bd20f8f4 |
1 | //----------------------------------------------------------------------------- |
2 | // (c) 2009 Henryk Plötz <henryk@ploetzli.ch> |
3 | // |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
5 | // at your option, any later version. See the LICENSE.txt file for the text of |
6 | // the license. |
7 | //----------------------------------------------------------------------------- |
8 | // LEGIC RF simulation code |
9 | //----------------------------------------------------------------------------- |
a7247d85 |
10 | |
e30c654b |
11 | #include "proxmark3.h" |
a7247d85 |
12 | #include "apps.h" |
f7e3ed82 |
13 | #include "util.h" |
9ab7a6c7 |
14 | #include "string.h" |
a7247d85 |
15 | |
f7e3ed82 |
16 | #include "legicrf.h" |
8e220a91 |
17 | #include "legic_prng.h" |
18 | #include "crc.h" |
19 | |
a7247d85 |
20 | static struct legic_frame { |
ccedd6ae |
21 | int bits; |
a2b1414f |
22 | uint32_t data; |
a7247d85 |
23 | } current_frame; |
8e220a91 |
24 | |
3612a8a8 |
25 | static enum { |
26 | STATE_DISCON, |
27 | STATE_IV, |
28 | STATE_CON, |
29 | } legic_state; |
30 | |
31 | static crc_t legic_crc; |
32 | static int legic_read_count; |
33 | static uint32_t legic_prng_bc; |
34 | static uint32_t legic_prng_iv; |
35 | |
36 | static int legic_phase_drift; |
37 | static int legic_frame_drift; |
38 | static int legic_reqresp_drift; |
8e220a91 |
39 | |
add16a62 |
40 | AT91PS_TC timer; |
3612a8a8 |
41 | AT91PS_TC prng_timer; |
add16a62 |
42 | |
43 | static void setup_timer(void) |
44 | { |
45 | /* Set up Timer 1 to use for measuring time between pulses. Since we're bit-banging |
46 | * this it won't be terribly accurate but should be good enough. |
47 | */ |
48 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1); |
49 | timer = AT91C_BASE_TC1; |
50 | timer->TC_CCR = AT91C_TC_CLKDIS; |
0aa4cfc2 |
51 | timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK; |
add16a62 |
52 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
53 | |
3612a8a8 |
54 | /* |
55 | * Set up Timer 2 to use for measuring time between frames in |
56 | * tag simulation mode. Runs 4x faster as Timer 1 |
57 | */ |
58 | AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC2); |
59 | prng_timer = AT91C_BASE_TC2; |
60 | prng_timer->TC_CCR = AT91C_TC_CLKDIS; |
61 | prng_timer->TC_CMR = AT91C_TC_CLKS_TIMER_DIV2_CLOCK; |
62 | prng_timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
63 | } |
64 | |
add16a62 |
65 | /* At TIMER_CLOCK3 (MCK/32) */ |
66 | #define RWD_TIME_1 150 /* RWD_TIME_PAUSE off, 80us on = 100us */ |
67 | #define RWD_TIME_0 90 /* RWD_TIME_PAUSE off, 40us on = 60us */ |
68 | #define RWD_TIME_PAUSE 30 /* 20us */ |
69 | #define RWD_TIME_FUZZ 20 /* rather generous 13us, since the peak detector + hysteresis fuzz quite a bit */ |
70 | #define TAG_TIME_BIT 150 /* 100us for every bit */ |
71 | #define TAG_TIME_WAIT 490 /* time from RWD frame end to tag frame start, experimentally determined */ |
72 | |
3612a8a8 |
73 | #define SIM_DIVISOR 586 /* prng_time/SIM_DIVISOR count prng needs to be forwared */ |
74 | #define SIM_SHIFT 900 /* prng_time+SIM_SHIFT shift of delayed start */ |
75 | |
76 | #define SESSION_IV 0x55 |
77 | #define OFFSET_LOG 1024 |
add16a62 |
78 | |
79 | #define FUZZ_EQUAL(value, target, fuzz) ((value) > ((target)-(fuzz)) && (value) < ((target)+(fuzz))) |
aac23b24 |
80 | |
3612a8a8 |
81 | /* Generate Keystream */ |
82 | static uint32_t get_key_stream(int skip, int count) |
83 | { |
84 | uint32_t key=0; int i; |
85 | |
86 | /* Use int to enlarge timer tc to 32bit */ |
87 | legic_prng_bc += prng_timer->TC_CV; |
88 | prng_timer->TC_CCR = AT91C_TC_SWTRG; |
89 | |
90 | /* If skip == -1, forward prng time based */ |
91 | if(skip == -1) { |
92 | i = (legic_prng_bc+SIM_SHIFT)/SIM_DIVISOR; /* Calculate Cycles based on timer */ |
93 | i -= legic_prng_count(); /* substract cycles of finished frames */ |
94 | i -= count; /* substract current frame length, rewidn to bedinning */ |
95 | legic_prng_forward(i); |
96 | } else { |
97 | legic_prng_forward(skip); |
98 | } |
99 | |
100 | /* Write Time Data into LOG */ |
117d9ec2 |
101 | uint8_t *BigBuf = BigBuf_get_addr(); |
3612a8a8 |
102 | if(count == 6) { i = -1; } else { i = legic_read_count; } |
117d9ec2 |
103 | BigBuf[OFFSET_LOG+128+i] = legic_prng_count(); |
104 | BigBuf[OFFSET_LOG+256+i*4] = (legic_prng_bc >> 0) & 0xff; |
105 | BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff; |
106 | BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff; |
107 | BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff; |
108 | BigBuf[OFFSET_LOG+384+i] = count; |
3612a8a8 |
109 | |
110 | /* Generate KeyStream */ |
111 | for(i=0; i<count; i++) { |
112 | key |= legic_prng_get_bit() << i; |
113 | legic_prng_forward(1); |
114 | } |
115 | return key; |
116 | } |
117 | |
118 | /* Send a frame in tag mode, the FPGA must have been set up by |
119 | * LegicRfSimulate |
120 | */ |
121 | static void frame_send_tag(uint16_t response, int bits, int crypt) |
122 | { |
123 | /* Bitbang the response */ |
124 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
125 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; |
126 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; |
127 | |
128 | /* Use time to crypt frame */ |
129 | if(crypt) { |
130 | legic_prng_forward(2); /* TAG_TIME_WAIT -> shift by 2 */ |
131 | int i; int key = 0; |
132 | for(i=0; i<bits; i++) { |
133 | key |= legic_prng_get_bit() << i; |
134 | legic_prng_forward(1); |
135 | } |
136 | //Dbprintf("key = 0x%x", key); |
137 | response = response ^ key; |
138 | } |
139 | |
140 | /* Wait for the frame start */ |
141 | while(timer->TC_CV < (TAG_TIME_WAIT - 30)) ; |
142 | |
143 | int i; |
144 | for(i=0; i<bits; i++) { |
145 | int nextbit = timer->TC_CV + TAG_TIME_BIT; |
146 | int bit = response & 1; |
147 | response = response >> 1; |
148 | if(bit) { |
149 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; |
150 | } else { |
151 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
152 | } |
153 | while(timer->TC_CV < nextbit) ; |
154 | } |
155 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
156 | } |
157 | |
dcc10e5e |
158 | /* Send a frame in reader mode, the FPGA must have been set up by |
159 | * LegicRfReader |
160 | */ |
8e220a91 |
161 | static void frame_send_rwd(uint32_t data, int bits) |
dcc10e5e |
162 | { |
163 | /* Start clock */ |
164 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
165 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
e30c654b |
166 | |
dcc10e5e |
167 | int i; |
168 | for(i=0; i<bits; i++) { |
169 | int starttime = timer->TC_CV; |
170 | int pause_end = starttime + RWD_TIME_PAUSE, bit_end; |
171 | int bit = data & 1; |
172 | data = data >> 1; |
8e220a91 |
173 | |
174 | if(bit ^ legic_prng_get_bit()) { |
dcc10e5e |
175 | bit_end = starttime + RWD_TIME_1; |
176 | } else { |
177 | bit_end = starttime + RWD_TIME_0; |
178 | } |
e30c654b |
179 | |
dcc10e5e |
180 | /* RWD_TIME_PAUSE time off, then some time on, so that the complete bit time is |
181 | * RWD_TIME_x, where x is the bit to be transmitted */ |
182 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
183 | while(timer->TC_CV < pause_end) ; |
184 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; |
8e220a91 |
185 | legic_prng_forward(1); /* bit duration is longest. use this time to forward the lfsr */ |
e30c654b |
186 | |
dcc10e5e |
187 | while(timer->TC_CV < bit_end) ; |
188 | } |
e30c654b |
189 | |
dcc10e5e |
190 | { |
191 | /* One final pause to mark the end of the frame */ |
192 | int pause_end = timer->TC_CV + RWD_TIME_PAUSE; |
193 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
194 | while(timer->TC_CV < pause_end) ; |
195 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; |
196 | } |
e30c654b |
197 | |
dcc10e5e |
198 | /* Reset the timer, to measure time until the start of the tag frame */ |
199 | timer->TC_CCR = AT91C_TC_SWTRG; |
2561caa2 |
200 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
dcc10e5e |
201 | } |
202 | |
203 | /* Receive a frame from the card in reader emulation mode, the FPGA and |
204 | * timer must have been set up by LegicRfReader and frame_send_rwd. |
e30c654b |
205 | * |
dcc10e5e |
206 | * The LEGIC RF protocol from card to reader does not include explicit |
207 | * frame start/stop information or length information. The reader must |
208 | * know beforehand how many bits it wants to receive. (Notably: a card |
209 | * sending a stream of 0-bits is indistinguishable from no card present.) |
e30c654b |
210 | * |
dcc10e5e |
211 | * Receive methodology: There is a fancy correlator in hi_read_rx_xcorr, but |
212 | * I'm not smart enough to use it. Instead I have patched hi_read_tx to output |
213 | * the ADC signal with hysteresis on SSP_DIN. Bit-bang that signal and look |
214 | * for edges. Count the edges in each bit interval. If they are approximately |
215 | * 0 this was a 0-bit, if they are approximately equal to the number of edges |
216 | * expected for a 212kHz subcarrier, this was a 1-bit. For timing we use the |
217 | * timer that's still running from frame_send_rwd in order to get a synchronization |
218 | * with the frame that we just sent. |
e30c654b |
219 | * |
220 | * FIXME: Because we're relying on the hysteresis to just do the right thing |
dcc10e5e |
221 | * the range is severely reduced (and you'll probably also need a good antenna). |
e30c654b |
222 | * So this should be fixed some time in the future for a proper receiver. |
dcc10e5e |
223 | */ |
8e220a91 |
224 | static void frame_receive_rwd(struct legic_frame * const f, int bits, int crypt) |
dcc10e5e |
225 | { |
a2b1414f |
226 | uint32_t the_bit = 1; /* Use a bitmask to save on shifts */ |
227 | uint32_t data=0; |
dcc10e5e |
228 | int i, old_level=0, edges=0; |
229 | int next_bit_at = TAG_TIME_WAIT; |
3612a8a8 |
230 | |
231 | if(bits > 32) { |
232 | bits = 32; |
233 | } |
dcc10e5e |
234 | |
235 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; |
236 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; |
237 | |
8e220a91 |
238 | /* we have some time now, precompute the cipher |
3612a8a8 |
239 | * since we cannot compute it on the fly while reading */ |
8e220a91 |
240 | legic_prng_forward(2); |
241 | |
242 | if(crypt) |
243 | { |
244 | for(i=0; i<bits; i++) { |
245 | data |= legic_prng_get_bit() << i; |
246 | legic_prng_forward(1); |
247 | } |
248 | } |
249 | |
dcc10e5e |
250 | while(timer->TC_CV < next_bit_at) ; |
8e220a91 |
251 | |
dcc10e5e |
252 | next_bit_at += TAG_TIME_BIT; |
e30c654b |
253 | |
dcc10e5e |
254 | for(i=0; i<bits; i++) { |
255 | edges = 0; |
256 | while(timer->TC_CV < next_bit_at) { |
257 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); |
258 | if(level != old_level) |
259 | edges++; |
260 | old_level = level; |
261 | } |
262 | next_bit_at += TAG_TIME_BIT; |
3612a8a8 |
263 | |
dcc10e5e |
264 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ |
8e220a91 |
265 | data ^= the_bit; |
dcc10e5e |
266 | } |
dcc10e5e |
267 | the_bit <<= 1; |
268 | } |
e30c654b |
269 | |
dcc10e5e |
270 | f->data = data; |
271 | f->bits = bits; |
e30c654b |
272 | |
2561caa2 |
273 | /* Reset the timer, to synchronize the next frame */ |
274 | timer->TC_CCR = AT91C_TC_SWTRG; |
275 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
dcc10e5e |
276 | } |
277 | |
3612a8a8 |
278 | static void frame_append_bit(struct legic_frame * const f, int bit) |
279 | { |
280 | if(f->bits >= 31) { |
281 | return; /* Overflow, won't happen */ |
282 | } |
283 | f->data |= (bit<<f->bits); |
284 | f->bits++; |
285 | } |
286 | |
ccedd6ae |
287 | static void frame_clean(struct legic_frame * const f) |
a7247d85 |
288 | { |
ccedd6ae |
289 | f->data = 0; |
290 | f->bits = 0; |
a7247d85 |
291 | } |
292 | |
a2b1414f |
293 | static uint32_t perform_setup_phase_rwd(int iv) |
2561caa2 |
294 | { |
e30c654b |
295 | |
2561caa2 |
296 | /* Switch on carrier and let the tag charge for 1ms */ |
297 | AT91C_BASE_PIOA->PIO_SODR = GPIO_SSC_DOUT; |
298 | SpinDelay(1); |
e30c654b |
299 | |
8e220a91 |
300 | legic_prng_init(0); /* no keystream yet */ |
301 | frame_send_rwd(iv, 7); |
3612a8a8 |
302 | legic_prng_init(iv); |
e30c654b |
303 | |
2561caa2 |
304 | frame_clean(¤t_frame); |
8e220a91 |
305 | frame_receive_rwd(¤t_frame, 6, 1); |
306 | legic_prng_forward(1); /* we wait anyways */ |
2561caa2 |
307 | while(timer->TC_CV < 387) ; /* ~ 258us */ |
8e220a91 |
308 | frame_send_rwd(0x19, 6); |
2561caa2 |
309 | |
8e220a91 |
310 | return current_frame.data; |
2561caa2 |
311 | } |
312 | |
8e220a91 |
313 | static void LegicCommonInit(void) { |
7cc204bf |
314 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
dcc10e5e |
315 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
316 | FpgaSetupSsc(); |
317 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX); |
e30c654b |
318 | |
dcc10e5e |
319 | /* Bitbang the transmitter */ |
320 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
321 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; |
322 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; |
e30c654b |
323 | |
dcc10e5e |
324 | setup_timer(); |
e30c654b |
325 | |
8e220a91 |
326 | crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0); |
327 | } |
328 | |
329 | static void switch_off_tag_rwd(void) |
330 | { |
331 | /* Switch off carrier, make sure tag is reset */ |
332 | AT91C_BASE_PIOA->PIO_CODR = GPIO_SSC_DOUT; |
333 | SpinDelay(10); |
e30c654b |
334 | |
8e220a91 |
335 | WDT_HIT(); |
336 | } |
337 | /* calculate crc for a legic command */ |
a2b1414f |
338 | static int LegicCRC(int byte_index, int value, int cmd_sz) { |
8e220a91 |
339 | crc_clear(&legic_crc); |
340 | crc_update(&legic_crc, 1, 1); /* CMD_READ */ |
a2b1414f |
341 | crc_update(&legic_crc, byte_index, cmd_sz-1); |
8e220a91 |
342 | crc_update(&legic_crc, value, 8); |
343 | return crc_finish(&legic_crc); |
344 | } |
345 | |
a2b1414f |
346 | int legic_read_byte(int byte_index, int cmd_sz) { |
8e220a91 |
347 | int byte; |
348 | |
349 | legic_prng_forward(4); /* we wait anyways */ |
3612a8a8 |
350 | while(timer->TC_CV < 387) ; /* ~ 258us + 100us*delay */ |
8e220a91 |
351 | |
a2b1414f |
352 | frame_send_rwd(1 | (byte_index << 1), cmd_sz); |
8e220a91 |
353 | frame_clean(¤t_frame); |
354 | |
355 | frame_receive_rwd(¤t_frame, 12, 1); |
356 | |
357 | byte = current_frame.data & 0xff; |
a2b1414f |
358 | if( LegicCRC(byte_index, byte, cmd_sz) != (current_frame.data >> 8) ) { |
3612a8a8 |
359 | Dbprintf("!!! crc mismatch: expected %x but got %x !!!", |
360 | LegicCRC(byte_index, current_frame.data & 0xff, cmd_sz), current_frame.data >> 8); |
a2b1414f |
361 | return -1; |
362 | } |
8e220a91 |
363 | |
364 | return byte; |
365 | } |
366 | |
367 | /* legic_write_byte() is not included, however it's trivial to implement |
368 | * and here are some hints on what remains to be done: |
369 | * |
370 | * * assemble a write_cmd_frame with crc and send it |
371 | * * wait until the tag sends back an ACK ('1' bit unencrypted) |
372 | * * forward the prng based on the timing |
373 | */ |
3612a8a8 |
374 | int legic_write_byte(int byte, int addr, int addr_sz) { |
375 | //do not write UID, CRC, DCF |
376 | if(addr <= 0x06) { |
377 | return 0; |
378 | } |
8e220a91 |
379 | |
3612a8a8 |
380 | //== send write command ============================== |
381 | crc_clear(&legic_crc); |
382 | crc_update(&legic_crc, 0, 1); /* CMD_WRITE */ |
383 | crc_update(&legic_crc, addr, addr_sz); |
384 | crc_update(&legic_crc, byte, 8); |
385 | |
386 | uint32_t crc = crc_finish(&legic_crc); |
387 | uint32_t cmd = ((crc <<(addr_sz+1+8)) //CRC |
388 | |(byte <<(addr_sz+1)) //Data |
389 | |(addr <<1) //Address |
390 | |(0x00 <<0)); //CMD = W |
391 | uint32_t cmd_sz = addr_sz+1+8+4; //crc+data+cmd |
392 | |
393 | legic_prng_forward(2); /* we wait anyways */ |
29435274 |
394 | while(timer->TC_CV < 387) {}; /* ~ 258us */ |
3612a8a8 |
395 | frame_send_rwd(cmd, cmd_sz); |
396 | |
397 | //== wait for ack ==================================== |
398 | int t, old_level=0, edges=0; |
399 | int next_bit_at =0; |
400 | while(timer->TC_CV < 387) ; /* ~ 258us */ |
401 | for(t=0; t<80; t++) { |
402 | edges = 0; |
403 | next_bit_at += TAG_TIME_BIT; |
404 | while(timer->TC_CV < next_bit_at) { |
405 | int level = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); |
406 | if(level != old_level) { |
407 | edges++; |
408 | } |
409 | old_level = level; |
410 | } |
411 | if(edges > 20 && edges < 60) { /* expected are 42 edges */ |
412 | int t = timer->TC_CV; |
413 | int c = t/TAG_TIME_BIT; |
414 | timer->TC_CCR = AT91C_TC_SWTRG; |
415 | while(timer->TC_CV > 1) ; /* Wait till the clock has reset */ |
416 | legic_prng_forward(c); |
417 | return 0; |
418 | } |
419 | } |
420 | timer->TC_CCR = AT91C_TC_SWTRG; |
29435274 |
421 | while(timer->TC_CV > 1) {}; /* Wait till the clock has reset */ |
3612a8a8 |
422 | return -1; |
423 | } |
8e220a91 |
424 | |
3612a8a8 |
425 | int LegicRfReader(int offset, int bytes) { |
a2b1414f |
426 | int byte_index=0, cmd_sz=0, card_sz=0; |
e30c654b |
427 | |
8e220a91 |
428 | LegicCommonInit(); |
429 | |
117d9ec2 |
430 | uint8_t *BigBuf = BigBuf_get_addr(); |
a2b1414f |
431 | memset(BigBuf, 0, 1024); |
e30c654b |
432 | |
8e220a91 |
433 | DbpString("setting up legic card"); |
3612a8a8 |
434 | uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV); |
435 | switch_off_tag_rwd(); //we lose to mutch time with dprintf |
a2b1414f |
436 | switch(tag_type) { |
437 | case 0x1d: |
438 | DbpString("MIM 256 card found, reading card ..."); |
3612a8a8 |
439 | cmd_sz = 9; |
a2b1414f |
440 | card_sz = 256; |
441 | break; |
442 | case 0x3d: |
443 | DbpString("MIM 1024 card found, reading card ..."); |
3612a8a8 |
444 | cmd_sz = 11; |
a2b1414f |
445 | card_sz = 1024; |
446 | break; |
447 | default: |
b279e3ef |
448 | Dbprintf("Unknown card format: %x",tag_type); |
3612a8a8 |
449 | return -1; |
a2b1414f |
450 | } |
451 | if(bytes == -1) { |
452 | bytes = card_sz; |
453 | } |
3612a8a8 |
454 | if(bytes+offset >= card_sz) { |
a2b1414f |
455 | bytes = card_sz-offset; |
3612a8a8 |
456 | } |
a2b1414f |
457 | |
3612a8a8 |
458 | perform_setup_phase_rwd(SESSION_IV); |
8e220a91 |
459 | |
3612a8a8 |
460 | LED_B_ON(); |
8e220a91 |
461 | while(byte_index < bytes) { |
3612a8a8 |
462 | int r = legic_read_byte(byte_index+offset, cmd_sz); |
463 | if(r == -1 ||BUTTON_PRESS()) { |
464 | DbpString("operation aborted"); |
a2b1414f |
465 | switch_off_tag_rwd(); |
3612a8a8 |
466 | LED_B_OFF(); |
467 | LED_C_OFF(); |
468 | return -1; |
a2b1414f |
469 | } |
117d9ec2 |
470 | BigBuf[byte_index] = r; |
3612a8a8 |
471 | WDT_HIT(); |
2561caa2 |
472 | byte_index++; |
3612a8a8 |
473 | if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF(); |
2561caa2 |
474 | } |
3612a8a8 |
475 | LED_B_OFF(); |
476 | LED_C_OFF(); |
477 | switch_off_tag_rwd(); |
478 | Dbprintf("Card read, use 'hf legic decode' or"); |
479 | Dbprintf("'data hexsamples %d' to view results", (bytes+7) & ~7); |
480 | return 0; |
481 | } |
482 | |
483 | void LegicRfWriter(int bytes, int offset) { |
484 | int byte_index=0, addr_sz=0; |
117d9ec2 |
485 | uint8_t *BigBuf = BigBuf_get_addr(); |
486 | |
3612a8a8 |
487 | LegicCommonInit(); |
488 | |
489 | DbpString("setting up legic card"); |
490 | uint32_t tag_type = perform_setup_phase_rwd(SESSION_IV); |
8e220a91 |
491 | switch_off_tag_rwd(); |
3612a8a8 |
492 | switch(tag_type) { |
493 | case 0x1d: |
494 | if(offset+bytes > 0x100) { |
495 | Dbprintf("Error: can not write to 0x%03.3x on MIM 256", offset+bytes); |
496 | return; |
497 | } |
498 | addr_sz = 8; |
499 | Dbprintf("MIM 256 card found, writing 0x%02.2x - 0x%02.2x ...", offset, offset+bytes); |
500 | break; |
501 | case 0x3d: |
502 | if(offset+bytes > 0x400) { |
503 | Dbprintf("Error: can not write to 0x%03.3x on MIM 1024", offset+bytes); |
504 | return; |
505 | } |
506 | addr_sz = 10; |
507 | Dbprintf("MIM 1024 card found, writing 0x%03.3x - 0x%03.3x ...", offset, offset+bytes); |
508 | break; |
509 | default: |
510 | Dbprintf("No or unknown card found, aborting"); |
511 | return; |
512 | } |
513 | |
514 | LED_B_ON(); |
515 | perform_setup_phase_rwd(SESSION_IV); |
516 | legic_prng_forward(2); |
517 | while(byte_index < bytes) { |
117d9ec2 |
518 | int r = legic_write_byte(BigBuf[byte_index+offset], byte_index+offset, addr_sz); |
3612a8a8 |
519 | if((r != 0) || BUTTON_PRESS()) { |
520 | Dbprintf("operation aborted @ 0x%03.3x", byte_index); |
521 | switch_off_tag_rwd(); |
522 | LED_B_OFF(); |
523 | LED_C_OFF(); |
524 | return; |
525 | } |
526 | WDT_HIT(); |
527 | byte_index++; |
528 | if(byte_index & 0x10) LED_C_ON(); else LED_C_OFF(); |
529 | } |
530 | LED_B_OFF(); |
531 | LED_C_OFF(); |
532 | DbpString("write successful"); |
533 | } |
534 | |
535 | int timestamp; |
536 | |
537 | /* Handle (whether to respond) a frame in tag mode */ |
538 | static void frame_handle_tag(struct legic_frame const * const f) |
539 | { |
117d9ec2 |
540 | uint8_t *BigBuf = BigBuf_get_addr(); |
541 | |
3612a8a8 |
542 | /* First Part of Handshake (IV) */ |
543 | if(f->bits == 7) { |
544 | if(f->data == SESSION_IV) { |
545 | LED_C_ON(); |
546 | prng_timer->TC_CCR = AT91C_TC_SWTRG; |
547 | legic_prng_init(f->data); |
548 | frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1b */ |
549 | legic_state = STATE_IV; |
550 | legic_read_count = 0; |
551 | legic_prng_bc = 0; |
552 | legic_prng_iv = f->data; |
553 | |
554 | /* TIMEOUT */ |
555 | timer->TC_CCR = AT91C_TC_SWTRG; |
556 | while(timer->TC_CV > 1); |
557 | while(timer->TC_CV < 280); |
558 | return; |
559 | } else if((prng_timer->TC_CV % 50) > 40) { |
560 | legic_prng_init(f->data); |
561 | frame_send_tag(0x3d, 6, 1); |
562 | SpinDelay(20); |
563 | return; |
564 | } |
565 | } |
566 | |
567 | /* 0x19==??? */ |
568 | if(legic_state == STATE_IV) { |
569 | if((f->bits == 6) && (f->data == (0x19 ^ get_key_stream(1, 6)))) { |
570 | legic_state = STATE_CON; |
571 | |
572 | /* TIMEOUT */ |
573 | timer->TC_CCR = AT91C_TC_SWTRG; |
574 | while(timer->TC_CV > 1); |
575 | while(timer->TC_CV < 200); |
576 | return; |
577 | } else { |
578 | legic_state = STATE_DISCON; |
579 | LED_C_OFF(); |
580 | Dbprintf("0x19 - Frame: %03.3x", f->data); |
581 | return; |
582 | } |
583 | } |
584 | |
585 | /* Read */ |
586 | if(f->bits == 11) { |
587 | if(legic_state == STATE_CON) { |
588 | int key = get_key_stream(-1, 11); //legic_phase_drift, 11); |
589 | int addr = f->data ^ key; addr = addr >> 1; |
117d9ec2 |
590 | int data = BigBuf[addr]; |
3612a8a8 |
591 | int hash = LegicCRC(addr, data, 11) << 8; |
117d9ec2 |
592 | BigBuf[OFFSET_LOG+legic_read_count] = (uint8_t)addr; |
3612a8a8 |
593 | legic_read_count++; |
594 | |
595 | //Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c); |
596 | legic_prng_forward(legic_reqresp_drift); |
597 | |
598 | frame_send_tag(hash | data, 12, 1); |
599 | |
600 | /* SHORT TIMEOUT */ |
601 | timer->TC_CCR = AT91C_TC_SWTRG; |
602 | while(timer->TC_CV > 1); |
603 | legic_prng_forward(legic_frame_drift); |
604 | while(timer->TC_CV < 180); |
605 | return; |
606 | } |
607 | } |
608 | |
609 | /* Write */ |
610 | if(f->bits == 23) { |
611 | int key = get_key_stream(-1, 23); //legic_frame_drift, 23); |
612 | int addr = f->data ^ key; addr = addr >> 1; addr = addr & 0x3ff; |
613 | int data = f->data ^ key; data = data >> 11; data = data & 0xff; |
614 | |
615 | /* write command */ |
616 | legic_state = STATE_DISCON; |
617 | LED_C_OFF(); |
618 | Dbprintf("write - addr: %x, data: %x", addr, data); |
619 | return; |
620 | } |
621 | |
622 | if(legic_state != STATE_DISCON) { |
623 | Dbprintf("Unexpected: sz:%u, Data:%03.3x, State:%u, Count:%u", f->bits, f->data, legic_state, legic_read_count); |
624 | int i; |
625 | Dbprintf("IV: %03.3x", legic_prng_iv); |
626 | for(i = 0; i<legic_read_count; i++) { |
117d9ec2 |
627 | Dbprintf("Read Nb: %u, Addr: %u", i, BigBuf[OFFSET_LOG+i]); |
3612a8a8 |
628 | } |
629 | |
630 | for(i = -1; i<legic_read_count; i++) { |
631 | uint32_t t; |
117d9ec2 |
632 | t = BigBuf[OFFSET_LOG+256+i*4]; |
633 | t |= BigBuf[OFFSET_LOG+256+i*4+1] << 8; |
634 | t |= BigBuf[OFFSET_LOG+256+i*4+2] <<16; |
635 | t |= BigBuf[OFFSET_LOG+256+i*4+3] <<24; |
3612a8a8 |
636 | |
637 | Dbprintf("Cycles: %u, Frame Length: %u, Time: %u", |
117d9ec2 |
638 | BigBuf[OFFSET_LOG+128+i], |
639 | BigBuf[OFFSET_LOG+384+i], |
3612a8a8 |
640 | t); |
641 | } |
642 | } |
643 | legic_state = STATE_DISCON; |
644 | legic_read_count = 0; |
645 | SpinDelay(10); |
646 | LED_C_OFF(); |
647 | return; |
648 | } |
649 | |
650 | /* Read bit by bit untill full frame is received |
651 | * Call to process frame end answer |
652 | */ |
653 | static void emit(int bit) |
654 | { |
655 | if(bit == -1) { |
656 | if(current_frame.bits <= 4) { |
657 | frame_clean(¤t_frame); |
658 | } else { |
659 | frame_handle_tag(¤t_frame); |
660 | frame_clean(¤t_frame); |
661 | } |
662 | WDT_HIT(); |
663 | } else if(bit == 0) { |
664 | frame_append_bit(¤t_frame, 0); |
665 | } else if(bit == 1) { |
666 | frame_append_bit(¤t_frame, 1); |
667 | } |
668 | } |
669 | |
670 | void LegicRfSimulate(int phase, int frame, int reqresp) |
671 | { |
672 | /* ADC path high-frequency peak detector, FPGA in high-frequency simulator mode, |
673 | * modulation mode set to 212kHz subcarrier. We are getting the incoming raw |
674 | * envelope waveform on DIN and should send our response on DOUT. |
675 | * |
676 | * The LEGIC RF protocol is pulse-pause-encoding from reader to card, so we'll |
677 | * measure the time between two rising edges on DIN, and no encoding on the |
678 | * subcarrier from card to reader, so we'll just shift out our verbatim data |
679 | * on DOUT, 1 bit is 100us. The time from reader to card frame is still unclear, |
680 | * seems to be 300us-ish. |
681 | */ |
682 | |
683 | if(phase < 0) { |
684 | int i; |
685 | for(i=0; i<=reqresp; i++) { |
686 | legic_prng_init(SESSION_IV); |
687 | Dbprintf("i=%u, key 0x%3.3x", i, get_key_stream(i, frame)); |
688 | } |
689 | return; |
690 | } |
691 | |
692 | legic_phase_drift = phase; |
693 | legic_frame_drift = frame; |
694 | legic_reqresp_drift = reqresp; |
695 | |
7cc204bf |
696 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF); |
3612a8a8 |
697 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); |
698 | FpgaSetupSsc(); |
699 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_212K); |
700 | |
701 | /* Bitbang the receiver */ |
702 | AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_DIN; |
703 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DIN; |
704 | |
705 | setup_timer(); |
706 | crc_init(&legic_crc, 4, 0x19 >> 1, 0x5, 0); |
707 | |
708 | int old_level = 0; |
709 | int active = 0; |
710 | legic_state = STATE_DISCON; |
711 | |
712 | LED_B_ON(); |
713 | DbpString("Starting Legic emulator, press button to end"); |
714 | while(!BUTTON_PRESS()) { |
715 | int level = !!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_DIN); |
716 | int time = timer->TC_CV; |
717 | |
718 | if(level != old_level) { |
719 | if(level == 1) { |
720 | timer->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; |
721 | if(FUZZ_EQUAL(time, RWD_TIME_1, RWD_TIME_FUZZ)) { |
722 | /* 1 bit */ |
723 | emit(1); |
724 | active = 1; |
725 | LED_A_ON(); |
726 | } else if(FUZZ_EQUAL(time, RWD_TIME_0, RWD_TIME_FUZZ)) { |
727 | /* 0 bit */ |
728 | emit(0); |
729 | active = 1; |
730 | LED_A_ON(); |
731 | } else if(active) { |
732 | /* invalid */ |
733 | emit(-1); |
734 | active = 0; |
735 | LED_A_OFF(); |
736 | } |
737 | } |
738 | } |
739 | |
740 | if(time >= (RWD_TIME_1+RWD_TIME_FUZZ) && active) { |
741 | /* Frame end */ |
742 | emit(-1); |
743 | active = 0; |
744 | LED_A_OFF(); |
745 | } |
746 | |
747 | if(time >= (20*RWD_TIME_1) && (timer->TC_SR & AT91C_TC_CLKSTA)) { |
748 | timer->TC_CCR = AT91C_TC_CLKDIS; |
749 | } |
750 | |
751 | old_level = level; |
752 | WDT_HIT(); |
753 | } |
754 | DbpString("Stopped"); |
755 | LED_B_OFF(); |
756 | LED_A_OFF(); |
757 | LED_C_OFF(); |
dcc10e5e |
758 | } |
a2b1414f |
759 | |