/*
// Original Timings for reference
+//note startgap must be sent after tag has been powered up for more than 3ms (per T5557 ds)
#define START_GAP 31*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc)
#define WRITE_GAP 20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc)
#define WRITE_0 18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc)
#define WRITE_1 50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) 432 for T55x7; 448 for E5550
+#define READ_GAP 15*8
*/
/* Q5 timing datasheet:
* Write_0 Fast Mode | 8*8 | 12*8 | 16*8 |
* Write_1 Fast Mode | 24*8 | 28*8 | 32*8 |
*/
-/*
-//note startgap must be sent after tag has been powered up for more than 3ms (per T5557 ds)
-#define START_GAP 31*8 //31*8 // was 250 // SPEC: 1*8 to 50*8 - typ 15*8 (or 15fc) - T5557: 10*8 to 50*8
-#define WRITE_GAP 20*8 //20*8 // was 160 // SPEC: 1*8 to 20*8 - typ 10*8 (or 10fc) - T5557: 8*8 to 30*8 typ 50-150us
-#define WRITE_0 18*8 //18*8 // was 144 // SPEC: 16*8 to 32*8 - typ 24*8 (or 24fc) - T5557: 16*8 to 31*8 typ 24*8
-#define WRITE_1 50*8 //50*8 // was 400 // SPEC: 48*8 to 64*8 - typ 56*8 (or 56fc) - T5557: 48*8 to 63*8 typ 54*8 432 for T55x7; 448 for E5550
-
-#define READ_GAP 15*8
-*/
// Structure to hold Timing values. In future will be simplier to add user changable timings.
typedef struct {
#define T55xx_DLMode_1of4 3 // 1 of 4
#define T55xx_LongLeadingReference 4 // Value to tell Write Bit to send long reference
// Macro for code readability
-#define BitStream_Byte(X) ((X) / 8)
-#define BitStream_Bit(X) ((X) - ((X) / 8) * 8)
+#define BitStream_Byte(X) ((X) >> 3)
+#define BitStream_Bit(X) ((X) & 7)
void TurnReadLFOn(int delay) {
void T55xxWriteBit(int bit, T55xx_Timing *Timings) {
// If bit = 4 Send Long Leading Reference which is 138 + WRITE_0
-
+ // Dbprintf ("Bits : %d",bit);
switch (bit){
case 0 : TurnReadLFOn(Timings->WRITE_0); break; // Send bit 0/00
case 1 : TurnReadLFOn(Timings->WRITE_1); break; // Send bit 1/01
NextOffset++;
}
}
- else
- Dbprintf ("Too Many Bits to fit into bit buffer");
-
+ else{
+ // Note: This should never happen unless some code changes cause it.
+ // So short message for coders when testing.
+ Dbprintf ("T55 too many bits");
+ }
return NextOffset;
}
// Send one downlink command to the card
-void T55xx_SendCMD (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) { //, bool read_cmd) {//, struct T55xx_Timing *Timing) {
+void T55xx_SendCMD (uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
/*
arg bits
xxxxxx1x 0x02 Page
xxxxx1xx 0x04 testMode
xxx11xxx 0x18 downlink mode
- xx1xxxxx 0x20 reg_readmode
+ xx1xxxxx 0x20 !reg_readmode
x1xxxxxx 0x40 called for a read, so no data packet
-
+ 1xxxxxxx 0x80 reset
+
*/
bool PwdMode = ((arg & 0x01) == 0x01);
- uint8_t Page = (arg & 0x02) >> 1;
+ bool Page = (arg & 0x02);
bool testMode = ((arg & 0x04) == 0x04);
uint8_t downlink_mode = (arg >> 3) & 0x03;
bool reg_readmode = ((arg & 0x20) == 0x20);
bool read_cmd = ((arg & 0x40) == 0x40);
+ bool reset = (arg & 0x80);
+
uint8_t i = 0;
uint8_t BitStream[10]; // Max Downlink Command size ~74 bits, so 10 bytes (80 bits)
uint8_t BitStreamLen;
// Build Bit Stream to send.
memset (BitStream,0x00,sizeof(BitStream));
- BitStreamLen = 0;
+ BitStreamLen = 0; // Ensure 0 bit index to start.
// Add Leading 0 and 1 of 4 reference bit
if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4))
if (downlink_mode == T55xx_DLMode_1of4)
BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream));
- // Add Opcode
- if (testMode) Dbprintf("TestMODE");
- BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,testMode ? 0 : 1 , 1,sizeof(BitStream));
- BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,testMode ? 1 : Page , 1,sizeof(BitStream));
+ // Add Opcode
+ if (reset) {
+ // Reset : r*) 00
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 2,sizeof(BitStream));
+ }
+ else
+ {
+ if (testMode) Dbprintf("TestMODE");
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,testMode ? 0 : 1 , 1,sizeof(BitStream));
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen,testMode ? 1 : Page , 1,sizeof(BitStream));
- if (PwdMode) {
- // Leading 0 and 1 of 4 00 fixed bits if passsword used
- if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4)) {
- BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream));
- BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream));
- }
- BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Pwd, 32,sizeof(BitStream));
- }
-
- // Add Lock bit 0
- BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream));
+ if (PwdMode) {
+ // Leading 0 and 1 of 4 00 fixed bits if passsword used
+ if ((downlink_mode == T55xx_DLMode_Leading0) || (downlink_mode == T55xx_DLMode_1of4)) {
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 2,sizeof(BitStream));
+ }
+ BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Pwd, 32,sizeof(BitStream));
+ }
- // Add Data if a write command
- if (!read_cmd) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Data, 32,sizeof(BitStream));
+ // Add Lock bit 0
+ if (!reg_readmode) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, 0, 1,sizeof(BitStream));
- // Add Address
- if (!reg_readmode) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Block, 3,sizeof(BitStream));
+ // Add Data if a write command
+ if (!read_cmd) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Data, 32,sizeof(BitStream));
+ // Add Address
+ if (!reg_readmode) BitStreamLen = T55xx_SetBits (BitStream, BitStreamLen, Block, 3,sizeof(BitStream));
+ }
+
// Send Bits to T55xx
// Set up FPGA, 125kHz
LFSetupFPGAForADC(95, true);
if (downlink_mode == T55xx_DLMode_LLR)
T55xxWriteBit (T55xx_LongLeadingReference,Timing); // Send Long Leading Start Reference
- if (downlink_mode == T55xx_DLMode_1of4) { // 1 of 4 need to send 2 bits at a time
- for ( i = 0; i < BitStreamLen; i+=2 ) {
+ if ((downlink_mode == T55xx_DLMode_1of4) && (BitStreamLen > 0)) { // 1 of 4 need to send 2 bits at a time
+ for ( i = 0; i < BitStreamLen-1; i+=2 ) {
SendBits = (BitStream[BitStream_Byte(i )] >> (BitStream_Bit(i )) & 1) << 1; // Bit i
SendBits += (BitStream[BitStream_Byte(i+1)] >> (BitStream_Bit(i+1)) & 1); // Bit i+1;
T55xxWriteBit (SendBits & 3,Timing);
// Send T5577 reset command then read stream (see if we can identify the start of the stream)
void T55xxResetRead(void) {
LED_A_ON();
+
+ // send r* 00
+ uint8_t arg = 0x80; // SendCMD will add correct reference mode based on flags (when added).
+
+ // Add in downlink_mode when ready
+ // arg |= 0x00; // dlmode << 3 (00 default - 08 leading 0 - 10 Fixed - 18 1 of 4 )
+
//clear buffer now so it does not interfere with timing later
BigBuf_Clear_keep_EM();
- // Set up FPGA, 125kHz
- LFSetupFPGAForADC(95, true);
- StartTicks();
- // make sure tag is fully powered up...
- WaitMS(5);
-
- // Trigger T55x7 in mode.
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
- WaitUS(T55xx_Timing_FixedBit.START_GAP);
-
- // reset tag - op code 00
- T55xxWriteBit(0,&T55xx_Timing_FixedBit);
- T55xxWriteBit(0,&T55xx_Timing_FixedBit);
+ T55xx_SendCMD (0, 0, 0, arg); //, true);
TurnReadLFOn(T55xx_Timing_FixedBit.READ_GAP);
xxxxxx1x 0x02 Page
xxxxx1xx 0x04 testMode
xxx11xxx 0x18 downlink mode
- xx1xxxxx 0x20 reg_readmode
+ xx1xxxxx 0x20 !reg_readmode
x1xxxxxx 0x40 called for a read, so no data packet
+ 1xxxxxxx 0x80 reset
*/
bool testMode = ((arg & 0x04) == 0x04);
}
// Read one card block in page [page]
-//void T55xxReadBlock (uint16_t arg0, uint8_t Block, uint32_t Pwd) {//, struct T55xx_Timing *Timing) {
void T55xxReadBlock (uint16_t arg0, uint8_t Block, uint32_t Pwd) {//, struct T55xx_Timing *Timing) {
LED_A_ON();
xxxxxx1x 0x02 Page
xxxxx1xx 0x04 testMode
xxx11xxx 0x18 downlink mode
- xx1xxxxx 0x20 reg_readmode
+ xx1xxxxx 0x20 !reg_readmode
x1xxxxxx 0x40 called for a read, so no data packet
+ 1xxxxxxx 0x80 reset
*/
// Set Read Flag to ensure SendCMD does not add "data" to the packet
arg0 |= 0x40;
-
+ // RegRead Mode true of block 0xff
if (Block == 0xff) arg0 |= 0x20;
//make sure block is at max 7
BigBuf_Clear_ext(false);
T55xx_SendCMD (0, Block, Pwd, arg0); //, true);
-
-/*
-// the send has been moved to the above SendCMD Call
-=======
- // Set up FPGA, 125kHz to power up the tag
- LFSetupFPGAForADC(95, true);
- StartTicks();
- // make sure tag is fully powered up...
- WaitMS(5);
- // Trigger T55x7 Direct Access Mode with start gap
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
- WaitUS(START_GAP);
-
- // Opcode 1[page]
- T55xxWriteBit(1);
- T55xxWriteBit(Page); //Page 0
-
- if (PwdMode) {
- // Send Pwd
- for (i = 0x80000000; i != 0; i >>= 1)
- T55xxWriteBit(Pwd & i);
- }
- // Send a zero bit separation
- T55xxWriteBit(0);
-
- // Send Block number (if direct access mode)
- if (!RegReadMode)
- for (i = 0x04; i != 0; i >>= 1)
- T55xxWriteBit(Block & i);
-
-
-*/
// Turn field on to read the response
// 137*8 seems to get to the start of data pretty well...
// but we want to go past the start and let the repeating data settle in...
void T55xxWakeUp(uint32_t Pwd){
LED_B_ON();
- uint32_t i = 0;
-
- // Set up FPGA, 125kHz
- LFSetupFPGAForADC(95, true);
- StartTicks();
- // make sure tag is fully powered up...
- WaitMS(5);
-
- // Trigger T55x7 Direct Access Mode
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
- WaitUS(T55xx_Timing_FixedBit.START_GAP);
+ /*
+ arg bits
+ xxxxxxx1 0x01 PwdMode
+ xxxxxx1x 0x02 Page
+ xxxxx1xx 0x04 testMode
+ xxx11xxx 0x18 downlink mode
+ xx1xxxxx 0x20 !reg_readmode
+ x1xxxxxx 0x40 called for a read, so no data packet
+ 1xxxxxxx 0x80 reset
+ */
- // Opcode 10
- T55xxWriteBit(1,&T55xx_Timing_FixedBit);
- T55xxWriteBit(0,&T55xx_Timing_FixedBit); //Page 0
-
- // Send Pwd
- for (i = 0x80000000; i != 0; i >>= 1)
- T55xxWriteBit(Pwd & i,&T55xx_Timing_FixedBit);
+ // r* 10 (00) <pwd> r* for llr , L0 and 1/4 - (00) for L0 and 1/4 - All handled in SendCMD
+ // So, default Opcode 10 and pwd.
+ uint8_t arg = 0x01 | 0x40 | 0x20; //Password Read Call no data | reg_read no block
+
+ // Add in downlink_mode when ready
+ // arg |= 0x00; // dlmode << 3 (00 default - 08 leading 0 - 10 Fixed - 18 1 of 4 )
+
+ T55xx_SendCMD (0, 0, Pwd, arg); //, true);
// Turn and leave field on to let the begin repeating transmission
TurnReadLFOn(20*1000);
projects / proxmark3-svn / blobdiff