i
][8], Blocks
[i
][9], Blocks
[i
][10], Blocks
[i
][11], Blocks
[i
][12], Blocks
[i
][13], Blocks
[i
][14], Blocks
[i
][15]);
1853 Dbprintf("<missing block %d>", i
);
1855 Dbprintf("-----------------------------------------");
1861 //-----------------------------------
1862 // EM4469 / EM4305 routines
1863 //-----------------------------------
1864 #define FWD_CMD_LOGIN 0xC //including the even parity, binary mirrored
1865 #define FWD_CMD_WRITE 0xA
1866 #define FWD_CMD_READ 0x9
1867 #define FWD_CMD_DISABLE 0x5
1870 uint8_t forwardLink_data
[64]; //array of forwarded bits
1871 uint8_t * forward_ptr
; //ptr for forward message preparation
1872 uint8_t fwd_bit_sz
; //forwardlink bit counter
1873 uint8_t * fwd_write_ptr
; //forwardlink bit pointer
1875 //====================================================================
1876 // prepares command bits
1878 //====================================================================
1879 //--------------------------------------------------------------------
1880 uint8_t Prepare_Cmd( uint8_t cmd
) {
1881 //--------------------------------------------------------------------
1883 *forward_ptr
++ = 0; //start bit
1884 *forward_ptr
++ = 0; //second pause for 4050 code
1886 *forward_ptr
++ = cmd
;
1888 *forward_ptr
++ = cmd
;
1890 *forward_ptr
++ = cmd
;
1892 *forward_ptr
++ = cmd
;
1894 return 6; //return number of emited bits
1897 //====================================================================
1898 // prepares address bits
1900 //====================================================================
1902 //--------------------------------------------------------------------
1903 uint8_t Prepare_Addr( uint8_t addr
) {
1904 //--------------------------------------------------------------------
1906 register uint8_t line_parity
;
1911 *forward_ptr
++ = addr
;
1912 line_parity
^= addr
;
1916 *forward_ptr
++ = (line_parity
& 1);
1918 return 7; //return number of emited bits
1921 //====================================================================
1922 // prepares data bits intreleaved with parity bits
1924 //====================================================================
1926 //--------------------------------------------------------------------
1927 uint8_t Prepare_Data( uint16_t data_low
, uint16_t data_hi
) {
1928 //--------------------------------------------------------------------
1930 register uint8_t line_parity
;
1931 register uint8_t column_parity
;
1932 register uint8_t i
, j
;
1933 register uint16_t data
;
1938 for(i
=0; i
<4; i
++) {
1940 for(j
=0; j
<8; j
++) {
1941 line_parity
^= data
;
1942 column_parity
^= (data
& 1) << j
;
1943 *forward_ptr
++ = data
;
1946 *forward_ptr
++ = line_parity
;
1951 for(j
=0; j
<8; j
++) {
1952 *forward_ptr
++ = column_parity
;
1953 column_parity
>>= 1;
1957 return 45; //return number of emited bits
1960 //====================================================================
1961 // Forward Link send function
1962 // Requires: forwarLink_data filled with valid bits (1 bit per byte)
1963 // fwd_bit_count set with number of bits to be sent
1964 //====================================================================
1965 void SendForward(uint8_t fwd_bit_count
) {
1967 fwd_write_ptr
= forwardLink_data
;
1968 fwd_bit_sz
= fwd_bit_count
;
1973 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1974 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
1976 // Give it a bit of time for the resonant antenna to settle.
1977 // And for the tag to fully power up
1980 // force 1st mod pulse (start gap must be longer for 4305)
1981 fwd_bit_sz
--; //prepare next bit modulation
1983 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
); // field off
1984 SpinDelayUs(55*8); //55 cycles off (8us each)for 4305
1985 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1986 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);//field on
1987 SpinDelayUs(16*8); //16 cycles on (8us each)
1989 // now start writting
1990 while(fwd_bit_sz
-- > 0) { //prepare next bit modulation
1991 if(((*fwd_write_ptr
++) & 1) == 1)
1992 SpinDelayUs(32*8); //32 cycles at 125Khz (8us each)
1994 //These timings work for 4469/4269/4305 (with the 55*8 above)
1995 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
); // field off
1996 SpinDelayUs(23*8); //16-4 cycles off (8us each)
1997 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
1998 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);//field on
1999 SpinDelayUs(9*8); //16 cycles on (8us each)
2004 void EM4xLogin(uint32_t Password
) {
2006 uint8_t fwd_bit_count
;
2008 forward_ptr
= forwardLink_data
;
2009 fwd_bit_count
= Prepare_Cmd( FWD_CMD_LOGIN
);
2010 fwd_bit_count
+= Prepare_Data( Password
&0xFFFF, Password
>>16 );
2012 SendForward(fwd_bit_count
);
2014 //Wait for command to complete
2019 void EM4xReadWord(uint8_t Address
, uint32_t Pwd
, uint8_t PwdMode
) {
2021 uint8_t fwd_bit_count
;
2022 uint8_t *dest
= (uint8_t *)BigBuf
;
2025 //If password mode do login
2026 if (PwdMode
== 1) EM4xLogin(Pwd
);
2028 forward_ptr
= forwardLink_data
;
2029 fwd_bit_count
= Prepare_Cmd( FWD_CMD_READ
);
2030 fwd_bit_count
+= Prepare_Addr( Address
);
2033 // Clear destination buffer before sending the command
2034 memset(dest
, 128, m
);
2035 // Connect the A/D to the peak-detected low-frequency path.
2036 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
2037 // Now set up the SSC to get the ADC samples that are now streaming at us.
2040 SendForward(fwd_bit_count
);
2042 // Now do the acquisition
2045 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_TXRDY
) {
2046 AT91C_BASE_SSC
->SSC_THR
= 0x43;
2048 if (AT91C_BASE_SSC
->SSC_SR
& AT91C_SSC_RXRDY
) {
2049 dest
[i
] = (uint8_t)AT91C_BASE_SSC
->SSC_RHR
;
2054 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
); // field off
2058 void EM4xWriteWord(uint32_t Data
, uint8_t Address
, uint32_t Pwd
, uint8_t PwdMode
) {
2060 uint8_t fwd_bit_count
;
2062 //If password mode do login
2063 if (PwdMode
== 1) EM4xLogin(Pwd
);
2065 forward_ptr
= forwardLink_data
;
2066 fwd_bit_count
= Prepare_Cmd( FWD_CMD_WRITE
);
2067 fwd_bit_count
+= Prepare_Addr( Address
);
2068 fwd_bit_count
+= Prepare_Data( Data
&0xFFFF, Data
>>16 );
2070 SendForward(fwd_bit_count
);
2072 //Wait for write to complete
2074 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
); // field off