X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/aac23b243446e10c96ee93444b2e29dbcc73c08a..add16a62877f52dab8e8fbb28b2c776902b82ba8:/armsrc/legicrf.c diff --git a/armsrc/legicrf.c b/armsrc/legicrf.c index ae56dcb5..00cb52b6 100644 --- a/armsrc/legicrf.c +++ b/armsrc/legicrf.c @@ -8,21 +8,50 @@ #include "apps.h" #include "legicrf.h" +#include "unistd.h" +#include "stdint.h" static struct legic_frame { - int num_bytes; - int num_bits; - char data[10]; + int bits; + uint16_t data; } current_frame; +AT91PS_TC timer; -static char queries[][4] = { +static void setup_timer(void) +{ + /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging + * this it won't be terribly accurate but should be good enough. + */ + AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); + timer = AT91C_BASE_TC1; + timer->TC_CCR = AT91C_TC_CLKDIS; + timer->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3; + timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; + +/* At TIMER_CLOCK3 (MCK/32) */ +#define RWD_TIME_1 150 /* RWD_TIME_PAUSE off, 80us on = 100us */ +#define RWD_TIME_0 90 /* RWD_TIME_PAUSE off, 40us on = 60us */ +#define RWD_TIME_PAUSE 30 /* 20us */ +#define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */ +#define TAG_TIME_BIT 150 /* 100us for every bit */ +#define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */ + +} + +#define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz))) + +static const struct legic_frame queries[] = { {7, 0x55}, /* 1010 101 */ }; -static char responses[][4] = { + +static const struct legic_frame responses[] = { {6, 0x3b}, /* 1101 11 */ }; -static void frame_send(char *response, int num_bytes, int num_bits) +/* Send a frame in tag mode, the FPGA must have been set up by + * LegicRfSimulate + */ +static void frame_send_tag(uint16_t response, int bits) { #if 0 /* Use the SSC to send a response. 8-bit transfers, LSBit first, 100us per bit */ @@ -33,36 +62,40 @@ static void frame_send(char *response, int num_bytes, int num_bits) AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; /* Wait for the frame start */ - while(AT91C_BASE_TC1->TC_CV < 490) ; + while(timer->TC_CV < TAG_TIME_WAIT) ; int i; - for(i=0; i<(num_bytes*8+num_bits); i++) { - int nextbit = AT91C_BASE_TC1->TC_CV + 150; - int bit = response[i/8] & (1<<(i%8)); + for(i=0; iTC_CV + TAG_TIME_BIT; + int bit = response & 1; + response = response >> 1; if(bit) AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; else AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; - while(AT91C_BASE_TC1->TC_CV < nextbit) ; + while(timer->TC_CV < nextbit) ; } AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; #endif } -static void frame_respond(struct legic_frame *f) +/* Figure out a response to a frame in tag mode */ +static void frame_respond_tag(struct legic_frame const * const f) { LED_D_ON(); - int bitcount = f->num_bytes*8+f->num_bits; - int i, r=-1; + int i, r_size; + uint16_t r_data; + for(i=0; idata[0] == queries[i][1] && f->data[1] == queries[i][2]) { - r = i; + if(f->bits == queries[i].bits && f->data == queries[i].data) { + r_data = responses[i].data; + r_size = responses[i].bits; break; } } - if(r != -1) { - frame_send(&responses[r][1], responses[r][0]/8, responses[r][0]%8); + if(r_size != 0) { + frame_send_tag(r_data, r_size); LED_A_ON(); } else { LED_A_OFF(); @@ -71,47 +104,47 @@ static void frame_respond(struct legic_frame *f) LED_D_OFF(); } -static void frame_append_bit(struct legic_frame *f, int bit) +static void frame_append_bit(struct legic_frame * const f, int bit) { - if(f->num_bytes >= (int)sizeof(f->data)) + if(f->bits >= 15) return; /* Overflow, won't happen */ - f->data[f->num_bytes] |= (bit<num_bits); - f->num_bits++; - if(f->num_bits > 7) { - f->num_bits = 0; - f->num_bytes++; - } + f->data |= (bit<bits); + f->bits++; } -static int frame_is_empty(struct legic_frame *f) +static int frame_is_empty(struct legic_frame const * const f) { - return( (f->num_bytes*8 + f->num_bits) <= 4 ); + return( f->bits <= 4 ); } -static void frame_handle(struct legic_frame *f) +/* Handle (whether to respond) a frame in tag mode */ +static void frame_handle_tag(struct legic_frame const * const f) { - if(f->num_bytes == 0 && f->num_bits == 6) { + if(f->bits == 6) { /* Short path */ return; } if( !frame_is_empty(f) ) { - frame_respond(f); + frame_respond_tag(f); } } -static void frame_clean(struct legic_frame *f) +static void frame_clean(struct legic_frame * const f) { - if(!frame_is_empty(f)) - /* memset(f->data, 0, sizeof(f->data)); */ - f->data[0] = f->data[1] = 0; - f->num_bits = 0; - f->num_bytes = 0; + f->data = 0; + f->bits = 0; } -static void emit(int bit) +enum emit_mode { + EMIT_RWD, /* Emit in tag simulation mode, e.g. the source is the RWD */ + EMIT_TAG /* Emit in reader simulation mode, e.g. the source is the TAG */ +}; +static void emit(enum emit_mode mode, int bit) { if(bit == -1) { - frame_handle(¤t_frame); + if(mode == EMIT_RWD) { + frame_handle_tag(¤t_frame); + } frame_clean(¤t_frame); } else if(bit == 0) { frame_append_bit(¤t_frame, 0); @@ -140,56 +173,46 @@ void LegicRfSimulate(void) AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; - /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging - * this it won't be terribly accurate but should be good enough. - */ - AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); - AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; - AT91C_BASE_TC1->TC_CMR = TC_CMR_TCCLKS_TIMER_CLOCK3; - AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; - int old_level = 0; - -/* At TIMER_CLOCK3 (MCK/32) */ -#define BIT_TIME_1 150 -#define BIT_TIME_0 90 -#define BIT_TIME_FUZZ 20 + setup_timer(); + int old_level = 0; int active = 0; + while(!BUTTON_PRESS()) { int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); - int time = AT91C_BASE_TC1->TC_CV; + int time = timer->TC_CV; if(level != old_level) { if(level == 1) { - AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; - if(time > (BIT_TIME_1-BIT_TIME_FUZZ) && time < (BIT_TIME_1+BIT_TIME_FUZZ)) { + timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; + if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) { /* 1 bit */ - emit(1); + emit(EMIT_RWD, 1); active = 1; LED_B_ON(); - } else if(time > (BIT_TIME_0-BIT_TIME_FUZZ) && time < (BIT_TIME_0+BIT_TIME_FUZZ)) { + } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) { /* 0 bit */ - emit(0); + emit(EMIT_RWD, 0); active = 1; LED_B_ON(); } else if(active) { /* invalid */ - emit(-1); + emit(EMIT_RWD, -1); active = 0; LED_B_OFF(); } } } - if(time >= (BIT_TIME_1+BIT_TIME_FUZZ) && active) { + if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) { /* Frame end */ - emit(-1); + emit(EMIT_RWD, -1); active = 0; LED_B_OFF(); } - if(time >= (20*BIT_TIME_1) && (AT91C_BASE_TC1->TC_SR & AT91C_TC_CLKSTA)) { - AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; + if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) { + timer->TC_CCR = AT91C_TC_CLKDIS; }