]> git.zerfleddert.de Git - proxmark3-svn/commitdiff
added tiwrite command, split LF code from appmain into lfops.c
authord18c7db <d18c7db@ef4ab9da-24cd-11de-8aaa-f3a34680c41f>
Sat, 25 Jul 2009 11:47:43 +0000 (11:47 +0000)
committerd18c7db <d18c7db@ef4ab9da-24cd-11de-8aaa-f3a34680c41f>
Sat, 25 Jul 2009 11:47:43 +0000 (11:47 +0000)
armsrc/Makefile
armsrc/Makefile.linux
armsrc/appmain.c
armsrc/apps.h
armsrc/lfops.c [new file with mode: 0644]
common/crc16.c
include/usb_cmd.h
winsrc/command.cpp

index b7b4d71007d24aad47b5c937a1a41f1ba6bfc905..1c73054adc38df69aa5ae23cee33129d5bae2d32 100644 (file)
@@ -21,6 +21,7 @@ OBJLCD = $(OBJDIR)/fonts.o \
 OBJ =  $(OBJDIR)/start.o \\r
                $(OBJDIR)/appmain.o \\r
                $(OBJDIR)/fpga.o \\r
 OBJ =  $(OBJDIR)/start.o \\r
                $(OBJDIR)/appmain.o \\r
                $(OBJDIR)/fpga.o \\r
+               $(OBJDIR)/lfops.o \\r
                $(OBJDIR)/iso14443.o \\r
                $(OBJDIR)/iso14443a.o \\r
                $(OBJDIR)/iso15693.o \\r
                $(OBJDIR)/iso14443.o \\r
                $(OBJDIR)/iso14443a.o \\r
                $(OBJDIR)/iso15693.o \\r
index 897a6b121cfed1c07a5adc0442f2440dbcaa06ca..9f3b7874477ca166a3c3d0bdeb5f51af7d5b10d2 100644 (file)
@@ -32,6 +32,7 @@ OBJLCD = $(OBJDIR)/LCD.o\
 OBJ =  $(OBJDIR)/start.o \
                $(OBJDIR)/appmain.o \
                $(OBJDIR)/fpga.o \
 OBJ =  $(OBJDIR)/start.o \
                $(OBJDIR)/appmain.o \
                $(OBJDIR)/fpga.o \
+               $(OBJDIR)/lfops.o \
                $(OBJDIR)/iso15693.o \
                $(OBJDIR)/util.o
 
                $(OBJDIR)/iso15693.o \
                $(OBJDIR)/util.o
 
index f35a82fa544ce1d4c7ab13e4d8ec9e494c2251da..7dba687fc80ca37270ffb48ba70cba2d83a20fab 100644 (file)
@@ -5,7 +5,6 @@
 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
 //-----------------------------------------------------------------------------
 
 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
 //-----------------------------------------------------------------------------
 
-
 #include <proxmark3.h>
 #include <stdlib.h>
 #include "apps.h"
 #include <proxmark3.h>
 #include <stdlib.h>
 #include "apps.h"
@@ -14,9 +13,6 @@
 #include "LCD.h"
 #endif
 
 #include "LCD.h"
 #endif
 
-// The large multi-purpose buffer, typically used to hold A/D samples,
-// maybe pre-processed in some way.
-DWORD BigBuf[16000];
 int usbattached = 0;
 
 //=============================================================================
 int usbattached = 0;
 
 //=============================================================================
@@ -29,7 +25,6 @@ BYTE ToSend[256];
 int ToSendMax;
 static int ToSendBit;
 
 int ToSendMax;
 static int ToSendBit;
 
-
 void BufferClear(void)
 {
        memset(BigBuf,0,sizeof(BigBuf));
 void BufferClear(void)
 {
        memset(BigBuf,0,sizeof(BigBuf));
@@ -99,185 +94,6 @@ void DbpIntegers(int x1, int x2, int x3)
        SpinDelay(50);
 }
 
        SpinDelay(50);
 }
 
-void AcquireRawAdcSamples125k(BOOL at134khz)
-{
-       if(at134khz) {
-               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-       } else {
-               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-       }
-
-       // Connect the A/D to the peak-detected low-frequency path.
-       SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
-
-       // Give it a bit of time for the resonant antenna to settle.
-       SpinDelay(50);
-
-       // Now set up the SSC to get the ADC samples that are now streaming at us.
-       FpgaSetupSsc();
-
-       // Now call the acquisition routine
-       DoAcquisition125k(at134khz);
-}
-
-// split into two routines so we can avoid timing issues after sending commands //
-void DoAcquisition125k(BOOL at134khz)
-{
-       BYTE *dest = (BYTE *)BigBuf;
-       int n = sizeof(BigBuf);
-       int i;
-
-       memset(dest,0,n);
-       i = 0;
-       for(;;) {
-               if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
-                       SSC_TRANSMIT_HOLDING = 0x43;
-                       LED_D_ON();
-               }
-               if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
-                       dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
-                       i++;
-                       LED_D_OFF();
-                       if(i >= n) {
-                               break;
-                       }
-               }
-       }
-       DbpIntegers(dest[0], dest[1], at134khz);
-}
-
-void ModThenAcquireRawAdcSamples125k(int delay_off,int period_0,int period_1,BYTE *command)
-{
-       BOOL at134khz;
-
-       // see if 'h' was specified
-       if(command[strlen((char *) command) - 1] == 'h')
-               at134khz= TRUE;
-       else
-               at134khz= FALSE;
-
-       if(at134khz) {
-               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-       } else {
-               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-       }
-
-       // Give it a bit of time for the resonant antenna to settle.
-       SpinDelay(50);
-
-       // Now set up the SSC to get the ADC samples that are now streaming at us.
-       FpgaSetupSsc();
-
-       // now modulate the reader field
-       while(*command != '\0' && *command != ' ')
-               {
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-               LED_D_OFF();
-               SpinDelayUs(delay_off);
-               if(at134khz) {
-                       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-                       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-               } else {
-                       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-                       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-               }
-               LED_D_ON();
-               if(*(command++) == '0')
-                       SpinDelayUs(period_0);
-               else
-                       SpinDelayUs(period_1);
-               }
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-       LED_D_OFF();
-       SpinDelayUs(delay_off);
-       if(at134khz) {
-               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-       } else {
-               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
-       }
-
-       // now do the read
-       DoAcquisition125k(at134khz);
-}
-
-void AcquireTiType(void)
-{
-       int i;
-       int n = 5000;
-
-       // clear buffer
-       memset(BigBuf,0,sizeof(BigBuf));
-
-       // Set up the synchronous serial port
-  PIO_DISABLE = (1<<GPIO_SSC_DIN);
-  PIO_PERIPHERAL_A_SEL = (1<<GPIO_SSC_DIN);
-
-       // steal this pin from the SSP and use it to control the modulation
-  PIO_ENABLE = (1<<GPIO_SSC_DOUT);
-       PIO_OUTPUT_ENABLE       = (1<<GPIO_SSC_DOUT);
-
-  SSC_CONTROL = SSC_CONTROL_RESET;
-  SSC_CONTROL = SSC_CONTROL_RX_ENABLE | SSC_CONTROL_TX_ENABLE;
-
-  // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long
-  // 48/2 = 24 MHz clock must be divided by 12
-  SSC_CLOCK_DIVISOR = 12;
-
-  SSC_RECEIVE_CLOCK_MODE = SSC_CLOCK_MODE_SELECT(0);
-       SSC_RECEIVE_FRAME_MODE = SSC_FRAME_MODE_BITS_IN_WORD(32) | SSC_FRAME_MODE_MSB_FIRST;
-       SSC_TRANSMIT_CLOCK_MODE = 0;
-       SSC_TRANSMIT_FRAME_MODE = 0;
-
-       LED_D_ON();
-
-       // modulate antenna
-       PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);
-
-       // Charge TI tag for 50ms.
-       SpinDelay(50);
-
-       // stop modulating antenna and listen
-       PIO_OUTPUT_DATA_CLEAR = (1<<GPIO_SSC_DOUT);
-
-       LED_D_OFF();
-
-       i = 0;
-       for(;;) {
-                       if(SSC_STATUS & SSC_STATUS_RX_READY) {
-                                       BigBuf[i] = SSC_RECEIVE_HOLDING;        // store 32 bit values in buffer
-                                       i++; if(i >= n) return;
-                       }
-                       WDT_HIT();
-       }
-
-       // return stolen pin to SSP
-       PIO_DISABLE = (1<<GPIO_SSC_DOUT);
-       PIO_PERIPHERAL_A_SEL = (1<<GPIO_SSC_DIN) | (1<<GPIO_SSC_DOUT);
-}
-
-void AcquireRawBitsTI(void)
-{
-       LED_D_ON();
-       // TI tags charge at 134.2Khz
-       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
-       // Place FPGA in passthrough mode, in this mode the CROSS_LO line
-       // connects to SSP_DIN and the SSP_DOUT logic level controls
-       // whether we're modulating the antenna (high)
-       // or listening to the antenna (low)
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
-
-       // get TI tag data into the buffer
-       AcquireTiType();
-
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-}
-
 //-----------------------------------------------------------------------------
 // Read an ADC channel and block till it completes, then return the result
 // in ADC units (0 to 1023). Also a routine to average 32 samples and
 //-----------------------------------------------------------------------------
 // Read an ADC channel and block till it completes, then return the result
 // in ADC units (0 to 1023). Also a routine to average 32 samples and
@@ -364,397 +180,338 @@ void MeasureAntennaTuning(void)
        UsbSendPacket((BYTE *)&c, sizeof(c));
 }
 
        UsbSendPacket((BYTE *)&c, sizeof(c));
 }
 
-void SimulateTagLowFrequency(int period, int ledcontrol)
+void SimulateTagHfListen(void)
 {
 {
+       BYTE *dest = (BYTE *)BigBuf;
+       int n = sizeof(BigBuf);
+       BYTE v = 0;
        int i;
        int i;
-       BYTE *tab = (BYTE *)BigBuf;
-
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR);
+       int p = 0;
 
 
-       PIO_ENABLE = (1 << GPIO_SSC_DOUT) | (1 << GPIO_SSC_CLK);
+       // We're using this mode just so that I can test it out; the simulated
+       // tag mode would work just as well and be simpler.
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
 
 
-       PIO_OUTPUT_ENABLE = (1 << GPIO_SSC_DOUT);
-       PIO_OUTPUT_DISABLE = (1 << GPIO_SSC_CLK);
+       // We need to listen to the high-frequency, peak-detected path.
+       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
 
-#define SHORT_COIL()   LOW(GPIO_SSC_DOUT)
-#define OPEN_COIL()    HIGH(GPIO_SSC_DOUT)
+       FpgaSetupSsc();
 
        i = 0;
        for(;;) {
 
        i = 0;
        for(;;) {
-               while(!(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK))) {
-                       if(BUTTON_PRESS()) {
-                               DbpString("Stopped");
-                               return;
-                       }
-                       WDT_HIT();
+               if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
+                       SSC_TRANSMIT_HOLDING = 0xff;
                }
                }
+               if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
+                       BYTE r = (BYTE)SSC_RECEIVE_HOLDING;
 
 
-               if (ledcontrol)
-                       LED_D_ON();
-
-               if(tab[i])
-                       OPEN_COIL();
-               else
-                       SHORT_COIL();
+                       v <<= 1;
+                       if(r & 1) {
+                               v |= 1;
+                       }
+                       p++;
 
 
-               if (ledcontrol)
-                       LED_D_OFF();
+                       if(p >= 8) {
+                               dest[i] = v;
+                               v = 0;
+                               p = 0;
+                               i++;
 
 
-               while(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK)) {
-                       if(BUTTON_PRESS()) {
-                               DbpString("Stopped");
-                               return;
+                               if(i >= n) {
+                                       break;
+                               }
                        }
                        }
-                       WDT_HIT();
                }
                }
-
-               i++;
-               if(i == period) i = 0;
        }
        }
+       DbpString("simulate tag (now type bitsamples)");
 }
 
 }
 
-// compose fc/8 fc/10 waveform
-static void fc(int c, int *n) {
-       BYTE *dest = (BYTE *)BigBuf;
-       int idx;
-
-       // for when we want an fc8 pattern every 4 logical bits
-       if(c==0) {
-               dest[((*n)++)]=1;
-               dest[((*n)++)]=1;
-               dest[((*n)++)]=0;
-               dest[((*n)++)]=0;
-               dest[((*n)++)]=0;
-               dest[((*n)++)]=0;
-               dest[((*n)++)]=0;
-               dest[((*n)++)]=0;
-       }
-       //      an fc/8  encoded bit is a bit pattern of  11000000  x6 = 48 samples
-       if(c==8) {
-               for (idx=0; idx<6; idx++) {
-                       dest[((*n)++)]=1;
-                       dest[((*n)++)]=1;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-               }
-       }
+void ReadMem(int addr)
+{
+       const DWORD *data = ((DWORD *)addr);
+       int i;
 
 
-       //      an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
-       if(c==10) {
-               for (idx=0; idx<5; idx++) {
-                       dest[((*n)++)]=1;
-                       dest[((*n)++)]=1;
-                       dest[((*n)++)]=1;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-                       dest[((*n)++)]=0;
-               }
-       }
+       DbpString("Reading memory at address");
+       DbpIntegers(0, 0, addr);
+       for (i = 0; i < 8; i+= 2)
+               DbpIntegers(0, data[i], data[i+1]);
 }
 
 }
 
-// prepare a waveform pattern in the buffer based on the ID given then
-// simulate a HID tag until the button is pressed
-static void CmdHIDsimTAG(int hi, int lo, int ledcontrol)
+// samy's sniff and repeat routine
+void SamyRun()
 {
 {
-       int n=0, i=0;
-       /*
-        HID tag bitstream format
-        The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
-        A 1 bit is represented as 6 fc8 and 5 fc10 patterns
-        A 0 bit is represented as 5 fc10 and 6 fc8 patterns
-        A fc8 is inserted before every 4 bits
-        A special start of frame pattern is used consisting a0b0 where a and b are neither 0
-        nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
-       */
-
-       if (hi>0xFFF) {
-               DbpString("Tags can only have 44 bits.");
-               return;
-       }
-       fc(0,&n);
-       // special start of frame marker containing invalid bit sequences
-       fc(8,  &n);     fc(8,  &n);     // invalid
-       fc(8,  &n);     fc(10, &n); // logical 0
-       fc(10, &n);     fc(10, &n); // invalid
-       fc(8,  &n);     fc(10, &n); // logical 0
-
-       WDT_HIT();
-       // manchester encode bits 43 to 32
-       for (i=11; i>=0; i--) {
-               if ((i%4)==3) fc(0,&n);
-               if ((hi>>i)&1) {
-                       fc(10, &n);     fc(8,  &n);             // low-high transition
-               } else {
-                       fc(8,  &n);     fc(10, &n);             // high-low transition
-               }
-       }
+       DbpString("Stand-alone mode! No PC necessary.");
 
 
-       WDT_HIT();
-       // manchester encode bits 31 to 0
-       for (i=31; i>=0; i--) {
-               if ((i%4)==3) fc(0,&n);
-               if ((lo>>i)&1) {
-                       fc(10, &n);     fc(8,  &n);             // low-high transition
-               } else {
-                       fc(8,  &n);     fc(10, &n);             // high-low transition
-               }
-       }
+       // 3 possible options? no just 2 for now
+#define OPTS 2
 
 
-       if (ledcontrol)
-               LED_A_ON();
-       SimulateTagLowFrequency(n, ledcontrol);
+       int high[OPTS], low[OPTS];
 
 
-       if (ledcontrol)
-               LED_A_OFF();
-}
+       // Oooh pretty -- notify user we're in elite samy mode now
+       LED(LED_RED,    200);
+       LED(LED_ORANGE, 200);
+       LED(LED_GREEN,  200);
+       LED(LED_ORANGE, 200);
+       LED(LED_RED,    200);
+       LED(LED_ORANGE, 200);
+       LED(LED_GREEN,  200);
+       LED(LED_ORANGE, 200);
+       LED(LED_RED,    200);
 
 
-// loop to capture raw HID waveform then FSK demodulate the TAG ID from it
-static void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
-{
-       BYTE *dest = (BYTE *)BigBuf;
-       int m=0, n=0, i=0, idx=0, found=0, lastval=0;
-       DWORD hi=0, lo=0;
+       int selected = 0;
+       int playing = 0;
 
 
-       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
+       // Turn on selected LED
+       LED(selected + 1, 0);
 
 
-       // Connect the A/D to the peak-detected low-frequency path.
-       SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
+       for (;;)
+       {
+               usbattached = UsbPoll(FALSE);
+               WDT_HIT();
 
 
-       // Give it a bit of time for the resonant antenna to settle.
-       SpinDelay(50);
+               // Was our button held down or pressed?
+               int button_pressed = BUTTON_HELD(1000);
+               SpinDelay(300);
 
 
-       // Now set up the SSC to get the ADC samples that are now streaming at us.
-       FpgaSetupSsc();
+               // Button was held for a second, begin recording
+               if (button_pressed > 0)
+               {
+                       LEDsoff();
+                       LED(selected + 1, 0);
+                       LED(LED_RED2, 0);
 
 
-       for(;;) {
-               WDT_HIT();
-               if (ledcontrol)
-                       LED_A_ON();
-               if(BUTTON_PRESS()) {
-                       DbpString("Stopped");
-                       if (ledcontrol)
-                               LED_A_OFF();
-                       return;
-               }
+                       // record
+                       DbpString("Starting recording");
 
 
-               i = 0;
-               m = sizeof(BigBuf);
-               memset(dest,128,m);
-               for(;;) {
-                       if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
-                               SSC_TRANSMIT_HOLDING = 0x43;
-                               if (ledcontrol)
-                                       LED_D_ON();
-                       }
-                       if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
-                               dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
-                               // we don't care about actual value, only if it's more or less than a
-                               // threshold essentially we capture zero crossings for later analysis
-                               if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
-                               i++;
-                               if (ledcontrol)
-                                       LED_D_OFF();
-                               if(i >= m) {
-                                       break;
-                               }
-                       }
-               }
+                       // wait for button to be released
+                       while(BUTTON_PRESS())
+                               WDT_HIT();
 
 
-               // FSK demodulator
+                       /* need this delay to prevent catching some weird data */
+                       SpinDelay(500);
 
 
-               // sync to first lo-hi transition
-               for( idx=1; idx<m; idx++) {
-                       if (dest[idx-1]<dest[idx])
-                               lastval=idx;
-                               break;
-               }
-               WDT_HIT();
+                       CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
+                       DbpString("Recorded");
+                       DbpIntegers(selected, high[selected], low[selected]);
 
 
-               // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
-               // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
-               // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
-               for( i=0; idx<m; idx++) {
-                       if (dest[idx-1]<dest[idx]) {
-                               dest[i]=idx-lastval;
-                               if (dest[i] <= 8) {
-                                               dest[i]=1;
-                               } else {
-                                               dest[i]=0;
-                               }
+                       LEDsoff();
+                       LED(selected + 1, 0);
+                       // Finished recording
 
 
-                               lastval=idx;
-                               i++;
-                       }
+                       // If we were previously playing, set playing off
+                       // so next button push begins playing what we recorded
+                       playing = 0;
                }
                }
-               m=i;
-               WDT_HIT();
 
 
-               // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
-               lastval=dest[0];
-               idx=0;
-               i=0;
-               n=0;
-               for( idx=0; idx<m; idx++) {
-                       if (dest[idx]==lastval) {
-                               n++;
-                       } else {
-                               // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
-                               // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
-                               // swallowed up by rounding
-                               // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
-                               // special start of frame markers use invalid manchester states (no transitions) by using sequences
-                               // like 111000
-                               if (dest[idx-1]) {
-                                       n=(n+1)/6;                      // fc/8 in sets of 6
-                               } else {
-                                       n=(n+1)/5;                      // fc/10 in sets of 5
-                               }
-                               switch (n) {                    // stuff appropriate bits in buffer
-                                       case 0:
-                                       case 1: // one bit
-                                               dest[i++]=dest[idx-1];
-                                               break;
-                                       case 2: // two bits
-                                               dest[i++]=dest[idx-1];
-                                               dest[i++]=dest[idx-1];
-                                               break;
-                                       case 3: // 3 bit start of frame markers
-                                               dest[i++]=dest[idx-1];
-                                               dest[i++]=dest[idx-1];
-                                               dest[i++]=dest[idx-1];
-                                               break;
-                                       // When a logic 0 is immediately followed by the start of the next transmisson
-                                       // (special pattern) a pattern of 4 bit duration lengths is created.
-                                       case 4:
-                                               dest[i++]=dest[idx-1];
-                                               dest[i++]=dest[idx-1];
-                                               dest[i++]=dest[idx-1];
-                                               dest[i++]=dest[idx-1];
-                                               break;
-                                       default:        // this shouldn't happen, don't stuff any bits
-                                               break;
-                               }
-                               n=0;
-                               lastval=dest[idx];
-                       }
-               }
-               m=i;
-               WDT_HIT();
+               // Change where to record (or begin playing)
+               else if (button_pressed)
+               {
+                       // Next option if we were previously playing
+                       if (playing)
+                               selected = (selected + 1) % OPTS;
+                       playing = !playing;
 
 
-               // final loop, go over previously decoded manchester data and decode into usable tag ID
-               // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
-               for( idx=0; idx<m-6; idx++) {
-                       // search for a start of frame marker
-                       if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
-                       {
-                               found=1;
-                               idx+=6;
-                               if (found && (hi|lo)) {
-                                       DbpString("TAG ID");
-                                       DbpIntegers(hi, lo, (lo>>1)&0xffff);
-                                       /* if we're only looking for one tag */
-                                       if (findone)
-                                       {
-                                               *high = hi;
-                                               *low = lo;
-                                               return;
-                                       }
-                                       hi=0;
-                                       lo=0;
-                                       found=0;
-                               }
-                       }
-                       if (found) {
-                               if (dest[idx] && (!dest[idx+1]) ) {
-                                       hi=(hi<<1)|(lo>>31);
-                                       lo=(lo<<1)|0;
-                               } else if ( (!dest[idx]) && dest[idx+1]) {
-                                       hi=(hi<<1)|(lo>>31);
-                                       lo=(lo<<1)|1;
-                               } else {
-                                       found=0;
-                                       hi=0;
-                                       lo=0;
-                               }
-                               idx++;
-                       }
-                       if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
+                       LEDsoff();
+                       LED(selected + 1, 0);
+
+                       // Begin transmitting
+                       if (playing)
                        {
                        {
-                               found=1;
-                               idx+=6;
-                               if (found && (hi|lo)) {
-                                       DbpString("TAG ID");
-                                       DbpIntegers(hi, lo, (lo>>1)&0xffff);
-                                       /* if we're only looking for one tag */
-                                       if (findone)
+                               LED(LED_GREEN, 0);
+                               DbpString("Playing");
+                               // wait for button to be released
+                               while(BUTTON_PRESS())
+                                       WDT_HIT();
+                               DbpIntegers(selected, high[selected], low[selected]);
+                               CmdHIDsimTAG(high[selected], low[selected], 0);
+                               DbpString("Done playing");
+                               if (BUTTON_HELD(1000) > 0)
                                        {
                                        {
-                                               *high = hi;
-                                               *low = lo;
-                                               return;
+                                       DbpString("Exiting");
+                                       LEDsoff();
+                                       return;
                                        }
                                        }
-                                       hi=0;
-                                       lo=0;
-                                       found=0;
-                               }
+
+                               /* We pressed a button so ignore it here with a delay */
+                               SpinDelay(300);
+
+                               // when done, we're done playing, move to next option
+                               selected = (selected + 1) % OPTS;
+                               playing = !playing;
+                               LEDsoff();
+                               LED(selected + 1, 0);
                        }
                        }
+                       else
+                               while(BUTTON_PRESS())
+                                       WDT_HIT();
                }
                }
-               WDT_HIT();
        }
 }
 
        }
 }
 
-void SimulateTagHfListen(void)
+
+/*
+OBJECTIVE
+Listen and detect an external reader. Determine the best location
+for the antenna.
+
+INSTRUCTIONS:
+Inside the ListenReaderField() function, there is two mode.
+By default, when you call the function, you will enter mode 1.
+If you press the PM3 button one time, you will enter mode 2.
+If you press the PM3 button a second time, you will exit the function.
+
+DESCRIPTION OF MODE 1:
+This mode just listens for an external reader field and lights up green
+for HF and/or red for LF. This is the original mode of the detectreader
+function.
+
+DESCRIPTION OF MODE 2:
+This mode will visually represent, using the LEDs, the actual strength of the
+current compared to the maximum current detected. Basically, once you know
+what kind of external reader is present, it will help you spot the best location to place
+your antenna. You will probably not get some good results if there is a LF and a HF reader
+at the same place! :-)
+
+LIGHT SCHEME USED:
+
+Light scheme | Descriptiong
+----------------------------------------------------
+    ----     | No field detected
+    X---     | 14% of maximum current detected
+    -X--     | 29% of maximum current detected
+    --X-     | 43% of maximum current detected
+    ---X     | 57% of maximum current detected
+    --XX     | 71% of maximum current detected
+    -XXX     | 86% of maximum current detected
+    XXXX     | 100% of maximum current detected
+
+TODO:
+Add the LF part for MODE 2
+
+*/
+void ListenReaderField(int limit)
 {
 {
-       BYTE *dest = (BYTE *)BigBuf;
-       int n = sizeof(BigBuf);
-       BYTE v = 0;
-       int i;
-       int p = 0;
+       int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0;
+       int hf_av, hf_av_new,  hf_baseline= 0, hf_count= 0, hf_max;
+       int mode=1;
 
 
-       // We're using this mode just so that I can test it out; the simulated
-       // tag mode would work just as well and be simpler.
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP);
+#define LF_ONLY                1
+#define HF_ONLY                2
 
 
-       // We need to listen to the high-frequency, peak-detected path.
-       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+       LED_A_OFF();
+       LED_B_OFF();
+       LED_C_OFF();
+       LED_D_OFF();
 
 
-       FpgaSetupSsc();
+       lf_av= ReadAdc(ADC_CHAN_LF);
 
 
-       i = 0;
-       for(;;) {
-               if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
-                       SSC_TRANSMIT_HOLDING = 0xff;
+       if(limit != HF_ONLY)
+               {
+               DbpString("LF 125/134 Baseline:");
+               DbpIntegers(lf_av,0,0);
+               lf_baseline= lf_av;
                }
                }
-               if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
-                       BYTE r = (BYTE)SSC_RECEIVE_HOLDING;
 
 
-                       v <<= 1;
-                       if(r & 1) {
-                               v |= 1;
-                       }
-                       p++;
+       hf_av=hf_max=ReadAdc(ADC_CHAN_HF);
 
 
-                       if(p >= 8) {
-                               dest[i] = v;
-                               v = 0;
-                               p = 0;
-                               i++;
+       if (limit != LF_ONLY)
+               {
+               DbpString("HF 13.56 Baseline:");
+               DbpIntegers(hf_av,0,0);
+               hf_baseline= hf_av;
+               }
 
 
-                               if(i >= n) {
+       for(;;)
+               {
+               if (BUTTON_PRESS()) {
+                       SpinDelay(500);
+                       switch (mode) {
+                               case 1:
+                                       mode=2;
+                                       DbpString("Signal Strength Mode");
                                        break;
                                        break;
+                               case 2:
+                               default:
+                                       DbpString("Stopped");
+                                       LED_A_OFF();
+                                       LED_B_OFF();
+                                       LED_C_OFF();
+                                       LED_D_OFF();
+                                       return;
+                                       break;
+                       }
+               }
+               WDT_HIT();
+
+               if (limit != HF_ONLY)
+                       {
+                       if (abs(lf_av - lf_baseline) > 10)
+                               LED_D_ON();
+                       else
+                               LED_D_OFF();
+                       ++lf_count;
+                       lf_av_new= ReadAdc(ADC_CHAN_LF);
+                       // see if there's a significant change
+                       if(abs(lf_av - lf_av_new) > 10)
+                               {
+                               DbpString("LF 125/134 Field Change:");
+                               DbpIntegers(lf_av,lf_av_new,lf_count);
+                               lf_av= lf_av_new;
+                               lf_count= 0;
+                               }
+                       }
+
+               if (limit != LF_ONLY)
+                       {
+                       if (abs(hf_av - hf_baseline) > 10) {
+                               if (mode == 1)
+                                       LED_B_ON();
+                               if (mode == 2) {
+                                       if ( hf_av>(hf_max/7)*6) {
+                                               LED_A_ON();     LED_B_ON();     LED_C_ON();     LED_D_ON();
+                                       }
+                                       if ( (hf_av>(hf_max/7)*5) && (hf_av<=(hf_max/7)*6) ) {
+                                               LED_A_ON();     LED_B_ON();     LED_C_OFF(); LED_D_ON();
+                                       }
+                                       if ( (hf_av>(hf_max/7)*4) && (hf_av<=(hf_max/7)*5) ) {
+                                               LED_A_OFF(); LED_B_ON(); LED_C_OFF(); LED_D_ON();
+                                       }
+                                       if ( (hf_av>(hf_max/7)*3) && (hf_av<=(hf_max/7)*4) ) {
+                                               LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); LED_D_ON();
+                                       }
+                                       if ( (hf_av>(hf_max/7)*2) && (hf_av<=(hf_max/7)*3) ) {
+                                               LED_A_OFF(); LED_B_ON(); LED_C_OFF(); LED_D_OFF();
+                                       }
+                                       if ( (hf_av>(hf_max/7)*1) && (hf_av<=(hf_max/7)*2) ) {
+                                               LED_A_ON();     LED_B_OFF(); LED_C_OFF(); LED_D_OFF();
+                                       }
+                                       if ( (hf_av>(hf_max/7)*0) && (hf_av<=(hf_max/7)*1) ) {
+                                               LED_A_OFF(); LED_B_OFF(); LED_C_ON(); LED_D_OFF();
+                                       }
+                               }
+                       } else {
+                               if (mode == 1) {
+                                       LED_B_OFF();
+                               }
+                               if (mode == 2) {
+                                       LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); LED_D_OFF();
+                               }
+                       }
+
+                       ++hf_count;
+                       hf_av_new= ReadAdc(ADC_CHAN_HF);
+                       // see if there's a significant change
+                       if(abs(hf_av - hf_av_new) > 10)
+                               {
+                               DbpString("HF 13.56 Field Change:");
+                               DbpIntegers(hf_av,hf_av_new,hf_count);
+                               hf_av= hf_av_new;
+                               if (hf_av > hf_max)
+                                       hf_max = hf_av;
+                               hf_count= 0;
                                }
                        }
                }
                                }
                        }
                }
-       }
-       DbpString("simulate tag (now type bitsamples)");
 }
 
 void UsbPacketReceived(BYTE *packet, int len)
 }
 
 void UsbPacketReceived(BYTE *packet, int len)
@@ -770,10 +527,6 @@ void UsbPacketReceived(BYTE *packet, int len)
                        ModThenAcquireRawAdcSamples125k(c->ext1,c->ext2,c->ext3,c->d.asBytes);
                        break;
 
                        ModThenAcquireRawAdcSamples125k(c->ext1,c->ext2,c->ext3,c->d.asBytes);
                        break;
 
-               case CMD_ACQUIRE_RAW_BITS_TI_TYPE:
-                       AcquireRawBitsTI();
-                       break;
-
                case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
                        AcquireRawAdcSamplesIso15693();
                        break;
                case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
                        AcquireRawAdcSamplesIso15693();
                        break;
@@ -844,6 +597,18 @@ void UsbPacketReceived(BYTE *packet, int len)
                        LED_D_OFF(); // LED D indicates field ON or OFF
                        break;
 
                        LED_D_OFF(); // LED D indicates field ON or OFF
                        break;
 
+               case CMD_ACQUIRE_RAW_BITS_TI_TYPE:
+                       AcquireRawBitsTI();
+                       break;
+
+               case CMD_READ_TI_TYPE:
+                       ReadTItag();
+                       break;
+
+               case CMD_WRITE_TI_TYPE:
+                       WriteTItag(c->ext1,c->ext2,c->ext3);
+                       break;
+
                case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
                case CMD_DOWNLOAD_RAW_BITS_TI_TYPE: {
                        UsbCommand n;
                case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K:
                case CMD_DOWNLOAD_RAW_BITS_TI_TYPE: {
                        UsbCommand n;
@@ -883,7 +648,7 @@ void UsbPacketReceived(BYTE *packet, int len)
                        LCDSend(c->ext1);
                        break;
 #endif
                        LCDSend(c->ext1);
                        break;
 #endif
-        case CMD_SETUP_WRITE:
+               case CMD_SETUP_WRITE:
                case CMD_FINISH_WRITE:
                case CMD_HARDWARE_RESET:
                        USB_D_PLUS_PULLUP_OFF();
                case CMD_FINISH_WRITE:
                case CMD_HARDWARE_RESET:
                        USB_D_PLUS_PULLUP_OFF();
@@ -902,17 +667,6 @@ void UsbPacketReceived(BYTE *packet, int len)
        }
 }
 
        }
 }
 
-void ReadMem(int addr)
-{
-       const DWORD *data = ((DWORD *)addr);
-       int i;
-
-       DbpString("Reading memory at address");
-       DbpIntegers(0, 0, addr);
-       for (i = 0; i < 8; i+= 2)
-               DbpIntegers(0, data[i], data[i+1]);
-}
-
 void AppMain(void)
 {
        memset(BigBuf,0,sizeof(BigBuf));
 void AppMain(void)
 {
        memset(BigBuf,0,sizeof(BigBuf));
@@ -976,282 +730,3 @@ void AppMain(void)
                        SamyRun();
        }
 }
                        SamyRun();
        }
 }
-
-
-// samy's sniff and repeat routine
-void SamyRun()
-{
-       DbpString("Stand-alone mode! No PC necessary.");
-
-       // 3 possible options? no just 2 for now
-#define OPTS 2
-
-       int high[OPTS], low[OPTS];
-
-       // Oooh pretty -- notify user we're in elite samy mode now
-       LED(LED_RED,    200);
-       LED(LED_ORANGE, 200);
-       LED(LED_GREEN,  200);
-       LED(LED_ORANGE, 200);
-       LED(LED_RED,    200);
-       LED(LED_ORANGE, 200);
-       LED(LED_GREEN,  200);
-       LED(LED_ORANGE, 200);
-       LED(LED_RED,    200);
-
-       int selected = 0;
-       int playing = 0;
-
-       // Turn on selected LED
-       LED(selected + 1, 0);
-
-       for (;;)
-       {
-               usbattached = UsbPoll(FALSE);
-               WDT_HIT();
-
-               // Was our button held down or pressed?
-               int button_pressed = BUTTON_HELD(1000);
-               SpinDelay(300);
-
-               // Button was held for a second, begin recording
-               if (button_pressed > 0)
-               {
-                       LEDsoff();
-                       LED(selected + 1, 0);
-                       LED(LED_RED2, 0);
-
-                       // record
-                       DbpString("Starting recording");
-
-                       // wait for button to be released
-                       while(BUTTON_PRESS())
-                               WDT_HIT();
-
-                       /* need this delay to prevent catching some weird data */
-                       SpinDelay(500);
-
-                       CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
-                       DbpString("Recorded");
-                       DbpIntegers(selected, high[selected], low[selected]);
-
-                       LEDsoff();
-                       LED(selected + 1, 0);
-                       // Finished recording
-
-                       // If we were previously playing, set playing off
-                       // so next button push begins playing what we recorded
-                       playing = 0;
-               }
-
-               // Change where to record (or begin playing)
-               else if (button_pressed)
-               {
-                       // Next option if we were previously playing
-                       if (playing)
-                               selected = (selected + 1) % OPTS;
-                       playing = !playing;
-
-                       LEDsoff();
-                       LED(selected + 1, 0);
-
-                       // Begin transmitting
-                       if (playing)
-                       {
-                               LED(LED_GREEN, 0);
-                               DbpString("Playing");
-                               // wait for button to be released
-                               while(BUTTON_PRESS())
-                                       WDT_HIT();
-                               DbpIntegers(selected, high[selected], low[selected]);
-                               CmdHIDsimTAG(high[selected], low[selected], 0);
-                               DbpString("Done playing");
-                               if (BUTTON_HELD(1000) > 0)
-                                       {
-                                       DbpString("Exiting");
-                                       LEDsoff();
-                                       return;
-                                       }
-
-                               /* We pressed a button so ignore it here with a delay */
-                               SpinDelay(300);
-
-                               // when done, we're done playing, move to next option
-                               selected = (selected + 1) % OPTS;
-                               playing = !playing;
-                               LEDsoff();
-                               LED(selected + 1, 0);
-                       }
-                       else
-                               while(BUTTON_PRESS())
-                                       WDT_HIT();
-               }
-       }
-}
-
-
-/* \r
-OBJECTIVE\r
-Listen and detect an external reader. Determine the best location\r
-for the antenna.\r
-\r
-INSTRUCTIONS:\r
-Inside the ListenReaderField() function, there is two mode. \r
-By default, when you call the function, you will enter mode 1.\r
-If you press the PM3 button one time, you will enter mode 2.\r
-If you press the PM3 button a second time, you will exit the function.\r
-\r
-DESCRIPTION OF MODE 1:\r
-This mode just listens for an external reader field and lights up green \r
-for HF and/or red for LF. This is the original mode of the detectreader\r
-function.\r
-\r
-DESCRIPTION OF MODE 2:\r
-This mode will visually represent, using the LEDs, the actual strength of the\r
-current compared to the maximum current detected. Basically, once you know \r
-what kind of external reader is present, it will help you spot the best location to place\r
-your antenna. You will probably not get some good results if there is a LF and a HF reader\r
-at the same place! :-)\r
-\r
-LIGHT SCHEME USED:\r
-\r
-Light scheme | Descriptiong\r
-----------------------------------------------------\r
-    ----     | No field detected\r
-    X---     | 14% of maximum current detected\r
-    -X--     | 29% of maximum current detected\r
-    --X-     | 43% of maximum current detected\r
-    ---X     | 57% of maximum current detected\r
-    --XX     | 71% of maximum current detected\r
-    -XXX     | 86% of maximum current detected\r
-    XXXX     | 100% of maximum current detected\r
-\r
-TODO:\r
-Add the LF part for MODE 2\r
-\r
-*/\r
-void ListenReaderField(int limit)\r
-{\r
-       int lf_av, lf_av_new, lf_baseline= 0, lf_count= 0;\r
-       int hf_av, hf_av_new,  hf_baseline= 0, hf_count= 0, hf_max;\r
-       int mode=1;\r
-\r
-#define LF_ONLY                1\r
-#define HF_ONLY                2\r
-\r
-       LED_A_OFF();\r
-       LED_B_OFF();\r
-       LED_C_OFF();\r
-       LED_D_OFF();\r
-\r
-       lf_av= ReadAdc(ADC_CHAN_LF);\r
-\r
-       if(limit != HF_ONLY) \r
-               {\r
-               DbpString("LF 125/134 Baseline:");\r
-               DbpIntegers(lf_av,0,0);\r
-               lf_baseline= lf_av;\r
-               }\r
-\r
-       hf_av=hf_max=ReadAdc(ADC_CHAN_HF);\r
-\r
-       if (limit != LF_ONLY) \r
-               {\r
-               DbpString("HF 13.56 Baseline:");\r
-               DbpIntegers(hf_av,0,0);\r
-               hf_baseline= hf_av;\r
-               }\r
-\r
-       for(;;) \r
-               {\r
-               if (BUTTON_PRESS()) {\r
-                       SpinDelay(500);\r
-                       switch (mode) {\r
-                               case 1:\r
-                                       mode=2;\r
-                                       DbpString("Signal Strength Mode");
-                                       break;\r
-                               case 2:\r
-                               default:\r
-                                       DbpString("Stopped");\r
-                                       LED_A_OFF();\r
-                                       LED_B_OFF();\r
-                                       LED_C_OFF();\r
-                                       LED_D_OFF();\r
-                                       return;\r
-                                       break;\r
-                       }\r
-               }\r
-               WDT_HIT();\r
-\r
-               if (limit != HF_ONLY) \r
-                       {\r
-                       if (abs(lf_av - lf_baseline) > 10)\r
-                               LED_D_ON();\r
-                       else\r
-                               LED_D_OFF();\r
-                       ++lf_count;\r
-                       lf_av_new= ReadAdc(ADC_CHAN_LF);\r
-                       // see if there's a significant change\r
-                       if(abs(lf_av - lf_av_new) > 10) \r
-                               {\r
-                               DbpString("LF 125/134 Field Change:");\r
-                               DbpIntegers(lf_av,lf_av_new,lf_count);\r
-                               lf_av= lf_av_new;\r
-                               lf_count= 0;\r
-                               }\r
-                       }\r
-\r
-               if (limit != LF_ONLY) \r
-                       {\r
-                       if (abs(hf_av - hf_baseline) > 10) {\r
-                               if (mode == 1)\r
-                                       LED_B_ON();\r
-                               if (mode == 2) {\r
-                                       if ( hf_av>(hf_max/7)*6) {\r
-                                               LED_A_ON();     LED_B_ON();     LED_C_ON();     LED_D_ON();\r
-                                       }\r
-                                       if ( (hf_av>(hf_max/7)*5) && (hf_av<=(hf_max/7)*6) ) {\r
-                                               LED_A_ON();     LED_B_ON();     LED_C_OFF(); LED_D_ON();\r
-                                       }\r
-                                       if ( (hf_av>(hf_max/7)*4) && (hf_av<=(hf_max/7)*5) ) {\r
-                                               LED_A_OFF(); LED_B_ON(); LED_C_OFF(); LED_D_ON();\r
-                                       }\r
-                                       if ( (hf_av>(hf_max/7)*3) && (hf_av<=(hf_max/7)*4) ) {\r
-                                               LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); LED_D_ON();\r
-                                       }\r
-                                       if ( (hf_av>(hf_max/7)*2) && (hf_av<=(hf_max/7)*3) ) {\r
-                                               LED_A_OFF(); LED_B_ON(); LED_C_OFF(); LED_D_OFF();\r
-                                       }\r
-                                       if ( (hf_av>(hf_max/7)*1) && (hf_av<=(hf_max/7)*2) ) {\r
-                                               LED_A_ON();     LED_B_OFF(); LED_C_OFF(); LED_D_OFF();\r
-                                       }\r
-                                       if ( (hf_av>(hf_max/7)*0) && (hf_av<=(hf_max/7)*1) ) {\r
-                                               LED_A_OFF(); LED_B_OFF(); LED_C_ON(); LED_D_OFF();\r
-                                       }\r
-                               } \r
-                       } else {\r
-                               if (mode == 1) {\r
-                                       LED_B_OFF();\r
-                               }\r
-                               if (mode == 2) {\r
-                                       LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); LED_D_OFF();\r
-                               }\r
-                       }\r
-\r
-                       ++hf_count;\r
-                       hf_av_new= ReadAdc(ADC_CHAN_HF);\r
-                       // see if there's a significant change\r
-                       if(abs(hf_av - hf_av_new) > 10) \r
-                               {\r
-                               DbpString("HF 13.56 Field Change:");\r
-                               DbpIntegers(hf_av,hf_av_new,hf_count);\r
-                               hf_av= hf_av_new;\r
-                               if (hf_av > hf_max)\r
-                                       hf_max = hf_av;\r
-                               hf_count= 0;\r
-                               }\r
-                       }\r
-               }\r
-}\r
-\r
index 3fdb6169479047ba78e445cf7ba472cdad413a82..11084ad7d00be26e4f7364037d9cf9cb3ae0fdd5 100644 (file)
@@ -7,7 +7,11 @@
 #ifndef __APPS_H\r
 #define __APPS_H\r
 \r
 #ifndef __APPS_H\r
 #define __APPS_H\r
 \r
-/// appmain.c\r
+// The large multi-purpose buffer, typically used to hold A/D samples,\r
+// maybe processed in some way.\r
+DWORD BigBuf[16000];\r
+\r
+/// appmain.h\r
 void ReadMem(int addr);\r
 void AppMain(void);\r
 void SamyRun(void);\r
 void ReadMem(int addr);\r
 void AppMain(void);\r
 void SamyRun(void);\r
@@ -22,7 +26,7 @@ extern int ToSendMax;
 extern BYTE ToSend[];\r
 extern DWORD BigBuf[];\r
 \r
 extern BYTE ToSend[];\r
 extern DWORD BigBuf[];\r
 \r
-/// fpga.c\r
+/// fpga.h\r
 void FpgaSendCommand(WORD cmd, WORD v);\r
 void FpgaWriteConfWord(BYTE v);\r
 void FpgaDownloadAndGo(void);\r
 void FpgaSendCommand(WORD cmd, WORD v);\r
 void FpgaWriteConfWord(BYTE v);\r
 void FpgaDownloadAndGo(void);\r
@@ -58,6 +62,18 @@ void SetAdcMuxFor(int whichGpio);
 #define FPGA_HF_ISO14443A_READER_LISTEN                        (3<<0)\r
 #define FPGA_HF_ISO14443A_READER_MOD                           (4<<0)\r
 \r
 #define FPGA_HF_ISO14443A_READER_LISTEN                        (3<<0)\r
 #define FPGA_HF_ISO14443A_READER_MOD                           (4<<0)\r
 \r
+/// lfops.h\r
+void AcquireRawAdcSamples125k(BOOL at134khz);\r
+void DoAcquisition125k(BOOL at134khz);\r
+void ModThenAcquireRawAdcSamples125k(int delay_off,int period_0,int period_1,BYTE *command);\r
+void ReadTItag();\r
+void WriteTItag(DWORD idhi, DWORD idlo, WORD crc);\r
+void AcquireTiType(void);\r
+void AcquireRawBitsTI(void);\r
+void SimulateTagLowFrequency(int period, int ledcontrol);\r
+void CmdHIDsimTAG(int hi, int lo, int ledcontrol);\r
+void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol);\r
+\r
 /// iso14443.h\r
 void SimulateIso14443Tag(void);\r
 void AcquireRawAdcSamplesIso14443(DWORD parameter);\r
 /// iso14443.h\r
 void SimulateIso14443Tag(void);\r
 void AcquireRawAdcSamplesIso14443(DWORD parameter);\r
diff --git a/armsrc/lfops.c b/armsrc/lfops.c
new file mode 100644 (file)
index 0000000..9fe60de
--- /dev/null
@@ -0,0 +1,654 @@
+//-----------------------------------------------------------------------------\r
+// Miscellaneous routines for low frequency tag operations.\r
+// Tags supported here so far are Texas Instruments (TI), HID\r
+// Also routines for raw mode reading/simulating of LF waveform\r
+//\r
+//-----------------------------------------------------------------------------\r
+#include <proxmark3.h>\r
+#include "apps.h"\r
+#include "../common/crc16.c"\r
+\r
+void AcquireRawAdcSamples125k(BOOL at134khz)\r
+{\r
+       if(at134khz) {\r
+               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
+               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+       } else {\r
+               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz\r
+               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+       }\r
+\r
+       // Connect the A/D to the peak-detected low-frequency path.\r
+       SetAdcMuxFor(GPIO_MUXSEL_LOPKD);\r
+\r
+       // Give it a bit of time for the resonant antenna to settle.\r
+       SpinDelay(50);\r
+\r
+       // Now set up the SSC to get the ADC samples that are now streaming at us.\r
+       FpgaSetupSsc();\r
+\r
+       // Now call the acquisition routine\r
+       DoAcquisition125k(at134khz);\r
+}\r
+\r
+// split into two routines so we can avoid timing issues after sending commands //\r
+void DoAcquisition125k(BOOL at134khz)\r
+{\r
+       BYTE *dest = (BYTE *)BigBuf;\r
+       int n = sizeof(BigBuf);\r
+       int i;\r
+\r
+       memset(dest,0,n);\r
+       i = 0;\r
+       for(;;) {\r
+               if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
+                       SSC_TRANSMIT_HOLDING = 0x43;\r
+                       LED_D_ON();\r
+               }\r
+               if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
+                       dest[i] = (BYTE)SSC_RECEIVE_HOLDING;\r
+                       i++;\r
+                       LED_D_OFF();\r
+                       if(i >= n) {\r
+                               break;\r
+                       }\r
+               }\r
+       }\r
+       DbpIntegers(dest[0], dest[1], at134khz);\r
+}\r
+\r
+void ModThenAcquireRawAdcSamples125k(int delay_off,int period_0,int period_1,BYTE *command)\r
+{\r
+       BOOL at134khz;\r
+\r
+       // see if 'h' was specified\r
+       if(command[strlen((char *) command) - 1] == 'h')\r
+               at134khz= TRUE;\r
+       else\r
+               at134khz= FALSE;\r
+\r
+       if(at134khz) {\r
+               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
+               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+       } else {\r
+               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz\r
+               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+       }\r
+\r
+       // Give it a bit of time for the resonant antenna to settle.\r
+       SpinDelay(50);\r
+\r
+       // Now set up the SSC to get the ADC samples that are now streaming at us.\r
+       FpgaSetupSsc();\r
+\r
+       // now modulate the reader field\r
+       while(*command != '\0' && *command != ' ')\r
+               {\r
+               FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+               LED_D_OFF();\r
+               SpinDelayUs(delay_off);\r
+               if(at134khz) {\r
+                       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
+                       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+               } else {\r
+                       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz\r
+                       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+               }\r
+               LED_D_ON();\r
+               if(*(command++) == '0')\r
+                       SpinDelayUs(period_0);\r
+               else\r
+                       SpinDelayUs(period_1);\r
+               }\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+       LED_D_OFF();\r
+       SpinDelayUs(delay_off);\r
+       if(at134khz) {\r
+               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
+               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+       } else {\r
+               FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz\r
+               FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+       }\r
+\r
+       // now do the read\r
+       DoAcquisition125k(at134khz);\r
+}\r
+\r
+void AcquireTiType(void)\r
+{\r
+       int i;\r
+       // tag transmission is <20ms, sampling at 2M gives us 40K samples max\r
+       // each sample is 1 bit stuffed into a DWORD so we need 1250 DWORDS\r
+       int n = 1250;\r
+\r
+       // clear buffer\r
+       memset(BigBuf,0,sizeof(BigBuf));\r
+\r
+       // Set up the synchronous serial port\r
+  PIO_DISABLE = (1<<GPIO_SSC_DIN);\r
+  PIO_PERIPHERAL_A_SEL = (1<<GPIO_SSC_DIN);\r
+\r
+       // steal this pin from the SSP and use it to control the modulation\r
+  PIO_ENABLE = (1<<GPIO_SSC_DOUT);\r
+       PIO_OUTPUT_ENABLE       = (1<<GPIO_SSC_DOUT);\r
+\r
+  SSC_CONTROL = SSC_CONTROL_RESET;\r
+  SSC_CONTROL = SSC_CONTROL_RX_ENABLE | SSC_CONTROL_TX_ENABLE;\r
+\r
+  // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long\r
+  // 48/2 = 24 MHz clock must be divided by 12\r
+  SSC_CLOCK_DIVISOR = 12;\r
+\r
+  SSC_RECEIVE_CLOCK_MODE = SSC_CLOCK_MODE_SELECT(0);\r
+       SSC_RECEIVE_FRAME_MODE = SSC_FRAME_MODE_BITS_IN_WORD(32) | SSC_FRAME_MODE_MSB_FIRST;\r
+       SSC_TRANSMIT_CLOCK_MODE = 0;\r
+       SSC_TRANSMIT_FRAME_MODE = 0;\r
+\r
+       LED_D_ON();\r
+\r
+       // modulate antenna\r
+       PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);\r
+\r
+       // Charge TI tag for 50ms.\r
+       SpinDelay(50);\r
+\r
+       // stop modulating antenna and listen\r
+       PIO_OUTPUT_DATA_CLEAR = (1<<GPIO_SSC_DOUT);\r
+\r
+       LED_D_OFF();\r
+\r
+       i = 0;\r
+       for(;;) {\r
+                       if(SSC_STATUS & SSC_STATUS_RX_READY) {\r
+                                       BigBuf[i] = SSC_RECEIVE_HOLDING;        // store 32 bit values in buffer\r
+                                       i++; if(i >= n) return;\r
+                       }\r
+                       WDT_HIT();\r
+       }\r
+\r
+       // return stolen pin to SSP\r
+       PIO_DISABLE = (1<<GPIO_SSC_DOUT);\r
+       PIO_PERIPHERAL_A_SEL = (1<<GPIO_SSC_DIN) | (1<<GPIO_SSC_DOUT);\r
+}\r
+\r
+void ReadTItag()\r
+{\r
+}\r
+\r
+void WriteTIbyte(BYTE b)\r
+{\r
+       int i = 0;\r
+\r
+       // modulate 8 bits out to the antenna\r
+       for (i=0; i<8; i++)\r
+       {\r
+               if (b&(1<<i)) {\r
+                       // stop modulating antenna\r
+                       PIO_OUTPUT_DATA_CLEAR = (1<<GPIO_SSC_DOUT);\r
+                       SpinDelayUs(1000);\r
+                       // modulate antenna\r
+                       PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);\r
+                       SpinDelayUs(1000);\r
+               } else {\r
+                       // stop modulating antenna\r
+                       PIO_OUTPUT_DATA_CLEAR = (1<<GPIO_SSC_DOUT);\r
+                       SpinDelayUs(300);\r
+                       // modulate antenna\r
+                       PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);\r
+                       SpinDelayUs(1700);\r
+               }\r
+       }\r
+}\r
+\r
+void AcquireRawBitsTI(void)\r
+{\r
+       // TI tags charge at 134.2Khz\r
+       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
+\r
+       // Place FPGA in passthrough mode, in this mode the CROSS_LO line\r
+       // connects to SSP_DIN and the SSP_DOUT logic level controls\r
+       // whether we're modulating the antenna (high)\r
+       // or listening to the antenna (low)\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);\r
+\r
+       // get TI tag data into the buffer\r
+       AcquireTiType();\r
+\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+}\r
+\r
+// this is a dummy function to get around\r
+// a possible flash bug in the bootloader\r
+// delete once you've added more code.\r
+void DummyDummyDummy(void)\r
+{\r
+       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);\r
+       AcquireTiType();\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+}\r
+\r
+// arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc\r
+// if crc provided, it will be written with the data verbatim (even if bogus)\r
+// if not provided a valid crc will be computed from the data and written.\r
+void WriteTItag(DWORD idhi, DWORD idlo, WORD crc)\r
+{\r
+\r
+       // WARNING the order of the bytes in which we calc crc below needs checking\r
+       // i'm 99% sure the crc algorithm is correct, but it may need to eat the\r
+       // bytes in reverse or something\r
+\r
+       if(crc == 0) {\r
+               crc = update_crc16(crc, (idlo)&0xff);\r
+               crc = update_crc16(crc, (idlo>>8)&0xff);\r
+               crc = update_crc16(crc, (idlo>>16)&0xff);\r
+               crc = update_crc16(crc, (idlo>>24)&0xff);\r
+               crc = update_crc16(crc, (idhi)&0xff);\r
+               crc = update_crc16(crc, (idhi>>8)&0xff);\r
+               crc = update_crc16(crc, (idhi>>16)&0xff);\r
+               crc = update_crc16(crc, (idhi>>24)&0xff);\r
+       }\r
+       DbpString("Writing the following data to tag:");\r
+       DbpIntegers(idhi, idlo, crc);\r
+\r
+       // TI tags charge at 134.2Khz\r
+       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz\r
+       // Place FPGA in passthrough mode, in this mode the CROSS_LO line\r
+       // connects to SSP_DIN and the SSP_DOUT logic level controls\r
+       // whether we're modulating the antenna (high)\r
+       // or listening to the antenna (low)\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);\r
+       LED_A_ON();\r
+\r
+       // steal this pin from the SSP and use it to control the modulation\r
+  PIO_ENABLE = (1<<GPIO_SSC_DOUT);\r
+       PIO_OUTPUT_ENABLE       = (1<<GPIO_SSC_DOUT);\r
+\r
+       // writing algorithm:\r
+       // a high bit consists of a field off for 1ms and field on for 1ms\r
+       // a low bit consists of a field off for 0.3ms and field on for 1.7ms\r
+       // initiate a charge time of 50ms (field on) then immediately start writing bits\r
+       // start by writing 0xBB (keyword) and 0xEB (password)\r
+       // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer)\r
+       // finally end with 0x0300 (write frame)\r
+       // all data is sent lsb firts\r
+       // finish with 15ms programming time\r
+\r
+       // modulate antenna\r
+       PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);\r
+       SpinDelay(50);  // charge time\r
+\r
+       WriteTIbyte(0xbb); // keyword\r
+       WriteTIbyte(0xeb); // password\r
+       WriteTIbyte( (idlo    )&0xff );\r
+       WriteTIbyte( (idlo>>8 )&0xff );\r
+       WriteTIbyte( (idlo>>16)&0xff );\r
+       WriteTIbyte( (idlo>>24)&0xff );\r
+       WriteTIbyte( (idhi    )&0xff );\r
+       WriteTIbyte( (idhi>>8 )&0xff );\r
+       WriteTIbyte( (idhi>>16)&0xff );\r
+       WriteTIbyte( (idhi>>24)&0xff ); // data hi to lo\r
+       WriteTIbyte( (crc     )&0xff ); // crc lo\r
+       WriteTIbyte( (crc>>8  )&0xff ); // crc hi\r
+       WriteTIbyte(0x00); // write frame lo\r
+       WriteTIbyte(0x03); // write frame hi\r
+       PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);\r
+       SpinDelay(50);  // programming time\r
+\r
+       LED_A_OFF();\r
+\r
+       // get TI tag data into the buffer\r
+       AcquireTiType();\r
+\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+       DbpString("Now use tibits and tidemod");\r
+}\r
+\r
+void SimulateTagLowFrequency(int period, int ledcontrol)\r
+{\r
+       int i;\r
+       BYTE *tab = (BYTE *)BigBuf;\r
+\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR);\r
+\r
+       PIO_ENABLE = (1 << GPIO_SSC_DOUT) | (1 << GPIO_SSC_CLK);\r
+\r
+       PIO_OUTPUT_ENABLE = (1 << GPIO_SSC_DOUT);\r
+       PIO_OUTPUT_DISABLE = (1 << GPIO_SSC_CLK);\r
+\r
+#define SHORT_COIL()   LOW(GPIO_SSC_DOUT)\r
+#define OPEN_COIL()    HIGH(GPIO_SSC_DOUT)\r
+\r
+       i = 0;\r
+       for(;;) {\r
+               while(!(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK))) {\r
+                       if(BUTTON_PRESS()) {\r
+                               DbpString("Stopped");\r
+                               return;\r
+                       }\r
+                       WDT_HIT();\r
+               }\r
+\r
+               if (ledcontrol)\r
+                       LED_D_ON();\r
+\r
+               if(tab[i])\r
+                       OPEN_COIL();\r
+               else\r
+                       SHORT_COIL();\r
+\r
+               if (ledcontrol)\r
+                       LED_D_OFF();\r
+\r
+               while(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK)) {\r
+                       if(BUTTON_PRESS()) {\r
+                               DbpString("Stopped");\r
+                               return;\r
+                       }\r
+                       WDT_HIT();\r
+               }\r
+\r
+               i++;\r
+               if(i == period) i = 0;\r
+       }\r
+}\r
+\r
+// compose fc/8 fc/10 waveform\r
+static void fc(int c, int *n) {\r
+       BYTE *dest = (BYTE *)BigBuf;\r
+       int idx;\r
+\r
+       // for when we want an fc8 pattern every 4 logical bits\r
+       if(c==0) {\r
+               dest[((*n)++)]=1;\r
+               dest[((*n)++)]=1;\r
+               dest[((*n)++)]=0;\r
+               dest[((*n)++)]=0;\r
+               dest[((*n)++)]=0;\r
+               dest[((*n)++)]=0;\r
+               dest[((*n)++)]=0;\r
+               dest[((*n)++)]=0;\r
+       }\r
+       //      an fc/8  encoded bit is a bit pattern of  11000000  x6 = 48 samples\r
+       if(c==8) {\r
+               for (idx=0; idx<6; idx++) {\r
+                       dest[((*n)++)]=1;\r
+                       dest[((*n)++)]=1;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+               }\r
+       }\r
+\r
+       //      an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples\r
+       if(c==10) {\r
+               for (idx=0; idx<5; idx++) {\r
+                       dest[((*n)++)]=1;\r
+                       dest[((*n)++)]=1;\r
+                       dest[((*n)++)]=1;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+                       dest[((*n)++)]=0;\r
+               }\r
+       }\r
+}\r
+\r
+// prepare a waveform pattern in the buffer based on the ID given then\r
+// simulate a HID tag until the button is pressed\r
+void CmdHIDsimTAG(int hi, int lo, int ledcontrol)\r
+{\r
+       int n=0, i=0;\r
+       /*\r
+        HID tag bitstream format\r
+        The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits\r
+        A 1 bit is represented as 6 fc8 and 5 fc10 patterns\r
+        A 0 bit is represented as 5 fc10 and 6 fc8 patterns\r
+        A fc8 is inserted before every 4 bits\r
+        A special start of frame pattern is used consisting a0b0 where a and b are neither 0\r
+        nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)\r
+       */\r
+\r
+       if (hi>0xFFF) {\r
+               DbpString("Tags can only have 44 bits.");\r
+               return;\r
+       }\r
+       fc(0,&n);\r
+       // special start of frame marker containing invalid bit sequences\r
+       fc(8,  &n);     fc(8,  &n);     // invalid\r
+       fc(8,  &n);     fc(10, &n); // logical 0\r
+       fc(10, &n);     fc(10, &n); // invalid\r
+       fc(8,  &n);     fc(10, &n); // logical 0\r
+\r
+       WDT_HIT();\r
+       // manchester encode bits 43 to 32\r
+       for (i=11; i>=0; i--) {\r
+               if ((i%4)==3) fc(0,&n);\r
+               if ((hi>>i)&1) {\r
+                       fc(10, &n);     fc(8,  &n);             // low-high transition\r
+               } else {\r
+                       fc(8,  &n);     fc(10, &n);             // high-low transition\r
+               }\r
+       }\r
+\r
+       WDT_HIT();\r
+       // manchester encode bits 31 to 0\r
+       for (i=31; i>=0; i--) {\r
+               if ((i%4)==3) fc(0,&n);\r
+               if ((lo>>i)&1) {\r
+                       fc(10, &n);     fc(8,  &n);             // low-high transition\r
+               } else {\r
+                       fc(8,  &n);     fc(10, &n);             // high-low transition\r
+               }\r
+       }\r
+\r
+       if (ledcontrol)\r
+               LED_A_ON();\r
+       SimulateTagLowFrequency(n, ledcontrol);\r
+\r
+       if (ledcontrol)\r
+               LED_A_OFF();\r
+}\r
+\r
+\r
+// loop to capture raw HID waveform then FSK demodulate the TAG ID from it\r
+void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)\r
+{\r
+       BYTE *dest = (BYTE *)BigBuf;\r
+       int m=0, n=0, i=0, idx=0, found=0, lastval=0;\r
+       DWORD hi=0, lo=0;\r
+\r
+       FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz\r
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);\r
+\r
+       // Connect the A/D to the peak-detected low-frequency path.\r
+       SetAdcMuxFor(GPIO_MUXSEL_LOPKD);\r
+\r
+       // Give it a bit of time for the resonant antenna to settle.\r
+       SpinDelay(50);\r
+\r
+       // Now set up the SSC to get the ADC samples that are now streaming at us.\r
+       FpgaSetupSsc();\r
+\r
+       for(;;) {\r
+               WDT_HIT();\r
+               if (ledcontrol)\r
+                       LED_A_ON();\r
+               if(BUTTON_PRESS()) {\r
+                       DbpString("Stopped");\r
+                       if (ledcontrol)\r
+                               LED_A_OFF();\r
+                       return;\r
+               }\r
+\r
+               i = 0;\r
+               m = sizeof(BigBuf);\r
+               memset(dest,128,m);\r
+               for(;;) {\r
+                       if(SSC_STATUS & (SSC_STATUS_TX_READY)) {\r
+                               SSC_TRANSMIT_HOLDING = 0x43;\r
+                               if (ledcontrol)\r
+                                       LED_D_ON();\r
+                       }\r
+                       if(SSC_STATUS & (SSC_STATUS_RX_READY)) {\r
+                               dest[i] = (BYTE)SSC_RECEIVE_HOLDING;\r
+                               // we don't care about actual value, only if it's more or less than a\r
+                               // threshold essentially we capture zero crossings for later analysis\r
+                               if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;\r
+                               i++;\r
+                               if (ledcontrol)\r
+                                       LED_D_OFF();\r
+                               if(i >= m) {\r
+                                       break;\r
+                               }\r
+                       }\r
+               }\r
+\r
+               // FSK demodulator\r
+\r
+               // sync to first lo-hi transition\r
+               for( idx=1; idx<m; idx++) {\r
+                       if (dest[idx-1]<dest[idx])\r
+                               lastval=idx;\r
+                               break;\r
+               }\r
+               WDT_HIT();\r
+\r
+               // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)\r
+               // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere\r
+               // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10\r
+               for( i=0; idx<m; idx++) {\r
+                       if (dest[idx-1]<dest[idx]) {\r
+                               dest[i]=idx-lastval;\r
+                               if (dest[i] <= 8) {\r
+                                               dest[i]=1;\r
+                               } else {\r
+                                               dest[i]=0;\r
+                               }\r
+\r
+                               lastval=idx;\r
+                               i++;\r
+                       }\r
+               }\r
+               m=i;\r
+               WDT_HIT();\r
+\r
+               // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns\r
+               lastval=dest[0];\r
+               idx=0;\r
+               i=0;\r
+               n=0;\r
+               for( idx=0; idx<m; idx++) {\r
+                       if (dest[idx]==lastval) {\r
+                               n++;\r
+                       } else {\r
+                               // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,\r
+                               // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets\r
+                               // swallowed up by rounding\r
+                               // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding\r
+                               // special start of frame markers use invalid manchester states (no transitions) by using sequences\r
+                               // like 111000\r
+                               if (dest[idx-1]) {\r
+                                       n=(n+1)/6;                      // fc/8 in sets of 6\r
+                               } else {\r
+                                       n=(n+1)/5;                      // fc/10 in sets of 5\r
+                               }\r
+                               switch (n) {                    // stuff appropriate bits in buffer\r
+                                       case 0:\r
+                                       case 1: // one bit\r
+                                               dest[i++]=dest[idx-1];\r
+                                               break;\r
+                                       case 2: // two bits\r
+                                               dest[i++]=dest[idx-1];\r
+                                               dest[i++]=dest[idx-1];\r
+                                               break;\r
+                                       case 3: // 3 bit start of frame markers\r
+                                               dest[i++]=dest[idx-1];\r
+                                               dest[i++]=dest[idx-1];\r
+                                               dest[i++]=dest[idx-1];\r
+                                               break;\r
+                                       // When a logic 0 is immediately followed by the start of the next transmisson\r
+                                       // (special pattern) a pattern of 4 bit duration lengths is created.\r
+                                       case 4:\r
+                                               dest[i++]=dest[idx-1];\r
+                                               dest[i++]=dest[idx-1];\r
+                                               dest[i++]=dest[idx-1];\r
+                                               dest[i++]=dest[idx-1];\r
+                                               break;\r
+                                       default:        // this shouldn't happen, don't stuff any bits\r
+                                               break;\r
+                               }\r
+                               n=0;\r
+                               lastval=dest[idx];\r
+                       }\r
+               }\r
+               m=i;\r
+               WDT_HIT();\r
+\r
+               // final loop, go over previously decoded manchester data and decode into usable tag ID\r
+               // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0\r
+               for( idx=0; idx<m-6; idx++) {\r
+                       // search for a start of frame marker\r
+                       if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )\r
+                       {\r
+                               found=1;\r
+                               idx+=6;\r
+                               if (found && (hi|lo)) {\r
+                                       DbpString("TAG ID");\r
+                                       DbpIntegers(hi, lo, (lo>>1)&0xffff);\r
+                                       /* if we're only looking for one tag */\r
+                                       if (findone)\r
+                                       {\r
+                                               *high = hi;\r
+                                               *low = lo;\r
+                                               return;\r
+                                       }\r
+                                       hi=0;\r
+                                       lo=0;\r
+                                       found=0;\r
+                               }\r
+                       }\r
+                       if (found) {\r
+                               if (dest[idx] && (!dest[idx+1]) ) {\r
+                                       hi=(hi<<1)|(lo>>31);\r
+                                       lo=(lo<<1)|0;\r
+                               } else if ( (!dest[idx]) && dest[idx+1]) {\r
+                                       hi=(hi<<1)|(lo>>31);\r
+                                       lo=(lo<<1)|1;\r
+                               } else {\r
+                                       found=0;\r
+                                       hi=0;\r
+                                       lo=0;\r
+                               }\r
+                               idx++;\r
+                       }\r
+                       if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )\r
+                       {\r
+                               found=1;\r
+                               idx+=6;\r
+                               if (found && (hi|lo)) {\r
+                                       DbpString("TAG ID");\r
+                                       DbpIntegers(hi, lo, (lo>>1)&0xffff);\r
+                                       /* if we're only looking for one tag */\r
+                                       if (findone)\r
+                                       {\r
+                                               *high = hi;\r
+                                               *low = lo;\r
+                                               return;\r
+                                       }\r
+                                       hi=0;\r
+                                       lo=0;\r
+                                       found=0;\r
+                               }\r
+                       }\r
+               }\r
+               WDT_HIT();\r
+       }\r
+}\r
index 6cdf3ea3b2023e91efb8717ea104bb37e3682bb0..1497ecf6c9f02265526ee7f48aeecef6fdcd7ff0 100644 (file)
@@ -1,4 +1,4 @@
-unsigned short update_crc16( WORD crc, BYTE c ) {\r
+WORD update_crc16( WORD crc, BYTE c ) {\r
        WORD i, v, tcrc = 0;\r
 \r
        v = (crc ^ c) & 0xff;\r
        WORD i, v, tcrc = 0;\r
 \r
        v = (crc ^ c) & 0xff;\r
@@ -7,5 +7,5 @@ unsigned short update_crc16( WORD crc, BYTE c ) {
       v >>= 1;\r
   }\r
 \r
       v >>= 1;\r
   }\r
 \r
-  return (crc >> 8) ^ tcrc;\r
+  return ((crc >> 8) ^ tcrc)&0xffff;\r
 }\r
 }\r
index dff02a3327bcd10fff82db3098ab0327cdcb2ce9..8245bae2ecff3704d455c8dba93aa78c1902ff46 100644 (file)
@@ -20,60 +20,59 @@ typedef struct {
 } UsbCommand;\r
 \r
 // For the bootloader\r
 } UsbCommand;\r
 \r
 // For the bootloader\r
-#define CMD_DEVICE_INFO                                                                0x0000\r
-#define CMD_SETUP_WRITE                                                                0x0001\r
-#define CMD_FINISH_WRITE                                                       0x0003\r
-#define CMD_HARDWARE_RESET                                                     0x0004\r
-#define CMD_START_FLASH                                                                0x0005
-#define CMD_ACK                                                                                0x00ff\r
+#define CMD_DEVICE_INFO                                                                                                                                0x0000\r
+#define CMD_SETUP_WRITE                                                                                                                                0x0001\r
+#define CMD_FINISH_WRITE                                                                                                                       0x0003\r
+#define CMD_HARDWARE_RESET                                                                                                             0x0004\r
+#define CMD_START_FLASH                                                                                                                                0x0005\r
+#define CMD_ACK                                                                                                                                                                0x00ff\r
 \r
 // For general mucking around\r
 \r
 // For general mucking around\r
-#define CMD_DEBUG_PRINT_STRING                                         0x0100\r
-#define CMD_DEBUG_PRINT_INTEGERS                                       0x0101\r
-#define CMD_DEBUG_PRINT_BYTES                                          0x0102\r
-#define CMD_LCD_RESET                                                          0x0103\r
-#define CMD_LCD                                                                                0x0104\r
-#define CMD_BUFF_CLEAR                                                         0x0105
-#define CMD_READ_MEM                                                           0x0106
+#define CMD_DEBUG_PRINT_STRING                                                                                         0x0100\r
+#define CMD_DEBUG_PRINT_INTEGERS                                                                                       0x0101\r
+#define CMD_DEBUG_PRINT_BYTES                                                                                                  0x0102\r
+#define CMD_LCD_RESET                                                                                                                                  0x0103\r
+#define CMD_LCD                                                                                                                                                                0x0104\r
+#define CMD_BUFF_CLEAR                                                                                                                         0x0105\r
+#define CMD_READ_MEM                                                                                                                                   0x0106\r
 \r
 // For low-frequency tags\r
 \r
 // For low-frequency tags\r
-#define CMD_ACQUIRE_RAW_BITS_TI_TYPE                           0x0200\r
-#define CMD_DOWNLOAD_RAW_BITS_TI_TYPE                          0x0201\r
-#define CMD_DOWNLOADED_RAW_BITS_TI_TYPE                                0x0202\r
-#define CMD_ACQUIRE_RAW_ADC_SAMPLES_125K                       0x0203\r
-#define CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K                      0x0204\r
-#define CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K                    0x0205\r
-#define CMD_DOWNLOADED_SIM_SAMPLES_125K                                0x0206\r
-#define CMD_SIMULATE_TAG_125K                                          0x0207\r
-#define CMD_HID_DEMOD_FSK                                                      0x0208  // ## New command: demodulate HID tag ID\r
-#define CMD_HID_SIM_TAG                                                                0x0209  // ## New command: simulate HID tag by ID\r
-#define CMD_SET_LF_DIVISOR                                                     0x020A\r
-#define CMD_SWEEP_LF                                                           0x020B\r
-#define CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K                      0x020C\r
+#define CMD_ACQUIRE_RAW_BITS_TI_TYPE                                                                   0x0200\r
+#define CMD_DOWNLOAD_RAW_BITS_TI_TYPE                                                                  0x0201\r
+#define CMD_READ_TI_TYPE                                                                                                                       0x0202\r
+#define CMD_WRITE_TI_TYPE                                                                                                                      0x0203\r
+#define CMD_DOWNLOADED_RAW_BITS_TI_TYPE                                                                0x0204\r
+#define CMD_ACQUIRE_RAW_ADC_SAMPLES_125K                                                       0x0205\r
+#define CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K                      0x0206\r
+#define CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K                                                      0x0207\r
+#define CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K                                            0x0208\r
+#define CMD_DOWNLOADED_SIM_SAMPLES_125K                                                                0x0209\r
+#define CMD_SIMULATE_TAG_125K                                                                                                  0x020A\r
+#define CMD_HID_DEMOD_FSK                                                                                                                      0x020B\r
+#define CMD_HID_SIM_TAG                                                                                                                                0x020C\r
+#define CMD_SET_LF_DIVISOR                                                                                                             0x020D\r
 \r
 // For the 13.56 MHz tags\r
 \r
 // For the 13.56 MHz tags\r
-#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693          0x0300\r
-#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443          0x0301\r
-#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443_SIM      0x0302
-#define CMD_READ_SRI512_TAG                                                    0x0303\r
-#define CMD_READER_ISO_15693                                           0x0310  // ## New command to act like a 15693 reader - greg\r
-#define CMD_SIMTAG_ISO_15693                                           0x0311  // ## New command to act like a 15693 reader - greg\r
-\r
-#define CMD_SIMULATE_TAG_HF_LISTEN                                     0x0380\r
-#define CMD_SIMULATE_TAG_ISO_14443                                     0x0381\r
-#define CMD_SNOOP_ISO_14443                                                    0x0382\r
-#define CMD_SNOOP_ISO_14443a                                           0x0383  // ## New snoop command\r
-#define CMD_SIMULATE_TAG_ISO_14443a                                    0x0384  // ## New command: Simulate tag 14443a\r
-#define CMD_READER_ISO_14443a                                          0x0385  // ## New command to act like a 14443a reader\r
-#define CMD_SIMULATE_MIFARE_CARD                                       0x0386\r
+#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693                                  0x0300\r
+#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443                                  0x0301\r
+#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443_SIM                      0x0302\r
+#define CMD_READ_SRI512_TAG                                                                                                            0x0303\r
+#define CMD_READER_ISO_15693                                                                                                   0x0310\r
+#define CMD_SIMTAG_ISO_15693                                                                                                   0x0311\r
+#define CMD_SIMULATE_TAG_HF_LISTEN                                                                             0x0380\r
+#define CMD_SIMULATE_TAG_ISO_14443                                                                             0x0381\r
+#define CMD_SNOOP_ISO_14443                                                                                                            0x0382\r
+#define CMD_SNOOP_ISO_14443a                                                                                                   0x0383\r
+#define CMD_SIMULATE_TAG_ISO_14443a                                                                            0x0384\r
+#define CMD_READER_ISO_14443a                                                                                                  0x0385\r
+#define CMD_SIMULATE_MIFARE_CARD                                                                                       0x0386\r
 \r
 // For measurements of the antenna tuning\r
 \r
 // For measurements of the antenna tuning\r
-#define CMD_MEASURE_ANTENNA_TUNING                                     0x0400\r
-#define CMD_MEASURED_ANTENNA_TUNING                                    0x0401\r
-#define CMD_LISTEN_READER_FIELD                                                0x0402
+#define CMD_MEASURE_ANTENNA_TUNING                                                                             0x0400\r
+#define CMD_MEASURED_ANTENNA_TUNING                                                                            0x0401\r
+#define CMD_LISTEN_READER_FIELD                                                                                                0x0402\r
 \r
 // For direct FPGA control\r
 \r
 // For direct FPGA control\r
-#define CMD_FPGA_MAJOR_MODE_OFF                                                0x0500  // ## FPGA Control\r
-#define CMD_TEST                                                                       0x0501\r
+#define CMD_FPGA_MAJOR_MODE_OFF                                                                                                0x0500\r
 \r
 #endif\r
 \r
 #endif\r
index 4ac807d969e17f5baa5a2d6a3aa76c36c3e51f0d..5af6c709c61aff22383b470838c4c806d3580681 100644 (file)
@@ -1395,14 +1395,14 @@ static void CmdHi15demod(char *str)
        PrintToScrollback("CRC=%04x", Iso15693Crc(outBuf, k-2));\r
 }\r
 \r
        PrintToScrollback("CRC=%04x", Iso15693Crc(outBuf, k-2));\r
 }\r
 \r
-static void CmdTiread(char *str)\r
+static void CmdTIReadRaw(char *str)\r
 {\r
        UsbCommand c;\r
        c.cmd = CMD_ACQUIRE_RAW_BITS_TI_TYPE;\r
        SendCommand(&c, FALSE);\r
 }\r
 \r
 {\r
        UsbCommand c;\r
        c.cmd = CMD_ACQUIRE_RAW_BITS_TI_TYPE;\r
        SendCommand(&c, FALSE);\r
 }\r
 \r
-static void CmdTibits(char *str)\r
+static void CmdTIBits(char *str)\r
 {\r
        int cnt = 0;\r
        int i;\r
 {\r
        int cnt = 0;\r
        int i;\r
@@ -1554,7 +1554,30 @@ static void CmdFSKdemod(char *cmdline)
        PrintToScrollback("hex: %08x %08x", hi, lo);\r
 }\r
 \r
        PrintToScrollback("hex: %08x %08x", hi, lo);\r
 }\r
 \r
-static void CmdTidemod(char *cmdline)\r
+// read a TI tag and return its ID\r
+static void CmdTIRead(char *str)\r
+{\r
+       UsbCommand c;\r
+       c.cmd = CMD_READ_TI_TYPE;\r
+       SendCommand(&c, FALSE);\r
+}\r
+\r
+// write new data to a r/w TI tag\r
+static void CmdTIWrite(char *str)\r
+{\r
+       UsbCommand c;\r
+       int res=0;\r
+\r
+       c.cmd = CMD_WRITE_TI_TYPE;\r
+       res = sscanf(str, "0x%x 0x%x 0x%x ", &c.ext1, &c.ext2, &c.ext3);\r
+       if (res == 2) c.ext3=0;\r
+       if (res<2)\r
+               PrintToScrollback("Please specify 2 or three hex strings, eg 0x1234 0x5678");\r
+       else \r
+               SendCommand(&c, FALSE);\r
+}\r
+\r
+static void CmdTIDemod(char *cmdline)\r
 {\r
        /* MATLAB as follows:\r
 f_s = 2000000;  % sampling frequency\r
 {\r
        /* MATLAB as follows:\r
 f_s = 2000000;  % sampling frequency\r
@@ -1754,9 +1777,13 @@ h = sign(sin(cumsum(h)));
                // align 16 bit "end bits" or "ident" into lower half of shift3\r
          shift3 >>= 16;\r
 \r
                // align 16 bit "end bits" or "ident" into lower half of shift3\r
          shift3 >>= 16;\r
 \r
-               if ( (shift3^shift0)&0xffff ) {\r
+               // only 15 bits compare, last bit of ident is not valid\r
+               if ( (shift3^shift0)&0x7fff ) {\r
                        PrintToScrollback("Error: Ident mismatch!");\r
                }\r
                        PrintToScrollback("Error: Ident mismatch!");\r
                }\r
+               // WARNING the order of the bytes in which we calc crc below needs checking\r
+               // i'm 99% sure the crc algorithm is correct, but it may need to eat the\r
+               // bytes in reverse or something\r
                // calculate CRC\r
                crc=0;\r
                crc = update_crc16(crc, (shift0)&0xff);\r
                // calculate CRC\r
                crc=0;\r
                crc = update_crc16(crc, (shift0)&0xff);\r
@@ -2841,9 +2868,11 @@ static struct {
        {"scale",                                       CmdScale,                                               1, "<int> -- Set cursor display scale"},\r
        {"setlfdivisor",        CmdSetDivisor,                  0, "<19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)"},\r
        {"sri512read",          CmdSri512read,                  0, "<int> -- Read contents of a SRI512 tag"},\r
        {"scale",                                       CmdScale,                                               1, "<int> -- Set cursor display scale"},\r
        {"setlfdivisor",        CmdSetDivisor,                  0, "<19 - 255> -- Drive LF antenna at 12Mhz/(divisor+1)"},\r
        {"sri512read",          CmdSri512read,                  0, "<int> -- Read contents of a SRI512 tag"},\r
-       {"tibits",                              CmdTibits,                                      0, "Get raw bits for TI-type LF tag"},\r
-       {"tidemod",                             CmdTidemod,                                     1, "Demodulate raw bits for TI-type LF tag"},\r
-       {"tiread",                              CmdTiread,                                      0, "Read a TI-type 134 kHz tag"},\r
+       {"tibits",                              CmdTIBits,                                      0, "Get raw bits for TI-type LF tag"},\r
+       {"tidemod",                             CmdTIDemod,                                     1, "Demodulate raw bits for TI-type LF tag"},\r
+       {"tireadraw",                   CmdTIReadRaw,                           0, "Read a TI-type 134 kHz tag in raw mode"},\r
+       {"tiread",                              CmdTIRead,                                      0, "Read and decode a TI 134 kHz tag"},\r
+       {"tiwrite",                             CmdTIWrite,                                     0, "Write new data to a r/w TI 134 kHz tag"},\r
        {"threshold",                   CmdThreshold,                           1, "Maximize/minimize every value in the graph window depending on threshold"},\r
        {"tune",                                        CmdTune,                                                0, "Measure antenna tuning"},\r
        {"vchdemod",                    CmdVchdemod,                            0, "['clone'] -- Demodulate samples for VeriChip"},\r
        {"threshold",                   CmdThreshold,                           1, "Maximize/minimize every value in the graph window depending on threshold"},\r
        {"tune",                                        CmdTune,                                                0, "Measure antenna tuning"},\r
        {"vchdemod",                    CmdVchdemod,                            0, "['clone'] -- Demodulate samples for VeriChip"},\r
Impressum, Datenschutz