1 //-----------------------------------------------------------------------------
2 // The main application code. This is the first thing called after start.c
4 // Jonathan Westhues, Mar 2006
5 // Edits by Gerhard de Koning Gans, Sep 2007 (##)
6 //-----------------------------------------------------------------------------
16 // The large multi-purpose buffer, typically used to hold A/D samples,
17 // maybe pre-processed in some way.
20 //=============================================================================
21 // A buffer where we can queue things up to be sent through the FPGA, for
22 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
23 // is the order in which they go out on the wire.
24 //=============================================================================
31 void BufferClear(void)
33 memset(BigBuf
,0,sizeof(BigBuf
));
34 DbpString("Buffer cleared");
37 void ToSendReset(void)
43 void ToSendStuffBit(int b
)
47 ToSend
[ToSendMax
] = 0;
52 ToSend
[ToSendMax
] |= (1 << (7 - ToSendBit
));
57 if(ToSendBit
>= sizeof(ToSend
)) {
59 DbpString("ToSendStuffBit overflowed!");
63 //=============================================================================
64 // Debug print functions, to go out over USB, to the usual PC-side client.
65 //=============================================================================
67 void DbpString(char *str
)
70 c
.cmd
= CMD_DEBUG_PRINT_STRING
;
72 memcpy(c
.d
.asBytes
, str
, c
.ext1
);
74 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
75 // TODO fix USB so stupid things like this aren't req'd
79 void DbpIntegers(int x1
, int x2
, int x3
)
82 c
.cmd
= CMD_DEBUG_PRINT_INTEGERS
;
87 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
92 void AcquireRawAdcSamples125k(BOOL at134khz
)
94 BYTE
*dest
= (BYTE
*)BigBuf
;
95 int n
= sizeof(BigBuf
);
101 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
102 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_134_KHZ
);
104 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
105 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_125_KHZ
);
108 // Connect the A/D to the peak-detected low-frequency path.
109 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
111 // Give it a bit of time for the resonant antenna to settle.
114 // Now set up the SSC to get the ADC samples that are now streaming at us.
119 if(SSC_STATUS
& (SSC_STATUS_TX_READY
)) {
120 SSC_TRANSMIT_HOLDING
= 0x43;
123 if(SSC_STATUS
& (SSC_STATUS_RX_READY
)) {
124 dest
[i
] = (BYTE
)SSC_RECEIVE_HOLDING
;
132 DbpIntegers(dest
[0], dest
[1], at134khz
);
135 //-----------------------------------------------------------------------------
136 // Read an ADC channel and block till it completes, then return the result
137 // in ADC units (0 to 1023). Also a routine to average 32 samples and
139 //-----------------------------------------------------------------------------
140 static int ReadAdc(int ch
)
144 ADC_CONTROL
= ADC_CONTROL_RESET
;
145 ADC_MODE
= ADC_MODE_PRESCALE(32) | ADC_MODE_STARTUP_TIME(16) |
146 ADC_MODE_SAMPLE_HOLD_TIME(8);
147 ADC_CHANNEL_ENABLE
= ADC_CHANNEL(ch
);
149 ADC_CONTROL
= ADC_CONTROL_START
;
150 while(!(ADC_STATUS
& ADC_END_OF_CONVERSION(ch
)))
152 d
= ADC_CHANNEL_DATA(ch
);
157 static int AvgAdc(int ch
)
162 for(i
= 0; i
< 32; i
++) {
166 return (a
+ 15) >> 5;
170 * Sweeps the useful LF range of the proxmark from
171 * 46.8kHz (divisor=255) to 600kHz (divisor=19) and
172 * reads the voltage in the antenna: the result is a graph
173 * which should clearly show the resonating frequency of your
174 * LF antenna ( hopefully around 90 if it is tuned to 125kHz!)
178 BYTE
*dest
= (BYTE
*)BigBuf
;
182 memset(BigBuf
,0,sizeof(BigBuf
));
184 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
185 for (i
=255; i
>19; i
--) {
186 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, i
);
188 dest
[i
] = (137500 * AvgAdc(4)) >> 18;
192 void MeasureAntennaTuning(void)
194 // Impedances are Zc = 1/(j*omega*C), in ohms
195 #define LF_TUNING_CAP_Z 1273 // 1 nF @ 125 kHz
196 #define HF_TUNING_CAP_Z 235 // 50 pF @ 13.56 MHz
198 int vLf125
, vLf134
, vHf
; // in mV
202 // Let the FPGA drive the low-frequency antenna around 125 kHz.
203 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
204 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_125_KHZ
);
207 // Vref = 3.3V, and a 10000:240 voltage divider on the input
208 // can measure voltages up to 137500 mV
209 vLf125
= (137500 * vLf125
) >> 10;
211 // Let the FPGA drive the low-frequency antenna around 134 kHz.
212 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
213 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_134_KHZ
);
216 // Vref = 3.3V, and a 10000:240 voltage divider on the input
217 // can measure voltages up to 137500 mV
218 vLf134
= (137500 * vLf134
) >> 10;
220 // Let the FPGA drive the high-frequency antenna around 13.56 MHz.
221 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
);
224 // Vref = 3300mV, and an 10:1 voltage divider on the input
225 // can measure voltages up to 33000 mV
226 vHf
= (33000 * vHf
) >> 10;
228 c
.cmd
= CMD_MEASURED_ANTENNA_TUNING
;
229 c
.ext1
= (vLf125
<< 0) | (vLf134
<< 16);
231 c
.ext3
= (LF_TUNING_CAP_Z
<< 0) | (HF_TUNING_CAP_Z
<< 16);
232 UsbSendPacket((BYTE
*)&c
, sizeof(c
));
235 void SimulateTagLowFrequency(int period
)
238 BYTE
*tab
= (BYTE
*)BigBuf
;
240 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR
);
242 PIO_ENABLE
= (1 << GPIO_SSC_DOUT
) | (1 << GPIO_SSC_CLK
);
244 PIO_OUTPUT_ENABLE
= (1 << GPIO_SSC_DOUT
);
245 PIO_OUTPUT_DISABLE
= (1 << GPIO_SSC_CLK
);
247 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
248 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
252 while(!(PIO_PIN_DATA_STATUS
& (1<<GPIO_SSC_CLK
))) {
267 while(PIO_PIN_DATA_STATUS
& (1<<GPIO_SSC_CLK
)) {
275 if(i
== period
) i
= 0;
279 // compose fc/8 fc/10 waveform
280 static void fc(int c
, int *n
) {
281 BYTE
*dest
= (BYTE
*)BigBuf
;
284 // for when we want an fc8 pattern every 4 logical bits
295 // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
297 for (idx
=0; idx
<6; idx
++) {
309 // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
311 for (idx
=0; idx
<5; idx
++) {
326 // prepare a waveform pattern in the buffer based on the ID given then
327 // simulate a HID tag until the button is pressed
328 static void CmdHIDsimTAG(int hi
, int lo
)
332 HID tag bitstream format
333 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
334 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
335 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
336 A fc8 is inserted before every 4 bits
337 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
338 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
342 DbpString("Tags can only have 44 bits.");
346 // special start of frame marker containing invalid bit sequences
347 fc(8, &n
); fc(8, &n
); // invalid
348 fc(8, &n
); fc(10, &n
); // logical 0
349 fc(10, &n
); fc(10, &n
); // invalid
350 fc(8, &n
); fc(10, &n
); // logical 0
353 // manchester encode bits 43 to 32
354 for (i
=11; i
>=0; i
--) {
355 if ((i
%4)==3) fc(0,&n
);
357 fc(10, &n
); fc(8, &n
); // low-high transition
359 fc(8, &n
); fc(10, &n
); // high-low transition
364 // manchester encode bits 31 to 0
365 for (i
=31; i
>=0; i
--) {
366 if ((i
%4)==3) fc(0,&n
);
368 fc(10, &n
); fc(8, &n
); // low-high transition
370 fc(8, &n
); fc(10, &n
); // high-low transition
375 SimulateTagLowFrequency(n
);
379 // loop to capture raw HID waveform then FSK demodulate the TAG ID from it
380 static void CmdHIDdemodFSK(void)
382 BYTE
*dest
= (BYTE
*)BigBuf
;
383 int m
=0, n
=0, i
=0, idx
=0, found
=0, lastval
=0;
386 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
387 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
| FPGA_LF_READER_USE_125_KHZ
);
389 // Connect the A/D to the peak-detected low-frequency path.
390 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
392 // Give it a bit of time for the resonant antenna to settle.
395 // Now set up the SSC to get the ADC samples that are now streaming at us.
410 if(SSC_STATUS
& (SSC_STATUS_TX_READY
)) {
411 SSC_TRANSMIT_HOLDING
= 0x43;
414 if(SSC_STATUS
& (SSC_STATUS_RX_READY
)) {
415 dest
[i
] = (BYTE
)SSC_RECEIVE_HOLDING
;
416 // we don't care about actual value, only if it's more or less than a
417 // threshold essentially we capture zero crossings for later analysis
418 if(dest
[i
] < 127) dest
[i
] = 0; else dest
[i
] = 1;
429 // sync to first lo-hi transition
430 for( idx
=1; idx
<m
; idx
++) {
431 if (dest
[idx
-1]<dest
[idx
])
437 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
438 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
439 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
440 for( i
=0; idx
<m
; idx
++) {
441 if (dest
[idx
-1]<dest
[idx
]) {
456 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
461 for( idx
=0; idx
<m
; idx
++) {
462 if (dest
[idx
]==lastval
) {
465 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
466 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
467 // swallowed up by rounding
468 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
469 // special start of frame markers use invalid manchester states (no transitions) by using sequences
472 n
=(n
+1)/6; // fc/8 in sets of 6
474 n
=(n
+1)/5; // fc/10 in sets of 5
476 switch (n
) { // stuff appropriate bits in buffer
479 dest
[i
++]=dest
[idx
-1];
482 dest
[i
++]=dest
[idx
-1];
483 dest
[i
++]=dest
[idx
-1];
485 case 3: // 3 bit start of frame markers
486 dest
[i
++]=dest
[idx
-1];
487 dest
[i
++]=dest
[idx
-1];
488 dest
[i
++]=dest
[idx
-1];
490 // When a logic 0 is immediately followed by the start of the next transmisson
491 // (special pattern) a pattern of 4 bit duration lengths is created.
493 dest
[i
++]=dest
[idx
-1];
494 dest
[i
++]=dest
[idx
-1];
495 dest
[i
++]=dest
[idx
-1];
496 dest
[i
++]=dest
[idx
-1];
498 default: // this shouldn't happen, don't stuff any bits
508 // final loop, go over previously decoded manchester data and decode into usable tag ID
509 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
510 for( idx
=0; idx
<m
-6; idx
++) {
511 // search for a start of frame marker
512 if ( dest
[idx
] && dest
[idx
+1] && dest
[idx
+2] && (!dest
[idx
+3]) && (!dest
[idx
+4]) && (!dest
[idx
+5]) )
516 if (found
&& (hi
|lo
)) {
518 DbpIntegers(hi
, lo
, (lo
>>1)&0xffff);
525 if (dest
[idx
] && (!dest
[idx
+1]) ) {
528 } else if ( (!dest
[idx
]) && dest
[idx
+1]) {
538 if ( dest
[idx
] && dest
[idx
+1] && dest
[idx
+2] && (!dest
[idx
+3]) && (!dest
[idx
+4]) && (!dest
[idx
+5]) )
542 if (found
&& (hi
|lo
)) {
544 DbpIntegers(hi
, lo
, (lo
>>1)&0xffff);
555 void SimulateTagHfListen(void)
557 BYTE
*dest
= (BYTE
*)BigBuf
;
558 int n
= sizeof(BigBuf
);
563 // We're using this mode just so that I can test it out; the simulated
564 // tag mode would work just as well and be simpler.
565 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR
| FPGA_HF_READER_RX_XCORR_848_KHZ
| FPGA_HF_READER_RX_XCORR_SNOOP
);
567 // We need to listen to the high-frequency, peak-detected path.
568 SetAdcMuxFor(GPIO_MUXSEL_HIPKD
);
574 if(SSC_STATUS
& (SSC_STATUS_TX_READY
)) {
575 SSC_TRANSMIT_HOLDING
= 0xff;
577 if(SSC_STATUS
& (SSC_STATUS_RX_READY
)) {
578 BYTE r
= (BYTE
)SSC_RECEIVE_HOLDING
;
598 DbpString("simulate tag (now type bitsamples)");
601 void UsbPacketReceived(BYTE
*packet
, int len
)
603 UsbCommand
*c
= (UsbCommand
*)packet
;
606 case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
:
607 AcquireRawAdcSamples125k(c
->ext1
);
610 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693
:
611 AcquireRawAdcSamplesIso15693();
618 case CMD_READER_ISO_15693
:
619 ReaderIso15693(c
->ext1
);
622 case CMD_SIMTAG_ISO_15693
:
623 SimTagIso15693(c
->ext1
);
626 case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443
:
627 AcquireRawAdcSamplesIso14443(c
->ext1
);
630 case CMD_READ_SRI512_TAG
:
631 ReadSRI512Iso14443(c
->ext1
);
634 case CMD_READER_ISO_14443a
:
635 ReaderIso14443a(c
->ext1
);
638 case CMD_SNOOP_ISO_14443
:
642 case CMD_SNOOP_ISO_14443a
:
646 case CMD_SIMULATE_TAG_HF_LISTEN
:
647 SimulateTagHfListen();
650 case CMD_SIMULATE_TAG_ISO_14443
:
651 SimulateIso14443Tag();
654 case CMD_SIMULATE_TAG_ISO_14443a
:
655 SimulateIso14443aTag(c
->ext1
, c
->ext2
); // ## Simulate iso14443a tag - pass tag type & UID
658 case CMD_MEASURE_ANTENNA_TUNING
:
659 MeasureAntennaTuning();
662 case CMD_HID_DEMOD_FSK
:
663 CmdHIDdemodFSK(); // Demodulate HID tag
666 case CMD_HID_SIM_TAG
:
667 CmdHIDsimTAG(c
->ext1
, c
->ext2
); // Simulate HID tag by ID
670 case CMD_FPGA_MAJOR_MODE_OFF
: // ## FPGA Control
671 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
673 LED_D_OFF(); // LED D indicates field ON or OFF
676 case CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
:
677 case CMD_DOWNLOAD_RAW_BITS_TI_TYPE
: {
679 if(c
->cmd
== CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
) {
680 n
.cmd
= CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K
;
682 n
.cmd
= CMD_DOWNLOADED_RAW_BITS_TI_TYPE
;
685 memcpy(n
.d
.asDwords
, BigBuf
+c
->ext1
, 12*sizeof(DWORD
));
686 UsbSendPacket((BYTE
*)&n
, sizeof(n
));
689 case CMD_DOWNLOADED_SIM_SAMPLES_125K
: {
690 BYTE
*b
= (BYTE
*)BigBuf
;
691 memcpy(b
+c
->ext1
, c
->d
.asBytes
, 48);
694 case CMD_SIMULATE_TAG_125K
:
696 SimulateTagLowFrequency(c
->ext1
);
708 case CMD_SET_LF_DIVISOR
:
709 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, c
->ext1
);
716 case CMD_SETUP_WRITE
:
717 case CMD_FINISH_WRITE
:
718 case CMD_HARDWARE_RESET
:
719 USB_D_PLUS_PULLUP_OFF();
722 RSTC_CONTROL
= RST_CONTROL_KEY
| RST_CONTROL_PROCESSOR_RESET
;
724 // We're going to reset, and the bootrom will take control.
730 DbpString("unknown command");
737 memset(BigBuf
,0,sizeof(BigBuf
));
747 // The FPGA gets its clock from us from PCK0 output, so set that up.
748 PIO_PERIPHERAL_B_SEL
= (1 << GPIO_PCK0
);
749 PIO_DISABLE
= (1 << GPIO_PCK0
);
750 PMC_SYS_CLK_ENABLE
= PMC_SYS_CLK_PROGRAMMABLE_CLK_0
;
751 // PCK0 is PLL clock / 4 = 96Mhz / 4 = 24Mhz
752 PMC_PROGRAMMABLE_CLK_0
= PMC_CLK_SELECTION_PLL_CLOCK
|
753 PMC_CLK_PRESCALE_DIV_4
;
754 PIO_OUTPUT_ENABLE
= (1 << GPIO_PCK0
);
757 SPI_CONTROL
= SPI_CONTROL_RESET
;
759 SSC_CONTROL
= SSC_CONTROL_RESET
;
761 // Load the FPGA image, which we have stored in our flash.
768 // test text on different colored backgrounds
769 LCDString(" The quick brown fox ", &FONT6x8
,1,1+8*0,WHITE
,BLACK
);
770 LCDString(" jumped over the ", &FONT6x8
,1,1+8*1,BLACK
,WHITE
);
771 LCDString(" lazy dog. ", &FONT6x8
,1,1+8*2,YELLOW
,RED
);
772 LCDString(" AaBbCcDdEeFfGgHhIiJj ", &FONT6x8
,1,1+8*3,RED
,GREEN
);
773 LCDString(" KkLlMmNnOoPpQqRrSsTt ", &FONT6x8
,1,1+8*4,MAGENTA
,BLUE
);
774 LCDString("UuVvWwXxYyZz0123456789", &FONT6x8
,1,1+8*5,BLUE
,YELLOW
);
775 LCDString("`-=[]_;',./~!@#$%^&*()", &FONT6x8
,1,1+8*6,BLACK
,CYAN
);
776 LCDString(" _+{}|:\\\"<>? ",&FONT6x8
,1,1+8*7,BLUE
,MAGENTA
);
779 LCDFill(0, 1+8* 8, 132, 8, BLACK
);
780 LCDFill(0, 1+8* 9, 132, 8, WHITE
);
781 LCDFill(0, 1+8*10, 132, 8, RED
);
782 LCDFill(0, 1+8*11, 132, 8, GREEN
);
783 LCDFill(0, 1+8*12, 132, 8, BLUE
);
784 LCDFill(0, 1+8*13, 132, 8, YELLOW
);
785 LCDFill(0, 1+8*14, 132, 8, CYAN
);
786 LCDFill(0, 1+8*15, 132, 8, MAGENTA
);
796 void SpinDelay(int ms
)
798 int ticks
= (48000*ms
) >> 10;
800 // Borrow a PWM unit for my real-time clock
801 PWM_ENABLE
= PWM_CHANNEL(0);
802 // 48 MHz / 1024 gives 46.875 kHz
803 PWM_CH_MODE(0) = PWM_CH_MODE_PRESCALER(10);
804 PWM_CH_DUTY_CYCLE(0) = 0;
805 PWM_CH_PERIOD(0) = 0xffff;
807 WORD start
= (WORD
)PWM_CH_COUNTER(0);
810 WORD now
= (WORD
)PWM_CH_COUNTER(0);
811 if(now
== (WORD
)(start
+ ticks
)) {