]>
Commit | Line | Data |
---|---|---|
1 | #include "proxmark3.h" | |
2 | #include "apps.h" | |
3 | #include "lfsampling.h" | |
4 | #include "pcf7931.h" | |
5 | #include "util.h" | |
6 | #include "string.h" | |
7 | ||
8 | #define T0_PCF 8 //period for the pcf7931 in us | |
9 | #define ALLOC 16 | |
10 | ||
11 | int DemodPCF7931(uint8_t **outBlocks) { | |
12 | ||
13 | uint8_t bits[256] = {0x00}; | |
14 | uint8_t blocks[8][16]; | |
15 | uint8_t *dest = BigBuf_get_addr(); | |
16 | ||
17 | int GraphTraceLen = BigBuf_max_traceLen(); | |
18 | if ( GraphTraceLen > 18000 ) | |
19 | GraphTraceLen = 18000; | |
20 | ||
21 | ||
22 | int i, j, lastval, bitidx, half_switch; | |
23 | int clock = 64; | |
24 | int tolerance = clock / 8; | |
25 | int pmc, block_done; | |
26 | int lc, warnings = 0; | |
27 | int num_blocks = 0; | |
28 | int lmin=128, lmax=128; | |
29 | uint8_t dir; | |
30 | //clear read buffer | |
31 | BigBuf_Clear_keep_EM(); | |
32 | ||
33 | LFSetupFPGAForADC(95, true); | |
34 | DoAcquisition_default(0, true); | |
35 | ||
36 | lmin = 64; | |
37 | lmax = 192; | |
38 | ||
39 | i = 2; | |
40 | ||
41 | /* Find first local max/min */ | |
42 | if(dest[1] > dest[0]) { | |
43 | while(i < GraphTraceLen) { | |
44 | if( !(dest[i] > dest[i-1]) && dest[i] > lmax) | |
45 | break; | |
46 | i++; | |
47 | } | |
48 | dir = 0; | |
49 | } | |
50 | else { | |
51 | while(i < GraphTraceLen) { | |
52 | if( !(dest[i] < dest[i-1]) && dest[i] < lmin) | |
53 | break; | |
54 | i++; | |
55 | } | |
56 | dir = 1; | |
57 | } | |
58 | ||
59 | lastval = i++; | |
60 | half_switch = 0; | |
61 | pmc = 0; | |
62 | block_done = 0; | |
63 | ||
64 | for (bitidx = 0; i < GraphTraceLen; i++) | |
65 | { | |
66 | if ( (dest[i-1] > dest[i] && dir == 1 && dest[i] > lmax) || (dest[i-1] < dest[i] && dir == 0 && dest[i] < lmin)) | |
67 | { | |
68 | lc = i - lastval; | |
69 | lastval = i; | |
70 | ||
71 | // Switch depending on lc length: | |
72 | // Tolerance is 1/8 of clock rate (arbitrary) | |
73 | if (ABS(lc-clock/4) < tolerance) { | |
74 | // 16T0 | |
75 | if((i - pmc) == lc) { /* 16T0 was previous one */ | |
76 | /* It's a PMC ! */ | |
77 | i += (128+127+16+32+33+16)-1; | |
78 | lastval = i; | |
79 | pmc = 0; | |
80 | block_done = 1; | |
81 | } | |
82 | else { | |
83 | pmc = i; | |
84 | } | |
85 | } else if (ABS(lc-clock/2) < tolerance) { | |
86 | // 32TO | |
87 | if((i - pmc) == lc) { /* 16T0 was previous one */ | |
88 | /* It's a PMC ! */ | |
89 | i += (128+127+16+32+33)-1; | |
90 | lastval = i; | |
91 | pmc = 0; | |
92 | block_done = 1; | |
93 | } | |
94 | else if(half_switch == 1) { | |
95 | bits[bitidx++] = 0; | |
96 | half_switch = 0; | |
97 | } | |
98 | else | |
99 | half_switch++; | |
100 | } else if (ABS(lc-clock) < tolerance) { | |
101 | // 64TO | |
102 | bits[bitidx++] = 1; | |
103 | } else { | |
104 | // Error | |
105 | warnings++; | |
106 | if (warnings > 10) | |
107 | { | |
108 | Dbprintf("Error: too many detection errors, aborting."); | |
109 | return 0; | |
110 | } | |
111 | } | |
112 | ||
113 | if(block_done == 1) { | |
114 | if(bitidx == 128) { | |
115 | for(j=0; j<16; j++) { | |
116 | blocks[num_blocks][j] = 128*bits[j*8+7]+ | |
117 | 64*bits[j*8+6]+ | |
118 | 32*bits[j*8+5]+ | |
119 | 16*bits[j*8+4]+ | |
120 | 8*bits[j*8+3]+ | |
121 | 4*bits[j*8+2]+ | |
122 | 2*bits[j*8+1]+ | |
123 | bits[j*8]; | |
124 | ||
125 | } | |
126 | num_blocks++; | |
127 | } | |
128 | bitidx = 0; | |
129 | block_done = 0; | |
130 | half_switch = 0; | |
131 | } | |
132 | if(i < GraphTraceLen) | |
133 | dir =(dest[i-1] > dest[i]) ? 0 : 1; | |
134 | } | |
135 | if(bitidx==255) | |
136 | bitidx=0; | |
137 | warnings = 0; | |
138 | if(num_blocks == 4) break; | |
139 | } | |
140 | memcpy(outBlocks, blocks, 16*num_blocks); | |
141 | return num_blocks; | |
142 | } | |
143 | ||
144 | int IsBlock0PCF7931(uint8_t *Block) { | |
145 | // Assume RFU means 0 :) | |
146 | if((memcmp(Block, "\x00\x00\x00\x00\x00\x00\x00\x01", 8) == 0) && memcmp(Block+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) // PAC enabled | |
147 | return 1; | |
148 | if((memcmp(Block+9, "\x00\x00\x00\x00\x00\x00\x00", 7) == 0) && Block[7] == 0) // PAC disabled, can it *really* happen ? | |
149 | return 1; | |
150 | return 0; | |
151 | } | |
152 | ||
153 | int IsBlock1PCF7931(uint8_t *Block) { | |
154 | // Assume RFU means 0 :) | |
155 | if(Block[10] == 0 && Block[11] == 0 && Block[12] == 0 && Block[13] == 0) | |
156 | if((Block[14] & 0x7f) <= 9 && Block[15] <= 9) | |
157 | return 1; | |
158 | ||
159 | return 0; | |
160 | } | |
161 | ||
162 | void ReadPCF7931() { | |
163 | uint8_t Blocks[8][17]; | |
164 | uint8_t tmpBlocks[4][16]; | |
165 | int i, j, ind, ind2, n; | |
166 | int num_blocks = 0; | |
167 | int max_blocks = 8; | |
168 | int ident = 0; | |
169 | int error = 0; | |
170 | int tries = 0; | |
171 | ||
172 | memset(Blocks, 0, 8*17*sizeof(uint8_t)); | |
173 | ||
174 | do { | |
175 | memset(tmpBlocks, 0, 4*16*sizeof(uint8_t)); | |
176 | n = DemodPCF7931((uint8_t**)tmpBlocks); | |
177 | if(!n) | |
178 | error++; | |
179 | if(error==10 && num_blocks == 0) { | |
180 | Dbprintf("Error, no tag or bad tag"); | |
181 | return; | |
182 | } | |
183 | else if (tries==20 || error==10) { | |
184 | Dbprintf("Error reading the tag"); | |
185 | Dbprintf("Here is the partial content"); | |
186 | goto end; | |
187 | } | |
188 | ||
189 | for(i=0; i<n; i++) | |
190 | Dbprintf("(dbg) %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x", | |
191 | tmpBlocks[i][0], tmpBlocks[i][1], tmpBlocks[i][2], tmpBlocks[i][3], tmpBlocks[i][4], tmpBlocks[i][5], tmpBlocks[i][6], tmpBlocks[i][7], | |
192 | tmpBlocks[i][8], tmpBlocks[i][9], tmpBlocks[i][10], tmpBlocks[i][11], tmpBlocks[i][12], tmpBlocks[i][13], tmpBlocks[i][14], tmpBlocks[i][15]); | |
193 | if(!ident) { | |
194 | for(i=0; i<n; i++) { | |
195 | if(IsBlock0PCF7931(tmpBlocks[i])) { | |
196 | // Found block 0 ? | |
197 | if(i < n-1 && IsBlock1PCF7931(tmpBlocks[i+1])) { | |
198 | // Found block 1! | |
199 | // \o/ | |
200 | ident = 1; | |
201 | memcpy(Blocks[0], tmpBlocks[i], 16); | |
202 | Blocks[0][ALLOC] = 1; | |
203 | memcpy(Blocks[1], tmpBlocks[i+1], 16); | |
204 | Blocks[1][ALLOC] = 1; | |
205 | max_blocks = MAX((Blocks[1][14] & 0x7f), Blocks[1][15]) + 1; | |
206 | // Debug print | |
207 | Dbprintf("(dbg) Max blocks: %d", max_blocks); | |
208 | num_blocks = 2; | |
209 | // Handle following blocks | |
210 | for(j=i+2, ind2=2; j!=i; j++, ind2++, num_blocks++) { | |
211 | if(j==n) j=0; | |
212 | if(j==i) break; | |
213 | memcpy(Blocks[ind2], tmpBlocks[j], 16); | |
214 | Blocks[ind2][ALLOC] = 1; | |
215 | } | |
216 | break; | |
217 | } | |
218 | } | |
219 | } | |
220 | } | |
221 | else { | |
222 | for(i=0; i<n; i++) { // Look for identical block in known blocks | |
223 | if(memcmp(tmpBlocks[i], "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16)) { // Block is not full of 00 | |
224 | for(j=0; j<max_blocks; j++) { | |
225 | if(Blocks[j][ALLOC] == 1 && !memcmp(tmpBlocks[i], Blocks[j], 16)) { | |
226 | // Found an identical block | |
227 | for(ind=i-1,ind2=j-1; ind >= 0; ind--,ind2--) { | |
228 | if(ind2 < 0) | |
229 | ind2 = max_blocks; | |
230 | if(!Blocks[ind2][ALLOC]) { // Block ind2 not already found | |
231 | // Dbprintf("Tmp %d -> Block %d", ind, ind2); | |
232 | memcpy(Blocks[ind2], tmpBlocks[ind], 16); | |
233 | Blocks[ind2][ALLOC] = 1; | |
234 | num_blocks++; | |
235 | if(num_blocks == max_blocks) goto end; | |
236 | } | |
237 | } | |
238 | for(ind=i+1,ind2=j+1; ind < n; ind++,ind2++) { | |
239 | if(ind2 > max_blocks) | |
240 | ind2 = 0; | |
241 | if(!Blocks[ind2][ALLOC]) { // Block ind2 not already found | |
242 | // Dbprintf("Tmp %d -> Block %d", ind, ind2); | |
243 | memcpy(Blocks[ind2], tmpBlocks[ind], 16); | |
244 | Blocks[ind2][ALLOC] = 1; | |
245 | num_blocks++; | |
246 | if(num_blocks == max_blocks) goto end; | |
247 | } | |
248 | } | |
249 | } | |
250 | } | |
251 | } | |
252 | } | |
253 | } | |
254 | tries++; | |
255 | if (BUTTON_PRESS()) return; | |
256 | } while (num_blocks != max_blocks); | |
257 | end: | |
258 | Dbprintf("-----------------------------------------"); | |
259 | Dbprintf("Memory content:"); | |
260 | Dbprintf("-----------------------------------------"); | |
261 | for(i=0; i<max_blocks; i++) { | |
262 | if(Blocks[i][ALLOC]==1) | |
263 | Dbprintf("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x", | |
264 | Blocks[i][0], Blocks[i][1], Blocks[i][2], Blocks[i][3], Blocks[i][4], Blocks[i][5], Blocks[i][6], Blocks[i][7], | |
265 | Blocks[i][8], Blocks[i][9], Blocks[i][10], Blocks[i][11], Blocks[i][12], Blocks[i][13], Blocks[i][14], Blocks[i][15]); | |
266 | else | |
267 | Dbprintf("<missing block %d>", i); | |
268 | } | |
269 | Dbprintf("-----------------------------------------"); | |
270 | ||
271 | cmd_send(CMD_ACK,0,0,0,0,0); | |
272 | } | |
273 | ||
274 | ||
275 | /* Write on a byte of a PCF7931 tag | |
276 | * @param address : address of the block to write | |
277 | @param byte : address of the byte to write | |
278 | @param data : data to write | |
279 | */ | |
280 | void WritePCF7931(uint8_t pass1, uint8_t pass2, uint8_t pass3, uint8_t pass4, uint8_t pass5, uint8_t pass6, uint8_t pass7, uint16_t init_delay, int32_t l, int32_t p, uint8_t address, uint8_t byte, uint8_t data) | |
281 | { | |
282 | ||
283 | uint32_t tab[1024]={0}; // data times frame | |
284 | uint32_t u = 0; | |
285 | uint8_t parity = 0; | |
286 | bool comp = 0; | |
287 | ||
288 | //BUILD OF THE DATA FRAME | |
289 | ||
290 | //alimentation of the tag (time for initializing) | |
291 | AddPatternPCF7931(init_delay, 0, 8192/2*T0_PCF, tab); | |
292 | ||
293 | //PMC | |
294 | Dbprintf("Initialization delay : %d us", init_delay); | |
295 | AddPatternPCF7931(8192/2*T0_PCF + 319*T0_PCF+70, 3*T0_PCF, 29*T0_PCF, tab); | |
296 | ||
297 | Dbprintf("Offsets : %d us on the low pulses width, %d us on the low pulses positions", l, p); | |
298 | ||
299 | //password indication bit | |
300 | AddBitPCF7931(1, tab, l, p); | |
301 | ||
302 | ||
303 | //password (on 56 bits) | |
304 | Dbprintf("Password (LSB first on each byte) : %02x %02x %02x %02x %02x %02x %02x", pass1,pass2,pass3,pass4,pass5,pass6,pass7); | |
305 | AddBytePCF7931(pass1, tab, l, p); | |
306 | AddBytePCF7931(pass2, tab, l, p); | |
307 | AddBytePCF7931(pass3, tab, l, p); | |
308 | AddBytePCF7931(pass4, tab, l, p); | |
309 | AddBytePCF7931(pass5, tab, l, p); | |
310 | AddBytePCF7931(pass6, tab, l, p); | |
311 | AddBytePCF7931(pass7, tab, l, p); | |
312 | ||
313 | //programming mode (0 or 1) | |
314 | AddBitPCF7931(0, tab, l, p); | |
315 | ||
316 | //block adress on 6 bits | |
317 | Dbprintf("Block address : %02x", address); | |
318 | for (u=0; u<6; u++) | |
319 | { | |
320 | if (address&(1<<u)) { // bit 1 | |
321 | parity++; | |
322 | AddBitPCF7931(1, tab, l, p); | |
323 | } else{ // bit 0 | |
324 | AddBitPCF7931(0, tab, l, p); | |
325 | } | |
326 | } | |
327 | ||
328 | //byte address on 4 bits | |
329 | Dbprintf("Byte address : %02x", byte); | |
330 | for (u=0; u<4; u++) | |
331 | { | |
332 | if (byte&(1<<u)) { // bit 1 | |
333 | parity++; | |
334 | AddBitPCF7931(1, tab, l, p); | |
335 | } else{ // bit 0 | |
336 | AddBitPCF7931(0, tab, l, p); | |
337 | } | |
338 | } | |
339 | ||
340 | //data on 8 bits | |
341 | Dbprintf("Data : %02x", data); | |
342 | for (u=0; u<8; u++) | |
343 | { | |
344 | if (data&(1<<u)) { // bit 1 | |
345 | parity++; | |
346 | AddBitPCF7931(1, tab, l, p); | |
347 | } else{ //bit 0 | |
348 | AddBitPCF7931(0, tab, l, p); | |
349 | } | |
350 | } | |
351 | ||
352 | ||
353 | //parity bit | |
354 | if((parity%2)==0){ | |
355 | AddBitPCF7931(0, tab, l, p); //even parity | |
356 | }else{ | |
357 | AddBitPCF7931(1, tab, l, p);//odd parity | |
358 | } | |
359 | ||
360 | //time access memory | |
361 | AddPatternPCF7931(5120+2680, 0, 0, tab); | |
362 | ||
363 | //conversion of the scale time | |
364 | for(u=0;u<500;u++){ | |
365 | tab[u]=(tab[u] * 3)/2; | |
366 | } | |
367 | ||
368 | ||
369 | //compennsation of the counter reload | |
370 | while (!comp){ | |
371 | comp = 1; | |
372 | for(u=0;tab[u]!=0;u++){ | |
373 | if(tab[u] > 0xFFFF){ | |
374 | tab[u] -= 0xFFFF; | |
375 | comp = 0; | |
376 | } | |
377 | } | |
378 | } | |
379 | ||
380 | SendCmdPCF7931(tab); | |
381 | } | |
382 | ||
383 | ||
384 | ||
385 | /* Send a trame to a PCF7931 tags | |
386 | * @param tab : array of the data frame | |
387 | */ | |
388 | ||
389 | void SendCmdPCF7931(uint32_t * tab){ | |
390 | uint16_t u=0; | |
391 | uint16_t tempo=0; | |
392 | ||
393 | Dbprintf("SENDING DATA FRAME..."); | |
394 | ||
395 | FpgaDownloadAndGo(FPGA_BITSTREAM_LF); | |
396 | ||
397 | FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz | |
398 | ||
399 | FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU ); | |
400 | ||
401 | LED_A_ON(); | |
402 | ||
403 | // steal this pin from the SSP and use it to control the modulation | |
404 | AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; | |
405 | AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; | |
406 | ||
407 | //initialization of the timer | |
408 | AT91C_BASE_PMC->PMC_PCER |= (0x1 << 12) | (0x1 << 13) | (0x1 << 14); | |
409 | AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE; | |
410 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable | |
411 | AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK; //clock at 48/32 MHz | |
412 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN; | |
413 | AT91C_BASE_TCB->TCB_BCR = 1; | |
414 | ||
415 | ||
416 | tempo = AT91C_BASE_TC0->TC_CV; | |
417 | for(u=0;tab[u]!= 0;u+=3){ | |
418 | ||
419 | ||
420 | // modulate antenna | |
421 | HIGH(GPIO_SSC_DOUT); | |
422 | while(tempo != tab[u]){ | |
423 | tempo = AT91C_BASE_TC0->TC_CV; | |
424 | } | |
425 | ||
426 | // stop modulating antenna | |
427 | LOW(GPIO_SSC_DOUT); | |
428 | while(tempo != tab[u+1]){ | |
429 | tempo = AT91C_BASE_TC0->TC_CV; | |
430 | } | |
431 | ||
432 | ||
433 | // modulate antenna | |
434 | HIGH(GPIO_SSC_DOUT); | |
435 | while(tempo != tab[u+2]){ | |
436 | tempo = AT91C_BASE_TC0->TC_CV; | |
437 | } | |
438 | ||
439 | ||
440 | } | |
441 | ||
442 | LED_A_OFF(); | |
443 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); | |
444 | SpinDelay(200); | |
445 | ||
446 | ||
447 | AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable | |
448 | DbpString("FINISH !"); | |
449 | DbpString("(Could be usefull to send the same trame many times)"); | |
450 | LED(0xFFFF, 1000); | |
451 | } | |
452 | ||
453 | ||
454 | /* Add a byte for building the data frame of PCF7931 tags | |
455 | * @param b : byte to add | |
456 | * @param tab : array of the data frame | |
457 | * @param l : offset on low pulse width | |
458 | * @param p : offset on low pulse positioning | |
459 | */ | |
460 | ||
461 | bool AddBytePCF7931(uint8_t byte, uint32_t * tab, int32_t l, int32_t p){ | |
462 | ||
463 | uint32_t u; | |
464 | for (u=0; u<8; u++) | |
465 | { | |
466 |