#include "crc16.h"
#include "string.h"
-// split into two routines so we can avoid timing issues after sending commands //
+
+/**
+* Does the sample acquisition. If threshold is specified, the actual sampling
+* is not commenced until the threshold has been reached.
+* @param trigger_threshold - the threshold
+* @param silent - is true, now outputs are made. If false, dbprints the status
+*/
void DoAcquisition125k_internal(int trigger_threshold,bool silent)
{
uint8_t *dest = (uint8_t *)BigBuf;
}
}
+/**
+* Perform sample aquisition.
+*/
void DoAcquisition125k(int trigger_threshold)
{
DoAcquisition125k_internal(trigger_threshold, false);
}
-//void SetupToAcquireRawAdcSamples(int divisor)
+/**
+* Setup the FPGA to listen for samples. This method downloads the FPGA bitstream
+* if not already loaded, sets divisor and starts up the antenna.
+* @param divisor : 1, 88> 255 or negative ==> 134.8 KHz
+* 0 or 95 ==> 125 KHz
+*
+**/
void LFSetupFPGAForADC(int divisor, bool lf_field)
{
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
// Now set up the SSC to get the ADC samples that are now streaming at us.
FpgaSetupSsc();
}
-
+/**
+* Initializes the FPGA, and acquires the samples.
+**/
void AcquireRawAdcSamples125k(int divisor)
{
LFSetupFPGAForADC(divisor, true);
// Now call the acquisition routine
DoAcquisition125k_internal(-1,false);
}
+/**
+* Initializes the FPGA for snoop-mode, and acquires the samples.
+**/
+
void SnoopLFRawAdcSamples(int divisor, int trigger_threshold)
{
LFSetupFPGAForADC(divisor, false);
- DoAcquisition125k(trigger_threshold, false);
-}
-
-
+ DoAcquisition125k(trigger_threshold);
}
void ModThenAcquireRawAdcSamples125k(int delay_off, int period_0, int period_1, uint8_t *command)
{
- int at134khz;
/* Make sure the tag is reset */
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
SpinDelay(2500);
+
+ int divisor_used = 95; // 125 KHz
// see if 'h' was specified
+
if (command[strlen((char *) command) - 1] == 'h')
- at134khz = TRUE;
- else
- at134khz = FALSE;
+ divisor_used = 88; // 134.8 KHz
- if (at134khz)
- FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
- else
- FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor_used);
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
-
// Give it a bit of time for the resonant antenna to settle.
SpinDelay(50);
+
// And a little more time for the tag to fully power up
SpinDelay(2000);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
SpinDelayUs(delay_off);
- if (at134khz)
- FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
- else
- FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor_used);
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
SpinDelayUs(delay_off);
- if (at134khz)
- FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
- else
- FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+ FpgaSendCommand(FPGA_CMD_SET_DIVISOR, divisor_used);
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
size_t size=0,idx=0; //, found=0;
uint32_t hi2=0, hi=0, lo=0;
+ // Configure to go in 125Khz listen mode
+ LFSetupFPGAForADC(95, true);
while(!BUTTON_PRESS()) {
- // Configure to go in 125Khz listen mode
- LFSetupFPGAForADC(0, true)
-
WDT_HIT();
if (ledcontrol) LED_A_ON();
- DoAcquisition125k_internal(true);
+ DoAcquisition125k_internal(-1,true);
size = sizeof(BigBuf);
// FSK demodulator
size = fsk_demod(dest, size);
- WDT_HIT();
// we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
// 1->0 : fc/8 in sets of 6
idx+=sizeof(frame_marker_mask);
while(dest[idx] != dest[idx+1] && idx < size-2)
- { // Keep going until next frame marker (or error)
+ {
+ // Keep going until next frame marker (or error)
// Shift in a bit. Start by shifting high registers
hi2 = (hi2<<1)|(hi>>31);
hi = (hi<<1)|(lo>>31);
else // 0 1
lo=(lo<<1)|
1;
- numshifts ++;
+ numshifts++;
idx += 2;
}
+
//Dbprintf("Num shifts: %d ", numshifts);
// Hopefully, we read a tag and hit upon the next frame marker
- if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0)
+ if(idx + sizeof(frame_marker_mask) < size)
{
- if (hi2 != 0){
- Dbprintf("TAG ID: %x%08x%08x (%d)",
- (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
- }
- else {
- Dbprintf("TAG ID: %x%08x (%d)",
- (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ if ( memcmp(dest+idx, frame_marker_mask, sizeof(frame_marker_mask)) == 0)
+ {
+ if (hi2 != 0){ //should be large enough for the largest HID tags
+ Dbprintf("TAG ID: %x%08x%08x (%d)",
+ (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ }
+ else { //standard bits
+ //Dbprintf("TAG ID: %x%08x (%d)",
+ // (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+ uint8_t bitlen = 0;
+ uint32_t fc = 0;
+ uint32_t cardnum = 0;
+
+ if (((hi>>5)&1)==1){//if bit 38 is set then < 37 bit format is used
+ uint32_t lo2=0;
+ lo2=(((hi & 31) << 12) | (lo>>20)); //get bits 21-37 to check for format len bit
+ uint8_t idx3 = 1;
+ while(lo2>1){ //find last bit set to 1 (format len bit)
+ lo2=lo2>>1;
+ idx3++;
+ }
+ bitlen =idx3+19;
+ fc =0;
+ cardnum=0;
+ if(bitlen==26){
+ cardnum = (lo>>1)&0xFFFF;
+ fc = (lo>>17)&0xFF;
+ }
+ if(bitlen==37){
+ cardnum = (lo>>1)&0x7FFFF;
+ fc = ((hi&0xF)<<12)|(lo>>20);
+ }
+ if(bitlen==34){
+ cardnum = (lo>>1)&0xFFFF;
+ fc= ((hi&1)<<15)|(lo>>17);
+ }
+ if(bitlen==35){
+ cardnum = (lo>>1)&0xFFFFF;
+ fc = ((hi&1)<<11)|(lo>>21);
+ }
+ //Dbprintf("Format Len: %d bit - FC: %d - Card: %d",(unsigned int) bitlen, (unsigned int) fc, (unsigned int) cardnum);
+ }
+ else { //if bit 38 is not set then 37 bit format is used
+ bitlen= 37;
+ fc =0;
+ cardnum=0;
+ if(bitlen==37){
+ cardnum = (lo>>1)&0x7FFFF;
+ fc = ((hi&0xF)<<12)|(lo>>20);
+ }
+ }
+ //Dbprintf("TAG ID: %x%08x (%d)",
+ // (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+
+ Dbprintf("TAG ID: %x%08x (%d) - Format Len: %dbit - FC: %d - Card: %d",
+ (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF,
+ (unsigned int) bitlen, (unsigned int) fc, (unsigned int) cardnum);
+ }
}
+
}
// reset
size_t size=0, idx=0;
uint32_t code=0, code2=0;
+ // Configure to go in 125Khz listen mode
+ LFSetupFPGAForADC(95, true);
while(!BUTTON_PRESS()) {
- // Configure to go in 125Khz listen mode
- LFSetupFPGAForADC(0, true);
WDT_HIT();
if (ledcontrol) LED_A_ON();
- DoAcquisition125k_internal(true);
+ DoAcquisition125k_internal(-1,true);
size = sizeof(BigBuf);
// FSK demodulator
size = fsk_demod(dest, size);
- WDT_HIT();
// we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
// 1->0 : fc/8 in sets of 7
for( idx=0; idx < size - 64; idx++) {
if ( memcmp(dest + idx, mask, sizeof(mask)) ) continue;
-
+ Dbprintf("%b",bytebits_to_byte(dest+idx,32));
Dbprintf("%d%d%d%d%d%d%d%d",dest[idx], dest[idx+1], dest[idx+2],dest[idx+3],dest[idx+4],dest[idx+5],dest[idx+6],dest[idx+7]);
Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+8], dest[idx+9], dest[idx+10],dest[idx+11],dest[idx+12],dest[idx+13],dest[idx+14],dest[idx+15]);
Dbprintf("%d%d%d%d%d%d%d%d",dest[idx+16],dest[idx+17],dest[idx+18],dest[idx+19],dest[idx+20],dest[idx+21],dest[idx+22],dest[idx+23]);
code = bytebits_to_byte(dest+idx,32);
code2 = bytebits_to_byte(dest+idx+32,32);
- short version = bytebits_to_byte(dest+idx+14,4);
- char unknown = bytebits_to_byte(dest+idx+19,8) ;
- uint16_t number = bytebits_to_byte(dest+idx+36,9);
+ short version = bytebits_to_byte(dest+idx+28,8); //14,4
+ char facilitycode = bytebits_to_byte(dest+idx+19,8) ;
+ uint16_t number = (bytebits_to_byte(dest+idx+37,8)<<8)|(bytebits_to_byte(dest+idx+46,8)); //36,9
- Dbprintf("XSF(%02d)%02x:%d (%08x%08x)",version,unknown,number,code,code2);
+ Dbprintf("XSF(%02d)%02x:%d (%08x%08x)",version,facilitycode,number,code,code2);
if (ledcontrol) LED_D_OFF();
// if we're only looking for one tag
// Write one card block in page 0, no lock
void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
{
- unsigned int i;
+ //unsigned int i; //enio adjustment 12/10/14
+ uint32_t i;
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
{
uint8_t *dest = (uint8_t *)BigBuf;
- int m=0, i=0;
-
+ //int m=0, i=0; //enio adjustment 12/10/14
+ uint32_t m=0, i=0;
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
m = sizeof(BigBuf);
// Clear destination buffer before sending the command
for (bitidx = 0; i < GraphTraceLen; i++)
{
- if ( (GraphBuffer[i-1] > GraphBuffer[i] && dir == 1 && GraphBuffer[i] > lmax) || (GraphBuffer[i-1] < GraphBuffer[i] && dir == 0 && GraphBuffer[i] < lmin))
- {
- lc = i - lastval;
- lastval = i;
-
- // Switch depending on lc length:
- // Tolerance is 1/8 of clock rate (arbitrary)
- if (abs(lc-clock/4) < tolerance) {
- // 16T0
- if((i - pmc) == lc) { /* 16T0 was previous one */
- /* It's a PMC ! */
- i += (128+127+16+32+33+16)-1;
- lastval = i;
- pmc = 0;
- block_done = 1;
- }
- else {
- pmc = i;
- }
- } else if (abs(lc-clock/2) < tolerance) {
- // 32TO
- if((i - pmc) == lc) { /* 16T0 was previous one */
- /* It's a PMC ! */
- i += (128+127+16+32+33)-1;
- lastval = i;
- pmc = 0;
- block_done = 1;
- }
- else if(half_switch == 1) {
- BitStream[bitidx++] = 0;
- half_switch = 0;
- }
- else
- half_switch++;
- } else if (abs(lc-clock) < tolerance) {
- // 64TO
- BitStream[bitidx++] = 1;
- } else {
- // Error
- warnings++;
- if (warnings > 10)
- {
- Dbprintf("Error: too many detection errors, aborting.");
- return 0;
- }
- }
-
- if(block_done == 1) {
- if(bitidx == 128) {
- for(j=0; j<16; j++) {
- Blocks[num_blocks][j] = 128*BitStream[j*8+7]+
- 64*BitStream[j*8+6]+
- 32*BitStream[j*8+5]+
- 16*BitStream[j*8+4]+
- 8*BitStream[j*8+3]+
- 4*BitStream[j*8+2]+
- 2*BitStream[j*8+1]+
- BitStream[j*8];
- }
- num_blocks++;
- }
- bitidx = 0;
- block_done = 0;
- half_switch = 0;
- }
- if (GraphBuffer[i-1] > GraphBuffer[i]) dir=0;
- else dir = 1;
- }
- if(bitidx==255)
- bitidx=0;
- warnings = 0;
- if(num_blocks == 4) break;
+ if ( (GraphBuffer[i-1] > GraphBuffer[i] && dir == 1 && GraphBuffer[i] > lmax) || (GraphBuffer[i-1] < GraphBuffer[i] && dir == 0 && GraphBuffer[i] < lmin))
+ {
+ lc = i - lastval;
+ lastval = i;
+
+ // Switch depending on lc length:
+ // Tolerance is 1/8 of clock rate (arbitrary)
+ if (abs(lc-clock/4) < tolerance) {
+ // 16T0
+ if((i - pmc) == lc) { /* 16T0 was previous one */
+ /* It's a PMC ! */
+ i += (128+127+16+32+33+16)-1;
+ lastval = i;
+ pmc = 0;
+ block_done = 1;
+ }
+ else {
+ pmc = i;
+ }
+ } else if (abs(lc-clock/2) < tolerance) {
+ // 32TO
+ if((i - pmc) == lc) { /* 16T0 was previous one */
+ /* It's a PMC ! */
+ i += (128+127+16+32+33)-1;
+ lastval = i;
+ pmc = 0;
+ block_done = 1;
+ }
+ else if(half_switch == 1) {
+ BitStream[bitidx++] = 0;
+ half_switch = 0;
+ }
+ else
+ half_switch++;
+ } else if (abs(lc-clock) < tolerance) {
+ // 64TO
+ BitStream[bitidx++] = 1;
+ } else {
+ // Error
+ warnings++;
+ if (warnings > 10)
+ {
+ Dbprintf("Error: too many detection errors, aborting.");
+ return 0;
+ }
+ }
+
+ if(block_done == 1) {
+ if(bitidx == 128) {
+ for(j=0; j<16; j++) {
+ Blocks[num_blocks][j] = 128*BitStream[j*8+7]+
+ 64*BitStream[j*8+6]+
+ 32*BitStream[j*8+5]+
+ 16*BitStream[j*8+4]+
+ 8*BitStream[j*8+3]+
+ 4*BitStream[j*8+2]+
+ 2*BitStream[j*8+1]+
+ BitStream[j*8];
+ }
+ num_blocks++;
+ }
+ bitidx = 0;
+ block_done = 0;
+ half_switch = 0;
+ }
+ if(i < GraphTraceLen)
+ {
+ if (GraphBuffer[i-1] > GraphBuffer[i]) dir=0;
+ else dir = 1;
+ }
+ }
+ if(bitidx==255)
+ bitidx=0;
+ warnings = 0;
+ if(num_blocks == 4) break;
}
memcpy(outBlocks, Blocks, 16*num_blocks);
return num_blocks;
projects / proxmark3-svn / blobdiff