]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // The main application code. This is the first thing called after start.c | |
3 | // executes. | |
4 | // Jonathan Westhues, Mar 2006 | |
5 | // Edits by Gerhard de Koning Gans, Sep 2007 (##) | |
6 | //----------------------------------------------------------------------------- | |
7 | ||
8 | ||
9 | #include <proxmark3.h> | |
10 | #include <stdlib.h> | |
11 | #include "apps.h" | |
12 | #ifdef WITH_LCD | |
13 | #include "fonts.h" | |
14 | #include "LCD.h" | |
15 | #endif | |
16 | ||
17 | // The large multi-purpose buffer, typically used to hold A/D samples, | |
18 | // maybe pre-processed in some way. | |
19 | DWORD BigBuf[16000]; | |
20 | ||
21 | //============================================================================= | |
22 | // A buffer where we can queue things up to be sent through the FPGA, for | |
23 | // any purpose (fake tag, as reader, whatever). We go MSB first, since that | |
24 | // is the order in which they go out on the wire. | |
25 | //============================================================================= | |
26 | ||
27 | BYTE ToSend[256]; | |
28 | int ToSendMax; | |
29 | static int ToSendBit; | |
30 | ||
31 | ||
32 | void BufferClear(void) | |
33 | { | |
34 | memset(BigBuf,0,sizeof(BigBuf)); | |
35 | DbpString("Buffer cleared"); | |
36 | } | |
37 | ||
38 | void ToSendReset(void) | |
39 | { | |
40 | ToSendMax = -1; | |
41 | ToSendBit = 8; | |
42 | } | |
43 | ||
44 | void ToSendStuffBit(int b) | |
45 | { | |
46 | if(ToSendBit >= 8) { | |
47 | ToSendMax++; | |
48 | ToSend[ToSendMax] = 0; | |
49 | ToSendBit = 0; | |
50 | } | |
51 | ||
52 | if(b) { | |
53 | ToSend[ToSendMax] |= (1 << (7 - ToSendBit)); | |
54 | } | |
55 | ||
56 | ToSendBit++; | |
57 | ||
58 | if(ToSendBit >= sizeof(ToSend)) { | |
59 | ToSendBit = 0; | |
60 | DbpString("ToSendStuffBit overflowed!"); | |
61 | } | |
62 | } | |
63 | ||
64 | //============================================================================= | |
65 | // Debug print functions, to go out over USB, to the usual PC-side client. | |
66 | //============================================================================= | |
67 | ||
68 | void DbpString(char *str) | |
69 | { | |
70 | UsbCommand c; | |
71 | c.cmd = CMD_DEBUG_PRINT_STRING; | |
72 | c.ext1 = strlen(str); | |
73 | memcpy(c.d.asBytes, str, c.ext1); | |
74 | ||
75 | UsbSendPacket((BYTE *)&c, sizeof(c)); | |
76 | // TODO fix USB so stupid things like this aren't req'd | |
77 | SpinDelay(50); | |
78 | } | |
79 | ||
80 | void DbpIntegers(int x1, int x2, int x3) | |
81 | { | |
82 | UsbCommand c; | |
83 | c.cmd = CMD_DEBUG_PRINT_INTEGERS; | |
84 | c.ext1 = x1; | |
85 | c.ext2 = x2; | |
86 | c.ext3 = x3; | |
87 | ||
88 | UsbSendPacket((BYTE *)&c, sizeof(c)); | |
89 | // XXX | |
90 | SpinDelay(50); | |
91 | } | |
92 | ||
93 | void AcquireRawAdcSamples125k(BOOL at134khz) | |
94 | { | |
95 | if(at134khz) { | |
96 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
97 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ); | |
98 | } else { | |
99 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
100 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ); | |
101 | } | |
102 | ||
103 | // Connect the A/D to the peak-detected low-frequency path. | |
104 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); | |
105 | ||
106 | // Give it a bit of time for the resonant antenna to settle. | |
107 | SpinDelay(50); | |
108 | ||
109 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
110 | FpgaSetupSsc(); | |
111 | ||
112 | // Now call the acquisition routine | |
113 | DoAcquisition125k(at134khz); | |
114 | } | |
115 | ||
116 | // split into two routines so we can avoid timing issues after sending commands // | |
117 | void DoAcquisition125k(BOOL at134khz) | |
118 | { | |
119 | BYTE *dest = (BYTE *)BigBuf; | |
120 | int n = sizeof(BigBuf); | |
121 | int i; | |
122 | ||
123 | memset(dest,0,n); | |
124 | i = 0; | |
125 | for(;;) { | |
126 | if(SSC_STATUS & (SSC_STATUS_TX_READY)) { | |
127 | SSC_TRANSMIT_HOLDING = 0x43; | |
128 | LED_D_ON(); | |
129 | } | |
130 | if(SSC_STATUS & (SSC_STATUS_RX_READY)) { | |
131 | dest[i] = (BYTE)SSC_RECEIVE_HOLDING; | |
132 | i++; | |
133 | LED_D_OFF(); | |
134 | if(i >= n) { | |
135 | break; | |
136 | } | |
137 | } | |
138 | } | |
139 | DbpIntegers(dest[0], dest[1], at134khz); | |
140 | } | |
141 | ||
142 | void ModThenAcquireRawAdcSamples125k(int delay_off,int period_0,int period_1,BYTE *command) | |
143 | { | |
144 | BOOL at134khz; | |
145 | ||
146 | // see if 'h' was specified | |
147 | if(command[strlen(command) - 1] == 'h') | |
148 | at134khz= TRUE; | |
149 | else | |
150 | at134khz= FALSE; | |
151 | ||
152 | if(at134khz) { | |
153 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
154 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ); | |
155 | } else { | |
156 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
157 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ); | |
158 | } | |
159 | ||
160 | // Give it a bit of time for the resonant antenna to settle. | |
161 | SpinDelay(50); | |
162 | ||
163 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
164 | FpgaSetupSsc(); | |
165 | ||
166 | // now modulate the reader field | |
167 | while(*command != '\0' && *command != ' ') | |
168 | { | |
169 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
170 | LED_D_OFF(); | |
171 | SpinDelayUs(delay_off); | |
172 | if(at134khz) { | |
173 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
174 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ); | |
175 | } else { | |
176 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
177 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ); | |
178 | } | |
179 | LED_D_ON(); | |
180 | if(*(command++) == '0') | |
181 | SpinDelayUs(period_0); | |
182 | else | |
183 | SpinDelayUs(period_1); | |
184 | } | |
185 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
186 | LED_D_OFF(); | |
187 | SpinDelayUs(delay_off); | |
188 | if(at134khz) { | |
189 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
190 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ); | |
191 | } else { | |
192 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
193 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ); | |
194 | } | |
195 | ||
196 | // now do the read | |
197 | DoAcquisition125k(at134khz); | |
198 | } | |
199 | ||
200 | //----------------------------------------------------------------------------- | |
201 | // Read an ADC channel and block till it completes, then return the result | |
202 | // in ADC units (0 to 1023). Also a routine to average 32 samples and | |
203 | // return that. | |
204 | //----------------------------------------------------------------------------- | |
205 | static int ReadAdc(int ch) | |
206 | { | |
207 | DWORD d; | |
208 | ||
209 | ADC_CONTROL = ADC_CONTROL_RESET; | |
210 | ADC_MODE = ADC_MODE_PRESCALE(32) | ADC_MODE_STARTUP_TIME(16) | | |
211 | ADC_MODE_SAMPLE_HOLD_TIME(8); | |
212 | ADC_CHANNEL_ENABLE = ADC_CHANNEL(ch); | |
213 | ||
214 | ADC_CONTROL = ADC_CONTROL_START; | |
215 | while(!(ADC_STATUS & ADC_END_OF_CONVERSION(ch))) | |
216 | ; | |
217 | d = ADC_CHANNEL_DATA(ch); | |
218 | ||
219 | return d; | |
220 | } | |
221 | ||
222 | static int AvgAdc(int ch) | |
223 | { | |
224 | int i; | |
225 | int a = 0; | |
226 | ||
227 | for(i = 0; i < 32; i++) { | |
228 | a += ReadAdc(ch); | |
229 | } | |
230 | ||
231 | return (a + 15) >> 5; | |
232 | } | |
233 | ||
234 | /* | |
235 | * Sweeps the useful LF range of the proxmark from | |
236 | * 46.8kHz (divisor=255) to 600kHz (divisor=19) and | |
237 | * reads the voltage in the antenna: the result is a graph | |
238 | * which should clearly show the resonating frequency of your | |
239 | * LF antenna ( hopefully around 90 if it is tuned to 125kHz!) | |
240 | */ | |
241 | void SweepLFrange() | |
242 | { | |
243 | BYTE *dest = (BYTE *)BigBuf; | |
244 | int i; | |
245 | ||
246 | // clear buffer | |
247 | memset(BigBuf,0,sizeof(BigBuf)); | |
248 | ||
249 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER); | |
250 | for (i=255; i>19; i--) { | |
251 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, i); | |
252 | SpinDelay(20); | |
253 | dest[i] = (137500 * AvgAdc(ADC_CHAN_LF)) >> 18; | |
254 | } | |
255 | } | |
256 | ||
257 | void MeasureAntennaTuning(void) | |
258 | { | |
259 | // Impedances are Zc = 1/(j*omega*C), in ohms | |
260 | #define LF_TUNING_CAP_Z 1273 // 1 nF @ 125 kHz | |
261 | #define HF_TUNING_CAP_Z 235 // 50 pF @ 13.56 MHz | |
262 | ||
263 | int vLf125, vLf134, vHf; // in mV | |
264 | ||
265 | UsbCommand c; | |
266 | ||
267 | // Let the FPGA drive the low-frequency antenna around 125 kHz. | |
268 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
269 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ); | |
270 | SpinDelay(20); | |
271 | vLf125 = AvgAdc(ADC_CHAN_LF); | |
272 | // Vref = 3.3V, and a 10000:240 voltage divider on the input | |
273 | // can measure voltages up to 137500 mV | |
274 | vLf125 = (137500 * vLf125) >> 10; | |
275 | ||
276 | // Let the FPGA drive the low-frequency antenna around 134 kHz. | |
277 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz | |
278 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_134_KHZ); | |
279 | SpinDelay(20); | |
280 | vLf134 = AvgAdc(ADC_CHAN_LF); | |
281 | // Vref = 3.3V, and a 10000:240 voltage divider on the input | |
282 | // can measure voltages up to 137500 mV | |
283 | vLf134 = (137500 * vLf134) >> 10; | |
284 | ||
285 | // Let the FPGA drive the high-frequency antenna around 13.56 MHz. | |
286 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR); | |
287 | SpinDelay(20); | |
288 | vHf = AvgAdc(ADC_CHAN_HF); | |
289 | // Vref = 3300mV, and an 10:1 voltage divider on the input | |
290 | // can measure voltages up to 33000 mV | |
291 | vHf = (33000 * vHf) >> 10; | |
292 | ||
293 | c.cmd = CMD_MEASURED_ANTENNA_TUNING; | |
294 | c.ext1 = (vLf125 << 0) | (vLf134 << 16); | |
295 | c.ext2 = vHf; | |
296 | c.ext3 = (LF_TUNING_CAP_Z << 0) | (HF_TUNING_CAP_Z << 16); | |
297 | UsbSendPacket((BYTE *)&c, sizeof(c)); | |
298 | } | |
299 | ||
300 | void SimulateTagLowFrequency(int period) | |
301 | { | |
302 | int i; | |
303 | BYTE *tab = (BYTE *)BigBuf; | |
304 | ||
305 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR); | |
306 | ||
307 | PIO_ENABLE = (1 << GPIO_SSC_DOUT) | (1 << GPIO_SSC_CLK); | |
308 | ||
309 | PIO_OUTPUT_ENABLE = (1 << GPIO_SSC_DOUT); | |
310 | PIO_OUTPUT_DISABLE = (1 << GPIO_SSC_CLK); | |
311 | ||
312 | #define SHORT_COIL() LOW(GPIO_SSC_DOUT) | |
313 | #define OPEN_COIL() HIGH(GPIO_SSC_DOUT) | |
314 | ||
315 | i = 0; | |
316 | for(;;) { | |
317 | while(!(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK))) { | |
318 | if(BUTTON_PRESS()) { | |
319 | return; | |
320 | } | |
321 | WDT_HIT(); | |
322 | } | |
323 | ||
324 | LED_D_ON(); | |
325 | if(tab[i]) { | |
326 | OPEN_COIL(); | |
327 | } else { | |
328 | SHORT_COIL(); | |
329 | } | |
330 | LED_D_OFF(); | |
331 | ||
332 | while(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK)) { | |
333 | if(BUTTON_PRESS()) { | |
334 | return; | |
335 | } | |
336 | WDT_HIT(); | |
337 | } | |
338 | ||
339 | i++; | |
340 | if(i == period) i = 0; | |
341 | } | |
342 | } | |
343 | ||
344 | // compose fc/8 fc/10 waveform | |
345 | static void fc(int c, int *n) { | |
346 | BYTE *dest = (BYTE *)BigBuf; | |
347 | int idx; | |
348 | ||
349 | // for when we want an fc8 pattern every 4 logical bits | |
350 | if(c==0) { | |
351 | dest[((*n)++)]=1; | |
352 | dest[((*n)++)]=1; | |
353 | dest[((*n)++)]=0; | |
354 | dest[((*n)++)]=0; | |
355 | dest[((*n)++)]=0; | |
356 | dest[((*n)++)]=0; | |
357 | dest[((*n)++)]=0; | |
358 | dest[((*n)++)]=0; | |
359 | } | |
360 | // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples | |
361 | if(c==8) { | |
362 | for (idx=0; idx<6; idx++) { | |
363 | dest[((*n)++)]=1; | |
364 | dest[((*n)++)]=1; | |
365 | dest[((*n)++)]=0; | |
366 | dest[((*n)++)]=0; | |
367 | dest[((*n)++)]=0; | |
368 | dest[((*n)++)]=0; | |
369 | dest[((*n)++)]=0; | |
370 | dest[((*n)++)]=0; | |
371 | } | |
372 | } | |
373 | ||
374 | // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples | |
375 | if(c==10) { | |
376 | for (idx=0; idx<5; idx++) { | |
377 | dest[((*n)++)]=1; | |
378 | dest[((*n)++)]=1; | |
379 | dest[((*n)++)]=1; | |
380 | dest[((*n)++)]=0; | |
381 | dest[((*n)++)]=0; | |
382 | dest[((*n)++)]=0; | |
383 | dest[((*n)++)]=0; | |
384 | dest[((*n)++)]=0; | |
385 | dest[((*n)++)]=0; | |
386 | dest[((*n)++)]=0; | |
387 | } | |
388 | } | |
389 | } | |
390 | ||
391 | // prepare a waveform pattern in the buffer based on the ID given then | |
392 | // simulate a HID tag until the button is pressed | |
393 | static void CmdHIDsimTAG(int hi, int lo) | |
394 | { | |
395 | int n=0, i=0; | |
396 | /* | |
397 | HID tag bitstream format | |
398 | The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits | |
399 | A 1 bit is represented as 6 fc8 and 5 fc10 patterns | |
400 | A 0 bit is represented as 5 fc10 and 6 fc8 patterns | |
401 | A fc8 is inserted before every 4 bits | |
402 | A special start of frame pattern is used consisting a0b0 where a and b are neither 0 | |
403 | nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10) | |
404 | */ | |
405 | ||
406 | if (hi>0xFFF) { | |
407 | DbpString("Tags can only have 44 bits."); | |
408 | return; | |
409 | } | |
410 | fc(0,&n); | |
411 | // special start of frame marker containing invalid bit sequences | |
412 | fc(8, &n); fc(8, &n); // invalid | |
413 | fc(8, &n); fc(10, &n); // logical 0 | |
414 | fc(10, &n); fc(10, &n); // invalid | |
415 | fc(8, &n); fc(10, &n); // logical 0 | |
416 | ||
417 | WDT_HIT(); | |
418 | // manchester encode bits 43 to 32 | |
419 | for (i=11; i>=0; i--) { | |
420 | if ((i%4)==3) fc(0,&n); | |
421 | if ((hi>>i)&1) { | |
422 | fc(10, &n); fc(8, &n); // low-high transition | |
423 | } else { | |
424 | fc(8, &n); fc(10, &n); // high-low transition | |
425 | } | |
426 | } | |
427 | ||
428 | WDT_HIT(); | |
429 | // manchester encode bits 31 to 0 | |
430 | for (i=31; i>=0; i--) { | |
431 | if ((i%4)==3) fc(0,&n); | |
432 | if ((lo>>i)&1) { | |
433 | fc(10, &n); fc(8, &n); // low-high transition | |
434 | } else { | |
435 | fc(8, &n); fc(10, &n); // high-low transition | |
436 | } | |
437 | } | |
438 | ||
439 | LED_A_ON(); | |
440 | SimulateTagLowFrequency(n); | |
441 | LED_A_OFF(); | |
442 | } | |
443 | ||
444 | // loop to capture raw HID waveform then FSK demodulate the TAG ID from it | |
445 | static void CmdHIDdemodFSK(void) | |
446 | { | |
447 | BYTE *dest = (BYTE *)BigBuf; | |
448 | int m=0, n=0, i=0, idx=0, found=0, lastval=0; | |
449 | DWORD hi=0, lo=0; | |
450 | ||
451 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
452 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER | FPGA_LF_READER_USE_125_KHZ); | |
453 | ||
454 | // Connect the A/D to the peak-detected low-frequency path. | |
455 | SetAdcMuxFor(GPIO_MUXSEL_LOPKD); | |
456 | ||
457 | // Give it a bit of time for the resonant antenna to settle. | |
458 | SpinDelay(50); | |
459 | ||
460 | // Now set up the SSC to get the ADC samples that are now streaming at us. | |
461 | FpgaSetupSsc(); | |
462 | ||
463 | for(;;) { | |
464 | WDT_HIT(); | |
465 | LED_A_ON(); | |
466 | if(BUTTON_PRESS()) { | |
467 | LED_A_OFF(); | |
468 | return; | |
469 | } | |
470 | ||
471 | i = 0; | |
472 | m = sizeof(BigBuf); | |
473 | memset(dest,128,m); | |
474 | for(;;) { | |
475 | if(SSC_STATUS & (SSC_STATUS_TX_READY)) { | |
476 | SSC_TRANSMIT_HOLDING = 0x43; | |
477 | LED_D_ON(); | |
478 | } | |
479 | if(SSC_STATUS & (SSC_STATUS_RX_READY)) { | |
480 | dest[i] = (BYTE)SSC_RECEIVE_HOLDING; | |
481 | // we don't care about actual value, only if it's more or less than a | |
482 | // threshold essentially we capture zero crossings for later analysis | |
483 | if(dest[i] < 127) dest[i] = 0; else dest[i] = 1; | |
484 | i++; | |
485 | LED_D_OFF(); | |
486 | if(i >= m) { | |
487 | break; | |
488 | } | |
489 | } | |
490 | } | |
491 | ||
492 | // FSK demodulator | |
493 | ||
494 | // sync to first lo-hi transition | |
495 | for( idx=1; idx<m; idx++) { | |
496 | if (dest[idx-1]<dest[idx]) | |
497 | lastval=idx; | |
498 | break; | |
499 | } | |
500 | WDT_HIT(); | |
501 | ||
502 | // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8) | |
503 | // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere | |
504 | // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10 | |
505 | for( i=0; idx<m; idx++) { | |
506 | if (dest[idx-1]<dest[idx]) { | |
507 | dest[i]=idx-lastval; | |
508 | if (dest[i] <= 8) { | |
509 | dest[i]=1; | |
510 | } else { | |
511 | dest[i]=0; | |
512 | } | |
513 | ||
514 | lastval=idx; | |
515 | i++; | |
516 | } | |
517 | } | |
518 | m=i; | |
519 | WDT_HIT(); | |
520 | ||
521 | // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns | |
522 | lastval=dest[0]; | |
523 | idx=0; | |
524 | i=0; | |
525 | n=0; | |
526 | for( idx=0; idx<m; idx++) { | |
527 | if (dest[idx]==lastval) { | |
528 | n++; | |
529 | } else { | |
530 | // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents, | |
531 | // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets | |
532 | // swallowed up by rounding | |
533 | // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding | |
534 | // special start of frame markers use invalid manchester states (no transitions) by using sequences | |
535 | // like 111000 | |
536 | if (dest[idx-1]) { | |
537 | n=(n+1)/6; // fc/8 in sets of 6 | |
538 | } else { | |
539 | n=(n+1)/5; // fc/10 in sets of 5 | |
540 | } | |
541 | switch (n) { // stuff appropriate bits in buffer | |
542 | case 0: | |
543 | case 1: // one bit | |
544 | dest[i++]=dest[idx-1]; | |
545 | break; | |
546 | case 2: // two bits | |
547 | dest[i++]=dest[idx-1]; | |
548 | dest[i++]=dest[idx-1]; | |
549 | break; | |
550 | case 3: // 3 bit start of frame markers | |
551 | dest[i++]=dest[idx-1]; | |
552 | dest[i++]=dest[idx-1]; | |
553 | dest[i++]=dest[idx-1]; | |
554 | break; | |
555 | // When a logic 0 is immediately followed by the start of the next transmisson | |
556 | // (special pattern) a pattern of 4 bit duration lengths is created. | |
557 | case 4: | |
558 | dest[i++]=dest[idx-1]; | |
559 | dest[i++]=dest[idx-1]; | |
560 | dest[i++]=dest[idx-1]; | |
561 | dest[i++]=dest[idx-1]; | |
562 | break; | |
563 | default: // this shouldn't happen, don't stuff any bits | |
564 | break; | |
565 | } | |
566 | n=0; | |
567 | lastval=dest[idx]; | |
568 | } | |
569 | } | |
570 | m=i; | |
571 | WDT_HIT(); | |
572 | ||
573 | // final loop, go over previously decoded manchester data and decode into usable tag ID | |
574 | // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0 | |
575 | for( idx=0; idx<m-6; idx++) { | |
576 | // search for a start of frame marker | |
577 | if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) ) | |
578 | { | |
579 | found=1; | |
580 | idx+=6; | |
581 | if (found && (hi|lo)) { | |
582 | DbpString("TAG ID"); | |
583 | DbpIntegers(hi, lo, (lo>>1)&0xffff); | |
584 | hi=0; | |
585 | lo=0; | |
586 | found=0; | |
587 | } | |
588 | } | |
589 | if (found) { | |
590 | if (dest[idx] && (!dest[idx+1]) ) { | |
591 | hi=(hi<<1)|(lo>>31); | |
592 | lo=(lo<<1)|0; | |
593 | } else if ( (!dest[idx]) && dest[idx+1]) { | |
594 | hi=(hi<<1)|(lo>>31); | |
595 | lo=(lo<<1)|1; | |
596 | } else { | |
597 | found=0; | |
598 | hi=0; | |
599 | lo=0; | |
600 | } | |
601 | idx++; | |
602 | } | |
603 | if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) ) | |
604 | { | |
605 | found=1; | |
606 | idx+=6; | |
607 | if (found && (hi|lo)) { | |
608 | DbpString("TAG ID"); | |
609 | DbpIntegers(hi, lo, (lo>>1)&0xffff); | |
610 | hi=0; | |
611 | lo=0; | |
612 | found=0; | |
613 | } | |
614 | } | |
615 | } | |
616 | WDT_HIT(); | |
617 | } | |
618 | } | |
619 | ||
620 | void SimulateTagHfListen(void) | |
621 | { | |
622 | BYTE *dest = (BYTE *)BigBuf; | |
623 | int n = sizeof(BigBuf); | |
624 | BYTE v = 0; | |
625 | int i; | |
626 | int p = 0; | |
627 | ||
628 | // We're using this mode just so that I can test it out; the simulated | |
629 | // tag mode would work just as well and be simpler. | |
630 | FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_HF_READER_RX_XCORR_SNOOP); | |
631 | ||
632 | // We need to listen to the high-frequency, peak-detected path. | |
633 | SetAdcMuxFor(GPIO_MUXSEL_HIPKD); | |
634 | ||
635 | FpgaSetupSsc(); | |
636 | ||
637 | i = 0; | |
638 | for(;;) { | |
639 | if(SSC_STATUS & (SSC_STATUS_TX_READY)) { | |
640 | SSC_TRANSMIT_HOLDING = 0xff; | |
641 | } | |
642 | if(SSC_STATUS & (SSC_STATUS_RX_READY)) { | |
643 | BYTE r = (BYTE)SSC_RECEIVE_HOLDING; | |
644 | ||
645 | v <<= 1; | |
646 | if(r & 1) { | |
647 | v |= 1; | |
648 | } | |
649 | p++; | |
650 | ||
651 | if(p >= 8) { | |
652 | dest[i] = v; | |
653 | v = 0; | |
654 | p = 0; | |
655 | i++; | |
656 | ||
657 | if(i >= n) { | |
658 | break; | |
659 | } | |
660 | } | |
661 | } | |
662 | } | |
663 | DbpString("simulate tag (now type bitsamples)"); | |
664 | } | |
665 | ||
666 | void UsbPacketReceived(BYTE *packet, int len) | |
667 | { | |
668 | UsbCommand *c = (UsbCommand *)packet; | |
669 | ||
670 | switch(c->cmd) { | |
671 | case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K: | |
672 | AcquireRawAdcSamples125k(c->ext1); | |
673 | break; | |
674 | ||
675 | case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K: | |
676 | ModThenAcquireRawAdcSamples125k(c->ext1,c->ext2,c->ext3,c->d.asBytes); | |
677 | break; | |
678 | ||
679 | case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693: | |
680 | AcquireRawAdcSamplesIso15693(); | |
681 | break; | |
682 | ||
683 | case CMD_BUFF_CLEAR: | |
684 | BufferClear(); | |
685 | break; | |
686 | ||
687 | case CMD_READER_ISO_15693: | |
688 | ReaderIso15693(c->ext1); | |
689 | break; | |
690 | ||
691 | case CMD_SIMTAG_ISO_15693: | |
692 | SimTagIso15693(c->ext1); | |
693 | break; | |
694 | ||
695 | case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443: | |
696 | AcquireRawAdcSamplesIso14443(c->ext1); | |
697 | break; | |
698 | ||
699 | case CMD_READ_SRI512_TAG: | |
700 | ReadSRI512Iso14443(c->ext1); | |
701 | break; | |
702 | ||
703 | case CMD_READER_ISO_14443a: | |
704 | ReaderIso14443a(c->ext1); | |
705 | break; | |
706 | ||
707 | case CMD_SNOOP_ISO_14443: | |
708 | SnoopIso14443(); | |
709 | break; | |
710 | ||
711 | case CMD_SNOOP_ISO_14443a: | |
712 | SnoopIso14443a(); | |
713 | break; | |
714 | ||
715 | case CMD_SIMULATE_TAG_HF_LISTEN: | |
716 | SimulateTagHfListen(); | |
717 | break; | |
718 | ||
719 | case CMD_SIMULATE_TAG_ISO_14443: | |
720 | SimulateIso14443Tag(); | |
721 | break; | |
722 | ||
723 | case CMD_SIMULATE_TAG_ISO_14443a: | |
724 | SimulateIso14443aTag(c->ext1, c->ext2); // ## Simulate iso14443a tag - pass tag type & UID | |
725 | break; | |
726 | ||
727 | case CMD_MEASURE_ANTENNA_TUNING: | |
728 | MeasureAntennaTuning(); | |
729 | break; | |
730 | ||
731 | case CMD_LISTEN_READER_FIELD: | |
732 | ListenReaderField(c->ext1); | |
733 | break; | |
734 | ||
735 | case CMD_HID_DEMOD_FSK: | |
736 | CmdHIDdemodFSK(); // Demodulate HID tag | |
737 | break; | |
738 | ||
739 | case CMD_HID_SIM_TAG: | |
740 | CmdHIDsimTAG(c->ext1, c->ext2); // Simulate HID tag by ID | |
741 | break; | |
742 | ||
743 | case CMD_FPGA_MAJOR_MODE_OFF: // ## FPGA Control | |
744 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
745 | SpinDelay(200); | |
746 | LED_D_OFF(); // LED D indicates field ON or OFF | |
747 | break; | |
748 | ||
749 | case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K: | |
750 | case CMD_DOWNLOAD_RAW_BITS_TI_TYPE: { | |
751 | UsbCommand n; | |
752 | if(c->cmd == CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K) { | |
753 | n.cmd = CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K; | |
754 | } else { | |
755 | n.cmd = CMD_DOWNLOADED_RAW_BITS_TI_TYPE; | |
756 | } | |
757 | n.ext1 = c->ext1; | |
758 | memcpy(n.d.asDwords, BigBuf+c->ext1, 12*sizeof(DWORD)); | |
759 | UsbSendPacket((BYTE *)&n, sizeof(n)); | |
760 | break; | |
761 | } | |
762 | case CMD_DOWNLOADED_SIM_SAMPLES_125K: { | |
763 | BYTE *b = (BYTE *)BigBuf; | |
764 | memcpy(b+c->ext1, c->d.asBytes, 48); | |
765 | break; | |
766 | } | |
767 | case CMD_SIMULATE_TAG_125K: | |
768 | LED_A_ON(); | |
769 | SimulateTagLowFrequency(c->ext1); | |
770 | LED_A_OFF(); | |
771 | break; | |
772 | #ifdef WITH_LCD | |
773 | case CMD_LCD_RESET: | |
774 | LCDReset(); | |
775 | break; | |
776 | #endif | |
777 | case CMD_SWEEP_LF: | |
778 | SweepLFrange(); | |
779 | break; | |
780 | ||
781 | case CMD_SET_LF_DIVISOR: | |
782 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, c->ext1); | |
783 | break; | |
784 | #ifdef WITH_LCD | |
785 | case CMD_LCD: | |
786 | LCDSend(c->ext1); | |
787 | break; | |
788 | #endif | |
789 | case CMD_SETUP_WRITE: | |
790 | case CMD_FINISH_WRITE: | |
791 | case CMD_HARDWARE_RESET: | |
792 | USB_D_PLUS_PULLUP_OFF(); | |
793 | SpinDelay(1000); | |
794 | SpinDelay(1000); | |
795 | RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET; | |
796 | for(;;) { | |
797 | // We're going to reset, and the bootrom will take control. | |
798 | } | |
799 | break; | |
800 | ||
801 | ||
802 | default: | |
803 | DbpString("unknown command"); | |
804 | break; | |
805 | } | |
806 | } | |
807 | ||
808 | void AppMain(void) | |
809 | { | |
810 | memset(BigBuf,0,sizeof(BigBuf)); | |
811 | SpinDelay(100); | |
812 | ||
813 | LED_D_OFF(); | |
814 | LED_C_OFF(); | |
815 | LED_B_OFF(); | |
816 | LED_A_OFF(); | |
817 | ||
818 | UsbStart(); | |
819 | ||
820 | // The FPGA gets its clock from us from PCK0 output, so set that up. | |
821 | PIO_PERIPHERAL_B_SEL = (1 << GPIO_PCK0); | |
822 | PIO_DISABLE = (1 << GPIO_PCK0); | |
823 | PMC_SYS_CLK_ENABLE = PMC_SYS_CLK_PROGRAMMABLE_CLK_0; | |
824 | // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz | |
825 | PMC_PROGRAMMABLE_CLK_0 = PMC_CLK_SELECTION_PLL_CLOCK | | |
826 | PMC_CLK_PRESCALE_DIV_4; | |
827 | PIO_OUTPUT_ENABLE = (1 << GPIO_PCK0); | |
828 | ||
829 | // Reset SPI | |
830 | SPI_CONTROL = SPI_CONTROL_RESET; | |
831 | // Reset SSC | |
832 | SSC_CONTROL = SSC_CONTROL_RESET; | |
833 | ||
834 | // Load the FPGA image, which we have stored in our flash. | |
835 | FpgaDownloadAndGo(); | |
836 | ||
837 | #ifdef WITH_LCD | |
838 | ||
839 | LCDInit(); | |
840 | ||
841 | // test text on different colored backgrounds | |
842 | LCDString(" The quick brown fox ", &FONT6x8,1,1+8*0,WHITE ,BLACK ); | |
843 | LCDString(" jumped over the ", &FONT6x8,1,1+8*1,BLACK ,WHITE ); | |
844 | LCDString(" lazy dog. ", &FONT6x8,1,1+8*2,YELLOW ,RED ); | |
845 | LCDString(" AaBbCcDdEeFfGgHhIiJj ", &FONT6x8,1,1+8*3,RED ,GREEN ); | |
846 | LCDString(" KkLlMmNnOoPpQqRrSsTt ", &FONT6x8,1,1+8*4,MAGENTA,BLUE ); | |
847 | LCDString("UuVvWwXxYyZz0123456789", &FONT6x8,1,1+8*5,BLUE ,YELLOW); | |
848 | LCDString("`-=[]_;',./~!@#$%^&*()", &FONT6x8,1,1+8*6,BLACK ,CYAN ); | |
849 | LCDString(" _+{}|:\\\"<>? ",&FONT6x8,1,1+8*7,BLUE ,MAGENTA); | |
850 | ||
851 | // color bands | |
852 | LCDFill(0, 1+8* 8, 132, 8, BLACK); | |
853 | LCDFill(0, 1+8* 9, 132, 8, WHITE); | |
854 | LCDFill(0, 1+8*10, 132, 8, RED); | |
855 | LCDFill(0, 1+8*11, 132, 8, GREEN); | |
856 | LCDFill(0, 1+8*12, 132, 8, BLUE); | |
857 | LCDFill(0, 1+8*13, 132, 8, YELLOW); | |
858 | LCDFill(0, 1+8*14, 132, 8, CYAN); | |
859 | LCDFill(0, 1+8*15, 132, 8, MAGENTA); | |
860 | ||
861 | #endif | |
862 | ||
863 | for(;;) { | |
864 | UsbPoll(FALSE); | |
865 | WDT_HIT(); | |
866 | } | |
867 | } | |
868 | ||
869 | void SpinDelayUs(int us) | |
870 | { | |
871 | int ticks = (48*us) >> 10; | |
872 | ||
873 | // Borrow a PWM unit for my real-time clock | |
874 | PWM_ENABLE = PWM_CHANNEL(0); | |
875 | // 48 MHz / 1024 gives 46.875 kHz | |
876 | PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10); | |
877 | PWM_CH_DUTY_CYCLE(0) = 0; | |
878 | PWM_CH_PERIOD(0) = 0xffff; | |
879 | ||
880 | WORD start = (WORD)PWM_CH_COUNTER(0); | |
881 | ||
882 | for(;;) { | |
883 | WORD now = (WORD)PWM_CH_COUNTER(0); | |
884 | if(now == (WORD)(start + ticks)) { | |
885 | return; | |
886 | } | |
887 | WDT_HIT(); | |
888 | } | |
889 | } | |
890 | ||
891 | void SpinDelay(int ms) | |
892 | { | |
893 | int ticks = (48000*ms) >> 10; | |
894 | ||
895 | // Borrow a PWM unit for my real-time clock | |
896 | PWM_ENABLE = PWM_CHANNEL(0); | |
897 | // 48 MHz / 1024 gives 46.875 kHz | |
898 | PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10); | |
899 | PWM_CH_DUTY_CYCLE(0) = 0; | |
900 | PWM_CH_PERIOD(0) = 0xffff; | |
901 | ||
902 | WORD start = (WORD)PWM_CH_COUNTER(0); | |
903 | ||
904 | for(;;) { | |
905 | WORD now = (WORD)PWM_CH_COUNTER(0); | |
906 | if(now == (WORD)(start + ticks)) { | |
907 | return; | |
908 | } | |
909 | WDT_HIT(); | |
910 | } | |
911 | } | |
912 | ||
913 | // listen for external reader | |
914 | void ListenReaderField(int limit) | |
915 | { | |
916 | int lf_av, lf_av_new, lf_baseline= -1, lf_count= 0; | |
917 | int hf_av, hf_av_new, hf_baseline= -1, hf_count= 0; | |
918 | ||
919 | #define LF_ONLY 1 | |
920 | #define HF_ONLY 2 | |
921 | ||
922 | LED_A_OFF(); | |
923 | LED_B_OFF(); | |
924 | LED_C_OFF(); | |
925 | LED_D_OFF(); | |
926 | ||
927 | lf_av= ReadAdc(ADC_CHAN_LF); | |
928 | ||
929 | if(limit != HF_ONLY && lf_baseline == -1) | |
930 | { | |
931 | DbpString("LF 125/134 Baseline:"); | |
932 | DbpIntegers(lf_av,0,0); | |
933 | lf_baseline= lf_av; | |
934 | } | |
935 | ||
936 | hf_av= ReadAdc(ADC_CHAN_HF); | |
937 | ||
938 | ||
939 | if (limit != LF_ONLY && hf_baseline == -1) | |
940 | { | |
941 | DbpString("HF 13.56 Baseline:"); | |
942 | DbpIntegers(hf_av,0,0); | |
943 | hf_baseline= hf_av; | |
944 | } | |
945 | ||
946 | for(;;) | |
947 | { | |
948 | if(BUTTON_PRESS()) | |
949 | { | |
950 | LED_B_OFF(); | |
951 | LED_D_OFF(); | |
952 | return; | |
953 | } | |
954 | WDT_HIT(); | |
955 | ||
956 | ||
957 | if (limit != HF_ONLY) | |
958 | { | |
959 | if (abs(lf_av - lf_baseline) > 10) | |
960 | LED_D_ON(); | |
961 | else | |
962 | LED_D_OFF(); | |
963 | ++lf_count; | |
964 | lf_av_new= ReadAdc(ADC_CHAN_LF); | |
965 | // see if there's a significant change | |
966 | if(abs(lf_av - lf_av_new) > 10) | |
967 | { | |
968 | DbpString("LF 125/134 Field Change:"); | |
969 | DbpIntegers(lf_av,lf_av_new,lf_count); | |
970 | lf_av= lf_av_new; | |
971 | lf_count= 0; | |
972 | } | |
973 | } | |
974 | ||
975 | if (limit != LF_ONLY) | |
976 | { | |
977 | if (abs(hf_av - hf_baseline) > 10) | |
978 | LED_B_ON(); | |
979 | else | |
980 | LED_B_OFF(); | |
981 | ++hf_count; | |
982 | hf_av_new= ReadAdc(ADC_CHAN_HF); | |
983 | // see if there's a significant change | |
984 | if(abs(hf_av - hf_av_new) > 10) | |
985 | { | |
986 | DbpString("HF 13.56 Field Change:"); | |
987 | DbpIntegers(hf_av,hf_av_new,hf_count); | |
988 | hf_av= hf_av_new; | |
989 | hf_count= 0; | |
990 | } | |
991 | } | |
992 | } | |
993 | } |